caracms 0.3.3 → 0.4.0

package/src/editor/server/move.ts

@@ -18,41 +18,46 @@
  *   it's free in every collection (the document's own address aside), not under
  *   `/admin` or `/_caracms`, not strictly below another collection's `urlBase`. The
  *   same address is refused (`same`): there's nothing to change.
- * - **Pages under it stay where they are** (as on a delete, M5a Decision 12): moving
- *   Services moves Services' own page, and its pages keep their addresses, as a group.
+ * - **Everything under it moves with it** (collections under pages, Decision 9; a delete
+ *   still leaves them, M5a Decision 12): moving Services to /offerings carries
+ *   /services/branding to /offerings/branding, and a page that holds a collection carries
+ *   its documents' addresses (`movesUnder`, `planMoves`). The whole plan is checked, then
+ *   lands all or nothing: the many-move engine (Contracts), which the arrange screen reuses.
  *
- * What a move changes (`moveChanges`), worked out from the store's own texts:
+ * What a move changes (`movesChanges`), worked out from the store's own texts, each file once for every move:
  *
  * - the document, at its new path, with its own links to itself rewritten;
  * - **every other document that links to it or references it** (relink.ts), Site
  *   Settings included, each changed only where it points at the old address;
  * - **Site Settings' redirects** (redirects.ts): entries to the old address go to the
  *   new one (chains collapse), an entry from the new address goes (a page is there
- *   now), and `old → new` is added, unless the document was never live (`addRedirect`
- *   false: live mode's document made since the last Publish).
+ *   now), and `old → new` is added, unless the request says not to (`redirect: false`,
+ *   Change address…'s box unticked: pages shuffled before a site launches need none)
+ *   or the document was never live (live mode's document made since the last Publish).
+ *   Either way `addRedirect` is false; the chains still collapse.
  *
- * On disk the order is: the new file (an exclusive create), the rewritten files, Site
- * Settings, then the old file goes. A failure part way leaves the old document where
- * it was, never no document.
+ * On disk the order is: the new files (exclusive creates), the rewritten files, Site
+ * Settings, then the old files go; a failure part way puts every file back (`movesOnDisk`).
  */
-import { writeFile } from 'node:fs/promises';
+import { readFile, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { SITE_SETTINGS_FILE, type ResolvedCollection, type ResolvedSite } from '../../config.ts';
 import { documentUrl, type DocumentEntry } from '../../content.ts';
+import { heldBases, withHeldBases, type HeldBase } from '../../held.ts';
 import { own, parseAnyDocument, type SettingsDocument } from '../../document.ts';
 import type { Person } from '../../live/messages.ts';
-import { redirectsAfterMove, type Redirect } from '../../redirects.ts';
+import { redirectsAddedBy, redirectsAfterMoves, type Redirect } from '../../redirects.ts';
 import { relinkText, type AddressMove } from '../../relink.ts';
 import { schemaRef, stampSchema } from '../../schema-key.ts';
 import { applyKeyedEdits } from '../../serialize.ts';
-import { addressProblem, INDEX_MESSAGE, isSlug, NO_ADDRESS_MESSAGE, RESERVED_SLUG, slugify } from '../../slug.ts';
+import { addressProblem, INDEX_MESSAGE, isSlug, NO_ADDRESS_MESSAGE, RESERVED_SLUG, sameAddress, slugify } from '../../slug.ts';
 import { RELEASE_HEADER, type MoveRequest, type MoveResponse } from '../types.ts';
 import { confineOnDisk, createOnDisk, deleteOnDisk, MAX_CREATE_BODY_BYTES, refused, target, type Target } from './create.ts';
 import { checkOrigin, seqOf, tabOf, WriteRefused, writeAtomic, type WriteContext } from './write.ts';
 
 type Site = Pick<ResolvedSite, 'root' | 'collections' | 'blocks' | 'codeRoutes'>;
 
-const MOVE_SHAPE = '{ collection, path, to }';
+const MOVE_SHAPE = '{ collection, path, to, redirect? }';
 
 /** A path for a message: control characters shown escaped, long ones cut. */
 const printable = (value: string) => {
@@ -64,26 +69,54 @@ const printable = (value: string) => {
 export function parseMoveBody(body: unknown): MoveRequest {
 	if (!body || typeof body !== 'object' || Array.isArray(body)) throw refused(400, 'bad-request', `Malformed body: it must be a JSON object. Send ${MOVE_SHAPE}.`);
 	const b = body as Record<string, unknown>;
-	const extra = Object.keys(b).filter((k) => !['collection', 'path', 'to'].includes(k));
+	const extra = Object.keys(b).filter((k) => !['collection', 'path', 'to', 'redirect'].includes(k));
 	if (extra.length) throw refused(400, 'bad-request', `Malformed body: unexpected ${extra.map((k) => `"${printable(k)}"`).join(', ')}. Send ${MOVE_SHAPE}.`);
 	if (typeof b.collection !== 'string' || b.collection === '') throw refused(400, 'bad-request', `Malformed body: "collection" must be a collection's name. Send ${MOVE_SHAPE}.`);
 	if (typeof b.path !== 'string' || b.path === '') throw refused(400, 'bad-request', `Malformed body: "path" must be the document's path in its collection. Send ${MOVE_SHAPE}.`);
 	if (typeof b.to !== 'string') throw refused(400, 'bad-request', `Malformed body: "to" must be the document's new path in its collection. Send ${MOVE_SHAPE}.`);
+	if (b.redirect !== undefined && typeof b.redirect !== 'boolean') throw refused(400, 'bad-request', `Malformed body: "redirect" must be true or false. Send ${MOVE_SHAPE}.`);
 	if (b.path.length > 512 || b.to.length > 512) throw refused(400, 'bad-path', 'That path is too long.');
-	return { collection: b.collection, path: b.path, to: b.to };
+	return { collection: b.collection, path: b.path, to: b.to, ...(b.redirect === false ? { redirect: false } : {}) };
 }
 
+/** One document's new path in its collection: the many-move engine's unit (Contracts). */
+export interface PathMove {
+	collection: string;
+	path: string;
+	to: string;
+}
+
+/**
+ * The many-move engine's request (collections under pages, Decision 9 and Contracts):
+ * every document whose path changes, any collections, any number; the one redirect
+ * choice; and an optional change to Site Settings' text that lands, or rolls back, with
+ * the redirects (the arrange screen's saved order). A held document whose holder moves
+ * keeps its path, so it's never listed: the plan adds it.
+ */
+export interface ManyMoveRequest {
+	moves: readonly PathMove[];
+	/** Whether to leave redirects from the old addresses (default true). A document that was never live gets none either way. */
+	redirect?: boolean;
+	/** A pure function, Site Settings' text → its text, applied after the redirects are folded in. */
+	editSettings?: (text: string) => string;
+}
+
+/** One address that changes. */
 export interface MovePlan {
 	from: Target & { entry: DocumentEntry; url: string };
 	to: Target & { url: string };
 	move: AddressMove;
 	title: string;
+	/** False for a held document whose holder moved: its file stays where it is, only its address changes. */
+	refiled: boolean;
 }
 
-/** Check a move against the rules and the store's listing (every document, every collection). Throws WriteRefused. */
-export function planMove(site: Site, request: MoveRequest, documents: readonly DocumentEntry[]): MovePlan {
+/** The individual rules for one requested move, against the listing as it is. Throws WriteRefused. */
+function checkOne(site: Site, bases: Readonly<Record<string, HeldBase>>, request: PathMove, documents: readonly DocumentEntry[]) {
 	const collection = own(site.collections, request.collection);
 	if (!collection) throw refused(400, 'bad-path', `No collection "${printable(request.collection)}" is declared.`);
+	const unheld = own(bases, collection.name)?.problem;
+	if (unheld) throw refused(400, 'not-held', unheld);
 	if (collection.urlBase === null) {
 		const what = collection.kind === 'shared' ? 'A shared block' : collection.kind === 'settings' ? 'Site Settings' : `${collection.label} has no pages of its own, so a document there`;
 		throw refused(400, 'not-allowed', `${what} has no address to change.`);
@@ -110,40 +143,142 @@ export function planMove(site: Site, request: MoveRequest, documents: readonly D
 		const better = slugify(part);
 		throw refused(400, 'bad-name', better ? `"${printable(part)}" can't be part of an address; "${better}" can.` : NO_ADDRESS_MESSAGE);
 	});
-	const toUrl = documentUrl(collection, to.path)!;
-	if (documents.some((d) => d.file === to.file)) throw refused(409, 'address-taken', `There's already a page at ${toUrl}.`);
-	const others = documents.filter((d) => d.file !== from.file);
-	const collections = Object.values(site.collections).map(({ name, label, urlBase }) => ({ name, label, urlBase }));
-	const problem = addressProblem(toUrl, collection.name, collections, others, site.codeRoutes);
-	if (problem) throw refused(problem.code === 'address-taken' ? 409 : 400, problem.code, problem.message);
-	return {
-		from: { ...from, entry, url: fromUrl },
-		to: { ...to, url: toUrl },
-		move: { collection: collection.name, fromPath: from.path, toPath: to.path, fromUrl, toUrl },
-		title: entry.label,
-	};
+	return { collection, from: { ...from, entry, url: fromUrl }, to };
+}
+
+/**
+ * Change address… on a page (Decision 9): the page, then every page under it at any
+ * depth, each at the same place under the new address. (Held documents follow their
+ * holder in `planMoves`.) Anything else is the one move asked for.
+ */
+export function movesUnder(site: Pick<Site, 'collections'>, request: Pick<PathMove, 'collection' | 'path' | 'to'>, documents: readonly DocumentEntry[]): PathMove[] {
+	const root: PathMove = { collection: request.collection, path: request.path, to: request.to };
+	const collection = own(site.collections, request.collection);
+	if (!collection?.nested || request.to === request.path) return [root];
+	if (request.to.startsWith(`${request.path}/`)) {
+		const label = documents.find((d) => d.collection === collection.name && d.path === request.path)?.label ?? request.path;
+		throw refused(400, 'not-allowed', `${label} can't go under itself.`);
+	}
+	const under = documents.filter((d) => d.collection === collection.name && d.path.startsWith(`${request.path}/`));
+	// A file under it that can't be opened has no address to carry: it would be left behind as a group.
+	const broken = under.find((d) => d.warning);
+	if (broken) {
+		const label = documents.find((d) => d.collection === collection.name && d.path === request.path)?.label ?? request.path;
+		throw refused(400, 'not-allowed', `${broken.file} is under ${label} and can't be opened, so ${label} can't move with everything under it. Fix or delete that file first.`);
+	}
+	return [root, ...under.map((d) => ({ collection: d.collection, path: d.path, to: `${request.to}${d.path.slice(request.path.length)}` }))];
+}
+
+/**
+ * Check a whole plan against the rules and the store's listing at call time (every
+ * document, every collection), and work out every address that changes: the requested
+ * moves, in order, then the documents of each held collection whose holder's address
+ * changes. Each requested move follows a single move's rules; then, as a whole, every new
+ * address must be free of documents (as they'll be once the plan has landed, so a swap is
+ * fine) and code routes, none reserved, and no two moves may land on one address.
+ * Throws WriteRefused, naming the first problem.
+ */
+export function planMoves(configured: Site, requests: readonly PathMove[], documents: readonly DocumentEntry[]): MovePlan[] {
+	if (requests.length === 0) throw refused(400, 'bad-request', 'Nothing to move.');
+	// Collections under pages (Decision 7): a held collection's base is resolved from the listing.
+	const before = heldBases(configured.collections, documents);
+	const site = withHeldBases(configured, before);
+	const checked = requests.map((r) => checkOne(site, before, r, documents));
+	const moving = new Map<string, (typeof checked)[number]>();
+	for (const c of checked) {
+		if (moving.has(c.from.file)) throw refused(400, 'bad-request', `${c.from.entry.label} is in the plan twice.`);
+		moving.set(c.from.file, c);
+	}
+
+	// The listing once the plan has landed: moved documents at their new paths, then every
+	// held collection's base worked out again from it (a holder may have moved).
+	const shifted = documents.map((d) => {
+		const c = moving.get(d.file);
+		return c ? { ...d, path: c.to.path, file: c.to.file, url: documentUrl(site.collections[d.collection]!, c.to.path) } : d;
+	});
+	const after = heldBases(configured.collections, shifted);
+	const landed = withHeldBases(configured, after);
+	const urlAfter = (d: { collection: string; path: string }) => documentUrl(landed.collections[d.collection]!, d.path);
+
+	const plans: MovePlan[] = checked.map((c) => {
+		const toUrl = urlAfter(c.to);
+		if (toUrl === null) throw refused(400, 'not-held', own(after, c.collection.name)?.problem ?? `${c.from.entry.label} would have no address.`);
+		return {
+			from: c.from,
+			to: { ...c.to, url: toUrl },
+			move: { collection: c.collection.name, fromPath: c.from.path, toPath: c.to.path, fromUrl: c.from.url, toUrl },
+			title: c.from.entry.label,
+			refiled: true,
+		};
+	});
+	// Each held collection whose holder's address changes: its documents follow, each an ordinary move (Decision 3).
+	for (const b of Object.values(before)) {
+		const next = after[b.collection];
+		if (b.base === null || !next?.base || next.base === b.base) continue;
+		for (const d of documents) {
+			if (d.collection !== b.collection || d.warning || moving.has(d.file)) continue;
+			const fromUrl = documentUrl(site.collections[d.collection]!, d.path);
+			const toUrl = urlAfter(d);
+			if (fromUrl === null || toUrl === null) continue;
+			const at = target(site, d.collection, d.path);
+			plans.push({ from: { ...at, entry: d, url: fromUrl }, to: { ...at, url: toUrl }, move: { collection: d.collection, fromPath: d.path, toPath: d.path, fromUrl, toUrl }, title: d.label, refiled: false });
+		}
+	}
+
+	// As a whole: every new address free, none reserved, no two moves to one.
+	const lead = (p: MovePlan, i: number) => (i === 0 ? '' : `${p.title} would move to ${p.to.url}. `);
+	const listedAfter = shifted.map((d) => ({ ...d, url: urlAfter(d) }));
+	const collections = Object.values(landed.collections).map(({ name, label, urlBase, heldBy }) => ({ name, label, urlBase, heldBy }));
+	const vacated = new Set(plans.filter((p) => p.refiled).map((p) => p.from.file));
+	const seen = new Map<string, MovePlan>();
+	plans.forEach((p, i) => {
+		const key = sameAddress(p.to.url);
+		const twice = seen.get(key);
+		if (twice) throw refused(409, 'address-taken', `${twice.title} and ${p.title} would both be at ${p.to.url}.`);
+		seen.set(key, p);
+		if (p.refiled && !vacated.has(p.to.file) && documents.some((d) => d.file === p.to.file)) throw refused(409, 'address-taken', `${lead(p, i)}There's already a page at ${p.to.url}.`);
+		const others = listedAfter.filter((d) => d.file !== p.to.file);
+		const problem = addressProblem(p.to.url, p.move.collection, collections, others, site.codeRoutes);
+		if (problem) throw refused(problem.code === 'address-taken' ? 409 : 400, problem.code, `${lead(p, i)}${problem.message}`);
+	});
+	return plans;
+}
+
+/** One move's plan (a page alone, with nothing under it). See `planMoves`. */
+export function planMove(site: Site, request: PathMove, documents: readonly DocumentEntry[]): MovePlan {
+	return planMoves(site, [request], documents)[0]!;
 }
 
 export interface MoveChanges {
-	/** The document's text at its new path. */
-	moved: string;
-	/** Every other document whose text changes (links or references to it), Site Settings aside. */
+	/** Each refiled document's text at its new path, in plan order. */
+	moved: { plan: MovePlan; text: string }[];
+	/** Every other document whose text changes (links or references to any of them), Site Settings aside: a held document whose file stays among them. */
 	relinked: { file: string; collection: string; path: string; title: string; text: string }[];
 	/** Site Settings' text after (null: no change), and before (null: the file isn't there yet). */
 	settings: { before: string | null; after: string } | null;
-	redirect: Redirect | null;
+	/** The redirects added, one per address that was live (and asked for). */
+	redirects: Redirect[];
+	/** Whether Site Settings changed for its own links, not only its redirects. */
+	settingsRelinked: boolean;
 }
 
 const settingsCollection = (site: Site): ResolvedCollection | undefined => Object.values(site.collections).find((c) => c.kind === 'settings');
 
 /**
- * Site Settings' text once its redirects follow the move (and its own links are
- * rewritten), or null when nothing changes. `text` null: there's no Site Settings file yet.
+ * Site Settings' text once its redirects follow every move (redirects.ts →
+ * `redirectsAfterMoves`: all at once, against the list before the plan, so a swap or a
+ * chain comes out right; `add` per move), its own links are rewritten, and the caller's own
+ * `edit` is applied; null when nothing changes. `text` null: there's no Site Settings file yet.
  */
-export function settingsAfterMove(site: Site, text: string | null, move: AddressMove, addRedirect: boolean): string | null {
+export function settingsAfterMoves(
+	site: Site,
+	text: string | null,
+	moves: readonly { move: AddressMove; add: boolean }[],
+	edit?: (text: string) => string,
+): string | null {
 	const collection = settingsCollection(site);
 	if (!collection) return null;
-	const relinked = text === null ? null : relinkText(text, move, site, collection).text;
+	const relinked = text === null ? null : relinkText(text, moves.map((m) => m.move), site, collection).text;
 	let raw: unknown = {};
 	if (relinked !== null) {
 		try {
@@ -153,12 +288,18 @@ export function settingsAfterMove(site: Site, text: string | null, move: Address
 		}
 	}
 	const doc = parseAnyDocument(raw, site, collection) as SettingsDocument;
-	const redirects = redirectsAfterMove(doc.data.redirects ?? [], move.fromUrl, move.toUrl, addRedirect);
+	const redirects = redirectsAfterMoves(doc.data.redirects ?? [], moves.map((m) => ({ from: m.move.fromUrl, to: m.move.toUrl, add: m.add })));
 	const title = relinked === null ? 'Site Settings' : doc.title;
-	const after = applyKeyedEdits(relinked, { title, data: { ...doc.data, redirects } }, collection);
+	let after = applyKeyedEdits(relinked, { title, data: { ...doc.data, redirects } }, collection);
+	if (edit) after = edit(after);
 	return after === text ? null : after;
 }
 
+/** One move's Site Settings (see `settingsAfterMoves`). */
+export function settingsAfterMove(site: Site, text: string | null, move: AddressMove, addRedirect: boolean): string | null {
+	return settingsAfterMoves(site, text, [{ move, add: addRedirect }]);
+}
+
 /**
  * Site Settings' text without its redirect from `url`, or null when it has none: a new
  * document made at an address that redirected (a page is there again). Both stores'
@@ -180,79 +321,123 @@ export function settingsWithoutRedirectFrom(site: Site, text: string | null, url
 }
 
 /**
- * What the move changes, from the store's own texts (`readText` by site-relative file;
- * live mode's has the autosaves on top). `addRedirect`: whether `old → new` is added.
+ * What the plan changes, from the store's own texts (`readText` by site-relative file;
+ * live mode's has the autosaves on top): each linking file rewritten once for all the
+ * moves that touch it. `addRedirect(plan)`: whether that address gets `old → new`.
  */
-export async function moveChanges(
+export async function movesChanges(
 	site: Site,
-	plan: MovePlan,
+	plans: readonly MovePlan[],
 	documents: readonly DocumentEntry[],
 	readText: (file: string) => Promise<string | null>,
-	addRedirect: boolean,
+	addRedirect: (plan: MovePlan) => boolean,
+	editSettings?: (text: string) => string,
 ): Promise<MoveChanges> {
-	const text = await readText(plan.from.file);
-	if (text === null) throw refused(404, 'not-found', `${site.collections[plan.from.collection]!.label}: no document "${plan.from.path}".`);
+	const moves = plans.map((p) => p.move);
 	const collectionOf = (name: string) => site.collections[name]!;
-	// M8 Decision 14: its `$schema` path follows the file to its new folder.
-	const moved = stampSchema(relinkText(text, plan.move, site, collectionOf(plan.from.collection)).text, schemaRef(collectionOf(plan.to.collection), plan.to.file), { add: false });
+	const refiled = new Set(plans.filter((p) => p.refiled).map((p) => p.from.file));
+	const moved: MoveChanges['moved'] = [];
+	for (const plan of plans) {
+		if (!plan.refiled) continue;
+		const text = await readText(plan.from.file);
+		if (text === null) throw refused(404, 'not-found', `${collectionOf(plan.from.collection).label}: no document "${plan.from.path}".`);
+		// M8 Decision 14: its `$schema` path follows the file to its new folder.
+		moved.push({ plan, text: stampSchema(relinkText(text, moves, site, collectionOf(plan.from.collection)).text, schemaRef(collectionOf(plan.to.collection), plan.to.file), { add: false }) });
+	}
 	const relinked: MoveChanges['relinked'] = [];
 	for (const d of documents) {
-		if (d.file === plan.from.file || d.file === SITE_SETTINGS_FILE) continue;
+		if (refiled.has(d.file) || d.file === SITE_SETTINGS_FILE) continue;
 		const text = await readText(d.file);
 		if (text === null) continue;
-		const after = relinkText(text, plan.move, site, collectionOf(d.collection));
+		const after = relinkText(text, moves, site, collectionOf(d.collection));
 		if (after.links) relinked.push({ file: d.file, collection: d.collection, path: d.path, title: d.label, text: after.text });
 	}
 	const before = await readText(SITE_SETTINGS_FILE);
-	const after = settingsAfterMove(site, before, plan.move, addRedirect);
+	const adds = plans.map((p) => ({ move: p.move, add: addRedirect(p) }));
+	const after = settingsAfterMoves(site, before, adds, editSettings);
+	const settings = settingsCollection(site);
 	return {
 		moved,
 		relinked,
 		settings: after === null ? null : { before, after },
-		redirect: addRedirect ? { from: plan.move.fromUrl, to: plan.move.toUrl } : null,
+		redirects: redirectsAddedBy(adds.map((a) => ({ from: a.move.fromUrl, to: a.move.toUrl, add: a.add }))),
+		settingsRelinked: !!settings && before !== null && relinkText(before, moves, site, settings).links > 0,
 	};
 }
 
-/** The route's answer for a move done. */
-export function moveResponse(site: Site, plan: MovePlan, changes: MoveChanges): MoveResponse {
+/** The route's answer for a plan done: the first plan's document is the one asked about. */
+export function moveResponse(plans: readonly MovePlan[], changes: MoveChanges): MoveResponse {
+	const [first] = plans;
 	const relinked = changes.relinked.map(({ collection, path, title }) => ({ collection, path, title }));
-	if (changes.settings && relinkTouched(site, changes.settings, plan.move)) relinked.push({ collection: 'settings', path: 'site-settings', title: 'Site Settings' });
+	if (changes.settingsRelinked) relinked.push({ collection: 'settings', path: 'site-settings', title: 'Site Settings' });
+	const redirectOf = (p: MovePlan) => changes.redirects.find((r) => r.from === p.move.fromUrl) ?? null;
 	return {
 		ok: true,
-		collection: plan.to.collection,
-		path: plan.to.path,
-		file: plan.to.file,
-		url: plan.to.url,
-		from: { path: plan.from.path, file: plan.from.file, url: plan.from.url },
+		collection: first!.to.collection,
+		path: first!.to.path,
+		file: first!.to.file,
+		url: first!.to.url,
+		from: { path: first!.from.path, file: first!.from.file, url: first!.from.url },
 		relinked,
-		redirect: changes.redirect,
+		redirect: redirectOf(first!),
+		moved: plans.map((p) => ({ collection: p.move.collection, from: p.move.fromPath, to: p.move.toPath, title: p.title, fromUrl: p.move.fromUrl, toUrl: p.move.toUrl })),
+		redirects: changes.redirects,
 	};
 }
 
-/** Whether Site Settings changed for its own links (not only its redirects). */
-function relinkTouched(site: Site, settings: { before: string | null }, move: AddressMove): boolean {
-	const collection = settingsCollection(site);
-	return !!collection && settings.before !== null && relinkText(settings.before, move, site, collection).links > 0;
-}
-
 // ── The disk (local mode) ──────────────────────────────────────────────────
 
-/** Move on disk: the new file (exclusive), the rewritten files, Site Settings, then the old file goes. */
-export async function moveOnDisk(site: Site, plan: MovePlan, changes: MoveChanges): Promise<void> {
-	const collection = site.collections[plan.to.collection]!;
-	const document = parseAnyDocument(JSON.parse(changes.moved), site, collection);
-	await createOnDisk(site, { ...plan.to, title: plan.title, text: changes.moved, document });
-	for (const r of changes.relinked) {
-		const confined = await confineOnDisk(site, r.file);
-		await writeAtomic(confined.absolute, r.text);
-	}
-	if (changes.settings) {
-		const file = join(site.root, SITE_SETTINGS_FILE);
-		if (changes.settings.before === null) {
-			await writeFile(file, changes.settings.after, { encoding: 'utf8', flag: 'wx', mode: 0o644 });
-		} else await writeAtomic(file, changes.settings.after);
+/**
+ * The plan on disk, all or nothing: each new file (an exclusive create; a file another
+ * move in the plan vacates is written over, as a swap needs), the rewritten files, Site
+ * Settings, then the old files go (and the folders they leave empty). Every text was read
+ * first, so a failure part way puts every file back as it was.
+ */
+export async function movesOnDisk(site: Site, changes: MoveChanges): Promise<void> {
+	const vacated = new Set(changes.moved.map((m) => m.plan.from.file));
+	const targets = new Set(changes.moved.map((m) => m.plan.to.file));
+	const undo: (() => Promise<unknown>)[] = [];
+	const overwrite = async (file: string, text: string, before: string | null) => {
+		const confined = await confineOnDisk(site, file);
+		const prior = before ?? (await readFile(confined.absolute, 'utf8'));
+		await writeAtomic(confined.absolute, text);
+		undo.push(() => writeAtomic(confined.absolute, prior));
+	};
+	try {
+		for (const { plan, text } of changes.moved) {
+			if (vacated.has(plan.to.file)) {
+				await overwrite(plan.to.file, text, null);
+				continue;
+			}
+			const collection = site.collections[plan.to.collection]!;
+			const document = parseAnyDocument(JSON.parse(text), site, collection);
+			await createOnDisk(site, { ...plan.to, title: plan.title, text, document });
+			undo.push(() => deleteOnDisk(site, { ...plan.to, entry: plan.from.entry }));
+		}
+		for (const r of changes.relinked) await overwrite(r.file, r.text, null);
+		if (changes.settings) {
+			const file = join(site.root, SITE_SETTINGS_FILE);
+			if (changes.settings.before === null) {
+				await writeFile(file, changes.settings.after, { encoding: 'utf8', flag: 'wx', mode: 0o644 });
+				undo.push(() => rm(file, { force: true }));
+			} else {
+				await writeAtomic(file, changes.settings.after);
+				const before = changes.settings.before;
+				undo.push(() => writeAtomic(file, before));
+			}
+		}
+		for (const { plan } of changes.moved) {
+			if (targets.has(plan.from.file)) continue;
+			const confined = await confineOnDisk(site, plan.from.file);
+			const text = await readFile(confined.absolute, 'utf8');
+			await deleteOnDisk(site, { ...plan.from, entry: plan.from.entry });
+			const collection = site.collections[plan.from.collection]!;
+			undo.push(() => createOnDisk(site, { ...plan.from, title: plan.title, text, document: parseAnyDocument(JSON.parse(text), site, collection) }));
+		}
+	} catch (error) {
+		for (const step of undo.reverse()) await step().catch(() => {});
+		throw error;
 	}
-	await deleteOnDisk(site, { ...plan.from, entry: plan.from.entry });
 }
 
 // ── The route ──────────────────────────────────────────────────────────────

package/src/editor/styles/editor.css

@@ -228,6 +228,8 @@ details.fgroup>summary .wmark{margin-left:var(--space-1)}
 details.fgroup>summary .wmark .i{margin-left:0;rotate:none}
 /* M9 Decision 7: the page's "Hidden from the site" switch, between its page fields and SEO. */
 .page-hidden{margin-top:var(--space-4)}
+/* Collections under pages (Decision 5): "Holds Journal (24)", beside Hidden, with no control */
+.page-holds{display:flex;align-items:center;gap:var(--space-2);margin:var(--space-2) 0 0;font-size:var(--text-sm);color:var(--text-muted)}
 /* A group field (group()): Page details' section, among a form's fields; inside a list item it keeps to the item's width. */
 details.fgroup.group-field{margin-block:var(--space-3)}
 details.fgroup.group-field+details.fgroup.group-field{margin-top:calc(-1 * var(--space-3))}
@@ -462,6 +464,9 @@ details.fgroup.group-field+details.fgroup.group-field{margin-top:calc(-1 * var(-
 .dialog>p,.dialog>form>p{color:var(--text-muted)}
 .dialog>p+p,.dialog>form>p+p{margin-top:var(--space-2)}
 .dialog .field{margin:var(--space-4) 0 0}
+.dialog .check{display:flex;align-items:center;gap:var(--space-2);font-size:var(--text-sm);font-weight:var(--weight-medium);color:var(--text);cursor:pointer}
+.dialog .check input{flex:none;width:16px;height:16px;margin:0;accent-color:var(--select);cursor:inherit}
+.dialog .check + .field-help{margin-top:var(--space-1);padding-left:calc(16px + var(--space-2))}
 .dialog .acts{display:flex;justify-content:flex-end;gap:var(--space-2);margin-top:var(--space-6)}
 .dialog .icon-h{display:grid;place-items:center;width:36px;height:36px;margin-bottom:var(--space-3);border-radius:50%}
 .urlpre{display:flex;align-items:center;gap:var(--space-1);margin-top:var(--space-1-5);font-size:var(--text-sm);color:var(--text-muted)}

package/src/editor/styles/levels/collections.css

@@ -37,6 +37,8 @@
 .ct-open:focus-visible{outline:2px solid var(--select);outline-offset:2px;border-radius:var(--radius-xs)}
 .ct-title-cell .meta{display:inline-flex;align-items:center;gap:var(--space-1);margin-left:var(--space-1-5)}
 .ct-title-cell .meta:empty{display:none}
+/* Hidden (M9 Decision 7; collections under pages, Decision 11): the sidebar row's mark, small and grey, not part of the title. */
+.ct-title-cell .hmark{font-size:var(--text-xs);font-weight:var(--weight-regular);color:var(--text-subtle);white-space:nowrap}
 .ct-extra{margin-left:var(--space-2);font-size:var(--text-xs);color:var(--text-subtle)}
 .ct tr.is-warned .ct-open{color:var(--text-muted)}
 .ct tr.is-current .ct-open{color:var(--select-strong);font-weight:var(--weight-semibold)}

package/src/editor/styles/levels/m5a-documents.css

@@ -11,6 +11,21 @@
 .ptype.sm .i{color:var(--icon)}
 .ptype[aria-checked="true"]{border-color:var(--select);background:var(--select-wash)}
 .ptype[aria-checked="true"] b,.ptype[aria-checked="true"] .i{color:var(--select-strong)}
+/* Collections under pages (Decision 9): Change address…'s list of every address that changes */
+.mv-list{list-style:none;margin:var(--space-2) 0 0;padding:var(--space-1) var(--space-2);max-height:11rem;overflow:auto;border:1px solid var(--border);border-radius:var(--radius-md);font-size:var(--text-sm);line-height:1.6}
+.mv-list li{overflow-wrap:anywhere}
+/* In a short window the dialog stays inside it, the list the part that gives (down to about
+   two addresses), so Cancel and Change address always show. A column, not a scrolling dialog:
+   the Inside picker's popover must not be clipped. The margins keep the block layout's gaps
+   (no margins collapse in a column). */
+.dialog[data-dialog="move"]{display:flex;flex-direction:column;max-height:calc(100dvh - 2 * var(--space-4))}
+.dialog[data-dialog="move"]>form{display:flex;flex-direction:column;min-height:0}
+.dialog[data-dialog="move"]>form>*{flex:none}
+.dialog[data-dialog="move"]>form>h2+.field{margin-top:var(--space-2)}
+.dialog[data-dialog="move"]>form>.field>:last-child{margin-bottom:0}
+.dialog[data-dialog="move"]>form>[data-moving]{flex:0 1 auto;display:flex;flex-direction:column;min-height:0}
+.dialog[data-dialog="move"]>form>[data-moving]>*{flex:none}
+.dialog[data-dialog="move"]>form>[data-moving]>.mv-list{flex:0 1 auto;min-height:3rem;margin-top:0}
 .dlg-list{display:flex;flex-direction:column;gap:2px;margin-top:var(--space-3);padding:var(--space-1);border:1px solid var(--border);border-radius:var(--radius-md)}
 /* Site Settings (M5a): a fixed form with no page of its own */
 .set-sec{margin:0 calc(-1 * var(--space-4));padding:var(--space-4) var(--space-4) var(--space-1);border-top:1px solid var(--border)}

package/src/editor/types.ts

@@ -54,6 +54,16 @@ export interface EditorAnyCollection {
 	sort?: import('../columns.ts').SortConfig | null;
 	/** A section builder's offered blocks (config.ts); null or absent for every block. */
 	blocks?: string[] | null;
+	/**
+	 * Collections under pages (Decision 7): the nested collection whose page holds this one, set
+	 * only on a held collection. Its `urlBase` is then the server's resolved base (the holder's
+	 * address + `/`), or null while `problem` says why it has none.
+	 */
+	heldBy?: string | null;
+	/** A held collection's holder (held.ts → HeldBase); null or absent when none holds it, and on any other collection. */
+	holder?: { collection: string; path: string } | null;
+	/** Decision 13's sentence for a held collection with no addresses (shown on its sidebar entry); null or absent otherwise. */
+	problem?: string | null;
 }
 
 /**
@@ -486,9 +496,11 @@ export interface StatusResponse {
 	 * Runs-anywhere Decision 5: what's wrong with the site's GitHub access, for every
 	 * person, while it holds (not dismissable, unlike `notices`): a refused credential, a
 	 * missing permission, or a token expiring within 14 days. `message` names the fix,
-	 * for the developer it's forwarded to. Null when nothing is wrong.
+	 * for the developer it's forwarded to. Null when nothing is wrong. `cloud` (caracms-cloud
+	 * M2 Decision 14): CaraCMS Cloud refused a token; `message` is the cloud's sentence and
+	 * `link` the install link it names, if any, which the note shows as a link.
 	 */
-	githubAccess: { kind: 'refused' | 'permission' | 'expiring'; title: string; message: string } | null;
+	githubAccess: { kind: 'refused' | 'permission' | 'expiring' | 'cloud'; title: string; message: string; link?: string | null } | null;
 	/**
 	 * The brand as committed in Site Settings (M5a Decision 10: read from `drafts`, never
 	 * an autosave), so the chrome picks up a change on the next poll with no reload.
@@ -582,12 +594,15 @@ export interface DeleteResponse {
  * POST /_caracms/move (pre-M7 item 8): change a document's address. `to` is its new
  * path in the same collection (`studio/visit`), its new parts made with slug.ts as a
  * new document's are. Every link and reference to it is rewritten, and a redirect from
- * the old address to the new is added to Site Settings.
+ * the old address to the new is added to Site Settings unless `redirect` is false
+ * (Change address…'s "Leave a redirect from …", on unless it's unticked).
  */
 export interface MoveRequest {
 	collection: string;
 	path: string;
 	to: string;
+	/** Whether to leave a redirect from the old address (default true). A document that was never live gets none either way. */
+	redirect?: boolean;
 }
 
 /** 200: the document is at its new path (live mode: as autosaves, all going out at the next Publish). */
@@ -602,8 +617,16 @@ export interface MoveResponse {
 	from: { path: string; file: string; url: string };
 	/** The other documents whose links (or references) to it were rewritten, with their titles. */
 	relinked: { collection: string; path: string; title: string }[];
-	/** The redirect added: null for a document that was never live (made since the last Publish). */
+	/** The redirect added: null when none was asked for, or for a document that was never live (made since the last Publish). */
 	redirect: { from: string; to: string } | null;
+	/**
+	 * Collections under pages (Decision 9): every address that changed, this document's first,
+	 * then the pages under it and the documents of a collection held under it (`from` = `to`:
+	 * a held document's file stays where it is).
+	 */
+	moved: { collection: string; from: string; to: string; title: string; fromUrl: string; toUrl: string }[];
+	/** Every redirect added, one per address that was live (none when none was asked for). */
+	redirects: { from: string; to: string }[];
 }
 
 /**
@@ -613,7 +636,8 @@ export interface MoveResponse {
  *   isn't an address `slugify` leaves as it is, or nothing left), `index`,
  *   `reserved-address` (under `/admin` or `/_caracms`), `below-collection` (strictly
  *   under another collection's address), `not-allowed` (Site Settings, Home, a shared
- *   block with no or an unknown block type);
+ *   block with no or an unknown block type), `not-held` (collections under pages, Decision 7: a
+ *   held collection no page holds, or whose holding is a problem; the message is held.ts's sentence);
  * - 404 `not-found` (delete: no such document);
  * - 409 `exists` (create: the document is already there), `address-taken` (another
  *   document has that address: "There's already a page at /services/packaging"),
@@ -636,10 +660,12 @@ export type CreateDeleteCode =
 	| 'reserved-address'
 	| 'below-collection'
 	| 'not-allowed'
+	| 'not-held'
 	| 'not-found'
 	| 'exists'
 	| 'address-taken'
 	| 'in-use'
+	| 'holds'
 	| 'locked'
 	| 'same';