caracms 0.3.3 → 0.4.0

package/src/live/drafts-store.ts

@@ -35,7 +35,7 @@ import { join, relative, sep } from 'node:path';
 import { SITE_SETTINGS_FILE, type ResolvedSite } from '../config.ts';
 import { filesSource, listDocuments, readDocument, resolveDocumentFile } from '../content.ts';
 import { planCreate, planDelete, refused } from '../editor/server/create.ts';
-import { moveChanges, moveResponse, planMove, settingsWithoutRedirectFrom } from '../editor/server/move.ts';
+import { movesChanges, moveResponse, movesUnder, planMoves, settingsWithoutRedirectFrom, type ManyMoveRequest, type MovePlan } from '../editor/server/move.ts';
 import { replaceChanges, replaceResponse } from '../editor/server/replace.ts';
 import { parseAnyDocument } from '../document.ts';
 import type { DraftsStore } from '../editor/server/drafts-store.ts';
@@ -268,6 +268,122 @@ export function liveDraftsStore(parts: LiveStoreParts): DraftsStore {
 		if (!(before && before.lock.tab === tab)) await locks.release(SITE_SETTINGS_FILE, tab, person);
 	};
 
+	/**
+	 * The many-move engine (collections under pages, Contracts; pre-M7 item 8's move, for any
+	 * number of documents): the plan is checked as a whole against the listing with every
+	 * autosave on top (move.ts → `planMoves`), then:
+	 *
+	 * - **Every file it writes is this tab's before anything is written** (`takeAll`): each
+	 *   moved document's old and new file, every linking file, Site Settings. Someone else's
+	 *   lock on any one refuses the whole move (nothing is changed), naming them and the
+	 *   document; the mover's own lock in another tab moves to this one. A held document whose
+	 *   file stays (its holder moved) is written, and locked, only when its own links change.
+	 * - **It lands whole or leaves nothing behind.** Each autosave it stores is noted with the
+	 *   one it replaced; any failure puts them back newest first, compare-and-set against what
+	 *   the move wrote, and releases every lock it took. The new documents first, then the
+	 *   linking files, a file another move vacates written over (a swap), the old files gone,
+	 *   and Site Settings (the one autosave the sweep commits at once) last, so a sweep tick
+	 *   can't commit a redirect for a move that then fails.
+	 * - **A document that was never live gets no redirect**: one made since the last Publish,
+	 *   or one already moved since then (its live address already redirects, and follows).
+	 *   Each refiled document's move is recorded for Publish ("Moved from"), and every changed
+	 *   address's live one (autosaves.ts → `recordAddresses`), so a held document whose file
+	 *   stays is named too.
+	 */
+	const moveMany = (request: ManyMoveRequest, context?: WriteContext): Promise<MoveResponse> =>
+		guard(async () => {
+			const { person, tab } = who(context);
+			const documents = await listed();
+			const plans = planMoves(site, request.moves, documents);
+			const source = overlay((await autosaves.all()).map((r) => r.value));
+			const addresses = await autosaves.addresses();
+			const onMain = (file: string) => git.changeOf(file, '') === 'changed';
+			const wasLive = (p: MovePlan) => onMain(p.from.file) && !addresses.has(p.from.file);
+			const changes = await movesChanges(site, plans, documents, (file) => source.readText(join(site.root, file)), (p) => request.redirect !== false && wasLive(p), request.editSettings);
+			const refiled = plans.filter((p) => p.refiled);
+			const vacated = new Set(refiled.map((p) => p.from.file));
+			const targets = new Set(refiled.map((p) => p.to.file));
+			const files = [...new Set([...refiled.flatMap((p) => [p.from.file, p.to.file]), ...changes.relinked.map((r) => r.file), ...(changes.settings ? [SITE_SETTINGS_FILE] : [])])];
+			const root = plans[0]!;
+			const movingWith = new Map(plans.filter((p) => !p.refiled).map((p) => [p.from.file, p]));
+
+			const took: string[] = [];
+			const written: Written[] = [];
+			try {
+				await takeAll(files, tab, person, took, (file, who, mine) => {
+					const elsewhere = mine ? ' in another tab' : '';
+					const until = `so the address can't change until ${mine ? 'that tab is closed' : "they're done"}.`;
+					const from = refiled.find((p) => p.from.file === file);
+					if (from) return `${who} editing ${from.title}${elsewhere}, so ${from === root ? 'its' : `${root.title}'s`} address can't change yet.`;
+					const to = refiled.find((p) => p.to.file === file);
+					if (to) return `${who} working on ${to.to.url} right now, so ${to.title} can't move there yet.`;
+					if (file === SITE_SETTINGS_FILE) return `${who} editing Site Settings${elsewhere}, which holds the redirects, ${until}`;
+					const name = changes.relinked.find((r) => r.file === file)?.title ?? file;
+					return movingWith.has(file) ? `${who} editing ${name}${elsewhere}, which moves with ${root.title}, ${until}` : `${who} editing ${name}${elsewhere}, which links to ${plans.length === 1 ? root.from.url : 'an address that changes'}, ${until}`;
+				});
+
+				const t = now();
+				const at = new Date(t).toISOString();
+				// The new documents first, as a create makes one: an autosave with no base in drafts.
+				// Made there since the listing was read: it exists. A pending deletion there is replaced.
+				for (const { plan, text } of changes.moved) {
+					if (vacated.has(plan.to.file)) continue;
+					for (let attempt = 1; ; attempt++) {
+						if (attempt > 6) throw new Error('caracms: the autosave kept changing under the move.');
+						const existing = await autosaves.get(plan.to.file);
+						const over = git.read(plan.to.file);
+						if ((existing && !existing.value.gone) || (!existing && over !== null)) throw refused(409, 'address-taken', `There's already a page at ${plan.to.url}.`);
+						const next: Autosave = { ...saved(plan.to.file, text, plan.to.collection, person, tab, t)(null, null), base: text, created: { over } };
+						if (await autosaves.putIf(existing, next)) {
+							written.push({ prior: existing, wrote: { raw: JSON.stringify(next), value: next } });
+							break;
+						}
+					}
+				}
+				for (const r of changes.relinked) written.push(await stash(r.file, tab, saved(r.file, r.text, r.collection, person, tab, t)));
+				// A file another move in the plan vacates (a swap) is written over, as an edit.
+				for (const { plan, text } of changes.moved) if (vacated.has(plan.to.file)) written.push(await stash(plan.to.file, tab, saved(plan.to.file, text, plan.to.collection, person, tab, t)));
+				// Then the old ones go, as a delete removes one.
+				for (const plan of refiled) {
+					if (targets.has(plan.from.file)) continue;
+					const oldTitle = titleOf(plan.from.file, git.read(plan.from.file) ?? (await source.readText(join(site.root, plan.from.file))));
+					written.push(
+						await stash(plan.from.file, tab, (prior, current) => ({
+							file: plan.from.file,
+							base: prior ? prior.base : (current ?? ''),
+							...carried(prior),
+							document: null,
+							text: null,
+							editor: person,
+							tab,
+							firstAt: prior?.firstAt ?? t,
+							updatedAt: t,
+							seq: null,
+							...(prior?.created ? { created: prior.created } : {}),
+							gone: { title: oldTitle },
+						})),
+					);
+				}
+				// The redirects last (see above).
+				if (changes.settings) written.push(await stash(SITE_SETTINGS_FILE, tab, saved(SITE_SETTINGS_FILE, changes.settings.after, 'settings', person, tab, t)));
+
+				const texts: [string, string][] = [...changes.moved.map((m): [string, string] => [m.plan.to.file, m.text]), ...changes.relinked.map((r): [string, string] => [r.file, r.text]), ...(changes.settings ? [[SITE_SETTINGS_FILE, changes.settings.after] as [string, string]] : [])];
+				for (const [file, text] of texts) await autosaves.setChanged(file, { by: person, version: fileVersion(text), at });
+				for (const plan of refiled) if (!targets.has(plan.from.file)) await autosaves.setChanged(plan.from.file, { by: person, version: '', at, gone: true });
+				// The moves themselves, kept until they're published: the waiting list and Publish read them, not the redirects.
+				await autosaves.recordMoves(refiled.map((plan) => ({ from: plan.from.file, to: plan.to.file, wasLive: onMain(plan.from.file) })));
+				await autosaves.recordAddresses(plans.map((p) => ({ from: p.from.file, to: p.to.file, fromUrl: p.from.url, toUrl: p.to.url, wasLive: onMain(p.from.file) })));
+			} catch (error) {
+				await undo(written, took, tab, person);
+				throw error;
+			}
+			// The tab moves on to the asked-for document's new address, keeping its lock there; the others go once committed.
+			for (const plan of refiled) if (!targets.has(plan.from.file)) await locks.release(plan.from.file, tab, person, { deleted: true });
+			for (const f of took) if (f !== root.to.file && !(vacated.has(f) && !targets.has(f))) await locks.release(f, tab, person);
+			sweep.poke();
+			return moveResponse(plans, changes);
+		});
+
 	return {
 		source: () =>
 			guard(async () => overlay((await autosaves.all()).map((r) => r.value))),
@@ -414,93 +530,12 @@ export function liveDraftsStore(parts: LiveStoreParts): DraftsStore {
 				return { ok: true, collection: plan.collection, path: plan.path, file: plan.file, url: plan.url, version };
 			}),
 
-		move: (request, context): Promise<MoveResponse> =>
-			guard(async () => {
-				const { person, tab } = who(context);
-				const documents = await listed();
-				const plan = planMove(site, request, documents);
-				const source = overlay((await autosaves.all()).map((r) => r.value));
-				// A document made since the last Publish was never live, so nobody has its old address: no redirect.
-				const wasLive = git.changeOf(plan.from.file, '') === 'changed';
-				const changes = await moveChanges(site, plan, documents, (file) => source.readText(join(site.root, file)), wasLive);
-				const relinked = changes.relinked.map((r) => r.file);
-				const files = [plan.from.file, plan.to.file, ...relinked, ...(changes.settings ? [SITE_SETTINGS_FILE] : [])];
-
-				// Every file the move writes is this tab's before anything is written. Someone else's
-				// lock on one refuses the whole move (nothing is changed), naming them and the document;
-				// the mover's own lock in another tab moves to this one (that tab goes read-only, as after Edit here).
-				//
-				// **A move lands whole or leaves nothing behind.** Each autosave it stores is noted with the
-				// one it replaced; any failure after the first (Redis gone, an autosave that kept changing)
-				// puts them back newest first, compare-and-set against what the move wrote, and releases
-				// every lock the move took, so a retry finds the document where it was. Site Settings (the
-				// one autosave the sweep commits at once) is stored last, so a sweep tick can't commit a
-				// redirect for a move that then fails.
-				const took: string[] = [];
-				const written: Written[] = [];
-				try {
-					await takeAll(files, tab, person, took, (file, who, mine) => {
-						const name = file === plan.from.file ? plan.title : file === SITE_SETTINGS_FILE ? 'Site Settings' : (changes.relinked.find((r) => r.file === file)?.title ?? plan.to.url);
-						return file === plan.from.file
-							? `${who} editing ${name}${mine ? ' in another tab' : ''}, so its address can't change yet.`
-							: file === plan.to.file
-								? `${who} working on ${plan.to.url} right now, so ${plan.title} can't move there yet.`
-								: `${who} editing ${name}${mine ? ' in another tab' : ''}, which ${file === SITE_SETTINGS_FILE ? 'holds the redirects' : `links to ${plan.from.url}`}, so the address can't change until ${mine ? 'that tab is closed' : 'they\'re done'}.`;
-					});
-
-					const t = now();
-					const at = new Date(t).toISOString();
-					// The new document first, as a create makes one: its autosave, with no base in drafts.
-					// Made there since the listing was read: it exists. A pending deletion there is replaced.
-					for (let attempt = 1; ; attempt++) {
-						if (attempt > 6) throw new Error('caracms: the autosave kept changing under the move.');
-						const existing = await autosaves.get(plan.to.file);
-						const over = git.read(plan.to.file);
-						if ((existing && !existing.value.gone) || (!existing && over !== null)) throw refused(409, 'address-taken', `There's already a page at ${plan.to.url}.`);
-						const next: Autosave = { ...saved(plan.to.file, changes.moved, plan.to.collection, person, tab, t)(null, null), base: changes.moved, created: { over } };
-						if (await autosaves.putIf(existing, next)) {
-							written.push({ prior: existing, wrote: { raw: JSON.stringify(next), value: next } });
-							break;
-						}
-					}
-					for (const r of changes.relinked) written.push(await stash(r.file, tab, saved(r.file, r.text, r.collection, person, tab, t)));
-					// Then the old one goes, as a delete removes one.
-					const oldTitle = titleOf(plan.from.file, git.read(plan.from.file) ?? (await source.readText(join(site.root, plan.from.file))));
-					written.push(
-						await stash(plan.from.file, tab, (prior, current) => ({
-							file: plan.from.file,
-							base: prior ? prior.base : (current ?? ''),
-							...carried(prior),
-							document: null,
-							text: null,
-							editor: person,
-							tab,
-							firstAt: prior?.firstAt ?? t,
-							updatedAt: t,
-							seq: null,
-							...(prior?.created ? { created: prior.created } : {}),
-							gone: { title: oldTitle },
-						})),
-					);
-					// The redirect last (see above).
-					if (changes.settings) written.push(await stash(SITE_SETTINGS_FILE, tab, saved(SITE_SETTINGS_FILE, changes.settings.after, 'settings', person, tab, t)));
+		move: async (request, context): Promise<MoveResponse> => {
+			const moves = movesUnder(site, request, await listed());
+			return moveMany({ moves, ...(request.redirect === false ? { redirect: false } : {}) }, context);
+		},
 
-					for (const [file, text] of [[plan.to.file, changes.moved], ...changes.relinked.map((r) => [r.file, r.text]), ...(changes.settings ? [[SITE_SETTINGS_FILE, changes.settings.after]] : [])] as [string, string][]) {
-						await autosaves.setChanged(file, { by: person, version: fileVersion(text), at });
-					}
-					await autosaves.setChanged(plan.from.file, { by: person, version: '', at, gone: true });
-					// The move itself, kept until it's published: the waiting list and Publish read it, not the redirect.
-					await autosaves.recordMove(plan.from.file, plan.to.file, wasLive);
-				} catch (error) {
-					await undo(written, took, tab, person);
-					throw error;
-				}
-				// The tab moves on to the new address, keeping its lock there; the others go once committed.
-				await locks.release(plan.from.file, tab, person, { deleted: true });
-				for (const f of took) if (f !== plan.to.file && f !== plan.from.file) await locks.release(f, tab, person);
-				sweep.poke();
-				return moveResponse(site, plan, changes);
-			}),
+		moveMany: (request, context) => moveMany(request, context),
 
 		/**
 		 * M6c G4 (Decision 9): Replace… on a file. Every document with a link to the old file

package/src/live/editor.ts

@@ -24,6 +24,7 @@
  * is the sweep's "am I ticking" and git.ts's caches.
  */
 import { SITE_SETTINGS_FILE, type ResolvedSite } from '../config.ts';
+import { filesSource, heldBasesOf } from '../content.ts';
 import { brandFrom, editorBrand } from '../editor/brand.ts';
 import type { DraftsStore } from '../editor/server/drafts-store.ts';
 import { handleCreate, handleDelete } from '../editor/server/create.ts';
@@ -42,7 +43,7 @@ import type {
 	TryAgainResponse,
 	WaitingView,
 } from '../editor/types.ts';
-import { Autosaves } from './autosaves.ts';
+import { Autosaves, splitMoves } from './autosaves.ts';
 import { lastChangeOf, liveDraftsStore, unavailable } from './drafts-store.ts';
 import { LiveGit, movesIn, NO_REDEPLOYER_REASON, titleOf } from './git.ts';
 import { accessProblemMessage, type GitHubAccessProblem } from './github.ts';
@@ -63,6 +64,7 @@ const ACCESS_TITLE: Record<GitHubAccessProblem['kind'], string> = {
 	refused: 'GitHub refused this site',
 	permission: 'GitHub refused a change',
 	expiring: "This site's GitHub token expires soon",
+	cloud: 'No GitHub access through CaraCMS Cloud',
 };
 
 export interface LiveEditor {
@@ -321,10 +323,24 @@ export async function createLiveEditor(
 		// Pre-M7 item 8: a moved document is one entry, on its new file, with its old address.
 		// Read from the moves as recorded, not Site Settings' redirects: removing the redirect leaves it a move.
 		const readNow = (f: string) => (textNow.has(f) ? (textNow.get(f) ?? null) : git.read(f));
-		const moves = movesIn(site, [...waiting.keys()], readNow, new Map(snap.hash(autosaves.movesKey())));
+		// The copy with every autosave on top: where a holder is now, moved or not committed yet.
+		const nowSource = () => {
+			const files = new Map(git.files());
+			for (const a of saves) {
+				if (a.text === null) files.delete(a.file);
+				else files.set(a.file, a.text);
+			}
+			return filesSource(site.root, () => files);
+		};
+		const { records, addresses } = splitMoves(snap.hash(autosaves.movesKey()));
+		// Collections under pages: a held document's addresses come from its holder (read only when something moved).
+		const moved = records.size || addresses.size;
+		const moves = movesIn(site, [...waiting.keys()], readNow, records, moved ? await heldBasesOf(site, nowSource()) : {}, addresses);
 		const redirects = moves.from.size ? redirectsIn(readNow(SITE_SETTINGS_FILE)) : [];
 		for (const [file, from] of moves.from) {
-			const w = waiting.get(file)!;
+			// A held document whose holder moved keeps its file, unchanged: it waits as a move all the same.
+			const w = waiting.get(file) ?? { file, change: 'changed' as const, ...docOf(site, file), title: titleOf(file, readNow(file)), editors: [], changedAt: null, keptDraft: false, uncommitted: false, editingNow: editingNow(file), missingAlt: [] };
+			waiting.set(file, w);
 			w.movedFrom = from;
 			w.movedRedirect = redirects.some((r) => r.from === from);
 		}
@@ -357,7 +373,9 @@ export async function createLiveEditor(
 			notices: Notices.forPerson(person, git.keptDraftNotices(), titleFor, snap.set(noticeStore.dismissedKey), snap.hash(noticeStore.noticesKey).values()),
 			publish: await publishView({ running: snap.string(git.publishLockKey) !== null, record: LiveGit.publishRecordFrom(snap.string(git.publishRecordKey)) }),
 			// Runs-anywhere Decision 5: while it holds, not dismissable.
-			githubAccess: access ? { kind: access.kind, title: ACCESS_TITLE[access.kind], message: accessProblemMessage(access) } : null,
+			githubAccess: access
+				? { kind: access.kind, title: ACCESS_TITLE[access.kind], message: accessProblemMessage(access), link: access.kind === 'cloud' ? access.installUrl : null }
+				: null,
 			// M5a Decision 10: from the committed copy, never an autosave.
 			brand: editorBrand(brandFrom(git.read(SITE_SETTINGS_FILE), site)),
 		};

package/src/live/git.ts

@@ -36,9 +36,10 @@
 import { randomBytes } from 'node:crypto';
 import { relative, sep } from 'node:path';
 import { repoPrefix, SITE_SETTINGS_FILE, type ResolvedSite } from '../config.ts';
-import { documentUrl, filesSource, type ContentSource } from '../content.ts';
+import { documentUrl, filesSource, heldBasesOf, type ContentSource } from '../content.ts';
+import { withHeldBases, type HeldBase } from '../held.ts';
 import { confinePath } from '../editor/server/write.ts';
-import { movesKey } from './autosaves.ts';
+import { ADDRESS_FIELD, movesKey, splitMoves } from './autosaves.ts';
 import type { WaitingChange } from '../editor/types.ts';
 import { MissingBranchError, StaleHeadError, type Branch, type CommitSummary, type Comparison, type GitBackend, type Head, type Heads, type TreeChange } from './backend.ts';
 import { HttpError } from './github.ts';
@@ -721,8 +722,12 @@ export class LiveGit {
 		// A file drafts no longer has is deleted: "Contact (deleted)", its title from main's copy first (M5a Decision 12).
 		const gone = files.filter((f) => this.read(f) === null);
 		const goneTitles = await this.titlesBeforeRemoval(gone, heads.main.commit);
-		const records = await this.moveRecords();
-		const moves = this.movesIn(files, records);
+		const { records, addresses } = splitMoves(Object.entries(await this.redis.hgetall(movesKey(this.keyPrefix))));
+		// Collections under pages: a held document's addresses come from its holder's (only `holds` is read, so no blocks are needed).
+		const bases = await heldBasesOf({ ...this.site, blocks: {} }, this.contentSource());
+		const moves = this.movesIn(files, records, bases, addresses);
+		// A held document whose holder moved keeps its file, unchanged: still one moved item in the headline.
+		const readdressed = [...moves.from.keys()].filter((f) => !files.includes(f));
 		// Each file's own title (a "stood" notice names the document by it), then the headline's items.
 		const fileTitles = files.map((f) => {
 			const text = this.read(f);
@@ -734,7 +739,11 @@ export class LiveGit {
 		});
 		// Pre-M7 item 8: a moved document is one item in the headline, "Visit (moved from /studio/visit)",
 		// listed first; its old file is part of that item, not one of its own.
-		const titles = [...items.filter((_, i) => moves.from.has(files[i]!)), ...items.filter((_, i) => !moves.from.has(files[i]!) && !moves.to.has(files[i]!))];
+		const titles = [
+			...items.filter((_, i) => moves.from.has(files[i]!)),
+			...readdressed.map((f) => `${titleOf(f, this.read(f))} (moved from ${moves.from.get(f)})`),
+			...items.filter((_, i) => !moves.from.has(files[i]!) && !moves.to.has(files[i]!)),
+		];
 		const commit = await this.backend.createCommit(heads.drafts.tree, [heads.main.commit], publishMessage(titles, files, by));
 		const moved = await this.moveRefs([
 			// main: a fast-forward onto the squash commit. drafts: not a fast-forward, so
@@ -758,6 +767,23 @@ export class LiveGit {
 			if (cleared) this.statusCache.hash(moves, {}, published);
 			else this.statusCache.drop(moves);
 		}
+		// Collections under pages: an address this publish took live is done with; one that
+		// changed since (still its live address in what was published) stays waiting.
+		const live = withHeldBases(this.site, bases);
+		const done = [...addresses].filter(([file, was]) => {
+			if (this.read(file) === null) return false;
+			const url = this.urlOf(live, file);
+			return url !== null && url !== was;
+		}).map(([file]) => `${ADDRESS_FIELD}${file}`);
+		if (done.length) {
+			const key = movesKey(this.keyPrefix);
+			const cleared = await this.redis.hdel(key, ...done).then(
+				() => true,
+				() => false,
+			);
+			if (cleared) this.statusCache.hash(key, {}, done);
+			else this.statusCache.drop(key);
+		}
 		const record: PublishRecord = { commit, by, at: new Date(this.now()).toISOString(), files, titles, tryAgainAt: null };
 		await this.setPublishRecord(record);
 		this.log(`published ${commit.slice(0, 7)} (attempt ${attempt}): ${titles.join(', ')}`);
@@ -817,13 +843,18 @@ export class LiveGit {
 	}
 
 	/** Pre-M7 item 8: the documents a publish moves (`movesIn`), over `drafts`' copy. */
-	private movesIn(files: string[], records: ReadonlyMap<string, string>): Moves {
-		return movesIn(this.site, files, (f) => this.read(f), records);
+	private movesIn(files: string[], records: ReadonlyMap<string, string>, bases: Readonly<Record<string, HeldBase>>, addresses: ReadonlyMap<string, string>): Moves {
+		return movesIn(this.site, files, (f) => this.read(f), records, bases, addresses);
 	}
 
-	/** Pre-M7 item 8: the moves recorded as they were made (autosaves.ts → `moves`), old file → new file. */
-	private async moveRecords(): Promise<Map<string, string>> {
-		return new Map(Object.entries(await this.redis.hgetall(movesKey(this.keyPrefix))));
+	/** A file's document address on a site with its held bases resolved; null when it isn't a document with one. */
+	private urlOf(site: Pick<ResolvedSite, 'root' | 'collections'>, file: string): string | null {
+		try {
+			const c = confinePath(site as ResolvedSite, file);
+			return documentUrl(site.collections[c.collection]!, c.path);
+		} catch {
+			return null;
+		}
 	}
 
 	/** A file's title for the waiting list and notices: the copy's, else the title it had when it was deleted, else its name. */
@@ -1060,7 +1091,22 @@ export interface Moves {
  * old one gone (`read` null) and the new one there. Publish's headline and the waiting
  * list read it ("Visit (moved from /studio/visit)").
  */
-export function movesIn(site: Pick<ResolvedSite, 'root' | 'collections'>, files: readonly string[], read: (file: string) => string | null, records: ReadonlyMap<string, string>): Moves {
+export function movesIn(
+	site: Pick<ResolvedSite, 'root' | 'collections'>,
+	files: readonly string[],
+	read: (file: string) => string | null,
+	records: ReadonlyMap<string, string>,
+	/** Collections under pages: the held collections' resolved bases (held.ts), so a held document's move has addresses. */
+	bases: Readonly<Record<string, HeldBase>> = {},
+	/**
+	 * Collections under pages: each moved document's live address, by its file now
+	 * (autosaves.ts → `recordAddresses`). It wins over one worked out from the old file
+	 * (whose holder may have moved too), and names a held document whose holder moved,
+	 * whose file stays as it is: that one counts whether or not its file is among `files`.
+	 */
+	addresses: ReadonlyMap<string, string> = new Map(),
+): Moves {
+	site = withHeldBases(site, bases);
 	const from = new Map<string, string>();
 	const to = new Map<string, string>();
 	const urlOf = (file: string) => {
@@ -1075,12 +1121,17 @@ export function movesIn(site: Pick<ResolvedSite, 'root' | 'collections'>, files:
 	for (const [old, moved] of records) {
 		if (old === moved || !changed.has(old) || !changed.has(moved) || from.has(moved) || to.has(old)) continue;
 		if (read(old) !== null || read(moved) === null) continue;
-		const fromUrl = urlOf(old);
+		const fromUrl = addresses.get(moved) ?? urlOf(old);
 		const toUrl = urlOf(moved);
 		if (!fromUrl || !toUrl) continue;
 		from.set(moved, fromUrl);
 		to.set(old, toUrl);
 	}
+	for (const [file, live] of addresses) {
+		if (from.has(file) || to.has(file) || read(file) === null) continue;
+		const url = urlOf(file);
+		if (url && url !== live) from.set(file, live);
+	}
 	return { from, to };
 }
 

package/src/live/github.ts

@@ -22,9 +22,16 @@
  *   token, an expiry within 14 days. `accessProblem()` says which holds now; a later
  *   success clears the first two.
  *
- * The private key and the token are never logged.
+ * - **CaraCMS Cloud** (`CARACMS_CLOUD_KEY`; caracms-cloud M2 Decisions 12–14) mints the
+ *   installation token instead: `POST /v1/github/token` (cloud.ts), refreshed five minutes
+ *   early like the App's. A refusal from the cloud is an access problem of kind `cloud`
+ *   carrying the cloud's sentence (and its install link), cleared by the next token; so is
+ *   a token answer for another repo than the one the server started on.
+ *
+ * The private key, the site key and the tokens are never logged.
  */
 import { createSign } from 'node:crypto';
+import { CLOUD_REPO_CHANGED, CloudRefusal, cloudToken } from './cloud.ts';
 
 const API = 'https://api.github.com';
 
@@ -50,16 +57,27 @@ export interface TokenConnection extends ConnectionBase {
 	token: string;
 }
 
-export type GitHubConnection = AppConnection | TokenConnection;
+/** CaraCMS Cloud mints the token (caracms-cloud M2 Decision 12); `fetch` reaches the cloud as well as GitHub. */
+export interface CloudConnection extends ConnectionBase {
+	cloudKey: string;
+	cloudUrl: string;
+}
+
+export type GitHubConnection = AppConnection | TokenConnection | CloudConnection;
+
+/** Which credential a client signs in with. */
+export type GitHubCredential = 'app' | 'token' | 'cloud';
 
 /**
  * What's wrong with GitHub access right now (Decision 5), shown in the editor while it holds.
  * `credential` says which one the site uses, so the sentence names the right fix.
  */
 export type GitHubAccessProblem =
-	| { kind: 'refused'; credential: 'app' | 'token' }
-	| { kind: 'permission'; credential: 'app' | 'token'; permission: string }
-	| { kind: 'expiring'; credential: 'token'; expires: string };
+	| { kind: 'refused'; credential: GitHubCredential }
+	| { kind: 'permission'; credential: GitHubCredential; permission: string }
+	| { kind: 'expiring'; credential: 'token'; expires: string }
+	/** CaraCMS Cloud refused a token (caracms-cloud M2 Decision 14): its sentence as it came, and its install link. */
+	| { kind: 'cloud'; credential: 'cloud'; message: string; installUrl: string | null };
 
 /** A token expiring within this long shows in the editor (Decision 5). */
 export const TOKEN_EXPIRY_WARNING_MS = 14 * 24 * 60 * 60_000;
@@ -84,11 +102,19 @@ export function accessProblemMessage(problem: GitHubAccessProblem): string {
 	const what = problem.credential === 'token' ? 'GitHub token (CARACMS_GITHUB_TOKEN)' : 'GitHub App';
 	switch (problem.kind) {
 		case 'refused':
+			if (problem.credential === 'cloud') {
+				return "GitHub refused the token CaraCMS Cloud gave this site: the caracms App may have been uninstalled from the repo or suspended. Changes can't be saved to GitHub until it's installed again; ask CaraCMS to check the site.";
+			}
 			return problem.credential === 'token'
 				? `GitHub refused this site's ${what}: it may have expired or been revoked. Changes can't be saved to GitHub until a developer makes a new fine-grained token and sets it.`
 				: `GitHub refused this site's ${what}: it may have been uninstalled from the repo or suspended. Changes can't be saved to GitHub until a developer reinstalls it.`;
 		case 'permission':
+			if (problem.credential === 'cloud') {
+				return `GitHub refused a change because the caracms App, through CaraCMS Cloud, lacks the "${problem.permission}" permission on this site's repo. Ask CaraCMS to check the App.`;
+			}
 			return `GitHub refused a change because this site's ${what} lacks the "${problem.permission}" permission. A developer can add it in the ${problem.credential === 'token' ? "token's settings" : "App's settings"}.`;
+		case 'cloud':
+			return problem.message;
 		case 'expiring': {
 			const date = new Date(problem.expires).toLocaleDateString('en-IE', { day: 'numeric', month: 'long', year: 'numeric', timeZone: 'UTC' });
 			return `This site's ${what} expires on ${date}. After that, changes can't be saved to GitHub: a developer can regenerate it, or make a new one, and set it before then.`;
@@ -206,9 +232,10 @@ export class GitHubClient {
 	readonly owner: string;
 	readonly repo: string;
 	/** Which credential this client signs in with. */
-	readonly credential: 'app' | 'token';
+	readonly credential: GitHubCredential;
 	private readonly appId: string;
 	private readonly key: string;
+	private readonly cloud: { key: string; url: string } | null = null;
 	private readonly fetcher: typeof fetch;
 	private readonly now: () => number;
 	private readonly timeoutMs: number;
@@ -219,6 +246,8 @@ export class GitHubClient {
 	private refused = false;
 	private missingPermission: string | null = null;
 	private personalTokenExpires: number | null = null;
+	/** The cloud's last refusal, until a token comes. */
+	private cloudProblem: { message: string; installUrl: string | null } | null = null;
 
 	constructor(connection: GitHubConnection, tracker: Tracker) {
 		if ('token' in connection) {
@@ -227,6 +256,11 @@ export class GitHubClient {
 			this.key = '';
 			this.token = connection.token;
 			this.tokenExpires = Number.POSITIVE_INFINITY;
+		} else if ('cloudKey' in connection) {
+			this.credential = 'cloud';
+			this.appId = '';
+			this.key = '';
+			this.cloud = { key: connection.cloudKey, url: connection.cloudUrl };
 		} else {
 			this.credential = 'app';
 			this.appId = connection.appId;
@@ -242,6 +276,7 @@ export class GitHubClient {
 
 	/** What's wrong with GitHub access now, the most serious first; null when nothing is (Decision 5). */
 	accessProblem(): GitHubAccessProblem | null {
+		if (this.cloudProblem) return { kind: 'cloud', credential: 'cloud', ...this.cloudProblem };
 		if (this.refused) return { kind: 'refused', credential: this.credential };
 		if (this.missingPermission) return { kind: 'permission', credential: this.credential, permission: this.missingPermission };
 		const expires = this.personalTokenExpires;
@@ -297,11 +332,38 @@ export class GitHubClient {
 		this.tokenExpires = Date.parse(tok.expires_at);
 	}
 
+	/**
+	 * Ask CaraCMS Cloud for a token. A refusal is kept as the access problem (and thrown); a
+	 * cloud that can't be reached only fails this call, as an unreachable GitHub does.
+	 */
+	private async cloudSignIn(cloud: { key: string; url: string }): Promise<void> {
+		let answer;
+		try {
+			answer = await cloudToken({ ...cloud, fetch: this.fetcher, timeoutMs: this.timeoutMs });
+		} catch (error) {
+			if (error instanceof CloudRefusal && error.error !== 'unreachable') this.cloudProblem = { message: error.message, installUrl: error.installUrl };
+			throw error;
+		}
+		if (answer.repo.toLowerCase() !== this.nameWithOwner.toLowerCase()) {
+			const refusal = new CloudRefusal('repo_changed', CLOUD_REPO_CHANGED(answer.repo));
+			this.cloudProblem = { message: refusal.message, installUrl: null };
+			throw refusal;
+		}
+		this.cloudProblem = null;
+		this.token = answer.token;
+		this.tokenExpires = answer.expiresAt;
+	}
+
+	/** Sign in now (the cloud's first token at start, so a refusal stops the start). */
+	async ready(): Promise<void> {
+		await this.auth();
+	}
+
 	/** The installation token, refreshed five minutes before it expires; a personal token as it is. */
 	private async auth(): Promise<string> {
 		if (this.credential === 'token') return this.token;
 		if (!this.token || this.now() > this.tokenExpires - 5 * 60_000) {
-			this.signingIn ??= this.signIn().finally(() => {
+			this.signingIn ??= (this.cloud ? this.cloudSignIn(this.cloud) : this.signIn()).finally(() => {
 				this.signingIn = null;
 			});
 			await this.signingIn;