caracms 0.3.4 → 0.5.0

package/src/live/autosaves.ts

@@ -120,6 +120,21 @@ export interface Read<T> {
 
 /** The Redis hash of moves waiting to publish (old file → new file). */
 export const movesKey = (prefix: string) => `${prefix}moves`;
+/**
+ * Collections under pages: the moves hash also holds each moved document's live address,
+ * as `@<file now>` → the address (see `recordAddresses`), so the status poll reads no more
+ * keys than before (Redis diet). `splitMoves` parts the two.
+ */
+export const ADDRESS_FIELD = '@';
+export function splitMoves(fields: Iterable<[string, string]>): { records: Map<string, string>; addresses: Map<string, string> } {
+	const records = new Map<string, string>();
+	const addresses = new Map<string, string>();
+	for (const [k, v] of fields) {
+		if (k.startsWith(ADDRESS_FIELD)) addresses.set(k.slice(ADDRESS_FIELD.length), v);
+		else records.set(k, v);
+	}
+	return { records, addresses };
+}
 
 const parse = <T>(raw: string | null): T | null => {
 	if (raw === null) return null;
@@ -243,7 +258,7 @@ export class Autosaves {
 
 	/** Pre-M7 item 8: the moves waiting to publish, old file → new file. */
 	async moves(): Promise<Map<string, string>> {
-		return new Map(Object.entries(await this.redis.hgetall(movesKey(this.prefix))));
+		return splitMoves(Object.entries(await this.redis.hgetall(movesKey(this.prefix)))).records;
 	}
 
 	private async setMove(from: string, to: string): Promise<void> {
@@ -271,11 +286,83 @@ export class Autosaves {
 		} else if (wasLive) await this.setMove(from, to);
 	}
 
+	/**
+	 * Several documents moved at once (the many-move engine), each as `recordMove` would,
+	 * but every one read against the records before the plan: in a chain (A → B, B → C)
+	 * the second move's `from` is the first's `to`, and read one at a time it would take
+	 * over the first's record. In a swap each gets its record (`movesIn` counts neither
+	 * while both files are there).
+	 */
+	async recordMoves(entries: readonly { from: string; to: string; wasLive: boolean }[]): Promise<void> {
+		if (entries.length === 0) return;
+		const before = await this.moves();
+		const after = new Map(before);
+		const origins = entries.map((e) => [...before].find(([, t]) => t === e.from)?.[0] ?? (e.wasLive ? e.from : null));
+		for (const origin of origins) if (origin !== null) after.delete(origin);
+		entries.forEach((e, i) => {
+			const origin = origins[i]!;
+			if (origin !== null && origin !== e.to) after.set(origin, e.to);
+		});
+		const drop = [...before.keys()].filter((f) => !after.has(f));
+		if (drop.length) await this.dropMoves(...drop);
+		for (const [f, t] of after) if (before.get(f) !== t) await this.setMove(f, t);
+	}
+
+	/** Collections under pages: each moved document's live address, by its file now. */
+	async addresses(): Promise<Map<string, string>> {
+		return splitMoves(Object.entries(await this.redis.hgetall(movesKey(this.prefix)))).addresses;
+	}
+
+	/**
+	 * Collections under pages (Decision 9): each address a move changed, in one write. The
+	 * record is the document's live address, by its file now: a held document keeps its file
+	 * when its holder moves, so its old address can't be worked out from a file's move, nor
+	 * from its holder's address now. Moved since the last Publish already: the record follows
+	 * it to its new file; back at its live address: the record goes. A document that was
+	 * never live (`wasLive` false, no record) gets none.
+	 */
+	async recordAddresses(entries: readonly { from: string; to: string; toUrl: string; fromUrl: string; wasLive: boolean }[]): Promise<void> {
+		if (entries.length === 0) return;
+		// Every live address from the records as they were before the plan, never from the
+		// map being changed: in a swap or a chain one entry's `to` is another's `from`.
+		const before = await this.addresses();
+		const same = (a: string, b: string) => a.replace(/\/+$/, '').toLowerCase() === b.replace(/\/+$/, '').toLowerCase();
+		const live = entries.map((e) => before.get(e.from) ?? (e.wasLive ? e.fromUrl : null));
+		const after = new Map(before);
+		for (const e of entries) if (e.from !== e.to) after.delete(e.from);
+		entries.forEach((e, i) => {
+			const address = live[i]!;
+			if (address === null || same(address, e.toUrl)) after.delete(e.to);
+			else after.set(e.to, address);
+		});
+		const drop = new Set([...before.keys()].filter((f) => !after.has(f)));
+		const set: Record<string, string> = {};
+		for (const [f, v] of after) if (before.get(f) !== v) set[f] = v;
+		const key = movesKey(this.prefix);
+		const field = (file: string) => `${ADDRESS_FIELD}${file}`;
+		if (drop.size) {
+			const fields = [...drop].map(field);
+			await landed(this.cache, key, () => this.redis.hdel(key, ...fields));
+			this.cache?.hash(key, {}, fields);
+		}
+		if (Object.keys(set).length) {
+			const fields = Object.fromEntries(Object.entries(set).map(([f, v]) => [field(f), v]));
+			await landed(this.cache, key, () => this.redis.hset(key, fields));
+			this.cache?.hash(key, fields);
+		}
+	}
+
 	/** A deleted document's move, if it was moved, is no move any more: it's a deletion. */
 	async forgetMoveTo(file: string): Promise<void> {
 		const moves = await this.moves();
 		const olds = [...moves].filter(([, t]) => t === file).map(([o]) => o);
 		if (olds.length) await this.dropMoves(...olds);
+		if ((await this.addresses()).has(file)) {
+			const key = movesKey(this.prefix);
+			const field = `${ADDRESS_FIELD}${file}`;
+			await landed(this.cache, key, () => this.redis.hdel(key, field));
+			this.cache?.hash(key, {}, [field]);
+		}
 	}
 
 	/** The merge's ancestor for an autosave (Decision 6). See `ancestorFor`. */

package/src/live/cloud.ts

@@ -0,0 +1,131 @@
+/**
+ * CaraCMS Cloud as the site's GitHub credential (caracms-cloud M2, Decisions 11–14).
+ *
+ * - `CARACMS_CLOUD_KEY` (the site key, `cck_…`) is sent as `Authorization: Bearer` and
+ *   nowhere else; `CARACMS_CLOUD_URL` overrides the production address below.
+ * - `cloudSettings()`: `GET /v1/settings` at start, for the site's repo (`github.repo`;
+ *   null is `no_repo`, with the cloud's own sentence).
+ * - `cloudToken()`: `POST /v1/github/token`, a fresh installation token on the site's repo,
+ *   about an hour long. `GitHubClient` calls it and refreshes five minutes early.
+ * - **A refusal** (any answer that isn't 2xx, carrying `{ error, message }`) throws a
+ *   `CloudRefusal` with the cloud's `message` as it came, and `installUrl` when there is
+ *   one. A cloud that can't be reached, or answers with something else, throws a
+ *   `CloudRefusal` whose `error` is `unreachable`, with the package's own sentence.
+ *
+ * - `cloudUnavailable()`: the sign-in guard's 503 for a refusal at start (Decision 14),
+ *   the sentence escaped and the install link a link.
+ *
+ * The key and the tokens are never logged and never put in an error.
+ */
+
+/** The production API's address (caracms-cloud M0 → Contracts). The one place it's written. */
+export const DEFAULT_CLOUD_URL = 'https://glad-bird-412.ap-southeast-2.convex.site';
+
+/** A site key: `cck_` and 43 base64url characters (caracms-cloud M1). */
+export const CLOUD_KEY_SHAPE = /^cck_[A-Za-z0-9_-]{43}$/;
+
+export const CLOUD_UNREACHABLE = "CaraCMS Cloud couldn't be reached, so the editor can't start. Try again in a minute.";
+/** The cloud's own `no_repo` sentence (Contracts), for `github.repo: null` in the settings. */
+export const CLOUD_NO_REPO = 'This site has no GitHub repo in CaraCMS Cloud yet. Ask CaraCMS to set one.';
+/** Decision 13: a token answer named another repo than the one the server started with. */
+export const CLOUD_REPO_CHANGED = (repo: string) => `This site's repo was changed in CaraCMS Cloud to ${repo}. Restart the server to use it.`;
+
+/** How long a call to the cloud may take before it counts as unreachable. */
+export const CLOUD_TIMEOUT_MS = 20_000;
+
+export interface CloudConnection {
+	key: string;
+	url: string;
+	/** For tests. Default: global fetch. */
+	fetch?: typeof fetch;
+	timeoutMs?: number;
+}
+
+/** The cloud said no (or couldn't be reached). `message` is safe to show and to log. */
+export class CloudRefusal extends Error {
+	/** The cloud's `error` (`no_repo`, `app_not_installed`, `unknown_key`…), or the package's `unreachable` / `repo_changed`. */
+	readonly error: string;
+	/** An `https://` link the message names (the App's install page), or null. */
+	readonly installUrl: string | null;
+	constructor(error: string, message: string, installUrl: string | null = null) {
+		super(message);
+		this.name = 'CloudRefusal';
+		this.error = error;
+		this.installUrl = installUrl;
+	}
+}
+
+const unreachable = () => new CloudRefusal('unreachable', CLOUD_UNREACHABLE);
+
+async function call(connection: CloudConnection, method: 'GET' | 'POST', path: string): Promise<Record<string, unknown>> {
+	let res: Response;
+	let body: unknown;
+	try {
+		res = await (connection.fetch ?? fetch)(`${connection.url}${path}`, {
+			method,
+			headers: { authorization: `Bearer ${connection.key}`, accept: 'application/json', 'user-agent': 'caracms' },
+			signal: AbortSignal.timeout(connection.timeoutMs ?? CLOUD_TIMEOUT_MS),
+		});
+		body = await res.json();
+	} catch {
+		throw unreachable();
+	}
+	const answer = body && typeof body === 'object' && !Array.isArray(body) ? (body as Record<string, unknown>) : null;
+	if (!answer) throw unreachable();
+	if (!res.ok) {
+		const { error, message, installUrl } = answer;
+		if (typeof error !== 'string' || typeof message !== 'string' || !message.trim()) throw unreachable();
+		throw new CloudRefusal(error, message, typeof installUrl === 'string' && /^https:\/\//i.test(installUrl) ? installUrl : null);
+	}
+	return answer;
+}
+
+const REPO = /^([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/;
+
+/** The site's repo, from `GET /v1/settings`. */
+export async function cloudSettings(connection: CloudConnection): Promise<{ owner: string; repo: string }> {
+	const answer = await call(connection, 'GET', '/v1/settings');
+	const github = answer.github as { repo?: unknown } | undefined;
+	if (!github || typeof github !== 'object') throw unreachable();
+	if (github.repo === null) throw new CloudRefusal('no_repo', CLOUD_NO_REPO);
+	const m = typeof github.repo === 'string' ? REPO.exec(github.repo) : null;
+	if (!m) throw unreachable();
+	return { owner: m[1]!, repo: m[2]! };
+}
+
+/** A fresh installation token on the site's repo, from `POST /v1/github/token`. */
+export async function cloudToken(connection: CloudConnection): Promise<{ token: string; expiresAt: number; repo: string }> {
+	const answer = await call(connection, 'POST', '/v1/github/token');
+	const { token, expiresAt, repo } = answer;
+	const at = typeof expiresAt === 'string' ? Date.parse(expiresAt) : Number.NaN;
+	if (typeof token !== 'string' || !token || Number.isNaN(at) || typeof repo !== 'string') throw unreachable();
+	return { token, expiresAt: at, repo };
+}
+
+const escapeHtml = (s: string) => s.replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[c]!);
+
+/**
+ * The message as HTML, escaped, with `link` (when there is one) as a link: where the
+ * message names it, in place; otherwise after it. The message's words are never changed.
+ */
+export function messageHtml(message: string, link: string | null): string {
+	if (!link) return escapeHtml(message);
+	const a = `<a href="${escapeHtml(link)}">${escapeHtml(link)}</a>`;
+	const parts = message.split(link);
+	return parts.length > 1 ? parts.map(escapeHtml).join(a) : `${escapeHtml(message)} ${a}`;
+}
+
+/** The cloud's refusal at start (Decision 14): its sentence, the install link as a link. */
+export function cloudUnavailable(refusal: CloudRefusal, api: boolean): Response {
+	const headers = { 'Cache-Control': 'private, no-store' };
+	if (api) {
+		return new Response(JSON.stringify({ error: refusal.message, code: refusal.error, installUrl: refusal.installUrl }), {
+			status: 503,
+			headers: { ...headers, 'Content-Type': 'application/json; charset=utf-8' },
+		});
+	}
+	return new Response(
+		`<!doctype html><meta charset="utf-8"><meta name="robots" content="noindex"><title>Editor unavailable</title><p>${messageHtml(refusal.message, refusal.installUrl)}</p>`,
+		{ status: 503, headers: { ...headers, 'Content-Type': 'text/html; charset=utf-8' } },
+	);
+}

package/src/live/drafts-store.ts

@@ -34,8 +34,9 @@
 import { join, relative, sep } from 'node:path';
 import { SITE_SETTINGS_FILE, type ResolvedSite } from '../config.ts';
 import { filesSource, listDocuments, readDocument, resolveDocumentFile } from '../content.ts';
-import { planCreate, planDelete, refused } from '../editor/server/create.ts';
-import { moveChanges, moveResponse, planMove, settingsWithoutRedirectFrom } from '../editor/server/move.ts';
+import { assertSettingsReadable, orderEdit, planArrange } from '../editor/server/arrange.ts';
+import { planCreate, planDelete, refused, target } from '../editor/server/create.ts';
+import { movesChanges, moveResponse, movesUnder, planMoves, settingsWithoutRedirectFrom, type ManyMoveRequest, type MovePlan } from '../editor/server/move.ts';
 import { replaceChanges, replaceResponse } from '../editor/server/replace.ts';
 import { parseAnyDocument } from '../document.ts';
 import type { DraftsStore } from '../editor/server/drafts-store.ts';
@@ -268,6 +269,127 @@ export function liveDraftsStore(parts: LiveStoreParts): DraftsStore {
 		if (!(before && before.lock.tab === tab)) await locks.release(SITE_SETTINGS_FILE, tab, person);
 	};
 
+	/**
+	 * The many-move engine (collections under pages, Contracts; pre-M7 item 8's move, for any
+	 * number of documents): the plan is checked as a whole against the listing with every
+	 * autosave on top (move.ts → `planMoves`), then:
+	 *
+	 * - **Every file it writes is this tab's before anything is written** (`takeAll`): each
+	 *   moved document's old and new file, every linking file, Site Settings. Someone else's
+	 *   lock on any one refuses the whole move (nothing is changed), naming them and the
+	 *   document; the mover's own lock in another tab moves to this one. A held document whose
+	 *   file stays (its holder moved) is written, and locked, only when its own links change.
+	 * - **It lands whole or leaves nothing behind.** Each autosave it stores is noted with the
+	 *   one it replaced; any failure puts them back newest first, compare-and-set against what
+	 *   the move wrote, and releases every lock it took. The new documents first, then the
+	 *   linking files, a file another move vacates written over (a swap), the old files gone,
+	 *   and Site Settings (the one autosave the sweep commits at once) last, so a sweep tick
+	 *   can't commit a redirect for a move that then fails.
+	 * - **A document that was never live gets no redirect**: one made since the last Publish,
+	 *   or one already moved since then (its live address already redirects, and follows).
+	 *   But when a move vacates an address that is another document's live address (a chain
+	 *   before the Publish: A → B, then B's document to C, so B had none), it redirects to
+	 *   where that document is now, so the old public address still finds it.
+	 *   Each refiled document's move is recorded for Publish ("Moved from"), and every changed
+	 *   address's live one (autosaves.ts → `recordAddresses`), so a held document whose file
+	 *   stays is named too.
+	 */
+	const moveMany = (request: ManyMoveRequest, context?: WriteContext): Promise<MoveResponse> =>
+		guard(async () => {
+			const { person, tab } = who(context);
+			const documents = await listed();
+			const plans = planMoves(site, request.moves, documents);
+			const source = overlay((await autosaves.all()).map((r) => r.value));
+			const addresses = await autosaves.addresses();
+			const onMain = (file: string) => git.changeOf(file, '') === 'changed';
+			const wasLive = (p: MovePlan) => onMain(p.from.file) && !addresses.has(p.from.file);
+			// A live address a chain left without a redirect gets one once a move vacates it (move.ts → `movesChanges`).
+			const liveAddressOf = request.redirect === false ? undefined : (file: string) => addresses.get(file) ?? null;
+			const changes = await movesChanges(site, plans, documents, (file) => source.readText(join(site.root, file)), (p) => request.redirect !== false && wasLive(p), request.editSettings, liveAddressOf);
+			const refiled = plans.filter((p) => p.refiled);
+			const vacated = new Set(refiled.map((p) => p.from.file));
+			const targets = new Set(refiled.map((p) => p.to.file));
+			const files = [...new Set([...refiled.flatMap((p) => [p.from.file, p.to.file]), ...changes.relinked.map((r) => r.file), ...(changes.settings ? [SITE_SETTINGS_FILE] : [])])];
+			const root = plans[0]!;
+			const movingWith = new Map(plans.filter((p) => !p.refiled).map((p) => [p.from.file, p]));
+
+			const took: string[] = [];
+			const written: Written[] = [];
+			try {
+				await takeAll(files, tab, person, took, (file, who, mine) => {
+					const elsewhere = mine ? ' in another tab' : '';
+					const until = `so the address can't change until ${mine ? 'that tab is closed' : "they're done"}.`;
+					const from = refiled.find((p) => p.from.file === file);
+					if (from) return `${who} editing ${from.title}${elsewhere}, so ${from === root ? 'its' : `${root.title}'s`} address can't change yet.`;
+					const to = refiled.find((p) => p.to.file === file);
+					if (to) return `${who} working on ${to.to.url} right now, so ${to.title} can't move there yet.`;
+					if (file === SITE_SETTINGS_FILE) return `${who} editing Site Settings${elsewhere}, which holds the redirects, ${until}`;
+					const name = changes.relinked.find((r) => r.file === file)?.title ?? file;
+					return movingWith.has(file) ? `${who} editing ${name}${elsewhere}, which moves with ${root.title}, ${until}` : `${who} editing ${name}${elsewhere}, which links to ${plans.length === 1 ? root.from.url : 'an address that changes'}, ${until}`;
+				});
+
+				const t = now();
+				const at = new Date(t).toISOString();
+				// The new documents first, as a create makes one: an autosave with no base in drafts.
+				// Made there since the listing was read: it exists. A pending deletion there is replaced.
+				for (const { plan, text } of changes.moved) {
+					if (vacated.has(plan.to.file)) continue;
+					for (let attempt = 1; ; attempt++) {
+						if (attempt > 6) throw new Error('caracms: the autosave kept changing under the move.');
+						const existing = await autosaves.get(plan.to.file);
+						const over = git.read(plan.to.file);
+						if ((existing && !existing.value.gone) || (!existing && over !== null)) throw refused(409, 'address-taken', `There's already a page at ${plan.to.url}.`);
+						const next: Autosave = { ...saved(plan.to.file, text, plan.to.collection, person, tab, t)(null, null), base: text, created: { over } };
+						if (await autosaves.putIf(existing, next)) {
+							written.push({ prior: existing, wrote: { raw: JSON.stringify(next), value: next } });
+							break;
+						}
+					}
+				}
+				for (const r of changes.relinked) written.push(await stash(r.file, tab, saved(r.file, r.text, r.collection, person, tab, t)));
+				// A file another move in the plan vacates (a swap) is written over, as an edit.
+				for (const { plan, text } of changes.moved) if (vacated.has(plan.to.file)) written.push(await stash(plan.to.file, tab, saved(plan.to.file, text, plan.to.collection, person, tab, t)));
+				// Then the old ones go, as a delete removes one.
+				for (const plan of refiled) {
+					if (targets.has(plan.from.file)) continue;
+					const oldTitle = titleOf(plan.from.file, git.read(plan.from.file) ?? (await source.readText(join(site.root, plan.from.file))));
+					written.push(
+						await stash(plan.from.file, tab, (prior, current) => ({
+							file: plan.from.file,
+							base: prior ? prior.base : (current ?? ''),
+							...carried(prior),
+							document: null,
+							text: null,
+							editor: person,
+							tab,
+							firstAt: prior?.firstAt ?? t,
+							updatedAt: t,
+							seq: null,
+							...(prior?.created ? { created: prior.created } : {}),
+							gone: { title: oldTitle },
+						})),
+					);
+				}
+				// The redirects last (see above).
+				if (changes.settings) written.push(await stash(SITE_SETTINGS_FILE, tab, saved(SITE_SETTINGS_FILE, changes.settings.after, 'settings', person, tab, t)));
+
+				const texts: [string, string][] = [...changes.moved.map((m): [string, string] => [m.plan.to.file, m.text]), ...changes.relinked.map((r): [string, string] => [r.file, r.text]), ...(changes.settings ? [[SITE_SETTINGS_FILE, changes.settings.after] as [string, string]] : [])];
+				for (const [file, text] of texts) await autosaves.setChanged(file, { by: person, version: fileVersion(text), at });
+				for (const plan of refiled) if (!targets.has(plan.from.file)) await autosaves.setChanged(plan.from.file, { by: person, version: '', at, gone: true });
+				// The moves themselves, kept until they're published: the waiting list and Publish read them, not the redirects.
+				await autosaves.recordMoves(refiled.map((plan) => ({ from: plan.from.file, to: plan.to.file, wasLive: onMain(plan.from.file) })));
+				await autosaves.recordAddresses(plans.map((p) => ({ from: p.from.file, to: p.to.file, fromUrl: p.from.url, toUrl: p.to.url, wasLive: onMain(p.from.file) })));
+			} catch (error) {
+				await undo(written, took, tab, person);
+				throw error;
+			}
+			// The tab moves on to the asked-for document's new address, keeping its lock there; the others go once committed.
+			for (const plan of refiled) if (!targets.has(plan.from.file)) await locks.release(plan.from.file, tab, person, { deleted: true });
+			for (const f of took) if (f !== root.to.file && !(vacated.has(f) && !targets.has(f))) await locks.release(f, tab, person);
+			sweep.poke();
+			return moveResponse(plans, changes);
+		});
+
 	return {
 		source: () =>
 			guard(async () => overlay((await autosaves.all()).map((r) => r.value))),
@@ -414,92 +536,63 @@ export function liveDraftsStore(parts: LiveStoreParts): DraftsStore {
 				return { ok: true, collection: plan.collection, path: plan.path, file: plan.file, url: plan.url, version };
 			}),
 
-		move: (request, context): Promise<MoveResponse> =>
+		move: async (request, context): Promise<MoveResponse> => {
+			const documents = await listed();
+			const moves = movesUnder(site, request, documents);
+			// Arrange pages (Decision 6): a saved order follows the move, in the same Site Settings write.
+			return moveMany({ moves, ...(request.redirect === false ? { redirect: false } : {}), editSettings: orderEdit(site, moves, documents) }, context);
+		},
+
+		moveMany: (request, context) => moveMany(request, context),
+
+		/**
+		 * Arrange pages (Contracts): the plan against the listing with every autosave on top,
+		 * then the moves through `moveMany` (every lock up front, someone else's on any file
+		 * refuses it all, a rollback on any failure) with the arranged order riding its Site
+		 * Settings write. The engine keeps the first document's lock, as Change address…'s tab
+		 * moves on to it; the arrange screen has no document open, so it's let go here. With no
+		 * moves (Decision 21), Site Settings alone, under its lock, as one autosave.
+		 */
+		arrange: (request, context) =>
 			guard(async () => {
 				const { person, tab } = who(context);
-				const documents = await listed();
-				const plan = planMove(site, request, documents);
-				const source = overlay((await autosaves.all()).map((r) => r.value));
-				// A document made since the last Publish was never live, so nobody has its old address: no redirect.
-				const wasLive = git.changeOf(plan.from.file, '') === 'changed';
-				const changes = await moveChanges(site, plan, documents, (file) => source.readText(join(site.root, file)), wasLive);
-				const relinked = changes.relinked.map((r) => r.file);
-				const files = [plan.from.file, plan.to.file, ...relinked, ...(changes.settings ? [SITE_SETTINGS_FILE] : [])];
-
-				// Every file the move writes is this tab's before anything is written. Someone else's
-				// lock on one refuses the whole move (nothing is changed), naming them and the document;
-				// the mover's own lock in another tab moves to this one (that tab goes read-only, as after Edit here).
-				//
-				// **A move lands whole or leaves nothing behind.** Each autosave it stores is noted with the
-				// one it replaced; any failure after the first (Redis gone, an autosave that kept changing)
-				// puts them back newest first, compare-and-set against what the move wrote, and releases
-				// every lock the move took, so a retry finds the document where it was. Site Settings (the
-				// one autosave the sweep commits at once) is stored last, so a sweep tick can't commit a
-				// redirect for a move that then fails.
+				const plan = planArrange(site, request, await listed());
+				// An unreadable Site Settings would drop the order and the redirects without a word: refuse every Apply.
+				if (plan.moves.length) assertSettingsReadable(site, (await autosaves.get(SITE_SETTINGS_FILE))?.value.text ?? git.read(SITE_SETTINGS_FILE));
+				if (plan.moves.length) {
+					const first = plan.moves[0]!;
+					const kept = target(site, first.collection, first.to).file;
+					const before = await locks.read(kept);
+					await moveMany({ moves: plan.moves, ...(request.redirect === false ? { redirect: false } : {}), editSettings: (text) => plan.edit(text) ?? text }, context);
+					if (!(before && before.lock.tab === tab)) await locks.release(kept, tab, person);
+					return { ok: true as const };
+				}
 				const took: string[] = [];
 				const written: Written[] = [];
 				try {
-					await takeAll(files, tab, person, took, (file, who, mine) => {
-						const name = file === plan.from.file ? plan.title : file === SITE_SETTINGS_FILE ? 'Site Settings' : (changes.relinked.find((r) => r.file === file)?.title ?? plan.to.url);
-						return file === plan.from.file
-							? `${who} editing ${name}${mine ? ' in another tab' : ''}, so its address can't change yet.`
-							: file === plan.to.file
-								? `${who} working on ${plan.to.url} right now, so ${plan.title} can't move there yet.`
-								: `${who} editing ${name}${mine ? ' in another tab' : ''}, which ${file === SITE_SETTINGS_FILE ? 'holds the redirects' : `links to ${plan.from.url}`}, so the address can't change until ${mine ? 'that tab is closed' : 'they\'re done'}.`;
-					});
-
-					const t = now();
-					const at = new Date(t).toISOString();
-					// The new document first, as a create makes one: its autosave, with no base in drafts.
-					// Made there since the listing was read: it exists. A pending deletion there is replaced.
-					for (let attempt = 1; ; attempt++) {
-						if (attempt > 6) throw new Error('caracms: the autosave kept changing under the move.');
-						const existing = await autosaves.get(plan.to.file);
-						const over = git.read(plan.to.file);
-						if ((existing && !existing.value.gone) || (!existing && over !== null)) throw refused(409, 'address-taken', `There's already a page at ${plan.to.url}.`);
-						const next: Autosave = { ...saved(plan.to.file, changes.moved, plan.to.collection, person, tab, t)(null, null), base: changes.moved, created: { over } };
-						if (await autosaves.putIf(existing, next)) {
-							written.push({ prior: existing, wrote: { raw: JSON.stringify(next), value: next } });
-							break;
-						}
-					}
-					for (const r of changes.relinked) written.push(await stash(r.file, tab, saved(r.file, r.text, r.collection, person, tab, t)));
-					// Then the old one goes, as a delete removes one.
-					const oldTitle = titleOf(plan.from.file, git.read(plan.from.file) ?? (await source.readText(join(site.root, plan.from.file))));
-					written.push(
-						await stash(plan.from.file, tab, (prior, current) => ({
-							file: plan.from.file,
-							base: prior ? prior.base : (current ?? ''),
-							...carried(prior),
-							document: null,
-							text: null,
-							editor: person,
-							tab,
-							firstAt: prior?.firstAt ?? t,
-							updatedAt: t,
-							seq: null,
-							...(prior?.created ? { created: prior.created } : {}),
-							gone: { title: oldTitle },
-						})),
-					);
-					// The redirect last (see above).
-					if (changes.settings) written.push(await stash(SITE_SETTINGS_FILE, tab, saved(SITE_SETTINGS_FILE, changes.settings.after, 'settings', person, tab, t)));
-
-					for (const [file, text] of [[plan.to.file, changes.moved], ...changes.relinked.map((r) => [r.file, r.text]), ...(changes.settings ? [[SITE_SETTINGS_FILE, changes.settings.after]] : [])] as [string, string][]) {
-						await autosaves.setChanged(file, { by: person, version: fileVersion(text), at });
+					await takeAll([SITE_SETTINGS_FILE], tab, person, took, (_file, who, mine) => `${who} editing Site Settings${mine ? ' in another tab' : ''}, which holds the order of the Pages tree, so the order can't change until ${mine ? 'that tab is closed' : "they're done"}.`);
+					const current = (await autosaves.get(SITE_SETTINGS_FILE))?.value.text ?? git.read(SITE_SETTINGS_FILE);
+					assertSettingsReadable(site, current);
+					const next = plan.edit(current);
+					if (next !== null && next !== current) {
+						const t = now();
+						let after = next;
+						written.push(
+							await stash(SITE_SETTINGS_FILE, tab, (prior, drafts) => {
+								const base = prior ? prior.text : drafts;
+								after = plan.edit(base) ?? base ?? next;
+								return saved(SITE_SETTINGS_FILE, after, 'settings', person, tab, t)(prior, drafts);
+							}),
+						);
+						await autosaves.setChanged(SITE_SETTINGS_FILE, { by: person, version: fileVersion(after), at: new Date(t).toISOString() });
 					}
-					await autosaves.setChanged(plan.from.file, { by: person, version: '', at, gone: true });
-					// The move itself, kept until it's published: the waiting list and Publish read it, not the redirect.
-					await autosaves.recordMove(plan.from.file, plan.to.file, wasLive);
 				} catch (error) {
 					await undo(written, took, tab, person);
 					throw error;
 				}
-				// The tab moves on to the new address, keeping its lock there; the others go once committed.
-				await locks.release(plan.from.file, tab, person, { deleted: true });
-				for (const f of took) if (f !== plan.to.file && f !== plan.from.file) await locks.release(f, tab, person);
+				for (const f of took) await locks.release(f, tab, person);
 				sweep.poke();
-				return moveResponse(site, plan, changes);
+				return { ok: true as const };
 			}),
 
 		/**

package/src/live/editor.ts

@@ -23,7 +23,10 @@
  * State lives in Redis and git (two servers run during a deploy); what's held here
  * is the sweep's "am I ticking" and git.ts's caches.
  */
+import { orderIn } from '../editor/server/arrange.ts';
+import { pageOrderStamp } from '../page-order.ts';
 import { SITE_SETTINGS_FILE, type ResolvedSite } from '../config.ts';
+import { filesSource, heldBasesOf } from '../content.ts';
 import { brandFrom, editorBrand } from '../editor/brand.ts';
 import type { DraftsStore } from '../editor/server/drafts-store.ts';
 import { handleCreate, handleDelete } from '../editor/server/create.ts';
@@ -42,7 +45,7 @@ import type {
 	TryAgainResponse,
 	WaitingView,
 } from '../editor/types.ts';
-import { Autosaves } from './autosaves.ts';
+import { Autosaves, splitMoves } from './autosaves.ts';
 import { lastChangeOf, liveDraftsStore, unavailable } from './drafts-store.ts';
 import { LiveGit, movesIn, NO_REDEPLOYER_REASON, titleOf } from './git.ts';
 import { accessProblemMessage, type GitHubAccessProblem } from './github.ts';
@@ -63,6 +66,7 @@ const ACCESS_TITLE: Record<GitHubAccessProblem['kind'], string> = {
 	refused: 'GitHub refused this site',
 	permission: 'GitHub refused a change',
 	expiring: "This site's GitHub token expires soon",
+	cloud: 'No GitHub access through CaraCMS Cloud',
 };
 
 export interface LiveEditor {
@@ -321,10 +325,24 @@ export async function createLiveEditor(
 		// Pre-M7 item 8: a moved document is one entry, on its new file, with its old address.
 		// Read from the moves as recorded, not Site Settings' redirects: removing the redirect leaves it a move.
 		const readNow = (f: string) => (textNow.has(f) ? (textNow.get(f) ?? null) : git.read(f));
-		const moves = movesIn(site, [...waiting.keys()], readNow, new Map(snap.hash(autosaves.movesKey())));
+		// The copy with every autosave on top: where a holder is now, moved or not committed yet.
+		const nowSource = () => {
+			const files = new Map(git.files());
+			for (const a of saves) {
+				if (a.text === null) files.delete(a.file);
+				else files.set(a.file, a.text);
+			}
+			return filesSource(site.root, () => files);
+		};
+		const { records, addresses } = splitMoves(snap.hash(autosaves.movesKey()));
+		// Collections under pages: a held document's addresses come from its holder (read only when something moved).
+		const moved = records.size || addresses.size;
+		const moves = movesIn(site, [...waiting.keys()], readNow, records, moved ? await heldBasesOf(site, nowSource()) : {}, addresses);
 		const redirects = moves.from.size ? redirectsIn(readNow(SITE_SETTINGS_FILE)) : [];
 		for (const [file, from] of moves.from) {
-			const w = waiting.get(file)!;
+			// A held document whose holder moved keeps its file, unchanged: it waits as a move all the same.
+			const w = waiting.get(file) ?? { file, change: 'changed' as const, ...docOf(site, file), title: titleOf(file, readNow(file)), editors: [], changedAt: null, keptDraft: false, uncommitted: false, editingNow: editingNow(file), missingAlt: [] };
+			waiting.set(file, w);
 			w.movedFrom = from;
 			w.movedRedirect = redirects.some((r) => r.from === from);
 		}
@@ -357,9 +375,13 @@ export async function createLiveEditor(
 			notices: Notices.forPerson(person, git.keptDraftNotices(), titleFor, snap.set(noticeStore.dismissedKey), snap.hash(noticeStore.noticesKey).values()),
 			publish: await publishView({ running: snap.string(git.publishLockKey) !== null, record: LiveGit.publishRecordFrom(snap.string(git.publishRecordKey)) }),
 			// Runs-anywhere Decision 5: while it holds, not dismissable.
-			githubAccess: access ? { kind: access.kind, title: ACCESS_TITLE[access.kind], message: accessProblemMessage(access) } : null,
+			githubAccess: access
+				? { kind: access.kind, title: ACCESS_TITLE[access.kind], message: accessProblemMessage(access), link: access.kind === 'cloud' ? access.installUrl : null }
+				: null,
 			// M5a Decision 10: from the committed copy, never an autosave.
 			brand: editorBrand(brandFrom(git.read(SITE_SETTINGS_FILE), site)),
+			// Arrange pages (Decision 18): from the autosaves already in the snapshot, else the copy; no Redis command of its own.
+			pageOrderStamp: pageOrderStamp(orderIn(readNow(SITE_SETTINGS_FILE))),
 		};
 		return json(200, body);
 	});