caracms 0.4.0 → 0.5.1

package/src/editor/server/arrange.ts

@@ -0,0 +1,245 @@
+/**
+ * Arrange pages (Contracts → Apply request): the arrange screen's Apply, both modes.
+ *
+ * **A security boundary, as move is** (move.ts): the paths come from the browser, so the
+ * route is the same POST-JSON-same-origin handler, and every move goes through the
+ * many-move engine (`moveMany`: create.ts → `target`, the store's own checks and locks).
+ *
+ * - `planArrange` expands each root with Change address…'s expansion (move.ts →
+ *   `movesUnder`): everything under it, except what's under another root, which wins for its
+ *   own subtree. It checks every `order` key and slug against the Pages collection as it
+ *   will be once the moves land, and builds the engine's Site Settings edit: the saved order
+ *   re-keyed after the moves, the request's lists replacing those keys (page-order.ts →
+ *   `arrangedOrder`), so the order and the redirects land, or roll back, in one write.
+ * - With no moves (an order-only Apply, Decision 21), the store writes Site Settings alone,
+ *   taking its lock in live mode (`DraftsStore.arrange`).
+ * - Change address… keeps the order current the same way (`orderEdit`, Decision 6).
+ */
+import type { ResolvedCollection, ResolvedSite } from '../../config.ts';
+import type { DocumentEntry } from '../../content.ts';
+import { parseAnyDocument, type SettingsDocument } from '../../document.ts';
+import type { Person } from '../../live/messages.ts';
+import { arrangedOrder, isOrderedCollection, listingStamp, orderAfterMoves, parsePageOrder, type PageOrder, type PathChange } from '../../page-order.ts';
+import { applyKeyedEdits } from '../../serialize.ts';
+import type { ArrangeRequest, ArrangeResponse } from '../types.ts';
+import { refused } from './create.ts';
+import { movesUnder, type PathMove } from './move.ts';
+import { checkOrigin, seqOf, tabOf, WriteRefused, type WriteContext } from './write.ts';
+
+type Site = Pick<ResolvedSite, 'root' | 'collections' | 'blocks'>;
+
+/** An Apply's body can carry a whole tree's order and moves. */
+export const MAX_ARRANGE_BODY_BYTES = 256 * 1024;
+
+const ARRANGE_SHAPE = '{ moves: [{ collection, fromPath, toPath }…], order: { "<parent path>": ["slug"…] }, redirect?, expect? }';
+
+/** Decision 10's sentence when the listing isn't the one the review was planned on. */
+export const CHANGED_MESSAGE = 'The pages changed since you opened the review.';
+
+/** Validate an Apply body's shape. Throws WriteRefused 400. */
+export function parseArrangeBody(body: unknown): ArrangeRequest {
+	const bad = (why: string) => refused(400, 'bad-request', `Malformed body: ${why}. Send ${ARRANGE_SHAPE}.`);
+	if (!body || typeof body !== 'object' || Array.isArray(body)) throw bad('it must be a JSON object');
+	const b = body as Record<string, unknown>;
+	const extra = Object.keys(b).filter((k) => !['moves', 'order', 'redirect', 'expect'].includes(k));
+	if (extra.length) throw bad(`unexpected ${extra.map((k) => JSON.stringify(k.slice(0, 60))).join(', ')}`);
+	if (!Array.isArray(b.moves)) throw bad('"moves" must be a list');
+	const moves = b.moves.map((m, i) => {
+		if (!m || typeof m !== 'object' || Array.isArray(m)) throw bad(`moves[${i}] must be { collection, fromPath, toPath }`);
+		const r = m as Record<string, unknown>;
+		if (Object.keys(r).some((k) => !['collection', 'fromPath', 'toPath'].includes(k))) throw bad(`moves[${i}] must be { collection, fromPath, toPath }`);
+		if (typeof r.collection !== 'string' || r.collection === '') throw bad(`moves[${i}].collection must be a collection's name`);
+		if (typeof r.fromPath !== 'string' || r.fromPath === '') throw bad(`moves[${i}].fromPath must be the page's path`);
+		if (typeof r.toPath !== 'string') throw bad(`moves[${i}].toPath must be the page's new path`);
+		if (r.fromPath.length > 512 || r.toPath.length > 512) throw refused(400, 'bad-path', 'That path is too long.');
+		return { collection: r.collection, fromPath: r.fromPath, toPath: r.toPath };
+	});
+	if (!b.order || typeof b.order !== 'object' || Array.isArray(b.order)) throw bad('"order" must be an object of lists');
+	const order: PageOrder = {};
+	for (const [key, list] of Object.entries(b.order as Record<string, unknown>)) {
+		if (!Array.isArray(list) || !list.every((s) => typeof s === 'string' && s !== '')) throw bad(`order[${JSON.stringify(key.slice(0, 60))}] must be a list of slugs`);
+		if (key.length > 512) throw refused(400, 'bad-path', 'That path is too long.');
+		order[key] = [...new Set(list as string[])];
+	}
+	if (b.redirect !== undefined && typeof b.redirect !== 'boolean') throw bad('"redirect" must be true or false');
+	let expect: Record<string, string> | undefined;
+	if (b.expect !== undefined) {
+		if (!b.expect || typeof b.expect !== 'object' || Array.isArray(b.expect) || !Object.values(b.expect).every((v) => typeof v === 'string')) throw bad('"expect" must be { "<collection>": "<stamp>" }');
+		expect = { ...(b.expect as Record<string, string>) };
+	}
+	return { moves, order, ...(b.redirect === false ? { redirect: false } : {}), ...(expect ? { expect } : {}) };
+}
+
+const orderedCollection = (site: Pick<Site, 'collections'>): ResolvedCollection | undefined => Object.values(site.collections).find((c) => isOrderedCollection(c));
+const settingsCollection = (site: Pick<Site, 'collections'>): ResolvedCollection | undefined => Object.values(site.collections).find((c) => c.kind === 'settings');
+
+/** Site Settings' `pageOrder` in its text (`{}`: none, or the text isn't JSON). */
+export function orderIn(text: string | null): PageOrder {
+	if (text === null) return {};
+	try {
+		const raw = JSON.parse(text) as unknown;
+		return raw && typeof raw === 'object' && !Array.isArray(raw) ? parsePageOrder((raw as Record<string, unknown>).pageOrder) : {};
+	} catch {
+		return {};
+	}
+}
+
+/**
+ * Site Settings' text with `pageOrder` set to `order` (taken out when it's empty), every
+ * other key as it was; `text` null: a new file. Unchanged text when the order is the same,
+ * or when the text isn't JSON (the editor warns about that file).
+ */
+export function settingsWithOrder(site: Pick<Site, 'collections' | 'blocks'>, text: string | null, order: PageOrder): string | null {
+	const collection = settingsCollection(site);
+	if (!collection) return text;
+	let doc: SettingsDocument | null = null;
+	if (text !== null) {
+		try {
+			doc = parseAnyDocument(JSON.parse(text), site, collection) as SettingsDocument;
+		} catch {
+			return text;
+		}
+	}
+	if (doc === null && Object.keys(order).length === 0) return text;
+	return applyKeyedEdits(text, { title: doc?.title ?? 'Site Settings', data: { ...(doc?.data ?? {}), pageOrder: order } }, collection);
+}
+
+/** The sentence an order-only Apply is refused with when Site Settings, which holds the order, can't be read. */
+export const UNREADABLE_SETTINGS_MESSAGE = "Site Settings isn't valid JSON, so the new order can't be saved there. Nothing was changed: fix Site Settings, then apply again.";
+
+/**
+ * An order-only Apply (Decision 21) writes nothing but Site Settings, so one that can't be read
+ * is refused (422 invalid-json) rather than answered `{ ok: true }` with the order dropped.
+ * `text` null (no file yet) is fine: the order makes a new one.
+ */
+export function assertSettingsReadable(site: Pick<Site, 'collections' | 'blocks'>, text: string | null): void {
+	const collection = settingsCollection(site);
+	if (!collection || text === null) return;
+	try {
+		parseAnyDocument(JSON.parse(text), site, collection);
+	} catch {
+		throw refused(422, 'invalid-json', UNREADABLE_SETTINGS_MESSAGE);
+	}
+}
+
+/** The ordered collection's path changes in a list of moves. */
+function pathChanges(site: Pick<Site, 'collections'>, moves: readonly PathMove[]): PathChange[] {
+	const pages = orderedCollection(site);
+	return pages ? moves.filter((m) => m.collection === pages.name).map((m) => ({ from: m.path, to: m.to })) : [];
+}
+const pathsOf = (site: Pick<Site, 'collections'>, documents: readonly DocumentEntry[]) => {
+	const pages = orderedCollection(site);
+	return pages ? documents.filter((d) => d.collection === pages.name).map((d) => d.path) : [];
+};
+
+/** Change address… (Decision 6): the engine's Site Settings edit that keeps a saved order current after these moves. */
+export function orderEdit(site: Site, moves: readonly PathMove[], documents: readonly DocumentEntry[]): (text: string) => string {
+	const changes = pathChanges(site, moves);
+	const before = pathsOf(site, documents);
+	return (text) => {
+		const saved = orderIn(text);
+		if (changes.length === 0 || Object.keys(saved).length === 0) return text;
+		return settingsWithOrder(site, text, orderAfterMoves(saved, changes, before)) ?? text;
+	};
+}
+
+export interface ArrangePlan {
+	/** Every document whose path changes, roots first (each root, then what it carries); empty for an order-only Apply. */
+	moves: PathMove[];
+	/** Site Settings' text → its text with the arranged order (the engine's `editSettings`, or the order-only write). */
+	edit: (text: string | null) => string | null;
+}
+
+/**
+ * The Apply's plan against the listing as it is (`documents`): the roots expanded, the
+ * order checked against the Pages collection as it will be. Throws WriteRefused: the
+ * engine's own refusals for a root (move.ts → `movesUnder`), `not-found` (404) for an
+ * order entry that names nothing once the moves land.
+ */
+export function planArrange(site: Site, request: ArrangeRequest, documents: readonly DocumentEntry[]): ArrangePlan {
+	// Decision 10: the review's listing, collection by collection, before anything is planned.
+	for (const [collection, stamp] of Object.entries(request.expect ?? {})) {
+		const paths = documents.filter((d) => d.collection === collection).map((d) => d.path);
+		if (listingStamp(paths) !== stamp) throw refused(409, 'changed', CHANGED_MESSAGE);
+	}
+	const key = (m: { collection: string; path: string }) => `${m.collection}\0${m.path}`;
+	// Shallowest first, so an inner root wins for its own subtree.
+	const roots = [...request.moves].sort((a, b) => a.fromPath.split('/').length - b.fromPath.split('/').length);
+	const seen = new Set<string>();
+	for (const r of roots) {
+		const k = key({ collection: r.collection, path: r.fromPath });
+		if (seen.has(k)) throw refused(400, 'bad-request', `${r.fromPath} is in the plan twice.`);
+		seen.add(k);
+	}
+	const planned = new Map<string, PathMove>();
+	for (const r of roots) {
+		for (const m of movesUnder(site, { collection: r.collection, path: r.fromPath, to: r.toPath }, documents)) planned.set(key(m), m);
+	}
+	// Roots in the order asked, each followed by what it carries (what the innermost root above it carries).
+	const ownerOf = (m: PathMove) =>
+		request.moves.filter((o) => o.collection === m.collection && (m.path === o.fromPath || m.path.startsWith(`${o.fromPath}/`))).sort((a, b) => b.fromPath.length - a.fromPath.length)[0]!;
+	const ordered: PathMove[] = [];
+	for (const r of request.moves) {
+		ordered.push(planned.get(key({ collection: r.collection, path: r.fromPath }))!);
+		for (const m of planned.values()) if (m.path !== r.fromPath && ownerOf(m) === r) ordered.push(m);
+	}
+
+	// The Pages collection once the moves land: every `order` key and slug names something there.
+	const changes = pathChanges(site, ordered);
+	const before = pathsOf(site, documents);
+	const moving = new Map(changes.map((c) => [c.from, c.to]));
+	const after = before.map((p) => moving.get(p) ?? p);
+	const known = new Set<string>(['']);
+	for (const p of after) {
+		const parts = p.split('/');
+		for (let i = 1; i <= parts.length; i++) known.add(parts.slice(0, i).join('/'));
+	}
+	for (const [parent, slugs] of Object.entries(request.order)) {
+		if (!known.has(parent)) throw refused(404, 'not-found', `There's no page or group at /${parent} any more.`);
+		for (const slug of slugs) {
+			const path = parent === '' ? slug : `${parent}/${slug}`;
+			if (!known.has(path)) throw refused(404, 'not-found', `There's no page or group at /${path} any more.`);
+		}
+	}
+	const edit = (text: string | null) => settingsWithOrder(site, text, arrangedOrder(orderIn(text), request.order, changes, before));
+	return { moves: ordered, edit };
+}
+
+// ── The route ──────────────────────────────────────────────────────────────
+
+const json = (status: number, body: unknown, headers: Record<string, string> = {}) =>
+	new Response(JSON.stringify(body), {
+		status,
+		headers: { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store', ...headers },
+	});
+
+/** What the route needs of the drafts store. */
+export interface Arranges {
+	arrange(request: ArrangeRequest, context?: WriteContext): Promise<ArrangeResponse>;
+}
+
+/** POST /_caracms/arrange: a Request in, a Response out, through the mode's store (move.ts's handling, the same checks). */
+export async function handleArrange(request: Request, store: Arranges, who: { person?: Person | null } = {}): Promise<Response> {
+	try {
+		if (request.method !== 'POST') throw new WriteRefused(405, 'The arrange route only takes POST.');
+		checkOrigin(request);
+		const type = request.headers.get('content-type') ?? '';
+		if (!/^application\/json\s*(;|$)/i.test(type)) throw new WriteRefused(415, 'Send JSON (Content-Type: application/json).');
+		const length = Number(request.headers.get('content-length') ?? 0);
+		if (length > MAX_ARRANGE_BODY_BYTES) throw new WriteRefused(413, 'That body is too large.');
+		const raw = await request.text();
+		if (Buffer.byteLength(raw) > MAX_ARRANGE_BODY_BYTES) throw new WriteRefused(413, 'That body is too large.');
+		let body: unknown;
+		try {
+			body = JSON.parse(raw);
+		} catch {
+			throw refused(400, 'bad-request', 'Malformed body: it isn\'t valid JSON.');
+		}
+		const context: WriteContext = { person: who.person ?? null, tab: tabOf(request), release: false, seq: seqOf(request) };
+		return json(200, await store.arrange(parseArrangeBody(body), context));
+	} catch (error) {
+		if (error instanceof WriteRefused) return json(error.status, { error: error.message, ...error.body }, error.status === 405 ? { Allow: 'POST' } : {});
+		console.error('[caracms] arrange failed:', error);
+		return json(500, { error: `That didn't work (${error instanceof Error ? error.message : String(error)}).` });
+	}
+}

package/src/editor/server/drafts-store.ts

@@ -6,12 +6,13 @@
  *
  * Everything reads at request time (never imported, Decision 5), and keeps no state.
  */
-import { stat } from 'node:fs/promises';
+import { stat, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { SITE_SETTINGS_FILE, type ResolvedSite } from '../../config.ts';
 import { diskSource, listDocuments, readDocument, type ContentSource } from '../../content.ts';
-import type { AnyOpenedDocument, CreateRequest, CreateResponse, DeleteRequest, DeleteResponse, ListedDocument, MoveRequest, MoveResponse, OpenedDocument, ReplaceFileRequest, ReplaceFileResponse } from '../types.ts';
+import type { AnyOpenedDocument, ArrangeRequest, ArrangeResponse, CreateRequest, CreateResponse, DeleteRequest, DeleteResponse, ListedDocument, MoveRequest, MoveResponse, OpenedDocument, ReplaceFileRequest, ReplaceFileResponse } from '../types.ts';
 import { confineOnDisk, createOnDisk, deleteOnDisk, planCreate, planDelete, target } from './create.ts';
+import { assertSettingsReadable, orderEdit, planArrange } from './arrange.ts';
 import { movesChanges, movesOnDisk, moveResponse, movesUnder, planMoves, settingsWithoutRedirectFrom, type ManyMoveRequest } from './move.ts';
 import { replaceChanges, replaceResponse } from './replace.ts';
 import { applyWrite, fileVersion, writeAtomic, type WriteContext, type WriteRequest, type WriteResponse } from './write.ts';
@@ -66,6 +67,13 @@ export interface DraftsStore {
 	 * autosave, all rolled back on a failure, all going out at the next Publish. Throws WriteRefused.
 	 */
 	moveMany(request: ManyMoveRequest, context?: WriteContext): Promise<MoveResponse>;
+	/**
+	 * Arrange pages (Contracts → Apply request): the roots expanded and checked (arrange.ts →
+	 * `planArrange`), then the moves through `moveMany` with the arranged order as its Site
+	 * Settings edit, landing or rolling back together; with no moves, Site Settings alone
+	 * (live mode: under its lock, Decision 21). Throws WriteRefused.
+	 */
+	arrange(request: ArrangeRequest, context?: WriteContext): Promise<ArrangeResponse>;
 	/**
 	 * M6c G4 (Decision 9): Replace… on a file. Every link to `from`, in every document, points
 	 * at `to` (replace.ts has the rules, the same in both stores). Local: each file written
@@ -125,10 +133,32 @@ export function localDraftsStore(site: Site): DraftsStore {
 		async move(request) {
 			// The file first (a link out of the collection is refused before anything else), then the rules.
 			await confineOnDisk(site, target(site, request.collection, request.path).file);
-			const moves = movesUnder(site, request, await listDocuments(site));
-			return moveMany({ moves, ...(request.redirect === false ? { redirect: false } : {}) });
+			const documents = await listDocuments(site);
+			const moves = movesUnder(site, request, documents);
+			// Arrange pages (Decision 6): a saved order follows the move, in the same Site Settings write.
+			return moveMany({ moves, ...(request.redirect === false ? { redirect: false } : {}), editSettings: orderEdit(site, moves, documents) });
 		},
 		moveMany,
+		async arrange(request) {
+			// The files first (a link out of the collection is refused before anything else), then the plan.
+			for (const m of request.moves) await confineOnDisk(site, target(site, m.collection, m.fromPath).file);
+			const plan = planArrange(site, request, await listDocuments(site));
+			// An unreadable Site Settings would drop the order and the redirects without a word: refuse every Apply.
+			assertSettingsReadable(site, await diskSource.readText(join(site.root, SITE_SETTINGS_FILE)));
+			if (plan.moves.length) {
+				await moveMany({ moves: plan.moves, ...(request.redirect === false ? { redirect: false } : {}), editSettings: (text) => plan.edit(text) ?? text });
+				return { ok: true };
+			}
+			const file = join(site.root, SITE_SETTINGS_FILE);
+			const before = await diskSource.readText(file);
+			assertSettingsReadable(site, before);
+			const after = plan.edit(before);
+			if (after !== null && after !== before) {
+				if (before === null) await writeFile(file, after, { encoding: 'utf8', flag: 'wx', mode: 0o644 });
+				else await writeAtomic(file, after);
+			}
+			return { ok: true };
+		},
 		async replaceFile(request) {
 			const changes = await replaceChanges(site, request, await listDocuments(site), (file) => diskSource.readText(join(site.root, file)));
 			// As a local move writes its relinked files: each confined and atomic, in listing order.

package/src/editor/server/move.ts

@@ -46,7 +46,7 @@ import { documentUrl, type DocumentEntry } from '../../content.ts';
 import { heldBases, withHeldBases, type HeldBase } from '../../held.ts';
 import { own, parseAnyDocument, type SettingsDocument } from '../../document.ts';
 import type { Person } from '../../live/messages.ts';
-import { redirectsAddedBy, redirectsAfterMoves, type Redirect } from '../../redirects.ts';
+import { redirectsAddedBy, redirectsAfterMoves, type LiveHome, type Redirect } from '../../redirects.ts';
 import { relinkText, type AddressMove } from '../../relink.ts';
 import { schemaRef, stampSchema } from '../../schema-key.ts';
 import { applyKeyedEdits } from '../../serialize.ts';
@@ -267,14 +267,16 @@ const settingsCollection = (site: Site): ResolvedCollection | undefined => Objec
 /**
  * Site Settings' text once its redirects follow every move (redirects.ts →
  * `redirectsAfterMoves`: all at once, against the list before the plan, so a swap or a
- * chain comes out right; `add` per move), its own links are rewritten, and the caller's own
- * `edit` is applied; null when nothing changes. `text` null: there's no Site Settings file yet.
+ * chain comes out right; `add` per move; `homes`, live mode's documents whose live address
+ * is elsewhere, for a live address a move vacates), its own links are rewritten, and the
+ * caller's own `edit` is applied; null when nothing changes. `text` null: there's no Site Settings file yet.
  */
 export function settingsAfterMoves(
 	site: Site,
 	text: string | null,
 	moves: readonly { move: AddressMove; add: boolean }[],
 	edit?: (text: string) => string,
+	homes: readonly LiveHome[] = [],
 ): string | null {
 	const collection = settingsCollection(site);
 	if (!collection) return null;
@@ -288,7 +290,7 @@ export function settingsAfterMoves(
 		}
 	}
 	const doc = parseAnyDocument(raw, site, collection) as SettingsDocument;
-	const redirects = redirectsAfterMoves(doc.data.redirects ?? [], moves.map((m) => ({ from: m.move.fromUrl, to: m.move.toUrl, add: m.add })));
+	const redirects = redirectsAfterMoves(doc.data.redirects ?? [], moves.map((m) => ({ from: m.move.fromUrl, to: m.move.toUrl, add: m.add })), homes);
 	const title = relinked === null ? 'Site Settings' : doc.title;
 	let after = applyKeyedEdits(relinked, { title, data: { ...doc.data, redirects } }, collection);
 	if (edit) after = edit(after);
@@ -324,6 +326,14 @@ export function settingsWithoutRedirectFrom(site: Site, text: string | null, url
  * What the plan changes, from the store's own texts (`readText` by site-relative file;
  * live mode's has the autosaves on top): each linking file rewritten once for all the
  * moves that touch it. `addRedirect(plan)`: whether that address gets `old → new`.
+ *
+ * `liveAddressOf(file)` (live mode, passed only when the move leaves redirects): a
+ * document's live address by its file before the plan, when it isn't where the document is
+ * (moved since the last Publish; autosaves.ts → `addresses`), else null. When a move
+ * vacates such an address and no document takes it, it redirects to where that document
+ * is once the plan has landed (redirects.ts → `redirectsAfterMoves`'s `homes`): after a
+ * chain A → B, B → C, B's document has no redirect from B (A's sat there), so A's moving
+ * on from B leaves `B → C`.
  */
 export async function movesChanges(
 	site: Site,
@@ -332,6 +342,7 @@ export async function movesChanges(
 	readText: (file: string) => Promise<string | null>,
 	addRedirect: (plan: MovePlan) => boolean,
 	editSettings?: (text: string) => string,
+	liveAddressOf?: (file: string) => string | null,
 ): Promise<MoveChanges> {
 	const moves = plans.map((p) => p.move);
 	const collectionOf = (name: string) => site.collections[name]!;
@@ -354,23 +365,46 @@ export async function movesChanges(
 	}
 	const before = await readText(SITE_SETTINGS_FILE);
 	const adds = plans.map((p) => ({ move: p.move, add: addRedirect(p) }));
-	const after = settingsAfterMoves(site, before, adds, editSettings);
+	const homes = liveAddressOf ? liveHomes(site, plans, documents, liveAddressOf) : [];
+	const after = settingsAfterMoves(site, before, adds, editSettings, homes);
 	const settings = settingsCollection(site);
 	return {
 		moved,
 		relinked,
 		settings: after === null ? null : { before, after },
-		redirects: redirectsAddedBy(adds.map((a) => ({ from: a.move.fromUrl, to: a.move.toUrl, add: a.add }))),
+		redirects: redirectsAddedBy(adds.map((a) => ({ from: a.move.fromUrl, to: a.move.toUrl, add: a.add })), homes),
 		settingsRelinked: !!settings && before !== null && relinkText(before, moves, site, settings).links > 0,
 	};
 }
 
+/** Each document with a live address elsewhere (`liveAddressOf`), and its address once the plan has landed. */
+function liveHomes(site: Site, plans: readonly MovePlan[], documents: readonly DocumentEntry[], liveAddressOf: (file: string) => string | null): LiveHome[] {
+	const planned = new Map(plans.map((p) => [p.from.file, p]));
+	let sited: Site | null = null;
+	const homes: LiveHome[] = [];
+	for (const d of documents) {
+		const live = liveAddressOf(d.file);
+		if (live === null) continue;
+		const plan = planned.get(d.file);
+		let now: string | null;
+		if (plan) now = plan.to.url;
+		else {
+			// Not in the plan: its address doesn't change (a held document whose holder moves is in it).
+			sited ??= withHeldBases(site, heldBases(site.collections, documents));
+			const collection = sited.collections[d.collection];
+			now = collection ? documentUrl(collection, d.path) : null;
+		}
+		if (now !== null) homes.push({ live, now });
+	}
+	return homes;
+}
+
 /** The route's answer for a plan done: the first plan's document is the one asked about. */
 export function moveResponse(plans: readonly MovePlan[], changes: MoveChanges): MoveResponse {
 	const [first] = plans;
 	const relinked = changes.relinked.map(({ collection, path, title }) => ({ collection, path, title }));
 	if (changes.settingsRelinked) relinked.push({ collection: 'settings', path: 'site-settings', title: 'Site Settings' });
-	const redirectOf = (p: MovePlan) => changes.redirects.find((r) => r.from === p.move.fromUrl) ?? null;
+	const redirectOf = (p: MovePlan) => changes.redirects.find((r) => r.from === p.move.fromUrl && r.to === p.move.toUrl) ?? null;
 	return {
 		ok: true,
 		collection: first!.to.collection,

package/src/editor/styles/levels/arrange.css

@@ -0,0 +1,152 @@
+/*
+  Arrange pages (notes/2026-10-25-arrange-pages.md; the mockup's notes/mockups/arrange-pages.html, as drawn).
+  The screen takes the preview's place as a light sheet over the stage, the way a collection's table does
+  (collections.css → .stage-table); the pane holds its level ("Arrange pages", then "Review").
+  Rows are the Pages tree's rows grown wide: a grip, the name at its depth (16px steps), the address, the row's end.
+  Marks are washes, full rings, chips and labels. No side rails anywhere (M2 Decision 10).
+*/
+:root{
+  --arr-max-w:940px;     /* the tree's width on the stage: names and addresses side by side, left-aligned under its head */
+  --arr-row-h:32px;      /* a row: a touch taller than the sidebar's 30px, a bigger target to drag and drop on */
+  --arr-grip-w:24px;     /* the grip's column; a row's icon starts after it, then one --tree-indent per depth */
+  --arr-addr-w:300px;    /* the address column, at its widest */
+  --arr-addr-min:140px;  /* the address column at its narrowest (the editor's 1,024px floor), where it gives way to the name first */
+  --arr-name-min:200px;  /* the name column's narrowest: an icon, a name cut short, and a mark or two */
+  --arr-end-w:184px;     /* a row's end: its actions (Rename…, Remove), the inside tag, the twisty */
+  --arr-mark:2px;        /* the beside line's weight; the inside ring is the same 2px, all the way round */
+  --arr-ghost-w:300px;   /* the dragged card's widest */
+}
+.stage.is-arrange .frame{visibility:hidden}
+.arr{position:absolute;inset:0;z-index:3;display:flex;flex-direction:column;min-height:0;background:var(--surface);color:var(--text);animation:fade-in var(--dur-base) var(--ease-out)}
+.arr-head{flex:none;padding:var(--space-4) var(--space-6) var(--space-3);border-bottom:1px solid var(--border)}
+.arr-head-in{max-width:var(--arr-max-w);display:grid;grid-template-columns:minmax(0,1fr) auto;align-items:center;gap:var(--space-2) var(--space-3)}
+.arr-title{display:flex;align-items:baseline;gap:var(--space-2);min-width:0}
+.arr-title h2{margin:0;font-size:var(--text-xl);font-weight:var(--weight-semibold);letter-spacing:var(--tracking-tight);white-space:nowrap}
+.arr-title .n-chip{font-size:var(--text-sm);font-weight:var(--weight-medium);color:var(--text-subtle);white-space:nowrap}
+.arr-hint{grid-column:1 / -1;display:flex;flex-wrap:wrap;align-items:center;gap:var(--space-1-5) var(--space-5);font-size:var(--text-sm);color:var(--text-muted)}
+.arr-ro{display:inline-flex;align-items:center;gap:var(--space-1-5);font-size:var(--text-sm);color:var(--text-muted)}
+/* The two markers' key, drawn as the markers themselves */
+.key{display:inline-flex;align-items:center;gap:var(--space-2);white-space:nowrap}
+.key-line{position:relative;width:26px;height:var(--arr-mark);border-radius:2px;background:var(--select)}
+.key-line::before{content:"";position:absolute;left:-3px;top:50%;width:6px;height:6px;translate:0 -50%;border:2px solid var(--select);border-radius:50%;background:var(--surface)}
+.key-ring{width:26px;height:14px;border-radius:var(--radius-sm);background:var(--select-wash);box-shadow:0 0 0 var(--arr-mark) var(--select)}
+.arr-scroll{flex:1;min-height:0;overflow:auto;overscroll-behavior:contain;padding:0 var(--space-6) var(--space-10);scrollbar-width:thin;scrollbar-color:var(--border-hover) transparent}
+.arr-cols{position:sticky;top:0;z-index:2;max-width:var(--arr-max-w);display:grid;grid-template-columns:var(--arr-grip-w) minmax(var(--arr-name-min),1fr) minmax(var(--arr-addr-min),var(--arr-addr-w)) var(--arr-end-w);align-items:center;height:34px;margin-bottom:var(--space-1);background:var(--surface);border-bottom:1px solid var(--border);font-size:var(--text-xs);font-weight:var(--weight-semibold);letter-spacing:var(--tracking-caps);text-transform:uppercase;color:var(--text-subtle)}
+.arr-tree{position:relative;max-width:var(--arr-max-w)}
+/* A row */
+.arow{position:relative;display:grid;grid-template-columns:var(--arr-grip-w) minmax(var(--arr-name-min),1fr) minmax(var(--arr-addr-min),var(--arr-addr-w)) var(--arr-end-w);align-items:center;min-height:var(--arr-row-h);border:1px solid transparent;border-radius:var(--radius-md);transition:background var(--dur-fast),border-color var(--dur-fast),box-shadow var(--dur-fast)}
+.arow:hover{background:var(--surface-hover)}
+.arow[data-drag]{cursor:grab}
+.ag{display:grid;place-items:center;align-self:stretch;color:var(--icon)}
+.arow[data-drag]:hover .ag{color:var(--text)}
+.an{display:flex;align-items:center;gap:var(--space-2);min-width:0;overflow:hidden;padding-left:calc(var(--depth,0) * var(--tree-indent));padding-right:var(--space-2)}
+.an>.i{flex:none;color:var(--icon)}
+.an .nm{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.an .meta{display:inline-flex;flex:0 1 auto;align-items:center;gap:var(--space-1-5);min-width:0;overflow:hidden;font-size:var(--text-xs);color:var(--text-subtle);white-space:nowrap}
+.an .meta .chip{flex:none;height:18px;font-size:var(--text-2xs)}
+.an .meta>:not(.chip){min-width:0;overflow:hidden;text-overflow:ellipsis}
+.an .cnt{font-variant-numeric:tabular-nums}
+.aa{min-width:0;padding-right:var(--space-2);overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font:var(--text-xs)/1.3 var(--font-mono);color:var(--text-muted)}
+.aa .new{color:var(--select-strong);font-weight:var(--weight-medium)}
+.aa .was{margin-left:var(--space-2);color:var(--text-subtle);font-family:var(--font-ui)}
+.aa .was .mono{font-family:var(--font-mono)}
+.ae{display:flex;align-items:center;justify-content:flex-end;gap:var(--space-1);min-width:0;padding-right:var(--space-1)}
+.ae .act{opacity:0;transition:opacity var(--dur-fast)}
+.arow:hover .ae .act,.arow:focus-within .ae .act{opacity:1}
+.ae .carried{font-size:var(--text-xs);color:var(--text-subtle);white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+.atw{display:grid;place-items:center;width:calc(var(--tree-twisty) + 6px);height:calc(var(--tree-twisty) + 6px);flex:none;padding:0;border:0;border-radius:var(--radius-sm);background:none;color:var(--icon);transition:background var(--dur-fast),color var(--dur-fast)}
+.atw:hover{background:var(--surface-pressed);color:var(--text)}
+.atw .i{transition:rotate var(--dur-fast) var(--ease-out)}
+.atw[aria-expanded="true"] .i{rotate:90deg}
+.atw-gap{width:calc(var(--tree-twisty) + 6px);flex:none}
+/* Home: fixed, first, takes nothing */
+.arow.is-home .an .nm{font-weight:var(--weight-medium)}
+/* A held collection's row: moves with its page; nothing drags it, nothing drops on it */
+.arow.is-held{color:var(--text-muted)}
+.arow.is-held:hover{background:none}
+/* Marks for what's changed here and not applied yet: the tool's blue in a chip, and the new address in blue */
+.arow.is-gone .an .nm,.arow.is-gone .an>.i{color:var(--text-subtle)}
+.arow.is-gone .aa{color:var(--text-subtle);font-family:var(--font-ui)}
+/* A new group with nothing in it: a full dashed ring (an empty slot, like .empty and .add-row), and its line under it */
+.arow.is-empty{border:1px dashed var(--border-strong)}
+.arow-sub{display:flex;align-items:center;flex-wrap:wrap;gap:var(--space-1-5) var(--space-2);min-height:24px;margin:0 0 var(--space-1);padding-left:calc(var(--arr-grip-w) + var(--depth,0) * var(--tree-indent) + 24px);font-size:var(--text-sm);color:var(--text-muted)}
+.arow-sub.err{color:var(--status-danger);font-weight:var(--weight-medium)}
+.arow-sub .i{flex:none}
+/* Naming a new group, or renaming one, in its row */
+.arow.is-naming{background:var(--surface-sunken);border-color:var(--border)}
+.arow.is-naming:hover{background:var(--surface-sunken)}
+.arow.is-naming .an .input{width:min(260px,100%);min-height:26px;height:26px;padding:2px 8px;font-size:var(--text-base)}
+.arow.is-naming .ae .btn{flex:none}
+/* Linked from the review: hovering an entry there washes its row here */
+.arow.is-linked{background:var(--select-wash)}
+/* Dragging. The row being dragged keeps its place as a dashed outline (the block list's ghost, .brow.is-ghost); what's under it goes with it. */
+.arow.is-src{background:none;border:1px dashed var(--border-strong)}
+.arow.is-src>*{visibility:hidden}
+/* Inside: the row it goes into gets the selection's wash and a full 2px ring, and says so at its end */
+.arow.is-into,.arow.is-into:hover{background:var(--select-wash);border-color:var(--select);box-shadow:0 0 0 1px var(--select)}
+.arow.is-into .an .nm{color:var(--select-strong);font-weight:var(--weight-semibold)}
+.arow.is-into .an>.i{color:var(--select-strong)}
+.tag{display:inline-flex;align-items:center;gap:var(--space-1);height:20px;padding:0 var(--space-2);border-radius:var(--radius-pill);background:var(--select);color:var(--on-fill);font-size:var(--text-xs);font-weight:var(--weight-semibold);white-space:nowrap}
+/* Refused: a danger wash and a full thin ring, and the reason in one line across the address and the end */
+.arow.is-refused,.arow.is-refused:hover{background:var(--status-danger-wash);border-color:var(--status-danger-border)}
+.arow-why{grid-column:3 / 5;display:flex;align-items:center;gap:var(--space-1-5);min-width:0;padding-right:var(--space-2);font-size:var(--text-sm);font-weight:var(--weight-medium);color:var(--status-danger);white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+/* Beside: a 2px line between two rows, starting where that level's icons start (so its indent says which level), a ring at its
+   start, and the level it lands in at its end. The line is a marker across the row, never a bar down a card's side. */
+.amark{position:absolute;right:0;z-index:4;height:var(--arr-mark);border-radius:2px;background:var(--select);box-shadow:0 0 0 2px var(--surface);pointer-events:none}
+.amark::before{content:"";position:absolute;left:-4px;top:50%;width:8px;height:8px;translate:0 -50%;border:2px solid var(--select);border-radius:50%;background:var(--surface)}
+.amark .tag{position:absolute;right:var(--space-1);top:50%;translate:0 -50%;box-shadow:0 0 0 2px var(--surface)}
+/* The card under the pointer while dragging */
+.adrag{position:fixed;left:0;top:0;z-index:70;display:grid;grid-template-columns:16px minmax(0,1fr);align-items:center;gap:2px var(--space-2);min-width:220px;max-width:var(--arr-ghost-w);padding:var(--space-2) var(--space-3) var(--space-2) var(--space-2-5);background:var(--surface);border:1px solid var(--border-strong);border-radius:var(--radius-md);box-shadow:var(--shadow-drag);pointer-events:none;font-size:var(--text-base)}
+.adrag>.i{color:var(--icon)}
+.adrag .nm{display:flex;align-items:baseline;gap:var(--space-1-5);min-width:0;font-weight:var(--weight-semibold);white-space:nowrap;overflow:hidden}
+.adrag .nm small{font-size:var(--text-xs);font-weight:var(--weight-regular);color:var(--text-subtle);overflow:hidden;text-overflow:ellipsis}
+.adrag .to{grid-column:2;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font:var(--text-xs)/1.35 var(--font-mono);color:var(--select-strong)}
+.adrag .to.plain{font-family:var(--font-ui);color:var(--text-muted)}
+.adrag.no{border-color:var(--status-danger-border)}
+.adrag.no .to{display:flex;align-items:center;gap:var(--space-1);font-family:var(--font-ui);font-weight:var(--weight-medium);color:var(--status-danger)}
+body.is-dragging,body.is-dragging *{cursor:grabbing!important;user-select:none}
+body.is-dragging.is-no,body.is-dragging.is-no *{cursor:not-allowed!important}
+
+/* The pane's levels: Arrange pages, then Review */
+.arr-none{font-size:var(--text-sm);color:var(--text-muted)}
+.chg{list-style:none;margin:0 calc(-1 * var(--space-1));padding:0;display:flex;flex-direction:column;gap:1px}
+.chg li{display:grid;grid-template-columns:16px minmax(0,1fr);gap:var(--space-2);padding:var(--space-1-5) var(--space-1);border-radius:var(--radius-md);font-size:var(--text-sm);color:var(--text-muted);line-height:1.4}
+.chg li .i{margin-top:1px;color:var(--icon)}
+.chg li b{color:var(--text);font-weight:var(--weight-semibold)}
+.chg li.is-muted b{color:var(--text-muted)}
+.arr-foot{flex:none;padding:var(--space-3) var(--space-4) var(--space-4);border-top:1px solid var(--border);background:var(--surface)}
+.arr-foot .why{display:grid;grid-template-columns:16px minmax(0,1fr);gap:var(--space-1-5);margin-bottom:var(--space-3);font-size:var(--text-sm);color:var(--text-muted)}
+.arr-foot .why .i{margin-top:1px;color:var(--icon)}
+.arr-foot .why b{color:var(--text);font-weight:var(--weight-semibold)}
+.arr-foot .busy{margin-bottom:var(--space-3);font-size:var(--text-sm);color:var(--status-waiting)}
+.arr-foot .acts{display:flex;justify-content:flex-end;gap:var(--space-2)}
+/* The review: what moves, where, and whether old links keep working */
+.rv-lead{margin-bottom:var(--space-4);font-size:var(--text-md);font-weight:var(--weight-semibold);line-height:1.35}
+.rv-lead small{display:block;margin-top:2px;font-size:var(--text-sm);font-weight:var(--weight-regular);color:var(--text-muted)}
+.rv{list-style:none;margin:0 calc(-1 * var(--space-1));padding:0;display:flex;flex-direction:column;gap:1px}
+.rv-e{display:grid;grid-template-columns:16px minmax(0,1fr);column-gap:var(--space-2);row-gap:1px;margin-left:calc(var(--in,0) * var(--tree-indent));padding:var(--space-1-5) var(--space-1);border-radius:var(--radius-md);transition:background var(--dur-fast)}
+.rv-e:hover{background:var(--surface-hover)}
+.rv-e>.i{margin-top:1px;color:var(--icon)}
+.rv-e .t{display:flex;align-items:center;flex-wrap:wrap;gap:var(--space-1) var(--space-1-5);min-width:0;font-weight:var(--weight-semibold);line-height:1.35}
+.rv-e .t .chip{height:18px;font-size:var(--text-2xs)}
+.rv-e.is-carried .t,.rv-e.is-held .t{font-weight:var(--weight-medium)}
+.rv-e.is-gone .t{font-weight:var(--weight-medium);color:var(--text-muted)}
+.rv-e.is-gone>.i{color:var(--text-subtle)}
+.mv{grid-column:2;display:flex;flex-wrap:wrap;column-gap:var(--space-1);min-width:0;font:var(--text-xs)/1.5 var(--font-mono);color:var(--text-subtle);overflow-wrap:anywhere}
+.mv .to{color:var(--text)}
+.rv-more{margin-left:auto;font-size:var(--text-xs)}
+.rv-more .i{transition:rotate var(--dur-fast) var(--ease-out)}
+.rv-more[aria-expanded="true"] .i{rotate:90deg}
+.rv-docs{grid-column:2;list-style:none;margin:var(--space-1-5) 0 0;padding:var(--space-1-5) var(--space-2);border:1px solid var(--border);border-radius:var(--radius-md);background:var(--surface-sunken);font:var(--text-xs)/1.6 var(--font-mono);color:var(--text-muted);overflow-wrap:anywhere}
+.rv-docs li.is-new{color:var(--status-warning-strong);font-weight:var(--weight-medium)}
+.rv-tick{margin-top:var(--space-4);padding-top:var(--space-4);border-top:1px solid var(--border)}
+.rv-tick .field-help{margin-bottom:0}
+/* Shared pieces the mockup draws outside a dialog or a level's own CSS: the tick, and the order-only panel's fixed line */
+.rv-tick .check{display:flex;align-items:center;gap:var(--space-2);font-size:var(--text-sm);font-weight:var(--weight-medium);color:var(--text);cursor:pointer}
+.rv-tick .check input{flex:none;width:16px;height:16px;margin:0;accent-color:var(--select);cursor:inherit}
+.rv-tick .check + .field-help{margin-top:var(--space-1);padding-left:calc(16px + var(--space-2))}
+.rv-tick .check:has(input:disabled){cursor:not-allowed;color:var(--text-muted)}
+.side-level[data-pane-level="arrange"] .sec-h .n{font-weight:var(--weight-medium);letter-spacing:0;color:var(--text-subtle)}
+.arow.is-naming .input[aria-invalid="true"]{border-color:var(--status-danger);box-shadow:0 0 0 3px var(--status-danger-halo)}
+.arr-foot .progress{margin:0 0 var(--space-2-5)}
+.mv .fr{margin-top:0}