@avocadostudio-ai/orchestrator-core 0.1.0

package/dist/state/session-state.js

@@ -0,0 +1,1083 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { demoPublishedPages, demoSiteConfig, ensureItemIds, IMAGE_PLACEHOLDER } from "@avocadostudio-ai/shared";
+import { toErrorDetail as _unifiedToErrorDetail } from "../errors.js";
+import { archiveMigratedJson, getStore, readLegacyJson, resolveJsonMigrationTtlDays, sweepStaleMigrations, } from "./sqlite-store-singleton.js";
+import { CHAT_HISTORY_CAP, HISTORY_DEPTH_CAP, RECENT_EDITS_CAP, VERSION_LOG_CAP, PUBLISH_LOG_CAP, } from "./sqlite-store.js";
+// Single source of truth for these caps is `sqlite-store.ts`. Re-exported
+// under the legacy names so existing imports keep working.
+export const HISTORY_DEPTH_MAX = HISTORY_DEPTH_CAP;
+export const VERSION_LOG_MAX = VERSION_LOG_CAP;
+export const CHAT_HISTORY_MAX_TURNS = CHAT_HISTORY_CAP;
+export const PUBLISH_LOG_MAX = PUBLISH_LOG_CAP;
+// ---------------------------------------------------------------------------
+// Session-key helpers
+// ---------------------------------------------------------------------------
+export const DEFAULT_SITE_ID = "avocado-stories";
+export const DEFAULT_SESSION = "dev";
+export function normalizeSiteId(value) {
+    if (typeof value !== "string")
+        return DEFAULT_SITE_ID;
+    const cleaned = value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return cleaned || DEFAULT_SITE_ID;
+}
+export function normalizeSession(value) {
+    if (typeof value !== "string")
+        return DEFAULT_SESSION;
+    const cleaned = value.trim();
+    return cleaned || DEFAULT_SESSION;
+}
+/** Returns true for the default JSON-file site (avocado-stories). */
+export function isLegacySiteId(siteId) {
+    return siteId === DEFAULT_SITE_ID || siteId === "default";
+}
+export function scopedSessionKey(session, siteId) {
+    const normalizedSession = normalizeSession(session);
+    const normalizedSiteId = normalizeSiteId(siteId);
+    if (isLegacySiteId(normalizedSiteId)) {
+        return normalizedSession;
+    }
+    return `${normalizedSiteId}::${normalizedSession}`;
+}
+export const continuationChainBySession = new Map();
+// ---------------------------------------------------------------------------
+// State maps
+// ---------------------------------------------------------------------------
+export const publishedPages = new Map();
+for (const page of demoPublishedPages())
+    publishedPages.set(page.slug, structuredClone(page));
+export const draftPages = new Map();
+export const historyUndo = new Map();
+export const historyRedo = new Map();
+export const versions = new Map();
+export const recentEdits = new Map();
+export const versionLog = new Map();
+/**
+ * Per-session publish-log entries — one row per `POST /publish` attempt.
+ * Mirrors the SQLite `publish_log` table. Unlike most other state maps, this
+ * one is NOT included in `writeAllStateToStore`'s drop-and-reinsert pass:
+ * publish entries support async UPDATE (deploy resolves seconds later) and
+ * the SQLite row is the source of truth. Writes go straight through via
+ * `pushPublishLogEntry` / `updatePublishLogStatus`; this Map is a read cache.
+ */
+export const publishLogBySession = new Map();
+/**
+ * Per-ticket slugs touched by an agent run. Survives the execute→publish
+ * invocation gap so the publish-mode comment can list exactly what this
+ * ticket changed, rather than every page in the shared session. Capped at
+ * ISSUE_TOUCHED_MAX entries (oldest dropped by updatedAt).
+ */
+export const issueTouchedSlugsByKey = new Map();
+const ISSUE_TOUCHED_MAX = 200;
+export function setIssueTouchedSlugs(issueKey, slugs) {
+    if (!issueKey)
+        return;
+    issueTouchedSlugsByKey.set(issueKey, {
+        slugs: Array.from(new Set(slugs.filter((s) => typeof s === "string" && s.length > 0))),
+        updatedAt: new Date().toISOString(),
+    });
+    if (issueTouchedSlugsByKey.size > ISSUE_TOUCHED_MAX) {
+        const sorted = Array.from(issueTouchedSlugsByKey.entries())
+            .sort((a, b) => a[1].updatedAt.localeCompare(b[1].updatedAt));
+        const toDelete = sorted.slice(0, issueTouchedSlugsByKey.size - ISSUE_TOUCHED_MAX);
+        for (const [key] of toDelete)
+            issueTouchedSlugsByKey.delete(key);
+    }
+}
+export function getIssueTouchedSlugs(issueKey) {
+    return issueTouchedSlugsByKey.get(issueKey)?.slugs ?? [];
+}
+export const pendingClarificationBySession = new Map();
+export const chatHistoryBySession = new Map();
+export const pendingApprovalPlanBySession = new Map();
+export const imageSourcePreferenceBySession = new Map();
+export const publishStatusBySession = new Map();
+export const siteConfigs = new Map();
+// No hardcoded seed: drafts now hydrate from the live published JSON via
+// `hydrateSiteConfigFromPublished` on first session touch. A hardcoded seed
+// here would silently win over published nav state during the merge,
+// re-introducing the wipe-on-publish bug it originally tried to prevent.
+export let lastPublishedScopedSession;
+export function setLastPublishedScopedSession(key) { lastPublishedScopedSession = key; }
+function parseSessionKey(sessionKey) {
+    const sep = sessionKey.indexOf("::");
+    if (sep === -1)
+        return { session: sessionKey, siteId: DEFAULT_SITE_ID };
+    return { siteId: sessionKey.slice(0, sep), session: sessionKey.slice(sep + 2) };
+}
+export function getSessionSummary(sessionKey) {
+    const { session, siteId } = parseSessionKey(sessionKey);
+    // Read draftPages directly to avoid auto-seeding via getSessionDraft, which
+    // would inflate draftPageCount for never-touched sessions.
+    const draftPageCount = draftPages.get(sessionKey)?.size ?? 0;
+    const version = versions.get(sessionKey) ?? 0;
+    const log = versionLog.get(sessionKey);
+    const lastMutatedAt = log && log.length > 0 ? log[log.length - 1].at : null;
+    return { sessionKey, session, siteId, version, draftPageCount, lastMutatedAt };
+}
+export function listSessionSummaries() {
+    // Union of every key seen across draft / version / version-log maps. A
+    // session may appear in `versions` (bumped) without `draftPages` (e.g.
+    // when only site-config was touched), or vice versa, so we walk all three.
+    const keys = new Set();
+    for (const k of draftPages.keys())
+        keys.add(k);
+    for (const k of versions.keys())
+        keys.add(k);
+    for (const k of versionLog.keys())
+        keys.add(k);
+    const summaries = Array.from(keys, (key) => getSessionSummary(key));
+    // Sort most-recently-mutated first, then by key for deterministic output.
+    summaries.sort((a, b) => {
+        if (a.lastMutatedAt && b.lastMutatedAt)
+            return b.lastMutatedAt.localeCompare(a.lastMutatedAt);
+        if (a.lastMutatedAt)
+            return -1;
+        if (b.lastMutatedAt)
+            return 1;
+        return a.sessionKey.localeCompare(b.sessionKey);
+    });
+    return summaries;
+}
+/** Total published pages across all sites (currently just the JSON-file legacy site). */
+export function publishedPageCountGlobal() {
+    return publishedPages.size;
+}
+// Track sessions that were just restored so bootstrap doesn't overwrite them
+const recentlyRestoredSessions = new Set();
+export function markRecentlyRestored(session) { recentlyRestoredSessions.add(session); }
+export function consumeRecentlyRestored(session) { return recentlyRestoredSessions.delete(session); }
+// ---------------------------------------------------------------------------
+// Persistence config
+// ---------------------------------------------------------------------------
+/**
+ * Legacy JSON state file path. Resolved lazily each call so tests can
+ * point to a temp file via `ORCHESTRATOR_STATE_FILE`. Read only at
+ * startup, for one-shot migration into SQLite. Once migrated, the file
+ * is renamed to `<path>.migrated-<ts>` and swept after
+ * `ORCHESTRATOR_JSON_MIGRATION_TTL_DAYS`.
+ */
+function resolveStateFilePath() {
+    return (process.env.ORCHESTRATOR_STATE_FILE ??
+        resolve(process.cwd(), "../../.data/orchestrator-state.json"));
+}
+/**
+ * Sentinel session key used to store the global `publishedPages` Map in the
+ * per-session `pages` table. Picked so it can never collide with a real
+ * session key (which is either `<site>::<session>` or a bare session name).
+ */
+const PUBLISHED_GLOBAL_KEY = "__published_global__";
+// ---------------------------------------------------------------------------
+// Utility: error detail extractor — canonical impl in ../errors.ts
+// ---------------------------------------------------------------------------
+export const toErrorDetail = _unifiedToErrorDetail;
+// ---------------------------------------------------------------------------
+// Hero image prop guard (needed by getSessionDraft, setPage, applyPersistedState)
+// ---------------------------------------------------------------------------
+export function ensureHeroImageProps(page) {
+    for (const block of page.blocks) {
+        const props = block.props;
+        if (block.type === "Hero") {
+            // Skip imageUrl fallback if the block uses carouselImages instead
+            if (typeof props.imageUrl !== "string" || props.imageUrl.length === 0) {
+                if (!Array.isArray(props.carouselImages) || props.carouselImages.length === 0) {
+                    props.imageUrl = IMAGE_PLACEHOLDER;
+                }
+            }
+            if (typeof props.imageAlt !== "string" || props.imageAlt.length === 0) {
+                props.imageAlt =
+                    page.slug === "/pricing"
+                        ? "Abstract generated illustration for the pricing hero"
+                        : "Abstract generated illustration for the hero section";
+            }
+            continue;
+        }
+        if (block.type === "TwoColumn") {
+            if (!Array.isArray(props.left) || props.left.length === 0) {
+                // Migrate from legacy flat props if present
+                const heading = typeof props.heading === "string" ? props.heading
+                    : typeof props.title === "string" ? props.title : "Section heading";
+                const body = typeof props.body === "string" ? props.body
+                    : typeof props.description === "string" ? props.description : "Section content";
+                props.left = [
+                    { type: "heading", text: heading },
+                    { type: "paragraph", text: body }
+                ];
+            }
+            if (!Array.isArray(props.right) || props.right.length === 0) {
+                const src = typeof props.imageUrl === "string" ? props.imageUrl : IMAGE_PLACEHOLDER;
+                const alt = typeof props.imageAlt === "string" ? props.imageAlt : "Section image";
+                props.right = [{ type: "image", src, alt }];
+            }
+            if (props.variant !== "default" && props.variant !== "accent") {
+                props.variant = "default";
+            }
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Slug ordering helper
+// ---------------------------------------------------------------------------
+export function orderSlugsHomeFirst(slugs) {
+    return slugs.includes("/") ? ["/", ...slugs.filter((route) => route !== "/")] : slugs;
+}
+// ---------------------------------------------------------------------------
+// Accessor functions
+// ---------------------------------------------------------------------------
+/** Resolve monorepo root (orchestrator lives at apps/orchestrator/) */
+function monorepoRoot() {
+    return resolve(dirname(new URL(import.meta.url).pathname), "../../../");
+}
+/**
+ * Try to read a site's content/pages.json synchronously.
+ * Returns parsed PageDoc[] or empty array on failure.
+ */
+function readSitePages(siteId) {
+    try {
+        const pagesPath = resolve(monorepoRoot(), "apps", siteId, "content", "pages.json");
+        if (!existsSync(pagesPath))
+            return [];
+        const raw = readFileSync(pagesPath, "utf-8");
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Try to read a site's content/site-config.json synchronously.
+ * Seeds siteConfigs with nav labels, logo, footer, etc.
+ */
+function seedSiteConfig(session, siteId) {
+    try {
+        const configPath = resolve(monorepoRoot(), "apps", siteId, "content", "site-config.json");
+        if (!existsSync(configPath))
+            return;
+        const config = JSON.parse(readFileSync(configPath, "utf-8"));
+        if (config && typeof config === "object") {
+            siteConfigs.set(session, { ...siteConfigs.get(session), ...config });
+        }
+    }
+    catch { /* ignore */ }
+}
+/**
+ * Monorepo-only: backfill the in-memory siteConfig from the bundled
+ * apps/site/lib/published-content.json on first session touch.
+ *
+ * Why: the orch's draft siteConfig can drift narrower than what's actually
+ * published (e.g. SQLite outage loses a session's nav state, or a fresh boot
+ * of an already-published site has nothing in SQLite). Without this fill-in,
+ * the next publish silently wipes nav fields the live site still depends on.
+ *
+ * SDK consumers wire `getSiteConfig` into `createEditorApiHandler` and the
+ * orchestrator picks the live state up through `/publish/diff`'s
+ * loadPublishedForDiff path; this helper is only for the bundled apps/site.
+ *
+ * Exported for tests; production callers omit `publishedPathOverride`.
+ */
+export function hydrateSiteConfigFromPublished(session, publishedPathOverride) {
+    try {
+        // monorepoRoot() resolves to apps/ (the function is named optimistically —
+        // see callers in readSitePages/seedSiteConfig). The bundled site lives at
+        // apps/site, so resolve from there.
+        const publishedPath = publishedPathOverride
+            ?? resolve(monorepoRoot(), "site", "lib", "published-content.json");
+        if (!existsSync(publishedPath))
+            return;
+        const parsed = JSON.parse(readFileSync(publishedPath, "utf-8"));
+        const published = parsed.siteConfig;
+        if (!published || typeof published !== "object")
+            return;
+        // Existing keys win — protects against clobbering an in-flight edit on
+        // restart. Published only backfills keys the draft is missing.
+        const existing = siteConfigs.get(session) ?? {};
+        const merged = { ...published, ...existing };
+        siteConfigs.set(session, merged);
+    }
+    catch { /* ignore */ }
+}
+export function getSessionDraft(session) {
+    let sessionMap = draftPages.get(session);
+    if (!sessionMap) {
+        sessionMap = new Map();
+        if (!session.includes("::")) {
+            // Legacy/default sessions — seed from published demo pages
+            for (const [slug, page] of publishedPages) {
+                const copy = structuredClone(page);
+                ensureHeroImageProps(copy);
+                ensureItemIds(copy.blocks);
+                sessionMap.set(slug, copy);
+            }
+        }
+        else {
+            // Site-scoped sessions — seed from the site's content/pages.json on disk.
+            // This ensures migrated sites load immediately without waiting for async bootstrap.
+            const siteId = session.split("::")[0];
+            const sitePages = readSitePages(siteId);
+            if (sitePages.length > 0) {
+                for (const page of sitePages) {
+                    const copy = structuredClone(page);
+                    ensureHeroImageProps(copy);
+                    ensureItemIds(copy.blocks);
+                    sessionMap.set(copy.slug, copy);
+                }
+                seedSiteConfig(session, siteId);
+                console.log(`[session-state] Seeded ${session} from apps/${siteId}/content/pages.json (${sitePages.length} pages)`);
+            }
+            // Monorepo: backfill nav state from the bundled apps/site/lib/published-content.json
+            // so we don't silently wipe live nav fields on next publish. The shared
+            // `ensureSiteConfigHydrated` gate keeps this idempotent across the
+            // multiple entry points that touch a session (getSiteConfig, etc).
+            ensureSiteConfigHydrated(session);
+        }
+        draftPages.set(session, sessionMap);
+    }
+    return sessionMap;
+}
+export function getHistoryMap(store, session) {
+    let bySession = store.get(session);
+    if (!bySession) {
+        bySession = new Map();
+        store.set(session, bySession);
+    }
+    return bySession;
+}
+export function getPage(session, slug) {
+    const sessionDraft = getSessionDraft(session);
+    return sessionDraft.get(slug) ?? null;
+}
+export function getSessionPages(session) {
+    const draft = getSessionDraft(session);
+    const slugs = orderSlugsHomeFirst(Array.from(draft.keys()));
+    return slugs.map((slug) => structuredClone(draft.get(slug)));
+}
+// ---------------------------------------------------------------------------
+// Context cache — invalidated on setPage / removePage / bumpVersion
+// ---------------------------------------------------------------------------
+const _contextCache = new Map();
+export function getContextCache(session) {
+    return _contextCache.get(session);
+}
+export function setContextCache(session, entry) {
+    _contextCache.set(session, entry);
+}
+function invalidateContextCache(session) {
+    _contextCache.delete(session);
+}
+export function setPage(session, page) {
+    const sessionDraft = getSessionDraft(session);
+    ensureHeroImageProps(page);
+    ensureItemIds(page.blocks);
+    sessionDraft.set(page.slug, page);
+    invalidateContextCache(session);
+}
+export function removePage(session, slug) {
+    const sessionDraft = getSessionDraft(session);
+    sessionDraft.delete(slug);
+    invalidateContextCache(session);
+}
+/**
+ * Append `snapshot` to an undo/redo stack, evicting the oldest entries
+ * once `HISTORY_DEPTH_MAX` is exceeded. Mutates `list` in place.
+ */
+export function pushCappedHistory(list, snapshot) {
+    list.push(snapshot === null ? null : structuredClone(snapshot));
+    if (list.length > HISTORY_DEPTH_MAX) {
+        list.splice(0, list.length - HISTORY_DEPTH_MAX);
+    }
+}
+export function pushUndo(session, slug, snapshot) {
+    const undoMap = getHistoryMap(historyUndo, session);
+    const list = undoMap.get(slug) ?? [];
+    pushCappedHistory(list, snapshot);
+    undoMap.set(slug, list);
+    const redoMap = getHistoryMap(historyRedo, session);
+    redoMap.set(slug, []);
+}
+export function bumpVersion(session) {
+    const current = versions.get(session) ?? 0;
+    const next = current + 1;
+    versions.set(session, next);
+    invalidateContextCache(session);
+    return next;
+}
+export function pushRecentEdit(session, entry) {
+    const list = recentEdits.get(session) ?? [];
+    list.push({ ...entry, at: new Date().toISOString() });
+    recentEdits.set(session, list.slice(-RECENT_EDITS_CAP));
+}
+export function pushVersionEntry(session, entry) {
+    const list = versionLog.get(session) ?? [];
+    list.push({ ...entry, at: new Date().toISOString() });
+    versionLog.set(session, list.slice(-VERSION_LOG_MAX));
+}
+export function getVersionLog(session, slug, limit = 50) {
+    const list = versionLog.get(session) ?? [];
+    const filtered = slug ? list.filter((e) => e.slug === slug) : list;
+    return filtered.slice(-limit);
+}
+// ---------------------------------------------------------------------------
+// Publish log
+// ---------------------------------------------------------------------------
+/**
+ * Insert a publish-log row. Writes through to SQLite immediately so the row
+ * survives a process restart between the initial publish and the later async
+ * status update (deploy resolution can take seconds to minutes). Also mirrors
+ * into `publishLogBySession` for cheap reads.
+ *
+ * The `id` field is generated here (UUID) so callers don't need to import
+ * crypto. Returns the full materialised entry, including `id` / timestamps.
+ */
+export function pushPublishLogEntry(partial) {
+    const now = new Date().toISOString();
+    const entry = {
+        ...partial,
+        id: globalThis.crypto.randomUUID(),
+        at: now,
+        updatedAt: now,
+    };
+    try {
+        getStore().pushPublishLog(entry);
+    }
+    catch (error) {
+        // Persistence failure must not break the publish — log and continue with
+        // the in-memory mirror only. The next publish will retry.
+        console.error("[publish-log] failed to persist row", error);
+    }
+    const list = publishLogBySession.get(entry.session) ?? [];
+    list.push(entry);
+    publishLogBySession.set(entry.session, list.slice(-PUBLISH_LOG_MAX));
+    return entry;
+}
+/**
+ * Patch an existing publish-log row by `id`. Updates SQLite and the in-memory
+ * mirror. Used by `GET /publish/status` to transition `triggered` → `success`
+ * or `failed` when Vercel resolves. Returns the updated entry, or null if the
+ * id was not found.
+ */
+export function updatePublishLogStatusById(id, patch) {
+    let updated = null;
+    try {
+        updated = getStore().updatePublishLogById(id, patch);
+    }
+    catch (error) {
+        console.error("[publish-log] failed to update row", error);
+        return null;
+    }
+    if (!updated)
+        return null;
+    const list = publishLogBySession.get(updated.session) ?? [];
+    const idx = list.findIndex((e) => e.id === id);
+    if (idx >= 0)
+        list[idx] = updated;
+    else
+        list.push(updated);
+    publishLogBySession.set(updated.session, list.slice(-PUBLISH_LOG_MAX));
+    return updated;
+}
+/**
+ * Resolve a publish-log row to update when an async deploy status arrives.
+ * Prefers an exact `deploymentId` match; falls back to the most recent
+ * `triggered` row for the session (covers deploy-hook targets that don't
+ * parse a deployment id out of their response).
+ */
+export function findPublishLogForStatusUpdate(session, deploymentId) {
+    const store = getStore();
+    if (deploymentId) {
+        const byDeployment = store.getPublishLogByDeploymentId(session, deploymentId);
+        if (byDeployment)
+            return byDeployment;
+    }
+    return store.getMostRecentTriggeredPublishLog(session);
+}
+export function listPublishLog(session, limit = 50) {
+    const cached = publishLogBySession.get(session);
+    if (cached && cached.length > 0)
+        return cached.slice(-limit);
+    // Cache miss — read through. Cheap (one indexed scan).
+    try {
+        const fromStore = getStore().listPublishLog(session, limit);
+        if (fromStore.length > 0)
+            publishLogBySession.set(session, fromStore.slice(-PUBLISH_LOG_MAX));
+        return fromStore;
+    }
+    catch (error) {
+        console.error("[publish-log] failed to list rows", error);
+        return [];
+    }
+}
+export function pushChatHistory(session, userMessage, assistantSummary) {
+    const history = chatHistoryBySession.get(session) ?? [];
+    // Never store blank turns — an empty/whitespace content block carries no context and
+    // is invalid for the planner LLMs (Anthropic rejects the WHOLE request if any history
+    // message is empty). A whitespace-only user message must not poison the session. (#33)
+    if (userMessage.trim().length > 0)
+        history.push({ role: "user", content: userMessage });
+    if (assistantSummary.trim().length > 0)
+        history.push({ role: "assistant", content: assistantSummary });
+    chatHistoryBySession.set(session, history.slice(-CHAT_HISTORY_MAX_TURNS));
+}
+export function getRecentEdits(session, slug) {
+    const list = recentEdits.get(session) ?? [];
+    return list
+        .filter((item) => item.slug === slug)
+        .slice(-3)
+        .map((item) => ({
+        at: item.at,
+        summary: item.summary,
+        ops: item.ops.map((op) => op.op)
+    }));
+}
+// ---------------------------------------------------------------------------
+// Site config accessors
+// ---------------------------------------------------------------------------
+// Tracks sessions that have already been offered a hydration pass this process.
+// Both getSessionDraft and getSiteConfig are entry points users can hit first
+// (the editor fetches /draft/site-config independently of any page request),
+// so we guard the hydrate call here rather than re-checking in each caller.
+const hydratedSessions = new Set();
+function ensureSiteConfigHydrated(session) {
+    if (hydratedSessions.has(session))
+        return;
+    hydratedSessions.add(session);
+    // Only the monorepo's bundled apps/site maps to a known published JSON path.
+    // SDK consumers expose siteConfig via their /api/editor/pages route; the
+    // orch picks that up through publish-diff's loadPublishedForDiff path.
+    // The monorepo's bundled demo — bare/default sessions and the editor's
+    // avocado-hub::* sessions — all represent the same site. Seed the header
+    // (name, logo, nav groups/labels) from the baked demo snapshot so the editor
+    // preview matches the live avocado-site.vercel.app header instead of falling
+    // back to bare defaults. (The legacy disk-read path resolved the wrong dir and
+    // silently returned nothing.) Existing keys win, so an in-flight edit isn't
+    // clobbered on re-hydrate. Other site-scoped sessions (e.g. SDK consumers) are
+    // left untouched — their config arrives via publish-diff's loadPublishedForDiff.
+    const isBundledDemo = !session.includes("::") || session.startsWith("avocado-hub::");
+    if (isBundledDemo) {
+        const existing = siteConfigs.get(session) ?? {};
+        siteConfigs.set(session, { ...demoSiteConfig(), ...existing });
+    }
+}
+export function getSiteConfig(session) {
+    ensureSiteConfigHydrated(session);
+    return siteConfigs.get(session) ?? {};
+}
+export function setSiteConfig(session, config) {
+    const existing = siteConfigs.get(session) ?? {};
+    siteConfigs.set(session, { ...existing, ...config });
+    // A user-initiated write counts as "we know about this session" — skip the
+    // published fill-in so it doesn't undo whatever the user just set.
+    hydratedSessions.add(session);
+}
+/**
+ * Walk the in-memory `siteConfigs` map and return one entry per unique siteId,
+ * preferring entries that match `wantedSession` over legacy unscoped ones.
+ *
+ * The map keys come from `scopedSessionKey()`: either `{siteId}::{session}` or
+ * just `{session}` for legacy sites (avocado-stories convention). Owning that
+ * parsing here keeps route handlers from having to know about the key format.
+ */
+export function listSitesForSession(wantedSession) {
+    const byId = new Map();
+    for (const [key, config] of siteConfigs.entries()) {
+        const sep = key.indexOf("::");
+        // Skip bare-session keys (no `::`). They're the internal legacy routing
+        // convention for the avocado-stories JSON-file site; surfacing them here
+        // would re-add a phantom site in the editor dashboard every time the user
+        // tries to delete it.
+        if (sep === -1)
+            continue;
+        const siteId = key.slice(0, sep);
+        const session = key.slice(sep + 2);
+        const matchesSession = session === wantedSession;
+        const existing = byId.get(siteId);
+        if (!existing || (matchesSession && !existing.matchesSession)) {
+            byId.set(siteId, {
+                config: { id: siteId, ...config },
+                matchesSession,
+            });
+        }
+    }
+    return Array.from(byId.values()).map((entry) => entry.config);
+}
+// ---------------------------------------------------------------------------
+// Persistence helpers
+// ---------------------------------------------------------------------------
+export function nestedPageMapToObject(source) {
+    const out = {};
+    for (const [session, pages] of source) {
+        out[session] = {};
+        for (const [slug, page] of pages)
+            out[session][slug] = structuredClone(page);
+    }
+    return out;
+}
+export function nestedHistoryMapToObject(source) {
+    const out = {};
+    for (const [session, bySlug] of source) {
+        out[session] = {};
+        for (const [slug, snapshots] of bySlug)
+            out[session][slug] = snapshots.map((item) => item === null ? null : structuredClone(item));
+    }
+    return out;
+}
+export function objectToNestedPageMap(source) {
+    const out = new Map();
+    if (!source || typeof source !== "object")
+        return out;
+    for (const [session, pages] of Object.entries(source)) {
+        if (!pages || typeof pages !== "object")
+            continue;
+        const bySlug = new Map();
+        for (const [slug, page] of Object.entries(pages)) {
+            if (!page || typeof page !== "object")
+                continue;
+            bySlug.set(slug, page);
+        }
+        out.set(session, bySlug);
+    }
+    return out;
+}
+export function objectToNestedHistoryMap(source) {
+    const out = new Map();
+    if (!source || typeof source !== "object")
+        return out;
+    for (const [session, bySlugRaw] of Object.entries(source)) {
+        if (!bySlugRaw || typeof bySlugRaw !== "object")
+            continue;
+        const bySlug = new Map();
+        for (const [slug, listRaw] of Object.entries(bySlugRaw)) {
+            if (!Array.isArray(listRaw))
+                continue;
+            bySlug.set(slug, listRaw.filter((item) => item === null || (item && typeof item === "object")));
+        }
+        out.set(session, bySlug);
+    }
+    return out;
+}
+export function applyPersistedState(parsed) {
+    if (Array.isArray(parsed.publishedPages) && parsed.publishedPages.length > 0) {
+        publishedPages.clear();
+        for (const page of parsed.publishedPages) {
+            if (!page || typeof page !== "object" || typeof page.slug !== "string")
+                continue;
+            ensureHeroImageProps(page);
+            publishedPages.set(page.slug, page);
+        }
+    }
+    draftPages.clear();
+    for (const [session, bySlug] of objectToNestedPageMap(parsed.draftPages)) {
+        for (const page of bySlug.values()) {
+            ensureHeroImageProps(page);
+            // Legacy JSON predates stable item ids — backfill here so the very first
+            // post-migration persist (writeAllStateToStore right after this call)
+            // already stores id-carrying drafts instead of waiting for the next boot.
+            ensureItemIds(page.blocks);
+        }
+        draftPages.set(session, bySlug);
+    }
+    historyUndo.clear();
+    for (const [session, bySlug] of objectToNestedHistoryMap(parsed.historyUndo))
+        historyUndo.set(session, bySlug);
+    historyRedo.clear();
+    for (const [session, bySlug] of objectToNestedHistoryMap(parsed.historyRedo))
+        historyRedo.set(session, bySlug);
+    versions.clear();
+    if (parsed.versions && typeof parsed.versions === "object") {
+        for (const [session, value] of Object.entries(parsed.versions)) {
+            if (typeof value === "number" && Number.isFinite(value))
+                versions.set(session, value);
+        }
+    }
+    recentEdits.clear();
+    if (parsed.recentEdits && typeof parsed.recentEdits === "object") {
+        for (const [session, listRaw] of Object.entries(parsed.recentEdits)) {
+            if (!Array.isArray(listRaw))
+                continue;
+            const list = listRaw
+                .filter((entry) => entry && typeof entry === "object")
+                .map((entry) => entry);
+            recentEdits.set(session, list.slice(-RECENT_EDITS_CAP));
+        }
+    }
+    chatHistoryBySession.clear();
+    if (parsed.chatHistory && typeof parsed.chatHistory === "object") {
+        for (const [session, listRaw] of Object.entries(parsed.chatHistory)) {
+            if (!Array.isArray(listRaw))
+                continue;
+            const list = listRaw
+                .filter((entry) => entry &&
+                typeof entry === "object" &&
+                (entry.role === "user" || entry.role === "assistant") &&
+                typeof entry.content === "string")
+                .map((entry) => entry);
+            chatHistoryBySession.set(session, list.slice(-CHAT_HISTORY_MAX_TURNS));
+        }
+    }
+    siteConfigs.clear();
+    // Reload invalidates the hydration cache — the persisted snapshot is now
+    // the new baseline, and any session that still has gaps should get another
+    // fill-in pass from the published JSON.
+    hydratedSessions.clear();
+    // No hardcoded re-seed: `hydrateSiteConfigFromPublished` runs on first
+    // session touch and fills missing nav fields from the live published JSON.
+    // A static seed here would always win over published nav state during the
+    // fill-in merge, re-introducing the wipe-on-publish bug.
+    if (parsed.siteConfigs && typeof parsed.siteConfigs === "object") {
+        for (const [session, config] of Object.entries(parsed.siteConfigs)) {
+            if (config && typeof config === "object") {
+                siteConfigs.set(session, config);
+            }
+        }
+    }
+    versionLog.clear();
+    if (parsed.versionLog && typeof parsed.versionLog === "object") {
+        for (const [session, listRaw] of Object.entries(parsed.versionLog)) {
+            if (!Array.isArray(listRaw))
+                continue;
+            const list = listRaw
+                .filter((entry) => entry && typeof entry === "object" && typeof entry.version === "number")
+                .map((entry) => entry);
+            versionLog.set(session, list.slice(-VERSION_LOG_MAX));
+        }
+    }
+    publishLogBySession.clear();
+    if (parsed.publishLog && typeof parsed.publishLog === "object") {
+        for (const [session, listRaw] of Object.entries(parsed.publishLog)) {
+            if (!Array.isArray(listRaw))
+                continue;
+            const list = listRaw
+                .filter((entry) => !!entry &&
+                typeof entry === "object" &&
+                typeof entry.id === "string" &&
+                typeof entry.status === "string");
+            publishLogBySession.set(session, list.slice(-PUBLISH_LOG_MAX));
+        }
+    }
+    issueTouchedSlugsByKey.clear();
+    if (parsed.issueTouchedSlugs && typeof parsed.issueTouchedSlugs === "object") {
+        for (const [issueKey, entryRaw] of Object.entries(parsed.issueTouchedSlugs)) {
+            if (!entryRaw || typeof entryRaw !== "object")
+                continue;
+            const entry = entryRaw;
+            if (!Array.isArray(entry.slugs))
+                continue;
+            const slugs = entry.slugs.filter((s) => typeof s === "string" && s.length > 0);
+            const updatedAt = typeof entry.updatedAt === "string" ? entry.updatedAt : new Date().toISOString();
+            issueTouchedSlugsByKey.set(issueKey, { slugs, updatedAt });
+        }
+    }
+}
+const persistStmtsCache = new WeakMap();
+function buildPersistStmts(store) {
+    const db = store.db;
+    return {
+        deletePages: db.prepare("DELETE FROM pages"),
+        insertPage: db.prepare("INSERT INTO pages(session, slug, kind, doc) VALUES (?, ?, ?, ?)"),
+        deleteHistory: db.prepare("DELETE FROM history"),
+        insertHistory: db.prepare("INSERT INTO history(session, slug, direction, seq, snapshot) VALUES (?, ?, ?, ?, ?)"),
+        deleteSessions: db.prepare("DELETE FROM sessions"),
+        deleteVersionLog: db.prepare("DELETE FROM version_log"),
+        insertVersionLog: db.prepare("INSERT INTO version_log(session, seq, entry) VALUES (?, ?, ?)"),
+        deleteRecentEdits: db.prepare("DELETE FROM recent_edits"),
+        insertRecentEdit: db.prepare("INSERT INTO recent_edits(session, seq, entry) VALUES (?, ?, ?)"),
+        deleteChatHistory: db.prepare("DELETE FROM chat_history"),
+        insertChatMessage: db.prepare("INSERT INTO chat_history(session, seq, role, content) VALUES (?, ?, ?, ?)"),
+        deleteSiteConfigs: db.prepare("DELETE FROM site_configs"),
+        deleteIssueTouched: db.prepare("DELETE FROM issue_touched"),
+    };
+}
+function getPersistStmts(store) {
+    let stmts = persistStmtsCache.get(store);
+    if (!stmts) {
+        stmts = buildPersistStmts(store);
+        persistStmtsCache.set(store, stmts);
+    }
+    return stmts;
+}
+/**
+ * Snapshot every in-memory Map into SQLite inside a single transaction.
+ * Writes all sessions on every call, not just the mutated one — acceptable
+ * at current scale (state typically well under 1 MB). Per-session
+ * write-through is the first optimization if this becomes a hot spot.
+ */
+function writeAllStateToStore(store) {
+    const s = getPersistStmts(store);
+    store.transaction(() => {
+        // Pages — drop-all-then-reinsert so deletes propagate.
+        s.deletePages.run();
+        for (const [slug, page] of publishedPages) {
+            s.insertPage.run(PUBLISHED_GLOBAL_KEY, slug, "published", JSON.stringify(page));
+        }
+        for (const [session, bySlug] of draftPages) {
+            for (const [slug, page] of bySlug) {
+                s.insertPage.run(session, slug, "draft", JSON.stringify(page));
+            }
+        }
+        // History — drop + reinsert so pops propagate. Trim locally to
+        // HISTORY_DEPTH_MAX as defense-in-depth (legacy JSON imports could be
+        // deeper). We slice but intentionally DO NOT mutate the caller's Map —
+        // pushCappedHistory already bounds new writes in-memory.
+        s.deleteHistory.run();
+        const writeHistory = (map, direction) => {
+            for (const [session, bySlug] of map) {
+                for (const [slug, list] of bySlug) {
+                    const trimmed = list.length > HISTORY_DEPTH_MAX
+                        ? list.slice(list.length - HISTORY_DEPTH_MAX)
+                        : list;
+                    trimmed.forEach((snap, i) => s.insertHistory.run(session, slug, direction, i + 1, snap === null ? null : JSON.stringify(snap)));
+                }
+            }
+        };
+        writeHistory(historyUndo, "undo");
+        writeHistory(historyRedo, "redo");
+        // Version counters
+        s.deleteSessions.run();
+        for (const [session, v] of versions)
+            store.setVersion(session, v);
+        // Version log
+        s.deleteVersionLog.run();
+        for (const [session, list] of versionLog) {
+            list.forEach((entry, i) => s.insertVersionLog.run(session, i + 1, JSON.stringify(entry)));
+        }
+        // Recent edits
+        s.deleteRecentEdits.run();
+        for (const [session, list] of recentEdits) {
+            list.forEach((entry, i) => s.insertRecentEdit.run(session, i + 1, JSON.stringify(entry)));
+        }
+        // Chat history
+        s.deleteChatHistory.run();
+        for (const [session, list] of chatHistoryBySession) {
+            list.forEach((m, i) => s.insertChatMessage.run(session, i + 1, m.role, m.content));
+        }
+        // Site configs
+        s.deleteSiteConfigs.run();
+        for (const [session, cfg] of siteConfigs)
+            store.setSiteConfig(session, cfg);
+        // Issue-touched
+        s.deleteIssueTouched.run();
+        for (const [key, row] of issueTouchedSlugsByKey)
+            store.setIssueTouched(key, row);
+    });
+}
+/**
+ * Hydrate the in-memory Maps from a SqliteStore. Caller must have cleared
+ * the Maps first if they want authoritative replacement.
+ */
+function hydrateMapsFromStore(store) {
+    // Published (global) pages live under PUBLISHED_GLOBAL_KEY.
+    for (const page of store.listPages(PUBLISHED_GLOBAL_KEY, "published")) {
+        ensureHeroImageProps(page);
+        publishedPages.set(page.slug, page);
+    }
+    // Draft pages — walk every session except the sentinel. Backfill stable list
+    // item ids on the way in (one-time migration for sessions persisted before
+    // item ids existed); `itemIdsBackfilled` triggers a single write-back below so
+    // the ids are durable rather than regenerated on every boot.
+    let itemIdsBackfilled = false;
+    for (const session of store.listDraftSessions()) {
+        if (session === PUBLISHED_GLOBAL_KEY)
+            continue;
+        const bySlug = new Map();
+        for (const page of store.listPages(session, "draft")) {
+            ensureHeroImageProps(page);
+            if (ensureItemIds(page.blocks))
+                itemIdsBackfilled = true;
+            bySlug.set(page.slug, page);
+        }
+        if (bySlug.size > 0)
+            draftPages.set(session, bySlug);
+    }
+    // History — need a list of sessions/slugs. We rely on the fact that any
+    // session with history also has draft pages, plus a fallback scan via the
+    // session-slug pairs already captured in the DB.
+    const histRows = store.db
+        .prepare(`SELECT session, slug, direction, seq, snapshot FROM history ORDER BY session, slug, direction, seq`)
+        .all();
+    for (const row of histRows) {
+        const target = row.direction === "undo" ? historyUndo : historyRedo;
+        let bySlug = target.get(row.session);
+        if (!bySlug) {
+            bySlug = new Map();
+            target.set(row.session, bySlug);
+        }
+        const list = bySlug.get(row.slug) ?? [];
+        list.push(row.snapshot === null ? null : JSON.parse(row.snapshot));
+        bySlug.set(row.slug, list);
+    }
+    // Versions
+    const versionRows = store.db
+        .prepare("SELECT session, version FROM sessions")
+        .all();
+    for (const r of versionRows)
+        versions.set(r.session, r.version);
+    // Version log
+    const vlogSessions = store.db
+        .prepare("SELECT DISTINCT session FROM version_log")
+        .all();
+    for (const { session } of vlogSessions) {
+        versionLog.set(session, store.listVersionLog(session, undefined, VERSION_LOG_MAX));
+    }
+    // Recent edits
+    const editSessions = store.db
+        .prepare("SELECT DISTINCT session FROM recent_edits")
+        .all();
+    for (const { session } of editSessions) {
+        recentEdits.set(session, store.listRecentEdits(session));
+    }
+    // Chat history
+    const chatSessions = store.db
+        .prepare("SELECT DISTINCT session FROM chat_history")
+        .all();
+    for (const { session } of chatSessions) {
+        chatHistoryBySession.set(session, store.listChatHistory(session));
+    }
+    // Site configs
+    for (const { session, config } of store.listSiteConfigs()) {
+        siteConfigs.set(session, config);
+    }
+    // Issue-touched
+    for (const { issueKey, row } of store.listIssueTouched()) {
+        issueTouchedSlugsByKey.set(issueKey, row);
+    }
+    // Publish log
+    for (const session of store.listPublishLogSessions()) {
+        publishLogBySession.set(session, store.listPublishLog(session, PUBLISH_LOG_MAX));
+    }
+    // Write back the one-time list-item-id backfill (all maps are now hydrated, so
+    // this full snapshot is complete). Skipped entirely when nothing changed.
+    if (itemIdsBackfilled)
+        writeAllStateToStore(store);
+}
+/**
+ * Persist the current in-memory state to SQLite. Always flushes any pending
+ * debounced write first, then runs synchronously (better-sqlite3 is sync).
+ * Async signature preserved for callers that want to `await` (publish flow
+ * does). Errors are logged and rethrown.
+ */
+export async function persistStateNow(logger) {
+    if (persistTimer) {
+        clearTimeout(persistTimer);
+        persistTimer = null;
+    }
+    try {
+        writeAllStateToStore(getStore());
+    }
+    catch (error) {
+        logger.error({ err: toErrorDetail(error) }, "Failed to persist orchestrator state to SQLite");
+        throw error;
+    }
+}
+/**
+ * Schedule a persist with a short debounce so a single request's sync
+ * mutation burst coalesces into one transaction — chat turns, agent runs,
+ * and /ops calls that land N mutations followed by schedulePersistState
+ * write-through exactly once. The window is narrow enough that the worst
+ * crash-loss is tens of ms of mutations.
+ *
+ * Any write error is logged, not propagated — the caller has already
+ * returned its response by the time the timer fires.
+ */
+let persistTimer = null;
+const PERSIST_DEBOUNCE_MS = 30;
+export function schedulePersistState(logger) {
+    if (persistTimer)
+        return; // Already scheduled; coalesce.
+    persistTimer = setTimeout(() => {
+        persistTimer = null;
+        try {
+            writeAllStateToStore(getStore());
+        }
+        catch (error) {
+            logger.error({ err: toErrorDetail(error) }, "Failed to persist orchestrator state to SQLite");
+        }
+    }, PERSIST_DEBOUNCE_MS);
+    // Don't let the debounce timer keep the process alive on its own.
+    if (typeof persistTimer.unref === "function")
+        persistTimer.unref();
+}
+// ---------------------------------------------------------------------------
+// Ephemeral map eviction — prevents unbounded growth in long-running processes
+// ---------------------------------------------------------------------------
+const APPROVAL_PLAN_TTL_MS = 60 * 60 * 1000; // 1 hour — approvals expire if user abandons
+const PUBLISH_STATUS_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+const EPHEMERAL_MAP_CAP = 500; // max entries for maps without timestamps
+/**
+ * Evict stale/excess entries from ephemeral in-memory maps.
+ * Called on a periodic timer (see index.ts). Safe to call at any time.
+ */
+export function evictStaleEphemeralMaps() {
+    const now = Date.now();
+    // pendingApprovalPlanBySession: has createdAt — evict by age
+    for (const [key, plan] of pendingApprovalPlanBySession) {
+        if (now - new Date(plan.createdAt).getTime() > APPROVAL_PLAN_TTL_MS) {
+            pendingApprovalPlanBySession.delete(key);
+        }
+    }
+    // publishStatusBySession: has updatedAt — evict by age
+    for (const [key, tracker] of publishStatusBySession) {
+        if (now - new Date(tracker.updatedAt).getTime() > PUBLISH_STATUS_TTL_MS) {
+            publishStatusBySession.delete(key);
+        }
+    }
+    // Maps without timestamps — cap at EPHEMERAL_MAP_CAP, drop oldest-inserted entries
+    for (const map of [continuationChainBySession, pendingClarificationBySession, imageSourcePreferenceBySession]) {
+        if (map.size > EPHEMERAL_MAP_CAP) {
+            const excess = map.size - EPHEMERAL_MAP_CAP;
+            let dropped = 0;
+            for (const key of map.keys()) {
+                if (dropped >= excess)
+                    break;
+                map.delete(key);
+                dropped++;
+            }
+        }
+    }
+}
+export async function loadStateFromDisk(logger) {
+    let store;
+    try {
+        store = getStore();
+    }
+    catch (error) {
+        logger.error({ err: toErrorDetail(error) }, "Failed to open orchestrator SQLite store");
+        return;
+    }
+    const jsonPath = resolveStateFilePath();
+    // Sweep stale .json.migrated-<ts> siblings first; never blocks startup.
+    void sweepStaleMigrations(jsonPath, resolveJsonMigrationTtlDays(), logger);
+    // If SQLite already has state, just hydrate from it.
+    const sessionsSeeded = store.db
+        .prepare("SELECT COUNT(*) AS n FROM pages")
+        .get().n > 0;
+    if (sessionsSeeded) {
+        hydrateMapsFromStore(store);
+        logger.info({ backend: "sqlite" }, "Loaded persisted orchestrator state");
+        return;
+    }
+    // DB is empty — migrate from legacy JSON if it exists.
+    if (!existsSync(jsonPath)) {
+        logger.info({ backend: "sqlite" }, "No prior orchestrator state; starting fresh");
+        return;
+    }
+    try {
+        const parsed = await readLegacyJson(jsonPath);
+        if (parsed) {
+            applyPersistedState(parsed);
+            writeAllStateToStore(store);
+            const archived = await archiveMigratedJson(jsonPath);
+            logger.info({ file: jsonPath, archived }, "Migrated orchestrator state from JSON to SQLite");
+        }
+        else {
+            logger.info({ file: jsonPath }, "Legacy JSON state file was empty; ignoring");
+        }
+    }
+    catch (error) {
+        logger.error({ err: toErrorDetail(error), file: jsonPath }, "Failed to migrate orchestrator state from JSON");
+    }
+}
+export { InMemoryContentSource } from "./in-memory-content-source.js";