@avocadostudio-ai/orchestrator-core 0.3.2 → 0.4.0

package/dist/http/history-actions.js

@@ -167,3 +167,125 @@ export function historyRestoreAction(body, log) {
         }
     };
 }
+/**
+ * Throw away selected changes by rolling each affected page back to the state
+ * it held immediately before the earliest change selected on it.
+ *
+ * The version log is a per-page timeline, not a stack of independent patches:
+ * an entry records the page *after* the change, so "undo this one change and
+ * keep the later ones" is not a question the stored data can answer. What it
+ * can answer is "put this page back the way it was before change N", which is
+ * what discarding means here — and it is why the response names every later
+ * entry that goes with it. The caller shows that list before asking the user
+ * to confirm; this function reports it again for whatever actually happened.
+ *
+ * Selecting several entries on one page collapses to its earliest. Selecting
+ * entries across pages rolls each page back independently — untouched pages
+ * keep their edits.
+ *
+ * Like a restore, a discard is itself an edit: the current page goes onto the
+ * undo stack first, so a discard can be undone.
+ */
+export function historyDiscardAction(body, log) {
+    if (!body.session)
+        return badRequest("session is required");
+    const requested = Array.isArray(body.versions)
+        ? Array.from(new Set(body.versions.filter((v) => typeof v === "number" && Number.isFinite(v))))
+        : [];
+    if (requested.length === 0)
+        return badRequest("versions must be a non-empty array of version numbers");
+    const session = scopedSessionKey(body.session, body.siteId);
+    const entries = versionLog.get(session) ?? [];
+    const byVersion = new Map(entries.map((entry) => [entry.version, entry]));
+    const skipped = [];
+    /*
+     * Collapse to one rollback per page. A selection of three entries on the
+     * same page is one rollback to before the earliest of them; running three
+     * would have the second and third restore snapshots the first already
+     * invalidated.
+     */
+    const earliestBySlug = new Map();
+    for (const version of requested) {
+        const entry = byVersion.get(version);
+        if (!entry) {
+            skipped.push({ version, reason: "not in this session's version log" });
+            continue;
+        }
+        const current = earliestBySlug.get(entry.slug);
+        if (current === undefined || version < current)
+            earliestBySlug.set(entry.slug, version);
+    }
+    const discarded = [];
+    let previewVersion = versions.get(session) ?? 0;
+    let navigateToSlug;
+    for (const [slug, fromVersion] of earliestBySlug) {
+        /*
+         * The state before `fromVersion` is the snapshot of the newest earlier
+         * entry on the same page. An entry with no snapshot is a legacy row that
+         * cannot restore anything, so it does not count as the prior state.
+         */
+        const prior = entries
+            .filter((entry) => entry.slug === slug && entry.version < fromVersion && entry.snapshot !== undefined)
+            .at(-1);
+        if (!prior) {
+            /*
+             * Nothing recorded before this change — the log was capped, or this is
+             * the page's first entry. Guessing would mean inventing a state the
+             * page never had, so the entry stays and the caller is told why.
+             */
+            skipped.push({
+                version: fromVersion,
+                reason: "no recorded page state before this change"
+            });
+            continue;
+        }
+        const alsoDiscarded = entries
+            .filter((entry) => entry.slug === slug && entry.version >= fromVersion)
+            .map((entry) => entry.version)
+            .filter((version) => version !== fromVersion);
+        // Filtered above, so this only maps the impossible `undefined` onto the
+        // `null` that means "the page did not exist at this version".
+        const snapshot = prior.snapshot ?? null;
+        // pushUndo also clears redo, which is right: a discard starts a new branch.
+        pushUndo(session, slug, getPage(session, slug));
+        if (snapshot === null)
+            removePage(session, slug);
+        else
+            setPage(session, structuredClone(snapshot));
+        previewVersion = bumpVersion(session);
+        const count = alsoDiscarded.length + 1;
+        pushVersionEntry(session, {
+            version: previewVersion,
+            slug,
+            summary: `Discarded ${count} change${count === 1 ? "" : "s"} — back to v${prior.version}`,
+            opTypes: [],
+            opCount: 0,
+            source: "restore",
+            snapshot: snapshot === null ? null : structuredClone(snapshot)
+        });
+        discarded.push({ slug, fromVersion, toVersion: snapshot === null ? null : prior.version, alsoDiscarded });
+        navigateToSlug = slug;
+    }
+    if (discarded.length === 0) {
+        return {
+            code: 400,
+            body: { error: "nothing could be discarded", skipped }
+        };
+    }
+    schedulePersistState(log);
+    const touched = discarded[discarded.length - 1].slug;
+    const undoList = getHistoryMap(historyUndo, session).get(touched) ?? [];
+    const redoList = getHistoryMap(historyRedo, session).get(touched) ?? [];
+    return {
+        code: 200,
+        body: {
+            status: "applied",
+            previewVersion,
+            discarded,
+            skipped,
+            ...(navigateToSlug ? { navigateToSlug } : {}),
+            canUndo: undoList.length > 0,
+            canRedo: redoList.length > 0
+        }
+    };
+}

package/dist/http/image-generate-actions.d.ts

@@ -23,8 +23,8 @@
  * Each function returns the status code and body to send, or emits frames;
  * neither Fastify nor `Response` appears in this file.
  */
-import type { Logger } from "../logger.js";
-import type { ActionResult } from "./history-actions.js";
+import type { Logger } from "../logger.ts";
+import type { ActionResult } from "./history-actions.ts";
 export type { ActionResult };
 /**
  * The one seam that decides where a generated image is written and what URL

package/dist/http/ops-actions.d.ts

@@ -17,8 +17,8 @@
  * own again.
  */
 import type { BlockManifest, Operation } from "@avocadostudio-ai/shared";
-import { type SkippedOperation } from "../ops/ops-engine.js";
-import type { ActionResult } from "./history-actions.js";
+import { type SkippedOperation } from "../ops/ops-engine.ts";
+import type { ActionResult } from "./history-actions.ts";
 export type { ActionResult };
 /**
  * Never mutates state, so it skips undo snapshotting, the version bump and the

package/dist/http/publish-actions.d.ts

@@ -16,10 +16,10 @@
  * neither Fastify nor `Response` appears in this file.
  */
 import type { PageDoc, SiteConfig } from "@avocadostudio-ai/shared";
-import type { PublishLogStatus } from "../state/session-state.js";
-import { refreshPublishStatusFromVercel } from "../publish/publish-helpers.js";
-import type { Logger } from "../logger.js";
-import type { ActionResult } from "./history-actions.js";
+import type { PublishLogStatus } from "../state/session-state.ts";
+import { refreshPublishStatusFromVercel } from "../publish/publish-helpers.ts";
+import type { Logger } from "../logger.ts";
+import type { ActionResult } from "./history-actions.ts";
 export type { ActionResult };
 /**
  * What "the site as it is currently live" resolves to.
@@ -35,6 +35,16 @@ export type PublishedContent = {
     pages: PageDoc[];
     siteConfig?: SiteConfig | null;
 };
+/**
+ * Where the published side came from, in descending order of trust.
+ *
+ * A diff can be computed from any of them — a wrong diff only misreports. A
+ * *partial* publish cannot: it merges the unselected pages back out of this
+ * baseline and ships them, so a baseline that is really the startup demo seed
+ * would overwrite the live site with demo content. `"memory"` therefore
+ * disqualifies a subset publish; see `publish-selection.ts`.
+ */
+export type PublishedPagesSource = "site" | "file" | "memory";
 /**
  * Where the published side comes from. The monorepo answers it from the site
  * app; a library-mode consumer answers it from its CMS adapter, whose
@@ -65,6 +75,7 @@ export declare function loadPublishedForDiff(opts: {
 }): Promise<{
     pages: PageDoc[];
     siteConfig: SiteConfig | null;
+    source: PublishedPagesSource;
 }>;
 /**
  * The default source: the four-step monorepo chain above, unchanged, so the

package/dist/http/publish-actions.js

@@ -91,7 +91,7 @@ export async function loadPublishedForDiff(opts) {
     }
     // Hot path: remote returned both pages and siteConfig.
     if (remotePages && remoteSiteConfig) {
-        return { pages: remotePages, siteConfig: remoteSiteConfig };
+        return { pages: remotePages, siteConfig: remoteSiteConfig, source: "site" };
     }
     // Either the remote didn't run, didn't include siteConfig (older SDK or
     // site dev not yet restarted), or didn't include pages. Read the JSON file
@@ -101,9 +101,9 @@ export async function loadPublishedForDiff(opts) {
     const pages = remotePages ?? fromFile.pages;
     const siteConfig = remoteSiteConfig ?? fromFile.siteConfig;
     if (pages)
-        return { pages, siteConfig };
+        return { pages, siteConfig, source: remotePages ? "site" : "file" };
     logger.warn("publish/diff: falling back to in-memory publishedPages — diff may be inaccurate");
-    return { pages: Array.from(publishedPages.values()), siteConfig };
+    return { pages: Array.from(publishedPages.values()), siteConfig, source: "memory" };
 }
 /**
  * The default source: the four-step monorepo chain above, unchanged, so the

package/dist/http/restore-actions.d.ts

@@ -14,9 +14,9 @@
  * function returns the status code and body to send; neither Fastify nor
  * `Response` appears in this file.
  */
-import { listRestoreSnapshots, loadPublishedSnapshotFromCommit, deletePublishSnapshot } from "../publish/publish-helpers.js";
-import type { Logger } from "../logger.js";
-import type { ActionResult } from "./history-actions.js";
+import { listRestoreSnapshots, loadPublishedSnapshotFromCommit, deletePublishSnapshot } from "../publish/publish-helpers.ts";
+import type { Logger } from "../logger.ts";
+import type { ActionResult } from "./history-actions.ts";
 export type { ActionResult };
 /**
  * The three git-backed helpers, injectable so the actions are testable.

package/dist/http/screenshot-actions.d.ts

@@ -24,8 +24,8 @@
  * page. So the path is declarable: per request, per registered site, or via
  * `createOrchestrator({ draftPath })`.
  */
-import type { Logger } from "../logger.js";
-import type { ActionResult } from "./history-actions.js";
+import type { Logger } from "../logger.ts";
+import type { ActionResult } from "./history-actions.ts";
 export type { ActionResult };
 export type ScreenshotParams = {
     session?: string;

package/dist/http/session-actions.d.ts

@@ -17,7 +17,7 @@
  * embedding its own editor, and it would answer a question no embedded caller
  * should be asking.
  */
-import type { ActionResult } from "./history-actions.js";
+import type { ActionResult } from "./history-actions.ts";
 export type { ActionResult };
 /**
  * The caller's bound session and a summary of its state.

package/dist/http/telemetry-feedback-actions.d.ts

@@ -15,8 +15,8 @@
  * status code and body to send; neither Fastify nor `Response` appears in this
  * file.
  */
-import type { FeedbackStore } from "../telemetry/feedback-store.js";
-import type { ActionResult } from "./history-actions.js";
+import type { FeedbackStore } from "../telemetry/feedback-store.ts";
+import type { ActionResult } from "./history-actions.ts";
 export type { ActionResult };
 /**
  * The store is a parameter, not a module singleton.

package/dist/http/unsplash-actions.d.ts

@@ -15,8 +15,8 @@
  * orchestrator runtime is ready, and why this file needs no collaborators
  * beyond an access key and a `fetch`.
  */
-import type { Logger } from "../logger.js";
-import type { ActionResult } from "./history-actions.js";
+import type { Logger } from "../logger.ts";
+import type { ActionResult } from "./history-actions.ts";
 export type { ActionResult };
 /**
  * Raw query values, straight off the wire.

package/dist/http/variations-actions.d.ts

@@ -17,8 +17,8 @@
  * wire bytes for callers that don't already have an SSE writer. Neither Fastify
  * nor `Response` appears in this file.
  */
-import { type VariationRequestBody, type VariationPipelineContext, type VariationResult, type VariationImageUpdate } from "../chat/variation-pipeline.js";
-import type { ActionResult } from "./history-actions.js";
+import { type VariationRequestBody, type VariationPipelineContext, type VariationResult, type VariationImageUpdate } from "../chat/variation-pipeline.ts";
+import type { ActionResult } from "./history-actions.ts";
 export type { ActionResult };
 export type { VariationRequestBody, VariationPipelineContext };
 export type ParsedVariationRequest = {

package/dist/index.d.ts

@@ -1,4 +1,11 @@
 export { createOrchestrator, type CreateOrchestratorConfig, type OrchestratorHandler } from "./handler/create-orchestrator.ts";
 export type { OrchestratorAuth, AuthContext } from "./handler/auth.ts";
-export type { CmsAdapter, CmsCapabilities, CmsInlineAsset, CmsPublishContext, CmsPublishResult, CmsPerspective, CmsReadOptions, CmsMediaItem, CmsMediaPage, CmsMediaQuery, ResolvedCapabilities } from "./cms/adapter.ts";
-export { jsonFileAdapter, editorApiAdapter, resolveCapabilities, cmsMediaSource, cmsMediaLabel, type JsonFileAdapterOptions, type EditorApiAdapterOptions, type CmsMediaSource, type CmsMediaSourceConfig } from "./cms/index.ts";
+export type { CmsAdapter, CmsCapabilities, CmsInlineAsset, CmsPublishContext, CmsPublishResult, CmsPerspective, CmsReadOptions, CmsMediaItem, CmsMediaPage, CmsMediaQuery, CmsMediaUpload, ResolvedCapabilities } from "./cms/adapter.ts";
+export { jsonFileAdapter, editorApiAdapter, resolveCapabilities, cmsMediaSource, cmsMediaUploader, cmsMediaLabel, type JsonFileAdapterOptions, type EditorApiAdapterOptions, type CmsMediaSource, type CmsMediaUploader, type CmsMediaSourceConfig } from "./cms/index.ts";
+export { registerPublishTarget, selectPublishTarget, getPublishTarget, listPublishTargets } from "./publish/publish-target-registry.ts";
+export type { PublishTarget, PublishContext, PublishOutcome, PublishStatus, PublishResult } from "./publish/publish-target.ts";
+export { SqliteDurableStore, InMemoryDurableStore, getDurableStore, resetDurableStore, setDurableStore, durableStoreIsEphemeral, type SqliteDurableStoreOptions, type InMemoryDurableStoreOptions, type DurableStore, type FindingInput, type FindingRecord, type FindingQuery, type FindingSeverity, type FindingStatus, type FindingEvidence, type CheckRunInput, type CheckRunRecord, type CheckRunPatch, type CheckRunTrigger, type MemoryInput, type MemoryRecord, type MemoryQuery, type MemoryScope, type MemoryKind, type MemorySource, type MemoryStatus, type CorrectionInput, type CorrectionRecord, type CorrectionQuery, type CorrectionOutcome, type ProposalInput, type ProposalRecord, type ProposalQuery, type ProposalStatus } from "./durable/index.ts";
+export { runDraftChecks, runChecksForSession, scheduleChecksAfterApply, scheduleChecksAfterPublish, cancelScheduledChecks, fingerprintFor, DRAFT_RULES, walkPageFields, fieldText, type RunChecksArgs, type CheckRule, type CheckContext, type RuleFinding, type FieldEntry, type SiteView } from "./checks/index.ts";
+export { runChecksAction, listFindingsAction, listCheckRunsAction, updateFindingAction, type RunChecksParams, type ListFindingsParams, type UpdateFindingParams, type ChecksScope } from "./http/checks-actions.ts";
+export { durableHealth, noteDurableFailure, isDiscardInFlight } from "./durable/durable-store-singleton.ts";
+export { loadPendingPlan, savePendingPlan, clearPendingPlan, peekPendingPlan } from "./durable/pending-plan-store.ts";

package/dist/index.js

@@ -18,4 +18,31 @@
 //
 // The Fastify HTTP wrapper lives in apps/orchestrator and imports from here.
 export { createOrchestrator } from "./handler/create-orchestrator.js";
-export { jsonFileAdapter, editorApiAdapter, resolveCapabilities, cmsMediaSource, cmsMediaLabel } from "./cms/index.js";
+export { jsonFileAdapter, editorApiAdapter, resolveCapabilities, cmsMediaSource, cmsMediaUploader, cmsMediaLabel } from "./cms/index.js";
+// The publish-target plugin point. `docs-site/integration/publishing.mdx` has
+// documented this as the way to publish somewhere we do not ship a target for
+// since before the package had an export map, and told the reader to import it
+// from `"./publish/publish-target-registry.js"` — a relative path into *this*
+// repository, pasted into their file. It cannot resolve from anywhere, and
+// there was no specifier that could: the symbol was not exported here, so a
+// registry consumer had no reachable way to register a target at all.
+//
+// The interface was always meant to be public — `architecture.mdx` calls it the
+// integration point for "S3, GitLab Pages, Netlify, a CMS API, a custom CI/CD
+// pipeline". Only the export was missing.
+export { registerPublishTarget, selectPublishTarget, getPublishTarget, listPublishTargets } from "./publish/publish-target-registry.js";
+// The durable substrate for findings, memory, corrections and proposals. It is
+// public because the implementation is meant to be replaceable: a library-mode
+// host on a serverless platform has no persistent disk for a SQLite file, and
+// every record here would otherwise die with the process. `DurableStore` is the
+// seam a Neon- or Turso-backed store fills — which is only true if a consumer
+// installing from the registry can reach the type.
+export { SqliteDurableStore, InMemoryDurableStore, getDurableStore, resetDurableStore, setDurableStore, durableStoreIsEphemeral } from "./durable/index.js";
+// The draft-tier checks: pure functions of a PageDoc and the block manifest,
+// producing findings into the durable store. Public so an integrator can run
+// them (or add a rule of their own) against a site we do not host.
+export { runDraftChecks, runChecksForSession, scheduleChecksAfterApply, scheduleChecksAfterPublish, cancelScheduledChecks, fingerprintFor, DRAFT_RULES, walkPageFields, fieldText } from "./checks/index.js";
+// The checks HTTP surface, mounted by both transports.
+export { runChecksAction, listFindingsAction, listCheckRunsAction, updateFindingAction } from "./http/checks-actions.js";
+export { durableHealth, noteDurableFailure, isDiscardInFlight } from "./durable/durable-store-singleton.js";
+export { loadPendingPlan, savePendingPlan, clearPendingPlan, peekPendingPlan } from "./durable/pending-plan-store.js";

package/dist/nlp/deterministic-planner-context.d.ts

@@ -46,6 +46,22 @@ export declare function selectedBlockSnapshot(args: {
     selectedEditablePath: string | null;
     selectedEditableValue: {} | null;
 } | null;
+/**
+ * How an item in a list prop gets named to the planner, in precedence order.
+ *
+ * A list whose items match none of these reaches the planner as a bare count,
+ * and the planner then cannot answer "update the FAQ entry about freezing" —
+ * it knows there are three entries and nothing about any of them. It says so,
+ * correctly, and asks which one. Three of the twelve list fields in the block
+ * registry were in that state: `FAQAccordion.items` names its question `q`,
+ * `Testimonials.items` has `author`/`quote`, and `Gallery.images` has
+ * `caption`/`alt`. None of those were listed here.
+ *
+ * `arrayPropLabelKeys` is asserted against the block registry by a test, so a
+ * new block with a differently-named item field fails there rather than
+ * silently costing the planner a clarification round-trip.
+ */
+export declare const ARRAY_PROP_LABEL_KEYS: readonly ["label", "title", "heading", "question", "q", "name", "author", "caption", "alt", "quote", "value", "text"];
 export declare function arrayPropLengths(props: Record<string, unknown>): Record<string, {
     length: number;
     labels?: string[];

package/dist/nlp/deterministic-planner-context.js

@@ -184,6 +184,35 @@ export function selectedBlockSnapshot(args) {
 // ---------------------------------------------------------------------------
 // Array prop metadata
 // ---------------------------------------------------------------------------
+/**
+ * How an item in a list prop gets named to the planner, in precedence order.
+ *
+ * A list whose items match none of these reaches the planner as a bare count,
+ * and the planner then cannot answer "update the FAQ entry about freezing" —
+ * it knows there are three entries and nothing about any of them. It says so,
+ * correctly, and asks which one. Three of the twelve list fields in the block
+ * registry were in that state: `FAQAccordion.items` names its question `q`,
+ * `Testimonials.items` has `author`/`quote`, and `Gallery.images` has
+ * `caption`/`alt`. None of those were listed here.
+ *
+ * `arrayPropLabelKeys` is asserted against the block registry by a test, so a
+ * new block with a differently-named item field fails there rather than
+ * silently costing the planner a clarification round-trip.
+ */
+export const ARRAY_PROP_LABEL_KEYS = [
+    "label",
+    "title",
+    "heading",
+    "question",
+    "q",
+    "name",
+    "author",
+    "caption",
+    "alt",
+    "quote",
+    "value",
+    "text"
+];
 export function arrayPropLengths(props) {
     const out = {};
     for (const [key, value] of Object.entries(props)) {
@@ -192,13 +221,10 @@ export function arrayPropLengths(props) {
         const labels = [];
         for (const item of value) {
             if (typeof item === "object" && item !== null) {
-                const labelValue = item.label ??
-                    item.title ??
-                    item.heading ??
-                    item.question ??
-                    item.name;
-                if (typeof labelValue === "string")
-                    labels.push(labelValue);
+                const record = item;
+                const labelKey = ARRAY_PROP_LABEL_KEYS.find((candidate) => typeof record[candidate] === "string");
+                if (labelKey)
+                    labels.push(record[labelKey]);
             }
         }
         out[key] = labels.length > 0 ? { length: value.length, labels } : { length: value.length };

package/dist/nlp/intent-detection.d.ts

@@ -282,12 +282,28 @@ export declare function adviceResponse(args: {
 };
 export declare function plannerMessageWithPendingContext(session: string, message: string): string;
 /** Build the site context lines without wrapping in a message. Returns null if empty. */
+/** How many documents ride along in a planner request. */
+export declare const SITE_CONTEXT_DOCUMENT_CAP = 60;
 export declare function buildSiteContextBlock(args?: {
     sitePurpose?: string;
     siteHosting?: string;
     businessContext?: ChatRequestBody["businessContext"];
     siteContext?: ChatRequestBody["siteContext"];
     pageDirectory?: string;
+    /**
+     * The site's downloadable documents, so the planner can link one.
+     *
+     * Without it, "link the winter menu" is unanswerable: the model has the
+     * page list and the block schemas and no idea the site holds fifteen PDFs,
+     * so it invents a plausible path — which is exactly how a link to a
+     * misspelled filename gets written in the first place. Listed by path and
+     * name, because the path is what goes in the link and the name is what the
+     * user said.
+     */
+    documents?: Array<{
+        path: string;
+        name?: string;
+    }>;
 }): string | null;
 export declare function withSiteContext(message: string, args?: {
     sitePurpose?: string;

package/dist/nlp/intent-detection.js

@@ -492,6 +492,8 @@ function normalizeConstraintList(value) {
     return [];
 }
 /** Build the site context lines without wrapping in a message. Returns null if empty. */
+/** How many documents ride along in a planner request. */
+export const SITE_CONTEXT_DOCUMENT_CAP = 60;
 export function buildSiteContextBlock(args) {
     const businessContext = parseJsonObjectMaybe(args?.businessContext);
     const siteContext = parseJsonObjectMaybe(args?.siteContext);
@@ -516,7 +518,19 @@ export function buildSiteContextBlock(args) {
         constraints.length > 0 ? `Constraints: ${constraints.join("; ")}` : null,
         siteName ? `Site name: ${siteName}` : null,
         pageTemplates.length > 0 ? `Page templates:\n${pageTemplates.join("\n")}` : null,
-        args?.pageDirectory ? `Pages:\n${args.pageDirectory}` : null
+        args?.pageDirectory ? `Pages:\n${args.pageDirectory}` : null,
+        /*
+         * Capped. A media library can hold hundreds of files and this rides in
+         * every planner request; past the cap the model sees a partial list, which
+         * makes it worse at finding an obscure document but never wrong about the
+         * ones it does see.
+         */
+        args?.documents && args.documents.length > 0
+            ? `Documents the site hosts (link by path, never invent one):\n${args.documents
+                .slice(0, SITE_CONTEXT_DOCUMENT_CAP)
+                .map((d) => (d.name ? `- ${d.name} — ${d.path}` : `- ${d.path}`))
+                .join("\n")}`
+            : null
     ].filter((line) => Boolean(line));
     if (lines.length === 0)
         return null;

package/dist/nlp/plan-normalizer.js

@@ -1,4 +1,4 @@
-import { allowedBlockTypes, blockSchemas, declaredDefaultPropsForType, defaultPropsForType as sharedDefaultPropsForType, getBlockMeta } from "@avocadostudio-ai/shared";
+import { allowedBlockTypes, blockAcceptsProp, blockListItemAcceptsKey, blockSchemas, declaredDefaultPropsForType, defaultPropsForType as sharedDefaultPropsForType } from "@avocadostudio-ai/shared";
 import { extractRouteMentions, firstRouteMention, normalizeRouteCandidate, parseCreatePageRequest } from "./intent-helpers.js";
 // ---------------------------------------------------------------------------
 // Prop-name aliasing, asked of the registry rather than of a literal
@@ -18,23 +18,14 @@ import { extractRouteMentions, firstRouteMention, normalizeRouteCandidate, parse
  * wrong about its own job; the first link was answering a question about a name
  * instead of about a schema.
  *
- * So ask the registry. A rename now requires positive evidence in both
- * directions: the block cannot take the key the planner used, and can take the
- * one we would rewrite it to. Every other case — unknown block type, a block
- * that accepts both, a block that accepts neither — leaves the value alone,
- * which is the answer that loses no data.
+ * So ask the registry — `blockAcceptsProp`, which lives in `shared` because the
+ * planner prompt needs the same answer before it tells the model a prop name is
+ * wrong. A rename requires positive evidence in both directions: the block
+ * cannot take the key the planner used, and can take the one we would rewrite
+ * it to. Every other case — unknown block type, a block that accepts both, a
+ * block that accepts neither — leaves the value alone, which is the answer that
+ * loses no data.
  */
-function blockAcceptsProp(blockType, prop) {
-    if (!blockType)
-        return false;
-    const meta = getBlockMeta(blockType);
-    if (meta?.fields && prop in meta.fields)
-        return true;
-    // Manifest-registered blocks may carry a schema richer than their derived
-    // meta, so the schema gets the second look rather than the first refusal.
-    const shape = blockSchemas[blockType]?.shape;
-    return Boolean(shape && prop in shape);
-}
 /*
  * Avocado's own `autoplay` / `loop` / `striped` are string enums ("true" /
  * "false"), not booleans, so a model that emits a real boolean has to be
@@ -86,16 +77,11 @@ function shouldAliasProp(blockType, from, to) {
     return !blockAcceptsProp(blockType, from) && blockAcceptsProp(blockType, to);
 }
 /*
- * The same question for a key inside a list item. `listFields[key].itemFields`
- * is the declared shape; a block with no declared list metadata answers "no"
- * to both halves and is therefore left alone.
+ * The same question for a key inside a list item — also shared, for the same
+ * reason. A block with no declared list metadata answers "no" to both halves
+ * and is therefore left alone.
  */
-function listItemAcceptsKey(blockType, listKey, itemKey) {
-    if (!blockType)
-        return false;
-    const itemFields = getBlockMeta(blockType)?.listFields?.[listKey]?.itemFields;
-    return Boolean(itemFields && itemKey in itemFields);
-}
+const listItemAcceptsKey = blockListItemAcceptsKey;
 function shouldAliasItemKey(blockType, listKey, from, to) {
     return (!listItemAcceptsKey(blockType, listKey, from) && listItemAcceptsKey(blockType, listKey, to));
 }
@@ -711,6 +697,19 @@ export function normalizePlanCandidate(input, args) {
         return args.currentPage.blocks[idx - 1]?.id;
     };
     const usedBlockIds = new Set((args?.currentPage?.blocks ?? []).map((b) => b.id));
+    /**
+     * Block ids this pass renamed, old → new.
+     *
+     * Renaming an `add_block` id is only safe if the rest of the plan follows it.
+     * A plan that adds `b_hero_x` and then updates `b_hero_x` means the block it
+     * just added; leave the reference pointing at the colliding name and the
+     * update lands on the *existing* block instead — content written over the
+     * wrong block, which is the failure mode this repo keeps re-shipping. Ops are
+     * normalized in order, so only ops after the rename are rewritten: a
+     * reference that came *before* the add_block can only have meant the block
+     * that was already there.
+     */
+    const renamedBlockIds = new Map();
     let createdPageSlug;
     let droppedPageLevelUpdate = false;
     // itemIds already claimed by a remove_item freeze in THIS plan — used to spot
@@ -972,6 +971,19 @@ export function normalizePlanCandidate(input, args) {
             raw.afterBlockId =
                 raw.after_block_id ?? raw.after ?? raw.insertAfterId ?? beforeToAfter(raw.beforeId ?? raw.insertBeforeId);
         }
+        // Follow any add_block id an earlier op in this plan had to uniquify. Runs
+        // after the alias resolution above so `after_block_id` and friends are
+        // already folded into the canonical keys. See `renamedBlockIds`.
+        if (renamedBlockIds.size > 0) {
+            for (const key of ["blockId", "afterBlockId", "newBlockId"]) {
+                const value = raw[key];
+                if (typeof value === "string") {
+                    const renamed = renamedBlockIds.get(value);
+                    if (renamed)
+                        raw[key] = renamed;
+                }
+            }
+        }
         if (!raw.afterPageSlug) {
             raw.afterPageSlug =
                 raw.afterPageSlug ??
@@ -1246,15 +1258,37 @@ export function normalizePlanCandidate(input, args) {
                     block.props = {};
                 }
             }
-            if ((!block.id || typeof block.id !== "string") && typeof block.type === "string") {
-                let fallbackId = `b_${String(block.type).toLowerCase()}_${Date.now()}`;
+            /*
+             * The model authors this id. Nothing in the `add_block` prompt says how
+             * to build one, so it free-associates from the page and the block type —
+             * `b_featuregrid_wellness` for a FeatureGrid on /avocado-wellness. That is
+             * a near-deterministic function of the prompt, so the same request asked
+             * twice produces the same id twice, and the second one dies in the ops
+             * engine on "Block id … already exists", taking the whole plan down with
+             * it: a committing apply is all-or-nothing.
+             *
+             * `usedBlockIds` is seeded from the page's existing blocks and knew this
+             * all along. It was consulted only when the model *omitted* an id, which
+             * is the one case that cannot collide; a supplied id went through
+             * untouched and was never even registered, so two ops in one plan could
+             * pick the same name. Uniquify instead — a fourth FeatureGrid is a
+             * legitimate reading of "populate this page", and only the label was
+             * wrong. The engine's own check stays as the backstop and must never be
+             * relaxed into an overwrite.
+             */
+            const suppliedId = typeof block.id === "string" && block.id.length > 0 ? block.id : null;
+            const idStem = suppliedId ?? (typeof block.type === "string" ? `b_${String(block.type).toLowerCase()}_${Date.now()}` : null);
+            if (idStem) {
+                let candidate = idStem;
                 let sfx = 0;
-                while (usedBlockIds.has(fallbackId)) {
+                while (usedBlockIds.has(candidate)) {
                     sfx++;
-                    fallbackId = `b_${String(block.type).toLowerCase()}_${Date.now()}_${sfx}`;
+                    candidate = `${idStem}_${sfx}`;
                 }
-                usedBlockIds.add(fallbackId);
-                block.id = fallbackId;
+                usedBlockIds.add(candidate);
+                if (suppliedId && candidate !== suppliedId)
+                    renamedBlockIds.set(suppliedId, candidate);
+                block.id = candidate;
             }
             raw.block = block;
             // Remap heading→title for non-Hero blocks (LLMs often confuse heading/title)

package/dist/ops/destructive-action-gate.js

@@ -24,12 +24,17 @@ function slugsTouchedByOps(ops) {
             set.add(op.toPageSlug);
             continue;
         }
+        // rename_page: one page, under two names. Counting both slugs made every
+        // rename look like a cross-page plan and held it for approval — the same
+        // miscount duplicate_page and duplicate_block are special-cased for above.
+        if (op.op === "rename_page") {
+            set.add(typeof op.newPageSlug === "string" ? op.newPageSlug : op.pageSlug);
+            continue;
+        }
         if ("pageSlug" in op && typeof op.pageSlug === "string")
             set.add(op.pageSlug);
         if (op.op === "duplicate_block" && typeof op.toPageSlug === "string")
             set.add(op.toPageSlug);
-        if (op.op === "rename_page" && typeof op.newPageSlug === "string")
-            set.add(op.newPageSlug);
     }
     return Array.from(set);
 }