@avocadostudio-ai/orchestrator-core 0.3.3 → 0.5.0

package/dist/http/publish-actions.d.ts

@@ -35,6 +35,16 @@ export type PublishedContent = {
     pages: PageDoc[];
     siteConfig?: SiteConfig | null;
 };
+/**
+ * Where the published side came from, in descending order of trust.
+ *
+ * A diff can be computed from any of them — a wrong diff only misreports. A
+ * *partial* publish cannot: it merges the unselected pages back out of this
+ * baseline and ships them, so a baseline that is really the startup demo seed
+ * would overwrite the live site with demo content. `"memory"` therefore
+ * disqualifies a subset publish; see `publish-selection.ts`.
+ */
+export type PublishedPagesSource = "site" | "file" | "memory";
 /**
  * Where the published side comes from. The monorepo answers it from the site
  * app; a library-mode consumer answers it from its CMS adapter, whose
@@ -65,6 +75,7 @@ export declare function loadPublishedForDiff(opts: {
 }): Promise<{
     pages: PageDoc[];
     siteConfig: SiteConfig | null;
+    source: PublishedPagesSource;
 }>;
 /**
  * The default source: the four-step monorepo chain above, unchanged, so the

package/dist/http/publish-actions.js

@@ -91,7 +91,7 @@ export async function loadPublishedForDiff(opts) {
     }
     // Hot path: remote returned both pages and siteConfig.
     if (remotePages && remoteSiteConfig) {
-        return { pages: remotePages, siteConfig: remoteSiteConfig };
+        return { pages: remotePages, siteConfig: remoteSiteConfig, source: "site" };
     }
     // Either the remote didn't run, didn't include siteConfig (older SDK or
     // site dev not yet restarted), or didn't include pages. Read the JSON file
@@ -101,9 +101,9 @@ export async function loadPublishedForDiff(opts) {
     const pages = remotePages ?? fromFile.pages;
     const siteConfig = remoteSiteConfig ?? fromFile.siteConfig;
     if (pages)
-        return { pages, siteConfig };
+        return { pages, siteConfig, source: remotePages ? "site" : "file" };
     logger.warn("publish/diff: falling back to in-memory publishedPages — diff may be inaccurate");
-    return { pages: Array.from(publishedPages.values()), siteConfig };
+    return { pages: Array.from(publishedPages.values()), siteConfig, source: "memory" };
 }
 /**
  * The default source: the four-step monorepo chain above, unchanged, so the

package/dist/image/image-helpers.js

@@ -1,6 +1,7 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import OpenAI from "openai";
+import { resolveDataDir } from "../state/data-dir.js";
 import { listImages, fileNameToAlt, resolveGdriveFolderId } from "./gdrive-client.js";
 // ---------------------------------------------------------------------------
 // Image generation timing — rolling average for progress estimation
@@ -218,7 +219,7 @@ export async function generateVariationImageWithOpenAI(args) {
     const background = args.background ?? "auto";
     const outputFormat = args.outputFormat ?? "png";
     const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
-    const generatedImageDir = process.env.ORCHESTRATOR_GENERATED_IMAGE_DIR ?? resolve(process.cwd(), "../../.data/generated-images");
+    const generatedImageDir = process.env.ORCHESTRATOR_GENERATED_IMAGE_DIR ?? resolve(resolveDataDir(), "generated-images");
     const orchestratorPublicOrigin = (process.env.ORCHESTRATOR_PUBLIC_ORIGIN ?? "http://localhost:4200").replace(/\/+$/, "");
     args.log?.info({ event: "openai_image_start", model, size, background, outputFormat, promptLength: args.prompt.length }, "Starting OpenAI image generation");
     const genStartMs = Date.now();
@@ -270,7 +271,7 @@ export async function generateVariationImageWithOpenAI(args) {
 // Shared image save utility
 // ---------------------------------------------------------------------------
 export async function saveGeneratedImage(bytes, prefix = "gen", ext = "png") {
-    const generatedImageDir = process.env.ORCHESTRATOR_GENERATED_IMAGE_DIR ?? resolve(process.cwd(), "../../.data/generated-images");
+    const generatedImageDir = process.env.ORCHESTRATOR_GENERATED_IMAGE_DIR ?? resolve(resolveDataDir(), "generated-images");
     const orchestratorPublicOrigin = (process.env.ORCHESTRATOR_PUBLIC_ORIGIN ?? "http://localhost:4200").replace(/\/+$/, "");
     const fileName = `${prefix}_${Date.now()}_${Math.random().toString(36).slice(2, 8)}.${ext}`;
     await mkdir(generatedImageDir, { recursive: true });

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { createOrchestrator, type CreateOrchestratorConfig, type OrchestratorHandler } from "./handler/create-orchestrator.ts";
 export type { OrchestratorAuth, AuthContext } from "./handler/auth.ts";
-export type { CmsAdapter, CmsCapabilities, CmsInlineAsset, CmsPublishContext, CmsPublishResult, CmsPerspective, CmsReadOptions, CmsMediaItem, CmsMediaPage, CmsMediaQuery, ResolvedCapabilities } from "./cms/adapter.ts";
-export { jsonFileAdapter, editorApiAdapter, resolveCapabilities, cmsMediaSource, cmsMediaLabel, type JsonFileAdapterOptions, type EditorApiAdapterOptions, type CmsMediaSource, type CmsMediaSourceConfig } from "./cms/index.ts";
+export type { CmsAdapter, CmsCapabilities, CmsInlineAsset, CmsPublishContext, CmsPublishResult, CmsPerspective, CmsReadOptions, CmsMediaItem, CmsMediaPage, CmsMediaQuery, CmsMediaUpload, ResolvedCapabilities } from "./cms/adapter.ts";
+export { jsonFileAdapter, editorApiAdapter, resolveCapabilities, cmsMediaSource, cmsMediaUploader, cmsMediaLabel, type JsonFileAdapterOptions, type EditorApiAdapterOptions, type CmsMediaSource, type CmsMediaUploader, type CmsMediaSourceConfig } from "./cms/index.ts";
 export { registerPublishTarget, selectPublishTarget, getPublishTarget, listPublishTargets } from "./publish/publish-target-registry.ts";
 export type { PublishTarget, PublishContext, PublishOutcome, PublishStatus, PublishResult } from "./publish/publish-target.ts";
 export { SqliteDurableStore, InMemoryDurableStore, getDurableStore, resetDurableStore, setDurableStore, durableStoreIsEphemeral, type SqliteDurableStoreOptions, type InMemoryDurableStoreOptions, type DurableStore, type FindingInput, type FindingRecord, type FindingQuery, type FindingSeverity, type FindingStatus, type FindingEvidence, type CheckRunInput, type CheckRunRecord, type CheckRunPatch, type CheckRunTrigger, type MemoryInput, type MemoryRecord, type MemoryQuery, type MemoryScope, type MemoryKind, type MemorySource, type MemoryStatus, type CorrectionInput, type CorrectionRecord, type CorrectionQuery, type CorrectionOutcome, type ProposalInput, type ProposalRecord, type ProposalQuery, type ProposalStatus } from "./durable/index.ts";

package/dist/index.js

@@ -18,7 +18,7 @@
 //
 // The Fastify HTTP wrapper lives in apps/orchestrator and imports from here.
 export { createOrchestrator } from "./handler/create-orchestrator.js";
-export { jsonFileAdapter, editorApiAdapter, resolveCapabilities, cmsMediaSource, cmsMediaLabel } from "./cms/index.js";
+export { jsonFileAdapter, editorApiAdapter, resolveCapabilities, cmsMediaSource, cmsMediaUploader, cmsMediaLabel } from "./cms/index.js";
 // The publish-target plugin point. `docs-site/integration/publishing.mdx` has
 // documented this as the way to publish somewhere we do not ship a target for
 // since before the package had an export map, and told the reader to import it

package/dist/nlp/intent-detection.d.ts

@@ -282,12 +282,28 @@ export declare function adviceResponse(args: {
 };
 export declare function plannerMessageWithPendingContext(session: string, message: string): string;
 /** Build the site context lines without wrapping in a message. Returns null if empty. */
+/** How many documents ride along in a planner request. */
+export declare const SITE_CONTEXT_DOCUMENT_CAP = 60;
 export declare function buildSiteContextBlock(args?: {
     sitePurpose?: string;
     siteHosting?: string;
     businessContext?: ChatRequestBody["businessContext"];
     siteContext?: ChatRequestBody["siteContext"];
     pageDirectory?: string;
+    /**
+     * The site's downloadable documents, so the planner can link one.
+     *
+     * Without it, "link the winter menu" is unanswerable: the model has the
+     * page list and the block schemas and no idea the site holds fifteen PDFs,
+     * so it invents a plausible path — which is exactly how a link to a
+     * misspelled filename gets written in the first place. Listed by path and
+     * name, because the path is what goes in the link and the name is what the
+     * user said.
+     */
+    documents?: Array<{
+        path: string;
+        name?: string;
+    }>;
 }): string | null;
 export declare function withSiteContext(message: string, args?: {
     sitePurpose?: string;

package/dist/nlp/intent-detection.js

@@ -492,6 +492,8 @@ function normalizeConstraintList(value) {
     return [];
 }
 /** Build the site context lines without wrapping in a message. Returns null if empty. */
+/** How many documents ride along in a planner request. */
+export const SITE_CONTEXT_DOCUMENT_CAP = 60;
 export function buildSiteContextBlock(args) {
     const businessContext = parseJsonObjectMaybe(args?.businessContext);
     const siteContext = parseJsonObjectMaybe(args?.siteContext);
@@ -516,7 +518,19 @@ export function buildSiteContextBlock(args) {
         constraints.length > 0 ? `Constraints: ${constraints.join("; ")}` : null,
         siteName ? `Site name: ${siteName}` : null,
         pageTemplates.length > 0 ? `Page templates:\n${pageTemplates.join("\n")}` : null,
-        args?.pageDirectory ? `Pages:\n${args.pageDirectory}` : null
+        args?.pageDirectory ? `Pages:\n${args.pageDirectory}` : null,
+        /*
+         * Capped. A media library can hold hundreds of files and this rides in
+         * every planner request; past the cap the model sees a partial list, which
+         * makes it worse at finding an obscure document but never wrong about the
+         * ones it does see.
+         */
+        args?.documents && args.documents.length > 0
+            ? `Documents the site hosts (link by path, never invent one):\n${args.documents
+                .slice(0, SITE_CONTEXT_DOCUMENT_CAP)
+                .map((d) => (d.name ? `- ${d.name} — ${d.path}` : `- ${d.path}`))
+                .join("\n")}`
+            : null
     ].filter((line) => Boolean(line));
     if (lines.length === 0)
         return null;

package/dist/nlp/plan-normalizer.js

@@ -1,4 +1,4 @@
-import { allowedBlockTypes, blockSchemas, declaredDefaultPropsForType, defaultPropsForType as sharedDefaultPropsForType, getBlockMeta } from "@avocadostudio-ai/shared";
+import { allowedBlockTypes, blockAcceptsProp, blockListItemAcceptsKey, blockSchemas, declaredDefaultPropsForType, defaultPropsForType as sharedDefaultPropsForType } from "@avocadostudio-ai/shared";
 import { extractRouteMentions, firstRouteMention, normalizeRouteCandidate, parseCreatePageRequest } from "./intent-helpers.js";
 // ---------------------------------------------------------------------------
 // Prop-name aliasing, asked of the registry rather than of a literal
@@ -18,23 +18,14 @@ import { extractRouteMentions, firstRouteMention, normalizeRouteCandidate, parse
  * wrong about its own job; the first link was answering a question about a name
  * instead of about a schema.
  *
- * So ask the registry. A rename now requires positive evidence in both
- * directions: the block cannot take the key the planner used, and can take the
- * one we would rewrite it to. Every other case — unknown block type, a block
- * that accepts both, a block that accepts neither — leaves the value alone,
- * which is the answer that loses no data.
+ * So ask the registry — `blockAcceptsProp`, which lives in `shared` because the
+ * planner prompt needs the same answer before it tells the model a prop name is
+ * wrong. A rename requires positive evidence in both directions: the block
+ * cannot take the key the planner used, and can take the one we would rewrite
+ * it to. Every other case — unknown block type, a block that accepts both, a
+ * block that accepts neither — leaves the value alone, which is the answer that
+ * loses no data.
  */
-function blockAcceptsProp(blockType, prop) {
-    if (!blockType)
-        return false;
-    const meta = getBlockMeta(blockType);
-    if (meta?.fields && prop in meta.fields)
-        return true;
-    // Manifest-registered blocks may carry a schema richer than their derived
-    // meta, so the schema gets the second look rather than the first refusal.
-    const shape = blockSchemas[blockType]?.shape;
-    return Boolean(shape && prop in shape);
-}
 /*
  * Avocado's own `autoplay` / `loop` / `striped` are string enums ("true" /
  * "false"), not booleans, so a model that emits a real boolean has to be
@@ -86,16 +77,11 @@ function shouldAliasProp(blockType, from, to) {
     return !blockAcceptsProp(blockType, from) && blockAcceptsProp(blockType, to);
 }
 /*
- * The same question for a key inside a list item. `listFields[key].itemFields`
- * is the declared shape; a block with no declared list metadata answers "no"
- * to both halves and is therefore left alone.
+ * The same question for a key inside a list item — also shared, for the same
+ * reason. A block with no declared list metadata answers "no" to both halves
+ * and is therefore left alone.
  */
-function listItemAcceptsKey(blockType, listKey, itemKey) {
-    if (!blockType)
-        return false;
-    const itemFields = getBlockMeta(blockType)?.listFields?.[listKey]?.itemFields;
-    return Boolean(itemFields && itemKey in itemFields);
-}
+const listItemAcceptsKey = blockListItemAcceptsKey;
 function shouldAliasItemKey(blockType, listKey, from, to) {
     return (!listItemAcceptsKey(blockType, listKey, from) && listItemAcceptsKey(blockType, listKey, to));
 }

package/dist/publish/publish-helpers.d.ts

@@ -1,5 +1,5 @@
 import type { Logger } from "../logger.ts";
-import { type PageDoc } from "@avocadostudio-ai/shared";
+import { type PageDoc, type SiteConfig } from "@avocadostudio-ai/shared";
 import { type PublishTracker } from "../state/session-state.ts";
 export declare function deploymentIdFromAny(input: string): string | undefined;
 export declare function refreshPublishStatusFromVercel(current: PublishTracker): Promise<PublishTracker>;
@@ -44,7 +44,17 @@ export declare function collectInlineAssets(pages: PageDoc[], generatedImageDir:
  * Best-effort: failures are silently ignored.
  */
 export declare function recordPublishSnapshot(session: string, pages: PageDoc[], log?: Logger, siteConfig?: Record<string, unknown>): Promise<string | undefined>;
-export declare function publishViaGit(session: string): Promise<{
+/**
+ * `content` is what the route decided to publish. It defaults to the whole
+ * session draft, which is what this read for itself before the argument
+ * existed and what a full publish still computes. A partial publish passes the
+ * merged set instead — live site plus the selected pages — and re-reading the
+ * draft here would quietly publish everything anyway.
+ */
+export declare function publishViaGit(session: string, content?: {
+    pages: PageDoc[];
+    siteConfig: SiteConfig;
+}): Promise<{
     status: "failed";
     session: string;
     slugs: string[];

package/dist/publish/publish-helpers.js

@@ -4,6 +4,7 @@ import { existsSync } from "node:fs";
 import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { promisify } from "node:util";
 import { resolve } from "node:path";
+import { resolveDataDir } from "../state/data-dir.js";
 import { pageDocSchema } from "@avocadostudio-ai/shared";
 import { draftPages, versions, ensureHeroImageProps, persistStateNow, getSessionPages, getSiteConfig, isLegacySiteId } from "../state/session-state.js";
 import { toErrorDetail } from "../ops/ops-engine.js";
@@ -392,13 +393,20 @@ function sanitizeBranch(input) {
     const trimmed = input.trim();
     return trimmed.length > 0 ? trimmed : "main";
 }
-export async function publishViaGit(session) {
+/**
+ * `content` is what the route decided to publish. It defaults to the whole
+ * session draft, which is what this read for itself before the argument
+ * existed and what a full publish still computes. A partial publish passes the
+ * merged set instead — live site plus the selected pages — and re-reading the
+ * draft here would quietly publish everything anyway.
+ */
+export async function publishViaGit(session, content) {
     const repoRoot = resolve(process.cwd(), "../..");
     const targetPath = "apps/site/lib/published-content.json";
     const absoluteTargetPath = resolve(repoRoot, targetPath);
     const branch = sanitizeBranch(process.env.PUBLISH_GIT_BRANCH ?? "main");
     const strict = process.env.PUBLISH_GIT_STRICT === "1";
-    let pages = getSessionPages(session);
+    let pages = content?.pages ?? getSessionPages(session);
     const slugs = pages.map((page) => page.slug);
     // Rewrite localhost image URLs → relative paths and copy files into public/
     const imageUrlMap = findLocalhostImageUrls(pages);
@@ -406,7 +414,7 @@ export async function publishViaGit(session) {
     let copiedImages = false;
     if (imageUrlMap.size > 0) {
         const generatedImageDir = process.env.ORCHESTRATOR_GENERATED_IMAGE_DIR ??
-            resolve(process.cwd(), "../../.data/generated-images");
+            resolve(resolveDataDir(), "generated-images");
         await mkdir(imageDestDir, { recursive: true });
         for (const [, fileName] of imageUrlMap) {
             const src = resolve(generatedImageDir, fileName);
@@ -421,7 +429,7 @@ export async function publishViaGit(session) {
         }
         pages = rewriteImageUrlsInPages(pages, imageUrlMap);
     }
-    const siteConfig = getSiteConfig(session);
+    const siteConfig = content?.siteConfig ?? getSiteConfig(session);
     const payload = `${JSON.stringify({ pages, siteConfig }, null, 2)}\n`;
     await writeFile(absoluteTargetPath, payload, "utf8");
     const statusRaw = await runGit(["status", "--porcelain"], repoRoot);

package/dist/publish/publish-selection.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Publishing some of the draft rather than all of it.
+ *
+ * The editor's publish dialog lists every changed page and lets the user tick
+ * the ones to ship. Turning that tick list into something a publish target can
+ * receive is not filtering, and the difference is the whole point of this file.
+ *
+ * `PublishContext.pages` is a snapshot: "make the site be this". Every
+ * built-in target reads it that way — the git target serialises it to
+ * `published-content.json`, the site-contract target POSTs it to
+ * `/api/editor/publish`, a CMS adapter diffs it against what it read. Handing
+ * any of them the four pages the user ticked would not publish four pages; it
+ * would publish a four-page site and take the other fifty-six down. That is
+ * the same class of bug as the three in b4b58a5f — content destroyed by an
+ * edit that was only ever asked to change part of it.
+ *
+ * So a subset publish is a *merge*: start from what is live, overwrite the
+ * selected slugs with their draft versions, and leave every other page exactly
+ * as the live site already has it. A diffing adapter then finds changes only
+ * in the selected pages, because the rest are byte-identical to the baseline
+ * it read. A snapshot target writes a site that differs from the current one
+ * only in the selected pages. Both contracts come out right, and neither
+ * target needs to know a subset was requested.
+ *
+ * It follows that a subset publish is impossible without knowing what is live.
+ * `selectPagesForPublish` says so rather than guessing — the caller refuses
+ * the publish instead of shipping a site assembled from a baseline it does not
+ * have.
+ */
+import type { PageDoc, SiteConfig } from "@avocadostudio-ai/shared";
+export type PublishSelection = {
+    /**
+     * Slugs to publish. `undefined` means "publish everything", which is the
+     * old behaviour and skips this module entirely.
+     */
+    slugs?: readonly string[];
+    /**
+     * Whether the site-wide config (header, nav, footer chrome) ships too. It
+     * is one more tick box in the dialog and lives outside the page tree, so it
+     * is selected separately. Defaults to true, matching a full publish.
+     */
+    includeSiteConfig?: boolean;
+};
+export type SelectedPublish = {
+    /** The merged page set to hand a publish target. */
+    pages: PageDoc[];
+    /** The config to hand it — draft or published, per `includeSiteConfig`. */
+    siteConfig: SiteConfig;
+    /** Slugs whose content this publish actually changes. */
+    selectedSlugs: string[];
+    /** Selected slugs that are live now and are being taken down. */
+    removedSlugs: string[];
+};
+export type SelectionFailure = {
+    error: string;
+};
+export type SelectionResult = SelectedPublish | SelectionFailure;
+export declare function isSelectionFailure(result: SelectionResult): result is SelectionFailure;
+/**
+ * Normalise what the client sent.
+ *
+ * Sending the field at all is the request for a subset; its length is not. An
+ * empty array means "no pages", which is a real thing to ask for — the publish
+ * dialog can have every page unticked and the site header ticked — and the two
+ * mistakes are not symmetrical: reading `[]` as "everything" ships pages the
+ * user just unticked, while reading it as "no pages" republishes what is
+ * already live and changes nothing. Only an absent or malformed field means
+ * the whole draft, which is what every caller meant before this existed.
+ */
+export declare function parseSelectionSlugs(raw: unknown): string[] | undefined;
+/**
+ * Build the page set and config for a publish that covers only `slugs`.
+ *
+ * `published` is what the live site currently holds. `null`/`undefined` means
+ * the caller could not find out, which is a refusal rather than an empty site
+ * — see the note at the top of this file.
+ */
+export declare function selectPagesForPublish(opts: {
+    draft: readonly PageDoc[];
+    published: readonly PageDoc[] | null | undefined;
+    draftSiteConfig: SiteConfig;
+    publishedSiteConfig?: SiteConfig | null;
+    selection: PublishSelection;
+}): SelectionResult;

package/dist/publish/publish-selection.js

@@ -0,0 +1,113 @@
+/**
+ * Publishing some of the draft rather than all of it.
+ *
+ * The editor's publish dialog lists every changed page and lets the user tick
+ * the ones to ship. Turning that tick list into something a publish target can
+ * receive is not filtering, and the difference is the whole point of this file.
+ *
+ * `PublishContext.pages` is a snapshot: "make the site be this". Every
+ * built-in target reads it that way — the git target serialises it to
+ * `published-content.json`, the site-contract target POSTs it to
+ * `/api/editor/publish`, a CMS adapter diffs it against what it read. Handing
+ * any of them the four pages the user ticked would not publish four pages; it
+ * would publish a four-page site and take the other fifty-six down. That is
+ * the same class of bug as the three in b4b58a5f — content destroyed by an
+ * edit that was only ever asked to change part of it.
+ *
+ * So a subset publish is a *merge*: start from what is live, overwrite the
+ * selected slugs with their draft versions, and leave every other page exactly
+ * as the live site already has it. A diffing adapter then finds changes only
+ * in the selected pages, because the rest are byte-identical to the baseline
+ * it read. A snapshot target writes a site that differs from the current one
+ * only in the selected pages. Both contracts come out right, and neither
+ * target needs to know a subset was requested.
+ *
+ * It follows that a subset publish is impossible without knowing what is live.
+ * `selectPagesForPublish` says so rather than guessing — the caller refuses
+ * the publish instead of shipping a site assembled from a baseline it does not
+ * have.
+ */
+export function isSelectionFailure(result) {
+    return "error" in result;
+}
+/**
+ * Normalise what the client sent.
+ *
+ * Sending the field at all is the request for a subset; its length is not. An
+ * empty array means "no pages", which is a real thing to ask for — the publish
+ * dialog can have every page unticked and the site header ticked — and the two
+ * mistakes are not symmetrical: reading `[]` as "everything" ships pages the
+ * user just unticked, while reading it as "no pages" republishes what is
+ * already live and changes nothing. Only an absent or malformed field means
+ * the whole draft, which is what every caller meant before this existed.
+ */
+export function parseSelectionSlugs(raw) {
+    if (!Array.isArray(raw))
+        return undefined;
+    const slugs = raw.filter((s) => typeof s === "string" && s.trim().length > 0).map((s) => s.trim());
+    return Array.from(new Set(slugs));
+}
+/**
+ * Build the page set and config for a publish that covers only `slugs`.
+ *
+ * `published` is what the live site currently holds. `null`/`undefined` means
+ * the caller could not find out, which is a refusal rather than an empty site
+ * — see the note at the top of this file.
+ */
+export function selectPagesForPublish(opts) {
+    const { draft, published, draftSiteConfig, publishedSiteConfig, selection } = opts;
+    const slugs = selection.slugs;
+    // No subset asked for: the full draft, unchanged, exactly as before.
+    if (!slugs) {
+        return { pages: [...draft], siteConfig: draftSiteConfig, selectedSlugs: draft.map((p) => p.slug), removedSlugs: [] };
+    }
+    if (!published) {
+        return {
+            error: "Cannot publish selected pages without knowing what is currently live. " +
+                "Publish everything, or retry once the published site is reachable."
+        };
+    }
+    const draftBySlug = new Map(draft.map((page) => [page.slug, page]));
+    const publishedBySlug = new Map(published.map((page) => [page.slug, page]));
+    const unknown = slugs.filter((slug) => !draftBySlug.has(slug) && !publishedBySlug.has(slug));
+    if (unknown.length > 0) {
+        return { error: `Unknown page${unknown.length === 1 ? "" : "s"}: ${unknown.join(", ")}` };
+    }
+    const selected = new Set(slugs);
+    const pages = [];
+    const removedSlugs = [];
+    /*
+     * Live pages first, in the order the live site has them, so an unselected
+     * page keeps its position as well as its content. A selected page that the
+     * draft no longer has is a deletion the user ticked: drop it here and record
+     * it, so the summary can say a page came down rather than silently omitting
+     * it.
+     */
+    for (const page of published) {
+        if (!selected.has(page.slug)) {
+            pages.push(page);
+            continue;
+        }
+        const draftPage = draftBySlug.get(page.slug);
+        if (draftPage)
+            pages.push(draftPage);
+        else
+            removedSlugs.push(page.slug);
+    }
+    // Selected pages the live site does not have yet, in draft order.
+    for (const page of draft) {
+        if (!selected.has(page.slug))
+            continue;
+        if (publishedBySlug.has(page.slug))
+            continue;
+        pages.push(page);
+    }
+    /*
+     * Leaving the header out has to mean shipping the header that is live, not
+     * shipping nothing: the targets take a config, and an absent one reads as
+     * "clear the site chrome". When the published config is unknown the draft's
+     * is the only one there is — the same value a full publish would send.
+     */
+    const siteConfig = selection.includeSiteConfig === false ? publishedSiteConfig ?? draftSiteConfig : draftSiteConfig;
+    return { pages, siteConfig, selectedSlugs: [...slugs], removedSlugs };
+}

package/dist/publish/targets/git.js

@@ -10,8 +10,8 @@ import { publishViaGit } from "../publish-helpers.js";
 export class GitPublishTarget {
     name = "git";
     async publish(ctx) {
-        const { session, scopedSession, slugs } = ctx;
-        const result = await publishViaGit(scopedSession);
+        const { session, scopedSession, slugs, pages, siteConfig } = ctx;
+        const result = await publishViaGit(scopedSession, { pages, siteConfig });
         const now = new Date().toISOString();
         const tracker = {
             session,

package/dist/state/data-dir.d.ts

@@ -0,0 +1,6 @@
+export declare function isLegacyMonorepoLayout(cwd?: string): boolean;
+/**
+ * The `.data` directory for this process, or the legacy monorepo one when this
+ * really is a package inside the monorepo and that directory already exists.
+ */
+export declare function resolveDataDir(cwd?: string): string;

package/dist/state/data-dir.js

@@ -0,0 +1,35 @@
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+/*
+ * Where this process keeps its own files: the database, generated images, the
+ * agent log.
+ *
+ * The answer is `<cwd>/.data`. It used to be `<cwd>/../../.data`, which is
+ * `apps/orchestrator`'s position in *this* repo and nobody else's — a
+ * library-mode host runs from its own project root, so it wrote two directories
+ * above itself, outside the project and outside version control, into a
+ * directory shared with every sibling checkout that made the same mistake.
+ *
+ * The legacy location is still honoured for an existing monorepo checkout, but
+ * only on proof of workspace membership. The first version of that back-compat
+ * check asked `existsSync(legacy)` alone — "has anyone ever created that file",
+ * not "am I a package in the workspace that owns it" — so one mistaken write
+ * captured every unrelated project under that parent, permanently, because the
+ * bug is what created the file that re-triggered it.
+ */
+export function isLegacyMonorepoLayout(cwd = process.cwd()) {
+    return (existsSync(resolve(cwd, "../../pnpm-workspace.yaml")) &&
+        existsSync(resolve(cwd, "package.json")));
+}
+/**
+ * The `.data` directory for this process, or the legacy monorepo one when this
+ * really is a package inside the monorepo and that directory already exists.
+ */
+export function resolveDataDir(cwd = process.cwd()) {
+    if (isLegacyMonorepoLayout(cwd)) {
+        const legacy = resolve(cwd, "../../.data");
+        if (existsSync(legacy))
+            return legacy;
+    }
+    return resolve(cwd, ".data");
+}

package/dist/state/site-assets.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The documents this site holds, for the parts of the process that cannot ask.
+ *
+ * The list comes from `CmsAdapter.getMedia`, and getting it is IO. Two very
+ * different consumers need it and neither has an adapter in scope:
+ *
+ *   - `content.file-link-unknown`, which turns a hand-typed PDF path into
+ *     something verifiable, and which is a pure function by construction;
+ *   - the planner's site context, so "link the winter menu" can resolve to a
+ *     path that exists instead of a plausible-looking invention.
+ *
+ * So it is registered once per process, which is what an adapter already is:
+ * `createOrchestrator` sets it when the host implements `getMedia`, and the
+ * standalone multi-site orchestrator — which wires no adapter — never does.
+ *
+ * Unregistered answers `undefined`, and that is load-bearing everywhere it is
+ * read. `undefined` is "this site cannot list its documents", under which no
+ * rule may call a link broken; `[]` is "it listed them and has none", under
+ * which every document link really is broken. Collapsing the two would report
+ * every document on every site without a media library as missing.
+ */
+export type SiteAssetRecord = {
+    path: string;
+    name?: string;
+    contentType?: string;
+    size?: number;
+};
+type AssetLister = () => Promise<SiteAssetRecord[]>;
+/** Registered by `createOrchestrator` when the site's adapter can list files. */
+export declare function setSiteAssetLister(lister: AssetLister | null): void;
+/** Drop the cache — called after an upload, so a new file is visible at once. */
+export declare function invalidateSiteAssets(): void;
+/**
+ * The site's documents, or `undefined` if it cannot say.
+ *
+ * A lister that throws also answers `undefined`: a media library that is *down*
+ * must not read as a media library that is *empty*, or one outage becomes a
+ * finding on every document link on the site.
+ */
+export declare function getSiteAssets(now?: () => number): Promise<SiteAssetRecord[] | undefined>;
+export {};

package/dist/state/site-assets.js

@@ -0,0 +1,40 @@
+let listSiteAssets = null;
+/** Registered by `createOrchestrator` when the site's adapter can list files. */
+export function setSiteAssetLister(lister) {
+    listSiteAssets = lister;
+    cache = null;
+}
+/*
+ * A publish fans out one check run and an apply debounces into another, and a
+ * chat turn asks as well; going to the CMS three times in ten seconds is waste
+ * the site pays for. Short enough that a document uploaded mid-session is
+ * picked up almost immediately — and an upload clears it outright, so the file
+ * somebody just added is linkable in the same breath.
+ */
+const CACHE_MS = 30_000;
+let cache = null;
+/** Drop the cache — called after an upload, so a new file is visible at once. */
+export function invalidateSiteAssets() {
+    cache = null;
+}
+/**
+ * The site's documents, or `undefined` if it cannot say.
+ *
+ * A lister that throws also answers `undefined`: a media library that is *down*
+ * must not read as a media library that is *empty*, or one outage becomes a
+ * finding on every document link on the site.
+ */
+export async function getSiteAssets(now = Date.now) {
+    if (!listSiteAssets)
+        return undefined;
+    if (cache && now() - cache.at < CACHE_MS)
+        return cache.assets;
+    try {
+        const assets = await listSiteAssets();
+        cache = { at: now(), assets };
+        return assets;
+    }
+    catch {
+        return undefined;
+    }
+}