@foldrun/core 1.4.1 → 2.0.0

package/dist/index.d.ts

@@ -24,7 +24,6 @@ export * from "./src/tool-names.ts";
 export * from "./src/history.ts";
 export * from "./src/zip.ts";
 export * from "./src/package.ts";
-export * from "./src/gitrepo.ts";
 export * from "./src/storage.ts";
 export * from "./src/secrets.ts";
 export * from "./src/oauth-presets.ts";
@@ -35,5 +34,3 @@ export * from "./src/approvals.ts";
 export * from "./src/deploy.ts";
 export * from "./src/agent-import.ts";
 export * from "./src/account.ts";
-export * from "./src/tar.ts";
-export * from "./src/git.ts";

package/dist/index.js

@@ -35,7 +35,6 @@ export * from "./src/tool-names.js";
 export * from "./src/history.js";
 export * from "./src/zip.js";
 export * from "./src/package.js";
-export * from "./src/gitrepo.js";
 export * from "./src/storage.js";
 export * from "./src/secrets.js";
 export * from "./src/oauth-presets.js";
@@ -46,5 +45,3 @@ export * from "./src/approvals.js";
 export * from "./src/deploy.js";
 export * from "./src/agent-import.js";
 export * from "./src/account.js";
-export * from "./src/tar.js";
-export * from "./src/git.js";

package/dist/src/deploy.d.ts

@@ -124,32 +124,6 @@ export interface DeployOptions {
  * webhook or a CLI that needs to report *why*, and every reason is already in
  * the plan.
  */
-/** What a push recorded about itself, where the Repository page reads it. */
-export interface PushNote {
-    commit: string;
-    at: string;
-    applied: boolean;
-    issues?: unknown[];
-    blockedBy?: string[];
-    /** Set when a blocked push was applied later, by the retry. */
-    appliedAt?: string;
-}
-export declare const pushNotePath: (tenant: string, workspace: string) => string;
-export declare function readPushNote(tenant: string, workspace: string): PushNote | null;
-export declare function writePushNote(tenant: string, workspace: string, note: PushNote): void;
-/**
- * A push whose deploy was refused only because a run was in flight is not a
- * failure — it is a deploy that has not happened yet. Git already said the
- * push succeeded (the deploy happens after the client is gone), so nothing
- * would ever tell anyone the workspace on disk is behind `main`. This applies
- * it once the runs are done.
- *
- * Only `blockedBy`: a push refused for `issues` is a broken workspace and
- * wants a person, not a retry.
- */
-export declare function applyPendingPush(tenant: string, workspace: string, filesAt: (tenant: string, scope: string, ref: string) => DeployFile[]): {
-    commit: string;
-} | null;
 export declare function deployWorkspace(tenant: string, workspace: string, files: DeployFile[], opts?: DeployOptions): DeployResult;
 export declare function writeDeployedCommit(tenant: string, workspace: string, commit: string): void;
 export declare function deployedCommit(tenant: string, workspace: string): {

package/dist/src/deploy.js

@@ -20,7 +20,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { saveWorkspace, keptOnDeploy, workspaceDir, listRuns, parseFlow, parseToolDef, WORKSPACE_DIRS, assertSafeName, notifyWorkspaceChanged, } from "./store.js";
+import { saveWorkspace, keptOnDeploy, workspaceDir, listRunSummaries, parseFlow, parseToolDef, WORKSPACE_DIRS, assertSafeName, } from "./store.js";
 import { lintFlow } from "./flow-lint.js";
 import { refNames } from "./refs.js";
 import matter from "gray-matter";
@@ -32,11 +32,12 @@ import { networkProblems } from "./network.js";
 import { actionProblems } from "./web-actions.js";
 import { languageProblem } from "./language.js";
 import { localeProblems } from "./locale.js";
-import { repoDir } from "./gitrepo.js";
 import { entriesNoFollow } from "./paths.js";
 import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles } from "./scan.js";
 /** Directories a deploy never reads out of a source tree. */
-const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results"]);
+// `.cache` is what a run's tools leave in an agent's folder (HOME is that
+// folder): logs and font caches, never authored.
+const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results", ".cache"]);
 /** Files that are never part of a workspace, whatever directory they sit in. */
 const NOT_SOURCE_FILE = new Set([".DS_Store", "secrets.json"]);
 const IN_WORKSPACE_DIR = new RegExp(`^(${WORKSPACE_DIRS.join("|")})/`);
@@ -432,7 +433,7 @@ export function deployIssues(files) {
 export function runsInFlight(tenant, workspace) {
     if (!fs.existsSync(workspaceDir(tenant, workspace)))
         return [];
-    return listRuns(tenant, workspace)
+    return listRunSummaries(tenant, workspace)
         .filter((r) => r.status === "queued" || r.status === "running" || r.status === "awaiting-approval")
         .map((r) => r.id);
 }
@@ -490,58 +491,14 @@ export function planDeploy(tenant, workspace, files) {
         blockedBy: runsInFlight(tenant, workspace),
     };
 }
-export const pushNotePath = (tenant, workspace) => path.join(repoDir(tenant, workspace), "foldrun-last-push.json");
-export function readPushNote(tenant, workspace) {
-    try {
-        return JSON.parse(fs.readFileSync(pushNotePath(tenant, workspace), "utf8"));
-    }
-    catch {
-        return null;
-    }
-}
-export function writePushNote(tenant, workspace, note) {
-    try {
-        fs.writeFileSync(pushNotePath(tenant, workspace), JSON.stringify(note));
-    }
-    catch {
-        // The note is a record, not the deploy. Losing it must not fail a push.
-    }
-    // A push waiting on a run is the scheduler's to apply; tell it there is one.
-    notifyWorkspaceChanged(tenant, workspace, "push");
-}
 /**
- * A push whose deploy was refused only because a run was in flight is not a
- * failure — it is a deploy that has not happened yet. Git already said the
- * push succeeded (the deploy happens after the client is gone), so nothing
- * would ever tell anyone the workspace on disk is behind `main`. This applies
- * it once the runs are done.
+ * Deploy a file list to a workspace, if it checks out.
  *
- * Only `blockedBy`: a push refused for `issues` is a broken workspace and
- * wants a person, not a retry.
+ * Returns the plan either way, with `applied` saying whether anything changed.
+ * A refused deploy is a normal outcome, not an exception: the caller is a
+ * webhook or a CLI that needs to report *why*, and every reason is already in
+ * the plan.
  */
-export function applyPendingPush(tenant, workspace, filesAt) {
-    const note = readPushNote(tenant, workspace);
-    if (!note || note.applied)
-        return null;
-    if (!note.blockedBy?.length || (note.issues?.length ?? 0) > 0)
-        return null;
-    if (runsInFlight(tenant, workspace).length > 0)
-        return null;
-    // Only the commit the note names, and only while it is still what main
-    // points at — a newer push supersedes it and wrote its own note.
-    const result = deployWorkspace(tenant, workspace, filesAt(tenant, workspace, note.commit), {
-        commit: note.commit,
-        force: false,
-    });
-    writePushNote(tenant, workspace, {
-        ...note,
-        applied: result.applied,
-        issues: result.issues ?? [],
-        blockedBy: result.blockedBy ?? [],
-        ...(result.applied ? { appliedAt: new Date().toISOString() } : {}),
-    });
-    return result.applied ? { commit: note.commit } : null;
-}
 export function deployWorkspace(tenant, workspace, files, opts = {}) {
     assertSafeName(tenant, "tenant");
     assertSafeName(workspace, "workspace");

package/dist/src/history.d.ts

@@ -9,11 +9,6 @@
  */
 type TreeReader = (tenant: string, scope: string) => RevisionFile[] | null;
 export declare function registerTreeReader(fn: TreeReader): void;
-/** Something to do after a commit lands on main — the mirror push. Registered
- *  by mirror.ts; this module cannot import it (secrets, settings). */
-type AfterCommit = (tenant: string, scope: string, sha: string) => void;
-export declare function registerAfterCommit(fn: AfterCommit): void;
-export declare function notifyCommit(tenant: string, scope: string, sha: string): void;
 export interface RevisionFile {
     path: string;
     /** Null when the file did not exist before. */
@@ -55,17 +50,42 @@ export declare function recordRevision(tenant: string, scope: string, files: Rev
     id?: string;
     commit?: string | null;
 }): Revision | null;
+/** Whether a revision can be restored to: it has a snapshot. */
+export declare function hasSnapshot(tenant: string, scope: string, id: string): boolean;
+/** The whole tree at revision `id`, or null when it has no snapshot. */
+export declare function snapshotAt(tenant: string, scope: string, id: string): {
+    path: string;
+    content: string;
+}[] | null;
+/** The newest revision that can be restored to — what "now" is in history. */
+export declare function headRevision(tenant: string, scope: string): RevisionSummary | null;
+/**
+ * A scope with no snapshot yet gets one: its tree as it stands, recorded as
+ * a revision of its own — where its history starts. Every workspace that
+ * existed when history moved off git starts here, and so does one created
+ * by a path that never recorded a change. Returns the head's id, or null
+ * when there is nothing to snapshot.
+ */
+export declare function ensureBaseline(tenant: string, scope: string, by?: string): string | null;
+/**
+ * The revision a restore means: an id (or the commit a deploy recorded), a
+ * date (`2026-10-17`, `2026-10-17T09:00Z`) or a span back from now (`90m`,
+ * `12h`, `3d`, `2w`) — the newest revision with a snapshot at or before that
+ * moment. Null when history holds nothing that old. Throws (status 400) on
+ * something that is none of those.
+ */
+export declare function resolveRevision(tenant: string, scope: string, to: string, now?: number): {
+    id: string;
+    at: string;
+    by: string;
+    message: string;
+} | null;
 /** Newest first. `forPath` narrows to revisions that touched one file. */
 export declare function listRevisions(tenant: string, scope: string, opts?: {
     forPath?: string;
     limit?: number;
 }): RevisionSummary[];
 export declare function readRevision(tenant: string, scope: string, id: string, forPath?: string): Revision | null;
-/**
- * Make sure a scope's repository has its initial import, so a clone made
- * right now is complete. A no-op once any commit exists.
- */
-export declare function ensureImported(tenant: string, scope: string): string | null;
 /** The most recent revision id for a scope — what a change is attributed
  *  to when nothing more specific (a deployed commit) is on record. */
 export declare function latestRevisionId(tenant: string, scope: string): string | null;

package/dist/src/history.js

@@ -15,45 +15,33 @@
 // git repository — and when one is connected later, its commits slot into
 // the same series.
 //
-// No git binary, no working copy, no repository on the server. The platform
-// image deliberately has none (deploy.ts explains why); this is a journal of
-// content, which is all the questions above need. Connecting a repository
-// is a separate step and pushes THIS history out, not the other way round.
+// No git. This is a journal of content plus a snapshot of the whole tree at
+// every revision — the platform's own deploy history, the way Vercel and
+// Cloudflare keep theirs: rollback and restore point back to a snapshot and
+// never need a repository. A customer's code history belongs in their own
+// GitHub or GitLab, connected later, and is a separate thing. (Until 17 Oct
+// 2026 this preferred a bare git repository per workspace whenever a git
+// binary existed; that git is gone, and history started fresh from a
+// baseline snapshot.)
 //
-// Storage: <data>/<tenant>/.history/<scope>/<id>.json, one file per revision,
-// plus index.jsonl — one line each, newest last — so listing does not open
-// every revision. Content is stored inline: the files are small, and a
-// content-addressed store would be machinery in search of a problem.
+// Storage, under <data>/<tenant>/.history/<scope>/:
+//   <id>.json      one revision: what changed, from what, to what (inline,
+//                  clipped at 256 KB — what the history page diffs)
+//   index.jsonl    one line per revision, newest last, so listing opens none
+//   trees/<id>.json  the whole tree right after it: { path: sha256 }
+//   blobs/<aa>/<sha256>  each version of a file, once — content-addressed,
+//                  because a snapshot per save is mostly files that did not
+//                  change, and storing them again would be the whole tree
+//                  per save.
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 import { dataRoot } from "./paths.js";
-import { commitChanges, gitAvailable, headSha, listCommits, readCommit, repoExists, } from "./gitrepo.js";
 let readTree = () => null;
 export function registerTreeReader(fn) {
     const prev = readTree;
     readTree = (tenant, scope) => fn(tenant, scope) ?? prev(tenant, scope);
 }
-const afterCommit = [];
-export function registerAfterCommit(fn) {
-    afterCommit.push(fn);
-}
-export function notifyCommit(tenant, scope, sha) {
-    for (const fn of afterCommit) {
-        try {
-            fn(tenant, scope, sha);
-        }
-        catch {
-            // a mirror that fails must not fail the save that triggered it
-        }
-    }
-}
-/** Journal or git? Git whenever the binary exists; the journal is the
- *  fallback for an install without one. An install that started on the
- *  journal keeps it readable — both are consulted on read. */
-const useGit = () => process.env.FOLDRUN_HISTORY !== "journal" && gitAvailable();
-// Not store's assertSafeName: store imports this module, and a cycle between
-// the two is avoidable for one regex.
 function assertSafeName(v, what) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._@-]{0,120}$/.test(v))
         throw new Error(`illegal ${what}: ${v}`);
@@ -82,37 +70,6 @@ export function recordRevision(tenant, scope, files, meta = {}) {
     const changed = files.filter((f) => f.before !== f.after);
     if (changed.length === 0)
         return null;
-    if (useGit()) {
-        // First commit ever for this scope: import the whole tree as it stands
-        // now (the writer has already written), so the repository is complete
-        // from its first commit rather than starting with one file.
-        const first = !headSha(tenant, scope);
-        // Generated bundle files (knowledge/index.md, memory/log.md) are rewritten
-        // by the same save that changed a concept, outside this call. Commit them
-        // as they now stand, or a clone's index disagrees with its own files —
-        // the exact drift the template tests exist to catch.
-        const generated = first
-            ? []
-            : (readTree(tenant, scope) ?? []).filter((f) => /(^|\/)(knowledge|memory)\/(.*\/)?(index|log)\.md$/.test(f.path));
-        const toCommit = first ? (readTree(tenant, scope) ?? changed) : [...changed, ...generated];
-        const sha = commitChanges(tenant, scope, toCommit, {
-            by: meta.by,
-            // Named after what the caller changed, not the generated files that
-            // rode along — "edited knowledge/style.md", not "changed 3 files".
-            message: first ? `initial import${meta.message ? ` — ${meta.message}` : ""}` : (meta.message ?? describe(changed)),
-        });
-        if (!sha)
-            return null;
-        notifyCommit(tenant, scope, sha);
-        return {
-            id: meta.commit ?? sha,
-            at: new Date().toISOString(),
-            by: meta.by ?? "system",
-            message: meta.message ?? describe(changed),
-            commit: sha,
-            files: changed,
-        };
-    }
     const dir = historyDir(tenant, scope);
     fs.mkdirSync(dir, { recursive: true });
     const rev = {
@@ -137,9 +94,168 @@ export function recordRevision(tenant, scope, files, meta = {}) {
         commit: rev.commit,
         paths: rev.files.map((f) => f.path),
     };
+    // The tree as it stands now (the writer has already written), so this
+    // revision can be restored to exactly — including files a save rewrote
+    // outside this call, such as a bundle's generated index.
+    snapshot(tenant, scope, rev.id);
     fs.appendFileSync(path.join(dir, "index.jsonl"), `${JSON.stringify(line)}\n`);
     return rev;
 }
+// ----------------------------------------------------------------- snapshots
+const sha256 = (s) => crypto.createHash("sha256").update(s).digest("hex");
+const treePath = (tenant, scope, id) => path.join(historyDir(tenant, scope), "trees", `${id}.json`);
+const blobPath = (tenant, scope, sha) => path.join(historyDir(tenant, scope), "blobs", sha.slice(0, 2), sha);
+/** Write the scope's whole tree as revision `id`'s snapshot. False when there
+ *  is no tree to read (a workspace being deleted).
+ *
+ *  What a snapshot is: the tree as it stood just after this revision was
+ *  written — point in time, which is what a restore wants. A revision's
+ *  diff names only its own change; its snapshot is everything on disk at
+ *  that moment, including another writer's change that landed in between,
+ *  part of one if it was mid-write (saves are not transactional across
+ *  files, and never were). Reviewed with Codex, 17 Oct 2026. */
+function snapshot(tenant, scope, id) {
+    const tree = readTree(tenant, scope);
+    if (!tree)
+        return false;
+    const files = {};
+    for (const f of tree) {
+        if (f.after === null)
+            continue;
+        const sha = sha256(f.after);
+        const blob = blobPath(tenant, scope, sha);
+        if (!fs.existsSync(blob)) {
+            fs.mkdirSync(path.dirname(blob), { recursive: true });
+            const tmp = `${blob}.${process.pid}.tmp`;
+            fs.writeFileSync(tmp, f.after);
+            fs.renameSync(tmp, blob);
+        }
+        files[f.path] = sha;
+    }
+    const file = treePath(tenant, scope, id);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify({ v: 1, files }));
+    fs.renameSync(tmp, file);
+    return true;
+}
+/** Whether a revision can be restored to: it has a snapshot. */
+export function hasSnapshot(tenant, scope, id) {
+    assertSafeName(id, "revision id");
+    return fs.existsSync(treePath(tenant, scope, id));
+}
+/** The whole tree at revision `id`, or null when it has no snapshot. */
+export function snapshotAt(tenant, scope, id) {
+    assertSafeName(id, "revision id");
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(treePath(tenant, scope, id), "utf8"));
+    }
+    catch {
+        return null;
+    }
+    return Object.entries(manifest.files ?? {})
+        .map(([p, sha]) => ({ path: p, content: fs.readFileSync(blobPath(tenant, scope, sha), "utf8") }))
+        .sort((a, b) => a.path.localeCompare(b.path));
+}
+/** Every revision of the scope that has a snapshot — one listing, rather
+ *  than a stat per revision. */
+function snapshotIds(tenant, scope) {
+    try {
+        return new Set(fs.readdirSync(path.join(historyDir(tenant, scope), "trees")).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5)));
+    }
+    catch {
+        return new Set();
+    }
+}
+/** The newest revision that can be restored to — what "now" is in history. */
+export function headRevision(tenant, scope) {
+    const have = snapshotIds(tenant, scope);
+    return journalRevisions(tenant, scope, { limit: Infinity }).find((r) => have.has(r.id)) ?? null;
+}
+/**
+ * A scope with no snapshot yet gets one: its tree as it stands, recorded as
+ * a revision of its own — where its history starts. Every workspace that
+ * existed when history moved off git starts here, and so does one created
+ * by a path that never recorded a change. Returns the head's id, or null
+ * when there is nothing to snapshot.
+ */
+export function ensureBaseline(tenant, scope, by = "foldrun") {
+    const head = headRevision(tenant, scope);
+    if (head)
+        return head.id;
+    const tree = readTree(tenant, scope);
+    if (!tree || tree.length === 0)
+        return null;
+    const dir = historyDir(tenant, scope);
+    fs.mkdirSync(dir, { recursive: true });
+    const id = newRevisionId();
+    // One baseline even when the web tier and the worker both find none at
+    // once: whoever creates the marker first writes it, the other reads it.
+    const marker = path.join(dir, ".baseline");
+    try {
+        fs.writeFileSync(marker, id, { flag: "wx" });
+    }
+    catch {
+        const held = headRevision(tenant, scope)?.id ?? null;
+        // A marker with no baseline behind it, minutes old, is a process that
+        // died writing one: clear it, and the next call writes the baseline.
+        try {
+            if (!held && Date.now() - fs.statSync(marker).mtimeMs > 5 * 60_000)
+                fs.rmSync(marker, { force: true });
+        }
+        catch {
+            // gone already
+        }
+        return held;
+    }
+    const rev = {
+        id,
+        at: new Date().toISOString(),
+        by,
+        message: "history starts here",
+        commit: null,
+        files: [],
+    };
+    fs.writeFileSync(path.join(dir, `${rev.id}.json`), JSON.stringify(rev));
+    if (!snapshot(tenant, scope, rev.id))
+        return null;
+    const line = { id: rev.id, at: rev.at, by: rev.by, message: rev.message, commit: null, paths: [] };
+    fs.appendFileSync(path.join(dir, "index.jsonl"), `${JSON.stringify(line)}\n`);
+    return rev.id;
+}
+/**
+ * The revision a restore means: an id (or the commit a deploy recorded), a
+ * date (`2026-10-17`, `2026-10-17T09:00Z`) or a span back from now (`90m`,
+ * `12h`, `3d`, `2w`) — the newest revision with a snapshot at or before that
+ * moment. Null when history holds nothing that old. Throws (status 400) on
+ * something that is none of those.
+ */
+export function resolveRevision(tenant, scope, to, now = Date.now()) {
+    const t = to.trim();
+    if (!t || t.startsWith("-"))
+        throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
+    const have = snapshotIds(tenant, scope);
+    const all = journalRevisions(tenant, scope, { limit: Infinity }).filter((r) => have.has(r.id));
+    const rel = /^(\d+)\s*(m|h|d|w)$/.exec(t);
+    const moment = rel
+        ? now - Number(rel[1]) * { m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000 }[rel[2]]
+        : /^\d{4}-\d{2}-\d{2}/.test(t)
+            ? Date.parse(t)
+            : null;
+    let hit;
+    if (moment !== null) {
+        if (Number.isNaN(moment))
+            throw Object.assign(new Error(`not a date: ${to}`), { status: 400 });
+        hit = all.find((r) => Date.parse(r.at) <= moment);
+    }
+    else {
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,120}$/.test(t))
+            throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
+        hit = all.find((r) => r.id === t || r.commit === t || (t.length >= 7 && r.commit?.startsWith(t)));
+    }
+    return hit ? { id: hit.id, at: hit.at, by: hit.by, message: hit.message } : null;
+}
 const clip = (s) => s === null ? null : s.length > MAX_INLINE ? `[${s.length} bytes — too large to keep inline]` : s;
 /** "edited tools/x/run.py", "created 3 files", "deleted flows/old.md". */
 function describe(files) {
@@ -157,59 +273,76 @@ function describe(files) {
 }
 /** Newest first. `forPath` narrows to revisions that touched one file. */
 export function listRevisions(tenant, scope, opts = {}) {
-    if (useGit() && repoExists(tenant, scope)) {
-        const fromGit = listCommits(tenant, scope, opts);
-        // Anything the journal holds from before the repository existed comes
-        // after git's rows: older, and still worth showing.
-        return [...fromGit, ...journalRevisions(tenant, scope, opts)].slice(0, opts.limit ?? 200);
-    }
     return journalRevisions(tenant, scope, opts);
 }
 function journalRevisions(tenant, scope, opts = {}) {
-    const file = path.join(historyDir(tenant, scope), "index.jsonl");
-    if (!fs.existsSync(file))
+    const dir = historyDir(tenant, scope);
+    const file = path.join(dir, "index.jsonl");
+    if (!fs.existsSync(dir))
         return [];
-    const all = fs
-        .readFileSync(file, "utf8")
-        .split("\n")
-        .filter(Boolean)
-        .flatMap((l) => {
+    let all = fs.existsSync(file)
+        ? fs
+            .readFileSync(file, "utf8")
+            .split("\n")
+            .filter(Boolean)
+            .flatMap((l) => {
+            try {
+                return [JSON.parse(l)];
+            }
+            catch {
+                return []; // a torn line — the rebuild below brings it back
+            }
+        })
+            .reverse()
+        : [];
+    // The revision files are the record; index.jsonl is a cache of them. An
+    // append from two processes on NFS is not atomic across clients, and a
+    // process can die between a revision's file and its line — so when the
+    // two disagree, the index is rebuilt from the files.
+    const recorded = fs.readdirSync(dir).filter((f) => f.endsWith(".json")).length;
+    if (recorded !== new Set(all.map((r) => r.id)).size)
+        all = rebuildIndex(dir);
+    // A line appended just after a rebuild wrote it too: once each.
+    const seen = new Set();
+    all = all.filter((r) => !seen.has(r.id) && seen.add(r.id));
+    const narrowed = opts.forPath ? all.filter((r) => r.paths.includes(opts.forPath)) : all;
+    return narrowed.slice(0, opts.limit ?? 200);
+}
+/** index.jsonl again, from the revision files themselves, newest first. */
+function rebuildIndex(dir) {
+    const rows = [];
+    for (const f of fs.readdirSync(dir)) {
+        if (!f.endsWith(".json"))
+            continue;
         try {
-            return [JSON.parse(l)];
+            const file = path.join(dir, f);
+            const rev = JSON.parse(fs.readFileSync(file, "utf8"));
+            rows.push({ id: rev.id, at: rev.at, by: rev.by, message: rev.message, commit: rev.commit, paths: rev.files.map((x) => x.path), written: fs.statSync(file).mtimeMs });
         }
         catch {
-            return []; // a torn line from a crash mid-append loses one entry, not the file
+            // a revision half-written by a process that died: not one
         }
-    })
-        .reverse();
-    const narrowed = opts.forPath ? all.filter((r) => r.paths.includes(opts.forPath)) : all;
-    return narrowed.slice(0, opts.limit ?? 200);
+    }
+    // Two saves in one millisecond share an `at`; the order they were written
+    // in breaks the tie (an id's suffix is random, so it cannot).
+    rows.sort((a, b) => a.at.localeCompare(b.at) || a.written - b.written || a.id.localeCompare(b.id));
+    try {
+        const tmp = path.join(dir, `index.jsonl.${process.pid}.tmp`);
+        fs.writeFileSync(tmp, rows.map(({ written: _w, ...r }) => JSON.stringify(r) + "\n").join(""));
+        fs.renameSync(tmp, path.join(dir, "index.jsonl"));
+    }
+    catch {
+        // a read-only volume still gets the answer
+    }
+    return rows.map(({ written: _w, ...r }) => r).reverse();
 }
 export function readRevision(tenant, scope, id, forPath) {
     assertSafeName(id, "revision id");
-    if (useGit() && repoExists(tenant, scope) && /^[0-9a-f]{7,40}$/.test(id)) {
-        const fromGit = readCommit(tenant, scope, id, forPath);
-        if (fromGit)
-            return fromGit;
-    }
     const file = path.join(historyDir(tenant, scope), `${id}.json`);
     if (!fs.existsSync(file))
         return null;
-    return JSON.parse(fs.readFileSync(file, "utf8"));
-}
-/**
- * Make sure a scope's repository has its initial import, so a clone made
- * right now is complete. A no-op once any commit exists.
- */
-export function ensureImported(tenant, scope) {
-    if (!useGit())
-        return null;
-    if (headSha(tenant, scope))
-        return headSha(tenant, scope);
-    const tree = readTree(tenant, scope);
-    if (!tree || tree.length === 0)
-        return null;
-    return commitChanges(tenant, scope, tree, { by: "foldrun", message: "initial import" });
+    const rev = JSON.parse(fs.readFileSync(file, "utf8"));
+    return forPath ? { ...rev, files: rev.files.filter((f) => f.path === forPath) } : rev;
 }
 /** The most recent revision id for a scope — what a change is attributed
  *  to when nothing more specific (a deployed commit) is on record. */

package/dist/src/library.d.ts

@@ -88,16 +88,3 @@ export interface LibraryUse {
     relation: "use" | "shadowed";
 }
 export declare function libraryUsage(tenant: string, kind: LibraryKind, name: string): LibraryUse[];
-/**
- * Make the shelf match a tree — what a push to the library repository does.
- * Written with plain fs and recorded as ONE revision at the end: going
- * through writeLibraryFile per file would commit each one on top of the
- * pushed commit, and the history would show a push as fifty edits.
- */
-export declare function syncLibraryFromTree(tenant: string, files: {
-    path: string;
-    content: string;
-}[], meta?: {
-    by?: string;
-    commit?: string | null;
-}): number;