uniweb 1.21.6 → 1.21.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "1.21.6",
+  "version": "1.21.8",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.3.2",
     "prompts": "^2.4.2",
     "tar": "^7.5.21",
-    "@uniweb/core": "~1.4.8",
-    "@uniweb/schemas": "~1.6.5",
+    "@uniweb/content-writer": "~1.3.1",
+    "@uniweb/core": "~1.4.9",
     "@uniweb/semantic-parser": "~1.13.0",
-    "@uniweb/content-writer": "~1.3.1"
+    "@uniweb/schemas": "~1.6.5"
   },
   "peerDependencies": {
-    "@uniweb/build": "~1.10.6",
-    "@uniweb/semantic-parser": "~1.13.0",
-    "@uniweb/content-reader": "~1.5.7"
+    "@uniweb/build": "~1.10.7",
+    "@uniweb/content-reader": "~1.5.7",
+    "@uniweb/semantic-parser": "~1.13.0"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/partials/agents.md

@@ -2862,7 +2862,7 @@ uniweb <command> --help           # Per-command flags — no side effects. Prefe
 | Any static host at all | `uniweb export` | full control; no Uniweb account needed |
 | Uniweb Cloud | `uniweb publish` | teams with non-technical content authors, or client work |
 
-`uniweb deploy` never assumes a host: with nothing configured it opens a picker listing only destinations it can act on, and records the choice in `deploy.yml` so later runs go straight there. On Cloudflare Pages / Netlify / Vercel, `add ci` also adds per-PR previews that comment the URL. GitHub runs workflows only from the top of the repository: in a project that is a folder of a larger repository, the project's own `.github/` never runs, and `uniweb status` says so — as it says when a target in `deploy.yml` was never deployed from this copy. Adapters: `github-pages`, `cloudflare-pages`, `netlify`, `vercel`, plus `s3-cloudfront` for `deploy`. That record is `deploy.yml`, beside `site.yml` — **the CLI writes it, you don't create it**: the first successful deploy scaffolds the whole file, and later deploys rewrite only its `deploys:` block. Edit `targets:` when you want to change where a site ships. Host credentials come from the environment, never from that committed file.
+`uniweb deploy` never assumes a host: with nothing configured it opens a picker listing only destinations it can act on, and records the choice in `deploy.yml` so later runs go straight there. On Cloudflare Pages / Netlify / Vercel, `add ci` also adds per-PR previews that comment the URL. GitHub runs workflows only from the top of the repository: in a project that is a folder of a larger repository, the project's own `.github/` never runs — `uniweb status` says so, and `uniweb add ci` refuses to write one there — as it says when a target in `deploy.yml` was never deployed from this copy. Adapters: `github-pages`, `cloudflare-pages`, `netlify`, `vercel`, plus `s3-cloudfront` for `deploy`. That record is `deploy.yml`, beside `site.yml` — **the CLI writes it, you don't create it**: the first successful deploy scaffolds the whole file, and later deploys rewrite only its `deploys:` block. Edit `targets:` when you want to change where a site ships. Host credentials come from the environment, never from that committed file.
 
 Foundations have their own free path too: `uniweb add ci --target foundation` publishes to permanent versioned URLs on GitHub Pages.
 
@@ -2916,6 +2916,8 @@ A site can be in more than one place — usually while it moves from one host to
 
 **Nobody's work is overwritten without asking.** `uniweb push` is refused if the site changed on the backend since your last pull — usually an author editing in the app — and reports what changed; nothing is written. Edits to different sections never collide. **In a git repository `uniweb pull` merges, like `git pull`:** it commits the backend's content (*"The site's content on …"*) and merges that commit into your branch, against the last state of the site your history shares with the backend. Your work, committed or not, and a teammate's arriving through git are kept; a file the backend never had is never deleted; changes to different parts of a file combine silently; and only a genuine overlap leaves conflict markers and a non-zero exit — so `uniweb pull && uniweb push` never ships markers. Settle a conflict as in any merge, then `git commit`; where your uncommitted changes overlap what the pull brought, the markers are theirs — settle them and `git add` each file, then `git stash drop` (git keeps them in the stash too). A push or publish is refused while a file under the site is in conflict. **In a git repository a push sends what you have committed:** with the site's content not committed it is refused before anything is sent, naming the files — commit them, or run `uniweb push --commit -m "…"` (it commits the site's content only, and leaves anything else staged as it is); `publish` and `sync` take `--commit` too. That commit is where the next pull merges from, which is how the pull tells your changes from the backend's. What the push writes back into the files — the ids the backend assigned — it commits itself, as `uniweb`. When the backend has nothing new, a pull says so and lists the files where yours hold changes it lacks. `uniweb refresh` runs `git pull` first, then the same pull. A push is also refused when your branch does not hold what this copy last took from the backend — after `git merge --abort`, or in a fresh clone that has not pulled — so pull, then push. Outside git — which includes a folder the repository around it ignores, such as a scratch directory — `uniweb pull` takes the backend's version over your files, asking first. `--force` is the deliberate overwrite (on `push` it replaces the backend's changes, on `pull` it discards yours); don't use it to get past a refusal. `uniweb sync` is `refresh` then `push`; neither publishes.
 
+**Moving a synced project to another repository.** Where the copy last met the backend is in its git history, and in `.uniweb/`, which git never holds — both stay behind; `sync.json` comes along, so the copy still knows its site. Move one this way: `uniweb sync` in the old copy, then copy the project in without its `.git/` and commit it, then sign in to the site's workspace and `uniweb pull` once — it records where the copy and the site meet, with nothing to settle when the old copy had synced. When it had not, `uniweb status` says the copy shares no history with the site's content and lists the files that say something else; the first pull makes each a conflict. Settle each by what you know: an edit made in the app since the last push is the backend's side, a change made in the copy and never pushed is yours — ask the person when you cannot tell. Never `--force` it in either direction: one side's edits would be gone from every file.
+
 **`sync.json` says which site this is, on each backend.** The first push to a backend records what that backend assigned — the site's id and owner, the ids of its records and uploaded files — in `sync.json` beside `site.yml`. In a git repository the push commits it; never edit it. **To make a new site from a copy of a project, run `uniweb forget --all` in the copy before its first push** — the copy carries the original's `sync.json`, so otherwise its push updates the original's site. When two projects in one workspace hold the same site, a push or publish from either is refused until that is done. `uniweb forget --server <url>` removes just one backend's records, such as a scratch server's. A record file's `$uuid` is its own id and stays in both cases. **`push`, `pull` and `publish` go to the backend you are logged in to** — the last `uniweb login --server <url>` — and never to one you are not logged in to. A bare `uniweb login` logs in to https://uniweb.app; for any other backend, name it — logging in is how you switch, and the backend commands take no `--server` of their own. When the project has no site on that backend but has one elsewhere, a push says so before creating a new one.
 
 **`services:` in `site.yml` is where a site says which services it uses** — site search, form

package/src/backend/site-sync.js

@@ -1012,6 +1012,8 @@ export function untakenBase(siteDir, backend) {
     }
     return {
       headline: "Not pushed — your branch does not hold the backend content this copy last took.",
+      // Never taken here — a fresh copy, or one brought from another repository — not lost.
+      ...(point && held ? {} : { never: true }),
       lines: [
         point && held
           ? 'The pull or push it came from is not in your history — a merge abandoned, or the branch moved.'
@@ -1980,6 +1982,24 @@ async function comparisonEmit(
   })
 }
 
+/**
+ * What a push would send from the files as they stand, every entity hashed — the same emit
+ * the banked hashes are compared with (`comparisonEmit`) — or null when the files do not emit
+ * (a key the build refuses, say). Two folders whose hashes agree say the same thing to the
+ * backend, however their files are written: a pull with no common history reads that to leave
+ * a file alone (`commands/pull.js`).
+ *
+ * @returns {Promise<Record<string,string>|null>}
+ */
+export async function entityHashes(siteDir, backend = null, { declarations, fields = null } = {}) {
+  try {
+    const pkg = await comparisonEmit(siteDir, { backend, sendAll: true, declarations, fields })
+    return pkg.hashes || {}
+  } catch {
+    return null
+  }
+}
+
 /**
  * Re-bank the send-only-changed hashes over the files as they NOW stand.
  *

package/src/commands/add.js

@@ -44,6 +44,7 @@ import {
   resolveUniqueName
 } from '../utils/names.js'
 import { findWorkspaceRoot } from '../utils/workspace.js'
+import { repoOf } from '../utils/sync-point.js'
 import {
   normalizeFoundationName,
   ensureFoundationName,
@@ -1479,6 +1480,20 @@ export default function ${name}({ content, params }) {
  * and can plug in later.
  */
 async function addCi(rootDir, opts, pm = 'pnpm') {
+  // ⛔ A PROJECT THAT IS A FOLDER OF A LARGER REPOSITORY gets no workflow: GitHub runs workflows
+  // only from a repository's top, and this writes into the project's own `.github/`, where it
+  // would never run. Refused rather than written, for now [Diego, 2026-10-26: "refuse for now"] —
+  // measured on a repository of client projects, one of which carried a GitHub Pages workflow
+  // from its old repository that had not run since it moved.
+  const repo = repoOf(rootDir)
+  if (repo?.prefix) {
+    error(`Not added: this project is the folder ${repo.path} of the repository at ${repo.top}.`)
+    log(`  GitHub runs workflows only from the top of a repository (${relative(rootDir, join(repo.top, '.github', 'workflows'))}/),`)
+    log(`  so one written in this project's own .github/ would never run.`)
+    log(`  Deploy from a repository of its own, or by hand from here: uniweb deploy --host=<adapter>.`)
+    process.exit(1)
+  }
+
   // Lazy-load the host registry so the CLI doesn't pay this import on
   // every add invocation.
   let getAdapter, listAdapters

package/src/commands/pull.js

@@ -97,6 +97,7 @@ import {
   makeModelResolver,
   ensureRegisteredFoundation,
   deploymentFields,
+  entityHashes,
   rebankSyncHashes,
   writeQueryUuids,
   mergeBaseVersions,
@@ -118,6 +119,7 @@ import {
   madeOnto,
   baseFor,
   openStandIn,
+  fileAt,
   mergeSyncPoint,
   takeSyncPoint,
   snapshotFiles,
@@ -565,6 +567,100 @@ function restore(path, bytes) {
   else writeFileSync(path, bytes)
 }
 
+/**
+ * ⭐ WITH NO COMMON HISTORY, A FILE THAT SAYS WHAT THE BACKEND HOLDS IS LEFT AS IT IS.
+ *
+ * A project copied into another repository leaves its sync points in the old history, so its
+ * first pull merges two histories that share nothing: every file the projection rewrites is a
+ * conflict, this copy's against the backend's. The writer already keeps an author's text where it
+ * would write the same document (`project-writer.js`, "an unchanged body keeps the author's own
+ * text"); what it rewrites, this tries once more, two ways. Every hash a push would send, with the
+ * backend's file put in among this copy's (`entityHashes`): where none moves, the two say the
+ * same. And the same asset written two ways, which a push sends as different data
+ * (`sameButAssetForms`). Either way this copy's text goes into the backend's commit, and the merge
+ * has nothing to settle there. A backend file that does not emit at all — a key the build
+ * refuses — says something else, and stays the backend's.
+ *
+ * Measured 2026-10-26 on two sites copied out of their own repositories: six conflicts, three of
+ * them content — a logo added in the app, a key the copy had renamed on both sites — and three
+ * gallery records naming their images by URL where the backend's files name them by path.
+ *
+ * @returns {Promise<string[]>} the files left as this copy writes them
+ */
+async function keepWhatMeansTheSame({ standIn, repo, origin, declarations, fields }) {
+  const dir = standIn.siteDir
+  const ours = new Map()
+  const theirs = new Map()
+  for (const [status, path] of standIn.changes()) {
+    if (status !== 'M') continue
+    const head = fileAt(repo, 'HEAD', path)
+    const now = bytesOf(join(dir, path))
+    if (head && now) {
+      ours.set(path, head)
+      theirs.set(path, now)
+    }
+  }
+  if (!ours.size) return []
+  const opts = { ...(declarations?.size ? { declarations } : {}), fields }
+  const kept = []
+  // What the emits print is a comparison's, not this pull's to say.
+  const said = { warn: console.warn, log: console.log, info: console.info }
+  console.warn = console.log = console.info = () => {}
+  try {
+    // This copy's text everywhere: the files each backend one is tried among.
+    for (const [path, bytes] of ours) writeFileSync(join(dir, path), bytes)
+    const mine = await entityHashes(dir, origin, opts)
+    if (mine) {
+      for (const [path, bytes] of theirs) {
+        writeFileSync(join(dir, path), bytes)
+        const tried = await entityHashes(dir, origin, opts)
+        if ((tried && sameHashes(tried, mine)) || sameButAssetForms(path, ours.get(path), bytes)) kept.push(path)
+        writeFileSync(join(dir, path), ours.get(path))
+      }
+    }
+  } finally {
+    Object.assign(console, said)
+    // The backend's text back wherever it says something else.
+    for (const [path, bytes] of theirs) if (!kept.includes(path)) writeFileSync(join(dir, path), bytes)
+  }
+  return kept
+}
+
+function sameHashes(a, b) {
+  const keys = Object.keys(a)
+  return keys.length === Object.keys(b).length && keys.every((k) => a[k] === b[k])
+}
+
+/**
+ * Two versions of a file that differ only in how they name the same assets: a URL to the
+ * backend's copy (`https://…/assets/<sha256>/base.jpeg`) where the other has the site's own path
+ * (`/assets/<sha256>.jpeg`). A push sends different data from each — a URL, an asset reference —
+ * so the hashes differ, but the asset is one, by its content hash. This copy's text is kept: the
+ * banked hash is its own, so a push leaves the file alone, and the next pull from this base writes
+ * the backend's way (ours unchanged, theirs different). Measured 2026-10-26: three gallery records
+ * an older pull had written with URLs.
+ */
+export function sameButAssetForms(path, a, b) {
+  const asset = (s) => s.replace(/(?:https?:\/\/[^\s"'()]+)?\/assets\/([0-9a-f]{64})(?:\/[^\s"'()]*?)?(?:\.[A-Za-z0-9]+)?(?=[\s"'()]|$)/g, 'asset:$1')
+  const read = (bytes) => {
+    const text = bytes.toString('utf8')
+    if (!/\.ya?ml$/.test(path)) return asset(text)
+    try {
+      return JSON.stringify(sortedDeep(yaml.load(text)), (_, v) => (typeof v === 'string' ? asset(v) : v))
+    } catch {
+      return asset(text)
+    }
+  }
+  const [x, y] = [read(a), read(b)]
+  return x === y && a.toString('utf8') !== b.toString('utf8')
+}
+
+function sortedDeep(v) {
+  if (Array.isArray(v)) return v.map(sortedDeep)
+  if (v && typeof v === 'object' && !(v instanceof Date)) return Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortedDeep(v[k])]))
+  return v
+}
+
 // The sync point's subject line, and the merge's.
 const pulledFrom = (origin) => `The site's content on ${origin}`
 const mergedFrom = (origin) => `Merge the site's content from ${origin}`
@@ -999,9 +1095,9 @@ export async function pull(args = [], deps = {}) {
       origin: client.origin,
       siteUuid: siteContentUuid
     })
-    // A probe with no base has no way to tell the backend's changes from this copy's: onto
-    // HEAD, every difference would read as the backend's.
-    if (probe && !base) return { exitCode: 0, probe: null }
+    // A probe with no base cannot tell the backend's changes from this copy's: onto HEAD, it says
+    // what differs, and which way is the person's to read (`noBase`, below). ⛔ Until 2026-10-26
+    // it said nothing at all, and status could not size a copied project's first pull.
     onto = force || !base ? repo.head : base
     try {
       standIn = openStandIn(repo, { roots, rev: onto })
@@ -1158,10 +1254,20 @@ export async function pull(args = [], deps = {}) {
       for (const w of report.warnings) note(`! ${w}`)
     }
 
+    // ⭐ With no common history, each file that says what the backend holds is left as this copy
+    // writes it (`keepWhatMeansTheSame`): only a difference in content is a conflict.
+    if (standIn && !base && !force) {
+      merge.keptAsWritten = await keepWhatMeansTheSame({ standIn, repo, origin: client.origin, declarations, fields })
+    }
+
     // ⭐ A PROBE STOPS HERE, the stand-in holding what this pull would take: what differs
-    // from the base is what the backend changed. Nothing is banked; `finally` closes it.
+    // from the base is what the backend changed — or, with no base, what differs at all, which
+    // way unknown (`noBase`). Nothing is banked; `finally` closes it.
     if (probe) {
-      return { exitCode: 0, probe: { files: standIn.changes(), recordsNotPlaced: Boolean(recordsNotPlaced) } }
+      return {
+        exitCode: 0,
+        probe: { files: standIn.changes(), recordsNotPlaced: Boolean(recordsNotPlaced), ...(base ? {} : { noBase: true }) }
+      }
     }
 
     // Outside git: what this pull wrote, so the next one can tell its own output from the
@@ -1369,6 +1475,11 @@ export async function pull(args = [], deps = {}) {
         if (ahead.length > 12) note(`  … and ${ahead.length - 12} more`)
       }
     }
+    if (merge.keptAsWritten?.length) {
+      note(`${merge.keptAsWritten.length} file(s) differ from ${client.origin}'s only in how they are written, and are left as they are:`)
+      for (const p of merge.keptAsWritten.slice(0, 12)) note(`  ${repo.prefix}${p}`)
+      if (merge.keptAsWritten.length > 12) note(`  … and ${merge.keptAsWritten.length - 12} more`)
+    }
     if (merge.conflicted.length) {
       error(`${merge.conflicted.length} file(s) have conflicts to resolve:`)
       for (const f of merge.conflicted) note(`  ${f}`)
@@ -1379,7 +1490,7 @@ export async function pull(args = [], deps = {}) {
       } else {
         if (merge.noBase) {
           note(`No commit in this history is one ${client.origin}'s content came from, so nothing tells`)
-          note("your changes from the backend's: each file where they differ is a conflict, yours against the backend's.")
+          note("your changes from the backend's: each file that says something else is a conflict, yours against the backend's.")
           note('Once this merge is committed, later pulls merge from it.')
         }
         note(

package/src/commands/status.js

@@ -467,7 +467,11 @@ async function appChecks(siteDir, siteYml, { offline, args, git }) {
     checks.push({
       id: 'app.base',
       state: 'blocking',
-      summary: base.headline.replace(/^Not pushed — /, '').replace(/^./, (ch) => ch.toUpperCase()),
+      // ⛔ Not "does not hold what this copy last took" for a copy that took nothing here — a fresh
+      // copy, or a project brought from another repository, whose sync points stayed there.
+      summary: base.never
+        ? 'This copy has not taken the site from the backend yet: a push waits until a pull has merged its content.'
+        : base.headline.replace(/^Not pushed — /, '').replace(/^./, (ch) => ch.toUpperCase()),
       blocks: ['push', 'publish']
     })
     proposals.push({ step: 'pull', command: 'npx uniweb pull', why: "merge the backend's content with yours" })
@@ -502,6 +506,14 @@ async function appChecks(siteDir, siteYml, { offline, args, git }) {
           }
         : { id: 'app.unpushed', state: 'ok', summary: 'Nothing waiting to be pushed.' }
     )
+  } else if (base?.never && git.repo) {
+    // ⛔ A copy that took nothing here has no record of what it last sent, so every entity would
+    // count as unsent — "holds changes" is a guess, and a push step before the pull it needs.
+    checks.push({
+      id: 'app.unpushed',
+      state: 'unknown',
+      summary: "What this copy holds that the backend lacks is known once a pull has merged the site's content here."
+    })
   } else {
     try {
       const probe = await probeUnpushed(siteDir, { backend: origin })
@@ -575,8 +587,9 @@ async function appChecks(siteDir, siteYml, { offline, args, git }) {
 
   // ⭐ WHAT CHANGED ON THE BACKEND, AS A PULL WOULD TAKE IT. In a repository, the pull itself,
   // stopped before it takes anything (`probePull`): the files it would change, translations
-  // and records included. Where it cannot answer — outside git, no sync point to merge from —
-  // the backend's units against this copy's last sync (`backend/app-changes.js`).
+  // and records included — with no sync point in this history, the files that differ, which way
+  // unknown (`noBaseChanges`). Outside git, the backend's units against this copy's last sync
+  // (`backend/app-changes.js`).
   const readChanges = async () => {
     if (git.repo) {
       const org = readOrgFlag(args)
@@ -746,7 +759,8 @@ function changeChecks(siteDir, changes, unpushedFiles, proposals) {
  * `app.changes` from the pull's own answer (`probePull`): the files it would change, each
  * as the pull would write it.
  */
-function probedChanges({ files: list, recordsNotPlaced }, unpushedFiles, proposals) {
+function probedChanges({ files: list, recordsNotPlaced, noBase }, unpushedFiles, proposals) {
+  if (noBase) return noBaseChanges(list, recordsNotPlaced)
   if (!list.length) {
     return [{ id: 'app.changes', state: 'ok', summary: 'Nothing changed on the backend since this copy last synced.', detail: { source: 'pull', files: [] } }]
   }
@@ -776,6 +790,34 @@ function probedChanges({ files: list, recordsNotPlaced }, unpushedFiles, proposa
   ]
 }
 
+/**
+ * `app.changes` for a copy whose history shares no commit with the site's content — a project
+ * brought into another repository, whose sync points stayed in the old one. What differs is
+ * said, which way unknown: the first pull makes each such file a conflict, yours against the
+ * backend's, and records where the two meet; one that says what the backend holds, written
+ * another way, it leaves alone, and it is not listed (`keepWhatMeansTheSame`, `commands/pull.js`).
+ * The pull itself is `app.base`'s step.
+ */
+function noBaseChanges(list, recordsNotPlaced) {
+  const differ = list.filter(([s]) => s === 'M').map(([, p]) => p)
+  const added = list.filter(([s]) => s === 'A').map(([, p]) => p)
+  const lines = []
+  if (added.length) lines.push(`${count(added.length, 'file')} only the backend has — the pull adds ${added.length === 1 ? 'it' : 'them'}.`)
+  if (recordsNotPlaced) lines.push('Some records could not be placed in files — `npx uniweb pull` says which, and why.')
+  return [
+    {
+      id: 'app.changes',
+      state: 'attention',
+      summary: differ.length
+        ? `This copy shares no history with the site's content on the backend — brought from another repository, most likely. ${count(differ.length, 'file')} here ${differ.length === 1 ? 'says' : 'say'} something else, and the first pull makes ${differ.length === 1 ? 'it a conflict' : 'each a conflict'} to settle, yours against the backend's.`
+        : "This copy shares no history with the site's content on the backend, and its files say what the site holds: the first pull records where they meet, with nothing to settle.",
+      files: differ,
+      lines,
+      detail: { source: 'pull', noBase: true, files: list.map(([s, p]) => ({ path: p, change: CHANGE[s] || s })) }
+    }
+  ]
+}
+
 /**
  * `app.foundation`: the local foundation against its registered version — what the next
  * push or publish does with it (`backend/foundation-bring-along.js`).

package/src/framework-index.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-26T21:28:38.450Z",
+  "generatedAt": "2026-10-26T23:21:20.295Z",
   "packages": {
     "@uniweb/api": {
       "version": "1.6.4"
     },
     "@uniweb/build": {
-      "version": "1.10.6"
+      "version": "1.10.7"
     },
     "@uniweb/content-reader": {
       "version": "1.5.7"
@@ -15,7 +15,7 @@
       "version": "1.3.1"
     },
     "@uniweb/core": {
-      "version": "1.4.8"
+      "version": "1.4.9"
     },
     "@uniweb/frame-bridge": {
       "version": "1.0.2"
@@ -24,7 +24,7 @@
       "version": "1.0.6"
     },
     "@uniweb/kit": {
-      "version": "1.6.6"
+      "version": "1.6.7"
     },
     "@uniweb/loom": {
       "version": "1.1.2"
@@ -33,10 +33,10 @@
       "version": "1.1.4"
     },
     "@uniweb/projections": {
-      "version": "1.2.2"
+      "version": "1.2.3"
     },
     "@uniweb/runtime": {
-      "version": "1.2.4"
+      "version": "1.2.5"
     },
     "@uniweb/scene": {
       "version": "1.0.1"

package/src/utils/sync-point.js

@@ -759,6 +759,15 @@ export function uncommittedPaths(repo, roots) {
   return [...new Set(out.map((p) => siteRelative(repo, p)))]
 }
 
+/** A site file's bytes as `rev` holds it — `path` relative to the site — or null when it holds none. */
+export function fileAt(repo, rev, path) {
+  try {
+    return git(repo.top, ['cat-file', 'blob', `${rev}:${repo.prefix}${path}`])
+  } catch {
+    return null
+  }
+}
+
 /**
  * The files under the roots that differ from what `rev` holds there — changed, deleted, or
  * new and not ignored — relative to the site.