midsummer-sol 0.1.1

package/sol.js

@@ -0,0 +1,3518 @@
+#!/usr/bin/env node
+// @bun
+
+// src/bin/sol.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, mkdtempSync, readdirSync as readdirSync7, readFileSync as readFileSync9, rmSync, unlinkSync as unlinkSync6, watch, writeFileSync as writeFileSync9 } from "fs";
+import { homedir, hostname, platform as platform2, tmpdir } from "os";
+import { basename, dirname as dirname5, join as join9, resolve as resolve3, sep as sep3 } from "path";
+
+// src/attest.ts
+function canonicalOp(op) {
+  return JSON.stringify({
+    seq: op.seq,
+    type: op.type,
+    path: op.path,
+    rootAfter: op.rootAfter,
+    by: op.by ?? null,
+    message: op.message ?? null
+  });
+}
+
+// src/errors.ts
+class CorruptRepoError extends Error {
+  constructor(message) {
+    super(`corrupt repo: ${message}`);
+    this.name = "CorruptRepoError";
+  }
+}
+
+class CorruptObjectError extends Error {
+  hash;
+  constructor(hash, message = "stored bytes do not hash to their content address") {
+    super(`corrupt object ${hash}: ${message}`);
+    this.hash = hash;
+    this.name = "CorruptObjectError";
+  }
+}
+
+// src/store.ts
+import { createHash } from "node:crypto";
+function hashString(s) {
+  return "h_" + createHash("sha256").update(s, "utf8").digest("hex");
+}
+function hashNode(node) {
+  let canon;
+  if (node.kind === "blob") {
+    canon = node.encoding ? `blob\x00${node.encoding}\x00${node.content}` : `blob\x00${node.content}`;
+  } else if (node.kind === "sealed")
+    canon = `sealed\x00${node.box}`;
+  else
+    canon = "tree\x00" + Object.keys(node.entries).sort().map((k) => {
+      const e = node.entries[k];
+      return e.mode === undefined ? `${k}\x00${e.kind}\x00${e.hash}` : `${k}\x00${e.kind}\x00${e.hash}\x00${e.mode}`;
+    }).join(`
+`);
+  return hashString(canon);
+}
+
+class Store {
+  objects = new Map;
+  put(node) {
+    const h = hashNode(node);
+    if (!this.objects.has(h))
+      this.objects.set(h, node);
+    return h;
+  }
+  get(h) {
+    return this.objects.get(h);
+  }
+  getTree(h) {
+    const n = this.get(h);
+    if (!n || n.kind !== "tree")
+      throw new Error(`not a tree: ${h}`);
+    return n;
+  }
+  has(h) {
+    return this.get(h) !== undefined;
+  }
+  size() {
+    return this.objects.size;
+  }
+}
+
+// src/chain.ts
+function hashEntry(prevHash, op) {
+  return hashString(canonicalOp(op) + "\x00" + (prevHash ?? ""));
+}
+function verifyChain(ops) {
+  let prev;
+  for (const op of ops) {
+    if (op.prevHash !== prev)
+      throw new CorruptRepoError(`op-log prevHash mismatch at seq ${op.seq}`);
+    if (op.entryHash !== hashEntry(prev, op))
+      throw new CorruptRepoError(`op-log chain broken at seq ${op.seq}`);
+    prev = op.entryHash;
+  }
+  return prev;
+}
+
+// src/tree.ts
+var EMPTY_TREE = { kind: "tree", entries: {} };
+function emptyRoot(store) {
+  return store.put(EMPTY_TREE);
+}
+function segments(path) {
+  return path.split("/").filter(Boolean);
+}
+function writeFile(store, root, path, content, opts = {}) {
+  const blob = opts.encoding ? { kind: "blob", content, encoding: opts.encoding } : { kind: "blob", content };
+  return writeInto(store, root, segments(path), store.put(blob), opts.mode);
+}
+function writeInto(store, treeHash, segs, blobHash, mode) {
+  const tree = store.getTree(treeHash);
+  const entries = { ...tree.entries };
+  const [head, ...rest] = segs;
+  if (rest.length === 0) {
+    entries[head] = mode === undefined ? { kind: "blob", hash: blobHash } : { kind: "blob", hash: blobHash, mode };
+  } else {
+    const child = entries[head];
+    const childHash = child?.kind === "tree" ? child.hash : emptyRoot(store);
+    entries[head] = { kind: "tree", hash: writeInto(store, childHash, rest, blobHash, mode) };
+  }
+  return store.put({ kind: "tree", entries });
+}
+function fileAt(store, root, path) {
+  const segs = segments(path);
+  let cur = root;
+  for (let i = 0;i < segs.length; i++) {
+    const entry = store.getTree(cur).entries[segs[i]];
+    if (!entry)
+      return;
+    if (i === segs.length - 1)
+      return entry.kind === "blob" ? store.get(entry.hash) : undefined;
+    if (entry.kind !== "tree")
+      return;
+    cur = entry.hash;
+  }
+  return;
+}
+function modeAt(store, root, path) {
+  const segs = segments(path);
+  let cur = root;
+  for (let i = 0;i < segs.length; i++) {
+    const entry = store.getTree(cur).entries[segs[i]];
+    if (!entry)
+      return;
+    if (i === segs.length - 1)
+      return entry.mode;
+    if (entry.kind !== "tree")
+      return;
+    cur = entry.hash;
+  }
+  return;
+}
+function readFile(store, root, path) {
+  const segs = segments(path);
+  let cur = root;
+  for (let i = 0;i < segs.length; i++) {
+    const entry = store.getTree(cur).entries[segs[i]];
+    if (!entry)
+      return;
+    if (i === segs.length - 1) {
+      return entry.kind === "blob" ? store.get(entry.hash).content : undefined;
+    }
+    if (entry.kind !== "tree")
+      return;
+    cur = entry.hash;
+  }
+  return;
+}
+function listAll(store, root, prefix = "") {
+  const tree = store.getTree(root);
+  const out = [];
+  for (const [name, entry] of Object.entries(tree.entries)) {
+    const p = prefix ? `${prefix}/${name}` : name;
+    if (entry.kind === "tree")
+      out.push(...listAll(store, entry.hash, p));
+    else
+      out.push(p);
+  }
+  return out.sort();
+}
+function entryKindAt(store, root, path) {
+  const segs = segments(path);
+  let cur = root;
+  for (let i = 0;i < segs.length; i++) {
+    const entry = store.getTree(cur).entries[segs[i]];
+    if (!entry)
+      return;
+    if (i === segs.length - 1)
+      return entry.kind;
+    if (entry.kind !== "tree")
+      return;
+    cur = entry.hash;
+  }
+  return;
+}
+
+// src/diff.ts
+function diffTrees(store, aHead, bHead) {
+  const aPaths = new Set(listAll(store, aHead));
+  const bPaths = new Set(listAll(store, bHead));
+  const added = [];
+  const removed = [];
+  const modified = [];
+  for (const p of bPaths)
+    if (!aPaths.has(p))
+      added.push(p);
+  for (const p of aPaths)
+    if (!bPaths.has(p))
+      removed.push(p);
+  for (const p of aPaths) {
+    if (!bPaths.has(p))
+      continue;
+    const a = fileAt(store, aHead, p);
+    const b = fileAt(store, bHead, p);
+    if (!a || !b)
+      continue;
+    if (a.content === b.content && a.encoding === b.encoding)
+      continue;
+    const binary = a.encoding === "base64" || b.encoding === "base64";
+    const hunks = binary ? "" : lineHunks(a.content, b.content);
+    modified.push({ path: p, hunks });
+  }
+  added.sort();
+  removed.sort();
+  modified.sort((x, y) => x.path < y.path ? -1 : x.path > y.path ? 1 : 0);
+  return { added, removed, modified };
+}
+function splitLines(s) {
+  return s.split(`
+`);
+}
+function lcsSteps(a, b) {
+  const n = a.length;
+  const m = b.length;
+  const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+  for (let i2 = n - 1;i2 >= 0; i2--) {
+    for (let j2 = m - 1;j2 >= 0; j2--) {
+      dp[i2][j2] = a[i2] === b[j2] ? dp[i2 + 1][j2 + 1] + 1 : Math.max(dp[i2 + 1][j2], dp[i2][j2 + 1]);
+    }
+  }
+  const steps = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      steps.push({ tag: " ", line: a[i] });
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1]) {
+      steps.push({ tag: "-", line: a[i] });
+      i++;
+    } else {
+      steps.push({ tag: "+", line: b[j] });
+      j++;
+    }
+  }
+  while (i < n)
+    steps.push({ tag: "-", line: a[i++] });
+  while (j < m)
+    steps.push({ tag: "+", line: b[j++] });
+  return steps;
+}
+function lineHunks(aText, bText) {
+  const steps = lcsSteps(splitLines(aText), splitLines(bText));
+  const body = steps.map((s) => `${s.tag}${s.line}`).join(`
+`);
+  return `@@ -1 +1 @@
+${body}`;
+}
+
+// src/file-store.ts
+import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { gunzipSync, gzipSync } from "node:zlib";
+
+// src/chain.ts
+function hashEntry2(prevHash, op) {
+  return hashString(canonicalOp(op) + "\x00" + (prevHash ?? ""));
+}
+function chainOp(prevHash, op) {
+  return { ...op, prevHash, entryHash: hashEntry2(prevHash, op) };
+}
+
+// src/async-store.ts
+async function getTree(store, hash) {
+  const node = await store.get(hash);
+  if (!node || node.kind !== "tree")
+    throw new Error(`not a tree: ${hash}`);
+  return node;
+}
+
+class MemoryAsyncStore {
+  nodes = new Map;
+  async put(node) {
+    const h = hashNode(node);
+    if (!this.nodes.has(h))
+      this.nodes.set(h, node);
+    return h;
+  }
+  async get(hash) {
+    return this.nodes.get(hash);
+  }
+  async has(hash) {
+    return this.nodes.has(hash);
+  }
+  get size() {
+    return this.nodes.size;
+  }
+}
+
+// src/async-tree.ts
+function segments2(path) {
+  return path.split("/").filter(Boolean);
+}
+async function emptyRoot2(store) {
+  return store.put({ kind: "tree", entries: {} });
+}
+async function writeFile2(store, root, path, content, opts = {}) {
+  const blob = opts.encoding ? { kind: "blob", content, encoding: opts.encoding } : { kind: "blob", content };
+  const hash = await store.put(blob);
+  return writeInto2(store, root, segments2(path), hash, "blob", opts.mode);
+}
+async function writeSealed(store, root, path, box) {
+  const hash = await store.put({ kind: "sealed", box });
+  return writeInto2(store, root, segments2(path), hash, "sealed");
+}
+async function writeInto2(store, treeHash, segs, hash, leafKind, mode) {
+  const tree = await getTree(store, treeHash);
+  const entries = { ...tree.entries };
+  const [head, ...rest] = segs;
+  if (rest.length === 0) {
+    entries[head] = mode === undefined ? { kind: leafKind, hash } : { kind: leafKind, hash, mode };
+  } else {
+    const child = entries[head];
+    const childHash = child?.kind === "tree" ? child.hash : await emptyRoot2(store);
+    entries[head] = { kind: "tree", hash: await writeInto2(store, childHash, rest, hash, leafKind, mode) };
+  }
+  return store.put({ kind: "tree", entries });
+}
+async function applyBatch(store, root, changes) {
+  if (changes.size === 0)
+    return root;
+  const tree = await getTree(store, root);
+  const entries = { ...tree.entries };
+  const subdirs = new Map;
+  for (const [path, leaf] of changes) {
+    const i = path.indexOf("/");
+    if (i === -1) {
+      if (leaf === null)
+        delete entries[path];
+      else
+        entries[path] = leaf.mode === undefined ? { kind: leaf.kind, hash: leaf.hash } : { kind: leaf.kind, hash: leaf.hash, mode: leaf.mode };
+    } else {
+      const head = path.slice(0, i);
+      let m = subdirs.get(head);
+      if (!m) {
+        m = new Map;
+        subdirs.set(head, m);
+      }
+      m.set(path.slice(i + 1), leaf);
+    }
+  }
+  for (const [name, sub] of subdirs) {
+    const child = entries[name];
+    const childRoot = child && child.kind === "tree" ? child.hash : await emptyRoot2(store);
+    const built = await applyBatch(store, childRoot, sub);
+    const builtTree = await getTree(store, built);
+    if (Object.keys(builtTree.entries).length === 0)
+      delete entries[name];
+    else
+      entries[name] = { kind: "tree", hash: built };
+  }
+  return store.put({ kind: "tree", entries });
+}
+async function deleteFile(store, root, path) {
+  return deleteInto(store, root, segments2(path));
+}
+async function deleteInto(store, treeHash, segs) {
+  const tree = await getTree(store, treeHash);
+  const entries = { ...tree.entries };
+  const [head, ...rest] = segs;
+  if (!entries[head])
+    return treeHash;
+  if (rest.length === 0) {
+    delete entries[head];
+  } else if (entries[head].kind === "tree") {
+    entries[head] = { kind: "tree", hash: await deleteInto(store, entries[head].hash, rest) };
+  }
+  return store.put({ kind: "tree", entries });
+}
+async function nodeAt(store, root, path) {
+  const segs = segments2(path);
+  let cur = root;
+  for (let i = 0;i < segs.length; i++) {
+    const entry = (await getTree(store, cur)).entries[segs[i]];
+    if (!entry)
+      return;
+    if (i === segs.length - 1) {
+      if (entry.kind === "tree")
+        return;
+      const node = await store.get(entry.hash);
+      if (!node)
+        return;
+      if (node.kind === "blob")
+        return { kind: "blob", content: node.content };
+      if (node.kind === "sealed")
+        return { kind: "sealed", box: node.box };
+      return;
+    }
+    if (entry.kind !== "tree")
+      return;
+    cur = entry.hash;
+  }
+  return;
+}
+async function fileAt2(store, root, path) {
+  const segs = segments2(path);
+  let cur = root;
+  for (let i = 0;i < segs.length; i++) {
+    const entry = (await getTree(store, cur)).entries[segs[i]];
+    if (!entry)
+      return;
+    if (i === segs.length - 1) {
+      if (entry.kind !== "blob")
+        return;
+      const node = await store.get(entry.hash);
+      return node && node.kind === "blob" ? node : undefined;
+    }
+    if (entry.kind !== "tree")
+      return;
+    cur = entry.hash;
+  }
+  return;
+}
+async function modeAt2(store, root, path) {
+  const segs = segments2(path);
+  let cur = root;
+  for (let i = 0;i < segs.length; i++) {
+    const entry = (await getTree(store, cur)).entries[segs[i]];
+    if (!entry)
+      return;
+    if (i === segs.length - 1)
+      return entry.mode;
+    if (entry.kind !== "tree")
+      return;
+    cur = entry.hash;
+  }
+  return;
+}
+async function listAll2(store, root, prefix = "") {
+  const tree = await getTree(store, root);
+  const out = [];
+  for (const [name, entry] of Object.entries(tree.entries)) {
+    const p = prefix ? `${prefix}/${name}` : name;
+    if (entry.kind === "tree")
+      out.push(...await listAll2(store, entry.hash, p));
+    else
+      out.push(p);
+  }
+  return out.sort();
+}
+
+// src/types.ts
+var SEALED = "<<sealed>>";
+
+// src/async-repo.ts
+function pageOps(ops, opts = {}) {
+  let out = opts.from !== undefined ? ops.filter((o) => o.seq >= opts.from) : ops.slice();
+  if (opts.limit !== undefined)
+    out = out.slice(0, opts.limit);
+  return out;
+}
+class AsyncRepo {
+  store;
+  log;
+  actor;
+  constructor(store, log, actor = "anon") {
+    this.store = store;
+    this.log = log;
+    this.actor = actor;
+  }
+  async currentRoot() {
+    const head = await this.log.head();
+    if (head === undefined) {
+      const seq = await this.log.seq();
+      if (seq > 0)
+        throw new CorruptRepoError(`op-log has ${seq} op(s) but no head pointer — head is lost`);
+      return emptyRoot2(this.store);
+    }
+    if (!await this.store.has(head)) {
+      throw new CorruptRepoError(`head ${head} references a node missing from the store — dangling head`);
+    }
+    return head;
+  }
+  async writeFile(path, content, at = Date.now(), by = this.actor) {
+    const rootAfter = await writeFile2(this.store, await this.currentRoot(), path, content);
+    await this.log.append({ seq: await this.log.seq() + 1, type: "write", path, rootAfter, at, by });
+    return rootAfter;
+  }
+  async applyBatch(changes) {
+    const root = await this.currentRoot();
+    const leaves = new Map;
+    for (const c of changes) {
+      if ("delete" in c) {
+        leaves.set(c.path, null);
+        continue;
+      }
+      const blob = c.encoding ? { kind: "blob", content: c.content, encoding: c.encoding } : { kind: "blob", content: c.content };
+      const hash = await this.store.put(blob);
+      leaves.set(c.path, { kind: "blob", hash, mode: c.mode });
+    }
+    return { root: await applyBatch(this.store, root, leaves), changed: changes.length };
+  }
+  async writeBytes(path, data, at = Date.now(), by = this.actor) {
+    const rootAfter = await writeFile2(this.store, await this.currentRoot(), path, Buffer.from(data).toString("base64"), { encoding: "base64" });
+    await this.log.append({ seq: await this.log.seq() + 1, type: "write", path, rootAfter, at, by });
+    return rootAfter;
+  }
+  async readBytes(path) {
+    const leaf = await this.read(path);
+    if (!leaf)
+      return;
+    if (leaf.kind === "sealed")
+      return SEALED;
+    const f = await fileAt2(this.store, await this.currentRoot(), path);
+    if (!f)
+      return;
+    return new Uint8Array(Buffer.from(f.content, f.encoding === "base64" ? "base64" : "utf8"));
+  }
+  async chmod(path, mode, at = Date.now()) {
+    const f = await fileAt2(this.store, await this.currentRoot(), path);
+    if (!f)
+      return this.currentRoot();
+    const rootAfter = await writeFile2(this.store, await this.currentRoot(), path, f.content, { encoding: f.encoding, mode });
+    await this.log.append({ seq: await this.log.seq() + 1, type: "write", path, rootAfter, at, by: this.actor });
+    return rootAfter;
+  }
+  async mode(path) {
+    return modeAt2(this.store, await this.currentRoot(), path);
+  }
+  async writeSealed(path, box, at = Date.now()) {
+    const rootAfter = await writeSealed(this.store, await this.currentRoot(), path, box);
+    await this.log.append({ seq: await this.log.seq() + 1, type: "seal", path, rootAfter, at, by: this.actor });
+    return rootAfter;
+  }
+  async read(path) {
+    return nodeAt(this.store, await this.currentRoot(), path);
+  }
+  async deleteFile(path, at = Date.now(), by = this.actor) {
+    const rootAfter = await deleteFile(this.store, await this.currentRoot(), path);
+    await this.log.append({ seq: await this.log.seq() + 1, type: "delete", path, rootAfter, at, by });
+    return rootAfter;
+  }
+  async readFile(path) {
+    const leaf = await this.read(path);
+    if (!leaf)
+      return;
+    return leaf.kind === "sealed" ? SEALED : leaf.content;
+  }
+  async list() {
+    return listAll2(this.store, await this.currentRoot());
+  }
+  async head() {
+    return this.currentRoot();
+  }
+  async history(opts) {
+    return this.log.history(opts);
+  }
+}
+
+// src/file-store.ts
+function encodeObject(node) {
+  return gzipSync(JSON.stringify(node), { level: 1 });
+}
+function decodeObject(raw) {
+  const json = raw.length >= 2 && raw[0] === 31 && raw[1] === 139 ? gunzipSync(raw).toString("utf8") : raw.toString("utf8");
+  return JSON.parse(json);
+}
+
+class FileStore {
+  objects;
+  constructor(solDir) {
+    this.objects = join(solDir, "objects");
+    mkdirSync(this.objects, { recursive: true });
+  }
+  path(hash) {
+    return join(this.objects, hash);
+  }
+  async put(node) {
+    const h = hashNode(node);
+    const p = this.path(h);
+    if (!existsSync(p)) {
+      const tmp = `${p}.tmp`;
+      writeFileSync(tmp, encodeObject(node));
+      renameSync(tmp, p);
+    }
+    return h;
+  }
+  async get(hash) {
+    const p = this.path(hash);
+    if (!existsSync(p))
+      return;
+    const node = decodeObject(readFileSync(p));
+    if (hashNode(node) !== hash)
+      throw new CorruptObjectError(hash);
+    return node;
+  }
+  async has(hash) {
+    return existsSync(this.path(hash));
+  }
+  count() {
+    return existsSync(this.objects) ? readdirSync(this.objects).length : 0;
+  }
+}
+
+// src/crypto.ts
+import { createCipheriv, createDecipheriv, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, timingSafeEqual } from "node:crypto";
+var UNREADABLE = "<<unreadable>>";
+
+class KeyRing {
+  keys = new Map;
+  ensure(actor) {
+    let k = this.keys.get(actor);
+    if (!k) {
+      k = randomBytes(32);
+      this.keys.set(actor, k);
+    }
+    return k;
+  }
+  key(actor) {
+    return this.keys.get(actor);
+  }
+  serialize() {
+    const out = {};
+    for (const [a, k] of this.keys)
+      out[a] = k.toString("base64");
+    return out;
+  }
+  load(data) {
+    for (const [a, k] of Object.entries(data))
+      this.keys.set(a, Buffer.from(k, "base64"));
+  }
+}
+var RECOVERY_INFO = Buffer.from("forge-vcs/recovery/v1\x00");
+
+// src/crypto.ts
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createPublicKey as createPublicKey2, diffieHellman as diffieHellman2, generateKeyPairSync as generateKeyPairSync2, hkdfSync as hkdfSync2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var UNREADABLE2 = "<<unreadable>>";
+
+class KeyRing2 {
+  keys = new Map;
+  ensure(actor) {
+    let k = this.keys.get(actor);
+    if (!k) {
+      k = randomBytes2(32);
+      this.keys.set(actor, k);
+    }
+    return k;
+  }
+  key(actor) {
+    return this.keys.get(actor);
+  }
+  serialize() {
+    const out = {};
+    for (const [a, k] of this.keys)
+      out[a] = k.toString("base64");
+    return out;
+  }
+  load(data) {
+    for (const [a, k] of Object.entries(data))
+      this.keys.set(a, Buffer.from(k, "base64"));
+  }
+}
+function aeadSeal(key, plain) {
+  const iv = randomBytes2(12);
+  const c = createCipheriv2("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([c.update(plain), c.final()]);
+  return { iv: iv.toString("base64"), ct: ct.toString("base64"), tag: c.getAuthTag().toString("base64") };
+}
+function aeadOpen(key, box) {
+  const d = createDecipheriv2("aes-256-gcm", key, Buffer.from(box.iv, "base64"));
+  d.setAuthTag(Buffer.from(box.tag, "base64"));
+  return Buffer.concat([d.update(Buffer.from(box.ct, "base64")), d.final()]);
+}
+function sealContent(ring, content, recipients, epoch = 1) {
+  const cek = randomBytes2(32);
+  const body = aeadSeal(cek, Buffer.from(content, "utf8"));
+  const lockboxes = {};
+  for (const r of recipients)
+    lockboxes[r] = aeadSeal(ring.ensure(r), cek);
+  return { body, lockboxes, epoch };
+}
+function openContent(ring, box, actor) {
+  const lb = box.lockboxes[actor];
+  const key = ring.key(actor);
+  if (!lb || !key)
+    return UNREADABLE2;
+  try {
+    const cek = aeadOpen(key, lb);
+    return aeadOpen(cek, box.body).toString("utf8");
+  } catch {
+    return UNREADABLE2;
+  }
+}
+var RECOVERY_INFO2 = Buffer.from("forge-vcs/recovery/v1\x00");
+
+// src/sealed-client.ts
+class SealedClient {
+  repo;
+  ring;
+  constructor(repo, ring) {
+    this.repo = repo;
+    this.ring = ring;
+  }
+  async write(path, content) {
+    return this.repo.writeFile(path, content);
+  }
+  async seal(path, content, recipients) {
+    const box = sealContent(this.ring, content, recipients);
+    return this.repo.writeSealed(path, JSON.stringify(box));
+  }
+  async open(path, actor) {
+    const leaf = await this.repo.read(path);
+    if (!leaf)
+      return;
+    if (leaf.kind === "blob")
+      return leaf.content;
+    const box = JSON.parse(leaf.box);
+    return openContent(this.ring, box, actor);
+  }
+}
+
+// src/bin/git-adapter.ts
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync5, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join5 } from "node:path";
+
+// src/file-store.ts
+import { appendFileSync as appendFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+import { gunzipSync as gunzipSync2, gzipSync as gzipSync2 } from "node:zlib";
+function encodeObject2(node) {
+  return gzipSync2(JSON.stringify(node), { level: 1 });
+}
+function decodeObject2(raw) {
+  const json = raw.length >= 2 && raw[0] === 31 && raw[1] === 139 ? gunzipSync2(raw).toString("utf8") : raw.toString("utf8");
+  return JSON.parse(json);
+}
+
+class FileStore2 {
+  objects;
+  constructor(solDir) {
+    this.objects = join2(solDir, "objects");
+    mkdirSync2(this.objects, { recursive: true });
+  }
+  path(hash) {
+    return join2(this.objects, hash);
+  }
+  async put(node) {
+    const h = hashNode(node);
+    const p = this.path(h);
+    if (!existsSync2(p)) {
+      const tmp = `${p}.tmp`;
+      writeFileSync2(tmp, encodeObject2(node));
+      renameSync2(tmp, p);
+    }
+    return h;
+  }
+  async get(hash) {
+    const p = this.path(hash);
+    if (!existsSync2(p))
+      return;
+    const node = decodeObject2(readFileSync2(p));
+    if (hashNode(node) !== hash)
+      throw new CorruptObjectError(hash);
+    return node;
+  }
+  async has(hash) {
+    return existsSync2(this.path(hash));
+  }
+  count() {
+    return existsSync2(this.objects) ? readdirSync2(this.objects).length : 0;
+  }
+}
+
+class FileOpLog {
+  opsFile;
+  headFile;
+  constructor(solDir) {
+    this.opsFile = join2(solDir, "ops.jsonl");
+    this.headFile = join2(solDir, "HEAD");
+  }
+  readHead() {
+    return existsSync2(this.headFile) ? JSON.parse(readFileSync2(this.headFile, "utf8")) : { seq: 0 };
+  }
+  async head() {
+    return this.readHead().head;
+  }
+  async seq() {
+    return this.readHead().seq ?? 0;
+  }
+  async logTip() {
+    return this.readHead().logTip;
+  }
+  async append(entry) {
+    const chained = chainOp(this.readHead().logTip, entry);
+    appendFileSync2(this.opsFile, JSON.stringify(chained) + `
+`);
+    writeFileSync2(this.headFile, JSON.stringify({ head: chained.rootAfter, seq: chained.seq, logTip: chained.entryHash }));
+  }
+  async history(opts) {
+    if (!existsSync2(this.opsFile))
+      return [];
+    const all = [];
+    for (const l of readFileSync2(this.opsFile, "utf8").split(`
+`)) {
+      if (!l)
+        continue;
+      try {
+        all.push(JSON.parse(l));
+      } catch {
+        break;
+      }
+    }
+    return pageOps(all, opts);
+  }
+}
+
+// src/bin/runtime.ts
+import { chmodSync as chmodSync2, existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync4, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname2, join as join4, relative as relative2 } from "node:path";
+
+// src/bin/lib.ts
+import {
+  appendFileSync as appendFileSync3,
+  chmodSync,
+  existsSync as existsSync3,
+  lstatSync,
+  mkdirSync as mkdirSync3,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync3,
+  readlinkSync,
+  rmdirSync,
+  symlinkSync,
+  unlinkSync,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { dirname, join as join3, relative, resolve, sep } from "node:path";
+
+// src/diff.ts
+function splitLines2(s) {
+  return s.split(`
+`);
+}
+function lcsSteps2(a, b) {
+  const n = a.length;
+  const m = b.length;
+  const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+  for (let i2 = n - 1;i2 >= 0; i2--) {
+    for (let j2 = m - 1;j2 >= 0; j2--) {
+      dp[i2][j2] = a[i2] === b[j2] ? dp[i2 + 1][j2 + 1] + 1 : Math.max(dp[i2 + 1][j2], dp[i2][j2 + 1]);
+    }
+  }
+  const steps = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      steps.push({ tag: " ", line: a[i] });
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1]) {
+      steps.push({ tag: "-", line: a[i] });
+      i++;
+    } else {
+      steps.push({ tag: "+", line: b[j] });
+      j++;
+    }
+  }
+  while (i < n)
+    steps.push({ tag: "-", line: a[i++] });
+  while (j < m)
+    steps.push({ tag: "+", line: b[j++] });
+  return steps;
+}
+function lineHunks2(aText, bText) {
+  const steps = lcsSteps2(splitLines2(aText), splitLines2(bText));
+  const body = steps.map((s) => `${s.tag}${s.line}`).join(`
+`);
+  return `@@ -1 +1 @@
+${body}`;
+}
+
+// src/bin/lib.ts
+var procCwd = process.cwd();
+function findRepoRoot(start) {
+  let d = start;
+  for (;; ) {
+    if (existsSync3(join3(d, ".sol")))
+      return d;
+    const parent = dirname(d);
+    if (parent === d)
+      return;
+    d = parent;
+  }
+}
+var repoRoot = findRepoRoot(procCwd);
+var cwd = repoRoot ?? procCwd;
+var solDir = join3(cwd, ".sol");
+var actor = process.env.SOL_ACTOR || process.env.USER || "you";
+var DEFAULT_IGNORE = [".sol", ".git", "node_modules", "dist", "build", ".next", ".cache", ".DS_Store", "__pycache__", "*.pyc", ".venv", "venv", "target", ".gradle", "*.log"];
+function ignorePatterns() {
+  const f = join3(cwd, ".solignore");
+  const extra = existsSync3(f) ? readFileSync3(f, "utf8").split(`
+`).map((s) => s.trim()).filter((s) => s && !s.startsWith("#")) : [];
+  return [...DEFAULT_IGNORE, ...extra];
+}
+function isIgnored(rel, pats) {
+  const segs = rel.split("/");
+  return pats.some((p0) => {
+    const p = p0.endsWith("/") ? p0.slice(0, -1) : p0;
+    if (p.startsWith("*."))
+      return rel.endsWith(p.slice(1));
+    return rel === p || rel.startsWith(p + "/") || segs.includes(p);
+  });
+}
+
+// src/bin/runtime.ts
+var SYMLINK_MODE = 40960;
+var EXEC_MODE = 493;
+function hydrate(store, head, dir) {
+  if (!head)
+    return 0;
+  let n = 0;
+  for (const p of listAll(store, head)) {
+    const blob = fileAt(store, head, p);
+    if (!blob)
+      continue;
+    const abs = join4(dir, p);
+    mkdirSync4(dirname2(abs), { recursive: true });
+    const mode = modeAt(store, head, p);
+    if (mode === SYMLINK_MODE) {
+      try {
+        unlinkSync2(abs);
+      } catch {}
+      symlinkSync2(blob.content, abs);
+    } else {
+      writeFileSync4(abs, blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+      if (mode === EXEC_MODE) {
+        try {
+          chmodSync2(abs, EXEC_MODE);
+        } catch {}
+      }
+    }
+    n++;
+  }
+  return n;
+}
+
+// src/bin/git-adapter.ts
+var git = (cwd2, ...a) => execFileSync("git", ["-C", cwd2, ...a], { maxBuffer: 1 << 30 });
+function parseLsTree(out) {
+  const m = new Map;
+  for (const entry of out.split("\x00")) {
+    if (!entry)
+      continue;
+    const tab = entry.indexOf("\t");
+    const meta = entry.slice(0, tab).split(" ");
+    m.set(entry.slice(tab + 1), { mode: meta[0], hash: meta[2] });
+  }
+  return m;
+}
+async function applyGitFile(repo, path, mode, content) {
+  if (mode === "120000") {
+    const target = content.toString("utf8");
+    if (await repo.readFile(path) !== target || await repo.mode(path) !== 40960) {
+      await repo.writeFile(path, target);
+      await repo.chmod(path, 40960);
+    }
+    return;
+  }
+  const exec = mode === "100755";
+  const curExec = await repo.mode(path) === 493;
+  if (content.includes(0)) {
+    const cur = await repo.readBytes(path);
+    const same = cur !== undefined && cur !== SEALED && Buffer.from(cur).equals(content);
+    if (!same)
+      await repo.writeBytes(path, new Uint8Array(content));
+  } else {
+    const disk = content.toString("utf8");
+    if (await repo.readFile(path) !== disk)
+      await repo.writeFile(path, disk);
+  }
+  if (exec !== curExec)
+    await repo.chmod(path, exec ? 493 : 420);
+}
+function setHead(fdir, head) {
+  const hf = join5(fdir, "HEAD");
+  const cur = existsSync5(hf) ? JSON.parse(readFileSync5(hf, "utf8")) : { seq: 0 };
+  writeFileSync5(hf, JSON.stringify({ ...cur, head }));
+}
+async function importGitRepo(gitPath, fdir) {
+  const store = new FileStore2(fdir);
+  const log = new FileOpLog(fdir);
+  const empty = await emptyRoot2(store);
+  const commitList = git(gitPath, "rev-list", "--reverse", "--topo-order", "--all").toString().trim().split(`
+`).filter(Boolean);
+  const gitToSol = new Map;
+  const gitFiles = new Map;
+  let count = 0;
+  for (const gc of commitList) {
+    const author = git(gitPath, "log", "-1", "--format=%an", gc).toString().trim() || "git";
+    const message = git(gitPath, "log", "-1", "--format=%B", gc).toString().trim();
+    const parents = git(gitPath, "log", "-1", "--format=%P", gc).toString().trim().split(/\s+/).filter(Boolean);
+    const p1Sol = parents[0] ? gitToSol.get(parents[0]) ?? empty : empty;
+    setHead(fdir, p1Sol);
+    const repo = new AsyncRepo(store, log, author);
+    const tree = parseLsTree(git(gitPath, "ls-tree", "-r", "-z", gc).toString());
+    for (const [path, { mode, hash }] of tree) {
+      if (mode === "160000")
+        continue;
+      await applyGitFile(repo, path, mode, git(gitPath, "cat-file", "blob", hash));
+    }
+    for (const p of parents[0] ? gitFiles.get(parents[0]) ?? new Set : new Set)
+      if (!tree.has(p))
+        await repo.deleteFile(p);
+    const head = await repo.head();
+    const p2Sol = parents[1] ? gitToSol.get(parents[1]) : undefined;
+    await log.append({ seq: await log.seq() + 1, type: "checkpoint", path: "", rootAfter: head, at: Date.now(), by: author, message, parent: p1Sol, ...p2Sol ? { parent2: p2Sol } : {} });
+    gitToSol.set(gc, head);
+    gitFiles.set(gc, new Set(tree.keys()));
+    count++;
+  }
+  const branches = [];
+  for (const line of git(gitPath, "for-each-ref", "--format=%(refname:short) %(objectname)", "refs/heads").toString().trim().split(`
+`).filter(Boolean)) {
+    const [name, tip] = line.split(" ");
+    const solHead = gitToSol.get(tip);
+    if (solHead)
+      branches.push({ name, head: solHead });
+  }
+  const current = git(gitPath, "rev-parse", "--abbrev-ref", "HEAD").toString().trim() || "main";
+  const currentSol = gitToSol.get(git(gitPath, "rev-parse", "HEAD").toString().trim()) ?? await log.head() ?? "";
+  setHead(fdir, currentSol);
+  return { commits: count, branches, head: currentSol, current };
+}
+function exportToGit(store, head, gitPath, message) {
+  const want = new Set(head ? listAll(store, head) : []);
+  const tracked = git(gitPath, "ls-files", "-z").toString().split("\x00").filter(Boolean);
+  let deleted = 0;
+  for (const f of tracked) {
+    if (!want.has(f)) {
+      try {
+        unlinkSync3(join5(gitPath, f));
+      } catch {}
+      deleted++;
+    }
+  }
+  const written = hydrate(store, head, gitPath);
+  git(gitPath, "add", "-A");
+  git(gitPath, "commit", "-m", message || "sol export", "--allow-empty");
+  return { written, deleted };
+}
+
+// src/log.ts
+function groupIntoUnits(ops) {
+  const units = [];
+  let cur = [];
+  for (const op of ops) {
+    if (op.type === "checkpoint") {
+      units.push({ label: op.message, by: op.by, at: op.at, head: op.rootAfter, ops: cur, open: false });
+      cur = [];
+    } else {
+      cur.push(op);
+    }
+  }
+  if (cur.length > 0) {
+    const last = cur[cur.length - 1];
+    units.push({ by: last.by, at: last.at, head: last.rootAfter, ops: cur, open: true });
+  }
+  return units;
+}
+function formatLog(ops) {
+  return ops.map((op) => {
+    const by = op.by ?? "?";
+    const head = `${op.seq} ${by} ${op.type} ${op.path}`;
+    return op.message ? `${head}: ${op.message}` : head;
+  });
+}
+
+// src/text-merge.ts
+function lines(s) {
+  return s.split(`
+`);
+}
+function eq(a, b) {
+  return a.length === b.length && a.every((x, i) => x === b[i]);
+}
+function lcsPairs(a, b) {
+  const n = a.length;
+  const m = b.length;
+  const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+  for (let i2 = n - 1;i2 >= 0; i2--) {
+    for (let j2 = m - 1;j2 >= 0; j2--) {
+      dp[i2][j2] = a[i2] === b[j2] ? dp[i2 + 1][j2 + 1] + 1 : Math.max(dp[i2 + 1][j2], dp[i2][j2 + 1]);
+    }
+  }
+  const pairs = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      pairs.push([i, j]);
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1])
+      i++;
+    else
+      j++;
+  }
+  return pairs;
+}
+function hunks(base, other) {
+  const pairs = lcsPairs(base, other);
+  const out = [];
+  let pb = 0;
+  let po = 0;
+  const flush = (bEnd, oEnd) => {
+    if (bEnd > pb || oEnd > po)
+      out.push({ bs: pb, be: bEnd, lines: other.slice(po, oEnd) });
+  };
+  for (const [bi, oi] of pairs) {
+    flush(bi, oi);
+    pb = bi + 1;
+    po = oi + 1;
+  }
+  flush(base.length, other.length);
+  return out;
+}
+function sideContent(side, rs, re, base) {
+  const res = [];
+  let pos = rs;
+  for (const h of side) {
+    if (h.bs < rs || h.be > re)
+      continue;
+    for (let k = pos;k < h.bs; k++)
+      res.push(base[k]);
+    res.push(...h.lines);
+    pos = Math.max(pos, h.be);
+  }
+  for (let k = pos;k < re; k++)
+    res.push(base[k]);
+  return res;
+}
+function merge3(baseS, oursS, theirsS) {
+  const base = lines(baseS);
+  const ours = hunks(base, lines(oursS));
+  const theirs = hunks(base, lines(theirsS));
+  const all = [
+    ...ours.map((h) => ({ ...h, side: "o" })),
+    ...theirs.map((h) => ({ ...h, side: "t" }))
+  ].sort((x, y) => x.bs - y.bs || x.be - y.be);
+  const regions = [];
+  for (const h of all) {
+    const last = regions[regions.length - 1];
+    if (last && h.bs < last.re) {
+      last.re = Math.max(last.re, h.be);
+      if (h.side === "o")
+        last.o = true;
+      else
+        last.t = true;
+    } else {
+      regions.push({ rs: h.bs, re: h.be, o: h.side === "o", t: h.side === "t" });
+    }
+  }
+  const out = [];
+  let conflicts = 0;
+  let pos = 0;
+  for (const reg of regions) {
+    for (let k = pos;k < reg.rs; k++)
+      out.push(base[k]);
+    const o = sideContent(ours, reg.rs, reg.re, base);
+    const t = sideContent(theirs, reg.rs, reg.re, base);
+    if (reg.o && reg.t) {
+      if (eq(o, t))
+        out.push(...o);
+      else {
+        conflicts++;
+        out.push("<<<<<<< ours", ...o, "=======", ...t, ">>>>>>> theirs");
+      }
+    } else if (reg.o)
+      out.push(...o);
+    else
+      out.push(...t);
+    pos = reg.re;
+  }
+  for (let k = pos;k < base.length; k++)
+    out.push(base[k]);
+  return { clean: conflicts === 0, text: out.join(`
+`), conflicts };
+}
+
+// src/merge.ts
+function resolvePath(base, ours, theirs) {
+  const oursChanged = ours !== base;
+  const theirsChanged = theirs !== base;
+  if (!oursChanged && !theirsChanged) {
+    return { content: base };
+  }
+  if (oursChanged && !theirsChanged) {
+    return { content: ours };
+  }
+  if (!oursChanged && theirsChanged) {
+    return { content: theirs };
+  }
+  if (ours === theirs) {
+    return { content: ours };
+  }
+  if (base !== undefined && ours !== undefined && theirs !== undefined) {
+    const m = merge3(base, ours, theirs);
+    if (m.clean)
+      return { content: m.text };
+    return { content: m.text, conflict: { path: "", ours, theirs } };
+  }
+  return {
+    content: ours,
+    conflict: { path: "", ours, theirs }
+  };
+}
+function merge(repo, baseHead, oursHead, theirsHead) {
+  const store = repo.store;
+  const paths = new Set([
+    ...listAll(store, baseHead),
+    ...listAll(store, oursHead),
+    ...listAll(store, theirsHead)
+  ]);
+  const conflicts = [];
+  let root = emptyRoot(store);
+  for (const path of [...paths].sort()) {
+    const base = readFile(store, baseHead, path);
+    const ours = readFile(store, oursHead, path);
+    const theirs = readFile(store, theirsHead, path);
+    const { content, conflict } = resolvePath(base, ours, theirs);
+    if (conflict)
+      conflicts.push({ ...conflict, path });
+    if (content !== undefined) {
+      root = writeFile(store, root, path, content);
+    }
+  }
+  return { head: root, conflicts };
+}
+
+// src/mr.ts
+function latestVerdicts(mr) {
+  const m = new Map;
+  for (const r of mr.reviews)
+    m.set(r.actor, r.verdict);
+  return m;
+}
+function mrSummary(mr) {
+  const approvals = [...latestVerdicts(mr).values()].filter((v) => v === "approve").length;
+  const checks = mr.checks.length ? `${mr.checks.filter((c) => c.status === "pass").length}/${mr.checks.length} checks pass` : "no checks";
+  const fails = mr.checks.filter((c) => c.status === "fail").length;
+  return `${approvals} approval${approvals === 1 ? "" : "s"}, ${checks}${fails ? `, ${fails} failing` : ""}`;
+}
+
+// src/store.ts
+import { createHash as createHash2 } from "node:crypto";
+function hashString2(s) {
+  return "h_" + createHash2("sha256").update(s, "utf8").digest("hex");
+}
+function hashNode2(node) {
+  let canon;
+  if (node.kind === "blob") {
+    canon = node.encoding ? `blob\x00${node.encoding}\x00${node.content}` : `blob\x00${node.content}`;
+  } else if (node.kind === "sealed")
+    canon = `sealed\x00${node.box}`;
+  else
+    canon = "tree\x00" + Object.keys(node.entries).sort().map((k) => {
+      const e = node.entries[k];
+      return e.mode === undefined ? `${k}\x00${e.kind}\x00${e.hash}` : `${k}\x00${e.kind}\x00${e.hash}\x00${e.mode}`;
+    }).join(`
+`);
+  return hashString2(canon);
+}
+
+class Store2 {
+  objects = new Map;
+  put(node) {
+    const h = hashNode2(node);
+    if (!this.objects.has(h))
+      this.objects.set(h, node);
+    return h;
+  }
+  get(h) {
+    return this.objects.get(h);
+  }
+  getTree(h) {
+    const n = this.get(h);
+    if (!n || n.kind !== "tree")
+      throw new Error(`not a tree: ${h}`);
+    return n;
+  }
+  has(h) {
+    return this.get(h) !== undefined;
+  }
+  size() {
+    return this.objects.size;
+  }
+}
+
+// src/tree.ts
+var EMPTY_TREE2 = { kind: "tree", entries: {} };
+function emptyRoot3(store) {
+  return store.put(EMPTY_TREE2);
+}
+function segments3(path) {
+  return path.split("/").filter(Boolean);
+}
+function fileAt3(store, root, path) {
+  const segs = segments3(path);
+  let cur = root;
+  for (let i = 0;i < segs.length; i++) {
+    const entry = store.getTree(cur).entries[segs[i]];
+    if (!entry)
+      return;
+    if (i === segs.length - 1)
+      return entry.kind === "blob" ? store.get(entry.hash) : undefined;
+    if (entry.kind !== "tree")
+      return;
+    cur = entry.hash;
+  }
+  return;
+}
+function listAll3(store, root, prefix = "") {
+  const tree = store.getTree(root);
+  const out = [];
+  for (const [name, entry] of Object.entries(tree.entries)) {
+    const p = prefix ? `${prefix}/${name}` : name;
+    if (entry.kind === "tree")
+      out.push(...listAll3(store, entry.hash, p));
+    else
+      out.push(p);
+  }
+  return out.sort();
+}
+
+// src/types.ts
+var SEALED2 = "<<sealed>>";
+
+// src/bin/lib.ts
+import {
+  appendFileSync as appendFileSync4,
+  chmodSync as chmodSync3,
+  existsSync as existsSync6,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync5,
+  readdirSync as readdirSync5,
+  readFileSync as readFileSync6,
+  readlinkSync as readlinkSync3,
+  rmdirSync as rmdirSync2,
+  symlinkSync as symlinkSync3,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync6
+} from "node:fs";
+import { dirname as dirname3, join as join6, relative as relative3, resolve as resolve2, sep as sep2 } from "node:path";
+var procCwd2 = process.cwd();
+function findRepoRoot2(start) {
+  let d = start;
+  for (;; ) {
+    if (existsSync6(join6(d, ".sol")))
+      return d;
+    const parent = dirname3(d);
+    if (parent === d)
+      return;
+    d = parent;
+  }
+}
+var repoRoot2 = findRepoRoot2(procCwd2);
+var cwd2 = repoRoot2 ?? procCwd2;
+var solDir2 = join6(cwd2, ".sol");
+var actor2 = process.env.SOL_ACTOR || process.env.USER || "you";
+function repoRel(p) {
+  return relative3(cwd2, resolve2(procCwd2, p));
+}
+var SYMLINK_MODE2 = 40960;
+var EXEC_MODE2 = 493;
+function die(msg) {
+  console.error("sol: " + msg);
+  process.exit(1);
+}
+function open() {
+  if (!existsSync6(solDir2))
+    die("not a sol repo — run `sol init` first");
+  return { repo: new AsyncRepo(new FileStore2(solDir2), new FileOpLog(solDir2), actor2), log: new FileOpLog(solDir2) };
+}
+var DEFAULT_IGNORE2 = [".sol", ".git", "node_modules", "dist", "build", ".next", ".cache", ".DS_Store", "__pycache__", "*.pyc", ".venv", "venv", "target", ".gradle", "*.log"];
+function ignorePatterns2() {
+  const f = join6(cwd2, ".solignore");
+  const extra = existsSync6(f) ? readFileSync6(f, "utf8").split(`
+`).map((s) => s.trim()).filter((s) => s && !s.startsWith("#")) : [];
+  return [...DEFAULT_IGNORE2, ...extra];
+}
+function isIgnored2(rel, pats) {
+  const segs = rel.split("/");
+  return pats.some((p0) => {
+    const p = p0.endsWith("/") ? p0.slice(0, -1) : p0;
+    if (p.startsWith("*."))
+      return rel.endsWith(p.slice(1));
+    return rel === p || rel.startsWith(p + "/") || segs.includes(p);
+  });
+}
+function walkEntries(dir = cwd2, base = cwd2, pats = ignorePatterns2(), out = []) {
+  for (const name of readdirSync5(dir)) {
+    const p = join6(dir, name);
+    const rel = relative3(base, p);
+    if (isIgnored2(rel, pats))
+      continue;
+    const st = lstatSync3(p);
+    if (st.isDirectory() && !st.isSymbolicLink())
+      walkEntries(p, base, pats, out);
+    else
+      out.push({ rel, st });
+  }
+  return out;
+}
+function walkFiles(dir = cwd2, base = cwd2, pats = ignorePatterns2()) {
+  return walkEntries(dir, base, pats).map((e) => e.rel);
+}
+async function snapshotFile(repo, f) {
+  const abs = join6(cwd2, f);
+  const st = lstatSync3(abs);
+  if (st.isSymbolicLink()) {
+    const target = readlinkSync3(abs);
+    if (await repo.readFile(f) === target && await repo.mode(f) === SYMLINK_MODE2)
+      return false;
+    await repo.writeFile(f, target);
+    await repo.chmod(f, SYMLINK_MODE2);
+    return true;
+  }
+  const wantExec = (st.mode & 73) !== 0;
+  const curMode = await repo.mode(f);
+  const isExec = curMode === EXEC_MODE2;
+  const buf = readFileSync6(abs);
+  if (buf.includes(0)) {
+    const cur = await repo.readBytes(f);
+    const same2 = cur !== undefined && cur !== SEALED && Buffer.from(cur).equals(buf);
+    if (same2 && wantExec === isExec)
+      return false;
+    if (!same2)
+      await repo.writeBytes(f, new Uint8Array(buf));
+    if (wantExec !== isExec)
+      await repo.chmod(f, wantExec ? EXEC_MODE2 : 420);
+    return true;
+  }
+  const disk = buf.toString("utf8");
+  const stored = await repo.readFile(f);
+  if (stored === SEALED)
+    return false;
+  const same = stored === disk;
+  if (same && wantExec === isExec)
+    return false;
+  if (!same)
+    await repo.writeFile(f, disk);
+  if (wantExec !== isExec)
+    await repo.chmod(f, wantExec ? EXEC_MODE2 : 420);
+  return true;
+}
+async function fileChange(repo, f) {
+  const abs = join6(cwd2, f);
+  const st = lstatSync3(abs);
+  if (st.isSymbolicLink()) {
+    const target = readlinkSync3(abs);
+    if (await repo.readFile(f) === target && await repo.mode(f) === SYMLINK_MODE2)
+      return null;
+    return { path: f, content: target, mode: SYMLINK_MODE2 };
+  }
+  const wantMode = (st.mode & 73) !== 0 ? EXEC_MODE2 : undefined;
+  const curMode = await repo.mode(f);
+  const buf = readFileSync6(abs);
+  if (buf.includes(0)) {
+    const cur = await repo.readBytes(f);
+    if (cur === SEALED)
+      return null;
+    const same = cur !== undefined && Buffer.from(cur).equals(buf);
+    if (same && curMode === wantMode)
+      return null;
+    return { path: f, content: buf.toString("base64"), encoding: "base64", mode: wantMode };
+  }
+  const disk = buf.toString("utf8");
+  const stored = await repo.readFile(f);
+  if (stored === SEALED)
+    return null;
+  if (stored === disk && curMode === wantMode)
+    return null;
+  return { path: f, content: disk, mode: wantMode };
+}
+var includePath = () => join6(solDir2, "include");
+function forceIncluded() {
+  return existsSync6(includePath()) ? readFileSync6(includePath(), "utf8").split(`
+`).map((s) => s.trim()).filter(Boolean) : [];
+}
+function addInclude(path) {
+  if (!forceIncluded().includes(path))
+    appendFileSync4(includePath(), path + `
+`);
+}
+function lexists(abs) {
+  try {
+    lstatSync3(abs);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function snapshotTree(repo) {
+  const onDisk = new Set(walkFiles());
+  for (const f of forceIncluded())
+    if (lexists(join6(cwd2, f)))
+      onDisk.add(f);
+  const tracked = await repo.list();
+  for (const t of tracked)
+    if (!onDisk.has(t) && lexists(join6(cwd2, t)))
+      onDisk.add(t);
+  const changes = [];
+  for (const f of onDisk) {
+    const c = await fileChange(repo, f);
+    if (c)
+      changes.push(c);
+  }
+  for (const t of tracked)
+    if (!lexists(join6(cwd2, t)))
+      changes.push({ path: t, delete: true });
+  return repo.applyBatch(changes);
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function acquireLock() {
+  const lockDir = join6(solDir2, "lock");
+  const deadline = Date.now() + 15000;
+  for (;; ) {
+    try {
+      mkdirSync5(lockDir);
+      break;
+    } catch {
+      try {
+        if (Date.now() - lstatSync3(lockDir).mtimeMs > 30000) {
+          rmdirSync2(lockDir);
+          continue;
+        }
+      } catch {}
+      if (Date.now() > deadline)
+        die("repo is locked by another sol process (timed out)");
+      sleepSync(25);
+    }
+  }
+  let released = false;
+  const release = () => {
+    if (released)
+      return;
+    released = true;
+    try {
+      rmdirSync2(lockDir);
+    } catch {}
+  };
+  process.on("exit", release);
+  return release;
+}
+
+class LazyStore extends Store {
+  objDir;
+  constructor(objDir) {
+    super();
+    this.objDir = objDir;
+  }
+  get(h) {
+    const cached = this.objects.get(h);
+    if (cached)
+      return cached;
+    const p = join6(this.objDir, h);
+    if (!existsSync6(p))
+      return;
+    try {
+      const node = decodeObject2(readFileSync6(p));
+      this.objects.set(h, node);
+      return node;
+    } catch {
+      return;
+    }
+  }
+}
+function loadStore() {
+  return new LazyStore(join6(solDir2, "objects"));
+}
+function allLocalNodes() {
+  const objDir = join6(solDir2, "objects");
+  const out = [];
+  if (existsSync6(objDir))
+    for (const name of readdirSync5(objDir)) {
+      if (name.endsWith(".tmp"))
+        continue;
+      try {
+        out.push(decodeObject2(readFileSync6(join6(objDir, name))));
+      } catch {}
+    }
+  return out;
+}
+async function resolveRef(log, ref) {
+  const ops = await log.history();
+  if (!ref || ref === "head" || ref === "HEAD")
+    return { head: await log.head() ?? "", op: ops[ops.length - 1] };
+  if (existsSync6(refsPath())) {
+    const refs = JSON.parse(readFileSync6(refsPath(), "utf8"));
+    if (ref === refs.current) {
+      const h = await log.head() ?? "";
+      return { head: h, op: [...ops].reverse().find((o) => o.rootAfter === h) ?? ops[ops.length - 1] };
+    }
+    const named = refs.branches[ref]?.head ?? refs.tags[ref];
+    if (named !== undefined)
+      return { head: named, op: [...ops].reverse().find((o) => o.rootAfter === named) };
+  }
+  if (/^\d+$/.test(ref)) {
+    const op2 = ops.find((o) => o.seq === Number(ref)) || die("no op at seq " + ref);
+    return { head: op2.rootAfter, op: op2 };
+  }
+  const bare = ref.startsWith("h_") ? ref : "h_" + ref;
+  const op = ops.find((o) => o.rootAfter.startsWith(bare) || (o.entryHash ?? "").startsWith(bare)) || die("unknown ref: " + ref);
+  return { head: op.rootAfter, op };
+}
+function materialize(store, head, path) {
+  const blob = fileAt(store, head, path);
+  if (!blob)
+    return false;
+  const abs = resolve2(cwd2, path);
+  if (abs !== cwd2 && !abs.startsWith(cwd2 + sep2)) {
+    console.error("sol: refusing to write outside the repo: " + path);
+    return false;
+  }
+  const mode = modeAt(store, head, path);
+  mkdirSync5(dirname3(abs), { recursive: true });
+  if (mode === SYMLINK_MODE2) {
+    try {
+      unlinkSync4(abs);
+    } catch {}
+    symlinkSync3(blob.content, abs);
+    return true;
+  }
+  writeFileSync6(abs, blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+  if (mode === EXEC_MODE2) {
+    try {
+      chmodSync3(abs, EXEC_MODE2);
+    } catch {}
+  }
+  return true;
+}
+function materializeTree(store, head) {
+  const want = new Set(head ? listAll(store, head) : []);
+  let n = 0;
+  for (const f of walkFiles())
+    if (!want.has(f)) {
+      unlinkSync4(join6(cwd2, f));
+      n++;
+    }
+  for (const f of want)
+    if (materialize(store, head, f))
+      n++;
+  writeWorkingIndex([...want]);
+  return n;
+}
+function fileHashes(store, root, prefix = "", out = new Map) {
+  const tree = store.getTree(root);
+  for (const [name, e] of Object.entries(tree.entries)) {
+    const p = prefix ? `${prefix}/${name}` : name;
+    if (e.kind === "tree")
+      fileHashes(store, e.hash, p, out);
+    else
+      out.set(p, e.hash);
+  }
+  return out;
+}
+function materializeDiff(store, fromHead, toHead) {
+  const from = fromHead ? fileHashes(store, fromHead) : new Map;
+  const to = toHead ? fileHashes(store, toHead) : new Map;
+  let n = 0;
+  for (const p of from.keys())
+    if (!to.has(p)) {
+      try {
+        unlinkSync4(join6(cwd2, p));
+        n++;
+      } catch {}
+    }
+  for (const [p, h] of to)
+    if (from.get(p) !== h && materialize(store, toHead, p))
+      n++;
+  writeWorkingIndex([...to.keys()]);
+  return n;
+}
+function countChanges(store, fromHead, toHead) {
+  const hashes = (head) => {
+    if (!head)
+      return new Map;
+    try {
+      return fileHashes(store, head);
+    } catch {
+      return new Map;
+    }
+  };
+  const from = hashes(fromHead);
+  const to = hashes(toHead);
+  let n = 0;
+  for (const p of from.keys())
+    if (!to.has(p))
+      n++;
+  for (const [p, h] of to)
+    if (from.get(p) !== h)
+      n++;
+  return n;
+}
+var indent = (s) => s.split(`
+`).map((l) => "    " + l).join(`
+`);
+function printTreeDiff(d) {
+  for (const p of d.added)
+    console.log(`+ added    ${p}`);
+  for (const p of d.removed)
+    console.log(`- removed  ${p}`);
+  for (const m of d.modified) {
+    console.log(`~ modified ${m.path}`);
+    if (m.hunks)
+      console.log(indent(m.hunks));
+  }
+  if (!d.added.length && !d.removed.length && !d.modified.length)
+    console.log("no changes");
+}
+var indexPath = () => join6(solDir2, "index.json");
+function loadWorkingIndex() {
+  if (!existsSync6(indexPath()))
+    return new Map;
+  try {
+    return new Map(Object.entries(JSON.parse(readFileSync6(indexPath(), "utf8"))));
+  } catch {
+    return new Map;
+  }
+}
+function writeWorkingIndex(files) {
+  if (!existsSync6(solDir2))
+    return;
+  const idx = {};
+  for (const f of files) {
+    try {
+      const st = lstatSync3(join6(cwd2, f));
+      idx[f] = [st.mtimeMs, st.size, st.mode & 73 ? 1 : 0];
+    } catch {}
+  }
+  writeFileSync6(indexPath(), JSON.stringify(idx));
+}
+function workingChanges(store, head, index = loadWorkingIndex()) {
+  const inHead = new Set(head ? listAll(store, head) : []);
+  const onDisk = new Map;
+  for (const e of walkEntries())
+    onDisk.set(e.rel, e.st);
+  for (const f of forceIncluded())
+    if (!onDisk.has(f)) {
+      try {
+        onDisk.set(f, lstatSync3(join6(cwd2, f)));
+      } catch {}
+    }
+  for (const t of inHead)
+    if (!onDisk.has(t)) {
+      try {
+        onDisk.set(t, lstatSync3(join6(cwd2, t)));
+      } catch {}
+    }
+  const added = [];
+  const modified = [];
+  const removed = [];
+  for (const f of onDisk.keys())
+    if (!inHead.has(f))
+      added.push(f);
+  for (const f of inHead)
+    if (!onDisk.has(f) && index.has(f))
+      removed.push(f);
+  for (const [f, st] of onDisk) {
+    if (!inHead.has(f))
+      continue;
+    const ix = index.get(f);
+    if (ix && !st.isSymbolicLink() && ix[0] === st.mtimeMs && ix[1] === st.size && ix[2] === (st.mode & 73 ? 1 : 0))
+      continue;
+    if (entryKindAt(store, head, f) === "sealed")
+      continue;
+    const stored = readFile(store, head, f);
+    if (stored === SEALED)
+      continue;
+    const abs = join6(cwd2, f);
+    if (st.isSymbolicLink()) {
+      if (stored !== readlinkSync3(abs))
+        modified.push(f);
+      continue;
+    }
+    const buf = readFileSync6(abs);
+    const diskContent = buf.includes(0) ? buf.toString("base64") : buf.toString("utf8");
+    const wantExec = (st.mode & 73) !== 0;
+    const isExec = modeAt(store, head, f) === EXEC_MODE2;
+    if (stored !== diskContent || wantExec !== isExec)
+      modified.push(f);
+  }
+  return { added: added.sort(), modified: modified.sort(), removed: removed.sort() };
+}
+function printWorkingDiff(store, base) {
+  const ch = workingChanges(store, base);
+  for (const f of ch.added)
+    console.log(`+ added    ${f}`);
+  for (const f of ch.removed)
+    console.log(`- removed  ${f}`);
+  for (const f of ch.modified) {
+    console.log(`~ modified ${f}`);
+    const abs = join6(cwd2, f);
+    if (lstatSync3(abs).isSymbolicLink())
+      continue;
+    const buf = readFileSync6(abs);
+    if (buf.includes(0))
+      continue;
+    const stored = readFile(store, base, f);
+    if (typeof stored === "string" && stored !== buf.toString("utf8"))
+      console.log(indent(lineHunks2(stored, buf.toString("utf8"))));
+  }
+  if (!ch.added.length && !ch.removed.length && !ch.modified.length)
+    console.log("no working changes");
+}
+function blameFile(ops, store, path) {
+  let tagged = [];
+  const currentLines = () => tagged.map((t) => t.line);
+  const linesOf = (content) => content === "" ? [] : content.replace(/\n$/, "").split(`
+`);
+  const sameLines = (a, b) => a.length === b.length && a.every((line, i) => line === b[i]);
+  for (const op of ops) {
+    let content;
+    if (op.type === "write" && op.path === path) {
+      content = readFile(store, op.rootAfter, path);
+    } else if (op.type === "delete" && op.path === path) {
+      tagged = [];
+      continue;
+    } else if (op.type === "checkpoint") {
+      content = readFile(store, op.rootAfter, path);
+      if (content === undefined || content === SEALED) {
+        if (tagged.length)
+          tagged = [];
+        continue;
+      }
+      if (sameLines(currentLines(), linesOf(content)))
+        continue;
+    } else {
+      continue;
+    }
+    if (content === undefined || content === SEALED) {
+      tagged = [];
+      continue;
+    }
+    const next = linesOf(content);
+    const keep = lcsMatch(tagged.map((t) => t.line), next);
+    const out = [];
+    for (let j = 0;j < next.length; j++)
+      out.push(keep[j] >= 0 ? { line: next[j], by: tagged[keep[j]].by, seq: tagged[keep[j]].seq } : { line: next[j], by: op.by, seq: op.seq });
+    tagged = out;
+  }
+  return tagged;
+}
+function lcsMatch(a, b) {
+  const n = a.length;
+  const m = b.length;
+  const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+  for (let i2 = n - 1;i2 >= 0; i2--)
+    for (let j2 = m - 1;j2 >= 0; j2--)
+      dp[i2][j2] = a[i2] === b[j2] ? dp[i2 + 1][j2 + 1] + 1 : Math.max(dp[i2 + 1][j2], dp[i2][j2 + 1]);
+  const match = new Array(m).fill(-1);
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      match[j] = i;
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1])
+      i++;
+    else
+      j++;
+  }
+  return match;
+}
+var refsPath = () => join6(solDir2, "refs.json");
+var saveRefs = (refs) => writeFileSync6(refsPath(), JSON.stringify(refs, null, 2));
+async function loadRefs(log) {
+  const head = await log.head() ?? "";
+  if (!existsSync6(refsPath())) {
+    const fresh = { current: "main", branches: { main: { head, base: head } }, tags: {} };
+    saveRefs(fresh);
+    return fresh;
+  }
+  const refs = JSON.parse(readFileSync6(refsPath(), "utf8"));
+  if (refs.branches[refs.current])
+    refs.branches[refs.current].head = head;
+  return refs;
+}
+function setOpLogHead(head) {
+  const hf = join6(solDir2, "HEAD");
+  const cur = existsSync6(hf) ? JSON.parse(readFileSync6(hf, "utf8")) : { seq: 0 };
+  writeFileSync6(hf, JSON.stringify({ ...cur, head }));
+}
+async function persistTree(src, dst, head) {
+  const node = src.get(head);
+  if (!node)
+    return;
+  await dst.put(node);
+  if (node.kind === "tree")
+    for (const e of Object.values(node.entries))
+      await persistTree(src, dst, e.hash);
+}
+async function appendCommit(log, head, message, parent, parent2) {
+  await log.append({ seq: await log.seq() + 1, type: "checkpoint", path: "", rootAfter: head, at: Date.now(), by: actor2, message, parent, ...parent2 ? { parent2 } : {} });
+}
+async function appendCapture(log, root) {
+  await log.append({ seq: await log.seq() + 1, type: "write", path: "", rootAfter: root, at: Date.now(), by: actor2 });
+}
+var keysPath = () => join6(solDir2, "keys.json");
+function loadKeyRing() {
+  const ring = new KeyRing2;
+  if (existsSync6(keysPath()))
+    ring.load(JSON.parse(readFileSync6(keysPath(), "utf8")));
+  return ring;
+}
+function saveKeyRing(ring) {
+  writeFileSync6(keysPath(), JSON.stringify(ring.serialize(), null, 2), { mode: 384 });
+  try {
+    chmodSync3(keysPath(), 384);
+  } catch {}
+}
+
+// src/bin/remote.ts
+import { appendFileSync as appendFileSync5, existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join7 } from "node:path";
+var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`;
+async function call(cfg, token, path, init) {
+  const res = await fetch(endpoint(cfg, path), {
+    ...init,
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init?.headers }
+  });
+  if (!res.ok)
+    throw new Error(`remote ${path} -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
+  return res.json();
+}
+var remoteHead = (cfg, token) => call(cfg, token, "/head");
+var remoteExport = (cfg, token) => call(cfg, token, "/export");
+var remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) });
+var remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) });
+var mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) });
+var mrList = (cfg, token) => call(cfg, token, "/mrs");
+var mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`);
+var mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`);
+var mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) });
+var accessGet = (cfg, token) => call(cfg, token, "/access");
+var accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) });
+var forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) });
+var forksList = (cfg, token) => call(cfg, token, "/forks");
+function loadRemote(solDir3) {
+  const p = join7(solDir3, "remote.json");
+  return existsSync7(p) ? JSON.parse(readFileSync7(p, "utf8")) : undefined;
+}
+var saveRemote = (solDir3, cfg) => writeFileSync7(join7(solDir3, "remote.json"), JSON.stringify(cfg, null, 2));
+async function writeBundle(solDir3, bundle, from = 0) {
+  const store = new FileStore2(solDir3);
+  for (const node of bundle.nodes)
+    await store.put(node);
+  const fresh = bundle.ops.filter((o) => o.seq > from);
+  const lines2 = fresh.map((o) => JSON.stringify(o)).join(`
+`) + (fresh.length ? `
+` : "");
+  const opsFile = join7(solDir3, "ops.jsonl");
+  if (from === 0)
+    writeFileSync7(opsFile, lines2);
+  else if (fresh.length)
+    appendFileSync5(opsFile, lines2);
+  writeFileSync7(join7(solDir3, "HEAD"), JSON.stringify({ head: bundle.head, seq: bundle.seq, logTip: bundle.tip }));
+  return fresh.length;
+}
+
+// src/bin/runtime.ts
+import { chmodSync as chmodSync4, existsSync as existsSync8, lstatSync as lstatSync4, mkdirSync as mkdirSync6, readdirSync as readdirSync6, readFileSync as readFileSync8, readlinkSync as readlinkSync4, symlinkSync as symlinkSync4, unlinkSync as unlinkSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { platform } from "node:os";
+import { dirname as dirname4, join as join8, relative as relative4 } from "node:path";
+var SYMLINK_MODE3 = 40960;
+var EXEC_MODE3 = 493;
+function isolateCommand(command, scratch) {
+  if (platform() === "darwin") {
+    const profile = [
+      "(version 1)",
+      "(allow default)",
+      "(deny network*)",
+      "(deny file-write*)",
+      `(allow file-write* (subpath ${JSON.stringify(scratch)}) (subpath "/private/var/folders") (subpath "/private/tmp") (subpath "/dev") (literal "/dev/null"))`
+    ].join(" ");
+    return ["sandbox-exec", "-p", profile, ...command];
+  }
+  throw new Error(`--isolate not yet wired for platform ${platform()} (macOS sandbox-exec only); omit --isolate to run unconfined`);
+}
+function hydrate2(store, head, dir) {
+  if (!head)
+    return 0;
+  let n = 0;
+  for (const p of listAll(store, head)) {
+    const blob = fileAt(store, head, p);
+    if (!blob)
+      continue;
+    const abs = join8(dir, p);
+    mkdirSync6(dirname4(abs), { recursive: true });
+    const mode = modeAt(store, head, p);
+    if (mode === SYMLINK_MODE3) {
+      try {
+        unlinkSync5(abs);
+      } catch {}
+      symlinkSync4(blob.content, abs);
+    } else {
+      writeFileSync8(abs, blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+      if (mode === EXEC_MODE3) {
+        try {
+          chmodSync4(abs, EXEC_MODE3);
+        } catch {}
+      }
+    }
+    n++;
+  }
+  return n;
+}
+function walkDir(dir, base, pats, out = []) {
+  for (const name of readdirSync6(dir)) {
+    const p = join8(dir, name);
+    const rel = relative4(base, p);
+    if (isIgnored(rel, pats))
+      continue;
+    const st = lstatSync4(p);
+    if (st.isSymbolicLink())
+      out.push(rel);
+    else if (st.isDirectory())
+      walkDir(p, base, pats, out);
+    else
+      out.push(rel);
+  }
+  return out;
+}
+async function capture(repo, dir, keep = []) {
+  const pats = ignorePatterns();
+  const files = new Set(walkDir(dir, dir, pats));
+  for (const k of keep)
+    if (existsSync8(join8(dir, k)))
+      files.add(k);
+  const written = [];
+  for (const f of files) {
+    const abs = join8(dir, f);
+    const st = lstatSync4(abs);
+    if (st.isSymbolicLink()) {
+      const target = readlinkSync4(abs);
+      if (await repo.readFile(f) !== target) {
+        await repo.writeFile(f, target);
+        await repo.chmod(f, SYMLINK_MODE3);
+        written.push(f);
+      }
+      continue;
+    }
+    const buf = readFileSync8(abs);
+    if (buf.includes(0)) {
+      const cur = await repo.readBytes(f);
+      if (cur === undefined || cur === SEALED || !Buffer.from(cur).equals(buf)) {
+        await repo.writeBytes(f, new Uint8Array(buf));
+        written.push(f);
+      }
+    } else {
+      const disk = buf.toString("utf8");
+      if (await repo.readFile(f) !== disk) {
+        await repo.writeFile(f, disk);
+        written.push(f);
+      }
+    }
+  }
+  const deleted = [];
+  for (const t of await repo.list()) {
+    if (!existsSync8(join8(dir, t))) {
+      await repo.deleteFile(t);
+      deleted.push(t);
+    }
+  }
+  return { written, deleted };
+}
+
+// src/bin/sol.ts
+var CRED_PATH = join9(homedir(), ".sol", "credentials");
+function tokenClaims(token) {
+  try {
+    return JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString());
+  } catch {
+    return {};
+  }
+}
+async function loadStoredToken() {
+  if (!existsSync9(CRED_PATH))
+    return;
+  let creds;
+  try {
+    creds = JSON.parse(readFileSync9(CRED_PATH, "utf8"));
+  } catch {
+    return;
+  }
+  if (!creds.accessToken)
+    return;
+  const exp = tokenClaims(creds.accessToken).exp;
+  if (typeof exp === "number" && exp * 1000 > Date.now() + 30000)
+    return creds.accessToken;
+  if (creds.refreshToken && creds.webUrl) {
+    try {
+      const res = await fetch(`${creds.webUrl}/api/auth/refresh`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ refreshToken: creds.refreshToken }) });
+      if (res.ok) {
+        const r = await res.json();
+        if (r.accessToken) {
+          writeFileSync9(CRED_PATH, JSON.stringify({ ...creds, accessToken: r.accessToken, refreshToken: r.refreshToken ?? creds.refreshToken }, null, 2), { mode: 384 });
+          return r.accessToken;
+        }
+      }
+    } catch {}
+  }
+  return creds.accessToken;
+}
+function authHost() {
+  if (process.env.SOL_AUTH)
+    return process.env.SOL_AUTH.replace(/\/+$/, "");
+  try {
+    const w = JSON.parse(readFileSync9(CRED_PATH, "utf8")).webUrl;
+    if (w)
+      return w.replace(/\/+$/, "");
+  } catch {}
+  return "https://auth.midsummer.new";
+}
+var DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, "");
+var remoteUrlArg = (a) => /^https?:\/\//.test(a[0] ?? "") ? [a[0].replace(/\/+$/, ""), a.slice(1)] : [DEFAULT_REMOTE_URL, a];
+function resolveRemote(solDir3) {
+  const cfg = loadRemote(solDir3);
+  if (!cfg)
+    return;
+  return cfg.url ? cfg : { ...cfg, url: DEFAULT_REMOTE_URL };
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  if (argv[0] === "--version" || argv[0] === "-v" || argv[0] === "version") {
+    console.log("sol 0.1.0");
+    return;
+  }
+  const args = argv.slice(1);
+  const wantsHelp = args.includes("--help") || args.includes("-h");
+  const SUBHELP = {
+    mr: `sol mr open [--from <branch>] [--to <branch>] [--upstream <repo>] -t "title" [-m body]
+  sol mr list | show <id> | review <id> --approve|--request-changes|--comment [-m msg]
+  sol mr comment <id> -m msg [--path f --line N] | check <id> --run -- <cmd> | merge <id> [--force] | close <id>`,
+    fork: "sol fork [<url>] <parent-repo> <new-repo> [dir]   \u2014 your own copy (all branches + history + a parent link)",
+    forks: "sol forks   \u2014 list the forks of the current repo",
+    access: "sol access [show | public | private | add <userId> <read|write|admin> | remove <userId>]",
+    auth: "sol auth [login [<web-url>] | logout | status | whoami | set-handle <name> | pat [days]]",
+    clone: "sol clone [<url>] <owner>/<repo> [dir]   \u2014 default dir = <repo> (url defaults to the hosted Sol)"
+  };
+  if (wantsHelp && argv[0] && SUBHELP[argv[0]]) {
+    console.log(SUBHELP[argv[0]]);
+    return;
+  }
+  const cmd = argv[0] && wantsHelp ? "help" : argv[0];
+  if (!process.env.SOL_TOKEN && new Set(["clone", "push", "pull", "promote", "fork", "forks", "mr", "access"]).has(cmd ?? "")) {
+    const t = await loadStoredToken();
+    if (t)
+      process.env.SOL_TOKEN = t;
+  }
+  const release = new Set(["add", "track", "commit", "checkpoint", "rm", "gc", "branch", "tag", "switch", "merge", "pull", "run", "seal"]).has(cmd) && existsSync9(solDir2) ? acquireLock() : undefined;
+  try {
+    switch (cmd) {
+      case "init": {
+        const here = join9(procCwd2, ".sol");
+        if (existsSync9(here))
+          die("already a sol repo: " + procCwd2);
+        if (repoRoot2 && repoRoot2 !== procCwd2 && !args.includes("--force")) {
+          die(`already inside a Sol repo at ${repoRoot2}
+  -> just commit into it: \`sol commit ...\` works from here (sol walks up to find the repo)
+  -> to nest a NEW repo here anyway: \`sol init --force\``);
+        }
+        mkdirSync7(here, { recursive: true });
+        new FileStore(here);
+        console.log(`initialized empty sol repo in ${here}`);
+        break;
+      }
+      case "track":
+      case "add": {
+        if (!existsSync9(solDir2))
+          die("not a sol repo \u2014 run `sol init` first");
+        const files = args.filter((a) => a !== "." && !a.startsWith("-"));
+        if (!files.length) {
+          console.log('every change is auto-captured \u2014 just `sol commit`. Sol has no staging area, so there is nothing to "add".');
+          console.log("use `sol track <ignored-file>` only to force-track a normally-ignored path.");
+          break;
+        }
+        let n = 0;
+        for (const f of files) {
+          const rf = repoRel(f);
+          if (!existsSync9(join9(cwd2, rf))) {
+            console.error("skip (not on disk): " + f);
+            continue;
+          }
+          addInclude(rf);
+          n++;
+        }
+        console.log(`will track ${n} path(s) on the next commit`);
+        break;
+      }
+      case "commit":
+      case "checkpoint": {
+        const { repo, log } = open();
+        let message = "";
+        const paths = [];
+        const wholeTreeOptIn = args.includes("--whole-tree");
+        const ca = args.filter((x) => x !== "--whole-tree" && x !== "--force");
+        const mi = ca.indexOf("-m");
+        if (mi >= 0) {
+          message = ca[mi + 1] ?? "";
+          for (let i = 0;i < ca.length; i++)
+            if (i !== mi && i !== mi + 1)
+              paths.push(ca[i]);
+        } else {
+          message = ca.join(" ");
+        }
+        if (!message)
+          die('commit needs a message: sol commit "what you did"  (scoped: sol commit -m "msg" file1 file2)');
+        const parentHead = await repo.head();
+        const mergeHeadPath = join9(solDir2, "MERGE_HEAD");
+        const parent2 = existsSync9(mergeHeadPath) ? readFileSync9(mergeHeadPath, "utf8").trim() || undefined : undefined;
+        let changed = 0;
+        let commitRoot = parentHead;
+        if (paths.length) {
+          for (const p of paths) {
+            const rp = repoRel(p);
+            if (existsSync9(join9(cwd2, rp))) {
+              if (await snapshotFile(repo, rp))
+                changed++;
+            } else if ((await repo.list()).includes(rp)) {
+              await repo.deleteFile(rp);
+              changed++;
+            } else {
+              console.error("skip (not on disk, not tracked): " + p);
+            }
+          }
+          commitRoot = await repo.head();
+        } else {
+          const optedIn = wholeTreeOptIn || process.env.SOL_ALLOW_WHOLE_TREE === "1";
+          if (process.env.SOL_ACTOR && !optedIn) {
+            die(`refusing a whole-tree commit as "${actor2}" \u2014 it would attribute ALL pending files to you.
+  concurrent agents: sol commit -m "${message}" <your files>   (or a per-agent SolWorkspace/MCP)
+  if you truly own the whole tree: add --whole-tree  or set SOL_ALLOW_WHOLE_TREE=1`);
+          }
+          const snap = await snapshotTree(repo);
+          changed = snap.changed;
+          commitRoot = snap.root;
+          if (!process.env.SOL_ACTOR && changed > 1) {
+            console.error(`note: whole-tree commit attributes all ${changed} pending files to ${actor2}. for concurrent agents, prefer \`sol commit -m "msg" <files>\`.`);
+          }
+        }
+        if (!args.includes("--force")) {
+          const cstore = loadStore();
+          const cd = diffTrees(cstore, parentHead, commitRoot);
+          const changedPaths = paths.length ? paths.map((p) => repoRel(p)) : [...cd.added, ...cd.modified.map((m) => m.path)];
+          for (const p of changedPaths) {
+            const f = fileAt3(cstore, commitRoot, p);
+            if (f && f.encoding !== "base64" && /^<{7}( |$)/m.test(f.content) && /^>{7}( |$)/m.test(f.content)) {
+              die(`refusing to commit unresolved conflict markers in ${p} \u2014 resolve the <<<<<<< / >>>>>>> blocks first (or \`sol commit --force ...\` to override).`);
+            }
+          }
+        }
+        await appendCommit(log, commitRoot, message, parentHead, parent2);
+        if (parent2) {
+          try {
+            unlinkSync6(mergeHeadPath);
+          } catch {}
+        }
+        const refs = await loadRefs(log);
+        saveRefs(refs);
+        writeWorkingIndex(await repo.list());
+        console.log(`commit ${commitRoot.slice(0, 14)} \u2014 ${message}  (${changed} file change${changed === 1 ? "" : "s"})`);
+        break;
+      }
+      case "status": {
+        const { repo, log } = open();
+        const refs = existsSync9(refsPath()) ? await loadRefs(log) : undefined;
+        const head = await repo.head();
+        console.log(`repo ${cwd2}`);
+        console.log(`on ${refs ? refs.current : "main"}   head ${head.slice(0, 14)}   seq ${await log.seq()}   actor ${actor2}`);
+        const ch = workingChanges(loadStore(), head);
+        const dirty = ch.added.length + ch.modified.length + ch.removed.length;
+        if (!dirty) {
+          console.log("working tree clean");
+          break;
+        }
+        console.log(`${dirty} uncommitted change(s):`);
+        for (const f of ch.added)
+          console.log("  + " + f);
+        for (const f of ch.modified)
+          console.log("  ~ " + f);
+        for (const f of ch.removed)
+          console.log("  - " + f);
+        break;
+      }
+      case "ls": {
+        for (const f of await open().repo.list())
+          console.log(f);
+        break;
+      }
+      case "cat": {
+        const path = args[0] || die("cat needs a path");
+        const repo = open().repo;
+        const c = await repo.readFile(path);
+        if (c === undefined)
+          die("no such tracked path: " + path);
+        if (c === SEALED2) {
+          const opened = await new SealedClient(repo, loadKeyRing()).open(path, actor2);
+          process.stdout.write(opened === undefined || opened === UNREADABLE ? `<<sealed \u2014 you are not a recipient>>
+` : opened);
+          break;
+        }
+        process.stdout.write(c);
+        break;
+      }
+      case "log": {
+        const { log } = open();
+        const ops = await log.history();
+        if (args.includes("--all") || args.includes("--ops")) {
+          if (!ops.length)
+            console.log("(no history yet)");
+          for (const line of formatLog(ops))
+            console.log(line.replace(/\bcheckpoint\b/, "commit"));
+          break;
+        }
+        const store = loadStore();
+        const byRoot = new Map;
+        for (const o of ops)
+          if (o.type === "checkpoint")
+            byRoot.set(o.rootAfter, o);
+        const live = await log.head() ?? "";
+        const refArg = args.find((a) => !a.startsWith("-"));
+        const lrefs = existsSync9(refsPath()) ? JSON.parse(readFileSync9(refsPath(), "utf8")) : null;
+        let tip = live;
+        if (refArg) {
+          tip = lrefs?.branches[refArg]?.head ?? refArg;
+        } else if (lrefs && !byRoot.has(tip)) {
+          const stored = lrefs.branches[lrefs.current]?.head;
+          if (stored && byRoot.has(stored))
+            tip = stored;
+        }
+        const chain = [];
+        const seen = new Set;
+        let cur = tip;
+        while (cur && byRoot.has(cur) && !seen.has(cur)) {
+          seen.add(cur);
+          const c = byRoot.get(cur);
+          chain.push(c);
+          cur = c.parent;
+        }
+        if (!chain.length) {
+          console.log(ops.length ? '(no commits on this branch yet \u2014 run `sol commit "msg"`)' : "(no history yet)");
+        }
+        for (const c of chain) {
+          const n = countChanges(store, c.parent ?? "", c.rootAfter);
+          const tag = c.parent2 ? `  [merge ${c.parent2.slice(0, 8)}]` : "";
+          console.log(`${c.rootAfter.slice(0, 14)}  ${(c.by ?? "?").padEnd(14)}  ${c.message ?? ""}  (${n} change${n === 1 ? "" : "s"})${tag}`);
+        }
+        const wc = workingChanges(store, live);
+        const dirty = wc.added.length + wc.modified.length + wc.removed.length;
+        if (dirty)
+          console.log(`(working: ${dirty} uncommitted change(s))`);
+        break;
+      }
+      case "rm": {
+        const path = args[0] || die("rm needs a path");
+        let onDisk = false;
+        try {
+          unlinkSync6(join9(cwd2, path));
+          onDisk = true;
+        } catch {}
+        if (onDisk) {
+          console.log(`removed ${path} from disk (commit to record the deletion)`);
+          break;
+        }
+        const { repo } = open();
+        if (!(await repo.list()).includes(path))
+          die("not tracked and not on disk: " + path);
+        await repo.deleteFile(path);
+        console.log("removed (tracked-only) " + path);
+        break;
+      }
+      case "diff": {
+        const { log } = open();
+        const store = loadStore();
+        if (args.length >= 2) {
+          printTreeDiff(diffTrees(store, (await resolveRef(log, args[0])).head, (await resolveRef(log, args[1])).head));
+        } else {
+          printWorkingDiff(store, (await resolveRef(log, args[0])).head);
+        }
+        break;
+      }
+      case "restore":
+      case "checkout": {
+        const { log } = open();
+        const store = loadStore();
+        let from = "head";
+        const rest = [];
+        for (let i = 0;i < args.length; i++) {
+          if (args[i] === "--from")
+            from = args[++i];
+          else if (args[i] !== "--all")
+            rest.push(args[i]);
+        }
+        const { head } = await resolveRef(log, from);
+        if (rest.length === 0) {
+          const n = materializeTree(store, head);
+          console.log(`restored the working tree to ${from === "head" ? "HEAD" : from} (${n} change(s))`);
+        } else {
+          let n = 0;
+          for (const p of rest) {
+            if (materialize(store, head, p))
+              n++;
+            else
+              console.error(`not in ${from}: ${p}`);
+          }
+          console.log(`restored ${n} file(s) from ${from === "head" ? "HEAD" : from}`);
+        }
+        break;
+      }
+      case "show": {
+        const { log } = open();
+        const store = loadStore();
+        const ops = await log.history();
+        const { op } = await resolveRef(log, args[0]);
+        if (!op)
+          die("nothing to show (empty repo)");
+        const idx = ops.findIndex((o) => o.seq === op.seq);
+        let prev = emptyRoot3(store);
+        if (op.parent !== undefined) {
+          prev = op.parent;
+        } else if (op.type === "checkpoint") {
+          for (let i = idx - 1;i >= 0; i--)
+            if (ops[i].type === "checkpoint") {
+              prev = ops[i].rootAfter;
+              break;
+            }
+        } else if (idx > 0) {
+          prev = ops[idx - 1].rootAfter;
+        }
+        const kind = op.type === "checkpoint" ? "commit" : op.type;
+        console.log(`${kind} ${op.rootAfter.slice(0, 14)}   seq ${op.seq}   by ${op.by ?? "?"}${op.message ? `
+
+    ` + op.message : ""}
+`);
+        printTreeDiff(diffTrees(store, prev, op.rootAfter));
+        break;
+      }
+      case "blame": {
+        const path = args[0] || die("blame needs a path");
+        const ops = await open().repo.history();
+        const lines2 = blameFile(ops, loadStore(), path);
+        if (!lines2.length)
+          die("no history for " + path);
+        for (const t of lines2)
+          console.log(`${String(t.seq).padStart(4)} ${(t.by ?? "?").padEnd(16)} ${t.line}`);
+        break;
+      }
+      case "fsck": {
+        const { log } = open();
+        const store = loadStore();
+        const head = await log.head();
+        const ops = await log.history();
+        let chainOk = true;
+        let chainErr = "";
+        try {
+          for (let i = 0;i < ops.length; i++)
+            if (ops[i].seq !== i + 1)
+              throw new Error("gap before seq " + (i + 1));
+          verifyChain(ops);
+        } catch (e) {
+          chainOk = false;
+          chainErr = String(e?.message ?? e);
+        }
+        const missing = [];
+        if (head) {
+          const seen = new Set;
+          const walk = (h) => {
+            if (seen.has(h))
+              return;
+            seen.add(h);
+            const node = store.get(h);
+            if (!node) {
+              missing.push(h);
+              return;
+            }
+            if (node.kind === "tree")
+              for (const e of Object.values(node.entries))
+                walk(e.hash);
+          };
+          walk(head);
+        }
+        const ok = chainOk && missing.length === 0;
+        console.log(`fsck: ${ok ? "OK" : "PROBLEMS FOUND"}`);
+        console.log(`  op-log: ${ops.length} op(s), chain ${chainOk ? "valid + contiguous" : "BROKEN \u2014 " + chainErr}`);
+        console.log(`  head:   ${head ? head.slice(0, 16) : "(empty)"}, ${missing.length} missing object(s)`);
+        for (const mh of missing)
+          console.log("    missing " + mh);
+        process.exitCode = ok ? 0 : 1;
+        break;
+      }
+      case "gc": {
+        const { log } = open();
+        const store = loadStore();
+        const ops = await log.history();
+        const reachable = new Set;
+        const walk = (h) => {
+          if (reachable.has(h))
+            return;
+          const node = store.get(h);
+          if (!node)
+            return;
+          reachable.add(h);
+          if (node.kind === "tree")
+            for (const e of Object.values(node.entries))
+              walk(e.hash);
+        };
+        for (const op of ops)
+          walk(op.rootAfter);
+        const objDir = join9(solDir2, "objects");
+        let removed = 0;
+        for (const name of readdirSync7(objDir)) {
+          if (name.endsWith(".tmp") || !reachable.has(name)) {
+            unlinkSync6(join9(objDir, name));
+            removed++;
+          }
+        }
+        console.log(`gc: kept ${reachable.size} object(s), removed ${removed} unreachable`);
+        break;
+      }
+      case "ignore": {
+        const pat = args.join(" ").trim();
+        if (!pat) {
+          for (const p of ignorePatterns2())
+            console.log(p);
+          break;
+        }
+        const f = join9(cwd2, ".solignore");
+        const lead = existsSync9(f) && !readFileSync9(f, "utf8").endsWith(`
+`) ? `
+` : "";
+        appendFileSync4(f, lead + pat + `
+`);
+        console.log("ignoring: " + pat);
+        break;
+      }
+      case "seal": {
+        const { repo } = open();
+        const path = args[0] || die("usage: sol seal <path> [recipient...]");
+        const recipients = args.slice(1);
+        if (!recipients.includes(actor2))
+          recipients.push(actor2);
+        let content = await repo.readFile(path);
+        if (content === SEALED2)
+          die("already sealed: " + path);
+        if (content === undefined) {
+          const abs = join9(cwd2, path);
+          if (!existsSync9(abs))
+            die("no such file: " + path);
+          content = readFileSync9(abs, "utf8");
+        }
+        const ring = loadKeyRing();
+        await new SealedClient(repo, ring).seal(path, content, recipients);
+        saveKeyRing(ring);
+        console.log(`sealed ${path} to ${recipients.join(", ")} \u2014 content is now host-blind ciphertext (the keystore stays local)`);
+        break;
+      }
+      case "branch":
+      case "branches": {
+        const { log } = open();
+        const refs = await loadRefs(log);
+        if (cmd === "branches" || !args[0]) {
+          for (const [n, b] of Object.entries(refs.branches))
+            console.log(`${n === refs.current ? "* " : "  "}${n}  ${(b.head || "empty").slice(0, 12)}`);
+          break;
+        }
+        const name = args[0];
+        if (refs.branches[name] || refs.tags[name])
+          die("already exists: " + name);
+        let head = await log.head() ?? "";
+        if (args[1]) {
+          const resolved = refs.branches[args[1]]?.head ?? refs.tags[args[1]] ?? (args[1].startsWith("h_") ? args[1] : "");
+          if (!resolved)
+            die(`cannot resolve ref '${args[1]}' \u2014 use a branch/tag name or a commit hash`);
+          head = resolved;
+        }
+        refs.branches[name] = { head, base: head };
+        saveRefs(refs);
+        console.log(`branch ${name} at ${(head || "empty").slice(0, 12)}`);
+        break;
+      }
+      case "tag": {
+        const { log } = open();
+        const refs = await loadRefs(log);
+        if (!args[0]) {
+          for (const [n, h] of Object.entries(refs.tags))
+            console.log(`${n}  ${h.slice(0, 12)}`);
+          break;
+        }
+        const name = args[0];
+        if (refs.branches[name] || refs.tags[name])
+          die("already exists: " + name);
+        refs.tags[name] = await log.head() ?? "";
+        saveRefs(refs);
+        console.log(`tag ${name} at ${(refs.tags[name] || "empty").slice(0, 12)}`);
+        break;
+      }
+      case "switch": {
+        const { repo, log } = open();
+        const name = args[0] || die("switch needs a branch name");
+        const refs = await loadRefs(log);
+        const target = refs.branches[name];
+        if (!target)
+          die(`no such branch: ${name} (run \`sol branch ${name}\` to create it)`);
+        const fromHead = await repo.head();
+        const wc = workingChanges(loadStore(), fromHead);
+        if (wc.added.length + wc.modified.length + wc.removed.length > 0) {
+          die('you have uncommitted changes \u2014 commit them first (`sol commit "msg"`), then switch. your work is safe on disk.');
+        }
+        setOpLogHead(target.head);
+        refs.current = name;
+        saveRefs(refs);
+        const n = materializeDiff(loadStore(), fromHead, target.head);
+        console.log(`switched to ${name} (${(target.head || "empty").slice(0, 12)}); working tree = ${n} file(s)`);
+        break;
+      }
+      case "merge": {
+        const { repo, log } = open();
+        const name = args[0] || die("merge needs a branch name");
+        const refs = await loadRefs(log);
+        const other = refs.branches[name];
+        if (!other)
+          die("no such branch: " + name);
+        if (name === refs.current)
+          die("cannot merge a branch into itself");
+        const mc = workingChanges(loadStore(), await repo.head());
+        if (mc.added.length + mc.modified.length + mc.removed.length > 0) {
+          die("you have uncommitted changes \u2014 commit them first, then merge.");
+        }
+        const ours = await log.head() ?? "";
+        const store = loadStore();
+        const result = merge({ store }, other.base, ours, other.head);
+        if (result.conflicts.length) {
+          materializeTree(store, result.head);
+          writeFileSync9(join9(solDir2, "MERGE_HEAD"), other.head);
+          console.log(`merge ${name} -> ${result.conflicts.length} conflict(s), left in your working tree (uncommitted):`);
+          for (const c of result.conflicts)
+            console.log("  " + c.path);
+          console.log("resolve the <<<<<<< markers, then `sol commit`");
+          process.exitCode = 1;
+          break;
+        }
+        await persistTree(store, new FileStore(solDir2), result.head);
+        await appendCommit(log, result.head, `merge ${name} into ${refs.current}`, ours, other.head);
+        refs.branches[refs.current].head = result.head;
+        refs.branches[name].base = other.head;
+        saveRefs(refs);
+        setOpLogHead(result.head);
+        materializeTree(store, result.head);
+        console.log(`merged ${name} into ${refs.current} cleanly -> ${result.head.slice(0, 12)}`);
+        break;
+      }
+      case "remote": {
+        if (!existsSync9(solDir2))
+          die("not a sol repo");
+        if (args[0]) {
+          const repoName = args[1] || die("usage: sol remote <url> <repo>");
+          saveRemote(solDir2, { url: args[0], repo: repoName });
+          console.log(`remote set: ${args[0]} (repo ${repoName})`);
+          break;
+        }
+        const cfg = loadRemote(solDir2);
+        console.log(cfg ? `${cfg.url} (repo ${cfg.repo}${cfg.forkParent ? `, fork of ${cfg.forkParent}` : ""})` : "(no remote \u2014 `sol remote <url> <repo>` or `sol clone`)");
+        break;
+      }
+      case "auth": {
+        const sub = args[0];
+        if (sub === "login") {
+          const webUrl = (args[1] || "https://auth.midsummer.new").replace(/\/+$/, "");
+          const osLabel = { darwin: "macOS", win32: "Windows", linux: "Linux" }[platform2()] ?? platform2();
+          const deviceLabel = `${osLabel} \xB7 ${hostname()}`;
+          const codeRes = await fetch(`${webUrl}/api/auth/device/code`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ deviceLabel })
+          });
+          if (!codeRes.ok)
+            die(`could not reach ${webUrl} (device/code -> ${codeRes.status})`);
+          const { code, authorizeUrl, verification_uri_complete, interval } = await codeRes.json();
+          const openUrl = verification_uri_complete || `${authorizeUrl || `${webUrl}/cli/authorize`}?code=${encodeURIComponent(code)}`;
+          console.log(`
+  To sign in, open:  ${openUrl}`);
+          console.log(`  (code, for reference:  ${code})
+`);
+          console.log("  Waiting for approval...");
+          const deadline = Date.now() + 5 * 60 * 1000;
+          let tokens;
+          while (Date.now() < deadline) {
+            await new Promise((r) => setTimeout(r, (interval || 2) * 1000));
+            const pr = await (await fetch(`${webUrl}/api/auth/device/poll`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ code }) })).json();
+            if (pr.status === "approved" && pr.accessToken) {
+              tokens = { accessToken: pr.accessToken, refreshToken: pr.refreshToken ?? "" };
+              break;
+            }
+            if (pr.status === "expired")
+              die("the code expired \u2014 run `sol auth login` again");
+          }
+          if (!tokens)
+            die("timed out waiting for approval");
+          mkdirSync7(dirname5(CRED_PATH), { recursive: true });
+          writeFileSync9(CRED_PATH, JSON.stringify({ webUrl, ...tokens }, null, 2), { mode: 384 });
+          const c = tokenClaims(tokens.accessToken);
+          console.log(`
+  Logged in as ${c.handle ? `@${c.handle}` : c.email || "user"}.`);
+          if (!c.handle)
+            console.log("  (no handle yet \u2014 set one in the web app to get your <handle>/<repo> namespace)");
+        } else if (sub === "logout") {
+          if (existsSync9(CRED_PATH))
+            unlinkSync6(CRED_PATH);
+          console.log("logged out");
+        } else if (sub === "status" || !sub) {
+          if (process.env.SOL_TOKEN) {
+            const c2 = tokenClaims(process.env.SOL_TOKEN);
+            console.log(`authenticated via SOL_TOKEN (env)${c2.handle ? ` as @${c2.handle}` : ""}`);
+            break;
+          }
+          if (!existsSync9(CRED_PATH)) {
+            console.log("not logged in \u2014 run `sol auth login` (or set SOL_TOKEN)");
+            break;
+          }
+          const creds = JSON.parse(readFileSync9(CRED_PATH, "utf8"));
+          const c = tokenClaims(creds.accessToken || "");
+          const stale = typeof c.exp === "number" && c.exp * 1000 < Date.now();
+          console.log(`logged in as ${c.handle ? `@${c.handle}` : c.email || "user"} via ${creds.webUrl}${stale ? " (token stale \u2014 refreshes on next use)" : ""}`);
+        } else if (sub === "whoami") {
+          const token = process.env.SOL_TOKEN || await loadStoredToken();
+          if (!token)
+            die("not logged in \u2014 run `sol auth login` (or set SOL_TOKEN)");
+          const res = await fetch(`${authHost()}/api/auth/me`, { headers: { authorization: `Bearer ${token}` } });
+          if (res.status === 401)
+            die("not logged in \u2014 your session expired; run `sol auth login` again");
+          if (!res.ok)
+            die(`could not reach ${authHost()} (me -> ${res.status})`);
+          const me = await res.json();
+          console.log(me.handle ? `signed in as @${me.handle}  ${me.email ?? ""}`.trimEnd() : `signed in${me.email ? ` as ${me.email}` : ""} \u2014 no handle yet (\`sol auth set-handle <name>\`)`);
+        } else if (sub === "set-handle") {
+          const want = args[1] || die("usage: sol auth set-handle <name>");
+          const handle = want.toLowerCase();
+          const token = process.env.SOL_TOKEN || await loadStoredToken();
+          if (!token)
+            die("not logged in \u2014 run `sol auth login` (or set SOL_TOKEN)");
+          let hadHandle = false;
+          try {
+            const meRes = await fetch(`${authHost()}/api/auth/me`, { headers: { authorization: `Bearer ${token}` } });
+            if (meRes.ok)
+              hadHandle = Boolean((await meRes.json()).handle);
+          } catch {}
+          const res = await fetch(`${authHost()}/api/auth/handle`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify({ handle }) });
+          if (res.status === 401)
+            die("not logged in \u2014 your session expired; run `sol auth login` again");
+          if (!res.ok) {
+            let msg = `could not set handle (${res.status})`;
+            try {
+              const err = await res.json();
+              if (err.error?.message)
+                msg = err.error.message;
+            } catch {}
+            die(msg);
+          }
+          const out = await res.json();
+          if (hadHandle)
+            console.log("heads-up: changing your handle re-namespaces your repos under the new <handle>/<repo>.");
+          console.log(`handle set to @${out.handle}`);
+        } else if (sub === "pat") {
+          if (!existsSync9(CRED_PATH))
+            die("run `sol auth login` first");
+          const creds = JSON.parse(readFileSync9(CRED_PATH, "utf8"));
+          const token = await loadStoredToken();
+          if (!token || !creds.webUrl)
+            die("run `sol auth login` first");
+          const patAction = args[1];
+          if (patAction === "list") {
+            const res = await fetch(`${creds.webUrl}/api/auth/pat`, { headers: { authorization: `Bearer ${token}` } });
+            if (!res.ok)
+              die(`could not list PATs (${res.status})`);
+            const { tokens } = await res.json();
+            if (!tokens.length) {
+              console.log("(no personal access tokens \u2014 `sol auth pat [days] [name]` to mint one)");
+              break;
+            }
+            for (const t of tokens) {
+              const state = t.revokedAt ? "revoked" : t.expiresAt < Date.now() ? "expired" : "active";
+              const used = t.lastUsedAt ? `, last used ${new Date(t.lastUsedAt).toISOString().slice(0, 10)}` : "";
+              console.log(`  ${t.id}  ${t.name.padEnd(20)} [${state}]  expires ${new Date(t.expiresAt).toISOString().slice(0, 10)}${used}`);
+            }
+          } else if (patAction === "revoke") {
+            const id = args[2] || die("usage: sol auth pat revoke <id>");
+            const res = await fetch(`${creds.webUrl}/api/auth/pat`, { method: "DELETE", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify({ id }) });
+            if (res.status === 404)
+              die(`no such PAT (or not yours): ${id}`);
+            if (!res.ok)
+              die(`could not revoke PAT (${res.status})`);
+            const out = await res.json();
+            console.log(`revoked PAT ${id}${out.edgePropagated === false ? " (DB only \u2014 edge KV not configured; valid at the edge until expiry)" : ""}`);
+          } else {
+            const days = Number(patAction) || 90;
+            const name = (Number(patAction) ? args[2] : patAction) || undefined;
+            const res = await fetch(`${creds.webUrl}/api/auth/pat`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify({ days, ...name ? { name } : {} }) });
+            if (!res.ok)
+              die(`could not mint a PAT (${res.status})`);
+            const out = await res.json();
+            console.log(`
+  Personal Access Token "${out.name}" (id ${out.id}, expires in ${days} days) \u2014 store it now, it is not shown again:
+`);
+            console.log(`    ${out.token}
+`);
+            console.log("  Use it for git or CI (no device flow needed):");
+            console.log("    git clone https://x:<token>@<sol-backend>/git/<owner>/<repo>");
+            console.log("    export SOL_TOKEN=<token>");
+            console.log(`
+  Manage:  sol auth pat list   |   sol auth pat revoke ${out.id}`);
+          }
+        } else {
+          die("usage: sol auth [login [<web-url>] | logout | status | whoami | set-handle <name> | pat [days] [name] | pat list | pat revoke <id>]");
+        }
+        break;
+      }
+      case "clone": {
+        const [url, rest] = remoteUrlArg(args);
+        const repoName = rest[0] || die("usage: sol clone [<url>] <owner>/<repo> [dir]");
+        const token = process.env.SOL_TOKEN || die("set SOL_TOKEN to the backend bearer token");
+        const target = resolve3(cwd2, rest[1] || repoName.split("/").pop() || repoName);
+        const fdir = join9(target, ".sol");
+        if (existsSync9(fdir))
+          die("already a sol repo: " + target);
+        const cfg = { url, repo: repoName };
+        const bundle = await remoteExport(cfg, token);
+        mkdirSync7(fdir, { recursive: true });
+        await writeBundle(fdir, bundle, 0);
+        saveRemote(fdir, cfg);
+        const srvRefs = bundle.refs ?? { branches: { main: bundle.head ?? "" }, production: "main" };
+        const checkout = bundle.checkout ?? { branch: srvRefs.production || "main", head: srvRefs.branches[srvRefs.production] ?? bundle.head };
+        const onBranch = checkout.branch;
+        const checkoutHead = checkout.head ?? bundle.head ?? "";
+        const cloneBranches = {};
+        for (const [name, h] of Object.entries(srvRefs.branches))
+          cloneBranches[name] = { head: h, base: h, remote: h };
+        if (!cloneBranches[onBranch])
+          cloneBranches[onBranch] = { head: checkoutHead, base: checkoutHead, remote: checkoutHead };
+        writeFileSync9(join9(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
+        writeFileSync9(join9(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: bundle.seq, logTip: bundle.tip }));
+        const store = new Store2;
+        for (const node of bundle.nodes)
+          store.put(node);
+        let n = 0;
+        if (checkoutHead) {
+          for (const f of listAll3(store, checkoutHead)) {
+            const abs = resolve3(target, f);
+            if (abs !== target && !abs.startsWith(target + sep3))
+              continue;
+            const blob = fileAt3(store, checkoutHead, f);
+            if (!blob)
+              continue;
+            mkdirSync7(dirname5(abs), { recursive: true });
+            writeFileSync9(abs, blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+            n++;
+          }
+        }
+        console.log(`cloned ${repoName} -> ${rest[1] || repoName} (${bundle.ops.length} ops, ${Object.keys(cloneBranches).length} branch(es), ${n} files, on ${onBranch})`);
+        break;
+      }
+      case "push": {
+        const { log } = open();
+        const cfg = resolveRemote(solDir2) || die("no remote \u2014 set one with `sol remote <url> <repo>`");
+        const token = process.env.SOL_TOKEN || die("set SOL_TOKEN");
+        const rh = await remoteHead(cfg, token);
+        const ops = await log.history();
+        const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
+        const localTip = await log.logTip();
+        const localRefs = existsSync9(refsPath()) ? JSON.parse(readFileSync9(refsPath(), "utf8")) : undefined;
+        const branch = localRefs?.current ?? "main";
+        const branchHead = await log.head() ?? "";
+        if (localSeq === rh.seq && localTip === rh.tip) {
+          console.log("everything up to date");
+          break;
+        }
+        if (rh.seq > 0) {
+          const atRemote = ops.find((o) => o.seq === rh.seq);
+          if (!atRemote || atRemote.entryHash !== rh.tip)
+            die("push rejected \u2014 the remote has changes you don't have (run `sol pull` first)");
+        }
+        if (localSeq <= rh.seq) {
+          console.log("nothing to push");
+          break;
+        }
+        let res;
+        try {
+          res = await remotePush(cfg, token, { nodes: allLocalNodes(), ops: ops.filter((o) => o.seq > rh.seq), branch, head: branchHead, expectedHead: localRefs?.branches[branch]?.remote });
+        } catch (e) {
+          if (String(e?.message ?? "").includes("409"))
+            die(`push rejected \u2014 branch '${branch}' moved on the remote. run \`sol pull\`, then push again.`);
+          throw e;
+        }
+        const canon = await remoteExport(cfg, token);
+        await writeBundle(solDir2, canon, 0);
+        if (existsSync9(refsPath())) {
+          const refs = JSON.parse(readFileSync9(refsPath(), "utf8"));
+          if (canon.refs) {
+            for (const [name, h] of Object.entries(canon.refs.branches)) {
+              refs.branches[name] = { head: refs.branches[name]?.head ?? h, base: refs.branches[name]?.base ?? h, remote: h };
+            }
+          }
+          if (refs.branches[branch]) {
+            refs.branches[branch].head = res.head ?? branchHead;
+            refs.branches[branch].remote = res.head ?? branchHead;
+          }
+          saveRefs(refs);
+        }
+        setOpLogHead(res.head ?? branchHead);
+        const prod = res.refs?.production;
+        console.log(`pushed ${res.applied} op(s) -> remote (branch ${branch} @ ${(res.head ?? "").slice(0, 12)})${prod ? `; production=${prod}` : ""}`);
+        break;
+      }
+      case "pull": {
+        const { log } = open();
+        const cfg = resolveRemote(solDir2) || die("no remote \u2014 set one with `sol remote <url> <repo>`");
+        const token = process.env.SOL_TOKEN || die("set SOL_TOKEN");
+        const bundle = await remoteExport(cfg, token);
+        const ops = await log.history();
+        const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
+        const localTip = await log.logTip();
+        const curBranch = existsSync9(refsPath()) ? JSON.parse(readFileSync9(refsPath(), "utf8")).current : bundle.refs?.production || "main";
+        const remoteCurHead = bundle.refs?.branches?.[curBranch] ?? bundle.head ?? "";
+        if (bundle.seq === localSeq && bundle.tip === localTip) {
+          if (bundle.refs && existsSync9(refsPath())) {
+            const lr = JSON.parse(readFileSync9(refsPath(), "utf8"));
+            const before = lr.branches[lr.current]?.head;
+            for (const [name, h] of Object.entries(bundle.refs.branches))
+              lr.branches[name] = { head: h, base: lr.branches[name]?.base ?? h, remote: h };
+            saveRefs(lr);
+            const after = lr.branches[lr.current]?.head;
+            if (after && after !== before) {
+              setOpLogHead(after);
+              materializeDiff(loadStore(), before ?? "", after);
+              console.log(`updated ${lr.current} -> ${after.slice(0, 12)} (a ref moved on the remote \u2014 merge/promote)`);
+              break;
+            }
+          }
+          console.log("already up to date");
+          break;
+        }
+        let n = 0;
+        while (n < ops.length && n < bundle.ops.length && ops[n].entryHash === bundle.ops[n].entryHash)
+          n++;
+        if (n === bundle.ops.length) {
+          console.log("up to date (local is ahead \u2014 run `sol push`)");
+          break;
+        }
+        const syncRefHead = (h) => {
+          if (!existsSync9(refsPath()))
+            return;
+          const refs = JSON.parse(readFileSync9(refsPath(), "utf8"));
+          if (refs.branches[refs.current])
+            refs.branches[refs.current].head = h;
+          saveRefs(refs);
+        };
+        {
+          const wc = workingChanges(loadStore(), await log.head() ?? "");
+          const dirty = [...wc.added.map((f) => "+ " + f), ...wc.modified.map((f) => "~ " + f), ...wc.removed.map((f) => "- " + f)];
+          if (dirty.length)
+            die(`you have uncommitted changes \u2014 commit (\`sol commit\`) or discard them before pulling:
+  ${dirty.join(`
+  `)}`);
+        }
+        if (n === ops.length) {
+          const added = await writeBundle(solDir2, bundle, localSeq);
+          syncRefHead(remoteCurHead);
+          setOpLogHead(remoteCurHead);
+          materializeTree(loadStore(), remoteCurHead);
+          if (bundle.refs && existsSync9(refsPath())) {
+            const lr = JSON.parse(readFileSync9(refsPath(), "utf8"));
+            for (const [name, h] of Object.entries(bundle.refs.branches))
+              lr.branches[name] = { head: h, base: lr.branches[name]?.base ?? h, remote: h };
+            saveRefs(lr);
+          }
+          console.log(`pulled ${added} new op(s) -> ${curBranch} now at ${(remoteCurHead || "").slice(0, 12)}`);
+          break;
+        }
+        const store = loadStore();
+        for (const node of bundle.nodes)
+          store.put(node);
+        const base = n > 0 ? ops[n - 1].rootAfter : emptyRoot3(store);
+        const localHead = await log.head() ?? "";
+        const remoteHead2 = remoteCurHead;
+        const pathAuthor = new Map;
+        for (const op of ops.slice(n))
+          if (op.by && op.path)
+            pathAuthor.set(op.path, op.by);
+        const result = merge({ store }, base, localHead, remoteHead2);
+        const conflicted = new Set(result.conflicts.map((c) => c.path));
+        await writeBundle(solDir2, bundle, 0);
+        setOpLogHead(remoteHead2);
+        const { repo: rebased } = open();
+        const d = diffTrees(store, remoteHead2, result.head);
+        for (const p of [...d.added, ...d.modified.map((m) => m.path)]) {
+          if (conflicted.has(p))
+            continue;
+          const blob = fileAt3(store, result.head, p);
+          if (!blob)
+            continue;
+          const author = pathAuthor.get(p);
+          if (blob.encoding === "base64")
+            await rebased.writeBytes(p, new Uint8Array(Buffer.from(blob.content, "base64")), undefined, author);
+          else
+            await rebased.writeFile(p, blob.content, undefined, author);
+        }
+        for (const p of d.removed)
+          if (!conflicted.has(p))
+            await rebased.deleteFile(p, undefined, pathAuthor.get(p));
+        if (!result.conflicts.length)
+          await appendCommit(log, await rebased.head(), "merge remote into local", remoteHead2);
+        const mergedHead = await log.head() ?? "";
+        syncRefHead(mergedHead);
+        materializeTree(loadStore(), mergedHead);
+        if (result.conflicts.length) {
+          for (const c of result.conflicts) {
+            const blob = fileAt3(store, result.head, c.path);
+            if (blob)
+              writeFileSync9(join9(cwd2, c.path), blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+          }
+          writeFileSync9(join9(solDir2, "MERGE_HEAD"), remoteHead2);
+          console.log(`pulled + merged WITH ${result.conflicts.length} conflict(s), left uncommitted in your working tree:`);
+          for (const c of result.conflicts)
+            console.log("  " + c.path);
+          console.log("resolve the <<<<<<< markers, then `sol commit` and `sol push`");
+          process.exitCode = 1;
+        } else {
+          console.log(`pulled + merged remote into local -> ${mergedHead.slice(0, 12)} (now run \`sol push\`)`);
+        }
+        break;
+      }
+      case "promote": {
+        if (!existsSync9(solDir2))
+          die("not a sol repo");
+        const cfg = resolveRemote(solDir2) || die("no remote \u2014 set one with `sol remote <url> <repo>`");
+        const token = process.env.SOL_TOKEN || die("set SOL_TOKEN");
+        const cur = existsSync9(refsPath()) ? JSON.parse(readFileSync9(refsPath(), "utf8")).current : "main";
+        const branch = args[0] || cur;
+        const refs = await remotePromote(cfg, token, branch);
+        console.log(`promoted '${branch}' -> production '${refs.production}' now at ${(refs.branches[refs.production] ?? "").slice(0, 12)}`);
+        break;
+      }
+      case "fork": {
+        const [url, frest] = remoteUrlArg(args);
+        const parent = frest[0] || die("usage: sol fork [<url>] <parent-repo> <new-repo> [dir]");
+        const newRepo = frest[1] || die("usage: sol fork [<url>] <parent-repo> <new-repo> [dir]");
+        const token = process.env.SOL_TOKEN || die("set SOL_TOKEN");
+        const target = resolve3(cwd2, frest[2] || newRepo);
+        const fdir = join9(target, ".sol");
+        if (existsSync9(fdir))
+          die("already a sol repo: " + target);
+        const parentCfg = { url, repo: parent };
+        const newCfg = { url, repo: newRepo, forkParent: parent };
+        const bundle = await remoteExport(parentCfg, token);
+        if (!bundle.ops.length)
+          die(`parent repo '${parent}' is empty or unreachable`);
+        const prodBranch = bundle.refs?.production || "main";
+        const prodHead = bundle.checkout?.head || bundle.head;
+        await remotePush(newCfg, token, { nodes: bundle.nodes, ops: bundle.ops, branch: prodBranch, head: prodHead });
+        for (const [name, h] of Object.entries(bundle.refs?.branches ?? {})) {
+          if (name !== prodBranch)
+            await remotePush(newCfg, token, { nodes: [], ops: [], branch: name, head: h });
+        }
+        await forkMeta(newCfg, token, parent);
+        const canon = await remoteExport(newCfg, token);
+        mkdirSync7(fdir, { recursive: true });
+        await writeBundle(fdir, canon, 0);
+        const srvRefs = canon.refs ?? { branches: { main: canon.head ?? "" }, production: "main" };
+        const checkout = canon.checkout ?? { branch: srvRefs.production || "main", head: srvRefs.branches[srvRefs.production] ?? canon.head };
+        const onBranch = checkout.branch;
+        const checkoutHead = checkout.head ?? canon.head ?? "";
+        const cloneBranches = {};
+        for (const [name, h] of Object.entries(srvRefs.branches))
+          cloneBranches[name] = { head: h, base: h, remote: h };
+        writeFileSync9(join9(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
+        writeFileSync9(join9(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: canon.seq, logTip: canon.tip }));
+        saveRemote(fdir, newCfg);
+        const store = new Store2;
+        for (const node of canon.nodes)
+          store.put(node);
+        let n = 0;
+        if (checkoutHead) {
+          for (const f of listAll3(store, checkoutHead)) {
+            const abs = resolve3(target, f);
+            if (abs !== target && !abs.startsWith(target + sep3))
+              continue;
+            const blob = fileAt3(store, checkoutHead, f);
+            if (!blob)
+              continue;
+            mkdirSync7(dirname5(abs), { recursive: true });
+            writeFileSync9(abs, blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+            n++;
+          }
+        }
+        console.log(`forked ${parent} -> ${newRepo}  (your copy at ${args[3] || newRepo}: ${Object.keys(cloneBranches).length} branch(es), ${n} files; parent: ${parent})`);
+        break;
+      }
+      case "access": {
+        const cfg = resolveRemote(solDir2) || die("no remote \u2014 set one with `sol remote <url> <repo>`");
+        const token = process.env.SOL_TOKEN || die("set SOL_TOKEN");
+        const sub = args[0];
+        if (!sub || sub === "show") {
+          const a = await accessGet(cfg, token);
+          console.log(`${cfg.repo}: ${a.visibility}`);
+          const cols = Object.entries(a.collaborators);
+          if (cols.length)
+            for (const [u, r] of cols)
+              console.log(`  ${u}: ${r}`);
+          else
+            console.log("  (no collaborators)");
+        } else if (sub === "public" || sub === "private") {
+          const a = await accessSet(cfg, token, { visibility: sub });
+          console.log(`${cfg.repo} is now ${a.visibility}`);
+        } else if (sub === "add") {
+          const userId = args[1] || die("usage: sol access add <userId> <read|write|admin>");
+          const role = args[2] || "read";
+          if (role !== "read" && role !== "write" && role !== "admin")
+            die(`invalid role '${role}' \u2014 use read, write, or admin`);
+          const a = await accessSet(cfg, token, { collaborator: { userId, role } });
+          if (a.collaborators?.[userId] === role)
+            console.log(`granted ${role} to ${userId} on ${cfg.repo}`);
+          else
+            die(`failed to grant ${role} to ${userId} (the server did not apply it)`);
+        } else if (sub === "remove") {
+          const userId = args[1] || die("usage: sol access remove <userId>");
+          await accessSet(cfg, token, { collaborator: { userId, remove: true } });
+          console.log(`removed ${userId} from ${cfg.repo}`);
+        } else {
+          die("usage: sol access [show | public | private | add <userId> <role> | remove <userId>]");
+        }
+        break;
+      }
+      case "forks": {
+        const cfg = resolveRemote(solDir2) || die("no remote \u2014 set one with `sol remote <url> <repo>`");
+        const token = process.env.SOL_TOKEN || die("set SOL_TOKEN");
+        const { forks } = await forksList(cfg, token);
+        if (!forks.length)
+          console.log(`(no forks of ${cfg.repo})`);
+        else {
+          console.log(`forks of ${cfg.repo}:`);
+          for (const f of forks)
+            console.log(`  ${f.repo}`);
+        }
+        break;
+      }
+      case "mr": {
+        const cfg = resolveRemote(solDir2) || die("no remote \u2014 set one with `sol remote <url> <repo>`");
+        const token = process.env.SOL_TOKEN || die("set SOL_TOKEN");
+        const sub = args[0];
+        const localRefs = () => existsSync9(refsPath()) ? JSON.parse(readFileSync9(refsPath(), "utf8")) : { current: "main", branches: {}, tags: {} };
+        const flag = (name) => {
+          const i = args.indexOf(name);
+          return i >= 0 ? args[i + 1] : undefined;
+        };
+        const has = (name) => args.includes(name);
+        const idArg = () => +(args[1] || die("this `sol pr` command needs an <id>"));
+        if (sub === "open") {
+          const refs = localRefs();
+          const fromBranch = flag("--from") || refs.current;
+          const fromHead = refs.branches[fromBranch]?.head;
+          const upstream = flag("--upstream") || (has("--upstream") ? cfg.forkParent : undefined);
+          const target = upstream ? { url: cfg.url, repo: upstream } : cfg;
+          const pr = await mrOpen(target, token, { fromRepo: upstream ? cfg.repo : undefined, fromBranch, fromHead, toBranch: flag("--to"), title: flag("-t") || flag("--title"), body: flag("-m") || flag("--body") });
+          const where = upstream ? `${cfg.repo}/${pr.fromBranch} -> ${upstream}/${pr.toBranch}` : `${pr.fromBranch} -> ${pr.toBranch}`;
+          console.log(`opened MR #${pr.id}${upstream ? ` on ${upstream}` : ""}: ${pr.title}  (${where})`);
+        } else if (sub === "list") {
+          const { mrs } = await mrList(cfg, token);
+          if (!mrs.length)
+            console.log("(no merge requests)");
+          for (const p of mrs)
+            console.log(`#${p.id}  [${p.status}]  ${p.fromRepo ? `${p.fromRepo}/` : ""}${p.fromBranch} -> ${p.toBranch}  "${p.title}"  \u2014 ${mrSummary(p)}`);
+        } else if (sub === "show") {
+          const pr = await mrGet(cfg, token, idArg());
+          console.log(`MR #${pr.id}  [${pr.status}]  by ${pr.author}`);
+          console.log(`${pr.fromRepo ? `${pr.fromRepo}/` : ""}${pr.fromBranch} (${(pr.fromHead || "").slice(0, 12)}) -> ${pr.toBranch}${pr.fromRepo ? "  [cross-fork]" : ""}`);
+          console.log(pr.title);
+          if (pr.body)
+            console.log(`
+${pr.body}`);
+          console.log(`
+${mrSummary(pr)}`);
+          for (const c of pr.checks)
+            console.log(`  check ${c.name}: ${c.status}${c.detail ? ` (${c.detail.split(`
+`)[0]})` : ""}`);
+          for (const r of pr.reviews)
+            console.log(`  review ${r.actor}: ${r.verdict}${r.body ? ` \u2014 ${r.body}` : ""}`);
+          for (const c of pr.comments)
+            console.log(`  comment ${c.actor}${c.path ? ` @${c.path}:${c.line}` : ""}: ${c.body}`);
+          console.log(`
+--- diff (what would merge) ---`);
+          if (pr.fromRepo) {
+            const d = await mrDiff(cfg, token, pr.id);
+            for (const p of d.added ?? [])
+              console.log(`  + ${p}`);
+            for (const m of d.modified ?? []) {
+              const path = typeof m === "string" ? m : m.path;
+              console.log(`  ~ ${path}`);
+              const hunks2 = typeof m === "string" ? "" : m.hunks;
+              if (hunks2)
+                console.log(hunks2.split(`
+`).map((l) => "      " + l).join(`
+`));
+            }
+            for (const p of d.removed ?? [])
+              console.log(`  - ${p}`);
+            if (!((d.added?.length ?? 0) + (d.modified?.length ?? 0) + (d.removed?.length ?? 0)))
+              console.log("  (no changes)");
+          } else {
+            const toHead = localRefs().branches[pr.toBranch]?.head;
+            if (toHead && pr.fromHead) {
+              try {
+                printTreeDiff(diffTrees(loadStore(), toHead, pr.fromHead));
+              } catch {
+                console.log("(run `sol pull` to compute the diff locally)");
+              }
+            }
+          }
+        } else if (sub === "review") {
+          const verdict = has("--approve") ? "approve" : has("--request-changes") ? "request-changes" : "comment";
+          const pr = await mrAction(cfg, token, "review", { id: idArg(), verdict, body: flag("-m") ?? "" });
+          console.log(`reviewed MR #${pr.id}: ${verdict}`);
+        } else if (sub === "comment") {
+          const line = flag("--line");
+          const pr = await mrAction(cfg, token, "comment", { id: idArg(), body: flag("-m") ?? "", path: flag("--path"), line: line ? +line : undefined });
+          console.log(`commented on MR #${pr.id}`);
+        } else if (sub === "check") {
+          const id = idArg();
+          if (has("--run")) {
+            const dashes = args.indexOf("--");
+            if (dashes < 0 || args.length <= dashes + 1)
+              die("usage: sol mr check <id> --run -- <test command>");
+            const cmd2 = args.slice(dashes + 1);
+            const name = flag("--name") || cmd2.join(" ");
+            let status = "pass";
+            let detail = "";
+            try {
+              execFileSync2(cmd2[0], cmd2.slice(1), { cwd: cwd2, stdio: "pipe" });
+            } catch (e) {
+              status = "fail";
+              const err = e;
+              detail = (err.stdout?.toString() || err.message || "").slice(-200);
+            }
+            const pr = await mrAction(cfg, token, "check", { id, name, status, detail });
+            console.log(`check '${name}' on MR #${pr.id}: ${status}`);
+          } else {
+            const name = flag("--name") || "check";
+            const status = flag("--status") || "pending";
+            await mrAction(cfg, token, "check", { id, name, status, detail: flag("--detail") });
+            console.log(`reported check '${name}' = ${status} on MR #${id}`);
+          }
+        } else if (sub === "merge") {
+          const id = idArg();
+          try {
+            const pr = await mrAction(cfg, token, "merge", { id, force: has("--force") });
+            console.log(`merged MR #${pr.id} -> ${pr.toBranch} now at ${(pr.mergeHead || "").slice(0, 12)} (run \`sol pull\` to sync)`);
+          } catch (e) {
+            const msg = String(e.message).replace(/^remote \/mr\/merge -> \d+: /, "");
+            let clean = msg;
+            try {
+              const j = JSON.parse(msg);
+              clean = j.reasons?.length ? `${j.error}: ${j.reasons.join("; ")} \u2014 use \`--force\` to override` : j.error;
+            } catch {}
+            die(clean);
+          }
+        } else if (sub === "close") {
+          const pr = await mrAction(cfg, token, "close", { id: idArg() });
+          console.log(`closed MR #${pr.id}`);
+        } else {
+          die("usage: sol mr open|list|show <id>|review <id>|comment <id>|check <id>|merge <id>|close <id>");
+        }
+        break;
+      }
+      case "watch": {
+        const { repo, log } = open();
+        const tick = async (announce) => {
+          const release2 = acquireLock();
+          let changed = 0;
+          try {
+            const snap = await snapshotTree(repo);
+            changed = snap.changed;
+            if (changed) {
+              await appendCapture(log, snap.root);
+              writeWorkingIndex(await repo.list());
+            }
+          } finally {
+            release2();
+          }
+          const t = new Date().toLocaleTimeString();
+          if (changed)
+            console.log(`[${t}] auto-captured ${changed} change(s) -> ${(await repo.head()).slice(0, 12)}`);
+          else if (announce)
+            console.log(`[${t}] working tree already up to date`);
+        };
+        await tick(true);
+        console.log(`sol watching ${cwd2}
+  every change is auto-captured into the op-log \u2014 nothing is lost, even if you never commit.
+  run \`sol commit "msg"\` any time to mark a milestone. Ctrl-C to stop.`);
+        let timer;
+        watch(cwd2, { recursive: true }, (_e, filename) => {
+          if (!filename)
+            return;
+          const top = String(filename).split(sep3)[0];
+          if (top === ".sol" || DEFAULT_IGNORE2.includes(top))
+            return;
+          clearTimeout(timer);
+          timer = setTimeout(() => tick(false).catch((e) => console.error("sol: " + (e?.message || e))), 400);
+        });
+        await new Promise(() => {});
+        break;
+      }
+      case "run": {
+        const { repo, log } = open();
+        const keep = [];
+        const command = [];
+        let isolate = false;
+        for (let i = 0;i < args.length; i++) {
+          if (args[i] === "--keep")
+            keep.push(args[++i]);
+          else if (args[i] === "--isolate")
+            isolate = true;
+          else
+            command.push(args[i]);
+        }
+        if (!command.length)
+          die("usage: sol run [--keep <path>] [--isolate] <command...>");
+        const head = await repo.head();
+        const dir = mkdtempSync(join9(tmpdir(), "sol-run-"));
+        try {
+          const hn = hydrate2(loadStore(), head, dir);
+          console.log(`hydrated ${hn} file(s) -> sandbox${isolate ? " (isolated: no network, writes confined to the sandbox)" : ""}`);
+          const argv2 = isolate ? isolateCommand(command, dir) : command;
+          console.log(`$ ${command.join(" ")}`);
+          let failed = 0;
+          try {
+            execFileSync2(argv2[0], argv2.slice(1), { cwd: dir, stdio: "inherit" });
+          } catch (e) {
+            failed = typeof e?.status === "number" ? e.status : 1;
+          }
+          if (failed) {
+            console.error(`(command failed with exit ${failed}; nothing captured)`);
+            process.exitCode = failed;
+            break;
+          }
+          const { written, deleted } = await capture(repo, dir, keep);
+          if (written.length || deleted.length) {
+            await appendCommit(log, await repo.head(), `run: ${command.join(" ")}`, head);
+            if (existsSync9(refsPath())) {
+              const refs = JSON.parse(readFileSync9(refsPath(), "utf8"));
+              if (refs.branches[refs.current]) {
+                refs.branches[refs.current].head = await repo.head();
+                saveRefs(refs);
+              }
+            }
+            const synced = loadStore();
+            const nh = await repo.head();
+            for (const f of written)
+              materialize(synced, nh, f);
+            for (const f of deleted) {
+              try {
+                unlinkSync6(join9(cwd2, f));
+              } catch {}
+            }
+            console.log(`captured ${written.length} written, ${deleted.length} deleted file(s):`);
+            for (const f of written)
+              console.log("  + " + f);
+            for (const f of deleted)
+              console.log("  - " + f);
+          } else {
+            console.log("no files captured (the run produced no tracked changes)");
+          }
+        } finally {
+          rmSync(dir, { recursive: true, force: true });
+        }
+        break;
+      }
+      case "git": {
+        const sub = args[0];
+        if (sub === "import") {
+          const gitPath = resolve3(cwd2, args[1] || die("usage: sol git import <git-repo> [dir]"));
+          const target = resolve3(cwd2, args[2] || basename(gitPath));
+          const fdir = join9(target, ".sol");
+          if (existsSync9(fdir))
+            die("already a sol repo: " + target);
+          mkdirSync7(fdir, { recursive: true });
+          const { commits, branches, head, current } = await importGitRepo(gitPath, fdir);
+          const refsBranches = {};
+          for (const b of branches)
+            refsBranches[b.name] = { head: b.head, base: b.head };
+          if (!refsBranches[current])
+            refsBranches[current] = { head, base: head };
+          refsBranches[current].head = head;
+          writeFileSync9(join9(fdir, "refs.json"), JSON.stringify({ current, branches: refsBranches, tags: {} }, null, 2));
+          const store = new Store2;
+          for (const name of readdirSync7(join9(fdir, "objects"))) {
+            if (name.endsWith(".tmp"))
+              continue;
+            try {
+              store.put(decodeObject(readFileSync9(join9(fdir, "objects", name))));
+            } catch {}
+          }
+          const onDisk = hydrate2(store, head, target);
+          console.log(`imported ${commits} commit(s), ${branches.length} branch(es) from git -> ${args[2] || basename(gitPath)} (${onDisk} files; on branch ${current})`);
+        } else if (sub === "export") {
+          const { log } = open();
+          const gitPath = resolve3(cwd2, args[1] || die('usage: sol git export <git-repo> [-m "msg"]'));
+          const mi = args.indexOf("-m");
+          const store = loadStore();
+          const head = await log.head() ?? "";
+          const closed = groupIntoUnits(await log.history()).filter((u) => !u.open);
+          const msg = mi >= 0 ? args[mi + 1] : closed.length ? closed[closed.length - 1].label ?? "sol export" : "sol export";
+          const { written, deleted } = exportToGit(store, head, gitPath, msg ?? "sol export");
+          console.log(`exported ${written} file(s), ${deleted} deleted -> git commit in ${args[1]} (now \`git push\`)`);
+        } else {
+          die('usage: sol git import <repo> [dir]   |   sol git export <repo> [-m "msg"]');
+        }
+        break;
+      }
+      default:
+        if (cmd && cmd !== "help" && cmd !== "-h" && cmd !== "--help") {
+          console.error("sol: unknown command: " + cmd + `
+`);
+          process.exitCode = 1;
+        }
+        console.log(`sol \u2014 local content-addressed VCS (the new git)
+
+the model: edit files freely, then commit \u2014 or run \`sol watch\` and every change is captured
+automatically. there is NO separate "git add".
+
+everyday (examples are copy-safe \u2014 use real filenames):
+  sol init                       create a repo in ./.sol
+  sol watch                      AUTO-CAPTURE every change (run once; nothing is ever lost)
+  sol run npm test               hydrate to a sandbox, run, capture outputs (--isolate to confine)
+  sol commit "what changed"      commit the whole tree (SINGLE-AUTHOR; -m "msg" file.ts scopes to files)
+  sol status                     current branch + uncommitted changes
+  sol log                        commit history              (sol log --all for every op)
+  sol diff                       working-tree changes        (sol diff main feature between refs)
+  sol show 5                     a commit's message + its diff
+  sol restore --from 3 app.py    put a file (or the whole tree) back from a ref
+  sol blame todo/cli.py          who/which commit last touched each line
+  sol ls / sol cat README.md   list tracked files / print one
+  sol rm old.txt                 delete a file (from the repo and disk)
+  sol ignore "*.tmp"             add an ignore pattern (no arg lists the active patterns)
+  sol fsck / sol gc            verify integrity / drop unreachable objects
+
+branches & tags:
+  sol branch                     list branches (sol branch feature creates one at HEAD)
+  sol switch feature             switch to a branch (captures current work first, never loses it)
+  sol merge feature              3-way merge a branch in (conflicts land in the working tree)
+  sol tag v1                     mark an immutable label at HEAD
+
+auth (sign in once; remote commands then use the cached token, no SOL_TOKEN needed):
+  sol auth login [<web-url>]     device-flow sign-in via the Midsummer web app; caches the token ~/.sol/credentials
+  sol auth whoami                print the identity behind the cached token (signed in as @<handle>)
+  sol auth set-handle <name>     choose your @handle \u2014 the <owner> in <owner>/<repo> (changing it re-namespaces repos)
+  sol auth pat [days]            mint a long-lived Personal Access Token for git/CI (default 90 days)
+  sol auth status / logout       show who you're signed in as / clear the cached token
+
+remotes (self-hostable backend; token in SOL_TOKEN or via sol auth login):
+  sol clone [<url>] <owner>/<repo> [dir]   clone a remote repo (checks out PRODUCTION); default dir = <repo>
+  sol push / sol pull          sync your commits with the remote (push registers your branch's head)
+  sol promote [branch]         point the remote's production branch at <branch> (default: current)
+  sol remote <url> <repo>        set the remote (no arg: show it; url defaults to the hosted Sol)
+  sol fork [<url>] <parent> <new> [dir]   make your own copy of a repo (all branches + history + a parent link)
+  sol forks                      list the forks of the current repo
+  sol access [show|public|private|add <userId> <role>|remove <userId>]   manage repo visibility + collaborators
+
+merge requests (propose a branch's commits to merge; reviews + CI checks):
+  sol mr open [--from B] [--to B] -t "title" [-m body]   open an MR (from=current branch, to=production)
+  sol mr list                  list MRs (open/merged/closed)
+  sol mr show <id>             metadata, reviews/checks, + the diff it would merge
+  sol mr review <id> --approve | --request-changes | --comment [-m ...]
+  sol mr check <id> --run [--name N] -- <test cmd>       run the tests, report a pass/fail check
+  sol mr merge <id> [--force]  fast-forward-merge (gated on checks + reviews; --force overrides)
+  sol mr close <id>
+
+git interop (adopt Sol without leaving GitHub):
+  sol git import <repo> [dir]    import a git repo's HEAD into a new Sol repo (modes/symlinks/binaries)
+  sol git export <repo>          write Sol's tree back as a git commit (+ deletes), then \`git push\`
+
+for concurrent agents, use scoped commits (sol commit -m "msg" file) or a per-agent workspace.
+a whole-tree commit is REFUSED when SOL_ACTOR is set (--whole-tree / SOL_ALLOW_WHOLE_TREE=1 to override).
+
+a ref is a branch/tag name, a commit hash-prefix, an op seq number, or HEAD. content is SHA-256
+addressed; history is a tamper-evident hash-chained op-log. attribute changes with SOL_ACTOR=you.`);
+    }
+  } finally {
+    release?.();
+  }
+}
+main().catch((e) => die(e?.message || String(e)));