midsummer-sol 0.2.0 → 0.2.1

package/sol.js

@@ -2034,6 +2034,52 @@ var init_seal_audience = __esm(() => {
   init_identity_store();
 });
 
+// src/bin/keyring-at-rest.ts
+import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes4, scryptSync as scryptSync3 } from "node:crypto";
+function deriveWrapKey2(recoveryCode, accountId, salt) {
+  return scryptSync3(recoveryCode.normalize("NFKD"), Buffer.concat([Buffer.from(`sol/keyring/v2\x00${accountId}\x00`), salt]), 32, KDF);
+}
+function isEnvelope(parsed) {
+  return !!parsed && typeof parsed === "object" && parsed.v === 2 && parsed.enc === "scrypt-aes-256-gcm";
+}
+function wrapContext() {
+  const id = loadIdentity();
+  const recoveryCode = process.env.SOL_RECOVERY_CODE;
+  if (!id || !recoveryCode)
+    return;
+  return { accountId: id.accountId, recoveryCode };
+}
+function encryptKeyRing(serialized) {
+  const ctx = wrapContext();
+  if (!ctx)
+    return;
+  const salt = randomBytes4(16);
+  const key = deriveWrapKey2(ctx.recoveryCode, ctx.accountId, salt);
+  const iv = randomBytes4(12);
+  const c = createCipheriv3("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([c.update(Buffer.from(JSON.stringify(serialized), "utf8")), c.final()]);
+  return { v: 2, enc: "scrypt-aes-256-gcm", accountId: ctx.accountId, salt: salt.toString("base64"), iv: iv.toString("base64"), ct: ct.toString("base64"), tag: c.getAuthTag().toString("base64") };
+}
+function decryptKeyRing(env) {
+  const recoveryCode = process.env.SOL_RECOVERY_CODE;
+  if (!recoveryCode)
+    throw new Error("keys.json is encrypted at rest but SOL_RECOVERY_CODE is unset — set it to unlock the local keyring.");
+  const key = deriveWrapKey2(recoveryCode, env.accountId, Buffer.from(env.salt, "base64"));
+  const d = createDecipheriv3("aes-256-gcm", key, Buffer.from(env.iv, "base64"));
+  d.setAuthTag(Buffer.from(env.tag, "base64"));
+  try {
+    const pt = Buffer.concat([d.update(Buffer.from(env.ct, "base64")), d.final()]).toString("utf8");
+    return JSON.parse(pt);
+  } catch {
+    throw new Error("failed to decrypt keys.json — wrong SOL_RECOVERY_CODE for this keyring, or the file was tampered.");
+  }
+}
+var KDF;
+var init_keyring_at_rest = __esm(() => {
+  init_identity_store();
+  KDF = { N: 1 << 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
+});
+
 // src/bin/lib.ts
 import {
   appendFileSync as appendFileSync2,
@@ -2221,6 +2267,16 @@ async function snapshotTree(repo) {
     if (!onDisk.has(t) && lexists(join4(cwd, t)))
       onDisk.add(t);
   const hidden = hiddenPathSet(solDir);
+  const sealedProtected = new Set;
+  for (const t of tracked) {
+    if (lexists(join4(cwd, t)))
+      continue;
+    const leaf = await repo.read(t).catch(() => {
+      return;
+    });
+    if (leaf?.kind === "sealed")
+      sealedProtected.add(t);
+  }
   const changes = [];
   for (const f of onDisk) {
     if (hidden.has(f))
@@ -2229,9 +2285,12 @@ async function snapshotTree(repo) {
     if (c)
       changes.push(c);
   }
-  for (const t of tracked)
-    if (!hidden.has(t) && !isReservedSegment(t) && !lexists(join4(cwd, t)))
+  for (const t of tracked) {
+    if (hidden.has(t) || isReservedSegment(t) || sealedProtected.has(t))
+      continue;
+    if (!lexists(join4(cwd, t)))
       changes.push({ path: t, delete: true });
+  }
   return repo.applyBatch(changes);
 }
 function sleepSync(ms) {
@@ -3041,12 +3100,15 @@ async function appendCapture(log, root) {
 }
 function loadKeyRing() {
   const ring = new KeyRing;
-  if (existsSync4(keysPath()))
-    ring.load(JSON.parse(readFileSync4(keysPath(), "utf8")));
+  if (!existsSync4(keysPath()))
+    return ring;
+  const parsed = JSON.parse(readFileSync4(keysPath(), "utf8"));
+  ring.load(isEnvelope(parsed) ? decryptKeyRing(parsed) : parsed);
   return ring;
 }
 function saveKeyRing(ring) {
-  writeFileSync4(keysPath(), JSON.stringify(ring.serialize(), null, 2), { mode: 384 });
+  const env = encryptKeyRing(ring.serialize());
+  writeFileSync4(keysPath(), JSON.stringify(env ?? ring.serialize(), null, 2), { mode: 384 });
   try {
     chmodSync3(keysPath(), 384);
   } catch {}
@@ -3066,6 +3128,7 @@ var init_lib = __esm(() => {
   init_struct();
   init_tree();
   init_seal_audience();
+  init_keyring_at_rest();
   procCwd = process.cwd();
   repoRoot = findRepoRoot(procCwd);
   cwd = repoRoot ?? procCwd;
@@ -3499,7 +3562,7 @@ __export(exports_anchor, {
   creatorPinPath: () => creatorPinPath,
   creatorFingerprint: () => creatorFingerprint
 });
-import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "node:fs";
 import { join as join9 } from "node:path";
 function repoSolDir(solDir2) {
   return solDir2;
@@ -3690,26 +3753,74 @@ function validateGenesisAnchor(solDir2) {
   }
   return out;
 }
+function readEnvFiles(solDir2) {
+  const dir = envDir(solDir2);
+  const out = {};
+  if (!existsSync9(dir))
+    return out;
+  for (const name of readdirSync3(dir, { withFileTypes: true })) {
+    if (!name.isFile() || ENVSTATE_SKIP_FILES.has(name.name))
+      continue;
+    try {
+      out[name.name] = readFileSync9(join9(dir, name.name), "utf8");
+    } catch {}
+  }
+  return out;
+}
+function readSealStanzas(solDir2) {
+  const dir = sealDir(solDir2);
+  const out = {};
+  if (!existsSync9(dir))
+    return out;
+  for (const name of readdirSync3(dir, { withFileTypes: true })) {
+    if (!name.isFile() || !name.name.endsWith(".stanzas"))
+      continue;
+    try {
+      out[name.name] = readFileSync9(join9(dir, name.name), "utf8");
+    } catch {}
+  }
+  return out;
+}
 function readEnvStateBundle(solDir2) {
   const journal = readJournal(solDir2);
   const creatorPin = readCreatorPin(solDir2);
-  if (!journal.length && !creatorPin)
+  const files = readEnvFiles(solDir2);
+  const seals = readSealStanzas(solDir2);
+  if (!journal.length && !creatorPin && !Object.keys(files).length && !Object.keys(seals).length)
     return;
   const journalHead = journal.length ? journal[journal.length - 1].entryHash : undefined;
-  return { v: 1, creatorPin, journal, journalHead, journalLen: journal.length };
+  return { v: 1, creatorPin, journal, journalHead, journalLen: journal.length, files, seals };
 }
 function writeEnvStateBundle(solDir2, bundle) {
+  mkdirSync5(envDir(solDir2), { recursive: true });
   writeJournal(solDir2, bundle.journal);
   if (bundle.creatorPin) {
     writeFileSync9(creatorPinPath(solDir2), JSON.stringify(bundle.creatorPin, null, 2), { mode: 420 });
   }
+  mkdirSync5(envDir(solDir2), { recursive: true });
+  for (const [name, contents] of Object.entries(bundle.files ?? {})) {
+    if (name.includes("/") || name.includes("\\") || name.includes("\x00"))
+      continue;
+    if (ENVSTATE_SKIP_FILES.has(name))
+      continue;
+    writeFileSync9(join9(envDir(solDir2), name), contents, { mode: 420 });
+  }
+  const seals = bundle.seals ?? {};
+  if (Object.keys(seals).length)
+    mkdirSync5(sealDir(solDir2), { recursive: true });
+  for (const [name, box] of Object.entries(seals)) {
+    if (!name.endsWith(".stanzas") || name.includes("/") || name.includes("\\") || name.includes("\x00"))
+      continue;
+    writeFileSync9(join9(sealDir(solDir2), name), box, { mode: 384 });
+  }
   updateHeadPin(solDir2);
 }
-var creatorPinPath = (solDir2) => join9(envDir(solDir2), "creator.pin"), headPinPath = (solDir2) => join9(envDir(solDir2), "head.pin");
+var creatorPinPath = (solDir2) => join9(envDir(solDir2), "creator.pin"), headPinPath = (solDir2) => join9(envDir(solDir2), "head.pin"), ENVSTATE_SKIP_FILES;
 var init_anchor = __esm(() => {
   init_store2();
   init_journal();
   init_sign();
+  ENVSTATE_SKIP_FILES = new Set(["journal.jsonl", "creator.pin", "head.pin"]);
 });
 
 // src/secret/toml.ts
@@ -4325,7 +4436,7 @@ var init_authz = __esm(() => {
 });
 
 // src/secret/model.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync as readFileSync10, statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readdirSync as readdirSync4, readFileSync as readFileSync10, statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join10 } from "node:path";
 function envInitialized(solDir2) {
   return existsSync10(manifestPath(solDir2));
@@ -4362,8 +4473,8 @@ function audienceFor(world, env, entryAud) {
   return world.files[env]?.audience ?? [];
 }
 function ensureEnvDir(solDir2) {
-  mkdirSync5(envDir(solDir2), { recursive: true });
-  mkdirSync5(sealDir(solDir2), { recursive: true });
+  mkdirSync6(envDir(solDir2), { recursive: true });
+  mkdirSync6(sealDir(solDir2), { recursive: true });
 }
 function writeEnvFile(solDir2, f) {
   ensureEnvDir(solDir2);
@@ -4641,7 +4752,7 @@ function collectStaleStanzas(solDir2) {
       referenced.add(stanzaFileFor(e.newSeal));
   }
   const orphans = [];
-  for (const name of readdirSync3(dir)) {
+  for (const name of readdirSync4(dir)) {
     if (!name.endsWith(".stanzas"))
       continue;
     if (!referenced.has(name))
@@ -5015,6 +5126,201 @@ var init_sealed_client = __esm(() => {
   init_crypto();
 });
 
+// src/bin/secret-scrub.ts
+var exports_secret_scrub = {};
+__export(exports_secret_scrub, {
+  scrubHistory: () => scrubHistory,
+  pendingScrubPaths: () => pendingScrubPaths,
+  historyHasCleartext: () => historyHasCleartext,
+  gcAfterScrub: () => gcAfterScrub,
+  clearPendingScrub: () => clearPendingScrub,
+  addPendingScrub: () => addPendingScrub
+});
+import { existsSync as existsSync11, readdirSync as readdirSync5, readFileSync as readFileSync11, unlinkSync as unlinkSync4, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join11 } from "node:path";
+function pendingScrubPaths(solDir2) {
+  const p = pendingPath(solDir2);
+  if (!existsSync11(p))
+    return [];
+  try {
+    const v = JSON.parse(readFileSync11(p, "utf8"));
+    return Array.isArray(v) ? v : [];
+  } catch {
+    return [];
+  }
+}
+function addPendingScrub(solDir2, path) {
+  const set = new Set(pendingScrubPaths(solDir2));
+  set.add(path);
+  writeFileSync11(pendingPath(solDir2), JSON.stringify([...set], null, 2), { mode: 384 });
+}
+function clearPendingScrub(solDir2) {
+  try {
+    writeFileSync11(pendingPath(solDir2), JSON.stringify([], null, 2), { mode: 384 });
+  } catch {}
+}
+function historyHasCleartext(solDir2, ops, path) {
+  const store2 = new LazyStore(join11(solDir2, "objects"));
+  for (const op of ops) {
+    try {
+      if (entryKindAt(store2, op.rootAfter, path) === "blob")
+        return true;
+    } catch {}
+  }
+  return false;
+}
+function currentSealedBox(store2, head, path) {
+  try {
+    return sealedBoxAt(store2, head, path);
+  } catch {
+    return;
+  }
+}
+function replaceWithSealed(store2, treeHash, segs, sealedHash, mode, put) {
+  const tree = store2.getTree(treeHash);
+  const [head, ...rest] = segs;
+  const entry = tree.entries[head];
+  if (!entry)
+    return treeHash;
+  const entries = { ...tree.entries };
+  if (rest.length === 0) {
+    if (entry.kind !== "blob")
+      return treeHash;
+    entries[head] = mode === undefined ? { kind: "sealed", hash: sealedHash } : { kind: "sealed", hash: sealedHash, mode };
+  } else {
+    if (entry.kind !== "tree")
+      return treeHash;
+    const child = replaceWithSealed(store2, entry.hash, rest, sealedHash, mode, put);
+    if (child === entry.hash)
+      return treeHash;
+    entries[head] = { kind: "tree", hash: child };
+  }
+  return put({ kind: "tree", entries });
+}
+async function scrubHistory(solDir2, ops, paths) {
+  const objDir = join11(solDir2, "objects");
+  const store2 = new LazyStore(objDir);
+  const put = (n) => {
+    const h = hashNode(n);
+    store2.objects.set(h, n);
+    writeFileSync11(join11(objDir, h), encodeObject(n));
+    return h;
+  };
+  const head = (() => {
+    const hp = join11(solDir2, "HEAD");
+    return existsSync11(hp) ? JSON.parse(readFileSync11(hp, "utf8")).head : undefined;
+  })();
+  const sealedHashFor = new Map;
+  for (const p of paths) {
+    const box = head ? currentSealedBox(store2, head, p) : undefined;
+    if (box === undefined)
+      continue;
+    const node = { kind: "sealed", box };
+    const hash = put(node);
+    let mode;
+    try {
+      mode = headMode(store2, head, p);
+    } catch {}
+    sealedHashFor.set(p, { hash, mode });
+  }
+  const rootMap = new Map;
+  const newOps = [];
+  let prevTip;
+  let rewritten = 0;
+  for (const op of ops) {
+    let root = op.rootAfter;
+    for (const [p, s] of sealedHashFor) {
+      const segs = p.split("/").filter(Boolean);
+      const next = replaceWithSealed(store2, root, segs, s.hash, s.mode, put);
+      root = next;
+    }
+    const rootChanged = root !== op.rootAfter;
+    rootMap.set(op.rootAfter, root);
+    const remapped = { ...op, rootAfter: root };
+    if (op.parent !== undefined && rootMap.has(op.parent))
+      remapped.parent = rootMap.get(op.parent);
+    if (op.parent2 !== undefined && rootMap.has(op.parent2))
+      remapped.parent2 = rootMap.get(op.parent2);
+    if (rootChanged) {
+      delete remapped.sig;
+      delete remapped.pub;
+      delete remapped.att;
+      rewritten++;
+    }
+    const { prevHash: _p, entryHash: _e, ...bare } = remapped;
+    const chained = chainOp(prevTip, bare);
+    newOps.push(chained);
+    prevTip = chained.entryHash;
+  }
+  const last = newOps[newOps.length - 1];
+  return {
+    scrubbedPaths: [...sealedHashFor.keys()],
+    rewrittenOps: rewritten,
+    ops: newOps,
+    newHead: last?.rootAfter,
+    newSeq: last?.seq ?? 0,
+    newLogTip: last?.entryHash,
+    rootMap
+  };
+}
+function gcAfterScrub(solDir2, ops) {
+  const objDir = join11(solDir2, "objects");
+  if (!existsSync11(objDir))
+    return 0;
+  const store2 = new LazyStore(objDir);
+  const reachable = new Set;
+  const walk = (h) => {
+    if (reachable.has(h))
+      return;
+    const node = store2.get(h);
+    if (!node)
+      return;
+    reachable.add(h);
+    if (node.kind === "tree")
+      for (const e of Object.values(node.entries))
+        walk(e.hash);
+  };
+  for (const op of ops) {
+    walk(op.rootAfter);
+    if (op.prov)
+      walk(op.prov);
+  }
+  let removed = 0;
+  for (const name of readdirSync5(objDir)) {
+    if (name.endsWith(".tmp") || !reachable.has(name)) {
+      try {
+        unlinkSync4(join11(objDir, name));
+        removed++;
+      } catch {}
+    }
+  }
+  return removed;
+}
+function headMode(store2, root, path) {
+  const segs = path.split("/").filter(Boolean);
+  let cur = root;
+  for (let i = 0;i < segs.length; i++) {
+    const t = store2.getTree(cur);
+    const e = t.entries[segs[i]];
+    if (!e)
+      return;
+    if (i === segs.length - 1)
+      return e.mode;
+    if (e.kind !== "tree")
+      return;
+    cur = e.hash;
+  }
+  return;
+}
+var pendingPath = (solDir2) => join11(solDir2, "scrub-pending.json");
+var init_secret_scrub = __esm(() => {
+  init_chain();
+  init_file_store();
+  init_store();
+  init_tree();
+  init_lib();
+});
+
 // src/text-merge.ts
 function lines(s) {
   return s.split(`
@@ -5233,24 +5539,24 @@ __export(exports_local_peer, {
   openPeer: () => openPeer,
   localPeerSolDir: () => localPeerSolDir
 });
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "node:fs";
-import { join as join11, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
+import { join as join12, resolve as resolve2 } from "node:path";
 function localPeerSolDir(arg, base) {
   if (/^https?:\/\//.test(arg))
     return;
   const p = resolve2(base, arg);
-  if (existsSync11(join11(p, ".sol")))
-    return join11(p, ".sol");
-  if (existsSync11(join11(p, "objects")) && existsSync11(join11(p, "HEAD")))
+  if (existsSync12(join12(p, ".sol")))
+    return join12(p, ".sol");
+  if (existsSync12(join12(p, "objects")) && existsSync12(join12(p, "HEAD")))
     return p;
   return;
 }
 function openPeer(peerSolDir) {
-  const metaPath = join11(peerSolDir, "view.json");
-  if (existsSync11(metaPath)) {
+  const metaPath = join12(peerSolDir, "view.json");
+  if (existsSync12(metaPath)) {
     try {
-      const parent = resolve2(peerSolDir, JSON.parse(readFileSync11(metaPath, "utf8")).parent);
-      return { store: new FileStore(peerSolDir, join11(parent, "objects")), log: new FileOpLog(peerSolDir) };
+      const parent = resolve2(peerSolDir, JSON.parse(readFileSync12(metaPath, "utf8")).parent);
+      return { store: new FileStore(peerSolDir, join12(parent, "objects")), log: new FileOpLog(peerSolDir) };
     } catch {}
   }
   return { store: new FileStore(peerSolDir), log: new FileOpLog(peerSolDir) };
@@ -5515,9 +5821,9 @@ __export(exports_runtime, {
   hydrate: () => hydrate2,
   capture: () => capture
 });
-import { chmodSync as chmodSync4, existsSync as existsSync12, lstatSync as lstatSync2, mkdirSync as mkdirSync6, readdirSync as readdirSync4, readFileSync as readFileSync12, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, unlinkSync as unlinkSync4, writeFileSync as writeFileSync11 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync13, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readdirSync as readdirSync6, readFileSync as readFileSync13, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, unlinkSync as unlinkSync5, writeFileSync as writeFileSync12 } from "node:fs";
 import { platform } from "node:os";
-import { dirname as dirname3, join as join12, relative as relative2 } from "node:path";
+import { dirname as dirname3, join as join13, relative as relative2 } from "node:path";
 function isolateCommand(command, scratch) {
   if (platform() === "darwin") {
     const profile = [
@@ -5539,16 +5845,16 @@ function hydrate2(store2, head, dir) {
     const blob = fileAt(store2, head, p);
     if (!blob)
       continue;
-    const abs = join12(dir, p);
-    mkdirSync6(dirname3(abs), { recursive: true });
+    const abs = join13(dir, p);
+    mkdirSync7(dirname3(abs), { recursive: true });
     const mode = modeAt(store2, head, p);
     if (mode === SYMLINK_MODE2) {
       try {
-        unlinkSync4(abs);
+        unlinkSync5(abs);
       } catch {}
       symlinkSync2(blob.content, abs);
     } else {
-      writeFileSync11(abs, blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+      writeFileSync12(abs, blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
       if (mode === EXEC_MODE2) {
         try {
           chmodSync4(abs, EXEC_MODE2);
@@ -5560,8 +5866,8 @@ function hydrate2(store2, head, dir) {
   return n;
 }
 function walkDir(dir, base, pats, out = []) {
-  for (const name of readdirSync4(dir)) {
-    const p = join12(dir, name);
+  for (const name of readdirSync6(dir)) {
+    const p = join13(dir, name);
     const rel = relative2(base, p);
     if (isIgnored(rel, pats))
       continue;
@@ -5579,11 +5885,11 @@ async function capture(repo, dir, keep = []) {
   const pats = ignorePatterns();
   const files = new Set(walkDir(dir, dir, pats));
   for (const k of keep)
-    if (existsSync12(join12(dir, k)))
+    if (existsSync13(join13(dir, k)))
       files.add(k);
   const written = [];
   for (const f of files) {
-    const abs = join12(dir, f);
+    const abs = join13(dir, f);
     const st = lstatSync2(abs);
     if (st.isSymbolicLink()) {
       const target = readlinkSync2(abs);
@@ -5594,7 +5900,7 @@ async function capture(repo, dir, keep = []) {
       }
       continue;
     }
-    const buf = readFileSync12(abs);
+    const buf = readFileSync13(abs);
     if (buf.includes(0)) {
       const cur = await repo.readBytes(f);
       if (cur === undefined || cur === SEALED || !Buffer.from(cur).equals(buf)) {
@@ -5611,7 +5917,7 @@ async function capture(repo, dir, keep = []) {
   }
   const deleted = [];
   for (const t of await repo.list()) {
-    if (!existsSync12(join12(dir, t))) {
+    if (!existsSync13(join13(dir, t))) {
       await repo.deleteFile(t);
       deleted.push(t);
     }
@@ -5725,8 +6031,8 @@ __export(exports_git_adapter, {
   exportHistoryToGit: () => exportHistoryToGit
 });
 import { execFileSync } from "node:child_process";
-import { existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync13, unlinkSync as unlinkSync5, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync14, unlinkSync as unlinkSync6, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join14 } from "node:path";
 import { deflateSync } from "node:zlib";
 async function importGitHead(gitPath, ws) {
   const listing = git(gitPath, "ls-tree", "-r", "-z", "HEAD").toString();
@@ -5794,9 +6100,9 @@ async function applyGitFile(repo, path, mode, content) {
     await repo.chmod(path, exec ? 493 : 420);
 }
 function setHead(fdir, head) {
-  const hf = join13(fdir, "HEAD");
-  const cur = existsSync13(hf) ? JSON.parse(readFileSync13(hf, "utf8")) : { seq: 0 };
-  writeFileSync12(hf, JSON.stringify({ ...cur, head }));
+  const hf = join14(fdir, "HEAD");
+  const cur = existsSync14(hf) ? JSON.parse(readFileSync14(hf, "utf8")) : { seq: 0 };
+  writeFileSync13(hf, JSON.stringify({ ...cur, head }));
 }
 async function importGitRepo(gitPath, fdir) {
   const store2 = new FileStore(fdir);
@@ -5850,7 +6156,7 @@ function exportToGit(store2, head, gitPath, message) {
   for (const f of tracked) {
     if (!want.has(f)) {
       try {
-        unlinkSync5(join13(gitPath, f));
+        unlinkSync6(join14(gitPath, f));
       } catch {}
       deleted++;
     }
@@ -5861,20 +6167,20 @@ function exportToGit(store2, head, gitPath, message) {
   return { written, deleted };
 }
 function gitObjectsDir(gitPath) {
-  for (const c of [join13(gitPath, ".git", "objects"), join13(gitPath, "objects")])
-    if (existsSync13(c))
+  for (const c of [join14(gitPath, ".git", "objects"), join14(gitPath, "objects")])
+    if (existsSync14(c))
       return c;
   return;
 }
 function writeLooseObject(objectsDir2, o) {
-  const dir = join13(objectsDir2, o.oid.slice(0, 2));
-  const file = join13(dir, o.oid.slice(2));
-  if (existsSync13(file))
+  const dir = join14(objectsDir2, o.oid.slice(0, 2));
+  const file = join14(dir, o.oid.slice(2));
+  if (existsSync14(file))
     return;
   const header = Buffer.from(`${o.type} ${o.content.length}\x00`);
   const framed = Buffer.concat([header, Buffer.from(o.content)]);
-  mkdirSync7(dir, { recursive: true });
-  writeFileSync12(file, deflateSync(framed));
+  mkdirSync8(dir, { recursive: true });
+  writeFileSync13(file, deflateSync(framed));
 }
 function exportAncestry(ops) {
   const parents = new Map;
@@ -5986,31 +6292,31 @@ __export(exports_views, {
   loadViewsRegistry: () => loadViewsRegistry,
   createView: () => createView
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync8, readdirSync as readdirSync5, readFileSync as readFileSync14, rmSync, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join14, relative as relative3, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync15, rmSync, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join15, relative as relative3, resolve as resolve3 } from "node:path";
 function loadViewsRegistry(parentSol) {
   const p = viewsRegistryPath(parentSol);
-  if (!existsSync14(p))
+  if (!existsSync15(p))
     return { views: [] };
   try {
-    return JSON.parse(readFileSync14(p, "utf8"));
+    return JSON.parse(readFileSync15(p, "utf8"));
   } catch {
     return { views: [] };
   }
 }
 function saveViewsRegistry(parentSol, reg) {
-  writeFileSync13(viewsRegistryPath(parentSol), JSON.stringify(reg, null, 2));
+  writeFileSync14(viewsRegistryPath(parentSol), JSON.stringify(reg, null, 2));
 }
 function createView(opts) {
   const { parentSol, viewDir, name, branch, actor: actor2, startHead } = opts;
-  const viewSol = join14(viewDir, ".sol");
-  mkdirSync8(viewSol, { recursive: true });
+  const viewSol = join15(viewDir, ".sol");
+  mkdirSync9(viewSol, { recursive: true });
   const meta = { parent: relative3(viewSol, parentSol), name, branch, actor: actor2, startHead, createdAt: Date.now() };
-  writeFileSync13(join14(viewSol, "view.json"), JSON.stringify(meta, null, 2));
-  writeFileSync13(join14(viewSol, "HEAD"), JSON.stringify({ head: startHead, seq: 0 }));
+  writeFileSync14(join15(viewSol, "view.json"), JSON.stringify(meta, null, 2));
+  writeFileSync14(join15(viewSol, "HEAD"), JSON.stringify({ head: startHead, seq: 0 }));
   const refs = { current: branch, branches: { [branch]: { head: startHead, base: startHead } }, tags: {} };
-  writeFileSync13(join14(viewSol, "refs.json"), JSON.stringify(refs, null, 2));
-  const store2 = new LazyStore(join14(parentSol, "objects"));
+  writeFileSync14(join15(viewSol, "refs.json"), JSON.stringify(refs, null, 2));
+  const store2 = new LazyStore(join15(parentSol, "objects"));
   const paths = (startHead ? listAll(store2, startHead) : []).filter((p) => !p.split("/").some(isReservedKey));
   for (const f of paths)
     materializeInto(store2, startHead, viewDir, f);
@@ -6025,8 +6331,8 @@ async function viewStatuses(parentSol) {
   const reg = loadViewsRegistry(parentSol);
   const out = [];
   for (const v of reg.views) {
-    const viewSol = join14(v.dir, ".sol");
-    const exists = existsSync14(join14(viewSol, "view.json"));
+    const viewSol = join15(v.dir, ".sol");
+    const exists = existsSync15(join15(viewSol, "view.json"));
     let head;
     if (exists) {
       head = await new FileOpLog(viewSol).head();
@@ -6050,7 +6356,7 @@ function pruneViews(parentSol, opts = {}) {
   const reg = loadViewsRegistry(parentSol);
   const removed = [];
   reg.views = reg.views.filter((v) => {
-    const present = existsSync14(join14(v.dir, ".sol", "view.json"));
+    const present = existsSync15(join15(v.dir, ".sol", "view.json"));
     const target = opts.name ? v.name === opts.name : !present;
     if (!target)
       return true;
@@ -6066,12 +6372,12 @@ function pruneViews(parentSol, opts = {}) {
   return removed;
 }
 function sharedObjectCount(parentSol) {
-  const dir = join14(parentSol, "objects");
-  if (!existsSync14(dir))
+  const dir = join15(parentSol, "objects");
+  if (!existsSync15(dir))
     return 0;
-  return readdirSync5(dir).filter((n) => !n.endsWith(".tmp")).length;
+  return readdirSync7(dir).filter((n) => !n.endsWith(".tmp")).length;
 }
-var viewsRegistryPath = (parentSol) => join14(parentSol, "views.json");
+var viewsRegistryPath = (parentSol) => join15(parentSol, "views.json");
 var init_views = __esm(() => {
   init_file_store();
   init_struct();
@@ -6511,7 +6817,7 @@ __export(exports_secret2, {
   runEnv: () => runEnv,
   resolveReference: () => resolveReference
 });
-import { readFileSync as readFileSync15, readSync, writeSync } from "node:fs";
+import { readFileSync as readFileSync16, readSync, writeSync } from "node:fs";
 import { spawnSync as spawnSync2 } from "node:child_process";
 function flag(args, name) {
   const i = args.indexOf(name);
@@ -6883,7 +7189,7 @@ async function envValidate(ctx, args, json) {
 }
 function readSchemaText(solDir2) {
   try {
-    return readFileSync15(schemaLockPath(solDir2), "utf8");
+    return readFileSync16(schemaLockPath(solDir2), "utf8");
   } catch {
     return;
   }
@@ -7558,14 +7864,14 @@ var exports_sol_secret_mcp = {};
 __export(exports_sol_secret_mcp, {
   startSecretMcp: () => startSecretMcp
 });
-import { existsSync as existsSync15 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync16 } from "node:fs";
+import { join as join16 } from "node:path";
 async function startSecretMcp(opts = {}) {
   const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
   const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
   const { CallToolRequestSchema, ListToolsRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
-  const solDir2 = opts.solDir || process.env.SOL_DIR || join15(process.cwd(), ".sol");
-  if (!existsSync15(solDir2)) {
+  const solDir2 = opts.solDir || process.env.SOL_DIR || join16(process.cwd(), ".sol");
+  if (!existsSync16(solDir2)) {
     process.stderr.write(`sol-secret-mcp: no .sol at ${solDir2} — run \`sol init\` first (or set SOL_DIR)
 `);
     process.exit(1);
@@ -7719,8 +8025,8 @@ var exports_sol_mcp = {};
 __export(exports_sol_mcp, {
   startWorkspaceMcp: () => startWorkspaceMcp
 });
-import { mkdirSync as mkdirSync9 } from "node:fs";
-import { join as join16 } from "node:path";
+import { mkdirSync as mkdirSync10 } from "node:fs";
+import { join as join17 } from "node:path";
 async function handle(ws, name, a) {
   switch (name) {
     case "sol_write":
@@ -7762,8 +8068,8 @@ async function startWorkspaceMcp(opts = {}) {
   const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
   const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
   const { CallToolRequestSchema, ListToolsRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
-  const solDir2 = opts.solDir || process.env.SOL_DIR || join16(process.cwd(), ".sol");
-  mkdirSync9(solDir2, { recursive: true });
+  const solDir2 = opts.solDir || process.env.SOL_DIR || join17(process.cwd(), ".sol");
+  mkdirSync10(solDir2, { recursive: true });
   const ws = new SolWorkspace(new FileStore(solDir2), new FileOpLog(solDir2), process.env.SOL_ACTOR || "agent");
   const server = new Server({ name: "sol", version: "0.1.0" }, { capabilities: { tools: {} } });
   server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
@@ -7800,9 +8106,9 @@ __export(exports_dispatch, {
   dispatch: () => dispatch
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync10, mkdtempSync, readdirSync as readdirSync6, readFileSync as readFileSync16, rmSync as rmSync2, unlinkSync as unlinkSync6, watch, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync11, mkdtempSync, readdirSync as readdirSync8, readFileSync as readFileSync17, rmSync as rmSync2, unlinkSync as unlinkSync7, watch, writeFileSync as writeFileSync15 } from "node:fs";
 import { homedir as homedir2, hostname, platform as platform2, tmpdir } from "node:os";
-import { basename, dirname as dirname4, join as join17, resolve as resolve4, sep as sep2 } from "node:path";
+import { basename, dirname as dirname4, join as join18, resolve as resolve4, sep as sep2 } from "node:path";
 function globCovers(pattern, path) {
   let re = "";
   for (let i = 0;i < pattern.length; i++) {
@@ -7830,11 +8136,11 @@ function tokenClaims(token) {
   }
 }
 async function loadStoredToken() {
-  if (!existsSync16(CRED_PATH))
+  if (!existsSync17(CRED_PATH))
     return;
   let creds;
   try {
-    creds = JSON.parse(readFileSync16(CRED_PATH, "utf8"));
+    creds = JSON.parse(readFileSync17(CRED_PATH, "utf8"));
   } catch {
     return;
   }
@@ -7849,7 +8155,7 @@ async function loadStoredToken() {
       if (res.ok) {
         const r = await res.json();
         if (r.accessToken) {
-          writeFileSync14(CRED_PATH, JSON.stringify({ ...creds, accessToken: r.accessToken, refreshToken: r.refreshToken ?? creds.refreshToken }, null, 2), { mode: 384 });
+          writeFileSync15(CRED_PATH, JSON.stringify({ ...creds, accessToken: r.accessToken, refreshToken: r.refreshToken ?? creds.refreshToken }, null, 2), { mode: 384 });
           return r.accessToken;
         }
       }
@@ -7870,7 +8176,7 @@ function authHost() {
   if (process.env.SOL_AUTH)
     return process.env.SOL_AUTH.replace(/\/+$/, "");
   try {
-    const w = JSON.parse(readFileSync16(CRED_PATH, "utf8")).webUrl;
+    const w = JSON.parse(readFileSync17(CRED_PATH, "utf8")).webUrl;
     if (w)
       return w.replace(/\/+$/, "");
   } catch {}
@@ -7931,7 +8237,7 @@ function cliVersion() {
   if (typeof __SOL_COMPILED_VERSION__ === "string" && __SOL_COMPILED_VERSION__)
     return __SOL_COMPILED_VERSION__;
   try {
-    return JSON.parse(readFileSync16(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
+    return JSON.parse(readFileSync17(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
   } catch {
     return "dev";
   }
@@ -8461,7 +8767,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
     try {
       const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
       const { openContent: openContent2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-      const ring = existsSync16(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+      const ring = existsSync17(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
       const self = loadSelfIdentity2();
       setSealedDecryptor((boxStr) => {
         const box = JSON.parse(boxStr);
@@ -8471,19 +8777,19 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
     } catch {}
   }
   const servesMcp = cmd === "mcp" || cmd === "secret" && args[0] === "mcp";
-  const release = !servesMcp && new Set(["add", "track", "commit", "checkpoint", "rm", "gc", "branch", "tag", "switch", "merge", "undo", "revert", "pull", "push", "restore", "checkout", "run", "seal", "view", "env", "secret"]).has(cmd) && existsSync16(solDir) ? acquireLock() : undefined;
+  const release = !servesMcp && new Set(["add", "track", "commit", "checkpoint", "rm", "gc", "branch", "tag", "switch", "merge", "undo", "revert", "pull", "push", "restore", "checkout", "run", "seal", "view", "env", "secret"]).has(cmd) && existsSync17(solDir) ? acquireLock() : undefined;
   try {
     switch (cmd) {
       case "init": {
-        const here = join17(procCwd, ".sol");
-        if (existsSync16(here))
+        const here = join18(procCwd, ".sol");
+        if (existsSync17(here))
           die("already a sol repo: " + procCwd);
         if (repoRoot && repoRoot !== procCwd && !args.includes("--force")) {
           die(`already inside a Sol repo at ${repoRoot}
   -> just commit into it: \`sol commit ...\` works from here (sol walks up to find the repo)
   -> to nest a NEW repo here anyway: \`sol init --force\``);
         }
-        mkdirSync10(here, { recursive: true });
+        mkdirSync11(here, { recursive: true });
         new FileStore(here);
         console.log(`initialized empty sol repo in ${here}`);
         break;
@@ -8599,7 +8905,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (sub === "import") {
           const passphrase = process.env.SOL_KEYSTORE_PASSPHRASE || die("set SOL_KEYSTORE_PASSPHRASE to decrypt the bundle");
           const file = args[1] || die("usage: sol keys import <bundle.json>   (set SOL_KEYSTORE_PASSPHRASE)");
-          const bundle = JSON.parse(readFileSync16(file, "utf8"));
+          const bundle = JSON.parse(readFileSync17(file, "utf8"));
           let recovered;
           try {
             recovered = importBundle2(bundle, passphrase);
@@ -8630,7 +8936,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         break;
       }
       case "trust": {
-        if (!existsSync16(solDir))
+        if (!existsSync17(solDir))
           die("not a sol repo — run `sol init` first");
         const map = loadTrust();
         if (args[0] === "--remove" || args[0] === "-r") {
@@ -8677,7 +8983,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       }
       case "track":
       case "add": {
-        if (!existsSync16(solDir))
+        if (!existsSync17(solDir))
           die("not a sol repo — run `sol init` first");
         const files = args.filter((a) => a !== "." && !a.startsWith("-"));
         if (!files.length) {
@@ -8688,7 +8994,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         let n = 0;
         for (const f of files) {
           const rf = repoRel(f);
-          if (!existsSync16(join17(cwd, rf))) {
+          if (!existsSync17(join18(cwd, rf))) {
             console.error("skip (not on disk): " + f);
             continue;
           }
@@ -8717,14 +9023,14 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (!message)
           die('commit needs a message: sol commit "what you did"  (scoped: sol commit -m "msg" file1 file2)');
         const parentHead = await repo.head();
-        const mergeHeadPath = join17(solDir, "MERGE_HEAD");
-        const parent2 = existsSync16(mergeHeadPath) ? readFileSync16(mergeHeadPath, "utf8").trim() || undefined : undefined;
+        const mergeHeadPath = join18(solDir, "MERGE_HEAD");
+        const parent2 = existsSync17(mergeHeadPath) ? readFileSync17(mergeHeadPath, "utf8").trim() || undefined : undefined;
         let changed = 0;
         let commitRoot = parentHead;
         if (paths.length) {
           for (const p of paths) {
             const rp = repoRel(p);
-            if (existsSync16(join17(cwd, rp))) {
+            if (existsSync17(join18(cwd, rp))) {
               if (await snapshotFile(repo, rp))
                 changed++;
             } else if ((await repo.list()).includes(rp)) {
@@ -8766,7 +9072,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         await appendCommit(log, commitRoot, message, parentHead, parent2);
         if (parent2) {
           try {
-            unlinkSync6(mergeHeadPath);
+            unlinkSync7(mergeHeadPath);
           } catch {}
         }
         const refs = await loadRefs(log);
@@ -8779,7 +9085,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       }
       case "status": {
         const { repo, log } = open();
-        const refs = existsSync16(refsPath()) ? await loadRefs(log) : undefined;
+        const refs = existsSync17(refsPath()) ? await loadRefs(log) : undefined;
         const head = await repo.head();
         const headOp = head ? [...await log.history()].reverse().find((o) => o.rootAfter === head) : undefined;
         const headBy = headOp?.by ?? "?";
@@ -8869,7 +9175,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const { listAll: listAll3 } = await Promise.resolve().then(() => (init_tree(), exports_tree));
         const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
         const { openContent: openContent2, UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-        const ring = existsSync16(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+        const ring = existsSync17(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
         const self = loadSelfIdentity2();
         const decrypt = (boxStr) => {
           try {
@@ -8917,7 +9223,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             const { readFile: readTree, entryKindAt: kindAt } = await Promise.resolve().then(() => (init_tree(), exports_tree));
             const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
             const { openContent: openContent2, UNREADABLE: UNREADABLE2, KeyRing: KeyRing3 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-            const ring = existsSync16(solDir) ? loadKeyRing() : new KeyRing3;
+            const ring = existsSync17(solDir) ? loadKeyRing() : new KeyRing3;
             const self = loadSelfIdentity2();
             const decrypt = (boxStr) => {
               try {
@@ -9016,7 +9322,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         };
         const live = await log.head() ?? "";
         const refArg = args.find((a) => !a.startsWith("-"));
-        const lrefs = existsSync16(refsPath()) ? JSON.parse(readFileSync16(refsPath(), "utf8")) : null;
+        const lrefs = existsSync17(refsPath()) ? JSON.parse(readFileSync17(refsPath(), "utf8")) : null;
         let tipRoot = live;
         if (refArg) {
           tipRoot = lrefs?.branches[refArg]?.head ?? refArg;
@@ -9069,7 +9375,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const path = args[0] || die("rm needs a path");
         let onDisk = false;
         try {
-          unlinkSync6(join17(cwd, path));
+          unlinkSync7(join18(cwd, path));
           onDisk = true;
         } catch {}
         if (onDisk) {
@@ -9297,16 +9603,16 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           if (op.prov)
             walk(op.prov);
         }
-        const objDir = join17(solDir, "objects");
+        const objDir = join18(solDir, "objects");
         let removed = 0;
-        for (const name of readdirSync6(objDir)) {
+        for (const name of readdirSync8(objDir)) {
           if (name.endsWith(".tmp") || !reachable.has(name)) {
-            unlinkSync6(join17(objDir, name));
+            unlinkSync7(join18(objDir, name));
             removed++;
           }
         }
         console.log(`gc: kept ${reachable.size} object(s), removed ${removed} unreachable`);
-        if (existsSync16(join17(solDir, "env", "seal"))) {
+        if (existsSync17(join18(solDir, "env", "seal"))) {
           const { gcStaleStanzas: gcStaleStanzas2 } = await Promise.resolve().then(() => (init_secret(), exports_secret));
           const st = gcStaleStanzas2(solDir);
           if (st.removed)
@@ -9321,8 +9627,8 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             console.log(p);
           break;
         }
-        const f = join17(cwd, ".solignore");
-        const lead = existsSync16(f) && !readFileSync16(f, "utf8").endsWith(`
+        const f = join18(cwd, ".solignore");
+        const lead = existsSync17(f) && !readFileSync17(f, "utf8").endsWith(`
 `) ? `
 ` : "";
         appendFileSync2(f, lead + pat + `
@@ -9423,6 +9729,48 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const wantJson = args.includes("--json");
         const reapply = args.includes("--reapply");
         const positional = args.filter((a) => !a.startsWith("-"));
+        if (args.includes("--scrub-history")) {
+          const { pendingScrubPaths: pendingScrubPaths2, historyHasCleartext: historyHasCleartext2, scrubHistory: scrubHistory2, clearPendingScrub: clearPendingScrub2, gcAfterScrub: gcAfterScrub2 } = await Promise.resolve().then(() => (init_secret_scrub(), exports_secret_scrub));
+          const ops = await log.history();
+          const only = positional[0];
+          const targets = (only ? [only] : pendingScrubPaths2(solDir)).filter((p) => historyHasCleartext2(solDir, ops, p));
+          if (!targets.length) {
+            if (only)
+              die(`no pre-seal cleartext in history for "${only}" — nothing to scrub (it was never committed in the clear, or is already scrubbed).`);
+            clearPendingScrub2(solDir);
+            console.log(wantJson ? JSON.stringify({ scrubbed: [], rewrittenOps: 0 }) : "no paths with recoverable pre-seal cleartext — nothing to scrub.");
+            break;
+          }
+          let removed = 0;
+          {
+            const res = await scrubHistory2(solDir, ops, targets);
+            writeFileSync15(join18(solDir, "ops.jsonl"), res.ops.map((o) => JSON.stringify(o)).join(`
+`) + (res.ops.length ? `
+` : ""));
+            writeFileSync15(join18(solDir, "HEAD"), JSON.stringify({ head: res.newHead, seq: res.newSeq, logTip: res.newLogTip }));
+            if (existsSync17(refsPath())) {
+              const refs = JSON.parse(readFileSync17(refsPath(), "utf8"));
+              for (const b of Object.values(refs.branches)) {
+                if (b.head && res.rootMap.has(b.head))
+                  b.head = res.rootMap.get(b.head);
+                if (b.base && res.rootMap.has(b.base))
+                  b.base = res.rootMap.get(b.base);
+                if (b.remote && res.rootMap.has(b.remote))
+                  b.remote = res.rootMap.get(b.remote);
+              }
+              saveRefs(refs);
+            }
+            removed = gcAfterScrub2(solDir, res.ops);
+            clearPendingScrub2(solDir);
+          }
+          if (wantJson) {
+            console.log(JSON.stringify({ scrubbed: targets, removedObjects: removed }));
+            break;
+          }
+          console.log(`scrubbed pre-seal cleartext from history for: ${targets.join(", ")} — the op-log was rewritten and ${removed} orphaned cleartext object(s) dropped (\`sol restore\` can no longer recover them); push is unblocked.`);
+          console.log("  NOTE: this is a DESTRUCTIVE local history rewrite. collaborators who already pulled the old history must re-clone.");
+          break;
+        }
         if (reapply) {
           const cfg = resolveRemote(solDir) || die("no remote — the policy lives on the repo; `sol remote <url> <repo>` first");
           const token = process.env.SOL_TOKEN || authExpired();
@@ -9559,10 +9907,10 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (content === SEALED && !args.includes("--hide-names"))
           die("already sealed: " + path);
         if (content === undefined) {
-          const abs = join17(cwd, path);
-          if (!existsSync16(abs))
+          const abs = join18(cwd, path);
+          if (!existsSync17(abs))
             die("no such file: " + path);
-          content = readFileSync16(abs, "utf8");
+          content = readFileSync17(abs, "utf8");
         }
         const ring = loadKeyRing();
         const { SealedClient: SealedClient2 } = await Promise.resolve().then(() => (init_sealed_client(), exports_sealed_client));
@@ -9744,6 +10092,18 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             recordAudience2(solDir, { path, epoch: 1, at: Date.now(), accounts: [], local: [...localRecipients] });
           }
           saveKeyRing(ring);
+          if (onTree !== undefined && onTree !== SEALED) {
+            const { historyHasCleartext: historyHasCleartext2, addPendingScrub: addPendingScrub2 } = await Promise.resolve().then(() => (init_secret_scrub(), exports_secret_scrub));
+            if (historyHasCleartext2(solDir, await log.history(), path)) {
+              addPendingScrub2(solDir, path);
+              if (!wantJson) {
+                console.error(`
+WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal cleartext is STILL recoverable from history (\`sol restore\`) and would ship to every clone on push.`);
+                console.error(`  push is now BLOCKED for safety. run \`sol seal ${path} --scrub-history\` to rewrite it out of history, then push.
+`);
+              }
+            }
+          }
         }
         if (wantHideName) {
           const { slotForPath: slotForPath2, recordNameSlot: recordNameSlot2, recordHiddenPath: recordHiddenPath2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
@@ -9843,7 +10203,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const { openContent: openContent2, UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
         const { parseStruct: parseStruct2 } = await Promise.resolve().then(() => (init_struct(), exports_struct));
         const audiences = loadAudiences2(solDir);
-        const ring = existsSync16(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+        const ring = existsSync17(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
         const self = loadSelfIdentity2();
         const levelOf = (boxStr) => {
           try {
@@ -10038,7 +10398,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const result = merge2({ store: store2 }, other.base, ours, other.head);
         if (result.conflicts.length) {
           materializeTree(store2, result.head);
-          writeFileSync14(join17(solDir, "MERGE_HEAD"), other.head);
+          writeFileSync15(join18(solDir, "MERGE_HEAD"), other.head);
           saveMergeConflicts(solDir, result.conflicts);
           console.log(`merge ${name} -> ${result.conflicts.length} conflict(s), left in your working tree (uncommitted):`);
           for (const c of result.conflicts)
@@ -10139,7 +10499,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         break;
       }
       case "remote": {
-        if (!existsSync16(solDir))
+        if (!existsSync17(solDir))
           die("not a sol repo");
         if (args[0]) {
           const repoName = args[1] || die("usage: sol remote <url> <repo>");
@@ -10185,16 +10545,16 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           }
           if (!tokens)
             die("timed out waiting for approval");
-          mkdirSync10(dirname4(CRED_PATH), { recursive: true });
-          writeFileSync14(CRED_PATH, JSON.stringify({ webUrl, ...tokens }, null, 2), { mode: 384 });
+          mkdirSync11(dirname4(CRED_PATH), { recursive: true });
+          writeFileSync15(CRED_PATH, JSON.stringify({ webUrl, ...tokens }, null, 2), { mode: 384 });
           const c = tokenClaims(tokens.accessToken);
           console.log(`
   Logged in as ${c.handle ? `@${c.handle}` : c.email || "user"}.`);
           if (!c.handle)
             console.log("  (no handle yet — set one in the web app to get your <handle>/<repo> namespace)");
         } else if (sub === "logout") {
-          if (existsSync16(CRED_PATH))
-            unlinkSync6(CRED_PATH);
+          if (existsSync17(CRED_PATH))
+            unlinkSync7(CRED_PATH);
           console.log("logged out");
         } else if (sub === "status" || !sub) {
           if (process.env.SOL_TOKEN) {
@@ -10202,11 +10562,11 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             console.log(`authenticated via SOL_TOKEN (env)${c2.handle ? ` as @${c2.handle}` : ""}`);
             break;
           }
-          if (!existsSync16(CRED_PATH)) {
+          if (!existsSync17(CRED_PATH)) {
             console.log("not logged in — run `sol auth login` (or set SOL_TOKEN)");
             break;
           }
-          const creds = JSON.parse(readFileSync16(CRED_PATH, "utf8"));
+          const creds = JSON.parse(readFileSync17(CRED_PATH, "utf8"));
           const c = tokenClaims(creds.accessToken || "");
           const stale = typeof c.exp === "number" && c.exp * 1000 < Date.now();
           console.log(`logged in as ${c.handle ? `@${c.handle}` : c.email || "user"} via ${creds.webUrl}${stale ? " (token stale — refreshes on next use)" : ""}`);
@@ -10256,9 +10616,9 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             console.log("heads-up: changing your handle re-namespaces your repos under the new <handle>/<repo>.");
           console.log(`handle set to @${out.handle}`);
         } else if (sub === "pat") {
-          if (!existsSync16(CRED_PATH))
+          if (!existsSync17(CRED_PATH))
             die("run `sol auth login` first");
-          const creds = JSON.parse(readFileSync16(CRED_PATH, "utf8"));
+          const creds = JSON.parse(readFileSync17(CRED_PATH, "utf8"));
           const token = await loadStoredToken();
           if (!token || !creds.webUrl)
             die("run `sol auth login` first");
@@ -10317,10 +10677,10 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const peer = openPeer2(localSrc);
           const peerHead = await peer.log.head();
           const dest = resolve4(procCwd, args[1] || (args[0].replace(/\/+$/, "").split("/").pop() || "clone") + "-clone");
-          const ddir = join17(dest, ".sol");
-          if (existsSync16(ddir))
+          const ddir = join18(dest, ".sol");
+          if (existsSync17(ddir))
             die("already a sol repo: " + dest);
-          mkdirSync10(ddir, { recursive: true });
+          mkdirSync11(ddir, { recursive: true });
           const peerOps = await peer.log.history();
           const res = await converge2({ store: new FileStore(ddir), log: new FileOpLog(ddir) }, { nodes: await peerNodes2(peer, peerHead, peerOps), ops: peerOps, incomingHead: peerHead, actor });
           const dstore = new Store;
@@ -10330,7 +10690,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const files = (res.head ? listAll(dstore, res.head) : []).filter((f) => !f.split("/").some(isReservedKey2));
           for (const f of files)
             materializeInto(dstore, res.head, dest, f);
-          writeFileSync14(join17(ddir, "refs.json"), JSON.stringify({ current: "main", branches: { main: { head: res.head, base: res.head, remote: res.head } }, tags: {} }, null, 2));
+          writeFileSync15(join18(ddir, "refs.json"), JSON.stringify({ current: "main", branches: { main: { head: res.head, base: res.head, remote: res.head } }, tags: {} }, null, 2));
           writeWorkingIndexAt(ddir, dest, files);
           console.log(`cloned local peer ${args[0]} -> ${dest} (${(await peer.log.history()).length} ops, ${files.length} files)`);
           break;
@@ -10339,12 +10699,12 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const repoName = rest[0] || die("usage: sol clone [<url>] <owner>/<repo> [dir]");
         const token = process.env.SOL_TOKEN || die("set SOL_TOKEN to the backend bearer token");
         const target = resolve4(cwd, rest[1] || repoName.split("/").pop() || repoName);
-        const fdir = join17(target, ".sol");
-        if (existsSync16(fdir))
+        const fdir = join18(target, ".sol");
+        if (existsSync17(fdir))
           die("already a sol repo: " + target);
         const cfg = { url, repo: repoName };
         const bundle = await remoteExport(cfg, token);
-        mkdirSync10(fdir, { recursive: true });
+        mkdirSync11(fdir, { recursive: true });
         await writeBundle(fdir, bundle, 0);
         saveRemote(fdir, cfg);
         await pullEnvState(fdir, cfg, token);
@@ -10357,8 +10717,8 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           cloneBranches[name] = { head: h, base: h, remote: h };
         if (!cloneBranches[onBranch])
           cloneBranches[onBranch] = { head: checkoutHead, base: checkoutHead, remote: checkoutHead };
-        writeFileSync14(join17(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
-        writeFileSync14(join17(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: bundle.seq, logTip: bundle.tip }));
+        writeFileSync15(join18(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
+        writeFileSync15(join18(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: bundle.seq, logTip: bundle.tip }));
         const store2 = new Store;
         for (const node of bundle.nodes)
           store2.put(node);
@@ -10384,12 +10744,20 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           }
         }
         const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`, or `sol push <repo>` to use the hosted Sol");
+        {
+          const { pendingScrubPaths: pendingScrubPaths2, historyHasCleartext: historyHasCleartext2 } = await Promise.resolve().then(() => (init_secret_scrub(), exports_secret_scrub));
+          const ops0 = await log.history();
+          const stillLeaking = pendingScrubPaths2(solDir).filter((p) => historyHasCleartext2(solDir, ops0, p));
+          if (stillLeaking.length) {
+            die(`refusing to push — pre-seal CLEARTEXT is still in history for: ${stillLeaking.join(", ")}. the plaintext would ship to every clone (recoverable via \`sol restore\`). run \`sol seal ${stillLeaking[0]} --scrub-history\` (repeat per path, or \`sol seal --scrub-history\` for all) first.`);
+          }
+        }
         const token = process.env.SOL_TOKEN || authExpired();
         const rh = await remoteHead(cfg, token);
         const ops = await log.history();
         const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
         const localTip = await log.logTip();
-        const localRefs = existsSync16(refsPath()) ? JSON.parse(readFileSync16(refsPath(), "utf8")) : undefined;
+        const localRefs = existsSync17(refsPath()) ? JSON.parse(readFileSync17(refsPath(), "utf8")) : undefined;
         const branch = localRefs?.current ?? "main";
         const branchHead = await log.head() ?? "";
         const remoteWasEmpty = rh.seq === 0 && !rh.tip;
@@ -10412,8 +10780,8 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const prevHead = await log.head() ?? "";
         await writeBundle(solDir, canon, 0);
         const convergedHead = res.head ?? canon.refs?.branches?.[branch] ?? branchHead;
-        if (existsSync16(refsPath())) {
-          const refs = JSON.parse(readFileSync16(refsPath(), "utf8"));
+        if (existsSync17(refsPath())) {
+          const refs = JSON.parse(readFileSync17(refsPath(), "utf8"));
           if (canon.refs) {
             for (const [name, h] of Object.entries(canon.refs.branches)) {
               refs.branches[name] = { head: refs.branches[name]?.head ?? h, base: refs.branches[name]?.base ?? h, remote: h };
@@ -10477,8 +10845,8 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const ownMeta = readViewMeta(solDir);
           const base2 = peerMeta?.startHead ?? ownMeta?.startHead;
           const res = await converge2({ store: new FileStore(solDir, objectsDir()), log }, { nodes: await peerNodes2(peer, peerHead, peerOps), ops: peerOps, incomingHead: peerHead, actor, ...base2 ? { base: base2 } : {} });
-          if (existsSync16(refsPath())) {
-            const refs = JSON.parse(readFileSync16(refsPath(), "utf8"));
+          if (existsSync17(refsPath())) {
+            const refs = JSON.parse(readFileSync17(refsPath(), "utf8"));
             if (refs.branches[refs.current])
               refs.branches[refs.current].head = res.head;
             saveRefs(refs);
@@ -10509,11 +10877,11 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const ops = await log.history();
         const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
         const localTip = await log.logTip();
-        const curBranch = existsSync16(refsPath()) ? JSON.parse(readFileSync16(refsPath(), "utf8")).current : bundle.refs?.production || "main";
+        const curBranch = existsSync17(refsPath()) ? JSON.parse(readFileSync17(refsPath(), "utf8")).current : bundle.refs?.production || "main";
         const remoteCurHead = bundle.refs?.branches?.[curBranch] ?? bundle.head ?? "";
         if (bundle.seq === localSeq && bundle.tip === localTip) {
-          if (bundle.refs && existsSync16(refsPath())) {
-            const lr = JSON.parse(readFileSync16(refsPath(), "utf8"));
+          if (bundle.refs && existsSync17(refsPath())) {
+            const lr = JSON.parse(readFileSync17(refsPath(), "utf8"));
             const before = lr.branches[lr.current]?.head;
             for (const [name, h] of Object.entries(bundle.refs.branches))
               lr.branches[name] = { head: h, base: lr.branches[name]?.base ?? h, remote: h };
@@ -10537,9 +10905,9 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           break;
         }
         const syncRefHead = (h) => {
-          if (!existsSync16(refsPath()))
+          if (!existsSync17(refsPath()))
             return;
-          const refs = JSON.parse(readFileSync16(refsPath(), "utf8"));
+          const refs = JSON.parse(readFileSync17(refsPath(), "utf8"));
           if (refs.branches[refs.current])
             refs.branches[refs.current].head = h;
           saveRefs(refs);
@@ -10557,8 +10925,8 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           syncRefHead(remoteCurHead);
           setOpLogHead(remoteCurHead);
           materializeTree(loadStore(), remoteCurHead);
-          if (bundle.refs && existsSync16(refsPath())) {
-            const lr = JSON.parse(readFileSync16(refsPath(), "utf8"));
+          if (bundle.refs && existsSync17(refsPath())) {
+            const lr = JSON.parse(readFileSync17(refsPath(), "utf8"));
             for (const [name, h] of Object.entries(bundle.refs.branches))
               lr.branches[name] = { head: h, base: lr.branches[name]?.base ?? h, remote: h };
             saveRefs(lr);
@@ -10606,9 +10974,9 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           for (const c of result.conflicts) {
             const blob = fileAt(store2, result.head, c.path);
             if (blob)
-              writeFileSync14(join17(cwd, c.path), blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+              writeFileSync15(join18(cwd, c.path), blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
           }
-          writeFileSync14(join17(solDir, "MERGE_HEAD"), remoteHead2);
+          writeFileSync15(join18(solDir, "MERGE_HEAD"), remoteHead2);
           saveMergeConflicts(solDir, result.conflicts);
           console.log(`pulled + merged WITH ${result.conflicts.length} conflict(s), left uncommitted in your working tree:`);
           for (const c of result.conflicts)
@@ -10623,11 +10991,11 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         break;
       }
       case "promote": {
-        if (!existsSync16(solDir))
+        if (!existsSync17(solDir))
           die("not a sol repo");
         const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired();
-        const cur = existsSync16(refsPath()) ? JSON.parse(readFileSync16(refsPath(), "utf8")).current : "main";
+        const cur = existsSync17(refsPath()) ? JSON.parse(readFileSync17(refsPath(), "utf8")).current : "main";
         const branch = args[0] || cur;
         const refs = await remotePromote(cfg, token, branch);
         console.log(`promoted '${branch}' -> production '${refs.production}' now at ${(refs.branches[refs.production] ?? "").slice(0, 12)}`);
@@ -10639,8 +11007,8 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const newRepo = frest[1] || die("usage: sol fork [<url>] <parent-repo> <new-repo> [dir]");
         const token = process.env.SOL_TOKEN || authExpired();
         const target = resolve4(cwd, frest[2] || newRepo);
-        const fdir = join17(target, ".sol");
-        if (existsSync16(fdir))
+        const fdir = join18(target, ".sol");
+        if (existsSync17(fdir))
           die("already a sol repo: " + target);
         const parentCfg = { url, repo: parent };
         const newCfg = { url, repo: newRepo, forkParent: parent };
@@ -10656,7 +11024,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         }
         await forkMeta(newCfg, token, parent);
         const canon = await remoteExport(newCfg, token);
-        mkdirSync10(fdir, { recursive: true });
+        mkdirSync11(fdir, { recursive: true });
         await writeBundle(fdir, canon, 0);
         const srvRefs = canon.refs ?? { branches: { main: canon.head ?? "" }, production: "main" };
         const checkout = canon.checkout ?? { branch: srvRefs.production || "main", head: srvRefs.branches[srvRefs.production] ?? canon.head };
@@ -10665,8 +11033,8 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const cloneBranches = {};
         for (const [name, h] of Object.entries(srvRefs.branches))
           cloneBranches[name] = { head: h, base: h, remote: h };
-        writeFileSync14(join17(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
-        writeFileSync14(join17(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: canon.seq, logTip: canon.tip }));
+        writeFileSync15(join18(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
+        writeFileSync15(join18(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: canon.seq, logTip: canon.tip }));
         saveRemote(fdir, newCfg);
         const store2 = new Store;
         for (const node of canon.nodes)
@@ -10753,7 +11121,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const token = process.env.SOL_TOKEN || authExpired();
         const { mrSummary: mrSummary2 } = await Promise.resolve().then(() => exports_mr);
         const sub = args[0];
-        const localRefs = () => existsSync16(refsPath()) ? JSON.parse(readFileSync16(refsPath(), "utf8")) : { current: "main", branches: {}, tags: {} };
+        const localRefs = () => existsSync17(refsPath()) ? JSON.parse(readFileSync17(refsPath(), "utf8")) : { current: "main", branches: {}, tags: {} };
         const flag2 = (name) => {
           const i = args.indexOf(name);
           return i >= 0 ? args[i + 1] : undefined;
@@ -10931,7 +11299,7 @@ ${mrSummary2(pr)}`);
           die("usage: sol run [--keep <path>] [--isolate] <command...>");
         const { capture: capture3, hydrate: hydrate3, isolateCommand: isolateCommand2 } = await Promise.resolve().then(() => (init_runtime(), exports_runtime));
         const head = await repo.head();
-        const dir = mkdtempSync(join17(tmpdir(), "sol-run-"));
+        const dir = mkdtempSync(join18(tmpdir(), "sol-run-"));
         try {
           const hn = hydrate3(loadStore(), head, dir);
           console.log(`hydrated ${hn} file(s) -> sandbox${isolate ? " (isolated: no network, writes confined to the sandbox)" : ""}`);
@@ -10951,8 +11319,8 @@ ${mrSummary2(pr)}`);
           const { written, deleted } = await capture3(repo, dir, keep);
           if (written.length || deleted.length) {
             await appendCommit(log, await repo.head(), `run: ${command.join(" ")}`, head);
-            if (existsSync16(refsPath())) {
-              const refs = JSON.parse(readFileSync16(refsPath(), "utf8"));
+            if (existsSync17(refsPath())) {
+              const refs = JSON.parse(readFileSync17(refsPath(), "utf8"));
               if (refs.branches[refs.current]) {
                 refs.branches[refs.current].head = await repo.head();
                 saveRefs(refs);
@@ -10964,7 +11332,7 @@ ${mrSummary2(pr)}`);
               materialize(synced, nh, f);
             for (const f of deleted) {
               try {
-                unlinkSync6(join17(cwd, f));
+                unlinkSync7(join18(cwd, f));
               } catch {}
             }
             console.log(`captured ${written.length} written, ${deleted.length} deleted file(s):`);
@@ -10986,10 +11354,10 @@ ${mrSummary2(pr)}`);
         if (sub === "import") {
           const gitPath = resolve4(cwd, args[1] || die("usage: sol git import <git-repo> [dir]"));
           const target = resolve4(cwd, args[2] || basename(gitPath));
-          const fdir = join17(target, ".sol");
-          if (existsSync16(fdir))
+          const fdir = join18(target, ".sol");
+          if (existsSync17(fdir))
             die("already a sol repo: " + target);
-          mkdirSync10(fdir, { recursive: true });
+          mkdirSync11(fdir, { recursive: true });
           const { commits, branches, head, current } = await importGitRepo2(gitPath, fdir);
           const refsBranches = {};
           for (const b of branches)
@@ -10997,13 +11365,13 @@ ${mrSummary2(pr)}`);
           if (!refsBranches[current])
             refsBranches[current] = { head, base: head };
           refsBranches[current].head = head;
-          writeFileSync14(join17(fdir, "refs.json"), JSON.stringify({ current, branches: refsBranches, tags: {} }, null, 2));
+          writeFileSync15(join18(fdir, "refs.json"), JSON.stringify({ current, branches: refsBranches, tags: {} }, null, 2));
           const store2 = new Store;
-          for (const name of readdirSync6(join17(fdir, "objects"))) {
+          for (const name of readdirSync8(join18(fdir, "objects"))) {
             if (name.endsWith(".tmp"))
               continue;
             try {
-              store2.put(decodeObject(readFileSync16(join17(fdir, "objects", name))));
+              store2.put(decodeObject(readFileSync17(join18(fdir, "objects", name))));
             } catch {}
           }
           const onDisk = hydrate3(store2, head, target);
@@ -11035,9 +11403,9 @@ ${mrSummary2(pr)}`);
           die("already inside a view — create views from the parent repo (its `.sol` owns the shared store + op-log).");
         const name = args.find((a) => !a.startsWith("-")) || die("usage: sol view <name> [dir]");
         const rest = args.filter((a) => !a.startsWith("-"));
-        const defaultDir = join17(dirname4(cwd), `${basename(cwd)}-${name}`);
+        const defaultDir = join18(dirname4(cwd), `${basename(cwd)}-${name}`);
         const viewDir = rest[1] ? resolve4(procCwd, rest[1]) : defaultDir;
-        if (existsSync16(join17(viewDir, ".sol")))
+        if (existsSync17(join18(viewDir, ".sol")))
           die("already a sol repo/view: " + viewDir);
         const branch = `view/${name}`;
         const startHead = await log.head() ?? emptyRoot(loadStore());
@@ -11051,7 +11419,7 @@ ${mrSummary2(pr)}`);
         break;
       }
       case "views": {
-        if (!existsSync16(solDir))
+        if (!existsSync17(solDir))
           die("not a sol repo");
         const parentSol = parentSolDir(solDir) ?? solDir;
         const { pruneViews: pruneViews2, viewStatuses: viewStatuses2, sharedObjectCount: sharedObjectCount2 } = await Promise.resolve().then(() => (init_views(), exports_views));
@@ -11145,7 +11513,7 @@ ${mrSummary2(pr)}`);
           await startSecretMcp2({ solDir });
           break;
         }
-        if (!existsSync16(solDir))
+        if (!existsSync17(solDir))
           die("not a sol repo — run `sol init` first");
         const { runEnv: runEnv2, runSecret: runSecret2, resolveReference: resolveReference2 } = await Promise.resolve().then(() => (init_secret2(), exports_secret2));
         const { loadSelfIdentity: loadSelfIdentity2, loadManageIdentity: loadManageIdentity2, fetchKey: fetchKey2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
@@ -11318,18 +11686,18 @@ var init_dispatch = __esm(() => {
   init_remote();
   init_lib();
   init_test_gate();
-  CRED_PATH = join17(homedir2(), ".sol", "credentials");
+  CRED_PATH = join18(homedir2(), ".sol", "credentials");
   DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, "");
   ATTEST_KEY = process.env.SOL_ATTEST_KEY || undefined;
 });
 
 // src/bin/sol.ts
-import { readFileSync as readFileSync17 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 function cliVersion2() {
   if (typeof __SOL_COMPILED_VERSION__ === "string" && __SOL_COMPILED_VERSION__)
     return __SOL_COMPILED_VERSION__;
   try {
-    return JSON.parse(readFileSync17(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
+    return JSON.parse(readFileSync18(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
   } catch {
     return "dev";
   }