midsummer-sol 0.3.4 → 0.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "midsummer-sol",
-  "version": "0.3.4",
+  "version": "0.3.7",
   "description": "Sol — agent-native version control (a new git). CLI, MCP server, and no-filesystem SDK.",
   "bin": { "sol": "./sol.js", "sol-mcp": "./sol-mcp.js", "sol-secret-mcp": "./sol-secret-mcp.js" },
   "main": "./index.js",

package/sol-mcp.js

@@ -3036,6 +3036,7 @@ __export(exports_lib, {
   allLocalNodes: () => allLocalNodes,
   addInclude: () => addInclude,
   actor: () => actor,
+  acquireLockAt: () => acquireLockAt,
   acquireLock: () => acquireLock,
   LazyStore: () => LazyStore,
   DEFAULT_IGNORE: () => DEFAULT_IGNORE
@@ -3269,9 +3270,9 @@ function pidAlive(pid) {
     return e?.code === "EPERM";
   }
 }
-function acquireLock() {
-  const lockFile = join5(lockDir(), "lock");
-  const deadline = Date.now() + 15000;
+function acquireLockAt(lockFile, opts = {}) {
+  const deadline = Date.now() + (opts.timeoutMs ?? 15000);
+  const onTimeout = opts.onTimeout ?? "die";
   for (;; ) {
     try {
       writeFileSync5(lockFile, String(process.pid), { flag: "wx" });
@@ -3294,8 +3295,11 @@ function acquireLock() {
       } catch {
         continue;
       }
-      if (Date.now() > deadline)
-        die("repo is locked by another sol process (timed out)");
+      if (Date.now() > deadline) {
+        if (onTimeout === "undefined")
+          return;
+        die(opts.timeoutMsg ?? "repo is locked by another sol process (timed out)");
+      }
       sleepSync(25);
     }
   }
@@ -3311,6 +3315,9 @@ function acquireLock() {
   process.on("exit", release);
   return release;
 }
+function acquireLock() {
+  return acquireLockAt(join5(lockDir(), "lock"));
+}
 function loadStore() {
   return new LazyStore(objectsDir());
 }
@@ -4156,9 +4163,12 @@ var init_lib = __esm(() => {
 var exports_remote = {};
 __export(exports_remote, {
   writeBundle: () => writeBundle,
+  splitLeafPacks: () => splitLeafPacks,
   saveRemote: () => saveRemote,
   remoteRefs: () => remoteRefs,
   remotePushPack: () => remotePushPack,
+  remotePushGiantLeaf: () => remotePushGiantLeaf,
+  remotePushBlobs: () => remotePushBlobs,
   remotePush: () => remotePush,
   remotePromote: () => remotePromote,
   remoteHead: () => remoteHead,
@@ -4182,12 +4192,13 @@ __export(exports_remote, {
   loadRemote: () => loadRemote,
   forksList: () => forksList,
   forkMeta: () => forkMeta,
+  classifyNodes: () => classifyNodes,
   accessSet: () => accessSet,
   accessGet: () => accessGet
 });
 import { appendFileSync as appendFileSync4, existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join6 } from "node:path";
-import { gzipSync as gzipSync3 } from "node:zlib";
+import { gunzipSync as gunzipSync3, gzipSync as gzipSync3 } from "node:zlib";
 async function call(cfg, token, path, init) {
   const res = await fetch(endpoint(cfg, path), {
     ...init,
@@ -4197,6 +4208,147 @@ async function call(cfg, token, path, init) {
     throw new Error(`remote ${path} -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
   return res.json();
 }
+function decodePackLine(line) {
+  const map = JSON.parse(gunzipSync3(Buffer.from(line, "base64")).toString("utf8"));
+  return Object.values(map);
+}
+async function exportStreaming(cfg, token) {
+  const res = await fetch(endpoint(cfg, "/export?stream=1"), {
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
+  });
+  if (!res.ok)
+    throw new Error(`remote /export -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
+  if (!res.body)
+    return res.json();
+  const reader = res.body.getReader();
+  const td = new TextDecoder;
+  let buf = "";
+  let header;
+  const nodes = [];
+  const consumeLine = (line) => {
+    if (line === "")
+      return;
+    if (!header) {
+      header = JSON.parse(line);
+      if (Array.isArray(header.nodes))
+        for (const n of header.nodes)
+          nodes.push(n);
+      return;
+    }
+    for (const n of decodePackLine(line))
+      nodes.push(n);
+  };
+  for (;; ) {
+    const { done, value } = await reader.read();
+    if (value)
+      buf += td.decode(value, { stream: true });
+    let nl;
+    while ((nl = buf.indexOf(`
+`)) >= 0) {
+      consumeLine(buf.slice(0, nl));
+      buf = buf.slice(nl + 1);
+    }
+    if (done)
+      break;
+  }
+  buf += td.decode();
+  if (buf.length)
+    consumeLine(buf);
+  if (!header)
+    throw new Error("remote /export returned an empty stream");
+  return { ...header, nodes };
+}
+function classifyNodes(nodes) {
+  const trees = [];
+  const leaves = [];
+  let total = 0;
+  for (const n of nodes) {
+    total += nodeBytes(n);
+    (n.kind === "tree" ? trees : leaves).push(n);
+  }
+  return { trees, leaves, total };
+}
+function splitLeafPacks(leaves, maxBytes) {
+  const packs = [];
+  let cur = [];
+  let size = 0;
+  for (const n of leaves) {
+    const b = nodeBytes(n);
+    if (cur.length && size + b > maxBytes) {
+      packs.push(cur);
+      cur = [];
+      size = 0;
+    }
+    cur.push(n);
+    size += b;
+  }
+  if (cur.length)
+    packs.push(cur);
+  return packs;
+}
+async function pool(tasks, limit) {
+  const out = new Array(tasks.length);
+  let next = 0;
+  const worker = async () => {
+    for (;; ) {
+      const i = next++;
+      if (i >= tasks.length)
+        return;
+      out[i] = await tasks[i]();
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, tasks.length) }, worker));
+  return out;
+}
+async function retryTransient(fn, attempts = 5) {
+  let last;
+  for (let i = 0;i < attempts; i++) {
+    try {
+      return await fn();
+    } catch (e) {
+      last = e;
+      const m = e instanceof Error ? e.message : String(e);
+      if (!/-> 5dd|reset|fetch failed|network|ECONN|terminated|timeout/i.test(m))
+        throw e;
+      await new Promise((r) => setTimeout(r, 400 * (i + 1)));
+    }
+  }
+  throw last;
+}
+function canonicalPackBytesClient(entries) {
+  const sorted = [...entries].sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+  const obj = {};
+  for (const [h, n] of sorted)
+    obj[h] = n;
+  return JSON.stringify(obj);
+}
+async function remotePushGiantLeaf(cfg, token, node) {
+  const hash = hashNode(node);
+  const body = canonicalPackBytesClient([[hash, node]]);
+  const packId = hashString(body);
+  const packBody = gzipSync3(Buffer.from(body, "utf8")).toString("base64");
+  const path = `/push/blobs?giant=${encodeURIComponent(hash)}&packId=${encodeURIComponent(packId)}`;
+  return retryTransient(() => call(cfg, token, path, { method: "POST", body: packBody }));
+}
+async function remotePushPack(cfg, token, body) {
+  const { trees, leaves, total } = classifyNodes(body.nodes);
+  if (total <= SMALL_PUSH_BYTES) {
+    return retryTransient(() => call(cfg, token, "/push/pack", { method: "POST", body: gzipSync3(JSON.stringify(body)), headers: { "content-encoding": "gzip" } }));
+  }
+  const giants = leaves.filter((n) => nodeBytes(n) > GIANT_LEAF_BYTES);
+  const normal = leaves.filter((n) => nodeBytes(n) <= GIANT_LEAF_BYTES);
+  const blobPacks = splitLeafPacks(normal, BLOB_PACK_BYTES);
+  const tasks = [
+    ...blobPacks.map((pack) => () => remotePushBlobs(cfg, token, pack)),
+    ...giants.map((node) => () => remotePushGiantLeaf(cfg, token, node))
+  ];
+  await pool(tasks, BLOB_PACK_CONCURRENCY);
+  return retryTransient(() => call(cfg, token, "/push/pack", {
+    method: "POST",
+    body: gzipSync3(JSON.stringify({ ...body, nodes: trees })),
+    headers: { "content-encoding": "gzip" }
+  }));
+}
 function loadRemote(solDir2) {
   const p = join6(solDir2, "remote.json");
   return existsSync6(p) ? JSON.parse(readFileSync6(p, "utf8")) : undefined;
@@ -4217,9 +4369,13 @@ async function writeBundle(solDir2, bundle, from = 0) {
   writeFileSync6(join6(solDir2, "HEAD"), JSON.stringify({ head: bundle.head, seq: bundle.seq, logTip: bundle.tip }));
   return fresh.length;
 }
-var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteGate = (cfg, token, branch) => call(cfg, token, `/head?gateState=true${branch ? `&branch=${encodeURIComponent(branch)}` : ""}`), remoteExport = (cfg, token) => call(cfg, token, "/export"), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), remotePushPack = (cfg, token, body) => call(cfg, token, "/push/pack", { method: "POST", body: gzipSync3(JSON.stringify(body)), headers: { "content-encoding": "gzip" } }), mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), ownerSet = (cfg, token, ownerHandle) => call(cfg, token, "/owner", { method: "POST", body: JSON.stringify({ ownerHandle }) }), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync6(join6(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
+var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteGate = (cfg, token, branch) => call(cfg, token, `/head?gateState=true${branch ? `&branch=${encodeURIComponent(branch)}` : ""}`), remoteExport = (cfg, token) => exportStreaming(cfg, token), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), SMALL_PUSH_BYTES, BLOB_PACK_BYTES, BLOB_PACK_CONCURRENCY = 6, GIANT_LEAF_BYTES, nodeBytes = (n) => JSON.stringify(n).length, remotePushBlobs = (cfg, token, nodes) => retryTransient(() => call(cfg, token, "/push/blobs", { method: "POST", body: gzipSync3(JSON.stringify({ nodes })), headers: { "content-encoding": "gzip" } })), mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), ownerSet = (cfg, token, ownerHandle) => call(cfg, token, "/owner", { method: "POST", body: JSON.stringify({ ownerHandle }) }), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync6(join6(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
 var init_remote = __esm(() => {
   init_file_store2();
+  init_store();
+  SMALL_PUSH_BYTES = 24 * 1024 * 1024;
+  BLOB_PACK_BYTES = 16 * 1024 * 1024;
+  GIANT_LEAF_BYTES = 24 * 1024 * 1024;
 });
 
 // src/bin/test-gate.ts
@@ -9620,21 +9776,41 @@ function tokenClaims(token) {
     return {};
   }
 }
-async function loadStoredToken() {
-  if (!existsSync20(CRED_PATH))
-    return;
-  let creds;
+function readCreds() {
   try {
-    creds = JSON.parse(readFileSync20(CRED_PATH, "utf8"));
+    return JSON.parse(readFileSync20(CRED_PATH, "utf8"));
   } catch {
     return;
   }
-  if (!creds.accessToken)
+}
+function accessTokenFresh(accessToken) {
+  if (!accessToken)
+    return false;
+  const exp = tokenClaims(accessToken).exp;
+  return typeof exp === "number" && exp * 1000 > Date.now() + 30000;
+}
+async function loadStoredToken() {
+  if (!existsSync20(CRED_PATH))
     return;
-  const exp = tokenClaims(creds.accessToken).exp;
-  if (typeof exp === "number" && exp * 1000 > Date.now() + 30000)
+  let creds = readCreds();
+  if (!creds?.accessToken)
+    return;
+  if (accessTokenFresh(creds.accessToken))
+    return creds.accessToken;
+  if (!(creds.refreshToken && creds.webUrl))
     return creds.accessToken;
-  if (creds.refreshToken && creds.webUrl) {
+  const release = acquireLockAt(join19(dirname5(CRED_PATH), "credentials.lock"), {
+    timeoutMs: 1e4,
+    onTimeout: "undefined"
+  });
+  try {
+    if (release) {
+      const fresh = readCreds();
+      if (fresh?.accessToken && accessTokenFresh(fresh.accessToken))
+        return fresh.accessToken;
+      if (fresh)
+        creds = fresh;
+    }
     try {
       const res = await fetch(`${creds.webUrl}/api/auth/refresh`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ refreshToken: creds.refreshToken }) });
       if (res.ok) {
@@ -9645,8 +9821,10 @@ async function loadStoredToken() {
         }
       }
     } catch {}
+    return creds.accessToken;
+  } finally {
+    release?.();
   }
-  return creds.accessToken;
 }
 function authExpired() {
   return die("session expired — run `sol auth login` (or set SOL_TOKEN)");
@@ -12389,8 +12567,12 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             const days = Number(patAction) || 90;
             const name = (Number(patAction) ? args[2] : patAction) || undefined;
             const res = await fetch(`${creds.webUrl}/api/auth/pat`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify({ days, ...name ? { name } : {} }) });
-            if (!res.ok)
-              die(`could not mint a PAT (${res.status})`);
+            if (!res.ok) {
+              const reason = await res.json().then((b) => b?.error?.detail || b?.error?.message).catch(() => {
+                return;
+              });
+              die(`could not mint a PAT (${res.status})${reason ? `: ${reason}` : ""}`);
+            }
             const out = await res.json();
             console.log(`
   Personal Access Token "${out.name}" (id ${out.id}, expires in ${days} days) — store it now, it is not shown again:

package/sol.js

@@ -2269,6 +2269,7 @@ __export(exports_lib, {
   allLocalNodes: () => allLocalNodes,
   addInclude: () => addInclude,
   actor: () => actor,
+  acquireLockAt: () => acquireLockAt,
   acquireLock: () => acquireLock,
   LazyStore: () => LazyStore,
   DEFAULT_IGNORE: () => DEFAULT_IGNORE
@@ -2502,9 +2503,9 @@ function pidAlive(pid) {
     return e?.code === "EPERM";
   }
 }
-function acquireLock() {
-  const lockFile = join4(lockDir(), "lock");
-  const deadline = Date.now() + 15000;
+function acquireLockAt(lockFile, opts = {}) {
+  const deadline = Date.now() + (opts.timeoutMs ?? 15000);
+  const onTimeout = opts.onTimeout ?? "die";
   for (;; ) {
     try {
       writeFileSync4(lockFile, String(process.pid), { flag: "wx" });
@@ -2527,8 +2528,11 @@ function acquireLock() {
       } catch {
         continue;
       }
-      if (Date.now() > deadline)
-        die("repo is locked by another sol process (timed out)");
+      if (Date.now() > deadline) {
+        if (onTimeout === "undefined")
+          return;
+        die(opts.timeoutMsg ?? "repo is locked by another sol process (timed out)");
+      }
       sleepSync(25);
     }
   }
@@ -2544,6 +2548,9 @@ function acquireLock() {
   process.on("exit", release);
   return release;
 }
+function acquireLock() {
+  return acquireLockAt(join4(lockDir(), "lock"));
+}
 function loadStore() {
   return new LazyStore(objectsDir());
 }
@@ -3389,9 +3396,12 @@ var init_lib = __esm(() => {
 var exports_remote = {};
 __export(exports_remote, {
   writeBundle: () => writeBundle,
+  splitLeafPacks: () => splitLeafPacks,
   saveRemote: () => saveRemote,
   remoteRefs: () => remoteRefs,
   remotePushPack: () => remotePushPack,
+  remotePushGiantLeaf: () => remotePushGiantLeaf,
+  remotePushBlobs: () => remotePushBlobs,
   remotePush: () => remotePush,
   remotePromote: () => remotePromote,
   remoteHead: () => remoteHead,
@@ -3415,12 +3425,13 @@ __export(exports_remote, {
   loadRemote: () => loadRemote,
   forksList: () => forksList,
   forkMeta: () => forkMeta,
+  classifyNodes: () => classifyNodes,
   accessSet: () => accessSet,
   accessGet: () => accessGet
 });
 import { appendFileSync as appendFileSync3, existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join5 } from "node:path";
-import { gzipSync as gzipSync2 } from "node:zlib";
+import { gunzipSync as gunzipSync2, gzipSync as gzipSync2 } from "node:zlib";
 async function call(cfg, token, path, init) {
   const res = await fetch(endpoint(cfg, path), {
     ...init,
@@ -3430,6 +3441,147 @@ async function call(cfg, token, path, init) {
     throw new Error(`remote ${path} -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
   return res.json();
 }
+function decodePackLine(line) {
+  const map = JSON.parse(gunzipSync2(Buffer.from(line, "base64")).toString("utf8"));
+  return Object.values(map);
+}
+async function exportStreaming(cfg, token) {
+  const res = await fetch(endpoint(cfg, "/export?stream=1"), {
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
+  });
+  if (!res.ok)
+    throw new Error(`remote /export -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
+  if (!res.body)
+    return res.json();
+  const reader = res.body.getReader();
+  const td = new TextDecoder;
+  let buf = "";
+  let header;
+  const nodes = [];
+  const consumeLine = (line) => {
+    if (line === "")
+      return;
+    if (!header) {
+      header = JSON.parse(line);
+      if (Array.isArray(header.nodes))
+        for (const n of header.nodes)
+          nodes.push(n);
+      return;
+    }
+    for (const n of decodePackLine(line))
+      nodes.push(n);
+  };
+  for (;; ) {
+    const { done, value } = await reader.read();
+    if (value)
+      buf += td.decode(value, { stream: true });
+    let nl;
+    while ((nl = buf.indexOf(`
+`)) >= 0) {
+      consumeLine(buf.slice(0, nl));
+      buf = buf.slice(nl + 1);
+    }
+    if (done)
+      break;
+  }
+  buf += td.decode();
+  if (buf.length)
+    consumeLine(buf);
+  if (!header)
+    throw new Error("remote /export returned an empty stream");
+  return { ...header, nodes };
+}
+function classifyNodes(nodes) {
+  const trees = [];
+  const leaves = [];
+  let total = 0;
+  for (const n of nodes) {
+    total += nodeBytes(n);
+    (n.kind === "tree" ? trees : leaves).push(n);
+  }
+  return { trees, leaves, total };
+}
+function splitLeafPacks(leaves, maxBytes) {
+  const packs = [];
+  let cur = [];
+  let size = 0;
+  for (const n of leaves) {
+    const b = nodeBytes(n);
+    if (cur.length && size + b > maxBytes) {
+      packs.push(cur);
+      cur = [];
+      size = 0;
+    }
+    cur.push(n);
+    size += b;
+  }
+  if (cur.length)
+    packs.push(cur);
+  return packs;
+}
+async function pool(tasks, limit) {
+  const out = new Array(tasks.length);
+  let next = 0;
+  const worker = async () => {
+    for (;; ) {
+      const i = next++;
+      if (i >= tasks.length)
+        return;
+      out[i] = await tasks[i]();
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, tasks.length) }, worker));
+  return out;
+}
+async function retryTransient(fn, attempts = 5) {
+  let last;
+  for (let i = 0;i < attempts; i++) {
+    try {
+      return await fn();
+    } catch (e) {
+      last = e;
+      const m = e instanceof Error ? e.message : String(e);
+      if (!/-> 5dd|reset|fetch failed|network|ECONN|terminated|timeout/i.test(m))
+        throw e;
+      await new Promise((r) => setTimeout(r, 400 * (i + 1)));
+    }
+  }
+  throw last;
+}
+function canonicalPackBytesClient(entries) {
+  const sorted = [...entries].sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+  const obj = {};
+  for (const [h, n] of sorted)
+    obj[h] = n;
+  return JSON.stringify(obj);
+}
+async function remotePushGiantLeaf(cfg, token, node) {
+  const hash = hashNode(node);
+  const body = canonicalPackBytesClient([[hash, node]]);
+  const packId = hashString(body);
+  const packBody = gzipSync2(Buffer.from(body, "utf8")).toString("base64");
+  const path = `/push/blobs?giant=${encodeURIComponent(hash)}&packId=${encodeURIComponent(packId)}`;
+  return retryTransient(() => call(cfg, token, path, { method: "POST", body: packBody }));
+}
+async function remotePushPack(cfg, token, body) {
+  const { trees, leaves, total } = classifyNodes(body.nodes);
+  if (total <= SMALL_PUSH_BYTES) {
+    return retryTransient(() => call(cfg, token, "/push/pack", { method: "POST", body: gzipSync2(JSON.stringify(body)), headers: { "content-encoding": "gzip" } }));
+  }
+  const giants = leaves.filter((n) => nodeBytes(n) > GIANT_LEAF_BYTES);
+  const normal = leaves.filter((n) => nodeBytes(n) <= GIANT_LEAF_BYTES);
+  const blobPacks = splitLeafPacks(normal, BLOB_PACK_BYTES);
+  const tasks = [
+    ...blobPacks.map((pack) => () => remotePushBlobs(cfg, token, pack)),
+    ...giants.map((node) => () => remotePushGiantLeaf(cfg, token, node))
+  ];
+  await pool(tasks, BLOB_PACK_CONCURRENCY);
+  return retryTransient(() => call(cfg, token, "/push/pack", {
+    method: "POST",
+    body: gzipSync2(JSON.stringify({ ...body, nodes: trees })),
+    headers: { "content-encoding": "gzip" }
+  }));
+}
 function loadRemote(solDir2) {
   const p = join5(solDir2, "remote.json");
   return existsSync5(p) ? JSON.parse(readFileSync5(p, "utf8")) : undefined;
@@ -3450,9 +3602,13 @@ async function writeBundle(solDir2, bundle, from = 0) {
   writeFileSync5(join5(solDir2, "HEAD"), JSON.stringify({ head: bundle.head, seq: bundle.seq, logTip: bundle.tip }));
   return fresh.length;
 }
-var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteGate = (cfg, token, branch) => call(cfg, token, `/head?gateState=true${branch ? `&branch=${encodeURIComponent(branch)}` : ""}`), remoteExport = (cfg, token) => call(cfg, token, "/export"), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), remotePushPack = (cfg, token, body) => call(cfg, token, "/push/pack", { method: "POST", body: gzipSync2(JSON.stringify(body)), headers: { "content-encoding": "gzip" } }), mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), ownerSet = (cfg, token, ownerHandle) => call(cfg, token, "/owner", { method: "POST", body: JSON.stringify({ ownerHandle }) }), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync5(join5(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
+var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteGate = (cfg, token, branch) => call(cfg, token, `/head?gateState=true${branch ? `&branch=${encodeURIComponent(branch)}` : ""}`), remoteExport = (cfg, token) => exportStreaming(cfg, token), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), SMALL_PUSH_BYTES, BLOB_PACK_BYTES, BLOB_PACK_CONCURRENCY = 6, GIANT_LEAF_BYTES, nodeBytes = (n) => JSON.stringify(n).length, remotePushBlobs = (cfg, token, nodes) => retryTransient(() => call(cfg, token, "/push/blobs", { method: "POST", body: gzipSync2(JSON.stringify({ nodes })), headers: { "content-encoding": "gzip" } })), mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), ownerSet = (cfg, token, ownerHandle) => call(cfg, token, "/owner", { method: "POST", body: JSON.stringify({ ownerHandle }) }), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync5(join5(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
 var init_remote = __esm(() => {
   init_file_store();
+  init_store();
+  SMALL_PUSH_BYTES = 24 * 1024 * 1024;
+  BLOB_PACK_BYTES = 16 * 1024 * 1024;
+  GIANT_LEAF_BYTES = 24 * 1024 * 1024;
 });
 
 // src/bin/test-gate.ts
@@ -9388,21 +9544,41 @@ function tokenClaims(token) {
     return {};
   }
 }
-async function loadStoredToken() {
-  if (!existsSync19(CRED_PATH))
-    return;
-  let creds;
+function readCreds() {
   try {
-    creds = JSON.parse(readFileSync19(CRED_PATH, "utf8"));
+    return JSON.parse(readFileSync19(CRED_PATH, "utf8"));
   } catch {
     return;
   }
-  if (!creds.accessToken)
+}
+function accessTokenFresh(accessToken) {
+  if (!accessToken)
+    return false;
+  const exp = tokenClaims(accessToken).exp;
+  return typeof exp === "number" && exp * 1000 > Date.now() + 30000;
+}
+async function loadStoredToken() {
+  if (!existsSync19(CRED_PATH))
+    return;
+  let creds = readCreds();
+  if (!creds?.accessToken)
     return;
-  const exp = tokenClaims(creds.accessToken).exp;
-  if (typeof exp === "number" && exp * 1000 > Date.now() + 30000)
+  if (accessTokenFresh(creds.accessToken))
     return creds.accessToken;
-  if (creds.refreshToken && creds.webUrl) {
+  if (!(creds.refreshToken && creds.webUrl))
+    return creds.accessToken;
+  const release = acquireLockAt(join18(dirname5(CRED_PATH), "credentials.lock"), {
+    timeoutMs: 1e4,
+    onTimeout: "undefined"
+  });
+  try {
+    if (release) {
+      const fresh = readCreds();
+      if (fresh?.accessToken && accessTokenFresh(fresh.accessToken))
+        return fresh.accessToken;
+      if (fresh)
+        creds = fresh;
+    }
     try {
       const res = await fetch(`${creds.webUrl}/api/auth/refresh`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ refreshToken: creds.refreshToken }) });
       if (res.ok) {
@@ -9413,8 +9589,10 @@ async function loadStoredToken() {
         }
       }
     } catch {}
+    return creds.accessToken;
+  } finally {
+    release?.();
   }
-  return creds.accessToken;
 }
 function authExpired() {
   return die("session expired — run `sol auth login` (or set SOL_TOKEN)");
@@ -12157,8 +12335,12 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             const days = Number(patAction) || 90;
             const name = (Number(patAction) ? args[2] : patAction) || undefined;
             const res = await fetch(`${creds.webUrl}/api/auth/pat`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify({ days, ...name ? { name } : {} }) });
-            if (!res.ok)
-              die(`could not mint a PAT (${res.status})`);
+            if (!res.ok) {
+              const reason = await res.json().then((b) => b?.error?.detail || b?.error?.message).catch(() => {
+                return;
+              });
+              die(`could not mint a PAT (${res.status})${reason ? `: ${reason}` : ""}`);
+            }
             const out = await res.json();
             console.log(`
   Personal Access Token "${out.name}" (id ${out.id}, expires in ${days} days) — store it now, it is not shown again:
@@ -13672,21 +13854,41 @@ function tokenClaims2(token) {
     return {};
   }
 }
-async function loadStoredToken2() {
-  if (!existsSync20(CRED_PATH2))
-    return;
-  let creds;
+function readCreds2() {
   try {
-    creds = JSON.parse(readFileSync20(CRED_PATH2, "utf8"));
+    return JSON.parse(readFileSync20(CRED_PATH2, "utf8"));
   } catch {
     return;
   }
-  if (!creds.accessToken)
+}
+function accessTokenFresh2(accessToken) {
+  if (!accessToken)
+    return false;
+  const exp = tokenClaims2(accessToken).exp;
+  return typeof exp === "number" && exp * 1000 > Date.now() + 30000;
+}
+async function loadStoredToken2() {
+  if (!existsSync20(CRED_PATH2))
+    return;
+  let creds = readCreds2();
+  if (!creds?.accessToken)
     return;
-  const exp = tokenClaims2(creds.accessToken).exp;
-  if (typeof exp === "number" && exp * 1000 > Date.now() + 30000)
+  if (accessTokenFresh2(creds.accessToken))
     return creds.accessToken;
-  if (creds.refreshToken && creds.webUrl) {
+  if (!(creds.refreshToken && creds.webUrl))
+    return creds.accessToken;
+  const release = acquireLockAt(join20(dirname7(CRED_PATH2), "credentials.lock"), {
+    timeoutMs: 1e4,
+    onTimeout: "undefined"
+  });
+  try {
+    if (release) {
+      const fresh = readCreds2();
+      if (fresh?.accessToken && accessTokenFresh2(fresh.accessToken))
+        return fresh.accessToken;
+      if (fresh)
+        creds = fresh;
+    }
     try {
       const res = await fetch(`${creds.webUrl}/api/auth/refresh`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ refreshToken: creds.refreshToken }) });
       if (res.ok) {
@@ -13697,8 +13899,10 @@ async function loadStoredToken2() {
         }
       }
     } catch {}
+    return creds.accessToken;
+  } finally {
+    release?.();
   }
-  return creds.accessToken;
 }
 function authExpired2() {
   return die("session expired — run `sol auth login` (or set SOL_TOKEN)");
@@ -16441,8 +16645,12 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             const days = Number(patAction) || 90;
             const name = (Number(patAction) ? args[2] : patAction) || undefined;
             const res = await fetch(`${creds.webUrl}/api/auth/pat`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify({ days, ...name ? { name } : {} }) });
-            if (!res.ok)
-              die(`could not mint a PAT (${res.status})`);
+            if (!res.ok) {
+              const reason = await res.json().then((b) => b?.error?.detail || b?.error?.message).catch(() => {
+                return;
+              });
+              die(`could not mint a PAT (${res.status})${reason ? `: ${reason}` : ""}`);
+            }
             const out = await res.json();
             console.log(`
   Personal Access Token "${out.name}" (id ${out.id}, expires in ${days} days) — store it now, it is not shown again: