midsummer-sol 0.3.6 → 0.3.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "midsummer-sol",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Sol — agent-native version control (a new git). CLI, MCP server, and no-filesystem SDK.",
   "bin": { "sol": "./sol.js", "sol-mcp": "./sol-mcp.js", "sol-secret-mcp": "./sol-secret-mcp.js" },
   "main": "./index.js",

package/sol-mcp.js

@@ -3036,6 +3036,7 @@ __export(exports_lib, {
   allLocalNodes: () => allLocalNodes,
   addInclude: () => addInclude,
   actor: () => actor,
+  acquireLockAt: () => acquireLockAt,
   acquireLock: () => acquireLock,
   LazyStore: () => LazyStore,
   DEFAULT_IGNORE: () => DEFAULT_IGNORE
@@ -3269,9 +3270,9 @@ function pidAlive(pid) {
     return e?.code === "EPERM";
   }
 }
-function acquireLock() {
-  const lockFile = join5(lockDir(), "lock");
-  const deadline = Date.now() + 15000;
+function acquireLockAt(lockFile, opts = {}) {
+  const deadline = Date.now() + (opts.timeoutMs ?? 15000);
+  const onTimeout = opts.onTimeout ?? "die";
   for (;; ) {
     try {
       writeFileSync5(lockFile, String(process.pid), { flag: "wx" });
@@ -3294,8 +3295,11 @@ function acquireLock() {
       } catch {
         continue;
       }
-      if (Date.now() > deadline)
-        die("repo is locked by another sol process (timed out)");
+      if (Date.now() > deadline) {
+        if (onTimeout === "undefined")
+          return;
+        die(opts.timeoutMsg ?? "repo is locked by another sol process (timed out)");
+      }
       sleepSync(25);
     }
   }
@@ -3311,6 +3315,9 @@ function acquireLock() {
   process.on("exit", release);
   return release;
 }
+function acquireLock() {
+  return acquireLockAt(join5(lockDir(), "lock"));
+}
 function loadStore() {
   return new LazyStore(objectsDir());
 }
@@ -4160,6 +4167,7 @@ __export(exports_remote, {
   saveRemote: () => saveRemote,
   remoteRefs: () => remoteRefs,
   remotePushPack: () => remotePushPack,
+  remotePushGiantLeaf: () => remotePushGiantLeaf,
   remotePushBlobs: () => remotePushBlobs,
   remotePush: () => remotePush,
   remotePromote: () => remotePromote,
@@ -4184,6 +4192,7 @@ __export(exports_remote, {
   loadRemote: () => loadRemote,
   forksList: () => forksList,
   forkMeta: () => forkMeta,
+  exportStreaming: () => exportStreaming,
   classifyNodes: () => classifyNodes,
   accessSet: () => accessSet,
   accessGet: () => accessGet
@@ -4250,6 +4259,37 @@ async function exportStreaming(cfg, token) {
     throw new Error("remote /export returned an empty stream");
   return { ...header, nodes };
 }
+async function exportManifest(cfg, token) {
+  const res = await fetch(endpoint(cfg, "/export/manifest"), {
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
+  });
+  if (res.status === 404)
+    return exportStreaming(cfg, token);
+  if (!res.ok)
+    throw new Error(`remote /export/manifest -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
+  const m = await res.json();
+  if (!Array.isArray(m.packIds))
+    return exportStreaming(cfg, token);
+  const tasks = [
+    ...(m.packIds ?? []).map((packId) => () => fetchPack(cfg, token, packId, false)),
+    ...(m.legacyNodes ?? []).map((hash) => () => fetchPack(cfg, token, hash, true))
+  ];
+  const packNodes = await pool(tasks, CLONE_PACK_CONCURRENCY);
+  const nodes = [];
+  for (const ns of packNodes)
+    for (const n of ns)
+      nodes.push(n);
+  return { schema: m.schema, head: m.head, seq: m.seq, tip: m.tip, ops: m.ops, nodes, refs: m.refs, checkout: m.checkout };
+}
+async function fetchPack(cfg, token, id, legacy) {
+  return retryTransient(async () => {
+    const path = `/pack/${encodeURIComponent(id)}${legacy ? "?legacy=1" : ""}`;
+    const res = await fetch(endpoint(cfg, path), { headers: { authorization: `Bearer ${token}` } });
+    if (!res.ok)
+      throw new Error(`remote /pack -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
+    return decodePackLine((await res.text()).trim());
+  });
+}
 function classifyNodes(nodes) {
   const trees = [];
   const leaves = [];
@@ -4307,13 +4347,34 @@ async function retryTransient(fn, attempts = 5) {
   }
   throw last;
 }
+function canonicalPackBytesClient(entries) {
+  const sorted = [...entries].sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+  const obj = {};
+  for (const [h, n] of sorted)
+    obj[h] = n;
+  return JSON.stringify(obj);
+}
+async function remotePushGiantLeaf(cfg, token, node) {
+  const hash = hashNode(node);
+  const body = canonicalPackBytesClient([[hash, node]]);
+  const packId = hashString(body);
+  const packBody = gzipSync3(Buffer.from(body, "utf8")).toString("base64");
+  const path = `/push/blobs?giant=${encodeURIComponent(hash)}&packId=${encodeURIComponent(packId)}`;
+  return retryTransient(() => call(cfg, token, path, { method: "POST", body: packBody }));
+}
 async function remotePushPack(cfg, token, body) {
   const { trees, leaves, total } = classifyNodes(body.nodes);
   if (total <= SMALL_PUSH_BYTES) {
     return retryTransient(() => call(cfg, token, "/push/pack", { method: "POST", body: gzipSync3(JSON.stringify(body)), headers: { "content-encoding": "gzip" } }));
   }
-  const blobPacks = splitLeafPacks(leaves, BLOB_PACK_BYTES);
-  await pool(blobPacks.map((pack) => () => remotePushBlobs(cfg, token, pack)), BLOB_PACK_CONCURRENCY);
+  const giants = leaves.filter((n) => nodeBytes(n) > GIANT_LEAF_BYTES);
+  const normal = leaves.filter((n) => nodeBytes(n) <= GIANT_LEAF_BYTES);
+  const blobPacks = splitLeafPacks(normal, BLOB_PACK_BYTES);
+  const tasks = [
+    ...blobPacks.map((pack) => () => remotePushBlobs(cfg, token, pack)),
+    ...giants.map((node) => () => remotePushGiantLeaf(cfg, token, node))
+  ];
+  await pool(tasks, BLOB_PACK_CONCURRENCY);
   return retryTransient(() => call(cfg, token, "/push/pack", {
     method: "POST",
     body: gzipSync3(JSON.stringify({ ...body, nodes: trees })),
@@ -4340,11 +4401,13 @@ async function writeBundle(solDir2, bundle, from = 0) {
   writeFileSync6(join6(solDir2, "HEAD"), JSON.stringify({ head: bundle.head, seq: bundle.seq, logTip: bundle.tip }));
   return fresh.length;
 }
-var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteGate = (cfg, token, branch) => call(cfg, token, `/head?gateState=true${branch ? `&branch=${encodeURIComponent(branch)}` : ""}`), remoteExport = (cfg, token) => exportStreaming(cfg, token), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), SMALL_PUSH_BYTES, BLOB_PACK_BYTES, BLOB_PACK_CONCURRENCY = 1, nodeBytes = (n) => JSON.stringify(n).length, remotePushBlobs = (cfg, token, nodes) => retryTransient(() => call(cfg, token, "/push/blobs", { method: "POST", body: gzipSync3(JSON.stringify({ nodes })), headers: { "content-encoding": "gzip" } })), mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), ownerSet = (cfg, token, ownerHandle) => call(cfg, token, "/owner", { method: "POST", body: JSON.stringify({ ownerHandle }) }), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync6(join6(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
+var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteGate = (cfg, token, branch) => call(cfg, token, `/head?gateState=true${branch ? `&branch=${encodeURIComponent(branch)}` : ""}`), CLONE_PACK_CONCURRENCY = 12, remoteExport = (cfg, token) => exportManifest(cfg, token), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), SMALL_PUSH_BYTES, BLOB_PACK_BYTES, BLOB_PACK_CONCURRENCY = 6, GIANT_LEAF_BYTES, nodeBytes = (n) => JSON.stringify(n).length, remotePushBlobs = (cfg, token, nodes) => retryTransient(() => call(cfg, token, "/push/blobs", { method: "POST", body: gzipSync3(JSON.stringify({ nodes })), headers: { "content-encoding": "gzip" } })), mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), ownerSet = (cfg, token, ownerHandle) => call(cfg, token, "/owner", { method: "POST", body: JSON.stringify({ ownerHandle }) }), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync6(join6(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
 var init_remote = __esm(() => {
   init_file_store2();
+  init_store();
   SMALL_PUSH_BYTES = 24 * 1024 * 1024;
   BLOB_PACK_BYTES = 16 * 1024 * 1024;
+  GIANT_LEAF_BYTES = 24 * 1024 * 1024;
 });
 
 // src/bin/test-gate.ts
@@ -9745,21 +9808,41 @@ function tokenClaims(token) {
     return {};
   }
 }
-async function loadStoredToken() {
-  if (!existsSync20(CRED_PATH))
-    return;
-  let creds;
+function readCreds() {
   try {
-    creds = JSON.parse(readFileSync20(CRED_PATH, "utf8"));
+    return JSON.parse(readFileSync20(CRED_PATH, "utf8"));
   } catch {
     return;
   }
-  if (!creds.accessToken)
+}
+function accessTokenFresh(accessToken) {
+  if (!accessToken)
+    return false;
+  const exp = tokenClaims(accessToken).exp;
+  return typeof exp === "number" && exp * 1000 > Date.now() + 30000;
+}
+async function loadStoredToken() {
+  if (!existsSync20(CRED_PATH))
+    return;
+  let creds = readCreds();
+  if (!creds?.accessToken)
     return;
-  const exp = tokenClaims(creds.accessToken).exp;
-  if (typeof exp === "number" && exp * 1000 > Date.now() + 30000)
+  if (accessTokenFresh(creds.accessToken))
     return creds.accessToken;
-  if (creds.refreshToken && creds.webUrl) {
+  if (!(creds.refreshToken && creds.webUrl))
+    return creds.accessToken;
+  const release = acquireLockAt(join19(dirname5(CRED_PATH), "credentials.lock"), {
+    timeoutMs: 1e4,
+    onTimeout: "undefined"
+  });
+  try {
+    if (release) {
+      const fresh = readCreds();
+      if (fresh?.accessToken && accessTokenFresh(fresh.accessToken))
+        return fresh.accessToken;
+      if (fresh)
+        creds = fresh;
+    }
     try {
       const res = await fetch(`${creds.webUrl}/api/auth/refresh`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ refreshToken: creds.refreshToken }) });
       if (res.ok) {
@@ -9770,8 +9853,10 @@ async function loadStoredToken() {
         }
       }
     } catch {}
+    return creds.accessToken;
+  } finally {
+    release?.();
   }
-  return creds.accessToken;
 }
 function authExpired() {
   return die("session expired — run `sol auth login` (or set SOL_TOKEN)");
@@ -12514,8 +12599,12 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             const days = Number(patAction) || 90;
             const name = (Number(patAction) ? args[2] : patAction) || undefined;
             const res = await fetch(`${creds.webUrl}/api/auth/pat`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify({ days, ...name ? { name } : {} }) });
-            if (!res.ok)
-              die(`could not mint a PAT (${res.status})`);
+            if (!res.ok) {
+              const reason = await res.json().then((b) => b?.error?.detail || b?.error?.message).catch(() => {
+                return;
+              });
+              die(`could not mint a PAT (${res.status})${reason ? `: ${reason}` : ""}`);
+            }
             const out = await res.json();
             console.log(`
   Personal Access Token "${out.name}" (id ${out.id}, expires in ${days} days) — store it now, it is not shown again:

package/sol.js

@@ -2269,6 +2269,7 @@ __export(exports_lib, {
   allLocalNodes: () => allLocalNodes,
   addInclude: () => addInclude,
   actor: () => actor,
+  acquireLockAt: () => acquireLockAt,
   acquireLock: () => acquireLock,
   LazyStore: () => LazyStore,
   DEFAULT_IGNORE: () => DEFAULT_IGNORE
@@ -2502,9 +2503,9 @@ function pidAlive(pid) {
     return e?.code === "EPERM";
   }
 }
-function acquireLock() {
-  const lockFile = join4(lockDir(), "lock");
-  const deadline = Date.now() + 15000;
+function acquireLockAt(lockFile, opts = {}) {
+  const deadline = Date.now() + (opts.timeoutMs ?? 15000);
+  const onTimeout = opts.onTimeout ?? "die";
   for (;; ) {
     try {
       writeFileSync4(lockFile, String(process.pid), { flag: "wx" });
@@ -2527,8 +2528,11 @@ function acquireLock() {
       } catch {
         continue;
       }
-      if (Date.now() > deadline)
-        die("repo is locked by another sol process (timed out)");
+      if (Date.now() > deadline) {
+        if (onTimeout === "undefined")
+          return;
+        die(opts.timeoutMsg ?? "repo is locked by another sol process (timed out)");
+      }
       sleepSync(25);
     }
   }
@@ -2544,6 +2548,9 @@ function acquireLock() {
   process.on("exit", release);
   return release;
 }
+function acquireLock() {
+  return acquireLockAt(join4(lockDir(), "lock"));
+}
 function loadStore() {
   return new LazyStore(objectsDir());
 }
@@ -3393,6 +3400,7 @@ __export(exports_remote, {
   saveRemote: () => saveRemote,
   remoteRefs: () => remoteRefs,
   remotePushPack: () => remotePushPack,
+  remotePushGiantLeaf: () => remotePushGiantLeaf,
   remotePushBlobs: () => remotePushBlobs,
   remotePush: () => remotePush,
   remotePromote: () => remotePromote,
@@ -3417,6 +3425,7 @@ __export(exports_remote, {
   loadRemote: () => loadRemote,
   forksList: () => forksList,
   forkMeta: () => forkMeta,
+  exportStreaming: () => exportStreaming,
   classifyNodes: () => classifyNodes,
   accessSet: () => accessSet,
   accessGet: () => accessGet
@@ -3483,6 +3492,37 @@ async function exportStreaming(cfg, token) {
     throw new Error("remote /export returned an empty stream");
   return { ...header, nodes };
 }
+async function exportManifest(cfg, token) {
+  const res = await fetch(endpoint(cfg, "/export/manifest"), {
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
+  });
+  if (res.status === 404)
+    return exportStreaming(cfg, token);
+  if (!res.ok)
+    throw new Error(`remote /export/manifest -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
+  const m = await res.json();
+  if (!Array.isArray(m.packIds))
+    return exportStreaming(cfg, token);
+  const tasks = [
+    ...(m.packIds ?? []).map((packId) => () => fetchPack(cfg, token, packId, false)),
+    ...(m.legacyNodes ?? []).map((hash) => () => fetchPack(cfg, token, hash, true))
+  ];
+  const packNodes = await pool(tasks, CLONE_PACK_CONCURRENCY);
+  const nodes = [];
+  for (const ns of packNodes)
+    for (const n of ns)
+      nodes.push(n);
+  return { schema: m.schema, head: m.head, seq: m.seq, tip: m.tip, ops: m.ops, nodes, refs: m.refs, checkout: m.checkout };
+}
+async function fetchPack(cfg, token, id, legacy) {
+  return retryTransient(async () => {
+    const path = `/pack/${encodeURIComponent(id)}${legacy ? "?legacy=1" : ""}`;
+    const res = await fetch(endpoint(cfg, path), { headers: { authorization: `Bearer ${token}` } });
+    if (!res.ok)
+      throw new Error(`remote /pack -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
+    return decodePackLine((await res.text()).trim());
+  });
+}
 function classifyNodes(nodes) {
   const trees = [];
   const leaves = [];
@@ -3540,13 +3580,34 @@ async function retryTransient(fn, attempts = 5) {
   }
   throw last;
 }
+function canonicalPackBytesClient(entries) {
+  const sorted = [...entries].sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+  const obj = {};
+  for (const [h, n] of sorted)
+    obj[h] = n;
+  return JSON.stringify(obj);
+}
+async function remotePushGiantLeaf(cfg, token, node) {
+  const hash = hashNode(node);
+  const body = canonicalPackBytesClient([[hash, node]]);
+  const packId = hashString(body);
+  const packBody = gzipSync2(Buffer.from(body, "utf8")).toString("base64");
+  const path = `/push/blobs?giant=${encodeURIComponent(hash)}&packId=${encodeURIComponent(packId)}`;
+  return retryTransient(() => call(cfg, token, path, { method: "POST", body: packBody }));
+}
 async function remotePushPack(cfg, token, body) {
   const { trees, leaves, total } = classifyNodes(body.nodes);
   if (total <= SMALL_PUSH_BYTES) {
     return retryTransient(() => call(cfg, token, "/push/pack", { method: "POST", body: gzipSync2(JSON.stringify(body)), headers: { "content-encoding": "gzip" } }));
   }
-  const blobPacks = splitLeafPacks(leaves, BLOB_PACK_BYTES);
-  await pool(blobPacks.map((pack) => () => remotePushBlobs(cfg, token, pack)), BLOB_PACK_CONCURRENCY);
+  const giants = leaves.filter((n) => nodeBytes(n) > GIANT_LEAF_BYTES);
+  const normal = leaves.filter((n) => nodeBytes(n) <= GIANT_LEAF_BYTES);
+  const blobPacks = splitLeafPacks(normal, BLOB_PACK_BYTES);
+  const tasks = [
+    ...blobPacks.map((pack) => () => remotePushBlobs(cfg, token, pack)),
+    ...giants.map((node) => () => remotePushGiantLeaf(cfg, token, node))
+  ];
+  await pool(tasks, BLOB_PACK_CONCURRENCY);
   return retryTransient(() => call(cfg, token, "/push/pack", {
     method: "POST",
     body: gzipSync2(JSON.stringify({ ...body, nodes: trees })),
@@ -3573,11 +3634,13 @@ async function writeBundle(solDir2, bundle, from = 0) {
   writeFileSync5(join5(solDir2, "HEAD"), JSON.stringify({ head: bundle.head, seq: bundle.seq, logTip: bundle.tip }));
   return fresh.length;
 }
-var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteGate = (cfg, token, branch) => call(cfg, token, `/head?gateState=true${branch ? `&branch=${encodeURIComponent(branch)}` : ""}`), remoteExport = (cfg, token) => exportStreaming(cfg, token), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), SMALL_PUSH_BYTES, BLOB_PACK_BYTES, BLOB_PACK_CONCURRENCY = 1, nodeBytes = (n) => JSON.stringify(n).length, remotePushBlobs = (cfg, token, nodes) => retryTransient(() => call(cfg, token, "/push/blobs", { method: "POST", body: gzipSync2(JSON.stringify({ nodes })), headers: { "content-encoding": "gzip" } })), mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), ownerSet = (cfg, token, ownerHandle) => call(cfg, token, "/owner", { method: "POST", body: JSON.stringify({ ownerHandle }) }), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync5(join5(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
+var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteGate = (cfg, token, branch) => call(cfg, token, `/head?gateState=true${branch ? `&branch=${encodeURIComponent(branch)}` : ""}`), CLONE_PACK_CONCURRENCY = 12, remoteExport = (cfg, token) => exportManifest(cfg, token), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), SMALL_PUSH_BYTES, BLOB_PACK_BYTES, BLOB_PACK_CONCURRENCY = 6, GIANT_LEAF_BYTES, nodeBytes = (n) => JSON.stringify(n).length, remotePushBlobs = (cfg, token, nodes) => retryTransient(() => call(cfg, token, "/push/blobs", { method: "POST", body: gzipSync2(JSON.stringify({ nodes })), headers: { "content-encoding": "gzip" } })), mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), ownerSet = (cfg, token, ownerHandle) => call(cfg, token, "/owner", { method: "POST", body: JSON.stringify({ ownerHandle }) }), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync5(join5(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
 var init_remote = __esm(() => {
   init_file_store();
+  init_store();
   SMALL_PUSH_BYTES = 24 * 1024 * 1024;
   BLOB_PACK_BYTES = 16 * 1024 * 1024;
+  GIANT_LEAF_BYTES = 24 * 1024 * 1024;
 });
 
 // src/bin/test-gate.ts
@@ -9513,21 +9576,41 @@ function tokenClaims(token) {
     return {};
   }
 }
-async function loadStoredToken() {
-  if (!existsSync19(CRED_PATH))
-    return;
-  let creds;
+function readCreds() {
   try {
-    creds = JSON.parse(readFileSync19(CRED_PATH, "utf8"));
+    return JSON.parse(readFileSync19(CRED_PATH, "utf8"));
   } catch {
     return;
   }
-  if (!creds.accessToken)
+}
+function accessTokenFresh(accessToken) {
+  if (!accessToken)
+    return false;
+  const exp = tokenClaims(accessToken).exp;
+  return typeof exp === "number" && exp * 1000 > Date.now() + 30000;
+}
+async function loadStoredToken() {
+  if (!existsSync19(CRED_PATH))
     return;
-  const exp = tokenClaims(creds.accessToken).exp;
-  if (typeof exp === "number" && exp * 1000 > Date.now() + 30000)
+  let creds = readCreds();
+  if (!creds?.accessToken)
+    return;
+  if (accessTokenFresh(creds.accessToken))
+    return creds.accessToken;
+  if (!(creds.refreshToken && creds.webUrl))
     return creds.accessToken;
-  if (creds.refreshToken && creds.webUrl) {
+  const release = acquireLockAt(join18(dirname5(CRED_PATH), "credentials.lock"), {
+    timeoutMs: 1e4,
+    onTimeout: "undefined"
+  });
+  try {
+    if (release) {
+      const fresh = readCreds();
+      if (fresh?.accessToken && accessTokenFresh(fresh.accessToken))
+        return fresh.accessToken;
+      if (fresh)
+        creds = fresh;
+    }
     try {
       const res = await fetch(`${creds.webUrl}/api/auth/refresh`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ refreshToken: creds.refreshToken }) });
       if (res.ok) {
@@ -9538,8 +9621,10 @@ async function loadStoredToken() {
         }
       }
     } catch {}
+    return creds.accessToken;
+  } finally {
+    release?.();
   }
-  return creds.accessToken;
 }
 function authExpired() {
   return die("session expired — run `sol auth login` (or set SOL_TOKEN)");
@@ -12282,8 +12367,12 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             const days = Number(patAction) || 90;
             const name = (Number(patAction) ? args[2] : patAction) || undefined;
             const res = await fetch(`${creds.webUrl}/api/auth/pat`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify({ days, ...name ? { name } : {} }) });
-            if (!res.ok)
-              die(`could not mint a PAT (${res.status})`);
+            if (!res.ok) {
+              const reason = await res.json().then((b) => b?.error?.detail || b?.error?.message).catch(() => {
+                return;
+              });
+              die(`could not mint a PAT (${res.status})${reason ? `: ${reason}` : ""}`);
+            }
             const out = await res.json();
             console.log(`
   Personal Access Token "${out.name}" (id ${out.id}, expires in ${days} days) — store it now, it is not shown again:
@@ -13797,21 +13886,41 @@ function tokenClaims2(token) {
     return {};
   }
 }
-async function loadStoredToken2() {
-  if (!existsSync20(CRED_PATH2))
-    return;
-  let creds;
+function readCreds2() {
   try {
-    creds = JSON.parse(readFileSync20(CRED_PATH2, "utf8"));
+    return JSON.parse(readFileSync20(CRED_PATH2, "utf8"));
   } catch {
     return;
   }
-  if (!creds.accessToken)
+}
+function accessTokenFresh2(accessToken) {
+  if (!accessToken)
+    return false;
+  const exp = tokenClaims2(accessToken).exp;
+  return typeof exp === "number" && exp * 1000 > Date.now() + 30000;
+}
+async function loadStoredToken2() {
+  if (!existsSync20(CRED_PATH2))
     return;
-  const exp = tokenClaims2(creds.accessToken).exp;
-  if (typeof exp === "number" && exp * 1000 > Date.now() + 30000)
+  let creds = readCreds2();
+  if (!creds?.accessToken)
+    return;
+  if (accessTokenFresh2(creds.accessToken))
+    return creds.accessToken;
+  if (!(creds.refreshToken && creds.webUrl))
     return creds.accessToken;
-  if (creds.refreshToken && creds.webUrl) {
+  const release = acquireLockAt(join20(dirname7(CRED_PATH2), "credentials.lock"), {
+    timeoutMs: 1e4,
+    onTimeout: "undefined"
+  });
+  try {
+    if (release) {
+      const fresh = readCreds2();
+      if (fresh?.accessToken && accessTokenFresh2(fresh.accessToken))
+        return fresh.accessToken;
+      if (fresh)
+        creds = fresh;
+    }
     try {
       const res = await fetch(`${creds.webUrl}/api/auth/refresh`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ refreshToken: creds.refreshToken }) });
       if (res.ok) {
@@ -13822,8 +13931,10 @@ async function loadStoredToken2() {
         }
       }
     } catch {}
+    return creds.accessToken;
+  } finally {
+    release?.();
   }
-  return creds.accessToken;
 }
 function authExpired2() {
   return die("session expired — run `sol auth login` (or set SOL_TOKEN)");
@@ -16566,8 +16677,12 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             const days = Number(patAction) || 90;
             const name = (Number(patAction) ? args[2] : patAction) || undefined;
             const res = await fetch(`${creds.webUrl}/api/auth/pat`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify({ days, ...name ? { name } : {} }) });
-            if (!res.ok)
-              die(`could not mint a PAT (${res.status})`);
+            if (!res.ok) {
+              const reason = await res.json().then((b) => b?.error?.detail || b?.error?.message).catch(() => {
+                return;
+              });
+              die(`could not mint a PAT (${res.status})${reason ? `: ${reason}` : ""}`);
+            }
             const out = await res.json();
             console.log(`
   Personal Access Token "${out.name}" (id ${out.id}, expires in ${days} days) — store it now, it is not shown again: