treelay 0.1.0

package/dist/chunk-QKQUPZVD.js

@@ -0,0 +1,2665 @@
+// src/errors.ts
+var CycleError = class extends Error {
+  constructor(path) {
+    super(`Inheritance cycle detected: ${path.join(" \u2192 ")}`);
+    this.path = path;
+    this.name = "CycleError";
+  }
+  path;
+};
+var InconsistentHierarchyError = class extends Error {
+  constructor(message) {
+    super(`Inconsistent hierarchy: ${message}`);
+    this.name = "InconsistentHierarchyError";
+  }
+};
+var MergeConflictError = class extends Error {
+  constructor(file, message) {
+    super(`Merge conflict in ${file}: ${message}`);
+    this.file = file;
+    this.name = "MergeConflictError";
+  }
+  file;
+};
+var NotImplementedError = class extends Error {
+  constructor(what) {
+    super(`Not implemented yet: ${what}`);
+    this.name = "NotImplementedError";
+  }
+};
+
+// src/c3.ts
+function c3Linearize(root, parentsOf, key = (n) => String(n)) {
+  const lin = (node, path) => {
+    const k = key(node);
+    if (path.includes(k)) {
+      throw new CycleError([...path, k]);
+    }
+    const parents = parentsOf(node);
+    if (parents.length === 0) return [node];
+    const nextPath = [...path, k];
+    const sequences = parents.map((p) => lin(p, nextPath));
+    sequences.push([...parents]);
+    return [node, ...merge(sequences, key)];
+  };
+  return lin(root, []);
+}
+function merge(sequences, key) {
+  const lists = sequences.map((s) => [...s]).filter((s) => s.length > 0);
+  const result = [];
+  while (lists.length > 0) {
+    let candidate;
+    for (const list of lists) {
+      const head = list[0];
+      const headKey = key(head);
+      const inSomeTail = lists.some(
+        (other) => other.slice(1).some((n) => key(n) === headKey)
+      );
+      if (!inSomeTail) {
+        candidate = head;
+        break;
+      }
+    }
+    if (candidate === void 0) {
+      const remaining = lists.map((l) => l.map(key).join(", ")).join(" | ");
+      throw new InconsistentHierarchyError(
+        `cannot linearize conflicting precedence among: ${remaining}`
+      );
+    }
+    result.push(candidate);
+    const candidateKey = key(candidate);
+    for (let i = lists.length - 1; i >= 0; i--) {
+      const list = lists[i];
+      if (list.length > 0 && key(list[0]) === candidateKey) {
+        list.shift();
+      }
+      if (list.length === 0) {
+        lists.splice(i, 1);
+      }
+    }
+  }
+  return result;
+}
+
+// src/manifest.ts
+import { readFileSync, existsSync, accessSync, constants } from "fs";
+import { join } from "path";
+import { parse as parseYaml } from "yaml";
+var MANIFEST_NAMES = ["treelay.json", "treelay.yaml", "treelay.yml"];
+function loadManifest(dir) {
+  for (const name of MANIFEST_NAMES) {
+    const file = join(dir, name);
+    if (existsSync(file)) {
+      const raw = readFileSync(file, "utf8");
+      return name.endsWith(".json") ? JSON.parse(raw) : parseYaml(raw);
+    }
+  }
+  const pkgPath = join(dir, "package.json");
+  if (existsSync(pkgPath)) {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    if (pkg.treelay) {
+      return { ...pkg.name !== void 0 ? { name: pkg.name } : {}, ...pkg.treelay };
+    }
+  }
+  return {};
+}
+function isWritable(dir) {
+  try {
+    accessSync(dir, constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/render.ts
+import { Liquid } from "liquidjs";
+var DEFAULT_TEMPLATE_SUFFIX = ".tmpl";
+function createEngine() {
+  return new Liquid({
+    // No `root`/`fs` ⇒ `{% include %}`/`{% render %}` from disk is unavailable.
+    strictVariables: true,
+    strictFilters: true
+  });
+}
+var engine = createEngine();
+async function renderString(template, values) {
+  return engine.parseAndRender(template, values);
+}
+function templateTarget(path, suffix = DEFAULT_TEMPLATE_SUFFIX) {
+  if (path.endsWith(suffix)) {
+    return { render: true, outPath: path.slice(0, -suffix.length) };
+  }
+  return { render: false, outPath: path };
+}
+
+// src/variables.ts
+import { createInterface } from "readline/promises";
+import { parse as parseYaml2 } from "yaml";
+function mergeVariableDecls(layers) {
+  const merged = {};
+  for (const layer of layers) {
+    const vars = layer.manifest.variables ?? {};
+    for (const [name, decl] of Object.entries(vars)) {
+      merged[name] = { ...merged[name], ...decl };
+    }
+  }
+  return merged;
+}
+var DEFER = /* @__PURE__ */ Symbol("defer");
+function coerce(type, raw) {
+  if (raw === void 0 || raw === null) return raw;
+  switch (type) {
+    case "string":
+    case "path":
+      return String(raw);
+    case "number": {
+      if (typeof raw === "number") return raw;
+      const n = Number(raw);
+      if (Number.isNaN(n)) throw new Error(`expected a number, got "${raw}"`);
+      return n;
+    }
+    case "boolean":
+      if (typeof raw === "boolean") return raw;
+      return raw === "true" || raw === "1" || raw === "yes";
+    case "json":
+      return typeof raw === "string" ? JSON.parse(raw) : raw;
+    case "yaml":
+      return typeof raw === "string" ? parseYaml2(raw) : raw;
+  }
+}
+function isFalsy(rendered) {
+  const t = rendered.trim();
+  return t === "" || t === "false";
+}
+async function resolveValues(graph, options = {}) {
+  const engine2 = createEngine();
+  const decls = graph.variables;
+  const values = {};
+  const tryRender = async (tmpl) => {
+    try {
+      return await engine2.parseAndRender(tmpl, values);
+    } catch {
+      return DEFER;
+    }
+  };
+  const evalDefault = async (decl) => {
+    if (typeof decl.default !== "string") return decl.default;
+    const r = await tryRender(decl.default);
+    if (r === DEFER) return DEFER;
+    return coerce(decl.type, r);
+  };
+  const provided = { ...options.answers, ...options.set };
+  for (const [name, raw] of Object.entries(provided)) {
+    values[name] = decls[name] ? coerce(decls[name].type, raw) : raw;
+  }
+  const resolved = new Set(Object.keys(provided).filter((n) => decls[n]));
+  let pending = Object.keys(decls).filter((n) => !resolved.has(n));
+  let rl;
+  const promptVar = async (name, decl, fallback) => {
+    rl ??= createInterface({ input: process.stdin, output: process.stdout });
+    const hint = decl.choices ? ` ${JSON.stringify(decl.choices)}` : "";
+    const def = fallback !== void 0 ? ` [${String(fallback)}]` : "";
+    const answer = (await rl.question(`${decl.prompt}${hint}${def} `)).trim();
+    return answer === "" ? fallback : coerce(decl.type, answer);
+  };
+  try {
+    let guard = pending.length + 1;
+    while (pending.length && guard-- > 0) {
+      const next = [];
+      let progressed = false;
+      for (const name of pending) {
+        const decl = decls[name];
+        if (decl.when !== void 0) {
+          const w = await tryRender(decl.when);
+          if (w === DEFER) {
+            next.push(name);
+            continue;
+          }
+          if (isFalsy(w)) {
+            resolved.add(name);
+            progressed = true;
+            continue;
+          }
+        }
+        if (decl.computed) {
+          if (decl.default === void 0) {
+            throw new Error(`computed variable "${name}" has no default`);
+          }
+          const r = await evalDefault(decl);
+          if (r === DEFER) {
+            next.push(name);
+            continue;
+          }
+          values[name] = r;
+          resolved.add(name);
+          progressed = true;
+          continue;
+        }
+        const fallback = decl.default !== void 0 ? await evalDefault(decl) : void 0;
+        if (fallback === DEFER) {
+          next.push(name);
+          continue;
+        }
+        if (decl.prompt !== void 0 && options.prompt) {
+          values[name] = await promptVar(name, decl, fallback);
+        } else if (fallback !== void 0) {
+          values[name] = fallback;
+        } else {
+          next.push(name);
+          continue;
+        }
+        resolved.add(name);
+        progressed = true;
+      }
+      pending = next;
+      if (!progressed) break;
+    }
+  } finally {
+    rl?.close();
+  }
+  if (pending.length) {
+    throw new Error(
+      `Cannot resolve variables: ${pending.join(", ")} (no value/default, or a dependency cycle among defaults)`
+    );
+  }
+  for (const [name, decl] of Object.entries(decls)) {
+    if (!(name in values)) continue;
+    if (decl.choices && !decl.choices.includes(values[name])) {
+      throw new Error(
+        `Invalid ${name}: ${JSON.stringify(values[name])} not in ` + JSON.stringify(decl.choices)
+      );
+    }
+    if (decl.validate) {
+      const msg = (await engine2.parseAndRender(decl.validate, values)).trim();
+      if (msg) throw new Error(`Invalid ${name}: ${msg}`);
+    }
+  }
+  return values;
+}
+
+// src/hash.ts
+import { createHash } from "crypto";
+import { readdirSync, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+function hashContent(data) {
+  return "sha256:" + createHash("sha256").update(data).digest("hex");
+}
+function matchesHash(data, recorded) {
+  return hashContent(data) === recorded.trim();
+}
+function hashTree(dir) {
+  const digest = createHash("sha256");
+  for (const rel of listTreeFiles(dir)) {
+    digest.update(rel);
+    digest.update("\0");
+    digest.update(createHash("sha256").update(readFileSync2(join2(dir, rel))).digest());
+    digest.update("\n");
+  }
+  return "sha256:" + digest.digest("hex");
+}
+var TREE_HASH_PRUNE = /* @__PURE__ */ new Set([".git", "node_modules"]);
+function listTreeFiles(dir, prefix = "") {
+  const out = [];
+  for (const e of readdirSync(dir, { withFileTypes: true }).sort(
+    (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
+  )) {
+    if (TREE_HASH_PRUNE.has(e.name)) continue;
+    const rel = prefix === "" ? e.name : `${prefix}/${e.name}`;
+    if (e.isDirectory()) out.push(...listTreeFiles(join2(dir, e.name), rel));
+    else if (e.isFile()) out.push(rel);
+  }
+  return out;
+}
+
+// src/refs.ts
+import { isAbsolute } from "path";
+var InvalidRefError = class extends Error {
+  constructor(ref, reason) {
+    super(`Invalid layer reference "${ref}": ${reason}`);
+    this.ref = ref;
+    this.name = "InvalidRefError";
+  }
+  ref;
+};
+var GITHUB_SHORTHAND = /^github:([^/#?]+)\/([^/#?]+?)(?:\.git)?(?=[#?]|$)/;
+var WINDOWS_DRIVE = /^[A-Za-z]:[\\/]/;
+function splitSuffixes(rest) {
+  let body = rest;
+  let committish;
+  let subdir;
+  const hash = body.indexOf("#");
+  if (hash !== -1) {
+    committish = body.slice(hash + 1);
+    body = body.slice(0, hash);
+  }
+  const q = body.indexOf("?");
+  if (q !== -1) {
+    const params = new URLSearchParams(body.slice(q + 1));
+    const p = params.get("path");
+    if (p) subdir = normalizeSubdir(p);
+    body = body.slice(0, q);
+  }
+  return {
+    body,
+    ...subdir !== void 0 ? { subdir } : {},
+    ...committish !== void 0 && committish !== "" ? { committish } : {}
+  };
+}
+function normalizeSubdir(p) {
+  const clean = p.split("\\").join("/").replace(/^\/+|\/+$/g, "");
+  if (clean.split("/").includes("..")) {
+    throw new InvalidRefError(p, "`path=` may not escape the fetched tree with `..`");
+  }
+  return clean;
+}
+function isLocalRef(ref) {
+  return parseRef(ref).kind === "local";
+}
+function parseRef(ref) {
+  const raw = ref.trim();
+  if (raw === "") throw new InvalidRefError(ref, "empty reference");
+  if (raw.startsWith("file:")) {
+    return { kind: "local", raw, path: raw.slice("file:".length) };
+  }
+  if (raw.startsWith(".") || isAbsolute(raw) || WINDOWS_DRIVE.test(raw)) {
+    return { kind: "local", raw, path: raw };
+  }
+  const gh = GITHUB_SHORTHAND.exec(raw);
+  if (gh) {
+    const { subdir: subdir2, committish } = splitSuffixes(raw.slice(gh[0].length));
+    return git(raw, `https://github.com/${gh[1]}/${gh[2]}.git`, committish, subdir2);
+  }
+  if (raw.startsWith("git+")) {
+    const { body: body2, subdir: subdir2, committish } = splitSuffixes(raw.slice("git+".length));
+    if (body2 === "") throw new InvalidRefError(ref, "git ref has no URL");
+    return git(raw, body2, committish, subdir2);
+  }
+  if (raw.includes("://")) {
+    const { body: body2, subdir: subdir2, committish } = splitSuffixes(raw);
+    if (body2.endsWith(".git")) return git(raw, body2, committish, subdir2);
+    throw new InvalidRefError(
+      ref,
+      "URLs must be prefixed with `git+` (or end in `.git`) so the transport is explicit"
+    );
+  }
+  const npmBody = raw.startsWith("npm:") ? raw.slice("npm:".length) : raw;
+  const { body, subdir } = splitSuffixes(npmBody);
+  return npm(raw, body, subdir);
+}
+function git(raw, url, committish, subdir) {
+  return {
+    kind: "git",
+    raw,
+    url,
+    committish: committish ?? "HEAD",
+    ...subdir !== void 0 ? { subdir } : {}
+  };
+}
+function npm(raw, body, subdir) {
+  const at = body.indexOf("@", body.startsWith("@") ? 1 : 0);
+  const name = at === -1 ? body : body.slice(0, at);
+  const range = at === -1 ? "*" : body.slice(at + 1);
+  if (name === "") throw new InvalidRefError(raw, "npm ref has no package name");
+  return {
+    kind: "npm",
+    raw,
+    name,
+    range: range === "" ? "*" : range,
+    ...subdir !== void 0 ? { subdir } : {}
+  };
+}
+function canonicalRef(ref) {
+  const parsed = typeof ref === "string" ? parseRef(ref) : ref;
+  const query = parsed.kind !== "local" && parsed.subdir ? `?path=${parsed.subdir}` : "";
+  switch (parsed.kind) {
+    case "local":
+      return parsed.raw;
+    case "git":
+      return `git+${parsed.url}${query}#${parsed.committish}`;
+    case "npm":
+      return `npm:${parsed.name}@${parsed.range}${query}`;
+  }
+}
+function pinnedRef(ref, revision) {
+  const query = ref.subdir ? `?path=${ref.subdir}` : "";
+  return ref.kind === "git" ? `git+${ref.url}${query}#${revision}` : `npm:${ref.name}@${revision}${query}`;
+}
+function isCommitSha(committish) {
+  return /^[0-9a-f]{40}$/i.test(committish);
+}
+
+// src/fetch/cache.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync2, mkdirSync, rmSync } from "fs";
+import { homedir } from "os";
+import { join as join3 } from "path";
+function cacheRoot(override) {
+  return override ?? process.env["TREELAY_CACHE_DIR"] ?? join3(homedir(), ".cache", "treelay");
+}
+function locationKey(location) {
+  const slug = location.replace(/^[a-z+]+:\/\//i, "").replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "layer";
+  const digest = createHash2("sha256").update(location).digest("hex").slice(0, 16);
+  return `${slug}-${digest}`;
+}
+function gitRepoDir(location, root) {
+  return join3(cacheRoot(root), "git", locationKey(location));
+}
+function gitMirrorDir(location, root) {
+  return join3(gitRepoDir(location, root), "repo.git");
+}
+function gitRevisionDir(location, revision, root) {
+  return join3(gitRepoDir(location, root), "rev", revision);
+}
+function freshDir(dir) {
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+function ensureCacheDir(dir) {
+  if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+// src/fetch/git.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync3, rmSync as rmSync2 } from "fs";
+import { join as join4 } from "path";
+var GitFetchError = class extends Error {
+  constructor(url, message) {
+    super(`git layer ${url}: ${message}`);
+    this.url = url;
+    this.name = "GitFetchError";
+  }
+  url;
+};
+function git2(args, cwd) {
+  try {
+    return execFileSync("git", args, {
+      encoding: "utf8",
+      ...cwd ? { cwd } : {},
+      stdio: ["ignore", "pipe", "pipe"],
+      env: {
+        ...process.env,
+        // Never stop for credentials: a hung prompt inside a build is worse
+        // than a clear "authentication failed".
+        GIT_TERMINAL_PROMPT: "0",
+        GIT_ADVICE: "0"
+      }
+    }).trim();
+  } catch (err) {
+    const e = err;
+    const detail = (e.stderr?.toString() ?? e.message ?? "").trim();
+    throw new Error(detail || `git ${args.join(" ")} failed`);
+  }
+}
+function ensureMirror(url, cacheDir) {
+  const mirror = gitMirrorDir(url, cacheDir);
+  if (existsSync3(join4(mirror, "HEAD"))) return mirror;
+  ensureCacheDir(gitRepoDir(url, cacheDir));
+  try {
+    git2(["clone", "--mirror", "--quiet", url, mirror]);
+  } catch (err) {
+    rmSync2(mirror, { recursive: true, force: true });
+    throw new GitFetchError(url, `clone failed \u2014 ${err.message}`);
+  }
+  return mirror;
+}
+function updateMirror(url, mirror) {
+  try {
+    git2(["--git-dir", mirror, "fetch", "--prune", "--quiet", "origin", "+refs/*:refs/*"]);
+  } catch (err) {
+    throw new GitFetchError(url, `fetch failed \u2014 ${err.message}`);
+  }
+}
+function hasCommit(mirror, committish) {
+  try {
+    git2(["--git-dir", mirror, "rev-parse", "--verify", "--quiet", `${committish}^{commit}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveGitRevision(ref, cacheDir) {
+  const mirror = ensureMirror(ref.url, cacheDir);
+  if (!isCommitSha(ref.committish) || !hasCommit(mirror, ref.committish)) {
+    updateMirror(ref.url, mirror);
+  }
+  try {
+    return git2(["--git-dir", mirror, "rev-parse", `${ref.committish}^{commit}`]);
+  } catch {
+    throw new GitFetchError(
+      ref.url,
+      `no such revision "${ref.committish}". It may have been deleted, renamed, or never pushed.`
+    );
+  }
+}
+function liveGitRevision(ref) {
+  if (isCommitSha(ref.committish)) return ref.committish;
+  try {
+    const lines = git2(["ls-remote", ref.url, ref.committish, `${ref.committish}^{}`]).split("\n").filter((l) => l.trim() !== "");
+    const peeled = lines.find((l) => l.split(/\s+/)[1]?.endsWith("^{}"));
+    return (peeled ?? lines[0])?.split(/\s+/)[0];
+  } catch {
+    return void 0;
+  }
+}
+function materializeGit(ref, revision, cacheDir) {
+  const dest = gitRevisionDir(ref.url, revision, cacheDir);
+  const root = ref.subdir ? join4(dest, ref.subdir) : dest;
+  if (!existsSync3(dest)) {
+    const mirror = ensureMirror(ref.url, cacheDir);
+    if (!hasCommit(mirror, revision)) updateMirror(ref.url, mirror);
+    freshDir(dest);
+    const tar = join4(dest, ".treelay-archive.tar");
+    try {
+      git2(["--git-dir", mirror, "archive", "--format=tar", "-o", tar, revision]);
+      execFileSync("tar", ["-xf", tar, "-C", dest], { stdio: "ignore" });
+    } catch (err) {
+      rmSync2(dest, { recursive: true, force: true });
+      throw new GitFetchError(
+        ref.url,
+        `could not extract ${revision.slice(0, 12)} \u2014 ${err.message}`
+      );
+    } finally {
+      rmSync2(tar, { force: true });
+    }
+  }
+  if (!existsSync3(root)) {
+    throw new GitFetchError(
+      ref.url,
+      `subdirectory "${ref.subdir}" does not exist at ${revision.slice(0, 12)}`
+    );
+  }
+  return { dir: root, integrity: hashTree(root) };
+}
+
+// src/fetch/npm.ts
+import { createRequire } from "module";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { dirname, join as join5 } from "path";
+import { satisfies, validRange } from "semver";
+var NpmResolveError = class extends Error {
+  constructor(packageName, message) {
+    super(`npm layer ${packageName}: ${message}`);
+    this.packageName = packageName;
+    this.name = "NpmResolveError";
+  }
+  packageName;
+};
+function packageDir(ref, fromDir) {
+  for (let dir = fromDir; ; dir = dirname(dir)) {
+    const candidate = join5(dir, "node_modules", ref.name);
+    if (existsSync4(join5(candidate, "package.json"))) return candidate;
+    if (dirname(dir) === dir) break;
+  }
+  try {
+    const require3 = createRequire(join5(fromDir, "package.json"));
+    return dirname(require3.resolve(`${ref.name}/package.json`));
+  } catch {
+    throw new NpmResolveError(
+      ref.name,
+      `not installed under ${fromDir}. treelay resolves npm layers from node_modules rather than installing them \u2014 run your package manager first (e.g. \`npm install ${ref.name}\`).`
+    );
+  }
+}
+function liveNpmVersion(ref, fromDir) {
+  try {
+    const pkg = JSON.parse(
+      readFileSync3(join5(packageDir(ref, fromDir), "package.json"), "utf8")
+    );
+    return pkg.version;
+  } catch {
+    return void 0;
+  }
+}
+function materializeNpm(ref, fromDir) {
+  const pkgRoot = packageDir(ref, fromDir);
+  const pkg = JSON.parse(readFileSync3(join5(pkgRoot, "package.json"), "utf8"));
+  const version = pkg.version ?? "0.0.0";
+  if (ref.range !== "*" && validRange(ref.range) && !satisfies(version, ref.range)) {
+    throw new NpmResolveError(
+      ref.name,
+      `installed version ${version} does not satisfy "${ref.range}". Update the dependency, or relax the ref in treelay.json.`
+    );
+  }
+  const root = ref.subdir ? join5(pkgRoot, ref.subdir) : pkgRoot;
+  if (!existsSync4(root)) {
+    throw new NpmResolveError(
+      ref.name,
+      `subdirectory "${ref.subdir}" does not exist in ${pkgRoot}`
+    );
+  }
+  return { dir: root, revision: version, integrity: hashTree(root) };
+}
+
+// src/fetch/index.ts
+import { existsSync as existsSync5 } from "fs";
+var LockMissingError = class extends Error {
+  constructor(ref) {
+    super(
+      `${ref} is not in treelay.lock, and resolution is frozen. Run \`treelay lock\` and commit the result, or drop --frozen-lockfile.`
+    );
+    this.ref = ref;
+    this.name = "LockMissingError";
+  }
+  ref;
+};
+var IntegrityError = class extends Error {
+  constructor(ref, expected, actual) {
+    super(
+      `${ref}: cached content does not match treelay.lock.
+  expected ${expected}
+  actual   ${actual}
+The cache entry has been modified or corrupted. Delete it (or the whole cache) and re-resolve.`
+    );
+    this.name = "IntegrityError";
+  }
+};
+function fetchLayer(ref, options) {
+  const key = canonicalRef(ref);
+  const locked = options.updateRefs ? void 0 : options.lock.refs[key];
+  if (!locked && options.frozen) throw new LockMissingError(key);
+  const { dir, revision, integrity } = ref.kind === "git" ? fetchGit(ref, locked?.resolved, options) : materializeNpm(ref, options.fromDir);
+  if (locked && locked.resolved === revision && locked.integrity !== integrity) {
+    throw new IntegrityError(key, locked.integrity, integrity);
+  }
+  const entry = {
+    kind: ref.kind,
+    source: ref.kind === "git" ? ref.url : ref.name,
+    requested: ref.kind === "git" ? ref.committish : ref.range,
+    resolved: revision,
+    integrity,
+    ...ref.subdir !== void 0 ? { path: ref.subdir } : {}
+  };
+  const changed = locked === void 0 || locked.resolved !== entry.resolved || locked.integrity !== entry.integrity;
+  return { ref: key, dir, revision, integrity, entry, changed };
+}
+function fetchGit(ref, lockedRevision, options) {
+  const revision = lockedRevision ?? resolveGitRevision(ref, options.cacheDir);
+  const { dir, integrity } = materializeGit(ref, revision, options.cacheDir);
+  return { dir, revision, integrity };
+}
+function verifyIntegrity(dir, expected) {
+  return existsSync5(dir) && hashTree(dir) === expected;
+}
+function liveRevision(ref, fromDir) {
+  return ref.kind === "git" ? liveGitRevision(ref) : liveNpmVersion(ref, fromDir);
+}
+
+// src/lockfile.ts
+import { existsSync as existsSync6, readFileSync as readFileSync4, writeFileSync } from "fs";
+import { join as join6 } from "path";
+var LOCKFILE_NAME = "treelay.lock";
+var LOCKFILE_VERSION = 1;
+function emptyLock() {
+  return { lockfileVersion: LOCKFILE_VERSION, refs: {} };
+}
+function lockfilePath(leafDir) {
+  return join6(leafDir, LOCKFILE_NAME);
+}
+var LockfileError = class extends Error {
+  constructor(file, reason) {
+    super(`${file}: ${reason}`);
+    this.name = "LockfileError";
+  }
+};
+function readLock(leafDir) {
+  const file = lockfilePath(leafDir);
+  if (!existsSync6(file)) return emptyLock();
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(file, "utf8"));
+  } catch (err) {
+    throw new LockfileError(file, `not valid JSON (${err.message})`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new LockfileError(file, "expected a JSON object");
+  }
+  const lock = parsed;
+  if (lock.lockfileVersion !== LOCKFILE_VERSION) {
+    throw new LockfileError(
+      file,
+      `lockfileVersion ${String(lock.lockfileVersion)} was written by a different version of treelay (this one writes ${LOCKFILE_VERSION}). Delete it and re-run \`treelay lock\` to regenerate.`
+    );
+  }
+  return { lockfileVersion: LOCKFILE_VERSION, refs: lock.refs ?? {} };
+}
+function serializeLock(lock) {
+  const refs = {};
+  for (const key of Object.keys(lock.refs).sort()) {
+    const e = lock.refs[key];
+    refs[key] = {
+      kind: e.kind,
+      source: e.source,
+      requested: e.requested,
+      resolved: e.resolved,
+      integrity: e.integrity,
+      ...e.path !== void 0 ? { path: e.path } : {},
+      ...e.requestedBy?.length ? { requestedBy: [...e.requestedBy].sort() } : {}
+    };
+  }
+  return JSON.stringify({ lockfileVersion: lock.lockfileVersion, refs }, null, 2) + "\n";
+}
+function writeLock(leafDir, lock) {
+  const file = lockfilePath(leafDir);
+  const text = serializeLock(lock);
+  if (existsSync6(file) && readFileSync4(file, "utf8") === text) return false;
+  writeFileSync(file, text);
+  return true;
+}
+function locksEqual(a, b) {
+  return serializeLock(a) === serializeLock(b);
+}
+
+// src/resolve.ts
+import { isAbsolute as isAbsolute2, relative, resolve as resolvePath } from "path";
+import { existsSync as existsSync7, statSync } from "fs";
+var MountError = class extends Error {
+  constructor(mountPath, reason) {
+    super(`Invalid mount "${mountPath}": ${reason}`);
+    this.name = "MountError";
+  }
+};
+function resolve(srcDir, options = {}) {
+  const root = isAbsolute2(srcDir) ? srcDir : resolvePath(process.cwd(), srcDir);
+  const existing = options.noLock ? emptyLock() : readLock(root);
+  const ctx = {
+    root,
+    options,
+    cache: /* @__PURE__ */ new Map(),
+    existing,
+    next: emptyLock()
+  };
+  const self = loadLocal(ctx, root);
+  const parentsOf = (layer) => (layer.manifest.parents ?? []).map((ref) => loadRef(ctx, ref, layer));
+  const mro = c3Linearize(self, parentsOf, (l) => l.id);
+  const parentsLowToHigh = mro.slice(1).reverse();
+  const mixins = (self.manifest.mixins ?? []).map((ref) => loadRef(ctx, ref, self));
+  const declared = [...parentsLowToHigh, ...mixins, self];
+  const mounts = resolveMounts(ctx, declared);
+  const layers = [...mounts, ...declared];
+  const variables = mergeVariableDecls(layers);
+  return {
+    layers,
+    variables,
+    lock: ctx.next,
+    lockDirty: !options.noLock && !locksEqual(existing, ctx.next),
+    lockDir: root
+  };
+}
+function resolveMounts(ctx, declared) {
+  const winners = /* @__PURE__ */ new Map();
+  for (const layer of declared) {
+    for (const [path, ref] of Object.entries(layer.manifest.mounts ?? {})) {
+      winners.set(normalizeMount(path), { ref, from: layer });
+    }
+  }
+  if (!winners.size) return [];
+  const paths = [...winners.keys()].sort();
+  for (let i = 1; i < paths.length; i++) {
+    const prev = paths[i - 1];
+    if (paths[i].startsWith(prev + "/")) {
+      throw new MountError(
+        paths[i],
+        `it nests inside mount "${prev}". Overlapping mounts have no unambiguous owner \u2014 give them disjoint paths.`
+      );
+    }
+  }
+  return paths.map((path) => {
+    const { ref, from } = winners.get(path);
+    const base = loadRef(ctx, ref, from);
+    return {
+      ...base,
+      // A mount is a distinct stack position, so it needs a distinct identity:
+      // the same ref may legitimately be mounted at two paths.
+      id: `mount:${path}`,
+      mountPath: path,
+      // Vendored trees are never promotion targets. Reflux maps output paths
+      // back to layer paths, and a mounted layer's output paths carry a prefix
+      // its sources do not — so it is read-only until that mapping exists (§8).
+      writable: false
+    };
+  });
+}
+function normalizeMount(path) {
+  const clean = path.split("\\").join("/").replace(/^\.\//, "").replace(/\/+$/, "");
+  if (clean === "" || clean === ".") {
+    throw new MountError(path, "a mount needs a non-empty subpath");
+  }
+  if (isAbsolute2(clean) || clean.startsWith("/")) {
+    throw new MountError(path, "mount paths are relative to the composed tree root");
+  }
+  if (clean.split("/").includes("..")) {
+    throw new MountError(path, "mount paths may not escape the composed tree");
+  }
+  return clean;
+}
+function loadLocal(ctx, dir) {
+  const cached = ctx.cache.get(dir);
+  if (cached) return cached;
+  const layer = {
+    id: dir,
+    dir,
+    manifest: loadManifest(dir),
+    writable: isWritable(dir),
+    origin: { kind: "local" }
+  };
+  ctx.cache.set(dir, layer);
+  return layer;
+}
+function loadRef(ctx, ref, from) {
+  const parsed = parseRef(ref);
+  if (parsed.kind === "local") return loadLocal(ctx, resolveLocalRef(ref, from.dir));
+  const key = canonicalRef(parsed);
+  const cached = ctx.cache.get(key);
+  if (cached) {
+    recordRequester(ctx, key, from);
+    return cached;
+  }
+  const fetched = fetchLayer(parsed, {
+    fromDir: from.dir,
+    lock: ctx.existing,
+    ...ctx.options.frozen ? { frozen: true } : {},
+    ...ctx.options.updateRefs ? { updateRefs: true } : {},
+    ...ctx.options.cacheDir ? { cacheDir: ctx.options.cacheDir } : {}
+  });
+  ctx.next.refs[key] = fetched.entry;
+  recordRequester(ctx, key, from);
+  const layer = {
+    id: key,
+    dir: fetched.dir,
+    manifest: loadManifest(fetched.dir),
+    // A cache checkout is shared by every project on the machine and is keyed
+    // by an immutable revision. Editing it would silently change other builds,
+    // so fetched layers are never promotion targets (§8).
+    writable: false,
+    origin: {
+      kind: parsed.kind,
+      ref: key,
+      revision: fetched.revision,
+      integrity: fetched.integrity
+    }
+  };
+  ctx.cache.set(key, layer);
+  return layer;
+}
+function recordRequester(ctx, key, from) {
+  const entry = ctx.next.refs[key];
+  if (!entry) return;
+  const who = from.origin?.kind === "local" || from.origin === void 0 ? relative(ctx.root, from.dir).split("\\").join("/") || "." : from.id;
+  const list = new Set(entry.requestedBy ?? []);
+  list.add(who);
+  entry.requestedBy = [...list].sort();
+}
+function resolveLocalRef(ref, fromDir) {
+  const parsed = parseRef(ref);
+  const dir = resolvePath(fromDir, parsed.kind === "local" ? parsed.path : ref);
+  if (!existsSync7(dir) || !statSync(dir).isDirectory()) {
+    throw new Error(`Layer not found: "${ref}" (resolved to ${dir})`);
+  }
+  return dir;
+}
+function resolveRef(ref, fromDir, options = {}) {
+  const parsed = parseRef(ref);
+  if (parsed.kind === "local") return resolveLocalRef(ref, fromDir);
+  return fetchLayer(parsed, {
+    fromDir,
+    lock: options.lock ?? emptyLock(),
+    ...options.frozen ? { frozen: true } : {},
+    ...options.updateRefs ? { updateRefs: true } : {},
+    ...options.cacheDir ? { cacheDir: options.cacheDir } : {}
+  }).dir;
+}
+
+// src/merge/patch.ts
+import { applyPatch, parsePatch } from "diff";
+import { merge as diff3, mergeDiff3 } from "node-diff3";
+var MERGE_LABELS = {
+  ours: "ours (your edits)",
+  base: "base (last template output)",
+  theirs: "theirs (new template)"
+};
+function mergeText3(args) {
+  const { base, ours, theirs, labels = MERGE_LABELS } = args;
+  if (ours === theirs) return { clean: true, text: ours };
+  if (ours === base) return { clean: true, text: theirs };
+  if (theirs === base) return { clean: true, text: ours };
+  const merged = mergeDiff3(toLines(ours), toLines(base), toLines(theirs), {
+    label: { a: labels.ours, o: labels.base, b: labels.theirs }
+  });
+  return {
+    clean: !merged.conflict,
+    text: fromLines(merged.result)
+  };
+}
+function toLines(text) {
+  return text.split("\n");
+}
+function fromLines(lines) {
+  return lines.join("\n");
+}
+function assertParseable(file, patch) {
+  let hunks = 0;
+  try {
+    hunks = parsePatch(patch).reduce((n, p) => n + p.hunks.length, 0);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const hint = /invalid line/i.test(message) ? "\nCheck the `@@ -old,COUNT +new,COUNT @@` header: the counts must match the number of lines in the hunk body (context + removals for the first, context + additions for the second)." : "";
+    throw new MergeConflictError(
+      file,
+      `patch payload is not a valid unified diff \u2014 ${message}${hint}`
+    );
+  }
+  if (hunks === 0) {
+    throw new MergeConflictError(
+      file,
+      "patch payload contains no hunks (expected unified-diff `@@` sections)"
+    );
+  }
+}
+function preview(text, maxLines = 20) {
+  const lines = toLines(text);
+  return lines.length <= maxLines ? text : fromLines(lines.slice(0, maxLines)) + `
+\u2026 (${lines.length - maxLines} more lines)`;
+}
+function applyPatch3Way(args) {
+  const { file, current, patch, base } = args;
+  assertParseable(file, patch);
+  if (base === void 0) {
+    const applied = applyPatch(current, patch);
+    if (applied === false) {
+      throw new MergeConflictError(
+        file,
+        `patch does not apply to the inherited content and no base was recorded, so it cannot be reconciled.
+Record a \`base:\`/\`baseContent:\` in the sidecar to enable a three-way merge.
+--- patch ---
+${preview(patch)}`
+      );
+    }
+    return applied;
+  }
+  const patched = applyPatch(base, patch);
+  if (patched === false) {
+    throw new MergeConflictError(
+      file,
+      `patch does not apply to its own recorded base \u2014 the sidecar is inconsistent (\`base\`/\`baseContent\` does not match the patch payload).
+--- patch ---
+${preview(patch)}`
+    );
+  }
+  if (current === base) return patched;
+  const merged = diff3(toLines(current), toLines(base), toLines(patched));
+  if (merged.conflict) {
+    throw new MergeConflictError(
+      file,
+      `three-way merge conflict \u2014 the inherited file changed in the same region the patch edits.
+Re-author the patch against the current content, or resolve by hand.
+--- conflict ---
+${preview(fromLines(merged.result))}`
+    );
+  }
+  return fromLines(merged.result);
+}
+
+// src/sidecar.ts
+import { parse as parseYaml3 } from "yaml";
+var SIDECAR_SUFFIX = ".treelay";
+function isSidecar(path) {
+  return path.endsWith(SIDECAR_SUFFIX) && path !== SIDECAR_SUFFIX;
+}
+function sidecarTarget(path) {
+  return path.slice(0, -SIDECAR_SUFFIX.length);
+}
+function parseSidecar(yaml) {
+  const op = parseYaml3(yaml);
+  if (!op || typeof op.op !== "string") {
+    throw new Error(`Invalid .treelay sidecar: missing "op"`);
+  }
+  return op;
+}
+var SUFFIX_OPS = {
+  ".patch": "patch",
+  ".append": "append",
+  ".prepend": "prepend",
+  ".delete": "delete"
+};
+function desugarSuffix(path) {
+  for (const [suffix, op] of Object.entries(SUFFIX_OPS)) {
+    if (path.endsWith(suffix)) {
+      return { op, target: path.slice(0, -suffix.length) };
+    }
+  }
+  return void 0;
+}
+
+// src/merge/deepMerge.ts
+function isObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function deepMerge(base, over, arrays = "replace") {
+  if (Array.isArray(base) && Array.isArray(over)) {
+    switch (arrays) {
+      case "concat":
+        return [...base, ...over];
+      case "replace":
+        return over;
+      case "by-key":
+        return over;
+    }
+  }
+  if (isObject(base) && isObject(over)) {
+    const result = { ...base };
+    for (const [k, v] of Object.entries(over)) {
+      result[k] = k in base ? deepMerge(base[k], v, arrays) : v;
+    }
+    return result;
+  }
+  return over;
+}
+
+// src/merge/structured.ts
+import { createRequire as createRequire2 } from "module";
+var require2 = createRequire2(import.meta.url);
+var { applyPatch: applyJsonPatchLib } = require2("fast-json-patch");
+var jsonMergePatch = require2("json-merge-patch");
+function applyMergePatch(target, patch) {
+  const clone = target === void 0 ? void 0 : structuredClone(target);
+  return jsonMergePatch.apply(clone, patch);
+}
+function generateMergePatch(before, after) {
+  return jsonMergePatch.generate(before, after);
+}
+function applyJsonPatch(target, ops) {
+  const { newDocument } = applyJsonPatchLib(
+    structuredClone(target),
+    ops,
+    /* validateOperation */
+    true,
+    /* mutateDocument */
+    false
+  );
+  return newDocument;
+}
+function isObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function patchesConflict(a, b) {
+  if (isObject2(a) && isObject2(b)) {
+    for (const key of Object.keys(a)) {
+      if (key in b && patchesConflict(a[key], b[key])) return true;
+    }
+    return false;
+  }
+  return JSON.stringify(a) !== JSON.stringify(b);
+}
+function mergeStructured3(base, ours, theirs) {
+  const ourPatch = generateMergePatch(base, ours);
+  const theirPatch = generateMergePatch(base, theirs);
+  if (ourPatch === void 0) return { clean: true, value: theirs };
+  if (theirPatch === void 0) return { clean: true, value: ours };
+  if (patchesConflict(ourPatch, theirPatch)) return { clean: false, value: void 0 };
+  return {
+    clean: true,
+    value: applyMergePatch(applyMergePatch(base, theirPatch), ourPatch)
+  };
+}
+
+// src/merge/index.ts
+import picomatch from "picomatch";
+var STRUCTURED = /\.(json|ya?ml|toml)$/i;
+var BINARY = /\.(png|jpe?g|gif|webp|ico|pdf|woff2?|ttf|zip|gz)$/i;
+function defaultStrategy(path) {
+  if (STRUCTURED.test(path)) return "deep-merge";
+  if (BINARY.test(path)) return "replace";
+  return "replace";
+}
+function strategyFor(path, globs = {}) {
+  for (const [glob, strategy] of Object.entries(globs)) {
+    if (picomatch.isMatch(path, glob)) return strategy;
+  }
+  return defaultStrategy(path);
+}
+
+// src/layer-files.ts
+import { relative as relative2, resolve as resolvePath2 } from "path";
+import fg from "fast-glob";
+var ALWAYS_IGNORE = [
+  "**/node_modules/**",
+  "**/.git/**",
+  "**/.git",
+  ".treelay/**",
+  "**/.treelay/**",
+  "**/treelay.json",
+  "**/treelay.yaml",
+  "**/treelay.yml",
+  // The lockfile is manifest metadata, not content. Composing it would publish
+  // a layer's pins into every tree built from it — and, worse, make the leaf's
+  // own lockfile a *generated* file that `update` then reports as a change.
+  "**/treelay.lock"
+];
+var SelfCompileError = class extends Error {
+  constructor(dir) {
+    super(
+      `Destination is a layer root: ${dir}
+Compiling a layer into itself would overwrite the sources being read. Choose a destination outside the layer, or a subdirectory of it (e.g. ${dir}/build).`
+    );
+    this.name = "SelfCompileError";
+  }
+};
+function destExclusions(layerDir, destDir) {
+  if (!destDir) return [];
+  const layerAbs = resolvePath2(layerDir);
+  const destAbs = resolvePath2(destDir);
+  if (destAbs === layerAbs) throw new SelfCompileError(layerAbs);
+  const rel = relative2(layerAbs, destAbs);
+  if (rel === "" || rel.startsWith("..") || resolvePath2(layerAbs, rel) !== destAbs) {
+    return [];
+  }
+  const posix = rel.split("\\").join("/");
+  return [posix, `${posix}/**`];
+}
+function mountTarget(layer, target) {
+  return layer.mountPath ? `${layer.mountPath}/${target}` : target;
+}
+function listLayerFiles(layer, destDir) {
+  return fg.sync("**/*", {
+    cwd: layer.dir,
+    dot: true,
+    onlyFiles: true,
+    ignore: [
+      ...ALWAYS_IGNORE,
+      ...layer.manifest.ignore ?? [],
+      ...destExclusions(layer.dir, destDir)
+    ]
+  }).sort();
+}
+function classifyEntry(source, templateSuffix) {
+  const { render: isTemplate, outPath: inner } = templateTarget(source, templateSuffix);
+  if (isSidecar(inner)) {
+    return {
+      source,
+      inner,
+      isTemplate,
+      kind: "sidecar",
+      rawTarget: sidecarTarget(inner)
+    };
+  }
+  const sugar = desugarSuffix(inner);
+  if (sugar) {
+    return {
+      source,
+      inner,
+      isTemplate,
+      kind: "suffix",
+      op: sugar.op,
+      rawTarget: sugar.target
+    };
+  }
+  return { source, inner, isTemplate, kind: "file", rawTarget: inner };
+}
+function enumerateLayer(layer, destDir) {
+  const suffix = layer.manifest.templateSuffix ?? DEFAULT_TEMPLATE_SUFFIX;
+  return listLayerFiles(layer, destDir).map((rel) => classifyEntry(rel, suffix));
+}
+
+// src/state.ts
+import {
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync2,
+  existsSync as existsSync8,
+  rmSync as rmSync3
+} from "fs";
+import { dirname as dirname2, join as join7 } from "path";
+var STATE_DIR = ".treelay";
+var statePaths = (destDir) => ({
+  dir: join7(destDir, STATE_DIR),
+  lock: join7(destDir, STATE_DIR, "lock.json"),
+  answers: join7(destDir, STATE_DIR, "answers.json"),
+  baseline: join7(destDir, STATE_DIR, "baseline.json"),
+  /** Content snapshot of the last template output — the diff3 merge base (§7). */
+  baselineDir: join7(destDir, STATE_DIR, "baseline"),
+  manifest: join7(destDir, STATE_DIR, "manifest.json")
+});
+function sourceOf(state) {
+  return state.lock.lineage[state.lock.lineage.length - 1];
+}
+function hasState(destDir) {
+  return existsSync8(statePaths(destDir).lock);
+}
+function stripSecrets(values, decls) {
+  const out = {};
+  for (const [k, v] of Object.entries(values)) {
+    if (decls[k]?.secret) continue;
+    out[k] = v;
+  }
+  return out;
+}
+function writeState(destDir, state, decls, snapshot) {
+  const paths = statePaths(destDir);
+  mkdirSync2(paths.dir, { recursive: true });
+  const json = (v) => JSON.stringify(v, null, 2) + "\n";
+  writeFileSync2(paths.lock, json(state.lock));
+  writeFileSync2(paths.answers, json(stripSecrets(state.answers, decls)));
+  writeFileSync2(paths.baseline, json(state.baseline));
+  writeFileSync2(paths.manifest, json(state.manifest));
+  if (snapshot) {
+    rmSync3(paths.baselineDir, { recursive: true, force: true });
+    for (const [rel, data] of snapshot) {
+      const abs = join7(paths.baselineDir, rel);
+      ensureDir(abs);
+      writeFileSync2(abs, data);
+    }
+  }
+}
+function readBaselineFile(destDir, rel, expectedHash) {
+  const abs = join7(statePaths(destDir).baselineDir, rel);
+  if (!existsSync8(abs)) return void 0;
+  const data = readFileSync5(abs);
+  if (expectedHash !== void 0 && hashContent(data) !== expectedHash) {
+    return void 0;
+  }
+  return data;
+}
+function readState(destDir) {
+  const paths = statePaths(destDir);
+  const read = (p) => JSON.parse(readFileSync5(p, "utf8"));
+  return {
+    lock: read(paths.lock),
+    answers: read(paths.answers),
+    baseline: read(paths.baseline),
+    manifest: read(paths.manifest)
+  };
+}
+function lockFromGraph(graph) {
+  const versions = {};
+  for (const ref of Object.keys(graph.lock?.refs ?? {}).sort()) {
+    versions[ref] = graph.lock.refs[ref].resolved;
+  }
+  return {
+    lineage: graph.layers.map((l) => l.id),
+    versions
+  };
+}
+function ensureDir(filePath) {
+  mkdirSync2(dirname2(filePath), { recursive: true });
+}
+
+// src/compile.ts
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8 } from "path";
+import fg2 from "fast-glob";
+
+// src/serde.ts
+import { parse as parseYaml4, stringify as stringifyYaml } from "yaml";
+function structuredFormat(path) {
+  if (/\.json$/i.test(path)) return "json";
+  if (/\.ya?ml$/i.test(path)) return "yaml";
+  return void 0;
+}
+function parseStructured(path, text) {
+  const fmt = structuredFormat(path);
+  if (fmt === "json") return text.trim() === "" ? {} : JSON.parse(text);
+  if (fmt === "yaml") return parseYaml4(text) ?? {};
+  throw new Error(`Not a structured file: ${path}`);
+}
+function stringifyStructured(path, data) {
+  const fmt = structuredFormat(path);
+  if (fmt === "json") return JSON.stringify(data, null, 2) + "\n";
+  if (fmt === "yaml") return stringifyYaml(data);
+  throw new Error(`Not a structured file: ${path}`);
+}
+
+// src/compile.ts
+function needsRender(s) {
+  return s.includes("{{") || s.includes("{%");
+}
+async function composeFiles(graph, values = {}, destDir) {
+  const acc = /* @__PURE__ */ new Map();
+  for (const layer of graph.layers) {
+    await applyLayer(layer, acc, values, destDir);
+  }
+  return acc;
+}
+function summarize(acc) {
+  const result = { files: {} };
+  const baseline = {};
+  const manifest = {};
+  for (const [rel, entry] of acc) {
+    result.files[rel] = {
+      fromLayer: entry.fromLayer,
+      strategy: entry.strategy,
+      owned: false,
+      ...entry.patchedFrom.length ? { patchedFrom: entry.patchedFrom } : {}
+    };
+    baseline[rel] = hashContent(entry.data);
+    manifest[rel] = { owned: false, fromLayer: entry.fromLayer };
+  }
+  return { result, baseline, manifest };
+}
+async function compile(graph, options) {
+  const values = options.values ?? {};
+  const acc = await composeFiles(graph, values, options.destDir);
+  const { result, baseline, manifest } = summarize(acc);
+  const snapshot = /* @__PURE__ */ new Map();
+  for (const [rel, entry] of acc) {
+    const abs = join8(options.destDir, rel);
+    ensureDir(abs);
+    writeFileSync3(abs, entry.data);
+    snapshot.set(rel, entry.data);
+  }
+  const state = {
+    lock: lockFromGraph(graph),
+    answers: values,
+    baseline,
+    manifest
+  };
+  writeState(options.destDir, state, graph.variables, snapshot);
+  if (options.writeLockfile !== false && graph.lockDirty && graph.lockDir && graph.lock) {
+    writeLock(graph.lockDir, graph.lock);
+  }
+  return result;
+}
+async function applyLayer(layer, acc, values, destDir) {
+  const suffix = layer.manifest.templateSuffix ?? DEFAULT_TEMPLATE_SUFFIX;
+  const renderAllText = layer.manifest.render === "all-text";
+  const arrays = layer.manifest.arrays ?? "replace";
+  const entries = fg2.sync("**/*", {
+    cwd: layer.dir,
+    dot: true,
+    onlyFiles: true,
+    // A destination nested inside this layer is pruned so a recompile never
+    // folds its own prior output back in (§7).
+    ignore: [
+      ...ALWAYS_IGNORE,
+      ...layer.manifest.ignore ?? [],
+      ...destExclusions(layer.dir, destDir)
+    ]
+  });
+  const ops = [];
+  for (const rel of entries.sort()) {
+    const raw = readFileSync6(join8(layer.dir, rel));
+    const { render: isTmpl, outPath: inner } = templateTarget(rel, suffix);
+    if (isSidecar(inner)) {
+      const op = sidecarToOp(raw.toString("utf8"), inner, isTmpl, values);
+      op.target = mountTarget(layer, op.target);
+      ops.push(op);
+      continue;
+    }
+    const sugar = desugarSuffix(inner);
+    if (sugar) {
+      ops.push({
+        kind: sugar.op,
+        target: mountTarget(layer, await renderPath(sugar.target, values)),
+        render: isTmpl,
+        content: raw.toString("utf8")
+      });
+      continue;
+    }
+    const rendered = await renderPath(inner, values);
+    if (rendered.trim() === "") continue;
+    const target = mountTarget(layer, rendered);
+    const doRenderContent = isTmpl || renderAllText && looksTextual(inner);
+    const data = doRenderContent ? Buffer.from(await renderString(raw.toString("utf8"), values), "utf8") : raw;
+    mergeFile(acc, target, data, layer, arrays);
+  }
+  for (const op of ops) await applyOp(acc, op, values);
+}
+async function renderPath(path, values) {
+  return needsRender(path) ? renderString(path, values) : path;
+}
+function sidecarToOp(yamlText, innerPath, isTmpl, _values) {
+  const sc = parseSidecar(yamlText);
+  const op = {
+    kind: sc.op,
+    target: sidecarTarget(innerPath),
+    render: sc.render ?? false
+  };
+  if (sc.when !== void 0) op.when = sc.when;
+  if (sc.base !== void 0) op.base = sc.base;
+  if (sc.baseContent !== void 0) op.baseContent = sc.baseContent;
+  if (sc.content !== void 0) op.content = sc.content;
+  if (sc.merge !== void 0) op.merge = sc.merge;
+  if (sc.jsonPatch !== void 0) op.jsonPatch = sc.jsonPatch;
+  if (sc.patch !== void 0) op.content = sc.patch;
+  void isTmpl;
+  return op;
+}
+function mergeFile(acc, target, data, layer, arrays) {
+  const strategy = strategyFor(target, layer.manifest.merge);
+  const existing = acc.get(target);
+  if (!existing) {
+    acc.set(target, { data, strategy, fromLayer: layer.id, patchedFrom: [] });
+    return;
+  }
+  switch (strategy) {
+    case "replace":
+      existing.data = data;
+      existing.fromLayer = layer.id;
+      existing.strategy = strategy;
+      break;
+    case "deep-merge": {
+      const merged = deepMerge(
+        parseStructured(target, existing.data.toString("utf8")),
+        parseStructured(target, data.toString("utf8")),
+        arrays ?? "replace"
+      );
+      existing.data = Buffer.from(stringifyStructured(target, merged), "utf8");
+      existing.patchedFrom.push(existing.fromLayer);
+      existing.fromLayer = layer.id;
+      existing.strategy = strategy;
+      break;
+    }
+    case "append":
+      existing.data = Buffer.concat([existing.data, data]);
+      existing.patchedFrom.push(layer.id);
+      break;
+    case "prepend":
+      existing.data = Buffer.concat([data, existing.data]);
+      existing.patchedFrom.push(layer.id);
+      break;
+    case "delete":
+      acc.delete(target);
+      break;
+    case "patch":
+      existing.data = Buffer.from(
+        applyPatch3Way({
+          file: target,
+          current: existing.data.toString("utf8"),
+          patch: data.toString("utf8")
+        }),
+        "utf8"
+      );
+      existing.strategy = "patch";
+      existing.patchedFrom.push(layer.id);
+      break;
+  }
+}
+async function applyOp(acc, op, values) {
+  if (op.when !== void 0) {
+    const w = (await renderString(op.when, values)).trim();
+    if (w === "" || w === "false") return;
+  }
+  const existing = acc.get(op.target);
+  const content = op.content !== void 0 && op.render ? await renderString(op.content, values) : op.content;
+  switch (op.kind) {
+    case "delete":
+      acc.delete(op.target);
+      return;
+    case "replace": {
+      const data = Buffer.from(content ?? "", "utf8");
+      if (existing) {
+        existing.data = data;
+        existing.patchedFrom.push("sidecar");
+      } else {
+        acc.set(op.target, {
+          data,
+          strategy: "replace",
+          fromLayer: "sidecar",
+          patchedFrom: []
+        });
+      }
+      return;
+    }
+    case "append":
+    case "prepend": {
+      const add = Buffer.from(content ?? "", "utf8");
+      const base = existing?.data ?? Buffer.alloc(0);
+      const data = op.kind === "append" ? Buffer.concat([base, add]) : Buffer.concat([add, base]);
+      if (existing) {
+        existing.data = data;
+        existing.patchedFrom.push("sidecar");
+      } else {
+        acc.set(op.target, {
+          data,
+          strategy: op.kind,
+          fromLayer: "sidecar",
+          patchedFrom: []
+        });
+      }
+      return;
+    }
+    case "merge": {
+      const baseData = existing ? parseStructured(op.target, existing.data.toString("utf8")) : {};
+      const result = op.jsonPatch ? applyJsonPatch(baseData, op.jsonPatch) : applyMergePatch(baseData, op.merge ?? {});
+      setStructured(acc, op, existing, result);
+      return;
+    }
+    case "patch": {
+      if (!existing) {
+        throw new MergeConflictError(
+          op.target,
+          "patch has nothing to apply to \u2014 the file is not produced by any lower layer (never created, or removed by a tombstone). Ship the full file instead of a patch, or drop the tombstone."
+        );
+      }
+      const current = existing.data.toString("utf8");
+      existing.data = Buffer.from(
+        applyPatch3Way({
+          file: op.target,
+          current,
+          patch: content ?? "",
+          ...resolvePatchBase(op, current)
+        }),
+        "utf8"
+      );
+      existing.strategy = "patch";
+      existing.patchedFrom.push("sidecar");
+      return;
+    }
+  }
+}
+function resolvePatchBase(op, current) {
+  if (op.baseContent !== void 0) {
+    if (op.base !== void 0 && hashContent(op.baseContent) !== op.base.trim()) {
+      throw new MergeConflictError(
+        op.target,
+        `sidecar is inconsistent: \`baseContent\` hashes to ${hashContent(op.baseContent)} but \`base\` records ${op.base}.`
+      );
+    }
+    return { base: op.baseContent };
+  }
+  if (op.base !== void 0 && hashContent(current) === op.base.trim()) {
+    return { base: current };
+  }
+  return {};
+}
+function setStructured(acc, op, existing, value) {
+  const data = Buffer.from(stringifyStructured(op.target, value), "utf8");
+  if (existing) {
+    existing.data = data;
+    existing.patchedFrom.push("sidecar");
+  } else {
+    acc.set(op.target, {
+      data,
+      strategy: "deep-merge",
+      fromLayer: "sidecar",
+      patchedFrom: []
+    });
+  }
+}
+function looksTextual(path) {
+  return !/\.(png|jpe?g|gif|webp|ico|pdf|woff2?|ttf|zip|gz|tar|exe|bin)$/i.test(
+    path
+  );
+}
+
+// src/drift.ts
+function hasDrift(reports) {
+  return reports.some((r) => r.status === "moved");
+}
+function checkDrift(graph, fromDir) {
+  const lock = graph.lock;
+  if (!lock) return [];
+  const anchor = fromDir ?? graph.lockDir ?? process.cwd();
+  const reports = [];
+  for (const key of Object.keys(lock.refs).sort()) {
+    const entry = lock.refs[key];
+    const layers = graph.layers.filter((l) => l.origin?.ref === key).map((l) => l.manifest.name ?? l.id);
+    const parsed = parseRef(key);
+    const immutable = parsed.kind === "git" && parsed.committish === entry.resolved || parsed.kind === "npm" && parsed.range === entry.resolved;
+    const current = immutable ? entry.resolved : liveRevision(parsed, anchor);
+    const status2 = immutable ? "immutable" : current === void 0 ? "unknown" : current === entry.resolved ? "in-sync" : "moved";
+    reports.push({
+      ref: key,
+      requested: entry.requested,
+      locked: entry.resolved,
+      ...current !== void 0 ? { current } : {},
+      status: status2,
+      layers
+    });
+  }
+  return reports;
+}
+function short(rev) {
+  return /^[0-9a-f]{40}$/i.test(rev) ? rev.slice(0, 12) : rev;
+}
+function formatDrift(reports) {
+  const moved = reports.filter((r) => r.status === "moved");
+  if (!moved.length) return "";
+  const lines = moved.map((r) => {
+    const who = r.layers.length ? `  (${r.layers.join(", ")})` : "";
+    return `  ${r.ref}
+    pinned  ${short(r.locked)}
+    ${r.requested} is now  ${short(r.current)}${who}`;
+  });
+  return `${moved.length} ref(s) have moved upstream since treelay.lock was written:
+` + lines.join("\n") + `
+This build used the pinned revisions. Run \`treelay lock --update\` to advance them.`;
+}
+
+// src/update.ts
+import {
+  existsSync as existsSync9,
+  readFileSync as readFileSync7,
+  rmSync as rmSync4,
+  writeFileSync as writeFileSync4,
+  statSync as statSync2
+} from "fs";
+import { join as join9 } from "path";
+function isBinary(data) {
+  return data.includes(0);
+}
+function mergeOne(path, base, ours, theirs) {
+  const text = mergeText3({ base, ours, theirs });
+  if (text.clean) return text;
+  if (structuredFormat(path)) {
+    try {
+      const merged = mergeStructured3(
+        parseStructured(path, base),
+        parseStructured(path, ours),
+        parseStructured(path, theirs)
+      );
+      if (merged.clean) {
+        return { clean: true, text: stringifyStructured(path, merged.value) };
+      }
+    } catch {
+    }
+  }
+  return text;
+}
+async function planFrom(destDir, options) {
+  const state = readState(destDir);
+  const src = sourceOf(state);
+  if (!src) {
+    throw new Error(
+      `${destDir}: .treelay/lock.json records no lineage, so there is no template to update from. Recompile with \`treelay compile <src> ${destDir}\`.`
+    );
+  }
+  if (!existsSync9(src) || !statSync2(src).isDirectory()) {
+    throw new Error(
+      `${destDir}: the template it was compiled from is gone (${src}). Restore it, or recompile from its new location.`
+    );
+  }
+  const graph = resolve(src, options.frozen ? { frozen: true } : {});
+  const newVariables = Object.keys(graph.variables).filter(
+    (name) => !(name in state.answers)
+  );
+  const values = await resolveValues(graph, {
+    answers: state.answers,
+    ...options.set ? { set: options.set } : {},
+    prompt: options.prompt !== false
+  });
+  const theirs = await composeFiles(graph, values, destDir);
+  const decisions = [];
+  const files = {};
+  const conflicts = [];
+  const paths = [
+    .../* @__PURE__ */ new Set([...Object.keys(state.baseline), ...theirs.keys()])
+  ].sort();
+  for (const path of paths) {
+    const decision = decide(destDir, path, state, theirs, options);
+    decisions.push(decision);
+    files[path] = decision.resolution;
+    if (decision.resolution === "conflict") conflicts.push(path);
+  }
+  return {
+    decisions,
+    plan: { files, conflicts, newVariables, drift: checkDrift(graph) },
+    theirs,
+    values,
+    state,
+    destLock: lockFromGraph(graph),
+    variables: graph.variables
+  };
+}
+function decide(destDir, path, state, theirsMap, options) {
+  const baseHash = state.baseline[path];
+  const theirsEntry = theirsMap.get(path);
+  const abs = join9(destDir, path);
+  const ours = existsSync9(abs) ? readFileSync7(abs) : void 0;
+  if (!theirsEntry) {
+    if (!ours) return { path, resolution: "unchanged" };
+    if (baseHash !== void 0 && hashContent(ours) === baseHash) {
+      return { path, resolution: "delete", remove: true };
+    }
+    return conflictOver(path, ours, void 0, options);
+  }
+  const theirs = theirsEntry.data;
+  if (baseHash === void 0) {
+    if (!ours) return { path, resolution: "take-theirs", write: theirs };
+    if (ours.equals(theirs)) return { path, resolution: "unchanged" };
+    return conflictOver(path, ours, theirs, options);
+  }
+  if (!ours) {
+    if (hashContent(theirs) === baseHash) return { path, resolution: "keep-ours" };
+    return conflictOver(path, void 0, theirs, options);
+  }
+  const oursUnchanged = hashContent(ours) === baseHash;
+  const theirsUnchanged = hashContent(theirs) === baseHash;
+  if (oursUnchanged && theirsUnchanged) return { path, resolution: "unchanged" };
+  if (oursUnchanged) return { path, resolution: "take-theirs", write: theirs };
+  if (theirsUnchanged) return { path, resolution: "keep-ours" };
+  if (ours.equals(theirs)) return { path, resolution: "unchanged" };
+  const base = readBaselineFile(destDir, path, baseHash);
+  if (!base || isBinary(base) || isBinary(ours) || isBinary(theirs)) {
+    return conflictOver(path, ours, theirs, options);
+  }
+  const merged = mergeOne(
+    path,
+    base.toString("utf8"),
+    ours.toString("utf8"),
+    theirs.toString("utf8")
+  );
+  if (merged.clean) {
+    return { path, resolution: "merged", write: Buffer.from(merged.text, "utf8") };
+  }
+  return conflictOver(path, ours, theirs, options, Buffer.from(merged.text, "utf8"));
+}
+function conflictOver(path, ours, theirs, options, markers) {
+  if ((options.onConflict ?? "markers") === "rej") {
+    return {
+      path,
+      resolution: "conflict",
+      ...ours ? {} : { write: Buffer.alloc(0) },
+      ...theirs ? { rej: theirs } : { rej: Buffer.alloc(0) }
+    };
+  }
+  const write = markers ?? theirs ?? ours;
+  return { path, resolution: "conflict", ...write ? { write } : {} };
+}
+async function planUpdate(destDir, options = {}) {
+  const { plan } = await planFrom(destDir, { ...options, prompt: false });
+  return plan;
+}
+async function update(destDir, options = {}) {
+  const { decisions, plan, theirs, values, variables, destLock } = await planFrom(
+    destDir,
+    options
+  );
+  for (const d of decisions) {
+    const abs = join9(destDir, d.path);
+    if (d.remove) {
+      rmSync4(abs, { force: true });
+      continue;
+    }
+    if (d.write) {
+      ensureDir(abs);
+      writeFileSync4(abs, d.write);
+    }
+    if (d.rej) {
+      ensureDir(abs);
+      writeFileSync4(abs + ".rej", d.rej);
+    }
+  }
+  const { baseline, manifest } = summarize(theirs);
+  const snapshot = /* @__PURE__ */ new Map();
+  for (const [rel, entry] of theirs) snapshot.set(rel, entry.data);
+  writeState(
+    destDir,
+    { lock: destLock, answers: values, baseline, manifest },
+    variables,
+    snapshot
+  );
+  return plan;
+}
+
+// src/explain.ts
+import { readFileSync as readFileSync8 } from "fs";
+import { basename, join as join10, resolve as resolvePath3 } from "path";
+function summarizeLayers(graph) {
+  const self = graph.layers[graph.layers.length - 1];
+  const mixinIds = /* @__PURE__ */ new Set();
+  if (self) {
+    for (const ref of self.manifest.mixins ?? []) {
+      try {
+        const parsed = parseRef(ref);
+        mixinIds.add(
+          parsed.kind === "local" ? resolvePath3(self.dir, parsed.path) : canonicalRef(parsed)
+        );
+      } catch {
+      }
+    }
+  }
+  return graph.layers.map((layer, i) => ({
+    id: layer.id,
+    name: displayName(layer),
+    role: layer.mountPath ? "mount" : layer === self ? "self" : mixinIds.has(layer.id) ? "mixin" : "parent",
+    position: i + 1,
+    writable: layer.writable,
+    ...layer.origin?.ref ? { ref: layer.origin.ref } : {},
+    ...layer.origin?.revision ? { revision: layer.origin.revision } : {},
+    ...layer.mountPath ? { mountPath: layer.mountPath } : {}
+  }));
+}
+function displayName(layer) {
+  if (layer.manifest.name) return layer.manifest.name;
+  if (layer.mountPath) return `${layer.mountPath}/`;
+  return layer.origin?.ref ?? basename(layer.dir);
+}
+async function tryRenderPath(path, values) {
+  if (!path.includes("{{") && !path.includes("{%")) return { path };
+  try {
+    return { path: await renderString(path, values) };
+  } catch {
+    return { path, note: "path left unrendered (no value for its variables)" };
+  }
+}
+async function explain(graph, options = {}) {
+  const values = options.values ?? {};
+  const summaries = summarizeLayers(graph);
+  const live = /* @__PURE__ */ new Map();
+  const history = /* @__PURE__ */ new Map();
+  const deleted = /* @__PURE__ */ new Set();
+  const record = (target, c) => {
+    const list = history.get(target);
+    if (list) list.push(c);
+    else history.set(target, [c]);
+  };
+  for (const [i, layer] of graph.layers.entries()) {
+    const summary = summaries[i];
+    const arrays = layer.manifest.arrays ?? "replace";
+    void arrays;
+    const entries = enumerateLayer(layer, options.destDir);
+    const ops = [];
+    for (const entry of entries) {
+      if (entry.kind !== "file") {
+        ops.push(entry);
+        continue;
+      }
+      const rendered = await tryRenderPath(entry.rawTarget, values);
+      if (rendered.path.trim() === "") continue;
+      const target = mountTarget(layer, rendered.path);
+      const strategy = strategyFor(target, layer.manifest.merge);
+      const existing = live.get(target);
+      const base = {
+        layer: layer.id,
+        name: summary.name,
+        role: summary.role,
+        position: summary.position,
+        source: entry.source,
+        strategy,
+        kind: entry.kind,
+        ...rendered.note ? { note: rendered.note } : {}
+      };
+      if (!existing) {
+        live.set(target, { strategy, fromLayer: layer.id, patchedFrom: [] });
+        deleted.delete(target);
+        record(target, { ...base, action: "create" });
+        continue;
+      }
+      switch (strategy) {
+        case "replace":
+          existing.fromLayer = layer.id;
+          existing.strategy = strategy;
+          record(target, { ...base, action: "replace" });
+          break;
+        case "deep-merge":
+          existing.patchedFrom.push(existing.fromLayer);
+          existing.fromLayer = layer.id;
+          existing.strategy = strategy;
+          record(target, { ...base, action: "deep-merge" });
+          break;
+        case "append":
+        case "prepend":
+          existing.patchedFrom.push(layer.id);
+          record(target, { ...base, action: strategy });
+          break;
+        case "delete":
+          live.delete(target);
+          deleted.add(target);
+          record(target, { ...base, action: "delete" });
+          break;
+        case "patch":
+          record(target, {
+            ...base,
+            action: "patch",
+            note: "unified-diff patch via merge glob (\xA75) \u2014 described, not applied"
+          });
+          break;
+      }
+    }
+    for (const entry of ops) {
+      await explainOp(entry, layer, summary, values, live, deleted, record);
+    }
+  }
+  const files = {};
+  for (const path of [...history.keys()].sort()) {
+    const state = live.get(path);
+    files[path] = {
+      path,
+      contributions: history.get(path),
+      present: state !== void 0,
+      patchedFrom: state?.patchedFrom ?? [],
+      ...state ? { winner: state.fromLayer, strategy: state.strategy } : {}
+    };
+  }
+  return { layers: summaries, files };
+}
+async function explainOp(entry, layer, summary, values, live, deleted, record) {
+  let op = entry.op;
+  let baseHash;
+  let when;
+  if (entry.kind === "sidecar") {
+    try {
+      const sc = parseSidecar(readFileSync8(join10(layer.dir, entry.source), "utf8"));
+      op = sc.op;
+      baseHash = sc.base;
+      when = sc.when;
+    } catch (err) {
+      record(mountTarget(layer, entry.rawTarget), {
+        layer: layer.id,
+        name: summary.name,
+        role: summary.role,
+        position: summary.position,
+        source: entry.source,
+        action: "replace",
+        strategy: "replace",
+        kind: entry.kind,
+        skipped: true,
+        note: `unreadable sidecar: ${err instanceof Error ? err.message : String(err)}`
+      });
+      return;
+    }
+  }
+  if (!op) return;
+  const rendered = await tryRenderPath(entry.rawTarget, values);
+  const target = mountTarget(layer, rendered.path);
+  const contribution = {
+    layer: layer.id,
+    name: summary.name,
+    role: summary.role,
+    position: summary.position,
+    source: entry.source,
+    action: op,
+    strategy: op === "merge" ? "deep-merge" : op,
+    kind: entry.kind,
+    ...baseHash ? { base: baseHash } : {},
+    ...rendered.note ? { note: rendered.note } : {}
+  };
+  if (when !== void 0) {
+    let truthy = true;
+    try {
+      const w = (await renderString(when, values)).trim();
+      truthy = !(w === "" || w === "false");
+    } catch {
+      truthy = false;
+    }
+    if (!truthy) {
+      record(target, {
+        ...contribution,
+        skipped: true,
+        note: `skipped: \`when: ${when}\` evaluated falsy`
+      });
+      return;
+    }
+  }
+  const existing = live.get(target);
+  switch (op) {
+    case "delete":
+      live.delete(target);
+      deleted.add(target);
+      break;
+    case "replace":
+    case "append":
+    case "prepend":
+      if (existing) existing.patchedFrom.push("sidecar");
+      else
+        live.set(target, {
+          strategy: op === "replace" ? "replace" : op,
+          fromLayer: "sidecar",
+          patchedFrom: []
+        });
+      break;
+    case "merge":
+      if (existing) existing.patchedFrom.push("sidecar");
+      else
+        live.set(target, {
+          strategy: "deep-merge",
+          fromLayer: "sidecar",
+          patchedFrom: []
+        });
+      break;
+    case "patch":
+      contribution.note = "unified-diff 3-way patch (\xA75) \u2014 described, not applied" + (baseHash ? "" : "; no recorded base \u21D2 best-effort apply");
+      break;
+  }
+  record(target, contribution);
+}
+async function explainFile(graph, path, options = {}) {
+  const result = await explain(graph, options);
+  return result.files[path];
+}
+async function explainDest(destDir) {
+  if (!hasState(destDir)) {
+    throw new Error(
+      `No .treelay state in ${destDir} \u2014 not a compiled destination. Point \`explain\` at a source layer directory instead.`
+    );
+  }
+  const state = readState(destDir);
+  const src = state.lock.lineage[state.lock.lineage.length - 1];
+  if (!src) throw new Error(`Corrupt lockfile in ${destDir}: empty lineage.`);
+  const result = await explain(resolve(src), {
+    values: state.answers,
+    destDir
+  });
+  for (const [path, entry] of Object.entries(state.manifest)) {
+    const file = result.files[path];
+    if (file) file.owned = entry.owned;
+  }
+  return result;
+}
+function formatExplanation(result, only) {
+  const lines = [];
+  lines.push("Layers (lowest \u2192 highest precedence):");
+  for (const l of result.layers) {
+    const marks = [
+      l.mountPath ? `mounted at ${l.mountPath}/` : void 0,
+      l.revision ? `pinned ${shortRevision(l.revision)}` : void 0,
+      l.writable ? void 0 : "read-only"
+    ].filter(Boolean);
+    const flags = marks.length ? `  [${marks.join(", ")}]` : "";
+    lines.push(`  ${l.position}. ${l.name}  (${l.role})${flags}`);
+  }
+  lines.push("");
+  const paths = only ? [only] : Object.keys(result.files);
+  if (only && !result.files[only]) {
+    lines.push(`No layer contributes to "${only}".`);
+    return lines.join("\n");
+  }
+  for (const path of paths) {
+    const file = result.files[path];
+    const status2 = file.present ? `\u2190 ${nameOf(result, file.winner)} (${file.strategy})` : "\u2190 removed (tombstoned)";
+    lines.push(`${path}  ${status2}`);
+    for (const c of file.contributions) {
+      const marks = [
+        c.skipped ? "skipped" : void 0,
+        c.kind === "sidecar" ? "sidecar" : c.kind === "suffix" ? "suffix" : void 0,
+        c.base ? `base ${c.base.slice(0, 14)}\u2026` : void 0
+      ].filter(Boolean);
+      const suffix = marks.length ? `  [${marks.join(", ")}]` : "";
+      lines.push(
+        `  ${c.position}. ${pad(c.name, 18)} ${pad(c.role, 7)} ${pad(c.action, 11)} ${c.source}${suffix}`
+      );
+      if (c.note) lines.push(`       note: ${c.note}`);
+    }
+    if (file.patchedFrom.length) {
+      const names = file.patchedFrom.map((id) => nameOf(result, id));
+      lines.push(`  folded in: ${names.join(", ")}`);
+    }
+    if (file.owned) lines.push("  user-owned (not produced by the template)");
+    lines.push("");
+  }
+  return lines.join("\n").trimEnd();
+}
+function shortRevision(rev) {
+  return /^[0-9a-f]{40}$/i.test(rev) ? rev.slice(0, 12) : rev;
+}
+function nameOf(result, id) {
+  if (!id) return "\u2014";
+  return result.layers.find((l) => l.id === id)?.name ?? id;
+}
+function pad(s, n) {
+  return s.length >= n ? s : s + " ".repeat(n - s.length);
+}
+
+// src/blast-radius.ts
+import { readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname3, join as join11, resolve as resolvePath4, sep } from "path";
+import fg3 from "fast-glob";
+var MANIFEST_GLOBS = [
+  "**/treelay.json",
+  "**/treelay.yaml",
+  "**/treelay.yml",
+  "**/package.json"
+];
+var SCAN_IGNORE = ["**/node_modules/**", "**/.git/**"];
+function blastRadius(layerDir, options) {
+  const target = resolvePath4(layerDir);
+  const searchRoot = resolvePath4(options.searchRoot);
+  const depth = options.depth ?? 8;
+  const dependents = /* @__PURE__ */ new Set();
+  const destinations = /* @__PURE__ */ new Set();
+  for (const rel of fg3.sync(MANIFEST_GLOBS, {
+    cwd: searchRoot,
+    dot: true,
+    onlyFiles: true,
+    deep: depth,
+    ignore: SCAN_IGNORE
+  })) {
+    const dir = resolvePath4(searchRoot, dirname3(rel));
+    if (dir === target) continue;
+    if (options.excludeLayer && dir === resolvePath4(options.excludeLayer)) continue;
+    const manifest = loadManifest(dir);
+    const refs = [...manifest.parents ?? [], ...manifest.mixins ?? []];
+    for (const ref of refs) {
+      let resolved;
+      try {
+        resolved = resolveRef(ref, dir);
+      } catch {
+        continue;
+      }
+      if (resolved === target) dependents.add(dir);
+    }
+  }
+  for (const rel of fg3.sync(`**/${STATE_DIR}/lock.json`, {
+    cwd: searchRoot,
+    dot: true,
+    onlyFiles: true,
+    deep: depth + 1,
+    ignore: SCAN_IGNORE
+  })) {
+    const destDir = resolvePath4(searchRoot, dirname3(dirname3(rel)));
+    if (options.excludeDest && destDir === resolvePath4(options.excludeDest)) continue;
+    try {
+      const lock = JSON.parse(readFileSync9(join11(searchRoot, rel), "utf8"));
+      if (lock.lineage?.includes(target)) destinations.add(destDir);
+    } catch {
+      continue;
+    }
+  }
+  return {
+    layer: target,
+    searchRoot,
+    dependents: [...dependents].sort(),
+    destinations: [...destinations].sort(),
+    bounded: true
+  };
+}
+function describeBlastRadius(radius, layerName2) {
+  const n = radius.dependents.length;
+  const d = radius.destinations.length;
+  if (n === 0 && d === 0) {
+    return `${layerName2} has no other known consumers under ${radius.searchRoot}.`;
+  }
+  const parts = [];
+  if (n) parts.push(`${n} other layer${n === 1 ? "" : "s"} inherit${n === 1 ? "s" : ""} it`);
+  if (d) parts.push(`${d} compiled destination${d === 1 ? "" : "s"} include${d === 1 ? "s" : ""} it`);
+  return `${layerName2} is consumed beyond this project \u2014 ${parts.join(", ")}. This edit reaches all of them on their next update.`;
+}
+function commonAncestor(paths) {
+  if (paths.length === 0) return resolvePath4(".");
+  const split = paths.map((p) => resolvePath4(p).split(sep));
+  const first = split[0];
+  let i = 0;
+  while (i < first.length && split.every((parts) => parts[i] === first[i])) i++;
+  return split[0].slice(0, i).join(sep) || sep;
+}
+
+// src/verify.ts
+import { readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
+import { join as join12 } from "path";
+async function composeToMemory(graph, values, destDir) {
+  const composed = await composeFiles(graph, values, destDir);
+  const files = /* @__PURE__ */ new Map();
+  for (const [rel, entry] of composed) files.set(rel, entry.data);
+  return files;
+}
+async function roundTripVerify(destDir, graph, values, options = {}) {
+  const composed = await composeToMemory(graph, values, destDir);
+  const mismatches = [];
+  for (const [rel, expected] of composed) {
+    const abs = join12(destDir, rel);
+    if (!existsSync10(abs)) {
+      mismatches.push({
+        path: rel,
+        kind: "missing-in-dest",
+        detail: "the template produces this file but the destination lacks it"
+      });
+      continue;
+    }
+    const actual = readFileSync10(abs);
+    if (!actual.equals(expected)) {
+      mismatches.push({
+        path: rel,
+        kind: "content-differs",
+        detail: `recompiled output differs from the working copy (${expected.length} vs ${actual.length} bytes)`
+      });
+    }
+  }
+  for (const rel of options.expectAbsent ?? []) {
+    if (composed.has(rel)) {
+      mismatches.push({
+        path: rel,
+        kind: "should-have-been-removed",
+        detail: "the template still produces this file after the promotion"
+      });
+    }
+  }
+  return { ok: mismatches.length === 0, mismatches, composed };
+}
+function describeMismatches(mismatches) {
+  return mismatches.map((m) => `  ${m.path} \u2014 ${m.kind}: ${m.detail}`).join("\n");
+}
+
+// src/reflux.ts
+import {
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync11,
+  rmSync as rmSync5,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { dirname as dirname4, join as join13, relative as relative3, resolve as resolvePath5 } from "path";
+import { createPatch } from "diff";
+import fg4 from "fast-glob";
+import { stringify as stringifyYaml2 } from "yaml";
+var WHOLESALE_ACTIONS = /* @__PURE__ */ new Set(["create", "replace", "delete"]);
+var STRUCTURED2 = /\.(json|ya?ml|toml)$/i;
+async function loadContext(destDir) {
+  const state = readState(destDir);
+  const srcDir = sourceOf(state);
+  if (!srcDir) throw new Error(`Corrupt lockfile in ${destDir}: empty lineage.`);
+  const graph = resolve(srcDir);
+  const explanation = await explain(graph, { values: state.answers, destDir });
+  return {
+    destDir,
+    srcDir,
+    graph,
+    values: state.answers,
+    explanation,
+    baseline: state.baseline,
+    manifest: state.manifest
+  };
+}
+function destFiles(destDir) {
+  return fg4.sync("**/*", {
+    cwd: destDir,
+    dot: true,
+    onlyFiles: true,
+    ignore: [`${STATE_DIR}/**`]
+  }).sort();
+}
+var layerName = (layer) => layer.manifest.name ?? relative3(dirname4(layer.dir), layer.dir);
+function layerById(graph, id) {
+  return graph.layers.find((l) => l.id === id);
+}
+function nameOf2(graph, id) {
+  const layer = layerById(graph, id);
+  return layer ? layerName(layer) : id;
+}
+function positionOf(graph, id) {
+  return graph.layers.findIndex((l) => l.id === id) + 1;
+}
+function shadowers(explanation, path, position) {
+  const file = explanation.files[path];
+  if (!file) return [];
+  return file.contributions.filter(
+    (c) => c.position > position && !c.skipped && WHOLESALE_ACTIONS.has(c.action)
+  );
+}
+async function status(destDir) {
+  const ctx = await loadContext(destDir);
+  const present = new Set(destFiles(destDir));
+  const changes = [];
+  for (const [path, recorded] of Object.entries(ctx.baseline)) {
+    if (!present.has(path)) {
+      changes.push(annotate(ctx, { path, kind: "deleted" }));
+      continue;
+    }
+    const actual = hashContent(readFileSync11(join13(destDir, path)));
+    if (actual !== recorded) {
+      changes.push(annotate(ctx, { path, kind: "modified" }));
+    }
+  }
+  for (const path of present) {
+    if (path in ctx.baseline) continue;
+    changes.push(annotate(ctx, { path, kind: "added" }));
+  }
+  return changes.sort((a, b) => a.path.localeCompare(b.path));
+}
+function annotate(ctx, change) {
+  const file = ctx.explanation.files[change.path];
+  const producing = file?.winner ?? ctx.manifest[change.path]?.fromLayer;
+  const targets = ctx.graph.layers.filter((l) => l.writable).filter((l) => shadowers(ctx.explanation, change.path, positionOf(ctx.graph, l.id)).length === 0).map((l) => l.id);
+  return {
+    ...change,
+    ...producing ? { producingLayer: producing } : {},
+    ...file?.patchedFrom.length ? { patchedBy: file.patchedFrom } : {},
+    ...file ? {} : { owned: true },
+    targets
+  };
+}
+function formatStatus(changes, graph) {
+  if (changes.length === 0) return "No changes vs baseline.";
+  const mark = { modified: "M", added: "A", deleted: "D" };
+  const width = Math.max(...changes.map((c) => c.path.length));
+  return changes.map((c) => {
+    const path = c.path.padEnd(width);
+    if (!c.producingLayer) return `  A  ${path}  \u2190 local-only (no template origin)`;
+    const patched = c.patchedBy?.length ? `  (+ patched by ${c.patchedBy.map((id) => nameOf2(graph, id)).join(", ")})` : "";
+    return `  ${mark[c.kind]}  ${path}  \u2190 produced by ${nameOf2(graph, c.producingLayer)}${patched}`;
+  }).join("\n");
+}
+async function promote(destDir, changes, options = {}) {
+  if (changes.length === 0) throw new Error("promote: no changes given.");
+  const ctx = await loadContext(destDir);
+  const target = resolveTarget(ctx, changes, options.to);
+  const position = positionOf(ctx.graph, target.id);
+  if (!target.writable) {
+    throw new Error(
+      `Cannot promote into ${layerName(target)}: the layer is read-only.
+Promote into a writable layer above it, or capture the change as a patch there (\xA78).`
+    );
+  }
+  for (const change of changes) {
+    const blocked = shadowers(ctx.explanation, change.path, position);
+    if (blocked.length) {
+      const names = [...new Set(blocked.map((c) => c.name))].join(", ");
+      throw new Error(
+        `Promoting ${change.path} to ${layerName(target)} has no effect; ${names} overrides this file at a higher precedence.
+Promote to ${names} or to the leaf instead (\xA78 guard 1).`
+      );
+    }
+  }
+  const tx = new LayerTransaction();
+  let landed;
+  try {
+    landed = [];
+    for (const change of changes) {
+      landed.push(await landChange(ctx, change, target, position, tx));
+    }
+  } catch (err) {
+    tx.rollback();
+    throw err;
+  }
+  const verify = options.verify !== false;
+  if (verify) {
+    const regraph = resolve(ctx.srcDir);
+    const removed = changes.filter((c) => c.kind === "deleted").map((c) => c.path);
+    const result = await roundTripVerify(destDir, regraph, ctx.values, {
+      expectAbsent: removed
+    });
+    if (!result.ok) {
+      tx.rollback();
+      throw new Error(
+        `Round-trip verification failed after promoting to ${layerName(target)} \u2014 the recompiled template does not reproduce the working copy, so the promotion was rolled back (\xA78 guard 2):
+${describeMismatches(result.mismatches)}`
+      );
+    }
+    rebaseline(ctx, regraph, result.composed);
+  }
+  const searchRoot = options.searchRoot ?? commonAncestor([...ctx.graph.layers.map((l) => l.dir), destDir]);
+  const radius = blastRadius(target.dir, {
+    searchRoot,
+    excludeDest: destDir,
+    excludeLayer: ctx.srcDir
+  });
+  return {
+    target: target.id,
+    targetName: layerName(target),
+    landed,
+    verified: verify,
+    blastRadius: radius,
+    blastRadiusWarning: describeBlastRadius(radius, layerName(target))
+  };
+}
+function resolveTarget(ctx, changes, to) {
+  if (to) {
+    const dir = to.startsWith(".") || to.startsWith("/") ? resolveRef(to, ctx.srcDir) : to;
+    const layer2 = ctx.graph.layers.find((l) => l.id === dir || layerName(l) === to);
+    if (!layer2) {
+      const known = ctx.graph.layers.map((l) => layerName(l)).join(", ");
+      throw new Error(`Unknown promotion target "${to}". Layers in this composition: ${known}.`);
+    }
+    return layer2;
+  }
+  const suggestions = new Set(
+    changes.map((c) => c.producingLayer ?? ctx.explanation.files[c.path]?.winner ?? ctx.srcDir)
+  );
+  if (suggestions.size > 1) {
+    const names = [...suggestions].map((id) => nameOf2(ctx.graph, id)).join(", ");
+    throw new Error(
+      `These changes come from different layers (${names}), so there is no single suggested target. Promote them separately, or pass an explicit target.`
+    );
+  }
+  const [only] = [...suggestions];
+  const layer = layerById(ctx.graph, only);
+  if (!layer) throw new Error(`Suggested target ${only} is not part of the composition.`);
+  return layer;
+}
+async function landChange(ctx, change, target, position, tx) {
+  const file = ctx.explanation.files[change.path];
+  if (change.kind === "deleted") {
+    const own2 = file?.contributions.find((c) => c.layer === target.id);
+    if (own2 && file.contributions.length === 1) {
+      tx.remove(join13(target.dir, own2.source));
+      return { path: change.path, mode: "tombstone", wrote: own2.source };
+    }
+    const sidecar = change.path + SIDECAR_SUFFIX;
+    tx.write(join13(target.dir, sidecar), stringifyYaml2({ op: "delete" }));
+    return { path: change.path, mode: "tombstone", wrote: sidecar };
+  }
+  const desired = readFileSync11(join13(ctx.destDir, change.path), "utf8");
+  const own = file?.contributions.find((c) => c.layer === target.id && c.kind === "file");
+  if (own) {
+    tx.write(join13(target.dir, own.source), desired);
+    return { path: change.path, mode: "rewrite", wrote: own.source };
+  }
+  const inherited = await inheritedBelow(ctx, position, change.path);
+  if (inherited !== void 0) {
+    const sidecar = change.path + SIDECAR_SUFFIX;
+    tx.write(
+      join13(target.dir, sidecar),
+      buildPatchSidecar(change.path, inherited, desired)
+    );
+    return { path: change.path, mode: "patch", wrote: sidecar };
+  }
+  tx.write(join13(target.dir, change.path), desired);
+  return { path: change.path, mode: "create", wrote: change.path };
+}
+async function inheritedBelow(ctx, position, path) {
+  if (position <= 1) return void 0;
+  const below = {
+    layers: ctx.graph.layers.slice(0, position - 1),
+    variables: ctx.graph.variables
+  };
+  const composed = await composeToMemory(below, ctx.values);
+  return composed.get(path)?.toString("utf8");
+}
+function buildPatchSidecar(path, base, desired) {
+  if (STRUCTURED2.test(path)) {
+    return stringifyYaml2({
+      op: "merge",
+      base: hashContent(base),
+      merge: generateMergePatch(parseStructured(path, base), parseStructured(path, desired))
+    });
+  }
+  return stringifyYaml2({
+    op: "patch",
+    base: hashContent(base),
+    baseContent: base,
+    patch: createPatch(path, base, desired, void 0, void 0, { context: 3 })
+  });
+}
+function rebaseline(ctx, graph, composed) {
+  const baseline = {};
+  const manifest = {};
+  for (const [path, data] of composed) {
+    baseline[path] = hashContent(data);
+    manifest[path] = {
+      owned: false,
+      fromLayer: ctx.manifest[path]?.fromLayer ?? ctx.srcDir
+    };
+  }
+  writeState(
+    ctx.destDir,
+    { lock: lockFromGraph(graph), answers: ctx.values, baseline, manifest },
+    graph.variables,
+    composed
+  );
+}
+async function extract(destDir, changes, options) {
+  if (changes.length === 0) throw new Error("extract: no changes given.");
+  const ctx = await loadContext(destDir);
+  const layerDir = resolvePath5(ctx.srcDir, options.as);
+  if (existsSync11(join13(layerDir, "treelay.json"))) {
+    throw new Error(`A layer already exists at ${layerDir}. Choose another path.`);
+  }
+  const name = options.name ?? layerDir.split("/").filter(Boolean).pop();
+  const tx = new LayerTransaction();
+  const written = [];
+  try {
+    tx.write(join13(layerDir, "treelay.json"), JSON.stringify({ name }, null, 2) + "\n");
+    for (const change of changes) {
+      if (change.kind === "deleted") {
+        const sidecar = change.path + SIDECAR_SUFFIX;
+        tx.write(join13(layerDir, sidecar), stringifyYaml2({ op: "delete" }));
+        written.push(sidecar);
+        continue;
+      }
+      tx.write(
+        join13(layerDir, change.path),
+        readFileSync11(join13(destDir, change.path), "utf8")
+      );
+      written.push(change.path);
+    }
+    if (options.asMixin) wireMixin(ctx, options.as, tx);
+  } catch (err) {
+    tx.rollback();
+    throw err;
+  }
+  const wired = options.asMixin === true;
+  const shouldVerify = wired && options.verify !== false;
+  let verified = false;
+  if (shouldVerify) {
+    const regraph = resolve(ctx.srcDir);
+    const removed = changes.filter((c) => c.kind === "deleted").map((c) => c.path);
+    const result = await roundTripVerify(destDir, regraph, ctx.values, {
+      expectAbsent: removed
+    });
+    if (!result.ok) {
+      tx.rollback();
+      throw new Error(
+        `Round-trip verification failed after extracting ${name} \u2014 rolled back (\xA78 guard 2):
+${describeMismatches(result.mismatches)}`
+      );
+    }
+    rebaseline(ctx, regraph, result.composed);
+    verified = true;
+  }
+  return { layer: layerDir, name, files: written.sort(), wired, verified };
+}
+function wireMixin(ctx, ref, tx) {
+  const manifestPath = join13(ctx.srcDir, "treelay.json");
+  if (!existsSync11(manifestPath)) {
+    throw new Error(
+      `Cannot wire the extracted layer in: ${ctx.srcDir} has no treelay.json. Extract without --mixin and add it by hand.`
+    );
+  }
+  const raw = readFileSync11(manifestPath, "utf8");
+  const manifest = JSON.parse(raw);
+  const mixins = [...manifest.mixins ?? [], ref];
+  tx.write(manifestPath, JSON.stringify({ ...manifest, mixins }, null, 2) + "\n");
+}
+var LayerTransaction = class {
+  undo = [];
+  write(path, content) {
+    const existed = existsSync11(path);
+    const previous = existed ? readFileSync11(path) : void 0;
+    mkdirSync3(dirname4(path), { recursive: true });
+    writeFileSync5(path, content);
+    this.undo.push(() => {
+      if (previous !== void 0) writeFileSync5(path, previous);
+      else rmSync5(path, { force: true });
+    });
+  }
+  remove(path) {
+    if (!existsSync11(path)) return;
+    const previous = readFileSync11(path);
+    rmSync5(path, { force: true });
+    this.undo.push(() => {
+      mkdirSync3(dirname4(path), { recursive: true });
+      writeFileSync5(path, previous);
+    });
+  }
+  rollback() {
+    for (const step of this.undo.reverse()) step();
+    this.undo = [];
+  }
+};
+
+export {
+  CycleError,
+  InconsistentHierarchyError,
+  MergeConflictError,
+  NotImplementedError,
+  c3Linearize,
+  loadManifest,
+  createEngine,
+  renderString,
+  templateTarget,
+  mergeVariableDecls,
+  resolveValues,
+  hashContent,
+  matchesHash,
+  hashTree,
+  InvalidRefError,
+  isLocalRef,
+  parseRef,
+  canonicalRef,
+  pinnedRef,
+  isCommitSha,
+  cacheRoot,
+  locationKey,
+  GitFetchError,
+  NpmResolveError,
+  LockMissingError,
+  IntegrityError,
+  fetchLayer,
+  verifyIntegrity,
+  liveRevision,
+  LOCKFILE_NAME,
+  LOCKFILE_VERSION,
+  emptyLock,
+  lockfilePath,
+  LockfileError,
+  readLock,
+  serializeLock,
+  writeLock,
+  locksEqual,
+  MountError,
+  resolve,
+  resolveRef,
+  MERGE_LABELS,
+  mergeText3,
+  applyPatch3Way,
+  isSidecar,
+  sidecarTarget,
+  parseSidecar,
+  desugarSuffix,
+  deepMerge,
+  applyMergePatch,
+  applyJsonPatch,
+  mergeStructured3,
+  defaultStrategy,
+  strategyFor,
+  ALWAYS_IGNORE,
+  SelfCompileError,
+  destExclusions,
+  mountTarget,
+  listLayerFiles,
+  classifyEntry,
+  enumerateLayer,
+  STATE_DIR,
+  statePaths,
+  sourceOf,
+  hasState,
+  writeState,
+  readBaselineFile,
+  readState,
+  composeFiles,
+  summarize,
+  compile,
+  hasDrift,
+  checkDrift,
+  formatDrift,
+  planUpdate,
+  update,
+  summarizeLayers,
+  explain,
+  explainFile,
+  explainDest,
+  formatExplanation,
+  blastRadius,
+  describeBlastRadius,
+  commonAncestor,
+  composeToMemory,
+  roundTripVerify,
+  describeMismatches,
+  status,
+  formatStatus,
+  promote,
+  extract
+};
+//# sourceMappingURL=chunk-QKQUPZVD.js.map