@ankurhalder/codebase-snapshot 3.0.0 → 4.0.1

package/dist/{chunk-5B4UVQLR.js → chunk-RGIMMEAW.js}

@@ -1,5 +1,6 @@
 import * as crypto from 'crypto';
 import * as fs9 from 'fs';
+import * as os from 'os';
 import * as path10 from 'path';
 import ts from 'typescript';
 import { pathToFileURL } from 'url';
@@ -547,14 +548,42 @@ function summarizeTypeScriptSource(relativePath, content) {
     const modifiers = ts.canHaveModifiers(node) ? ts.getModifiers(node) : void 0;
     return Boolean(modifiers?.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword));
   };
-  const recordFunctionLike = (name, exported) => {
+  const rendersJsx = (node) => {
+    const pending = [node];
+    while (pending.length > 0) {
+      const current = pending.pop();
+      if (ts.isJsxElement(current) || ts.isJsxSelfClosingElement(current) || ts.isJsxFragment(current)) {
+        return true;
+      }
+      if (ts.isCallExpression(current)) {
+        const callee = current.expression;
+        const calleeName = ts.isIdentifier(callee) ? callee.text : ts.isPropertyAccessExpression(callee) ? callee.name.text : "";
+        if (calleeName === "createElement") return true;
+      }
+      ts.forEachChild(current, (child) => {
+        pending.push(child);
+      });
+    }
+    return false;
+  };
+  const REACT_BASE_CLASS = /(?:^|\.)(?:PureComponent|Component)$/;
+  const extendsReactBase = (node) => {
+    const heritage = (node.heritageClauses ?? []).find(
+      (clause) => clause.token === ts.SyntaxKind.ExtendsKeyword
+    );
+    const expression = heritage?.types[0]?.expression;
+    if (!expression) return false;
+    const text2 = ts.isIdentifier(expression) ? expression.text : expression.getText(sourceFile);
+    return REACT_BASE_CLASS.test(text2);
+  };
+  const recordFunctionLike = (name, exported, node) => {
     summary.functions.push(name);
     if (exported) {
       summary.exports.push(name);
       if (ROUTE_HANDLER_NAMES.has(name)) summary.routeHandlers.push(name);
     }
     if (/^use[A-Z0-9]/.test(name)) summary.hooks.push(name);
-    if (/^[A-Z]/.test(name)) summary.reactComponents.push(name);
+    if (/^[A-Z]/.test(name) && rendersJsx(node)) summary.reactComponents.push(name);
   };
   const stack = [sourceFile];
   while (stack.length > 0) {
@@ -583,7 +612,7 @@ function summarizeTypeScriptSource(relativePath, content) {
     if (ts.isFunctionDeclaration(node)) {
       const exported = isExported(node);
       if (node.name) {
-        recordFunctionLike(node.name.text, exported);
+        recordFunctionLike(node.name.text, exported, node);
         if (isDefault(node)) summary.exports.push("default");
       } else if (isDefault(node)) {
         summary.exports.push("default");
@@ -594,7 +623,9 @@ function summarizeTypeScriptSource(relativePath, content) {
         summary.classes.push(node.name.text);
         if (isExported(node)) summary.exports.push(node.name.text);
         if (isDefault(node)) summary.exports.push("default");
-        if (/^[A-Z]/.test(node.name.text)) summary.reactComponents.push(node.name.text);
+        if (/^[A-Z]/.test(node.name.text) && (extendsReactBase(node) || rendersJsx(node))) {
+          summary.reactComponents.push(node.name.text);
+        }
       } else if (isDefault(node)) {
         summary.exports.push("default");
       }
@@ -622,7 +653,9 @@ function summarizeTypeScriptSource(relativePath, content) {
           if (ROUTE_HANDLER_NAMES.has(name)) summary.routeHandlers.push(name);
         }
         if (/^use[A-Z0-9]/.test(name)) summary.hooks.push(name);
-        if (/^[A-Z]/.test(name)) summary.reactComponents.push(name);
+        if (/^[A-Z]/.test(name) && declaration.initializer !== void 0 && rendersJsx(declaration.initializer)) {
+          summary.reactComponents.push(name);
+        }
       }
     }
     const children = [];
@@ -1676,6 +1709,416 @@ function toDetected(preset) {
 function detectPreset(cwd, forced) {
   return detectPresetFromContext(buildPresetContext(cwd), forced);
 }
+
+// src/security/patterns.ts
+var STRONG_CREDENTIAL_NAME = "(?:password|passwd|passphrase|pwd|api[_-]?key|api[_-]?secret|secret[_-]?access[_-]?key|secret[_-]?key|client[_-]?secret[_-]?key|client[_-]?secret|private[_-]?key|aws[_-]?secret[_-]?access[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|session[_-]?token|secret|token)";
+var WEAK_CREDENTIAL_NAME = "(?:pass|id[_-]?token|credentials?)";
+var NOT_A_LITERAL_VALUE = "(?!(?:string|number|boolean|bigint|symbol|unknown|any|never|void|null|undefined|true|false|process\\.env|Buffer|Record|object)\\b)";
+var UNQUOTED_LITERAL = "(?![0-9]+(?![A-Za-z0-9_+=/.-]))([A-Za-z0-9_+=/-]{1,512})(?![A-Za-z0-9_+=/.-]|\\()";
+var UNQUOTED_AMBIGUOUS_LITERAL = "(?![0-9]+(?![A-Za-z0-9_+=/.-]))([A-Za-z0-9_+=/-]{8,512})(?![A-Za-z0-9_+=/.-]|\\()";
+var UNQUOTED_STRONG_NAME = `(?<!id[-_])${STRONG_CREDENTIAL_NAME}`;
+var DEFAULT_SECRET_PATTERNS = [
+  {
+    rule: "private-key-header",
+    pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----|-----BEGIN (?:RSA |OPENSSH |EC |PGP |DSA |ENCRYPTED )?PRIVATE KEY-----/
+  },
+  {
+    rule: "jwt-token",
+    pattern: /eyJ[A-Za-z0-9_-]{10,1024}\.eyJ[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,1024}/
+  },
+  {
+    rule: "aws-access-key-id",
+    pattern: /(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[0-9A-Z]{16}/
+  },
+  {
+    // The name is no longer limited to the three snake_case spellings: an
+    // `awsSecret` / `secretAccessKey` property leaked verbatim because only the
+    // literal words matched. The value is masked alone, so the key survives.
+    rule: "aws-secret-access-key",
+    pattern: new RegExp(
+      `${STRONG_CREDENTIAL_NAME}["']?\\s{0,8}[:=]\\s{0,8}["']?([A-Za-z0-9/+=]{40})["']?`,
+      "i"
+    ),
+    valueGroup: 1
+  },
+  {
+    // A 40-character base64 value with no key name in sight. A key-independent
+    // rule is the only thing that catches `new AWS.SecretKey(…)` arguments and
+    // pasted `~/.aws/credentials` fragments, but a bare length test also matches
+    // every 40-char git SHA-1, so the value must mix case and digits and must
+    // not be pure hex.
+    rule: "aws-secret-access-key-value",
+    pattern: /(?<![A-Za-z0-9/+=])(?![0-9a-fA-F]{40}(?![A-Za-z0-9/+=]))(?=[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=]))(?=[A-Za-z0-9/+=]{0,39}[A-Z])(?=[A-Za-z0-9/+=]{0,39}[a-z])(?=[A-Za-z0-9/+=]{0,39}[0-9])[A-Za-z0-9/+=]{40}/
+  },
+  {
+    rule: "github-token",
+    pattern: /gh[pousr]_[A-Za-z0-9]{36,251}|github_pat_[A-Za-z0-9_]{22,251}|ghs_[A-Za-z0-9]{36,251}/
+  },
+  {
+    // `xoxc-`/`xoxd-` are the user and refresh tokens, `xoxb`/`xoxp` the bot and
+    // user tokens; the whole Slack family shares one prefix shape.
+    rule: "slack-token",
+    pattern: /xox[baprsdc]-[0-9A-Za-z-]{10,250}/
+  },
+  {
+    // Prefix-only vendors. Each prefix below is documented, globally unique and
+    // cannot collide with an ordinary identifier, which is what makes a bare
+    // prefix rule cheap and safe: `glpat-` (GitLab), `hvs.`/`s.` (Vault service
+    // and batch tokens), `whsec_` (Stripe webhook secret), `dckr_pat_` (Docker
+    // Hub), `hf_` (HuggingFace), `ya29.` (Google OAuth access token).
+    rule: "known-vendor-token-prefix",
+    pattern: /\b(?:glpat-[A-Za-z0-9_-]{20,64}|hvs\.[A-Za-z0-9_-]{20,128}|s\.[A-Za-z0-9]{20,64}|whsec_[A-Za-z0-9]{20,64}|dckr_pat_[A-Za-z0-9_-]{20,64}|hf_[A-Za-z0-9]{30,64}|ya29\.[A-Za-z0-9_-]{20,128})/
+  },
+  {
+    rule: "slack-webhook-url",
+    pattern: /hooks\.slack\.com\/services\/T[A-Z0-9]{6,12}\/B[A-Z0-9]{6,12}\/[A-Za-z0-9]{20,32}/
+  },
+  {
+    rule: "stripe-secret-key",
+    pattern: /[sr]k_live_[0-9a-zA-Z]{20,247}/
+  },
+  {
+    rule: "google-api-key",
+    pattern: /AIza[0-9A-Za-z_-]{35}/
+  },
+  {
+    rule: "google-oauth-client-secret",
+    pattern: /GOCSPX-[A-Za-z0-9_-]{20,64}/
+  },
+  {
+    rule: "openai-anthropic-key",
+    pattern: /\bsk-(?:ant-[a-z0-9]+-|proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}_?[A-Za-z0-9_-]{0,20}\b/
+  },
+  {
+    rule: "npm-token",
+    pattern: /npm_[A-Za-z0-9]{36}/
+  },
+  {
+    rule: "pypi-token",
+    pattern: /pypi-[A-Za-z0-9_-]{50,180}/
+  },
+  {
+    rule: "sendgrid-key",
+    pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/
+  },
+  {
+    rule: "twilio-api-key",
+    pattern: /SK[0-9a-fA-F]{32}/
+  },
+  {
+    rule: "digitalocean-token",
+    pattern: /dop_v1_[0-9a-f]{64}/
+  },
+  {
+    rule: "azure-storage-account-key",
+    pattern: /AccountKey=[A-Za-z0-9+/=]{80,100}/
+  },
+  {
+    // Scheme-less userinfo: `//user:password@host`.
+    //
+    // Enumerating schemes is a losing game — `mysqlx`, `svn`, `telnet`, `imap`,
+    // `pop3`, `nntp`, `kafka`, `elasticsearch` each leaked a password while the
+    // list grew by hand. This rule matches the shape instead, so any scheme
+    // (including one invented tomorrow) is covered, provided the `//` is followed
+    // immediately by the userinfo: `// see the docs` and a bare reminder comment
+    // never match, because a space or the comment wording breaks the shape.
+    rule: "uri-credentials",
+    pattern: /\/\/[^\s:/@"'`;()<>,]{1,128}:[^\s:/@"'`;()<>,]{1,256}@[^\s/"'`;()<>,]{1,256}/
+  },
+  {
+    // The host tail stops at quotes, `;`, `)`, `<`, `>` and `,`: an unbounded
+    // `[^\s/]` used to swallow the closing quote and the statement separator of
+    // the string the URL was written in.
+    rule: "database-uri-credentials",
+    pattern: /(?:mongodb(?:\+srv)?|postgres(?:ql)?|mysql|maria(?:db)?|redis(?:s)?|amqp(?:s)?|clickhouse|mssql|sqlserver|oracle):\/\/[^\s:@/"'`;()<>,]{1,128}:[^\s@/"'`;()<>,]{1,256}@[^\s/"'`;()<>,]{1,256}/
+  },
+  {
+    rule: "basic-auth-url",
+    pattern: /(?:https?|ftp|sftp|ssh|git|smtp|smtps|ldap|ldaps):\/\/[^\s:@/"'`;()<>,]{1,128}:[^\s@/"'`;()<>,]{1,256}@[^\s/"'`;()<>,]{1,256}/i
+  },
+  {
+    // Quoted credentials in any common key spelling. The value may be as short
+    // as one character: `password: "hunter2"` is a credential whatever its
+    // entropy, and a length floor was exactly how it survived into `parts`.
+    //
+    // The key is either bare (`dbPassword:`) or wholly quoted (`"dbPassword":`).
+    // There is deliberately no optional quote *before* the separator: that let a
+    // previous string's closing quote stand in for the key's, so
+    // ``${pass ? "  PASS" : "  FAIL"}`` had `"  FAIL"` masked as if `PASS` were
+    // the key name.
+    rule: "credential-assignment",
+    pattern: new RegExp(
+      `(?:["']${STRONG_CREDENTIAL_NAME}["']|${STRONG_CREDENTIAL_NAME})\\s{0,8}[:=]\\s{0,8}(["'\`])([^"'\`\\n]{1,512})\\1`,
+      "i"
+    ),
+    valueGroup: 2
+  },
+  {
+    // `pass`, `id-token` and `credentials` are ambiguous on their own, so they
+    // are accepted only against a quoted value long enough to be a credential.
+    rule: "credential-assignment-weak",
+    pattern: new RegExp(
+      `(?:["']${WEAK_CREDENTIAL_NAME}["']|${WEAK_CREDENTIAL_NAME})\\s{0,8}[:=]\\s{0,8}(["'\`])([^"'\`\\n]{8,512})\\1`,
+      "i"
+    ),
+    valueGroup: 2
+  },
+  {
+    // The unquoted twin for YAML, docker-compose and `.env`: those formats never
+    // quote their values, so the rules above cannot see them. `valueGroup` keeps
+    // `POSTGRES_PASSWORD:` in the output.
+    rule: "credential-assignment-unquoted",
+    pattern: new RegExp(
+      `${UNQUOTED_STRONG_NAME}\\s{0,8}[:=]\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_LITERAL}`,
+      "i"
+    ),
+    valueGroup: 1
+  },
+  {
+    // `pass: hunter2hunter2` and `credentials: hunter2hunter2`: the ambiguous
+    // names, unquoted, with the length and non-digit floor that keeps
+    // `pass: 3` / `credentials: none` readable.
+    rule: "credential-assignment-unquoted-weak",
+    pattern: new RegExp(
+      `${WEAK_CREDENTIAL_NAME}\\s{0,8}[:=]\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_AMBIGUOUS_LITERAL}`,
+      "i"
+    ),
+    valueGroup: 1
+  },
+  {
+    // `Authorization: Bearer <token>` and `Authorization: Basic <base64>`.
+    //
+    // The scheme is consumed by a lookbehind so the match is the token alone and
+    // needs no `valueGroup`. A lone `Bearer`/`Basic`, and a word after it that
+    // cannot be a credential (`Bearer authentication`), stay readable: the value
+    // must contain a digit, be at least 32 chars, or carry base64 `=` padding.
+    rule: "authorization-header",
+    pattern: /(?<=(?:Bearer|Basic)\s{1,8})(?:[A-Za-z0-9_.+/-]{0,31}[0-9][A-Za-z0-9_.+/-]{0,1024}|[A-Za-z0-9_.+/-]{32,1024}|[A-Za-z0-9_.+/-]{8,1024}={1,2})(?![A-Za-z0-9_.+/=-])/
+  },
+  {
+    // Broader names than before (`apiKey`, `clientSecret`, `privateKey` were
+    // invisible to it) and value-only masking. Kept alongside the two rules
+    // above because it also matches a *quoted key* followed by an unquoted
+    // value, e.g. `"client_secret": abc123`.
+    rule: "generic-secret-assignment",
+    pattern: /(?:api[_-]?key|secret[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?token|refresh[_-]?token|private[_-]?key|password|passwd|pwd)["']?\s*[:=]\s*["']([^"'\s]{8,256})["']/i,
+    valueGroup: 1
+  },
+  {
+    // Covers `.env` / shell assignment syntax, which never quotes its values and
+    // was therefore invisible to the rule above. Anchored to the line start and
+    // limited to secret-looking names to stay at zero false positives.
+    //
+    // The name is matched with BOUNDED quantifiers on purpose: an unbounded
+    // `[A-Za-z0-9_]*` on both sides of the keyword alternation backtracks at
+    // every offset of a long identifier, which made this rule quadratic
+    // (measured 5.6 s for a single 240 KB line before bounding).
+    // The value is matched on its own — `=\s*(value)` — and masked alone.
+    // Anchoring the value to end-of-line (`[^\s#]{6,512}$`) meant ANY trailing
+    // comment or space disabled the rule, so `TOKEN=secret # rotate` and
+    // `TOKEN=secret   ` were emitted in clear; a CRLF file disabled it wholesale.
+    rule: "env-secret-assignment",
+    pattern: /^\s{0,64}(?:export\s{1,8})?[A-Za-z0-9_]{0,96}(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|CREDENTIAL)[A-Za-z0-9_]{0,96}\s{0,8}=\s{0,8}(?!["'`$<{[\]\s])([^\s#;"'`)]{1,512})/i,
+    valueGroup: 1
+  }
+];
+var PEM_BLOCK_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/g;
+var PEM_UNTERMINATED_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:\r?\n[A-Za-z0-9+/=]{4,}[ A-Za-z0-9+/=]*)+/g;
+
+// src/security/redact.ts
+var REDACTION_MARKER = "[REDACTED: potential secret-like value omitted from snapshot]";
+var PEM_REDACTION_MARKER = "[REDACTED: private key block omitted from snapshot]";
+function describeValue(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "an array";
+  if (value instanceof RegExp) return value.toString();
+  if (typeof value === "string") return `the string ${JSON.stringify(value)}`;
+  return `a ${typeof value}`;
+}
+function compilePattern(rule, pattern, valueGroup) {
+  if (pattern instanceof RegExp) {
+    const flags = new Set(pattern.flags.replace(/[gy]/g, "").split(""));
+    if (valueGroup !== void 0) flags.add("d");
+    return {
+      rule,
+      pattern: new RegExp(pattern.source, [...flags].join("")),
+      ...valueGroup === void 0 ? {} : { valueGroup }
+    };
+  }
+  if (typeof pattern === "string") {
+    try {
+      return {
+        rule,
+        pattern: new RegExp(pattern, valueGroup === void 0 ? "i" : "id"),
+        ...valueGroup === void 0 ? {} : { valueGroup }
+      };
+    } catch (err) {
+      throw new Error(
+        `Invalid regular expression for secret rule "${rule}": ${err.message}`
+      );
+    }
+  }
+  throw new Error(
+    `Secret rule "${rule}" has a pattern that is neither a RegExp nor a string (received ${describeValue(pattern)}).`
+  );
+}
+function compileSecretRules(rules) {
+  if (!Array.isArray(rules)) {
+    throw new Error(
+      `secrets.customPatterns must be an array of secret rules (received ${describeValue(rules)}).`
+    );
+  }
+  let generated = 0;
+  return rules.map((entry, index) => {
+    const where = `secrets.customPatterns[${index}]`;
+    if (entry instanceof RegExp) {
+      generated += 1;
+      return compilePattern(`custom-${generated}`, entry, void 0);
+    }
+    if (typeof entry === "string") {
+      generated += 1;
+      return compilePattern(`custom-${generated}`, entry, void 0);
+    }
+    if (typeof entry === "object" && entry !== null) {
+      const candidate = entry;
+      if (typeof candidate.rule !== "string" || candidate.rule.trim() === "") {
+        throw new Error(
+          `${where} is missing \`rule\` (received keys: ${Object.keys(candidate).join(", ") || "none"}). A named rule is { rule: "corp-token", pattern: /CORP-[A-Z0-9]{8}/ }, or pass the RegExp itself.`
+        );
+      }
+      const valueGroup = candidate.valueGroup;
+      if (valueGroup !== void 0) {
+        if (typeof valueGroup !== "number" || !Number.isInteger(valueGroup) || valueGroup < 0) {
+          throw new Error(
+            `${where}.valueGroup must be a non-negative integer capture-group index (received ${describeValue(valueGroup)}).`
+          );
+        }
+      }
+      if (candidate.pattern === void 0) {
+        throw new Error(
+          `${where} (rule "${candidate.rule}") is missing \`pattern\`. Expected { rule, pattern: RegExp | string }.`
+        );
+      }
+      return compilePattern(
+        candidate.rule,
+        candidate.pattern,
+        valueGroup
+      );
+    }
+    throw new Error(
+      `${where} must be a RegExp, a string, or { rule, pattern } (received ${describeValue(entry)}).`
+    );
+  });
+}
+function toGlobal(rule) {
+  const flags = new Set(rule.pattern.flags.replace(/[gy]/g, "").split(""));
+  flags.add("g");
+  if (rule.valueGroup !== void 0) flags.add("d");
+  return new RegExp(rule.pattern.source, [...flags].join(""));
+}
+var LINE_BREAK = /(\r\n|\n|\r)/;
+function scanAndRedactSecrets(content, rules, filePath) {
+  const findings = [];
+  let redacted = content;
+  for (const blockPattern of [PEM_BLOCK_PATTERN, PEM_UNTERMINATED_PATTERN]) {
+    blockPattern.lastIndex = 0;
+    let match;
+    while ((match = blockPattern.exec(redacted)) !== null) {
+      if (match[0].length === 0) {
+        blockPattern.lastIndex += 1;
+        continue;
+      }
+      const line = redacted.slice(0, match.index).split("\n").length;
+      const newlines = (match[0].match(/\n/g) ?? []).length;
+      findings.push({ rule: "private-key-block", line, path: filePath });
+      redacted = redacted.slice(0, match.index) + PEM_REDACTION_MARKER + "\n".repeat(newlines) + redacted.slice(match.index + match[0].length);
+      blockPattern.lastIndex = match.index + PEM_REDACTION_MARKER.length + newlines;
+    }
+  }
+  const compiled = rules.map((rule) => ({
+    rule: rule.rule,
+    pattern: toGlobal(rule),
+    ...rule.valueGroup === void 0 ? {} : { valueGroup: rule.valueGroup }
+  }));
+  const segments = redacted.split(LINE_BREAK);
+  let lineNumber = 1;
+  for (let index = 0; index < segments.length; index += 2) {
+    const line = segments[index];
+    if (line.length > 0) {
+      const spans = [];
+      const matchedRules = /* @__PURE__ */ new Set();
+      for (const { rule, pattern, valueGroup } of compiled) {
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(line)) !== null) {
+          if (match[0].length === 0) {
+            pattern.lastIndex += 1;
+            continue;
+          }
+          const group = valueGroup === void 0 ? void 0 : match.indices?.[valueGroup];
+          spans.push(
+            group ? { start: group[0], end: group[1], rule } : { start: match.index, end: match.index + match[0].length, rule }
+          );
+          matchedRules.add(rule);
+        }
+      }
+      if (spans.length > 0) {
+        for (const rule of matchedRules) {
+          findings.push({ rule, line: lineNumber, path: filePath });
+        }
+        segments[index] = applySpans(line, spans);
+      }
+    }
+    if (index + 1 < segments.length) lineNumber += 1;
+  }
+  return { redacted: segments.join(""), findings };
+}
+var TOKEN_CHARS_LEFT = /[A-Za-z0-9_+/-]/;
+var TOKEN_CHARS_RIGHT = /[A-Za-z0-9_+/=-]/;
+function expandOverToken(line, start, end) {
+  let left = start;
+  let right = end;
+  while (left > 0 && TOKEN_CHARS_LEFT.test(line[left - 1])) left -= 1;
+  while (right < line.length && TOKEN_CHARS_RIGHT.test(line[right])) right += 1;
+  return { start: left, end: right };
+}
+function applySpans(line, spans) {
+  const ordered = [...spans].sort((a, b) => a.start - b.start || a.end - b.end);
+  const merged = [];
+  for (const span of ordered) {
+    const clampedStart = Math.max(0, Math.min(span.start, line.length));
+    const clampedEnd = Math.max(clampedStart, Math.min(span.end, line.length));
+    const { start, end } = expandOverToken(line, clampedStart, clampedEnd);
+    const last = merged[merged.length - 1];
+    if (last && start <= last.end) last.end = Math.max(last.end, end);
+    else merged.push({ start, end });
+  }
+  let out = "";
+  let cursor = 0;
+  for (const span of merged) {
+    out += line.slice(cursor, span.start);
+    out += REDACTION_MARKER;
+    cursor = span.end;
+  }
+  out += line.slice(cursor);
+  return out;
+}
+
+// src/scanner/files.ts
+var PRESET_IGNORES = new Set(
+  PRESETS.flatMap((preset) => preset.exclude ?? [])
+);
+function readLinkTarget(linkPath, fallback) {
+  try {
+    return fs9.readlinkSync(linkPath);
+  } catch {
+    return fallback;
+  }
+}
+function isInside(root, candidate) {
+  const relative4 = path10.relative(root, candidate);
+  return relative4 === "" || !relative4.startsWith(`..${path10.sep}`) && relative4 !== ".." && !path10.isAbsolute(relative4);
+}
 function getGitInfo(cwd, fallbackBranch = "main") {
   try {
     const reported = childProcess.execSync("git rev-parse --abbrev-ref HEAD", {
@@ -1720,20 +2163,79 @@ var DEFAULT_IGNORED_FILES = [
   "bun.lockb",
   "composer.lock"
 ];
-var SENSITIVE_BASENAME = /^(?:\.env(?:[._-][A-Za-z0-9_-]*)*|\.env(?:backup|bak|old|orig|copy|save)|\.envrc|\.npmrc(?:\.[A-Za-z0-9_-]+)?|\.yarnrc(?:\.yml)?|\.netrc(?:\.[A-Za-z0-9_-]+)?|\.git-credentials|\.htpasswd|\.pgpass|id_[a-z0-9_]+(?:\.[A-Za-z0-9_-]+)?|credentials(?:\.json)?|service[-_]?account(?:\.[a-z0-9_-]+)*\.json|secrets?\.(?:json|ya?ml))$/i;
+var SENSITIVE_BASENAME = /^(?:\.env(?:[._-][A-Za-z0-9_-]*)*|\.env(?:backup|bak|old|orig|copy|save)|\.envrc|\.npmrc(?:\.[A-Za-z0-9_-]+)?|\.yarnrc(?:\.yml)?|\.netrc(?:\.[A-Za-z0-9_-]+)?|\.git-credentials|\.htpasswd|\.pgpass|\.vault-token|vault[-_]agent[-_]token|id_[a-z0-9_]+(?:\.[A-Za-z0-9_-]+)?|credentials(?:\.(?:json|ya?ml|toml))?|service[-_]?account(?:\.[a-z0-9_-]+)*\.json|secrets?\.(?:json|ya?ml|toml)|env|[A-Za-z0-9_-]{1,64}\.env)$/i;
 var SENSITIVE_PATH = /(?:^|\/)\.(?:aws|ssh|gnupg)\/|(?:^|\/)\.docker\/config\.json$|(?:^|\/)\.kube\/config$/i;
 var SENSITIVE_EXT = /\.(?:pem|key|p12|pfx|jks|keystore|ppk|asc|kdbx|tfstate|tfvars)$/i;
 var TEMPLATE_SUFFIX = /\.(?:example|sample|template|dist)(?=$|[.])/i;
+var BACKUP_SUFFIX = /(?:~|\.(?:bak|backup|old|orig|save|copy|swp|swo|tmp|part))$/i;
+function normaliseName(name) {
+  let normalised = name.trim().replace(/[. ]+$/, "");
+  let previous = "";
+  while (previous !== normalised) {
+    previous = normalised;
+    normalised = normalised.replace(BACKUP_SUFFIX, "");
+  }
+  return normalised;
+}
 var matchesSensitiveList = (posixPath, base) => SENSITIVE_BASENAME.test(base) || SENSITIVE_PATH.test(posixPath) || SENSITIVE_EXT.test(base);
 function isSensitivePath(relativePath) {
   const posixPath = relativePath.replace(/\\/g, "/");
-  const base = posixPath.split("/").pop() ?? posixPath;
+  const raw = posixPath.split("/").pop() ?? posixPath;
+  const base = normaliseName(raw);
   if (TEMPLATE_SUFFIX.test(base)) {
     const stripped = base.replace(new RegExp(TEMPLATE_SUFFIX.source, "gi"), "");
     if (matchesSensitiveList(posixPath, stripped)) return false;
   }
   return matchesSensitiveList(posixPath, base);
 }
+var activeSecretRules = null;
+function setActiveSecretRules(rules) {
+  activeSecretRules = rules === null ? null : [...rules];
+}
+function pathScanRules(extraRules) {
+  const fallback = extraRules ?? activeSecretRules ?? [];
+  return [...DEFAULT_SECRET_PATTERNS, ...fallback];
+}
+function findSecretInPath(relativePath, extraRules) {
+  const posixPath = relativePath.replace(/\\/g, "/");
+  const spans = [];
+  const rules = [];
+  for (const { rule, pattern } of pathScanRules(extraRules)) {
+    const scan = new RegExp(pattern.source, `${pattern.flags.replace(/[gy]/g, "")}g`);
+    let match;
+    while ((match = scan.exec(posixPath)) !== null) {
+      if (match[0].length === 0) {
+        scan.lastIndex += 1;
+        continue;
+      }
+      spans.push({ start: match.index, end: match.index + match[0].length });
+      if (!rules.includes(rule)) rules.push(rule);
+    }
+  }
+  if (spans.length === 0) return null;
+  spans.sort((a, b) => a.start - b.start || a.end - b.end);
+  const merged = [];
+  for (const span of spans) {
+    const last = merged[merged.length - 1];
+    if (last && span.start <= last.end) last.end = Math.max(last.end, span.end);
+    else merged.push({ start: span.start, end: span.end });
+  }
+  let out = "";
+  let cursor = 0;
+  for (const span of merged) {
+    out += posixPath.slice(cursor, span.start);
+    out += REDACTION_MARKER;
+    cursor = span.end;
+  }
+  out += posixPath.slice(cursor);
+  return { rules, masked: out };
+}
+function maskSkipPaths(records, extraRules) {
+  return records.map((record) => {
+    const hit = findSecretInPath(record.path, extraRules);
+    return hit ? { ...record, path: hit.masked } : record;
+  });
+}
 function globToRegExp(glob) {
   const normalized = glob.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
   const anchored = normalized.startsWith("/");
@@ -1854,49 +2356,178 @@ function defaultIgnoreReason(relativePath) {
   }
   return null;
 }
-function collectFiles(cwd, options = {}) {
-  const includePatterns = options.includePatterns ?? [];
-  const excludePatterns = options.excludePatterns ?? [];
-  const includeSensitiveFiles = options.includeSensitiveFiles ?? false;
-  let candidates;
-  let walkSkips = [];
+function listIgnoredPaths(cwd) {
   try {
     const stdout = childProcess.execSync(
-      "git ls-files -z --cached --others --exclude-standard",
+      "git ls-files -z --others --ignored --exclude-standard --directory",
       {
         cwd,
         stdio: ["ignore", "pipe", "ignore"],
         encoding: "utf8",
-        maxBuffer: 50 * 1024 * 1024
+        maxBuffer: 32 * 1024 * 1024
       }
     );
-    candidates = stdout.split("\0").filter((entry) => entry.length > 0).map((entry) => entry.replace(/\\/g, "/"));
+    return stdout.split("\0").filter((entry) => entry.length > 0).map((entry) => entry.replace(/\\/g, "/"));
   } catch {
-    const walked = walkDirectory(cwd, cwd, /* @__PURE__ */ new Set());
-    candidates = walked.files;
-    walkSkips = walked.skipped;
+    return [];
   }
-  const skipped = [...walkSkips];
-  const files = candidates.filter((file) => {
-    const ignored = defaultIgnoreReason(file);
-    if (ignored) {
-      skipped.push({ path: file, reason: "default-ignore", detail: ignored });
-      return false;
-    }
-    if (includePatterns.length > 0 && !includePatterns.some((pattern) => matchesExclude(file, pattern))) {
-      skipped.push({
-        path: file,
-        reason: "excluded",
+}
+var TOOL_OWNED_DIR_NAMES = /* @__PURE__ */ new Set(["snapshot", "snapshot.tmp"]);
+function isToolOwnedDirName(name) {
+  return TOOL_OWNED_DIR_NAMES.has(name) || name.startsWith("snapshot.backup-");
+}
+function hasSnapshotMarker(target) {
+  try {
+    return fs9.statSync(target).isDirectory() && fs9.existsSync(path10.join(target, ".codebase-snapshot"));
+  } catch {
+    return false;
+  }
+}
+function makeToolOwnedDecider(cwd) {
+  const markers = /* @__PURE__ */ new Map();
+  return (relativePath) => {
+    const parts = relativePath.replace(/\\/g, "/").split("/");
+    for (let depth = 1; depth < parts.length; depth += 1) {
+      const prefix = parts.slice(0, depth).join("/");
+      if (depth === 1 && isToolOwnedDirName(prefix)) return true;
+      let hasMarker = markers.get(prefix);
+      if (hasMarker === void 0) {
+        hasMarker = fs9.existsSync(path10.join(cwd, prefix, ".codebase-snapshot"));
+        markers.set(prefix, hasMarker);
+      }
+      if (hasMarker) return true;
+    }
+    return false;
+  };
+}
+function makeLinkProbe() {
+  const cache = /* @__PURE__ */ new Map();
+  return (absolutePath) => {
+    let known = cache.get(absolutePath);
+    if (known === void 0) {
+      try {
+        known = fs9.lstatSync(absolutePath).isSymbolicLink();
+      } catch {
+        known = false;
+      }
+      cache.set(absolutePath, known);
+    }
+    return known;
+  };
+}
+function dropLinkedDirectories(cwd, candidates, skipped) {
+  const isLink = makeLinkProbe();
+  let rootReal = cwd;
+  try {
+    rootReal = fs9.realpathSync(cwd);
+  } catch {
+  }
+  const reported = /* @__PURE__ */ new Set();
+  const kept = [];
+  for (const candidate of candidates) {
+    const parts = candidate.split("/");
+    let linkedDir = null;
+    for (let depth = 1; depth <= parts.length; depth += 1) {
+      const prefix = parts.slice(0, depth).join("/");
+      if (isLink(path10.join(cwd, prefix))) {
+        linkedDir = prefix;
+        break;
+      }
+    }
+    if (linkedDir === null) {
+      kept.push(candidate);
+      continue;
+    }
+    if (reported.has(linkedDir)) continue;
+    reported.add(linkedDir);
+    const absolute = path10.join(cwd, linkedDir);
+    let targetReal = absolute;
+    try {
+      targetReal = fs9.realpathSync(absolute);
+    } catch {
+    }
+    const target = readLinkTarget(absolute, targetReal);
+    const what = linkedDir === candidate ? "symbolic link" : "directory link";
+    skipped.push(
+      isInside(rootReal, targetReal) ? {
+        path: linkedDir,
+        reason: "symlink",
+        detail: `${what} not followed (target: ${target})`
+      } : {
+        path: linkedDir,
+        reason: "outside-root",
+        detail: `link target resolves outside the scanned root (target: ${target}); not followed`
+      }
+    );
+  }
+  return kept;
+}
+function collectFiles(cwd, options = {}) {
+  const includePatterns = options.includePatterns ?? [];
+  const excludePatterns = options.excludePatterns ?? [];
+  const includeSensitiveFiles = options.includeSensitiveFiles ?? false;
+  const pathRules = options.secretRules;
+  const isToolOwned = makeToolOwnedDecider(cwd);
+  let candidates;
+  const skipped = [];
+  try {
+    const stdout = childProcess.execSync(
+      "git ls-files -z --cached --others --exclude-standard",
+      {
+        cwd,
+        stdio: ["ignore", "pipe", "ignore"],
+        encoding: "utf8",
+        maxBuffer: 50 * 1024 * 1024
+      }
+    );
+    candidates = stdout.split("\0").filter((entry) => entry.length > 0).map((entry) => entry.replace(/\\/g, "/"));
+    candidates = dropLinkedDirectories(cwd, candidates, skipped);
+    const known = new Set(candidates);
+    for (const ignoredPath of listIgnoredPaths(cwd)) {
+      const trimmed = ignoredPath.replace(/\/+$/, "");
+      if (known.has(trimmed) || known.has(ignoredPath)) continue;
+      if (isToolOwned(trimmed)) continue;
+      if (isSensitivePath(trimmed)) {
+        skipped.push({
+          path: trimmed,
+          reason: "sensitive-file",
+          detail: "credential-bearing file, ignored by .gitignore; enable includeSensitiveFiles to emit it"
+        });
+      } else {
+        skipped.push({
+          path: trimmed,
+          reason: "gitignore",
+          detail: ignoredPath.endsWith("/") ? "ignored by .gitignore (directory, not descended)" : "ignored by .gitignore"
+        });
+      }
+    }
+  } catch {
+    const walked = walkDirectory(cwd, cwd, rootRealFor(cwd), /* @__PURE__ */ new Set(), true);
+    candidates = walked.files;
+    skipped.push(...walked.skipped);
+  }
+  const files = candidates.filter((file) => {
+    if (isToolOwned(file)) return false;
+    const ignored = defaultIgnoreReason(file);
+    if (ignored) {
+      skipped.push({ path: file, reason: "default-ignore", detail: ignored });
+      return false;
+    }
+    if (includePatterns.length > 0 && !includePatterns.some((pattern) => matchesExclude(file, pattern))) {
+      skipped.push({
+        path: file,
+        reason: "excluded",
         detail: `does not match any include pattern (${includePatterns.join(", ")})`
       });
       return false;
     }
     for (const pattern of excludePatterns) {
       if (matchesExclude(file, pattern)) {
+        const fromPreset = PRESET_IGNORES.has(pattern);
         skipped.push({
           path: file,
-          reason: "excluded",
-          detail: `matches exclude pattern "${pattern}"`
+          reason: fromPreset ? "default-ignore" : "excluded",
+          detail: fromPreset ? `preset ignore: "${pattern}"` : `matches exclude pattern "${pattern}"`
         });
         return false;
       }
@@ -1909,56 +2540,119 @@ function collectFiles(cwd, options = {}) {
       });
       return false;
     }
+    const secret = findSecretInPath(file, pathRules);
+    if (secret) {
+      skipped.push({
+        path: secret.masked,
+        reason: "sensitive-path",
+        detail: `path matches secret rule "${secret.rules.join('", "')}"; the file was skipped and its path is masked here because paths are emitted into every artifact`
+      });
+      return false;
+    }
     return true;
   }).sort();
-  return { files, skipped };
+  return { files, skipped: maskSkipPaths(skipped, pathRules) };
 }
-function walkDirectory(dir, baseDir, visited) {
-  const results = { files: [], skipped: [] };
-  let realDir;
+function rootRealFor(root) {
   try {
-    realDir = fs9.realpathSync(dir);
+    return fs9.realpathSync(root);
   } catch {
-    realDir = dir;
+    return root;
   }
-  if (visited.has(realDir)) return results;
-  visited.add(realDir);
-  const ignoredByGitignore = dir === baseDir ? readGitignoreMatcher(baseDir) : () => false;
+}
+function walkDirectory(dir, baseDir, rootReal, visited, isRoot = false) {
+  const results = { files: [], skipped: [] };
+  if (visited.has(dir)) return results;
+  visited.add(dir);
+  const ignoredByGitignore = isRoot ? readGitignoreMatcher(baseDir) : () => false;
   let entries;
   try {
     entries = fs9.readdirSync(dir, { withFileTypes: true });
   } catch {
-    results.skipped.push({ path: dir, reason: "read-error", detail: "directory unreadable" });
+    results.skipped.push({
+      path: path10.relative(baseDir, dir).replace(/\\/g, "/") || ".",
+      reason: "read-error",
+      detail: "directory unreadable"
+    });
     return results;
   }
   for (const entry of entries) {
-    if (DEFAULT_IGNORED_DIRS.includes(entry.name)) continue;
     const fullPath = path10.join(dir, entry.name);
     const relPath = path10.relative(baseDir, fullPath).replace(/\\/g, "/");
-    if (ignoredByGitignore(relPath)) continue;
+    if (isToolOwnedDirName(entry.name)) continue;
+    if (DEFAULT_IGNORED_DIRS.includes(entry.name)) {
+      results.skipped.push({
+        path: relPath,
+        reason: "default-ignore",
+        detail: `built-in ignore: directory "${entry.name}" (not descended)`
+      });
+      continue;
+    }
+    if (DEFAULT_IGNORED_FILES.includes(entry.name) || entry.name.startsWith("snapshot.backup-")) {
+      results.skipped.push({
+        path: relPath,
+        reason: "default-ignore",
+        detail: "built-in ignore: filename"
+      });
+      continue;
+    }
+    if (ignoredByGitignore(relPath)) {
+      if (!hasSnapshotMarker(fullPath)) {
+        results.skipped.push({
+          path: relPath,
+          reason: isSensitivePath(relPath) ? "sensitive-file" : "gitignore",
+          detail: "ignored by .gitignore"
+        });
+      }
+      continue;
+    }
     let isDirectory = entry.isDirectory();
     let isFile = entry.isFile();
     if (entry.isSymbolicLink()) {
+      let targetReal;
       try {
-        const stats = fs9.statSync(fullPath);
-        isDirectory = stats.isDirectory();
-        isFile = stats.isFile();
-        if (!isDirectory && !isFile) {
-          results.skipped.push({ path: relPath, reason: "symlink", detail: "not a file or directory" });
-          continue;
-        }
+        targetReal = fs9.realpathSync(fullPath);
+      } catch {
+        results.skipped.push({ path: relPath, reason: "read-error", detail: "broken symlink" });
+        continue;
+      }
+      let stats;
+      try {
+        stats = fs9.statSync(fullPath);
+      } catch {
+        results.skipped.push({ path: relPath, reason: "read-error", detail: "unreadable symlink" });
+        continue;
+      }
+      const linkTarget = readLinkTarget(fullPath, targetReal);
+      if (!isInside(rootReal, targetReal)) {
+        results.skipped.push({
+          path: relPath,
+          reason: "outside-root",
+          detail: `link target resolves outside the scanned root (target: ${linkTarget}); not followed`
+        });
+        continue;
+      }
+      if (stats.isDirectory()) {
         results.skipped.push({
           path: relPath,
           reason: "symlink",
-          detail: isDirectory ? "followed directory symlink" : "followed file symlink"
+          detail: `directory link not followed (target: ${linkTarget})`
+        });
+        continue;
+      }
+      if (!stats.isFile()) {
+        results.skipped.push({
+          path: relPath,
+          reason: "symlink",
+          detail: `link to neither a file nor a directory (target: ${linkTarget})`
         });
-      } catch {
-        results.skipped.push({ path: relPath, reason: "read-error", detail: "broken symlink" });
         continue;
       }
+      isDirectory = false;
+      isFile = true;
     }
     if (isDirectory) {
-      const nested = walkDirectory(fullPath, baseDir, visited);
+      const nested = walkDirectory(fullPath, baseDir, rootReal, visited);
       results.files.push(...nested.files);
       results.skipped.push(...nested.skipped);
     } else if (isFile) {
@@ -1968,195 +2662,6 @@ function walkDirectory(dir, baseDir, visited) {
   return results;
 }
 
-// src/security/patterns.ts
-var DEFAULT_SECRET_PATTERNS = [
-  {
-    rule: "private-key-header",
-    pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----|-----BEGIN (?:RSA |OPENSSH |EC |PGP |DSA |ENCRYPTED )?PRIVATE KEY-----/
-  },
-  {
-    rule: "jwt-token",
-    pattern: /eyJ[A-Za-z0-9_-]{10,1024}\.eyJ[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,1024}/
-  },
-  {
-    rule: "aws-access-key-id",
-    pattern: /(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[0-9A-Z]{16}/
-  },
-  {
-    rule: "aws-secret-access-key",
-    pattern: /(?:aws_secret_access_key|aws_secret_key|secret_access_key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+=]{40}["']?/i
-  },
-  {
-    rule: "github-token",
-    pattern: /gh[pousr]_[A-Za-z0-9]{36,251}|github_pat_[A-Za-z0-9_]{22,251}|ghs_[A-Za-z0-9]{36,251}/
-  },
-  {
-    rule: "slack-token",
-    pattern: /xox[baprs]-[0-9A-Za-z-]{10,250}/
-  },
-  {
-    rule: "slack-webhook-url",
-    pattern: /hooks\.slack\.com\/services\/T[A-Z0-9]{6,12}\/B[A-Z0-9]{6,12}\/[A-Za-z0-9]{20,32}/
-  },
-  {
-    rule: "stripe-secret-key",
-    pattern: /[sr]k_live_[0-9a-zA-Z]{20,247}/
-  },
-  {
-    rule: "google-api-key",
-    pattern: /AIza[0-9A-Za-z_-]{35}/
-  },
-  {
-    rule: "google-oauth-client-secret",
-    pattern: /GOCSPX-[A-Za-z0-9_-]{20,64}/
-  },
-  {
-    rule: "openai-anthropic-key",
-    pattern: /\bsk-(?:ant-[a-z0-9]+-|proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}_?[A-Za-z0-9_-]{0,20}\b/
-  },
-  {
-    rule: "npm-token",
-    pattern: /npm_[A-Za-z0-9]{36}/
-  },
-  {
-    rule: "pypi-token",
-    pattern: /pypi-[A-Za-z0-9_-]{50,180}/
-  },
-  {
-    rule: "sendgrid-key",
-    pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/
-  },
-  {
-    rule: "twilio-api-key",
-    pattern: /SK[0-9a-fA-F]{32}/
-  },
-  {
-    rule: "digitalocean-token",
-    pattern: /dop_v1_[0-9a-f]{64}/
-  },
-  {
-    rule: "azure-storage-account-key",
-    pattern: /AccountKey=[A-Za-z0-9+/=]{80,100}/
-  },
-  {
-    rule: "database-uri-credentials",
-    pattern: /(?:mongodb(?:\+srv)?|postgres(?:ql)?|mysql|maria(?:db)?|redis(?:s)?|amqp(?:s)?|clickhouse):\/\/[^\s:@/]{1,128}:[^\s@/]{1,256}@[^\s/]{1,256}/
-  },
-  {
-    rule: "basic-auth-url",
-    pattern: /(?:https?|ftp|sftp|ssh|git):\/\/[^\s:@/]{1,128}:[^\s@/]{1,256}@[^\s/]{1,256}/i
-  },
-  {
-    rule: "generic-secret-assignment",
-    pattern: /(?:api[_-]?key|secret[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?token|refresh[_-]?token|private[_-]?key|password|passwd|pwd)["']?\s*[:=]\s*["'][^"'\s]{8,256}["']/i
-  },
-  {
-    // Covers `.env` / shell assignment syntax, which never quotes its values and
-    // was therefore invisible to the rule above. Anchored to the line start and
-    // limited to secret-looking names to stay at zero false positives.
-    //
-    // The name is matched with BOUNDED quantifiers on purpose: an unbounded
-    // `[A-Za-z0-9_]*` on both sides of the keyword alternation backtracks at
-    // every offset of a long identifier, which made this rule quadratic
-    // (measured 5.6 s for a single 240 KB line before bounding).
-    rule: "env-secret-assignment",
-    pattern: /^\s{0,64}(?:export\s{1,8})?[A-Za-z0-9_]{0,96}(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|CREDENTIAL)[A-Za-z0-9_]{0,96}\s{0,8}=\s{0,8}(?![\s$<{[])[^\s#]{6,512}$/i
-  }
-];
-var PEM_BLOCK_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/g;
-var PEM_UNTERMINATED_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:\r?\n[A-Za-z0-9+/=]{4,}[ A-Za-z0-9+/=]*)+/g;
-
-// src/security/redact.ts
-var REDACTION_MARKER = "[REDACTED: potential secret-like value omitted from snapshot]";
-var PEM_REDACTION_MARKER = "[REDACTED: private key block omitted from snapshot]";
-function compileSecretRules(rules) {
-  return rules.map((rule) => {
-    if (rule.pattern instanceof RegExp) {
-      return {
-        rule: rule.rule,
-        pattern: new RegExp(rule.pattern.source, rule.pattern.flags.replace(/[gy]/g, ""))
-      };
-    }
-    if (typeof rule.pattern === "string") {
-      try {
-        return { rule: rule.rule, pattern: new RegExp(rule.pattern, "i") };
-      } catch (err) {
-        throw new Error(
-          `Invalid regular expression for secret rule "${rule.rule}": ${err.message}`
-        );
-      }
-    }
-    throw new Error(
-      `Secret rule "${String(rule.rule)}" has a pattern that is neither a RegExp nor a string.`
-    );
-  });
-}
-function toGlobal(pattern) {
-  const flags = pattern.flags.replace(/[gy]/g, "");
-  return new RegExp(pattern.source, `${flags}g`);
-}
-function scanAndRedactSecrets(content, rules, filePath) {
-  const findings = [];
-  let redacted = content;
-  for (const blockPattern of [PEM_BLOCK_PATTERN, PEM_UNTERMINATED_PATTERN]) {
-    blockPattern.lastIndex = 0;
-    let match;
-    while ((match = blockPattern.exec(redacted)) !== null) {
-      if (match[0].length === 0) {
-        blockPattern.lastIndex += 1;
-        continue;
-      }
-      const line = redacted.slice(0, match.index).split("\n").length;
-      const newlines = (match[0].match(/\n/g) ?? []).length;
-      findings.push({ rule: "private-key-block", line, path: filePath });
-      redacted = redacted.slice(0, match.index) + PEM_REDACTION_MARKER + "\n".repeat(newlines) + redacted.slice(match.index + match[0].length);
-      blockPattern.lastIndex = match.index + PEM_REDACTION_MARKER.length + newlines;
-    }
-  }
-  const compiled = rules.map((rule) => ({
-    rule: rule.rule,
-    pattern: toGlobal(rule.pattern)
-  }));
-  const lines = redacted.split("\n");
-  const redactedLines = lines.map((line, index) => {
-    if (line.length === 0) return line;
-    const spans = [];
-    const matchedRules = /* @__PURE__ */ new Set();
-    for (const { rule, pattern } of compiled) {
-      pattern.lastIndex = 0;
-      let match;
-      while ((match = pattern.exec(line)) !== null) {
-        if (match[0].length === 0) {
-          pattern.lastIndex += 1;
-          continue;
-        }
-        spans.push({ start: match.index, end: match.index + match[0].length, rule });
-        matchedRules.add(rule);
-      }
-    }
-    if (spans.length === 0) return line;
-    for (const rule of matchedRules) {
-      findings.push({ rule, line: index + 1, path: filePath });
-    }
-    return applySpans(line, spans);
-  });
-  return { redacted: redactedLines.join("\n"), findings };
-}
-function applySpans(line, spans) {
-  const ordered = [...spans].sort((a, b) => a.start - b.start || a.end - b.end);
-  let out = "";
-  let cursor = 0;
-  for (const span of ordered) {
-    if (span.end <= cursor) continue;
-    const start = Math.max(span.start, cursor);
-    out += line.slice(cursor, start);
-    out += REDACTION_MARKER;
-    cursor = Math.min(span.end, line.length);
-  }
-  out += line.slice(cursor);
-  return out;
-}
-
 // src/config.ts
 var CONFIG_FILENAMES = [
   "snapshot.config.ts",
@@ -2206,7 +2711,12 @@ function normalizeResolvedConfig(config) {
     ),
     include: resolveInclude(config.include),
     preset: typeof config.preset === "string" ? config.preset : "generic",
-    presetExclude: Array.isArray(config.presetExclude) ? config.presetExclude : [],
+    presetExclude: [
+      .../* @__PURE__ */ new Set([
+        ...Array.isArray(config.presetExclude) ? config.presetExclude : [],
+        ...outputExcludePatterns(config.cwd, config.outDir, config.tmpDir)
+      ])
+    ],
     layersMode: config.layersMode === "replace" ? "replace" : "merge",
     budgets: config.budgets && typeof config.budgets === "object" ? config.budgets : { default: config.maxPartBytes, byLayer: {} },
     hooks: resolveHooks(config.hooks),
@@ -2243,7 +2753,68 @@ function supportsTypeScriptImports() {
   return major > 22 || major === 22 && minor >= 6;
 }
 function stripJsonComments2(raw) {
-  return raw.replace(/^\uFEFF/, "").replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'\\])\/\/.*$/gm, "$1");
+  const text2 = raw.replace(/^\uFEFF/, "");
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let index = 0; index < text2.length; index += 1) {
+    const char = text2[index];
+    if (inString) {
+      out += char;
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      out += char;
+      continue;
+    }
+    if (char === "/" && text2[index + 1] === "/") {
+      while (index < text2.length && text2[index] !== "\n" && text2[index] !== "\r") index += 1;
+      index -= 1;
+      continue;
+    }
+    if (char === "/" && text2[index + 1] === "*") {
+      index += 2;
+      while (index < text2.length && !(text2[index] === "*" && text2[index + 1] === "/")) {
+        if (text2[index] === "\n" || text2[index] === "\r") out += text2[index];
+        index += 1;
+      }
+      index += 1;
+      continue;
+    }
+    out += char;
+  }
+  return stripTrailingCommas(out);
+}
+function stripTrailingCommas(text2) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let index = 0; index < text2.length; index += 1) {
+    const char = text2[index];
+    if (inString) {
+      out += char;
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      out += char;
+      continue;
+    }
+    if (char === ",") {
+      let next = index + 1;
+      while (next < text2.length && /\s/.test(text2[next])) next += 1;
+      if (text2[next] === "}" || text2[next] === "]") continue;
+    }
+    out += char;
+  }
+  return out;
 }
 function parseJsonish(raw, file) {
   try {
@@ -2252,6 +2823,47 @@ function parseJsonish(raw, file) {
     throw new Error(`Could not parse ${file}: ${err.message}`);
   }
 }
+function describeValue2(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "an array";
+  if (value instanceof RegExp) return value.toString();
+  if (typeof value === "function") return "a function";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "object") {
+    const keys = Object.keys(value);
+    return keys.length > 0 ? `an object with keys ${keys.join(", ")}` : "an empty object";
+  }
+  return `${typeof value} (${String(value)})`;
+}
+var isThenable = (value) => typeof value.then === "function";
+function readConfigExport(exported, file) {
+  if (exported === void 0 || exported === null) {
+    throw new Error(
+      `${file} does not export a configuration object (received ${describeValue2(exported)}).`
+    );
+  }
+  if (Array.isArray(exported)) {
+    throw new Error(
+      `${file} exports an array; expected a single configuration object such as \`export default { outDir: "snapshot" }\`.`
+    );
+  }
+  if (typeof exported === "function") {
+    throw new Error(
+      `${file} exports a function; expected a configuration object. Call the function yourself and export its result.`
+    );
+  }
+  if (typeof exported !== "object") {
+    throw new Error(
+      `${file} does not export a configuration object (received ${describeValue2(exported)}).`
+    );
+  }
+  if (isThenable(exported)) {
+    throw new Error(
+      `${file} exports a Promise/thenable, not a configuration object. An async config is read synchronously, so its settings would be ignored: export a plain object (\`const config = {\u2026}; export default config;\`).`
+    );
+  }
+  return exported;
+}
 async function loadConfigFileDetailed(cwd) {
   const warnings = [];
   const errors = [];
@@ -2281,13 +2893,7 @@ async function loadConfigFileDetailed(cwd) {
     }
     try {
       const imported = await import(pathToFileURL(fullPath).href);
-      const config = imported.default ?? imported;
-      if (!config || typeof config !== "object") {
-        const message = `${fullPath} does not export a configuration object.`;
-        warnings.push(message);
-        errors.push(message);
-        continue;
-      }
+      const config = readConfigExport(imported.default ?? imported, fullPath);
       return { config, file: fullPath, warnings, errors };
     } catch (err) {
       const message = `Could not load ${fullPath}: ${err.message}`;
@@ -2341,7 +2947,7 @@ var DEFAULT_ARTIFACTS = {
 function isArtifactName(value) {
   return ARTIFACT_NAMES.includes(value);
 }
-function resolveArtifacts(requested, skipped, includeMonolith) {
+function resolveArtifacts(requested, skipped, includeMonolith, monolithOverride) {
   const artifacts = {
     ...DEFAULT_ARTIFACTS,
     // `includeMonolith` predates this selection and stays the switch for it.
@@ -2363,6 +2969,9 @@ function resolveArtifacts(requested, skipped, includeMonolith) {
       artifacts[name] = value;
     }
   }
+  if (monolithOverride !== void 0) {
+    artifacts.monolith = monolithOverride;
+  }
   for (const name of skipped ?? []) {
     if (!isArtifactName(name)) {
       throw new Error(
@@ -2373,9 +2982,106 @@ function resolveArtifacts(requested, skipped, includeMonolith) {
   }
   return artifacts;
 }
-function positiveInteger(value, fallback) {
-  if (!Number.isFinite(value) || value <= 0) return fallback;
-  return Math.floor(value);
+function strictPositiveInteger(value, fallback, label) {
+  if (value === void 0) return fallback;
+  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+    throw new Error(`${label} must be a positive integer (received ${describeValue2(value)}).`);
+  }
+  return value;
+}
+function strictBoolean(value, fallback, label) {
+  if (value === void 0) return fallback;
+  if (typeof value !== "boolean") {
+    throw new Error(`${label} must be true or false (received ${describeValue2(value)}).`);
+  }
+  return value;
+}
+function strictString(value, fallback, label) {
+  if (value === void 0) return fallback;
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`${label} must be a non-empty string (received ${describeValue2(value)}).`);
+  }
+  return value;
+}
+function resolveExcludePatterns(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value) || value.some((pattern) => typeof pattern !== "string")) {
+    throw new Error(
+      `\`excludePatterns\` must be an array of glob strings such as ["**/*.test.ts"] (received ${describeValue2(value)}).`
+    );
+  }
+  return value.map((pattern) => pattern.trim()).filter(Boolean);
+}
+var AUTO_PRESET_ALIASES = /* @__PURE__ */ new Set(["auto", "detected"]);
+function resolvePresetName(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(
+      `\`preset\` must be a preset name (received ${describeValue2(value)}). Use "detected" (or "auto") to detect one, or one of: ${listPresetNames().join(", ")}.`
+    );
+  }
+  const name = value.trim();
+  return AUTO_PRESET_ALIASES.has(name.toLowerCase()) ? void 0 : name;
+}
+function resolveRuleList(value, kind) {
+  const collection = kind === "layer" ? "layers" : "kinds";
+  const example = kind === "layer" ? `{ name: "api", match: "src/api/**" }` : `{ kind: "route", match: "src/routes/**" }`;
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) {
+    throw new Error(
+      `\`${collection}\` must be an array of ${kind} rules (received ${describeValue2(value)}). A ${kind} rule is ${example}.`
+    );
+  }
+  return value.map((entry, index) => {
+    const where = `${collection}[${index}]`;
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+      throw new Error(`${where} must be an object (received ${describeValue2(entry)}). A ${kind} rule is ${example}.`);
+    }
+    const record = entry;
+    const keys = Object.keys(record);
+    const canonical = kind === "layer" ? "name" : "kind";
+    const alias = kind === "layer" ? "layer" : "name";
+    const rawName = typeof record[canonical] === "string" ? record[canonical] : typeof record[alias] === "string" ? record[alias] : void 0;
+    if (rawName === void 0 || rawName.trim() === "") {
+      throw new Error(
+        `${where} is missing \`${canonical}\` (received keys: ${keys.join(", ") || "none"}). A ${kind} rule is ${example}; \`${alias}\` is accepted as an alias of \`${canonical}\`.`
+      );
+    }
+    const match = record.match;
+    if (match === void 0) {
+      throw new Error(
+        `${where}.match is required (received keys: ${keys.join(", ") || "none"}). Use a glob string ("src/api/**"), a RegExp (/\\\\.tsx$/) or a function.`
+      );
+    }
+    if (!(typeof match === "string" || match instanceof RegExp || typeof match === "function")) {
+      throw new Error(`${where}.match must be a string, a RegExp or a function (received ${describeValue2(match)}).`);
+    }
+    if (typeof match === "string" && match.trim() === "") {
+      throw new Error(`${where}.match must not be an empty string.`);
+    }
+    return {
+      name: rawName.trim(),
+      match
+    };
+  });
+}
+function resolveLayerRules(value) {
+  return resolveRuleList(value, "layer").map((rule) => ({ name: rule.name, match: rule.match }));
+}
+function resolveKindRules(value) {
+  return resolveRuleList(value, "kind").map((rule) => ({ kind: rule.name, match: rule.match }));
+}
+function outputExcludePatterns(cwd, outDir, tmpDir) {
+  const patterns = [];
+  for (const dir of [outDir, tmpDir]) {
+    const absolute = path10.resolve(cwd, dir);
+    const relative4 = path10.relative(cwd, absolute);
+    if (!relative4 || relative4 === ".." || relative4.startsWith(`..${path10.sep}`) || path10.isAbsolute(relative4)) {
+      continue;
+    }
+    patterns.push(`${relative4.replace(/\\/g, "/")}/**`);
+  }
+  return patterns;
 }
 var BYTE_UNITS = {
   b: 1,
@@ -2444,11 +3150,13 @@ function resolveLayersMode(mode) {
   }
   return mode;
 }
-function resolveBudgets(budgets, fallback) {
+function resolveBudgets(budgets, fallback, overrideDefault) {
   const byLayer = {};
   if (budgets === void 0) return { default: fallback, byLayer };
   if (typeof budgets !== "object" || budgets === null || Array.isArray(budgets)) {
-    throw new Error("`budgets` must be an object.");
+    throw new Error(
+      `\`budgets\` must be an object such as { default: "120k", byLayer: { api: "60k" } } (received ${describeValue2(budgets)}).`
+    );
   }
   if (budgets.byLayer !== void 0) {
     if (typeof budgets.byLayer !== "object" || budgets.byLayer === null) {
@@ -2463,10 +3171,12 @@ function resolveBudgets(budgets, fallback) {
       );
     }
   }
-  return {
-    default: boundedBytes(budgets.default, fallback, MIN_MAX_PART_BYTES, "budgets.default"),
-    byLayer
-  };
+  const resolvedDefault = boundedBytes(budgets.default, fallback, MIN_MAX_PART_BYTES, "budgets.default");
+  if (!overrideDefault) return { default: resolvedDefault, byLayer };
+  for (const [layer2, value] of Object.entries(byLayer)) {
+    byLayer[layer2] = Math.min(value, fallback);
+  }
+  return { default: fallback, byLayer };
 }
 function resolveHooks(hooks) {
   if (hooks === void 0) return {};
@@ -2479,6 +3189,11 @@ function resolveHooks(hooks) {
   return { ...hooks };
 }
 function resolveCandidateCwd(userConfig, cliOptions, baseDir) {
+  if (userConfig?.cwd !== void 0 && (typeof userConfig.cwd !== "string" || userConfig.cwd.trim() === "")) {
+    throw new Error(
+      `\`cwd\` must be a non-empty path string (received ${describeValue2(userConfig.cwd)}).`
+    );
+  }
   const candidate = cliOptions?.cwd || userConfig?.cwd || baseDir || process.cwd();
   const resolved = path10.resolve(candidate);
   if (!fs9.existsSync(resolved)) {
@@ -2491,55 +3206,107 @@ function resolveCandidateCwd(userConfig, cliOptions, baseDir) {
 }
 function resolveConfig(userConfig, cliOptions, baseDir) {
   const cwd = resolveCandidateCwd(userConfig ?? null, cliOptions, baseDir);
-  const forcedPreset = userConfig?.preset;
+  const forcedPreset = resolvePresetName(userConfig?.preset);
   if (forcedPreset !== void 0 && !getPreset(forcedPreset)) {
     throw new Error(unknownPresetMessage(forcedPreset));
   }
   const preset = detectPreset(cwd, forcedPreset);
   const layersMode = resolveLayersMode(userConfig?.layersMode);
-  const layers = userConfig?.layers && userConfig.layers.length > 0 ? layersMode === "replace" ? userConfig.layers : [...userConfig.layers, ...preset.layers] : preset.layers;
-  const kinds = userConfig?.kinds && userConfig.kinds.length > 0 ? layersMode === "replace" ? userConfig.kinds : [...userConfig.kinds, ...preset.kinds] : preset.kinds;
-  const customRules = userConfig?.secrets?.customPatterns ?? [];
-  const rawRules = userConfig?.secrets?.disableDefaultPatterns ? customRules : [...DEFAULT_SECRET_PATTERNS, ...customRules];
-  const secretRules = compileSecretRules(rawRules);
-  const includeMonolith = cliOptions?.includeMonolith ?? userConfig?.includeMonolith ?? false;
+  const userLayers = resolveLayerRules(userConfig?.layers);
+  const userKinds = resolveKindRules(userConfig?.kinds);
+  const layers = userLayers.length > 0 ? layersMode === "replace" ? userLayers : [...userLayers, ...preset.layers] : preset.layers;
+  const kinds = userKinds.length > 0 ? layersMode === "replace" ? userKinds : [...userKinds, ...preset.kinds] : preset.kinds;
+  const secrets = userConfig?.secrets;
+  if (secrets !== void 0 && (typeof secrets !== "object" || Array.isArray(secrets))) {
+    throw new Error(
+      `\`secrets\` must be an object of { customPatterns, disableDefaultPatterns } (received ${describeValue2(secrets)}).`
+    );
+  }
+  const customRules = secrets?.customPatterns ?? [];
+  if (!Array.isArray(customRules)) {
+    throw new Error(
+      `\`secrets.customPatterns\` must be an array of secret rules (received ${describeValue2(customRules)}). Each entry is a RegExp, a string, or { rule, pattern }.`
+    );
+  }
+  const disableDefaultPatterns = strictBoolean(
+    secrets?.disableDefaultPatterns,
+    false,
+    "`secrets.disableDefaultPatterns`"
+  );
+  const aliasedRules = userConfig?.secretRules;
+  if (aliasedRules !== void 0 && !Array.isArray(aliasedRules)) {
+    throw new Error(
+      `\`secretRules\` must be an array of { rule, pattern } entries (received ${describeValue2(aliasedRules)}).`
+    );
+  }
+  const compiledCustomRules = compileSecretRules([
+    ...customRules,
+    ...aliasedRules ?? []
+  ]);
+  const secretRules = disableDefaultPatterns ? compiledCustomRules : [...compileSecretRules(DEFAULT_SECRET_PATTERNS), ...compiledCustomRules];
+  setActiveSecretRules(secretRules);
+  const cliMonolith = cliOptions?.includeMonolith;
+  const includeMonolith = cliMonolith ?? strictBoolean(userConfig?.includeMonolith, false, "`includeMonolith`");
   const artifacts = resolveArtifacts(
     userConfig?.artifacts,
     cliOptions?.skipArtifacts,
-    includeMonolith
+    includeMonolith,
+    cliMonolith
   );
+  const explicitMaxPartBytes = cliOptions?.maxPartBytes ?? userConfig?.maxPartBytes;
   const maxPartBytes = boundedBytes(
-    cliOptions?.maxPartBytes ?? userConfig?.maxPartBytes,
+    explicitMaxPartBytes,
     300 * 1024,
     MIN_MAX_PART_BYTES,
     "maxPartBytes"
   );
-  const budgets = resolveBudgets(userConfig?.budgets, maxPartBytes);
+  const budgets = resolveBudgets(
+    userConfig?.budgets,
+    maxPartBytes,
+    explicitMaxPartBytes !== void 0
+  );
+  const configuredOutDir = strictString(userConfig?.outDir, "snapshot", "`outDir`");
+  const outDir = cliOptions?.outDir || configuredOutDir;
+  const tmpDir = strictString(userConfig?.tmpDir, "snapshot.tmp", "`tmpDir`");
+  const branch = strictString(userConfig?.branch, "main", "`branch`");
+  const configuredSensitiveFiles = strictBoolean(
+    userConfig?.includeSensitiveFiles,
+    false,
+    "`includeSensitiveFiles`"
+  );
+  const includeSensitiveFiles = strictBoolean(
+    cliOptions?.includeSensitiveFiles,
+    configuredSensitiveFiles,
+    "`includeSensitiveFiles`"
+  );
+  const presetExclude = [
+    .../* @__PURE__ */ new Set([...preset.exclude, ...outputExcludePatterns(cwd, outDir, tmpDir)])
+  ];
   return markResolvedConfig({
     cwd,
-    branch: userConfig?.branch || "main",
-    outDir: cliOptions?.outDir || userConfig?.outDir || "snapshot",
-    tmpDir: userConfig?.tmpDir || "snapshot.tmp",
+    branch,
+    outDir,
+    tmpDir,
     maxPartBytes,
     largeFileBytes: boundedBytes(cliOptions?.largeFileBytes ?? userConfig?.largeFileBytes, 200 * 1024, 1, "largeFileBytes"),
-    previewHeadLines: positiveInteger(userConfig?.previewHeadLines ?? 80, 80),
-    previewTailLines: positiveInteger(userConfig?.previewTailLines ?? 40, 40),
+    previewHeadLines: strictPositiveInteger(userConfig?.previewHeadLines, 80, "`previewHeadLines`"),
+    previewTailLines: strictPositiveInteger(userConfig?.previewTailLines, 40, "`previewTailLines`"),
     includeMonolith: artifacts.monolith,
     maxMonolithBytes: optionalBytes(
       cliOptions?.maxMonolithBytes !== void 0 ? cliOptions.maxMonolithBytes : userConfig?.maxMonolithBytes,
       "maxMonolithBytes"
     ),
-    includeSensitiveFiles: cliOptions?.includeSensitiveFiles ?? userConfig?.includeSensitiveFiles ?? false,
+    includeSensitiveFiles,
     include: resolveInclude(userConfig?.include),
     preset: preset.presetName,
-    presetExclude: [...preset.exclude],
+    presetExclude,
     artifacts,
     layersMode,
     budgets,
     hooks: resolveHooks(userConfig?.hooks),
     layers,
     kinds,
-    excludePatterns: userConfig?.excludePatterns ?? [],
+    excludePatterns: resolveExcludePatterns(userConfig?.excludePatterns),
     secretRules
   });
 }
@@ -2585,7 +3352,8 @@ function defineConfig(config) {
 }
 
 // src/generator/audit.ts
-function generateAuditReport(manifest, secretFindings) {
+function generateAuditReport(manifest, secretFindings, secretRules) {
+  const mask = (value) => findSecretInPath(value, secretRules)?.masked ?? value;
   const lines = [
     "# Codebase Health & Security Audit",
     "",
@@ -2594,7 +3362,11 @@ function generateAuditReport(manifest, secretFindings) {
     `**Total Files:** ${manifest.counts.totalFiles}  `,
     `**Total Lines:** ${manifest.counts.totalLines.toLocaleString()}  `,
     `**Total Size:** ${(manifest.counts.totalSizeBytes / (1024 * 1024)).toFixed(2)} MB  `,
-    `**Redacted Content Bytes:** ${manifest.totals.totalContentBytes.toLocaleString()}  `,
+    // This counts the bytes that were *emitted* after redaction, not the bytes
+    // that were masked: calling it "redacted bytes" made a repository with zero
+    // secrets report a non-zero redacted-byte figure directly above "no secrets
+    // detected". The number of masked spans is reported in section 1 instead.
+    `**Emitted Content Bytes:** ${manifest.totals.totalContentBytes.toLocaleString()}  `,
     "",
     "## 1. Security Scan & Redaction",
     "",
@@ -2616,7 +3388,7 @@ function generateAuditReport(manifest, secretFindings) {
       "| :--- | :--- | :--- |"
     );
     for (const finding of secretFindings) {
-      lines.push(`| \`${finding.path ?? "unknown"}\` | ${finding.line} | \`${finding.rule}\` |`);
+      lines.push(`| \`${mask(finding.path ?? "unknown")}\` | ${finding.line} | \`${finding.rule}\` |`);
     }
     lines.push("", "### Matches by rule", "", "| Rule | Matches |", "| :--- | :--- |");
     for (const [rule, count] of Array.from(byRule.entries()).sort((a, b) => b[1] - a[1])) {
@@ -2638,7 +3410,7 @@ function generateAuditReport(manifest, secretFindings) {
     for (const file of largeFiles) {
       const sizeKb = (file.sizeBytes / 1024).toFixed(1);
       const status = file.isPreviewTruncated ? "Truncated Head/Tail" : "Full";
-      lines.push(`| \`${file.relativePath}\` | ${sizeKb} KB | ${file.lines} | ${status} |`);
+      lines.push(`| \`${mask(file.relativePath)}\` | ${sizeKb} KB | ${file.lines} | ${status} |`);
     }
     lines.push("");
   }
@@ -2680,7 +3452,7 @@ function generateAuditReport(manifest, secretFindings) {
       "| :--- | :--- | :--- |"
     );
     for (const skip of manifest.skipped) {
-      lines.push(`| \`${skip.path}\` | \`${skip.reason}\` | ${skip.detail ?? "-"} |`);
+      lines.push(`| \`${mask(skip.path)}\` | \`${skip.reason}\` | ${skip.detail ?? "-"} |`);
     }
     lines.push("");
   }
@@ -2797,6 +3569,8 @@ function renumberParts(parts, contentFingerprint) {
       layerCounts[file.layer] = (layerCounts[file.layer] || 0) + 1;
       kindCounts[file.kind] = (kindCounts[file.kind] || 0) + 1;
     }
+    const pathLines = included.map((file) => displayPath(file.relativePath));
+    const listFence = fenceForText(pathLines.join("\n"), 3);
     const header = [
       `# Codebase Snapshot Part ${zeroPad(index + 1)} of ${zeroPad(total)}`,
       "",
@@ -2809,9 +3583,9 @@ function renumberParts(parts, contentFingerprint) {
       "",
       "## Files",
       "",
-      "```text",
-      ...included.map((file) => displayPath(file.relativePath)),
-      "```",
+      `${listFence}text`,
+      ...pathLines,
+      listFence,
       "",
       "## Contents",
       ""
@@ -2839,7 +3613,8 @@ function capValue(value, max) {
   return `${value.slice(0, half)}\u2026${value.slice(value.length - half)}`;
 }
 var capMetadata = (value) => capValue(value, METADATA_VALUE_MAX);
-var displayPath = (value) => capValue(value, DISPLAY_PATH_MAX);
+var CONTROL_CHARS = /[\u0000-\u001f\u007f]/g;
+var displayPath = (value) => capValue(value.replace(CONTROL_CHARS, " "), DISPLAY_PATH_MAX);
 function topEntries(counts, limit) {
   return Object.entries(counts).sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0)).slice(0, limit).map(([key, value]) => `${capMetadata(key)} (${value})`).join(", ");
 }
@@ -2935,6 +3710,8 @@ function renderGroups(groups, contentFingerprint) {
       layerCounts[section.file.layer] = (layerCounts[section.file.layer] || 0) + 1;
       kindCounts[section.file.kind] = (kindCounts[section.file.kind] || 0) + 1;
     }
+    const pathLines = group.map((s) => displayPath(s.file.relativePath));
+    const listFence = fenceForText(pathLines.join("\n"), 3);
     const header = [
       `# Codebase Snapshot Part ${zeroPad(index + 1)} of ${zeroPad(total)}`,
       "",
@@ -2947,9 +3724,9 @@ function renderGroups(groups, contentFingerprint) {
       "",
       "## Files",
       "",
-      "```text",
-      ...group.map((s) => displayPath(s.file.relativePath)),
-      "```",
+      `${listFence}text`,
+      ...pathLines,
+      listFence,
       "",
       "## Contents",
       ""
@@ -3008,9 +3785,12 @@ function renderFileSection(file) {
   ].join("\n");
 }
 function fenceForContent(content) {
+  return fenceForText(content, 4);
+}
+function fenceForText(content, minimum) {
   const matches = content.match(/`+/g);
   const maxRun = matches?.reduce((max, run) => Math.max(max, run.length), 0) ?? 0;
-  return "`".repeat(Math.max(4, maxRun + 1));
+  return "`".repeat(Math.max(minimum, maxRun + 1));
 }
 function renderSummary(summary) {
   if (!summary) return [];
@@ -3159,6 +3939,7 @@ function generateReadme(manifest) {
 
 // src/generator/tree.ts
 var MAX_TREE_LINES = 2e4;
+var CONTROL_CHARS2 = /[\u0000-\u001f\u007f]/g;
 function generateProjectTree(filePaths) {
   const root = { children: /* @__PURE__ */ new Map() };
   for (const filePath of filePaths) {
@@ -3173,7 +3954,7 @@ function generateProjectTree(filePaths) {
       current = child;
     }
   }
-  const lines = ["# Project Tree", "", "```text", "."];
+  const lines = ["."];
   let truncatedAt = -1;
   function walk(node, prefix) {
     if (truncatedAt !== -1) return;
@@ -3188,7 +3969,8 @@ function generateProjectTree(filePaths) {
       const isLast = index === keys.length - 1;
       const child = node.children.get(key);
       const isDirectory = child.children.size > 0;
-      lines.push(`${prefix}${isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "}${key}${isDirectory ? "/" : ""}`);
+      const label = key.replace(CONTROL_CHARS2, " ");
+      lines.push(`${prefix}${isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "}${label}${isDirectory ? "/" : ""}`);
       if (lines.length >= MAX_TREE_LINES) {
         truncatedAt = lines.length;
         return;
@@ -3200,8 +3982,8 @@ function generateProjectTree(filePaths) {
   if (truncatedAt !== -1) {
     lines.push(`... [tree truncated at ${MAX_TREE_LINES} lines] ...`);
   }
-  lines.push("```", "");
-  return lines.join("\n");
+  const fence = fenceForText(lines.join("\n"), 3);
+  return ["# Project Tree", "", `${fence}text`, ...lines, fence, ""].join("\n");
 }
 var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
   ".png",
@@ -3332,6 +4114,9 @@ function detectLanguage(filePath) {
   const ext = path10.posix.extname(base).toLowerCase();
   return LANGUAGE_BY_EXTENSION[ext] ?? "text";
 }
+function maskedPath(value, secretRules) {
+  return findSecretInPath(value, secretRules)?.masked ?? value;
+}
 function emptyDrift() {
   return {
     missingInSnapshot: [],
@@ -3345,6 +4130,15 @@ function emptyDrift() {
 function sha256Hex(buffer) {
   return crypto.createHash("sha256").update(buffer).digest("hex");
 }
+function wouldNowBeIncluded(cwd, relativePath) {
+  const absolutePath = path10.join(cwd, relativePath);
+  try {
+    if (!fs9.statSync(absolutePath).isFile()) return false;
+    return !isBinaryFile(absolutePath);
+  } catch {
+    return false;
+  }
+}
 function validateSnapshot(configInput) {
   assertUsableConfigInput(configInput);
   const config = isResolvedConfig(configInput) ? normalizeResolvedConfig(configInput) : resolveConfig(configInput);
@@ -3393,15 +4187,20 @@ function validateSnapshot(configInput) {
   const skippedSet = new Set(
     manifest.skipped.filter((entry) => entry && typeof entry.path === "string").map((entry) => entry.path)
   );
+  const isSkippedOnDisk = (diskFile) => {
+    if (skippedSet.has(diskFile)) return true;
+    return skippedSet.has(maskedPath(diskFile, config.secretRules));
+  };
   const collection = collectFiles(config.cwd, {
     includePatterns: config.include,
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
-    includeSensitiveFiles: config.includeSensitiveFiles
+    includeSensitiveFiles: config.includeSensitiveFiles,
+    secretRules: config.secretRules
   });
   for (const diskFile of collection.files) {
-    if (skippedSet.has(diskFile)) continue;
     const snapshotHash = manifestFileMap.get(diskFile);
     if (!snapshotHash) {
+      if (isSkippedOnDisk(diskFile) && !wouldNowBeIncluded(config.cwd, diskFile)) continue;
       drift.missingInSnapshot.push(diskFile);
       continue;
     }
@@ -3670,10 +4469,19 @@ function validateSnapshot(configInput) {
       `${drift.configMismatches.length} configuration mismatch(es) between the manifest and this run.`
     );
   }
+  const maskedDrift = {
+    ...drift,
+    missingInSnapshot: drift.missingInSnapshot.map((value) => maskedPath(value, config.secretRules)),
+    missingOnDisk: drift.missingOnDisk.map((value) => maskedPath(value, config.secretRules)),
+    hashMismatches: drift.hashMismatches.map((mismatch) => ({
+      ...mismatch,
+      path: maskedPath(mismatch.path, config.secretRules)
+    }))
+  };
   return {
     valid: errors.length === 0,
     manifestPresent: true,
-    drift,
+    drift: maskedDrift,
     errors,
     warnings
   };
@@ -3682,16 +4490,15 @@ function describeMatcher(matcher) {
   if (typeof matcher === "string") return matcher;
   if (matcher instanceof RegExp) return String(matcher);
   if (typeof matcher === "function") {
-    const source = String(matcher).replace(/\s+/g, " ").trim();
-    return source.length > 70 ? `${source.slice(0, 67)}...` : source;
+    return "function (custom predicate)";
   }
   return String(matcher);
 }
 function normalizeTarget(cwd, target) {
   const absolute = path10.resolve(cwd, target);
-  const relative3 = path10.relative(cwd, absolute);
-  if (relative3.startsWith("..") || path10.isAbsolute(relative3)) return target;
-  return relative3.split(path10.sep).join("/");
+  const relative4 = path10.relative(cwd, absolute);
+  if (relative4.startsWith("..") || path10.isAbsolute(relative4)) return target;
+  return relative4.split(path10.sep).join("/");
 }
 function findRuleMatch(rules, relativePath) {
   return rules.find(
@@ -3707,20 +4514,24 @@ function readManifest2(config) {
   }
 }
 function explainPath(config, target) {
-  const relative3 = normalizeTarget(config.cwd, target);
-  const absolute = path10.join(config.cwd, relative3);
+  const relative4 = normalizeTarget(config.cwd, target);
+  const absolute = path10.join(config.cwd, relative4);
+  const maskedPath2 = findSecretInPath(relative4, config.secretRules)?.masked ?? relative4;
   const result = {
-    path: relative3,
+    path: maskedPath2,
     exists: fs9.existsSync(absolute),
     included: false
   };
   const collection = collectFiles(config.cwd, {
     includePatterns: config.include,
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
-    includeSensitiveFiles: config.includeSensitiveFiles
+    includeSensitiveFiles: config.includeSensitiveFiles,
+    secretRules: config.secretRules
   });
-  if (!collection.files.includes(relative3)) {
-    const record = collection.skipped.find((entry2) => entry2.path === relative3);
+  if (!collection.files.includes(relative4)) {
+    const record = collection.skipped.find(
+      (entry2) => entry2.path === relative4 || entry2.path === maskedPath2
+    );
     if (record) {
       result.reason = record.reason;
       result.detail = record.detail;
@@ -3734,24 +4545,30 @@ function explainPath(config, target) {
     return result;
   }
   result.included = true;
-  result.layer = classifyLayer(relative3, config.layers);
-  result.kind = classifyKind(relative3, config.kinds);
-  result.language = detectLanguage(relative3);
-  const layerRule = findRuleMatch(config.layers, relative3);
+  if (isBinaryFile(absolute)) {
+    result.included = false;
+    result.reason = "binary";
+    result.detail = "binary content; generate skips it and records `binary` in manifest.skipped[]";
+    return result;
+  }
+  result.layer = classifyLayer(relative4, config.layers);
+  result.kind = classifyKind(relative4, config.kinds);
+  result.language = detectLanguage(relative4);
+  const layerRule = findRuleMatch(config.layers, relative4);
   if (layerRule) result.layerMatch = describeMatcher(layerRule.match);
-  const kindRule = findRuleMatch(config.kinds, relative3);
+  const kindRule = findRuleMatch(config.kinds, relative4);
   if (kindRule) result.kindMatch = describeMatcher(kindRule.match);
   if (fs9.existsSync(absolute) && fs9.statSync(absolute).isFile()) {
     const buffer = fs9.readFileSync(absolute);
     const text2 = buffer.toString("utf8");
     result.bytes = buffer.length;
     result.lines = countLines(text2);
-    const { findings } = scanAndRedactSecrets(text2, config.secretRules, relative3);
+    const { findings } = scanAndRedactSecrets(text2, config.secretRules, relative4);
     result.secretCount = findings.length;
     result.secrets = findings.slice(0, 20).map((finding) => ({ rule: finding.rule, line: finding.line }));
   }
   const manifest = readManifest2(config);
-  const entry = manifest?.files.find((file) => file.relativePath === relative3);
+  const entry = Array.isArray(manifest?.files) ? manifest.files.find((file) => file.relativePath === relative4) : void 0;
   result.part = entry?.part ?? null;
   result.inclusionMode = entry?.inclusionMode;
   return result;
@@ -3806,7 +4623,40 @@ function hashMap(manifest) {
   }
   return map;
 }
+function manifestProblem(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return "not a JSON object";
+  const candidate = value;
+  if (!Array.isArray(candidate.files)) return 'no "files" array';
+  for (const entry of candidate.files) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      return 'a "files" entry is not an object';
+    }
+    if (typeof entry.relativePath !== "string") {
+      return 'a "files" entry has no "relativePath"';
+    }
+  }
+  const counts = candidate.counts;
+  if (!counts || typeof counts !== "object" || Array.isArray(counts)) {
+    return 'no "counts" object';
+  }
+  for (const key of ["totalFiles", "totalLines", "totalSizeBytes", "partsCount"]) {
+    if (typeof counts[key] !== "number") {
+      return `no numeric "counts.${key}"`;
+    }
+  }
+  if (typeof candidate.generatedAt !== "string") return 'no "generatedAt"';
+  if (typeof candidate.fingerprint !== "string") return 'no "fingerprint"';
+  return null;
+}
+function assertUsableManifest(value, label) {
+  const problem = manifestProblem(value);
+  if (problem) {
+    throw new Error(`The ${label} manifest is not a snapshot manifest this tool wrote: ${problem}.`);
+  }
+}
 function compareManifests(before, after) {
+  assertUsableManifest(before, "before");
+  assertUsableManifest(after, "after");
   const left = hashMap(before);
   const right = hashMap(after);
   const added = [];
@@ -3823,12 +4673,13 @@ function compareManifests(before, after) {
     if (!right.has(filePath)) removed.push(filePath);
   }
   const sort = (values) => values.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const mask = (values) => values.map((value) => findSecretInPath(value)?.masked ?? value);
   return {
     before: side(before),
     after: side(after),
-    added: sort(added),
-    removed: sort(removed),
-    changed: sort(changed),
+    added: mask(sort(added)),
+    removed: mask(sort(removed)),
+    changed: mask(sort(changed)),
     unchanged
   };
 }
@@ -3852,11 +4703,11 @@ function loadManifest(target) {
   } catch (err) {
     throw new Error(`Could not parse ${manifestPath}: ${err.message}`);
   }
-  if (!parsed || !Array.isArray(parsed.files)) {
-    throw new Error(`${manifestPath} is not a snapshot manifest (no "files" array).`);
-  }
-  if (!parsed.counts || typeof parsed.counts !== "object") {
-    throw new Error(`${manifestPath} is not a snapshot manifest (no "counts" object).`);
+  const problem = manifestProblem(parsed);
+  if (problem) {
+    throw new Error(
+      `${manifestPath} is not a usable snapshot manifest: ${problem}. Point diff at a manifest.json written by \`generate\` (or at the directory that holds it).`
+    );
   }
   return parsed;
 }
@@ -3968,7 +4819,7 @@ function renderConfig(answers) {
   secrets: {
     // [{ rule: "internal-token", pattern: /CORP-[A-Z0-9]{32}/ }]
     customPatterns: [],
-    // Set true to drop the 21 built-in rules.
+    // Set true to drop the built-in rules above and keep only customPatterns.
     disableDefaultPatterns: false,
   },
 
@@ -3984,6 +4835,10 @@ function renderConfig(answers) {
   },
   // Skip the monolith above this size. null = no limit.
   maxMonolithBytes: null,
+  // Top-level switch for the monolith, equivalent to artifacts.monolith.
+  // When both are present the artifact entry wins; this one exists so the
+  // generated file lists every setting the tool accepts.
+  includeMonolith: ${artifacts.monolith},
 
   // \u2500\u2500 Advanced \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   // afterGenerate: (manifest) => { /* write your own artifact */ }
@@ -4305,6 +5160,14 @@ function existingConfig(cwd) {
   }
   return null;
 }
+function packageJsonHasConfig(cwd) {
+  try {
+    const parsed = JSON.parse(fs9.readFileSync(path10.join(cwd, "package.json"), "utf8"));
+    return typeof parsed.snapshot === "object" && parsed.snapshot !== null;
+  } catch {
+    return false;
+  }
+}
 function artifactAnswers(options) {
   const artifacts = { ...DEFAULT_ANSWERS.artifacts };
   for (const name of options.skipArtifacts ?? []) {
@@ -4517,6 +5380,11 @@ async function runInit(options) {
       `A configuration already exists (${present}). Re-run with --force to replace it.`
     );
   }
+  if (packageJsonHasConfig(options.cwd) && !options.force) {
+    throw new Error(
+      'package.json already defines a "snapshot" config. Remove that key, or re-run with --force to write a config file that takes precedence over it.'
+    );
+  }
   if (fs9.existsSync(configPath) && !options.force) {
     throw new Error(`${configName} already exists. Re-run with --force to replace it.`);
   }
@@ -4536,7 +5404,7 @@ async function runInit(options) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "3.0.0";
+var GENERATOR_VERSION = "4.0.1";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto.createHash("sha256").update(input).digest("hex");
@@ -4573,7 +5441,6 @@ function bump(counts, key) {
 }
 var RELATIVE_SPECIFIER = /^\.{1,2}\//;
 var IMPORT_CANDIDATE_SUFFIXES = [
-  "",
   ".ts",
   ".tsx",
   ".mts",
@@ -4587,23 +5454,59 @@ var IMPORT_CANDIDATE_SUFFIXES = [
   "/index.js",
   "/index.mjs"
 ];
-function resolveSpecifier(fromFile, specifier, knownFiles) {
+var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+]);
+function buildImportResolver(files) {
+  const byPath = /* @__PURE__ */ new Map();
+  const byPathFolded = /* @__PURE__ */ new Map();
+  const byStem = /* @__PURE__ */ new Map();
+  const byStemFolded = /* @__PURE__ */ new Map();
+  const remember = (map, key, value) => {
+    if (!map.has(key)) map.set(key, value);
+  };
+  for (const file of files) {
+    const relativePath = file.relativePath;
+    remember(byPath, relativePath, relativePath);
+    remember(byPathFolded, relativePath.toLowerCase(), relativePath);
+    const extension = path10.posix.extname(relativePath);
+    if (!SOURCE_EXTENSIONS.has(extension)) continue;
+    const stem = relativePath.slice(0, -extension.length);
+    remember(byStem, stem, relativePath);
+    remember(byStemFolded, stem.toLowerCase(), relativePath);
+    if (path10.posix.basename(stem) === "index") {
+      const directory = path10.posix.dirname(stem);
+      remember(byStem, directory, relativePath);
+      remember(byStemFolded, directory.toLowerCase(), relativePath);
+    }
+  }
+  return { byPath, byPathFolded, byStem, byStemFolded };
+}
+function resolveSpecifier(fromFile, specifier, resolver) {
   if (!RELATIVE_SPECIFIER.test(specifier)) return null;
-  const baseDir = path10.posix.dirname(fromFile);
-  const joined = path10.posix.normalize(path10.posix.join(baseDir, specifier));
-  const candidate = joined.replace(/\.(?:js|mjs|cjs|jsx)$/, "");
+  const joined = path10.posix.normalize(
+    path10.posix.join(path10.posix.dirname(fromFile), specifier)
+  );
+  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
+  const direct = exact(joined);
+  if (direct) return direct;
   for (const suffix of IMPORT_CANDIDATE_SUFFIXES) {
-    const withSuffix = `${joined}${suffix}`;
-    if (knownFiles.has(withSuffix)) return withSuffix;
+    const hit = exact(`${joined}${suffix}`);
+    if (hit) return hit;
   }
-  const extensionSwap = new RegExp(`${candidate}\\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$`);
-  for (const file of knownFiles) {
-    if (extensionSwap.test(file)) return file;
-  }
-  return null;
+  const stem = joined.replace(/\.(?:js|mjs|cjs|jsx)$/, "");
+  const byStem = (key) => resolver.byStem.get(key) ?? resolver.byStemFolded.get(key.toLowerCase()) ?? null;
+  return byStem(joined) ?? byStem(stem);
 }
 function buildIndexes(files) {
-  const knownFiles = new Set(files.map((file) => file.relativePath));
+  const resolver = buildImportResolver(files);
   const importerCounts = /* @__PURE__ */ new Map();
   const byFile = files.filter((file) => isSourceSummary(file.summary)).map((file) => {
     const summary = file.summary;
@@ -4615,7 +5518,7 @@ function buildIndexes(files) {
   });
   for (const entry of byFile) {
     for (const specifier of entry.imports) {
-      const resolved = resolveSpecifier(entry.path, specifier, knownFiles);
+      const resolved = resolveSpecifier(entry.path, specifier, resolver);
       if (resolved) importerCounts.set(resolved, (importerCounts.get(resolved) ?? 0) + 1);
     }
   }
@@ -4706,29 +5609,224 @@ function resolveSafeOutputDirs(config) {
   return { outDir, tmpDir };
 }
 var PLACEHOLDER_ENTRIES = /* @__PURE__ */ new Set([".gitkeep", ".gitignore", ".DS_Store"]);
+var RUN_DIR_PREFIX = "run-";
+var STALE_RUN_MS = 60 * 60 * 1e3;
+function maskPathText(value, secretRules) {
+  return findSecretInPath(value, secretRules)?.masked ?? value;
+}
+function maskSkipRecords(records, secretRules) {
+  return maskSkipPaths(records, secretRules);
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code !== "ESRCH";
+  }
+}
 var OWNERSHIP_MARKER = ".codebase-snapshot";
-function writeOwnershipMarker(dir) {
+var SUPPORTED_MARKER_SCHEMAS = /* @__PURE__ */ new Set([SCHEMA_VERSION]);
+var SNAPSHOT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function listEntries(dir) {
+  const entries = [];
+  const walk = (absolute, prefix) => {
+    let children;
+    try {
+      children = fs9.readdirSync(absolute, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const child of children) {
+      const relative4 = prefix === "" ? child.name : `${prefix}/${child.name}`;
+      entries.push(relative4);
+      if (child.isDirectory()) walk(path10.join(absolute, child.name), relative4);
+    }
+  };
+  walk(dir, "");
+  return entries.sort();
+}
+function markerPayload(dir, state, id, createdAt) {
   const marker2 = {
     generator: GENERATOR_NAME,
     version: GENERATOR_VERSION,
-    schemaVersion: SCHEMA_VERSION
+    schemaVersion: SCHEMA_VERSION,
+    createdAt,
+    state,
+    id,
+    pid: process.pid,
+    entries: listEntries(dir)
   };
-  fs9.writeFileSync(path10.join(dir, OWNERSHIP_MARKER), `${JSON.stringify(marker2, null, 2)}
-`, "utf8");
-}
-function isOwnOutput(dir) {
-  if (fs9.existsSync(path10.join(dir, OWNERSHIP_MARKER))) return true;
   const manifestPath = path10.join(dir, "manifest.json");
-  if (!fs9.existsSync(manifestPath)) return false;
+  if (fs9.existsSync(manifestPath)) {
+    marker2.manifestSha256 = sha256Hex2(fs9.readFileSync(manifestPath));
+  }
+  return marker2;
+}
+function writeOwnershipMarker(dir, marker2) {
+  fs9.writeFileSync(
+    path10.join(dir, OWNERSHIP_MARKER),
+    `${JSON.stringify(marker2, null, 2)}
+`,
+    "utf8"
+  );
+}
+function readOwnershipMarker(dir) {
+  const markerPath = path10.join(dir, OWNERSHIP_MARKER);
+  if (!fs9.existsSync(markerPath)) {
+    return { marker: null, problem: "it holds no .codebase-snapshot marker" };
+  }
+  let raw;
   try {
-    const parsed = JSON.parse(fs9.readFileSync(manifestPath, "utf8"));
-    const generator = parsed.generator;
-    return typeof parsed.schemaVersion === "string" && Array.isArray(parsed.files) && typeof generator === "object" && generator !== null && generator.name === GENERATOR_NAME;
+    raw = fs9.readFileSync(markerPath, "utf8");
   } catch {
-    return false;
+    return { marker: null, problem: "its .codebase-snapshot marker could not be read" };
+  }
+  if (raw.trim().length === 0) {
+    return { marker: null, problem: "its .codebase-snapshot marker is empty" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { marker: null, problem: "its .codebase-snapshot marker is not valid JSON" };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { marker: null, problem: "its .codebase-snapshot marker is not a JSON object" };
+  }
+  const candidate = parsed;
+  if (candidate.generator !== GENERATOR_NAME) {
+    return { marker: null, problem: "its .codebase-snapshot marker names a different generator" };
+  }
+  if (typeof candidate.schemaVersion !== "string" || !SUPPORTED_MARKER_SCHEMAS.has(candidate.schemaVersion)) {
+    return {
+      marker: null,
+      problem: `its .codebase-snapshot marker has a schema version this build does not understand (${String(candidate.schemaVersion)})`
+    };
+  }
+  if (typeof candidate.id !== "string" || !SNAPSHOT_ID_PATTERN.test(candidate.id)) {
+    return { marker: null, problem: "its .codebase-snapshot marker carries no snapshot id" };
+  }
+  if (candidate.state !== "staging" && candidate.state !== "complete") {
+    return { marker: null, problem: "its .codebase-snapshot marker records no run state" };
+  }
+  return {
+    marker: {
+      generator: GENERATOR_NAME,
+      version: typeof candidate.version === "string" ? candidate.version : "unknown",
+      schemaVersion: candidate.schemaVersion,
+      createdAt: typeof candidate.createdAt === "string" ? candidate.createdAt : "unknown",
+      state: candidate.state,
+      id: candidate.id,
+      pid: typeof candidate.pid === "number" ? candidate.pid : void 0,
+      manifestSha256: typeof candidate.manifestSha256 === "string" ? candidate.manifestSha256 : void 0,
+      entries: Array.isArray(candidate.entries) && candidate.entries.every((entry) => typeof entry === "string") ? candidate.entries : void 0
+    },
+    problem: null
+  };
+}
+function describeManifestProblem(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return "is not a JSON object";
+  const candidate = value;
+  const generator = candidate.generator;
+  if (typeof generator !== "object" || generator === null || generator.name !== GENERATOR_NAME) {
+    return "was not written by this generator";
+  }
+  if (!Array.isArray(candidate.files)) return "has no files array";
+  return null;
+}
+function assessSnapshotDirectory(dir) {
+  const { marker: marker2, problem } = readOwnershipMarker(dir);
+  if (!marker2) return { owned: false, problem, foreignEntries: [], marker: null };
+  if (marker2.state !== "complete") {
+    return {
+      owned: false,
+      problem: "its .codebase-snapshot marker records a run that never finished writing it",
+      foreignEntries: [],
+      marker: marker2
+    };
+  }
+  const manifestPath = path10.join(dir, "manifest.json");
+  if (fs9.existsSync(manifestPath)) {
+    let raw;
+    try {
+      raw = fs9.readFileSync(manifestPath, "utf8");
+    } catch {
+      return {
+        owned: false,
+        problem: "its manifest.json could not be read",
+        foreignEntries: [],
+        marker: marker2
+      };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return {
+        owned: false,
+        problem: "its manifest.json is not valid JSON",
+        foreignEntries: [],
+        marker: marker2
+      };
+    }
+    const manifestProblem2 = describeManifestProblem(parsed);
+    if (manifestProblem2) {
+      return {
+        owned: false,
+        problem: `its manifest.json ${manifestProblem2}`,
+        foreignEntries: [],
+        marker: marker2
+      };
+    }
+    if (!marker2.manifestSha256) {
+      return {
+        owned: false,
+        problem: "its .codebase-snapshot marker records no manifest digest",
+        foreignEntries: [],
+        marker: marker2
+      };
+    }
+    if (sha256Hex2(raw) !== marker2.manifestSha256) {
+      return {
+        owned: false,
+        problem: "its manifest.json does not match the digest recorded in its .codebase-snapshot marker",
+        foreignEntries: [],
+        marker: marker2
+      };
+    }
+  } else if (marker2.manifestSha256) {
+    return {
+      owned: false,
+      problem: "its manifest.json is missing although its marker records one",
+      foreignEntries: [],
+      marker: marker2
+    };
+  }
+  const recorded = new Set(marker2.entries ?? []);
+  if (recorded.size === 0) {
+    return {
+      owned: false,
+      problem: "its .codebase-snapshot marker records no contents",
+      foreignEntries: [],
+      marker: marker2
+    };
   }
+  const foreignEntries = listEntries(dir).filter(
+    (entry) => !recorded.has(entry) && !PLACEHOLDER_ENTRIES.has(entry)
+  );
+  return {
+    owned: foreignEntries.length === 0,
+    problem: null,
+    foreignEntries,
+    marker: marker2
+  };
+}
+function describeEntries(entries, limit = 5) {
+  const shown = entries.slice(0, limit).join(", ");
+  return entries.length > limit ? `${shown}, and ${entries.length - limit} more` : shown;
 }
-function assertReplaceable(target, label) {
+function assertReplaceable(target, label, secretRules) {
   if (!fs9.existsSync(target)) return;
   if (!fs9.statSync(target).isDirectory()) {
     throw new Error(
@@ -4736,26 +5834,210 @@ function assertReplaceable(target, label) {
     );
   }
   const entries = fs9.readdirSync(target);
-  const meaningful = entries.filter((name) => !PLACEHOLDER_ENTRIES.has(name));
-  if (meaningful.length === 0) return;
-  if (isOwnOutput(target)) return;
-  const preview = meaningful.slice(0, 5).join(", ");
-  const more = meaningful.length > 5 ? `, and ${meaningful.length - 5} more` : "";
+  if (entries.length === 0) return;
+  if (entries.every((name) => PLACEHOLDER_ENTRIES.has(name))) return;
+  const { problem } = readOwnershipMarker(target);
+  const verdict = assessSnapshotDirectory(target);
+  if (verdict.owned) return;
+  const shownForeign = verdict.foreignEntries.map((name) => maskPathText(name, secretRules));
+  const shownEntries = entries.map((name) => maskPathText(name, secretRules));
+  if (verdict.foreignEntries.length > 0) {
+    throw new Error(
+      `Refusing to replace ${label} ${target}: it carries this generator's ownership marker, but these entries are not part of the snapshot it recorded: ${describeEntries(shownForeign)}. Remove them yourself, or point ${label} at a new or empty directory.`
+    );
+  }
+  const reason = verdict.problem ?? problem ?? "it does not look like a snapshot this generator wrote";
   throw new Error(
-    `Refusing to replace ${label} ${target}: it exists, is not empty, and does not look like a snapshot this generator wrote (found ${preview}${more}). Point ${label} at a new or empty directory, or delete it yourself first.`
+    `Refusing to replace ${label} ${target}: ${reason} (found ${describeEntries(shownEntries)}). Remove the directory yourself, or point ${label} at a new or empty directory.`
   );
 }
-function swapIntoPlace(tmpDir, outDir) {
+function assertStagingRootUsable(tmpDir, secretRules) {
+  if (!fs9.existsSync(tmpDir)) return;
+  if (!fs9.statSync(tmpDir).isDirectory()) {
+    throw new Error(`Refusing to write into tmpDir ${tmpDir}: it exists but is not a directory.`);
+  }
+  const entries = fs9.readdirSync(tmpDir);
+  if (entries.length === 0) return;
+  const foreign = entries.filter((name) => {
+    const full = path10.join(tmpDir, name);
+    if (!name.startsWith(RUN_DIR_PREFIX)) return true;
+    let stats;
+    try {
+      stats = fs9.statSync(full);
+    } catch {
+      return true;
+    }
+    if (!stats.isDirectory()) return true;
+    const { marker: marker2 } = readOwnershipMarker(full);
+    if (marker2) return false;
+    try {
+      return fs9.readdirSync(full).length > 0;
+    } catch {
+      return true;
+    }
+  });
+  if (foreign.length > 0) {
+    const shown = describeEntries(foreign.map((name) => maskPathText(name, secretRules)));
+    throw new Error(
+      `Refusing to replace tmpDir ${tmpDir}: it holds ${shown}, which this generator did not write. Point tmpDir at a new or empty directory, or remove those files yourself.`
+    );
+  }
+}
+function cleanStaleRunDirs(tmpDir) {
+  let entries;
+  try {
+    entries = fs9.readdirSync(tmpDir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (!name.startsWith(RUN_DIR_PREFIX)) continue;
+    const full = path10.join(tmpDir, name);
+    const { marker: marker2 } = readOwnershipMarker(full);
+    if (marker2) {
+      const created = Date.parse(marker2.createdAt);
+      const aged = !Number.isFinite(created) || Date.now() - created > STALE_RUN_MS;
+      const abandoned = typeof marker2.pid === "number" && !isProcessAlive(marker2.pid);
+      if (aged || abandoned) {
+        try {
+          fs9.rmSync(full, { recursive: true, force: true });
+        } catch {
+        }
+      }
+      continue;
+    }
+    try {
+      if (fs9.readdirSync(full).length === 0) fs9.rmSync(full, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+function removeIfEmpty(dir) {
+  try {
+    if (fs9.readdirSync(dir).length === 0) fs9.rmSync(dir, { recursive: true, force: true });
+  } catch {
+  }
+}
+function ensureParentDirectory(target, label) {
+  const parent = path10.dirname(target);
+  if (fs9.existsSync(parent) && !fs9.statSync(parent).isDirectory()) {
+    throw new Error(
+      `Refusing to create ${label} ${target}: ${parent} exists but is not a directory.`
+    );
+  }
+  try {
+    fs9.mkdirSync(parent, { recursive: true });
+  } catch (err) {
+    throw new Error(
+      `Refusing to create ${label} ${target}: its parent ${parent} could not be created (${err.message}).`
+    );
+  }
+}
+function acquireRunLock(stagingRoot) {
+  const key = lockKeyFor(stagingRoot);
+  const lockPath = path10.join(os.tmpdir(), `codebase-snapshot-${key}.lock`);
+  const payload = `${JSON.stringify({
+    pid: process.pid,
+    stagingRoot,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  })}
+`;
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const handle = fs9.openSync(lockPath, "wx");
+      try {
+        fs9.writeSync(handle, payload);
+      } finally {
+        fs9.closeSync(handle);
+      }
+      return () => {
+        try {
+          fs9.rmSync(lockPath, { force: true });
+        } catch {
+        }
+      };
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (attempt === 0 && lockOwnerIsGone(lockPath)) {
+        fs9.rmSync(lockPath, { force: true });
+        continue;
+      }
+      throw new Error(
+        `Another generate run is already using the staging directory ${stagingRoot}. Wait for it to finish, or delete ${lockPath} if no other run is active.`
+      );
+    }
+  }
+  throw new Error(`Could not acquire the generate lock for ${stagingRoot}.`);
+}
+function lockKeyFor(stagingRoot) {
+  let key = stagingRoot;
+  try {
+    key = fs9.realpathSync(stagingRoot);
+  } catch {
+  }
+  if (process.platform === "win32" || process.platform === "darwin") key = key.toLowerCase();
+  return sha256Hex2(key).slice(0, 16);
+}
+function lockOwnerIsGone(lockPath) {
+  let raw;
+  try {
+    raw = fs9.readFileSync(lockPath, "utf8");
+  } catch {
+    return false;
+  }
+  let pid;
+  try {
+    pid = JSON.parse(raw).pid;
+  } catch {
+    return false;
+  }
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (err) {
+    return err.code === "ESRCH";
+  }
+}
+function writeManifestAtomically(manifestPath, manifest) {
+  const tempPath = `${manifestPath}.${process.pid}.tmp`;
+  fs9.writeFileSync(tempPath, JSON.stringify(manifest, null, 2), "utf8");
+  try {
+    fs9.renameSync(tempPath, manifestPath);
+  } catch (err) {
+    try {
+      fs9.rmSync(tempPath, { force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
+function swapIntoPlace(stagingDir, outDir) {
+  ensureParentDirectory(outDir, "outDir");
+  const deadline = Date.now() + 3e3;
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      swapOnce(stagingDir, outDir);
+      return;
+    } catch (err) {
+      const code = err.code;
+      const racy = code === "ENOENT" || code === "ENOTEMPTY" || code === "EEXIST" || code === "EPERM";
+      if (!racy || attempt >= 10 || Date.now() > deadline) throw err;
+      sleepSync(50);
+    }
+  }
+}
+function swapOnce(stagingDir, outDir) {
   const backupDir = `${outDir}.backup-${process.pid}-${Date.now()}`;
   const hadPrevious = fs9.existsSync(outDir);
   if (hadPrevious) fs9.renameSync(outDir, backupDir);
   try {
     try {
-      fs9.renameSync(tmpDir, outDir);
+      fs9.renameSync(stagingDir, outDir);
     } catch (err) {
       if (err.code === "EXDEV") {
-        fs9.cpSync(tmpDir, outDir, { recursive: true });
-        fs9.rmSync(tmpDir, { recursive: true, force: true });
+        fs9.cpSync(stagingDir, outDir, { recursive: true });
+        fs9.rmSync(stagingDir, { recursive: true, force: true });
       } else {
         throw err;
       }
@@ -4769,6 +6051,10 @@ function swapIntoPlace(tmpDir, outDir) {
     throw err;
   }
 }
+function sleepSync(milliseconds) {
+  const buffer = new Int32Array(new SharedArrayBuffer(4));
+  Atomics.wait(buffer, 0, 0, milliseconds);
+}
 function artifactWarnings(artifacts) {
   const messages = [];
   if (!artifacts.manifest) {
@@ -4831,10 +6117,12 @@ function generateSnapshot(configInput, options) {
   const collection = collectFiles(config.cwd, {
     includePatterns: config.include,
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
-    includeSensitiveFiles: config.includeSensitiveFiles
+    includeSensitiveFiles: config.includeSensitiveFiles,
+    secretRules: config.secretRules
   });
   const files = [];
-  const skipped = [...collection.skipped];
+  const monolithBodies = /* @__PURE__ */ new Map();
+  const skipped = maskSkipRecords([...collection.skipped], config.secretRules);
   const secretFindings = [];
   const warnings = [];
   const layerCounts = {};
@@ -4897,6 +6185,9 @@ function generateSnapshot(configInput, options) {
       isPreviewTruncated = preview.isTruncated;
       includedLines = preview.includedLines;
     }
+    if (config.includeMonolith && isPreviewTruncated) {
+      monolithBodies.set(relativePath, redacted);
+    }
     let summary;
     let summaryQuality;
     try {
@@ -4905,12 +6196,12 @@ function generateSnapshot(configInput, options) {
       summaryQuality = outcome?.quality;
       if (isSourceSummary(summary) && summary.parseErrors) {
         warnings.push(
-          `Parse errors in ${relativePath} (${summary.parseErrors}); its summary is incomplete.`
+          `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`
         );
       }
     } catch (err) {
       warnings.push(
-        `Summary skipped for ${relativePath}: ${err.message}`.replace(/\s+/g, " ")
+        `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(/\s+/g, " ")
       );
     }
     files.push({
@@ -4939,7 +6230,12 @@ function generateSnapshot(configInput, options) {
     ).join("\n")
   );
   const fullContents = /* @__PURE__ */ new Map();
-  for (const file of files) fullContents.set(file.relativePath, file.content ?? "");
+  for (const file of files) {
+    fullContents.set(
+      file.relativePath,
+      monolithBodies.get(file.relativePath) ?? file.content ?? ""
+    );
+  }
   const parts = partitionByBudget(files, config, fingerprint);
   const maxEffectiveBudget = Math.max(
     config.maxPartBytes,
@@ -5014,21 +6310,28 @@ function generateSnapshot(configInput, options) {
       const { content: _content, ...rest } = file;
       return rest;
     }),
-    skipped,
+    skipped: maskSkipRecords(skipped, config.secretRules),
     warnings
   };
   manifest.warnings = [
     ...warnings,
-    ...secretFindings.map((finding) => `${finding.rule} at ${finding.path ?? "unknown"}:${finding.line}`)
+    ...secretFindings.map((finding) => `${finding.rule} at ${maskPathText(finding.path ?? "unknown", config.secretRules)}:${finding.line}`)
   ];
   manifest.totals.warningCount = manifest.warnings.length;
   let monolithJson = null;
   let monolithMarkdown = null;
   if (config.includeMonolith) {
-    const fullFiles = files.map((file) => ({
-      ...file,
-      content: fullContents.get(file.relativePath) ?? ""
-    }));
+    const fullFiles = files.map((file) => {
+      const content = fullContents.get(file.relativePath) ?? "";
+      return {
+        ...file,
+        content,
+        inclusionMode: "full",
+        isPreviewTruncated: false,
+        includedBytes: Buffer.byteLength(content, "utf8"),
+        includedLines: countLines(content)
+      };
+    });
     const json = generateMonolithJson(manifest, fullFiles);
     const markdown = generateMonolithMarkdown(manifest, fullFiles);
     const jsonBytes = Buffer.byteLength(json, "utf8");
@@ -5056,62 +6359,97 @@ function generateSnapshot(configInput, options) {
   }
   for (const message of artifactWarnings(config.artifacts)) manifest.warnings.push(message);
   manifest.totals.warningCount = manifest.warnings.length;
+  const { outDir, tmpDir } = resolveSafeOutputDirs(config);
+  const { artifacts } = config;
+  assertReplaceable(outDir, "outDir", config.secretRules);
+  assertStagingRootUsable(tmpDir, config.secretRules);
   if (dryRun) {
     runAfterGenerate(config, manifest);
     return manifest;
   }
-  const { outDir, tmpDir } = resolveSafeOutputDirs(config);
-  assertReplaceable(tmpDir, "tmpDir");
-  assertReplaceable(outDir, "outDir");
-  const { artifacts } = config;
-  fs9.rmSync(tmpDir, { recursive: true, force: true });
-  fs9.mkdirSync(tmpDir, { recursive: true });
-  writeOwnershipMarker(tmpDir);
-  const partsDir = path10.join(tmpDir, "parts");
-  const reportsDir = path10.join(tmpDir, "reports");
-  if (artifacts.parts) fs9.mkdirSync(partsDir, { recursive: true });
-  if (artifacts.navigation || artifacts.projectTree || artifacts.audit) {
-    fs9.mkdirSync(reportsDir, { recursive: true });
-  }
-  if (artifacts.parts) {
-    for (const part of parts) {
-      fs9.writeFileSync(path10.join(partsDir, part.filename), part.markdown, "utf8");
+  const releaseLock = acquireRunLock(tmpDir);
+  let stagingDir = null;
+  try {
+    ensureParentDirectory(outDir, "outDir");
+    fs9.mkdirSync(tmpDir, { recursive: true });
+    cleanStaleRunDirs(tmpDir);
+    const snapshotId = crypto.randomUUID();
+    const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+    stagingDir = path10.join(tmpDir, `${RUN_DIR_PREFIX}${process.pid}-${snapshotId.slice(0, 8)}`);
+    fs9.mkdirSync(stagingDir);
+    writeOwnershipMarker(stagingDir, {
+      generator: GENERATOR_NAME,
+      version: GENERATOR_VERSION,
+      schemaVersion: SCHEMA_VERSION,
+      createdAt,
+      state: "staging",
+      id: snapshotId,
+      pid: process.pid
+    });
+    const partsDir = path10.join(stagingDir, "parts");
+    const reportsDir = path10.join(stagingDir, "reports");
+    if (artifacts.parts) fs9.mkdirSync(partsDir, { recursive: true });
+    if (artifacts.navigation || artifacts.projectTree || artifacts.audit) {
+      fs9.mkdirSync(reportsDir, { recursive: true });
+    }
+    if (artifacts.parts) {
+      for (const part of parts) {
+        fs9.writeFileSync(path10.join(partsDir, part.filename), part.markdown, "utf8");
+      }
     }
+    if (artifacts.projectTree) {
+      const projectTree = generateProjectTree(files.map((file) => file.relativePath));
+      fs9.writeFileSync(path10.join(reportsDir, "project-tree.md"), projectTree, "utf8");
+    }
+    if (artifacts.navigation) {
+      fs9.writeFileSync(path10.join(reportsDir, "navigation.md"), generateNavigation(manifest), "utf8");
+    }
+    if (artifacts.audit) {
+      fs9.writeFileSync(
+        path10.join(reportsDir, "audit.md"),
+        generateAuditReport(manifest, secretFindings, config.secretRules),
+        "utf8"
+      );
+    }
+    if (artifacts.readme) {
+      fs9.writeFileSync(path10.join(stagingDir, "README.md"), generateReadme(manifest), "utf8");
+    }
+    if (artifacts.manifest) {
+      fs9.writeFileSync(path10.join(stagingDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
+    }
+    if (monolithJson !== null) {
+      fs9.writeFileSync(path10.join(stagingDir, "full-codebase.json"), monolithJson, "utf8");
+    }
+    if (monolithMarkdown !== null) {
+      fs9.writeFileSync(path10.join(stagingDir, "full-codebase.md"), monolithMarkdown, "utf8");
+    }
+    writeOwnershipMarker(stagingDir, markerPayload(stagingDir, "complete", snapshotId, createdAt));
+    swapIntoPlace(stagingDir, outDir);
+    stagingDir = null;
+    const warningsBeforeHook = manifest.warnings.length;
+    runAfterGenerate(config, manifest);
+    if (artifacts.manifest && manifest.warnings.length !== warningsBeforeHook) {
+      writeManifestAtomically(path10.join(outDir, "manifest.json"), manifest);
+    }
+    writeOwnershipMarker(outDir, markerPayload(outDir, "complete", snapshotId, createdAt));
+    return manifest;
+  } catch (err) {
+    if (stagingDir !== null) {
+      try {
+        fs9.rmSync(stagingDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    throw err;
+  } finally {
+    removeIfEmpty(tmpDir);
+    releaseLock();
   }
-  if (artifacts.projectTree) {
-    const projectTree = generateProjectTree(files.map((file) => file.relativePath));
-    fs9.writeFileSync(path10.join(reportsDir, "project-tree.md"), projectTree, "utf8");
-  }
-  if (artifacts.navigation) {
-    fs9.writeFileSync(path10.join(reportsDir, "navigation.md"), generateNavigation(manifest), "utf8");
-  }
-  if (artifacts.audit) {
-    fs9.writeFileSync(
-      path10.join(reportsDir, "audit.md"),
-      generateAuditReport(manifest, secretFindings),
-      "utf8"
-    );
-  }
-  if (artifacts.readme) {
-    fs9.writeFileSync(path10.join(tmpDir, "README.md"), generateReadme(manifest), "utf8");
-  }
-  if (artifacts.manifest) {
-    fs9.writeFileSync(path10.join(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
-  }
-  if (monolithJson !== null) {
-    fs9.writeFileSync(path10.join(tmpDir, "full-codebase.json"), monolithJson, "utf8");
-  }
-  if (monolithMarkdown !== null) {
-    fs9.writeFileSync(path10.join(tmpDir, "full-codebase.md"), monolithMarkdown, "utf8");
-  }
-  swapIntoPlace(tmpDir, outDir);
-  runAfterGenerate(config, manifest);
-  return manifest;
 }
 async function generateSnapshotAsync(configInput, options) {
   return generateSnapshot(configInput, options);
 }
 
-export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countLines, defineConfig, detectLanguage, detectPreset, explainPath, fenceForContent, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renderMinimalConfig, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, unknownPresetMessage, validateSnapshot };
-//# sourceMappingURL=chunk-5B4UVQLR.js.map
-//# sourceMappingURL=chunk-5B4UVQLR.js.map
+export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countLines, defineConfig, detectLanguage, detectPreset, explainPath, fenceForContent, fenceForText, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renderMinimalConfig, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, unknownPresetMessage, validateSnapshot };
+//# sourceMappingURL=chunk-RGIMMEAW.js.map
+//# sourceMappingURL=chunk-RGIMMEAW.js.map