@fern-api/replay 0.16.0 → 0.16.1

package/dist/cli.cjs

@@ -5485,6 +5485,215 @@ var init_GitClient = __esm({
   }
 });
 
+// node_modules/balanced-match/index.js
+var require_balanced_match = __commonJS({
+  "node_modules/balanced-match/index.js"(exports2, module2) {
+    "use strict";
+    module2.exports = balanced;
+    function balanced(a, b, str) {
+      if (a instanceof RegExp) a = maybeMatch(a, str);
+      if (b instanceof RegExp) b = maybeMatch(b, str);
+      var r = range(a, b, str);
+      return r && {
+        start: r[0],
+        end: r[1],
+        pre: str.slice(0, r[0]),
+        body: str.slice(r[0] + a.length, r[1]),
+        post: str.slice(r[1] + b.length)
+      };
+    }
+    function maybeMatch(reg, str) {
+      var m = str.match(reg);
+      return m ? m[0] : null;
+    }
+    balanced.range = range;
+    function range(a, b, str) {
+      var begs, beg, left, right, result;
+      var ai = str.indexOf(a);
+      var bi = str.indexOf(b, ai + 1);
+      var i = ai;
+      if (ai >= 0 && bi > 0) {
+        if (a === b) {
+          return [ai, bi];
+        }
+        begs = [];
+        left = str.length;
+        while (i >= 0 && !result) {
+          if (i == ai) {
+            begs.push(i);
+            ai = str.indexOf(a, i + 1);
+          } else if (begs.length == 1) {
+            result = [begs.pop(), bi];
+          } else {
+            beg = begs.pop();
+            if (beg < left) {
+              left = beg;
+              right = bi;
+            }
+            bi = str.indexOf(b, i + 1);
+          }
+          i = ai < bi && ai >= 0 ? ai : bi;
+        }
+        if (begs.length) {
+          result = [left, right];
+        }
+      }
+      return result;
+    }
+  }
+});
+
+// node_modules/brace-expansion/index.js
+var require_brace_expansion = __commonJS({
+  "node_modules/brace-expansion/index.js"(exports2, module2) {
+    "use strict";
+    var balanced = require_balanced_match();
+    module2.exports = expandTop;
+    var escSlash = "\0SLASH" + Math.random() + "\0";
+    var escOpen = "\0OPEN" + Math.random() + "\0";
+    var escClose = "\0CLOSE" + Math.random() + "\0";
+    var escComma = "\0COMMA" + Math.random() + "\0";
+    var escPeriod = "\0PERIOD" + Math.random() + "\0";
+    function numeric(str) {
+      return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0);
+    }
+    function escapeBraces(str) {
+      return str.split("\\\\").join(escSlash).split("\\{").join(escOpen).split("\\}").join(escClose).split("\\,").join(escComma).split("\\.").join(escPeriod);
+    }
+    function unescapeBraces(str) {
+      return str.split(escSlash).join("\\").split(escOpen).join("{").split(escClose).join("}").split(escComma).join(",").split(escPeriod).join(".");
+    }
+    function parseCommaParts(str) {
+      if (!str)
+        return [""];
+      var parts = [];
+      var m = balanced("{", "}", str);
+      if (!m)
+        return str.split(",");
+      var pre = m.pre;
+      var body = m.body;
+      var post = m.post;
+      var p = pre.split(",");
+      p[p.length - 1] += "{" + body + "}";
+      var postParts = parseCommaParts(post);
+      if (post.length) {
+        p[p.length - 1] += postParts.shift();
+        p.push.apply(p, postParts);
+      }
+      parts.push.apply(parts, p);
+      return parts;
+    }
+    function expandTop(str) {
+      if (!str)
+        return [];
+      if (str.substr(0, 2) === "{}") {
+        str = "\\{\\}" + str.substr(2);
+      }
+      return expand2(escapeBraces(str), true).map(unescapeBraces);
+    }
+    function embrace(str) {
+      return "{" + str + "}";
+    }
+    function isPadded(el) {
+      return /^-?0\d/.test(el);
+    }
+    function lte(i, y) {
+      return i <= y;
+    }
+    function gte(i, y) {
+      return i >= y;
+    }
+    function expand2(str, isTop) {
+      var expansions = [];
+      var m = balanced("{", "}", str);
+      if (!m) return [str];
+      var pre = m.pre;
+      var post = m.post.length ? expand2(m.post, false) : [""];
+      if (/\$$/.test(m.pre)) {
+        for (var k = 0; k < post.length; k++) {
+          var expansion = pre + "{" + m.body + "}" + post[k];
+          expansions.push(expansion);
+        }
+      } else {
+        var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
+        var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
+        var isSequence = isNumericSequence || isAlphaSequence;
+        var isOptions = m.body.indexOf(",") >= 0;
+        if (!isSequence && !isOptions) {
+          if (m.post.match(/,(?!,).*\}/)) {
+            str = m.pre + "{" + m.body + escClose + m.post;
+            return expand2(str);
+          }
+          return [str];
+        }
+        var n;
+        if (isSequence) {
+          n = m.body.split(/\.\./);
+        } else {
+          n = parseCommaParts(m.body);
+          if (n.length === 1) {
+            n = expand2(n[0], false).map(embrace);
+            if (n.length === 1) {
+              return post.map(function(p) {
+                return m.pre + n[0] + p;
+              });
+            }
+          }
+        }
+        var N;
+        if (isSequence) {
+          var x = numeric(n[0]);
+          var y = numeric(n[1]);
+          var width = Math.max(n[0].length, n[1].length);
+          var incr = n.length == 3 ? Math.abs(numeric(n[2])) : 1;
+          var test = lte;
+          var reverse = y < x;
+          if (reverse) {
+            incr *= -1;
+            test = gte;
+          }
+          var pad = n.some(isPadded);
+          N = [];
+          for (var i = x; test(i, y); i += incr) {
+            var c;
+            if (isAlphaSequence) {
+              c = String.fromCharCode(i);
+              if (c === "\\")
+                c = "";
+            } else {
+              c = String(i);
+              if (pad) {
+                var need = width - c.length;
+                if (need > 0) {
+                  var z = new Array(need + 1).join("0");
+                  if (i < 0)
+                    c = "-" + z + c.slice(1);
+                  else
+                    c = z + c;
+                }
+              }
+            }
+            N.push(c);
+          }
+        } else {
+          N = [];
+          for (var j = 0; j < n.length; j++) {
+            N.push.apply(N, expand2(n[j], false));
+          }
+        }
+        for (var j = 0; j < N.length; j++) {
+          for (var k = 0; k < post.length; k++) {
+            var expansion = pre + N[j] + post[k];
+            if (!isTop || isSequence || expansion)
+              expansions.push(expansion);
+          }
+        }
+      }
+      return expansions;
+    }
+  }
+});
+
 // node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS({
   "node_modules/yaml/dist/nodes/identity.js"(exports2) {
@@ -12774,243 +12983,34 @@ var require_dist3 = __commonJS({
   }
 });
 
-// node_modules/balanced-match/index.js
-var require_balanced_match = __commonJS({
-  "node_modules/balanced-match/index.js"(exports2, module2) {
-    "use strict";
-    module2.exports = balanced;
-    function balanced(a, b, str) {
-      if (a instanceof RegExp) a = maybeMatch(a, str);
-      if (b instanceof RegExp) b = maybeMatch(b, str);
-      var r = range(a, b, str);
-      return r && {
-        start: r[0],
-        end: r[1],
-        pre: str.slice(0, r[0]),
-        body: str.slice(r[0] + a.length, r[1]),
-        post: str.slice(r[1] + b.length)
+// src/HybridReconstruction.ts
+var HybridReconstruction_exports = {};
+__export(HybridReconstruction_exports, {
+  assembleHybrid: () => assembleHybrid,
+  locateHunksInOurs: () => locateHunksInOurs,
+  parseHunks: () => parseHunks,
+  reconstructFromGhostPatch: () => reconstructFromGhostPatch
+});
+function parseHunks(fileDiff) {
+  const lines = fileDiff.split("\n");
+  const hunks = [];
+  let currentHunk = null;
+  for (const line of lines) {
+    const headerMatch = line.match(
+      /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/
+    );
+    if (headerMatch) {
+      if (currentHunk) {
+        hunks.push(currentHunk);
+      }
+      currentHunk = {
+        oldStart: parseInt(headerMatch[1], 10),
+        oldCount: headerMatch[2] != null ? parseInt(headerMatch[2], 10) : 1,
+        newStart: parseInt(headerMatch[3], 10),
+        newCount: headerMatch[4] != null ? parseInt(headerMatch[4], 10) : 1,
+        lines: []
       };
-    }
-    function maybeMatch(reg, str) {
-      var m = str.match(reg);
-      return m ? m[0] : null;
-    }
-    balanced.range = range;
-    function range(a, b, str) {
-      var begs, beg, left, right, result;
-      var ai = str.indexOf(a);
-      var bi = str.indexOf(b, ai + 1);
-      var i = ai;
-      if (ai >= 0 && bi > 0) {
-        if (a === b) {
-          return [ai, bi];
-        }
-        begs = [];
-        left = str.length;
-        while (i >= 0 && !result) {
-          if (i == ai) {
-            begs.push(i);
-            ai = str.indexOf(a, i + 1);
-          } else if (begs.length == 1) {
-            result = [begs.pop(), bi];
-          } else {
-            beg = begs.pop();
-            if (beg < left) {
-              left = beg;
-              right = bi;
-            }
-            bi = str.indexOf(b, i + 1);
-          }
-          i = ai < bi && ai >= 0 ? ai : bi;
-        }
-        if (begs.length) {
-          result = [left, right];
-        }
-      }
-      return result;
-    }
-  }
-});
-
-// node_modules/brace-expansion/index.js
-var require_brace_expansion = __commonJS({
-  "node_modules/brace-expansion/index.js"(exports2, module2) {
-    "use strict";
-    var balanced = require_balanced_match();
-    module2.exports = expandTop;
-    var escSlash = "\0SLASH" + Math.random() + "\0";
-    var escOpen = "\0OPEN" + Math.random() + "\0";
-    var escClose = "\0CLOSE" + Math.random() + "\0";
-    var escComma = "\0COMMA" + Math.random() + "\0";
-    var escPeriod = "\0PERIOD" + Math.random() + "\0";
-    function numeric(str) {
-      return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0);
-    }
-    function escapeBraces(str) {
-      return str.split("\\\\").join(escSlash).split("\\{").join(escOpen).split("\\}").join(escClose).split("\\,").join(escComma).split("\\.").join(escPeriod);
-    }
-    function unescapeBraces(str) {
-      return str.split(escSlash).join("\\").split(escOpen).join("{").split(escClose).join("}").split(escComma).join(",").split(escPeriod).join(".");
-    }
-    function parseCommaParts(str) {
-      if (!str)
-        return [""];
-      var parts = [];
-      var m = balanced("{", "}", str);
-      if (!m)
-        return str.split(",");
-      var pre = m.pre;
-      var body = m.body;
-      var post = m.post;
-      var p = pre.split(",");
-      p[p.length - 1] += "{" + body + "}";
-      var postParts = parseCommaParts(post);
-      if (post.length) {
-        p[p.length - 1] += postParts.shift();
-        p.push.apply(p, postParts);
-      }
-      parts.push.apply(parts, p);
-      return parts;
-    }
-    function expandTop(str) {
-      if (!str)
-        return [];
-      if (str.substr(0, 2) === "{}") {
-        str = "\\{\\}" + str.substr(2);
-      }
-      return expand2(escapeBraces(str), true).map(unescapeBraces);
-    }
-    function embrace(str) {
-      return "{" + str + "}";
-    }
-    function isPadded(el) {
-      return /^-?0\d/.test(el);
-    }
-    function lte(i, y) {
-      return i <= y;
-    }
-    function gte(i, y) {
-      return i >= y;
-    }
-    function expand2(str, isTop) {
-      var expansions = [];
-      var m = balanced("{", "}", str);
-      if (!m) return [str];
-      var pre = m.pre;
-      var post = m.post.length ? expand2(m.post, false) : [""];
-      if (/\$$/.test(m.pre)) {
-        for (var k = 0; k < post.length; k++) {
-          var expansion = pre + "{" + m.body + "}" + post[k];
-          expansions.push(expansion);
-        }
-      } else {
-        var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
-        var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
-        var isSequence = isNumericSequence || isAlphaSequence;
-        var isOptions = m.body.indexOf(",") >= 0;
-        if (!isSequence && !isOptions) {
-          if (m.post.match(/,(?!,).*\}/)) {
-            str = m.pre + "{" + m.body + escClose + m.post;
-            return expand2(str);
-          }
-          return [str];
-        }
-        var n;
-        if (isSequence) {
-          n = m.body.split(/\.\./);
-        } else {
-          n = parseCommaParts(m.body);
-          if (n.length === 1) {
-            n = expand2(n[0], false).map(embrace);
-            if (n.length === 1) {
-              return post.map(function(p) {
-                return m.pre + n[0] + p;
-              });
-            }
-          }
-        }
-        var N;
-        if (isSequence) {
-          var x = numeric(n[0]);
-          var y = numeric(n[1]);
-          var width = Math.max(n[0].length, n[1].length);
-          var incr = n.length == 3 ? Math.abs(numeric(n[2])) : 1;
-          var test = lte;
-          var reverse = y < x;
-          if (reverse) {
-            incr *= -1;
-            test = gte;
-          }
-          var pad = n.some(isPadded);
-          N = [];
-          for (var i = x; test(i, y); i += incr) {
-            var c;
-            if (isAlphaSequence) {
-              c = String.fromCharCode(i);
-              if (c === "\\")
-                c = "";
-            } else {
-              c = String(i);
-              if (pad) {
-                var need = width - c.length;
-                if (need > 0) {
-                  var z = new Array(need + 1).join("0");
-                  if (i < 0)
-                    c = "-" + z + c.slice(1);
-                  else
-                    c = z + c;
-                }
-              }
-            }
-            N.push(c);
-          }
-        } else {
-          N = [];
-          for (var j = 0; j < n.length; j++) {
-            N.push.apply(N, expand2(n[j], false));
-          }
-        }
-        for (var j = 0; j < N.length; j++) {
-          for (var k = 0; k < post.length; k++) {
-            var expansion = pre + N[j] + post[k];
-            if (!isTop || isSequence || expansion)
-              expansions.push(expansion);
-          }
-        }
-      }
-      return expansions;
-    }
-  }
-});
-
-// src/HybridReconstruction.ts
-var HybridReconstruction_exports = {};
-__export(HybridReconstruction_exports, {
-  assembleHybrid: () => assembleHybrid,
-  locateHunksInOurs: () => locateHunksInOurs,
-  parseHunks: () => parseHunks,
-  reconstructFromGhostPatch: () => reconstructFromGhostPatch
-});
-function parseHunks(fileDiff) {
-  const lines = fileDiff.split("\n");
-  const hunks = [];
-  let currentHunk = null;
-  for (const line of lines) {
-    const headerMatch = line.match(
-      /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/
-    );
-    if (headerMatch) {
-      if (currentHunk) {
-        hunks.push(currentHunk);
-      }
-      currentHunk = {
-        oldStart: parseInt(headerMatch[1], 10),
-        oldCount: headerMatch[2] != null ? parseInt(headerMatch[2], 10) : 1,
-        newStart: parseInt(headerMatch[3], 10),
-        newCount: headerMatch[4] != null ? parseInt(headerMatch[4], 10) : 1,
-        lines: []
-      };
-      continue;
+      continue;
     }
     if (!currentHunk) continue;
     if (line.startsWith("diff --git") || line.startsWith("index ") || line.startsWith("---") || line.startsWith("+++") || line.startsWith("old mode") || line.startsWith("new mode") || line.startsWith("similarity index") || line.startsWith("rename from") || line.startsWith("rename to") || line.startsWith("new file mode") || line.startsWith("deleted file mode")) {
@@ -13299,2244 +13299,2262 @@ init_GitClient();
 // src/LockfileManager.ts
 var import_node_fs = require("fs");
 var import_node_path2 = require("path");
-var import_yaml = __toESM(require_dist3(), 1);
 
-// src/credentials.ts
-var CREDENTIAL_PATTERNS = [
-  { name: "PRIVATE KEY block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
-  { name: "OPENSSH key", re: /-----BEGIN OPENSSH PRIVATE KEY-----/ },
-  { name: "RSA key", re: /-----BEGIN RSA PRIVATE KEY-----/ },
-  { name: "CERTIFICATE", re: /-----BEGIN CERTIFICATE-----/ },
-  { name: "TOKEN=", re: /\bTOKEN\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/ },
-  { name: "api_key=", re: /\bapi[_-]?key\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/i },
-  { name: "password=", re: /\bpassword\s*=\s*["']?[^\s"']{6,}/i },
-  { name: "AWS_SECRET_ACCESS_KEY", re: /AWS_SECRET_ACCESS_KEY/ },
-  { name: "JWT (eyJ...)", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ }
-];
-var SENSITIVE_FILE_PATTERNS = [
-  /(^|\/)\.env(\.[^/]+)?$/,
-  /\.pem$/,
-  /\.key$/,
-  /\.pkce_state\.json$/,
-  /(^|\/)id_rsa$/,
-  /(^|\/)id_ed25519$/
-];
-function isSensitiveFile(filePath) {
-  return SENSITIVE_FILE_PATTERNS.some((re) => re.test(filePath));
-}
-function scanForCredentials(content) {
-  const matches = [];
-  for (const { name, re } of CREDENTIAL_PATTERNS) {
-    if (re.test(content)) {
-      matches.push(name);
-    }
-  }
-  return matches;
-}
+// node_modules/minimatch/dist/esm/index.js
+var import_brace_expansion = __toESM(require_brace_expansion(), 1);
 
-// src/LockfileManager.ts
-var LOCKFILE_HEADER = "# DO NOT EDIT MANUALLY - Managed by Fern Replay\n";
-var LockfileNotFoundError = class extends Error {
-  constructor(path2) {
-    super(`Lockfile not found: ${path2}`);
-    this.name = "LockfileNotFoundError";
-  }
-};
-var LockfileManager = class {
-  outputDir;
-  lock = null;
-  warnings = [];
-  constructor(outputDir) {
-    this.outputDir = outputDir;
-  }
-  get lockfilePath() {
-    return (0, import_node_path2.join)(this.outputDir, ".fern", "replay.lock");
+// node_modules/minimatch/dist/esm/assert-valid-pattern.js
+var MAX_PATTERN_LENGTH = 1024 * 64;
+var assertValidPattern = (pattern) => {
+  if (typeof pattern !== "string") {
+    throw new TypeError("invalid pattern");
   }
-  get customizationsPath() {
-    return (0, import_node_path2.join)(this.outputDir, ".fern", "replay.yml");
+  if (pattern.length > MAX_PATTERN_LENGTH) {
+    throw new TypeError("pattern is too long");
   }
-  exists() {
-    return (0, import_node_fs.existsSync)(this.lockfilePath);
+};
+
+// node_modules/minimatch/dist/esm/brace-expressions.js
+var posixClasses = {
+  "[:alnum:]": ["\\p{L}\\p{Nl}\\p{Nd}", true],
+  "[:alpha:]": ["\\p{L}\\p{Nl}", true],
+  "[:ascii:]": ["\\x00-\\x7f", false],
+  "[:blank:]": ["\\p{Zs}\\t", true],
+  "[:cntrl:]": ["\\p{Cc}", true],
+  "[:digit:]": ["\\p{Nd}", true],
+  "[:graph:]": ["\\p{Z}\\p{C}", true, true],
+  "[:lower:]": ["\\p{Ll}", true],
+  "[:print:]": ["\\p{C}", true],
+  "[:punct:]": ["\\p{P}", true],
+  "[:space:]": ["\\p{Z}\\t\\r\\n\\v\\f", true],
+  "[:upper:]": ["\\p{Lu}", true],
+  "[:word:]": ["\\p{L}\\p{Nl}\\p{Nd}\\p{Pc}", true],
+  "[:xdigit:]": ["A-Fa-f0-9", false]
+};
+var braceEscape = (s) => s.replace(/[[\]\\-]/g, "\\$&");
+var regexpEscape = (s) => s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&");
+var rangesToString = (ranges) => ranges.join("");
+var parseClass = (glob, position) => {
+  const pos = position;
+  if (glob.charAt(pos) !== "[") {
+    throw new Error("not in a brace expression");
   }
-  read() {
-    if (this.lock) {
-      return this.lock;
+  const ranges = [];
+  const negs = [];
+  let i = pos + 1;
+  let sawStart = false;
+  let uflag = false;
+  let escaping = false;
+  let negate = false;
+  let endPos = pos;
+  let rangeStart = "";
+  WHILE: while (i < glob.length) {
+    const c = glob.charAt(i);
+    if ((c === "!" || c === "^") && i === pos + 1) {
+      negate = true;
+      i++;
+      continue;
     }
-    try {
-      const content = (0, import_node_fs.readFileSync)(this.lockfilePath, "utf-8");
-      this.lock = (0, import_yaml.parse)(content);
-      return this.lock;
-    } catch (error) {
-      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-        throw new LockfileNotFoundError(this.lockfilePath);
-      }
-      throw error;
+    if (c === "]" && sawStart && !escaping) {
+      endPos = i + 1;
+      break;
     }
-  }
-  initialize(firstGeneration) {
-    this.initializeInMemory(firstGeneration);
-    this.save();
-  }
-  /**
-   * Set up in-memory lock state without writing to disk.
-   * Useful for bootstrap dry-run where we need state for detection
-   * but don't want to persist anything.
-   */
-  initializeInMemory(firstGeneration) {
-    this.lock = {
-      version: "1.0",
-      generations: [firstGeneration],
-      current_generation: firstGeneration.commit_sha,
-      patches: []
-    };
-  }
-  save() {
-    if (!this.lock) {
-      throw new Error("No lockfile data to save. Call read() or initialize() first.");
+    sawStart = true;
+    if (c === "\\") {
+      if (!escaping) {
+        escaping = true;
+        i++;
+        continue;
+      }
     }
-    this.warnings.length = 0;
-    const cleanPatches = [];
-    for (const patch of this.lock.patches) {
-      const diffMatches = scanForCredentials(patch.patch_content);
-      const snapshotMatches = [];
-      if (patch.theirs_snapshot) {
-        for (const content2 of Object.values(patch.theirs_snapshot)) {
-          const m = scanForCredentials(content2);
-          for (const x of m) {
-            if (!snapshotMatches.includes(x)) snapshotMatches.push(x);
+    if (c === "[" && !escaping) {
+      for (const [cls, [unip, u, neg]] of Object.entries(posixClasses)) {
+        if (glob.startsWith(cls, i)) {
+          if (rangeStart) {
+            return ["$.", false, glob.length - pos, true];
           }
+          i += cls.length;
+          if (neg)
+            negs.push(unip);
+          else
+            ranges.push(unip);
+          uflag = uflag || u;
+          continue WHILE;
         }
       }
-      const credentialMatches = [...diffMatches, ...snapshotMatches.filter((m) => !diffMatches.includes(m))];
-      const sensitiveFiles = patch.files.filter((f) => isSensitiveFile(f));
-      if (credentialMatches.length > 0 || sensitiveFiles.length > 0) {
-        const reasons = [];
-        if (credentialMatches.length > 0) {
-          reasons.push(`credential patterns: ${credentialMatches.join(", ")}`);
-        }
-        if (sensitiveFiles.length > 0) {
-          reasons.push(`sensitive files: ${sensitiveFiles.join(", ")}`);
-        }
-        this.warnings.push(
-          `Patch ${patch.id} removed from lockfile: ${reasons.join("; ")}. This prevents credential exposure in committed lockfiles.`
-        );
-      } else {
-        cleanPatches.push(patch);
-      }
-    }
-    this.lock.patches = cleanPatches;
-    const dir = (0, import_node_path2.dirname)(this.lockfilePath);
-    if (!(0, import_node_fs.existsSync)(dir)) {
-      (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-    }
-    const yaml = (0, import_yaml.stringify)(this.lock, {
-      lineWidth: 0,
-      blockQuote: "literal"
-    });
-    const content = LOCKFILE_HEADER + yaml;
-    const tmpPath = this.lockfilePath + ".tmp";
-    (0, import_node_fs.writeFileSync)(tmpPath, content, "utf-8");
-    (0, import_node_fs.renameSync)(tmpPath, this.lockfilePath);
-  }
-  addGeneration(record) {
-    this.ensureLoaded();
-    this.lock.generations.push(record);
-    this.lock.current_generation = record.commit_sha;
-  }
-  addPatch(patch) {
-    this.ensureLoaded();
-    this.lock.patches.push(patch);
-  }
-  updatePatch(patchId, updates) {
-    this.ensureLoaded();
-    const patch = this.lock.patches.find((p) => p.id === patchId);
-    if (!patch) {
-      throw new Error(`Patch not found: ${patchId}`);
     }
-    Object.assign(patch, updates);
-  }
-  removePatch(patchId) {
-    this.ensureLoaded();
-    this.lock.patches = this.lock.patches.filter((p) => p.id !== patchId);
-  }
-  clearPatches() {
-    this.ensureLoaded();
-    this.lock.patches = [];
-  }
-  addForgottenHash(hash) {
-    this.ensureLoaded();
-    if (!this.lock.forgotten_hashes) {
-      this.lock.forgotten_hashes = [];
+    escaping = false;
+    if (rangeStart) {
+      if (c > rangeStart) {
+        ranges.push(braceEscape(rangeStart) + "-" + braceEscape(c));
+      } else if (c === rangeStart) {
+        ranges.push(braceEscape(c));
+      }
+      rangeStart = "";
+      i++;
+      continue;
     }
-    if (!this.lock.forgotten_hashes.includes(hash)) {
-      this.lock.forgotten_hashes.push(hash);
+    if (glob.startsWith("-]", i + 1)) {
+      ranges.push(braceEscape(c + "-"));
+      i += 2;
+      continue;
     }
-  }
-  getUnresolvedPatches() {
-    this.ensureLoaded();
-    return this.lock.patches.filter((p) => p.status === "unresolved");
-  }
-  getResolvingPatches() {
-    this.ensureLoaded();
-    return this.lock.patches.filter((p) => p.status === "resolving");
-  }
-  markPatchUnresolved(patchId) {
-    this.updatePatch(patchId, { status: "unresolved" });
-  }
-  markPatchResolved(patchId, updates) {
-    this.ensureLoaded();
-    const patch = this.lock.patches.find((p) => p.id === patchId);
-    if (!patch) {
-      throw new Error(`Patch not found: ${patchId}`);
+    if (glob.startsWith("-", i + 1)) {
+      rangeStart = c;
+      i += 2;
+      continue;
     }
-    delete patch.status;
-    Object.assign(patch, updates);
-  }
-  getPatches() {
-    this.ensureLoaded();
-    return this.lock.patches;
-  }
-  setReplaySkippedAt(timestamp) {
-    this.ensureLoaded();
-    this.lock.replay_skipped_at = timestamp;
+    ranges.push(braceEscape(c));
+    i++;
   }
-  clearReplaySkippedAt() {
-    this.ensureLoaded();
-    delete this.lock.replay_skipped_at;
+  if (endPos < i) {
+    return ["", false, 0, false];
   }
-  isReplaySkipped() {
-    this.ensureLoaded();
-    return this.lock.replay_skipped_at != null;
+  if (!ranges.length && !negs.length) {
+    return ["$.", false, glob.length - pos, true];
   }
-  getGeneration(commitSha) {
-    this.ensureLoaded();
-    return this.lock.generations.find((g) => g.commit_sha === commitSha);
-  }
-  getCustomizationsConfig() {
-    if (!(0, import_node_fs.existsSync)(this.customizationsPath)) {
-      return {};
-    }
-    const content = (0, import_node_fs.readFileSync)(this.customizationsPath, "utf-8");
-    return (0, import_yaml.parse)(content) ?? {};
-  }
-  ensureLoaded() {
-    if (!this.lock) {
-      throw new Error("No lockfile loaded. Call read() or initialize() first.");
-    }
+  if (negs.length === 0 && ranges.length === 1 && /^\\?.$/.test(ranges[0]) && !negate) {
+    const r = ranges[0].length === 2 ? ranges[0].slice(-1) : ranges[0];
+    return [regexpEscape(r), false, endPos - pos, false];
   }
+  const sranges = "[" + (negate ? "^" : "") + rangesToString(ranges) + "]";
+  const snegs = "[" + (negate ? "" : "^") + rangesToString(negs) + "]";
+  const comb = ranges.length && negs.length ? "(" + sranges + "|" + snegs + ")" : ranges.length ? sranges : snegs;
+  return [comb, uflag, endPos - pos, true];
 };
 
-// src/ReplayDetector.ts
-var import_node_crypto = require("crypto");
-
-// src/shared/binary.ts
-var import_node_path3 = require("path");
-var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
-  ".png",
-  ".jpg",
-  ".jpeg",
-  ".gif",
-  ".bmp",
-  ".ico",
-  ".webp",
-  ".svg",
-  ".pdf",
-  ".doc",
-  ".docx",
-  ".xls",
-  ".xlsx",
-  ".ppt",
-  ".pptx",
-  ".zip",
-  ".gz",
-  ".tar",
-  ".bz2",
-  ".7z",
-  ".rar",
-  ".jar",
-  ".war",
-  ".ear",
-  ".class",
-  ".exe",
-  ".dll",
-  ".so",
-  ".dylib",
-  ".o",
-  ".a",
-  ".woff",
-  ".woff2",
-  ".ttf",
-  ".eot",
-  ".otf",
-  ".mp3",
-  ".mp4",
-  ".avi",
-  ".mov",
-  ".wav",
-  ".flac",
-  ".sqlite",
-  ".db",
-  ".pyc",
-  ".pyo",
-  ".DS_Store"
-]);
-function isBinaryFile(filePath) {
-  const ext2 = (0, import_node_path3.extname)(filePath).toLowerCase();
-  return BINARY_EXTENSIONS.has(ext2);
-}
-
-// src/git/CommitDetection.ts
-var FERN_BOT_NAME = "fern-api";
-var FERN_BOT_EMAIL = "115122769+fern-api[bot]@users.noreply.github.com";
-var FERN_BOT_LOGIN = "fern-api[bot]";
-var FERN_SUPPORT_NAMES = ["fern-support", "Fern Support"];
-function isGenerationCommit(commit) {
-  const isFernSupport = FERN_SUPPORT_NAMES.includes(commit.authorName);
-  const isBotAuthor = !isFernSupport && (commit.authorLogin === FERN_BOT_LOGIN || commit.authorEmail === FERN_BOT_EMAIL || commit.authorName === FERN_BOT_NAME);
-  const hasGenerationMarker = commit.message.startsWith("[fern-generated]") || commit.message.startsWith("[fern-replay]") || commit.message.startsWith("[fern-autoversion]") || commit.message.includes("Generated by Fern") || commit.message.includes("\u{1F916} Generated with Fern") || // Squash merge of a Fern-generated PR uses the PR title as commit message.
-  // The default PR title is "SDK Generation" (from GithubStep's commitMessage default).
-  // GitHub appends "(#N)" for the PR number, e.g. "SDK Generation (#70)".
-  commit.message.startsWith("SDK Generation") || // Merge commit (GitHub's "Create a merge commit" option) of a fern-bot
-  // regen PR. First-parent walking lands on this commit, not on the
-  // generation commit on the side branch, so the classifier must treat
-  // it as a generation boundary. GitHub's default subject is
-  // "Merge pull request #N from <owner>/<branch>"; fern-bot branches are
-  // named "<owner>/fern-bot/<...>".
-  /^Merge pull request #\d+ from [^/]+\/fern-bot\//.test(commit.message);
-  return isBotAuthor || hasGenerationMarker;
-}
-function isGenerationBoundary(commit) {
-  const isFernSupport = FERN_SUPPORT_NAMES.includes(commit.authorName);
-  const isBotAuthor = !isFernSupport && (commit.authorLogin === FERN_BOT_LOGIN || commit.authorEmail === FERN_BOT_EMAIL || commit.authorName === FERN_BOT_NAME);
-  const isAutoversion = commit.message.startsWith("[fern-autoversion]");
-  const hasBoundaryMarker = commit.message.startsWith("[fern-generated]") || commit.message.startsWith("[fern-replay]") || commit.message.includes("Generated by Fern") || commit.message.includes("\u{1F916} Generated with Fern") || commit.message.startsWith("SDK Generation");
-  return isBotAuthor && !isAutoversion || hasBoundaryMarker;
-}
-function isReplayCommit(commit) {
-  return commit.message.startsWith("[fern-replay]");
-}
-function isRevertCommit(message) {
-  return /^Revert ".+"$/.test(message);
-}
-function parseRevertedSha(fullBody) {
-  const match2 = fullBody.match(/This reverts commit ([0-9a-f]{40})\./);
-  return match2?.[1];
-}
-function parseRevertedMessage(subject) {
-  const match2 = subject.match(/^Revert "(.+)"$/);
-  return match2?.[1];
-}
+// node_modules/minimatch/dist/esm/unescape.js
+var unescape = (s, { windowsPathsNoEscape = false } = {}) => {
+  return windowsPathsNoEscape ? s.replace(/\[([^\/\\])\]/g, "$1") : s.replace(/((?!\\).|^)\[([^\/\\])\]/g, "$1$2").replace(/\\([^\/])/g, "$1");
+};
 
-// src/ReplayDetector.ts
-var INFRASTRUCTURE_FILES = /* @__PURE__ */ new Set([".fernignore"]);
-function parsePatchFileHeaders(patchContent) {
-  const results = [];
-  let currentPath = null;
-  let currentIsCreate = false;
-  let currentIsDelete = false;
-  const flush = () => {
-    if (currentPath !== null) {
-      results.push({ path: currentPath, isCreate: currentIsCreate, isDelete: currentIsDelete });
+// node_modules/minimatch/dist/esm/ast.js
+var types = /* @__PURE__ */ new Set(["!", "?", "+", "*", "@"]);
+var isExtglobType = (c) => types.has(c);
+var startNoTraversal = "(?!(?:^|/)\\.\\.?(?:$|/))";
+var startNoDot = "(?!\\.)";
+var addPatternStart = /* @__PURE__ */ new Set(["[", "."]);
+var justDots = /* @__PURE__ */ new Set(["..", "."]);
+var reSpecials = new Set("().*{}+?[]^$\\!");
+var regExpEscape = (s) => s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&");
+var qmark = "[^/]";
+var star = qmark + "*?";
+var starNoEmpty = qmark + "+?";
+var AST = class _AST {
+  type;
+  #root;
+  #hasMagic;
+  #uflag = false;
+  #parts = [];
+  #parent;
+  #parentIndex;
+  #negs;
+  #filledNegs = false;
+  #options;
+  #toString;
+  // set to true if it's an extglob with no children
+  // (which really means one child of '')
+  #emptyExt = false;
+  constructor(type, parent, options = {}) {
+    this.type = type;
+    if (type)
+      this.#hasMagic = true;
+    this.#parent = parent;
+    this.#root = this.#parent ? this.#parent.#root : this;
+    this.#options = this.#root === this ? options : this.#root.#options;
+    this.#negs = this.#root === this ? [] : this.#root.#negs;
+    if (type === "!" && !this.#root.#filledNegs)
+      this.#negs.push(this);
+    this.#parentIndex = this.#parent ? this.#parent.#parts.length : 0;
+  }
+  get hasMagic() {
+    if (this.#hasMagic !== void 0)
+      return this.#hasMagic;
+    for (const p of this.#parts) {
+      if (typeof p === "string")
+        continue;
+      if (p.type || p.hasMagic)
+        return this.#hasMagic = true;
     }
-  };
-  for (const line of patchContent.split("\n")) {
-    if (line.startsWith("diff --git ")) {
-      flush();
-      currentPath = null;
-      currentIsCreate = false;
-      currentIsDelete = false;
-      const match2 = line.match(/^diff --git a\/(.+?) b\/(.+?)$/);
-      if (match2) {
-        currentPath = match2[2] ?? null;
+    return this.#hasMagic;
+  }
+  // reconstructs the pattern
+  toString() {
+    if (this.#toString !== void 0)
+      return this.#toString;
+    if (!this.type) {
+      return this.#toString = this.#parts.map((p) => String(p)).join("");
+    } else {
+      return this.#toString = this.type + "(" + this.#parts.map((p) => String(p)).join("|") + ")";
+    }
+  }
+  #fillNegs() {
+    if (this !== this.#root)
+      throw new Error("should only call on root");
+    if (this.#filledNegs)
+      return this;
+    this.toString();
+    this.#filledNegs = true;
+    let n;
+    while (n = this.#negs.pop()) {
+      if (n.type !== "!")
+        continue;
+      let p = n;
+      let pp = p.#parent;
+      while (pp) {
+        for (let i = p.#parentIndex + 1; !pp.type && i < pp.#parts.length; i++) {
+          for (const part of n.#parts) {
+            if (typeof part === "string") {
+              throw new Error("string part in extglob AST??");
+            }
+            part.copyIn(pp.#parts[i]);
+          }
+        }
+        p = pp;
+        pp = p.#parent;
       }
-    } else if (currentPath !== null) {
-      if (line.startsWith("new file mode ")) {
-        currentIsCreate = true;
-      } else if (line.startsWith("deleted file mode ")) {
-        currentIsDelete = true;
+    }
+    return this;
+  }
+  push(...parts) {
+    for (const p of parts) {
+      if (p === "")
+        continue;
+      if (typeof p !== "string" && !(p instanceof _AST && p.#parent === this)) {
+        throw new Error("invalid part: " + p);
       }
+      this.#parts.push(p);
     }
   }
-  flush();
-  return results;
-}
-async function capturePatchSnapshot(git, files, treeish) {
-  const snapshot = {};
-  for (const file of files) {
-    if (isBinaryFile(file)) continue;
-    const content = await git.showFile(treeish, file).catch(() => null);
-    if (content != null) snapshot[file] = content;
+  toJSON() {
+    const ret = this.type === null ? this.#parts.slice().map((p) => typeof p === "string" ? p : p.toJSON()) : [this.type, ...this.#parts.map((p) => p.toJSON())];
+    if (this.isStart() && !this.type)
+      ret.unshift([]);
+    if (this.isEnd() && (this === this.#root || this.#root.#filledNegs && this.#parent?.type === "!")) {
+      ret.push({});
+    }
+    return ret;
   }
-  return snapshot;
-}
-function filterInfrastructureAndSensitiveFiles(rawFilesOutput) {
-  const allFiles = rawFilesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f)).filter((f) => !f.startsWith(".fern/"));
-  const sensitiveFiles = allFiles.filter((f) => isSensitiveFile(f));
-  const files = allFiles.filter((f) => !isSensitiveFile(f));
-  return { files, sensitiveFiles };
-}
-var ReplayDetector = class {
-  git;
-  lockManager;
-  sdkOutputDir;
-  warnings = [];
-  constructor(git, lockManager, sdkOutputDir) {
-    this.git = git;
-    this.lockManager = lockManager;
-    this.sdkOutputDir = sdkOutputDir;
-  }
-  /**
-   * Derive the previous-generation SHA from git history instead of trusting
-   * `lock.current_generation`.
-   *
-   * Walks `git log HEAD --first-parent` and returns the SHA of the most recent
-   * commit that `isGenerationBoundary` classifies as a customization-baseline
-   * boundary, or null if no such commit is reachable from HEAD on the mainline.
-   *
-   * `isGenerationBoundary` is intentionally narrower than `isGenerationCommit`:
-   * it excludes `[fern-autoversion]` (lightweight bumps that don't reset the
-   * baseline) and the GitHub merge-commit subject for fern-bot regen PRs
-   * (which sits on first-parent but where the customer fix-up commits live
-   * on second-parent — stopping at the merge would hide them).
-   *
-   * See docs/adr/0001-derived-scan-boundary.md.
-   */
-  async findPreviousGenerationFromHistory() {
-    let log;
-    try {
-      log = await this.git.exec([
-        "log",
-        "--first-parent",
-        "--format=%H%x00%an%x00%ae%x00%s",
-        "HEAD"
-      ]);
-    } catch {
-      return null;
-    }
-    for (const commit of this.parseGitLog(log)) {
-      if (isGenerationBoundary(commit)) {
-        return commit.sha;
+  isStart() {
+    if (this.#root === this)
+      return true;
+    if (!this.#parent?.isStart())
+      return false;
+    if (this.#parentIndex === 0)
+      return true;
+    const p = this.#parent;
+    for (let i = 0; i < this.#parentIndex; i++) {
+      const pp = p.#parts[i];
+      if (!(pp instanceof _AST && pp.type === "!")) {
+        return false;
       }
     }
-    return null;
+    return true;
   }
-  async detectNewPatches() {
-    const lock = this.lockManager.read();
-    const derivedSha = await this.findPreviousGenerationFromHistory();
-    if (derivedSha !== null) {
-      const derivedRecord = await this.synthesizeGenerationRecord(derivedSha);
-      return this.detectPatchesInRange(derivedSha, derivedRecord, lock);
-    }
-    const lastGen = this.getLastGeneration(lock);
-    if (!lastGen) {
-      return { patches: [], revertedPatchIds: [] };
-    }
-    const exists2 = await this.git.commitExists(lastGen.commit_sha);
-    if (!exists2) {
-      this.warnings.push(
-        `Generation commit ${lastGen.commit_sha.slice(0, 7)} not found in git history. Falling back to tree-diff detection (likely a shallow clone).`
-      );
-      return this.detectPatchesViaTreeDiff(
-        lastGen,
-        /* commitKnownMissing */
-        true
-      );
+  isEnd() {
+    if (this.#root === this)
+      return true;
+    if (this.#parent?.type === "!")
+      return true;
+    if (!this.#parent?.isEnd())
+      return false;
+    if (!this.type)
+      return this.#parent?.isEnd();
+    const pl = this.#parent ? this.#parent.#parts.length : 0;
+    return this.#parentIndex === pl - 1;
+  }
+  copyIn(part) {
+    if (typeof part === "string")
+      this.push(part);
+    else
+      this.push(part.clone(this));
+  }
+  clone(parent) {
+    const c = new _AST(this.type, parent);
+    for (const p of this.#parts) {
+      c.copyIn(p);
     }
-    return this.detectPatchesInRange(lastGen.commit_sha, lastGen, lock);
+    return c;
   }
-  /**
-   * Walk `${rangeStart}..HEAD`, classify each commit, emit one
-   * `StoredPatch` per customer commit. Body shared by the linear path
-   * (rangeStart = lastGen.commit_sha) and the merge-base path.
-   *
-   * Patch `base_generation` is always `lastGen.commit_sha` — the
-   * lockfile-tracked reference the applicator uses to fetch base file
-   * content, regardless of where the walk actually started.
-   */
-  async detectPatchesInRange(rangeStart, lastGen, lock) {
-    const log = await this.git.exec([
-      "log",
-      "--no-merges",
-      "--format=%H%x00%an%x00%ae%x00%s",
-      `${rangeStart}..HEAD`,
-      "--",
-      this.sdkOutputDir
-    ]);
-    if (!log.trim()) {
-      return { patches: [], revertedPatchIds: [] };
+  static #parseAST(str, ast, pos, opt) {
+    let escaping = false;
+    let inBrace = false;
+    let braceStart = -1;
+    let braceNeg = false;
+    if (ast.type === null) {
+      let i2 = pos;
+      let acc2 = "";
+      while (i2 < str.length) {
+        const c = str.charAt(i2++);
+        if (escaping || c === "\\") {
+          escaping = !escaping;
+          acc2 += c;
+          continue;
+        }
+        if (inBrace) {
+          if (i2 === braceStart + 1) {
+            if (c === "^" || c === "!") {
+              braceNeg = true;
+            }
+          } else if (c === "]" && !(i2 === braceStart + 2 && braceNeg)) {
+            inBrace = false;
+          }
+          acc2 += c;
+          continue;
+        } else if (c === "[") {
+          inBrace = true;
+          braceStart = i2;
+          braceNeg = false;
+          acc2 += c;
+          continue;
+        }
+        if (!opt.noext && isExtglobType(c) && str.charAt(i2) === "(") {
+          ast.push(acc2);
+          acc2 = "";
+          const ext2 = new _AST(c, ast);
+          i2 = _AST.#parseAST(str, ext2, i2, opt);
+          ast.push(ext2);
+          continue;
+        }
+        acc2 += c;
+      }
+      ast.push(acc2);
+      return i2;
     }
-    const commits = this.parseGitLog(log);
-    const newPatches = [];
-    const forgottenHashes = new Set(lock.forgotten_hashes ?? []);
-    for (const commit of commits) {
-      if (isGenerationCommit(commit)) {
+    let i = pos + 1;
+    let part = new _AST(null, ast);
+    const parts = [];
+    let acc = "";
+    while (i < str.length) {
+      const c = str.charAt(i++);
+      if (escaping || c === "\\") {
+        escaping = !escaping;
+        acc += c;
         continue;
       }
-      if (lock.patches.find((p) => p.original_commit === commit.sha)) {
+      if (inBrace) {
+        if (i === braceStart + 1) {
+          if (c === "^" || c === "!") {
+            braceNeg = true;
+          }
+        } else if (c === "]" && !(i === braceStart + 2 && braceNeg)) {
+          inBrace = false;
+        }
+        acc += c;
+        continue;
+      } else if (c === "[") {
+        inBrace = true;
+        braceStart = i;
+        braceNeg = false;
+        acc += c;
         continue;
       }
-      const parents = await this.git.getCommitParents(commit.sha);
-      let patchContent;
-      try {
-        patchContent = await this.git.formatPatch(commit.sha);
-      } catch {
-        this.warnings.push(
-          `Could not generate patch for commit ${commit.sha.slice(0, 7)} \u2014 it may be unreachable in a shallow clone. Skipping.`
-        );
+      if (isExtglobType(c) && str.charAt(i) === "(") {
+        part.push(acc);
+        acc = "";
+        const ext2 = new _AST(c, part);
+        part.push(ext2);
+        i = _AST.#parseAST(str, ext2, i, opt);
         continue;
       }
-      let contentHash = this.computeContentHash(patchContent);
-      if (lock.patches.find((p) => p.content_hash === contentHash) || forgottenHashes.has(contentHash)) {
+      if (c === "|") {
+        part.push(acc);
+        acc = "";
+        parts.push(part);
+        part = new _AST(null, ast);
         continue;
       }
-      const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
-      const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
-      if (sensitiveFiles.length > 0) {
-        this.warnings.push(
-          `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
-        );
-        if (files.length > 0) {
-          const parentSha = parents[0];
-          if (parentSha) {
-            try {
-              patchContent = await this.git.exec(["diff", parentSha, commit.sha, "--", ...files]);
-            } catch {
-              continue;
-            }
-            if (!patchContent.trim()) continue;
-            contentHash = this.computeContentHash(patchContent);
-          }
+      if (c === ")") {
+        if (acc === "" && ast.#parts.length === 0) {
+          ast.#emptyExt = true;
         }
+        part.push(acc);
+        acc = "";
+        ast.push(...parts, part);
+        return i;
       }
-      if (files.length === 0) {
-        continue;
-      }
-      const theirsSnapshot = await capturePatchSnapshot(this.git, files, commit.sha);
-      newPatches.push({
-        id: `patch-${commit.sha.slice(0, 8)}`,
-        content_hash: contentHash,
-        original_commit: commit.sha,
-        original_message: commit.message,
-        original_author: `${commit.authorName} <${commit.authorEmail}>`,
-        base_generation: lastGen.commit_sha,
-        files,
-        patch_content: patchContent,
-        ...Object.keys(theirsSnapshot).length > 0 ? { theirs_snapshot: theirsSnapshot } : {},
-        ...this.isCreationOnlyPatch(patchContent) ? { user_owned: true } : {}
-      });
+      acc += c;
     }
-    const survivingPatches = await this.collapseNetZeroFiles(newPatches);
-    survivingPatches.reverse();
-    const revertedPatchIdSet = /* @__PURE__ */ new Set();
-    const revertIndicesToRemove = /* @__PURE__ */ new Set();
-    for (let i = 0; i < survivingPatches.length; i++) {
-      const patch = survivingPatches[i];
-      if (!isRevertCommit(patch.original_message)) continue;
-      let body = "";
-      try {
-        body = await this.git.getCommitBody(patch.original_commit);
-      } catch {
-      }
-      const revertedSha = parseRevertedSha(body);
-      const revertedMessage = parseRevertedMessage(patch.original_message);
-      let matchedExisting = false;
-      if (revertedSha) {
-        const existing = lock.patches.find((p) => p.original_commit === revertedSha);
-        if (existing) {
-          revertedPatchIdSet.add(existing.id);
-          revertIndicesToRemove.add(i);
-          matchedExisting = true;
+    ast.type = null;
+    ast.#hasMagic = void 0;
+    ast.#parts = [str.substring(pos - 1)];
+    return i;
+  }
+  static fromGlob(pattern, options = {}) {
+    const ast = new _AST(null, void 0, options);
+    _AST.#parseAST(pattern, ast, 0, options);
+    return ast;
+  }
+  // returns the regular expression if there's magic, or the unescaped
+  // string if not.
+  toMMPattern() {
+    if (this !== this.#root)
+      return this.#root.toMMPattern();
+    const glob = this.toString();
+    const [re, body, hasMagic, uflag] = this.toRegExpSource();
+    const anyMagic = hasMagic || this.#hasMagic || this.#options.nocase && !this.#options.nocaseMagicOnly && glob.toUpperCase() !== glob.toLowerCase();
+    if (!anyMagic) {
+      return body;
+    }
+    const flags = (this.#options.nocase ? "i" : "") + (uflag ? "u" : "");
+    return Object.assign(new RegExp(`^${re}$`, flags), {
+      _src: re,
+      _glob: glob
+    });
+  }
+  get options() {
+    return this.#options;
+  }
+  // returns the string match, the regexp source, whether there's magic
+  // in the regexp (so a regular expression is required) and whether or
+  // not the uflag is needed for the regular expression (for posix classes)
+  // TODO: instead of injecting the start/end at this point, just return
+  // the BODY of the regexp, along with the start/end portions suitable
+  // for binding the start/end in either a joined full-path makeRe context
+  // (where we bind to (^|/), or a standalone matchPart context (where
+  // we bind to ^, and not /).  Otherwise slashes get duped!
+  //
+  // In part-matching mode, the start is:
+  // - if not isStart: nothing
+  // - if traversal possible, but not allowed: ^(?!\.\.?$)
+  // - if dots allowed or not possible: ^
+  // - if dots possible and not allowed: ^(?!\.)
+  // end is:
+  // - if not isEnd(): nothing
+  // - else: $
+  //
+  // In full-path matching mode, we put the slash at the START of the
+  // pattern, so start is:
+  // - if first pattern: same as part-matching mode
+  // - if not isStart(): nothing
+  // - if traversal possible, but not allowed: /(?!\.\.?(?:$|/))
+  // - if dots allowed or not possible: /
+  // - if dots possible and not allowed: /(?!\.)
+  // end is:
+  // - if last pattern, same as part-matching mode
+  // - else nothing
+  //
+  // Always put the (?:$|/) on negated tails, though, because that has to be
+  // there to bind the end of the negated pattern portion, and it's easier to
+  // just stick it in now rather than try to inject it later in the middle of
+  // the pattern.
+  //
+  // We can just always return the same end, and leave it up to the caller
+  // to know whether it's going to be used joined or in parts.
+  // And, if the start is adjusted slightly, can do the same there:
+  // - if not isStart: nothing
+  // - if traversal possible, but not allowed: (?:/|^)(?!\.\.?$)
+  // - if dots allowed or not possible: (?:/|^)
+  // - if dots possible and not allowed: (?:/|^)(?!\.)
+  //
+  // But it's better to have a simpler binding without a conditional, for
+  // performance, so probably better to return both start options.
+  //
+  // Then the caller just ignores the end if it's not the first pattern,
+  // and the start always gets applied.
+  //
+  // But that's always going to be $ if it's the ending pattern, or nothing,
+  // so the caller can just attach $ at the end of the pattern when building.
+  //
+  // So the todo is:
+  // - better detect what kind of start is needed
+  // - return both flavors of starting pattern
+  // - attach $ at the end of the pattern when creating the actual RegExp
+  //
+  // Ah, but wait, no, that all only applies to the root when the first pattern
+  // is not an extglob. If the first pattern IS an extglob, then we need all
+  // that dot prevention biz to live in the extglob portions, because eg
+  // +(*|.x*) can match .xy but not .yx.
+  //
+  // So, return the two flavors if it's #root and the first child is not an
+  // AST, otherwise leave it to the child AST to handle it, and there,
+  // use the (?:^|/) style of start binding.
+  //
+  // Even simplified further:
+  // - Since the start for a join is eg /(?!\.) and the start for a part
+  // is ^(?!\.), we can just prepend (?!\.) to the pattern (either root
+  // or start or whatever) and prepend ^ or / at the Regexp construction.
+  toRegExpSource(allowDot) {
+    const dot = allowDot ?? !!this.#options.dot;
+    if (this.#root === this)
+      this.#fillNegs();
+    if (!this.type) {
+      const noEmpty = this.isStart() && this.isEnd();
+      const src = this.#parts.map((p) => {
+        const [re, _, hasMagic, uflag] = typeof p === "string" ? _AST.#parseGlob(p, this.#hasMagic, noEmpty) : p.toRegExpSource(allowDot);
+        this.#hasMagic = this.#hasMagic || hasMagic;
+        this.#uflag = this.#uflag || uflag;
+        return re;
+      }).join("");
+      let start2 = "";
+      if (this.isStart()) {
+        if (typeof this.#parts[0] === "string") {
+          const dotTravAllowed = this.#parts.length === 1 && justDots.has(this.#parts[0]);
+          if (!dotTravAllowed) {
+            const aps = addPatternStart;
+            const needNoTrav = (
+              // dots are allowed, and the pattern starts with [ or .
+              dot && aps.has(src.charAt(0)) || // the pattern starts with \., and then [ or .
+              src.startsWith("\\.") && aps.has(src.charAt(2)) || // the pattern starts with \.\., and then [ or .
+              src.startsWith("\\.\\.") && aps.has(src.charAt(4))
+            );
+            const needNoDot = !dot && !allowDot && aps.has(src.charAt(0));
+            start2 = needNoTrav ? startNoTraversal : needNoDot ? startNoDot : "";
+          }
         }
       }
-      if (!matchedExisting && revertedMessage) {
-        const existing = lock.patches.find((p) => p.original_message === revertedMessage);
-        if (existing) {
-          revertedPatchIdSet.add(existing.id);
-          revertIndicesToRemove.add(i);
-          matchedExisting = true;
-        }
+      let end = "";
+      if (this.isEnd() && this.#root.#filledNegs && this.#parent?.type === "!") {
+        end = "(?:$|\\/)";
       }
-      if (matchedExisting) continue;
-      let matchedNew = false;
-      if (revertedSha) {
-        const idx = survivingPatches.findIndex(
-          (p, j) => j !== i && !revertIndicesToRemove.has(j) && p.original_commit === revertedSha
-        );
-        if (idx !== -1) {
-          revertIndicesToRemove.add(i);
-          revertIndicesToRemove.add(idx);
-          matchedNew = true;
+      const final2 = start2 + src + end;
+      return [
+        final2,
+        unescape(src),
+        this.#hasMagic = !!this.#hasMagic,
+        this.#uflag
+      ];
+    }
+    const repeated = this.type === "*" || this.type === "+";
+    const start = this.type === "!" ? "(?:(?!(?:" : "(?:";
+    let body = this.#partsToRegExp(dot);
+    if (this.isStart() && this.isEnd() && !body && this.type !== "!") {
+      const s = this.toString();
+      this.#parts = [s];
+      this.type = null;
+      this.#hasMagic = void 0;
+      return [s, unescape(this.toString()), false, false];
+    }
+    let bodyDotAllowed = !repeated || allowDot || dot || !startNoDot ? "" : this.#partsToRegExp(true);
+    if (bodyDotAllowed === body) {
+      bodyDotAllowed = "";
+    }
+    if (bodyDotAllowed) {
+      body = `(?:${body})(?:${bodyDotAllowed})*?`;
+    }
+    let final = "";
+    if (this.type === "!" && this.#emptyExt) {
+      final = (this.isStart() && !dot ? startNoDot : "") + starNoEmpty;
+    } else {
+      const close = this.type === "!" ? (
+        // !() must match something,but !(x) can match ''
+        "))" + (this.isStart() && !dot && !allowDot ? startNoDot : "") + star + ")"
+      ) : this.type === "@" ? ")" : this.type === "?" ? ")?" : this.type === "+" && bodyDotAllowed ? ")" : this.type === "*" && bodyDotAllowed ? `)?` : `)${this.type}`;
+      final = start + body + close;
+    }
+    return [
+      final,
+      unescape(body),
+      this.#hasMagic = !!this.#hasMagic,
+      this.#uflag
+    ];
+  }
+  #partsToRegExp(dot) {
+    return this.#parts.map((p) => {
+      if (typeof p === "string") {
+        throw new Error("string type in extglob ast??");
+      }
+      const [re, _, _hasMagic, uflag] = p.toRegExpSource(dot);
+      this.#uflag = this.#uflag || uflag;
+      return re;
+    }).filter((p) => !(this.isStart() && this.isEnd()) || !!p).join("|");
+  }
+  static #parseGlob(glob, hasMagic, noEmpty = false) {
+    let escaping = false;
+    let re = "";
+    let uflag = false;
+    for (let i = 0; i < glob.length; i++) {
+      const c = glob.charAt(i);
+      if (escaping) {
+        escaping = false;
+        re += (reSpecials.has(c) ? "\\" : "") + c;
+        continue;
+      }
+      if (c === "\\") {
+        if (i === glob.length - 1) {
+          re += "\\\\";
+        } else {
+          escaping = true;
         }
+        continue;
       }
-      if (!matchedNew && revertedMessage) {
-        const idx = survivingPatches.findIndex(
-          (p, j) => j !== i && !revertIndicesToRemove.has(j) && p.original_message === revertedMessage
-        );
-        if (idx !== -1) {
-          revertIndicesToRemove.add(i);
-          revertIndicesToRemove.add(idx);
+      if (c === "[") {
+        const [src, needUflag, consumed, magic] = parseClass(glob, i);
+        if (consumed) {
+          re += src;
+          uflag = uflag || needUflag;
+          i += consumed - 1;
+          hasMagic = hasMagic || magic;
+          continue;
         }
       }
-      if (!matchedExisting && !matchedNew) {
-        revertIndicesToRemove.add(i);
+      if (c === "*") {
+        if (noEmpty && glob === "*")
+          re += starNoEmpty;
+        else
+          re += star;
+        hasMagic = true;
+        continue;
+      }
+      if (c === "?") {
+        re += qmark;
+        hasMagic = true;
+        continue;
       }
+      re += regExpEscape(c);
     }
-    const filteredPatches = survivingPatches.filter((_, i) => !revertIndicesToRemove.has(i));
-    return { patches: filteredPatches, revertedPatchIds: [...revertedPatchIdSet] };
+    return [re, unescape(glob), !!hasMagic, uflag];
   }
-  /**
-   * Compute content hash for deduplication.
-   *
-   * Produces a format-agnostic hash so both `git format-patch` output
-   * (email-wrapped) and plain `git diff` output hash to the same value
-   * when the underlying diff hunks are identical.
-   *
-   * Normalization:
-   *   1. Strip email wrapper: everything before the first `diff --git` line
-   *      (From:, Subject:, Date:, diffstat, blank separators).
-   *   2. Strip `index` lines (blob SHA pairs change across rebases).
-   *   3. Strip trailing git version marker (`-- \n<version>`).
-   *
-   * This ensures content hashes match across the no-patches and normal-
-   * regeneration flows, which store formatPatch and git-diff formats
-   * respectively.
-   */
-  computeContentHash(patchContent) {
-    const lines = patchContent.split("\n");
-    const diffStart = lines.findIndex((l) => l.startsWith("diff --git "));
-    const relevantLines = diffStart > 0 ? lines.slice(diffStart) : lines;
-    const normalized = relevantLines.filter((line) => !line.startsWith("index ")).join("\n").replace(/\n-- \n[\d]+\.[\d]+[^\n]*\s*$/, "");
-    return `sha256:${(0, import_node_crypto.createHash)("sha256").update(normalized).digest("hex")}`;
+};
+
+// node_modules/minimatch/dist/esm/escape.js
+var escape = (s, { windowsPathsNoEscape = false } = {}) => {
+  return windowsPathsNoEscape ? s.replace(/[?*()[\]]/g, "[$&]") : s.replace(/[?*()[\]\\]/g, "\\$&");
+};
+
+// node_modules/minimatch/dist/esm/index.js
+var minimatch = (p, pattern, options = {}) => {
+  assertValidPattern(pattern);
+  if (!options.nocomment && pattern.charAt(0) === "#") {
+    return false;
   }
-  /**
-   * Drop patches whose files were transiently created and then deleted
-   * within the current linear detection window, and are absent from
-   * HEAD at the end of the window.
-   *
-   * Rationale: each commit becomes its own patch, so a file that was
-   * briefly added and later removed survives as a create+delete pair whose
-   * cumulative diff is empty. We drop such patches before they reach the
-   * lockfile.
-   *
-   * A file is "transient" when:
-   *   1. some patch in the window sets `new file mode` for it (a creation), AND
-   *   2. some patch in the window sets `deleted file mode` for it (a deletion), AND
-   *   3. it is absent from HEAD's tree.
-   *
-   * The HEAD guard (#3) prevents false positives when a file is deleted
-   * and then recreated with different content — the cumulative diff of
-   * such a pair is non-empty and must be preserved.
-   *
-   * This only drops patches whose `files` are a subset of the transient
-   * set. A partial-transient patch (one that touches a transient file
-   * alongside a persistent one) is left unmodified; surgical stripping of
-   * single files from a multi-file patch would require a follow-up that
-   * regenerates the patch content via `git format-patch -- <files>`. No
-   * current failing test exercises this, and leaving the patch intact
-   * preserves today's behaviour. Revisit if a future adversarial test
-   * demands per-file stripping.
-   */
-  async collapseNetZeroFiles(patches) {
-    if (patches.length === 0) return patches;
-    const stateByFile = /* @__PURE__ */ new Map();
-    for (const patch of patches) {
-      for (const header of parsePatchFileHeaders(patch.patch_content)) {
-        if (!header.isCreate && !header.isDelete) continue;
-        const prior = stateByFile.get(header.path) ?? { created: false, deleted: false };
-        if (header.isCreate) prior.created = true;
-        if (header.isDelete) prior.deleted = true;
-        stateByFile.set(header.path, prior);
+  return new Minimatch(pattern, options).match(p);
+};
+var starDotExtRE = /^\*+([^+@!?\*\[\(]*)$/;
+var starDotExtTest = (ext2) => (f) => !f.startsWith(".") && f.endsWith(ext2);
+var starDotExtTestDot = (ext2) => (f) => f.endsWith(ext2);
+var starDotExtTestNocase = (ext2) => {
+  ext2 = ext2.toLowerCase();
+  return (f) => !f.startsWith(".") && f.toLowerCase().endsWith(ext2);
+};
+var starDotExtTestNocaseDot = (ext2) => {
+  ext2 = ext2.toLowerCase();
+  return (f) => f.toLowerCase().endsWith(ext2);
+};
+var starDotStarRE = /^\*+\.\*+$/;
+var starDotStarTest = (f) => !f.startsWith(".") && f.includes(".");
+var starDotStarTestDot = (f) => f !== "." && f !== ".." && f.includes(".");
+var dotStarRE = /^\.\*+$/;
+var dotStarTest = (f) => f !== "." && f !== ".." && f.startsWith(".");
+var starRE = /^\*+$/;
+var starTest = (f) => f.length !== 0 && !f.startsWith(".");
+var starTestDot = (f) => f.length !== 0 && f !== "." && f !== "..";
+var qmarksRE = /^\?+([^+@!?\*\[\(]*)?$/;
+var qmarksTestNocase = ([$0, ext2 = ""]) => {
+  const noext = qmarksTestNoExt([$0]);
+  if (!ext2)
+    return noext;
+  ext2 = ext2.toLowerCase();
+  return (f) => noext(f) && f.toLowerCase().endsWith(ext2);
+};
+var qmarksTestNocaseDot = ([$0, ext2 = ""]) => {
+  const noext = qmarksTestNoExtDot([$0]);
+  if (!ext2)
+    return noext;
+  ext2 = ext2.toLowerCase();
+  return (f) => noext(f) && f.toLowerCase().endsWith(ext2);
+};
+var qmarksTestDot = ([$0, ext2 = ""]) => {
+  const noext = qmarksTestNoExtDot([$0]);
+  return !ext2 ? noext : (f) => noext(f) && f.endsWith(ext2);
+};
+var qmarksTest = ([$0, ext2 = ""]) => {
+  const noext = qmarksTestNoExt([$0]);
+  return !ext2 ? noext : (f) => noext(f) && f.endsWith(ext2);
+};
+var qmarksTestNoExt = ([$0]) => {
+  const len = $0.length;
+  return (f) => f.length === len && !f.startsWith(".");
+};
+var qmarksTestNoExtDot = ([$0]) => {
+  const len = $0.length;
+  return (f) => f.length === len && f !== "." && f !== "..";
+};
+var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix";
+var path = {
+  win32: { sep: "\\" },
+  posix: { sep: "/" }
+};
+var sep = defaultPlatform === "win32" ? path.win32.sep : path.posix.sep;
+minimatch.sep = sep;
+var GLOBSTAR = /* @__PURE__ */ Symbol("globstar **");
+minimatch.GLOBSTAR = GLOBSTAR;
+var qmark2 = "[^/]";
+var star2 = qmark2 + "*?";
+var twoStarDot = "(?:(?!(?:\\/|^)(?:\\.{1,2})($|\\/)).)*?";
+var twoStarNoDot = "(?:(?!(?:\\/|^)\\.).)*?";
+var filter = (pattern, options = {}) => (p) => minimatch(p, pattern, options);
+minimatch.filter = filter;
+var ext = (a, b = {}) => Object.assign({}, a, b);
+var defaults = (def) => {
+  if (!def || typeof def !== "object" || !Object.keys(def).length) {
+    return minimatch;
+  }
+  const orig = minimatch;
+  const m = (p, pattern, options = {}) => orig(p, pattern, ext(def, options));
+  return Object.assign(m, {
+    Minimatch: class Minimatch extends orig.Minimatch {
+      constructor(pattern, options = {}) {
+        super(pattern, ext(def, options));
       }
-    }
-    let anyCandidate = false;
-    for (const state of stateByFile.values()) {
-      if (state.created && state.deleted) {
-        anyCandidate = true;
-        break;
+      static defaults(options) {
+        return orig.defaults(ext(def, options)).Minimatch;
       }
-    }
-    if (!anyCandidate) return patches;
-    const headFiles = await this.listHeadFiles();
-    const transient = /* @__PURE__ */ new Set();
-    for (const [file, state] of stateByFile) {
-      if (state.created && state.deleted && !headFiles.has(file)) {
-        transient.add(file);
+    },
+    AST: class AST extends orig.AST {
+      /* c8 ignore start */
+      constructor(type, parent, options = {}) {
+        super(type, parent, ext(def, options));
       }
-    }
-    if (transient.size === 0) return patches;
-    return patches.filter((patch) => !patch.files.every((f) => transient.has(f)));
+      /* c8 ignore stop */
+      static fromGlob(pattern, options = {}) {
+        return orig.AST.fromGlob(pattern, ext(def, options));
+      }
+    },
+    unescape: (s, options = {}) => orig.unescape(s, ext(def, options)),
+    escape: (s, options = {}) => orig.escape(s, ext(def, options)),
+    filter: (pattern, options = {}) => orig.filter(pattern, ext(def, options)),
+    defaults: (options) => orig.defaults(ext(def, options)),
+    makeRe: (pattern, options = {}) => orig.makeRe(pattern, ext(def, options)),
+    braceExpand: (pattern, options = {}) => orig.braceExpand(pattern, ext(def, options)),
+    match: (list, pattern, options = {}) => orig.match(list, pattern, ext(def, options)),
+    sep: orig.sep,
+    GLOBSTAR
+  });
+};
+minimatch.defaults = defaults;
+var braceExpand = (pattern, options = {}) => {
+  assertValidPattern(pattern);
+  if (options.nobrace || !/\{(?:(?!\{).)*\}/.test(pattern)) {
+    return [pattern];
   }
-  /**
-   * List every tracked path at HEAD (one `git ls-tree -r` invocation).
-   * Returns an empty Set if HEAD is unborn or the invocation fails — the
-   * caller then treats every candidate as "not in HEAD" and may collapse
-   * more aggressively. On typical SDK repos this is a single sub-10ms call.
-   */
-  async listHeadFiles() {
-    try {
-      const out = await this.git.exec(["ls-tree", "-r", "--name-only", "HEAD"]);
-      return new Set(out.split("\n").map((l) => l.trim()).filter(Boolean));
-    } catch {
-      return /* @__PURE__ */ new Set();
-    }
+  return (0, import_brace_expansion.default)(pattern);
+};
+minimatch.braceExpand = braceExpand;
+var makeRe = (pattern, options = {}) => new Minimatch(pattern, options).makeRe();
+minimatch.makeRe = makeRe;
+var match = (list, pattern, options = {}) => {
+  const mm = new Minimatch(pattern, options);
+  list = list.filter((f) => mm.match(f));
+  if (mm.options.nonull && !list.length) {
+    list.push(pattern);
   }
-  /**
-   * Detect patches via tree diff for non-linear history. Returns a composite patch.
-   * Revert reconciliation is skipped here because tree-diff produces a single composite
-   * patch from the aggregate diff — individual revert commits are not distinguishable.
-   */
-  async detectPatchesViaTreeDiff(lastGen, commitKnownMissing) {
-    const diffBase = await this.resolveDiffBase(lastGen, commitKnownMissing);
-    if (!diffBase) {
-      return this.detectPatchesViaCommitScan();
-    }
-    const lockForGuard = this.lockManager.read();
-    const knownGenerations = new Set(lockForGuard.generations.map((g) => g.commit_sha));
-    let resolvedBaseGeneration = commitKnownMissing ? diffBase : lastGen.commit_sha;
-    if (commitKnownMissing && !knownGenerations.has(diffBase)) {
-      const fallback = lockForGuard.current_generation ?? lockForGuard.generations[lockForGuard.generations.length - 1]?.commit_sha;
-      if (!fallback) {
-        this.warnings.push(
-          `Composite-patch fallback skipped: diff base ${diffBase.slice(0, 7)} is not a recorded generation and the lockfile has no recorded generations to anchor on. Customer customizations on disk are preserved; tracked patches will resume on the next regeneration.`
-        );
-        return { patches: [], revertedPatchIds: [] };
-      }
-      resolvedBaseGeneration = fallback;
+  return list;
+};
+minimatch.match = match;
+var globMagic = /[?*]|[+@!]\(.*?\)|\[|\]/;
+var regExpEscape2 = (s) => s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&");
+var Minimatch = class {
+  options;
+  set;
+  pattern;
+  windowsPathsNoEscape;
+  nonegate;
+  negate;
+  comment;
+  empty;
+  preserveMultipleSlashes;
+  partial;
+  globSet;
+  globParts;
+  nocase;
+  isWindows;
+  platform;
+  windowsNoMagicRoot;
+  regexp;
+  constructor(pattern, options = {}) {
+    assertValidPattern(pattern);
+    options = options || {};
+    this.options = options;
+    this.pattern = pattern;
+    this.platform = options.platform || defaultPlatform;
+    this.isWindows = this.platform === "win32";
+    this.windowsPathsNoEscape = !!options.windowsPathsNoEscape || options.allowWindowsEscape === false;
+    if (this.windowsPathsNoEscape) {
+      this.pattern = this.pattern.replace(/\\/g, "/");
     }
-    const filesOutput = await this.git.exec(["diff", "--name-only", diffBase, "HEAD"]);
-    const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
-    if (sensitiveFiles.length > 0) {
-      this.warnings.push(
-        `Sensitive file(s) excluded from composite patch: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
-      );
+    this.preserveMultipleSlashes = !!options.preserveMultipleSlashes;
+    this.regexp = null;
+    this.negate = false;
+    this.nonegate = !!options.nonegate;
+    this.comment = false;
+    this.empty = false;
+    this.partial = !!options.partial;
+    this.nocase = !!this.options.nocase;
+    this.windowsNoMagicRoot = options.windowsNoMagicRoot !== void 0 ? options.windowsNoMagicRoot : !!(this.isWindows && this.nocase);
+    this.globSet = [];
+    this.globParts = [];
+    this.set = [];
+    this.make();
+  }
+  hasMagic() {
+    if (this.options.magicalBraces && this.set.length > 1) {
+      return true;
     }
-    if (files.length === 0) return { patches: [], revertedPatchIds: [] };
-    const diff = await this.git.exec(["diff", diffBase, "HEAD", "--", ...files]);
-    if (!diff.trim()) return { patches: [], revertedPatchIds: [] };
-    const contentHash = this.computeContentHash(diff);
-    const lock = this.lockManager.read();
-    if (lock.patches.some((p) => p.content_hash === contentHash) || (lock.forgotten_hashes ?? []).includes(contentHash)) {
-      return { patches: [], revertedPatchIds: [] };
+    for (const pattern of this.set) {
+      for (const part of pattern) {
+        if (typeof part !== "string")
+          return true;
+      }
     }
-    const headSha = (await this.git.exec(["rev-parse", "HEAD"])).trim();
-    const theirsSnapshot = await capturePatchSnapshot(this.git, files, "HEAD");
-    const compositePatch = {
-      id: `patch-composite-${headSha.slice(0, 8)}`,
-      content_hash: contentHash,
-      original_commit: headSha,
-      original_message: "Customer customizations (composite)",
-      original_author: "composite",
-      // Anchor `base_generation` on a SHA the applicator's
-      // `resolveBaseGeneration` can find — always a member of
-      // `lock.generations`. When `diffBase` is a recorded
-      // generation, use it directly; otherwise the guard above
-      // has already mapped it onto `current_generation`.
-      base_generation: resolvedBaseGeneration,
-      files,
-      patch_content: diff,
-      ...Object.keys(theirsSnapshot).length > 0 ? { theirs_snapshot: theirsSnapshot } : {},
-      ...this.isCreationOnlyPatch(diff) ? { user_owned: true } : {}
-    };
-    return { patches: [compositePatch], revertedPatchIds: [] };
+    return false;
   }
-  /**
-   * Last-resort detection when both generation commit and tree are unreachable.
-   * Scans all commits from HEAD, filters against known lockfile patches, and
-   * skips creation-only commits (squashed history after force push).
-   *
-   * Detected patches use the commit's parent as base_generation so the applicator
-   * can find base file content from the parent's tree (which IS reachable).
-   */
-  async detectPatchesViaCommitScan() {
-    const lock = this.lockManager.read();
-    const knownGenerations = new Set(lock.generations.map((g) => g.commit_sha));
-    const fallbackAnchor = lock.current_generation ?? lock.generations[lock.generations.length - 1]?.commit_sha;
-    const log = await this.git.exec([
-      "log",
-      "--max-count=200",
-      "--format=%H%x00%an%x00%ae%x00%s",
-      "HEAD",
-      "--",
-      this.sdkOutputDir
-    ]);
-    if (!log.trim()) {
-      return { patches: [], revertedPatchIds: [] };
+  debug(..._) {
+  }
+  make() {
+    const pattern = this.pattern;
+    const options = this.options;
+    if (!options.nocomment && pattern.charAt(0) === "#") {
+      this.comment = true;
+      return;
     }
-    const commits = this.parseGitLog(log);
-    const newPatches = [];
-    const forgottenHashes = new Set(lock.forgotten_hashes ?? []);
-    const existingHashes = new Set(lock.patches.map((p) => p.content_hash));
-    const existingCommits = new Set(lock.patches.map((p) => p.original_commit));
-    for (const commit of commits) {
-      if (isGenerationCommit(commit)) {
-        continue;
-      }
-      const parents = await this.git.getCommitParents(commit.sha);
-      if (parents.length > 1) {
-        continue;
-      }
-      if (existingCommits.has(commit.sha)) {
-        continue;
-      }
-      let patchContent;
-      try {
-        patchContent = await this.git.formatPatch(commit.sha);
-      } catch {
-        continue;
-      }
-      let contentHash = this.computeContentHash(patchContent);
-      if (existingHashes.has(contentHash) || forgottenHashes.has(contentHash)) {
-        continue;
+    if (!pattern) {
+      this.empty = true;
+      return;
+    }
+    this.parseNegate();
+    this.globSet = [...new Set(this.braceExpand())];
+    if (options.debug) {
+      this.debug = (...args) => console.error(...args);
+    }
+    this.debug(this.pattern, this.globSet);
+    const rawGlobParts = this.globSet.map((s) => this.slashSplit(s));
+    this.globParts = this.preprocess(rawGlobParts);
+    this.debug(this.pattern, this.globParts);
+    let set = this.globParts.map((s, _, __) => {
+      if (this.isWindows && this.windowsNoMagicRoot) {
+        const isUNC = s[0] === "" && s[1] === "" && (s[2] === "?" || !globMagic.test(s[2])) && !globMagic.test(s[3]);
+        const isDrive = /^[a-z]:/i.test(s[0]);
+        if (isUNC) {
+          return [...s.slice(0, 4), ...s.slice(4).map((ss) => this.parse(ss))];
+        } else if (isDrive) {
+          return [s[0], ...s.slice(1).map((ss) => this.parse(ss))];
+        }
       }
-      if (this.isCreationOnlyPatch(patchContent)) {
-        continue;
+      return s.map((ss) => this.parse(ss));
+    });
+    this.debug(this.pattern, set);
+    this.set = set.filter((s) => s.indexOf(false) === -1);
+    if (this.isWindows) {
+      for (let i = 0; i < this.set.length; i++) {
+        const p = this.set[i];
+        if (p[0] === "" && p[1] === "" && this.globParts[i][2] === "?" && typeof p[3] === "string" && /^[a-z]:$/i.test(p[3])) {
+          p[2] = "?";
+        }
       }
-      const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
-      const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
-      if (sensitiveFiles.length > 0) {
-        this.warnings.push(
-          `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
-        );
-        if (files.length > 0) {
-          if (parents.length === 0) {
-            continue;
-          }
-          try {
-            patchContent = await this.git.exec(["diff", parents[0], commit.sha, "--", ...files]);
-          } catch {
-            continue;
+    }
+    this.debug(this.pattern, this.set);
+  }
+  // various transforms to equivalent pattern sets that are
+  // faster to process in a filesystem walk.  The goal is to
+  // eliminate what we can, and push all ** patterns as far
+  // to the right as possible, even if it increases the number
+  // of patterns that we have to process.
+  preprocess(globParts) {
+    if (this.options.noglobstar) {
+      for (let i = 0; i < globParts.length; i++) {
+        for (let j = 0; j < globParts[i].length; j++) {
+          if (globParts[i][j] === "**") {
+            globParts[i][j] = "*";
           }
-          if (!patchContent.trim()) continue;
-          contentHash = this.computeContentHash(patchContent);
         }
       }
-      if (files.length === 0) {
-        continue;
-      }
-      if (parents.length === 0) {
-        continue;
-      }
-      const parentSha = parents[0];
-      let baseGeneration;
-      if (knownGenerations.has(parentSha)) {
-        baseGeneration = parentSha;
-      } else if (fallbackAnchor) {
-        baseGeneration = fallbackAnchor;
-      } else {
-        this.warnings.push(
-          `Skipping commit ${commit.sha.slice(0, 7)} (${commit.message.split("\n")[0]}): no recorded generation in the lockfile to anchor on. The customer's state on disk is preserved; tracked patches will resume on the next regeneration.`
-        );
-        continue;
-      }
-      const theirsSnapshot = await capturePatchSnapshot(this.git, files, commit.sha);
-      newPatches.push({
-        id: `patch-${commit.sha.slice(0, 8)}`,
-        content_hash: contentHash,
-        original_commit: commit.sha,
-        original_message: commit.message,
-        original_author: `${commit.authorName} <${commit.authorEmail}>`,
-        base_generation: baseGeneration,
-        files,
-        patch_content: patchContent,
-        ...Object.keys(theirsSnapshot).length > 0 ? { theirs_snapshot: theirsSnapshot } : {}
-      });
     }
-    newPatches.reverse();
-    return { patches: newPatches, revertedPatchIds: [] };
+    const { optimizationLevel = 1 } = this.options;
+    if (optimizationLevel >= 2) {
+      globParts = this.firstPhasePreProcess(globParts);
+      globParts = this.secondPhasePreProcess(globParts);
+    } else if (optimizationLevel >= 1) {
+      globParts = this.levelOneOptimize(globParts);
+    } else {
+      globParts = this.adjascentGlobstarOptimize(globParts);
+    }
+    return globParts;
   }
-  /**
-   * Check if a format-patch consists entirely of new-file creations.
-   * Used to identify squashed commits after force push, which create all files
-   * from scratch (--- /dev/null) rather than modifying existing files.
-   */
-  isCreationOnlyPatch(patchContent) {
-    const diffOldHeaders = patchContent.split("\n").filter((l) => l.startsWith("--- "));
-    if (diffOldHeaders.length === 0) {
-      return false;
-    }
-    return diffOldHeaders.every((l) => l === "--- /dev/null");
-  }
-  /**
-   * Resolve the best available diff base for a generation record.
-   * Prefers commit_sha, falls back to tree_hash for unreachable commits.
-   * When commitKnownMissing is true, skips the redundant commitExists check.
-   */
-  async resolveDiffBase(gen, commitKnownMissing) {
-    if (!commitKnownMissing && await this.git.commitExists(gen.commit_sha)) {
-      return gen.commit_sha;
-    }
-    if (await this.git.treeExists(gen.tree_hash)) {
-      return gen.tree_hash;
-    }
-    return null;
-  }
-  parseGitLog(log) {
-    return log.trim().split("\n").map((line) => {
-      const [sha, authorName, authorEmail, message] = line.split("\0");
-      return { sha, authorName, authorEmail, message };
+  // just get rid of adjascent ** portions
+  adjascentGlobstarOptimize(globParts) {
+    return globParts.map((parts) => {
+      let gs = -1;
+      while (-1 !== (gs = parts.indexOf("**", gs + 1))) {
+        let i = gs;
+        while (parts[i + 1] === "**") {
+          i++;
+        }
+        if (i !== gs) {
+          parts.splice(gs, i - gs);
+        }
+      }
+      return parts;
     });
   }
-  getLastGeneration(lock) {
-    return lock.generations.find((g) => g.commit_sha === lock.current_generation);
-  }
-  /**
-   * Build a transient `GenerationRecord` from a SHA derived by walking git
-   * history. Only `commit_sha` (and `tree_hash` when needed downstream) is
-   * load-bearing here; the rest are filled with defensible placeholders.
-   * This record is consumed by `detectPatchesInRange` and is never persisted.
-   */
-  async synthesizeGenerationRecord(sha) {
-    let tree_hash = "";
-    try {
-      tree_hash = await this.git.getTreeHash(sha);
-    } catch {
-    }
-    return {
-      commit_sha: sha,
-      tree_hash,
-      timestamp: (/* @__PURE__ */ new Date(0)).toISOString(),
-      cli_version: "",
-      generator_versions: {}
-    };
-  }
-};
-
-// src/ReplayService.ts
-var import_node_fs2 = require("fs");
-var import_promises6 = require("fs/promises");
-var import_node_path9 = require("path");
-
-// node_modules/minimatch/dist/esm/index.js
-var import_brace_expansion = __toESM(require_brace_expansion(), 1);
-
-// node_modules/minimatch/dist/esm/assert-valid-pattern.js
-var MAX_PATTERN_LENGTH = 1024 * 64;
-var assertValidPattern = (pattern) => {
-  if (typeof pattern !== "string") {
-    throw new TypeError("invalid pattern");
-  }
-  if (pattern.length > MAX_PATTERN_LENGTH) {
-    throw new TypeError("pattern is too long");
-  }
-};
-
-// node_modules/minimatch/dist/esm/brace-expressions.js
-var posixClasses = {
-  "[:alnum:]": ["\\p{L}\\p{Nl}\\p{Nd}", true],
-  "[:alpha:]": ["\\p{L}\\p{Nl}", true],
-  "[:ascii:]": ["\\x00-\\x7f", false],
-  "[:blank:]": ["\\p{Zs}\\t", true],
-  "[:cntrl:]": ["\\p{Cc}", true],
-  "[:digit:]": ["\\p{Nd}", true],
-  "[:graph:]": ["\\p{Z}\\p{C}", true, true],
-  "[:lower:]": ["\\p{Ll}", true],
-  "[:print:]": ["\\p{C}", true],
-  "[:punct:]": ["\\p{P}", true],
-  "[:space:]": ["\\p{Z}\\t\\r\\n\\v\\f", true],
-  "[:upper:]": ["\\p{Lu}", true],
-  "[:word:]": ["\\p{L}\\p{Nl}\\p{Nd}\\p{Pc}", true],
-  "[:xdigit:]": ["A-Fa-f0-9", false]
-};
-var braceEscape = (s) => s.replace(/[[\]\\-]/g, "\\$&");
-var regexpEscape = (s) => s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&");
-var rangesToString = (ranges) => ranges.join("");
-var parseClass = (glob, position) => {
-  const pos = position;
-  if (glob.charAt(pos) !== "[") {
-    throw new Error("not in a brace expression");
+  // get rid of adjascent ** and resolve .. portions
+  levelOneOptimize(globParts) {
+    return globParts.map((parts) => {
+      parts = parts.reduce((set, part) => {
+        const prev = set[set.length - 1];
+        if (part === "**" && prev === "**") {
+          return set;
+        }
+        if (part === "..") {
+          if (prev && prev !== ".." && prev !== "." && prev !== "**") {
+            set.pop();
+            return set;
+          }
+        }
+        set.push(part);
+        return set;
+      }, []);
+      return parts.length === 0 ? [""] : parts;
+    });
   }
-  const ranges = [];
-  const negs = [];
-  let i = pos + 1;
-  let sawStart = false;
-  let uflag = false;
-  let escaping = false;
-  let negate = false;
-  let endPos = pos;
-  let rangeStart = "";
-  WHILE: while (i < glob.length) {
-    const c = glob.charAt(i);
-    if ((c === "!" || c === "^") && i === pos + 1) {
-      negate = true;
-      i++;
-      continue;
-    }
-    if (c === "]" && sawStart && !escaping) {
-      endPos = i + 1;
-      break;
-    }
-    sawStart = true;
-    if (c === "\\") {
-      if (!escaping) {
-        escaping = true;
-        i++;
-        continue;
-      }
+  levelTwoFileOptimize(parts) {
+    if (!Array.isArray(parts)) {
+      parts = this.slashSplit(parts);
     }
-    if (c === "[" && !escaping) {
-      for (const [cls, [unip, u, neg]] of Object.entries(posixClasses)) {
-        if (glob.startsWith(cls, i)) {
-          if (rangeStart) {
-            return ["$.", false, glob.length - pos, true];
+    let didSomething = false;
+    do {
+      didSomething = false;
+      if (!this.preserveMultipleSlashes) {
+        for (let i = 1; i < parts.length - 1; i++) {
+          const p = parts[i];
+          if (i === 1 && p === "" && parts[0] === "")
+            continue;
+          if (p === "." || p === "") {
+            didSomething = true;
+            parts.splice(i, 1);
+            i--;
           }
-          i += cls.length;
-          if (neg)
-            negs.push(unip);
-          else
-            ranges.push(unip);
-          uflag = uflag || u;
-          continue WHILE;
+        }
+        if (parts[0] === "." && parts.length === 2 && (parts[1] === "." || parts[1] === "")) {
+          didSomething = true;
+          parts.pop();
         }
       }
-    }
-    escaping = false;
-    if (rangeStart) {
-      if (c > rangeStart) {
-        ranges.push(braceEscape(rangeStart) + "-" + braceEscape(c));
-      } else if (c === rangeStart) {
-        ranges.push(braceEscape(c));
+      let dd = 0;
+      while (-1 !== (dd = parts.indexOf("..", dd + 1))) {
+        const p = parts[dd - 1];
+        if (p && p !== "." && p !== ".." && p !== "**") {
+          didSomething = true;
+          parts.splice(dd - 1, 2);
+          dd -= 2;
+        }
       }
-      rangeStart = "";
-      i++;
-      continue;
-    }
-    if (glob.startsWith("-]", i + 1)) {
-      ranges.push(braceEscape(c + "-"));
-      i += 2;
-      continue;
-    }
-    if (glob.startsWith("-", i + 1)) {
-      rangeStart = c;
-      i += 2;
-      continue;
-    }
-    ranges.push(braceEscape(c));
-    i++;
-  }
-  if (endPos < i) {
-    return ["", false, 0, false];
-  }
-  if (!ranges.length && !negs.length) {
-    return ["$.", false, glob.length - pos, true];
-  }
-  if (negs.length === 0 && ranges.length === 1 && /^\\?.$/.test(ranges[0]) && !negate) {
-    const r = ranges[0].length === 2 ? ranges[0].slice(-1) : ranges[0];
-    return [regexpEscape(r), false, endPos - pos, false];
+    } while (didSomething);
+    return parts.length === 0 ? [""] : parts;
   }
-  const sranges = "[" + (negate ? "^" : "") + rangesToString(ranges) + "]";
-  const snegs = "[" + (negate ? "" : "^") + rangesToString(negs) + "]";
-  const comb = ranges.length && negs.length ? "(" + sranges + "|" + snegs + ")" : ranges.length ? sranges : snegs;
-  return [comb, uflag, endPos - pos, true];
-};
-
-// node_modules/minimatch/dist/esm/unescape.js
-var unescape = (s, { windowsPathsNoEscape = false } = {}) => {
-  return windowsPathsNoEscape ? s.replace(/\[([^\/\\])\]/g, "$1") : s.replace(/((?!\\).|^)\[([^\/\\])\]/g, "$1$2").replace(/\\([^\/])/g, "$1");
-};
-
-// node_modules/minimatch/dist/esm/ast.js
-var types = /* @__PURE__ */ new Set(["!", "?", "+", "*", "@"]);
-var isExtglobType = (c) => types.has(c);
-var startNoTraversal = "(?!(?:^|/)\\.\\.?(?:$|/))";
-var startNoDot = "(?!\\.)";
-var addPatternStart = /* @__PURE__ */ new Set(["[", "."]);
-var justDots = /* @__PURE__ */ new Set(["..", "."]);
-var reSpecials = new Set("().*{}+?[]^$\\!");
-var regExpEscape = (s) => s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&");
-var qmark = "[^/]";
-var star = qmark + "*?";
-var starNoEmpty = qmark + "+?";
-var AST = class _AST {
-  type;
-  #root;
-  #hasMagic;
-  #uflag = false;
-  #parts = [];
-  #parent;
-  #parentIndex;
-  #negs;
-  #filledNegs = false;
-  #options;
-  #toString;
-  // set to true if it's an extglob with no children
-  // (which really means one child of '')
-  #emptyExt = false;
-  constructor(type, parent, options = {}) {
-    this.type = type;
-    if (type)
-      this.#hasMagic = true;
-    this.#parent = parent;
-    this.#root = this.#parent ? this.#parent.#root : this;
-    this.#options = this.#root === this ? options : this.#root.#options;
-    this.#negs = this.#root === this ? [] : this.#root.#negs;
-    if (type === "!" && !this.#root.#filledNegs)
-      this.#negs.push(this);
-    this.#parentIndex = this.#parent ? this.#parent.#parts.length : 0;
-  }
-  get hasMagic() {
-    if (this.#hasMagic !== void 0)
-      return this.#hasMagic;
-    for (const p of this.#parts) {
-      if (typeof p === "string")
-        continue;
-      if (p.type || p.hasMagic)
-        return this.#hasMagic = true;
-    }
-    return this.#hasMagic;
-  }
-  // reconstructs the pattern
-  toString() {
-    if (this.#toString !== void 0)
-      return this.#toString;
-    if (!this.type) {
-      return this.#toString = this.#parts.map((p) => String(p)).join("");
-    } else {
-      return this.#toString = this.type + "(" + this.#parts.map((p) => String(p)).join("|") + ")";
-    }
-  }
-  #fillNegs() {
-    if (this !== this.#root)
-      throw new Error("should only call on root");
-    if (this.#filledNegs)
-      return this;
-    this.toString();
-    this.#filledNegs = true;
-    let n;
-    while (n = this.#negs.pop()) {
-      if (n.type !== "!")
-        continue;
-      let p = n;
-      let pp = p.#parent;
-      while (pp) {
-        for (let i = p.#parentIndex + 1; !pp.type && i < pp.#parts.length; i++) {
-          for (const part of n.#parts) {
-            if (typeof part === "string") {
-              throw new Error("string part in extglob AST??");
+  // First phase: single-pattern processing
+  // <pre> is 1 or more portions
+  // <rest> is 1 or more portions
+  // <p> is any portion other than ., .., '', or **
+  // <e> is . or ''
+  //
+  // **/.. is *brutal* for filesystem walking performance, because
+  // it effectively resets the recursive walk each time it occurs,
+  // and ** cannot be reduced out by a .. pattern part like a regexp
+  // or most strings (other than .., ., and '') can be.
+  //
+  // <pre>/**/../<p>/<p>/<rest> -> {<pre>/../<p>/<p>/<rest>,<pre>/**/<p>/<p>/<rest>}
+  // <pre>/<e>/<rest> -> <pre>/<rest>
+  // <pre>/<p>/../<rest> -> <pre>/<rest>
+  // **/**/<rest> -> **/<rest>
+  //
+  // **/*/<rest> -> */**/<rest> <== not valid because ** doesn't follow
+  // this WOULD be allowed if ** did follow symlinks, or * didn't
+  firstPhasePreProcess(globParts) {
+    let didSomething = false;
+    do {
+      didSomething = false;
+      for (let parts of globParts) {
+        let gs = -1;
+        while (-1 !== (gs = parts.indexOf("**", gs + 1))) {
+          let gss = gs;
+          while (parts[gss + 1] === "**") {
+            gss++;
+          }
+          if (gss > gs) {
+            parts.splice(gs + 1, gss - gs);
+          }
+          let next = parts[gs + 1];
+          const p = parts[gs + 2];
+          const p2 = parts[gs + 3];
+          if (next !== "..")
+            continue;
+          if (!p || p === "." || p === ".." || !p2 || p2 === "." || p2 === "..") {
+            continue;
+          }
+          didSomething = true;
+          parts.splice(gs, 1);
+          const other = parts.slice(0);
+          other[gs] = "**";
+          globParts.push(other);
+          gs--;
+        }
+        if (!this.preserveMultipleSlashes) {
+          for (let i = 1; i < parts.length - 1; i++) {
+            const p = parts[i];
+            if (i === 1 && p === "" && parts[0] === "")
+              continue;
+            if (p === "." || p === "") {
+              didSomething = true;
+              parts.splice(i, 1);
+              i--;
             }
-            part.copyIn(pp.#parts[i]);
+          }
+          if (parts[0] === "." && parts.length === 2 && (parts[1] === "." || parts[1] === "")) {
+            didSomething = true;
+            parts.pop();
+          }
+        }
+        let dd = 0;
+        while (-1 !== (dd = parts.indexOf("..", dd + 1))) {
+          const p = parts[dd - 1];
+          if (p && p !== "." && p !== ".." && p !== "**") {
+            didSomething = true;
+            const needDot = dd === 1 && parts[dd + 1] === "**";
+            const splin = needDot ? ["."] : [];
+            parts.splice(dd - 1, 2, ...splin);
+            if (parts.length === 0)
+              parts.push("");
+            dd -= 2;
           }
         }
-        p = pp;
-        pp = p.#parent;
       }
-    }
-    return this;
+    } while (didSomething);
+    return globParts;
   }
-  push(...parts) {
-    for (const p of parts) {
-      if (p === "")
-        continue;
-      if (typeof p !== "string" && !(p instanceof _AST && p.#parent === this)) {
-        throw new Error("invalid part: " + p);
+  // second phase: multi-pattern dedupes
+  // {<pre>/*/<rest>,<pre>/<p>/<rest>} -> <pre>/*/<rest>
+  // {<pre>/<rest>,<pre>/<rest>} -> <pre>/<rest>
+  // {<pre>/**/<rest>,<pre>/<rest>} -> <pre>/**/<rest>
+  //
+  // {<pre>/**/<rest>,<pre>/**/<p>/<rest>} -> <pre>/**/<rest>
+  // ^-- not valid because ** doens't follow symlinks
+  secondPhasePreProcess(globParts) {
+    for (let i = 0; i < globParts.length - 1; i++) {
+      for (let j = i + 1; j < globParts.length; j++) {
+        const matched = this.partsMatch(globParts[i], globParts[j], !this.preserveMultipleSlashes);
+        if (matched) {
+          globParts[i] = [];
+          globParts[j] = matched;
+          break;
+        }
       }
-      this.#parts.push(p);
-    }
-  }
-  toJSON() {
-    const ret = this.type === null ? this.#parts.slice().map((p) => typeof p === "string" ? p : p.toJSON()) : [this.type, ...this.#parts.map((p) => p.toJSON())];
-    if (this.isStart() && !this.type)
-      ret.unshift([]);
-    if (this.isEnd() && (this === this.#root || this.#root.#filledNegs && this.#parent?.type === "!")) {
-      ret.push({});
     }
-    return ret;
+    return globParts.filter((gs) => gs.length);
   }
-  isStart() {
-    if (this.#root === this)
-      return true;
-    if (!this.#parent?.isStart())
-      return false;
-    if (this.#parentIndex === 0)
-      return true;
-    const p = this.#parent;
-    for (let i = 0; i < this.#parentIndex; i++) {
-      const pp = p.#parts[i];
-      if (!(pp instanceof _AST && pp.type === "!")) {
+  partsMatch(a, b, emptyGSMatch = false) {
+    let ai = 0;
+    let bi = 0;
+    let result = [];
+    let which = "";
+    while (ai < a.length && bi < b.length) {
+      if (a[ai] === b[bi]) {
+        result.push(which === "b" ? b[bi] : a[ai]);
+        ai++;
+        bi++;
+      } else if (emptyGSMatch && a[ai] === "**" && b[bi] === a[ai + 1]) {
+        result.push(a[ai]);
+        ai++;
+      } else if (emptyGSMatch && b[bi] === "**" && a[ai] === b[bi + 1]) {
+        result.push(b[bi]);
+        bi++;
+      } else if (a[ai] === "*" && b[bi] && (this.options.dot || !b[bi].startsWith(".")) && b[bi] !== "**") {
+        if (which === "b")
+          return false;
+        which = "a";
+        result.push(a[ai]);
+        ai++;
+        bi++;
+      } else if (b[bi] === "*" && a[ai] && (this.options.dot || !a[ai].startsWith(".")) && a[ai] !== "**") {
+        if (which === "a")
+          return false;
+        which = "b";
+        result.push(b[bi]);
+        ai++;
+        bi++;
+      } else {
         return false;
       }
     }
-    return true;
-  }
-  isEnd() {
-    if (this.#root === this)
-      return true;
-    if (this.#parent?.type === "!")
-      return true;
-    if (!this.#parent?.isEnd())
-      return false;
-    if (!this.type)
-      return this.#parent?.isEnd();
-    const pl = this.#parent ? this.#parent.#parts.length : 0;
-    return this.#parentIndex === pl - 1;
-  }
-  copyIn(part) {
-    if (typeof part === "string")
-      this.push(part);
-    else
-      this.push(part.clone(this));
+    return a.length === b.length && result;
   }
-  clone(parent) {
-    const c = new _AST(this.type, parent);
-    for (const p of this.#parts) {
-      c.copyIn(p);
+  parseNegate() {
+    if (this.nonegate)
+      return;
+    const pattern = this.pattern;
+    let negate = false;
+    let negateOffset = 0;
+    for (let i = 0; i < pattern.length && pattern.charAt(i) === "!"; i++) {
+      negate = !negate;
+      negateOffset++;
     }
-    return c;
+    if (negateOffset)
+      this.pattern = pattern.slice(negateOffset);
+    this.negate = negate;
   }
-  static #parseAST(str, ast, pos, opt) {
-    let escaping = false;
-    let inBrace = false;
-    let braceStart = -1;
-    let braceNeg = false;
-    if (ast.type === null) {
-      let i2 = pos;
-      let acc2 = "";
-      while (i2 < str.length) {
-        const c = str.charAt(i2++);
-        if (escaping || c === "\\") {
-          escaping = !escaping;
-          acc2 += c;
-          continue;
-        }
-        if (inBrace) {
-          if (i2 === braceStart + 1) {
-            if (c === "^" || c === "!") {
-              braceNeg = true;
-            }
-          } else if (c === "]" && !(i2 === braceStart + 2 && braceNeg)) {
-            inBrace = false;
+  // set partial to true to test if, for example,
+  // "/a/b" matches the start of "/*/b/*/d"
+  // Partial means, if you run out of file before you run
+  // out of pattern, then that's fine, as long as all
+  // the parts match.
+  matchOne(file, pattern, partial = false) {
+    const options = this.options;
+    if (this.isWindows) {
+      const fileDrive = typeof file[0] === "string" && /^[a-z]:$/i.test(file[0]);
+      const fileUNC = !fileDrive && file[0] === "" && file[1] === "" && file[2] === "?" && /^[a-z]:$/i.test(file[3]);
+      const patternDrive = typeof pattern[0] === "string" && /^[a-z]:$/i.test(pattern[0]);
+      const patternUNC = !patternDrive && pattern[0] === "" && pattern[1] === "" && pattern[2] === "?" && typeof pattern[3] === "string" && /^[a-z]:$/i.test(pattern[3]);
+      const fdi = fileUNC ? 3 : fileDrive ? 0 : void 0;
+      const pdi = patternUNC ? 3 : patternDrive ? 0 : void 0;
+      if (typeof fdi === "number" && typeof pdi === "number") {
+        const [fd, pd] = [file[fdi], pattern[pdi]];
+        if (fd.toLowerCase() === pd.toLowerCase()) {
+          pattern[pdi] = fd;
+          if (pdi > fdi) {
+            pattern = pattern.slice(pdi);
+          } else if (fdi > pdi) {
+            file = file.slice(fdi);
           }
-          acc2 += c;
-          continue;
-        } else if (c === "[") {
-          inBrace = true;
-          braceStart = i2;
-          braceNeg = false;
-          acc2 += c;
-          continue;
-        }
-        if (!opt.noext && isExtglobType(c) && str.charAt(i2) === "(") {
-          ast.push(acc2);
-          acc2 = "";
-          const ext2 = new _AST(c, ast);
-          i2 = _AST.#parseAST(str, ext2, i2, opt);
-          ast.push(ext2);
-          continue;
         }
-        acc2 += c;
       }
-      ast.push(acc2);
-      return i2;
     }
-    let i = pos + 1;
-    let part = new _AST(null, ast);
-    const parts = [];
-    let acc = "";
-    while (i < str.length) {
-      const c = str.charAt(i++);
-      if (escaping || c === "\\") {
-        escaping = !escaping;
-        acc += c;
-        continue;
+    const { optimizationLevel = 1 } = this.options;
+    if (optimizationLevel >= 2) {
+      file = this.levelTwoFileOptimize(file);
+    }
+    this.debug("matchOne", this, { file, pattern });
+    this.debug("matchOne", file.length, pattern.length);
+    for (var fi = 0, pi = 0, fl = file.length, pl = pattern.length; fi < fl && pi < pl; fi++, pi++) {
+      this.debug("matchOne loop");
+      var p = pattern[pi];
+      var f = file[fi];
+      this.debug(pattern, p, f);
+      if (p === false) {
+        return false;
       }
-      if (inBrace) {
-        if (i === braceStart + 1) {
-          if (c === "^" || c === "!") {
-            braceNeg = true;
+      if (p === GLOBSTAR) {
+        this.debug("GLOBSTAR", [pattern, p, f]);
+        var fr = fi;
+        var pr = pi + 1;
+        if (pr === pl) {
+          this.debug("** at the end");
+          for (; fi < fl; fi++) {
+            if (file[fi] === "." || file[fi] === ".." || !options.dot && file[fi].charAt(0) === ".")
+              return false;
           }
-        } else if (c === "]" && !(i === braceStart + 2 && braceNeg)) {
-          inBrace = false;
+          return true;
         }
-        acc += c;
-        continue;
-      } else if (c === "[") {
-        inBrace = true;
-        braceStart = i;
-        braceNeg = false;
-        acc += c;
-        continue;
-      }
-      if (isExtglobType(c) && str.charAt(i) === "(") {
-        part.push(acc);
-        acc = "";
-        const ext2 = new _AST(c, part);
-        part.push(ext2);
-        i = _AST.#parseAST(str, ext2, i, opt);
-        continue;
-      }
-      if (c === "|") {
-        part.push(acc);
-        acc = "";
-        parts.push(part);
-        part = new _AST(null, ast);
-        continue;
-      }
-      if (c === ")") {
-        if (acc === "" && ast.#parts.length === 0) {
-          ast.#emptyExt = true;
+        while (fr < fl) {
+          var swallowee = file[fr];
+          this.debug("\nglobstar while", file, fr, pattern, pr, swallowee);
+          if (this.matchOne(file.slice(fr), pattern.slice(pr), partial)) {
+            this.debug("globstar found match!", fr, fl, swallowee);
+            return true;
+          } else {
+            if (swallowee === "." || swallowee === ".." || !options.dot && swallowee.charAt(0) === ".") {
+              this.debug("dot detected!", file, fr, pattern, pr);
+              break;
+            }
+            this.debug("globstar swallow a segment, and continue");
+            fr++;
+          }
         }
-        part.push(acc);
-        acc = "";
-        ast.push(...parts, part);
-        return i;
+        if (partial) {
+          this.debug("\n>>> no match, partial?", file, fr, pattern, pr);
+          if (fr === fl) {
+            return true;
+          }
+        }
+        return false;
       }
-      acc += c;
+      let hit;
+      if (typeof p === "string") {
+        hit = f === p;
+        this.debug("string match", p, f, hit);
+      } else {
+        hit = p.test(f);
+        this.debug("pattern match", p, f, hit);
+      }
+      if (!hit)
+        return false;
+    }
+    if (fi === fl && pi === pl) {
+      return true;
+    } else if (fi === fl) {
+      return partial;
+    } else if (pi === pl) {
+      return fi === fl - 1 && file[fi] === "";
+    } else {
+      throw new Error("wtf?");
     }
-    ast.type = null;
-    ast.#hasMagic = void 0;
-    ast.#parts = [str.substring(pos - 1)];
-    return i;
   }
-  static fromGlob(pattern, options = {}) {
-    const ast = new _AST(null, void 0, options);
-    _AST.#parseAST(pattern, ast, 0, options);
-    return ast;
+  braceExpand() {
+    return braceExpand(this.pattern, this.options);
   }
-  // returns the regular expression if there's magic, or the unescaped
-  // string if not.
-  toMMPattern() {
-    if (this !== this.#root)
-      return this.#root.toMMPattern();
-    const glob = this.toString();
-    const [re, body, hasMagic, uflag] = this.toRegExpSource();
-    const anyMagic = hasMagic || this.#hasMagic || this.#options.nocase && !this.#options.nocaseMagicOnly && glob.toUpperCase() !== glob.toLowerCase();
-    if (!anyMagic) {
-      return body;
+  parse(pattern) {
+    assertValidPattern(pattern);
+    const options = this.options;
+    if (pattern === "**")
+      return GLOBSTAR;
+    if (pattern === "")
+      return "";
+    let m;
+    let fastTest = null;
+    if (m = pattern.match(starRE)) {
+      fastTest = options.dot ? starTestDot : starTest;
+    } else if (m = pattern.match(starDotExtRE)) {
+      fastTest = (options.nocase ? options.dot ? starDotExtTestNocaseDot : starDotExtTestNocase : options.dot ? starDotExtTestDot : starDotExtTest)(m[1]);
+    } else if (m = pattern.match(qmarksRE)) {
+      fastTest = (options.nocase ? options.dot ? qmarksTestNocaseDot : qmarksTestNocase : options.dot ? qmarksTestDot : qmarksTest)(m);
+    } else if (m = pattern.match(starDotStarRE)) {
+      fastTest = options.dot ? starDotStarTestDot : starDotStarTest;
+    } else if (m = pattern.match(dotStarRE)) {
+      fastTest = dotStarTest;
     }
-    const flags = (this.#options.nocase ? "i" : "") + (uflag ? "u" : "");
-    return Object.assign(new RegExp(`^${re}$`, flags), {
-      _src: re,
-      _glob: glob
-    });
-  }
-  get options() {
-    return this.#options;
+    const re = AST.fromGlob(pattern, this.options).toMMPattern();
+    if (fastTest && typeof re === "object") {
+      Reflect.defineProperty(re, "test", { value: fastTest });
+    }
+    return re;
   }
-  // returns the string match, the regexp source, whether there's magic
-  // in the regexp (so a regular expression is required) and whether or
-  // not the uflag is needed for the regular expression (for posix classes)
-  // TODO: instead of injecting the start/end at this point, just return
-  // the BODY of the regexp, along with the start/end portions suitable
-  // for binding the start/end in either a joined full-path makeRe context
-  // (where we bind to (^|/), or a standalone matchPart context (where
-  // we bind to ^, and not /).  Otherwise slashes get duped!
-  //
-  // In part-matching mode, the start is:
-  // - if not isStart: nothing
-  // - if traversal possible, but not allowed: ^(?!\.\.?$)
-  // - if dots allowed or not possible: ^
-  // - if dots possible and not allowed: ^(?!\.)
-  // end is:
-  // - if not isEnd(): nothing
-  // - else: $
-  //
-  // In full-path matching mode, we put the slash at the START of the
-  // pattern, so start is:
-  // - if first pattern: same as part-matching mode
-  // - if not isStart(): nothing
-  // - if traversal possible, but not allowed: /(?!\.\.?(?:$|/))
-  // - if dots allowed or not possible: /
-  // - if dots possible and not allowed: /(?!\.)
-  // end is:
-  // - if last pattern, same as part-matching mode
-  // - else nothing
-  //
-  // Always put the (?:$|/) on negated tails, though, because that has to be
-  // there to bind the end of the negated pattern portion, and it's easier to
-  // just stick it in now rather than try to inject it later in the middle of
-  // the pattern.
-  //
-  // We can just always return the same end, and leave it up to the caller
-  // to know whether it's going to be used joined or in parts.
-  // And, if the start is adjusted slightly, can do the same there:
-  // - if not isStart: nothing
-  // - if traversal possible, but not allowed: (?:/|^)(?!\.\.?$)
-  // - if dots allowed or not possible: (?:/|^)
-  // - if dots possible and not allowed: (?:/|^)(?!\.)
-  //
-  // But it's better to have a simpler binding without a conditional, for
-  // performance, so probably better to return both start options.
-  //
-  // Then the caller just ignores the end if it's not the first pattern,
-  // and the start always gets applied.
-  //
-  // But that's always going to be $ if it's the ending pattern, or nothing,
-  // so the caller can just attach $ at the end of the pattern when building.
-  //
-  // So the todo is:
-  // - better detect what kind of start is needed
-  // - return both flavors of starting pattern
-  // - attach $ at the end of the pattern when creating the actual RegExp
-  //
-  // Ah, but wait, no, that all only applies to the root when the first pattern
-  // is not an extglob. If the first pattern IS an extglob, then we need all
-  // that dot prevention biz to live in the extglob portions, because eg
-  // +(*|.x*) can match .xy but not .yx.
-  //
-  // So, return the two flavors if it's #root and the first child is not an
-  // AST, otherwise leave it to the child AST to handle it, and there,
-  // use the (?:^|/) style of start binding.
-  //
-  // Even simplified further:
-  // - Since the start for a join is eg /(?!\.) and the start for a part
-  // is ^(?!\.), we can just prepend (?!\.) to the pattern (either root
-  // or start or whatever) and prepend ^ or / at the Regexp construction.
-  toRegExpSource(allowDot) {
-    const dot = allowDot ?? !!this.#options.dot;
-    if (this.#root === this)
-      this.#fillNegs();
-    if (!this.type) {
-      const noEmpty = this.isStart() && this.isEnd();
-      const src = this.#parts.map((p) => {
-        const [re, _, hasMagic, uflag] = typeof p === "string" ? _AST.#parseGlob(p, this.#hasMagic, noEmpty) : p.toRegExpSource(allowDot);
-        this.#hasMagic = this.#hasMagic || hasMagic;
-        this.#uflag = this.#uflag || uflag;
-        return re;
-      }).join("");
-      let start2 = "";
-      if (this.isStart()) {
-        if (typeof this.#parts[0] === "string") {
-          const dotTravAllowed = this.#parts.length === 1 && justDots.has(this.#parts[0]);
-          if (!dotTravAllowed) {
-            const aps = addPatternStart;
-            const needNoTrav = (
-              // dots are allowed, and the pattern starts with [ or .
-              dot && aps.has(src.charAt(0)) || // the pattern starts with \., and then [ or .
-              src.startsWith("\\.") && aps.has(src.charAt(2)) || // the pattern starts with \.\., and then [ or .
-              src.startsWith("\\.\\.") && aps.has(src.charAt(4))
-            );
-            const needNoDot = !dot && !allowDot && aps.has(src.charAt(0));
-            start2 = needNoTrav ? startNoTraversal : needNoDot ? startNoDot : "";
+  makeRe() {
+    if (this.regexp || this.regexp === false)
+      return this.regexp;
+    const set = this.set;
+    if (!set.length) {
+      this.regexp = false;
+      return this.regexp;
+    }
+    const options = this.options;
+    const twoStar = options.noglobstar ? star2 : options.dot ? twoStarDot : twoStarNoDot;
+    const flags = new Set(options.nocase ? ["i"] : []);
+    let re = set.map((pattern) => {
+      const pp = pattern.map((p) => {
+        if (p instanceof RegExp) {
+          for (const f of p.flags.split(""))
+            flags.add(f);
+        }
+        return typeof p === "string" ? regExpEscape2(p) : p === GLOBSTAR ? GLOBSTAR : p._src;
+      });
+      pp.forEach((p, i) => {
+        const next = pp[i + 1];
+        const prev = pp[i - 1];
+        if (p !== GLOBSTAR || prev === GLOBSTAR) {
+          return;
+        }
+        if (prev === void 0) {
+          if (next !== void 0 && next !== GLOBSTAR) {
+            pp[i + 1] = "(?:\\/|" + twoStar + "\\/)?" + next;
+          } else {
+            pp[i] = twoStar;
           }
+        } else if (next === void 0) {
+          pp[i - 1] = prev + "(?:\\/|" + twoStar + ")?";
+        } else if (next !== GLOBSTAR) {
+          pp[i - 1] = prev + "(?:\\/|\\/" + twoStar + "\\/)" + next;
+          pp[i + 1] = GLOBSTAR;
         }
-      }
-      let end = "";
-      if (this.isEnd() && this.#root.#filledNegs && this.#parent?.type === "!") {
-        end = "(?:$|\\/)";
-      }
-      const final2 = start2 + src + end;
-      return [
-        final2,
-        unescape(src),
-        this.#hasMagic = !!this.#hasMagic,
-        this.#uflag
-      ];
+      });
+      return pp.filter((p) => p !== GLOBSTAR).join("/");
+    }).join("|");
+    const [open, close] = set.length > 1 ? ["(?:", ")"] : ["", ""];
+    re = "^" + open + re + close + "$";
+    if (this.negate)
+      re = "^(?!" + re + ").+$";
+    try {
+      this.regexp = new RegExp(re, [...flags].join(""));
+    } catch (ex) {
+      this.regexp = false;
     }
-    const repeated = this.type === "*" || this.type === "+";
-    const start = this.type === "!" ? "(?:(?!(?:" : "(?:";
-    let body = this.#partsToRegExp(dot);
-    if (this.isStart() && this.isEnd() && !body && this.type !== "!") {
-      const s = this.toString();
-      this.#parts = [s];
-      this.type = null;
-      this.#hasMagic = void 0;
-      return [s, unescape(this.toString()), false, false];
+    return this.regexp;
+  }
+  slashSplit(p) {
+    if (this.preserveMultipleSlashes) {
+      return p.split("/");
+    } else if (this.isWindows && /^\/\/[^\/]+/.test(p)) {
+      return ["", ...p.split(/\/+/)];
+    } else {
+      return p.split(/\/+/);
     }
-    let bodyDotAllowed = !repeated || allowDot || dot || !startNoDot ? "" : this.#partsToRegExp(true);
-    if (bodyDotAllowed === body) {
-      bodyDotAllowed = "";
+  }
+  match(f, partial = this.partial) {
+    this.debug("match", f, this.pattern);
+    if (this.comment) {
+      return false;
     }
-    if (bodyDotAllowed) {
-      body = `(?:${body})(?:${bodyDotAllowed})*?`;
+    if (this.empty) {
+      return f === "";
     }
-    let final = "";
-    if (this.type === "!" && this.#emptyExt) {
-      final = (this.isStart() && !dot ? startNoDot : "") + starNoEmpty;
-    } else {
-      const close = this.type === "!" ? (
-        // !() must match something,but !(x) can match ''
-        "))" + (this.isStart() && !dot && !allowDot ? startNoDot : "") + star + ")"
-      ) : this.type === "@" ? ")" : this.type === "?" ? ")?" : this.type === "+" && bodyDotAllowed ? ")" : this.type === "*" && bodyDotAllowed ? `)?` : `)${this.type}`;
-      final = start + body + close;
+    if (f === "/" && partial) {
+      return true;
     }
-    return [
-      final,
-      unescape(body),
-      this.#hasMagic = !!this.#hasMagic,
-      this.#uflag
-    ];
-  }
-  #partsToRegExp(dot) {
-    return this.#parts.map((p) => {
-      if (typeof p === "string") {
-        throw new Error("string type in extglob ast??");
-      }
-      const [re, _, _hasMagic, uflag] = p.toRegExpSource(dot);
-      this.#uflag = this.#uflag || uflag;
-      return re;
-    }).filter((p) => !(this.isStart() && this.isEnd()) || !!p).join("|");
-  }
-  static #parseGlob(glob, hasMagic, noEmpty = false) {
-    let escaping = false;
-    let re = "";
-    let uflag = false;
-    for (let i = 0; i < glob.length; i++) {
-      const c = glob.charAt(i);
-      if (escaping) {
-        escaping = false;
-        re += (reSpecials.has(c) ? "\\" : "") + c;
-        continue;
+    const options = this.options;
+    if (this.isWindows) {
+      f = f.split("\\").join("/");
+    }
+    const ff = this.slashSplit(f);
+    this.debug(this.pattern, "split", ff);
+    const set = this.set;
+    this.debug(this.pattern, "set", set);
+    let filename = ff[ff.length - 1];
+    if (!filename) {
+      for (let i = ff.length - 2; !filename && i >= 0; i--) {
+        filename = ff[i];
       }
-      if (c === "\\") {
-        if (i === glob.length - 1) {
-          re += "\\\\";
-        } else {
-          escaping = true;
-        }
-        continue;
+    }
+    for (let i = 0; i < set.length; i++) {
+      const pattern = set[i];
+      let file = ff;
+      if (options.matchBase && pattern.length === 1) {
+        file = [filename];
       }
-      if (c === "[") {
-        const [src, needUflag, consumed, magic] = parseClass(glob, i);
-        if (consumed) {
-          re += src;
-          uflag = uflag || needUflag;
-          i += consumed - 1;
-          hasMagic = hasMagic || magic;
-          continue;
+      const hit = this.matchOne(file, pattern, partial);
+      if (hit) {
+        if (options.flipNegate) {
+          return true;
         }
+        return !this.negate;
       }
-      if (c === "*") {
-        if (noEmpty && glob === "*")
-          re += starNoEmpty;
-        else
-          re += star;
-        hasMagic = true;
-        continue;
-      }
-      if (c === "?") {
-        re += qmark;
-        hasMagic = true;
-        continue;
-      }
-      re += regExpEscape(c);
     }
-    return [re, unescape(glob), !!hasMagic, uflag];
+    if (options.flipNegate) {
+      return false;
+    }
+    return this.negate;
+  }
+  static defaults(def) {
+    return minimatch.defaults(def).Minimatch;
   }
 };
+minimatch.AST = AST;
+minimatch.Minimatch = Minimatch;
+minimatch.escape = escape;
+minimatch.unescape = unescape;
 
-// node_modules/minimatch/dist/esm/escape.js
-var escape = (s, { windowsPathsNoEscape = false } = {}) => {
-  return windowsPathsNoEscape ? s.replace(/[?*()[\]]/g, "[$&]") : s.replace(/[?*()[\]\\]/g, "\\$&");
-};
+// src/LockfileManager.ts
+var import_yaml = __toESM(require_dist3(), 1);
 
-// node_modules/minimatch/dist/esm/index.js
-var minimatch = (p, pattern, options = {}) => {
-  assertValidPattern(pattern);
-  if (!options.nocomment && pattern.charAt(0) === "#") {
-    return false;
+// src/credentials.ts
+var CREDENTIAL_PATTERNS = [
+  { name: "PRIVATE KEY block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "OPENSSH key", re: /-----BEGIN OPENSSH PRIVATE KEY-----/ },
+  { name: "RSA key", re: /-----BEGIN RSA PRIVATE KEY-----/ },
+  { name: "CERTIFICATE", re: /-----BEGIN CERTIFICATE-----/ },
+  { name: "TOKEN=", re: /\bTOKEN\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/ },
+  { name: "api_key=", re: /\bapi[_-]?key\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/i },
+  { name: "password=", re: /\bpassword\s*=\s*["']?[^\s"']{6,}/i },
+  { name: "AWS_SECRET_ACCESS_KEY", re: /AWS_SECRET_ACCESS_KEY/ },
+  { name: "JWT (eyJ...)", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ }
+];
+var SENSITIVE_FILE_PATTERNS = [
+  /(^|\/)\.env(\.[^/]+)?$/,
+  /\.pem$/,
+  /\.key$/,
+  /\.pkce_state\.json$/,
+  /(^|\/)id_rsa$/,
+  /(^|\/)id_ed25519$/
+];
+function isSensitiveFile(filePath) {
+  return SENSITIVE_FILE_PATTERNS.some((re) => re.test(filePath));
+}
+function scanForCredentials(content) {
+  const matches = [];
+  for (const { name, re } of CREDENTIAL_PATTERNS) {
+    if (re.test(content)) {
+      matches.push(name);
+    }
+  }
+  return matches;
+}
+
+// src/LockfileManager.ts
+var LOCKFILE_HEADER = "# DO NOT EDIT MANUALLY - Managed by Fern Replay\n";
+var LockfileNotFoundError = class extends Error {
+  constructor(path2) {
+    super(`Lockfile not found: ${path2}`);
+    this.name = "LockfileNotFoundError";
   }
-  return new Minimatch(pattern, options).match(p);
-};
-var starDotExtRE = /^\*+([^+@!?\*\[\(]*)$/;
-var starDotExtTest = (ext2) => (f) => !f.startsWith(".") && f.endsWith(ext2);
-var starDotExtTestDot = (ext2) => (f) => f.endsWith(ext2);
-var starDotExtTestNocase = (ext2) => {
-  ext2 = ext2.toLowerCase();
-  return (f) => !f.startsWith(".") && f.toLowerCase().endsWith(ext2);
-};
-var starDotExtTestNocaseDot = (ext2) => {
-  ext2 = ext2.toLowerCase();
-  return (f) => f.toLowerCase().endsWith(ext2);
-};
-var starDotStarRE = /^\*+\.\*+$/;
-var starDotStarTest = (f) => !f.startsWith(".") && f.includes(".");
-var starDotStarTestDot = (f) => f !== "." && f !== ".." && f.includes(".");
-var dotStarRE = /^\.\*+$/;
-var dotStarTest = (f) => f !== "." && f !== ".." && f.startsWith(".");
-var starRE = /^\*+$/;
-var starTest = (f) => f.length !== 0 && !f.startsWith(".");
-var starTestDot = (f) => f.length !== 0 && f !== "." && f !== "..";
-var qmarksRE = /^\?+([^+@!?\*\[\(]*)?$/;
-var qmarksTestNocase = ([$0, ext2 = ""]) => {
-  const noext = qmarksTestNoExt([$0]);
-  if (!ext2)
-    return noext;
-  ext2 = ext2.toLowerCase();
-  return (f) => noext(f) && f.toLowerCase().endsWith(ext2);
-};
-var qmarksTestNocaseDot = ([$0, ext2 = ""]) => {
-  const noext = qmarksTestNoExtDot([$0]);
-  if (!ext2)
-    return noext;
-  ext2 = ext2.toLowerCase();
-  return (f) => noext(f) && f.toLowerCase().endsWith(ext2);
-};
-var qmarksTestDot = ([$0, ext2 = ""]) => {
-  const noext = qmarksTestNoExtDot([$0]);
-  return !ext2 ? noext : (f) => noext(f) && f.endsWith(ext2);
-};
-var qmarksTest = ([$0, ext2 = ""]) => {
-  const noext = qmarksTestNoExt([$0]);
-  return !ext2 ? noext : (f) => noext(f) && f.endsWith(ext2);
-};
-var qmarksTestNoExt = ([$0]) => {
-  const len = $0.length;
-  return (f) => f.length === len && !f.startsWith(".");
-};
-var qmarksTestNoExtDot = ([$0]) => {
-  const len = $0.length;
-  return (f) => f.length === len && f !== "." && f !== "..";
-};
-var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix";
-var path = {
-  win32: { sep: "\\" },
-  posix: { sep: "/" }
 };
-var sep = defaultPlatform === "win32" ? path.win32.sep : path.posix.sep;
-minimatch.sep = sep;
-var GLOBSTAR = /* @__PURE__ */ Symbol("globstar **");
-minimatch.GLOBSTAR = GLOBSTAR;
-var qmark2 = "[^/]";
-var star2 = qmark2 + "*?";
-var twoStarDot = "(?:(?!(?:\\/|^)(?:\\.{1,2})($|\\/)).)*?";
-var twoStarNoDot = "(?:(?!(?:\\/|^)\\.).)*?";
-var filter = (pattern, options = {}) => (p) => minimatch(p, pattern, options);
-minimatch.filter = filter;
-var ext = (a, b = {}) => Object.assign({}, a, b);
-var defaults = (def) => {
-  if (!def || typeof def !== "object" || !Object.keys(def).length) {
-    return minimatch;
+var LockfileManager = class {
+  outputDir;
+  lock = null;
+  fernignorePatterns = [];
+  warnings = [];
+  constructor(outputDir) {
+    this.outputDir = outputDir;
   }
-  const orig = minimatch;
-  const m = (p, pattern, options = {}) => orig(p, pattern, ext(def, options));
-  return Object.assign(m, {
-    Minimatch: class Minimatch extends orig.Minimatch {
-      constructor(pattern, options = {}) {
-        super(pattern, ext(def, options));
-      }
-      static defaults(options) {
-        return orig.defaults(ext(def, options)).Minimatch;
+  /**
+   * Inform the lockfile of the customer's `.fernignore` patterns so that
+   * `save()` can suppress its "Patch X removed from lockfile" warning when
+   * every file in the stripped patch is already `.fernignore`-protected.
+   * The strip itself still happens (credentials never persist); only the
+   * customer-visible warning is suppressed in that case, because the
+   * protected files survive the generator wipe regardless of whether the
+   * lockfile tracks them, so there's nothing for the customer to action.
+   */
+  setFernignorePatterns(patterns) {
+    this.fernignorePatterns = patterns;
+  }
+  get lockfilePath() {
+    return (0, import_node_path2.join)(this.outputDir, ".fern", "replay.lock");
+  }
+  get customizationsPath() {
+    return (0, import_node_path2.join)(this.outputDir, ".fern", "replay.yml");
+  }
+  exists() {
+    return (0, import_node_fs.existsSync)(this.lockfilePath);
+  }
+  read() {
+    if (this.lock) {
+      return this.lock;
+    }
+    try {
+      const content = (0, import_node_fs.readFileSync)(this.lockfilePath, "utf-8");
+      this.lock = (0, import_yaml.parse)(content);
+      return this.lock;
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+        throw new LockfileNotFoundError(this.lockfilePath);
       }
-    },
-    AST: class AST extends orig.AST {
-      /* c8 ignore start */
-      constructor(type, parent, options = {}) {
-        super(type, parent, ext(def, options));
+      throw error;
+    }
+  }
+  initialize(firstGeneration) {
+    this.initializeInMemory(firstGeneration);
+    this.save();
+  }
+  /**
+   * Set up in-memory lock state without writing to disk.
+   * Useful for bootstrap dry-run where we need state for detection
+   * but don't want to persist anything.
+   */
+  initializeInMemory(firstGeneration) {
+    this.lock = {
+      version: "1.0",
+      generations: [firstGeneration],
+      current_generation: firstGeneration.commit_sha,
+      patches: []
+    };
+  }
+  save() {
+    if (!this.lock) {
+      throw new Error("No lockfile data to save. Call read() or initialize() first.");
+    }
+    this.warnings.length = 0;
+    const cleanPatches = [];
+    for (const patch of this.lock.patches) {
+      const diffMatches = scanForCredentials(patch.patch_content);
+      const snapshotMatches = [];
+      if (patch.theirs_snapshot) {
+        for (const content2 of Object.values(patch.theirs_snapshot)) {
+          const m = scanForCredentials(content2);
+          for (const x of m) {
+            if (!snapshotMatches.includes(x)) snapshotMatches.push(x);
+          }
+        }
       }
-      /* c8 ignore stop */
-      static fromGlob(pattern, options = {}) {
-        return orig.AST.fromGlob(pattern, ext(def, options));
+      const credentialMatches = [...diffMatches, ...snapshotMatches.filter((m) => !diffMatches.includes(m))];
+      const sensitiveFiles = patch.files.filter((f) => isSensitiveFile(f));
+      if (credentialMatches.length > 0 || sensitiveFiles.length > 0) {
+        const reasons = [];
+        if (credentialMatches.length > 0) {
+          reasons.push(`credential patterns: ${credentialMatches.join(", ")}`);
+        }
+        if (sensitiveFiles.length > 0) {
+          reasons.push(`sensitive files: ${sensitiveFiles.join(", ")}`);
+        }
+        const allProtected = patch.files.length > 0 && patch.files.every(
+          (f) => this.fernignorePatterns.some((p) => f === p || minimatch(f, p))
+        );
+        if (!allProtected) {
+          this.warnings.push(
+            `Patch ${patch.id} removed from lockfile: ${reasons.join("; ")}. This prevents credential exposure in committed lockfiles.`
+          );
+        }
+      } else {
+        cleanPatches.push(patch);
       }
-    },
-    unescape: (s, options = {}) => orig.unescape(s, ext(def, options)),
-    escape: (s, options = {}) => orig.escape(s, ext(def, options)),
-    filter: (pattern, options = {}) => orig.filter(pattern, ext(def, options)),
-    defaults: (options) => orig.defaults(ext(def, options)),
-    makeRe: (pattern, options = {}) => orig.makeRe(pattern, ext(def, options)),
-    braceExpand: (pattern, options = {}) => orig.braceExpand(pattern, ext(def, options)),
-    match: (list, pattern, options = {}) => orig.match(list, pattern, ext(def, options)),
-    sep: orig.sep,
-    GLOBSTAR
-  });
-};
-minimatch.defaults = defaults;
-var braceExpand = (pattern, options = {}) => {
-  assertValidPattern(pattern);
-  if (options.nobrace || !/\{(?:(?!\{).)*\}/.test(pattern)) {
-    return [pattern];
+    }
+    this.lock.patches = cleanPatches;
+    const dir = (0, import_node_path2.dirname)(this.lockfilePath);
+    if (!(0, import_node_fs.existsSync)(dir)) {
+      (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+    }
+    const yaml = (0, import_yaml.stringify)(this.lock, {
+      lineWidth: 0,
+      blockQuote: "literal"
+    });
+    const content = LOCKFILE_HEADER + yaml;
+    const tmpPath = this.lockfilePath + ".tmp";
+    (0, import_node_fs.writeFileSync)(tmpPath, content, "utf-8");
+    (0, import_node_fs.renameSync)(tmpPath, this.lockfilePath);
   }
-  return (0, import_brace_expansion.default)(pattern);
-};
-minimatch.braceExpand = braceExpand;
-var makeRe = (pattern, options = {}) => new Minimatch(pattern, options).makeRe();
-minimatch.makeRe = makeRe;
-var match = (list, pattern, options = {}) => {
-  const mm = new Minimatch(pattern, options);
-  list = list.filter((f) => mm.match(f));
-  if (mm.options.nonull && !list.length) {
-    list.push(pattern);
+  addGeneration(record) {
+    this.ensureLoaded();
+    this.lock.generations.push(record);
+    this.lock.current_generation = record.commit_sha;
   }
-  return list;
-};
-minimatch.match = match;
-var globMagic = /[?*]|[+@!]\(.*?\)|\[|\]/;
-var regExpEscape2 = (s) => s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&");
-var Minimatch = class {
-  options;
-  set;
-  pattern;
-  windowsPathsNoEscape;
-  nonegate;
-  negate;
-  comment;
-  empty;
-  preserveMultipleSlashes;
-  partial;
-  globSet;
-  globParts;
-  nocase;
-  isWindows;
-  platform;
-  windowsNoMagicRoot;
-  regexp;
-  constructor(pattern, options = {}) {
-    assertValidPattern(pattern);
-    options = options || {};
-    this.options = options;
-    this.pattern = pattern;
-    this.platform = options.platform || defaultPlatform;
-    this.isWindows = this.platform === "win32";
-    this.windowsPathsNoEscape = !!options.windowsPathsNoEscape || options.allowWindowsEscape === false;
-    if (this.windowsPathsNoEscape) {
-      this.pattern = this.pattern.replace(/\\/g, "/");
+  addPatch(patch) {
+    this.ensureLoaded();
+    this.lock.patches.push(patch);
+  }
+  updatePatch(patchId, updates) {
+    this.ensureLoaded();
+    const patch = this.lock.patches.find((p) => p.id === patchId);
+    if (!patch) {
+      throw new Error(`Patch not found: ${patchId}`);
     }
-    this.preserveMultipleSlashes = !!options.preserveMultipleSlashes;
-    this.regexp = null;
-    this.negate = false;
-    this.nonegate = !!options.nonegate;
-    this.comment = false;
-    this.empty = false;
-    this.partial = !!options.partial;
-    this.nocase = !!this.options.nocase;
-    this.windowsNoMagicRoot = options.windowsNoMagicRoot !== void 0 ? options.windowsNoMagicRoot : !!(this.isWindows && this.nocase);
-    this.globSet = [];
-    this.globParts = [];
-    this.set = [];
-    this.make();
+    Object.assign(patch, updates);
   }
-  hasMagic() {
-    if (this.options.magicalBraces && this.set.length > 1) {
-      return true;
+  removePatch(patchId) {
+    this.ensureLoaded();
+    this.lock.patches = this.lock.patches.filter((p) => p.id !== patchId);
+  }
+  clearPatches() {
+    this.ensureLoaded();
+    this.lock.patches = [];
+  }
+  addForgottenHash(hash) {
+    this.ensureLoaded();
+    if (!this.lock.forgotten_hashes) {
+      this.lock.forgotten_hashes = [];
+    }
+    if (!this.lock.forgotten_hashes.includes(hash)) {
+      this.lock.forgotten_hashes.push(hash);
+    }
+  }
+  getUnresolvedPatches() {
+    this.ensureLoaded();
+    return this.lock.patches.filter((p) => p.status === "unresolved");
+  }
+  getResolvingPatches() {
+    this.ensureLoaded();
+    return this.lock.patches.filter((p) => p.status === "resolving");
+  }
+  markPatchUnresolved(patchId) {
+    this.updatePatch(patchId, { status: "unresolved" });
+  }
+  markPatchResolved(patchId, updates) {
+    this.ensureLoaded();
+    const patch = this.lock.patches.find((p) => p.id === patchId);
+    if (!patch) {
+      throw new Error(`Patch not found: ${patchId}`);
+    }
+    delete patch.status;
+    Object.assign(patch, updates);
+  }
+  getPatches() {
+    this.ensureLoaded();
+    return this.lock.patches;
+  }
+  setReplaySkippedAt(timestamp) {
+    this.ensureLoaded();
+    this.lock.replay_skipped_at = timestamp;
+  }
+  clearReplaySkippedAt() {
+    this.ensureLoaded();
+    delete this.lock.replay_skipped_at;
+  }
+  isReplaySkipped() {
+    this.ensureLoaded();
+    return this.lock.replay_skipped_at != null;
+  }
+  getGeneration(commitSha) {
+    this.ensureLoaded();
+    return this.lock.generations.find((g) => g.commit_sha === commitSha);
+  }
+  getCustomizationsConfig() {
+    if (!(0, import_node_fs.existsSync)(this.customizationsPath)) {
+      return {};
+    }
+    const content = (0, import_node_fs.readFileSync)(this.customizationsPath, "utf-8");
+    return (0, import_yaml.parse)(content) ?? {};
+  }
+  ensureLoaded() {
+    if (!this.lock) {
+      throw new Error("No lockfile loaded. Call read() or initialize() first.");
+    }
+  }
+};
+
+// src/ReplayDetector.ts
+var import_node_crypto = require("crypto");
+
+// src/shared/binary.ts
+var import_node_path3 = require("path");
+var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".bmp",
+  ".ico",
+  ".webp",
+  ".svg",
+  ".pdf",
+  ".doc",
+  ".docx",
+  ".xls",
+  ".xlsx",
+  ".ppt",
+  ".pptx",
+  ".zip",
+  ".gz",
+  ".tar",
+  ".bz2",
+  ".7z",
+  ".rar",
+  ".jar",
+  ".war",
+  ".ear",
+  ".class",
+  ".exe",
+  ".dll",
+  ".so",
+  ".dylib",
+  ".o",
+  ".a",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".eot",
+  ".otf",
+  ".mp3",
+  ".mp4",
+  ".avi",
+  ".mov",
+  ".wav",
+  ".flac",
+  ".sqlite",
+  ".db",
+  ".pyc",
+  ".pyo",
+  ".DS_Store"
+]);
+function isBinaryFile(filePath) {
+  const ext2 = (0, import_node_path3.extname)(filePath).toLowerCase();
+  return BINARY_EXTENSIONS.has(ext2);
+}
+
+// src/git/CommitDetection.ts
+var FERN_BOT_NAME = "fern-api";
+var FERN_BOT_EMAIL = "115122769+fern-api[bot]@users.noreply.github.com";
+var FERN_BOT_LOGIN = "fern-api[bot]";
+var FERN_SUPPORT_NAMES = ["fern-support", "Fern Support"];
+function isGenerationCommit(commit) {
+  const isFernSupport = FERN_SUPPORT_NAMES.includes(commit.authorName);
+  const isBotAuthor = !isFernSupport && (commit.authorLogin === FERN_BOT_LOGIN || commit.authorEmail === FERN_BOT_EMAIL || commit.authorName === FERN_BOT_NAME);
+  const hasGenerationMarker = commit.message.startsWith("[fern-generated]") || commit.message.startsWith("[fern-replay]") || commit.message.startsWith("[fern-autoversion]") || commit.message.includes("Generated by Fern") || commit.message.includes("\u{1F916} Generated with Fern") || // Squash merge of a Fern-generated PR uses the PR title as commit message.
+  // The default PR title is "SDK Generation" (from GithubStep's commitMessage default).
+  // GitHub appends "(#N)" for the PR number, e.g. "SDK Generation (#70)".
+  commit.message.startsWith("SDK Generation") || // Merge commit (GitHub's "Create a merge commit" option) of a fern-bot
+  // regen PR. First-parent walking lands on this commit, not on the
+  // generation commit on the side branch, so the classifier must treat
+  // it as a generation boundary. GitHub's default subject is
+  // "Merge pull request #N from <owner>/<branch>"; fern-bot branches are
+  // named "<owner>/fern-bot/<...>".
+  /^Merge pull request #\d+ from [^/]+\/fern-bot\//.test(commit.message);
+  return isBotAuthor || hasGenerationMarker;
+}
+function isGenerationBoundary(commit) {
+  const isFernSupport = FERN_SUPPORT_NAMES.includes(commit.authorName);
+  const isBotAuthor = !isFernSupport && (commit.authorLogin === FERN_BOT_LOGIN || commit.authorEmail === FERN_BOT_EMAIL || commit.authorName === FERN_BOT_NAME);
+  const isAutoversion = commit.message.startsWith("[fern-autoversion]");
+  const hasBoundaryMarker = commit.message.startsWith("[fern-generated]") || commit.message.startsWith("[fern-replay]") || commit.message.includes("Generated by Fern") || commit.message.includes("\u{1F916} Generated with Fern") || commit.message.startsWith("SDK Generation");
+  return isBotAuthor && !isAutoversion || hasBoundaryMarker;
+}
+function isReplayCommit(commit) {
+  return commit.message.startsWith("[fern-replay]");
+}
+function isRevertCommit(message) {
+  return /^Revert ".+"$/.test(message);
+}
+function parseRevertedSha(fullBody) {
+  const match2 = fullBody.match(/This reverts commit ([0-9a-f]{40})\./);
+  return match2?.[1];
+}
+function parseRevertedMessage(subject) {
+  const match2 = subject.match(/^Revert "(.+)"$/);
+  return match2?.[1];
+}
+
+// src/ReplayDetector.ts
+var INFRASTRUCTURE_FILES = /* @__PURE__ */ new Set([".fernignore"]);
+function parsePatchFileHeaders(patchContent) {
+  const results = [];
+  let currentPath = null;
+  let currentIsCreate = false;
+  let currentIsDelete = false;
+  const flush = () => {
+    if (currentPath !== null) {
+      results.push({ path: currentPath, isCreate: currentIsCreate, isDelete: currentIsDelete });
     }
-    for (const pattern of this.set) {
-      for (const part of pattern) {
-        if (typeof part !== "string")
-          return true;
+  };
+  for (const line of patchContent.split("\n")) {
+    if (line.startsWith("diff --git ")) {
+      flush();
+      currentPath = null;
+      currentIsCreate = false;
+      currentIsDelete = false;
+      const match2 = line.match(/^diff --git a\/(.+?) b\/(.+?)$/);
+      if (match2) {
+        currentPath = match2[2] ?? null;
+      }
+    } else if (currentPath !== null) {
+      if (line.startsWith("new file mode ")) {
+        currentIsCreate = true;
+      } else if (line.startsWith("deleted file mode ")) {
+        currentIsDelete = true;
       }
     }
-    return false;
   }
-  debug(..._) {
+  flush();
+  return results;
+}
+async function capturePatchSnapshot(git, files, treeish) {
+  const snapshot = {};
+  for (const file of files) {
+    if (isBinaryFile(file)) continue;
+    const content = await git.showFile(treeish, file).catch(() => null);
+    if (content != null) snapshot[file] = content;
   }
-  make() {
-    const pattern = this.pattern;
-    const options = this.options;
-    if (!options.nocomment && pattern.charAt(0) === "#") {
-      this.comment = true;
-      return;
-    }
-    if (!pattern) {
-      this.empty = true;
-      return;
-    }
-    this.parseNegate();
-    this.globSet = [...new Set(this.braceExpand())];
-    if (options.debug) {
-      this.debug = (...args) => console.error(...args);
+  return snapshot;
+}
+function filterInfrastructureAndSensitiveFiles(rawFilesOutput) {
+  const allFiles = rawFilesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f)).filter((f) => !f.startsWith(".fern/"));
+  const sensitiveFiles = allFiles.filter((f) => isSensitiveFile(f));
+  const files = allFiles.filter((f) => !isSensitiveFile(f));
+  return { files, sensitiveFiles };
+}
+var ReplayDetector = class {
+  git;
+  lockManager;
+  sdkOutputDir;
+  warnings = [];
+  constructor(git, lockManager, sdkOutputDir) {
+    this.git = git;
+    this.lockManager = lockManager;
+    this.sdkOutputDir = sdkOutputDir;
+  }
+  /**
+   * Derive the previous-generation SHA from git history instead of trusting
+   * `lock.current_generation`.
+   *
+   * Walks `git log HEAD --first-parent` and returns the SHA of the most recent
+   * commit that `isGenerationBoundary` classifies as a customization-baseline
+   * boundary, or null if no such commit is reachable from HEAD on the mainline.
+   *
+   * `isGenerationBoundary` is intentionally narrower than `isGenerationCommit`:
+   * it excludes `[fern-autoversion]` (lightweight bumps that don't reset the
+   * baseline) and the GitHub merge-commit subject for fern-bot regen PRs
+   * (which sits on first-parent but where the customer fix-up commits live
+   * on second-parent — stopping at the merge would hide them).
+   *
+   * See docs/adr/0001-derived-scan-boundary.md.
+   */
+  async findPreviousGenerationFromHistory() {
+    let log;
+    try {
+      log = await this.git.exec([
+        "log",
+        "--first-parent",
+        "--format=%H%x00%an%x00%ae%x00%s",
+        "HEAD"
+      ]);
+    } catch {
+      return null;
     }
-    this.debug(this.pattern, this.globSet);
-    const rawGlobParts = this.globSet.map((s) => this.slashSplit(s));
-    this.globParts = this.preprocess(rawGlobParts);
-    this.debug(this.pattern, this.globParts);
-    let set = this.globParts.map((s, _, __) => {
-      if (this.isWindows && this.windowsNoMagicRoot) {
-        const isUNC = s[0] === "" && s[1] === "" && (s[2] === "?" || !globMagic.test(s[2])) && !globMagic.test(s[3]);
-        const isDrive = /^[a-z]:/i.test(s[0]);
-        if (isUNC) {
-          return [...s.slice(0, 4), ...s.slice(4).map((ss) => this.parse(ss))];
-        } else if (isDrive) {
-          return [s[0], ...s.slice(1).map((ss) => this.parse(ss))];
-        }
-      }
-      return s.map((ss) => this.parse(ss));
-    });
-    this.debug(this.pattern, set);
-    this.set = set.filter((s) => s.indexOf(false) === -1);
-    if (this.isWindows) {
-      for (let i = 0; i < this.set.length; i++) {
-        const p = this.set[i];
-        if (p[0] === "" && p[1] === "" && this.globParts[i][2] === "?" && typeof p[3] === "string" && /^[a-z]:$/i.test(p[3])) {
-          p[2] = "?";
-        }
+    for (const commit of this.parseGitLog(log)) {
+      if (isGenerationBoundary(commit)) {
+        return commit.sha;
       }
     }
-    this.debug(this.pattern, this.set);
+    return null;
   }
-  // various transforms to equivalent pattern sets that are
-  // faster to process in a filesystem walk.  The goal is to
-  // eliminate what we can, and push all ** patterns as far
-  // to the right as possible, even if it increases the number
-  // of patterns that we have to process.
-  preprocess(globParts) {
-    if (this.options.noglobstar) {
-      for (let i = 0; i < globParts.length; i++) {
-        for (let j = 0; j < globParts[i].length; j++) {
-          if (globParts[i][j] === "**") {
-            globParts[i][j] = "*";
-          }
-        }
-      }
+  async detectNewPatches() {
+    const lock = this.lockManager.read();
+    const derivedSha = await this.findPreviousGenerationFromHistory();
+    if (derivedSha !== null) {
+      const derivedRecord = await this.synthesizeGenerationRecord(derivedSha);
+      return this.detectPatchesInRange(derivedSha, derivedRecord, lock);
     }
-    const { optimizationLevel = 1 } = this.options;
-    if (optimizationLevel >= 2) {
-      globParts = this.firstPhasePreProcess(globParts);
-      globParts = this.secondPhasePreProcess(globParts);
-    } else if (optimizationLevel >= 1) {
-      globParts = this.levelOneOptimize(globParts);
-    } else {
-      globParts = this.adjascentGlobstarOptimize(globParts);
+    const lastGen = this.getLastGeneration(lock);
+    if (!lastGen) {
+      return { patches: [], revertedPatchIds: [] };
     }
-    return globParts;
-  }
-  // just get rid of adjascent ** portions
-  adjascentGlobstarOptimize(globParts) {
-    return globParts.map((parts) => {
-      let gs = -1;
-      while (-1 !== (gs = parts.indexOf("**", gs + 1))) {
-        let i = gs;
-        while (parts[i + 1] === "**") {
-          i++;
-        }
-        if (i !== gs) {
-          parts.splice(gs, i - gs);
-        }
-      }
-      return parts;
-    });
-  }
-  // get rid of adjascent ** and resolve .. portions
-  levelOneOptimize(globParts) {
-    return globParts.map((parts) => {
-      parts = parts.reduce((set, part) => {
-        const prev = set[set.length - 1];
-        if (part === "**" && prev === "**") {
-          return set;
-        }
-        if (part === "..") {
-          if (prev && prev !== ".." && prev !== "." && prev !== "**") {
-            set.pop();
-            return set;
-          }
-        }
-        set.push(part);
-        return set;
-      }, []);
-      return parts.length === 0 ? [""] : parts;
-    });
+    const exists2 = await this.git.commitExists(lastGen.commit_sha);
+    if (!exists2) {
+      this.warnings.push(
+        `Generation commit ${lastGen.commit_sha.slice(0, 7)} not found in git history. Falling back to tree-diff detection (likely a shallow clone).`
+      );
+      return this.detectPatchesViaTreeDiff(
+        lastGen,
+        /* commitKnownMissing */
+        true
+      );
+    }
+    return this.detectPatchesInRange(lastGen.commit_sha, lastGen, lock);
   }
-  levelTwoFileOptimize(parts) {
-    if (!Array.isArray(parts)) {
-      parts = this.slashSplit(parts);
+  /**
+   * Walk `${rangeStart}..HEAD`, classify each commit, emit one
+   * `StoredPatch` per customer commit. Body shared by the linear path
+   * (rangeStart = lastGen.commit_sha) and the merge-base path.
+   *
+   * Patch `base_generation` is always `lastGen.commit_sha` — the
+   * lockfile-tracked reference the applicator uses to fetch base file
+   * content, regardless of where the walk actually started.
+   */
+  async detectPatchesInRange(rangeStart, lastGen, lock) {
+    const log = await this.git.exec([
+      "log",
+      "--no-merges",
+      "--format=%H%x00%an%x00%ae%x00%s",
+      `${rangeStart}..HEAD`,
+      "--",
+      this.sdkOutputDir
+    ]);
+    if (!log.trim()) {
+      return { patches: [], revertedPatchIds: [] };
     }
-    let didSomething = false;
-    do {
-      didSomething = false;
-      if (!this.preserveMultipleSlashes) {
-        for (let i = 1; i < parts.length - 1; i++) {
-          const p = parts[i];
-          if (i === 1 && p === "" && parts[0] === "")
-            continue;
-          if (p === "." || p === "") {
-            didSomething = true;
-            parts.splice(i, 1);
-            i--;
+    const commits = this.parseGitLog(log);
+    const newPatches = [];
+    const forgottenHashes = new Set(lock.forgotten_hashes ?? []);
+    for (const commit of commits) {
+      if (isGenerationCommit(commit)) {
+        continue;
+      }
+      if (lock.patches.find((p) => p.original_commit === commit.sha)) {
+        continue;
+      }
+      const parents = await this.git.getCommitParents(commit.sha);
+      let patchContent;
+      try {
+        patchContent = await this.git.formatPatch(commit.sha);
+      } catch {
+        this.warnings.push(
+          `Could not generate patch for commit ${commit.sha.slice(0, 7)} \u2014 it may be unreachable in a shallow clone. Skipping.`
+        );
+        continue;
+      }
+      let contentHash = this.computeContentHash(patchContent);
+      if (lock.patches.find((p) => p.content_hash === contentHash) || forgottenHashes.has(contentHash)) {
+        continue;
+      }
+      const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
+      const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
+      if (sensitiveFiles.length > 0) {
+        this.warnings.push(
+          `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
+        );
+        if (files.length > 0) {
+          const parentSha = parents[0];
+          if (parentSha) {
+            try {
+              patchContent = await this.git.exec(["diff", parentSha, commit.sha, "--", ...files]);
+            } catch {
+              continue;
+            }
+            if (!patchContent.trim()) continue;
+            contentHash = this.computeContentHash(patchContent);
           }
         }
-        if (parts[0] === "." && parts.length === 2 && (parts[1] === "." || parts[1] === "")) {
-          didSomething = true;
-          parts.pop();
-        }
       }
-      let dd = 0;
-      while (-1 !== (dd = parts.indexOf("..", dd + 1))) {
-        const p = parts[dd - 1];
-        if (p && p !== "." && p !== ".." && p !== "**") {
-          didSomething = true;
-          parts.splice(dd - 1, 2);
-          dd -= 2;
+      if (files.length === 0) {
+        continue;
+      }
+      const theirsSnapshot = await capturePatchSnapshot(this.git, files, commit.sha);
+      newPatches.push({
+        id: `patch-${commit.sha.slice(0, 8)}`,
+        content_hash: contentHash,
+        original_commit: commit.sha,
+        original_message: commit.message,
+        original_author: `${commit.authorName} <${commit.authorEmail}>`,
+        base_generation: lastGen.commit_sha,
+        files,
+        patch_content: patchContent,
+        ...Object.keys(theirsSnapshot).length > 0 ? { theirs_snapshot: theirsSnapshot } : {},
+        ...this.isCreationOnlyPatch(patchContent) ? { user_owned: true } : {}
+      });
+    }
+    const survivingPatches = await this.collapseNetZeroFiles(newPatches);
+    survivingPatches.reverse();
+    const revertedPatchIdSet = /* @__PURE__ */ new Set();
+    const revertIndicesToRemove = /* @__PURE__ */ new Set();
+    for (let i = 0; i < survivingPatches.length; i++) {
+      const patch = survivingPatches[i];
+      if (!isRevertCommit(patch.original_message)) continue;
+      let body = "";
+      try {
+        body = await this.git.getCommitBody(patch.original_commit);
+      } catch {
+      }
+      const revertedSha = parseRevertedSha(body);
+      const revertedMessage = parseRevertedMessage(patch.original_message);
+      let matchedExisting = false;
+      if (revertedSha) {
+        const existing = lock.patches.find((p) => p.original_commit === revertedSha);
+        if (existing) {
+          revertedPatchIdSet.add(existing.id);
+          revertIndicesToRemove.add(i);
+          matchedExisting = true;
         }
       }
-    } while (didSomething);
-    return parts.length === 0 ? [""] : parts;
-  }
-  // First phase: single-pattern processing
-  // <pre> is 1 or more portions
-  // <rest> is 1 or more portions
-  // <p> is any portion other than ., .., '', or **
-  // <e> is . or ''
-  //
-  // **/.. is *brutal* for filesystem walking performance, because
-  // it effectively resets the recursive walk each time it occurs,
-  // and ** cannot be reduced out by a .. pattern part like a regexp
-  // or most strings (other than .., ., and '') can be.
-  //
-  // <pre>/**/../<p>/<p>/<rest> -> {<pre>/../<p>/<p>/<rest>,<pre>/**/<p>/<p>/<rest>}
-  // <pre>/<e>/<rest> -> <pre>/<rest>
-  // <pre>/<p>/../<rest> -> <pre>/<rest>
-  // **/**/<rest> -> **/<rest>
-  //
-  // **/*/<rest> -> */**/<rest> <== not valid because ** doesn't follow
-  // this WOULD be allowed if ** did follow symlinks, or * didn't
-  firstPhasePreProcess(globParts) {
-    let didSomething = false;
-    do {
-      didSomething = false;
-      for (let parts of globParts) {
-        let gs = -1;
-        while (-1 !== (gs = parts.indexOf("**", gs + 1))) {
-          let gss = gs;
-          while (parts[gss + 1] === "**") {
-            gss++;
-          }
-          if (gss > gs) {
-            parts.splice(gs + 1, gss - gs);
-          }
-          let next = parts[gs + 1];
-          const p = parts[gs + 2];
-          const p2 = parts[gs + 3];
-          if (next !== "..")
-            continue;
-          if (!p || p === "." || p === ".." || !p2 || p2 === "." || p2 === "..") {
-            continue;
-          }
-          didSomething = true;
-          parts.splice(gs, 1);
-          const other = parts.slice(0);
-          other[gs] = "**";
-          globParts.push(other);
-          gs--;
+      if (!matchedExisting && revertedMessage) {
+        const existing = lock.patches.find((p) => p.original_message === revertedMessage);
+        if (existing) {
+          revertedPatchIdSet.add(existing.id);
+          revertIndicesToRemove.add(i);
+          matchedExisting = true;
         }
-        if (!this.preserveMultipleSlashes) {
-          for (let i = 1; i < parts.length - 1; i++) {
-            const p = parts[i];
-            if (i === 1 && p === "" && parts[0] === "")
-              continue;
-            if (p === "." || p === "") {
-              didSomething = true;
-              parts.splice(i, 1);
-              i--;
-            }
-          }
-          if (parts[0] === "." && parts.length === 2 && (parts[1] === "." || parts[1] === "")) {
-            didSomething = true;
-            parts.pop();
-          }
+      }
+      if (matchedExisting) continue;
+      let matchedNew = false;
+      if (revertedSha) {
+        const idx = survivingPatches.findIndex(
+          (p, j) => j !== i && !revertIndicesToRemove.has(j) && p.original_commit === revertedSha
+        );
+        if (idx !== -1) {
+          revertIndicesToRemove.add(i);
+          revertIndicesToRemove.add(idx);
+          matchedNew = true;
         }
-        let dd = 0;
-        while (-1 !== (dd = parts.indexOf("..", dd + 1))) {
-          const p = parts[dd - 1];
-          if (p && p !== "." && p !== ".." && p !== "**") {
-            didSomething = true;
-            const needDot = dd === 1 && parts[dd + 1] === "**";
-            const splin = needDot ? ["."] : [];
-            parts.splice(dd - 1, 2, ...splin);
-            if (parts.length === 0)
-              parts.push("");
-            dd -= 2;
-          }
+      }
+      if (!matchedNew && revertedMessage) {
+        const idx = survivingPatches.findIndex(
+          (p, j) => j !== i && !revertIndicesToRemove.has(j) && p.original_message === revertedMessage
+        );
+        if (idx !== -1) {
+          revertIndicesToRemove.add(i);
+          revertIndicesToRemove.add(idx);
         }
       }
-    } while (didSomething);
-    return globParts;
+      if (!matchedExisting && !matchedNew) {
+        revertIndicesToRemove.add(i);
+      }
+    }
+    const filteredPatches = survivingPatches.filter((_, i) => !revertIndicesToRemove.has(i));
+    return { patches: filteredPatches, revertedPatchIds: [...revertedPatchIdSet] };
   }
-  // second phase: multi-pattern dedupes
-  // {<pre>/*/<rest>,<pre>/<p>/<rest>} -> <pre>/*/<rest>
-  // {<pre>/<rest>,<pre>/<rest>} -> <pre>/<rest>
-  // {<pre>/**/<rest>,<pre>/<rest>} -> <pre>/**/<rest>
-  //
-  // {<pre>/**/<rest>,<pre>/**/<p>/<rest>} -> <pre>/**/<rest>
-  // ^-- not valid because ** doens't follow symlinks
-  secondPhasePreProcess(globParts) {
-    for (let i = 0; i < globParts.length - 1; i++) {
-      for (let j = i + 1; j < globParts.length; j++) {
-        const matched = this.partsMatch(globParts[i], globParts[j], !this.preserveMultipleSlashes);
-        if (matched) {
-          globParts[i] = [];
-          globParts[j] = matched;
-          break;
-        }
+  /**
+   * Compute content hash for deduplication.
+   *
+   * Produces a format-agnostic hash so both `git format-patch` output
+   * (email-wrapped) and plain `git diff` output hash to the same value
+   * when the underlying diff hunks are identical.
+   *
+   * Normalization:
+   *   1. Strip email wrapper: everything before the first `diff --git` line
+   *      (From:, Subject:, Date:, diffstat, blank separators).
+   *   2. Strip `index` lines (blob SHA pairs change across rebases).
+   *   3. Strip trailing git version marker (`-- \n<version>`).
+   *
+   * This ensures content hashes match across the no-patches and normal-
+   * regeneration flows, which store formatPatch and git-diff formats
+   * respectively.
+   */
+  computeContentHash(patchContent) {
+    const lines = patchContent.split("\n");
+    const diffStart = lines.findIndex((l) => l.startsWith("diff --git "));
+    const relevantLines = diffStart > 0 ? lines.slice(diffStart) : lines;
+    const normalized = relevantLines.filter((line) => !line.startsWith("index ")).join("\n").replace(/\n-- \n[\d]+\.[\d]+[^\n]*\s*$/, "");
+    return `sha256:${(0, import_node_crypto.createHash)("sha256").update(normalized).digest("hex")}`;
+  }
+  /**
+   * Drop patches whose files were transiently created and then deleted
+   * within the current linear detection window, and are absent from
+   * HEAD at the end of the window.
+   *
+   * Rationale: each commit becomes its own patch, so a file that was
+   * briefly added and later removed survives as a create+delete pair whose
+   * cumulative diff is empty. We drop such patches before they reach the
+   * lockfile.
+   *
+   * A file is "transient" when:
+   *   1. some patch in the window sets `new file mode` for it (a creation), AND
+   *   2. some patch in the window sets `deleted file mode` for it (a deletion), AND
+   *   3. it is absent from HEAD's tree.
+   *
+   * The HEAD guard (#3) prevents false positives when a file is deleted
+   * and then recreated with different content — the cumulative diff of
+   * such a pair is non-empty and must be preserved.
+   *
+   * This only drops patches whose `files` are a subset of the transient
+   * set. A partial-transient patch (one that touches a transient file
+   * alongside a persistent one) is left unmodified; surgical stripping of
+   * single files from a multi-file patch would require a follow-up that
+   * regenerates the patch content via `git format-patch -- <files>`. No
+   * current failing test exercises this, and leaving the patch intact
+   * preserves today's behaviour. Revisit if a future adversarial test
+   * demands per-file stripping.
+   */
+  async collapseNetZeroFiles(patches) {
+    if (patches.length === 0) return patches;
+    const stateByFile = /* @__PURE__ */ new Map();
+    for (const patch of patches) {
+      for (const header of parsePatchFileHeaders(patch.patch_content)) {
+        if (!header.isCreate && !header.isDelete) continue;
+        const prior = stateByFile.get(header.path) ?? { created: false, deleted: false };
+        if (header.isCreate) prior.created = true;
+        if (header.isDelete) prior.deleted = true;
+        stateByFile.set(header.path, prior);
       }
     }
-    return globParts.filter((gs) => gs.length);
-  }
-  partsMatch(a, b, emptyGSMatch = false) {
-    let ai = 0;
-    let bi = 0;
-    let result = [];
-    let which = "";
-    while (ai < a.length && bi < b.length) {
-      if (a[ai] === b[bi]) {
-        result.push(which === "b" ? b[bi] : a[ai]);
-        ai++;
-        bi++;
-      } else if (emptyGSMatch && a[ai] === "**" && b[bi] === a[ai + 1]) {
-        result.push(a[ai]);
-        ai++;
-      } else if (emptyGSMatch && b[bi] === "**" && a[ai] === b[bi + 1]) {
-        result.push(b[bi]);
-        bi++;
-      } else if (a[ai] === "*" && b[bi] && (this.options.dot || !b[bi].startsWith(".")) && b[bi] !== "**") {
-        if (which === "b")
-          return false;
-        which = "a";
-        result.push(a[ai]);
-        ai++;
-        bi++;
-      } else if (b[bi] === "*" && a[ai] && (this.options.dot || !a[ai].startsWith(".")) && a[ai] !== "**") {
-        if (which === "a")
-          return false;
-        which = "b";
-        result.push(b[bi]);
-        ai++;
-        bi++;
-      } else {
-        return false;
+    let anyCandidate = false;
+    for (const state of stateByFile.values()) {
+      if (state.created && state.deleted) {
+        anyCandidate = true;
+        break;
       }
     }
-    return a.length === b.length && result;
+    if (!anyCandidate) return patches;
+    const headFiles = await this.listHeadFiles();
+    const transient = /* @__PURE__ */ new Set();
+    for (const [file, state] of stateByFile) {
+      if (state.created && state.deleted && !headFiles.has(file)) {
+        transient.add(file);
+      }
+    }
+    if (transient.size === 0) return patches;
+    return patches.filter((patch) => !patch.files.every((f) => transient.has(f)));
   }
-  parseNegate() {
-    if (this.nonegate)
-      return;
-    const pattern = this.pattern;
-    let negate = false;
-    let negateOffset = 0;
-    for (let i = 0; i < pattern.length && pattern.charAt(i) === "!"; i++) {
-      negate = !negate;
-      negateOffset++;
+  /**
+   * List every tracked path at HEAD (one `git ls-tree -r` invocation).
+   * Returns an empty Set if HEAD is unborn or the invocation fails — the
+   * caller then treats every candidate as "not in HEAD" and may collapse
+   * more aggressively. On typical SDK repos this is a single sub-10ms call.
+   */
+  async listHeadFiles() {
+    try {
+      const out = await this.git.exec(["ls-tree", "-r", "--name-only", "HEAD"]);
+      return new Set(out.split("\n").map((l) => l.trim()).filter(Boolean));
+    } catch {
+      return /* @__PURE__ */ new Set();
     }
-    if (negateOffset)
-      this.pattern = pattern.slice(negateOffset);
-    this.negate = negate;
   }
-  // set partial to true to test if, for example,
-  // "/a/b" matches the start of "/*/b/*/d"
-  // Partial means, if you run out of file before you run
-  // out of pattern, then that's fine, as long as all
-  // the parts match.
-  matchOne(file, pattern, partial = false) {
-    const options = this.options;
-    if (this.isWindows) {
-      const fileDrive = typeof file[0] === "string" && /^[a-z]:$/i.test(file[0]);
-      const fileUNC = !fileDrive && file[0] === "" && file[1] === "" && file[2] === "?" && /^[a-z]:$/i.test(file[3]);
-      const patternDrive = typeof pattern[0] === "string" && /^[a-z]:$/i.test(pattern[0]);
-      const patternUNC = !patternDrive && pattern[0] === "" && pattern[1] === "" && pattern[2] === "?" && typeof pattern[3] === "string" && /^[a-z]:$/i.test(pattern[3]);
-      const fdi = fileUNC ? 3 : fileDrive ? 0 : void 0;
-      const pdi = patternUNC ? 3 : patternDrive ? 0 : void 0;
-      if (typeof fdi === "number" && typeof pdi === "number") {
-        const [fd, pd] = [file[fdi], pattern[pdi]];
-        if (fd.toLowerCase() === pd.toLowerCase()) {
-          pattern[pdi] = fd;
-          if (pdi > fdi) {
-            pattern = pattern.slice(pdi);
-          } else if (fdi > pdi) {
-            file = file.slice(fdi);
-          }
-        }
+  /**
+   * Detect patches via tree diff for non-linear history. Returns a composite patch.
+   * Revert reconciliation is skipped here because tree-diff produces a single composite
+   * patch from the aggregate diff — individual revert commits are not distinguishable.
+   */
+  async detectPatchesViaTreeDiff(lastGen, commitKnownMissing) {
+    const diffBase = await this.resolveDiffBase(lastGen, commitKnownMissing);
+    if (!diffBase) {
+      return this.detectPatchesViaCommitScan();
+    }
+    const lockForGuard = this.lockManager.read();
+    const knownGenerations = new Set(lockForGuard.generations.map((g) => g.commit_sha));
+    let resolvedBaseGeneration = commitKnownMissing ? diffBase : lastGen.commit_sha;
+    if (commitKnownMissing && !knownGenerations.has(diffBase)) {
+      const fallback = lockForGuard.current_generation ?? lockForGuard.generations[lockForGuard.generations.length - 1]?.commit_sha;
+      if (!fallback) {
+        this.warnings.push(
+          `Composite-patch fallback skipped: diff base ${diffBase.slice(0, 7)} is not a recorded generation and the lockfile has no recorded generations to anchor on. Customer customizations on disk are preserved; tracked patches will resume on the next regeneration.`
+        );
+        return { patches: [], revertedPatchIds: [] };
       }
+      resolvedBaseGeneration = fallback;
     }
-    const { optimizationLevel = 1 } = this.options;
-    if (optimizationLevel >= 2) {
-      file = this.levelTwoFileOptimize(file);
+    const filesOutput = await this.git.exec(["diff", "--name-only", diffBase, "HEAD"]);
+    const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
+    if (sensitiveFiles.length > 0) {
+      this.warnings.push(
+        `Sensitive file(s) excluded from composite patch: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
+      );
     }
-    this.debug("matchOne", this, { file, pattern });
-    this.debug("matchOne", file.length, pattern.length);
-    for (var fi = 0, pi = 0, fl = file.length, pl = pattern.length; fi < fl && pi < pl; fi++, pi++) {
-      this.debug("matchOne loop");
-      var p = pattern[pi];
-      var f = file[fi];
-      this.debug(pattern, p, f);
-      if (p === false) {
-        return false;
+    if (files.length === 0) return { patches: [], revertedPatchIds: [] };
+    const diff = await this.git.exec(["diff", diffBase, "HEAD", "--", ...files]);
+    if (!diff.trim()) return { patches: [], revertedPatchIds: [] };
+    const contentHash = this.computeContentHash(diff);
+    const lock = this.lockManager.read();
+    if (lock.patches.some((p) => p.content_hash === contentHash) || (lock.forgotten_hashes ?? []).includes(contentHash)) {
+      return { patches: [], revertedPatchIds: [] };
+    }
+    const headSha = (await this.git.exec(["rev-parse", "HEAD"])).trim();
+    const theirsSnapshot = await capturePatchSnapshot(this.git, files, "HEAD");
+    const compositePatch = {
+      id: `patch-composite-${headSha.slice(0, 8)}`,
+      content_hash: contentHash,
+      original_commit: headSha,
+      original_message: "Customer customizations (composite)",
+      original_author: "composite",
+      // Anchor `base_generation` on a SHA the applicator's
+      // `resolveBaseGeneration` can find — always a member of
+      // `lock.generations`. When `diffBase` is a recorded
+      // generation, use it directly; otherwise the guard above
+      // has already mapped it onto `current_generation`.
+      base_generation: resolvedBaseGeneration,
+      files,
+      patch_content: diff,
+      ...Object.keys(theirsSnapshot).length > 0 ? { theirs_snapshot: theirsSnapshot } : {},
+      ...this.isCreationOnlyPatch(diff) ? { user_owned: true } : {}
+    };
+    return { patches: [compositePatch], revertedPatchIds: [] };
+  }
+  /**
+   * Last-resort detection when both generation commit and tree are unreachable.
+   * Scans all commits from HEAD, filters against known lockfile patches, and
+   * skips creation-only commits (squashed history after force push).
+   *
+   * Detected patches use the commit's parent as base_generation so the applicator
+   * can find base file content from the parent's tree (which IS reachable).
+   */
+  async detectPatchesViaCommitScan() {
+    const lock = this.lockManager.read();
+    const knownGenerations = new Set(lock.generations.map((g) => g.commit_sha));
+    const fallbackAnchor = lock.current_generation ?? lock.generations[lock.generations.length - 1]?.commit_sha;
+    const log = await this.git.exec([
+      "log",
+      "--max-count=200",
+      "--format=%H%x00%an%x00%ae%x00%s",
+      "HEAD",
+      "--",
+      this.sdkOutputDir
+    ]);
+    if (!log.trim()) {
+      return { patches: [], revertedPatchIds: [] };
+    }
+    const commits = this.parseGitLog(log);
+    const newPatches = [];
+    const forgottenHashes = new Set(lock.forgotten_hashes ?? []);
+    const existingHashes = new Set(lock.patches.map((p) => p.content_hash));
+    const existingCommits = new Set(lock.patches.map((p) => p.original_commit));
+    for (const commit of commits) {
+      if (isGenerationCommit(commit)) {
+        continue;
       }
-      if (p === GLOBSTAR) {
-        this.debug("GLOBSTAR", [pattern, p, f]);
-        var fr = fi;
-        var pr = pi + 1;
-        if (pr === pl) {
-          this.debug("** at the end");
-          for (; fi < fl; fi++) {
-            if (file[fi] === "." || file[fi] === ".." || !options.dot && file[fi].charAt(0) === ".")
-              return false;
-          }
-          return true;
-        }
-        while (fr < fl) {
-          var swallowee = file[fr];
-          this.debug("\nglobstar while", file, fr, pattern, pr, swallowee);
-          if (this.matchOne(file.slice(fr), pattern.slice(pr), partial)) {
-            this.debug("globstar found match!", fr, fl, swallowee);
-            return true;
-          } else {
-            if (swallowee === "." || swallowee === ".." || !options.dot && swallowee.charAt(0) === ".") {
-              this.debug("dot detected!", file, fr, pattern, pr);
-              break;
-            }
-            this.debug("globstar swallow a segment, and continue");
-            fr++;
-          }
-        }
-        if (partial) {
-          this.debug("\n>>> no match, partial?", file, fr, pattern, pr);
-          if (fr === fl) {
-            return true;
+      const parents = await this.git.getCommitParents(commit.sha);
+      if (parents.length > 1) {
+        continue;
+      }
+      if (existingCommits.has(commit.sha)) {
+        continue;
+      }
+      let patchContent;
+      try {
+        patchContent = await this.git.formatPatch(commit.sha);
+      } catch {
+        continue;
+      }
+      let contentHash = this.computeContentHash(patchContent);
+      if (existingHashes.has(contentHash) || forgottenHashes.has(contentHash)) {
+        continue;
+      }
+      if (this.isCreationOnlyPatch(patchContent)) {
+        continue;
+      }
+      const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
+      const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
+      if (sensitiveFiles.length > 0) {
+        this.warnings.push(
+          `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
+        );
+        if (files.length > 0) {
+          if (parents.length === 0) {
+            continue;
+          }
+          try {
+            patchContent = await this.git.exec(["diff", parents[0], commit.sha, "--", ...files]);
+          } catch {
+            continue;
           }
+          if (!patchContent.trim()) continue;
+          contentHash = this.computeContentHash(patchContent);
         }
-        return false;
       }
-      let hit;
-      if (typeof p === "string") {
-        hit = f === p;
-        this.debug("string match", p, f, hit);
+      if (files.length === 0) {
+        continue;
+      }
+      if (parents.length === 0) {
+        continue;
+      }
+      const parentSha = parents[0];
+      let baseGeneration;
+      if (knownGenerations.has(parentSha)) {
+        baseGeneration = parentSha;
+      } else if (fallbackAnchor) {
+        baseGeneration = fallbackAnchor;
       } else {
-        hit = p.test(f);
-        this.debug("pattern match", p, f, hit);
+        this.warnings.push(
+          `Skipping commit ${commit.sha.slice(0, 7)} (${commit.message.split("\n")[0]}): no recorded generation in the lockfile to anchor on. The customer's state on disk is preserved; tracked patches will resume on the next regeneration.`
+        );
+        continue;
       }
-      if (!hit)
-        return false;
-    }
-    if (fi === fl && pi === pl) {
-      return true;
-    } else if (fi === fl) {
-      return partial;
-    } else if (pi === pl) {
-      return fi === fl - 1 && file[fi] === "";
-    } else {
-      throw new Error("wtf?");
+      const theirsSnapshot = await capturePatchSnapshot(this.git, files, commit.sha);
+      newPatches.push({
+        id: `patch-${commit.sha.slice(0, 8)}`,
+        content_hash: contentHash,
+        original_commit: commit.sha,
+        original_message: commit.message,
+        original_author: `${commit.authorName} <${commit.authorEmail}>`,
+        base_generation: baseGeneration,
+        files,
+        patch_content: patchContent,
+        ...Object.keys(theirsSnapshot).length > 0 ? { theirs_snapshot: theirsSnapshot } : {}
+      });
     }
+    newPatches.reverse();
+    return { patches: newPatches, revertedPatchIds: [] };
   }
-  braceExpand() {
-    return braceExpand(this.pattern, this.options);
-  }
-  parse(pattern) {
-    assertValidPattern(pattern);
-    const options = this.options;
-    if (pattern === "**")
-      return GLOBSTAR;
-    if (pattern === "")
-      return "";
-    let m;
-    let fastTest = null;
-    if (m = pattern.match(starRE)) {
-      fastTest = options.dot ? starTestDot : starTest;
-    } else if (m = pattern.match(starDotExtRE)) {
-      fastTest = (options.nocase ? options.dot ? starDotExtTestNocaseDot : starDotExtTestNocase : options.dot ? starDotExtTestDot : starDotExtTest)(m[1]);
-    } else if (m = pattern.match(qmarksRE)) {
-      fastTest = (options.nocase ? options.dot ? qmarksTestNocaseDot : qmarksTestNocase : options.dot ? qmarksTestDot : qmarksTest)(m);
-    } else if (m = pattern.match(starDotStarRE)) {
-      fastTest = options.dot ? starDotStarTestDot : starDotStarTest;
-    } else if (m = pattern.match(dotStarRE)) {
-      fastTest = dotStarTest;
-    }
-    const re = AST.fromGlob(pattern, this.options).toMMPattern();
-    if (fastTest && typeof re === "object") {
-      Reflect.defineProperty(re, "test", { value: fastTest });
+  /**
+   * Check if a format-patch consists entirely of new-file creations.
+   * Used to identify squashed commits after force push, which create all files
+   * from scratch (--- /dev/null) rather than modifying existing files.
+   */
+  isCreationOnlyPatch(patchContent) {
+    const diffOldHeaders = patchContent.split("\n").filter((l) => l.startsWith("--- "));
+    if (diffOldHeaders.length === 0) {
+      return false;
     }
-    return re;
+    return diffOldHeaders.every((l) => l === "--- /dev/null");
   }
-  makeRe() {
-    if (this.regexp || this.regexp === false)
-      return this.regexp;
-    const set = this.set;
-    if (!set.length) {
-      this.regexp = false;
-      return this.regexp;
+  /**
+   * Resolve the best available diff base for a generation record.
+   * Prefers commit_sha, falls back to tree_hash for unreachable commits.
+   * When commitKnownMissing is true, skips the redundant commitExists check.
+   */
+  async resolveDiffBase(gen, commitKnownMissing) {
+    if (!commitKnownMissing && await this.git.commitExists(gen.commit_sha)) {
+      return gen.commit_sha;
     }
-    const options = this.options;
-    const twoStar = options.noglobstar ? star2 : options.dot ? twoStarDot : twoStarNoDot;
-    const flags = new Set(options.nocase ? ["i"] : []);
-    let re = set.map((pattern) => {
-      const pp = pattern.map((p) => {
-        if (p instanceof RegExp) {
-          for (const f of p.flags.split(""))
-            flags.add(f);
-        }
-        return typeof p === "string" ? regExpEscape2(p) : p === GLOBSTAR ? GLOBSTAR : p._src;
-      });
-      pp.forEach((p, i) => {
-        const next = pp[i + 1];
-        const prev = pp[i - 1];
-        if (p !== GLOBSTAR || prev === GLOBSTAR) {
-          return;
-        }
-        if (prev === void 0) {
-          if (next !== void 0 && next !== GLOBSTAR) {
-            pp[i + 1] = "(?:\\/|" + twoStar + "\\/)?" + next;
-          } else {
-            pp[i] = twoStar;
-          }
-        } else if (next === void 0) {
-          pp[i - 1] = prev + "(?:\\/|" + twoStar + ")?";
-        } else if (next !== GLOBSTAR) {
-          pp[i - 1] = prev + "(?:\\/|\\/" + twoStar + "\\/)" + next;
-          pp[i + 1] = GLOBSTAR;
-        }
-      });
-      return pp.filter((p) => p !== GLOBSTAR).join("/");
-    }).join("|");
-    const [open, close] = set.length > 1 ? ["(?:", ")"] : ["", ""];
-    re = "^" + open + re + close + "$";
-    if (this.negate)
-      re = "^(?!" + re + ").+$";
-    try {
-      this.regexp = new RegExp(re, [...flags].join(""));
-    } catch (ex) {
-      this.regexp = false;
+    if (await this.git.treeExists(gen.tree_hash)) {
+      return gen.tree_hash;
     }
-    return this.regexp;
+    return null;
   }
-  slashSplit(p) {
-    if (this.preserveMultipleSlashes) {
-      return p.split("/");
-    } else if (this.isWindows && /^\/\/[^\/]+/.test(p)) {
-      return ["", ...p.split(/\/+/)];
-    } else {
-      return p.split(/\/+/);
-    }
+  parseGitLog(log) {
+    return log.trim().split("\n").map((line) => {
+      const [sha, authorName, authorEmail, message] = line.split("\0");
+      return { sha, authorName, authorEmail, message };
+    });
   }
-  match(f, partial = this.partial) {
-    this.debug("match", f, this.pattern);
-    if (this.comment) {
-      return false;
-    }
-    if (this.empty) {
-      return f === "";
-    }
-    if (f === "/" && partial) {
-      return true;
-    }
-    const options = this.options;
-    if (this.isWindows) {
-      f = f.split("\\").join("/");
-    }
-    const ff = this.slashSplit(f);
-    this.debug(this.pattern, "split", ff);
-    const set = this.set;
-    this.debug(this.pattern, "set", set);
-    let filename = ff[ff.length - 1];
-    if (!filename) {
-      for (let i = ff.length - 2; !filename && i >= 0; i--) {
-        filename = ff[i];
-      }
-    }
-    for (let i = 0; i < set.length; i++) {
-      const pattern = set[i];
-      let file = ff;
-      if (options.matchBase && pattern.length === 1) {
-        file = [filename];
-      }
-      const hit = this.matchOne(file, pattern, partial);
-      if (hit) {
-        if (options.flipNegate) {
-          return true;
-        }
-        return !this.negate;
-      }
-    }
-    if (options.flipNegate) {
-      return false;
-    }
-    return this.negate;
+  getLastGeneration(lock) {
+    return lock.generations.find((g) => g.commit_sha === lock.current_generation);
   }
-  static defaults(def) {
-    return minimatch.defaults(def).Minimatch;
+  /**
+   * Build a transient `GenerationRecord` from a SHA derived by walking git
+   * history. Only `commit_sha` (and `tree_hash` when needed downstream) is
+   * load-bearing here; the rest are filled with defensible placeholders.
+   * This record is consumed by `detectPatchesInRange` and is never persisted.
+   */
+  async synthesizeGenerationRecord(sha) {
+    let tree_hash = "";
+    try {
+      tree_hash = await this.git.getTreeHash(sha);
+    } catch {
+    }
+    return {
+      commit_sha: sha,
+      tree_hash,
+      timestamp: (/* @__PURE__ */ new Date(0)).toISOString(),
+      cli_version: "",
+      generator_versions: {}
+    };
   }
 };
-minimatch.AST = AST;
-minimatch.Minimatch = Minimatch;
-minimatch.escape = escape;
-minimatch.unescape = unescape;
 
 // src/ReplayService.ts
+var import_node_fs2 = require("fs");
+var import_promises6 = require("fs/promises");
+var import_node_path9 = require("path");
 init_GitClient();
 
 // src/ReplayApplicator.ts
@@ -17042,12 +17060,23 @@ async function computePerPatchDiff(patch, getCurrentGenContent, getWorkingTreeCo
       unlocatableFiles.push(file);
       continue;
     }
-    const locInCurrentGen = locInCurrentGenRaw.map(
-      (l) => resolveSpan(l, currentGenLines, "old")
-    );
-    const locInWorkingTree = locInWorkingTreeRaw.map(
-      (l) => resolveSpan(l, workingTreeLines, "new")
-    );
+    const locInCurrentGen = [];
+    const locInWorkingTree = [];
+    let spanResolutionFailed = false;
+    for (let i = 0; i < locInCurrentGenRaw.length; i++) {
+      const cg = resolveSpan(locInCurrentGenRaw[i], currentGenLines, "old");
+      const wt = resolveSpan(locInWorkingTreeRaw[i], workingTreeLines, "new");
+      if (cg === null || wt === null) {
+        spanResolutionFailed = true;
+        break;
+      }
+      locInCurrentGen.push(cg);
+      locInWorkingTree.push(wt);
+    }
+    if (spanResolutionFailed) {
+      unlocatableFiles.push(file);
+      continue;
+    }
     const overlay = overlayRegions(
       currentGenLines,
       locInCurrentGen,
@@ -17109,11 +17138,11 @@ function resolveSpan(loc, oursLines, prefer) {
   if (prefer === "old") {
     if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
     if (newFits) return { ...loc, oursSpan: hunk.newCount };
-  } else {
-    if (newFits) return { ...loc, oursSpan: hunk.newCount };
-    if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
+    return loc;
   }
-  return loc;
+  if (newFits) return { ...loc, oursSpan: hunk.newCount };
+  if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
+  return null;
 }
 function sequenceMatches(needle, haystack, offset) {
   if (offset + needle.length > haystack.length) return false;
@@ -17329,6 +17358,7 @@ var FirstGenerationFlow = class {
     };
   }
   async apply(_prep) {
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     return firstGenerationReport();
   }
@@ -17387,6 +17417,7 @@ var SkipApplicationFlow = class {
     };
   }
   async apply(_prep, options) {
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     const credentialWarnings = [...this.service.lockManager.warnings];
     if (!options?.stageOnly) {
@@ -17510,6 +17541,7 @@ var NoPatchesFlow = class {
         this.service.lockManager.addPatch(patch);
       }
     }
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     this.service.warnings.push(...this.service.lockManager.warnings);
     if (newPatches.length > 0) {
@@ -17672,6 +17704,7 @@ var NormalRegenerationFlow = class {
         }
       }
     }
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     this.service.warnings.push(...this.service.lockManager.warnings);
     if (options?.stageOnly) {
@@ -18365,6 +18398,11 @@ var ReplayService = class {
             (files) => this.git.exec(["diff", currentGen, "HEAD", "--", ...files]).catch(() => null)
           );
           if (ppResult === null) continue;
+          if (ppResult.hadFallback) {
+            this.warnings.push(
+              `Patch ${patch.id}: couldn't fully isolate ${ppResult.fallbackFiles.join(", ")} \u2014 customization preserved, attribution may have merged with another patch.`
+            );
+          }
           const diff = ppResult.diff;
           if (!diff.trim()) {
             if (await allPatchFilesUserOwned(patch)) continue;
@@ -18452,6 +18490,11 @@ var ReplayService = class {
           (files) => this.git.exec(["diff", currentGen, "HEAD", "--", ...files]).catch(() => null)
         );
         if (ppResult === null) continue;
+        if (ppResult.hadFallback) {
+          this.warnings.push(
+            `Patch ${patch.id}: couldn't fully isolate ${ppResult.fallbackFiles.join(", ")} \u2014 customization preserved, attribution may have merged with another patch.`
+          );
+        }
         const diff = ppResult.diff;
         if (!diff.trim()) {
           if (await allPatchFilesUserOwned(patch)) {
@@ -18546,6 +18589,7 @@ If you want to keep these lines, restore them in a follow-up commit and re-run r
       }
     }
   }
+  /** @internal Used by Flow implementations in `src/flows/`. */
   readFernignorePatterns() {
     const fernignorePath = (0, import_node_path9.join)(this.outputDir, ".fernignore");
     if (!(0, import_node_fs2.existsSync)(fernignorePath)) return [];