@lzehrung/codegraph 2.1.0 → 2.1.2

package/dist/indexer/build-cache/project-snapshot.js

@@ -6,29 +6,35 @@ import { buildGraphAdjacency } from "../../graphs/adjacency.js";
 import { buildReferenceCandidateIndex } from "../reference-candidates.js";
 import { BloomFilter, BloomFilterCache } from "../../util/bloomFilter.js";
 import { summarizeAnalysis } from "../../analysisSummary.js";
-import { fileIdentityKey, isFilePathWithinRoot, normalizePath } from "../../util/paths.js";
+import { assertFilePathWithinRoot, fileIdentityKey, isFilePathWithinRoot, normalizePath } from "../../util/paths.js";
 import { getNativeRuntimeFingerprint } from "../../native/treeSitterNative.js";
+import { logWithLevel } from "../../logging.js";
 import { SymbolKind } from "../types.js";
 import { buildSymbolGraph, } from "../../graphs/symbol-graph.js";
 import { getImplementationFingerprint, normalizeGraphOptions } from "./options.js";
-import { cacheRoot } from "./module-cache.js";
+import { cacheAbsolutePath, cacheRelativePath, transformPersistedExportFromModule, } from "./module-cache.js";
+import { cacheRoot } from "./location.js";
 const SNAPSHOT_SYMBOL_KINDS = new Set(Object.values(SymbolKind));
-const PROJECT_SNAPSHOT_VERSION = 4;
+const PROJECT_SNAPSHOT_VERSION = 9;
+export const BLOOM_FILTER_SNAPSHOT_VERSION = 4;
+export const BLOOM_FILTER_SNAPSHOT_FILENAME = "bloom-filters.json";
 const BLOOM_FILTER_MIN_SIZE = 1_000;
 const BLOOM_FILTER_MAX_SIZE = 1_000_000;
 const BLOOM_FILTER_MIN_HASH_COUNT = 1;
 const BLOOM_FILTER_MAX_HASH_COUNT = 10;
-const DETAILED_SYMBOL_GRAPH_SNAPSHOT_VERSION = 2;
+const DETAILED_SYMBOL_GRAPH_SNAPSHOT_VERSION = 3;
 const DETAILED_SYMBOL_GRAPH_SNAPSHOT_FILENAME = "detailed-symbol-graph.json";
 const SNAPSHOT_TEMP_RETENTION_MS = 24 * 60 * 60 * 1_000;
 const SNAPSHOT_TEMP_SUFFIX = ".tmp";
 const MAX_SNAPSHOT_CACHE_ENTRIES = 32;
 const parsedSnapshotCache = new Map();
+const transformedSnapshotCache = new Map();
+const transformedSnapshotModulesCache = new Map();
 const detailedSymbolGraphCache = new Map();
-export function projectSnapshotFilesSignature(entries) {
+export function projectSnapshotFilesSignature(entries, projectRoot) {
     const hash = createHash("sha256");
     for (const [file, entry] of [...entries.entries()].sort(([left], [right]) => compareSnapshotPath(left, right))) {
-        hash.update(file);
+        hash.update(projectRoot ? cacheRelativePath(projectRoot, file) : file);
         hash.update("\0");
         hash.update(entry.sig);
         hash.update("\0");
@@ -55,8 +61,115 @@ export function createProjectSnapshotIdentity(filesSignature, opts) {
 function serializedProjectRoot(projectRoot) {
     return normalizePath(path.resolve(projectRoot));
 }
-function projectRootMatches(projectRoot, storedProjectRoot) {
-    return fileIdentityKey(path.resolve(projectRoot)) === fileIdentityKey(path.resolve(storedProjectRoot));
+function transformPath(root, value, toRelative) {
+    if (toRelative) {
+        return path.isAbsolute(value) ? cacheRelativePath(root, value) : value;
+    }
+    return assertFilePathWithinRoot(root, cacheAbsolutePath(root, value), "Persisted cache path");
+}
+function transformHandle(root, value, toRelative) {
+    const separator = value.indexOf("::");
+    if (separator < 0)
+        return transformPath(root, value, toRelative);
+    const file = value.slice(0, separator);
+    return `${transformPath(root, file, toRelative)}${value.slice(separator)}`;
+}
+function transformModule(root, module, toRelative) {
+    const copy = structuredClone(module);
+    const file = (value) => transformPath(root, value, toRelative);
+    copy.file = file(copy.file);
+    for (const local of copy.locals)
+        local.file = file(local.file);
+    for (const entry of copy.exports) {
+        if (entry.type === "local") {
+            entry.target.file = file(entry.target.file);
+        }
+        else {
+            transformPersistedExportFromModule(root, entry, toRelative);
+        }
+    }
+    for (const binding of copy.imports) {
+        if (typeof binding.resolved === "string")
+            binding.resolved = file(binding.resolved);
+    }
+    return copy;
+}
+function transformSnapshotPaths(payload, root, toRelative) {
+    const copy = structuredClone(payload);
+    copy.graph.nodes = copy.graph.nodes.map((node) => transformPath(root, node, toRelative));
+    copy.graph.edges = copy.graph.edges.map((edge) => ({
+        ...edge,
+        from: transformPath(root, edge.from, toRelative),
+        to: edge.to.type === "file" ? { ...edge.to, path: transformPath(root, edge.to.path, toRelative) } : edge.to,
+    }));
+    copy.modules = copy.modules.map((module) => transformModule(root, module, toRelative));
+    if (copy.projectFiles) {
+        copy.projectFiles = copy.projectFiles.map((file) => ({
+            ...file,
+            path: transformPath(root, file.path, toRelative),
+            projectRoot: transformPath(root, file.projectRoot, toRelative),
+        }));
+    }
+    if (copy.bloomFilters) {
+        const bloomFilters = {};
+        for (const [file, filter] of Object.entries(copy.bloomFilters)) {
+            bloomFilters[transformPath(root, file, toRelative)] = filter;
+        }
+        copy.bloomFilters = bloomFilters;
+    }
+    const fileSignatures = {};
+    for (const [file, signature] of Object.entries(copy.fileSignatures ?? {})) {
+        fileSignatures[transformPath(root, file, toRelative)] = signature;
+    }
+    copy.fileSignatures = fileSignatures;
+    return copy;
+}
+function migrateProjectSnapshotPayload(value, currentRoot) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return value;
+    const payload = value;
+    if ((payload.version !== 4 && payload.version !== 5) || typeof payload.projectRoot !== "string")
+        return value;
+    const relative = transformSnapshotPaths(value, payload.projectRoot, true);
+    const migrated = transformSnapshotPaths(relative, currentRoot, false);
+    migrated.version = PROJECT_SNAPSHOT_VERSION;
+    migrated.projectRoot = serializedProjectRoot(currentRoot);
+    return migrated;
+}
+function transformDetailedGraph(graph, root, toRelative) {
+    return {
+        nodes: graph.nodes.map((node) => {
+            const file = transformPath(root, node.file, toRelative);
+            return { ...node, file, id: transformHandle(root, node.id, toRelative) };
+        }),
+        edges: graph.edges.map((edge) => ({
+            ...edge,
+            from: transformHandle(root, edge.from, toRelative),
+            to: transformHandle(root, edge.to, toRelative),
+            ...(edge.site
+                ? {
+                    site: {
+                        ...edge.site,
+                        file: transformPath(root, edge.site.file, toRelative),
+                    },
+                }
+                : {}),
+        })),
+    };
+}
+function migrateDetailedSymbolGraphPayload(value, currentRoot) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return value;
+    const payload = value;
+    if (payload.version !== 2 || typeof payload.projectRoot !== "string" || !payload.graph)
+        return value;
+    const relativeGraph = transformDetailedGraph(payload.graph, payload.projectRoot, true);
+    return {
+        ...payload,
+        version: DETAILED_SYMBOL_GRAPH_SNAPSHOT_VERSION,
+        projectRoot: serializedProjectRoot(currentRoot),
+        graph: transformDetailedGraph(relativeGraph, currentRoot, false),
+    };
 }
 function compareSnapshotPath(left, right) {
     if (left < right)
@@ -153,17 +266,30 @@ function materializeDetailedSymbolGraph(payload) {
 function decodeSnapshotPayload(compressed) {
     return JSON.parse(brotliDecompressSync(compressed).toString("utf8"));
 }
+function recordSnapshotCorruption(report, artifact, reason, logLevel) {
+    if (report) {
+        report.manifest ??= { used: true, reused: false };
+        report.manifest.corruptions ??= [];
+        if (!report.manifest.corruptions.some((entry) => entry.artifact === artifact)) {
+            report.manifest.corruptions.push({ artifact, reason });
+        }
+    }
+    logWithLevel(logLevel, "warn", `Warning: Corrupt cache artifact ${artifact}: ${reason}`);
+}
+function isMissingArtifactError(error) {
+    return !!error && typeof error === "object" && "code" in error && error.code === "ENOENT";
+}
 async function readParsedSnapshot(snapshotPath) {
     const before = await snapshotFileIdentity(snapshotPath);
     const cached = parsedSnapshotCache.get(snapshotPath);
     if (cached && sameSnapshotFileIdentity(cached.identity, before)) {
         setBoundedSnapshotCache(parsedSnapshotCache, snapshotPath, cached);
-        return { identity: cached.identity, payload: decodeSnapshotPayload(cached.compressed) };
+        return { identity: cached.identity, payload: cached.payload };
     }
     const compressed = Buffer.from(await fsp.readFile(snapshotPath));
     const payload = decodeSnapshotPayload(compressed);
     const after = await snapshotFileIdentity(snapshotPath);
-    const entry = { identity: before, compressed };
+    const entry = { identity: before, compressed, payload };
     if (sameSnapshotFileIdentity(before, after)) {
         setBoundedSnapshotCache(parsedSnapshotCache, snapshotPath, entry);
     }
@@ -172,6 +298,55 @@ async function readParsedSnapshot(snapshotPath) {
     }
     return { identity: before, payload };
 }
+function transformCachedProjectSnapshot(snapshotPath, identity, rawPayload, projectRoot) {
+    const cached = transformedSnapshotCache.get(snapshotPath);
+    if (cached && cached.root === projectRoot && sameSnapshotFileIdentity(cached.identity, identity)) {
+        setBoundedSnapshotCache(transformedSnapshotCache, snapshotPath, cached);
+        return structuredClone(cached.payload);
+    }
+    const migratedPayload = migrateProjectSnapshotPayload(rawPayload, projectRoot);
+    const payload = migratedPayload && typeof migratedPayload === "object" && !Array.isArray(migratedPayload)
+        ? transformSnapshotPaths(migratedPayload, projectRoot, false)
+        : migratedPayload;
+    setBoundedSnapshotCache(transformedSnapshotCache, snapshotPath, { identity, root: projectRoot, payload });
+    return structuredClone(payload);
+}
+function transformCachedProjectSnapshotModules(snapshotPath, identity, rawPayload, projectRoot) {
+    const cached = transformedSnapshotModulesCache.get(snapshotPath);
+    if (cached && cached.root === projectRoot && sameSnapshotFileIdentity(cached.identity, identity)) {
+        setBoundedSnapshotCache(transformedSnapshotModulesCache, snapshotPath, cached);
+        return structuredClone(cached.payload);
+    }
+    const migratedPayload = migrateProjectSnapshotPayload(rawPayload, projectRoot);
+    if (!migratedPayload || typeof migratedPayload !== "object" || Array.isArray(migratedPayload)) {
+        return migratedPayload;
+    }
+    const payload = migratedPayload;
+    if (!Array.isArray(payload.modules) || !payload.fileSignatures || typeof payload.fileSignatures !== "object") {
+        return migratedPayload;
+    }
+    const modules = structuredClone(payload.modules).map((module) => transformModule(projectRoot, module, false));
+    const fileSignatures = {};
+    for (const [file, signature] of Object.entries(payload.fileSignatures)) {
+        fileSignatures[transformPath(projectRoot, file, false)] = signature;
+    }
+    const transformed = {
+        version: payload.version ?? PROJECT_SNAPSHOT_VERSION,
+        filesSignature: payload.filesSignature ?? "",
+        projectRoot: serializedProjectRoot(projectRoot),
+        ...(payload.nativeMode !== undefined ? { nativeMode: payload.nativeMode } : {}),
+        nativeRuntimeFingerprint: payload.nativeRuntimeFingerprint ?? "",
+        implementationFingerprint: payload.implementationFingerprint ?? "",
+        modules,
+        fileSignatures,
+    };
+    setBoundedSnapshotCache(transformedSnapshotModulesCache, snapshotPath, {
+        identity,
+        root: projectRoot,
+        payload: transformed,
+    });
+    return structuredClone(transformed);
+}
 function projectIndexManifestEntries(entries) {
     return new Map(Array.from(entries, ([file, entry]) => [
         file,
@@ -181,24 +356,22 @@ function projectIndexManifestEntries(entries) {
         },
     ]));
 }
-export async function tryLoadProjectIndexSnapshot(projectRoot, opts, manifestEntries) {
-    const filesSignature = projectSnapshotFilesSignature(manifestEntries);
+export async function tryLoadProjectIndexSnapshot(projectRoot, opts, manifestEntries, report) {
+    const filesSignature = projectSnapshotFilesSignature(manifestEntries, projectRoot);
     if ((opts?.cache ?? "off") !== "disk")
         return null;
     try {
-        const rawPayload = (await readParsedSnapshot(projectSnapshotPath(projectRoot, opts))).payload;
+        const parsedSnapshot = await readParsedSnapshot(projectSnapshotPath(projectRoot, opts));
+        const payload = transformCachedProjectSnapshot(projectSnapshotPath(projectRoot, opts), parsedSnapshot.identity, parsedSnapshot.payload, projectRoot);
         const nativeRuntimeFingerprint = getNativeRuntimeFingerprint(opts?.native);
         const implementationFingerprint = getImplementationFingerprint();
-        if (!isProjectIndexSnapshotPayload(rawPayload) ||
-            rawPayload.filesSignature !== filesSignature ||
-            !projectRootMatches(projectRoot, rawPayload.projectRoot) ||
-            rawPayload.nativeMode !== normalizedSnapshotNativeMode(opts?.native) ||
-            rawPayload.nativeRuntimeFingerprint !== nativeRuntimeFingerprint ||
-            rawPayload.implementationFingerprint !== implementationFingerprint) {
+        if (!isProjectIndexSnapshotPayload(payload) ||
+            payload.filesSignature !== filesSignature ||
+            payload.nativeMode !== normalizedSnapshotNativeMode(opts?.native) ||
+            payload.nativeRuntimeFingerprint !== nativeRuntimeFingerprint ||
+            payload.implementationFingerprint !== implementationFingerprint) {
             return null;
         }
-        // Payload is freshly JSON.parsed from memoized compressed bytes (no deep clone).
-        const payload = rawPayload;
         const graph = {
             nodes: new Set(payload.graph.nodes),
             edges: payload.graph.edges,
@@ -211,11 +384,12 @@ export async function tryLoadProjectIndexSnapshot(projectRoot, opts, manifestEnt
             modules,
             byFile: modules,
             projectRoot: serializedProjectRoot(projectRoot),
+            ...(payload.languageExtensions ? { languageExtensions: payload.languageExtensions } : {}),
             ...(payload.nativeMode ? { nativeMode: payload.nativeMode } : {}),
             exportCache: new Map(),
             scopeCache: new Map(),
             ...(shouldHydrateBloomFilters && payload.bloomFilters
-                ? { bloomFilters: deserializeBloomFilterCache(payload.bloomFilters) }
+                ? { bloomFilters: deserializeBloomFilterCache(payload.bloomFilters, projectRoot) }
                 : {}),
             ...(payload.projectFiles ? { projectFiles: payload.projectFiles } : {}),
             referenceCandidates: buildReferenceCandidateIndex(modules),
@@ -231,56 +405,157 @@ export async function tryLoadProjectIndexSnapshot(projectRoot, opts, manifestEnt
             ...(payload.analysisReport ? { analysisReport: payload.analysisReport } : {}),
         };
     }
-    catch {
+    catch (error) {
+        if (!isMissingArtifactError(error)) {
+            recordSnapshotCorruption(report, projectSnapshotPath(projectRoot, opts), String(error), opts?.logLevel);
+        }
         return null;
     }
 }
 /**
- * Load only the bloom-filter section of the last-written project snapshot, without requiring
- * the whole snapshot to match this build's files signature or native runtime fingerprint.
- * Bloom filters are a pure function of a file's text, so a filter persisted for a given file
- * is safe to reuse after its snapshot's root and implementation fingerprints are validated.
- * Only the bloom section is then read, so a corrupt payload is rejected without walking
- * `graph.edges` / `modules`. Returns `null` when disk caching is off, `useBloomFilters` is
- * disabled, or no valid snapshot with bloom data exists.
+ * Load only modules and signatures from the last-written project snapshot. Path transforms avoid
+ * cloning the graph and project metadata, while each returned module remains caller-owned.
  */
-export async function tryLoadPersistedBloomFilters(projectRoot, opts) {
+export async function tryLoadProjectSnapshotModules(projectRoot, opts, fileSignatures, report) {
+    if ((opts?.cache ?? "off") !== "disk")
+        return null;
+    try {
+        const parsedSnapshot = await readParsedSnapshot(projectSnapshotPath(projectRoot, opts));
+        const payload = transformCachedProjectSnapshotModules(projectSnapshotPath(projectRoot, opts), parsedSnapshot.identity, parsedSnapshot.payload, projectRoot);
+        const nativeRuntimeFingerprint = getNativeRuntimeFingerprint(opts?.native);
+        const implementationFingerprint = getImplementationFingerprint();
+        if (!isProjectSnapshotModulesPayload(payload) ||
+            payload.nativeMode !== normalizedSnapshotNativeMode(opts?.native) ||
+            payload.nativeRuntimeFingerprint !== nativeRuntimeFingerprint ||
+            payload.implementationFingerprint !== implementationFingerprint) {
+            return null;
+        }
+        const normalizedFileSignatures = new Map(Object.entries(payload.fileSignatures).map(([file, signature]) => [fileIdentityKey(file), signature]));
+        const normalizedCurrentSignatures = new Map(Array.from(fileSignatures, ([file, signature]) => [fileIdentityKey(file), signature]));
+        const modules = new Map();
+        for (const mod of payload.modules) {
+            const moduleKey = fileIdentityKey(mod.file);
+            const signature = normalizedCurrentSignatures.get(moduleKey);
+            const snapshotSignature = normalizedFileSignatures.get(moduleKey);
+            if (!signature || !snapshotSignature || !snapshotSignatureMatches(snapshotSignature, signature))
+                continue;
+            modules.set(moduleKey, mod);
+        }
+        return modules;
+    }
+    catch (error) {
+        if (!isMissingArtifactError(error)) {
+            recordSnapshotCorruption(report, projectSnapshotPath(projectRoot, opts), String(error), opts?.logLevel);
+        }
+        return null;
+    }
+}
+export async function tryLoadPersistedBloomFilters(projectRoot, opts, report) {
     if ((opts?.cache ?? "off") !== "disk" || (opts?.useBloomFilters ?? true) === false)
         return null;
+    try {
+        const sidecarPath = bloomFilterSnapshotPath(projectRoot, opts);
+        const sidecarParsed = (await readParsedSnapshot(sidecarPath)).payload;
+        const sidecarBloom = persistedBloomFiltersFromSidecar(sidecarParsed, projectRoot);
+        if (sidecarBloom) {
+            return createPersistedBloomFilters(sidecarBloom.bloomFilters, sidecarBloom.fileSignatures, projectRoot);
+        }
+        recordSnapshotCorruption(report, sidecarPath, "invalid bloom filter payload", opts?.logLevel);
+    }
+    catch (error) {
+        const isMissing = error && typeof error === "object" && "code" in error && error.code === "ENOENT";
+        if (!isMissing) {
+            recordSnapshotCorruption(report, bloomFilterSnapshotPath(projectRoot, opts), String(error), opts?.logLevel);
+        }
+    }
     try {
         const payload = (await readParsedSnapshot(projectSnapshotPath(projectRoot, opts))).payload;
         const bloomFilters = persistedBloomFiltersFromSnapshot(payload, projectRoot);
         if (!bloomFilters)
             return null;
-        return deserializeBloomFilterCache(bloomFilters);
+        return createPersistedBloomFilters(bloomFilters.bloomFilters, bloomFilters.fileSignatures, projectRoot);
     }
-    catch {
+    catch (error) {
+        const isMissing = error && typeof error === "object" && "code" in error && error.code === "ENOENT";
+        if (!isMissing) {
+            recordSnapshotCorruption(report, projectSnapshotPath(projectRoot, opts), String(error), opts?.logLevel);
+        }
         return null;
     }
 }
-/** Light validation for bloom hydration: snapshot version, root identity, and bloom section only. */
-function persistedBloomFiltersFromSnapshot(value, projectRoot) {
+function persistedBloomFiltersFromSidecar(value, projectRoot) {
     if (!value || typeof value !== "object")
         return null;
     const payload = value;
+    if (payload.version !== BLOOM_FILTER_SNAPSHOT_VERSION ||
+        typeof payload.projectRoot !== "string" ||
+        payload.implementationFingerprint !== getImplementationFingerprint() ||
+        typeof payload.projectSnapshotIdentity !== "string" ||
+        !/^[a-f0-9]{64}$/.test(payload.projectSnapshotIdentity)) {
+        return null;
+    }
+    const bloomFilters = payload.bloomFilters;
+    const fileSignatures = payload.fileSignatures;
+    if (!isSerializedBloomFilterRecord(bloomFilters) || !isSnapshotFileSignatureRecord(fileSignatures)) {
+        return null;
+    }
+    return { bloomFilters, fileSignatures };
+}
+/** Light validation for bloom hydration: snapshot version, root identity, and bloom section only. */
+function persistedBloomFiltersFromSnapshot(value, projectRoot) {
+    const migrated = migrateProjectSnapshotPayload(value, projectRoot);
+    if (!migrated || typeof migrated !== "object")
+        return null;
+    const payload = migrated;
     if (payload.version !== PROJECT_SNAPSHOT_VERSION ||
         typeof payload.projectRoot !== "string" ||
-        !projectRootMatches(projectRoot, payload.projectRoot) ||
         payload.implementationFingerprint !== getImplementationFingerprint()) {
         return null;
     }
-    if (!isSerializedBloomFilterRecord(payload.bloomFilters))
+    const bloomFilters = payload.bloomFilters;
+    const fileSignatures = payload.fileSignatures;
+    if (!isSerializedBloomFilterRecord(bloomFilters) || !isSnapshotFileSignatureRecord(fileSignatures)) {
         return null;
-    return payload.bloomFilters;
+    }
+    return { bloomFilters, fileSignatures };
+}
+function createPersistedBloomFilters(bloomFilters, fileSignatures, projectRoot) {
+    const filters = deserializeBloomFilterCache(bloomFilters, projectRoot);
+    const signatures = new Map(Object.entries(fileSignatures).map(([file, signature]) => [
+        fileIdentityKey(cacheAbsolutePath(projectRoot, file)),
+        signature,
+    ]));
+    return {
+        get: (file, signature) => {
+            const persistedSignature = signatures.get(fileIdentityKey(file));
+            if (!persistedSignature || !snapshotSignatureMatches(persistedSignature, signature))
+                return undefined;
+            return filters.get(file);
+        },
+    };
+}
+function snapshotSignatureMatches(snapshotSignature, currentSignature) {
+    const matchingGitSignature = !!snapshotSignature.gitSig && !!currentSignature.gitSig && snapshotSignature.gitSig === currentSignature.gitSig;
+    if (matchingGitSignature)
+        return true;
+    // `cacheSig` is git- or content-hash-derived (forced whenever caching is enabled without a git
+    // signature; see `fileSignature()`), so when both sides have it, it is a strictly stronger and
+    // authoritative identity check than the cheap `mtime:size` `sig`. Comparing bare `sig` alone
+    // would wrongly treat a same-size edit whose mtime got restored as unchanged.
+    if (snapshotSignature.cacheSig !== undefined && currentSignature.cacheSig !== undefined) {
+        return snapshotSignature.cacheSig === currentSignature.cacheSig;
+    }
+    return snapshotSignature.sig === currentSignature.sig;
 }
 export async function writeProjectIndexSnapshot(projectRoot, opts, index, filesSignature) {
     const projectSnapshotIdentity = createProjectSnapshotIdentity(filesSignature, opts);
+    const fileSignatures = serializeSnapshotFileSignatures(index.manifestEntries, projectRoot);
     const serializedBloomFilters = index.bloomFilters
-        ? serializeBloomFilterCache(index.bloomFilters, Array.from(index.byFile.values(), (module) => module.file))
+        ? serializeBloomFilterCache(index.bloomFilters, Array.from(index.byFile.values(), (module) => module.file), projectRoot)
         : undefined;
     const snapshotAnalysisReport = analysisReportFromBuildReport(index.buildReport);
     const snapshotAnalysis = index.buildReport ? summarizeAnalysis({ index, report: index.buildReport }) : index.analysis;
-    const payload = {
+    const payload = transformSnapshotPaths({
         version: PROJECT_SNAPSHOT_VERSION,
         filesSignature,
         projectRoot: serializedProjectRoot(projectRoot),
@@ -291,6 +566,8 @@ export async function writeProjectIndexSnapshot(projectRoot, opts, index, filesS
             edges: index.graph.edges,
         },
         modules: [...index.byFile.values()],
+        fileSignatures,
+        ...(index.languageExtensions ? { languageExtensions: index.languageExtensions } : {}),
         ...(normalizedSnapshotNativeMode(index.nativeMode)
             ? { nativeMode: normalizedSnapshotNativeMode(index.nativeMode) }
             : {}),
@@ -298,7 +575,7 @@ export async function writeProjectIndexSnapshot(projectRoot, opts, index, filesS
         ...(serializedBloomFilters ? { bloomFilters: serializedBloomFilters } : {}),
         ...(snapshotAnalysis ? { analysis: snapshotAnalysis } : {}),
         ...(snapshotAnalysisReport ? { analysisReport: snapshotAnalysisReport } : {}),
-    };
+    }, projectRoot, true);
     try {
         const snapshotPath = projectSnapshotPath(projectRoot, opts);
         const compressed = brotliCompressSync(JSON.stringify(payload), {
@@ -306,8 +583,36 @@ export async function writeProjectIndexSnapshot(projectRoot, opts, index, filesS
         });
         await writeSnapshotAtomically(snapshotPath, compressed);
         const identity = await snapshotFileIdentity(snapshotPath);
-        setBoundedSnapshotCache(parsedSnapshotCache, snapshotPath, { identity, compressed });
+        transformedSnapshotCache.delete(snapshotPath);
+        transformedSnapshotModulesCache.delete(snapshotPath);
+        setBoundedSnapshotCache(parsedSnapshotCache, snapshotPath, { identity, compressed, payload });
         index.projectSnapshotIdentity = projectSnapshotIdentity;
+        if (serializedBloomFilters) {
+            try {
+                const bloomPayload = {
+                    version: BLOOM_FILTER_SNAPSHOT_VERSION,
+                    projectRoot: serializedProjectRoot(projectRoot),
+                    implementationFingerprint: getImplementationFingerprint(),
+                    projectSnapshotIdentity,
+                    fileSignatures,
+                    bloomFilters: serializedBloomFilters,
+                };
+                const bloomPath = bloomFilterSnapshotPath(projectRoot, opts);
+                const bloomCompressed = brotliCompressSync(JSON.stringify(bloomPayload), {
+                    params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 4 },
+                });
+                await writeSnapshotAtomically(bloomPath, bloomCompressed);
+                const bloomIdentity = await snapshotFileIdentity(bloomPath);
+                setBoundedSnapshotCache(parsedSnapshotCache, bloomPath, {
+                    identity: bloomIdentity,
+                    compressed: bloomCompressed,
+                    payload: bloomPayload,
+                });
+            }
+            catch {
+                // Bloom sidecar write failure must not fail indexing
+            }
+        }
     }
     catch {
         delete index.projectSnapshotIdentity;
@@ -317,44 +622,13 @@ export async function writeProjectIndexSnapshot(projectRoot, opts, index, filesS
 function projectSnapshotPath(projectRoot, opts) {
     return path.join(cacheRoot(projectRoot, opts), "project-index-snapshot.json");
 }
-export async function tryLoadDetailedSymbolGraphSnapshot(projectRoot, opts, index) {
-    if ((opts?.cache ?? "off") !== "disk" || !index.projectSnapshotIdentity)
-        return null;
-    try {
-        const snapshotPath = detailedSymbolGraphSnapshotPath(projectRoot, opts);
-        const observedIdentity = await snapshotFileIdentity(snapshotPath);
-        const cached = detailedSymbolGraphCache.get(snapshotPath);
-        if (cached &&
-            cached.projectSnapshotIdentity === index.projectSnapshotIdentity &&
-            sameSnapshotFileIdentity(cached.identity, observedIdentity)) {
-            setBoundedSnapshotCache(detailedSymbolGraphCache, snapshotPath, cached);
-            return materializeDetailedSymbolGraph(cached.graph);
-        }
-        const parsed = await readParsedSnapshot(snapshotPath);
-        const payload = parsed.payload;
-        if (!isDetailedSymbolGraphSnapshotPayload(payload) ||
-            !projectRootMatches(projectRoot, payload.projectRoot) ||
-            payload.implementationFingerprint !== getImplementationFingerprint() ||
-            payload.projectSnapshotIdentity !== index.projectSnapshotIdentity) {
-            return null;
-        }
-        const graph = materializeDetailedSymbolGraph(payload.graph);
-        if (!(await isDetailedSymbolGraphCompatibleWithProject(projectRoot, index, graph))) {
-            return null;
-        }
-        const identity = await snapshotFileIdentity(snapshotPath);
-        if (!sameSnapshotFileIdentity(parsed.identity, identity))
-            return null;
-        setBoundedSnapshotCache(detailedSymbolGraphCache, snapshotPath, {
-            identity,
-            projectSnapshotIdentity: index.projectSnapshotIdentity,
-            graph: payload.graph,
-        });
-        return graph;
-    }
-    catch {
-        return null;
+function bloomFilterSnapshotPath(projectRoot, opts) {
+    const root = path.resolve(cacheRoot(projectRoot, opts));
+    const snapshotPath = path.resolve(root, BLOOM_FILTER_SNAPSHOT_FILENAME);
+    if (!isFilePathWithinRoot(root, snapshotPath)) {
+        throw new Error(`Bloom filter snapshot escaped cache root: ${snapshotPath}`);
     }
+    return snapshotPath;
 }
 export async function writeDetailedSymbolGraphSnapshot(projectRoot, opts, index, graph) {
     if ((opts?.cache ?? "off") !== "disk" || !index.projectSnapshotIdentity)
@@ -365,26 +639,29 @@ export async function writeDetailedSymbolGraphSnapshot(projectRoot, opts, index,
         implementationFingerprint: getImplementationFingerprint(),
         graphHash: detailedSymbolGraphContentHash(index.projectSnapshotIdentity, graph),
         projectSnapshotIdentity: index.projectSnapshotIdentity,
-        graph: {
+        graph: transformDetailedGraph({
             nodes: [...graph.nodes.values()],
             edges: graph.edges,
-        },
+        }, projectRoot, true),
     };
     try {
         const snapshotPath = detailedSymbolGraphSnapshotPath(projectRoot, opts);
         parsedSnapshotCache.delete(snapshotPath);
+        transformedSnapshotModulesCache.delete(snapshotPath);
         detailedSymbolGraphCache.delete(snapshotPath);
         const compressed = brotliCompressSync(JSON.stringify(payload), {
             params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 4 },
         });
         await writeSnapshotAtomically(snapshotPath, compressed);
         const identity = await snapshotFileIdentity(snapshotPath);
-        const cachedPayload = structuredClone(payload);
-        setBoundedSnapshotCache(parsedSnapshotCache, snapshotPath, { identity, compressed });
+        setBoundedSnapshotCache(parsedSnapshotCache, snapshotPath, { identity, compressed, payload });
         setBoundedSnapshotCache(detailedSymbolGraphCache, snapshotPath, {
             identity,
             projectSnapshotIdentity: index.projectSnapshotIdentity,
-            graph: cachedPayload.graph,
+            graph: {
+                nodes: [...graph.nodes.values()],
+                edges: graph.edges,
+            },
         });
     }
     catch {
@@ -399,6 +676,57 @@ function detailedSymbolGraphSnapshotPath(projectRoot, opts) {
     }
     return snapshotPath;
 }
+export async function tryLoadDetailedSymbolGraphSnapshot(projectRoot, opts, index, report) {
+    if ((opts?.cache ?? "off") !== "disk" || !index.projectSnapshotIdentity)
+        return null;
+    const snapshotPath = detailedSymbolGraphSnapshotPath(projectRoot, opts);
+    try {
+        const observedIdentity = await snapshotFileIdentity(snapshotPath);
+        const cached = detailedSymbolGraphCache.get(snapshotPath);
+        if (cached &&
+            cached.projectSnapshotIdentity === index.projectSnapshotIdentity &&
+            sameSnapshotFileIdentity(cached.identity, observedIdentity)) {
+            setBoundedSnapshotCache(detailedSymbolGraphCache, snapshotPath, cached);
+            return materializeDetailedSymbolGraph(cached.graph);
+        }
+        const parsed = await readParsedSnapshot(snapshotPath);
+        const migratedPayload = migrateDetailedSymbolGraphPayload(parsed.payload, projectRoot);
+        const payload = migratedPayload && typeof migratedPayload === "object" && !Array.isArray(migratedPayload)
+            ? {
+                ...migratedPayload,
+                graph: transformDetailedGraph(migratedPayload.graph, projectRoot, false),
+            }
+            : migratedPayload;
+        if (!isDetailedSymbolGraphSnapshotPayload(payload) ||
+            payload.implementationFingerprint !== getImplementationFingerprint() ||
+            payload.projectSnapshotIdentity !== index.projectSnapshotIdentity) {
+            recordSnapshotCorruption(report, snapshotPath, "invalid detailed symbol graph payload", opts?.logLevel);
+            return null;
+        }
+        const graph = materializeDetailedSymbolGraph(payload.graph);
+        if (!(await isDetailedSymbolGraphCompatibleWithProject(projectRoot, index, graph))) {
+            recordSnapshotCorruption(report, snapshotPath, "detailed symbol graph does not match project", opts?.logLevel);
+            return null;
+        }
+        const identity = await snapshotFileIdentity(snapshotPath);
+        if (!sameSnapshotFileIdentity(parsed.identity, identity)) {
+            recordSnapshotCorruption(report, snapshotPath, "detailed symbol graph changed while reading", opts?.logLevel);
+            return null;
+        }
+        setBoundedSnapshotCache(detailedSymbolGraphCache, snapshotPath, {
+            identity,
+            projectSnapshotIdentity: index.projectSnapshotIdentity,
+            graph: payload.graph,
+        });
+        return graph;
+    }
+    catch (error) {
+        if (!isMissingArtifactError(error)) {
+            recordSnapshotCorruption(report, snapshotPath, String(error), opts?.logLevel);
+        }
+        return null;
+    }
+}
 function detailedSymbolGraphContentHash(projectSnapshotIdentity, graph) {
     const hash = createHash("sha256");
     hash.update(projectSnapshotIdentity);
@@ -642,6 +970,21 @@ function isProjectFileType(value) {
 function isProjectFileRole(value) {
     return value === "manifest" || value === "lockfile" || value === "config" || value === "solution" || value === "ide";
 }
+function isProjectSnapshotModulesPayload(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const payload = value;
+    return (payload.version === PROJECT_SNAPSHOT_VERSION &&
+        typeof payload.filesSignature === "string" &&
+        typeof payload.projectRoot === "string" &&
+        typeof payload.nativeRuntimeFingerprint === "string" &&
+        typeof payload.implementationFingerprint === "string" &&
+        /^[a-f0-9]{64}$/.test(payload.implementationFingerprint) &&
+        Array.isArray(payload.modules) &&
+        payload.modules.every(isModuleIndex) &&
+        isSnapshotFileSignatureRecord(payload.fileSignatures) &&
+        (payload.nativeMode === undefined || isSnapshotNativeMode(payload.nativeMode)));
+}
 function isProjectIndexSnapshotPayload(value) {
     if (!value || typeof value !== "object")
         return false;
@@ -659,7 +1002,9 @@ function isProjectIndexSnapshotPayload(value) {
         payload.graph.edges.every(isGraphEdge) &&
         Array.isArray(payload.modules) &&
         payload.modules.every(isModuleIndex) &&
+        isSnapshotFileSignatureRecord(payload.fileSignatures) &&
         (payload.nativeMode === undefined || isSnapshotNativeMode(payload.nativeMode)) &&
+        (payload.languageExtensions === undefined || isLanguageExtensionMap(payload.languageExtensions)) &&
         (payload.bloomFilters === undefined || isSerializedBloomFilterRecord(payload.bloomFilters)) &&
         (payload.analysis === undefined || isAnalysisSummary(payload.analysis)) &&
         (payload.analysisReport === undefined || isSnapshotAnalysisReport(payload.analysisReport)) &&
@@ -746,14 +1091,14 @@ function isAnalysisSummary(value) {
         typeof summary.nativeFilesFellBack === "number" &&
         typeof summary.label === "string");
 }
-function serializeBloomFilterCache(cache, files) {
+function serializeBloomFilterCache(cache, files, projectRoot) {
     const serialized = {};
     for (const file of files) {
         const filter = cache.get(file);
         if (!filter)
             continue;
         const metadata = filter.getMetadata();
-        serialized[file] = {
+        serialized[cacheRelativePath(projectRoot, file)] = {
             size: metadata.size,
             hashCount: metadata.hashCount,
             bitsBase64: filter.toBuffer().toString("base64"),
@@ -761,10 +1106,35 @@ function serializeBloomFilterCache(cache, files) {
     }
     return Object.keys(serialized).length ? serialized : undefined;
 }
-function deserializeBloomFilterCache(serialized) {
+function serializeSnapshotFileSignatures(entries, projectRoot) {
+    const serialized = {};
+    for (const [file, entry] of entries ?? []) {
+        serialized[cacheRelativePath(projectRoot, file)] = {
+            sig: entry.sig,
+            ...(entry.gitSig ? { gitSig: entry.gitSig } : {}),
+            ...(entry.cacheSig ? { cacheSig: entry.cacheSig } : {}),
+        };
+    }
+    return serialized;
+}
+function isSnapshotFileSignatureRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    return Object.values(value).every(isSnapshotFileSignature);
+}
+function isSnapshotFileSignature(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const signature = value;
+    return (typeof signature.sig === "string" &&
+        (signature.gitSig === undefined || typeof signature.gitSig === "string") &&
+        (signature.cacheSig === undefined || typeof signature.cacheSig === "string"));
+}
+function deserializeBloomFilterCache(serialized, projectRoot) {
     const cache = new BloomFilterCache();
     for (const [file, filter] of Object.entries(serialized)) {
-        cache.set(file, BloomFilter.fromBuffer(Buffer.from(filter.bitsBase64, "base64"), filter.size, filter.hashCount));
+        const absoluteFile = assertFilePathWithinRoot(projectRoot, cacheAbsolutePath(projectRoot, file), "Persisted cache path");
+        cache.set(absoluteFile, BloomFilter.fromBuffer(Buffer.from(filter.bitsBase64, "base64"), filter.size, filter.hashCount));
     }
     return cache;
 }
@@ -773,6 +1143,11 @@ function isSerializedBloomFilterRecord(value) {
         return false;
     return Object.values(value).every(isSerializedBloomFilter);
 }
+function isLanguageExtensionMap(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    return Object.values(value).every((entry) => typeof entry === "string");
+}
 function isSerializedBloomFilter(value) {
     if (!value || typeof value !== "object")
         return false;
@@ -788,9 +1163,15 @@ function isSerializedBloomFilter(value) {
         typeof filter.bitsBase64 !== "string") {
         return false;
     }
-    const maxBytes = Math.ceil(filter.size / 8);
-    const maxBase64Length = Math.ceil(maxBytes / 3) * 4;
-    return filter.bitsBase64.length === maxBase64Length;
+    const expectedBytes = Math.ceil(filter.size / 8);
+    let decoded;
+    try {
+        decoded = Buffer.from(filter.bitsBase64, "base64");
+    }
+    catch {
+        return false;
+    }
+    return decoded.length === expectedBytes && decoded.toString("base64") === filter.bitsBase64;
 }
 function isModuleIndex(value) {
     if (!value || typeof value !== "object")