codebase-snapshot 0.9.0 → 0.9.1

package/CHANGELOG.md

@@ -4,6 +4,53 @@ All notable changes to `codebase-snapshot`.
 
 ---
 
+## A note on version numbers
+
+This package started its public life as `@ankurhalder/codebase-snapshot`, which reached 4.4.1. It
+moved to the unscoped name and **restarted at 0.9.0**, so the numbers below are not a continuation of
+the old line — `0.9.0` is newer than `4.4.1`, not older. 1.0.0 is reserved for when the CLI surface
+is settled.
+
+Two versions exist on the registry that are not releases, and both are deprecated:
+
+| Version | What it is |
+| :-- | :-- |
+| `codebase-snapshot@4.5.0` | Published for about an hour under the new name before the scheme was reset to 0.9.0. Withdrawn, never the supported version. |
+| `codebase-snapshot@0.0.0-stage` | npm's own staging placeholder, created automatically during the first publish of the name. Not a release. |
+
+Deleting them requires account-level rights that the release pipeline does not have, so they are
+deprecated with an explanatory message instead. `latest` has pointed at 0.9.0 since it existed.
+
+## 0.9.1
+
+### The documentation now derives its version from `package.json`
+
+A documented version is a promise about the release, and every one of them was hand-written — so they
+rotted silently at each bump. The README still described a `0.x` line whose numbers appeared nowhere
+in it, `SECURITY.md` advertised **"4.x supported"** on a project whose latest release was 0.9.0, and
+both `setup` examples printed `4.4.0` and `4.1.1` as the dependency the command adds.
+
+Versions now live in exactly one place, and `scripts/sync-docs.mjs` writes them into the documentation:
+
+- Prose carries marked spans — `<!--@majorMinor-->0.9<!--/@majorMinor-->` — which GitHub renders as
+  the value and hides as a comment.
+- Code-block examples are matched by shape instead, because inside a fence an HTML comment is literal
+  text and the marker syntax would leak into the page.
+- `npm run verify` fails when anything is out of step, and `npm run site` and `prepack` both sync
+  first, so the docs site and the published README cannot contradict the package they describe.
+
+Changelog history is deliberately excluded. It records what happened at each version, and rewriting a
+past entry would falsify that record rather than maintain it.
+
+### Other corrections in this pass
+
+- `SECURITY.md` supported versions: 0.9.x, with a sentence explaining why 0.9.0 is newer than 4.4.1.
+- The README states the pre-1.0 contract once, in wording that does not go stale.
+- The changelog opens with a note on the version numbering, so the registry's three versions are not
+  a mystery to anyone reading them.
+- The `v4.5.0` release and git tag were deleted; that version no longer exists on npm.
+
+---
 ## 0.9.0
 
 ### The package is now `codebase-snapshot`, unscoped
@@ -41,7 +88,7 @@ name on the next run, so an existing snapshot keeps working and is upgraded in p
 
 ### Documentation site
 
-The docs now have a crawlable home at <https://codebase-snapshot.ankurhalder.com>, generated from
+The docs now have a crawlable home at <https://ankurhalder.github.io/codebase-snapshot/>, generated from
 `README.md` and `docs/` in this repository, with a sitemap, its own `robots.txt`, an `llms.txt` at
 the site root and a Markdown twin per page. GitHub's `robots.txt` blocks directory-tree and raw-file
 paths and publishes no repository sitemap, so `docs/` had no crawlable entry point before this.

package/README.md

@@ -50,7 +50,7 @@ npx codebase-snapshot generate      # no install, one-off
 npm install -D codebase-snapshot    # or add it to a project
 ```
 
-This is a **0.x** release. Version numbers follow semver's 0.x conventions, so the CLI surface may change in a minor release until 1.0.0 — pin an exact version if you need a fixed surface today.`n`nAny npm-compatible client works — npm, yarn (classic and Berry with strict PnP), pnpm and bun —
+This is a **<!--@major-->0<!--/@major-->.x** release. Version numbers follow semver's 0.x conventions, so the CLI surface may change in a minor release until 1.0.0 — pin an exact version if you need a fixed surface today.`n`nAny npm-compatible client works — npm, yarn (classic and Berry with strict PnP), pnpm and bun —
 each verified against the packed tarball before release. Requires **Node.js 18+**.
 
 Published from GitHub Actions with [build provenance](https://docs.npmjs.com/generating-provenance-statements): npm shows the tarball was built from this repository at a tagged commit, and `npm audit signatures` verifies it.

package/SECURITY.md

@@ -6,8 +6,12 @@ Only the latest published release receives security fixes.
 
 | Version | Supported |
 | :--- | :--- |
-| 4.x | ✅ |
-| 3.x and older | ❌ |
+| <!--@majorMinor-->0.9<!--/@majorMinor-->.x | ✅ |
+| anything older | ❌ |
+
+The number line restarted at 0.9.0 when the package moved to the unscoped `codebase-snapshot` name,
+so <!--@majorMinor-->0.9<!--/@majorMinor-->.x is newer than 4.4.1, not older. That is explained in full in the
+[changelog](CHANGELOG.md#a-note-on-version-numbers).
 
 ## Reporting a vulnerability
 

package/dist/bin.js

@@ -4294,7 +4294,7 @@ function gitignorePath(cwd, filePath) {
 
 // src/version.ts
 var GENERATOR_NAME = "codebase-snapshot";
-var GENERATOR_VERSION = "0.9.0";
+var GENERATOR_VERSION = "0.9.1";
 var LEGACY_GENERATOR_NAMES = ["@ankurhalder/codebase-snapshot"];
 function isOurGeneratorName(name) {
   if (typeof name !== "string") return false;
@@ -8148,7 +8148,7 @@ function buildAgentContract() {
         id: "verify",
         run: `npx ${PACKAGE_NAME}@latest --version`,
         // The requirement is the major version; the exact build is context. A
-        // floating tag may print 4.0.7 today and 4.0.9 next week, and an agent
+        // floating tag may print a different patch today than next week, and an agent
         // must not conclude that a working tool is broken because of a patch.
         expect: `prints v${MAJOR_VERSION} or newer on stdout and exits 0 (this build is v${GENERATOR_VERSION}: compare the major version, not the patch)`,
         notes: `If it prints an older major than this contract's, the @latest tag is behind the release: pin the exact version with \`npx ${PACKAGE_NAME}@${GENERATOR_VERSION} --version\` instead of retrying @latest. If it prints nothing, clear the npm cache and retry, or use \`npx -p <pkg> codebase-snapshot\`.`

package/dist/{chunk-FJ4RQYY2.js → chunk-HT7J3NWT.js}

@@ -5421,7 +5421,7 @@ function validateSnapshot(configInput) {
 
 // src/version.ts
 var GENERATOR_NAME = "codebase-snapshot";
-var GENERATOR_VERSION = "0.9.0";
+var GENERATOR_VERSION = "0.9.1";
 var LEGACY_GENERATOR_NAMES = ["@ankurhalder/codebase-snapshot"];
 function isOurGeneratorName(name) {
   if (typeof name !== "string") return false;
@@ -7881,5 +7881,5 @@ async function generateSnapshotAsync(configInput, options) {
 }
 
 export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, appendGitignoreEntries, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countInvalidUtf8Bytes, countLines, decodeText, defineConfig, describeManifestShapeProblem, detectLanguage, detectPreset, escapeControls, explainPath, fenceForContent, fenceForText, formatNumber, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, gitignorePath, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isDiscoveryMode, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, unknownPresetMessage, validateSnapshot };
-//# sourceMappingURL=chunk-FJ4RQYY2.js.map
-//# sourceMappingURL=chunk-FJ4RQYY2.js.map
+//# sourceMappingURL=chunk-HT7J3NWT.js.map
+//# sourceMappingURL=chunk-HT7J3NWT.js.map

package/dist/cli.cjs

@@ -4286,7 +4286,7 @@ function gitignorePath(cwd, filePath) {
 
 // src/version.ts
 var GENERATOR_NAME = "codebase-snapshot";
-var GENERATOR_VERSION = "0.9.0";
+var GENERATOR_VERSION = "0.9.1";
 var LEGACY_GENERATOR_NAMES = ["@ankurhalder/codebase-snapshot"];
 function isOurGeneratorName(name) {
   if (typeof name !== "string") return false;
@@ -8119,7 +8119,7 @@ function buildAgentContract() {
         id: "verify",
         run: `npx ${PACKAGE_NAME}@latest --version`,
         // The requirement is the major version; the exact build is context. A
-        // floating tag may print 4.0.7 today and 4.0.9 next week, and an agent
+        // floating tag may print a different patch today than next week, and an agent
         // must not conclude that a working tool is broken because of a patch.
         expect: `prints v${MAJOR_VERSION} or newer on stdout and exits 0 (this build is v${GENERATOR_VERSION}: compare the major version, not the patch)`,
         notes: `If it prints an older major than this contract's, the @latest tag is behind the release: pin the exact version with \`npx ${PACKAGE_NAME}@${GENERATOR_VERSION} --version\` instead of retrying @latest. If it prints nothing, clear the npm cache and retry, or use \`npx -p <pkg> codebase-snapshot\`.`

package/dist/cli.js

@@ -1,4 +1,4 @@
-import { GENERATOR_VERSION, loadConfigFileDetailed, resolveConfig, validateSnapshot, describeManifestShapeProblem, explainPath, compareManifests, loadManifest, renderDiffText, generateSnapshot, formatNumber, isDiscoveryMode, ARTIFACT_NAMES, getPreset, unknownPresetMessage, GENERATOR_NAME, runInit, PromptCancelled, MIN_MAX_PART_BYTES, SCHEMA_VERSION, PRESETS, parseByteSize, gitignorePath, appendGitignoreEntries, escapeControls, renderExplainText } from './chunk-FJ4RQYY2.js';
+import { GENERATOR_VERSION, loadConfigFileDetailed, resolveConfig, validateSnapshot, describeManifestShapeProblem, explainPath, compareManifests, loadManifest, renderDiffText, generateSnapshot, formatNumber, isDiscoveryMode, ARTIFACT_NAMES, getPreset, unknownPresetMessage, GENERATOR_NAME, runInit, PromptCancelled, MIN_MAX_PART_BYTES, SCHEMA_VERSION, PRESETS, parseByteSize, gitignorePath, appendGitignoreEntries, escapeControls, renderExplainText } from './chunk-HT7J3NWT.js';
 import { spawnSync } from 'child_process';
 import * as fs from 'fs';
 import * as path2 from 'path';
@@ -240,7 +240,7 @@ function buildAgentContract() {
         id: "verify",
         run: `npx ${PACKAGE_NAME}@latest --version`,
         // The requirement is the major version; the exact build is context. A
-        // floating tag may print 4.0.7 today and 4.0.9 next week, and an agent
+        // floating tag may print a different patch today than next week, and an agent
         // must not conclude that a working tool is broken because of a patch.
         expect: `prints v${MAJOR_VERSION} or newer on stdout and exits 0 (this build is v${GENERATOR_VERSION}: compare the major version, not the patch)`,
         notes: `If it prints an older major than this contract's, the @latest tag is behind the release: pin the exact version with \`npx ${PACKAGE_NAME}@${GENERATOR_VERSION} --version\` instead of retrying @latest. If it prints nothing, clear the npm cache and retry, or use \`npx -p <pkg> codebase-snapshot\`.`

package/dist/index.cjs

@@ -5450,7 +5450,7 @@ function validateSnapshot(configInput) {
 
 // src/version.ts
 var GENERATOR_NAME = "codebase-snapshot";
-var GENERATOR_VERSION = "0.9.0";
+var GENERATOR_VERSION = "0.9.1";
 var LEGACY_GENERATOR_NAMES = ["@ankurhalder/codebase-snapshot"];
 function isOurGeneratorName(name) {
   if (typeof name !== "string") return false;

package/dist/index.d.cts

@@ -398,7 +398,7 @@ declare function validateSnapshot(configInput: ResolvedSnapshotConfig | Snapshot
  * `package.json` carries the same version; `npm run verify` compares the two.
  */
 declare const GENERATOR_NAME = "codebase-snapshot";
-declare const GENERATOR_VERSION = "0.9.0";
+declare const GENERATOR_VERSION = "0.9.1";
 
 declare const DEFAULT_SECRET_PATTERNS: SecretRule[];
 

package/dist/index.d.ts

@@ -398,7 +398,7 @@ declare function validateSnapshot(configInput: ResolvedSnapshotConfig | Snapshot
  * `package.json` carries the same version; `npm run verify` compares the two.
  */
 declare const GENERATOR_NAME = "codebase-snapshot";
-declare const GENERATOR_VERSION = "0.9.0";
+declare const GENERATOR_VERSION = "0.9.1";
 
 declare const DEFAULT_SECRET_PATTERNS: SecretRule[];
 

package/dist/index.js

@@ -1,3 +1,3 @@
-export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countInvalidUtf8Bytes, countLines, decodeText, defineConfig, detectLanguage, detectPreset, explainPath, fenceForContent, fenceForText, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, validateSnapshot } from './chunk-FJ4RQYY2.js';
+export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countInvalidUtf8Bytes, countLines, decodeText, defineConfig, detectLanguage, detectPreset, explainPath, fenceForContent, fenceForText, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, validateSnapshot } from './chunk-HT7J3NWT.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/docs/cli.md

@@ -124,7 +124,7 @@ The whole first run in one command, with defaults and no prompts:
 🚀 Setup for: /path/to/repo
 ✅ Created snapshot.config.ts (preset: nextjs)
    Added npm scripts: snapshot, snapshot:validate
-   Added devDependency: codebase-snapshot ^4.4.0
+   Added devDependency: codebase-snapshot ^0.9.1
    Added to .gitignore: snapshot/, snapshot.tmp/
 ⏳ Installing dependencies…
 ✅ Installed dependencies (npm install, 2.1s)
@@ -161,7 +161,7 @@ It also has three side effects on files you own, and it says so when it does the
 ```
 ✅ Created snapshot.config.ts (preset: node-lib)
    Added npm scripts: snapshot, snapshot:validate
-   Added devDependency: codebase-snapshot ^4.1.1
+   Added devDependency: codebase-snapshot ^0.9.1
    Added to .gitignore: snapshot/, snapshot.tmp/
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-snapshot",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Turn a codebase into token-efficient, size-budgeted Markdown parts for an LLM: an AST partitioner, snapshot generator, secret auditor and drift validator for ChatGPT, Claude and Cursor.",
   "keywords": [
     "codebase",
@@ -91,11 +91,12 @@
     "test:coverage": "node --test --experimental-test-coverage tests/*.test.js",
     "prepublishOnly": "npm run build",
     "publish:create": "npm publish packages/create --access public",
-    "prepack": "npm run build",
+    "prepack": "npm run sync-docs && npm run build",
     "pack-check": "node scripts/pack-check.mjs",
-    "site": "node scripts/build-site.mjs",
+    "sync-docs": "node scripts/sync-docs.mjs",
+    "site": "npm run sync-docs && node scripts/build-site.mjs",
     "seo-rank": "node scripts/seo-rank.mjs",
-    "verify": "npm run check && npm run pack-check"
+    "verify": "npm run check && npm run sync-docs -- --check && npm run pack-check"
   },
   "dependencies": {
     "typescript": "^5.0.0"