codebase-snapshot 0.9.12 → 0.9.14

package/dist/bin.js

@@ -1254,9 +1254,18 @@ var DEFAULT_SECRET_PATTERNS = [
     // The unquoted twin for YAML, docker-compose and `.env`: those formats never
     // quote their values, so the rules above cannot see them. `valueGroup` keeps
     // `POSTGRES_PASSWORD:` in the output.
+    //
+    // This is the one unquoted rule without `NOT_AFTER_QUOTE`, and the lookbehind is a
+    // string-literal guard rather than a precision rule: a credential assignment *inside* a
+    // literal — `const dsn = "password=hunter2;host=db"`, `curl -d "password=hunter2"` — was
+    // rejected before it could be considered, and a DSN is a credential in a string. What made the
+    // lookbehind redundant is the shape of `UNQUOTED_LITERAL`: a value has to start with a word
+    // character, so `["awsSecret:", "apiKey:"]` — the list of key names the lookbehind was added
+    // for — cannot match here anyway. `redact.ts` still refuses a match whose separator is inside
+    // the literal, which is the case that list actually is.
     rule: "credential-assignment-unquoted",
     pattern: new RegExp(
-      `${NOT_AFTER_QUOTE}${UNQUOTED_STRONG_NAME}\\s{0,8}${ASSIGN}\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_LITERAL}`,
+      `${UNQUOTED_STRONG_NAME}\\s{0,8}${ASSIGN}\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_LITERAL}`,
       "i"
     ),
     valueGroup: 1
@@ -1291,6 +1300,27 @@ var DEFAULT_SECRET_PATTERNS = [
     pattern: /(?<!["'])(?:api[_-]?key|secret[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?token|refresh[_-]?token|private[_-]?key|password|passwd|pwd)["']?\s*(?<![=!<>])[:=](?!=)\s*["']([^"'\s]{8,256})["']/i,
     valueGroup: 1
   },
+  {
+    // `${VAR:-fallback}` — a default value in a shell script, a `.env`, docker-compose or a
+    // GitHub Actions workflow.
+    //
+    // This shape defeated every rule above it, and each refusal was individually reasonable:
+    // the quoted rules need a quote after the separator, and the unquoted ones need the value to
+    // begin with a word character — a fallback begins with `$`. So
+    // `POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-MyProdPassword123!}` was emitted whole, `.env` files
+    // and compose files included, which is where that idiom is the norm.
+    //
+    // The **fallback** is what gets masked, not the whole expansion: the variable name is the
+    // readable context, exactly as `POSTGRES_PASSWORD:` is kept by the rule above. A single
+    // interpolation with no operator (`${DB_PASSWORD}`) still does not match — there is nothing
+    // between the braces to mask, and `isTemplateInterpolation` keeps such a value readable.
+    rule: "interpolation-fallback-secret",
+    pattern: new RegExp(
+      `(?:["']${STRONG_CREDENTIAL_NAME}["']|${NOT_AFTER_QUOTE}${STRONG_CREDENTIAL_NAME})\\s{0,8}${ASSIGN}\\s{0,8}["'\`]?\\$\\{[A-Za-z_][A-Za-z0-9_]*:?[-=?+]([^}"'\`\\r\\n]{2,512})\\}["'\`]?`,
+      "i"
+    ),
+    valueGroup: 1
+  },
   {
     // Covers `.env` / shell assignment syntax, which never quotes its values and
     // was therefore invisible to the rule above. Anchored to the line start and
@@ -1318,8 +1348,8 @@ var DEFAULT_SECRET_PATTERNS = [
     valueGroup: 1
   }
 ];
-var PEM_BLOCK_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/g;
-var PEM_UNTERMINATED_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:\r?\n[A-Za-z0-9+/=]{4,}[ A-Za-z0-9+/=]*)+/g;
+var PEM_BLOCK_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN)[\s\S])*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/g;
+var PEM_UNTERMINATED_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:\r\n|\n|\r)(?:(?:[ \t]*(?:Proc-Type|DEK-Info|Comment|Version):[^\r\n]*|[ \t]*)(?:\r\n|\n|\r))*(?:[ \t]*[A-Za-z0-9+/=]{8,}[ \t]*(?:\r\n|\n|\r|$))+/g;
 
 // src/security/redact.ts
 var REDACTION_MARKER = "[REDACTED: potential secret-like value omitted from snapshot]";
@@ -1413,6 +1443,20 @@ function toGlobal(rule) {
   return new RegExp(rule.pattern.source, [...flags].join(""));
 }
 var LINE_BREAK = /(\r\n|\n|\r)/;
+var LINE_TERMINATOR = /\r\n|\n|\r/g;
+var COMPILED_RULES = /* @__PURE__ */ new WeakMap();
+function compiledRuleFor(rule) {
+  let compiled = COMPILED_RULES.get(rule);
+  if (compiled === void 0) {
+    compiled = {
+      rule: rule.rule,
+      pattern: toGlobal(rule),
+      ...rule.valueGroup === void 0 ? {} : { valueGroup: rule.valueGroup }
+    };
+    COMPILED_RULES.set(rule, compiled);
+  }
+  return compiled;
+}
 function scanAndRedactSecrets(content, rules, filePath) {
   const findings = [];
   let redacted = content;
@@ -1424,18 +1468,15 @@ function scanAndRedactSecrets(content, rules, filePath) {
         blockPattern.lastIndex += 1;
         continue;
       }
-      const line = redacted.slice(0, match.index).split("\n").length;
-      const newlines = (match[0].match(/\n/g) ?? []).length;
+      const before = redacted.slice(0, match.index);
+      const line = (before.match(LINE_TERMINATOR) ?? []).length + 1;
+      const newlines = (match[0].match(LINE_TERMINATOR) ?? []).length;
       findings.push({ rules: ["private-key-block"], line, path: filePath });
-      redacted = redacted.slice(0, match.index) + PEM_REDACTION_MARKER + "\n".repeat(newlines) + redacted.slice(match.index + match[0].length);
+      redacted = before + PEM_REDACTION_MARKER + "\n".repeat(newlines) + redacted.slice(match.index + match[0].length);
       blockPattern.lastIndex = match.index + PEM_REDACTION_MARKER.length + newlines;
     }
   }
-  const compiled = rules.map((rule) => ({
-    rule: rule.rule,
-    pattern: toGlobal(rule),
-    ...rule.valueGroup === void 0 ? {} : { valueGroup: rule.valueGroup }
-  }));
+  const compiled = rules.map(compiledRuleFor);
   const segments = redacted.split(LINE_BREAK);
   let lineNumber = 1;
   for (let index = 0; index < segments.length; index += 2) {
@@ -1453,8 +1494,10 @@ function scanAndRedactSecrets(content, rules, filePath) {
           }
           const group = valueGroup === void 0 ? void 0 : match.indices?.[valueGroup];
           if (group && isSelfNamingConstant(line, group[0], group[1])) continue;
-          if (valueGroup !== void 0 && startsInsideStringLiteral(line, match.index)) continue;
-          if (group && isUnquotedValue(line, group[0]) && isDeclaredBinding(line, match.index)) {
+          if (valueGroup !== void 0 && startsInsideStringLiteral(line, match.index, group?.[0])) {
+            continue;
+          }
+          if (group && isUnquotedValue(line, group[0]) && isDeclaredBinding(line, match.index, filePath)) {
             continue;
           }
           if (group && isTemplateInterpolation(line, group[0], group[1])) continue;
@@ -1487,14 +1530,20 @@ function expandOverToken(line, start, end) {
   while (right < line.length && TOKEN_CHARS_RIGHT.test(line[right])) right += 1;
   return { start: left, end: right };
 }
-function startsInsideStringLiteral(line, matchIndex) {
+function startsInsideStringLiteral(line, matchIndex, valueStart) {
   let runStart = matchIndex;
   while (runStart > 0 && /[A-Za-z0-9_-]/.test(line[runStart - 1])) runStart -= 1;
   const before = runStart > 0 ? line[runStart - 1] : "";
-  return before === '"' || before === "'" || before === "`";
+  if (before !== '"' && before !== "'" && before !== "`") return false;
+  if (valueStart === void 0) return true;
+  return /["'`]/.test(line.slice(matchIndex, valueStart));
 }
 function isTemplateInterpolation(line, start, end) {
-  return line[start] === "$" && line[start + 1] === "{" && line[end - 1] === "}";
+  if (line[start] !== "$" || line[start + 1] !== "{" || line[end - 1] !== "}") {
+    return false;
+  }
+  const inner = line.slice(start + 2, end - 1).trim();
+  return /^[A-Za-z_$][A-Za-z0-9_$.()[\]]*$/.test(inner);
 }
 function isSelfNamingConstant(line, start, end) {
   const value = line.slice(start, end);
@@ -1519,9 +1568,19 @@ function isUnquotedValue(line, start) {
   const before = start > 0 ? line[start - 1] : "";
   return before !== '"' && before !== "'" && before !== "`";
 }
-var DECLARATION_KEYWORDS = /\b(?:const|let|var|readonly|public|private|protected|static|declare|export|using)\s+$/;
+var DECLARATION_KEYWORDS = /\b(?:const|let|var|readonly|public|private|protected|static|using)\s+$/;
+var ASSIGNMENT_FILE = /\.(?:sh|bash|zsh|ksh|fish|env|ya?ml|toml|ini|conf|cfg|properties|tf|tfvars|service)$/i;
+var ASSIGNMENT_BASENAME = /^(?:\.env(?:\.[^/]*)?|\.envrc|\.profile|\.bashrc|\.zshrc|\.bash_profile)$/i;
+function isAssignmentFile(filePath) {
+  if (filePath === void 0) return false;
+  const normalised = filePath.replace(/\\/g, "/");
+  if (ASSIGNMENT_FILE.test(normalised)) return true;
+  const base = normalised.slice(normalised.lastIndexOf("/") + 1);
+  return ASSIGNMENT_BASENAME.test(base);
+}
 var DECLARATION_WINDOW = 40;
-function isDeclaredBinding(line, matchIndex) {
+function isDeclaredBinding(line, matchIndex, filePath) {
+  if (isAssignmentFile(filePath)) return false;
   let runStart = matchIndex;
   while (runStart > 0 && /[A-Za-z0-9_$]/.test(line[runStart - 1])) runStart -= 1;
   const from = Math.max(0, runStart - DECLARATION_WINDOW);
@@ -1563,6 +1622,15 @@ function readLinkTarget(linkPath, fallback) {
     return fallback;
   }
 }
+function brokenLinkRecord(linkPath, relativePath, rootReal) {
+  const rawTarget = readLinkTarget(linkPath, linkPath);
+  const resolvedFallback = path2.resolve(path2.dirname(linkPath), rawTarget);
+  return isInside(rootReal, resolvedFallback) ? { path: relativePath, reason: "read-error", detail: "broken symlink" } : {
+    path: relativePath,
+    reason: "outside-root",
+    detail: `link target resolves outside the scanned root (target: ${rawTarget}); not followed`
+  };
+}
 function isInside(root, candidate) {
   const relative12 = path2.relative(root, candidate);
   return relative12 === "" || !relative12.startsWith(`..${path2.sep}`) && relative12 !== ".." && !path2.isAbsolute(relative12);
@@ -1652,6 +1720,13 @@ function isSensitivePath(relativePath) {
   return matchesSensitiveList(posixPath, base);
 }
 var GLOBAL_PATTERNS = /* @__PURE__ */ new WeakMap();
+var GLOB_REGEX_CACHE = /* @__PURE__ */ new Map();
+var GITIGNORE_REGEX_CACHE = /* @__PURE__ */ new Map();
+var REGEX_CACHE_LIMIT = 4096;
+function rememberCompiled(cache, key, value) {
+  if (cache.size >= REGEX_CACHE_LIMIT) cache.clear();
+  cache.set(key, value);
+}
 function globalPattern(pattern) {
   let compiled = GLOBAL_PATTERNS.get(pattern);
   if (compiled === void 0) {
@@ -1662,8 +1737,8 @@ function globalPattern(pattern) {
 }
 var DEFAULT_PATH_RULES = [...DEFAULT_SECRET_PATTERNS];
 function pathScanRules(extraRules) {
-  if (extraRules === void 0 || extraRules.length === 0) return DEFAULT_PATH_RULES;
-  return [...DEFAULT_SECRET_PATTERNS, ...extraRules];
+  if (extraRules === void 0) return DEFAULT_PATH_RULES;
+  return extraRules;
 }
 function findSecretInPath(relativePath, extraRules) {
   const posixPath = relativePath.replace(/\\/g, "/");
@@ -1712,11 +1787,22 @@ function maskSkipPaths(records, extraRules) {
   });
 }
 function globToRegExp(glob) {
+  const cached = GLOB_REGEX_CACHE.get(glob);
+  if (cached !== void 0) return cached;
   const normalized = glob.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
   const anchored = normalized.startsWith("/");
   const body = anchored ? normalized.slice(1) : normalized;
   const prefix = anchored || body.includes("/") ? "^" : "(?:^|.*/)";
-  return new RegExp(`${prefix}${globBodyToRegExp(body, true)}(?:/.*)?$`);
+  let compiled;
+  try {
+    compiled = new RegExp(`${prefix}${globBodyToRegExp(body, true)}(?:/.*)?$`);
+  } catch (error) {
+    throw new Error(
+      `"${glob}" is not a valid glob: ${error.message}. A character class must be ascending, as in "[a-z]".`
+    );
+  }
+  rememberCompiled(GLOB_REGEX_CACHE, glob, compiled);
+  return compiled;
 }
 function globBodyToRegExp(body, allowBraces) {
   let out = "";
@@ -1828,6 +1914,14 @@ function escapeRegExpChar(character) {
   return /[\\^$.*+?()[\]{}|/]/.test(character) ? `\\${character}` : character;
 }
 function matchGitignorePattern(target, pattern) {
+  let compiled = GITIGNORE_REGEX_CACHE.get(pattern);
+  if (compiled === void 0) {
+    compiled = compileGitignorePattern(pattern);
+    rememberCompiled(GITIGNORE_REGEX_CACHE, pattern, compiled);
+  }
+  return compiled.test(target);
+}
+function compileGitignorePattern(pattern) {
   const anchored = pattern.startsWith("/");
   const body = anchored ? pattern.slice(1) : pattern;
   let source = "";
@@ -1876,7 +1970,11 @@ function matchGitignorePattern(target, pattern) {
     source += escapeRegExpChar(character);
   }
   const prefix = anchored || body.includes("/") ? "^" : "(?:^|.*/)";
-  return new RegExp(`${prefix}${source}(?:/.*)?$`).test(target);
+  try {
+    return new RegExp(`${prefix}${source}(?:/.*)?$`);
+  } catch {
+    return /$^/;
+  }
 }
 function matchesGitignoreRule(rule, scoped, isDirectory) {
   if (!rule.dirOnly) return matchGitignorePattern(scoped, rule.pattern);
@@ -1906,14 +2004,31 @@ function gitignoreVerdict(layers, relativePath, isDirectory) {
   }
   return verdict;
 }
-function defaultIgnoreReason(relativePath) {
+var DEFAULT_TOOL_DIR_NAMES = ["snapshot"];
+function toolDirNamesFor(toolOwnedPaths) {
+  const names = new Set(DEFAULT_TOOL_DIR_NAMES);
+  for (const entry of toolOwnedPaths) {
+    const base = entry.replace(/\\/g, "/").replace(/\/+$/, "").split("/").pop();
+    if (base !== void 0 && base.length > 0) names.add(base);
+  }
+  return [...names];
+}
+function isToolLeftoverName(name, dirNames) {
+  for (const dirName of dirNames) {
+    if (name.startsWith(`${dirName}.backup-`) || name.startsWith(`${dirName}.partial-`)) {
+      return true;
+    }
+  }
+  return false;
+}
+function defaultIgnoreReason(relativePath, toolDirNames = DEFAULT_TOOL_DIR_NAMES) {
   const posixPath = relativePath.replace(/\\/g, "/");
   const parts = posixPath.split("/");
   for (let i = 0; i < parts.length - 1; i++) {
     if (DEFAULT_IGNORED_DIRS.includes(parts[i])) {
       return `built-in ignore: directory "${parts[i]}"`;
     }
-    if (parts[i].startsWith("snapshot.backup-")) {
+    if (isToolLeftoverName(parts[i], toolDirNames)) {
       return `built-in ignore: leftover snapshot backup "${parts[i]}"`;
     }
   }
@@ -1921,6 +2036,9 @@ function defaultIgnoreReason(relativePath) {
   if (DEFAULT_IGNORED_FILES.includes(base)) {
     return `built-in ignore: filename "${base}"`;
   }
+  if (isToolLeftoverName(base, toolDirNames)) {
+    return `built-in ignore: leftover snapshot backup "${base}"`;
+  }
   return null;
 }
 function listIgnoredPaths(cwd) {
@@ -1989,41 +2107,72 @@ function dropLinkedDirectories(cwd, candidates, skipped) {
   }
   const reported = /* @__PURE__ */ new Set();
   const kept = [];
+  const report = (linkedPath, record) => {
+    if (reported.has(linkedPath)) return;
+    reported.add(linkedPath);
+    skipped.push(record);
+  };
   for (const candidate of candidates) {
     const parts = candidate.split("/");
-    let linkedDir = null;
+    let linkedPath = null;
     for (let depth = 1; depth <= parts.length; depth += 1) {
       const prefix = parts.slice(0, depth).join("/");
       if (isLink(path2.join(cwd, prefix))) {
-        linkedDir = prefix;
+        linkedPath = prefix;
         break;
       }
     }
-    if (linkedDir === null) {
+    if (linkedPath === null) {
       kept.push(candidate);
       continue;
     }
-    if (reported.has(linkedDir)) continue;
-    reported.add(linkedDir);
-    const absolute = path2.join(cwd, linkedDir);
-    let targetReal = absolute;
+    const absolute = path2.join(cwd, linkedPath);
+    const rawTarget = readLinkTarget(absolute, absolute);
+    let targetReal = null;
     try {
       targetReal = fs2.realpathSync(absolute);
     } catch {
+      targetReal = null;
     }
-    const target = readLinkTarget(absolute, targetReal);
-    const what = linkedDir === candidate ? "symbolic link" : "directory link";
-    skipped.push(
-      isInside(rootReal, targetReal) ? {
-        path: linkedDir,
-        reason: "symlink",
-        detail: `${what} not followed (target: ${target})`
-      } : {
-        path: linkedDir,
+    if (targetReal === null) {
+      report(linkedPath, brokenLinkRecord(absolute, linkedPath, rootReal));
+      continue;
+    }
+    if (!isInside(rootReal, targetReal)) {
+      report(linkedPath, {
+        path: linkedPath,
         reason: "outside-root",
-        detail: `link target resolves outside the scanned root (target: ${target}); not followed`
-      }
-    );
+        detail: `link target resolves outside the scanned root (target: ${rawTarget}); not followed`
+      });
+      continue;
+    }
+    let stats = null;
+    try {
+      stats = fs2.statSync(absolute);
+    } catch {
+      stats = null;
+    }
+    if (stats === null) {
+      report(linkedPath, { path: linkedPath, reason: "read-error", detail: "unreadable symlink" });
+      continue;
+    }
+    if (linkedPath !== candidate || stats.isDirectory()) {
+      report(linkedPath, {
+        path: linkedPath,
+        reason: "symlink",
+        detail: `directory link not followed (target: ${rawTarget})`
+      });
+      continue;
+    }
+    if (!stats.isFile()) {
+      report(linkedPath, {
+        path: linkedPath,
+        reason: "symlink",
+        detail: `link to neither a file nor a directory (target: ${rawTarget})`
+      });
+      continue;
+    }
+    kept.push(candidate);
   }
   return kept;
 }
@@ -2070,6 +2219,7 @@ function collectFiles(cwd, options = {}) {
     (options.toolOwnedPaths ?? []).map((entry) => entry.replace(/\\/g, "/"))
   );
   const isToolOwned = makeToolOwnedDecider(cwd, [...toolOwnedPaths]);
+  const toolDirNames = toolDirNamesFor(toolOwnedPaths);
   let candidates;
   const skipped = [];
   const discovery = options.discovery ?? "auto";
@@ -2098,7 +2248,7 @@ function collectFiles(cwd, options = {}) {
   }
   const files = candidates.filter((file) => {
     if (isToolOwned(file)) return false;
-    const ignored = defaultIgnoreReason(file);
+    const ignored = defaultIgnoreReason(file, toolDirNames);
     if (ignored) {
       skipped.push({ path: file, reason: "default-ignore", detail: ignored });
       return false;
@@ -2153,6 +2303,7 @@ function rootRealFor(root) {
 function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PURE__ */ new Set(), parentGitignoreLayers = []) {
   const results = { files: [], skipped: [] };
   const stack = [];
+  const toolDirNames = toolDirNamesFor(reservedPaths);
   const relativeToBase = (target) => path2.relative(baseDir, target).replace(/\\/g, "/") || ".";
   const enter = (current, layers) => {
     if (visited.has(current)) return false;
@@ -2197,11 +2348,11 @@ function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PU
       });
       continue;
     }
-    if (DEFAULT_IGNORED_FILES.includes(entry.name) || entry.name.startsWith("snapshot.backup-")) {
+    if (DEFAULT_IGNORED_FILES.includes(entry.name) || isToolLeftoverName(entry.name, toolDirNames)) {
       results.skipped.push({
         path: relPath,
         reason: "default-ignore",
-        detail: "built-in ignore: filename"
+        detail: isToolLeftoverName(entry.name, toolDirNames) ? `built-in ignore: leftover snapshot backup "${entry.name}" (not descended)` : "built-in ignore: filename"
       });
       continue;
     }
@@ -2222,7 +2373,7 @@ function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PU
       try {
         targetReal = fs2.realpathSync(fullPath);
       } catch {
-        results.skipped.push({ path: relPath, reason: "read-error", detail: "broken symlink" });
+        results.skipped.push(brokenLinkRecord(fullPath, relPath, rootReal));
         continue;
       }
       let stats;
@@ -2322,8 +2473,9 @@ function findConfigFile(cwd) {
   const pkgJsonPath = path3.join(cwd, "package.json");
   if (!fs3.existsSync(pkgJsonPath)) return null;
   try {
-    const parsed = JSON.parse(fs3.readFileSync(pkgJsonPath, "utf8"));
-    return parsed.snapshot === void 0 ? null : pkgJsonPath;
+    const parsed = JSON.parse(stripJsonComments(fs3.readFileSync(pkgJsonPath, "utf8")));
+    const snapshot = parsed?.snapshot;
+    return typeof snapshot === "object" && snapshot !== null && !Array.isArray(snapshot) ? pkgJsonPath : null;
   } catch {
     return null;
   }
@@ -2373,15 +2525,19 @@ function normalizeBudgets(budgets, maxPartBytes) {
 }
 function normalizeResolvedConfig(config) {
   const discovery = isDiscoveryMode(config.discovery) ? config.discovery : "auto";
+  const monolithWanted = config.includeMonolith === true || config.artifacts?.monolith === true;
+  const artifacts = resolveArtifacts(
+    config.artifacts,
+    void 0,
+    monolithWanted,
+    monolithWanted
+  );
   return markResolvedConfig({
     ...config,
     discovery,
+    includeMonolith: artifacts.monolith,
     secretRules: compileSecretRules(config.secretRules),
-    artifacts: resolveArtifacts(
-      config.artifacts,
-      void 0,
-      config.includeMonolith === true
-    ),
+    artifacts,
     include: resolveInclude(config.include),
     preset: typeof config.preset === "string" ? config.preset : "generic",
     presetExclude: [
@@ -2590,6 +2746,16 @@ async function importConfigModule(fullPath) {
   url.searchParams.set("codebaseSnapshotLoad", String(moduleConfigLoadToken));
   return await import(url.href);
 }
+function attachConfigDir(config, filePath) {
+  if (typeof config === "object" && config !== null) {
+    Object.defineProperty(config, CONFIG_DIR_SYMBOL, {
+      value: path3.dirname(filePath),
+      enumerable: false,
+      configurable: true
+    });
+  }
+  return config;
+}
 async function loadConfigFileDetailed(cwd) {
   const warnings = [];
   const errors = [];
@@ -2605,7 +2771,7 @@ async function loadConfigFileDetailed(cwd) {
           );
         }
         assertKnownConfigKeys(config, fullPath);
-        return { config, file: fullPath, warnings, errors };
+        return { config: attachConfigDir(config, fullPath), file: fullPath, warnings, errors };
       } catch (err) {
         const raw = err.message;
         const message = raw.includes(fullPath) ? raw : `${fullPath}: ${raw}`;
@@ -2624,7 +2790,7 @@ async function loadConfigFileDetailed(cwd) {
       const imported = await importConfigModule(fullPath);
       const hasDefault = Object.prototype.hasOwnProperty.call(imported, "default");
       const config = readConfigExport(hasDefault ? imported.default : imported, fullPath);
-      return { config, file: fullPath, warnings, errors };
+      return { config: attachConfigDir(config, fullPath), file: fullPath, warnings, errors };
     } catch (err) {
       const message = `Could not load ${fullPath}: ${err.message}`;
       warnings.push(message);
@@ -2642,7 +2808,12 @@ async function loadConfigFileDetailed(cwd) {
           snapshotKey,
           `${pkgJsonPath} (the "snapshot" key)`
         );
-        return { config: snapshotKey, file: pkgJsonPath, warnings, errors };
+        return {
+          config: attachConfigDir(snapshotKey, pkgJsonPath),
+          file: pkgJsonPath,
+          warnings,
+          errors
+        };
       }
       if (snapshotKey !== void 0) {
         const kind = Array.isArray(snapshotKey) ? "array" : typeof snapshotKey;
@@ -2681,7 +2852,7 @@ var DEFAULT_ARTIFACTS = {
 function isArtifactName(value) {
   return ARTIFACT_NAMES.includes(value);
 }
-function resolveArtifacts(requested, skipped, includeMonolith, monolithOverride) {
+function resolveArtifacts(requested, skipped, includeMonolith, monolithOverride, only) {
   const artifacts = {
     ...DEFAULT_ARTIFACTS,
     // `includeMonolith` predates this selection and stays the switch for it.
@@ -2706,6 +2877,21 @@ function resolveArtifacts(requested, skipped, includeMonolith, monolithOverride)
   if (monolithOverride !== void 0) {
     artifacts.monolith = monolithOverride;
   }
+  if (only !== void 0 && only.length > 0) {
+    const keep = /* @__PURE__ */ new Set();
+    for (const name of only) {
+      if (!isArtifactName(name)) {
+        throw new Error(
+          `Unknown artifact "${name}". Expected one of: ${ARTIFACT_NAMES.join(", ")}.`
+        );
+      }
+      keep.add(name);
+    }
+    for (const name of ARTIFACT_NAMES) {
+      artifacts[name] = keep.has(name);
+    }
+    return artifacts;
+  }
   for (const name of skipped ?? []) {
     if (!isArtifactName(name)) {
       throw new Error(
@@ -3006,7 +3192,8 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     userConfig?.artifacts,
     cliOptions?.skipArtifacts,
     includeMonolith,
-    cliMonolith
+    cliMonolith,
+    cliOptions?.onlyArtifacts
   );
   const explicitMaxPartBytes = cliOptions?.maxPartBytes ?? userConfig?.maxPartBytes;
   const maxPartBytes = boundedBytes(
@@ -3180,7 +3367,18 @@ function configDigest(config) {
     excludePatterns: config.excludePatterns,
     preset: config.preset,
     layersMode: config.layersMode,
-    budgets: config.budgets,
+    // `budgets.byLayer` is a plain object, and `JSON.stringify` preserves insertion order — so
+    // `{ docs, api }` and `{ api, docs }` hashed differently despite being the same settings, and
+    // `validate` reported configuration drift for a snapshot nobody had changed. The keys are
+    // canonicalised here; nothing else about the object is order-dependent.
+    budgets: {
+      default: config.budgets.default,
+      byLayer: Object.fromEntries(
+        Object.entries(config.budgets.byLayer).sort(
+          ([left], [right]) => left < right ? -1 : left > right ? 1 : 0
+        )
+      )
+    },
     // The matcher is what makes a layer a layer. Hashing only the names meant that
     // moving `{ name: "api", match: "src/api/**" }` to `"src/v2/**"` produced the same
     // digest, so `validate` reported "valid and up to date" for a snapshot whose files
@@ -3288,6 +3486,10 @@ var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mjs",
   ".cjs"
 ]);
+var PYTHON_EXTENSIONS = /* @__PURE__ */ new Set([".py", ".pyi"]);
+var RUBY_EXTENSIONS = /* @__PURE__ */ new Set([".rb", ".rake", ".gemspec"]);
+var C_EXTENSIONS = /* @__PURE__ */ new Set([".c", ".h", ".cc", ".cpp", ".cxx", ".hpp", ".hxx", ".m", ".mm"]);
+var PYTHON_SUFFIXES = [".py", ".pyi", "/__init__.py", "/__init__.pyi"];
 function buildImportResolver(files) {
   const byPath = /* @__PURE__ */ new Map();
   const byPathFolded = /* @__PURE__ */ new Map();
@@ -3314,11 +3516,45 @@ function buildImportResolver(files) {
   return { byPath, byPathFolded, byStem, byStemFolded };
 }
 function resolveSpecifier(fromFile, specifier, resolver) {
+  const extension = path4.posix.extname(fromFile).toLowerCase();
+  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
+  const firstOf = (candidates) => {
+    for (const candidate of candidates) {
+      const hit = exact(candidate);
+      if (hit) return hit;
+    }
+    return null;
+  };
+  if (PYTHON_EXTENSIONS.has(extension) && specifier.startsWith(".")) {
+    const dots = /^\.+/.exec(specifier)?.[0].length ?? 0;
+    const rest = specifier.slice(dots).replace(/\./g, "/");
+    let base = path4.posix.dirname(fromFile);
+    for (let up = 1; up < dots; up += 1) base = path4.posix.dirname(base);
+    const joined2 = rest ? path4.posix.normalize(path4.posix.join(base, rest)) : base;
+    return firstOf([joined2, ...PYTHON_SUFFIXES.map((suffix) => `${joined2}${suffix}`)]);
+  }
+  if (RUBY_EXTENSIONS.has(extension) && specifier.startsWith("./")) {
+    const joined2 = path4.posix.normalize(
+      path4.posix.join(path4.posix.dirname(fromFile), specifier)
+    );
+    return firstOf([`${joined2}.rb`, joined2]);
+  }
+  if (C_EXTENSIONS.has(extension) && specifier.startsWith("./")) {
+    const joined2 = path4.posix.normalize(
+      path4.posix.join(path4.posix.dirname(fromFile), specifier)
+    );
+    return exact(joined2);
+  }
+  if (extension === ".dart" && !specifier.includes(":")) {
+    const joined2 = path4.posix.normalize(
+      path4.posix.join(path4.posix.dirname(fromFile), specifier)
+    );
+    return firstOf([joined2, `${joined2}.dart`]);
+  }
   if (!RELATIVE_SPECIFIER.test(specifier)) return null;
   const joined = path4.posix.normalize(
     path4.posix.join(path4.posix.dirname(fromFile), specifier)
   );
-  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
   const direct = exact(joined);
   if (direct) return direct;
   for (const suffix of IMPORT_CANDIDATE_SUFFIXES) {
@@ -3450,13 +3686,23 @@ function summarizeTypeScriptSource(relativePath, content) {
     if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
       summary.imports.push(node.moduleSpecifier.text);
     }
+    if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference) && node.moduleReference.expression !== void 0 && ts.isStringLiteral(node.moduleReference.expression)) {
+      summary.imports.push(node.moduleReference.expression.text);
+    }
+    if (ts.isCallExpression(node) && node.arguments.length >= 1) {
+      const firstArgument = node.arguments[0];
+      if (firstArgument !== void 0 && ts.isStringLiteral(firstArgument)) {
+        const isDynamicImport = node.expression.kind === ts.SyntaxKind.ImportKeyword;
+        const isRequire = ts.isIdentifier(node.expression) && node.expression.text === "require";
+        if (isDynamicImport || isRequire) summary.imports.push(firstArgument.text);
+      }
+    }
     if (ts.isExportDeclaration(node)) {
       if (node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
         summary.imports.push(node.moduleSpecifier.text);
+        summary.reExports.push(node.moduleSpecifier.text);
         if (node.exportClause && ts.isNamespaceExport(node.exportClause)) {
           summary.exports.push(node.exportClause.name.text);
-        } else if (!node.exportClause) {
-          summary.reExports.push(node.moduleSpecifier.text);
         }
       }
       if (node.exportClause && ts.isNamedExports(node.exportClause)) {
@@ -3601,7 +3847,7 @@ function isCapitalizedName(name) {
 }
 
 // src/ast/profiles/cfamily.ts
-var INCLUDE = /^#\s*include\s*[<"]([^>"]+)[>"]/;
+var INCLUDE = /^#\s*include\s*([<"])([^>"]+)[>"]/;
 var DEFINE = /^#\s*define\s+([A-Za-z_]\w*)/;
 var USING = /^using\s+(?:namespace\s+)?([\w:]+)\s*;/;
 var TYPE_DECL = /^(?:typedef\s+)?(?:struct|union|class|enum)\s+([A-Za-z_]\w*)/;
@@ -3620,7 +3866,7 @@ var cfamilyProfile = {
       }
       const included = INCLUDE.exec(trimmed);
       if (included) {
-        summary.imports.push(included[1]);
+        summary.imports.push(included[1] === '"' ? `./${included[2]}` : included[2]);
         return;
       }
       const used = USING.exec(trimmed);
@@ -4024,7 +4270,15 @@ var pythonProfile = {
       }
       const from = FROM_IMPORT.exec(trimmed);
       if (from) {
-        summary.imports.push(from[1]);
+        const module = from[1];
+        if (/^\.+$/.test(module)) {
+          for (const name of from[2].split(",")) {
+            const imported2 = name.replace(/[()]/g, "").trim().split(/\s+as\s+/)[0].trim();
+            if (/^[A-Za-z_]\w*$/.test(imported2)) summary.imports.push(`${module}${imported2}`);
+          }
+        } else {
+          summary.imports.push(module);
+        }
         routePending = false;
         return;
       }
@@ -4073,7 +4327,8 @@ var pythonProfile = {
 };
 
 // src/ast/profiles/ruby.ts
-var REQUIRE = /^require(?:_relative)?\s+["']([^"']+)["']/;
+var REQUIRE_RELATIVE = /^require_relative\s+["']([^"']+)["']/;
+var REQUIRE = /^require\s+["']([^"']+)["']/;
 var CLASS_OR_MODULE = /^(?:class|module)\s+([A-Z][\w:]*)/;
 var METHOD2 = /^def\s+(?:self\.)?([A-Za-z_]\w*[?!=]?)/;
 var rubyProfile = {
@@ -4084,6 +4339,11 @@ var rubyProfile = {
     eachLine(content, (line) => {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) return;
+      const relative12 = REQUIRE_RELATIVE.exec(trimmed);
+      if (relative12) {
+        summary.imports.push(`./${relative12[1]}`);
+        return;
+      }
       const required = REQUIRE.exec(trimmed);
       if (required) {
         summary.imports.push(required[1]);
@@ -4174,7 +4434,8 @@ var rustProfile = {
 };
 
 // src/ast/profiles/sfc.ts
-var SCRIPT_BLOCK = /<script[^>]*>([\s\S]*?)<\/script>/gi;
+var SCRIPT_BLOCK = /<script([^>]*)>([\s\S]*?)<\/script>/gi;
+var JSX_LANG = /\blang\s*=\s*["']?[tj]sx\b/i;
 var ASTRO_FRONTMATTER = /^\uFEFF?---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?=\r?\n|$)/;
 function componentName(path22) {
   const base = path22.split("/").pop() ?? path22;
@@ -4185,13 +4446,15 @@ var sfcProfile = {
   extensions: [".vue", ".svelte", ".astro"],
   summarize(path22, content) {
     let script = "";
+    let usesJsx = path22.toLowerCase().endsWith(".astro");
     if (path22.toLowerCase().endsWith(".astro")) {
       const frontmatter = ASTRO_FRONTMATTER.exec(content);
       if (frontmatter) script += `${frontmatter[1]}
 `;
     }
     for (const match of content.matchAll(SCRIPT_BLOCK)) {
-      script += `${match[1]}
+      if (JSX_LANG.test(match[1] ?? "")) usesJsx = true;
+      script += `${match[2]}
 `;
     }
     const name = componentName(path22);
@@ -4203,7 +4466,7 @@ var sfcProfile = {
       }
       return { summary: finalizeSummary(summary2), quality: "heuristic" };
     }
-    const summary = summarizeTypeScriptSource(`${name}.ts`, script);
+    const summary = summarizeTypeScriptSource(`${name}.${usesJsx ? "tsx" : "ts"}`, script);
     summary.reactComponents.push(name);
     summary.exports.push(name);
     return { summary: finalizeSummary(summary), quality: "ast" };
@@ -4641,18 +4904,22 @@ function isBinaryFile(absolutePath) {
 }
 
 // src/ast/imports.ts
+var SUMMARY_MAX_SOURCE_BYTES = 2 * 1024 * 1024;
 var TS_SOURCE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 var isTsSource = (relativePath) => {
   const lower = relativePath.toLowerCase();
   return TS_SOURCE_EXTENSIONS.some((extension) => lower.endsWith(extension));
 };
 function importsOfText(relativePath, text2) {
+  if (Buffer.byteLength(text2, "utf8") > SUMMARY_MAX_SOURCE_BYTES) return [];
   if (isTsSource(relativePath)) return summarizeTypeScriptSource(relativePath, text2).imports;
   return summarizeWithProfile(relativePath, text2)?.summary.imports ?? [];
 }
 function importsOfFile(relativePath, absolutePath) {
   let buffer;
   try {
+    const stats = fs5.statSync(absolutePath);
+    if (!stats.isFile() || stats.size > SUMMARY_MAX_SOURCE_BYTES) return [];
     buffer = fs5.readFileSync(absolutePath);
   } catch {
     return [];
@@ -4783,9 +5050,13 @@ function describeManifestShapeProblem(value) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
       return 'a "parts" entry is not an object';
     }
-    if (typeof entry.filename !== "string") {
+    const filename = entry.filename;
+    if (typeof filename !== "string" || filename.trim() === "") {
       return 'a "parts" entry has no "filename"';
     }
+    if (filename.includes("/") || filename.includes("\\") || filename.includes("\0") || filename === "." || filename === ".." || path6.isAbsolute(filename)) {
+      return 'a "parts" entry "filename" must be a bare filename inside parts/';
+    }
   }
   if (!candidate.layers || typeof candidate.layers !== "object" || Array.isArray(candidate.layers)) {
     return 'missing "layers" object';
@@ -4896,7 +5167,7 @@ function validateSnapshot(configInput) {
   });
   for (const diskFile of collection.files) {
     const snapshotHash = manifestFileMap.get(diskFile);
-    if (!snapshotHash) {
+    if (snapshotHash === void 0) {
       const skipReason = skippedReasonOnDisk(diskFile);
       if (skipReason === "unchanged") {
         if (unchangedScope !== null) {
@@ -4910,6 +5181,11 @@ function validateSnapshot(configInput) {
       drift.missingInSnapshot.push(diskFile);
       continue;
     }
+    if (unchangedScope !== null && !unchangedScope.has(diskFile) && !becameDependent(diskFile)) {
+      drift.configMismatches.push(
+        `scope: ${maskedPath(diskFile, config.secretRules)} is in the snapshot but is no longer in the changed-files scope`
+      );
+    }
     let diskHash;
     try {
       diskHash = sha256Hex(fs6.readFileSync(path6.join(config.cwd, diskFile)));
@@ -5050,6 +5326,41 @@ function validateSnapshot(configInput) {
         `includeSensitiveFiles: manifest ${recorded.includeSensitiveFiles} vs current ${config.includeSensitiveFiles}`
       );
     }
+    if ((recorded.maxPartTokens ?? void 0) !== (config.maxPartTokens ?? void 0)) {
+      drift.configMismatches.push(
+        `maxPartTokens: manifest ${String(recorded.maxPartTokens ?? "unset")} vs current ${String(config.maxPartTokens ?? "unset")}`
+      );
+    }
+    if ((recorded.maxMonolithBytes ?? null) !== (config.maxMonolithBytes ?? null)) {
+      drift.configMismatches.push(
+        `maxMonolithBytes: manifest ${String(recorded.maxMonolithBytes ?? null)} vs current ${String(config.maxMonolithBytes ?? null)}`
+      );
+    }
+    if (Boolean(recorded.skeleton) !== Boolean(config.skeleton)) {
+      drift.configMismatches.push(
+        `skeleton: manifest ${Boolean(recorded.skeleton)} vs current ${Boolean(config.skeleton)}`
+      );
+    }
+    if (Boolean(recorded.sarif) !== Boolean(config.sarif)) {
+      drift.configMismatches.push(
+        `sarif: manifest ${Boolean(recorded.sarif)} vs current ${Boolean(config.sarif)}`
+      );
+    }
+    if ((recorded.changedSince ?? void 0) !== (config.changedSince ?? void 0)) {
+      drift.configMismatches.push(
+        `changedSince: manifest ${String(recorded.changedSince ?? "unset")} vs current ${String(config.changedSince ?? "unset")}`
+      );
+    }
+    if (Boolean(recorded.staged) !== Boolean(config.staged)) {
+      drift.configMismatches.push(
+        `staged: manifest ${Boolean(recorded.staged)} vs current ${Boolean(config.staged)}`
+      );
+    }
+    if (Boolean(recorded.withDependents) !== Boolean(config.withDependents)) {
+      drift.configMismatches.push(
+        `withDependents: manifest ${Boolean(recorded.withDependents)} vs current ${Boolean(config.withDependents)}`
+      );
+    }
     const effectiveDiscovery = config.discovery ?? "auto";
     const recordedDiscovery = recorded.discovery;
     if (recordedDiscovery !== void 0 && recordedDiscovery !== effectiveDiscovery) {
@@ -5528,9 +5839,21 @@ import * as fs8 from "fs";
 import * as path9 from "path";
 
 // src/partitioner/preview.ts
+var LINE_ENDINGS = /\r\n|\r/g;
+var normaliseLineEndings = (content) => content.replace(LINE_ENDINGS, "\n");
 function countLines(content) {
   if (content.length === 0) return 0;
-  return content.split("\n").length - (content.endsWith("\n") ? 1 : 0);
+  let breaks = 0;
+  for (let index = 0; index < content.length; index += 1) {
+    const code = content.charCodeAt(index);
+    if (code === 10) {
+      breaks += 1;
+      continue;
+    }
+    if (code === 13 && content.charCodeAt(index + 1) !== 10) breaks += 1;
+  }
+  const last = content.charCodeAt(content.length - 1);
+  return last === 10 || last === 13 ? breaks : breaks + 1;
 }
 function truncateToBytes(content, maxBytes) {
   if (maxBytes <= 0) return { content: "", isTruncated: content.length > 0 };
@@ -5541,17 +5864,18 @@ function truncateToBytes(content, maxBytes) {
   return { content: slice, isTruncated: true };
 }
 function truncatePreview(content, headLines, tailLines) {
-  const lines = content.split("\n");
-  const total = countLines(content);
+  const normalised = normaliseLineEndings(content);
+  const lines = normalised.split("\n");
+  const total = countLines(normalised);
   if (total <= headLines + tailLines) {
     return {
-      content,
+      content: normalised,
       isTruncated: false,
       originalLines: total,
       includedLines: total
     };
   }
-  const window = content.endsWith("\n") ? lines.slice(0, -1) : lines;
+  const window = normalised.endsWith("\n") ? lines.slice(0, -1) : lines;
   const head = window.slice(0, headLines);
   const tail = tailLines > 0 ? window.slice(window.length - tailLines) : [];
   const omitted = total - head.length - tail.length;
@@ -5674,10 +5998,13 @@ function describeMatcher(matcher) {
   return String(matcher);
 }
 function normalizeTarget(cwd, target) {
-  const absolute = path9.resolve(cwd, target);
-  const relative12 = path9.relative(cwd, absolute);
-  if (relative12.startsWith("..") || path9.isAbsolute(relative12)) return target;
-  return relative12.split(path9.sep).join("/");
+  const resolvedCwd = path9.resolve(cwd);
+  const absolute = path9.resolve(resolvedCwd, target);
+  const relative12 = path9.relative(resolvedCwd, absolute);
+  if (relative12 === "" || relative12 === ".." || relative12.startsWith(`..${path9.sep}`) || path9.isAbsolute(relative12)) {
+    return { relative: target.replace(/\\/g, "/"), outsideRoot: true };
+  }
+  return { relative: relative12.split(path9.sep).join("/"), outsideRoot: false };
 }
 function findRuleMatch(rules, relativePath) {
   return rules.find(
@@ -5704,9 +6031,19 @@ function readManifest2(config) {
   }
 }
 function explainPath(config, target) {
-  const relative12 = normalizeTarget(config.cwd, target);
-  const absolute = path9.join(config.cwd, relative12);
+  const normalized = normalizeTarget(config.cwd, target);
+  const relative12 = normalized.relative;
   const maskedPath2 = findSecretInPath(relative12, config.secretRules)?.masked ?? relative12;
+  if (normalized.outsideRoot) {
+    return {
+      path: maskedPath2,
+      exists: false,
+      included: false,
+      reason: "outside-root",
+      detail: "path resolves outside the configured repository root and was not inspected"
+    };
+  }
+  const absolute = path9.join(config.cwd, relative12);
   const result = {
     path: maskedPath2,
     exists: fs8.existsSync(absolute),
@@ -5861,6 +6198,178 @@ function renderExplainText(result) {
 import * as fs10 from "fs";
 import * as path11 from "path";
 
+// src/ast/structured.ts
+function stripJsonComments2(content) {
+  const text2 = content.replace(/^\uFEFF/, "");
+  const withoutComments = stripComments(text2);
+  return stripTrailingCommas2(withoutComments);
+}
+function stripComments(text2) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let index = 0; index < text2.length; index += 1) {
+    const char = text2[index];
+    if (inString) {
+      out += char;
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      out += char;
+      continue;
+    }
+    if (char === "/" && text2[index + 1] === "/") {
+      while (index < text2.length && text2[index] !== "\n" && text2[index] !== "\r") index += 1;
+      index -= 1;
+      continue;
+    }
+    if (char === "/" && text2[index + 1] === "*") {
+      index += 2;
+      while (index < text2.length && !(text2[index] === "*" && text2[index + 1] === "/")) {
+        if (text2[index] === "\n" || text2[index] === "\r") out += text2[index];
+        index += 1;
+      }
+      index += 1;
+      continue;
+    }
+    out += char;
+  }
+  return out;
+}
+function stripTrailingCommas2(text2) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let index = 0; index < text2.length; index += 1) {
+    const char = text2[index];
+    if (inString) {
+      out += char;
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      out += char;
+      continue;
+    }
+    if (char === ",") {
+      let next = index + 1;
+      while (next < text2.length && /\s/.test(text2[next])) next += 1;
+      if (text2[next] === "}" || text2[next] === "]") continue;
+    }
+    out += char;
+  }
+  return out;
+}
+function summarizeJson(content) {
+  try {
+    const parsed = JSON.parse(stripJsonComments2(content));
+    if (Array.isArray(parsed)) {
+      const sample = parsed[0];
+      const sampleKeys = sample && typeof sample === "object" && !Array.isArray(sample) ? Object.keys(sample).slice(0, 10).sort() : [];
+      return {
+        shape: "array",
+        itemCount: parsed.length,
+        keys: [],
+        sampleKeys
+      };
+    }
+    if (parsed && typeof parsed === "object") {
+      const keys = Object.keys(parsed).sort();
+      return {
+        shape: "object",
+        itemCount: keys.length,
+        keys: keys.slice(0, 30),
+        sampleKeys: []
+      };
+    }
+    return {
+      shape: typeof parsed,
+      itemCount: null,
+      keys: [],
+      sampleKeys: []
+    };
+  } catch {
+    return {
+      shape: "invalid-json",
+      itemCount: null,
+      keys: [],
+      sampleKeys: []
+    };
+  }
+}
+function frontMatterEnd(lines) {
+  if (lines.length < 3 || lines[0].trim() !== "---") return 0;
+  for (let index = 1; index < lines.length; index += 1) {
+    const line = lines[index];
+    const candidate = line.trim();
+    if (candidate === "---" || candidate === "...") {
+      return index > 1 ? index : 0;
+    }
+    if (candidate === "") continue;
+    if (/^#(\s|$)/.test(candidate)) continue;
+    if (/^(`{3,}|~{3,})/.test(candidate)) return 0;
+    if (/^#{1,6}\s+\S/.test(candidate)) return 0;
+    const isYamlMapping = /^[A-Za-z0-9_.-]+\s*:(\s|$)/.test(candidate);
+    const isListItem = /^-(?:(\s|$))/.test(candidate);
+    const isIndented = /^[ \t]/.test(line);
+    if (!isYamlMapping && !isListItem && !isIndented) return 0;
+  }
+  return 0;
+}
+function summarizeMarkdown(content) {
+  const headings = [];
+  const frontmatterKeys = [];
+  const lines = content.replace(/^\uFEFF/, "").split(/\r\n|\n|\r/);
+  let inFrontmatter = false;
+  let fence = null;
+  const frontMatterEndLine = frontMatterEnd(lines);
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index];
+    if (index === 0 && frontMatterEndLine > 0) {
+      inFrontmatter = true;
+      continue;
+    }
+    if (inFrontmatter) {
+      const trimmedFrontmatter = line.trim();
+      if (trimmedFrontmatter === "---" || trimmedFrontmatter === "...") {
+        inFrontmatter = false;
+        continue;
+      }
+      const match = /^([A-Za-z0-9_.-]+)\s*:/.exec(line);
+      if (match) frontmatterKeys.push(match[1]);
+      continue;
+    }
+    const trimmed = line.trim();
+    const fenceMatch = /^(`{3,}|~{3,})(.*)$/.exec(trimmed);
+    if (fenceMatch) {
+      const run = fenceMatch[1];
+      const rest = fenceMatch[2].trim();
+      if (fence === null) {
+        fence = { marker: run[0], length: run.length };
+      } else if (run[0] === fence.marker && run.length >= fence.length && rest === "") {
+        fence = null;
+      }
+      continue;
+    }
+    if (fence !== null) continue;
+    const headingMatch = /^(#{1,6})\s+(.+)$/.exec(trimmed);
+    if (headingMatch) {
+      headings.push(`${headingMatch[1]} ${headingMatch[2].trim()}`);
+    }
+  }
+  return {
+    headings: headings.slice(0, 40),
+    frontmatterKeys: Array.from(new Set(frontmatterKeys)).sort()
+  };
+}
+
 // src/gitignore.ts
 import * as fs9 from "fs";
 import * as path10 from "path";
@@ -5901,7 +6410,7 @@ function gitignorePath(cwd, filePath) {
 
 // src/version.ts
 var GENERATOR_NAME = "codebase-snapshot";
-var GENERATOR_VERSION = "0.9.12";
+var GENERATOR_VERSION = "0.9.14";
 var LEGACY_GENERATOR_NAMES = ["@ankurhalder/codebase-snapshot"];
 function isOurGeneratorName(name) {
   if (typeof name !== "string") return false;
@@ -6111,6 +6620,24 @@ function displayWidth(line) {
   return width;
 }
 var GUTTER_PATTERN = /^[ \t]*(?:[❯◆◻◼▏✖][ \t]+)*/;
+function sliceByDisplayWidth(text2, maxCells) {
+  let cells = 0;
+  let lastSpace = -1;
+  let index = 0;
+  for (const character of text2) {
+    const width = isWideCodePoint(character.codePointAt(0) ?? 0) ? 2 : 1;
+    if (cells + width > maxCells) break;
+    if (character === " ") lastSpace = index;
+    cells += width;
+    index += character.length;
+  }
+  if (index >= text2.length) return { head: text2, tail: "" };
+  if (lastSpace > 0) {
+    return { head: text2.slice(0, lastSpace), tail: text2.slice(lastSpace + 1).trimStart() };
+  }
+  const safeIndex = index > 0 ? index : Array.from(text2)[0]?.length ?? 1;
+  return { head: text2.slice(0, safeIndex), tail: text2.slice(safeIndex).trimStart() };
+}
 function wrapOneLine(line, limit) {
   if (displayWidth(line) <= limit) return [line];
   const gutter = GUTTER_PATTERN.exec(line)?.[0] ?? "";
@@ -6125,12 +6652,11 @@ function wrapOneLine(line, limit) {
       rows.push(prefix + rest);
       break;
     }
-    let cut = room;
-    const space = rest.slice(0, room).lastIndexOf(" ");
-    if (space > 0) cut = space;
-    const taken = rest.slice(0, cut).trimEnd();
-    rows.push(`${prefix}${taken.length > 0 ? taken : rest.slice(0, cut)}`);
-    rest = rest.slice(cut).trimStart();
+    const { head, tail } = sliceByDisplayWidth(rest, room);
+    rows.push(
+      `${prefix}${head.length > 0 ? head : rest.slice(0, 1)}`
+    );
+    rest = tail;
     prefix = continuation;
   }
   return rows;
@@ -6201,7 +6727,7 @@ function keyReader(input) {
     next() {
       const queued = queue.shift();
       if (queued) return Promise.resolve(queued);
-      return new Promise((resolve9) => waiters.push(resolve9));
+      return new Promise((resolve10) => waiters.push(resolve10));
     },
     close() {
       input.off("keypress", onKey);
@@ -6418,17 +6944,25 @@ var CONFIG_CANDIDATES = [
   ".snapshotrc.json",
   ".snapshotrc"
 ];
-function chooseConfigFileName(cwd) {
-  if (!supportsTypeScriptImports()) return "snapshot.config.mjs";
-  const pkgPath = path11.join(cwd, "package.json");
-  if (!fs10.existsSync(pkgPath)) return "snapshot.config.mjs";
+function parsePackageJson(raw) {
+  const parsed = JSON.parse(stripJsonComments2(raw));
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("package.json is not a JSON object");
+  }
+  return parsed;
+}
+function readPackageJson(cwd) {
   try {
-    const parsed = JSON.parse(fs10.readFileSync(pkgPath, "utf8"));
-    return parsed.type === "module" ? "snapshot.config.ts" : "snapshot.config.mjs";
+    return parsePackageJson(fs10.readFileSync(path11.join(cwd, "package.json"), "utf8"));
   } catch {
-    return "snapshot.config.mjs";
+    return null;
   }
 }
+function chooseConfigFileName(cwd) {
+  if (!supportsTypeScriptImports()) return "snapshot.config.mjs";
+  const parsed = readPackageJson(cwd);
+  return parsed?.type === "module" ? "snapshot.config.ts" : "snapshot.config.mjs";
+}
 var SIZE_CHOICES = [
   { value: "60k", label: "Small", hint: "60 KB \xB7 ~15k tokens \xB7 tight context windows" },
   { value: "120k", label: "Medium", hint: "120 KB \xB7 ~30k tokens \xB7 recommended" },
@@ -6436,12 +6970,9 @@ var SIZE_CHOICES = [
   { value: "custom", label: "Custom\u2026", hint: "type a size like 150k or 1.5mb" }
 ];
 function packageJsonHasConfig(cwd) {
-  try {
-    const parsed = JSON.parse(fs10.readFileSync(path11.join(cwd, "package.json"), "utf8"));
-    return typeof parsed.snapshot === "object" && parsed.snapshot !== null && !Array.isArray(parsed.snapshot);
-  } catch {
-    return false;
-  }
+  const parsed = readPackageJson(cwd);
+  if (parsed === null) return false;
+  return typeof parsed.snapshot === "object" && parsed.snapshot !== null && !Array.isArray(parsed.snapshot);
 }
 function artifactAnswers(options) {
   const artifacts = { ...DEFAULT_ANSWERS.artifacts };
@@ -6482,12 +7013,7 @@ function writeFileOrExplain(target, content) {
 function canWriteModuleConfig(name, cwd) {
   if (name.endsWith(".mjs") || name.endsWith(".ts")) return true;
   if (!name.endsWith(".js")) return false;
-  try {
-    const parsed = JSON.parse(fs10.readFileSync(path11.join(cwd, "package.json"), "utf8"));
-    return parsed.type === "module";
-  } catch {
-    return false;
-  }
+  return readPackageJson(cwd)?.type === "module";
 }
 function configFormatLabel(name) {
   if (name.endsWith(".js")) return 'CommonJS `.js` (package.json has no "type": "module")';
@@ -6515,7 +7041,8 @@ function serializePackageJson(raw, value) {
   const crlf = raw.includes("\r\n");
   const body = JSON.stringify(value, null, spacing);
   const text2 = crlf ? body.replace(/\n/g, "\r\n") : body;
-  return `${text2}${raw.endsWith("\n") ? crlf ? "\r\n" : "\n" : ""}`;
+  const bom = raw.startsWith("\uFEFF") ? "\uFEFF" : "";
+  return `${bom}${text2}${raw.endsWith("\n") ? crlf ? "\r\n" : "\n" : ""}`;
 }
 function updatePackageJson(cwd, notes) {
   const packagePath = path11.join(cwd, "package.json");
@@ -6531,7 +7058,7 @@ function updatePackageJson(cwd, notes) {
   let parsed;
   try {
     raw = fs10.readFileSync(packagePath, "utf8");
-    parsed = JSON.parse(raw);
+    parsed = parsePackageJson(raw);
   } catch {
     notes.push("Could not parse package.json; npm scripts and the devDependency were not added.");
     return unchanged;
@@ -6949,158 +7476,76 @@ function hasPriorSnapshot(cwd, outDir) {
   }
   if (parsed === null || typeof parsed !== "object") return false;
   return isOurGeneratorName(parsed.generator);
-}
-
-// src/index.ts
-import * as crypto4 from "crypto";
-import { AsyncLocalStorage } from "async_hooks";
-import * as fs14 from "fs";
-import * as os2 from "os";
-import * as path16 from "path";
-
-// src/ast/structured.ts
-function stripJsonComments2(content) {
-  const text2 = content.replace(/^\uFEFF/, "");
-  let out = "";
-  let inString = false;
-  let inLineComment = false;
-  let inBlockComment = false;
-  for (let i = 0; i < text2.length; i++) {
-    const char = text2[i];
-    const next = text2[i + 1];
-    if (inLineComment) {
-      if (char === "\n") {
-        inLineComment = false;
-        out += char;
-      }
-      continue;
-    }
-    if (inBlockComment) {
-      if (char === "*" && next === "/") {
-        inBlockComment = false;
-        i += 1;
-      }
-      continue;
-    }
-    if (inString) {
-      out += char;
-      if (char === "\\") {
-        if (next !== void 0) {
-          out += next;
-          i += 1;
-        }
-      } else if (char === '"') {
-        inString = false;
-      }
-      continue;
-    }
-    if (char === '"') {
-      inString = true;
-      out += char;
-      continue;
-    }
-    if (char === "/" && next === "/") {
-      inLineComment = true;
-      i += 1;
-      continue;
-    }
-    if (char === "/" && next === "*") {
-      inBlockComment = true;
-      i += 1;
-      continue;
-    }
-    out += char;
-  }
-  return out;
-}
-function summarizeJson(content) {
-  try {
-    const parsed = JSON.parse(stripJsonComments2(content));
-    if (Array.isArray(parsed)) {
-      const sample = parsed[0];
-      const sampleKeys = sample && typeof sample === "object" && !Array.isArray(sample) ? Object.keys(sample).slice(0, 10).sort() : [];
-      return {
-        shape: "array",
-        itemCount: parsed.length,
-        keys: [],
-        sampleKeys
-      };
-    }
-    if (parsed && typeof parsed === "object") {
-      const keys = Object.keys(parsed).sort();
-      return {
-        shape: "object",
-        itemCount: keys.length,
-        keys: keys.slice(0, 30),
-        sampleKeys: []
-      };
-    }
-    return {
-      shape: typeof parsed,
-      itemCount: null,
-      keys: [],
-      sampleKeys: []
-    };
-  } catch {
-    return {
-      shape: "invalid-json",
-      itemCount: null,
-      keys: [],
-      sampleKeys: []
-    };
-  }
-}
-function summarizeMarkdown(content) {
-  const headings = [];
-  const frontmatterKeys = [];
-  const lines = content.replace(/^\uFEFF/, "").split("\n");
-  let inFrontmatter = false;
-  let fence = null;
-  let closesFrontmatter = false;
-  for (let index = 1; index < lines.length; index++) {
-    if (lines[index].trim() === "---") {
-      closesFrontmatter = true;
-      break;
-    }
-  }
-  for (let index = 0; index < lines.length; index++) {
-    const line = lines[index];
-    if (index === 0 && line.trim() === "---" && closesFrontmatter) {
-      inFrontmatter = true;
-      continue;
-    }
-    if (inFrontmatter) {
-      if (line.trim() === "---") {
-        inFrontmatter = false;
-        continue;
+}
+
+// src/index.ts
+import * as crypto4 from "crypto";
+
+// src/stdout.ts
+import { AsyncLocalStorage } from "async_hooks";
+var hookStdoutScope = new AsyncLocalStorage();
+var captureScope = new AsyncLocalStorage();
+var installs = 0;
+var underlying = null;
+var router = null;
+var asText = (chunk) => typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+var callbackIn = (rest) => {
+  for (const argument of rest) {
+    if (typeof argument === "function") return argument;
+  }
+  return void 0;
+};
+function installStdoutRouter() {
+  if (installs === 0) {
+    underlying = process.stdout.write;
+    const realStdout = underlying.bind(process.stdout);
+    const realStderr = process.stderr.write.bind(process.stderr);
+    router = ((...args) => {
+      if (hookStdoutScope.getStore() === true) return realStderr(...args);
+      const capture = captureScope.getStore();
+      if (capture !== void 0) {
+        capture.write(asText(args[0]));
+        const callback = callbackIn(args.slice(1));
+        if (callback) callback(null);
+        return true;
       }
-      const match = /^([a-zA-Z0-9_-]+):/.exec(line);
-      if (match) frontmatterKeys.push(match[1]);
-      continue;
-    }
-    const trimmed = line.trim();
-    const fenceMatch = /^(`{3,}|~{3,})(.*)$/.exec(trimmed);
-    if (fenceMatch) {
-      const run = fenceMatch[1];
-      const rest = fenceMatch[2].trim();
-      if (fence === null) {
-        fence = { marker: run[0], length: run.length };
-      } else if (run[0] === fence.marker && run.length >= fence.length && rest === "") {
-        fence = null;
+      return realStdout(...args);
+    });
+    process.stdout.write = router;
+  }
+  installs += 1;
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    installs -= 1;
+    if (installs === 0) {
+      if (process.stdout.write === router && underlying !== null) {
+        process.stdout.write = underlying;
       }
-      continue;
+      underlying = null;
+      router = null;
     }
-    if (fence !== null) continue;
-    const headingMatch = /^(#{1,6})\s+(.+)$/.exec(trimmed);
-    if (headingMatch) {
-      headings.push(`${headingMatch[1]} ${headingMatch[2].trim()}`);
-    }
-  }
-  return {
-    headings: headings.slice(0, 40),
-    frontmatterKeys: Array.from(new Set(frontmatterKeys)).sort()
   };
 }
+async function runWithStdoutCapture(fn) {
+  let text2 = "";
+  const release = installStdoutRouter();
+  try {
+    const value = await captureScope.run(
+      { write: (chunk) => void (text2 += chunk) },
+      fn
+    );
+    return { value, text: text2 };
+  } finally {
+    release();
+  }
+}
+
+// src/index.ts
+import * as fs14 from "fs";
+import * as os2 from "os";
+import * as path16 from "path";
 
 // src/ast/skeleton.ts
 import ts2 from "typescript";
@@ -7109,25 +7554,36 @@ function hasCollapsibleBody(node) {
   const body = node.body;
   return body !== void 0 && ts2.isBlock(body);
 }
-function isTsxFileName(fileName) {
-  return fileName.toLowerCase().endsWith(".tsx");
+function scriptKindFor(fileName) {
+  const lower = fileName.toLowerCase();
+  if (lower.endsWith(".tsx")) return ts2.ScriptKind.TSX;
+  if (lower.endsWith(".jsx")) return ts2.ScriptKind.JSX;
+  if (lower.endsWith(".js") || lower.endsWith(".mjs") || lower.endsWith(".cjs")) {
+    return ts2.ScriptKind.JS;
+  }
+  return ts2.ScriptKind.TS;
 }
 function skeletonizeTypeScript(source, fileName = "file.ts") {
-  const scriptKind = isTsxFileName(fileName) ? ts2.ScriptKind.TSX : ts2.ScriptKind.TS;
   const sourceFile = ts2.createSourceFile(
     fileName,
     source,
     ts2.ScriptTarget.Latest,
-    true,
-    scriptKind
+    // `setParentNodes: false`. Nothing here reads `.parent` — the one `getStart` call is given the
+    // source file explicitly, which is the reason that argument exists. Asking for parent pointers
+    // makes the parser run a second full pass over every node in the file to set them, on top of
+    // the summary parse this same file already pays for.
+    false,
+    scriptKindFor(fileName)
   );
   const spans = [];
   const visit = (node) => {
     if ((ts2.isFunctionDeclaration(node) || ts2.isMethodDeclaration(node) || ts2.isConstructorDeclaration(node) || ts2.isGetAccessorDeclaration(node) || ts2.isSetAccessorDeclaration(node) || ts2.isFunctionExpression(node) || ts2.isArrowFunction(node)) && hasCollapsibleBody(node)) {
       const body = node.body;
-      const start = body.getStart(sourceFile);
-      const end = body.getEnd();
-      if (end > start) spans.push({ start, end });
+      if (body.statements.length > 0) {
+        const start = body.getStart(sourceFile);
+        const end = body.getEnd();
+        if (end > start) spans.push({ start, end });
+      }
     }
     ts2.forEachChild(node, visit);
   };
@@ -7139,16 +7595,21 @@ function skeletonizeTypeScript(source, fileName = "file.ts") {
     if (last && span.start < last.end) continue;
     outermost.push(span);
   }
-  let text2 = source;
-  for (let index = outermost.length - 1; index >= 0; index -= 1) {
-    const span = outermost[index];
-    text2 = `${text2.slice(0, span.start)}{ /* ... */ }${text2.slice(span.end)}`;
+  const chunks = [];
+  let cursor = 0;
+  for (const span of outermost) {
+    chunks.push(source.slice(cursor, span.start), "{ /* ... */ }");
+    cursor = span.end;
   }
-  return { text: text2, collapsed: outermost.length };
+  chunks.push(source.slice(cursor));
+  return { text: chunks.join(""), collapsed: outermost.length };
 }
 function isSkeletonizable(filePath) {
   const lower = filePath.toLowerCase();
-  return lower.endsWith(".ts") || lower.endsWith(".tsx") || lower.endsWith(".mts") || lower.endsWith(".cts");
+  if (lower.endsWith(".d.ts") || lower.endsWith(".d.mts") || lower.endsWith(".d.cts")) {
+    return false;
+  }
+  return lower.endsWith(".ts") || lower.endsWith(".tsx") || lower.endsWith(".mts") || lower.endsWith(".cts") || lower.endsWith(".js") || lower.endsWith(".jsx") || lower.endsWith(".mjs") || lower.endsWith(".cjs");
 }
 
 // src/generator/audit.ts
@@ -7422,23 +7883,55 @@ function truncateWithBudgetMarker(content, maxBytes, budget, originalLines) {
   };
 }
 function partitionFiles(files, maxPartBytes, contentFingerprint) {
-  if (files.length === 0) return [];
-  const budget = Math.max(MIN_SECTION_BUDGET_BYTES + HEADER_RESERVE_BYTES, maxPartBytes);
-  const sectionBudget = budget - HEADER_RESERVE_BYTES;
-  const prepared = files.map((file) => prepareSection(file, sectionBudget));
-  let groups = greedyGroups(prepared, budget);
+  return partitionFilesForBuckets([{ files, budgetBytes: maxPartBytes }], contentFingerprint);
+}
+function partitionFilesForBuckets(buckets, contentFingerprint) {
+  const groups = [];
+  for (const bucket of buckets) {
+    if (bucket.files.length === 0) continue;
+    const budget = Math.max(
+      MIN_SECTION_BUDGET_BYTES + HEADER_RESERVE_BYTES,
+      bucket.budgetBytes
+    );
+    const sectionBudget = budget - HEADER_RESERVE_BYTES;
+    const prepared = bucket.files.map((file) => prepareSection(file, sectionBudget));
+    for (const sections of greedyGroups(prepared, budget)) groups.push({ sections, budget });
+  }
+  if (groups.length === 0) return [];
+  const measurements = /* @__PURE__ */ new Map();
+  const widthOf = (total) => Math.max(3, String(total).length);
+  const measure = (group, index, total) => {
+    const cached = measurements.get(group);
+    const width = widthOf(total);
+    if (cached !== void 0 && cached.index === index && cached.width === width) {
+      return cached.size;
+    }
+    const { content } = assembleGroup(group, index, total, contentFingerprint);
+    const size2 = Buffer.byteLength(content, "utf8");
+    measurements.set(group, { index, width, size: size2 });
+    return size2;
+  };
   for (let pass = 0; pass < MAX_SPLIT_PASSES; pass++) {
-    const rendered = renderGroups(groups, budget, contentFingerprint);
-    const oversized = rendered.findIndex((part) => part.metadata.byteSize > budget);
-    if (oversized === -1) return rendered;
+    const total = groups.length;
+    let oversized = -1;
+    for (let index = 0; index < total; index += 1) {
+      const group2 = groups[index];
+      if (measure(group2, index, total) > group2.budget) {
+        oversized = index;
+        break;
+      }
+    }
+    if (oversized === -1) return renderGroups(groups, contentFingerprint);
     const group = groups[oversized];
-    if (group.length > 1) {
-      const moved = group.pop();
-      groups.splice(oversized + 1, 0, [moved]);
+    if (group.sections.length > 1) {
+      const moved = group.sections.pop();
+      groups.splice(oversized + 1, 0, { sections: [moved], budget: group.budget });
+      measurements.delete(group);
       continue;
     }
-    const [section] = group;
-    const overflow = rendered[oversized].metadata.byteSize - budget;
+    const [section] = group.sections;
+    if (section === void 0) return renderGroups(groups, contentFingerprint);
+    const overflow = measure(group, oversized, total) - group.budget;
     const currentContent = section.file.content ?? "";
     const shrinkTo = Math.max(
       0,
@@ -7447,26 +7940,33 @@ function partitionFiles(files, maxPartBytes, contentFingerprint) {
     const shrunk = truncateWithBudgetMarker(
       currentContent,
       shrinkTo,
-      budget,
+      group.budget,
       section.file.originalLines
     );
     if (shrunk.isTruncated) {
       applyTruncatedContent(section.file, shrunk.content);
       section.text = renderFileSection(section.file);
       section.byteSize = Buffer.byteLength(section.text, "utf8");
+      measurements.delete(group);
       continue;
     }
+    const rendered = renderGroups(groups, contentFingerprint);
     const marker2 = TRUNCATION_MARKER;
-    assertBudgetHoldsMarker(budget);
+    assertBudgetHoldsMarker(group.budget);
     const target = Math.max(
       0,
-      budget - Buffer.byteLength(marker2, "utf8") - TOKEN_LINE_SLACK
+      group.budget - Buffer.byteLength(marker2, "utf8") - TOKEN_LINE_SLACK
     );
     const clipped = truncateToBytes(rendered[oversized].markdown, target);
-    rendered[oversized] = rehashPart(rendered[oversized], clipped.content + marker2);
+    rendered[oversized] = rehashPart(
+      rendered[oversized],
+      clipped.content + marker2
+    );
     return rendered;
   }
-  return enforceBudget(renderGroups(groups, budget, contentFingerprint), budget);
+  return renderGroups(groups, contentFingerprint).flatMap(
+    (part) => enforceBudget([part], part.metadata.budgetBytes)
+  );
 }
 var TRUNCATION_MARKER = "\n... [part truncated: cannot fit budget] ...\n";
 function assertBudgetHoldsMarker(budget) {
@@ -7489,69 +7989,7 @@ function enforceBudget(parts, budget) {
     return rehashPart(part, clipped.content + TRUNCATION_MARKER);
   });
 }
-function renumberParts(parts, contentFingerprint) {
-  const total = parts.length;
-  if (total === 0) return [];
-  const zeroPad = (index) => String(index).padStart(Math.max(3, String(total).length), "0");
-  const nameFor = (position) => `part-${zeroPad(position)}.md`;
-  const marker2 = "## Contents\n";
-  const renumbered = parts.map((part, index) => {
-    const markerIndex = part.markdown.indexOf(marker2);
-    const body = markerIndex === -1 ? "" : part.markdown.slice(markerIndex + marker2.length);
-    const included = part.metadata.includedFiles;
-    if (markerIndex === -1) {
-      throw new Error(`${part.filename} has no "## Contents" section to re-number.`);
-    }
-    const layerCounts = {};
-    const kindCounts = {};
-    for (const file of included) {
-      layerCounts[file.layer] = (layerCounts[file.layer] || 0) + 1;
-      kindCounts[file.kind] = (kindCounts[file.kind] || 0) + 1;
-    }
-    const pathLines = included.map((file) => displayPath(file.relativePath));
-    const listFence = fenceForText(pathLines.join("\n"), 3);
-    const header = [
-      `# Codebase Snapshot Part ${zeroPad(index + 1)} of ${zeroPad(total)}`,
-      "",
-      `- Previous: ${index === 0 ? "none" : nameFor(index)}`,
-      `- Next: ${index === total - 1 ? "none" : nameFor(index + 2)}`,
-      `- Files: ${included.length}`,
-      `- Content Fingerprint: ${contentFingerprint || "none"}`,
-      `- Layers: ${topEntries(layerCounts, 6) || "none"}`,
-      `- Kinds: ${topEntries(kindCounts, 8) || "none"}`,
-      "",
-      UNTRUSTED_CONTENT_NOTICE,
-      "",
-      "## Files",
-      "",
-      `${listFence}text`,
-      ...pathLines,
-      listFence,
-      "",
-      "## Contents",
-      ""
-    ].join("\n");
-    const assembled = (header + body).replace(/\r\n/g, "\n");
-    const estimatedTokens = estimateTokens(assembled);
-    const markdown = insertTokenLine(assembled, estimatedTokens);
-    const metadata = {
-      ...part.metadata,
-      index: index + 1,
-      filename: nameFor(index + 1),
-      byteSize: Buffer.byteLength(markdown, "utf8"),
-      estimatedTokens,
-      sha256: crypto3.createHash("sha256").update(markdown).digest("hex"),
-      lines: countLines(markdown),
-      fileCount: included.length,
-      layersCovered: Object.keys(layerCounts).sort()
-    };
-    return { filename: metadata.filename, markdown, metadata };
-  });
-  return renumbered.map(
-    (part) => enforceBudget([part], part.metadata.budgetBytes)[0] ?? part
-  );
-}
-var SECTION_TRUNCATION_NOTICE = "\n... [section truncated: metadata alone exceeds the part budget] ...\n";
+var SECTION_TRUNCATION_NOTICE = "... [section truncated: the fixed metadata and a code fence did not fit the part budget] ...";
 var METADATA_VALUE_MAX = 200;
 var DISPLAY_PATH_MAX = 300;
 function capValue(value, max) {
@@ -7593,13 +8031,57 @@ function prepareSection(file, sectionBudget) {
     shrinkBody();
   }
   if (byteSize > sectionBudget) {
-    const target = sectionBudget - Buffer.byteLength(SECTION_TRUNCATION_NOTICE, "utf8");
-    const truncated = truncateToBytes(text2, Math.max(0, target));
-    text2 = truncated.content + SECTION_TRUNCATION_NOTICE;
+    applyTruncatedContent(file, SECTION_TRUNCATION_NOTICE);
+    file.summary = void 0;
+    file.summaryOmitted = true;
+    text2 = renderFileSection(file);
     byteSize = Buffer.byteLength(text2, "utf8");
+    if (byteSize > sectionBudget) {
+      text2 = truncateRenderedSection(text2, sectionBudget, fenceForContent(file.content ?? ""));
+      byteSize = Buffer.byteLength(text2, "utf8");
+    }
   }
   return { file, text: text2, byteSize };
 }
+function truncateRenderedSection(text2, sectionBudget, fence) {
+  const closing = `
+${SECTION_TRUNCATION_NOTICE}
+${fence}
+`;
+  const bodyRoom = sectionBudget - Buffer.byteLength(closing, "utf8");
+  if (bodyRoom > 0) {
+    const cut2 = truncateToBytes(text2, bodyRoom).content;
+    const lastBreak2 = cut2.lastIndexOf("\n");
+    const kept = lastBreak2 >= 0 ? cut2.slice(0, lastBreak2 + 1) : "";
+    if (fenceIsOpen(kept, fence)) return `${kept}${closing}`;
+  }
+  const probe = text2.slice(0, 512);
+  const emptyFence = fenceForText(probe.slice(0, Math.max(0, probe.lastIndexOf("\n") + 1)), 4);
+  const block = `
+${emptyFence}
+${SECTION_TRUNCATION_NOTICE}
+${emptyFence}
+`;
+  const prefixRoom = sectionBudget - Buffer.byteLength(block, "utf8");
+  const cut = prefixRoom > 0 ? truncateToBytes(text2, prefixRoom).content : "";
+  const lastBreak = cut.lastIndexOf("\n");
+  const prefix = lastBreak >= 0 ? cut.slice(0, lastBreak + 1) : "";
+  return `${dropTrailingOpenFence(prefix, fence)}${block}`;
+}
+function dropTrailingOpenFence(text2, fence) {
+  if (!fenceIsOpen(text2, fence)) return text2;
+  const lines = text2.split("\n");
+  const opening = lines.findIndex((line) => line.startsWith(fence));
+  if (opening < 0) return text2;
+  return lines.slice(0, opening).join("\n") + (opening > 0 ? "\n" : "");
+}
+function fenceIsOpen(text2, fence) {
+  let open = false;
+  for (const line of text2.split("\n")) {
+    if (line.startsWith(fence)) open = !open;
+  }
+  return open;
+}
 function applyTruncatedContent(file, content) {
   file.content = content;
   file.isPreviewTruncated = true;
@@ -7647,52 +8129,64 @@ function greedyGroups(sections, budget) {
   if (current.length > 0) groups.push(current);
   return groups;
 }
-function renderGroups(groups, budget, contentFingerprint) {
+function assembleGroup(group, index, total, contentFingerprint) {
+  const width = Math.max(3, String(total).length);
+  const zeroPad = (value) => String(value).padStart(width, "0");
+  const filename = `part-${zeroPad(index + 1)}.md`;
+  const prev = index === 0 ? "none" : `part-${zeroPad(index)}.md`;
+  const next = index === total - 1 ? "none" : `part-${zeroPad(index + 2)}.md`;
+  for (const section of group.sections) {
+    section.file.part = filename;
+  }
+  const layerCounts = {};
+  const kindCounts = {};
+  for (const section of group.sections) {
+    layerCounts[section.file.layer] = (layerCounts[section.file.layer] || 0) + 1;
+    kindCounts[section.file.kind] = (kindCounts[section.file.kind] || 0) + 1;
+  }
+  const pathLines = group.sections.map((s) => displayPath(s.file.relativePath));
+  const listFence = fenceForText(pathLines.join("\n"), 3);
+  const header = [
+    `# Codebase Snapshot Part ${zeroPad(index + 1)} of ${zeroPad(total)}`,
+    "",
+    `- Previous: ${prev}`,
+    `- Next: ${next}`,
+    `- Files: ${group.sections.length}`,
+    `- Content Fingerprint: ${contentFingerprint || "none"}`,
+    `- Layers: ${topEntries(layerCounts, 6) || "none"}`,
+    `- Kinds: ${topEntries(kindCounts, 8) || "none"}`,
+    "",
+    UNTRUSTED_CONTENT_NOTICE,
+    "",
+    "## Files",
+    "",
+    `${listFence}text`,
+    ...pathLines,
+    listFence,
+    "",
+    "## Contents",
+    ""
+  ].join("\n");
+  const assembled = (header + group.sections.map((s) => s.text).join("")).replace(
+    /\r\n|\r/g,
+    "\n"
+  );
+  const estimatedTokens = estimateTokens(assembled);
+  return { filename, content: insertTokenLine(assembled, estimatedTokens), estimatedTokens };
+}
+function renderGroups(groups, contentFingerprint) {
   const total = groups.length;
-  const zeroPad = (index) => String(index).padStart(Math.max(3, String(total).length), "0");
   return groups.map((group, index) => {
-    const filename = `part-${zeroPad(index + 1)}.md`;
-    const prev = index === 0 ? "none" : `part-${zeroPad(index)}.md`;
-    const next = index === total - 1 ? "none" : `part-${zeroPad(index + 2)}.md`;
-    for (const section of group) {
-      section.file.part = filename;
-    }
-    const layersCovered = Array.from(new Set(group.map((s) => s.file.layer))).sort();
-    const layerCounts = {};
-    const kindCounts = {};
-    for (const section of group) {
-      layerCounts[section.file.layer] = (layerCounts[section.file.layer] || 0) + 1;
-      kindCounts[section.file.kind] = (kindCounts[section.file.kind] || 0) + 1;
-    }
-    const pathLines = group.map((s) => displayPath(s.file.relativePath));
-    const listFence = fenceForText(pathLines.join("\n"), 3);
-    const header = [
-      `# Codebase Snapshot Part ${zeroPad(index + 1)} of ${zeroPad(total)}`,
-      "",
-      `- Previous: ${prev}`,
-      `- Next: ${next}`,
-      `- Files: ${group.length}`,
-      `- Content Fingerprint: ${contentFingerprint || "none"}`,
-      `- Layers: ${topEntries(layerCounts, 6) || "none"}`,
-      `- Kinds: ${topEntries(kindCounts, 8) || "none"}`,
-      "",
-      UNTRUSTED_CONTENT_NOTICE,
-      "",
-      "## Files",
-      "",
-      `${listFence}text`,
-      ...pathLines,
-      listFence,
-      "",
-      "## Contents",
-      ""
-    ].join("\n");
-    const assembled = (header + group.map((s) => s.text).join("")).replace(/\r\n/g, "\n");
-    const estimatedTokens = estimateTokens(assembled);
-    const content = insertTokenLine(assembled, estimatedTokens);
+    const { filename, content, estimatedTokens } = assembleGroup(
+      group,
+      index,
+      total,
+      contentFingerprint
+    );
     const byteSize = Buffer.byteLength(content, "utf8");
     const sha256 = crypto3.createHash("sha256").update(content).digest("hex");
-    const includedFiles = group.map(({ file }) => ({
+    const layersCovered = Array.from(new Set(group.sections.map((s) => s.file.layer))).sort();
+    const includedFiles = group.sections.map(({ file }) => ({
       relativePath: file.relativePath,
       sourceBytes: file.sizeBytes,
       includedBytes: file.includedBytes,
@@ -7705,10 +8199,10 @@ function renderGroups(groups, budget, contentFingerprint) {
       filename,
       byteSize,
       estimatedTokens,
-      budgetBytes: budget,
+      budgetBytes: group.budget,
       sha256,
       lines: countLines(content),
-      fileCount: group.length,
+      fileCount: group.sections.length,
       layersCovered,
       includedFiles
     };
@@ -7716,7 +8210,7 @@ function renderGroups(groups, budget, contentFingerprint) {
   });
 }
 function emittedBody(content) {
-  const normalised = content.replace(/\r\n/g, "\n");
+  const normalised = content.replace(/\r\n|\r/g, "\n");
   return normalised.endsWith("\n") ? normalised.slice(0, -1) : normalised;
 }
 function compactMetadata(file) {
@@ -7784,7 +8278,7 @@ function generateMonolithJson(manifest, filesWithContent) {
 }
 function generateMonolithMarkdown(manifest, filesWithContent) {
   const sections = filesWithContent.map((file) => {
-    const content = (file.content ?? "").replace(/\r\n/g, "\n");
+    const content = (file.content ?? "").replace(/\r\n|\r/g, "\n");
     const fence = fenceForContent(content);
     return [
       `## File: ${escapeControls(file.relativePath)}`,
@@ -8026,6 +8520,7 @@ function generateProjectTree(filePaths) {
 
 // src/update-check.ts
 import * as fs12 from "fs";
+import * as http from "http";
 import * as https from "https";
 import * as os from "os";
 import * as path13 from "path";
@@ -8050,22 +8545,28 @@ function updateCommand(kind) {
   if (kind === "local") return "npm install codebase-snapshot@latest";
   return "npm install -g codebase-snapshot";
 }
-function versionParts(value) {
-  const core = value.trim().replace(/^v/i, "").split("-")[0];
-  return core.split(".").map((part) => {
+function parseSemver(value) {
+  const cleaned = value.trim().replace(/^v/i, "").split("+")[0] ?? "";
+  const dash = cleaned.indexOf("-");
+  const corePart = dash === -1 ? cleaned : cleaned.slice(0, dash);
+  const prerelease = dash === -1 ? null : cleaned.slice(dash + 1);
+  const core = corePart.split(".").map((part) => {
     const parsed = Number(part);
     return Number.isFinite(parsed) ? parsed : 0;
   });
+  return { core, prerelease };
 }
 function isNewer(candidate, current) {
-  const left = versionParts(candidate);
-  const right = versionParts(current);
-  const length = Math.max(left.length, right.length);
+  const left = parseSemver(candidate);
+  const right = parseSemver(current);
+  if (left.prerelease !== null && right.prerelease === null) return false;
+  const length = Math.max(left.core.length, right.core.length);
   for (let index = 0; index < length; index += 1) {
-    const a = left[index] ?? 0;
-    const b = right[index] ?? 0;
+    const a = left.core[index] ?? 0;
+    const b = right.core[index] ?? 0;
     if (a !== b) return a > b;
   }
+  if (left.prerelease === null && right.prerelease !== null) return true;
   return false;
 }
 function cacheDirectory(env = process.env, platform = process.platform) {
@@ -8133,14 +8634,22 @@ function writeCache(file, entry) {
   }
 }
 function fetchLatestVersion(url = PACKAGE_LATEST_URL, timeoutMs = REQUEST_TIMEOUT_MS) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let settled = false;
+    let request = null;
     const finish = (value) => {
       if (settled) return;
       settled = true;
-      resolve9(value);
+      clearTimeout(deadline);
+      resolve10(value);
     };
-    const request = https.get(
+    const deadline = setTimeout(() => {
+      request?.destroy();
+      finish(null);
+    }, timeoutMs);
+    deadline.unref();
+    const transport = url.startsWith("http:") ? http : https;
+    request = transport.get(
       url,
       {
         headers: {
@@ -8159,7 +8668,7 @@ function fetchLatestVersion(url = PACKAGE_LATEST_URL, timeoutMs = REQUEST_TIMEOU
         response.on("data", (chunk) => {
           body += chunk;
           if (body.length > 64 * 1024) {
-            request.destroy();
+            request?.destroy();
             finish(null);
           }
         });
@@ -8174,10 +8683,6 @@ function fetchLatestVersion(url = PACKAGE_LATEST_URL, timeoutMs = REQUEST_TIMEOU
       }
     );
     request.on("error", () => finish(null));
-    request.setTimeout(timeoutMs, () => {
-      request.destroy();
-      finish(null);
-    });
   });
 }
 async function checkForUpdate(options) {
@@ -8345,7 +8850,10 @@ const { parentPort, workerData } = require("node:worker_threads");
       parentPort.postMessage({ ok: false, message: loaded.errors.join("; ") });
       return;
     }
-    const config = mod.resolveConfig(loaded.config, workerData.cliOptions, workerData.cwd);
+    // \`hooks: {}\` is a value, not an absence: the config is applied with the hook list emptied,
+    // so the run is the documented MCP run rather than the CLI run with one setting removed.
+    const base = loaded.config ? { ...loaded.config, hooks: {} } : null;
+    const config = mod.resolveConfig(base, workerData.cliOptions, workerData.cwd);
     const manifest = mod.generateSnapshot(config);
     parentPort.postMessage({
       ok: true,
@@ -8368,14 +8876,15 @@ const { parentPort, workerData } = require("node:worker_threads");
 })();
 `;
 function generateInWorker(cwd, cliOptions) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let settled = false;
+    let worker = null;
     const finish = (result) => {
       if (settled) return;
       settled = true;
-      resolve9(result);
+      if (worker !== null) void worker.terminate();
+      resolve10(result);
     };
-    let worker;
     const isCjs = typeof __dirname !== "undefined";
     const directory = isCjs ? __dirname : path15.dirname(fileURLToPath(import.meta.url));
     try {
@@ -8408,7 +8917,100 @@ function generateInWorker(cwd, cliOptions) {
 
 // src/index.ts
 var SCHEMA_VERSION = "3.0.0";
-var SUMMARY_MAX_SOURCE_BYTES = 2 * 1024 * 1024;
+var SUMMARY_MAX_SOURCE_BYTES2 = SUMMARY_MAX_SOURCE_BYTES;
+var FILE_DERIVATIONS = /* @__PURE__ */ new Map();
+var FILE_DERIVATION_LIMIT_BYTES = 64 * 1024 * 1024;
+var fileDerivationBytes = 0;
+function takeDerivation(path22, hash, settings) {
+  const cached = FILE_DERIVATIONS.get(path22);
+  if (cached === void 0 || cached.hash !== hash || cached.settings !== settings) return void 0;
+  return cached;
+}
+function rememberDerivation(path22, hash, settings, derivation) {
+  const bodyBytes = derivation.finalContent === derivation.redacted ? derivation.redacted.length : derivation.redacted.length + derivation.finalContent.length;
+  const bytes = bodyBytes * 2 + 512;
+  if (bytes > FILE_DERIVATION_LIMIT_BYTES / 4) return;
+  while (fileDerivationBytes + bytes > FILE_DERIVATION_LIMIT_BYTES) {
+    const oldest = FILE_DERIVATIONS.keys().next();
+    if (oldest.done === true) break;
+    const evicted = FILE_DERIVATIONS.get(oldest.value);
+    FILE_DERIVATIONS.delete(oldest.value);
+    if (evicted !== void 0) fileDerivationBytes -= evicted.bytes;
+  }
+  FILE_DERIVATIONS.set(path22, { ...derivation, hash, settings, bytes });
+  fileDerivationBytes += bytes;
+}
+function derivationSettings(config) {
+  const rules = config.secretRules.map(
+    (rule) => `${rule.rule}\0${rule.pattern.source}\0${rule.pattern.flags}\0${rule.valueGroup ?? ""}`
+  ).join("
");
+  return `${GENERATOR_VERSION}${configDigest(config)}${sha256Hex2(rules)}`;
+}
+function deriveFile(relativePath, rawContent, sizeBytes, config) {
+  const lineCount = countLines(rawContent);
+  const { redacted, findings } = scanAndRedactSecrets(rawContent, config.secretRules, relativePath);
+  const isLarge = sizeBytes > config.largeFileBytes;
+  let finalContent = redacted;
+  let isPreviewTruncated = false;
+  let includedLines = lineCount;
+  let inclusionMode = "full";
+  if (config.skeleton === true && isSkeletonizable(relativePath)) {
+    const skeleton = skeletonizeTypeScript(redacted, relativePath);
+    if (skeleton.collapsed > 0) {
+      finalContent = skeleton.text;
+      inclusionMode = "signatures";
+      includedLines = countLines(skeleton.text);
+    }
+  }
+  if (isLarge && inclusionMode !== "signatures") {
+    const preview = truncatePreview(redacted, config.previewHeadLines, config.previewTailLines);
+    finalContent = preview.content;
+    isPreviewTruncated = preview.isTruncated;
+    includedLines = preview.includedLines;
+    inclusionMode = isPreviewTruncated ? "preview" : "full";
+  }
+  let summary;
+  let summaryQuality;
+  let summarySkip = null;
+  let summaryWarning = null;
+  let dependentImports = null;
+  if (Buffer.byteLength(rawContent, "utf8") > SUMMARY_MAX_SOURCE_BYTES2) {
+    summarySkip = "oversize";
+    dependentImports = [];
+  } else if (SKIP_PREVIEW_SUMMARIES && isPreviewTruncated && hasStructuralSummary(relativePath)) {
+    summarySkip = "preview";
+    dependentImports = importsOfText(relativePath, rawContent);
+  } else {
+    try {
+      const outcome = summarizeFile(relativePath, rawContent);
+      summary = outcome?.summary ? maskSummaryStrings(outcome.summary, config.secretRules) : void 0;
+      summaryQuality = outcome?.quality;
+      if (isSourceSummary(summary) && summary.parseErrors) {
+        summaryWarning = `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`;
+      }
+    } catch (err) {
+      summaryWarning = `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(
+        /\s+/g,
+        " "
+      );
+    }
+  }
+  return {
+    redacted,
+    findings,
+    lineCount,
+    finalContent,
+    inclusionMode,
+    isPreviewTruncated,
+    includedLines,
+    isLarge,
+    summary,
+    summaryQuality,
+    summarySkip,
+    summaryWarning,
+    dependentImports
+  };
+}
 function sha256Hex2(input) {
   return crypto4.createHash("sha256").update(input).digest("hex");
 }
@@ -8953,10 +9555,7 @@ function acquireRunLock(stagingRoot) {
       };
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
-      if (attempt === 0 && lockOwnerIsGone(lockPath)) {
-        fs14.rmSync(lockPath, { force: true });
-        continue;
-      }
+      if (attempt === 0 && reclaimStaleLock(lockPath)) continue;
       throw new Error(
         `Another generate run is already using the staging directory ${stagingRoot}. Wait for it to finish, or delete ${lockPath} if no other run is active.`
       );
@@ -8965,14 +9564,25 @@ function acquireRunLock(stagingRoot) {
   throw new Error(`Could not acquire the generate lock for ${stagingRoot}.`);
 }
 function lockKeyFor(stagingRoot) {
-  let key = stagingRoot;
-  try {
-    key = fs14.realpathSync(stagingRoot);
-  } catch {
-  }
+  let key = canonicalLockTarget(stagingRoot);
   if (process.platform === "win32" || process.platform === "darwin") key = key.toLowerCase();
   return sha256Hex2(key).slice(0, 16);
 }
+function canonicalLockTarget(targetPath2) {
+  const resolved = path16.resolve(targetPath2);
+  let existing = resolved;
+  const tail = [];
+  for (; ; ) {
+    try {
+      return path16.join(fs14.realpathSync(existing), ...tail);
+    } catch {
+      const parent = path16.dirname(existing);
+      if (parent === existing) return resolved;
+      tail.unshift(path16.basename(existing));
+      existing = parent;
+    }
+  }
+}
 function lockPathFor(stagingRoot) {
   return path16.join(os2.tmpdir(), `codebase-snapshot-${lockKeyFor(stagingRoot)}.lock`);
 }
@@ -8997,6 +9607,24 @@ function lockOwnerIsGone(lockPath) {
     return err.code === "ESRCH";
   }
 }
+function reclaimStaleLock(lockPath) {
+  let before;
+  try {
+    before = fs14.statSync(lockPath);
+  } catch {
+    return true;
+  }
+  if (!lockOwnerIsGone(lockPath)) return false;
+  try {
+    const current = fs14.statSync(lockPath);
+    const sameFile = current.ino === before.ino && current.birthtimeMs === before.birthtimeMs && current.mtimeMs === before.mtimeMs;
+    if (!sameFile) return false;
+    fs14.rmSync(lockPath, { force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function lockFileIsAncient(lockPath) {
   try {
     return Date.now() - fs14.statSync(lockPath).mtimeMs > STALE_RUN_MS;
@@ -9054,7 +9682,6 @@ function swapOnce(stagingDir, outDir) {
         throw copyErr;
       }
     }
-    if (hadPrevious) fs14.rmSync(backupDir, { recursive: true, force: true });
   } catch (err) {
     if (hadPrevious && fs14.existsSync(backupDir)) {
       if (fs14.existsSync(outDir)) fs14.rmSync(outDir, { recursive: true, force: true });
@@ -9062,6 +9689,16 @@ function swapOnce(stagingDir, outDir) {
     }
     throw err;
   }
+  if (hadPrevious) {
+    try {
+      fs14.rmSync(backupDir, { recursive: true, force: true });
+    } catch (err) {
+      process.stderr.write(
+        `\u26A0 The previous snapshot could not be removed from ${backupDir} (${err.message}). The new snapshot is in place; delete that directory by hand when convenient.
+`
+      );
+    }
+  }
 }
 function sleepSync(milliseconds) {
   const buffer = new Int32Array(new SharedArrayBuffer(4));
@@ -9084,22 +9721,18 @@ function artifactWarnings(artifacts, sarif) {
   }
   return messages;
 }
+function installHookStdoutRedirect() {
+  return installStdoutRouter();
+}
 function runAfterGenerate(config, manifest) {
   const hook = config.hooks.afterGenerate;
   if (!hook) return null;
-  const stdoutWrite = process.stdout.write.bind(process.stdout);
-  const stderrWrite = process.stderr.write.bind(process.stderr);
-  const hookScope = new AsyncLocalStorage();
-  const patchedWrite = ((...args) => hookScope.getStore() === true ? stderrWrite(...args) : stdoutWrite(...args));
-  const restoreStdout = () => {
-    if (process.stdout.write === patchedWrite) process.stdout.write = stdoutWrite;
-  };
+  const releaseRedirect = installHookStdoutRedirect();
   let returned;
   try {
-    process.stdout.write = patchedWrite;
-    returned = hookScope.run(true, () => hook(manifest));
+    returned = hookStdoutScope.run(true, () => hook(manifest));
   } catch (err) {
-    restoreStdout();
+    releaseRedirect();
     const message = maskPathText(err.message, config.secretRules);
     manifest.warnings.push(`hooks.afterGenerate failed: ${message}`);
     manifest.totals.warningCount = manifest.warnings.length;
@@ -9107,10 +9740,10 @@ function runAfterGenerate(config, manifest) {
   }
   const thenable = returned;
   if (!thenable || typeof thenable.then !== "function") {
-    restoreStdout();
+    releaseRedirect();
     return null;
   }
-  return Promise.resolve(returned).finally(restoreStdout);
+  return Promise.resolve(returned).finally(releaseRedirect);
 }
 function partitionByBudget(files, config, fingerprint) {
   const budgetFor = (file) => config.budgets.byLayer[file.layer] ?? config.budgets.default;
@@ -9121,23 +9754,14 @@ function partitionByBudget(files, config, fingerprint) {
     if (bucket) bucket.push(file);
     else buckets.set(budget, [file]);
   }
-  if (buckets.size <= 1) {
-    const only = buckets.size === 1 ? Array.from(buckets.keys())[0] : config.maxPartBytes;
-    return partitionFiles(files, only, fingerprint);
+  if (buckets.size === 0) return [];
+  if (buckets.size === 1) {
+    return partitionFiles(files, Array.from(buckets.keys())[0], fingerprint);
   }
-  const parts = [];
-  for (const budget of Array.from(buckets.keys()).sort((a, b) => a - b)) {
-    parts.push(...partitionFiles(buckets.get(budget) ?? [], budget, fingerprint));
-  }
-  const merged = renumberParts(parts, fingerprint);
-  const byPath = new Map(files.map((file) => [file.relativePath, file]));
-  for (const part of merged) {
-    for (const included of part.metadata.includedFiles) {
-      const file = byPath.get(included.relativePath);
-      if (file) file.part = part.filename;
-    }
-  }
-  return merged;
+  return partitionFilesForBuckets(
+    Array.from(buckets.entries()).sort(([left], [right]) => left - right).map(([budgetBytes, bucketFiles]) => ({ files: bucketFiles, budgetBytes })),
+    fingerprint
+  );
 }
 function generateSnapshot(configInput, options) {
   assertUsableConfigInput(configInput);
@@ -9169,6 +9793,7 @@ function generateSnapshot(configInput, options) {
     return false;
   }) : collection.files;
   const files = [];
+  const derivationKey = derivationSettings(config);
   const monolithBodies = /* @__PURE__ */ new Map();
   const skipped = maskSkipRecords([...collection.skipped], config.secretRules);
   const secretFindings = [];
@@ -9181,6 +9806,7 @@ function generateSnapshot(configInput, options) {
   const fileWarnings = [];
   const oversizeSummaryPaths = [];
   const previewSummaryPaths = [];
+  const skippedSummaryImports = /* @__PURE__ */ new Map();
   const layerCounts = {};
   const kindCounts = {};
   let totalLines = 0;
@@ -9245,8 +9871,6 @@ function generateSnapshot(configInput, options) {
     }
     const hashSha256 = sha256Hex2(buffer);
     const rawContent = decoded.text;
-    const lineCount = countLines(rawContent);
-    totalLines += lineCount;
     totalSizeBytes += stats.size;
     if (decoded.encoding !== "utf-8") {
       encodingNotes.push({
@@ -9260,66 +9884,25 @@ function generateSnapshot(configInput, options) {
     const language = detectLanguage(relativePath);
     bump(layerCounts, layer2);
     bump(kindCounts, kind);
-    const { redacted, findings } = scanAndRedactSecrets(
-      rawContent,
-      config.secretRules,
-      relativePath
-    );
-    secretFindings.push(...findings);
-    const isLarge = stats.size > config.largeFileBytes;
-    if (isLarge) largeFileCount += 1;
-    let finalContent = redacted;
-    let isPreviewTruncated = false;
-    let includedLines = lineCount;
-    let inclusionMode = "full";
-    if (config.skeleton === true && isSkeletonizable(relativePath)) {
-      const skeleton = skeletonizeTypeScript(redacted, relativePath);
-      if (skeleton.collapsed > 0) {
-        finalContent = skeleton.text;
-        inclusionMode = "signatures";
-        includedLines = countLines(skeleton.text);
-      }
-    }
-    if (isLarge && inclusionMode !== "signatures") {
-      const preview = truncatePreview(
-        redacted,
-        config.previewHeadLines,
-        config.previewTailLines
-      );
-      finalContent = preview.content;
-      isPreviewTruncated = preview.isTruncated;
-      includedLines = preview.includedLines;
-      inclusionMode = isPreviewTruncated ? "preview" : "full";
-    }
-    if (config.includeMonolith && (isPreviewTruncated || inclusionMode === "signatures")) {
-      monolithBodies.set(relativePath, redacted);
-    }
-    let summary;
-    let summaryQuality;
-    if (Buffer.byteLength(rawContent, "utf8") > SUMMARY_MAX_SOURCE_BYTES) {
-      oversizeSummaryPaths.push(relativePath);
-    } else if (SKIP_PREVIEW_SUMMARIES && isPreviewTruncated && hasStructuralSummary(relativePath)) {
-      previewSummaryPaths.push(relativePath);
-    } else {
-      try {
-        const outcome = summarizeFile(relativePath, rawContent);
-        summary = outcome?.summary ? maskSummaryStrings(outcome.summary, config.secretRules) : void 0;
-        summaryQuality = outcome?.quality;
-        if (isSourceSummary(summary) && summary.parseErrors) {
-          fileWarnings.push({
-            path: relativePath,
-            message: `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`
-          });
-        }
-      } catch (err) {
-        fileWarnings.push({
-          path: relativePath,
-          message: `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(
-            /\s+/g,
-            " "
-          )
-        });
-      }
+    const derivation = takeDerivation(absolutePath, hashSha256, derivationKey) ?? (() => {
+      const fresh = deriveFile(relativePath, rawContent, stats.size, config);
+      rememberDerivation(absolutePath, hashSha256, derivationKey, fresh);
+      return fresh;
+    })();
+    const { lineCount } = derivation;
+    totalLines += lineCount;
+    secretFindings.push(...derivation.findings);
+    if (derivation.isLarge) largeFileCount += 1;
+    if (derivation.summarySkip === "oversize") oversizeSummaryPaths.push(relativePath);
+    else if (derivation.summarySkip === "preview") previewSummaryPaths.push(relativePath);
+    if (derivation.dependentImports !== null) {
+      skippedSummaryImports.set(relativePath, derivation.dependentImports);
+    }
+    if (derivation.summaryWarning !== null) {
+      fileWarnings.push({ path: relativePath, message: derivation.summaryWarning });
+    }
+    if (config.includeMonolith && (derivation.isPreviewTruncated || derivation.inclusionMode === "signatures")) {
+      monolithBodies.set(relativePath, derivation.redacted);
     }
     files.push({
       relativePath,
@@ -9330,24 +9913,25 @@ function generateSnapshot(configInput, options) {
       layer: layer2,
       kind,
       language,
-      inclusionMode,
-      isLarge,
-      isPreviewTruncated,
+      inclusionMode: derivation.inclusionMode,
+      isLarge: derivation.isLarge,
+      isPreviewTruncated: derivation.isPreviewTruncated,
       originalLines: lineCount,
-      includedLines,
-      includedBytes: Buffer.byteLength(finalContent, "utf8"),
-      summary,
-      summaryQuality,
+      includedLines: derivation.includedLines,
+      includedBytes: Buffer.byteLength(derivation.finalContent, "utf8"),
+      summary: derivation.summary,
+      summaryQuality: derivation.summaryQuality,
       ...decoded.encoding === "utf-8" ? {} : { encoding: decoded.encoding },
-      content: finalContent
+      content: derivation.finalContent
     });
   }
   if (changedScope !== null && changedPaths !== null && config.withDependents === true) {
     const keep = new Set(changedPaths);
     const resolver = buildImportResolver(files);
     for (const file of files) {
-      if (!isSourceSummary(file.summary)) continue;
-      if (importsChangedFile(file.relativePath, file.summary.imports, changedPaths, resolver)) {
+      const fileImports = isSourceSummary(file.summary) ? file.summary.imports : skippedSummaryImports.get(file.relativePath) ?? [];
+      if (fileImports.length === 0) continue;
+      if (importsChangedFile(file.relativePath, fileImports, changedPaths, resolver)) {
         keep.add(file.relativePath);
       }
     }
@@ -9378,6 +9962,9 @@ function generateSnapshot(configInput, options) {
     for (const path22 of [...monolithBodies.keys()]) {
       if (!keep.has(path22)) monolithBodies.delete(path22);
     }
+    for (const path22 of [...skippedSummaryImports.keys()]) {
+      if (!keep.has(path22)) skippedSummaryImports.delete(path22);
+    }
   }
   if (changedScope !== null) {
     for (const relativePath of unchangedPaths) {
@@ -9413,7 +10000,7 @@ function generateSnapshot(configInput, options) {
     const shown = oversizeSummaryPaths.slice(0, ENCODING_PATHS_SHOWN).map((entry) => maskPathText(entry, config.secretRules));
     const hidden = oversizeSummaryPaths.length - ENCODING_PATHS_SHOWN;
     warnings.push(
-      `${oversizeSummaryPaths.length} file(s) exceed ${Math.round(SUMMARY_MAX_SOURCE_BYTES / (1024 * 1024))} MB and were not parsed for a structural summary: ${shown.join(", ")}${hidden > 0 ? ` and ${hidden} more` : ""}. Their bodies are emitted as head/tail previews.`
+      `${oversizeSummaryPaths.length} file(s) exceed ${Math.round(SUMMARY_MAX_SOURCE_BYTES2 / (1024 * 1024))} MB and were not parsed for a structural summary: ${shown.join(", ")}${hidden > 0 ? ` and ${hidden} more` : ""}. Their bodies are emitted as head/tail previews.`
     );
   }
   for (const [encoding, bucket] of encodingBuckets) {
@@ -9437,11 +10024,13 @@ function generateSnapshot(configInput, options) {
     ).join("\n")
   );
   const fullContents = /* @__PURE__ */ new Map();
-  for (const file of files) {
-    fullContents.set(
-      file.relativePath,
-      monolithBodies.get(file.relativePath) ?? file.content ?? ""
-    );
+  if (config.includeMonolith) {
+    for (const file of files) {
+      fullContents.set(
+        file.relativePath,
+        monolithBodies.get(file.relativePath) ?? file.content ?? ""
+      );
+    }
   }
   const parts = partitionByBudget(files, config, fingerprint);
   const truncatedPreviewCount = files.filter((file) => file.isPreviewTruncated).length;
@@ -9702,7 +10291,7 @@ function generateSnapshot(configInput, options) {
     };
     shipHookState();
     if (pendingHook) {
-      pendingHook.then(
+      const tracked = pendingHook.then(
         () => {
           try {
             shipHookState();
@@ -9721,8 +10310,10 @@ function generateSnapshot(configInput, options) {
           } catch {
           }
         }
-      );
-      pendingHooks.set(outDir, pendingHook);
+      ).finally(() => {
+        if (pendingHooks.get(outDir) === tracked) pendingHooks.delete(outDir);
+      });
+      pendingHooks.set(outDir, tracked);
     }
     return manifest;
   } catch (err) {
@@ -9904,12 +10495,35 @@ async function openWorkspace(root, overrides = {}) {
     }
     cliOptions.maxPartBytes = parsed;
   }
+  if (overrides.maxPartTokens !== void 0) {
+    const parsed = parseByteSize(overrides.maxPartTokens);
+    if (parsed === void 0) {
+      return {
+        ok: false,
+        message: '"maxPartTokens" must be a token count, for example 32000 or "32k".'
+      };
+    }
+    cliOptions.maxPartTokens = parsed;
+  }
   if (overrides.outDir !== void 0) {
     if (typeof overrides.outDir !== "string" || overrides.outDir.trim().length === 0) {
       return { ok: false, message: '"outDir" must be a non-empty string.' };
     }
     cliOptions.outDir = overrides.outDir.trim();
   }
+  if (overrides.changedSince !== void 0) {
+    if (typeof overrides.changedSince !== "string" || overrides.changedSince.trim().length === 0) {
+      return {
+        ok: false,
+        message: '"changedSince" must be a git ref such as "main" or "HEAD~3".'
+      };
+    }
+    cliOptions.changedSince = overrides.changedSince.trim();
+  }
+  if (overrides.skeleton === true) cliOptions.skeleton = true;
+  if (overrides.sarif === true) cliOptions.sarif = true;
+  if (overrides.staged === true) cliOptions.staged = true;
+  if (overrides.withDependents === true) cliOptions.withDependents = true;
   try {
     const config = resolveConfig(loaded.config, cliOptions, root);
     return { ok: true, workspace: { root, config, configFile: loaded.file, cliOptions } };
@@ -9921,6 +10535,16 @@ var manifestCache = /* @__PURE__ */ new Map();
 function manifestPathFor(workspace) {
   return path17.resolve(workspace.root, workspace.config.outDir, "manifest.json");
 }
+function partPathFor(workspace, filename) {
+  if (filename.length === 0 || filename.includes("\0")) return null;
+  const partsDir = path17.resolve(workspace.root, workspace.config.outDir, "parts");
+  const resolved = path17.resolve(partsDir, filename);
+  const relative12 = path17.relative(partsDir, resolved);
+  if (relative12.length === 0 || relative12.includes(path17.sep) || relative12.includes("/") || relative12.includes("\\") || path17.isAbsolute(relative12)) {
+    return null;
+  }
+  return resolved;
+}
 function readManifest3(workspace) {
   const file = manifestPathFor(workspace);
   const shown = path17.relative(workspace.root, file).split(path17.sep).join("/") || file;
@@ -9991,6 +10615,44 @@ var OUT_DIR_PROPERTY = {
   description: "Snapshot directory, relative to the root. Defaults to the project configuration's outDir."
 };
 var outDirOverride = (args) => ({ outDir: args.outDir });
+var SCOPE_PROPERTIES = {
+  maxPartTokens: {
+    type: "string",
+    description: 'Token ceiling per part, for example 32000 or "32k". Narrower than maxPartBytes; it converts at four bytes per token.'
+  },
+  skeleton: {
+    type: "boolean",
+    description: "Replace every function body with `{ /* ... */ }`, keeping signatures, imports and exports. Applies to TypeScript, JavaScript and JSX."
+  },
+  sarif: {
+    type: "boolean",
+    description: "Also write reports/audit.sarif beside reports/audit.md, for CI code scanning."
+  },
+  changedSince: {
+    type: "string",
+    description: 'Only files changed since this git ref, for example "main" or "HEAD~3".'
+  },
+  staged: {
+    type: "boolean",
+    description: "Only files staged in the git index."
+  },
+  withDependents: {
+    type: "boolean",
+    description: "With staged or changedSince, also include the files that import the changed ones (one hop)."
+  }
+};
+function workspaceOverrides(args) {
+  return {
+    outDir: args.outDir,
+    maxPartBytes: args.maxPartBytes,
+    maxPartTokens: args.maxPartTokens,
+    skeleton: args.skeleton,
+    sarif: args.sarif,
+    changedSince: args.changedSince,
+    staged: args.staged,
+    withDependents: args.withDependents
+  };
+}
 function failure(message) {
   return { text: message, isError: true };
 }
@@ -10021,12 +10683,13 @@ function summarizeDrift(drift) {
 }
 function toRelativePath(root, value) {
   const cleaned = value.trim();
-  if (cleaned.length === 0) return null;
-  if (!path18.isAbsolute(cleaned)) {
-    return cleaned.replace(/\\/g, "/").replace(/^\.\//, "");
+  if (cleaned.length === 0 || cleaned.includes("\0")) return null;
+  const resolvedRoot = path18.resolve(root);
+  const absolute = path18.resolve(resolvedRoot, cleaned);
+  const relative12 = path18.relative(resolvedRoot, absolute);
+  if (relative12 === "" || relative12 === ".." || relative12.startsWith(`..${path18.sep}`) || path18.isAbsolute(relative12)) {
+    return null;
   }
-  const relative12 = path18.relative(root, cleaned);
-  if (relative12.startsWith("..") || path18.isAbsolute(relative12)) return null;
   return relative12.split(path18.sep).join("/");
 }
 function symbolsOf(entry) {
@@ -10162,7 +10825,8 @@ var planTool = {
       maxPartBytes: {
         type: "string",
         description: 'Byte budget per part, for example 307200 or "300k". Defaults to the project configuration.'
-      }
+      },
+      ...SCOPE_PROPERTIES
     },
     additionalProperties: false
   },
@@ -10179,7 +10843,7 @@ var planTool = {
   },
   annotations: READ_ONLY,
   async handler(args, context) {
-    const prepared = await prepare(args, context, { maxPartBytes: args.maxPartBytes, outDir: args.outDir });
+    const prepared = await prepare(args, context, workspaceOverrides(args));
     if (!prepared.ok) return prepared.outcome;
     const workspace = prepared.workspace;
     let manifest;
@@ -10237,7 +10901,8 @@ var generateTool = {
       maxPartBytes: {
         type: "string",
         description: 'Byte budget per part, for example 307200 or "300k". Defaults to the project configuration.'
-      }
+      },
+      ...SCOPE_PROPERTIES
     },
     additionalProperties: false
   },
@@ -10253,10 +10918,7 @@ var generateTool = {
   },
   annotations: WRITES,
   async handler(args, context) {
-    const prepared = await prepare(args, context, {
-      maxPartBytes: args.maxPartBytes,
-      outDir: args.outDir
-    });
+    const prepared = await prepare(args, context, workspaceOverrides(args));
     if (!prepared.ok) return prepared.outcome;
     const workspace = prepared.workspace;
     const result = await generateInWorker(workspace.root, workspace.cliOptions);
@@ -10295,7 +10957,7 @@ var validateTool = {
   description: "Re-read the repository and report whether the snapshot on disk still matches it. Use it before trusting context that came from an earlier session, or after changing the config.",
   inputSchema: {
     type: "object",
-    properties: { root: ROOT_PROPERTY, outDir: OUT_DIR_PROPERTY },
+    properties: { root: ROOT_PROPERTY, outDir: OUT_DIR_PROPERTY, ...SCOPE_PROPERTIES },
     additionalProperties: false
   },
   outputSchema: {
@@ -10307,7 +10969,7 @@ var validateTool = {
   },
   annotations: READ_ONLY,
   async handler(args, context) {
-    const prepared = await prepare(args, context, outDirOverride(args));
+    const prepared = await prepare(args, context, workspaceOverrides(args));
     if (!prepared.ok) return prepared.outcome;
     const workspace = prepared.workspace;
     let result;
@@ -10652,7 +11314,12 @@ var readTool = {
         `${relativePath} is not in the snapshot. Call snapshot_locate to find the path, or snapshot_explain to learn why it was excluded.`
       );
     }
-    const partPath = path18.resolve(workspace.root, workspace.config.outDir, "parts", entry.part);
+    const partPath = partPathFor(workspace, entry.part);
+    if (partPath === null) {
+      return failure(
+        `${entry.part} is not a part of this snapshot: its name leaves ${workspace.config.outDir}/parts. Run snapshot_generate to rebuild it.`
+      );
+    }
     let partText;
     try {
       partText = fs16.readFileSync(partPath, "utf8");
@@ -10732,7 +11399,8 @@ var explainTool = {
         description: "Path relative to the repository root. Directories are explained as a whole."
       },
       root: ROOT_PROPERTY,
-      outDir: OUT_DIR_PROPERTY
+      outDir: OUT_DIR_PROPERTY,
+      ...SCOPE_PROPERTIES
     },
     required: ["path"],
     additionalProperties: false
@@ -10747,7 +11415,7 @@ var explainTool = {
   },
   annotations: READ_ONLY,
   async handler(args, context) {
-    const prepared = await prepare(args, context, outDirOverride(args));
+    const prepared = await prepare(args, context, workspaceOverrides(args));
     if (!prepared.ok) return prepared.outcome;
     const workspace = prepared.workspace;
     if (typeof args.path !== "string") return failure('"path" must be a string.');
@@ -11589,7 +12257,7 @@ function buildAgentContract() {
         { key: "preset", type: "string", default: "detected", summary: "Force a preset. Unknown names are an error." },
         { key: "maxPartBytes", type: "number | string", default: 307200, summary: "Per-part byte budget." },
         { key: "maxPartTokens", type: "number | string | null", default: null, summary: "Per-part token ceiling; narrows maxPartBytes. Minimum 1024." },
-        { key: "skeleton", type: "boolean", default: false, summary: "Collapse function bodies to `{ /* ... */ }` in TypeScript files." },
+        { key: "skeleton", type: "boolean", default: false, summary: "Collapse function bodies to `{ /* ... */ }` in TS, JS, TSX and JSX files." },
         { key: "sarif", type: "boolean", default: false, summary: "Also write reports/audit.sarif." },
         { key: "changedSince", type: "string | null", default: null, summary: "Snapshot only files that differ from this git ref." },
         { key: "staged", type: "boolean", default: false, summary: "Snapshot only files staged in the index." },
@@ -12533,9 +13201,9 @@ function buildResourceProvider() {
         const index = Number(partMatch[1]);
         const part = read.manifest.parts.find((candidate) => candidate.index === index);
         if (!part) return null;
-        const text2 = readFileIfPresent(
-          path20.resolve(workspace.root, workspace.config.outDir, "parts", part.filename)
-        );
+        const partPath = partPathFor(workspace, part.filename);
+        if (partPath === null) return null;
+        const text2 = readFileIfPresent(partPath);
         if (text2 === null) return null;
         return { uri, mimeType: "text/markdown", text: capUtf8(text2, MAX_RESOURCE_BYTES).text };
       }
@@ -12567,11 +13235,11 @@ var MAX_LINE_BYTES = 32 * 1024 * 1024;
 function createWriter(output) {
   return {
     write(value) {
-      return new Promise((resolve9, reject) => {
+      return new Promise((resolve10, reject) => {
         output.write(`${JSON.stringify(value)}
 `, (error) => {
           if (error) reject(error);
-          else resolve9();
+          else resolve10();
         });
       });
     }
@@ -12579,6 +13247,7 @@ function createWriter(output) {
 }
 function createLineReader(input, options) {
   let buffer = "";
+  let bufferBytes = 0;
   let discarding = false;
   let discardedBytes = 0;
   const deliver = (line) => {
@@ -12591,6 +13260,13 @@ function createLineReader(input, options) {
     if (trimmed.trim().length === 0) return;
     options.onLine(trimmed);
   };
+  const discardBuffered = () => {
+    discarding = true;
+    discardedBytes += bufferBytes;
+    buffer = "";
+    bufferBytes = 0;
+    options.onOverflow?.(discardedBytes);
+  };
   const drain = () => {
     let index = buffer.indexOf("\n");
     while (index >= 0) {
@@ -12598,42 +13274,57 @@ function createLineReader(input, options) {
       buffer = buffer.slice(index + 1);
       if (discarding) {
         deliver(line);
-      } else if (line.length > MAX_LINE_BYTES) {
-        options.onOverflow?.(line.length);
       } else {
-        deliver(line);
+        const lineBytes = Buffer.byteLength(line, "utf8");
+        if (lineBytes > MAX_LINE_BYTES) options.onOverflow?.(lineBytes);
+        else deliver(line);
       }
       index = buffer.indexOf("\n");
     }
+    bufferBytes = Buffer.byteLength(buffer, "utf8");
+    if (!discarding && bufferBytes > MAX_LINE_BYTES) discardBuffered();
   };
   const onData = (chunk) => {
+    const chunkBytes = Buffer.byteLength(chunk, "utf8");
     if (discarding) {
       const index = chunk.indexOf("\n");
       if (index < 0) {
-        discardedBytes += chunk.length;
+        discardedBytes += chunkBytes;
         return;
       }
       buffer = chunk.slice(index + 1);
+      bufferBytes = Buffer.byteLength(buffer, "utf8");
       deliver("");
       drain();
       return;
     }
-    buffer += chunk;
-    drain();
-    if (buffer.length > MAX_LINE_BYTES) {
+    if (chunk.indexOf("\n") < 0 && bufferBytes + chunkBytes > MAX_LINE_BYTES) {
       discarding = true;
-      discardedBytes = buffer.length;
+      discardedBytes = bufferBytes + chunkBytes;
       buffer = "";
+      bufferBytes = 0;
       options.onOverflow?.(discardedBytes);
       return;
     }
+    buffer += chunk;
+    drain();
   };
   const onEnd = () => {
-    if (buffer.length > 0) {
-      const rest = buffer;
-      buffer = "";
-      deliver(rest);
+    const rest = buffer;
+    const restBytes = bufferBytes || Buffer.byteLength(rest, "utf8");
+    buffer = "";
+    bufferBytes = 0;
+    if (rest.length === 0) return;
+    if (discarding) {
+      discarding = false;
+      discardedBytes = 0;
+      return;
     }
+    if (restBytes > MAX_LINE_BYTES) {
+      options.onOverflow?.(restBytes);
+      return;
+    }
+    deliver(rest);
   };
   input.setEncoding("utf8");
   input.on("data", onData);
@@ -12684,8 +13375,8 @@ async function runStdioServer(options) {
   let inFlight = 0;
   let inputEnded = false;
   let resolveDone = () => void 0;
-  const finished = new Promise((resolve9) => {
-    resolveDone = resolve9;
+  const finished = new Promise((resolve10) => {
+    resolveDone = resolve10;
   });
   const finishIfIdle = () => {
     if (inputEnded && inFlight === 0) resolveDone(0);
@@ -13197,7 +13888,9 @@ function nextStepHint(cwd, scriptsAddedNow) {
   let hasScript = scriptsAddedNow;
   if (!hasScript) {
     try {
-      const parsed = JSON.parse(fs19.readFileSync(path21.join(cwd, "package.json"), "utf8"));
+      const parsed = JSON.parse(
+        stripJsonComments2(fs19.readFileSync(path21.join(cwd, "package.json"), "utf8"))
+      );
       hasScript = typeof parsed.scripts?.snapshot === "string";
     } catch {
       hasScript = false;
@@ -13299,18 +13992,8 @@ function installDependencies(cwd) {
   return { manager: manager.name, command, ok: true, detail: seconds };
 }
 async function captureStdout(fn) {
-  const original = process.stdout.write.bind(process.stdout);
-  let text2 = "";
-  process.stdout.write = ((chunk) => {
-    text2 += typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
-    return true;
-  });
-  try {
-    const code = await fn();
-    return { code, text: text2 };
-  } finally {
-    process.stdout.write = original;
-  }
+  const { value, text: text2 } = await runWithStdoutCapture(fn);
+  return { code: value, text: text2 };
 }
 async function runSetupCommand(invocation, options = {}) {
   try {
@@ -13425,31 +14108,33 @@ async function runSetupCommand(invocation, options = {}) {
     if (invocation.watch) generateArgs.push("--watch");
     if (invocation.format === "json") {
       const generated = await captureStdout(() => main(generateArgs));
-      let manifest = null;
+      let parsed = null;
       try {
-        manifest = JSON.parse(generated.text);
+        parsed = JSON.parse(generated.text);
       } catch {
-        manifest = null;
+        parsed = null;
+      }
+      const setup = {
+        configPath: init.configPath,
+        configReused: init.reused,
+        preset: init.preset,
+        scripts: init.scripts,
+        dependency: init.dependency,
+        gitignoreEntries: init.gitignoreEntries,
+        install,
+        notes: init.notes,
+        hook
+      };
+      if (generated.code !== 0) {
+        const inner = parsed && typeof parsed.error === "object" && parsed.error !== null ? parsed.error : { message: "Snapshot generation failed during setup.", exitCode: generated.code };
+        process.stdout.write(
+          `${JSON.stringify({ error: inner, setup, manifest: null }, null, 2)}
+`
+        );
+        return generated.code;
       }
       process.stdout.write(
-        `${JSON.stringify(
-          {
-            setup: {
-              configPath: init.configPath,
-              configReused: init.reused,
-              preset: init.preset,
-              scripts: init.scripts,
-              dependency: init.dependency,
-              gitignoreEntries: init.gitignoreEntries,
-              install,
-              notes: init.notes,
-              hook
-            },
-            manifest
-          },
-          null,
-          2
-        )}
+        `${JSON.stringify({ setup, manifest: parsed }, null, 2)}
 `
       );
       return generated.code;
@@ -13642,6 +14327,10 @@ ${USAGE}
       largeFileBytes: invocation.largeFileBytes,
       maxMonolithBytes: invocation.maxMonolithBytes,
       skipArtifacts: invocation.skipArtifacts,
+      // `--only-artifacts` is forwarded as itself, not only as the derived suppression list:
+      // suppression cannot switch an artifact *on*, so a config that had turned one of the
+      // requested artifacts off left the run with nothing to write.
+      onlyArtifacts: invocation.onlyArtifacts,
       discovery: invocation.discovery,
       changedSince: invocation.changedSince,
       staged: invocation.staged,
@@ -13653,19 +14342,6 @@ ${USAGE}
   );
   if (invocation.command === "validate") {
     const result = validateSnapshot(resolved);
-    if (result.valid) {
-      const manifestPath = path21.resolve(resolved.cwd, resolved.outDir, "manifest.json");
-      let manifest;
-      try {
-        manifest = JSON.parse(fs19.readFileSync(manifestPath, "utf8"));
-      } catch {
-        manifest = void 0;
-      }
-      const shapeError = manifest === void 0 ? null : describeManifestShapeProblem(manifest);
-      if (shapeError) {
-        return fail(invocation.format, `${manifestPath} is not a snapshot manifest: ${shapeError}`);
-      }
-    }
     emit(invocation.format, result, () => renderValidateText(result));
     return result.valid ? 0 : 1;
   }
@@ -13860,10 +14536,13 @@ function isGeneratedWatchPath(candidate, paths) {
   const outDir = comparablePath(path21.resolve(paths.cwd, paths.outDir));
   const tmpDir = comparablePath(path21.resolve(paths.cwd, paths.tmpDir));
   if (isSameOrInside(outDir, absolute) || isSameOrInside(tmpDir, absolute)) return true;
-  const parent = path21.dirname(absolute);
-  if (parent === path21.dirname(outDir) && path21.basename(absolute).startsWith(`${path21.basename(outDir)}.backup-`)) {
-    return true;
-  }
+  const offsets = [path21.basename(outDir), path21.basename(tmpDir)].filter((name) => name.length > 0);
+  const leftover = absolute.split(/[\\/]+/).some(
+    (segment) => offsets.some(
+      (name) => segment.startsWith(`${name}.backup-`) || segment.startsWith(`${name}.partial-`)
+    )
+  );
+  if (leftover) return true;
   return absolute.split(/[\\/]+/).some((segment) => VCS_SEGMENTS.has(segment));
 }
 function decideWatchEvent(state, event, paths) {
@@ -13938,6 +14617,7 @@ async function runWatchLoop(invocation, resolved, options) {
           largeFileBytes: invocation.largeFileBytes,
           maxMonolithBytes: invocation.maxMonolithBytes,
           skipArtifacts: invocation.skipArtifacts,
+          onlyArtifacts: invocation.onlyArtifacts,
           discovery: invocation.discovery,
           changedSince: invocation.changedSince,
           staged: invocation.staged,
@@ -13995,12 +14675,12 @@ async function runWatchLoop(invocation, resolved, options) {
     info(`\u26A0 Watch error: ${err.message}`);
     info("   The watcher may have missed changes. Restart with Ctrl+C if they stop arriving.");
   });
-  await new Promise((resolve9) => {
+  await new Promise((resolve10) => {
     const stop = () => {
       stopped = true;
       if (timer) clearTimeout(timer);
       watcher.close();
-      resolve9();
+      resolve10();
     };
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);