codebase-snapshot 0.9.12 → 0.9.14

package/dist/{chunk-3H45YMBG.js → chunk-DUZK5VL2.js}

@@ -9,11 +9,70 @@ import { createRequire } from 'module';
 import { pathToFileURL, fileURLToPath } from 'url';
 import * as childProcess from 'child_process';
 import { execFileSync } from 'child_process';
+import * as http from 'http';
 import * as https from 'https';
 import * as readline from 'readline';
 import { Worker } from 'worker_threads';
 
 // src/index.ts
+var hookStdoutScope = new AsyncLocalStorage();
+var captureScope = new AsyncLocalStorage();
+var installs = 0;
+var underlying = null;
+var router = null;
+var asText = (chunk) => typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+var callbackIn = (rest) => {
+  for (const argument of rest) {
+    if (typeof argument === "function") return argument;
+  }
+  return void 0;
+};
+function installStdoutRouter() {
+  if (installs === 0) {
+    underlying = process.stdout.write;
+    const realStdout = underlying.bind(process.stdout);
+    const realStderr = process.stderr.write.bind(process.stderr);
+    router = ((...args) => {
+      if (hookStdoutScope.getStore() === true) return realStderr(...args);
+      const capture = captureScope.getStore();
+      if (capture !== void 0) {
+        capture.write(asText(args[0]));
+        const callback = callbackIn(args.slice(1));
+        if (callback) callback(null);
+        return true;
+      }
+      return realStdout(...args);
+    });
+    process.stdout.write = router;
+  }
+  installs += 1;
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    installs -= 1;
+    if (installs === 0) {
+      if (process.stdout.write === router && underlying !== null) {
+        process.stdout.write = underlying;
+      }
+      underlying = null;
+      router = null;
+    }
+  };
+}
+async function runWithStdoutCapture(fn) {
+  let text2 = "";
+  const release = installStdoutRouter();
+  try {
+    const value = await captureScope.run(
+      { write: (chunk) => void (text2 += chunk) },
+      fn
+    );
+    return { value, text: text2 };
+  } finally {
+    release();
+  }
+}
 
 // src/ast/profiles/shared.ts
 var MAX_SUMMARY_CHARS = 1e6;
@@ -69,7 +128,7 @@ function isCapitalizedName(name) {
 }
 
 // src/ast/profiles/cfamily.ts
-var INCLUDE = /^#\s*include\s*[<"]([^>"]+)[>"]/;
+var INCLUDE = /^#\s*include\s*([<"])([^>"]+)[>"]/;
 var DEFINE = /^#\s*define\s+([A-Za-z_]\w*)/;
 var USING = /^using\s+(?:namespace\s+)?([\w:]+)\s*;/;
 var TYPE_DECL = /^(?:typedef\s+)?(?:struct|union|class|enum)\s+([A-Za-z_]\w*)/;
@@ -88,7 +147,7 @@ var cfamilyProfile = {
       }
       const included = INCLUDE.exec(trimmed);
       if (included) {
-        summary.imports.push(included[1]);
+        summary.imports.push(included[1] === '"' ? `./${included[2]}` : included[2]);
         return;
       }
       const used = USING.exec(trimmed);
@@ -492,7 +551,15 @@ var pythonProfile = {
       }
       const from = FROM_IMPORT.exec(trimmed);
       if (from) {
-        summary.imports.push(from[1]);
+        const module = from[1];
+        if (/^\.+$/.test(module)) {
+          for (const name of from[2].split(",")) {
+            const imported2 = name.replace(/[()]/g, "").trim().split(/\s+as\s+/)[0].trim();
+            if (/^[A-Za-z_]\w*$/.test(imported2)) summary.imports.push(`${module}${imported2}`);
+          }
+        } else {
+          summary.imports.push(module);
+        }
         routePending = false;
         return;
       }
@@ -541,7 +608,8 @@ var pythonProfile = {
 };
 
 // src/ast/profiles/ruby.ts
-var REQUIRE = /^require(?:_relative)?\s+["']([^"']+)["']/;
+var REQUIRE_RELATIVE = /^require_relative\s+["']([^"']+)["']/;
+var REQUIRE = /^require\s+["']([^"']+)["']/;
 var CLASS_OR_MODULE = /^(?:class|module)\s+([A-Z][\w:]*)/;
 var METHOD2 = /^def\s+(?:self\.)?([A-Za-z_]\w*[?!=]?)/;
 var rubyProfile = {
@@ -552,6 +620,11 @@ var rubyProfile = {
     eachLine(content, (line) => {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) return;
+      const relative8 = REQUIRE_RELATIVE.exec(trimmed);
+      if (relative8) {
+        summary.imports.push(`./${relative8[1]}`);
+        return;
+      }
       const required = REQUIRE.exec(trimmed);
       if (required) {
         summary.imports.push(required[1]);
@@ -748,13 +821,23 @@ function summarizeTypeScriptSource(relativePath, content) {
     if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
       summary.imports.push(node.moduleSpecifier.text);
     }
+    if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference) && node.moduleReference.expression !== void 0 && ts.isStringLiteral(node.moduleReference.expression)) {
+      summary.imports.push(node.moduleReference.expression.text);
+    }
+    if (ts.isCallExpression(node) && node.arguments.length >= 1) {
+      const firstArgument = node.arguments[0];
+      if (firstArgument !== void 0 && ts.isStringLiteral(firstArgument)) {
+        const isDynamicImport = node.expression.kind === ts.SyntaxKind.ImportKeyword;
+        const isRequire = ts.isIdentifier(node.expression) && node.expression.text === "require";
+        if (isDynamicImport || isRequire) summary.imports.push(firstArgument.text);
+      }
+    }
     if (ts.isExportDeclaration(node)) {
       if (node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
         summary.imports.push(node.moduleSpecifier.text);
+        summary.reExports.push(node.moduleSpecifier.text);
         if (node.exportClause && ts.isNamespaceExport(node.exportClause)) {
           summary.exports.push(node.exportClause.name.text);
-        } else if (!node.exportClause) {
-          summary.reExports.push(node.moduleSpecifier.text);
         }
       }
       if (node.exportClause && ts.isNamedExports(node.exportClause)) {
@@ -846,7 +929,8 @@ function summarizeTypeScriptSource(relativePath, content) {
 }
 
 // src/ast/profiles/sfc.ts
-var SCRIPT_BLOCK = /<script[^>]*>([\s\S]*?)<\/script>/gi;
+var SCRIPT_BLOCK = /<script([^>]*)>([\s\S]*?)<\/script>/gi;
+var JSX_LANG = /\blang\s*=\s*["']?[tj]sx\b/i;
 var ASTRO_FRONTMATTER = /^\uFEFF?---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?=\r?\n|$)/;
 function componentName(path17) {
   const base = path17.split("/").pop() ?? path17;
@@ -857,13 +941,15 @@ var sfcProfile = {
   extensions: [".vue", ".svelte", ".astro"],
   summarize(path17, content) {
     let script = "";
+    let usesJsx = path17.toLowerCase().endsWith(".astro");
     if (path17.toLowerCase().endsWith(".astro")) {
       const frontmatter = ASTRO_FRONTMATTER.exec(content);
       if (frontmatter) script += `${frontmatter[1]}
 `;
     }
     for (const match of content.matchAll(SCRIPT_BLOCK)) {
-      script += `${match[1]}
+      if (JSX_LANG.test(match[1] ?? "")) usesJsx = true;
+      script += `${match[2]}
 `;
     }
     const name = componentName(path17);
@@ -875,7 +961,7 @@ var sfcProfile = {
       }
       return { summary: finalizeSummary(summary2), quality: "heuristic" };
     }
-    const summary = summarizeTypeScriptSource(`${name}.ts`, script);
+    const summary = summarizeTypeScriptSource(`${name}.${usesJsx ? "tsx" : "ts"}`, script);
     summary.reactComponents.push(name);
     summary.exports.push(name);
     return { summary: finalizeSummary(summary), quality: "ast" };
@@ -1067,124 +1153,421 @@ function summarizeWithProfile(path17, content) {
   const profile = profileForPath(path17);
   return profile ? profile.summarize(path17, content) : null;
 }
-
-// src/ast/structured.ts
-function stripJsonComments(content) {
-  const text2 = content.replace(/^\uFEFF/, "");
-  let out = "";
-  let inString = false;
-  let inLineComment = false;
-  let inBlockComment = false;
-  for (let i = 0; i < text2.length; i++) {
-    const char = text2[i];
-    const next = text2[i + 1];
-    if (inLineComment) {
-      if (char === "\n") {
-        inLineComment = false;
-        out += char;
-      }
+var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".avif",
+  ".ico",
+  ".bmp",
+  ".tiff",
+  ".pdf",
+  ".zip",
+  ".tar",
+  ".gz",
+  ".tgz",
+  ".br",
+  ".bz2",
+  ".xz",
+  ".zst",
+  ".lz4",
+  ".lzma",
+  ".7z",
+  ".rar",
+  ".mp3",
+  ".mp4",
+  ".wav",
+  ".ogg",
+  ".webm",
+  ".mov",
+  ".avi",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".otf",
+  ".eot",
+  ".wasm",
+  ".node",
+  ".exe",
+  ".dll",
+  ".dylib",
+  ".so"
+]);
+function isBinaryExtension(filePath) {
+  const ext = path16.extname(filePath).toLowerCase();
+  return BINARY_EXTENSIONS.has(ext);
+}
+function isBinaryBuffer(buffer) {
+  return buffer.includes(0);
+}
+function countControlBytes(buffer) {
+  let count = 0;
+  for (let index = 0; index < buffer.length; index++) {
+    const byte = buffer[index];
+    if (byte < 32) {
+      if (byte !== 9 && byte !== 10 && byte !== 13) count += 1;
       continue;
     }
-    if (inBlockComment) {
-      if (char === "*" && next === "/") {
-        inBlockComment = false;
-        i += 1;
-      }
+    if (byte === 127) {
+      count += 1;
       continue;
     }
-    if (inString) {
-      out += char;
-      if (char === "\\") {
-        if (next !== void 0) {
-          out += next;
-          i += 1;
-        }
-      } else if (char === '"') {
-        inString = false;
+    if (byte === 194 && index + 1 < buffer.length) {
+      const next = buffer[index + 1];
+      if (next >= 128 && next <= 159) {
+        count += 1;
+        index += 1;
       }
+    }
+  }
+  return count;
+}
+var CONTROL_BYTES_FLOOR = 4;
+function countInvalidUtf8Bytes(buffer) {
+  let invalid = 0;
+  let index = 0;
+  const length = buffer.length;
+  while (index < length) {
+    const lead = buffer[index];
+    if (lead < 128) {
+      index += 1;
       continue;
     }
-    if (char === '"') {
-      inString = true;
-      out += char;
+    let continuation = 0;
+    let codePoint = 0;
+    let minimum = 0;
+    if ((lead & 224) === 192) {
+      continuation = 1;
+      codePoint = lead & 31;
+      minimum = 128;
+    } else if ((lead & 240) === 224) {
+      continuation = 2;
+      codePoint = lead & 15;
+      minimum = 2048;
+    } else if ((lead & 248) === 240) {
+      continuation = 3;
+      codePoint = lead & 7;
+      minimum = 65536;
+    } else {
+      invalid += 1;
+      index += 1;
       continue;
     }
-    if (char === "/" && next === "/") {
-      inLineComment = true;
-      i += 1;
+    if (index + continuation >= length) {
+      invalid += 1;
+      index += 1;
       continue;
     }
-    if (char === "/" && next === "*") {
-      inBlockComment = true;
-      i += 1;
+    let wellFormed = true;
+    for (let offset = 1; offset <= continuation; offset++) {
+      const next = buffer[index + offset];
+      if ((next & 192) !== 128) {
+        wellFormed = false;
+        break;
+      }
+      codePoint = codePoint << 6 | next & 63;
+    }
+    const isSurrogate = codePoint >= 55296 && codePoint <= 57343;
+    if (!wellFormed || codePoint < minimum || codePoint > 1114111 || isSurrogate) {
+      invalid += 1;
+      index += 1;
       continue;
     }
-    out += char;
+    index += continuation + 1;
   }
-  return out;
+  return invalid;
 }
-function summarizeJson(content) {
-  try {
-    const parsed = JSON.parse(stripJsonComments(content));
-    if (Array.isArray(parsed)) {
-      const sample = parsed[0];
-      const sampleKeys = sample && typeof sample === "object" && !Array.isArray(sample) ? Object.keys(sample).slice(0, 10).sort() : [];
-      return {
-        shape: "array",
-        itemCount: parsed.length,
-        keys: [],
-        sampleKeys
-      };
+function readBomEncoding(buffer) {
+  if (buffer.length >= 2) {
+    if (buffer[0] === 255 && buffer[1] === 254) return "utf-16le";
+    if (buffer[0] === 254 && buffer[1] === 255) return "utf-16be";
+  }
+  return null;
+}
+function looksLikeUtf16(buffer) {
+  if (buffer.length < 8 || buffer.length % 2 !== 0) return null;
+  const sample = Math.min(buffer.length, 4096);
+  let nulInLowByte = 0;
+  let nulInHighByte = 0;
+  const units = sample / 2;
+  for (let index = 0; index < sample; index += 2) {
+    if (buffer[index] === 0) nulInLowByte += 1;
+    if (buffer[index + 1] === 0) nulInHighByte += 1;
+  }
+  if (nulInHighByte > units * 0.3 && nulInLowByte < units * 0.05) return "utf-16le";
+  if (nulInLowByte > units * 0.3 && nulInHighByte < units * 0.05) return "utf-16be";
+  return null;
+}
+function decodeUtf16(buffer, encoding) {
+  const littleEndian = encoding === "utf-16le" ? buffer : Buffer.from(buffer.subarray(0, buffer.length - buffer.length % 2)).swap16();
+  return new TextDecoder("utf-16le").decode(littleEndian);
+}
+function decodeText(buffer) {
+  const bomEncoding = readBomEncoding(buffer);
+  if (bomEncoding) {
+    const text2 = decodeUtf16(buffer.subarray(2), bomEncoding);
+    return { text: text2, encoding: bomEncoding, invalidBytes: 0, binary: false };
+  }
+  if (buffer.includes(0)) {
+    const shape = looksLikeUtf16(buffer);
+    if (shape) {
+      return { text: decodeUtf16(buffer, shape), encoding: shape, invalidBytes: 0, binary: false };
     }
-    if (parsed && typeof parsed === "object") {
-      const keys = Object.keys(parsed).sort();
+    const offset = buffer.indexOf(0);
+    return {
+      text: "",
+      encoding: "utf-8",
+      invalidBytes: 0,
+      binary: true,
+      binaryReason: `NUL byte at offset ${offset}`
+    };
+  }
+  const invalidBytes = countInvalidUtf8Bytes(buffer);
+  if (invalidBytes === 0) {
+    const controlBytes = countControlBytes(buffer);
+    if (controlBytes > CONTROL_BYTES_FLOOR && controlBytes * 100 > buffer.length) {
       return {
-        shape: "object",
-        itemCount: keys.length,
-        keys: keys.slice(0, 30),
-        sampleKeys: []
+        text: "",
+        encoding: "utf-8",
+        invalidBytes: 0,
+        binary: true,
+        binaryReason: `${controlBytes} control byte(s) in ${buffer.length} B; valid UTF-8 but not text`
       };
     }
     return {
-      shape: typeof parsed,
-      itemCount: null,
-      keys: [],
-      sampleKeys: []
+      text: new TextDecoder("utf-8").decode(buffer),
+      encoding: "utf-8",
+      invalidBytes: 0,
+      binary: false
     };
-  } catch {
+  }
+  if (invalidBytes >= 32 && invalidBytes * 3 >= buffer.length) {
     return {
-      shape: "invalid-json",
-      itemCount: null,
-      keys: [],
-      sampleKeys: []
+      text: "",
+      encoding: "utf-8",
+      invalidBytes,
+      binary: true,
+      binaryReason: `${invalidBytes} of ${buffer.length} bytes are not UTF-8; treated as binary`
     };
   }
+  return {
+    text: buffer.toString("utf8"),
+    encoding: "utf-8-lossy",
+    invalidBytes,
+    binary: false
+  };
 }
-function summarizeMarkdown(content) {
-  const headings = [];
-  const frontmatterKeys = [];
-  const lines = content.replace(/^\uFEFF/, "").split("\n");
-  let inFrontmatter = false;
-  let fence = null;
-  let closesFrontmatter = false;
-  for (let index = 1; index < lines.length; index++) {
-    if (lines[index].trim() === "---") {
-      closesFrontmatter = true;
-      break;
-    }
-  }
+var BINARY_SCAN_BYTES = 8 * 1024 * 1024;
+var CHUNK = 64 * 1024;
+var SHAPE_SAMPLE_BYTES = 4096;
+function isBinaryFile(absolutePath) {
+  if (isBinaryExtension(absolutePath)) return true;
+  let fd;
+  try {
+    fd = fs14.openSync(absolutePath, "r");
+    const buffer = Buffer.alloc(CHUNK);
+    let sample;
+    let position = 0;
+    while (position < BINARY_SCAN_BYTES) {
+      const wanted = Math.min(CHUNK, BINARY_SCAN_BYTES - position);
+      const bytesRead = fs14.readSync(fd, buffer, 0, wanted, position);
+      if (bytesRead === 0) return false;
+      const chunk = buffer.subarray(0, bytesRead);
+      if (sample === void 0) {
+        sample = Buffer.from(chunk.subarray(0, SHAPE_SAMPLE_BYTES));
+      }
+      if (chunk.includes(0)) {
+        const shape = readBomEncoding(sample) ?? looksLikeUtf16(sample);
+        return shape === null;
+      }
+      position += bytesRead;
+    }
+    return false;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        fs14.closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+
+// src/ast/imports.ts
+var SUMMARY_MAX_SOURCE_BYTES = 2 * 1024 * 1024;
+var TS_SOURCE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+var isTsSource = (relativePath) => {
+  const lower = relativePath.toLowerCase();
+  return TS_SOURCE_EXTENSIONS.some((extension) => lower.endsWith(extension));
+};
+function importsOfText(relativePath, text2) {
+  if (Buffer.byteLength(text2, "utf8") > SUMMARY_MAX_SOURCE_BYTES) return [];
+  if (isTsSource(relativePath)) return summarizeTypeScriptSource(relativePath, text2).imports;
+  return summarizeWithProfile(relativePath, text2)?.summary.imports ?? [];
+}
+function importsOfFile(relativePath, absolutePath) {
+  let buffer;
+  try {
+    const stats = fs14.statSync(absolutePath);
+    if (!stats.isFile() || stats.size > SUMMARY_MAX_SOURCE_BYTES) return [];
+    buffer = fs14.readFileSync(absolutePath);
+  } catch {
+    return [];
+  }
+  const decoded = decodeText(buffer);
+  if (decoded.binary) return [];
+  return importsOfText(relativePath, decoded.text);
+}
+
+// src/ast/structured.ts
+function stripJsonComments(content) {
+  const text2 = content.replace(/^\uFEFF/, "");
+  const withoutComments = stripComments(text2);
+  return stripTrailingCommas(withoutComments);
+}
+function stripComments(text2) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let index = 0; index < text2.length; index += 1) {
+    const char = text2[index];
+    if (inString) {
+      out += char;
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      out += char;
+      continue;
+    }
+    if (char === "/" && text2[index + 1] === "/") {
+      while (index < text2.length && text2[index] !== "\n" && text2[index] !== "\r") index += 1;
+      index -= 1;
+      continue;
+    }
+    if (char === "/" && text2[index + 1] === "*") {
+      index += 2;
+      while (index < text2.length && !(text2[index] === "*" && text2[index + 1] === "/")) {
+        if (text2[index] === "\n" || text2[index] === "\r") out += text2[index];
+        index += 1;
+      }
+      index += 1;
+      continue;
+    }
+    out += char;
+  }
+  return out;
+}
+function stripTrailingCommas(text2) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let index = 0; index < text2.length; index += 1) {
+    const char = text2[index];
+    if (inString) {
+      out += char;
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      out += char;
+      continue;
+    }
+    if (char === ",") {
+      let next = index + 1;
+      while (next < text2.length && /\s/.test(text2[next])) next += 1;
+      if (text2[next] === "}" || text2[next] === "]") continue;
+    }
+    out += char;
+  }
+  return out;
+}
+function summarizeJson(content) {
+  try {
+    const parsed = JSON.parse(stripJsonComments(content));
+    if (Array.isArray(parsed)) {
+      const sample = parsed[0];
+      const sampleKeys = sample && typeof sample === "object" && !Array.isArray(sample) ? Object.keys(sample).slice(0, 10).sort() : [];
+      return {
+        shape: "array",
+        itemCount: parsed.length,
+        keys: [],
+        sampleKeys
+      };
+    }
+    if (parsed && typeof parsed === "object") {
+      const keys = Object.keys(parsed).sort();
+      return {
+        shape: "object",
+        itemCount: keys.length,
+        keys: keys.slice(0, 30),
+        sampleKeys: []
+      };
+    }
+    return {
+      shape: typeof parsed,
+      itemCount: null,
+      keys: [],
+      sampleKeys: []
+    };
+  } catch {
+    return {
+      shape: "invalid-json",
+      itemCount: null,
+      keys: [],
+      sampleKeys: []
+    };
+  }
+}
+function frontMatterEnd(lines) {
+  if (lines.length < 3 || lines[0].trim() !== "---") return 0;
+  for (let index = 1; index < lines.length; index += 1) {
+    const line = lines[index];
+    const candidate = line.trim();
+    if (candidate === "---" || candidate === "...") {
+      return index > 1 ? index : 0;
+    }
+    if (candidate === "") continue;
+    if (/^#(\s|$)/.test(candidate)) continue;
+    if (/^(`{3,}|~{3,})/.test(candidate)) return 0;
+    if (/^#{1,6}\s+\S/.test(candidate)) return 0;
+    const isYamlMapping = /^[A-Za-z0-9_.-]+\s*:(\s|$)/.test(candidate);
+    const isListItem = /^-(?:(\s|$))/.test(candidate);
+    const isIndented = /^[ \t]/.test(line);
+    if (!isYamlMapping && !isListItem && !isIndented) return 0;
+  }
+  return 0;
+}
+function summarizeMarkdown(content) {
+  const headings = [];
+  const frontmatterKeys = [];
+  const lines = content.replace(/^\uFEFF/, "").split(/\r\n|\n|\r/);
+  let inFrontmatter = false;
+  let fence = null;
+  const frontMatterEndLine = frontMatterEnd(lines);
   for (let index = 0; index < lines.length; index++) {
     const line = lines[index];
-    if (index === 0 && line.trim() === "---" && closesFrontmatter) {
+    if (index === 0 && frontMatterEndLine > 0) {
       inFrontmatter = true;
       continue;
     }
     if (inFrontmatter) {
-      if (line.trim() === "---") {
+      const trimmedFrontmatter = line.trim();
+      if (trimmedFrontmatter === "---" || trimmedFrontmatter === "...") {
         inFrontmatter = false;
         continue;
       }
-      const match = /^([a-zA-Z0-9_-]+):/.exec(line);
+      const match = /^([A-Za-z0-9_.-]+)\s*:/.exec(line);
       if (match) frontmatterKeys.push(match[1]);
       continue;
     }
@@ -1217,24 +1600,39 @@ function hasCollapsibleBody(node) {
   return body !== void 0 && ts.isBlock(body);
 }
 function isTsxFileName(fileName) {
-  return fileName.toLowerCase().endsWith(".tsx");
+  const lower = fileName.toLowerCase();
+  return lower.endsWith(".tsx") || lower.endsWith(".jsx");
+}
+function scriptKindFor(fileName) {
+  const lower = fileName.toLowerCase();
+  if (lower.endsWith(".tsx")) return ts.ScriptKind.TSX;
+  if (lower.endsWith(".jsx")) return ts.ScriptKind.JSX;
+  if (lower.endsWith(".js") || lower.endsWith(".mjs") || lower.endsWith(".cjs")) {
+    return ts.ScriptKind.JS;
+  }
+  return ts.ScriptKind.TS;
 }
 function skeletonizeTypeScript(source, fileName = "file.ts") {
-  const scriptKind = isTsxFileName(fileName) ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
   const sourceFile = ts.createSourceFile(
     fileName,
     source,
     ts.ScriptTarget.Latest,
-    true,
-    scriptKind
+    // `setParentNodes: false`. Nothing here reads `.parent` — the one `getStart` call is given the
+    // source file explicitly, which is the reason that argument exists. Asking for parent pointers
+    // makes the parser run a second full pass over every node in the file to set them, on top of
+    // the summary parse this same file already pays for.
+    false,
+    scriptKindFor(fileName)
   );
   const spans = [];
   const visit = (node) => {
     if ((ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node) || ts.isConstructorDeclaration(node) || ts.isGetAccessorDeclaration(node) || ts.isSetAccessorDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node)) && hasCollapsibleBody(node)) {
       const body = node.body;
-      const start = body.getStart(sourceFile);
-      const end = body.getEnd();
-      if (end > start) spans.push({ start, end });
+      if (body.statements.length > 0) {
+        const start = body.getStart(sourceFile);
+        const end = body.getEnd();
+        if (end > start) spans.push({ start, end });
+      }
     }
     ts.forEachChild(node, visit);
   };
@@ -1246,16 +1644,21 @@ function skeletonizeTypeScript(source, fileName = "file.ts") {
     if (last && span.start < last.end) continue;
     outermost.push(span);
   }
-  let text2 = source;
-  for (let index = outermost.length - 1; index >= 0; index -= 1) {
-    const span = outermost[index];
-    text2 = `${text2.slice(0, span.start)}{ /* ... */ }${text2.slice(span.end)}`;
+  const chunks = [];
+  let cursor = 0;
+  for (const span of outermost) {
+    chunks.push(source.slice(cursor, span.start), "{ /* ... */ }");
+    cursor = span.end;
   }
-  return { text: text2, collapsed: outermost.length };
+  chunks.push(source.slice(cursor));
+  return { text: chunks.join(""), collapsed: outermost.length };
 }
 function isSkeletonizable(filePath) {
   const lower = filePath.toLowerCase();
-  return lower.endsWith(".ts") || lower.endsWith(".tsx") || lower.endsWith(".mts") || lower.endsWith(".cts");
+  if (lower.endsWith(".d.ts") || lower.endsWith(".d.mts") || lower.endsWith(".d.cts")) {
+    return false;
+  }
+  return lower.endsWith(".ts") || lower.endsWith(".tsx") || lower.endsWith(".mts") || lower.endsWith(".cts") || lower.endsWith(".js") || lower.endsWith(".jsx") || lower.endsWith(".mjs") || lower.endsWith(".cjs");
 }
 var MANIFEST_FILES = [
   "package.json",
@@ -2493,9 +2896,18 @@ var DEFAULT_SECRET_PATTERNS = [
     // The unquoted twin for YAML, docker-compose and `.env`: those formats never
     // quote their values, so the rules above cannot see them. `valueGroup` keeps
     // `POSTGRES_PASSWORD:` in the output.
+    //
+    // This is the one unquoted rule without `NOT_AFTER_QUOTE`, and the lookbehind is a
+    // string-literal guard rather than a precision rule: a credential assignment *inside* a
+    // literal — `const dsn = "password=hunter2;host=db"`, `curl -d "password=hunter2"` — was
+    // rejected before it could be considered, and a DSN is a credential in a string. What made the
+    // lookbehind redundant is the shape of `UNQUOTED_LITERAL`: a value has to start with a word
+    // character, so `["awsSecret:", "apiKey:"]` — the list of key names the lookbehind was added
+    // for — cannot match here anyway. `redact.ts` still refuses a match whose separator is inside
+    // the literal, which is the case that list actually is.
     rule: "credential-assignment-unquoted",
     pattern: new RegExp(
-      `${NOT_AFTER_QUOTE}${UNQUOTED_STRONG_NAME}\\s{0,8}${ASSIGN}\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_LITERAL}`,
+      `${UNQUOTED_STRONG_NAME}\\s{0,8}${ASSIGN}\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_LITERAL}`,
       "i"
     ),
     valueGroup: 1
@@ -2530,6 +2942,27 @@ var DEFAULT_SECRET_PATTERNS = [
     pattern: /(?<!["'])(?:api[_-]?key|secret[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?token|refresh[_-]?token|private[_-]?key|password|passwd|pwd)["']?\s*(?<![=!<>])[:=](?!=)\s*["']([^"'\s]{8,256})["']/i,
     valueGroup: 1
   },
+  {
+    // `${VAR:-fallback}` — a default value in a shell script, a `.env`, docker-compose or a
+    // GitHub Actions workflow.
+    //
+    // This shape defeated every rule above it, and each refusal was individually reasonable:
+    // the quoted rules need a quote after the separator, and the unquoted ones need the value to
+    // begin with a word character — a fallback begins with `$`. So
+    // `POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-MyProdPassword123!}` was emitted whole, `.env` files
+    // and compose files included, which is where that idiom is the norm.
+    //
+    // The **fallback** is what gets masked, not the whole expansion: the variable name is the
+    // readable context, exactly as `POSTGRES_PASSWORD:` is kept by the rule above. A single
+    // interpolation with no operator (`${DB_PASSWORD}`) still does not match — there is nothing
+    // between the braces to mask, and `isTemplateInterpolation` keeps such a value readable.
+    rule: "interpolation-fallback-secret",
+    pattern: new RegExp(
+      `(?:["']${STRONG_CREDENTIAL_NAME}["']|${NOT_AFTER_QUOTE}${STRONG_CREDENTIAL_NAME})\\s{0,8}${ASSIGN}\\s{0,8}["'\`]?\\$\\{[A-Za-z_][A-Za-z0-9_]*:?[-=?+]([^}"'\`\\r\\n]{2,512})\\}["'\`]?`,
+      "i"
+    ),
+    valueGroup: 1
+  },
   {
     // Covers `.env` / shell assignment syntax, which never quotes its values and
     // was therefore invisible to the rule above. Anchored to the line start and
@@ -2557,8 +2990,8 @@ var DEFAULT_SECRET_PATTERNS = [
     valueGroup: 1
   }
 ];
-var PEM_BLOCK_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/g;
-var PEM_UNTERMINATED_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:\r?\n[A-Za-z0-9+/=]{4,}[ A-Za-z0-9+/=]*)+/g;
+var PEM_BLOCK_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN)[\s\S])*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/g;
+var PEM_UNTERMINATED_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:\r\n|\n|\r)(?:(?:[ \t]*(?:Proc-Type|DEK-Info|Comment|Version):[^\r\n]*|[ \t]*)(?:\r\n|\n|\r))*(?:[ \t]*[A-Za-z0-9+/=]{8,}[ \t]*(?:\r\n|\n|\r|$))+/g;
 
 // src/security/redact.ts
 var REDACTION_MARKER = "[REDACTED: potential secret-like value omitted from snapshot]";
@@ -2652,6 +3085,20 @@ function toGlobal(rule) {
   return new RegExp(rule.pattern.source, [...flags].join(""));
 }
 var LINE_BREAK = /(\r\n|\n|\r)/;
+var LINE_TERMINATOR = /\r\n|\n|\r/g;
+var COMPILED_RULES = /* @__PURE__ */ new WeakMap();
+function compiledRuleFor(rule) {
+  let compiled = COMPILED_RULES.get(rule);
+  if (compiled === void 0) {
+    compiled = {
+      rule: rule.rule,
+      pattern: toGlobal(rule),
+      ...rule.valueGroup === void 0 ? {} : { valueGroup: rule.valueGroup }
+    };
+    COMPILED_RULES.set(rule, compiled);
+  }
+  return compiled;
+}
 function scanAndRedactSecrets(content, rules, filePath) {
   const findings = [];
   let redacted = content;
@@ -2663,18 +3110,15 @@ function scanAndRedactSecrets(content, rules, filePath) {
         blockPattern.lastIndex += 1;
         continue;
       }
-      const line = redacted.slice(0, match.index).split("\n").length;
-      const newlines = (match[0].match(/\n/g) ?? []).length;
+      const before = redacted.slice(0, match.index);
+      const line = (before.match(LINE_TERMINATOR) ?? []).length + 1;
+      const newlines = (match[0].match(LINE_TERMINATOR) ?? []).length;
       findings.push({ rules: ["private-key-block"], line, path: filePath });
-      redacted = redacted.slice(0, match.index) + PEM_REDACTION_MARKER + "\n".repeat(newlines) + redacted.slice(match.index + match[0].length);
+      redacted = before + PEM_REDACTION_MARKER + "\n".repeat(newlines) + redacted.slice(match.index + match[0].length);
       blockPattern.lastIndex = match.index + PEM_REDACTION_MARKER.length + newlines;
     }
   }
-  const compiled = rules.map((rule) => ({
-    rule: rule.rule,
-    pattern: toGlobal(rule),
-    ...rule.valueGroup === void 0 ? {} : { valueGroup: rule.valueGroup }
-  }));
+  const compiled = rules.map(compiledRuleFor);
   const segments = redacted.split(LINE_BREAK);
   let lineNumber = 1;
   for (let index = 0; index < segments.length; index += 2) {
@@ -2692,8 +3136,10 @@ function scanAndRedactSecrets(content, rules, filePath) {
           }
           const group = valueGroup === void 0 ? void 0 : match.indices?.[valueGroup];
           if (group && isSelfNamingConstant(line, group[0], group[1])) continue;
-          if (valueGroup !== void 0 && startsInsideStringLiteral(line, match.index)) continue;
-          if (group && isUnquotedValue(line, group[0]) && isDeclaredBinding(line, match.index)) {
+          if (valueGroup !== void 0 && startsInsideStringLiteral(line, match.index, group?.[0])) {
+            continue;
+          }
+          if (group && isUnquotedValue(line, group[0]) && isDeclaredBinding(line, match.index, filePath)) {
             continue;
           }
           if (group && isTemplateInterpolation(line, group[0], group[1])) continue;
@@ -2726,14 +3172,20 @@ function expandOverToken(line, start, end) {
   while (right < line.length && TOKEN_CHARS_RIGHT.test(line[right])) right += 1;
   return { start: left, end: right };
 }
-function startsInsideStringLiteral(line, matchIndex) {
+function startsInsideStringLiteral(line, matchIndex, valueStart) {
   let runStart = matchIndex;
   while (runStart > 0 && /[A-Za-z0-9_-]/.test(line[runStart - 1])) runStart -= 1;
   const before = runStart > 0 ? line[runStart - 1] : "";
-  return before === '"' || before === "'" || before === "`";
+  if (before !== '"' && before !== "'" && before !== "`") return false;
+  if (valueStart === void 0) return true;
+  return /["'`]/.test(line.slice(matchIndex, valueStart));
 }
 function isTemplateInterpolation(line, start, end) {
-  return line[start] === "$" && line[start + 1] === "{" && line[end - 1] === "}";
+  if (line[start] !== "$" || line[start + 1] !== "{" || line[end - 1] !== "}") {
+    return false;
+  }
+  const inner = line.slice(start + 2, end - 1).trim();
+  return /^[A-Za-z_$][A-Za-z0-9_$.()[\]]*$/.test(inner);
 }
 function isSelfNamingConstant(line, start, end) {
   const value = line.slice(start, end);
@@ -2758,9 +3210,19 @@ function isUnquotedValue(line, start) {
   const before = start > 0 ? line[start - 1] : "";
   return before !== '"' && before !== "'" && before !== "`";
 }
-var DECLARATION_KEYWORDS = /\b(?:const|let|var|readonly|public|private|protected|static|declare|export|using)\s+$/;
+var DECLARATION_KEYWORDS = /\b(?:const|let|var|readonly|public|private|protected|static|using)\s+$/;
+var ASSIGNMENT_FILE = /\.(?:sh|bash|zsh|ksh|fish|env|ya?ml|toml|ini|conf|cfg|properties|tf|tfvars|service)$/i;
+var ASSIGNMENT_BASENAME = /^(?:\.env(?:\.[^/]*)?|\.envrc|\.profile|\.bashrc|\.zshrc|\.bash_profile)$/i;
+function isAssignmentFile(filePath) {
+  if (filePath === void 0) return false;
+  const normalised = filePath.replace(/\\/g, "/");
+  if (ASSIGNMENT_FILE.test(normalised)) return true;
+  const base = normalised.slice(normalised.lastIndexOf("/") + 1);
+  return ASSIGNMENT_BASENAME.test(base);
+}
 var DECLARATION_WINDOW = 40;
-function isDeclaredBinding(line, matchIndex) {
+function isDeclaredBinding(line, matchIndex, filePath) {
+  if (isAssignmentFile(filePath)) return false;
   let runStart = matchIndex;
   while (runStart > 0 && /[A-Za-z0-9_$]/.test(line[runStart - 1])) runStart -= 1;
   const from = Math.max(0, runStart - DECLARATION_WINDOW);
@@ -2802,6 +3264,15 @@ function readLinkTarget(linkPath, fallback) {
     return fallback;
   }
 }
+function brokenLinkRecord(linkPath, relativePath, rootReal) {
+  const rawTarget = readLinkTarget(linkPath, linkPath);
+  const resolvedFallback = path16.resolve(path16.dirname(linkPath), rawTarget);
+  return isInside(rootReal, resolvedFallback) ? { path: relativePath, reason: "read-error", detail: "broken symlink" } : {
+    path: relativePath,
+    reason: "outside-root",
+    detail: `link target resolves outside the scanned root (target: ${rawTarget}); not followed`
+  };
+}
 function isInside(root, candidate) {
   const relative8 = path16.relative(root, candidate);
   return relative8 === "" || !relative8.startsWith(`..${path16.sep}`) && relative8 !== ".." && !path16.isAbsolute(relative8);
@@ -2891,6 +3362,13 @@ function isSensitivePath(relativePath) {
   return matchesSensitiveList(posixPath, base);
 }
 var GLOBAL_PATTERNS = /* @__PURE__ */ new WeakMap();
+var GLOB_REGEX_CACHE = /* @__PURE__ */ new Map();
+var GITIGNORE_REGEX_CACHE = /* @__PURE__ */ new Map();
+var REGEX_CACHE_LIMIT = 4096;
+function rememberCompiled(cache, key, value) {
+  if (cache.size >= REGEX_CACHE_LIMIT) cache.clear();
+  cache.set(key, value);
+}
 function globalPattern(pattern) {
   let compiled = GLOBAL_PATTERNS.get(pattern);
   if (compiled === void 0) {
@@ -2901,8 +3379,8 @@ function globalPattern(pattern) {
 }
 var DEFAULT_PATH_RULES = [...DEFAULT_SECRET_PATTERNS];
 function pathScanRules(extraRules) {
-  if (extraRules === void 0 || extraRules.length === 0) return DEFAULT_PATH_RULES;
-  return [...DEFAULT_SECRET_PATTERNS, ...extraRules];
+  if (extraRules === void 0) return DEFAULT_PATH_RULES;
+  return extraRules;
 }
 function findSecretInPath(relativePath, extraRules) {
   const posixPath = relativePath.replace(/\\/g, "/");
@@ -2951,11 +3429,22 @@ function maskSkipPaths(records, extraRules) {
   });
 }
 function globToRegExp(glob) {
+  const cached = GLOB_REGEX_CACHE.get(glob);
+  if (cached !== void 0) return cached;
   const normalized = glob.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
   const anchored = normalized.startsWith("/");
   const body = anchored ? normalized.slice(1) : normalized;
   const prefix = anchored || body.includes("/") ? "^" : "(?:^|.*/)";
-  return new RegExp(`${prefix}${globBodyToRegExp(body, true)}(?:/.*)?$`);
+  let compiled;
+  try {
+    compiled = new RegExp(`${prefix}${globBodyToRegExp(body, true)}(?:/.*)?$`);
+  } catch (error) {
+    throw new Error(
+      `"${glob}" is not a valid glob: ${error.message}. A character class must be ascending, as in "[a-z]".`
+    );
+  }
+  rememberCompiled(GLOB_REGEX_CACHE, glob, compiled);
+  return compiled;
 }
 function globBodyToRegExp(body, allowBraces) {
   let out = "";
@@ -3067,6 +3556,14 @@ function escapeRegExpChar(character) {
   return /[\\^$.*+?()[\]{}|/]/.test(character) ? `\\${character}` : character;
 }
 function matchGitignorePattern(target, pattern) {
+  let compiled = GITIGNORE_REGEX_CACHE.get(pattern);
+  if (compiled === void 0) {
+    compiled = compileGitignorePattern(pattern);
+    rememberCompiled(GITIGNORE_REGEX_CACHE, pattern, compiled);
+  }
+  return compiled.test(target);
+}
+function compileGitignorePattern(pattern) {
   const anchored = pattern.startsWith("/");
   const body = anchored ? pattern.slice(1) : pattern;
   let source = "";
@@ -3115,7 +3612,11 @@ function matchGitignorePattern(target, pattern) {
     source += escapeRegExpChar(character);
   }
   const prefix = anchored || body.includes("/") ? "^" : "(?:^|.*/)";
-  return new RegExp(`${prefix}${source}(?:/.*)?$`).test(target);
+  try {
+    return new RegExp(`${prefix}${source}(?:/.*)?$`);
+  } catch {
+    return /$^/;
+  }
 }
 function matchesGitignoreRule(rule, scoped, isDirectory) {
   if (!rule.dirOnly) return matchGitignorePattern(scoped, rule.pattern);
@@ -3145,14 +3646,31 @@ function gitignoreVerdict(layers, relativePath, isDirectory) {
   }
   return verdict;
 }
-function defaultIgnoreReason(relativePath) {
+var DEFAULT_TOOL_DIR_NAMES = ["snapshot"];
+function toolDirNamesFor(toolOwnedPaths) {
+  const names = new Set(DEFAULT_TOOL_DIR_NAMES);
+  for (const entry of toolOwnedPaths) {
+    const base = entry.replace(/\\/g, "/").replace(/\/+$/, "").split("/").pop();
+    if (base !== void 0 && base.length > 0) names.add(base);
+  }
+  return [...names];
+}
+function isToolLeftoverName(name, dirNames) {
+  for (const dirName of dirNames) {
+    if (name.startsWith(`${dirName}.backup-`) || name.startsWith(`${dirName}.partial-`)) {
+      return true;
+    }
+  }
+  return false;
+}
+function defaultIgnoreReason(relativePath, toolDirNames = DEFAULT_TOOL_DIR_NAMES) {
   const posixPath = relativePath.replace(/\\/g, "/");
   const parts = posixPath.split("/");
   for (let i = 0; i < parts.length - 1; i++) {
     if (DEFAULT_IGNORED_DIRS.includes(parts[i])) {
       return `built-in ignore: directory "${parts[i]}"`;
     }
-    if (parts[i].startsWith("snapshot.backup-")) {
+    if (isToolLeftoverName(parts[i], toolDirNames)) {
       return `built-in ignore: leftover snapshot backup "${parts[i]}"`;
     }
   }
@@ -3160,6 +3678,9 @@ function defaultIgnoreReason(relativePath) {
   if (DEFAULT_IGNORED_FILES.includes(base)) {
     return `built-in ignore: filename "${base}"`;
   }
+  if (isToolLeftoverName(base, toolDirNames)) {
+    return `built-in ignore: leftover snapshot backup "${base}"`;
+  }
   return null;
 }
 function listIgnoredPaths(cwd) {
@@ -3228,41 +3749,72 @@ function dropLinkedDirectories(cwd, candidates, skipped) {
   }
   const reported = /* @__PURE__ */ new Set();
   const kept = [];
+  const report = (linkedPath, record) => {
+    if (reported.has(linkedPath)) return;
+    reported.add(linkedPath);
+    skipped.push(record);
+  };
   for (const candidate of candidates) {
     const parts = candidate.split("/");
-    let linkedDir = null;
+    let linkedPath = null;
     for (let depth = 1; depth <= parts.length; depth += 1) {
       const prefix = parts.slice(0, depth).join("/");
       if (isLink(path16.join(cwd, prefix))) {
-        linkedDir = prefix;
+        linkedPath = prefix;
         break;
       }
     }
-    if (linkedDir === null) {
+    if (linkedPath === null) {
       kept.push(candidate);
       continue;
     }
-    if (reported.has(linkedDir)) continue;
-    reported.add(linkedDir);
-    const absolute = path16.join(cwd, linkedDir);
-    let targetReal = absolute;
+    const absolute = path16.join(cwd, linkedPath);
+    const rawTarget = readLinkTarget(absolute, absolute);
+    let targetReal = null;
     try {
       targetReal = fs14.realpathSync(absolute);
     } catch {
+      targetReal = null;
     }
-    const target = readLinkTarget(absolute, targetReal);
-    const what = linkedDir === candidate ? "symbolic link" : "directory link";
-    skipped.push(
-      isInside(rootReal, targetReal) ? {
-        path: linkedDir,
-        reason: "symlink",
-        detail: `${what} not followed (target: ${target})`
-      } : {
-        path: linkedDir,
+    if (targetReal === null) {
+      report(linkedPath, brokenLinkRecord(absolute, linkedPath, rootReal));
+      continue;
+    }
+    if (!isInside(rootReal, targetReal)) {
+      report(linkedPath, {
+        path: linkedPath,
         reason: "outside-root",
-        detail: `link target resolves outside the scanned root (target: ${target}); not followed`
-      }
-    );
+        detail: `link target resolves outside the scanned root (target: ${rawTarget}); not followed`
+      });
+      continue;
+    }
+    let stats = null;
+    try {
+      stats = fs14.statSync(absolute);
+    } catch {
+      stats = null;
+    }
+    if (stats === null) {
+      report(linkedPath, { path: linkedPath, reason: "read-error", detail: "unreadable symlink" });
+      continue;
+    }
+    if (linkedPath !== candidate || stats.isDirectory()) {
+      report(linkedPath, {
+        path: linkedPath,
+        reason: "symlink",
+        detail: `directory link not followed (target: ${rawTarget})`
+      });
+      continue;
+    }
+    if (!stats.isFile()) {
+      report(linkedPath, {
+        path: linkedPath,
+        reason: "symlink",
+        detail: `link to neither a file nor a directory (target: ${rawTarget})`
+      });
+      continue;
+    }
+    kept.push(candidate);
   }
   return kept;
 }
@@ -3309,6 +3861,7 @@ function collectFiles(cwd, options = {}) {
     (options.toolOwnedPaths ?? []).map((entry) => entry.replace(/\\/g, "/"))
   );
   const isToolOwned = makeToolOwnedDecider(cwd, [...toolOwnedPaths]);
+  const toolDirNames = toolDirNamesFor(toolOwnedPaths);
   let candidates;
   const skipped = [];
   const discovery = options.discovery ?? "auto";
@@ -3337,7 +3890,7 @@ function collectFiles(cwd, options = {}) {
   }
   const files = candidates.filter((file) => {
     if (isToolOwned(file)) return false;
-    const ignored = defaultIgnoreReason(file);
+    const ignored = defaultIgnoreReason(file, toolDirNames);
     if (ignored) {
       skipped.push({ path: file, reason: "default-ignore", detail: ignored });
       return false;
@@ -3392,6 +3945,7 @@ function rootRealFor(root) {
 function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PURE__ */ new Set(), parentGitignoreLayers = []) {
   const results = { files: [], skipped: [] };
   const stack = [];
+  const toolDirNames = toolDirNamesFor(reservedPaths);
   const relativeToBase = (target) => path16.relative(baseDir, target).replace(/\\/g, "/") || ".";
   const enter = (current, layers) => {
     if (visited.has(current)) return false;
@@ -3436,11 +3990,11 @@ function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PU
       });
       continue;
     }
-    if (DEFAULT_IGNORED_FILES.includes(entry.name) || entry.name.startsWith("snapshot.backup-")) {
+    if (DEFAULT_IGNORED_FILES.includes(entry.name) || isToolLeftoverName(entry.name, toolDirNames)) {
       results.skipped.push({
         path: relPath,
         reason: "default-ignore",
-        detail: "built-in ignore: filename"
+        detail: isToolLeftoverName(entry.name, toolDirNames) ? `built-in ignore: leftover snapshot backup "${entry.name}" (not descended)` : "built-in ignore: filename"
       });
       continue;
     }
@@ -3461,7 +4015,7 @@ function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PU
       try {
         targetReal = fs14.realpathSync(fullPath);
       } catch {
-        results.skipped.push({ path: relPath, reason: "read-error", detail: "broken symlink" });
+        results.skipped.push(brokenLinkRecord(fullPath, relPath, rootReal));
         continue;
       }
       let stats;
@@ -3549,8 +4103,9 @@ function findConfigFile(cwd) {
   const pkgJsonPath = path16.join(cwd, "package.json");
   if (!fs14.existsSync(pkgJsonPath)) return null;
   try {
-    const parsed = JSON.parse(fs14.readFileSync(pkgJsonPath, "utf8"));
-    return parsed.snapshot === void 0 ? null : pkgJsonPath;
+    const parsed = JSON.parse(stripJsonComments2(fs14.readFileSync(pkgJsonPath, "utf8")));
+    const snapshot = parsed?.snapshot;
+    return typeof snapshot === "object" && snapshot !== null && !Array.isArray(snapshot) ? pkgJsonPath : null;
   } catch {
     return null;
   }
@@ -3600,15 +4155,19 @@ function normalizeBudgets(budgets, maxPartBytes) {
 }
 function normalizeResolvedConfig(config) {
   const discovery = isDiscoveryMode(config.discovery) ? config.discovery : "auto";
+  const monolithWanted = config.includeMonolith === true || config.artifacts?.monolith === true;
+  const artifacts = resolveArtifacts(
+    config.artifacts,
+    void 0,
+    monolithWanted,
+    monolithWanted
+  );
   return markResolvedConfig({
     ...config,
     discovery,
+    includeMonolith: artifacts.monolith,
     secretRules: compileSecretRules(config.secretRules),
-    artifacts: resolveArtifacts(
-      config.artifacts,
-      void 0,
-      config.includeMonolith === true
-    ),
+    artifacts,
     include: resolveInclude(config.include),
     preset: typeof config.preset === "string" ? config.preset : "generic",
     presetExclude: [
@@ -3687,9 +4246,9 @@ function stripJsonComments2(raw) {
     }
     out += char;
   }
-  return stripTrailingCommas(out);
+  return stripTrailingCommas2(out);
 }
-function stripTrailingCommas(text2) {
+function stripTrailingCommas2(text2) {
   let out = "";
   let inString = false;
   let escaped = false;
@@ -3817,11 +4376,21 @@ async function importConfigModule(fullPath) {
   url.searchParams.set("codebaseSnapshotLoad", String(moduleConfigLoadToken));
   return await import(url.href);
 }
-async function loadConfigFileDetailed(cwd) {
-  const warnings = [];
-  const errors = [];
-  for (const filename of CONFIG_FILENAMES) {
-    const fullPath = path16.join(cwd, filename);
+function attachConfigDir(config, filePath) {
+  if (typeof config === "object" && config !== null) {
+    Object.defineProperty(config, CONFIG_DIR_SYMBOL, {
+      value: path16.dirname(filePath),
+      enumerable: false,
+      configurable: true
+    });
+  }
+  return config;
+}
+async function loadConfigFileDetailed(cwd) {
+  const warnings = [];
+  const errors = [];
+  for (const filename of CONFIG_FILENAMES) {
+    const fullPath = path16.join(cwd, filename);
     if (!fs14.existsSync(fullPath)) continue;
     if (filename.endsWith(".json") || filename === ".snapshotrc") {
       try {
@@ -3832,7 +4401,7 @@ async function loadConfigFileDetailed(cwd) {
           );
         }
         assertKnownConfigKeys(config, fullPath);
-        return { config, file: fullPath, warnings, errors };
+        return { config: attachConfigDir(config, fullPath), file: fullPath, warnings, errors };
       } catch (err) {
         const raw = err.message;
         const message = raw.includes(fullPath) ? raw : `${fullPath}: ${raw}`;
@@ -3851,7 +4420,7 @@ async function loadConfigFileDetailed(cwd) {
       const imported = await importConfigModule(fullPath);
       const hasDefault = Object.prototype.hasOwnProperty.call(imported, "default");
       const config = readConfigExport(hasDefault ? imported.default : imported, fullPath);
-      return { config, file: fullPath, warnings, errors };
+      return { config: attachConfigDir(config, fullPath), file: fullPath, warnings, errors };
     } catch (err) {
       const message = `Could not load ${fullPath}: ${err.message}`;
       warnings.push(message);
@@ -3869,7 +4438,12 @@ async function loadConfigFileDetailed(cwd) {
           snapshotKey,
           `${pkgJsonPath} (the "snapshot" key)`
         );
-        return { config: snapshotKey, file: pkgJsonPath, warnings, errors };
+        return {
+          config: attachConfigDir(snapshotKey, pkgJsonPath),
+          file: pkgJsonPath,
+          warnings,
+          errors
+        };
       }
       if (snapshotKey !== void 0) {
         const kind = Array.isArray(snapshotKey) ? "array" : typeof snapshotKey;
@@ -3887,13 +4461,6 @@ async function loadConfigFileDetailed(cwd) {
 }
 async function loadConfigFile(cwd) {
   const loaded = await loadConfigFileDetailed(cwd);
-  if (loaded.config && loaded.file && typeof loaded.config === "object") {
-    Object.defineProperty(loaded.config, CONFIG_DIR_SYMBOL, {
-      value: path16.dirname(loaded.file),
-      enumerable: false,
-      configurable: true
-    });
-  }
   if (loaded.errors.length > 0) {
     throw new Error(`The config file could not be read: ${loaded.errors.join("; ")}`);
   }
@@ -3922,7 +4489,7 @@ var DEFAULT_ARTIFACTS = {
 function isArtifactName(value) {
   return ARTIFACT_NAMES.includes(value);
 }
-function resolveArtifacts(requested, skipped, includeMonolith, monolithOverride) {
+function resolveArtifacts(requested, skipped, includeMonolith, monolithOverride, only) {
   const artifacts = {
     ...DEFAULT_ARTIFACTS,
     // `includeMonolith` predates this selection and stays the switch for it.
@@ -3947,6 +4514,21 @@ function resolveArtifacts(requested, skipped, includeMonolith, monolithOverride)
   if (monolithOverride !== void 0) {
     artifacts.monolith = monolithOverride;
   }
+  if (only !== void 0 && only.length > 0) {
+    const keep = /* @__PURE__ */ new Set();
+    for (const name of only) {
+      if (!isArtifactName(name)) {
+        throw new Error(
+          `Unknown artifact "${name}". Expected one of: ${ARTIFACT_NAMES.join(", ")}.`
+        );
+      }
+      keep.add(name);
+    }
+    for (const name of ARTIFACT_NAMES) {
+      artifacts[name] = keep.has(name);
+    }
+    return artifacts;
+  }
   for (const name of skipped ?? []) {
     if (!isArtifactName(name)) {
       throw new Error(
@@ -4247,7 +4829,8 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     userConfig?.artifacts,
     cliOptions?.skipArtifacts,
     includeMonolith,
-    cliMonolith
+    cliMonolith,
+    cliOptions?.onlyArtifacts
   );
   const explicitMaxPartBytes = cliOptions?.maxPartBytes ?? userConfig?.maxPartBytes;
   const maxPartBytes = boundedBytes(
@@ -4421,7 +5004,18 @@ function configDigest(config) {
     excludePatterns: config.excludePatterns,
     preset: config.preset,
     layersMode: config.layersMode,
-    budgets: config.budgets,
+    // `budgets.byLayer` is a plain object, and `JSON.stringify` preserves insertion order — so
+    // `{ docs, api }` and `{ api, docs }` hashed differently despite being the same settings, and
+    // `validate` reported configuration drift for a snapshot nobody had changed. The keys are
+    // canonicalised here; nothing else about the object is order-dependent.
+    budgets: {
+      default: config.budgets.default,
+      byLayer: Object.fromEntries(
+        Object.entries(config.budgets.byLayer).sort(
+          ([left], [right]) => left < right ? -1 : left > right ? 1 : 0
+        )
+      )
+    },
     // The matcher is what makes a layer a layer. Hashing only the names meant that
     // moving `{ name: "api", match: "src/api/**" }` to `"src/v2/**"` produced the same
     // digest, so `validate` reported "valid and up to date" for a snapshot whose files
@@ -4705,9 +5299,21 @@ function generateSarifReport(manifest, findings, rules, toolVersion) {
 }
 
 // src/partitioner/preview.ts
+var LINE_ENDINGS = /\r\n|\r/g;
+var normaliseLineEndings = (content) => content.replace(LINE_ENDINGS, "\n");
 function countLines(content) {
   if (content.length === 0) return 0;
-  return content.split("\n").length - (content.endsWith("\n") ? 1 : 0);
+  let breaks = 0;
+  for (let index = 0; index < content.length; index += 1) {
+    const code = content.charCodeAt(index);
+    if (code === 10) {
+      breaks += 1;
+      continue;
+    }
+    if (code === 13 && content.charCodeAt(index + 1) !== 10) breaks += 1;
+  }
+  const last = content.charCodeAt(content.length - 1);
+  return last === 10 || last === 13 ? breaks : breaks + 1;
 }
 function truncateToBytes(content, maxBytes) {
   if (maxBytes <= 0) return { content: "", isTruncated: content.length > 0 };
@@ -4718,17 +5324,18 @@ function truncateToBytes(content, maxBytes) {
   return { content: slice, isTruncated: true };
 }
 function truncatePreview(content, headLines, tailLines) {
-  const lines = content.split("\n");
-  const total = countLines(content);
+  const normalised = normaliseLineEndings(content);
+  const lines = normalised.split("\n");
+  const total = countLines(normalised);
   if (total <= headLines + tailLines) {
     return {
-      content,
+      content: normalised,
       isTruncated: false,
       originalLines: total,
       includedLines: total
     };
   }
-  const window = content.endsWith("\n") ? lines.slice(0, -1) : lines;
+  const window = normalised.endsWith("\n") ? lines.slice(0, -1) : lines;
   const head = window.slice(0, headLines);
   const tail = tailLines > 0 ? window.slice(window.length - tailLines) : [];
   const omitted = total - head.length - tail.length;
@@ -4782,23 +5389,55 @@ function truncateWithBudgetMarker(content, maxBytes, budget, originalLines) {
   };
 }
 function partitionFiles(files, maxPartBytes, contentFingerprint) {
-  if (files.length === 0) return [];
-  const budget = Math.max(MIN_SECTION_BUDGET_BYTES + HEADER_RESERVE_BYTES, maxPartBytes);
-  const sectionBudget = budget - HEADER_RESERVE_BYTES;
-  const prepared = files.map((file) => prepareSection(file, sectionBudget));
-  let groups = greedyGroups(prepared, budget);
+  return partitionFilesForBuckets([{ files, budgetBytes: maxPartBytes }], contentFingerprint);
+}
+function partitionFilesForBuckets(buckets, contentFingerprint) {
+  const groups = [];
+  for (const bucket of buckets) {
+    if (bucket.files.length === 0) continue;
+    const budget = Math.max(
+      MIN_SECTION_BUDGET_BYTES + HEADER_RESERVE_BYTES,
+      bucket.budgetBytes
+    );
+    const sectionBudget = budget - HEADER_RESERVE_BYTES;
+    const prepared = bucket.files.map((file) => prepareSection(file, sectionBudget));
+    for (const sections of greedyGroups(prepared, budget)) groups.push({ sections, budget });
+  }
+  if (groups.length === 0) return [];
+  const measurements = /* @__PURE__ */ new Map();
+  const widthOf = (total) => Math.max(3, String(total).length);
+  const measure = (group, index, total) => {
+    const cached = measurements.get(group);
+    const width = widthOf(total);
+    if (cached !== void 0 && cached.index === index && cached.width === width) {
+      return cached.size;
+    }
+    const { content } = assembleGroup(group, index, total, contentFingerprint);
+    const size2 = Buffer.byteLength(content, "utf8");
+    measurements.set(group, { index, width, size: size2 });
+    return size2;
+  };
   for (let pass = 0; pass < MAX_SPLIT_PASSES; pass++) {
-    const rendered = renderGroups(groups, budget, contentFingerprint);
-    const oversized = rendered.findIndex((part) => part.metadata.byteSize > budget);
-    if (oversized === -1) return rendered;
+    const total = groups.length;
+    let oversized = -1;
+    for (let index = 0; index < total; index += 1) {
+      const group2 = groups[index];
+      if (measure(group2, index, total) > group2.budget) {
+        oversized = index;
+        break;
+      }
+    }
+    if (oversized === -1) return renderGroups(groups, contentFingerprint);
     const group = groups[oversized];
-    if (group.length > 1) {
-      const moved = group.pop();
-      groups.splice(oversized + 1, 0, [moved]);
+    if (group.sections.length > 1) {
+      const moved = group.sections.pop();
+      groups.splice(oversized + 1, 0, { sections: [moved], budget: group.budget });
+      measurements.delete(group);
       continue;
     }
-    const [section] = group;
-    const overflow = rendered[oversized].metadata.byteSize - budget;
+    const [section] = group.sections;
+    if (section === void 0) return renderGroups(groups, contentFingerprint);
+    const overflow = measure(group, oversized, total) - group.budget;
     const currentContent = section.file.content ?? "";
     const shrinkTo = Math.max(
       0,
@@ -4807,26 +5446,33 @@ function partitionFiles(files, maxPartBytes, contentFingerprint) {
     const shrunk = truncateWithBudgetMarker(
       currentContent,
       shrinkTo,
-      budget,
+      group.budget,
       section.file.originalLines
     );
     if (shrunk.isTruncated) {
       applyTruncatedContent(section.file, shrunk.content);
       section.text = renderFileSection(section.file);
       section.byteSize = Buffer.byteLength(section.text, "utf8");
+      measurements.delete(group);
       continue;
     }
+    const rendered = renderGroups(groups, contentFingerprint);
     const marker2 = TRUNCATION_MARKER;
-    assertBudgetHoldsMarker(budget);
+    assertBudgetHoldsMarker(group.budget);
     const target = Math.max(
       0,
-      budget - Buffer.byteLength(marker2, "utf8") - TOKEN_LINE_SLACK
+      group.budget - Buffer.byteLength(marker2, "utf8") - TOKEN_LINE_SLACK
     );
     const clipped = truncateToBytes(rendered[oversized].markdown, target);
-    rendered[oversized] = rehashPart(rendered[oversized], clipped.content + marker2);
+    rendered[oversized] = rehashPart(
+      rendered[oversized],
+      clipped.content + marker2
+    );
     return rendered;
   }
-  return enforceBudget(renderGroups(groups, budget, contentFingerprint), budget);
+  return renderGroups(groups, contentFingerprint).flatMap(
+    (part) => enforceBudget([part], part.metadata.budgetBytes)
+  );
 }
 var TRUNCATION_MARKER = "\n... [part truncated: cannot fit budget] ...\n";
 function assertBudgetHoldsMarker(budget) {
@@ -4911,7 +5557,7 @@ function renumberParts(parts, contentFingerprint) {
     (part) => enforceBudget([part], part.metadata.budgetBytes)[0] ?? part
   );
 }
-var SECTION_TRUNCATION_NOTICE = "\n... [section truncated: metadata alone exceeds the part budget] ...\n";
+var SECTION_TRUNCATION_NOTICE = "... [section truncated: the fixed metadata and a code fence did not fit the part budget] ...";
 var METADATA_VALUE_MAX = 200;
 var DISPLAY_PATH_MAX = 300;
 function capValue(value, max) {
@@ -4953,13 +5599,57 @@ function prepareSection(file, sectionBudget) {
     shrinkBody();
   }
   if (byteSize > sectionBudget) {
-    const target = sectionBudget - Buffer.byteLength(SECTION_TRUNCATION_NOTICE, "utf8");
-    const truncated = truncateToBytes(text2, Math.max(0, target));
-    text2 = truncated.content + SECTION_TRUNCATION_NOTICE;
+    applyTruncatedContent(file, SECTION_TRUNCATION_NOTICE);
+    file.summary = void 0;
+    file.summaryOmitted = true;
+    text2 = renderFileSection(file);
     byteSize = Buffer.byteLength(text2, "utf8");
+    if (byteSize > sectionBudget) {
+      text2 = truncateRenderedSection(text2, sectionBudget, fenceForContent(file.content ?? ""));
+      byteSize = Buffer.byteLength(text2, "utf8");
+    }
   }
   return { file, text: text2, byteSize };
 }
+function truncateRenderedSection(text2, sectionBudget, fence) {
+  const closing = `
+${SECTION_TRUNCATION_NOTICE}
+${fence}
+`;
+  const bodyRoom = sectionBudget - Buffer.byteLength(closing, "utf8");
+  if (bodyRoom > 0) {
+    const cut2 = truncateToBytes(text2, bodyRoom).content;
+    const lastBreak2 = cut2.lastIndexOf("\n");
+    const kept = lastBreak2 >= 0 ? cut2.slice(0, lastBreak2 + 1) : "";
+    if (fenceIsOpen(kept, fence)) return `${kept}${closing}`;
+  }
+  const probe = text2.slice(0, 512);
+  const emptyFence = fenceForText(probe.slice(0, Math.max(0, probe.lastIndexOf("\n") + 1)), 4);
+  const block = `
+${emptyFence}
+${SECTION_TRUNCATION_NOTICE}
+${emptyFence}
+`;
+  const prefixRoom = sectionBudget - Buffer.byteLength(block, "utf8");
+  const cut = prefixRoom > 0 ? truncateToBytes(text2, prefixRoom).content : "";
+  const lastBreak = cut.lastIndexOf("\n");
+  const prefix = lastBreak >= 0 ? cut.slice(0, lastBreak + 1) : "";
+  return `${dropTrailingOpenFence(prefix, fence)}${block}`;
+}
+function dropTrailingOpenFence(text2, fence) {
+  if (!fenceIsOpen(text2, fence)) return text2;
+  const lines = text2.split("\n");
+  const opening = lines.findIndex((line) => line.startsWith(fence));
+  if (opening < 0) return text2;
+  return lines.slice(0, opening).join("\n") + (opening > 0 ? "\n" : "");
+}
+function fenceIsOpen(text2, fence) {
+  let open = false;
+  for (const line of text2.split("\n")) {
+    if (line.startsWith(fence)) open = !open;
+  }
+  return open;
+}
 function applyTruncatedContent(file, content) {
   file.content = content;
   file.isPreviewTruncated = true;
@@ -5007,52 +5697,64 @@ function greedyGroups(sections, budget) {
   if (current.length > 0) groups.push(current);
   return groups;
 }
-function renderGroups(groups, budget, contentFingerprint) {
+function assembleGroup(group, index, total, contentFingerprint) {
+  const width = Math.max(3, String(total).length);
+  const zeroPad = (value) => String(value).padStart(width, "0");
+  const filename = `part-${zeroPad(index + 1)}.md`;
+  const prev = index === 0 ? "none" : `part-${zeroPad(index)}.md`;
+  const next = index === total - 1 ? "none" : `part-${zeroPad(index + 2)}.md`;
+  for (const section of group.sections) {
+    section.file.part = filename;
+  }
+  const layerCounts = {};
+  const kindCounts = {};
+  for (const section of group.sections) {
+    layerCounts[section.file.layer] = (layerCounts[section.file.layer] || 0) + 1;
+    kindCounts[section.file.kind] = (kindCounts[section.file.kind] || 0) + 1;
+  }
+  const pathLines = group.sections.map((s) => displayPath(s.file.relativePath));
+  const listFence = fenceForText(pathLines.join("\n"), 3);
+  const header = [
+    `# Codebase Snapshot Part ${zeroPad(index + 1)} of ${zeroPad(total)}`,
+    "",
+    `- Previous: ${prev}`,
+    `- Next: ${next}`,
+    `- Files: ${group.sections.length}`,
+    `- Content Fingerprint: ${contentFingerprint || "none"}`,
+    `- Layers: ${topEntries(layerCounts, 6) || "none"}`,
+    `- Kinds: ${topEntries(kindCounts, 8) || "none"}`,
+    "",
+    UNTRUSTED_CONTENT_NOTICE,
+    "",
+    "## Files",
+    "",
+    `${listFence}text`,
+    ...pathLines,
+    listFence,
+    "",
+    "## Contents",
+    ""
+  ].join("\n");
+  const assembled = (header + group.sections.map((s) => s.text).join("")).replace(
+    /\r\n|\r/g,
+    "\n"
+  );
+  const estimatedTokens = estimateTokens(assembled);
+  return { filename, content: insertTokenLine(assembled, estimatedTokens), estimatedTokens };
+}
+function renderGroups(groups, contentFingerprint) {
   const total = groups.length;
-  const zeroPad = (index) => String(index).padStart(Math.max(3, String(total).length), "0");
   return groups.map((group, index) => {
-    const filename = `part-${zeroPad(index + 1)}.md`;
-    const prev = index === 0 ? "none" : `part-${zeroPad(index)}.md`;
-    const next = index === total - 1 ? "none" : `part-${zeroPad(index + 2)}.md`;
-    for (const section of group) {
-      section.file.part = filename;
-    }
-    const layersCovered = Array.from(new Set(group.map((s) => s.file.layer))).sort();
-    const layerCounts = {};
-    const kindCounts = {};
-    for (const section of group) {
-      layerCounts[section.file.layer] = (layerCounts[section.file.layer] || 0) + 1;
-      kindCounts[section.file.kind] = (kindCounts[section.file.kind] || 0) + 1;
-    }
-    const pathLines = group.map((s) => displayPath(s.file.relativePath));
-    const listFence = fenceForText(pathLines.join("\n"), 3);
-    const header = [
-      `# Codebase Snapshot Part ${zeroPad(index + 1)} of ${zeroPad(total)}`,
-      "",
-      `- Previous: ${prev}`,
-      `- Next: ${next}`,
-      `- Files: ${group.length}`,
-      `- Content Fingerprint: ${contentFingerprint || "none"}`,
-      `- Layers: ${topEntries(layerCounts, 6) || "none"}`,
-      `- Kinds: ${topEntries(kindCounts, 8) || "none"}`,
-      "",
-      UNTRUSTED_CONTENT_NOTICE,
-      "",
-      "## Files",
-      "",
-      `${listFence}text`,
-      ...pathLines,
-      listFence,
-      "",
-      "## Contents",
-      ""
-    ].join("\n");
-    const assembled = (header + group.map((s) => s.text).join("")).replace(/\r\n/g, "\n");
-    const estimatedTokens = estimateTokens(assembled);
-    const content = insertTokenLine(assembled, estimatedTokens);
+    const { filename, content, estimatedTokens } = assembleGroup(
+      group,
+      index,
+      total,
+      contentFingerprint
+    );
     const byteSize = Buffer.byteLength(content, "utf8");
     const sha256 = crypto2.createHash("sha256").update(content).digest("hex");
-    const includedFiles = group.map(({ file }) => ({
+    const layersCovered = Array.from(new Set(group.sections.map((s) => s.file.layer))).sort();
+    const includedFiles = group.sections.map(({ file }) => ({
       relativePath: file.relativePath,
       sourceBytes: file.sizeBytes,
       includedBytes: file.includedBytes,
@@ -5065,10 +5767,10 @@ function renderGroups(groups, budget, contentFingerprint) {
       filename,
       byteSize,
       estimatedTokens,
-      budgetBytes: budget,
+      budgetBytes: group.budget,
       sha256,
       lines: countLines(content),
-      fileCount: group.length,
+      fileCount: group.sections.length,
       layersCovered,
       includedFiles
     };
@@ -5076,7 +5778,7 @@ function renderGroups(groups, budget, contentFingerprint) {
   });
 }
 function emittedBody(content) {
-  const normalised = content.replace(/\r\n/g, "\n");
+  const normalised = content.replace(/\r\n|\r/g, "\n");
   return normalised.endsWith("\n") ? normalised.slice(0, -1) : normalised;
 }
 function compactMetadata(file) {
@@ -5144,7 +5846,7 @@ function generateMonolithJson(manifest, filesWithContent) {
 }
 function generateMonolithMarkdown(manifest, filesWithContent) {
   const sections = filesWithContent.map((file) => {
-    const content = (file.content ?? "").replace(/\r\n/g, "\n");
+    const content = (file.content ?? "").replace(/\r\n|\r/g, "\n");
     const fence = fenceForContent(content);
     return [
       `## File: ${escapeControls(file.relativePath)}`,
@@ -5309,322 +6011,79 @@ function generateReadme(manifest, artifacts) {
       `${readOrder.length + 1}. Inspect \`manifest.json\` for precise dependency and AST symbol maps.`
     );
   }
-  readOrder.push(
-    `${readOrder.length + 1}. Check \`manifest.validation.status\` before trusting the snapshot; \`snapshot validate\` re-checks it against disk.`
-  );
-  lines.push("", "## AI Agent Ingestion Guide", "", ...readOrder, "");
-  return lines.join("\n");
-}
-
-// src/generator/tree.ts
-var MAX_TREE_LINES = 2e4;
-var MAX_TREE_DEPTH = 512;
-function childKeys(node) {
-  return Array.from(node.children.keys()).sort((a, b) => {
-    const aIsDir = node.children.get(a).children.size > 0;
-    const bIsDir = node.children.get(b).children.size > 0;
-    if (aIsDir !== bIsDir) return aIsDir ? -1 : 1;
-    return a < b ? -1 : a > b ? 1 : 0;
-  });
-}
-function generateProjectTree(filePaths) {
-  const root = { children: /* @__PURE__ */ new Map() };
-  for (const filePath of filePaths) {
-    const parts = filePath.split("/").filter((part) => part.length > 0);
-    let current = root;
-    for (const part of parts) {
-      let child = current.children.get(part);
-      if (!child) {
-        child = { children: /* @__PURE__ */ new Map() };
-        current.children.set(part, child);
-      }
-      current = child;
-    }
-  }
-  const lines = ["."];
-  let truncatedAt = -1;
-  let depthTruncated = false;
-  const stack = [{ node: root, prefix: "", depth: 0, keys: childKeys(root), index: 0 }];
-  while (stack.length > 0) {
-    const frame = stack[stack.length - 1];
-    if (frame.index >= frame.keys.length) {
-      stack.pop();
-      continue;
-    }
-    const key = frame.keys[frame.index];
-    frame.index += 1;
-    const isLast = frame.index === frame.keys.length;
-    const child = frame.node.children.get(key);
-    const isDirectory = child.children.size > 0;
-    const label = escapeControls(key);
-    lines.push(`${frame.prefix}${isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "}${label}${isDirectory ? "/" : ""}`);
-    if (lines.length >= MAX_TREE_LINES) {
-      truncatedAt = lines.length;
-      break;
-    }
-    if (!isDirectory) continue;
-    if (frame.depth + 1 > MAX_TREE_DEPTH) {
-      depthTruncated = true;
-      continue;
-    }
-    stack.push({
-      node: child,
-      prefix: frame.prefix + (isLast ? "    " : "\u2502   "),
-      depth: frame.depth + 1,
-      keys: childKeys(child),
-      index: 0
-    });
-  }
-  if (truncatedAt !== -1) {
-    lines.push(`... [tree truncated at ${MAX_TREE_LINES} lines] ...`);
-  } else if (depthTruncated) {
-    lines.push(`... [tree truncated at ${MAX_TREE_DEPTH} levels] ...`);
-  }
-  const fence = fenceForText(lines.join("\n"), 3);
-  return ["# Project Tree", "", `${fence}text`, ...lines, fence, ""].join("\n");
-}
-var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
-  ".png",
-  ".jpg",
-  ".jpeg",
-  ".gif",
-  ".webp",
-  ".avif",
-  ".ico",
-  ".bmp",
-  ".tiff",
-  ".pdf",
-  ".zip",
-  ".tar",
-  ".gz",
-  ".tgz",
-  ".br",
-  ".bz2",
-  ".xz",
-  ".zst",
-  ".lz4",
-  ".lzma",
-  ".7z",
-  ".rar",
-  ".mp3",
-  ".mp4",
-  ".wav",
-  ".ogg",
-  ".webm",
-  ".mov",
-  ".avi",
-  ".woff",
-  ".woff2",
-  ".ttf",
-  ".otf",
-  ".eot",
-  ".wasm",
-  ".node",
-  ".exe",
-  ".dll",
-  ".dylib",
-  ".so"
-]);
-function isBinaryExtension(filePath) {
-  const ext = path16.extname(filePath).toLowerCase();
-  return BINARY_EXTENSIONS.has(ext);
-}
-function isBinaryBuffer(buffer) {
-  return buffer.includes(0);
-}
-function countControlBytes(buffer) {
-  let count = 0;
-  for (let index = 0; index < buffer.length; index++) {
-    const byte = buffer[index];
-    if (byte < 32) {
-      if (byte !== 9 && byte !== 10 && byte !== 13) count += 1;
-      continue;
-    }
-    if (byte === 127) {
-      count += 1;
-      continue;
-    }
-    if (byte === 194 && index + 1 < buffer.length) {
-      const next = buffer[index + 1];
-      if (next >= 128 && next <= 159) {
-        count += 1;
-        index += 1;
-      }
-    }
-  }
-  return count;
-}
-var CONTROL_BYTES_FLOOR = 4;
-function countInvalidUtf8Bytes(buffer) {
-  let invalid = 0;
-  let index = 0;
-  const length = buffer.length;
-  while (index < length) {
-    const lead = buffer[index];
-    if (lead < 128) {
-      index += 1;
-      continue;
-    }
-    let continuation = 0;
-    let codePoint = 0;
-    let minimum = 0;
-    if ((lead & 224) === 192) {
-      continuation = 1;
-      codePoint = lead & 31;
-      minimum = 128;
-    } else if ((lead & 240) === 224) {
-      continuation = 2;
-      codePoint = lead & 15;
-      minimum = 2048;
-    } else if ((lead & 248) === 240) {
-      continuation = 3;
-      codePoint = lead & 7;
-      minimum = 65536;
-    } else {
-      invalid += 1;
-      index += 1;
-      continue;
-    }
-    if (index + continuation >= length) {
-      invalid += 1;
-      index += 1;
-      continue;
-    }
-    let wellFormed = true;
-    for (let offset = 1; offset <= continuation; offset++) {
-      const next = buffer[index + offset];
-      if ((next & 192) !== 128) {
-        wellFormed = false;
-        break;
-      }
-      codePoint = codePoint << 6 | next & 63;
-    }
-    const isSurrogate = codePoint >= 55296 && codePoint <= 57343;
-    if (!wellFormed || codePoint < minimum || codePoint > 1114111 || isSurrogate) {
-      invalid += 1;
-      index += 1;
-      continue;
-    }
-    index += continuation + 1;
-  }
-  return invalid;
-}
-function readBomEncoding(buffer) {
-  if (buffer.length >= 2) {
-    if (buffer[0] === 255 && buffer[1] === 254) return "utf-16le";
-    if (buffer[0] === 254 && buffer[1] === 255) return "utf-16be";
-  }
-  return null;
-}
-function looksLikeUtf16(buffer) {
-  if (buffer.length < 8 || buffer.length % 2 !== 0) return null;
-  const sample = Math.min(buffer.length, 4096);
-  let nulInLowByte = 0;
-  let nulInHighByte = 0;
-  const units = sample / 2;
-  for (let index = 0; index < sample; index += 2) {
-    if (buffer[index] === 0) nulInLowByte += 1;
-    if (buffer[index + 1] === 0) nulInHighByte += 1;
-  }
-  if (nulInHighByte > units * 0.3 && nulInLowByte < units * 0.05) return "utf-16le";
-  if (nulInLowByte > units * 0.3 && nulInHighByte < units * 0.05) return "utf-16be";
-  return null;
-}
-function decodeUtf16(buffer, encoding) {
-  const littleEndian = encoding === "utf-16le" ? buffer : Buffer.from(buffer.subarray(0, buffer.length - buffer.length % 2)).swap16();
-  return new TextDecoder("utf-16le").decode(littleEndian);
-}
-function decodeText(buffer) {
-  const bomEncoding = readBomEncoding(buffer);
-  if (bomEncoding) {
-    const text2 = decodeUtf16(buffer.subarray(2), bomEncoding);
-    return { text: text2, encoding: bomEncoding, invalidBytes: 0, binary: false };
-  }
-  if (buffer.includes(0)) {
-    const shape = looksLikeUtf16(buffer);
-    if (shape) {
-      return { text: decodeUtf16(buffer, shape), encoding: shape, invalidBytes: 0, binary: false };
-    }
-    const offset = buffer.indexOf(0);
-    return {
-      text: "",
-      encoding: "utf-8",
-      invalidBytes: 0,
-      binary: true,
-      binaryReason: `NUL byte at offset ${offset}`
-    };
-  }
-  const invalidBytes = countInvalidUtf8Bytes(buffer);
-  if (invalidBytes === 0) {
-    const controlBytes = countControlBytes(buffer);
-    if (controlBytes > CONTROL_BYTES_FLOOR && controlBytes * 100 > buffer.length) {
-      return {
-        text: "",
-        encoding: "utf-8",
-        invalidBytes: 0,
-        binary: true,
-        binaryReason: `${controlBytes} control byte(s) in ${buffer.length} B; valid UTF-8 but not text`
-      };
-    }
-    return {
-      text: new TextDecoder("utf-8").decode(buffer),
-      encoding: "utf-8",
-      invalidBytes: 0,
-      binary: false
-    };
-  }
-  if (invalidBytes >= 32 && invalidBytes * 3 >= buffer.length) {
-    return {
-      text: "",
-      encoding: "utf-8",
-      invalidBytes,
-      binary: true,
-      binaryReason: `${invalidBytes} of ${buffer.length} bytes are not UTF-8; treated as binary`
-    };
-  }
-  return {
-    text: buffer.toString("utf8"),
-    encoding: "utf-8-lossy",
-    invalidBytes,
-    binary: false
-  };
+  readOrder.push(
+    `${readOrder.length + 1}. Check \`manifest.validation.status\` before trusting the snapshot; \`snapshot validate\` re-checks it against disk.`
+  );
+  lines.push("", "## AI Agent Ingestion Guide", "", ...readOrder, "");
+  return lines.join("\n");
 }
-var BINARY_SCAN_BYTES = 8 * 1024 * 1024;
-var CHUNK = 64 * 1024;
-var SHAPE_SAMPLE_BYTES = 4096;
-function isBinaryFile(absolutePath) {
-  if (isBinaryExtension(absolutePath)) return true;
-  let fd;
-  try {
-    fd = fs14.openSync(absolutePath, "r");
-    const buffer = Buffer.alloc(CHUNK);
-    let sample;
-    let position = 0;
-    while (position < BINARY_SCAN_BYTES) {
-      const wanted = Math.min(CHUNK, BINARY_SCAN_BYTES - position);
-      const bytesRead = fs14.readSync(fd, buffer, 0, wanted, position);
-      if (bytesRead === 0) return false;
-      const chunk = buffer.subarray(0, bytesRead);
-      if (sample === void 0) {
-        sample = Buffer.from(chunk.subarray(0, SHAPE_SAMPLE_BYTES));
-      }
-      if (chunk.includes(0)) {
-        const shape = readBomEncoding(sample) ?? looksLikeUtf16(sample);
-        return shape === null;
+
+// src/generator/tree.ts
+var MAX_TREE_LINES = 2e4;
+var MAX_TREE_DEPTH = 512;
+function childKeys(node) {
+  return Array.from(node.children.keys()).sort((a, b) => {
+    const aIsDir = node.children.get(a).children.size > 0;
+    const bIsDir = node.children.get(b).children.size > 0;
+    if (aIsDir !== bIsDir) return aIsDir ? -1 : 1;
+    return a < b ? -1 : a > b ? 1 : 0;
+  });
+}
+function generateProjectTree(filePaths) {
+  const root = { children: /* @__PURE__ */ new Map() };
+  for (const filePath of filePaths) {
+    const parts = filePath.split("/").filter((part) => part.length > 0);
+    let current = root;
+    for (const part of parts) {
+      let child = current.children.get(part);
+      if (!child) {
+        child = { children: /* @__PURE__ */ new Map() };
+        current.children.set(part, child);
       }
-      position += bytesRead;
+      current = child;
     }
-    return false;
-  } catch {
-    return false;
-  } finally {
-    if (fd !== void 0) {
-      try {
-        fs14.closeSync(fd);
-      } catch {
-      }
+  }
+  const lines = ["."];
+  let truncatedAt = -1;
+  let depthTruncated = false;
+  const stack = [{ node: root, prefix: "", depth: 0, keys: childKeys(root), index: 0 }];
+  while (stack.length > 0) {
+    const frame = stack[stack.length - 1];
+    if (frame.index >= frame.keys.length) {
+      stack.pop();
+      continue;
+    }
+    const key = frame.keys[frame.index];
+    frame.index += 1;
+    const isLast = frame.index === frame.keys.length;
+    const child = frame.node.children.get(key);
+    const isDirectory = child.children.size > 0;
+    const label = escapeControls(key);
+    lines.push(`${frame.prefix}${isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "}${label}${isDirectory ? "/" : ""}`);
+    if (lines.length >= MAX_TREE_LINES) {
+      truncatedAt = lines.length;
+      break;
+    }
+    if (!isDirectory) continue;
+    if (frame.depth + 1 > MAX_TREE_DEPTH) {
+      depthTruncated = true;
+      continue;
     }
+    stack.push({
+      node: child,
+      prefix: frame.prefix + (isLast ? "    " : "\u2502   "),
+      depth: frame.depth + 1,
+      keys: childKeys(child),
+      index: 0
+    });
+  }
+  if (truncatedAt !== -1) {
+    lines.push(`... [tree truncated at ${MAX_TREE_LINES} lines] ...`);
+  } else if (depthTruncated) {
+    lines.push(`... [tree truncated at ${MAX_TREE_DEPTH} levels] ...`);
   }
+  const fence = fenceForText(lines.join("\n"), 3);
+  return ["# Project Tree", "", `${fence}text`, ...lines, fence, ""].join("\n");
 }
 function gitPaths(cwd, args) {
   let output;
@@ -5711,6 +6170,10 @@ var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mjs",
   ".cjs"
 ]);
+var PYTHON_EXTENSIONS = /* @__PURE__ */ new Set([".py", ".pyi"]);
+var RUBY_EXTENSIONS = /* @__PURE__ */ new Set([".rb", ".rake", ".gemspec"]);
+var C_EXTENSIONS = /* @__PURE__ */ new Set([".c", ".h", ".cc", ".cpp", ".cxx", ".hpp", ".hxx", ".m", ".mm"]);
+var PYTHON_SUFFIXES = [".py", ".pyi", "/__init__.py", "/__init__.pyi"];
 function buildImportResolver(files) {
   const byPath = /* @__PURE__ */ new Map();
   const byPathFolded = /* @__PURE__ */ new Map();
@@ -5737,11 +6200,45 @@ function buildImportResolver(files) {
   return { byPath, byPathFolded, byStem, byStemFolded };
 }
 function resolveSpecifier(fromFile, specifier, resolver) {
+  const extension = path16.posix.extname(fromFile).toLowerCase();
+  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
+  const firstOf = (candidates) => {
+    for (const candidate of candidates) {
+      const hit = exact(candidate);
+      if (hit) return hit;
+    }
+    return null;
+  };
+  if (PYTHON_EXTENSIONS.has(extension) && specifier.startsWith(".")) {
+    const dots = /^\.+/.exec(specifier)?.[0].length ?? 0;
+    const rest = specifier.slice(dots).replace(/\./g, "/");
+    let base = path16.posix.dirname(fromFile);
+    for (let up = 1; up < dots; up += 1) base = path16.posix.dirname(base);
+    const joined2 = rest ? path16.posix.normalize(path16.posix.join(base, rest)) : base;
+    return firstOf([joined2, ...PYTHON_SUFFIXES.map((suffix) => `${joined2}${suffix}`)]);
+  }
+  if (RUBY_EXTENSIONS.has(extension) && specifier.startsWith("./")) {
+    const joined2 = path16.posix.normalize(
+      path16.posix.join(path16.posix.dirname(fromFile), specifier)
+    );
+    return firstOf([`${joined2}.rb`, joined2]);
+  }
+  if (C_EXTENSIONS.has(extension) && specifier.startsWith("./")) {
+    const joined2 = path16.posix.normalize(
+      path16.posix.join(path16.posix.dirname(fromFile), specifier)
+    );
+    return exact(joined2);
+  }
+  if (extension === ".dart" && !specifier.includes(":")) {
+    const joined2 = path16.posix.normalize(
+      path16.posix.join(path16.posix.dirname(fromFile), specifier)
+    );
+    return firstOf([joined2, `${joined2}.dart`]);
+  }
   if (!RELATIVE_SPECIFIER.test(specifier)) return null;
   const joined = path16.posix.normalize(
     path16.posix.join(path16.posix.dirname(fromFile), specifier)
   );
-  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
   const direct = exact(joined);
   if (direct) return direct;
   for (const suffix of IMPORT_CANDIDATE_SUFFIXES) {
@@ -5822,28 +6319,6 @@ function detectLanguage(filePath) {
   const ext = path16.posix.extname(base).toLowerCase();
   return LANGUAGE_BY_EXTENSION[ext] ?? "text";
 }
-var TS_SOURCE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
-var isTsSource = (relativePath) => {
-  const lower = relativePath.toLowerCase();
-  return TS_SOURCE_EXTENSIONS.some((extension) => lower.endsWith(extension));
-};
-function importsOfText(relativePath, text2) {
-  if (isTsSource(relativePath)) return summarizeTypeScriptSource(relativePath, text2).imports;
-  return summarizeWithProfile(relativePath, text2)?.summary.imports ?? [];
-}
-function importsOfFile(relativePath, absolutePath) {
-  let buffer;
-  try {
-    buffer = fs14.readFileSync(absolutePath);
-  } catch {
-    return [];
-  }
-  const decoded = decodeText(buffer);
-  if (decoded.binary) return [];
-  return importsOfText(relativePath, decoded.text);
-}
-
-// src/validator/validate.ts
 function maskedPath(value, secretRules) {
   return findSecretInPath(value, secretRules)?.masked ?? value;
 }
@@ -5964,9 +6439,13 @@ function describeManifestShapeProblem(value) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
       return 'a "parts" entry is not an object';
     }
-    if (typeof entry.filename !== "string") {
+    const filename = entry.filename;
+    if (typeof filename !== "string" || filename.trim() === "") {
       return 'a "parts" entry has no "filename"';
     }
+    if (filename.includes("/") || filename.includes("\\") || filename.includes("\0") || filename === "." || filename === ".." || path16.isAbsolute(filename)) {
+      return 'a "parts" entry "filename" must be a bare filename inside parts/';
+    }
   }
   if (!candidate.layers || typeof candidate.layers !== "object" || Array.isArray(candidate.layers)) {
     return 'missing "layers" object';
@@ -6077,7 +6556,7 @@ function validateSnapshot(configInput) {
   });
   for (const diskFile of collection.files) {
     const snapshotHash = manifestFileMap.get(diskFile);
-    if (!snapshotHash) {
+    if (snapshotHash === void 0) {
       const skipReason = skippedReasonOnDisk(diskFile);
       if (skipReason === "unchanged") {
         if (unchangedScope !== null) {
@@ -6091,6 +6570,11 @@ function validateSnapshot(configInput) {
       drift.missingInSnapshot.push(diskFile);
       continue;
     }
+    if (unchangedScope !== null && !unchangedScope.has(diskFile) && !becameDependent(diskFile)) {
+      drift.configMismatches.push(
+        `scope: ${maskedPath(diskFile, config.secretRules)} is in the snapshot but is no longer in the changed-files scope`
+      );
+    }
     let diskHash;
     try {
       diskHash = sha256Hex(fs14.readFileSync(path16.join(config.cwd, diskFile)));
@@ -6231,6 +6715,41 @@ function validateSnapshot(configInput) {
         `includeSensitiveFiles: manifest ${recorded.includeSensitiveFiles} vs current ${config.includeSensitiveFiles}`
       );
     }
+    if ((recorded.maxPartTokens ?? void 0) !== (config.maxPartTokens ?? void 0)) {
+      drift.configMismatches.push(
+        `maxPartTokens: manifest ${String(recorded.maxPartTokens ?? "unset")} vs current ${String(config.maxPartTokens ?? "unset")}`
+      );
+    }
+    if ((recorded.maxMonolithBytes ?? null) !== (config.maxMonolithBytes ?? null)) {
+      drift.configMismatches.push(
+        `maxMonolithBytes: manifest ${String(recorded.maxMonolithBytes ?? null)} vs current ${String(config.maxMonolithBytes ?? null)}`
+      );
+    }
+    if (Boolean(recorded.skeleton) !== Boolean(config.skeleton)) {
+      drift.configMismatches.push(
+        `skeleton: manifest ${Boolean(recorded.skeleton)} vs current ${Boolean(config.skeleton)}`
+      );
+    }
+    if (Boolean(recorded.sarif) !== Boolean(config.sarif)) {
+      drift.configMismatches.push(
+        `sarif: manifest ${Boolean(recorded.sarif)} vs current ${Boolean(config.sarif)}`
+      );
+    }
+    if ((recorded.changedSince ?? void 0) !== (config.changedSince ?? void 0)) {
+      drift.configMismatches.push(
+        `changedSince: manifest ${String(recorded.changedSince ?? "unset")} vs current ${String(config.changedSince ?? "unset")}`
+      );
+    }
+    if (Boolean(recorded.staged) !== Boolean(config.staged)) {
+      drift.configMismatches.push(
+        `staged: manifest ${Boolean(recorded.staged)} vs current ${Boolean(config.staged)}`
+      );
+    }
+    if (Boolean(recorded.withDependents) !== Boolean(config.withDependents)) {
+      drift.configMismatches.push(
+        `withDependents: manifest ${Boolean(recorded.withDependents)} vs current ${Boolean(config.withDependents)}`
+      );
+    }
     const effectiveDiscovery = config.discovery ?? "auto";
     const recordedDiscovery = recorded.discovery;
     if (recordedDiscovery !== void 0 && recordedDiscovery !== effectiveDiscovery) {
@@ -6451,7 +6970,7 @@ function validateSnapshot(configInput) {
 
 // src/version.ts
 var GENERATOR_NAME = "codebase-snapshot";
-var GENERATOR_VERSION = "0.9.12";
+var GENERATOR_VERSION = "0.9.14";
 var LEGACY_GENERATOR_NAMES = ["@ankurhalder/codebase-snapshot"];
 function isOurGeneratorName(name) {
   if (typeof name !== "string") return false;
@@ -6478,22 +6997,28 @@ function updateCommand(kind) {
   if (kind === "local") return "npm install codebase-snapshot@latest";
   return "npm install -g codebase-snapshot";
 }
-function versionParts(value) {
-  const core = value.trim().replace(/^v/i, "").split("-")[0];
-  return core.split(".").map((part) => {
+function parseSemver(value) {
+  const cleaned = value.trim().replace(/^v/i, "").split("+")[0] ?? "";
+  const dash = cleaned.indexOf("-");
+  const corePart = dash === -1 ? cleaned : cleaned.slice(0, dash);
+  const prerelease = dash === -1 ? null : cleaned.slice(dash + 1);
+  const core = corePart.split(".").map((part) => {
     const parsed = Number(part);
     return Number.isFinite(parsed) ? parsed : 0;
   });
+  return { core, prerelease };
 }
 function isNewer(candidate, current) {
-  const left = versionParts(candidate);
-  const right = versionParts(current);
-  const length = Math.max(left.length, right.length);
+  const left = parseSemver(candidate);
+  const right = parseSemver(current);
+  if (left.prerelease !== null && right.prerelease === null) return false;
+  const length = Math.max(left.core.length, right.core.length);
   for (let index = 0; index < length; index += 1) {
-    const a = left[index] ?? 0;
-    const b = right[index] ?? 0;
+    const a = left.core[index] ?? 0;
+    const b = right.core[index] ?? 0;
     if (a !== b) return a > b;
   }
+  if (left.prerelease === null && right.prerelease !== null) return true;
   return false;
 }
 function cacheDirectory(env = process.env, platform = process.platform) {
@@ -6561,14 +7086,22 @@ function writeCache(file, entry) {
   }
 }
 function fetchLatestVersion(url = PACKAGE_LATEST_URL, timeoutMs = REQUEST_TIMEOUT_MS) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let settled = false;
+    let request = null;
     const finish = (value) => {
       if (settled) return;
       settled = true;
-      resolve5(value);
+      clearTimeout(deadline);
+      resolve6(value);
     };
-    const request = https.get(
+    const deadline = setTimeout(() => {
+      request?.destroy();
+      finish(null);
+    }, timeoutMs);
+    deadline.unref();
+    const transport = url.startsWith("http:") ? http : https;
+    request = transport.get(
       url,
       {
         headers: {
@@ -6587,7 +7120,7 @@ function fetchLatestVersion(url = PACKAGE_LATEST_URL, timeoutMs = REQUEST_TIMEOU
         response.on("data", (chunk) => {
           body += chunk;
           if (body.length > 64 * 1024) {
-            request.destroy();
+            request?.destroy();
             finish(null);
           }
         });
@@ -6602,10 +7135,6 @@ function fetchLatestVersion(url = PACKAGE_LATEST_URL, timeoutMs = REQUEST_TIMEOU
       }
     );
     request.on("error", () => finish(null));
-    request.setTimeout(timeoutMs, () => {
-      request.destroy();
-      finish(null);
-    });
   });
 }
 async function checkForUpdate(options) {
@@ -6649,10 +7178,13 @@ function describeMatcher(matcher) {
   return String(matcher);
 }
 function normalizeTarget(cwd, target) {
-  const absolute = path16.resolve(cwd, target);
-  const relative8 = path16.relative(cwd, absolute);
-  if (relative8.startsWith("..") || path16.isAbsolute(relative8)) return target;
-  return relative8.split(path16.sep).join("/");
+  const resolvedCwd = path16.resolve(cwd);
+  const absolute = path16.resolve(resolvedCwd, target);
+  const relative8 = path16.relative(resolvedCwd, absolute);
+  if (relative8 === "" || relative8 === ".." || relative8.startsWith(`..${path16.sep}`) || path16.isAbsolute(relative8)) {
+    return { relative: target.replace(/\\/g, "/"), outsideRoot: true };
+  }
+  return { relative: relative8.split(path16.sep).join("/"), outsideRoot: false };
 }
 function findRuleMatch(rules, relativePath) {
   return rules.find(
@@ -6679,9 +7211,19 @@ function readManifest2(config) {
   }
 }
 function explainPath(config, target) {
-  const relative8 = normalizeTarget(config.cwd, target);
-  const absolute = path16.join(config.cwd, relative8);
+  const normalized = normalizeTarget(config.cwd, target);
+  const relative8 = normalized.relative;
   const maskedPath2 = findSecretInPath(relative8, config.secretRules)?.masked ?? relative8;
+  if (normalized.outsideRoot) {
+    return {
+      path: maskedPath2,
+      exists: false,
+      included: false,
+      reason: "outside-root",
+      detail: "path resolves outside the configured repository root and was not inspected"
+    };
+  }
+  const absolute = path16.join(config.cwd, relative8);
   const result = {
     path: maskedPath2,
     exists: fs14.existsSync(absolute),
@@ -7319,6 +7861,24 @@ function displayWidth(line) {
   return width;
 }
 var GUTTER_PATTERN = /^[ \t]*(?:[❯◆◻◼▏✖][ \t]+)*/;
+function sliceByDisplayWidth(text2, maxCells) {
+  let cells = 0;
+  let lastSpace = -1;
+  let index = 0;
+  for (const character of text2) {
+    const width = isWideCodePoint(character.codePointAt(0) ?? 0) ? 2 : 1;
+    if (cells + width > maxCells) break;
+    if (character === " ") lastSpace = index;
+    cells += width;
+    index += character.length;
+  }
+  if (index >= text2.length) return { head: text2, tail: "" };
+  if (lastSpace > 0) {
+    return { head: text2.slice(0, lastSpace), tail: text2.slice(lastSpace + 1).trimStart() };
+  }
+  const safeIndex = index > 0 ? index : Array.from(text2)[0]?.length ?? 1;
+  return { head: text2.slice(0, safeIndex), tail: text2.slice(safeIndex).trimStart() };
+}
 function wrapOneLine(line, limit) {
   if (displayWidth(line) <= limit) return [line];
   const gutter = GUTTER_PATTERN.exec(line)?.[0] ?? "";
@@ -7333,12 +7893,11 @@ function wrapOneLine(line, limit) {
       rows.push(prefix + rest);
       break;
     }
-    let cut = room;
-    const space = rest.slice(0, room).lastIndexOf(" ");
-    if (space > 0) cut = space;
-    const taken = rest.slice(0, cut).trimEnd();
-    rows.push(`${prefix}${taken.length > 0 ? taken : rest.slice(0, cut)}`);
-    rest = rest.slice(cut).trimStart();
+    const { head, tail } = sliceByDisplayWidth(rest, room);
+    rows.push(
+      `${prefix}${head.length > 0 ? head : rest.slice(0, 1)}`
+    );
+    rest = tail;
     prefix = continuation;
   }
   return rows;
@@ -7409,7 +7968,7 @@ function keyReader(input) {
     next() {
       const queued = queue.shift();
       if (queued) return Promise.resolve(queued);
-      return new Promise((resolve5) => waiters.push(resolve5));
+      return new Promise((resolve6) => waiters.push(resolve6));
     },
     close() {
       input.off("keypress", onKey);
@@ -7626,17 +8185,25 @@ var CONFIG_CANDIDATES = [
   ".snapshotrc.json",
   ".snapshotrc"
 ];
-function chooseConfigFileName(cwd) {
-  if (!supportsTypeScriptImports()) return "snapshot.config.mjs";
-  const pkgPath = path16.join(cwd, "package.json");
-  if (!fs14.existsSync(pkgPath)) return "snapshot.config.mjs";
+function parsePackageJson(raw) {
+  const parsed = JSON.parse(stripJsonComments(raw));
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("package.json is not a JSON object");
+  }
+  return parsed;
+}
+function readPackageJson(cwd) {
   try {
-    const parsed = JSON.parse(fs14.readFileSync(pkgPath, "utf8"));
-    return parsed.type === "module" ? "snapshot.config.ts" : "snapshot.config.mjs";
+    return parsePackageJson(fs14.readFileSync(path16.join(cwd, "package.json"), "utf8"));
   } catch {
-    return "snapshot.config.mjs";
+    return null;
   }
 }
+function chooseConfigFileName(cwd) {
+  if (!supportsTypeScriptImports()) return "snapshot.config.mjs";
+  const parsed = readPackageJson(cwd);
+  return parsed?.type === "module" ? "snapshot.config.ts" : "snapshot.config.mjs";
+}
 var SIZE_CHOICES = [
   { value: "60k", label: "Small", hint: "60 KB \xB7 ~15k tokens \xB7 tight context windows" },
   { value: "120k", label: "Medium", hint: "120 KB \xB7 ~30k tokens \xB7 recommended" },
@@ -7644,12 +8211,9 @@ var SIZE_CHOICES = [
   { value: "custom", label: "Custom\u2026", hint: "type a size like 150k or 1.5mb" }
 ];
 function packageJsonHasConfig(cwd) {
-  try {
-    const parsed = JSON.parse(fs14.readFileSync(path16.join(cwd, "package.json"), "utf8"));
-    return typeof parsed.snapshot === "object" && parsed.snapshot !== null && !Array.isArray(parsed.snapshot);
-  } catch {
-    return false;
-  }
+  const parsed = readPackageJson(cwd);
+  if (parsed === null) return false;
+  return typeof parsed.snapshot === "object" && parsed.snapshot !== null && !Array.isArray(parsed.snapshot);
 }
 function artifactAnswers(options) {
   const artifacts = { ...DEFAULT_ANSWERS.artifacts };
@@ -7690,12 +8254,7 @@ function writeFileOrExplain(target, content) {
 function canWriteModuleConfig(name, cwd) {
   if (name.endsWith(".mjs") || name.endsWith(".ts")) return true;
   if (!name.endsWith(".js")) return false;
-  try {
-    const parsed = JSON.parse(fs14.readFileSync(path16.join(cwd, "package.json"), "utf8"));
-    return parsed.type === "module";
-  } catch {
-    return false;
-  }
+  return readPackageJson(cwd)?.type === "module";
 }
 function configFormatLabel(name) {
   if (name.endsWith(".js")) return 'CommonJS `.js` (package.json has no "type": "module")';
@@ -7723,7 +8282,8 @@ function serializePackageJson(raw, value) {
   const crlf = raw.includes("\r\n");
   const body = JSON.stringify(value, null, spacing);
   const text2 = crlf ? body.replace(/\n/g, "\r\n") : body;
-  return `${text2}${raw.endsWith("\n") ? crlf ? "\r\n" : "\n" : ""}`;
+  const bom = raw.startsWith("\uFEFF") ? "\uFEFF" : "";
+  return `${bom}${text2}${raw.endsWith("\n") ? crlf ? "\r\n" : "\n" : ""}`;
 }
 function updatePackageJson(cwd, notes) {
   const packagePath = path16.join(cwd, "package.json");
@@ -7739,7 +8299,7 @@ function updatePackageJson(cwd, notes) {
   let parsed;
   try {
     raw = fs14.readFileSync(packagePath, "utf8");
-    parsed = JSON.parse(raw);
+    parsed = parsePackageJson(raw);
   } catch {
     notes.push("Could not parse package.json; npm scripts and the devDependency were not added.");
     return unchanged;
@@ -8278,7 +8838,10 @@ const { parentPort, workerData } = require("node:worker_threads");
       parentPort.postMessage({ ok: false, message: loaded.errors.join("; ") });
       return;
     }
-    const config = mod.resolveConfig(loaded.config, workerData.cliOptions, workerData.cwd);
+    // \`hooks: {}\` is a value, not an absence: the config is applied with the hook list emptied,
+    // so the run is the documented MCP run rather than the CLI run with one setting removed.
+    const base = loaded.config ? { ...loaded.config, hooks: {} } : null;
+    const config = mod.resolveConfig(base, workerData.cliOptions, workerData.cwd);
     const manifest = mod.generateSnapshot(config);
     parentPort.postMessage({
       ok: true,
@@ -8301,14 +8864,15 @@ const { parentPort, workerData } = require("node:worker_threads");
 })();
 `;
 function generateInWorker(cwd, cliOptions) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let settled = false;
+    let worker = null;
     const finish = (result) => {
       if (settled) return;
       settled = true;
-      resolve5(result);
+      if (worker !== null) void worker.terminate();
+      resolve6(result);
     };
-    let worker;
     const isCjs = typeof __dirname !== "undefined";
     const directory = isCjs ? __dirname : path16.dirname(fileURLToPath(import.meta.url));
     try {
@@ -8341,7 +8905,100 @@ function generateInWorker(cwd, cliOptions) {
 
 // src/index.ts
 var SCHEMA_VERSION = "3.0.0";
-var SUMMARY_MAX_SOURCE_BYTES = 2 * 1024 * 1024;
+var SUMMARY_MAX_SOURCE_BYTES2 = SUMMARY_MAX_SOURCE_BYTES;
+var FILE_DERIVATIONS = /* @__PURE__ */ new Map();
+var FILE_DERIVATION_LIMIT_BYTES = 64 * 1024 * 1024;
+var fileDerivationBytes = 0;
+function takeDerivation(path17, hash, settings) {
+  const cached = FILE_DERIVATIONS.get(path17);
+  if (cached === void 0 || cached.hash !== hash || cached.settings !== settings) return void 0;
+  return cached;
+}
+function rememberDerivation(path17, hash, settings, derivation) {
+  const bodyBytes = derivation.finalContent === derivation.redacted ? derivation.redacted.length : derivation.redacted.length + derivation.finalContent.length;
+  const bytes = bodyBytes * 2 + 512;
+  if (bytes > FILE_DERIVATION_LIMIT_BYTES / 4) return;
+  while (fileDerivationBytes + bytes > FILE_DERIVATION_LIMIT_BYTES) {
+    const oldest = FILE_DERIVATIONS.keys().next();
+    if (oldest.done === true) break;
+    const evicted = FILE_DERIVATIONS.get(oldest.value);
+    FILE_DERIVATIONS.delete(oldest.value);
+    if (evicted !== void 0) fileDerivationBytes -= evicted.bytes;
+  }
+  FILE_DERIVATIONS.set(path17, { ...derivation, hash, settings, bytes });
+  fileDerivationBytes += bytes;
+}
+function derivationSettings(config) {
+  const rules = config.secretRules.map(
+    (rule) => `${rule.rule}\0${rule.pattern.source}\0${rule.pattern.flags}\0${rule.valueGroup ?? ""}`
+  ).join("
");
+  return `${GENERATOR_VERSION}${configDigest(config)}${sha256Hex2(rules)}`;
+}
+function deriveFile(relativePath, rawContent, sizeBytes, config) {
+  const lineCount = countLines(rawContent);
+  const { redacted, findings } = scanAndRedactSecrets(rawContent, config.secretRules, relativePath);
+  const isLarge = sizeBytes > config.largeFileBytes;
+  let finalContent = redacted;
+  let isPreviewTruncated = false;
+  let includedLines = lineCount;
+  let inclusionMode = "full";
+  if (config.skeleton === true && isSkeletonizable(relativePath)) {
+    const skeleton = skeletonizeTypeScript(redacted, relativePath);
+    if (skeleton.collapsed > 0) {
+      finalContent = skeleton.text;
+      inclusionMode = "signatures";
+      includedLines = countLines(skeleton.text);
+    }
+  }
+  if (isLarge && inclusionMode !== "signatures") {
+    const preview = truncatePreview(redacted, config.previewHeadLines, config.previewTailLines);
+    finalContent = preview.content;
+    isPreviewTruncated = preview.isTruncated;
+    includedLines = preview.includedLines;
+    inclusionMode = isPreviewTruncated ? "preview" : "full";
+  }
+  let summary;
+  let summaryQuality;
+  let summarySkip = null;
+  let summaryWarning = null;
+  let dependentImports = null;
+  if (Buffer.byteLength(rawContent, "utf8") > SUMMARY_MAX_SOURCE_BYTES2) {
+    summarySkip = "oversize";
+    dependentImports = [];
+  } else if (isPreviewTruncated && hasStructuralSummary(relativePath)) {
+    summarySkip = "preview";
+    dependentImports = importsOfText(relativePath, rawContent);
+  } else {
+    try {
+      const outcome = summarizeFile(relativePath, rawContent);
+      summary = outcome?.summary ? maskSummaryStrings(outcome.summary, config.secretRules) : void 0;
+      summaryQuality = outcome?.quality;
+      if (isSourceSummary(summary) && summary.parseErrors) {
+        summaryWarning = `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`;
+      }
+    } catch (err) {
+      summaryWarning = `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(
+        /\s+/g,
+        " "
+      );
+    }
+  }
+  return {
+    redacted,
+    findings,
+    lineCount,
+    finalContent,
+    inclusionMode,
+    isPreviewTruncated,
+    includedLines,
+    isLarge,
+    summary,
+    summaryQuality,
+    summarySkip,
+    summaryWarning,
+    dependentImports
+  };
+}
 function sha256Hex2(input) {
   return crypto2.createHash("sha256").update(input).digest("hex");
 }
@@ -8885,10 +9542,7 @@ function acquireRunLock(stagingRoot) {
       };
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
-      if (attempt === 0 && lockOwnerIsGone(lockPath)) {
-        fs14.rmSync(lockPath, { force: true });
-        continue;
-      }
+      if (attempt === 0 && reclaimStaleLock(lockPath)) continue;
       throw new Error(
         `Another generate run is already using the staging directory ${stagingRoot}. Wait for it to finish, or delete ${lockPath} if no other run is active.`
       );
@@ -8897,14 +9551,25 @@ function acquireRunLock(stagingRoot) {
   throw new Error(`Could not acquire the generate lock for ${stagingRoot}.`);
 }
 function lockKeyFor(stagingRoot) {
-  let key = stagingRoot;
-  try {
-    key = fs14.realpathSync(stagingRoot);
-  } catch {
-  }
+  let key = canonicalLockTarget(stagingRoot);
   if (process.platform === "win32" || process.platform === "darwin") key = key.toLowerCase();
   return sha256Hex2(key).slice(0, 16);
 }
+function canonicalLockTarget(targetPath) {
+  const resolved = path16.resolve(targetPath);
+  let existing = resolved;
+  const tail = [];
+  for (; ; ) {
+    try {
+      return path16.join(fs14.realpathSync(existing), ...tail);
+    } catch {
+      const parent = path16.dirname(existing);
+      if (parent === existing) return resolved;
+      tail.unshift(path16.basename(existing));
+      existing = parent;
+    }
+  }
+}
 function lockPathFor(stagingRoot) {
   return path16.join(os.tmpdir(), `codebase-snapshot-${lockKeyFor(stagingRoot)}.lock`);
 }
@@ -8929,6 +9594,24 @@ function lockOwnerIsGone(lockPath) {
     return err.code === "ESRCH";
   }
 }
+function reclaimStaleLock(lockPath) {
+  let before;
+  try {
+    before = fs14.statSync(lockPath);
+  } catch {
+    return true;
+  }
+  if (!lockOwnerIsGone(lockPath)) return false;
+  try {
+    const current = fs14.statSync(lockPath);
+    const sameFile = current.ino === before.ino && current.birthtimeMs === before.birthtimeMs && current.mtimeMs === before.mtimeMs;
+    if (!sameFile) return false;
+    fs14.rmSync(lockPath, { force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function lockFileIsAncient(lockPath) {
   try {
     return Date.now() - fs14.statSync(lockPath).mtimeMs > STALE_RUN_MS;
@@ -8986,7 +9669,6 @@ function swapOnce(stagingDir, outDir) {
         throw copyErr;
       }
     }
-    if (hadPrevious) fs14.rmSync(backupDir, { recursive: true, force: true });
   } catch (err) {
     if (hadPrevious && fs14.existsSync(backupDir)) {
       if (fs14.existsSync(outDir)) fs14.rmSync(outDir, { recursive: true, force: true });
@@ -8994,6 +9676,16 @@ function swapOnce(stagingDir, outDir) {
     }
     throw err;
   }
+  if (hadPrevious) {
+    try {
+      fs14.rmSync(backupDir, { recursive: true, force: true });
+    } catch (err) {
+      process.stderr.write(
+        `\u26A0 The previous snapshot could not be removed from ${backupDir} (${err.message}). The new snapshot is in place; delete that directory by hand when convenient.
+`
+      );
+    }
+  }
 }
 function sleepSync(milliseconds) {
   const buffer = new Int32Array(new SharedArrayBuffer(4));
@@ -9016,22 +9708,18 @@ function artifactWarnings(artifacts, sarif) {
   }
   return messages;
 }
+function installHookStdoutRedirect() {
+  return installStdoutRouter();
+}
 function runAfterGenerate(config, manifest) {
   const hook = config.hooks.afterGenerate;
   if (!hook) return null;
-  const stdoutWrite = process.stdout.write.bind(process.stdout);
-  const stderrWrite = process.stderr.write.bind(process.stderr);
-  const hookScope = new AsyncLocalStorage();
-  const patchedWrite = ((...args) => hookScope.getStore() === true ? stderrWrite(...args) : stdoutWrite(...args));
-  const restoreStdout = () => {
-    if (process.stdout.write === patchedWrite) process.stdout.write = stdoutWrite;
-  };
+  const releaseRedirect = installHookStdoutRedirect();
   let returned;
   try {
-    process.stdout.write = patchedWrite;
-    returned = hookScope.run(true, () => hook(manifest));
+    returned = hookStdoutScope.run(true, () => hook(manifest));
   } catch (err) {
-    restoreStdout();
+    releaseRedirect();
     const message = maskPathText(err.message, config.secretRules);
     manifest.warnings.push(`hooks.afterGenerate failed: ${message}`);
     manifest.totals.warningCount = manifest.warnings.length;
@@ -9039,10 +9727,10 @@ function runAfterGenerate(config, manifest) {
   }
   const thenable = returned;
   if (!thenable || typeof thenable.then !== "function") {
-    restoreStdout();
+    releaseRedirect();
     return null;
   }
-  return Promise.resolve(returned).finally(restoreStdout);
+  return Promise.resolve(returned).finally(releaseRedirect);
 }
 function partitionByBudget(files, config, fingerprint) {
   const budgetFor = (file) => config.budgets.byLayer[file.layer] ?? config.budgets.default;
@@ -9053,23 +9741,14 @@ function partitionByBudget(files, config, fingerprint) {
     if (bucket) bucket.push(file);
     else buckets.set(budget, [file]);
   }
-  if (buckets.size <= 1) {
-    const only = buckets.size === 1 ? Array.from(buckets.keys())[0] : config.maxPartBytes;
-    return partitionFiles(files, only, fingerprint);
+  if (buckets.size === 0) return [];
+  if (buckets.size === 1) {
+    return partitionFiles(files, Array.from(buckets.keys())[0], fingerprint);
   }
-  const parts = [];
-  for (const budget of Array.from(buckets.keys()).sort((a, b) => a - b)) {
-    parts.push(...partitionFiles(buckets.get(budget) ?? [], budget, fingerprint));
-  }
-  const merged = renumberParts(parts, fingerprint);
-  const byPath = new Map(files.map((file) => [file.relativePath, file]));
-  for (const part of merged) {
-    for (const included of part.metadata.includedFiles) {
-      const file = byPath.get(included.relativePath);
-      if (file) file.part = part.filename;
-    }
-  }
-  return merged;
+  return partitionFilesForBuckets(
+    Array.from(buckets.entries()).sort(([left], [right]) => left - right).map(([budgetBytes, bucketFiles]) => ({ files: bucketFiles, budgetBytes })),
+    fingerprint
+  );
 }
 function generateSnapshot(configInput, options) {
   assertUsableConfigInput(configInput);
@@ -9101,6 +9780,7 @@ function generateSnapshot(configInput, options) {
     return false;
   }) : collection.files;
   const files = [];
+  const derivationKey = derivationSettings(config);
   const monolithBodies = /* @__PURE__ */ new Map();
   const skipped = maskSkipRecords([...collection.skipped], config.secretRules);
   const secretFindings = [];
@@ -9113,6 +9793,7 @@ function generateSnapshot(configInput, options) {
   const fileWarnings = [];
   const oversizeSummaryPaths = [];
   const previewSummaryPaths = [];
+  const skippedSummaryImports = /* @__PURE__ */ new Map();
   const layerCounts = {};
   const kindCounts = {};
   let totalLines = 0;
@@ -9177,8 +9858,6 @@ function generateSnapshot(configInput, options) {
     }
     const hashSha256 = sha256Hex2(buffer);
     const rawContent = decoded.text;
-    const lineCount = countLines(rawContent);
-    totalLines += lineCount;
     totalSizeBytes += stats.size;
     if (decoded.encoding !== "utf-8") {
       encodingNotes.push({
@@ -9192,66 +9871,25 @@ function generateSnapshot(configInput, options) {
     const language = detectLanguage(relativePath);
     bump(layerCounts, layer2);
     bump(kindCounts, kind);
-    const { redacted, findings } = scanAndRedactSecrets(
-      rawContent,
-      config.secretRules,
-      relativePath
-    );
-    secretFindings.push(...findings);
-    const isLarge = stats.size > config.largeFileBytes;
-    if (isLarge) largeFileCount += 1;
-    let finalContent = redacted;
-    let isPreviewTruncated = false;
-    let includedLines = lineCount;
-    let inclusionMode = "full";
-    if (config.skeleton === true && isSkeletonizable(relativePath)) {
-      const skeleton = skeletonizeTypeScript(redacted, relativePath);
-      if (skeleton.collapsed > 0) {
-        finalContent = skeleton.text;
-        inclusionMode = "signatures";
-        includedLines = countLines(skeleton.text);
-      }
-    }
-    if (isLarge && inclusionMode !== "signatures") {
-      const preview = truncatePreview(
-        redacted,
-        config.previewHeadLines,
-        config.previewTailLines
-      );
-      finalContent = preview.content;
-      isPreviewTruncated = preview.isTruncated;
-      includedLines = preview.includedLines;
-      inclusionMode = isPreviewTruncated ? "preview" : "full";
-    }
-    if (config.includeMonolith && (isPreviewTruncated || inclusionMode === "signatures")) {
-      monolithBodies.set(relativePath, redacted);
-    }
-    let summary;
-    let summaryQuality;
-    if (Buffer.byteLength(rawContent, "utf8") > SUMMARY_MAX_SOURCE_BYTES) {
-      oversizeSummaryPaths.push(relativePath);
-    } else if (isPreviewTruncated && hasStructuralSummary(relativePath)) {
-      previewSummaryPaths.push(relativePath);
-    } else {
-      try {
-        const outcome = summarizeFile(relativePath, rawContent);
-        summary = outcome?.summary ? maskSummaryStrings(outcome.summary, config.secretRules) : void 0;
-        summaryQuality = outcome?.quality;
-        if (isSourceSummary(summary) && summary.parseErrors) {
-          fileWarnings.push({
-            path: relativePath,
-            message: `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`
-          });
-        }
-      } catch (err) {
-        fileWarnings.push({
-          path: relativePath,
-          message: `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(
-            /\s+/g,
-            " "
-          )
-        });
-      }
+    const derivation = takeDerivation(absolutePath, hashSha256, derivationKey) ?? (() => {
+      const fresh = deriveFile(relativePath, rawContent, stats.size, config);
+      rememberDerivation(absolutePath, hashSha256, derivationKey, fresh);
+      return fresh;
+    })();
+    const { lineCount } = derivation;
+    totalLines += lineCount;
+    secretFindings.push(...derivation.findings);
+    if (derivation.isLarge) largeFileCount += 1;
+    if (derivation.summarySkip === "oversize") oversizeSummaryPaths.push(relativePath);
+    else if (derivation.summarySkip === "preview") previewSummaryPaths.push(relativePath);
+    if (derivation.dependentImports !== null) {
+      skippedSummaryImports.set(relativePath, derivation.dependentImports);
+    }
+    if (derivation.summaryWarning !== null) {
+      fileWarnings.push({ path: relativePath, message: derivation.summaryWarning });
+    }
+    if (config.includeMonolith && (derivation.isPreviewTruncated || derivation.inclusionMode === "signatures")) {
+      monolithBodies.set(relativePath, derivation.redacted);
     }
     files.push({
       relativePath,
@@ -9262,24 +9900,25 @@ function generateSnapshot(configInput, options) {
       layer: layer2,
       kind,
       language,
-      inclusionMode,
-      isLarge,
-      isPreviewTruncated,
+      inclusionMode: derivation.inclusionMode,
+      isLarge: derivation.isLarge,
+      isPreviewTruncated: derivation.isPreviewTruncated,
       originalLines: lineCount,
-      includedLines,
-      includedBytes: Buffer.byteLength(finalContent, "utf8"),
-      summary,
-      summaryQuality,
+      includedLines: derivation.includedLines,
+      includedBytes: Buffer.byteLength(derivation.finalContent, "utf8"),
+      summary: derivation.summary,
+      summaryQuality: derivation.summaryQuality,
       ...decoded.encoding === "utf-8" ? {} : { encoding: decoded.encoding },
-      content: finalContent
+      content: derivation.finalContent
     });
   }
   if (changedScope !== null && changedPaths !== null && config.withDependents === true) {
     const keep = new Set(changedPaths);
     const resolver = buildImportResolver(files);
     for (const file of files) {
-      if (!isSourceSummary(file.summary)) continue;
-      if (importsChangedFile(file.relativePath, file.summary.imports, changedPaths, resolver)) {
+      const fileImports = isSourceSummary(file.summary) ? file.summary.imports : skippedSummaryImports.get(file.relativePath) ?? [];
+      if (fileImports.length === 0) continue;
+      if (importsChangedFile(file.relativePath, fileImports, changedPaths, resolver)) {
         keep.add(file.relativePath);
       }
     }
@@ -9310,6 +9949,9 @@ function generateSnapshot(configInput, options) {
     for (const path17 of [...monolithBodies.keys()]) {
       if (!keep.has(path17)) monolithBodies.delete(path17);
     }
+    for (const path17 of [...skippedSummaryImports.keys()]) {
+      if (!keep.has(path17)) skippedSummaryImports.delete(path17);
+    }
   }
   if (changedScope !== null) {
     for (const relativePath of unchangedPaths) {
@@ -9345,7 +9987,7 @@ function generateSnapshot(configInput, options) {
     const shown = oversizeSummaryPaths.slice(0, ENCODING_PATHS_SHOWN).map((entry) => maskPathText(entry, config.secretRules));
     const hidden = oversizeSummaryPaths.length - ENCODING_PATHS_SHOWN;
     warnings.push(
-      `${oversizeSummaryPaths.length} file(s) exceed ${Math.round(SUMMARY_MAX_SOURCE_BYTES / (1024 * 1024))} MB and were not parsed for a structural summary: ${shown.join(", ")}${hidden > 0 ? ` and ${hidden} more` : ""}. Their bodies are emitted as head/tail previews.`
+      `${oversizeSummaryPaths.length} file(s) exceed ${Math.round(SUMMARY_MAX_SOURCE_BYTES2 / (1024 * 1024))} MB and were not parsed for a structural summary: ${shown.join(", ")}${hidden > 0 ? ` and ${hidden} more` : ""}. Their bodies are emitted as head/tail previews.`
     );
   }
   for (const [encoding, bucket] of encodingBuckets) {
@@ -9369,11 +10011,13 @@ function generateSnapshot(configInput, options) {
     ).join("\n")
   );
   const fullContents = /* @__PURE__ */ new Map();
-  for (const file of files) {
-    fullContents.set(
-      file.relativePath,
-      monolithBodies.get(file.relativePath) ?? file.content ?? ""
-    );
+  if (config.includeMonolith) {
+    for (const file of files) {
+      fullContents.set(
+        file.relativePath,
+        monolithBodies.get(file.relativePath) ?? file.content ?? ""
+      );
+    }
   }
   const parts = partitionByBudget(files, config, fingerprint);
   const truncatedPreviewCount = files.filter((file) => file.isPreviewTruncated).length;
@@ -9634,7 +10278,7 @@ function generateSnapshot(configInput, options) {
     };
     shipHookState();
     if (pendingHook) {
-      pendingHook.then(
+      const tracked = pendingHook.then(
         () => {
           try {
             shipHookState();
@@ -9653,8 +10297,10 @@ function generateSnapshot(configInput, options) {
           } catch {
           }
         }
-      );
-      pendingHooks.set(outDir, pendingHook);
+      ).finally(() => {
+        if (pendingHooks.get(outDir) === tracked) pendingHooks.delete(outDir);
+      });
+      pendingHooks.set(outDir, tracked);
     }
     return manifest;
   } catch (err) {
@@ -9672,15 +10318,15 @@ function generateSnapshot(configInput, options) {
 }
 var pendingHooks = /* @__PURE__ */ new Map();
 async function generateSnapshotAsync(configInput, options) {
-  const manifest = generateSnapshot(configInput, options);
+  assertUsableConfigInput(configInput);
   const config = isResolvedConfig(configInput) ? normalizeResolvedConfig(configInput) : resolveConfig(configInput ?? null);
+  const manifest = generateSnapshot(config, options);
   const { outDir } = resolveSafeOutputDirs(config);
   const pending = pendingHooks.get(outDir);
   if (pending !== void 0) {
-    pendingHooks.delete(outDir);
     await pending.catch(() => void 0);
   }
   return manifest;
 }
 
-export { ARTIFACT_NAMES, CHECK_INTERVAL_MS, CONFIG_KEYS, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, FAILURE_INTERVAL_MS, GENERATOR_NAME, GENERATOR_VERSION, HOOK_MARKER, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, MIN_MAX_PART_TOKENS, PACKAGE_LATEST_URL, PRESETS, PromptBack, PromptCancelled, REQUEST_TIMEOUT_MS, SCHEMA_VERSION, anchorForPath, appendGitignoreEntries, assertReplaceable, assertUsableConfigInput, buildImportResolver, bytesForTokens, cacheDirectory, cacheFilePath, checkForUpdate, classifyKind, classifyLayer, collectFiles, compareManifests, configDigest, countInvalidUtf8Bytes, countLines, decodeText, defaultIO, defineConfig, describeManifestShapeProblem, detectLanguage, detectPreset, displayPath, displayWidth, enforceBudget, escapeControls, estimateTokens, explainPath, fenceForContent, fenceForText, fetchLatestVersion, findConfigFile, findSecretInPath, firstRunMessage, formatNumber, formatTokens, formatUpdateNotice, generateInWorker, generateProjectTree, generateSarifReport, generateSnapshot, generateSnapshotAsync, getGitInfo, getPreset, gitignorePath, globToRegExp, hasPriorSnapshot, importsChangedFile, importsOfFile, importsOfText, installKind, installPreCommitHook, isBinaryBuffer, isBinaryExtension, isBinaryFile, isDiscoveryMode, isEffectivelyEmpty, isInteractive, isNewer, isResolvedConfig, isSensitivePath, isSkeletonizable, isTsxFileName, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, lockPathFor, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, planFirstRun, profileForPath, renderConfig, renderDiffText, renderExplainText, renumberParts, resolveChangedScope, resolveConfig, resolveSafeOutputDirs, resolveSpecifier, runInit, scanAndRedactSecrets, shouldCheck, skeletonizeTypeScript, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, unknownPresetMessage, updateCommand, validateSnapshot, workerEntry, wrapLines };
+export { ARTIFACT_NAMES, CHECK_INTERVAL_MS, CONFIG_KEYS, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, FAILURE_INTERVAL_MS, GENERATOR_NAME, GENERATOR_VERSION, HOOK_MARKER, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, MIN_MAX_PART_TOKENS, PACKAGE_LATEST_URL, PRESETS, PromptBack, PromptCancelled, REQUEST_TIMEOUT_MS, SCHEMA_VERSION, anchorForPath, appendGitignoreEntries, assertReplaceable, assertUsableConfigInput, buildImportResolver, bytesForTokens, cacheDirectory, cacheFilePath, checkForUpdate, classifyKind, classifyLayer, collectFiles, compareManifests, configDigest, countInvalidUtf8Bytes, countLines, decodeText, defaultIO, defineConfig, describeManifestShapeProblem, detectLanguage, detectPreset, displayPath, displayWidth, enforceBudget, escapeControls, estimateTokens, explainPath, fenceForContent, fenceForText, fetchLatestVersion, findConfigFile, findSecretInPath, firstRunMessage, formatNumber, formatTokens, formatUpdateNotice, generateInWorker, generateProjectTree, generateSarifReport, generateSnapshot, generateSnapshotAsync, getGitInfo, getPreset, gitignorePath, globToRegExp, hasPriorSnapshot, importsChangedFile, importsOfFile, importsOfText, installKind, installPreCommitHook, isBinaryBuffer, isBinaryExtension, isBinaryFile, isDiscoveryMode, isEffectivelyEmpty, isInteractive, isNewer, isResolvedConfig, isSensitivePath, isSkeletonizable, isTsxFileName, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, lockPathFor, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, planFirstRun, profileForPath, renderConfig, renderDiffText, renderExplainText, renumberParts, resolveChangedScope, resolveConfig, resolveSafeOutputDirs, resolveSpecifier, runInit, runWithStdoutCapture, scanAndRedactSecrets, shouldCheck, skeletonizeTypeScript, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, unknownPresetMessage, updateCommand, validateSnapshot, workerEntry, wrapLines };