codebase-snapshot 0.9.9 → 0.9.12

package/dist/{chunk-KUVFTJHK.js → chunk-3H45YMBG.js}

@@ -1,15 +1,17 @@
-import * as crypto from 'crypto';
+import * as crypto2 from 'crypto';
 import { createHash } from 'crypto';
 import { AsyncLocalStorage } from 'async_hooks';
-import * as fs12 from 'fs';
+import * as fs14 from 'fs';
 import * as os from 'os';
-import * as path13 from 'path';
+import * as path16 from 'path';
 import ts from 'typescript';
 import { createRequire } from 'module';
-import { pathToFileURL } from 'url';
+import { pathToFileURL, fileURLToPath } from 'url';
 import * as childProcess from 'child_process';
+import { execFileSync } from 'child_process';
 import * as https from 'https';
 import * as readline from 'readline';
+import { Worker } from 'worker_threads';
 
 // src/index.ts
 
@@ -125,6 +127,59 @@ var cfamilyProfile = {
   }
 };
 
+// src/ast/profiles/dart.ts
+var IMPORT = /^import\s+['"]([^'"]+)['"]/;
+var PART = /^part(?:\s+of)?\s+['"]?([\w./]+)['"]?/;
+var TYPE = /^(?:abstract\s+|base\s+|final\s+|sealed\s+|interface\s+)*(class|mixin|enum|extension|typedef)\s+([A-Za-z_]\w*)/;
+var FUNC = /^(?:Future<[^>]*>|Stream<[^>]*>|void|bool|int|double|num|String|dynamic|var|[A-Z][\w<>, ?]*)\s+([A-Za-z_]\w*)\s*[(<]/;
+var VARIABLE = /^(?:late\s+)?(?:final|const|var)\s+(?:[\w<>?,. ]+?\s+)?([A-Za-z_]\w*)\s*=/;
+var dartProfile = {
+  id: "dart",
+  extensions: [".dart"],
+  summarize(_path, content) {
+    const summary = emptySummary();
+    eachLine(content, (line) => {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("//")) return;
+      const imported = IMPORT.exec(trimmed);
+      if (imported) {
+        summary.imports.push(imported[1]);
+        return;
+      }
+      if (/^part\b/.test(trimmed)) {
+        const part = PART.exec(trimmed);
+        summary.directives.push(part ? `part ${part[1]}` : "part");
+        return;
+      }
+      if (!isTopLevel(line)) return;
+      const type = TYPE.exec(trimmed);
+      if (type) {
+        const [, keyword, name] = type;
+        if (keyword === "mixin" || keyword === "extension") summary.types.push(name);
+        else if (keyword === "enum") summary.enums.push(name);
+        else if (keyword === "typedef") summary.types.push(name);
+        else summary.classes.push(name);
+        if (isPublicName(name)) summary.exports.push(name);
+        return;
+      }
+      const func = FUNC.exec(trimmed);
+      if (func) {
+        const name = func[1];
+        summary.functions.push(name);
+        if (isPublicName(name)) summary.exports.push(name);
+        return;
+      }
+      const variable = VARIABLE.exec(trimmed);
+      if (variable) {
+        const name = variable[1];
+        summary.variables.push(name);
+        if (isPublicName(name)) summary.exports.push(name);
+      }
+    });
+    return { summary: finalizeSummary(summary), quality: "heuristic" };
+  }
+};
+
 // src/ast/profiles/dotnet.ts
 var USING2 = /^using\s+([\w.]+)\s*;/;
 var TYPE_DECL2 = /^\s*(?:public\s+|internal\s+|private\s+|protected\s+|sealed\s+|abstract\s+|static\s+|partial\s+|readonly\s+)*(class|interface|struct|record|enum)\s+([A-Za-z_]\w*)/;
@@ -165,8 +220,8 @@ var dotnetProfile = {
 };
 
 // src/ast/profiles/go.ts
-var FUNC = /^func\s+(?:\([^)]*\)\s*)?([A-Za-z_]\w*)/;
-var TYPE = /^type\s+([A-Za-z_]\w*)\s+(.*)$/;
+var FUNC2 = /^func\s+(?:\([^)]*\)\s*)?([A-Za-z_]\w*)/;
+var TYPE2 = /^type\s+([A-Za-z_]\w*)\s+(.*)$/;
 var VAR_CONST = /^(?:var|const)\s+([A-Za-z_]\w*)/;
 var IMPORT_SINGLE = /^import\s+(?:[\w.]+\s+)?"([^"]+)"/;
 var IMPORT_OPEN = /^import\s*\(/;
@@ -199,14 +254,14 @@ var goProfile = {
         return;
       }
       if (!isTopLevel(line)) return;
-      const method = FUNC.exec(line);
+      const method = FUNC2.exec(line);
       if (method) {
         const name = method[1];
         summary.functions.push(name);
         if (isCapitalizedName(name)) summary.exports.push(name);
         return;
       }
-      const declared = TYPE.exec(line);
+      const declared = TYPE2.exec(line);
       if (declared) {
         const name = declared[1];
         const body = declared[2].trim();
@@ -226,8 +281,54 @@ var goProfile = {
   }
 };
 
+// src/ast/profiles/graphql.ts
+var DEFINITION = /^(?:extend\s+)?(type|interface|input|enum|union|scalar|schema)\s+([A-Za-z_]\w*)/;
+var OPERATION = /^(?:query|mutation|subscription)\s+([A-Za-z_]\w*)/;
+var DIRECTIVE = /^directive\s+@([A-Za-z_]\w*)/;
+var IMPORT2 = /^#import\s+"([^"]+)"/;
+var graphqlProfile = {
+  id: "graphql",
+  extensions: [".graphql", ".gql"],
+  summarize(_path, content) {
+    const summary = emptySummary();
+    eachLine(content, (line) => {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#") && !IMPORT2.test(trimmed)) return;
+      const imported = IMPORT2.exec(trimmed);
+      if (imported) {
+        summary.imports.push(imported[1]);
+        return;
+      }
+      const directive = DIRECTIVE.exec(trimmed);
+      if (directive) {
+        summary.functions.push(`@${directive[1]}`);
+        return;
+      }
+      const definition = DEFINITION.exec(trimmed);
+      if (definition) {
+        const [, keyword, name] = definition;
+        if (keyword === "interface") summary.interfaces.push(name);
+        else if (keyword === "enum") summary.enums.push(name);
+        else if (keyword === "input" || keyword === "scalar" || keyword === "union") {
+          summary.types.push(name);
+        } else summary.classes.push(name);
+        summary.exports.push(name);
+        return;
+      }
+      if (!isTopLevel(line)) return;
+      const operation = OPERATION.exec(trimmed);
+      if (operation) {
+        const name = operation[1];
+        summary.functions.push(name);
+        summary.routeHandlers.push(name);
+      }
+    });
+    return { summary: finalizeSummary(summary), quality: "heuristic" };
+  }
+};
+
 // src/ast/profiles/jvm.ts
-var IMPORT = /^import\s+(?:static\s+)?([\w.]+?)(?:\.\*)?;?\s*$/;
+var IMPORT3 = /^import\s+(?:static\s+)?([\w.]+?)(?:\.\*)?;?\s*$/;
 var TYPE_DECL3 = /^\s*(?:public\s+|private\s+|protected\s+|internal\s+)?(?:final\s+|abstract\s+|open\s+|sealed\s+|data\s+|static\s+|partial\s+)*(class|interface|enum|record|object|trait)\s+(?:class\s+)?([A-Za-z_]\w*)/;
 var KOTLIN_FUN = /^\s*(?:public\s+|private\s+|protected\s+|internal\s+|override\s+|suspend\s+|inline\s+|open\s+|operator\s+)*fun\s+(?:<[^>]*>\s*)?(?:[\w.]+\.)?([A-Za-z_]\w*)/;
 var SCALA_DEF = /^\s*def\s+([A-Za-z_]\w*)/;
@@ -235,9 +336,9 @@ var JAVA_METHOD = /^\s+(?:public|private|protected)\s+(?:static\s+)?(?:final\s+)
 var jvmProfile = {
   id: "jvm",
   extensions: [".java", ".kt", ".kts", ".scala"],
-  summarize(path14, content) {
+  summarize(path17, content) {
     const summary = emptySummary();
-    const lower = path14.toLowerCase();
+    const lower = path17.toLowerCase();
     const isJava = lower.endsWith(".java");
     const isKotlin = lower.endsWith(".kt") || lower.endsWith(".kts");
     eachLine(content, (line) => {
@@ -245,7 +346,7 @@ var jvmProfile = {
       if (!trimmed || trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*")) {
         return;
       }
-      const imported = IMPORT.exec(trimmed);
+      const imported = IMPORT3.exec(trimmed);
       if (imported) {
         summary.imports.push(imported[1]);
         return;
@@ -326,8 +427,50 @@ var phpProfile = {
   }
 };
 
+// src/ast/profiles/protobuf.ts
+var DECLARATION = /^(?:message|enum|service|extend)\s+([A-Za-z_]\w*)/;
+var RPC = /^\s*rpc\s+([A-Za-z_]\w*)/;
+var IMPORT4 = /^\s*import\s+(?:public\s+|weak\s+)?"([^"]+)"/;
+var PACKAGE = /^\s*package\s+([\w.]+)\s*;/;
+var protobufProfile = {
+  id: "protobuf",
+  extensions: [".proto"],
+  summarize(_path, content) {
+    const summary = emptySummary();
+    eachLine(content, (line) => {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("//")) return;
+      const imported = IMPORT4.exec(line);
+      if (imported) {
+        summary.imports.push(imported[1]);
+        return;
+      }
+      const pkg = PACKAGE.exec(line);
+      if (pkg) {
+        summary.directives.push(`package ${pkg[1]}`);
+        return;
+      }
+      const rpc = RPC.exec(line);
+      if (rpc) {
+        const name2 = rpc[1];
+        summary.functions.push(name2);
+        return;
+      }
+      const declaration = DECLARATION.exec(trimmed);
+      if (!declaration) return;
+      const name = declaration[1];
+      const keyword = /^\w+/.exec(trimmed)?.[0] ?? "";
+      if (keyword === "service") summary.interfaces.push(name);
+      else if (keyword === "enum") summary.enums.push(name);
+      else summary.classes.push(name);
+      summary.exports.push(name);
+    });
+    return { summary: finalizeSummary(summary), quality: "heuristic" };
+  }
+};
+
 // src/ast/profiles/python.ts
-var IMPORT2 = /^import\s+(.+)$/;
+var IMPORT5 = /^import\s+(.+)$/;
 var FROM_IMPORT = /^from\s+([\w.]+)\s+import\s+(.+)$/;
 var CLASS = /^class\s+([A-Za-z_]\w*)/;
 var DEF = /^(?:async\s+)?def\s+([A-Za-z_]\w*)/;
@@ -353,7 +496,7 @@ var pythonProfile = {
         routePending = false;
         return;
       }
-      const imported = IMPORT2.exec(trimmed);
+      const imported = IMPORT5.exec(trimmed);
       if (imported) {
         for (const part of imported[1].split(",")) {
           const name = part.trim().split(/\s+as\s+/)[0].trim();
@@ -437,7 +580,7 @@ var FN = /^(pub(?:\([^)]*\))?\s+)?(?:const\s+)?(?:async\s+)?(?:unsafe\s+)?fn\s+(
 var STRUCT = /^(pub(?:\([^)]*\))?\s+)?struct\s+([A-Za-z_]\w*)/;
 var TRAIT = /^(pub(?:\([^)]*\))?\s+)?(?:unsafe\s+)?trait\s+([A-Za-z_]\w*)/;
 var ENUM = /^(pub(?:\([^)]*\))?\s+)?enum\s+([A-Za-z_]\w*)/;
-var TYPE2 = /^(pub(?:\([^)]*\))?\s+)?type\s+([A-Za-z_]\w*)/;
+var TYPE3 = /^(pub(?:\([^)]*\))?\s+)?type\s+([A-Za-z_]\w*)/;
 var MOD = /^(pub(?:\([^)]*\))?\s+)?mod\s+([A-Za-z_]\w*)/;
 var IMPL = /^impl(?:<[^>]*>)?\s+(?:[\w:<>]+\s+for\s+)?([A-Za-z_]\w*)/;
 var rustProfile = {
@@ -479,7 +622,7 @@ var rustProfile = {
         if (isPublic) summary.exports.push(enumeration[2]);
         return;
       }
-      const alias = TYPE2.exec(line);
+      const alias = TYPE3.exec(line);
       if (alias) {
         summary.types.push(alias[2]);
         if (isPublic) summary.exports.push(alias[2]);
@@ -506,6 +649,16 @@ var ROUTE_HANDLER_NAMES = /* @__PURE__ */ new Set([
   "HEAD",
   "OPTIONS"
 ]);
+function bindingNames(name, into) {
+  if (ts.isIdentifier(name)) {
+    into.push(name.text);
+    return;
+  }
+  for (const element of name.elements) {
+    if (ts.isOmittedExpression(element)) continue;
+    bindingNames(element.name, into);
+  }
+}
 function summarizeTypeScriptSource(relativePath, content) {
   const summary = {
     directives: [],
@@ -606,12 +759,15 @@ function summarizeTypeScriptSource(relativePath, content) {
       }
       if (node.exportClause && ts.isNamedExports(node.exportClause)) {
         for (const element of node.exportClause.elements) {
-          summary.exports.push(element.name.text);
+          const exported = element.name.text;
+          summary.exports.push(exported);
+          if (ROUTE_HANDLER_NAMES.has(exported)) summary.routeHandlers.push(exported);
         }
       }
     }
     if (ts.isExportAssignment(node)) {
       summary.exports.push("default");
+      if (rendersJsx(node.expression)) summary.reactComponents.push("default");
     }
     if (ts.isFunctionDeclaration(node)) {
       const exported = isExported(node);
@@ -649,16 +805,18 @@ function summarizeTypeScriptSource(relativePath, content) {
     if (ts.isVariableStatement(node)) {
       const exported = isExported(node);
       for (const declaration of node.declarationList.declarations) {
-        if (!ts.isIdentifier(declaration.name)) continue;
-        const name = declaration.name.text;
-        summary.variables.push(name);
-        if (exported) {
-          summary.exports.push(name);
-          if (ROUTE_HANDLER_NAMES.has(name)) summary.routeHandlers.push(name);
-        }
-        if (/^use[A-Z0-9]/.test(name)) summary.hooks.push(name);
-        if (/^[A-Z]/.test(name) && declaration.initializer !== void 0 && rendersJsx(declaration.initializer)) {
-          summary.reactComponents.push(name);
+        const bound = [];
+        bindingNames(declaration.name, bound);
+        for (const name of bound) {
+          summary.variables.push(name);
+          if (exported) {
+            summary.exports.push(name);
+            if (ROUTE_HANDLER_NAMES.has(name)) summary.routeHandlers.push(name);
+          }
+          if (/^use[A-Z0-9]/.test(name)) summary.hooks.push(name);
+          if (/^[A-Z]/.test(name) && declaration.initializer !== void 0 && rendersJsx(declaration.initializer)) {
+            summary.reactComponents.push(name);
+          }
         }
       }
     }
@@ -690,16 +848,16 @@ function summarizeTypeScriptSource(relativePath, content) {
 // src/ast/profiles/sfc.ts
 var SCRIPT_BLOCK = /<script[^>]*>([\s\S]*?)<\/script>/gi;
 var ASTRO_FRONTMATTER = /^\uFEFF?---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?=\r?\n|$)/;
-function componentName(path14) {
-  const base = path14.split("/").pop() ?? path14;
+function componentName(path17) {
+  const base = path17.split("/").pop() ?? path17;
   return base.replace(/\.[^.]+$/, "");
 }
 var sfcProfile = {
   id: "sfc",
   extensions: [".vue", ".svelte", ".astro"],
-  summarize(path14, content) {
+  summarize(path17, content) {
     let script = "";
-    if (path14.toLowerCase().endsWith(".astro")) {
+    if (path17.toLowerCase().endsWith(".astro")) {
       const frontmatter = ASTRO_FRONTMATTER.exec(content);
       if (frontmatter) script += `${frontmatter[1]}
 `;
@@ -708,7 +866,7 @@ var sfcProfile = {
       script += `${match[1]}
 `;
     }
-    const name = componentName(path14);
+    const name = componentName(path17);
     if (!script.trim()) {
       const summary2 = emptySummary();
       if (name) {
@@ -720,7 +878,158 @@ var sfcProfile = {
     const summary = summarizeTypeScriptSource(`${name}.ts`, script);
     summary.reactComponents.push(name);
     summary.exports.push(name);
-    return { summary, quality: "ast" };
+    return { summary: finalizeSummary(summary), quality: "ast" };
+  }
+};
+
+// src/ast/profiles/sql.ts
+var CREATE = /^\s*CREATE\s+(?:OR\s+REPLACE\s+)?(?:TEMP(?:ORARY)?\s+)?(TABLE|VIEW|MATERIALIZED\s+VIEW|FUNCTION|PROCEDURE|INDEX|TYPE|SCHEMA|TRIGGER|SEQUENCE)\s+(?:IF\s+NOT\s+EXISTS\s+)?([A-Za-z_"][\w."]*)/i;
+var ALTER = /^\s*ALTER\s+(TABLE|VIEW)\s+(?:IF\s+EXISTS\s+)?([A-Za-z_"][\w."]*)/i;
+function bareName(identifier) {
+  const last = identifier.split(".").pop() ?? identifier;
+  return last.replace(/["`[\]]/g, "");
+}
+var sqlProfile = {
+  id: "sql",
+  extensions: [".sql"],
+  summarize(_path, content) {
+    const summary = emptySummary();
+    const seen = /* @__PURE__ */ new Set();
+    const declare = (kind, identifier) => {
+      const name = bareName(identifier);
+      if (!name || seen.has(`${kind}:${name}`)) return;
+      seen.add(`${kind}:${name}`);
+      const normalized = kind.toUpperCase().replace(/\s+/g, " ");
+      if (normalized === "TABLE" || normalized.endsWith("VIEW")) summary.classes.push(name);
+      else if (normalized === "TYPE" || normalized === "SCHEMA" || normalized === "SEQUENCE") {
+        summary.types.push(name);
+      } else summary.functions.push(name);
+      summary.exports.push(name);
+    };
+    eachLine(content, (line) => {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("--")) return;
+      const created = CREATE.exec(trimmed);
+      if (created) {
+        declare(String(created[1]), String(created[2]));
+        return;
+      }
+      const altered = ALTER.exec(trimmed);
+      if (altered) declare(String(altered[1]), String(altered[2]));
+    });
+    return { summary: finalizeSummary(summary), quality: "heuristic" };
+  }
+};
+
+// src/ast/profiles/swift.ts
+var MODIFIERS = "(?:@\\w+(?:\\([^)]*\\))?\\s+|(?:public|open|internal|fileprivate|private|final|static|mutating|nonmutating|override|required|convenience|lazy|weak|unowned)\\s+)*";
+var TYPE4 = new RegExp(`^${MODIFIERS}(class|struct|enum|protocol|actor|extension)\\s+([A-Za-z_]\\w*)`);
+var FUNC3 = new RegExp(`^${MODIFIERS}func\\s+([A-Za-z_]\\w*)`);
+var PROPERTY = new RegExp(`^${MODIFIERS}(?:let|var)\\s+([A-Za-z_]\\w*)`);
+var IMPORT6 = /^import\s+([A-Za-z_][\w.]*)/;
+var swiftProfile = {
+  id: "swift",
+  extensions: [".swift"],
+  summarize(_path, content) {
+    const summary = emptySummary();
+    eachLine(content, (line) => {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("//")) return;
+      const imported = IMPORT6.exec(trimmed);
+      if (imported) {
+        summary.imports.push(imported[1]);
+        return;
+      }
+      if (!isTopLevel(line)) return;
+      const exported = /\b(?:public|open)\b/.test(trimmed);
+      const type = TYPE4.exec(trimmed);
+      if (type) {
+        const [, keyword, name] = type;
+        if (keyword === "protocol") summary.interfaces.push(name);
+        else if (keyword === "enum") summary.enums.push(name);
+        else if (keyword === "extension") summary.types.push(name);
+        else summary.classes.push(name);
+        if (exported) summary.exports.push(name);
+        return;
+      }
+      const func = FUNC3.exec(trimmed);
+      if (func) {
+        const name = func[1];
+        summary.functions.push(name);
+        if (exported) summary.exports.push(name);
+        return;
+      }
+      const property = PROPERTY.exec(trimmed);
+      if (property) {
+        const name = property[1];
+        summary.variables.push(name);
+        if (exported && isPublicName(name)) summary.exports.push(name);
+      }
+    });
+    return { summary: finalizeSummary(summary), quality: "heuristic" };
+  }
+};
+
+// src/ast/profiles/terraform.ts
+var BLOCK = /^\s*(resource|data|module|provider|variable|output|locals|terraform)\b\s*("([^"]+)")?\s*("([^"]+)")?/;
+var TERRAFORM_VERSION = /^\s*required_version\s*=\s*"([^"]+)"/;
+var terraformProfile = {
+  id: "terraform",
+  extensions: [".tf", ".tfvars"],
+  summarize(_path, content) {
+    const summary = emptySummary();
+    eachLine(content, (line) => {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("//")) return;
+      const version = TERRAFORM_VERSION.exec(line);
+      if (version) {
+        summary.directives.push(`required_version ${version[1]}`);
+        return;
+      }
+      if (/^[A-Za-z_][\w-]*\s*=/.test(trimmed)) {
+        summary.variables.push(/^([A-Za-z_][\w-]*)/.exec(trimmed)?.[1] ?? trimmed);
+        return;
+      }
+      const block = BLOCK.exec(line);
+      if (!block) return;
+      const keyword = block[1];
+      const first = block[3];
+      const second = block[5];
+      switch (keyword) {
+        case "resource":
+        case "data": {
+          if (!first || !second) return;
+          const name = `${first}.${second}`;
+          summary.classes.push(name);
+          summary.exports.push(name);
+          return;
+        }
+        case "module": {
+          if (!first) return;
+          summary.imports.push(first);
+          return;
+        }
+        case "variable": {
+          if (!first) return;
+          summary.variables.push(first);
+          return;
+        }
+        case "output": {
+          if (!first) return;
+          summary.exports.push(first);
+          return;
+        }
+        case "provider": {
+          if (!first) return;
+          summary.imports.push(`provider:${first}`);
+          return;
+        }
+        default: {
+          summary.directives.push(keyword);
+        }
+      }
+    });
+    return { summary: finalizeSummary(summary), quality: "heuristic" };
   }
 };
 
@@ -734,7 +1043,13 @@ var LANGUAGE_PROFILES = [
   phpProfile,
   rubyProfile,
   cfamilyProfile,
-  sfcProfile
+  sfcProfile,
+  swiftProfile,
+  dartProfile,
+  sqlProfile,
+  graphqlProfile,
+  protobufProfile,
+  terraformProfile
 ];
 var BY_EXTENSION = /* @__PURE__ */ new Map();
 for (const profile of LANGUAGE_PROFILES) {
@@ -742,15 +1057,15 @@ for (const profile of LANGUAGE_PROFILES) {
     BY_EXTENSION.set(extension.toLowerCase(), profile);
   }
 }
-function profileForPath(path14) {
-  const lower = path14.toLowerCase();
+function profileForPath(path17) {
+  const lower = path17.toLowerCase();
   const dot = lower.lastIndexOf(".");
   if (dot === -1) return null;
   return BY_EXTENSION.get(lower.slice(dot)) ?? null;
 }
-function summarizeWithProfile(path14, content) {
-  const profile = profileForPath(path14);
-  return profile ? profile.summarize(path14, content) : null;
+function summarizeWithProfile(path17, content) {
+  const profile = profileForPath(path17);
+  return profile ? profile.summarize(path17, content) : null;
 }
 
 // src/ast/structured.ts
@@ -850,9 +1165,17 @@ function summarizeMarkdown(content) {
   const frontmatterKeys = [];
   const lines = content.replace(/^\uFEFF/, "").split("\n");
   let inFrontmatter = false;
+  let fence = null;
+  let closesFrontmatter = false;
+  for (let index = 1; index < lines.length; index++) {
+    if (lines[index].trim() === "---") {
+      closesFrontmatter = true;
+      break;
+    }
+  }
   for (let index = 0; index < lines.length; index++) {
     const line = lines[index];
-    if (index === 0 && line.trim() === "---") {
+    if (index === 0 && line.trim() === "---" && closesFrontmatter) {
       inFrontmatter = true;
       continue;
     }
@@ -865,7 +1188,20 @@ function summarizeMarkdown(content) {
       if (match) frontmatterKeys.push(match[1]);
       continue;
     }
-    const headingMatch = /^(#{1,6})\s+(.+)$/.exec(line.trim());
+    const trimmed = line.trim();
+    const fenceMatch = /^(`{3,}|~{3,})(.*)$/.exec(trimmed);
+    if (fenceMatch) {
+      const run = fenceMatch[1];
+      const rest = fenceMatch[2].trim();
+      if (fence === null) {
+        fence = { marker: run[0], length: run.length };
+      } else if (run[0] === fence.marker && run.length >= fence.length && rest === "") {
+        fence = null;
+      }
+      continue;
+    }
+    if (fence !== null) continue;
+    const headingMatch = /^(#{1,6})\s+(.+)$/.exec(trimmed);
     if (headingMatch) {
       headings.push(`${headingMatch[1]} ${headingMatch[2].trim()}`);
     }
@@ -875,6 +1211,52 @@ function summarizeMarkdown(content) {
     frontmatterKeys: Array.from(new Set(frontmatterKeys)).sort()
   };
 }
+function hasCollapsibleBody(node) {
+  if (!("body" in node)) return false;
+  const body = node.body;
+  return body !== void 0 && ts.isBlock(body);
+}
+function isTsxFileName(fileName) {
+  return fileName.toLowerCase().endsWith(".tsx");
+}
+function skeletonizeTypeScript(source, fileName = "file.ts") {
+  const scriptKind = isTsxFileName(fileName) ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
+  const sourceFile = ts.createSourceFile(
+    fileName,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    scriptKind
+  );
+  const spans = [];
+  const visit = (node) => {
+    if ((ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node) || ts.isConstructorDeclaration(node) || ts.isGetAccessorDeclaration(node) || ts.isSetAccessorDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node)) && hasCollapsibleBody(node)) {
+      const body = node.body;
+      const start = body.getStart(sourceFile);
+      const end = body.getEnd();
+      if (end > start) spans.push({ start, end });
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  if (spans.length === 0) return { text: source, collapsed: 0 };
+  const outermost = [];
+  for (const span of spans.sort((a, b) => a.start - b.start || b.end - a.end)) {
+    const last = outermost[outermost.length - 1];
+    if (last && span.start < last.end) continue;
+    outermost.push(span);
+  }
+  let text2 = source;
+  for (let index = outermost.length - 1; index >= 0; index -= 1) {
+    const span = outermost[index];
+    text2 = `${text2.slice(0, span.start)}{ /* ... */ }${text2.slice(span.end)}`;
+  }
+  return { text: text2, collapsed: outermost.length };
+}
+function isSkeletonizable(filePath) {
+  const lower = filePath.toLowerCase();
+  return lower.endsWith(".ts") || lower.endsWith(".tsx") || lower.endsWith(".mts") || lower.endsWith(".cts");
+}
 var MANIFEST_FILES = [
   "package.json",
   "pyproject.toml",
@@ -921,15 +1303,15 @@ var SKIPPED_WALK_DIRS = /* @__PURE__ */ new Set([
 ]);
 function readSmallFile(fullPath) {
   try {
-    const stats = fs12.statSync(fullPath);
+    const stats = fs14.statSync(fullPath);
     if (!stats.isFile() || stats.size > MANIFEST_MAX_BYTES) return null;
-    return fs12.readFileSync(fullPath, "utf8");
+    return fs14.readFileSync(fullPath, "utf8");
   } catch {
     return null;
   }
 }
 function readManifest(cwd, name) {
-  return readSmallFile(path13.join(cwd, name));
+  return readSmallFile(path16.join(cwd, name));
 }
 function dependenciesFromPackageJson(raw) {
   const names = /* @__PURE__ */ new Set();
@@ -989,7 +1371,7 @@ function pnpmWorkspacePatterns(raw) {
 function childDirectories(cwd, parent) {
   let entries;
   try {
-    entries = fs12.readdirSync(path13.join(cwd, parent), { withFileTypes: true });
+    entries = fs14.readdirSync(path16.join(cwd, parent), { withFileTypes: true });
   } catch {
     return [];
   }
@@ -1024,13 +1406,13 @@ function workspacePackageDirs(cwd, patterns) {
 function scanWorkspacePackages(cwd, patterns) {
   const files = /* @__PURE__ */ new Set();
   const dependencies = /* @__PURE__ */ new Set();
-  for (const relative7 of workspacePackageDirs(cwd, patterns)) {
-    const full = path13.join(cwd, relative7);
+  for (const relative8 of workspacePackageDirs(cwd, patterns)) {
+    const full = path16.join(cwd, relative8);
     try {
-      for (const entry of fs12.readdirSync(full, { withFileTypes: true })) files.add(entry.name);
+      for (const entry of fs14.readdirSync(full, { withFileTypes: true })) files.add(entry.name);
     } catch {
     }
-    const raw = readSmallFile(path13.join(full, "package.json"));
+    const raw = readSmallFile(path16.join(full, "package.json"));
     if (raw !== null) {
       for (const name of dependenciesFromPackageJson(raw)) dependencies.add(name);
     }
@@ -1047,7 +1429,7 @@ function countMarkdownFiles(cwd) {
     directoriesSeen += 1;
     let entries;
     try {
-      entries = fs12.readdirSync(current.dir, { withFileTypes: true });
+      entries = fs14.readdirSync(current.dir, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -1058,7 +1440,7 @@ function countMarkdownFiles(cwd) {
       }
       if (!entry.isDirectory() || current.depth >= 2) continue;
       if (entry.name.startsWith(".") || SKIPPED_WALK_DIRS.has(entry.name)) continue;
-      queue.push({ dir: path13.join(current.dir, entry.name), depth: current.depth + 1 });
+      queue.push({ dir: path16.join(current.dir, entry.name), depth: current.depth + 1 });
     }
   }
   return count;
@@ -1067,7 +1449,7 @@ function buildPresetContext(cwd) {
   const files = /* @__PURE__ */ new Set();
   const dirs = /* @__PURE__ */ new Set();
   try {
-    for (const entry of fs12.readdirSync(cwd, { withFileTypes: true })) {
+    for (const entry of fs14.readdirSync(cwd, { withFileTypes: true })) {
       if (entry.isDirectory()) dirs.add(entry.name);
       else if (entry.isFile()) files.add(entry.name);
     }
@@ -1084,7 +1466,7 @@ function buildPresetContext(cwd) {
   const isWorkspace = files.has("pnpm-workspace.yaml") || files.has("nx.json") || files.has("turbo.json") || files.has("lerna.json") || packageJson !== void 0 && packageJson.includes('"workspaces"') || declaredWorkspaces.length > 0;
   let workspace = { files: /* @__PURE__ */ new Set(), dependencies: /* @__PURE__ */ new Set() };
   if (isWorkspace) {
-    const pnpmRaw = files.has("pnpm-workspace.yaml") ? readSmallFile(path13.join(cwd, "pnpm-workspace.yaml")) : null;
+    const pnpmRaw = files.has("pnpm-workspace.yaml") ? readSmallFile(path16.join(cwd, "pnpm-workspace.yaml")) : null;
     const declared = pnpmRaw === null ? [] : pnpmWorkspacePatterns(pnpmRaw);
     const patterns = declared.length > 0 ? declared : declaredWorkspaces.length > 0 ? declaredWorkspaces : DEFAULT_WORKSPACE_PATTERNS;
     workspace = scanWorkspacePackages(cwd, patterns);
@@ -1929,10 +2311,15 @@ function detectPreset(cwd, forced) {
 // src/security/patterns.ts
 var STRONG_CREDENTIAL_NAME = "(?:password|passwd|passphrase|pwd|api[_-]?key|api[_-]?secret|secret[_-]?access[_-]?key|secret[_-]?key|client[_-]?secret[_-]?key|client[_-]?secret|private[_-]?key|aws[_-]?secret[_-]?access[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|session[_-]?token|secret|token)";
 var WEAK_CREDENTIAL_NAME = "(?:pass|id[_-]?token|credentials?)";
-var NOT_A_LITERAL_VALUE = "(?!(?:string|number|boolean|bigint|symbol|unknown|any|never|void|null|undefined|true|false|process\\.env|Buffer|Record|object)\\b)";
-var UNQUOTED_LITERAL = "(?![0-9]+(?![A-Za-z0-9_+=/%:.~-]))([A-Za-z0-9_+=/%:~-]{1,512})(?![A-Za-z0-9_+=/%:.~-]|\\()";
-var UNQUOTED_AMBIGUOUS_LITERAL = "(?![0-9]+(?![A-Za-z0-9_+=/%:.~-]))([A-Za-z0-9_+=/%:~-]{8,512})(?![A-Za-z0-9_+=/%:.~-]|\\()";
-var QUOTED_VALUE = String.raw`((?:[^"'\\\n]|\\.){1,512})`;
+var NOT_A_LITERAL_VALUE = "(?!(?:string|number|boolean|bigint|symbol|unknown|any|never|void|null|undefined|true|false|await|async|new|this|typeof|delete|yield|function|return|process\\.env|Buffer|Record|object)\\b)";
+var UNQUOTED_MIN_LENGTH = 2;
+var PROSE_CONTINUATION = String.raw`(?!\s+[a-z])`;
+var UNQUOTED_LITERAL = String.raw`(?![0-9]+(?![A-Za-z0-9_+=/%:.~-]))([A-Za-z0-9_][A-Za-z0-9_+=/%:~-]{${UNQUOTED_MIN_LENGTH - 1},511})(?![A-Za-z0-9_+=/%:.~-]|[({[])` + PROSE_CONTINUATION;
+var UNQUOTED_AMBIGUOUS_LITERAL = String.raw`(?![0-9]+(?![A-Za-z0-9_+=/%:.~-]))([A-Za-z0-9_][A-Za-z0-9_+=/%:~-]{7,511})(?![A-Za-z0-9_+=/%:.~-]|[({[])` + PROSE_CONTINUATION;
+var ASSIGN = String.raw`(?<![=!<>])[:=](?!=)`;
+var NOT_AFTER_QUOTE = String.raw`(?<!["'])`;
+var NOT_A_NAMESPACED_IDENTIFIER = String.raw`(?![a-z][a-z0-9]*(?:\.[a-z][a-z0-9-]*)+/)`;
+var QUOTED_VALUE = String.raw`((?:[^"'\\\n]|\\\\["'](?=[A-Za-z0-9_])|\\.){1,512})`;
 var UNQUOTED_STRONG_NAME = `(?<!id[-_])${STRONG_CREDENTIAL_NAME}`;
 var DEFAULT_SECRET_PATTERNS = [
   {
@@ -1975,7 +2362,7 @@ var DEFAULT_SECRET_PATTERNS = [
     // literal words matched. The value is masked alone, so the key survives.
     rule: "aws-secret-access-key",
     pattern: new RegExp(
-      `${STRONG_CREDENTIAL_NAME}["']?\\s{0,8}[:=]\\s{0,8}["']?([A-Za-z0-9/+=]{40})["']?`,
+      `(?:["']${STRONG_CREDENTIAL_NAME}["']|${NOT_AFTER_QUOTE}${STRONG_CREDENTIAL_NAME})\\s{0,8}${ASSIGN}\\s{0,8}["']?([A-Za-z0-9/+=]{40})["']?`,
       "i"
     ),
     valueGroup: 1
@@ -2087,7 +2474,7 @@ var DEFAULT_SECRET_PATTERNS = [
     // the key name.
     rule: "credential-assignment",
     pattern: new RegExp(
-      `(?:["']${STRONG_CREDENTIAL_NAME}["']|${STRONG_CREDENTIAL_NAME})\\s{0,8}[:=]\\s{0,8}(["'\`])${QUOTED_VALUE}\\1`,
+      `(?:["']${STRONG_CREDENTIAL_NAME}["']|${NOT_AFTER_QUOTE}${STRONG_CREDENTIAL_NAME})\\s{0,8}${ASSIGN}\\s{0,8}${NOT_A_NAMESPACED_IDENTIFIER}(["'\`])${QUOTED_VALUE}\\1`,
       "i"
     ),
     valueGroup: 2
@@ -2097,7 +2484,7 @@ var DEFAULT_SECRET_PATTERNS = [
     // are accepted only against a quoted value long enough to be a credential.
     rule: "credential-assignment-weak",
     pattern: new RegExp(
-      `(?:["']${WEAK_CREDENTIAL_NAME}["']|${WEAK_CREDENTIAL_NAME})\\s{0,8}[:=]\\s{0,8}(["'\`])${QUOTED_VALUE}\\1`,
+      `(?:["']${WEAK_CREDENTIAL_NAME}["']|${NOT_AFTER_QUOTE}${WEAK_CREDENTIAL_NAME})\\s{0,8}${ASSIGN}\\s{0,8}(["'\`])${QUOTED_VALUE}\\1`,
       "i"
     ),
     valueGroup: 2
@@ -2108,7 +2495,7 @@ var DEFAULT_SECRET_PATTERNS = [
     // `POSTGRES_PASSWORD:` in the output.
     rule: "credential-assignment-unquoted",
     pattern: new RegExp(
-      `${UNQUOTED_STRONG_NAME}\\s{0,8}[:=]\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_LITERAL}`,
+      `${NOT_AFTER_QUOTE}${UNQUOTED_STRONG_NAME}\\s{0,8}${ASSIGN}\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_LITERAL}`,
       "i"
     ),
     valueGroup: 1
@@ -2119,7 +2506,7 @@ var DEFAULT_SECRET_PATTERNS = [
     // `pass: 3` / `credentials: none` readable.
     rule: "credential-assignment-unquoted-weak",
     pattern: new RegExp(
-      `${WEAK_CREDENTIAL_NAME}\\s{0,8}[:=]\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_AMBIGUOUS_LITERAL}`,
+      `${NOT_AFTER_QUOTE}${WEAK_CREDENTIAL_NAME}\\s{0,8}${ASSIGN}\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_AMBIGUOUS_LITERAL}`,
       "i"
     ),
     valueGroup: 1
@@ -2140,7 +2527,7 @@ var DEFAULT_SECRET_PATTERNS = [
     // above because it also matches a *quoted key* followed by an unquoted
     // value, e.g. `"client_secret": abc123`.
     rule: "generic-secret-assignment",
-    pattern: /(?:api[_-]?key|secret[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?token|refresh[_-]?token|private[_-]?key|password|passwd|pwd)["']?\s*[:=]\s*["']([^"'\s]{8,256})["']/i,
+    pattern: /(?<!["'])(?:api[_-]?key|secret[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?token|refresh[_-]?token|private[_-]?key|password|passwd|pwd)["']?\s*(?<![=!<>])[:=](?!=)\s*["']([^"'\s]{8,256})["']/i,
     valueGroup: 1
   },
   {
@@ -2156,8 +2543,17 @@ var DEFAULT_SECRET_PATTERNS = [
     // Anchoring the value to end-of-line (`[^\s#]{6,512}$`) meant ANY trailing
     // comment or space disabled the rule, so `TOKEN=secret # rotate` and
     // `TOKEN=secret   ` were emitted in clear; a CRLF file disabled it wholesale.
+    //
+    // The name is now required to be uppercase. With `/i`, a reassignment inside a
+    // function — `  key = fs.realpathSync(stagingRoot)` — matched `key`…`KEY` and
+    // was emitted as `key = [REDACTED](stagingRoot)`, which corrupted this
+    // repository's own `src/index.ts`. Shell and `.env` names are uppercase by
+    // convention and a lowercase `key = …` at an indent is a variable, so the case
+    // of the name is the discriminator that separates the two. The value must end
+    // at end-of-line, whitespace or a comment: that is what stops a call expression
+    // (`NAME=f(x)`) from being read as an assigned literal.
     rule: "env-secret-assignment",
-    pattern: /^\s{0,64}(?:export\s{1,8})?[A-Za-z0-9_]{0,96}(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|CREDENTIAL)[A-Za-z0-9_]{0,96}\s{0,8}=\s{0,8}(?!["'`$<{[\]\s])([^\s#;"'`)]{1,512})/i,
+    pattern: /^\s{0,64}(?:export\s{1,8})?(?=[A-Z][A-Z0-9_]{0,191}\s{0,8}=)[A-Z0-9_]{0,96}(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|CREDENTIAL)[A-Z0-9_]{0,96}\s{0,8}=(?!=)\s{0,8}(?!["'`$<{[\]\s])([^\s#;"'`()]{1,512})(?=$|[\s#;])/,
     valueGroup: 1
   }
 ];
@@ -2295,6 +2691,12 @@ function scanAndRedactSecrets(content, rules, filePath) {
             continue;
           }
           const group = valueGroup === void 0 ? void 0 : match.indices?.[valueGroup];
+          if (group && isSelfNamingConstant(line, group[0], group[1])) continue;
+          if (valueGroup !== void 0 && startsInsideStringLiteral(line, match.index)) continue;
+          if (group && isUnquotedValue(line, group[0]) && isDeclaredBinding(line, match.index)) {
+            continue;
+          }
+          if (group && isTemplateInterpolation(line, group[0], group[1])) continue;
           spans.push(
             group ? { start: group[0], end: group[1], rule } : { start: match.index, end: match.index + match[0].length, rule }
           );
@@ -2324,6 +2726,46 @@ function expandOverToken(line, start, end) {
   while (right < line.length && TOKEN_CHARS_RIGHT.test(line[right])) right += 1;
   return { start: left, end: right };
 }
+function startsInsideStringLiteral(line, matchIndex) {
+  let runStart = matchIndex;
+  while (runStart > 0 && /[A-Za-z0-9_-]/.test(line[runStart - 1])) runStart -= 1;
+  const before = runStart > 0 ? line[runStart - 1] : "";
+  return before === '"' || before === "'" || before === "`";
+}
+function isTemplateInterpolation(line, start, end) {
+  return line[start] === "$" && line[start + 1] === "{" && line[end - 1] === "}";
+}
+function isSelfNamingConstant(line, start, end) {
+  const value = line.slice(start, end);
+  if (!/[a-z][A-Z]/.test(value)) return false;
+  let index = start;
+  if (index > 0) {
+    const openingQuote = line[index - 1];
+    if (openingQuote === '"' || openingQuote === "'" || openingQuote === "`") index -= 1;
+  }
+  while (index > 0 && /\s/.test(line[index - 1])) index -= 1;
+  if (index === 0) return false;
+  if (line[index - 1] !== ":" && line[index - 1] !== "=") return false;
+  index -= 1;
+  while (index > 0 && /\s/.test(line[index - 1])) index -= 1;
+  if (index > 0) {
+    const closingQuote = line[index - 1];
+    if (closingQuote === '"' || closingQuote === "'" || closingQuote === "`") index -= 1;
+  }
+  return line.endsWith(value, index);
+}
+function isUnquotedValue(line, start) {
+  const before = start > 0 ? line[start - 1] : "";
+  return before !== '"' && before !== "'" && before !== "`";
+}
+var DECLARATION_KEYWORDS = /\b(?:const|let|var|readonly|public|private|protected|static|declare|export|using)\s+$/;
+var DECLARATION_WINDOW = 40;
+function isDeclaredBinding(line, matchIndex) {
+  let runStart = matchIndex;
+  while (runStart > 0 && /[A-Za-z0-9_$]/.test(line[runStart - 1])) runStart -= 1;
+  const from = Math.max(0, runStart - DECLARATION_WINDOW);
+  return DECLARATION_KEYWORDS.test(line.slice(from, runStart));
+}
 function applySpans(line, spans) {
   const ordered = [...spans].sort((a, b) => a.start - b.start || a.end - b.end);
   const merged = [];
@@ -2350,45 +2792,58 @@ function applySpans(line, spans) {
 function isDiscoveryMode(value) {
   return value === "auto" || value === "git" || value === "walk";
 }
-var activeDiscovery = "auto";
-function setActiveDiscovery(mode) {
-  activeDiscovery = mode;
-}
 var PRESET_IGNORES = new Set(
   PRESETS.flatMap((preset) => preset.exclude ?? [])
 );
 function readLinkTarget(linkPath, fallback) {
   try {
-    return fs12.readlinkSync(linkPath);
+    return fs14.readlinkSync(linkPath);
   } catch {
     return fallback;
   }
 }
 function isInside(root, candidate) {
-  const relative7 = path13.relative(root, candidate);
-  return relative7 === "" || !relative7.startsWith(`..${path13.sep}`) && relative7 !== ".." && !path13.isAbsolute(relative7);
+  const relative8 = path16.relative(root, candidate);
+  return relative8 === "" || !relative8.startsWith(`..${path16.sep}`) && relative8 !== ".." && !path16.isAbsolute(relative8);
 }
+var GIT_OUTPUT_LIMIT = 68157440;
 function getGitInfo(cwd, fallbackBranch = "main") {
   try {
-    const reported = childProcess.execSync("git rev-parse --abbrev-ref HEAD", {
-      cwd,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    }).trim();
-    const branch = !reported || reported === "HEAD" ? fallbackBranch : reported;
-    const commit = childProcess.execSync("git rev-parse HEAD", {
-      cwd,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    }).trim() || "unknown";
-    const status = childProcess.execSync("git status --porcelain", {
-      cwd,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    }).trim();
-    return { branch, commit, isDirty: status.length > 0 };
-  } catch {
-    return { branch: fallbackBranch, commit: "unknown", isDirty: false };
+    const output = childProcess.execFileSync(
+      "git",
+      ["status", "--porcelain=v2", "--branch", "-z"],
+      {
+        cwd,
+        stdio: ["ignore", "pipe", "ignore"],
+        encoding: "utf8",
+        maxBuffer: GIT_OUTPUT_LIMIT
+      }
+    );
+    let branch = fallbackBranch;
+    let commit = "unknown";
+    let isDirty = false;
+    const records = output.split("\0").flatMap((record) => record.split("\n"));
+    for (const record of records) {
+      if (record.length === 0) continue;
+      if (!record.startsWith("# ")) {
+        isDirty = true;
+        break;
+      }
+      const oid = record.match(/^# branch\.oid (.+)$/);
+      if (oid) {
+        commit = oid[1] === "(initial)" ? "unknown" : oid[1];
+        continue;
+      }
+      const head = record.match(/^# branch\.head (.+)$/);
+      if (head) {
+        branch = head[1] === "(detached)" ? fallbackBranch : head[1];
+      }
+    }
+    return { branch, commit, isDirty };
+  } catch (err) {
+    const code = err.code;
+    const isDirty = code === "ENOBUFS";
+    return { branch: fallbackBranch, commit: "unknown", isDirty };
   }
 }
 var DEFAULT_IGNORED_DIRS = [
@@ -2435,16 +2890,27 @@ function isSensitivePath(relativePath) {
   }
   return matchesSensitiveList(posixPath, base);
 }
+var GLOBAL_PATTERNS = /* @__PURE__ */ new WeakMap();
+function globalPattern(pattern) {
+  let compiled = GLOBAL_PATTERNS.get(pattern);
+  if (compiled === void 0) {
+    compiled = new RegExp(pattern.source, `${pattern.flags.replace(/[gy]/g, "")}g`);
+    GLOBAL_PATTERNS.set(pattern, compiled);
+  }
+  return compiled;
+}
+var DEFAULT_PATH_RULES = [...DEFAULT_SECRET_PATTERNS];
 function pathScanRules(extraRules) {
-  const fallback = extraRules ?? [];
-  return [...DEFAULT_SECRET_PATTERNS, ...fallback];
+  if (extraRules === void 0 || extraRules.length === 0) return DEFAULT_PATH_RULES;
+  return [...DEFAULT_SECRET_PATTERNS, ...extraRules];
 }
 function findSecretInPath(relativePath, extraRules) {
   const posixPath = relativePath.replace(/\\/g, "/");
   const spans = [];
   const rules = [];
   for (const { rule, pattern } of pathScanRules(extraRules)) {
-    const scan = new RegExp(pattern.source, `${pattern.flags.replace(/[gy]/g, "")}g`);
+    const scan = globalPattern(pattern);
+    scan.lastIndex = 0;
     let match;
     while ((match = scan.exec(posixPath)) !== null) {
       if (match[0].length === 0) {
@@ -2571,10 +3037,10 @@ function trimUnescapedTrailingSpaces(line) {
   return line.slice(0, end);
 }
 function readGitignoreRules(dir) {
-  const gitignorePath2 = path13.join(dir, ".gitignore");
+  const gitignorePath2 = path16.join(dir, ".gitignore");
   let raw;
   try {
-    raw = fs12.readFileSync(gitignorePath2, "utf8");
+    raw = fs14.readFileSync(gitignorePath2, "utf8");
   } catch {
     return [];
   }
@@ -2600,7 +3066,7 @@ function readGitignoreRules(dir) {
 function escapeRegExpChar(character) {
   return /[\\^$.*+?()[\]{}|/]/.test(character) ? `\\${character}` : character;
 }
-function matchEscapedGitignorePattern(target, pattern) {
+function matchGitignorePattern(target, pattern) {
   const anchored = pattern.startsWith("/");
   const body = anchored ? pattern.slice(1) : pattern;
   let source = "";
@@ -2634,15 +3100,33 @@ function matchEscapedGitignorePattern(target, pattern) {
       source += "[^/]";
       continue;
     }
+    if (character === "[") {
+      const close = body.indexOf("]", i + 1);
+      if (close !== -1 && close > i + 1) {
+        const inner = body.slice(i + 1, close);
+        const negated = inner.startsWith("!") || inner.startsWith("^");
+        const chars = negated ? inner.slice(1) : inner;
+        const safe = chars.replace(/[\\^\]]/g, (value) => `\\${value}`);
+        source += negated ? `[^/${safe}]` : `[${safe}]`;
+        i = close;
+        continue;
+      }
+    }
     source += escapeRegExpChar(character);
   }
   const prefix = anchored || body.includes("/") ? "^" : "(?:^|.*/)";
   return new RegExp(`${prefix}${source}(?:/.*)?$`).test(target);
 }
-function matchesGitignorePattern(target, pattern) {
-  return pattern.includes("\\") ? matchEscapedGitignorePattern(target, pattern) : matchesExclude(target, pattern);
+function matchesGitignoreRule(rule, scoped, isDirectory) {
+  if (!rule.dirOnly) return matchGitignorePattern(scoped, rule.pattern);
+  const segments = scoped.split("/");
+  const limit = isDirectory ? segments.length : segments.length - 1;
+  for (let depth = 1; depth <= limit; depth += 1) {
+    if (matchGitignorePattern(segments.slice(0, depth).join("/"), rule.pattern)) return true;
+  }
+  return false;
 }
-function gitignoreVerdict(layers, relativePath) {
+function gitignoreVerdict(layers, relativePath, isDirectory) {
   let verdict = null;
   for (const layer2 of layers) {
     let scoped;
@@ -2655,8 +3139,7 @@ function gitignoreVerdict(layers, relativePath) {
     }
     let layerVerdict = null;
     for (const rule of layer2.rules) {
-      const target = rule.dirOnly ? scoped.replace(/\/.*$/, "") : scoped;
-      if (matchesGitignorePattern(target, rule.pattern)) layerVerdict = !rule.negated;
+      if (matchesGitignoreRule(rule, scoped, isDirectory)) layerVerdict = !rule.negated;
     }
     if (layerVerdict !== null) verdict = layerVerdict;
   }
@@ -2681,13 +3164,14 @@ function defaultIgnoreReason(relativePath) {
 }
 function listIgnoredPaths(cwd) {
   try {
-    const stdout = childProcess.execSync(
-      "git ls-files -z --others --ignored --exclude-standard --directory",
+    const stdout = childProcess.execFileSync(
+      "git",
+      ["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--directory"],
       {
         cwd,
         stdio: ["ignore", "pipe", "ignore"],
         encoding: "utf8",
-        maxBuffer: 32 * 1024 * 1024
+        maxBuffer: GIT_OUTPUT_LIMIT
       }
     );
     return stdout.split("\0").filter((entry) => entry.length > 0).map((entry) => entry.replace(/\\/g, "/"));
@@ -2695,13 +3179,9 @@ function listIgnoredPaths(cwd) {
     return [];
   }
 }
-var TOOL_OWNED_DIR_NAMES = /* @__PURE__ */ new Set(["snapshot", "snapshot.tmp"]);
-function isToolOwnedDirName(name) {
-  return TOOL_OWNED_DIR_NAMES.has(name) || name.startsWith("snapshot.backup-");
-}
 function hasSnapshotMarker(target) {
   try {
-    return fs12.statSync(target).isDirectory() && fs12.existsSync(path13.join(target, ".codebase-snapshot"));
+    return fs14.statSync(target).isDirectory() && fs14.existsSync(path16.join(target, ".codebase-snapshot"));
   } catch {
     return false;
   }
@@ -2715,7 +3195,7 @@ function makeToolOwnedDecider(cwd, toolOwnedPaths) {
       const prefix = parts.slice(0, depth).join("/");
       let hasMarker = markers.get(prefix);
       if (hasMarker === void 0) {
-        hasMarker = fs12.existsSync(path13.join(cwd, prefix, ".codebase-snapshot"));
+        hasMarker = fs14.existsSync(path16.join(cwd, prefix, ".codebase-snapshot"));
         markers.set(prefix, hasMarker);
       }
       if (hasMarker) return true;
@@ -2730,7 +3210,7 @@ function makeLinkProbe() {
     let known = cache.get(absolutePath);
     if (known === void 0) {
       try {
-        known = fs12.lstatSync(absolutePath).isSymbolicLink();
+        known = fs14.lstatSync(absolutePath).isSymbolicLink();
       } catch {
         known = false;
       }
@@ -2743,7 +3223,7 @@ function dropLinkedDirectories(cwd, candidates, skipped) {
   const isLink = makeLinkProbe();
   let rootReal = cwd;
   try {
-    rootReal = fs12.realpathSync(cwd);
+    rootReal = fs14.realpathSync(cwd);
   } catch {
   }
   const reported = /* @__PURE__ */ new Set();
@@ -2753,7 +3233,7 @@ function dropLinkedDirectories(cwd, candidates, skipped) {
     let linkedDir = null;
     for (let depth = 1; depth <= parts.length; depth += 1) {
       const prefix = parts.slice(0, depth).join("/");
-      if (isLink(path13.join(cwd, prefix))) {
+      if (isLink(path16.join(cwd, prefix))) {
         linkedDir = prefix;
         break;
       }
@@ -2764,10 +3244,10 @@ function dropLinkedDirectories(cwd, candidates, skipped) {
     }
     if (reported.has(linkedDir)) continue;
     reported.add(linkedDir);
-    const absolute = path13.join(cwd, linkedDir);
+    const absolute = path16.join(cwd, linkedDir);
     let targetReal = absolute;
     try {
-      targetReal = fs12.realpathSync(absolute);
+      targetReal = fs14.realpathSync(absolute);
     } catch {
     }
     const target = readLinkTarget(absolute, targetReal);
@@ -2787,13 +3267,14 @@ function dropLinkedDirectories(cwd, candidates, skipped) {
   return kept;
 }
 function listGitCandidates(cwd, skipped, isToolOwned) {
-  const stdout = childProcess.execSync(
-    "git ls-files -z --cached --others --exclude-standard",
+  const stdout = childProcess.execFileSync(
+    "git",
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard"],
     {
       cwd,
       stdio: ["ignore", "pipe", "ignore"],
       encoding: "utf8",
-      maxBuffer: 50 * 1024 * 1024
+      maxBuffer: GIT_OUTPUT_LIMIT
     }
   );
   let candidates = stdout.split("\0").filter((entry) => entry.length > 0).map((entry) => entry.replace(/\\/g, "/"));
@@ -2830,7 +3311,7 @@ function collectFiles(cwd, options = {}) {
   const isToolOwned = makeToolOwnedDecider(cwd, [...toolOwnedPaths]);
   let candidates;
   const skipped = [];
-  const discovery = options.discovery ?? activeDiscovery;
+  const discovery = options.discovery ?? "auto";
   if (discovery === "walk") {
     const walked = walkDirectory(cwd, cwd, rootRealFor(cwd), /* @__PURE__ */ new Set(), toolOwnedPaths);
     candidates = walked.files;
@@ -2844,7 +3325,7 @@ function collectFiles(cwd, options = {}) {
           "Discovery mode is `git`, but git could not list this directory's files. Run inside a working repository, or pass --discovery walk (or auto) to scan the tree directly."
         );
       }
-      if (fs12.existsSync(path13.join(cwd, ".git"))) {
+      if (fs14.existsSync(path16.join(cwd, ".git"))) {
         throw new Error(
           "This directory is a git repository, but git could not list its files. A plain walk honours .gitignore files, but git also applies .git/info/exclude and your global excludes file, includes files that are tracked although a .gitignore now matches them, and treats a submodule as a single entry. Fix the repository (git status should work), run outside git, or pass --discovery walk to accept those differences."
         );
@@ -2903,7 +3384,7 @@ function collectFiles(cwd, options = {}) {
 }
 function rootRealFor(root) {
   try {
-    return fs12.realpathSync(root);
+    return fs14.realpathSync(root);
   } catch {
     return root;
   }
@@ -2911,18 +3392,18 @@ function rootRealFor(root) {
 function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PURE__ */ new Set(), parentGitignoreLayers = []) {
   const results = { files: [], skipped: [] };
   const stack = [];
-  const relativeToBase = (target) => path13.relative(baseDir, target).replace(/\\/g, "/") || ".";
+  const relativeToBase = (target) => path16.relative(baseDir, target).replace(/\\/g, "/") || ".";
   const enter = (current, layers) => {
     if (visited.has(current)) return false;
     visited.add(current);
     const localRules = readGitignoreRules(current);
     const gitignoreLayers = localRules.length === 0 ? layers : [
       ...layers,
-      { prefix: path13.relative(baseDir, current).replace(/\\/g, "/"), rules: localRules }
+      { prefix: path16.relative(baseDir, current).replace(/\\/g, "/"), rules: localRules }
     ];
     let entries;
     try {
-      entries = fs12.readdirSync(current, { withFileTypes: true });
+      entries = fs14.readdirSync(current, { withFileTypes: true });
     } catch {
       results.skipped.push({
         path: relativeToBase(current),
@@ -2944,10 +3425,10 @@ function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PU
     }
     const entry = frame.entries[frame.index];
     frame.index += 1;
-    const fullPath = path13.join(frame.dir, entry.name);
-    const relPath = path13.relative(baseDir, fullPath).replace(/\\/g, "/");
-    if (isToolOwnedDirName(entry.name) && reservedPaths.has(relPath)) continue;
-    if (DEFAULT_IGNORED_DIRS.includes(entry.name)) {
+    const fullPath = path16.join(frame.dir, entry.name);
+    const relPath = path16.relative(baseDir, fullPath).replace(/\\/g, "/");
+    if (reservedPaths.has(relPath)) continue;
+    if (entry.isDirectory() && DEFAULT_IGNORED_DIRS.includes(entry.name)) {
       results.skipped.push({
         path: relPath,
         reason: "default-ignore",
@@ -2963,7 +3444,7 @@ function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PU
       });
       continue;
     }
-    if (gitignoreVerdict(frame.gitignoreLayers, relPath) === true) {
+    if (gitignoreVerdict(frame.gitignoreLayers, relPath, entry.isDirectory()) === true) {
       if (!hasSnapshotMarker(fullPath)) {
         results.skipped.push({
           path: relPath,
@@ -2978,14 +3459,14 @@ function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PU
     if (entry.isSymbolicLink()) {
       let targetReal;
       try {
-        targetReal = fs12.realpathSync(fullPath);
+        targetReal = fs14.realpathSync(fullPath);
       } catch {
         results.skipped.push({ path: relPath, reason: "read-error", detail: "broken symlink" });
         continue;
       }
       let stats;
       try {
-        stats = fs12.statSync(fullPath);
+        stats = fs14.statSync(fullPath);
       } catch {
         results.skipped.push({ path: relPath, reason: "read-error", detail: "unreadable symlink" });
         continue;
@@ -3027,6 +3508,28 @@ function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PU
   return results;
 }
 
+// src/tokenize.ts
+var WORD_RUN = /[A-Za-z0-9_]+/g;
+var SINGLE_TOKEN = /[^\sA-Za-z0-9_]/g;
+var LINE_BREAK_RUN = /\n+/g;
+var CHARS_PER_WORD_TOKEN = 6;
+function estimateTokens(text2) {
+  if (text2.length === 0) return 0;
+  let total = 0;
+  for (const match of text2.match(WORD_RUN) ?? []) {
+    total += Math.max(1, Math.round(match.length / CHARS_PER_WORD_TOKEN));
+  }
+  total += text2.match(SINGLE_TOKEN)?.length ?? 0;
+  total += text2.match(LINE_BREAK_RUN)?.length ?? 0;
+  return total;
+}
+function bytesForTokens(tokens) {
+  return Math.max(0, Math.floor(tokens * 4));
+}
+function formatTokens(count) {
+  return count.toLocaleString("en-US");
+}
+
 // src/config.ts
 var CONFIG_DIR_SYMBOL = /* @__PURE__ */ Symbol.for("codebase-snapshot.configDir");
 var CONFIG_FILENAMES = [
@@ -3040,13 +3543,13 @@ var CONFIG_FILENAMES = [
 ];
 function findConfigFile(cwd) {
   for (const filename of CONFIG_FILENAMES) {
-    const fullPath = path13.join(cwd, filename);
-    if (fs12.existsSync(fullPath)) return fullPath;
+    const fullPath = path16.join(cwd, filename);
+    if (fs14.existsSync(fullPath)) return fullPath;
   }
-  const pkgJsonPath = path13.join(cwd, "package.json");
-  if (!fs12.existsSync(pkgJsonPath)) return null;
+  const pkgJsonPath = path16.join(cwd, "package.json");
+  if (!fs14.existsSync(pkgJsonPath)) return null;
   try {
-    const parsed = JSON.parse(fs12.readFileSync(pkgJsonPath, "utf8"));
+    const parsed = JSON.parse(fs14.readFileSync(pkgJsonPath, "utf8"));
     return parsed.snapshot === void 0 ? null : pkgJsonPath;
   } catch {
     return null;
@@ -3080,9 +3583,23 @@ function isResolvedConfig(value) {
   );
   return hasResolvedNumbers && hasResolvedStrings && hasResolvedFlags && hasResolvedRules && hasCompiledRules;
 }
+function normalizeBudgets(budgets, maxPartBytes) {
+  const clearer = typeof maxPartBytes === "number" && Number.isFinite(maxPartBytes) && maxPartBytes > 0 ? maxPartBytes : void 0;
+  if (budgets === void 0 || typeof budgets !== "object" || budgets === null) {
+    return { default: clearer ?? 0, byLayer: {} };
+  }
+  const fallbackDefault = clearer ?? budgets.default;
+  const byLayer = {};
+  const layers = budgets.byLayer;
+  if (layers !== void 0 && typeof layers === "object" && layers !== null) {
+    for (const [layer2, value] of Object.entries(layers)) {
+      byLayer[layer2] = Math.min(value, fallbackDefault);
+    }
+  }
+  return { default: fallbackDefault, byLayer };
+}
 function normalizeResolvedConfig(config) {
   const discovery = isDiscoveryMode(config.discovery) ? config.discovery : "auto";
-  setActiveDiscovery(discovery);
   return markResolvedConfig({
     ...config,
     discovery,
@@ -3101,7 +3618,7 @@ function normalizeResolvedConfig(config) {
       ])
     ],
     layersMode: config.layersMode === "replace" ? "replace" : "merge",
-    budgets: config.budgets && typeof config.budgets === "object" ? config.budgets : { default: config.maxPartBytes, byLayer: {} },
+    budgets: normalizeBudgets(config.budgets, config.maxPartBytes),
     hooks: resolveHooks(config.hooks),
     excludePatterns: Array.isArray(config.excludePatterns) ? config.excludePatterns : [],
     layers: Array.isArray(config.layers) ? config.layers : [],
@@ -3223,6 +3740,7 @@ var CONFIG_KEYS = /* @__PURE__ */ new Set([
   "artifacts",
   "branch",
   "budgets",
+  "changedSince",
   "cwd",
   "discovery",
   "exclude",
@@ -3237,12 +3755,18 @@ var CONFIG_KEYS = /* @__PURE__ */ new Set([
   "layersMode",
   "maxMonolithBytes",
   "maxPartBytes",
+  "maxPartTokens",
   "outDir",
   "preset",
   "previewHeadLines",
+  "staged",
   "previewTailLines",
+  "secretRules",
   "secrets",
-  "tmpDir"
+  "sarif",
+  "skeleton",
+  "tmpDir",
+  "withDependents"
 ]);
 function assertKnownConfigKeys(value, file) {
   const unknownKeys = Object.keys(value).filter((key) => !CONFIG_KEYS.has(key));
@@ -3297,11 +3821,11 @@ async function loadConfigFileDetailed(cwd) {
   const warnings = [];
   const errors = [];
   for (const filename of CONFIG_FILENAMES) {
-    const fullPath = path13.join(cwd, filename);
-    if (!fs12.existsSync(fullPath)) continue;
+    const fullPath = path16.join(cwd, filename);
+    if (!fs14.existsSync(fullPath)) continue;
     if (filename.endsWith(".json") || filename === ".snapshotrc") {
       try {
-        const config = parseJsonish(fs12.readFileSync(fullPath, "utf8"), fullPath);
+        const config = parseJsonish(fs14.readFileSync(fullPath, "utf8"), fullPath);
         if (config === null || typeof config !== "object" || Array.isArray(config)) {
           throw new Error(
             `${fullPath} does not hold a configuration object (received ${describeValue2(config)}).`
@@ -3335,12 +3859,16 @@ async function loadConfigFileDetailed(cwd) {
       continue;
     }
   }
-  const pkgJsonPath = path13.join(cwd, "package.json");
-  if (fs12.existsSync(pkgJsonPath)) {
+  const pkgJsonPath = path16.join(cwd, "package.json");
+  if (fs14.existsSync(pkgJsonPath)) {
     try {
-      const parsed = parseJsonish(fs12.readFileSync(pkgJsonPath, "utf8"), pkgJsonPath);
+      const parsed = parseJsonish(fs14.readFileSync(pkgJsonPath, "utf8"), pkgJsonPath);
       const snapshotKey = parsed.snapshot;
       if (snapshotKey && typeof snapshotKey === "object" && !Array.isArray(snapshotKey)) {
+        assertKnownConfigKeys(
+          snapshotKey,
+          `${pkgJsonPath} (the "snapshot" key)`
+        );
         return { config: snapshotKey, file: pkgJsonPath, warnings, errors };
       }
       if (snapshotKey !== void 0) {
@@ -3361,7 +3889,7 @@ async function loadConfigFile(cwd) {
   const loaded = await loadConfigFileDetailed(cwd);
   if (loaded.config && loaded.file && typeof loaded.config === "object") {
     Object.defineProperty(loaded.config, CONFIG_DIR_SYMBOL, {
-      value: path13.dirname(loaded.file),
+      value: path16.dirname(loaded.file),
       enumerable: false,
       configurable: true
     });
@@ -3372,6 +3900,7 @@ async function loadConfigFile(cwd) {
   return loaded.config;
 }
 var MIN_MAX_PART_BYTES = 4096;
+var MIN_MAX_PART_TOKENS = MIN_MAX_PART_BYTES / 4;
 var ARTIFACT_NAMES = [
   "readme",
   "manifest",
@@ -3520,12 +4049,12 @@ function resolveKindRules(value) {
 function outputExcludePatterns(cwd, outDir, tmpDir) {
   const patterns = [];
   for (const dir of [outDir, tmpDir]) {
-    const absolute = path13.resolve(cwd, dir);
-    const relative7 = path13.relative(cwd, absolute);
-    if (!relative7 || relative7 === ".." || relative7.startsWith(`..${path13.sep}`) || path13.isAbsolute(relative7)) {
+    const absolute = path16.resolve(cwd, dir);
+    const relative8 = path16.relative(cwd, absolute);
+    if (!relative8 || relative8 === ".." || relative8.startsWith(`..${path16.sep}`) || path16.isAbsolute(relative8)) {
       continue;
     }
-    patterns.push(`${relative7.replace(/\\/g, "/")}/**`);
+    patterns.push(`${relative8.replace(/\\/g, "/")}/**`);
   }
   return patterns;
 }
@@ -3572,6 +4101,20 @@ function boundedBytes(value, fallback, minimum, label) {
   }
   return parsed;
 }
+function boundedTokens(value, label) {
+  const parsed = parseByteSize(value);
+  if (parsed === void 0 || !Number.isInteger(parsed)) {
+    throw new Error(
+      `${label} must be a whole token count such as 30000 or "30k" (received ${describeBytes(value)}).`
+    );
+  }
+  if (parsed < MIN_MAX_PART_TOKENS) {
+    throw new Error(
+      `${label} must be at least ${MIN_MAX_PART_TOKENS} tokens (${MIN_MAX_PART_BYTES} bytes is the smallest part budget); received ${describeBytes(value)}.`
+    );
+  }
+  return parsed;
+}
 function optionalBytes(value, label) {
   if (value === void 0 || value === null) return null;
   const parsed = parseByteSize(value);
@@ -3641,11 +4184,11 @@ function resolveCandidateCwd(userConfig, cliOptions, baseDir) {
     );
   }
   const candidate = cliOptions?.cwd || userConfig?.cwd || baseDir || process.cwd();
-  const resolved = path13.resolve(candidate);
-  if (!fs12.existsSync(resolved)) {
+  const resolved = path16.resolve(candidate);
+  if (!fs14.existsSync(resolved)) {
     throw new Error(`Working directory does not exist: ${resolved}`);
   }
-  if (!fs12.statSync(resolved).isDirectory()) {
+  if (!fs14.statSync(resolved).isDirectory()) {
     throw new Error(`Working directory is not a directory: ${resolved}`);
   }
   return resolved;
@@ -3660,7 +4203,6 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     );
   }
   const discovery = requestedDiscovery ?? "auto";
-  setActiveDiscovery(discovery);
   const forcedPreset = resolvePresetName(userConfig?.preset);
   if (forcedPreset !== void 0 && !getPreset(forcedPreset)) {
     throw new Error(unknownPresetMessage(forcedPreset));
@@ -3714,13 +4256,53 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     MIN_MAX_PART_BYTES,
     "maxPartBytes"
   );
+  const rawMaxPartTokens = cliOptions?.maxPartTokens ?? userConfig?.maxPartTokens;
+  const requestedMaxPartTokens = rawMaxPartTokens === null ? void 0 : rawMaxPartTokens;
+  const maxPartTokens = requestedMaxPartTokens === void 0 ? void 0 : boundedTokens(requestedMaxPartTokens, "maxPartTokens");
+  const effectiveMaxPartBytes = maxPartTokens === void 0 ? maxPartBytes : Math.min(maxPartBytes, bytesForTokens(maxPartTokens));
   const budgets = resolveBudgets(
     userConfig?.budgets,
-    maxPartBytes,
-    explicitMaxPartBytes !== void 0
+    effectiveMaxPartBytes,
+    explicitMaxPartBytes !== void 0 || maxPartTokens !== void 0
   );
+  const resolvedMaxPartBytes = explicitMaxPartBytes !== void 0 || maxPartTokens !== void 0 ? effectiveMaxPartBytes : budgets.default;
   const configuredOutDir = strictString(userConfig?.outDir, "snapshot", "`outDir`");
   const outDir = cliOptions?.outDir || configuredOutDir;
+  const rawChangedSinceSetting = cliOptions?.changedSince ?? userConfig?.changedSince;
+  const rawChangedSince = rawChangedSinceSetting === null ? void 0 : rawChangedSinceSetting;
+  if (rawChangedSince !== void 0 && (typeof rawChangedSince !== "string" || rawChangedSince.trim().length === 0)) {
+    throw new Error(
+      `\`changedSince\` must be a git ref such as "main" or "HEAD~3" (received ${describeValue2(rawChangedSince)}).`
+    );
+  }
+  const changedSince = rawChangedSince === void 0 ? void 0 : String(rawChangedSince).trim();
+  const rawStaged = cliOptions?.staged ?? userConfig?.staged;
+  if (rawStaged !== void 0 && typeof rawStaged !== "boolean") {
+    throw new Error(`\`staged\` must be a boolean (received ${describeValue2(rawStaged)}).`);
+  }
+  const staged = rawStaged === true;
+  const rawWithDependents = cliOptions?.withDependents ?? userConfig?.withDependents;
+  if (rawWithDependents !== void 0 && typeof rawWithDependents !== "boolean") {
+    throw new Error(
+      `\`withDependents\` must be a boolean (received ${describeValue2(rawWithDependents)}).`
+    );
+  }
+  const withDependents = rawWithDependents === true;
+  const rawSkeleton = cliOptions?.skeleton ?? userConfig?.skeleton;
+  if (rawSkeleton !== void 0 && typeof rawSkeleton !== "boolean") {
+    throw new Error(`\`skeleton\` must be a boolean (received ${describeValue2(rawSkeleton)}).`);
+  }
+  const skeleton = rawSkeleton === true;
+  const rawSarif = cliOptions?.sarif ?? userConfig?.sarif;
+  if (rawSarif !== void 0 && typeof rawSarif !== "boolean") {
+    throw new Error(`\`sarif\` must be a boolean (received ${describeValue2(rawSarif)}).`);
+  }
+  const sarif = rawSarif === true;
+  if (withDependents && changedSince === void 0 && !staged) {
+    throw new Error(
+      "`withDependents` widens a changed-files scope, so it needs `changedSince` or `staged` (with neither, every file is already included)."
+    );
+  }
   const tmpDir = strictString(userConfig?.tmpDir, "snapshot.tmp", "`tmpDir`");
   const branch = strictString(userConfig?.branch, "main", "`branch`");
   const configuredSensitiveFiles = strictBoolean(
@@ -3741,7 +4323,8 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     branch,
     outDir,
     tmpDir,
-    maxPartBytes,
+    maxPartBytes: resolvedMaxPartBytes,
+    ...maxPartTokens === void 0 ? {} : { maxPartTokens },
     largeFileBytes: boundedBytes(cliOptions?.largeFileBytes ?? userConfig?.largeFileBytes, 200 * 1024, 1, "largeFileBytes"),
     previewHeadLines: strictPositiveInteger(userConfig?.previewHeadLines, 80, "`previewHeadLines`"),
     previewTailLines: strictPositiveInteger(userConfig?.previewTailLines, 40, "`previewTailLines`"),
@@ -3751,6 +4334,11 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
       "maxMonolithBytes"
     ),
     includeSensitiveFiles,
+    ...changedSince === void 0 ? {} : { changedSince },
+    ...staged ? { staged } : {},
+    ...withDependents ? { withDependents } : {},
+    ...skeleton ? { skeleton } : {},
+    ...sarif ? { sarif } : {},
     include: resolveInclude(userConfig?.include),
     preset: preset.presetName,
     presetExclude,
@@ -3784,14 +4372,11 @@ function matchRule(filePath, matcher) {
     if (pattern.endsWith("/**")) {
       const prefix = pattern.slice(0, -3).replace(/\/+$/, "");
       if (!prefix) return true;
-      if (!/[*?]/.test(prefix)) {
+      if (!/[*?{[]/.test(prefix)) {
         return filePath === prefix || filePath.startsWith(`${prefix}/`);
       }
     }
-    if (pattern.includes("*") || pattern.includes("?")) {
-      return globToRegExp(pattern).test(filePath);
-    }
-    return filePath.includes(pattern);
+    return matchesExclude(filePath, pattern);
   }
   return false;
 }
@@ -3810,6 +4395,21 @@ function classifyKind(filePath, kinds) {
 function configDigest(config) {
   const material = {
     maxPartBytes: config.maxPartBytes,
+    // The user's own unit. `maxPartBytes` above already reflects the converted ceiling, but
+    // recording the token number means changing 32k to 64k moves the digest even in the
+    // corner where both round to the same byte budget.
+    maxPartTokens: config.maxPartTokens ?? null,
+    // A changed-files scope decides which files are in the snapshot at all, so a snapshot
+    // taken over a different scope is a different snapshot.
+    changedSince: config.changedSince ?? null,
+    staged: config.staged === true,
+    withDependents: config.withDependents === true,
+    // Signature compression changes the emitted bytes of every TypeScript file it touches.
+    skeleton: config.skeleton === true,
+    // `sarif` is not one of `artifacts`: it writes `reports/audit.sarif` beside the audit, and
+    // leaving it out of the digest meant a snapshot taken without it and one taken with it
+    // compared equal even though their directories differ.
+    sarif: config.sarif === true,
     largeFileBytes: config.largeFileBytes,
     previewHeadLines: config.previewHeadLines,
     previewTailLines: config.previewTailLines,
@@ -3822,9 +4422,19 @@ function configDigest(config) {
     preset: config.preset,
     layersMode: config.layersMode,
     budgets: config.budgets,
-    layers: config.layers.map((layer2) => layer2.name),
-    kinds: config.kinds.map((kind) => kind.kind),
-    secretRules: config.secretRules.map((rule) => `${rule.rule}:${rule.pattern.source}`).sort()
+    // The matcher is what makes a layer a layer. Hashing only the names meant that
+    // moving `{ name: "api", match: "src/api/**" }` to `"src/v2/**"` produced the same
+    // digest, so `validate` reported "valid and up to date" for a snapshot whose files
+    // had all been reclassified — and per-layer budgets applied to different files.
+    layers: config.layers.map((layer2) => ({ name: layer2.name, match: String(layer2.match) })),
+    kinds: config.kinds.map((kind) => ({ kind: kind.kind, match: String(kind.match) })),
+    // How files are enumerated decides what is in the snapshot at all.
+    discovery: config.discovery ?? "auto",
+    // `flags` and `valueGroup` change *what is masked*, and a rule's source alone does
+    // not imply either: the same source with and without `i` redacts different lines.
+    secretRules: config.secretRules.map(
+      (rule) => `${rule.rule}:${rule.pattern.source}/${rule.pattern.flags}:${rule.valueGroup ?? ""}`
+    ).sort()
   };
   return createHash("sha256").update(JSON.stringify(material)).digest("hex");
 }
@@ -4004,6 +4614,95 @@ function generateAuditReport(manifest, secretFindings, secretRules) {
   }
   return lines.join("\n");
 }
+var SARIF_VERSION = "2.1.0";
+var SARIF_SCHEMA = "https://json.schemastore.org/sarif-2.1.0.json";
+var BUILTIN_RULE_IDS = new Map(
+  [
+    ...DEFAULT_SECRET_PATTERNS.map((rule) => rule.rule),
+    // Produced by the whole-block pass in `redact.ts`, not by a pattern in the catalogue.
+    "private-key-block"
+  ].map((name, index) => [name, `CS${String(index + 1).padStart(3, "0")}`])
+);
+function ruleIdFor(name) {
+  const builtin = BUILTIN_RULE_IDS.get(name);
+  if (builtin !== void 0) return builtin;
+  const digest = crypto2.createHash("sha256").update(name).digest("hex").slice(0, 8);
+  return `CS${digest.toUpperCase()}`;
+}
+function generateSarifReport(manifest, findings, rules, toolVersion) {
+  const ruleNames = Array.from(
+    /* @__PURE__ */ new Set([...rules.map((rule) => rule.rule), ...findings.flatMap((finding) => finding.rules)])
+  ).sort();
+  const ruleIndex = /* @__PURE__ */ new Map();
+  const sarifRules = ruleNames.map((name, index) => {
+    ruleIndex.set(name, index);
+    const id = ruleIdFor(name);
+    return {
+      id,
+      name,
+      shortDescription: { text: `Credential-shaped value masked by the "${name}" rule` },
+      defaultConfiguration: { level: "note" },
+      help: {
+        text: "A value in this line matched a secret pattern and was replaced with a redaction marker in the snapshot. If this is a real credential, rotate it; if it is a fixture, the placeholder can be made unmistakable."
+      }
+    };
+  });
+  const results = findings.filter((finding) => typeof finding.path === "string" && finding.path.length > 0).map((finding) => {
+    const primary = finding.rules[0] ?? "unknown";
+    const line = Math.max(1, finding.line);
+    const findingPath = String(finding.path).replace(/\\/g, "/");
+    return {
+      ruleId: ruleIdFor(primary),
+      ruleIndex: ruleIndex.get(primary) ?? 0,
+      level: "note",
+      message: {
+        text: `Credential-shaped value masked (rule${finding.rules.length === 1 ? "" : "s"}: ${finding.rules.join(", ")})`
+      },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: { uri: findingPath, uriBaseId: "%SRCROOT%" },
+            region: { startLine: line }
+          }
+        }
+      ],
+      partialFingerprints: {
+        // Stable across commits for the same finding, which is what keeps an alert open
+        // instead of closing and reopening it on every run.
+        codebaseSnapshotFinding: `${findingPath}#L${line}#${finding.rules.join("+")}`
+      }
+    };
+  }).sort(
+    (a, b) => a.locations[0].physicalLocation.artifactLocation.uri.localeCompare(
+      b.locations[0].physicalLocation.artifactLocation.uri
+    ) || a.locations[0].physicalLocation.region.startLine - b.locations[0].physicalLocation.region.startLine
+  );
+  const log = {
+    $schema: SARIF_SCHEMA,
+    version: SARIF_VERSION,
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "codebase-snapshot",
+            version: toolVersion,
+            informationUri: "https://github.com/ankurhalder/codebase-snapshot",
+            rules: sarifRules
+          }
+        },
+        automationDetails: {
+          // The snapshot's own fingerprint: two uploads of the same snapshot are the same run,
+          // so Code Scanning can tell an unchanged upload from a new one.
+          id: `codebase-snapshot/${manifest.fingerprint}`
+        },
+        originalUriBaseIds: { "%SRCROOT%": { uri: "file:///" } },
+        results
+      }
+    ]
+  };
+  return `${JSON.stringify(log, null, 2)}
+`;
+}
 
 // src/partitioner/preview.ts
 function countLines(content) {
@@ -4053,14 +4752,29 @@ var HEADER_RESERVE_BYTES = 2048 + Buffer.byteLength(UNTRUSTED_CONTENT_NOTICE, "u
 var MIN_SECTION_BUDGET_BYTES = 512;
 var MAX_SPLIT_PASSES = 64;
 var BUDGET_MARKER_RESERVE = 96;
+function insertTokenLine(markdown, tokens) {
+  return markdown.replace(
+    /^(- Files: .*)$/m,
+    `$1
+- Estimated Tokens: ~${formatTokens(tokens)}`
+  );
+}
+function replaceTokenLine(markdown, tokens) {
+  const line = `- Estimated Tokens: ~${formatTokens(tokens)}`;
+  if (/^- Estimated Tokens: .*$/m.test(markdown)) {
+    return markdown.replace(/^- Estimated Tokens: .*$/m, line);
+  }
+  return insertTokenLine(markdown, tokens);
+}
 var BUDGET_MARKER_SUFFIX = /\n\.\.\. \[\d+ lines omitted: part budget \d+ B\] \.\.\.$/;
-function truncateWithBudgetMarker(content, maxBytes, budget) {
+var TOKEN_LINE = /^- Estimated Tokens: .*$/m;
+var TOKEN_LINE_SLACK = 32;
+function truncateWithBudgetMarker(content, maxBytes, budget, originalLines) {
   const base = content.replace(BUDGET_MARKER_SUFFIX, "");
-  const baseLines = countLines(base);
   const truncated = truncateToBytes(base, Math.max(0, maxBytes));
   if (!truncated.isTruncated) return { content: base, isTruncated: false };
   const keptLines = countLines(truncated.content);
-  const omitted = Math.max(1, baseLines - keptLines);
+  const omitted = Math.max(1, Math.max(countLines(base), originalLines) - keptLines);
   return {
     content: `${truncated.content}
 ... [${omitted} lines omitted: part budget ${budget} B] ...`,
@@ -4074,7 +4788,7 @@ function partitionFiles(files, maxPartBytes, contentFingerprint) {
   const prepared = files.map((file) => prepareSection(file, sectionBudget));
   let groups = greedyGroups(prepared, budget);
   for (let pass = 0; pass < MAX_SPLIT_PASSES; pass++) {
-    const rendered = renderGroups(groups, contentFingerprint);
+    const rendered = renderGroups(groups, budget, contentFingerprint);
     const oversized = rendered.findIndex((part) => part.metadata.byteSize > budget);
     if (oversized === -1) return rendered;
     const group = groups[oversized];
@@ -4090,28 +4804,49 @@ function partitionFiles(files, maxPartBytes, contentFingerprint) {
       0,
       Buffer.byteLength(currentContent, "utf8") - overflow - BUDGET_MARKER_RESERVE
     );
-    const shrunk = truncateWithBudgetMarker(currentContent, shrinkTo, budget);
+    const shrunk = truncateWithBudgetMarker(
+      currentContent,
+      shrinkTo,
+      budget,
+      section.file.originalLines
+    );
     if (shrunk.isTruncated) {
       applyTruncatedContent(section.file, shrunk.content);
       section.text = renderFileSection(section.file);
       section.byteSize = Buffer.byteLength(section.text, "utf8");
       continue;
     }
-    const marker2 = "\n... [part truncated: cannot fit budget] ...\n";
-    const target = Math.max(0, budget - Buffer.byteLength(marker2, "utf8"));
+    const marker2 = TRUNCATION_MARKER;
+    assertBudgetHoldsMarker(budget);
+    const target = Math.max(
+      0,
+      budget - Buffer.byteLength(marker2, "utf8") - TOKEN_LINE_SLACK
+    );
     const clipped = truncateToBytes(rendered[oversized].markdown, target);
     rendered[oversized] = rehashPart(rendered[oversized], clipped.content + marker2);
     return rendered;
   }
-  return enforceBudget(renderGroups(groups, contentFingerprint), budget);
+  return enforceBudget(renderGroups(groups, budget, contentFingerprint), budget);
 }
-function enforceBudget(parts, budget) {
-  const marker2 = "\n... [part truncated: cannot fit budget] ...\n";
-  const target = Math.max(0, budget - Buffer.byteLength(marker2, "utf8"));
-  return parts.map((part) => {
+var TRUNCATION_MARKER = "\n... [part truncated: cannot fit budget] ...\n";
+function assertBudgetHoldsMarker(budget) {
+  const minimum = Buffer.byteLength(TRUNCATION_MARKER, "utf8");
+  if (budget < minimum) {
+    throw new Error(
+      `A part budget of ${budget} B cannot hold the truncation notice (${minimum} B), so a clipped part could not fit and still say it was clipped. Use a budget of at least ${minimum} B.`
+    );
+  }
+}
+function enforceBudget(parts, budget) {
+  const target = Math.max(
+    0,
+    budget - Buffer.byteLength(TRUNCATION_MARKER, "utf8") - TOKEN_LINE_SLACK
+  );
+  return parts.map((part) => {
     if (part.metadata.byteSize <= budget) return part;
+    assertBudgetHoldsMarker(budget);
     const clipped = truncateToBytes(part.markdown, target);
-    return rehashPart(part, clipped.content + marker2);
+    return rehashPart(part, clipped.content + TRUNCATION_MARKER);
   });
 }
 function renumberParts(parts, contentFingerprint) {
@@ -4120,7 +4855,7 @@ function renumberParts(parts, contentFingerprint) {
   const zeroPad = (index) => String(index).padStart(Math.max(3, String(total).length), "0");
   const nameFor = (position) => `part-${zeroPad(position)}.md`;
   const marker2 = "## Contents\n";
-  return parts.map((part, index) => {
+  const renumbered = parts.map((part, index) => {
     const markerIndex = part.markdown.indexOf(marker2);
     const body = markerIndex === -1 ? "" : part.markdown.slice(markerIndex + marker2.length);
     const included = part.metadata.includedFiles;
@@ -4156,19 +4891,25 @@ function renumberParts(parts, contentFingerprint) {
       "## Contents",
       ""
     ].join("\n");
-    const markdown = (header + body).replace(/\r\n/g, "\n");
+    const assembled = (header + body).replace(/\r\n/g, "\n");
+    const estimatedTokens = estimateTokens(assembled);
+    const markdown = insertTokenLine(assembled, estimatedTokens);
     const metadata = {
       ...part.metadata,
       index: index + 1,
       filename: nameFor(index + 1),
       byteSize: Buffer.byteLength(markdown, "utf8"),
-      sha256: crypto.createHash("sha256").update(markdown).digest("hex"),
+      estimatedTokens,
+      sha256: crypto2.createHash("sha256").update(markdown).digest("hex"),
       lines: countLines(markdown),
       fileCount: included.length,
       layersCovered: Object.keys(layerCounts).sort()
     };
     return { filename: metadata.filename, markdown, metadata };
   });
+  return renumbered.map(
+    (part) => enforceBudget([part], part.metadata.budgetBytes)[0] ?? part
+  );
 }
 var SECTION_TRUNCATION_NOTICE = "\n... [section truncated: metadata alone exceeds the part budget] ...\n";
 var METADATA_VALUE_MAX = 200;
@@ -4192,7 +4933,12 @@ function prepareSection(file, sectionBudget) {
     const overhead = byteSize - Buffer.byteLength(content, "utf8");
     const allowed = sectionBudget - overhead - BUDGET_MARKER_RESERVE;
     if (allowed <= 0) return;
-    const truncated = truncateWithBudgetMarker(content, allowed, sectionBudget);
+    const truncated = truncateWithBudgetMarker(
+      content,
+      allowed,
+      sectionBudget,
+      file.originalLines
+    );
     if (!truncated.isTruncated) return;
     applyTruncatedContent(file, truncated.content);
     text2 = renderFileSection(file);
@@ -4222,14 +4968,17 @@ function applyTruncatedContent(file, content) {
   file.includedLines = countLines(content);
 }
 function rehashPart(part, markdown) {
+  const estimatedTokens = estimateTokens(markdown.replace(TOKEN_LINE, ""));
+  const redistributed = replaceTokenLine(markdown, estimatedTokens);
   return {
     filename: part.filename,
-    markdown,
+    markdown: redistributed,
     metadata: {
       ...part.metadata,
-      byteSize: Buffer.byteLength(markdown, "utf8"),
-      sha256: crypto.createHash("sha256").update(markdown).digest("hex"),
-      lines: countLines(markdown)
+      byteSize: Buffer.byteLength(redistributed, "utf8"),
+      sha256: crypto2.createHash("sha256").update(redistributed).digest("hex"),
+      lines: countLines(redistributed),
+      estimatedTokens
     }
   };
 }
@@ -4258,7 +5007,7 @@ function greedyGroups(sections, budget) {
   if (current.length > 0) groups.push(current);
   return groups;
 }
-function renderGroups(groups, contentFingerprint) {
+function renderGroups(groups, budget, contentFingerprint) {
   const total = groups.length;
   const zeroPad = (index) => String(index).padStart(Math.max(3, String(total).length), "0");
   return groups.map((group, index) => {
@@ -4298,9 +5047,11 @@ function renderGroups(groups, contentFingerprint) {
       "## Contents",
       ""
     ].join("\n");
-    const content = (header + group.map((s) => s.text).join("")).replace(/\r\n/g, "\n");
+    const assembled = (header + group.map((s) => s.text).join("")).replace(/\r\n/g, "\n");
+    const estimatedTokens = estimateTokens(assembled);
+    const content = insertTokenLine(assembled, estimatedTokens);
     const byteSize = Buffer.byteLength(content, "utf8");
-    const sha256 = crypto.createHash("sha256").update(content).digest("hex");
+    const sha256 = crypto2.createHash("sha256").update(content).digest("hex");
     const includedFiles = group.map(({ file }) => ({
       relativePath: file.relativePath,
       sourceBytes: file.sizeBytes,
@@ -4313,6 +5064,8 @@ function renderGroups(groups, contentFingerprint) {
       index: index + 1,
       filename,
       byteSize,
+      estimatedTokens,
+      budgetBytes: budget,
       sha256,
       lines: countLines(content),
       fileCount: group.length,
@@ -4326,6 +5079,16 @@ function emittedBody(content) {
   const normalised = content.replace(/\r\n/g, "\n");
   return normalised.endsWith("\n") ? normalised.slice(0, -1) : normalised;
 }
+function compactMetadata(file) {
+  const count = (value) => `${value} line${value === 1 ? "" : "s"}`;
+  const lines = file.includedLines === file.originalLines ? count(file.originalLines) : `${count(file.includedLines)} of ${count(file.originalLines)}`;
+  return [
+    `- Meta: ${capMetadata(file.layer)}/${capMetadata(file.kind)}`,
+    capMetadata(file.language),
+    file.inclusionMode,
+    `${lines} (${file.sizeBytes} B)`
+  ].join(" | ");
+}
 function renderFileSection(file) {
   const content = file.content ?? "";
   const body = emittedBody(content);
@@ -4337,16 +5100,9 @@ function renderFileSection(file) {
     `<a id="${anchor}"></a>`,
     `### FILE: ${displayPath(file.relativePath)}`,
     "",
-    `- Layer: ${capMetadata(file.layer)}`,
-    `- Kind: ${capMetadata(file.kind)}`,
-    `- Language: ${capMetadata(file.language)}`,
-    `- Inclusion: ${file.inclusionMode}`,
-    `- Source Bytes: ${file.sizeBytes}`,
-    `- Source Lines: ${file.originalLines}`,
-    `- Included Lines: ${file.includedLines}`,
-    `- SHA-256: ${file.hashSha256}`,
+    compactMetadata(file),
     ...file.summaryQuality ? [`- Summary Quality: ${file.summaryQuality}`] : [],
-    ...renderSummary(file.summary),
+    ...renderSummary(file.summary, file.inclusionMode),
     ...file.summaryOmitted ? ["- Summary: (omitted: exceeds the part budget)"] : [],
     "",
     file.inclusionMode === "preview" ? "#### Bounded Preview" : "#### Content",
@@ -4366,14 +5122,15 @@ function fenceForText(content, minimum) {
   const maxRun = matches?.reduce((max, run) => Math.max(max, run.length), 0) ?? 0;
   return "`".repeat(Math.max(minimum, maxRun + 1));
 }
-function renderSummary(summary) {
+function renderSummary(summary, inclusionMode) {
   if (!summary) return [];
   if (typeof summary === "string") return [`- Summary: ${summary}`];
+  if (inclusionMode === "full") return [];
   return ["- Summary:", "```json", JSON.stringify(summary, null, 2), "```"];
 }
 function anchorForPath(filePath) {
   const slug = filePath.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
-  const digest = crypto.createHash("sha256").update(filePath).digest("hex").slice(0, 8);
+  const digest = crypto2.createHash("sha256").update(filePath).digest("hex").slice(0, 8);
   return `${slug || "file"}-${digest}`;
 }
 
@@ -4669,7 +5426,7 @@ var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
   ".so"
 ]);
 function isBinaryExtension(filePath) {
-  const ext = path13.extname(filePath).toLowerCase();
+  const ext = path16.extname(filePath).toLowerCase();
   return BINARY_EXTENSIONS.has(ext);
 }
 function isBinaryBuffer(buffer) {
@@ -4839,13 +5596,13 @@ function isBinaryFile(absolutePath) {
   if (isBinaryExtension(absolutePath)) return true;
   let fd;
   try {
-    fd = fs12.openSync(absolutePath, "r");
+    fd = fs14.openSync(absolutePath, "r");
     const buffer = Buffer.alloc(CHUNK);
     let sample;
     let position = 0;
     while (position < BINARY_SCAN_BYTES) {
       const wanted = Math.min(CHUNK, BINARY_SCAN_BYTES - position);
-      const bytesRead = fs12.readSync(fd, buffer, 0, wanted, position);
+      const bytesRead = fs14.readSync(fd, buffer, 0, wanted, position);
       if (bytesRead === 0) return false;
       const chunk = buffer.subarray(0, bytesRead);
       if (sample === void 0) {
@@ -4863,12 +5620,145 @@ function isBinaryFile(absolutePath) {
   } finally {
     if (fd !== void 0) {
       try {
-        fs12.closeSync(fd);
+        fs14.closeSync(fd);
       } catch {
       }
     }
   }
 }
+function gitPaths(cwd, args) {
+  let output;
+  try {
+    output = execFileSync("git", args, {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024
+    });
+  } catch (err) {
+    const stderr = err.stderr ?? "";
+    const reason = stderr.trim() || err.message;
+    throw new Error(
+      `Could not list changed files (git ${args.join(" ")}): ${reason}. A changed-files snapshot needs a git working tree and a ref that exists; run \`codebase-snapshot generate\` without --changed-since to scan everything.`
+    );
+  }
+  return output.split("\0").map((entry) => entry.trim().replace(/\\/g, "/")).filter((entry) => entry.length > 0);
+}
+function assertUsableRef(ref) {
+  if (ref.startsWith("-")) {
+    throw new Error(
+      `--changed-since must be a git ref, not an option (received ${JSON.stringify(ref)}). Name a branch, tag, or commit such as \`main\` or \`HEAD~1\`.`
+    );
+  }
+}
+function resolveChangedScope(cwd, request) {
+  const paths = /* @__PURE__ */ new Set();
+  const descriptions = [];
+  if (request.changedSince !== void 0) {
+    assertUsableRef(request.changedSince);
+    for (const path17 of gitPaths(cwd, [
+      "diff",
+      "--name-only",
+      "-z",
+      "--relative",
+      request.changedSince,
+      "--"
+    ])) {
+      paths.add(path17);
+    }
+    for (const path17 of gitPaths(cwd, ["ls-files", "--others", "--exclude-standard", "-z", "--"])) {
+      paths.add(path17);
+    }
+    descriptions.push(`changed since ${request.changedSince}`);
+  }
+  if (request.staged === true) {
+    for (const path17 of gitPaths(cwd, [
+      "diff",
+      "--cached",
+      "--name-only",
+      "-z",
+      "--relative",
+      "--"
+    ])) {
+      paths.add(path17);
+    }
+    descriptions.push("staged");
+  }
+  return { paths, detail: descriptions.join(" and ") };
+}
+var RELATIVE_SPECIFIER = /^\.{1,2}\//;
+var IMPORT_CANDIDATE_SUFFIXES = [
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  "/index.ts",
+  "/index.tsx",
+  "/index.js",
+  "/index.mjs"
+];
+var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+]);
+function buildImportResolver(files) {
+  const byPath = /* @__PURE__ */ new Map();
+  const byPathFolded = /* @__PURE__ */ new Map();
+  const byStem = /* @__PURE__ */ new Map();
+  const byStemFolded = /* @__PURE__ */ new Map();
+  const remember = (map, key, value) => {
+    if (!map.has(key)) map.set(key, value);
+  };
+  for (const file of files) {
+    const relativePath = file.relativePath;
+    remember(byPath, relativePath, relativePath);
+    remember(byPathFolded, relativePath.toLowerCase(), relativePath);
+    const extension = path16.posix.extname(relativePath);
+    if (!SOURCE_EXTENSIONS.has(extension)) continue;
+    const stem = relativePath.slice(0, -extension.length);
+    remember(byStem, stem, relativePath);
+    remember(byStemFolded, stem.toLowerCase(), relativePath);
+    if (path16.posix.basename(stem) === "index") {
+      const directory = path16.posix.dirname(stem);
+      remember(byStem, directory, relativePath);
+      remember(byStemFolded, directory.toLowerCase(), relativePath);
+    }
+  }
+  return { byPath, byPathFolded, byStem, byStemFolded };
+}
+function resolveSpecifier(fromFile, specifier, resolver) {
+  if (!RELATIVE_SPECIFIER.test(specifier)) return null;
+  const joined = path16.posix.normalize(
+    path16.posix.join(path16.posix.dirname(fromFile), specifier)
+  );
+  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
+  const direct = exact(joined);
+  if (direct) return direct;
+  for (const suffix of IMPORT_CANDIDATE_SUFFIXES) {
+    const hit = exact(`${joined}${suffix}`);
+    if (hit) return hit;
+  }
+  const stem = joined.replace(/\.(?:js|mjs|cjs|jsx)$/, "");
+  const byStem = (key) => resolver.byStem.get(key) ?? resolver.byStemFolded.get(key.toLowerCase()) ?? null;
+  return byStem(joined) ?? byStem(stem);
+}
+function importsChangedFile(importerPath, imports, changedPaths, resolver) {
+  for (const specifier of imports) {
+    const resolved = resolveSpecifier(importerPath, specifier, resolver);
+    if (resolved !== null && changedPaths.has(resolved)) return true;
+  }
+  return false;
+}
 var LANGUAGE_BY_EXTENSION = {
   ".ts": "typescript",
   ".mts": "typescript",
@@ -4902,6 +5792,8 @@ var LANGUAGE_BY_EXTENSION = {
   ".java": "java",
   ".rb": "ruby",
   ".php": "php",
+  ".swift": "swift",
+  ".dart": "dart",
   ".toml": "toml",
   ".ini": "ini",
   ".env": "dotenv",
@@ -4910,7 +5802,8 @@ var LANGUAGE_BY_EXTENSION = {
   ".graphql": "graphql",
   ".gql": "graphql",
   ".proto": "protobuf",
-  ".tf": "hcl"
+  ".tf": "hcl",
+  ".tfvars": "hcl"
 };
 var LANGUAGE_BY_BASENAME = {
   Dockerfile: "dockerfile",
@@ -4923,44 +5816,66 @@ var LANGUAGE_BY_BASENAME = {
 };
 function detectLanguage(filePath) {
   const normalized = filePath.replace(/\\/g, "/");
-  const base = path13.posix.basename(normalized);
+  const base = path16.posix.basename(normalized);
   if (LANGUAGE_BY_BASENAME[base]) return LANGUAGE_BY_BASENAME[base];
   if (base === ".env" || base.startsWith(".env.")) return "dotenv";
-  const ext = path13.posix.extname(base).toLowerCase();
+  const ext = path16.posix.extname(base).toLowerCase();
   return LANGUAGE_BY_EXTENSION[ext] ?? "text";
 }
+var TS_SOURCE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+var isTsSource = (relativePath) => {
+  const lower = relativePath.toLowerCase();
+  return TS_SOURCE_EXTENSIONS.some((extension) => lower.endsWith(extension));
+};
+function importsOfText(relativePath, text2) {
+  if (isTsSource(relativePath)) return summarizeTypeScriptSource(relativePath, text2).imports;
+  return summarizeWithProfile(relativePath, text2)?.summary.imports ?? [];
+}
+function importsOfFile(relativePath, absolutePath) {
+  let buffer;
+  try {
+    buffer = fs14.readFileSync(absolutePath);
+  } catch {
+    return [];
+  }
+  const decoded = decodeText(buffer);
+  if (decoded.binary) return [];
+  return importsOfText(relativePath, decoded.text);
+}
+
+// src/validator/validate.ts
 function maskedPath(value, secretRules) {
   return findSecretInPath(value, secretRules)?.masked ?? value;
 }
 function confineToDirectory(directory, filename) {
   if (filename.includes("\0")) return null;
-  if (path13.isAbsolute(filename)) return null;
-  const base = path13.resolve(directory);
-  const resolved = path13.resolve(base, filename);
+  if (path16.isAbsolute(filename)) return null;
+  const base = path16.resolve(directory);
+  const resolved = path16.resolve(base, filename);
   const caseInsensitive = process.platform === "win32" || process.platform === "darwin";
-  const prefix = caseInsensitive ? `${base}${path13.sep}`.toLowerCase() : `${base}${path13.sep}`;
+  const prefix = caseInsensitive ? `${base}${path16.sep}`.toLowerCase() : `${base}${path16.sep}`;
   const candidate = caseInsensitive ? resolved.toLowerCase() : resolved;
   return candidate.startsWith(prefix) ? resolved : null;
 }
 function findStagingDirectory(config) {
-  const tmpDir = path13.resolve(config.cwd, config.tmpDir);
+  const tmpDir = path16.resolve(config.cwd, config.tmpDir);
   let entries;
   try {
-    entries = fs12.readdirSync(tmpDir);
+    entries = fs14.readdirSync(tmpDir);
   } catch {
     return null;
   }
   const runs = entries.filter((name) => name.startsWith("run-")).sort();
   const newest = runs[runs.length - 1];
-  return newest ? path13.join(tmpDir, newest) : null;
+  return newest ? path16.join(tmpDir, newest) : null;
 }
 function describeMissingManifest(config, manifestPath) {
-  const outDir = path13.resolve(config.cwd, config.outDir);
-  const markerPath = path13.join(outDir, ".codebase-snapshot");
+  const outDir = path16.resolve(config.cwd, config.outDir);
+  const markerPath = path16.join(outDir, ".codebase-snapshot");
   let marker2 = null;
   try {
-    if (fs12.existsSync(markerPath)) {
-      const parsed = JSON.parse(fs12.readFileSync(markerPath, "utf8"));
+    if (fs14.existsSync(markerPath)) {
+      const parsed = JSON.parse(fs14.readFileSync(markerPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         marker2 = parsed;
       }
@@ -4992,18 +5907,18 @@ function emptyDrift() {
   };
 }
 function sha256Hex(buffer) {
-  return crypto.createHash("sha256").update(buffer).digest("hex");
+  return crypto2.createHash("sha256").update(buffer).digest("hex");
 }
 var VERIFY_SNIFF_MAX_BYTES = 8 * 1024 * 1024;
-function wouldNowBeIncluded(cwd, relativePath, reason) {
-  const absolutePath = path13.join(cwd, relativePath);
+function wouldNowBeIncluded(cwd, relativePath) {
+  const absolutePath = path16.join(cwd, relativePath);
   try {
-    const stats = fs12.statSync(absolutePath);
+    const stats = fs14.statSync(absolutePath);
     if (!stats.isFile()) return false;
-    if (isBinaryFile(absolutePath)) return false;
-    if (reason !== "binary") return true;
-    if (stats.size > VERIFY_SNIFF_MAX_BYTES) return false;
-    return !decodeText(fs12.readFileSync(absolutePath)).binary;
+    if (stats.size <= VERIFY_SNIFF_MAX_BYTES) {
+      return !decodeText(fs14.readFileSync(absolutePath)).binary;
+    }
+    return !isBinaryFile(absolutePath);
   } catch {
     return false;
   }
@@ -5061,8 +5976,8 @@ function describeManifestShapeProblem(value) {
 function validateSnapshot(configInput) {
   assertUsableConfigInput(configInput);
   const config = isResolvedConfig(configInput) ? normalizeResolvedConfig(configInput) : resolveConfig(configInput);
-  const manifestPath = path13.resolve(config.cwd, config.outDir, "manifest.json");
-  if (!fs12.existsSync(manifestPath)) {
+  const manifestPath = path16.resolve(config.cwd, config.outDir, "manifest.json");
+  if (!fs14.existsSync(manifestPath)) {
     return {
       valid: false,
       manifestPresent: false,
@@ -5073,7 +5988,7 @@ function validateSnapshot(configInput) {
   }
   let manifest;
   try {
-    manifest = JSON.parse(fs12.readFileSync(manifestPath, "utf8"));
+    manifest = JSON.parse(fs14.readFileSync(manifestPath, "utf8"));
   } catch (err) {
     return {
       valid: false,
@@ -5095,7 +6010,7 @@ function validateSnapshot(configInput) {
   }
   const drift = emptyDrift();
   const warnings = [];
-  const snapshotDir = path13.resolve(config.cwd, config.outDir);
+  const snapshotDir = path16.resolve(config.cwd, config.outDir);
   const manifestFileMap = /* @__PURE__ */ new Map();
   for (const file of manifest.files) {
     if (file && typeof file.relativePath === "string") {
@@ -5113,23 +6028,72 @@ function validateSnapshot(configInput) {
     if (direct !== void 0) return direct;
     return skippedReasons.get(maskedPath(diskFile, config.secretRules)) ?? null;
   };
+  let unchangedScope = null;
+  const recordedChangedSince = manifest.config?.changedSince;
+  const recordedStaged = manifest.config?.staged === true;
+  const recordedWithDependents = manifest.config?.withDependents === true;
+  if (recordedChangedSince !== void 0 || recordedStaged) {
+    try {
+      unchangedScope = new Set(
+        resolveChangedScope(config.cwd, {
+          ...recordedChangedSince === void 0 ? {} : { changedSince: recordedChangedSince },
+          ...recordedStaged ? { staged: true } : {}
+        }).paths
+      );
+    } catch {
+      warnings.push(
+        "The snapshot was generated with a changed-files scope, but that scope could not be re-resolved; files it recorded as `unchanged` were trusted rather than re-checked."
+      );
+    }
+  }
+  let dependentResolver = null;
+  function becameDependent(diskFile) {
+    if (!recordedWithDependents || unchangedScope === null) return false;
+    dependentResolver ??= buildImportResolver(
+      collection.files.map((file) => ({ relativePath: file }))
+    );
+    return importsChangedFile(
+      diskFile,
+      importsOfFile(diskFile, path16.join(config.cwd, diskFile)),
+      unchangedScope,
+      dependentResolver
+    );
+  }
   const collection = collectFiles(config.cwd, {
     includePatterns: config.include,
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
     includeSensitiveFiles: config.includeSensitiveFiles,
-    secretRules: config.secretRules
+    secretRules: config.secretRules,
+    // Passed explicitly, like `generate` does. Relying on a process-wide "current
+    // discovery mode" meant `validate` could enumerate files one way while the snapshot
+    // had been generated another way, and then blame the difference on drift.
+    discovery: config.discovery,
+    // The same exclusion `generate` applies: without it, `validate` recounted the tool's
+    // own output directory as a set of files missing from the snapshot, so a correct
+    // snapshot was reported as drifting.
+    toolOwnedPaths: [config.outDir, config.tmpDir].map(
+      (directory) => path16.relative(config.cwd, path16.resolve(config.cwd, directory)).replace(/\\/g, "/")
+    ).filter((relative8) => relative8.length > 0 && !relative8.startsWith(".."))
   });
   for (const diskFile of collection.files) {
     const snapshotHash = manifestFileMap.get(diskFile);
     if (!snapshotHash) {
       const skipReason = skippedReasonOnDisk(diskFile);
-      if (skipReason !== null && !wouldNowBeIncluded(config.cwd, diskFile, skipReason)) continue;
+      if (skipReason === "unchanged") {
+        if (unchangedScope !== null) {
+          if (unchangedScope.has(diskFile) || becameDependent(diskFile)) {
+            drift.missingInSnapshot.push(diskFile);
+          }
+        }
+        continue;
+      }
+      if (skipReason !== null && !wouldNowBeIncluded(config.cwd, diskFile)) continue;
       drift.missingInSnapshot.push(diskFile);
       continue;
     }
     let diskHash;
     try {
-      diskHash = sha256Hex(fs12.readFileSync(path13.join(config.cwd, diskFile)));
+      diskHash = sha256Hex(fs14.readFileSync(path16.join(config.cwd, diskFile)));
     } catch (err) {
       if (err.code === "ENOENT") {
         drift.missingOnDisk.push(diskFile);
@@ -5153,7 +6117,7 @@ function validateSnapshot(configInput) {
     }
     let statFailure = null;
     try {
-      fs12.statSync(confined);
+      fs14.statSync(confined);
     } catch (err) {
       statFailure = err;
     }
@@ -5173,7 +6137,7 @@ function validateSnapshot(configInput) {
     ...Object.values(config.budgets.byLayer)
   );
   const partNames = /* @__PURE__ */ new Set();
-  const partsDir = path13.join(snapshotDir, "parts");
+  const partsDir = path16.join(snapshotDir, "parts");
   for (const part of manifest.parts) {
     if (!part || typeof part.filename !== "string") continue;
     partNames.add(part.filename);
@@ -5188,7 +6152,7 @@ function validateSnapshot(configInput) {
     }
     let buffer;
     try {
-      buffer = fs12.readFileSync(partPath);
+      buffer = fs14.readFileSync(partPath);
     } catch {
       drift.partIssues.push({ part: part.filename, issue: "missing from snapshot/parts" });
       continue;
@@ -5202,10 +6166,11 @@ function validateSnapshot(configInput) {
     if (sha256Hex(buffer) !== part.sha256) {
       drift.partIssues.push({ part: part.filename, issue: "sha256 does not match the manifest" });
     }
-    if (buffer.length > maxEffectiveBudget) {
+    const partBudget = typeof part.budgetBytes === "number" ? part.budgetBytes : maxEffectiveBudget;
+    if (buffer.length > partBudget) {
       drift.partIssues.push({
         part: part.filename,
-        issue: `${buffer.length} B exceeds the effective part budget ${maxEffectiveBudget} B`
+        issue: typeof part.budgetBytes === "number" ? `${buffer.length} B exceeds its part budget ${partBudget} B` : `${buffer.length} B exceeds the effective part budget ${partBudget} B`
       });
     }
   }
@@ -5402,9 +6367,9 @@ function validateSnapshot(configInput) {
     ["full-codebase.md", manifest.artifacts?.fullMarkdown]
   ]) {
     if (!artifact) continue;
-    const artifactPath = path13.join(snapshotDir, key);
+    const artifactPath = path16.join(snapshotDir, key);
     try {
-      const buffer = fs12.readFileSync(artifactPath);
+      const buffer = fs14.readFileSync(artifactPath);
       if (sha256Hex(buffer) !== artifact.sha256 || buffer.length !== artifact.byteSize) {
         drift.partIssues.push({ part: key, issue: "artifact does not match its recorded digest" });
       }
@@ -5412,6 +6377,18 @@ function validateSnapshot(configInput) {
       drift.partIssues.push({ part: key, issue: "declared artifact is missing" });
     }
   }
+  const sarifArtifact = manifest.artifacts?.sarif;
+  if (sarifArtifact) {
+    const sarifKey = "reports/audit.sarif";
+    try {
+      const buffer = fs14.readFileSync(path16.join(snapshotDir, "reports", "audit.sarif"));
+      if (sha256Hex(buffer) !== sarifArtifact.sha256 || buffer.length !== sarifArtifact.byteSize) {
+        drift.partIssues.push({ part: sarifKey, issue: "artifact does not match its recorded digest" });
+      }
+    } catch {
+      drift.partIssues.push({ part: sarifKey, issue: "declared artifact is missing" });
+    }
+  }
   if (manifest.git && manifest.git.branch && manifest.git.branch !== config.branch) {
     warnings.push(
       `Snapshot was generated on branch "${manifest.git.branch}" but the configured branch is "${config.branch}".`
@@ -5474,7 +6451,7 @@ function validateSnapshot(configInput) {
 
 // src/version.ts
 var GENERATOR_NAME = "codebase-snapshot";
-var GENERATOR_VERSION = "0.9.9";
+var GENERATOR_VERSION = "0.9.12";
 var LEGACY_GENERATOR_NAMES = ["@ankurhalder/codebase-snapshot"];
 function isOurGeneratorName(name) {
   if (typeof name !== "string") return false;
@@ -5521,17 +6498,17 @@ function isNewer(candidate, current) {
 }
 function cacheDirectory(env = process.env, platform = process.platform) {
   if (platform === "win32") {
-    const base2 = env.LOCALAPPDATA ?? path13.join(os.homedir(), "AppData", "Local");
-    return path13.join(base2, "codebase-snapshot");
+    const base2 = env.LOCALAPPDATA ?? path16.join(os.homedir(), "AppData", "Local");
+    return path16.join(base2, "codebase-snapshot");
   }
   if (platform === "darwin") {
-    return path13.join(os.homedir(), "Library", "Caches", "codebase-snapshot");
+    return path16.join(os.homedir(), "Library", "Caches", "codebase-snapshot");
   }
-  const base = env.XDG_CACHE_HOME ?? path13.join(os.homedir(), ".cache");
-  return path13.join(base, "codebase-snapshot");
+  const base = env.XDG_CACHE_HOME ?? path16.join(os.homedir(), ".cache");
+  return path16.join(base, "codebase-snapshot");
 }
 function cacheFilePath(env = process.env) {
-  return path13.join(cacheDirectory(env), "update-check.json");
+  return path16.join(cacheDirectory(env), "update-check.json");
 }
 function shouldCheck(argv, env) {
   const disabled = ["1", "true", "yes"].includes(
@@ -5544,13 +6521,23 @@ function shouldCheck(argv, env) {
   for (const skip of ["mcp", "describe", "skill", "--version", "-v", "--help", "-h"]) {
     if (args.includes(skip)) return false;
   }
-  if (args.some((argument) => argument.includes("json"))) return false;
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index];
+    if (argument === "--format") {
+      if (args[index + 1] === "json") return false;
+      break;
+    }
+    if (argument.startsWith("--format=")) {
+      if (argument.slice("--format=".length) === "json") return false;
+      break;
+    }
+  }
   return true;
 }
 function readCache(file) {
   let raw;
   try {
-    raw = fs12.readFileSync(file, "utf8");
+    raw = fs14.readFileSync(file, "utf8");
   } catch {
     return null;
   }
@@ -5567,8 +6554,8 @@ function readCache(file) {
 }
 function writeCache(file, entry) {
   try {
-    fs12.mkdirSync(path13.dirname(file), { recursive: true });
-    fs12.writeFileSync(file, `${JSON.stringify(entry)}
+    fs14.mkdirSync(path16.dirname(file), { recursive: true });
+    fs14.writeFileSync(file, `${JSON.stringify(entry)}
 `, "utf8");
   } catch {
   }
@@ -5662,42 +6649,42 @@ function describeMatcher(matcher) {
   return String(matcher);
 }
 function normalizeTarget(cwd, target) {
-  const absolute = path13.resolve(cwd, target);
-  const relative7 = path13.relative(cwd, absolute);
-  if (relative7.startsWith("..") || path13.isAbsolute(relative7)) return target;
-  return relative7.split(path13.sep).join("/");
+  const absolute = path16.resolve(cwd, target);
+  const relative8 = path16.relative(cwd, absolute);
+  if (relative8.startsWith("..") || path16.isAbsolute(relative8)) return target;
+  return relative8.split(path16.sep).join("/");
 }
 function findRuleMatch(rules, relativePath) {
   return rules.find(
     (rule) => matchRule(relativePath, rule.match)
   );
 }
-function findRecordedAncestor(skipped, relative7, maskedPath2) {
+function findRecordedAncestor(skipped, relative8, maskedPath2) {
   let nearest;
   for (const record of skipped) {
     const ancestorPath = record.path;
     if (ancestorPath.length === 0) continue;
-    const isAncestor = relative7.startsWith(`${ancestorPath}/`) || maskedPath2.startsWith(`${ancestorPath}/`);
+    const isAncestor = relative8.startsWith(`${ancestorPath}/`) || maskedPath2.startsWith(`${ancestorPath}/`);
     if (!isAncestor) continue;
     if (!nearest || ancestorPath.length > nearest.path.length) nearest = record;
   }
   return nearest;
 }
 function readManifest2(config) {
-  const manifestPath = path13.resolve(config.cwd, config.outDir, "manifest.json");
+  const manifestPath = path16.resolve(config.cwd, config.outDir, "manifest.json");
   try {
-    return JSON.parse(fs12.readFileSync(manifestPath, "utf8"));
+    return JSON.parse(fs14.readFileSync(manifestPath, "utf8"));
   } catch {
     return null;
   }
 }
 function explainPath(config, target) {
-  const relative7 = normalizeTarget(config.cwd, target);
-  const absolute = path13.join(config.cwd, relative7);
-  const maskedPath2 = findSecretInPath(relative7, config.secretRules)?.masked ?? relative7;
+  const relative8 = normalizeTarget(config.cwd, target);
+  const absolute = path16.join(config.cwd, relative8);
+  const maskedPath2 = findSecretInPath(relative8, config.secretRules)?.masked ?? relative8;
   const result = {
     path: maskedPath2,
-    exists: fs12.existsSync(absolute),
+    exists: fs14.existsSync(absolute),
     included: false
   };
   const collection = collectFiles(config.cwd, {
@@ -5705,15 +6692,18 @@ function explainPath(config, target) {
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
     includeSensitiveFiles: config.includeSensitiveFiles,
     secretRules: config.secretRules,
+    // `explain` must enumerate files exactly as `generate` would, or it explains a
+    // decision the generator never made.
+    discovery: config.discovery,
     // Same exclusion `generate` applies, so `explain` never says "not-discovered" about a file
     // that is only missing because the walker dropped the tool's own output directory.
     toolOwnedPaths: [config.outDir, config.tmpDir].map(
-      (directory) => path13.relative(config.cwd, path13.resolve(config.cwd, directory)).replace(/\\/g, "/")
-    ).filter((relative8) => relative8.length > 0 && !relative8.startsWith(".."))
+      (directory) => path16.relative(config.cwd, path16.resolve(config.cwd, directory)).replace(/\\/g, "/")
+    ).filter((relative9) => relative9.length > 0 && !relative9.startsWith(".."))
   });
-  if (!collection.files.includes(relative7)) {
+  if (!collection.files.includes(relative8)) {
     const record = collection.skipped.find(
-      (entry2) => entry2.path === relative7 || entry2.path === maskedPath2
+      (entry2) => entry2.path === relative8 || entry2.path === maskedPath2
     );
     if (record) {
       result.reason = record.reason;
@@ -5722,7 +6712,7 @@ function explainPath(config, target) {
       result.reason = "missing";
       result.detail = "no such file or directory, relative to the configured cwd";
     } else {
-      const ancestor = findRecordedAncestor(collection.skipped, relative7, maskedPath2);
+      const ancestor = findRecordedAncestor(collection.skipped, relative8, maskedPath2);
       if (ancestor) {
         result.reason = ancestor.reason;
         result.detail = ancestor.detail ? `${ancestor.detail} \u2014 inherited from the skipped directory \`${ancestor.path}\`` : `inside the skipped directory \`${ancestor.path}\``;
@@ -5734,21 +6724,58 @@ function explainPath(config, target) {
     return result;
   }
   result.included = true;
-  if (isBinaryFile(absolute)) {
+  if (config.changedSince !== void 0 || config.staged === true) {
+    let inScope;
+    let scopeDetail = "";
+    try {
+      const scope = resolveChangedScope(config.cwd, {
+        ...config.changedSince === void 0 ? {} : { changedSince: config.changedSince },
+        ...config.staged === true ? { staged: true } : {}
+      });
+      inScope = scope.paths.has(relative8);
+      if (!inScope && config.withDependents === true) {
+        inScope = importsChangedFile(
+          relative8,
+          importsOfFile(relative8, absolute),
+          scope.paths,
+          buildImportResolver(collection.files.map((file) => ({ relativePath: file })))
+        );
+      }
+      scopeDetail = scope.detail;
+    } catch (err) {
+      result.included = false;
+      result.reason = "unknown";
+      result.detail = `the changed-files scope could not be resolved: ${err.message}`;
+      return result;
+    }
+    if (!inScope) {
+      result.included = false;
+      result.reason = "unchanged";
+      result.detail = `not ${scopeDetail}; the snapshot was generated with a changed-files scope, which keeps only the files that moved (plus dependents, with --with-dependents)`;
+      return result;
+    }
+  }
+  let sizeOnDisk = null;
+  try {
+    sizeOnDisk = fs14.statSync(absolute).size;
+  } catch {
+    sizeOnDisk = null;
+  }
+  if (sizeOnDisk !== null && sizeOnDisk > BINARY_SCAN_BYTES && isBinaryFile(absolute)) {
     result.included = false;
     result.reason = "binary";
     result.detail = "binary content; generate skips it and records `binary` in manifest.skipped[]";
     return result;
   }
-  result.layer = classifyLayer(relative7, config.layers);
-  result.kind = classifyKind(relative7, config.kinds);
-  result.language = detectLanguage(relative7);
-  const layerRule = findRuleMatch(config.layers, relative7);
+  result.layer = classifyLayer(relative8, config.layers);
+  result.kind = classifyKind(relative8, config.kinds);
+  result.language = detectLanguage(relative8);
+  const layerRule = findRuleMatch(config.layers, relative8);
   if (layerRule) result.layerMatch = describeMatcher(layerRule.match);
-  const kindRule = findRuleMatch(config.kinds, relative7);
+  const kindRule = findRuleMatch(config.kinds, relative8);
   if (kindRule) result.kindMatch = describeMatcher(kindRule.match);
-  if (fs12.existsSync(absolute) && fs12.statSync(absolute).isFile()) {
-    const buffer = fs12.readFileSync(absolute);
+  if (fs14.existsSync(absolute) && fs14.statSync(absolute).isFile()) {
+    const buffer = fs14.readFileSync(absolute);
     const decoded = decodeText(buffer);
     if (decoded.binary) {
       result.included = false;
@@ -5760,12 +6787,12 @@ function explainPath(config, target) {
     result.bytes = buffer.length;
     result.lines = countLines(text2);
     if (decoded.encoding !== "utf-8") result.encoding = decoded.encoding;
-    const { findings } = scanAndRedactSecrets(text2, config.secretRules, relative7);
+    const { findings } = scanAndRedactSecrets(text2, config.secretRules, relative8);
     result.secretCount = findings.length;
     result.secrets = findings.slice(0, 20).map((finding) => ({ rules: finding.rules, line: finding.line }));
   }
   const manifest = readManifest2(config);
-  const entry = Array.isArray(manifest?.files) ? manifest.files.find((file) => file.relativePath === relative7) : void 0;
+  const entry = Array.isArray(manifest?.files) ? manifest.files.find((file) => file.relativePath === relative8) : void 0;
   result.part = entry?.part ?? null;
   result.inclusionMode = entry?.inclusionMode;
   return result;
@@ -5996,14 +7023,14 @@ function compareManifests(before, after) {
 function loadManifest(target) {
   let isDirectory;
   try {
-    isDirectory = fs12.statSync(target).isDirectory();
+    isDirectory = fs14.statSync(target).isDirectory();
   } catch {
     throw new Error(`No snapshot found at ${target}: the path does not exist.`);
   }
-  const manifestPath = isDirectory ? path13.join(target, "manifest.json") : target;
+  const manifestPath = isDirectory ? path16.join(target, "manifest.json") : target;
   let raw;
   try {
-    raw = fs12.readFileSync(manifestPath, "utf8");
+    raw = fs14.readFileSync(manifestPath, "utf8");
   } catch {
     throw new Error(`Could not read a manifest at ${manifestPath}.`);
   }
@@ -6060,15 +7087,15 @@ function renderDiffText(diff) {
 function appendGitignoreEntries(cwd, entries) {
   const wanted = [...new Set(entries)].filter((entry) => entry.trim().length > 0);
   if (wanted.length === 0) return { added: [], note: null };
-  const ignorePath = path13.join(cwd, ".gitignore");
+  const ignorePath = path16.join(cwd, ".gitignore");
   const manual = `Add ${wanted.map((entry) => `"${entry}"`).join(" and ")} to your .gitignore yourself.`;
   let existing = "";
   try {
-    if (fs12.existsSync(ignorePath)) {
-      if (fs12.statSync(ignorePath).isDirectory()) {
+    if (fs14.existsSync(ignorePath)) {
+      if (fs14.statSync(ignorePath).isDirectory()) {
         return { added: [], note: `${ignorePath} is a directory, so it was not updated. ${manual}` };
       }
-      existing = fs12.readFileSync(ignorePath, "utf8");
+      existing = fs14.readFileSync(ignorePath, "utf8");
     }
   } catch (err) {
     return {
@@ -6081,7 +7108,7 @@ function appendGitignoreEntries(cwd, entries) {
   if (added.length === 0) return { added: [], note: null };
   const prefix = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
   try {
-    fs12.writeFileSync(ignorePath, `${existing}${prefix}${added.join("\n")}
+    fs14.writeFileSync(ignorePath, `${existing}${prefix}${added.join("\n")}
 `, "utf8");
   } catch (err) {
     return { added: [], note: `${err.message}. ${manual}` };
@@ -6089,7 +7116,7 @@ function appendGitignoreEntries(cwd, entries) {
   return { added, note: null };
 }
 function gitignorePath(cwd, filePath) {
-  return path13.relative(cwd, filePath).split(path13.sep).join("/");
+  return path16.relative(cwd, filePath).split(path16.sep).join("/");
 }
 
 // src/wizard/config-template.ts
@@ -6097,7 +7124,12 @@ var DEFAULT_ANSWERS = {
   preset: "generic",
   branch: "main",
   maxPartBytes: "300k",
+  maxPartTokens: null,
   largeFileBytes: "200k",
+  maxMonolithBytes: null,
+  discovery: "auto",
+  skeleton: false,
+  sarif: false,
   include: [],
   excludePatterns: [],
   artifacts: {
@@ -6150,6 +7182,9 @@ function renderConfig(answers) {
   // \u2500\u2500 Size \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   // Hard ceiling per part. "300k", 307200 and "1.5mb" are all accepted.
   maxPartBytes: ${size(answers.maxPartBytes)},
+  // The same ceiling expressed in tokens; it narrows maxPartBytes rather than
+  // replacing it. null = not set. Minimum 1024.
+  maxPartTokens: ${answers.maxPartTokens === null ? "null" : String(answers.maxPartTokens)},
   // Files above this size get a head/tail preview instead of the full body.
   largeFileBytes: ${size(answers.largeFileBytes)},
   previewHeadLines: 80,
@@ -6160,6 +7195,22 @@ function renderConfig(answers) {
     byLayer: {},
   },
 
+  // \u2500\u2500 Scope and compression \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  // Replace function and method bodies with \`{ /* ... */ }\` in TypeScript files.
+  // Signatures and comments stay, so the structure of the file survives.
+  skeleton: ${answers.skeleton},
+  // Also write reports/audit.sarif (SARIF 2.1.0) for a CI security gate. The
+  // matched value is never included \u2014 only the path, the line and the rule.
+  sarif: ${answers.sarif},
+  // Snapshot only the files that differ from a git ref (for example "main"),
+  // plus untracked ones. null and false both mean "snapshot everything".
+  changedSince: null,
+  // Snapshot only what is staged in the index: the pre-commit counterpart.
+  staged: false,
+  // With changedSince or staged, also include the files that import a changed
+  // one, one hop out. Meaningless without a scope.
+  withDependents: false,
+
   // \u2500\u2500 What goes in \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   // Allow-list. Empty means "everything that is not ignored".
   // Example: ["src/**", "packages/*/src/**"]
@@ -6169,7 +7220,7 @@ function renderConfig(answers) {
   // How candidate files are found: "auto" lists them through git when git can
   // and walks the tree otherwise; "git" and "walk" force one path, and "walk" is
   // the escape hatch when .git exists but git cannot list it.
-  discovery: "auto",
+  discovery: ${JSON.stringify(answers.discovery)},
 
   // \u2500\u2500 Classification \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   // "merge" = the preset's rules plus yours (yours win). "replace" = yours only.
@@ -6200,7 +7251,7 @@ function renderConfig(answers) {
     monolith: ${artifacts.monolith},     // full-codebase.json + .md (roughly doubles output)
   },
   // Skip the monolith above this size. null = no limit.
-  maxMonolithBytes: null,
+  maxMonolithBytes: ${answers.maxMonolithBytes === null ? "null" : size(answers.maxMonolithBytes)},
   // Top-level switch for the monolith, equivalent to artifacts.monolith.
   // When both are present the artifact entry wins; this one exists so the
   // generated file lists every setting the tool accepts.
@@ -6577,10 +7628,10 @@ var CONFIG_CANDIDATES = [
 ];
 function chooseConfigFileName(cwd) {
   if (!supportsTypeScriptImports()) return "snapshot.config.mjs";
-  const pkgPath = path13.join(cwd, "package.json");
-  if (!fs12.existsSync(pkgPath)) return "snapshot.config.mjs";
+  const pkgPath = path16.join(cwd, "package.json");
+  if (!fs14.existsSync(pkgPath)) return "snapshot.config.mjs";
   try {
-    const parsed = JSON.parse(fs12.readFileSync(pkgPath, "utf8"));
+    const parsed = JSON.parse(fs14.readFileSync(pkgPath, "utf8"));
     return parsed.type === "module" ? "snapshot.config.ts" : "snapshot.config.mjs";
   } catch {
     return "snapshot.config.mjs";
@@ -6594,7 +7645,7 @@ var SIZE_CHOICES = [
 ];
 function packageJsonHasConfig(cwd) {
   try {
-    const parsed = JSON.parse(fs12.readFileSync(path13.join(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(fs14.readFileSync(path16.join(cwd, "package.json"), "utf8"));
     return typeof parsed.snapshot === "object" && parsed.snapshot !== null && !Array.isArray(parsed.snapshot);
   } catch {
     return false;
@@ -6611,11 +7662,12 @@ function artifactAnswers(options) {
     const keep = new Set(options.onlyArtifacts);
     for (const name of ARTIFACT_NAMES) artifacts[name] = keep.has(name);
   }
+  if (options.includeMonolith === true) artifacts.monolith = true;
   return artifacts;
 }
 function topLevelDirs(cwd) {
   try {
-    return fs12.readdirSync(cwd, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules").map((entry) => entry.name).sort();
+    return fs14.readdirSync(cwd, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules").map((entry) => entry.name).sort();
   } catch {
     return [];
   }
@@ -6628,7 +7680,7 @@ function describeJsonValue(value) {
 }
 function writeFileOrExplain(target, content) {
   try {
-    fs12.writeFileSync(target, content, "utf8");
+    fs14.writeFileSync(target, content, "utf8");
   } catch (err) {
     const code = err.code;
     const reason = code === "EACCES" || code === "EPERM" || code === "EROFS" ? `permission denied (${code})` : code === "EISDIR" ? "it is a directory" : `${err.message}`;
@@ -6639,7 +7691,7 @@ function canWriteModuleConfig(name, cwd) {
   if (name.endsWith(".mjs") || name.endsWith(".ts")) return true;
   if (!name.endsWith(".js")) return false;
   try {
-    const parsed = JSON.parse(fs12.readFileSync(path13.join(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(fs14.readFileSync(path16.join(cwd, "package.json"), "utf8"));
     return parsed.type === "module";
   } catch {
     return false;
@@ -6674,19 +7726,19 @@ function serializePackageJson(raw, value) {
   return `${text2}${raw.endsWith("\n") ? crlf ? "\r\n" : "\n" : ""}`;
 }
 function updatePackageJson(cwd, notes) {
-  const packagePath = path13.join(cwd, "package.json");
+  const packagePath = path16.join(cwd, "package.json");
   const unchanged = {
     scripts: [],
     dependency: { name: GENERATOR_NAME, range: null, added: false }
   };
-  if (!fs12.existsSync(packagePath)) {
+  if (!fs14.existsSync(packagePath)) {
     notes.push("No package.json found, so npm scripts and the devDependency were not added.");
     return unchanged;
   }
   let raw;
   let parsed;
   try {
-    raw = fs12.readFileSync(packagePath, "utf8");
+    raw = fs14.readFileSync(packagePath, "utf8");
     parsed = JSON.parse(raw);
   } catch {
     notes.push("Could not parse package.json; npm scripts and the devDependency were not added.");
@@ -6711,17 +7763,26 @@ function updatePackageJson(cwd, notes) {
     scriptsWereBroken = true;
   }
   const added = [];
+  const isSelfRepository = parsed.name === GENERATOR_NAME;
+  const scriptPrefix = isSelfRepository ? "node ./dist/bin.js" : `npx ${GENERATOR_NAME}`;
   if (!scripts.snapshot) {
-    scripts.snapshot = `npx ${GENERATOR_NAME} generate`;
+    scripts.snapshot = `${scriptPrefix} generate`;
     added.push("snapshot");
   }
   if (!scripts["snapshot:validate"]) {
-    scripts["snapshot:validate"] = `npx ${GENERATOR_NAME} validate`;
+    scripts["snapshot:validate"] = `${scriptPrefix} validate`;
     added.push("snapshot:validate");
   }
   const declared = declaredRange(parsed);
   let dependency;
-  if (declared !== null) {
+  if (isSelfRepository) {
+    if (declared !== null) {
+      notes.push(
+        `package.json declares ${GENERATOR_NAME} as a dependency of itself. It was left as it is, but a package cannot depend on itself: remove the entry and run the local build instead.`
+      );
+    }
+    dependency = { name: GENERATOR_NAME, range: declared, added: false };
+  } else if (declared !== null) {
     dependency = { name: GENERATOR_NAME, range: declared, added: false };
   } else {
     const range = `^${GENERATOR_VERSION}`;
@@ -6771,7 +7832,15 @@ async function runInit(options) {
     // `validate` warn about a mismatch the user never caused.
     branch: getGitInfo(options.cwd).branch,
     maxPartBytes: options.maxPartBytes ?? detected.recommendedBudget ?? DEFAULT_ANSWERS.maxPartBytes,
-    largeFileBytes: DEFAULT_ANSWERS.largeFileBytes,
+    // Every setting the caller named is written down, not just forwarded. A config that omits
+    // what the run used is drift the next `validate` reports, and `setup` is the one command
+    // that is supposed to leave a project in a consistent state.
+    maxPartTokens: options.maxPartTokens ?? DEFAULT_ANSWERS.maxPartTokens,
+    largeFileBytes: options.largeFileBytes ?? DEFAULT_ANSWERS.largeFileBytes,
+    maxMonolithBytes: options.maxMonolithBytes ?? DEFAULT_ANSWERS.maxMonolithBytes,
+    discovery: options.discovery ?? DEFAULT_ANSWERS.discovery,
+    skeleton: options.skeleton ?? DEFAULT_ANSWERS.skeleton,
+    sarif: options.sarif ?? DEFAULT_ANSWERS.sarif,
     include: options.include ?? [],
     excludePatterns: options.exclude ?? [],
     artifacts: artifactAnswers(options),
@@ -6978,7 +8047,7 @@ async function runInit(options) {
   const configText = renderConfig(answers);
   const preferredName = chooseConfigFileName(options.cwd);
   const presentConfigs = CONFIG_CANDIDATES.filter(
-    (name) => fs12.existsSync(path13.join(options.cwd, name))
+    (name) => fs14.existsSync(path16.join(options.cwd, name))
   );
   const present = presentConfigs[0] ?? null;
   if (presentConfigs.length > 1) {
@@ -6987,7 +8056,7 @@ async function runInit(options) {
     );
   }
   const configName = present !== null && options.force ? present : preferredName;
-  const configPath = path13.join(options.cwd, configName);
+  const configPath = path16.join(options.cwd, configName);
   const reused = present !== null && options.force !== true && options.reuseConfig === true;
   if (reused) notes.push(`Kept the existing ${present} instead of writing a new one.`);
   if (options.dryRun) {
@@ -7002,7 +8071,8 @@ async function runInit(options) {
       scripts: [],
       gitignoreEntries: [],
       dependency: { name: GENERATOR_NAME, range: `^${GENERATOR_VERSION}`, added: false },
-      notes
+      notes,
+      outDir: answers.outDir
     };
   }
   if (present !== null && present !== preferredName && !options.force && !reused) {
@@ -7020,7 +8090,7 @@ async function runInit(options) {
       'package.json already defines a "snapshot" config. Remove that key, or re-run with --force to write a config file that takes precedence over it.'
     );
   }
-  if (fs12.existsSync(configPath) && !options.force && !reused) {
+  if (fs14.existsSync(configPath) && !options.force && !reused) {
     throw new Error(`${configName} already exists. Re-run with --force to replace it.`);
   }
   if (!reused) writeFileOrExplain(configPath, configText);
@@ -7038,14 +8108,15 @@ async function runInit(options) {
     scripts,
     gitignoreEntries: ignore.added,
     dependency,
-    notes
+    notes,
+    outDir: answers.outDir
   };
 }
 function describeTarget(cwd) {
-  const relative7 = path13.relative(process.cwd(), cwd);
-  if (relative7 === "") return "this directory";
-  if (relative7.startsWith("..") || path13.isAbsolute(relative7)) return cwd;
-  return relative7;
+  const relative8 = path16.relative(process.cwd(), cwd);
+  if (relative8 === "") return "this directory";
+  if (relative8.startsWith("..") || path16.isAbsolute(relative8)) return cwd;
+  return relative8;
 }
 function firstRunMessage(reason, cwd) {
   const where = describeTarget(cwd);
@@ -7068,7 +8139,7 @@ function planFirstRun(facts) {
 var NOT_CONTENT = /* @__PURE__ */ new Set([".git", ".hg", ".svn", ".bzr", ".DS_Store", "Thumbs.db"]);
 function isEffectivelyEmpty(cwd) {
   try {
-    return fs12.readdirSync(cwd).every((entry) => NOT_CONTENT.has(entry));
+    return fs14.readdirSync(cwd).every((entry) => NOT_CONTENT.has(entry));
   } catch {
     return false;
   }
@@ -7076,19 +8147,203 @@ function isEffectivelyEmpty(cwd) {
 function hasPriorSnapshot(cwd, outDir) {
   let parsed;
   try {
-    parsed = JSON.parse(fs12.readFileSync(path13.join(cwd, outDir, ".codebase-snapshot"), "utf8"));
+    parsed = JSON.parse(fs14.readFileSync(path16.join(cwd, outDir, ".codebase-snapshot"), "utf8"));
   } catch {
     return false;
   }
   if (parsed === null || typeof parsed !== "object") return false;
   return isOurGeneratorName(parsed.generator);
 }
+var HOOK_MARKER = `# ${GENERATOR_NAME}: pre-commit snapshot check`;
+function shellQuote(value) {
+  return value.replace(/[\\"`$]/g, (character) => `\\${character}`);
+}
+function hookScript(outDir) {
+  const dir = shellQuote(outDir.replace(/\\/g, "/"));
+  return `#!/bin/sh
+${HOOK_MARKER}
+#
+# Refuse the commit when the snapshot is out of date with the tree.
+#
+# Remove this file to stop the check, or edit it \u2014 a hook this tool did not write is never
+# overwritten, and neither is one it did: run \`${GENERATOR_NAME} init --install-hook\` again
+# to restore the body below.
+set -e
+
+SNAPSHOT_DIR="${dir}"
+
+if [ ! -f "$SNAPSHOT_DIR/manifest.json" ]; then
+  echo "${GENERATOR_NAME}: no snapshot in $SNAPSHOT_DIR, skipping the staleness check." >&2
+  echo "  Run \\"npx ${GENERATOR_NAME} generate\\" to create one." >&2
+  exit 0
+fi
+
+if ! npx --no-install ${GENERATOR_NAME} validate >/dev/null 2>&1; then
+  echo "${GENERATOR_NAME}: the snapshot is out of date." >&2
+  echo "  Run \\"npx ${GENERATOR_NAME} generate\\", stage the change, and commit again." >&2
+  echo "  (npx --no-install is used on purpose: this hook must not install anything)" >&2
+  exit 1
+fi
+`;
+}
+function gitDirectory(cwd) {
+  const dotGit = path16.join(cwd, ".git");
+  let stats;
+  try {
+    stats = fs14.statSync(dotGit);
+  } catch {
+    return null;
+  }
+  if (stats.isDirectory()) return dotGit;
+  if (!stats.isFile()) return null;
+  try {
+    const contents = fs14.readFileSync(dotGit, "utf8");
+    const match = /^gitdir:\s*(.+)$/m.exec(contents);
+    if (!match) return null;
+    const target = match[1];
+    const resolved = path16.isAbsolute(target.trim()) ? target.trim() : path16.join(cwd, target.trim());
+    return fs14.statSync(resolved).isDirectory() ? resolved : null;
+  } catch {
+    return null;
+  }
+}
+function installPreCommitHook(cwd, outDir = "snapshot") {
+  const gitDir = gitDirectory(cwd);
+  if (gitDir === null) {
+    return {
+      path: null,
+      written: false,
+      notes: [
+        "Not a git working tree (no .git directory or gitdir link), so no pre-commit hook was installed."
+      ]
+    };
+  }
+  const hooksDir = path16.join(gitDir, "hooks");
+  const hookPath = path16.join(hooksDir, "pre-commit");
+  try {
+    fs14.mkdirSync(hooksDir, { recursive: true });
+  } catch (err) {
+    return {
+      path: hookPath,
+      written: false,
+      notes: [`Could not create ${hooksDir}: ${err.message}`]
+    };
+  }
+  let existing = null;
+  try {
+    existing = fs14.readFileSync(hookPath, "utf8");
+  } catch {
+    existing = null;
+  }
+  if (existing !== null && !existing.includes(HOOK_MARKER)) {
+    return {
+      path: hookPath,
+      written: false,
+      notes: [
+        `${hookPath} already exists and was not written by ${GENERATOR_NAME}; it was left untouched.`,
+        `Add \`npx ${GENERATOR_NAME} validate\` to it to get the same check.`
+      ]
+    };
+  }
+  try {
+    fs14.writeFileSync(hookPath, hookScript(outDir), "utf8");
+    fs14.chmodSync(hookPath, 493);
+  } catch (err) {
+    return {
+      path: hookPath,
+      written: false,
+      notes: [`Could not write ${hookPath}: ${err.message}`]
+    };
+  }
+  return {
+    path: hookPath,
+    written: true,
+    notes: [
+      existing === null ? `Installed ${hookPath}: commits are refused while the snapshot is out of date.` : `Updated ${hookPath} to the current ${GENERATOR_NAME} check.`
+    ]
+  };
+}
+function workerEntry(directory, isCjs) {
+  const entry = path16.join(directory, isCjs ? "index.cjs" : "index.js");
+  return { path: entry, url: pathToFileURL(entry).href };
+}
+var WORKER_SOURCE = `
+const { parentPort, workerData } = require("node:worker_threads");
+
+(async () => {
+  try {
+    const mod = await import(workerData.entryUrl);
+    const loaded = await mod.loadConfigFileDetailed(workerData.cwd);
+    if (loaded.errors.length > 0) {
+      parentPort.postMessage({ ok: false, message: loaded.errors.join("; ") });
+      return;
+    }
+    const config = mod.resolveConfig(loaded.config, workerData.cliOptions, workerData.cwd);
+    const manifest = mod.generateSnapshot(config);
+    parentPort.postMessage({
+      ok: true,
+      summary: {
+        fingerprint: manifest.fingerprint,
+        totalFiles: manifest.counts.totalFiles,
+        skippedCount: manifest.counts.skippedCount,
+        partsCount: manifest.counts.partsCount,
+        parts: manifest.parts.map((part) => ({ filename: part.filename, byteSize: part.byteSize })),
+        totalContentBytes: manifest.totals.totalContentBytes,
+        warnings: manifest.warnings,
+      },
+    });
+  } catch (error) {
+    parentPort.postMessage({
+      ok: false,
+      message: error && error.message ? error.message : String(error),
+    });
+  }
+})();
+`;
+function generateInWorker(cwd, cliOptions) {
+  return new Promise((resolve5) => {
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      resolve5(result);
+    };
+    let worker;
+    const isCjs = typeof __dirname !== "undefined";
+    const directory = isCjs ? __dirname : path16.dirname(fileURLToPath(import.meta.url));
+    try {
+      worker = new Worker(WORKER_SOURCE, {
+        eval: true,
+        workerData: {
+          entryUrl: workerEntry(directory, isCjs).url,
+          cwd,
+          cliOptions
+        }
+      });
+    } catch (error) {
+      finish({
+        ok: false,
+        message: `Could not start the generate worker: ${error instanceof Error ? error.message : String(error)}`
+      });
+      return;
+    }
+    worker.on("message", (message) => finish(message));
+    worker.on("error", (error) => {
+      finish({ ok: false, message: `The generate worker failed: ${error.message}` });
+    });
+    worker.on("exit", (code) => {
+      if (!settled) {
+        finish({ ok: false, message: `The generate worker exited (code ${code}) without a result.` });
+      }
+    });
+  });
+}
 
 // src/index.ts
 var SCHEMA_VERSION = "3.0.0";
 var SUMMARY_MAX_SOURCE_BYTES = 2 * 1024 * 1024;
 function sha256Hex2(input) {
-  return crypto.createHash("sha256").update(input).digest("hex");
+  return crypto2.createHash("sha256").update(input).digest("hex");
 }
 var TS_EXTENSIONS = [
   ".ts",
@@ -7127,71 +8382,15 @@ function hasStructuralSummary(relativePath) {
 function bump(counts, key) {
   counts[key] = (counts[key] ?? 0) + 1;
 }
-var RELATIVE_SPECIFIER = /^\.{1,2}\//;
-var IMPORT_CANDIDATE_SUFFIXES = [
-  ".ts",
-  ".tsx",
-  ".mts",
-  ".cts",
-  ".js",
-  ".jsx",
-  ".mjs",
-  ".cjs",
-  "/index.ts",
-  "/index.tsx",
-  "/index.js",
-  "/index.mjs"
-];
-var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
-  ".ts",
-  ".tsx",
-  ".mts",
-  ".cts",
-  ".js",
-  ".jsx",
-  ".mjs",
-  ".cjs"
-]);
-function buildImportResolver(files) {
-  const byPath = /* @__PURE__ */ new Map();
-  const byPathFolded = /* @__PURE__ */ new Map();
-  const byStem = /* @__PURE__ */ new Map();
-  const byStemFolded = /* @__PURE__ */ new Map();
-  const remember = (map, key, value) => {
-    if (!map.has(key)) map.set(key, value);
-  };
-  for (const file of files) {
-    const relativePath = file.relativePath;
-    remember(byPath, relativePath, relativePath);
-    remember(byPathFolded, relativePath.toLowerCase(), relativePath);
-    const extension = path13.posix.extname(relativePath);
-    if (!SOURCE_EXTENSIONS.has(extension)) continue;
-    const stem = relativePath.slice(0, -extension.length);
-    remember(byStem, stem, relativePath);
-    remember(byStemFolded, stem.toLowerCase(), relativePath);
-    if (path13.posix.basename(stem) === "index") {
-      const directory = path13.posix.dirname(stem);
-      remember(byStem, directory, relativePath);
-      remember(byStemFolded, directory.toLowerCase(), relativePath);
+function retain(items, keep) {
+  let write = 0;
+  for (const item of items) {
+    if (keep(item)) {
+      items[write] = item;
+      write += 1;
     }
   }
-  return { byPath, byPathFolded, byStem, byStemFolded };
-}
-function resolveSpecifier(fromFile, specifier, resolver) {
-  if (!RELATIVE_SPECIFIER.test(specifier)) return null;
-  const joined = path13.posix.normalize(
-    path13.posix.join(path13.posix.dirname(fromFile), specifier)
-  );
-  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
-  const direct = exact(joined);
-  if (direct) return direct;
-  for (const suffix of IMPORT_CANDIDATE_SUFFIXES) {
-    const hit = exact(`${joined}${suffix}`);
-    if (hit) return hit;
-  }
-  const stem = joined.replace(/\.(?:js|mjs|cjs|jsx)$/, "");
-  const byStem = (key) => resolver.byStem.get(key) ?? resolver.byStemFolded.get(key.toLowerCase()) ?? null;
-  return byStem(joined) ?? byStem(stem);
+  items.length = write;
 }
 function buildIndexes(files) {
   const resolver = buildImportResolver(files);
@@ -7243,7 +8442,7 @@ function buildIndexes(files) {
     }))
   };
 }
-function verifyInMemory(files, parts, maxPartBytes) {
+function verifyInMemory(files, parts) {
   const errors = [];
   const partNames = new Set(parts.map((part) => part.filename));
   for (const file of files) {
@@ -7259,8 +8458,11 @@ function verifyInMemory(files, parts, maxPartBytes) {
     if (actualBytes !== part.metadata.byteSize) {
       errors.push(`${part.filename} byteSize ${part.metadata.byteSize} != actual ${actualBytes}.`);
     }
-    if (actualBytes > maxPartBytes) {
-      errors.push(`${part.filename} (${actualBytes} B) exceeds the part budget of ${maxPartBytes} B.`);
+    const partBudget = part.metadata.budgetBytes;
+    if (actualBytes > partBudget) {
+      errors.push(
+        `${part.filename} (${actualBytes} B) exceeds its part budget of ${partBudget} B.`
+      );
     }
     if (part.metadata.includedFiles.length !== part.metadata.fileCount) {
       errors.push(`${part.filename} fileCount does not match its included files.`);
@@ -7273,11 +8475,11 @@ function verifyInMemory(files, parts, maxPartBytes) {
   return errors;
 }
 function resolveSafeOutputDirs(config) {
-  const cwd = path13.resolve(config.cwd);
-  const outDir = path13.resolve(cwd, config.outDir);
-  const tmpDir = path13.resolve(cwd, config.tmpDir);
-  const root = path13.parse(cwd).root;
-  const contains = (parent, child) => child === parent || child.startsWith(`${parent}${path13.sep}`);
+  const cwd = path16.resolve(config.cwd);
+  const outDir = path16.resolve(cwd, config.outDir);
+  const tmpDir = path16.resolve(cwd, config.tmpDir);
+  const root = path16.parse(cwd).root;
+  const contains = (parent, child) => child === parent || child.startsWith(`${parent}${path16.sep}`);
   const reject = (reason) => {
     throw new Error(
       `Refusing to generate: ${reason}. outDir=${outDir} tmpDir=${tmpDir} cwd=${cwd}`
@@ -7333,14 +8535,14 @@ function listEntries(dir) {
   const walk = (absolute, prefix) => {
     let children;
     try {
-      children = fs12.readdirSync(absolute, { withFileTypes: true });
+      children = fs14.readdirSync(absolute, { withFileTypes: true });
     } catch {
       return;
     }
     for (const child of children) {
-      const relative7 = prefix === "" ? child.name : `${prefix}/${child.name}`;
-      entries.push(relative7);
-      if (child.isDirectory()) walk(path13.join(absolute, child.name), relative7);
+      const relative8 = prefix === "" ? child.name : `${prefix}/${child.name}`;
+      entries.push(relative8);
+      if (child.isDirectory()) walk(path16.join(absolute, child.name), relative8);
     }
   };
   walk(dir, "");
@@ -7357,28 +8559,33 @@ function markerPayload(dir, state, id, createdAt) {
     pid: process.pid,
     entries: listEntries(dir)
   };
-  const manifestPath = path13.join(dir, "manifest.json");
-  if (fs12.existsSync(manifestPath)) {
-    marker2.manifestSha256 = sha256Hex2(fs12.readFileSync(manifestPath));
+  const manifestPath = path16.join(dir, "manifest.json");
+  if (fs14.existsSync(manifestPath)) {
+    marker2.manifestSha256 = sha256Hex2(fs14.readFileSync(manifestPath));
   }
   return marker2;
 }
 function writeOwnershipMarker(dir, marker2) {
-  fs12.writeFileSync(
-    path13.join(dir, OWNERSHIP_MARKER),
+  fs14.writeFileSync(
+    path16.join(dir, OWNERSHIP_MARKER),
     `${JSON.stringify(marker2, null, 2)}
 `,
     "utf8"
   );
 }
+function markerBelongsTo(dir, id) {
+  const evidence = readOwnershipMarker(dir);
+  if (evidence.marker === null) return true;
+  return evidence.marker.id === id;
+}
 function readOwnershipMarker(dir) {
-  const markerPath = path13.join(dir, OWNERSHIP_MARKER);
-  if (!fs12.existsSync(markerPath)) {
+  const markerPath = path16.join(dir, OWNERSHIP_MARKER);
+  if (!fs14.existsSync(markerPath)) {
     return { marker: null, problem: "it holds no .codebase-snapshot marker" };
   }
   let raw;
   try {
-    raw = fs12.readFileSync(markerPath, "utf8");
+    raw = fs14.readFileSync(markerPath, "utf8");
   } catch {
     return { marker: null, problem: "its .codebase-snapshot marker could not be read" };
   }
@@ -7446,11 +8653,11 @@ function assessSnapshotDirectory(dir) {
       marker: marker2
     };
   }
-  const manifestPath = path13.join(dir, "manifest.json");
-  if (fs12.existsSync(manifestPath)) {
+  const manifestPath = path16.join(dir, "manifest.json");
+  if (fs14.existsSync(manifestPath)) {
     let raw;
     try {
-      raw = fs12.readFileSync(manifestPath, "utf8");
+      raw = fs14.readFileSync(manifestPath, "utf8");
     } catch {
       return {
         owned: false,
@@ -7532,13 +8739,13 @@ function containsNoFiles(dir) {
     const current = pending.pop();
     let entries;
     try {
-      entries = fs12.readdirSync(current, { withFileTypes: true });
+      entries = fs14.readdirSync(current, { withFileTypes: true });
     } catch {
       return false;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        pending.push(path13.join(current, entry.name));
+        pending.push(path16.join(current, entry.name));
       } else if (!IGNORABLE_ENTRIES.has(entry.name)) {
         return false;
       }
@@ -7547,13 +8754,13 @@ function containsNoFiles(dir) {
   return true;
 }
 function assertReplaceable(target, label, secretRules) {
-  if (!fs12.existsSync(target)) return;
-  if (!fs12.statSync(target).isDirectory()) {
+  if (!fs14.existsSync(target)) return;
+  if (!fs14.statSync(target).isDirectory()) {
     throw new Error(
       `Refusing to write into ${label} ${target}: it exists but is not a directory.`
     );
   }
-  const entries = fs12.readdirSync(target);
+  const entries = fs14.readdirSync(target);
   if (entries.length === 0) return;
   if (entries.every((name) => IGNORABLE_ENTRIES.has(name))) return;
   if (containsNoFiles(target)) return;
@@ -7573,18 +8780,18 @@ function assertReplaceable(target, label, secretRules) {
   );
 }
 function assertStagingRootUsable(tmpDir, secretRules) {
-  if (!fs12.existsSync(tmpDir)) return;
-  if (!fs12.statSync(tmpDir).isDirectory()) {
+  if (!fs14.existsSync(tmpDir)) return;
+  if (!fs14.statSync(tmpDir).isDirectory()) {
     throw new Error(`Refusing to write into tmpDir ${tmpDir}: it exists but is not a directory.`);
   }
-  const entries = fs12.readdirSync(tmpDir);
+  const entries = fs14.readdirSync(tmpDir);
   if (entries.length === 0) return;
   const foreign = entries.filter((name) => {
-    const full = path13.join(tmpDir, name);
+    const full = path16.join(tmpDir, name);
     if (!name.startsWith(RUN_DIR_PREFIX)) return true;
     let stats;
     try {
-      stats = fs12.statSync(full);
+      stats = fs14.statSync(full);
     } catch {
       return true;
     }
@@ -7592,7 +8799,7 @@ function assertStagingRootUsable(tmpDir, secretRules) {
     const { marker: marker2 } = readOwnershipMarker(full);
     if (marker2) return false;
     try {
-      return fs12.readdirSync(full).length > 0;
+      return fs14.readdirSync(full).length > 0;
     } catch {
       return true;
     }
@@ -7607,13 +8814,13 @@ function assertStagingRootUsable(tmpDir, secretRules) {
 function cleanStaleRunDirs(tmpDir) {
   let entries;
   try {
-    entries = fs12.readdirSync(tmpDir);
+    entries = fs14.readdirSync(tmpDir);
   } catch {
     return;
   }
   for (const name of entries) {
     if (!name.startsWith(RUN_DIR_PREFIX)) continue;
-    const full = path13.join(tmpDir, name);
+    const full = path16.join(tmpDir, name);
     const { marker: marker2 } = readOwnershipMarker(full);
     if (marker2) {
       const created = Date.parse(marker2.createdAt);
@@ -7621,33 +8828,33 @@ function cleanStaleRunDirs(tmpDir) {
       const abandoned = typeof marker2.pid === "number" && !isProcessAlive(marker2.pid);
       if (aged || abandoned) {
         try {
-          fs12.rmSync(full, { recursive: true, force: true });
+          fs14.rmSync(full, { recursive: true, force: true });
         } catch {
         }
       }
       continue;
     }
     try {
-      if (fs12.readdirSync(full).length === 0) fs12.rmSync(full, { recursive: true, force: true });
+      if (fs14.readdirSync(full).length === 0) fs14.rmSync(full, { recursive: true, force: true });
     } catch {
     }
   }
 }
 function removeIfEmpty(dir) {
   try {
-    if (fs12.readdirSync(dir).length === 0) fs12.rmSync(dir, { recursive: true, force: true });
+    if (fs14.readdirSync(dir).length === 0) fs14.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
 }
 function ensureParentDirectory(target, label) {
-  const parent = path13.dirname(target);
-  if (fs12.existsSync(parent) && !fs12.statSync(parent).isDirectory()) {
+  const parent = path16.dirname(target);
+  if (fs14.existsSync(parent) && !fs14.statSync(parent).isDirectory()) {
     throw new Error(
       `Refusing to create ${label} ${target}: ${parent} exists but is not a directory.`
     );
   }
   try {
-    fs12.mkdirSync(parent, { recursive: true });
+    fs14.mkdirSync(parent, { recursive: true });
   } catch (err) {
     throw new Error(
       `Refusing to create ${label} ${target}: its parent ${parent} could not be created (${err.message}).`
@@ -7655,8 +8862,7 @@ function ensureParentDirectory(target, label) {
   }
 }
 function acquireRunLock(stagingRoot) {
-  const key = lockKeyFor(stagingRoot);
-  const lockPath = path13.join(os.tmpdir(), `codebase-snapshot-${key}.lock`);
+  const lockPath = lockPathFor(stagingRoot);
   const payload = `${JSON.stringify({
     pid: process.pid,
     stagingRoot,
@@ -7665,22 +8871,22 @@ function acquireRunLock(stagingRoot) {
 `;
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const handle = fs12.openSync(lockPath, "wx");
+      const handle = fs14.openSync(lockPath, "wx");
       try {
-        fs12.writeSync(handle, payload);
+        fs14.writeSync(handle, payload);
       } finally {
-        fs12.closeSync(handle);
+        fs14.closeSync(handle);
       }
       return () => {
         try {
-          fs12.rmSync(lockPath, { force: true });
+          fs14.rmSync(lockPath, { force: true });
         } catch {
         }
       };
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       if (attempt === 0 && lockOwnerIsGone(lockPath)) {
-        fs12.rmSync(lockPath, { force: true });
+        fs14.rmSync(lockPath, { force: true });
         continue;
       }
       throw new Error(
@@ -7693,16 +8899,19 @@ function acquireRunLock(stagingRoot) {
 function lockKeyFor(stagingRoot) {
   let key = stagingRoot;
   try {
-    key = fs12.realpathSync(stagingRoot);
+    key = fs14.realpathSync(stagingRoot);
   } catch {
   }
   if (process.platform === "win32" || process.platform === "darwin") key = key.toLowerCase();
   return sha256Hex2(key).slice(0, 16);
 }
+function lockPathFor(stagingRoot) {
+  return path16.join(os.tmpdir(), `codebase-snapshot-${lockKeyFor(stagingRoot)}.lock`);
+}
 function lockOwnerIsGone(lockPath) {
   let raw;
   try {
-    raw = fs12.readFileSync(lockPath, "utf8");
+    raw = fs14.readFileSync(lockPath, "utf8");
   } catch {
     return false;
   }
@@ -7710,9 +8919,9 @@ function lockOwnerIsGone(lockPath) {
   try {
     pid = JSON.parse(raw).pid;
   } catch {
-    return false;
+    return lockFileIsAncient(lockPath);
   }
-  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return false;
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return lockFileIsAncient(lockPath);
   try {
     process.kill(pid, 0);
     return false;
@@ -7720,14 +8929,21 @@ function lockOwnerIsGone(lockPath) {
     return err.code === "ESRCH";
   }
 }
+function lockFileIsAncient(lockPath) {
+  try {
+    return Date.now() - fs14.statSync(lockPath).mtimeMs > STALE_RUN_MS;
+  } catch {
+    return false;
+  }
+}
 function writeManifestAtomically(manifestPath, manifest) {
   const tempPath = `${manifestPath}.${process.pid}.tmp`;
-  fs12.writeFileSync(tempPath, JSON.stringify(manifest, null, 2), "utf8");
+  fs14.writeFileSync(tempPath, JSON.stringify(manifest, null, 2), "utf8");
   try {
-    fs12.renameSync(tempPath, manifestPath);
+    fs14.renameSync(tempPath, manifestPath);
   } catch (err) {
     try {
-      fs12.rmSync(tempPath, { force: true });
+      fs14.rmSync(tempPath, { force: true });
     } catch {
     }
     throw err;
@@ -7750,31 +8966,31 @@ function swapIntoPlace(stagingDir, outDir) {
 }
 function swapOnce(stagingDir, outDir) {
   const backupDir = `${outDir}.backup-${process.pid}-${Date.now()}`;
-  const hadPrevious = fs12.existsSync(outDir);
-  if (hadPrevious) fs12.renameSync(outDir, backupDir);
+  const hadPrevious = fs14.existsSync(outDir);
+  if (hadPrevious) fs14.renameSync(outDir, backupDir);
   try {
     try {
-      fs12.renameSync(stagingDir, outDir);
+      fs14.renameSync(stagingDir, outDir);
     } catch (err) {
       if (err.code !== "EXDEV") throw err;
       const partialDir = `${outDir}.partial-${process.pid}-${Date.now()}`;
       try {
-        fs12.cpSync(stagingDir, partialDir, { recursive: true });
-        fs12.renameSync(partialDir, outDir);
-        fs12.rmSync(stagingDir, { recursive: true, force: true });
+        fs14.cpSync(stagingDir, partialDir, { recursive: true });
+        fs14.renameSync(partialDir, outDir);
+        fs14.rmSync(stagingDir, { recursive: true, force: true });
       } catch (copyErr) {
         try {
-          fs12.rmSync(partialDir, { recursive: true, force: true });
+          fs14.rmSync(partialDir, { recursive: true, force: true });
         } catch {
         }
         throw copyErr;
       }
     }
-    if (hadPrevious) fs12.rmSync(backupDir, { recursive: true, force: true });
+    if (hadPrevious) fs14.rmSync(backupDir, { recursive: true, force: true });
   } catch (err) {
-    if (hadPrevious && fs12.existsSync(backupDir)) {
-      if (fs12.existsSync(outDir)) fs12.rmSync(outDir, { recursive: true, force: true });
-      fs12.renameSync(backupDir, outDir);
+    if (hadPrevious && fs14.existsSync(backupDir)) {
+      if (fs14.existsSync(outDir)) fs14.rmSync(outDir, { recursive: true, force: true });
+      fs14.renameSync(backupDir, outDir);
     }
     throw err;
   }
@@ -7783,7 +8999,7 @@ function sleepSync(milliseconds) {
   const buffer = new Int32Array(new SharedArrayBuffer(4));
   Atomics.wait(buffer, 0, 0, milliseconds);
 }
-function artifactWarnings(artifacts) {
+function artifactWarnings(artifacts, sarif) {
   const messages = [];
   if (!artifacts.manifest) {
     messages.push("manifest.json is disabled: `validate` and `report` cannot inspect this snapshot.");
@@ -7793,7 +9009,7 @@ function artifactWarnings(artifacts) {
       "parts are disabled but navigation.md is enabled: its links point at part files that were not written."
     );
   }
-  if (ARTIFACT_NAMES.every((name) => artifacts[name] === false)) {
+  if (!sarif && ARTIFACT_NAMES.every((name) => artifacts[name] === false)) {
     messages.push(
       "every artifact is disabled: only the .codebase-snapshot ownership marker will be written."
     );
@@ -7865,13 +9081,25 @@ function generateSnapshot(configInput, options) {
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
     includeSensitiveFiles: config.includeSensitiveFiles,
     secretRules: config.secretRules,
+    discovery: config.discovery,
     // The output and staging directories this run is about to write, relative to the root. A
     // first run cannot have marked them yet, so the name alone keeps a run from recording its own
     // output — but only at these exact paths, not at every directory that shares the name.
     toolOwnedPaths: [config.outDir, config.tmpDir].map(
-      (directory) => path13.relative(config.cwd, path13.resolve(config.cwd, directory)).replace(/\\/g, "/")
-    ).filter((relative7) => relative7.length > 0 && !relative7.startsWith(".."))
+      (directory) => path16.relative(config.cwd, path16.resolve(config.cwd, directory)).replace(/\\/g, "/")
+    ).filter((relative8) => relative8.length > 0 && !relative8.startsWith(".."))
   });
+  const changedScope = config.changedSince !== void 0 || config.staged === true ? resolveChangedScope(config.cwd, {
+    ...config.changedSince === void 0 ? {} : { changedSince: config.changedSince },
+    ...config.staged === true ? { staged: true } : {}
+  }) : null;
+  const changedPaths = changedScope === null ? null : new Set(changedScope.paths);
+  const unchangedPaths = [];
+  const candidateFiles = changedPaths !== null && config.withDependents !== true ? collection.files.filter((relativePath) => {
+    if (changedPaths.has(relativePath)) return true;
+    unchangedPaths.push(relativePath);
+    return false;
+  }) : collection.files;
   const files = [];
   const monolithBodies = /* @__PURE__ */ new Map();
   const skipped = maskSkipRecords([...collection.skipped], config.secretRules);
@@ -7882,6 +9110,7 @@ function generateSnapshot(configInput, options) {
     return files.some((file) => file.isPreviewTruncated && !file.isLarge);
   };
   const encodingNotes = [];
+  const fileWarnings = [];
   const oversizeSummaryPaths = [];
   const previewSummaryPaths = [];
   const layerCounts = {};
@@ -7889,13 +9118,13 @@ function generateSnapshot(configInput, options) {
   let totalLines = 0;
   let totalSizeBytes = 0;
   let largeFileCount = 0;
-  for (const relativePath of collection.files) {
-    const absolutePath = path13.join(config.cwd, relativePath);
+  for (const relativePath of candidateFiles) {
+    const absolutePath = path16.join(config.cwd, relativePath);
     let stats;
     try {
-      stats = fs12.statSync(absolutePath);
+      stats = fs14.statSync(absolutePath);
       if (!stats.isFile()) {
-        const nestedRepository = stats.isDirectory() && fs12.existsSync(path13.join(absolutePath, ".git"));
+        const nestedRepository = stats.isDirectory() && fs14.existsSync(path16.join(absolutePath, ".git"));
         skipped.push(
           nestedRepository ? {
             path: relativePath,
@@ -7909,13 +9138,17 @@ function generateSnapshot(configInput, options) {
       skipped.push({ path: relativePath, reason: "read-error" });
       continue;
     }
-    if (isBinaryFile(absolutePath)) {
+    if (isBinaryExtension(absolutePath)) {
+      skipped.push({ path: relativePath, reason: "binary", detail: `Size: ${stats.size} B` });
+      continue;
+    }
+    if (stats.size > BINARY_SCAN_BYTES && isBinaryFile(absolutePath)) {
       skipped.push({ path: relativePath, reason: "binary", detail: `Size: ${stats.size} B` });
       continue;
     }
     let buffer;
     try {
-      buffer = fs12.readFileSync(absolutePath);
+      buffer = fs14.readFileSync(absolutePath);
     } catch {
       skipped.push({ path: relativePath, reason: "read-error" });
       continue;
@@ -7970,7 +9203,16 @@ function generateSnapshot(configInput, options) {
     let finalContent = redacted;
     let isPreviewTruncated = false;
     let includedLines = lineCount;
-    if (isLarge) {
+    let inclusionMode = "full";
+    if (config.skeleton === true && isSkeletonizable(relativePath)) {
+      const skeleton = skeletonizeTypeScript(redacted, relativePath);
+      if (skeleton.collapsed > 0) {
+        finalContent = skeleton.text;
+        inclusionMode = "signatures";
+        includedLines = countLines(skeleton.text);
+      }
+    }
+    if (isLarge && inclusionMode !== "signatures") {
       const preview = truncatePreview(
         redacted,
         config.previewHeadLines,
@@ -7979,8 +9221,9 @@ function generateSnapshot(configInput, options) {
       finalContent = preview.content;
       isPreviewTruncated = preview.isTruncated;
       includedLines = preview.includedLines;
+      inclusionMode = isPreviewTruncated ? "preview" : "full";
     }
-    if (config.includeMonolith && isPreviewTruncated) {
+    if (config.includeMonolith && (isPreviewTruncated || inclusionMode === "signatures")) {
       monolithBodies.set(relativePath, redacted);
     }
     let summary;
@@ -7995,14 +9238,19 @@ function generateSnapshot(configInput, options) {
         summary = outcome?.summary ? maskSummaryStrings(outcome.summary, config.secretRules) : void 0;
         summaryQuality = outcome?.quality;
         if (isSourceSummary(summary) && summary.parseErrors) {
-          warnings.push(
-            `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`
-          );
+          fileWarnings.push({
+            path: relativePath,
+            message: `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`
+          });
         }
       } catch (err) {
-        warnings.push(
-          `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(/\s+/g, " ")
-        );
+        fileWarnings.push({
+          path: relativePath,
+          message: `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(
+            /\s+/g,
+            " "
+          )
+        });
       }
     }
     files.push({
@@ -8014,7 +9262,7 @@ function generateSnapshot(configInput, options) {
       layer: layer2,
       kind,
       language,
-      inclusionMode: isPreviewTruncated ? "preview" : "full",
+      inclusionMode,
       isLarge,
       isPreviewTruncated,
       originalLines: lineCount,
@@ -8026,6 +9274,58 @@ function generateSnapshot(configInput, options) {
       content: finalContent
     });
   }
+  if (changedScope !== null && changedPaths !== null && config.withDependents === true) {
+    const keep = new Set(changedPaths);
+    const resolver = buildImportResolver(files);
+    for (const file of files) {
+      if (!isSourceSummary(file.summary)) continue;
+      if (importsChangedFile(file.relativePath, file.summary.imports, changedPaths, resolver)) {
+        keep.add(file.relativePath);
+      }
+    }
+    for (const file of files) {
+      if (!keep.has(file.relativePath)) unchangedPaths.push(file.relativePath);
+    }
+    const kept = files.filter((file) => keep.has(file.relativePath));
+    files.length = 0;
+    files.push(...kept);
+    totalLines = files.reduce((total, file) => total + file.lines, 0);
+    totalSizeBytes = files.reduce((total, file) => total + file.sizeBytes, 0);
+    largeFileCount = 0;
+    for (const key of Object.keys(layerCounts)) delete layerCounts[key];
+    for (const key of Object.keys(kindCounts)) delete kindCounts[key];
+    for (const file of files) {
+      bump(layerCounts, file.layer);
+      bump(kindCounts, file.kind);
+      if (file.isLarge) largeFileCount += 1;
+    }
+    retain(
+      secretFindings,
+      (finding) => finding.path === void 0 || keep.has(finding.path)
+    );
+    retain(encodingNotes, (note) => keep.has(note.path));
+    retain(oversizeSummaryPaths, (path17) => keep.has(path17));
+    retain(previewSummaryPaths, (path17) => keep.has(path17));
+    retain(fileWarnings, (warning) => keep.has(warning.path));
+    for (const path17 of [...monolithBodies.keys()]) {
+      if (!keep.has(path17)) monolithBodies.delete(path17);
+    }
+  }
+  if (changedScope !== null) {
+    for (const relativePath of unchangedPaths) {
+      skipped.push({
+        path: relativePath,
+        reason: "unchanged",
+        detail: `not ${changedScope.detail}`
+      });
+    }
+  }
+  for (const warning of fileWarnings) warnings.push(warning.message);
+  if (changedScope !== null && files.length === 0) {
+    warnings.push(
+      `No file is ${changedScope.detail}, so the snapshot is empty. Check the ref, or run without --changed-since to scan the whole repository.`
+    );
+  }
   const encodingBuckets = /* @__PURE__ */ new Map();
   for (const note of encodingNotes) {
     const bucket = encodingBuckets.get(note.encoding) ?? { paths: [], invalidBytes: 0 };
@@ -8076,13 +9376,8 @@ function generateSnapshot(configInput, options) {
     );
   }
   const parts = partitionByBudget(files, config, fingerprint);
-  const maxEffectiveBudget = Math.max(
-    config.maxPartBytes,
-    config.budgets.default,
-    ...Object.values(config.budgets.byLayer)
-  );
   const truncatedPreviewCount = files.filter((file) => file.isPreviewTruncated).length;
-  const validationErrors = verifyInMemory(files, parts, maxEffectiveBudget);
+  const validationErrors = verifyInMemory(files, parts);
   const totalContentBytes = files.reduce((total, file) => total + file.includedBytes, 0);
   const maskName = (value) => maskPathText(value, config.secretRules);
   const manifest = {
@@ -8102,12 +9397,26 @@ function generateSnapshot(configInput, options) {
     config: {
       digest: configDigest(config),
       maxPartBytes: config.maxPartBytes,
+      // The ceiling the user named, in their own unit. `maxPartBytes` above is what the
+      // partitioner enforced; both are recorded so the manifest can explain the gap.
+      ...config.maxPartTokens === void 0 ? {} : { maxPartTokens: config.maxPartTokens },
       largeFileBytes: config.largeFileBytes,
       previewHeadLines: config.previewHeadLines,
       previewTailLines: config.previewTailLines,
       includeMonolith: config.includeMonolith,
+      // A ceiling that decides whether `full-codebase.*` is written at all, so it belongs
+      // in the record of what the run enforced. Omitting it left `--max-monolith-bytes`
+      // invisible in the manifest that is supposed to describe the run.
+      maxMonolithBytes: config.maxMonolithBytes ?? null,
       includeSensitiveFiles: config.includeSensitiveFiles,
       discovery: config.discovery ?? "auto",
+      // A changed-files scope decides which files are in the snapshot, so the manifest that
+      // describes the run has to name it.
+      ...config.changedSince === void 0 ? {} : { changedSince: config.changedSince },
+      ...config.staged === true ? { staged: true } : {},
+      ...config.withDependents === true ? { withDependents: true } : {},
+      ...config.skeleton === true ? { skeleton: true } : {},
+      ...config.sarif === true ? { sarif: true } : {},
       artifacts: { ...config.artifacts },
       include: [...config.include].map(maskName),
       preset: config.preset,
@@ -8139,6 +9448,9 @@ function generateSnapshot(configInput, options) {
       skippedFiles: skipped.length,
       totalSourceBytes: totalSizeBytes,
       totalContentBytes,
+      // The parts are what a model is handed, so the estimate is over the parts rather than
+      // over the sources: previews and the byte budget both shrink the number.
+      estimatedTokens: parts.reduce((total, part) => total + part.metadata.estimatedTokens, 0),
       partCount: parts.length,
       warningCount: 0,
       redactedLines: 0
@@ -8177,7 +9489,9 @@ function generateSnapshot(configInput, options) {
     );
     manifest.totals.warningCount = manifest.warnings.length;
   }
-  for (const message of artifactWarnings(config.artifacts)) manifest.warnings.push(message);
+  for (const message of artifactWarnings(config.artifacts, config.sarif === true)) {
+    manifest.warnings.push(message);
+  }
   manifest.totals.warningCount = manifest.warnings.length;
   let projectTree = null;
   if (config.artifacts.projectTree) {
@@ -8190,6 +9504,13 @@ function generateSnapshot(configInput, options) {
       manifest.totals.warningCount = manifest.warnings.length;
     }
   }
+  const sarifText = config.sarif === true ? generateSarifReport(manifest, secretFindings, config.secretRules, GENERATOR_VERSION) : null;
+  if (sarifText !== null) {
+    manifest.artifacts.sarif = {
+      byteSize: Buffer.byteLength(sarifText, "utf8"),
+      sha256: sha256Hex2(sarifText)
+    };
+  }
   let monolithJson = null;
   let monolithMarkdown = null;
   if (config.includeMonolith) {
@@ -8240,17 +9561,17 @@ function generateSnapshot(configInput, options) {
   const lockKeys = Array.from(/* @__PURE__ */ new Set([tmpDir, outDir])).sort();
   const releases = lockKeys.map((key) => acquireRunLock(key));
   const releaseLock = () => {
-    for (const release of releases.reverse()) release();
+    for (const release of [...releases].reverse()) release();
   };
   let stagingDir = null;
   try {
     ensureParentDirectory(outDir, "outDir");
-    fs12.mkdirSync(tmpDir, { recursive: true });
+    fs14.mkdirSync(tmpDir, { recursive: true });
     cleanStaleRunDirs(tmpDir);
-    const snapshotId = crypto.randomUUID();
+    const snapshotId = crypto2.randomUUID();
     const createdAt = (/* @__PURE__ */ new Date()).toISOString();
-    stagingDir = path13.join(tmpDir, `${RUN_DIR_PREFIX}${process.pid}-${snapshotId.slice(0, 8)}`);
-    fs12.mkdirSync(stagingDir);
+    stagingDir = path16.join(tmpDir, `${RUN_DIR_PREFIX}${process.pid}-${snapshotId.slice(0, 8)}`);
+    fs14.mkdirSync(stagingDir);
     writeOwnershipMarker(stagingDir, {
       generator: GENERATOR_NAME,
       version: GENERATOR_VERSION,
@@ -8260,41 +9581,44 @@ function generateSnapshot(configInput, options) {
       id: snapshotId,
       pid: process.pid
     });
-    const partsDir = path13.join(stagingDir, "parts");
-    const reportsDir = path13.join(stagingDir, "reports");
-    if (artifacts.parts) fs12.mkdirSync(partsDir, { recursive: true });
-    if (artifacts.navigation || artifacts.projectTree || artifacts.audit) {
-      fs12.mkdirSync(reportsDir, { recursive: true });
+    const partsDir = path16.join(stagingDir, "parts");
+    const reportsDir = path16.join(stagingDir, "reports");
+    if (artifacts.parts) fs14.mkdirSync(partsDir, { recursive: true });
+    if (artifacts.navigation || artifacts.projectTree || artifacts.audit || config.sarif === true) {
+      fs14.mkdirSync(reportsDir, { recursive: true });
     }
     if (artifacts.parts) {
       for (const part of parts) {
-        fs12.writeFileSync(path13.join(partsDir, part.filename), part.markdown, "utf8");
+        fs14.writeFileSync(path16.join(partsDir, part.filename), part.markdown, "utf8");
       }
     }
     if (projectTree !== null) {
-      fs12.writeFileSync(path13.join(reportsDir, "project-tree.md"), projectTree, "utf8");
+      fs14.writeFileSync(path16.join(reportsDir, "project-tree.md"), projectTree, "utf8");
     }
     if (artifacts.navigation) {
-      fs12.writeFileSync(path13.join(reportsDir, "navigation.md"), generateNavigation(manifest), "utf8");
+      fs14.writeFileSync(path16.join(reportsDir, "navigation.md"), generateNavigation(manifest), "utf8");
     }
     if (artifacts.audit) {
-      fs12.writeFileSync(
-        path13.join(reportsDir, "audit.md"),
+      fs14.writeFileSync(
+        path16.join(reportsDir, "audit.md"),
         generateAuditReport(manifest, secretFindings, config.secretRules),
         "utf8"
       );
     }
+    if (sarifText !== null) {
+      fs14.writeFileSync(path16.join(reportsDir, "audit.sarif"), sarifText, "utf8");
+    }
     if (artifacts.readme) {
-      fs12.writeFileSync(path13.join(stagingDir, "README.md"), generateReadme(manifest, artifacts), "utf8");
+      fs14.writeFileSync(path16.join(stagingDir, "README.md"), generateReadme(manifest, artifacts), "utf8");
     }
     if (artifacts.manifest) {
-      fs12.writeFileSync(path13.join(stagingDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
+      fs14.writeFileSync(path16.join(stagingDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
     }
     if (monolithJson !== null) {
-      fs12.writeFileSync(path13.join(stagingDir, "full-codebase.json"), monolithJson, "utf8");
+      fs14.writeFileSync(path16.join(stagingDir, "full-codebase.json"), monolithJson, "utf8");
     }
     if (monolithMarkdown !== null) {
-      fs12.writeFileSync(path13.join(stagingDir, "full-codebase.md"), monolithMarkdown, "utf8");
+      fs14.writeFileSync(path16.join(stagingDir, "full-codebase.md"), monolithMarkdown, "utf8");
     }
     writeOwnershipMarker(stagingDir, markerPayload(stagingDir, "complete", snapshotId, createdAt));
     swapIntoPlace(stagingDir, outDir);
@@ -8302,31 +9626,41 @@ function generateSnapshot(configInput, options) {
     const warningsBeforeHook = manifest.warnings.length;
     const pendingHook = runAfterGenerate(config, manifest);
     const shipHookState = () => {
+      if (!markerBelongsTo(outDir, snapshotId)) return;
       if (artifacts.manifest && manifest.warnings.length !== warningsBeforeHook) {
-        writeManifestAtomically(path13.join(outDir, "manifest.json"), manifest);
+        writeManifestAtomically(path16.join(outDir, "manifest.json"), manifest);
       }
       writeOwnershipMarker(outDir, markerPayload(outDir, "complete", snapshotId, createdAt));
     };
     shipHookState();
     if (pendingHook) {
-      pendingHook.catch((err) => {
-        const message = maskPathText(
-          err instanceof Error ? err.message : String(err),
-          config.secretRules
-        );
-        manifest.warnings.push(`hooks.afterGenerate failed: ${message}`);
-        manifest.totals.warningCount = manifest.warnings.length;
-        try {
-          shipHookState();
-        } catch {
+      pendingHook.then(
+        () => {
+          try {
+            shipHookState();
+          } catch {
+          }
+        },
+        (err) => {
+          const message = maskPathText(
+            err instanceof Error ? err.message : String(err),
+            config.secretRules
+          );
+          manifest.warnings.push(`hooks.afterGenerate failed: ${message}`);
+          manifest.totals.warningCount = manifest.warnings.length;
+          try {
+            shipHookState();
+          } catch {
+          }
         }
-      });
+      );
+      pendingHooks.set(outDir, pendingHook);
     }
     return manifest;
   } catch (err) {
     if (stagingDir !== null) {
       try {
-        fs12.rmSync(stagingDir, { recursive: true, force: true });
+        fs14.rmSync(stagingDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -8336,10 +9670,17 @@ function generateSnapshot(configInput, options) {
     releaseLock();
   }
 }
+var pendingHooks = /* @__PURE__ */ new Map();
 async function generateSnapshotAsync(configInput, options) {
-  return generateSnapshot(configInput, options);
+  const manifest = generateSnapshot(configInput, options);
+  const config = isResolvedConfig(configInput) ? normalizeResolvedConfig(configInput) : resolveConfig(configInput ?? null);
+  const { outDir } = resolveSafeOutputDirs(config);
+  const pending = pendingHooks.get(outDir);
+  if (pending !== void 0) {
+    pendingHooks.delete(outDir);
+    await pending.catch(() => void 0);
+  }
+  return manifest;
 }
 
-export { ARTIFACT_NAMES, CHECK_INTERVAL_MS, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, FAILURE_INTERVAL_MS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PACKAGE_LATEST_URL, PRESETS, PromptBack, PromptCancelled, REQUEST_TIMEOUT_MS, SCHEMA_VERSION, anchorForPath, appendGitignoreEntries, assertReplaceable, assertUsableConfigInput, cacheDirectory, cacheFilePath, checkForUpdate, collectFiles, compareManifests, countInvalidUtf8Bytes, countLines, decodeText, defaultIO, defineConfig, describeManifestShapeProblem, detectLanguage, detectPreset, displayWidth, escapeControls, explainPath, fenceForContent, fenceForText, fetchLatestVersion, findConfigFile, firstRunMessage, formatNumber, formatUpdateNotice, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, gitignorePath, globToRegExp, hasPriorSnapshot, installKind, isBinaryBuffer, isBinaryExtension, isBinaryFile, isDiscoveryMode, isEffectivelyEmpty, isInteractive, isNewer, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, planFirstRun, profileForPath, renderConfig, renderDiffText, renderExplainText, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, shouldCheck, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, unknownPresetMessage, updateCommand, validateSnapshot, wrapLines };
-//# sourceMappingURL=chunk-KUVFTJHK.js.map
-//# sourceMappingURL=chunk-KUVFTJHK.js.map
+export { ARTIFACT_NAMES, CHECK_INTERVAL_MS, CONFIG_KEYS, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, FAILURE_INTERVAL_MS, GENERATOR_NAME, GENERATOR_VERSION, HOOK_MARKER, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, MIN_MAX_PART_TOKENS, PACKAGE_LATEST_URL, PRESETS, PromptBack, PromptCancelled, REQUEST_TIMEOUT_MS, SCHEMA_VERSION, anchorForPath, appendGitignoreEntries, assertReplaceable, assertUsableConfigInput, buildImportResolver, bytesForTokens, cacheDirectory, cacheFilePath, checkForUpdate, classifyKind, classifyLayer, collectFiles, compareManifests, configDigest, countInvalidUtf8Bytes, countLines, decodeText, defaultIO, defineConfig, describeManifestShapeProblem, detectLanguage, detectPreset, displayPath, displayWidth, enforceBudget, escapeControls, estimateTokens, explainPath, fenceForContent, fenceForText, fetchLatestVersion, findConfigFile, findSecretInPath, firstRunMessage, formatNumber, formatTokens, formatUpdateNotice, generateInWorker, generateProjectTree, generateSarifReport, generateSnapshot, generateSnapshotAsync, getGitInfo, getPreset, gitignorePath, globToRegExp, hasPriorSnapshot, importsChangedFile, importsOfFile, importsOfText, installKind, installPreCommitHook, isBinaryBuffer, isBinaryExtension, isBinaryFile, isDiscoveryMode, isEffectivelyEmpty, isInteractive, isNewer, isResolvedConfig, isSensitivePath, isSkeletonizable, isTsxFileName, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, lockPathFor, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, planFirstRun, profileForPath, renderConfig, renderDiffText, renderExplainText, renumberParts, resolveChangedScope, resolveConfig, resolveSafeOutputDirs, resolveSpecifier, runInit, scanAndRedactSecrets, shouldCheck, skeletonizeTypeScript, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, unknownPresetMessage, updateCommand, validateSnapshot, workerEntry, wrapLines };