sigmap 8.30.0 → 8.32.0

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.30.0 | Benchmark: sigmap-v8.30-main (2026-09-07)
+# Version: 8.32.0 | Benchmark: sigmap-v8.32-main (2026-09-12)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.30-main, 2026-09-07)
+## Core metrics (benchmark: sigmap-v8.32-main, 2026-09-12)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
@@ -132,6 +132,8 @@ sigmap tune                              Recommend config from repo detection
 sigmap tune --apply                      Write the recommendations into gen-context.config.json (merges; your keys preserved)
 sigmap skills list                       List skill clients (Claude/Cursor/Windsurf/Copilot/AGENTS.md) and install state (--json)
 sigmap skills install                    Install the SigMap agent playbooks for detected clients (--client <name> | --all)
+sigmap lines <file> <start>-<end>        Print an exact line range — CLI twin of get_lines (secrets redacted)
+sigmap lines <file> :<line> --context <n>  Window around one signature anchor (default ±10)
 sigmap note "<text>"                     Append a note to the cross-session decision log
 sigmap note                              List recent notes (also: note --list <N>)
 sigmap status                            Show repo state — branch, dirty files, index freshness, notes

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.30.0 | Benchmark: sigmap-v8.30-main (2026-09-07)
+# Version: 8.32.0 | Benchmark: sigmap-v8.32-main (2026-09-12)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.30-main, 2026-09-07)
+## Core metrics (benchmark: sigmap-v8.32-main, 2026-09-12)
 
 - hit@5 retrieval: 81.1% vs 44.0% single-shot grep baseline (1.73× lift)
 - Token reduction: 96.8% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.30.0",
+  "version": "8.32.0",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {
@@ -31,6 +31,8 @@
     "benchmark:test-discovery": "node scripts/run-test-discovery-benchmark.mjs --save",
     "benchmark:terse": "node scripts/run-terse-benchmark.mjs --save",
     "benchmark:callgraph-boost": "node scripts/run-callgraph-boost-benchmark.mjs --save",
+    "benchmark:callgraph-jvm": "node scripts/run-callgraph-jvm-benchmark.mjs",
+    "validate:callgraph-jvm": "node scripts/run-callgraph-jvm-benchmark.mjs --gate",
     "benchmark:centrality-blend": "node scripts/run-centrality-blend-benchmark.mjs --save",
     "benchmark:surface-enrichment": "node scripts/run-surface-enrichment-benchmark.mjs --save",
     "validate:squeeze": "node scripts/run-squeeze-benchmark.mjs --gate",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.30.0",
+  "version": "8.32.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.30.0",
+  "version": "8.32.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/extractors/cpp.js

@@ -1,5 +1,13 @@
 'use strict';
 
+const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
+
+// Ceilings sit above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed
+// — an undisclosed cap looks like a class that simply has eight methods (#576).
+const MEMBER_LIMIT = 8;
+const PER_FILE_LIMIT = 25;
+
 /**
  * Extract signatures from C/C++ source code.
  * @param {string} src - Raw file content
@@ -30,7 +38,7 @@ function extract(src) {
     sigs.push(`${m[2]}(${normalizeParams(m[3])})${retStr}`);
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractBlock(src, startIndex) {
@@ -53,7 +61,7 @@ function extractMembers(block) {
     const retStr = ret ? ` → ${ret}` : '';
     members.push(`${m[2]}(${normalizeParams(m[3])})${retStr}`);
   }
-  return members.slice(0, 8);
+  return capWithNotice(members, MEMBER_LIMIT, 'members');
 }
 
 function normalizeParams(params) {

package/src/extractors/csharp.js

@@ -1,6 +1,13 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
+const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
+
+// Ceilings sit above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed
+// — an undisclosed cap looks like a class that simply has eight methods (#576).
+const MEMBER_LIMIT = 8;
+const PER_FILE_LIMIT = 25;
 
 /**
  * Extract signatures from C# source code.
@@ -25,11 +32,12 @@ function extract(src) {
     const block = extractBlock(stripped, bodyStart);
     sigs.push(withAnchor(`${m[1]} ${m[2]}`, lineAt(stripped, declIdx), lineAt(stripped, bodyStart + block.length)));
     for (const meth of extractMembers(block)) {
-      sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + meth.declIdx), lineAt(stripped, bodyStart + meth.endIdx)));
+      // The disclosure marker carries no offsets; anchor it at the class body.
+      sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
     }
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractBlock(src, startIndex) {
@@ -55,7 +63,7 @@ function extractMembers(block) {
       endIdx: m.index + m[0].length,
     });
   }
-  return members.slice(0, 8);
+  return capMembersWithNotice(members, MEMBER_LIMIT);
 }
 
 function normalizeParams(params) {

package/src/extractors/css.js

@@ -1,5 +1,11 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
+
 /**
  * Extract signatures from CSS/SCSS/SASS/Less source code.
  * @param {string} src - Raw file content
@@ -63,7 +69,7 @@ function extract(src) {
     for (const name of selected) sigs.push(`.${name}`);
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 module.exports = { extract };

package/src/extractors/dart.js

@@ -1,6 +1,13 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
+const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
+
+// Ceilings sit above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed
+// — an undisclosed cap looks like a class that simply has eight methods (#576).
+const MEMBER_LIMIT = 8;
+const PER_FILE_LIMIT = 25;
 
 /**
  * Extract signatures from Dart source code.
@@ -36,7 +43,8 @@ function extract(src) {
     const block = extractBlock(stripped, bodyStart);
     sigs.push(withAnchor(`${abs}class ${m[1]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)));
     for (const meth of extractMembers(block)) {
-      sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + meth.declIdx), lineAt(stripped, bodyStart + meth.endIdx)));
+      // The disclosure marker carries no offsets; anchor it at the class body.
+      sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
     }
   }
 
@@ -48,7 +56,7 @@ function extract(src) {
     sigs.push(withAnchor(`${m[2]}(${normalizeParams(m[3])})${retStr}`, s, e));
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractBlock(src, startIndex) {
@@ -73,7 +81,7 @@ function extractMembers(block) {
       endIdx: m.index + m[0].length,
     });
   }
-  return members.slice(0, 8);
+  return capMembersWithNotice(members, MEMBER_LIMIT);
 }
 
 function normalizeParams(params) {

package/src/extractors/dockerfile.js

@@ -1,5 +1,11 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
+
 /**
  * Extract signatures from Dockerfiles.
  * @param {string} src - Raw file content
@@ -43,7 +49,7 @@ function extract(src) {
     if (m) sigs.push(`ARG ${m[1]}`);
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 module.exports = { extract };

package/src/extractors/gdscript.js

@@ -1,5 +1,15 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
+
+// Ceilings disclose what they drop rather than truncating silently (#576).
+const MEMBER_LIMIT = 6;
+const ENUM_LIMIT = 24;
+
 /**
  * Extract signatures from Godot GDScript source code.
  * @param {string} src - Raw file content
@@ -44,7 +54,7 @@ function extract(src) {
       .split(',')
       .map((s) => s.trim().split(/\s*=/)[0].trim())
       .filter(Boolean);
-    sigs.push(`${indent}enum ${m[1]} { ${members.slice(0, 6).join(', ')} }`);
+    sigs.push(`${indent}enum ${m[1]} { ${capWithNotice(members, ENUM_LIMIT, 'values').join(', ')} }`);
   }
 
   let constCount = 0;
@@ -92,7 +102,7 @@ function extract(src) {
     }
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractInnerMembers(stripped, startIndex) {
@@ -110,7 +120,7 @@ function extractInnerMembers(stripped, startIndex) {
       members.push(`${staticKw}func ${fm[2]}(${params})${retStr}`);
     }
   }
-  return members.slice(0, 6);
+  return capWithNotice(members, MEMBER_LIMIT, 'members');
 }
 
 function normalizeParams(params) {

package/src/extractors/go.js

@@ -1,6 +1,11 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
 
 /**
  * Extract signatures from Go source code.
@@ -49,7 +54,7 @@ function extract(src) {
     sigs.push(hinted(withAnchor(`func ${receiver}${m[2]}(${normalizeParams(m[3])})${retStr}`, lineAt(stripped, m.index), lineAt(stripped, end)), m[2]));
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractBlock(src, startIndex) {

package/src/extractors/html.js

@@ -1,5 +1,11 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
+
 /**
  * Extract signatures from HTML files.
  * Focuses on id/class attributes, forms, and script tags.
@@ -33,7 +39,7 @@ function extract(src) {
     sigs.push(`data-${m[0].match(/data-(\w[\w-]*)/i)[1]}: ${m[1]}`);
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 module.exports = { extract };

package/src/extractors/kotlin.js

@@ -1,6 +1,13 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
+const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
+
+// Ceilings sit above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed
+// — an undisclosed cap looks like a class that simply has eight methods (#576).
+const MEMBER_LIMIT = 8;
+const PER_FILE_LIMIT = 25;
 
 /**
  * Extract signatures from Kotlin source code.
@@ -35,7 +42,8 @@ function extract(src) {
     const block = extractBlock(stripped, bodyStart);
     sigs.push(withAnchor(`${m[1]} ${m[2]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)));
     for (const meth of extractMembers(block)) {
-      sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + meth.declIdx), lineAt(stripped, bodyStart + meth.endIdx)));
+      // The disclosure marker carries no offsets; anchor it at the class body.
+      sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
     }
   }
 
@@ -48,7 +56,7 @@ function extract(src) {
     sigs.push(withAnchor(`${suspend}fun ${m[1]}(${normalizeParams(m[2])})${retStr}`, s, e));
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractBlock(src, startIndex) {
@@ -75,7 +83,7 @@ function extractMembers(block) {
       endIdx: m.index + m[0].length,
     });
   }
-  return members.slice(0, 8);
+  return capMembersWithNotice(members, MEMBER_LIMIT);
 }
 
 function normalizeParams(params) {

package/src/extractors/php.js

@@ -1,6 +1,13 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
+const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
+
+// Ceilings sit above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed
+// — an undisclosed cap looks like a class that simply has eight methods (#576).
+const MEMBER_LIMIT = 8;
+const PER_FILE_LIMIT = 25;
 
 /**
  * Extract signatures from PHP source code.
@@ -40,7 +47,8 @@ function extract(src) {
     const block = extractBlock(stripped, bodyStart);
     sigs.push(withAnchor(`${kind} ${m[1]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)));
     for (const meth of extractMembers(block)) {
-      sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + meth.declIdx), lineAt(stripped, bodyStart + meth.endIdx)));
+      // The disclosure marker carries no offsets; anchor it at the class body.
+      sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
     }
   }
 
@@ -52,7 +60,7 @@ function extract(src) {
     sigs.push(withAnchor(`function ${m[1]}(${normalizeParams(m[2])})${retStr}`, s, e));
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractBlock(src, startIndex) {
@@ -80,7 +88,7 @@ function extractMembers(block) {
       endIdx: m.index + m[0].length,
     });
   }
-  return members.slice(0, 8);
+  return capMembersWithNotice(members, MEMBER_LIMIT);
 }
 
 function normalizeParams(params) {

package/src/extractors/python.js

@@ -2,6 +2,11 @@
 
 const path = require('path');
 const { lineAt } = require('./line-anchor');
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 30;
 
 /**
  * 1-based line of the last source line belonging to a top-level (indent 0)
@@ -136,7 +141,7 @@ function extract(src, filePath) {
     }
   }
 
-  return sigs.slice(0, 30);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractClassMethods(stripped, startIndex) {

package/src/extractors/r.js

@@ -1,5 +1,11 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 30;
+
 /**
  * Extract signatures from R source code.
  *
@@ -113,7 +119,7 @@ function extract(src) {
     sigs.push(`setClass("${sm[1]}")`);
   }
 
-  return sigs.slice(0, 30);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 /**

package/src/extractors/ruby.js

@@ -1,5 +1,11 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
+
 /**
  * Extract signatures from Ruby source code.
  * @param {string} src - Raw file content
@@ -34,7 +40,7 @@ function extract(src) {
     sigs.push(`def ${m[1]}${params}${retStr}`);
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function normalizeParams(params) {

package/src/extractors/rust.js

@@ -1,6 +1,11 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
 
 /**
  * Extract signatures from Rust source code.
@@ -70,7 +75,7 @@ function extract(src) {
     sigs.push(hinted(withAnchor(`pub ${asyncKw}fn ${m[1]}(${normalizeParams(m[2])})${retStr}`, s, e), m[1]));
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractBlock(src, startIndex) {

package/src/extractors/scala.js

@@ -1,6 +1,13 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
+const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
+
+// Ceilings sit above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed
+// — an undisclosed cap looks like a class that simply has eight methods (#576).
+const MEMBER_LIMIT = 8;
+const PER_FILE_LIMIT = 25;
 
 /**
  * Extract signatures from Scala source code.
@@ -27,7 +34,8 @@ function extract(src) {
     const block = extractBlock(stripped, bodyStart);
     sigs.push(withAnchor(`${kind} ${m[1]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)));
     for (const fn of extractMembers(block)) {
-      sigs.push(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + fn.declIdx), lineAt(stripped, bodyStart + fn.endIdx)));
+      // The disclosure marker carries no offsets; anchor it at the class body.
+      sigs.push(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + (fn.declIdx || 0)), lineAt(stripped, bodyStart + (fn.endIdx || 0))));
     }
   }
 
@@ -41,7 +49,7 @@ function extract(src) {
     sigs.push(withAnchor(`def ${m[1]}${params}${retStr}`, line, line));
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractBlock(src, startIndex) {
@@ -68,7 +76,7 @@ function extractMembers(block) {
       endIdx: m.index + m[0].length,
     });
   }
-  return members.slice(0, 8);
+  return capMembersWithNotice(members, MEMBER_LIMIT);
 }
 
 function normalizeParams(params) {

package/src/extractors/shell.js

@@ -1,5 +1,11 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
+
 /**
  * Extract signatures from shell scripts (bash, zsh, fish).
  * @param {string} src - Raw file content
@@ -37,7 +43,7 @@ function extract(src) {
     }
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 module.exports = { extract };

package/src/extractors/svelte.js

@@ -1,5 +1,11 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
+
 /**
  * Extract signatures from Svelte components.
  * @param {string} src - Raw file content
@@ -42,7 +48,7 @@ function extract(src) {
     sigs.push(`$: ${m[1]}`);
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function normalizeParams(params) {

package/src/extractors/swift.js

@@ -1,6 +1,13 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
+const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
+
+// Ceilings sit above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed
+// — an undisclosed cap looks like a class that simply has eight methods (#576).
+const MEMBER_LIMIT = 8;
+const PER_FILE_LIMIT = 25;
 
 /**
  * Extract signatures from Swift source code.
@@ -36,7 +43,8 @@ function extract(src) {
     const block = extractBlock(stripped, bodyStart);
     sigs.push(withAnchor(`${m[1]} ${m[2]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)));
     for (const fn of extractMembers(block)) {
-      sigs.push(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + fn.declIdx), lineAt(stripped, bodyStart + fn.endIdx)));
+      // The disclosure marker carries no offsets; anchor it at the class body.
+      sigs.push(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + (fn.declIdx || 0)), lineAt(stripped, bodyStart + (fn.endIdx || 0))));
     }
   }
 
@@ -48,7 +56,7 @@ function extract(src) {
     sigs.push(withAnchor(`${asyncKw}func ${m[1]}(${normalizeParams(m[2])})${retStr}`, s, e));
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function extractBlock(src, startIndex) {
@@ -74,7 +82,7 @@ function extractMembers(block) {
       endIdx: m.index + m[0].length,
     });
   }
-  return members.slice(0, 8);
+  return capMembersWithNotice(members, MEMBER_LIMIT);
 }
 
 function normalizeParams(params) {

package/src/extractors/vue.js

@@ -1,5 +1,11 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
+
 /**
  * Extract signatures from Vue single-file components.
  * @param {string} src - Raw file content
@@ -64,7 +70,7 @@ function extract(src) {
   const emitsMatch = script.match(/(?:defineEmits|emits)\s*(?::\s*|\(\s*)(\[[\s\S]*?\])/);
   if (emitsMatch) sigs.push(`emits: ${emitsMatch[1].replace(/\s+/g, ' ')}`);
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 function normalizeParams(params) {

package/src/extractors/yaml.js

@@ -1,5 +1,11 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling sits above the default `maxSigsPerFile` so the configured budget
+// governs output rather than a literal buried here, and omissions are disclosed (#576).
+const PER_FILE_LIMIT = 25;
+
 /**
  * Extract signatures from YAML configuration files.
  * @param {string} src - Raw file content
@@ -53,7 +59,7 @@ function extract(src) {
     }
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
 }
 
 module.exports = { extract };