sigmap 8.33.0 → 8.35.0

package/llms-full.txt

@@ -11,21 +11,21 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.33.0 | Benchmark: sigmap-v8.33-main (2026-09-13)
+# Version: 8.35.0 | Benchmark: sigmap-v8.35-main (2026-09-13)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.33-main, 2026-09-13)
+## Core metrics (benchmark: sigmap-v8.35-main, 2026-09-13)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
-| Retrieval hit@5 | 44.0% (single-shot grep) | 78.9% (1.73× lift) |
-| Token reduction | — | 96.8% average |
-| Task-success proxy (modeled) | — | 62.9% |
-| Prompts per task | 2.84 | 1.58 (44.4% fewer) |
-| Supported languages | — | 32 |
+| Retrieval hit@5 | 44.0% (single-shot grep) | 78.6% (1.73× lift) |
+| Token reduction | — | 96.6% average |
+| Task-success proxy (modeled) | — | 61.0% |
+| Prompts per task | 2.84 | 1.61 (43.4% fewer) |
+| Supported languages | — | 33 |
 | MCP tools | — | 21 |
 | npm runtime dependencies | — | 0 |
 
@@ -370,9 +370,9 @@ impact = {"depth":3,"includeSigs":true}
 
 ---
 
-## Supported languages (32 extractors)
+## Supported languages (33 extractors)
 
-cpp, csharp, css, dart, dockerfile, gdscript, go, graphql, html, java, javascript, kotlin, markdown, php, properties, protobuf, python, r, ruby, rust, scala, shell, sql, svelte, swift, terraform, toml, typescript, typescript_react, vue_sfc, xml, yaml
+cpp, csharp, css, dart, dockerfile, gdscript, go, graphql, html, java, javascript, kotlin, lua, markdown, php, properties, protobuf, python, r, ruby, rust, scala, shell, sql, svelte, swift, terraform, toml, typescript, typescript_react, vue_sfc, xml, yaml
 
 ---
 

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.33.0 | Benchmark: sigmap-v8.33-main (2026-09-13)
+# Version: 8.35.0 | Benchmark: sigmap-v8.35-main (2026-09-13)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,13 +23,13 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.33-main, 2026-09-13)
+## Core metrics (benchmark: sigmap-v8.35-main, 2026-09-13)
 
-- hit@5 retrieval: 78.9% vs 44.0% single-shot grep baseline (1.73× lift)
-- Token reduction: 96.8% average across benchmark repos
-- Task-success proxy: 62.9% (modeled from retrieval tiers, not measured LLM sessions)
-- Prompts per task: 1.58 vs 2.84 baseline (44.4% fewer, modeled)
-- Languages: 32 supported · MCP tools: 21
+- hit@5 retrieval: 78.6% vs 44.0% single-shot grep baseline (1.73× lift)
+- Token reduction: 96.6% average across benchmark repos
+- Task-success proxy: 61.0% (modeled from retrieval tiers, not measured LLM sessions)
+- Prompts per task: 1.61 vs 2.84 baseline (43.4% fewer, modeled)
+- Languages: 33 supported · MCP tools: 21
 - Dependencies: zero npm runtime dependencies · fully offline
 
 ## Quick start

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.33.0",
+  "version": "8.35.0",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.33.0",
+  "version": "8.35.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/index.js

@@ -29,6 +29,7 @@ const EXT_MAP = {
   '.swift': 'swift',
   '.dart': 'dart',
   '.scala': 'scala',   '.sc': 'scala',
+  '.lua': 'lua',
   '.gd': 'gdscript',
   '.r': 'r',           '.R': 'r',
   '.vue': 'vue',

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.33.0",
+  "version": "8.35.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/config/loader.js

@@ -81,7 +81,7 @@ const SUPPORTED_CODE_EXTS = new Set([
   '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
   '.py', '.pyw', '.java', '.kt', '.kts', '.go', '.rs', '.cs',
   '.cpp', '.c', '.h', '.hpp', '.cc', '.rb', '.rake', '.php',
-  '.swift', '.dart', '.scala', '.sc', '.vue', '.svelte',
+  '.swift', '.dart', '.scala', '.sc', '.lua', '.vue', '.svelte',
   '.html', '.htm', '.css', '.scss', '.sass', '.less',
   '.yml', '.yaml', '.sh', '.bash', '.zsh', '.fish',
   '.sql', '.graphql', '.gql', '.tf', '.tfvars', '.proto',

package/src/config/tune.js

@@ -38,7 +38,7 @@ const TOKENS_PER_FILE = 25;
 const SOURCE_EXTS = new Set([
   '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx', '.py', '.rb', '.go', '.rs',
   '.java', '.kt', '.cs', '.cpp', '.c', '.h', '.hpp', '.swift', '.dart',
-  '.scala', '.php', '.gd', '.r', '.R',
+  '.scala', '.php', '.lua', '.gd', '.r', '.R',
 ]);
 
 /** Raw user config file content, or null when absent/unparsable. */

package/src/discovery/language-detector.js

@@ -19,6 +19,7 @@ const EXT_TO_LANG = {
   '.java': 'java', '.kt': 'kotlin', '.cs': 'csharp', '.cpp': 'cpp',
   '.c': 'cpp', '.h': 'cpp', '.hpp': 'cpp', '.swift': 'swift',
   '.dart': 'dart', '.scala': 'scala', '.php': 'php',
+  '.lua': 'lua',
   '.gd': 'gdscript',
   '.r': 'r', '.R': 'r',
 };

package/src/discovery/source-root-registry.js

@@ -156,12 +156,21 @@ const REGISTRY = {
       akka:  { detectionFiles: [], detectionDeps: ['akka'], srcDirs: ['src/main/scala','src'] },
       play:  { detectionFiles: [], detectionDeps: ['play'], srcDirs: ['app','conf'] },
       spark: { detectionFiles: [], detectionDeps: ['spark'],srcDirs: ['src/main/scala'] },
-      zio:   { detectionFiles: [], detectionDeps: ['zio'],  srcDirs: ['src/main/scala'] },
+      zio:   { detectionFiles: [], detectionDeps: ['zio'], srcDirs: ['src/main/scala'] },
     },
     srcDirs:  ['src/main/scala','src'],
     penalties: ['target'],
   },
 
+  lua: {
+    manifestFiles: ['.luarc.json', 'selene.toml', 'stylua.toml'],
+    frameworks: {
+      luarocks: { detectionFiles: ['*.rockspec'], srcDirs: ['src','lua','lib'] },
+    },
+    srcDirs:  ['src','lua','lib'],
+    penalties: ['.luarocks','luarocks_modules'],
+  },
+
   r: {
     manifestFiles: ['DESCRIPTION','renv.lock'],
     frameworks: {

package/src/discovery/source-root-scorer.js

@@ -7,7 +7,7 @@ const { git } = require('../util/git');
 const CODE_EXTS = new Set([
   '.js','.mjs','.cjs','.ts','.tsx','.jsx',
   '.py','.rb','.go','.rs','.java','.kt',
-  '.cs','.cpp','.c','.h','.swift','.dart','.scala','.php',
+  '.cs','.cpp','.c','.h','.swift','.dart','.scala','.php','.lua',
 ]);
 
 const AUTO_SKIP = new Set([

package/src/extractors/cpp.js

@@ -5,8 +5,13 @@ const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 // Ceilings sit above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed
 // — an undisclosed cap looks like a class that simply has eight methods (#576).
-const MEMBER_LIMIT = 8;
-const PER_FILE_LIMIT = 25;
+// Class bodies are scanned to this many characters. Real classes routinely
+// run past the old 4KB scan window — truncating there silently hid every
+// member after ~4000 chars AND anchored class end-lines short (#576). The
+// ceiling only guards against pathological input (Java parity, #551).
+const MAX_CLASS_BODY_CHARS = 200000;
+const MEMBER_LIMIT = 120;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from C/C++ source code.
@@ -43,7 +48,7 @@ function extract(src) {
 
 function extractBlock(src, startIndex) {
   let depth = 1, i = startIndex;
-  const end = Math.min(src.length, startIndex + 4000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;

package/src/extractors/csharp.js

@@ -6,8 +6,13 @@ const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 // Ceilings sit above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed
 // — an undisclosed cap looks like a class that simply has eight methods (#576).
-const MEMBER_LIMIT = 8;
-const PER_FILE_LIMIT = 25;
+// Class bodies are scanned to this many characters. Real classes routinely
+// run past the old 4KB scan window — truncating there silently hid every
+// member after ~4000 chars AND anchored class end-lines short (#576). The
+// ceiling only guards against pathological input (Java parity, #551).
+const MAX_CLASS_BODY_CHARS = 200000;
+const MEMBER_LIMIT = 120;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from C# source code.
@@ -42,7 +47,7 @@ function extract(src) {
 
 function extractBlock(src, startIndex) {
   let depth = 1, i = startIndex;
-  const end = Math.min(src.length, startIndex + 5000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;

package/src/extractors/css.js

@@ -4,7 +4,7 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from CSS/SCSS/SASS/Less source code.

package/src/extractors/dart.js

@@ -6,8 +6,13 @@ const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 // Ceilings sit above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed
 // — an undisclosed cap looks like a class that simply has eight methods (#576).
-const MEMBER_LIMIT = 8;
-const PER_FILE_LIMIT = 25;
+// Class bodies are scanned to this many characters. Real classes routinely
+// run past the old 4KB scan window — truncating there silently hid every
+// member after ~4000 chars AND anchored class end-lines short (#576). The
+// ceiling only guards against pathological input (Java parity, #551).
+const MAX_CLASS_BODY_CHARS = 200000;
+const MEMBER_LIMIT = 120;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from Dart source code.
@@ -61,7 +66,7 @@ function extract(src) {
 
 function extractBlock(src, startIndex) {
   let depth = 1, i = startIndex;
-  const end = Math.min(src.length, startIndex + 4000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;

package/src/extractors/deps.js

@@ -89,6 +89,28 @@ function extractRDeps(src) {
   return [...deps].slice(0, 5);
 }
 
+/**
+ * Extract Lua require() module dependencies.
+ * Captures `require "mod"` and `require("mod")`, returning compact module
+ * names as they appear in source.
+ * @param {string} src
+ * @returns {string[]}
+ */
+function extractLuaDeps(src) {
+  const deps = new Set();
+  const stripped = stripLuaComments(src || '');
+  for (const m of stripped.matchAll(/\brequire\s*(?:\(\s*)?["']([A-Za-z0-9_.\/-]+)["']\s*\)?/g)) {
+    if (m[1]) deps.add(m[1]);
+  }
+  return [...deps].slice(0, 5);
+}
+
+function stripLuaComments(src) {
+  return String(src || '')
+    .replace(/--\[\[[\s\S]*?\]\]/g, '')
+    .replace(/--.*$/gm, '');
+}
+
 /**
  * Build reverse dependency map from forward map.
  * @param {Map<string, string[]>} forwardMap
@@ -107,4 +129,4 @@ function buildReverseDepMap(forwardMap) {
   return reverse;
 }
 
-module.exports = { extractPythonDeps, extractTSDeps, extractRDeps, buildReverseDepMap };
+module.exports = { extractPythonDeps, extractTSDeps, extractRDeps, extractLuaDeps, buildReverseDepMap };

package/src/extractors/dispatch.js

@@ -28,6 +28,7 @@ const EXTRACTORS = {
   swift: require('./swift'),
   dart: require('./dart'),
   scala: require('./scala'),
+  lua: require('./lua'),
   gdscript: require('./gdscript'),
   r: require('./r'),
   vue_sfc: require('./vue_sfc'),
@@ -78,6 +79,7 @@ const EXT_MAP = {
   '.swift': 'swift',
   '.dart': 'dart',
   '.scala': 'scala', '.sc': 'scala',
+  '.lua': 'lua',
   '.gd': 'gdscript',
   '.r': 'r', '.R': 'r',
   '.vue': 'vue_sfc',

package/src/extractors/dockerfile.js

@@ -4,7 +4,7 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from Dockerfiles.

package/src/extractors/gdscript.js

@@ -4,10 +4,10 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+const PER_FILE_LIMIT = 200;
 
 // Ceilings disclose what they drop rather than truncating silently (#576).
-const MEMBER_LIMIT = 6;
+const MEMBER_LIMIT = 120;
 const ENUM_LIMIT = 24;
 
 /**

package/src/extractors/go.js

@@ -1,11 +1,19 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
-const { capWithNotice } = require('../util/truncate');
+const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+// Class bodies are scanned to this many characters. Real classes routinely
+// run past the old 4KB scan window — truncating there silently hid every
+// member after ~4000 chars AND anchored class end-lines short (#576). The
+// ceiling only guards against pathological input (Java parity, #551).
+const MAX_CLASS_BODY_CHARS = 200000;
+const PER_FILE_LIMIT = 200;
+
+// Per-interface member ceiling, disclosed via capMembersWithNotice (#576).
+const MEMBER_LIMIT = 120;
 
 /**
  * Extract signatures from Go source code.
@@ -41,7 +49,7 @@ function extract(src) {
     const block = extractBlock(stripped, bodyStart);
     sigs.push(hinted(withAnchor(`type ${m[1]} interface`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)), m[1]));
     for (const meth of extractInterfaceMethods(block)) {
-      sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + meth.declIdx), lineAt(stripped, bodyStart + meth.endIdx)));
+      sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
     }
   }
 
@@ -59,7 +67,7 @@ function extract(src) {
 
 function extractBlock(src, startIndex) {
   let depth = 1, i = startIndex;
-  const end = Math.min(src.length, startIndex + 2000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;
@@ -79,7 +87,7 @@ function extractInterfaceMethods(block) {
       endIdx: m.index + m[0].length,
     });
   }
-  return methods.slice(0, 8);
+  return capMembersWithNotice(methods, MEMBER_LIMIT, 'methods');
 }
 
 function normalizeParams(params) {

package/src/extractors/html.js

@@ -4,7 +4,7 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from HTML files.

package/src/extractors/javascript.js

@@ -4,6 +4,10 @@ const { lineAt, withAnchor } = require('./line-anchor');
 const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 const { stripComments, maskCode, readBalanced } = require('./scan');
 
+// Class bodies are scanned to this many characters — guard against
+// pathological input only; the old 4KB window silently hid members (#576).
+const MAX_CLASS_BODY_CHARS = 200000;
+
 /**
  * Extract signatures from JavaScript source code.
  * Top-level declarations and class members carry a `:start-end` line anchor
@@ -113,13 +117,13 @@ function extract(src) {
     const anchored = anchors[i] ? withAnchor(s, anchors[i][0], anchors[i][1]) : s;
     return docHintFor[i] ? `${anchored}  # ${docHintFor[i]}` : anchored;
   });
-  return capWithNotice(withAnchors, 25, 'signatures');
+  return capWithNotice(withAnchors, 200, 'signatures');
 }
 
 function extractBlock(src, startIndex) {
   let depth = 1;
   let i = startIndex;
-  const end = Math.min(src.length, startIndex + 4000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;
@@ -154,7 +158,7 @@ function extractClassMembers(block, maskedBlock, returnHints) {
     const retStr = formatReturnHint(returnHints.get(m[1]));
     members.push({ text: `${isStatic}${isAsync}${m[1]}(${normalizeParams(params)})${retStr}`, start, end });
   }
-  return capMembersWithNotice(members, 8, 'methods');
+  return capMembersWithNotice(members, 120, 'methods');
 }
 
 function buildReturnHints(src) {

package/src/extractors/kotlin.js

@@ -6,8 +6,13 @@ const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 // Ceilings sit above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed
 // — an undisclosed cap looks like a class that simply has eight methods (#576).
-const MEMBER_LIMIT = 8;
-const PER_FILE_LIMIT = 25;
+// Class bodies are scanned to this many characters. Real classes routinely
+// run past the old 4KB scan window — truncating there silently hid every
+// member after ~4000 chars AND anchored class end-lines short (#576). The
+// ceiling only guards against pathological input (Java parity, #551).
+const MAX_CLASS_BODY_CHARS = 200000;
+const MEMBER_LIMIT = 120;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from Kotlin source code.
@@ -61,7 +66,7 @@ function extract(src) {
 
 function extractBlock(src, startIndex) {
   let depth = 1, i = startIndex;
-  const end = Math.min(src.length, startIndex + 4000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;

package/src/extractors/lua.js

@@ -0,0 +1,152 @@
+'use strict';
+
+const { capWithNotice } = require('../util/truncate');
+
+// Ceiling discloses what it drops rather than truncating silently (#583).
+// Collection runs to completion so the marker reports the true overflow —
+// stopping early made r.js report "+1 more" where 50 were hidden (#584).
+const PER_FILE_LIMIT = 200;
+
+/**
+ * Extract signatures from Lua source code.
+ *
+ * Recognised constructs:
+ *   - Global functions: `function name(args)`
+ *   - Module-table functions: `function M.name(args)` / `function M:name(args)`
+ *   - Local functions: `local function name(args)`
+ *   - Assigned functions: `name = function(args)` / `M.name = function(args)`
+ *   - Module imports: `local mod = require("mod")` as compact hints
+ *   - LDoc-style doc comments (`---`) as first-sentence hints
+ *
+ * The extractor is regex-only and zero-dependency, matching SigMap's Tier-3
+ * language extractor style.
+ *
+ * @param {string} src - Raw file content
+ * @returns {string[]} Array of signature strings
+ */
+function extract(src) {
+  if (!src || typeof src !== 'string') return [];
+  const sigs = [];
+  const hints = collectDocHints(src);
+  const stripped = stripLuaComments(src);
+  const seen = new Set();
+
+  // local foo = require('bar.baz') — useful module-surface hint, capped low.
+  for (const m of stripped.matchAll(/^\s*(?:local\s+)?([A-Za-z_]\w*)\s*=\s*require\s*\(\s*['"]([A-Za-z0-9_.\/-]+)['"]\s*\)/gm)) {
+    pushUnique(sigs, seen, `require ${m[2]} as ${m[1]}`);
+  }
+
+  // local function name(args)
+  for (const m of stripped.matchAll(/^\s*local\s+function\s+([A-Za-z_]\w*)\s*\(([^)]*)\)/gm)) {
+    if (m[1].startsWith('_')) continue;
+    pushUnique(sigs, seen, `local function ${m[1]}(${normalizeParams(m[2])})${applyHint(hints, m[1])}`);
+  }
+
+  // function name(args), function M.name(args), function M:name(args)
+  for (const m of stripped.matchAll(/^\s*function\s+([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*\(([^)]*)\)/gm)) {
+    const name = m[1];
+    if (name.startsWith('_')) continue;
+    pushUnique(sigs, seen, `function ${name}(${normalizeParams(m[2])})${applyHint(hints, name)}`);
+  }
+
+  // name = function(args), M.name = function(args), M:name = function(args)
+  for (const m of stripped.matchAll(/^\s*(?:local\s+)?([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*=\s*function\s*\(([^)]*)\)/gm)) {
+    const name = m[1];
+    if (name.startsWith('_')) continue;
+    pushUnique(sigs, seen, `${name} = function(${normalizeParams(m[2])})${applyHint(hints, name)}`);
+  }
+
+  return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
+}
+
+function pushUnique(out, seen, sig) {
+  if (!sig || seen.has(sig)) return;
+  seen.add(sig);
+  out.push(sig);
+}
+
+function normalizeParams(params) {
+  return String(params || '')
+    .replace(/--.*$/gm, '')
+    .split(',')
+    .map((p) => p.trim().replace(/\s+/g, ' '))
+    .filter(Boolean)
+    .join(', ');
+}
+
+function applyHint(hints, name) {
+  const h = hints.get(name);
+  return h ? `  # ${h}` : '';
+}
+
+/**
+ * Attach each contiguous `---` doc block to the next function-like declaration
+ * by its extracted symbol name.
+ */
+function collectDocHints(src) {
+  const hints = new Map();
+  const lines = src.split('\n');
+  let block = [];
+  for (const line of lines) {
+    const doc = line.match(/^\s*---\s?(.*)$/);
+    if (doc) {
+      block.push(doc[1]);
+    } else if (block.length > 0) {
+      const decl = line.match(/^\s*local\s+function\s+([A-Za-z_]\w*)\s*\(/)
+                || line.match(/^\s*function\s+([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*\(/)
+                || line.match(/^\s*(?:local\s+)?([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*=\s*function\s*\(/);
+      if (decl) {
+        const hint = firstDocSentence(block);
+        if (hint) hints.set(decl[1], hint);
+      }
+      block = [];
+    }
+  }
+  return hints;
+}
+
+function firstDocSentence(block) {
+  for (const raw of block) {
+    const line = String(raw || '').trim();
+    if (!line || line.startsWith('@')) continue;
+    return line.replace(/\s+/g, ' ').slice(0, 60).replace(/[.,;:!?]+$/, '').trim();
+  }
+  return '';
+}
+
+/** Strip Lua line and long comments while preserving strings enough for regex scans. */
+function stripLuaComments(src) {
+  const out = src.split('');
+  const blank = (a, b) => { for (let i = a; i < b; i++) if (out[i] !== '\n') out[i] = ' '; };
+  let i = 0;
+  while (i < src.length) {
+    const ch = src[i];
+    if (ch === '"' || ch === "'") {
+      const quote = ch;
+      i++;
+      while (i < src.length) {
+        if (src[i] === '\\') { i += 2; continue; }
+        if (src[i] === quote) { i++; break; }
+        if (src[i] === '\n') break;
+        i++;
+      }
+      continue;
+    }
+    if (src.startsWith('--[[', i)) {
+      const end = src.indexOf(']]', i + 4);
+      blank(i, end === -1 ? src.length : end + 2);
+      i = end === -1 ? src.length : end + 2;
+      continue;
+    }
+    if (src.startsWith('--', i)) {
+      const end = src.indexOf('\n', i + 2);
+      blank(i, end === -1 ? src.length : end);
+      i = end === -1 ? src.length : end;
+      continue;
+    }
+    i++;
+  }
+  return out.join('');
+}
+
+module.exports = { extract };

package/src/extractors/markdown.js

@@ -3,7 +3,7 @@
 const { capWithNotice } = require('../util/truncate');
 
 // Ceiling discloses what it drops rather than truncating silently (#583).
-const PER_FILE_LIMIT = 40;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Lightweight markdown technical indexer.

package/src/extractors/php.js

@@ -6,8 +6,13 @@ const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 // Ceilings sit above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed
 // — an undisclosed cap looks like a class that simply has eight methods (#576).
-const MEMBER_LIMIT = 8;
-const PER_FILE_LIMIT = 25;
+// Class bodies are scanned to this many characters. Real classes routinely
+// run past the old 4KB scan window — truncating there silently hid every
+// member after ~4000 chars AND anchored class end-lines short (#576). The
+// ceiling only guards against pathological input (Java parity, #551).
+const MAX_CLASS_BODY_CHARS = 200000;
+const MEMBER_LIMIT = 120;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from PHP source code.
@@ -65,7 +70,7 @@ function extract(src) {
 
 function extractBlock(src, startIndex) {
   let depth = 1, i = startIndex;
-  const end = Math.min(src.length, startIndex + 4000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;