#!/usr/bin/env node
'use strict';
// SigMap — standalone bundle (bundled modules generated by scripts/build-bundle.mjs)
// Copy this single file to any project: node gen-context.js --setup
// No src/ directory required. Node.js 18+ only. Zero npm dependencies.

const __factories = {};
const __cache = {};
function __require(key) {
  if (Object.prototype.hasOwnProperty.call(__cache, key)) {
    return __cache[key].exports;
  }
  if (!Object.prototype.hasOwnProperty.call(__factories, key)) {
    throw new Error('[sigmap] bundled module not found: ' + key);
  }
  const module = { exports: {} };
  __cache[key] = module;
  __factories[key](module, module.exports);
  return module.exports;
}


// ═══ SIGMAP BUNDLED MODULES — generated by scripts/build-bundle.mjs; do not edit by hand ═══

// ── ./packages/adapters/claude ──
__factories["./packages/adapters/claude"] = function(module, exports) {
  
  /**
   * Claude adapter — appends to CLAUDE.md under a marker line.
   * Never overwrites human-written content above the marker.
   *
   * Contract:
   *   format(context, opts?) → string
   *   outputPath(cwd) → string
   *   write(context, cwd, opts?) → void   (handles append logic)
   */

  const path = require('path');
  const fs = require('fs');
  const { replaceManagedSection, managedSectionLineStart } = __require('./src/util/managed-section');

  const name = 'claude';

  const ALLOWLIST_MARKER = '<!-- sigmap-bash-allowlist -->';

  const ALLOWLIST_BLOCK = [
    '## Bash allowlist',
    '',
    ALLOWLIST_MARKER,
    '',
    'The following sigmap commands are pre-approved — Claude Code will not prompt for confirmation:',
    '',
    '```json',
    JSON.stringify({
      permissions: {
        allow: [
          'Bash(sigmap ask*)',
          'Bash(sigmap validate*)',
          'Bash(sigmap judge*)',
          'Bash(sigmap weights*)',
          'Bash(sigmap history*)',
          'Bash(sigmap --query*)',
          'Bash(sigmap --diff*)',
          'Bash(sigmap --health*)',
          'Bash(sigmap --coverage*)',
          'Bash(node gen-context.js*)',
        ],
      },
    }, null, 2),
    '```',
    '',
    'Add the `permissions.allow` array above to `.claude/settings.json` to activate.',
    '',
  ].join('\n');

  /**
   * Format context suited for CLAUDE.md.
   * @param {string} context - Raw signature context string
   * @param {object} [opts]
   * @param {string} [opts.version] - SigMap version string
   * @returns {string}
   */
  function format(context, opts = {}) {
    if (!context || typeof context !== 'string') return '';
    const version   = opts.version || 'unknown';
    const timestamp = new Date().toISOString();
    const meta      = _confidenceMeta(opts);
    // Stable-prefix layout (#683): a wall-clock stamp ahead of the body busts a
    // prefix cache on every run, so it trails the content with the volatile tail.
    if (opts.cacheLayout !== 'legacy') {
      return [
        `<!-- Generated by SigMap v${version} -->`,
        meta,
        '',
        context,
        `<!-- Updated: ${timestamp} -->`,
      ].join('\n');
    }
    return [
      `<!-- Generated by SigMap v${version} — ${timestamp} -->`,
      meta,
      '',
      context,
    ].join('\n');
  }

  function _confidenceMeta(opts) {
    const parts = [`version=${opts.version || 'unknown'}`];
    if (opts.confidence)    parts.push(`confidence=${opts.confidence}`);
    if (opts.coverage != null) parts.push(`coverage=${opts.coverage}%`);
    if (opts.dropped  != null) parts.push(`dropped=${opts.dropped}`);
    if (opts.commit)        parts.push(`commit=${opts.commit}`);
    // Host-toolchain label (#609): byte-stability holds per toolchain version.
    if (opts.toolchain)     parts.push(`toolchain=${opts.toolchain}`);
    return `<!-- sigmap: ${parts.join(' ')} -->`;
  }

  /**
   * Return the output file path for this adapter.
   * @param {string} cwd - Project root
   * @returns {string}
   */
  function outputPath(cwd) {
    return path.join(cwd, 'CLAUDE.md');
  }

  /**
   * Write signatures into CLAUDE.md using the append-under-marker strategy.
   * Human content above the marker is never touched.
   * @param {string} context - Raw signature context string
   * @param {string} cwd - Project root
   * @param {object} [opts]
   */
  function write(context, cwd, opts = {}) {
    const filePath = outputPath(cwd);
    let existing = '';
    if (fs.existsSync(filePath)) {
      existing = fs.readFileSync(filePath, 'utf8');
    }
    const formatted = format(context, opts);
    // The marker is found by src/util/managed-section.js: a mention of it in prose
    // or a code block is never the marker, so human content is never discarded (#873).
    const placed = replaceManagedSection(existing, formatted);
    if (placed.warning) console.warn(`[sigmap] CLAUDE.md: ${placed.warning}`);
    let newContent = placed.content;

    // Inject ## Bash allowlist above the sig marker if not already present
    if (!newContent.includes(ALLOWLIST_MARKER)) {
      const sigMarkerPos = managedSectionLineStart(newContent);
      if (sigMarkerPos !== -1) {
        newContent = newContent.slice(0, sigMarkerPos) + ALLOWLIST_BLOCK + '\n' + newContent.slice(sigMarkerPos);
      } else {
        newContent = ALLOWLIST_BLOCK + '\n' + newContent;
      }
    }

    fs.writeFileSync(filePath, newContent, 'utf8');
  }

  module.exports = { name, format, outputPath, write };
  
};

// ── ./packages/adapters/codex ──
__factories["./packages/adapters/codex"] = function(module, exports) {
  
  /**
   * Codex adapter — writes OpenAI-style context to AGENTS.md.
   *
   * This adapter reuses the same prompt format as the OpenAI adapter,
   * but targets AGENTS.md so Codex-style agents can read repository guidance.
   *
   * Contract:
   *   format(context, opts?) → string
   *   outputPath(cwd) → string
   *   write(context, cwd, opts?) → void
   */

  const path = require('path');
  const fs = require('fs');
  const { replaceManagedSection } = __require('./src/util/managed-section');

  const name = 'codex';

  /**
   * Format context for AGENTS.md — clean markdown, no LLM preamble.
   * @param {string} context - Raw signature context string
   * @param {object} [opts]
   * @returns {string}
   */
  function format(context, opts = {}) {
    if (!context || typeof context !== 'string' || !context.trim()) return '';
    return `# Code signatures\n\n${context}`;
  }

  /**
   * Return the output file path for this adapter.
   * @param {string} cwd - Project root
   * @returns {string}
   */
  function outputPath(cwd) {
    return path.join(cwd, 'AGENTS.md');
  }

  /**
   * Write signatures into AGENTS.md using append-under-marker.
   * If marker exists, content above marker is preserved.
   * If legacy generated content exists without marker, replace it cleanly.
   * @param {string} context - Raw signature context string
   * @param {string} cwd - Project root
   * @param {object} [opts]
   */
  function write(context, cwd, opts = {}) {
    const filePath = outputPath(cwd);
    const placed = place(context, cwd, opts);
    if (placed.warning) console.warn(`[sigmap] ${path.relative(cwd, filePath)}: ${placed.warning}`);
    fs.writeFileSync(filePath, placed.content, 'utf8');
  }

  /**
   * What AGENTS.md would contain after `write`, without writing it: the human lines
   * above the managed section, kept, and the formatted block below them. Lets a caller
   * measure the finished file against a host's limit (#995).
   * @param {string} context - Raw signature context string
   * @param {string} cwd - Project root
   * @param {object} [opts]
   * @returns {{ content: string, warning?: string }}
   */
  function place(context, cwd, opts = {}) {
    const filePath = outputPath(cwd);
    let existing = '';
    if (fs.existsSync(filePath)) {
      existing = fs.readFileSync(filePath, 'utf8');
    }

    const formatted = format(context, opts);
    // A mention of the marker in prose or a code block is never the marker, and
    // only a file that is ENTIRELY generated is replaced whole (#873).
    return replaceManagedSection(existing, formatted, { legacy: true });
  }

  module.exports = { name, format, outputPath, write, place };
  
};

// ── ./packages/adapters/copilot ──
__factories["./packages/adapters/copilot"] = function(module, exports) {
  
  /**
   * Copilot adapter — writes to .github/copilot-instructions.md
   * GitHub Copilot reads this file automatically in every workspace.
   *
   * Contract:
   *   format(context, opts?) → string
   *   outputPath(cwd) → string
   */

  const path = require('path');
  const fs = require('fs');
  const { replaceManagedSection } = __require('./src/util/managed-section');

  const name = 'copilot';

  /**
   * Format context for GitHub Copilot instructions.
   * @param {string} context - Raw signature context string
   * @param {object} [opts]
   * @param {string} [opts.version] - SigMap version string
   * @returns {string}
   */
  function format(context, opts = {}) {
    if (!context || typeof context !== 'string') return '';
    const version   = opts.version   || 'unknown';
    const timestamp = new Date().toISOString();
    const meta = _confidenceMeta(opts);
    // Stable-prefix layout (#683): the stamp trails the content, not heads it.
    const stampAtTail = opts.cacheLayout !== 'legacy';
    const header = [
      `<!-- Generated by SigMap gen-context.js v${version} -->`,
      ...(stampAtTail ? [] : [`<!-- Updated: ${timestamp} -->`]),
      meta,
      `<!-- Do not edit below — regenerate with: node gen-context.js -->`,
      '',
      '# Code signatures',
      '',
    ].join('\n');
    return header + context + (stampAtTail ? `\n<!-- Updated: ${timestamp} -->` : '');
  }

  function _confidenceMeta(opts) {
    const parts = [`version=${opts.version || 'unknown'}`];
    if (opts.confidence)    parts.push(`confidence=${opts.confidence}`);
    if (opts.coverage != null) parts.push(`coverage=${opts.coverage}%`);
    if (opts.dropped  != null) parts.push(`dropped=${opts.dropped}`);
    if (opts.commit)        parts.push(`commit=${opts.commit}`);
    // Host-toolchain label (#609): byte-stability holds per toolchain version.
    if (opts.toolchain)     parts.push(`toolchain=${opts.toolchain}`);
    return `<!-- sigmap: ${parts.join(' ')} -->`;
  }

  /**
   * Return the output file path for this adapter.
   * @param {string} cwd - Project root
   * @returns {string}
   */
  function outputPath(cwd) {
    return path.join(cwd, '.github', 'copilot-instructions.md');
  }

  /**
   * Write signatures into copilot-instructions.md using append-under-marker.
   * If marker exists, content above marker is preserved.
   * If legacy generated content exists without marker, replace it cleanly.
   * @param {string} context - Raw signature context string
   * @param {string} cwd - Project root
   * @param {object} [opts]
   */
  function write(context, cwd, opts = {}) {
    const filePath = outputPath(cwd);
    let existing = '';
    if (fs.existsSync(filePath)) {
      existing = fs.readFileSync(filePath, 'utf8');
    }

    const formatted = format(context, opts);
    // A mention of the marker in prose or a code block is never the marker, and
    // only a file that is ENTIRELY generated is replaced whole (#873).
    const placed = replaceManagedSection(existing, formatted, { legacy: true });
    if (placed.warning) console.warn(`[sigmap] ${path.relative(cwd, filePath)}: ${placed.warning}`);
    const newContent = placed.content;

    fs.mkdirSync(path.dirname(filePath), { recursive: true });
    fs.writeFileSync(filePath, newContent, 'utf8');
  }

  module.exports = { name, format, outputPath, write };
  
};

// ── ./packages/adapters/cursor ──
__factories["./packages/adapters/cursor"] = function(module, exports) {
  
  /**
   * Cursor adapter — writes to .cursorrules
   * Cursor reads .cursorrules automatically in every workspace.
   *
   * Contract:
   *   format(context, opts?) → string
   *   outputPath(cwd) → string
   */

  const path = require('path');

  const name = 'cursor';

  /**
   * Format context for Cursor rules file.
   * @param {string} context - Raw signature context string
   * @param {object} [opts]
   * @param {string} [opts.version] - SigMap version string
   * @returns {string}
   */
  function format(context, opts = {}) {
    if (!context || typeof context !== 'string') return '';
    const version   = opts.version || 'unknown';
    const timestamp = new Date().toISOString();
    const meta      = _confidenceMeta(opts);
    // Stable-prefix layout (#683): the stamp trails the content, not heads it.
    const stampAtTail = opts.cacheLayout !== 'legacy';
    const header = [
      `# Code signatures — generated by SigMap v${version}`,
      ...(stampAtTail ? [] : [`# Updated: ${timestamp}`]),
      `# ${meta}`,
      `# Regenerate: node gen-context.js`,
      '',
    ].join('\n');
    return header + context + (stampAtTail ? `\n# Updated: ${timestamp}` : '');
  }

  function _confidenceMeta(opts) {
    const parts = [`version=${opts.version || 'unknown'}`];
    if (opts.confidence)    parts.push(`confidence=${opts.confidence}`);
    if (opts.coverage != null) parts.push(`coverage=${opts.coverage}%`);
    if (opts.dropped  != null) parts.push(`dropped=${opts.dropped}`);
    if (opts.commit)        parts.push(`commit=${opts.commit}`);
    return `sigmap: ${parts.join(' ')}`;
  }

  /**
   * Return the output file path for this adapter.
   * @param {string} cwd - Project root
   * @returns {string}
   */
  function outputPath(cwd) {
    return path.join(cwd, '.cursorrules');
  }

  module.exports = { name, format, outputPath };
  
};

// ── ./packages/adapters/gemini ──
__factories["./packages/adapters/gemini"] = function(module, exports) {
  
  /**
   * Gemini adapter — formats context as a Gemini system instruction.
   * Use the output as the `system_instruction` field in a Gemini API request.
   *
   * Example usage:
   *   const { format } = require('sigmap/adapters/gemini');
   *   const instruction = format(context);
   *   // Pass to: genAI.getGenerativeModel({ model: 'gemini-pro', systemInstruction: instruction })
   *
   * Contract:
   *   format(context, opts?) → string
   *   outputPath(cwd) → string
   */

  const path = require('path');
  const fs = require('fs');
  const { replaceManagedSection } = __require('./src/util/managed-section');

  const name = 'gemini';

  /**
   * Format context as a Gemini system instruction.
   * @param {string} context - Raw signature context string
   * @param {object} [opts]
   * @param {string} [opts.version] - SigMap version string
   * @param {string} [opts.projectName] - Optional project name
   * @returns {string}
   */
  function format(context, opts = {}) {
    if (!context || typeof context !== 'string') return '';
    const version = opts.version || 'unknown';
    const timestamp = new Date().toISOString();
    const projectLine = opts.projectName
      ? `Project: ${opts.projectName}\n`
      : '';

    const meta = _confidenceMeta(opts);
    // Stable-prefix layout (#683): the date trails the content, not heads it.
    const stampAtTail = opts.cacheLayout !== 'legacy';
    return [
      `You are a coding assistant with complete knowledge of this codebase.`,
      stampAtTail
        ? `The following code signatures were extracted by SigMap v${version}.`
        : `The following code signatures were extracted by SigMap v${version} on ${timestamp}.`,
      `<!-- ${meta} -->`,
      projectLine,
      `These signatures represent every public function, class, and type in the project.`,
      `Refer to them when answering questions about code structure, APIs, and implementation.`,
      `## Code Signatures`,
      ``,
      context,
      ...(stampAtTail ? [`<!-- Updated: ${timestamp} -->`] : []),
    ].join('\n');
  }

  /**
   * Return the output file path for this adapter.
   * @param {string} cwd - Project root
   * @returns {string}
   */
  function outputPath(cwd) {
    return path.join(cwd, '.github', 'gemini-context.md');
  }

  /**
   * Write signatures into gemini-context.md using append-under-marker.
   * If marker exists, content above marker is preserved.
   * If legacy generated content exists without marker, replace it cleanly.
   * @param {string} context - Raw signature context string
   * @param {string} cwd - Project root
   * @param {object} [opts]
   */
  function write(context, cwd, opts = {}) {
    const filePath = outputPath(cwd);
    let existing = '';
    if (fs.existsSync(filePath)) {
      existing = fs.readFileSync(filePath, 'utf8');
    }

    const formatted = format(context, opts);
    // A mention of the marker in prose or a code block is never the marker, and
    // only a file that is ENTIRELY generated is replaced whole (#873).
    const placed = replaceManagedSection(existing, formatted, { legacy: true });
    if (placed.warning) console.warn(`[sigmap] ${path.relative(cwd, filePath)}: ${placed.warning}`);
    const newContent = placed.content;

    fs.mkdirSync(path.dirname(filePath), { recursive: true });
    fs.writeFileSync(filePath, newContent, 'utf8');
  }

  function _confidenceMeta(opts) {
    const parts = [`version=${opts.version || 'unknown'}`];
    if (opts.confidence)    parts.push(`confidence=${opts.confidence}`);
    if (opts.coverage != null) parts.push(`coverage=${opts.coverage}%`);
    if (opts.dropped  != null) parts.push(`dropped=${opts.dropped}`);
    if (opts.commit)        parts.push(`commit=${opts.commit}`);
    return `sigmap: ${parts.join(' ')}`;
  }

  module.exports = { name, format, outputPath, write };
  
};

// ── ./packages/adapters/index ──
__factories["./packages/adapters/index"] = function(module, exports) {
  
  /**
   * packages/adapters/index.js
   * Central registry for all SigMap output adapters.
   *
   * Usage:
   *   const { getAdapter, listAdapters, adapt } = require('sigmap/adapters');
   *   const output = adapt(context, 'copilot', { version: '3.0.0' });
   */

  const path = require('path');

  // Third-party adapters: 'willow' writes atoms to a Willow MCP knowledge store
  // instead of a flat file (see willow.js for configuration).
  const ADAPTER_NAMES = ['copilot', 'claude', 'cursor', 'windsurf', 'openai', 'gemini', 'codex', 'willow'];

  // Lazy-load adapters so unused ones don't pay any require() cost
  const _cache = {};

  /**
   * Load and return an adapter module by name.
   * @param {string} name - Adapter name (copilot|claude|cursor|windsurf|openai|gemini|codex|willow)
   * @returns {{ name: string, format: Function, outputPath: Function }|null}
   */
  function getAdapter(name) {
    if (!name || typeof name !== 'string') return null;
    const key = name.toLowerCase();
    if (!ADAPTER_NAMES.includes(key)) return null;
    if (!_cache[key]) {
      try {
        _cache[key] = require(path.join(__dirname, key + '.js'));
      } catch (_) {
        return null;
      }
    }
    return _cache[key];
  }

  /**
   * List all available adapter names.
   * @returns {string[]}
   */
  function listAdapters() {
    return ADAPTER_NAMES.slice();
  }

  /**
   * Format context using the named adapter.
   * @param {string} context - Raw signature context string
   * @param {string} adapterName - Adapter name
   * @param {object} [opts] - Options passed to adapter.format()
   * @returns {string} Formatted output string (empty string if adapter not found or context empty)
   */
  function adapt(context, adapterName, opts = {}) {
    if (!context || typeof context !== 'string') return '';
    const adapter = getAdapter(adapterName);
    if (!adapter || typeof adapter.format !== 'function') return '';
    try {
      return adapter.format(context, opts);
    } catch (_) {
      return '';
    }
  }

  /**
   * Map old `outputs` config values to new `adapters` names.
   * Provides backward compatibility for existing configurations.
   * @param {string[]} outputs - Legacy outputs array
   * @returns {string[]} Equivalent adapters array
   */
  function outputsToAdapters(outputs) {
    if (!Array.isArray(outputs)) return ['copilot'];
    return outputs.map((o) => {
      // All current output names already match adapter names
      if (ADAPTER_NAMES.includes(o)) return o;
      return o; // pass through unknowns — getAdapter() will handle gracefully
    });
  }

  module.exports = { getAdapter, listAdapters, adapt, outputsToAdapters };
  
};

// ── ./packages/adapters/llm-full ──
__factories["./packages/adapters/llm-full"] = function(module, exports) {
  
  const path = require('path');
  const fs   = require('fs');
  module.exports = { name: 'llm-full', format, outputPath, write };

  function outputPath(cwd) { return path.join(cwd, 'llm-full.txt'); }

  function format(context, opts) {
    opts = opts || {};
    // Stable-prefix layout (#683): the stamp trails the entries, not heads them.
    const stampAtTail = opts.cacheLayout !== 'legacy';
    const stamp = `Generated: ${new Date().toISOString()} | SigMap v${opts.version || ''}`;
    const lines = [
      `# ${context.projectName || 'Project'} — SigMap Context`,
      ...(stampAtTail ? [] : [stamp]),
      '',
    ];
    for (const entry of (context.fileEntries || [])) {
      const rel = path.relative(opts.cwd || '', entry.filePath);
      lines.push(`## ${rel}`, '```', ...(entry.sigs || []), '```', '');
    }
    if (stampAtTail) lines.push(stamp);
    return lines.join('\n');
  }

  function write(context, cwd, opts) {
    opts = opts || {};
    fs.writeFileSync(outputPath(cwd), format(context, { ...opts, cwd }));
  }
  
};

// ── ./packages/adapters/openai ──
__factories["./packages/adapters/openai"] = function(module, exports) {
  
  /**
   * OpenAI adapter — formats context as an OpenAI system message.
   * Use the output as the `content` field of a system role message.
   *
   * Example usage in code:
   *   const { format } = require('sigmap/adapters/openai');
   *   const systemPrompt = format(context);
   *   // Pass to: openai.chat.completions.create({ messages: [{ role: 'system', content: systemPrompt }] })
   *
   * Contract:
   *   format(context, opts?) → string
   *   outputPath(cwd) → string
   */

  const path = require('path');

  const name = 'openai';

  /**
   * Format context as an OpenAI system prompt.
   * @param {string} context - Raw signature context string
   * @param {object} [opts]
   * @param {string} [opts.version] - SigMap version string
   * @param {string} [opts.projectName] - Optional project name
   * @returns {string}
   */
  function format(context, opts = {}) {
    if (!context || typeof context !== 'string') return '';
    const version = opts.version || 'unknown';
    const timestamp = new Date().toISOString();
    const projectLine = opts.projectName
      ? `Project: ${opts.projectName}\n`
      : '';

    const meta = _confidenceMeta(opts);
    // Stable-prefix layout (#683): the date trails the content, not heads it.
    const stampAtTail = opts.cacheLayout !== 'legacy';
    return [
      `You are a coding assistant with full knowledge of this codebase.`,
      stampAtTail
        ? `Below are the code signatures extracted by SigMap v${version}.`
        : `Below are the code signatures extracted by SigMap v${version} on ${timestamp}.`,
      `<!-- ${meta} -->`,
      projectLine,
      `Use these signatures to answer questions about the code accurately.`,
      `When the user asks about a specific file or function, refer to the signatures below.`,
      `## Code Signatures`,
      ``,
      context,
      ...(stampAtTail ? [`<!-- Updated: ${timestamp} -->`] : []),
    ].join('\n');
  }

  /**
   * Return the output file path for this adapter.
   * Writes a .openai-context.md file that can be loaded at runtime.
   * @param {string} cwd - Project root
   * @returns {string}
   */
  function outputPath(cwd) {
    return path.join(cwd, '.github', 'openai-context.md');
  }

  function _confidenceMeta(opts) {
    const parts = [`version=${opts.version || 'unknown'}`];
    if (opts.confidence)    parts.push(`confidence=${opts.confidence}`);
    if (opts.coverage != null) parts.push(`coverage=${opts.coverage}%`);
    if (opts.dropped  != null) parts.push(`dropped=${opts.dropped}`);
    if (opts.commit)        parts.push(`commit=${opts.commit}`);
    return `sigmap: ${parts.join(' ')}`;
  }

  module.exports = { name, format, outputPath };
  
};

// ── ./packages/adapters/willow ──
__factories["./packages/adapters/willow"] = function(module, exports) {
  
  /**
   * Willow adapter — writes SigMap context to Willow MCP knowledge store.
   *
   * Instead of writing a flat .willow-context.md file, this adapter sends
   * signature atoms to a Willow MCP server (https://github.com/willow-memory/willow-mcp)
   * via HTTP JSON-RPC (`POST …/tools/call`). Each indexed file becomes one
   * `knowledge_ingest` atom. Requires an HTTP MCP listener (not Cursor stdio).
   *
   * Contract:
   *   format(context, opts?) → string   (markdown for display/debug)
   *   outputPath(cwd)        → string   (placeholder — no file written)
   *   write(context, cwd, opts?) → Promise<void> (POSTs to Willow MCP, must await)
   *
   * Configuration (env vars or opts):
   *   WILLOW_MCP_URL   — MCP server base URL (default: http://localhost:8000)
   *   WILLOW_AGENT     — agent namespace (default: sigmap)
   *   WILLOW_TIMEOUT   — fetch timeout in ms (default: 30000)
   *   WILLOW_MAX_ATOM_SIZE — max atom size in bytes (default: 100000)
   *   WILLOW_RETRIES   — max retry attempts for transient failures (default: 3)
   */

  const crypto = require('crypto');
  const name = 'willow';
  const DEFAULT_MCP_URL = 'http://localhost:8000';
  const DEFAULT_TIMEOUT_MS = 30000;
  const DEFAULT_MAX_ATOM_SIZE = 100000;
  const DEFAULT_RETRIES = 3;

  /**
   * Format SigMap context as markdown for display or debug.
   * @param {string} context - Raw SigMap context string
   * @param {object} [opts] - Unused; reserved for future options
   * @returns {string}
   */
  function format(context, opts = {}) {
    if (!context || typeof context !== 'string') return '';
    const ts = new Date().toISOString();
    return `<!-- SigMap Willow context — ${ts} -->\n\n${context}`;
  }

  /**
   * Return the placeholder output path (no file is written by this adapter).
   * @param {string} cwd - Working directory
   * @returns {string}
   */
  function outputPath(cwd) {
    return '.willow-context.md';
  }

  /**
   * Generate a cryptographically strong ID for an atom.
   * Uses SHA256 hash of the filepath to ensure uniqueness and prevent collisions.
   * @param {string} filepath - File path to hash
   * @returns {string} - sigmap-{32-char-hex}
   */
  function generateAtomId(filepath) {
    const hash = crypto
      .createHash('sha256')
      .update(filepath)
      .digest('hex');
    return `sigmap-${hash}`;
  }

  /**
   * Fetch with timeout support.
   * @param {string} url - URL to fetch
   * @param {object} opts - Fetch options
   * @param {number} timeoutMs - Timeout in milliseconds
   * @returns {Promise<Response>}
   */
  async function fetchWithTimeout(url, opts, timeoutMs) {
    const controller = new AbortController();
    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
    try {
      return await fetch(url, { ...opts, signal: controller.signal });
    } finally {
      clearTimeout(timeoutId);
    }
  }

  /**
   * POST an atom to Willow with exponential backoff retry.
   * @param {object} atom - Atom to ingest
   * @param {string} mcpUrl - MCP server URL
   * @param {number} timeoutMs - Fetch timeout
   * @param {number} maxRetries - Max retry attempts
   * @returns {Promise<boolean>} - True if succeeded, false if all retries exhausted
   */
  async function postAtomWithRetry(atom, mcpUrl, timeoutMs, maxRetries) {
    let lastErr;
    for (let attempt = 0; attempt < maxRetries; attempt++) {
      try {
        const resp = await fetchWithTimeout(
          `${mcpUrl}/tools/call`,
          {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({
              name: 'knowledge_ingest',
              arguments: {
                app_id: atom.agent,
                content: atom.content,
                domain: atom.domain,
                source: atom.id,
                tags: ['sigmap', 'code', atom.project].filter(Boolean),
              },
            }),
          },
          timeoutMs,
        );

        if (resp.ok) {
          return true;
        }

        if (resp.status >= 500) {
          lastErr = new Error(`HTTP ${resp.status}`);
          if (attempt < maxRetries - 1) {
            await new Promise((resolve) => setTimeout(resolve, 100 * Math.pow(2, attempt)));
            continue;
          }
        } else {
          process.stderr.write(`[willow-adapter] ${atom.id}: HTTP ${resp.status} (not retryable)\n`);
          return false;
        }
      } catch (err) {
        lastErr = err;
        if (attempt < maxRetries - 1) {
          await new Promise((resolve) => setTimeout(resolve, 100 * Math.pow(2, attempt)));
          continue;
        }
      }
    }

    process.stderr.write(
      `[willow-adapter] ${atom.id}: failed after ${maxRetries} attempts: ${lastErr?.message || 'unknown'}\n`,
    );
    return false;
  }

  /**
   * POST each file section from SigMap context to the Willow MCP knowledge store.
   * Each `## filepath` section becomes one searchable knowledge atom.
   * Failures are per-atom and logged to stderr; function never throws.
   * IMPORTANT: This is async — caller MUST await write() before process exit.
   *
   * @param {string} context - Raw SigMap context string
   * @param {string} cwd - Working directory (used as project label)
   * @param {object} [opts] - Optional overrides: { mcpUrl, agent, timeoutMs, maxAtomSize, maxRetries }
   * @returns {Promise<void>}
   */
  async function write(context, cwd, opts = {}) {
    if (!context) return;

    const mcpUrl = opts.mcpUrl || process.env.WILLOW_MCP_URL || DEFAULT_MCP_URL;
    const agent = opts.agent || process.env.WILLOW_AGENT || 'sigmap';
    const timeoutMs = opts.timeoutMs || parseInt(process.env.WILLOW_TIMEOUT, 10) || DEFAULT_TIMEOUT_MS;
    const maxAtomSize = opts.maxAtomSize || parseInt(process.env.WILLOW_MAX_ATOM_SIZE, 10) || DEFAULT_MAX_ATOM_SIZE;
    const maxRetries = opts.maxRetries || parseInt(process.env.WILLOW_RETRIES, 10) || DEFAULT_RETRIES;

    const sections = context.split(/\n(?=##\s)/);
    const atoms = sections
      .map((section) => {
        const titleMatch = section.match(/^##\s+(.+)/);
        if (!titleMatch) return null;

        const title = titleMatch[1].trim();
        const contentSize = section.length;

        if (contentSize > maxAtomSize) {
          process.stderr.write(`[willow-adapter] ${title}: oversized (${contentSize} > ${maxAtomSize} bytes)\n`);
          return null;
        }

        return {
          id: generateAtomId(title),
          title,
          summary: `${title} (${contentSize} bytes)`,
          content: section.trim(),
          domain: 'code',
          source_type: 'sigmap',
          agent,
          project: cwd ? require('path').basename(cwd) : 'unknown',
        };
      })
      .filter(Boolean);

    if (!atoms.length) return;

    await Promise.all(
      atoms.map((atom) => postAtomWithRetry(atom, mcpUrl, timeoutMs, maxRetries).catch((err) => {
        process.stderr.write(`[willow-adapter] ${atom.id}: unexpected error: ${err.message}\n`);
      })),
    );
  }

  module.exports = { name, format, outputPath, write };
  
};

// ── ./packages/adapters/windsurf ──
__factories["./packages/adapters/windsurf"] = function(module, exports) {
  
  /**
   * Windsurf adapter — writes to .windsurfrules
   * Windsurf reads .windsurfrules automatically in every workspace.
   *
   * Contract:
   *   format(context, opts?) → string
   *   outputPath(cwd) → string
   */

  const path = require('path');

  const name = 'windsurf';

  /**
   * Format context for Windsurf rules file.
   * @param {string} context - Raw signature context string
   * @param {object} [opts]
   * @param {string} [opts.version] - SigMap version string
   * @returns {string}
   */
  function format(context, opts = {}) {
    if (!context || typeof context !== 'string') return '';
    const version   = opts.version || 'unknown';
    const timestamp = new Date().toISOString();
    const meta      = _confidenceMeta(opts);
    // Stable-prefix layout (#683): the stamp trails the content, not heads it.
    const stampAtTail = opts.cacheLayout !== 'legacy';
    const header = [
      `# Code signatures — generated by SigMap v${version}`,
      ...(stampAtTail ? [] : [`# Updated: ${timestamp}`]),
      `# ${meta}`,
      `# Regenerate: node gen-context.js`,
      '',
    ].join('\n');
    return header + context + (stampAtTail ? `\n# Updated: ${timestamp}` : '');
  }

  function _confidenceMeta(opts) {
    const parts = [`version=${opts.version || 'unknown'}`];
    if (opts.confidence)    parts.push(`confidence=${opts.confidence}`);
    if (opts.coverage != null) parts.push(`coverage=${opts.coverage}%`);
    if (opts.dropped  != null) parts.push(`dropped=${opts.dropped}`);
    if (opts.commit)        parts.push(`commit=${opts.commit}`);
    return `sigmap: ${parts.join(' ')}`;
  }

  /**
   * Return the output file path for this adapter.
   * @param {string} cwd - Project root
   * @returns {string}
   */
  function outputPath(cwd) {
    return path.join(cwd, '.windsurfrules');
  }

  module.exports = { name, format, outputPath };
  
};

// ── ./src/analysis/coverage-score ──
__factories["./src/analysis/coverage-score"] = function(module, exports) {
  
  /**
   * SigMap coverage scorer — v5.5.0
   *
   * Measures what fraction of *code* files made it into the context output
   * after token-budget application. Non-code files (json, md, config) are
   * counted separately as `nonCodeSkipped` so the grade reflects real coverage.
   *
   *   - Health score = context freshness / reduction quality / budget compliance
   *   - Coverage score = how much of the codebase is represented in context
   *
   * Grade scale:  A ≥ 90%  |  B ≥ 75%  |  C ≥ 50%  |  D < 50%
   *
   * @param {string} cwd
   * @param {Array<{filePath:string}>} fileEntries - files that made it into output
   * @param {{srcDirs:string[], exclude:string[]}} config
   * @returns {{
   *   score: number,
   *   grade: 'A'|'B'|'C'|'D',
   *   total: number,
   *   included: number,
   *   dropped: number,
   *   nonCodeSkipped: number,
   *   confidence: 'HIGH'|'MEDIUM'|'LOW',
   *   perModule: Map<string, {total:number, included:number, pct:number}>,
   * }}
   */

  const dirListing = __require('./src/util/dir-listing');

  const CODE_EXTS = new Set([
    '.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx',
    '.py', '.rb', '.go', '.rs', '.java', '.kt',
    '.cs', '.cpp', '.c', '.h', '.hpp', '.m', '.mm',
    '.swift', '.dart', '.scala', '.php',
    '.vue', '.svelte', '.css', '.scss',
    '.sql', '.graphql', '.proto', '.tf',
    '.lua', '.r', '.jl', '.ex', '.exs',
    '.sh', '.bash', '.zsh', '.ps1', '.psm1', '.psd1',
  ]);

  /**
   * The one coverage ratio (#848).
   *
   * `validate` kept its own `Math.round((covered / total) * 100)`, which agreed
   * with this module on every populated repo and disagreed on an empty one: the
   * hand-rolled version read 0% where every other surface read 100%. An empty
   * in-scope set has nothing left uncovered, so 100 is the convention — and it is
   * now stated in exactly one place.
   *
   * @param {number} included
   * @param {number} total
   * @returns {number} whole percent
   */
  function coveragePct(included, total) {
    return total > 0 ? Math.round((included / total) * 100) : 100;
  }

  function coverageScore(cwd, fileEntries, config) {
    const fs   = require('fs');
    const path = require('path');

    const srcDirs = (config && Array.isArray(config.srcDirs) && config.srcDirs.length > 0)
      ? config.srcDirs
      : ['src', 'app', 'lib'];

    const excludeSet = new Set([
      'node_modules', '.git', 'dist', 'build', 'out', '__pycache__',
      '.next', 'coverage', 'target', 'vendor', '.context',
    ]);
    if (config && Array.isArray(config.exclude)) {
      for (const x of config.exclude) excludeSet.add(String(x));
    }

    const includedSet = new Set((fileEntries || []).map(f => f.filePath));

    // Walk srcDirs: separate code files from non-code files. srcDirs can overlap —
    // `--monorepo` hands every package ['src', 'lib', 'app', '.'], and `.` holds the
    // others — so a file is counted once, however many roots reach it (#918): one
    // file read "2 of 2 source files included".
    const allFiles  = [];
    const allSource = [];
    const walked = new Set();
    for (const relDir of srcDirs) {
      const absDir = path.resolve(cwd, relDir);
      if (!fs.existsSync(absDir)) continue;
      const found = [];
      _walk(absDir, excludeSet, found);
      for (const f of found) if (!walked.has(f)) { walked.add(f); allFiles.push(f); }
    }
    for (const f of allFiles) {
      if (CODE_EXTS.has(path.extname(f).toLowerCase())) allSource.push(f);
    }
    const nonCodeSkipped = allFiles.length - allSource.length;

    const total    = allSource.length;
    const included = allSource.filter(f => includedSet.has(f)).length;
    const dropped  = total - included;
    const pct      = coveragePct(included, total);

    const grade = pct >= 90 ? 'A' : pct >= 75 ? 'B' : pct >= 50 ? 'C' : 'D';
    const confidence = pct >= 90 ? 'HIGH' : pct >= 70 ? 'MEDIUM' : 'LOW';

    // Per-module breakdown (one entry per srcDir)
    const perModule = new Map();
    for (const relDir of srcDirs) {
      const absDir   = path.resolve(cwd, relDir);
      const modFiles = allSource.filter(f => f.startsWith(absDir + path.sep) || f === absDir);
      const modIncl  = modFiles.filter(f => includedSet.has(f)).length;
      const modPct   = coveragePct(modIncl, modFiles.length);
      perModule.set(relDir, { total: modFiles.length, included: modIncl, pct: modPct });
    }

    return { score: pct, grade, total, included, dropped, nonCodeSkipped, confidence, perModule };
  }

  /**
   * Source files that exist in the repo but fall OUTSIDE every configured
   * srcDir (#805).
   *
   * `coverageScore` walks srcDirs only, so its denominator cannot see a file the
   * detector never selected — which is how a flat Go layout reported a plausible
   * "indexed 67% (2/3 files)" while ten of thirteen source files were invisible.
   * The number was not wrong about its own population; nothing told the user the
   * population was wrong.
   *
   * Deliberately a SEPARATE primitive rather than a new denominator inside
   * `coverageScore`: the named populations (#762) are pinned, and the fix here is
   * to disclose what is missing, not to redefine coverage.
   *
   * @param {string} cwd
   * @param {{srcDirs:string[], exclude:string[], maxDepth?:number}} config
   * Counts IMPLEMENTATION files only — tests, docs, CI, mocks and the
   * conventional tooling directories are legitimately outside srcDirs and are
   * reported separately as `skipped`.
   *
   * @returns {{ total: number, byExt: Array<{ext: string, count: number}>,
   *             dirs: string[], skipped: number, inScope: number, share: number }}
   */
  function outsideSrcDirs(cwd, config) {
    const fs   = require('fs');
    const path = require('path');

    const srcDirs = (config && Array.isArray(config.srcDirs) && config.srcDirs.length > 0)
      ? config.srcDirs : ['src', 'app', 'lib'];

    // A srcDir of '.' covers the whole tree, so nothing can be outside it.
    if (srcDirs.some((d) => d === '.' || d === './')) return { total: 0, byExt: [], dirs: [], skipped: 0, inScope: 0, share: 0 };

    const excludeSet = new Set([
      'node_modules', '.git', 'dist', 'build', 'out', '__pycache__',
      '.next', 'coverage', 'target', 'vendor', '.context',
    ]);
    if (config && Array.isArray(config.exclude)) {
      for (const x of config.exclude) excludeSet.add(String(x));
    }

    const srcAbs = srcDirs.map((d) => path.resolve(cwd, d));
    const inSrc  = (f) => srcAbs.some((a) => f === a || f.startsWith(a + path.sep));

    const all = [];
    _walkOwned(cwd, excludeSet, all, 0);

    let inScope = 0;
    for (const a of srcAbs) {
      const found = [];
      try { if (fs.existsSync(a)) _walkOwned(a, excludeSet, found, 0); } catch (_) {}
      for (const f of found) if (CODE_EXTS.has(path.extname(f).toLowerCase())) inScope++;
    }

    // Only IMPLEMENTATION counts. Tests, docs, CI, mocks and the conventional
    // tooling directories are routinely and correctly outside srcDirs — counting
    // them turned this into a 297-file warning on SigMap's own repo, where the
    // real answer is the two root-level entrypoints. A check that cries wolf on a
    // correct configuration teaches the user to ignore it.
    let cls = null;
    try { cls = __require('./src/util/file-class'); } catch (_) {}
    const OUT_OF_SCOPE_DIRS = new Set([
      'test', 'tests', 'spec', 'specs', '__tests__', 'e2e',
      'docs', 'doc', 'documentation', 'examples', 'example', 'samples',
      'scripts', 'benchmarks', 'fixtures', 'mocks', '__mocks__',
      'testdata', 'demo', 'demos', 'tools', 'migrations',
    ]);

    const byExt = new Map();
    const dirs  = new Set();
    let total = 0;
    let skipped = 0;
    for (const f of all) {
      const ext = path.extname(f).toLowerCase();
      if (!CODE_EXTS.has(ext)) continue;
      if (inSrc(f)) continue;
      const rel = path.relative(cwd, f).split(path.sep).join('/');
      const topDir = rel.includes('/') ? rel.split('/')[0] : '.';
      if (OUT_OF_SCOPE_DIRS.has(topDir)) { skipped++; continue; }
      if (cls && (cls.isTestFile(rel) || cls.isDocsFile(rel) || cls.isCiFile(rel) || cls.isMockFile(rel))) {
        skipped++; continue;
      }
      total++;
      byExt.set(ext, (byExt.get(ext) || 0) + 1);
      dirs.add(topDir);
    }

    return {
      total,
      byExt: [...byExt.entries()]
        .map(([ext, count]) => ({ ext, count }))
        .sort((a, b) => b.count - a.count || a.ext.localeCompare(b.ext)),
      dirs: [...dirs].sort(),
      skipped,
      inScope,
      // Share of the implementation that srcDirs is missing. A handful of root
      // entrypoints outside srcDirs is normal; a majority of the codebase is the
      // #805 failure. Callers grade on this rather than on the raw count.
      share: inScope + total > 0 ? total / (inScope + total) : 0,
    };
  }

  /**
   * How much of the REPOSITORY the source roots cover: the one figure `generate`, `validate` and
   * `doctor` all print (#997).
   *
   * Each of them used to grade a population of its own, and every one of those denominators was
   * the detector's own scope. A run that indexed 10 of a repository's 309 files printed "100%"
   * (the 10 it had picked), and the run that indexed more read LOWER, because the grade divided by
   * what fits the context file. The denominator here is the repository: the code files under the
   * roots (tests inside them included) plus the implementation files outside them (tests, docs, CI,
   * mocks and the conventional tooling directories legitimately sit outside, and are not counted
   * against it; see `outsideSrcDirs`).
   *
   * @param {string} cwd
   * @param {{srcDirs:string[], exclude:string[]}} config
   * @returns {{ covered: number, outside: number, all: number, pct: number, dirs: string[], byDir: Array<{dir:string,count:number}> }}
   */
  function repositoryCoverage(cwd, config) {
    const fs = require('fs');
    const path = require('path');
    cwd = path.resolve(cwd); // the walks compare absolute paths: a relative cwd made every file look outside
    const srcDirs = (config && Array.isArray(config.srcDirs) && config.srcDirs.length > 0) ? config.srcDirs : [];
    // A root of '.' is the whole repository: everything is covered, whatever it is called.
    if (srcDirs.some((d) => d === '.' || d === './')) {
      const excludeSet = new Set(['node_modules', '.git', 'dist', 'build', 'out', '__pycache__', '.next', 'coverage', 'target', 'vendor', '.context']);
      if (config && Array.isArray(config.exclude)) for (const x of config.exclude) excludeSet.add(String(x));
      const all = [];
      _walkOwned(path.resolve(cwd), excludeSet, all, 0);
      const n = all.filter((f) => CODE_EXTS.has(path.extname(f).toLowerCase())).length;
      return { covered: n, outside: 0, all: n, pct: coveragePct(n, n), dirs: [], byDir: [] };
    }
    const out = outsideSrcDirs(cwd, config);
    const all = out.inScope + out.total;
    // The outside implementation files by top-level directory, most first: what the warning names.
    const byDir = new Map();
    if (out.total > 0) {
      const excludeSet = new Set(['node_modules', '.git', 'dist', 'build', 'out', '__pycache__', '.next', 'coverage', 'target', 'vendor', '.context']);
      if (config && Array.isArray(config.exclude)) for (const x of config.exclude) excludeSet.add(String(x));
      const files = [];
      _walkOwned(path.resolve(cwd), excludeSet, files, 0);
      const srcAbs = srcDirs.map((d) => path.resolve(cwd, d));
      let cls = null;
      try { cls = __require('./src/util/file-class'); } catch (_) { /* optional */ }
      const OUT = new Set(['test', 'tests', 'spec', 'specs', '__tests__', 'e2e', 'docs', 'doc', 'documentation', 'examples', 'example', 'samples', 'scripts', 'benchmarks', 'fixtures', 'mocks', '__mocks__', 'testdata', 'demo', 'demos', 'tools', 'migrations']);
      for (const file of files) {
        if (!CODE_EXTS.has(path.extname(file).toLowerCase())) continue;
        if (srcAbs.some((a) => file === a || file.startsWith(a + path.sep))) continue;
        const rel = path.relative(cwd, file).split(path.sep).join('/');
        const top = rel.includes('/') ? rel.split('/')[0] : '.';
        if (OUT.has(top)) continue;
        if (cls && (cls.isTestFile(rel) || cls.isDocsFile(rel) || cls.isCiFile(rel) || cls.isMockFile(rel))) continue;
        byDir.set(top, (byDir.get(top) || 0) + 1);
      }
    }
    const ranked = [...byDir.entries()].map(([dir, count]) => ({ dir, count })).sort((a, b) => b.count - a.count || a.dir.localeCompare(b.dir));
    return { covered: out.inScope, outside: out.total, all, pct: coveragePct(out.inScope, all), dirs: ranked.map((r) => r.dir), byDir: ranked };
  }

  /** The words every surface uses for the repository figure. */
  function formatRepositoryCoverage(rc) {
    const n = (x) => x.toLocaleString('en-US');
    return `${rc.pct}% of the repository's code (${n(rc.covered)} of ${n(rc.all)} files) is under the source roots`;
  }

  /**
   * Depth-bounded walk that stops at NESTED REPOSITORIES.
   *
   * A vendored or cloned repo is not this repo's source, and walking it is both
   * wrong and expensive: on SigMap's own tree `benchmarks/repos/` holds 43 cloned
   * repositories — 47,327 of the 53,013 files under cwd — so an unbounded walk
   * spent its entire time in directories whose files could never be the user's.
   * A `.git` entry is the marker, which also covers submodules and any vendored
   * checkout the exclude list does not happen to name.
   */
  const OWNED_WALK_MAX_DEPTH = 10;

  function _walkOwned(dir, excludeSet, out, depth) {
    const fs   = require('fs');
    const path = require('path');
    if (depth > OWNED_WALK_MAX_DEPTH) return;
    let entries;
    try { entries = dirListing.list(dir); } catch (_) { return; }
    if (depth > 0 && entries.some((e) => e.name === '.git')) return; // a repo of its own
    for (const e of entries) {
      if (excludeSet.has(e.name)) continue;
      const full = path.join(dir, e.name);
      if (e.isDirectory()) { _walkOwned(full, excludeSet, out, depth + 1); }
      else if (e.isFile())  { out.push(full); }
    }
  }

  function _walk(dir, excludeSet, out) {
    const fs   = require('fs');
    const path = require('path');
    let entries;
    try { entries = dirListing.list(dir); } catch (_) { return; }
    for (const e of entries) {
      if (excludeSet.has(e.name)) continue;
      const full = path.join(dir, e.name);
      if (e.isDirectory()) { _walk(full, excludeSet, out); }
      else if (e.isFile())  { out.push(full); }
    }
  }

  /**
   * Named populations (#762).
   *
   * Four surfaces printed a coverage percentage for one repo and no two agreed:
   * `validate` 98% (175/179), `doctor` 100%, `--health` 100% (170/170) and
   * `--report` 54% (91/170). They were not in conflict — they were measuring
   * DIFFERENT populations through the same primitive, and none of them said
   * which. `doctor` was the sharpest case: it fed `coverageScore` the retrieval
   * index and then printed "of source files in context", contradicting the very
   * run that built that context.
   *
   * Differing numbers are fine. Unlabelled ones are not. Every surface now names
   * its population, so a reader can tell at a glance that 54% and 100% are
   * answers to two different questions.
   */
  const POPULATIONS = {
    // Survived the token budget — what the agent actually sees.
    'in-context': { label: 'in-context', noun: 'scoped source files' },
    // Present in the retrieval index, including anything stored outside the
    // budgeted context file (sig-index, per-module splits, cold store).
    indexed:      { label: 'indexed',    noun: 'files' },
    // Readable on disk under srcDirs — an access check, not a coverage claim.
    readable:     { label: 'readable',   noun: 'files in srcDirs' },
  };

  /**
   * Render a coverage figure with its population, numerator and denominator.
   * `indexed 98% (175/179 files)` — never a bare percentage.
   */
  function formatCoverage(cov, population, opts = {}) {
    const pop = POPULATIONS[population];
    if (!pop) throw new Error(`unknown coverage population: ${population}`);
    const included = opts.included != null ? opts.included : cov.included;
    const total    = opts.total    != null ? opts.total    : cov.total;
    const grade    = opts.grade === false ? '' : ` grade ${cov.grade}`;
    return `${pop.label} ${cov.score}% (${included}/${total} ${pop.noun})${grade}`;
  }

  /**
   * The `indexed` population: how much of the in-scope file list the retrieval
   * index actually holds (#848).
   *
   * The naive form — `index.size / fileList.length` — is not a coverage ratio at
   * all. The persisted index deliberately holds more than the current config
   * scopes (declared entrypoints, test roots, CI definitions, files a srcDir
   * change dropped), so the quotient runs past 100%: `validate` reported 218%
   * before #770 replaced it with the INTERSECTION, and `--ci` was still gating
   * releases on 241% until this became a shared function instead of a formula
   * each surface kept its own copy of.
   *
   * @param {Set<string>|Iterable<string>} indexedRel - index keys, repo-relative
   * @param {Iterable<string>} inScopeRel - the in-scope file list, repo-relative
   * @returns {{score:number, included:number, total:number, grade:string}}
   */
  function indexedCoverage(indexedRel, inScopeRel) {
    const indexed = indexedRel instanceof Set ? indexedRel : new Set(indexedRel);
    let included = 0;
    let total = 0;
    for (const f of inScopeRel) { total++; if (indexed.has(f)) included++; }
    const score = coveragePct(included, total);
    return { score, included, total, grade: score >= 90 ? 'A' : score >= 75 ? 'B' : score >= 50 ? 'C' : 'D' };
  }

  /**
   * The files actually present in the generated context file — the `in-context`
   * population. Parsed from the `### <relpath>` section headings rather than the
   * retrieval index, because the index deliberately holds more than the budget
   * admitted, and conflating the two is what produced the contradiction above.
   */
  function inContextFiles(cwd) {
    const fs   = require('fs');
    const path = require('path');
    const candidates = [
      path.join(cwd, '.github', 'copilot-instructions.md'),
      path.join(cwd, 'CLAUDE.md'),
      path.join(cwd, 'AGENTS.md'),
      path.join(cwd, 'GEMINI.md'),
    ];
    const out = new Set();
    for (const file of candidates) {
      let content;
      try { content = fs.readFileSync(file, 'utf8'); } catch (_) { continue; }
      const section = __require('./src/util/managed-section').findManagedSection(content);
      if (section) content = content.slice(section.index);
      for (const m of content.matchAll(/^### (.+)$/gm)) {
        const rel = m[1].trim();
        if (!rel || rel.includes(' ')) continue;
        out.add(path.resolve(cwd, rel));
      }
      if (out.size) break; // first adapter output that carries sections wins
    }
    return [...out].map((filePath) => ({ filePath }));
  }

  module.exports = { coverageScore, coveragePct, indexedCoverage, formatCoverage, inContextFiles, outsideSrcDirs, repositoryCoverage, formatRepositoryCoverage, POPULATIONS, CODE_EXTS };
  
};

// ── ./src/analysis/diagnostics ──
__factories["./src/analysis/diagnostics"] = function(module, exports) {
  
  /**
   * Diagnostic utilities for understanding file inclusion/exclusion decisions.
   *
   * Provides detailed per-file diagnostics showing:
   * - Why files are included or excluded
   * - Ranking scores and signals
   * - Budget constraints and priorities
   */

  const path = require('path');

  function estimateTokens(text) {
    return Math.ceil(text.length / 4);
  }

  function formatFileDecision(entry, decision, reason, score = null) {
    const rel = path.relative(process.cwd(), entry.filePath);
    const tokens = estimateTokens(entry.sigs.join('\n'));
    let line = `${decision === 'included' ? '✓' : '✗'} ${rel}`;
    line += ` [${tokens} tokens]`;
    if (score !== null) line += ` [score: ${score.toFixed(2)}]`;
    if (reason) line += ` — ${reason}`;
    return line;
  }

  function computeFileMetrics(entry) {
    const loc = typeof entry.loc === 'number' ? entry.loc : (entry.content ? entry.content.split('\n').length : 1);
    const sigCount = entry.sigs ? entry.sigs.length : 0;
    const signalQuality = loc > 0 ? sigCount / loc : 0;
    const tokens = estimateTokens(entry.sigs.join('\n'));

    return {
      lineOfCode: loc,
      sigCount: sigCount,
      signalQuality: signalQuality.toFixed(3),
      tokens: tokens,
      relevance: (sigCount / Math.max(loc, 1)).toFixed(3),
    };
  }

  function explainInclusion(fileEntries, budgetLimit) {
    const lines = [];

    lines.push('## File Inclusion Diagnostics\n');
    lines.push(`Budget: ${budgetLimit} tokens`);
    lines.push(`Files: ${fileEntries.length} scanned\n`);

    let totalTokens = 0;
    const withMetrics = fileEntries.map((e) => {
      const metrics = computeFileMetrics(e);
      totalTokens += metrics.tokens;
      return { entry: e, metrics };
    });

    lines.push(`Total token requirement: ${totalTokens} tokens`);
    lines.push(`Budget headroom: ${budgetLimit * 0.9} tokens (90% of ${budgetLimit})\n`);

    if (totalTokens > budgetLimit * 0.9) {
      lines.push('⚠ Over budget — files will be dropped\n');
      lines.push('### Per-file metrics:');
      for (const { entry, metrics } of withMetrics) {
        const rel = path.relative(process.cwd(), entry.filePath);
        lines.push(`- ${rel}`);
        lines.push(`  - Size: ${metrics.tokens} tokens, ${metrics.lineOfCode} lines`);
        lines.push(`  - Sigs: ${metrics.sigCount}, quality: ${metrics.signalQuality}`);
      }
    } else {
      lines.push('✓ All files fit within budget\n');
    }

    return lines.join('\n');
  }

  function explainExclusion(dropped, reason) {
    return `Excluded ${dropped.length} files: ${reason}`;
  }

  module.exports = {
    formatFileDecision,
    computeFileMetrics,
    explainInclusion,
    explainExclusion,
    estimateTokens,
  };
  
};

// ── ./src/analysis/index-state ──
__factories["./src/analysis/index-state"] = function(module, exports) {
  
  /**
   * One definition of what the signature index holds, and of how old it is.
   *
   * WHY THIS EXISTS
   * ---------------
   * `generate` writes the index over an AUGMENTED population: the configured
   * `srcDirs` walk, widened by the declared package entrypoints, every test root
   * and every CI definition — all three deliberate, all three shipped so
   * `sigmap ask` can reach code that lives outside `srcDirs` by construction.
   *
   * `validate` and `doctor` measured that same index against the UN-widened
   * `srcDirs` list, so on this repo 266 perfectly good entries (256 under
   * `test/`, 10 under `.github/`) read as "stale index entries … re-run sigmap",
   * which fixed nothing because nothing was broken. Meanwhile `doctor` counted
   * the same 266 as indexed coverage and called the index fresh, and `status`
   * — reading only the usage log — said the index had never been built.
   *
   * Three private definitions of one population and one timestamp. This module
   * owns both, so the four surfaces can only agree. It classifies entries the
   * index already holds rather than re-walking the tree: the fix is a population
   * widening, not an index prune, and index size must not move because of it.
   *
   * Zero-dependency, bundle-safe (fs + path only).
   */

  const fs = require('fs');
  const path = require('path');

  /**
   * Directory roots whose contents `generate` indexes as tests. Imported by
   * `collectTestEntries` so the collector and the classifier cannot drift.
   */
  const TEST_ROOTS = ['test', 'tests', '__tests__', 'spec', 'e2e'];

  /**
   * The test-root directories of a repo, spelled as they are ON DISK.
   *
   * `TEST_ROOTS` is lowercase, and `path.join(cwd, 'tests')` resolves a SwiftPM
   * `Tests/` on a case-insensitive filesystem (macOS) but not on a case-sensitive
   * one (Linux): the same checkout was indexed under the lowercased key
   * `tests/...` on one and not at all on the other (#893 §5). Matching the
   * directory NAME case-insensitively and keeping the on-disk spelling gives
   * one population and one key everywhere.
   *
   * @param {string} cwd
   * @returns {string[]} root-level directory names, `TEST_ROOTS` order first
   */
  function testRootDirs(cwd) {
    let names;
    try { names = fs.readdirSync(cwd); } catch (_) { return []; }
    const out = [];
    for (const root of TEST_ROOTS) {
      for (const name of names.filter((n) => n.toLowerCase() === root).sort()) {
        let isDir = false;
        try { isDir = fs.statSync(path.join(cwd, name)).isDirectory(); } catch (_) { /* dangling link */ }
        if (isDir) out.push(name);
      }
    }
    return out;
  }

  /**
   * Directories holding CI / pipeline definitions. `.` covers the single-file
   * forms (.gitlab-ci.yml, Jenkinsfile, compose files, …). Imported by
   * `collectPipelineEntries` for the same reason as TEST_ROOTS.
   */
  const CI_DIRS = [
    '.', '.github/workflows', '.gitea/workflows', '.forgejo/workflows',
    '.circleci', '.woodpecker',
  ];

  /** The index artifact `generate` writes before the token budget is applied. */
  const INDEX_REL = '.context/sig-index.json';

  /** Generated context files, in the order the resolvers prefer them. */
  const ADAPTER_OUTPUTS = [
    ['.github', 'copilot-instructions.md'],
    ['CLAUDE.md'],
    ['AGENTS.md'],
    ['.cursorrules'],
    ['.windsurfrules'],
    ['.github', 'openai-context.md'],
    ['.github', 'gemini-context.md'],
    ['llm-full.txt'],
    ['llm.txt'],
  ];

  const EXCLUDE_DIRS = new Set([
    'node_modules', '.git', 'dist', 'build', 'out', '__pycache__',
    '.next', 'coverage', 'target', 'vendor', '.context',
  ]);

  function _norm(p) {
    return String(p || '').replace(/\\/g, '/').replace(/^\.\//, '');
  }

  /**
   * Source files a project declares as its own entrypoints in package.json
   * (`main` and every `bin` target), repo-relative.
   *
   * @param {string} cwd
   * @returns {Set<string>}
   */
  function declaredEntrypointPaths(cwd) {
    const out = new Set();
    try {
      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
      const refs = [];
      if (typeof pkg.main === 'string') refs.push(pkg.main);
      if (typeof pkg.bin === 'string') refs.push(pkg.bin);
      else if (pkg.bin && typeof pkg.bin === 'object') {
        refs.push(...Object.values(pkg.bin).filter((v) => typeof v === 'string'));
      }
      for (const ref of refs) {
        const rel = _norm(path.relative(cwd, path.resolve(cwd, ref)));
        if (rel && !rel.startsWith('..')) out.add(rel);
      }
    } catch (_) { /* no package.json → nothing declared */ }
    return out;
  }

  /**
   * Why a repo-relative path is in the index despite falling outside `srcDirs`,
   * or null when nothing justifies it.
   *
   * @param {string} rel - repo-relative, forward slashes
   * @param {{ entrypoints?: Set<string> }} [ctx]
   * @returns {'test'|'ci'|'entrypoint'|null}
   */
  function augmentedReason(rel, ctx = {}) {
    const r = _norm(rel);
    if (!r) return null;
    if (ctx.entrypoints && ctx.entrypoints.has(r)) return 'entrypoint';

    const first = r.split('/')[0];
    if (r.includes('/') && TEST_ROOTS.includes(first.toLowerCase())) return 'test';

    const dir = r.includes('/') ? r.slice(0, r.lastIndexOf('/')) : '.';
    if (CI_DIRS.includes(dir)) {
      // The extractor's own routing decides what counts as a pipeline file, so
      // this cannot drift from `langFor`. A root-level file only qualifies when
      // the extractor claims it — `.` would otherwise match the whole repo root.
      let platformFor = null;
      try { ({ platformFor } = __require('./src/extractors/pipeline')); } catch (_) {}
      if (platformFor && platformFor(r)) return 'ci';
    }
    return null;
  }

  /**
   * Split the entries an index holds into the four classes that have different
   * remedies.
   *
   * `inScope` and `augmented` are both legitimate — together they are the
   * population `generate` writes. `missing` and `outOfScope` are the two real
   * stale classes, separated because a deleted file is cleared by re-running
   * `sigmap` while a file that merely left `srcDirs` is a config question.
   *
   * @param {string} cwd
   * @param {Iterable<string>} indexedRel - repo-relative keys of the index
   * @param {{srcDirs?: string[]}} config
   * @returns {{ inScope: string[], augmented: string[], missing: string[],
   *             outOfScope: string[], stale: number, byReason: object }}
   */
  function classifyIndexEntries(cwd, indexedRel, config) {
    const srcDirs = (config && Array.isArray(config.srcDirs) && config.srcDirs.length)
      ? config.srcDirs.map((d) => _norm(d).replace(/\/+$/, ''))
      : ['src', 'app', 'lib'];
    const entrypoints = declaredEntrypointPaths(cwd);

    const inScope = [];
    const augmented = [];
    const missing = [];
    const outOfScope = [];
    const byReason = { test: 0, ci: 0, entrypoint: 0 };

    for (const raw of indexedRel || []) {
      const rel = _norm(raw);
      if (!rel) continue;
      let exists = true;
      try { exists = fs.statSync(path.join(cwd, rel)).isFile(); } catch (_) { exists = false; }
      if (!exists) { missing.push(rel); continue; }

      if (srcDirs.some((d) => rel === d || rel.startsWith(`${d}/`))) { inScope.push(rel); continue; }

      const reason = augmentedReason(rel, { entrypoints });
      if (reason) { augmented.push(rel); byReason[reason]++; continue; }

      outOfScope.push(rel);
    }

    return {
      inScope, augmented, missing, outOfScope,
      stale: missing.length + outOfScope.length,
      byReason,
    };
  }

  /**
   * Human summary of the augmented entries, e.g. "256 test, 10 CI".
   *
   * @param {{ byReason: object }} classification
   * @returns {string}
   */
  function formatAugmented(classification) {
    const by = (classification && classification.byReason) || {};
    const label = { test: 'test', ci: 'CI', entrypoint: 'entrypoint' };
    return Object.keys(label)
      .filter((k) => by[k] > 0)
      .map((k) => `${by[k]} ${label[k]}`)
      .join(', ');
  }

  /**
   * Remediation lines for whatever stale classes are actually present, each
   * naming a command or change that fixes THAT class. Empty when nothing is
   * stale — the previous single message advised re-running `sigmap` for entries
   * a re-run could never clear.
   *
   * @param {{ missing: string[], outOfScope: string[] }} classification
   * @returns {string[]}
   */
  function staleRemedies(classification) {
    const out = [];
    const missing = (classification && classification.missing) || [];
    const outOfScope = (classification && classification.outOfScope) || [];
    if (missing.length) {
      out.push(`${missing.length} indexed file(s) no longer exist (e.g. ${missing[0]}) — run: sigmap   (a full run prunes them)`);
    }
    if (outOfScope.length) {
      out.push(`${outOfScope.length} indexed file(s) are outside srcDirs with no test/CI/entrypoint role (e.g. ${outOfScope[0]}) — widen "srcDirs" in gen-context.config.json, or run: sigmap roots --fix`);
    }
    return out;
  }

  /** Newest mtime among the generated context files, or 0 when none exist. */
  function _contextMtime(cwd) {
    let newest = 0;
    for (const parts of ADAPTER_OUTPUTS) {
      try {
        const m = fs.statSync(path.join(cwd, ...parts)).mtimeMs;
        if (m > newest) newest = m;
      } catch (_) {}
    }
    return newest;
  }

  /**
   * When the index was last built, and from which evidence.
   *
   * Ordered by how much the source actually knows: the usage log records the run
   * itself but only exists under `--track`; the index artifact records its own
   * `generated` stamp, file count and version; the context file knows only its
   * mtime. `status` reported `never` whenever the first was absent, which is the
   * default — hence the disclosed fallback rather than a silent one.
   *
   * @param {string} cwd
   * @returns {{ ts: string|null, source: string|null, files: number|null,
   *             version: string|null }}
   */
  function indexFreshness(cwd) {
    // 1. Usage log — the run itself, when tracking is on.
    try {
      const { readLog } = __require('./src/tracking/logger');
      const log = readLog(cwd) || [];
      if (log.length) {
        const last = log[log.length - 1];
        if (last && last.ts) {
          return {
            ts: last.ts,
            source: 'usage log',
            files: last.fileCount != null ? last.fileCount : null,
            version: last.version || null,
          };
        }
      }
    } catch (_) {}

    // 2. The retrieval index — self-describing, written by every full run.
    try {
      const abs = path.join(cwd, INDEX_REL);
      const data = JSON.parse(fs.readFileSync(abs, 'utf8'));
      const ts = data && data.generated
        ? data.generated
        : new Date(fs.statSync(abs).mtimeMs).toISOString();
      return {
        ts,
        source: INDEX_REL,
        files: data && data.files ? Object.keys(data.files).length : null,
        version: (data && data.sigmapVersion) || null,
      };
    } catch (_) {}

    // 3. The generated context file — mtime only.
    const ctx = _contextMtime(cwd);
    if (ctx > 0) {
      return { ts: new Date(ctx).toISOString(), source: 'context file mtime', files: null, version: null };
    }

    return { ts: null, source: null, files: null, version: null };
  }

  /**
   * Count code files under `srcDirs` modified after `sinceMs`.
   *
   * Lifted out of `doctor` so `status` counts the same thing: the two reported
   * different freshness because they were reading different populations with
   * different timestamps, and sharing only the timestamp would have left half
   * the disagreement in place.
   *
   * @param {string} cwd
   * @param {{srcDirs?: string[], exclude?: string[]}} config
   * @param {number} sinceMs
   * @param {Map<string,{at:number}>} [covered] - live overlay entries; a file whose
   *        entry was stamped at or after its last write is already reflected in
   *        queries, so it does not count as changed (#926)
   * @returns {number}
   */
  function changedSince(cwd, config, sinceMs, covered) {
    const { CODE_EXTS } = __require('./src/analysis/coverage-score');
    const exclude = new Set(EXCLUDE_DIRS);
    if (config && Array.isArray(config.exclude)) for (const x of config.exclude) exclude.add(String(x));
    const srcDirs = (config && Array.isArray(config.srcDirs) && config.srcDirs.length)
      ? config.srcDirs : ['src', 'app', 'lib'];

    let changed = 0;
    let seen = 0;
    const walk = (dir, depth) => {
      if (depth > 8 || seen > 5000) return;
      let entries;
      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
      for (const e of entries) {
        if (exclude.has(e.name)) continue;
        const full = path.join(dir, e.name);
        if (e.isDirectory()) walk(full, depth + 1);
        else if (e.isFile() && CODE_EXTS.has(path.extname(e.name).toLowerCase())) {
          seen++;
          try {
            const m = fs.statSync(full).mtimeMs;
            if (m > sinceMs && !isCovered(covered, cwd, full, m)) changed++;
          } catch (_) {}
        }
      }
    };
    for (const d of srcDirs) {
      const abs = path.isAbsolute(d) ? d : path.join(cwd, d);
      if (fs.existsSync(abs)) walk(abs, 0);
    }
    return changed;
  }

  /**
   * Whether a live overlay entry already describes `fullPath` as of `mtimeMs`.
   * An entry is stamped before the file is read, so an edit that lands during the
   * read leaves the file's mtime ahead of the stamp and it stays uncovered.
   */
  function isCovered(covered, cwd, fullPath, mtimeMs) {
    if (!covered || covered.size === 0) return false;
    const rel = path.relative(cwd, fullPath).replace(/\\/g, '/');
    const e = covered.get(rel);
    // `at` comes from Date.now() (whole ms) and an mtime carries a fraction, so a
    // write in the same millisecond as the stamp must still count as covered.
    // An additive entry adds one symbol to a file it knows nothing else about, so
    // it says nothing about the rest of the file and cannot vouch for it.
    return !!e && !e.additive && e.at >= Math.floor(mtimeMs);
  }

  /**
   * The live half of index freshness: what the overlay holds beyond the last full
   * run, and what the watcher last measured. Everything derivable is derived here
   * at read time; only the watcher's own measurements come from `.context/live.json`.
   * A figure nobody measured is `null` — never `0`.
   *
   * @param {string} cwd
   * @returns {{ overlayDepth: number, overlay: Map, watcher: {running:boolean, pid:number|null}|null,
   *             lastLatencyMs: number|null, lastLatencyPath: string|null, lastPatchAt: string|null,
   *             lastRegenAt: string|null, lastRegenMs: number|null, patches: number|null,
   *             regens: number|null, settleMs: number|null, incremental: boolean|null,
   *             measured: boolean }}
   */
  function liveIndexState(cwd) {
    const overlay = __require('./src/cache/overlay');
    const { readIndexStamp } = __require('./src/retrieval/sig-index-store');
    const all = overlay.load(cwd);
    let baseMs = readIndexStamp(cwd);
    if (!Number.isFinite(baseMs)) baseMs = _contextMtime(cwd);
    const pending = overlay.pending(all, baseMs);

    const t = overlay.readLive(cwd);
    let watcher = null;
    if (t && Number.isFinite(t.pid)) {
      let running = false;
      try { process.kill(t.pid, 0); running = true; } catch (err) { running = err.code === 'EPERM'; }
      // A live pid is necessary, not sufficient: a crashed watcher's number can be
      // reused. A watcher that reports a heartbeat must have beaten recently (it
      // beats every 20 s); one that predates the heartbeat is judged by pid alone.
      if (running && t.heartbeatAt) {
        const age = Date.now() - Date.parse(t.heartbeatAt);
        if (Number.isFinite(age) && age > 90000) running = false;
      }
      watcher = { running, pid: running ? t.pid : null };
    }
    const num = (v) => (Number.isFinite(v) ? v : null);
    return {
      overlayDepth: pending.size,
      overlay: all,
      watcher,
      lastLatencyMs: t ? num(t.lastLatencyMs) : null,
      lastLatencyPath: t && typeof t.lastLatencyPath === 'string' ? t.lastLatencyPath : null,
      lastPatchAt: t && t.lastPatchAt ? t.lastPatchAt : null,
      lastRegenAt: t && t.lastRegenAt ? t.lastRegenAt : null,
      lastRegenMs: t ? num(t.lastRegenMs) : null,
      patches: t ? num(t.patches) : null,
      regens: t ? num(t.regens) : null,
      settleMs: t ? num(t.settleMs) : null,
      incremental: t && typeof t.incremental === 'boolean' ? t.incremental : null,
      measured: !!t && Number.isFinite(t.lastLatencyMs),
    };
  }

  module.exports = {
    TEST_ROOTS,
    testRootDirs,
    CI_DIRS,
    INDEX_REL,
    ADAPTER_OUTPUTS,
    declaredEntrypointPaths,
    augmentedReason,
    classifyIndexEntries,
    formatAugmented,
    staleRemedies,
    indexFreshness,
    changedSince,
    isCovered,
    liveIndexState,
  };
  
};

// ── ./src/analysis/test-coverage ──
__factories["./src/analysis/test-coverage"] = function(module, exports) {
  
  /**
   * Test coverage by evidence: which test files exercise a given source file.
   * Shared by `--analyze` (its tested / untested column) and `plan` (the tests
   * to re-run after a change), so the two commands cannot disagree (#862).
   *
   * "Not covered" means no test file targets or loads the source file. A module
   * exercised only through the CLI is not detected, so the absence is not proof
   * that nothing tests it.
   *
   * A source file is covered when a test file
   *   name      — targets its stem (`findRelatedTests`: `foo.test.js`,
   *               `test_foo.py`, `FooTest.java`), or
   *   reference — loads it: a `require` / `import` that resolves to it, or
   *               its path built with `path.join` / `path.resolve`
   *               (`path.join(ROOT, 'src/x/y')`, `path.join(ROOT, 'src', 'x', 'y.js')`).
   *               A path a test merely mentions — a fixture map key such as
   *               `'src/auth.js': '…'` — is not a load.
   *
   * Name evidence alone misses every test named after a feature rather than a
   * file — `judge.test.js` exercising `judge-engine.js` — which is most of an
   * integration suite. Reference evidence is path-shaped, so it sees JS/TS
   * `require` / `import` and joined paths; a Python or JVM import by package
   * name is left to the naming rule.
   *
   * Each command used to keep its own heuristic, and they disagreed. `--analyze`
   * looked for the basename as a substring of the entries directly under `test/`,
   * so `fix` matched the directory `fixtures` and nothing one level down was
   * seen. `plan` asked whether a function name appeared as a token in any test.
   * Neither could say which test it meant.
   */

  const fs = require('fs');
  const path = require('path');
  const { relatedTestsIndex } = __require('./src/evidence/pack');
  const { testRootDirs } = __require('./src/analysis/index-state');
  const { CODE_EXTS } = __require('./src/analysis/coverage-score');
  const { isTestFile, isMockFile } = __require('./src/util/file-class');

  // Scaffolding under a test root: inputs and expected outputs, not tests. Matched
  // as a prefix, so `fixtures-adversarial/` is recognised as well as `fixtures/`.
  const NOT_TESTS_RE = /^(node_modules|_{0,2}(fixtures?|testdata|snapshots?|expected)(_{0,2}|[-_.].*))$/i;
  const MAX_DEPTH = 8;
  const MAX_BYTES = 512 * 1024;

  // A path a test loads: the argument of require / import / from.
  const LOAD_RE = /\b(?:require|import)\s*\(\s*(['"`])([^'"`\n]+)\1|\b(?:from|import)\s+(['"`])([^'"`\n]+)\3/g;
  // A path it builds: `path.join(ROOT, 'src/x/y')` or `path.join(ROOT, 'src', 'x', 'y.js')`.
  const JOIN_CALL_RE = /\b(?:join|resolve)\(([^()]*)\)/g;
  const SEGMENT_ARG_RE = /^(['"`])([\w@./-]+)\1$/;

  const _posix = (p) => String(p).replace(/\\/g, '/');

  // Repo-relative, minus the code extension: the key both sides meet on.
  function _key(rel) {
    const ext = path.posix.extname(rel);
    return ext && CODE_EXTS.has(ext.toLowerCase()) ? rel.slice(0, -ext.length) : rel;
  }

  // What one test file loads or builds, exactly as its source spells it.
  function _pathsIn(src) {
    const out = [];
    let m;
    LOAD_RE.lastIndex = 0;
    while ((m = LOAD_RE.exec(src)) !== null) {
      const lit = m[2] || m[4];
      if (lit.includes('/')) out.push(lit);
    }
    JOIN_CALL_RE.lastIndex = 0;
    while ((m = JOIN_CALL_RE.exec(src)) !== null) {
      let run = [];
      const flush = () => {
        if (run.length > 1 || (run.length === 1 && run[0].includes('/'))) out.push(run.join('/'));
        run = [];
      };
      for (const arg of m[1].split(',')) {
        const lit = arg.trim().match(SEGMENT_ARG_RE);
        if (lit) run.push(lit[2]); else flush();
      }
      flush();
    }
    return out;
  }

  function _isTest(rel) {
    return CODE_EXTS.has(path.posix.extname(rel).toLowerCase()) && !isMockFile(rel);
  }

  function _walk(dir, rel, depth, exclude, out) {
    if (depth > MAX_DEPTH) return;
    let entries;
    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
    for (const e of entries) {
      if (e.name.startsWith('.') || NOT_TESTS_RE.test(e.name) || exclude.has(e.name)) continue;
      const childRel = `${rel}/${e.name}`;
      if (e.isDirectory()) _walk(path.join(dir, e.name), childRel, depth + 1, exclude, out);
      else if (e.isFile() && _isTest(childRel)) out.push(childRel);
    }
  }

  /**
   * Index the repo's test files once, then look up the tests of each source file.
   *
   * @param {string} cwd
   * @param {object} [opts]
   * @param {string[]} [opts.files]   - files already known (repo-relative or
   *        absolute); the test files among them are added, so tests that sit
   *        beside their source are seen without a second walk
   * @param {string[]} [opts.exclude] - directory names to skip
   * @returns {{ testFiles: string[], testsFor: (relPath: string) => string[] }}
   */
  function buildTestCoverageIndex(cwd, opts = {}) {
    const exclude = new Set(opts.exclude || []);
    const found = [];
    for (const root of testRootDirs(cwd)) _walk(path.join(cwd, root), root, 0, exclude, found);
    for (const f of opts.files || []) {
      const rel = _posix(path.isAbsolute(f) ? path.relative(cwd, f) : f);
      if (isTestFile(rel) && _isTest(rel) && !rel.split('/').some((seg) => NOT_TESTS_RE.test(seg))) found.push(rel);
    }
    const testFiles = [...new Set(found)].sort();

    const byName = relatedTestsIndex(testFiles);

    const byReference = new Map();
    const referencedBy = new Map();
    for (const test of testFiles) {
      let src;
      try {
        const abs = path.join(cwd, test);
        if (fs.statSync(abs).size > MAX_BYTES) continue;
        src = fs.readFileSync(abs, 'utf8');
      } catch (_) { continue; }
      const dir = path.posix.dirname(test);
      for (const lit of _pathsIn(src)) {
        const rel = path.posix.normalize(lit.startsWith('.') ? path.posix.join(dir, lit) : lit);
        if (rel.startsWith('..')) continue;                                // outside the repo
        const key = _key(rel);
        if (!byReference.has(key)) byReference.set(key, new Set());
        byReference.get(key).add(test);
        if (!referencedBy.has(test)) referencedBy.set(test, new Set());
        referencedBy.get(test).add(key);
      }
    }

    // Two source files can share a stem (`security/patterns.js`,
    // `extractors/patterns.js`), and the naming rule gives `patterns.test.js` to
    // both. When that test loads one of them and not the other, it is the test of
    // the one it loads.
    function loadsNamesake(test, key) {
      const base = path.posix.basename(key).toLowerCase();
      for (const k of referencedBy.get(test) || []) {
        if (k !== key && path.posix.basename(k).toLowerCase() === base) return true;
      }
      return false;
    }

    function testsFor(relPath) {
      const rel = _posix(relPath);
      if (isTestFile(rel)) return [];
      const key = _key(rel);
      const out = new Set(byName(rel).filter((t) => !loadsNamesake(t, key)));
      const keys = path.posix.basename(key) === 'index' ? [key, path.posix.dirname(key)] : [key];
      for (const k of keys) for (const t of byReference.get(k) || []) out.add(t);
      return [...out].sort();
    }

    return { testFiles, testsFor };
  }

  module.exports = { buildTestCoverageIndex };
  
};

// ── ./src/cache/entry ──
__factories["./src/cache/entry"] = function(module, exports) {
  
  /**
   * The index form of one file's signatures — the stages every writer shares (#926).
   *
   * A full `generate`, the watcher's per-file patch, the read-time `freshen` and the
   * MCP notify hooks all put a file's signatures into the index. They used to
   * disagree: the hooks and `freshen` stored the raw extraction, so an edit that
   * went through them replaced a redacted base entry with one carrying the secret,
   * and dropped the module-doc line. Now the stages live here, once:
   *
   *   extract → cap at the index limit → redact secrets → module-doc line / terse
   *
   * The CLI core's `detectAndExtract` stays the extractor for generate and the
   * watcher (it owns the opt-in exactness tiers and the generic fallback); the
   * stages after extraction are these.
   *
   * Zero-dependency, bundle-safe.
   */

  const fs = require('fs');
  const path = require('path');

  /**
   * Redact secrets from a file's signatures. Fails CLOSED: a scanner that cannot
   * run throws, and the caller records nothing rather than storing a raw entry.
   *
   * @param {string[]} sigs
   * @param {string} filePath
   * @param {{secretScan?: boolean}} config
   * @returns {{ sigs: string[], redacted: boolean }}
   */
  function redactSecrets(sigs, filePath, config) {
    if (!config || !config.secretScan) return { sigs, redacted: false };
    const { scan } = __require('./src/security/scanner');
    const result = scan(sigs, filePath);
    return { sigs: result.safe, redacted: !!result.redacted };
  }

  /**
   * The file as the retrieval index stores it: a leading module-doc line (the
   * file's stated purpose, which is the vocabulary a behavioural query uses) and,
   * with `terse`, the compact encoding. Index-only — the prompt artifact is
   * token-budgeted, the index is not.
   *
   * @param {string} filePath
   * @param {string} content
   * @param {string[]} sigs
   * @param {{terse?: boolean}} config
   * @param {string} [precomputedDoc] - the file's module-doc line when already known (the extraction cache
   *        holds it), so the file need not be read; '' means the file has none
   * @returns {string[]}
   */
  function indexSigsFor(filePath, content, sigs, config, precomputedDoc) {
    let out = sigs;
    try {
      // TRIED AND REJECTED: also indexing every per-symbol doc sentence
      // untruncated (src/retrieval/doc-text.js). 39% of extractor doc hints are
      // cut at 60 chars, so recovering them looked like free vocabulary. It is
      // not: train hit@5 fell 75.6% -> 73.3% at every docWeight from 0.2 to 1.0,
      // and the mined corpus never moved off 62.5%. The MODULE HEADER is the
      // high-signal prose — it states the file's purpose. Per-symbol sentences
      // describe internal helpers, so they broaden what each file matches
      // without making any file a better answer.
      const { moduleDocSig } = __require('./src/retrieval/module-doc');
      const doc = typeof precomputedDoc === 'string' ? precomputedDoc : moduleDocSig(content, filePath);
      // The header is prose lifted from the file, so it is scanned like a signature:
      // a key pasted into a header comment must not reach the index. A scanner that
      // cannot run throws into the catch below and the line is simply omitted.
      if (doc) out = [redactSecrets([doc], filePath, config).sigs[0], ...sigs];
    } catch (_) { /* enrichment is best-effort */ }
    if (config && config.terse) {
      try {
        const { encodeTerseSigs } = __require('./src/format/terse');
        out = encodeTerseSigs(sigs);
      } catch (_) { /* terse unavailable → index full signatures */ }
    }
    return out;
  }

  /**
   * The few settings the stages above read, from the project's own config file
   * over the shipped defaults. Reading the raw file (not the full loader) keeps
   * this cheap enough for a hook that runs on every agent write.
   *
   * @param {string} cwd
   * @returns {{ secretScan: boolean, terse: boolean, maxSigsPerFile: number, maxIndexSigsPerFile: number }}
   */
  function entryConfig(cwd) {
    const { DEFAULTS } = __require('./src/config/defaults');
    let raw = {};
    try {
      const parsed = JSON.parse(fs.readFileSync(path.join(cwd, 'gen-context.config.json'), 'utf8'));
      if (parsed && typeof parsed === 'object') raw = parsed;
    } catch (_) { /* no project config → shipped defaults */ }
    // A local `extends` supplies the base. A URL is not followed here: a hook that
    // runs on every agent write never goes to the network.
    if (typeof raw.extends === 'string' && !/^https?:\/\//.test(raw.extends)) {
      try { raw = Object.assign({}, __require('./src/config/loader').loadBaseConfig(raw.extends, cwd), raw); } catch (_) { /* unreadable base → own keys only */ }
    }
    const pick = (k) => (raw[k] !== undefined ? raw[k] : DEFAULTS[k]);
    return {
      secretScan: !!pick('secretScan'),
      terse: !!pick('terse'),
      maxSigsPerFile: Number.isFinite(pick('maxSigsPerFile')) ? pick('maxSigsPerFile') : 25,
      maxIndexSigsPerFile: Number.isFinite(pick('maxIndexSigsPerFile')) ? pick('maxIndexSigsPerFile') : 200,
    };
  }

  /**
   * What a full extraction is asked for, whatever the limits: the extractors stop at 200
   * signatures a file on their own, and this bounds the few that do not. It is above both
   * limits so that `capForIndex` is the one place a file is cut, and can say how much.
   */
  const EXTRACT_CEILING = 1000;

  /**
   * Matches the extractors' own disclosure line at the end of a file's list, `… +N more
   * <label>` (util/truncate.js). The labels a whole file can end with: `signatures` for most
   * extractors, `headings` (markdown), `keys` and `entries` (properties, toml). Others, like
   * `methods` or `members`, close a class block inside the list and are left where they are.
   */
  const TRUNCATION_NOTICE = /^… \+(\d+) more (?:signatures|headings|keys|entries)$/;

  /**
   * How many signatures a file may contribute to the retrieval INDEX, and so how many
   * the extraction must produce: the index limit, never below the context-file limit
   * (the context file is a view of what was extracted, so the index cannot hold less).
   *
   * @param {{maxSigsPerFile?: number, maxIndexSigsPerFile?: number}} config
   * @returns {number}
   */
  function indexLimit(config) {
    const ctx = Number.isFinite(config && config.maxSigsPerFile) ? config.maxSigsPerFile : 25;
    const idx = Number.isFinite(config && config.maxIndexSigsPerFile) ? config.maxIndexSigsPerFile : 200;
    return Math.max(ctx, idx);
  }

  /**
   * A file's signatures as the INDEX keeps them: at most `limit`, and without the
   * extractor's trailing `… +N more signatures` line. That line is a disclosure for a
   * reader of the prompt, not a signature: left in the index it would put the words
   * "more" and "signatures" into every truncated file's vocabulary and show up as a
   * line with no symbol to the tools that read the index.
   *
   * @param {string[]} sigs
   * @param {number} limit
   * @returns {{ sigs: string[], dropped: number }} `dropped` counts what the limit
   *          and the extractor's own ceiling left out
   */
  function capForIndex(sigs, limit) {
    let list = sigs;
    let dropped = 0;
    const last = list.length ? TRUNCATION_NOTICE.exec(list[list.length - 1]) : null;
    if (last) { dropped += Number(last[1]); list = list.slice(0, -1); }
    if (list.length > limit) { dropped += list.length - limit; list = list.slice(0, limit); }
    return { sigs: list, dropped };
  }

  /**
   * A file's signatures split the way the index file keeps them (#982): `view` is what the
   * ranker, `ask` and the tools that list a file have always read, the first `maxSigsPerFile`
   * of the extraction exactly as before; `more` is the rest, up to the index limit, kept for the
   * tools that look a symbol up (`verify`, `get_callee_signatures`). A file that fits the
   * context limit keeps its list untouched, notice line and all.
   *
   * @param {string[]} sigs the extraction, already secret-scanned
   * @param {{maxSigsPerFile?: number, maxIndexSigsPerFile?: number}} config
   * @returns {{ view: string[], more: string[], dropped: number }}
   */
  function splitForIndex(sigs, config) {
    // What the context file keeps, by the very expression the extraction cuts with, so an odd
    // setting (a negative number, a string) means the same here as there.
    const limit = config && config.maxSigsPerFile !== undefined ? config.maxSigsPerFile : 25;
    const ctx = sigs.slice(0, limit).length;
    if (ctx === sigs.length) return { view: sigs, more: [], dropped: 0 };
    const kept = capForIndex(sigs, indexLimit(config));
    return { view: kept.sigs.slice(0, ctx), more: kept.sigs.slice(ctx), dropped: kept.dropped };
  }

  /**
   * The signatures kept apart, in the same encoding as the ones read: with `terse` the compact
   * form, so a lookup tool does not meet two encodings in one file.
   *
   * @param {string[]} more
   * @param {{terse?: boolean}} config
   * @returns {string[]}
   */
  function moreForIndex(more, config) {
    if (!config || !config.terse || more.length === 0) return more;
    try { return __require('./src/format/terse').encodeTerseSigs(more); } catch (_) { return more; }
  }

  /**
   * A file's signatures as the index would hold them, for writers that live in
   * `src/` (freshen, the notify hooks) and so extract through the dispatch table.
   *
   * @param {string} filePath - absolute
   * @param {string} content
   * @param {string} cwd
   * @param {object} [config] - from entryConfig(cwd)
   * @returns {string[]} empty when the file yields no signatures
   */
  function entrySigs(filePath, content, cwd, config) {
    return entryParts(filePath, content, cwd, config).sigs;
  }

  /**
   * `entrySigs` with the signatures past what the ranker reads kept apart (#982): `sigs` is the
   * entry the index file's `files` holds, `more` its `more`. The whole extraction is
   * secret-scanned, so what is kept apart is scanned like the rest.
   *
   * @param {string} filePath - absolute
   * @param {string} content
   * @param {string} cwd
   * @param {object} [config] - from entryConfig(cwd)
   * @returns {{ sigs: string[], more: string[] }} both empty when the file yields no signatures
   */
  function entryParts(filePath, content, cwd, config) {
    const cfg = config || entryConfig(cwd);
    const { extractFile, langFor } = __require('./src/extractors/dispatch');
    let sigs = extractFile(filePath, content);
    // A full run's generic tier indexes files the dispatch table has no extractor
    // for (.zig, templates, ...). Without the same fallback an entry written here
    // would be empty for them, and "empty" must never mean "remove".
    if (sigs.length === 0 && !langFor(filePath)) {
      try { sigs = __require('./src/extractors/generic').extract(content, filePath) || []; } catch (_) { sigs = []; }
    }
    const split = splitForIndex(sigs, cfg);
    if (split.view.length === 0) return { sigs: [], more: [] };
    const safe = redactSecrets(split.view.concat(split.more), filePath, cfg).sigs;
    return {
      sigs: indexSigsFor(filePath, content, safe.slice(0, split.view.length), cfg),
      more: moreForIndex(safe.slice(split.view.length), cfg),
    };
  }

  module.exports = { redactSecrets, indexSigsFor, entryConfig, entrySigs, entryParts, indexLimit, capForIndex, splitForIndex, moreForIndex, EXTRACT_CEILING };
  
};

// ── ./src/cache/extract-cache ──
__factories["./src/cache/extract-cache"] = function(module, exports) {
  
  /**
   * Content-hash extraction cache (#971): a re-run costs the files that changed.
   *
   * `generate` used to re-extract every file on every run: a second run with nothing
   * changed cost as much as the first. This keeps, per file, what the run derives from
   * its content (the signatures the extractor returned, the imports, the line and token
   * counts, the TODO lines and the module-doc line), keyed by the SHA-1 of the content,
   * in `.context/extract-cache.json` (already self-ignoring). A hit hands back exactly
   * what a fresh derivation would have produced, so the output of a warm run is
   * byte-identical to a cold one.
   *
   * What makes an entry valid is everything the derivation depends on besides the file,
   * and the cache records it once, as a fingerprint: SigMap's version, the extractor
   * sources and the CLI core that routes to them, the extraction ceiling, whether
   * imports are mapped, and the Python interpreter the AST tier would use. A different
   * fingerprint discards the whole file, which is how an extractor change, a version
   * bump or a different python3 force the right re-extraction.
   *
   * To avoid even reading a file that has not changed, an entry also remembers the
   * file's size and mtime. They are trusted only when the file was last modified more
   * than two seconds before the entry was written (the rule git applies to a "racily
   * clean" index entry): a file edited within the same clock tick, at the same size,
   * is read and hashed instead.
   *
   * Opt-in extraction tiers whose answer depends on something outside the file (the
   * repo's own typescript package, a language server, a SCIP index) are not cached.
   *
   * Zero-dependency, bundle-safe (fs, path, crypto only).
   */

  const fs = require('fs');
  const path = require('path');
  const crypto = require('crypto');

  const SCHEMA = 2;
  const CACHE_REL = path.join('.context', 'extract-cache.json');
  /** A stat is believed only if the file is at least this much older than the entry (ms). */
  const RACY_MS = 2000;

  /** Hex SHA-1 of a string or Buffer. */
  function sha1(data) {
    return crypto.createHash('sha1').update(data).digest('hex');
  }

  /** The cache key of a file's content. */
  function contentHash(content) {
    return sha1(content);
  }

  /**
   * One hash for the files of `dir` that end in one of `extensions` (sorted by name; name
   * and bytes both in the hash), or '' when the directory is absent. Used for the
   * extractor sources.
   */
  function treeHash(dir, extensions) {
    let names;
    try { names = fs.readdirSync(dir).filter((n) => extensions.some((e) => n.endsWith(e))).sort(); } catch (_) { return ''; }
    const h = crypto.createHash('sha1');
    for (const n of names) {
      h.update(n);
      h.update('\0');
      try { h.update(fs.readFileSync(path.join(dir, n))); } catch (_) { /* unreadable: the name still counts */ }
      h.update('\0');
    }
    return h.digest('hex');
  }

  /**
   * The fingerprint of everything a derivation depends on besides the file.
   *
   * @param {object} parts - version, the extraction ceiling, depMap, secretScan, the Python tier id, and
   *        the two hashes the caller computes from the install (`sources`, `core`)
   * @returns {string}
   */
  function fingerprint(parts) {
    return sha1(JSON.stringify([SCHEMA, parts.version, parts.sources, parts.core, parts.readLimit, parts.depMap, parts.secretScan, parts.python]));
  }

  /** Whether an entry's remembered stat can stand in for reading the file. */
  function trusted(e, st) {
    return !!st && Number.isFinite(e.w) && e.z === st.size && e.m === st.mtimeMs && e.m <= e.w - RACY_MS;
  }

  /**
   * Open the cache for a repository. A file that is absent, corrupt, from another
   * schema or under another fingerprint is the same as an empty cache.
   *
   * An entry is `{ h, z, m, w, s, d, l, k, g, t }`: content hash; size, mtime and the time it
   * was written; signatures, imports, lines, tokens, module-doc line, and (once something asked for
   * them) TODO lines.
   *
   * @param {string} cwd
   * @param {string} fp - fingerprint()
   */
  function open(cwd, fp) {
    const file = path.join(cwd, CACHE_REL);
    let files = {};
    let toolchain = null;
    let memos = {};
    try {
      const data = JSON.parse(fs.readFileSync(file, 'utf8'));
      if (data && data.schema === SCHEMA && data.fingerprint === fp && data.files && typeof data.files === 'object') {
        files = data.files;
        toolchain = typeof data.toolchain === 'string' ? data.toolchain : null;
        if (data.memo && typeof data.memo === 'object') memos = data.memo;
      }
    } catch (_) { /* absent or unreadable: start empty */ }

    const loaded = Object.keys(files).length;
    const next = {};
    let changed = false;
    let toolchainChanged = false;
    const stats = { hits: 0, statHits: 0, misses: 0 };
    const originalToolchain = toolchain;
    const memoNext = {};
    let memoChanged = false;

    return {
      stats,
      loaded,
      get toolchain() { return toolchain; },
      setToolchain(label) {
        const v = typeof label === 'string' ? label : null;
        if (v !== toolchain) { toolchain = v; toolchainChanged = true; }
      },
      /** Whether the file is believed unchanged from its stat alone (no read needed). */
      fresh(rel, st) {
        const e = files[rel];
        return !!e && Array.isArray(e.s) && trusted(e, st);
      },
      /**
       * The entry for a file whose stat is trusted, without reading it; otherwise undefined.
       * An entry that holds signatures but not the fact a consumer reads (`need`, by default the
       * line count) is not served this way, so the file is read once and the entry completed.
       */
      peek(rel, st, need = 'l') {
        const e = files[rel];
        if (e && Array.isArray(e.s) && (e.s.length === 0 || e[need] !== undefined) && trusted(e, st)) {
          next[rel] = e; stats.hits++; stats.statHits++;
          return e;
        }
        return undefined;
      },
      /**
       * An answer a run derived from something other than a file's content (git history, for the
       * run's recent-changes section), kept under a name with the key it is valid for. Gives it
       * back only for that exact key.
       */
      memoGet(name, key) {
        const m = memos[name];
        if (m && m.k === key) { memoNext[name] = m; return m.v; }
        return undefined;
      },
      memoSet(name, key, value) {
        memoNext[name] = { k: key, v: value };
        memoChanged = true;
      },
      /** The entry this run holds for a file (one it has looked at), or undefined. */
      entryOf(rel) {
        return next[rel];
      },
      /** Add derived facts to an entry already held (marks the cache for writing). */
      update(entry, facts) {
        Object.assign(entry, facts);
        changed = true;
        return entry;
      },
      /** The entry for a file whose content hashes to `hash`; refreshes the remembered stat. */
      get(rel, hash, st) {
        const e = files[rel];
        if (e && e.h === hash && Array.isArray(e.s)) {
          stats.hits++;
          if (st && !trusted(e, st)) { e.z = st.size; e.m = st.mtimeMs; e.w = Date.now(); changed = true; }
          next[rel] = e;
          return e;
        }
        stats.misses++;
        return undefined;
      },
      set(rel, hash, facts, st) {
        const e = Object.assign({ h: hash, z: st ? st.size : null, m: st ? st.mtimeMs : null, w: Date.now() }, facts);
        next[rel] = e;
        changed = true;
        return e;
      },
      /**
       * Carry every loaded entry under `prefix` over untouched: for a run that does not visit
       * that part of the cache (the test entries are only collected when the index is written),
       * so that it is not mistaken for deleted files and dropped.
       */
      keep(prefix) {
        for (const rel of Object.keys(files)) {
          if (rel.startsWith(prefix) && !(rel in next)) next[rel] = files[rel];
        }
      },
      /**
       * Write the cache holding exactly the files this run saw (a deleted or renamed file
       * is dropped). Nothing is written when nothing changed. Failure to write is silent:
       * the cache is an accelerator, never a dependency.
       */
      save() {
        const pruned = Object.keys(files).some((rel) => !(rel in next)) || Object.keys(memos).some((n) => !(n in memoNext));
        if (!changed && !pruned && !memoChanged && !toolchainChanged && toolchain === originalToolchain) return false;
        try {
          const out = path.join(cwd, CACHE_REL);
          fs.mkdirSync(path.dirname(out), { recursive: true });
          try { __require('./src/util/context-dir').ensureSelfIgnore(cwd); } catch (_) { /* best-effort */ }
          const body = {};
          for (const rel of Object.keys(next).sort()) body[rel] = next[rel];
          const tmp = `${out}.${process.pid}.tmp`;
          fs.writeFileSync(tmp, JSON.stringify({ schema: SCHEMA, fingerprint: fp, toolchain, memo: memoNext, files: body }), 'utf8');
          fs.renameSync(tmp, out);
          return true;
        } catch (_) { return false; }
      },
    };
  }

  module.exports = { SCHEMA, CACHE_REL, RACY_MS, contentHash, treeHash, fingerprint, open, sha1 };
  
};

// ── ./src/cache/freshen ──
__factories["./src/cache/freshen"] = function(module, exports) {
  
  /**
   * Read-time self-heal (IMPL.md Layer 1, "safety net" tier).
   *
   * Keeps the live overlay (cache/overlay.js) in line with the current source tree
   * so the index reflects on-disk reality even when no write hook was called.
   * Re-extracts files modified since the index was built (bounded to actual
   * session edits, not the whole tree) and records them as overlay entries.
   * buildSigIndex applies the overlay over the base index and an entry REPLACES
   * the file's base entry, so the next read is fresh — including a renamed or
   * removed symbol, which the old additive cache merge could never show (#926).
   *
   * Throttled per cwd. Skips entirely when there is no generated index to heal
   * (a cold repo should run `generate` or use the notify hooks). Deleted files are
   * not swept here (that is a stat per indexed file on every read): the watcher
   * and `notify_file_deleted` record those as they happen.
   *
   * Zero-dependency, bundle-safe (fs + dispatch + overlay).
   */

  const fs = require('fs');
  const path = require('path');
  const overlay = __require('./src/cache/overlay');
  const { readIndexStamp } = __require('./src/retrieval/sig-index-store');
  const { entryConfig, entryParts } = __require('./src/cache/entry');
  const { langFor } = __require('./src/extractors/dispatch');
  const { loadIgnorePatterns, matchesIgnore } = __require('./src/util/ignore');
  const { resolveGraphDirs } = __require('./src/graph/src-dirs');

  const DEFAULT_SRC_DIRS = ['src', 'app', 'lib', 'packages', 'services', 'api'];
  const DEFAULT_EXCLUDE = [
    'node_modules', '.git', 'dist', 'build', 'out', '__pycache__',
    '.next', 'coverage', 'target', 'vendor', '.context',
  ];
  const CONTEXT_PATHS = [
    ['.github', 'copilot-instructions.md'],
    ['CLAUDE.md'], ['AGENTS.md'], ['.github', 'context-cold.md'],
  ];
  const THROTTLE_MS = 1500;
  // A file time this far ahead of the clock cannot be ordered against any entry's stamp. The slack
  // keeps whole-millisecond clocks and filesystem timestamp granularity from tripping the rule.
  const FUTURE_SLACK_MS = 1000;
  const _lastRun = new Map();

  function _readConfig(cwd) {
    try {
      const cfg = JSON.parse(fs.readFileSync(path.join(cwd, 'gen-context.config.json'), 'utf8'));
      return cfg && typeof cfg === 'object' ? cfg : {};
    } catch (_) { return {}; }
  }

  /** Newest mtime among existing generated context files, or 0 if none. */
  function _contextMtime(cwd) {
    let newest = 0;
    for (const parts of CONTEXT_PATHS) {
      try { newest = Math.max(newest, fs.statSync(path.join(cwd, ...parts)).mtimeMs); } catch (_) {}
    }
    return newest;
  }

  function _walk(dir, exclude, out, depth, maxDepth) {
    if (depth > maxDepth) return;
    let entries;
    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
    for (const e of entries) {
      if (exclude.has(e.name)) continue;
      const full = path.join(dir, e.name);
      if (e.isDirectory()) _walk(full, exclude, out, depth + 1, maxDepth);
      else if (e.isFile() && langFor(e.name)) out.push(full);
    }
  }

  /**
   * Re-extract source files changed since the last generate.
   * @param {string} cwd
   * @param {{force?:boolean, now?:number}} [opts]
   * @returns {number} overlay entries written
   */
  function freshen(cwd, opts = {}) {
    const now = opts.now != null ? opts.now : Date.now();
    if (!opts.force) {
      if (now - (_lastRun.get(cwd) || 0) < THROTTLE_MS) return 0;
    }
    _lastRun.set(cwd, now);

    try {
      // When the base index began: the retrieval index knows exactly (read from its
      // head, not parsed); a repo with only a context file falls back to that
      // file's mtime.
      const stamp = readIndexStamp(cwd);
      const base = Number.isFinite(stamp) ? stamp : _contextMtime(cwd);
      const entries = overlay.load(cwd);
      // Nothing to heal: no generated context AND no live overlay.
      if (base === 0 && entries.size === 0) return 0;

      const cfg = _readConfig(cwd);
      // A pin wins; without one, the roots detection chose (#934) — otherwise a
      // zero-config repo whose code sits in `django/` or `internal/` never has an
      // edit healed, and `ask` answers from the pre-edit index.
      const srcDirs = Array.isArray(cfg.srcDirs) && cfg.srcDirs.length
        ? cfg.srcDirs
        : resolveGraphDirs(cwd, DEFAULT_SRC_DIRS).srcDirs;
      const exclude = new Set([...DEFAULT_EXCLUDE, ...(Array.isArray(cfg.exclude) ? cfg.exclude : [])]);
      const maxDepth = Number.isFinite(cfg.maxDepth) ? cfg.maxDepth : 8;

      const walked = [];
      for (const d of srcDirs) {
        const abs = path.isAbsolute(d) ? d : path.join(cwd, d);
        if (fs.existsSync(abs)) _walk(abs, exclude, walked, 0, maxDepth);
      }
      // Roots may nest (`.` beside `src`); a file is healed once however often the
      // walk reached it.
      const files = [...new Set(walked)];

      // Candidates = files changed after the index began that the overlay has not
      // already described (an entry stamped at or after the change has). "Changed"
      // is the later of mtime and ctime: `mv`, `git mv` and `cp -p` keep a file's
      // mtime but move its ctime, and a moved file is new to the index.
      const stale = [];
      const ignore = loadIgnorePatterns(cwd); // the same filter a full run applies
      for (const f of files) {
        let changed;
        try { const st = fs.statSync(f); changed = Math.max(st.mtimeMs, st.ctimeMs); } catch (_) { continue; }
        if (changed <= base) continue;
        const key = overlay.relKey(cwd, f);
        if (!key || matchesIgnore(key, ignore)) continue;
        const have = entries.get(key);
        // An additive entry vouches only for the symbol it added, not the file.
        // A timestamp in the future (clock skew, a restored file) cannot be ordered
        // against any entry's stamp, so a whole-file entry that exists covers it —
        // otherwise it would be read again on every call. Whole-ms stamp vs a
        // fractional file time, hence the floor.
        if (have && !have.additive && (have.at >= Math.floor(changed) || changed > Date.now() + FUTURE_SLACK_MS)) continue;
        stale.push({ f, key });
      }
      if (stale.length === 0) return 0;

      const entryCfg = entryConfig(cwd);
      const fresh = [];
      // One python3 process for the stale Python files, not one each (#970).
      try { __require('./src/extractors/python').prefetch(stale.map((s) => s.f)); } catch (_) {}
      for (const { f, key } of stale) {
        try {
          const at = Date.now(); // before the read: an edit during it stays uncovered
          const { sigs, more } = entryParts(f, fs.readFileSync(f, 'utf8'), cwd, entryCfg);
          // An empty result is not recorded: this tier cannot tell a file with no
          // signatures from an extractor that failed, and a wrong removal is worse
          // than a stale entry the next full run replaces. A scanner that cannot
          // run throws and lands here too — nothing unredacted is ever stored.
          if (sigs.length > 0) fresh.push([key, more.length > 0 ? { at, sigs, more } : { at, sigs }]);
        } catch (_) {}
      }
      if (fresh.length > 0) overlay.update(cwd, (m) => { for (const [k, e] of fresh) overlay.put(m, k, e); });
      return fresh.length;
    } catch (_) {
      return 0;
    }
  }

  module.exports = { freshen };
  
};

// ── ./src/cache/overlay ──
__factories["./src/cache/overlay"] = function(module, exports) {
  
  /**
   * Live overlay (#926): what changed since the last full index, applied at read time.
   *
   * WHY THIS EXISTS
   * ---------------
   * The retrieval index (`.context/sig-index.json`) is rewritten only by a full
   * `generate`. Between two runs the code keeps changing, and three writers tried
   * to keep queries honest — the MCP notify hooks, the read-time `freshen`, and
   * (now) the watcher. They wrote into `.sigmap-cache.json`, which the reader then
   * MERGED with the index under "the entry with more signatures wins". So an edit
   * could only ever add: rename a function, drop one, or delete a file and the
   * stale entry won, because the old list was as long or longer. Reproduced on
   * v8.71.0: after `freshen()` a renamed symbol was still listed and its new name
   * was not.
   *
   * This store is the authoritative half of that arrangement. An entry says "as of
   * `at`, this file contributes exactly these signatures" (or: nothing, it is gone),
   * and it REPLACES the base entry for as long as it is newer than the base index.
   * Once a full run starts after `at`, the base has seen the change and the entry
   * is simply ignored — no invalidation protocol, no version stamp to disagree about.
   *
   * It is a separate file from `.sigmap-cache.json` on purpose: that cache is
   * version-stamped by SigMap's own VERSION when `generate` writes it and by the
   * PROJECT's package.json version when the hooks write it, so two writers busted
   * each other's entries. This store has no stamp to bust.
   *
   * Entry shapes (keys are repo-relative, forward slashes):
   *   { at, sigs: string[] }                 replace the file's signatures
   *   { at, deleted: true }                  the file contributes nothing now
   *   { at, sigs: string[], additive: true } add these to whatever the file has
   *
   * Zero-dependency, bundle-safe (fs + path only).
   */

  const fs = require('fs');
  const path = require('path');

  const DIR = '.context';
  const OVERLAY_FILE = 'overlay.json';
  const LIVE_FILE = 'live.json';
  const SCHEMA = 1;

  // An entry stamped further ahead than this is not a clock error SigMap can reason
  // about (an NTP step backwards, a VM resume, a hand-edited file): it would outlive
  // every full run and shadow the fresh base entry, so it is not trusted.
  const MAX_FUTURE_SKEW_MS = 5 * 60 * 1000;

  function overlayPath(cwd) { return path.join(cwd, DIR, OVERLAY_FILE); }
  function livePath(cwd) { return path.join(cwd, DIR, LIVE_FILE); }

  /** Repo-relative key with forward slashes, or null for a path outside `cwd`. */
  function relKey(cwd, p) {
    const rel = path.relative(cwd, path.resolve(cwd, p)).replace(/\\/g, '/');
    return !rel || rel.startsWith('..') ? null : rel;
  }

  /** Write-then-rename so a concurrent reader never sees half a file. */
  function writeAtomic(file, text) {
    fs.mkdirSync(path.dirname(file), { recursive: true });
    const tmp = `${file}.${process.pid}.tmp`;
    try {
      fs.writeFileSync(tmp, text, 'utf8');
      fs.renameSync(tmp, file);
    } catch (err) {
      try { fs.unlinkSync(tmp); } catch (_) {}
      throw err;
    }
  }

  function _valid(e) {
    return !!e && typeof e === 'object' && Number.isFinite(e.at)
      && (e.deleted === true || (Array.isArray(e.sigs) && e.sigs.every((s) => typeof s === 'string')))
      && (e.more === undefined || (Array.isArray(e.more) && e.more.every((s) => typeof s === 'string')));
  }

  /**
   * Every overlay entry, or an empty Map when the store is absent or unreadable.
   * @param {string} cwd
   * @returns {Map<string, {at:number, sigs?:string[], deleted?:boolean, additive?:boolean}>}
   */
  function load(cwd) {
    const out = new Map();
    try {
      const data = JSON.parse(fs.readFileSync(overlayPath(cwd), 'utf8'));
      if (!data || data.schema !== SCHEMA || !data.entries || typeof data.entries !== 'object') return out;
      const horizon = Date.now() + MAX_FUTURE_SKEW_MS;
      for (const [rel, e] of Object.entries(data.entries)) if (_valid(e) && e.at <= horizon) out.set(rel, e);
    } catch (_) { /* absent or corrupt → nothing is overlaid, the base index stands */ }
    return out;
  }

  function _save(cwd, entries) {
    writeAtomic(overlayPath(cwd), JSON.stringify({ schema: SCHEMA, entries: Object.fromEntries(entries) }));
  }

  /**
   * Read-modify-write the store in one step. The function receives the live Map.
   * A failure to write is swallowed: the overlay is an accelerator, never a
   * correctness dependency — the next full run supersedes whatever was lost.
   *
   * @param {string} cwd
   * @param {(entries: Map) => void} fn
   * @returns {boolean} whether the store was written
   */
  function update(cwd, fn) {
    try {
      const entries = load(cwd);
      fn(entries);
      _save(cwd, entries);
      return true;
    } catch (_) { return false; }
  }

  /**
   * Record one entry unless the store already holds a NEWER one for the file. Two
   * writers can race (the watcher, the MCP server's freshen); the later `at` is
   * the better description of the file, so a slow writer must not overwrite it.
   *
   * @returns {boolean} whether the entry was recorded
   */
  function put(entries, rel, entry) {
    const cur = entries.get(rel);
    if (cur && cur.at > entry.at) return false;
    entries.set(rel, entry);
    return true;
  }

  /**
   * Apply the overlay to an index, in place. Entries not newer than the base are
   * skipped — a full run has already seen them.
   *
   * @param {Map<string,string[]>} index
   * @param {Map} entries
   * @param {number|null} baseMs - when the base index began; null/0 → every entry is newer
   * @param {Map<string,string[]>} [more] the signatures past what the ranker reads (#982), kept
   *        in step: an entry that replaces a file's signatures carries its own, a deleted file
   *        loses them, an additive entry leaves them
   * @returns {number} entries applied
   */
  function apply(index, entries, baseMs, more) {
    // `at` is whole milliseconds and a base derived from a file mtime is fractional.
    const since = Number.isFinite(baseMs) ? Math.floor(baseMs) : 0;
    let applied = 0;
    for (const [rel, e] of entries) {
      if (e.at < since) continue;
      if (e.deleted) { if (more) more.delete(rel); if (index.delete(rel)) applied++; continue; }
      if (!e.sigs || e.sigs.length === 0) continue;
      if (e.additive) {
        const have = index.get(rel) || [];
        const merged = have.slice();
        for (const s of e.sigs) if (!merged.includes(s)) merged.push(s);
        index.set(rel, merged);
      } else {
        index.set(rel, e.sigs);
        if (more) { if (e.more && e.more.length > 0) more.set(rel, e.more); else more.delete(rel); }
      }
      applied++;
    }
    return applied;
  }

  /** Entries that are still newer than the base — the overlay's live depth. */
  function pending(entries, baseMs) {
    const since = Number.isFinite(baseMs) ? Math.floor(baseMs) : 0;
    const out = new Map();
    for (const [rel, e] of entries) if (e.at >= since) out.set(rel, e);
    return out;
  }

  /**
   * Drop entries a full run has superseded. Called after a full generate, with the
   * instant that run began.
   * @returns {number} entries removed
   */
  function prune(cwd, baseMs) {
    let removed = 0;
    // Nothing superseded → leave the store (and its mtime) alone, and never create it.
    let any = false;
    for (const e of load(cwd).values()) if (e.at < baseMs) { any = true; break; }
    if (!any) return 0;
    update(cwd, (entries) => {
      for (const [rel, e] of [...entries]) {
        if (e.at < baseMs) { entries.delete(rel); removed++; }
      }
    });
    return removed;
  }

  // ── Live telemetry (.context/live.json) ──────────────────────────────────────
  // Facts only the watcher can measure. Written by the watcher process alone;
  // everything derivable (overlay depth, staleness) is computed at read time so it
  // can never disagree with the overlay it describes.

  /** @returns {object|null} the recorded watcher telemetry, or null when none */
  function readLive(cwd) {
    try {
      const data = JSON.parse(fs.readFileSync(livePath(cwd), 'utf8'));
      return data && data.schema === SCHEMA ? data : null;
    } catch (_) { return null; }
  }

  /**
   * Merge `patch` into the telemetry and persist it (`opts.replace` starts from
   * nothing — a fresh watcher must not inherit a dead one's numbers). Never throws.
   */
  function writeLive(cwd, patch, opts = {}) {
    try {
      const cur = opts.replace ? {} : (readLive(cwd) || {});
      writeAtomic(livePath(cwd), JSON.stringify(Object.assign({}, cur, patch, { schema: SCHEMA })));
      return true;
    } catch (_) { return false; }
  }

  module.exports = {
    SCHEMA, overlayPath, livePath, relKey,
    load, update, put, apply, pending, prune,
    readLive, writeLive,
  };
  
};

// ── ./src/cache/sig-cache ──
__factories["./src/cache/sig-cache"] = function(module, exports) {
  
  /**
   * Incremental extraction cache (v6.1).
   *
   * Stores extracted signatures keyed by file path + mtime so only
   * modified files are re-extracted on subsequent runs.
   *
   * Cache file: .sigmap-cache.json in cwd (gitignored).
   * Format:
   *   { sigmapVersion: string, entries: { [absPath]: { mtime: number, sigs: string[] } } }
   */

  const fs   = require('fs');
  const path = require('path');

  const CACHE_FILE = '.sigmap-cache.json';

  function cachePath(cwd) {
    return path.join(cwd, CACHE_FILE);
  }

  /**
   * Load the cache from disk.
   * Returns a Map<absPath, { mtime: number, sigs: string[] }>.
   * Returns an empty Map if cache is absent, corrupt, or from a different version.
   *
   * @param {string} cwd
   * @param {string} currentVersion - sigmap VERSION constant
   * @returns {Map<string, { mtime: number, sigs: string[] }>}
   */
  function loadCache(cwd, currentVersion) {
    try {
      const raw = fs.readFileSync(cachePath(cwd), 'utf8');
      const data = JSON.parse(raw);
      // Bust cache on version change to avoid stale sig formats
      if (data.sigmapVersion !== currentVersion) return new Map();
      return new Map(Object.entries(data.entries || {}));
    } catch (_) {
      return new Map();
    }
  }

  /**
   * Persist the cache to disk.
   *
   * @param {string} cwd
   * @param {string} currentVersion
   * @param {Map<string, { mtime: number, sigs: string[] }>} cache
   */
  function saveCache(cwd, currentVersion, cache) {
    try {
      const data = {
        sigmapVersion: currentVersion,
        entries: Object.fromEntries(cache),
      };
      fs.writeFileSync(cachePath(cwd), JSON.stringify(data), 'utf8');
    } catch (_) {
      // Non-fatal: cache save failure just means a full re-extract next run
    }
  }

  /**
   * Given a list of absolute file paths, return only those whose mtime
   * differs from the cached value (or that are not cached at all).
   *
   * @param {string[]} files - absolute paths
   * @param {Map<string, { mtime: number, sigs: string[] }>} cache
   * @returns {{ changed: string[], unchanged: string[] }}
   */
  function getChangedFiles(files, cache) {
    const changed = [];
    const unchanged = [];
    for (const f of files) {
      try {
        const mtime = fs.statSync(f).mtimeMs;
        const cached = cache.get(f);
        if (!cached || cached.mtime !== mtime) {
          changed.push(f);
        } else {
          unchanged.push(f);
        }
      } catch (_) {
        changed.push(f); // file unreadable → treat as changed
      }
    }
    return { changed, unchanged };
  }

  /**
   * Update cache entries for a batch of files after fresh extraction.
   *
   * @param {Map<string, { mtime: number, sigs: string[] }>} cache
   * @param {{ file: string, sigs: string[] }[]} extracted - freshly extracted results
   */
  function updateCacheEntries(cache, extracted) {
    for (const { file, sigs } of extracted) {
      try {
        const mtime = fs.statSync(file).mtimeMs;
        cache.set(file, { mtime, sigs });
      } catch (_) {}
    }
  }

  /**
   * Drop cache entries whose file no longer exists on disk.
   *
   * `saveCache` writes the whole Map back, and `ranker.buildSigIndex` merges the
   * cache into the retrieval index, so a deleted file stayed in the index until a
   * version bump busted the cache — which is why `validate`'s "re-run sigmap to
   * refresh the index" was advice that could not work. Keyed on existence only,
   * never on the current scope, so a per-package monorepo run cannot evict
   * another package's entries.
   *
   * @param {Map<string, { mtime: number, sigs: string[] }>} cache
   * @returns {number} entries removed
   */
  function pruneMissing(cache) {
    let removed = 0;
    for (const absPath of [...cache.keys()]) {
      try {
        if (fs.statSync(absPath).isFile()) continue;
      } catch (_) { /* unreadable → treat as gone */ }
      cache.delete(absPath);
      removed++;
    }
    return removed;
  }

  module.exports = { loadCache, saveCache, getChangedFiles, updateCacheEntries, pruneMissing };
  
};

// ── ./src/cli/command-table ──
__factories["./src/cli/command-table"] = function(module, exports) {
  
  /**
   * The canonical CLI vocabulary (#848, closes #817).
   *
   * `--help` used to be a 113-line template literal in `gen-context.js`, kept by
   * hand alongside the `KNOWN_COMMANDS` set the dispatcher guards on — two copies
   * of one fact. The comment above that set already claimed "`sigmap --help`
   * renders from the same vocabulary"; it did not, and the copies drifted:
   * #661 found twelve shipped commands missing from `--help`, #775 found a flag
   * `--help` advertised that the command ignored, and the template itself carried
   * a misaligned `gain --since` line, a literal `%%` left over from a `printf`
   * escape that a template literal never needed, and an adapter list that had
   * fallen a release behind `packages/adapters/`.
   *
   * `USAGE` below is now the only source. `--help` renders from it, the
   * unknown-command guard derives its vocabulary from it, and the guards in
   * `test/integration/command-table.test.js` fail when it and the dispatch chain
   * disagree in either direction.
   *
   * Adding a command means adding a `USAGE` row — there is nowhere else to add it.
   */

  /** Column the description starts in, measured from the end of `${cmd}`. */
  const DESC_COL = 35;

  /**
   * Every `--help` usage line, in display order.
   *
   * `argv` is the invocation after the program name (empty for a bare run);
   * `desc` is the one-line description, in which `{cmd}` stands for the invocation
   * name. The leading bare word of `argv` is the
   * subcommand the line documents, and its `--flags` are the flags that
   * subcommand is advertised as accepting — both are read back out by the guards,
   * so the shape of these strings is a contract, not just presentation.
   */
  const USAGE = [
    { argv: '', desc: 'Generate context once and exit' },
    { argv: '--monorepo', desc: 'Generate per-package context (monorepo)' },
    { argv: '--each', desc: 'Run for every repo in the current directory' },
    { argv: '--routing', desc: 'Include model routing hints in output' },
    { argv: '--terse', desc: 'Compact signature encoding (deterministic; line anchors preserved)' },
    { argv: '--format cache', desc: 'Also write Anthropic prompt-cache JSON' },
    { argv: '--track', desc: 'Append run metrics to .context/usage.ndjson' },
    { argv: '--watch', desc: 'Generate + watch for file changes' },
    { argv: '--setup', desc: 'Generate + install git hook + watch' },
    { argv: '--generate', desc: 'Same as a bare run — the flag the installed post-commit hook passes' },
    { argv: 'daemon start|stop|status', desc: 'Run --watch as a detached background daemon (status exits 1 when not running)' },
    { argv: '--mcp', desc: 'Start MCP server on stdio' },
    { argv: '--report', desc: 'Token reduction stats to stdout (exits 1 if over budget)' },
    { argv: '--report --json', desc: 'Token report as JSON (for CI; exits 1 if over budget)' },
    { argv: '--report --history', desc: 'Print usage log summary from .context/usage.ndjson' },
    { argv: '--report --history --chart', desc: 'Include inline SVG charts + Unicode sparklines' },
    { argv: '--report --sessions', desc: 'Captured agent sessions: provenance-labelled figures, per-class totals, branch rollup, coverage (--json, --agent <name>, --limit <n>)' },
    { argv: '--dashboard [--out <path>]', desc: 'Write .context/dashboard.html (HTML health dashboard)' },
    { argv: '--suggest-tool "<task>"', desc: 'Recommend model tier for a task description' },
    { argv: '--suggest-tool "<task>" --json', desc: 'Machine-readable tier recommendation' },
    { argv: '--health', desc: 'Print composite health score' },
    { argv: '--health --json', desc: 'Machine-readable health score' },
    { argv: '--ci [--min-coverage N]', desc: 'CI exit gate — exits 1 when indexed coverage is below the threshold (default 80)' },
    { argv: '--ci --json', desc: 'Gate verdict as JSON {pass, coverage, threshold}' },
    { argv: 'gain', desc: 'Token-savings dashboard (totals + by-operation)' },
    { argv: 'gain --all', desc: 'Add daily / weekly / monthly trend tables' },
    { argv: 'gain --json', desc: 'Aggregate savings as JSON' },
    { argv: 'gain --since 7d', desc: 'Window filter (7d, 30d, 12h, or ISO date)' },
    { argv: 'gain --top <n> | --model <name>', desc: 'Limit rows / set $ pricing model' },
    { argv: 'gain --reset', desc: 'Clear the local savings log (.context/gain.ndjson)' },
    { argv: '... --no-track', desc: 'Disable gain savings capture for this run' },
    { argv: '--diff', desc: 'Changed files: working tree vs HEAD' },
    { argv: '--diff <base-ref>', desc: 'Changed files: working tree vs <base-ref> (incl. uncommitted)' },
    { argv: '--diff --staged', desc: 'Changed files: index vs HEAD (staged only)' },
    { argv: '--benchmark', desc: 'Run retrieval benchmark (benchmarks/tasks/retrieval.jsonl)' },
    { argv: '--adapter <name>', desc: 'Generate for a specific adapter only (v3.0+)' },
    { argv: '--adapter <name> --json', desc: 'Show adapter output path as JSON' },
    { argv: '--benchmark --json', desc: 'Benchmark results as JSON' },
    { argv: '--eval', desc: 'Alias for --benchmark' },
    { argv: '--analyze', desc: 'Per-file breakdown: sigs, tokens, extractor, coverage' },
    { argv: '--analyze --json', desc: 'Breakdown as JSON' },
    { argv: '--analyze --slow', desc: 'Re-time each extractor; flag files >50ms' },
    { argv: '--diagnose-extractors', desc: 'Run all 21 extractors vs fixtures; show pass/fail + diff' },
    { argv: '--query "<text>"', desc: 'Rank files by relevance to a query' },
    { argv: '--query "<text>" --json', desc: 'Ranked results as JSON' },
    { argv: '--query "<text>" --top <n>', desc: 'Limit results to top N files (default 10)' },
    { argv: '--query "<text>" --explain', desc: 'Per-file score signals, token coverage and near misses' },
    { argv: 'ask "<query>"', desc: 'Ranked files for a question, signatures written to .context/query-context.md (--json, --top <n>, --mode)' },
    { argv: 'ask "<query>" --verbose', desc: 'Also print the full header: intent, coverage, risk, cost (default: files + one summary line)' },
    { argv: 'ask "<query>" --explain', desc: 'Diagnose a miss: which tokens matched, why files were demoted' },
    { argv: 'ask "<query>" --with-source', desc: 'Add top-symbol bodies + blast radius (budgeted; --source-budget <n>)' },
    { argv: 'plan "<goal>"', desc: 'Files to inspect, likely-to-change set, and impact radius (--json)' },
    { argv: 'explain <file>', desc: 'Why a file is in or out of the generated context (--json)' },
    { argv: 'run', desc: 'Alias for a bare generate ({cmd} run --report, etc.)' },
    { argv: 'learn --good <files...>', desc: 'Boost files in .context/weights.json' },
    { argv: 'learn --bad <files...>', desc: 'Penalize files in .context/weights.json' },
    { argv: 'learn --reset', desc: 'Delete learned file weights' },
    { argv: 'weights', desc: 'Show learned file multipliers' },
    { argv: 'weights --json', desc: 'Learned weights as JSON' },
    { argv: '--impact <file>', desc: 'Show every file impacted by changing <file>' },
    { argv: '--impact <file> --json', desc: 'Impact as JSON {changed, direct, transitive, tests, routes}' },
    { argv: '--impact <file> --depth <n>', desc: 'BFS depth limit (default 3, 0=unlimited)' },
    { argv: '--callers <symbol>', desc: 'Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS, Python, Java, Go, Rust)' },
    { argv: '--callees <symbol>', desc: 'Every repo function that <symbol> (transitively) calls' },
    { argv: '--callers <symbol> --json --depth <n>', desc: 'Call-graph edges as JSON (depth 0 = unlimited)' },
    { argv: 'verify <answer.md>', desc: 'Flagship grounding guard — flag fake files/tests/imports/symbols/npm-scripts in an AI answer (alias of verify-ai-output)' },
    { argv: 'verify <answer.md> --json', desc: 'Grounding report as JSON (exits 1 if issues)' },
    { argv: 'verify <answer.md> --report', desc: 'Write a standalone HTML report (red/amber/green)' },
    { argv: 'verify-ai-output <answer.md>', desc: 'Full command name for {cmd} verify' },
    { argv: 'validate', desc: 'Check config + index coverage; --query "<text>" also probes retrieval (--json)' },
    { argv: 'judge [--response <f>|-] [--context <f>]', desc: 'Score an AI answer\'s groundedness (stdin ok; --json, --threshold <n>, --learn)' },
    { argv: 'conventions', desc: 'Extract repo file-naming/export/test conventions (--conflicts, --inject, --report, --fix)' },
    { argv: 'scaffold "<name>"', desc: 'Propose a convention-matched file/dir scaffold (--ext, --threshold, --force, --json)' },
    { argv: 'verify-plan <plan.md|->', desc: 'Check a plan vs the live index — files/symbols exist, blast radius, scope (--json)' },
    { argv: 'verify-plan <plan.md> --creates <names>', desc: 'Mark names the plan INTRODUCES (comma-separated) — checked in reverse: they must not exist yet' },
    { argv: 'review-pr', desc: 'Audit a diff — scope drift, god-node edits, missing tests, security files (--staged, --base, --json, --markdown)' },
    { argv: 'review-pr --markdown', desc: 'PR Evidence Report — branded Markdown (signatures + blast radius + tests) to post as a PR comment' },
    { argv: 'create "<task>"', desc: 'Grounded-creation pipeline: scaffold → verify-plan → verify-ai-output → review-pr (--staged, --creates)' },
    { argv: 'wiki', desc: 'Deterministic architecture wiki from signatures + graph — no LLM (--json, --out <path>)' },
    { argv: 'squeeze <file|->', desc: 'Minimize a pasted stacktrace/CI-log/JSON blob (--json for stats)' },
    { argv: 'squeeze --response <file|->', desc: 'Minimize an agent/tool response (same engine; also exposed as the squeeze_output MCP tool)' },
    { argv: 'ask "<query>" --squeeze', desc: 'Auto-accept input minimization (no prompt; for scripts/CI)' },
    { argv: 'ask "<query>" --no-squeeze', desc: 'Disable input minimization entirely' },
    { argv: 'ask "<query>" --squeeze-threshold N', desc: 'Min reduction % to prompt (default 30)' },
    { argv: 'deps', desc: 'List declared dependencies across every manifest at the root' },
    { argv: 'deps --json', desc: 'Same, as machine-readable JSON' },
    { argv: 'sbom', desc: 'CycloneDX 1.5 SBOM on stdout (pipe to osv-scanner for CVEs)' },
    { argv: 'sbom --out sbom.json', desc: 'Write the SBOM to a file (--exact-only, --no-dev)' },
    { argv: 'evidence "<query>"', desc: 'Build a deterministic Evidence Pack (JSON) → .context/evidence-pack.json' },
    { argv: 'evidence "<query>" --markdown', desc: 'Emit the Markdown handoff rendering to stdout' },
    { argv: 'evidence "<query>" --top <n> --budget <n> --out <path>', desc: 'Tune ranked files / token budget / write rendered output' },
    { argv: 'memory', desc: 'List cross-session stores (.context/) — entries, size, age' },
    { argv: 'memory --clear <store>', desc: 'Clear one store: session|notes|weights|evidence|all (--json supported)' },
    { argv: 'budget', desc: 'Session spend ledger — estimated SigMap-emitted tokens, budget, context age (--json)' },
    { argv: 'budget --budget <tokens>', desc: 'One-off budget override (config: sessionBudgetTokens, contextTtlDays)' },
    { argv: 'redact [file]', desc: 'Mask secrets in a file or stdin (10-pattern bank); redacted text to stdout (--json)' },
    { argv: 'tune', desc: 'Recommend config from repo detection — srcDirs, monorepo, adapters, exclude, budget (--json)' },
    { argv: 'tune --apply', desc: 'Write the recommendations into gen-context.config.json (merges; your keys preserved)' },
    { argv: 'skills list', desc: 'List skill clients (Claude/Cursor/Windsurf/Copilot/AGENTS.md) and install state (--json)' },
    { argv: 'skills install', desc: 'Install the SigMap agent playbooks for detected clients (--client <name> | --all)' },
    { argv: 'lines <file> <start>-<end>', desc: 'Print an exact line range — CLI twin of get_lines (secrets redacted)' },
    { argv: 'lines <file> :<line> --context <n>', desc: 'Window around one signature anchor (default ±10)' },
    { argv: 'note "<text>"', desc: 'Append a note to the cross-session decision log' },
    { argv: 'note "<text>" --tag <name>', desc: 'Tag a note; todo | open | thread | next surface as open threads in the session summary' },
    { argv: 'note', desc: 'List recent notes (also: note --list <N>)' },
    { argv: 'history', desc: 'Recent usage-log entries with a sparkline (--last <n>, --json)' },
    { argv: 'compare', desc: 'SigMap vs baseline benchmark; outside the source checkout shows local history (--run, --json)' },
    { argv: 'share', desc: 'Shareable one-liner with your live numbers (copied to clipboard)' },
    { argv: 'bench --submit', desc: 'Format local benchmark history as a shareable community block' },
    { argv: 'roots', desc: 'Detect source roots for this repo (--fix, --json)' },
    { argv: 'sync', desc: 'Write every adapter output + llms.txt and print a compact diff' },
    { argv: 'suggest-profile', desc: 'Infer the task profile from staged changes (--short)' },
    { argv: 'session [list]', desc: 'Captured agent sessions — billed tokens per request category, each labelled with its provenance (--json, --agent <name>, --limit <n>)' },
    { argv: 'session show <id>', desc: 'One session in full; an unambiguous id prefix works (--json)' },
    { argv: 'session log --transcript <file> --id <session_id>', desc: 'Record a Claude Code transcript\'s usage, counted once per message (--agent, --end, --reason <why>)' },
    { argv: 'session log --from-json <file|->', desc: 'Record usage an agent reported itself: {id, agent, model, usage: {in, out, cacheRead, cacheWrite}}' },
    { argv: 'session log --ci', desc: 'Append an agent:"ci" record for this pipeline run (usage is unavailable — a CI job has no transcript)' },
    { argv: 'session summary', desc: 'Warm-start summary of the last session — deterministic, no LLM, ≤400 tokens (--json; `summary --last` is the same call)' },
    { argv: 'session compact', desc: 'Fold sessions older than session.retention.days into monthly rollups (--json)' },
    { argv: 'hooks install claude', desc: 'Wire session capture into Claude Code (--stop adds the per-turn hook; --shared writes the committed settings file)' },
    { argv: 'hooks status', desc: 'Which session hooks are wired, and whether the script they run still exists (--json)' },
    { argv: 'hooks remove claude', desc: 'Remove SigMap\'s session hooks from Claude Code settings' },
    { argv: 'status', desc: 'Show repo state — branch, dirty files, index freshness, notes' },
    { argv: 'doctor', desc: 'Diagnose config, index, freshness, coverage, MCP wiring — with fixes (--json; exits 1 on hard failure)' },
    { argv: 'mcp list', desc: 'List MCP clients and their config paths (--json)' },
    { argv: 'mcp install <client>', desc: 'Wire MCP for one client (claude|cursor|windsurf|vscode|zed|codex|gemini|opencode|mcp); --global for user-level' },
    { argv: '--init', desc: 'Write example config + .contextignore scaffold' },
    { argv: '--help', desc: 'Show this message' },
    { argv: '--version', desc: 'Show version' },
  ];

  /**
   * Subcommands that only dispatch when a required flag is present — without the
   * flag they are not commands at all, so the guard must not accept them bare.
   */
  const FLAG_GATED = [
    ['bench', '--submit'],
  ];

  /** The prose that follows the usage list. `{adapters}` is substituted at render time. */
  const SECTIONS = `
  Strategies (set via config "strategy" key):
    "full"        Single file, all signatures. Works everywhere. (default)
    "index"       Always-on file is a MAP only (~500 tokens): modules, entry
                  points, versions, how to retrieve. Every signature stays in
                  .context/sig-index.json and is pulled per question via
                  "sigmap ask". Largest always-on saving; needs the agent to
                  actually run "sigmap ask" (or the MCP tools).
    "per-module"  One .github/context-<module>.md per srcDir + thin overview.
                  ~70% fewer tokens per question. No MCP needed.
    "hot-cold"    Hot (recently changed) auto-injected; cold in .github/context-cold.md
                  ~90% fewer tokens. Best with MCP (Claude Code, Cursor).
                  Set "hotCommits": N to control how many commits count as hot (default 10).

  Adapters (v3.0+): {adapters}
    Set "adapters": ["copilot","openai","codex"] in config to write multiple adapter outputs.
    Old "outputs" config key is still accepted (maps to adapters automatically).

  Config: gen-context.config.json
  Ignore: .contextignore, .repomixignore
  Output: .github/copilot-instructions.md (default)
  `;

  /**
   * Flags that mean "a bare run". Nothing in the dispatch chain reads them — they
   * fall through to the default generate — so the guard that greps the CLI core for
   * every advertised flag exempts exactly these, and command-table.test.js proves
   * each one by running it against a bare run instead (#918).
   *
   * `--generate` is the flag the post-commit hook written by `--setup` passes. It
   * is the v0.1.0 spelling (packages/core/README.md promises it unchanged), so
   * every hook ever installed depends on it.
   */
  const BARE_RUN_ALIASES = ['--generate'];

  /** Bare-word tokens that lead a usage line but are not subcommands. */
  const NOT_A_COMMAND = new Set(['...']);

  /**
   * The subcommand a usage line documents, or null for the flag forms and the
   * bare generate.
   * @param {string} argv
   * @returns {string|null}
   */
  function commandOf(argv) {
    const first = String(argv).trim().split(/\s+/)[0] || '';
    if (!/^[a-z][a-z-]*$/.test(first) || NOT_A_COMMAND.has(first)) return null;
    return first;
  }

  /**
   * Long flags a usage line advertises. Short forms and `<n>`-style placeholders
   * are not flags and are skipped.
   * @param {string} argv
   * @returns {string[]}
   */
  function flagsOf(argv) {
    return String(argv).split(/\s+/).filter((t) => /^--[a-z][a-z-]*$/.test(t));
  }

  /**
   * Every bare-word subcommand the CLI accepts bare, sorted — the vocabulary the
   * unknown-command guard is built from (#655). Flag-gated names are excluded:
   * they dispatch only with their flag, and the guard handles them separately.
   * @returns {string[]}
   */
  function commandNames() {
    const gated = new Set(FLAG_GATED.map(([name]) => name));
    const out = new Set();
    for (const row of USAGE) {
      const c = commandOf(row.argv);
      if (c && !gated.has(c)) out.add(c);
    }
    return [...out].sort();
  }

  /**
   * The flag-gated subcommands as `Map` entries.
   * @returns {Array<[string, string]>}
   */
  function flagGated() {
    return FLAG_GATED.map(([name, flag]) => [name, flag]);
  }

  /**
   * The flags advertised for one subcommand, or the global flags when `name` is
   * null — the set the flag-acceptance guard checks against the dispatch chain.
   * @param {string|null} name
   * @returns {string[]}
   */
  function flagsFor(name) {
    const out = new Set();
    for (const row of USAGE) {
      if (commandOf(row.argv) !== (name || null)) continue;
      for (const f of flagsOf(row.argv)) out.add(f);
    }
    return [...out].sort();
  }

  /**
   * One rendered usage line: `  <cmd> <argv>` with the description aligned to
   * `DESC_COL`, falling back to a two-space gap when `argv` overflows the column.
   * @param {string} cmd
   * @param {{argv: string, desc: string}} row
   * @returns {string}
   */
  function usageLine(cmd, row) {
    const left = row.argv ? ` ${row.argv}` : '';
    const pad = left.length >= DESC_COL ? `${left}  ` : left.padEnd(DESC_COL);
    return `  ${cmd}${pad}${row.desc.split('{cmd}').join(cmd)}`;
  }

  /**
   * Render the whole `--help` body from the table.
   * @param {{cmd?: string, version?: string, adapters?: string[]}} [opts]
   * @returns {string}
   */
  function renderHelp(opts = {}) {
    const cmd = opts.cmd || 'node gen-context.js';
    const version = opts.version || '';
    const adapters = (opts.adapters && opts.adapters.length ? opts.adapters : ['copilot']).join(' | ');
    const header = cmd === 'node gen-context.js'
      ? `SigMap — gen-context.js v${version}`
      : `SigMap v${version}  (${cmd})`;
    return [
      '',
      header,
      'Zero-dependency AI context engine',
      '',
      'Usage:',
      ...USAGE.map((row) => usageLine(cmd, row)),
      SECTIONS.replace('{adapters}', adapters),
    ].join('\n');
  }

  module.exports = {
    USAGE, FLAG_GATED, SECTIONS, DESC_COL, BARE_RUN_ALIASES,
    commandOf, flagsOf, commandNames, flagGated, flagsFor, usageLine, renderHelp,
  };
  
};

// ── ./src/config/defaults ──
__factories["./src/config/defaults"] = function(module, exports) {
  
  /**
   * Default configuration values for SigMap.
   * All keys documented here. Override via gen-context.config.json.
   */
  const DEFAULTS = {
    // Primary output file (used when outputs includes 'copilot')
    output: '.github/copilot-instructions.md',

    // Output targets: 'copilot' | 'claude' | 'cursor' | 'windsurf'
    outputs: ['copilot'],

    // How much of the instruction file a host reads (#995). Codex loads at most
    // `project_doc_max_bytes` of an AGENTS.md (32 KiB by default, or what its own
    // config.toml sets); Claude Code asks for a short CLAUDE.md (about 200 lines). The
    // 'codex' and 'claude' outputs are trimmed to fit, lowest-priority files first.
    // `null` is the host's own limit (Codex's config.toml, else 32 KiB; Claude Code's 200
    // lines), so a run can say where its limit came from; a number is yours; 0 turns a cap off.
    codexMaxBytes: null,
    claudeMaxLines: null,

    // Adapter targets (v3.0+): replaces 'outputs'. Same names, adds 'openai' | 'gemini'.
    // Old 'outputs' config key is still accepted and silently maps to 'adapters'.
    adapters: null,

    // Directories to scan (relative to project root)
    srcDirs: [
      'src', 'app', 'lib', 'packages', 'services', 'api',
      // common monorepo / multi-project top-level names
      'server', 'client', 'web', 'frontend', 'backend',
      'desktop', 'mobile', 'shared', 'common', 'core',
      'workers', 'functions', 'lambda', 'cmd',
      // framework convention folders
      'pages', 'components', 'hooks', 'routes', 'controllers',
      'models', 'views', 'resources', 'config', 'db',
      'projects', 'apps', 'libs', 'instance', 'blueprints',
      // JVM project structures (Java, Kotlin, Scala)
      'src/main/java', 'src/main/kotlin', 'src/main/scala',
      'app/src/main/java', 'app/src/main/kotlin',
      'src/test/java', 'src/test/kotlin',
    ],

    // Directory/file names to exclude entirely
    exclude: [
      'node_modules', '.git', 'dist', 'build', 'out',
      '__pycache__', '.next', 'coverage', 'target', 'vendor',
      '.context',
      // CI/test artifacts
      'playwright-tmp', 'playwright-report', 'test-results',
      // build/monorepo caches
      '.turbo',
      // documentation build output
      'storybook-static', '.docusaurus',
    ],

    // Maximum directory depth to recurse
    maxDepth: 6,

    // Maximum signatures a file contributes to the GENERATED CONTEXT FILE (the prompt
    // artifact, which is token-budgeted). The retrieval index has its own limit below.
    maxSigsPerFile: 25,

    // Maximum signatures a file contributes to the RETRIEVAL INDEX (.context/sig-index.json),
    // which is not injected into a prompt. The index never holds fewer than `maxSigsPerFile`.
    // The first `maxSigsPerFile` of a file are what ranking and `ask` read, exactly as before;
    // the rest are kept apart for the tools that look a symbol up (`verify`, `search_signatures`,
    // `get_callee_signatures`). Most extractors stop at 200 a file (and 120 members a class) on
    // their own, so a higher value changes nothing for them.
    maxIndexSigsPerFile: 200,

    // Maximum tokens in final output before budget enforcement kicks in.
    // Used only when autoMaxTokens is false, or as a floor for auto-scaling.
    maxTokens: 6000,

    // Automatically scale the token budget based on repo size.
    // When true, SigMap targets `coverageTarget` fraction of source files and
    // raises the budget up to `modelContextLimit * maxTokensHeadroom`.
    // Set to false (or set maxTokens explicitly) to pin the budget.
    autoMaxTokens: true,

    // Fraction of source files to target for inclusion (0.0–1.0).
    // 0.80 = include at least 80% of source files in the context output.
    coverageTarget: 0.80,

    // Model context window size (tokens). Used to compute the hard cap:
    //   hardCap = modelContextLimit × maxTokensHeadroom
    // Default: GPT-4o / Claude Sonnet (128K). Set higher for Gemini 1M etc.
    modelContextLimit: 128000,

    // Model profile overrides (#688). SigMap ships a dated table of model names,
    // input prices, context windows and cache minimums (src/config/models.js);
    // every value here wins over the shipped one, per model and per field.
    //   asOf          — "YYYY-MM-DD" you verified your figures; printed with them
    //   roster        — the models you actually have; advice names only these,
    //                   and (when modelContextLimit is unset) the budget cap drops
    //                   to the smallest roster window if that is below the default
    //   prices        — { "<model>": USD per 1M input tokens }
    //   windows       — { "<model>": context window in tokens }
    //   cacheMin      — { "<model>": minimum cacheable prefix in tokens }
    //   charsPerToken — { "<model>": chars per token }; absent = chars/4, labelled est.
    //   tiers         — { "<model>": "fast" | "balanced" | "powerful" }
    models: {
      asOf: null,
      roster: [],
      prices: {},
      windows: {},
      cacheMin: {},
      charsPerToken: {},
      tiers: {},
    },

    // Fraction of the model context window reserved for SigMap output.
    // Leaves the remaining fraction for the conversation, system prompt, etc.
    // Default 0.20 = 20% of 128K = 25,600 token hard cap.
    maxTokensHeadroom: 0.20,

    // Scan signatures for secrets and redact matches
    secretScan: true,

    // Auto-detect monorepo packages and write per-package output files
    monorepo: false,

    // Sort recently git-committed files higher in output
    diffPriority: true,

    // Context strategy controls how the output is split and injected.
    // 'index'      -> always-on file is a MAP only (modules, entry points,
    //                 versions, retrieval commands); every signature stays in
    //                 .context/sig-index.json and is pulled per question by
    //                 `sigmap ask`. Largest always-on saving (#1a, v8.50).
    // 'full'       -> single context file (default)
    // 'per-module' -> one context-<module>.md per top-level srcDir + thin overview
    // 'hot-cold'   -> recent files in primary output, older files in context-cold.md
    strategy: 'full',

    // For hot-cold strategy: how many recent git commits count as "hot"
    hotCommits: 10,

    // Debounce delay (ms) between file-system events and the watcher acting on them
    watchDebounce: 300,

    // Watch mode patches only the files that changed straight into the live overlay
    // (queries see them at once) instead of regenerating everything per save.
    // false restores the previous behaviour: one full regeneration per change burst.
    watchIncremental: true,

    // Quiet time (ms) after the last patch before ONE full regeneration refreshes
    // the written context files (CLAUDE.md, copilot-instructions.md, ...). Queries
    // never wait for it. Raise it to trade static-file freshness for CPU.
    watchSettleMs: 5000,

    // Append model routing hints section to the context output
    // Routes files to fast/balanced/powerful model tiers based on complexity
    routing: false,

    // sigmap judge — verdict threshold and the --learn boost/penalize band (J2).
    // The band is measured, not hand-picked: answers built from ≥ ~80% context-
    // grounded vocabulary score above learnBoostAbove, answers under ~30%
    // grounded score below learnPenalizeBelow (guard-tested on a mixture corpus
    // drawn from the repo's own signatures — see judge.test.js). CLI flags
    // override; scores between the two bounds neither boost nor penalize.
    judge: {
      threshold: 0.25,          // verdict pass/fail floor (--threshold overrides)
      learnBoostAbove: 0.75,    // --learn boosts context files above this score
      learnPenalizeBelow: 0.40, // --learn penalizes context files below this score
    },

    // Output format: 'default' (markdown only) | 'cache' (also write Anthropic prompt-cache JSON)
    format: 'default',

    // Where volatile content sits in the generated context (#683).
    //   'stable-prefix' — stable body first, then an invisible marker, then the
    //                     blocks that change per commit (recent changes, routing
    //                     hints, wall-clock stamps), so a prefix cache keeps
    //                     hitting on the signature body across commits.
    //   'legacy'        — the previous order, recent changes ahead of the signatures.
    cacheLayout: 'stable-prefix',

    // TTL on the cached block `--format cache` writes: exactly '5m' or '1h'.
    // A 1h write costs 2x input (5m: 1.25x); reads are ~0.1x either way.
    cacheTtl: '5m',

    // Append run metrics to .context/usage.ndjson after each generate
    tracking: false,

    // Session spend ledger (`sigmap budget` / MCP get_budget). Estimates only —
    // counts tokens SigMap emitted (chars/4), not the host chat's total spend.
    // Number → warn threshold for estimated SigMap-emitted tokens per session.
    sessionBudgetTokens: null,

    // Number of days before generated context counts as stale in budget output.
    contextTtlDays: null,

    // Session capture + warm-start summary (#922, epic #682). Only active once
    // `sigmap hooks install claude` (or `sigmap session log`) has written
    // .context/sessions.ndjson — a repo that never captures a session is unaffected.
    session: {
      // Sessions older than `days` fold into monthly rollups (raw events dropped).
      retention: { days: 90, compact: 'monthly' },
      // What an `ask` query leaves in the session log: 'hashed' (12-hex digest),
      // 'full' (redacted text) or 'off' (nothing).
      logQueries: 'hashed',
      // Write the warm-start summary into CLAUDE.md / AGENTS.md / copilot / gemini
      // instruction files on generate. Off: those files are committed, and the
      // summary carries personal session activity. The SessionStart hook delivers
      // it locally regardless.
      injectSummary: false,
      // Advertise (and accept) the `log_session_usage` MCP tool, so an agent with no
      // hooks can report its own usage. Off: the tool is not in `tools/list`, so a
      // project that does not capture sessions pays none of its definition tokens.
      mcpCapture: false,
    },

    // MCP server configuration
    mcp: {
      autoRegister: true,
      // Which tools the server advertises and answers (#878): "all" (every shipped
      // tool; also what an absent key means), "core" (the retrieval + grounding loop,
      // about a third of the definition tokens) or an array of tool names.
      tools: 'all',
    },

    // Include a compact import dependency map at top of output
    depMap: true,

    // Include a compact `name@version` list of installed direct deps (D8)
    versionPins: true,

    // Terse signature encoding — deterministic compaction of sig lines (D7, opt-in)
    terse: false,

    // Include TODO/FIXME/HACK/XXX comments as compact section
    todos: true,

    // Include compact recent git changes section
    changes: true,

    // Number of commits used for changes section
    changesCommits: 10,

    // Add test coverage markers to extracted function signatures (opt-in)
    testCoverage: false,

    // Directories scanned for tests when testCoverage is enabled
    testDirs: ['tests', 'test', '__tests__', 'spec'],

    // Enable incremental signature cache (v6.7) - only re-extract changed files
    sigCache: false,

    // Content-hash extraction cache (#971): a re-run costs the files that changed. Entries live
    // in `.context/extract-cache.json`, are keyed by the SHA-1 of the file and by a fingerprint
    // of everything else the extraction depends on, and give a warm run byte-identical output.
    // Not used with `exactness.typescript|lsp|scip`, whose answers come from outside the file.
    extractCache: true,

    // Add reverse dependency usage hints on file headings (opt-in)
    impactRadius: false,

    // Query-aware retrieval settings (v2.3)
    retrieval: {
      // Maximum number of files to return for --query
      topK: 10,
      // Multiplier applied to recently-changed files (>1 boosts them up)
      recencyBoost: 1.5,
      // Boost files call-graph-connected to query matches (opt-in, measure-gated)
      callGraphBoost: false,
      // Blend import-graph centrality into ranking as a small prior (opt-in, measure-gated)
      centralityBlend: false,
      // Append route pseudo-signatures to the rankable index (opt-in, measure-gated)
      surfaceEnrichment: false,
      // Repo-mined query expansion: per-repo co-occurrence synonyms cached in
      // .context/mined-expansions.json (B2, opt-in, measure-gated)
      minedExpansions: false,
      // Index each file's rare body words — the words its signatures drop — into the ranking
      // only, cached in .context/body-words.json. On by default since v8.75.0 (#943, #674): it won
      // +17 on the third-party corpus with no corpus net-negative. `false` turns it off.
      bodyWords: true,
    },

    // Host-toolchain exactness tiers (#542 T2, opt-in, silent regex fallback).
    // typescript: parse .ts with the TARGET repo's own node_modules/typescript
    // (the user's install, never bundled). Byte-stability then holds per
    // toolchain version, and the generated header labels the version used.
    exactness: {
      typescript: false,
      // T3 spike (#612): LSP documentSymbol via a server already on the machine
      // (clangd/gopls/rust-analyzer), cached per content hash + server binary,
      // silent regex fallback. lspServers lays { ".ext": ["cmd", ...] } entries
      // over the built-in registry — commands are spawned directly, never a shell.
      lsp: false,
      lspServers: {},
      // T4 spike (#618): read a CI-produced index.scip at the repo root as a
      // signature source (import only) — compiler-typed signatures, same
      // per-file never-lose-vs-regex guard as the LSP tier.
      scip: false,
    },

    // Impact layer settings (v2.5)
    impact: {
      // BFS traversal depth limit for --impact (0 = unlimited)
      depth: 3,
      // Include signatures of impacted files in --impact output
      includeSigs: true,
    },
  };

  module.exports = { DEFAULTS };
  
};

// ── ./src/config/loader ──
__factories["./src/config/loader"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');
  const { DEFAULTS } = __require('./src/config/defaults');

  const BASE_CONFIG_TTL_MS = 60 * 60 * 1000; // 1 hour

  function loadBaseConfig(extendsVal, cwd) {
    if (!extendsVal || typeof extendsVal !== 'string') return {};

    if (extendsVal.startsWith('https://') || extendsVal.startsWith('http://')) {
      const cacheDir  = path.join(cwd, '.context', 'config-cache');
      const cacheKey  = Buffer.from(extendsVal).toString('base64url').replace(/[^a-zA-Z0-9_-]/g, '_');
      const cachePath = path.join(cacheDir, `${cacheKey}.json`);

      if (fs.existsSync(cachePath)) {
        const age = Date.now() - fs.statSync(cachePath).mtimeMs;
        if (age < BASE_CONFIG_TTL_MS) {
          try { return JSON.parse(fs.readFileSync(cachePath, 'utf8')); } catch (_) {}
        }
      }

      try {
        const https = require('https');
        const http  = require('http');
        const mod   = extendsVal.startsWith('https://') ? https : http;
        const raw   = (() => {
          let data = '';
          return new Promise((resolve, reject) => {
            mod.get(extendsVal, (res) => {
              res.on('data', (c) => { data += c; });
              res.on('end', () => resolve(data));
            }).on('error', reject);
          });
        })();
        // Sync fallback: run a tiny fetch in a child node process. Shell-free —
        // execFileSync runs the node binary directly (no /bin/sh) and the URL is
        // passed as an argv value, never interpolated into a command string.
        const { execFileSync } = require('child_process');
        const SYNC_FETCH = "const u=process.argv[1];const h=require(u.startsWith('https')?'https':'http');let d='';h.get(u,r=>{r.on('data',c=>d+=c);r.on('end',()=>process.stdout.write(d))}).on('error',()=>process.exit(1))";
        const out = execFileSync(process.execPath, ['-e', SYNC_FETCH, extendsVal], { timeout: 10000, encoding: 'utf8' });
        const parsed = JSON.parse(out);
        if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true });
        fs.writeFileSync(cachePath, JSON.stringify(parsed), 'utf8');
        return parsed;
      } catch (err) {
        process.stderr.write(`[sigmap] config extends: could not fetch ${extendsVal}: ${err.message}\n`);
        if (fs.existsSync(cachePath)) {
          try { return JSON.parse(fs.readFileSync(cachePath, 'utf8')); } catch (_) {}
        }
        return {};
      }
    }

    // Local file path
    const absPath = path.resolve(cwd, extendsVal);
    try {
      return JSON.parse(fs.readFileSync(absPath, 'utf8'));
    } catch (err) {
      process.stderr.write(`[sigmap] config extends: could not load ${absPath}: ${err.message}\n`);
      return {};
    }
  }

  // Keys that are valid in gen-context.config.json
  const KNOWN_KEYS = new Set(Object.keys(DEFAULTS));

  // Opt-in ranking signals that measured no net benefit on any corpus (#905). They still
  // work; setting one warns once per process, so a user hears it before v9.0 removes
  // the key rather than after. The figures are in docs-vp/guide/retrieval-benchmark.md.
  const DEPRECATED_SIGNALS = ['centralityBlend', 'surfaceEnrichment'];
  const _deprecationWarned = new Set();

  /**
   * Warn, once per process, for each deprecated retrieval signal a config turns on.
   * @param {object|undefined} source a config object (user config or an `extends` base)
   */
  function warnDeprecatedSignals(source) {
    const retrieval = source && source.retrieval;
    if (!retrieval || typeof retrieval !== 'object') return;
    for (const key of DEPRECATED_SIGNALS) {
      if (retrieval[key] !== true || _deprecationWarned.has(key)) continue;
      _deprecationWarned.add(key);
      console.warn(`[sigmap] retrieval.${key} is deprecated and will be removed in v9.0: it measured no net benefit on any benchmark corpus (https://sigmap.io/guide/retrieval-benchmark). It still works until then.`);
    }
  }

  // Common top-level folder names that reliably hold source code
  const COMMON_CODE_DIRS = new Set([
    'src', 'app', 'lib', 'packages', 'services', 'api', 'core', 'cmd',
    'internal', 'pkg', 'handlers', 'controllers', 'models', 'views',
    'components', 'pages', 'routes', 'middleware', 'utils', 'helpers',
    'modules', 'plugins', 'extensions', 'adapters', 'drivers',
    'examples', 'sample', 'demo', 'tests', 'test', 'spec', '__tests__',
    'hooks', 'composables', 'stores', 'features', 'domain', 'infra',
    'infrastructure', 'application', 'data', 'Sources', 'Tests',
  ]);

  const SUPPORTED_CODE_EXTS = new Set([
    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
    '.py', '.pyw', '.java', '.kt', '.kts', '.go', '.rs', '.cs',
    '.cpp', '.c', '.h', '.hpp', '.cc', '.m', '.mm', '.rb', '.rake', '.php',
    '.swift', '.dart', '.scala', '.sc', '.lua', '.ex', '.exs', '.vue', '.svelte', '.astro',
    '.html', '.htm', '.css', '.scss', '.sass', '.less',
    '.yml', '.yaml', '.sh', '.bash', '.zsh', '.fish',
    '.ps1', '.psm1', '.psd1',
    '.sql', '.graphql', '.gql', '.tf', '.tfvars', '.proto',
    '.toml', '.properties', '.xml', '.md',
  ]);

  /**
   * Detect source directories for the given project root.
   * Uses smart resolver (v6.5+) with fallback to legacy heuristics.
   *
   * @param {string} cwd - Project root
   * @param {string[]} excludeList - Folders to skip
   * @returns {string[]}
   */
  function detectAutoSrcDirs(cwd, excludeList) {
    try {
      const { resolveSourceRoots } = __require('./src/discovery/source-root-resolver');
      const result = resolveSourceRoots(cwd, { exclude: excludeList || [] });
      if (result.roots.length > 0) {
        if (result.confidence === 'low') {
          process.stderr.write(
            '[sigmap] low confidence root detection — run "sigmap roots --explain" to verify\n'
          );
        }
        return result.roots;
      }
    } catch (_) {}

    return _legacyDetectAutoSrcDirs(cwd, excludeList);
  }

  /**
   * Legacy source directory detection (fallback).
   *
   * @param {string} cwd - Project root
   * @param {string[]} excludeList - Folders to skip
   * @returns {string[]}
   */
  function _legacyDetectAutoSrcDirs(cwd, excludeList) {
    const excludeSet = new Set(excludeList || []);
    const candidates = new Set(DEFAULTS.srcDirs);

    // ── Manifest-based detection ──────────────────────────────────────────────
    const pkgPath = path.join(cwd, 'package.json');
    if (fs.existsSync(pkgPath)) {
      try {
        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
        const allDeps = { ...pkg.dependencies, ...pkg.devDependencies, ...pkg.peerDependencies };
        if (allDeps.react || allDeps.next) {
          for (const d of ['src', 'app', 'pages', 'components', 'hooks', 'lib', 'utils']) candidates.add(d);
        }
        if (allDeps['@angular/core']) {
          for (const d of ['src', 'projects', 'apps', 'libs']) candidates.add(d);
        }
        if (allDeps['@nestjs/core']) {
          for (const d of ['src', 'libs', 'apps']) candidates.add(d);
        }
        if (allDeps.vue) {
          for (const d of ['src', 'components', 'views', 'stores', 'composables', 'plugins']) candidates.add(d);
        }
        if (allDeps.svelte || allDeps['@sveltejs/kit']) {
          for (const d of ['src', 'lib', 'routes']) candidates.add(d);
        }
        if (allDeps.nx || allDeps.turbo || allDeps.lerna || pkg.workspaces) {
          for (const d of ['packages', 'apps', 'libs', 'services']) candidates.add(d);
        }
      } catch (_) {}
    }

    const hasPyproject = fs.existsSync(path.join(cwd, 'pyproject.toml'));
    const hasRequirements = fs.existsSync(path.join(cwd, 'requirements.txt'));
    const hasSetupPy = fs.existsSync(path.join(cwd, 'setup.py'));
    if (hasPyproject || hasRequirements || hasSetupPy) {
      for (const d of ['src', 'app', 'apps', 'tests', 'examples', 'instance', 'blueprints']) candidates.add(d);
    }

    if (fs.existsSync(path.join(cwd, 'Gemfile'))) {
      for (const d of ['app', 'lib', 'config', 'db', 'spec', 'test']) candidates.add(d);
    }

    if (fs.existsSync(path.join(cwd, 'composer.json'))) {
      for (const d of ['app', 'resources', 'routes', 'database', 'tests']) candidates.add(d);
    }

    if (fs.existsSync(path.join(cwd, 'go.mod'))) {
      for (const d of ['cmd', 'internal', 'pkg', 'api', 'handler', 'handlers', 'middleware', 'service']) candidates.add(d);
    }

    if (fs.existsSync(path.join(cwd, 'Cargo.toml'))) {
      for (const d of ['src', 'crates', 'examples', 'tests', 'benches']) candidates.add(d);
    }

    const hasGradle = fs.existsSync(path.join(cwd, 'build.gradle')) ||
                      fs.existsSync(path.join(cwd, 'build.gradle.kts'));
    const hasMaven = fs.existsSync(path.join(cwd, 'pom.xml'));
    if (hasGradle || hasMaven) {
      for (const d of [
        'src/main/java', 'src/main/kotlin', 'src/main/scala',
        'src/main/resources', 'src/test/java', 'src/test/kotlin',
      ]) candidates.add(d);
    }

    if (fs.existsSync(path.join(cwd, 'pubspec.yaml'))) {
      for (const d of ['lib', 'test', 'integration_test', 'example', 'bin']) candidates.add(d);
    }

    if (fs.existsSync(path.join(cwd, 'Package.swift'))) {
      for (const d of ['Sources', 'Tests']) candidates.add(d);
    }

    // ── Top-level directory scan ──────────────────────────────────────────────
    try {
      const entries = fs.readdirSync(cwd, { withFileTypes: true });
      for (const entry of entries) {
        if (!entry.isDirectory()) continue;
        if (entry.name.startsWith('.')) continue;
        if (excludeSet.has(entry.name)) continue;

        const lname = entry.name.toLowerCase();
        if (COMMON_CODE_DIRS.has(entry.name) || COMMON_CODE_DIRS.has(lname)) {
          candidates.add(entry.name);
          continue;
        }
        // Unknown dir: add if it directly contains source files
        const dirPath = path.join(cwd, entry.name);
        try {
          const subs = fs.readdirSync(dirPath, { withFileTypes: true });
          const hasSrc = subs.some((s) => {
            if (!s.isFile()) return false;
            return SUPPORTED_CODE_EXTS.has(path.extname(s.name).toLowerCase()) || s.name === 'Dockerfile';
          });
          if (hasSrc) { candidates.add(entry.name); continue; }
          const hasSrcSub = subs.some((s) =>
            s.isDirectory() && ['src', 'lib', 'main', 'java', 'kotlin', 'scala', 'python'].includes(s.name));
          if (hasSrcSub) candidates.add(entry.name);
        } catch (_) {}
      }
    } catch (_) {}

    // Only return those that exist
    return Array.from(candidates).filter((d) => {
      try { return fs.statSync(path.join(cwd, d)).isDirectory(); } catch (_) { return false; }
    });
  }

  /**
   * Directory depth needed to reach source under a JVM package layout.
   *
   * `maxDepth: 6` is right for the JS/Python-shaped trees it was tuned on, but a
   * JVM project puts one directory per package segment — real code in
   * `src/main/java/com/company/project/module/Class.java` sits 8-10 levels down.
   * At depth 6 only the top-level package was indexed: on spring-petclinic, 6 of
   * 47 Java files (#590).
   *
   * #561 already raised the dependency-graph walk to 12 for exactly this reason,
   * so extraction was the shallower half of an inconsistent pair.
   *
   * Deepening globally is not free — it adds candidates to every repo and cost
   * 2.2pp on the (filename-leaky) 105-task matrix corpus while the unbiased
   * `mined` corpus stayed flat. So the depth is raised only where the layout
   * demands it, leaving non-JVM repos byte-identical.
   *
   * @param {string} cwd
   * @returns {boolean} true when the repo looks like a Maven/Gradle/sbt project
   */
  function _isJvmLayout(cwd) {
    const MARKERS = ['pom.xml', 'build.gradle', 'build.gradle.kts', 'build.sbt', 'settings.gradle', 'settings.gradle.kts'];
    for (const m of MARKERS) {
      try { if (fs.existsSync(path.join(cwd, m))) return true; } catch { /* unreadable cwd */ }
    }
    for (const d of ['src/main/java', 'src/main/kotlin', 'src/main/scala']) {
      try { if (fs.existsSync(path.join(cwd, d))) return true; } catch { /* ignore */ }
    }
    return false;
  }

  /** Walk depth for a JVM package layout — matches the graph walk from #561. */
  const JVM_MAX_DEPTH = 12;

  /**
   * Raise `maxDepth` to the JVM depth when the layout needs it (#590).
   * An explicit user value always wins, including a deliberately shallow one.
   * @param {object} cfg   resolved config (mutated and returned)
   * @param {string} cwd
   * @param {boolean} userSetDepth
   * @returns {object} cfg
   */
  function _applyJvmDepth(cfg, cwd, userSetDepth) {
    if (!userSetDepth && cfg.maxDepth < JVM_MAX_DEPTH && _isJvmLayout(cwd)) {
      cfg.maxDepth = JVM_MAX_DEPTH;
    }
    return cfg;
  }

  /**
   * Load and merge configuration for a given working directory.
   *
   * @param {string} cwd - Project root directory
   * @returns {object} Merged config (DEFAULTS + user overrides)
   */
  function loadConfig(cwd) {
    const configPath = path.join(cwd, 'gen-context.config.json');
    if (!fs.existsSync(configPath)) {
      const cfg = deepClone(DEFAULTS);
      const detected = detectAutoSrcDirs(cwd, cfg.exclude);
      if (detected.length > 0) cfg.srcDirs = detected;
      cfg._userKeys = [];
      return _applyJvmDepth(cfg, cwd, false);
    }

    let userConfig;
    try {
      const raw = fs.readFileSync(configPath, 'utf8');
      userConfig = JSON.parse(raw);
    } catch (err) {
      console.warn(`[sigmap] config parse error in ${configPath}: ${err.message}`);
      const cfg = deepClone(DEFAULTS);
      const detected = detectAutoSrcDirs(cwd, cfg.exclude);
      if (detected.length > 0) cfg.srcDirs = detected;
      cfg._userKeys = [];
      return _applyJvmDepth(cfg, cwd, false);
    }

    // Warn on unknown keys (helps catch typos)
    for (const key of Object.keys(userConfig)) {
      if (key.startsWith('_') || key === 'extends') continue;
      if (!KNOWN_KEYS.has(key)) {
        console.warn(`[sigmap] unknown config key: "${key}" (ignored)`);
      }
    }

    // Deep merge: DEFAULTS → base (extends) → user config
    const baseConfig = loadBaseConfig(userConfig.extends, cwd);
    const merged = deepClone(DEFAULTS);

    warnDeprecatedSignals(baseConfig);
    warnDeprecatedSignals(userConfig);

    for (const key of Object.keys(baseConfig)) {
      if (key.startsWith('_') || key === 'extends') continue;
      if (!KNOWN_KEYS.has(key)) continue;
      const val = baseConfig[key];
      if (val !== null && typeof val === 'object' && !Array.isArray(val) &&
          typeof merged[key] === 'object' && !Array.isArray(merged[key])) {
        merged[key] = Object.assign({}, merged[key], val);
      } else {
        merged[key] = val;
      }
    }

    for (const key of Object.keys(userConfig)) {
      if (key.startsWith('_') || key === 'extends') continue;
      if (!KNOWN_KEYS.has(key)) continue; // skip unknown keys
      const val = userConfig[key];
      if (val !== null && typeof val === 'object' && !Array.isArray(val) &&
          typeof merged[key] === 'object' && !Array.isArray(merged[key])) {
        merged[key] = Object.assign({}, merged[key], val);
      } else {
        merged[key] = val;
      }
    }

    // If user didn't specify srcDirs, auto-detect; fall back to DEFAULTS if nothing found
    if (!Array.isArray(userConfig.srcDirs)) {
      const detected = detectAutoSrcDirs(cwd, merged.exclude);
      merged.srcDirs = detected.length > 0 ? detected : deepClone(DEFAULTS.srcDirs);
    }

    // Backward compat (v3.0+): mirror outputs ↔ adapters
    if (merged.adapters && !Array.isArray(merged.adapters)) merged.adapters = null;
    if (!merged.adapters && Array.isArray(merged.outputs)) {
      merged.adapters = merged.outputs.slice();
    } else if (Array.isArray(merged.adapters) && !userConfig.outputs) {
      merged.outputs = merged.adapters.filter((a) => ['copilot','claude','cursor','windsurf'].includes(a));
    }

    // Provenance (#783): which keys the project actually set, as opposed to
    // inheriting from DEFAULTS. Without this, "your maxTokens was overridden"
    // could not tell a pinned 500 from the shipped default 6000, and the notice
    // fired on every repo that had never configured a budget at all. The `_`
    // prefix is the existing convention for a key the merge loops skip, so this
    // can neither collide with a real key nor trigger the unknown-key warning.
    // A key set by an `extends` base counts as user-set: the project chose it.
    const _userKeys = [];
    for (const src of [baseConfig, userConfig]) {
      for (const key of Object.keys(src || {})) {
        if (key.startsWith('_') || key === 'extends') continue;
        if (!KNOWN_KEYS.has(key)) continue;
        if (!_userKeys.includes(key)) _userKeys.push(key);
      }
    }
    merged._userKeys = _userKeys;

    return _applyJvmDepth(merged, cwd, userConfig.maxDepth !== undefined);
  }

  function deepClone(obj) {
    return JSON.parse(JSON.stringify(obj));
  }

  module.exports = { loadConfig, loadBaseConfig };
  
};

// ── ./src/config/models ──
__factories["./src/config/models"] = function(module, exports) {
  
  /**
   * The model profile — the one dated table behind every model name, price,
   * context window and cache minimum SigMap prints (#688, #778).
   *
   * Before this module the routing hints and the pricing table were two unrelated
   * literals: no name the first printed was a key of the second, neither said
   * when it was true, and neither could be corrected from config. Both now derive
   * from MODELS below and keep no model literal of their own (guard-tested).
   *
   * Every figure was read from the vendor's own pricing or models page on AS_OF.
   * A figure that was not verified there is `null`, never a guess. This is not a
   * mirror of any vendor's catalog — it is the handful of models the advice
   * names by default, plus the keys older releases accepted. Anything else is
   * declared by the user under the `models` config namespace, which wins over
   * the shipped values field by field.
   *
   * There is no live fetch, opt-in or otherwise. Freshness is `sigmap doctor`
   * warning once the profile is STALE_AFTER_DAYS old.
   */

  // The date the figures below were checked against each vendor's pages.
  const AS_OF = '2026-10-04';

  // `sigmap doctor` warns once the profile in force is older than this.
  const STALE_AFTER_DAYS = 90;

  // Lowest to highest. A vendor's higher tier never costs less than its lower.
  const TIER_ORDER = ['fast', 'balanced', 'powerful'];

  // What an estimate assumes when a model has no `charsPerToken` of its own.
  const DEFAULT_CHARS_PER_TOKEN = 4;

  // inputPerMtok: USD per 1,000,000 input tokens, standard (uncached, non-batch).
  // window:       context window in tokens. cacheMin: minimum cacheable prefix.
  // A model with no `tier` is priced but never named as advice.
  const MODELS = {
    'claude-fable-5-1':  { vendor: 'anthropic', tier: 'powerful', inputPerMtok: 10,   window: 1000000, cacheMin: 512 },
    'claude-opus-5-5':   { vendor: 'anthropic', tier: 'powerful', inputPerMtok: 4,    window: 1000000, cacheMin: 512 },
    'claude-sonnet-5-5': { vendor: 'anthropic', tier: 'balanced', inputPerMtok: 2,    window: 1000000, cacheMin: 512 },
    'claude-haiku-4-5':  { vendor: 'anthropic', tier: 'fast',     inputPerMtok: 1,    window: 200000,  cacheMin: 4096 },

    'gpt-6-astra':       { vendor: 'openai',    tier: 'powerful', inputPerMtok: 10,   window: 1050000, cacheMin: null },
    'gpt-6.1-sol':       { vendor: 'openai',    tier: 'balanced', inputPerMtok: 2,    window: 1050000, cacheMin: null },
    'gpt-6-luna':        { vendor: 'openai',    tier: 'fast',     inputPerMtok: 0.1,  window: 1050000, cacheMin: null },
    'gpt-4o':            { vendor: 'openai',    tier: null,       inputPerMtok: 2.5,  window: null,    cacheMin: null },
    'gpt-4o-mini':       { vendor: 'openai',    tier: null,       inputPerMtok: 0.15, window: null,    cacheMin: null },

    // gemini-3.1-pro-preview: prompts up to 200K tokens; longer prompts cost more.
    // gemini-3.8-flash: the vendor lists this rate as valid through 2026-12-31.
    'gemini-3.1-pro-preview': { vendor: 'google', tier: 'powerful', inputPerMtok: 2,    window: null, cacheMin: null },
    'gemini-3.8-flash':       { vendor: 'google', tier: 'balanced', inputPerMtok: 0.75, window: null, cacheMin: null },
    'gemini-3.5-flash-lite':  { vendor: 'google', tier: 'fast',     inputPerMtok: 0.3,  window: null, cacheMin: null },

    // Flash price/window verified 2026-10-20: platform.minimax.io/docs/guides/models-intro
    // and platform.minimax.io/docs/guides/pricing-paygo. Keep AS_OF conservative for the rest.
    'minimax-m3.1-flash': { vendor: 'minimax', tier: null,       inputPerMtok: 0.15, window: 1000000, cacheMin: null },
    // minimax-m3: requests up to 512K input tokens; longer requests cost more.
    'minimax-m3':        { vendor: 'minimax',   tier: null,       inputPerMtok: 0.3,  window: null,    cacheMin: null },
    // Retain explicit legacy estimates without advertising the model by default.
    'minimax-m2.7':      { vendor: 'minimax',   tier: null,       inputPerMtok: 0.3,  window: null,    cacheMin: null, legacy: true },
  };

  // Family keys older releases accepted, kept valid as names for the current model.
  const ALIASES = {
    'claude-opus': 'claude-opus-5-5',
    'claude-sonnet': 'claude-sonnet-5-5',
    'claude-haiku': 'claude-haiku-4-5',
  };

  // Priced when no model is named.
  const DEFAULT_MODEL = 'claude-sonnet';

  const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;

  function _key(name) {
    return String(name == null ? '' : name).trim().toLowerCase();
  }

  function _isMap(v) {
    return v !== null && typeof v === 'object' && !Array.isArray(v);
  }

  function _positive(v) {
    return typeof v === 'number' && Number.isFinite(v) && v > 0;
  }

  /**
   * The profile in force: the shipped table with the project's `models` config
   * laid over it, field by field.
   *
   * Precedence is config over shipped for every field. A config value of the
   * wrong type is ignored rather than trusted, so a typo cannot blank a price.
   *
   * @param {object} [config] - merged SigMap config (or nothing for the shipped profile)
   * @returns {{
   *   asOf: string, asOfSource: 'shipped'|'config',
   *   models: Object<string, {vendor:string|null, tier:string|null, inputPerMtok:number|null,
   *     window:number|null, cacheMin:number|null, charsPerToken:number|null, source:'shipped'|'config'}>,
   *   aliases: Object<string,string>, defaultModel: string,
   *   roster: string[], rosterDeclared: boolean, rosterUnknown: string[]
   * }}
   */
  function resolveProfile(config) {
    const user = _isMap(config && config.models) ? config.models : {};
    const models = {};
    for (const [id, m] of Object.entries(MODELS)) {
      models[id] = Object.assign({ charsPerToken: null, source: 'shipped' }, m);
    }

    const entry = (name) => {
      const id = _key(name);
      if (!id) return null;
      if (!models[id]) {
        models[id] = { vendor: null, tier: null, inputPerMtok: null, window: null, cacheMin: null, charsPerToken: null, source: 'config' };
      }
      return models[id];
    };
    const lay = (map, field, valid) => {
      if (!_isMap(map)) return;
      for (const [name, value] of Object.entries(map)) {
        if (!valid(value)) continue;
        const id = ALIASES[_key(name)] || _key(name);
        const e = entry(id);
        if (!e) continue;
        e[field] = value;
        e.source = 'config';
      }
    };
    lay(user.prices, 'inputPerMtok', _positive);
    lay(user.windows, 'window', _positive);
    lay(user.cacheMin, 'cacheMin', _positive);
    lay(user.charsPerToken, 'charsPerToken', _positive);
    lay(user.tiers, 'tier', (v) => TIER_ORDER.includes(v));

    const roster = [];
    for (const name of Array.isArray(user.roster) ? user.roster : []) {
      const id = ALIASES[_key(name)] || _key(name);
      if (id && !roster.includes(id)) roster.push(id);
    }
    // A roster entry SigMap has no price for cannot be costed or tiered until
    // the project supplies the figures; doctor reports these.
    const rosterUnknown = roster.filter((id) => !models[id] || models[id].inputPerMtok == null);

    const userAsOf = typeof user.asOf === 'string' && DATE_RE.test(user.asOf) && !Number.isNaN(Date.parse(user.asOf));
    return {
      asOf: userAsOf ? user.asOf : AS_OF,
      asOfSource: userAsOf ? 'config' : 'shipped',
      models,
      aliases: Object.assign({}, ALIASES),
      defaultModel: DEFAULT_MODEL,
      roster,
      rosterDeclared: roster.length > 0,
      rosterUnknown,
    };
  }

  /**
   * Look a model name up in a profile, through aliases, ignoring case.
   *
   * @param {object} profile - from resolveProfile
   * @param {string} name
   * @returns {{ id: string, model: object }|null} null when the name is unknown
   */
  function lookup(profile, name) {
    const key = _key(name);
    const id = profile.aliases[key] || key;
    const model = profile.models[id];
    return model ? { id, model } : null;
  }

  /**
   * The models advice names for a tier: the roster's, when one is declared;
   * otherwise every tiered model in the profile. Only priced models qualify, so
   * every name returned is one `gain --model` accepts.
   *
   * @param {object} profile
   * @param {string} tier - one of TIER_ORDER
   * @returns {string[]} model ids, in table order
   */
  function tierModels(profile, tier) {
    const pool = profile.rosterDeclared ? profile.roster : Object.keys(profile.models);
    return pool.filter((id) => {
      const m = profile.models[id];
      return m && m.tier === tier && m.inputPerMtok != null;
    });
  }

  /**
   * Input-price span of a tier's models, or null when the tier names none.
   * @returns {{ min: number, max: number }|null}
   */
  function tierPriceRange(profile, tier) {
    const prices = tierModels(profile, tier).map((id) => profile.models[id].inputPerMtok);
    if (prices.length === 0) return null;
    return { min: Math.min(...prices), max: Math.max(...prices) };
  }

  /**
   * The smallest context window on the declared roster — the one a shared
   * context file has to fit. Null when no roster is declared or none of its
   * windows is known.
   *
   * @returns {{ window: number, model: string, unknown: string[] }|null}
   */
  function smallestRosterWindow(profile) {
    if (!profile.rosterDeclared) return null;
    let best = null;
    const unknown = [];
    for (const id of profile.roster) {
      const m = profile.models[id];
      if (!m || m.window == null) { unknown.push(id); continue; }
      if (!best || m.window < best.window) best = { window: m.window, model: id };
    }
    return best ? Object.assign(best, { unknown }) : null;
  }

  /**
   * The context limit the auto budget caps against.
   *
   * A `modelContextLimit` the project set always wins. Otherwise a declared
   * roster can only LOWER the limit — to its smallest known window — never
   * raise it: declaring a 1M-window model is not a request for a larger
   * always-on context file, while declaring a small one is a hard constraint.
   *
   * @param {object} config - merged SigMap config
   * @returns {{ limit: number, source: 'config'|'roster'|'default', model: string|null }}
   */
  function contextLimit(config) {
    const configured = (config && config.modelContextLimit != null) ? config.modelContextLimit : 128000;
    const userSet = !!(config && Array.isArray(config._userKeys) && config._userKeys.includes('modelContextLimit'));
    if (userSet) return { limit: configured, source: 'config', model: null };
    const smallest = smallestRosterWindow(resolveProfile(config));
    if (smallest && smallest.window < configured) return { limit: smallest.window, source: 'roster', model: smallest.model };
    return { limit: configured, source: 'default', model: null };
  }

  /**
   * How a token count priced against a model was obtained. SigMap counts
   * characters; without a per-model factor the count is the chars/4 estimate
   * and must be labelled as one.
   *
   * @param {object} profile
   * @param {string} name - model name or alias
   * @returns {{ charsPerToken: number, estimated: boolean, scale: number, label: string }}
   *   `scale` converts a chars/4 token count to this model's count.
   */
  function tokenBasis(profile, name) {
    const hit = lookup(profile, name);
    const factor = hit && hit.model.charsPerToken;
    if (!_positive(factor)) {
      return { charsPerToken: DEFAULT_CHARS_PER_TOKEN, estimated: true, scale: 1, label: `est. (chars/${DEFAULT_CHARS_PER_TOKEN})` };
    }
    return { charsPerToken: factor, estimated: false, scale: DEFAULT_CHARS_PER_TOKEN / factor, label: `chars/${factor} (models.charsPerToken)` };
  }

  /**
   * Age of a profile against a clock.
   * @param {object} profile
   * @param {number} [nowMs] - injectable clock
   * @returns {{ days: number, stale: boolean }}
   */
  function profileAge(profile, nowMs) {
    const now = typeof nowMs === 'number' ? nowMs : Date.now();
    const days = Math.max(0, Math.floor((now - Date.parse(profile.asOf)) / 86400000));
    return { days, stale: days > STALE_AFTER_DAYS };
  }

  /** `as of 2026-10-04 (shipped profile)` — the provenance tag outputs carry. */
  function asOfLabel(profile) {
    return `as of ${profile.asOf} (${profile.asOfSource === 'config' ? 'your config' : 'shipped profile'})`;
  }

  module.exports = {
    AS_OF, STALE_AFTER_DAYS, TIER_ORDER, DEFAULT_MODEL, DEFAULT_CHARS_PER_TOKEN, MODELS, ALIASES,
    resolveProfile, lookup, tierModels, tierPriceRange, smallestRosterWindow, contextLimit,
    tokenBasis, profileAge, asOfLabel,
  };
  
};

// ── ./src/config/tune ──
__factories["./src/config/tune"] = function(module, exports) {
  
  /**
   * sigmap tune — deterministic config optimizer (F2, #514).
   *
   * Packages the existing discovery stack (source-root-resolver, the shared
   * monorepo detector, client-artifact probes) into a recommended config diff with a
   * one-line reason per change. Read-only by default; `applyTuneProposal`
   * merges accepted changes into gen-context.config.json, preserving every
   * user key. Explicit user choices are never proposed against.
   */

  const fs = require('fs');
  const path = require('path');
  const { loadConfig } = __require('./src/config/loader');
  const { resolveSourceRoots } = __require('./src/discovery/source-root-resolver');
  const { detectMonorepo } = __require('./src/discovery/monorepo');

  // Client artifacts → adapter names (additive only).
  const ADAPTER_MARKERS = [
    { adapter: 'claude',   files: ['CLAUDE.md'] },
    { adapter: 'cursor',   files: ['.cursorrules', '.cursor'] },
    { adapter: 'windsurf', files: ['.windsurfrules', '.windsurf'] },
    { adapter: 'codex',    files: ['AGENTS.md'] },
  ];

  // Root-level dirs that are typically vendored/generated when present.
  const JUNK_DIRS = [
    'third_party', 'thirdparty', 'external', 'externals',
    'generated', 'testdata', 'snapshots', 'tmp', 'temp', '.cache',
  ];

  // Rough signature cost per source file (chars/4 world) for the budget check.
  const TOKENS_PER_FILE = 25;

  const SOURCE_EXTS = new Set([
    '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx', '.py', '.rb', '.go', '.rs',
    '.java', '.kt', '.cs', '.cpp', '.c', '.h', '.hpp', '.m', '.mm', '.swift', '.dart',
    '.scala', '.php', '.lua', '.gd', '.r', '.R',
    '.ps1', '.psm1', '.psd1',
  ]);

  /** Raw user config file content, or null when absent/unparsable. */
  function _readUserConfig(cwd) {
    try {
      return JSON.parse(fs.readFileSync(path.join(cwd, 'gen-context.config.json'), 'utf8'));
    } catch (_) {
      return null;
    }
  }

  /** Count source files under `roots` (relative to cwd), depth-capped, deterministic. */
  function _countSourceFiles(cwd, roots, exclude, depth = 5) {
    const excSet = new Set(exclude || []);
    let count = 0;
    const walk = (dir, d) => {
      if (d <= 0 || count > 20000) return;
      let entries;
      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
      for (const e of entries) {
        if (excSet.has(e.name)) continue;
        if (e.isDirectory()) walk(path.join(dir, e.name), d - 1);
        else if (e.isFile() && SOURCE_EXTS.has(path.extname(e.name))) count++;
      }
    };
    for (const r of roots) {
      const full = path.join(cwd, r);
      if (fs.existsSync(full)) walk(full, depth);
    }
    return count;
  }

  // `_monorepoMarker` used to live here as a byte-for-byte duplicate of the
  // resolver's own marker check. Both answered "no" on a repo where `--monorepo`
  // processes two packages, so `tune` never proposed `monorepo: true` for a
  // layout the mode demonstrably supports (#781). One detector now answers it,
  // and it reports whether the evidence is a declared marker or the layout.

  /**
   * Build the recommended config diff for a repo.
   *
   * @param {string} cwd
   * @returns {{ changes: Array<{key:string, current:*, recommended:*, reason:string}>,
   *             detection: { roots:string[], confidence:string, isMonorepo:boolean,
   *                           monorepoEvidence:string },
   *             configExists: boolean }}
   */
  function buildTuneProposal(cwd) {
    const userConfig = _readUserConfig(cwd);
    const config = loadConfig(cwd);
    const detection = resolveSourceRoots(cwd, { exclude: config.exclude });
    const changes = [];

    // 1. srcDirs — recommend pinning the detected roots when the user hasn't.
    // Pinned srcDirs make generation explicit/stable and are protected from
    // token-budget drops; user-pinned srcDirs are never proposed against.
    const userPinnedSrcDirs = !!(userConfig && Array.isArray(userConfig.srcDirs));
    if (!userPinnedSrcDirs && detection.roots.length > 0 && detection.confidence !== 'low') {
      changes.push({
        key: 'srcDirs',
        current: null,
        recommended: detection.roots,
        reason: `pin the ${detection.roots.length} detected source root(s) [confidence ${detection.confidence}] — explicit srcDirs are stable across runs and protected from budget drops`,
      });
    }

    // 2. monorepo — a workspace marker exists but the mode is off.
    const monorepo = detectMonorepo(cwd);
    if (monorepo.isMonorepo && config.monorepo !== true) {
      changes.push({
        key: 'monorepo',
        current: config.monorepo,
        recommended: true,
        reason: monorepo.evidence,
      });
    }

    // 3. adapters — client artifacts present that the adapter list doesn't cover.
    const currentAdapters = Array.isArray(config.adapters) ? config.adapters
      : (Array.isArray(config.outputs) ? config.outputs : ['copilot']);
    const found = [];
    for (const { adapter, files } of ADAPTER_MARKERS) {
      if (currentAdapters.includes(adapter)) continue;
      const hit = files.find((f) => fs.existsSync(path.join(cwd, f)));
      if (hit) found.push({ adapter, hit });
    }
    if (found.length > 0) {
      changes.push({
        key: 'adapters',
        current: currentAdapters,
        recommended: [...currentAdapters, ...found.map((f) => f.adapter)],
        reason: `client files present: ${found.map((f) => f.hit).join(', ')}`,
      });
    }

    // 4. exclude — root-level vendored/generated dirs not excluded yet.
    const junkFound = JUNK_DIRS.filter((d) => {
      if ((config.exclude || []).includes(d)) return false;
      try { return fs.statSync(path.join(cwd, d)).isDirectory(); } catch (_) { return false; }
    });
    if (junkFound.length > 0) {
      changes.push({
        key: 'exclude',
        current: userConfig && userConfig.exclude ? userConfig.exclude : null,
        recommended: [...((userConfig && userConfig.exclude) || config.exclude), ...junkFound],
        reason: `present at root and typically vendored/generated: ${junkFound.join(', ')}`,
      });
    }

    // 5. autoMaxTokens — a pinned budget that the repo's size will overflow.
    if (config.autoMaxTokens === false) {
      const roots = detection.roots.length > 0 ? detection.roots : config.srcDirs;
      const files = _countSourceFiles(cwd, roots, config.exclude);
      const estTokens = files * TOKENS_PER_FILE;
      if (estTokens > config.maxTokens) {
        changes.push({
          key: 'autoMaxTokens',
          current: false,
          recommended: true,
          reason: `~${files} source files need ~${estTokens} tokens (heuristic) but maxTokens is pinned at ${config.maxTokens} — auto-scaling targets ${Math.round((config.coverageTarget || 0.8) * 100)}% coverage`,
        });
      }
    }

    return {
      changes,
      detection: { roots: detection.roots, confidence: detection.confidence, isMonorepo: monorepo.isMonorepo, monorepoEvidence: monorepo.evidence },
      configExists: userConfig !== null,
    };
  }

  /**
   * Merge a proposal's changes into gen-context.config.json (create if absent).
   * Preserves every existing user key; only the proposed keys are written.
   *
   * @returns {{ path: string, applied: string[] }}
   */
  function applyTuneProposal(cwd, proposal) {
    const cfgPath = path.join(cwd, 'gen-context.config.json');
    const existing = _readUserConfig(cwd) || {};
    for (const c of proposal.changes) existing[c.key] = c.recommended;
    fs.writeFileSync(cfgPath, JSON.stringify(existing, null, 2) + '\n');
    return { path: cfgPath, applied: proposal.changes.map((c) => c.key) };
  }

  /** Human rendering of a proposal (one block per change, reason indented). */
  function formatTuneProposal(proposal) {
    const lines = [];
    if (proposal.changes.length === 0) {
      lines.push('[sigmap] tune: config already matches detection — no changes recommended');
    } else {
      lines.push(`[sigmap] tune: ${proposal.changes.length} recommended change(s)`);
      for (const c of proposal.changes) {
        lines.push(`  ${c.key.padEnd(14)} ${JSON.stringify(c.current)} → ${JSON.stringify(c.recommended)}`);
        lines.push(`  ${''.padEnd(14)} reason: ${c.reason}`);
      }
      lines.push('');
      lines.push('  apply with: sigmap tune --apply   (then: sigmap validate)');
    }
    const mono = proposal.detection.isMonorepo ? 'yes' : 'no';
    const monoWhy = proposal.detection.monorepoEvidence ? ` (${proposal.detection.monorepoEvidence})` : '';
    lines.push(`  detection: roots [${proposal.detection.roots.join(', ')}] · confidence ${proposal.detection.confidence} · monorepo ${mono}${monoWhy}`);
    return lines.join('\n');
  }

  module.exports = { buildTuneProposal, applyTuneProposal, formatTuneProposal, JUNK_DIRS, TOKENS_PER_FILE };
  
};

// ── ./src/conventions/ci ──
__factories["./src/conventions/ci"] = function(module, exports) {
  
  /**
   * Convention CI gate (IMPL.md §4 — `conventions --ci`).
   *
   * Fails CI when a repo's overall convention consistency is below a threshold,
   * and optionally when it regresses vs the last recorded run. Builds on the
   * `--report` score. Pure, zero-dependency, bundle-safe.
   */

  const { overallScore } = __require('./src/conventions/report');

  const DEFAULT_MIN = 0.7;
  const EPS = 1e-9;

  /**
   * Evaluate the consistency gate.
   * @param {object} result an `extractConventions` result
   * @param {object} [opts]
   * @param {number} [opts.min=0.7] minimum overall consistency (0–1)
   * @param {boolean} [opts.noRegress=false] also fail if the score dropped vs prior
   * @param {object|null} [prior] the previous snapshot (from `report.snapshot`)
   * @returns {{ score:number, min:number, ok:boolean, regressed:boolean, reasons:string[] }}
   */
  function ciGate(result, opts = {}, prior = null) {
    const min = opts.min != null ? opts.min : DEFAULT_MIN;
    const score = overallScore(result);
    const reasons = [];
    let ok = true;

    if (score < min) {
      ok = false;
      reasons.push(`consistency ${(score * 100).toFixed(0)}% below min ${(min * 100).toFixed(0)}%`);
    }

    let regressed = false;
    if (opts.noRegress && prior && typeof prior.score === 'number') {
      if (score < prior.score - EPS) {
        regressed = true;
        ok = false;
        reasons.push(`consistency dropped ${(prior.score * 100).toFixed(0)}% → ${(score * 100).toFixed(0)}%`);
      }
    }

    return { score, min, ok, regressed, reasons };
  }

  module.exports = { ciGate, DEFAULT_MIN };
  
};

// ── ./src/conventions/conflicts ──
__factories["./src/conventions/conflicts"] = function(module, exports) {
  
  /**
   * Convention conflict analysis (IMPL.md §4 / §5.3 — grounded codegen, Layer 3).
   *
   * Given an `extractConventions` result, surface *why* a convention is mixed:
   * every variant pattern with its file count, share, and example files, plus
   * rename suggestions that move minority file-naming files toward the dominant
   * style. Pure, zero-dependency, bundle-safe.
   */

  /** Split a file name into its stem (before the first dot) and the rest. */
  function _splitName(filename) {
    const s = String(filename || '');
    const dot = s.indexOf('.');
    if (dot <= 0) return { stem: s, ext: '' };
    return { stem: s.slice(0, dot), ext: s.slice(dot) };
  }

  /** Break a stem into lowercase word parts regardless of its current style. */
  function _words(stem) {
    return String(stem || '')
      .replace(/([a-z0-9])([A-Z])/g, '$1 $2') // camel/Pascal boundaries
      .replace(/[-_]+/g, ' ')                 // kebab / snake separators
      .trim()
      .split(/\s+/)
      .filter(Boolean)
      .map((w) => w.toLowerCase());
  }

  const _cap = (w) => w.charAt(0).toUpperCase() + w.slice(1);

  /**
   * Convert a file stem to a target naming style.
   * @param {string} stem name without extension
   * @param {'PascalCase'|'camelCase'|'kebab-case'|'snake_case'} style
   * @returns {string}
   */
  function toNamingStyle(stem, style) {
    const w = _words(stem);
    if (w.length === 0) return String(stem || '');
    switch (style) {
      case 'PascalCase': return w.map(_cap).join('');
      case 'camelCase': return w[0] + w.slice(1).map(_cap).join('');
      case 'kebab-case': return w.join('-');
      case 'snake_case': return w.join('_');
      default: return String(stem || '');
    }
  }

  /** Rename suggestion to bring a file to the dominant naming style. */
  function renameSuggestion(filename, dominantStyle) {
    const { stem, ext } = _splitName(filename);
    const to = toNamingStyle(stem, dominantStyle) + ext;
    return { from: filename, to };
  }

  const LABELS = {
    fileNaming: 'file naming',
    exportStyle: 'export style',
  };

  /**
   * Analyze an `extractConventions` result for conflicts.
   * @param {object} result the object returned by `extractConventions`
   * @returns {{ hasConflicts: boolean, conventions: Array<{
   *   key:string, name:string, dominant:string|null, dominantPct:number,
   *   tier:string, total:number,
   *   variants:Array<{pattern:string,count:number,pct:number,examples:string[]}>,
   *   renames:Array<{from:string,to:string}> }> }}
   */
  function analyzeConflicts(result) {
    const out = [];
    for (const key of ['fileNaming', 'exportStyle']) {
      const conv = result && result[key];
      // A conflict is any convention with more than one observed pattern.
      if (!conv || conv.total === 0 || conv.variants.length < 2) continue;

      const variants = conv.variants.map((v) => ({
        pattern: v.label,
        count: v.count,
        pct: v.pct,
        examples: v.examples || [],
      }));

      // Rename suggestions only for file naming (export style is a code change, not a rename).
      const renames = [];
      if (key === 'fileNaming' && conv.dominant) {
        for (const v of conv.variants) {
          if (v.label === conv.dominant) continue;
          for (const ex of (v.examples || [])) {
            renames.push(renameSuggestion(ex, conv.dominant));
          }
        }
      }

      out.push({
        key,
        name: LABELS[key] || key,
        dominant: conv.dominant,
        dominantPct: conv.dominantPct,
        tier: conv.tier,
        total: conv.total,
        variants,
        renames,
      });
    }
    return { hasConflicts: out.length > 0, conventions: out };
  }

  module.exports = { analyzeConflicts, toNamingStyle, renameSuggestion };
  
};

// ── ./src/conventions/extract ──
__factories["./src/conventions/extract"] = function(module, exports) {
  
  /**
   * Convention extraction (IMPL.md Layer 3 — grounded code generation).
   *
   * Detects a repo's dominant coding conventions so generated code matches the
   * house style instead of drifting (Cause 4: naming/convention drift). This
   * first slice covers TS/JS/Python and three conventions: file naming, export
   * style, and test framework. `scoreConvention` is the reusable consistency
   * primitive that Gap 1 (scaffold confidence) will also build on.
   *
   * Zero dependencies, bundle-safe (fs + path only).
   */

  const fs = require('fs');
  const path = require('path');

  const JS_TS_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs']);
  const PY_EXTS = new Set(['.py']);
  const SCOPED_EXTS = new Set([...JS_TS_EXTS, ...PY_EXTS]);

  // Consistency tiers (IMPL.md §5.1): a convention is only safe to enforce when
  // it is actually consistent.
  const TIER_CONSISTENT = 0.9;
  const TIER_MOSTLY = 0.7;

  /**
   * Classify a file's base name (without extension) into a naming style.
   *
   * A single lowercase word (`user`, `index`, `loader`) is classified
   * `single-word`, NOT `camelCase`: it has no case boundary or separator, so it is
   * compatible with camelCase, kebab-case AND snake_case at once and expresses no
   * distinguishable convention. `scoreConvention` treats it as style-neutral
   * (excluded), so a repo of single-word files reports "unknown" rather than a
   * spurious "100% camelCase".
   *
   * @param {string} basename a file basename, e.g. "user-service.ts"
   * @returns {'PascalCase'|'camelCase'|'kebab-case'|'snake_case'|'single-word'|'other'}
   */
  function classifyNaming(basename) {
    let stem = String(basename || '');
    const dot = stem.indexOf('.');
    if (dot > 0) stem = stem.slice(0, dot); // strip ext + compound suffix (.test, .d)
    if (!stem) return 'other';
    if (/[-]/.test(stem) && /^[a-z0-9]+(?:-[a-z0-9]+)+$/.test(stem)) return 'kebab-case';
    if (/[_]/.test(stem) && /^[a-z0-9]+(?:_[a-z0-9]+)+$/.test(stem)) return 'snake_case';
    if (/^[A-Z][A-Za-z0-9]*$/.test(stem) && /[a-z]/.test(stem)) return 'PascalCase';
    if (/^[a-z][A-Za-z0-9]*$/.test(stem) && /[A-Z]/.test(stem)) return 'camelCase';
    if (/^[a-z][a-z0-9]*$/.test(stem)) return 'single-word'; // style-neutral (no case boundary)
    return 'other';
  }

  const MAX_EXAMPLES = 3;

  /**
   * Score a set of categorical observations into a dominant convention plus its
   * consistency tier. The reusable primitive (IMPL.md §5.2).
   * @param {string[]} labels observed category for each sample (e.g. naming styles)
   * @param {string[]} [refs] optional identifier (e.g. file name) parallel to
   *   `labels`; when given, each variant carries up to 3 `examples`.
   * @returns {{ dominant: string|null, dominantPct: number, total: number,
   *             variants: Array<{label:string, count:number, pct:number, examples?:string[]}>,
   *             tier: 'consistent'|'mostly'|'inconsistent'|'unknown' }}
   */
  function scoreConvention(labels, refs) {
    const all = labels || [];
    const counts = new Map();
    const examples = new Map();
    let total = 0;
    for (let i = 0; i < all.length; i++) {
      const l = all[i];
      // 'other' = unclassifiable; 'single-word' = style-neutral. Both express no
      // distinguishable convention and are excluded from the score.
      if (l == null || l === 'other' || l === 'single-word') continue;
      total++;
      counts.set(l, (counts.get(l) || 0) + 1);
      if (refs && refs[i] != null) {
        const ex = examples.get(l) || [];
        if (ex.length < MAX_EXAMPLES) { ex.push(refs[i]); examples.set(l, ex); }
      }
    }
    if (total === 0) {
      return { dominant: null, dominantPct: 0, total: 0, variants: [], tier: 'unknown' };
    }
    const variants = [...counts.entries()]
      .map(([label, count]) => {
        const v = { label, count, pct: count / total };
        if (refs) v.examples = examples.get(label) || [];
        return v;
      })
      .sort((a, b) => b.count - a.count || a.label.localeCompare(b.label));
    const top = variants[0];
    let tier = 'inconsistent';
    if (top.pct >= TIER_CONSISTENT) tier = 'consistent';
    else if (top.pct >= TIER_MOSTLY) tier = 'mostly';
    return {
      dominant: top.label,
      dominantPct: top.pct,
      total,
      variants,
      tier,
    };
  }

  /** Detect JS/TS export style for a single file's source. */
  function _jsExportStyle(src) {
    const s = String(src || '');
    if (/\bexport\s+default\b/.test(s) || /\bmodule\.exports\s*=\s*(?:function|class|\{?\s*[A-Za-z_$])/.test(s)) {
      // module.exports = { a, b } reads as named; only treat bare assignment as default.
      if (/\bexport\s+default\b/.test(s)) return 'default';
      if (/\bmodule\.exports\s*=\s*\{/.test(s)) return 'named';
      return 'default';
    }
    if (/\bexport\s+(?:const|let|var|function|class|async\s+function|\{|type|interface|enum)\b/.test(s)
      || /\bmodule\.exports\s*=\s*\{/.test(s) || /\bexports\.[A-Za-z_$]/.test(s)) {
      return 'named';
    }
    return 'other';
  }

  /** Detect the test framework in use from manifests + source heuristics. */
  function _detectTestFramework(cwd, files) {
    const deps = {};
    try {
      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
      Object.assign(deps, pkg.dependencies, pkg.devDependencies);
    } catch (_) {}
    for (const fw of ['vitest', 'jest', 'mocha', 'ava', 'jasmine']) {
      if (deps[fw]) return fw;
    }
    // Python: pytest in requirements / pyproject.
    for (const manifest of ['requirements.txt', 'requirements-dev.txt', 'pyproject.toml', 'setup.cfg']) {
      try {
        const raw = fs.readFileSync(path.join(cwd, manifest), 'utf8');
        if (/\bpytest\b/.test(raw)) return 'pytest';
        if (/\bunittest\b/.test(raw)) return 'unittest';
      } catch (_) {}
    }
    // Fallback: infer from test file contents.
    for (const f of files) {
      if (!/\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.py$/.test(f)) continue;
      let src = '';
      try { src = fs.readFileSync(f, 'utf8'); } catch (_) { continue; }
      if (/\bvi\.(fn|mock|spyOn)\b|from ['"]vitest['"]/.test(src)) return 'vitest';
      if (/\bjest\.(fn|mock|spyOn)\b/.test(src)) return 'jest';
      if (/\bimport pytest\b|@pytest\./.test(src)) return 'pytest';
      if (/\bdescribe\(|\bit\(/.test(src)) return 'mocha/jest-style';
    }
    return null;
  }

  /**
   * Extract repo coding conventions for the scoped languages (TS/JS/Python).
   * @param {string} cwd repo root
   * @param {string[]} files absolute paths to source files (e.g. from buildFileList)
   * @returns {{ fileNaming: object, exportStyle: object, testFramework: string|null,
   *             scope: string[], scannedFiles: number }}
   */
  function extractConventions(cwd, files) {
    const scoped = (files || []).filter((f) => SCOPED_EXTS.has(path.extname(f).toLowerCase()));
    const namingLabels = [];
    const namingRefs = [];
    const exportLabels = [];
    const exportRefs = [];
    for (const f of scoped) {
      const base = path.basename(f);
      // Skip test files for the naming convention (they have their own naming).
      if (!/\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.py$/.test(f)) {
        namingLabels.push(classifyNaming(base));
        namingRefs.push(base);
      }
      if (JS_TS_EXTS.has(path.extname(f).toLowerCase())) {
        let src = '';
        try { src = fs.readFileSync(f, 'utf8'); } catch (_) {}
        exportLabels.push(_jsExportStyle(src));
        exportRefs.push(base);
      }
    }
    return {
      fileNaming: scoreConvention(namingLabels, namingRefs),
      exportStyle: scoreConvention(exportLabels, exportRefs),
      testFramework: _detectTestFramework(cwd, scoped),
      scope: ['typescript', 'javascript', 'python'],
      scannedFiles: scoped.length,
    };
  }

  module.exports = { classifyNaming, scoreConvention, extractConventions };
  
};

// ── ./src/conventions/fix ──
__factories["./src/conventions/fix"] = function(module, exports) {
  
  /**
   * Convention fix list (IMPL.md §4 — `conventions --fix`).
   *
   * The complete, actionable rename checklist: every scoped source file whose
   * name doesn't match the dominant file-naming convention, with full from→to
   * paths. Distinct from `--conflicts` (a diagnostic summary with up to 3 example
   * basenames) — `--fix` lists *every* offending file with its real path, ready
   * to paste into a task or PR. Pure, zero-dependency, bundle-safe.
   */

  const path = require('path');
  const { classifyNaming } = __require('./src/conventions/extract');
  const { toNamingStyle } = __require('./src/conventions/conflicts');

  const JS_TS_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs']);
  const PY_EXTS = new Set(['.py']);
  const SCOPED_EXTS = new Set([...JS_TS_EXTS, ...PY_EXTS]);

  const TEST_RE = /\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.py$/;

  /** Rename a file path's basename to the target naming style (keep dir + ext). */
  function _renamePath(relPath, style) {
    const dir = relPath.includes('/') ? relPath.slice(0, relPath.lastIndexOf('/') + 1) : '';
    const base = relPath.includes('/') ? relPath.slice(relPath.lastIndexOf('/') + 1) : relPath;
    const dot = base.indexOf('.');
    const stem = dot > 0 ? base.slice(0, dot) : base;
    const ext = dot > 0 ? base.slice(dot) : '';
    return `${dir}${toNamingStyle(stem, style)}${ext}`;
  }

  /**
   * Build the exhaustive rename checklist for the dominant file-naming convention.
   * @param {string} cwd repo root (for relative paths)
   * @param {string[]} files absolute source paths (e.g. from buildFileList)
   * @param {object} conventions an `extractConventions` result (for the dominant style)
   * @returns {{ dominant: string|null, renames: Array<{from:string,to:string,fromStyle:string}>, count: number }}
   */
  function buildFixList(cwd, files, conventions) {
    const dominant = conventions && conventions.fileNaming && conventions.fileNaming.dominant;
    if (!dominant) return { dominant: null, renames: [], count: 0 };

    const renames = [];
    for (const f of files || []) {
      if (!SCOPED_EXTS.has(path.extname(f).toLowerCase())) continue;
      if (TEST_RE.test(f)) continue;
      const base = path.basename(f);
      const style = classifyNaming(base);
      // Skip unclassifiable ('other') and style-neutral single-word names — a
      // single lowercase word already satisfies any convention, so renaming it
      // (e.g. user.js → user.js) is a no-op at best and noise at worst.
      if (style === 'other' || style === 'single-word' || style === dominant) continue;
      const rel = path.relative(cwd, f).replace(/\\/g, '/');
      renames.push({ from: rel, to: _renamePath(rel, dominant), fromStyle: style });
    }
    renames.sort((a, b) => a.from.localeCompare(b.from));
    return { dominant, renames, count: renames.length };
  }

  module.exports = { buildFixList };
  
};

// ── ./src/conventions/inject ──
__factories["./src/conventions/inject"] = function(module, exports) {
  
  /**
   * CLAUDE.md convention injection (IMPL.md §7 Phase 2 / §8 step 5).
   *
   * Renders the conventions detected by `extractConventions` into a
   * marker-delimited markdown block and injects it into CLAUDE.md so an agent
   * reading the file plans grounded in the repo's house style. Idempotent and
   * marker-scoped — it never touches human content or the `## Auto-generated
   * signatures` block. Pure string transforms; zero-dependency, bundle-safe.
   */

  const START = '<!-- sigmap-conventions:start -->';
  const END = '<!-- sigmap-conventions:end -->';

  const TIER_NOTE = {
    consistent: 'consistent — match it',
    mostly: 'dominant, with some drift',
    inconsistent: 'no clear convention — check neighboring files',
  };

  const NAMES = {
    fileNaming: 'File naming',
    exportStyle: 'Export style',
  };

  const _pct = (n) => `${Math.round(n * 100)}%`;

  function _conventionLine(label, conv) {
    if (!conv || conv.total === 0 || !conv.dominant) return null;
    const note = TIER_NOTE[conv.tier] || conv.tier;
    let line = `- **${label}:** ${conv.dominant} (${_pct(conv.dominantPct)} — ${note}).`;
    const others = conv.variants.slice(1).filter((v) => v.pct > 0);
    if (others.length) {
      line += ` Variants: ${others.map((v) => `${v.label} ${_pct(v.pct)}`).join(', ')}.`;
    }
    return line;
  }

  /**
   * Render the conventions block (including its start/end markers).
   * @param {object} result an `extractConventions` result
   * @param {string} [version] SigMap version for the footer
   * @returns {string}
   */
  function renderConventionsBlock(result, version) {
    const lines = [];
    for (const key of ['fileNaming', 'exportStyle']) {
      const l = _conventionLine(NAMES[key], result && result[key]);
      if (l) lines.push(l);
    }
    if (result && result.testFramework) {
      lines.push(`- **Test framework:** ${result.testFramework}.`);
    }

    const body = lines.length
      ? lines
      : ['- No conventions detected yet (run `sigmap conventions` on a TS/JS/Python repo).'];

    const ver = version ? ` v${version}` : '';
    return [
      START,
      '## Conventions (auto-detected by SigMap)',
      '',
      'Match these when writing or editing code (TS/JS/Python):',
      '',
      ...body,
      '',
      `<sub>Generated by SigMap${ver} · run \`sigmap conventions --inject\` to refresh.</sub>`,
      END,
    ].join('\n');
  }

  /**
   * Inject (or replace) the conventions block in existing CLAUDE.md content.
   * Replaces an existing marked block in place; appends one when absent.
   * Idempotent — never touches content outside the markers.
   * @param {string} existing current file content ('' if the file is new)
   * @param {string} block the block returned by `renderConventionsBlock`
   * @returns {string}
   */
  function injectConventions(existing, block) {
    const src = String(existing || '');
    const startIdx = src.indexOf(START);
    if (startIdx !== -1) {
      const endIdx = src.indexOf(END, startIdx);
      if (endIdx !== -1) {
        const before = src.slice(0, startIdx);
        const after = src.slice(endIdx + END.length);
        return before + block + after;
      }
    }
    if (src.trim() === '') return block + '\n';
    const sep = src.endsWith('\n') ? '\n' : '\n\n';
    return src + sep + block + '\n';
  }

  module.exports = { renderConventionsBlock, injectConventions, START, END };
  
};

// ── ./src/conventions/report ──
__factories["./src/conventions/report"] = function(module, exports) {
  
  /**
   * Convention audit + trend (IMPL.md §4 — `conventions --report`).
   *
   * Turns an `extractConventions` result into an audit: a consistency score per
   * convention plus a single file-count-weighted overall score, each with a delta
   * vs the previous run (the trend). Pure, zero-dependency, bundle-safe.
   */

  const NAMES = { fileNaming: 'file naming', exportStyle: 'export style' };

  /** File-count-weighted mean of the scored conventions' dominant shares (0–1). */
  function overallScore(result) {
    let num = 0;
    let den = 0;
    for (const key of ['fileNaming', 'exportStyle']) {
      const c = result && result[key];
      if (c && c.total > 0) { num += c.dominantPct * c.total; den += c.total; }
    }
    return den > 0 ? num / den : 0;
  }

  /**
   * Build a consistency report with trend vs a prior snapshot.
   * @param {object} result an `extractConventions` result
   * @param {object|null} [prior] a previous snapshot (this module's `snapshot` shape)
   * @returns {{ conventions: object[], testFramework: string|null,
   *   score: number, prevScore: number|null, scoreDelta: number|null }}
   */
  function scoreReport(result, prior) {
    const conventions = [];
    for (const key of ['fileNaming', 'exportStyle']) {
      const c = (result && result[key]) || { dominant: null, dominantPct: 0, total: 0, tier: 'unknown' };
      const priorPct = prior && prior[key] && typeof prior[key].dominantPct === 'number' ? prior[key].dominantPct : null;
      conventions.push({
        key,
        name: NAMES[key] || key,
        dominant: c.dominant,
        dominantPct: c.dominantPct,
        tier: c.tier,
        total: c.total,
        delta: priorPct == null ? null : c.dominantPct - priorPct,
      });
    }
    const score = overallScore(result);
    const prevScore = prior && typeof prior.score === 'number' ? prior.score : null;
    return {
      conventions,
      testFramework: (result && result.testFramework) || null,
      score,
      prevScore,
      scoreDelta: prevScore == null ? null : score - prevScore,
    };
  }

  /**
   * A compact, persistable snapshot of a run (one line in the history log).
   * @param {object} result an `extractConventions` result
   * @param {string} [ts] ISO timestamp (caller supplies — keeps this pure)
   */
  function snapshot(result, ts) {
    const pick = (c) => (c && c.total > 0
      ? { dominant: c.dominant, dominantPct: c.dominantPct, tier: c.tier, total: c.total }
      : { dominant: null, dominantPct: 0, tier: 'unknown', total: 0 });
    return {
      ts: ts || null,
      fileNaming: pick(result && result.fileNaming),
      exportStyle: pick(result && result.exportStyle),
      testFramework: (result && result.testFramework) || null,
      score: overallScore(result),
    };
  }

  module.exports = { scoreReport, snapshot, overallScore };
  
};

// ── ./src/conventions/update ──
__factories["./src/conventions/update"] = function(module, exports) {
  
  /**
   * Convention incremental rescan (IMPL.md §4 — `conventions --update`).
   *
   * Avoids recomputing the conventions snapshot when nothing changed: compare the
   * source files' mtimes to the stored `.context/conventions.json` and only flag a
   * rescan when the snapshot is missing or some file is newer. Pure (fs reads
   * only), zero-dependency, bundle-safe.
   */

  const fs = require('fs');

  /**
   * Source files modified after a reference time.
   * @param {string[]} files absolute paths
   * @param {number} sinceMs epoch ms threshold
   * @returns {string[]}
   */
  function changedSince(files, sinceMs) {
    const out = [];
    for (const f of files || []) {
      try { if (fs.statSync(f).mtimeMs > sinceMs) out.push(f); } catch (_) {}
    }
    return out;
  }

  /**
   * Decide whether the conventions snapshot needs a rescan.
   * @param {string} cwd repo root (unused but kept for signature symmetry)
   * @param {string[]} files absolute source paths
   * @param {string} snapshotPath path to the stored conventions.json
   * @returns {{ snapshotExists: boolean, stale: boolean, changed: string[] }}
   */
  function planUpdate(cwd, files, snapshotPath) {
    let snapshotMs = null;
    try { snapshotMs = fs.statSync(snapshotPath).mtimeMs; } catch (_) {}
    const snapshotExists = snapshotMs != null;
    if (!snapshotExists) {
      return { snapshotExists: false, stale: true, changed: [] };
    }
    const changed = changedSince(files, snapshotMs);
    return { snapshotExists: true, stale: changed.length > 0, changed };
  }

  module.exports = { changedSince, planUpdate };
  
};

// ── ./src/create/orchestrate ──
__factories["./src/create/orchestrate"] = function(module, exports) {
  
  /**
   * create orchestrator (IMPL.md §6.2 — the capstone of the grounded-creation loop).
   *
   * Sequences the four guard stages — scaffold → verify-plan → verify-ai-output →
   * review-pr — in one pass with `n/4` numbering and a single pass/fail summary.
   * The agent does the LLM writing between stages; `create` runs the deterministic
   * guards it owns. A stage runs only when its input is present (else it is
   * skipped, which does not fail the run). Zero-dependency, bundle-safe; delegates
   * to the real stage modules.
   *
   * A run where NOTHING ran is reported as `nothingRan`, not as a pass (#767):
   * `failed === 0` is vacuously true over an empty set, so a CI step that shelled
   * out to `create` with no inputs read success from a run that verified nothing.
   *
   * The scaffold stage's proposed filenames are handed to verify-plan as
   * introductions (#666), so the pipeline's own primary use case — a plan for code
   * that does not exist yet — can reach stage 2 instead of failing on itself.
   */

  const { proposeScaffold } = __require('./src/scaffold/propose');
  const { verifyPlan } = __require('./src/plan/verify-plan');
  const { verify } = __require('./src/verify/hallucination-guard');
  const { reviewPr } = __require('./src/review/review-pr');

  const TOTAL = 4;

  /** What each stage needs in order to run — printed when nothing ran (#767). */
  const STAGE_NEEDS = {
    scaffold: '--name <module> (plus a detectable file-naming convention)',
    'verify-plan': '--plan <plan.md>',
    'verify-ai-output': '--answer <answer.md>',
    'review-pr': '--staged, or commits since --base',
  };

  /** Files a successful scaffold proposes — introductions for verify-plan. */
  function _scaffoldIntroductions(step) {
    const p = step && step.ran && step.ok && step.detail && step.detail.proposal;
    if (!p) return [];
    return [p.filename, p.testFile].filter(Boolean);
  }

  /**
   * Run the create pipeline over whatever inputs are available.
   * @param {object} ctx
   * @param {string} [ctx.task] free-text task label (echoed back)
   * @param {string} [ctx.name] module name → enables the scaffold stage
   * @param {object} [ctx.conventions] an `extractConventions` result (for scaffold)
   * @param {object} [ctx.scaffoldOpts] options forwarded to `proposeScaffold`
   * @param {string} [ctx.plan] plan markdown → enables verify-plan
   * @param {string[]} [ctx.creates] names the plan introduces, forwarded to
   *   verify-plan alongside the scaffold's own proposed filenames
   * @param {string} [ctx.answer] AI answer markdown → enables verify-ai-output
   * @param {Array<{path:string,status:string}>} [ctx.changedFiles] → enables review-pr
   * @param {string} cwd repo root
   * @returns {{ task: string|null, steps: object[], summary: object }}
   */
  function orchestrate(ctx = {}, cwd) {
    const steps = [];
    const skip = (n, name, reason) =>
      ({ n, total: TOTAL, name, ran: false, ok: null, skipped: true, reason, needs: STAGE_NEEDS[name] });

    // 1/4 — scaffold (needs a name + conventions)
    if (ctx.name && ctx.conventions) {
      const d = proposeScaffold(ctx.name, ctx.conventions, ctx.scaffoldOpts || {});
      steps.push({ n: 1, total: TOTAL, name: 'scaffold', ran: true, ok: !!d.ok, skipped: false, detail: d });
    } else {
      steps.push(skip(1, 'scaffold', 'no --name'));
    }

    // 2/4 — verify-plan (needs a plan). The scaffold's proposed files are
    // introductions, so stage 2 does not reject the files stage 1 just designed.
    if (ctx.plan != null && String(ctx.plan).trim() !== '') {
      const creates = [...(ctx.creates || []), ..._scaffoldIntroductions(steps[0])];
      const r = verifyPlan(ctx.plan, cwd, creates.length ? { creates } : {});
      steps.push({ n: 2, total: TOTAL, name: 'verify-plan', ran: true, ok: !!r.summary.ok, skipped: false, detail: r });
    } else {
      steps.push(skip(2, 'verify-plan', 'no --plan'));
    }

    // 3/4 — verify-ai-output (needs an answer)
    if (ctx.answer != null && String(ctx.answer).trim() !== '') {
      const r = verify(ctx.answer, cwd);
      steps.push({ n: 3, total: TOTAL, name: 'verify-ai-output', ran: true, ok: r.summary.total === 0, skipped: false, detail: r });
    } else {
      steps.push(skip(3, 'verify-ai-output', 'no --answer'));
    }

    // 4/4 — review-pr (needs changed files)
    if (Array.isArray(ctx.changedFiles) && ctx.changedFiles.length) {
      const r = reviewPr(ctx.changedFiles, cwd);
      steps.push({ n: 4, total: TOTAL, name: 'review-pr', ran: true, ok: !!r.summary.ok, skipped: false, detail: r });
    } else {
      steps.push(skip(4, 'review-pr', 'no changes'));
    }

    const ran = steps.filter((s) => s.ran);
    const passed = ran.filter((s) => s.ok).length;
    const failed = ran.length - passed;
    const nothingRan = ran.length === 0;
    return {
      task: ctx.task || null,
      steps,
      summary: {
        total: TOTAL,
        ran: ran.length,
        skipped: steps.length - ran.length,
        passed,
        failed,
        nothingRan,
        // A run that verified nothing is not a pass: `failed === 0` is vacuously
        // true over an empty set, which is exactly the false CI pass of #767.
        ok: !nothingRan && failed === 0,
      },
    };
  }

  module.exports = { orchestrate, TOTAL, STAGE_NEEDS };
  
};

// ── ./src/daemon/daemon ──
__factories["./src/daemon/daemon"] = function(module, exports) {
  
  /**
   * Detached watch daemon (D1).
   *
   * Runs the existing `--watch` mode as a background process so the index stays
   * fresh without holding a terminal. State lives under `.context/` (consistent
   * with session/usage): `daemon.pid` records the watcher's PID, `daemon.log`
   * captures its output.
   *
   * Zero-dependency and shell-free: the watcher is launched with
   * `spawn(process.execPath, [gen-context.js, '--watch'], { detached: true })` —
   * an arguments array, never a shell command string.
   */

  const fs = require('fs');
  const path = require('path');
  const { spawn } = require('child_process');

  module.exports = { start, stop, status, pidFile, logFile, isAlive, readPid };

  function daemonDir(cwd) {
    return path.join(cwd, '.context');
  }

  function pidFile(cwd) {
    return path.join(daemonDir(cwd), 'daemon.pid');
  }

  function logFile(cwd) {
    return path.join(daemonDir(cwd), 'daemon.log');
  }

  /** True if a process with this PID exists (signal 0 probes without killing). */
  function isAlive(pid) {
    if (!Number.isInteger(pid) || pid <= 0) return false;
    try {
      process.kill(pid, 0);
      return true;
    } catch (err) {
      // EPERM = the process exists but is owned by another user — treat as alive.
      return err.code === 'EPERM';
    }
  }

  /** Read the recorded PID, or null if the file is missing/unparseable. */
  function readPid(cwd) {
    try {
      const raw = fs.readFileSync(pidFile(cwd), 'utf8').trim();
      const pid = parseInt(raw, 10);
      return Number.isInteger(pid) && pid > 0 ? pid : null;
    } catch (_) {
      return null;
    }
  }

  function removePidFile(cwd) {
    try {
      fs.unlinkSync(pidFile(cwd));
    } catch (_) {}
  }

  /**
   * @returns {{ running: boolean, pid: number|null, pidFile: string, logFile: string }}
   */
  function status(cwd) {
    const pid = readPid(cwd);
    const running = pid != null && isAlive(pid);
    // A recorded-but-dead PID is stale — clean it up so the state stays truthful.
    if (pid != null && !running) removePidFile(cwd);
    return { running, pid: running ? pid : null, pidFile: pidFile(cwd), logFile: logFile(cwd) };
  }

  /**
   * Launch a detached `--watch` process. Idempotent: if one is already running
   * this is a no-op that reports the existing PID.
   *
   * @param {string} cwd
   * @param {{ scriptPath: string }} opts - path to gen-context.js (the CLI entry)
   * @returns {{ status: 'started'|'already', pid: number, logFile: string }}
   */
  function start(cwd, opts = {}) {
    const scriptPath = opts.scriptPath;
    if (!scriptPath) throw new Error('daemon.start requires opts.scriptPath');

    const current = status(cwd);
    if (current.running) {
      return { status: 'already', pid: current.pid, logFile: logFile(cwd) };
    }

    fs.mkdirSync(daemonDir(cwd), { recursive: true });
    const out = fs.openSync(logFile(cwd), 'a');
    try {
      const child = spawn(process.execPath, [scriptPath, '--watch'], {
        cwd,
        detached: true,
        stdio: ['ignore', out, out],
      });
      child.unref();
      fs.writeFileSync(pidFile(cwd), String(child.pid) + '\n');
      return { status: 'started', pid: child.pid, logFile: logFile(cwd) };
    } finally {
      try { fs.closeSync(out); } catch (_) {}
    }
  }

  /**
   * Stop the running watcher (SIGTERM) and clear its PID file.
   *
   * @returns {{ status: 'stopped'|'not-running'|'stale', pid?: number }}
   */
  function stop(cwd) {
    const pid = readPid(cwd);
    if (pid == null) return { status: 'not-running' };
    if (!isAlive(pid)) {
      removePidFile(cwd);
      return { status: 'stale', pid };
    }
    try {
      process.kill(pid, 'SIGTERM');
    } catch (_) {}
    removePidFile(cwd);
    return { status: 'stopped', pid };
  }
  
};

// ── ./src/deps/inventory ──
__factories["./src/deps/inventory"] = function(module, exports) {
  
  /**
   * Dependency inventory (#2a, v8.50).
   *
   * WHY THIS EXISTS
   * ---------------
   * `src/map/config-manifest.js` detected manifests but extracted nothing from
   * most of them: `pom.xml (maven) | present`, `requirements.txt (python) |
   * present`. The word "present" is not grounding. Meanwhile
   * `src/verify/lib-index.js` resolved real `name@version` pins — but only for
   * JS and Python, and only from what is installed on disk.
   *
   * This module reads DECLARED dependencies out of the manifests themselves, so
   * it works on a repo that has never been installed, in every ecosystem SigMap
   * claims to support. A model that knows `express@5.1.0` stops writing Express
   * 4 API; that is the whole point.
   *
   * Pure, zero-dependency, deterministic: no network, no clock, no child
   * processes. Rows are sorted and capped, and every cap is disclosed.
   */

  const fs = require('fs');
  const path = require('path');
  const dirListing = __require('./src/util/dir-listing');

  const MAX_DEPS_PER_MANIFEST = 400;

  // ---------------------------------------------------------------------------
  // Small readers
  // ---------------------------------------------------------------------------

  function readText(p) { try { return fs.readFileSync(p, 'utf8'); } catch (_) { return null; } }
  function readJson(p) { try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; } }
  function exists(p) { try { return fs.existsSync(p); } catch (_) { return false; } }

  /** Strip XML comments so a commented-out <dependency> is never counted. */
  function stripXmlComments(src) { return String(src).replace(/<!--[\s\S]*?-->/g, ''); }

  /** Blank `#` comments outside quotes, preserving line structure. */
  function stripHashComments(src) {
    return String(src).split('\n').map((line) => {
      let quote = null;
      for (let i = 0; i < line.length; i++) {
        const c = line[i];
        if (quote) { if (c === quote) quote = null; continue; }
        if (c === '"' || c === "'") { quote = c; continue; }
        if (c === '#') return line.slice(0, i);
      }
      return line;
    }).join('\n');
  }

  /**
   * Split a TOML document into `[table]` sections.
   *
   * Deliberately NOT a regex with a section lookahead: JavaScript has no `\Z`
   * anchor, so the obvious `(?=^\[|\Z)` silently fails to terminate the LAST
   * table in a file — which is exactly where `[dependencies.reqwest]` and
   * `[libraries]` tend to live.
   *
   * @param {string} src
   * @returns {Array<{name:string, body:string}>}
   */
  function tomlTables(src) {
    const out = [];
    let current = null;
    for (const line of stripHashComments(String(src)).split('\n')) {
      const m = /^\s*\[\[?([^\]]+?)\]\]?\s*$/.exec(line);
      if (m) {
        current = { name: m[1].trim(), lines: [] };
        out.push(current);
        continue;
      }
      if (current) current.lines.push(line);
    }
    return out.map((t) => ({ name: t.name, body: t.lines.join('\n') }));
  }

  /** Body of the first table with this exact name, or '' when absent. */
  function tomlTable(tables, name) {
    const hit = tables.find((t) => t.name === name);
    return hit ? hit.body : '';
  }

  /**
   * Quoted strings in a TOML array, matched by the OUTER quote style only.
   *
   * A naive `/["']([^"']+)["']/g` sweep splits
   * `"brotli; platform_python_implementation == 'CPython'"` at the inner single
   * quotes and reports `CPython` as a package — a phantom component that would
   * reach a vulnerability scanner as a real one.
   *
   * @param {string} body
   * @returns {string[]}
   */
  function tomlStrings(body) {
    const src = String(body || '');
    const dq = [...src.matchAll(/"([^"]*)"/g)].map((m) => m[1]);
    if (dq.length) return dq.filter(Boolean);
    return [...src.matchAll(/'([^']*)'/g)].map((m) => m[1]).filter(Boolean);
  }

  /** `key = "value"` lookup inside a table body. */
  function tomlValue(body, key) {
    const m = new RegExp(`^\\s*${key}\\s*=\\s*["']([^"']+)["']`, 'm').exec(body || '');
    return m ? m[1] : null;
  }

  /**
   * True for a constraint on the runtime/toolchain rather than on a package.
   * These have no registry entry, so they can never carry a purl.
   */
  function isPlatformRequirement(ecosystem, name) {
    const n = String(name).toLowerCase();
    if (ecosystem === 'composer') {
      return n === 'php' || n.startsWith('php-') || n.startsWith('ext-')
        || n === 'hhvm' || n.startsWith('composer-');
    }
    if (ecosystem === 'pub') return n === 'sdk' || n === 'flutter';
    return false;
  }

  function dep(ecosystem, name, version, scope, file) {
    return { ecosystem, name: String(name).trim(), version: version ? String(version).trim() : '', scope, file };
  }

  // ---------------------------------------------------------------------------
  // npm / package.json
  // ---------------------------------------------------------------------------

  const NPM_SCOPES = [
    ['dependencies', 'runtime'],
    ['devDependencies', 'dev'],
    ['peerDependencies', 'peer'],
    ['optionalDependencies', 'optional'],
  ];

  function npmDeps(cwd, rel, out) {
    const pkg = readJson(path.join(cwd, rel));
    if (!pkg) return null;
    for (const [key, scope] of NPM_SCOPES) {
      const block = pkg[key];
      if (!block || typeof block !== 'object') continue;
      for (const [name, version] of Object.entries(block)) {
        out.push(dep('npm', name, version, scope, rel));
      }
    }
    return { name: pkg.name || null, version: pkg.version || null };
  }

  /**
   * Exact installed versions from package-lock.json — the version the code
   * actually runs against, which a `^5.1.0` range does not tell you.
   * @returns {Map<string,string>} bare package name → resolved version
   */
  function npmLockVersions(cwd) {
    const out = new Map();
    const lock = readJson(path.join(cwd, 'package-lock.json'));
    if (!lock) return out;
    // lockfileVersion 2/3: `packages` keyed by "node_modules/<name>".
    if (lock.packages && typeof lock.packages === 'object') {
      for (const [key, meta] of Object.entries(lock.packages)) {
        if (!key || !meta || !meta.version) continue;
        const m = /(?:^|\/)node_modules\/(.+)$/.exec(key);
        if (!m) continue;
        if (!out.has(m[1])) out.set(m[1], meta.version);
      }
    }
    // lockfileVersion 1: flat `dependencies` map.
    if (out.size === 0 && lock.dependencies && typeof lock.dependencies === 'object') {
      for (const [name, meta] of Object.entries(lock.dependencies)) {
        if (meta && meta.version) out.set(name, meta.version);
      }
    }
    return out;
  }

  // ---------------------------------------------------------------------------
  // Python
  // ---------------------------------------------------------------------------

  const REQ_LINE = /^\s*([A-Za-z0-9._-]+)\s*(\[[^\]]*\])?\s*((?:[<>=!~^]=?|===)\s*[^;,\s]+(?:\s*,\s*(?:[<>=!~^]=?|===)\s*[^;,\s]+)*)?/;

  function requirementsDeps(cwd, rel, out) {
    const src = readText(path.join(cwd, rel));
    if (src == null) return false;
    for (const raw of stripHashComments(src).split('\n')) {
      const line = raw.trim();
      // Skip blanks, pip flags (-r, -e, --index-url) and direct URLs.
      if (!line || line.startsWith('-') || /^[a-z+]+:\/\//i.test(line)) continue;
      const m = REQ_LINE.exec(line);
      if (!m || !m[1]) continue;
      out.push(dep('pypi', m[1], (m[3] || '').replace(/\s+/g, ''), 'runtime', rel));
    }
    return true;
  }

  /** `[project] dependencies` (PEP 621) and `[tool.poetry.dependencies]`. */
  function pyprojectDeps(cwd, rel, out) {
    const src = readText(path.join(cwd, rel));
    if (src == null) return null;
    const tables = tomlTables(src);
    const project = tomlTable(tables, 'project');
    const poetryMeta = tomlTable(tables, 'tool.poetry');
    const name = tomlValue(project, 'name') || tomlValue(poetryMeta, 'name');
    const version = tomlValue(project, 'version') || tomlValue(poetryMeta, 'version');

    const pushSpec = (raw, scope) => {
      // PEP 508 environment marker: "brotli; platform_python_implementation == 'CPython'".
      // Everything after `;` is a condition, not part of the requirement.
      const spec = REQ_LINE.exec(String(raw).split(';')[0].trim());
      if (spec && spec[1]) out.push(dep('pypi', spec[1], (spec[3] || '').replace(/\s+/g, ''), scope, rel));
    };

    // PEP 621: dependencies = ["requests>=2", "flask==3.0"]
    const arr = /dependencies\s*=\s*\[([\s\S]*?)\]/.exec(project);
    if (arr) for (const q of tomlStrings(arr[1])) pushSpec(q, 'runtime');

    // PEP 621 extras: [project.optional-dependencies] with one array per extra.
    const optional = tomlTable(tables, 'project.optional-dependencies');
    if (optional) {
      for (const m of optional.matchAll(/=\s*\[([\s\S]*?)\]/g)) {
        for (const q of tomlStrings(m[1])) pushSpec(q, 'optional');
      }
    }

    // Poetry: name = "^1.2" or name = { version = "1.2", ... } per table.
    for (const t of tables) {
      if (!/^tool\.poetry\.(dev-)?dependencies$/.test(t.name)
        && !/^tool\.poetry\.group\.[^.]+\.dependencies$/.test(t.name)) continue;
      const scope = /dev-dependencies|group\.(dev|test)\./.test(t.name) ? 'dev' : 'runtime';
      for (const m of t.body.matchAll(/^\s*([A-Za-z0-9._-]+)\s*=\s*(.+)$/gm)) {
        if (m[1] === 'python') continue;
        const v = m[2].trim();
        const inline = v.startsWith('{')
          ? (v.match(/version\s*=\s*["']([^"']+)["']/) || [])[1] || ''
          : v.replace(/^["']|["']$/g, '');
        out.push(dep('pypi', m[1], inline, scope, rel));
      }
    }
    return { name, version };
  }

  // ---------------------------------------------------------------------------
  // Maven / Gradle
  // ---------------------------------------------------------------------------

  /**
   * Maven coordinates, with `${property}` placeholders resolved against the
   * POM's own <properties> block — unresolved `${jackson.version}` strings are
   * exactly as useless as the "present" this replaces.
   */
  function mavenDeps(cwd, rel, out) {
    const raw = readText(path.join(cwd, rel));
    if (raw == null) return null;
    const src = stripXmlComments(raw);

    const props = new Map();
    const propBlock = src.match(/<properties>([\s\S]*?)<\/properties>/);
    if (propBlock) {
      for (const m of propBlock[1].matchAll(/<([A-Za-z0-9._-]+)>([^<]*)<\/\1>/g)) props.set(m[1], m[2].trim());
    }
    const resolve = (v) => String(v || '').replace(/\$\{([^}]+)\}/g, (full, key) => (props.has(key) ? props.get(key) : full));

    // Project identity is the POM's OWN coordinates. Slicing "everything before
    // <dependencies>" took the FIRST artifactId in that span, which is the
    // <parent>'s whenever one is declared — so every Spring Boot POM reported
    // `spring-boot-starter-parent` as the project (#747). Maven's own rule is
    // that a child inherits groupId/version from its parent but never the
    // artifactId, so the parent block is read only as a fallback.
    const parentBlock = (src.match(/<parent>([\s\S]*?)<\/parent>/) || [])[1] || '';
    const withoutParent = src.replace(/<parent>[\s\S]*?<\/parent>/, '');
    const headEnd = withoutParent.search(/<dependencies>|<dependencyManagement>|<modules>|<build>/);
    const head = headEnd === -1 ? withoutParent : withoutParent.slice(0, headEnd);
    const pick = (block, tag) => ((block.match(new RegExp(`<${tag}>([^<]+)</${tag}>`)) || [])[1] || '').trim();
    const artifactId = pick(head, 'artifactId') || null;
    const version = resolve(pick(head, 'version') || pick(parentBlock, 'version')) || null;

    // <dependencyManagement> declares VERSION CONSTRAINTS, not dependencies. It
    // was being scanned as if it did, so managed-only coordinates were reported
    // as runtime dependencies and leaked into `sigmap sbom` (#747).
    const declared = src.replace(/<dependencyManagement>[\s\S]*?<\/dependencyManagement>/g, '');

    for (const block of declared.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g)) {
      const body = block[1];
      const g = (body.match(/<groupId>([^<]+)<\/groupId>/) || [])[1];
      const a = (body.match(/<artifactId>([^<]+)<\/artifactId>/) || [])[1];
      if (!g || !a) continue;
      const v = resolve((body.match(/<version>([^<]+)<\/version>/) || [])[1] || '');
      const s = ((body.match(/<scope>([^<]+)<\/scope>/) || [])[1] || 'compile').trim().toLowerCase();
      // `provided`/`system` are compile-time only and are NOT shipped — the exact
      // distinction an SBOM consumer needs, and it was collapsed into `runtime`.
      // `import` is a BOM pointer rather than a dependency at all.
      if (s === 'import') continue;
      const scope = s === 'test' ? 'test' : (s === 'provided' || s === 'system') ? 'build' : 'runtime';
      out.push(dep('maven', `${g.trim()}:${a.trim()}`, v, scope, rel));
    }
    return { name: artifactId, version };
  }

  const GRADLE_CONFIGS = 'implementation|api|compileOnly|runtimeOnly|testImplementation|testCompileOnly|testRuntimeOnly|annotationProcessor|kapt|ksp|classpath';

  /**
   * Gradle's own version variables, so `"g:a:${someVersion}"` resolves.
   *
   * Maven `${property}` placeholders were resolved from the start; Gradle's were
   * not, which left real coordinates carrying a literal `${webjarsBootstrapVersion}`
   * — the same uselessness the Maven resolution exists to prevent. Covers the
   * three forms that appear in practice: `ext.NAME = "v"`, an `ext { NAME = "v" }`
   * block, and `gradle.properties`.
   *
   * @param {string} cwd
   * @param {string} src - the build script, comments already stripped
   * @returns {Map<string,string>}
   */
  function gradleVars(cwd, src) {
    const vars = new Map();

    // gradle.properties — plain key=value, and the conventional place for these.
    const props = readText(path.join(cwd, 'gradle.properties'));
    if (props) {
      for (const m of stripHashComments(props).matchAll(/^\s*([A-Za-z_][\w.-]*)\s*=\s*(.+)$/gm)) {
        vars.set(m[1], m[2].trim().replace(/^["']|["']$/g, ''));
      }
    }

    // ext.NAME = "value"  /  def NAME = "value"  /  NAME = "value" inside ext { }
    for (const m of src.matchAll(/(?:^|\n)\s*(?:ext\.|def\s+)([A-Za-z_]\w*)\s*=\s*["']([^"']+)["']/g)) {
      vars.set(m[1], m[2]);
    }
    const extBlock = /(?:^|\n)\s*ext\s*\{([\s\S]*?)\n\s*\}/.exec(src);
    if (extBlock) {
      for (const m of extBlock[1].matchAll(/^\s*([A-Za-z_]\w*)\s*=\s*["']([^"']+)["']/gm)) {
        vars.set(m[1], m[2]);
      }
    }
    return vars;
  }

  function gradleDeps(cwd, rel, out) {
    const src = readText(path.join(cwd, rel));
    if (src == null) return false;
    const clean = src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
    const vars = gradleVars(cwd, clean);
    // `${name}` and the bare `$name` form Groovy also accepts.
    const resolve = (v) => String(v || '')
      .replace(/\$\{([^}]+)\}/g, (full, key) => (vars.has(key.trim()) ? vars.get(key.trim()) : full))
      .replace(/\$([A-Za-z_]\w*)/g, (full, key) => (vars.has(key) ? vars.get(key) : full));

    const re = new RegExp(`\\b(${GRADLE_CONFIGS})\\s*[( ]\\s*["']([^"']+)["']`, 'g');
    for (const m of clean.matchAll(re)) {
      const scope = /^test/.test(m[1]) ? 'test' : 'runtime';
      const parts = m[2].split(':');
      if (parts.length >= 2) {
        out.push(dep('maven', `${parts[0]}:${parts[1]}`, resolve(parts[2] || ''), scope, rel));
      }
    }
    return true;
  }

  /** Gradle version catalog: [libraries] entries in gradle/libs.versions.toml. */
  function versionCatalogDeps(cwd, rel, out) {
    const src = readText(path.join(cwd, rel));
    if (src == null) return false;
    const tables = tomlTables(src);

    const versions = new Map();
    for (const m of tomlTable(tables, 'versions').matchAll(/^\s*([A-Za-z0-9._-]+)\s*=\s*["']([^"']+)["']/gm)) {
      versions.set(m[1], m[2]);
    }

    for (const m of tomlTable(tables, 'libraries').matchAll(/^\s*([A-Za-z0-9._-]+)\s*=\s*(.+)$/gm)) {
      const body = m[2];
      let coord = (body.match(/module\s*=\s*["']([^"']+)["']/) || [])[1];
      if (!coord) {
        const g = (body.match(/group\s*=\s*["']([^"']+)["']/) || [])[1];
        const a = (body.match(/\bname\s*=\s*["']([^"']+)["']/) || [])[1];
        if (g && a) coord = `${g}:${a}`;
      }
      if (!coord) {
        const plain = /^\s*["']([^"':]+:[^"':]+)(?::([^"']+))?["']\s*$/.exec(body);
        if (plain) coord = plain[1];
      }
      if (!coord) continue;
      const ref = (body.match(/version\.ref\s*=\s*["']([^"']+)["']/) || [])[1];
      const lit = (body.match(/\bversion\s*=\s*["']([^"']+)["']/) || [])[1];
      out.push(dep('maven', coord, ref ? (versions.get(ref) || '') : (lit || ''), 'runtime', rel));
    }
    return true;
  }

  // ---------------------------------------------------------------------------
  // Go / Rust / Ruby / PHP / .NET / Dart
  // ---------------------------------------------------------------------------

  function goDeps(cwd, rel, out) {
    const src = readText(path.join(cwd, rel));
    if (src == null) return null;
    const clean = src.replace(/^\s*\/\/.*$/gm, '');
    const moduleName = (clean.match(/^module\s+(\S+)/m) || [])[1] || null;
    const goVersion = (clean.match(/^go\s+(\S+)/m) || [])[1] || null;

    for (const block of clean.matchAll(/^require\s*\(([\s\S]*?)^\)/gm)) {
      for (const line of block[1].split('\n')) {
        const m = /^\s*(\S+)\s+(v\S+)/.exec(line);
        if (m) out.push(dep('go', m[1], m[2], /\/\/\s*indirect/.test(line) ? 'indirect' : 'runtime', rel));
      }
    }
    for (const m of clean.matchAll(/^require\s+(\S+)\s+(v\S+)/gm)) {
      out.push(dep('go', m[1], m[2], 'runtime', rel));
    }
    return { name: moduleName, version: goVersion ? `go ${goVersion}` : null };
  }

  function cargoDeps(cwd, rel, out) {
    const src = readText(path.join(cwd, rel));
    if (src == null) return null;
    const tables = tomlTables(src);
    const pkg = tomlTable(tables, 'package');

    const SCOPES = { dependencies: 'runtime', 'dev-dependencies': 'dev', 'build-dependencies': 'build' };
    for (const t of tables) {
      // Flat table: [dependencies] with one key per crate.
      if (SCOPES[t.name]) {
        for (const m of t.body.matchAll(/^\s*([A-Za-z0-9._-]+)\s*=\s*(.+)$/gm)) {
          const v = m[2].trim();
          const ver = v.startsWith('{')
            ? (v.match(/version\s*=\s*["']([^"']+)["']/) || [])[1] || ''
            : v.replace(/^["']|["']$/g, '');
          out.push(dep('cargo', m[1], ver, SCOPES[t.name], rel));
        }
        continue;
      }
      // Sub-table: [dependencies.reqwest] — the form the old regex could not
      // terminate when it was the last table in the file.
      const sub = /^(dependencies|dev-dependencies|build-dependencies)\.(.+)$/.exec(t.name);
      if (sub) out.push(dep('cargo', sub[2], tomlValue(t.body, 'version') || '', SCOPES[sub[1]], rel));
    }
    return { name: tomlValue(pkg, 'name'), version: tomlValue(pkg, 'version') };
  }

  function gemfileDeps(cwd, rel, out) {
    const src = readText(path.join(cwd, rel));
    if (src == null) return false;
    const clean = stripHashComments(src);
    let group = 'runtime';
    for (const line of clean.split('\n')) {
      const g = /^\s*group\s+([^d]*?)\s*do/.exec(line);
      if (g) group = /test|development/.test(g[1]) ? 'dev' : 'runtime';
      if (/^\s*end\s*$/.test(line)) group = 'runtime';
      const m = /^\s*gem\s+["']([^"']+)["']\s*(?:,\s*["']([^"']+)["'])?/.exec(line);
      if (m) out.push(dep('rubygems', m[1], m[2] || '', group, rel));
    }
    return true;
  }

  function composerDeps(cwd, rel, out) {
    const json = readJson(path.join(cwd, rel));
    if (!json) return null;
    for (const [key, scope] of [['require', 'runtime'], ['require-dev', 'dev']]) {
      const block = json[key];
      if (!block || typeof block !== 'object') continue;
      for (const [name, version] of Object.entries(block)) {
        const row = dep('composer', name, version, scope, rel);
        // `php`, `ext-mbstring`, `composer-runtime-api` are platform constraints,
        // not packages: they have no registry entry and no purl. Kept in the
        // inventory (the PHP version bound is useful grounding) but flagged so
        // the SBOM does not emit them as library components.
        if (isPlatformRequirement('composer', name)) row.platform = true;
        out.push(row);
      }
    }
    return { name: json.name || null, version: json.version || null };
  }

  function csprojDeps(cwd, rel, out) {
    const raw = readText(path.join(cwd, rel));
    if (raw == null) return false;
    const src = stripXmlComments(raw);
    for (const m of src.matchAll(/<PackageReference\s+([^>]*?)\/?>/g)) {
      const attrs = m[1];
      const name = (attrs.match(/Include\s*=\s*"([^"]+)"/) || [])[1];
      if (!name) continue;
      out.push(dep('nuget', name, (attrs.match(/Version\s*=\s*"([^"]+)"/) || [])[1] || '', 'runtime', rel));
    }
    return true;
  }

  function pubspecDeps(cwd, rel, out) {
    const src = readText(path.join(cwd, rel));
    if (src == null) return null;
    const clean = stripHashComments(src);
    const name = (clean.match(/^name:\s*(\S+)/m) || [])[1] || null;
    const version = (clean.match(/^version:\s*(\S+)/m) || [])[1] || null;

    // Walked line by line: a regex block match cannot reliably terminate the
    // final section of the file, and dev_dependencies is usually last.
    let scope = null;
    for (const line of clean.split('\n')) {
      const section = /^(dev_dependencies|dependencies|dependency_overrides):\s*$/.exec(line);
      if (section) { scope = section[1] === 'dependencies' ? 'runtime' : 'dev'; continue; }
      if (/^\S/.test(line)) { scope = null; continue; }
      if (!scope) continue;
      const m = /^\s{2}([A-Za-z0-9._-]+):\s*(.*)$/.exec(line);
      if (!m || m[1] === 'sdk' || m[1] === 'flutter') continue;
      out.push(dep('pub', m[1], m[2].trim().replace(/^["']|["']$/g, ''), scope, rel));
    }
    return { name, version };
  }

  // ---------------------------------------------------------------------------
  // Aggregation
  // ---------------------------------------------------------------------------

  /**
   * Every manifest this module knows how to read, in a stable order.
   * `parse` pushes dep rows and may return `{ name, version }` project identity.
   */
  const MANIFESTS = [
    { file: 'package.json', ecosystem: 'npm', label: 'npm', parse: npmDeps },
    { file: 'requirements.txt', ecosystem: 'pypi', label: 'python', parse: requirementsDeps },
    { file: 'pyproject.toml', ecosystem: 'pypi', label: 'python', parse: pyprojectDeps },
    { file: 'pom.xml', ecosystem: 'maven', label: 'maven', parse: mavenDeps },
    { file: 'build.gradle', ecosystem: 'maven', label: 'gradle', parse: gradleDeps },
    { file: 'build.gradle.kts', ecosystem: 'maven', label: 'gradle', parse: gradleDeps },
    { file: 'gradle/libs.versions.toml', ecosystem: 'maven', label: 'gradle catalog', parse: versionCatalogDeps },
    { file: 'go.mod', ecosystem: 'go', label: 'go', parse: goDeps },
    { file: 'Cargo.toml', ecosystem: 'cargo', label: 'rust', parse: cargoDeps },
    { file: 'Gemfile', ecosystem: 'rubygems', label: 'ruby', parse: gemfileDeps },
    { file: 'composer.json', ecosystem: 'composer', label: 'php', parse: composerDeps },
    { file: 'pubspec.yaml', ecosystem: 'pub', label: 'dart', parse: pubspecDeps },
  ];

  /** Locate a single `*.csproj` at the repo root, if one exists. */
  function findCsproj(cwd) {
    try {
      return fs.readdirSync(cwd).filter((f) => f.endsWith('.csproj')).sort()[0] || null;
    } catch (_) { return null; }
  }

  /**
   * Read every manifest at the repo root into a flat dependency inventory.
   *
   * @param {string} cwd - project root
   * @param {object} [opts]
   * @param {boolean} [opts.resolve=true] - fold exact package-lock versions in
   * @returns {{
   *   deps: Array<{ecosystem:string,name:string,version:string,resolved?:string,scope:string,file:string}>,
   *   manifests: Array<{file:string,label:string,ecosystem:string,name:string|null,version:string|null,count:number}>,
   *   ecosystems: string[],
   *   truncated: number
   * }}
   */

  /** Directories a manifest walk must never descend into. */
  const MANIFEST_SKIP_DIRS = new Set([
    'node_modules', 'target', 'build', 'dist', 'out', 'vendor', '.git', '.svn',
    '.hg', '.venv', 'venv', '__pycache__', '.gradle', '.idea', '.vscode',
    'coverage', '.next', '.nuxt', '.context', 'bin', 'obj',
    // Fixture trees hold manifests that describe a TEST CASE, not this project's
    // dependencies — sigmap's own `test/fixtures/pom.xml` was being reported as a
    // spring-petclinic dependency set.
    'fixtures', '__fixtures__', 'testdata', 'test-fixtures', '__snapshots__',
  ]);

  /** How deep the manifest walk descends, and how many manifests it will take. */
  const MANIFEST_MAX_DEPTH = 4;
  const MANIFEST_MAX_FILES = 200;


  /**
   * Directory names the project itself excludes, read straight from its config
   * and `.contextignore`.
   *
   * Without this the walk descends into whatever the repo has deliberately kept
   * out of context — sigmap's own `benchmarks/repos/` holds 43 CLONED THIRD-PARTY
   * REPOS, and every one of their manifests was being reported as a dependency of
   * sigmap. Read directly rather than threaded through six call sites, so `deps`,
   * `sbom` and the project map all honour it.
   *
   * @param {string} cwd
   * @returns {string[]} bare directory names
   */
  function projectExcludes(cwd) {
    const names = [];
    const cfg = readJson(path.join(cwd, 'gen-context.config.json'));
    if (cfg && Array.isArray(cfg.exclude)) {
      for (const e of cfg.exclude) if (typeof e === 'string') names.push(e.replace(/\/+$/, ''));
    }
    const ignore = readText(path.join(cwd, '.contextignore'));
    if (ignore) {
      for (const raw of ignore.split('\n')) {
        const line = raw.trim();
        // Only plain directory entries — globs stay the file walker's business.
        if (!line || line.startsWith('#') || line.includes('*')) continue;
        names.push(line.replace(/\/+$/, ''));
      }
    }
    return names.filter(Boolean);
  }

  /**
   * Every manifest in the tree, not just the ones at the repo root (#747).
   *
   * Probing `cwd/<manifest>` reported NOTHING for a multi-module Maven build —
   * the normal shape for Java — because the aggregator POM at the root declares
   * `<modules>` and no `<dependencies>`, while every real dependency lives in
   * `service-<name>/pom.xml`. The same blind spot hid a nested `backend/requirements.txt`
   * and any nested `package.json` workspace.
   *
   * Bounded by depth and count so a deep monorepo cannot blow up a run, and the
   * root is always visited first so its manifests sort ahead of nested ones.
   *
   * @param {string} cwd
   * @param {object} [opts]
   * @param {string[]} [opts.exclude] extra directory names to skip
   * @returns {string[]} manifest paths relative to cwd, POSIX-separated
   */
  function findManifests(cwd, opts = {}) {
    const wanted = new Map(MANIFESTS.map((m) => [m.file, true]));
    const skip = new Set([...MANIFEST_SKIP_DIRS, ...(opts.exclude || []), ...projectExcludes(cwd)]);
    const found = [];
    const walk = (dir, relDir, depth) => {
      if (found.length >= MANIFEST_MAX_FILES || depth > MANIFEST_MAX_DEPTH) return;
      let entries;
      try { entries = dirListing.list(dir); } catch (_) { return; }
      const dirs = [];
      for (const e of entries) {
        if (e.isDirectory()) {
          if (skip.has(e.name) || e.name.startsWith('.')) continue;
          dirs.push(e.name);
          continue;
        }
        if (!e.isFile()) continue;
        const rel = relDir ? `${relDir}/${e.name}` : e.name;
        // `gradle/libs.versions.toml` is the one nested-by-name manifest.
        if (wanted.has(e.name) || wanted.has(rel)) found.push(rel);
        else if (e.name.endsWith('.csproj')) found.push(rel);
      }
      // `gradle/libs.versions.toml` lives one level down by convention.
      for (const d of dirs.sort()) {
        walk(path.join(dir, d), relDir ? `${relDir}/${d}` : d, depth + 1);
      }
    };
    walk(cwd, '', 0);
    // Root manifests first, then by the order MANIFESTS declares, then by path.
    // Callers pick project identity as "the first manifest that has a name"
    // (src/deps/sbom.js), so a plain alphabetical sort silently reassigned it —
    // `composer.json`'s `vendor/app` displaced `package.json`'s `shop`. The
    // declared order is also the meaningful one: package.json before composer.json.
    const rank = new Map(MANIFESTS.map((m, i) => [m.file, i]));
    const rankOf = (f) => {
      const base = f.split('/').pop();
      const r = rank.has(f) ? rank.get(f) : rank.get(base);
      return r === undefined ? MANIFESTS.length : r;
    };
    return found.sort((a, b) => {
      const da = a.split('/').length, db = b.split('/').length;
      if (da !== db) return da - db;
      const ra = rankOf(a), rb = rankOf(b);
      if (ra !== rb) return ra - rb;
      return a < b ? -1 : a > b ? 1 : 0;
    }).slice(0, MANIFEST_MAX_FILES);
  }

  function collectDependencies(cwd, opts = {}) {
    const deps = [];
    const manifests = [];
    let truncated = 0;

    // Resolve each discovered path back to its parser by basename (or by the
    // `gradle/libs.versions.toml` relative form, the one manifest named by path).
    const byFile = new Map(MANIFESTS.map((m) => [m.file, m]));
    const entries = [];
    for (const rel of findManifests(cwd, opts)) {
      const base = rel.split('/').pop();
      const spec = byFile.get(rel) || byFile.get(base);
      if (spec) { entries.push({ ...spec, file: rel }); continue; }
      if (base.endsWith('.csproj')) {
        entries.push({ file: rel, ecosystem: 'nuget', label: 'dotnet', parse: csprojDeps });
      }
    }

    for (const m of entries) {
      if (!exists(path.join(cwd, m.file))) continue;
      const before = deps.length;
      let identity = null;
      try { identity = m.parse(cwd, m.file, deps); } catch (_) { identity = null; }

      // Per-manifest cap, disclosed rather than silently applied.
      const produced = deps.length - before;
      if (produced > MAX_DEPS_PER_MANIFEST) {
        truncated += produced - MAX_DEPS_PER_MANIFEST;
        deps.splice(before + MAX_DEPS_PER_MANIFEST, produced - MAX_DEPS_PER_MANIFEST);
      }

      manifests.push({
        file: m.file,
        label: m.label,
        ecosystem: m.ecosystem,
        name: identity && identity.name ? identity.name : null,
        version: identity && identity.version ? identity.version : null,
        count: Math.min(produced, MAX_DEPS_PER_MANIFEST),
      });
    }

    if (opts.resolve !== false) {
      const locked = npmLockVersions(cwd);
      if (locked.size) {
        for (const d of deps) {
          if (d.ecosystem !== 'npm') continue;
          const hit = locked.get(d.name);
          if (hit) d.resolved = hit;
        }
      }
    }

    // Deterministic order: ecosystem, then name, then scope.
    deps.sort((a, b) => (a.ecosystem < b.ecosystem ? -1 : a.ecosystem > b.ecosystem ? 1
      : a.name < b.name ? -1 : a.name > b.name ? 1
        : a.scope < b.scope ? -1 : a.scope > b.scope ? 1 : 0));

    return {
      deps,
      manifests,
      ecosystems: [...new Set(manifests.map((m) => m.ecosystem))].sort(),
      truncated,
    };
  }

  /**
   * `name@version` pins for direct runtime dependencies — the densest grounding
   * that fits in an always-on context header. Prefers the exact locked version
   * over a declared range, since the range is not what the code runs against.
   *
   * @param {object} inventory - result of collectDependencies
   * @param {object} [opts]
   * @param {number} [opts.limit=40]
   * @returns {{ pins: string[], total: number }}
   */
  function versionPins(inventory, opts = {}) {
    const limit = Number.isInteger(opts.limit) && opts.limit >= 0 ? opts.limit : 40;
    const seen = new Set();
    const pins = [];
    for (const d of (inventory && inventory.deps) || []) {
      if (d.scope !== 'runtime' || d.platform) continue;
      const version = d.resolved || d.version;
      // `any` (Dart), `latest` and `*` are wildcards, not versions — pinning to
      // them would be a false precision.
      if (!version || !/\d/.test(version)) continue;
      // PyPI writes its own operator (`requests==2.31.0`); an interposed `@`
      // would produce `requests@==2.31.0`, which is not a real requirement
      // string. Every other ecosystem uses the `name@version` form.
      const pin = (d.ecosystem === 'pypi' && /^[=<>!~]/.test(version))
        ? `${d.name}${version}`
        : `${d.name}@${version}`;
      if (seen.has(pin)) continue;
      seen.add(pin);
      pins.push(pin);
    }
    pins.sort();
    return { pins: limit ? pins.slice(0, limit) : pins, total: pins.length };
  }

  module.exports = {
    findManifests,
    collectDependencies,
    isPlatformRequirement,
    versionPins,
    npmLockVersions,
    MANIFESTS,
    MAX_DEPS_PER_MANIFEST,
  };
  
};

// ── ./src/deps/sbom ──
__factories["./src/deps/sbom"] = function(module, exports) {
  
  /**
   * CycloneDX SBOM export (#2c', v8.50).
   *
   * WHY THIS AND NOT A CVE FEED
   * ---------------------------
   * The obvious ask is "tell me which dependencies have CVEs". SigMap should not
   * build that, for three reasons:
   *
   *   1. Determinism. Byte-reproducible output is the differentiator. A
   *      network-sourced vulnerability section makes two runs on the same commit
   *      disagree, which contaminates the reproducibility claim for the WHOLE
   *      artifact, not just that section.
   *   2. Liability. A stale or wrong CVE claim is worse than no claim, and it
   *      would mean owning a vulnerability feed forever.
   *   3. It is already solved. osv-scanner, Dependabot, Trivy and `npm audit`
   *      do this well and for free.
   *
   * So SigMap emits the one thing those tools need and cannot derive from a
   * signature map: a complete, deterministic component list. Pipe it onward:
   *
   *     sigmap sbom > sbom.json && osv-scanner --sbom sbom.json
   *
   * The user gets the CVE outcome; SigMap owns no database and no network code.
   *
   * Spec: CycloneDX 1.5. `serialNumber` and `metadata.timestamp` are optional in
   * the spec and are deliberately OMITTED — both would vary run to run and break
   * byte-stability for no analytic gain.
   */

  const { collectDependencies } = __require('./src/deps/inventory');

  const SPEC_VERSION = '1.5';
  const BOM_FORMAT = 'CycloneDX';

  /** SigMap ecosystem key → Package URL type (purl-spec). */
  const PURL_TYPE = {
    npm: 'npm',
    pypi: 'pypi',
    maven: 'maven',
    go: 'golang',
    cargo: 'cargo',
    rubygems: 'gem',
    composer: 'composer',
    nuget: 'nuget',
    pub: 'pub',
  };

  /**
   * CycloneDX `scope` is a three-value enum. Anything shipped to production is
   * `required`; build/dev/test tooling is `optional`.
   */
  const CDX_SCOPE = {
    runtime: 'required',
    peer: 'required',
    dev: 'optional',
    test: 'optional',
    build: 'optional',
    optional: 'optional',
    indirect: 'required',
  };

  /** True when a version string is an exact pin rather than a range. */
  function isExactVersion(v) {
    const s = String(v || '').trim();
    // A version must carry at least one digit: `any` (Dart), `latest` and `*`
    // are wildcards, and `pkg:pub/cli_util@any` is not a scannable component.
    if (!s || !/\d/.test(s)) return false;
    return !/[\^~<>=!*|\s,]/.test(s) || /^v?\d+(\.\d+)*([-+][\w.]+)*$/.test(s);
  }

  /**
   * Best-effort exact version for a declared range.
   *
   * A range has no single correct answer, so this takes the LOWER BOUND —
   * `^5.1.0` becomes `5.1.0`. That over-reports rather than under-reports
   * against a vulnerability database, which is the safer direction, and every
   * such component is counted and disclosed by `summarize` so the caller can say
   * so rather than implying a precision that is not there.
   *
   * @param {string} spec
   * @returns {string} normalized version, or '' when nothing usable is present
   */
  function normalizeVersion(spec) {
    const s = String(spec || '').trim();
    if (!s || !/\d/.test(s)) return '';
    // The leading `v` is NOT stripped: Go module versions carry it by
    // convention (`pkg:golang/...@v1.10.0`) and no other ecosystem declares one.
    if (isExactVersion(s)) return s;
    const first = s.split(/[,|]/)[0].trim();
    const m = /(\d+(?:\.\d+)*(?:[-+][\w.]+)*)/.exec(first);
    return m ? m[1] : '';
  }

  /** Percent-encode a purl path segment, keeping the `/` that separates scopes. */
  function purlEncode(segment) {
    return encodeURIComponent(String(segment)).replace(/%40/g, '%40');
  }

  /**
   * Build a Package URL for one dependency row.
   * @returns {string} purl, or '' when the ecosystem has no purl type
   */
  function purlFor(d, version) {
    const type = PURL_TYPE[d.ecosystem];
    if (!type) return '';
    const ver = version ? `@${encodeURIComponent(version)}` : '';

    if (type === 'maven') {
      // Maven coordinates are `groupId:artifactId`.
      const [group, artifact] = String(d.name).split(':');
      if (!group || !artifact) return '';
      return `pkg:maven/${purlEncode(group)}/${purlEncode(artifact)}${ver}`;
    }
    if (type === 'golang') {
      // Go module paths are already slash-separated and must stay readable.
      return `pkg:golang/${String(d.name).split('/').map(purlEncode).join('/')}${ver}`;
    }
    if (type === 'npm' && String(d.name).startsWith('@')) {
      const [scope, name] = String(d.name).split('/');
      if (!name) return '';
      return `pkg:npm/${purlEncode(scope)}/${purlEncode(name)}${ver}`;
    }
    if (type === 'composer') {
      const [vendor, name] = String(d.name).split('/');
      if (!vendor || !name) return '';
      return `pkg:composer/${purlEncode(vendor)}/${purlEncode(name)}${ver}`;
    }
    return `pkg:${type}/${purlEncode(d.name)}${ver}`;
  }

  /**
   * Build a CycloneDX 1.5 document for a repo.
   *
   * @param {string} cwd - project root
   * @param {object} [opts]
   * @param {boolean} [opts.exactOnly=false] - drop components whose version is a
   *   range rather than a pin, for callers who would rather have a short precise
   *   BOM than a long approximate one
   * @param {boolean} [opts.includeDev=true] - include dev/test/build components
   * @returns {{ bom: object, stats: { total:number, exact:number, ranged:number, unversioned:number, skipped:number } }}
   */
  function buildSbom(cwd, opts = {}) {
    const exactOnly = opts.exactOnly === true;
    const includeDev = opts.includeDev !== false;
    const inventory = collectDependencies(cwd);

    const components = [];
    const stats = { total: 0, exact: 0, ranged: 0, unversioned: 0, skipped: 0 };
    const seen = new Set();

    for (const d of inventory.deps) {
      // Platform constraints (`php`, `ext-mbstring`, Dart `sdk`) have no registry
      // entry and therefore no purl; emitting them as components gives a scanner
      // rows it can never resolve.
      if (d.platform) { stats.skipped++; continue; }
      const cdxScope = CDX_SCOPE[d.scope] || 'optional';
      if (!includeDev && cdxScope === 'optional') { stats.skipped++; continue; }

      const declared = d.resolved || d.version;
      const exact = !!d.resolved || isExactVersion(declared);
      const version = normalizeVersion(declared);

      // Count only what actually lands in the BOM, so `total` always equals
      // exact + ranged + unversioned; anything dropped is counted as skipped.
      const ranged = !exact && !!version;
      if (exactOnly && (ranged || !version)) { stats.skipped++; continue; }
      if (!version) stats.unversioned++;
      else if (exact) stats.exact++;
      else stats.ranged++;

      const purl = purlFor(d, version);
      // bom-ref must be unique; purl already is, and it keeps the doc readable.
      const ref = purl || `${d.ecosystem}:${d.name}@${version || 'unknown'}`;
      if (seen.has(ref)) continue;
      seen.add(ref);

      const component = {
        type: 'library',
        'bom-ref': ref,
        name: d.name,
        scope: cdxScope,
      };
      if (version) component.version = version;
      if (purl) component.purl = purl;

      const properties = [
        { name: 'sigmap:ecosystem', value: d.ecosystem },
        { name: 'sigmap:manifest', value: d.file },
        { name: 'sigmap:scope', value: d.scope },
      ];
      // Keep the original spec when it is not what landed in `version`, so a
      // reader can tell an inferred lower bound from a real pin.
      if (declared && declared !== version) {
        properties.push({ name: 'sigmap:versionSpec', value: declared });
      }
      if (!exact && version) {
        properties.push({ name: 'sigmap:versionInferred', value: 'lower-bound-of-range' });
      }
      component.properties = properties;

      components.push(component);
      stats.total++;
    }

    // Deterministic ordering, independent of manifest read order.
    components.sort((a, b) => (a['bom-ref'] < b['bom-ref'] ? -1 : a['bom-ref'] > b['bom-ref'] ? 1 : 0));

    // Project identity: prefer a manifest that actually names the project.
    const root = inventory.manifests.find((m) => m.name) || null;
    const metadataComponent = root
      ? { type: 'application', 'bom-ref': root.name, name: root.name, ...(root.version ? { version: root.version } : {}) }
      : { type: 'application', 'bom-ref': 'root', name: 'unknown' };

    const bom = {
      bomFormat: BOM_FORMAT,
      specVersion: SPEC_VERSION,
      version: 1,
      metadata: {
        // No `timestamp` and no `serialNumber`: both are optional in the spec and
        // both would make two runs on the same commit differ.
        tools: { components: [{ type: 'application', name: 'sigmap', publisher: 'sigmap' }] },
        component: metadataComponent,
      },
      components,
    };

    return { bom, stats };
  }

  /** Pretty-printed JSON rendering, stable across runs. */
  function formatSbom(bom) {
    return JSON.stringify(bom, null, 2);
  }

  /**
   * One-line human summary for stderr, disclosing how precise the BOM is.
   * @param {object} stats - from buildSbom
   * @returns {string[]} lines
   */
  function summarize(stats) {
    const lines = [`[sigmap] sbom: ${stats.total} component(s) — ${stats.exact} pinned`];
    if (stats.ranged > 0) {
      lines.push(`[sigmap]   ${stats.ranged} declared as a range; the lower bound was used —`);
      lines.push('[sigmap]   scanners may over-report on those. Commit a lockfile for exact pins.');
    }
    if (stats.unversioned > 0) {
      lines.push(`[sigmap]   ${stats.unversioned} with no version at all`);
    }
    if (stats.skipped > 0) {
      lines.push(`[sigmap]   ${stats.skipped} omitted by the current flags`);
    }
    lines.push('[sigmap]   scan it: osv-scanner --sbom <file>');
    return lines;
  }

  module.exports = {
    buildSbom,
    formatSbom,
    summarize,
    purlFor,
    normalizeVersion,
    isExactVersion,
    SPEC_VERSION,
    PURL_TYPE,
  };
  
};

// ── ./src/discovery/framework-detector ──
__factories["./src/discovery/framework-detector"] = function(module, exports) {
  
  const fs   = require('fs');
  const path = require('path');
  const { REGISTRY } = __require('./src/discovery/source-root-registry');

  function detectFrameworks(cwd) {
    const detected = [];
    const names = _nameSets(cwd);

    for (const [lang, reg] of Object.entries(REGISTRY)) {
      if (!reg.frameworks) continue;
      for (const [name, fw] of Object.entries(reg.frameworks)) {
        let confidence = 0;

        // Detection files: +0.95 / 0.93 / 0.90 depending on specificity
        for (const f of (fw.detectionFiles || [])) {
          if (_existsAnywhere(cwd, f, 3, names)) { confidence = Math.max(confidence, 0.93); }
        }

        // Detection deps in package.json
        if (fw.detectionDeps?.length) {
          const deps = _readDeps(cwd);
          for (const dep of fw.detectionDeps) {
            if (deps.has(dep)) { confidence = Math.max(confidence, 0.90); }
          }
        }

        // go.mod and Cargo.toml deps
        if (lang === 'go' && fw.detectionDeps?.length) {
          const goMod = _readFile(path.join(cwd, 'go.mod'));
          for (const dep of fw.detectionDeps) {
            if (goMod.includes(dep)) { confidence = Math.max(confidence, 0.90); }
          }
        }
        if (lang === 'rust' && fw.detectionDeps?.length) {
          const cargoToml = _readFile(path.join(cwd, 'Cargo.toml'));
          for (const dep of fw.detectionDeps) {
            if (cargoToml.includes(dep)) { confidence = Math.max(confidence, 0.88); }
          }
        }

        // Special rules
        if (fw.specialRule === 'django-app-dirs' && fs.existsSync(path.join(cwd, 'manage.py'))) {
          confidence = Math.max(confidence, 0.95);
        }
        if (fw.specialRule === 'swift-project-dir' && _existsAnywhere(cwd, '.xcodeproj', 2, names)) {
          confidence = Math.max(confidence, 0.90);
        }

        if (confidence > 0) detected.push({ name, language: lang, confidence });
      }
    }

    return detected.sort((a, b) => b.confidence - a.confidence);
  }

  function _readDeps(cwd) {
    try {
      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
      return new Set([...Object.keys(pkg.dependencies || {}), ...Object.keys(pkg.devDependencies || {})]);
    } catch { return new Set(); }
  }

  function _readFile(p) {
    try { return fs.readFileSync(p, 'utf8'); } catch { return ''; }
  }

  function _existsAnywhere(cwd, filename, maxDepth, names) {
    const parts = filename.split('/');
    if (parts.length > 1) return fs.existsSync(path.join(cwd, filename));
    return (names ? names.of(maxDepth) : _walkNames(cwd, maxDepth)).has(filename);
  }

  /**
   * Every entry name found by listing `depth` levels of directories under `dir`: the
   * root's entries, those of its subdirectories, and so on. A name is "found" exactly when the
   * old per-name walk (`_walkFind`) would have found it, but the tree is listed once, not once
   * for each of the ~50 names a run asks about (that was 160-340 ms on Django, #971).
   */
  function _walkNames(dir, depth, out = new Set()) {
    if (depth <= 0) return out;
    try {
      for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
        out.add(e.name);
        if (e.isDirectory() && depth > 1) _walkNames(path.join(dir, e.name), depth - 1, out);
      }
    } catch (_) { /* an unreadable directory has no names */ }
    return out;
  }

  /** The name sets of one `detectFrameworks` run, listed on first use and once per depth. */
  function _nameSets(cwd) {
    const byDepth = new Map();
    return { of(depth) { if (!byDepth.has(depth)) byDepth.set(depth, _walkNames(cwd, depth)); return byDepth.get(depth); } };
  }

  // `_walkNames` is exported for the test that holds it to the per-name walk it replaced.
  module.exports = { detectFrameworks, _walkNames };
  
};

// ── ./src/discovery/language-detector ──
__factories["./src/discovery/language-detector"] = function(module, exports) {
  
  const fs   = require('fs');
  const path = require('path');
  const { REGISTRY } = __require('./src/discovery/source-root-registry');

  module.exports = { detectLanguages };

  const SKIP_DIRS = new Set([
    'node_modules','dist','build','.git','venv','.venv','target',
    'DerivedData','Pods','.build','Carthage','coverage','.next','.nuxt',
    '__pycache__','.pytest_cache','vendor','.bundle','Carthage',
  ]);

  const EXT_TO_LANG = {
    '.js': 'javascript', '.mjs': 'javascript', '.cjs': 'javascript',
    '.ts': 'typescript', '.tsx': 'typescript', '.jsx': 'javascript',
    '.py': 'python', '.rb': 'ruby', '.go': 'go', '.rs': 'rust',
    '.java': 'java', '.kt': 'kotlin', '.cs': 'csharp', '.cpp': 'cpp',
    '.c': 'cpp', '.h': 'cpp', '.hpp': 'cpp', '.m': 'objc', '.mm': 'objc', '.swift': 'swift',
    '.dart': 'dart', '.scala': 'scala', '.php': 'php',
    '.lua': 'lua',
    '.ex': 'elixir', '.exs': 'elixir',
    '.astro': 'astro',
    '.gd': 'gdscript',
    '.r': 'r', '.R': 'r',
    '.ps1': 'powershell', '.psm1': 'powershell', '.psd1': 'powershell',
  };

  function detectLanguages(cwd) {
    const weights = {};

    // Signal 1: manifest files (+3 each)
    for (const [lang, reg] of Object.entries(REGISTRY)) {
      for (const mf of (reg.manifestFiles || [])) {
        if (fs.existsSync(path.join(cwd, mf))) {
          weights[lang] = (weights[lang] || 0) + 3;
        }
      }
    }

    // Signal 2: TypeScript dep in package.json (+2)
    try {
      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
      const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
      if (allDeps.typescript) { weights.typescript = (weights.typescript || 0) + 2; }
    } catch (_) {}

    // Signal 3: file extension count (walk depth 3, capped at +5 per language)
    const extCount = {};
    _walkDepth(cwd, 3, extCount);
    const maxCount = Math.max(1, ...Object.values(extCount));
    for (const [ext, count] of Object.entries(extCount)) {
      const lang = EXT_TO_LANG[ext];
      if (lang) {
        weights[lang] = (weights[lang] || 0) + Math.min(5, (count / maxCount) * 5);
      }
    }

    // Normalize to [0,1] and sort
    const maxW = Math.max(1, ...Object.values(weights));
    return Object.entries(weights)
      .map(([name, w]) => ({ name, weight: Math.round(w / maxW * 100) / 100 }))
      .sort((a, b) => b.weight - a.weight);
  }

  function _walkDepth(dir, depth, extCount) {
    if (depth <= 0) return;
    let entries;
    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
    for (const e of entries) {
      if (SKIP_DIRS.has(e.name)) continue;
      if (e.isDirectory()) {
        _walkDepth(path.join(dir, e.name), depth - 1, extCount);
      } else if (e.isFile()) {
        const ext = path.extname(e.name).toLowerCase();
        if (EXT_TO_LANG[ext]) extCount[ext] = (extCount[ext] || 0) + 1;
      }
    }
  }
  
};

// ── ./src/discovery/monorepo ──
__factories["./src/discovery/monorepo"] = function(module, exports) {
  
  /**
   * monorepo.js — the single monorepo verdict, with its evidence.
   *
   * SigMap had three detectors that disagreed about the same repo (#781):
   *
   *   * `_detectMonorepo` in source-root-resolver.js — marker files only
   *   * `_monorepoMarker` in config/tune.js          — a duplicate of the above
   *   * `detectMonorepoPackages` in gen-context.js   — scans the layout
   *
   * On SigMap's own repo the marker-based pair answered "no" (there is no
   * `pnpm-workspace.yaml` and no `package.json.workspaces`) while the layout scan
   * found two packages, so `roots` and `tune` told the user they were not in a
   * monorepo while `--monorepo` demonstrably processed `packages/core` and
   * `packages/cli`. `tune` therefore never proposed `monorepo: true` for a repo
   * where the mode works.
   *
   * One function answers it now, and it reports HOW it decided: a declared
   * workspace and a layout-only match are different facts, and collapsing them
   * into a bare boolean is what let the disagreement hide.
   *
   * Zero dependencies.
   */

  const fs = require('fs');
  const path = require('path');

  /** Files that DECLARE a workspace. */
  const MARKERS = ['pnpm-workspace.yaml', 'turbo.json', 'nx.json', 'lerna.json', 'melos.yaml'];

  /** Directories that conventionally hold sibling packages. */
  const MONO_ROOTS = ['packages', 'apps', 'services', 'libs', 'modules'];

  /**
   * Any of these makes a directory a package. `pubspec.yaml` (Dart) and `mix.exs`
   * (Elixir) were missing, so a pub workspace or an umbrella project was not a
   * monorepo and none of its packages was ever offered as a source root (#900).
   */
  const PKG_MANIFESTS = [
    'package.json', 'pyproject.toml', 'Cargo.toml', 'go.mod',
    'build.gradle', 'build.gradle.kts', 'pom.xml', 'requirements.txt',
    'pubspec.yaml', 'mix.exs',
  ];

  /** A layout match needs at least this many sibling packages to count. */
  const MIN_LAYOUT_PACKAGES = 2;

  /**
   * The declared-workspace marker for this repo, or null.
   * @returns {string|null} the marker's filename, for use as evidence
   */
  function workspaceMarker(cwd) {
    for (const m of MARKERS) {
      if (fs.existsSync(path.join(cwd, m))) return m;
    }
    try {
      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
      if (pkg.workspaces) return 'package.json workspaces';
    } catch (_) {}
    // Dart 3.6+ pub workspaces declare their members in the root pubspec, and an
    // Elixir umbrella project says where its apps live in the root mix.exs.
    try {
      if (/^workspace:/m.test(fs.readFileSync(path.join(cwd, 'pubspec.yaml'), 'utf8'))) return 'pubspec.yaml workspace';
    } catch (_) {}
    try {
      if (/\bapps_path:/.test(fs.readFileSync(path.join(cwd, 'mix.exs'), 'utf8'))) return 'mix.exs apps_path';
    } catch (_) {}
    return null;
  }

  /**
   * Sibling packages found by scanning the conventional container directories.
   * @returns {Array<{dir: string, manifest: string}>} repo-relative package dirs
   */
  function layoutPackages(cwd) {
    const found = [];
    for (const top of MONO_ROOTS) {
      const topFull = path.join(cwd, top);
      let entries;
      try { entries = fs.readdirSync(topFull, { withFileTypes: true }); } catch (_) { continue; }
      for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
        if (!e.isDirectory()) continue;
        const pkgDir = path.join(topFull, e.name);
        const manifest = PKG_MANIFESTS.find((m) => fs.existsSync(path.join(pkgDir, m)));
        if (manifest) found.push({ dir: `${top}/${e.name}`, manifest });
      }
    }
    return found;
  }

  /**
   * The monorepo verdict for a repo, and the evidence behind it.
   *
   * `isMonorepo` is true for a declared workspace OR a layout carrying at least
   * MIN_LAYOUT_PACKAGES sibling packages. One package under `packages/` is a
   * common single-package layout, not a monorepo, so it does not qualify.
   *
   * @param {string} cwd
   * @returns {{
   *   isMonorepo: boolean,
   *   source: 'marker'|'layout'|'none',
   *   evidence: string,
   *   marker: string|null,
   *   packages: Array<{dir: string, manifest: string}>
   * }}
   */
  function detectMonorepo(cwd) {
    const marker = workspaceMarker(cwd);
    const packages = layoutPackages(cwd);

    if (marker) {
      return {
        isMonorepo: true,
        source: 'marker',
        evidence: `marker: ${marker}`,
        marker,
        packages,
      };
    }
    if (packages.length >= MIN_LAYOUT_PACKAGES) {
      const top = packages[0].dir.split('/')[0];
      return {
        isMonorepo: true,
        source: 'layout',
        evidence: `layout: ${packages.length} manifests under ${top}/`,
        marker: null,
        packages,
      };
    }
    return {
      isMonorepo: false,
      source: 'none',
      evidence: packages.length === 1
        ? `no: 1 package under ${packages[0].dir.split('/')[0]}/ (needs ${MIN_LAYOUT_PACKAGES})`
        : 'no: no workspace marker and no sibling packages',
      marker: null,
      packages,
    };
  }

  module.exports = {
    detectMonorepo,
    workspaceMarker,
    layoutPackages,
    MARKERS,
    MONO_ROOTS,
    PKG_MANIFESTS,
    MIN_LAYOUT_PACKAGES,
  };
  
};

// ── ./src/discovery/r-manifest ──
__factories["./src/discovery/r-manifest"] = function(module, exports) {
  
  /**
   * Parsers for R package manifest files (DESCRIPTION + NAMESPACE).
   *
   * Zero-dependency, regex/line-based. Both readers are safe on missing files
   * (return null) and on malformed input (return whatever could be parsed).
   *
   * Exports:
   *   readDescription(cwd) → { package, version, imports[], depends[], suggests[], linkingTo[] } | null
   *   readNamespace(cwd)   → { exports: Set, exportPatterns: RegExp[], s3methods: [{generic,class}], importFrom: Map<pkg, Set<name>> } | null
   *   collectLocalDefs(rFiles) → Map<defName, absPath>
   */

  const fs   = require('fs');
  const path = require('path');

  /**
   * Parse a DESCRIPTION file (Debian control format).
   *
   * Continuation lines start with whitespace and are appended to the previous
   * field. Comma-separated dependency lists are split and version constraints
   * `pkg (>= 1.0.0)` are stripped to just `pkg`.
   *
   * @param {string} cwd - project root containing DESCRIPTION
   * @returns {object|null}
   */
  function readDescription(cwd) {
    const p = path.join(cwd, 'DESCRIPTION');
    if (!fs.existsSync(p)) return null;
    let raw;
    try { raw = fs.readFileSync(p, 'utf8'); } catch (_) { return null; }

    const fields = {};
    let currentKey = null;
    for (const rawLine of raw.split('\n')) {
      if (/^\s/.test(rawLine) && currentKey) {
        // Continuation: append (with a space) to the current field.
        fields[currentKey] += ' ' + rawLine.trim();
        continue;
      }
      const m = rawLine.match(/^([A-Za-z][\w.]*)\s*:\s*(.*)$/);
      if (m) {
        currentKey = m[1];
        fields[currentKey] = m[2].trim();
      } else {
        currentKey = null;
      }
    }

    return {
      package:   fields.Package   || null,
      version:   fields.Version   || null,
      imports:   splitDeps(fields.Imports),
      depends:   splitDeps(fields.Depends),
      suggests:  splitDeps(fields.Suggests),
      linkingTo: splitDeps(fields.LinkingTo),
    };
  }

  /**
   * Split a DESCRIPTION dep list like
   *   "dplyr (>= 1.0.0), ggplot2, R (>= 4.0)"
   * into a clean array of package names, dropping `R` itself.
   */
  function splitDeps(value) {
    if (!value) return [];
    return value.split(',')
      .map((s) => s.trim().replace(/\s*\([^)]*\)\s*$/, '').trim())
      .filter((s) => s && s !== 'R');
  }

  /**
   * Parse a NAMESPACE file.
   *
   * Recognised directives (R writes NAMESPACE in Lisp-y notation):
   *   export(name) / export("name")
   *   exportPattern("^foo")
   *   exportMethods(generic1, generic2)
   *   S3method(generic, class)
   *   importFrom(pkg, name1, name2, ...)
   *   import(pkg)
   *   useDynLib(pkg)            — ignored (compiled code)
   *
   * @param {string} cwd
   * @returns {object|null}
   */
  function readNamespace(cwd) {
    const p = path.join(cwd, 'NAMESPACE');
    if (!fs.existsSync(p)) return null;
    let raw;
    try { raw = fs.readFileSync(p, 'utf8'); } catch (_) { return null; }

    // Strip comments.
    const text = raw.replace(/#.*$/gm, '');

    const exports = new Set();
    const exportPatterns = [];
    const s3methods = [];
    const importFrom = new Map();

    for (const m of text.matchAll(/\bexport\s*\(\s*([^)]+)\)/g)) {
      for (const name of splitArgs(m[1])) {
        const clean = stripQuotes(name);
        if (clean) exports.add(clean);
      }
    }
    for (const m of text.matchAll(/\bexportMethods\s*\(\s*([^)]+)\)/g)) {
      for (const name of splitArgs(m[1])) {
        const clean = stripQuotes(name);
        if (clean) exports.add(clean);
      }
    }
    for (const m of text.matchAll(/\bexportPattern\s*\(\s*["']([^"']+)["']\s*\)/g)) {
      try { exportPatterns.push(new RegExp(m[1])); } catch (_) {}
    }
    for (const m of text.matchAll(/\bS3method\s*\(\s*([\w.]+)\s*,\s*([\w.]+)\s*\)/g)) {
      s3methods.push({ generic: m[1], class: m[2] });
      // The generic itself is implicitly exported for the registered class.
      exports.add(m[1]);
    }
    for (const m of text.matchAll(/\bimportFrom\s*\(\s*([\w.]+)\s*,\s*([^)]+)\)/g)) {
      const pkg = m[1];
      if (!importFrom.has(pkg)) importFrom.set(pkg, new Set());
      for (const name of splitArgs(m[2])) {
        const clean = stripQuotes(name);
        if (clean) importFrom.get(pkg).add(clean);
      }
    }

    return { exports, exportPatterns, s3methods, importFrom };
  }

  function splitArgs(raw) {
    return raw.split(',').map((s) => s.trim()).filter(Boolean);
  }

  function stripQuotes(s) {
    return s.replace(/^["']|["']$/g, '').trim();
  }

  /**
   * Build a Map<symbolName, absFilePath> from the top-level definitions in a
   * set of R files. Used by the graph builder to resolve `localPkg::fn` to a
   * concrete file. Reads each file once and runs a single regex.
   *
   * @param {string[]} rFiles - absolute paths to .R/.r files
   * @returns {Map<string, string>}
   */
  function collectLocalDefs(rFiles) {
    const defs = new Map();
    // Matches `name <- function(`, `name <- R6Class(`, `name <- new_class(`,
    // `setGeneric("name"`, `setClass("name"`. First-write-wins.
    const reAssign = /^(?:[ \t]*)([\w.]+)\s*(?:<<-|<-|=)\s*(?:(?:R6::)?R6Class|(?:S7::)?new_class|function)\b/gm;
    const reS4Generic = /^[ \t]*setGeneric\s*\(\s*["']([\w.]+)["']/gm;
    const reS4Class   = /^[ \t]*setClass\s*\(\s*["']([\w.]+)["']/gm;
    for (const filePath of rFiles) {
      let content;
      try { content = fs.readFileSync(filePath, 'utf8'); } catch (_) { continue; }
      const stripped = content.replace(/#.*$/gm, '');
      let m;
      while ((m = reAssign.exec(stripped)) !== null) {
        if (m[1].startsWith('.')) continue;
        if (!defs.has(m[1])) defs.set(m[1], filePath);
      }
      while ((m = reS4Generic.exec(stripped)) !== null) {
        if (!defs.has(m[1])) defs.set(m[1], filePath);
      }
      while ((m = reS4Class.exec(stripped)) !== null) {
        if (!defs.has(m[1])) defs.set(m[1], filePath);
      }
    }
    return defs;
  }

  module.exports = { readDescription, readNamespace, collectLocalDefs };
  
};

// ── ./src/discovery/sigmapignore ──
__factories["./src/discovery/sigmapignore"] = function(module, exports) {
  
  const fs   = require('fs');
  const path = require('path');

  module.exports = { loadIgnorePatterns, matchesIgnorePattern };

  function loadIgnorePatterns(cwd) {
    for (const fname of ['.sigmapignore', '.contextignore']) {
      const p = path.join(cwd, fname);
      if (fs.existsSync(p)) {
        return fs.readFileSync(p, 'utf8')
          .split('\n')
          .map(l => l.trim())
          .filter(l => l && !l.startsWith('#'));
      }
    }
    return [];
  }

  function matchesIgnorePattern(dirName, patterns) {
    for (const pat of patterns) {
      const clean = pat.replace(/\/$/, '');
      if (clean === dirName) return true;
      if (clean.endsWith('/**') && dirName.startsWith(clean.slice(0, -3))) return true;
      if (clean.endsWith('/*') && dirName.startsWith(clean.slice(0, -2))) return true;
    }
    return false;
  }
  
};

// ── ./src/discovery/source-root-registry ──
__factories["./src/discovery/source-root-registry"] = function(module, exports) {
  
  const REGISTRY = {
    javascript: {
      manifestFiles: ['package.json'],
      frameworks: {
        nextjs:    { detectionFiles: ['next.config.js','next.config.ts','next.config.mjs'], detectionDeps: ['next'],               srcDirs: ['app','src/app','pages','src/pages','src','components','lib','hooks','utils'], entrypoints: ['app/page.tsx','pages/index.tsx'] },
        nestjs:    { detectionFiles: ['nest-cli.json'],                                    detectionDeps: ['@nestjs/core'],        srcDirs: ['src'], entrypoints: ['src/main.ts','src/app.module.ts'] },
        express:   { detectionFiles: [],                                                    detectionDeps: ['express'],             srcDirs: ['src','routes','middleware','controllers','services'], entrypoints: ['src/index.js','server.js','app.js'] },
        fastify:   { detectionFiles: [],                                                    detectionDeps: ['fastify'],             srcDirs: ['src','routes','plugins'], entrypoints: ['src/index.js'] },
        react:     { detectionFiles: [],                                                    detectionDeps: ['react'],               srcDirs: ['src','components','hooks','context','pages','app','lib','utils'] },
        vue:       { detectionFiles: ['vue.config.js','vue.config.ts'],                    detectionDeps: ['vue'],                 srcDirs: ['src','components','composables','pages','views'] },
        nuxt:      { detectionFiles: ['nuxt.config.js','nuxt.config.ts'],                  detectionDeps: ['nuxt'],                srcDirs: ['pages','components','composables','server','middleware','plugins'] },
        svelte:    { detectionFiles: ['svelte.config.js'],                                 detectionDeps: ['svelte','@sveltejs/kit'], srcDirs: ['src','src/routes','src/lib'] },
        angular:   { detectionFiles: ['angular.json'],                                     detectionDeps: ['@angular/core'],       srcDirs: ['src','src/app','projects','apps','libs'] },
        gatsby:    { detectionFiles: ['gatsby-config.js','gatsby-config.ts'],              detectionDeps: ['gatsby'],              srcDirs: ['src','gatsby'] },
        vite:      { detectionFiles: ['vite.config.js','vite.config.ts'],                  detectionDeps: ['vite'],                srcDirs: ['src'] },
        remix:     { detectionFiles: ['remix.config.js'],                                  detectionDeps: ['@remix-run/react'],    srcDirs: ['app'] },
        trpc:      { detectionFiles: [],                                                    detectionDeps: ['@trpc/server'],        srcDirs: ['src','server','routers'] },
      },
      srcDirs:  ['src','lib','index.js','server.js','app.js'],
      penalties: ['dist','build','.next','.nuxt','coverage','storybook-static'],
    },

    typescript: {
      manifestFiles: ['package.json','tsconfig.json'],
      frameworks: {
        nextjs:  { detectionFiles: ['next.config.ts','next.config.mjs'], detectionDeps: ['next'],            srcDirs: ['app','src/app','pages','src','components','lib','hooks','utils'] },
        nestjs:  { detectionFiles: ['nest-cli.json'],                     detectionDeps: ['@nestjs/core'],   srcDirs: ['src'], entrypoints: ['src/main.ts'] },
        angular: { detectionFiles: ['angular.json'],                      detectionDeps: ['@angular/core'],  srcDirs: ['src','src/app','projects','apps','libs'] },
      },
      srcDirs:  ['src','lib','packages'],
      penalties: ['dist','build','.next'],
    },

    python: {
      manifestFiles: ['requirements.txt','pyproject.toml','setup.py','Pipfile'],
      frameworks: {
        django:  { detectionFiles: ['manage.py'],           detectionDeps: ['Django'],  srcDirs: [],         specialRule: 'django-app-dirs', entrypoints: ['manage.py'] },
        fastapi: { detectionFiles: [],                       detectionDeps: ['fastapi'], srcDirs: ['app','src','routers','api'], entrypoints: ['main.py','app/main.py'] },
        flask:   { detectionFiles: ['wsgi.py','app.py'],    detectionDeps: ['Flask'],   srcDirs: ['app','src'], entrypoints: ['app.py','wsgi.py'] },
        celery:  { detectionFiles: [],                       detectionDeps: ['celery'],  srcDirs: ['tasks','workers','app'] },
      },
      srcDirs:  ['.'],
      penalties: ['venv','.venv','__pycache__','.pytest_cache','htmlcov'],
    },

    go: {
      manifestFiles: ['go.mod'],
      frameworks: {
        gin:   { detectionFiles: [], detectionDeps: ['github.com/gin-gonic/gin'],      srcDirs: ['internal','cmd','pkg','api','handler','middleware'] },
        echo:  { detectionFiles: [], detectionDeps: ['github.com/labstack/echo'],      srcDirs: ['internal','cmd','handler','middleware'] },
        fiber: { detectionFiles: [], detectionDeps: ['github.com/gofiber/fiber'],      srcDirs: ['internal','cmd','handler','routes'] },
        grpc:  { detectionFiles: [], detectionDeps: ['google.golang.org/grpc'],        srcDirs: ['internal','proto','server','client'] },
        chi:   { detectionFiles: [], detectionDeps: ['github.com/go-chi/chi'],         srcDirs: ['internal','cmd','handler'] },
      },
      srcDirs:  ['internal','cmd','pkg','api'],
      penalties: ['vendor'],
    },

    rust: {
      manifestFiles: ['Cargo.toml'],
      frameworks: {
        actix: { detectionFiles: [], detectionDeps: ['actix-web'], srcDirs: ['src'] },
        axum:  { detectionFiles: [], detectionDeps: ['axum'],      srcDirs: ['src'] },
        tauri: { detectionFiles: ['src-tauri/tauri.conf.json'], detectionDeps: ['tauri'], srcDirs: ['src','src-tauri/src'] },
      },
      srcDirs:  ['src'],
      penalties: ['target'],
    },

    java: {
      manifestFiles: ['pom.xml','build.gradle'],
      frameworks: {
        spring:   { detectionFiles: [], detectionDeps: ['spring-boot'], srcDirs: ['src/main/java','src/main/kotlin','src/main/resources'] },
        quarkus:  { detectionFiles: [], detectionDeps: ['io.quarkus'],  srcDirs: ['src/main/java'] },
        android:  { detectionFiles: ['AndroidManifest.xml'],            srcDirs: ['app/src/main/java','app/src/main','src'] },
        micronaut:{ detectionFiles: [], detectionDeps: ['io.micronaut'],srcDirs: ['src/main/java'] },
      },
      srcDirs:  ['src/main/java','src'],
      penalties: ['target','build'],
    },

    kotlin: {
      manifestFiles: ['build.gradle.kts'],
      frameworks: {
        spring:  { detectionFiles: [], detectionDeps: ['spring-boot'],    srcDirs: ['src/main/kotlin'] },
        android: { detectionFiles: ['AndroidManifest.xml'],               srcDirs: ['app/src/main/kotlin','app/src/main/java'] },
        ktor:    { detectionFiles: [], detectionDeps: ['io.ktor'],         srcDirs: ['src'] },
        compose: { detectionFiles: [], detectionDeps: ['compose-runtime'], srcDirs: ['app/src/main/kotlin','src'] },
      },
      srcDirs:  ['src/main/kotlin','src'],
      penalties: ['build','.gradle'],
    },

    csharp: {
      manifestFiles: ['.csproj','.sln'],
      frameworks: {
        aspnet:  { detectionFiles: ['appsettings.json'], detectionDeps: ['Microsoft.AspNetCore'], srcDirs: ['Controllers','Services','Models','Middleware','Pages'] },
        blazor:  { detectionFiles: [], detectionDeps: ['Microsoft.AspNetCore.Components'],        srcDirs: ['Components','Pages','Services'] },
        unity:   { detectionFiles: ['ProjectSettings/ProjectSettings.asset'],                     srcDirs: ['Assets/Scripts','Assets'] },
        maui:    { detectionFiles: [], detectionDeps: ['Microsoft.Maui'],                          srcDirs: ['src','Pages','ViewModels'] },
      },
      srcDirs:  ['src','Controllers','Services','Models'],
      penalties: ['bin','obj','.vs'],
    },

    php: {
      manifestFiles: ['composer.json'],
      frameworks: {
        laravel:   { detectionFiles: ['artisan'],           srcDirs: ['app','routes','config','database','resources','tests'], entrypoints: ['artisan'] },
        symfony:   { detectionFiles: ['symfony.lock'],      srcDirs: ['src','config','templates'], specialRule: 'symfony-bundle-dirs' },
        wordpress: { detectionFiles: ['wp-config.php'],     srcDirs: ['wp-content/themes','wp-content/plugins','wp-content/mu-plugins'] },
        slim:      { detectionFiles: [],                    detectionDeps: ['slim/slim'], srcDirs: ['src','app','routes'] },
      },
      srcDirs:  ['src','app'],
      penalties: ['vendor'],
    },

    ruby: {
      manifestFiles: ['Gemfile'],
      frameworks: {
        rails:   { detectionFiles: ['config/routes.rb'],   srcDirs: ['app','lib','config','db','spec','test'], entrypoints: ['config/routes.rb'] },
        sinatra: { detectionFiles: ['config.ru','app.rb'], srcDirs: ['.','lib'],            entrypoints: ['app.rb','config.ru'] },
        hanami:  { detectionFiles: [],                     detectionDeps: ['hanami'],       srcDirs: ['apps','lib','slices'] },
      },
      srcDirs:  ['app','lib'],
      penalties: ['vendor','coverage','.bundle'],
    },

    swift: {
      manifestFiles: ['Package.swift'],
      frameworks: {
        vapor:   { detectionFiles: [],              detectionDeps: ['vapor/vapor'], srcDirs: ['Sources','App'] },
        swiftui: { detectionFiles: ['.xcodeproj'],  srcDirs: [],                    specialRule: 'swift-project-dir' },
        swiftpm: { detectionFiles: ['Package.swift'],srcDirs: ['Sources'] },
      },
      srcDirs:  ['Sources','Source'],
      penalties: ['.build','DerivedData','Pods','Carthage'],
    },

    dart: {
      manifestFiles: ['pubspec.yaml'],
      frameworks: {
        flutter:    { detectionFiles: [],                   detectionDeps: ['flutter'],    srcDirs: ['lib','lib/src'], entrypoints: ['lib/main.dart'] },
        serverpod:  { detectionFiles: [],                   detectionDeps: ['serverpod'],  srcDirs: ['lib','endpoints','models'] },
        'dart-frog':{ detectionFiles: ['dart_frog.yaml'],   srcDirs: ['routes','lib'] },
      },
      srcDirs:  ['lib','lib/src'],
      // A pub workspace is a set of packages, and a pub package keeps its
      // implementation in `lib/` — `test/`, `example/` and `tool/` are siblings,
      // not source. A package's source root is therefore `<package>/lib`.
      packageSrcDir: 'lib',
      penalties: ['.dart_tool','build'],
    },

    // Elixir: a mix project's application is `lib/`; `assets/` and `priv/` are the
    // front-end sources and compiled output Phoenix keeps beside it, and in an
    // umbrella each app under `apps/` has its own `lib/`.
    elixir: {
      manifestFiles: ['mix.exs'],
      frameworks: {},
      srcDirs:  ['lib'],
      packageSrcDir: 'lib',
      penalties: ['deps','_build','cover','priv'],
    },

    // GDScript has no source directory: `res://` is the project root and a script
    // sits next to the scene it drives, at any depth. The repo root IS the source
    // root, even when it holds no script itself (a collection of demos keeps them
    // all in subdirectories).
    gdscript: {
      manifestFiles: ['project.godot'],
      frameworks: {},
      srcDirs:  [],
      rootedAtRepo: true,
      penalties: ['.godot','.import'],
    },

    scala: {
      manifestFiles: ['build.sbt'],
      frameworks: {
        akka:  { detectionFiles: [], detectionDeps: ['akka'], srcDirs: ['src/main/scala','src'] },
        play:  { detectionFiles: [], detectionDeps: ['play'], srcDirs: ['app','conf'] },
        spark: { detectionFiles: [], detectionDeps: ['spark'],srcDirs: ['src/main/scala'] },
        zio:   { detectionFiles: [], detectionDeps: ['zio'], srcDirs: ['src/main/scala'] },
      },
      srcDirs:  ['src/main/scala','src'],
      penalties: ['target'],
    },

    lua: {
      manifestFiles: ['.luarc.json', 'selene.toml', 'stylua.toml'],
      frameworks: {
        luarocks: { detectionFiles: ['*.rockspec'], srcDirs: ['src','lua','lib'] },
      },
      srcDirs:  ['src','lua','lib'],
      penalties: ['.luarocks','luarocks_modules'],
    },

    r: {
      manifestFiles: ['DESCRIPTION','renv.lock'],
      frameworks: {
        shiny: { detectionFiles: ['app.R','ui.R','server.R'], srcDirs: ['R','inst','tests'], entrypoints: ['app.R','server.R'] },
      },
      srcDirs:  ['R','src','inst'],
      penalties: ['renv','packrat','.Rcheck'],
    },
  };

  module.exports = { REGISTRY };
  
};

// ── ./src/discovery/source-root-resolver ──
__factories["./src/discovery/source-root-resolver"] = function(module, exports) {
  
  const fs   = require('fs');
  const path = require('path');
  const { REGISTRY }              = __require('./src/discovery/source-root-registry');
  const { detectLanguages }       = __require('./src/discovery/language-detector');
  const { detectFrameworks }      = __require('./src/discovery/framework-detector');
  const { scoreCandidate, sourceFileCountFor, getRecentlyChangedDirs, ROOT_ENTRYPOINTS, CODE_EXTS, AUTO_SKIP } = __require('./src/discovery/source-root-scorer');
  const { loadIgnorePatterns, matchesIgnorePattern } = __require('./src/discovery/sigmapignore');
  const { detectMonorepo }         = __require('./src/discovery/monorepo');

  module.exports = { resolveSourceRoots };

  const MAX_ROOTS = 6;

  // Six roots is where the choice starts, not where it stops. A layout with more modules than that
  // (Rails has twelve, each a gem with its own `lib/` and `test/`) went on indexing six and left the
  // rest out without a word (#997). Past MAX_ROOTS, the next-ranked candidates are added until the roots
  // hold COVERAGE_TARGET of the code in all the candidates, up to MAX_COVERAGE_ROOTS.
  const COVERAGE_TARGET = 0.95;
  const MAX_COVERAGE_ROOTS = 40;

  // A Gradle/Maven multi-module build legitimately has one source root per
  // module — okhttp has 27 — so the 6-root cap tuned for JS layouts would
  // discard most of the repo. Raised only for that case.
  const MAX_JVM_MODULE_ROOTS = 40;
  const JVM_SOURCE_LANGS = ['java', 'kotlin', 'scala'];

  // The same reasoning for a pub workspace or an Elixir umbrella project: one
  // source root per member package is the correct answer (riverpod has 12), not
  // over-detection.
  const MAX_PACKAGE_ROOTS = 40;

  /**
   * Build-file evidence of a multi-module JVM project.
   *
   * Secondary signal only: the primary test is structural (see below), because
   * a build file can describe modules that are not on disk, and a layout can be
   * multi-module under a tool nobody enumerated. Covers the three that declare
   * modules declaratively — Gradle, Maven, sbt.
   */
  function _hasMultiModuleMarker(cwd) {
    for (const f of ['settings.gradle', 'settings.gradle.kts']) {
      try {
        if (/^\s*include\b/m.test(fs.readFileSync(path.join(cwd, f), 'utf8'))) return true;
      } catch (_) { /* absent */ }
    }
    try {
      const pom = fs.readFileSync(path.join(cwd, 'pom.xml'), 'utf8').replace(/<!--[\s\S]*?-->/g, '');
      if (/<modules>[\s\S]*?<module>/.test(pom)) return true;
    } catch (_) { /* absent */ }
    try {
      // sbt: `lazy val core = project.in(file("core"))` / `= Project(...)`.
      if (/^\s*lazy\s+val\s+\w+\s*=\s*[\w.]*[Pp]roject/m.test(fs.readFileSync(path.join(cwd, 'build.sbt'), 'utf8'))) return true;
    } catch (_) { /* absent */ }
    return false;
  }

  /**
   * JVM source-set directories under each module, one and two levels deep.
   *
   * Two levels because grouped layouts (`libs/core/...`, `samples/guide/...`)
   * are common. Leaves are used rather than module roots so tests, resources
   * and build output are excluded by construction rather than filtered later.
   *
   * Source sets are discovered rather than assumed: classic Gradle uses
   * `src/main/<lang>`, but Kotlin Multiplatform uses `src/jvmMain/<lang>`,
   * `src/commonMain/<lang>`, `src/androidMain/<lang>` and friends. Anything
   * test-shaped is skipped — test files are indexed by their own pass and must
   * not become source roots.
   *
   * @returns {Array<{name:string, full:string}>}
   */
  function _jvmModuleSourceDirs(cwd, ignorePatterns, excSet) {
    const out = [];
    const seen = new Set();

    const dirsIn = (abs) => {
      try {
        return fs.readdirSync(abs, { withFileTypes: true })
          .filter((e) => e.isDirectory())
          .map((e) => e.name)
          .sort((a, b) => a.localeCompare(b));
      } catch (_) { return []; }
    };

    // `<base>/src/<sourceSet>/<lang>` for every non-test source set present.
    const collect = (relBase) => {
      const srcRel = relBase ? `${relBase}/src` : 'src';
      const srcAbs = path.join(cwd, srcRel.split('/').join(path.sep));
      for (const sourceSet of dirsIn(srcAbs)) {
        if (/test/i.test(sourceSet)) continue;
        for (const lang of JVM_SOURCE_LANGS) {
          const rel = `${srcRel}/${sourceSet}/${lang}`;
          if (seen.has(rel)) continue;
          const full = path.join(cwd, rel.split('/').join(path.sep));
          try { if (!fs.statSync(full).isDirectory()) continue; } catch (_) { continue; }
          seen.add(rel);
          out.push({ name: rel, full });
        }
      }
    };

    collect('');
    for (const top of dirsIn(cwd)) {
      if (excSet.has(top) || matchesIgnorePattern(top, ignorePatterns)) continue;
      if (top.startsWith('.')) continue;
      collect(top);
      for (const nested of dirsIn(path.join(cwd, top))) {
        if (excSet.has(nested) || nested.startsWith('.') || nested === 'src' || nested === 'build') continue;
        collect(`${top}/${nested}`);
      }
    }
    return out;
  }

  function resolveSourceRoots(cwd, opts = {}) {
    const ignorePatterns = loadIgnorePatterns(cwd);
    const languages      = detectLanguages(cwd);
    const frameworks     = detectFrameworks(cwd);
    const recentDirs     = getRecentlyChangedDirs(cwd);
    const monorepo       = detectMonorepo(cwd);
    const isMonorepo     = monorepo.isMonorepo;

    const primaryLang   = languages[0]?.name;
    const primaryFw     = frameworks[0];
    const registry      = primaryLang ? REGISTRY[primaryLang] : null;

    // Build framework-derived context
    const fwEntry        = primaryFw && registry?.frameworks?.[primaryFw.name];
    const frameworkSrcDirs   = new Set(fwEntry?.srcDirs || registry?.srcDirs || []);
    const entrypoints        = fwEntry?.entrypoints || [];
    const frameworkPenalties = registry?.penalties || [];

    const context = { frameworks, languages, recentDirs, frameworkSrcDirs, entrypoints, frameworkPenalties };

    // Enumerate candidates
    const candidates = _enumerateCandidates(cwd, isMonorepo, ignorePatterns, opts.exclude || [], registry);

    // A workspace whose language keeps each package's source in one directory
    // (Dart and Elixir: `lib/`) — two or more members is what makes it one.
    const isPackageWorkspace = candidates.filter((c) => c.packageSrc).length >= 2;

    // JVM source sets are discovered STRUCTURALLY — two or more module source
    // dirs on disk is what makes a build multi-module, whatever tool declares
    // them. Gradle/Maven/sbt markers are a secondary signal, so a single-module
    // project with a declared-but-absent module still behaves normally.
    const jvmModuleDirs = _jvmModuleSourceDirs(cwd, ignorePatterns, new Set(opts.exclude || []));
    const nestedModuleDirs = jvmModuleDirs.filter((c) => c.name.includes('/src/'));
    const isJvmMultiModule = nestedModuleDirs.length >= 2 || (nestedModuleDirs.length >= 1 && _hasMultiModuleMarker(cwd));
    if (isJvmMultiModule) {
      const have = new Set(candidates.map((c) => c.name));
      for (const c of jvmModuleDirs) {
        if (!have.has(c.name)) candidates.push(c);
      }
    }

    // Score each candidate, on the code in its whole subtree. A candidate that holds other candidates
    // (`packages/` over `packages/a`, a JVM module over its source sets) keeps the two-level count it
    // was scored on before: the full-depth count would put it above its members, and the dedupe below
    // keeps the parent.
    const holdsOthers = (name) => candidates.some((o) => o.name !== name && o.name.startsWith(name + '/'));
    const scored = candidates
      .map(({ name, full, packageSrc }) => {
        const files = sourceFileCountFor(name, full, frameworkSrcDirs, holdsOthers(name));
        return { dir: name, full, packageSrc, files, score: scoreCandidate(name, full, context, files) };
      })
      .filter(c => c.score > 0)
      // In a package workspace the members' source directories ARE the source;
      // whatever else sits at the top of the repo — a docs site, benchmarks,
      // tooling — is not. Without this riverpod's `website/` (JavaScript) outranked
      // all twelve Dart packages and was the only thing indexed (#900).
      .filter(c => !isPackageWorkspace || c.packageSrc)
      // Final tie-break on dir keeps selection deterministic when scores tie — the
      // top-MAX_ROOTS slice below would otherwise admit different dirs run to run
      // (candidate order comes from filesystem readdir), changing which files are
      // collected and making the generated context non-reproducible.
      .sort((a, b) => b.score - a.score || (b.files || 0) - (a.files || 0) || a.dir.localeCompare(b.dir));

    // Handle special rules
    let roots = _applySpecialRules(scored, cwd, primaryFw, fwEntry, frameworks, new Set(opts.exclude || []), registry);

    // Dedupe nested paths (prefer parent)
    roots = _dedupeNested(roots);

    // Cap at MAX_ROOTS — raised for a multi-module JVM build, where one root
    // per module is the correct answer rather than over-detection.
    const cap = isJvmMultiModule ? MAX_JVM_MODULE_ROOTS : isPackageWorkspace ? MAX_PACKAGE_ROOTS : MAX_ROOTS;
    let picked = roots.slice(0, cap);
    let omitted = roots.length - picked.length;
    if (omitted > 0 && cap === MAX_ROOTS) {
      const all = roots.reduce((n, r) => n + (r.files || 0), 0);
      let have = picked.reduce((n, r) => n + (r.files || 0), 0);
      for (let i = cap; i < roots.length && picked.length < MAX_COVERAGE_ROOTS && all > 0 && have / all < COVERAGE_TARGET; i++) {
        picked.push(roots[i]);
        have += roots[i].files || 0;
      }
      omitted = roots.length - picked.length;
    }
    roots = picked.map(r => r.dir);

    // Fallback: if nothing scored, return empty (caller falls back to legacy)
    const confidence = _computeConfidence(frameworks, languages, scored.length);

    return {
      roots,
      languages,
      frameworks,
      confidence,
      explanation: scored.slice(0, Math.max(8, roots.length)).map(c => ({
        dir:   c.dir,
        score: c.score,
        files: c.files,
        reason: `score: ${c.score}`,
      })),
      // Candidates left out because the cap was reached before the code was covered.
      truncated: omitted > 0,
      omitted,
      isMonorepo,
      monorepo,
      isJvmMultiModule,
      isPackageWorkspace,
    };
  }

  function _enumerateCandidates(cwd, isMonorepo, ignorePatterns, excludeList, registry) {
    const candidates = [];
    // Dart and Elixir keep a package's implementation in one named directory.
    const packageSrcDir = registry && registry.packageSrcDir;
    const excSet     = new Set(excludeList);

    // Root-level dirs (sorted so candidate order — and downstream dedupe/selection
    // — is deterministic regardless of filesystem readdir order)
    try {
      const rootEntries = fs.readdirSync(cwd, { withFileTypes: true })
        .sort((a, b) => a.name.localeCompare(b.name));
      for (const e of rootEntries) {
        if (!e.isDirectory()) continue;
        if (excSet.has(e.name)) continue;
        if (matchesIgnorePattern(e.name, ignorePatterns)) continue;
        candidates.push({ name: e.name, full: path.join(cwd, e.name) });
      }
    } catch (_) {}

    // Monorepo sub-packages: packages/*/src, apps/*/src, services/*/src
    if (isMonorepo) {
      for (const top of ['packages','apps','services','modules']) {
        const topFull = path.join(cwd, top);
        if (!fs.existsSync(topFull)) continue;
        try {
          for (const pkg of fs.readdirSync(topFull, { withFileTypes: true })) {
            if (!pkg.isDirectory()) continue;
            // A package of such a language contributes its source directory and
            // nothing else. The package root would also pull in test/, example/
            // and tool/ — in riverpod, a 244-file lint-fixture package among them.
            if (packageSrcDir) {
              const libFull = path.join(topFull, pkg.name, packageSrcDir);
              if (fs.existsSync(libFull)) {
                candidates.push({ name: `${top}/${pkg.name}/${packageSrcDir}`, full: libFull, packageSrc: true });
              }
              continue;
            }
            const srcFull = path.join(topFull, pkg.name, 'src');
            if (fs.existsSync(srcFull)) {
              candidates.push({ name: `${top}/${pkg.name}/src`, full: srcFull });
            }
            // Also consider the package root itself
            candidates.push({ name: `${top}/${pkg.name}`, full: path.join(topFull, pkg.name) });

            // JVM project structures in monorepo packages (Java, Kotlin, Scala)
            for (const jvmLang of ['java', 'kotlin', 'scala']) {
              const srcMainJvm = path.join(topFull, pkg.name, 'src', 'main', jvmLang);
              if (fs.existsSync(srcMainJvm)) {
                candidates.push({ name: `${top}/${pkg.name}/src/main/${jvmLang}`, full: srcMainJvm });
              }
              const appSrcMainJvm = path.join(topFull, pkg.name, 'app', 'src', 'main', jvmLang);
              if (fs.existsSync(appSrcMainJvm)) {
                candidates.push({ name: `${top}/${pkg.name}/app/src/main/${jvmLang}`, full: appSrcMainJvm });
              }
            }
          }
        } catch (_) {}
      }
    }

    // Deep paths known by language/framework (e.g. src/main/java, src-tauri/src)
    const DEEP_PATHS = [
      'src/main/java','src/main/kotlin','src/main/scala',
      'src-tauri/src','Sources/App','app/src/main/java','app/src/main/kotlin','app/src/main/scala',
      'src/test/java','src/test/kotlin',
    ];
    for (const dp of DEEP_PATHS) {
      const full = path.join(cwd, dp);
      if (fs.existsSync(full)) candidates.push({ name: dp, full });
    }

    return candidates;
  }

  // A flat layout keeps its source at the repo root — the normal shape of a Go
  // module, and common in C and single-file-per-package Rust. `_enumerateCandidates`
  // only ever walks DIRECTORIES, so `.` could never be selected no matter how much
  // source sat there: a fresh `gin` clone detected
  // ["internal","binding","render","codec","ginS","testdata"] and left `gin.go`,
  // `routergroup.go`, `context.go` and `tree.go` invisible, with nothing warning
  // (#805). Two structural signals qualify the root, deliberately not one tuned
  // ratio:
  //
  //   A. a Go module — `go.mod` at the root means the root IS a package, which is
  //      the toolchain's own model. Measured across 43 cached benchmark repos this
  //      selects exactly the four Go modules (cobra, echo, gin, gorm) and nothing
  //      else; every non-Go repo has zero root-level `.go` files.
  //   B. the root holds a meaningful share of the tree's code. The margin is wide:
  //      the Go repos sit at 10-69% while every other repo is at or below 4%.
  const ROOT_MIN_FILES = 3;
  const ROOT_MIN_SHARE = 0.20;
  const ROOT_SCORE     = 9.0;   // above any scored subdirectory, so `.` sorts first

  /** Code files directly in `dir` (non-recursive). */
  function _directCodeFiles(dir) {
    try {
      return fs.readdirSync(dir, { withFileTypes: true })
        .filter((e) => e.isFile() && CODE_EXTS.has(path.extname(e.name))).length;
    } catch (_) { return 0; }
  }

  /**
   * Code files in the whole tree, bounded in depth, skipping vendor directories
   * and stopping at NESTED REPOSITORIES — a vendored or cloned repo is not this
   * repo's source, and walking one is both wrong and expensive.
   */
  function _treeCodeFiles(dir, excSet, depth = 0) {
    if (depth > 6) return 0;
    let entries;
    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return _directCodeFiles(dir); }
    if (depth > 0 && entries.some((e) => e.name === '.git')) return 0;
    let n = _directCodeFiles(dir);
    for (const e of entries) {
      if (!e.isDirectory()) continue;
      if (AUTO_SKIP.has(e.name) || excSet.has(e.name) || e.name.startsWith('.')) continue;
      n += _treeCodeFiles(path.join(dir, e.name), excSet, depth + 1);
    }
    return n;
  }

  /**
   * Whether the repo root is itself a source root, and why.
   * @returns {{ score: number, reason: string }|null}
   */
  function _flatLayoutRoot(cwd, excSet, registry) {
    // C — a language that is rooted at the repo by construction. GDScript has no
    // source directory: scripts sit next to the scenes they drive at any depth,
    // and a collection of demos keeps every one in a subdirectory, so the root
    // holds none directly and neither A nor B below can see it. Decided from the
    // script files alone — never from `project.godot`, which a sparse checkout of
    // a demo collection does not have.
    if (registry && registry.rootedAtRepo) {
      const total = _treeCodeFiles(cwd, excSet);
      if (total >= ROOT_MIN_FILES) {
        return { score: ROOT_SCORE, reason: `${total} code files below a root that holds none directly` };
      }
    }

    const rootFiles = _directCodeFiles(cwd);
    if (rootFiles === 0) return null;

    // A — a Go module's root is a package by definition.
    if (fs.existsSync(path.join(cwd, 'go.mod'))) {
      let goFiles = 0;
      try {
        goFiles = fs.readdirSync(cwd, { withFileTypes: true })
          .filter((e) => e.isFile() && e.name.endsWith('.go')).length;
      } catch (_) {}
      if (goFiles > 0) {
        return { score: ROOT_SCORE, reason: `go.mod with ${goFiles} root-level .go file(s)` };
      }
    }

    // B — the root holds a meaningful share of the tree's code.
    if (rootFiles < ROOT_MIN_FILES) return null;
    const total = _treeCodeFiles(cwd, excSet);
    if (total === 0) return null;
    const share = rootFiles / total;
    if (share >= ROOT_MIN_SHARE) {
      return { score: ROOT_SCORE, reason: `${rootFiles} of ${total} code files at the root (${Math.round(share * 100)}%)` };
    }
    return null;
  }

  function _applySpecialRules(scored, cwd, primaryFw, fwEntry, frameworks, excSet = new Set(), registry = null) {
    let roots = [...scored];

    // Flat layout: the root is a source root. Added here rather than as an
    // ordinary candidate because `scoreCandidate` scores directory NAMES against
    // the framework registry, and `.` is not a name it can reason about.
    const flatRoot = _flatLayoutRoot(cwd, excSet, registry);
    if (flatRoot && !roots.find((r) => r.dir === '.')) {
      roots.push({ dir: '.', full: cwd, score: flatRoot.score, reason: flatRoot.reason });
      roots.sort((a, b) => b.score - a.score || a.dir.localeCompare(b.dir));
    }

    // Django: walk root dirs for any containing models.py or views.py
    if (primaryFw?.name === 'django' || frameworks.some(f => f.name === 'django')) {
      try {
        for (const e of fs.readdirSync(cwd, { withFileTypes: true })) {
          if (!e.isDirectory()) continue;
          const d = path.join(cwd, e.name);
          if (fs.existsSync(path.join(d, 'models.py')) || fs.existsSync(path.join(d, 'views.py'))) {
            if (!roots.find(r => r.dir === e.name)) {
              roots.push({ dir: e.name, full: d, score: 5.0 });
            }
          }
        }
      } catch (_) {}
      roots.sort((a, b) => b.score - a.score || a.dir.localeCompare(b.dir));
    }

    // Swift project dir: dirs with ≥3 .swift files
    if (frameworks.some(f => f.name === 'swiftui')) {
      try {
        for (const e of fs.readdirSync(cwd, { withFileTypes: true })) {
          if (!e.isDirectory()) continue;
          const d = path.join(cwd, e.name);
          const swiftCount = (fs.readdirSync(d).filter(f => f.endsWith('.swift'))).length;
          if (swiftCount >= 3 && !roots.find(r => r.dir === e.name)) {
            roots.push({ dir: e.name, full: d, score: 4.0 });
          }
        }
      } catch (_) {}
      roots.sort((a, b) => b.score - a.score || a.dir.localeCompare(b.dir));
    }

    return roots;
  }

  function _dedupeNested(scored) {
    const result = [];
    for (const c of scored) {
      const cNorm = c.dir.replace(/\\/g, '/');
      const isNested = result.some(r => {
        const rNorm = r.dir.replace(/\\/g, '/');
        // `.` is the parent of everything, but `'internal'.startsWith('./')` is
        // false, so without this a flat layout would return ['.', 'internal', …]
        // and walk the same files twice.
        if (rNorm === '.') return cNorm !== '.';
        return cNorm.startsWith(rNorm + '/');
      });
      if (!isNested) result.push(c);
    }
    return result;
  }

  function _computeConfidence(frameworks, languages, scoredCount) {
    if (frameworks.length > 0 && frameworks[0].confidence >= 0.90) return 'high';
    if (languages.length > 0 && scoredCount > 0) return 'medium';
    return 'low';
  }
  
};

// ── ./src/discovery/source-root-scorer ──
__factories["./src/discovery/source-root-scorer"] = function(module, exports) {
  
  const fs   = require('fs');
  const path = require('path');
  const { git } = __require('./src/util/git');

  const CODE_EXTS = new Set([
    '.js','.mjs','.cjs','.ts','.tsx','.jsx',
    '.py','.rb','.go','.rs','.java','.kt',
    '.cs','.cpp','.c','.h','.m','.mm','.swift','.dart','.scala','.php','.lua',
    '.ps1','.psm1','.psd1',
    // Elixir and GDScript were detected as languages (`language-detector`) but not
    // counted as code here, so a directory of nothing but `.ex` or `.gd` scored
    // zero and was dropped: phoenix resolved to its JavaScript, godot to nothing (#900).
    '.ex','.exs','.gd',
  ]);

  const AUTO_SKIP = new Set([
    'node_modules','dist','build','.git','.next','.nuxt','vendor',
    'DerivedData','Pods','target','coverage','__pycache__','.venv','venv',
    '.build','Carthage','storybook-static','.gradle','bin','obj','.vs',
  ]);

  const PENALTY_DIRS = new Set([
    'test','tests','spec','__tests__','e2e','docs','doc','docs-vp',
    'examples','example','fixtures','mocks','__mocks__','demo','samples','migrations',
    'benchmarks','scripts',
    // `testdata` is Go's fixture convention and the go tool ignores it outright.
    // Without it here, a flat Go layout selected `testdata` as a source root
    // while the module root — holding every file that answers a question — was
    // never even a candidate (#805).
    'testdata','test-data','__fixtures__','snapshots','__snapshots__',
  ]);

  // Matches a JVM source root anywhere in a path, for any SOURCE SET.
  //
  // Two separate misses were hiding behind the original anchored `src/main/...`
  // form. It never matched `<module>/src/main/kotlin`, the standard Gradle
  // multi-module layout, so every module in a 27-module build scored 0. And it
  // assumed the source set is always called `main`, which Kotlin Multiplatform
  // has not been true of for years — okhttp's core keeps 307 files under
  // `okhttp/src/jvmMain/kotlin` and `src/androidMain/kotlin`.
  //
  // Test source sets (`src/test`, `src/commonTest`, `src/androidHostTest`) are
  // excluded here; they are indexed separately and must not become src roots.
  const JVM_PATH_PATTERN = /(^|\/)(app\/)?src\/(?!.*[Tt]est)[A-Za-z0-9_]+\/(java|kotlin|scala)$/;

  const ROOT_ENTRYPOINTS = {
    go:         ['main.go'],
    python:     ['app.py','main.py','wsgi.py','asgi.py'],
    javascript: ['index.js','server.js','app.js'],
    typescript: ['index.ts','main.ts'],
    rust:       [],
    php:        ['index.php'],
  };

  function getRecentlyChangedDirs(cwd) {
    try {
      const out = git(['log', '--name-only', '--format=', 'HEAD~10'], { cwd, timeout: 3000 }).toString();
      return new Set(out.split('\n').filter(Boolean).map(f => f.split('/')[0]));
    } catch { return new Set(); }
  }

  /**
   * Code files in a whole subtree, walking at most `TREE_COUNT_DEPTH` levels, skipping vendor and
   * build directories, dot directories and NESTED REPOSITORIES (a vendored or cloned repo is not
   * this repo's source). `activerecord/` in Rails keeps its code at `lib/active_record/…`, three
   * levels down: the two-level sample this replaced counted a handful of its 1,143 files, scored
   * the directory 0 and never offered it as a root (#997).
   */
  const TREE_COUNT_DEPTH = 8;
  function countTreeCode(dir, depth = 0) {
    if (depth > TREE_COUNT_DEPTH) return 0;
    let entries;
    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return 0; }
    if (depth > 0 && entries.some((e) => e.name === '.git')) return 0; // a repository of its own
    let n = 0;
    for (const e of entries) {
      if (e.isFile()) { if (CODE_EXTS.has(path.extname(e.name).toLowerCase())) n++; }
      else if (e.isDirectory() && !AUTO_SKIP.has(e.name) && !e.name.startsWith('.')) n += countTreeCode(path.join(dir, e.name), depth + 1);
    }
    return n;
  }

  /**
   * The code a candidate holds, as the score reads it: the whole subtree, except in a directory the
   * scorer treats as noise by name — `docs/`, `examples/`, `tests/`, `documentation-website/` — which is
   * counted as before, two levels deep. The flat -3.0 penalty was tuned against that count; a full-depth
   * count lifts such a directory above zero and makes it a root, which the tree-wide count was never
   * meant to do (flask took `examples`, libuv `docs`, exposed `documentation-website`, and the index
   * grew files nobody asks about).
   *
   * A CONTAINER is counted that way too: a candidate that holds other candidates (`packages/` over
   * `packages/a`, `src/` over `src/test/java`, `okhttp/` over its source sets). Its full-depth count
   * outscores its members and the parent-wins dedupe then replaces them with it, so a JS monorepo
   * resolved to `packages` and a module to its own directory, tests and docs included. So is a dot
   * directory (`.github`, `.yarn`, `.configs`): tooling, which rust-analyzer's `.github` was made a root
   * for once its scripts were counted to the bottom.
   */
  const DOCS_LIKE = /^(docs?|documentation)([-_.].*)?$/i;
  function sourceFileCountFor(dirName, fullPath, frameworkSrcDirs, container) {
    const lower = dirName.toLowerCase();
    const noise = (PENALTY_DIRS.has(lower) || DOCS_LIKE.test(lower)) && !(frameworkSrcDirs && frameworkSrcDirs.has(dirName));
    const dotted = dirName.split('/').some((seg) => seg.startsWith('.'));
    return noise || container || dotted ? _countSourceFiles(fullPath, 2) : countTreeCode(fullPath);
  }

  function scoreCandidate(dirName, fullPath, context, precounted) {
    const { frameworks, languages, recentDirs, frameworkSrcDirs, entrypoints, frameworkPenalties } = context;

    // Auto-skip noise
    if (AUTO_SKIP.has(dirName)) return -99;
    if (!fs.existsSync(fullPath)) return -99;

    let score = 0;

    // JVM paths (Java, Kotlin, Scala) get highest priority: +5.0
    if (JVM_PATH_PATTERN.test(dirName)) score += 5.0;

    // Framework match: +3.0 if this dir is in the framework's srcDirs
    if (frameworkSrcDirs.has(dirName)) score += 3.0;

    // Count source files (the resolver passes the count it already took)
    const sourceFileCount = typeof precounted === 'number' ? precounted : sourceFileCountFor(dirName, fullPath, frameworkSrcDirs);
    const density = Math.min(1.0, sourceFileCount / 10);

    // Language density: +2.5
    score += density * 2.5;

    // Symbol density: +2.0 if ≥3 source files
    if (sourceFileCount >= 3) score += 2.0;

    // Entrypoint: +1.5 if a known entrypoint lives in this dir
    if ((entrypoints || []).some(ep => ep.startsWith(dirName + '/'))) score += 1.5;

    // Manifest proximity: +1.0 if a manifest file is in this dir
    if (fs.existsSync(path.join(fullPath, 'package.json')) ||
        fs.existsSync(path.join(fullPath, 'go.mod')) ||
        fs.existsSync(path.join(fullPath, 'Cargo.toml')) ||
        fs.existsSync(path.join(fullPath, 'pom.xml'))) {
      score += 1.0;
    }

    // Git activity bonus: +2.0 if recently committed files exist here
    if (recentDirs.has(dirName)) score += 2.0;

    // Noise penalty: -3.0 (unless directory is in framework's srcDirs)
    if (PENALTY_DIRS.has(dirName.toLowerCase()) && !frameworkSrcDirs.has(dirName)) score -= 3.0;

    // Framework penalty dirs
    if ((frameworkPenalties || []).includes(dirName)) score -= 3.0;

    return Math.round(score * 100) / 100;
  }

  function _countSourceFiles(dir, depth) {
    if (depth <= 0) return 0;
    let count = 0;
    try {
      for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
        if (e.isFile() && CODE_EXTS.has(path.extname(e.name).toLowerCase())) count++;
        else if (e.isDirectory() && depth > 1) count += _countSourceFiles(path.join(dir, e.name), depth - 1);
      }
    } catch (_) {}
    return count;
  }

  module.exports = { scoreCandidate, countTreeCode, sourceFileCountFor, getRecentlyChangedDirs, ROOT_ENTRYPOINTS, JVM_PATH_PATTERN, CODE_EXTS, AUTO_SKIP, PENALTY_DIRS };
  
};

// ── ./src/doctor/diagnose ──
__factories["./src/doctor/diagnose"] = function(module, exports) {
  
  /**
   * sigmap doctor (v8.0 E3).
   *
   * One-shot diagnostic for a SigMap setup: each check reports ok/warn/fail with
   * an actionable fix, so a cold user can reach a useful answer in minutes. Pure,
   * resilient (no check ever throws), zero new runtime deps. Composes the config
   * loader, coverage scorer, signature index, and the known adapter-output /
   * MCP-config paths.
   */

  const fs = require('fs');
  const path = require('path');
  const os = require('os');

  // Generated context files a `read_context`/`ask` flow can consume.
  const ADAPTER_OUTPUTS = [
    ['.github', 'copilot-instructions.md'],
    ['CLAUDE.md'],
    ['AGENTS.md'],
    ['.cursorrules'],
    ['.windsurfrules'],
    ['.github', 'openai-context.md'],
    ['.github', 'gemini-context.md'],
    ['llm-full.txt'],
    ['llm.txt'],
  ];

  const EXCLUDE_DIRS = new Set([
    'node_modules', '.git', 'dist', 'build', 'out', '__pycache__',
    '.next', 'coverage', 'target', 'vendor', '.context',
  ]);

  const ICON = { ok: '✓', warn: '⚠', fail: '✗' };

  // Share of implementation outside srcDirs that turns the report into a warning.
  // Below it, a couple of root entrypoints outside srcDirs is an ordinary layout.
  const OUTSIDE_WARN_SHARE = 0.10;

  // Share of code files in languages the import graph cannot read that turns its
  // report into a warning (#979). Below it, a few files is an ordinary layout.
  const UNTRACKED_WARN_SHARE = 0.10;

  function _short(p, cwd) {
    const rel = path.relative(cwd, p);
    return rel && !rel.startsWith('..') ? rel : p.replace(os.homedir(), '~');
  }

  function _contextFiles(cwd) {
    const out = [];
    for (const parts of ADAPTER_OUTPUTS) {
      const p = path.join(cwd, ...parts);
      try { if (fs.existsSync(p)) out.push(p); } catch (_) {}
    }
    return out;
  }

  function _mcpTargets(cwd, home = os.homedir(), codexHome = path.join(home, '.codex')) {
    return [
      path.join(cwd, '.mcp.json'),
      path.join(cwd, '.cursor', 'mcp.json'),
      path.join(cwd, '.windsurf', 'mcp.json'),
      path.join(cwd, '.vscode', 'mcp.json'),
      path.join(cwd, 'opencode.json'),
      path.join(home, '.codeium', 'windsurf', 'mcp_config.json'),
      path.join(home, '.config', 'opencode', 'opencode.json'),
      path.join(home, '.gemini', 'settings.json'),
      path.join(codexHome, 'config.toml'),
      path.join(home, '.config', 'zed', 'settings.json'),
    ];
  }

  /**
   * Count code files under srcDirs modified after the context was generated.
   * Delegates to the shared primitive so `status` counts the same population
   * against the same timestamp (#825).
   */
  function _countChangedSince(cwd, srcDirs, config, ctxMtime, covered) {
    const { changedSince } = __require('./src/analysis/index-state');
    return changedSince(cwd, Object.assign({}, config, { srcDirs }), ctxMtime, covered);
  }

  /**
   * Run all diagnostic checks.
   * @param {string} cwd
   * @returns {{ checks: Array<{id,label,status,detail,fix}>, ok: boolean, errors: number, warnings: number }}
   */
  function diagnose(cwd, opts = {}) {
    const checks = [];
    const add = (id, label, status, detail, fix) => checks.push({ id, label, status, detail: detail || '', fix: fix || null });

    // 1. Git repository
    try {
      const { tryGit } = __require('./src/util/git');
      const inside = tryGit(['rev-parse', '--is-inside-work-tree'], { cwd });
      if (inside === 'true') add('git', 'Git repository', 'ok', 'recency boost + impact analysis enabled');
      else add('git', 'Git repository', 'warn', 'not a git repository', 'git init — enables recency boost and impact analysis');
    } catch (_) {
      add('git', 'Git repository', 'warn', 'git not available', 'install git for recency boost + impact analysis');
    }

    // 2. Config & source roots
    let config = {};
    try {
      const cfgPath = path.join(cwd, 'gen-context.config.json');
      let configBroken = false;
      if (fs.existsSync(cfgPath)) {
        try { JSON.parse(fs.readFileSync(cfgPath, 'utf8')); }
        catch (e) {
          configBroken = true;
          add('config', 'Config & source roots', 'fail', `gen-context.config.json is invalid JSON: ${e.message}`, 'fix the JSON syntax, or delete the file to fall back to defaults');
        }
      }
      const { loadConfig } = __require('./src/config/loader');
      config = loadConfig(cwd) || {};
      if (!configBroken) {
        // Distinguish explicitly-configured srcDirs (validate each) from the
        // default candidate list (just report which ones actually exist).
        let explicitSrcDirs = null;
        if (fs.existsSync(cfgPath)) {
          try { const raw = JSON.parse(fs.readFileSync(cfgPath, 'utf8')); if (Array.isArray(raw.srcDirs)) explicitSrcDirs = raw.srcDirs; } catch (_) {}
        }
        const exists = (d) => { try { return fs.existsSync(path.isAbsolute(d) ? d : path.join(cwd, d)); } catch (_) { return false; } };
        const srcDirs = Array.isArray(config.srcDirs) ? config.srcDirs : [];
        const present = srcDirs.filter(exists);

        if (explicitSrcDirs) {
          const missing = explicitSrcDirs.filter((d) => !exists(d));
          if (missing.length) add('config', 'Config & source roots', 'warn', `configured srcDirs not found: ${missing.join(', ')}`, 'fix "srcDirs" in gen-context.config.json');
          else add('config', 'Config & source roots', 'ok', `srcDirs: ${explicitSrcDirs.join(', ')}`);
        } else if (present.length === 0) {
          add('config', 'Config & source roots', 'warn', 'no source directories found (looked for src/, app/, lib/, …)', 'create a src/ dir, set "srcDirs" in gen-context.config.json, or run: sigmap roots --fix');
        } else {
          add('config', 'Config & source roots', 'ok', `source roots: ${present.slice(0, 8).join(', ')}${present.length > 8 ? `, +${present.length - 8} more` : ''}`);
        }

        // #805: srcDirs can be confidently wrong. A coverage figure computed over
        // srcDirs cannot see a file the detector never selected, so a flat Go
        // layout reported a healthy-looking percentage while the codebase was
        // invisible. This check measures the population itself.
        try {
          const { outsideSrcDirs } = __require('./src/analysis/coverage-score');
          const outside = outsideSrcDirs(cwd, config);
          const pct = Math.round(outside.share * 100);
          if (outside.total === 0) {
            add('srcdirs-coverage', 'Source files in scope', 'ok', 'every implementation file is under srcDirs');
          } else if (outside.share < OUTSIDE_WARN_SHARE) {
            // A few root-level entrypoints outside srcDirs is a normal layout,
            // so the count is reported without crying wolf.
            const exts = outside.byExt.slice(0, 3).map((e) => `${e.count}${e.ext}`).join(' ');
            add('srcdirs-coverage', 'Source files in scope', 'ok',
              `${outside.inScope} in scope · ${outside.total} outside (${pct}%) — ${exts} in ${outside.dirs.slice(0, 3).join(', ')}`);
          } else {
            const exts = outside.byExt.slice(0, 4).map((e) => `${e.count}${e.ext}`).join(' ');
            add('srcdirs-coverage', 'Source files in scope',
              'warn',
              `${outside.total} of ${outside.inScope + outside.total} implementation file(s) are OUTSIDE srcDirs (${pct}%) — ${exts} in ${outside.dirs.slice(0, 5).join(', ')}`,
              'run: sigmap roots --fix   or widen "srcDirs" in gen-context.config.json');
          }
        } catch (_) {}
      }
    } catch (e) {
      if (!checks.some((c) => c.id === 'config')) add('config', 'Config & source roots', 'warn', `could not load config: ${e.message}`);
    }

    // 2b. The repository figure `generate` and `validate` print: the same words, the same count, and a
    // warning when the roots cover less than 80% of it (#997). The row above only said which roots were
    // picked, and was green for a layout that left 97% of the repository out.
    try {
      if (config && Array.isArray(config.srcDirs) && config.srcDirs.length) {
        const cov = __require('./src/analysis/coverage-score');
        const rc = cov.repositoryCoverage(cwd, config);
        const row = checks.find((c) => c.id === 'config');
        if (row && rc.all > 0) {
          row.detail += ` \u2014 ${cov.formatRepositoryCoverage(rc)}`;
          if (rc.pct < 80 && row.status === 'ok') {
            row.status = 'warn';
            row.fix = 'run: sigmap roots --explain   or widen "srcDirs" in gen-context.config.json';
          }
        }
      }
    } catch (_) {}

    // 3. Generated context file
    const ctxFiles = _contextFiles(cwd);
    if (ctxFiles.length === 0) {
      add('context', 'Generated context', 'fail', 'no context file found', 'run: npx sigmap   (generates the signature map)');
    } else {
      add('context', 'Generated context', 'ok', `${ctxFiles.length} file(s): ${ctxFiles.map((f) => _short(f, cwd)).join(', ')}`);
    }

    // 4. Signature index
    //
    // #825: this printed one bare total ("447 file(s) indexed") over a population
    // `generate` deliberately widens past srcDirs, so it read as coverage of the
    // source tree and never surfaced a genuinely stale entry. The classifier owns
    // the split; the three classes are reported as what they are.
    let indexSize = 0;
    let indexClass = null;
    try {
      const { buildSigIndex } = __require('./src/retrieval/ranker');
      const sigIndex = buildSigIndex(cwd);
      indexSize = sigIndex.size;
      const { classifyIndexEntries } = __require('./src/analysis/index-state');
      indexClass = classifyIndexEntries(cwd, sigIndex.keys(), config);
    } catch (_) {}
    if (indexSize === 0) {
      add('index', 'Signature index', ctxFiles.length === 0 ? 'fail' : 'warn', 'no signatures indexed', 'run: npx sigmap   then: sigmap ask "<query>"');
    } else if (!indexClass) {
      add('index', 'Signature index', 'ok', `${indexSize} file(s) indexed`);
    } else {
      const { formatAugmented, staleRemedies } = __require('./src/analysis/index-state');
      const parts = [`${indexClass.inScope.length} in-scope file(s) indexed`];
      if (indexClass.augmented.length) parts.push(`${indexClass.augmented.length} beyond srcDirs (${formatAugmented(indexClass)})`);
      if (indexClass.stale) parts.push(`${indexClass.stale} stale`);
      const remedies = staleRemedies(indexClass);
      add('index', 'Signature index', indexClass.stale ? 'warn' : 'ok', parts.join(' · '), remedies.length ? remedies[0] : null);
    }

    // 5. Index freshness
    //
    // #825: the timestamp comes from the shared primitive, so `status` cannot
    // report "never" against the same index this calls up to date. An index
    // holding stale entries is not up to date either, whatever the mtimes say.
    try {
      if (ctxFiles.length) {
        const { indexFreshness } = __require('./src/analysis/index-state');
        const fresh = indexFreshness(cwd);
        const sinceMs = fresh.ts ? Date.parse(fresh.ts) : NaN;
        const refMs = Number.isFinite(sinceMs)
          ? sinceMs
          : Math.max(...ctxFiles.map((f) => { try { return fs.statSync(f).mtimeMs; } catch (_) { return 0; } }));
        const srcDirs = (config && Array.isArray(config.srcDirs) && config.srcDirs.length) ? config.srcDirs : ['src', 'app', 'lib'];
        // A file the live overlay already describes is reflected in queries, so it
        // is not a change the index is missing (#926); the static files it leaves
        // behind are reported by the "Live index" check below.
        let covered = null;
        try { covered = __require('./src/analysis/index-state').liveIndexState(cwd).overlay; } catch (_) {}
        const changed = _countChangedSince(cwd, srcDirs, config, refMs, covered);
        const from = fresh.source ? ` (from ${fresh.source})` : '';
        if (changed > 0) add('freshness', 'Index freshness', 'warn', `${changed} source file(s) changed since last generate${from}`, 'run: sigmap   (or: sigmap --watch to auto-refresh)');
        else if (indexClass && indexClass.stale) add('freshness', 'Index freshness', 'warn', `sources unchanged${from}, but the index holds ${indexClass.stale} stale entry/entries`, 'run: sigmap   (prunes deleted files), then: sigmap validate');
        else add('freshness', 'Index freshness', 'ok', `index is up to date with sources${from}`);
      }
    } catch (_) {}

    // 5b. Live index (#926)
    //
    // Only when there is something to say: an overlay holding changes the written
    // context files do not yet reflect, or a watcher that has recorded how long a
    // save takes to reach queries. A repo that has never used either gets no row.
    try {
      if (ctxFiles.length) {
        const { liveIndexState } = __require('./src/analysis/index-state');
        const live = liveIndexState(cwd);
        if (live.overlayDepth > 0 || live.watcher) {
          const parts = [];
          if (live.overlayDepth > 0) parts.push(`${live.overlayDepth} file(s) served from the overlay, not yet in the written context files`);
          if (live.watcher) parts.push(live.watcher.running ? `watcher running (pid ${live.watcher.pid})` : 'last watcher is not running');
          if (live.measured) parts.push(`last save → index ${live.lastLatencyMs} ms (${live.lastLatencyPath})`);
          else if (live.watcher) parts.push('save → index latency not measured yet');
          const watching = live.watcher && live.watcher.running;
          if (live.overlayDepth > 0 && !watching) {
            add('live', 'Live index', 'warn', parts.join(' · '), 'run: sigmap   (regenerates the written files), or: sigmap daemon start');
          } else {
            add('live', 'Live index', 'ok', parts.join(' · '));
          }
        }
      }
    } catch (_) {}

    // 6. Coverage
    try {
      if (indexSize > 0) {
        // #762: this fed `coverageScore` the RETRIEVAL INDEX and then printed
        // "of source files in context" — so doctor claimed 100% in-context while
        // the run that built that context reported 54%. The index deliberately
        // holds more than the budget admitted. Measure what is actually in the
        // context file, and name the population either way.
        const { coverageScore, formatCoverage, inContextFiles } = __require('./src/analysis/coverage-score');
        const cov = coverageScore(cwd, inContextFiles(cwd), config);
        const line = formatCoverage(cov, 'in-context');
        if (cov.score < 70) add('coverage', 'Coverage', 'warn', line, 'increase maxTokens or expand srcDirs in gen-context.config.json');
        else add('coverage', 'Coverage', 'ok', line);
      }
    } catch (_) {}

    // 6b. Instruction files against what the host reads (#995)
    //
    // Codex loads at most `project_doc_max_bytes` of an AGENTS.md and Claude Code asks for
    // a short CLAUDE.md. Truncation is silent, so a file over its limit is a warning here,
    // whoever wrote the lines that put it there.
    try {
      const hl = __require('./src/util/host-limits');
      const home = opts.home || os.homedir();
      const env = opts.env || process.env;
      const rows = [];
      const over = [];
      for (const [file, target] of [['AGENTS.md', 'codex'], ['CLAUDE.md', 'claude']]) {
        let text;
        try { text = fs.readFileSync(path.join(cwd, file), 'utf8'); } catch (_) { continue; }
        const limit = hl.hostLimit(target, config, env, home);
        if (!limit) {
          const unit = target === 'claude' ? 'lines' : 'bytes';
          rows.push(`${file} ${hl.formatSize(unit, hl.measure(unit, text))} (cap off)`);
          continue;
        }
        const size = hl.measure(limit.unit, text);
        rows.push(`${file} ${hl.formatSize(limit.unit, size)} of ${hl.formatSize(limit.unit, limit.max)}`);
        if (size > limit.max) {
          over.push(target === 'codex'
            ? `${file} is over Codex's limit: it reads the first ${hl.formatSize('bytes', limit.max)} and cuts the rest`
            : `${file} is over ${limit.max} lines: Claude Code asks for a short file`);
        }
      }
      if (rows.length) {
        if (over.length) {
          add('instructions', 'Instruction files', 'warn', `${rows.join(' · ')} — ${over.join('; ')}`,
            'run: sigmap   (the "codex" and "claude" outputs are written to fit); the lines you wrote above SigMap\'s block are yours to trim, and codexMaxBytes / claudeMaxLines set the limit');
        } else {
          add('instructions', 'Instruction files', 'ok', rows.join(' · '));
        }
      }
    } catch (_) {}

    // 7. Model profile (#688)
    //
    // Every model name, price and window SigMap prints comes from one dated
    // table. Nothing refreshes it — there is no live fetch — so its age is the
    // only freshness signal there is, and a roster entry with no figures is
    // advice that cannot be costed.
    try {
      const { resolveProfile, profileAge, asOfLabel, STALE_AFTER_DAYS } = __require('./src/config/models');
      const profile = resolveProfile(config);
      const age = profileAge(profile, opts.nowMs);
      const roster = profile.rosterDeclared ? `roster: ${profile.roster.join(', ')}` : 'no roster declared — advice names the shipped defaults';
      if (age.stale) {
        add('models', 'Model profile', 'warn',
          `${asOfLabel(profile)} is ${age.days} days old (limit ${STALE_AFTER_DAYS}) — model names, prices and windows may have changed`,
          'check your vendors\' pricing pages, then set "models.asOf" and any changed figures in gen-context.config.json — or upgrade sigmap');
      } else if (profile.rosterUnknown.length) {
        add('models', 'Model profile', 'warn',
          `roster names model(s) with no price on record: ${profile.rosterUnknown.join(', ')}`,
          'add them under "models.prices" (and "models.windows", "models.tiers") in gen-context.config.json');
      } else {
        add('models', 'Model profile', 'ok', `${asOfLabel(profile)} · ${roster}`);
      }
    } catch (_) {}

    // 8. MCP wiring
    try {
      let wired = null;
      const home = opts.home || os.homedir();
      const env = opts.env || process.env;
      const codexHome = path.resolve(cwd, opts.codexHome || env.CODEX_HOME || path.join(home, '.codex'));
      for (const t of _mcpTargets(cwd, home, codexHome)) {
        try {
          if (!fs.existsSync(t)) continue;
          if (/sigmap/.test(fs.readFileSync(t, 'utf8'))) { wired = t; break; }
        } catch (_) {}
      }
      if (wired) add('mcp', 'MCP wiring', 'ok', `registered in ${_short(wired, cwd)}`);
      else add('mcp', 'MCP wiring', 'warn', 'MCP server not registered in any editor config', 'run: sigmap --setup   (auto-wires Claude, Cursor, Windsurf, VS Code, …)');
    } catch (_) {}

    // 8b. MCP tool profile (#878). Every definition is paid for in tokens at the
    // start of every MCP session, so the active profile and its cost are shown — and,
    // on "all", what "core" would cost instead. The resolver is the one the server
    // uses, so this row cannot disagree with what `tools/list` returns.
    try {
      const profile = __require('./src/mcp/profile');
      const resolved = profile.resolveProfile(config);
      // `session.mcpCapture` adds a tool the profile does not own; the figure is what the client receives.
      let captureOn = false;
      try { captureOn = __require('./src/session/store').sessionConfig(config).mcpCapture === true; } catch (_) {}
      const shown = profile.label(resolved, captureOn);
      if (resolved.notes.length > 0) {
        add('mcp-tools', 'MCP tool profile', 'warn', `${resolved.notes.join('; ')} · ${shown}`,
          'set "mcp.tools" in gen-context.config.json to "all", "core" or a list of tool names (inside an "mcp" object)');
      } else if (resolved.profile === 'all') {
        add('mcp-tools', 'MCP tool profile', 'ok',
          `${shown} · "mcp.tools": "core" would advertise ${profile.CORE.length} tools, ~${resolved.coreTokens.toLocaleString('en-US')} tokens`);
      } else {
        add('mcp-tools', 'MCP tool profile', 'ok', shown);
      }
    } catch (_) {}

    // 9. Git hook (#784)
    //
    // `--setup` installs a post-commit hook that regenerates context on every
    // commit, and nothing afterwards said whether it was still there: a hook from
    // months ago could point at a deleted install, run twice per commit, have lost
    // its executable bit, or sit in a directory git no longer reads.
    try {
      const { inspectPostCommitHook } = __require('./src/util/post-commit-hook');
      const { tryGit } = __require('./src/util/git');
      const hook = inspectPostCommitHook(cwd);
      const rel = _short(hook.path, cwd);
      const setup = 'run: sigmap --setup   (installs it, or rewrites it to the current install)';
      if (!hook.gitHooks) {
        if (tryGit(['rev-parse', '--is-inside-work-tree'], { cwd }) === 'true') {
          add('hook', 'Git hook', 'ok', 'no .git/hooks directory here (worktree or submodule) — the hook lives in the main checkout');
        }
      } else {
        const hooksPath = tryGit(['config', '--get', 'core.hooksPath'], { cwd });
        if (!hook.exists || hook.copies === 0) {
          add('hook', 'Git hook', 'warn',
            hook.exists ? `${rel} exists but does not run SigMap` : 'no post-commit hook — context is regenerated only when you run sigmap',
            setup);
        } else if (hook.copies > 1) {
          add('hook', 'Git hook', 'warn', `${rel} runs SigMap ${hook.copies} times per commit`, setup + ' — collapses the copies to one');
        } else if (!hook.scriptExists) {
          add('hook', 'Git hook', 'warn', `${rel} runs ${_short(hook.script, cwd)}, which no longer exists`, setup);
        } else if (hook.executable === false) {
          add('hook', 'Git hook', 'warn', `${rel} is not executable — git skips it`, 'run: chmod +x ' + rel);
        } else if (hooksPath && path.resolve(cwd, hooksPath) !== path.dirname(hook.path)) {
          add('hook', 'Git hook', 'warn', `core.hooksPath is ${hooksPath}, so git does not run ${rel}`, `add the SigMap line from ${rel} to ${hooksPath}/post-commit`);
        } else {
          add('hook', 'Git hook', 'ok', `${rel} regenerates context after each commit (runs ${_short(hook.script, cwd)})`);
        }
      }
    } catch (_) {}

    // 10. Session capture (#922). Optional: a repo that never captured a session gets no
    // check at all, so this adds nothing for anyone who has not opted in.
    try {
      const sessions = __require('./src/session/store').inspect(cwd);
      const { inspectClaudeHooks } = __require('./src/session/hooks-install');
      const hooks = inspectClaudeHooks(cwd);
      if (sessions.exists || hooks.files.length > 0) {
        const store = path.relative(cwd, sessions.path) || sessions.path;
        if (!sessions.exists) {
          add('sessions', 'Session store', 'ok', 'no sessions recorded yet (hooks are wired; the store appears after the first session)');
        } else if (sessions.corrupt > 0 || sessions.unsupported > 0) {
          add('sessions', 'Session store', 'warn',
            `${store}: ${sessions.corrupt} unreadable and ${sessions.unsupported} newer-schema line(s) skipped (${sessions.sessions} session(s) readable)`,
            'the readable sessions are unaffected; compaction drops the damaged lines the next time it rewrites the file');
        } else if (sessions.bytes > 5 * 1024 * 1024) {
          add('sessions', 'Session store', 'warn', `${store} is ${(sessions.bytes / 1048576).toFixed(1)} MB`, 'run: sigmap session compact   (or lower session.retention.days)');
        } else if (sessions.staleLock) {
          add('sessions', 'Session store', 'warn', 'a compaction lock is older than 30s', 'delete .context/sessions.lock if no sigmap process is running');
        } else {
          add('sessions', 'Session store', 'ok', `${sessions.sessions} session(s), ${sessions.events} event(s), ${sessions.open} open${sessions.rollups ? `, ${sessions.rollups} monthly rollup(s)` : ''}`);
        }
        if (hooks.missingScript.length) {
          add('session-hooks', 'Session hooks', 'warn', `a hook runs ${_short(hooks.missingScript[0], cwd)}, which no longer exists`, 'run: sigmap hooks install claude   (rewrites them to the current install)');
        } else if (hooks.files.some((f) => f.error)) {
          add('session-hooks', 'Session hooks', 'warn', hooks.files.find((f) => f.error).error, 'fix the JSON, then run: sigmap hooks install claude');
        } else if (hooks.wired) {
          add('session-hooks', 'Session hooks', 'ok', `Claude Code: ${hooks.events.join(', ')}`);
        } else if (hooks.files.length > 0) {
          add('session-hooks', 'Session hooks', 'warn', `only ${hooks.events.join(', ') || 'none'} wired — a session needs SessionStart and SessionEnd`, 'run: sigmap hooks install claude');
        } else {
          add('session-hooks', 'Session hooks', 'ok', 'not installed — sessions are only recorded by `sigmap session log` (optional: sigmap hooks install claude)');
        }
      }
    } catch (_) {}

    // 11. Local state stays out of git (#947). `.context/` holds derived indexes, run telemetry
    // and session records. SigMap now writes `.context/.gitignore` itself, but a repo that
    // committed the directory under an earlier version keeps tracking it — ignore rules never
    // untrack — so the check looks at what git does, not at what SigMap wrote. Silent when there
    // is no `.context/` or no git: nothing to commit, nothing to say.
    try {
      const { tryGit } = __require('./src/util/git');
      if (fs.statSync(path.join(cwd, '.context')).isDirectory()
          && tryGit(['rev-parse', '--is-inside-work-tree'], { cwd }) === 'true') {
        const tracked = tryGit(['ls-files', '-z', '--', '.context'], { cwd }).split('\0').filter(Boolean);
        if (tracked.length > 0) {
          add('context-git', 'Local state in git', 'warn',
            `${tracked.length} file(s) under .context/ are tracked by git (indexes, telemetry, session records)`,
            'run: git rm -r --cached .context   (the files stay on disk and are ignored from then on)');
        } else if (tryGit(['check-ignore', '--', '.context/sig-index.json'], { cwd })) {
          add('context-git', 'Local state in git', 'ok', '.context/ is ignored by git');
        } else {
          add('context-git', 'Local state in git', 'warn', '.context/ is not ignored — `git add .` would commit it',
            'run: sigmap   (writes .context/.gitignore), or add ".context/" to your .gitignore');
        }
      }
    } catch (_) {}

    // 12. Import-graph reach (#979). The graph reads eight language families; a
    // file in any other language has no edges, so --impact / get_impact answer
    // "not tracked" for it. Say so here, before a query reaches it. A few stray
    // files are an ordinary layout; past a tenth of the code, it is a warning.
    try {
      const { censusUntracked, graphLanguageList } = __require('./src/graph/language-support');
      // No roots or exclusions passed: the census resolves them exactly as the
      // graph walk does, so it counts the tree the graph would have read.
      const census = censusUntracked(cwd);
      if (census.untracked === 0) {
        if (census.tracked > 0) add('graph', 'Import graph', 'ok', `${census.tracked} file(s) in languages it reads (${graphLanguageList()})`);
      } else {
        const list = census.languages.slice(0, 6).map((l) => `${l.label} ${l.files}`).join(', ')
          + (census.languages.length > 6 ? `, +${census.languages.length - 6} more` : '');
        const share = census.untracked / (census.untracked + census.tracked);
        add('graph', 'Import graph', share < UNTRACKED_WARN_SHARE ? 'ok' : 'warn',
          `${census.tracked} file(s) readable; ${census.untracked} in languages it does not read (${list}) — --impact and get_impact report these as "not tracked", not as having no dependents`,
          share < UNTRACKED_WARN_SHARE ? null : `the import graph reads ${graphLanguageList()} only; signatures, ranking and ask still cover every language`);
      }
    } catch (_) {}

    const errors = checks.filter((c) => c.status === 'fail').length;
    const warnings = checks.filter((c) => c.status === 'warn').length;
    return { checks, ok: errors === 0, errors, warnings };
  }

  /** Human-readable checklist. */
  function formatDoctor(result) {
    const lines = ['sigmap doctor', ''];
    for (const c of result.checks) {
      lines.push(`${ICON[c.status] || '?'} ${c.label}${c.detail ? ' — ' + c.detail : ''}`);
      if (c.status !== 'ok' && c.fix) lines.push(`    ↳ ${c.fix}`);
    }
    lines.push('');
    lines.push(
      result.errors === 0 && result.warnings === 0
        ? '✓ All checks passed.'
        : `${result.errors} error(s), ${result.warnings} warning(s).`
    );
    return lines.join('\n');
  }

  /** Machine-readable result. */
  function formatDoctorJSON(result) {
    return JSON.stringify(result, null, 2);
  }

  module.exports = { diagnose, formatDoctor, formatDoctorJSON };
  
};

// ── ./src/eval/analyzer ──
__factories["./src/eval/analyzer"] = function(module, exports) {
  
  /**
   * SigMap file analyzer — per-file diagnostic statistics.
   * Zero npm dependencies.
   *
   * Exports:
   *   analyzeFiles(files, cwd, opts) → stats[]
   *   formatAnalysisTable(stats)    → markdown table string
   *   formatAnalysisJSON(stats)     → plain object suitable for JSON.stringify
   */

  const fs   = require('fs');
  const path = require('path');

  // Extension → extractor name (mirrors EXT_MAP in gen-context.js)
  // Extractor resolution goes through the dispatcher — the single source of
  // truth (#591). This file previously kept its own copy, which had drifted to
  // a dead duplicate `.vue` key.
  const { langFor } = __require('./src/extractors/dispatch');
  const { buildTestCoverageIndex } = __require('./src/analysis/test-coverage');

  function getExtractorName(filePath) {
    return langFor(filePath);
  }

  /** Rough token estimate: chars / 4 */
  function tokenCount(sigs) {
    return Math.ceil(sigs.reduce((sum, s) => sum + s.length, 0) / 4);
  }

  /**
   * Load an extractor module from src/extractors/ relative to cwd.
   * Falls back to requiring from the module directory itself.
   */
  function loadExtractor(name, cwd) {
    // Try repo-local src/extractors first (for projects that embed sigmap)
    const local = path.join(cwd, 'src', 'extractors', `${name}.js`);
    if (fs.existsSync(local)) {
      try { return require(local); } catch (_) {}
    }
    // Then standard node resolution from the current package
    try { return require(path.join(__dirname, '..', 'extractors', `${name}.js`)); } catch (_) {}
    return null;
  }

  /**
   * Analyze a list of absolute file paths.
   *
   * @param {string[]} files   - absolute paths to analyze
   * @param {string}   cwd     - project root
   * @param {object}  [opts]
   * @param {boolean} [opts.slow=false]  - if true, measure extraction time per file
   * @param {number}  [opts.slowMs=50]   - threshold (ms) before a file is "slow"
   * @param {number}  [opts.maxSigs=25]  - max sigs per file
   * @returns {object[]} array of per-file stat objects
   */
  function analyzeFiles(files, cwd, opts) {
    const slow    = (opts && opts.slow)   || false;
    const slowMs  = (opts && opts.slowMs) || 50;
    const maxSigs = (opts && opts.maxSigs) || 25;

    const stats = [];
    const extractorCache = {};
    // One index for the whole run, shared with `plan` (#862).
    const coverage = buildTestCoverageIndex(cwd, { files });

    for (const filePath of files) {
      const extractorName = getExtractorName(filePath);
      if (!extractorName) continue;

      // Load extractor (cached)
      if (!extractorCache[extractorName]) {
        extractorCache[extractorName] = loadExtractor(extractorName, cwd);
      }
      const extractor = extractorCache[extractorName];
      if (!extractor || typeof extractor.extract !== 'function') continue;

      let content;
      try { content = fs.readFileSync(filePath, 'utf8'); } catch (_) { continue; }

      let sigs;
      let elapsedMs = 0;

      if (slow) {
        const t0 = Date.now();
        try { sigs = extractor.extract(content, filePath); } catch (_) { sigs = []; }
          elapsedMs = Date.now() - t0;
      } else {
        try { sigs = extractor.extract(content, filePath); } catch (_) { sigs = []; }
      }

      sigs = (Array.isArray(sigs) ? sigs : []).slice(0, maxSigs);

      const rel      = path.relative(cwd, filePath);
      const tokens   = tokenCount(sigs);
      const covered  = coverage.testsFor(rel).length > 0;
      const isSlow   = slow && elapsedMs > slowMs;
      // v4.0: signal quality = sigs per line-of-code (higher = more informative to LLMs)
      const linesOfCode    = content.split('\n').length;
      const signalQuality  = linesOfCode > 0 ? parseFloat((sigs.length / linesOfCode).toFixed(4)) : 0;

      stats.push({
        file:          rel,
        extractor:     extractorName,
        sigs:          sigs.length,
        tokens,
        covered,
        linesOfCode,
        signalQuality,
        elapsedMs:     slow ? elapsedMs : undefined,
        slow:          slow ? isSlow : undefined,
      });
    }

    return stats;
  }

  /**
   * Format stats as a markdown table.
   *
   * @param {object[]} stats - output of analyzeFiles()
   * @param {boolean}  showSlow - whether to include the Elapsed column
   * @returns {string}
   */
  function formatAnalysisTable(stats, showSlow) {
    if (!stats || stats.length === 0) return '_(no files analyzed)_\n';

    // Column widths. A loop, not `Math.max(4, ...lengths)`: one argument per
    // file overflows the stack past ~125k files (#855).
    let maxFile = 4;
    for (const s of stats) if (s.file.length > maxFile) maxFile = s.file.length;

    const header = showSlow
      ? `| ${'File'.padEnd(maxFile)} | Sigs | Tokens | Extractor   | Coverage   | Elapsed  |`
      : `| ${'File'.padEnd(maxFile)} | Sigs | Tokens | Extractor   | Coverage   |`;

    const sep = showSlow
      ? `|${'-'.repeat(maxFile + 2)}|------|--------|-------------|------------|----------|`
      : `|${'-'.repeat(maxFile + 2)}|------|--------|-------------|------------|`;

    const rows = stats.map((s) => {
      const cov  = s.covered ? '✓ tested  ' : '✗ untested';
      const file = s.file.padEnd(maxFile);
      const ext  = (s.extractor || '').padEnd(11);
      const base = `| ${file} | ${String(s.sigs).padStart(4)} | ${String(s.tokens).padStart(6)} | ${ext} | ${cov} |`;
      if (showSlow) {
        const ms = s.elapsedMs !== undefined ? `${s.elapsedMs}ms` : '';
        const flag = s.slow ? ' ⚠️' : '';
        return `${base} ${ms.padStart(6)}${flag} |`;
      }
      return base;
    });

    const totalSigs   = stats.reduce((n, s) => n + s.sigs,   0);
    const totalTokens = stats.reduce((n, s) => n + s.tokens, 0);
    const slotFile    = ''.padEnd(maxFile);
    const baseFoot    = `| ${slotFile} | ${String(totalSigs).padStart(4)} | ${String(totalTokens).padStart(6)} | **Total**   |            |`;
    const footer = showSlow ? `${baseFoot} ${' '.padStart(8)} |` : baseFoot;

    return [header, sep, ...rows, sep, footer].join('\n') + '\n';
  }

  /**
   * Format stats as a plain-object suitable for JSON.stringify.
   *
   * @param {object[]} stats
   * @returns {object}
   */
  function formatAnalysisJSON(stats) {
    const totalSigs   = stats.reduce((n, s) => n + s.sigs,   0);
    const totalTokens = stats.reduce((n, s) => n + s.tokens, 0);
    const slowFiles   = stats.filter((s) => s.slow);

    return {
      files:       stats,
      totalSigs,
      totalTokens,
      slowFiles:   slowFiles.map((s) => ({ file: s.file, elapsedMs: s.elapsedMs })),
      fileCount:   stats.length,
    };
  }

  module.exports = { analyzeFiles, formatAnalysisTable, formatAnalysisJSON };
  
};

// ── ./src/eval/corpus ──
__factories["./src/eval/corpus"] = function(module, exports) {
  
  /**
   * Task-corpus hygiene (A3, v8.22 "Hard Corpus").
   *
   * A benchmark query "leaks" when it shares a token with the basenames of its
   * expected files — hit@5 then partly measures filename matching, not
   * retrieval. The criterion is deterministic and reuses the production
   * tokenizer (identifier splitting + stemming from src/retrieval/bm25.js), so
   * "payments" leaks against payment.js and "InterceptorManager" leaks against
   * "interceptor manager" the same way the ranker would see them.
   *
   * Tasks carry an optional `split` field: 'hard' tasks MUST be leak-free
   * (validateTasks reports them as violations); 'easy' tasks (the default) may
   * leak — that is what makes them easy.
   *
   * Size buckets group repos by indexed file count so large repos stop being
   * averaged away by tiny ones. Thresholds are the rough tertiles of the
   * current benchmarks/repos corpus (43 repos, 27–3450 source files).
   */

  const { tokenize } = __require('./src/retrieval/bm25');

  const BUCKET_LIMITS = { small: 200, medium: 1000 }; // files; large = above medium

  /**
   * Stemmed tokens of a file path's basename (extension stripped).
   * @param {string} filePath
   * @returns {string[]}
   */
  function basenameTokens(filePath) {
    const base = String(filePath).split('/').pop() || '';
    return tokenize(base.replace(/\.[^.]*$/, ''));
  }

  /**
   * Leaked tokens between a query and its expected files' basenames.
   * @param {string} query
   * @param {string[]} expectedFiles
   * @returns {{ leaked: string[], clean: boolean }}
   */
  function queryLeakage(query, expectedFiles) {
    const qToks = new Set(tokenize(query));
    const leaked = new Set();
    for (const f of expectedFiles || []) {
      for (const t of basenameTokens(f)) {
        if (qToks.has(t)) leaked.add(t);
      }
    }
    return { leaked: [...leaked].sort(), clean: leaked.size === 0 };
  }

  /**
   * Validate a task list: every task gets a leakage result; hard-split tasks
   * that leak are violations.
   * @param {Array<{id?:string, query:string, expected_files?:string[], split?:string}>} tasks
   * @returns {{ results: object[], hardViolations: object[] }}
   */
  function validateTasks(tasks) {
    const results = [];
    const hardViolations = [];
    for (const t of tasks || []) {
      const split = t.split === 'hard' ? 'hard' : 'easy';
      const { leaked, clean } = queryLeakage(t.query, t.expected_files);
      const row = { id: t.id || '?', split, leaked, clean };
      results.push(row);
      if (split === 'hard' && !clean) hardViolations.push(row);
    }
    return { results, hardViolations };
  }

  /**
   * Size bucket for a repo by indexed file count.
   * @param {number} fileCount
   * @returns {'small'|'medium'|'large'}
   */
  function sizeBucket(fileCount) {
    if (fileCount < BUCKET_LIMITS.small) return 'small';
    if (fileCount <= BUCKET_LIMITS.medium) return 'medium';
    return 'large';
  }

  module.exports = { basenameTokens, queryLeakage, validateTasks, sizeBucket, BUCKET_LIMITS };
  
};

// ── ./src/eval/llm-ablation ──
__factories["./src/eval/llm-ablation"] = function(module, exports) {
  
  /**
   * LLM A/B hallucination ablation (IMPL.md §9) — the honest measurement.
   *
   * Runs a model twice per task — (A) no SigMap context, (B) with SigMap
   * grounding — pipes both outputs through the hallucination guard, and reports
   * the measured delta in flagged codebase-fact errors. The model call is
   * INJECTED (`complete(prompt) → text`), so the harness itself is pure and
   * offline-testable; the live model adapter lives in `scripts/run-llm-ablation.mjs`.
   * Zero-dependency, bundle-safe (no network here).
   */

  const { verify } = __require('./src/verify/hallucination-guard');

  const path = require('path');

  /** Strip a signature's trailing line anchor (` :12-20`) for prompt cleanliness. */
  function _cleanSig(sig) {
    return String(sig).replace(/\s*:\d+(?:-\d+)?\s*$/, '').trim();
  }

  /**
   * Build the SigMap grounding block for a repo — what we prepend to a task
   * prompt in arm B. Conventions (the house style) + **exact signatures** grouped
   * by file (what `get_callee_signatures` returns), so the model references the
   * real surface instead of guessing — the actual product behavior, not a flat
   * name dump.
   * @param {string} cwd
   * @param {object} [opts]
   * @param {number} [opts.maxSignatures=150] cap on signature lines (bounds prompt size)
   * @returns {string}
   */
  function buildGrounding(cwd, opts = {}) {
    const maxSignatures = opts.maxSignatures != null ? opts.maxSignatures : 150;
    const parts = [];

    let index = null;
    try {
      const { buildSigIndex } = __require('./src/retrieval/ranker');
      index = buildSigIndex(cwd);
    } catch (_) {}

    try {
      const { extractConventions } = __require('./src/conventions/extract');
      const { renderConventionsBlock } = __require('./src/conventions/inject');
      const files = index ? [...index.keys()] : [];
      parts.push(renderConventionsBlock(extractConventions(cwd, files)));
    } catch (_) {}

    if (index) {
      const lines = ['## Exact signatures (use these — do not invent symbols or paths)'];
      let count = 0;
      for (const [file, sigs] of index) {
        if (count >= maxSignatures) break;
        const rel = path.relative(cwd, file).replace(/\\/g, '/');
        const clean = (sigs || []).map(_cleanSig).filter(Boolean);
        if (!clean.length) continue;
        lines.push(`### ${rel}`);
        for (const s of clean) {
          if (count >= maxSignatures) break;
          lines.push(s);
          count++;
        }
      }
      if (count > 0) parts.push(lines.join('\n'));
    }

    return parts.join('\n\n');
  }

  /**
   * Score an answer: flagged codebase-fact errors + the issue list (the §9 metric).
   * @param {string} answerText
   * @param {string} cwd
   * @returns {{ total: number, issues: object[] }}
   */
  function scoreAnswerDetail(answerText, cwd) {
    try {
      const { issues, summary } = verify(String(answerText || ''), cwd);
      return { total: summary.total || 0, issues: issues || [] };
    } catch (_) {
      return { total: 0, issues: [] };
    }
  }

  /** Count flagged codebase-fact errors in an answer (the §9 metric). */
  function scoreAnswer(answerText, cwd) {
    return scoreAnswerDetail(answerText, cwd).total;
  }

  /**
   * Run the A/B ablation over a task corpus.
   * @param {Array<{id:string, prompt:string}>} tasks
   * @param {string} cwd
   * @param {(prompt:string, meta:object)=>string} complete injected model call
   * @param {object} [opts]
   * @param {string} [opts.grounding] precomputed grounding (else built from cwd)
   * @param {boolean} [opts.collectIssues] attach `aIssues`/`bIssues` per task
   * @returns {{ tasks: object[], aggregate: object }}
   */
  function runAblation(tasks, cwd, complete, opts = {}) {
    const grounding = opts.grounding != null ? opts.grounding : buildGrounding(cwd);
    const rows = [];
    let sumA = 0;
    let sumB = 0;

    for (const task of tasks || []) {
      const basePrompt = task.prompt || '';
      const groundedPrompt = grounding ? `${grounding}\n\n---\n\n${basePrompt}` : basePrompt;

      const outA = String(complete(basePrompt, { id: task.id, grounded: false }) || '');
      const outB = String(complete(groundedPrompt, { id: task.id, grounded: true }) || '');

      const a = scoreAnswerDetail(outA, cwd);
      const b = scoreAnswerDetail(outB, cwd);
      sumA += a.total;
      sumB += b.total;
      const row = { id: task.id, aFlagged: a.total, bFlagged: b.total };
      if (opts.collectIssues) { row.aIssues = a.issues; row.bIssues = b.issues; }
      rows.push(row);
    }

    const n = rows.length;
    const per100 = (sum) => (n > 0 ? (sum / n) * 100 : 0);
    return {
      tasks: rows,
      aggregate: {
        n,
        withoutFlagged: sumA,
        withFlagged: sumB,
        delta: sumA - sumB,
        withoutPer100: per100(sumA),
        withPer100: per100(sumB),
      },
    };
  }

  /** mean/min/max of a number list (0s for an empty list). */
  function _stats(nums) {
    if (!nums.length) return { mean: 0, min: 0, max: 0 };
    const sum = nums.reduce((a, b) => a + b, 0);
    return { mean: sum / nums.length, min: Math.min(...nums), max: Math.max(...nums) };
  }

  /**
   * Aggregate several `runAblation` passes into a stable estimate — mean ± range
   * of the without/with per-100 flag rates and their delta. At N=40 with tiny raw
   * counts a single pass is noisy; averaging repeated passes gives a publishable
   * number with an honest spread.
   * @param {object[]} aggregates the `.aggregate` object from each runAblation pass
   * @returns {{ runs:number, n:number, withoutPer100:object, withPer100:object, deltaPer100:object }}
   */
  function aggregateRuns(aggregates) {
    const runs = (aggregates || []).filter(Boolean);
    const without = runs.map((a) => a.withoutPer100);
    const withG = runs.map((a) => a.withPer100);
    const delta = runs.map((a) => a.withoutPer100 - a.withPer100);
    return {
      runs: runs.length,
      n: runs.length ? runs[0].n : 0,
      withoutPer100: _stats(without),
      withPer100: _stats(withG),
      deltaPer100: _stats(delta),
    };
  }

  module.exports = { buildGrounding, scoreAnswer, scoreAnswerDetail, runAblation, aggregateRuns };
  
};

// ── ./src/eval/runner ──
__factories["./src/eval/runner"] = function(module, exports) {
  
  /**
   * SigMap benchmark runner.
   * Zero npm dependencies.
   *
   * Loads evaluation tasks from a JSONL file, runs signature-based retrieval
   * against a target repo, and returns scored results.
   *
   * Usage (programmatic):
   *   const { run } = __require('./src/eval/src/eval/runner');
   *   const results = run('benchmarks/tasks/retrieval.jsonl', cwd);
   *   // results: { tasks: [...], metrics: { hitAt5, mrr, precisionAt5, avgTokens, tasks } }
   *
   * Usage (CLI via gen-context.js --benchmark):
   *   node gen-context.js --benchmark
   *   node gen-context.js --benchmark --json
   */

  const fs = require('fs');
  const path = require('path');
  const { aggregate } = __require('./src/eval/scorer');
  const { bm25rank } = __require('./src/retrieval/bm25');

  // ---------------------------------------------------------------------------
  // Context file reader
  // ---------------------------------------------------------------------------

  /**
   * Read the generated context file and build a simple signature index:
   *   Map<filePath, string[]>  — file → list of signature strings
   *
   * The context file uses section headers like:
   *   ### src/extractors/python.js
   * followed by ``` blocks containing signatures.
   *
   * @param {string} cwd
   * @returns {Map<string, string[]>}
   */
  function buildSigIndex(cwd) {
    // Delegate to the production index builder. This used to parse
    // .github/copilot-instructions.md directly — a second parallel implementation
    // that saw only the token-BUDGETED view, ignored the other adapters, the
    // hot-cold/per-module strategy splits, and the complete retrieval index. The
    // corpus therefore scored a smaller index than `sigmap ask` actually uses.
    return __require('./src/retrieval/ranker').buildSigIndex(cwd);
  }

  // ---------------------------------------------------------------------------
  // Identifier-aware BM25 ranking (v7.31; see src/retrieval/bm25.js and #395)
  // ---------------------------------------------------------------------------

  const { tokenize } = __require('./src/retrieval/bm25');

  /**
   * Rank all files in the index against a query with the identifier-aware BM25
   * re-ranker. Returns file entries sorted by relevance score descending; ties
   * are broken by file path alphabetically (deterministic).
   * @param {string} query
   * @param {Map<string, string[]>} index
   * @param {number} topK
   * @returns {{ file: string, score: number, sigs: string[] }[]}
   */
  function rank(query, index, topK = 10, opts = {}) {
    // Measure the ranker users actually hit. This used to call bm25rank directly,
    // which meant the corpus scored a parallel implementation with no penalties,
    // graph boost, recency or learned weights — so no ranking regression in
    // src/retrieval/ranker.js could ever show up in the benchmark numbers.
    const { rank: prodRank } = __require('./src/retrieval/ranker');
    const o = Object.assign({ topK }, opts);
    // What ships includes body words whenever retrieval.bodyWords is on (the default, or the
    // repository's own gen-context.config.json), so a caller that names none gets them: built in
    // memory from the sources under `cwd`, never cached, so a pinned checkout is left as it was.
    // A caller that names the option — a Map to use, or null or undefined for none — is scoring
    // something else on purpose and is left alone.
    if (!Object.prototype.hasOwnProperty.call(o, 'bodyWords') && o.cwd) {
      const bodyWords = defaultBodyWords(index, o.cwd);
      if (bodyWords) o.bodyWords = bodyWords;
    }
    return prodRank(query, index, o).slice(0, topK);
  }

  /** `index` -> its body words, so one index scored over many tasks reads its sources once. */
  const _bodyWordsOf = new WeakMap();

  /** `{repository, config file mtime, the default}` -> whether it ships body words; the config is read once. */
  const _flagOf = new Map();

  /**
   * Whether the repository at `cwd` ships body words, resolved the way `ask` resolves it: the
   * default in src/config/defaults.js, merged with the repository's `gen-context.config.json` and
   * whatever it `extends`, through the config loader. A repository with no config file skips the
   * loader (which would walk it to detect source roots) and takes the default.
   *
   * @param {string} cwd
   * @returns {boolean}
   */
  function bodyWordsOn(cwd) {
    const dflt = __require('./src/config/defaults').DEFAULTS.retrieval.bodyWords === true;
    let mtime = 0;
    try { mtime = fs.statSync(path.join(cwd, 'gen-context.config.json')).mtimeMs; } catch (_) { /* no config file */ }
    const key = `${path.resolve(cwd)}\0${mtime}\0${dflt}`;
    if (_flagOf.has(key)) return _flagOf.get(key);
    let on = dflt;
    if (mtime) {
      try {
        const cfg = __require('./src/config/loader').loadConfig(cwd);
        on = !!(cfg && cfg.retrieval && cfg.retrieval.bodyWords);
      } catch (_) { /* keep the default */ }
    }
    _flagOf.set(key, on);
    return on;
  }

  /**
   * The body words the shipped ranker would use for the repository at `cwd`, or null when the
   * repository switches them off.
   *
   * @param {Map<string, string[]>} index
   * @param {string} cwd
   * @returns {Map<string, string>|null}
   */
  function defaultBodyWords(index, cwd) {
    if (!(index instanceof Map) || index.size === 0) return null;
    if (!bodyWordsOn(cwd)) return null;
    const known = _bodyWordsOf.get(index);
    if (known && known.cwd === cwd) return known.words;
    let words = null;
    try { words = __require('./src/retrieval/body-words').buildFor(cwd, index); } catch (_) { words = null; }
    _bodyWordsOf.set(index, { cwd, words });
    return words;
  }

  // ---------------------------------------------------------------------------
  // Token estimation
  // ---------------------------------------------------------------------------

  /**
   * Estimate token count from character count (chars/4, ±5%).
   * @param {string[]} sigs
   * @returns {number}
   */
  function estimateTokens(sigs) {
    const text = (sigs || []).join('\n');
    return Math.ceil(text.length / 4);
  }

  // ---------------------------------------------------------------------------
  // Task loader
  // ---------------------------------------------------------------------------

  /**
   * Load tasks from a JSONL file.
   * Each line: { id, query, expected_files, repo, split? ('easy'|'hard') }
   * Invalid or blank lines are silently skipped.
   * @param {string} tasksFile - absolute or relative path
   * @returns {Array<{id:string, query:string, expected:string[], repo:string}>}
   */
  function loadTasks(tasksFile) {
    if (!fs.existsSync(tasksFile)) return [];
    const lines = fs.readFileSync(tasksFile, 'utf8').split('\n');
    const tasks = [];
    for (const line of lines) {
      const trimmed = line.trim();
      if (!trimmed) continue;
      try {
        const obj = JSON.parse(trimmed);
        if (obj.query && Array.isArray(obj.expected_files)) {
          tasks.push({
            id: obj.id || String(tasks.length + 1),
            query: obj.query,
            expected: obj.expected_files,
            repo: obj.repo || '.',
            split: obj.split === 'hard' ? 'hard' : 'easy',
          });
        }
      } catch {
        // skip invalid JSON lines
      }
    }
    return tasks;
  }

  // ---------------------------------------------------------------------------
  // Main runner
  // ---------------------------------------------------------------------------

  /**
   * Run all tasks in tasksFile against the repo at cwd.
   *
   * @param {string} tasksFile - path to JSONL task file (absolute or relative to cwd)
   * @param {string} cwd       - project root
   * @param {object} [opts]
   * @param {number} [opts.topK=10] - how many results to rank per query
   * @returns {{
   *   tasks: Array<{id, query, expected, ranked, hit5, rr, precAt5, tokens}>,
   *   metrics: { hitAt5, mrr, precisionAt5, avgTokens, tasks }
   * }}
   */
  function run(tasksFile, cwd, opts = {}) {
    const topK = opts.topK || 10;

    // Resolve paths
    const resolvedTasksFile = path.isAbsolute(tasksFile)
      ? tasksFile
      : path.resolve(cwd, tasksFile);

    const tasks = loadTasks(resolvedTasksFile);
    if (tasks.length === 0) {
      return {
        tasks: [],
        metrics: { hitAt5: 0, mrr: 0, precisionAt5: 0, avgTokens: 0, tasks: 0 },
      };
    }

    // Build index once (re-used across all tasks in the same repo)
    const index = buildSigIndex(cwd);
    // Import graph built once too — the hop-1/hop-2 boost is part of what ships.
    let graph = null;
    try { graph = __require('./src/graph/builder').buildRankingGraph(cwd); } catch (_) {}

    const taskResults = [];
    for (const task of tasks) {
      const topResult = rank(task.query, index, topK, { cwd, graph, learned: opts.learned });
      const ranked = topResult.map((r) => r.file);
      const tokens = topResult.reduce((sum, r) => sum + estimateTokens(r.sigs), 0);

      const { hitAtK, reciprocalRank, precisionAtK } = __require('./src/eval/scorer');
      const hit5 = hitAtK(ranked, task.expected, 5);
      const rr = reciprocalRank(ranked, task.expected);
      const precAt5 = precisionAtK(ranked, task.expected, 5);

      taskResults.push({
        id: task.id,
        query: task.query,
        expected: task.expected,
        ranked,
        hit5,
        rr,
        precAt5,
        tokens,
      });
    }

    const metrics = aggregate(
      taskResults.map((r) => ({ ranked: r.ranked, expected: r.expected, tokens: r.tokens })),
    );

    return { tasks: taskResults, metrics };
  }

  // ---------------------------------------------------------------------------
  // Table formatter
  // ---------------------------------------------------------------------------

  /**
   * Format task results as a markdown table string.
   * @param {Array} taskResults - from run()
   * @returns {string}
   */
  function formatTable(taskResults) {
    const header = '| Task | Query | hit@5 | RR | Tokens |';
    const divider = '|---|---|:---:|:---:|---:|';
    const rows = taskResults.map((r) => {
      const q = r.query.length > 40 ? r.query.slice(0, 37) + '...' : r.query;
      return `| ${r.id} | ${q} | ${r.hit5 ? '✓' : '✗'} | ${r.rr.toFixed(2)} | ${r.tokens} |`;
    });
    return [header, divider, ...rows].join('\n');
  }

  /**
   * Format aggregate metrics as a human-readable string.
   * @param {object} metrics - from aggregate()
   * @returns {string}
   */
  function formatMetrics(metrics) {
    return [
      `[sigmap] benchmark results:`,
      `  tasks       : ${metrics.tasks}`,
      `  hit@5       : ${(metrics.hitAt5 * 100).toFixed(1)}%`,
      `  MRR         : ${metrics.mrr.toFixed(3)}`,
      `  precision@5 : ${(metrics.precisionAt5 * 100).toFixed(1)}%`,
      `  avg tokens  : ${metrics.avgTokens}`,
    ].join('\n');
  }

  module.exports = { run, rank, loadTasks, buildSigIndex, formatTable, formatMetrics, tokenize, bodyWordsOn };
  
};

// ── ./src/eval/scorer ──
__factories["./src/eval/scorer"] = function(module, exports) {
  
  /**
   * SigMap evaluation scorer.
   * Zero npm dependencies.
   *
   * Computes retrieval quality metrics:
   *   hit@k     — fraction of tasks where the correct file appears in top-k results
   *   MRR       — mean reciprocal rank (1/rank of first correct result)
   *   precision@k — fraction of top-k results that are correct
   *
   * All functions are pure and never throw.
   */

  /**
   * Return the 1-based rank of the first expected file found in the ranked
   * result list, or Infinity if none found.
   * @param {string[]} ranked   - Ordered list of file paths returned by the system
   * @param {string[]} expected - List of acceptable correct files (any match counts)
   * @returns {number}
   */
  function firstRank(ranked, expected) {
    if (!Array.isArray(ranked) || !Array.isArray(expected)) return Infinity;
    const expSet = new Set(expected.map((f) => normalizePath(f)));
    for (let i = 0; i < ranked.length; i++) {
      if (expSet.has(normalizePath(ranked[i]))) return i + 1;
    }
    return Infinity;
  }

  /**
   * Normalize a file path for comparison (trim leading ./, lowercase on
   * case-insensitive platforms is intentionally NOT done — keep paths as-is
   * but trim leading directory separators and ./).
   * @param {string} p
   * @returns {string}
   */
  function normalizePath(p) {
    return String(p).replace(/^\.\//, '').replace(/\\/g, '/');
  }

  /**
   * Compute hit@k for one task.
   * @param {string[]} ranked   - Ordered results
   * @param {string[]} expected - Correct files
   * @param {number}   k        - Cut-off (default 5)
   * @returns {0|1}
   */
  function hitAtK(ranked, expected, k = 5) {
    return firstRank(ranked, expected) <= k ? 1 : 0;
  }

  /**
   * Compute reciprocal rank for one task.
   * @param {string[]} ranked
   * @param {string[]} expected
   * @returns {number} value in (0, 1]
   */
  function reciprocalRank(ranked, expected) {
    const rank = firstRank(ranked, expected);
    return rank === Infinity ? 0 : 1 / rank;
  }

  /**
   * Compute precision@k for one task.
   * Fraction of the top-k results that appear in expected.
   * @param {string[]} ranked
   * @param {string[]} expected
   * @param {number}   k
   * @returns {number} value in [0, 1]
   */
  function precisionAtK(ranked, expected, k = 5) {
    if (!ranked || ranked.length === 0) return 0;
    const expSet = new Set(expected.map((f) => normalizePath(f)));
    const topK = ranked.slice(0, k);
    const hits = topK.filter((f) => expSet.has(normalizePath(f))).length;
    return hits / topK.length;
  }

  /**
   * Aggregate metrics across all task results.
   *
   * @param {Array<{ranked: string[], expected: string[], tokens: number}>} results
   * @param {number} k - cut-off (default 5)
   * @returns {{
   *   hitAt5: number,    // fraction [0,1]
   *   mrr: number,       // mean reciprocal rank [0,1]
   *   precisionAt5: number,
   *   avgTokens: number,
   *   tasks: number
   * }}
   */
  function aggregate(results, k = 5) {
    if (!Array.isArray(results) || results.length === 0) {
      return { hitAt5: 0, mrr: 0, precisionAt5: 0, avgTokens: 0, tasks: 0 };
    }

    let totalHit = 0;
    let totalRR = 0;
    let totalPrec = 0;
    let totalTokens = 0;

    for (const r of results) {
      const ranked = r.ranked || [];
      const expected = r.expected || [];
      totalHit += hitAtK(ranked, expected, k);
      totalRR += reciprocalRank(ranked, expected);
      totalPrec += precisionAtK(ranked, expected, k);
      totalTokens += (typeof r.tokens === 'number' ? r.tokens : 0);
    }

    const n = results.length;
    return {
      hitAt5: round(totalHit / n),
      mrr: round(totalRR / n),
      precisionAt5: round(totalPrec / n),
      avgTokens: Math.round(totalTokens / n),
      tasks: n,
    };
  }

  function round(x) {
    return Math.round(x * 1000) / 1000;
  }

  module.exports = { hitAtK, reciprocalRank, precisionAtK, aggregate, firstRank };
  
};

// ── ./src/eval/usefulness-scorer ──
__factories["./src/eval/usefulness-scorer"] = function(module, exports) {
  
  module.exports = { scoreUsefulness, computeUsefulnessStats };

  /**
   * Score answer usefulness based on:
   * 1. Whether right file was retrieved (retrieval hit)
   * 2. Whether retrieved context covered the answer (coverage)
   * 3. Confidence in answer quality (from ranking score)
   */
  function scoreUsefulness(taskResult, rankingScore) {
    const { hitRank } = taskResult;

    // Tier 1: File not retrieved — context cannot be useful
    if (hitRank === -1 || hitRank > 5) {
      return {
        tier: 'not-useful',
        score: 0.0,
        reason: 'expected file not in top 5'
      };
    }

    // Tier 2: File retrieved but not top ranking — partially useful
    if (hitRank > 1) {
      return {
        tier: 'partially-useful',
        score: rankingScore * 0.5,  // Partial usefulness
        reason: `file ranked #${hitRank}`
      };
    }

    // Tier 3: File at top of ranking — fully useful
    return {
      tier: 'fully-useful',
      score: rankingScore,  // Full usefulness
      reason: 'file ranked first'
    };
  }

  function computeUsefulnessStats(taskResults) {
    const tiers = {
      'fully-useful': 0,
      'partially-useful': 0,
      'not-useful': 0
    };

    let totalScore = 0;
    let count = 0;

    taskResults.forEach(result => {
      const usefulness = scoreUsefulness(result, result.rankingScore || 1.0);
      tiers[usefulness.tier]++;
      totalScore += usefulness.score;
      count++;
    });

    return {
      fully_useful: tiers['fully-useful'],
      partially_useful: tiers['partially-useful'],
      not_useful: tiers['not-useful'],
      fully_useful_pct: count > 0 ? (tiers['fully-useful'] / count * 100).toFixed(1) : 0,
      partially_useful_pct: count > 0 ? (tiers['partially-useful'] / count * 100).toFixed(1) : 0,
      not_useful_pct: count > 0 ? (tiers['not-useful'] / count * 100).toFixed(1) : 0,
      average_usefulness_score: count > 0 ? (totalScore / count).toFixed(3) : 0
    };
  }
  
};

// ── ./src/evidence/pack ──
__factories["./src/evidence/pack"] = function(module, exports) {
  
  /**
   * Evidence Pack v2 (v8.0 E1; schema v2 adds a published schema URL, per-file
   * multi-factor risk labels, measured test-discovery provenance, and generator
   * identity — all additive over v1).
   *
   * A deterministic, machine-consumable signature-and-evidence map. Replaces the
   * "paste this into your prompt" workflow with a byte-stable JSON artifact that
   * an agent or CI can ingest directly — every entry anchored to a real file,
   * symbol, and line range. The published schema lives at
   * docs-vp/public/schemas/evidence-pack-2.json (sigmap.io/schemas/).
   *
   * Composed entirely from shipped zero-dep modules:
   *   - retrieval/ranker        → ranked files, scores, signals
   *   - extractors/line-anchor  → `:start-end` suffix parsing (sourceLines)
   *   - security/scanner        → secret redaction of symbols
   *   - map/knowledge-map       → relatedTests view over the store's tests edges
   *   - crypto (node builtin)    → sha256 grounding hash
   *
   * Determinism: the pack carries NO wall-clock timestamp. Given an unchanged
   * repository, `buildEvidencePack` returns a byte-identical object, and
   * `grounding.contextHash` is stable. This is the point — the pack is auditable.
   */

  const fs = require('fs');
  const path = require('path');
  const crypto = require('crypto');

  const { buildSigIndex, rank, detectIntent } = __require('./src/retrieval/ranker');
  const { scan } = __require('./src/security/scanner');

  const SCHEMA_VERSION = '2.0';
  const SCHEMA_URL = 'https://sigmap.io/schemas/evidence-pack-2.json';
  const DEFAULT_BUDGET = 6000;
  const DEFAULT_TOP = 12;

  // Measured accuracy of the stem-affix test-discovery method (C2). Constants
  // are sourced from the committed benchmarks/reports/test-discovery.json and
  // guarded by a test that fails on drift — re-run `npm run
  // benchmark:test-discovery` and update together, never hand-invent.
  const TEST_DISCOVERY = {
    method: 'stem-affix-match',
    measured: { f1: 0.98, precision: 0.971, recall: 0.988, pairs: 3701, repos: 28 },
    benchmark: 'npm run benchmark:test-discovery',
  };

  const GENERATED_RE = /(^|\/)(dist|build|out|vendor|node_modules)\/|\.(generated|min|bundle)\.|\.(pb|_pb)\.|\.pb\.go$|_pb2\.py$/;
  const TEST_RE = /(^|\/)(tests?|__tests__|spec|specs)\/|\.(test|spec)\.[a-z]+$|(^|\/)test_[^/]+\.py$|_test\.(go|py|rb)$/;
  const CONFIG_RE = /\.(json|ya?ml|toml|ini|conf|config|properties|env)$|(^|\/)(\.?[a-z]+rc)$|\.config\.[a-z]+$/i;
  // DB migrations: framework dirs (Rails/Alembic/Prisma), Flyway `V1__x.sql`,
  // timestamped migration files, and `*_migration.*` naming.
  const MIGRATION_RE = /(^|\/)(migrations?|alembic\/versions|prisma\/migrations)(\/|$)|(^|\/)db\/migrate\/|(^|\/)V\d+(_\d+)*__[^/]+\.(sql|java)$|(^|\/)\d{8,}[_-][^/]+\.(sql|rb|py|js|ts)$|[._-]migration[s]?[._-]/i;
  const PAYMENT_RE = /(^|\/|[._-])(payment|payments|billing|checkout|invoice|invoicing|subscription|stripe|paypal|braintree|charge|refund|payout)([._-]|\/|$)/i;
  const AUTH_RE = /(^|\/|[._-])(auth|authn|authz|login|logout|signin|signup|password|passwd|session|oauth|jwt|permission|permissions|acl|rbac|credential|credentials)([._-]|\/|$)/i;
  const SECURITY_RE = /(^|\/|[._-])(secret|secrets|crypto|cipher|encrypt|decrypt|token|signing|keystore|vault)([._-]|\/|$)/i;
  // Public API surface: `api/` dirs, `public-api`, and module barrel entrypoints.
  const PUBLIC_API_RE = /(^|\/)api(\/|$)|(^|\/)public[-_]?api(\/|$)|(^|\/)index\.(js|ts|mjs|cjs)$/i;

  /**
   * Split a signature's `  :start-end` line anchor from its symbol text.
   * @param {string} sig
   * @returns {{ symbol: string, start: number|null, end: number|null }}
   */
  function parseAnchor(sig) {
    const m = /\s*:(\d+)-(\d+)\s*$/.exec(sig);
    if (!m) return { symbol: sig.trim(), start: null, end: null };
    return {
      symbol: sig.slice(0, m.index).trim(),
      start: parseInt(m[1], 10),
      end: parseInt(m[2], 10),
    };
  }

  /**
   * Classify a file into a risk label (C3, v8.5). Path-based, deterministic.
   * Precedence is strict, most-specific-risk first: a migration touching payments
   * is labeled `migration` (a schema change is the dominant risk), payment/auth
   * outrank the generic `security` bucket, and `config`/`public-api` resolve
   * before the `source` fallback. `test`/`generated` semantics are preserved so
   * existing consumers (findRelatedTests, verifier) keep working.
   * @param {string} relPath
   * @returns {'generated'|'test'|'migration'|'payment'|'auth'|'security'|'config'|'public-api'|'source'}
   */
  function riskLabelFor(relPath) {
    return riskFactorsFor(relPath)[0];
  }

  /**
   * Every risk category a file matches, in the same strict precedence order
   * riskLabelFor uses (schema v2). Where v1 collapsed a migration touching
   * payments to `migration`, the factors list carries both. Always non-empty:
   * a file matching nothing is `['source']`.
   * @param {string} relPath
   * @returns {string[]}
   */
  function riskFactorsFor(relPath) {
    const p = relPath.replace(/\\/g, '/');
    const factors = [];
    if (GENERATED_RE.test(p)) factors.push('generated');
    if (TEST_RE.test(p)) factors.push('test');
    if (MIGRATION_RE.test(p)) factors.push('migration');
    if (PAYMENT_RE.test(p)) factors.push('payment');
    if (AUTH_RE.test(p)) factors.push('auth');
    if (SECURITY_RE.test(p)) factors.push('security');
    if (CONFIG_RE.test(p)) factors.push('config');
    if (PUBLIC_API_RE.test(p)) factors.push('public-api');
    return factors.length ? factors : ['source'];
  }

  /** Filename stem (basename minus the first extension chain). */
  function stemOf(relPath) {
    const base = path.basename(relPath);
    return base.replace(/\.[^.]+$/, '').replace(/\.(test|spec)$/i, '');
  }

  /**
   * Infer the implementation stem a test file targets, by stripping the
   * conventional test affixes across languages (measured in the C2 benchmark):
   *   foo.test.js / foo.spec.ts    → foo   (JS/TS)
   *   test_foo.py                  → foo   (Python / pytest)
   *   foo_test.go / foo_test.py    → foo   (Go, unittest)
   *   FooTest.java / BarSpec.scala → Foo   (JVM, PascalCase)
   * @param {string} relPath
   * @returns {string}
   */
  function testTargetStem(relPath) {
    let s = stemOf(relPath);               // strips ext + trailing .test/.spec
    s = s.replace(/^test[_-]/i, '');       // Python: test_foo
    s = s.replace(/[_-]test$/i, '');       // Go / unittest: foo_test
    s = s.replace(/(Tests?|Specs?)$/, ''); // JVM PascalCase: FooTest, BarSpec
    return s;
  }

  /**
   * Impl→test discovery (C2, v8.5). Matches test files back to their
   * implementation by normalizing conventional test affixes, so JS/TS, Python,
   * Go, and JVM naming conventions all resolve. Deterministic; accuracy is
   * measured by `scripts/run-test-discovery-benchmark.mjs`.
   * @param {string} relPath
   * @param {string[]} allFiles  - universe of indexed files (relative paths)
   * @returns {string[]}
   */
  function findRelatedTests(relPath, allFiles) {
    if (riskLabelFor(relPath) === 'test') return [];
    const stem = stemOf(relPath).toLowerCase();
    if (!stem) return [];
    const out = [];
    for (const f of allFiles) {
      if (f === relPath) continue;
      if (riskLabelFor(f) !== 'test') continue;
      if (testTargetStem(f).toLowerCase() === stem) out.push(f);
    }
    return out.sort();
  }

  /**
   * `findRelatedTests` for many lookups against one universe: the same stem rule,
   * indexed once instead of rescanned per file. `lookup(relPath)` returns exactly
   * what `findRelatedTests(relPath, allFiles)` would — pinned by a test over this
   * repo's own files, so the two cannot drift.
   * @param {string[]} allFiles - universe of files (relative paths)
   * @returns {(relPath: string) => string[]}
   */
  function relatedTestsIndex(allFiles) {
    const byStem = new Map();
    for (const f of allFiles) {
      if (riskLabelFor(f) !== 'test') continue;
      const key = testTargetStem(f).toLowerCase();
      if (!byStem.has(key)) byStem.set(key, []);
      byStem.get(key).push(f);
    }
    return function lookup(relPath) {
      if (riskLabelFor(relPath) === 'test') return [];
      const stem = stemOf(relPath).toLowerCase();
      if (!stem) return [];
      return (byStem.get(stem) || []).filter((f) => f !== relPath).sort();
    };
  }

  /** Map a ranker `signals` object into a short human-readable reason string. */
  function reasonFor(signals) {
    if (!signals) return 'ranked match';
    const parts = [];
    if (signals.symbolMatch > 0) parts.push('symbol-name match');
    if (signals.exactToken > 0) parts.push('exact token match');
    if (signals.prefixMatch > 0) parts.push('prefix match');
    if (signals.pathMatch > 0) parts.push('path match');
    if (signals.graphBoost > 0) parts.push('dependency-graph neighbor');
    if (signals.recencyBoost > 1) parts.push('recently changed');
    if (signals.learnedWeights && signals.learnedWeights !== 1) parts.push('learned weight');
    return parts.length ? parts.join('; ') : 'ranked match';
  }

  /** Token estimate for a signature block (matches the ranker's heuristic). */
  function sigTokens(sigs) {
    return Math.ceil(sigs.join('\n').length / 4);
  }

  /**
   * Stable stringify with recursively sorted object keys, for hashing.
   * @param {*} value
   * @returns {string}
   */
  function canonicalize(value) {
    return JSON.stringify(sortKeys(value));
  }

  function sortKeys(value) {
    if (Array.isArray(value)) return value.map(sortKeys);
    if (value && typeof value === 'object') {
      const out = {};
      for (const k of Object.keys(value).sort()) out[k] = sortKeys(value[k]);
      return out;
    }
    return value;
  }

  /**
   * Build an Evidence Pack for a query.
   *
   * @param {string} query
   * @param {string} cwd
   * @param {object} [opts]
   * @param {number} [opts.budget=6000]      - token budget for included files
   * @param {number} [opts.top=12]           - max ranked files to consider
   * @param {Map<string,string[]>} [opts.sigIndex] - pre-built index (else built from cwd)
   * @param {object} [opts.map]             - pre-loaded knowledge map (else loaded from cwd)
   * @returns {object} Evidence Pack v1
   */
  function buildEvidencePack(query, cwd, opts = {}) {
    const budget = Number.isFinite(opts.budget) ? opts.budget : DEFAULT_BUDGET;
    const top = Number.isFinite(opts.top) ? opts.top : DEFAULT_TOP;

    const sigIndex = opts.sigIndex instanceof Map ? opts.sigIndex : buildSigIndex(cwd);
    const intent = detectIntent(query);
    const allFiles = Array.from(sigIndex.keys());

    // An injected index is not this repository's: its words are not built from `cwd` (as the map below is not).
    const bodyWords = opts.sigIndex instanceof Map ? null : __require('./src/retrieval/body-words').forRepo(cwd, sigIndex);
    const ranked = rank(query, sigIndex, { topK: top, cwd, bodyWords })
      .filter((r) => r.score > 0 || ranked0Empty(query));
    const maxScore = ranked.reduce((m, r) => Math.max(m, r.score), 0);

    // Related tests are a view over the knowledge-map store (#635) — same bytes
    // as per-file discovery (the store's tests edges come from findRelatedTests
    // over the same index). Injected-index callers keep the legacy path: loading
    // the store would build and cache under an arbitrary cwd.
    let kmap = opts.map || null;
    if (!kmap && !(opts.sigIndex instanceof Map)) {
      try { kmap = __require('./src/map/knowledge-map').loadOrBuild(cwd); } catch (_) { kmap = null; }
    }
    let storeTests = null;
    if (kmap) {
      try { storeTests = __require('./src/map/knowledge-map').relatedTestsView(kmap, ranked.map((r) => r.file)); } catch (_) { storeTests = null; }
    }

    // Greedy budget fill in rank order; the remainder is reported as dropped.
    const files = [];
    const droppedFiles = [];
    let used = 0;

    for (const r of ranked) {
      const tokens = sigTokens(r.sigs);
      if (files.length > 0 && used + tokens > budget) {
        droppedFiles.push({ path: r.file, reason: `budget: would exceed ${budget}-token limit` });
        continue;
      }
      used += tokens;

      const safe = scan(r.sigs, r.file).safe;
      const symbols = [];
      const sourceLines = [];
      for (const sig of safe) {
        const { symbol, start, end } = parseAnchor(sig);
        symbols.push(symbol);
        if (start !== null) sourceLines.push({ symbol, start, end });
      }

      const riskFactors = riskFactorsFor(r.file);
      files.push({
        path: r.file,
        symbols,
        reason: reasonFor(r.signals),
        confidence: maxScore > 0 ? Math.round((r.score / maxScore) * 100) / 100 : 0,
        sourceLines,
        relatedTests: storeTests && storeTests.has(r.file) ? storeTests.get(r.file) : findRelatedTests(r.file, allFiles),
        riskLabel: riskFactors[0],
        riskFactors,
      });
    }

    const symbolCount = files.reduce((n, f) => n + f.symbols.length, 0);
    const anchoredSymbols = files.reduce((n, f) => n + f.sourceLines.length, 0);

    const pack = {
      schemaVersion: SCHEMA_VERSION,
      schemaUrl: SCHEMA_URL,
      generator: { name: 'sigmap', version: typeof opts.version === 'string' ? opts.version : null },
      query,
      intent,
      files,
      tokenBudget: { limit: budget, used, remaining: Math.max(0, budget - used) },
      droppedFiles,
      testDiscovery: TEST_DISCOVERY,
      grounding: {
        symbolCount,
        anchoredSymbols,
        anchorCoverage: symbolCount > 0 ? Math.round((anchoredSymbols / symbolCount) * 1000) / 1000 : 0,
        contextHash: null,
        deterministic: true,
      },
    };

    // Hash everything except the hash field itself.
    const forHash = Object.assign({}, pack, {
      grounding: Object.assign({}, pack.grounding, { contextHash: undefined }),
    });
    pack.grounding.contextHash = 'sha256:' + crypto.createHash('sha256').update(canonicalize(forHash)).digest('hex');

    return pack;
  }

  // rank() returns [] for an empty/whitespace query; keep the filter readable.
  function ranked0Empty(query) {
    return !query || !query.trim();
  }

  /** Pretty-printed canonical JSON rendering of a pack. */
  function formatJSON(pack) {
    return JSON.stringify(pack, null, 2);
  }

  /** Markdown handoff rendering of a pack. */
  function formatMarkdown(pack) {
    const L = [];
    L.push(`# Evidence Pack — \`${pack.query}\``);
    L.push('');
    L.push(`- **Schema:** v${pack.schemaVersion}`);
    L.push(`- **Intent:** ${pack.intent}`);
    L.push(`- **Budget:** ${pack.tokenBudget.used} / ${pack.tokenBudget.limit} tokens used (${pack.tokenBudget.remaining} remaining)`);
    L.push(`- **Grounding:** ${pack.grounding.anchoredSymbols}/${pack.grounding.symbolCount} symbols anchored (${Math.round(pack.grounding.anchorCoverage * 100)}%)`);
    L.push(`- **Hash:** \`${pack.grounding.contextHash}\``);
    L.push('');

    for (const f of pack.files) {
      const risk = (f.riskFactors && f.riskFactors.length > 1) ? f.riskFactors.join(' + ') : f.riskLabel;
      L.push(`## \`${f.path}\`  _(${risk}, confidence ${f.confidence})_`);
      L.push(`_${f.reason}_`);
      if (f.relatedTests.length) L.push(`Related tests: ${f.relatedTests.map((t) => `\`${t}\``).join(', ')}`);
      L.push('');
      L.push('```');
      for (const s of f.symbols) L.push(s);
      L.push('```');
      L.push('');
    }

    if (pack.droppedFiles.length) {
      L.push('## Dropped (over budget)');
      for (const d of pack.droppedFiles) L.push(`- \`${d.path}\` — ${d.reason}`);
      L.push('');
    }

    return L.join('\n');
  }

  module.exports = {
    buildEvidencePack,
    formatJSON,
    formatMarkdown,
    parseAnchor,
    riskLabelFor,
    riskFactorsFor,
    findRelatedTests,
    relatedTestsIndex,
    SCHEMA_VERSION,
    SCHEMA_URL,
    TEST_DISCOVERY,
  };
  
};

// ── ./src/extractors/astro ──
__factories["./src/extractors/astro"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');
  const typescript = __require('./src/extractors/typescript');

  // Ceiling discloses what it drops rather than truncating silently (#576).
  const PER_FILE_LIMIT = 200;
  const MAX_COMPONENT_HINTS = 8;

  /**
   * Extract signatures from Astro components (.astro) — frontmatter + template
   * (#539). The TS frontmatter between `---` fences is delegated to the real
   * TypeScript extractor (anchors shifted to file coordinates), so functions,
   * consts, and the Props interface come out with full fidelity; capitalized
   * component usages in the template are appended as a compact hint, mirroring
   * the vue_sfc/svelte family.
   *
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(src);
    if (fm) {
      // Frontmatter content starts on line 2 of the file.
      const offset = 1;
      // Astro's Props convention is usually non-exported; the TS extractor only
      // matches `export interface`. Prefixing on the SAME line keeps every line
      // number — and therefore every anchor — valid.
      const body = fm[1].replace(/^(\s*)interface Props\b/m, '$1export interface Props');
      for (const sig of typescript.extract(body)) {
        sigs.push(sig.replace(/ {2}:(\d+)-(\d+)/, (_, s, e) => `  :${Number(s) + offset}-${Number(e) + offset}`));
      }

      // Frontmatter code is file-local by design, so the exported-only passes
      // above miss most of it. Astro-specific surface:
      const lineOf = (idx) => body.slice(0, idx).split('\n').length + offset;

      // const { title, description = 'x' } = Astro.props — the props actually consumed.
      const propsUse = /^const\s*\{([^}]+)\}\s*=\s*Astro\.props/m.exec(body);
      if (propsUse) {
        const names = propsUse[1].split(',').map((p) => p.trim().split(/[=:]/)[0].trim()).filter(Boolean);
        const ln = lineOf(propsUse.index);
        sigs.push(`props { ${names.join(', ')} }  :${ln}-${ln}`);
      }

      // Non-exported top-level functions (the norm in frontmatter).
      for (const m of body.matchAll(/^(async\s+)?function\s+(\w+)\s*\(([^)]*)\)(?:\s*:\s*([^{=\n]+))?/gm)) {
        if (m[2].startsWith('_')) continue;
        const params = m[3].trim().replace(/\s+/g, ' ').split(',').map((p) => p.split(':')[0].trim()).filter(Boolean).join(', ');
        const ret = m[4] ? ` → ${m[4].trim().replace(/\s+/g, ' ').slice(0, 25)}` : '';
        const ln = lineOf(m.index);
        sigs.push(`${m[1] ? 'async ' : ''}function ${m[2]}(${params})${ret}  :${ln}-${ln}`);
      }

      // Data-loading consts: const posts = await getCollection('blog').
      for (const m of body.matchAll(/^const\s+(\w+)\s*=\s*await\s+(\w[\w.]*)\s*\(/gm)) {
        const ln = lineOf(m.index);
        sigs.push(`const ${m[1]} = await ${m[2]}()  :${ln}-${ln}`);
      }
    }

    // Component usages in the template: <Layout ...>, <Card />, dotted islands.
    const template = fm ? src.slice(fm.index + fm[0].length) : src;
    const used = new Set();
    for (const m of template.matchAll(/<([A-Z][\w.]*)[\s/>]/g)) {
      used.add(m[1]);
    }
    if (used.size > 0) {
      const names = [...used].sort();
      const shown = names.slice(0, MAX_COMPONENT_HINTS);
      const more = names.length - shown.length;
      sigs.push(`uses ${shown.join(', ')}${more > 0 ? ` … +${more} more` : ''}`);
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/component-surface ──
__factories["./src/extractors/component-surface"] = function(module, exports) {
  
  const { readBalanced } = __require('./src/extractors/scan');

  // Web-component surface for the TS/JS extractors (#537). The class extractor
  // sees a Lit or Angular component's methods but loses everything that makes
  // it a component — the tag name or selector, the reactive/input/output
  // fields, and the base class. For an agent those ARE the public API. This is
  // decorator-aware enrichment in the hooks/Zustand idiom family, not a new
  // extractor: every addition is gated on detecting a component marker, so
  // non-component classes stay byte-identical.

  // Decorators (and nothing but decorators/whitespace/modifier keywords) may
  // sit between a recognised marker and its class declaration.
  const GAP_RE = /^(?:\s|@[\w.]+\([^)]*\)|export|default|abstract)*$/;

  const CUSTOM_ELEMENT_RE = /@customElement\(\s*['"]([^'"]+)['"]\s*\)/g;
  const NG_COMPONENT_RE = /@(?:Component|Directive)\(/g;
  const DEFINE_RE = /customElements\.define\(\s*['"]([^'"]+)['"]\s*,\s*(\w+)/g;

  const PROP_RE = /@(property|state)\s*\(([^)]*)\)\s*(?:declare\s+)?(?:readonly\s+)?(\w+)\s*([?!]?)\s*(?::\s*([^=;\n]+))?/g;
  const IO_RE = /@(Input|Output)\s*\(\s*(?:['"][^'"]*['"])?\s*\)\s*(?:declare\s+)?(?:readonly\s+)?(\w+)\s*([?!]?)\s*(?::\s*([^=;\n]+))?/g;

  const TYPE_CHARS = 30;
  const _type = (t) => (t ? `: ${t.trim().replace(/\s+/g, ' ').slice(0, TYPE_CHARS)}` : '');

  /**
   * Pre-pass over a whole (comment-stripped) source: component markers by the
   * class index they attach to, plus `customElements.define` tags by class name.
   * @param {string} stripped
   * @returns {{ decorated: Map<number, {tag?: string, selector?: string}>, defined: Map<string, string> }}
   */
  function scanComponentMarkers(stripped) {
    const decorated = new Map();
    const defined = new Map();

    const attach = (endIdx, info) => {
      // The marker binds to the next `class` whose gap is decorators-only.
      const rel = stripped.slice(endIdx).search(/(?:^|\n)[^\n]*\bclass\s+\w/);
      if (rel === -1) return;
      const classAt = endIdx + rel;
      if (!GAP_RE.test(stripped.slice(endIdx, classAt))) return;
      const existing = decorated.get(classAt) || {};
      decorated.set(classAt, Object.assign(existing, info));
    };

    for (const m of stripped.matchAll(CUSTOM_ELEMENT_RE)) {
      attach(m.index + m[0].length, { tag: m[1] });
    }
    for (const m of stripped.matchAll(NG_COMPONENT_RE)) {
      const open = m.index + m[0].length - 1;
      const close = readBalanced(stripped, open);
      if (close === -1) continue;
      const cfg = stripped.slice(open + 1, close);
      const sel = /selector\s*:\s*['"]([^'"]+)['"]/.exec(cfg);
      attach(close + 1, sel ? { selector: sel[1] } : { selector: '' });
    }
    for (const m of stripped.matchAll(DEFINE_RE)) {
      defined.set(m[2], m[1]);
    }
    return { decorated, defined };
  }

  /**
   * Component-marker lookup for one class match. `classLineStart` is the match
   * index of the class STATEMENT (line start); decorators bind to the position
   * of the `class` keyword itself, so probe the small window between them.
   */
  function markersForClass(decorated, stripped, classLineStart, matchText) {
    const kw = classLineStart + matchText.search(/\bclass\s/);
    for (const [at, info] of decorated) {
      if (at >= classLineStart - 1 && at <= kw + 1) return info;
    }
    return null;
  }

  /**
   * Component surface member lines for a class body.
   * @param {string} block - class body (comment-stripped)
   * @returns {Array<{text: string, start: number, end: number}>} offsets within block
   */
  function componentMembers(block) {
    const out = [];
    for (const m of block.matchAll(PROP_RE)) {
      const opt = m[4] === '?' ? '?' : '';
      out.push({ text: `@${m[1]} ${m[3]}${opt}${_type(m[5])}`, start: m.index, end: m.index + m[0].length });
    }
    for (const m of block.matchAll(IO_RE)) {
      const opt = m[3] === '?' ? '?' : '';
      out.push({ text: `@${m[1]}() ${m[2]}${opt}${_type(m[4])}`, start: m.index, end: m.index + m[0].length });
    }
    out.sort((a, b) => a.start - b.start);
    return out;
  }

  module.exports = { scanComponentMarkers, markersForClass, componentMembers };
  
};

// ── ./src/extractors/coverage ──
__factories["./src/extractors/coverage"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');

  function walkFiles(dir) {
    let out = [];
    let entries;
    try {
      entries = fs.readdirSync(dir, { withFileTypes: true });
    } catch (_) {
      return out;
    }
    for (const entry of entries) {
      const full = path.join(dir, entry.name);
      if (entry.isDirectory()) out = out.concat(walkFiles(full));
      else if (entry.isFile()) out.push(full);
    }
    return out;
  }

  function buildTestIndex(cwd, testDirs) {
    const dirs = Array.isArray(testDirs) && testDirs.length ? testDirs : ['tests', 'test', '__tests__', 'spec'];
    const names = new Set();

    for (const dir of dirs) {
      const abs = path.join(cwd, dir);
      if (!fs.existsSync(abs)) continue;
      for (const file of walkFiles(abs)) {
        let src = '';
        try {
          src = fs.readFileSync(file, 'utf8');
        } catch (_) {
          continue;
        }

        // Extract tokens from JS/TS test name strings (it/test/describe calls)
        for (const m of src.matchAll(/\b(?:it|test|describe)\s*\(\s*['"\`]([\w_ ]+)['"\`]/g)) {
          if (!m[1]) continue;
          const full = m[1].replace(/[\s_]+/g, '_').toLowerCase();
          names.add(full); // also keep whole phrase: "validate_user"
          for (const word of m[1].split(/[\s_]+/)) {
            if (word.length >= 3) names.add(word.toLowerCase());
          }
        }
        // Python/Ruby style: def test_funcname() / def test_funcname: → index the suffix
        for (const m of src.matchAll(/\bdef\s+test_([\w]+)\s*[(:]/g)) {
          if (!m[1]) continue;
          names.add(m[1].toLowerCase()); // full suffix: "validate_user"
          for (const word of m[1].split('_')) {
            if (word.length >= 3) names.add(word.toLowerCase());
          }
        }
        // Also capture identifiers directly invoked in expect/assert calls
        for (const m of src.matchAll(/\b(?:expect|assert)\s*\(\s*(?:await\s+)?([\w]+)\s*\(/g)) {
          if (m[1] && m[1].length >= 3) names.add(m[1].toLowerCase());
        }
      }
    }

    return names;
  }

  function isTested(funcName, testIndex) {
    if (!funcName || funcName.length < 3 || !testIndex || testIndex.size === 0) return false;
    const lower = funcName.toLowerCase();
    // Direct match or test_ prefix match
    if (testIndex.has(lower) || testIndex.has(`test_${lower}`)) return true;
    // Token-level match: split camelCase and snake_case, check if all meaningful tokens are covered
    const tokens = funcName
      .replace(/([A-Z])/g, '_$1')
      .toLowerCase()
      .split(/[_\s]+/)
      .filter(t => t.length >= 3);
    if (tokens.length >= 2 && tokens.every(t => testIndex.has(t))) return true;
    return false;
  }

  module.exports = { buildTestIndex, isTested };
  
};

// ── ./src/extractors/cpp ──
__factories["./src/extractors/cpp"] = function(module, exports) {
  
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode } = __require('./src/extractors/scan');
  const { withAnchor } = __require('./src/extractors/line-anchor');

  // Ceilings sit above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed
  // — an undisclosed cap looks like a class that simply has eight methods (#576).
  const MEMBER_LIMIT = 120;
  const PER_FILE_LIMIT = 200;
  // Past this a file is generated or data, not a declaration surface worth scanning.
  const MAX_SOURCE = 4 * 1024 * 1024;
  const MAX_PARAMS = 200;
  const MAX_RETURN = 30;

  /**
   * Extract signatures from C/C++ source code (Tier 2, #975).
   *
   * The source is masked (comments, strings and preprocessor lines blanked, every
   * newline kept), cut into tokens, and read one declaration at a time: namespaces
   * and `extern "C"` blocks are transparent, a class, struct or union lists the
   * functions it declares or defines under it, and a function is listed whether it
   * has a body or only a prototype (a header is a declaration surface). Each
   * signature carries the `:start-end` lines of its declaration, from its first
   * token (a `template <...>` header included) to the `;` or the closing `}`.
   *
   * What it does not do is expand macros or resolve names, so it is a reading of
   * the text and not of the program: a function a macro writes is not listed, an
   * `#if` that opens a brace in one branch and not in another can swallow the rest
   * of the file, and a statement it cannot place is skipped rather than guessed.
   *
   * @param {string} src - Raw file content
   * @param {string} [filePath]
   * @returns {string[]} Array of signature strings
   */
  function extract(src, filePath) {
    if (!src || typeof src !== 'string') return [];
    // stripComments is length- AND newline-preserving; the previous strip DELETED
    // comment text, so offsets no longer aligned with the masked surface the
    // balanced reader walks (#695).
    const stripped = stripComments(src);

    // `.h` is shared with Objective-C. Sniffed on the comment-stripped text: a
    // C++ header that only MENTIONS `@interface` in a comment is still C++.
    if (/^\s*@(?:interface|implementation|protocol)\b/m.test(stripped) || /^\s*#import\b/m.test(stripped)) {
      return __require('./src/extractors/objc').extract(src, filePath);
    }
    if (src.length > MAX_SOURCE) return [];

    const toks = tokenize(maskCode(blankDirectives(src)));
    const nodes = [];
    new Reader(toks, stripped).block(0, toks.length, { out: nodes, cls: null });

    const sigs = [];
    render(nodes, 0, sigs);
    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  // ── Output ───────────────────────────────────────────────────────────────────

  function render(nodes, depth, sigs) {
    const pad = '  '.repeat(depth);
    const lines = [];
    for (const n of nodes) {
      if (n.kind === 'func') {
        if (/^_/.test(n.name.split('::').pop())) continue; // underscore names are left out on purpose
        lines.push({ text: `${pad}${n.name}(${n.params})${n.ret ? ` → ${n.ret}` : ''}`, n });
      } else {
        lines.push({ text: `${pad}${n.keyword} ${n.name}`, n });
      }
    }
    for (const l of lines) {
      sigs.push(withAnchor(l.text, l.n.start, l.n.end));
      if (l.n.members) {
        const inner = [];
        render(l.n.members, depth + 1, inner);
        // a class body that holds only nested classes still lists them; the cap counts lines
        for (const m of capMembersWithNotice(inner.map((t) => ({ text: t })), MEMBER_LIMIT, 'members')) sigs.push(m.text);
      }
    }
  }

  // ── Masking and tokens ───────────────────────────────────────────────────────

  /**
   * Blank every preprocessor line (with its backslash continuations), keeping the newlines. Done on the raw
   * text, before the masking: an unquoted apostrophe in `#error don't` would otherwise open a character
   * literal that runs into the code below it.
   */
  function blankDirectives(text) {
    const out = text.split('');
    const n = text.length;
    let i = 0;
    while (i < n) {
      let e = text.indexOf('\n', i);
      if (e < 0) e = n;
      let j = i;
      while (j < e && (text[j] === ' ' || text[j] === '\t')) j++;
      if (text[j] === '#') {
        for (;;) {
          for (let q = i; q < e; q++) out[q] = ' ';
          let b = e - 1;
          if (b >= i && text[b] === '\r') b--;
          if (b >= i && text[b] === '\\' && e < n) { i = e + 1; e = text.indexOf('\n', i); if (e < 0) e = n; continue; }
          break;
        }
      }
      i = e + 1;
    }
    return out.join('');
  }

  const isIdStart = (c) => (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 95 || c === 36 || c > 127;
  const isIdPart = (c) => isIdStart(c) || (c >= 48 && c <= 57);
  const isDigit = (c) => c >= 48 && c <= 57;

  /** Tokens: `{ t: 'id'|'num'|'str'|'p', v, line, i, end }` (`i`/`end` are offsets into the masked text). */
  function tokenize(m) {
    const toks = [];
    const n = m.length;
    let line = 1;
    let i = 0;
    while (i < n) {
      const c = m.charCodeAt(i);
      if (c === 10) { line++; i++; continue; }
      if (c === 32 || c === 9 || c === 13 || c === 12 || c === 11) { i++; continue; }
      if (isIdStart(c)) {
        let j = i + 1;
        while (j < n && isIdPart(m.charCodeAt(j))) j++;
        toks.push({ t: 'id', v: m.slice(i, j), line, i, end: j });
        i = j;
        continue;
      }
      if (isDigit(c)) {
        let j = i + 1;
        while (j < n && (isIdPart(m.charCodeAt(j)) || m[j] === '.' || m[j] === "'")) j++;
        toks.push({ t: 'num', v: m.slice(i, j), line, i, end: j });
        i = j;
        continue;
      }
      if (c === 34 || c === 39) {
        // the masked literal keeps its quotes and blanks the inside, so the next same quote closes it
        let j = i + 1;
        const startLine = line;
        while (j < n && m.charCodeAt(j) !== c) { if (m.charCodeAt(j) === 10) line++; j++; }
        toks.push({ t: 'str', v: '"', line: startLine, i, end: j + 1 });
        i = j + 1;
        continue;
      }
      const two = m.slice(i, i + 2);
      if (two === '::' || two === '->') { toks.push({ t: 'p', v: two, line, i, end: i + 2 }); i += 2; continue; }
      if (m.startsWith('...', i)) { toks.push({ t: 'p', v: '...', line, i, end: i + 3 }); i += 3; continue; }
      toks.push({ t: 'p', v: m[i], line, i, end: i + 1 });
      i++;
    }
    return toks;
  }

  /** For every `(`, `[` and `{`, the index of its closer (and the other way round); -1 when unmatched. */
  function pairBrackets(toks) {
    const pair = new Int32Array(toks.length).fill(-1);
    const CLOSE = { '(': ')', '[': ']', '{': '}' };
    const stack = [];
    for (let i = 0; i < toks.length; i++) {
      const v = toks[i].v;
      if (toks[i].t !== 'p') continue;
      if (CLOSE[v]) { stack.push(i); continue; }
      if (v === ')' || v === ']' || v === '}') {
        // a closer that does not match the innermost opener closes the openers an `#if` left open
        let k = stack.length - 1;
        while (k >= 0 && CLOSE[toks[stack[k]].v] !== v) k--;
        if (k < 0) continue;
        const open = stack[k];
        stack.length = k;
        pair[open] = i;
        pair[i] = open;
      }
    }
    return pair;
  }

  // ── The reader ───────────────────────────────────────────────────────────────

  const SKIPPED_SPECIFIERS = new Set([
    'static', 'inline', 'virtual', 'constexpr', 'consteval', 'constinit', 'extern', 'explicit', 'mutable',
    'register', 'thread_local', '__inline', '__inline__', '__forceinline', '_Noreturn', '__extension__',
  ]);
  const ATTRIBUTE_CALLS = new Set(['__attribute__', '__declspec', 'alignas', '_Alignas', '__asm__', '__asm', 'asm']);
  const NOT_A_FUNCTION = new Set([
    'if', 'for', 'while', 'switch', 'return', 'sizeof', 'alignof', 'decltype', 'typeof', '__typeof__', 'static_assert',
    '_Static_assert', 'defined', 'catch', 'throw', 'new', 'delete', 'case', 'else', 'do', 'noexcept', 'requires', '_Generic',
    'typeid', 'co_return', 'co_await', 'co_yield', 'using', 'namespace', 'typedef',
  ]);
  const DECL_KEYWORDS = new Set(['class', 'struct', 'union', 'enum', 'namespace', 'template', 'typedef', 'extern', 'inline', 'static', 'using', 'friend', 'virtual', 'constexpr']);
  const ACCESS = new Set(['public', 'private', 'protected']);
  const TYPE_PARENS = new Set(['decltype', 'typeof', '__typeof__', '_Atomic', 'typename']);
  const TAIL_WORDS = new Set(['const', 'volatile', 'noexcept', 'override', 'final', 'throw', 'mutable', 'try']);
  // An export or attribute macro: upper case with an underscore (`UV_EXTERN`, `ABSL_MUST_USE_RESULT`).
  // `FILE` or `DWORD` is a type and is kept.
  const isMacroName = (v) => /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/.test(v);
  const TYPE_WORDS = new Set(['unsigned', 'signed', 'long', 'short', 'int', 'char', 'float', 'double', 'bool', 'void', 'auto', 'wchar_t', 'char8_t', 'char16_t', 'char32_t', '_Bool', '_Complex']);
  const ELABORATED = new Set(['struct', 'union', 'enum', 'class', 'typename']);

  /**
   * Whether the tokens in front of a name read as a type that ends in a name of its own (`int count`,
   * `std::vector<int>* items`): a variable that a macro call annotates, not a return type.
   */
  function endsInDeclarator(toks) {
    const t = toks.filter((x) => !(x.t === 'id' && (SKIPPED_SPECIFIERS.has(x.v) || x.v === 'const' || x.v === 'volatile' || isMacroName(x.v))));
    const last = t[t.length - 1];
    const prev = t[t.length - 2];
    if (!last || !prev || last.t !== 'id' || TYPE_WORDS.has(last.v)) return false;
    if (prev.t === 'id') return !ELABORATED.has(prev.v);
    return prev.v === '*' || prev.v === '&' || prev.v === '&&' || prev.v === '>';
  }

  class Reader {
    constructor(toks, stripped) {
      this.toks = toks;
      this.src = stripped;
      this.pair = pairBrackets(toks);
    }

    /** Read declarations from token `i` up to `end` (exclusive) into `ctx.out`. */
    block(i, end, ctx) {
      const { toks } = this;
      while (i < end) {
        const t = toks[i];
        if (t.v === ';' || t.v === '}' || t.v === ')' || t.v === ']') { i++; continue; }
        if (t.t === 'id' && ACCESS.has(t.v) && toks[i + 1] && toks[i + 1].v === ':') { i += 2; continue; }
        const next = this.statement(i, end, ctx);
        i = next > i ? next : i + 1;
      }
    }

    /** The token index just past a `<...>` group opening at `open`, or -1 when it does not close before `end`. */
    angles(open, end) {
      const { toks, pair } = this;
      let depth = 0;
      for (let k = open; k < end; k++) {
        const v = toks[k].v;
        if (toks[k].t === 'p') {
          if (v === '<') depth++;
          else if (v === '>') { depth--; if (depth === 0) return k + 1; }
          else if (v === '(' || v === '[' || v === '{') { if (pair[k] < 0) return -1; k = pair[k]; }
          else if (v === ';' || v === '}') return -1;
        }
      }
      return -1;
    }

    /** Index of the first token of the declaration proper, past specifiers, attributes and annotation macros. */
    prefix(j, end) {
      const { toks, pair } = this;
      for (;;) {
        const t = toks[j];
        if (!t || j >= end) return j;
        if (t.t === 'id' && SKIPPED_SPECIFIERS.has(t.v)) { j++; continue; }
        if (t.v === '[' && toks[j + 1] && toks[j + 1].v === '[') { if (pair[j] < 0) return j; j = pair[j] + 1; continue; }
        if (t.t === 'id' && ATTRIBUTE_CALLS.has(t.v) && toks[j + 1] && toks[j + 1].v === '(') {
          if (pair[j + 1] < 0) return j;
          j = pair[j + 1] + 1;
          continue;
        }
        if (t.t === 'id' && isMacroName(t.v)) {
          // `ABSL_NAMESPACE_BEGIN class Foo`, `UV_EXTERN struct x {`: a macro in front of a declaration keyword
          let k = j + 1;
          if (toks[k] && toks[k].v === '(' && pair[k] >= 0) k = pair[k] + 1;
          if (toks[k] && toks[k].t === 'id' && DECL_KEYWORDS.has(toks[k].v)) { j = k; continue; }
        }
        return j;
      }
    }

    /** Read one statement starting at `i`; returns the index to continue from. */
    statement(i, end, ctx) {
      const { toks, pair } = this;
      let j = i;

      // A macro written as a statement of its own (`SPDLOG_NAMESPACE_BEGIN`, `UV_PRIVATE_REQ_TYPES`) has
      // no `;`, so it would run into the declaration below it and pull its first line up. One line apart
      // it is an attribute (`UV_EXTERN` above its return type); a blank line or more apart it is its own.
      const lead = toks[i];
      if (lead.t === 'id' && isMacroName(lead.v) && toks[i + 1] && toks[i + 1].v !== '(' && toks[i + 1].line - lead.line >= 2) return i + 1;

      // template <...> headers, however many
      while (toks[j] && toks[j].v === 'template' && toks[j + 1] && toks[j + 1].v === '<') {
        const after = this.angles(j + 1, end);
        if (after < 0) return this.skip(j, end);
        j = after;
      }

      // `extern "C" {`: the masking blanks the string, quotes included, so the brace follows `extern` directly
      if (toks[j] && toks[j].v === 'extern') {
        const open = toks[j + 1] && toks[j + 1].t === 'str' ? j + 2 : j + 1;
        if (toks[open] && toks[open].v === '{') {
          const close = pair[open];
          this.block(open + 1, close < 0 ? end : close, ctx);
          return close < 0 ? end : close + 1;
        }
      }

      const first = toks[j];
      if (!first) return end;
      if (first.v === 'friend' || first.v === 'using' || first.v === 'static_assert' || first.v === '_Static_assert') return this.skip(j, end);
      if (first.v === 'typedef') return this.typedef(i, j, end, ctx);
      if (first.v === '{') return pair[j] < 0 ? end : pair[j] + 1; // a block a macro left behind

      if (first.v === 'namespace' || (first.v === 'inline' && toks[j + 1] && toks[j + 1].v === 'namespace')) {
        let k = j + (first.v === 'inline' ? 2 : 1);
        while (k < end && toks[k].v !== '{' && toks[k].v !== ';' && toks[k].v !== '=') k++;
        if (toks[k] && toks[k].v === '{') {
          const close = pair[k];
          this.block(k + 1, close < 0 ? end : close, ctx);
          return close < 0 ? end : close + 1;
        }
        return this.skip(j, end);
      }

      const p = this.prefix(j, end);
      const head = toks[p];
      if (!head) return end;
      if (head.v === 'class' || head.v === 'struct' || head.v === 'union') {
        const r = this.record(i, p, end, ctx);
        if (r >= 0) return r;
      } else if (head.v === 'enum') {
        const r = this.enumeration(i, p, end, ctx);
        if (r >= 0) return r;
      } else if (head.v === 'namespace') {
        return this.statement(p, end, ctx);
      }
      return this.declaration(i, p, end, ctx);
    }

    /** Skip a statement we do not list: to its `;`, or past its `{...}` body. */
    skip(i, end) {
      const { toks, pair } = this;
      let sawEquals = false;
      for (let k = i; k < end; k++) {
        const v = toks[k].v;
        if (toks[k].t !== 'p') continue;
        if (v === ';') return k + 1;
        if (v === '=') sawEquals = true;
        else if (v === '(' || v === '[') { if (pair[k] >= 0) k = pair[k]; }
        else if (v === '{') {
          if (pair[k] < 0) return end;
          k = pair[k];
          if (sawEquals) continue;
          return toks[k + 1] && toks[k + 1].v === ';' ? k + 2 : k + 1;
        } else if (v === '}') return k;
      }
      return end;
    }

    /** `typedef`: a named struct/union/enum is listed, everything else is skipped. */
    typedef(i, j, end, ctx) {
      const { toks } = this;
      const k = this.prefix(j + 1, end);
      const kw = toks[k] && toks[k].v;
      if (kw === 'struct' || kw === 'union' || kw === 'class') { const r = this.record(i, k, end, ctx); if (r >= 0) return r; }
      if (kw === 'enum') { const r = this.enumeration(i, k, end, ctx); if (r >= 0) return r; }
      return this.skip(j, end);
    }

    /** The head of a class, struct or union at `p`. Returns the index after it, or -1 when it is not a definition. */
    record(i, p, end, ctx) {
      const { toks, pair } = this;
      const keyword = toks[p].v;
      let k = p + 1;
      const names = [];
      let stop = -1; // where the name ends: the base clause, `final` or the brace
      for (; k < end; k++) {
        const t = toks[k];
        if (t.t === 'p') {
          if (t.v === '{') break;
          if (t.v === ';') return this.skip(i, end);
          // past the `:` a comma separates base classes; before it, one means this is not a class head
          if (t.v === '=' || t.v === '}' || t.v === ')' || (t.v === ',' && stop < 0)) return -1;
          if (t.v === '[' && toks[k + 1] && toks[k + 1].v === '[') { if (pair[k] < 0) return -1; k = pair[k]; continue; }
          if (t.v === '(') {
            const prev = toks[k - 1];
            // an attribute or annotation call (`__attribute__((packed))`, `ABSL_DEPRECATED("x")`) is not the name
            if (prev && prev.t === 'id' && (ATTRIBUTE_CALLS.has(prev.v) || isMacroName(prev.v)) && pair[k] >= 0) {
              if (names[names.length - 1] === prev) names.pop();
              k = pair[k];
              continue;
            }
            return -1;
          }
          if (t.v === '<') { const after = this.angles(k, end); if (after < 0) return -1; k = after - 1; continue; }
          if (t.v === ':' && stop < 0) { stop = k; continue; }
          continue;
        }
        if (stop >= 0) continue;
        if (t.t === 'id' && (t.v === 'final' || t.v === 'sealed')) { stop = k; continue; }
        if (t.t === 'id' && !ATTRIBUTE_CALLS.has(t.v)) names.push(t);
      }
      if (k >= end || toks[k].v !== '{') return -1;
      const open = k;
      const close = pair[open];
      const nameTok = names.filter((t) => !isMacroName(t.v)).pop() || names.pop();
      const lastLine = close < 0 ? toks[end - 1].line : toks[close].line;
      if (!nameTok) return this.afterDeclarators(close < 0 ? end : close + 1, end);
      const node = { kind: 'class', keyword, name: nameTok.v, start: toks[i].line, end: lastLine, members: [] };
      ctx.out.push(node);
      this.block(open + 1, close < 0 ? end : close, { out: node.members, cls: node });
      return this.afterDeclarators(close < 0 ? end : close + 1, end);
    }

    /** `enum`, `enum class`, `enum struct`. */
    enumeration(i, p, end, ctx) {
      const { toks, pair } = this;
      let k = p + 1;
      let scoped = false;
      if (toks[k] && (toks[k].v === 'class' || toks[k].v === 'struct')) { scoped = true; k++; }
      const names = [];
      let stop = false;
      for (; k < end; k++) {
        const t = toks[k];
        if (t.t === 'p') {
          if (t.v === '{') break;
          if (t.v === ';') return this.skip(i, end);
          if (t.v === '=' || t.v === '}' || t.v === ',' || t.v === ')') return -1;
          if (t.v === '(') {
            const prev = toks[k - 1];
            if (prev && prev.t === 'id' && (ATTRIBUTE_CALLS.has(prev.v) || isMacroName(prev.v)) && pair[k] >= 0) { if (names[names.length - 1] === prev) names.pop(); k = pair[k]; continue; }
            return -1;
          }
          if (t.v === ':') stop = true;
          continue;
        }
        if (!stop && t.t === 'id' && !ATTRIBUTE_CALLS.has(t.v)) names.push(t);
      }
      if (k >= end || toks[k].v !== '{') return -1;
      const close = pair[k];
      const nameTok = names.filter((t) => !isMacroName(t.v)).pop() || names.pop();
      if (nameTok) {
        ctx.out.push({ kind: 'enum', keyword: scoped ? 'enum class' : 'enum', name: nameTok.v, start: toks[i].line, end: close < 0 ? toks[end - 1].line : toks[close].line });
      }
      return this.afterDeclarators(close < 0 ? end : close + 1, end);
    }

    /** After a `}` that closed a type: declarators (`} x, *y;`) up to the `;`. */
    afterDeclarators(k, end) {
      const { toks, pair } = this;
      for (; k < end; k++) {
        const v = toks[k].v;
        if (v === ';') return k + 1;
        if (toks[k].t === 'p' && (v === '(' || v === '[' || v === '{') && pair[k] >= 0) { k = pair[k]; continue; }
        if (toks[k].t === 'p' && (v === '}' || v === ')')) return k;
        if (toks[k].t === 'id' && DECL_KEYWORDS.has(toks[k].v) && v !== 'static') return k; // a statement began without a `;`
      }
      return end;
    }

    /**
     * What follows a parameter list: cv-qualifiers, `noexcept`, `override`, a trailing return type, an
     * initialiser list, `= 0`, `= default`, `= delete`. Returns { body: index of `{` or -1, end: index
     * of the last token of the declaration, next: where to continue } or null when what follows is not
     * the end of a declarator (so the `(` was not the function's).
     */
    tail(p, end) {
      const { toks, pair } = this;
      for (let guard = 0; p < end && guard < 400; guard++) {
        const t = toks[p];
        const v = t.v;
        if (v === ';') return { body: -1, last: p, next: p + 1 };
        if (v === '{') {
          const c = pair[p];
          const last = c < 0 ? end - 1 : c;
          return { body: p, last, next: last + 1 + (toks[last + 1] && toks[last + 1].v === ';' ? 1 : 0) };
        }
        if (v === '=') {
          const w = toks[p + 1];
          if (w && (w.v === '0' || w.v === 'default' || w.v === 'delete') && toks[p + 2] && toks[p + 2].v === ';') return { body: -1, last: p + 2, next: p + 3 };
          return null;
        }
        if (v === ':') return this.initializers(p + 1, end);
        if (v === '->') {
          // trailing return type: up to the body, `;` or `= 0`
          let k = p + 1;
          while (k < end && toks[k].v !== '{' && toks[k].v !== ';' && toks[k].v !== '=') {
            if (toks[k].t === 'p' && (toks[k].v === '(' || toks[k].v === '[') && pair[k] >= 0) k = pair[k];
            k++;
          }
          p = k;
          continue;
        }
        if (v === '&' || v === '&&') { p++; continue; }
        if (t.t === 'id' && (TAIL_WORDS.has(v) || isMacroName(v) || ATTRIBUTE_CALLS.has(v))) {
          p++;
          if (toks[p] && toks[p].v === '(' && pair[p] >= 0) p = pair[p] + 1;
          continue;
        }
        if (t.t === 'id' && v === 'requires') { while (p < end && toks[p].v !== '{' && toks[p].v !== ';') p++; continue; }
        if (v === '[' && toks[p + 1] && toks[p + 1].v === '[' && pair[p] >= 0) { p = pair[p] + 1; continue; }
        return null;
      }
      return null;
    }

    /** A constructor's initialiser list, up to the body. `p` is the first token after the `:`. */
    initializers(p, end) {
      const { toks, pair } = this;
      for (let k = p; k < end; k++) {
        const t = toks[k];
        if (t.t !== 'p') continue;
        if (t.v === '(' || t.v === '[') { if (pair[k] < 0) return null; k = pair[k]; continue; }
        if (t.v === '{') {
          const prev = toks[k - 1];
          // `member{0}` and `Base<T>{}` initialise; the brace after `)` or `}` is the body
          if (prev && (prev.t === 'id' || prev.v === '>') ) { if (pair[k] < 0) return null; k = pair[k]; continue; }
          const c = pair[k];
          const last = c < 0 ? end - 1 : c;
          return { body: k, last, next: last + 1 + (toks[last + 1] && toks[last + 1].v === ';' ? 1 : 0) };
        }
        if (t.v === ';') return null;
      }
      return null;
    }

    /** The declaration starting at statement token `i`, whose meaningful part starts at `p`. */
    declaration(i, p, end, ctx) {
      const { toks, pair } = this;
      const cands = [];
      let k = p;
      for (; k < end; k++) {
        const t = toks[k];
        if (t.t === 'id' && t.v === 'operator') {
          // `operator<<`, `operator bool` run to the `(`; for `operator()` that is the name's own `(`, which is
          // rejected as a candidate (a `(` follows it) before its real parameter list is read
          let q = k + 1;
          while (q < end && toks[q].v !== '(' && toks[q].v !== ';' && toks[q].v !== '{') q++;
          k = q - 1;
          continue;
        }
        if (t.t === 'p') {
          const v = t.v;
          if (v === ';') return k + 1;
          if (v === '}') return k;
          if (v === '{') return this.skip(p, end); // a body or initialiser with no declarator we recognise
          if (v === '=') return this.skip(p, end);
          if (v === '[') { if (pair[k] >= 0) k = pair[k]; continue; }
          if (v === '<') { const after = this.angles(k, end); if (after > 0) k = after - 1; continue; }
          if (v === '(') {
            const close = pair[k];
            if (close < 0) return this.skip(p, end);
            const nameEnd = k - 1;
            const prev = toks[nameEnd];
            // `operator()` is a name, and its parameter list is the next group
            if (prev && prev.v === ')' && toks[nameEnd - 1] && toks[nameEnd - 1].v === '(' && toks[nameEnd - 2] && toks[nameEnd - 2].v === 'operator') {
              cands.push({ open: k, close, nameStart: nameEnd - 2 });
            } else if (prev && prev.v === ')' && pair[nameEnd] === nameEnd - 2 && toks[nameEnd - 1].t === 'id' && toks[nameEnd - 3] && (toks[nameEnd - 3].t === 'id' || toks[nameEnd - 3].v === '>' || toks[nameEnd - 3].v === '*' || toks[nameEnd - 3].v === '&')) {
              // `result_type (min)() { ... }`: the parentheses keep a function-like macro named `min` from expanding
              cands.push({ open: k, close, nameStart: nameEnd - 1, parenthesised: true });
            } else if (prev && prev.t === 'id' && !NOT_A_FUNCTION.has(prev.v) && !ATTRIBUTE_CALLS.has(prev.v)) {
              cands.push({ open: k, close, nameStart: nameEnd });
            } else if (prev && prev.t === 'p' && toks[this.operatorStart(nameEnd)] && toks[this.operatorStart(nameEnd)].v === 'operator') {
              cands.push({ open: k, close, nameStart: this.operatorStart(nameEnd) });
            }
            const cand = cands[cands.length - 1];
            if (cand && cand.open === k) {
              const tl = this.tail(close + 1, end);
              if (tl) {
                const fn = this.function(i, p, cand, tl, ctx);
                if (fn) return tl.next;
                return tl.next > k ? tl.next : this.skip(p, end);
              }
            }
            k = close;
            continue;
          }
        }
      }
      return end;
    }

    /** Index of the `operator` token that starts the operator name ending at `last`, or -1. */
    operatorStart(last) {
      const { toks } = this;
      for (let q = last; q >= 0 && q > last - 6; q--) {
        if (toks[q].t === 'id' && toks[q].v === 'operator') return q;
        if (toks[q].t === 'p' && (toks[q].v === ';' || toks[q].v === '{' || toks[q].v === '}')) return -1;
      }
      return -1;
    }

    /** Try to list the function whose parameter list is `cand`; returns the node or null. */
    function(i, p, cand, tl, ctx) {
      const { toks, pair, src } = this;
      let ns = cand.nameStart;
      // a conversion operator names a type: `operator bool`, `operator const char*`
      if (toks[ns].v !== 'operator' && toks[ns - 1] && toks[ns - 1].v === 'operator') ns--;
      let nameFrom = ns;
      // `~Foo`
      if (toks[nameFrom - 1] && toks[nameFrom - 1].v === '~') nameFrom--;
      // `A::B::name`, `A<T>::name`
      while (toks[nameFrom - 1] && toks[nameFrom - 1].v === '::') {
        let q = nameFrom - 2;
        if (toks[q] && toks[q].v === '>') {
          let depth = 0;
          while (q >= p) { if (toks[q].v === '>') depth++; else if (toks[q].v === '<') { depth--; if (depth === 0) break; } q--; }
          q--;
        }
        if (q < p || !toks[q] || toks[q].t !== 'id') break;
        nameFrom = q;
      }
      // the written name, without template arguments in the qualifier
      const nameText = cand.parenthesised ? toks[nameFrom].v : this.nameText(nameFrom, cand.open);
      if (!nameText) return null;
      const bare = nameText.split('::').pop();
      const isOperator = /^operator\b/.test(bare);
      if (!isOperator && NOT_A_FUNCTION.has(bare)) return null;

      // what stands before the name: the return type, plus specifiers. An annotation macro called with
      // arguments (`ABSL_DEPRECATED("x") void f();`) is not part of the type and is dropped.
      const before = [];
      let wrapped = null; // the argument tokens of the one macro call that was dropped: `CJSON_PUBLIC(const char *) name(`
      let calls = 0;
      for (let q = p; q < nameFrom - (cand.parenthesised ? 1 : 0); q++) {
        const t = toks[q];
        if (t.t === 'id' && isMacroName(t.v) && toks[q + 1] && toks[q + 1].v === '(' && pair[q + 1] >= 0) {
          calls++;
          wrapped = toks.slice(q + 2, pair[q + 1]);
          q = pair[q + 1];
          continue;
        }
        before.push(t);
      }
      // Any other parenthesis there is a macro call with no `;` that ran into this declaration
      // (`DECLARE(foo) TEST(a, b) { ... }`), except where a type itself has one (`decltype(x)`).
      for (let q = 0; q < before.length; q++) {
        if (before[q].v !== '(') continue;
        const prev = before[q - 1];
        if (!(prev && prev.t === 'id' && (TYPE_PARENS.has(prev.v) || ATTRIBUTE_CALLS.has(prev.v)))) return null;
      }
      const qualified = nameText.includes('::');
      const cls = ctx.cls;
      const parts = nameText.split('::');
      const isCtorLike = bare === (cls && cls.name) || /^~/.test(bare)
        || (qualified && (parts[parts.length - 2] === bare || parts[parts.length - 2] === bare.replace(/^~/, '')))
        || (isOperator && /^operator\s+[A-Za-z_]/.test(bare) && !/^operator\s*(new|delete)\b/.test(bare));
      // `int count GUARDED_BY(mu_);` is a variable and its annotation. A name in capitals after a type that ends in a
      // name of its own is that, not a function (`UTC()` after `time_zone` is one).
      if (!isOperator && !/[a-z]/.test(bare) && endsInDeclarator(before)) return null;
      const typeTokens = before.filter((t) => !(t.t === 'id' && (SKIPPED_SPECIFIERS.has(t.v) || isMacroName(t.v))) && !(t.v === '>' || t.v === '<'));
      // Where the type is the macro itself, the name is an ordinary one: `CJSON_PUBLIC(const char *) cJSON_Version(void)`
      // wraps it in a call, `EMITTER_MANIP GetFlowType() const` is a macro that stands for it. A name in capitals
      // (`TEST(a, b) {`, `DECLARE(x);`) is a macro, not a function.
      let macroType = null;
      if (typeTokens.length === 0 && /[a-z]/.test(bare)) {
        const bareMacro = before.filter((t) => t.t === 'id' && isMacroName(t.v)).pop();
        if (calls === 1 && wrapped.length && wrapped.every((t) => t.t === 'id' || t.v === '*' || t.v === '&' || t.v === '::')) {
          macroType = collapse(src.slice(wrapped[0].i, wrapped[wrapped.length - 1].end));
        } else if (calls === 0 && bareMacro) {
          macroType = bareMacro.v;
        }
      }
      if (!isCtorLike && typeTokens.length === 0 && macroType === null) return null;     // `TEST(a, b) {`, `DECLARE(x);`: a macro, not a function
      if (isCtorLike && !cls && !qualified && !/^~/.test(bare)) return null;
      if (!cls && !qualified && !isCtorLike && this.looksLikeInitialiser(cand.open, cand.close)) return null;
      if (!cls && !qualified && isCtorLike) return null;

      const ret = isCtorLike ? '' : macroType !== null ? (macroType.length > MAX_RETURN ? macroType.slice(0, MAX_RETURN) : macroType) : this.returnType(before);
      const params = collapse(src.slice(toks[cand.open].end, toks[cand.close].i));
      ctx.out.push({
        kind: 'func', name: nameText, params: params.length > MAX_PARAMS ? `${params.slice(0, MAX_PARAMS - 1)}…` : params, ret,
        start: toks[i].line, end: toks[tl.last].line,
      });
      return true;
    }

    /**
     * `Foo x(1, 2);` initialises a variable; the parentheses of a function hold parameters. A literal is
     * evidence of the first only as a direct argument: `char name[16]` (an array bound) and `int n = 5`
     * (a default argument) are parameters.
     */
    looksLikeInitialiser(open, close) {
      const { toks, pair, src } = this;
      let defaulted = false;
      let from = toks[open].end;
      // the masking blanks a string away, so a quote is looked for in the text between the argument's tokens
      const quoted = (to) => !defaulted && /["']/.test(src.slice(from, to));
      for (let q = open + 1; q < close; q++) {
        const t = toks[q];
        if (t.t === 'p') {
          if ((t.v === '[' || t.v === '(') && pair[q] >= 0) { q = pair[q]; continue; }
          if (t.v === ',') { if (quoted(t.i)) return true; defaulted = false; from = t.end; }
          else if (t.v === '=') defaulted = true;
          else if (t.v === '.' && !defaulted) return true;
        } else if ((t.t === 'num' || t.t === 'str') && !defaulted) return true;
      }
      return quoted(toks[close].i);
    }

    /** The name as written, joined without spaces (`Foo::bar`, `~Foo`, `operator==`, `operator()`). */
    nameText(from, open) {
      const { toks } = this;
      let text = '';
      let angleDepth = 0;
      for (let q = from; q < open; q++) {
        const t = toks[q];
        if (t.v === '<' && toks[q - 1] && toks[q - 1].v !== 'operator' && !/operator/.test(text)) { angleDepth++; continue; }
        if (t.v === '>' && angleDepth > 0) { angleDepth--; continue; }
        if (angleDepth > 0) continue;
        if (t.t === 'id' && (/operator$/.test(text) || /\w$/.test(text))) text += ` ${t.v}`;
        else text += t.v;
      }
      return text.replace(/\s+/g, ' ').trim();
    }

    /** The return type, as written, minus specifiers, attributes and annotation macros. */
    returnType(before) {
      const { src } = this;
      const keep = before.filter((t) => !(t.t === 'id' && (SKIPPED_SPECIFIERS.has(t.v) || isMacroName(t.v))));
      // attribute groups inside the span: `[[nodiscard]]`, `__attribute__((x))`
      const kept = [];
      for (let q = 0; q < keep.length; q++) {
        const t = keep[q];
        if (t.v === '[' && keep[q + 1] && keep[q + 1].v === '[') { while (q < keep.length && !(keep[q].v === ']' && keep[q + 1] && keep[q + 1].v === ']')) q++; q++; continue; }
        if (t.t === 'id' && ATTRIBUTE_CALLS.has(t.v) && keep[q + 1] && keep[q + 1].v === '(') {
          let depth = 0;
          q++;
          for (; q < keep.length; q++) { if (keep[q].v === '(') depth++; else if (keep[q].v === ')') { depth--; if (depth === 0) break; } }
          continue;
        }
        kept.push(t);
      }
      if (!kept.length) return '';
      const text = collapse(src.slice(kept[0].i, kept[kept.length - 1].end));
      return text.length > MAX_RETURN ? text.slice(0, MAX_RETURN) : text;
    }
  }

  function collapse(s) {
    return s.replace(/\s+/g, ' ').trim();
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/csharp ──
__factories["./src/extractors/csharp"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');

  // Ceilings sit above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed
  // — an undisclosed cap looks like a class that simply has eight methods (#576).
  // Class bodies are scanned to this many characters. Real classes routinely
  // run past the old 4KB scan window — truncating there silently hid every
  // member after ~4000 chars AND anchored class end-lines short (#576). The
  // ceiling only guards against pathological input (Java parity, #551).
  const MAX_CLASS_BODY_CHARS = 200000;
  const MEMBER_LIMIT = 120;
  const PER_FILE_LIMIT = 200;

  // Chars scanned past the params before giving up on a return type.
  const RET_SCAN_CHARS = 400;

  /**
   * Extract signatures from C# source code.
   * Signatures carry `:start-end` line anchors (Surgical Context); the comment
   * strip below is newline-preserving so anchor lines match the original file.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // stripComments is length- AND newline-preserving; the previous regex strip
    // DELETED comment text, so offsets no longer aligned with the masked surface
    // the balanced reader walks (#695).
    const stripped = stripComments(src);
    const masked = maskCode(src);

    // Classes and interfaces. `partial` must sit immediately before the type
    // keyword, so it is one more optional token after the other modifiers; without
    // it every `partial` type — ubiquitous in WinForms, Blazor, EF and source
    // generators — extracted as nothing at all (#900).
    const typeRe = /^\s*(?:public\s+|internal\s+|protected\s+)?(?:abstract\s+|sealed\s+|static\s+)?(?:partial\s+)?(class|interface|enum|record|struct)\s+(\w+)(?:<[^{]*>)?(?:\s*:\s*[\w<>, .]+)?\s*\{/gm;
    for (const m of stripped.matchAll(typeRe)) {
      const declIdx = m.index + (m[0].length - m[0].trimStart().length);
      const bodyStart = m.index + m[0].length;
      const block = extractBlock(stripped, bodyStart);
      sigs.push(withAnchor(`${m[1]} ${m[2]}`, lineAt(stripped, declIdx), lineAt(stripped, bodyStart + block.length)));
      // Members of a NESTED type belong to that type, not to this one.
      const scoped = blankNestedTypeBodies(block, masked.slice(bodyStart, bodyStart + block.length),
        /^[ \t]+(?:(?:public|internal|protected|private|abstract|sealed|static|partial)\s+)*(?:class|interface|enum|record|struct)\s+\w+/gm);
      for (const meth of extractMembers(scoped.block, scoped.masked, { implicitPublic: m[1] === 'interface' })) {
        // The disclosure marker carries no offsets; anchor it at the class body.
        sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
      }
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /**
   * Resolve a declaration's parameter list with a BALANCED read (#695).
   *
   * `\(([^)]*)\)` stopped at the first `)`, so a nested call or a
   * function-typed parameter truncated the list mid-type.
   */
  function readParams(stripped, masked, openIdx) {
    const close = readBalanced(masked, openIdx);
    if (close < 0) return null;
    let i = close + 1;
    const stop = Math.min(masked.length, i + RET_SCAN_CHARS);
    while (i < stop) {
      const ch = masked[i];
      if (ch === '{' || ch === ';') break;
      if (ch === '(') { const c = readBalanced(masked, i); if (c < 0) break; i = c + 1; continue; }
      if (ch === '<') { const c = readBalanced(masked, i, '<', '>'); if (c < 0) { i++; continue; } i = c + 1; continue; }
      i++;
    }
    // `close` anchors a member to its DECLARATION line; `end` may run onto the
    // next line when the body brace sits there (C# style), which would widen the
    // anchor past the signature itself.
    return { params: stripped.slice(openIdx + 1, close), after: stripped.slice(close + 1, i), end: i, close };
  }

  /**
   * Blank the bodies of NESTED type declarations so their members are not also
   * attributed to the enclosing type (#741). Length- and newline-preserving, so
   * member offsets and line anchors still align with the original block.
   */
  function blankNestedTypeBodies(block, maskedBlock, typeRe) {
    const b = block.split('');
    const mb = maskedBlock.split('');
    for (const m of block.matchAll(typeRe)) {
      let i = m.index + m[0].length;
      const stop = Math.min(maskedBlock.length, i + RET_SCAN_CHARS);
      let open = -1;
      while (i < stop) {
        const ch = maskedBlock[i];
        if (ch === '{') { open = i; break; }
        if (ch === '(') { const c = readBalanced(maskedBlock, i); if (c < 0) break; i = c + 1; continue; }
        if (ch === '<') { const c = readBalanced(maskedBlock, i, '<', '>'); if (c < 0) { i++; continue; } i = c + 1; continue; }
        if (ch === ';') break;
        i++;
      }
      if (open < 0) continue;
      const close = readBalanced(maskedBlock, open, '{', '}');
      const end = close < 0 ? maskedBlock.length : close + 1;
      for (let k = open; k < end && k < b.length; k++) {
        if (b[k] !== '\n') b[k] = ' ';
        if (mb[k] !== '\n') mb[k] = ' ';
      }
    }
    return { block: b.join(''), masked: mb.join('') };
  }

  function extractBlock(src, startIndex) {
    let depth = 1, i = startIndex;
    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (src[i] === '{') depth++;
      else if (src[i] === '}') depth--;
      i++;
    }
    return src.slice(startIndex, i - 1);
  }

  function extractMembers(block, maskedBlock, opts = {}) {
    const members = [];
    // Interface members are IMPLICITLY public, so demanding an explicit modifier
    // matched none of them — `interface T` was reported with no members at all
    // (#741). Java already draws this distinction via the same option.
    const methodRe = opts.implicitPublic
      ? /^[ \t]+(?:(?:public|internal|protected|static|virtual|override|async|new)\s+)*([\w<>\[\]?., ]+?)\s+(\w+)\s*\(/gm
      : /^[ \t]+(?:public|internal|protected)\s+(?:static\s+|virtual\s+|override\s+|async\s+)*(?:where\s+\w+\s*:\s*[^\n]+\s+)?([\w<>\[\]?., ]+)\s+(\w+)\s*\(/gm;
    for (const m of block.matchAll(methodRe)) {
      const pr = readParams(block, maskedBlock, m.index + m[0].length - 1);
      if (!pr) continue;
      const ret = normalizeType(m[1]);
      const retStr = ret ? ` → ${ret}` : '';
      members.push({
        text: `${m[2]}(${normalizeParams(pr.params)})${retStr}`,
        declIdx: m.index + (m[0].length - m[0].trimStart().length),
        endIdx: pr.close + 1,
      });
    }
    return capMembersWithNotice(members, MEMBER_LIMIT);
  }

  function normalizeParams(params) {
    if (!params) return '';
    return params.trim().replace(/\s+/g, ' ');
  }

  function normalizeType(type) {
    if (!type) return '';
    return type.trim().replace(/\s+/g, ' ').slice(0, 30);
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/css ──
__factories["./src/extractors/css"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from CSS/SCSS/SASS/Less source code.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    const stripped = src
      .replace(/\/\/.*$/gm, '')
      .replace(/\/\*[\s\S]*?\*\//g, '');

    // CSS custom properties (variables)
    const rootMatch = stripped.match(/:root\s*\{([^}]*)\}/);
    if (rootMatch) {
      for (const m of rootMatch[1].matchAll(/(--[\w-]+)\s*:/g)) {
        sigs.push(`var ${m[1]}`);
      }
    }

    // SCSS/Less variables
    for (const m of stripped.matchAll(/^(\$[\w-]+)\s*:/gm)) {
      sigs.push(`$var ${m[1]}`);
    }

    // SCSS mixins
    for (const m of stripped.matchAll(/^@mixin\s+([\w-]+)(?:\s*\(([^)]*)\))?/gm)) {
      const params = m[2] ? `(${m[2].trim()})` : '';
      sigs.push(`@mixin ${m[1]}${params}`);
    }

    // SCSS functions
    for (const m of stripped.matchAll(/^@function\s+([\w-]+)\s*\(([^)]*)\)/gm)) {
      sigs.push(`@function ${m[1]}(${m[2].trim()})`);
    }

    // Key class names (top-level) — prefer hyphenated BEM/component names over utilities
    const allClassMatches = [...stripped.matchAll(/^\.([\w-]+)(?=[^{]*\{)/gm)];
    // Utility-class detection: classes are "utility-like" if they have no hyphen (e.g. .flex)
    // OR match Tailwind patterns: -digit suffix (.p-4, .bg-blue-500) or common size abbreviations
    // (.text-sm, .py-lg). Files where ≥70% of selectors are utility-like are skipped to avoid noise.
    function looksLikeUtility(name) {
      if (!name.includes('-')) return true;
      if (/-\d/.test(name)) return true;
      if (/-(?:sm|md|lg|xl|xs|2xl|3xl|px|py|full|auto|none|screen)$/.test(name)) return true;
      return false;
    }
    const utilityCount = allClassMatches.filter(m => looksLikeUtility(m[1])).length;
    const isUtilityFile = allClassMatches.length >= 5 && (utilityCount / allClassMatches.length) >= 0.70;
    if (!isUtilityFile) {
      const hyphenated = [];
      const singleWord = [];
      for (const m of allClassMatches) {
        if (m[1].includes('__') || m[1].includes('--')) hyphenated.push(m[1]); // BEM names first
        else if (m[1].includes('-')) hyphenated.push(m[1]); // other hyphenated component names
        else singleWord.push(m[1]);
      }
      // Up to 8 slots: hyphenated classes (semantic) first, then single-word to fill remaining
      const selected = [...hyphenated, ...singleWord].slice(0, 8);
      for (const name of selected) sigs.push(`.${name}`);
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/dart ──
__factories["./src/extractors/dart"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');

  // Ceilings sit above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed
  // — an undisclosed cap looks like a class that simply has eight methods (#576).
  // Class bodies are scanned to this many characters. Real classes routinely
  // run past the old 4KB scan window — truncating there silently hid every
  // member after ~4000 chars AND anchored class end-lines short (#576). The
  // ceiling only guards against pathological input (Java parity, #551).
  const MAX_CLASS_BODY_CHARS = 200000;
  const MEMBER_LIMIT = 120;
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from Dart source code.
   * Signatures carry `:start-end` line anchors (Surgical Context); the comment
   * strip below is newline-preserving so anchor lines match the original file.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // stripComments is length- AND newline-preserving; the previous strip DELETED
    // comment text, so offsets no longer aligned with the masked surface the
    // balanced reader walks (#695).
    const stripped = stripComments(src);
    const masked = maskCode(src);

    // Anchor range: scan past same-line trivia (`async`, `=>` stops) to a body `{`.
    const rangeFor = (declIdx, afterIdx) => {
      let k = afterIdx;
      while (k < stripped.length && /[ \tA-Za-z0-9_]/.test(stripped[k])) k++;
      if (stripped[k] === '{') {
        const end = k + 1 + extractBlock(stripped, k + 1).length;
        return [lineAt(stripped, declIdx), lineAt(stripped, end)];
      }
      const line = lineAt(stripped, declIdx);
      return [line, line];
    };

    // Classes and abstract classes
    for (const m of stripped.matchAll(/^(?:abstract\s+)?class\s+(\w+)(?:<[^{]*>)?(?:\s+extends\s+[\w<>, ]+)?(?:\s+(?:implements|with|on)\s+[\w<>, ]+)?\s*\{/gm)) {
      const abs = m[0].trimStart().startsWith('abstract') ? 'abstract ' : '';
      const bodyStart = m.index + m[0].length;
      const block = extractBlock(stripped, bodyStart);
      sigs.push(withAnchor(`${abs}class ${m[1]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)));
      for (const meth of extractMembers(block, masked.slice(bodyStart, bodyStart + block.length))) {
        // The disclosure marker carries no offsets; anchor it at the class body.
        sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
      }
    }

    // Top-level functions — capture return type (prefix before name) and show as suffix
    for (const m of stripped.matchAll(/^((?:Future<[\w<>?,\s]*>|[\w<>?]+))\s+(\w+)\s*\(/gm)) {
      if (m[2].startsWith('_')) continue;
      const pr = readParams(stripped, masked, m.index + m[0].length - 1);
      if (!pr) continue;
      const retStr = (m[1] && m[1] !== 'void') ? ` → ${m[1].replace(/\s+/g, '').slice(0, 25)}` : '';
      const [s, e] = rangeFor(m.index, pr.close + 1);
      sigs.push(withAnchor(`${m[2]}(${normalizeParams(pr.params)})${retStr}`, s, e));
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /** Balanced parameter read — `\(([^)]*)\)` truncated at a nested `)` (#695). */
  function readParams(stripped, masked, openIdx) {
    const close = readBalanced(masked, openIdx);
    if (close < 0) return null;
    return { params: stripped.slice(openIdx + 1, close), close };
  }

  function extractBlock(src, startIndex) {
    let depth = 1, i = startIndex;
    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (src[i] === '{') depth++;
      else if (src[i] === '}') depth--;
      i++;
    }
    return src.slice(startIndex, i - 1);
  }

  function extractMembers(block, maskedBlock) {
    const members = [];
    for (const m of block.matchAll(/^[ \t]+(?:@override\s+)?(?:@\w+\s+)*((?:Future<[\w<>?,\s]*>|[\w<>?]+))\s+(\w+)\s*\(/gm)) {
      if (m[2].startsWith('_')) continue;
      const pr = readParams(block, maskedBlock, m.index + m[0].length - 1);
      if (!pr) continue;
      const retStr = (m[1] && m[1] !== 'void') ? ` → ${m[1].replace(/\s+/g, '').slice(0, 25)}` : '';
      members.push({
        text: `${m[2]}(${normalizeParams(pr.params)})${retStr}`,
        declIdx: m.index + (m[0].length - m[0].trimStart().length),
        endIdx: pr.close + 1,
      });
    }
    return capMembersWithNotice(members, MEMBER_LIMIT);
  }

  /**
   * Compact the parameter text, keeping Dart's `{named}` / `[optional]` groups.
   *
   * The previous implementation deleted `{...}` groups wholesale — real API
   * surface, and only tolerable because the first-`)` capture had usually
   * mangled them anyway. Defaults are dropped at depth 0, so
   * `{int b = 2, int Function(int)? cb}` renders `{int b, int Function(int)? cb}`.
   */
  function normalizeParams(params) {
    if (!params || !params.trim()) return '';
    let out = '';
    let depth = 0;
    let quote = null;
    let skipDefault = false;
    for (let i = 0; i < params.length; i++) {
      const ch = params[i];
      if (quote) { out += ch; if (ch === '\\') { out += params[++i] || ''; continue; } if (ch === quote) quote = null; continue; }
      if (ch === '"' || ch === "'") { if (!skipDefault) { quote = ch; out += ch; } continue; }
      if (ch === '(' || ch === '<') { depth++; if (!skipDefault) out += ch; continue; }
      if (ch === ')' || ch === '>') { depth--; if (!skipDefault) out += ch; continue; }
      if (ch === '{' || ch === '[') { if (!skipDefault) out += ch; continue; }
      if (ch === '}' || ch === ']') { skipDefault = false; out += ch; continue; }
      if (ch === '=' && depth === 0) { skipDefault = true; continue; }
      if (ch === ',' && depth === 0) { skipDefault = false; out += ch; continue; }
      if (!skipDefault) out += ch;
    }
    return out.replace(/\s+/g, ' ').replace(/\s*,\s*/g, ', ').replace(/,\s*([}\]])/g, '$1').replace(/\s+([}\])])/g, '$1').replace(/\(\s+/g, '(').trim().replace(/,$/, '');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/deps ──
__factories["./src/extractors/deps"] = function(module, exports) {
  
  /**
   * Extract import dependencies from Python and TypeScript/JavaScript files.
   * Returns compact dependency arrays for the dep-map section of the context output.
   */

  const PYTHON_STDLIB = new Set([
    'os', 'sys', 're', 'json', 'time', 'threading', 'logging', 'typing',
    'dataclasses', 'datetime', 'uuid', 'pathlib', 'collections', 'functools',
    'itertools', 'math', 'random', 'string', 'struct', 'io', 'copy', 'pprint',
    'traceback', 'inspect', 'abc', 'enum', 'contextlib', 'weakref', 'gc',
    'socket', 'ssl', 'http', 'urllib', 'email', 'html', 'xml', 'csv', 'sqlite3',
    'argparse', 'subprocess', 'shutil', 'tempfile', 'glob', 'fnmatch', 'stat',
    'hashlib', 'hmac', 'base64', 'binascii', 'codecs', 'unicodedata', 'locale',
    'decimal', 'fractions', 'numbers', 'cmath', 'heapq', 'bisect', 'array',
    'queue', 'asyncio', 'concurrent', 'multiprocessing', 'signal', 'mmap',
    'builtins', 'warnings', 'operator', 'textwrap', 'difflib', 'readline',
  ]);

  /**
   * Extract project-level import dependencies from Python source.
   * @param {string} src
   * @returns {string[]}
   */
  function extractPythonDeps(src) {
    const deps = new Set();
    for (const m of src.matchAll(/^from\s+([\w.]+)\s+import/gm)) {
      const mod = m[1];
      const root = mod.replace(/^\.+/, '').split('.')[0];
      // Include relative imports and non-stdlib modules
      if (mod.startsWith('.') || (root && !PYTHON_STDLIB.has(root))) {
        deps.add(root || mod);
      }
    }
    for (const m of src.matchAll(/^import\s+([\w.]+)/gm)) {
      const root = m[1].split('.')[0];
      if (root && !PYTHON_STDLIB.has(root)) deps.add(root);
    }
    return [...deps].filter(Boolean).slice(0, 5);
  }

  /**
   * Extract relative import dependencies from TypeScript/JavaScript source.
   * @param {string} src
   * @returns {string[]}
   */
  function extractTSDeps(src) {
    // Strip single-line comments to avoid matching commented-out imports
    const stripped = src.replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
    const local = new Set();
    const pkgs = new Set();

    const add = (spec) => {
      if (!spec) return;
      if (spec.startsWith('.')) {
        // Normalise: '../store/authStore' -> store/authStore, './utils' -> utils
        const clean = spec.replace(/^\.\.\//, '').replace(/^\.\//, '').replace(/\.\w+$/, '');
        if (clean) local.add(clean);
        return;
      }
      if (spec.startsWith('/') || /^[a-z]+:/i.test(spec)) return; // absolute / url / node:
      // A bare specifier is an installed PACKAGE. These were dropped entirely,
      // so the dep map showed a JS project's internal wiring and never the
      // libraries it actually depends on — the reason "only npm projects list
      // their packages" read as false for this section.
      const parts = spec.split('/');
      const name = spec.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
      if (name) pkgs.add(name);
    };

    for (const m of stripped.matchAll(/\bfrom\s+['"]([^'"]+)['"]/g)) add(m[1]);
    for (const m of stripped.matchAll(/\brequire\(\s*['"]([^'"]+)['"]\s*\)/g)) add(m[1]);
    for (const m of stripped.matchAll(/\bimport\s+['"]([^'"]+)['"]/g)) add(m[1]);
    for (const m of stripped.matchAll(/\bimport\(\s*['"]([^'"]+)['"]\s*\)/g)) add(m[1]);

    // Packages first: which libraries a file uses is the scarcer signal, and the
    // local wiring is already recoverable from the file tree.
    return [...pkgs, ...local].slice(0, 5);
  }

  /**
   * Extract project-level import dependencies from R source.
   * Captures `library(pkg)`, `require(pkg)`, `requireNamespace("pkg")`, and
   * `pkg::fn` references, skipping base packages.
   * @param {string} src
   * @returns {string[]}
   */
  function extractRDeps(src) {
    const deps = new Set();
    // Strip line comments so commented-out library() calls don't match.
    const stripped = (src || '').replace(/#.*$/gm, '');
    for (const m of stripped.matchAll(/\b(?:library|require)\s*\(\s*["']?([\w.]+)["']?\s*\)/g)) {
      if (m[1] && !R_BASE_PKGS.has(m[1])) deps.add(m[1]);
    }
    for (const m of stripped.matchAll(/\brequireNamespace\s*\(\s*["']([\w.]+)["']/g)) {
      if (m[1] && !R_BASE_PKGS.has(m[1])) deps.add(m[1]);
    }
    for (const m of stripped.matchAll(/\b([A-Za-z][\w.]*)::[A-Za-z]/g)) {
      if (m[1] && !R_BASE_PKGS.has(m[1])) deps.add(m[1]);
    }
    return [...deps].slice(0, 5);
  }

  /**
   * Extract Lua require() module dependencies.
   * Captures `require "mod"` and `require("mod")`, returning compact module
   * names as they appear in source.
   * @param {string} src
   * @returns {string[]}
   */
  function extractLuaDeps(src) {
    const deps = new Set();
    const stripped = stripLuaComments(src || '');
    for (const m of stripped.matchAll(/\brequire\s*(?:\(\s*)?["']([A-Za-z0-9_.\/-]+)["']\s*\)?/g)) {
      if (m[1]) deps.add(m[1]);
    }
    return [...deps].slice(0, 5);
  }

  /**
   * Extract Elixir module dependencies: `alias A.B`, `import A.B`, `use A.B`,
   * `require A.B` — module names for repo-local resolution (#538).
   * @param {string} src
   * @returns {string[]}
   */
  function extractElixirDeps(src) {
    const deps = new Set();
    const stripped = String(src || '').replace(/#[^\n]*/g, '');
    for (const m of stripped.matchAll(/^\s*(?:alias|import|use|require)\s+([A-Z][\w.]*)/gm)) {
      deps.add(m[1]);
    }
    return [...deps].slice(0, 5);
  }

  function stripLuaComments(src) {
    return String(src || '')
      .replace(/--\[\[[\s\S]*?\]\]/g, '')
      .replace(/--.*$/gm, '');
  }

  /**
   * Build reverse dependency map from forward map.
   * @param {Map<string, string[]>} forwardMap
   * @returns {Map<string, string[]>}
   */
  function buildReverseDepMap(forwardMap) {
    const reverse = new Map();
    if (!forwardMap || typeof forwardMap.entries !== 'function') return reverse;
    for (const [file, deps] of forwardMap.entries()) {
      if (!Array.isArray(deps)) continue;
      for (const dep of deps) {
        if (!reverse.has(dep)) reverse.set(dep, []);
        reverse.get(dep).push(file);
      }
    }
    return reverse;
  }

  /** `java.*`/`javax.*` are the platform, not a dependency worth mapping. */
  const JAVA_PLATFORM = /^(?:java|javax|jdk|sun|com\.sun)\./;

  /**
   * Extract third-party package dependencies from Java/Kotlin source.
   *
   * There was no Java extractor at all, so a file importing jackson or Spring
   * produced an empty dep row while the POM beside it declared both. The import
   * is reduced to its PACKAGE (the class name dropped) so it lines up with the
   * groupId shape a reader sees in `sigmap deps`.
   *
   * @param {string} src
   * @returns {string[]}
   */
  function extractJavaDeps(src) {
    const deps = new Set();
    for (const m of src.matchAll(/^\s*import\s+(static\s+)?([\w.]+)(?:\.\*)?\s*;/gm)) {
      const isStatic = Boolean(m[1]);
      const full = m[2];
      if (JAVA_PLATFORM.test(full)) continue;
      const segs = full.split('.');
      // A static import ends in a MEMBER (`assertEquals`), which may be lowercase
      // and so would not be popped by the class rule below. Drop it first.
      if (isStatic && segs.length > 2) segs.pop();
      // Then drop the trailing Class name(s).
      while (segs.length > 2 && /^[A-Z]/.test(segs[segs.length - 1])) segs.pop();
      const pkg = segs.join('.');
      if (pkg && pkg.includes('.')) deps.add(pkg);
    }
    return [...deps].slice(0, 5);
  }

  module.exports = { extractPythonDeps, extractTSDeps, extractJavaDeps, extractRDeps, extractLuaDeps, extractElixirDeps, buildReverseDepMap };
  
};

// ── ./src/extractors/dispatch ──
__factories["./src/extractors/dispatch"] = function(module, exports) {
  
  const fs = require('fs');

  /**
   * Bundle-safe extractor dispatch.
   *
   * `packages/core`'s extract() resolves extractors via dynamic `require(path.join(…))`,
   * which cannot run inside the standalone bundle (no filesystem `src/`). This module
   * uses STATIC requires so the bundler rewrites them to `__require` and the extractors
   * resolve from the bundled factories. Used by the live-index MCP write hooks.
   */

  const path = require('path');
  const pipeline = __require('./src/extractors/pipeline');

  // Static language → extractor map (every entry is a bundled factory).
  const EXTRACTORS = {
    typescript: __require('./src/extractors/typescript'),
    typescript_react: __require('./src/extractors/typescript_react'),
    javascript: __require('./src/extractors/javascript'),
    python: __require('./src/extractors/python'),
    java: __require('./src/extractors/java'),
    kotlin: __require('./src/extractors/kotlin'),
    go: __require('./src/extractors/go'),
    rust: __require('./src/extractors/rust'),
    csharp: __require('./src/extractors/csharp'),
    cpp: __require('./src/extractors/cpp'),
    objc: __require('./src/extractors/objc'),
    ruby: __require('./src/extractors/ruby'),
    php: __require('./src/extractors/php'),
    swift: __require('./src/extractors/swift'),
    dart: __require('./src/extractors/dart'),
    scala: __require('./src/extractors/scala'),
    astro: __require('./src/extractors/astro'),
    elixir: __require('./src/extractors/elixir'),
    lua: __require('./src/extractors/lua'),
    gdscript: __require('./src/extractors/gdscript'),
    r: __require('./src/extractors/r'),
    vue_sfc: __require('./src/extractors/vue_sfc'),
    svelte: __require('./src/extractors/svelte'),
    html: __require('./src/extractors/html'),
    css: __require('./src/extractors/css'),
    yaml: __require('./src/extractors/yaml'),
    shell: __require('./src/extractors/shell'),
    powershell: __require('./src/extractors/powershell'),
    sql: __require('./src/extractors/sql'),
    graphql: __require('./src/extractors/graphql'),
    terraform: __require('./src/extractors/terraform'),
    protobuf: __require('./src/extractors/protobuf'),
    toml: __require('./src/extractors/toml'),
    properties: __require('./src/extractors/properties'),
    xml: __require('./src/extractors/xml'),
    markdown: __require('./src/extractors/markdown'),
    pipeline: __require('./src/extractors/pipeline'),
    dockerfile: __require('./src/extractors/dockerfile'),
    generic: __require('./src/extractors/generic'),
  };

  /**
   * Extension → extractor module name. **The single source of truth for
   * extractor resolution** (#591).
   *
   * Anything that decides *which extractor module to load* must go through
   * `langFor` rather than declaring its own copy. Three copies existed and two
   * had drifted: `src/eval/analyzer.js` carried a dead duplicate `.vue` key, and
   * the `--diagnose-extractors` map pointed at `vue.js` after that module was
   * deleted — which is how an unreachable extractor survived unnoticed (#582).
   *
   * Not every extension map in the codebase belongs here. `language-detector.js`
   * maps `.tsx → typescript` for language *statistics*, and `dashboard.js` keeps
   * short display *labels*. Both are correct for their purpose and deliberately
   * differ from resolution — folding them in would miscount languages.
   */
  const EXT_MAP = {
    '.ts': 'typescript', '.tsx': 'typescript_react',
    '.js': 'javascript', '.jsx': 'javascript', '.mjs': 'javascript', '.cjs': 'javascript',
    '.py': 'python', '.pyw': 'python',
    '.java': 'java',
    '.kt': 'kotlin', '.kts': 'kotlin',
    '.go': 'go',
    '.rs': 'rust',
    '.cs': 'csharp',
    '.cpp': 'cpp', '.c': 'cpp', '.h': 'cpp', '.hpp': 'cpp', '.cc': 'cpp',
    '.m': 'objc', '.mm': 'objc',
    '.rb': 'ruby', '.rake': 'ruby',
    '.php': 'php',
    '.swift': 'swift',
    '.dart': 'dart',
    '.scala': 'scala', '.sc': 'scala',
    '.astro': 'astro',
    '.ex': 'elixir',
    '.exs': 'elixir',
    '.lua': 'lua',
    '.gd': 'gdscript',
    '.r': 'r', '.R': 'r',
    '.vue': 'vue_sfc',
    '.svelte': 'svelte',
    '.html': 'html', '.htm': 'html',
    '.css': 'css', '.scss': 'css', '.sass': 'css', '.less': 'css',
    '.yml': 'yaml', '.yaml': 'yaml',
    '.sh': 'shell', '.bash': 'shell', '.zsh': 'shell', '.fish': 'shell',
    '.ps1': 'powershell', '.psm1': 'powershell', '.psd1': 'powershell',
    '.sql': 'sql',
    '.graphql': 'graphql', '.gql': 'graphql',
    '.tf': 'terraform', '.tfvars': 'terraform',
    '.proto': 'protobuf',
    '.toml': 'toml',
    '.properties': 'properties',
    '.xml': 'xml',
    '.md': 'markdown',
  };

  /**
   * Languages SigMap can extract, resolved from the one map above plus the two
   * that `langFor` routes by FILENAME rather than extension.
   *
   * `dashboard.js` kept a private 21-entry list and graded coverage against it,
   * so a repo written in Elixir, Lua, R, GDScript or Terraform was reported as
   * 9.5% covered against a denominator that had drifted from reality (#663). The
   * set is derived here instead, so adding an extractor cannot leave a second
   * copy stale. It reproduces `scripts/lib/source-meta.mjs` `deriveLanguages()`
   * exactly — the list `version.json` publishes and `check-doc-counts` gates —
   * which is why `typescript_react` is its own entry here as it is there.
   *
   * @type {string[]} sorted, deduplicated
   */
  const LANGUAGES = [...new Set([...Object.values(EXT_MAP), 'dockerfile', 'pipeline'])].sort();

  /** Resolve a language key from a file path/name. */
  function langFor(filePathOrName) {
    const raw = String(filePathOrName || '');
    // CI/pipeline definitions route by PATH, ahead of the extension map:
    // `.github/workflows/ci.yml` is a workflow first and YAML second, and
    // `Jenkinsfile` has no extension at all. Resolution stays single-source —
    // this is a path rule, not a second extension map.
    if (pipeline.platformFor(raw)) return 'pipeline';
    const base = path.basename(raw);
    if (base === 'Dockerfile' || base.startsWith('Dockerfile.')) return 'dockerfile';
    const ext = path.extname(base).toLowerCase();
    return EXT_MAP[ext] || null;
  }

  /**
   * Extract signatures from a file's content using the right extractor.
   * @param {string} filePathOrName - path or name (extension drives the extractor)
   * @param {string} src - file content
   * @returns {string[]}
   */
  function extractFile(filePathOrName, src) {
    if (!src || typeof src !== 'string') return [];
    const lang = langFor(filePathOrName);
    const mod = lang ? EXTRACTORS[lang] : null;
    if (!mod || typeof mod.extract !== 'function') return [];
    try {
      // Every extractor receives the path: python.js uses it to reach the native
      // AST tier (#693) and pipeline.js uses it to route by location; the rest
      // ignore the extra argument.
      //
      // Resolved to an absolute path when the file is on disk, because python's
      // AST pass shells out and needs a real path. When it is NOT on disk the
      // ORIGINAL string is passed rather than undefined, so path-routed
      // extraction still works for in-memory content (MCP write hooks, tests) —
      // `tryNativeExtract` returns null for a path it cannot read, so python
      // falls back to regex on its own.
      const abs = path.isAbsolute(filePathOrName) ? filePathOrName : path.resolve(filePathOrName);
      const fileArg = fs.existsSync(abs) ? abs : filePathOrName;
      const out = mod.extract(src, fileArg);
      return Array.isArray(out) ? out : [];
    } catch (_) {
      return [];
    }
  }

  module.exports = { extractFile, langFor, EXT_MAP, LANGUAGES };
  
};

// ── ./src/extractors/dockerfile ──
__factories["./src/extractors/dockerfile"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from Dockerfiles.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    const lines = src.split('\n').filter((l) => l.trim() && !l.trimStart().startsWith('#'));

    // FROM stages
    for (const line of lines) {
      const m = line.match(/^FROM\s+([^\s]+)(?:\s+AS\s+(\w+))?/i);
      if (m) sigs.push(`FROM ${m[1]}${m[2] ? ` AS ${m[2]}` : ''}`);
    }

    // EXPOSE ports
    const exposePorts = [];
    for (const line of lines) {
      const m = line.match(/^EXPOSE\s+([\d\s/]+)/i);
      if (m) exposePorts.push(...m[1].trim().split(/\s+/));
    }
    if (exposePorts.length > 0) sigs.push(`EXPOSE ${exposePorts.join(' ')}`);

    // ENTRYPOINT and CMD
    for (const line of lines) {
      if (/^ENTRYPOINT\s+/i.test(line)) sigs.push(line.trim());
      if (/^CMD\s+/i.test(line)) sigs.push(line.trim());
    }

    // ENV variables
    for (const line of lines) {
      const m = line.match(/^ENV\s+([\w]+)/i);
      if (m) sigs.push(`ENV ${m[1]}`);
    }

    // ARG variables
    for (const line of lines) {
      const m = line.match(/^ARG\s+([\w]+)/i);
      if (m) sigs.push(`ARG ${m[1]}`);
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/elixir ──
__factories["./src/extractors/elixir"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling discloses what it drops rather than truncating silently (#576).
  const PER_FILE_LIMIT = 200;
  const HINT_CHARS = 60;
  const SPEC_CHARS = 30;

  /**
   * Extract signatures from Elixir source code (.ex/.exs) — Tier 3 (#538).
   *
   * Recognised constructs:
   *   - `defmodule Mod.Name do` blocks, with `@moduledoc` first sentence
   *   - `def`/`defp`/`defmacro`/`defmacrop name(params)` (parens optional,
   *     `when` guards stripped), indented under their module
   *   - `@spec name(...) :: ret` as a `→ ret` return hint on the next def
   *   - `@doc "..."` / `@doc \"\"\"..."\"\"` first sentence as a doc hint
   *
   * Regex-only and zero-dependency, in the Lua/Ruby Tier-3 family.
   *
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];
    const lines = stripComments(src).split('\n');

    // Pending attribute state: @doc/@spec bind to the NEXT def; @moduledoc to
    // the enclosing module line just emitted.
    let pendingDoc = '';
    let pendingSpec = '';
    let moduleIdx = -1; // index in sigs of the current module line, for @moduledoc

    for (let i = 0; i < lines.length; i++) {
      const line = lines[i];

      const mod = /^\s*defmodule\s+([A-Z][\w.]*)\s+do\b/.exec(line);
      if (mod) {
        sigs.push(`defmodule ${mod[1]}`);
        moduleIdx = sigs.length - 1;
        pendingDoc = '';
        pendingSpec = '';
        continue;
      }

      const moduledoc = /^\s*@moduledoc\s+(.*)/.exec(line);
      if (moduledoc && moduleIdx !== -1) {
        const text = docText(moduledoc[1], lines, i);
        if (text && !sigs[moduleIdx].includes('  # ')) sigs[moduleIdx] += `  # ${text}`;
        continue;
      }

      const doc = /^\s*@doc\s+(.*)/.exec(line);
      if (doc) {
        pendingDoc = docText(doc[1], lines, i);
        continue;
      }

      const spec = /^\s*@spec\s+\w+[?!]?\s*\(.*::\s*(.+?)\s*$/.exec(line)
        || /^\s*@spec\s+\w+[?!]?\s+::\s*(.+?)\s*$/.exec(line);
      if (spec) {
        pendingSpec = spec[1].replace(/\s+/g, ' ').slice(0, SPEC_CHARS);
        continue;
      }

      const def = /^(\s*)(defmacrop?|defp?)\s+([a-z_]\w*[?!]?)\s*(?:\(([^)]*)\))?/.exec(line);
      if (def) {
        const name = def[3];
        if (name.startsWith('_') && !name.startsWith('__')) { pendingDoc = ''; pendingSpec = ''; continue; }
        const params = normalizeParams(def[4] || '');
        const ret = pendingSpec ? ` → ${pendingSpec}` : '';
        const hint = pendingDoc ? `  # ${pendingDoc}` : '';
        const indent = moduleIdx !== -1 ? '  ' : '';
        sigs.push(`${indent}${def[2]} ${name}(${params})${ret}${hint}`);
        pendingDoc = '';
        pendingSpec = '';
      }
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /** First sentence of a @doc/@moduledoc value; follows heredocs one line in. */
  function docText(rest, lines, i) {
    let text = rest.trim();
    if (text.startsWith('"""') || text.startsWith("'''")) {
      text = text.slice(3).trim();
      // Heredoc: take the first non-empty following line when the opener is bare.
      for (let j = i + 1; !text && j < lines.length && j < i + 4; j++) {
        const l = lines[j].trim();
        if (l.startsWith('"""') || l.startsWith("'''")) break;
        text = l;
      }
    }
    text = text.replace(/^["']|["']\s*\)?\s*$/g, '').replace(/\\n[\s\S]*$/, '');
    if (text === 'false') return '';
    return text.split(/[.!?]/)[0].trim().slice(0, HINT_CHARS);
  }

  function normalizeParams(params) {
    if (!params) return '';
    // Strip default values (`\\ default`) and pattern-match internals down to
    // the binding name where one is visible.
    return params
      .split(',')
      .map((p) => {
        let s = p.trim().split('\\\\')[0].trim();
        const asMatch = /=\s*([a-z_]\w*)\s*$/.exec(s); // %{...} = user
        if (asMatch) s = asMatch[1];
        return s.replace(/\s+/g, ' ');
      })
      .filter(Boolean)
      .join(', ');
  }

  /** Blank `#` comments while preserving line structure; strings kept. */
  function stripComments(src) {
    return String(src)
      .split('\n')
      .map((line) => {
        let out = '';
        let quote = null;
        for (let i = 0; i < line.length; i++) {
          const ch = line[i];
          if (quote) {
            out += ch;
            if (ch === quote && line[i - 1] !== '\\') quote = null;
            continue;
          }
          if (ch === '"' || ch === "'") { quote = ch; out += ch; continue; }
          if (ch === '#') break;
          out += ch;
        }
        return out;
      })
      .join('\n');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/gdscript ──
__factories["./src/extractors/gdscript"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  const PER_FILE_LIMIT = 200;

  // Ceilings disclose what they drop rather than truncating silently (#576).
  const MEMBER_LIMIT = 120;
  const ENUM_LIMIT = 24;

  /**
   * Extract signatures from Godot GDScript source code.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */

  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    const stripped = src.replace(/#.*$/gm, '');

    let className = null;
    let baseName = null;
    const addedClasses = new Set();

    const cm = stripped.match(/^class_name\s+(\w+)(?:\s+extends\s+([\w.]+))?/m);
    if (cm) {
      className = cm[1];
      if (cm[2]) baseName = cm[2];
    }
    if (!baseName) {
      const em = stripped.match(/^extends\s+([\w."/]+)/m);
      if (em) baseName = em[1];
    }

    if (className) {
      sigs.push(baseName ? `class ${className}(${baseName})` : `class ${className}`);
      addedClasses.add(className);
    } else if (baseName) {
      sigs.push(`extends ${baseName}`);
    }

    const indent = (className || baseName) ? '  ' : '';

    for (const m of stripped.matchAll(/^signal\s+(\w+)(?:\s*\(([^)]*)\))?/gm)) {
      sigs.push(`${indent}signal ${m[1]}(${normalizeParams(m[2] || '')})`);
    }

    for (const m of stripped.matchAll(/^enum\s+(\w+)\s*\{([^}]*)\}/gm)) {
      const members = m[2]
        .split(',')
        .map((s) => s.trim().split(/\s*=/)[0].trim())
        .filter(Boolean);
      sigs.push(`${indent}enum ${m[1]} { ${capWithNotice(members, ENUM_LIMIT, 'values').join(', ')} }`);
    }

    let constCount = 0;
    for (const m of stripped.matchAll(/^const\s+(\w+)(?:\s*:\s*[^=\n]+)?\s*:?=\s*([^\n]+)$/gm)) {
      let val = m[2].trim();
      const preloadMatch = val.match(/^preload\s*\(([^)]+)\)/);
      if (preloadMatch) {
        val = `preload(${preloadMatch[1]})`;
      } else if (val.length > 40) {
        val = val.slice(0, 37) + '...';
      }
      sigs.push(`${indent}const ${m[1]} = ${val}`);
      if (++constCount >= 5) break;
    }

    for (const m of stripped.matchAll(/^((?:@\w+(?:\([^)]*\))?\s+)*)var\s+(\w+)(?:\s*:\s*([^=\n]+?))?(?:\s*:?=\s*[^\n]+)?$/gm)) {
      const decorators = m[1] || '';
      const name = m[2];
      const hasDecorator = /@\w+/.test(decorators);
      if (!hasDecorator && name.startsWith('_')) continue;
      
      let prefix = decorators.replace(/\([^)]*\)/g, '').trim().split(/\s+/).join(' ');
      if (prefix) prefix += ' ';
      
      const type = (m[3] || '').trim();
      const typeStr = type ? `: ${type}` : '';
      sigs.push(`${indent}${prefix}var ${name}${typeStr}`);
    }

    for (const m of stripped.matchAll(/^(static\s+)?func\s+(\w+)\s*\(([^)]*)\)(?:\s*->\s*([^:\n]+))?\s*:/gm)) {
      const params = normalizeParams(m[3]);
      const ret = (m[4] || '').trim();
      const retStr = ret ? ` → ${ret.slice(0, 30)}` : '';
      const staticKw = m[1] ? 'static ' : '';
      sigs.push(`${indent}${staticKw}func ${m[2]}(${params})${retStr}`);
    }

    for (const m of stripped.matchAll(/^class\s+(\w+)(?:\s+extends\s+(\w+))?\s*:/gm)) {
      if (addedClasses.has(m[1])) continue;
      addedClasses.add(m[1]);
      sigs.push(m[2] ? `class ${m[1]}(${m[2]})` : `class ${m[1]}`);
      const startIdx = m.index + m[0].length;
      for (const meth of extractInnerMembers(stripped, startIdx)) {
        sigs.push(`  ${meth}`);
      }
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  function extractInnerMembers(stripped, startIndex) {
    const members = [];
    const lines = stripped.slice(startIndex).split('\n');
    for (const line of lines) {
      if (line.trim() === '') continue;
      if (!/^\s+/.test(line)) break;
      const fm = line.match(/^\s+(static\s+)?func\s+(\w+)\s*\(([^)]*)\)(?:\s*->\s*([^:\n]+))?\s*:/);
      if (fm) {
        const params = normalizeParams(fm[3]);
        const ret = (fm[4] || '').trim();
        const retStr = ret ? ` → ${ret.slice(0, 30)}` : '';
        const staticKw = fm[1] ? 'static ' : '';
        members.push(`${staticKw}func ${fm[2]}(${params})${retStr}`);
      }
    }
    return capWithNotice(members, MEMBER_LIMIT, 'members');
  }

  function normalizeParams(params) {
    if (!params) return '';
    return params.trim()
      .split(',')
      .map((p) => {
        const part = p.trim();
        if (!part) return '';
        const eqIdx = part.indexOf('=');
        const noDefault = eqIdx !== -1 ? part.slice(0, eqIdx).trim() : part;
        return noDefault.split(':')[0].trim();
      })
      .filter(Boolean)
      .join(', ');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/generic ──
__factories["./src/extractors/generic"] = function(module, exports) {
  
  module.exports = { extract };

  const PATTERNS = [
    /^(?:pub\s+)?(?:async\s+)?function\s+\w+\s*\(/,
    /^(?:pub\s+)?(?:async\s+)?fn\s+\w+[\s(<]/,
    /^def\s+\w+[\s(|:]/,
    /^(?:pub\s+)?func\s+\w+\s*\(/,
    /^(?:let|let\s+rec)\s+\w+\s*[=(]/,
    /^class\s+\w+/,
    /^(?:proc|sub|method)\s+\w+\s*\(/,
  ];

  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const results = [];
    for (const raw of src.split('\n')) {
      const line = raw.trim();
      if (!line || /^[#\-]/.test(line) || /^\/\//.test(line) || line.includes('\0')) continue;
      for (const pat of PATTERNS) {
        if (pat.test(line)) { results.push(line.slice(0, 120)); break; }
      }
      if (results.length >= 15) break;
    }
    return results;
  }
  
};

// ── ./src/extractors/go ──
__factories["./src/extractors/go"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  // Class bodies are scanned to this many characters. Real classes routinely
  // run past the old 4KB scan window — truncating there silently hid every
  // member after ~4000 chars AND anchored class end-lines short (#576). The
  // ceiling only guards against pathological input (Java parity, #551).
  const MAX_CLASS_BODY_CHARS = 200000;
  const PER_FILE_LIMIT = 200;

  // Per-interface member ceiling, disclosed via capMembersWithNotice (#576).
  const MEMBER_LIMIT = 120;

  // Chars scanned past the params for the return type before giving up — a
  // body-less declaration (assembly stub) must not swallow the next func's `{`.
  const RET_SCAN_CHARS = 300;

  /**
   * Extract signatures from Go source code.
   * Signatures carry `:start-end` line anchors (Surgical Context); comment
   * stripping is the shared string-aware scanner (G4, #643), so `//` inside a
   * string literal survives and anchor lines match the original file. Params
   * are captured with balanced-delimiter reads: nested func types, multiline
   * lists, type parameters (`[T any]`), and generic receivers all resolve.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];
    const docHints = buildDocHints(src);
    // Append the godoc hint after the anchor as `  # <hint>` — same convention
    // as the Python/JS extractors' doc hints.
    const hinted = (sig, name) => (docHints.has(name) ? `${sig}  # ${docHints.get(name)}` : sig);

    // stripComments is string-aware; maskCode additionally blanks string
    // contents so every delimiter seen on it is structural. Both preserve
    // length and newlines, so offsets align across all three surfaces.
    const stripped = stripComments(src);
    const masked = maskCode(src);

    // Index of the closing brace for a block opened just before startIndex.
    const blockEndIdx = (startIndex) => startIndex + extractBlock(stripped, masked, startIndex).length;

    // Structs (type parameters on the name allowed: `type Stack[T any] struct`)
    for (const m of stripped.matchAll(/^type\s+(\w+)(?:\[[^\]\n]*\])?\s+struct\s*\{/gm)) {
      const end = blockEndIdx(m.index + m[0].length);
      sigs.push(hinted(withAnchor(`type ${m[1]} struct`, lineAt(stripped, m.index), lineAt(stripped, end)), m[1]));
    }

    // Interfaces (type parameters on the name allowed)
    for (const m of stripped.matchAll(/^type\s+(\w+)(?:\[[^\]\n]*\])?\s+interface\s*\{/gm)) {
      const bodyStart = m.index + m[0].length;
      const block = extractBlock(stripped, masked, bodyStart);
      sigs.push(hinted(withAnchor(`type ${m[1]} interface`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)), m[1]));
      for (const meth of extractInterfaceMethods(block, masked.slice(bodyStart, bodyStart + block.length))) {
        sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
      }
    }

    // Functions and methods — balanced walk: optional receiver, name, optional
    // type params, params, return segment up to the body brace.
    const ws = (i) => { while (stripped[i] === ' ' || stripped[i] === '\t') i++; return i; };
    for (const m of stripped.matchAll(/^func\b/gm)) {
      let i = ws(m.index + 4);
      let receiver = '';
      if (stripped[i] === '(') {
        const close = readBalanced(masked, i);
        if (close < 0) continue;
        const rcvName = (/^[A-Za-z_]\w*/.exec(stripped.slice(i + 1, close).trim()) || [''])[0];
        receiver = rcvName ? `(${rcvName}) ` : '';
        i = ws(close + 1);
      }
      const nameM = /^[A-Za-z_]\w*/.exec(stripped.slice(i, i + 200));
      if (!nameM) continue;
      const name = nameM[0];
      i = ws(i + name.length);
      if (stripped[i] === '[') {
        const close = readBalanced(masked, i, '[', ']');
        if (close < 0) continue;
        i = ws(close + 1);
      }
      if (stripped[i] !== '(') continue;
      const paramsClose = readBalanced(masked, i);
      if (paramsClose < 0) continue;
      const params = stripped.slice(i + 1, paramsClose);
      // Return segment: walk to the body `{`, jumping balanced result tuples.
      let j = paramsClose + 1;
      let bodyOpen = -1;
      const scanEnd = Math.min(masked.length, paramsClose + RET_SCAN_CHARS);
      while (j < scanEnd) {
        const ch = masked[j];
        if (ch === '(') { const c = readBalanced(masked, j); if (c < 0) break; j = c + 1; continue; }
        if (ch === '{') { bodyOpen = j; break; }
        j++;
      }
      if (bodyOpen < 0) continue;
      const retType = stripped.slice(paramsClose + 1, bodyOpen).trim().replace(/\s+/g, ' ');
      const retStr = retType ? ` → ${retType.slice(0, 30)}` : '';
      const end = blockEndIdx(bodyOpen + 1);
      sigs.push(hinted(withAnchor(`func ${receiver}${name}(${normalizeParams(params)})${retStr}`, lineAt(stripped, m.index), lineAt(stripped, end)), name));
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  // Depth-counted on the MASKED surface (a brace inside a string can no longer
  // open or close a block); content sliced from the stripped surface.
  function extractBlock(stripped, masked, startIndex) {
    let depth = 1, i = startIndex;
    const end = Math.min(masked.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (masked[i] === '{') depth++;
      else if (masked[i] === '}') depth--;
      i++;
    }
    return stripped.slice(startIndex, i - 1);
  }

  function extractInterfaceMethods(block, maskedBlock) {
    const methods = [];
    for (const m of block.matchAll(/^[ \t]+([A-Za-z_]\w*)\s*\(/gm)) {
      const openIdx = m.index + m[0].length - 1;
      const close = readBalanced(maskedBlock, openIdx);
      if (close < 0) continue;
      const nl = block.indexOf('\n', close);
      const lineEnd = nl < 0 ? block.length : nl;
      const retType = block.slice(close + 1, lineEnd).trim().replace(/\s+/g, ' ');
      const retStr = retType ? ` → ${retType.slice(0, 30)}` : '';
      methods.push({
        text: `${m[1]}(${normalizeParams(block.slice(openIdx + 1, close))})${retStr}`,
        declIdx: m.index + (m[0].length - m[0].trimStart().length),
        endIdx: lineEnd,
      });
    }
    return capMembersWithNotice(methods, MEMBER_LIMIT, 'methods');
  }

  function normalizeParams(params) {
    if (!params) return '';
    return params.trim().replace(/\s+/g, ' ').replace(/,\s*$/, '');
  }

  // Godoc: the `//` comment block directly above a top-level func/type/method
  // declaration → first prose sentence, 60-char cap. Runs on the ORIGINAL src
  // (extract strips comments before matching). Compiler directives (`//go:...`)
  // carry no prose and are skipped.
  function buildDocHints(src) {
    const hints = new Map();
    const re = /((?:^\/\/[^\n]*\n)+)(?:func\s+(?:\([^)\n]*\)\s+)?(\w+)\s*[[(]|type\s+(\w+)\s+(?:struct|interface)\b)/gm;
    for (const m of src.matchAll(re)) {
      const name = m[2] || m[3];
      const hint = firstDocSentence(m[1]);
      if (hint && !hints.has(name)) hints.set(name, hint);
    }
    return hints;
  }

  // First non-directive prose line of a `//` block → first sentence, 60-char cap.
  function firstDocSentence(block) {
    const line = String(block).split('\n')
      .map((l) => l.replace(/^\/\/\s?/, '').trim())
      .find((l) => l && !l.startsWith('go:') && !l.startsWith('nolint'));
    if (!line) return '';
    return line.split(/[.!?]/)[0].trim().slice(0, 60);
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/graphql ──
__factories["./src/extractors/graphql"] = function(module, exports) {
  
  /**
   * Extract signatures from GraphQL schema / operation files.
   * Captures type, interface, enum, input, union, scalar, query, mutation,
   * subscription, fragment definitions.
   *
   * @param {string} src - Raw GraphQL content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Strip comments (# style)
    const stripped = src.replace(/#[^\n]*/g, '');

    // Schema type definitions: type Foo [implements Bar] { ... }
    for (const m of stripped.matchAll(
      /\b(type|interface|input)\s+(\w+)(?:\s+implements\s+([\w\s&]+))?\s*\{/g
    )) {
      const implements_ = m[3] ? ` implements ${m[3].trim().replace(/\s+/g, ' ')}` : '';
      sigs.push(`${m[1]} ${m[2]}${implements_}`);
    }

    // enum
    for (const m of stripped.matchAll(/\benum\s+(\w+)\s*\{/g)) {
      sigs.push(`enum ${m[1]}`);
    }

    // union
    for (const m of stripped.matchAll(/\bunion\s+(\w+)\s*=/g)) {
      sigs.push(`union ${m[1]}`);
    }

    // scalar
    for (const m of stripped.matchAll(/\bscalar\s+(\w+)/g)) {
      sigs.push(`scalar ${m[1]}`);
    }

    // extend type / extend interface
    for (const m of stripped.matchAll(/\bextend\s+(type|interface)\s+(\w+)/g)) {
      sigs.push(`extend ${m[1]} ${m[2]}`);
    }

    // Query / Mutation / Subscription operations
    for (const m of stripped.matchAll(
      /\b(query|mutation|subscription)\s+(\w+)\s*(?:\([^)]*\))?\s*\{/g
    )) {
      sigs.push(`${m[1]} ${m[2]}`);
    }

    // Named fragments
    for (const m of stripped.matchAll(/\bfragment\s+(\w+)\s+on\s+(\w+)/g)) {
      sigs.push(`fragment ${m[1]} on ${m[2]}`);
    }

    // Top-level schema { query: ... }
    if (/\bschema\s*\{/.test(stripped)) {
      sigs.push('schema { ... }');
    }

    return sigs;
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/html ──
__factories["./src/extractors/html"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from HTML files.
   * Focuses on id/class attributes, forms, and script tags.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Page title
    const titleMatch = src.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
    if (titleMatch) sigs.push(`title: ${titleMatch[1].trim()}`);

    // Forms with id/action
    for (const m of src.matchAll(/<form\s+([^>]*)>/gi)) {
      const attrs = m[1];
      const id = attrs.match(/id=["']?(\w+)/i);
      const action = attrs.match(/action=["']?([^"'\s>]+)/i);
      if (id) sigs.push(`form#${id[1]}${action ? ` action="${action[1]}"` : ''}`);
    }

    // Elements with id
    for (const m of src.matchAll(/<(\w+)\s+[^>]*id=["'](\w+)["'][^>]*>/gi)) {
      if (['html', 'head', 'body', 'script', 'style', 'link', 'meta'].includes(m[1].toLowerCase())) continue;
      sigs.push(`${m[1]}#${m[2]}`);
    }

    // Data attributes (data-component, data-controller etc)
    for (const m of src.matchAll(/data-(?:component|controller|view|page)=["'](\w[\w-]*)/gi)) {
      sigs.push(`data-${m[0].match(/data-(\w[\w-]*)/i)[1]}: ${m[1]}`);
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/java ──
__factories["./src/extractors/java"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');

  // Class bodies are scanned to this many characters. Generated JVM sources
  // (MyBatis/JPA entities) routinely run past 10KB, so the ceiling only guards
  // against pathological input rather than trimming ordinary classes.
  const MAX_CLASS_BODY_CHARS = 200000;

  // Per-class member ceiling. Sits above the default `maxSigsPerFile` so the
  // caller's configured budget governs the output rather than this file.
  const MAX_MEMBERS_PER_CLASS = 120;

  // Per-file signature ceiling, likewise above the configured default.
  const MAX_SIGS_PER_FILE = 200;

  // Chars scanned past a type's name/header for the body `{` (extends /
  // implements / permits clauses) before giving up.
  const HEAD_SCAN_CHARS = 500;

  /**
   * Extract signatures from Java source code.
   * Signatures carry `:start-end` line anchors (Surgical Context); comment
   * stripping is the shared string-aware scanner (G4, #646), so `//` or `/*`
   * inside a string literal survives, and brace depth is counted on masked
   * text. Balanced reads capture annotation-argument params, nested generic
   * bounds, generic type names, records, sealed types, and implicit-public
   * interface methods.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];
    const docHints = buildDocHints(src);
    // Append the Javadoc hint after the anchor as `  # <hint>` — same convention
    // as the Python/JS extractors' doc hints.
    const hinted = (sig, name) => (docHints.has(name) ? `${sig}  # ${docHints.get(name)}` : sig);

    const stripped = stripComments(src);
    const masked = maskCode(src);
    const ws = (i) => { while (stripped[i] === ' ' || stripped[i] === '\t' || stripped[i] === '\n') i++; return i; };

    // Type declarations: classes, interfaces, enums, records — modifiers in any
    // order, sealed/non-sealed included, generic names allowed.
    const typeRegex = /^[ \t]*(?:(?:public|protected|private|abstract|final|sealed|non-sealed|static|strictfp)\s+)*(class|interface|enum|record)\s+(\w+)/gm;
    for (const m of stripped.matchAll(typeRegex)) {
      const kw = m[1];
      const name = m[2];
      const declIdx = m.index + (m[0].length - m[0].trimStart().length);
      let i = m.index + m[0].length;
      // Optional type parameters on the name: `<T, ID>`, `<T extends Comparable<T>>`.
      i = ws(i);
      if (stripped[i] === '<') {
        const c = readBalanced(masked, i, '<', '>');
        if (c < 0) continue;
        i = ws(c + 1);
      }
      // Record header components: `record Point(int x, int y)`.
      let header = '';
      if (kw === 'record') {
        if (stripped[i] !== '(') continue;
        const c = readBalanced(masked, i);
        if (c < 0) continue;
        header = `(${normalizeParams(stripped.slice(i + 1, c))})`;
        i = ws(c + 1);
      }
      // Walk extends/implements/permits to the body brace, jumping generics.
      let bodyOpen = -1;
      const scanEnd = Math.min(masked.length, i + HEAD_SCAN_CHARS);
      let j = i;
      while (j < scanEnd) {
        const ch = masked[j];
        if (ch === '<') { const c = readBalanced(masked, j, '<', '>'); if (c < 0) break; j = c + 1; continue; }
        if (ch === '{') { bodyOpen = j; break; }
        if (ch === ';') break; // degenerate body-less declaration
        j++;
      }
      if (bodyOpen < 0) continue;
      const bodyStart = bodyOpen + 1;
      const block = extractBlock(stripped, masked, bodyStart);
      sigs.push(hinted(withAnchor(`${kw} ${name}${header}`, lineAt(stripped, declIdx), lineAt(stripped, bodyStart + block.length)), name));
      const maskedBlock = masked.slice(bodyStart, bodyStart + block.length);
      // Members of a NESTED type belong to that type. Reporting nested types at
      // all (the anchor fix above) is what makes this necessary — without it the
      // same method is emitted under both owners, as it was in kotlin/scala (#738).
      const scoped = blankNestedTypeBodies(block, maskedBlock,
        /^[ \t]+(?:(?:public|protected|private|abstract|final|sealed|non-sealed|static|strictfp)\s+)*(?:class|interface|enum|record)\s+\w+/gm);
      for (const meth of extractMembers(scoped.block, scoped.masked, { implicitPublic: kw === 'interface' })) {
        // The disclosure marker carries no offsets; anchor it at the class body.
        const declIdx = meth.declIdx || 0;
        const endIdx = meth.endIdx || 0;
        sigs.push(hinted(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + declIdx), lineAt(stripped, bodyStart + endIdx)), meth.name));
      }
    }

    return capWithNotice(sigs, MAX_SIGS_PER_FILE, 'signatures');
  }

  // Depth-counted on the MASKED surface (a brace inside a string can no longer
  // open or close a block); content sliced from the stripped surface.
  /**
   * Blank the bodies of NESTED type declarations so their members are not also
   * attributed to the enclosing type (#741). Length- and newline-preserving.
   */
  function blankNestedTypeBodies(block, maskedBlock, typeRe) {
    const b = block.split('');
    const mb = maskedBlock.split('');
    for (const m of block.matchAll(typeRe)) {
      let i = m.index + m[0].length;
      const stop = Math.min(maskedBlock.length, i + HEAD_SCAN_CHARS);
      let open = -1;
      while (i < stop) {
        const ch = maskedBlock[i];
        if (ch === '{') { open = i; break; }
        if (ch === '(') { const c = readBalanced(maskedBlock, i); if (c < 0) break; i = c + 1; continue; }
        if (ch === '<') { const c = readBalanced(maskedBlock, i, '<', '>'); if (c < 0) { i++; continue; } i = c + 1; continue; }
        if (ch === ';') break;
        i++;
      }
      if (open < 0) continue;
      const close = readBalanced(maskedBlock, open, '{', '}');
      const end = close < 0 ? maskedBlock.length : close + 1;
      for (let k = open; k < end && k < b.length; k++) {
        if (b[k] !== '\n') b[k] = ' ';
        if (mb[k] !== '\n') mb[k] = ' ';
      }
    }
    return { block: b.join(''), masked: mb.join('') };
  }

  function extractBlock(stripped, masked, startIndex) {
    let depth = 1;
    let i = startIndex;
    const end = Math.min(masked.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (masked[i] === '{') depth++;
      else if (masked[i] === '}') depth--;
      i++;
    }
    return stripped.slice(startIndex, i - 1);
  }

  const MODIFIER_RE = /^(?:public|protected|private|static|final|synchronized|abstract|default|native|strictfp)\b/;

  /**
   * Member scan over a type body. Class/enum/record mode requires a
   * public/protected modifier (statements inside method bodies never carry
   * one at declaration position). Interface mode additionally accepts
   * modifier-less declarations — interface bodies hold no statements, so a
   * `name(params)` parse there is safe.
   */
  function extractMembers(block, maskedBlock, opts = {}) {
    const members = [];
    const seen = new Set();
    const wsB = (i) => { while (block[i] === ' ' || block[i] === '\t') i++; return i; };
    const headRe = opts.implicitPublic
      ? /^([ \t]+)(?=[A-Za-z_<])/gm
      : /^([ \t]+)(?=(?:public|protected)\b)/gm;
    for (const m of block.matchAll(headRe)) {
      let i = m.index + m[1].length;
      const declIdx = i;
      // Modifiers (any, in any order).
      let sawVisible = false;
      for (;;) {
        const mm = MODIFIER_RE.exec(block.slice(i, i + 16));
        if (!mm) break;
        if (mm[0] === 'public' || mm[0] === 'protected') sawVisible = true;
        if (mm[0] === 'private') { sawVisible = false; break; }
        i = wsB(i + mm[0].length);
      }
      if (!opts.implicitPublic && !sawVisible) continue;
      // Optional generic type parameters: `<T extends Comparable<T>>`.
      if (block[i] === '<') {
        const c = readBalanced(maskedBlock, i, '<', '>');
        if (c < 0) continue;
        i = wsB(c + 1);
      }
      // Return type: identifier chain + optional generics + array brackets.
      const t0 = i;
      const idM = /^[\w.]+/.exec(block.slice(i, i + 200));
      if (!idM) continue;
      i += idM[0].length;
      if (block[i] === '<') {
        const c = readBalanced(maskedBlock, i, '<', '>');
        if (c < 0) continue;
        i = c + 1;
      }
      while (block.slice(i, i + 2) === '[]') i += 2;
      const retText = block.slice(t0, i);
      i = wsB(i);
      // Name, then params — anything else (field, constructor) is skipped.
      const nameM = /^\w+/.exec(block.slice(i, i + 200));
      if (!nameM) continue;
      const name = nameM[0];
      i = wsB(i + name.length);
      if (block[i] !== '(') continue;
      const close = readBalanced(maskedBlock, i);
      if (close < 0) continue;
      const params = block.slice(i + 1, close);
      const nl = block.indexOf('\n', close);
      const lineEnd = nl < 0 ? block.length : nl;
      const key = `${name}::${declIdx}`;
      if (seen.has(key)) continue;
      seen.add(key);
      const ret = normalizeType(retText);
      const retStr = ret ? ` → ${ret}` : '';
      members.push({
        text: `${name}(${normalizeParams(params)})${retStr}`,
        name,
        declIdx,
        endIdx: lineEnd,
      });
    }
    return capMembersWithNotice(members, MAX_MEMBERS_PER_CLASS);
  }

  function normalizeParams(params) {
    if (!params) return '';
    return params.trim().replace(/\s+/g, ' ').replace(/,\s*$/, '');
  }

  function normalizeType(type) {
    if (!type) return '';
    return type.trim().replace(/\s+/g, ' ').slice(0, 30);
  }

  // Javadoc: the `/** ... */` block directly above a type or public/protected
  // member declaration → first prose sentence, 60-char cap. Runs on the
  // ORIGINAL src (extract strips comments before matching). Annotation lines
  // (`@Override` etc.) between the doc block and the declaration are tolerated.
  // Body may not contain `*/` so a failed adjacency check can't expand across
  // code to the next comment block and misattribute the hint.
  function buildDocHints(src) {
    const hints = new Map();
    const patterns = [
      /\/\*\*((?:[^*]|\*(?!\/))*)\*\/\s*(?:@\w+(?:\([^)]*\))?\s*)*(?:public\s+|protected\s+)?(?:abstract\s+|final\s+|sealed\s+|non-sealed\s+)?(?:class|interface|enum|record)\s+(\w+)/g,
      /\/\*\*((?:[^*]|\*(?!\/))*)\*\/\s*(?:@\w+(?:\([^)]*\))?\s*)*(?:public|protected)\s+(?:static\s+)?(?:final\s+)?(?:synchronized\s+)?(?:<[^>]+>\s+)?[\w<>\[\], ?.]+\s+(\w+)\s*\(/g,
    ];
    for (const re of patterns) {
      for (const m of src.matchAll(re)) {
        const hint = firstDocSentence(m[1]);
        if (hint && !hints.has(m[2])) hints.set(m[2], hint);
      }
    }
    return hints;
  }

  // First non-tag prose line of a Javadoc body → first sentence, 60-char cap.
  function firstDocSentence(body) {
    const line = String(body).split('\n')
      .map((l) => l.replace(/^\s*\*\s?/, '').trim())
      .find((l) => l && !l.startsWith('@'));
    if (!line) return '';
    return line.split(/[.!?]/)[0].trim().slice(0, 60);
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/javascript ──
__factories["./src/extractors/javascript"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');
  const { scanComponentMarkers, markersForClass, componentMembers } = __require('./src/extractors/component-surface');
  const { lateLast } = __require('./src/util/late-last');
  const { atStatementStart } = __require('./src/util/statement-start');

  // Class bodies are scanned to this many characters — guard against
  // pathological input only; the old 4KB window silently hid members (#576).
  const MAX_CLASS_BODY_CHARS = 200000;

  /**
   * Extract signatures from JavaScript source code.
   * Top-level declarations and class members carry a `:start-end` line anchor
   * (see line-anchor.js); kept parallel to `sigs` and applied once at return.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];
    const anchors = [];
    // docHintFor[i] is the doc-comment hint for sigs[i] (top-level functions
    // only), appended after the anchor as `  # <hint>` — same convention as the
    // Python extractor's extractDocHint.
    const docHintFor = [];
    const returnHints = buildReturnHints(src);
    const docHints = buildDocHints(src);

    // stripComments is string-aware (a `//` inside a string literal survives);
    // maskCode additionally blanks string/template contents so every delimiter
    // found on it is structural. Both are length- and newline-preserving, so
    // offsets and line anchors align across all three views (#526). `js`
    // makes a regex literal or nested template inert too (#874).
    const stripped = stripComments(src, { js: true });
    const masked = maskCode(src, { js: true });

    // Full params for a declaration whose `(` sits at openIdx: depth-matched
    // close over masked text; TEXT sliced from stripped so string defaults keep
    // their real content. Falls back to first-`)` when unbalanced (cap hit).
    const paramsFrom = (openIdx) => {
      const closeIdx = readBalanced(masked, openIdx);
      if (closeIdx === -1) {
        const naive = stripped.indexOf(')', openIdx);
        return { params: stripped.slice(openIdx + 1, naive === -1 ? openIdx + 1 : naive), closeIdx: naive };
      }
      return { params: stripped.slice(openIdx + 1, closeIdx), closeIdx };
    };

    const blockEndIdx = (bodyStart) => bodyStart + extractBlock(masked, bodyStart).length;
    /**
     * Index of the `{` that opens a class body, scanning from just after the
     * class name, or -1 when there is none.
     *
     * Depth-aware so a call-expression superclass (`extends Mixin(Base)`) and a
     * generic argument list are stepped over rather than mistaken for the body.
     * Bounded, so a malformed class cannot walk the rest of the file.
     */
    const findClassBody = (from) => {
      let depth = 0;
      const limit = Math.min(masked.length, from + 600);
      for (let i = from; i < limit; i++) {
        const c = masked[i];
        if (c === '(' || c === '<' || c === '[') depth++;
        else if (c === ')' || c === '>' || c === ']') depth = Math.max(0, depth - 1);
        else if (c === '{' && depth === 0) return i;
        else if (c === ';' || c === '=') return -1;   // not a class declaration
      }
      return -1;
    };

    // End line for a function whose params close just before `matchEnd`.
    const fnEndLine = (matchEnd, startLn) => {
      const brace = masked.indexOf('{', matchEnd);
      return brace !== -1 ? lineAt(stripped, blockEndIdx(brace + 1)) : startLn;
    };

    // Classes
    //
    // The heritage clause is NOT matched by this regex, only the class name.
    // Trying to match it inline silently dropped whole classes: `extends
    // Mixin(LitElement)` — the idiomatic Lit/web-component composition — never
    // matched `extends [\w.]+` followed by `{`, and because the extends group
    // was optional the fallback failed too. On ing-bank/lion that was 111 of
    // 326 classes (34%) extracted as nothing at all: no class, no methods.
    // `findClassBody` walks to the body brace instead, so any superclass
    // expression works. Leading whitespace is allowed as well, which is what
    // makes the mixin-factory form (`superclass => class X extends superclass`)
    // reachable — its class sits indented on its own line.
    const classRegex = /^[ \t]*(export\s+(?:default\s+)?)?class\s+([\w$]+)(?![\w$])/gm;
    // Web-component surface (#537) — gated on detection, see typescript.js.
    const compMarkers = scanComponentMarkers(stripped);
    for (const m of stripped.matchAll(classRegex)) {
      const prefix = m[1] ? m[1].trim() + ' ' : '';
      const bodyBrace = findClassBody(m.index + m[0].length);
      if (bodyBrace === -1) continue;
      const heritage = stripped.slice(m.index + m[0].length, bodyBrace)
        .replace(/\s+/g, ' ').trim().replace(/^extends\s+/, '');
      const bodyStart = bodyBrace + 1;
      const blockEnd = blockEndIdx(bodyStart);
      const marker = markersForClass(compMarkers.decorated, stripped, m.index, m[0]);
      const definedTag = compMarkers.defined.get(m[2]);
      const isComponent = !!(marker || definedTag);
      // A call-expression superclass is mixin composition — `extends
      // LocalizeMixin(LitElement)` states which behaviours a component gets and
      // is not recoverable from anywhere else, so it is always rendered. A plain
      // `extends Base` stays gated on component detection, keeping every other
      // repo's output byte-identical.
      const base = heritage && (isComponent || heritage.includes('(')) ? ` extends ${heritage}` : '';
      sigs.push(`${prefix}class ${m[2]}${base}`);
      const classStartLn = lineAt(stripped, m.index);
      anchors.push([classStartLn, lineAt(stripped, blockEnd)]);
      const block = stripped.slice(bodyStart, blockEnd);
      const maskedBlock = masked.slice(bodyStart, blockEnd);
      if (isComponent) {
        const tag = (marker && marker.tag) || definedTag;
        if (tag) { sigs.push(`  custom element <${tag}>`); anchors.push([classStartLn, classStartLn]); }
        else if (marker && marker.selector) { sigs.push(`  selector '${marker.selector}'`); anchors.push([classStartLn, classStartLn]); }
        for (const cm of componentMembers(block)) {
          sigs.push(`  ${cm.text}`);
          anchors.push([lineAt(stripped, bodyStart + cm.start), lineAt(stripped, bodyStart + cm.end)]);
        }
      }
      for (const meth of extractClassMembers(block, maskedBlock, returnHints)) {
        sigs.push(`  ${meth.text}`);
        anchors.push([lineAt(stripped, bodyStart + meth.start), lineAt(stripped, bodyStart + meth.end)]);
      }
    }

    // Exported named functions — `export function f` and `export default function f`.
    // The modifiers are CAPTURED, never searched for in the whole match: `export
    // function async(` must not read as an async function because of its NAME (#902).
    for (const m of stripped.matchAll(/export\s+(default\s+)?(async\s+)?function\s+([\w$]+)\s*\(/gm)) {
      if (!atStatementStart(stripped, m.index)) continue;
      const asyncKw = m[2] ? 'async ' : '';
      const retStr = formatReturnHint(returnHints.get(m[3]));
      const startLn = lineAt(stripped, m.index);
      const { params, closeIdx } = paramsFrom(m.index + m[0].length - 1);
      sigs.push(`export ${m[1] ? 'default ' : ''}${asyncKw}function ${m[3]}(${normalizeParams(params)})${retStr}`);
      docHintFor[sigs.length - 1] = docHints.get(m[3]);
      anchors.push([startLn, fnEndLine(closeIdx + 1, startLn)]);
    }

    // `export default function () {}`: nothing names it, so the entry carries no name (#996).
    for (const m of stripped.matchAll(/export\s+default\s+(async\s+)?function\s*\(/gm)) {
      if (!atStatementStart(stripped, m.index)) continue;
      const startLn = lineAt(stripped, m.index);
      const { params, closeIdx } = paramsFrom(m.index + m[0].length - 1);
      sigs.push(`export default ${m[1] ? 'async ' : ''}function (${normalizeParams(params)})`);
      anchors.push([startLn, fnEndLine(closeIdx + 1, startLn)]);
    }

    // Arrow functions bound to a const — `export const f = (…) =>`, and the
    // `const f = (…) =>` that an `export default f` names (see below).
    const emittedArrows = new Set();
    const pushArrow = (declIdx, openIdx, name, asyncKw, prefix) => {
      const { params, closeIdx } = paramsFrom(openIdx);
      if (closeIdx === -1 || !/^\s*=>/.test(masked.slice(closeIdx + 1, closeIdx + 40))) return;
      const retStr = formatReturnHint(returnHints.get(name));
      const startLn = lineAt(stripped, declIdx);
      sigs.push(name ? `${prefix}const ${name} = ${asyncKw}(${normalizeParams(params)}) =>${retStr}` : `${prefix}${asyncKw}(${normalizeParams(params)}) =>${retStr}`);
      docHintFor[sigs.length - 1] = docHints.get(name);
      anchors.push([startLn, fnEndLine(closeIdx + 1, startLn)]);
      emittedArrows.add(name);
    };

    // Exported arrow functions
    for (const m of stripped.matchAll(/export\s+const\s+([\w$]+)\s*=\s*(?:async\s+)?\(/gm)) {
      if (!atStatementStart(stripped, m.index)) continue;
      pushArrow(m.index, m.index + m[0].length - 1, m[1], m[0].includes('async') ? 'async ' : '', 'export ');
    }

    // `export default (a) => …`: an anonymous default arrow.
    for (const m of masked.matchAll(/export\s+default\s+(async\s+)?\(/gm)) {
      if (!atStatementStart(masked, m.index)) continue;
      pushArrow(m.index, m.index + m[0].length - 1, '', m[1] ? 'async ' : '', 'export default ');
    }

    // `export default <identifier>` over a const-bound arrow (#900). A function
    // DECLARATION it names is already extracted below as a top-level function, so
    // only the arrow form — which nothing else reaches — is resolved here. The
    // identifier must be declared in this file: an imported one invents nothing.
    // Matched on the masked surface so a line inside a template literal is inert.
    for (const dm of masked.matchAll(/^export[ \t]+default[ \t]+([A-Za-z_$][\w$]*)[ \t]*;?[ \t]*$/gm)) {
      const name = dm[1];
      if (emittedArrows.has(name)) continue;
      const arrow = new RegExp(`^(?:const|let|var)\\s+${name.replace(/\$/g, '\\$')}\\s*=\\s*(async\\s+)?\\(`, 'm').exec(masked);
      if (arrow) pushArrow(arrow.index, arrow.index + arrow[0].length - 1, name, arrow[1] ? 'async ' : '', 'export default ');
    }

    // module.exports = { ... }
    const moduleExports = stripped.match(/^module\.exports\s*=\s*\{([^}]+)\}/m);
    if (moduleExports) {
      const names = moduleExports[1].split(',').map((s) => s.trim()).filter(Boolean);
      if (names.length > 0) {
        const startLn = lineAt(stripped, moduleExports.index);
        sigs.push(`module.exports = { ${names.join(', ')} }`);
        anchors.push([startLn, lineAt(stripped, moduleExports.index + moduleExports[0].length)]);
      }
    }

    // CommonJS assignment methods — `app.use = function use(fn) {…}` — on the module's exported
    // object (#996). That object is `exports`, `module.exports`, a name bound to
    // `module.exports` (`var app = module.exports = {}`) or one that `module.exports = name`
    // names; a local object that is never exported is not the module's API.
    const exportedObjects = new Set(['exports', 'module.exports']);
    for (const m of masked.matchAll(/^(?:(?:var|let|const)\s+)?([A-Za-z_$][\w$]*)\s*=\s*(?:exports\s*=\s*)?module\.exports\s*=/gm)) exportedObjects.add(m[1]);
    for (const m of masked.matchAll(/^module\.exports\s*=\s*([A-Za-z_$][\w$]*)[ \t]*;?[ \t]*$/gm)) exportedObjects.add(m[1]);
    const arrowEndLine = (closeIdx, startLn) => {
      const arrow = /^\s*=>\s*/.exec(masked.slice(closeIdx + 1, closeIdx + 40));
      if (!arrow) return -1;
      const bodyAt = closeIdx + 1 + arrow[0].length;
      return masked[bodyAt] === '{' ? lineAt(stripped, blockEndIdx(bodyAt + 1)) : lineAt(stripped, masked.indexOf(';', bodyAt) === -1 ? bodyAt : masked.indexOf(';', bodyAt));
    };
    for (const obj of exportedObjects) {
      const o = obj.replace(/[$.]/g, '\\$&');
      for (const m of masked.matchAll(new RegExp('^' + o + '\\.([\\w$]+)\\s*=\\s*(async\\s+)?function\\b\\s*([\\w$]*)\\s*\\(', 'gm'))) {
        const startLn = lineAt(stripped, m.index);
        const { params, closeIdx } = paramsFrom(m.index + m[0].length - 1);
        sigs.push(`${obj}.${m[1]} = ${m[2] ? 'async ' : ''}function ${m[3]}(${normalizeParams(params)})`);
        anchors.push([startLn, fnEndLine(closeIdx + 1, startLn)]);
      }
      for (const m of masked.matchAll(new RegExp('^' + o + '\\.([\\w$]+)\\s*=\\s*(async\\s+)?\\(', 'gm'))) {
        const { params, closeIdx } = paramsFrom(m.index + m[0].length - 1);
        const startLn = lineAt(stripped, m.index);
        const endLn = closeIdx === -1 ? -1 : arrowEndLine(closeIdx, startLn);
        if (endLn === -1) continue; // a parenthesised expression, not an arrow
        sigs.push(`${obj}.${m[1]} = ${m[2] ? 'async ' : ''}(${normalizeParams(params)}) =>`);
        anchors.push([startLn, endLn]);
      }
    }

    // Top-level named functions (non-exported)
    for (const m of stripped.matchAll(/^(?:async\s+)?function\s+([\w$]+)\s*\(/gm)) {
      const asyncKw = m[0].startsWith('async') ? 'async ' : '';
      const retStr = formatReturnHint(returnHints.get(m[1]));
      const startLn = lineAt(stripped, m.index);
      const { params, closeIdx } = paramsFrom(m.index + m[0].length - 1);
      sigs.push(`${asyncKw}function ${m[1]}(${normalizeParams(params)})${retStr}`);
      docHintFor[sigs.length - 1] = docHints.get(m[1]);
      anchors.push([startLn, fnEndLine(closeIdx + 1, startLn)]);
    }

    // The shapes read since #996 follow the ones always read, so the 200-entry cap can never push an old entry out.
    const ordered = lateLast(sigs, anchors, docHintFor);
    const withAnchors = ordered.sigs.map((s, i) => {
      const anchored = ordered.anchors[i] ? withAnchor(s, ordered.anchors[i][0], ordered.anchors[i][1]) : s;
      return ordered.docHints[i] ? `${anchored}  # ${ordered.docHints[i]}` : anchored;
    });
    return capWithNotice(withAnchors, 200, 'signatures');
  }

  function extractBlock(src, startIndex) {
    let depth = 1;
    let i = startIndex;
    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (src[i] === '{') depth++;
      else if (src[i] === '}') depth--;
      i++;
    }
    return src.slice(startIndex, i - 1);
  }

  const _CTRL_KEYWORDS = new Set(['if', 'for', 'while', 'switch', 'do', 'try', 'catch', 'finally', 'else', 'return']);

  // Returns members as { text, start, end } where start/end are char offsets
  // WITHIN `block` (end = the method's closing brace), so the caller can resolve
  // per-method line anchors that span the method body. `maskedBlock` is the
  // same-offset maskCode slice used for balanced-delimiter scanning.
  function extractClassMembers(block, maskedBlock, returnHints) {
    const members = [];
    for (const m of maskedBlock.matchAll(/^\s+(?:static\s+|async\s+|get\s+|set\s+)*(\w+)\s*\(/gm)) {
      if (/^_/.test(m[1])) continue;
      if (_CTRL_KEYWORDS.has(m[1])) continue;
      const openIdx = m.index + m[0].length - 1;
      const closeIdx = readBalanced(maskedBlock, openIdx);
      if (closeIdx === -1) continue;
      const braceMatch = maskedBlock.slice(closeIdx + 1, closeIdx + 40).match(/^\s*\{/);
      if (!braceMatch) continue;
      const params = block.slice(openIdx + 1, closeIdx);
      const bodyStart = closeIdx + 1 + braceMatch[0].length; // just past the opening brace
      const end = bodyStart + extractBlock(maskedBlock, bodyStart).length;
      const start = m.index + (m[0].length - m[0].replace(/^\s+/, '').length);
      if (m[1] === 'constructor') { members.push({ text: `constructor(${normalizeParams(params)})`, start, end }); continue; }
      const isAsync = m[0].includes('async ') ? 'async ' : '';
      const isStatic = m[0].includes('static ') ? 'static ' : '';
      const retStr = formatReturnHint(returnHints.get(m[1]));
      members.push({ text: `${isStatic}${isAsync}${m[1]}(${normalizeParams(params)})${retStr}`, start, end });
    }
    return capMembersWithNotice(members, 120, 'methods');
  }

  // One linear pass over well-formed docblocks. The previous three matchAll
  // passes used `\/\*\*[\s\S]*?@returns?...[\s\S]*?\*\/` — lazy gaps free to
  // scan ACROSS comment boundaries, so every docblock without a matching
  // declaration tail walked toward end-of-file: O(n²) on docblock-dense files,
  // measured at 93.6% of a full 15s self-generate (#615). The docblock-bounded
  // shape below is the one buildDocHints already uses, which profiles at ~0%.
  const RETURN_TAG = /@returns?\s+\{([^}]+)\}/;
  const RETURN_DECLS = [
    /\s*(?:export\s+(?:default\s+)?)?(?:async\s+)?function\s+(\w+)\s*\(/y,
    /\s*export\s+const\s+(\w+)\s*=\s*(?:async\s+)?\(/y,
    /\s*(?:static\s+|async\s+|get\s+|set\s+)*(\w+)\s*\(/y,
  ];

  function buildReturnHints(src) {
    const hints = new Map();
    for (const block of src.matchAll(/\/\*\*(?:[^*]|\*(?!\/))*\*\//g)) {
      const tag = RETURN_TAG.exec(block[0]);
      if (!tag) continue;
      const end = block.index + block[0].length;
      for (const decl of RETURN_DECLS) {
        decl.lastIndex = end;
        const m = decl.exec(src);
        if (m) hints.set(m[1], normalizeType(tag[1]));
      }
    }
    return hints;
  }

  // First prose sentence of the JSDoc block immediately preceding a top-level
  // function (same three shapes as buildReturnHints). Mirrors the Python
  // extractor's extractDocHint: first sentence only, 60-char cap.
  function buildDocHints(src) {
    const hints = new Map();
    // Body may not contain `*/` — otherwise a failed adjacency check would let
    // the match expand across a whole function to the next comment block and
    // misattribute the hint.
    const patterns = [
      /\/\*\*((?:[^*]|\*(?!\/))*)\*\/\s*(?:export\s+(?:default\s+)?)?(?:async\s+)?function\s+(\w+)\s*\(/g,
      /\/\*\*((?:[^*]|\*(?!\/))*)\*\/\s*export\s+const\s+(\w+)\s*=\s*(?:async\s+)?\(/g,
    ];
    for (const re of patterns) {
      for (const m of src.matchAll(re)) {
        const hint = firstDocSentence(m[1]);
        if (hint && !hints.has(m[2])) hints.set(m[2], hint);
      }
    }
    return hints;
  }

  // First non-tag prose line of a JSDoc body → first sentence, 60-char cap.
  function firstDocSentence(body) {
    const line = String(body).split('\n')
      .map((l) => l.replace(/^\s*\*\s?/, '').trim())
      .find((l) => l && !l.startsWith('@'));
    if (!line) return '';
    return line.split(/[.!?]/)[0].trim().slice(0, 60);
  }

  function normalizeType(type) {
    if (!type) return '';
    return type.trim().replace(/\s+/g, ' ').slice(0, 25);
  }

  function formatReturnHint(type) {
    return type ? ` → ${type}` : '';
  }

  function normalizeParams(params) {
    if (!params) return '';
    return params.trim().replace(/\s+/g, ' ');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/kotlin ──
__factories["./src/extractors/kotlin"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');

  // Ceilings sit above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed
  // — an undisclosed cap looks like a class that simply has eight methods (#576).
  // Class bodies are scanned to this many characters. Real classes routinely
  // run past the old 4KB scan window — truncating there silently hid every
  // member after ~4000 chars AND anchored class end-lines short (#576). The
  // ceiling only guards against pathological input (Java parity, #551).
  const MAX_CLASS_BODY_CHARS = 200000;
  const MEMBER_LIMIT = 120;
  const PER_FILE_LIMIT = 200;

  // Chars scanned past the params for a `: ReturnType` before giving up.
  const RET_SCAN_CHARS = 400;

  /** Type/class keywords that terminate a header walk — see `bodyBraceFor`. */
  const DECL_KEYWORDS = /\b(?:class|object|interface|fun|val|var)\b/;

  /**
   * Extract signatures from Kotlin source code.
   *
   * Migrated onto the shared balanced scanner (G4, #695). Two defects came from
   * doing this with regex alone:
   *
   *   1. `\(([^)]*)\)` stopped at the FIRST `)`, so a nested call in a default —
   *      `fun f(a: Int = g(1, 2))` — captured `a: Int = g(1` and the old
   *      comma-splitting `normalizeParams` then rendered `fun f(a, 2)`: a
   *      plausible-looking signature with an invented parameter. A consumer
   *      could not tell it was damaged.
   *   2. `(?:[^{]*)\{` on the class header matched NEWLINES, so a body-less
   *      `data class A(...)` walked past the blank line into the next
   *      declaration and adopted ITS body — reporting A with B's members while
   *      B vanished (#738). Misattribution, not truncation: every symbol was
   *      real, just bolted to the wrong owner.
   *
   * Both are now structural walks over a masked surface, so delimiters inside
   * strings and comments cannot open or close anything.
   *
   * Signatures carry `:start-end` line anchors (Surgical Context); both scan
   * surfaces are length- and newline-preserving so anchors match the original.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // stripComments is string-aware; maskCode additionally blanks string
    // contents so every delimiter seen on it is structural. Both preserve
    // length and newlines, so offsets align across both surfaces.
    const stripped = stripComments(src);
    const masked = maskCode(src);

    /**
     * Index of the body `{` belonging to the declaration starting at `from`, or
     * -1 when it has no body.
     *
     * Walks the header: balanced constructor parens and generic/annotation
     * groups are jumped whole; a newline is allowed (Kotlin wraps supertype
     * lists) but another declaration keyword or a blank line means the
     * declaration ended without a body — which is what stopped `data class A`
     * from swallowing the next class (#738).
     */
    const bodyBraceFor = (from) => {
      let i = from;
      const end = Math.min(masked.length, from + RET_SCAN_CHARS);
      while (i < end) {
        const ch = masked[i];
        if (ch === '{') return i;
        if (ch === '(') { const c = readBalanced(masked, i); if (c < 0) return -1; i = c + 1; continue; }
        if (ch === '<') { const c = readBalanced(masked, i, '<', '>'); if (c < 0) { i++; continue; } i = c + 1; continue; }
        if (ch === '[') { const c = readBalanced(masked, i, '[', ']'); if (c < 0) return -1; i = c + 1; continue; }
        if (ch === '\n') {
          // A blank line, or a new declaration on the next line, ends the header.
          const nl = masked.indexOf('\n', i + 1);
          const nextLine = masked.slice(i + 1, nl < 0 ? end : nl);
          if (!nextLine.trim()) return -1;
          if (DECL_KEYWORDS.test(nextLine) && !nextLine.trimStart().startsWith(':')) return -1;
          i++;
          continue;
        }
        if (ch === '=' || ch === ';') return -1; // expression body / bare decl
        i++;
      }
      return -1;
    };

    /** Closing `}` index for a block opened at `bodyOpen`, depth on the mask. */
    const blockEndIdx = (bodyOpen) => bodyOpen + 1 + extractBlock(stripped, masked, bodyOpen + 1).length;

    // ── Classes, objects, interfaces ──────────────────────────────────────────
    // The header is walked rather than regex-spanned, so a body-less declaration
    // is reported on its own line instead of borrowing the next one's body.
    for (const m of stripped.matchAll(
      /^[ \t]*(?:public\s+|internal\s+|private\s+)?(?:data\s+|sealed\s+|abstract\s+|open\s+|enum\s+|annotation\s+|value\s+)*(class|object|interface)\s+(\w+)/gm)) {
      const declIdx = m.index + (m[0].length - m[0].trimStart().length);
      const bodyOpen = bodyBraceFor(m.index + m[0].length);
      if (bodyOpen < 0) {
        // No body: a one-line `data class User(val id: String)` still names a
        // real type, so it is reported — anchored to its own single line.
        const line = lineAt(stripped, declIdx);
        sigs.push(withAnchor(`${m[1]} ${m[2]}`, line, line));
        continue;
      }
      const bodyStart = bodyOpen + 1;
      const block = extractBlock(stripped, masked, bodyStart);
      sigs.push(withAnchor(`${m[1]} ${m[2]}`, lineAt(stripped, declIdx), lineAt(stripped, bodyStart + block.length)));
      // Members of a NESTED type belong to that type, not to this one.
      const scoped = blankNestedTypeBodies(block, masked.slice(bodyStart, bodyStart + block.length),
        /^[ \t]+(?:(?:public|internal|private|protected)\s+)?(?:(?:data|sealed|abstract|open|enum|annotation|value|inner|companion)\s+)*(?:class|object|interface)\s+\w+/gm);
      for (const meth of extractMembers(scoped.block, scoped.masked)) {
        sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
      }
    }

    // ── Top-level functions ───────────────────────────────────────────────────
    for (const fn of scanFunctions(stripped, masked, /^(?:public\s+|internal\s+)?(?:suspend\s+)?fun\b/gm)) {
      const bodyOpen = bodyBraceFor(fn.afterRet);
      const end = bodyOpen >= 0 ? blockEndIdx(bodyOpen) : fn.afterRet;
      sigs.push(withAnchor(fn.text, lineAt(stripped, fn.declIdx), lineAt(stripped, end)));
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /**
   * Walk every `fun` matched by `headRe`, resolving its parameter list with a
   * balanced read instead of a first-`)` capture.
   * @returns {Array<{text:string, declIdx:number, endIdx:number, afterRet:number}>}
   */
  function scanFunctions(stripped, masked, headRe) {
    const out = [];
    const ws = (i) => { while (masked[i] === ' ' || masked[i] === '\t') i++; return i; };
    for (const m of stripped.matchAll(headRe)) {
      const head = m[0];
      const declIdx = m.index + (head.length - head.trimStart().length);
      const suspend = /\bsuspend\b/.test(head) ? 'suspend ' : '';
      let i = ws(m.index + head.length);

      const nameM = /^[A-Za-z_]\w*/.exec(stripped.slice(i, i + 200));
      if (!nameM) continue;
      const name = nameM[0];
      if (name.startsWith('_')) continue;
      i = ws(i + name.length);

      // Generic parameters, e.g. `fun <T> map(...)` handled by the head regex's
      // caller; a receiver-side `<T>` here is jumped whole.
      if (masked[i] === '<') {
        const c = readBalanced(masked, i, '<', '>');
        if (c >= 0) i = ws(c + 1);
      }
      if (masked[i] !== '(') continue;
      const close = readBalanced(masked, i);
      if (close < 0) continue;
      const params = stripped.slice(i + 1, close);

      // `: ReturnType` — read to the body `{`, the expression `=`, or EOL,
      // jumping balanced groups so `(Int) -> Int` survives intact.
      let j = close + 1;
      let ret = '';
      const scanEnd = Math.min(masked.length, close + RET_SCAN_CHARS);
      let k = ws(j);
      if (masked[k] === ':') {
        k++;
        const start = k;
        while (k < scanEnd) {
          const ch = masked[k];
          if (ch === '(') { const c = readBalanced(masked, k); if (c < 0) break; k = c + 1; continue; }
          if (ch === '<') { const c = readBalanced(masked, k, '<', '>'); if (c < 0) { k++; continue; } k = c + 1; continue; }
          if (ch === '{' || ch === '=' || ch === '\n') break;
          k++;
        }
        ret = stripped.slice(start, k).trim().replace(/\s+/g, ' ');
        j = k;
      }
      const retStr = ret ? ` → ${ret.slice(0, 25)}` : '';
      out.push({
        text: `${suspend}fun ${name}(${normalizeParams(params)})${retStr}`,
        declIdx,
        endIdx: j,
        afterRet: j,
      });
    }
    return out;
  }

  // Depth-counted on the MASKED surface (a brace inside a string can no longer
  // open or close a block); content sliced from the stripped surface.
  /**
   * Blank the bodies of NESTED type declarations inside a block, so their members
   * are not also attributed to the enclosing type.
   *
   * Before the scanner migration a nested `trait`/`interface` was never found at
   * all, so this could not arise. Finding them correctly exposed it: a method in
   * `object O { trait T { def inner… } }` was emitted once under O and once under
   * T. Blanking is length- and newline-preserving, so member offsets and line
   * anchors computed on the result still align with the original block.
   * @param {string} block        stripped block text
   * @param {string} maskedBlock  masked block text (same length)
   * @param {RegExp} typeRe       nested-type header matcher (global, multiline)
   * @returns {{ block: string, masked: string }}
   */
  function blankNestedTypeBodies(block, maskedBlock, typeRe) {
    const b = block.split('');
    const mb = maskedBlock.split('');
    const blank = (from, to) => {
      for (let k = from; k < to && k < b.length; k++) {
        if (b[k] !== '\n') b[k] = ' ';
        if (mb[k] !== '\n') mb[k] = ' ';
      }
    };
    for (const m of block.matchAll(typeRe)) {
      // Walk the nested header to its body brace, jumping balanced groups.
      let i = m.index + m[0].length;
      const stop = Math.min(maskedBlock.length, i + RET_SCAN_CHARS);
      let open = -1;
      while (i < stop) {
        const ch = maskedBlock[i];
        if (ch === '{') { open = i; break; }
        if (ch === '(') { const c = readBalanced(maskedBlock, i); if (c < 0) break; i = c + 1; continue; }
        if (ch === '[') { const c = readBalanced(maskedBlock, i, '[', ']'); if (c < 0) break; i = c + 1; continue; }
        if (ch === '\n') {
          const nl = maskedBlock.indexOf('\n', i + 1);
          if (!maskedBlock.slice(i + 1, nl < 0 ? stop : nl).trim()) break;
          i++; continue;
        }
        if (ch === '=' || ch === ';') break;
        i++;
      }
      if (open < 0) continue;
      const close = readBalanced(maskedBlock, open, '{', '}');
      blank(open, close < 0 ? maskedBlock.length : close + 1);
    }
    return { block: b.join(''), masked: mb.join('') };
  }

  function extractBlock(stripped, masked, startIndex) {
    let depth = 1, i = startIndex;
    const end = Math.min(masked.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (masked[i] === '{') depth++;
      else if (masked[i] === '}') depth--;
      i++;
    }
    return stripped.slice(startIndex, i - 1);
  }

  function extractMembers(block, maskedBlock) {
    const members = [];
    const fns = scanFunctions(block, maskedBlock,
      /^[ \t]+(?:public\s+|internal\s+|override\s+|protected\s+)?(?:suspend\s+)?fun\b/gm);
    for (const fn of fns) members.push({ text: fn.text, declIdx: fn.declIdx, endIdx: fn.endIdx });
    return capMembersWithNotice(members, MEMBER_LIMIT);
  }

  /**
   * Parameter NAMES only, with `: Type` and `= default` dropped.
   *
   * Depth- and string-aware: the old implementation split on every `,` and took
   * `split(':')[0]`, so `a: Int = g(1, 2)` became the two params `a` and `2`.
   * Nested delimiters are consumed with their annotation instead (#695).
   * @param {string} params raw text between the balanced parens
   * @returns {string} `a, b` style list
   */
  function normalizeParams(params) {
    if (!params || !params.trim()) return '';
    const names = [];
    let depth = 0;
    let quote = null;
    let seg = '';
    const flush = () => {
      // Name is everything before the first top-level `:` or `=`, minus
      // modifiers Kotlin allows there (`vararg`, `crossinline`, …) which the
      // previous rendering kept, so they are kept here too.
      const name = seg.split(/[:=]/)[0].trim().replace(/\s+/g, ' ');
      if (name) names.push(name);
      seg = '';
    };
    for (let i = 0; i < params.length; i++) {
      const ch = params[i];
      if (quote) {
        if (ch === '\\') { i++; continue; }
        if (ch === quote) quote = null;
        continue;
      }
      if (ch === '"' || ch === "'") { quote = ch; continue; }
      if (ch === '(' || ch === '[' || ch === '<' || ch === '{') { depth++; continue; }
      if (ch === ')' || ch === ']' || ch === '}') { depth--; continue; }
      // `->` is a function-type arrow, not a generic close (`Map<String, Int>` is).
      if (ch === '>') { if (params[i - 1] !== '-') depth--; else seg += depth === 0 ? ch : ''; continue; }
      if (ch === ',' && depth === 0) { flush(); continue; }
      if (depth === 0) seg += ch;
    }
    flush();
    return names.join(', ');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/line-anchor ──
__factories["./src/extractors/line-anchor"] = function(module, exports) {
  
  /**
   * Line-anchor helpers for Surgical Context (v6.11.0).
   *
   * Signatures carry their source location as a `:start-end` suffix so an agent
   * can read the exact lines instead of re-opening the whole file. The anchor is
   * a plain string suffix, which keeps the existing `string[]` signature contract
   * intact — ranker, adapters, and CLAUDE.md render it for free.
   */

  /**
   * 1-based line number of character index `idx` within `src`.
   * Counts newlines in the prefix, so it stays correct as long as the source
   * being indexed preserves every newline (see the newline-preserving comment
   * strips in the extractors).
   *
   * @param {string} src
   * @param {number} idx
   * @returns {number}
   */
  function lineAt(src, idx) {
    let line = 1;
    const end = Math.min(idx, src.length);
    for (let i = 0; i < end; i++) {
      if (src.charCodeAt(i) === 10) line++;
    }
    return line;
  }

  /**
   * Render an anchor suffix: `  :start-end`.
   * @param {number} start
   * @param {number} end
   * @returns {string}
   */
  function anchor(start, end) {
    return `  :${start}-${end}`;
  }

  /**
   * Append a line anchor to a signature string.
   * @param {string} sig
   * @param {number} start
   * @param {number} end
   * @returns {string}
   */
  function withAnchor(sig, start, end) {
    return `${sig}${anchor(start, end)}`;
  }

  module.exports = { lineAt, anchor, withAnchor };
  
};

// ── ./src/extractors/lsp_symbols ──
__factories["./src/extractors/lsp_symbols"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');
  const crypto = require('crypto');
  const { documentSymbols } = __require('./src/lsp/client');
  const { anchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');

  // LSP documentSymbol → signature lines (#612, tier T3 of #542). One client,
  // every LSP language: symbols come back language-neutral (SymbolKind + name
  // + a server-rendered `detail` type string + exact ranges), so the mapping
  // below is server-agnostic. Only clangd is measured; the gopls and
  // rust-analyzer rows ship designed-but-unmeasured, and any server that is
  // absent, crashes, or answers nothing falls back to the regex tier silently.
  //
  // A session costs a process spawn (~300ms with clangd), so results are
  // cached across runs in .context/lsp-cache.json keyed by content hash +
  // server command + the server binary's size/mtime — cheap to compute with
  // no extra spawn, and invalidated by either a file edit or a server upgrade.

  const MEMBER_LIMIT = 120;
  const PER_FILE_LIMIT = 200;

  // Built-in extension → server command. `exactness.lspServers` in config lays
  // entries over this (command arrays, spawned directly — never a shell).
  const DEFAULT_SERVERS = {
    '.c': ['clangd'], '.cc': ['clangd'], '.cpp': ['clangd'], '.cxx': ['clangd'],
    '.h': ['clangd'], '.hpp': ['clangd'], '.hh': ['clangd'],
    '.go': ['gopls'],
    '.rs': ['rust-analyzer'],
  };

  const LANGUAGE_IDS = {
    '.c': 'c', '.cc': 'cpp', '.cpp': 'cpp', '.cxx': 'cpp',
    '.h': 'cpp', '.hpp': 'cpp', '.hh': 'cpp',
    '.go': 'go', '.rs': 'rust',
  };

  // LSP SymbolKind — containers get their own top-level line; leaf kinds
  // inside a container render as indented members.
  const KIND_WORDS = {
    2: 'module', 3: 'namespace', 5: 'class', 10: 'enum', 11: 'interface', 23: 'struct',
  };
  const CONTAINER_KINDS = new Set(Object.keys(KIND_WORDS).map(Number));
  const LEAF_KINDS = new Set([6, 7, 8, 9, 12, 13, 14]); // method, property, field, ctor, function, variable, constant

  // Per-run state: failed server commands are not retried (a repo with the
  // flag on but no server pays one fast ENOENT, not one per file), and the
  // cache file is loaded once and written through on miss.
  const _deadServers = new Set();
  const _serverStat = new Map(); // cmd key → binary stat fragment | null
  let _cache = null;
  let _cachePath = null;
  const _labels = new Set();

  function _resolveBinaryStat(cmd0) {
    if (_serverStat.has(cmd0)) return _serverStat.get(cmd0);
    let out = null;
    const candidates = path.isAbsolute(cmd0)
      ? [cmd0]
      : String(process.env.PATH || '').split(path.delimiter).map((d) => path.join(d, cmd0));
    for (const c of candidates) {
      try {
        const st = fs.statSync(c);
        if (st.isFile()) { out = `${st.size}:${Math.round(st.mtimeMs)}`; break; }
      } catch (_) {}
    }
    _serverStat.set(cmd0, out);
    return out;
  }

  function _loadCache(cwd) {
    if (_cache && _cachePath === path.join(cwd, '.context', 'lsp-cache.json')) return _cache;
    _cachePath = path.join(cwd, '.context', 'lsp-cache.json');
    try {
      const parsed = JSON.parse(fs.readFileSync(_cachePath, 'utf8'));
      _cache = (parsed && parsed.schema === 1) ? parsed : { schema: 1, servers: {}, entries: {} };
    } catch (_) {
      _cache = { schema: 1, servers: {}, entries: {} };
    }
    return _cache;
  }

  function _saveCache() {
    if (!_cache || !_cachePath) return;
    try {
      fs.mkdirSync(path.dirname(_cachePath), { recursive: true });
      const tmp = _cachePath + '.tmp';
      fs.writeFileSync(tmp, JSON.stringify(_cache));
      fs.renameSync(tmp, _cachePath);
    } catch (_) {}
  }

  function _compact(s) {
    return String(s || '').replace(/\s+/g, ' ').trim().slice(0, 60);
  }

  /** Flatten hierarchical symbols into the two-level signature vocabulary. */
  function _render(symbols) {
    const sigs = [];
    const walk = (nodes) => {
      for (const s of nodes || []) {
        const startLn = s.range.start.line + 1;
        const endLn = s.range.end.line + 1;
        if (CONTAINER_KINDS.has(s.kind)) {
          sigs.push(`${KIND_WORDS[s.kind]} ${s.name}${anchor(startLn, endLn)}`);
          const members = [];
          const nested = [];
          for (const c of s.children || []) {
            if (CONTAINER_KINDS.has(c.kind)) { nested.push(c); continue; }
            if (!LEAF_KINDS.has(c.kind)) continue;
            const detail = _compact(c.detail);
            members.push({
              text: `${c.name}${detail ? ': ' + detail : ''}`,
              s: c.range.start.line + 1,
              e: c.range.end.line + 1,
            });
          }
          for (const mem of capMembersWithNotice(members, MEMBER_LIMIT)) {
            sigs.push(mem.s ? `  ${mem.text}${anchor(mem.s, mem.e)}` : `  ${mem.text}`);
          }
          walk(nested);
        } else if (LEAF_KINDS.has(s.kind)) {
          const detail = _compact(s.detail);
          sigs.push(`${s.name}${detail ? ': ' + detail : ''}${anchor(startLn, endLn)}`);
        }
      }
    };
    walk(symbols);
    return sigs;
  }

  /**
   * Extract signatures for a file via its registered language server.
   * Returns null on any failure so the caller falls back to the regex tier.
   * @param {string} filePath - absolute path
   * @param {string} src - file content
   * @param {object} [serverOverrides] - `exactness.lspServers` (ext → cmd array)
   * @param {string} [cwd] - project root; enables the cross-run cache
   * @returns {{ sigs: string[], label: string|null }|null}
   */
  function extractViaLsp(filePath, src, serverOverrides, cwd) {
    if (!src || typeof src !== 'string') return null;
    const ext = path.extname(filePath).toLowerCase();
    const cmd = (serverOverrides && serverOverrides[ext]) || DEFAULT_SERVERS[ext];
    if (!Array.isArray(cmd) || cmd.length === 0) return null;
    const cmdKey = cmd.join(' ');
    if (_deadServers.has(cmdKey)) return null;

    const binStat = _resolveBinaryStat(cmd[0]);
    const cache = cwd ? _loadCache(cwd) : null;
    const key = binStat
      ? `${crypto.createHash('sha1').update(src).digest('hex')}|${cmdKey}|${binStat}`
      : null;
    if (cache && key && Array.isArray(cache.entries[key])) {
      return { sigs: cache.entries[key], label: cache.servers[cmdKey] || null };
    }

    const languageId = LANGUAGE_IDS[ext] || 'plaintext';
    const out = documentSymbols(cmd, filePath, src, languageId);
    if (!out || out.missing || !out.symbols) {
      if (out && out.missing) _deadServers.add(cmdKey);
      return null;
    }

    const sigs = capWithNotice(_render(out.symbols), PER_FILE_LIMIT, 'signatures');
    if (sigs.length === 0) return null;

    const label = `${out.serverName || path.basename(cmd[0])}@${out.serverVersion || 'unknown'}`;
    if (cache && key) {
      cache.entries[key] = sigs;
      cache.servers[cmdKey] = label;
      _saveCache();
    }
    return { sigs, label };
  }

  /** Register a label once the caller has ACCEPTED the LSP result — a result
   * rejected by the quality guard must not put its server in the header. */
  function acceptLabel(label) {
    if (label) _labels.add(label);
  }

  /** Toolchain labels for servers whose results were actually used this run. */
  function toolchainLabels() {
    return [..._labels].sort();
  }

  module.exports = { extractViaLsp, acceptLabel, toolchainLabels, DEFAULT_SERVERS };
  
};

// ── ./src/extractors/lua ──
__factories["./src/extractors/lua"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling discloses what it drops rather than truncating silently (#583).
  // Collection runs to completion so the marker reports the true overflow —
  // stopping early made r.js report "+1 more" where 50 were hidden (#584).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from Lua source code.
   *
   * Recognised constructs:
   *   - Global functions: `function name(args)`
   *   - Module-table functions: `function M.name(args)` / `function M:name(args)`
   *   - Local functions: `local function name(args)`
   *   - Assigned functions: `name = function(args)` / `M.name = function(args)`
   *   - Module imports: `local mod = require("mod")` as compact hints
   *   - LDoc-style doc comments (`---`) as first-sentence hints
   *
   * The extractor is regex-only and zero-dependency, matching SigMap's Tier-3
   * language extractor style.
   *
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];
    const hints = collectDocHints(src);
    const stripped = stripLuaComments(src);
    const seen = new Set();

    // local foo = require('bar.baz') — useful module-surface hint, capped low.
    for (const m of stripped.matchAll(/^\s*(?:local\s+)?([A-Za-z_]\w*)\s*=\s*require\s*\(\s*['"]([A-Za-z0-9_.\/-]+)['"]\s*\)/gm)) {
      pushUnique(sigs, seen, `require ${m[2]} as ${m[1]}`);
    }

    // local function name(args)
    for (const m of stripped.matchAll(/^\s*local\s+function\s+([A-Za-z_]\w*)\s*\(([^)]*)\)/gm)) {
      if (m[1].startsWith('_')) continue;
      pushUnique(sigs, seen, `local function ${m[1]}(${normalizeParams(m[2])})${applyHint(hints, m[1])}`);
    }

    // function name(args), function M.name(args), function M:name(args)
    for (const m of stripped.matchAll(/^\s*function\s+([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*\(([^)]*)\)/gm)) {
      const name = m[1];
      if (name.startsWith('_')) continue;
      pushUnique(sigs, seen, `function ${name}(${normalizeParams(m[2])})${applyHint(hints, name)}`);
    }

    // name = function(args), M.name = function(args), M:name = function(args)
    for (const m of stripped.matchAll(/^\s*(?:local\s+)?([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*=\s*function\s*\(([^)]*)\)/gm)) {
      const name = m[1];
      if (name.startsWith('_')) continue;
      pushUnique(sigs, seen, `${name} = function(${normalizeParams(m[2])})${applyHint(hints, name)}`);
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  function pushUnique(out, seen, sig) {
    if (!sig || seen.has(sig)) return;
    seen.add(sig);
    out.push(sig);
  }

  function normalizeParams(params) {
    return String(params || '')
      .replace(/--.*$/gm, '')
      .split(',')
      .map((p) => p.trim().replace(/\s+/g, ' '))
      .filter(Boolean)
      .join(', ');
  }

  function applyHint(hints, name) {
    const h = hints.get(name);
    return h ? `  # ${h}` : '';
  }

  /**
   * Attach each contiguous `---` doc block to the next function-like declaration
   * by its extracted symbol name.
   */
  function collectDocHints(src) {
    const hints = new Map();
    const lines = src.split('\n');
    let block = [];
    for (const line of lines) {
      const doc = line.match(/^\s*---\s?(.*)$/);
      if (doc) {
        block.push(doc[1]);
      } else if (block.length > 0) {
        const decl = line.match(/^\s*local\s+function\s+([A-Za-z_]\w*)\s*\(/)
                  || line.match(/^\s*function\s+([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*\(/)
                  || line.match(/^\s*(?:local\s+)?([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*=\s*function\s*\(/);
        if (decl) {
          const hint = firstDocSentence(block);
          if (hint) hints.set(decl[1], hint);
        }
        block = [];
      }
    }
    return hints;
  }

  function firstDocSentence(block) {
    for (const raw of block) {
      const line = String(raw || '').trim();
      if (!line || line.startsWith('@')) continue;
      return line.replace(/\s+/g, ' ').slice(0, 60).replace(/[.,;:!?]+$/, '').trim();
    }
    return '';
  }

  /** Strip Lua line and long comments while preserving strings enough for regex scans. */
  function stripLuaComments(src) {
    const out = src.split('');
    const blank = (a, b) => { for (let i = a; i < b; i++) if (out[i] !== '\n') out[i] = ' '; };
    let i = 0;
    while (i < src.length) {
      const ch = src[i];
      if (ch === '"' || ch === "'") {
        const quote = ch;
        i++;
        while (i < src.length) {
          if (src[i] === '\\') { i += 2; continue; }
          if (src[i] === quote) { i++; break; }
          if (src[i] === '\n') break;
          i++;
        }
        continue;
      }
      if (src.startsWith('--[[', i)) {
        const end = src.indexOf(']]', i + 4);
        blank(i, end === -1 ? src.length : end + 2);
        i = end === -1 ? src.length : end + 2;
        continue;
      }
      if (src.startsWith('--', i)) {
        const end = src.indexOf('\n', i + 2);
        blank(i, end === -1 ? src.length : end);
        i = end === -1 ? src.length : end;
        continue;
      }
      i++;
    }
    return out.join('');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/markdown ──
__factories["./src/extractors/markdown"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling discloses what it drops rather than truncating silently (#583).
  const PER_FILE_LIMIT = 200;

  /**
   * Lightweight markdown technical indexer.
   * Captures headings and fenced code block language hints only.
   *
   * @param {string} src - Raw markdown content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Headings: # .. ######
    for (const m of src.matchAll(/^(#{1,6})\s+(.+)$/gm)) {
      const level = m[1].length;
      const title = m[2].trim().replace(/\s+/g, ' ');
      if (title) sigs.push(`h${level} ${title}`);
    }

    // Fenced code blocks: ```lang
    for (const m of src.matchAll(/^```\s*([A-Za-z0-9_+-]*)\s*$/gm)) {
      const lang = m[1] ? m[1].toLowerCase() : 'plain';
      sigs.push(`code-fence ${lang}`);
    }

    return capWithNotice(Array.from(new Set(sigs)), PER_FILE_LIMIT, 'headings');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/objc ──
__factories["./src/extractors/objc"] = function(module, exports) {
  
  /**
   * Objective-C / Objective-C++ Tier 2 Extractor (anchored regex)
   *
   * Extensions: .m, .mm (and .h when sniffed by cpp.js).
   * Target tier: 2 (anchored).
   *
   * Extracts:
   *   - @interface Foo : NSObject (with category / extension support)
   *   - @implementation Foo (and category implementation)
   *   - @protocol Fooing
   *   - Instance (-) and class (+) methods with balanced selector & argument types
   *   - @property declarations with attributes
   *   - C functions and static inline functions
   *   - typedef NS_ENUM, NS_OPTIONS, and typedef struct
   *   - C++ class / struct definitions in ObjC++ (.mm)
   *
   * Non-extraction:
   *   - Method bodies, ivar blocks (@private/@protected), #import, @synthesize.
   *
   * MATLAB fallback:
   *   - If no ObjC markers are detected, delegates to generic extractor.
   */

  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');

  const MEMBER_LIMIT = 120;
  const PER_FILE_LIMIT = 200;
  // Method bodies are matched to this many characters. readBalanced's default
  // 4KB window is a parameter-list ceiling; a real method body runs past it, and
  // an unmatched body anchored the method to its first line (cpp parity, #576).
  const MAX_BODY_CHARS = 200000;

  // Suffix annotations to strip from method declarations
  const METHOD_ATTR_RE = /\b(?:NS_SWIFT_NAME|NS_SWIFT_ASYNC_NAME|NS_DESIGNATED_INITIALIZER|NS_UNAVAILABLE|__attribute__\s*\(\([^)]*\)\)|API_AVAILABLE|API_DEPRECATED|API_UNAVAILABLE)\b(?:\s*\([^)]*\))?/g;

  /**
   * Extract signatures from Objective-C / Objective-C++ source.
   * @param {string} src - Raw file content
   * @param {string} [filePath] - Optional file path
   * @returns {string[]} Array of signature strings
   */
  function extract(src, filePath) {
    if (!src || typeof src !== 'string') return [];
    if (!src.trim()) return [];

    const stripped = stripComments(src);
    const masked = maskCode(src);
    const top = topLevelSurface(masked);

    // Check whether file has any Objective-C markers.
    // If not, delegate to generic extractor so MATLAB .m files are preserved.
    if (!hasObjCMarkers(stripped)) {
      try {
        return __require('./src/extractors/generic').extract(src);
      } catch (_) {
        return [];
      }
    }

    const sigs = [];

    // 1. Scan @interface, @protocol, @implementation blocks
    // The optional `<...>` after the name is a lightweight-generics parameter
    // list (`@interface Box<ObjectType> : NSObject`) or a protocol list.
    const containerRe = /^[ \t]*@(interface|protocol|implementation)\s+([A-Za-z0-9_]+)(?:[ \t]*<[^>\n]*>)?(?:[ \t]*\(([A-Za-z0-9_]*)\))?(?:[ \t]*:[ \t]*([A-Za-z0-9_]+))?(?:[ \t]*<[^>]*>)?/gm;

    for (const m of stripped.matchAll(containerRe)) {
      const declIdx = m.index + (m[0].length - m[0].trimStart().length);
      const kind = m[1];
      const name = m[2];
      const category = m[3];
      const superclass = m[4];

      // A forward declaration (`@protocol FooDelegate;`, `@protocol A, B;`) opens
      // no block. Read as a container it ran to the NEXT container's `@end` and
      // re-emitted that container's members under the wrong name.
      if (/^[ \t]*[;,]/.test(masked.slice(m.index + m[0].length, m.index + m[0].length + 40))) continue;

      // Find closing @end on masked surface
      const endMatch = findAtEnd(masked, declIdx + m[0].length);
      if (!endMatch) continue;

      const blockStart = declIdx + m[0].length;
      const blockEnd = endMatch.index;
      const endLine = lineAt(stripped, blockEnd);
      const startLine = lineAt(stripped, declIdx);

      // Build container signature
      let header = `@${kind} ${name}`;
      if (category !== undefined) {
        header += ` (${category})`;
      } else if (superclass) {
        header += ` : ${superclass}`;
      }

      sigs.push(withAnchor(header, startLine, endLine));

      // Extract members inside this container
      const blockStripped = stripped.slice(blockStart, blockEnd);
      const blockMasked = masked.slice(blockStart, blockEnd);
      const blockTop = top.slice(blockStart, blockEnd);
      const members = extractMembers(blockStripped, blockMasked, blockTop, stripped, blockStart, kind === 'implementation');

      for (const mem of members) {
        sigs.push(mem);
      }
    }

    // 2. Scan typedef NS_ENUM / NS_OPTIONS / typedef struct
    extractEnumsAndStructs(stripped, masked, sigs);

    // 3. Scan top-level C functions / static inline definitions
    extractCFunctions(stripped, masked, top, sigs);

    // 4. In ObjC++ (.mm, and a header cpp.js delegated here), scan C++ classes / structs
    if (filePath && /\.(?:mm|h|hh|hpp)$/i.test(filePath)) {
      extractCppClasses(stripped, masked, sigs);
    }

    if (sigs.length === 0) {
      try {
        return __require('./src/extractors/generic').extract(src);
      } catch (_) {
        return [];
      }
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /**
   * Fast detection of Objective-C markers in source text.
   */
  function hasObjCMarkers(stripped) {
    return /@(interface|implementation|protocol|property|synthesize|dynamic|end)\b|#import\b|NS_ENUM\b|NS_OPTIONS\b/.test(stripped);
  }

  /**
   * Locate matching `@end` keyword on masked surface.
   */
  function findAtEnd(masked, startIdx) {
    const atEndRe = /^[ \t]*@end\b/gm;
    atEndRe.lastIndex = startIdx;
    const m = atEndRe.exec(masked);
    if (!m) return null;
    return { index: m.index };
  }

  /**
   * Blank the interior of every `{...}` block, keeping the outermost braces —
   * what remains is the declaration surface. A method or C function can only
   * START at brace depth 0, so scanning this instead of the raw text is what
   * stops `x = a - b;` or `return CGRectMake(...)` inside a body from reading as
   * a method or a function prototype. Length- and newline-preserving.
   *
   * Depth has to survive real code, where braces do not always pair up textually:
   *   - `#if` / `#else` branches are alternatives, each opening its own `if (...) {`
   *     for one shared `}`. Every branch restarts from the depth at the `#if`.
   *   - `#define` bodies are skipped — a macro may hold half a block.
   *   - `extern "C" {` and `namespace x {` only group declarations: transparent.
   *   - Depth resets at a container keyword and at a method head in column 0.
   *     Neither can occur inside a block, so whatever imbalance is left costs one
   *     method its end line rather than every member after it.
   * @param {string} masked - output of maskCode
   * @returns {string}
   */
  function topLevelSurface(masked) {
    const out = masked.split('');
    const n = masked.length;
    const branchDepth = [];
    let depth = 0;
    let lineHead = true;
    for (let i = 0; i < n; i++) {
      const ch = masked[i];
      if (ch === '\n') { lineHead = true; continue; }
      if (ch === ' ' || ch === '\t') continue;

      if (lineHead) {
        lineHead = false;
        if (ch === '#') {
          const dir = /^#[ \t]*(if|ifdef|ifndef|elif|else|endif)\b/.exec(masked.slice(i, i + 16));
          if (dir) {
            if (dir[1] === 'endif') branchDepth.pop();
            else if (dir[1] === 'else' || dir[1] === 'elif') {
              if (branchDepth.length) depth = branchDepth[branchDepth.length - 1];
            } else branchDepth.push(depth);
          }
          // Blank the directive's logical line, continuations included: a macro
          // body is not a declaration, whatever depth it sits at.
          for (; i < n; i++) {
            if (masked[i] === '\n') {
              if (masked[i - 1] !== '\\') break;
            } else out[i] = ' ';
          }
          lineHead = true;
          continue;
        }
        if (ch === '@' && /^@(?:end\b|(?:interface|implementation|protocol)\s+\w)/.test(masked.slice(i, i + 20))) depth = 0;
        else if ((ch === '-' || ch === '+') && (i === 0 || masked[i - 1] === '\n') && /^[-+][ \t]*\(/.test(masked.slice(i, i + 8))) depth = 0;
      }

      if (ch === '{') {
        if (depth === 0 && /\b(?:extern|namespace(?:[ \t]+[\w:]+)?)\s*$/.test(masked.slice(Math.max(0, i - 80), i))) continue;
        if (depth > 0) out[i] = ' ';
        depth++;
      } else if (ch === '}') {
        if (depth > 0) depth--;
        if (depth > 0) out[i] = ' ';
      } else if (depth > 0) {
        out[i] = ' ';
      }
    }
    return out.join('');
  }

  /**
   * Extract members inside an @interface, @protocol, or @implementation block.
   * A member starts at the head of a line on the top-level surface, so an ivar
   * block and the bodies of methods and C helpers are never scanned for members.
   */
  function extractMembers(blockStripped, blockMasked, blockTop, fullStripped, offset, isImpl) {
    const members = [];
    const heads = [];
    for (const m of blockTop.matchAll(/^[ \t]*([-+]|@property\b)/gm)) {
      heads.push({ idx: m.index + m[0].length - m[1].length, isProp: m[1] === '@property' });
    }
    let resumeAt = 0;

    for (let h = 0; h < heads.length; h++) {
      const i = heads[h].idx;
      if (i < resumeAt) continue;

      const result = heads[h].isProp
        ? parseProperty(blockStripped, blockMasked, i)
        : parseMethod(blockStripped, blockMasked, i, isImpl, blockTop);
      if (!result) continue;

      // Every head is at depth 0, so a body that reaches the next one was closed
      // by a brace that is not its own — keep the start line, drop the bad end.
      const next = h + 1 < heads.length ? heads[h + 1].idx : Infinity;
      const endIdx = result.endIdx < next ? result.endIdx : result.bodyIdx;

      const startL = lineAt(fullStripped, offset + i);
      const endL = lineAt(fullStripped, offset + endIdx);
      members.push(withAnchor(`  ${result.sig}`, startL, endL));
      resumeAt = endIdx + 1;
    }

    return capWithNotice(members, MEMBER_LIMIT, 'methods');
  }

  /**
   * Parse an `@property (...) Type name;` declaration.
   */
  function parseProperty(stripped, masked, startIdx) {
    let i = startIdx + '@property'.length;
    const n = stripped.length;

    while (i < n && /[ \t]/.test(stripped[i])) i++;
    if (i >= n) return null;

    let attrs = '';
    if (stripped[i] === '(') {
      const closeParen = readBalanced(masked, i, '(', ')');
      if (closeParen < 0) return null;
      attrs = stripped.slice(i, closeParen + 1).replace(/\s+/g, ' ');
      i = closeParen + 1;
    }

    // Find terminating `;`
    let semi = i;
    while (semi < n && stripped[semi] !== ';' && stripped[semi] !== '\n' && stripped[semi] !== '@') {
      semi++;
    }
    if (semi >= n || stripped[semi] !== ';') return null;

    let rest = stripped.slice(i, semi).replace(METHOD_ATTR_RE, '').trim().replace(/\s+/g, ' ');
    if (!rest) return null;

    const sig = attrs ? `@property ${attrs} ${rest}` : `@property ${rest}`;
    return { sig, endIdx: semi };
  }

  /**
   * Parse a class (+) or instance (-) method.
   */
  function parseMethod(stripped, masked, startIdx, isImpl, top) {
    const kind = stripped[startIdx]; // '-' or '+'
    let i = startIdx + 1;
    const n = stripped.length;

    while (i < n && /[ \t\n]/.test(stripped[i])) i++;
    if (i >= n) return null;

    let returnType = '';
    if (stripped[i] === '(') {
      const closeParen = readBalanced(masked, i, '(', ')');
      if (closeParen < 0) return null;
      returnType = stripped.slice(i, closeParen + 1).replace(/\s+/g, ' ');
      i = closeParen + 1;
    }

    while (i < n && /[ \t\n]/.test(stripped[i])) i++;
    if (i >= n) return null;

    // Read first identifier
    let identStart = i;
    while (i < n && /[A-Za-z0-9_]/.test(stripped[i])) i++;
    const firstIdent = stripped.slice(identStart, i);
    if (!firstIdent) return null;

    while (i < n && /[ \t]/.test(stripped[i])) i++;

    let selectorParts = [];

    if (i < n && stripped[i] === ':') {
      // Method WITH arguments
      i++; // consume ':'
      while (i < n && /[ \t\n]/.test(stripped[i])) i++;

      let argType = '';
      if (i < n && stripped[i] === '(') {
        const closeParen = readBalanced(masked, i, '(', ')');
        if (closeParen < 0) return null;
        argType = stripped.slice(i, closeParen + 1).replace(/\s+/g, ' ');
        i = closeParen + 1;
      }

      while (i < n && /[ \t\n]/.test(stripped[i])) i++;

      let argNameStart = i;
      while (i < n && /[A-Za-z0-9_]/.test(stripped[i])) i++;
      const argName = stripped.slice(argNameStart, i);

      selectorParts.push(`${firstIdent}:${argType}${argName}`);

      // Read subsequent arguments if any
      while (i < n) {
        while (i < n && /[ \t\n]/.test(stripped[i])) i++;
        if (i >= n || stripped[i] === ';' || stripped[i] === '{' || stripped[i] === '@') break;

        let nextIdentStart = i;
        while (i < n && /[A-Za-z0-9_]/.test(stripped[i])) i++;
        const nextIdent = stripped.slice(nextIdentStart, i);
        if (!nextIdent) break;

        while (i < n && /[ \t]/.test(stripped[i])) i++;
        if (i >= n || stripped[i] !== ':') {
          // Not followed by ':', so it's a trailing attribute / macro
          break;
        }

        i++; // consume ':'
        while (i < n && /[ \t\n]/.test(stripped[i])) i++;

        let nextArgType = '';
        if (i < n && stripped[i] === '(') {
          const closeParen = readBalanced(masked, i, '(', ')');
          if (closeParen < 0) return null;
          nextArgType = stripped.slice(i, closeParen + 1).replace(/\s+/g, ' ');
          i = closeParen + 1;
        }

        while (i < n && /[ \t\n]/.test(stripped[i])) i++;

        let nextArgNameStart = i;
        while (i < n && /[A-Za-z0-9_]/.test(stripped[i])) i++;
        const nextArgName = stripped.slice(nextArgNameStart, i);

        selectorParts.push(`${nextIdent}:${nextArgType}${nextArgName}`);
      }
    } else {
      // 0-argument method
      selectorParts.push(firstIdent);
    }

    // Find termination: `;` for declaration or `{ ... }` for definition
    let endIdx = -1;
    let bodyIdx = -1;
    while (i < n && stripped[i] !== ';' && stripped[i] !== '{' && stripped[i] !== '@') {
      if (stripped[i] === '(') {
        const close = readBalanced(masked, i, '(', ')');
        if (close > 0) { i = close + 1; continue; }
      }
      i++;
    }

    if (i >= n || stripped[i] === '@') return null;

    // A definition may legally carry a `;` before its body: `- (void)run;\n{ ... }`.
    if (isImpl && stripped[i] === ';') {
      let k = i + 1;
      while (k < n && /\s/.test(masked[k])) k++;
      if (masked[k] === '{') i = k;
    }

    if (stripped[i] === ';') {
      endIdx = i;
    } else if (stripped[i] === '{') {
      // On the top-level surface the body interior is blank, so the next `}` is
      // this body's own — with no scan ceiling, and correct across `#if` branches.
      const closeBrace = top ? top.indexOf('}', i + 1) : readBalanced(masked, i, '{', '}', MAX_BODY_CHARS);
      bodyIdx = i;
      endIdx = closeBrace > 0 ? closeBrace : i;
    } else {
      return null;
    }

    const selectorStr = selectorParts.join(' ').trim();
    if (!selectorStr) return null;

    const sig = returnType ? `${kind} ${returnType}${selectorStr}` : `${kind} ${selectorStr}`;
    return { sig, endIdx, bodyIdx: bodyIdx < 0 ? endIdx : bodyIdx };
  }

  /**
   * Extract typedef NS_ENUM, NS_OPTIONS, and typedef struct.
   */
  function extractEnumsAndStructs(stripped, masked, sigs) {
    const enumRe = /^[ \t]*typedef[ \t]+(NS_ENUM|NS_OPTIONS)[ \t]*\([ \t]*([A-Za-z0-9_]+)[ \t]*,[ \t]*([A-Za-z0-9_]+)[ \t]*\)[ \t]*\{/gm;
    for (const m of stripped.matchAll(enumRe)) {
      const declIdx = m.index + (m[0].length - m[0].trimStart().length);
      const macro = m[1];
      const type = m[2];
      const name = m[3];
      const openBrace = m.index + m[0].length - 1;
      const closeBrace = readBalanced(masked, openBrace, '{', '}');
      const endLine = closeBrace > 0 ? lineAt(stripped, closeBrace) : lineAt(stripped, declIdx);
      const startLine = lineAt(stripped, declIdx);

      sigs.push(withAnchor(`typedef ${macro}(${type}, ${name})`, startLine, endLine));
    }

    const structRe = /^[ \t]*typedef[ \t]+struct[ \t]+([A-Za-z0-9_]+)?\s*\{/gm;
    for (const m of stripped.matchAll(structRe)) {
      const declIdx = m.index + (m[0].length - m[0].trimStart().length);
      const openBrace = m.index + m[0].length - 1;
      const closeBrace = readBalanced(masked, openBrace, '{', '}');
      if (closeBrace < 0) continue;

      // Scan after `}` for name
      let after = closeBrace + 1;
      while (after < stripped.length && /[ \t\n]/.test(stripped[after])) after++;
      const nameMatch = stripped.slice(after, after + 100).match(/^([A-Za-z0-9_]+)\s*;/);
      const structName = nameMatch ? nameMatch[1] : (m[1] || 'struct');
      const startLine = lineAt(stripped, declIdx);
      const endLine = lineAt(stripped, closeBrace);

      sigs.push(withAnchor(`typedef struct ${structName}`, startLine, endLine));
    }
  }

  /**
   * Extract top-level C functions and static inline functions. Matched on the
   * top-level surface: inside a body, `return CGRectMake(0, 0, w, h);` has the
   * same `type name(...);` shape as a prototype.
   */
  function extractCFunctions(stripped, masked, top, sigs) {
    const funcRe = /^[ \t]*(static[ \t]+inline[ \t]+|static[ \t]+|extern[ \t]+)?([A-Za-z0-9_]+(?:[ \t]+[A-Za-z0-9_]+)*[ \t*&]+)\s*([A-Za-z0-9_]+)[ \t]*\(/gm;

    for (const m of top.matchAll(funcRe)) {
      const declIdx = m.index + (m[0].length - m[0].trimStart().length);
      const modifier = m[1] || '';
      const rawType = m[2].trim();
      const name = m[3];

      // Filter out ObjC keywords, typedefs, or control flow
      if (name.startsWith('_') || /^(if|for|while|switch|return|sizeof|typedef|class|struct|case|NS_ENUM|NS_OPTIONS)$/.test(name)) continue;
      if (rawType.startsWith('typedef') || /^@(interface|implementation|protocol)/.test(rawType)) continue;

      const openParen = m.index + m[0].length - 1;
      const closeParen = readBalanced(masked, openParen, '(', ')');
      if (closeParen < 0) continue;

      // Must be followed by a function body `{` or `;`
      let k = closeParen + 1;
      while (k < masked.length && /[ \t\n]/.test(masked[k])) k++;
      if (k >= masked.length) continue;

      let returnPrefix = modifier ? `${modifier}${rawType}` : rawType;
      returnPrefix = returnPrefix.replace(/\s+/g, ' ').trim();
      if (!returnPrefix.endsWith('*') && !returnPrefix.endsWith('&')) {
        returnPrefix += ' ';
      }

      if (masked[k] === '{') {
        const closeBrace = top.indexOf('}', k + 1);
        const startLine = lineAt(stripped, declIdx);
        const endLine = closeBrace > 0 ? lineAt(stripped, closeBrace) : startLine;
        const params = stripped.slice(openParen + 1, closeParen).trim().replace(/\s+/g, ' ');
        sigs.push(withAnchor(`${returnPrefix}${name}(${params})`, startLine, endLine));
      } else if (masked[k] === ';') {
        const startLine = lineAt(stripped, declIdx);
        const endLine = lineAt(stripped, k);
        const params = stripped.slice(openParen + 1, closeParen).trim().replace(/\s+/g, ' ');
        sigs.push(withAnchor(`${returnPrefix}${name}(${params})`, startLine, endLine));
      }
    }
  }

  /**
   * Extract C++ classes and structs in ObjC++ (.mm files).
   */
  function extractCppClasses(stripped, masked, sigs) {
    const cppClassRe = /^[ \t]*(?:template\s*<[^>]*>\s*)?(class|struct)\s+([A-Za-z0-9_]+)(?:\s*:\s*[^{]+)?\s*\{/gm;
    for (const m of stripped.matchAll(cppClassRe)) {
      const declIdx = m.index + (m[0].length - m[0].trimStart().length);
      const kind = m[1];
      const name = m[2];
      const openBrace = m.index + m[0].length - 1;
      const closeBrace = readBalanced(masked, openBrace, '{', '}');
      const startLine = lineAt(stripped, declIdx);
      const endLine = closeBrace > 0 ? lineAt(stripped, closeBrace) : startLine;

      sigs.push(withAnchor(`${kind} ${name}`, startLine, endLine));
    }
  }

  module.exports = {
    extract,
    hasObjCMarkers,
    topLevelSurface,
    parseMethod,
    parseProperty,
    MEMBER_LIMIT,
    PER_FILE_LIMIT,
  };
  
};

// ── ./src/extractors/patterns ──
__factories["./src/extractors/patterns"] = function(module, exports) {
  
  /**
   * Phase D: Cross-module pattern inference and architectural detection.
   * Identifies DI patterns, service/repo layers, circular deps, type linkage, and unsafe patterns.
   *
   * @param {string} src - Raw source code
   * @returns {string[]} Array of pattern signatures
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // ────────────────────────────────────────────────────────────────
    // Dependency Injection Pattern Detection
    // ────────────────────────────────────────────────────────────────

    // Service container / factory patterns
    const containerRe = /(?:class|function|const)\s+([A-Z]\w*(?:Container|Factory|Registry|Provider|Injector))\b/g;
    for (const m of src.matchAll(containerRe)) {
      sigs.push(`di-container ${m[1]}`);
    }

    // Service decorators: @Injectable, @Service, @Singleton, @Provide
    const decoratorRe = /@(?:Injectable|Service|Singleton|Provide|Module|Component)\s*(?:\([^)]*\))?\s*(?:class|export\s+class|const\s+)\s+([A-Z]\w*)/g;
    for (const m of src.matchAll(decoratorRe)) {
      sigs.push(`service-decorated ${m[1]}`);
    }

    // Dependency injection via constructor: constructor(private readonly ...: Service)
    const ctorDiRe = /constructor\s*\([^)]*(?:private|protected)?\s+(?:readonly\s+)?([a-z_]\w*)\s*:\s*([A-Z]\w*)/g;
    const diServices = new Set();
    for (const m of src.matchAll(ctorDiRe)) {
      diServices.add(m[1]);
    }
    if (diServices.size > 0) {
      sigs.push(`di-injection ${diServices.size} params`);
    }

    // ────────────────────────────────────────────────────────────────
    // Service/Repository/Middleware Layer Detection
    // ────────────────────────────────────────────────────────────────

    // Repository pattern: extends Repository, implements IRepository
    const repoRe = /class\s+([A-Z]\w*(?:Repository|Repo|DataAccess))\b/g;
    for (const m of src.matchAll(repoRe)) {
      sigs.push(`repo ${m[1]}`);
    }

    // Service layer: @Service or ServiceImpl pattern
    const serviceRe = /(?:export\s+)?class\s+([A-Z]\w*Service\b)/g;
    for (const m of src.matchAll(serviceRe)) {
      sigs.push(`service ${m[1]}`);
    }

    // Middleware detection: app.use(), router.use(), middleware function
    if (/app\.use\s*\(|router\.use\s*\(|\.use\s*\(\s*function|middleware|app\.get\s*\(\s*['"`]\/[^'"`]*['"`]/.test(src)) {
      sigs.push('middleware-present');
    }

    // ────────────────────────────────────────────────────────────────
    // Type Linkage: Exported types → Implementations
    // ────────────────────────────────────────────────────────────────

    // Export type/interface followed by class implementing it
    const exportTypeRe = /export\s+(?:type|interface)\s+([A-Z]\w*)/g;
    const exportedTypes = new Set();
    for (const m of src.matchAll(exportTypeRe)) {
      exportedTypes.add(m[1]);
    }

    // Check if exported types have implementations
    for (const type of exportedTypes) {
      const implRe = new RegExp(`class\\s+([A-Z]\\w*)\\s+(?:extends|implements)\\s+(?:.*\\s+)?${type}\\b`, 'i');
      if (implRe.test(src)) {
        sigs.push(`type-impl ${type}`);
      }
    }

    // ────────────────────────────────────────────────────────────────
    // Unsafe Pattern Detection
    // ────────────────────────────────────────────────────────────────

    // Unchecked nulls / optional without validation
    if (/\?\s*{|Optional\s*<|\?\s*\.get\(\)|\?\s*\[|\?\s*\.length|\.split\(\)\.filter\(Boolean\)|if\s*\(\s*!.*\).*throw/.test(src)) {
      sigs.push('unsafe-null-check');
    }

    // Missing validation (direct use of user input)
    const userInputRe = /(?:request|input|params|body|query|args)\s*\[\s*['"][^'"]*['"]\s*\]|req(?:uest)?\..*\s*==|params\.split|String\(.*\)\.toLowerCase/;
    if (userInputRe.test(src)) {
      sigs.push('unsafe-input-validation');
    }

    // Weak error handling (catch {} or empty catch)
    if (/catch\s*\(\s*\)\s*\{|\}\s*catch\s*\{(\s*\/\/|\s*\})/.test(src)) {
      sigs.push('weak-error-handling');
    }

    // Direct error exposure
    if (/throw\s+new\s+Error\(|console\s*\.\s*error|res\.status\(500\)\.send\(err\)/.test(src)) {
      sigs.push('unsafe-error-exposure');
    }

    // ────────────────────────────────────────────────────────────────
    // Circular Dependency Hints
    // ────────────────────────────────────────────────────────────────

    // Mutual imports detected (A imports B, B imports A) — can't directly detect in single file,
    // but we can flag suspicious patterns
    const importRe = /(?:import|require)\s+(?:{[^}]*}|[a-zA-Z_]\w*)\s+from\s+['"]\.?\.?\/[^'"]+['"]/g;
    const importCount = (src.match(importRe) || []).length;
    if (importCount > 5) {
      sigs.push(`heavy-imports ${importCount}`);
    }

    // ────────────────────────────────────────────────────────────────
    // Layer/Module Organization Hints
    // ────────────────────────────────────────────────────────────────

    // Controller/Handler layer
    const controllerRe = /(?:class|export)\s+([A-Z]\w*(?:Controller|Handler|Route))\b/g;
    for (const m of src.matchAll(controllerRe)) {
      sigs.push(`controller ${m[1]}`);
    }

    // Use case / Domain logic
    if (/UseCase|Command|Query|UseCase\b|Interactor/.test(src)) {
      sigs.push('domain-usecase');
    }

    return Array.from(new Set(sigs)).slice(0, 60);
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/php ──
__factories["./src/extractors/php"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');

  // Ceilings sit above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed
  // — an undisclosed cap looks like a class that simply has eight methods (#576).
  // Class bodies are scanned to this many characters. Real classes routinely
  // run past the old 4KB scan window — truncating there silently hid every
  // member after ~4000 chars AND anchored class end-lines short (#576). The
  // ceiling only guards against pathological input (Java parity, #551).
  const MAX_CLASS_BODY_CHARS = 200000;
  const MEMBER_LIMIT = 120;
  const PER_FILE_LIMIT = 200;

  // Chars scanned past the params before giving up on a return type.
  const RET_SCAN_CHARS = 400;

  /**
   * Extract signatures from PHP source code.
   * Signatures carry `:start-end` line anchors (Surgical Context); the comment
   * strips below are newline-preserving so anchor lines match the original file.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // stripComments is length- AND newline-preserving; the previous regex strip
    // DELETED comment text, so offsets no longer aligned with the masked surface
    // the balanced reader walks (#695). The `#` line-comment form PHP also
    // accepts is blanked separately, preserving length.
    const stripped = blankHashComments(stripComments(src));
    const masked = blankHashComments(maskCode(src));

    // Anchor range: scan past same-line trivia to a body `{` (range) else single line.
    const rangeFor = (declIdx, afterIdx) => {
      let k = afterIdx;
      while (k < stripped.length && /[ \tA-Za-z0-9_:?\\]/.test(stripped[k])) k++;
      if (stripped[k] === '{' || (stripped[k] === '\n' && stripped[k + 1] === '{')) {
        const open = stripped[k] === '{' ? k : k + 1;
        const end = open + 1 + extractBlock(stripped, open + 1).length;
        return [lineAt(stripped, declIdx), lineAt(stripped, end)];
      }
      const line = lineAt(stripped, declIdx);
      return [line, line];
    };

    // Classes and interfaces
    const typeRe = /^(?:abstract\s+)?(?:class|interface|trait)\s+(\w+)(?:\s+extends\s+\w+)?(?:\s+implements\s+[\w, ]+)?\s*\{/gm;
    for (const m of stripped.matchAll(typeRe)) {
      const kind = m[0].trimStart().startsWith('interface') ? 'interface' :
        m[0].trimStart().startsWith('trait') ? 'trait' : 'class';
      const bodyStart = m.index + m[0].length;
      const block = extractBlock(stripped, bodyStart);
      sigs.push(withAnchor(`${kind} ${m[1]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)));
      for (const meth of extractMembers(block, masked.slice(bodyStart, bodyStart + block.length))) {
        // The disclosure marker carries no offsets; anchor it at the class body.
        sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
      }
    }

    // Top-level functions
    // `(?:<\?php\s+)?` lets a declaration share its line with the opening tag —
    // `<?php function f($a) {…}` previously yielded NOTHING at all (#696).
    for (const m of stripped.matchAll(/^(?:<\?php\s+|<\?=\s+)?function\s+(\w+)\s*\(/gm)) {
      const pr = readParams(stripped, masked, m.index + m[0].length - 1);
      if (!pr) continue;
      const rm = /^\s*:\s*([^\n{]+)/.exec(pr.after);
      const ret = normalizeType(rm ? rm[1] : '');
      const retStr = ret ? ` → ${ret}` : '';
      const declIdx = m.index + (m[0].startsWith('<?') ? m[0].length - m[0].replace(/^<\?(?:php|=)\s+/, '').length : 0);
      const [s, e] = rangeFor(declIdx, pr.end);
      sigs.push(withAnchor(`function ${m[1]}(${normalizeParams(pr.params)})${retStr}`, s, e));
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /** Blank `#` line comments, preserving length and newlines. */
  function blankHashComments(src) {
    return src.replace(/#[^\n]*/g, (m) => ' '.repeat(m.length));
  }

  /**
   * Resolve a declaration's parameter list with a BALANCED read (#695).
   *
   * `\(([^)]*)\)` stopped at the first `)`, so `function f($a = g(1, 2), $b)`
   * truncated to `function f($a = g(1, 2)` and a `)` inside a string default cut
   * the scan mid-literal.
   */
  function readParams(stripped, masked, openIdx) {
    const close = readBalanced(masked, openIdx);
    if (close < 0) return null;
    let i = close + 1;
    const stop = Math.min(masked.length, i + RET_SCAN_CHARS);
    while (i < stop) {
      const ch = masked[i];
      if (ch === '{' || ch === ';' || ch === '\n') break;
      i++;
    }
    return { params: stripped.slice(openIdx + 1, close), after: stripped.slice(close + 1, i), end: i, close };
  }

  function extractBlock(src, startIndex) {
    let depth = 1, i = startIndex;
    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (src[i] === '{') depth++;
      else if (src[i] === '}') depth--;
      i++;
    }
    return src.slice(startIndex, i - 1);
  }

  function extractMembers(block, maskedBlock) {
    const members = [];
    const methodRe = /^[ \t]+(?:public|protected)\s+(?:static\s+)?function\s+(\w+)\s*\(/gm;
    for (const m of block.matchAll(methodRe)) {
      if (m[1].startsWith('_')) continue;
      const pr = readParams(block, maskedBlock, m.index + m[0].length - 1);
      if (!pr) continue;
      const isStatic = m[0].includes('static ') ? 'static ' : '';
      const rm = /^\s*:\s*([^\n{]+)/.exec(pr.after);
      const ret = normalizeType(rm ? rm[1] : '');
      const retStr = ret ? ` → ${ret}` : '';
      members.push({
        text: `${isStatic}function ${m[1]}(${normalizeParams(pr.params)})${retStr}`,
        declIdx: m.index + (m[0].length - m[0].trimStart().length),
        endIdx: pr.close + 1,
      });
    }
    return capMembersWithNotice(members, MEMBER_LIMIT);
  }

  function normalizeParams(params) {
    if (!params) return '';
    return params.trim().replace(/\s+/g, ' ');
  }

  function normalizeType(type) {
    if (!type) return '';
    return type.trim().replace(/[;\s]+$/g, '').replace(/\s+/g, ' ').slice(0, 25);
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/pipeline ──
__factories["./src/extractors/pipeline"] = function(module, exports) {
  
  /**
   * CI / pipeline extractor (#3, v8.50).
   *
   * WHY THIS EXISTS
   * ---------------
   * `yaml.js` is a GENERIC key scanner. On a GitHub Actions workflow it emitted
   * four lines — `keys: [name, on, jobs]` plus one `job: <id>` per job — with no
   * triggers, no runner, no steps, no `needs`, no secrets, and no line anchors.
   * That answers none of the questions an agent actually asks of a pipeline file:
   * "what runs on a PR", "where does deploy happen", "which secrets does release
   * need", "why did publish not fire".
   *
   * This module parses the same files STRUCTURALLY and emits semantic signatures
   * with real `:start-end` anchors, so `sigmap lines` can jump straight to a job.
   *
   * Zero-dependency by constraint: no YAML library. `scanYaml` is a small
   * indentation-aware line scanner — enough for the shallow, regular shapes CI
   * formats use, and it degrades to fewer signatures rather than wrong ones.
   * Pure and deterministic: same bytes in, same bytes out, no clock, no I/O.
   */

  const path = require('path');
  const { capWithNotice } = __require('./src/util/truncate');

  const PER_FILE_LIMIT = 200;
  const MAX_STEPS_PER_JOB = 12;
  const MAX_VALUE_CHARS = 90;

  // ---------------------------------------------------------------------------
  // Platform routing
  // ---------------------------------------------------------------------------

  /**
   * Resolve a CI platform key from a file path, or null when the file is not a
   * pipeline definition. Path-based and case-insensitive on the basename.
   * @param {string} filePath
   * @returns {string|null}
   */
  function platformFor(filePath) {
    const p = String(filePath || '').replace(/\\/g, '/');
    const base = path.posix.basename(p);
    const lower = base.toLowerCase();

    // Forge workflow directories: GitHub, Gitea, Forgejo all use the same schema.
    if (/(^|\/)\.(github|gitea|forgejo)\/workflows\/[^/]+\.ya?ml$/i.test(p)) return 'github';
    if (lower === 'action.yml' || lower === 'action.yaml') return 'action';
    if (/^\.?gitlab-ci\.ya?ml$/i.test(lower) || /\.gitlab-ci\.ya?ml$/i.test(lower)) return 'gitlab';
    if (/(^|\/)\.circleci\/config\.ya?ml$/i.test(p)) return 'circleci';
    if (/^\.?azure-pipelines[\w.-]*\.ya?ml$/i.test(lower)) return 'azure';
    if (lower === 'bitbucket-pipelines.yml' || lower === 'bitbucket-pipelines.yaml') return 'bitbucket';
    if (/^\.(drone|woodpecker)\.ya?ml$/i.test(lower)) return 'drone';
    if (/(^|\/)\.woodpecker\/[^/]+\.ya?ml$/i.test(p)) return 'drone';
    if (lower === 'jenkinsfile' || lower.startsWith('jenkinsfile.') || lower.endsWith('.jenkinsfile')) return 'jenkins';
    if (/^(docker-)?compose[\w.-]*\.ya?ml$/i.test(lower)) return 'compose';
    return null;
  }

  /**
   * Content sniff for workflow files sitting outside their conventional path.
   * Deliberately narrow — it must never claim a plain config file.
   * @param {string} src
   * @returns {string|null}
   */
  function sniffPlatform(src) {
    const s = String(src || '');
    if (/^on\s*:/m.test(s) && /^jobs\s*:/m.test(s)) return 'github';
    if (/^pipelines\s*:/m.test(s) && /^\s+-?\s*step\s*:/m.test(s)) return 'bitbucket';
    if (/^services\s*:/m.test(s) && /^\s{2,}\w[\w.-]*\s*:\s*$/m.test(s) && /\b(image|build)\s*:/.test(s)) return 'compose';
    return null;
  }

  // ---------------------------------------------------------------------------
  // Minimal YAML structure scanner
  // ---------------------------------------------------------------------------

  /** Strip an unquoted trailing `# comment` from a line. */
  function stripInlineComment(line) {
    let quote = null;
    for (let i = 0; i < line.length; i++) {
      const c = line[i];
      if (quote) {
        if (c === quote) quote = null;
        continue;
      }
      if (c === '"' || c === "'") { quote = c; continue; }
      // A comment needs whitespace before `#`, so `a#b` and `#{}` stay intact.
      if (c === '#' && (i === 0 || /\s/.test(line[i - 1]))) return line.slice(0, i).trimEnd();
    }
    return line;
  }

  function unquote(v) {
    const s = String(v == null ? '' : v).trim();
    if (s.length >= 2 && ((s[0] === '"' && s[s.length - 1] === '"') || (s[0] === "'" && s[s.length - 1] === "'"))) {
      return s.slice(1, -1);
    }
    return s;
  }

  function compact(v, limit = MAX_VALUE_CHARS) {
    const s = unquote(v).replace(/\s+/g, ' ').trim();
    return s.length > limit ? s.slice(0, limit - 1) + '…' : s;
  }

  /** Parse a `[a, b, c]` flow sequence, else null. */
  function flowList(v) {
    const s = unquote(v);
    if (!/^\[.*\]$/.test(s)) return null;
    return s.slice(1, -1).split(',').map((x) => unquote(x)).filter(Boolean);
  }

  const KV_RE = /^("[^"]*"|'[^']*'|[^:]+?)\s*:(?:\s+([\s\S]*))?$/;

  /**
   * Scan YAML into a flat node list. Each node is one `key:` occurrence with its
   * indentation, 1-based line number, and whether it opened a sequence item.
   *
   * Block scalars (`|`, `>`) are skipped wholesale so shell bodies never parse as
   * structure — the single most common source of bogus signatures.
   *
   * @param {string} src
   * @returns {Array<{indent:number,key:string,value:string,line:number,item:boolean}>}
   */
  function scanYaml(src) {
    const lines = String(src).split('\n');
    const nodes = [];
    let blockIndent = -1;
    let blockTarget = null;

    for (let i = 0; i < lines.length; i++) {
      const raw = lines[i].replace(/\t/g, '  ');
      if (!raw.trim()) continue;
      const indent = raw.length - raw.replace(/^\s*/, '').length;

      if (blockIndent >= 0) {
        if (indent > blockIndent) {
          if (blockTarget) blockTarget.block.push(raw.trim());
          continue;
        }
        blockIndent = -1;
        blockTarget = null;
      }

      let content = raw.trim();
      if (content.startsWith('#')) continue;
      content = stripInlineComment(content);
      if (!content) continue;

      let item = false;
      let itemIndent = indent;
      // `- key: value` opens an item whose mapping sits two columns further in.
      while (content.startsWith('- ') || content === '-') {
        item = true;
        itemIndent += 2;
        content = content === '-' ? '' : content.slice(2).trim();
        if (!content) break;
      }
      if (!content) {
        nodes.push({ indent: itemIndent, key: '', value: '', line: i + 1, item });
        continue;
      }

      const m = KV_RE.exec(content);
      if (!m) {
        nodes.push({ indent: itemIndent, key: '', value: content, line: i + 1, item });
        continue;
      }

      const key = unquote(m[1]);
      const value = (m[2] || '').trim();
      nodes.push({ indent: itemIndent, key, value, line: i + 1, item });

      if (/^[|>][-+]?\d*$/.test(value)) {
        blockIndent = indent;
        blockTarget = nodes[nodes.length - 1];
        blockTarget.block = [];
      }
    }
    return nodes;
  }

  // ---------------------------------------------------------------------------
  // Node-tree helpers
  // ---------------------------------------------------------------------------

  /**
   * Exclusive end index of the block owned by nodes[i].
   *
   * A sequence item is the subtle case: `- name: x` followed by `run: y` puts
   * BOTH keys at the same indent, and the second one belongs to the item's
   * mapping. So for an item the scope runs until the next item marker at that
   * indent (or any shallower node), not until the next node at that indent.
   */
  function scopeEnd(nodes, i) {
    const n = nodes[i];
    for (let j = i + 1; j < nodes.length; j++) {
      const m = nodes[j];
      if (m.indent < n.indent) return j;
      if (m.indent === n.indent) {
        if (n.item && !m.item) continue;
        return j;
      }
    }
    return nodes.length;
  }

  /** All descendants of nodes[i], including an item's sibling mapping keys. */
  function childrenOf(nodes, i) {
    return nodes.slice(i + 1, scopeEnd(nodes, i));
  }

  /** Immediate children of nodes[i] — the shallowest descendant indent only. */
  function directChildren(nodes, i) {
    const kids = childrenOf(nodes, i);
    if (kids.length === 0) return [];
    const min = Math.min(...kids.map((k) => k.indent));
    return kids.filter((k) => k.indent === min);
  }

  /** Find a top-level (indent 0) node by key. */
  function topNode(nodes, key) {
    const i = nodes.findIndex((n) => n.indent === 0 && n.key === key);
    return i === -1 ? null : i;
  }

  /**
   * Value of an IMMEDIATE child key, or null.
   *
   * Job-level attributes (`runs-on`, `if`, `needs`, `environment`) must resolve
   * against direct children only: `childValue` walks all descendants, so a step
   * carrying `if:` would otherwise be reported as the job's condition.
   */
  function directValue(nodes, i, key) {
    const hit = directChildren(nodes, i).find((k) => k.key === key);
    return hit ? hit.value : null;
  }

  /** listValues restricted to an immediate child key. */
  function directListValues(nodes, i, key) {
    const hit = directChildren(nodes, i).find((k) => k.key === key);
    if (!hit) return [];
    if (hit.value) return flowList(hit.value) || [unquote(hit.value)];
    const out = [];
    for (const c of directChildren(nodes, nodes.indexOf(hit))) {
      const v = (c.item && !c.key) ? c.value : (c.item && c.key ? c.key : (!c.key ? c.value : ''));
      if (v) out.push(unquote(v));
    }
    return out.filter(Boolean);
  }

  /** First meaningful command inside a captured block scalar. */
  function blockText(node) {
    const body = (node && node.block) || [];
    const meaningful = body.filter((l) => l && !l.startsWith('#') && !/^set\s+[-+]/.test(l));
    if (meaningful.length === 0) return '';
    const first = compact(meaningful[0]);
    const rest = meaningful.length - 1;
    return rest > 0 ? `${first} (+${rest} line${rest === 1 ? '' : 's'})` : first;
  }

  /** Render a step/script value that may be an inline scalar or a block scalar. */
  function valueText(node) {
    if (!node) return '';
    if (/^[|>][-+]?\d*$/.test(String(node.value || '').trim())) return blockText(node);
    return compact(node.value);
  }

  /** First descendant with this key, or null. */
  function childValue(nodes, i, key) {
    const kids = childrenOf(nodes, i);
    const hit = kids.find((k) => k.key === key);
    return hit ? hit.value : null;
  }

  /**
   * Values of a key that may be a scalar, a flow list, or a block sequence.
   * @returns {string[]}
   */
  function listValues(nodes, i, key) {
    const kids = childrenOf(nodes, i);
    const at = kids.findIndex((k) => k.key === key);
    if (at === -1) return [];
    const node = kids[at];
    if (node.value) return flowList(node.value) || [unquote(node.value)];
    const out = [];
    const idx = nodes.indexOf(node);
    for (const c of directChildren(nodes, idx)) {
      if (c.item && !c.key && c.value) out.push(unquote(c.value));
      else if (c.item && c.key) out.push(unquote(c.key));
      else if (!c.key && c.value) out.push(unquote(c.value));
    }
    return out.filter(Boolean);
  }

  /** Last line covered by the block that starts at nodes[i]. */
  function spanEnd(nodes, i, lastLine) {
    const end = scopeEnd(nodes, i);
    return end < nodes.length ? Math.max(nodes[i].line, nodes[end].line - 1) : lastLine;
  }

  function anchor(start, end) {
    return `  :${start}-${Math.max(start, end)}`;
  }

  /** Secret names referenced anywhere in a line range, sorted and deduped. */
  function secretsIn(lines, start, end) {
    const text = lines.slice(start - 1, end).join('\n');
    const found = new Set();
    for (const m of text.matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/g)) found.add(m[1]);
    for (const m of text.matchAll(/\$\{\{\s*secrets\.([A-Za-z_][A-Za-z0-9_]*)/g)) found.add(m[1]);
    return [...found].sort();
  }

  // ---------------------------------------------------------------------------
  // GitHub Actions
  // ---------------------------------------------------------------------------

  /** Render the `on:` trigger block as `push[main], pull_request, schedule[cron]`. */
  function githubTriggers(nodes) {
    const i = topNode(nodes, 'on');
    if (i === null) return '';
    const node = nodes[i];
    if (node.value) {
      const list = flowList(node.value);
      return (list || [unquote(node.value)]).join(', ');
    }
    const out = [];
    for (const ev of directChildren(nodes, i)) {
      const evIdx = nodes.indexOf(ev);
      const name = ev.key || unquote(ev.value);
      if (!name) continue;
      // One filter kind renders bare (`push[main]`); several get labelled, or
      // `pull_request[main docs/**]` would read as one ambiguous list.
      const filters = [];
      for (const f of ['branches', 'tags', 'paths', 'types']) {
        const vals = listValues(nodes, evIdx, f);
        if (vals.length) filters.push({ kind: f, text: vals.slice(0, 6).join(',') });
      }
      const rendered = filters.length === 1
        ? filters[0].text
        : filters.map((f) => `${f.kind}:${f.text}`).join(' ');
      if (name === 'schedule') {
        const crons = childrenOf(nodes, evIdx).filter((c) => c.key === 'cron').map((c) => unquote(c.value));
        out.push(crons.length ? `schedule[${crons.join(', ')}]` : 'schedule');
        continue;
      }
      out.push(filters.length ? `${name}[${rendered}]` : name);
    }
    return out.join(', ');
  }

  function githubSteps(nodes, stepsIdx) {
    const out = [];
    for (const item of directChildren(nodes, stepsIdx)) {
      if (!item.item) continue;
      const idx = nodes.indexOf(item);
      const scope = [item, ...childrenOf(nodes, idx)];
      const get = (k) => {
        const hit = scope.find((s) => s.key === k);
        return hit ? hit.value : null;
      };
      const runNode = scope.find((s) => s.key === 'run');
      const uses = get('uses');
      const name = get('name');
      let text;
      const runText = runNode ? valueText(runNode) : '';
      if (runText) text = `run: ${runText}`;
      else if (uses) text = `uses: ${compact(uses)}`;
      else if (name) text = `step: ${compact(name)}`;
      else continue;
      const cond = get('if');
      if (cond) text += `  if: ${compact(cond, 50)}`;
      out.push(`  ${text}${anchor(item.line, spanEnd(nodes, idx, item.line))}`);
    }
    return capWithNotice(out, MAX_STEPS_PER_JOB, 'steps');
  }

  function githubActions(nodes, lines, fileName) {
    const sigs = [];
    const nameIdx = topNode(nodes, 'name');
    const wfName = nameIdx !== null ? unquote(nodes[nameIdx].value) || fileName : fileName;
    const triggers = githubTriggers(nodes);

    const onIdx = topNode(nodes, 'on');
    const headEnd = onIdx !== null ? spanEnd(nodes, onIdx, lines.length) : 1;
    let head = `workflow: ${wfName}`;
    if (triggers) head += `  on: ${triggers}`;

    const conc = topNode(nodes, 'concurrency');
    if (conc !== null) {
      const group = childValue(nodes, conc, 'group') || nodes[conc].value;
      if (group) head += `  concurrency: ${compact(group, 40)}`;
    }
    const perms = topNode(nodes, 'permissions');
    if (perms !== null) {
      const kids = directChildren(nodes, perms).filter((k) => k.key).map((k) => `${k.key}:${unquote(k.value)}`);
      head += `  permissions: ${kids.length ? kids.join(' ') : compact(nodes[perms].value)}`;
    }
    sigs.push(head + anchor(1, headEnd));

    const jobsIdx = topNode(nodes, 'jobs');
    if (jobsIdx === null) return sigs;

    for (const job of directChildren(nodes, jobsIdx)) {
      if (!job.key) continue;
      const idx = nodes.indexOf(job);
      const end = spanEnd(nodes, idx, lines.length);

      let line = `job: ${job.key}`;
      const runsOn = directValue(nodes, idx, 'runs-on');
      const reusable = directValue(nodes, idx, 'uses');
      if (runsOn) line += `  runs-on: ${compact(runsOn, 40)}`;
      else if (reusable) line += `  uses: ${compact(reusable)}`;

      const needs = directListValues(nodes, idx, 'needs');
      if (needs.length) line += `  needs: ${needs.join(',')}`;

      const cond = directValue(nodes, idx, 'if');
      if (cond) line += `  if: ${compact(cond, 60)}`;

      const env = directValue(nodes, idx, 'environment');
      if (env) line += `  environment: ${compact(env, 30)}`;

      // Matrix axes live under strategy.matrix; `include`/`exclude` are not axes.
      const kids = childrenOf(nodes, idx);
      const matrixNode = kids.find((k) => k.key === 'matrix');
      if (matrixNode) {
        const mIdx = nodes.indexOf(matrixNode);
        const axes = directChildren(nodes, mIdx)
          .filter((a) => a.key && a.key !== 'include' && a.key !== 'exclude')
          .map((a) => {
            const vals = flowList(a.value) || listValues(nodes, mIdx, a.key);
            return vals.length ? `${a.key}[${vals.join(',')}]` : a.key;
          });
        if (axes.length) line += `  matrix: ${axes.join(' ')}`;
      }

      const secrets = secretsIn(lines, job.line, end);
      if (secrets.length) line += `  secrets: ${secrets.join(',')}`;

      sigs.push(line + anchor(job.line, end));

      const stepsNode = kids.find((k) => k.key === 'steps');
      if (stepsNode) sigs.push(...githubSteps(nodes, nodes.indexOf(stepsNode)));
    }
    return sigs;
  }

  /** Composite / JS action definitions (`action.yml`). */
  function githubAction(nodes, lines, fileName) {
    const sigs = [];
    const nameIdx = topNode(nodes, 'name');
    const name = nameIdx !== null ? unquote(nodes[nameIdx].value) : fileName;
    const runsIdx = topNode(nodes, 'runs');
    const using = runsIdx !== null ? childValue(nodes, runsIdx, 'using') : null;
    let head = `action: ${name}`;
    if (using) head += `  using: ${compact(using, 30)}`;
    sigs.push(head + anchor(1, Math.min(lines.length, nameIdx !== null ? nodes[nameIdx].line : 1)));

    for (const section of ['inputs', 'outputs']) {
      const idx = topNode(nodes, section);
      if (idx === null) continue;
      for (const field of directChildren(nodes, idx)) {
        if (!field.key) continue;
        const fIdx = nodes.indexOf(field);
        const req = childValue(nodes, fIdx, 'required');
        const def = childValue(nodes, fIdx, 'default');
        let t = `  ${section === 'inputs' ? 'input' : 'output'}: ${field.key}`;
        if (req === 'true') t += ' (required)';
        if (def) t += `  default: ${compact(def, 30)}`;
        sigs.push(t + anchor(field.line, spanEnd(nodes, fIdx, lines.length)));
      }
    }
    return sigs;
  }

  // ---------------------------------------------------------------------------
  // GitLab CI
  // ---------------------------------------------------------------------------

  const GITLAB_RESERVED = new Set([
    'stages', 'variables', 'default', 'include', 'workflow', 'image', 'services',
    'before_script', 'after_script', 'cache', 'pages',
  ]);

  function gitlabCi(nodes, lines) {
    const sigs = [];
    const stagesIdx = topNode(nodes, 'stages');
    if (stagesIdx !== null) {
      const vals = flowList(nodes[stagesIdx].value) || listValues(nodes, stagesIdx, 'stages')
        || directChildren(nodes, stagesIdx).map((c) => unquote(c.value || c.key)).filter(Boolean);
      const list = (vals && vals.length) ? vals : directChildren(nodes, stagesIdx).map((c) => unquote(c.value || c.key)).filter(Boolean);
      if (list.length) {
        sigs.push(`pipeline: gitlab-ci  stages: ${list.join(' → ')}${anchor(nodes[stagesIdx].line, spanEnd(nodes, stagesIdx, lines.length))}`);
      }
    }

    for (let i = 0; i < nodes.length; i++) {
      const n = nodes[i];
      // Jobs are top-level mappings; `.hidden` entries are templates, still useful.
      if (n.indent !== 0 || !n.key || n.value || GITLAB_RESERVED.has(n.key)) continue;
      const end = spanEnd(nodes, i, lines.length);
      let line = n.key.startsWith('.') ? `template: ${n.key}` : `job: ${n.key}`;
      const stage = childValue(nodes, i, 'stage');
      if (stage) line += `  stage: ${compact(stage, 30)}`;
      const image = childValue(nodes, i, 'image');
      if (image) line += `  image: ${compact(image, 40)}`;
      const needs = listValues(nodes, i, 'needs');
      if (needs.length) line += `  needs: ${needs.join(',')}`;
      const when = childValue(nodes, i, 'when');
      if (when) line += `  when: ${compact(when, 20)}`;
      const ext = listValues(nodes, i, 'extends');
      if (ext.length) line += `  extends: ${ext.join(',')}`;
      const envNode = childrenOf(nodes, i).find((k) => k.key === 'environment');
      if (envNode) {
        const envName = envNode.value ? unquote(envNode.value) : childValue(nodes, nodes.indexOf(envNode), 'name');
        if (envName) line += `  environment: ${compact(envName, 30)}`;
      }
      sigs.push(line + anchor(n.line, end));

      const scriptNode = childrenOf(nodes, i).find((k) => k.key === 'script');
      if (scriptNode) {
        const sIdx = nodes.indexOf(scriptNode);
        const cmds = [];
        for (const c of directChildren(nodes, sIdx)) {
          const text = c.key && c.value ? `${c.key}: ${c.value}` : (c.value || c.key);
          if (text) cmds.push(`  run: ${compact(text)}${anchor(c.line, c.line)}`);
        }
        sigs.push(...capWithNotice(cmds, MAX_STEPS_PER_JOB, 'steps'));
      }
    }
    return sigs;
  }

  // ---------------------------------------------------------------------------
  // CircleCI
  // ---------------------------------------------------------------------------

  function circleCi(nodes, lines) {
    const sigs = [];
    const jobsIdx = topNode(nodes, 'jobs');
    if (jobsIdx !== null) {
      for (const job of directChildren(nodes, jobsIdx)) {
        if (!job.key) continue;
        const idx = nodes.indexOf(job);
        const end = spanEnd(nodes, idx, lines.length);
        let line = `job: ${job.key}`;
        const kids = childrenOf(nodes, idx);
        const docker = kids.find((k) => k.key === 'docker');
        if (docker) {
          const img = childrenOf(nodes, nodes.indexOf(docker)).find((k) => k.key === 'image');
          if (img) line += `  docker: ${compact(img.value, 40)}`;
        }
        const executor = childValue(nodes, idx, 'executor');
        if (executor) line += `  executor: ${compact(executor, 30)}`;
        sigs.push(line + anchor(job.line, end));

        const steps = kids.find((k) => k.key === 'steps');
        if (steps) {
          const sIdx = nodes.indexOf(steps);
          const out = [];
          for (const c of directChildren(nodes, sIdx)) {
            if (!c.item) continue;
            const cIdx = nodes.indexOf(c);
            const scope = [c, ...childrenOf(nodes, cIdx)];
            const cmd = scope.find((s) => s.key === 'command');
            const text = cmd ? cmd.value : (c.value || c.key);
            if (text) out.push(`  run: ${compact(text)}${anchor(c.line, c.line)}`);
          }
          sigs.push(...capWithNotice(out, MAX_STEPS_PER_JOB, 'steps'));
        }
      }
    }

    const wfIdx = topNode(nodes, 'workflows');
    if (wfIdx !== null) {
      for (const wf of directChildren(nodes, wfIdx)) {
        if (!wf.key || wf.key === 'version') continue;
        const idx = nodes.indexOf(wf);
        sigs.push(`workflow: ${wf.key}${anchor(wf.line, spanEnd(nodes, idx, lines.length))}`);
        const jl = childrenOf(nodes, idx).find((k) => k.key === 'jobs');
        if (!jl) continue;
        for (const j of directChildren(nodes, nodes.indexOf(jl))) {
          const name = j.key || unquote(j.value);
          if (!name) continue;
          const req = listValues(nodes, nodes.indexOf(j), 'requires');
          sigs.push(`  runs: ${name}${req.length ? `  requires: ${req.join(',')}` : ''}${anchor(j.line, j.line)}`);
        }
      }
    }
    return sigs;
  }

  // ---------------------------------------------------------------------------
  // Azure Pipelines
  // ---------------------------------------------------------------------------

  function azurePipelines(nodes, lines) {
    const sigs = [];
    const parts = [];
    for (const key of ['trigger', 'pr', 'schedules']) {
      const idx = topNode(nodes, key);
      if (idx === null) continue;
      const vals = flowList(nodes[idx].value) || (nodes[idx].value ? [unquote(nodes[idx].value)] : []);
      const branches = vals.length ? vals : listValues(nodes, idx, 'branches');
      const inner = branches.length ? branches : directChildren(nodes, idx)
        .filter((c) => c.item && (c.value || c.key)).map((c) => unquote(c.value || c.key));
      parts.push(inner.length ? `${key}[${inner.join(',')}]` : key);
    }
    const poolIdx = topNode(nodes, 'pool');
    let pool = '';
    if (poolIdx !== null) {
      pool = unquote(nodes[poolIdx].value) || childValue(nodes, poolIdx, 'vmImage') || '';
    }
    let head = 'pipeline: azure';
    if (parts.length) head += `  on: ${parts.join(', ')}`;
    if (pool) head += `  pool: ${compact(pool, 40)}`;
    sigs.push(head + anchor(1, nodes.length ? Math.min(lines.length, nodes[0].line) : 1));

    for (const section of ['stages', 'jobs']) {
      const idx = topNode(nodes, section);
      if (idx === null) continue;
      for (const item of directChildren(nodes, idx)) {
        if (!item.item) continue;
        const iIdx = nodes.indexOf(item);
        const scope = [item, ...childrenOf(nodes, iIdx)];
        const get = (k) => { const h = scope.find((s) => s.key === k); return h ? h.value : null; };
        const name = get('stage') || get('job') || get('template');
        if (!name) continue;
        const end = spanEnd(nodes, iIdx, lines.length);
        let line = `${section === 'stages' ? 'stage' : 'job'}: ${unquote(name)}`;
        const dn = get('displayName');
        if (dn) line += `  displayName: ${compact(dn, 40)}`;
        const dep = listValues(nodes, iIdx, 'dependsOn');
        if (dep.length) line += `  dependsOn: ${dep.join(',')}`;
        const cond = get('condition');
        if (cond) line += `  condition: ${compact(cond, 50)}`;
        sigs.push(line + anchor(item.line, end));

        const stepsNode = childrenOf(nodes, iIdx).find((k) => k.key === 'steps');
        if (stepsNode) {
          const sIdx = nodes.indexOf(stepsNode);
          const out = [];
          for (const c of directChildren(nodes, sIdx)) {
            if (!c.item) continue;
            const cScope = [c, ...childrenOf(nodes, nodes.indexOf(c))];
            const pick = (k) => { const h = cScope.find((s) => s.key === k); return h ? h.value : null; };
            const text = pick('script') || pick('bash') || pick('pwsh') || pick('task') || pick('template');
            if (text) out.push(`  run: ${compact(text)}${anchor(c.line, c.line)}`);
          }
          sigs.push(...capWithNotice(out, MAX_STEPS_PER_JOB, 'steps'));
        }
      }
    }
    return sigs;
  }

  // ---------------------------------------------------------------------------
  // Bitbucket Pipelines
  // ---------------------------------------------------------------------------

  function bitbucket(nodes, lines) {
    const sigs = [];
    const imgIdx = topNode(nodes, 'image');
    let head = 'pipeline: bitbucket';
    if (imgIdx !== null && nodes[imgIdx].value) head += `  image: ${compact(nodes[imgIdx].value, 40)}`;
    sigs.push(head + anchor(1, nodes.length ? nodes[0].line : 1));

    const pIdx = topNode(nodes, 'pipelines');
    if (pIdx === null) return sigs;
    for (const group of directChildren(nodes, pIdx)) {
      if (!group.key) continue;
      const gIdx = nodes.indexOf(group);
      const gEnd = spanEnd(nodes, gIdx, lines.length);
      sigs.push(`trigger: ${group.key}${anchor(group.line, gEnd)}`);

      for (const step of childrenOf(nodes, gIdx).filter((k) => k.key === 'step')) {
        const sIdx = nodes.indexOf(step);
        const name = childValue(nodes, sIdx, 'name');
        const img = childValue(nodes, sIdx, 'image');
        let line = `  step: ${name ? compact(name, 40) : '(unnamed)'}`;
        if (img) line += `  image: ${compact(img, 30)}`;
        const deploy = childValue(nodes, sIdx, 'deployment');
        if (deploy) line += `  deployment: ${compact(deploy, 20)}`;
        sigs.push(line + anchor(step.line, spanEnd(nodes, sIdx, lines.length)));
      }
    }
    return sigs;
  }

  // ---------------------------------------------------------------------------
  // Drone / Woodpecker
  // ---------------------------------------------------------------------------

  function drone(nodes, lines) {
    const sigs = [];
    const nameIdx = topNode(nodes, 'name');
    const kindIdx = topNode(nodes, 'kind');
    let head = `pipeline: ${nameIdx !== null ? unquote(nodes[nameIdx].value) : 'drone'}`;
    if (kindIdx !== null && nodes[kindIdx].value) head += `  kind: ${unquote(nodes[kindIdx].value)}`;
    sigs.push(head + anchor(1, nodes.length ? nodes[0].line : 1));

    const stepsIdx = topNode(nodes, 'steps');
    if (stepsIdx === null) return sigs;
    for (const step of directChildren(nodes, stepsIdx)) {
      if (!step.item) continue;
      const sIdx = nodes.indexOf(step);
      const scope = [step, ...childrenOf(nodes, sIdx)];
      const get = (k) => { const h = scope.find((s) => s.key === k); return h ? h.value : null; };
      const name = get('name');
      if (!name) continue;
      let line = `step: ${unquote(name)}`;
      const img = get('image');
      if (img) line += `  image: ${compact(img, 40)}`;
      const dep = listValues(nodes, sIdx, 'depends_on');
      if (dep.length) line += `  depends_on: ${dep.join(',')}`;
      sigs.push(line + anchor(step.line, spanEnd(nodes, sIdx, lines.length)));
    }
    return sigs;
  }

  // ---------------------------------------------------------------------------
  // Docker Compose
  // ---------------------------------------------------------------------------

  function compose(nodes, lines) {
    const sigs = [];
    const sIdx = topNode(nodes, 'services');
    if (sIdx === null) return sigs;
    for (const svc of directChildren(nodes, sIdx)) {
      if (!svc.key) continue;
      const idx = nodes.indexOf(svc);
      const end = spanEnd(nodes, idx, lines.length);
      let line = `service: ${svc.key}`;
      const image = childValue(nodes, idx, 'image');
      if (image) line += `  image: ${compact(image, 40)}`;
      else {
        const buildNode = childrenOf(nodes, idx).find((k) => k.key === 'build');
        if (buildNode) {
          const ctx = buildNode.value || childValue(nodes, nodes.indexOf(buildNode), 'context');
          line += `  build: ${ctx ? compact(ctx, 30) : '.'}`;
        }
      }
      const ports = listValues(nodes, idx, 'ports');
      if (ports.length) line += `  ports: ${ports.join(',')}`;
      const dep = listValues(nodes, idx, 'depends_on');
      if (dep.length) line += `  depends_on: ${dep.join(',')}`;
      const cmd = childValue(nodes, idx, 'command');
      if (cmd) line += `  command: ${compact(cmd, 40)}`;
      sigs.push(line + anchor(svc.line, end));
    }
    return sigs;
  }

  // ---------------------------------------------------------------------------
  // Jenkinsfile (Groovy declarative)
  // ---------------------------------------------------------------------------

  function jenkins(src) {
    const sigs = [];
    const lines = String(src).split('\n');
    const agent = src.match(/^\s*agent\s+(.+)$/m);
    sigs.push(`pipeline: jenkins${agent ? `  agent: ${compact(agent[1], 40)}` : ''}  :1-1`);

    for (let i = 0; i < lines.length; i++) {
      const stage = lines[i].match(/^\s*stage\s*\(\s*['"]([^'"]+)['"]/);
      if (stage) sigs.push(`stage: ${stage[1]}${anchor(i + 1, i + 1)}`);
      const sh = lines[i].match(/^\s*(sh|bat|powershell)\s+['"]{1,3}(.+?)['"]{1,3}\s*$/);
      if (sh) sigs.push(`  run: ${compact(sh[2])}${anchor(i + 1, i + 1)}`);
    }
    return sigs;
  }

  // ---------------------------------------------------------------------------
  // Entry point
  // ---------------------------------------------------------------------------

  const RENDERERS = {
    github: githubActions,
    action: githubAction,
    gitlab: gitlabCi,
    circleci: circleCi,
    azure: azurePipelines,
    bitbucket,
    drone,
    compose,
  };

  /**
   * Extract semantic signatures from a CI / pipeline definition.
   * @param {string} src - raw file content
   * @param {string} [filePath] - path (drives platform routing; falls back to a content sniff)
   * @returns {string[]}
   */
  function extract(src, filePath) {
    if (!src || typeof src !== 'string') return [];
    const platform = platformFor(filePath) || sniffPlatform(src);
    if (!platform) return [];

    try {
      if (platform === 'jenkins') return capWithNotice(jenkins(src), PER_FILE_LIMIT, 'signatures');
      const lines = src.split('\n');
      const nodes = scanYaml(src);
      if (nodes.length === 0) return [];
      const fileName = path.posix.basename(String(filePath || '').replace(/\\/g, '/')) || 'pipeline';
      const render = RENDERERS[platform];
      const sigs = render.length >= 3 ? render(nodes, lines, fileName) : render(nodes, lines);
      return capWithNotice(sigs.filter(Boolean), PER_FILE_LIMIT, 'signatures');
    } catch (_) {
      // A malformed pipeline must degrade to "no signatures", never to a throw
      // that would abort the whole context build.
      return [];
    }
  }

  module.exports = { extract, platformFor, sniffPlatform, scanYaml, PER_FILE_LIMIT };
  
};

// ── ./src/extractors/powershell ──
__factories["./src/extractors/powershell"] = function(module, exports) {
  
  /**
   * PowerShell extractor (Tier 2, Issue #840).
   *
   * Supported extensions: .ps1, .psm1, .psd1
   *
   * Architecture:
   *   - Local length- and newline-preserving maskPs() scanner for PowerShell comments
   *     (# and <# ... #>) and strings ('single', "double", and here-strings).
   *   - Balanced parameter and block depth scanning via readBalanced.
   *   - Signatures carry Surgical Context line anchors (:start-end).
   *   - Member and file caps with visible disclosure (capWithNotice / capMembersWithNotice).
   *
   * Internal/public convention:
   *   PowerShell has no script-scope private keyword. If an export list
   *   (Export-ModuleMember or FunctionsToExport) exists in the file, functions not
   *   listed are treated as internal and omitted. If no export list is present,
   *   all functions are emitted.
   */

  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { readBalanced } = __require('./src/extractors/scan');

  const PER_FILE_LIMIT = 200;
  const MEMBER_LIMIT = 120;
  const MAX_CLASS_BODY_CHARS = 200000;

  /**
   * Single-pass, length- and newline-preserving mask for PowerShell syntax.
   *
   * Priority order (per implementation guide):
   *   1. <# ... #> block comments (nestable in practice — depth tracked)
   *   2. # to end of line (only outside strings)
   *   3. @" ... "@ and @' ... '@ here-strings (terminator must be at line start)
   *   4. 'single' quoted strings (doubled '' escapes)
   *   5. "double" quoted strings (backtick ` is escape, NOT backslash)
   *
   * Blanked bytes become spaces; all \n are strictly preserved.
   *
   * @param {string} src
   * @returns {string} masked source of identical length and newline count
   */
  function maskPs(src) {
    if (!src || typeof src !== 'string') return '';
    const out = src.split('');
    const n = src.length;
    const blank = (from, to) => {
      for (let k = from; k < to; k++) {
        if (out[k] !== '\n') out[k] = ' ';
      }
    };

    let i = 0;
    while (i < n) {
      const c = src[i];
      const d = i + 1 < n ? src[i + 1] : '';

      // 1. Block comments: <# ... #> (nestable)
      if (c === '<' && d === '#') {
        let depth = 1;
        let j = i + 2;
        while (j < n && depth > 0) {
          if (src[j] === '<' && src[j + 1] === '#') {
            depth++;
            j += 2;
          } else if (src[j] === '#' && src[j + 1] === '>') {
            depth--;
            j += 2;
          } else {
            j++;
          }
        }
        blank(i, j);
        i = j;
        continue;
      }

      // 2. Here-strings: @"\r?\n ... \r?\n"@ or @'\r?\n ... \r?\n'@
      // Opening delimiter must be followed by newline (optional whitespace allowed before \n).
      if (c === '@' && (d === '"' || d === '\'')) {
        const quote = d;
        let k = i + 2;
        while (k < n && (src[k] === ' ' || src[k] === '\t' || src[k] === '\r')) k++;
        if (k < n && src[k] === '\n') {
          let j = k + 1;
          while (j < n) {
            // Terminator occurs at the beginning of a line (column 0, or right after \n)
            if ((j === 0 || src[j - 1] === '\n') && src[j] === quote && j + 1 < n && src[j + 1] === '@') {
              j += 2;
              break;
            }
            j++;
          }
          // Unterminated here-strings safely blank to EOF
          blank(i, j);
          i = j;
          continue;
        }
      }

      // 3. Single-quoted strings: 'text' (escape is doubled '')
      if (c === '\'') {
        let j = i + 1;
        while (j < n) {
          if (src[j] === '\'') {
            if (j + 1 < n && src[j + 1] === '\'') {
              j += 2;
              continue;
            }
            j++;
            break;
          }
          j++;
        }
        blank(i, j);
        i = j;
        continue;
      }

      // 4. Double-quoted strings: "text" (escape is ` or doubled "")
      if (c === '"') {
        let j = i + 1;
        while (j < n) {
          if (src[j] === '`') {
            j += 2;
            continue;
          }
          if (src[j] === '"') {
            if (j + 1 < n && src[j + 1] === '"') {
              j += 2;
              continue;
            }
            j++;
            break;
          }
          j++;
        }
        blank(i, j);
        i = j;
        continue;
      }

      // 5. Line comments: # ... (outside strings and block comments)
      if (c === '#') {
        let j = i + 1;
        while (j < n && src[j] !== '\n') j++;
        blank(i, j);
        i = j;
        continue;
      }

      i++;
    }

    return out.join('');
  }

  /**
   * Extract signatures from PowerShell source code (.ps1, .psm1, .psd1).
   *
   * @param {string} src - Raw file content
   * @param {string} [filePath] - File path (optional)
   * @returns {string[]} Array of signature strings
   */
  function extract(src, filePath) {
    if (!src || typeof src !== 'string') return [];

    const ext = typeof filePath === 'string'
      ? filePath.slice(filePath.lastIndexOf('.')).toLowerCase()
      : '';

    // .psd1 Module Manifest metadata extraction
    if (ext === '.psd1') {
      return extractManifest(src);
    }

    const masked = maskPs(src);
    const docHints = collectDocHints(src);
    const exportSet = collectExportedFunctions(src, masked);

    const sigs = [];

    // 1. PS5 Classes
    const classRe = /^[ \t]*class\s+([A-Za-z_]\w*)(?:\s*:\s*[A-Za-z_]\w*)?\s*\{/gm;
    const classRanges = [];
    for (const m of masked.matchAll(classRe)) {
      const declStart = m.index + (m[0].length - m[0].trimStart().length);
      const openBrace = m.index + m[0].length - 1;
      const closeBrace = readBalanced(masked, openBrace, '{', '}', MAX_CLASS_BODY_CHARS);
      const endIdx = closeBrace >= 0 ? closeBrace : openBrace;
      classRanges.push([openBrace, endIdx]);

      const className = m[1];
      sigs.push(withAnchor(`class ${className}`, lineAt(src, declStart), lineAt(src, endIdx)));

      const classBody = src.slice(openBrace + 1, endIdx);
      const classMasked = masked.slice(openBrace + 1, endIdx);
      const members = extractClassMembers(classBody, classMasked, openBrace + 1, src, className);
      for (const mem of members) {
        sigs.push(mem);
      }
    }

    // 2. Enums
    const enumRe = /^[ \t]*enum\s+([A-Za-z_]\w*)(?:\s*:\s*\w+)?\s*\{/gm;
    for (const m of masked.matchAll(enumRe)) {
      const declStart = m.index + (m[0].length - m[0].trimStart().length);
      const openBrace = m.index + m[0].length - 1;
      const closeBrace = readBalanced(masked, openBrace, '{', '}', 10000);
      const endIdx = closeBrace >= 0 ? closeBrace : openBrace;
      sigs.push(withAnchor(`enum ${m[1]}`, lineAt(src, declStart), lineAt(src, endIdx)));
    }

    // 3. Functions, Filters, and Workflows
    let lastDeclEnd = 0;
    const fnRe = /^[ \t]*(?:(?:\[[^\]]+\]\s*)*)(function|filter|workflow)\s+([A-Za-z0-9_:-]+)/gim;
    for (const m of masked.matchAll(fnRe)) {
      // Skip if inside a class body
      if (classRanges.some(([start, end]) => m.index > start && m.index < end)) {
        continue;
      }

      const keyword = m[1].toLowerCase();
      const rawName = m[2];

      // If an export list is present, skip unexported functions (internal convention)
      if (exportSet && !exportSet.has(rawName.toLowerCase())) {
        continue;
      }

      const declStart = m.index + (m[0].length - m[0].trimStart().length);

      // Look for body {
      const afterNameIdx = m.index + m[0].length;
      let openBrace = -1;
      for (let k = afterNameIdx; k < Math.min(masked.length, afterNameIdx + 2000); k++) {
        if (masked[k] === '{') {
          openBrace = k;
          break;
        }
      }

      const closeBrace = openBrace >= 0
        ? readBalanced(masked, openBrace, '{', '}', MAX_CLASS_BODY_CHARS)
        : -1;
      const endIdx = closeBrace >= 0 ? closeBrace : (openBrace >= 0 ? openBrace : declStart);

      // Check for inline parameters: function name($a, $b)
      let params = null;
      let openParen = -1;
      for (let k = afterNameIdx; k < (openBrace >= 0 ? openBrace : masked.length); k++) {
        if (masked[k] === '(') {
          openParen = k;
          break;
        }
      }

      if (openParen >= 0) {
        const closeParen = readBalanced(masked, openParen, '(', ')', 4000);
        if (closeParen >= 0) {
          params = parseParams(src.slice(openParen + 1, closeParen), masked.slice(openParen + 1, closeParen));
        }
      }

      // If no inline params, check for param(...) block inside body
      let bodySlice = '';
      let bodyMasked = '';
      if (openBrace >= 0) {
        const bodyEnd = closeBrace >= 0 ? closeBrace : Math.min(masked.length, openBrace + 4000);
        bodySlice = src.slice(openBrace + 1, bodyEnd);
        bodyMasked = masked.slice(openBrace + 1, bodyEnd);
      }

      if (params === null && openBrace >= 0) {
        const paramMatch = bodyMasked.match(/\bparam\s*\(/i);
        if (paramMatch) {
          const pOpen = paramMatch.index + paramMatch[0].length - 1;
          const pClose = readBalanced(bodyMasked, pOpen, '(', ')', 8000);
          if (pClose >= 0) {
            params = parseParams(bodySlice.slice(pOpen + 1, pClose), bodyMasked.slice(pOpen + 1, pClose));
          }
        }
      }

      // Default to empty params () if none defined
      const paramStr = params !== null ? params.join(', ') : '';

      // Advanced function attribute: [CmdletBinding()]
      // Scoped to the region between the end of the previous declaration (or previous block brace) and m.index
      const lastBrace = src.lastIndexOf('}', m.index);
      const lookbackStart = Math.max(lastDeclEnd, lastBrace >= 0 ? lastBrace + 1 : 0);
      const headerPrefix = src.slice(lookbackStart, m.index);
      const bodyPrefix = bodySlice.slice(0, 1000);
      const hasCmdletBinding = /\[CmdletBinding\b/i.test(headerPrefix) || /\[CmdletBinding\b/i.test(bodyPrefix);

      // Return type hint: [OutputType([Type])] or [OutputType('Type')]
      let returnType = '';
      const otMatch = (headerPrefix + '\n' + bodyPrefix).match(/\[OutputType\s*\(\s*(?:\[\s*([\w.]+)\s*\]|['"]([^'"]+)['"])/i);
      if (otMatch) {
        returnType = otMatch[1] || otMatch[2] || '';
      }

      lastDeclEnd = endIdx + 1;

      // Build signature string
      let sig = `${keyword} ${rawName}(${paramStr})`;
      if (hasCmdletBinding) sig += ' [CmdletBinding]';
      if (returnType) sig += ` → ${returnType}`;

      const anchored = withAnchor(sig, lineAt(src, declStart), lineAt(src, endIdx));

      // Doc hint from .SYNOPSIS
      const hint = docHints.get(rawName) || findBodySynopsis(bodySlice);
      const withHint = hint ? `${anchored}  # ${hint}` : anchored;

      sigs.push(withHint);
    }

    // 4. Module member exports: Export-ModuleMember -Function a, b
    const exportRe = /^[ \t]*Export-ModuleMember\s+(?:-Function\s+)?([^\r\n;#]+)/gim;
    for (const m of src.matchAll(exportRe)) {
      // Skip if commented out on masked surface
      if (masked[m.index] === ' ') continue;

      const declStart = m.index + (m[0].length - m[0].trimStart().length);
      const declEnd = m.index + m[0].trimEnd().length;

      // Normalise: Export-ModuleMember -Function a, b -> Export-ModuleMember a, b
      const rawArgs = m[1].trim();
      // Strip trailing other flags like -Variable, -Alias if present
      const cleanArgs = stripTrailingFlags(rawArgs);
      if (cleanArgs) {
        const text = `Export-ModuleMember ${cleanArgs.replace(/\s+/g, ' ')}`;
        sigs.push(withAnchor(text, lineAt(src, declStart), lineAt(src, declEnd)));
      }
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /**
   * Strip trailing flags like -Alias or -Variable from an Export-ModuleMember argument string.
   * Anchors on a whitespace-delimited flag token so a hyphen inside a Verb-Noun name is not stripped.
   */
  function stripTrailingFlags(args) {
    if (!args) return '';
    return args.replace(/\s-[A-Za-z]+\b[\s\S]*$/, '').trim();
  }

  /**
   * Extract PS5 class properties, constructors, and methods.
   */
  function extractClassMembers(body, maskedBody, offset, src, className) {
    const members = [];
    const KEYWORDS = /^(if|elseif|else|while|for|foreach|switch|until|trap|catch|return|throw|do|try|in|exit|break|continue)$/i;

    const methodRe = /^[ \t]*(hidden\s+)?(static\s+)?(?:\[\s*([\w.\[\]]+)\s*\]\s+)?([A-Za-z_]\w*)\s*\(/gm;

    // 1. Blank method bodies so statements inside methods (return, throw, calls)
    // are never matched as members or properties.
    const b = body.split('');
    const mb = maskedBody.split('');

    for (const m of maskedBody.matchAll(methodRe)) {
      const name = m[4];
      if (KEYWORDS.test(name)) continue;
      const openParen = m.index + m[0].length - 1;
      const closeParen = readBalanced(maskedBody, openParen, '(', ')', 2000);
      if (closeParen < 0) continue;

      let openBrace = -1;
      for (let k = closeParen + 1; k < Math.min(maskedBody.length, closeParen + 500); k++) {
        if (maskedBody[k] === '{') { openBrace = k; break; }
      }
      if (openBrace < 0) continue;
      const closeBrace = readBalanced(maskedBody, openBrace, '{', '}', MAX_CLASS_BODY_CHARS);
      if (closeBrace < 0) continue;

      // Blank inside { ... }
      for (let k = openBrace + 1; k < closeBrace; k++) {
        if (b[k] !== '\n') b[k] = ' ';
        if (mb[k] !== '\n') mb[k] = ' ';
      }
    }

    const cleanBody = b.join('');
    const cleanMasked = mb.join('');

    // 2. Extract methods and constructors
    for (const m of cleanMasked.matchAll(methodRe)) {
      const isHidden = Boolean(m[1]);
      if (isHidden) continue; // Skip private/hidden members

      const isStatic = Boolean(m[2]);
      const declaredType = m[3] || '';
      const name = m[4];
      if (KEYWORDS.test(name)) continue;

      const declStart = offset + m.index + (m[0].length - m[0].trimStart().length);
      const openParen = m.index + m[0].length - 1;
      const closeParen = readBalanced(cleanMasked, openParen, '(', ')', 2000);
      if (closeParen < 0) continue;

      let openBrace = -1;
      for (let k = closeParen + 1; k < Math.min(cleanMasked.length, closeParen + 500); k++) {
        if (cleanMasked[k] === '{') {
          openBrace = k;
          break;
        }
      }
      const closeBrace = openBrace >= 0
        ? readBalanced(cleanMasked, openBrace, '{', '}', MAX_CLASS_BODY_CHARS)
        : -1;
      const endIdx = offset + (closeBrace >= 0 ? closeBrace : closeParen);

      const paramList = parseParams(
        cleanBody.slice(openParen + 1, closeParen),
        cleanMasked.slice(openParen + 1, closeParen)
      );
      const paramStr = paramList.join(', ');

      let sigText = '';
      if (name === className) {
        // Constructor
        sigText = `  ${name}(${paramStr})`;
      } else {
        const typePrefix = declaredType ? `[${declaredType}] ` : '';
        const staticPrefix = isStatic ? 'static ' : '';
        sigText = `  ${staticPrefix}${typePrefix}${name}(${paramStr})`;
      }

      members.push({
        text: withAnchor(sigText, lineAt(src, declStart), lineAt(src, endIdx)),
        declStart,
      });
    }

    // 3. Extract PS5 class properties: [string]$BasePath, static [int]$Count, etc.
    const propRe = /^[ \t]*(hidden\s+)?(static\s+)?((?:\[[^\]]+\]\s*)*)\$([A-Za-z_]\w*)(?:\s*=.*)?$/gm;
    for (const m of cleanMasked.matchAll(propRe)) {
      const isHidden = Boolean(m[1]);
      if (isHidden) continue;
      const isStatic = Boolean(m[2]);
      const attrAndType = (m[3] || '').trim();
      const name = m[4];

      let declaredType = '';
      if (attrAndType) {
        const brackets = [...attrAndType.matchAll(/\[\s*([\w.\[\]]+)\s*\]/g)];
        if (brackets.length > 0) {
          declaredType = brackets[brackets.length - 1][1];
        }
      }

      const declStart = offset + m.index + (m[0].length - m[0].trimStart().length);
      const declEnd = offset + m.index + m[0].trimEnd().length;

      const typePrefix = declaredType ? `[${declaredType}] ` : '';
      const staticPrefix = isStatic ? 'static ' : '';
      const sigText = `  ${staticPrefix}${typePrefix}$${name}`;

      members.push({
        text: withAnchor(sigText, lineAt(src, declStart), lineAt(src, declEnd)),
        declStart,
      });
    }

    // Sort members by declaration offset so they appear in document order
    members.sort((m1, m2) => m1.declStart - m2.declStart);

    const capped = capMembersWithNotice(members, MEMBER_LIMIT, 'methods');
    return capped.map((m) => m.text);
  }

  /**
   * Parse balanced parameters into clean names.
   * Strips $, [Type], default expressions, and splatting (@).
   */
  function parseParams(paramText, maskedText) {
    if (!paramText || !paramText.trim()) return [];

    const chunks = [];
    let depth = 0;
    let start = 0;

    for (let i = 0; i < maskedText.length; i++) {
      const ch = maskedText[i];
      if (ch === '(' || ch === '[' || ch === '{') depth++;
      else if (ch === ')' || ch === ']' || ch === '}') depth--;
      else if (ch === ',' && depth === 0) {
        chunks.push(paramText.slice(start, i));
        start = i + 1;
      }
    }
    chunks.push(paramText.slice(start));

    const names = [];
    for (const chunk of chunks) {
      const name = extractParamName(chunk);
      if (name) names.push(name);
    }

    return names;
  }

  /**
   * Extract a single parameter variable name from a parameter declaration chunk.
   * E.g.: `[Parameter(Mandatory = $true)] [string]$FilePath = 'default'` -> `FilePath`
   */
  function extractParamName(chunk) {
    if (!chunk || !chunk.trim()) return '';

    // 1. Strip default expression (= ...) outside brackets/parens
    let depth = 0;
    let eqIdx = -1;
    for (let i = 0; i < chunk.length; i++) {
      const ch = chunk[i];
      if (ch === '[' || ch === '(' || ch === '{') depth++;
      else if (ch === ']' || ch === ')' || ch === '}') depth--;
      else if (ch === '=' && depth === 0) {
        eqIdx = i;
        break;
      }
    }
    const beforeEq = eqIdx >= 0 ? chunk.slice(0, eqIdx) : chunk;

    // 2. Strip all bracketed sections [...] (attributes and type annotations)
    let stripped = '';
    let bDepth = 0;
    for (let i = 0; i < beforeEq.length; i++) {
      const ch = beforeEq[i];
      if (ch === '[') bDepth++;
      else if (ch === ']') {
        if (bDepth > 0) bDepth--;
      } else if (bDepth === 0) {
        stripped += ch;
      }
    }

    // 3. Extract the variable name ($Name or ${Name})
    const varMatch = stripped.match(/\$(?:\{([^}]+)\}|([A-Za-z0-9_:-]+))/);
    if (varMatch) {
      const varName = varMatch[1] || varMatch[2];
      return varName.replace(/^[A-Za-z0-9_]+:/, '');
    }

    // 4. Fallback for splatting (@Name) or bare identifier
    const splatMatch = stripped.match(/@([A-Za-z0-9_:-]+)/);
    if (splatMatch) {
      return splatMatch[1];
    }

    const bare = stripped.trim().replace(/^[\$@]/, '');
    return /^[A-Za-z0-9_:-]+$/.test(bare) ? bare : '';
  }

  /**
   * Extract manifest entries for .psd1 files.
   * Keys: ModuleVersion, RootModule, FunctionsToExport
   */
  function extractManifest(src) {
    const sigs = [];
    const targetKeys = ['RootModule', 'ModuleVersion', 'FunctionsToExport'];

    for (const key of targetKeys) {
      const re = new RegExp(`^[ \\t]*${key}\\s*=\\s*([^\r\n#;]+)`, 'gim');
      const m = re.exec(src);
      if (m) {
        const declStart = m.index + (m[0].length - m[0].trimStart().length);
        const declEnd = m.index + m[0].trimEnd().length;
        const rawVal = m[1].trim();
        const cleanVal = rawVal.replace(/\s+/g, ' ');
        sigs.push(withAnchor(`${key} = ${cleanVal}`, lineAt(src, declStart), lineAt(src, declEnd)));
      }
    }

    return sigs;
  }

  /**
   * Collect exported function names if an export list exists in the file.
   * Returns null if no export list is found (meaning: emit all functions).
   */
  function collectExportedFunctions(src, masked) {
    let exportSet = null;

    // 1. Export-ModuleMember -Function a, b
    const emmRe = /^[ \t]*Export-ModuleMember\s+(?:-Function\s+)?([^\r\n;#]+)/gim;
    for (const m of src.matchAll(emmRe)) {
      if (masked[m.index] === ' ') continue;
      const args = stripTrailingFlags(m[1]);
      if (args) {
        if (!exportSet) exportSet = new Set();
        const parts = args.split(',').map((s) => s.trim().replace(/^['"]|['"]$/g, '').toLowerCase());
        for (const p of parts) if (p) exportSet.add(p);
      }
    }

    // 2. FunctionsToExport = @('a', 'b')
    const fteRe = /^[ \t]*FunctionsToExport\s*=\s*(?:@\(([^)]*)\)|['"]([^'"]+)['"])/gim;
    for (const m of src.matchAll(fteRe)) {
      if (masked[m.index] === ' ') continue;
      const raw = m[1] || m[2] || '';
      if (raw) {
        if (!exportSet) exportSet = new Set();
        const parts = raw.split(',').map((s) => s.trim().replace(/^['"]|['"]$/g, '').toLowerCase());
        for (const p of parts) if (p) exportSet.add(p);
      }
    }

    return exportSet;
  }

  /**
   * Collect doc hints from <# .SYNOPSIS ... #> comments before function declarations.
   */
  function collectDocHints(src) {
    const hints = new Map();
    const re = /(<#[\s\S]*?#>)\s*(?:\[[^\]]+\]\s*)*(?:function|filter|workflow)\s+([A-Za-z0-9_:-]+)/gi;

    for (const m of src.matchAll(re)) {
      const comment = m[1];
      const fnName = m[2];
      const hint = extractSynopsis(comment);
      if (hint && !hints.has(fnName)) {
        hints.set(fnName, hint);
      }
    }

    return hints;
  }

  /**
   * Extract synopsis inside a function's body if defined there (restricted to the body prefix).
   */
  function findBodySynopsis(bodySlice) {
    const prefix = bodySlice.slice(0, 1500);
    const m = prefix.match(/<#([\s\S]*?)#>/);
    if (!m) return '';
    return extractSynopsis(m[0]);
  }

  /**
   * Parse the first sentence of .SYNOPSIS from a comment block, capped at 60 chars.
   */
  function extractSynopsis(commentBlock) {
    const m = commentBlock.match(/\.SYNOPSIS\s+([\s\S]*?)(?=\r?\n\s*\.[A-Z]+|\s*#>)/i);
    if (!m) return '';

    const lines = m[1].split('\n')
      .map((l) => l.trim())
      .filter((l) => l && !l.startsWith('#') && !l.startsWith('.'));

    if (lines.length === 0) return '';
    const firstLine = lines[0];
    const sentence = firstLine.split(/[.!?]/)[0].trim();
    return (sentence || firstLine).slice(0, 60);
  }

  module.exports = { extract, maskPs };
  
};

// ── ./src/extractors/prdiff ──
__factories["./src/extractors/prdiff"] = function(module, exports) {
  
  /**
   * Compare signature arrays and produce compact diff markers.
   * @param {string[]} baseSigs
   * @param {string[]} currentSigs
   * @returns {{added:string[], removed:string[], modified:string[]}}
   */
  function diffSignatures(baseSigs, currentSigs) {
    const base = new Set(baseSigs || []);
    const curr = new Set(currentSigs || []);

    const added = [...curr].filter((s) => !base.has(s));
    const removed = [...base].filter((s) => !curr.has(s));

    const byName = (arr) => {
      const m = new Map();
      for (const s of arr) {
        const n = extractName(s);
        if (!n) continue;
        if (!m.has(n)) m.set(n, []);
        m.get(n).push(s);
      }
      return m;
    };

    const aBy = byName(added);
    const rBy = byName(removed);
    const modified = [];

    for (const [name] of aBy) {
      if (rBy.has(name)) modified.push(name);
    }

    return { added, removed, modified };
  }

  /**
   * Extract the declared symbol name from a signature line.
   *
   * Robust to the real forms SigMap emits — `export class X`, `const x = () =>`,
   * `async function x`, members, a trailing `:start-end` anchor, and `→ return`
   * suffixes. Anchored so it never returns a mid-string fragment (the old regex
   * could turn a signature into a 2-char name like `is`), and returns '' for
   * non-symbol lines (`module.exports = {…}`, markdown headers) instead of guessing.
   */
  function extractName(sig) {
    if (!sig) return '';
    // Drop a trailing `:start-end` (or `:line`) line anchor.
    let t = String(sig).replace(/\s*:\d+(?:-\d+)?\s*$/, '').trim();
    // Re-export / barrel lines carry no single declared name.
    if (/^(?:module\.)?exports\b/.test(t) || /^export\s*\{/.test(t) || /^export\s+\*/.test(t)) return '';
    // Strip leading modifiers so the keyword/name is at the start.
    t = t.replace(/^export\s+/, '')
         .replace(/^default\s+/, '')
         .replace(/^(?:public|private|protected|static|abstract|final|override|readonly)\s+/g, '')
         .replace(/^async\s+/, '');
    let m;
    // Declared forms: function/def/func/fn/class/interface/trait/struct/enum/record/type <name>
    if ((m = t.match(/^(?:def|function|func|fn|class|interface|trait|struct|enum|record|type)\s+([A-Za-z_$][\w$]*)/))) return m[1];
    // const/let/var/val <name> = …  (arrow functions, assigned values)
    if ((m = t.match(/^(?:const|let|var|val)\s+([A-Za-z_$][\w$]*)/))) return m[1];
    // Call / method form: <name>(…)
    if ((m = t.match(/^([A-Za-z_$][\w$]*)\s*\(/))) return m[1];
    // Lone identifier (e.g. a collapsed `symbol` after the anchor was stripped).
    if ((m = t.match(/^([A-Za-z_$][\w$]*)$/))) return m[1];
    return '';
  }

  module.exports = { diffSignatures, extractName };
  
};

// ── ./src/extractors/properties ──
__factories["./src/extractors/properties"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling discloses what it drops rather than truncating silently (#583).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from .properties configuration files.
   * Captures key names, grouped by prefixes where possible.
   *
   * @param {string} src - Raw properties content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    const lines = src.split(/\r?\n/);
    for (const line of lines) {
      const trimmed = line.trim();
      if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('!')) continue;

      const idxEq = trimmed.indexOf('=');
      const idxColon = trimmed.indexOf(':');
      const idx = idxEq >= 0 && idxColon >= 0 ? Math.min(idxEq, idxColon) : Math.max(idxEq, idxColon);
      if (idx <= 0) continue;

      const key = trimmed.slice(0, idx).trim();
      if (!key) continue;

      const parts = key.split('.').filter(Boolean);
      if (parts.length >= 2) {
        sigs.push(`group ${parts[0]}.${parts[1]}`);
      }
      sigs.push(`key ${key}`);
    }

    return capWithNotice(Array.from(new Set(sigs)), PER_FILE_LIMIT, 'keys');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/protobuf ──
__factories["./src/extractors/protobuf"] = function(module, exports) {
  
  /**
   * Extract signatures from Protocol Buffer (.proto) files.
   * Captures message, enum, service, rpc, oneof, extend definitions.
   *
   * @param {string} src - Raw .proto content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Strip single-line and block comments
    const stripped = src
      .replace(/\/\/[^\n]*/g, '')
      .replace(/\/\*[\s\S]*?\*\//g, '');

    // syntax / package / option (top-level metadata)
    const syntaxM = stripped.match(/\bsyntax\s*=\s*"([^"]+)"/);
    if (syntaxM) sigs.push(`syntax = "${syntaxM[1]}"`);

    const pkgM = stripped.match(/\bpackage\s+([\w.]+)\s*;/);
    if (pkgM) sigs.push(`package ${pkgM[1]}`);

    // message <Name> { ... }
    for (const m of stripped.matchAll(/\bmessage\s+(\w+)\s*\{/g)) {
      sigs.push(`message ${m[1]}`);
    }

    // enum <Name> { ... }
    for (const m of stripped.matchAll(/\benum\s+(\w+)\s*\{/g)) {
      sigs.push(`enum ${m[1]}`);
    }

    // service <Name> { ... }
    for (const m of stripped.matchAll(/\bservice\s+(\w+)\s*\{/g)) {
      sigs.push(`service ${m[1]}`);
    }

    // rpc <Name>(<Request>) returns (<Response>)
    for (const m of stripped.matchAll(
      /\brpc\s+(\w+)\s*\(\s*(stream\s+)?(\w+)\s*\)\s+returns\s*\(\s*(stream\s+)?(\w+)\s*\)/g
    )) {
      const req = `${m[2] || ''}${m[3]}`.trim();
      const res = `${m[4] || ''}${m[5]}`.trim();
      sigs.push(`rpc ${m[1]}(${req}) returns (${res})`);
    }

    // oneof <name>
    for (const m of stripped.matchAll(/\boneof\s+(\w+)\s*\{/g)) {
      sigs.push(`oneof ${m[1]}`);
    }

    // extend <TypeName>
    for (const m of stripped.matchAll(/\bextend\s+([\w.]+)\s*\{/g)) {
      sigs.push(`extend ${m[1]}`);
    }

    return sigs;
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/python ──
__factories["./src/extractors/python"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');
  const { lineAt } = __require('./src/extractors/line-anchor');
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  const PER_FILE_LIMIT = 200;

  // Per-class member ceiling, disclosed via capWithNotice (#576).
  const MEMBER_LIMIT = 120;

  /**
   * 1-based line of the last source line belonging to a top-level (indent 0)
   * def/class body that starts at `startLine` (1-based). Trailing blank lines
   * are excluded.
   * @param {string[]} srcLines
   * @param {number} startLine
   * @returns {number}
   */
  function pyBlockEnd(srcLines, startLine) {
    let end = startLine;
    for (let i = startLine; i < srcLines.length; i++) {
      const line = srcLines[i];
      if (line.trim() === '') continue;
      const indent = line.match(/^(\s*)/)[1].length;
      if (indent === 0) break;
      end = i + 1;
    }
    return end;
  }

  /**
   * Try to extract signatures using the native Python AST extractor.
   * Returns null if Python3 is unavailable or the script returns empty results.
   * @param {string} filePath - Absolute path to the Python file
   * @returns {string[]|null}
   */
  /** Resolve packaged python_ast.py (dev, npm tarball, or bundled CLI root). */
  function resolvePythonAstScript() {
    const candidates = [
      path.join(__dirname, 'python_ast.py'),
      path.join(__dirname, 'src', 'extractors', 'python_ast.py'),
    ];
    for (const candidate of candidates) {
      try {
        if (fs.existsSync(candidate)) return candidate;
      } catch (_) {}
    }
    return null;
  }

  // ---------------------------------------------------------------------------
  // Batch pre-pass (#970)
  //
  // The AST tier used to start one `python3` per file: about 2,900 process starts
  // on Django, 182 s against 7 s for the regex tier. `prefetch` hands a run's
  // whole file list to `python_ast.py --batch` in chunks, and `tryNativeExtract`
  // reads the answer back. The per-file call below stays for any caller that did
  // not prefetch (one file edited, an MCP write hook, a test), so it is never
  // wrong, only slower.
  // ---------------------------------------------------------------------------

  // Files per python3 process. Bounds the output held in memory at once (about
  // 3 KB of signatures a file, and up to about 25 KB for a file at the 200-signature
  // ceiling since #982) and the files a hung process can take with it, but
  // each process pays interpreter start-up: Django took 3.9 s at 200 a process and
  // 2.9 s at 1,000.
  const BATCH_CHUNK = 1000;
  // A chunk normally takes well under two seconds; this only ends a hung one.
  const BATCH_TIMEOUT_MS = 60000;
  const BATCH_MAX_BUFFER = 256 * 1024 * 1024;

  // absolute path -> { size, mtimeMs, sigs: string[]|null, degraded?: true }.
  // `sigs: null` is a settled answer for the regex tier (parse error, empty
  // result, python3 absent or failed), not "unknown": it is what keeps a failed
  // batch from falling back to one process per file. `degraded` marks the ones a
  // failure left unanswered, which the next prefetch tries again. The stat taken
  // BEFORE python3 reads the file makes a file edited afterwards miss and take the
  // per-file path, as it always has.
  const _batched = new Map();

  // 'major.minor' of the python3 that served the AST tier this run, and whether
  // it served any file: the generated header labels the toolchain (#609).
  let _astVersion = null;
  let _astServed = false;

  function statKey(p) {
    try {
      const st = fs.statSync(p);
      return { size: st.size, mtimeMs: st.mtimeMs };
    } catch (_) {
      return null;
    }
  }

  /**
   * Run one chunk through `python_ast.py --batch`.
   * @returns {{results: Map<string, string[]>, version: string|null, error: string|null, missing: boolean}}
   */
  function runBatchChunk(scriptPath, files, timeoutMs) {
    const { spawnSync } = require('child_process');
    const out = { results: new Map(), version: null, error: null, missing: false };
    const r = spawnSync('python3', [scriptPath, '--batch'], {
      input: files.map((f) => JSON.stringify(f)).join('\n') + '\n',
      encoding: 'utf8',
      timeout: timeoutMs,
      maxBuffer: BATCH_MAX_BUFFER,
      windowsHide: true,
    });
    if (r.error && r.error.code === 'ENOENT') { out.missing = true; return out; }
    // Whatever arrived before a crash or timeout is still good: python_ast.py
    // flushes one line per file.
    for (const line of String(r.stdout || '').split('\n')) {
      if (!line) continue;
      let obj;
      try { obj = JSON.parse(line); } catch (_) { continue; }
      if (obj && Array.isArray(obj.version) && obj.version.length >= 2) out.version = `${obj.version[0]}.${obj.version[1]}`;
      else if (obj && typeof obj.path === 'string' && Array.isArray(obj.sigs)) out.results.set(obj.path, obj.sigs);
    }
    if (r.error) out.error = r.error.code || r.error.message;
    else if (r.status !== 0) out.error = r.signal ? `killed by ${r.signal}` : `exit ${r.status}`;
    return out;
  }

  /**
   * Extract many Python files with one `python3` process per chunk instead of one
   * per file, and keep the answers for `tryNativeExtract`. A file an earlier call
   * answered and that has not changed since is not sent again (`sigmap sync` walks
   * the same files twice), and one that call failed on is. Never throws: a chunk
   * that fails costs the files it did not answer their AST pass (they use the regex
   * tier) and one line on stderr.
   *
   * @param {string[]} files - paths; non-Python files are ignored
   * @param {{chunk?: number, timeoutMs?: number}} [opts]
   * @returns {{requested: number, reused: number, served: number, regexTier: number, degraded: number, available: boolean}}
   *   served/regexTier/degraded count the files sent to python3 by THIS call
   */
  function prefetch(files, opts = {}) {
    const summary = { requested: 0, reused: 0, served: 0, regexTier: 0, degraded: 0, available: true };
    try {
      const scriptPath = resolvePythonAstScript();
      if (!scriptPath || !Array.isArray(files)) return summary;
      const chunk = opts.chunk > 0 ? opts.chunk : BATCH_CHUNK;
      const timeoutMs = opts.timeoutMs > 0 ? opts.timeoutMs : BATCH_TIMEOUT_MS;
      // A path holding a line break cannot be told apart from two by a reader of
      // lines, so it keeps the per-file path.
      const wanted = [...new Set(files.filter((f) => typeof f === 'string' && /\.pyw?$/i.test(f) && !/[\r\n]/.test(f))
        .map((f) => path.resolve(f)))];
      summary.requested = wanted.length;
      const list = wanted.filter((f) => {
        const hit = _batched.get(f);
        if (!hit || hit.degraded) return true;
        const now = statKey(f);
        return !(now && now.size === hit.size && now.mtimeMs === hit.mtimeMs);
      });
      summary.reused = wanted.length - list.length;
      let firstError = null;
      for (let i = 0; i < list.length; i += chunk) {
        const part = list.slice(i, i + chunk);
        const stats = part.map(statKey);
        const res = runBatchChunk(scriptPath, part, timeoutMs);
        if (res.missing) {
          // No python3 on PATH is the regex tier by design, not a failure: settle
          // this chunk and every later one without another attempt or a notice.
          summary.available = false;
          for (let j = i; j < list.length; j++) {
            const st = j < i + part.length ? stats[j - i] : statKey(list[j]);
            if (st) _batched.set(list[j], { size: st.size, mtimeMs: st.mtimeMs, sigs: null });
          }
          summary.regexTier += list.length - i;
          break;
        }
        if (res.version) _astVersion = res.version;
        for (let k = 0; k < part.length; k++) {
          if (!stats[k]) continue;
          const sigs = res.results.get(part[k]);
          const settled = sigs !== undefined && sigs.length > 0 ? sigs : null;
          const entry = { size: stats[k].size, mtimeMs: stats[k].mtimeMs, sigs: settled };
          if (sigs === undefined) entry.degraded = true;
          _batched.set(part[k], entry);
          if (settled) summary.served++;
          else if (sigs !== undefined) summary.regexTier++;
          else summary.degraded++;
        }
        if (res.error && !firstError) firstError = res.error;
      }
      if (summary.degraded > 0) {
        console.warn(`[sigmap] python3 AST pass failed for ${summary.degraded} of ${list.length} Python file(s) (${firstError || 'no result'}); they use the regex tier`);
      }
    } catch (_) {
      // A broken pre-pass must never stop generate; the per-file path still works.
      _batched.clear();
    }
    return summary;
  }

  /**
   * The header label for the AST tier, `python@3.9`, or null when no file was
   * served by it this run. Minor version, not patch: the `ast` node shapes the
   * extractor reads change with 3.x releases, not with 3.x.y fixes.
   * @returns {string|null}
   */
  function toolchainLabel() {
    if (!_astServed) return null;
    if (!_astVersion) {
      try {
        const { execFileSync } = require('child_process');
        const v = execFileSync('python3', ['-c', 'import sys; print("%d.%d" % sys.version_info[:2])'], { encoding: 'utf8', timeout: 5000, windowsHide: true });
        if (/^\d+\.\d+$/.test(v.trim())) _astVersion = v.trim();
      } catch (_) {}
    }
    return _astVersion ? `python@${_astVersion}` : null;
  }

  function tryNativeExtract(filePath) {
    const hit = _batched.get(filePath);
    if (hit !== undefined) {
      const now = statKey(filePath);
      if (now && now.size === hit.size && now.mtimeMs === hit.mtimeMs) {
        if (hit.sigs) _astServed = true;
        return hit.sigs;
      }
      _batched.delete(filePath);
    }
    try {
      const { execFileSync } = require('child_process');
      const scriptPath = resolvePythonAstScript();
      if (!scriptPath) return null;
      const result = execFileSync('python3', [scriptPath, filePath], {
        timeout: 5000,
        encoding: 'utf8',
      });
      const sigs = JSON.parse(result.trim());
      if (Array.isArray(sigs) && sigs.length > 0) {
        _astServed = true;
        return sigs;
      }
    } catch (_) {}
    return null;
  }

  /**
   * Extract signatures from Python source code.
   * When a real file path is provided, tries the native Python AST extractor first
   * (more accurate for multiline signatures, stacked decorators, and type annotations).
   * Falls back to the regex approach if Python3 is unavailable or returns no results.
   * @param {string} src - Raw file content
   * @param {string} [filePath] - Optional absolute path to the source file
   * @returns {string[]} Array of signature strings
   */
  function extract(src, filePath) {
    // Prefer native AST extractor when the file exists on disk (#693)
    if (filePath && typeof filePath === 'string') {
      const abs = path.isAbsolute(filePath) ? filePath : path.resolve(filePath);
      if (fs.existsSync(abs)) {
        const native = tryNativeExtract(abs);
        if (native) return native;
      }
    }
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // noComments: strip only # comments, keep docstrings (needed for @decorator detection)
    const noComments = src.replace(/#.*$/gm, '');
    // stripped: also strip docstrings (safe for regex matching). Docstrings are
    // blanked newline-by-newline (non-newline chars → spaces) so character
    // offsets and line numbers stay exact for line anchors.
    const stripped = noComments
      .replace(/"""[\s\S]*?"""/g, (m) => m.replace(/[^\n]/g, ' '))
      .replace(/'''[\s\S]*?'''/g, (m) => m.replace(/[^\n]/g, ' '));
    const srcLines = src.split('\n');

    // Classes
    for (const m of stripped.matchAll(/^class\s+(\w+)(?:\s*\(([^)]*)\))?\s*:/gm)) {
      const className = m[1];
      const baseName = m[2] ? m[2].trim() : '';
      const bodyStart = m.index + m[0].length;
      const clsStart = lineAt(stripped, m.index);
      const clsAnchor = `  :${clsStart}-${pyBlockEnd(srcLines, clsStart)}`;

      // Try @dataclass collapse
      const dcFields = tryExtractDataclassFields(stripped, m.index);
      if (dcFields !== null) {
        sigs.push(`@dataclass ${className}(${dcFields})${clsAnchor}`);
        continue;
      }

      // Try BaseModel/BaseSettings collapse
      if (/(BaseModel|BaseSettings)/.test(baseName)) {
        const bmFields = tryExtractBaseModelFields(stripped, bodyStart);
        if (bmFields) {
          sigs.push(`class ${className}(${baseName}) ${bmFields}${clsAnchor}`);
          continue;
        }
      }

      const baseStr = baseName ? `(${baseName})` : '';
      sigs.push(`class ${className}${baseStr}${clsAnchor}`);

      // Class-level ALL_CAPS constants
      for (const c of extractClassConstants(stripped, bodyStart)) {
        sigs.push(`  ${c}`);
      }

      // Methods
      const methods = extractClassMethods(stripped, bodyStart);
      for (const meth of methods) sigs.push(`  ${meth}`);
    }

    // Top-level functions
    for (const m of stripped.matchAll(/^((?:async\s+)?def\s+(\w+)\s*\(([^)]*)\)(?:\s*->\s*[^:]+)?)\s*:/gm)) {
      if (/^_/.test(m[2])) continue;
      const asyncKw = m[1].trimStart().startsWith('async') ? 'async ' : '';
      const params = normalizeParams(m[3]);
      const retType = extractReturnType(m[1] + ':');
      const retStr = retType ? ` → ${retType}` : '';
      const hint = extractDocHint(src, m[2], m[0]);
      const hintStr = hint ? `  # ${hint}` : '';
      const fnStart = lineAt(stripped, m.index);
      const fnAnchor = `  :${fnStart}-${pyBlockEnd(srcLines, fnStart)}`;
      sigs.push(`${asyncKw}def ${m[2]}(${params})${retStr}${fnAnchor}${hintStr}`);
    }

    // FastAPI router endpoints: @router.METHOD("path") + async def name(...)
    const lines = noComments.split('\n');
    for (let i = 0; i < lines.length - 1; i++) {
      const decLine = lines[i].trim();
      const rm = decLine.match(/^@\w+\.(get|post|put|patch|delete|head)\s*\(\s*['"]([^'"]+)['"]/);
      if (!rm) continue;
      for (let j = i + 1; j < Math.min(i + 6, lines.length); j++) {
        const fl = lines[j].trim();
        const fm = fl.match(/^(?:async\s+)?def\s+(\w+)/);
        if (fm) { const rs = j + 1; sigs.push(`${rm[1].toUpperCase()} ${rm[2]}  →  ${fm[1]}()  :${rs}-${pyBlockEnd(srcLines, rs)}`); break; }
        if (fl && !fl.startsWith('@') && !fl.startsWith('#')) break;
      }
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  function extractClassMethods(stripped, startIndex) {
    const methods = [];
    const lines = stripped.slice(startIndex).split('\n');
    for (const line of lines) {
      if (line.trim() === '') continue;
      const indent = line.match(/^(\s+)/);
      if (!indent) break;
      const m = line.match(/^\s+(?:async\s+)?def\s+(\w+)\s*\(([^)]*)\)(?:\s*->\s*([^:]+))?\s*:/);
      if (m) {
        if (m[1].startsWith('__') && m[1] !== '__init__') continue;
        if (m[1].startsWith('_') && !m[1].startsWith('__')) continue;
        const asyncKw = line.trimStart().startsWith('async') ? 'async ' : '';
        const params = normalizeParams(m[2]).replace(/^self,?\s*/, '').replace(/^cls,?\s*/, '');
        const retType = m[3] ? m[3].trim().replace(/Optional\[([^\]]+)\]/, '$1|None').slice(0, 30) : '';
        const retStr = retType ? ` → ${retType}` : '';
        methods.push(`${asyncKw}def ${m[1]}(${params})${retStr}`);
      }
    }
    return capWithNotice(methods, MEMBER_LIMIT, 'methods');
  }

  function tryExtractDataclassFields(stripped, classIndex) {
    const before = stripped.slice(Math.max(0, classIndex - 120), classIndex);
    if (!/@dataclass/.test(before)) return null;
    const lines = stripped.slice(classIndex).split('\n');
    const fields = [];
    for (const line of lines.slice(1)) {
      if (line.trim() === '') continue;
      if (!line.match(/^\s+/)) break;
      const f = line.match(/^\s+(\w+)\s*:\s*([^=\n]+?)(?:\s*=.*)?$/);
      if (!f) break;
      const isOptional = f[2].includes('Optional') || /=\s*None/.test(line);
      fields.push(isOptional ? `${f[1]}?` : f[1]);
    }
    return fields.length ? fields.join(', ') : null;
  }

  function tryExtractBaseModelFields(stripped, bodyStart) {
    const lines = stripped.slice(bodyStart, bodyStart + 800).split('\n');
    const fields = [];
    let foundFirst = false;
    for (const line of lines) {
      if (line.trim() === '') continue;
      if (foundFirst && !/^\s/.test(line)) break;
      if (!line.match(/^\s{4}\w/)) continue;
      foundFirst = true;
      const f = line.match(/^\s{4}(\w+)\s*(?::\s*([^=\n]+?))?(?:\s*=\s*(.*))?$/);
      if (!f || f[1].startsWith('_') || f[1] === 'class' || f[1] === 'def') continue;
      const isOptional = (f[2] || '').includes('Optional') || f[3] !== undefined;
      fields.push(isOptional ? `${f[1]}?` : `${f[1]}*`);
    }
    return fields.length ? `{${fields.slice(0, 6).join(', ')}}` : null;
  }

  function extractClassConstants(stripped, startIndex) {
    const lines = stripped.slice(startIndex).split('\n');
    const consts = [];
    for (const line of lines) {
      if (!line.match(/^\s+/)) break;
      const c = line.match(/^\s+([A-Z][A-Z0-9_]{2,})\s*=\s*(.+)/);
      if (!c) continue;
      let val = c[2].trim();
      const items = (val.match(/"([^"]+)"/g) || val.match(/'([^']+)'/g) || []);
      if (items.length > 3) val = `[${items[0].replace(/['"]/g, '')}..${items[items.length - 1].replace(/['"]/g, '')}]`;
      if (val.length > 40) val = val.slice(0, 37) + '...';
      consts.push(`${c[1]}=${val}`);
    }
    return consts.slice(0, 3);
  }

  function extractReturnType(sigLine) {
    const m = sigLine.match(/->\s*([^:]+):/);
    if (!m) return '';
    let rt = m[1].trim();
    rt = rt.replace(/Optional\[([^\]]+)\]/, '$1|None');
    return rt.length > 30 ? rt.slice(0, 27) + '...' : rt;
  }

  function normalizeParams(params) {
    if (!params) return '';
    return params.trim()
      .split(',')
      .map((p) => {
        const part = p.trim();
        if (!part) return '';
        const stars = part.match(/^(\*{1,2})/)?.[1] || '';
        const rest = part.slice(stars.length);
        const eqIdx = rest.indexOf('=');
        const noDefault = eqIdx !== -1 ? rest.slice(0, eqIdx).trim() : rest.trim();
        const clean = noDefault
          .replace(/Optional\[([^\]]+)\]/, '$1?')
          .replace(/Union\[([^\]]+),\s*None\]/, '$1?');
        return stars + clean;
      })
      .filter((p) => p && p !== 'self' && p !== 'cls')
      .join(', ');
  }

  function extractDocHint(src, fnName, fnSigLine) {
    if (!src || !fnName || !fnSigLine) return '';
    const escSig = fnSigLine.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
    const re = new RegExp(`^${escSig.replace(/\s+/g, '\\s+')}`, 'm');
    const pos = src.search(re);
    if (pos === -1) return '';
    const afterSig = src.slice(pos + fnSigLine.length, pos + fnSigLine.length + 600);

    // Find first non-empty line after function signature indentation
    const m = afterSig.match(/^\s*\n\s*(?:[rubfRUBF]{0,2})?("""|''')([\s\S]*?)\1/m);
    if (!m) return '';

    const firstLine = m[2]
      .split('\n')
      .map((l) => l.trim())
      .find(Boolean);
    if (!firstLine) return '';

    const sentence = firstLine.split(/[.!?]/)[0].trim();
    return sentence.slice(0, 60);
  }

  /**
   * The identity of the interpreter the AST tier would use: the real path, size and mtime of
   * the first `python3` on PATH, or 'none', and the things that choose which Python a version
   * manager's shim runs (an environment variable, a `.python-version` or `.tool-versions` file in
   * the project). A file extracted under one is not the file extracted under another (the AST
   * tier and the regex tier list different things, and the `ast` node shapes change between 3.x
   * releases), so the extraction cache is keyed by it (#971). Found without starting a process.
   *
   * @param {string} [cwd] - the project, for the version files
   * @returns {string}
   */
  function tierId(cwd) {
    const names = process.platform === 'win32' ? ['python3.exe', 'python3'] : ['python3'];
    let id = 'none';
    find: for (const dir of String(process.env.PATH || '').split(path.delimiter)) {
      if (!dir) continue;
      for (const name of names) {
        try {
          const real = fs.realpathSync(path.join(dir, name));
          const st = fs.statSync(real);
          if (st.isFile()) { id = `${real}:${st.size}:${Math.floor(st.mtimeMs)}`; break find; }
        } catch (_) { /* not in this directory */ }
      }
    }
    if (id === 'none') return id;
    const env = ['PYENV_VERSION', 'VIRTUAL_ENV', 'CONDA_PREFIX', 'ASDF_PYTHON_VERSION', 'UV_PYTHON'].map((k) => process.env[k] || '').join('|');
    let files = '';
    for (const f of ['.python-version', '.tool-versions']) {
      try { files += `|${f}=${fs.readFileSync(path.join(cwd || process.cwd(), f), 'utf8')}`; } catch (_) { /* none */ }
    }
    return `${id}|${env}${files}`;
  }

  /**
   * Whether this run asked python3 for the file and got no answer (the batch failed or timed
   * out): the regex tier served it, but that is the failure's answer, not the AST tier's, so a
   * caller that keeps answers must not keep this one. Absent python3 and a file the AST tier
   * settled as unparseable are settled answers, not this.
   *
   * @param {string} filePath
   * @returns {boolean}
   */
  function wasDegraded(filePath) {
    const hit = _batched.get(path.resolve(filePath));
    return !!(hit && hit.degraded);
  }

  /**
   * A run that serves its Python files from the extraction cache never starts the AST tier,
   * yet the header of a cold run names it (`toolchain=python@3.9`). The label the cold run
   * recorded is restored here so a warm run writes the same header.
   *
   * @param {string|null} label - as returned by toolchainLabel()
   */
  function restoreToolchain(label) {
    const m = /^python@(\d+\.\d+)$/.exec(String(label || ''));
    if (!m) return;
    _astServed = true;
    if (!_astVersion) _astVersion = m[1];
  }

  module.exports = { extract, tryNativeExtract, resolvePythonAstScript, prefetch, toolchainLabel, tierId, wasDegraded, restoreToolchain };
  
};

// ── ./src/extractors/python_dataclass ──
__factories["./src/extractors/python_dataclass"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  /**
   * Extract Python dataclass, Pydantic model, and SQLAlchemy ORM metadata.
   * Focuses on model fields, validation, and relationships.
   *
   * @param {string} src - Raw Python content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Dataclass definitions
    const dataclassRe = /@dataclass(?:\([^)]*\))?[\s\n]+class\s+([A-Z]\w*)/g;
    for (const m of src.matchAll(dataclassRe)) {
      sigs.push(`dataclass ${m[1]}`);
    }

    // Pydantic BaseModel classes
    const pydanticRe = /class\s+([A-Z]\w*)\s*\([^)]*BaseModel[^)]*\)/g;
    for (const m of src.matchAll(pydanticRe)) {
      sigs.push(`model ${m[1]}`);
    }

    // Pydantic v2 model_validate / field definitions
    if (/model_validate|field_validator|computed_field/.test(src)) {
      sigs.push('pydantic v2+');
    }

    // SQLAlchemy model classes
    const sqlalchemyRe = /class\s+([A-Z]\w*)\s*\([^)]*(?:Base|declarative_base)[^)]*\)/g;
    for (const m of src.matchAll(sqlalchemyRe)) {
      sigs.push(`orm ${m[1]}`);
    }

    // Model fields with type hints (for dataclass/Pydantic)
    const fieldRe = /^\s+([a-z_]\w*)\s*:\s*([A-Z]\w*|List|Dict|Optional|Union)[^=]*/gm;
    const fields = new Set();
    for (const m of src.matchAll(fieldRe)) {
      if (fields.size < 15) fields.add(m[1]);
    }
    for (const f of fields) {
      sigs.push(`field ${f}`);
    }

    // SQLAlchemy Column definitions
    const columnRe = /([a-z_]\w*)\s*=\s*Column\s*\([^)]*\)/g;
    for (const m of src.matchAll(columnRe)) {
      sigs.push(`column ${m[1]}`);
    }

    // Relationships (SQLAlchemy ForeignKey, relationship)
    const relRe = /(?:ForeignKey|relationship)\s*\(\s*['"]([a-zA-Z_]\w*)['"]/g;
    for (const m of src.matchAll(relRe)) {
      sigs.push(`relation ${m[1]}`);
    }

    // Validators (@validator, @field_validator)
    const validatorRe = /@(?:validator|field_validator)\s*\(\s*['"]?([a-z_]\w*)(?:['"]|,|\s|\))/g;
    const validators = new Set();
    for (const m of src.matchAll(validatorRe)) {
      validators.add(m[1]);
    }
    for (const v of validators) {
      sigs.push(`validator ${v}`);
    }

    // Config class (Pydantic v1 / SQLAlchemy)
    if (/class\s+Config\s*:/.test(src)) {
      sigs.push('config-class');
    }

    return capWithNotice(Array.from(new Set(sigs)), 200, 'signatures');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/r ──
__factories["./src/extractors/r"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from R source code.
   *
   * Recognised constructs:
   *   - Function definitions: `name <- function(args)`, `name = function(args)`,
   *     `name <<- function(args)`
   *   - S4: setClass / setGeneric / setMethod
   *   - R6: `Name <- R6Class("Name", public = list(method = function(...)))`
   *   - S7: `Name <- new_class("Name", ...)` and `method(generic, Name) <- function(...)`
   *   - roxygen2 docstring hint (first non-tag `#'` line) appended as `  # hint`
   *
   * The extractor stays regex-only and zero-dependency. Output uses two-space
   * indentation for class members (matching python/typescript/scala fixtures).
   *
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Collect roxygen2 hints from the original source (before stripping `#`).
    const docHints = collectRoxygenHints(src);

    // Strip line comments for the rest of the parsing. R uses `#` comments and
    // roxygen2 `#'` is consumed alongside them — its content already lives in
    // docHints.
    const stripped = src.replace(/#.*$/gm, '');

    // Track byte ranges already accounted for by R6 / setClass blocks so the
    // top-level function regex doesn't re-emit their methods as bare functions.
    const consumedRanges = [];

    // ── R6 classes ────────────────────────────────────────────────────────────
    //   ClassName <- R6Class("ClassName", public = list(method = function(...)))
    //   ClassName <- R6::R6Class(...)
    const r6Re = /([\w.]+)\s*(?:<<-|<-|=)\s*(?:R6::)?R6Class\s*\(/g;
    let m;
    while ((m = r6Re.exec(stripped)) !== null) {
      const name = m[1];
      if (name.startsWith('.')) continue;
      const openIdx = r6Re.lastIndex - 1;
      const body = readBalancedParens(stripped, openIdx);
      if (body === null) continue;
      const closeIdx = openIdx + body.length + 1;
      const classNameLit = readFirstStringArg(body) || name;
      sigs.push(`${name} <- R6Class("${classNameLit}")` + applyHint(docHints, name));
      for (const memberSig of extractListMethods(body, 8)) {
        sigs.push('  ' + memberSig);
      }
      consumedRanges.push([m.index, closeIdx]);
      r6Re.lastIndex = closeIdx;
    }

    // ── S7 classes ────────────────────────────────────────────────────────────
    //   ClassName <- new_class("ClassName", properties = list(...))
    const s7Classes = new Set();
    const s7Re = /([\w.]+)\s*(?:<<-|<-|=)\s*(?:S7::)?new_class\s*\(/g;
    while ((m = s7Re.exec(stripped)) !== null) {
      const name = m[1];
      if (name.startsWith('.')) continue;
      const openIdx = s7Re.lastIndex - 1;
      const body = readBalancedParens(stripped, openIdx);
      if (body === null) continue;
      const closeIdx = openIdx + body.length + 1;
      const classNameLit = readFirstStringArg(body) || name;
      s7Classes.add(classNameLit);
      s7Classes.add(name);
      sigs.push(`${name} <- new_class("${classNameLit}")` + applyHint(docHints, name));
      consumedRanges.push([m.index, closeIdx]);
      s7Re.lastIndex = closeIdx;
    }

    // S7 method dispatch: `method(generic, ClassName) <- function(args)`
    const s7MethodRe = /^[ \t]*method\s*\(\s*([\w.]+)\s*,\s*([\w.]+)\s*\)\s*(?:<<-|<-|=)\s*function\s*\(/gm;
    while ((m = s7MethodRe.exec(stripped)) !== null) {
      if (!s7Classes.has(m[2])) continue;
      const argsStart = s7MethodRe.lastIndex - 1;
      const args = readBalancedParens(stripped, argsStart);
      if (args === null) continue;
      sigs.push(`  method(${m[1]}, ${m[2]}) <- function(${normalizeParams(args)})`);
    }

    // ── Top-level function definitions ────────────────────────────────────────
    //   name <- function(args), name = function(args), name <<- function(args)
    // Skip matches whose position falls inside an R6/S7 class body — those have
    // already been emitted as indented members.
    const funcRe = /^(?:[ \t]*)([\w.]+)\s*(?:<<-|<-|=)\s*function\s*\(/gm;
    while ((m = funcRe.exec(stripped)) !== null) {
      const name = m[1];
      if (name.startsWith('.')) continue;
      if (inAnyRange(m.index, consumedRanges)) continue;
      const argsStart = funcRe.lastIndex - 1;
      const args = readBalancedParens(stripped, argsStart);
      if (args === null) continue;
      sigs.push(`${name} <- function(${normalizeParams(args)})` + applyHint(docHints, name));
    }

    // ── S4 ────────────────────────────────────────────────────────────────────
    for (const sm of stripped.matchAll(/^[ \t]*setGeneric\s*\(\s*["']([\w.]+)["']/gm)) {
      sigs.push(`setGeneric("${sm[1]}")`);
    }
    for (const sm of stripped.matchAll(/^[ \t]*setMethod\s*\(\s*["']([\w.]+)["']\s*,\s*["']([\w.]+)["']/gm)) {
      sigs.push(`setMethod("${sm[1]}", "${sm[2]}")`);
    }
    for (const sm of stripped.matchAll(/^[ \t]*setClass\s*\(\s*["']([\w.]+)["']/gm)) {
      sigs.push(`setClass("${sm[1]}")`);
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /**
   * Collect roxygen2 docstring hints from the original (uncommented) source.
   * Returns Map<symbolName, hint> where hint is the first @title line, else
   * @description, else the first non-tag content line. Trimmed to 60 chars,
   * trailing punctuation removed.
   */
  function collectRoxygenHints(src) {
    const hints = new Map();
    const lines = src.split('\n');
    let block = [];
    for (let i = 0; i < lines.length; i++) {
      const line = lines[i];
      if (/^\s*#'/.test(line)) {
        block.push(line.replace(/^\s*#'\s?/, ''));
        continue;
      }
      if (block.length > 0) {
        const m = line.match(/^[ \t]*([\w.]+)\s*(?:<<-|<-|=)\s*(?:R6::)?R6Class\b/)
               || line.match(/^[ \t]*([\w.]+)\s*(?:<<-|<-|=)\s*(?:S7::)?new_class\b/)
               || line.match(/^[ \t]*([\w.]+)\s*(?:<<-|<-|=)\s*function\b/);
        if (m) {
          const name = m[1];
          let hint = pickRoxygenLine(block, '@title')
                  || pickRoxygenLine(block, '@description')
                  || pickRoxygenLine(block, null);
          if (hint) {
            hint = hint.replace(/\s+/g, ' ').trim().slice(0, 60).replace(/[.,;:!?]+$/, '').trim();
            if (hint) hints.set(name, hint);
          }
        }
        block = [];
      }
    }
    return hints;
  }

  function pickRoxygenLine(block, tag) {
    for (const raw of block) {
      const b = raw.trim();
      if (!b) continue;
      if (tag) {
        if (b.startsWith(tag)) {
          const rest = b.slice(tag.length).trim();
          if (rest) return rest;
        }
      } else if (!b.startsWith('@')) {
        return b;
      }
    }
    return null;
  }

  function applyHint(hints, name) {
    const h = hints.get(name);
    return h ? `  # ${h}` : '';
  }

  /**
   * Extract method-like entries from the body of an R6/S7 list(...) argument.
   * Matches `name = function(args)` at any indentation. Caps at `cap` entries.
   */
  function extractListMethods(body, cap) {
    const out = [];
    const re = /(?:^|[\n,])\s*([\w.]+)\s*=\s*function\s*\(/g;
    let m;
    while ((m = re.exec(body)) !== null && out.length < cap) {
      const name = m[1];
      if (name.startsWith('.')) continue;
      const argsStart = re.lastIndex - 1;
      const args = readBalancedParens(body, argsStart);
      if (args === null) continue;
      out.push(`${name} <- function(${normalizeParams(args)})`);
    }
    return out;
  }

  function inAnyRange(pos, ranges) {
    for (const [s, e] of ranges) {
      if (pos >= s && pos < e) return true;
    }
    return false;
  }

  /** Extract the first quoted string from a comma-separated argument body. */
  function readFirstStringArg(body) {
    const m = body.match(/^\s*["']([\w.]+)["']/);
    return m ? m[1] : null;
  }

  /**
   * Read a parenthesis-balanced substring starting at the position of the
   * opening '(' character, returning the inner content (without the outer
   * parens). Returns null if no matching close paren is found within `cap`
   * characters, which guards against runaway scans on malformed input.
   */
  function readBalancedParens(src, openIdx, cap = 16384) {
    if (src[openIdx] !== '(') return null;
    let depth = 1;
    let i = openIdx + 1;
    const end = Math.min(src.length, openIdx + cap);
    let inString = null;
    while (i < end) {
      const ch = src[i];
      if (inString) {
        if (ch === '\\') { i += 2; continue; }
        if (ch === inString) inString = null;
        i++;
        continue;
      }
      if (ch === '"' || ch === "'") { inString = ch; i++; continue; }
      if (ch === '(') depth++;
      else if (ch === ')') {
        depth--;
        if (depth === 0) return src.slice(openIdx + 1, i);
      }
      i++;
    }
    return null;
  }

  /**
   * Compress whitespace inside a parameter list, collapse multi-line default
   * expressions onto a single line, and trim. String literals are protected so
   * that commas/equals inside default values like `sep = ","` don't get respaced.
   */
  function normalizeParams(raw) {
    let out = '';
    let inString = null;
    for (let i = 0; i < raw.length; i++) {
      const ch = raw[i];
      if (inString) {
        out += ch;
        if (ch === '\\' && i + 1 < raw.length) { out += raw[i + 1]; i++; continue; }
        if (ch === inString) inString = null;
        continue;
      }
      if (ch === '"' || ch === "'") { inString = ch; out += ch; continue; }
      if (/\s/.test(ch)) {
        if (out.length && !/\s$/.test(out)) out += ' ';
        continue;
      }
      if (ch === ',') {
        out = out.replace(/\s+$/, '') + ', ';
        continue;
      }
      if (ch === '=') {
        out = out.replace(/\s+$/, '') + ' = ';
        continue;
      }
      out += ch;
    }
    return out.trim();
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/ruby ──
__factories["./src/extractors/ruby"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');
  const { readBalanced } = __require('./src/extractors/scan');
  const { withAnchor } = __require('./src/extractors/line-anchor');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from Ruby source code.
   *
   * Classes and modules are found at any indentation and listed by the name the
   * source gives them (`class BadRequest`, not `ActionController::BadRequest`:
   * the symbol lookups downstream read the name after `class`, as they do for
   * the Python and Java extractors); every `def` is listed under the innermost
   * class or module that owns it (#981). Two classes of one name in different
   * namespaces stay two entries. Ownership comes from block depth: the source is
   * masked (comments, strings, heredocs, regexps, %-literals) and `end` is
   * matched against the keywords that open a block.
   *
   * Every signature carries the `:start-end` lines of its definition (#975): the
   * line of the `class` / `module` / `def` keyword and the line of the `end` that
   * the same depth count closes it with. A class reopened elsewhere is one entry,
   * anchored to its first opening; an endless `def f = x` ends on its own line.
   *
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];

    const { plain, code } = maskRuby(src);
    const owners = scanOwners(plain, code);

    const sigs = [];
    for (const o of owners) {
      if (o.kind) sigs.push(withAnchor(`${o.kind} ${o.name}`, o.start, o.end));
      for (const m of o.members) sigs.push(withAnchor(m.text, m.start, m.end));
    }
    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  // ── Masking ──────────────────────────────────────────────────────────────────

  const OPEN_FOR = { '(': ')', '[': ']', '{': '}', '<': '>' };

  /**
   * Length- AND newline-preserving masks (a deleting strip would desynchronise
   * the offsets the balanced reader walks, #695).
   *
   * `plain` has comments blanked and strings kept: the text parameters are read
   * from. `code` also blanks string, heredoc, regexp and %-literal contents and
   * `=begin`/`=end` blocks, so every keyword left in it is structural.
   */
  function maskRuby(src) {
    const n = src.length;
    const plain = src.split('');
    const code = src.split('');
    const blank = (arr, from, to) => { for (let k = from; k < to && k < n; k++) if (arr[k] !== '\n') arr[k] = ' '; };
    const blankBoth = (from, to) => { blank(plain, from, to); blank(code, from, to); };
    const lineEnd = (from) => { const e = src.indexOf('\n', from); return e === -1 ? n : e; };

    // The last non-blank character of `code` before `i`, and the word it ends
    // with, to tell a value position (`x = /re/`) from an operator (`a / b`).
    const prevSig = (i) => {
      let k = i - 1;
      while (k >= 0 && (code[k] === ' ' || code[k] === '\t')) k--;
      if (k < 0 || code[k] === '\n') return { ch: '', word: '', gap: false };
      let w = k;
      while (w >= 0 && /\w/.test(code[w])) w--;
      return { ch: code[k], word: code.slice(w + 1, k + 1).join(''), gap: k < i - 1 };
    };
    const VALUE_AFTER = new Set(['=', '(', ',', '[', '{', ';', ':', '!', '&', '|', '?', '~', '+', '-', '*', '<', '>', '^', '%', '']);
    const VALUE_WORDS = new Set(['when', 'if', 'unless', 'and', 'or', 'not', 'return', 'then', 'elsif', 'while', 'until', 'puts', 'in', 'case']);
    const inValuePosition = (i) => {
      const p = prevSig(i);
      return VALUE_AFTER.has(p.ch) || VALUE_WORDS.has(p.word);
    };

    // Double-quoted (and backtick) strings: `#{...}` may nest quotes and braces.
    const skipInterp = (i) => {
      let depth = 1;
      while (i < n && depth > 0) {
        const c = src[i];
        if (c === '$' && /[^\w\s]/.test(src[i + 1] || ' ')) { i += 2; continue; } // $` $' $" are globals
        if (c === '{') depth++;
        else if (c === '}') depth--;
        else if (c === '"' || c === '`') { i = skipDq(i + 1, c); continue; }
        else if (c === "'") { i = skipSq(i + 1); continue; }
        i++;
      }
      return i;
    };
    const skipDq = (i, q) => {
      while (i < n && src[i] !== q) {
        if (src[i] === '\\') i += 2;
        else if (src[i] === '#' && src[i + 1] === '{') i = skipInterp(i + 2);
        else i++;
      }
      return i + 1;
    };
    const skipSq = (i) => {
      while (i < n && src[i] !== "'") i += src[i] === '\\' ? 2 : 1;
      return i + 1;
    };

    const heredocs = []; // pending on the current line: { id, indented, raw }
    let i = 0;
    while (i < n) {
      const c = src[i];
      const atLineStart = i === 0 || src[i - 1] === '\n';

      if (atLineStart) {
        if (src.startsWith('=begin', i) && /[\s]|$/.test(src[i + 6] || '\n')) {
          const m = /^=end\b[^\n]*/m.exec(src.slice(i));
          const stop = m ? i + m.index + m[0].length : n;
          blankBoth(i, stop);
          i = stop;
          continue;
        }
        if (src.startsWith('__END__', i) && (i + 7 >= n || src[i + 7] === '\n' || src[i + 7] === '\r')) {
          blankBoth(i, n);
          break;
        }
      }

      if (c === '\n' && heredocs.length) {
        // The bodies start on the next line and run to each terminator in turn.
        let pos = i + 1;
        for (const h of heredocs) {
          while (pos < n) {
            const e = lineEnd(pos);
            const text = src.slice(pos, e).replace(/\r$/, '');
            blank(code, pos, e);
            const done = (h.indented ? text.trim() : text) === h.id;
            pos = Math.min(n, e + 1);
            if (done) break;
          }
        }
        heredocs.length = 0;
        i = pos;
        continue;
      }

      if (c === '$' && /[^\w\s]/.test(src[i + 1] || ' ')) {
        // A special global (`$'`, `$"`, `\$\``, `$/`, `$;`) is not the start of a string.
        i += 2;
        continue;
      }

      if (c === '#') {
        const e = lineEnd(i);
        blankBoth(i, e);
        i = e;
        continue;
      }
      if (c === "'") {
        const e = skipSq(i + 1);
        blank(code, i + 1, e - 1);
        i = e;
        continue;
      }
      if (c === '"' || c === '`') {
        const e = skipDq(i + 1, c);
        blank(code, i + 1, e - 1);
        i = e;
        continue;
      }
      if (c === '<' && src[i + 1] === '<') {
        const m = /^<<([~-]?)(["'`]?)([A-Za-z_]\w*)\2/.exec(src.slice(i, i + 80));
        const before = code.slice(Math.max(0, i - 60), i).join('');
        const lineStartText = code.slice(src.lastIndexOf('\n', i - 1) + 1, i).join('');
        const isClassSelf = /^\s*class\s*$/.test(lineStartText);
        const squiggly = m && (m[1] === '~' || m[1] === '-');
        const bare = m && !m[1] && !m[2] && /^[A-Z_][A-Z0-9_]*$/.test(m[3]);
        if (m && !isClassSelf && !/\w$/.test(before) && (squiggly || (bare && inValuePosition(i)))) {
          heredocs.push({ id: m[3], indented: !!m[1] });
          i += m[0].length;
          continue;
        }
        i += 2;
        continue;
      }
      if (c === '%') {
        const m = /^%([qQwWiIrsx]?)([(\[{<|!\/^~@#$&*+=;,.:?-])/.exec(src.slice(i, i + 3));
        const p = prevSig(i);
        // `%w[a b]`, `%{...}`, `%(...)`: after an operator, or as a call's argument (`assert_dom_equal %{<a/>}`).
        const literal = m && (m[1] || OPEN_FOR[m[2]]) && (inValuePosition(i) || (p.gap && /\w/.test(p.ch)));
        if (literal) {
          const open = m[2];
          const close = OPEN_FOR[open] || open;
          let j = i + m[0].length;
          let depth = 1;
          while (j < n && depth > 0) {
            if (src[j] === '\\') { j += 2; continue; }
            if (OPEN_FOR[open] && src[j] === open) depth++;
            else if (src[j] === close) depth--;
            j++;
          }
          blank(code, i + m[0].length, j - 1);
          i = j;
          continue;
        }
        i++;
        continue;
      }
      // `:/` is the operator symbol (`calculate(:/, other)`, `send(:/, x)`), not the start of a regexp;
      // `::/` cannot occur, so a single `:` before the slash is enough to tell.
      if (c === '/' && inValuePosition(i) && !(src[i - 1] === ':' && src[i - 2] !== ':')) {
        // Where a value is expected `/` cannot be division, so this is a regexp
        // literal. Under /x it may span lines (Rails' CONTENT_TYPE_PARSER does),
        // and a `/` inside a [...] class does not close it.
        let j = i + 1;
        let inClass = false;
        const stop = Math.min(n, i + 4000);
        for (; j < stop; j++) {
          const ch = src[j];
          if (ch === '\\') { j++; continue; }
          if (ch === '[') inClass = true;
          else if (ch === ']') inClass = false;
          else if (ch === '/' && !inClass) break;
        }
        if (src[j] === '/' && j < stop) {
          blank(code, i + 1, j);
          i = j + 1;
          continue;
        }
      }
      i++;
    }
    return { plain: plain.join(''), code: code.join('') };
  }

  // ── Structure ────────────────────────────────────────────────────────────────

  // Keywords that open or close a block. Not preceded by `.`/`:`/`@`/`$` (a
  // method call, symbol or variable), not a hash key (`if: 1`) and not the name
  // in `def end` / `def begin`.
  const KEYWORD = /(?<![\w.:@$])(?<!\bdef\s+)(class|module|def|if|unless|while|until|case|for|begin|do|end)(?![\w?!]|:(?!:))/g;

  // `before` is the text ahead of an `if`/`unless`/`while`/`until` on its line.
  // The keyword opens a block at the start of a statement or an assignment's
  // right-hand side; anywhere else it is a modifier (`x if y`, `return if y`).
  const OPENS_AFTER = /(?:^|[;(\[{|,]|(?:^|[^=!<>~])=|[-+*/%|&^]=|\|\|=|&&=|<<=|>>=|<<|&&|\|\||=>|\b(?:then|else|do|begin|ensure|and|or|not))$/;
  function opensBlock(before) {
    const t = before.trimEnd();
    return !ENDS_IN_SYMBOL.test(t) && OPENS_AFTER.test(t);
  }
  // A symbol literal is a finished value even when it ends in `=` (`alias_method :a, :[]= unless x`,
  // `attr_writer :b= if y`): what follows it is a modifier, not an assignment's right-hand side.
  const ENDS_IN_SYMBOL = /(?:^|[^:\w]):(?:\[\]=?|[A-Za-z_\u0080-\uFFFF][\w\u0080-\uFFFF]*[?!=]?)$/;

  // Identifiers may be non-ASCII (Sidekiq defines `def ❤`).
  const METHOD_NAME = /^(?:(self|[A-Za-z_]\w*)\.)?([A-Za-z_\u0080-\uFFFF][\w\u0080-\uFFFF]*[?!=]?|\[\]=?|<=>|===?|=~|!=|!~|\*\*|<<|>>|<=|>=|[+\-*/%<>!~^&|]@?|`)/;

  /**
   * Walk the masked source and return the owners in the order they open:
   * `{ kind, name, full, start, end, members }` (`name` as written, `full` the lexical
   * path that tells two same-named classes apart, `start`/`end` the 1-based lines of its
   * first opening), with the owner-less top-level defs last as `{ kind: null, members }`.
   * A member is `{ text, start, end }`.
   */
  function scanOwners(plain, code) {
    const owners = [];
    const byKey = new Map();
    const root = { kind: null, name: '', full: '', members: [] };
    // { type: 'class'|'module'|'sclass'|'def'|'block', owner?, self?, claims?: {start,end} to close with `end` }
    const frames = [];

    const ownerFrame = () => {
      for (let k = frames.length - 1; k >= 0; k--) {
        if (frames[k].type === 'class' || frames[k].type === 'module' || frames[k].type === 'sclass') return frames[k];
      }
      return null;
    };
    const namedFrame = () => {
      for (let k = frames.length - 1; k >= 0; k--) {
        if (frames[k].type === 'class' || frames[k].type === 'module') return frames[k];
      }
      return null;
    };
    const open = (kind, full, name, line) => {
      const key = `${kind} ${full}`;
      let o = byKey.get(key);
      if (!o) { o = { kind, name, full, start: line, end: line, members: [] }; byKey.set(key, o); owners.push(o); o.fresh = true; }
      return o;
    };

    let lineStart = 0;
    let lineNo = 1;
    while (lineStart <= code.length) {
      let lineEnd = code.indexOf('\n', lineStart);
      if (lineEnd === -1) lineEnd = code.length;
      const text = code.slice(lineStart, lineEnd);
      let loopDo = false;

      KEYWORD.lastIndex = 0;
      let m;
      while ((m = KEYWORD.exec(text)) !== null) {
        const kw = m[1];
        const col = m.index;
        const abs = lineStart + col;

        if (kw === 'end') {
          const closed = frames.pop();
          if (closed && closed.claims) closed.claims.end = lineNo;
        } else if (kw === 'class' || kw === 'module') {
          const rest = text.slice(col + kw.length);
          const sc = kw === 'class' ? /^\s*<<\s*(\w+)/.exec(rest) : null;
          const nm = sc ? null : /^\s+(::)?([A-Z]\w*(?:::[A-Z]\w*)*)/.exec(rest);
          if (!sc && !nm) continue;
          const parent = namedFrame();
          if (sc) {
            frames.push({ type: 'sclass', owner: parent ? parent.owner : null, self: sc[1] === 'self' });
          } else {
            const full = nm[1] || !parent ? nm[2] : `${parent.owner.full}::${nm[2]}`;
            const o = open(kw, full, nm[2], lineNo);
            // Only the first opening of a class is anchored; later ones add members under it.
            const claims = o.fresh ? o : null;
            o.fresh = false;
            frames.push({ type: kw, owner: o, claims });
          }
        } else if (kw === 'def') {
          const rest = code.slice(abs + 3, abs + 3 + 120);
          const lead = /^\s+/.exec(rest);
          const nm = lead && METHOD_NAME.exec(rest.slice(lead[0].length));
          // A def whose name this scan cannot read still opens a block that an `end`
          // will close, so it must be counted or the owner is popped too early.
          if (!nm) { frames.push({ type: 'def' }); continue; }
          const nameStart = abs + 3 + lead[0].length;
          const afterName = nameStart + nm[0].length;
          let paramsEnd = afterName;
          let params = '';
          let k = afterName;
          while (code[k] === ' ' || code[k] === '\t') k++;
          if (code[k] === '(') {
            const close = readBalanced(code, k);
            if (close >= 0) {
              params = `(${normalizeParams(plain.slice(k + 1, close))})`;
              paramsEnd = close + 1;
            }
          }
          // `def name(args) = expr` has no `end` to wait for.
          let e = paramsEnd;
          while (code[e] === ' ' || code[e] === '\t') e++;
          const endless = code[e] === '=' && !/[=~>]/.test(code[e + 1] || '');
          const member = { text: '', start: lineNo, end: lineNo };
          if (!endless) frames.push({ type: 'def', claims: member });

          const bare = nm[2];
          if (bare.startsWith('_')) continue;
          const ownerF = ownerFrame();
          const owner = ownerF ? ownerF.owner : null;
          const singleton = nm[1] ? `${nm[1]}.` : (ownerF && ownerF.type === 'sclass' && ownerF.self ? 'self.' : '');
          const ls = code.lastIndexOf('\n', abs - 1) + 1;
          member.text = `${owner ? '  ' : ''}def ${singleton}${bare}${params}${extractReturnHint(plain, ls)}`;
          (owner || root).members.push(member);
        } else if (kw === 'if' || kw === 'unless' || kw === 'while' || kw === 'until') {
          if (opensBlock(text.slice(0, col))) {
            frames.push({ type: 'block' });
            if (kw === 'while' || kw === 'until') loopDo = true;
          }
        } else if (kw === 'for') {
          frames.push({ type: 'block' });
          loopDo = true;
        } else if (kw === 'case' || kw === 'begin') {
          frames.push({ type: 'block' });
        } else if (kw === 'do') {
          if (loopDo) loopDo = false;
          else frames.push({ type: 'block' });
        }
      }
      lineStart = lineEnd + 1;
      lineNo++;
    }

    // A block the depth count never closed (input that stops early, or a construct the masking
    // misread) runs to the last line of the file; the empty piece after a final newline is not a line.
    const lastLine = code.endsWith('\n') ? lineNo - 2 : lineNo - 1;
    for (const f of frames) {
      if (f.claims) f.claims.end = Math.max(f.claims.start, lastLine);
    }

    return owners.concat(root.members.length ? [root] : []);
  }

  function normalizeParams(params) {
    if (!params) return '';
    return params.trim().replace(/\s+/g, ' ');
  }

  function extractReturnHint(stripped, index) {
    const start = Math.max(0, index - 180);
    const before = stripped.slice(start, index);
    const m = before.match(/sig\s*\{[\s\S]*?returns\(([^)]+)\)[\s\S]*?\}\s*$/);
    if (!m) return '';
    const type = m[1].trim().replace(/\s+/g, ' ').slice(0, 25);
    return type ? ` → ${type}` : '';
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/rust ──
__factories["./src/extractors/rust"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  // Class bodies are scanned to this many characters. Real classes routinely
  // run past the old 4KB scan window — truncating there silently hid every
  // member after ~4000 chars AND anchored class end-lines short (#576). The
  // ceiling only guards against pathological input (Java parity, #551).
  const MAX_CLASS_BODY_CHARS = 200000;
  const PER_FILE_LIMIT = 200;

  // Chars scanned past the params for a `-> Return` before giving up.
  const RET_SCAN_CHARS = 400;

  // Per-impl member ceiling, disclosed via capMembersWithNotice (#576).
  const MEMBER_LIMIT = 120;

  /**
   * Extract signatures from Rust source code.
   * Signatures carry `:start-end` line anchors (Surgical Context); the comment
   * strip below is newline-preserving so anchor lines match the original file.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];
    const docHints = buildDocHints(src);
    // Append the doc-comment hint after the anchor as `  # <hint>` — same
    // convention as the Python/JS extractors' doc hints.
    const hinted = (sig, name) => (docHints.has(name) ? `${sig}  # ${docHints.get(name)}` : sig);

    // stripComments is length- AND newline-preserving; the previous regex strip
    // DELETED comment text, so offsets computed on it no longer aligned with the
    // masked surface the balanced reader walks (#695).
    const stripped = stripComments(src);
    // Rust lifetimes (`&'db`, `<'_>`, `'static`) start with a single quote, which
    // maskCode reads as a CHAR-LITERAL opener. That desynchronised the mask, so
    // readBalanced failed and the whole declaration was dropped — 208 signatures
    // on rust-analyzer, every one of them lifetime-annotated. Blanked on the mask
    // surface only, length-preserving, so the rendered signature keeps them.
    const masked = maskCode(blankLifetimes(src));

    // Anchor range for a declaration at declIdx whose header ends at afterIdx:
    // if a `{` body follows, range to its closing brace; else single-line.
    const rangeFor = (declIdx, afterIdx) => {
      let k = afterIdx;
      while (k < stripped.length && /[ \t]/.test(stripped[k])) k++;
      if (stripped[k] === '{') {
        const end = k + 1 + extractBlock(stripped, k + 1).length;
        return [lineAt(stripped, declIdx), lineAt(stripped, end)];
      }
      const line = lineAt(stripped, declIdx);
      return [line, line];
    };

    // Structs
    for (const m of stripped.matchAll(/^pub\s+struct\s+(\w+)(?:<[^{]*>)?/gm)) {
      const [s, e] = rangeFor(m.index, m.index + m[0].length);
      sigs.push(hinted(withAnchor(`pub struct ${m[1]}`, s, e), m[1]));
    }

    // Enums
    for (const m of stripped.matchAll(/^pub\s+enum\s+(\w+)(?:<[^{]*>)?/gm)) {
      const [s, e] = rangeFor(m.index, m.index + m[0].length);
      sigs.push(hinted(withAnchor(`pub enum ${m[1]}`, s, e), m[1]));
    }

    // Traits
    for (const m of stripped.matchAll(/^pub\s+trait\s+(\w+)(?:<[^{]*>)?/gm)) {
      const [s, e] = rangeFor(m.index, m.index + m[0].length);
      sigs.push(hinted(withAnchor(`pub trait ${m[1]}`, s, e), m[1]));
    }

    // impl blocks
    for (const m of stripped.matchAll(/^impl(?:<[^>]*>)?\s+(?:[\w:]+\s+for\s+)?(\w+)(?:<[^{]*>)?\s*\{/gm)) {
      const bodyStart = m.index + m[0].length;
      const block = extractBlock(stripped, bodyStart);
      sigs.push(withAnchor(`impl ${m[1]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)));
      for (const fn of extractMethods(block, masked.slice(bodyStart, bodyStart + block.length))) {
        sigs.push(hinted(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + (fn.declIdx || 0)), lineAt(stripped, bodyStart + (fn.endIdx || 0))), fn.name));
      }
    }

    // Top-level pub fns — capture everything after ) up to { or ; for return type
    for (const m of stripped.matchAll(/^pub(?:\s+async)?\s+fn\s+(\w+)(?:<[^(]*>)?\s*\(/gm)) {
      const asyncKw = m[0].includes('async') ? 'async ' : '';
      const pr = readParams(stripped, masked, m.index + m[0].length - 1);
      if (!pr) continue;
      const retStr = extractReturnType(pr.after);
      const [s, e] = rangeFor(m.index, pr.end);
      sigs.push(hinted(withAnchor(`pub ${asyncKw}fn ${m[1]}(${normalizeParams(pr.params)})${retStr}`, s, e), m[1]));
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /**
   * Resolve a `fn` declaration's parameter list with a BALANCED read (#695).
   *
   * `\(([^)]*)\)` stopped at the first `)`, so a closure-typed parameter —
   * `b: Box<dyn Fn(i32) -> i32>` — truncated mid-type. The `->` to `→`
   * substitution in `extractReturnType` then fired on the CLOSURE's arrow,
   * leaving the real return arrow as literal `-> i32`, so the rendering stated
   * the return type twice in two notations.
   *
   * @param {string} stripped comment-blanked surface
   * @param {string} masked   comment- AND string-blanked surface (same length)
   * @param {number} openIdx  index of the `(` that opens the params
   * @returns {{ params: string, after: string, end: number }|null}
   */
  /**
   * Blank Rust lifetime tokens so they are not mistaken for char literals.
   *
   * A lifetime is `'` + identifier NOT followed by a closing `'` — which is what
   * distinguishes `&'a` from the char literal `'a'`. Length-preserving.
   * @param {string} src
   * @returns {string}
   */
  function blankLifetimes(src) {
    return src.replace(/'(?:[A-Za-z_][A-Za-z0-9_]*|_)(?!')/g, (m) => ' '.repeat(m.length));
  }

  function readParams(stripped, masked, openIdx) {
    const close = readBalanced(masked, openIdx);
    if (close < 0) return null;
    // Return segment runs from after the params to the body `{` or a `;`.
    let i = close + 1;
    const stop = Math.min(masked.length, i + RET_SCAN_CHARS);
    while (i < stop) {
      const ch = masked[i];
      if (ch === '{' || ch === ';') break;
      if (ch === '(') { const c = readBalanced(masked, i); if (c < 0) break; i = c + 1; continue; }
      if (ch === '<') { const c = readBalanced(masked, i, '<', '>'); if (c < 0) { i++; continue; } i = c + 1; continue; }
      i++;
    }
    // `close` anchors a member to its DECLARATION line; `end` may run onto the
    // next line when the body brace sits there (C# style), which would widen the
    // anchor past the signature itself.
    return { params: stripped.slice(openIdx + 1, close), after: stripped.slice(close + 1, i), end: i, close };
  }

  function extractBlock(src, startIndex) {
    let depth = 1, i = startIndex;
    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (src[i] === '{') depth++;
      else if (src[i] === '}') depth--;
      i++;
    }
    return src.slice(startIndex, i - 1);
  }

  function extractMethods(block, maskedBlock) {
    const methods = [];
    for (const m of block.matchAll(/^[ \t]+pub(?:\s+async)?\s+fn\s+(\w+)(?:<[^(]*>)?\s*\(/gm)) {
      const asyncKw = m[0].includes('async') ? 'async ' : '';
      const pr = readParams(block, maskedBlock, m.index + m[0].length - 1);
      if (!pr) continue;
      const retStr = extractReturnType(pr.after);
      methods.push({
        text: `pub ${asyncKw}fn ${m[1]}(${normalizeParams(pr.params)})${retStr}`,
        name: m[1],
        declIdx: m.index + (m[0].length - m[0].trimStart().length),
        endIdx: pr.end,
      });
    }
    return capMembersWithNotice(methods, MEMBER_LIMIT, 'methods');
  }

  function normalizeParams(params) {
    if (!params) return '';
    return params.trim().replace(/\s+/g, ' ');
  }

  function extractReturnType(afterParen) {
    if (!afterParen) return '';
    const m = afterParen.match(/->\s*([^{;]+)/);
    if (!m) return '';
    const rt = m[1].trim().replace(/\s+/g, ' ');
    return ` → ${rt.length > 30 ? rt.slice(0, 27) + '...' : rt}`;
  }

  // Rustdoc: the `///` block directly above a declaration → first prose
  // sentence, 60-char cap. Runs on the ORIGINAL src (extract strips comments
  // before matching). Attribute lines (`#[...]`) between the doc block and the
  // declaration are tolerated.
  function buildDocHints(src) {
    const hints = new Map();
    const re = /((?:^[ \t]*\/\/\/[^\n]*\n)+)(?:[ \t]*#\[[^\n]*\n)*[ \t]*pub(?:\s+async)?\s+(?:fn|struct|enum|trait)\s+(\w+)/gm;
    for (const m of src.matchAll(re)) {
      const hint = firstDocSentence(m[1]);
      if (hint && !hints.has(m[2])) hints.set(m[2], hint);
    }
    return hints;
  }

  // First prose line of a `///` block → first sentence, 60-char cap.
  function firstDocSentence(block) {
    const line = String(block).split('\n')
      .map((l) => l.replace(/^[ \t]*\/\/\/\s?/, '').trim())
      .find((l) => l);
    if (!line) return '';
    return line.split(/[.!?]/)[0].trim().slice(0, 60);
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/scala ──
__factories["./src/extractors/scala"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');

  // Ceilings sit above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed
  // — an undisclosed cap looks like a class that simply has eight methods (#576).
  // Class bodies are scanned to this many characters. Real classes routinely
  // run past the old 4KB scan window — truncating there silently hid every
  // member after ~4000 chars AND anchored class end-lines short (#576). The
  // ceiling only guards against pathological input (Java parity, #551).
  const MAX_CLASS_BODY_CHARS = 200000;
  const MEMBER_LIMIT = 120;
  const PER_FILE_LIMIT = 200;

  // Chars scanned past the params for a `: ReturnType` before giving up.
  const RET_SCAN_CHARS = 400;

  /** Keywords that mean the header ended without a body — see `bodyBraceFor`. */
  const DECL_KEYWORDS = /\b(?:class|trait|object|def|val|var|case)\b/;

  /**
   * Extract signatures from Scala source code.
   *
   * Migrated onto the shared balanced scanner (G4, #695), the same treatment
   * Kotlin received. Four defects came from doing this with regex alone:
   *
   *   1. `\(([^)]*)\)` stopped at the FIRST `)`, so a nested call in a default —
   *      `def f(a: Int = g(1, 2))` — captured `a: Int = g(1` and the
   *      comma-splitting `normalizeParams` rendered `def f(a, 2)`: a
   *      plausible-looking signature with an invented parameter.
   *   2. Scala generics use SQUARE brackets, which the splitter did not track, so
   *      `def f(m: Map[String, List[Int]])` rendered as the two params
   *      `m` and `List[Int]]` — an unbalanced type fragment.
   *   3. `(?:[^{]*)\{` on the type header matched NEWLINES, so a body-less
   *      `case class A(...)` walked past the blank line into the next
   *      declaration and adopted ITS body — reporting A with B's members while
   *      B vanished (#738). Misattribution, not truncation.
   *   4. Multiple parameter lists (currying) were dropped after the first, and
   *      with them the return type: `def f(a: Int)(b: Int): Int` rendered
   *      `def f(a)` with no `→`.
   *
   * Signatures carry `:start-end` line anchors (Surgical Context); both scan
   * surfaces are length- and newline-preserving so anchors match the original.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // stripComments is string-aware; maskCode additionally blanks string
    // contents so every delimiter seen on it is structural. Both preserve
    // length and newlines, so offsets align across both surfaces.
    const stripped = stripComments(src);
    const masked = maskCode(src);

    /**
     * Index of the body `{` belonging to the declaration starting at `from`, or
     * -1 when it has no body. Balanced constructor parens and `[T]` groups are
     * jumped whole; a blank line or a new declaration keyword ends the header,
     * which is what stops `case class A` swallowing the next type (#738).
     */
    const bodyBraceFor = (from) => {
      let i = from;
      const end = Math.min(masked.length, from + RET_SCAN_CHARS);
      while (i < end) {
        const ch = masked[i];
        if (ch === '{') return i;
        if (ch === '(') { const c = readBalanced(masked, i); if (c < 0) return -1; i = c + 1; continue; }
        if (ch === '[') { const c = readBalanced(masked, i, '[', ']'); if (c < 0) return -1; i = c + 1; continue; }
        if (ch === '\n') {
          const nl = masked.indexOf('\n', i + 1);
          const nextLine = masked.slice(i + 1, nl < 0 ? end : nl);
          if (!nextLine.trim()) return -1;
          // `extends`/`with` continuations are part of this header; a new
          // declaration keyword is not.
          const t = nextLine.trimStart();
          if (DECL_KEYWORDS.test(nextLine) && !/^(?:extends|with)\b/.test(t)) return -1;
          i++;
          continue;
        }
        if (ch === '=' || ch === ';') return -1;
        i++;
      }
      return -1;
    };

    const blockEndIdx = (bodyOpen) => bodyOpen + 1 + extractBlock(stripped, masked, bodyOpen + 1).length;

    // ── Classes, traits, objects ───────────────────────────────────────────────
    for (const m of stripped.matchAll(
      /^[ \t]*(?:(?:final|sealed|abstract|implicit|private|protected)\s+)*(case\s+class|case\s+object|class|trait|object)\s+(\w+)/gm)) {
      const declIdx = m.index + (m[0].length - m[0].trimStart().length);
      const kind = m[1].replace(/\s+/g, ' ');
      const bodyOpen = bodyBraceFor(m.index + m[0].length);
      if (bodyOpen < 0) {
        // No body: a one-line `case class User(id: String)` still names a real
        // type, so it is reported — anchored to its own single line.
        const line = lineAt(stripped, declIdx);
        sigs.push(withAnchor(`${kind} ${m[2]}`, line, line));
        continue;
      }
      const bodyStart = bodyOpen + 1;
      const block = extractBlock(stripped, masked, bodyStart);
      sigs.push(withAnchor(`${kind} ${m[2]}`, lineAt(stripped, declIdx), lineAt(stripped, bodyStart + block.length)));
      // Members of a NESTED type belong to that type, not to this one.
      const scoped = blankNestedTypeBodies(block, masked.slice(bodyStart, bodyStart + block.length),
        /^[ \t]+(?:(?:final|sealed|abstract|implicit|private|protected)\s+)*(?:case\s+class|case\s+object|class|trait|object)\s+\w+/gm);
      // capMembersWithNotice keeps the raised 120-member ceiling DISCLOSED — an
      // undisclosed cap looks like a class that simply has fewer methods (#576).
      const scopedMembers = capMembersWithNotice(
        scanDefs(scoped.block, scoped.masked, /^[ \t]+(?:(?:override|implicit|private|protected|final)\s+)*def\b/gm),
        MEMBER_LIMIT);
      for (const fn of scopedMembers) {
        sigs.push(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + (fn.declIdx || 0)), lineAt(stripped, bodyStart + (fn.endIdx || 0))));
      }
    }

    // ── Top-level defs ─────────────────────────────────────────────────────────
    for (const fn of scanDefs(stripped, masked, /^(?:(?:implicit|private|protected|final)\s+)*def\b/gm)) {
      const line = lineAt(stripped, fn.declIdx);
      sigs.push(withAnchor(fn.text, line, line));
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /**
   * Walk every `def` matched by `headRe`, resolving each parameter list with a
   * balanced read. Multiple lists (currying) are all rendered, so the return
   * type after the last one is no longer lost.
   * @returns {Array<{text:string, declIdx:number, endIdx:number}>}
   */
  function scanDefs(stripped, masked, headRe) {
    const out = [];
    const ws = (i) => { while (masked[i] === ' ' || masked[i] === '\t') i++; return i; };
    for (const m of stripped.matchAll(headRe)) {
      const head = m[0];
      const declIdx = m.index + (head.length - head.trimStart().length);
      let i = ws(m.index + head.length);

      const nameM = /^(?:[A-Za-z_]\w*|[+\-*/<>=!&|^%]+)/.exec(stripped.slice(i, i + 200));
      if (!nameM) continue;
      const name = nameM[0];
      if (name.startsWith('_')) continue;
      i = ws(i + name.length);

      // Method type parameters: `def f[T](a: T)`.
      if (masked[i] === '[') {
        const c = readBalanced(masked, i, '[', ']');
        if (c < 0) continue;
        i = ws(c + 1);
      }

      // One or more parameter lists.
      let lists = '';
      while (masked[i] === '(') {
        const close = readBalanced(masked, i);
        if (close < 0) break;
        lists += `(${normalizeParams(stripped.slice(i + 1, close))})`;
        i = ws(close + 1);
      }

      // `: ReturnType` up to `=`, the body `{`, or end of line.
      let ret = '';
      if (masked[i] === ':') {
        i++;
        const start = i;
        const scanEnd = Math.min(masked.length, i + RET_SCAN_CHARS);
        while (i < scanEnd) {
          const ch = masked[i];
          if (ch === '[') { const c = readBalanced(masked, i, '[', ']'); if (c < 0) break; i = c + 1; continue; }
          if (ch === '(') { const c = readBalanced(masked, i); if (c < 0) break; i = c + 1; continue; }
          if (ch === '=' || ch === '{' || ch === '\n') break;
          i++;
        }
        ret = normalizeType(stripped.slice(start, i));
      }
      const retStr = ret ? ` → ${ret}` : '';
      out.push({ text: `def ${name}${lists}${retStr}`, declIdx, endIdx: i });
    }
    return out;
  }

  // Depth-counted on the MASKED surface (a brace inside a string can no longer
  // open or close a block); content sliced from the stripped surface.
  /**
   * Blank the bodies of NESTED type declarations inside a block, so their members
   * are not also attributed to the enclosing type.
   *
   * Before the scanner migration a nested `trait`/`interface` was never found at
   * all, so this could not arise. Finding them correctly exposed it: a method in
   * `object O { trait T { def inner… } }` was emitted once under O and once under
   * T. Blanking is length- and newline-preserving, so member offsets and line
   * anchors computed on the result still align with the original block.
   * @param {string} block        stripped block text
   * @param {string} maskedBlock  masked block text (same length)
   * @param {RegExp} typeRe       nested-type header matcher (global, multiline)
   * @returns {{ block: string, masked: string }}
   */
  function blankNestedTypeBodies(block, maskedBlock, typeRe) {
    const b = block.split('');
    const mb = maskedBlock.split('');
    const blank = (from, to) => {
      for (let k = from; k < to && k < b.length; k++) {
        if (b[k] !== '\n') b[k] = ' ';
        if (mb[k] !== '\n') mb[k] = ' ';
      }
    };
    for (const m of block.matchAll(typeRe)) {
      // Walk the nested header to its body brace, jumping balanced groups.
      let i = m.index + m[0].length;
      const stop = Math.min(maskedBlock.length, i + RET_SCAN_CHARS);
      let open = -1;
      while (i < stop) {
        const ch = maskedBlock[i];
        if (ch === '{') { open = i; break; }
        if (ch === '(') { const c = readBalanced(maskedBlock, i); if (c < 0) break; i = c + 1; continue; }
        if (ch === '[') { const c = readBalanced(maskedBlock, i, '[', ']'); if (c < 0) break; i = c + 1; continue; }
        if (ch === '\n') {
          const nl = maskedBlock.indexOf('\n', i + 1);
          if (!maskedBlock.slice(i + 1, nl < 0 ? stop : nl).trim()) break;
          i++; continue;
        }
        if (ch === '=' || ch === ';') break;
        i++;
      }
      if (open < 0) continue;
      const close = readBalanced(maskedBlock, open, '{', '}');
      blank(open, close < 0 ? maskedBlock.length : close + 1);
    }
    return { block: b.join(''), masked: mb.join('') };
  }

  function extractBlock(stripped, masked, startIndex) {
    let depth = 1, i = startIndex;
    const end = Math.min(masked.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (masked[i] === '{') depth++;
      else if (masked[i] === '}') depth--;
      i++;
    }
    return stripped.slice(startIndex, i - 1);
  }

  /**
   * Parameter NAMES only, with `: Type` and `= default` dropped.
   *
   * Depth- and string-aware over `()`, `[]` and `{}`. Scala generics use SQUARE
   * brackets, so the old `split(',')` rendered `Map[String, List[Int]]` as two
   * parameters and left an unbalanced `List[Int]]` behind (#695).
   * @param {string} params raw text between the balanced parens
   * @returns {string} `a, b` style list
   */
  function normalizeParams(params) {
    if (!params || !params.trim()) return '';
    const names = [];
    let depth = 0;
    let quote = null;
    let seg = '';
    const flush = () => {
      // Keep `implicit` and other modifiers Scala allows in a param list, which
      // the previous rendering also kept.
      const name = seg.split(/[:=]/)[0].trim().replace(/\s+/g, ' ');
      if (name) names.push(name);
      seg = '';
    };
    for (let i = 0; i < params.length; i++) {
      const ch = params[i];
      if (quote) {
        if (ch === '\\') { i++; continue; }
        if (ch === quote) quote = null;
        continue;
      }
      if (ch === '"' || ch === "'") { quote = ch; continue; }
      if (ch === '(' || ch === '[' || ch === '{') { depth++; continue; }
      if (ch === ')' || ch === ']' || ch === '}') { depth--; continue; }
      if (ch === ',' && depth === 0) { flush(); continue; }
      if (depth === 0) seg += ch;
    }
    flush();
    return names.join(', ');
  }

  function normalizeType(type) {
    if (!type) return '';
    return type.trim().replace(/\s+/g, ' ').slice(0, 25);
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/scan ──
__factories["./src/extractors/scan"] = function(module, exports) {
  
  /**
   * Shared tokenizer-grade scanning core (G4 increment 1, #526).
   *
   * Hand-rolled string/comment state + delimiter depth — generalizes the
   * masking in src/graph/call-graph.js (maskJs) and the balanced reader in the
   * R extractor. NOT a parser, NOT tree-sitter: three small, deterministic,
   * zero-dependency passes that let extractors find real declaration
   * boundaries instead of truncating at the first `)`.
   *
   * All transforms are length- and newline-preserving, so character offsets
   * and line anchors computed on the output align 1:1 with the input.
   */

  /**
   * Words after which a `/` begins a regular expression rather than dividing.
   * An identifier-shaped token anywhere else is an operand, so a `/` after it is
   * division.
   */
  const REGEX_AFTER_WORD = new Set([
    'return', 'typeof', 'instanceof', 'in', 'of', 'new', 'delete', 'void',
    'throw', 'case', 'do', 'else', 'yield', 'await',
  ]);

  /**
   * End (exclusive, flags included) of the regular-expression literal that opens
   * at `i`, or -1 when it is not one. A literal cannot span lines, so a `/` with
   * no closing `/` before the newline — a closing JSX tag, a division in a
   * sentence — is not a regex. Honours `\` escapes and `[...]` classes, where an
   * unescaped `/` does not close the literal.
   */
  function regexEnd(src, i) {
    const n = src.length;
    let j = i + 1;
    let inClass = false;
    while (j < n) {
      const ch = src[j];
      if (ch === '\n') return -1;
      if (ch === '\\') { j += 2; continue; }
      if (inClass) { if (ch === ']') inClass = false; }
      else if (ch === '[') inClass = true;
      else if (ch === '/') {
        j++;
        while (j < n && /[a-z]/i.test(src[j])) j++;
        return j;
      }
      j++;
    }
    return -1;
  }

  /**
   * Advance the JS/TS tokenizer one token past `i`, for anything that is not a
   * comment, string or template: a regular-expression literal, a word, or a
   * punctuator. Returns where it ends and whether the token just read is a value
   * (so a following `/` divides). One step shared by `scan` and `exprEnd`, so the
   * main loop and a `${ }` expression can never disagree about what is a regex.
   */
  function jsToken(src, i, operand) {
    const c = src[i];
    if (c === '/' && !operand && src[i - 1] !== '<') {
      const j = regexEnd(src, i);
      if (j !== -1) return { end: j, operand: true, regex: true };
    }
    if (/[A-Za-z0-9_$]/.test(c)) {
      let j = i + 1;
      while (j < src.length && /[\w$]/.test(src[j])) j++;
      let operand = !REGEX_AFTER_WORD.has(src.slice(i, j));
      if (!operand) {
        // `o.in / 2`: after a `.` a keyword-shaped word is a property name, so a value
        let k = i - 1;
        while (k >= 0 && /\s/.test(src[k])) k--;
        if (src[k] === '.' && src[k - 1] !== '.') operand = true;
      }
      return { end: j, operand };
    }
    if (c === ')' || c === ']') return { end: i + 1, operand: true };
    if ((c === '+' || c === '-') && src[i + 1] === c) return { end: i + 2, operand }; // ++ / -- keep the state
    return { end: i + 1, operand: /\s/.test(c) ? operand : false };
  }

  /**
   * End (exclusive) of the template literal opening at `i`. A `${ ... }` inside
   * it holds ANY expression — including strings, comments and further template
   * literals — so a backtick there does not close the outer template.
   */
  function templateEnd(src, i) {
    const n = src.length;
    let j = i + 1;
    while (j < n) {
      const ch = src[j];
      if (ch === '\\') { j += 2; continue; }
      if (ch === '`') return j + 1;
      if (ch === '$' && src[j + 1] === '{') { j = exprEnd(src, j + 2); continue; }
      j++;
    }
    return n;
  }

  /** End (exclusive) of a `${` expression whose body starts at `j`: just past its matching `}`. */
  function exprEnd(src, j) {
    const n = src.length;
    let depth = 1;
    let operand = false;
    while (j < n) {
      const ch = src[j];
      if (ch === '`') { j = templateEnd(src, j); operand = true; continue; }
      if (ch === '"' || ch === "'") {
        let k = j + 1;
        while (k < n) { if (src[k] === '\\') { k += 2; continue; } if (src[k] === ch || src[k] === '\n') break; k++; }
        j = Math.min(n, k + 1); operand = true; continue;
      }
      if (ch === '/' && src[j + 1] === '/') { while (j < n && src[j] !== '\n') j++; continue; }
      if (ch === '/' && src[j + 1] === '*') { const k = src.indexOf('*/', j + 2); j = k === -1 ? n : k + 2; continue; }
      if (ch === '{') { depth++; operand = false; j++; continue; }
      if (ch === '}') { depth--; if (depth === 0) return j + 1; operand = false; j++; continue; }
      const t = jsToken(src, j, operand);
      j = t.end; operand = t.operand;
    }
    return n;
  }

  /**
   * One pass over `src` that finds comments, strings and — when `opts.regex` —
   * regular-expression literals, and blanks what the caller asks for.
   *
   * `opts.regex` is for JavaScript and TypeScript only. A regex body is code the
   * tokenizer must step over: its braces, parens and quotes are not structure, and
   * a `//` inside it (`/\//g`) is not a comment. Left unmasked, one `{` in a regex
   * unbalances every block scan after it, so a function's `:start-end` anchor ran
   * to the wrong line (#874). Other languages never enable it: a `/` there is
   * division or a comment, and guessing otherwise would mis-mask real code.
   *
   * Whether a `/` opens a regex depends on the token before it. After a value (an
   * identifier, number, string, `)` or `]`) it divides; after an operator, an
   * opening bracket, `,` `;` `{` `}` or one of REGEX_AFTER_WORD it starts a regex.
   *
   * @param {string} src
   * @param {{ js?: boolean, strings?: boolean, regexes?: boolean, comments?: boolean }} opts
   *        strings/regexes: blank their contents (otherwise they are only skipped).
   *        comments: false (default true) keeps comment bytes and only steps over
   *        them — for callers that READ comments but must not read them out of a
   *        string literal (todos.js)
   */
  function scan(src, opts) {
    const out = src.split('');
    const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
    const js = !!opts.js;
    const comments = opts.comments !== false;
    let i = 0; const n = src.length;
    let operand = false; // the previous significant token is a value, so `/` divides
    while (i < n) {
      const c = src[i], d = src[i + 1];
      if (c === '/' && d === '/') { let j = i + 2; while (j < n && src[j] !== '\n') j++; if (comments) blank(i, j); i = j; continue; }
      if (c === '/' && d === '*') { let j = i + 2; while (j < n && !(src[j] === '*' && src[j + 1] === '/')) j++; j = Math.min(n, j + 2); if (comments) blank(i, j); i = j; continue; }
      if (c === '"' || c === "'" || c === '`') {
        let j;
        if (js && c === '`') j = templateEnd(src, i);
        else {
          j = i + 1;
          while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === c) break; if (c !== '`' && src[j] === '\n') break; j++; }
          j = Math.min(n, j + 1);
        }
        if (opts.strings) blank(i, j);
        i = j; operand = true; continue;
      }
      if (js) {
        const t = jsToken(src, i, operand);
        if (t.regex && opts.regexes) blank(i, t.end);
        i = t.end; operand = t.operand; continue;
      }
      i++;
    }
    return out.join('');
  }

  /**
   * Blank comments only — string-aware, so `//` or `/*` INSIDE a string
   * literal survives (the naive regex strip corrupted e.g. `url = "https://x"`).
   * Comment bytes become spaces; newlines and everything else are preserved.
   * @param {string} src
   * @param {{ js?: boolean }} [opts] js: JS/TS only — step over regex literals and
   *        nested template literals so a `//` inside one is not read as a comment
   * @returns {string} same length, comments blanked
   */
  function stripComments(src, opts = {}) {
    return scan(src, { js: opts.js });
  }

  /**
   * Blank comments AND string/template contents (quotes included) — the
   * boundary-scanning surface: delimiters found here are always structural.
   * With `opts.js` (JS/TS only) regular-expression literals are blanked too, and a
   * template literal may nest another inside a `${ }`.
   * @param {string} src
   * @param {{ js?: boolean }} [opts]
   * @returns {string} same length, comments + strings blanked
   */
  function maskCode(src, opts = {}) {
    return scan(src, { js: opts.js, strings: true, regexes: true });
  }

  /**
   * Blank string/template contents only — comments survive verbatim, and `//`,
   * `/*`, `#` bytes a caller finds here are real comment text, not a
   * `'## todos'`-style literal (#877).
   * @param {string} src
   * @param {{ js?: boolean }} [opts] js: also blank regular-expression literals
   * @returns {string} same length, string/regex contents blanked, comments intact
   */
  function maskStrings(src, opts = {}) {
    return scan(src, { js: opts.js, strings: true, regexes: true, comments: false });
  }

  /**
   * Index of the delimiter that closes the one open at `openIdx`, matched by
   * depth over MASKED text (strings/comments already blanked, so every
   * delimiter seen is structural). -1 when unbalanced within the cap.
   * @param {string} masked  output of maskCode
   * @param {number} openIdx index of the opening delimiter
   * @param {string} [open='(']
   * @param {string} [close=')']
   * @param {number} [cap=4000] scan ceiling in chars
   * @returns {number}
   */
  function readBalanced(masked, openIdx, open = '(', close = ')', cap = 4000) {
    if (masked[openIdx] !== open) return -1;
    let depth = 1;
    const end = Math.min(masked.length, openIdx + cap);
    for (let i = openIdx + 1; i < end; i++) {
      const ch = masked[i];
      if (ch === open) depth++;
      else if (ch === close) {
        depth--;
        if (depth === 0) return i;
      }
    }
    return -1;
  }

  module.exports = { stripComments, maskCode, maskStrings, readBalanced };
  
};

// ── ./src/extractors/scip_symbols ──
__factories["./src/extractors/scip_symbols"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');
  const { parseIndex } = __require('./src/scip/reader');
  const { anchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice } = __require('./src/util/truncate');

  // SCIP index → signature lines (#618, tier T4 of #542, import only). When a
  // repo's CI already produced `index.scip` at the root, its documents carry
  // compiler-typed signatures inside `documentation[0]` code fences — richer
  // than the regex tier and free at extraction time. This renders them into the
  // signature vocabulary with anchors from definition occurrences. As with the
  // LSP tier, the wiring applies a per-file quality guard, so a sparse or stale
  // index entry never loses surface vs the regex floor, and the toolchain label
  // (`scip:<tool>@<version>` from Metadata) is registered only on acceptance.

  const PER_FILE_LIMIT = 200;
  const SIG_TEXT_CHARS = 110;
  const HINT_CHARS = 60;

  // SCIP symbol grammar suffixes to SKIP — not API surface:
  //   `(name)`  parameter · `[T]` type parameter · `local N` locals ·
  //   trailing `/` package/file symbols · `typeLiteral` synthesized members
  const SKIP_SYMBOL = /\((?:[^()]*)\)$|\[[^\]]*\]$|(^|\s)local\s+\d|\/$|typeLiteral/;

  let _cache = null; // { cwd, mtimeMs, size, index } — reloaded when the file changes

  function _loadIndex(cwd) {
    const p = path.join(cwd, 'index.scip');
    let st;
    try { st = fs.statSync(p); } catch (_) { return null; }
    if (_cache && _cache.cwd === cwd && _cache.mtimeMs === st.mtimeMs && _cache.size === st.size) {
      return _cache.index;
    }
    try {
      const index = parseIndex(fs.readFileSync(p));
      _cache = { cwd, mtimeMs: st.mtimeMs, size: st.size, index };
      return index;
    } catch (_) {
      _cache = { cwd, mtimeMs: st.mtimeMs, size: st.size, index: null };
      return null;
    }
  }

  /** Fence interior of a SCIP documentation string, compacted to one line. */
  function _sigText(doc) {
    const m = /^```[\w-]*\n([\s\S]*?)\n?```/.exec(doc || '');
    const inner = m ? m[1] : '';
    return inner.replace(/\s+/g, ' ').trim().slice(0, SIG_TEXT_CHARS);
  }

  function _hint(doc) {
    return String(doc || '').replace(/\s+/g, ' ').trim().split(/[.!?]/)[0].trim().slice(0, HINT_CHARS);
  }

  /** Member-of relation from SCIP symbol structure: `...X#member().` ⊂ `...X#`. */
  function _isMemberSymbol(symbol) {
    const hash = symbol.lastIndexOf('#');
    return hash !== -1 && hash < symbol.length - 1;
  }

  /**
   * Extract signatures for one file from the repo's SCIP index.
   * Returns null (caller falls back) when there is no usable entry.
   * @param {string} filePath - absolute path
   * @param {string} cwd - repo root (where index.scip lives)
   * @returns {{ sigs: string[], label: string }|null}
   */
  function extractViaScip(filePath, cwd) {
    if (!cwd) return null;
    const index = _loadIndex(cwd);
    if (!index) return null;
    const rel = path.relative(cwd, path.resolve(filePath)).replace(/\\/g, '/');
    const doc = index.documents.get(rel);
    if (!doc || doc.defs.length === 0) return null;

    const rows = [];
    for (const def of doc.defs) {
      if (SKIP_SYMBOL.test(def.symbol)) continue;
      const docs = doc.symbols.get(def.symbol) || [];
      const text = _sigText(docs[0]);
      if (!text) continue;
      const startLn = (def.range[0] || 0) + 1;
      // Occurrence ranges cover the identifier; enclosing_range (when the
      // indexer emits it) covers the whole declaration and gives a real end.
      const endLn = def.enclosing && def.enclosing.length >= 3
        ? def.enclosing[def.enclosing.length === 3 ? 0 : 2] + 1
        : startLn;
      const hint = _hint(docs[1]);
      rows.push({
        text: `${_isMemberSymbol(def.symbol) ? '  ' : ''}${text}${anchor(startLn, Math.max(endLn, startLn))}${hint ? `  # ${hint}` : ''}`,
        start: startLn,
      });
    }
    if (rows.length === 0) return null;
    rows.sort((a, b) => a.start - b.start);
    const sigs = capWithNotice(rows.map((r) => r.text), PER_FILE_LIMIT, 'signatures');
    return { sigs, label: `scip:${index.tool || 'unknown'}` };
  }

  const _labels = new Set();

  /** Register a label once the wiring has ACCEPTED the SCIP result. */
  function acceptLabel(label) {
    if (label) _labels.add(label);
  }

  /** Toolchain labels for indexes whose entries were actually used this run. */
  function toolchainLabels() {
    return [..._labels].sort();
  }

  module.exports = { extractViaScip, acceptLabel, toolchainLabels };
  
};

// ── ./src/extractors/shell ──
__factories["./src/extractors/shell"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from shell scripts (bash, zsh, fish).
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    const stripped = src.replace(/#.*$/gm, '');

    // Function definitions (bash: name() { and function name {)
    for (const m of stripped.matchAll(/^(?:function\s+)?([\w:-]+)\s*\(\s*\)\s*\{/gm)) {
      if (m[1].startsWith('_')) continue;
      sigs.push(`function ${m[1]}()`);
    }

    // Main entry point patterns
    if (/^\s*main\s*\(/m.test(src) || /^\s*main\s+"?\$@/m.test(src)) {
      sigs.push('main "$@"');
    }

    // Exported variables
    for (const m of stripped.matchAll(/^export\s+([\w]+)=/gm)) {
      sigs.push(`export ${m[1]}`);
    }

    // Script description (first non-comment line after shebang)
    const lines = src.split('\n');
    for (const line of lines.slice(0, 5)) {
      if (line.startsWith('#!')) continue;
      if (line.startsWith('#')) {
        const desc = line.replace(/^#+\s*/, '').trim();
        if (desc) { sigs.unshift(`# ${desc}`); break; }
      }
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/sql ──
__factories["./src/extractors/sql"] = function(module, exports) {
  
  /**
   * Extract signatures from SQL source files.
   * Captures CREATE TABLE, VIEW, INDEX, FUNCTION, PROCEDURE, TRIGGER, TYPE, SEQUENCE.
   *
   * @param {string} src - Raw SQL content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Strip single-line comments and block comments
    const stripped = src
      .replace(/--[^\n]*/g, '')
      .replace(/\/\*[\s\S]*?\*\//g, '');

    // CREATE TABLE [IF NOT EXISTS] <name> / CREATE [TEMP] TABLE ...
    for (const m of stripped.matchAll(
      /CREATE\s+(?:OR\s+REPLACE\s+)?(?:TEMP(?:ORARY)?\s+)?TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([`"[\w.]+)/gi
    )) {
      sigs.push(`TABLE ${_cleanName(m[1])}`);
    }

    // CREATE VIEW / MATERIALIZED VIEW
    for (const m of stripped.matchAll(
      /CREATE\s+(?:OR\s+REPLACE\s+)?(?:MATERIALIZED\s+)?VIEW\s+(?:IF\s+NOT\s+EXISTS\s+)?([`"[\w.]+)/gi
    )) {
      sigs.push(`VIEW ${_cleanName(m[1])}`);
    }

    // CREATE INDEX / UNIQUE INDEX
    for (const m of stripped.matchAll(
      /CREATE\s+(?:UNIQUE\s+)?INDEX\s+(?:CONCURRENTLY\s+)?(?:IF\s+NOT\s+EXISTS\s+)?([`"[\w.]+)\s+ON\s+([`"[\w.]+)/gi
    )) {
      sigs.push(`INDEX ${_cleanName(m[1])} ON ${_cleanName(m[2])}`);
    }

    // CREATE FUNCTION / CREATE OR REPLACE FUNCTION
    for (const m of stripped.matchAll(
      /CREATE\s+(?:OR\s+REPLACE\s+)?FUNCTION\s+([`"[\w.]+)\s*\(([^)]*)\)/gi
    )) {
      const params = _normalizeParams(m[2]);
      sigs.push(`FUNCTION ${_cleanName(m[1])}(${params})`);
    }

    // CREATE PROCEDURE
    for (const m of stripped.matchAll(
      /CREATE\s+(?:OR\s+REPLACE\s+)?PROCEDURE\s+([`"[\w.]+)\s*\(([^)]*)\)/gi
    )) {
      const params = _normalizeParams(m[2]);
      sigs.push(`PROCEDURE ${_cleanName(m[1])}(${params})`);
    }

    // CREATE TRIGGER
    for (const m of stripped.matchAll(
      /CREATE\s+(?:OR\s+REPLACE\s+)?(?:CONSTRAINT\s+)?TRIGGER\s+([`"[\w.]+)/gi
    )) {
      sigs.push(`TRIGGER ${_cleanName(m[1])}`);
    }

    // CREATE TYPE (composite, enum, domain)
    for (const m of stripped.matchAll(
      /CREATE\s+(?:OR\s+REPLACE\s+)?TYPE\s+([`"[\w.]+)/gi
    )) {
      sigs.push(`TYPE ${_cleanName(m[1])}`);
    }

    // CREATE SEQUENCE
    for (const m of stripped.matchAll(
      /CREATE\s+(?:OR\s+REPLACE\s+)?SEQUENCE\s+(?:IF\s+NOT\s+EXISTS\s+)?([`"[\w.]+)/gi
    )) {
      sigs.push(`SEQUENCE ${_cleanName(m[1])}`);
    }

    return sigs;
  }

  function _cleanName(raw) {
    return raw.replace(/^[`"[]|[`"\]]+$/g, '').trim();
  }

  function _normalizeParams(raw) {
    if (!raw || !raw.trim()) return '';
    return raw.trim()
      .split(',')
      .map((p) => p.trim().replace(/\s+/g, ' ').split(' ').slice(0, 2).join(' '))
      .filter(Boolean)
      .join(', ');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/svelte ──
__factories["./src/extractors/svelte"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from Svelte components.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Extract <script> block
    const scriptMatch = src.match(/<script(?:\s[^>]*)?>(?:\s*)([\s\S]*?)<\/script>/i);
    if (!scriptMatch) return sigs;

    const script = scriptMatch[1]
      .replace(/\/\/.*$/gm, '')
      .replace(/\/\*[\s\S]*?\*\//g, '');

    // Exported props (writable)
    for (const m of script.matchAll(/^\s+export\s+let\s+(\w+)(?:\s*=\s*[^;]+)?;/gm)) {
      sigs.push(`export let ${m[1]}`);
    }

    // Exported functions
    for (const m of script.matchAll(/^export\s+(?:async\s+)?function\s+(\w+)\s*\(([^)]*)\)(?:\s*:\s*([^{=\n]+))?/gm)) {
      const asyncKw = m[0].includes('async') ? 'async ' : '';
      const retStr = m[3] ? ` → ${normalizeType(m[3])}` : '';
      sigs.push(`export ${asyncKw}function ${m[1]}(${normalizeParams(m[2])})${retStr}`);
    }

    // Top-level functions
    for (const m of script.matchAll(/^(?:async\s+)?function\s+(\w+)\s*\(([^)]*)\)(?:\s*:\s*([^{=\n]+))?/gm)) {
      if (m[1].startsWith('_')) continue;
      const asyncKw = m[0].startsWith('async') ? 'async ' : '';
      const retStr = m[3] ? ` → ${normalizeType(m[3])}` : '';
      sigs.push(`${asyncKw}function ${m[1]}(${normalizeParams(m[2])})${retStr}`);
    }

    // Reactive declarations $:
    for (const m of script.matchAll(/^\s+\$:\s+(\w+)\s*=/gm)) {
      sigs.push(`$: ${m[1]}`);
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  function normalizeParams(params) {
    if (!params) return '';
    return params.trim().replace(/\s+/g, ' ');
  }

  function normalizeType(type) {
    if (!type) return '';
    return type.trim().replace(/[;\s]+$/g, '').replace(/\s+/g, ' ').slice(0, 25);
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/swift ──
__factories["./src/extractors/swift"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');

  // Ceilings sit above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed
  // — an undisclosed cap looks like a class that simply has eight methods (#576).
  // Class bodies are scanned to this many characters. Real classes routinely
  // run past the old 4KB scan window — truncating there silently hid every
  // member after ~4000 chars AND anchored class end-lines short (#576). The
  // ceiling only guards against pathological input (Java parity, #551).
  const MAX_CLASS_BODY_CHARS = 200000;
  const MEMBER_LIMIT = 120;
  const PER_FILE_LIMIT = 200;

  // Chars scanned past the params for a `-> Return` before giving up.
  const RET_SCAN_CHARS = 400;

  /**
   * Extract signatures from Swift source code.
   * Signatures carry `:start-end` line anchors (Surgical Context); the comment
   * strip below is newline-preserving so anchor lines match the original file.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // stripComments is length- AND newline-preserving; the previous regex strip
    // DELETED comment text, so offsets no longer aligned with the masked surface
    // the balanced reader walks (#695).
    const stripped = stripComments(src);
    const masked = maskCode(src);

    // Anchor range: scan past same-line modifiers to a body `{` (range) else single line.
    const rangeFor = (declIdx, afterIdx) => {
      let k = afterIdx;
      while (k < stripped.length && /[ \tA-Za-z0-9_>-]/.test(stripped[k])) k++;
      if (stripped[k] === '{') {
        const end = k + 1 + extractBlock(stripped, k + 1).length;
        return [lineAt(stripped, declIdx), lineAt(stripped, end)];
      }
      const line = lineAt(stripped, declIdx);
      return [line, line];
    };

    // Classes, structs, protocols, enums. The inheritance clause admits `@` so an
    // attributed conformance — `: @unchecked Sendable`, `: @retroactive Equatable`,
    // both routine in Swift 5.5+ concurrency code — does not make the whole type
    // extract as nothing (#900).
    const typeRe = /^[ \t]*(?:public\s+|internal\s+|open\s+|private\s+|fileprivate\s+)?(?:final\s+)?(class|struct|protocol|enum|actor)\s+(\w+)(?:<[^{]*>)?(?:\s*:\s*[\w, <>.@]+)?\s*\{/gm;
    for (const m of stripped.matchAll(typeRe)) {
      const declIdx = m.index + (m[0].length - m[0].trimStart().length);
      const bodyStart = m.index + m[0].length;
      const block = extractBlock(stripped, bodyStart);
      sigs.push(withAnchor(`${m[1]} ${m[2]}`, lineAt(stripped, declIdx), lineAt(stripped, bodyStart + block.length)));
      // Members of a NESTED type belong to that type. Finding nested types at all
      // (the anchor fix above) is what makes this necessary — without it the same
      // method is emitted under both owners, as it was in kotlin/scala (#738).
      const scoped = blankNestedTypeBodies(block, masked.slice(bodyStart, bodyStart + block.length),
        /^[ \t]+(?:(?:public|internal|open|private|fileprivate|final)\s+)*(?:class|struct|protocol|enum|actor)\s+\w+/gm);
      for (const fn of extractMembers(scoped.block, scoped.masked)) {
        // The disclosure marker carries no offsets; anchor it at the class body.
        sigs.push(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + (fn.declIdx || 0)), lineAt(stripped, bodyStart + (fn.endIdx || 0))));
      }
    }

    // Top-level public functions — capture everything after ) to end of line for arrow type
    for (const m of stripped.matchAll(/^(?:public\s+|internal\s+)?(?:static\s+)?(?:async\s+)?func\s+(\w+)(?:<[^(]*>)?\s*\(/gm)) {
      const asyncKw = m[0].includes('async') ? 'async ' : '';
      const pr = readParams(stripped, masked, m.index + m[0].length - 1);
      if (!pr) continue;
      const retStr = extractArrowType(pr.after);
      const [s, e] = rangeFor(m.index, pr.end);
      sigs.push(withAnchor(`${asyncKw}func ${m[1]}(${normalizeParams(pr.params)})${retStr}`, s, e));
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  /**
   * Resolve a `func` declaration's parameter list with a BALANCED read (#695).
   *
   * `\(([^)]*)\)` stopped at the first `)`, so a closure-typed parameter —
   * `cb: (Int) -> Int` — closed the list early. The arrow substitution then fired
   * inside the closure type and the remainder of the real parameter list was
   * appended as prose: `func f(cb) → Int, n: Int) -> Int`, structurally malformed.
   */
  function readParams(stripped, masked, openIdx) {
    const close = readBalanced(masked, openIdx);
    if (close < 0) return null;
    // Arrow segment: to the body `{` or end of line, jumping balanced groups so a
    // closure return type survives.
    let i = close + 1;
    const stop = Math.min(masked.length, i + RET_SCAN_CHARS);
    while (i < stop) {
      const ch = masked[i];
      if (ch === '{' || ch === '\n') break;
      if (ch === '(') { const c = readBalanced(masked, i); if (c < 0) break; i = c + 1; continue; }
      if (ch === '<') { const c = readBalanced(masked, i, '<', '>'); if (c < 0) { i++; continue; } i = c + 1; continue; }
      i++;
    }
    // `close` anchors a member to its DECLARATION line; `end` may run onto the
    // next line when the body brace sits there (C# style), which would widen the
    // anchor past the signature itself.
    return { params: stripped.slice(openIdx + 1, close), after: stripped.slice(close + 1, i), end: i, close };
  }

  /**
   * Blank the bodies of NESTED type declarations so their members are not also
   * attributed to the enclosing type (#741). Length- and newline-preserving.
   */
  function blankNestedTypeBodies(block, maskedBlock, typeRe) {
    const b = block.split('');
    const mb = maskedBlock.split('');
    for (const m of block.matchAll(typeRe)) {
      let i = m.index + m[0].length;
      const stop = Math.min(maskedBlock.length, i + RET_SCAN_CHARS);
      let open = -1;
      while (i < stop) {
        const ch = maskedBlock[i];
        if (ch === '{') { open = i; break; }
        if (ch === '(') { const c = readBalanced(maskedBlock, i); if (c < 0) break; i = c + 1; continue; }
        if (ch === '<') { const c = readBalanced(maskedBlock, i, '<', '>'); if (c < 0) { i++; continue; } i = c + 1; continue; }
        if (ch === '\n' && !maskedBlock.slice(i + 1, maskedBlock.indexOf('\n', i + 1) + 1 || stop).trim()) break;
        i++;
      }
      if (open < 0) continue;
      const close = readBalanced(maskedBlock, open, '{', '}');
      const end = close < 0 ? maskedBlock.length : close + 1;
      for (let k = open; k < end && k < b.length; k++) {
        if (b[k] !== '\n') b[k] = ' ';
        if (mb[k] !== '\n') mb[k] = ' ';
      }
    }
    return { block: b.join(''), masked: mb.join('') };
  }

  function extractBlock(src, startIndex) {
    let depth = 1, i = startIndex;
    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (src[i] === '{') depth++;
      else if (src[i] === '}') depth--;
      i++;
    }
    return src.slice(startIndex, i - 1);
  }

  function extractMembers(block, maskedBlock) {
    const members = [];
    for (const m of block.matchAll(/^[ \t]+(?:public\s+|internal\s+|open\s+)?(?:static\s+|class\s+)?(?:mutating\s+)?(?:async\s+)?func\s+(\w+)(?:<[^(]*>)?\s*\(/gm)) {
      if (m[1].startsWith('_')) continue;
      const asyncKw = m[0].includes('async') ? 'async ' : '';
      const pr = readParams(block, maskedBlock, m.index + m[0].length - 1);
      if (!pr) continue;
      const retStr = extractArrowType(pr.after);
      members.push({
        text: `${asyncKw}func ${m[1]}(${normalizeParams(pr.params)})${retStr}`,
        declIdx: m.index + (m[0].length - m[0].trimStart().length),
        endIdx: pr.end,
      });
    }
    return capMembersWithNotice(members, MEMBER_LIMIT);
  }

  /**
   * Parameter NAMES only, `: Type` and `= default` dropped.
   *
   * Depth- and string-aware: the old `split(',')` + `split(':')[0]` turned
   * `a: Int = g(1, 2)` into the two params `a` and `2` (#695).
   */
  function normalizeParams(params) {
    if (!params || !params.trim()) return '';
    const names = [];
    let depth = 0, quote = null, seg = '';
    const flush = () => {
      const name = seg.split(/[:=]/)[0].trim().replace(/\s+/g, ' ');
      if (name) names.push(name);
      seg = '';
    };
    for (let i = 0; i < params.length; i++) {
      const ch = params[i];
      if (quote) { if (ch === '\\') { i++; continue; } if (ch === quote) quote = null; continue; }
      if (ch === '"') { quote = ch; continue; }
      if (ch === '(' || ch === '[' || ch === '{') { depth++; continue; }
      if (ch === ')' || ch === ']' || ch === '}') { depth--; continue; }
      // `->` is a function-type arrow, not a generic close.
      if (ch === '<') { depth++; continue; }
      if (ch === '>') { if (params[i - 1] !== '-') depth--; continue; }
      if (ch === ',' && depth === 0) { flush(); continue; }
      if (depth === 0) seg += ch;
    }
    flush();
    return names.join(', ');
  }

  function extractArrowType(str) {
    if (!str) return '';
    const m = str.match(/->\s*([^\n{]+)/);
    if (!m) return '';
    const rt = m[1].trim().replace(/\s+/g, ' ');
    return ` → ${rt.length > 25 ? rt.slice(0, 22) + '...' : rt}`;
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/terraform ──
__factories["./src/extractors/terraform"] = function(module, exports) {
  
  /**
   * Extract signatures from Terraform (.tf / .tfvars) configuration files.
   * Captures resource, data, module, variable, output, locals, provider,
   * terraform blocks, and moved/import blocks.
   *
   * @param {string} src - Raw Terraform content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Strip single-line comments
    const stripped = src
      .replace(/\/\/[^\n]*/g, '')
      .replace(/#[^\n]*/g, '')
      .replace(/\/\*[\s\S]*?\*\//g, '');

    // resource "<type>" "<name>" { ... }
    for (const m of stripped.matchAll(/\bresource\s+"([^"]+)"\s+"([^"]+)"\s*\{/g)) {
      sigs.push(`resource "${m[1]}" "${m[2]}"`);
    }

    // data "<type>" "<name>" { ... }
    for (const m of stripped.matchAll(/\bdata\s+"([^"]+)"\s+"([^"]+)"\s*\{/g)) {
      sigs.push(`data "${m[1]}" "${m[2]}"`);
    }

    // module "<name>" { ... }
    for (const m of stripped.matchAll(/\bmodule\s+"([^"]+)"\s*\{/g)) {
      sigs.push(`module "${m[1]}"`);
    }

    // variable "<name>" { ... }
    for (const m of stripped.matchAll(/\bvariable\s+"([^"]+)"\s*\{/g)) {
      sigs.push(`variable "${m[1]}"`);
    }

    // output "<name>" { ... }
    for (const m of stripped.matchAll(/\boutput\s+"([^"]+)"\s*\{/g)) {
      sigs.push(`output "${m[1]}"`);
    }

    // provider "<name>" { ... }
    for (const m of stripped.matchAll(/\bprovider\s+"([^"]+)"\s*\{/g)) {
      sigs.push(`provider "${m[1]}"`);
    }

    // locals { ... } (just mark presence; key names too noisy to enumerate)
    if (/\blocals\s*\{/.test(stripped)) {
      sigs.push('locals { ... }');
    }

    // terraform { required_providers / backend }
    if (/\bterraform\s*\{/.test(stripped)) {
      sigs.push('terraform { ... }');
    }

    // moved block
    for (const m of stripped.matchAll(/\bmoved\s*\{[\s\S]*?from\s*=\s*([^\n]+)/g)) {
      sigs.push(`moved from ${m[1].trim()}`);
    }

    // import block (Terraform 1.5+)
    for (const m of stripped.matchAll(/\bimport\s*\{[\s\S]*?to\s*=\s*([^\n]+)/g)) {
      sigs.push(`import to ${m[1].trim()}`);
    }

    return sigs;
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/todos ──
__factories["./src/extractors/todos"] = function(module, exports) {
  
  const { maskStrings } = __require('./src/extractors/scan');

  /**
   * Extract TODO/FIXME/HACK/XXX comments from source text.
   *
   * Markers are matched on MASKED source (string/template contents blanked:
   * `maskStrings` in scan.js), so a marker spelled inside a string literal — a
   * `'## todos'` heading pushed by a generator, an example embedded in a template
   * string — is never read as a comment (#877).
   *
   * The marker itself is case-sensitive uppercase, the convention, and bounded by
   * a word boundary, so `#hackathon`, `// Todoist` and `#FIXMEs` do not match. A
   * lowercase marker is accepted only as its shorthand with a colon (`# todo: x`),
   * where the colon makes the intent unambiguous.
   *
   * @param {string} src - Raw file content
   * @returns {{line:number, tag:string, text:string}[]}
   */

  // `//`, `#` and `/*` are the comment openers this extractor reads: the first two
  // as before, `/*` because `/* HACK */` is a marker too. Masking is per line, so
  // an unterminated quote cannot hide markers written on later lines.
  const MARKER_RE = /(?:\/\/|#|\/\*)[ \t]*((?:TODO|FIXME|HACK|XXX)\b|(?:todo|fixme|hack|xxx)(?=[ \t]*:))/;

  /** The optional `:` separator between the marker and its message. */
  const SEP_RE = /^[ \t]*:?[ \t]*/;

  function extractTodos(src) {
    if (!src || typeof src !== 'string') return [];
    const todos = [];
    const lines = src.split('\n');

    for (let i = 0; i < lines.length; i++) {
      // Decide on masked text, read the message from the original line: masking
      // must never truncate a message (`# HACK: don't` would otherwise stop at the
      // apostrophe — the masker reads `#` as code, a private-field sigil in JS).
      const masked = maskStrings(lines[i]);
      const m = masked.match(MARKER_RE);
      if (!m) continue;

      const afterTag = m.index + m[0].length;
      const sep = masked.slice(afterTag).match(SEP_RE)[0];
      let text = lines[i].slice(afterTag + sep.length).trim();

      // In a block comment `*/` terminates the comment: it is not the message.
      const inBlock = m[0].startsWith('/*');
      if (inBlock) text = text.split('*/')[0].trim();
      // `// TODO` alone is a flag, not a message — unchanged from before.
      if (text === '' && !inBlock) continue;

      todos.push({
        line: i + 1,
        tag: m[1].toUpperCase(),
        text: text.slice(0, 70),
      });
    }

    return todos;
  }

  module.exports = { extractTodos };
  
};

// ── ./src/extractors/toml ──
__factories["./src/extractors/toml"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling discloses what it drops rather than truncating silently (#583).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from TOML configuration files.
   * Focuses on section/table names and high-value keys.
   *
   * @param {string} src - Raw TOML content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Remove # comments while preserving values before comment markers.
    const stripped = src.replace(/\s+#.*$/gm, '');

    // [section] and [[array.section]]
    for (const m of stripped.matchAll(/^\s*(\[\[?[^\]]+\]\]?)\s*$/gm)) {
      sigs.push(`table ${m[1].trim()}`);
    }

    // Key-value lines (top-level and nested) — keep key names only.
    for (const m of stripped.matchAll(/^\s*([A-Za-z0-9_.-]+)\s*=\s*(.+)$/gm)) {
      const key = m[1].trim();
      const value = m[2].trim();

      // Prefer common metadata/config keys for compact, useful output.
      if (/^(name|version|description|authors|license|requires-python|dependencies|optional-dependencies|scripts|tool\.|build-system\.|project\.)/.test(key)) {
        sigs.push(`key ${key}`);
        continue;
      }

      // Include booleans and simple scalar keys as generic config signal.
      if (/^(true|false|"[^"]*"|'[^']*'|[0-9._-]+)$/.test(value)) {
        sigs.push(`key ${key}`);
      }
    }

    return capWithNotice(Array.from(new Set(sigs)), PER_FILE_LIMIT, 'entries');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/typescript ──
__factories["./src/extractors/typescript"] = function(module, exports) {
  
  const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');
  const { scanComponentMarkers, markersForClass, componentMembers } = __require('./src/extractors/component-surface');
  const { lateLast } = __require('./src/util/late-last');
  const { atStatementStart } = __require('./src/util/statement-start');

  // Class bodies are scanned to this many characters — guard against
  // pathological input only; the old 4KB window silently hid members (#576).
  const MAX_CLASS_BODY_CHARS = 200000;

  /**
   * Extract signatures from TypeScript source code.
   * Top-level declarations carry a `:start-end` line anchor (see line-anchor.js);
   * indented members do not.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];
    // docHintFor[i] is the doc-comment hint for sigs[i] (exported top-level
    // functions only), appended after the anchor as `  # <hint>` — same
    // convention as the Python extractor's extractDocHint.
    const docHintFor = [];
    const docHints = buildDocHints(src);
    // anchors[i] is [start, end] for a top-level sig, or null for an indented member.
    // Kept parallel to `sigs` so existing push/mutation logic stays untouched;
    // anchors are applied once at return.
    const anchors = [];
    // Indexes of declarations whose shape this extractor could not read before #996 and that the text of the
    // signature does not give away; they are listed after the rest (see late-last.js).
    const lateAt = new Set();

    // stripComments is string-aware (a `//` inside a string literal survives);
    // maskCode additionally blanks string/template contents so every delimiter
    // found on it is structural. Both are length- and newline-preserving, so
    // offsets and line anchors align across all three views (#526). `js`
    // makes a regex literal or nested template inert too (#874).
    const stripped = stripComments(src, { js: true });
    const masked = maskCode(src, { js: true });

    // Full params for a declaration whose `(` sits at openIdx (see javascript.js).
    const paramsFrom = (openIdx) => {
      const closeIdx = readBalanced(masked, openIdx);
      if (closeIdx === -1) {
        const naive = stripped.indexOf(')', openIdx);
        return { params: stripped.slice(openIdx + 1, naive === -1 ? openIdx + 1 : naive), closeIdx: naive };
      }
      return { params: stripped.slice(openIdx + 1, closeIdx), closeIdx };
    };

    // Index of the closing brace for a block whose body starts at bodyStart.
    const blockEndIdx = (bodyStart) => bodyStart + extractBlock(masked, bodyStart).length;

    // Exported interfaces
    for (const m of stripped.matchAll(/export\s+interface\s+([\w$]+)(?:<[^{]*>)?\s*(?:extends\s+[^{]+)?\{/gm)) {
      if (!atStatementStart(stripped, m.index)) continue;
      const bodyStart = m.index + m[0].length;
      sigs.push(`export interface ${m[1]}`);
      anchors.push([lineAt(stripped, m.index), lineAt(stripped, blockEndIdx(bodyStart))]);
      // Collect members
      const block = extractBlock(stripped, bodyStart);
      const members = extractInterfaceMembers(block);
      for (const mem of members) {
        sigs.push(`  ${mem.text}`);
        anchors.push([lineAt(stripped, bodyStart + mem.start), lineAt(stripped, bodyStart + mem.end)]);
      }
    }

    // Exported type aliases
    for (const m of stripped.matchAll(/export\s+type\s+([\w$]+)(?:<[^=]*>)?\s*=/gm)) {
      if (!atStatementStart(stripped, m.index)) continue;
      sigs.push(`export type ${m[1]}`);
      anchors.push([lineAt(stripped, m.index), lineAt(stripped, m.index + m[0].length)]);
    }

    // Exported enums
    for (const m of stripped.matchAll(/export\s+(?:const\s+)?enum\s+([\w$]+)\s*\{/gm)) {
      if (!atStatementStart(stripped, m.index)) continue;
      const bodyStart = m.index + m[0].length;
      sigs.push(`export enum ${m[1]}`);
      anchors.push([lineAt(stripped, m.index), lineAt(stripped, blockEndIdx(bodyStart))]);
    }

    // Classes (exported and internal)
    // The heritage clause is walked to, not matched inline — see the note in
    // javascript.js. `extends Mixin(LitElement)` (idiomatic Lit composition)
    // never matched the old inline form, so the whole class was dropped:
    // no class line, no members. Leading whitespace is allowed so an indented
    // class expression — the mixin-factory form — is reachable too.
    const classRegex = /^[ \t]*(export\s+(?:default\s+)?)?(abstract\s+)?class\s+([\w$]+)(?![\w$])/gm;

    /**
     * Index of the `{` that opens a class body, or -1. Depth-aware so a
     * call-expression superclass, a generic argument list and an `implements`
     * clause are stepped over rather than mistaken for the body. Bounded.
     */
    const findClassBody = (from) => {
      let depth = 0;
      const limit = Math.min(masked.length, from + 600);
      for (let i = from; i < limit; i++) {
        const c = masked[i];
        if (c === '(' || c === '<' || c === '[') depth++;
        else if (c === ')' || c === '>' || c === ']') depth = Math.max(0, depth - 1);
        else if (c === '{' && depth === 0) return i;
        else if (c === ';' || (c === '=' && depth === 0)) return -1;
      }
      return -1;
    };
    // Web-component surface (#537): tag/selector + reactive fields + base are
    // rendered ONLY when a component marker is detected, so every other class
    // stays byte-identical.
    const compMarkers = scanComponentMarkers(stripped);
    for (const m of stripped.matchAll(classRegex)) {
      const prefix = m[1] ? m[1].trim().replace(/\s+/g, ' ') + ' ' : '';
      const abs = m[2] ? 'abstract ' : '';
      const bodyBrace = findClassBody(m.index + m[0].length);
      if (bodyBrace === -1) continue;
      // `implements` is dropped: the extends target is the behavioural parent,
      // and interfaces are already indexed in their own right.
      const heritage = stripped.slice(m.index + m[0].length, bodyBrace)
        .replace(/\s+/g, ' ').trim()
        .replace(/\s*\bimplements\b.*$/, '')
        .replace(/^extends\s+/, '').trim();
      const bodyStart = bodyBrace + 1;
      const blockEnd = blockEndIdx(bodyStart);
      const marker = markersForClass(compMarkers.decorated, stripped, m.index, m[0]);
      const definedTag = compMarkers.defined.get(m[3]);
      const isComponent = !!(marker || definedTag);
      // Mixin composition is always rendered (it is not recoverable elsewhere);
      // a plain `extends Base` stays gated on component detection so existing
      // output is unchanged.
      const base = heritage && (isComponent || heritage.includes('(')) ? ` extends ${heritage}` : '';
      // `class X<T = any>` was dropped whole: the scan took the default's `=` for an assignment (#996).
      if (stripped.slice(m.index + m[0].length, bodyBrace).includes('=')) lateAt.add(sigs.length);
      sigs.push(`${prefix}${abs}class ${m[3]}${base}`);
      const classStartLn = lineAt(stripped, m.index);
      anchors.push([classStartLn, lineAt(stripped, blockEnd)]);
      const block = stripped.slice(bodyStart, blockEnd);
      const maskedBlock = masked.slice(bodyStart, blockEnd);
      if (isComponent) {
        const tag = (marker && marker.tag) || definedTag;
        if (tag) { sigs.push(`  custom element <${tag}>`); anchors.push([classStartLn, classStartLn]); }
        else if (marker && marker.selector) { sigs.push(`  selector '${marker.selector}'`); anchors.push([classStartLn, classStartLn]); }
        for (const cm of componentMembers(block)) {
          sigs.push(`  ${cm.text}`);
          anchors.push([lineAt(stripped, bodyStart + cm.start), lineAt(stripped, bodyStart + cm.end)]);
        }
      }
      const methods = extractClassMembers(block, maskedBlock);
      for (const meth of methods) {
        sigs.push(`  ${meth.text}`);
        anchors.push([lineAt(stripped, bodyStart + meth.start), lineAt(stripped, bodyStart + meth.end)]);
      }
    }

    // Names already emitted by one of the export forms below, so
    // `export const f = …` followed by `export default f` is not listed twice.
    const emitted = new Set();

    // One emitter for every function-shaped export: `export function f`,
    // `export default function f`, and the declaration an `export default f`
    // names elsewhere in the file (#900). `prefix` is the text ahead of the
    // `function` keyword — 'export ' or 'export default '.
    const pushFunction = (declIdx, openIdx, name, asyncKw, prefix) => {
      const { params: rawParams, closeIdx } = paramsFrom(openIdx);
      if (closeIdx === -1) return;
      // Declaration shape check + return-type capture, mirroring the old
      // `\)(?:\s*:\s*[^{]+)?\s*\{` tail against the text after the real close.
      const tail = masked.slice(closeIdx + 1, closeIdx + 200).match(/^(\s*:\s*[^{]+?)?\s*\{/);
      if (!tail) return;
      const params = normalizeParams(rawParams);
      const retRaw = tail[1] ? stripped.slice(closeIdx + 1, closeIdx + 1 + tail[1].length).replace(/^\s*:\s*/, '') : '';
      const retType = retRaw ? retRaw.trim().replace(/\s+/g, ' ').slice(0, 30) : '';
      const retStr = retType ? ` → ${retType}` : '';
      const bodyStart = closeIdx + 1 + tail[0].length;
      sigs.push(`${prefix}${asyncKw}function ${name}(${params})${retStr}`);
      docHintFor[sigs.length - 1] = docHints.get(name);
      anchors.push([lineAt(stripped, declIdx), lineAt(stripped, blockEndIdx(bodyStart))]);
      emitted.add(name);

      // Hooks: capture compact return object shape for use* functions.
      if (name.startsWith('use')) {
        const body = stripped.slice(bodyStart, bodyStart + 800);
        const ret = body.match(/return\s*\{([^}]{1,260})\}/);
        if (ret) {
          const keys = ret[1]
            .split(',')
            .map((s) => s.trim().split(':')[0].split('(')[0].trim())
            .filter(Boolean)
            .slice(0, 8);
          if (keys.length) {
            sigs[sigs.length - 1] += ` → { ${keys.join(', ')} }`;
          }
        }
      }
    };

    // Exported top-level functions (not methods). The modifiers are CAPTURED, never
    // searched for in the whole match: `export function async(` must not read as an
    // async function because of its NAME (#902 — svelte has exactly that function).
    for (const m of stripped.matchAll(/export\s+(default\s+)?(async\s+)?function\s+([\w$]+)\s*(?:<[^(]*>)?\s*\(/gm)) {
      if (!atStatementStart(stripped, m.index)) continue;
      pushFunction(m.index, m.index + m[0].length - 1, m[3], m[2] ? 'async ' : '', m[1] ? 'export default ' : 'export ');
    }

    // `export default function () {}`: nothing names it, so the entry carries no name (zod's locale
    // files are all this shape, and a file of them extracted as nothing).
    for (const m of stripped.matchAll(/export\s+default\s+(async\s+)?function\s*(?:<[^(]*>)?\s*\(/gm)) {
      if (!atStatementStart(stripped, m.index)) continue;
      pushFunction(m.index, m.index + m[0].length - 1, '', m[1] ? 'async ' : '', 'export default ');
    }

    // Arrow-function counterpart of pushFunction: `export const f = (…) =>`, and
    // the `const f = (…) =>` an `export default f` names.
    const pushArrow = (declIdx, openIdx, name, asyncKw, prefix, late) => {
      const { params: rawParams, closeIdx } = paramsFrom(openIdx);
      if (closeIdx === -1) return;
      // Arrow shape check, mirroring the old `\)\s*(?::\s*[^=>{]+)?\s*=>` tail.
      const tail = masked.slice(closeIdx + 1, closeIdx + 200).match(/^\s*(?::\s*[^=>{]+)?\s*=>/);
      if (!tail) return;
      const params = normalizeParams(rawParams);
      if (late) lateAt.add(sigs.length);
      sigs.push(name ? `${prefix}const ${name} = ${asyncKw}(${params}) =>` : `${prefix}${asyncKw}(${params}) =>`);
      docHintFor[sigs.length - 1] = docHints.get(name);
      const matchEnd = closeIdx + 1 + tail[0].length;
      const bodyStart = masked.indexOf('{', matchEnd);
      const endLn = bodyStart !== -1
        ? lineAt(stripped, blockEndIdx(bodyStart + 1))
        : lineAt(stripped, matchEnd);
      anchors.push([lineAt(stripped, declIdx), endLn]);
      emitted.add(name);

      // Hooks: capture compact return object shape for use* functions.
      if (name.startsWith('use')) {
        if (bodyStart !== -1) {
          const body = stripped.slice(bodyStart, bodyStart + 800);
          const ret = body.match(/return\s*\{([^}]{1,260})\}/);
          if (ret) {
            const keys = ret[1]
              .split(',')
              .map((s) => s.trim().split(':')[0].split('(')[0].trim())
              .filter(Boolean)
              .slice(0, 8);
            if (keys.length) {
              sigs[sigs.length - 1] += ` → { ${keys.join(', ')} }`;
            }
          }
        }
      }
    };

    // `export const name = make(…)`: a const bound to a call is listed by its name and its anchor,
    // without the call's arguments, which are its body (#996). The zustand store form below has
    // its own entry, so it is skipped here.
    const pushFactory = (declIdx, from, name) => {
      const cm = /^([A-Za-z_$][\w$]*(?:\s*\.\s*[A-Za-z_$][\w$]*)*)\s*(?:<[^()]*>)?\s*\(/.exec(masked.slice(from, from + 200));
      if (!cm) return;
      const callee = cm[1].replace(/\s+/g, '');
      if (/^(?:new|await|typeof|void|function|class|require|import|async|super)$/.test(callee)) return;
      if (callee === 'create' && /^use\w+Store$/.test(name)) return;
      const closeIdx = readBalanced(masked, from + cm[0].length - 1);
      if (closeIdx === -1) return;
      sigs.push(`export const ${name} = ${callee}(...)`);
      docHintFor[sigs.length - 1] = docHints.get(name);
      anchors.push([lineAt(stripped, declIdx), lineAt(stripped, closeIdx)]);
      emitted.add(name);
    };

    // Exported consts. The initialiser is found by scanning, not by one pattern: a type annotation
    // may itself contain `=>` (`: (e: Error) => Function = …`), an arrow may be generic
    // (`= <T>(x: T) => x`), and a factory call has no arrow at all. An arrow's own signature is
    // unchanged from before; only the shapes that used to be missed are new.
    for (const m of masked.matchAll(/export\s+const\s+([\w$]+)/gm)) {
      if (!atStatementStart(masked, m.index)) continue;
      let p = skipSpace(masked, m.index + m[0].length);
      if (masked[p] === ':') {
        const eq = findAssign(masked, p + 1);
        if (eq === -1) continue;
        p = eq;
      }
      if (masked[p] !== '=' || masked[p + 1] === '=' || masked[p + 1] === '>') continue;
      p = skipSpace(masked, p + 1);
      let asyncKw = '';
      const am = /^async\s+/.exec(masked.slice(p, p + 12));
      if (am) { asyncKw = 'async '; p += am[0].length; }
      if (masked[p] === '<') {
        const close = skipAngles(masked, p);
        if (close === -1) continue;
        p = skipSpace(masked, close + 1);
      }
      // An arrow the old pattern already matched keeps its place; a generic one, or one behind an annotation
      // that contains `=>`, is a shape that was missed before and is listed after the rest.
      const legacy = /^export\s+const\s+\w+\s*(?::\s*[^=]+)?\s*=\s*(?:async\s+)?\(/.test(stripped.slice(m.index, m.index + 600));
      if (masked[p] === '(') { pushArrow(m.index, p, m[1], asyncKw, 'export ', !legacy); continue; }
      if (!asyncKw) pushFactory(m.index, p, m[1]);
    }

    // `export default (a) => …`: an anonymous default arrow.
    for (const m of masked.matchAll(/^export\s+default\s+(async\s+)?\(/gm)) {
      pushArrow(m.index, m.index + m[0].length - 1, '', m[1] ? 'async ' : '', 'export default ');
    }

    // `export default <identifier>` — the declaration it names is usually NOT
    // itself exported (`const scopedPlugin: PluginCreator = (id) => {…}` then
    // `export default scopedPlugin`), so none of the export forms above sees it
    // and the whole file extracted as nothing (#900: vue-core's pluginScoped.ts).
    // Resolved against a top-level declaration in the SAME file only; an imported
    // identifier names no declaration here, so nothing is invented. Matched on the
    // masked surface so an `export default x` line inside a template literal is inert.
    for (const dm of masked.matchAll(/^export[ \t]+default[ \t]+([A-Za-z_$][\w$]*)[ \t]*;?[ \t]*$/gm)) {
      const name = dm[1];
      if (emitted.has(name) || /^(?:function|class|async|abstract|interface|enum|type|new|await|typeof|void|null|undefined|true|false|this)$/.test(name)) continue;
      const id = name.replace(/\$/g, '\\$');
      const fn = new RegExp(`^(async\\s+)?function\\s+${id}\\s*(?:<[^(]*>)?\\s*\\(`, 'm').exec(masked);
      if (fn) { pushFunction(fn.index, fn.index + fn[0].length - 1, name, fn[1] ? 'async ' : '', 'export default '); continue; }
      const arrow = new RegExp(`^(?:const|let|var)\\s+${id}\\s*(?::\\s*[^=]+)?\\s*=\\s*(async\\s+)?\\(`, 'm').exec(masked);
      if (arrow) pushArrow(arrow.index, arrow.index + arrow[0].length - 1, name, arrow[1] ? 'async ' : '', 'export default ');
    }

    // Zustand stores: export const useXxxStore = create<State>()(...)
    for (const m of stripped.matchAll(/^export\s+const\s+(use\w+Store)\s*=\s*create(?:<[^>]*>)?\s*\(/gm)) {
      const stateType = m[0].match(/create<([\w]+)>/)?.[1] || '';
      const startLn = lineAt(stripped, m.index);
      sigs.push(`export const ${m[1]} = create<${stateType}>(...)`);
      anchors.push([startLn, startLn]);
      const ifaceRe = new RegExp(`interface\\s+${stateType}\\s*\\{([\\s\\S]*?)\\}`);
      const ifm = stripped.match(ifaceRe);
      if (ifm) {
        for (const fm of ifm[1].matchAll(/^\s+(\w+)\s*(?:\([^)]*\))?\s*:/gm)) { sigs.push(`  ${fm[1]}`); anchors.push(null); }
      }
    }

    // API client objects: const xxxApi = { method: async () => {} }
    for (const m of stripped.matchAll(/^(?:export\s+default\s+|const\s+)(\w*[Aa]pi\w*)\s*=\s*\{/gm)) {
      const bodyStart = m.index + m[0].length;
      const block = extractBlock(stripped, bodyStart);
      const methods = [...block.matchAll(/^\s+(\w+)\s*:\s*(?:async\s+)?(?:\([^)]*\)|\w+)\s*=>/gm)].map(mm => mm[1]);
      if (methods.length) {
        sigs.push(`${m[1]}: { ${methods.join(', ')} }`);
        anchors.push([lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)]);
      }
    }

    // The shapes read since #996 follow the ones always read, so the 200-entry cap can never push an old entry out.
    const ordered = lateLast(sigs, anchors, docHintFor, lateAt);
    const withAnchors = ordered.sigs.map((s, i) => {
      const anchored = ordered.anchors[i] ? withAnchor(s, ordered.anchors[i][0], ordered.anchors[i][1]) : s;
      return ordered.docHints[i] ? `${anchored}  # ${ordered.docHints[i]}` : anchored;
    });
    return capWithNotice(withAnchors, 200, 'signatures');
  }

  function skipSpace(src, i) {
    while (i < src.length && /\s/.test(src[i])) i++;
    return i;
  }

  /**
   * Index of the `=` that ends a type annotation, or -1. Brackets are tracked, and the arrow of
   * a function TYPE (`(e: Error) => Function`) is not an assignment.
   */
  function findAssign(masked, from) {
    let depth = 0;
    const limit = Math.min(masked.length, from + 800);
    for (let i = from; i < limit; i++) {
      const c = masked[i];
      if (c === '=') {
        if (masked[i + 1] === '>') { i++; continue; }
        if (depth === 0 && masked[i + 1] !== '=') return i;
        continue;
      }
      if (c === '(' || c === '[' || c === '{' || c === '<') depth++;
      else if (c === ')' || c === ']' || c === '}' || c === '>') depth = Math.max(0, depth - 1);
      else if (c === ';' && depth === 0) return -1;
    }
    return -1;
  }

  /** Index of the `>` that closes the generic list opened at `from`, or -1. */
  function skipAngles(masked, from) {
    let depth = 0;
    const limit = Math.min(masked.length, from + 400);
    for (let i = from; i < limit; i++) {
      const c = masked[i];
      if (c === '=' && masked[i + 1] === '>') { i++; continue; }
      if (c === '<') depth++;
      else if (c === '>') { depth--; if (depth === 0) return i; }
      else if (c === ';') return -1;
    }
    return -1;
  }

  function extractBlock(src, startIndex) {
    let depth = 1;
    let i = startIndex;
    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
    while (i < end && depth > 0) {
      if (src[i] === '{') depth++;
      else if (src[i] === '}') depth--;
      i++;
    }
    return src.slice(startIndex, i - 1);
  }

  // Returns members as { text, start, end } where start/end are char offsets
  // WITHIN `block`, so the caller can resolve member line anchors.
  function extractInterfaceMembers(block) {
    const maskedBlock = maskCode(block, { js: true });
    const members = [];
    for (const m of block.matchAll(/^\s+(readonly\s+)?(\w+)(\??):\s*([^;]+);/gm)) {
      const readonly = m[1] ? 'readonly ' : '';
      const optional = m[3] ? '?' : '';
      const typeStr = m[4].trim().replace(/\s+/g, ' ').slice(0, 35);
      const start = m.index + (m[0].length - m[0].replace(/^\s+/, '').length);
      members.push({ text: `${readonly}${m[2]}${optional}: ${typeStr}`, start, end: m.index + m[0].length });
    }
    for (const m of maskedBlock.matchAll(/^\s+(\w+)\s*(?:<[^(]*>)?\s*\(/gm)) {
      const openIdx = m.index + m[0].length - 1;
      const closeIdx = readBalanced(maskedBlock, openIdx);
      if (closeIdx === -1 || !/^\s*:/.test(maskedBlock.slice(closeIdx + 1, closeIdx + 40))) continue;
      const start = m.index + (m[0].length - m[0].replace(/^\s+/, '').length);
      members.push({ text: `${m[1]}(${normalizeParams(block.slice(openIdx + 1, closeIdx))})`, start, end: closeIdx + 1 });
    }
    return capMembersWithNotice(members, 120, 'members');
  }

  const _CTRL_KEYWORDS = new Set(['if', 'for', 'while', 'switch', 'do', 'try', 'catch', 'finally', 'else', 'return']);

  // Returns members as { text, start, end } where start/end are char offsets
  // WITHIN `block` (end = the method's closing brace), so the caller can resolve
  // per-method line anchors that span the method body.
  function extractClassMembers(block, maskedBlock) {
    const masked = maskedBlock || maskCode(block, { js: true });
    const members = [];
    // Public methods (skip private/protected/_ prefixed and control-flow keywords)
    // `get`/`set` are in the modifier list because an accessor is part of a
    // class's public surface — javascript.js has always treated them this way,
    // and the asymmetry meant a TypeScript class silently lost every accessor.
    // Found while fixing mixin-class extraction on a Lit codebase, where
    // `static get properties()` IS the reactive surface.
    const methodRe = /^\s+(?:public\s+|static\s+|async\s+|override\s+|get\s+|set\s+)*(\w+)\s*(?:<[^(]*>)?\s*\(/gm;
    for (const m of masked.matchAll(methodRe)) {
      if (_CTRL_KEYWORDS.has(m[1])) continue;
      if (/^(private|protected|_)/.test(m[1])) continue;
      const openIdx = m.index + m[0].length - 1;
      const closeIdx = readBalanced(masked, openIdx);
      if (closeIdx === -1) continue;
      // Declaration tail check + return-type capture, mirroring the old
      // `\)(?:\s*:\s*[^{;]+)?\s*\{` shape against the text after the real close.
      const tail = masked.slice(closeIdx + 1, closeIdx + 200).match(/^(\s*:\s*[^{;]+?)?\s*\{/);
      if (!tail) continue;
      const params = block.slice(openIdx + 1, closeIdx);
      const bodyStart = closeIdx + 1 + tail[0].length; // just past the opening brace
      const end = bodyStart + extractBlock(masked, bodyStart).length;
      const start = m.index + (m[0].length - m[0].replace(/^\s+/, '').length);
      if (m[1] === 'constructor') { members.push({ text: `constructor(${normalizeParams(params)})`, start, end }); continue; }
      const isAsync = m[0].includes('async ') ? 'async ' : '';
      const isStatic = m[0].includes('static ') ? 'static ' : '';
      const retRaw = tail[1] ? block.slice(closeIdx + 1, closeIdx + 1 + tail[1].length).replace(/^\s*:\s*/, '') : '';
      const retType = retRaw ? retRaw.trim().replace(/\s+/g, ' ').slice(0, 20) : '';
      const retStr = retType ? ` → ${retType}` : '';
      members.push({ text: `${isStatic}${isAsync}${m[1]}(${normalizeParams(params)})${retStr}`, start, end });
    }
    return capMembersWithNotice(members, 120, 'methods');
  }

  function normalizeParams(params) {
    if (!params) return '';
    const compact = params.trim().replace(/\s+/g, ' ');
    // Strip `: type` annotations at top level only — nested delimiters in types
    // (e.g. `cb: (x: number) => void`, `m: Map<string, X>`) are consumed with
    // their annotation instead of truncating at the first `)` or `,` (#526).
    let out = '';
    let depth = 0;
    let inType = false;
    let quote = null;
    for (let i = 0; i < compact.length; i++) {
      const ch = compact[i];
      if (quote) {
        if (ch === '\\') { if (!inType) out += ch + (compact[i + 1] || ''); i++; continue; }
        if (ch === quote) quote = null;
        if (!inType) out += ch;
        continue;
      }
      if (ch === '"' || ch === "'" || ch === '`') { quote = ch; if (!inType) out += ch; continue; }
      if (ch === '(' || ch === '[' || ch === '{' || ch === '<') depth++;
      else if (ch === ')' || ch === ']' || ch === '}' || (ch === '>' && compact[i - 1] !== '=')) depth--;
      if (inType) {
        if (depth <= 0 && ch === ',') { inType = false; out += ch; }
        else if (depth <= 0 && ch === '=' && compact[i + 1] !== '>') { inType = false; out += ' ='; }
        continue;
      }
      if (depth === 0 && ch === ':') { inType = true; continue; }
      out += ch;
    }
    return out.replace(/\s*,\s*/g, ', ').replace(/\s+/g, ' ').trim();
  }

  // First prose sentence of the JSDoc block immediately preceding an exported
  // top-level function (function or arrow-const form). Mirrors the Python
  // extractor's extractDocHint: first sentence only, 60-char cap.
  function buildDocHints(src) {
    const hints = new Map();
    // Body may not contain `*/` — otherwise a failed adjacency check would let
    // the match expand across a whole function to the next comment block and
    // misattribute the hint.
    const patterns = [
      /\/\*\*((?:[^*]|\*(?!\/))*)\*\/\s*export\s+(?:default\s+)?(?:async\s+)?function\s+(\w+)\s*[<(]/g,
      /\/\*\*((?:[^*]|\*(?!\/))*)\*\/\s*export\s+const\s+(\w+)\s*[:=]/g,
    ];
    for (const re of patterns) {
      for (const m of src.matchAll(re)) {
        const hint = firstDocSentence(m[1]);
        if (hint && !hints.has(m[2])) hints.set(m[2], hint);
      }
    }
    return hints;
  }

  // First non-tag prose line of a JSDoc body → first sentence, 60-char cap.
  function firstDocSentence(body) {
    const line = String(body).split('\n')
      .map((l) => l.replace(/^\s*\*\s?/, '').trim())
      .find((l) => l && !l.startsWith('@'));
    if (!line) return '';
    return line.split(/[.!?]/)[0].trim().slice(0, 60);
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/typescript_native ──
__factories["./src/extractors/typescript_native"] = function(module, exports) {
  
  const path = require('path');
  const { anchor } = __require('./src/extractors/line-anchor');
  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');

  // True-AST TypeScript extraction via the TARGET REPO's own `typescript`
  // package (#609, tier T2 of #542). Nothing is bundled and nothing is
  // required to exist: `resolveRepoTypescript` probes node_modules upward from
  // the file being extracted — the user's install, never ours (the lib-index
  // precedent) — and every failure path returns null so the caller falls back
  // to the regex extractor silently. Opt-in via `exactness.typescript`; the
  // resolved compiler is the target repo's own code and runs in-process, which
  // is why this tier is a conscious config choice rather than a default.
  //
  // Output parity: same line vocabulary as src/extractors/typescript.js (the
  // regex floor), same ceilings, same disclosure markers — only the parse is
  // different, so anchors and signatures survive multiline declarations,
  // constrained generics, decorators, and overloads that regex cannot see.

  // Emit only what the regex tier emits, in the same kind-grouped order, so a
  // flag-on/flag-off diff shows parsing differences rather than reordering.
  const MEMBER_LIMIT = 120;
  const PER_FILE_LIMIT = 200;
  const FUNC_RET_CHARS = 30;
  const METHOD_RET_CHARS = 20;
  const IFACE_TYPE_CHARS = 35;

  const _resolveCache = new Map(); // dirname → { ts, version } | null

  /**
   * Resolve the target repo's own `typescript` package, walking node_modules
   * upward from the file's directory. Cached per directory; null when absent
   * or unloadable.
   * @param {string} fromPath - absolute path of the file being extracted
   * @returns {{ ts: object, version: string }|null}
   */
  function resolveRepoTypescript(fromPath) {
    const dir = path.dirname(path.resolve(fromPath));
    if (_resolveCache.has(dir)) return _resolveCache.get(dir);
    let out = null;
    try {
      const resolved = require.resolve('typescript', { paths: [dir] });
      const ts = require(resolved);
      if (ts && typeof ts.createSourceFile === 'function' && typeof ts.version === 'string') {
        out = { ts, version: ts.version };
      }
    } catch (_) {}
    _resolveCache.set(dir, out);
    return out;
  }

  const _compact = (s) => String(s).replace(/\s+/g, ' ').trim();

  /**
   * Extract signatures from TypeScript source via the provided compiler module.
   * Returns null on ANY failure so the caller can fall back to regex.
   * @param {string} src - raw file content
   * @param {string} filePath - absolute path (names the SourceFile)
   * @param {object} ts - a resolved `typescript` module
   * @returns {string[]|null}
   */
  function extract(src, filePath, ts) {
    if (!src || typeof src !== 'string' || !ts) return null;
    try {
      return _extract(src, filePath, ts);
    } catch (_) {
      return null;
    }
  }

  function _extract(src, filePath, ts) {
    const sf = ts.createSourceFile(filePath || 'file.ts', src, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
    const lineOf = (pos) => sf.getLineAndCharacterOfPosition(pos).line + 1;
    const startLine = (node) => lineOf(node.getStart(sf));
    const endLine = (node) => lineOf(node.end > 0 ? node.end - 1 : node.end);
    const mods = (node) => (ts.canHaveModifiers && ts.canHaveModifiers(node) ? ts.getModifiers(node) : node.modifiers) || [];
    const hasMod = (node, kind) => mods(node).some((m) => m.kind === kind);
    const isExported = (node) => hasMod(node, ts.SyntaxKind.ExportKeyword);

    // Parameter rendering matches normalizeParams' output: names and defaults
    // survive, type annotations do not; constructor parameter-property
    // modifiers (private/readonly/...) survive because they name real fields.
    const paramText = (p) => {
      let out = '';
      for (const m of mods(p)) out += m.getText(sf) + ' ';
      if (p.dotDotDotToken) out += '...';
      out += _compact(p.name.getText(sf));
      if (p.initializer) out += ` = ${_compact(p.initializer.getText(sf)).slice(0, 40)}`;
      return out;
    };
    const paramsText = (node) => (node.parameters || []).map(paramText).join(', ');
    const retText = (node, cap) => {
      if (!node.type) return '';
      const t = _compact(node.type.getText(sf)).slice(0, cap);
      return t ? ` → ${t}` : '';
    };
    const docHint = (node) => {
      const js = node.jsDoc && node.jsDoc[0];
      if (!js || !js.comment) return '';
      const text = typeof js.comment === 'string'
        ? js.comment
        : js.comment.map((c) => c.text || '').join('');
      return _compact(text).split(/[.!?]/)[0].trim().slice(0, 60);
    };

    const interfaces = [];
    const types = [];
    const enums = [];
    const classes = [];
    const funcs = [];
    const arrows = [];

    for (const node of sf.statements) {
      if (ts.isInterfaceDeclaration(node) && isExported(node)) {
        const block = [{ text: `export interface ${node.name.text}`, s: startLine(node), e: endLine(node) }];
        const members = [];
        for (const mem of node.members) {
          if (ts.isPropertySignature(mem) && mem.name && mem.type) {
            const ro = hasMod(mem, ts.SyntaxKind.ReadonlyKeyword) ? 'readonly ' : '';
            const opt = mem.questionToken ? '?' : '';
            members.push({
              text: `${ro}${mem.name.getText(sf)}${opt}: ${_compact(mem.type.getText(sf)).slice(0, IFACE_TYPE_CHARS)}`,
              s: startLine(mem), e: endLine(mem),
            });
          } else if (ts.isMethodSignature(mem) && mem.name) {
            members.push({ text: `${mem.name.getText(sf)}(${paramsText(mem)})`, s: startLine(mem), e: endLine(mem) });
          }
        }
        for (const mem of capMembersWithNotice(members, MEMBER_LIMIT, 'members')) {
          block.push({ text: `  ${mem.text}`, s: mem.s || 0, e: mem.e || 0, marker: !mem.s });
        }
        interfaces.push(...block);
      } else if (ts.isTypeAliasDeclaration(node) && isExported(node)) {
        types.push({ text: `export type ${node.name.text}`, s: startLine(node), e: endLine(node) });
      } else if (ts.isEnumDeclaration(node) && isExported(node)) {
        enums.push({ text: `export enum ${node.name.text}`, s: startLine(node), e: endLine(node) });
      } else if (ts.isClassDeclaration(node) && node.name) {
        const prefix = isExported(node) ? 'export ' : '';
        const abs = hasMod(node, ts.SyntaxKind.AbstractKeyword) ? 'abstract ' : '';
        const block = [{ text: `${prefix}${abs}class ${node.name.text}`, s: startLine(node), e: endLine(node) }];
        const members = [];
        for (const mem of node.members) {
          if (ts.isConstructorDeclaration(mem) && mem.body) {
            members.push({ text: `constructor(${paramsText(mem)})`, s: startLine(mem), e: endLine(mem) });
          } else if (ts.isMethodDeclaration(mem) && mem.body && mem.name) {
            const name = mem.name.getText(sf);
            if (/^(private|protected|_)/.test(name)) continue;
            if (hasMod(mem, ts.SyntaxKind.PrivateKeyword) || hasMod(mem, ts.SyntaxKind.ProtectedKeyword)) continue;
            const st = hasMod(mem, ts.SyntaxKind.StaticKeyword) ? 'static ' : '';
            const as = hasMod(mem, ts.SyntaxKind.AsyncKeyword) ? 'async ' : '';
            members.push({
              text: `${st}${as}${name}(${paramsText(mem)})${retText(mem, METHOD_RET_CHARS)}`,
              s: startLine(mem), e: endLine(mem),
            });
          }
        }
        for (const mem of capMembersWithNotice(members, MEMBER_LIMIT, 'methods')) {
          block.push({ text: `  ${mem.text}`, s: mem.s || 0, e: mem.e || 0, marker: !mem.s });
        }
        classes.push(...block);
      } else if (ts.isFunctionDeclaration(node) && node.body && node.name && isExported(node)) {
        const as = hasMod(node, ts.SyntaxKind.AsyncKeyword) ? 'async ' : '';
        const hint = docHint(node);
        funcs.push({
          text: `export ${as}function ${node.name.text}(${paramsText(node)})${retText(node, FUNC_RET_CHARS)}`,
          s: startLine(node), e: endLine(node), hint,
        });
      } else if (ts.isVariableStatement(node) && isExported(node)) {
        for (const decl of node.declarationList.declarations) {
          const init = decl.initializer;
          if (!init || !ts.isArrowFunction(init) || !ts.isIdentifier(decl.name)) continue;
          const as = hasMod(init, ts.SyntaxKind.AsyncKeyword) ? 'async ' : '';
          arrows.push({
            text: `export const ${decl.name.text} = ${as}(${paramsText(init)}) =>`,
            s: startLine(node), e: endLine(node), hint: docHint(node),
          });
        }
      }
    }

    const rows = [...interfaces, ...types, ...enums, ...classes, ...funcs, ...arrows];
    const sigs = rows.map((r) => {
      const base = r.marker ? r.text : `${r.text}${anchor(r.s, r.e)}`;
      return r.hint ? `${base}  # ${r.hint}` : base;
    });
    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  module.exports = { extract, resolveRepoTypescript };
  
};

// ── ./src/extractors/typescript_react ──
__factories["./src/extractors/typescript_react"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling discloses what it drops rather than truncating silently (#583).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract React component signatures from .tsx files.
   * Captures component props interfaces, hooks usage, and exports.
   *
   * @param {string} src - Raw TypeScript/TSX content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Remove comments to simplify matching
    const stripped = src
      .replace(/\/\*[\s\S]*?\*\//g, '')
      .replace(/\/\/.*$/gm, '');

    // Component function declarations
    const compRe = /(?:export\s+)?(?:const|function)\s+([A-Z]\w*)\s*(?:<[^>]*>)?\s*\(\s*(?:props|{\s*[^}]*})?/g;
    for (const m of stripped.matchAll(compRe)) {
      sigs.push(`component ${m[1]}`);
    }

    // Props interfaces: interface SomeProps { ... }
    const propsRe = /interface\s+(\w*Props)\s*(?:<[^>]*>)?\s*{/g;
    for (const m of stripped.matchAll(propsRe)) {
      sigs.push(`props ${m[1]}`);
    }

    // React hooks (useState, useEffect, useContext, useCallback, useMemo, useReducer)
    const hookRe = /use([A-Z]\w*)\s*(?:<[^>]*>)?\s*\(/g;
    const hooks = new Set();
    for (const m of stripped.matchAll(hookRe)) {
      hooks.add(m[1]);
    }
    for (const h of hooks) {
      sigs.push(`hook use${h}`);
    }

    // Import/export statements for components
    const exportRe = /export\s+(?:const|function|default|interface|type)\s+([A-Z]\w*)/g;
    for (const m of stripped.matchAll(exportRe)) {
      sigs.push(`export ${m[1]}`);
    }

    // Event handler patterns: onClick, onChange, onSubmit, etc
    const handlerRe = /on([A-Z]\w+)\s*=\s*{?\s*\(?[a-zA-Z_$]/g;
    const handlers = new Set();
    for (const m of stripped.matchAll(handlerRe)) {
      handlers.add(m[1]);
    }
    for (const h of handlers) {
      sigs.push(`handler on${h}`);
    }

    return capWithNotice(Array.from(new Set(sigs)), PER_FILE_LIMIT, 'signatures');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/vue_sfc ──
__factories["./src/extractors/vue_sfc"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  /**
   * Extract Vue Single-File Component (SFC) signatures from .vue files.
   * Captures component metadata: name, props, emits, slots, composables, lifecycle.
   *
   * @param {string} src - Raw Vue SFC content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Extract script block (both <script> and <script setup>)
    const scriptMatch = src.match(/<script[^>]*>([\s\S]*?)<\/script>/);
    if (!scriptMatch) return sigs;
    const script = scriptMatch[1];

    // Component name (from export default { name: '...' })
    const nameRe = /(?:name\s*:\s*['"`]([a-zA-Z0-9]+)['"`]|export\s+default\s+defineComponent\s*\(\s*{\s*name\s*:\s*['"`]([a-zA-Z0-9]+)['"`])/;
    const nameMatch = script.match(nameRe);
    if (nameMatch) {
      sigs.push(`component ${nameMatch[1] || nameMatch[2]}`);
    }

    // Props definition
    const propsRe = /props\s*:\s*{([^}]*)}/;
    const propsMatch = script.match(propsRe);
    if (propsMatch) {
      const propLines = propsMatch[1].split(',');
      for (const line of propLines) {
        const propName = line.trim().match(/([a-zA-Z_$]\w*)/);
        if (propName) sigs.push(`prop ${propName[1]}`);
      }
    }

    // Props in composition API (defineProps)
    const definePropsRe = /defineProps\s*(?:<([^>]+)>)?\s*\(/;
    if (definePropsRe.test(script)) {
      sigs.push('props composition-api');
    }

    // Emits definition
    const emitsRe = /emits\s*:\s*\[([^\]]+)\]/;
    const emitsMatch = script.match(emitsRe);
    if (emitsMatch) {
      const emitNames = emitsMatch[1].split(',').map(e => e.trim().replace(/['"`]/g, ''));
      for (const e of emitNames) {
        if (e) sigs.push(`emit ${e}`);
      }
    }

    // Emits in composition API (defineEmits)
    const defineEmitsRe = /defineEmits\s*(?:<([^>]+)>)?\s*\(/;
    if (defineEmitsRe.test(script)) {
      sigs.push('emits composition-api');
    }

    // Lifecycle hooks
    const lifecycleHooks = ['setup', 'created', 'mounted', 'updated', 'unmounted'];
    for (const hook of lifecycleHooks) {
      if (new RegExp(`\\b${hook}\\s*\\(`).test(script)) {
        sigs.push(`lifecycle ${hook}`);
      }
    }

    // Composable/hooks usage (useXxx)
    const composableRe = /(?:import|const)\s+(?:{[^}]*}|[a-zA-Z_$]\w*)\s+from\s+['"]/g;
    if (composableRe.test(script)) {
      const useRe = /use([A-Z]\w*)/g;
      for (const m of script.matchAll(useRe)) {
        sigs.push(`composable use${m[1]}`);
      }
    }

    // Slots definition — capture from <slot name="..."> and template slots
    const namedSlotRe = /<slot\s+name=['"]([a-zA-Z_$]\w*)['"][^>]*>/g;
    const templateSlotRe = /<template\s+#([a-zA-Z_$]\w*)|v-slot:([a-zA-Z_$]\w*)/g;
    const slots = new Set();
    
    // Named slots in template: <slot name="header">
    for (const m of src.matchAll(namedSlotRe)) {
      if (m[1]) slots.add(m[1]);
    }
    
    // Template slots with # or v-slot
    for (const m of src.matchAll(templateSlotRe)) {
      const slotName = m[1] || m[2];
      if (slotName) slots.add(slotName);
    }
    
    for (const s of slots) {
      sigs.push(`slot ${s}`);
    }

    return capWithNotice(Array.from(new Set(sigs)), 200, 'signatures');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/xml ──
__factories["./src/extractors/xml"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  /**
   * Lightweight XML config extractor.
   * Captures root tags, key config tags, and id/name/class attributes.
   *
   * @param {string} src - Raw XML content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];
    const sigs = [];

    // Remove comments and XML declaration for simpler scanning.
    const stripped = src
      .replace(/<!--[\s\S]*?-->/g, '')
      .replace(/<\?xml[\s\S]*?\?>/gi, '');

    // Root element (first opening tag).
    const root = stripped.match(/<\s*([A-Za-z_][\w:.-]*)\b[^>]*>/);
    if (root) sigs.push(`root ${root[1]}`);

    // High-value config-like tags.
    const tagRe = /<\s*([A-Za-z_][\w:.-]*)\b([^>]*)>/g;
    for (const m of stripped.matchAll(tagRe)) {
      const tag = m[1];
      const attrs = m[2] || '';

      if (/^(bean|beans|route|routes|property|properties|dependency|dependencies|plugin|plugins|configuration|settings|profile|profiles|module|modules)$/i.test(tag)) {
        sigs.push(`tag ${tag}`);
      }

      const id = attrs.match(/\bid\s*=\s*"([^"]+)"/i);
      if (id) sigs.push(`${tag}#${id[1]}`);

      const name = attrs.match(/\bname\s*=\s*"([^"]+)"/i);
      if (name) sigs.push(`${tag}[name=${name[1]}]`);

      const cls = attrs.match(/\bclass\s*=\s*"([^"]+)"/i);
      if (cls) sigs.push(`${tag} -> ${cls[1]}`);
    }

    return capWithNotice(Array.from(new Set(sigs)), 200, 'signatures');
  }

  module.exports = { extract };
  
};

// ── ./src/extractors/yaml ──
__factories["./src/extractors/yaml"] = function(module, exports) {
  
  const { capWithNotice } = __require('./src/util/truncate');

  // Ceiling sits above the default `maxSigsPerFile` so the configured budget
  // governs output rather than a literal buried here, and omissions are disclosed (#576).
  const PER_FILE_LIMIT = 200;

  /**
   * Extract signatures from YAML configuration files.
   * @param {string} src - Raw file content
   * @returns {string[]} Array of signature strings
   */
  function extract(src) {
    if (!src || typeof src !== 'string') return [];

    // A workflow living outside its conventional path (vendored templates,
    // generator fixtures) still deserves semantic signatures rather than a bare
    // key list. The sniff is deliberately narrow so plain config never matches.
    try {
      const pipeline = __require('./src/extractors/pipeline');
      if (pipeline.sniffPlatform(src)) {
        const routed = pipeline.extract(src, '');
        if (routed.length > 0) return routed;
      }
    } catch (_) { /* fall through to the generic key scan */ }

    const sigs = [];

    const lines = src.split('\n');

    // Top-level keys (no leading whitespace)
    const topKeys = [];
    for (const line of lines) {
      if (/^#/.test(line)) continue;
      const m = line.match(/^([\w-]+)\s*:/);
      if (m) topKeys.push(m[1]);
    }
    if (topKeys.length > 0) sigs.push(`keys: [${topKeys.slice(0, 12).join(', ')}]`);

    // GitHub Actions: jobs
    let inJobs = false;
    for (const line of lines) {
      if (/^jobs\s*:/.test(line)) { inJobs = true; continue; }
      if (inJobs && /^[a-z]/.test(line) && !line.startsWith('jobs')) inJobs = false;
      if (inJobs) {
        const m = line.match(/^  ([\w-]+)\s*:/);
        if (m) sigs.push(`job: ${m[1]}`);
      }
    }

    // Docker Compose: services
    let inServices = false;
    for (const line of lines) {
      if (/^services\s*:/.test(line)) { inServices = true; continue; }
      if (inServices && /^[a-z]/.test(line) && !line.startsWith('services')) inServices = false;
      if (inServices) {
        const m = line.match(/^  ([\w-]+)\s*:/);
        if (m) sigs.push(`service: ${m[1]}`);
      }
    }

    // OpenAPI paths
    let inPaths = false;
    for (const line of lines) {
      if (/^paths\s*:/.test(line)) { inPaths = true; continue; }
      if (inPaths && /^[a-z]/.test(line) && !line.startsWith('paths')) inPaths = false;
      if (inPaths) {
        const m = line.match(/^  (\/[\w/{}-]*)\s*:/);
        if (m) sigs.push(`path: ${m[1]}`);
      }
    }

    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
  }

  module.exports = { extract };
  
};

// ── ./src/format/ask-output ──
__factories["./src/format/ask-output"] = function(module, exports) {
  
  /**
   * Default `sigmap ask` output (#966, from #879): the answer first, then as little
   * metadata as it takes to audit it.
   *
   * `ask` used to print a 12-line box and nothing else on stdout — intent, context
   * size, cutoff, hash, selection, coverage, risk, cost and a footnote — while the
   * files it ranked lived only in `.context/query-context.md`. The first thing a
   * reader met was metadata, none of it the answer, and `Risk: HIGH (19 file(s)
   * changed vs HEAD)` on an ordinary dirty working tree.
   *
   * The default is now the ranked files, one summary line carrying what makes a
   * result reproducible (count, cutoff, tokens, hash, where the context was
   * written) and — only when there is something to act on — one more line.
   * `--verbose` keeps the whole box, which the CLI core still prints; `--json` is
   * untouched.
   *
   * Pure formatting: the CLI core hands over figures it already computed for the
   * box and for `--json`, so nothing here can disagree with either. Zero dependencies.
   */

  /** NONE / LOW / MEDIUM / HIGH for a count of changed files — the scale `ask` uses for every `Risk` figure. */
  function riskLevel(count) {
    return count === 0 ? 'NONE' : count <= 3 ? 'LOW' : count <= 10 ? 'MEDIUM' : 'HIGH';
  }

  /** A score rounded exactly as `--json` rounds it, so a row and `cutoffScore` compare as equals. */
  function roundScore(score) {
    return Number.isFinite(score) ? Math.round(score * 1000) / 1000 : null;
  }

  const num = (n) => n.toLocaleString('en-US');

  /**
   * The ranked files, one per line: rank, path, score, and the tokens of its signatures.
   *
   * @param {Array<{file:string, score:number, tokens?:number}>} ranked
   * @returns {string[]}
   */
  function formatRankedList(ranked) {
    const rows = (ranked || []).map((r, i) => ({
      n: String(i + 1),
      file: String(r.file),
      score: roundScore(r.score),
      tokens: typeof r.tokens === 'number' ? num(r.tokens) : null,
    }));
    if (rows.length === 0) return [];
    const scoreOf = (r) => (r.score === null ? '-' : r.score.toFixed(3));
    // A loop, not `Math.max(...rows.map(...))`: spreading a very large `--top` overflows the call stack.
    const widest = (len) => rows.reduce((w, r) => Math.max(w, len(r)), 0);
    const nW = widest((r) => r.n.length);
    const fW = widest((r) => r.file.length);
    const sW = widest((r) => scoreOf(r).length);
    const tW = widest((r) => (r.tokens === null ? 0 : r.tokens.length));
    return rows.map((r) => {
      const tok = r.tokens === null ? '' : `  ${r.tokens.padStart(tW)} tok`;
      return `${r.n.padStart(nW)}  ${r.file.padEnd(fW)}  ${scoreOf(r).padStart(sW)}${tok}`.trimEnd();
    });
  }

  /**
   * The line every default run prints after the list. It keeps what #775 made
   * auditable — how many files, where the cut fell, a hash of what was written —
   * and says where the signatures are.
   *
   * @param {{ selected:number, indexed:number, cutoff:number|null, tokens:number, hash:string, contextPath:string }} s
   * @returns {string}
   */
  function formatSummary(s) {
    const parts = [
      `${s.selected} of ${s.indexed} files`,
      Number.isFinite(s.cutoff) ? `cutoff ${s.cutoff.toFixed(3)}` : null,
      `${num(s.tokens)} tokens`,
      s.hash,
    ].filter(Boolean);
    return `${parts.join(' · ')} → ${s.contextPath}`;
  }

  /**
   * What `--with-source` did, or null when it was not asked for. A request that put
   * nothing in is reported, never dropped: the reader asked for bodies.
   *
   * @param {object|null} section  the `--with-source` report, or null when it failed
   * @param {boolean} requested    whether `--with-source` was passed
   * @returns {string|null}
   */
  function formatSourceStatus(section, requested) {
    if (section && section.included > 0) {
      const omitted = section.truncated ? `; ${section.skipped} omitted (over budget)` : '';
      return `source: ${section.included} of ${section.candidates} top symbol(s), ` +
        `${num(section.spentTokens)} of ${num(section.budgetTokens)} budget token(s)${omitted}`;
    }
    if (requested) {
      const budget = section ? num(section.budgetTokens) : '0';
      return `source: none included — no anchored symbol fit the ${budget}-token budget ` +
        '(raise maxTokens or pass --source-budget <n>)';
    }
    return null;
  }

  /**
   * The `Risk` a reader can act on: the selected files that differ from HEAD. The
   * whole-tree figure (`--verbose`) says how much is in flight; this says whether
   * the answer is standing on code that is mid-edit.
   *
   * @param {number} selected  how many files were selected
   * @param {number} changed   how many of them are changed vs HEAD
   * @returns {{ level:string, changed:number, selected:number }|null}  null when none is
   */
  function selectionRisk(selected, changed) {
    return changed > 0 ? { level: riskLevel(changed), changed, selected } : null;
  }

  /** What an empty selection says when nothing in the query matched. */
  const NO_MATCH_HINT = 'no file matched — try other wording, or --explain to see which tokens matched';

  /**
   * The optional second line: only what the reader can act on, joined by " · ".
   *
   * @param {{ empty?:string|null, notes?:string[], source?:string|null, risk?:{level:string,changed:number,selected:number}|null }} h
   *        `empty` is the message for an empty selection (NO_MATCH_HINT, or a more exact one such
   *        as "nothing changed since <ref>" when a filter, not the query, emptied it)
   * @returns {string|null}  null when there is nothing to say
   */
  function formatHeadsUp(h) {
    const items = [];
    if (h.empty) items.push(h.empty);
    if (h.notes && h.notes.length > 0) items.push(`notes: ${h.notes.length} matching (${h.notes.join(' / ')})`);
    if (h.source) items.push(h.source);
    if (h.risk) items.push(`risk: ${h.risk.level} (${h.risk.changed} of ${h.risk.selected} selected file(s) changed vs HEAD)`);
    return items.length > 0 ? items.join(' · ') : null;
  }

  module.exports = { NO_MATCH_HINT, riskLevel, roundScore, formatRankedList, formatSummary, formatSourceStatus, selectionRisk, formatHeadsUp };
  
};

// ── ./src/format/benchmark-report ──
__factories["./src/format/benchmark-report"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');

  function escapeHtml(value) {
    return String(value == null ? '' : value)
      .replace(/&/g, '&amp;')
      .replace(/</g, '&lt;')
      .replace(/>/g, '&gt;')
      .replace(/"/g, '&quot;');
  }

  function formatInt(value) {
    const n = Number(value);
    if (!Number.isFinite(n)) return 'n/a';
    return Math.round(n).toLocaleString('en-US');
  }

  function formatCompact(value) {
    const n = Number(value);
    if (!Number.isFinite(n)) return 'n/a';
    if (Math.abs(n) >= 1_000_000) return `${(n / 1_000_000).toFixed(1)}M`;
    if (Math.abs(n) >= 1_000) return `${(n / 1_000).toFixed(1)}K`;
    return String(Math.round(n));
  }

  function formatPct(value, digits = 1) {
    const n = Number(value);
    if (!Number.isFinite(n)) return 'n/a';
    return `${n.toFixed(digits)}%`;
  }

  function formatMaybePct(value, digits = 1) {
    const n = Number(value);
    if (!Number.isFinite(n)) return 'n/a';
    return `${n.toFixed(digits)}%`;
  }

  function formatRatio(value, digits = 1) {
    const n = Number(value);
    if (!Number.isFinite(n)) return 'n/a';
    return `${n.toFixed(digits)}x`;
  }

  function formatMoney(value) {
    const n = Number(value);
    if (!Number.isFinite(n)) return 'n/a';
    return `$${n.toLocaleString('en-US', { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;
  }

  function durationLabel(ms) {
    const n = Number(ms);
    if (!Number.isFinite(n)) return 'n/a';
    const sec = n / 1000;
    if (sec < 60) return `${sec.toFixed(1)}s`;
    const min = Math.floor(sec / 60);
    const rem = sec - (min * 60);
    return `${min}m ${rem.toFixed(1)}s`;
  }

  function maxOrZero(values) {
    if (!Array.isArray(values) || values.length === 0) return 0;
    return Math.max(...values.map((v) => (Number.isFinite(v) ? v : 0)));
  }

  function readJson(filePath) {
    try {
      if (!fs.existsSync(filePath)) return null;
      return JSON.parse(fs.readFileSync(filePath, 'utf8'));
    } catch (_) {
      return null;
    }
  }

  function loadBenchmarkReports(cwd) {
    const reportsDir = path.join(cwd, 'benchmarks', 'reports');
    return {
      reportsDir,
      token: readJson(path.join(reportsDir, 'token-reduction.json')),
      retrieval: readJson(path.join(reportsDir, 'retrieval.json')),
      quality: readJson(path.join(reportsDir, 'quality.json')),
      task: readJson(path.join(reportsDir, 'task-benchmark.json')),
      matrix: readJson(path.join(reportsDir, 'benchmark-matrix.json')),
    };
  }

  function buildRetrievalSummary(retrieval) {
    if (!retrieval || !Array.isArray(retrieval.repos) || retrieval.repos.length === 0) return null;
    let totalTasks = 0;
    let weightedHit = 0;
    let weightedRand = 0;
    let correct = 0;
    let partial = 0;
    let wrong = 0;
    let repoCount = 0;

    for (const repo of retrieval.repos) {
      const tasks = Number(repo.tasks) || 0;
      repoCount++;
      totalTasks += tasks;
      weightedHit += (Number(repo.hitAt5) || 0) * tasks;
      weightedRand += (Number(repo.randomBaseline) || 0) * tasks;
      correct += Number(repo.tiers && repo.tiers.correct) || 0;
      partial += Number(repo.tiers && repo.tiers.partial) || 0;
      wrong += Number(repo.tiers && repo.tiers.wrong) || 0;
    }

    const hitAt5 = totalTasks > 0 ? (weightedHit / totalTasks) * 100 : null;
    const randomBaseline = totalTasks > 0 ? (weightedRand / totalTasks) * 100 : null;
    const lift = hitAt5 && randomBaseline ? hitAt5 / randomBaseline : null;

    return {
      repoCount,
      totalTasks,
      hitAt5,
      randomBaseline,
      lift,
      correct,
      partial,
      wrong,
    };
  }

  function buildBenchmarkSummary(reports, matrixSummary) {
    const missing = [];
    if (!reports.token) missing.push('token-reduction.json');
    if (!reports.retrieval) missing.push('retrieval.json');
    if (!reports.quality) missing.push('quality.json');
    if (!reports.task) missing.push('task-benchmark.json');

    const retrievalSummary = buildRetrievalSummary(reports.retrieval);
    const qualitySummary = reports.quality && reports.quality.summary ? reports.quality.summary : null;
    const tokenSummary = reports.token && reports.token.summary ? reports.token.summary : null;
    const taskSummary = reports.task && reports.task.summary ? reports.task.summary : null;
    const matrix = matrixSummary || reports.matrix || null;

    const generatedCandidates = [
      matrix && matrix.generated,
      reports.task && reports.task.generated,
      reports.retrieval && reports.retrieval.generated,
      reports.quality && reports.quality.timestamp,
      reports.token && reports.token.timestamp,
    ].filter(Boolean);
    const generatedAt = generatedCandidates
      .map((value) => ({ value, time: Date.parse(value) }))
      .filter((item) => Number.isFinite(item.time))
      .sort((a, b) => b.time - a.time)[0];

    return {
      generatedAt: (generatedAt && generatedAt.value) || generatedCandidates[0] || new Date().toISOString(),
      missing,
      tokenSummary,
      retrievalSummary,
      qualitySummary,
      taskSummary,
      matrix,
    };
  }

  function renderCard(label, value, hint, tone) {
    const toneClass = tone ? ` ${tone}` : '';
    return [
      `<article class="card${toneClass}">`,
      `<div class="label">${escapeHtml(label)}</div>`,
      `<div class="value">${escapeHtml(value)}</div>`,
      `<div class="hint">${escapeHtml(hint || '')}</div>`,
      '</article>',
    ].join('');
  }

  function renderProgress(label, value, max, suffix) {
    const safeValue = Number.isFinite(value) ? value : 0;
    const safeMax = Math.max(1, Number.isFinite(max) ? max : 1);
    const width = Math.max(2, Math.min(100, (safeValue / safeMax) * 100));
    return [
      '<div class="progress-row">',
      `<div class="progress-label">${escapeHtml(label)}</div>`,
      '<div class="progress-bar"><span style="width:',
      String(width.toFixed(1)),
      '%"></span></div>',
      `<div class="progress-value">${escapeHtml(`${safeValue}${suffix || ''}`)}</div>`,
      '</div>',
    ].join('');
  }

  function renderMatrixSection(matrix) {
    if (!matrix || !Array.isArray(matrix.steps) || matrix.steps.length === 0) return '';
    const rows = matrix.steps.map((step) => {
      const status = step.ok ? 'ok' : 'fail';
      return [
        '<tr>',
        `<td>${escapeHtml(step.name)}</td>`,
        `<td><span class="badge ${status}">${escapeHtml(step.ok ? 'ok' : `exit ${step.status}`)}</span></td>`,
        `<td>${escapeHtml(durationLabel(step.durationMs))}</td>`,
        `<td><code>${escapeHtml(['node', step.script].concat(step.args || []).join(' '))}</code></td>`,
        '</tr>',
      ].join('');
    }).join('');

    return [
      '<section>',
      '<h2>Run matrix</h2>',
      '<p class="section-copy">This shows which benchmark jobs ran, whether they succeeded, and how long each step took.</p>',
      '<table>',
      '<thead><tr><th>Step</th><th>Status</th><th>Duration</th><th>Command</th></tr></thead>',
      `<tbody>${rows}</tbody>`,
      '</table>',
      '</section>',
    ].join('');
  }

  function renderTokenSection(token) {
    if (!token || !Array.isArray(token.repos) || token.repos.length === 0) return '';
    const rows = token.repos
      .slice()
      .sort((a, b) => (b.reductionPct || 0) - (a.reductionPct || 0))
      .map((repo) => [
        '<tr>',
        `<td>${escapeHtml(repo.repo)}</td>`,
        `<td>${escapeHtml(repo.language || 'n/a')}</td>`,
        `<td>${escapeHtml(formatCompact(repo.rawTokens))}</td>`,
        `<td>${escapeHtml(formatCompact(repo.finalTokens))}</td>`,
        `<td>${escapeHtml(formatMaybePct(repo.reductionPct, 1))}</td>`,
        '</tr>',
      ].join(''))
      .join('');

    return [
      '<section>',
      '<h2>Token reduction</h2>',
      '<p class="section-copy">Raw repository tokens versus SigMap output size across the benchmark repos.</p>',
      '<table>',
      '<thead><tr><th>Repo</th><th>Language</th><th>Raw tokens</th><th>Final tokens</th><th>Reduction</th></tr></thead>',
      `<tbody>${rows}</tbody>`,
      '</table>',
      '</section>',
    ].join('');
  }

  function renderRetrievalSection(retrieval) {
    if (!retrieval || !Array.isArray(retrieval.repos) || retrieval.repos.length === 0) return '';
    const rows = retrieval.repos.map((repo) => {
      const lift = repo.randomBaseline > 0 ? (repo.hitAt5 / repo.randomBaseline) : null;
      return [
        '<tr>',
        `<td>${escapeHtml(repo.repo)}</td>`,
        `<td>${escapeHtml(formatMaybePct((repo.randomBaseline || 0) * 100, 1))}</td>`,
        `<td>${escapeHtml(formatMaybePct((repo.hitAt5 || 0) * 100, 1))}</td>`,
        `<td>${escapeHtml(formatRatio(lift, 1))}</td>`,
        `<td>${escapeHtml(String((repo.tiers && repo.tiers.correct) || 0))}</td>`,
        `<td>${escapeHtml(String((repo.tiers && repo.tiers.partial) || 0))}</td>`,
        `<td>${escapeHtml(String((repo.tiers && repo.tiers.wrong) || 0))}</td>`,
        '</tr>',
      ].join('');
    }).join('');

    return [
      '<section>',
      '<h2>Retrieval quality</h2>',
      '<p class="section-copy">Hit@5 performance against the random baseline, plus the quality-tier mix that drives the task benchmark.</p>',
      '<table>',
      '<thead><tr><th>Repo</th><th>Random hit@5</th><th>SigMap hit@5</th><th>Lift</th><th>Correct</th><th>Partial</th><th>Wrong</th></tr></thead>',
      `<tbody>${rows}</tbody>`,
      '</table>',
      '</section>',
    ].join('');
  }

  function renderQualitySection(quality) {
    if (!quality || !Array.isArray(quality.repos) || quality.repos.length === 0) return '';
    const rows = quality.repos.map((repo) => {
      const overflow = (repo.rawTokens || 0) > 128000 ? 'overflow' : 'fits';
      return [
        '<tr>',
        `<td>${escapeHtml(repo.repo)}</td>`,
        `<td>${escapeHtml(formatInt(repo.groundedSymbols))}</td>`,
        `<td>${escapeHtml(formatInt(repo.darkSymbols))}</td>`,
        `<td>${escapeHtml(formatMaybePct(repo.groundingPct, 0))}</td>`,
        `<td>${escapeHtml(String(repo.filesHiddenRaw || 0))}</td>`,
        `<td><span class="badge ${overflow === 'overflow' ? 'warn' : 'ok'}">${escapeHtml(overflow)}</span></td>`,
        '</tr>',
      ].join('');
    }).join('');

    return [
      '<section>',
      '<h2>Quality and hallucination surface</h2>',
      '<p class="section-copy">How much code stays visible to the model, plus the overflow and dark-symbol risk by repo.</p>',
      '<table>',
      '<thead><tr><th>Repo</th><th>Grounded symbols</th><th>Dark symbols</th><th>Grounding</th><th>Hidden files (raw)</th><th>GPT-4o 128K</th></tr></thead>',
      `<tbody>${rows}</tbody>`,
      '</table>',
      '</section>',
    ].join('');
  }

  function renderTaskSection(task) {
    if (!task || !Array.isArray(task.repos) || task.repos.length === 0 || !task.summary) return '';
    const summary = task.summary;
    const maxReduction = maxOrZero(task.repos.map((repo) => Number(repo.reductionPct) || 0));
    const repoBars = task.repos
      .slice()
      .sort((a, b) => (b.reductionPct || 0) - (a.reductionPct || 0))
      .slice(0, 10)
      .map((repo) => renderProgress(repo.repo, Number(repo.reductionPct) || 0, maxReduction, '%'))
      .join('');

    return [
      '<section>',
      '<h2>Task benchmark</h2>',
      '<p class="section-copy">A prompt-reduction proxy derived from retrieval quality tiers. Lower prompts means the right file surfaces sooner.</p>',
      '<div class="split">',
      '<div class="panel">',
      '<h3>Answer quality tiers</h3>',
      renderProgress('Correct', Number(summary.correctPct) || 0, 100, '%'),
      renderProgress('Partial', Number(summary.partialPct) || 0, 100, '%'),
      renderProgress('Wrong', Number(summary.wrongPct) || 0, 100, '%'),
      '</div>',
      '<div class="panel">',
      '<h3>Best prompt reduction by repo</h3>',
      repoBars,
      '</div>',
      '</div>',
      '</section>',
    ].join('');
  }

  function generateBenchmarkReportHtml(reports, opts = {}) {
    const summary = buildBenchmarkSummary(reports, opts.matrixSummary);
    const cards = [];
    cards.push(renderCard(
      'Token reduction',
      summary.tokenSummary ? formatPct(summary.tokenSummary.overallReductionPct, 1) : 'n/a',
      summary.tokenSummary ? `${formatInt(summary.tokenSummary.repoCount)} repos • ${formatCompact(summary.tokenSummary.totalRawTokens)} raw -> ${formatCompact(summary.tokenSummary.totalFinalTokens)} final` : 'token-reduction.json missing',
      'cool'
    ));
    cards.push(renderCard(
      'Retrieval hit@5',
      summary.retrievalSummary ? formatPct(summary.retrievalSummary.hitAt5, 1) : 'n/a',
      summary.retrievalSummary ? `${formatPct(summary.retrievalSummary.randomBaseline, 1)} random baseline • ${formatRatio(summary.retrievalSummary.lift, 1)} lift` : 'retrieval.json missing',
      'warm'
    ));
    cards.push(renderCard(
      'Prompt reduction',
      summary.taskSummary ? formatPct(summary.taskSummary.avgReductionPct, 0) : 'n/a',
      summary.taskSummary ? `${summary.taskSummary.avgPromptsWithout} -> ${summary.taskSummary.avgPromptsWith} prompts • ${formatInt(summary.taskSummary.totalTasks)} tasks` : 'task-benchmark.json missing',
      'neutral'
    ));
    cards.push(renderCard(
      'Overflow risk',
      summary.qualitySummary ? `${formatInt(summary.qualitySummary.overflowGPT4oCount)} repos` : 'n/a',
      summary.qualitySummary ? `${formatInt(summary.qualitySummary.totalHiddenFiles)} hidden raw files • ${formatMoney(summary.qualitySummary.gpt4oSavedPerMonth)}/month saved` : 'quality.json missing',
      summary.qualitySummary && summary.qualitySummary.overflowGPT4oCount > 0 ? 'warn' : 'ok'
    ));

    const missingHtml = summary.missing.length > 0
      ? `<div class="notice">Missing source reports: ${escapeHtml(summary.missing.join(', '))}. The page still renders whatever data is available.</div>`
      : '';

    return [
      '<!doctype html>',
      '<html lang="en">',
      '<head>',
      '<meta charset="utf-8" />',
      '<meta name="viewport" content="width=device-width, initial-scale=1" />',
      '<title>SigMap Benchmark Report</title>',
      '<style>',
      ':root { color-scheme: light; --bg:#f5f1e8; --panel:#fffaf2; --ink:#1f1b16; --muted:#6a6258; --line:#dccfbf; --gold:#c87f2a; --green:#2f6f52; --blue:#2f5f8f; --red:#9f4f43; --shadow:0 18px 40px rgba(54,38,14,.10);} ',
      '*{box-sizing:border-box} body{margin:0;font-family:ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;background:linear-gradient(180deg,#f3ecdf 0%,#f7f3ed 100%);color:var(--ink)}',
      '.page{max-width:1240px;margin:0 auto;padding:28px 20px 56px}',
      'header{display:flex;justify-content:space-between;gap:24px;align-items:flex-end;margin-bottom:24px}',
      'h1{margin:0;font-size:clamp(2rem,4vw,3.6rem);line-height:1.02;letter-spacing:-.04em}',
      '.lede{max-width:760px;color:var(--muted);font-size:1rem;line-height:1.6;margin-top:10px}',
      '.stamp{font-size:.92rem;color:var(--muted);text-align:right}',
      '.grid{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:14px;margin:20px 0 24px}',
      '.card,.panel,.notice,section{background:var(--panel);border:1px solid var(--line);box-shadow:var(--shadow);border-radius:18px}',
      '.card{padding:18px 18px 16px}.card.cool{background:#f7f5ff}.card.warm{background:#fff4eb}.card.warn{background:#fff1eb}.card.ok{background:#eff8f1}',
      '.label{font-size:.84rem;text-transform:uppercase;letter-spacing:.08em;color:var(--muted)}',
      '.value{font-size:2rem;font-weight:700;letter-spacing:-.04em;margin-top:8px}',
      '.hint{font-size:.95rem;color:var(--muted);margin-top:8px;line-height:1.5}',
      '.notice{padding:14px 16px;margin-bottom:20px;color:var(--muted)}',
      'section{padding:20px;margin-top:18px}',
      'h2{margin:0 0 6px;font-size:1.4rem;letter-spacing:-.03em}',
      'h3{margin:0 0 14px;font-size:1rem}',
      '.section-copy{margin:0 0 16px;color:var(--muted);line-height:1.6}',
      'table{width:100%;border-collapse:collapse;font-size:.95rem}',
      'th,td{padding:10px 12px;border-bottom:1px solid var(--line);text-align:left;vertical-align:top}',
      'th{font-size:.82rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}',
      'tbody tr:hover{background:rgba(200,127,42,.06)}',
      '.badge{display:inline-flex;align-items:center;padding:4px 8px;border-radius:999px;font-size:.78rem;font-weight:600;text-transform:uppercase;letter-spacing:.04em}',
      '.badge.ok{background:#e6f4ea;color:#21573f}.badge.warn{background:#fff0de;color:#8a4a17}.badge.fail{background:#fde8e5;color:#8a2e23}',
      '.split{display:grid;grid-template-columns:1fr 1fr;gap:16px}',
      '.panel{padding:16px}',
      '.progress-row{display:grid;grid-template-columns:140px 1fr 60px;gap:12px;align-items:center;margin:10px 0}',
      '.progress-label,.progress-value{font-size:.92rem}',
      '.progress-bar{height:10px;border-radius:999px;background:#efe4d5;overflow:hidden}',
      '.progress-bar span{display:block;height:100%;border-radius:999px;background:linear-gradient(90deg,var(--gold),#ebbb61)}',
      'code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.85rem}',
      '@media (max-width: 1020px){.grid{grid-template-columns:repeat(2,minmax(0,1fr))}.split{grid-template-columns:1fr}header{flex-direction:column;align-items:flex-start}.stamp{text-align:left}}',
      '@media (max-width: 640px){.grid{grid-template-columns:1fr}.progress-row{grid-template-columns:110px 1fr 52px}th:nth-child(n+5),td:nth-child(n+5){display:none}}',
      '</style>',
      '</head>',
      '<body>',
      '<div class="page">',
      '<header>',
      '<div>',
      '<h1>SigMap Benchmark Report</h1>',
      '<p class="lede">A self-contained view of token reduction, retrieval quality, hallucination surface, and task-level prompt reduction. This page reads the saved JSON benchmark artifacts so it stays easy to regenerate locally.</p>',
      '</div>',
      `<div class="stamp">Generated: ${escapeHtml(summary.generatedAt)}<br />Source directory: <code>benchmarks/reports</code></div>`,
      '</header>',
      missingHtml,
      `<div class="grid">${cards.join('')}</div>`,
      renderMatrixSection(summary.matrix),
      renderTokenSection(reports.token),
      renderRetrievalSection(reports.retrieval),
      renderQualitySection(reports.quality),
      renderTaskSection(reports.task),
      '</div>',
      '</body>',
      '</html>',
    ].join('');
  }

  function writeBenchmarkReport(cwd, opts = {}) {
    const reports = loadBenchmarkReports(cwd);
    const html = generateBenchmarkReportHtml(reports, opts);
    const filePath = path.join(reports.reportsDir, opts.fileName || 'benchmark-report.html');
    fs.mkdirSync(path.dirname(filePath), { recursive: true });
    fs.writeFileSync(filePath, html, 'utf8');
    return {
      file: filePath,
      summary: buildBenchmarkSummary(reports, opts.matrixSummary),
    };
  }

  module.exports = {
    loadBenchmarkReports,
    buildBenchmarkSummary,
    generateBenchmarkReportHtml,
    writeBenchmarkReport,
  };
  
};

// ── ./src/format/cache ──
__factories["./src/format/cache"] = function(module, exports) {
  
  /**
   * Format context output for Anthropic prompt cache API.
   *
   * Usage:
   *   const { formatCache } = __require('./src/format/src/format/cache');
   *   const json = formatCache(markdownContent, { ttl: '1h' });
   *   // json is a ready-to-use Anthropic `system` array
   *
   * The array is two blocks: the stable body carrying `cache_control`, then the
   * volatile tail (recent commits, routing hints) without it, so a new commit
   * only re-bills the tail. A legacy-layout file has no boundary and comes out
   * as one cached block.
   *
   * Writes: .github/copilot-instructions.cache.json
   */

  const { buildSystemBlocks, cacheControl, DEFAULT_TTL } = __require('./src/format/cache-layout');

  /**
   * Wrap markdown context as an Anthropic `system` array.
   * @param {string} content - Markdown content from formatOutput()
   * @param {{ ttl?: '5m'|'1h' }} [opts]
   * @returns {string} - JSON string: the `system` content blocks
   */
  function formatCache(content, opts = {}) {
    if (!content || typeof content !== 'string') content = '';
    const ttl = (opts && opts.ttl) || DEFAULT_TTL;
    let blocks = buildSystemBlocks(content, { ttl });
    // Nothing to split on and nothing to say: keep one (empty) cached block so
    // the output is still a well-formed system array.
    if (!blocks.length) blocks = [{ type: 'text', text: content, cache_control: cacheControl(ttl) }];
    return JSON.stringify(blocks, null, 2);
  }

  /**
   * Wrap markdown context in a full Anthropic messages API payload.
   * Includes the system array with cache_control so it can be copy-pasted
   * directly into an API call.
   * @param {string} content - Markdown content from formatOutput()
   * @param {string} [model] - Anthropic model ID (default: claude-opus-4-5)
   * @param {{ ttl?: '5m'|'1h' }} [opts]
   * @returns {string} - JSON string: { model, system: [...] }
   */
  function formatCachePayload(content, model, opts = {}) {
    if (!content || typeof content !== 'string') content = '';
    const ttl = (opts && opts.ttl) || DEFAULT_TTL;
    const system = JSON.parse(formatCache(content, { ttl }));
    const payload = {
      model: model || 'claude-opus-4-5',
      system,
      messages: [],
    };
    return JSON.stringify(payload, null, 2);
  }

  module.exports = { formatCache, formatCachePayload };
  
};

// ── ./src/format/cache-layout ──
__factories["./src/format/cache-layout"] = function(module, exports) {
  
  /**
   * Cache-stable context layout (#683).
   *
   * A provider's prompt cache matches on an exact prefix: the first byte that
   * differs ends the hit, and everything after it is billed as new input. The
   * generated context used to put a block that changes on every commit — and a
   * relative age that changed on every run — ahead of the whole signature body,
   * so the body could never be a cache hit.
   *
   * `cacheLayout: "stable-prefix"` (the default) therefore orders every output
   * as:  stable body  ->  VOLATILE_MARKER  ->  volatile tail. The marker is an
   * invisible HTML comment; it is also what `--format cache` splits on, so the
   * stable/volatile boundary is one fact in one place rather than a heading
   * heuristic each consumer re-derives.
   *
   * This module owns that boundary, the two config enums, the Anthropic
   * two-block payload, and the per-model fit-check. It reads cache minimums from
   * the model profile (src/config/models.js) and keeps no model literal of its own.
   */

  const { lookup, tokenBasis, DEFAULT_CHARS_PER_TOKEN } = __require('./src/config/models');

  // Ends the stable body. Everything after it may change run to run.
  const VOLATILE_MARKER = '<!-- sigmap:volatile -->';

  const LAYOUTS = ['stable-prefix', 'legacy'];
  const DEFAULT_LAYOUT = 'stable-prefix';

  // Exactly the values Anthropic's `cache_control.ttl` accepts.
  const CACHE_TTLS = ['5m', '1h'];
  const DEFAULT_TTL = '5m';

  // A prefix within this share of a model's minimum is too close to call: SigMap
  // counts characters, the provider counts tokens.
  const BORDERLINE_BAND = 0.15;

  /**
   * The layout in force. An unrecognised value falls back to the default and is
   * reported, never silently trusted.
   * @param {object} [config]
   * @returns {{ value: 'stable-prefix'|'legacy', invalid: string|null }}
   */
  function resolveLayout(config) {
    const raw = config && config.cacheLayout;
    if (raw == null) return { value: DEFAULT_LAYOUT, invalid: null };
    return LAYOUTS.includes(raw)
      ? { value: raw, invalid: null }
      : { value: DEFAULT_LAYOUT, invalid: String(raw) };
  }

  /**
   * The cache TTL in force: exactly "5m" or "1h".
   * @param {object} [config]
   * @returns {{ value: '5m'|'1h', invalid: string|null }}
   */
  function resolveTtl(config) {
    const raw = config && config.cacheTtl;
    if (raw == null) return { value: DEFAULT_TTL, invalid: null };
    return CACHE_TTLS.includes(raw)
      ? { value: raw, invalid: null }
      : { value: DEFAULT_TTL, invalid: String(raw) };
  }

  /**
   * Split generated context at the volatile marker.
   * @param {string} content
   * @returns {{ stable: string, volatile: string, split: boolean }}
   *   `split` is false for a legacy-layout file, which has no boundary to honour.
   */
  function splitVolatile(content) {
    const text = typeof content === 'string' ? content : '';
    const idx = text.indexOf(VOLATILE_MARKER);
    if (idx === -1) return { stable: text, volatile: '', split: false };
    return {
      stable: text.slice(0, idx).replace(/\s+$/, '') + '\n',
      volatile: text.slice(idx + VOLATILE_MARKER.length).replace(/^\s+/, ''),
      split: true,
    };
  }

  /** `cache_control` for a TTL; 5m is the API default so it is left implicit. */
  function cacheControl(ttl) {
    return ttl === '1h' ? { type: 'ephemeral', ttl: '1h' } : { type: 'ephemeral' };
  }

  /**
   * The Anthropic `system` array for a context file: the stable body carrying
   * `cache_control`, then the volatile tail without it. A tail that is empty is
   * omitted rather than sent as an empty text block, which the API rejects.
   * @param {string} content
   * @param {{ ttl?: '5m'|'1h' }} [opts]
   * @returns {Array<{type:'text', text:string, cache_control?:object}>}
   */
  function buildSystemBlocks(content, opts = {}) {
    const { stable, volatile } = splitVolatile(content);
    const blocks = [];
    if (stable.trim()) blocks.push({ type: 'text', text: stable, cache_control: cacheControl(opts.ttl) });
    if (volatile.trim()) blocks.push({ type: 'text', text: volatile });
    return blocks;
  }

  /**
   * Does a prefix of this size reach each model's minimum cacheable length?
   *
   * Only models whose minimum the profile carries are judged; a model with no
   * verified `cacheMin` is left out rather than given a guessed verdict. Inside
   * the borderline band the verdict is never "fits" or "below" — SigMap's count
   * is an estimate and a confident answer there would be made up.
   *
   * @param {string} stableText - the prefix that would carry `cache_control`
   * @param {object} profile - from resolveProfile
   * @returns {Array<{ model:string, cacheMin:number, tokens:number, estimated:boolean,
   *   verdict:'fits'|'borderline'|'below', note:string }>}
   */
  function fitCheck(stableText, profile) {
    const chars = typeof stableText === 'string' ? stableText.length : 0;
    const names = profile.rosterDeclared ? profile.roster : Object.keys(profile.models);
    const rows = [];
    for (const name of names) {
      const hit = lookup(profile, name);
      if (!hit || !(hit.model.cacheMin > 0)) continue;
      const basis = tokenBasis(profile, hit.id);
      const tokens = Math.ceil(chars / basis.charsPerToken);
      const min = hit.model.cacheMin;
      const lo = min * (1 - BORDERLINE_BAND);
      const hi = min * (1 + BORDERLINE_BAND);
      let verdict;
      let note;
      if (tokens < lo) {
        verdict = 'below';
        note = `below the ${min}-token minimum — this prefix will not be cached`;
      } else if (tokens > hi) {
        verdict = 'fits';
        note = `above the ${min}-token minimum`;
      } else {
        verdict = 'borderline';
        note = `within ${Math.round(BORDERLINE_BAND * 100)}% of the ${min}-token minimum — verify with a provider token counter`;
      }
      rows.push({ model: hit.id, cacheMin: min, tokens, estimated: basis.estimated, verdict, note });
    }
    return rows.sort((a, b) => a.model.localeCompare(b.model));
  }

  /**
   * Human lines for a fit-check, one per model.
   * @param {ReturnType<typeof fitCheck>} rows
   * @param {object} profile
   * @returns {string[]}
   */
  function formatFit(rows, profile) {
    if (!rows.length) return [];
    const w = Math.max(...rows.map((r) => r.model.length));
    const lines = [`cache fit (stable prefix; minimums as of ${profile.asOf}):`];
    for (const r of rows) {
      const mark = r.verdict === 'fits' ? 'fits      ' : r.verdict === 'below' ? 'below     ' : 'borderline';
      const count = `${r.estimated ? '~' : ''}${r.tokens} tokens${r.estimated ? ` (est. chars/${DEFAULT_CHARS_PER_TOKEN})` : ''}`;
      lines.push(`  ${r.model.padEnd(w)}  ${mark}  ${count} — ${r.note}`);
    }
    return lines;
  }

  module.exports = {
    VOLATILE_MARKER, LAYOUTS, DEFAULT_LAYOUT, CACHE_TTLS, DEFAULT_TTL, BORDERLINE_BAND,
    resolveLayout, resolveTtl, splitVolatile, cacheControl, buildSystemBlocks, fitCheck, formatFit,
  };
  
};

// ── ./src/format/dashboard ──
__factories["./src/format/dashboard"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');
  const { readLog } = __require('./src/tracking/logger');

  function toNumber(v) {
    const n = Number(v);
    return Number.isFinite(n) ? n : null;
  }

  function percentile(values, p) {
    if (!Array.isArray(values) || values.length === 0) return 0;
    const sorted = values.filter(Number.isFinite).slice().sort((a, b) => a - b);
    if (sorted.length === 0) return 0;
    if (p <= 0) return sorted[0];
    if (p >= 100) return sorted[sorted.length - 1];
    const idx = (p / 100) * (sorted.length - 1);
    const lo = Math.floor(idx);
    const hi = Math.ceil(idx);
    if (lo === hi) return sorted[lo];
    const frac = idx - lo;
    return sorted[lo] + (sorted[hi] - sorted[lo]) * frac;
  }

  function overBudgetStreak(entries) {
    if (!Array.isArray(entries) || entries.length === 0) return 0;
    let streak = 0;
    for (let i = entries.length - 1; i >= 0; i--) {
      if (entries[i] && entries[i].overBudget) streak++;
      else break;
    }
    return streak;
  }

  function loadConfig(cwd) {
    try {
      const p = path.join(cwd, 'gen-context.config.json');
      if (!fs.existsSync(p)) return null;
      return JSON.parse(fs.readFileSync(p, 'utf8'));
    } catch (_) {
      return null;
    }
  }

  function shouldExclude(rel, excludeSet) {
    if (!rel) return true;
    const parts = rel.split('/');
    for (const part of parts) {
      if (excludeSet.has(part)) return true;
    }
    return false;
  }

  /**
   * Resolve a file to a language key.
   *
   * This was a second extension map covering the same 21 languages as the old
   * `LANGUAGE_KEYS`, which is why widening only the denominator would have made
   * the figure worse: the numerator could never reach it. Detection and the
   * supported set now come from the same module (#663).
   */
  function detectLanguage(filePath) {
    try {
      const { langFor } = __require('./src/extractors/dispatch');
      return langFor(filePath);
    } catch (_) {
      return null;
    }
  }

  function walkFiles(dir, maxDepth, depth, out, excludeSet) {
    if (depth > maxDepth) return;
    let entries = [];
    try {
      entries = fs.readdirSync(dir, { withFileTypes: true });
    } catch (_) {
      return;
    }
    for (const entry of entries) {
      const abs = path.join(dir, entry.name);
      const rel = abs.replace(/\\/g, '/');
      if (shouldExclude(rel, excludeSet)) continue;
      if (entry.isDirectory()) {
        walkFiles(abs, maxDepth, depth + 1, out, excludeSet);
      } else if (entry.isFile()) {
        out.push(abs);
      }
    }
  }

  function computeExtractorCoverage(cwd) {
    const cfg = loadConfig(cwd) || {};
    const srcDirs = Array.isArray(cfg.srcDirs) && cfg.srcDirs.length > 0
      ? cfg.srcDirs
      : ['src', 'app', 'lib', 'packages', 'services', 'api'];
    const exclude = new Set([
      'node_modules', '.git', 'dist', 'build', 'out', '__pycache__', '.next',
      'coverage', 'target', 'vendor', '.context', 'jetbrains-plugin/build',
    ]);
    if (Array.isArray(cfg.exclude)) {
      for (const item of cfg.exclude) exclude.add(String(item));
    }

    let languages = [];
    try { ({ LANGUAGES: languages } = __require('./src/extractors/dispatch')); } catch (_) { languages = []; }

    const counts = {};
    for (const key of languages) counts[key] = 0;

    const files = [];
    for (const relDir of srcDirs) {
      const absDir = path.join(cwd, relDir);
      if (!fs.existsSync(absDir)) continue;
      walkFiles(absDir, 8, 0, files, exclude);
    }

    for (const f of files) {
      const lang = detectLanguage(f);
      if (lang && counts[lang] !== undefined) counts[lang]++;
    }

    const covered = languages.filter((k) => counts[k] > 0).length;
    const supported = languages.length;
    const pct = supported > 0 ? parseFloat(((covered / supported) * 100).toFixed(1)) : 0;
    return { supported, covered, pct, perLanguage: counts };
  }

  function readBenchmarkTrend(cwd) {
    // Prefer per-user history file written by benchmark scripts
    const histPath = path.join(cwd, '.context', 'benchmark-history.ndjson');
    if (fs.existsSync(histPath)) {
      const values = [];
      try {
        const lines = fs.readFileSync(histPath, 'utf8').trim().split('\n').filter(Boolean);
        for (const line of lines) {
          try {
            const obj = JSON.parse(line);
            if (obj.type === 'retrieval') {
              const v = toNumber(obj.hitAt5Pct);
              if (v !== null) values.push(v);
            }
          } catch (_) {}
        }
      } catch (_) {}
      if (values.length > 0) return values.slice(-30);
    }

    // Fallback: legacy benchmarks/results directory (CI artifacts)
    const resultDir = path.join(cwd, 'benchmarks', 'results');
    if (!fs.existsSync(resultDir)) return [];

    const files = [];
    walkFiles(resultDir, 6, 0, files, new Set());

    const values = [];
    for (const filePath of files) {
      const base = path.basename(filePath).toLowerCase();
      if (!base.endsWith('.json') && !base.endsWith('.jsonl') && !base.endsWith('.ndjson')) continue;
      let raw = '';
      try {
        raw = fs.readFileSync(filePath, 'utf8');
      } catch (_) {
        continue;
      }

      if (base.endsWith('.json')) {
        try {
          const obj = JSON.parse(raw);
          const direct = toNumber(obj && obj.hitAt5);
          const nested = toNumber(obj && obj.metrics && obj.metrics.hitAt5);
          if (direct !== null) values.push(direct);
          else if (nested !== null) values.push(nested);
        } catch (_) {}
        continue;
      }

      const lines = raw.split('\n').filter(Boolean);
      for (const line of lines) {
        try {
          const obj = JSON.parse(line);
          const direct = toNumber(obj && obj.hitAt5);
          const nested = toNumber(obj && obj.metrics && obj.metrics.hitAt5);
          if (direct !== null) values.push(direct);
          else if (nested !== null) values.push(nested);
        } catch (_) {}
      }
    }

    return values.slice(-30);
  }

  function lineChartSvg(values, title, ySuffix) {
    const width = 760;
    const height = 210;
    const left = 38;
    const right = 18;
    const top = 22;
    const bottom = 30;
    const innerW = width - left - right;
    const innerH = height - top - bottom;
    const clean = values.filter((n) => Number.isFinite(n));

    if (clean.length === 0) {
      return [
        `<svg viewBox="0 0 ${width} ${height}" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="${title}">`,
        '<rect x="0" y="0" width="100%" height="100%" fill="#0f1320" rx="12"/>',
        `<text x="20" y="36" fill="#d7defa" font-size="14" font-family="monospace">${title}</text>`,
        '<text x="20" y="96" fill="#8ea0d9" font-size="13" font-family="monospace">No data yet. Run with --track and --benchmark.</text>',
        '</svg>',
      ].join('');
    }

    const min = Math.min(...clean);
    const max = Math.max(...clean);
    const span = max - min || 1;

    const points = clean.map((v, i) => {
      const x = left + ((clean.length === 1 ? 0 : i / (clean.length - 1)) * innerW);
      const y = top + (1 - ((v - min) / span)) * innerH;
      return `${x.toFixed(1)},${y.toFixed(1)}`;
    }).join(' ');

    const latest = clean[clean.length - 1];
    const yLabel = ySuffix || '';
    const grid = [];
    for (let i = 0; i <= 4; i++) {
      const gy = top + (i / 4) * innerH;
      grid.push(`<line x1="${left}" y1="${gy.toFixed(1)}" x2="${left + innerW}" y2="${gy.toFixed(1)}" stroke="#223056" stroke-width="1"/>`);
    }

    return [
      `<svg viewBox="0 0 ${width} ${height}" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="${title}">`,
      '<defs><linearGradient id="lineFill" x1="0" y1="0" x2="0" y2="1"><stop offset="0%" stop-color="#42d392" stop-opacity="0.25"/><stop offset="100%" stop-color="#42d392" stop-opacity="0"/></linearGradient></defs>',
      '<rect x="0" y="0" width="100%" height="100%" fill="#0f1320" rx="12"/>',
      `<text x="20" y="26" fill="#d7defa" font-size="13" font-family="monospace">${title}</text>`,
      grid.join(''),
      `<polyline fill="none" stroke="#42d392" stroke-width="2.5" points="${points}"/>`,
      `<text x="20" y="${height - 8}" fill="#8ea0d9" font-size="12" font-family="monospace">latest: ${latest.toFixed(2)}${yLabel}</text>`,
      '</svg>',
    ].join('');
  }

  /**
   * Per-language file counts for the languages actually present in this repo.
   *
   * This charted a fixed 21 languages against a positionally-aligned list of 21
   * label abbreviations — a third copy of the language set, after `LANGUAGE_KEYS`
   * and the private extension map (#663). Charting all 36 supported languages
   * instead would put 20px between labels and read as noise, and most of them are
   * zero in any one repo. The chart now shows what is here, busiest first, so it
   * stays legible however many extractors SigMap ships.
   */
  function barChartSvg(perLanguage) {
    const width = 760;
    const height = 260;
    const left = 20;
    const top = 34;
    const usableW = width - left * 2;

    const present = Object.entries(perLanguage || {})
      .filter(([, v]) => v > 0)
      .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));

    const frame = (body) => [
      `<svg viewBox="0 0 ${width} ${height}" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Extractor coverage by language">`,
      '<rect x="0" y="0" width="100%" height="100%" fill="#0f1320" rx="12"/>',
      '<text x="20" y="24" fill="#d7defa" font-size="13" font-family="monospace">Per-language extractor coverage (file counts)</text>',
      '<line x1="20" y1="194" x2="740" y2="194" stroke="#223056" stroke-width="1"/>',
      body,
      '</svg>',
    ].join('');

    if (present.length === 0) {
      return frame('<text x="380" y="120" fill="#8ea0d9" font-size="12" font-family="monospace" text-anchor="middle">no files in a supported language under srcDirs</text>');
    }

    const max = Math.max(1, ...present.map(([, v]) => v));
    const barW = usableW / present.length;
    const bars = [];
    const xLabels = [];
    for (let i = 0; i < present.length; i++) {
      const [key, v] = present[i];
      const h = (v / max) * 160;
      const x = left + i * barW + 2;
      const y = top + 160 - h;
      bars.push(`<rect x="${x.toFixed(1)}" y="${y.toFixed(1)}" width="${Math.max(2, barW - 4).toFixed(1)}" height="${h.toFixed(1)}" fill="#7aa2ff" rx="2"/>`);
      const cx = left + i * barW + barW / 2;
      xLabels.push(`<text x="${cx.toFixed(1)}" y="222" fill="#8ea0d9" font-size="9" font-family="monospace" text-anchor="middle">${escapeAttr(key)}</text>`);
    }

    return frame(bars.join('') + xLabels.join(''));
  }

  function sparkline(values) {
    const clean = values.filter((n) => Number.isFinite(n));
    if (clean.length === 0) return 'n/a';
    const ticks = '▁▂▃▄▅▆▇█';
    const min = Math.min(...clean);
    const max = Math.max(...clean);
    const span = max - min || 1;
    return clean.map((v) => {
      const idx = Math.max(0, Math.min(ticks.length - 1, Math.round(((v - min) / span) * (ticks.length - 1))));
      return ticks[idx];
    }).join('');
  }

  function escapeAttr(s) {
    return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
      { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
    ));
  }

  // Surgical Context (v6.12.0): read the published token-reduction benchmark and
  // aggregate it for the dashboard panel. Numbers are never hand-typed — they come
  // straight from benchmarks/reports/token-reduction.json.
  function readTokenReduction(cwd) {
    const p = path.join(cwd, 'benchmarks', 'reports', 'token-reduction.json');
    let data;
    try { data = JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; }
    const repos = Array.isArray(data.repos) ? data.repos : [];
    if (repos.length === 0) return null;

    let baseline = 0, signatures = 0, surgical = 0, hasSurgical = false;
    for (const r of repos) {
      baseline += toNumber(r.rawTokens) || 0;
      signatures += toNumber(r.finalTokens) || 0;
      const s = toNumber(r.surgicalTokens);
      if (s !== null) { surgical += s; hasSurgical = true; }
    }

    const out = {
      version: data.version || null,
      repoCount: repos.length,
      baseline,
      signatures,
      savedPct: baseline > 0 ? Math.round((1 - signatures / baseline) * 1000) / 10 : 0,
      perRepo: repos.map((r) => ({
        repo: r.repo,
        language: r.language,
        rawTokens: toNumber(r.rawTokens) || 0,
        finalTokens: toNumber(r.finalTokens) || 0,
        reductionPct: toNumber(r.reductionPct) || 0,
      })),
    };
    if (hasSurgical) {
      out.surgical = surgical;
      out.surgicalSavedPct = baseline > 0 ? Math.round((1 - surgical / baseline) * 1000) / 10 : 0;
    }
    return out;
  }

  function tokenReductionPanelHtml(tr) {
    if (!tr) {
      return '<div class="panel"><div class="label">Token Reduction</div>' +
        '<div class="value" style="font-size:13px">No token-reduction benchmark found — run the token benchmark to populate this panel.</div></div>';
    }
    const fmt = (n) => Number(n).toLocaleString('en-US');
    const tiers = [
      { label: 'Whole-file baseline', value: fmt(tr.baseline) + ' tok' },
      { label: 'Ranked signatures (ask)', value: fmt(tr.signatures) + ' tok' },
    ];
    if (tr.surgical != null) {
      tiers.push({ label: 'Surgical (index + delta)', value: fmt(tr.surgical) + ' tok' });
      tiers.push({ label: 'Saved (surgical)', value: tr.surgicalSavedPct + '%' });
    } else {
      tiers.push({ label: 'Saved', value: tr.savedPct + '%' });
    }
    const tierHtml = tiers.map((t) =>
      `<div class="card"><div class="label">${escapeAttr(t.label)}</div><div class="value">${escapeAttr(t.value)}</div></div>`
    ).join('');

    // Proportional comparison bar (baseline = full width).
    const sigPct = tr.baseline > 0 ? Math.max(0.4, (tr.signatures / tr.baseline) * 100) : 0;
    const surgPct = (tr.surgical != null && tr.baseline > 0) ? Math.max(0.4, (tr.surgical / tr.baseline) * 100) : null;
    const barRow = (label, pct, color) =>
      `<div style="margin:4px 0;font-size:11px;color:#8ea0d9">${escapeAttr(label)}</div>` +
      `<div style="background:#0a0f1e;border:1px solid #223056;border-radius:6px;height:14px;overflow:hidden">` +
      `<div style="width:${pct.toFixed(1)}%;height:100%;background:${color}"></div></div>`;
    const bars = [
      barRow('Whole-file baseline (100%)', 100, '#3a4a78'),
      barRow(`Ranked signatures — ${tr.savedPct}% saved`, sigPct, '#2e7d6b'),
      surgPct != null ? barRow(`Surgical — ${tr.surgicalSavedPct}% saved`, surgPct, '#5ad1a8') : '',
    ].filter(Boolean).join('');

    const rows = tr.perRepo.slice(0, 8).map((r) =>
      `<tr><td>${escapeAttr(r.repo)}</td><td>${escapeAttr(r.language)}</td>` +
      `<td style="text-align:right">${fmt(r.rawTokens)}</td>` +
      `<td style="text-align:right">${fmt(r.finalTokens)}</td>` +
      `<td style="text-align:right">${r.reductionPct}%</td></tr>`
    ).join('');

    return [
      '<div class="panel">',
      `<div class="label">Token Reduction — ${tr.repoCount} benchmark repos${tr.version ? ' · v' + escapeAttr(tr.version) : ''}</div>`,
      `<div class="grid" style="margin:8px 0">${tierHtml}</div>`,
      bars,
      '<table style="width:100%;border-collapse:collapse;margin-top:10px;font-size:12px">',
      '<thead><tr style="color:#8ea0d9;text-align:left">',
      '<th>Repo</th><th>Lang</th><th style="text-align:right">Baseline</th><th style="text-align:right">Signatures</th><th style="text-align:right">Saved</th>',
      '</tr></thead>',
      `<tbody>${rows}</tbody>`,
      '</table>',
      '</div>',
    ].join('');
  }

  // Sessions (#951, SI-4). Every string here came from `.context/sessions.ndjson`, which a
  // repository can ship, so each goes through escapeAttr — the file is opened in a browser.
  function sessionsPanelHtml(report) {
    const render = __require('./src/session/render');
    const e = escapeAttr;
    const asOf = report.pricing.asOf;
    const head = '<div class="label">Sessions — billed tokens per request category, not context size</div>';
    const coverage = [
      '<div class="panel">',
      '<div class="label">Capture coverage — what each agent can report (declared, not inferred)</div>',
      '<ul style="margin:8px 0 0 16px;padding:0;font-size:12px;line-height:1.7">',
      report.coverage.map((c) => `<li>${e(c.text)}${c.sessions ? ` <span style="color:#8ea0d9">[${c.sessions} here]</span>` : ''}</li>`).join(''),
      '</ul>',
      '</div>',
    ].join('');

    if (report.sessions.length === 0) {
      return '<div class="panel">' + head +
        '<div class="value" style="font-size:13px;margin-top:8px">No sessions recorded yet — capture them with: sigmap hooks install claude</div></div>' +
        coverage;
    }

    const rows = report.sessions.map((s) =>
      `<tr><td>${e(render.when(s.startedAt))}</td><td>${e(s.agent || 'unknown')}</td><td>${e(s.branch || 'unknown')}</td>` +
      `<td style="text-align:right">${e(render.duration(s.durationMs))}</td><td>${e(s.provenance)}</td>` +
      `<td>${e(render.formatUsage(s.usage))}</td><td>${e(render.costText(s.cost, asOf))}</td></tr>`
    ).join('');

    const classLine = (label, t) => {
      const usage = t.usage ? render.formatUsage(t.usage, t.unreported) : 'unavailable';
      return `<div style="margin:4px 0;font-size:12px">[${e(label)}] ${t.sessions} session${t.sessions === 1 ? '' : 's'}: ` +
        `${e(usage)} · cost ${e(render.classCostText(t, asOf))}</div>`;
    };
    const totals = Object.entries(report.totals).map(([label, t]) => classLine(label, t)).join('');
    const branches = report.branches.map((b) =>
      `<div style="margin:8px 0 2px 0;font-size:12px;color:#8ea0d9">${e(b.branch)}</div>` +
      Object.entries(b.classes).map(([label, t]) => classLine(label, t)).join('')
    ).join('');
    const savings = report.savings
      ? `<div style="margin-top:8px;font-size:12px">SigMap savings [${e(report.savings.provenance)}]: ${report.savings.runs} logged run${report.savings.runs === 1 ? '' : 's'} ` +
        `since ${e(render.when(report.savings.since))} saved ~${Number(report.savings.savedTokens).toLocaleString('en-US')} tokens — not attributed to a session</div>`
      : '';

    return [
      '<div class="panel">',
      head,
      '<table style="width:100%;border-collapse:collapse;margin-top:10px;font-size:12px">',
      '<thead><tr style="color:#8ea0d9;text-align:left"><th>When</th><th>Agent</th><th>Branch</th>' +
        '<th style="text-align:right">Duration</th><th>Provenance</th><th>Tokens</th><th>Cost</th></tr></thead>',
      `<tbody>${rows}</tbody>`,
      '</table>',
      '<div class="label" style="margin-top:12px">Totals — one line per provenance class; classes are never summed together</div>',
      totals,
      '<div class="label" style="margin-top:12px">By branch</div>',
      branches,
      savings,
      `<div style="margin-top:10px;font-size:11px;color:#8ea0d9">pricing ${e(report.pricing.label)}` +
        `${report.pricing.stale ? ` — ${report.pricing.days} days old` : ''}. ${e(report.notes.cost)}</div>`,
      '</div>',
      coverage,
    ].join('');
  }

  function buildDashboardData(cwd, health) {
    // #773: one read path — usage.ndjson alone is empty whenever tracking is off.
    const entries = __require('./src/tracking/usage-source').readRuns(cwd);
    const recent = entries.slice(-30);
    const tokenReductionTrend = recent.map((e) => toNumber(e.reductionPct)).filter((n) => n !== null);
    const hitAt5Trend = readBenchmarkTrend(cwd);
    const coverage = computeExtractorCoverage(cwd);

    const finals = entries.map((e) => toNumber(e.finalTokens)).filter((n) => n !== null);
    const summary = {
      grade: health.grade,
      score: health.score,
      daysSinceRegen: health.daysSinceRegen,
      totalRuns: entries.length,
      overBudgetRate: entries.length > 0
        ? parseFloat(((entries.filter((e) => e.overBudget).length / entries.length) * 100).toFixed(1))
        : 0,
      p50TokenCount: Math.round(percentile(finals, 50)),
      p95TokenCount: Math.round(percentile(finals, 95)),
      overBudgetStreak: overBudgetStreak(entries),
      extractorCoverage: coverage.pct,
    };

    const tokenReduction = readTokenReduction(cwd);

    // The sessions panel must never take the dashboard down: a store that cannot be read
    // is reported as an empty one, which the panel words as "no sessions recorded".
    let sessions;
    try {
      let config = {};
      try { config = __require('./src/config/loader').loadConfig(cwd) || {}; } catch (_) { /* shipped profile */ }
      sessions = __require('./src/session/report').buildReport(cwd, { config, limit: 20 });
    } catch (_) {
      sessions = null;
    }

    return {
      summary,
      tokenReductionTrend,
      hitAt5Trend,
      coverage,
      tokenReduction,
      charts: {
        tokenReductionSvg: lineChartSvg(tokenReductionTrend, 'Token reduction trend (last 30 tracked runs)', '%'),
        hitAt5Svg: lineChartSvg(hitAt5Trend, 'hit@5 trend (last 30 benchmark runs)', ''),
        coverageSvg: barChartSvg(coverage.perLanguage),
        tokenSavingsPanel: tokenReductionPanelHtml(tokenReduction),
      },
      sessions,
      sessionsPanel: sessions ? sessionsPanelHtml(sessions) : '',
    };
  }

  function generateDashboardHtml(cwd, health) {
    const data = buildDashboardData(cwd, health);
    const cards = [
      { label: 'Current grade', value: `${data.summary.grade} (${data.summary.score}/100)` },
      { label: 'Days since regen', value: data.summary.daysSinceRegen === null ? 'n/a' : String(data.summary.daysSinceRegen) },
      { label: 'Total tracked runs', value: String(data.summary.totalRuns) },
      { label: 'Over-budget %', value: `${data.summary.overBudgetRate}%` },
      { label: 'p50 token count', value: String(data.summary.p50TokenCount) },
      { label: 'p95 token count', value: String(data.summary.p95TokenCount) },
      { label: 'Over-budget streak', value: String(data.summary.overBudgetStreak) },
      { label: 'Extractor coverage', value: `${data.summary.extractorCoverage}%` },
    ];

    const cardHtml = cards.map((c) => `<div class="card"><div class="label">${c.label}</div><div class="value">${c.value}</div></div>`).join('');

    const html = [
      '<!doctype html>',
      '<html lang="en">',
      '<head>',
      '<meta charset="utf-8"/>',
      '<meta name="viewport" content="width=device-width,initial-scale=1"/>',
      '<title>SigMap Dashboard</title>',
      '<style>',
      'body{margin:0;background:#0a0f1e;color:#e6ecff;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}',
      '.wrap{max-width:980px;margin:0 auto;padding:24px}',
      'h1{font-size:22px;margin:0 0 6px 0}',
      '.sub{color:#8ea0d9;font-size:12px;margin-bottom:20px}',
      '.grid{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:10px;margin-bottom:16px}',
      '.card{background:#111a33;border:1px solid #223056;border-radius:10px;padding:10px}',
      '.label{font-size:11px;color:#8ea0d9;margin-bottom:6px}',
      '.value{font-size:16px;color:#f5f7ff}',
      '.panel{background:#111a33;border:1px solid #223056;border-radius:12px;padding:10px;margin-top:12px}',
      '@media (max-width:900px){.grid{grid-template-columns:repeat(2,minmax(0,1fr));}}',
      '</style>',
      '</head>',
      '<body>',
      '<div class="wrap">',
      '<h1>SigMap v2.10 dashboard</h1>',
      '<div class="sub">Self-contained report. No external scripts, styles, or network calls.</div>',
      `<div class="grid">${cardHtml}</div>`,
      data.charts.tokenSavingsPanel,
      data.sessionsPanel,
      `<div class="panel">${data.charts.tokenReductionSvg}</div>`,
      `<div class="panel">${data.charts.hitAt5Svg}</div>`,
      `<div class="panel">${data.charts.coverageSvg}</div>`,
      '</div>',
      '</body>',
      '</html>',
    ].join('');

    return { html, data };
  }

  function renderHistoryCharts(cwd, health) {
    const data = buildDashboardData(cwd, health);
    const lines = [
      '[sigmap] history charts:',
      `  token reduction trend : ${sparkline(data.tokenReductionTrend)}`,
      `  hit@5 trend           : ${sparkline(data.hitAt5Trend)}`,
      `  extractor coverage    : ${data.coverage.covered}/${data.coverage.supported} (${data.coverage.pct}%)`,
      '',
      '[sigmap] inline svg: token reduction',
      data.charts.tokenReductionSvg,
      '',
      '[sigmap] inline svg: hit@5',
      data.charts.hitAt5Svg,
      '',
      '[sigmap] inline svg: coverage',
      data.charts.coverageSvg,
    ];

    return {
      text: lines.join('\n'),
      tokenReductionSparkline: sparkline(data.tokenReductionTrend),
      hitAt5Sparkline: sparkline(data.hitAt5Trend),
      summary: data.summary,
      charts: data.charts,
    };
  }

  module.exports = { generateDashboardHtml, renderHistoryCharts, computeExtractorCoverage, percentile, overBudgetStreak };
  
};

// ── ./src/format/gain-terminal ──
__factories["./src/format/gain-terminal"] = function(module, exports) {
  
  /**
   * SigMap `gain` — terminal renderer.
   *
   * Zero-dependency ANSI dashboard for token savings. Honors NO_COLOR and
   * non-TTY output (plain text for pipes / --json consumers elsewhere).
   *
   * "saved" is a counterfactual estimate (whole-file baseline − actual context),
   * never a measured delta — the footer says so on every view.
   */

  const USE_COLOR = !process.env.NO_COLOR && process.stdout.isTTY;

  const C = {
    reset: USE_COLOR ? '\x1b[0m' : '',
    dim: USE_COLOR ? '\x1b[2m' : '',
    bold: USE_COLOR ? '\x1b[1m' : '',
    green: USE_COLOR ? '\x1b[32m' : '',
    yellow: USE_COLOR ? '\x1b[33m' : '',
    red: USE_COLOR ? '\x1b[31m' : '',
    cyan: USE_COLOR ? '\x1b[36m' : '',
    gray: USE_COLOR ? '\x1b[90m' : '',
  };

  // ── formatters ───────────────────────────────────────────────────────────
  function humanTokens(n) {
    n = Number(n) || 0;
    if (n >= 1e9) return (n / 1e9).toFixed(1) + 'B';
    if (n >= 1e6) return (n / 1e6).toFixed(1) + 'M';
    if (n >= 1e3) return (n / 1e3).toFixed(1) + 'K';
    return String(Math.round(n));
  }

  function fmtInt(n) {
    return (Number(n) || 0).toLocaleString('en-US');
  }

  function fmtUSD(n) {
    n = Number(n) || 0;
    if (n >= 1000) return '$' + n.toLocaleString('en-US', { maximumFractionDigits: 0 });
    return '$' + n.toFixed(2);
  }

  function fmtDuration(ms) {
    ms = Number(ms) || 0;
    if (ms >= 3.6e6) return (ms / 3.6e6).toFixed(1) + 'h';
    if (ms >= 60000) return (ms / 60000).toFixed(1) + 'm';
    if (ms >= 1000) return (ms / 1000).toFixed(1) + 's';
    return Math.round(ms) + 'ms';
  }

  function fmtPct(p) {
    return (Number(p) || 0).toFixed(1) + '%';
  }

  function colorPct(p, text) {
    if (!USE_COLOR) return text;
    const c = p >= 85 ? C.green : p >= 60 ? C.yellow : C.red;
    return c + text + C.reset;
  }

  function pad(s, w, align) {
    s = String(s);
    const visible = s.replace(/\x1b\[[0-9;]*m/g, '');
    const gap = Math.max(0, w - visible.length);
    return align === 'right' ? ' '.repeat(gap) + s : s + ' '.repeat(gap);
  }

  /** Solid horizontal efficiency bar with a dotted remainder. */
  function bar(pct, width) {
    const filled = Math.round((clamp(pct, 0, 100) / 100) * width);
    const solid = '█'.repeat(filled);
    const rest = '░'.repeat(Math.max(0, width - filled));
    return (USE_COLOR ? C.green : '') + solid + (USE_COLOR ? C.gray : '') + rest + C.reset;
  }

  /** Proportional impact bar (share of total saved). */
  function impactBar(sharePct, width) {
    const n = Math.max(1, Math.round((clamp(sharePct, 0, 100) / 100) * width));
    return (USE_COLOR ? C.cyan : '') + '█'.repeat(n) + C.reset;
  }

  const clamp = (n, lo, hi) => Math.max(lo, Math.min(hi, n));
  const rule = (w) => C.gray + '─'.repeat(w) + C.reset;

  // ── views ──────────────────────────────────────────────────────────────
  /**
   * Render the global summary + by-operation table.
   * @param {object} agg     output of aggregate()
   * @param {object} [opts]  { version, scope }
   * @returns {string}
   */
  function renderSummary(agg, opts = {}) {
    const W = 74;
    const t = agg.totals;
    const L = [];
    const scope = opts.scope || 'this repo';
    const ver = opts.version ? `v${opts.version}` : '';

    L.push('');
    const heading = `⚡ SigMap — Token Savings (${scope})`;
    L.push('  ' + C.bold + C.cyan + heading + C.reset +
      pad(`${C.green}✓${C.reset} ${C.dim}${ver}${C.reset}`, W - heading.length, 'right'));
    L.push('  ' + rule(W));
    L.push('');

    if (t.count === 0) {
      L.push(`  ${C.yellow}No usage recorded yet.${C.reset}`);
      L.push(`  ${C.dim}Run a few queries (sigmap ask "...") or seed a demo:${C.reset}`);
      L.push(`  ${C.dim}  node scripts/gain.mjs --demo${C.reset}`);
      L.push('');
      return L.join('\n');
    }

    const label = (k) => C.dim + pad(k, 21) + C.reset;
    L.push('  ' + label('Total operations') + ': ' + C.bold + fmtInt(t.count) + C.reset);
    L.push('  ' + label('Whole-file baseline') + ': ' + humanTokens(t.baseline) + ' tok' +
      `   ${C.dim}← est. cost of feeding full files${C.reset}`);
    L.push('  ' + label('SigMap context') + ': ' + humanTokens(t.actual) + ' tok');
    L.push('  ' + label('Tokens saved') + ': ' + C.bold + humanTokens(t.saved) + C.reset +
      '  (' + colorPct(t.savedPct, fmtPct(t.savedPct)) + ')');
    L.push('  ' + label('Est. money saved') + ': ' + C.bold + C.green + fmtUSD(t.usdSaved) + C.reset +
      `   ${C.dim}(${agg.price.model} input @ $${agg.price.perMtok}/M as of ${agg.price.asOf} · tokens ${agg.price.tokenBasis} · --model to change)${C.reset}`);
    L.push('  ' + label('Avg latency') + ': ' + fmtDuration(t.avgMs) + ' / op' +
      `   ${C.dim}(local, no API round-trip)${C.reset}`);
    L.push('');
    L.push('  ' + label('Efficiency') + ': ▕' + bar(t.savedPct, 30) + '▏  ' +
      colorPct(t.savedPct, C.bold + fmtPct(t.savedPct) + C.reset));
    L.push('');

    // By operation table
    L.push(`  ${C.bold}By operation${C.reset}`);
    L.push('  ' + rule(W));
    L.push('  ' + C.dim +
      pad('#', 3) + pad('Operation', 24) + pad('Count', 8, 'right') +
      pad('Saved', 9, 'right') + pad('Avg%', 8, 'right') + pad('Time', 8, 'right') +
      '  Impact' + C.reset);
    agg.byOp.forEach((o, i) => {
      L.push('  ' +
        pad(`${i + 1}.`, 3) +
        pad(o.op, 24) +
        pad(fmtInt(o.count), 8, 'right') +
        pad(humanTokens(o.saved), 9, 'right') +
        pad(colorPct(o.avgPct, fmtPct(o.avgPct)), 8, 'right') +
        pad(fmtDuration(o.avgMs), 8, 'right') +
        '  ' + impactBar(o.sharePct, 12));
    });
    L.push('  ' + rule(W));
    L.push(`  ${C.dim}saved = baseline − actual · estimated vs whole-file reads · local-only${C.reset}`);
    L.push('');
    return L.join('\n');
  }

  /**
   * Render daily / weekly / monthly trend tables.
   * @param {object} agg
   * @returns {string}
   */
  function renderBreakdown(agg) {
    const L = [];
    if (agg.totals.count === 0) return renderSummary(agg);

    const section = (icon, title, rows, keyHeader) => {
      L.push('');
      L.push(`  ${C.bold}${icon} ${title}${C.reset}`);
      L.push('  ' + C.dim +
        pad(keyHeader, 14) + pad('Ops', 7, 'right') + pad('Baseline', 11, 'right') +
        pad('Actual', 10, 'right') + pad('Saved', 10, 'right') + pad('Save%', 8, 'right') +
        pad('Time', 8, 'right') + C.reset);
      let TB = 0, TA = 0, TS = 0, TC = 0, TM = 0;
      for (const r of rows) {
        TB += r.baseline; TA += r.actual; TS += r.saved; TC += r.count; TM += r.ms;
        L.push('  ' +
          pad(r.key, 14) + pad(fmtInt(r.count), 7, 'right') +
          pad(humanTokens(r.baseline), 11, 'right') + pad(humanTokens(r.actual), 10, 'right') +
          pad(humanTokens(r.saved), 10, 'right') +
          pad(colorPct(r.savedPct, fmtPct(r.savedPct)), 8, 'right') +
          pad(fmtDuration(r.ms), 8, 'right'));
      }
      const tp = TB > 0 ? (TS / TB) * 100 : 0;
      L.push('  ' + C.bold +
        pad('TOTAL', 14) + pad(fmtInt(TC), 7, 'right') +
        pad(humanTokens(TB), 11, 'right') + pad(humanTokens(TA), 10, 'right') +
        pad(humanTokens(TS), 10, 'right') + pad(fmtPct(tp), 8, 'right') +
        pad(fmtDuration(TM), 8, 'right') + C.reset);
    };

    const daily = agg.buckets.daily.slice(-30);
    section('📅', `Daily (last ${daily.length})`, daily, 'Date');
    const weekly = agg.buckets.weekly.slice(-6);
    section('📆', `Weekly (last ${weekly.length})`, weekly, 'Week of');
    const monthly = agg.buckets.monthly.slice(-3);
    section('🗓️', `Monthly (last ${monthly.length})`, monthly, 'Month');
    L.push('');
    L.push(`  ${C.dim}saved = baseline − actual · estimated vs whole-file reads · local-only${C.reset}`);
    L.push('');
    return L.join('\n');
  }

  module.exports = {
    renderSummary,
    renderBreakdown,
    // exported for tests
    humanTokens, fmtUSD, fmtDuration, fmtPct,
  };
  
};

// ── ./src/format/llm-txt ──
__factories["./src/format/llm-txt"] = function(module, exports) {
  
  const path = require('path');
  module.exports = { format, outputPath };

  function outputPath(cwd) { return path.join(cwd, 'llm.txt'); }

  function format(context, cwd, version) {
    const name  = context.projectName || path.basename(cwd);
    const langs = [...new Set((context.fileEntries || []).map(f => f.language).filter(Boolean))];
    const mods  = context.srcDirs || [];

    return [
      `# Project: ${name}`,
      `Languages: ${langs.join(', ') || 'unknown'}`,
      `Root: ${mods[0] || 'src/'}`,
      '',
      '## Modules',
      ...mods.map(m => `- ${m}/`),
      '',
      '## Key flows',
      '- <!-- describe your main user flows here -->',
      '',
      '## Rules',
      '- <!-- describe your team conventions here -->',
      '',
      `Generated: ${new Date().toISOString()} | SigMap v${version}`,
    ].join('\n');
  }
  
};

// ── ./src/format/llms-txt ──
__factories["./src/format/llms-txt"] = function(module, exports) {
  
  const path = require('path');
  const fs   = require('fs');
  const { tryGit } = __require('./src/util/git');
  module.exports = { format, outputPath };

  function outputPath(cwd) { return path.join(cwd, 'llms.txt'); }

  function getShortCommit(cwd) {
    return tryGit(['rev-parse', '--short', 'HEAD'], { cwd, timeout: 2000 });
  }

  function detectVersion(cwd) {
    try {
      const pkg = path.join(cwd, 'package.json');
      if (fs.existsSync(pkg)) return JSON.parse(fs.readFileSync(pkg, 'utf8')).version || '';
    } catch (_) {}
    return '';
  }

  function format(context, cwd, writtenFiles, sigmapVersion) {
    writtenFiles  = writtenFiles  || [];
    sigmapVersion = sigmapVersion || '';

    const name   = context.projectName || path.basename(cwd);
    const ver    = detectVersion(cwd);
    const commit = getShortCommit(cwd);
    const langs  = [...new Set((context.fileEntries || []).map(f => f.language).filter(Boolean))];

    const lines = [
      '# SigMap Context Index',
      `> Generated by SigMap v${sigmapVersion} — the deterministic, verifiable grounding layer for AI code work`,
      '',
      '## Project',
      `- Name: ${name}`,
    ];
    if (ver)          lines.push(`- Version: ${ver}`);
    if (langs.length) lines.push(`- Language: ${langs.join(', ')}`);
    if (commit)       lines.push(`- Commit: ${commit}`);

    if (writtenFiles.length) {
      lines.push('', '## Context Files');
      for (const f of writtenFiles) {
        const rel   = path.relative(cwd, f.path);
        const extra = f.tokens ? `: ${f.tokens} tokens` : '';
        lines.push(`- [${f.label || rel}](${rel})${extra}`);
      }
    }

    const mods = context.srcDirs || [];
    if (mods.length) {
      lines.push('', '## Source Modules');
      for (const m of mods) lines.push(`- [${m}/](${m}/)`);
    }

    const top5 = (context.fileEntries || [])
      .sort((a, b) => (b.sigs || []).length - (a.sigs || []).length)
      .slice(0, 5);
    if (top5.length) {
      lines.push('', '## Key Files');
      for (const f of top5) {
        const rel     = path.relative(cwd, f.filePath);
        const preview = (f.sigs || []).slice(0, 3).join(', ');
        lines.push(`- ${rel}: ${preview}`);
      }
    }

    return lines.join('\n');
  }
  
};

// ── ./src/format/terse ──
__factories["./src/format/terse"] = function(module, exports) {
  
  /**
   * Terse signature encoder (D7).
   *
   * Deterministic compaction of signature lines for the generated context —
   * opt-in via `--terse` / `terse: true`. Every transform is a fixed string
   * rewrite (no heuristics, no LLM), so terse output stays byte-stable.
   *
   * The line anchor (`  :start-end`) and everything after it (Python/R doc
   * hints) are preserved byte-exactly: `parseAnchor`, `get_lines`, and the
   * evidence pack keep working on terse output. Symbol extraction is safe too —
   * `extractName` in src/extractors/prdiff.js already recognizes `fn <name>`.
   */

  /** First `  :start[-end]` anchor token (two-space prefix, as emitted by line-anchor.js). */
  const ANCHOR_RE = /\s{2}:\d+(?:-\d+)?(?=\s|$)/;

  /**
   * Split a signature into the compactable text and the byte-preserved suffix
   * (anchor + any trailing doc hint).
   * @param {string} sig
   * @returns {{ text: string, suffix: string }}
   */
  function splitAnchor(sig) {
    const s = String(sig);
    const m = ANCHOR_RE.exec(s);
    if (!m) return { text: s, suffix: '' };
    return { text: s.slice(0, m.index), suffix: s.slice(m.index) };
  }

  /**
   * Compact one signature line. Leading whitespace (member indentation) is kept.
   * @param {string} sig
   * @returns {string}
   */
  function encodeTerseSig(sig) {
    const { text, suffix } = splitAnchor(sig);
    let t = text
      .replace(/\basync function\b/g, 'async fn')
      .replace(/\bfunction\b/g, 'fn')
      .replace(/\s+→\s+/g, '→')
      .replace(/,\s+/g, ',')
      .replace(/\s+=\s+/g, '=')
      .replace(/\{\s+/g, '{')
      .replace(/\s+\}/g, '}')
      .replace(/(\S)\s{2,}(?=\S)/g, '$1 ')
      .replace(/^module\.exports=/, 'exports=');
    return t + suffix;
  }

  /**
   * Compact an array of signature lines.
   * @param {string[]} sigs
   * @returns {string[]}
   */
  function encodeTerseSigs(sigs) {
    return (sigs || []).map(encodeTerseSig);
  }

  /** Estimated tokens of joined signature lines (same chars/4 rule as elsewhere). */
  function _tokens(sigs) {
    return Math.ceil(sigs.join('\n').length / 4);
  }

  /**
   * Measure the real reduction terse encoding buys over a set of signature
   * lists — the D7 "measure first" gate. Never quote a number this didn't produce.
   * @param {string[][]} sigsList one string[] per file
   * @returns {{ beforeTokens: number, afterTokens: number, reductionPct: number }}
   */
  function measureTerse(sigsList) {
    let beforeTokens = 0;
    let afterTokens = 0;
    for (const sigs of sigsList || []) {
      if (!sigs || !sigs.length) continue;
      beforeTokens += _tokens(sigs);
      afterTokens += _tokens(encodeTerseSigs(sigs));
    }
    const reductionPct = beforeTokens > 0
      ? Math.round(((beforeTokens - afterTokens) / beforeTokens) * 1000) / 10
      : 0;
    return { beforeTokens, afterTokens, reductionPct };
  }

  module.exports = { encodeTerseSig, encodeTerseSigs, measureTerse, splitAnchor };
  
};

// ── ./src/format/usage-guidance ──
__factories["./src/format/usage-guidance"] = function(module, exports) {
  
  /**
   * Canonical "how to use SigMap" guidance block (v6.16/v7.0).
   *
   * Every adapter emits this one identical block so all generated context files
   * (CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, GEMINI.md, .cursorrules,
   * …) carry the same, single usage section — instead of each adapter inventing
   * its own wording (and codex emitting a redundant second JSON block).
   *
   * The block is DIRECTIVE, not a reference table (#754). A list of commands is
   * something an agent reads past; an instruction to run them is something it
   * acts on. Only commands that change what an answer COSTS or whether it is
   * GROUNDED earn a row here — this ships in every context file, and on the
   * `index` strategy the whole always-on file is ~500 tokens, so each row is
   * paid for on every question. `sigmap skills install` ships the long-form
   * playbook; this is what every agent gets without opting in.
   */

  function usageBlock() {
    return [
      '## SigMap commands',
      '',
      '**Run these yourself in the terminal** — offline, deterministic, no model call.',
      '',
      '| When | Command |',
      '|------|---------|',
      '| Before answering anything about this code | `sigmap ask "<question>"` |',
      '| To read code you hold a `:start-end` anchor for | `sigmap lines <file> :<line> --context 10` |',
      '| Before editing a file / a function | `sigmap --impact <file>` · `sigmap --callers <symbol>` |',
      '| Before trusting generated code | `sigmap verify <answer.md>` |',
      '| To rank files by topic | `sigmap --query "<topic>"` |',
      '| Why a file is or is not in context | `sigmap explain <file>` |',
      '| After changing config or source dirs | `sigmap validate` |',
      '| To score an answer against this repo | `sigmap judge --response <file>` |',
      '',
      'Never open a file to "look around" — `sigmap ask` costs hundreds of tokens where',
      'reading the same files costs thousands. `:425-425` means line 425: read that range.',
      '',
    ].join('\n');
  }

  module.exports = { usageBlock };
  
};

// ── ./src/format/verify-report ──
__factories["./src/format/verify-report"] = function(module, exports) {
  
  /**
   * Hallucination Guard report view (Surface A, v6.15.0).
   *
   * Turns the `verify-ai-output --json` result into a standalone, self-contained
   * HTML report — red/amber/green per issue, with closest-match suggestions
   * inline. The visual language deliberately mirrors the planned PR-comment
   * styling so a single screenshot is reusable across docs and CI (plan proof #5).
   *
   * Zero dependencies, inline CSS/SVG, no external assets. Also exports a compact
   * Markdown renderer for CI / PR comments that shares the same structure.
   */

  const TYPE_META = {
    'fake-file': { label: 'Fake file', tone: 'red', icon: '✕' },
    'fake-test-file': { label: 'Fake test file', tone: 'red', icon: '✕' },
    'fake-import': { label: 'Fake import', tone: 'red', icon: '✕' },
    'fake-import-name': { label: 'Fake imported name', tone: 'amber', icon: '!' },
    'fake-npm-script': { label: 'Fake npm script', tone: 'red', icon: '✕' },
    'fake-symbol': { label: 'Fake symbol', tone: 'amber', icon: '!' },
  };

  function escapeHtml(value) {
    return String(value == null ? '' : value)
      .replace(/&/g, '&amp;')
      .replace(/</g, '&lt;')
      .replace(/>/g, '&gt;')
      .replace(/"/g, '&quot;');
  }

  function toneFor(issue) {
    const meta = TYPE_META[issue.type];
    if (meta) return meta.tone;
    return issue.confidence === 'high' ? 'red' : 'amber';
  }

  function labelFor(issue) {
    return (TYPE_META[issue.type] && TYPE_META[issue.type].label) || issue.type;
  }

  /**
   * Render the verify result to a full HTML document.
   * @param {{ file?: string, issues: object[], summary: object }} result
   * @param {object} [opts]
   * @param {string} [opts.title]
   * @returns {string} HTML
   */
  function renderReportHtml(result, opts = {}) {
    const issues = Array.isArray(result.issues) ? result.issues : [];
    const summary = result.summary || { total: issues.length, byType: {}, clean: issues.length === 0 };
    const file = result.file || opts.file || 'AI answer';
    const title = opts.title || 'SigMap — Hallucination Guard report';
    const clean = summary.clean || issues.length === 0;
    const byType = summary.byType || {};

    const chips = Object.keys(TYPE_META)
      .filter((t) => byType[t])
      .map((t) => `<span class="chip chip-${TYPE_META[t].tone}">${escapeHtml(TYPE_META[t].label)}: ${byType[t]}</span>`)
      .join('');

    // A clean verdict is only green when every claim class ran against a current
    // index and at least one claim was checked (#989); otherwise it is amber.
    const cov = summary.coverage || null;
    const qualified = !!cov && (cov.index !== 'ok' || cov.vacuous);
    const banner = !clean
      ? `<div class="banner banner-red"><span class="dot"></span> ${issues.length} issue${issues.length === 1 ? '' : 's'} found in <code>${escapeHtml(file)}</code></div>`
      : qualified
        ? `<div class="banner banner-amber"><span class="dot"></span> ${cov.vacuous ? 'Nothing to check — the answer names no file path, import, backticked call or npm script' : `No issues in the claims checked, but ${cov.index === 'missing' ? 'there is no usable symbol index' : 'the index is out of date'}`}</div>`
        : `<div class="banner banner-green"><span class="dot"></span> No hallucinations detected — ${escapeHtml(String(summary.symbolsIndexed || 0))} symbols indexed</div>`;
    const scope = cov
      ? `<p class="sub">${escapeHtml(`checked ${cov.claims.total} claim${cov.claims.total === 1 ? '' : 's'} · not checked: ${cov.notChecked.join(' · ')}`)}</p>`
      : '';

    const rows = issues.map((issue) => {
      const tone = toneFor(issue);
      const sugg = issue.suggestion
        ? `<div class="suggestion">↳ ${escapeHtml(issue.suggestion)} <span class="conf">heuristic</span></div>`
        : '';
      return [
        `<li class="issue issue-${tone}">`,
        `  <div class="issue-head">`,
        `    <span class="badge badge-${tone}">${escapeHtml(labelFor(issue))}</span>`,
        `    <span class="loc">${escapeHtml(issue.location || ('L' + issue.line))}</span>`,
        `    <span class="conf conf-${escapeHtml(issue.confidence || 'high')}">${escapeHtml(issue.confidence || 'high')} confidence</span>`,
        `  </div>`,
        `  <div class="msg">${escapeHtml(issue.message || issue.value)}</div>`,
        `  ${sugg}`,
        `</li>`,
      ].join('\n');
    }).join('\n');

    const list = clean
      ? '<p class="empty">Nothing to report — every file, import, symbol, and script in the answer resolves against the repository.</p>'
      : `<ul class="issues">${rows}</ul>`;

    return `<!DOCTYPE html>
  <html lang="en">
  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>${escapeHtml(title)}</title>
  <style>
    :root { color-scheme: light dark; }
    * { box-sizing: border-box; }
    body { font: 14px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; margin: 0; background: #0d1117; color: #e6edf3; }
    .wrap { max-width: 880px; margin: 0 auto; padding: 32px 20px 64px; }
    h1 { font-size: 20px; margin: 0 0 4px; }
    .sub { color: #8b949e; margin: 0 0 20px; font-size: 13px; }
    code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; background: #161b22; padding: 1px 5px; border-radius: 4px; font-size: 12.5px; }
    .banner { display: flex; align-items: center; gap: 8px; padding: 12px 16px; border-radius: 8px; font-weight: 600; margin-bottom: 16px; }
    .banner-green { background: rgba(46,160,67,.15); border: 1px solid rgba(46,160,67,.4); color: #3fb950; }
    .banner-red { background: rgba(248,81,73,.12); border: 1px solid rgba(248,81,73,.4); color: #f85149; }
    .banner-amber { background: rgba(210,153,34,.15); border: 1px solid rgba(210,153,34,.4); color: #d29922; }
    .dot { width: 9px; height: 9px; border-radius: 50%; background: currentColor; }
    .chips { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 20px; }
    .chip { font-size: 12px; padding: 3px 9px; border-radius: 999px; font-weight: 600; }
    .chip-red { background: rgba(248,81,73,.15); color: #f85149; }
    .chip-amber { background: rgba(210,153,34,.18); color: #d29922; }
    ul.issues { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 10px; }
    .issue { border: 1px solid #30363d; border-left-width: 4px; border-radius: 8px; padding: 12px 14px; background: #0f141a; }
    .issue-red { border-left-color: #f85149; }
    .issue-amber { border-left-color: #d29922; }
    .issue-head { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
    .badge { font-size: 11.5px; font-weight: 700; padding: 2px 8px; border-radius: 5px; text-transform: uppercase; letter-spacing: .03em; }
    .badge-red { background: rgba(248,81,73,.18); color: #f85149; }
    .badge-amber { background: rgba(210,153,34,.2); color: #d29922; }
    .loc { font-family: ui-monospace, monospace; color: #8b949e; font-size: 12px; }
    .conf { font-size: 11px; color: #8b949e; }
    .conf-high { color: #f85149; }
    .conf-medium { color: #d29922; }
    .msg { margin-top: 7px; font-family: ui-monospace, monospace; font-size: 12.5px; color: #e6edf3; }
    .suggestion { margin-top: 6px; font-size: 12.5px; color: #3fb950; }
    .suggestion .conf { margin-left: 6px; }
    .empty { color: #8b949e; }
    footer { margin-top: 28px; color: #6e7681; font-size: 12px; }
    a { color: #58a6ff; }
  </style>
  </head>
  <body>
  <div class="wrap">
    <h1>Hallucination Guard report</h1>
    <p class="sub">Deterministic verification of an AI answer against the real repository — <code>sigmap verify-ai-output</code></p>
    ${banner}
    ${scope}
    ${chips ? `<div class="chips">${chips}</div>` : ''}
    ${list}
    <footer>Generated by <a href="https://github.com/manojmallick/sigmap">SigMap</a> · offline, no LLM · suggestions are heuristic (closest-match)</footer>
  </div>
  </body>
  </html>
  `;
  }

  /** Compact Markdown rendering of the same result (CI / PR comments). */
  function renderReportMarkdown(result) {
    const issues = Array.isArray(result.issues) ? result.issues : [];
    const summary = result.summary || {};
    const file = result.file || 'AI answer';
    if (summary.clean || issues.length === 0) {
      const cov = summary.coverage;
      if (cov && (cov.vacuous || cov.index !== 'ok')) {
        return `### ⚠️ Hallucination Guard — not an all-clear\n\nNo issues in the claims checked in \`${file}\`, but ${cov.vacuous ? 'the answer names nothing checkable' : (cov.index === 'missing' ? 'there is no usable symbol index' : 'the index is out of date')}.`;
      }
      return `### ✅ Hallucination Guard — clean\n\nNo fabricated files, imports, symbols, or scripts found in the claims checked in \`${file}\`.`;
    }
    const lines = [
      `### ❌ Hallucination Guard — ${issues.length} issue${issues.length === 1 ? '' : 's'} in \`${file}\``,
      '',
      '| Type | Location | Detail | Suggestion |',
      '| --- | --- | --- | --- |',
    ];
    for (const i of issues) {
      const sugg = i.suggestion ? i.suggestion.replace(/\|/g, '\\|') : '—';
      lines.push(`| ${labelFor(i)} | ${i.location || ('L' + i.line)} | \`${String(i.value).replace(/\|/g, '\\|')}\` | ${sugg} |`);
    }
    return lines.join('\n');
  }

  module.exports = { renderReportHtml, renderReportMarkdown, escapeHtml };
  
};

// ── ./src/graph/blast-radius ──
__factories["./src/graph/blast-radius"] = function(module, exports) {
  
  /**
   * Method-level blast-radius scoring (GR2).
   *
   * Consumes the D4 call-graph (src/graph/call-graph.js): for each changed file,
   * resolve the functions it defines, BFS the reverse call edges, and score how
   * much of the codebase transitively calls into the change. The score is a
   * documented deterministic formula — no heuristics that vary run to run — so
   * review-pr findings and PR Evidence lines are byte-stable for a fixed tree.
   *
   * Score: min(100, direct×4 + transitive×1). Tiers:
   *   0 → none · 1–9 → low · 10–29 → medium · 30–59 → high · 60+ → critical
   */

  const path = require('path');
  const { buildCallGraph } = __require('./src/graph/call-graph');

  const DIRECT_WEIGHT = 4;
  const TRANSITIVE_WEIGHT = 1;
  const IMPACTED_FUNCTIONS_CAP = 12;

  const TEST_FILE_RE = /\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.(py|go)$|(^|\/)(tests?|__tests__|spec)\//;

  function tierFor(score) {
    if (score >= 60) return 'critical';
    if (score >= 30) return 'high';
    if (score >= 10) return 'medium';
    if (score >= 1) return 'low';
    return 'none';
  }

  function _normRel(p) {
    return String(p).replace(/\\/g, '/');
  }

  // BFS the reverse edges from a set of symbol ids; returns direct/transitive id sets.
  function _bfs(seedIds, reverse, maxDepth) {
    const direct = new Set();
    const transitive = new Set();
    const visited = new Set(seedIds);
    let frontier = [];
    for (const s of seedIds) {
      for (const nb of (reverse.get(s) || [])) {
        if (!visited.has(nb)) { direct.add(nb); visited.add(nb); frontier.push(nb); }
      }
    }
    let depth = 1;
    while (frontier.length && (maxDepth === 0 || depth < maxDepth)) {
      const next = [];
      for (const node of frontier) {
        for (const nb of (reverse.get(node) || [])) {
          if (!visited.has(nb)) { transitive.add(nb); visited.add(nb); next.push(nb); }
        }
      }
      frontier = next;
      depth++;
    }
    return { direct, transitive };
  }

  /**
   * Score the method-level blast radius of a changed-file list.
   *
   * @param {string[]} changedFiles repo-relative paths
   * @param {string} cwd
   * @param {object} [opts]
   * @param {object} [opts.graph]  injected call graph (tests); else built from cwd
   * @param {number} [opts.depth=0] BFS depth limit (0 = unlimited)
   * @returns {{
   *   available: boolean,
   *   files: Array<{ file:string, symbols:number, directCallers:number,
   *                  transitiveCallers:number, testCallers:number,
   *                  impactedFunctions:string[], score:number, tier:string }>,
   *   aggregate: { score:number, tier:string, impactedFunctions:number }
   * }}
   */
  function methodBlastRadius(changedFiles, cwd, opts = {}) {
    const empty = { available: false, files: [], aggregate: { score: 0, tier: 'none', impactedFunctions: 0 } };
    let graph;
    try {
      graph = opts.graph || buildCallGraph(cwd, opts);
    } catch (_) {
      return empty;
    }
    if (!graph || !graph.defs || graph.defs.size === 0) return empty;

    // Group defined symbol ids by their (normalized) defining file.
    const idsByFile = new Map();
    for (const [id, def] of graph.defs.entries()) {
      const rel = _normRel(def.file);
      if (!idsByFile.has(rel)) idsByFile.set(rel, []);
      idsByFile.get(rel).push(id);
    }

    const depth = Number.isFinite(opts.depth) ? opts.depth : 0;
    const files = [];
    const allImpacted = new Set();

    for (const changed of (changedFiles || []).map(_normRel).sort()) {
      const ids = idsByFile.get(changed);
      if (!ids || !ids.length) continue;
      const { direct, transitive } = _bfs(ids, graph.reverse, depth);
      const impacted = [...direct, ...transitive].sort();
      for (const id of impacted) allImpacted.add(id);
      const testCallers = impacted.filter((id) => {
        const def = graph.defs.get(id);
        return def && TEST_FILE_RE.test(_normRel(def.file));
      }).length;
      const score = Math.min(100, direct.size * DIRECT_WEIGHT + transitive.size * TRANSITIVE_WEIGHT);
      files.push({
        file: changed,
        symbols: ids.length,
        directCallers: direct.size,
        transitiveCallers: transitive.size,
        testCallers,
        impactedFunctions: impacted.slice(0, IMPACTED_FUNCTIONS_CAP),
        score,
        tier: tierFor(score),
      });
    }

    if (!files.length) return empty;
    const maxScore = files.reduce((m, f) => Math.max(m, f.score), 0);
    return {
      available: true,
      files,
      aggregate: { score: maxScore, tier: tierFor(maxScore), impactedFunctions: allImpacted.size },
    };
  }

  module.exports = { methodBlastRadius, tierFor, DIRECT_WEIGHT, TRANSITIVE_WEIGHT };
  
};

// ── ./src/graph/builder ──
__factories["./src/graph/builder"] = function(module, exports) {
  
  /**
   * Dependency graph builder (v2.5).
   *
   * Builds a forward and reverse dependency graph by resolving import/require
   * statements across JS/TS, Python, Go, Rust, Java, Kotlin, Ruby, Elixir and R files
   * (the original eight families) and, since #980, C/C++/Objective-C, PHP, C#, Dart,
   * Vue/Svelte/Astro, Lua and GDScript (src/graph/import-resolvers.js).
   *
   * @module src/graph/builder
   */

  const fs   = require('fs');
  const path = require('path');

  // Cross-platform node key. Delegates to the ONE shared definition so this graph
  // and the call-graph cannot drift apart again (see src/graph/path-key.js).
  const { graphKey } = __require('./src/graph/path-key');
  const { resolveGraphDirs, configuredSrcDirs } = __require('./src/graph/src-dirs');
  const RESOLVERS = __require('./src/graph/import-resolvers');   // the families added in #980
  const { ancestorDirs } = RESOLVERS;
  function normalizePath(p) {
    return graphKey(p);
  }

  // ---------------------------------------------------------------------------
  // Language-specific import extractors
  // ---------------------------------------------------------------------------

  const JS_EXTS  = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
  const PY_EXTS  = new Set(['.py', '.pyw']);
  const GO_EXTS  = new Set(['.go']);
  const RS_EXTS  = new Set(['.rs']);
  const JVM_EXTS = new Set(['.java', '.kt', '.kts', '.scala', '.sc']);
  const RB_EXTS  = new Set(['.rb', '.rake']);
  const R_EXTS   = new Set(['.r', '.R']);
  const EX_EXTS  = new Set(['.ex', '.exs']);

  // The languages the import graph reads, by family, and their union. The one
  // place that answers "can the graph see this file's imports" (#979): the walk
  // below, `--impact`, `get_impact`, `plan` and `doctor` all ask this list, so a
  // family added here is a family they all report as tracked.
  //
  // The first eight are the families the graph has always read. The ranker is still
  // handed only those (LEGACY_EXTS, see buildRankingGraph): a better blast-radius graph
  // must not silently move the retrieval numbers (#934, #935). The rest were added in
  // #980 and are read by every surface that reports a blast radius.
  const LEGACY_FAMILIES = [
    ['JavaScript/TypeScript', JS_EXTS],
    ['Python', PY_EXTS],
    ['Go', GO_EXTS],
    ['Rust', RS_EXTS],
    ['Java/Kotlin/Scala', JVM_EXTS],
    ['Ruby', RB_EXTS],
    ['Elixir', EX_EXTS],
    ['R', R_EXTS],
  ];
  const NEW_FAMILIES = RESOLVERS.FAMILIES.map((f) => [f.name, f.EXTS]);
  const GRAPH_FAMILIES = [...LEGACY_FAMILIES, ...NEW_FAMILIES];
  const LEGACY_EXTS = new Set(LEGACY_FAMILIES.flatMap(([, exts]) => [...exts]));
  const GRAPH_EXTS = new Set(GRAPH_FAMILIES.flatMap(([, exts]) => [...exts]));
  const NEW_EXTS = new Set(NEW_FAMILIES.flatMap(([, exts]) => [...exts]));

  // ---------------------------------------------------------------------------
  // Per-build lookup tables
  // ---------------------------------------------------------------------------
  // Go, JVM and Elixir imports name a module, not a file, so each used to be
  // resolved by scanning EVERY file in the set — normalising its path, twice for
  // the JVM — per import: O(imports × files). Once the walk follows the detected
  // roots a repo with a few thousand files spent most of its graph build inside
  // path.normalize (akka: 24 of 30 s). These tables are built once per file set
  // and answer the same questions by key, keeping the "first match in set order"
  // the scans had, so the edge set does not change.

  const _tables = new WeakMap();

  function tablesFor(fileSet) {
    let t = _tables.get(fileSet);
    if (t && t.size === fileSet.size) return t;
    const files = [...fileSet];
    t = { size: fileSet.size, files, keys: files.map(normalizePath), byBase: null, byDir: null };
    _tables.set(fileSet, t);
    return t;
  }

  function _push(map, key, i) {
    const a = map.get(key);
    if (a) a.push(i); else map.set(key, [i]);
  }

  /** file name → indices of the files carrying it, in set order. */
  function byBase(t) {
    if (!t.byBase) {
      t.byBase = new Map();
      t.keys.forEach((k, i) => _push(t.byBase, k.slice(k.lastIndexOf(path.sep) + 1), i));
    }
    return t.byBase;
  }

  /** directory component → indices of the files below one, in set order. */
  function byDir(t) {
    if (!t.byDir) {
      t.byDir = new Map();
      t.keys.forEach((k, i) => {
        const parts = k.split(path.sep);
        parts.pop(); // the file name is not a directory
        for (const p of new Set(parts)) _push(t.byDir, p, i);
      });
    }
    return t.byDir;
  }

  /** First file (set order) whose key ends with `want` — a normalised relative tail. */
  function firstEndingWith(t, want) {
    const cut = want.lastIndexOf(path.sep);
    if (cut === -1) {
      // No directory part, so the file-name bucket cannot narrow it: a bare
      // `Foo.java` is also the tail of `BarFoo.java`. Rare; scan.
      for (const k of t.keys) if (k.endsWith(want)) return k;
      return null;
    }
    const bucket = byBase(t).get(want.slice(cut + 1));
    if (!bucket) return null;
    for (const i of bucket) if (t.keys[i].endsWith(want)) return t.keys[i];
    return null;
  }

  /**
   * First file a Go import's last path segment names: `<suffix>.go`, or any file
   * below a directory called `<suffix>`. A file of a family added in #980 (a `.c` beside
   * the Go it is cgo for) is not a Go package file and never answers: the directory
   * match used to see only the original families, and still picks the same file there.
   */
  function firstGoMatch(t, suffix) {
    const a = byBase(t).get(suffix + '.go');
    const b = suffix ? byDir(t).get(suffix) : undefined;
    const ai = a ? a[0] : Infinity;
    let bi = Infinity;
    if (b) for (const i of b) { if (!NEW_EXTS.has(path.extname(t.keys[i]))) { bi = i; break; } }
    const i = Math.min(ai, bi);
    return i === Infinity ? null : t.keys[i];
  }

  /**
   * Probe an absolute base path for a JS/TS module file in fileSet, trying the
   * usual extension and index-file candidates.
   * @param {string} base - absolute path (no extension) to probe
   * @param {Set<string>} fileSet
   * @returns {string|null}
   */
  function probeJs(base, fileSet) {
    const candidates = [
      base,
      base + '.ts', base + '.tsx',
      base + '.js', base + '.jsx', base + '.mjs', base + '.cjs',
      path.join(base, 'index.ts'), path.join(base, 'index.tsx'),
      path.join(base, 'index.js'), path.join(base, 'index.jsx'),
    ];
    for (const c of candidates) {
      const normC = normalizePath(c);
      if (fileSet.has(normC)) return normC;
    }
    return null;
  }

  /**
   * Resolve a JS/TS relative import string to an absolute path in fileSet.
   * @param {string} dir - directory of the importing file
   * @param {string} importStr - raw import string (e.g. './utils', '../store')
   * @param {Set<string>} fileSet
   * @returns {string|null}
   */
  function resolveJsPath(dir, importStr, fileSet) {
    return probeJs(path.resolve(dir, importStr), fileSet);
  }

  /**
   * Strip comments and trailing commas so a tsconfig/jsconfig (JSONC) parses.
   * Deliberately conservative — leaves string contents alone.
   */
  function stripJsonc(src) {
    let out = '';
    let inStr = false, quote = '', inLine = false, inBlock = false;
    for (let i = 0; i < src.length; i++) {
      const c = src[i], n = src[i + 1];
      if (inLine) { if (c === '\n') { inLine = false; out += c; } continue; }
      if (inBlock) { if (c === '*' && n === '/') { inBlock = false; i++; } continue; }
      if (inStr) { out += c; if (c === '\\') { out += (n || ''); i++; } else if (c === quote) inStr = false; continue; }
      if (c === '"' || c === "'") { inStr = true; quote = c; out += c; continue; }
      if (c === '/' && n === '/') { inLine = true; i++; continue; }
      if (c === '/' && n === '*') { inBlock = true; i++; continue; }
      out += c;
    }
    // remove trailing commas before } or ]
    return out.replace(/,(\s*[}\]])/g, '$1');
  }

  /**
   * Load the JS/TS path-alias map from tsconfig.json / jsconfig.json.
   * Resolves `compilerOptions.paths` and `baseUrl` into absolute target bases so
   * bare/aliased imports (e.g. `@/utils`, `components/Button`) can be resolved to
   * on-disk files. Returns null when no config or no aliasing is configured.
   *
   * @param {string} cwd
   * @returns {{ baseUrl: string|null, entries: Array<{prefix:string,wildcard:boolean,targets:string[]}> }|null}
   */
  function loadAliasMap(cwd) {
    if (!cwd) return null;
    for (const name of ['tsconfig.json', 'jsconfig.json']) {
      let json;
      try { json = JSON.parse(stripJsonc(fs.readFileSync(path.join(cwd, name), 'utf8'))); }
      catch (_) { continue; }
      const co = (json && json.compilerOptions) || {};
      const baseUrl = co.baseUrl ? path.resolve(cwd, co.baseUrl) : null;
      const base = baseUrl || cwd;
      const entries = [];
      for (const [pattern, targets] of Object.entries(co.paths || {})) {
        const wildcard = pattern.includes('*');
        const prefix = pattern.replace(/\*.*$/, '');
        const tgs = (Array.isArray(targets) ? targets : [])
          .map((t) => path.resolve(base, String(t).replace(/\*.*$/, '')));
        if (tgs.length) entries.push({ prefix, wildcard, targets: tgs });
      }
      if (baseUrl || entries.length) return { baseUrl, entries };
      return null;
    }
    return null;
  }

  /**
   * Resolve a non-relative JS/TS import specifier through the alias map.
   * @param {string} spec - e.g. '@/utils', '@app/Button', 'components/Nav'
   * @param {object|null} aliasMap - from loadAliasMap
   * @param {Set<string>} fileSet
   * @returns {string|null}
   */
  function resolveAlias(spec, aliasMap, fileSet) {
    if (!aliasMap) return null;
    for (const e of aliasMap.entries) {
      if (e.wildcard) {
        if (spec.startsWith(e.prefix)) {
          const rest = spec.slice(e.prefix.length);
          for (const t of e.targets) {
            const r = probeJs(rest ? path.join(t, rest) : t, fileSet);
            if (r) return r;
          }
        }
      } else if (spec === e.prefix) {
        for (const t of e.targets) {
          const r = probeJs(t, fileSet);
          if (r) return r;
        }
      }
    }
    // Bare import resolved from baseUrl (tsconfig baseUrl without an explicit alias).
    if (aliasMap.baseUrl) {
      const r = probeJs(path.join(aliasMap.baseUrl, spec), fileSet);
      if (r) return r;
    }
    return null;
  }

  /**
   * Resolve an R `source(...)` argument to an absolute path in fileSet.
   * Tries the dir-relative path first, then a cwd-relative path so that
   * `source("R/helpers.R")` resolves from the project root.
   */
  function escapeRegex(s) {
    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
  }

  function resolveRPath(dir, importStr, fileSet, cwd) {
    const tried = new Set();
    const bases = [path.resolve(dir, importStr)];
    if (cwd) bases.push(path.resolve(cwd, importStr));
    for (const base of bases) {
      for (const c of [base, base + '.R', base + '.r']) {
        const normC = normalizePath(c);
        if (tried.has(normC)) continue;
        tried.add(normC);
        // Check both original and normalized paths (tests may pass non-normalized fileSet)
        if (fileSet.has(c)) return c;
        if (fileSet.has(normC)) return normC;
      }
    }
    return null;
  }

  /**
   * Resolve the ES imports and CommonJS requires of a piece of script source: a `.js` /
   * `.ts` file, or the `<script>` of a component.
   *
   * @param {string} content
   * @param {string} dir  directory of the file the script is in
   * @param {Set<string>} fileSet
   * @param {string} [cwd]
   * @param {object} [ctx]
   * @param {boolean} [wrapped]  also read import lists that span lines. Only a component's script
   *        is read that way: the original eight families keep their one-line reading, because the
   *        ranker's graph is built from them and a better blast radius must not move retrieval (#934).
   * @returns {string[]}
   */
  function jsDeps(content, dir, fileSet, cwd, ctx, wrapped) {
    const found = [];
    const aliasMap = ctx && ctx.aliasMap;
    // The extended graph (everything but the ranker's) also knows SvelteKit's `$lib`.
    const extended = !(ctx && ctx.families === 'legacy');
    // Resolve any specifier: relative → dir-relative; otherwise via tsconfig/
    // jsconfig path aliases + baseUrl. Bare npm packages (react, lodash) fall
    // through to null because they are not in fileSet, so no false edges.
    const resolveSpec = (spec) => {
      if (spec.startsWith('.')) return resolveJsPath(dir, spec, fileSet);
      const viaAlias = resolveAlias(spec, aliasMap, fileSet);
      if (viaAlias || !extended || !(spec === '$lib' || spec.startsWith('$lib/'))) return viaAlias;
      const rest = spec.slice('$lib'.length).replace(/^\//, '');
      for (const a of ancestorDirs(dir, cwd)) {
        const r = probeJs(rest ? path.join(a, 'src', 'lib', rest) : path.join(a, 'src', 'lib'), fileSet);
        if (r) return r;
      }
      return null;
    };

    const stripped = content
      .replace(/\/\/.*$/gm, '')
      .replace(/\/\*[\s\S]*?\*\//g, '');

    let m;
    // ES imports:  import ... from 'x'  |  import 'x'  |  export ... from 'x'
    const reEs = wrapped
      ? /(?:^|[\r\n])\s*(?:import|export)\s+(?:[^'";]*?\s+from\s+)?['"]([^'"]+)['"]/g
      : /(?:^|[\r\n])\s*(?:import|export)\s+(?:[^'";\r\n]*?\s+from\s+)?['"]([^'"]+)['"]/g;
    while ((m = reEs.exec(stripped)) !== null) {
      const r = resolveSpec(m[1]);
      if (r) found.push(r);
    }
    // CommonJS require('x') and dynamic import('x').
    const reCall = /\b(?:require|import)\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
    while ((m = reCall.exec(stripped)) !== null) {
      const r = resolveSpec(m[1]);
      if (r) found.push(r);
    }
    return found;
  }

  /**
   * Extract absolute dependency paths from a single file.
   * @param {string} filePath - absolute path to the file
   * @param {string} content  - file source content
   * @param {Set<string>} fileSet - set of all known absolute file paths
   * @param {string}  [cwd]   - project root, used to resolve R `source("R/...")` calls
   * @param {{ rPackage?: string, rLocalDefs?: Map<string,string> }} [ctx]
   *        Optional cross-file context. When present and the file is R, a
   *        `localPkg::fn` reference (where `localPkg` matches `rPackage`) is
   *        resolved to the file in `rLocalDefs` that defines `fn`.
   * @returns {string[]} resolved absolute paths this file imports
   */
  function extractFileDeps(filePath, content, fileSet, cwd, ctx) {
    const ext = path.extname(filePath).toLowerCase();
    const dir = path.dirname(filePath);
    const found = [];

    // ── JS / TS ───────────────────────────────────────────────────────────────
    if (JS_EXTS.has(ext)) found.push(...jsDeps(content, dir, fileSet, cwd, ctx));

    // ── Vue / Svelte / Astro ──────────────────────────────────────────────────
    // The imports sit in the component's script; they resolve like any script's.
    if (RESOLVERS.sfc.EXTS.has(ext)) {
      // A component that renders itself (svelte:self, a recursive Astro component) is not its own importer.
      const self = normalizePath(filePath);
      found.push(...jsDeps(RESOLVERS.sfc.scriptOf(ext, content), dir, fileSet, cwd, ctx, true).filter((k) => k !== self));
    }

    // ── C/C++/Objective-C, PHP, C#, Dart, Lua, GDScript (#980) ────────────────
    const family = RESOLVERS.BY_EXT.get(ext);
    if (family && family.extract) found.push(...family.extract(filePath, content, fileSet, cwd, ctx));

    // ── Python ────────────────────────────────────────────────────────────────
    if (PY_EXTS.has(ext)) {
      // from .module import ...  /  from ..pkg import ...
      const re = /^[ \t]*from\s+(\.+[\w.]*)\s+import/gm;
      let m;
      while ((m = re.exec(content)) !== null) {
        const dotCount = (m[1].match(/^\.+/) || [''])[0].length;
        const modPart  = m[1].slice(dotCount).replace(/\./g, '/');
        let base = dir;
        for (let i = 1; i < dotCount; i++) base = path.dirname(base);
        const candidate = modPart
          ? path.join(base, modPart + '.py')
          : null;
        if (candidate) {
          const normC = normalizePath(candidate);
          if (fileSet.has(normC)) found.push(normC);
        }
      }

      // Absolute imports: from package.module import ... (infer from project
      // structure). The module is resolved against EVERY ancestor of the
      // importing file up to the project root, nearest first — any of them can
      // be the source root on sys.path (src/ layouts, pytest rootdir). The old
      // dir + one-parent probe silently dropped edges for files nested two or
      // more directories below the source root (#532), and a false "zero
      // importers" from get_impact is exactly the signal that says a change is
      // safe to make.
      const reAbs = /^[ \t]*from\s+([\w.]+)\s+import/gm;
      while ((m = reAbs.exec(content)) !== null) {
        const modulePath = m[1].replace(/\./g, '/');
        const normCwd = normalizePath(path.resolve(cwd));
        let base = dir;
        let hit = null;
        for (let depth = 0; depth < 16 && !hit; depth++) {
          for (const c of [path.join(base, modulePath + '.py'), path.join(base, modulePath, '__init__.py')]) {
            const normC = normalizePath(c);
            if (fileSet.has(normC)) { hit = normC; break; }
          }
          if (normalizePath(base) === normCwd) break;
          const parent = path.dirname(base);
          if (parent === base) break;
          base = parent;
        }
        if (hit) found.push(hit);
      }
    }

    // ── Go ────────────────────────────────────────────────────────────────────
    // Go uses module paths, not relative file paths — we match same-module paths
    // by checking if any known file's relative path matches the imported suffix.
    if (GO_EXTS.has(ext)) {
      const re = /import\s*\(\s*([\s\S]*?)\s*\)/g;
      const reInline = /import\s+"([^"]+)"/g;
      const imports = [];
      let m;
      while ((m = re.exec(content)) !== null) {
        for (const imp of m[1].matchAll(/"([^"]+)"/g)) imports.push(imp[1]);
      }
      while ((m = reInline.exec(content)) !== null) imports.push(m[1]);

      if (imports.length > 0) {
        const t = tablesFor(fileSet);
        for (const imp of imports) {
          const hit = firstGoMatch(t, imp.split('/').pop());
          if (hit) found.push(hit);
        }
      }
    }

    // ── Rust ──────────────────────────────────────────────────────────────────
    // Match `mod foo;` and `use crate::foo::bar` — resolve to sibling .rs files
    if (RS_EXTS.has(ext)) {
      const reMod = /^\s*(?:pub\s+)?mod\s+(\w+)\s*;/gm;
      let m;
      while ((m = reMod.exec(content)) !== null) {
        const candidate = path.join(dir, m[1] + '.rs');
        const normC = normalizePath(candidate);
        if (fileSet.has(normC)) found.push(normC);
        // Also try mod/mod.rs
        const candidate2 = path.join(dir, m[1], 'mod.rs');
        const normC2 = normalizePath(candidate2);
        if (fileSet.has(normC2)) found.push(normC2);
      }
    }

    // ── Java / Kotlin / Scala ─────────────────────────────────────────────────
    // Match same-project import statements by matching package-relative paths
    if (JVM_EXTS.has(ext)) {
      const re = /^\s*import\s+([\w.]+)\s*;?/gm;
      let m;
      while ((m = re.exec(content)) !== null) {
        // Convert com.example.utils.StringHelper → com/example/utils/StringHelper.java
        const asPath = m[1].replace(/\./g, path.sep);
        const t = tablesFor(fileSet);
        for (const jvmExt of ['.java', '.kt', '.kts', '.scala', '.sc']) {
          const hit = firstEndingWith(t, normalizePath(asPath + jvmExt));
          if (hit) found.push(hit);
        }
      }
    }

    // ── Ruby ──────────────────────────────────────────────────────────────────
    if (RB_EXTS.has(ext)) {
      const re = /^\s*require_relative\s+['"]([^'"]+)['"]/gm;
      let m;
      while ((m = re.exec(content)) !== null) {
        const base = path.resolve(dir, m[1]);
        const candidate  = base.endsWith('.rb') ? base : base + '.rb';
        const normC = normalizePath(candidate);
        if (fileSet.has(normC)) found.push(normC);
      }
    }

    // ── Elixir ────────────────────────────────────────────────────────────────
    // Module references (`alias A.B`, `import A.B`, `use A.B`, `require A.B`)
    // resolve to repo files by the lib/ snake_case convention: A.B.C →
    // .../b/c.ex, longest suffix first. External modules miss fileSet, so no
    // false edges (#538).
    if (EX_EXTS.has(ext)) {
      const stripped = content.replace(/#[^\n]*/g, '');
      const snake = (seg) => seg.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
      const re = /^\s*(?:alias|import|use|require)\s+([A-Z][\w.]*)/gm;
      let m;
      while ((m = re.exec(stripped)) !== null) {
        const segs = m[1].split('.').map(snake);
        const suffixes = [];
        if (segs.length >= 2) suffixes.push(segs.slice(-2).join('/') + '.ex');
        suffixes.push(segs[segs.length - 1] + '.ex');
        let hit = null;
        const t = tablesFor(fileSet);
        for (const suf of suffixes) {
          const bucket = byBase(t).get(suf.slice(suf.lastIndexOf('/') + 1)) || [];
          for (const i of bucket) {
            if (t.files[i] === filePath) continue;
            if (t.keys[i].endsWith('/' + suf)) { hit = t.files[i]; break; }
          }
          if (hit) break;
        }
        if (hit) found.push(hit);
      }
    }

    // ── R ─────────────────────────────────────────────────────────────────────
    // R doesn't have JS-style relative imports inside packages — files in R/ are
    // auto-sourced in alphabetical order. We emit edges for:
    //   1. Explicit `source("path/file.R")` calls (common in Shiny / scripts).
    //   2. `localPkg::fn` references where `localPkg` matches the project's
    //      own DESCRIPTION#Package — resolved via the symbol→file map in ctx.
    // `library(pkg)` / external `pkg::fn` calls are not graph edges.
    if (R_EXTS.has(ext)) {
      const stripped = content.replace(/#.*$/gm, '');
      const reSrc = /(?:^|[^\w.])source\s*\(\s*["']([^"']+)["']/g;
      let m;
      while ((m = reSrc.exec(stripped)) !== null) {
        const r = resolveRPath(dir, m[1], fileSet, cwd);
        if (r) found.push(r);
      }
      if (ctx && ctx.rPackage && ctx.rLocalDefs && ctx.rLocalDefs.size > 0) {
        const pkg = ctx.rPackage;
        // Match `pkg::fn` or `pkg:::fn`. The `::` form needs to be the local
        // package — references to other packages are external.
        const reNs = new RegExp(`\\b${escapeRegex(pkg)}:::?([A-Za-z][\\w.]*)`, 'g');
        while ((m = reNs.exec(stripped)) !== null) {
          const target = ctx.rLocalDefs.get(m[1]);
          if (!target) continue;
          const normTarget = normalizePath(target);
          const normFilePath = normalizePath(filePath);
          if (normTarget === normFilePath) continue;
          // Check both original and normalized paths (tests may pass non-normalized fileSet)
          if (fileSet.has(target)) {
            found.push(target);
          } else if (fileSet.has(normTarget)) {
            found.push(normTarget);
          }
        }
      }
    }

    return [...new Set(found)];
  }

  // ---------------------------------------------------------------------------
  // Public API
  // ---------------------------------------------------------------------------

  /**
   * Build a forward and reverse dependency graph for all given files.
   *
   * @param {string[]} files - absolute file paths to analyze
   * @param {string}   cwd   - project root (used only for error reporting)
   * @param {{ rPackage?: string, rLocalDefs?: Map<string,string> }} [ctx]
   *        Optional cross-file context for namespace-aware resolution. Built
   *        automatically by `buildFromCwd` when DESCRIPTION + NAMESPACE exist.
   * @returns {{ forward: Map<string,string[]>, reverse: Map<string,string[]>,
   *             realPaths: Map<string,string> }}
   */
  function build(files, cwd, ctx) {
    const fileSet = new Set(files.map((f) => path.resolve(f)));
    // Create a normalized version for cross-platform case-insensitive lookups
    const fileSetNormalized = new Set([...fileSet].map(normalizePath));
    // Resolve the JS/TS path-alias map once (tsconfig/jsconfig paths + baseUrl),
    // unless a caller supplied one explicitly via ctx.
    const aliasMap = (ctx && 'aliasMap' in ctx) ? ctx.aliasMap : loadAliasMap(cwd);

    // Node keys are lowercased for case-insensitive matching, which loses the
    // real spelling every display surface needs. Keep the original-case path
    // alongside so renderers can recover it (see src/graph/path-key displayPath).
    // The resolvers that index file contents read files by it (a lowercased key is
    // not a path on a case-sensitive filesystem).
    const realPaths = new Map();
    const effectiveCtx = Object.assign({}, ctx, { aliasMap, realPaths });
    const forward = new Map();
    const reverse = new Map();

    // Initialise every known file in both maps (ensures isolated files appear)
    // Store using normalized paths for Windows compatibility
    for (const f of fileSet) {
      const normF = normalizePath(f);
      if (!realPaths.has(normF)) realPaths.set(normF, f);
      if (!forward.has(normF)) forward.set(normF, []);
      if (!reverse.has(normF)) reverse.set(normF, []);
    }

    for (const filePath of fileSet) {
      let content;
      try {
        content = fs.readFileSync(filePath, 'utf8');
      } catch (_) {
        continue;
      }

      const normFilePath = normalizePath(filePath);
      const deps = extractFileDeps(filePath, content, fileSetNormalized, cwd, effectiveCtx);
      if (deps.length > 0) {
        forward.set(normFilePath, deps);
        for (const dep of deps) {
          if (!reverse.has(dep)) reverse.set(dep, []);
          reverse.get(dep).push(normFilePath);
        }
      }
    }

    return { forward, reverse, realPaths };
  }

  // Directory names assumed when neither the caller nor the project config says
  // otherwise. A Maven/Gradle module (`mall-portal/`, `service-api/`) matches none
  // of them, which is why the config is consulted first.
  const DEFAULT_SRC_DIRS = ['src', 'app', 'lib', 'R', 'inst'];

  // Walk depth measured from EACH srcDir root, not from cwd — so this is not the
  // same quantity as the extractor's cwd-relative `maxDepth` and must not be read
  // from it. A standard Maven tree reaches `src/main/java/<group>/<artifact>/…`
  // nine directories below its module root, so the previous ceiling of 8 silently
  // dropped the deepest packages (on macrozheng/mall: every `service/impl/` class).
  const DEFAULT_WALK_DEPTH = 12;

  /**
   * Source directories declared in the project's own config, or null when there
   * is no readable config. See src-dirs.js for why this does not go through
   * `loadConfig`.
   */
  function _configuredSrcDirs(cwd) {
    return configuredSrcDirs(cwd);
  }

  /**
   * Build a dependency graph scoped to a single cwd by walking all JS/TS/Py/Go
   * files under srcDirs. Useful for the MCP tool handler.
   *
   * srcDirs resolution order: explicit `opts.srcDirs` → `gen-context.config.json`
   * → the source roots detection chose, plus DEFAULT_SRC_DIRS (src-dirs.js). The
   * config step keeps the graph from being empty on a Maven/Gradle layout; the
   * detection step does the same for every repo that has no config at all, which
   * is most of them (django/, packages/*, internal/, a flat Go module).
   *
   * @param {string} cwd
   * @param {object} [opts]
   * @param {string[]} [opts.srcDirs]
   * @param {string[]} [opts.exclude]
   * @param {number}   [opts.maxDepth] - walk depth from each srcDir root
   * @returns {{ forward: Map<string,string[]>, reverse: Map<string,string[]>,
   *             realPaths: Map<string,string> }}
   */
  function buildFromCwd(cwd, opts) {
    // R-package layouts use `R/` and `inst/`; Shiny apps put helpers in `R/`.
    // The existence check below makes these no-ops in non-R projects.
    const o = opts || {};
    // 'all' (default) reads every family; 'legacy' only the original eight, which is what the
    // ranker is handed (see buildRankingGraph).
    const families = o.families === 'legacy' ? 'legacy' : 'all';
    const readable = families === 'legacy' ? LEGACY_EXTS : GRAPH_EXTS;
    const maxDepth = o.maxDepth === undefined ? DEFAULT_WALK_DEPTH : o.maxDepth;
    let { srcDirs, exclude } = o;
    if (srcDirs === undefined) {
      const dirs = resolveGraphDirs(cwd, DEFAULT_SRC_DIRS);
      srcDirs = dirs.srcDirs;
      if (exclude === undefined && dirs.exclude) exclude = dirs.exclude;
    }
    if (exclude === undefined) exclude = ['node_modules', '.git', 'dist', 'build'];
    const excludeSet = new Set(exclude);

    // Collects into one shared array. Returning a list per directory and
    // spreading it into the parent (`push(...walkDir())`) passes every path as a
    // call argument, which overflows the stack past ~125k files (#855).
    function walkDir(dir, depth, out) {
      if (depth > maxDepth) return;
      let entries;
      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
      for (const e of entries) {
        if (excludeSet.has(e.name) || e.name.startsWith('.')) continue;
        const full = path.join(dir, e.name);
        if (e.isDirectory()) {
          walkDir(full, depth + 1, out);
        } else if (e.isFile()) {
          const ext = path.extname(e.name).toLowerCase();
          if (readable.has(ext)) out.push(full);
        }
      }
    }

    const files = [];
    for (const sd of srcDirs) {
      const absDir = path.resolve(cwd, sd);
      if (fs.existsSync(absDir)) walkDir(absDir, 0, files);
    }
    // Also include root-level entry files (R: app.R/server.R/ui.R/global.R for Shiny)
    for (const rootFile of ['gen-context.js', 'index.js', 'main.js', 'app.js',
                            'app.R', 'server.R', 'ui.R', 'global.R']) {
      const abs = path.resolve(cwd, rootFile);
      if (fs.existsSync(abs)) files.push(abs);
    }

    // Build R namespace context if this looks like an R package.
    let ctx = { families };
    try {
      const { readDescription, collectLocalDefs } = __require('./src/discovery/r-manifest');
      const desc = readDescription(cwd);
      if (desc && desc.package) {
        const rFiles = files.filter((f) => R_EXTS.has(path.extname(f).toLowerCase()));
        if (rFiles.length > 0) {
          ctx = { families, rPackage: desc.package, rLocalDefs: collectLocalDefs(rFiles) };
        }
      }
    } catch (_) { /* manifest module missing or read failed — proceed without ctx */ }

    return build(files, cwd, ctx);
  }

  /**
   * The graph the RANKER is handed. Deliberately the walk `buildFromCwd` did
   * before #934: the project's pinned srcDirs, else the conventional names.
   *
   * Why not the detected roots. The neighbour boost adds 0.40 per importing seed
   * with no bound, and was calibrated on graphs of a few hundred files. Over the
   * whole Django graph (2,971 files) one module that 180 matching files import
   * collects +72 on a base score of 12 and the answer falls out of the top 5.
   * Measured on xrepo that is net zero hits (+3 / -3) with django 3 -> 1, and the
   * damping that fixes it moves the published self-corpus numbers — a measured
   * change of its own (#935). Until then ranking, the benchmarks that score it
   * and the product that ships it all see the same graph they always did, and
   * only the surfaces that report a blast radius see the real one.
   *
   * @param {string} cwd
   * @param {object} [opts] as buildFromCwd; an explicit `srcDirs` still wins
   */
  function buildRankingGraph(cwd, opts) {
    // Also the original eight families only (#980): the families added since read more files
    // and add edges, and the same unbounded neighbour boost would see them. Pass
    // `families: 'all'` to measure what that does; nothing ships it.
    const o = Object.assign({ families: 'legacy' }, opts || {});
    if (o.srcDirs !== undefined) return buildFromCwd(cwd, o);
    return buildFromCwd(cwd, Object.assign({}, o, { srcDirs: configuredSrcDirs(cwd) || DEFAULT_SRC_DIRS }));
  }

  module.exports = { build, buildFromCwd, buildRankingGraph, extractFileDeps, normalizePath, loadAliasMap, resolveAlias, _configuredSrcDirs, DEFAULT_SRC_DIRS, DEFAULT_WALK_DEPTH, GRAPH_FAMILIES, GRAPH_EXTS, LEGACY_FAMILIES, LEGACY_EXTS };
  
};

// ── ./src/graph/call-graph ──
__factories["./src/graph/call-graph"] = function(module, exports) {
  
  /**
   * Method/caller-level call-graph (D4 v1, languages expanded in GR1).
   *
   * Builds symbol-level edges — which function calls which function — for JS/TS,
   * Python, Java, Go, and Rust. Deterministic, zero-dependency, regex +
   * brace/indent matching. Call sites are resolved with high precision: a call
   * resolves to a definition of that name in the *same file* first, then in a
   * *directly-imported* file (via the existing file-level import graph). Names
   * that resolve to no repo definition produce no edge — over-approximation
   * noise is avoided. Constructs that can't be parsed dependency-free are
   * skipped (less fidelity, never a parser dep).
   *
   * Symbol IDs are `relPath#symbolName` (forward-slashed, relative to cwd).
   *
   * @module src/graph/call-graph
   */

  const fs = require('fs');
  const path = require('path');
  const { build } = __require('./src/graph/builder');
  const { resolveGraphDirs, configuredSrcDirs } = __require('./src/graph/src-dirs');
  const { maskCode } = __require('./src/extractors/scan');

  const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
  const PY_EXTS = new Set(['.py', '.pyw']);
  const JAVA_EXTS = new Set(['.java']);
  const GO_EXTS = new Set(['.go']);
  const RS_EXTS = new Set(['.rs']);
  const KT_EXTS = new Set(['.kt', '.kts']);
  const SCALA_EXTS = new Set(['.scala', '.sc']);

  // The languages the method-level call graph reads, by family, and their union
  // (#979): narrower than the import graph (no Ruby, Elixir or R), so the two
  // are reported separately.
  const CALL_GRAPH_FAMILIES = [
    ['JavaScript/TypeScript', JS_EXTS],
    ['Python', PY_EXTS],
    ['Java', JAVA_EXTS],
    ['Go', GO_EXTS],
    ['Rust', RS_EXTS],
    ['Kotlin', KT_EXTS],
    ['Scala', SCALA_EXTS],
  ];
  const CALL_GRAPH_EXTS = new Set(CALL_GRAPH_FAMILIES.flatMap(([, exts]) => [...exts]));

  // Tokens that look like `name(` calls or definition headers but are language
  // keywords, not user symbols — never treated as a call or a definition.
  const NON_CALL = new Set([
    'if', 'for', 'while', 'switch', 'catch', 'return', 'function', 'typeof',
    'await', 'new', 'super', 'else', 'do', 'with', 'yield', 'void', 'delete',
    'in', 'of', 'case', 'throw', 'print', 'and', 'or', 'not', 'assert',
    'lambda', 'class', 'def', 'elif', 'except', 'finally', 'raise', 'import',
    'from', 'global', 'nonlocal', 'del', 'pass', 'async', 'require', 'constructor',
    'synchronized',
  ]);

  const { graphKey } = __require('./src/graph/path-key');
  function normalizePath(p) { return graphKey(p); }
  function toRel(cwd, f) { return path.relative(cwd, f).replace(/\\/g, '/'); }
  function symId(cwd, absFile, name) { return `${toRel(cwd, absFile)}#${name}`; }

  // ── Length- and newline-preserving maskers ──────────────────────────────────
  // Replace comment / string bodies with spaces so their braces, parens, and
  // call-looking tokens never confuse structure detection. Offsets stay aligned.

  function maskJs(src, opts) {
    return maskCode(src, opts);
  }

  // Rust: `//`, `/* */`, and `"..."` mask like JS, but a bare `'` is usually a
  // lifetime (`'a`), not a string — masking to the "closing" quote would corrupt
  // offsets. Only char literals (`'x'`, `'\n'`) are masked; lifetimes pass through.
  function maskRust(src) {
    const out = src.split('');
    const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
    let i = 0; const n = src.length;
    while (i < n) {
      const c = src[i], d = src[i + 1];
      if (c === '/' && d === '/') { let j = i + 2; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
      if (c === '/' && d === '*') { let j = i + 2; while (j < n && !(src[j] === '*' && src[j + 1] === '/')) j++; j = Math.min(n, j + 2); blank(i, j); i = j; continue; }
      if (c === '"') {
        let j = i + 1;
        while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === '"') break; j++; }
        j = Math.min(n, j + 1); blank(i, j); i = j; continue;
      }
      if (c === "'") {
        if (d === '\\' && src[i + 3] === "'") { blank(i, i + 4); i += 4; continue; } // '\n'
        if (d !== undefined && src[i + 2] === "'") { blank(i, i + 3); i += 3; continue; } // 'x'
        i++; continue; // lifetime `'a` — leave untouched
      }
      i++;
    }
    return out.join('');
  }

  function maskPy(src) {
    const out = src.split('');
    const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
    let i = 0; const n = src.length;
    while (i < n) {
      const c = src[i];
      if (c === '#') { let j = i + 1; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
      if (c === '"' || c === "'") {
        if (src.substr(i, 3) === c + c + c) {
          let j = i + 3; while (j < n && src.substr(j, 3) !== c + c + c) j++; j = Math.min(n, j + 3); blank(i, j); i = j; continue;
        }
        let j = i + 1; while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === c || src[j] === '\n') break; j++; }
        j = Math.min(n, j + 1); blank(i, j); i = j; continue;
      }
      i++;
    }
    return out.join('');
  }

  // ── Balanced-delimiter matchers (operate on masked source) ───────────────────
  function matchDelim(masked, openIdx, open, close) {
    let depth = 0;
    for (let i = openIdx; i < masked.length; i++) {
      if (masked[i] === open) depth++;
      else if (masked[i] === close) { depth--; if (depth === 0) return i; }
    }
    return masked.length - 1;
  }

  function lineAt(src, idx) {
    let line = 1;
    const end = Math.min(idx, src.length);
    for (let i = 0; i < end; i++) if (src.charCodeAt(i) === 10) line++;
    return line;
  }

  // ── Definition extraction ────────────────────────────────────────────────────
  // Each def: { name, line, bodyStart, bodyEnd } with char offsets into `masked`.

  function jsDefs(masked) {
    const defs = [];
    const seen = new Set();
    const push = (name, headerIdx, bodyStart, bodyEnd) => {
      const key = name + ':' + bodyStart;
      if (NON_CALL.has(name) || seen.has(key)) return;
      seen.add(key);
      defs.push({ name, line: lineAt(masked, headerIdx), bodyStart, bodyEnd });
    };

    // Locate the `{` body (or `=>` expression) that follows a param list `)`.
    const bodyAfterParams = (closeParen) => {
      let k = closeParen + 1;
      // skip a `=>`, return-type annotations, and whitespace up to `{` or a statement end
      while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n') k++;
      if (masked[k] === '{') { const end = matchDelim(masked, k, '{', '}'); return { bodyStart: k, bodyEnd: end }; }
      return null; // no braced body (interface/abstract/overload signature) — skip
    };

    // 1) function declarations:  (async) function name(...) { ... }
    const reFn = /\b(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)\s*\(/g;
    let m;
    while ((m = reFn.exec(masked)) !== null) {
      const paren = masked.indexOf('(', m.index + m[0].length - 1);
      const close = matchDelim(masked, paren, '(', ')');
      const body = bodyAfterParams(close);
      if (body) push(m[1], m.index, body.bodyStart, body.bodyEnd);
    }

    // 2) arrow / function expressions:  const name = (...) => { }  |  = function(...) { }
    const reArrow = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?(?:function\b\s*\*?\s*[A-Za-z_$]*\s*)?\(/g;
    while ((m = reArrow.exec(masked)) !== null) {
      const paren = masked.indexOf('(', m.index + m[0].length - 1);
      const close = matchDelim(masked, paren, '(', ')');
      let k = close + 1;
      while (k < masked.length && /\s/.test(masked[k])) k++;
      if (masked[k] === '{') { push(m[1], m.index, k, matchDelim(masked, k, '{', '}')); continue; }
      if (masked[k] === '=' && masked[k + 1] === '>') {
        let j = k + 2; while (j < masked.length && /\s/.test(masked[j])) j++;
        if (masked[j] === '{') push(m[1], m.index, j, matchDelim(masked, j, '{', '}'));
        else { // single-expression arrow body → to end of statement
          let e = j; let d = 0;
          while (e < masked.length) { const ch = masked[e]; if (ch === '(' || ch === '[') d++; else if (ch === ')' || ch === ']') d--; else if ((ch === ';' || ch === '\n') && d <= 0) break; e++; }
          push(m[1], m.index, j, e);
        }
      }
    }

    // 3) class methods:  class X { name(...) { } }
    const reClass = /\bclass\s+[A-Za-z_$][\w$]*/g;
    while ((m = reClass.exec(masked)) !== null) {
      const brace = masked.indexOf('{', m.index);
      if (brace === -1) continue;
      const classEnd = matchDelim(masked, brace, '{', '}');
      const reMethod = /(?:^|\n)\s*(?:public\s+|private\s+|protected\s+|static\s+|readonly\s+|abstract\s+|async\s+|get\s+|set\s+|\*\s*)*([A-Za-z_$][\w$]*)\s*\(/g;
      reMethod.lastIndex = brace;
      let mm;
      while ((mm = reMethod.exec(masked)) !== null && mm.index < classEnd) {
        const paren = masked.indexOf('(', mm.index + mm[0].length - 1);
        const close = matchDelim(masked, paren, '(', ')');
        const body = bodyAfterParams(close);
        if (body && body.bodyEnd <= classEnd) push(mm[1], mm.index, body.bodyStart, body.bodyEnd);
      }
    }

    return defs;
  }

  function pyDefs(masked) {
    const defs = [];
    const lines = masked.split('\n');
    // precompute char offset of each line start
    const offsets = [0];
    for (let i = 0; i < lines.length; i++) offsets.push(offsets[i] + lines[i].length + 1);
    for (let i = 0; i < lines.length; i++) {
      const m = lines[i].match(/^([ \t]*)(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/);
      if (!m) continue;
      const indent = m[1].length;
      let j = i + 1;
      for (; j < lines.length; j++) {
        const ln = lines[j];
        if (!ln.trim()) continue;                       // blank
        const ind = ln.match(/^[ \t]*/)[0].length;
        if (ind <= indent) break;                        // dedent → block ends
      }
      defs.push({ name: m[2], line: i + 1, bodyStart: offsets[i], bodyEnd: offsets[j] || masked.length });
    }
    return defs;
  }

  // Go:  func name(...) { }   |   func (r Recv) name(...) (T, error) { }
  // The return list may itself be parenthesized, so scan past it to the body `{`.
  function goDefs(masked) {
    const defs = [];
    const re = /(?:^|\n)func\s+(?:\([^)\n]*\)\s*)?([A-Za-z_]\w*)\s*\(/g;
    let m;
    while ((m = re.exec(masked)) !== null) {
      const paren = masked.indexOf('(', m.index + m[0].length - 1);
      const close = matchDelim(masked, paren, '(', ')');
      let k = close + 1;
      let depth = 0;
      while (k < masked.length) {
        const ch = masked[k];
        if (ch === '(') depth++;
        else if (ch === ')') depth--;
        else if (ch === '{' && depth === 0) break;
        else if (ch === '\n' && depth === 0) { k = -1; break; } // no body on this header
        k++;
      }
      if (k === -1 || k >= masked.length) continue;
      defs.push({ name: m[1], line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
    }
    return defs;
  }

  // Java: methods + constructors with braced bodies. Statement-shaped matches
  // (calls, control flow) are rejected because their `)` is followed by `;`,
  // and keyword headers (`if`, `while`, …) fall to the NON_CALL guard.
  // Words that can precede `name(` in a STATEMENT, so their presence means the
  // line is not a method declaration.
  const STMT_KEYWORDS = new Set([
    'return', 'throw', 'else', 'do', 'try', 'case', 'yield', 'assert', 'new',
    'if', 'while', 'for', 'switch', 'catch', 'synchronized', 'instanceof', 'await',
  ]);

  // Types a Java class declares it implements or extends, with generic arguments
  // stripped and any package qualifier dropped: `implements Foo<Bar, Baz>` yields
  // ['Foo'], never 'Baz>'. Also records whether the class is a Spring bean and
  // whether it is @Primary, which is what disambiguates several implementations.
  function javaTypeDecl(masked) {
    const m = /(?:^|\n)[^\n]*?\bclass\s+([A-Za-z_$][\w$]*)([^{]*)\{/.exec(masked);
    if (!m) return null;
    const [, className, tail] = m;
    const supers = [];
    for (const kw of ['implements', 'extends']) {
      const k = new RegExp('\\b' + kw + '\\s+([^{]*?)(?=\\b(?:implements|extends)\\b|$)').exec(tail);
      if (!k) continue;
      let depth = 0;
      let cur = '';
      for (const ch of k[1]) {
        if (ch === '<') { depth++; continue; }
        if (ch === '>') { depth--; continue; }
        if (ch === ',' && depth === 0) { if (cur.trim()) supers.push(cur.trim()); cur = ''; continue; }
        if (depth === 0) cur += ch;
      }
      if (cur.trim()) supers.push(cur.trim());
    }
    const head = masked.slice(0, m.index + m[0].length);
    return {
      className,
      supers: supers.map((t) => t.split('.').pop().trim()).filter(Boolean),
      isBean: /@(Service|Component|Repository|Controller|RestController)\b/.test(head),
      isPrimary: /@Primary\b/.test(head),
    };
  }

  function javaDefs(masked) {
    const defs = [];
    const seen = new Set();
    const re = /(?:^|\n)[ \t]*((?:(?:public|private|protected|static|final|abstract|synchronized|native|default|strictfp)\s+)*)(?:<[^>\n]{0,80}>\s*)?(?:[\w$][\w$.<>\[\],?\s]*?\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
    let m;
    while ((m = re.exec(masked)) !== null) {
      const name = m[2];
      if (NON_CALL.has(name)) continue;
      // `new Foo() { … }` anonymous classes are uses, not definitions.
      const before = masked.slice(Math.max(0, m.index), m.index + m[0].length - name.length - 1);
      if (/\bnew\s*$/.test(before)) continue;
      const paren = masked.indexOf('(', m.index + m[0].length - 1);
      const close = matchDelim(masked, paren, '(', ')');
      // skip `throws A, B` up to the body `{` (same line — multi-line headers are skipped)
      let k = close + 1;
      while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n' && masked[k] !== '=') k++;
      // A `;` here is an interface or abstract method DECLARATION. It owns no body,
      // so it emits no calls — but in Spring the declared interface is what callers
      // name, so without it as a node every controller→service edge has no target.
      // Recorded with an empty body range: can receive edges, never produces them.
      // `before` is everything between line start and the method name. A real
      // declaration has modifiers or a return type there (`void chargeCard(`);
      // a call statement has only whitespace (`identity(1);`) or a statement
      // keyword (`return helper(a);`) — neither may be read as a declaration,
      // or the call resolves to a phantom local def instead of the real target.
      const headWord = (before.match(/([A-Za-z_$][\w$]*)\s*$/) || [])[1];
      const isDecl = masked[k] === ';' && /\S/.test(before) && !STMT_KEYWORDS.has(headWord);
      if (masked[k] !== '{' && !isDecl) continue;
      const key = name + ':' + k;
      if (seen.has(key)) continue;
      seen.add(key);
      defs.push(isDecl
        ? { name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: k }
        : { name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
    }
    return defs;
  }

  // Rust: fn name(...) { }  |  fn name<T>(...) -> T where … { }  — inside or
  // outside impl/trait blocks. A `;` before the body brace (trait declaration)
  // means no body: skipped.
  function rustDefs(masked) {
    const defs = [];
    const re = /\bfn\s+([A-Za-z_]\w*)/g;
    let m;
    while ((m = re.exec(masked)) !== null) {
      let k = m.index + m[0].length;
      while (k < masked.length && /\s/.test(masked[k])) k++;
      if (masked[k] === '<') k = matchDelim(masked, k, '<', '>') + 1;
      while (k < masked.length && /\s/.test(masked[k])) k++;
      if (masked[k] !== '(') continue;
      const close = matchDelim(masked, k, '(', ')');
      // return type / where clause may span lines; stop at body `{` or decl `;`
      let b = close + 1;
      while (b < masked.length && masked[b] !== '{' && masked[b] !== ';') b++;
      if (masked[b] !== '{') continue;
      defs.push({ name: m[1], line: lineAt(masked, m.index), bodyStart: b, bodyEnd: matchDelim(masked, b, '{', '}') });
    }
    return defs;
  }

  // Pick the masker whose comment/string syntax matches the language.
  // Java and Go share JS syntax (Go raw strings mask like template literals).
  /**
   * Body range for a JVM-family member that may use either a brace body or an
   * expression body (`fun f() = expr` / `def f = expr`), which Java has not.
   * An expression body runs to the end of its line — enough to capture the calls
   * it makes, which is all the graph needs.
   * @returns {{bodyStart:number, bodyEnd:number}|null} null when neither form follows
   */
  function jvmBodyRange(masked, from) {
    let k = from;
    while (k < masked.length && masked[k] !== '{' && masked[k] !== '=' && masked[k] !== '\n' && masked[k] !== ';') k++;
    if (masked[k] === '{') return { bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') };
    if (masked[k] === '=') {
      // `= {` is still a brace body, just written with an assignment.
      let j = k + 1;
      while (j < masked.length && /\s/.test(masked[j])) j++;
      if (masked[j] === '{') return { bodyStart: j, bodyEnd: matchDelim(masked, j, '{', '}') };
      const eol = masked.indexOf('\n', k);
      return { bodyStart: k, bodyEnd: eol === -1 ? masked.length : eol };
    }
    return null; // abstract member or interface declaration
  }

  /**
   * Kotlin `fun` definitions, including extension functions (`fun Foo.bar()`,
   * recorded as `bar`) and expression bodies.
   */
  function ktDefs(masked) {
    const defs = [];
    const seen = new Set();
    const re = /(?:^|\n)[ \t]*((?:(?:public|private|protected|internal|open|override|abstract|final|suspend|inline|operator|infix|tailrec|external|expect|actual|inner|companion)\s+)*)fun\s+(?:<[^>\n]{0,80}>\s*)?(?:[A-Za-z_][\w.<>]*\.)?([A-Za-z_][\w]*)\s*\(/g;
    let m;
    while ((m = re.exec(masked)) !== null) {
      const name = m[2];
      if (NON_CALL.has(name)) continue;
      const paren = masked.indexOf('(', m.index + m[0].length - 1);
      const close = matchDelim(masked, paren, '(', ')');
      if (close < 0) continue;
      const range = jvmBodyRange(masked, close + 1);
      const line = lineAt(masked, m.index + 1);
      const key = name + ':' + (range ? range.bodyStart : line);
      if (seen.has(key)) continue;
      seen.add(key);
      // An abstract/interface member owns no body: it can receive edges but
      // never produces them, the same treatment javaDefs gives declarations.
      defs.push(range ? { name, line, ...range } : { name, line, bodyStart: close, bodyEnd: close });
    }
    return defs;
  }

  /**
   * Scala `def` definitions. Handles parameterless members (`def foo: Int = 1`),
   * type parameters, and expression bodies.
   */
  function scalaDefs(masked) {
    const defs = [];
    const seen = new Set();
    const re = /(?:^|\n)[ \t]*((?:(?:private|protected|override|implicit|final|lazy|sealed|abstract|inline)(?:\s*\[[^\]\n]{0,60}\])?\s+)*)def\s+([A-Za-z_][\w]*)\s*(?=[\[\(:=])/g;
    let m;
    while ((m = re.exec(masked)) !== null) {
      const name = m[2];
      if (NON_CALL.has(name)) continue;
      // Step past an optional type-parameter list, then an optional value list.
      let k = m.index + m[0].length;
      if (masked[k] === '[') { const e = matchDelim(masked, k, '[', ']'); if (e < 0) continue; k = e + 1; }
      while (masked[k] === '(') { const e = matchDelim(masked, k, '(', ')'); if (e < 0) break; k = e + 1; }
      const range = jvmBodyRange(masked, k);
      const line = lineAt(masked, m.index + 1);
      const key = name + ':' + (range ? range.bodyStart : line);
      if (seen.has(key)) continue;
      seen.add(key);
      defs.push(range ? { name, line, ...range } : { name, line, bodyStart: k, bodyEnd: k });
    }
    return defs;
  }

  function maskFor(filePath, src) {
    const ext = path.extname(filePath).toLowerCase();
    if (PY_EXTS.has(ext)) return maskPy(src);
    if (RS_EXTS.has(ext)) return maskRust(src);
    return maskJs(src, { js: JS_EXTS.has(ext) });
  }

  function extractDefs(filePath, src) {
    const ext = path.extname(filePath).toLowerCase();
    if (JS_EXTS.has(ext)) return jsDefs(maskJs(src, { js: true }));
    if (PY_EXTS.has(ext)) return pyDefs(maskPy(src));
    if (JAVA_EXTS.has(ext)) return javaDefs(maskJs(src));
    if (GO_EXTS.has(ext)) return goDefs(maskJs(src));
    if (RS_EXTS.has(ext)) return rustDefs(maskRust(src));
    if (KT_EXTS.has(ext)) return ktDefs(maskJs(src));
    if (SCALA_EXTS.has(ext)) return scalaDefs(maskJs(src));
    return null; // unsupported language
  }

  // Collect `name(` call tokens within [start,end) of masked source.
  function callsInRange(masked, start, end) {
    const slice = masked.slice(start, end);
    const names = new Set();
    const re = /([A-Za-z_$][\w$]*)\s*\(/g;
    let m;
    while ((m = re.exec(slice)) !== null) {
      // skip a `.name(` method access — resolved separately via receiverCallsInRange
      const before = slice[m.index - 1];
      if (before === '.') continue;
      if (!NON_CALL.has(m[1])) names.add(m[1]);
    }
    return names;
  }

  // Collect `receiver.method(` pairs within [start,end). A chained or computed
  // receiver (`a.b().c(`, `arr[0].c(`) is skipped: only a plain identifier can be
  // looked up in the declaration map, and guessing is worse than no edge.
  function receiverCallsInRange(masked, start, end) {
    const slice = masked.slice(start, end);
    const out = [];
    const re = /([A-Za-z_$][\w$]*)\s*\.\s*([A-Za-z_$][\w$]*)\s*\(/g;
    let m;
    while ((m = re.exec(slice)) !== null) {
      const before = slice[m.index - 1];
      if (before === '.' || before === ')' || before === ']') continue;
      if (NON_CALL.has(m[2])) continue;
      out.push({ receiver: m[1], method: m[2] });
    }
    return out;
  }

  // `private UserService userService;` / `UserService svc = new UserService();`
  // / `for (OmsOrderItem item : list)` → { userService: 'UserService', … }.
  // Declarations only: a bare assignment carries no type and is not inferred.
  const DECL_RE = /(?:^|[;{}(,\n])\s*(?:(?:public|private|protected|static|final|volatile|transient)\s+)*([A-Z][\w$]*)(?:\s*<[^>;=(){}]*>)?(?:\s*\[\s*\])?\s+([a-z_$][\w$]*)\s*(?=[;=:)])/g;

  function buildTypeMap(masked) {
    const map = new Map();
    let m;
    DECL_RE.lastIndex = 0;
    while ((m = DECL_RE.exec(masked)) !== null) {
      const [, type, name] = m;
      if (JVM_KEYWORDS.has(type) || JVM_KEYWORDS.has(name)) continue;
      if (!map.has(name)) map.set(name, type);   // first declaration wins — deterministic
    }
    return map;
  }

  // Type names that are never a user class, so never a resolvable receiver type.
  const JVM_KEYWORDS = new Set([
    'return', 'new', 'if', 'else', 'for', 'while', 'switch', 'case', 'throw', 'catch',
    'String', 'Integer', 'Long', 'Boolean', 'Double', 'Float', 'Object', 'List', 'Map',
    'Set', 'Collection', 'Optional', 'Override', 'Autowired', 'Resource', 'Deprecated',
  ]);

  // ── Public API ───────────────────────────────────────────────────────────────

  // Walk depth from each srcDir root (not from cwd). A Maven module reaches
  // `src/main/java/<group>/<artifact>/service/impl` nine directories down, so the
  // previous ceiling of 8 never saw the classes that own the method bodies.
  const DEFAULT_WALK_DEPTH = 12;

  function _walk(dir, excludeSet, out, depth, maxDepth) {
    if (depth > (maxDepth === undefined ? DEFAULT_WALK_DEPTH : maxDepth)) return;
    let entries;
    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
    for (const e of entries) {
      if (excludeSet.has(e.name) || e.name.startsWith('.')) continue;
      const full = path.join(dir, e.name);
      if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1, maxDepth);
      else if (e.isFile()) {
        if (CALL_GRAPH_EXTS.has(path.extname(e.name).toLowerCase())) out.push(full);
      }
    }
  }

  /**
   * Build the method-level call-graph for a project.
   *
   * @param {string} cwd
   * @param {object} [opts]
   * @param {string[]} [opts.srcDirs=['src','app','lib']]
   * @param {string[]} [opts.exclude]
   * @param {string[]} [opts.files]  explicit absolute file list (skips the walk)
   * @returns {{
   *   forward: Map<string,string[]>,   // callerId → calleeIds
   *   reverse: Map<string,string[]>,   // calleeId → callerIds
   *   defs:    Map<string,{file:string,name:string,line:number}>
   * }}
   */
  function buildCallGraph(cwd, opts = {}) {
    let files = opts.files ? opts.files.map((f) => path.resolve(f)) : [];
    let srcDirs = opts.srcDirs;
    let exclude = opts.exclude;
    if (!opts.files) {
      // Same resolution as the dependency graph (#560, #934): explicit opts →
      // the project's own config → the source roots detection chose plus the
      // historical defaults. Without the last step this is empty on any repo
      // whose sources are not under src/app/lib — and so is `--callers`.
      if (srcDirs == null) {
        const dirs = resolveGraphDirs(cwd, ['src', 'app', 'lib']);
        srcDirs = dirs.srcDirs;
        if (exclude == null && dirs.exclude) exclude = dirs.exclude;
      }
    }
    const excludeSet = new Set(exclude || ['node_modules', '.git', 'dist', 'build', 'coverage', 'vendor']);
    if (!opts.files) {
      for (const sd of srcDirs) {
        const abs = path.resolve(cwd, sd);
        if (fs.existsSync(abs)) _walk(abs, excludeSet, files, 0, opts.maxDepth);
      }
      // Roots may nest (`.` beside `src`); a file is one node however often the
      // walk reached it.
      files = [...new Set(files)];
    }

    // File-level import graph (for precise call-site resolution). Keys normalized.
    let fileGraph;
    try { fileGraph = build(files, cwd); } catch (_) { fileGraph = { forward: new Map() }; }

    // Per-file definitions + name→file lookups.
    const perFileDefs = new Map();   // absFile → def[]
    const defsByName = new Map();     // absFile → Map<name, symbolId[]>
    const normToAbs = new Map();      // normalized abs → abs
    const defs = new Map();           // symbolId → {file,name,line}

    // JVM convention: a public type lives in a file of the same name. This is the
    // deterministic type→file mapping receiver resolution needs, with no AST.
    const fileByTypeName = new Map();   // 'UserService' → [absFile]
    for (const f of files) {
      const ext = path.extname(f).toLowerCase();
      if (JAVA_EXTS.has(ext)) {
        const base = path.basename(f, path.extname(f));
        if (!fileByTypeName.has(base)) fileByTypeName.set(base, []);
        fileByTypeName.get(base).push(f);
      }
    }

    // interface/superclass name → implementing files, for the Spring hop below.
    const implsByType = new Map();     // 'PaymentService' → [{ file, isBean, isPrimary }]
    for (const f of files) {
      if (!JAVA_EXTS.has(path.extname(f).toLowerCase())) continue;
      let decl;
      try { decl = javaTypeDecl(maskJs(fs.readFileSync(f, 'utf8'))); } catch (_) { continue; }
      if (!decl) continue;
      for (const sup of decl.supers) {
        if (!implsByType.has(sup)) implsByType.set(sup, []);
        implsByType.get(sup).push({ file: f, isBean: decl.isBean, isPrimary: decl.isPrimary });
      }
    }

    /**
     * The single implementing file for a type, or null when it is ambiguous.
     * One implementation resolves outright; several resolve only via @Primary.
     * Anything still ambiguous yields no edge — polymorphism is not guessed.
     */
    const soleImpl = (typeName) => {
      const cands = implsByType.get(typeName) || [];
      if (cands.length === 1) return cands[0].file;
      const primary = cands.filter((c) => c.isPrimary);
      if (primary.length === 1) return primary[0].file;
      return null;
    };

    // #768: a zero here means "no edge was found", not "no caller exists". The
    // two systematic blind spots are counted while scanning so the formatter can
    // say which, instead of asserting a safety property the graph cannot support.
    let dynamicLoads = 0;
    for (const f of files) {
      normToAbs.set(normalizePath(path.resolve(f)), path.resolve(f));
      let src;
      try { src = fs.readFileSync(f, 'utf8'); } catch (_) { continue; }
      dynamicLoads += countDynamicLoads(src);
      const fileDefs = extractDefs(f, src);
      if (!fileDefs) continue;
      perFileDefs.set(f, fileDefs);
      const byName = new Map();
      for (const d of fileDefs) {
        const id = symId(cwd, f, d.name);
        defs.set(id, { file: toRel(cwd, f), name: d.name, line: d.line });
        if (!byName.has(d.name)) byName.set(d.name, []);
        byName.get(d.name).push(id);
      }
      defsByName.set(f, byName);
    }

    const forward = new Map();
    const reverse = new Map();
    // Additive: `forward`/`reverse` keep their existing shape, so every current
    // consumer is unaffected. Confidence is looked up by "from\u0000to".
    const edgeConfidence = new Map();
    const addEdge = (from, to, confidence) => {
      if (from === to) return;
      if (!forward.has(from)) forward.set(from, new Set());
      forward.get(from).add(to);
      if (!reverse.has(to)) reverse.set(to, new Set());
      reverse.get(to).add(from);
      if (confidence) {
        const k = from + '\u0000' + to;
        // A 'high' resolution never loses to a later 'medium' one.
        if (edgeConfidence.get(k) !== 'high') edgeConfidence.set(k, confidence);
      }
    };

    for (const [f, fileDefs] of perFileDefs.entries()) {
      const masked = maskFor(f, fs.readFileSync(f, 'utf8'));
      // resolution scope: this file's defs, then directly-imported files' defs
      const importedAbs = (fileGraph.forward.get(normalizePath(path.resolve(f))) || [])
        .map((nf) => normToAbs.get(nf)).filter(Boolean);
      // Go/Java: same-package symbols are visible with no import statement, and
      // a package is (in practice) a directory — extend the scope to same-dir
      // same-language siblings. Sorted for deterministic resolution order.
      const ext = path.extname(f).toLowerCase();
      if (GO_EXTS.has(ext) || JAVA_EXTS.has(ext)) {
        const siblings = [...perFileDefs.keys()]
          .filter((o) => o !== f && path.dirname(o) === path.dirname(f) && path.extname(o).toLowerCase() === ext)
          .sort();
        importedAbs.push(...siblings);
      }
      // Receiver types come from declarations anywhere in the file: fields are
      // declared outside any method body, locals inside one.
      const typeMap = JAVA_EXTS.has(ext) ? buildTypeMap(masked) : null;
      // Types reachable from this file, by name — imports first, then same-package
      // siblings, so an import always wins over a coincidental sibling name.
      const scopeByTypeName = new Map();
      if (typeMap) {
        for (const imp of importedAbs) {
          const base = path.basename(imp, path.extname(imp));
          if (!scopeByTypeName.has(base)) scopeByTypeName.set(base, imp);
        }
      }

      for (const d of fileDefs) {
        const callerId = symId(cwd, f, d.name);
        if (!forward.has(callerId)) forward.set(callerId, new Set()); // ensure node exists
        const callees = callsInRange(masked, d.bodyStart, d.bodyEnd);
        for (const nm of callees) {
          const local = (defsByName.get(f) || new Map()).get(nm);
          if (local && local.length) { for (const id of local) addEdge(callerId, id, 'high'); continue; }
          for (const imp of importedAbs) {
            const ids = (defsByName.get(imp) || new Map()).get(nm);
            if (ids && ids.length) { for (const id of ids) addEdge(callerId, id, 'high'); break; }
          }
        }

        // `receiver.method(` — resolve the receiver's declared type to a file.
        if (!typeMap) continue;
        for (const { receiver, method } of receiverCallsInRange(masked, d.bodyStart, d.bodyEnd)) {
          // A receiver that is itself a type name is a static call: `Foo.bar()`.
          const typeName = typeMap.get(receiver)
            || (fileByTypeName.has(receiver) ? receiver : null);
          if (!typeName) continue;                 // unknown receiver → no edge, never a guess

          let target = scopeByTypeName.get(typeName);
          let confidence = 'high';                 // typed receiver, resolved in scope
          if (!target) {
            const candidates = fileByTypeName.get(typeName) || [];
            if (candidates.length !== 1) continue; // ambiguous or absent → no edge
            target = candidates[0];
            confidence = 'medium';                 // type known, but not in this file's scope
          }
          const ids = (defsByName.get(target) || new Map()).get(method);
          if (ids && ids.length) for (const id of ids) addEdge(callerId, id, confidence);

          // Spring: the call names the interface, but the code that runs — and
          // that a reviewer changes — lives in the implementation. Both edges are
          // true, so both are recorded; without the second, blast radius on an
          // implementation is empty.
          const implFile = soleImpl(typeName);
          if (implFile && implFile !== target) {
            const implIds = (defsByName.get(implFile) || new Map()).get(method);
            if (implIds && implIds.length) for (const id of implIds) addEdge(callerId, id, confidence);
          }
        }
      }
    }

    const toArr = (mapOfSets) => {
      const out = new Map();
      for (const [k, set] of mapOfSets.entries()) out.set(k, [...set]);
      return out;
    };
    const scopeRoots = opts.files ? ['(explicit file list)'] : srcDirs;
    return {
      forward: toArr(forward), reverse: toArr(reverse), defs, edgeConfidence,
      scope: { roots: scopeRoots, files: files.length, dynamicLoads },
      // The exclusions this walk used, so "what was not searched" (#979) counts
      // the same tree. Beside `scope`, not in it: `scope` is printed in --json.
      exclude: [...excludeSet],
    };
  }

  /**
   * Collapse the symbol-level call-graph to FILE-level bidirectional edges for
   * the ranker's neighbor boost (opt-in via `retrieval.callGraphBoost`). A file
   * whose functions call into — or are called by — another file gets an edge in
   * both directions. Keys are `path.resolve`-form absolute paths (matching the
   * ranker's lookups); entries and neighbor lists are sorted for determinism.
   *
   * @param {string} cwd
   * @param {object} [opts] { graph } to inject a prebuilt call graph (tests)
   * @returns {{ forward: Map<string,string[]> }}
   */
  function buildCallFileGraph(cwd, opts = {}) {
    const graph = opts.graph || buildCallGraph(cwd, opts);
    const edges = new Map(); // absFile → Set<absFile>
    const add = (a, b) => {
      if (a === b) return;
      if (!edges.has(a)) edges.set(a, new Set());
      edges.get(a).add(b);
    };
    for (const [callerId, calleeIds] of graph.forward.entries()) {
      const callerDef = graph.defs.get(callerId);
      if (!callerDef) continue;
      for (const calleeId of calleeIds) {
        const calleeDef = graph.defs.get(calleeId);
        if (!calleeDef || calleeDef.file === callerDef.file) continue;
        // Keyed through graphKey so the file-level call graph shares ONE key space
        // with the import graph. Previously this kept case while builder.js
        // lowercased, so a lookup correct for one silently missed on the other.
        const a = graphKey(path.resolve(cwd, callerDef.file));
        const b = graphKey(path.resolve(cwd, calleeDef.file));
        add(a, b);
        add(b, a);
      }
    }
    const forward = new Map();
    for (const k of [...edges.keys()].sort()) forward.set(k, [...edges.get(k)].sort());
    return { forward };
  }

  // The result for a symbol the call graph does not know. `untracked` is added
  // only when the symbol is declared in a language the graph cannot read, so a
  // genuinely unknown symbol's result is the shape it always was (#979).
  function _unresolved(symbol, cwd, scope, exclude) {
    const result = { symbol, resolved: [], direct: [], transitive: [], total: 0, unresolved: true, scope };
    const untracked = _untrackedDeclaration(symbol, cwd);
    if (untracked) { result.untracked = untracked; return result; }
    // Not in the signature index either — which proves little: the index keeps
    // 200 signatures per file at most (25 before #982), so a method of a very large
    // class is absent from it, and so is one in a file outside the detected roots.
    // Say what the search could not read, in the roots it searched.
    if (scope && Array.isArray(scope.roots) && scope.roots.length) {
      try {
        const { censusUntracked } = __require('./src/graph/language-support');
        const census = censusUntracked(cwd, {
          srcDirs: scope.roots, exts: CALL_GRAPH_EXTS, exclude,
        });
        if (census.untracked > 0) {
          result.unsearched = { files: census.untracked, languages: census.languages.map((l) => ({ language: l.label, files: l.files })) };
        }
      } catch (_) { /* the census is advice; a failure leaves the plain answer */ }
    }
    return result;
  }

  // Resolve a user-supplied symbol (bare name or full `file#name` id) to ids.
  function _resolveSymbol(symbol, defs) {
    if (defs.has(symbol)) return [symbol];
    const ids = [];
    for (const id of defs.keys()) if (id.slice(id.indexOf('#') + 1) === symbol) ids.push(id);
    return ids;
  }

  // BFS over a graph map from seed ids up to maxDepth (0 = unlimited).
  function _bfs(seedIds, graph, maxDepth) {
    const direct = new Set();
    const transitive = new Set();
    const visited = new Set(seedIds);
    let frontier = [];
    for (const s of seedIds) for (const nb of (graph.get(s) || [])) if (!visited.has(nb)) { direct.add(nb); visited.add(nb); frontier.push(nb); }
    let depth = 1;
    while (frontier.length && (maxDepth === 0 || depth < maxDepth)) {
      const next = [];
      for (const node of frontier) for (const nb of (graph.get(node) || [])) if (!visited.has(nb)) { transitive.add(nb); visited.add(nb); next.push(nb); }
      frontier = next; depth++;
    }
    return { direct: [...direct], transitive: [...transitive] };
  }

  // Whether a signature declares `name`: the identifier that ends its head (the
  // text before the parameter list, a base-class clause or a body). `public
  // static function slug($t)` and `class Str extends Base` both declare; a
  // signature that merely mentions the name as a parameter or a type does not.
  function _declaresName(sig, name) {
    const head = String(sig).replace(/\s*:\d+(?:-\d+)?\s*$/, '')
      .split(/[({:<]|\s+(?:extends|implements|inherits|with|where)\b/)[0];
    const ids = head.match(/[A-Za-z_$][\w$]*/g);
    return !!ids && ids[ids.length - 1] === name;
  }

  /**
   * Where an unresolved symbol is declared in a language the call graph cannot
   * read (#979). The signature index covers every language the extractors read;
   * the call graph walks only `CALL_GRAPH_FAMILIES`, so a PHP method is "not
   * found" there for a reason the caller deserves to hear. Null when the symbol
   * is not in the index either (or there is no index): then it really is unknown.
   *
   * @returns {{ language: string, files: string[] }|null}
   */
  function _untrackedDeclaration(symbol, cwd) {
    try {
      const { callGraphSupport } = __require('./src/graph/language-support');
      const hash = symbol.indexOf('#');
      if (hash !== -1) {
        // `file#name` is only a file when one exists: `Service#save` and
        // `com.acme.Service#save` are class-qualified names, not paths.
        const file = symbol.slice(0, hash);
        if (!file || !fs.existsSync(path.resolve(cwd, file))) return null;
        const s = callGraphSupport(file);
        return s.tracked ? null : { language: s.label, files: [file] };
      }
      const index = __require('./src/retrieval/ranker').buildSigIndex(cwd, { full: true }); // a declaration past what the ranker reads still counts (#982)
      const files = [];
      const labels = new Set();
      for (const [file, sigs] of index) {
        const s = callGraphSupport(file);
        if (s.tracked || !sigs.some((sig) => _declaresName(sig, symbol))) continue;
        files.push(String(file).replace(/\\/g, '/'));
        labels.add(s.label);
      }
      if (!files.length) return null;
      return { language: [...labels].sort().join(', '), files: files.sort().slice(0, 3) };
    } catch (_) {
      return null;
    }
  }

  /**
   * Method-level blast radius: everything that (transitively) calls `symbol`.
   *
   * @param {string} symbol  bare name or `file#name`
   * @param {string} cwd
   * @param {object} [opts]  { depth=0, ...buildCallGraph opts }
   * @returns {{ symbol:string, resolved:string[], direct:string[], transitive:string[], total:number, unresolved:boolean }}
   */
  function methodImpact(symbol, cwd, opts = {}) {
    const graph = opts.graph || buildCallGraph(cwd, opts);
    const ids = _resolveSymbol(symbol, graph.defs);
    const scope = graph.scope || null;
    if (ids.length === 0) return _unresolved(symbol, cwd, scope, graph.exclude);
    const { direct, transitive } = _bfs(ids, graph.reverse, opts.depth || 0);
    return { symbol, resolved: ids, direct, transitive, total: direct.length + transitive.length, unresolved: false, scope };
  }

  /**
   * Module loads the import graph cannot follow, per file.
   *
   * Two forms, both common in this codebase: a `require()` whose argument is not
   * a static string literal, and the bundle-safe wrappers (`requireSourceOrBundled`,
   * `__require`) that take a literal but are invisible to a resolver looking for
   * `require`/`import`. Each one is a caller edge that may exist and was not seen.
   */
  function countDynamicLoads(src) {
    if (!src) return 0;
    let n = 0;
    const dynamicRequire = /\brequire\s*\(\s*(?!['"`])/g;
    const wrappers = /\b(?:requireSourceOrBundled|__require)\s*\(/g;
    while (dynamicRequire.exec(src)) n++;
    while (wrappers.exec(src)) n++;
    return n;
  }

  /**
   * What `symbol` (transitively) calls.
   * @returns {{ symbol:string, resolved:string[], direct:string[], transitive:string[], total:number, unresolved:boolean }}
   */
  function methodCallees(symbol, cwd, opts = {}) {
    const graph = opts.graph || buildCallGraph(cwd, opts);
    const ids = _resolveSymbol(symbol, graph.defs);
    const scope = graph.scope || null;
    if (ids.length === 0) return _unresolved(symbol, cwd, scope, graph.exclude);
    const { direct, transitive } = _bfs(ids, graph.forward, opts.depth || 0);
    return { symbol, resolved: ids, direct, transitive, total: direct.length + transitive.length, unresolved: false, scope };
  }

  // ── Formatters ───────────────────────────────────────────────────────────────
  /**
   * What the search actually covered, as a human clause (#768).
   *
   * `--callers` printed `zero method blast radius` — an affirmative safety claim
   * — for symbols that are demonstrably called, because the graph walks srcDirs
   * only and cannot follow dynamic module loads. It could not distinguish "no
   * caller exists" from "no edge was found here", and that is precisely the
   * claim a developer leans on before changing a signature. `--impact` already
   * labels itself a lower bound; this brings the stronger claim into line.
   */
  function _scopeClause(scope) {
    if (!scope) return 'lower bound — out-of-scope and dynamically-loaded callers are not resolved';
    const roots = (scope.roots || []).join(', ') || 'the configured source roots';
    const parts = [`searched ${roots}`];
    if (scope.files) parts.push(`${scope.files} file(s)`);
    let clause = `lower bound — ${parts.join(', ')}`;
    if (scope.dynamicLoads > 0) {
      clause += `; ${scope.dynamicLoads} dynamic module load(s) could not be followed`;
    }
    return clause;
  }

  function formatCallGraph(result, kind) {
    const verb = kind === 'callees' ? 'calls' : 'callers of';
    const lines = [`## ${kind === 'callees' ? 'Callees' : 'Callers'}: \`${result.symbol}\``, ''];
    if (result.unresolved) {
      lines.push('_symbol not found in the call-graph._');
      if (result.untracked) {
        const { callNote } = __require('./src/graph/language-support');
        lines.push('', `_${callNote(result.untracked.language, result.untracked.files)}_`);
      } else if (result.unsearched) {
        const { unsearchedNote } = __require('./src/graph/language-support');
        lines.push('', `_${unsearchedNote(result.unsearched)}_`);
      }
      return lines.join('\n');
    }
    const qualifier = _scopeClause(result.scope);
    if (result.total === 0) {
      lines.push(kind === 'callees'
        ? `_no repo-defined callee found (${qualifier})._`
        : `_no caller found (${qualifier})._`);
      return lines.join('\n');
    }
    lines.push(`**Total ${verb}:** ${result.total} _(${qualifier})_`, '');
    if (result.direct.length) { lines.push(`### Direct`); for (const id of result.direct) lines.push(`- \`${id}\``); lines.push(''); }
    if (result.transitive.length) { lines.push(`### Transitive`); for (const id of result.transitive) lines.push(`- \`${id}\``); lines.push(''); }
    return lines.join('\n');
  }

  function formatCallGraphJSON(result, kind) {
    const out = {
      symbol: result.symbol,
      kind: kind === 'callees' ? 'callees' : 'callers',
      resolved: result.resolved,
      direct: result.direct,
      transitive: result.transitive,
      total: result.total,
      unresolved: result.unresolved,
      // The same qualification the human output carries, so a machine consumer
      // cannot read an unqualified zero either (#768).
      lowerBound: true,
      scope: result.scope || null,
    };
    // Present only for a symbol declared in a language the call graph cannot
    // read, so every other result keeps its shape (#979).
    if (result.untracked) {
      out.graph = __require('./src/graph/language-support').UNSUPPORTED;
      out.language = result.untracked.language;
      out.declaredIn = result.untracked.files;
    }
    // A symbol the call graph does not know, in roots that hold files it cannot read.
    if (result.unsearched) out.unsearched = result.unsearched;
    return out;
  }

  /**
   * `buildCallFileGraph` as the RANKER's opt-in call-neighbour boost has always
   * seen it: the project's pinned srcDirs, else `src app lib`. The detected roots
   * are for the blast-radius surfaces; what ranking is handed waits on #935 (see
   * `buildRankingGraph` in builder.js for the measurement).
   */
  function buildRankingCallFileGraph(cwd, opts = {}) {
    if (opts.srcDirs != null || opts.files) return buildCallFileGraph(cwd, opts);
    return buildCallFileGraph(cwd, Object.assign({}, opts, { srcDirs: configuredSrcDirs(cwd) || ['src', 'app', 'lib'] }));
  }

  module.exports = {
    buildCallGraph, buildTypeMap, receiverCallsInRange, javaTypeDecl, DEFAULT_WALK_DEPTH, buildCallFileGraph, buildRankingCallFileGraph, methodImpact, methodCallees,
    formatCallGraph, formatCallGraphJSON,
    extractDefs, maskJs, maskPy, maskRust,
    CALL_GRAPH_FAMILIES, CALL_GRAPH_EXTS,
  };
  
};

// ── ./src/graph/centrality ──
__factories["./src/graph/centrality"] = function(module, exports) {
  
  /**
   * Zero-dependency import-graph centrality (Semantic Bridge II, B3).
   *
   * Power iteration over the forward dependency graph: rank flows from each
   * importer to the files it imports, so heavily-referenced files accumulate
   * centrality and one-off helpers do not. Deterministic — fixed damping,
   * fixed iteration count, nodes processed in sorted order.
   *
   * The result feeds the opt-in `retrieval.centralityBlend` ranking prior
   * (see src/retrieval/ranker.js) — a principled deepening of the existing
   * graph-boost idea, not a replacement for query relevance.
   */

  const DAMPING = 0.85;
  const ITERATIONS = 20;

  /**
   * Compute a normalized centrality score for every file in a dependency graph.
   *
   * @param {{ forward: Map<string, string[]> }} graph - forward dependency graph
   *        (file → files it imports), as built by src/graph/builder.js
   * @returns {Map<string, number>} file → centrality in (0, 1], max-normalized;
   *          empty Map when the graph is missing or empty
   */
  function computeCentrality(graph) {
    if (!graph || !(graph.forward instanceof Map) || graph.forward.size === 0) return new Map();

    const nodes = new Set(graph.forward.keys());
    for (const deps of graph.forward.values()) {
      for (const dep of deps || []) nodes.add(dep);
    }
    const nodeList = [...nodes].sort();
    const n = nodeList.length;
    const indexOf = new Map(nodeList.map((file, i) => [file, i]));
    const outLinks = nodeList.map((file) =>
      (graph.forward.get(file) || []).map((dep) => indexOf.get(dep)).filter((i) => i !== undefined));

    let ranks = new Array(n).fill(1 / n);
    for (let iter = 0; iter < ITERATIONS; iter++) {
      const next = new Array(n).fill((1 - DAMPING) / n);
      let dangling = 0;
      for (let i = 0; i < n; i++) {
        if (outLinks[i].length === 0) { dangling += ranks[i]; continue; }
        const share = (DAMPING * ranks[i]) / outLinks[i].length;
        for (const j of outLinks[i]) next[j] += share;
      }
      // Dangling mass (files that import nothing) is redistributed uniformly.
      const danglingShare = (DAMPING * dangling) / n;
      for (let i = 0; i < n; i++) next[i] += danglingShare;
      ranks = next;
    }

    // A loop, not `Math.max(...ranks)`: one argument per file overflows the
    // stack past ~125k files (#855).
    let max = 0;
    for (const r of ranks) if (r > max) max = r;
    max = max || 1;
    const result = new Map();
    for (let i = 0; i < n; i++) result.set(nodeList[i], ranks[i] / max);
    return result;
  }

  module.exports = { computeCentrality, DAMPING, ITERATIONS };
  
};

// ── ./src/graph/impact ──
__factories["./src/graph/impact"] = function(module, exports) {
  
  /**
   * Impact radius calculator (v2.5).
   *
   * Given a changed file and a dependency graph, finds every file that
   * transitively imports it using BFS. Handles circular dependencies safely.
   *
   * @module src/graph/impact
   */

  const path = require('path');
  const { buildFromCwd } = __require('./src/graph/builder');
  const { displayPath } = __require('./src/graph/path-key');
  const { markImpact, importNote, UNSUPPORTED } = __require('./src/graph/language-support');

  // Normalize paths for cross-platform consistency (same as in builder.js)
  function normalizePath(p) {
    return path.normalize(p).toLowerCase();
  }

  // ---------------------------------------------------------------------------
  // Core BFS traversal
  // ---------------------------------------------------------------------------

  /**
   * Walk the reverse graph from `startFile` using BFS up to `maxDepth` levels.
   * Returns separate sets for direct and transitive dependents.
   *
   * @param {string} startFile - absolute path of file that changed
   * @param {Map<string,string[]>} reverseGraph
   * @param {number} maxDepth  - 0 = unlimited
   * @returns {{ direct: Set<string>, transitive: Set<string> }}
   */
  function bfs(startFile, reverseGraph, maxDepth) {
    const direct     = new Set();
    const transitive = new Set();
    const visited    = new Set([startFile]);

    // Level 1 — direct importers
    const firstLevel = reverseGraph.get(startFile) || [];
    for (const f of firstLevel) {
      if (!visited.has(f)) {
        direct.add(f);
        visited.add(f);
      }
    }

    if (maxDepth === 1) return { direct, transitive };

    // BFS for deeper levels
    let frontier = [...direct];
    let depth = 1;

    while (frontier.length > 0 && (maxDepth === 0 || depth < maxDepth)) {
      const nextFrontier = [];
      for (const node of frontier) {
        const importers = reverseGraph.get(node) || [];
        for (const imp of importers) {
          if (!visited.has(imp)) {
            transitive.add(imp);
            visited.add(imp);
            nextFrontier.push(imp);
          }
        }
      }
      frontier = nextFrontier;
      depth++;
    }

    return { direct, transitive };
  }

  // ---------------------------------------------------------------------------
  // Helper: classify impacted files into tests / routes / other
  // ---------------------------------------------------------------------------

  const TEST_PATTERNS = [
    /[./\\](test|tests|spec|__tests__)[./\\]/,
    /\.(test|spec)\.[jt]sx?$/,
    /_test\.[jt]sx?$/,
    /_test\.py$/,
    /test_[^/\\]+\.py$/,
  ];

  const ROUTE_PATTERNS = [
    /router?\.[jt]sx?$/i,
    /routes?\.[jt]sx?$/i,
    /controller\.[jt]sx?$/i,
    /views?\.[jt]sx?$/i,
    /handlers?\.[jt]sx?$/i,
  ];

  function isTestFile(f)  { return TEST_PATTERNS.some((re) => re.test(f.replace(/\\/g, '/'))); }
  function isRouteFile(f) { return ROUTE_PATTERNS.some((re) => re.test(f.replace(/\\/g, '/'))); }

  // ---------------------------------------------------------------------------
  // Public API
  // ---------------------------------------------------------------------------

  /**
   * Compute the impact of changing `changedFile`.
   *
   * @param {string} changedFile - absolute or cwd-relative path
   * @param {{ forward: Map<string,string[]>, reverse: Map<string,string[]> }} graph
   * @param {object} [opts]
   * @param {number} [opts.depth=0]   - BFS depth limit (0 = unlimited)
   * @param {string} [opts.cwd]       - project root for relative path display
   * @returns {{
   *   changed:     string,
   *   direct:      string[],
   *   transitive:  string[],
   *   tests:       string[],
   *   routes:      string[],
   *   totalImpact: number
   * }}
   */
  function getImpact(changedFile, graph, opts) {
    const { depth = 0, cwd = process.cwd() } = opts || {};

    const absChangedReal = path.resolve(cwd, changedFile);
    const absChanged = normalizePath(absChangedReal);

    // Bail gracefully if file not in graph
    if (!graph || !graph.reverse) {
      return withModule(markImpact({ changed: changedFile, direct: [], transitive: [], tests: [], routes: [], totalImpact: 0 }, { cwd }), cwd);
    }

    const { direct, transitive } = bfs(absChanged, graph.reverse, depth);

    const allImpacted = [...direct, ...transitive];
    const tests  = allImpacted.filter(isTestFile);
    const routes = allImpacted.filter(isRouteFile);

    // BFS results are lowercased graph keys; render them through the graph's
    // original-case map so `/Users/...` checkouts do not climb out of cwd.
    // The changed file is caller-supplied, so its real spelling is known even
    // when it is absent from the graph (unindexed / no importers).
    const realPaths = new Map(graph.realPaths || []);
    if (!realPaths.has(absChanged)) realPaths.set(absChanged, absChangedReal);
    const toRel = (f) => displayPath(f, cwd, realPaths);

    // An empty result for a file the graph cannot read is "not tracked", not
    // "nothing depends on it" (#979); markImpact leaves every other result as is.
    return withModule(markImpact({
      changed:     toRel(absChanged),
      direct:      [...direct].map(toRel),
      transitive:  [...transitive].map(toRel),
      tests:       tests.map(toRel),
      routes:      routes.map(toRel),
      totalImpact: direct.size + transitive.size,
    }, { cwd }), cwd);
  }

  /**
   * Swift names modules, not files, so a Swift file has no file-level importers and is marked
   * "not tracked"; what is known is its module (#980). Attach the files in other targets that
   * import that module, labelled as module-level. Only a Swift file the graph could not read, and
   * only where a Package.swift declares the target that owns it.
   */
  function withModule(result, cwd) {
    if (!result || result.graph !== UNSUPPORTED || result.language !== 'Swift' || !cwd) return result;
    try {
      const m = __require('./src/graph/swift-modules').moduleImpact(cwd, path.resolve(cwd, result.changed));
      if (m) result.module = m;
    } catch (_) { /* module structure unreadable: the file-level answer stands */ }
    return result;
  }

  /**
   * Analyse the impact of one or more changed files, building the graph from cwd.
   * This is the high-level convenience function used by the CLI and MCP tool.
   *
   * @param {string|string[]} changedFiles
   * @param {string} cwd
   * @param {object} [opts]
   * @param {number} [opts.depth=3]
   * @param {string[]} [opts.srcDirs]
   * @param {string[]} [opts.exclude]
   * @returns {{ file: string, impact: object }[]}
   */
  function analyzeImpact(changedFiles, cwd, opts) {
    const { depth = 3 } = opts || {};
    const files = Array.isArray(changedFiles) ? changedFiles : [changedFiles];

    let graph;
    try {
      graph = buildFromCwd(cwd, opts);
    } catch (_) {
      graph = { forward: new Map(), reverse: new Map() };
    }

    return files.map((f) => ({
      file: f,
      impact: getImpact(f, graph, { depth, cwd }),
    }));
  }

  // ---------------------------------------------------------------------------
  // Formatting helpers
  // ---------------------------------------------------------------------------

  /**
   * Format an impact result as a readable markdown string.
   *
   * @param {object} result - return value of getImpact()
   * @returns {string}
   */
  function formatImpact(result) {
    const lines = [];
    lines.push(`## Impact: \`${result.changed}\``);
    lines.push('');

    if (result.graph === UNSUPPORTED) {
      lines.push(`_${importNote(result.language)}_`);
      if (result.module) {
        const m = result.module;
        lines.push('');
        lines.push(`### Module-level importers (module \`${m.module}\`, target \`${m.dir}\`)`);
        lines.push(`**${m.importers.length}** file(s) in other targets import this file's module _(module level: a superset of what changing this file affects)_`);
        for (const f of m.importers.slice(0, 25)) lines.push(`- \`${f}\``);
        if (m.importers.length > 25) lines.push(`- _…and ${m.importers.length - 25} more_`);
      }
      return lines.join('\n');
    }

    if (result.direct.length === 0 && result.transitive.length === 0) {
      lines.push('_No importers found via relative + aliased imports (lower bound — dynamic/computed imports are not tracked)._');
      return lines.join('\n');
    }

    lines.push(`**Total impacted files:** ${result.totalImpact} _(lower bound — resolves relative + tsconfig/jsconfig-aliased imports)_`);
    lines.push('');

    if (result.direct.length > 0) {
      lines.push('### Direct importers');
      for (const f of result.direct) lines.push(`- \`${f}\``);
      lines.push('');
    }

    if (result.transitive.length > 0) {
      lines.push('### Transitive importers');
      for (const f of result.transitive) lines.push(`- \`${f}\``);
      lines.push('');
    }

    if (result.tests.length > 0) {
      lines.push('### Affected tests');
      for (const f of result.tests) lines.push(`- \`${f}\``);
      lines.push('');
    }

    if (result.routes.length > 0) {
      lines.push('### Affected routes / controllers');
      for (const f of result.routes) lines.push(`- \`${f}\``);
      lines.push('');
    }

    return lines.join('\n');
  }

  /**
   * Format an impact result as a JSON-serialisable object.
   *
   * @param {object} result - return value of getImpact()
   * @returns {object}
   */
  function formatImpactJSON(result) {
    const out = {
      changed:     result.changed,
      direct:      result.direct,
      transitive:  result.transitive,
      tests:       result.tests,
      routes:      result.routes,
      totalImpact: result.totalImpact,
    };
    // Present only when the graph cannot read the file, so a readable file's
    // JSON is the shape it always was (#979).
    if (result.graph === UNSUPPORTED) { out.graph = result.graph; out.language = result.language; }
    if (result.module) out.module = result.module;
    return out;
  }

  module.exports = { getImpact, analyzeImpact, formatImpact, formatImpactJSON, isTestFile, isRouteFile };
  
};

// ── ./src/graph/import-resolvers ──
__factories["./src/graph/import-resolvers"] = function(module, exports) {
  
  /**
   * Import resolvers for the languages added to the import graph in #980: C/C++/Objective-C,
   * PHP, C#, Dart, Vue/Svelte/Astro, Lua and GDScript. `builder.js` builds `GRAPH_FAMILIES`
   * from `FAMILIES` and dispatches on extension, so a family listed here is walked, resolved
   * and reported as tracked by `--impact`, `get_impact`, `plan` and `doctor`.
   *
   * Each family is a section below with `name`, `EXTS` and either `extract(filePath, content,
   * fileSet, cwd, ctx)`, which returns graph keys, or (single-file components) `scriptOf`,
   * which returns the script the JS/TS resolver then reads. The rule every one keeps is
   * precision first: an import that cannot be resolved to exactly one file of the repository
   * yields no edge (an external package, a system header, a commented-out import, an ambiguous
   * name), and what a language does not count as an import is not an edge.
   *
   * One file and not one per language on purpose: this repository scores its own retrieval
   * against its own source, and every indexed file shifts that score (see the gate's comments),
   * so the footprint of a feature is part of its cost. Swift is in swift-modules.js: it names
   * modules, not files, and draws no file-level edge.
   *
   * Zero-dependency, bundle-safe.
   *
   * @module src/graph/import-resolvers
   */

  const fs = require('fs');
  const path = require('path');
  const { graphKey } = __require('./src/graph/path-key');
  const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');

  // ── shared ───────────────────────────────────────────────────────────────────

  /** Walk bound for any search up a directory chain. */
  const MAX_UP = 24;

  /**
   * Directories from `dir` up to and including `cwd`, nearest first. When `dir` is
   * not below `cwd` the chain still ends (at the filesystem root, or after MAX_UP).
   * @param {string} dir
   * @param {string} [cwd]
   * @returns {string[]} absolute directories
   */
  function ancestorDirs(dir, cwd) {
    const out = [];
    const stop = cwd ? graphKey(path.resolve(cwd)) : null;
    let d = path.resolve(dir);
    for (let i = 0; i < MAX_UP; i++) {
      out.push(d);
      if (stop && graphKey(d) === stop) break;
      const parent = path.dirname(d);
      if (parent === d) break;
      d = parent;
    }
    return out;
  }

  const _memo = new WeakMap();

  /**
   * Build something once per file set. The set the graph hands a resolver is made
   * once per build, so keying on it gives one index per build with no plumbing.
   * @template T
   * @param {Set<string>} fileSet
   * @param {string} name
   * @param {() => T} make
   * @returns {T}
   */
  function perBuild(fileSet, name, make) {
    let m = _memo.get(fileSet);
    if (!m) { m = new Map(); _memo.set(fileSet, m); }
    if (!m.has(name)) m.set(name, make());
    return m.get(name);
  }

  /** The text of a file, or '' when it cannot be read. */
  function readText(file) {
    try { return fs.readFileSync(file, 'utf8'); } catch (_) { return ''; }
  }

  /** A graph key's real path: the build's own map when it has one, else the key. */
  function realPathOf(ctx, key) {
    return (ctx && ctx.realPaths && ctx.realPaths.get(key)) || key;
  }

  /** True when `abs` is a file of the set; returns its key, else null. */
  function inSet(fileSet, abs) {
    const k = graphKey(abs);
    return fileSet.has(k) ? k : null;
  }

  /** Cache a directory-existence probe: one stat per directory per process. */
  const _exists = new Map();
  function dirHas(dir, name) {
    const k = dir + '\u0000' + name;
    if (!_exists.has(k)) {
      let ok = false;
      try { ok = fs.existsSync(path.join(dir, name)); } catch (_) { ok = false; }
      _exists.set(k, ok);
    }
    return _exists.get(k);
  }

  // ── C / C++ / Objective-C ─────────────────────────────────────────────────

  const c = (() => {
    /**
     * C / C++ / Objective-C includes (#980).
     *
     * `#include "x.h"` and `#import "x.h"` are searched the way a compiler searches them:
     * next to the including file first, then the include roots. `#include <x.h>` skips
     * the first step (it is not searched next to the file) and an angle-bracket header
     * that is not in the repository (`<stdio.h>`, `<vector>`) misses the file set and
     * yields no edge, so system headers need no list. Header-only libraries include their
     * own headers with angle brackets (`<spdlog/common.h>`); those resolve through the
     * roots exactly like a quoted one.
     *
     * Include roots, in order, for every directory from the including file up to the project
     * root. A quoted include tries the directory itself, its `include/` and its `src/`. An
     * angle-bracket include tries only `include/`, and the project root itself and its `src/`
     * when the path has a directory part (`<proj/x.h>`), so a repository file that happens to be
     * called `string.h` never answers `<string.h>`. If no root hits, a path with a directory part
     * (`uv/unix.h`) resolves when exactly one file of the repository ends with it; two candidates
     * are ambiguous and yield nothing.
     *
     * An include inside a comment is not an include (comments are blanked first), and an
     * include under `#if` still counts: the edge says "can include", the same
     * over-approximation the other languages' resolvers make.
     *
     * @module src/graph/import-resolvers (c)
     */


    const EXTS = new Set([
      '.c', '.h', '.cc', '.cpp', '.cxx', '.c++', '.hh', '.hpp', '.hxx', '.h++',
      '.inl', '.ipp', '.tpp', '.m', '.mm',
    ]);

    const QUOTED_SUBS = ['', 'include', 'src'];

    /** file name -> keys carrying it, for the unique-suffix step. */
    function byName(fileSet) {
      return perBuild(fileSet, 'c:byName', () => {
        const m = new Map();
        for (const k of fileSet) {
          const base = k.slice(k.lastIndexOf(path.sep) + 1);
          const a = m.get(base);
          if (a) a.push(k); else m.set(base, [k]);
        }
        return m;
      });
    }

    function resolve(spec, quoted, dir, selfKey, fileSet, cwd) {
      if (!spec || path.isAbsolute(spec)) return null;
      const rel = spec.replace(/\\/g, '/');
      if (rel.split('/').includes('..') && !quoted) return null; // an angle include never climbs

      const root = cwd ? graphKey(path.resolve(cwd)) : null;
      const slashed = rel.includes('/');
      for (const a of ancestorDirs(dir, cwd)) {
        const atRoot = root !== null && graphKey(a) === root;
        const subs = quoted ? QUOTED_SUBS : (slashed && atRoot ? QUOTED_SUBS : ['include']);
        for (const sub of subs) {
          const k = inSet(fileSet, path.resolve(a, sub, rel));
          if (k && k !== selfKey) return k;
        }
      }
      if (slashed) {
        const tail = graphKey(rel);
        const cands = (byName(fileSet).get(path.basename(tail)) || []).filter((k) => k !== selfKey && k.endsWith(path.sep + tail));
        if (cands.length === 1) return cands[0];
      }
      return null;
    }

    const RE = /^[ \t]*#[ \t]*(?:include|import)[ \t]*(?:"([^"\n]+)"|<([^>\n]+)>)/gm;

    /**
     * @param {string} filePath  absolute path
     * @param {string} content
     * @param {Set<string>} fileSet  graph keys
     * @param {string} [cwd]
     * @returns {string[]} keys of the files this one includes
     */
    function extract(filePath, content, fileSet, cwd) {
      const text = stripComments(content);
      const dir = path.dirname(filePath);
      const self = graphKey(filePath);
      const out = [];
      RE.lastIndex = 0;
      let m;
      while ((m = RE.exec(text)) !== null) {
        const quoted = m[1] !== undefined;
        const hit = resolve((quoted ? m[1] : m[2]).trim(), quoted, dir, self, fileSet, cwd);
        if (hit) out.push(hit);
      }
      return out;
    }

    return { name: 'C/C++/Objective-C', EXTS, extract };
  })();

  // ── PHP ───────────────────────────────────────────────────────────────────

  const php = (() => {
    /**
     * PHP imports (#980): `use Ns\Class;` and literal `require` / `include`.
     *
     * A `use` names a class, not a file, so it goes through the autoloader the project
     * declares. `composer.json` `autoload` and `autoload-dev` `psr-4` map a namespace
     * prefix to one or more directories, and PSR-4 tries every prefix that matches, so
     * `Illuminate\Support\Str` is looked for under `Illuminate\Support\` first and under
     * `Illuminate\` after it (Laravel maps the first to four directories). When no PSR-4
     * path holds a file of the set, a class declared in the set under that exact
     * namespace and name is used instead (a layout with no mapping, or a package whose
     * own `composer.json` is not the root one). Two files declaring one name are
     * ambiguous and yield nothing.
     *
     * Only top-level `use` statements of classes, interfaces, traits and enums are
     * imports: `use function` and `use const` name no file (their clause does not parse as a
     * class name), `use ($x)` on a closure and
     * a trait `use` inside a class body are indented and not matched. A class used by its
     * fully qualified name with no `use` is not an import and is not an edge.
     *
     * `require` / `include` with a literal path resolve next to the file, or relative to
     * the project root; `__DIR__ . '/x.php'` and `dirname(__FILE__) . '/x.php'` are the
     * file's directory. A path built from a variable yields nothing.
     *
     * @module src/graph/import-resolvers (php)
     */


    const EXTS = new Set(['.php']);

    // ── composer.json ────────────────────────────────────────────────────────────

    const _composer = new Map(); // composer.json path -> { mtimeMs, map }

    /** `{ prefix: 'Illuminate\\Support\\', dirs: [abs...] }[]`, longest prefix first. */
    function psr4(cwd) {
      if (!cwd) return [];
      const file = path.join(cwd, 'composer.json');
      let st;
      try { st = fs.statSync(file); } catch (_) { return []; }
      const known = _composer.get(file);
      if (known && known.mtimeMs === st.mtimeMs) return known.map;

      let json = null;
      try { json = JSON.parse(readText(file)); } catch (_) { json = null; }
      const map = [];
      for (const section of ['autoload', 'autoload-dev']) {
        const table = json && json[section] && json[section]['psr-4'];
        if (!table || typeof table !== 'object') continue;
        for (const [prefix, target] of Object.entries(table)) {
          const dirs = (Array.isArray(target) ? target : [target])
            .filter((d) => typeof d === 'string')
            .map((d) => path.resolve(cwd, d));
          const p = prefix === '' ? '' : (prefix.endsWith('\\') ? prefix : prefix + '\\');
          map.push({ prefix: p, dirs });
        }
      }
      map.sort((a, b) => b.prefix.length - a.prefix.length);
      _composer.set(file, { mtimeMs: st.mtimeMs, map });
      return map;
    }

    // ── a name -> file index, for what PSR-4 does not reach ──────────────────────

    const DECL = /^[ \t]*(?:(?:abstract|final|readonly)[ \t]+)*(?:class|interface|trait|enum)[ \t]+([A-Za-z_]\w*)/gm;
    const NS = /^[ \t]*namespace[ \t]+([A-Za-z_][\w\\]*)[ \t]*[;{]/gm;

    function declaredIn(text) {
      const out = [];
      const spans = [];
      NS.lastIndex = 0;
      let m;
      while ((m = NS.exec(text)) !== null) spans.push({ at: m.index, name: m[1] });
      DECL.lastIndex = 0;
      while ((m = DECL.exec(text)) !== null) {
        let ns = '';
        for (const s of spans) if (s.at <= m.index) ns = s.name;
        out.push((ns ? ns + '\\' : '') + m[1]);
      }
      return out;
    }

    /** lowercased fully qualified name -> keys declaring it. */
    function classIndex(fileSet, ctx) {
      return perBuild(fileSet, 'php:classes', () => {
        const idx = new Map();
        for (const k of fileSet) {
          if (!k.endsWith('.php')) continue;
          const text = stripComments(readText(realPathOf(ctx, k)));
          for (const fq of declaredIn(text)) {
            const l = fq.toLowerCase();
            const a = idx.get(l);
            if (a) a.push(k); else idx.set(l, [k]);
          }
        }
        return idx;
      });
    }

    function resolveClass(fq, fileSet, cwd, ctx) {
      const name = fq.replace(/^\\/, '');
      if (!name) return null;
      for (const { prefix, dirs } of psr4(cwd)) {
        if (!name.startsWith(prefix)) continue;
        const rest = name.slice(prefix.length).replace(/\\/g, path.sep);
        if (!rest) continue;
        for (const d of dirs) {
          const k = inSet(fileSet, path.join(d, rest + '.php'));
          if (k) return k;
        }
      }
      const hits = classIndex(fileSet, ctx).get(name.toLowerCase());
      return hits && hits.length === 1 ? hits[0] : null;
    }

    // ── use statements ───────────────────────────────────────────────────────────

    /** Split on commas that are not inside braces. */
    function topLevelCommas(s) {
      const out = [];
      let depth = 0;
      let cur = '';
      for (const ch of s) {
        if (ch === '{') depth++;
        else if (ch === '}') depth--;
        if (ch === ',' && depth === 0) { out.push(cur); cur = ''; } else cur += ch;
      }
      if (cur.trim()) out.push(cur);
      return out;
    }

    /** The fully qualified class names one `use` clause imports. */
    function namesIn(clause) {
      const out = [];
      for (const item of topLevelCommas(clause)) {
        const t = item.trim();
        const group = /^\\?([A-Za-z_][\w\\]*)\\\{([^}]*)\}$/.exec(t.replace(/\s+/g, ' '));
        if (group) {
          for (const sub of group[2].split(',')) {
            const s = sub.trim().replace(/\s+as\s+\w+$/i, '');
            if (/^(function|const)\s/.test(s) || !s) continue;
            out.push(group[1] + '\\' + s);
          }
          continue;
        }
        const plain = /^\\?([A-Za-z_][\w\\]*)(?:\s+as\s+\w+)?$/.exec(t.replace(/\s+/g, ' '));
        if (plain) out.push(plain[1]);
      }
      return out;
    }

    const USE = /^use[ \t]+([^;]+);/gm;
    const INCLUDE = /\b(?:require|include)(?:_once)?[ \t]*\(?[ \t]*(?:(__DIR__|dirname[ \t]*\([ \t]*__FILE__[ \t]*\))[ \t]*\.[ \t]*)?(['"])([^'"$\n]+)\2/g;

    function extract(filePath, content, fileSet, cwd, ctx) {
      const text = stripComments(content);
      const out = [];
      let m;

      USE.lastIndex = 0;
      while ((m = USE.exec(text)) !== null) {
        for (const fq of namesIn(m[1])) {
          const hit = resolveClass(fq, fileSet, cwd, ctx);
          if (hit) out.push(hit);
        }
      }

      const dir = path.dirname(filePath);
      INCLUDE.lastIndex = 0;
      while ((m = INCLUDE.exec(text)) !== null) {
        const lit = m[3];
        const bases = m[1] || lit.startsWith('./') || lit.startsWith('../') ? [dir] : [dir, cwd].filter(Boolean);
        for (const b of bases) {
          const k = inSet(fileSet, path.resolve(b, lit.replace(/^\/(?=[^/])/, m[1] ? '' : '/')));
          if (k) { out.push(k); break; }
        }
      }
      return out.filter((k) => k !== graphKey(filePath));
    }

    return { name: 'PHP', EXTS, extract };
  })();

  // ── C# ────────────────────────────────────────────────────────────────────

  const csharp = (() => {
    /**
     * C# `using` directives (#980).
     *
     * A `using` names a namespace, and a namespace is many files, so resolving it to all
     * of them would link every file of `Serilog` to every other. An edge A -> B is drawn
     * only when A imports a namespace in which B declares a top-level type AND A mentions
     * that type's name as an identifier. A `partial` type declared across several files
     * links to all of its parts. `using static N.T;` and `using Alias = N.T;` name a type
     * directly and link to the files declaring it.
     *
     * The index (namespace -> top-level type name -> files) is built once per build from
     * the C# files of the set. Block `namespace N { }`, nested blocks and file-scoped
     * `namespace N;` are read, with strings and comments blanked first so a brace inside
     * either does not move the depth.
     *
     * `global using` applies to every file of the same project (the directory holding the
     * nearest `.csproj` above it). Types in the file's own namespace need no `using`; they
     * are implicit dependencies, not imports, and are not edges. A namespace that is not
     * declared in the set (`System.*`, a NuGet package) matches nothing.
     *
     * @module src/graph/import-resolvers (csharp)
     */


    const EXTS = new Set(['.cs']);

    const NS_OPEN = /\bnamespace\s+([A-Za-z_][\w.]*)\s*([;{])/y;

    /**
     * Declarations of a file: `{ ns, type }` for each top-level type, and every namespace
     * it declares. Walks the masked text once, tracking brace depth.
     */
    function scanDeclarations(masked) {
      const types = [];
      const nss = new Set();
      const stack = []; // block namespaces: { name, depth }
      let fileScoped = '';
      let depth = 0;
      const n = masked.length;
      for (let i = 0; i < n; i++) {
        const ch = masked[i];
        if (ch === '{') { depth++; continue; }
        if (ch === '}') {
          depth--;
          while (stack.length && stack[stack.length - 1].depth > depth) stack.pop();
          continue;
        }
        if (ch === 'n' && masked.startsWith('namespace', i) && /\W/.test(masked[i - 1] || ' ')) {
          NS_OPEN.lastIndex = i;
          const m = NS_OPEN.exec(masked);
          if (m) {
            const outer = stack.length ? stack[stack.length - 1].name : fileScoped;
            const full = outer ? outer + '.' + m[1] : m[1];
            nss.add(full);
            if (m[2] === ';') fileScoped = full;
            else { stack.push({ name: full, depth: depth + 1 }); }
            i += m[0].length - 1;
            if (m[2] === '{') depth++;
            continue;
          }
        }
        if (/[cseird]/.test(ch) && /\W/.test(masked[i - 1] || ' ')) {
          const kw = /^(?:class|struct|interface|enum|record(?:\s+(?:class|struct))?|delegate\s+[^\s(;{]+(?:\s*<[^>]*>)?)\s+([A-Za-z_]\w*)/.exec(masked.slice(i, i + 160));
          if (kw) {
            const ns = stack.length ? stack[stack.length - 1].name : fileScoped;
            const onTop = stack.length ? depth === stack[stack.length - 1].depth : depth === 0;
            if (ns && onTop) types.push({ ns, type: kw[1] });
            i += kw[0].length - 1;
          }
        }
      }
      return { types, nss };
    }

    /** Does a directory hold a `.csproj`? One listing per directory per process. */
    const _csproj = new Map();
    function hasCsproj(dir) {
      if (!_csproj.has(dir)) {
        let names = [];
        try { names = fs.readdirSync(dir); } catch (_) { /* unreadable: no project here */ }
        _csproj.set(dir, names.some((x) => x.endsWith('.csproj')));
      }
      return _csproj.get(dir);
    }

    /** Directory of the nearest `.csproj` above a file; '' when there is none. */
    function projectDirOf(file, cwd) {
      for (const a of ancestorDirs(path.dirname(file), cwd)) if (hasCsproj(a)) return a;
      return '';
    }

    /** { ns: Map<lcNamespace, Map<type, Set<key>>>, globals: Map<project dir, Set<lcNamespace>> } */
    function indexFor(fileSet, cwd, ctx) {
      return perBuild(fileSet, 'cs:index', () => {
        const ns = new Map();
        const globals = new Map(); // project dir -> Set<namespace>
        for (const k of fileSet) {
          if (!k.endsWith('.cs')) continue;
          const real = realPathOf(ctx, k);
          const masked = maskCode(readText(real));
          const { types } = scanDeclarations(masked);
          for (const { ns: n, type } of types) {
            const key = n.toLowerCase();
            if (!ns.has(key)) ns.set(key, new Map());
            const byType = ns.get(key);
            if (!byType.has(type)) byType.set(type, new Set());
            byType.get(type).add(k);
          }
          const g = /^[ \t]*global[ \t]+using[ \t]+(?!static\b)(?:\w+[ \t]*=[ \t]*)?([A-Za-z_][\w.]*)[ \t]*;/gm;
          let m;
          while ((m = g.exec(masked)) !== null) {
            const p = projectDirOf(real, cwd);
            if (!globals.has(p)) globals.set(p, new Set());
            globals.get(p).add(m[1].toLowerCase());
          }
        }
        return { ns, globals };
      });
    }

    const USING = /^[ \t]*(global[ \t]+)?using[ \t]+(static[ \t]+)?(?:([A-Za-z_]\w*)[ \t]*=[ \t]*)?([A-Za-z_][\w.]*)(?:<[^;>]*>)?[ \t]*;/gm;

    function extract(filePath, content, fileSet, cwd, ctx) {
      const idx = indexFor(fileSet, cwd, ctx);
      const self = graphKey(filePath);
      const masked = maskCode(content);

      const imported = new Set();   // namespaces whose types the file may use
      const direct = [];            // [namespace, type] named outright
      let m;
      USING.lastIndex = 0;
      while ((m = USING.exec(masked)) !== null) {
        const name = m[4];
        if (m[2] || m[3]) {                       // using static N.T;  using A = N.T;
          const dot = name.lastIndexOf('.');
          if (dot > 0) direct.push([name.slice(0, dot).toLowerCase(), name.slice(dot + 1)]);
        } else {
          imported.add(name.toLowerCase());
        }
      }
      const proj = projectDirOf(filePath, cwd);
      for (const g of idx.globals.get(proj) || []) imported.add(g);

      const out = new Set();
      for (const [n, t] of direct) {
        const files = idx.ns.get(n) && idx.ns.get(n).get(t);
        if (files) for (const f of files) if (f !== self) out.add(f);
      }
      if (imported.size) {
        const ids = new Set(masked.match(/[A-Za-z_]\w*/g) || []);
        for (const n of imported) {
          const byType = idx.ns.get(n);
          if (!byType) continue;
          for (const [type, files] of byType) {
            if (!ids.has(type)) continue;
            for (const f of files) if (f !== self) out.add(f);
          }
        }
      }
      return [...out];
    }

    return { name: 'C#', EXTS, extract };
  })();

  // ── Dart ──────────────────────────────────────────────────────────────────

  const dart = (() => {
    /**
     * Dart `import`, `export` and `part` (#980).
     *
     * `import 'x.dart'`, `export 'x.dart'` and `part 'x.g.dart'` resolve next to the file;
     * `part of 'x.dart'` points back at the library. `package:name/path.dart` resolves
     * through the packages the repository itself holds: a package is a directory with a
     * `pubspec.yaml`, its name is that file's `name:`, and its code is under `lib/`. So in
     * a monorepo `package:flutter_riverpod/x.dart` reaches `packages/flutter_riverpod/lib/x.dart`.
     * `dart:` libraries and packages that are not in the repository (`package:flutter/...`,
     * `package:test/...`) miss the set and yield nothing.
     *
     * A conditional import (`import 'a.dart' if (dart.library.io) 'a_io.dart';`) is one
     * statement with several possible targets; every one that is a file of the set is an
     * edge, because any of them can be the file that is compiled in.
     *
     * @module src/graph/import-resolvers (dart)
     */


    const EXTS = new Set(['.dart']);

    /** package name -> lib directory, for every pubspec.yaml above any file of the set. */
    function packages(fileSet, cwd, ctx) {
      return perBuild(fileSet, 'dart:packages', () => {
        const roots = new Set();
        const seen = new Set();
        for (const k of fileSet) {
          if (!k.endsWith('.dart')) continue;
          // a key is lowercased; the directories to look in are spelled as they are on disk
          for (const a of ancestorDirs(path.dirname(realPathOf(ctx, k)), cwd)) {
            if (seen.has(a)) break;       // everything above it was already visited
            seen.add(a);
            if (dirHas(a, 'pubspec.yaml')) roots.add(a);
          }
        }
        const byName = new Map();
        for (const root of roots) {
          const m = /^name:[ \t]*['"]?([A-Za-z_][\w]*)['"]?[ \t]*$/m.exec(readText(path.join(root, 'pubspec.yaml')));
          if (m && !byName.has(m[1])) byName.set(m[1], path.join(root, 'lib'));
        }
        return byName;
      });
    }

    // A directive runs to its `;` and may hold conditional URIs after the first one.
    const DIRECTIVE = /^[ \t]*(import|export|part[ \t]+of|part)[ \t]+((?:'[^'\n]*'|"[^"\n]*")[^;]*);/gm;
    const URI = /(?:'([^'\n]*)'|"([^"\n]*)")/g;

    function extract(filePath, content, fileSet, cwd, ctx) {
      const text = stripComments(content);
      const dir = path.dirname(filePath);
      const self = graphKey(filePath);
      const out = [];
      let m;
      DIRECTIVE.lastIndex = 0;
      while ((m = DIRECTIVE.exec(text)) !== null) {
        const uris = [];
        URI.lastIndex = 0;
        let u;
        while ((u = URI.exec(m[2])) !== null) uris.push(u[1] !== undefined ? u[1] : u[2]);
        // `show` / `hide` / `as` clauses name symbols, not files, so only strings are read; a
        // string after `if (...)` is a conditional target, but a bare `show 'x'` cannot occur.
        for (const uri of uris) {
          let k = null;
          if (uri.startsWith('package:')) {
            const rest = uri.slice('package:'.length);
            const slash = rest.indexOf('/');
            if (slash < 0) continue;
            const lib = packages(fileSet, cwd, ctx).get(rest.slice(0, slash));
            if (lib) k = inSet(fileSet, path.join(lib, rest.slice(slash + 1)));
          } else if (!/^[a-z][a-z0-9+.-]*:/i.test(uri)) {     // dart:, http:, ... are not files of the set
            k = inSet(fileSet, path.resolve(dir, uri));
          }
          if (k && k !== self) out.push(k);
        }
      }
      return out;
    }

    return { name: 'Dart', EXTS, extract };
  })();

  // ── Vue / Svelte / Astro ──────────────────────────────────────────────────

  const sfc = (() => {
    /**
     * Single-file components: Vue, Svelte, Astro (#980).
     *
     * The imports of these files are ordinary ES imports; they sit in a `<script>` block
     * (Vue, Svelte) or in the frontmatter fence and `<script>` tags (Astro). This module
     * only finds that code. The graph builder resolves it with the same JS/TS resolver as
     * any other script, so relative paths, `tsconfig` aliases and extension-less
     * specifiers behave exactly as they do in a `.ts` file.
     *
     * Template markup, `<style>` blocks and component tags are not read: a tag
     * `<Child />` is an import only through the `import Child from './Child.vue'` that
     * names it, which is in the script. The extension stays in the specifier: a bundler
     * does not guess that `./Child` means `Child.vue` unless it is configured to, so
     * neither does the graph.
     *
     * @module src/graph/import-resolvers (sfc)
     */

    const EXTS = new Set(['.vue', '.svelte', '.astro']);

    const SCRIPT = /<script\b[^>]*>([\s\S]*?)<\/script\s*>/gi;
    const FENCE = /^\uFEFF?\s*---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/;

    /**
     * The script source of a component file: every `<script>` body, and for Astro the
     * frontmatter before them. Returned as one string; import statements are line based.
     * @param {string} ext   '.vue' | '.svelte' | '.astro'
     * @param {string} content
     * @returns {string}
     */
    function scriptOf(ext, content) {
      const parts = [];
      let body = content;
      if (ext === '.astro') {
        const f = FENCE.exec(content);
        if (f) { parts.push(f[1]); body = content.slice(f[0].length); }
      }
      SCRIPT.lastIndex = 0;
      let m;
      while ((m = SCRIPT.exec(body)) !== null) parts.push(m[1]);
      return parts.join('\n');
    }

    return { name: 'Vue/Svelte/Astro', EXTS, scriptOf };
  })();

  // ── Lua ───────────────────────────────────────────────────────────────────

  const lua = (() => {
    /**
     * Lua `require` (#980).
     *
     * `require("a.b")`, `require "a.b"` and `pcall(require, "a.b")` name a module whose file
     * is `a/b.lua` or `a/b/init.lua` under a root Lua searches (`package.path`). The roots
     * are not declared in the repository, so they are tried the way projects lay them out:
     * every directory from the requiring file up to the project root, and under each of
     * them the directory itself, `lua/`, `src/` and `lib/`. That finds `lua/plenary/job.lua`
     * for `require "plenary.job"` from a test, a plugin or another module. A module that is
     * not in the repository (`require "vim"`, a rock) misses the set and yields nothing.
     *
     * `dofile("x.lua")` and `loadfile("x.lua")` with a literal path resolve next to the file
     * or from the project root. A module name built at run time yields nothing.
     *
     * @module src/graph/import-resolvers (lua)
     */


    const EXTS = new Set(['.lua']);

    const ROOTS = ['', 'lua', 'src', 'lib'];

    /** Blank `--[[ ]]` / `--[==[ ]==]` blocks and `--` line comments, keeping newlines. */
    function stripLua(src) {
      return src
        .replace(/--\[(=*)\[[\s\S]*?\]\1\]/g, (m) => m.replace(/[^\n]/g, ' '))
        .replace(/--[^\n]*/g, '');
    }

    const REQUIRE = /(?:^|[^\w.:])require[ \t]*\(?[ \t]*(['"])([^'"\n]+)\1/g;
    const PCALL = /\bpcall[ \t]*\([ \t]*require[ \t]*,[ \t]*(['"])([^'"\n]+)\1/g;
    const FILE = /\b(?:dofile|loadfile)[ \t]*\([ \t]*(['"])([^'"\n]+\.lua)\1/g;

    function moduleFile(name, dir, fileSet, cwd) {
      if (!/^[\w.\-]+$/.test(name)) return null;
      const rel = name.replace(/\./g, path.sep);
      for (const a of ancestorDirs(dir, cwd)) {
        for (const r of ROOTS) {
          const k = inSet(fileSet, path.resolve(a, r, rel + '.lua')) || inSet(fileSet, path.resolve(a, r, rel, 'init.lua'));
          if (k) return k;
        }
      }
      return null;
    }

    function extract(filePath, content, fileSet, cwd) {
      const text = stripLua(content);
      const dir = path.dirname(filePath);
      const self = graphKey(filePath);
      const out = [];
      let m;
      for (const re of [REQUIRE, PCALL]) {
        re.lastIndex = 0;
        while ((m = re.exec(text)) !== null) {
          const k = moduleFile(m[2], dir, fileSet, cwd);
          if (k && k !== self) out.push(k);
        }
      }
      FILE.lastIndex = 0;
      while ((m = FILE.exec(text)) !== null) {
        const k = inSet(fileSet, path.resolve(dir, m[2])) || (cwd && inSet(fileSet, path.resolve(cwd, m[2])));
        if (k && k !== self) out.push(k);
      }
      return out;
    }

    return { name: 'Lua', EXTS, extract };
  })();

  // ── GDScript ──────────────────────────────────────────────────────────────

  const gdscript = (() => {
    /**
     * GDScript `preload`, `load` and `extends` (#980).
     *
     * `preload("res://a/b.gd")` and `load("res://a/b.gd")` resolve from the Godot project
     * root, the nearest directory above the file that holds a `project.godot` (a repository
     * of demo projects has one per project), falling back to the repository root. A path
     * without `res://` is relative to the file. Only a path that is a script of the set is
     * an edge: a scene, an image or a sound is not a node of this graph.
     *
     * `extends "res://base.gd"` is the same. `extends Name` resolves when `Name` is declared
     * by a `class_name Name` in the same Godot project, which is how a script inherits from
     * another without a path; the engine's own classes (`extends Node`) match nothing.
     *
     * A path held in a variable or built by concatenation yields nothing.
     *
     * @module src/graph/import-resolvers (gdscript)
     */


    const EXTS = new Set(['.gd']);

    function stripGd(src) { return src.replace(/(^|[^"'\\])#[^\n]*/g, '$1'); }

    /** The Godot project directory of a file: the nearest above it with a project.godot. */
    function projectRootOf(file, cwd) {
      for (const a of ancestorDirs(path.dirname(file), cwd)) if (dirHas(a, 'project.godot')) return a;
      return cwd ? path.resolve(cwd) : path.dirname(file);
    }

    const CLASS_NAME = /^[ \t]*class_name[ \t]+([A-Za-z_]\w*)/gm;

    /** project root -> class_name -> keys declaring it. */
    function classNames(fileSet, cwd, ctx) {
      return perBuild(fileSet, 'gd:classNames', () => {
        const idx = new Map();
        for (const k of fileSet) {
          if (!k.endsWith('.gd')) continue;
          const real = realPathOf(ctx, k);
          const text = stripGd(readText(real));
          const root = graphKey(projectRootOf(real, cwd));
          CLASS_NAME.lastIndex = 0;
          let m;
          while ((m = CLASS_NAME.exec(text)) !== null) {
            const key = root + '\u0000' + m[1];
            const a = idx.get(key);
            if (a) a.push(k); else idx.set(key, [k]);
          }
        }
        return idx;
      });
    }

    const LOAD = /\b(?:preload|load)[ \t]*\([ \t]*(['"])([^'"\n]+)\1/g;
    const EXTENDS_PATH = /^[ \t]*extends[ \t]+(['"])([^'"\n]+)\1/gm;
    const EXTENDS_NAME = /^[ \t]*(?:class_name[ \t]+\w+[ \t]+)?extends[ \t]+([A-Za-z_]\w*)/gm;

    function fileFor(p, dir, root, fileSet) {
      if (p.startsWith('res://')) return inSet(fileSet, path.join(root, p.slice('res://'.length)));
      if (/^[a-z][a-z0-9+.-]*:\/\//i.test(p)) return null;     // user://, http://, ...
      return inSet(fileSet, path.resolve(dir, p));
    }

    function extract(filePath, content, fileSet, cwd, ctx) {
      const text = stripGd(content);
      const dir = path.dirname(filePath);
      const root = projectRootOf(filePath, cwd);
      const self = graphKey(filePath);
      const out = [];
      let m;
      for (const re of [LOAD, EXTENDS_PATH]) {
        re.lastIndex = 0;
        while ((m = re.exec(text)) !== null) {
          const k = fileFor(m[2], dir, root, fileSet);
          if (k && k !== self) out.push(k);
        }
      }
      EXTENDS_NAME.lastIndex = 0;
      const names = classNames(fileSet, cwd, ctx);
      while ((m = EXTENDS_NAME.exec(text)) !== null) {
        const hits = names.get(graphKey(root) + '\u0000' + m[1]);
        if (hits && hits.length === 1 && hits[0] !== self) out.push(hits[0]);
      }
      return out;
    }

    return { name: 'GDScript', EXTS, extract };
  })();

  // ── the list ─────────────────────────────────────────────────────────────────

  const FAMILIES = [c, php, csharp, dart, sfc, lua, gdscript];

  /** extension -> family module */
  const BY_EXT = new Map();
  for (const f of FAMILIES) for (const e of f.EXTS) BY_EXT.set(e, f);

  module.exports = { FAMILIES, BY_EXT, sfc, ancestorDirs, stripComments, maskCode, readBalanced };
  
};

// ── ./src/graph/language-support ──
__factories["./src/graph/language-support"] = function(module, exports) {
  
  /**
   * What the dependency graphs can and cannot read (#979).
   *
   * The import graph reads fifteen language families (eight, and seven more since #980)
   * and the method-level call graph seven (`GRAPH_FAMILIES`, `CALL_GRAPH_FAMILIES`). A file in any other
   * language contributes no edges, so a blast-radius query on it used to answer
   * "no importers found" — the same words as "nothing depends on this" — when
   * the truth is "this language is not tracked". Laravel's `Str.php`, imported by
   * 164 files, printed that.
   *
   * This module is the one place that tells the two apart. It is built on the
   * families the graphs themselves declare, so a language added there is
   * reported as tracked everywhere with no second list to forget.
   *
   * @module src/graph/language-support
   */

  const fs = require('fs');
  const path = require('path');
  const { GRAPH_FAMILIES, GRAPH_EXTS, DEFAULT_SRC_DIRS, DEFAULT_WALK_DEPTH } = __require('./src/graph/builder');

  /** The value of the machine-readable `graph` field and of the `graph:` token in text. */
  const UNSUPPORTED = 'unsupported-language';

  /** Display names for the extractor language keys the graphs cannot read. */
  const LABELS = {
    php: 'PHP', csharp: 'C#', cpp: 'C/C++', objc: 'Objective-C', swift: 'Swift',
    dart: 'Dart', lua: 'Lua', gdscript: 'GDScript', vue_sfc: 'Vue', svelte: 'Svelte',
    astro: 'Astro', html: 'HTML', css: 'CSS', yaml: 'YAML', shell: 'Shell',
    powershell: 'PowerShell', sql: 'SQL', graphql: 'GraphQL', terraform: 'Terraform',
    protobuf: 'Protocol Buffers', toml: 'TOML', properties: '.properties', xml: 'XML',
    markdown: 'Markdown', dockerfile: 'Dockerfile', pipeline: 'CI pipeline',
    // Read by the import graph but not by the call graph, so a call-graph report can name them.
    ruby: 'Ruby', elixir: 'Elixir', r: 'R',
  };

  /**
   * Languages whose files are configuration, markup, queries or scripts: nobody
   * expects a module import graph for them, so `doctor` does not count them as a
   * gap. A blast-radius query on one of these files still gets the explicit
   * "not tracked" answer; only the census leaves them out.
   */
  const NOT_EXPECTED = new Set([
    'html', 'css', 'yaml', 'toml', 'properties', 'xml', 'markdown', 'dockerfile',
    'pipeline', 'sql', 'graphql', 'terraform', 'protobuf', 'shell', 'powershell',
  ]);

  /** "JavaScript/TypeScript, Python and R" from a family table. */
  function familyList(families) {
    const names = families.map(([name]) => name);
    if (names.length <= 1) return names.join('');
    return `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`;
  }

  /** The languages the import graph reads, as prose. */
  function graphLanguageList() { return familyList(GRAPH_FAMILIES); }

  /** The languages the method-level call graph reads, as prose. */
  function callGraphLanguageList() { return familyList(__require('./src/graph/call-graph').CALL_GRAPH_FAMILIES); }

  /**
   * Whether a graph can read a file, and what to call its language when it cannot.
   *
   * @param {string} file
   * @param {Set<string>} exts  the graph's extension set
   * @returns {{ tracked: boolean, key: string|null, label: string }}
   */
  function support(file, exts) {
    const ext = path.extname(String(file || '')).toLowerCase();
    if (exts.has(ext)) return { tracked: true, key: null, label: '' };
    // Resolved only here, on the rare path, so a normal query never loads the extractors.
    const key = __require('./src/extractors/dispatch').langFor(file);
    const label = (key && LABELS[key]) || (ext ? ext : 'this file type');
    return { tracked: false, key: key || null, label };
  }

  /** Can the import graph read this file? */
  function graphSupport(file) { return support(file, GRAPH_EXTS); }

  /** Can the method-level call graph read this file? */
  function callGraphSupport(file) { return support(file, __require('./src/graph/call-graph').CALL_GRAPH_EXTS); }

  /** "PHP imports" / "`.json` file imports" / "imports of this file type". */
  function _subject(label) {
    if (label === 'this file type') return 'imports of this file type';
    return label.startsWith('.') ? `\`${label}\` file imports` : `${label} imports`;
  }

  /**
   * The explicit answer for a blast-radius query on a file the import graph
   * cannot read. Carries the `graph: unsupported-language` token so text-only
   * callers (the MCP tools return markdown) can still match it.
   */
  function importNote(label) {
    const swift = label === 'Swift'
      ? ' Swift imports name modules (SwiftPM targets), not files, so no file-level edge is drawn; where a Package.swift declares the target, the files that import this file\'s module are listed below.'
      : '';
    return `graph: ${UNSUPPORTED} — ${_subject(label)} are not tracked (the import graph reads ${graphLanguageList()}). This is not evidence that nothing depends on this file.${swift}`;
  }

  /**
   * The same answer in one short clause, for the surfaces that print a blast
   * radius per file (diff context, PR evidence, verify-plan, `ask --with-source`,
   * `plan`): "PHP imports are not tracked (graph: unsupported-language); not
   * evidence that nothing depends on it".
   */
  function shortNote(label) {
    return `${_subject(label)} are not tracked (graph: ${UNSUPPORTED}); not evidence that nothing depends on it`;
  }

  /** The same for a symbol declared in a file the call graph cannot read. */
  function callNote(label, files) {
    const where = files && files.length ? ` in ${files.map((f) => `\`${f}\``).join(', ')}` : '';
    return `graph: ${UNSUPPORTED} — declared${where} (${label}); ${label} calls are not tracked (the call graph reads ${callGraphLanguageList()}). This is not evidence that nothing calls it.`;
  }

  /** What a call-graph search could not read, for a symbol it does not know. */
  function unsearchedNote(unsearched) {
    const langs = unsearched.languages.slice(0, 4).map((l) => `${l.files.toLocaleString('en-US')} ${l.language}`).join(', ')
      + (unsearched.languages.length > 4 ? `, +${unsearched.languages.length - 4} more` : '');
    return `Not searched: ${langs} file(s) in the searched roots. The call graph reads ${callGraphLanguageList()}; if this symbol is declared in a language it does not read, its callers are not tracked.`;
  }

  /**
   * Mark an impact result whose target the import graph cannot read.
   *
   * Only an empty result for an unreadable file is marked: a file with importers
   * keeps its list, and every readable file's result is returned untouched, so
   * the output for supported languages does not change.
   *
   * A directory is not a file in a language, so it is never marked.
   *
   * @param {{ changed: string, totalImpact: number }} result
   * @param {{ cwd?: string }} [opts]  with `cwd`, a path that is a directory is left alone
   * @returns {object} the same object, with `graph` and `language` added when it applies
   */
  function markImpact(result, opts) {
    if (!result || result.totalImpact > 0) return result;
    const cwd = opts && opts.cwd;
    if (cwd) {
      try { if (fs.statSync(path.resolve(cwd, result.changed)).isDirectory()) return result; } catch (_) { /* absent: judged by its extension */ }
    }
    const s = graphSupport(result.changed);
    if (!s.tracked) { result.graph = UNSUPPORTED; result.language = s.label; }
    return result;
  }

  /**
   * Count the files under a graph's walk roots by whether that graph reads them:
   * `doctor` for the import graph (same roots, exclusions and depth as
   * `buildFromCwd`), and the call-graph query for the roots it actually searched.
   *
   * @param {string} cwd
   * @param {object} [opts]  { srcDirs, exclude, maxDepth, exts } — `exts` is the
   *                         graph's extension set (default: the import graph's)
   * @returns {{ tracked: number, untracked: number, languages: Array<{ key: string, label: string, files: number }> }}
   */
  function censusUntracked(cwd, opts) {
    const o = opts || {};
    const readable = o.exts || GRAPH_EXTS;
    let { srcDirs, exclude } = o;
    if (srcDirs === undefined) {
      const dirs = __require('./src/graph/src-dirs').resolveGraphDirs(cwd, DEFAULT_SRC_DIRS);
      srcDirs = dirs.srcDirs;
      if (exclude === undefined && dirs.exclude) exclude = dirs.exclude;
    }
    const excludeSet = new Set(exclude === undefined ? ['node_modules', '.git', 'dist', 'build'] : exclude);
    const maxDepth = o.maxDepth === undefined ? DEFAULT_WALK_DEPTH : o.maxDepth;
    const { EXT_MAP } = __require('./src/extractors/dispatch');

    const seen = new Set();
    const byKey = new Map();
    let tracked = 0;
    const walk = (dir, depth) => {
      if (depth > maxDepth) return;
      let entries;
      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
      for (const e of entries) {
        if (excludeSet.has(e.name) || e.name.startsWith('.')) continue;
        const full = path.join(dir, e.name);
        if (e.isDirectory()) { walk(full, depth + 1); continue; }
        if (!e.isFile() || seen.has(full)) continue;
        seen.add(full);
        const ext = path.extname(e.name).toLowerCase();
        if (readable.has(ext)) { tracked++; continue; }
        const key = EXT_MAP[ext];
        if (!key || NOT_EXPECTED.has(key)) continue;
        byKey.set(key, (byKey.get(key) || 0) + 1);
      }
    };
    for (const sd of srcDirs) {
      const abs = path.resolve(cwd, sd);
      if (fs.existsSync(abs)) walk(abs, 0);
    }

    // `.c`, `.h`, `.cpp`… share one key: one row per language, not per extension.
    const languages = [...byKey.entries()]
      .map(([key, files]) => ({ key, label: LABELS[key] || key, files }))
      .sort((a, b) => b.files - a.files || (a.label < b.label ? -1 : 1));
    return { tracked, untracked: languages.reduce((n, l) => n + l.files, 0), languages };
  }

  module.exports = {
    UNSUPPORTED, LABELS, NOT_EXPECTED,
    graphSupport, callGraphSupport, graphLanguageList, callGraphLanguageList,
    importNote, shortNote, callNote, unsearchedNote, markImpact, censusUntracked,
  };
  
};

// ── ./src/graph/path-key ──
__factories["./src/graph/path-key"] = function(module, exports) {
  
  /**
   * The single definition of a graph node key.
   *
   * src/graph/builder.js and src/graph/call-graph.js each used to normalise paths
   * their own way — builder lowercased, call-graph did not — so a lookup written
   * for one silently missed on the other. That divergence disabled the import
   * boost on every repo whose path contains an uppercase letter, and later caused
   * a "fix" for one graph to break the other. Both now key through this function,
   * so there is one convention rather than two conventions and a convention.
   *
   * Lowercasing keeps lookups stable across case-insensitive filesystems (macOS,
   * Windows), where the same file legitimately arrives spelled two ways.
   *
   * Zero-dependency, pure, bundle-safe.
   */

  const path = require('path');

  /** Canonical key for a filesystem path used as a graph node. */
  function graphKey(p) {
    return path.normalize(String(p)).toLowerCase();
  }

  /**
   * Render a graph node key as a repo-relative path in its ORIGINAL case.
   *
   * Keys are lowercased for identity (see above), but `path.relative(cwd, key)`
   * then finds no common prefix on any checkout whose path contains an uppercase
   * letter (every macOS `/Users/...`) and climbs to the filesystem root. Graphs
   * carry a `realPaths` map (key -> original-case absolute path) so display can
   * recover the real spelling; the case-insensitive prefix strip below is the
   * fallback for keys that predate the map or came from another graph.
   *
   * @param {string} key              graph node key (or any absolute path)
   * @param {string} cwd              project root
   * @param {Map<string,string>} [realPaths]
   * @returns {string} repo-relative, forward-slashed, original case where known
   */
  function displayPath(key, cwd, realPaths) {
    const real = (realPaths && realPaths.get(key)) || key;
    const rel = path.relative(cwd, real);
    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) {
      return rel.replace(/\\/g, '/');
    }
    // Fallback: strip the cwd prefix case-insensitively rather than climbing out.
    const norm = path.normalize(real);
    const normCwd = path.normalize(cwd);
    if (norm.toLowerCase().startsWith(normCwd.toLowerCase())) {
      return norm.slice(normCwd.length).replace(/^[\\/]+/, '').replace(/\\/g, '/');
    }
    return rel.replace(/\\/g, '/');
  }

  module.exports = { graphKey, displayPath };
  
};

// ── ./src/graph/src-dirs ──
__factories["./src/graph/src-dirs"] = function(module, exports) {
  
  /**
   * Which directories a graph walk starts from (#934).
   *
   * The import graph, the call graph and the live-overlay freshen each carried
   * their own hard-coded directory list (`src app lib …`), so on any repo without
   * a `srcDirs` pin they walked a different set of files than the index — and on
   * a repo whose code sits in `django/`, `packages/*`, `internal/` or the repo
   * root itself, none at all. This is the one answer they all ask instead.
   *
   * Resolution order, same as the index's own:
   *
   *   1. `gen-context.config.json` `srcDirs`        — the project's own pin
   *   2. the source roots detection chose           — what `generate` walks
   *      PLUS the conventional defaults the caller passes (union, so no repo ends
   *      up with a smaller walk than it had before detection was consulted)
   *
   * An explicit `opts.srcDirs` from a caller is resolved by the caller and never
   * reaches here.
   *
   * Reads the config file directly rather than through `loadConfig`, which can
   * fetch `extends` over the network and spawn a child process — neither belongs
   * inside a graph build. Detection failing for any reason degrades to the
   * caller's defaults; it never throws into a graph build.
   *
   * Zero-dependency, bundle-safe.
   */

  const fs = require('fs');
  const path = require('path');

  // Never source, whatever a project's own `exclude` says: a config that lists
  // only `["dist"]` still must not send a walk into node_modules or .git.
  const ALWAYS_EXCLUDED = ['node_modules', '.git'];

  function readConfig(cwd) {
    try {
      const cfg = JSON.parse(fs.readFileSync(path.join(cwd, 'gen-context.config.json'), 'utf8'));
      return cfg && typeof cfg === 'object' ? cfg : null;
    } catch (_) { return null; /* absent or unparsable — the caller falls back */ }
  }

  /**
   * Source directories pinned in the project's own config, or null.
   * @param {string} cwd
   * @returns {string[]|null}
   */
  function configuredSrcDirs(cwd) {
    const cfg = readConfig(cwd);
    return cfg && Array.isArray(cfg.srcDirs) && cfg.srcDirs.length > 0 ? cfg.srcDirs : null;
  }

  /**
   * The exclude list the index walks with: the project's own `exclude` when it
   * sets one (the loader replaces the default array, not merges it), else the
   * shipped default. Always keeps node_modules and .git out.
   */
  function excludeList(cfg) {
    let base;
    if (cfg && Array.isArray(cfg.exclude)) base = cfg.exclude;
    else base = __require('./src/config/defaults').DEFAULTS.exclude;
    return [...new Set([...ALWAYS_EXCLUDED, ...base])];
  }

  // Detection walks the tree and asks git which directories changed recently —
  // tens of milliseconds on a small repo, a few hundred on a large one — and a
  // long-lived process (the MCP server, `watch`) asks on every read. A repo's
  // roots do not change between two reads seconds apart, so one answer is reused
  // briefly. The config file is NOT cached: a pin added a moment ago must win.
  const DETECT_TTL_MS = 10000;
  const _detected = new Map();

  function detectedRoots(cwd, exclude) {
    const key = cwd + '\0' + exclude.join('\n');
    const now = Date.now();
    const hit = _detected.get(key);
    if (hit && now - hit.at < DETECT_TTL_MS) return hit.roots;

    let roots = [];
    try {
      const { resolveSourceRoots } = __require('./src/discovery/source-root-resolver');
      const result = resolveSourceRoots(cwd, { exclude });
      if (Array.isArray(result.roots)) roots = result.roots;
    } catch (_) { /* degrade to the caller's defaults */ }
    _detected.set(key, { at: now, roots });
    return roots;
  }

  /** Forget remembered detections — for tests that change a layout in place. */
  function clearDetectionCache() { _detected.clear(); }

  // Repo-relative, forward-slashed, no leading `./` or trailing `/` — the form
  // two spellings of one directory compare equal in.
  const norm = (d) => String(d).replace(/\\/g, '/').replace(/^(\.\/)+/, '').replace(/\/+$/, '') || '.';

  /** Order-preserving union; a directory spelled twice is kept once. */
  function mergeDirs(first, second) {
    const seen = new Set();
    const out = [];
    for (const d of [...first, ...second]) {
      const key = norm(d);
      if (seen.has(key)) continue;
      seen.add(key);
      out.push(d);
    }
    return out;
  }

  /**
   * Resolve the directories a graph walk starts from.
   *
   * @param {string}   cwd
   * @param {string[]} defaults  the conventional names the caller always tried
   * @returns {{ srcDirs: string[], exclude: string[]|null, source: 'config'|'detected' }}
   *   `exclude` is null for a pinned config — the caller keeps its own legacy
   *   list there, so a pinned repo's graph is exactly what it was. It is the
   *   index's list when the dirs came from detection, because a detected root can
   *   be `.` (a flat Go module) and a walk from there must skip build output.
   */
  function resolveGraphDirs(cwd, defaults) {
    const pinned = configuredSrcDirs(cwd);
    if (pinned) return { srcDirs: pinned, exclude: null, source: 'config' };

    const exclude = excludeList(readConfig(cwd));
    return {
      srcDirs: mergeDirs(detectedRoots(cwd, exclude), defaults || []),
      exclude,
      source: 'detected',
    };
  }

  module.exports = { resolveGraphDirs, configuredSrcDirs, mergeDirs, clearDetectionCache, ALWAYS_EXCLUDED };
  
};

// ── ./src/graph/swift-modules ──
__factories["./src/graph/swift-modules"] = function(module, exports) {
  
  /**
   * Swift, at module level (#980).
   *
   * `import Alamofire` names a module, and a module is a SwiftPM target: many files, with
   * no way to tell from the import which of them are used. Linking the importing file to
   * any one of them, or to all, would invent file-level edges, so Swift contributes none
   * to the import graph (`.swift` stays outside `GRAPH_EXTS`, and a blast-radius query on a
   * Swift file still says file-level imports are not tracked).
   *
   * What is known, and is not invented, is the module structure: a `Package.swift` declares
   * targets and each owns a directory (`Sources/<name>` by default, a `path:` when given,
   * `Tests/<name>` for a test target). From that, for a Swift file: the target it belongs to,
   * and the files in OTHER targets that `import` that target. That is the module-level blast
   * radius, a superset of the true one, and it is reported as such.
   *
   * A project with no `Package.swift` (an Xcode project) has no module structure here and
   * answers nothing.
   *
   * @module src/graph/swift-modules
   */

  const fs = require('fs');
  const path = require('path');
  const { maskCode, readBalanced, stripComments } = __require('./src/graph/import-resolvers');

  const SKIP = new Set(['.git', 'node_modules', '.build', 'Pods', 'Carthage', 'DerivedData', 'build', 'dist', '.swiftpm']);
  const MAX_FILES = 50000;
  const MAX_DEPTH = 12;

  /** Every file under `root` for which `want(name)` holds, as absolute paths. */
  function walk(root, want) {
    const out = [];
    const go = (dir, depth) => {
      if (depth > MAX_DEPTH || out.length >= MAX_FILES) return;
      let entries;
      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
      for (const e of entries) {
        if (SKIP.has(e.name)) continue;
        const full = path.join(dir, e.name);
        if (e.isDirectory()) go(full, depth + 1);
        else if (e.isFile() && want(e.name)) out.push(full);
      }
    };
    go(root, 0);
    return out;
  }

  const KINDS = ['target', 'executableTarget', 'testTarget', 'macro', 'plugin'];
  const CALL = new RegExp(`\\.(${KINDS.join('|')})\\s*\\(`, 'g');

  /** The targets one Package.swift declares: `{ name, kind, dir }` with `dir` absolute. */
  function targetsOf(packageFile) {
    let src;
    try { src = fs.readFileSync(packageFile, 'utf8'); } catch (_) { return []; }
    const root = path.dirname(packageFile);
    const masked = maskCode(src);
    const text = stripComments(src);
    const out = [];
    CALL.lastIndex = 0;
    let m;
    while ((m = CALL.exec(masked)) !== null) {
      const open = m.index + m[0].length - 1;
      const close = readBalanced(masked, open, '(', ')', 8000);
      if (close < 0) continue;
      const args = text.slice(open + 1, close);
      const name = /\bname\s*:\s*"([^"]+)"/.exec(args);
      if (!name) continue;
      const given = /\bpath\s*:\s*"([^"]+)"/.exec(args);
      const kind = m[1];
      const rel = given ? given[1] : path.join(kind === 'testTarget' ? 'Tests' : 'Sources', name[1]);
      const dir = path.resolve(root, rel);
      if (fs.existsSync(dir)) out.push({ name: name[1], kind, dir });
    }
    return out;
  }

  /** All targets under `cwd`, from every Package.swift found. */
  function targetsUnder(cwd) {
    const out = [];
    for (const f of walk(cwd, (n) => n === 'Package.swift')) out.push(...targetsOf(f));
    return out;
  }

  const IMPORT = /^[ \t]*(?:@\w+(?:\([^)]*\))?[ \t]+)*import[ \t]+(?:(?:typealias|struct|class|enum|protocol|let|var|func)[ \t]+)?([A-Za-z_]\w*)/gm;

  /** The module names a Swift source imports. */
  function importedModules(content) {
    const text = stripComments(content);
    const out = new Set();
    IMPORT.lastIndex = 0;
    let m;
    while ((m = IMPORT.exec(text)) !== null) out.add(m[1]);
    return out;
  }

  /** The target whose directory holds `file` (the deepest, when targets nest). */
  function targetOf(targets, file) {
    let best = null;
    for (const t of targets) {
      const rel = path.relative(t.dir, file);
      if (rel && !rel.startsWith('..') && !path.isAbsolute(rel) && (!best || t.dir.length > best.dir.length)) best = t;
    }
    return best;
  }

  /**
   * The module-level view of a Swift file.
   * @param {string} cwd
   * @param {string} file  absolute path of a `.swift` file
   * @returns {{ module: string, kind: string, dir: string, importers: string[] }|null}
   *          null when `cwd` has no Package.swift target that owns the file
   */
  function moduleImpact(cwd, file) {
    const targets = targetsUnder(cwd);
    const mine = targetOf(targets, file);
    if (!mine) return null;
    const importers = [];
    for (const f of walk(cwd, (n) => n.endsWith('.swift'))) {
      if (f === file) continue;
      const t = targetOf(targets, f);
      if (t && t.name === mine.name) continue;
      let text;
      try { text = fs.readFileSync(f, 'utf8'); } catch (_) { continue; }
      if (importedModules(text).has(mine.name)) importers.push(path.relative(cwd, f).replace(/\\/g, '/'));
    }
    importers.sort();
    return { module: mine.name, kind: mine.kind, dir: path.relative(cwd, mine.dir).replace(/\\/g, '/'), importers };
  }

  /** Every `.swift` file the module view walks under `cwd`, repo-relative. */
  function swiftFiles(cwd) {
    return walk(cwd, (n) => n.endsWith('.swift')).map((f) => path.relative(cwd, f).replace(/\\/g, '/')).sort();
  }

  module.exports = { moduleImpact, swiftFiles, importedModules, targetsOf };
  
};

// ── ./src/health/scorer ──
__factories["./src/health/scorer"] = function(module, exports) {
  
  /**
   * SigMap health scorer (v8.11 — auditable composite).
   *
   * Computes a 0-100 health score for a project. Every deduction is recorded in a
   * `components[]` breakdown so the number is auditable (which signal cost what),
   * and purely-informational metrics live under `diagnostics` rather than being
   * dressed up as if they affect the grade.
   *
   * Scored signals (each appears in `components` only when it fires):
   *   1. context never generated  — no adapter output exists though source does  (45 pts)
   *   2. staleness                — freshest adapter output older than 7 days     (≤30 pts)
   *   3. low token reduction      — avg reduction under threshold (full strategy) (20 pts)
   *   4. cold-context staleness   — hot-cold context-cold.md older than 1 day     (≤10 pts)
   *   5. over-budget rate         — >20% of runs exceeded the token budget        (20 pts)
   *   6. sustained over-budget    — ≥3 consecutive over-budget runs               (5 pts)
   *
   * Diagnostics (informational, NOT scored): p50/p95 token count, and
   * languageCoverage (share of SigMap's supported languages present in the repo —
   * this is language diversity, not extractor quality, and was previously
   * mislabeled "extractorCoverage").
   *
   * Freshness looks at the freshest of ANY adapter output (not just Copilot), so a
   * Claude/Codex/Cursor user is not falsely flagged as "never generated".
   *
   * Grade scale:  A ≥ 90 | B ≥ 75 | C ≥ 60 | D < 60. Never throws.
   *
   * @param {string} cwd
   * @returns {object} { score, grade, components, strategy, tokenReductionPct,
   *   daysSinceRegen, strategyFreshnessDays, totalRuns, overBudgetRuns,
   *   overBudgetStreak, languageCoverage, extractorCoverage, diagnostics }
   */

  const fs = require('fs');
  const path = require('path');

  // Every path a SigMap adapter may write context to (freshness looks at the
  // freshest existing one). Mirrors the ranker's adapter-output probe order.
  const CONTEXT_FILES = [
    ['.github', 'copilot-instructions.md'],
    ['CLAUDE.md'],
    ['AGENTS.md'],
    ['.cursorrules'],
    ['.windsurfrules'],
    ['.github', 'openai-context.md'],
    ['.github', 'gemini-context.md'],
    ['llm-full.txt'],
    ['llm.txt'],
  ];

  function gradeFor(points) {
    if (points >= 90) return 'A';
    if (points >= 75) return 'B';
    if (points >= 60) return 'C';
    return 'D';
  }

  /**
   * Pure scoring core. Given gathered signals, return the score, grade, and the
   * labeled list of deductions. No IO — unit-testable in isolation.
   *
   * @param {object} s gathered signals
   * @returns {{ score:number, grade:'A'|'B'|'C'|'D', components:Array }}
   */
  function composeHealth(s) {
    const components = [];
    const add = (id, label, penalty, detail) => {
      const p = Math.round(penalty);
      if (p > 0) components.push({ id, label, penalty: p, detail });
    };

    // 1. Context never generated — a project with source files but no context of
    //    any kind is not "healthy"; it hasn't been set up. Gated on hasSource so
    //    an empty/new directory is not penalised for having nothing to index.
    if (s.daysSinceRegen === null && s.hasSource) {
      add('not-generated', 'context never generated', 45,
        'no adapter output found — run `sigmap` to generate context');
    }

    // 2. Staleness — freshest adapter output older than the 7-day window.
    if (s.daysSinceRegen !== null && s.daysSinceRegen > 7) {
      add('staleness', 'context stale', Math.min(30, Math.floor((s.daysSinceRegen - 7) * 4)),
        `${s.daysSinceRegen}d since last regen (>7d)`);
    }

    // 3. Low token reduction — only meaningful for the 'full' strategy; hot-cold
    //    and per-module intentionally produce small/partial outputs.
    const reductionThreshold = s.strategy === 'full' ? 60 : 0;
    if (s.tokenReductionPct !== null && s.tokenReductionPct < reductionThreshold) {
      add('low-reduction', 'low token reduction', 20,
        `${s.tokenReductionPct}% avg reduction (<${reductionThreshold}%)`);
    }

    // 4. Cold-context staleness (hot-cold only).
    if (s.strategy === 'hot-cold' && s.strategyFreshnessDays !== null && s.strategyFreshnessDays > 1) {
      add('cold-freshness', 'cold context stale', Math.min(10, Math.floor(s.strategyFreshnessDays - 1) * 3),
        `context-cold.md ${s.strategyFreshnessDays}d old`);
    }

    // 5. Over-budget rate.
    if (s.overBudgetRuns > 0 && s.totalRuns > 0) {
      const rate = (s.overBudgetRuns / s.totalRuns) * 100;
      if (rate > 20) add('over-budget', 'runs over budget', 20,
        `${Math.round(rate)}% of runs exceeded budget (>20%)`);
    }

    // 6. Sustained over-budget streak — previously computed but never scored.
    if (s.overBudgetStreak >= 3) {
      add('over-budget-streak', 'sustained over-budget', 5,
        `${s.overBudgetStreak} consecutive over-budget runs`);
    }

    const penalty = components.reduce((sum, c) => sum + c.penalty, 0);
    const score = Math.max(0, Math.min(100, 100 - penalty));
    return { score, grade: gradeFor(score), components };
  }

  /**
   * Gather health signals from disk and score them. Never throws.
   * @param {string} cwd
   */
  function score(cwd) {
    let strategy = 'full';
    try {
      const cfgPath = path.join(cwd, 'gen-context.config.json');
      if (fs.existsSync(cfgPath)) {
        strategy = JSON.parse(fs.readFileSync(cfgPath, 'utf8')).strategy || 'full';
      }
    } catch (_) {}

    // ── Usage-log signals (only present when tracking has recorded runs) ────────
    let tokenReductionPct = null;
    let overBudgetRuns = 0;
    let totalRuns = 0;
    let p50TokenCount = 0;
    let p95TokenCount = 0;
    let overBudgetStreak = 0;
    try {
      // #773: this read usage.ndjson, which `tracking: false` (the default)
      // never writes — so health reported "no history / 0 runs" on a repo whose
      // gain log held hundreds of generates. readRuns() is the one read path and
      // covers both stores.
      const { readRuns, summarizeRuns } = __require('./src/tracking/usage-source');
      const { readLog, summarize } = __require('./src/tracking/logger');
      const { percentile, overBudgetStreak: calcStreak } = __require('./src/format/dashboard');
      const entries = readRuns(cwd);
      const sum = summarizeRuns(entries);
      if (sum.totalRuns > 0 && sum.avgReductionPct !== null) tokenReductionPct = sum.avgReductionPct;
      // overBudget is only recorded by the tracked store; absent means unknown,
      // not zero, so it is read from there rather than inferred from gain.
      overBudgetRuns = summarize(readLog(cwd)).overBudgetRuns;
      totalRuns = sum.totalRuns;
      const finals = entries.map((e) => Number(e.finalTokens)).filter(Number.isFinite);
      p50TokenCount = Math.round(percentile(finals, 50));
      p95TokenCount = Math.round(percentile(finals, 95));
      overBudgetStreak = calcStreak(entries);
    } catch (_) {}

    // ── Language coverage (DIAGNOSTIC — share of supported languages present,
    //    i.e. diversity, not extractor quality). Also yields hasSource. ──────────
    let languageCoverage = null;
    let hasSource = false;
    try {
      const { computeExtractorCoverage } = __require('./src/format/dashboard');
      const cov = computeExtractorCoverage(cwd);
      languageCoverage = { covered: cov.covered, supported: cov.supported, pct: cov.pct };
      hasSource = Object.values(cov.perLanguage || {}).some((n) => n > 0);
    } catch (_) {}

    // ── Freshness across ALL adapter outputs (freshest wins) ───────────────────
    let daysSinceRegen = null;
    try {
      let newest = null;
      for (const parts of CONTEXT_FILES) {
        const p = path.join(cwd, ...parts);
        try {
          if (fs.existsSync(p)) {
            const m = fs.statSync(p).mtimeMs;
            if (newest === null || m > newest) newest = m;
          }
        } catch (_) {}
      }
      if (newest !== null) {
        daysSinceRegen = parseFloat(((Date.now() - newest) / (1000 * 60 * 60 * 24)).toFixed(1));
      }
    } catch (_) {}

    // ── Cold-context freshness (hot-cold strategy only) ────────────────────────
    let strategyFreshnessDays = null;
    if (strategy === 'hot-cold') {
      try {
        const coldFile = path.join(cwd, '.github', 'context-cold.md');
        if (fs.existsSync(coldFile)) {
          const m = fs.statSync(coldFile).mtimeMs;
          strategyFreshnessDays = parseFloat(((Date.now() - m) / (1000 * 60 * 60 * 24)).toFixed(1));
        }
      } catch (_) {}
    }

    const { score: points, grade, components } = composeHealth({
      strategy,
      daysSinceRegen,
      strategyFreshnessDays,
      tokenReductionPct,
      overBudgetRuns,
      totalRuns,
      overBudgetStreak,
      hasSource,
    });

    return {
      score: points,
      grade,
      components,
      strategy,
      tokenReductionPct,
      daysSinceRegen,
      strategyFreshnessDays,
      totalRuns,
      overBudgetRuns,
      overBudgetStreak,
      languageCoverage,
      // Back-compat top-level fields (also surfaced, honestly grouped, under
      // `diagnostics`). `extractorCoverage` keeps its old name but its value is
      // language-diversity pct (never extractor quality) — prefer `languageCoverage`.
      p50TokenCount,
      p95TokenCount,
      extractorCoverage: languageCoverage ? languageCoverage.pct : 0,
      diagnostics: { p50TokenCount, p95TokenCount, languageCoverage },
    };
  }

  module.exports = { score, composeHealth };
  
};

// ── ./src/init/creation-workflow ──
__factories["./src/init/creation-workflow"] = function(module, exports) {
  
  /**
   * Creation-workflow CLAUDE.md block (IMPL.md §6.2 — 2f).
   *
   * `sigmap --init` injects this block so an agent reading CLAUDE.md knows the
   * grounded-creation guard-rail workflow exists: scaffold → verify-plan →
   * verify-ai-output → review-pr, orchestrated by `sigmap create`. Idempotent and
   * marker-scoped — it never touches human content or the conventions /
   * auto-generated-signatures blocks. Pure string transforms; zero-dependency,
   * bundle-safe.
   */

  const START = '<!-- sigmap-creation-workflow:start -->';
  const END = '<!-- sigmap-creation-workflow:end -->';

  /** Render the Creation workflow block (including its start/end markers). */
  function renderCreationWorkflowBlock() {
    return [
      START,
      '## Creation workflow (SigMap)',
      '',
      'When creating or changing code, run the grounded-creation pipeline so each step is verified against the live index:',
      '',
      '1. **`sigmap scaffold "<name>"`** — propose a convention-matched file/structure (refuses if conventions are inconsistent).',
      '2. **`sigmap verify-plan <plan.md>`** — check the plan against the live index (files/symbols exist, blast radius, scope).',
      '3. **`sigmap verify-ai-output <answer.md>`** — flag fake files/symbols/imports in the generated output (offline).',
      '4. **`sigmap review-pr`** — audit the diff for scope drift, god-node edits, missing tests, and security files.',
      '',
      'Or run all four in one pass with **`sigmap create "<task>"`** (`1/4`…`4/4` numbering, single pass/fail).',
      '',
      '<sub>Generated by `sigmap --init` · refresh by re-running it.</sub>',
      END,
    ].join('\n');
  }

  /**
   * Inject (or replace) the Creation workflow block in existing CLAUDE.md content.
   * Replaces an existing marked block in place; appends one when absent.
   * Idempotent — never touches content outside the markers.
   * @param {string} existing current file content ('' if new)
   * @param {string} block the block from `renderCreationWorkflowBlock`
   * @returns {string}
   */
  function injectCreationWorkflow(existing, block) {
    const src = String(existing || '');
    const startIdx = src.indexOf(START);
    if (startIdx !== -1) {
      const endIdx = src.indexOf(END, startIdx);
      if (endIdx !== -1) {
        return src.slice(0, startIdx) + block + src.slice(endIdx + END.length);
      }
    }
    if (src.trim() === '') return block + '\n';
    const sep = src.endsWith('\n') ? '\n' : '\n\n';
    return src + sep + block + '\n';
  }

  module.exports = { renderCreationWorkflowBlock, injectCreationWorkflow, START, END };
  
};

// ── ./src/judge/context-source ──
__factories["./src/judge/context-source"] = function(module, exports) {
  
  /**
   * Context-file resolution and freshness for `sigmap judge` (#780).
   *
   * Two gaps this closes. First, `--context` was mandatory, so the most common
   * case — judge an answer against the context this repo just generated — still
   * meant typing the adapter's output path. Second, nothing ever compared that
   * file's age against the sources it describes, so an answer could be judged
   * against a context generated weeks and hundreds of commits ago with no hint
   * that the ground had moved.
   *
   * Zero dependencies, deterministic, filesystem-only.
   */

  const fs = require('fs');
  const path = require('path');

  /**
   * Generated context files, in the order `judge` prefers them. Mirrors the list
   * `sigmap doctor` checks, so both commands agree on what "the repo's generated
   * context" means.
   */
  const ADAPTER_OUTPUTS = [
    ['.github', 'copilot-instructions.md'],
    ['CLAUDE.md'],
    ['AGENTS.md'],
    ['.cursorrules'],
    ['.windsurfrules'],
    ['.github', 'openai-context.md'],
    ['.github', 'gemini-context.md'],
    ['llm-full.txt'],
    ['llm.txt'],
  ];

  const EXCLUDE_DIRS = new Set([
    'node_modules', '.git', 'dist', 'build', 'out', '__pycache__',
    '.next', 'coverage', 'target', 'vendor', '.context',
  ]);

  /**
   * The repo's generated context file, or null when none has been generated.
   *
   * @param {string} cwd
   * @returns {string|null} absolute path
   */
  function resolveContextFile(cwd) {
    for (const parts of ADAPTER_OUTPUTS) {
      const p = path.join(cwd, ...parts);
      try { if (fs.statSync(p).isFile()) return p; } catch (_) {}
    }
    return null;
  }

  /**
   * Newest source file under `srcDirs`, by mtime.
   *
   * @returns {{ file: string, mtimeMs: number }|null}
   */
  function _newestSource(cwd, srcDirs, config, covered) {
    const { CODE_EXTS } = __require('./src/analysis/coverage-score');
    const { isCovered } = __require('./src/analysis/index-state');
    const exclude = new Set(EXCLUDE_DIRS);
    if (config && Array.isArray(config.exclude)) for (const x of config.exclude) exclude.add(String(x));

    let newest = null;
    let seen = 0;
    const walk = (dir, depth) => {
      if (depth > 8 || seen > 5000) return;
      let entries;
      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
      for (const e of entries) {
        if (exclude.has(e.name)) continue;
        const full = path.join(dir, e.name);
        if (e.isDirectory()) walk(full, depth + 1);
        else if (e.isFile() && CODE_EXTS.has(path.extname(e.name).toLowerCase())) {
          seen++;
          try {
            const m = fs.statSync(full).mtimeMs;
            // The live overlay already reflects this write, so queries are not
            // ranked against stale ground on its account (#926).
            if (isCovered(covered, cwd, full, m)) continue;
            if (!newest || m > newest.mtimeMs) newest = { file: full, mtimeMs: m };
          } catch (_) {}
        }
      }
    };
    for (const d of srcDirs || []) {
      const abs = path.isAbsolute(d) ? d : path.join(cwd, d);
      if (fs.existsSync(abs)) walk(abs, 0);
    }
    return newest;
  }

  /**
   * Whether a context file is older than the sources it describes.
   *
   * @param {string} contextFile absolute path to the context file
   * @param {string} cwd
   * @param {object} [config] loaded sigmap config (reads `srcDirs`, `exclude`)
   * @param {{honorOverlay?: boolean}} [opts] count files the live overlay describes as fresh
   * @returns {{ stale: boolean, ageHours: number, newest: string }|null} null when
   *   freshness cannot be established (unreadable context, no source files found)
   */
  function contextStaleness(contextFile, cwd, config, opts) {
    let ctxMtime;
    try { ctxMtime = fs.statSync(contextFile).mtimeMs; } catch (_) { return null; }

    const srcDirs = (config && Array.isArray(config.srcDirs) && config.srcDirs.length)
      ? config.srcDirs
      : ['src', 'lib', 'app'];
    // Whether a write the live overlay already describes counts as fresh depends on
    // WHAT is being read. A reader that ranks through the index (ask, the MCP search
    // tools) sees the overlay, so it is fresh for them. A reader of the WRITTEN file
    // (judge, read_context) does not, and for them the file is stale until the next
    // full run — so this is opt-in, never the default (#926).
    let covered = null;
    if (opts && opts.honorOverlay) {
      try { covered = __require('./src/cache/overlay').load(cwd); } catch (_) { /* no overlay → nothing is covered */ }
    }
    const newest = _newestSource(cwd, srcDirs, config, covered);
    if (!newest) return null;

    const gapMs = newest.mtimeMs - ctxMtime;
    return {
      stale: gapMs > 0,
      gapMs: Math.max(0, Math.round(gapMs)),
      ageHours: Math.round((gapMs / 3600000) * 10) / 10,
      newest: path.relative(cwd, newest.file) || newest.file,
    };
  }

  /** Largest sensible unit for a gap, so a sub-hour drift never prints "0 hour(s)". */
  function _formatGap(ms) {
    const minutes = ms / 60000;
    if (minutes < 60) return `${Math.max(1, Math.round(minutes))} minute(s)`;
    const hours = minutes / 60;
    if (hours < 24) return `${Math.round(hours * 10) / 10} hour(s)`;
    return `${Math.round((hours / 24) * 10) / 10} day(s)`;
  }

  /**
   * Human one-liner for a stale context, or null when it is fresh.
   *
   * `ask` and the MCP read tools answer from the same possibly-stale ground as
   * `judge` and used to say nothing about it (#815). They share this function
   * rather than growing a second definition of "stale": the threshold (any
   * positive gap) and the gap wording are fixed here, and only the consequence
   * clause varies by surface — what a stale index does to a verdict is not what
   * it does to a ranking.
   *
   * @param {{stale:boolean, gapMs:number, newest:string}|null} staleness
   * @param {{ tail?: string }} [opts] consequence clause; defaults to `judge`'s.
   */
  function stalenessWarning(staleness, opts = {}) {
    if (!staleness || !staleness.stale) return null;
    const tail = opts.tail || 'the answer is being judged against stale ground';
    return `context is ${_formatGap(staleness.gapMs)} older than ${staleness.newest} — ${tail}`;
  }

  /**
   * Consequence clauses for the surfaces that share the warning above, so the
   * CLI and the MCP server cannot drift into two phrasings of one condition.
   */
  const STALE_TAILS = {
    judge: 'the answer is being judged against stale ground',
    ask:   'this answer is ranked against stale ground; re-run `sigmap` to refresh the index',
    mcp:   'this result is ranked against stale ground; re-run `sigmap` to refresh the index',
    verify: 'a symbol deleted or renamed since then still resolves, so a clean verdict is not an all-clear; re-run `sigmap` to refresh the index',
  };

  module.exports = { resolveContextFile, contextStaleness, stalenessWarning, STALE_TAILS, ADAPTER_OUTPUTS };
  
};

// ── ./src/judge/judge-engine ──
__factories["./src/judge/judge-engine"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');
  const { boostFiles, normalizeFile, penalizeFiles } = __require('./src/learning/weights');
  const parsers = __require('./src/verify/parsers');
  const { tokenize: rankTokenize, stem } = __require('./src/retrieval/bm25');

  /**
   * Ordinary-English vocabulary (#779).
   *
   * The judge scores how much of an answer's *technical* content the context
   * grounds — not how much of the answer is English. Before this list existed,
   * `groundedness` was a raw word-overlap ratio, so five words of hedging prose
   * dropped a fully-grounded answer below the threshold and failed it. Filler is
   * removed from BOTH sides, so it can neither inflate nor dilute the score.
   *
   * Deliberately excludes words that name things in a repo (`value`, `type`,
   * `error`, `state`, `class`, `result`, `case`, `file`, `path`, `key`, `index`):
   * dropping those would hide real vocabulary. Entries are stemmed at load with
   * the ranker's own stemmer, so surface forms match after tokenization.
   */
  const PROSE_WORDS = (
    // pronouns, determiners, quantifiers
    'i you we they he she it me us them him her my your our their his hers its ' +
    'this that these those which who whom whose what there here any some all both ' +
    'each every either neither many much few several other another same such own ' +
    'most more less least enough none nothing something anything everything ' +
    // auxiliaries and modals
    'am is are was were be been being have has had having do does did doing ' +
    'will would shall should can could may might must ought ' +
    // conjunctions, prepositions, discourse connectives
    'and or but if then else because since while when where whether though ' +
    'although unless until after before during about above below over under ' +
    'between among through across into onto upon within without along around ' +
    'beside behind beyond toward towards per via than so yet nor also too only ' +
    'just even still already again once ever never always often sometimes ' +
    'however therefore thus hence moreover furthermore additionally instead ' +
    'otherwise meanwhile overall indeed anyway rather ' +
    // hedges and intensifiers — the vocabulary of ungrounded prose
    'usually typically generally normally commonly probably possibly perhaps ' +
    'maybe likely unlikely actually really quite very fairly somewhat mostly ' +
    'largely simply basically essentially effectively clearly obviously ' +
    'certainly definitely particularly specifically especially approximately ' +
    'roughly slightly nearly almost ' +
    // generic verbs that carry no repo signal
    'look see make take give come want need know think say tell find use go ' +
    'put keep let help try seem become live decide mean work start happen ' +
    'consider note show tend appear allow provide ensure avoid prefer choose ' +
    'mention describe explain suggest recommend ' +
    // generic nouns and adjectives
    'thing way time place part kind sort lot bit point fact example reason ' +
    'problem question good bad better best worse worst big small large long ' +
    'short high low old first last next previous different important useful ' +
    'helpful easy hard difficult simple complex complicated general specific ' +
    'common possible sure able right wrong true false yes'
  ).split(/\s+/).filter(Boolean);

  const PROSE_STOP = new Set(PROSE_WORDS.map(stem));

  /**
   * The tokens a groundedness score is computed over.
   *
   * Uses the ranker's tokenizer (`src/retrieval/bm25.js`) so the judge and the
   * retrieval side agree on what a token is: camelCase and snake_case are split
   * and stemmed, which is why `buildEvidencePack` and `build evidence pack` now
   * score the same. The judge's own ad-hoc `/\b[a-z][a-z0-9_]{2,}\b/` regex did
   * neither, so a bare identifier written out as prose was invisible to it.
   *
   * @param {string} text
   * @returns {string[]}
   */
  function scoreTokens(text) {
    return rankTokenize(text).filter((t) => !PROSE_STOP.has(t));
  }

  function groundedness(response, context) {
    if (!response || !context) return 0;
    const ctxTokens = new Set(scoreTokens(context));
    if (ctxTokens.size === 0) return 0;
    const respTokens = scoreTokens(response);
    if (respTokens.length === 0) return 0;
    const matched = respTokens.filter((t) => ctxTokens.has(t));
    return parseFloat((matched.length / respTokens.length).toFixed(3));
  }

  const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');

  /**
   * Evidence in a claim's own form, for a claim `verify` has proved fake (#909).
   *
   *   symbol  a call or definition — `name(`, `name = (…) =>`, `def name` — never
   *           the bare word, which is how `rank` was "grounded" by prose
   *   file    the claimed path as a path-aligned suffix of a path the context
   *           names (`lib/index.js` inside `src/lib/index.js`, not `src/index.js`)
   *   import  the module as a whole token, not a substring of a longer one
   *
   * @param {'symbol'|'file'|'import'} kind
   * @param {string} needle  lower-cased claim value
   * @param {string} ctxLower lower-cased context
   * @returns {boolean}
   */
  function hasStrongEvidence(kind, needle, ctxLower) {
    const id = escapeRe(needle);
    if (kind === 'symbol') {
      return new RegExp(`(?<![\\w$])${id}\\s*\\(`).test(ctxLower)
        || new RegExp(`(?<![\\w$])${id}\\s*[:=]\\s*(?:async\\s*)?(?:function\\b|\\()`).test(ctxLower)
        || new RegExp(`\\b(?:def|function|func|fn|fun|class|struct|interface|trait|enum|type)\\s+${id}(?![\\w$])`).test(ctxLower);
    }
    // file and import share one shape: the claim bounded on both sides, with a
    // `/` before it allowed — that is a longer path ending in the claim.
    return new RegExp(`(?:^|[^\\w$.-])(?:[\\w$.-]+/)*${id}(?![\\w$-]|\\.[\\w])`).test(ctxLower);
  }

  /**
   * Claim-level grounding (v8.10) — the structural half of the judge.
   *
   * `groundedness` above measures lexical *word* overlap: "does the answer reuse
   * context vocabulary?" That is a weak proxy — an answer can echo context words
   * while asserting a symbol, file, or import the context never mentions (a
   * hallucination), and still score high. This function extracts the answer's
   * *concrete, checkable claims* — the same high-precision claims the hallucination
   * guard checks (backtick-wrapped `foo()` calls, `path/to/file.ext` references,
   * and `import … from 'mod'` statements) — and verifies each one appears in the
   * provided context. A claim the context never grounds is a hallucination signal
   * that pure word-overlap cannot see.
   *
   * Deterministic, offline, zero-dependency. Reuses `src/verify/parsers`.
   *
   * Structural half (J1, #640): when `opts.cwd` is provided, the verify engine —
   * the same `buildSymbolSet` + `buildLibraryIndex` map, and the same lookup of a
   * name in the source (#914), that `sigmap verify` uses — clears any claim whose
   * check class ran and did not flag it, so a real repo or installed-library
   * symbol the context never quotes is grounded, while a fabricated one still
   * fails. One grounding engine, two commands. Without a cwd, behavior is the
   * original lexical context matching, byte-identical.
   *
   * The verdict runs both ways (#909): a claim verify has proved fake is no longer
   * grounded by a weak lexical match — a substring, a prose word, a basename —
   * only by evidence in its own form (`hasStrongEvidence`). And an import verify
   * positively resolved (a repo module, the standard library, a go.mod
   * requirement) is cleared in any language, not only where a package.json exists.
   *
   * @param {string} response
   * @param {string} context
   * @param {object} [opts]
   * @param {string} [opts.cwd]  repo root for structural verification
   * @returns {{ total: number, grounded: number, ungrounded: Array<{kind:string, value:string}>, structural: boolean }}
   */
  function claimGrounding(response, context, opts = {}) {
    if (!response || !context) return { total: 0, grounded: 0, ungrounded: [], structural: false, checked: [], coverage: 0 };
    const ctxLower = context.toLowerCase();

    const raw = [];
    for (const s of parsers.extractSymbols(response)) raw.push({ kind: 'symbol', value: s.name });
    for (const f of parsers.extractFilePaths(response)) raw.push({ kind: 'file', value: f.path });
    for (const i of parsers.extractImports(response)) raw.push({ kind: 'import', value: i.module, relative: !!i.relative });

    const seen = new Set();
    const claims = raw.filter((c) => {
      const key = `${c.kind}::${c.value}`;
      if (seen.has(key)) return false;
      seen.add(key);
      return true;
    });

    let flagged = null;
    let checks = null;
    let verified = null;
    if (opts && typeof opts.cwd === 'string') {
      try {
        const { verify } = __require('./src/verify/hallucination-guard');
        const v = verify(response, opts.cwd);
        checks = (v.summary && v.summary.checks) || null;
        verified = new Set((v.summary && v.summary.verifiedImports) || []);
        flagged = new Set();
        for (const i of v.issues) {
          if (i.type === 'fake-symbol') flagged.add(`symbol::${i.value}`);
          else if (i.type === 'fake-file' || i.type === 'fake-test-file') flagged.add(`file::${i.value}`);
          else if (i.type === 'fake-import') flagged.add(`import::${i.value}`);
        }
      } catch (_) { flagged = null; checks = null; verified = null; }
    }
    // A claim is only structurally clearable when its check class actually ran —
    // "not flagged" means nothing if the symbol index is empty or there is no
    // package.json to check bare imports against. An import verify positively
    // resolved (a repo module, the standard library, a go.mod requirement) has
    // been checked whatever its language; one it could not decide has not (#909).
    const structuralRan = (c) => {
      if (!checks) return false;
      if (c.kind === 'symbol') return !!checks.symbols;
      if (c.kind === 'file') return !!checks.files;
      if (verified && verified.has(c.value)) return true;
      return c.relative ? !!checks.relativeImports : !!checks.bareImports;
    };

    const ungrounded = [];
    const checked = [];
    let grounded = 0;
    for (const c of claims) {
      const key = `${c.kind}::${c.value}`;
      // A file claim is grounded if its basename appears in context (the answer
      // may cite a different directory than the map records). Symbols and modules
      // are matched on the token itself.
      const needle = c.value.toLowerCase();
      const base = c.kind === 'file' ? (c.value.split('/').pop() || c.value).toLowerCase() : needle;
      // Structure outranks weak text (#909): once verify has proved the claim
      // fake, a word that merely occurs in the context — `rank` in "to rank files",
      // `index.js` in `src/index.js` — no longer grounds it; only evidence in the
      // claim's own form does. A claim can only be flagged if its check ran, so
      // being flagged is the proof. Without a structural verdict the match is unchanged.
      const proven = flagged !== null && flagged.has(key);
      const lexical = proven
        ? hasStrongEvidence(c.kind, needle, ctxLower)
        : (ctxLower.includes(base) || ctxLower.includes(needle));
      const structuralHit = flagged !== null && structuralRan(c) && !flagged.has(key);
      // Explainability (J4, #653): every claim reports its grounding route —
      // "context" (the context quotes it), "repo" (the structural pass cleared
      // it), or null (nothing grounds it). Context is reported first when both
      // apply, since it needs no repo at all.
      const via = lexical ? 'context' : (structuralHit ? 'repo' : null);
      checked.push({ kind: c.kind, value: c.value, grounded: via !== null, via });
      if (via !== null) grounded++;
      else ungrounded.push({ kind: c.kind, value: c.value });
    }

    return {
      total: claims.length,
      grounded,
      ungrounded,
      structural: flagged !== null,
      checked,
      coverage: claims.length ? Math.round((grounded / claims.length) * 1000) / 1000 : 0,
    };
  }

  /**
   * Hedging phrases that signal an answer is reasoning from general knowledge
   * rather than from the context. These are a *style* signal, never a grounding
   * one (#765): before this change a fully-grounded answer failed — exit 1, and
   * reported at `high` confidence — solely because it contained the word
   * "typically,". They are now reported as warnings and never flip the verdict.
   */
  const GENERIC_MARKERS = [
    'however, based on my knowledge',
    'generally speaking',
    'in general',
    'typically,',
    'usually,',
    'as a general rule',
  ];

  /**
   * Word-boundary matcher for a generic marker.
   *
   * A plain `includes()` matched `in general` inside `in general-purpose code`
   * (#765). The trailing lookahead rejects a following word character *or*
   * hyphen, so hyphenated compounds no longer trip the check, while markers that
   * end in punctuation (`typically,`) still match.
   */
  function markerRegex(marker) {
    return new RegExp(`\\b${marker.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w-])`, 'i');
  }

  function extractContextFiles(context, cwd) {
    if (!context || !cwd) return [];

    const seen = new Set();
    const files = [];
    const lines = context.split('\n');

    for (const line of lines) {
      const match = line.match(/^#{2,3}\s+(.+?)\s*$/);
      if (!match) continue;

      const normalized = normalizeFile(cwd, match[1]);
      if (!normalized) continue;

      const abs = path.join(cwd, normalized);
      if (!fs.existsSync(abs) || seen.has(normalized)) continue;

      seen.add(normalized);
      files.push(normalized);
    }

    return files;
  }

  /** Empty claim report, for a verdict reached without scoring anything. */
  function emptyClaims() {
    return { total: 0, grounded: 0, ungrounded: [], structural: false, checked: [], coverage: 0 };
  }

  /**
   * Why this input cannot be judged at all, or null when it can (#766).
   *
   * `pass`/`fail` is a judgement about an answer. An empty response file, an
   * empty context, or an answer with no scoreable vocabulary is not a wrong
   * answer — it is a missing one, and filing it as `fail` gives CI the same
   * signal a confidently hallucinated answer produces.
   */
  function inconclusiveReason(response, context) {
    if (!response || !response.trim()) return 'response is empty — nothing to judge';
    if (!context || !context.trim()) return 'context is empty — nothing to judge against';
    if (scoreTokens(context).length === 0) return 'context has no scoreable tokens — nothing to judge against';
    if (scoreTokens(response).length === 0) return 'response has no scoreable tokens — nothing to check against the context';
    return null;
  }

  function judge(response, context, opts = {}) {
    const threshold = opts.threshold !== undefined ? opts.threshold : 0.25;

    // Inconclusive short-circuit (#766): nothing was scored, so there is no
    // verdict to reach and no weights feedback to apply.
    const blocked = inconclusiveReason(response, context);
    if (blocked) {
      const result = {
        score: 0,
        verdict: 'inconclusive',
        reasons: [blocked],
        warnings: [],
        claims: emptyClaims(),
        confidence: { level: 'low', basis: ['nothing to judge'] },
      };
      if (opts.learn) {
        result.learning = { applied: false, action: 'none', files: [], reason: 'verdict inconclusive — no signal to learn from' };
      }
      return result;
    }

    const score = groundedness(response, context);
    const reasons = [];

    if (score < threshold) {
      reasons.push(`score ${score} is below threshold ${threshold} — response may not be grounded in context`);
    }

    // Style warnings (#765) — reported, never a verdict input.
    const warnings = [];
    for (const m of GENERIC_MARKERS) {
      if (markerRegex(m).test(response)) {
        warnings.push(`response contains generic phrase: "${m}"`);
      }
    }

    // Structural claim grounding: any concrete symbol/file/import the answer
    // states that neither the context nor (with a cwd) the repo/installed-lib
    // index grounds is a hallucination the lexical score above cannot detect.
    // Each ungrounded claim fails the verdict.
    const claims = claimGrounding(response, context, opts);
    const where = claims.structural ? 'context or repo index' : 'context';
    for (const c of claims.ungrounded) {
      reasons.push(`${c.kind} claim not grounded in ${where}: ${c.value}${c.kind === 'symbol' ? '()' : ''}`);
    }

    const verdict = score >= threshold && claims.ungrounded.length === 0 ? 'pass' : 'fail';

    // Confidence in the verdict (J4, #653) — a deterministic level with an
    // auditable basis, aligned with the Evidence Pack's confidence vocabulary:
    //   high   — the structural pass ran, every claim grounded, and the score
    //            clears the threshold by ≥ 0.15
    //   medium — claims were checked (lexically or with ungrounded findings —
    //            symbol detection is medium-certainty by the verify taxonomy),
    //            or the margin alone is comfortable
    //   low    — no concrete claims and a thin margin: the verdict rests on
    //            word overlap alone
    const margin = Math.round((score - threshold) * 1000) / 1000;
    const basis = [`${claims.total} claim(s) checked`];
    if (claims.structural) basis.push('structural pass ran');
    basis.push(`score margin ${margin}`);
    let level;
    if (claims.structural && claims.total > 0 && claims.ungrounded.length === 0 && margin >= 0.15) level = 'high';
    else if (claims.total > 0 || margin >= 0.15) level = 'medium';
    else level = 'low';
    // Hedging language is unverifiable by construction, so it caps confidence
    // rather than flipping the verdict (#765) — the judge must never report
    // `high` confidence in a result a stylistic signal had any part in.
    if (warnings.length && level === 'high') {
      level = 'medium';
      basis.push('generic phrasing present');
    }
    const confidence = { level, basis };

    const result = { score, verdict, reasons, warnings, claims, confidence };

    if (opts.learn) {
      const learning = {
        applied: false,
        action: 'none',
        files: [],
      };

      if (!opts.cwd) {
        learning.reason = 'cwd is required for learning';
        result.learning = learning;
        return result;
      }

      const contextFiles = extractContextFiles(context, opts.cwd);
      learning.files = contextFiles;

      if (contextFiles.length === 0) {
        learning.reason = 'no context files found in context headings';
        result.learning = learning;
        return result;
      }

      const boostAbove = typeof opts.learnBoostAbove === 'number' ? opts.learnBoostAbove : 0.75;
      const penalizeBelow = typeof opts.learnPenalizeBelow === 'number' ? opts.learnPenalizeBelow : 0.40;
      if (score > boostAbove) {
        boostFiles(opts.cwd, contextFiles, 0.05);
        learning.applied = true;
        learning.action = 'boost';
      } else if (score < penalizeBelow) {
        penalizeFiles(opts.cwd, contextFiles, 0.03);
        learning.applied = true;
        learning.action = 'penalize';
      } else {
        learning.reason = `groundedness in no-op band (${penalizeBelow}-${boostAbove})`;
      }

      result.learning = learning;
    }

    return result;
  }

  module.exports = { groundedness, claimGrounding, hasStrongEvidence, judge, scoreTokens, markerRegex, GENERIC_MARKERS, PROSE_STOP };
  
};

// ── ./src/learning/weights ──
__factories["./src/learning/weights"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');

  const DECAY = 0.95;
  const MAX_MULT = 3.0;
  const MIN_MULT = 0.30;
  const BASELINE = 1.0;
  // A multiplier this close to neutral changes no ranking; dropping it keeps
  // .context/weights.json from accumulating decayed-out noise forever.
  const NEUTRAL_EPSILON = 0.01;

  function weightsPath(cwd) {
    return path.join(cwd, '.context', 'weights.json');
  }

  function clampMultiplier(value) {
    if (!Number.isFinite(value)) return BASELINE;
    if (value > MAX_MULT) return MAX_MULT;
    if (value < MIN_MULT) return MIN_MULT;
    return parseFloat(value.toFixed(6));
  }

  function normalizeFile(cwd, filePath) {
    if (!cwd || !filePath || typeof filePath !== 'string') return null;
    const cleaned = filePath.trim().replace(/\\/g, '/');
    if (!cleaned) return null;

    const abs = path.resolve(cwd, cleaned);
    const rel = path.relative(cwd, abs);
    if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) return null;
    return rel.split(path.sep).join('/');
  }

  function sanitizeWeights(cwd, weights) {
    const out = {};
    const entries = weights && typeof weights === 'object' ? Object.entries(weights) : [];

    for (const [filePath, raw] of entries) {
      const normalized = normalizeFile(cwd, filePath);
      if (!normalized) continue;
      const mult = clampMultiplier(Number(raw));
      if (Math.abs(mult - BASELINE) < NEUTRAL_EPSILON) continue;
      out[normalized] = mult;
    }

    return out;
  }

  function loadWeights(cwd) {
    try {
      const parsed = JSON.parse(fs.readFileSync(weightsPath(cwd), 'utf8'));
      return sanitizeWeights(cwd, parsed);
    } catch (_) {
      return {};
    }
  }

  function saveWeights(cwd, weights) {
    const cleaned = sanitizeWeights(cwd, weights);
    const outPath = weightsPath(cwd);

    if (Object.keys(cleaned).length === 0) {
      try {
        if (fs.existsSync(outPath)) fs.unlinkSync(outPath);
      } catch (_) {}
      return;
    }

    fs.mkdirSync(path.dirname(outPath), { recursive: true });
    const sorted = Object.keys(cleaned)
      .sort()
      .reduce((acc, key) => {
        acc[key] = cleaned[key];
        return acc;
      }, {});
    fs.writeFileSync(outPath, JSON.stringify(sorted, null, 2) + '\n', 'utf8');
  }

  function updateWeights(cwd, opts = {}) {
    const goodAmount = Number.isFinite(opts.goodAmount) ? opts.goodAmount : 0.15;
    const badAmount = Number.isFinite(opts.badAmount) ? opts.badAmount : 0.10;
    const goodFiles = Array.isArray(opts.goodFiles) ? opts.goodFiles : [];
    const badFiles = Array.isArray(opts.badFiles) ? opts.badFiles : [];

    const weights = loadWeights(cwd);

    // Decay toward the NEUTRAL baseline, not toward zero. `w * DECAY` converges
    // on 0 (floor-clamped at MIN_MULT), so every unrelated `learn` call deepened
    // penalties forever and dragged boosts down through 1.0 into penalty
    // territory — the opposite of what `weights` documents.
    for (const key of Object.keys(weights)) {
      weights[key] = clampMultiplier(BASELINE + (weights[key] - BASELINE) * DECAY);
    }

    const good = [];
    const bad = [];

    for (const filePath of goodFiles) {
      const normalized = normalizeFile(cwd, filePath);
      if (!normalized) continue;
      weights[normalized] = clampMultiplier((weights[normalized] || BASELINE) + goodAmount);
      good.push(normalized);
    }

    for (const filePath of badFiles) {
      const normalized = normalizeFile(cwd, filePath);
      if (!normalized) continue;
      weights[normalized] = clampMultiplier((weights[normalized] || BASELINE) - badAmount);
      bad.push(normalized);
    }

    saveWeights(cwd, weights);
    return { good, bad, weights: loadWeights(cwd) };
  }

  function boostFiles(cwd, files, amount = 0.15) {
    return updateWeights(cwd, { goodFiles: files, goodAmount: amount });
  }

  function penalizeFiles(cwd, files, amount = 0.10) {
    return updateWeights(cwd, { badFiles: files, badAmount: amount });
  }

  function resetWeights(cwd) {
    const outPath = weightsPath(cwd);
    if (fs.existsSync(outPath)) fs.unlinkSync(outPath);
  }

  function exportWeights(cwd, outputPath) {
    const weights = loadWeights(cwd);
    const json = JSON.stringify(weights, null, 2) + '\n';
    if (outputPath) {
      fs.mkdirSync(path.dirname(path.resolve(outputPath)), { recursive: true });
      fs.writeFileSync(outputPath, json, 'utf8');
    } else {
      process.stdout.write(json);
    }
    return weights;
  }

  function importWeights(cwd, importPath, replace) {
    let incoming;
    try {
      incoming = JSON.parse(fs.readFileSync(importPath, 'utf8'));
    } catch (err) {
      throw new Error(`Cannot read weights file: ${err.message}`);
    }
    const sanitized = sanitizeWeights(cwd, incoming);
    if (replace) {
      saveWeights(cwd, sanitized);
      return sanitized;
    }
    const existing = loadWeights(cwd);
    const merged = Object.assign({}, existing, sanitized);
    saveWeights(cwd, merged);
    return merged;
  }

  module.exports = {
    BASELINE,
    DECAY,
    NEUTRAL_EPSILON,
    MAX_MULT,
    MIN_MULT,
    weightsPath,
    clampMultiplier,
    normalizeFile,
    loadWeights,
    saveWeights,
    updateWeights,
    boostFiles,
    penalizeFiles,
    resetWeights,
    exportWeights,
    importWeights,
  };
  
};

// ── ./src/lsp/client ──
__factories["./src/lsp/client"] = function(module, exports) {
  
  const { spawnSync } = require('child_process');
  const path = require('path');

  // Zero-dep synchronous LSP client (#612, tier T3 of #542). SigMap already
  // speaks JSON-RPC-over-stdio as an MCP *server*; this is the same wire
  // discipline run as a *client*, against a language server the machine
  // already has (clangd ships with Xcode CLT; gopls/rust-analyzer where
  // installed). Nothing is bundled and nothing is required to exist.
  //
  // The session is PIPELINED: every frame — initialize, initialized, didOpen,
  // documentSymbol, shutdown, exit — is written up front as one stdin buffer
  // via spawnSync (args array, never a shell), and the responses are parsed
  // from the captured stdout. Measured against clangd: a full round-trip in
  // ~290ms with exact multiline ranges. Servers process framed messages in a
  // read loop, so pipelining holds; any server that objects simply produces
  // no matching response and the caller falls back to the regex tier.

  const SESSION_TIMEOUT_MS = 10000;
  const MAX_BUFFER = 64 * 1024 * 1024;

  function frame(obj) {
    const s = JSON.stringify(obj);
    return `Content-Length: ${Buffer.byteLength(s)}\r\n\r\n${s}`;
  }

  /** Parse Content-Length-framed JSON-RPC messages from a captured stream. */
  function parseFrames(raw) {
    const msgs = [];
    let buf = raw || '';
    for (;;) {
      const m = buf.match(/^Content-Length: (\d+)\r\n(?:[^\r\n]+\r\n)*\r\n/);
      if (!m) break;
      const len = parseInt(m[1], 10);
      const body = buf.slice(m[0].length, m[0].length + len);
      if (Buffer.byteLength(body) < len) break;
      try { msgs.push(JSON.parse(body)); } catch (_) {}
      buf = buf.slice(m[0].length + len);
    }
    return msgs;
  }

  /**
   * One-shot documentSymbol session against a language server.
   * @param {string[]} cmd - command + args (spawned directly, never a shell)
   * @param {string} filePath - absolute path of the file
   * @param {string} src - file content (sent via didOpen; the file need not be saved)
   * @param {string} languageId - LSP language id ('cpp', 'go', 'rust', ...)
   * @returns {{ symbols: object[], serverVersion: string }|null} null on ANY failure
   */
  function documentSymbols(cmd, filePath, src, languageId) {
    if (!Array.isArray(cmd) || cmd.length === 0) return null;
    const abs = path.resolve(filePath);
    const uri = 'file://' + abs;
    const input =
      frame({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {
        processId: null,
        rootUri: 'file://' + path.dirname(abs),
        capabilities: { textDocument: { documentSymbol: { hierarchicalDocumentSymbolSupport: true } } },
      } }) +
      frame({ jsonrpc: '2.0', method: 'initialized', params: {} }) +
      frame({ jsonrpc: '2.0', method: 'textDocument/didOpen', params: {
        textDocument: { uri, languageId, version: 1, text: src },
      } }) +
      frame({ jsonrpc: '2.0', id: 2, method: 'textDocument/documentSymbol', params: { textDocument: { uri } } }) +
      frame({ jsonrpc: '2.0', id: 3, method: 'shutdown' }) +
      frame({ jsonrpc: '2.0', method: 'exit' });

    let r;
    try {
      r = spawnSync(cmd[0], cmd.slice(1), {
        input,
        encoding: 'utf8',
        timeout: SESSION_TIMEOUT_MS,
        maxBuffer: MAX_BUFFER,
      });
    } catch (_) {
      return { missing: true };
    }
    // A missing binary is permanent for the run; anything else — crash,
    // timeout, empty output — is a per-file failure and must not poison the
    // server for later files (a transient null once cost 12 of 19 files).
    if (r && r.error && r.error.code === 'ENOENT') return { missing: true };
    if (!r || r.error || !r.stdout) return null;

    const msgs = parseFrames(r.stdout);
    const init = msgs.find((x) => x.id === 1 && x.result);
    const sym = msgs.find((x) => x.id === 2);
    if (!sym || !Array.isArray(sym.result)) return null;
    const info = (init && init.result && init.result.serverInfo) || {};
    // Server version strings vary ('Apple clangd version 17.0.0 ...',
    // 'gopls v0.16.1') — pull the first dotted number rather than a word.
    const vm = typeof info.version === 'string' ? info.version.match(/\d+\.[\w.\-]+/) : null;
    return {
      symbols: sym.result,
      serverName: typeof info.name === 'string' ? info.name : '',
      serverVersion: vm ? vm[0] : '',
    };
  }

  module.exports = { documentSymbols, parseFrames, frame, SESSION_TIMEOUT_MS };
  
};

// ── ./src/map/build-ci ──
__factories["./src/map/build-ci"] = function(module, exports) {
  
  /**
   * Build & CI extractor (v8.5 C1).
   *
   * Surfaces how the project is built and validated: npm/pnpm/yarn scripts
   * (package.json), GitHub Actions workflows (.github/workflows/*.yml), and
   * Makefile targets. Pure, zero-dependency, deterministic.
   *
   * @param {string[]} files — absolute file paths (unused; roots are read directly)
   * @param {string}   cwd   — project root
   * @returns {string} formatted markdown table (empty string if none found)
   */

  const fs = require('fs');
  const path = require('path');

  const MAX_ROWS = 120;

  function readJson(p) {
    try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; }
  }

  function npmScripts(cwd, rows) {
    const pkg = readJson(path.join(cwd, 'package.json'));
    if (!pkg || !pkg.scripts || typeof pkg.scripts !== 'object') return;
    for (const name of Object.keys(pkg.scripts).sort()) {
      rows.push({ kind: 'script', name, detail: 'npm run ' + name });
    }
  }

  function ciWorkflows(cwd, rows) {
    const dir = path.join(cwd, '.github', 'workflows');
    let entries;
    try { entries = fs.readdirSync(dir); } catch (_) { return; }
    for (const file of entries.sort()) {
      if (!/\.ya?ml$/i.test(file)) continue;
      let content;
      try { content = fs.readFileSync(path.join(dir, file), 'utf8'); } catch (_) { continue; }
      const nameMatch = content.match(/^name:\s*(.+)$/m);
      const name = nameMatch ? nameMatch[1].trim().replace(/^['"]|['"]$/g, '') : file;
      // Trigger events from an `on:` mapping or inline form.
      const onMatch = content.match(/^on:\s*(.*)$/m);
      let triggers = '';
      if (onMatch) {
        if (onMatch[1].trim()) {
          triggers = onMatch[1].replace(/[[\]{}'"]/g, '').trim();
        } else {
          const block = content.slice(onMatch.index);
          const events = [...block.matchAll(/^\s{2,}([a-z_]+):/gm)].map((m) => m[1]);
          triggers = [...new Set(events)].slice(0, 6).join(', ');
        }
      }
      rows.push({ kind: 'ci', name, detail: `${file}${triggers ? ' — ' + triggers : ''}` });
    }
  }

  function makeTargets(cwd, rows) {
    let content;
    try { content = fs.readFileSync(path.join(cwd, 'Makefile'), 'utf8'); } catch (_) { return; }
    const targets = [];
    for (const line of content.split('\n')) {
      const m = line.match(/^([a-zA-Z0-9_][a-zA-Z0-9_.-]*)\s*:(?!=)/);
      if (m && m[1] !== '.PHONY') targets.push(m[1]);
    }
    for (const t of [...new Set(targets)].sort()) {
      rows.push({ kind: 'make', name: t, detail: 'make ' + t });
    }
  }

  /**
   * Structured build/CI target rows (#629): npm scripts, workflow files, and
   * Makefile targets, each `{ kind: 'script'|'ci'|'make', name, detail }`.
   */
  function collectTargets(cwd) {
    const rows = [];
    npmScripts(cwd, rows);
    ciWorkflows(cwd, rows);
    makeTargets(cwd, rows);
    return rows;
  }

  function analyze(files, cwd) {
    const rows = collectTargets(cwd);
    if (rows.length === 0) return '';

    const lines = [
      '| Kind | Name | Detail |',
      '|------|------|--------|',
    ];
    for (const r of rows.slice(0, MAX_ROWS)) {
      lines.push(`| ${r.kind} | ${r.name} | ${r.detail} |`);
    }
    if (rows.length > MAX_ROWS) {
      lines.push(`| … | | +${rows.length - MAX_ROWS} more |`);
    }
    return lines.join('\n');
  }

  module.exports = { analyze, collectTargets };
  
};

// ── ./src/map/class-hierarchy ──
__factories["./src/map/class-hierarchy"] = function(module, exports) {
  
  /**
   * Class hierarchy analyzer.
   * Extracts class declarations with extends/implements across
   * TypeScript, JavaScript, Python, Java, Kotlin, C# files.
   *
   * @param {string[]} files — absolute file paths to analyze
   * @param {string}   cwd   — project root for relative path display
   * @returns {string} formatted section content (empty string if nothing found)
   */

  const fs = require('fs');
  const path = require('path');

  function analyze(files, cwd) {
    const entries = [];

    for (const filePath of files) {
      const ext = path.extname(filePath).toLowerCase();
      const rel = path.relative(cwd, filePath).replace(/\\/g, '/');
      let content;
      try { content = fs.readFileSync(filePath, 'utf8'); } catch (_) { continue; }

      // TS / JS
      if (['.ts', '.tsx', '.js', '.jsx'].includes(ext)) {
        const re = /^\s*(?:export\s+)?(?:abstract\s+)?class\s+(\w+)(?:\s+extends\s+([\w<>.]+?))?(?:\s+implements\s+([\w<>.,\s]+?))?\s*\{/gm;
        let m;
        while ((m = re.exec(content)) !== null) {
          const parent = m[2] ? m[2].split('<')[0].trim() : null;
          const ifaces = m[3]
            ? m[3].split(',').map((s) => s.split('<')[0].trim()).filter(Boolean)
            : [];
          entries.push({ name: m[1], parent, interfaces: ifaces, file: rel });
        }
      }

      // Python
      if (['.py', '.pyw'].includes(ext)) {
        const re = /^\s*class\s+(\w+)\s*\(([^)]*)\)\s*:/gm;
        let m;
        while ((m = re.exec(content)) !== null) {
          const parents = m[2]
            .split(',')
            .map((s) => s.trim())
            .filter((s) => s && s !== 'object');
          entries.push({
            name: m[1],
            parent: parents[0] || null,
            interfaces: parents.slice(1),
            file: rel,
          });
        }
      }

      // Java
      if (ext === '.java') {
        const re = /^\s*(?:(?:public|protected|private|static|abstract|final)\s+)*class\s+(\w+)(?:\s+extends\s+(\w+))?(?:\s+implements\s+([\w,\s<>]+?))?\s*\{/gm;
        let m;
        while ((m = re.exec(content)) !== null) {
          const ifaces = m[3]
            ? m[3].split(',').map((s) => s.split('<')[0].trim()).filter(Boolean)
            : [];
          entries.push({ name: m[1], parent: m[2] || null, interfaces: ifaces, file: rel });
        }
      }

      // Kotlin
      if (['.kt', '.kts'].includes(ext)) {
        const re = /^\s*(?:(?:data|sealed|abstract|open|inner)\s+)?class\s+(\w+)(?:\s*[^:\r\n]*)?\s*:\s*([\w<>(),.\s]+?)(?:\s*\{|$)/gm;
        let m;
        while ((m = re.exec(content)) !== null) {
          const parents = m[2]
            .split(',')
            .map((s) => s.replace(/\(.*?\)/, '').split('<')[0].trim())
            .filter(Boolean);
          entries.push({
            name: m[1],
            parent: parents[0] || null,
            interfaces: parents.slice(1),
            file: rel,
          });
        }
      }

      // C#
      if (ext === '.cs') {
        const re = /^\s*(?:(?:public|internal|protected|private|static|abstract|sealed|partial)\s+)*class\s+(\w+)(?:\s*:\s*([\w<>.,\s]+?))?\s*\{/gm;
        let m;
        while ((m = re.exec(content)) !== null) {
          const parents = m[2]
            ? m[2].split(',').map((s) => s.split('<')[0].trim()).filter(Boolean)
            : [];
          entries.push({
            name: m[1],
            parent: parents[0] || null,
            interfaces: parents.slice(1),
            file: rel,
          });
        }
      }
    }

    if (entries.length === 0) return '';

    return entries
      .map((e) => {
        let line = e.name;
        if (e.parent) line += ` extends ${e.parent}`;
        if (e.interfaces.length > 0) line += ` implements ${e.interfaces.join(', ')}`;
        line += ` (${e.file})`;
        return line;
      })
      .join('\n');
  }

  module.exports = { analyze };
  
};

// ── ./src/map/config-manifest ──
__factories["./src/map/config-manifest"] = function(module, exports) {
  
  /**
   * Config & package-manifest extractor (v8.5 C1).
   *
   * Surfaces the project's package manifests and the notable root config files.
   *
   * Dependency extraction lives in `src/deps/inventory.js` (#2a, v8.50). Before
   * that, most ecosystems were reported as the literal word "present" —
   * `pom.xml (maven) | present` names a file without naming a single package or
   * version, which is not grounding. This module now renders real coordinates.
   *
   * Pure, zero-dependency, deterministic.
   *
   * @param {string[]} files — absolute file paths (unused; roots are read directly)
   * @param {string}   cwd   — project root
   * @returns {string} formatted markdown table (empty string if none found)
   */

  const fs = require('fs');
  const path = require('path');
  const { collectDependencies, versionPins } = __require('./src/deps/inventory');

  const CONFIG_FILES = [
    'tsconfig.json', 'jsconfig.json', '.eslintrc', '.eslintrc.json', '.eslintrc.js',
    '.prettierrc', 'babel.config.js', 'jest.config.js', 'vitest.config.ts',
    'webpack.config.js', 'vite.config.ts', 'rollup.config.js', 'tailwind.config.js',
    'docker-compose.yml', 'docker-compose.yaml', 'Dockerfile', '.editorconfig',
  ];

  const PIN_LIMIT = 30;

  /** Human ecosystem label for a manifest row. */
  const ECOSYSTEM_LABEL = {
    npm: 'npm', pypi: 'python', maven: 'maven', go: 'go', cargo: 'rust',
    rubygems: 'ruby', composer: 'php', nuget: 'dotnet', pub: 'dart',
  };

  /** `12 runtime, 3 dev` — scope counts for one manifest, most-important first. */
  function scopeSummary(deps) {
    const order = ['runtime', 'dev', 'test', 'peer', 'optional', 'build', 'indirect'];
    const counts = new Map();
    for (const d of deps) counts.set(d.scope, (counts.get(d.scope) || 0) + 1);
    const parts = [];
    for (const scope of order) {
      if (counts.has(scope)) parts.push(`${counts.get(scope)} ${scope}`);
    }
    for (const [scope, n] of [...counts].sort()) {
      if (!order.includes(scope)) parts.push(`${n} ${scope}`);
    }
    return parts.length ? parts.join(', ') : 'none declared';
  }

  function configFiles(cwd) {
    const present = [];
    for (const f of CONFIG_FILES) {
      if (fs.existsSync(path.join(cwd, f))) present.push(f);
    }
    return present;
  }

  function analyze(files, cwd) {
    let inventory = { deps: [], manifests: [], ecosystems: [], truncated: 0 };
    try {
      inventory = collectDependencies(cwd);
    } catch (_) { /* a repo with no readable manifest still lists config files */ }

    const configs = configFiles(cwd);
    if (inventory.manifests.length === 0 && configs.length === 0) return '';

    const lines = [];
    if (inventory.manifests.length) {
      lines.push('| Manifest | Project | Dependencies |', '|----------|---------|--------------|');
      for (const m of inventory.manifests) {
        const label = ECOSYSTEM_LABEL[m.ecosystem] || m.ecosystem;
        const id = [m.name, m.version].filter(Boolean).join('@') || '—';
        const mine = inventory.deps.filter((d) => d.file === m.file);
        lines.push(`| \`${m.file}\` (${label}) | ${id} | ${scopeSummary(mine)} |`);
      }

      // Exact pins are the densest grounding available: a model that knows
      // express@5.1.4 stops writing Express 4 API.
      const { pins, total } = versionPins(inventory, { limit: PIN_LIMIT });
      if (pins.length) {
        lines.push('');
        const shown = pins.map((p) => '`' + p + '`').join(', ');
        lines.push(`**Direct dependencies:** ${shown}${total > pins.length ? ` … +${total - pins.length} more` : ''}`);
      }
      if (inventory.truncated > 0) {
        lines.push('');
        lines.push(`> ${inventory.truncated} dependency row(s) omitted to stay within the per-manifest cap.`);
      }
    }

    if (configs.length) {
      if (lines.length) lines.push('');
      lines.push(`**Config files:** ${configs.map((c) => '`' + c + '`').join(', ')}`);
    }
    return lines.join('\n');
  }

  module.exports = { analyze };
  
};

// ── ./src/map/env-schema ──
__factories["./src/map/env-schema"] = function(module, exports) {
  
  /**
   * Environment-variable schema extractor (v8.5 C1).
   *
   * Surfaces the environment the project actually reads — from source across
   * JS/TS, Python, Ruby, and Go, plus keys declared in a committed `.env.example`
   * / `.env.sample` / `.env.template`. Pure, zero-dependency, deterministic.
   *
   * @param {string[]} files — absolute file paths to analyze (srcDirs-scoped)
   * @param {string}   cwd   — project root
   * @returns {string} formatted markdown table (empty string if none found)
   */

  const fs = require('fs');
  const path = require('path');

  const SCAN_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.rb', '.go']);
  const EXAMPLE_FILES = ['.env.example', '.env.sample', '.env.template', '.env.dist'];

  // process.env.X / process.env['X'] / import.meta.env.X / Deno.env.get('X')
  const JS_RE = /(?:process\.env|import\.meta\.env)(?:\.([A-Z_][A-Z0-9_]*)|\[\s*['"]([A-Z_][A-Z0-9_]*)['"]\s*\])|Deno\.env\.get\(\s*['"]([A-Z_][A-Z0-9_]*)['"]/g;
  // os.environ['X'] / os.environ.get('X') / os.getenv('X') / getenv('X')
  const PY_RE = /(?:os\.)?(?:environ(?:\.get)?\[?\s*['"]([A-Z_][A-Z0-9_]*)['"]|getenv\(\s*['"]([A-Z_][A-Z0-9_]*)['"])/g;
  const RB_RE = /ENV\[\s*['"]([A-Z_][A-Z0-9_]*)['"]\s*\]/g;
  const GO_RE = /os\.(?:Getenv|LookupEnv)\(\s*["`']([A-Z_][A-Z0-9_]*)["`']/g;

  const MAX_ROWS = 200;

  function collectMatches(re, content, into) {
    let m;
    re.lastIndex = 0;
    while ((m = re.exec(content)) !== null) {
      const name = m[1] || m[2] || m[3];
      if (name) into.add(name);
    }
  }

  function readExampleKeys(cwd) {
    const keys = new Set();
    for (const name of EXAMPLE_FILES) {
      let content;
      try { content = fs.readFileSync(path.join(cwd, name), 'utf8'); } catch (_) { continue; }
      for (const line of content.split('\n')) {
        const t = line.trim();
        if (!t || t.startsWith('#')) continue;
        const eq = t.match(/^(?:export\s+)?([A-Z_][A-Z0-9_]*)\s*=/);
        if (eq) keys.add(eq[1]);
      }
    }
    return keys;
  }

  /**
   * Structured env reads with per-file attribution (#629): one row per variable,
   * reader files repo-relative and sorted, plus the committed-example flag.
   * @returns {Array<{name: string, files: string[], inExample: boolean}>}
   */
  function collectEnvReads(files, cwd) {
    const readers = new Map(); // name → Set<rel file>

    for (const filePath of files) {
      const ext = path.extname(filePath).toLowerCase();
      if (!SCAN_EXTS.has(ext)) continue;
      let content;
      try { content = fs.readFileSync(filePath, 'utf8'); } catch (_) { continue; }

      const found = new Set();
      if (ext === '.py') collectMatches(PY_RE, content, found);
      else if (ext === '.rb') collectMatches(RB_RE, content, found);
      else if (ext === '.go') collectMatches(GO_RE, content, found);
      else collectMatches(JS_RE, content, found);
      if (found.size === 0) continue;

      const rel = path.relative(cwd, filePath).replace(/\\/g, '/');
      for (const name of found) {
        if (!readers.has(name)) readers.set(name, new Set());
        readers.get(name).add(rel);
      }
    }

    const fromExample = readExampleKeys(cwd);
    const names = [...new Set([...readers.keys(), ...fromExample])].sort();
    return names.map((name) => ({
      name,
      files: [...(readers.get(name) || [])].sort(),
      inExample: fromExample.has(name),
    }));
  }

  function analyze(files, cwd) {
    const rows = collectEnvReads(files, cwd);
    if (rows.length === 0) return '';

    const lines = [
      '| Variable | Source |',
      '|----------|--------|',
    ];
    for (const r of rows.slice(0, MAX_ROWS)) {
      const src = [];
      if (r.files.length > 0) src.push('code');
      if (r.inExample) src.push('.env.example');
      lines.push(`| ${r.name} | ${src.join(', ')} |`);
    }
    if (rows.length > MAX_ROWS) {
      lines.push(`| … | +${rows.length - MAX_ROWS} more |`);
    }
    return lines.join('\n');
  }

  module.exports = { analyze, collectEnvReads };
  
};

// ── ./src/map/import-graph ──
__factories["./src/map/import-graph"] = function(module, exports) {
  
  /**
   * Import graph analyzer.
   * Extracts relative import relationships from JS/TS/Python files
   * and detects circular dependencies.
   *
   * @param {string[]} files — absolute file paths to analyze
   * @param {string}   cwd   — project root for relative path display
   * @returns {string} formatted section content (empty string if nothing found)
   */

  const fs = require('fs');
  const path = require('path');

  const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
  const PY_EXTS = new Set(['.py', '.pyw']);

  // ---------------------------------------------------------------------------
  // Import extraction per language
  // ---------------------------------------------------------------------------
  function extractImports(filePath, content, fileSet) {
    const ext = path.extname(filePath).toLowerCase();
    const dir = path.dirname(filePath);
    const found = [];

    if (JS_EXTS.has(ext)) {
      // ES: import ... from './foo'  or  import './side-effect'
      const re1 = /(?:^|[\r\n])\s*import\s+(?:[^'";\r\n]*?\s+from\s+)?['"](\.[^'"]+)['"]/g;
      let m;
      while ((m = re1.exec(content)) !== null) {
        const resolved = resolveJsPath(dir, m[1], fileSet);
        if (resolved) found.push(resolved);
      }
      // CommonJS: __require('./src/map/foo')
      const re2 = /\brequire\s*\(\s*['"](\.[^'"]+)['"]\s*\)/g;
      while ((m = re2.exec(content)) !== null) {
        const resolved = resolveJsPath(dir, m[1], fileSet);
        if (resolved) found.push(resolved);
      }
    }

    if (PY_EXTS.has(ext)) {
      // Relative imports: from .module import ...  /  from ..pkg import ...
      const reRel = /^[ \t]*from\s+(\.+[\w.]*)\s+import/gm;
      let m;
      while ((m = reRel.exec(content)) !== null) {
        const dotCount = (m[1].match(/^\.+/) || [''])[0].length;
        const modPart = m[1].slice(dotCount).replace(/\./g, '/');
        let base = dir;
        for (let i = 1; i < dotCount; i++) base = path.dirname(base);
        const candidate = modPart ? path.join(base, modPart + '.py') : null;
        if (candidate && fileSet.has(candidate)) found.push(candidate);
      }

      // Absolute imports: from package.module import ... (infer from project structure)
      const reAbs = /^[ \t]*from\s+([\w.]+)\s+import/gm;
      while ((m = reAbs.exec(content)) !== null) {
        const modulePath = m[1].replace(/\./g, '/');
        const candidates = [
          path.join(dir, modulePath + '.py'),
          path.join(dir, modulePath, '__init__.py'),
          path.resolve(dir, '..', modulePath + '.py'),
          path.resolve(dir, '..', modulePath, '__init__.py'),
        ];
        for (const c of candidates) {
          if (fileSet.has(c)) {
            found.push(c);
            break;
          }
        }
      }
    }

    return [...new Set(found)];
  }

  function resolveJsPath(dir, importStr, fileSet) {
    const base = path.resolve(dir, importStr);
    const candidates = [
      base,
      base + '.ts', base + '.tsx',
      base + '.js', base + '.jsx', base + '.mjs', base + '.cjs',
      base + '/index.ts', base + '/index.tsx',
      base + '/index.js', base + '/index.jsx', base + '/index.mjs',
    ];
    for (const c of candidates) {
      if (fileSet.has(c)) return c;
    }

    // Fallback: check if base itself is already a valid file (handles .ts/.js already in path)
    if (fileSet.has(base)) return base;

    return null;
  }

  // ---------------------------------------------------------------------------
  // Cycle detection (DFS with path tracking)
  // ---------------------------------------------------------------------------
  function detectCycles(graph) {
    const cycles = [];
    const visited = new Set();
    const onStack = new Set();
    const stackArr = [];

    function dfs(node) {
      if (onStack.has(node)) {
        const start = stackArr.indexOf(node);
        if (start !== -1) cycles.push([...stackArr.slice(start), node]);
        return;
      }
      if (visited.has(node)) return;

      onStack.add(node);
      stackArr.push(node);
      for (const dep of (graph.get(node) || [])) dfs(dep);
      stackArr.pop();
      onStack.delete(node);
      visited.add(node);
    }

    for (const node of graph.keys()) {
      if (!visited.has(node)) dfs(node);
    }
    return cycles;
  }

  // ---------------------------------------------------------------------------
  // Build reverse graph (for caller detection)
  // ---------------------------------------------------------------------------
  function buildReverseGraph(graph) {
    const reverse = new Map();
    for (const [file, deps] of graph.entries()) {
      for (const dep of deps) {
        if (!reverse.has(dep)) reverse.set(dep, []);
        reverse.get(dep).push(file);
      }
    }
    return reverse;
  }

  // ---------------------------------------------------------------------------
  // Public API
  // ---------------------------------------------------------------------------
  function analyze(files, cwd) {
    const fileSet = new Set(files.map((f) => path.resolve(f)));
    const graph = new Map();

    for (const filePath of files) {
      let content;
      try { content = fs.readFileSync(filePath, 'utf8'); } catch (_) { continue; }
      const deps = extractImports(path.resolve(filePath), content, fileSet);
      if (deps.length > 0) graph.set(path.resolve(filePath), deps);
    }

    if (graph.size === 0) return '';

    const cycles = detectCycles(graph);
    const cycleNodeSet = new Set(cycles.flatMap((c) => c));

    const lines = [];
    const sorted = [...graph.entries()].sort((a, b) => a[0].localeCompare(b[0]));

    for (const [fp, deps] of sorted) {
      const rel = path.relative(cwd, fp).replace(/\\/g, '/');
      const depList = deps.map((d) => {
        const drel = path.relative(cwd, d).replace(/\\/g, '/');
        return cycleNodeSet.has(d) ? `${drel} ⚠` : drel;
      });
      lines.push(`${rel} → ${depList.join(', ')}`);
    }

    if (cycles.length > 0) {
      lines.push('');
      lines.push('Circular dependencies detected:');
      for (const cycle of cycles) {
        const relPath = cycle.map((n) => path.relative(cwd, n).replace(/\\/g, '/')).join(' → ');
        lines.push(`  ⚠ ${relPath}`);
      }
    }

    return lines.join('\n');
  }

  module.exports = { analyze, extractImports, buildReverseGraph, resolveJsPath, detectCycles };
  
};

// ── ./src/map/knowledge-map ──
__factories["./src/map/knowledge-map"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');
  const { buildFromCwd } = __require('./src/graph/builder');
  const { buildCallFileGraph } = __require('./src/graph/call-graph');
  const { buildSigIndex } = __require('./src/retrieval/ranker');
  const { parseAnchor, findRelatedTests } = __require('./src/evidence/pack');
  const { directDeps, collectVersionPins } = __require('./src/verify/lib-index');
  const { collectRoutes } = __require('./src/map/route-table');
  const { collectEnvReads } = __require('./src/map/env-schema');
  const { collectMigrations } = __require('./src/map/migrations');
  const { collectTargets } = __require('./src/map/build-ci');
  const { isSelfIgnore } = __require('./src/util/context-dir');

  // Unified knowledge map (#626, increment 1 of #543). SigMap already computes
  // the pieces — import graph, call-file graph, signature index, installed
  // library pins, route table, impl↔test discovery — but they live behind
  // separate tools. This assembles them into ONE typed, deterministic store.
  //
  // ── Schema draft (v3) ──────────────────────────────────────────────────────
  // Node ids (also the sort key):
  //   file:<rel-path>          symbol:<rel-path>#<name> (anchor start-end kept)
  //   lib:<name>@<version>     route:<METHOD> <path>
  //   env:<NAME>               migration:<rel-path>     script:<runner>:<name>
  // Edge kinds, serialized as { from, kind, to }:
  //   imports        file → file          (import graph)
  //   calls          file → file          (call-file graph)
  //   defines        file → symbol       (signature index, with anchors)
  //   tests          test-file → file    (impl↔test discovery)
  //   uses-lib       file → lib          (bare imports matching declared deps)
  //   exposes-route  file → route        (route table)
  //   reads-env      file → env          (per-file env reads, #629)
  // v3 (#632): file nodes carry a `tokens` estimate (chars/4 over signatures);
  // graph endpoints missing from the signature index still get file nodes.
  // v4 (#934): the import graph follows the detected source roots. A v3 map of a
  // zero-config repo holds an empty or partial graph, and its cache key (the
  // newest `.context` mtime) does not move on upgrade — so the bump is what makes
  // `get_impact` rebuild it once instead of answering from the old graph.
  // Serialization: nodes sorted by id, edges by (from, kind, to), keys sorted
  // recursively — two builds of the same tree are byte-identical. Symbol nodes
  // are capped per file and the cap is disclosed in `truncated`.

  const SCHEMA_VERSION = 4;
  const MAX_SYMBOLS_PER_FILE = 50;
  const CACHE_FILE = 'knowledge-map.json';

  const _rel = (cwd, f) => path.relative(cwd, f).replace(/\\/g, '/');

  /** Stable stringify: object keys sorted recursively (evidence-pack pattern). */
  function _sortKeys(value) {
    if (Array.isArray(value)) return value.map(_sortKeys);
    if (value && typeof value === 'object') {
      const out = {};
      for (const k of Object.keys(value).sort()) out[k] = _sortKeys(value[k]);
      return out;
    }
    return value;
  }
  function canonicalJson(value) {
    return JSON.stringify(_sortKeys(value), null, 1);
  }

  /** Bare (non-relative) import specifiers in a JS/TS source, root package only. */
  function _bareImports(src) {
    const out = new Set();
    const stripped = String(src).replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
    for (const m of stripped.matchAll(/(?:from\s+|require\s*\(\s*|import\s*\(\s*)['"]([^'".][^'"]*)['"]/g)) {
      const spec = m[1];
      const root = spec.startsWith('@') ? spec.split('/').slice(0, 2).join('/') : spec.split('/')[0];
      out.add(root);
    }
    return out;
  }

  /**
   * Build the unified knowledge map for a repo from existing producers.
   * Deterministic: same tree in, byte-identical store out.
   * @param {string} cwd
   * @returns {{ schema: number, nodes: object[], edges: object[], truncated: string[] }}
   */
  function buildKnowledgeMap(cwd) {
    // The graph builder lowercases absolute node keys, and macOS tmpdirs are
    // symlinks — resolve the root and match graph nodes via a lowercased
    // abs→rel lookup or every membership check silently misses.
    try { cwd = fs.realpathSync(cwd); } catch (_) {}
    const nodes = new Map(); // id → node
    const edges = new Set(); // canonical "from\u0000kind\u0000to"
    const truncated = [];
    const addNode = (node) => { if (!nodes.has(node.id)) nodes.set(node.id, node); };
    const addEdge = (from, kind, to) => { edges.add(`${from}\u0000${kind}\u0000${to}`); };

    // Files + symbols + defines — from the signature index (anchors included).
    const sigIndex = buildSigIndex(cwd);
    const relFiles = [...sigIndex.keys()].map((f) => f.replace(/\\/g, '/')).sort();
    for (const rel of relFiles) {
      const sigs = sigIndex.get(rel) || sigIndex.get(rel.replace(/\//g, path.sep)) || [];
      addNode({ id: `file:${rel}`, kind: 'file', tokens: Math.ceil(sigs.join('\n').length / 4) });
      let emitted = 0;
      for (const sig of sigs) {
        const { symbol, start, end } = parseAnchor(sig);
        const nameMatch = /([A-Za-z_$][\w$]*)\s*(?:\(|=|:|$)/.exec(symbol.replace(/^[\s#]*(?:export\s+|async\s+|function\s+|class\s+|def\s+|defp\s+|fn\s+|pub\s+fn\s+|module\.exports\s*=?\s*)?/, ''));
        if (!nameMatch) continue;
        if (emitted >= MAX_SYMBOLS_PER_FILE) { truncated.push(`file:${rel}`); break; }
        emitted++;
        const id = `symbol:${rel}#${nameMatch[1]}`;
        addNode(start ? { id, kind: 'symbol', anchor: `${start}-${end}` } : { id, kind: 'symbol' });
        addEdge(`file:${rel}`, 'defines', id);
      }
    }

    // Imports — the file dependency graph.
    const absToRel = new Map(relFiles.map((r) => [path.join(cwd, r).toLowerCase(), r]));
    const relOf = (abs) => absToRel.get(String(abs).toLowerCase());
    const relOfGraphKey = (abs) => {
      const hit = relOf(abs);
      if (hit) return hit;
      const key = String(abs);
      try {
        const real = fs.realpathSync(key);
        if (real.toLowerCase().startsWith(cwd.toLowerCase() + path.sep)) {
          return real.slice(cwd.length + 1).replace(/\\/g, '/');
        }
      } catch (_) {
        // Graph keys are lowercased (graphKey), so on a case-sensitive fs the
        // realpath probe fails whenever the true path has uppercase — prefix-
        // match the lowercased cwd instead of dropping the file (#635/#636 CI).
        if (key.toLowerCase().startsWith(cwd.toLowerCase() + path.sep)) {
          return key.slice(cwd.length + 1).replace(/\\/g, '/');
        }
      }
      return null;
    };
    const importGraph = buildFromCwd(cwd);
    for (const [from, tos] of importGraph.forward) {
      const fromRel = relOfGraphKey(from);
      if (!fromRel) continue;
      for (const to of tos || []) {
        const toRel = relOfGraphKey(to);
        if (!toRel) continue;
        addNode({ id: `file:${fromRel}`, kind: 'file', tokens: 0 });
        addNode({ id: `file:${toRel}`, kind: 'file', tokens: 0 });
        addEdge(`file:${fromRel}`, 'imports', `file:${toRel}`);
      }
    }

    // Calls — file-level call-graph edges (may be empty for uncovered languages).
    try {
      const callGraph = buildCallFileGraph(cwd);
      for (const [from, tos] of callGraph.forward || []) {
        const fromRel = relOf(from);
        if (!fromRel) continue;
        for (const to of tos || []) {
          const toRel = relOf(to);
          if (toRel) addEdge(`file:${fromRel}`, 'calls', `file:${toRel}`);
        }
      }
    } catch (_) {}

    // Libraries + uses-lib — declared deps with installed versions, bound to
    // the files whose bare imports name them.
    const deps = new Set(directDeps(cwd));
    const pins = collectVersionPins(cwd).pins; // "name@version"
    const versionOf = new Map(pins.map((p) => {
      const at = p.lastIndexOf('@');
      return [p.slice(0, at), p.slice(at + 1)];
    }));
    const libId = (name) => `lib:${name}@${versionOf.get(name) || 'unknown'}`;
    if (deps.size > 0) {
      for (const rel of relFiles) {
        if (!/\.(ts|tsx|js|jsx|mjs|cjs)$/.test(rel)) continue;
        let src;
        try { src = fs.readFileSync(path.join(cwd, rel), 'utf8'); } catch (_) { continue; }
        for (const spec of _bareImports(src)) {
          if (!deps.has(spec)) continue;
          addNode({ id: libId(spec), kind: 'library', name: spec, version: versionOf.get(spec) || null });
          addEdge(`file:${rel}`, 'uses-lib', libId(spec));
        }
      }
    }

    // Tests — impl↔test discovery from the evidence pack.
    for (const rel of relFiles) {
      for (const t of findRelatedTests(rel, relFiles)) {
        addEdge(`file:${t}`, 'tests', `file:${rel}`);
      }
    }

    // Routes.
    const absFiles = relFiles.map((r) => path.join(cwd, r));
    try {
      for (const r of collectRoutes(absFiles, cwd) || []) {
        if (!r.method || !r.path) continue;
        const id = `route:${r.method} ${r.path}`;
        addNode({ id, kind: 'route', method: r.method, path: r.path });
        // collectRoutes already returns repo-relative paths.
        const routeRel = r.file && (relOf(r.file) || (nodes.has(`file:${r.file}`) ? r.file : null));
        if (routeRel) addEdge(`file:${routeRel}`, 'exposes-route', id);
      }
    } catch (_) {}

    // Env vars + reads-env — per-file attribution from the env-schema collector.
    try {
      for (const row of collectEnvReads(absFiles, cwd) || []) {
        const id = `env:${row.name}`;
        addNode({ id, kind: 'env-var', name: row.name, inExample: row.inExample });
        for (const rel of row.files) {
          if (nodes.has(`file:${rel}`)) addEdge(`file:${rel}`, 'reads-env', id);
        }
      }
    } catch (_) {}

    // Migrations — files outside srcDirs get nodes of their own.
    try {
      for (const m of collectMigrations(cwd) || []) {
        addNode({ id: `migration:${m.file}`, kind: 'migration', version: m.version, name: m.name });
      }
    } catch (_) {}

    // Scripts — npm scripts, CI workflows, and Makefile targets.
    try {
      for (const t of collectTargets(cwd) || []) {
        addNode({ id: `script:${t.kind}:${t.name}`, kind: 'script', runner: t.kind, name: t.name, detail: t.detail });
      }
    } catch (_) {}

    return {
      schema: SCHEMA_VERSION,
      nodes: [...nodes.values()].sort((a, b) => a.id.localeCompare(b.id)),
      edges: [...edges].sort().map((e) => {
        const [from, kind, to] = e.split('\u0000');
        return { from, kind, to };
      }),
      truncated: [...new Set(truncated)].sort(),
    };
  }

  /** Load from .context cache (keyed by newest context mtime) or build fresh. */
  function loadOrBuild(cwd) {
    try { cwd = fs.realpathSync(cwd); } catch (_) {}
    const cachePath = path.join(cwd, '.context', CACHE_FILE);
    let ctxMtime = 0;
    try {
      for (const f of fs.readdirSync(path.join(cwd, '.context'))) {
        // live.json is watcher telemetry, *.tmp is a write in flight and .gitignore is the
        // directory's own ignore file (#947): none of them changes the index.
        if (f === CACHE_FILE || f === 'live.json' || f.endsWith('.tmp') || isSelfIgnore(f)) continue;
        const st = fs.statSync(path.join(cwd, '.context', f));
        if (st.mtimeMs > ctxMtime) ctxMtime = st.mtimeMs;
      }
    } catch (_) {}
    try {
      const cached = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
      if (cached.schema === SCHEMA_VERSION && cached.builtFor === ctxMtime) return cached;
    } catch (_) {}
    const map = buildKnowledgeMap(cwd);
    map.builtFor = ctxMtime;
    try {
      fs.mkdirSync(path.dirname(cachePath), { recursive: true });
      fs.writeFileSync(cachePath, canonicalJson(map));
    } catch (_) {}
    return map;
  }

  /**
   * Upgrade-impact walk: lib → importing files → their callers/importers →
   * the tests covering any file in the blast set.
   */
  function upgradeImpact(map, libraryName) {
    const lib = map.nodes.find((n) => n.kind === 'library' && n.name === libraryName);
    if (!lib) return null;
    const importers = map.edges.filter((e) => e.kind === 'uses-lib' && e.to === lib.id).map((e) => e.from);
    const importerSet = new Set(importers);
    const callers = new Set();
    for (const e of map.edges) {
      if ((e.kind === 'calls' || e.kind === 'imports') && importerSet.has(e.to) && !importerSet.has(e.from)) {
        callers.add(e.from);
      }
    }
    const blast = new Set([...importers, ...callers]);
    const tests = new Set();
    for (const e of map.edges) {
      if (e.kind === 'tests' && blast.has(e.to)) tests.add(e.from);
    }
    return {
      library: lib.id,
      importers: importers.sort(),
      callers: [...callers].sort(),
      tests: [...tests].sort(),
    };
  }

  /**
   * Impact of changing one file, computed from the store's `imports` edges with
   * the same BFS semantics as src/graph/impact (direct = level 1, transitive =
   * deeper, depth 0 = unlimited). Tests/routes are the pattern-classified sets
   * the old path produced, enriched with the store's discovered `tests` and
   * `exposes-route` edges (supersets, never smaller). Result shape matches
   * getImpact() so formatImpact renders it unchanged.
   */
  function impactView(map, relFile, depth, cwd) {
    const { isTestFile, isRouteFile } = __require('./src/graph/impact');
    const rel = String(relFile).replace(/\\/g, '/');
    const id = `file:${rel}`;
    const reverse = new Map();
    for (const e of map.edges) {
      if (e.kind !== 'imports') continue;
      if (!reverse.has(e.to)) reverse.set(e.to, []);
      reverse.get(e.to).push(e.from);
    }
    const direct = new Set();
    const transitive = new Set();
    const visited = new Set([id]);
    for (const f of reverse.get(id) || []) {
      if (!visited.has(f)) { direct.add(f); visited.add(f); }
    }
    if (depth !== 1) {
      let frontier = [...direct];
      let d = 1;
      while (frontier.length > 0 && (depth === 0 || d < depth)) {
        const next = [];
        for (const node of frontier) {
          for (const imp of reverse.get(node) || []) {
            if (!visited.has(imp)) { transitive.add(imp); visited.add(imp); next.push(imp); }
          }
        }
        frontier = next;
        d++;
      }
    }
    const strip = (x) => x.replace(/^file:/, '');
    const impacted = [...direct, ...transitive].map(strip);
    const tests = impacted.filter(isTestFile);
    const testSet = new Set(tests);
    const coverTargets = new Set([id, ...impacted.map((r) => `file:${r}`)]);
    const extraTests = [];
    for (const e of map.edges) {
      if (e.kind === 'tests' && coverTargets.has(e.to) && !testSet.has(strip(e.from))) {
        testSet.add(strip(e.from));
        extraTests.push(strip(e.from));
      }
    }
    const routeFiles = new Set(map.edges.filter((e) => e.kind === 'exposes-route').map((e) => strip(e.from)));
    const routes = impacted.filter((f) => isRouteFile(f) || routeFiles.has(f));
    // `get_impact` reads this view, not `getImpact`, so it needs the same
    // "not tracked" marking for files whose language the import graph cannot read (#979).
    return __require('./src/graph/language-support').markImpact({
      changed: rel,
      direct: [...direct].map(strip),
      transitive: [...transitive].map(strip),
      tests: tests.concat(extraTests.sort()),
      routes,
      totalImpact: direct.size + transitive.size,
    }, { cwd });
  }

  /**
   * Architecture rollup from the store: module token table, hub files by
   * reverse-import degree, dependency-cycle count, and the route total.
   */
  function architectureView(map) {
    const files = map.nodes.filter((n) => n.kind === 'file');
    const groups = {};
    let totalTokens = 0;
    for (const n of files) {
      const rel = n.id.slice(5);
      const parts = rel.split('/');
      const mod = parts.length > 1 ? parts[0] : '.';
      const tok = n.tokens || 0;
      if (!groups[mod]) groups[mod] = { files: 0, tokens: 0 };
      groups[mod].files++;
      groups[mod].tokens += tok;
      totalTokens += tok;
    }
    const modules = Object.entries(groups)
      .map(([mod, d]) => ({ mod, files: d.files, tokens: d.tokens }))
      .sort((a, b) => b.tokens - a.tokens);
    const inDeg = new Map();
    const forward = new Map();
    for (const e of map.edges) {
      if (e.kind !== 'imports') continue;
      const from = e.from.slice(5);
      const to = e.to.slice(5);
      inDeg.set(to, (inDeg.get(to) || 0) + 1);
      if (!forward.has(from)) forward.set(from, []);
      forward.get(from).push(to);
    }
    const hubs = [...inDeg.entries()]
      .map(([file, count]) => ({ file, in: count }))
      .sort((a, b) => b.in - a.in || (a.file < b.file ? -1 : 1))
      .slice(0, 10);
    let cycles = 0;
    try { cycles = __require('./src/map/import-graph').detectCycles(forward).length; } catch (_) {}
    const routes = map.nodes.filter((n) => n.kind === 'route').length;
    return { totalFiles: files.length, totalTokens, modules, hubs, cycles, routes };
  }

  /** Readers of one env var: the files that read it, and the committed-example flag. */
  function envReaders(map, name) {
    const id = `env:${name}`;
    const node = map.nodes.find((n) => n.id === id);
    if (!node) return null;
    const readers = map.edges.filter((e) => e.kind === 'reads-env' && e.to === id).map((e) => e.from).sort();
    return { env: id, inExample: !!node.inExample, readers };
  }

  /**
   * Related tests per file, from the store's `tests` edges (test → impl) — the
   * evidence view (#635). One edge pass for a whole file list; keys are the
   * caller's original path strings, and files absent from the store are omitted
   * so callers can fall back to per-file discovery.
   * @param {object} map
   * @param {string[]} rels
   * @returns {Map<string, string[]>} input path → sorted test rel paths
   */
  function relatedTestsView(map, rels) {
    const want = new Map(); // "file:<rel>" → original input string
    for (const r of rels || []) {
      const orig = String(r);
      want.set(`file:${orig.replace(/\\/g, '/')}`, orig);
    }
    const out = new Map();
    for (const n of map.nodes) {
      if (want.has(n.id)) out.set(want.get(n.id), []);
    }
    for (const e of map.edges) {
      if (e.kind !== 'tests') continue;
      const orig = want.get(e.to);
      if (orig !== undefined && out.has(orig)) out.get(orig).push(e.from.slice(5));
    }
    for (const list of out.values()) list.sort();
    return out;
  }

  /** Typed neighbors of one file node. */
  function fileNeighbors(map, rel) {
    const id = `file:${rel.replace(/\\/g, '/')}`;
    if (!map.nodes.some((n) => n.id === id)) return null;
    const out = { imports: [], importedBy: [], calls: [], calledBy: [], tests: [], testedBy: [], usesLibs: [], defines: [], routes: [], readsEnv: [] };
    for (const e of map.edges) {
      if (e.from === id) {
        if (e.kind === 'imports') out.imports.push(e.to);
        else if (e.kind === 'calls') out.calls.push(e.to);
        else if (e.kind === 'tests') out.tests.push(e.to);
        else if (e.kind === 'uses-lib') out.usesLibs.push(e.to);
        else if (e.kind === 'defines') out.defines.push(e.to);
        else if (e.kind === 'exposes-route') out.routes.push(e.to);
        else if (e.kind === 'reads-env') out.readsEnv.push(e.to);
      } else if (e.to === id) {
        if (e.kind === 'imports') out.importedBy.push(e.from);
        else if (e.kind === 'calls') out.calledBy.push(e.from);
        else if (e.kind === 'tests') out.testedBy.push(e.from);
      }
    }
    for (const k of Object.keys(out)) out[k].sort();
    return out;
  }

  module.exports = { buildKnowledgeMap, loadOrBuild, upgradeImpact, fileNeighbors, envReaders, impactView, architectureView, relatedTestsView, canonicalJson, SCHEMA_VERSION };
  
};

// ── ./src/map/migrations ──
__factories["./src/map/migrations"] = function(module, exports) {
  
  /**
   * Database-migration extractor (v8.5 C1).
   *
   * Detects schema-migration files across the common frameworks — Rails
   * (db/migrate), Django/Alembic, Prisma, Flyway (`V1__name.sql`), knex/Sequelize,
   * and timestamped SQL — and surfaces them with a parsed version + name. Pure,
   * zero-dependency, deterministic.
   *
   * @param {string[]} files — absolute file paths (unused; the tree is walked)
   * @param {string}   cwd   — project root
   * @returns {string} formatted markdown table (empty string if none found)
   */

  const fs = require('fs');
  const path = require('path');

  const MAX_DEPTH = 6;
  const MAX_ROWS = 200;
  const SKIP_DIR = new Set(['.git', 'node_modules', 'vendor', 'dist', 'build', 'target', '.venv', 'venv', '__pycache__']);
  const MIG_EXT = new Set(['.sql', '.rb', '.py', '.js', '.ts']);

  // A directory whose path marks its children as migrations.
  const MIG_DIR_RE = /(^|\/)(db\/migrate|migrations?|alembic\/versions|prisma\/migrations)$/i;
  // A filename that is itself a migration regardless of directory.
  const FLYWAY_RE = /^V\d+(?:[._]\d+)*__(.+)\.(sql|java)$/;
  const TIMESTAMP_RE = /^(\d{8,})[_-](.+)\.(sql|rb|py|js|ts)$/;
  const NAMED_RE = /[._-]migrations?[._-]/i;

  function walk(dir, cwd, depth, out) {
    if (depth > MAX_DEPTH) return;
    let entries;
    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));

    const relDir = path.relative(cwd, dir).replace(/\\/g, '/');
    const dirIsMigration = MIG_DIR_RE.test(relDir);

    for (const e of entries) {
      if (e.isDirectory()) {
        if (SKIP_DIR.has(e.name)) continue;
        walk(path.join(dir, e.name), cwd, depth + 1, out);
        continue;
      }
      const ext = path.extname(e.name).toLowerCase();
      if (!MIG_EXT.has(ext)) continue;

      const rel = path.relative(cwd, path.join(dir, e.name)).replace(/\\/g, '/');
      let version = null;
      let name = null;

      let m;
      if ((m = e.name.match(FLYWAY_RE))) { version = e.name.split('__')[0]; name = m[1].replace(/_/g, ' '); }
      else if ((m = e.name.match(TIMESTAMP_RE))) { version = m[1]; name = m[2].replace(/[_-]/g, ' '); }
      else if (dirIsMigration) { version = '—'; name = e.name.replace(ext, ''); }
      else if (NAMED_RE.test(e.name)) { version = '—'; name = e.name.replace(ext, ''); }
      else continue;

      out.push({ version, name, file: rel });
    }
  }

  /**
   * Structured migration rows (#629), sorted by repo-relative file path.
   * @returns {Array<{version: string, name: string, file: string}>}
   */
  function collectMigrations(cwd) {
    const found = [];
    walk(cwd, cwd, 0, found);
    found.sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : 0));
    return found;
  }

  function analyze(files, cwd) {
    const found = collectMigrations(cwd);
    if (found.length === 0) return '';

    const lines = [
      '| Version | Migration | File |',
      '|---------|-----------|------|',
    ];
    for (const r of found.slice(0, MAX_ROWS)) {
      lines.push(`| ${r.version} | ${r.name} | ${r.file} |`);
    }
    if (found.length > MAX_ROWS) {
      lines.push(`| … | +${found.length - MAX_ROWS} more | |`);
    }
    return lines.join('\n');
  }

  module.exports = { analyze, collectMigrations };
  
};

// ── ./src/map/route-table ──
__factories["./src/map/route-table"] = function(module, exports) {
  
  /**
   * HTTP route table extractor.
   * Detects routes in Express, Fastify, NestJS, Flask, FastAPI, Gin, Spring.
   *
   * @param {string[]} files — absolute file paths to analyze
   * @param {string}   cwd   — project root for relative path display
   * @returns {string} formatted markdown table (empty string if no routes found)
   */

  const fs = require('fs');
  const path = require('path');

  const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
  const PY_EXTS = new Set(['.py', '.pyw']);

  function shouldSkipFile(rel) {
    const normalized = rel.replace(/\\/g, '/').toLowerCase();
    return /(^|\/)(gen-context|gen-project-map)\.js$/.test(normalized);
  }

  /**
   * Byte offsets and prefixes of every `@Controller(...)` in a file.
   * A file may declare several controllers, so each route is attributed to the
   * nearest one above it rather than to a single file-wide prefix.
   * @param {string} content
   * @returns {Array<{index:number, prefix:string}>} ascending by index
   */
  function nestControllerPrefixes(content) {
    const out = [];
    const re = /@Controller\s*\(\s*(?:['"`]([^'"`]*)['"`])?/g;
    let m;
    while ((m = re.exec(content)) !== null) {
      out.push({ index: m.index, prefix: m[1] || '' });
    }
    return out;
  }

  /** Prefix of the nearest `@Controller` above `index`, or '' when there is none. */
  function prefixBefore(controllers, index) {
    let prefix = '';
    for (const c of controllers) {
      if (c.index > index) break;
      prefix = c.prefix;
    }
    return prefix;
  }

  /**
   * Join a controller prefix and a method path into one route path.
   * Either side may be empty, absent, or carry its own slashes.
   * @returns {string} always slash-prefixed; never a trailing slash except '/'
   */
  function joinRoute(prefix, methodPath) {
    const parts = [prefix, methodPath]
      .map((p) => String(p || '').trim().replace(/^\/+|\/+$/g, ''))
      .filter(Boolean);
    return parts.length ? '/' + parts.join('/') : '/';
  }

  /**
   * Structured route rows across the supported frameworks — the data behind
   * `analyze`, exposed for retrieval surface-enrichment (#488).
   * @param {string[]} files absolute paths
   * @param {string} cwd
   * @returns {{ method:string, path:string, file:string }[]} file is cwd-relative
   */
  function collectRoutes(files, cwd) {
    const routes = [];

    for (const filePath of files) {
      const ext = path.extname(filePath).toLowerCase();
      const rel = path.relative(cwd, filePath).replace(/\\/g, '/');
      if (shouldSkipFile(rel)) continue;
      let content;
      try { content = fs.readFileSync(filePath, 'utf8'); } catch (_) { continue; }

      // -----------------------------------------------------------------------
      // Express / Fastify / Koa (JS/TS)
      // -----------------------------------------------------------------------
      if (JS_EXTS.has(ext)) {
        // app.get('/path', ...) / router.post('/path') / fastify.put('/path')
        const re1 = /\b(?:app|router|fastify|server|koa|instance)\.(get|post|put|patch|delete|head|options|all)\s*\(\s*['"`]([^'"`]+)['"`]/gi;
        let m;
        while ((m = re1.exec(content)) !== null) {
          routes.push({ method: m[1].toUpperCase(), path: m[2], file: rel });
        }

        // NestJS: @Get(':id') / @Post() — composed with the enclosing
        // @Controller('prefix'). Without the prefix the emitted path matches
        // nothing real, which defeats the point of route pseudo-signatures (#585).
        const controllers = nestControllerPrefixes(content);
        const re2 = /@(Get|Post|Put|Patch|Delete|Head|Options|All)\s*\(\s*(?:['"`]([^'"`]*)['"`])?\s*\)/g;
        while ((m = re2.exec(content)) !== null) {
          const prefix = prefixBefore(controllers, m.index);
          routes.push({ method: m[1].toUpperCase(), path: joinRoute(prefix, m[2]), file: rel });
        }
      }

      // -----------------------------------------------------------------------
      // Flask / FastAPI (Python)
      // -----------------------------------------------------------------------
      if (PY_EXTS.has(ext)) {
        // @app.route('/path', methods=['GET', 'POST'])
        const re1 = /@[\w.]+\.route\s*\(\s*['"]([^'"]+)['"]([\s\S]{0,150}?)\)/g;
        let m;
        while ((m = re1.exec(content)) !== null) {
          const routePath = m[1];
          const methodsMatch = m[2].match(/methods\s*=\s*\[([^\]]+)\]/);
          if (methodsMatch) {
            const methods = methodsMatch[1].match(/['"]([A-Z]+)['"]/g) || [];
            for (const meth of methods) {
              routes.push({ method: meth.replace(/['"]/g, ''), path: routePath, file: rel });
            }
          } else {
            routes.push({ method: 'GET', path: routePath, file: rel });
          }
        }

        // @app.get('/path')  @router.post('/path')  FastAPI style
        const re2 = /@[\w.]+\.(get|post|put|patch|delete|head|options)\s*\(\s*['"]([^'"]+)['"]/g;
        while ((m = re2.exec(content)) !== null) {
          routes.push({ method: m[1].toUpperCase(), path: m[2], file: rel });
        }
      }

      // -----------------------------------------------------------------------
      // Go — Gin / Echo / chi / net/http
      // -----------------------------------------------------------------------
      if (ext === '.go') {
        // r.GET("/path", handler)
        const re1 = /\b\w+\.(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(\s*["']([^"']+)["']/g;
        let m;
        while ((m = re1.exec(content)) !== null) {
          routes.push({ method: m[1], path: m[2], file: rel });
        }
        // http.HandleFunc("/path", handler)
        const re2 = /http\.HandleFunc\s*\(\s*["']([^"']+)["']/g;
        while ((m = re2.exec(content)) !== null) {
          routes.push({ method: 'ANY', path: m[1], file: rel });
        }
      }

      // -----------------------------------------------------------------------
      // Spring (Java)
      // -----------------------------------------------------------------------
      if (ext === '.java') {
        // @GetMapping("/path") @PostMapping @RequestMapping
        const re1 = /@(Get|Post|Put|Patch|Delete|Request)Mapping\s*\(\s*(?:value\s*=\s*)?["']([^"']+)["']/g;
        let m;
        while ((m = re1.exec(content)) !== null) {
          const method = m[1] === 'Request' ? 'ANY' : m[1].toUpperCase();
          routes.push({ method, path: m[2], file: rel });
        }
      }
    }

    return routes;
  }

  function analyze(files, cwd) {
    const routes = collectRoutes(files, cwd);
    if (routes.length === 0) return '';

    const lines = [
      '| Method | Path | File |',
      '|--------|------|------|',
    ];
    for (const r of routes) {
      lines.push(`| ${r.method} | ${r.path} | ${r.file} |`);
    }
    return lines.join('\n');
  }

  module.exports = { analyze, collectRoutes };
  
};

// ── ./src/mcp/handlers ──
__factories["./src/mcp/handlers"] = function(module, exports) {
  
  const fs   = require('fs');
  const path = require('path');
  const { git } = __require('./src/util/git');

  const CONTEXT_FILE = path.join('.github', 'copilot-instructions.md');
  const CONTEXT_COLD_FILE = path.join('.github', 'context-cold.md');

  function _readContextFiles(cwd) {
    const paths = [path.join(cwd, CONTEXT_FILE), path.join(cwd, CONTEXT_COLD_FILE)];
    const chunks = [];
    for (const p of paths) {
      if (fs.existsSync(p)) chunks.push(fs.readFileSync(p, 'utf8'));
    }
    return chunks.join('\n');
  }

  /**
   * Stale-index banner for the MCP read tools (#815).
   *
   * `judge` has warned since v8.54.2 (#780) when the context it scores against is
   * older than the sources it describes. The retrieval surfaces answered from the
   * same ground and said nothing, so a stale result was byte-indistinguishable
   * from a fresh one. Both now call `src/judge/context-source.js`, so there is
   * one definition of "stale" rather than one per surface.
   *
   * Best-effort by design: freshness is advisory, and a failure to establish it
   * must never fail the read it annotates.
   *
   * @returns {string} the banner plus a blank line, or '' when fresh/unknowable
   */
  function _stalenessBanner(cwd, opts) {
    try {
      const { resolveContextFile, contextStaleness, stalenessWarning, STALE_TAILS } = __require('./src/judge/context-source');
      const contextFile = resolveContextFile(cwd);
      if (!contextFile) return '';
      let config = {};
      try { config = __require('./src/config/loader').loadConfig(cwd); } catch (_) {}
      const warning = stalenessWarning(contextStaleness(contextFile, cwd, config, opts), { tail: STALE_TAILS.mcp });
      return warning ? `> ⚠ ${warning}\n\n` : '';
    } catch (_) { return ''; }
  }

  // Section header keywords in PROJECT_MAP.md
  const MAP_SECTIONS = {
    imports: '### Import graph',
    classes: '### Class hierarchy',
    routes: '### Route table',
    env: '### Environment variables',
    buildci: '### Build & CI',
    manifests: '### Config & manifests',
    migrations: '### Database migrations',
  };

  /**
   * read_context({ module? }) → string
   *
   * Returns the full context file, or just the sections whose file paths
   * contain the given module substring.
   */
  function readContext(args, cwd) {
    const content = _readContextFiles(cwd);
    if (!content) {
      return 'No context file found. Run: node gen-context.js';
    }
    const banner = _stalenessBanner(cwd);

    if (!args || !args.module) return banner + content;

    const mod = args.module.replace(/\\/g, '/').replace(/\/$/, '');
    const lines = content.split('\n');
    const result = [];
    let capturing = false;

    for (const line of lines) {
      if (line.startsWith('### ')) {
        const filePath = line.slice(4).trim().replace(/\\/g, '/');
        // Match if file path starts with mod or contains /mod/ or /mod
        capturing =
          filePath === mod ||
          filePath.startsWith(mod + '/') ||
          filePath.includes('/' + mod + '/') ||
          filePath.includes('/' + mod);
        if (capturing) result.push(line);
        continue;
      }
      if (capturing) result.push(line);
    }

    if (result.length === 0) return `No signatures found for module: ${mod}`;
    return banner + result.join('\n');
  }

  /**
   * search_signatures({ query }) → string
   *
   * Case-insensitive search through all signature lines.
   * Returns matching lines grouped by file path.
   */
  function searchSignatures(args, cwd) {
    if (!args || !args.query) return 'Missing required argument: query';

    const query = args.query.toLowerCase();
    try {
      try { __require('./src/cache/freshen').freshen(cwd); } catch (_) {}
      const { buildSigIndex } = __require('./src/retrieval/ranker');
      // every signature the index keeps: a symbol is found here whenever get_callee_signatures finds it (#982)
      const index = buildSigIndex(cwd, { full: true });
      if (index.size === 0) {
        return 'No context file found. Run: node gen-context.js';
      }

      const result = [];
      for (const [file, sigs] of index.entries()) {
        const hits = sigs.filter((s) => s.toLowerCase().includes(query));
        if (hits.length === 0) continue;
        if (result.length > 0) result.push('');
        result.push(`### ${file}`);
        result.push(...hits);
      }

      if (result.length === 0) return `No signatures found matching: ${args.query}`;
      return _stalenessBanner(cwd, { honorOverlay: true }) + result.join('\n');
    } catch (err) {
      return `_search_signatures failed: ${err.message}_`;
    }
  }

  /**
   * get_map({ type }) → string
   *
   * Returns a section from PROJECT_MAP.md.
   * type: 'imports' | 'classes' | 'routes'
   */
  function getMap(args, cwd) {
    if (!args || !args.type) return 'Missing required argument: type';

    const header = MAP_SECTIONS[args.type];
    if (!header) {
      return `Unknown map type: "${args.type}". Use: ${Object.keys(MAP_SECTIONS).join(', ')}`;
    }

    const mapPath = path.join(cwd, 'PROJECT_MAP.md');
    if (!fs.existsSync(mapPath)) {
      return 'PROJECT_MAP.md not found. Run: node gen-project-map.js';
    }

    const content = fs.readFileSync(mapPath, 'utf8');
    const idx = content.indexOf(header);
    if (idx === -1) {
      return `Section "${header}" not found in PROJECT_MAP.md`;
    }

    // Extract from this header to the next ### header
    const after = content.slice(idx);
    const nextMatch = after.slice(header.length).search(/\n###\s/);
    return nextMatch === -1 ? after : after.slice(0, header.length + nextMatch);
  }

  /**
   * create_checkpoint({ note? }) → string
   *
   * Returns a markdown checkpoint summarising current project state:
   * - Timestamp and optional user note
   * - Active git branch + last 5 commit messages
   * - Token count of current context file
   * - List of modules present in the context
   * - Route count (if PROJECT_MAP.md exists)
   */
  function createCheckpoint(args, cwd) {
    const note = (args && args.note) ? args.note.trim() : '';
    const now = new Date().toISOString().replace('T', ' ').slice(0, 19) + ' UTC';
    const lines = [
      '# SigMap Checkpoint',
      `**Created:** ${now}`,
    ];

    if (note) lines.push(`**Note:** ${note}`);
    lines.push('');

    // ── Git info ────────────────────────────────────────────────────────────
    lines.push('## Git state');
    try {
      const branch = git(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd }).trim();
      lines.push(`**Branch:** ${branch}`);
    } catch (_) {
      lines.push('**Branch:** (not a git repo)');
    }

    try {
      const log = git(['log', '--oneline', '-5', '--no-decorate'], { cwd }).trim();
      if (log) {
        lines.push('');
        lines.push('**Recent commits:**');
        for (const l of log.split('\n')) lines.push(`- ${l}`);
      }
    } catch (_) {} // ignore — not every project uses git
    lines.push('');

    // ── Context stats ────────────────────────────────────────────────────────
    lines.push('## Context snapshot');
    const contextPath = path.join(cwd, CONTEXT_FILE);
    if (fs.existsSync(contextPath)) {
      const content = fs.readFileSync(contextPath, 'utf8');
      const tokens = Math.ceil(content.length / 4);

      // Count modules (### headers are file paths)
      const modules = content.split('\n').filter((l) => l.startsWith('### ')).map((l) => l.slice(4).trim());
      lines.push(`**Token count:** ~${tokens}`);
      lines.push(`**Modules in context:** ${modules.length}`);

      if (modules.length > 0) {
        lines.push('');
        lines.push('**Modules:**');
        for (const m of modules.slice(0, 20)) lines.push(`- ${m}`);
        if (modules.length > 20) lines.push(`- … and ${modules.length - 20} more`);
      }
    } else {
      lines.push('_No context file found. Run: node gen-context.js_');
    }
    lines.push('');

    // ── Route summary ────────────────────────────────────────────────────────
    const mapPath = path.join(cwd, 'PROJECT_MAP.md');
    if (fs.existsSync(mapPath)) {
      const mapContent = fs.readFileSync(mapPath, 'utf8');
      const routeLines = mapContent.split('\n').filter((l) => l.startsWith('| ') && !l.startsWith('| Method') && !l.startsWith('|---'));
      if (routeLines.length > 0) {
        lines.push('## Routes');
        lines.push(`**Total routes detected:** ${routeLines.length}`);
        lines.push('');
        for (const r of routeLines.slice(0, 10)) lines.push(r);
        if (routeLines.length > 10) lines.push(`| … | +${routeLines.length - 10} more | |`);
        lines.push('');
      }
    }

    lines.push('---');
    lines.push('_Generated by SigMap `create_checkpoint`_');

    return lines.join('\n');
  }

  /**
   * get_routing({}) → string
   *
   * Reads the current context file, classifies all indexed files by complexity,
   * and returns a formatted markdown routing guide showing which files belong
   * to the fast/balanced/powerful model tier.
   */
  function getRouting(args, cwd) {
    const contextPath = path.join(cwd, CONTEXT_FILE);
    // Model names come from the dated profile, never a literal here (#778).
    const { resolveProfile, asOfLabel } = __require('./src/config/models');
    const { tierInfo } = __require('./src/routing/hints');
    let profile = resolveProfile();
    try { profile = resolveProfile(__require('./src/config/loader').loadConfig(cwd)); } catch (_) {}
    if (!fs.existsSync(contextPath)) {
      return (
        '_No context file found. Run `node gen-context.js --routing` first._\n\n' +
        'This generates routing hints that map each file to a model tier:\n' +
        `- **fast** (${tierInfo('fast', profile).examples}) — config, markup, trivial utilities\n` +
        `- **balanced** (${tierInfo('balanced', profile).examples}) — standard application code\n` +
        `- **powerful** (${tierInfo('powerful', profile).examples}) — complex, security-critical, or large modules\n\n` +
        `Model names: ${asOfLabel(profile)}.`
      );
    }

    // Parse file list from context (### headings are file paths)
    const content = fs.readFileSync(contextPath, 'utf8');
    const fileRels = content.split('\n')
      .filter((l) => l.startsWith('### '))
      .map((l) => l.slice(4).trim());

    // Build synthetic fileEntries for the classifier
    // We don't have live sig arrays here, so rebuild from the context blocks
    const entries = [];
    const blocks = content.split(/^### /m).slice(1); // slice past the header
    for (const block of blocks) {
      const firstLine = block.split('\n')[0].trim();
      const codeBlock = block.match(/```\n([\s\S]*?)```/);
      const sigs = codeBlock ? codeBlock[1].trim().split('\n').filter(Boolean) : [];
      entries.push({ filePath: path.join(cwd, firstLine), sigs });
    }

    try {
      const { classifyAll } = __require('./src/routing/classifier');
      const { formatRoutingSection } = __require('./src/routing/hints');
      const groups = classifyAll(entries, cwd);
      return formatRoutingSection(groups, profile);
    } catch (err) {
      return `_Routing classification failed: ${err.message}_`;
    }
  }

  /**
   * Why a file with no indexed signatures is not indexed, when the answer is that it is
   * generated (#876): re-running the generator would not change it, so the generic
   * "Run: node gen-context.js" is advice that cannot help.
   * @returns {string|null}
   */
  function _generatedNote(abs, rel) {
    let fd;
    try {
      const size = fs.statSync(abs).size;
      fd = fs.openSync(abs, 'r');
      const head = Buffer.alloc(Math.min(4096, size));
      fs.readSync(fd, head, 0, head.length, 0);
      const tail = Buffer.alloc(Math.min(512, size));
      fs.readSync(fd, tail, 0, tail.length, size - tail.length);
      const why = __require('./src/util/file-class').generatedReason(rel, head.toString('utf8'), tail.toString('utf8'));
      return why ? `_Not indexed: this file looks generated (${why}). Index the sources it is built from; re-running the generator will not add it._` : null;
    } catch (_) {
      return null;
    } finally {
      if (fd !== undefined) { try { fs.closeSync(fd); } catch (_) { /* already closed */ } }
    }
  }

  /**
   * explain_file({ path }) → string
   *
   * Returns a file's signatures, its direct imports, and files that import it.
   * path: relative path from project root (e.g. 'src/services/auth.ts')
   */
  function explainFile(args, cwd) {
    if (!args || !args.path) return 'Missing required argument: path';

    const targetRel = args.path.replace(/\\/g, '/').replace(/^\//, '');
    const targetAbs = path.resolve(cwd, targetRel);
    const contextPath = path.join(cwd, CONTEXT_FILE);

    const lines = ['# explain_file: ' + targetRel, ''];

    // ── Signatures (hot + cold + cache via buildSigIndex) ───────────────────
    lines.push('## Signatures');
    let indexedFiles = [];

    try {
      const { buildSigIndex } = __require('./src/retrieval/ranker');
      const index = buildSigIndex(cwd, { full: true }); // one file: all of what the index keeps of it (#982)
      let sigs = index.get(targetRel);
      if (!sigs) {
        for (const [file, fileSigs] of index.entries()) {
          if (file === targetRel || file.endsWith('/' + targetRel) || targetRel.endsWith('/' + file)) {
            sigs = fileSigs;
            break;
          }
        }
      }
      if (sigs && sigs.length > 0) {
        lines.push(...sigs);
      } else {
        lines.push(_generatedNote(targetAbs, targetRel) || '_No signatures indexed for this file. Run: node gen-context.js_');
      }
      indexedFiles = [...index.keys()].map((rel) => path.resolve(cwd, rel));
    } catch (_) {
      lines.push('_No context file found. Run: node gen-context.js_');
    }

    if (!fs.existsSync(targetAbs)) {
      lines.push('');
      lines.push('> File not found on disk: ' + targetRel);
      return lines.join('\n');
    }

    lines.push('');

    // ── Direct imports ────────────────────────────────────────────────────────
    lines.push('## Imports (direct dependencies)');
    try {
      const { extractImports } = __require('./src/map/import-graph');
      const fileContent = fs.readFileSync(targetAbs, 'utf8');
      const fileSet = new Set(indexedFiles);
      fileSet.add(targetAbs);
      const imports = extractImports(targetAbs, fileContent, fileSet);
      if (imports.length > 0) {
        for (const imp of imports) lines.push('- ' + path.relative(cwd, imp).replace(/\\/g, '/'));
      } else {
        lines.push('_No resolvable relative imports found._');
      }
    } catch (err) {
      lines.push('_Could not analyze imports: ' + err.message + '_');
    }

    lines.push('');

    // ── Callers (reverse-import lookup) ──────────────────────────────────────
    lines.push('## Callers (files that import this file)');
    try {
      const { extractImports } = __require('./src/map/import-graph');
      const fileSet = new Set(indexedFiles);
      fileSet.add(targetAbs);
      const callers = [];
      for (const f of indexedFiles) {
        if (f === targetAbs || !fs.existsSync(f)) continue;
        try {
          const fc = fs.readFileSync(f, 'utf8');
          const imps = extractImports(f, fc, fileSet);
          if (imps.includes(targetAbs)) callers.push(path.relative(cwd, f).replace(/\\/g, '/'));
        } catch (_) {}
      }
      if (callers.length > 0) {
        for (const c of callers) lines.push('- ' + c);
      } else {
        lines.push('_No indexed files import this file._');
      }
    } catch (err) {
      lines.push('_Could not analyze callers: ' + err.message + '_');
    }

    return lines.join('\n');
  }

  /**
   * list_modules({}) → string
   *
   * Lists all srcDir modules present in the context file, sorted by token count
   * descending. Helps agents decide which module to query with read_context.
   */
  function listModules(args, cwd) {
    try {
      const { buildSigIndex } = __require('./src/retrieval/ranker');
      const index = buildSigIndex(cwd);
      if (index.size === 0) {
        return 'No context file found. Run: node gen-context.js';
      }

      const groups = {};
      for (const [rel, sigs] of index.entries()) {
        const parts = rel.replace(/\\/g, '/').split('/');
        const mod = parts.length > 1 ? parts[0] : '.';
        if (!groups[mod]) groups[mod] = { fileCount: 0, tokenCount: 0 };
        groups[mod].fileCount++;
        groups[mod].tokenCount += Math.ceil(sigs.join('\n').length / 4);
      }

    const sorted = Object.entries(groups)
      .map(([mod, data]) => ({ module: mod, fileCount: data.fileCount, tokenCount: data.tokenCount }))
      .sort((a, b) => b.tokenCount - a.tokenCount);

    if (sorted.length === 0) return 'No modules found in context file.';

    const total = sorted.reduce((s, m) => s + m.tokenCount, 0);

    return [
      '# Modules',
      '',
      '| Module | Files | Tokens |',
      '|--------|-------|--------|',
      ...sorted.map((m) => `| ${m.module} | ${m.fileCount} | ~${m.tokenCount} |`),
      '',
      `**Total context tokens: ~${total}**`,
      '',
      '_Use `read_context({ module: "name" })` to get signatures for a specific module._',
    ].join('\n');
    } catch (err) {
      return `_list_modules failed: ${err.message}_`;
    }
  }

  /**
   * query_context({ query, topK? }) → string
   *
   * Ranks context-file entries by relevance to the query and returns the
   * top-K most relevant files with their signatures and scores.
   */
  function queryContext(args, cwd) {
    if (!args || !args.query) return 'Missing required argument: query';

    try {
      const { rank, buildSigIndex, formatRankTable } = __require('./src/retrieval/ranker');
      const { buildRankingGraph } = __require('./src/graph/builder');
      const index = buildSigIndex(cwd);
      if (index.size === 0) return 'No signatures indexed. Run: node gen-context.js';

      const topK = Math.min(Math.max(1, parseInt(args.topK, 10) || 10), 25);
      // Build dependency graph for neighbor boost — non-fatal if it fails
      let graph = null;
      try { graph = buildRankingGraph(cwd); } catch (_) {}
      // Opt-in call-graph neighbor boost + surface enrichment + centrality blend — non-fatal
      let callGraph = null;
      let centrality = null;
      let expansions = null;
      let bodyWords = null;
      try {
        const { loadConfig } = __require('./src/config/loader');
        const retrieval = loadConfig(cwd).retrieval;
        if (retrieval && retrieval.callGraphBoost) {
          callGraph = __require('./src/graph/call-graph').buildRankingCallFileGraph(cwd);
        }
        if (retrieval && retrieval.surfaceEnrichment) {
          __require('./src/retrieval/enrich-from-maps').enrichWithSurfaces(index, cwd);
        }
        if (retrieval && retrieval.centralityBlend && graph) {
          centrality = __require('./src/graph/centrality').computeCentrality(graph);
        }
        if (retrieval && retrieval.minedExpansions) {
          expansions = __require('./src/retrieval/mined-expansions').loadOrMine(cwd).expansions;
        }
        if (retrieval && retrieval.bodyWords) {
          bodyWords = __require('./src/retrieval/body-words').loadOrBuild(cwd, index);
        }
      } catch (_) {}
      const results = rank(args.query, index, { topK, cwd, graph, callGraph, centrality, expansions, bodyWords });
      return _stalenessBanner(cwd, { honorOverlay: true }) + formatRankTable(results, args.query);
    } catch (err) {
      return `_query_context failed: ${err.message}_`;
    }
  }

  /**
   * get_method_impact({ symbol, direction?, depth? }) → string
   *
   * Method-level blast radius (GR2): every function that transitively calls
   * `symbol` (direction 'callers', default), or everything it calls ('callees').
   */
  function getMethodImpact(args, cwd) {
    if (!args || !args.symbol) return 'Missing required argument: symbol';

    try {
      const { methodImpact, methodCallees, formatCallGraph } = __require('./src/graph/call-graph');
      const kind = args.direction === 'callees' ? 'callees' : 'callers';
      const depth = Math.max(0, parseInt(args.depth, 10) || 0);
      const result = kind === 'callees'
        ? methodCallees(args.symbol, cwd, { depth })
        : methodImpact(args.symbol, cwd, { depth });
      return formatCallGraph(result, kind);
    } catch (err) {
      return `_get_method_impact failed: ${err.message}_`;
    }
  }

  /**
   * get_impact({ file, depth? }) → string
   *
   * Returns a formatted markdown impact report for the given file:
   * direct importers, transitive importers, affected tests, affected routes.
   */
  function getImpact(args, cwd) {
    if (!args || !args.file) return 'Missing required argument: file';

    try {
      // View over the knowledge map (#632): cached store instead of a per-call
      // graph rebuild; same BFS semantics and rendering as the old path.
      const km = __require('./src/map/knowledge-map');
      const { formatImpact } = __require('./src/graph/impact');
      const depth = Math.max(0, parseInt(args.depth, 10) || 3);
      const rel = path.isAbsolute(args.file) ? path.relative(cwd, args.file) : String(args.file);
      const map = km.loadOrBuild(cwd);
      return formatImpact(km.impactView(map, rel, depth, cwd));
    } catch (err) {
      return `_get_impact failed: ${err.message}_`;
    }
  }

  /**
   * get_lines({ file, start, end }) → string
   *
   * Surgical Context demand-driven fetch: returns an exact, clamped line range from a
   * source file. The path is resolved inside the project root (no traversal escape) and
   * the returned lines are secret-scanned via the same redactor used for signatures.
   */
  function getLines(args, cwd) {
    if (!args || !args.file) return 'Missing required argument: file';

    const rel = String(args.file).replace(/\\/g, '/').replace(/^\//, '');
    const abs = path.resolve(cwd, rel);

    // Sandbox: refuse paths that resolve outside the project root.
    const root = path.resolve(cwd);
    if (abs !== root && !abs.startsWith(root + path.sep)) {
      return `Refused: ${rel} resolves outside the project root`;
    }
    if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) {
      return `File not found: ${rel}`;
    }

    const start = parseInt(args.start, 10);
    const end = parseInt(args.end, 10);
    if (!Number.isFinite(start) || !Number.isFinite(end)) {
      return 'Arguments "start" and "end" must be numbers (1-based line numbers).';
    }

    let lines;
    try {
      lines = fs.readFileSync(abs, 'utf8').split('\n');
    } catch (err) {
      return `Could not read ${rel}: ${err.message}`;
    }

    const total = lines.length;
    const from = Math.max(1, Math.min(start, end));
    const to = Math.min(total, Math.max(start, end));
    if (from > total) return `${rel} has only ${total} lines; requested ${start}-${end}`;

    const slice = lines.slice(from - 1, to);

    // Redaction scan: reuse the signature secret scanner line-by-line.
    let safeLines = slice;
    try {
      const { scan } = __require('./src/security/scanner');
      safeLines = scan(slice, rel).safe;
    } catch (_) {} // non-fatal: fall back to raw slice

    return [
      `# ${rel}:${from}-${to}`,
      '```',
      ...safeLines,
      '```',
    ].join('\n');
  }

  /**
   * read_memory({ limit? }) → string
   *
   * Recall the cross-session decision log (notes) plus the last ranking-session
   * focus, formatted for an agent to consume at the start of a task.
   */
  function readMemory(args, cwd) {
    let limit = parseInt(args && args.limit, 10);
    if (!Number.isFinite(limit) || limit <= 0) limit = 10;
    limit = Math.min(limit, 50);

    const out = ['# SigMap memory'];

    let notes = [];
    try {
      const { readNotes, formatNotes } = __require('./src/session/notes');
      notes = readNotes(cwd, limit);
      out.push('');
      out.push(`## Recent notes (${notes.length})`);
      // Most recent first for quick scanning.
      out.push(formatNotes(notes.slice().reverse()));
    } catch (_) {
      out.push('');
      out.push('_No notes available._');
    }

    // Last ranking-session focus (if any) — extends src/session/memory.js.
    try {
      const { loadSession } = __require('./src/session/memory');
      const s = loadSession(cwd);
      if (s && (s.lastQuery || (s.topFiles && s.topFiles.length))) {
        out.push('');
        out.push('## Last session');
        if (s.lastQuery) out.push(`**Last query:** ${s.lastQuery}`);
        if (s.topFiles && s.topFiles.length) {
          out.push(`**Focus files:** ${s.topFiles.map((f) => f.file).slice(0, 5).join(', ')}`);
        }
      }
    } catch (_) { /* session optional */ }

    return out.join('\n');
  }

  /**
   * get_budget({ session?, budgetTokens? }) → string
   *
   * Session spend ledger (F1): estimated tokens SigMap emitted this session,
   * optional budget remaining, and context freshness. Estimates only (chars/4);
   * does NOT see the host chat's total spend.
   */
  function getBudget(args, cwd) {
    const { budgetStatus } = __require('./src/tracking/budget');
    let config = {};
    try { config = __require('./src/config/loader').loadConfig(cwd) || {}; } catch (_) {}
    const opts = { config };
    if (args && args.session) opts.session = String(args.session);
    if (args && args.budgetTokens != null) opts.budgetTokens = Number(args.budgetTokens);
    const s = budgetStatus(cwd, opts);

    const out = ['# SigMap session spend (estimates — chars/4; SigMap-emitted tokens only)'];
    out.push('');
    out.push(`Session   : ${s.session}`);
    out.push(`Ops       : ${s.ops}`);
    out.push(`Spent     : ~${s.spentTokens.toLocaleString()} tokens (baseline ~${s.baselineTokens.toLocaleString()}, saved ~${s.savedTokens.toLocaleString()})`);
    if (s.budgetTokens != null) {
      out.push(`Budget    : ${s.budgetTokens.toLocaleString()} → remaining ~${s.remainingTokens.toLocaleString()} (${s.pctUsed}% used)${s.overBudget ? '  ⚠ OVER BUDGET' : ''}`);
      if (s.overBudget || (s.pctUsed != null && s.pctUsed >= 80)) {
        out.push('Advice    : prefer terse output, squeeze large inputs, summarize-then-drop context.');
      }
    } else {
      out.push('Budget    : none set (config sessionBudgetTokens or budgetTokens arg)');
    }
    out.push(s.context.exists
      ? `Context   : ${s.context.ageDays} day(s) old${s.context.stale ? ` — STALE (> ${s.context.ttlDays}d TTL); re-run sigmap` : ''}`
      : 'Context   : no generated context found — run sigmap first');
    if (s.measured) {
      const { formatUsage, NOTE } = __require('./src/session/render');
      out.push(`Measured  : ${formatUsage(s.measured.usage)}  [${s.measured.provenance}] — ${NOTE}${s.measured.coverage === 'main' ? '; main conversation only' : ''}`);
    }
    return out.join('\n');
  }

  /**
   * log_session_usage({ id?, model?, usage? }) → string
   *
   * Record the calling agent's own usage as an `agent-reported` session (#951).
   * Never throws for bad input: a malformed `usage` is stored as `unavailable` and
   * the reason is returned, so the agent can correct it. What it prints is what
   * the store now holds for the id, which is not always this call's report — a
   * measured transcript of the same session outranks a self-report.
   *
   * @param {object} args
   * @param {string} cwd
   * @param {{ client?: string, token: string }} [conn] the MCP connection (client name, per-connection token)
   */
  function logSessionUsage(args, cwd, conn) {
    const { recordFromMcp } = __require('./src/session/capture');
    const store = __require('./src/session/store');
    const { formatUsage } = __require('./src/session/render');
    let config = {};
    try { config = __require('./src/config/loader').loadConfig(cwd) || {}; } catch (_) {}
    const r = recordFromMcp(cwd, args, conn, { config });
    const rec = store.readSessions(cwd).sessions.find((s) => s.id === r.id);
    const out = [`logged ${r.id} [${rec ? rec.provenance : 'unavailable'}] ${formatUsage(rec ? rec.usage : null)}`];
    if (r.reason) out.push(`usage recorded as unavailable: ${r.reason}`);
    return out.join('\n');
  }

  /**
   * get_callee_signatures — return the exact defining signature(s) of named
   * symbols from the index, so an agent never guesses a callee's parameter types.
   * Unknown names get a closest-match suggestion.
   * @param {{symbols:string[]}} args
   * @param {string} cwd
   */
  function getCalleeSignatures(args, cwd) {
    const symbols = args && Array.isArray(args.symbols)
      ? args.symbols.map((s) => String(s).trim()).filter(Boolean)
      : null;
    if (!symbols || symbols.length === 0) {
      return 'Missing required argument: symbols (non-empty string[])';
    }

    try {
      try { __require('./src/cache/freshen').freshen(cwd); } catch (_) {}
      const { buildSigIndex } = __require('./src/retrieval/ranker');
      const { buildSymbolCandidates, closestMatch, formatSuggestion } = __require('./src/verify/closest-match');
      const index = buildSigIndex(cwd, { full: true }); // a definition past what the ranker reads still counts (#982)
      if (index.size === 0) return 'No context file found. Run: node gen-context.js';

      // Extract the defining symbol name from a signature line (same rules as
      // buildSymbolCandidates) so we match definitions, not param occurrences.
      const defName = (sig) => {
        const cleaned = String(sig).replace(/\s*:\d+(?:-\d+)?\s*$/, '');
        const m = cleaned.match(/\b(?:async\s+function|function|class|def|interface|type|enum|const|let|var)\s+([A-Za-z_$][\w$]*)/)
          || cleaned.match(/([A-Za-z_$][\w$]*)\s*\(/);
        return m ? m[1] : null;
      };

      const candidates = buildSymbolCandidates(index);
      const blocks = [];
      for (const symbol of symbols) {
        const matches = [];
        for (const [file, sigs] of index.entries()) {
          for (const sig of sigs) {
            if (defName(sig) === symbol) matches.push(`${sig}    (${file})`);
          }
        }
        if (matches.length === 0) {
          const cm = closestMatch(symbol, candidates);
          const hint = cm ? ' — ' + formatSuggestion(cm) : '';
          blocks.push(`### ${symbol}\n_not found in index${hint}_`);
        } else {
          blocks.push(`### ${symbol}\n${matches.join('\n')}`);
        }
      }
      return blocks.join('\n\n');
    } catch (err) {
      return `_get_callee_signatures failed: ${err.message}_`;
    }
  }

  // ── Layer 1: live-index write hooks ────────────────────────────────────────
  // Keep the live overlay (cache/overlay.js) current while an agent creates,
  // modifies or deletes files, so the change is visible in the same session.
  // buildSigIndex applies the overlay over the base index, and an overlay entry
  // REPLACES the file's base entry — so a rename, a removed symbol or a deletion
  // shows up too, not only an addition (#926).

  /** notify_file_created — extract a file's signatures and index it live. */
  function notifyFileCreated(args, cwd) {
    const rel = args && args.path;
    if (!rel) return 'Missing required argument: path';
    try {
      const overlay = __require('./src/cache/overlay');
      const { entryParts } = __require('./src/cache/entry');
      const { loadIgnorePatterns, matchesIgnore } = __require('./src/util/ignore');
      const abs = path.resolve(cwd, rel);
      const key = overlay.relKey(cwd, abs);
      if (!key) return `${rel} is outside the project.`;
      // The filter a full run applies: an ignored file is not resurrected by a hook.
      if (matchesIgnore(key, loadIgnorePatterns(cwd))) return `${rel} is excluded by .contextignore — not indexed.`;
      const at = Date.now();
      let content = args.content;
      if (typeof content !== 'string') {
        try { content = fs.readFileSync(abs, 'utf8'); } catch (_) { content = ''; }
      }
      // The same stages a full run applies — a secret in the file is redacted here
      // too, and the module-doc line is kept — so this entry cannot replace a
      // redacted base entry with a leaky one.
      const { sigs, more } = entryParts(abs, content, cwd);
      // An empty result is NOT a removal: this tier cannot tell a file with no
      // signatures from one it cannot read or does not know, and a wrong removal is
      // worse than a stale entry the next full run replaces. Use notify_file_deleted
      // for a file that is gone.
      if (sigs.length === 0) return `No signatures found in ${rel}; the index is unchanged.`;
      if (!overlay.update(cwd, (entries) => overlay.put(entries, key, more.length > 0 ? { at, sigs, more } : { at, sigs }))) {
        return `_notify_file_created failed: could not write the live overlay_`;
      }
      return `Indexed ${rel}: ${sigs.length} signature(s) now live.`;
    } catch (err) {
      return `_notify_file_created failed: ${err.message}_`;
    }
  }

  /** notify_symbol_added — add one signature to a file's live entry. */
  function notifySymbolAdded(args, cwd) {
    if (!args || !args.signature || !args.file) {
      return 'Missing required arguments: signature, file';
    }
    try {
      const overlay = __require('./src/cache/overlay');
      const { entryConfig, redactSecrets } = __require('./src/cache/entry');
      const { loadIgnorePatterns, matchesIgnore } = __require('./src/util/ignore');
      const abs = path.resolve(cwd, args.file);
      const key = overlay.relKey(cwd, abs);
      if (!key) return `${args.file} is outside the project.`;
      if (matchesIgnore(key, loadIgnorePatterns(cwd))) return `${args.file} is excluded by .contextignore — not indexed.`;
      const line = Number.isFinite(Number(args.line)) ? `  :${args.line}` : '';
      // A signature an agent hands over is scanned like any other.
      const sig = redactSecrets([String(args.signature) + line], abs, entryConfig(cwd)).sigs[0];
      let count = 1;
      const wrote = overlay.update(cwd, (entries) => {
        const cur = entries.get(key);
        // Adding one symbol must never REPLACE the file's other symbols, so an
        // entry that did not come from a whole-file extraction is additive.
        const entry = cur && !cur.deleted ? cur : { at: Date.now(), sigs: [], additive: true };
        if (!entry.sigs.includes(sig)) entry.sigs.push(sig);
        // An additive entry's stamp only says when the symbol arrived. A whole-file
        // entry keeps the time its file was READ: refreshing it here would claim
        // coverage of edits that were never read (freshen would then skip them).
        if (entry.additive) entry.at = Date.now();
        entries.set(key, entry);
        count = entry.sigs.length;
      });
      if (!wrote) return `_notify_symbol_added failed: could not write the live overlay_`;
      try {
        const total = __require('./src/retrieval/ranker').buildSigIndex(cwd).get(key);
        if (total) count = total.length;
      } catch (_) { /* the live-added count stands */ }
      return `Added signature to ${args.file} (${count} total).`;
    } catch (err) {
      return `_notify_symbol_added failed: ${err.message}_`;
    }
  }

  /** notify_file_deleted — drop a file from the live index. */
  function notifyFileDeleted(args, cwd) {
    const rel = args && args.path;
    if (!rel) return 'Missing required argument: path';
    try {
      const overlay = __require('./src/cache/overlay');
      const key = overlay.relKey(cwd, path.resolve(cwd, rel));
      if (!key) return `${rel} is outside the project.`;
      let had = false;
      try { had = __require('./src/retrieval/ranker').buildSigIndex(cwd).has(key); } catch (_) {}
      // A tombstone, not a dropped entry: the file may live in the base index,
      // which only a full run rewrites.
      if (!overlay.update(cwd, (entries) => overlay.put(entries, key, { at: Date.now(), deleted: true }))) {
        return `_notify_file_deleted failed: could not write the live overlay_`;
      }
      return had ? `Removed ${rel} from the live index.` : `${rel} was not in the live index.`;
    } catch (err) {
      return `_notify_file_deleted failed: ${err.message}_`;
    }
  }

  /**
   * List the files changed in the working tree, staged area, or vs a base ref.
   * Shell-free (routes through src/util/git.js). Returns relative paths.
   */
  function _changedFiles(cwd, args) {
    // #667: shared with the `--diff` CLI path so both surfaces agree on what
    // "since <ref>" means. The ref form is ref-vs-working-tree, not ref..HEAD.
    const { changedFiles } = __require('./src/util/git');
    return changedFiles(cwd, { base: args.base, staged: args.staged });
  }

  /**
   * get_diff_context({ base?, staged?, depth? }) → string
   *
   * For each changed file: its extracted signatures + blast radius (direct
   * importers, transitive count, affected tests/routes) + a risk label.
   * Hands an agent everything a review or a safe edit needs in one call.
   */
  function getDiffContext(args, cwd) {
    try {
      const a = args || {};
      const files = _changedFiles(cwd, a);
      if (files.length === 0) {
        return '_No changed files detected._ (Outside a git repo, or the working tree / selected range is clean.)';
      }

      const { extractFile, langFor } = __require('./src/extractors/dispatch');
      const { analyzeImpact } = __require('./src/graph/impact');
      let riskLabelFor;
      try { ({ riskLabelFor } = __require('./src/evidence/pack')); } catch (_) { riskLabelFor = () => 'source'; }

      const depth = Math.max(0, parseInt(a.depth, 10) || 2);
      const srcFiles = files.filter((f) => langFor(f));
      let impactByFile = new Map();
      try {
        const impacts = analyzeImpact(srcFiles, cwd, { depth });
        impactByFile = new Map(impacts.map((r) => [r.file, r.impact]));
      } catch (_) { /* graph optional */ }

      const scope = a.base ? `vs ${a.base}` : (a.staged ? 'staged' : 'working tree');
      const out = [
        `# Diff context (${scope})`,
        '',
        `**${files.length} changed file${files.length === 1 ? '' : 's'}** · ${srcFiles.length} with extractable signatures`,
        '',
      ];

      for (const rel of files) {
        out.push(`## \`${rel}\``);
        if (!langFor(rel)) { out.push('_non-source file (no signatures)_', ''); continue; }

        out.push(`_risk: ${riskLabelFor(rel)}_`);
        const impact = impactByFile.get(rel);
        if (impact && impact.graph) {
          // The import graph cannot read this file's language: say so, not "0 impacted" (#979).
          out.push(`**Blast radius:** not tracked — ${__require('./src/graph/language-support').shortNote(impact.language)}`);
        } else if (impact) {
          out.push(
            `**Blast radius:** ${impact.totalImpact} file(s) impacted — ` +
            `${impact.direct.length} direct importer(s), ${impact.transitive.length} transitive` +
            (impact.tests.length ? `, ${impact.tests.length} test(s)` : '') +
            (impact.routes.length ? `, ${impact.routes.length} route(s)` : '')
          );
          if (impact.direct.length) {
            out.push(`Direct importers: ${impact.direct.slice(0, 8).map((f) => '`' + f + '`').join(', ')}` + (impact.direct.length > 8 ? ' …' : ''));
          }
          if (impact.tests.length) {
            out.push(`Tests to run: ${impact.tests.slice(0, 8).map((f) => '`' + f + '`').join(', ')}`);
          }
        } else {
          out.push('**Blast radius:** (not in dependency graph — new or leaf file)');
        }
        out.push('');

        let src = '';
        try { src = fs.readFileSync(path.resolve(cwd, rel), 'utf8'); } catch (_) {}
        const sigs = src ? extractFile(rel, src) : [];
        if (sigs.length) {
          out.push('```');
          for (const s of sigs.slice(0, 40)) out.push(s);
          if (sigs.length > 40) out.push(`… +${sigs.length - 40} more`);
          out.push('```');
        } else {
          out.push('_(no signatures extracted — file may be deleted or empty)_');
        }
        out.push('');
      }

      return out.join('\n');
    } catch (err) {
      return `_get_diff_context failed: ${err.message}_`;
    }
  }

  /**
   * get_architecture_overview({}) → string
   *
   * A high-level map of the codebase: module breakdown (files/tokens), the most
   * depended-on "hub" files, dependency-cycle count, and route totals. Extends
   * get_map — one call to orient in an unfamiliar repo.
   */
  function getArchitectureOverview(args, cwd) {
    try {
      // View over the knowledge map (#632): every section — modules, hubs,
      // cycles, routes — derives from the cached store; route totals count real
      // route nodes instead of PROJECT_MAP.md table lines.
      const km = __require('./src/map/knowledge-map');
      const map = km.loadOrBuild(cwd);
      const view = km.architectureView(map);
      const out = ['# Architecture overview', ''];

      if (view.totalFiles === 0) {
        out.push('_No context file found. Run: node gen-context.js_', '');
      } else {
        out.push(`**${view.totalFiles} indexed files · ${view.modules.length} modules · ~${view.totalTokens} tokens**`, '');
        out.push('## Modules', '| Module | Files | Tokens |', '|--------|-------|--------|');
        for (const m of view.modules.slice(0, 20)) out.push(`| ${m.mod} | ${m.files} | ~${m.tokens} |`);
        out.push('');
      }

      if (view.hubs.length) {
        out.push('## Hub files (most depended-on)', '| File | Importers |', '|------|-----------|');
        for (const h of view.hubs) out.push(`| \`${h.file}\` | ${h.in} |`);
        out.push('');
        out.push(`**Dependency cycles:** ${view.cycles}` + (view.cycles ? ' _(see import graph)_' : ' — none detected'), '');
      }

      if (view.routes > 0) {
        out.push('## Project map', `Routes detected: ${view.routes} _(use get_map for imports/classes/routes detail)_`, '');
      } else {
        out.push('_Run `node gen-project-map.js` for routes / class-hierarchy detail (get_map)._');
      }

      return out.join('\n');
    } catch (err) {
      return `_get_architecture_overview failed: ${err.message}_`;
    }
  }

  /**
   * verify_suggestion({ code }) → string
   *
   * Ground an AI code suggestion before it is written: run the Hallucination
   * Guard against the repo AND the installed-library symbol index (the moat), and
   * render a verdict + issues + the installed libraries verified against (pinned
   * versions, D8). Deterministic, offline.
   */
  function verifySuggestion(args, cwd) {
    const code = args && typeof args.code === 'string' ? args.code : '';
    if (!code.trim()) {
      return 'Usage: verify_suggestion({ code: "<AI-suggested code or answer>" }) — provide the snippet to verify against the repo + installed libraries.';
    }

    let result;
    try {
      const { verify } = __require('./src/verify/hallucination-guard');
      result = verify(code, cwd);
    } catch (err) {
      return `_verify_suggestion failed: ${err.message}_`;
    }

    const { issues, summary } = result;
    const cov = __require('./src/verify/coverage');
    let config = {};
    try { config = __require('./src/config/loader').loadConfig(cwd); } catch (_) {}
    const index = cov.indexState(cwd, summary, config);
    const coverage = cov.coverageOf(summary, index);
    summary.coverage = coverage;

    // A verdict is a statement about the claims that were checked, against an index
    // that is there and current (#989): never "Grounded" for an empty or skipped check.
    const out = [];
    if (!summary.clean) {
      out.push(`✗ ${summary.total} issue(s) found:`);
      for (const i of issues) {
        out.push(`  L${i.line}  [${i.type}]  ${i.message}`);
        if (i.suggestion) out.push(`         ↳ ${i.suggestion}`);
      }
    } else if (index.state !== 'ok') {
      out.push(`⚠ No issues in the claims checked, but ${index.state === 'missing' ? (index.symbolsRan === false ? 'the symbol check did not run' : 'there is no repo index') : 'the index is out of date'}.`);
    } else if (coverage.vacuous) {
      out.push('⚠ Nothing to check — the snippet names no file path, import, backticked call or npm script.');
    } else {
      out.push('✓ Grounded — no fake files, imports, symbols, or scripts found in the claims checked.');
    }
    if (index.warning) out.push(`  ${index.warning}`);

    out.push('');
    for (const l of cov.detailLines(coverage)) out.push(l);

    // D8: the installed libraries the suggestion was read against, with how much of
    // each was readable — a library at 0 names grounds nothing (#990).
    const libs = summary.libraries || [];
    out.push(`Symbols indexed: ${summary.symbolsIndexed} (repo + installed libraries)`);
    if (libs.length) {
      out.push(`${libs.length} installed librar${libs.length === 1 ? 'y' : 'ies'} read:`);
      for (const l of cov.libraryLines(libs)) out.push(`  ${l}`);
    }
    return out.join('\n');
  }

  /**
   * squeeze_output({ content }) → string
   *
   * Compress noisy tool/command/agent output (stack trace, CI/build log, or JSON
   * payload) through the deterministic squeeze engine. Enriches the top stack
   * frame with its signature when the symbol index is available. Passes the input
   * through unchanged when no squeezable structure is detected.
   */
  function squeezeOutput(args, cwd) {
    const content = args && typeof args.content === 'string' ? args.content : '';
    if (!content.trim()) {
      return 'Usage: squeeze_output({ content: "<raw tool/log/JSON output>" }) — provide the output to compress.';
    }

    let sq;
    try {
      const { squeeze } = __require('./src/squeeze/index');
      let srcDirs;
      let symbolIndex = null;
      try {
        const { loadConfig } = __require('./src/config/loader');
        srcDirs = loadConfig(cwd).srcDirs;
      } catch (_) {}
      try {
        const { buildSigIndex } = __require('./src/retrieval/ranker');
        symbolIndex = buildSigIndex(cwd, { full: true });
      } catch (_) {}
      sq = squeeze(content, { srcDirs, symbolIndex });
    } catch (err) {
      return `_squeeze_output failed: ${err.message}_`;
    }

    if (!sq.category || !sq.applies) {
      return `No squeezable structure detected — content unchanged (${sq.rawTokens} tokens).\n\n${content}`;
    }

    const pct = Math.round(sq.reduction * 100);
    const header =
      `Squeezed ${sq.category} — ${sq.rawTokens} → ${sq.squeezedTokens} tokens ` +
      `(${pct}% smaller)${sq.enriched ? ' · signature-enriched' : ''}\n\n`;
    return header + sq.squeezed;
  }

  // query_knowledge_map({ library | file }) → string (#626, increment 1 of #543)
  function queryKnowledgeMap(args, cwd) {
    const km = __require('./src/map/knowledge-map');
    const map = km.loadOrBuild(cwd);
    if (args && args.library) {
      const impact = km.upgradeImpact(map, String(args.library));
      if (!impact) return `No library node for "${args.library}" — not a declared dependency, or no file imports it.`;
      const lines = [`Upgrade impact for ${impact.library}:`];
      lines.push(`  importing files (${impact.importers.length}):`);
      for (const f of impact.importers) lines.push(`    ${f.replace(/^file:/, '')}`);
      lines.push(`  callers/importers of those (${impact.callers.length}):`);
      for (const f of impact.callers) lines.push(`    ${f.replace(/^file:/, '')}`);
      lines.push(`  covering tests (${impact.tests.length}):`);
      for (const f of impact.tests) lines.push(`    ${f.replace(/^file:/, '')}`);
      return lines.join('\n');
    }
    if (args && args.file) {
      const n = km.fileNeighbors(map, String(args.file));
      if (!n) return `No file node for "${args.file}" in the knowledge map.`;
      const lines = [`Knowledge-map neighbors of ${args.file}:`];
      for (const [k, v] of Object.entries(n)) {
        if (v.length === 0) continue;
        lines.push(`  ${k} (${v.length}): ${v.map((x) => x.replace(/^(file|symbol|lib|route|env):/, '')).slice(0, 20).join(', ')}${v.length > 20 ? ` … +${v.length - 20} more` : ''}`);
      }
      if (lines.length === 1) lines.push('  (no edges)');
      return lines.join('\n');
    }
    if (args && args.env) {
      const r = km.envReaders(map, String(args.env));
      if (!r) return `No env-var node for "${args.env}" — nothing reads it and no committed .env example declares it.`;
      const lines = [`Env var ${r.env}:`];
      lines.push(`  declared in a committed .env example: ${r.inExample ? 'yes' : 'no'}`);
      lines.push(`  reader files (${r.readers.length}):`);
      for (const f of r.readers) lines.push(`    ${f.replace(/^file:/, '')}`);
      return lines.join('\n');
    }
    return `Knowledge map: schema v${map.schema} · ${map.nodes.length} nodes · ${map.edges.length} edges. Pass { library } for upgrade impact, { file } for neighbors, or { env } for readers of an environment variable.`;
  }

  module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getMethodImpact, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput, getBudget, queryKnowledgeMap, logSessionUsage };
  
};

// ── ./src/mcp/install ──
__factories["./src/mcp/install"] = function(module, exports) {
  
  /**
   * Per-client MCP install (v8.0 E4).
   *
   * `sigmap --setup` wires *every* known editor at once and only touches config
   * files that already exist (to avoid creating clutter for editors the user does
   * not use). This module is the targeted counterpart: `sigmap mcp install <client>`
   * picks one client, and — because the user explicitly asked for it — CREATES the
   * config dir/file if it is missing. Idempotent: re-running never duplicates the
   * entry. Zero dependencies; only `fs`/`path`/`os`.
   */

  const fs   = require('fs');
  const path = require('path');
  const os   = require('os');
  const { spawnSync } = require('child_process');

  // Config shapes the supported clients use.
  //  - 'json'  → { mcpServers: { sigmap: { command, args } } }
  //  - 'vscode'→ { servers: { sigmap: { type: 'stdio', command, args } } }
  //  - 'zed'   → { context_servers: { sigmap: { command: { path, args } } } }
  //  - 'opencode' → { mcp: { sigmap: { type: 'local', command: [...] } } }
  //  - 'codex' → Codex CLI ~/.codex/config.toml ([mcp_servers.sigmap])
  const CLIENTS = {
    claude:   { label: 'Claude Code',  format: 'json', scope: 'project', project: ['.mcp.json'] },
    cursor:   { label: 'Cursor',       format: 'json', scope: 'project', project: ['.cursor', 'mcp.json'] },
    windsurf: { label: 'Windsurf',     format: 'json', scope: 'both',
                project: ['.windsurf', 'mcp.json'],
                global:  ['.codeium', 'windsurf', 'mcp_config.json'] },
    vscode:   { label: 'VS Code',      format: 'vscode', scope: 'project', project: ['.vscode', 'mcp.json'] },
    opencode: { label: 'OpenCode',     format: 'opencode', scope: 'both',
                project: ['opencode.json'],
                global:  ['.config', 'opencode', 'opencode.json'] },
    gemini:   { label: 'Gemini CLI',   format: 'json', scope: 'global', global: ['.gemini', 'settings.json'] },
    zed:      { label: 'Zed',          format: 'zed',  scope: 'global', global: ['.config', 'zed', 'settings.json'] },
    codex:    { label: 'Codex CLI',    format: 'codex', scope: 'global', global: ['.codex', 'config.toml'] },
    mcp:      { label: 'Portable (.mcp.json)', format: 'json', scope: 'project', project: ['.mcp.json'] },
  };

  /** Resolve the absolute config path for a client, honoring `global`. */
  function resolveTarget(spec, cwd, home, useGlobal) {
    const wantGlobal = useGlobal || spec.scope === 'global';
    if (wantGlobal && spec.global) return path.join(home, ...spec.global);
    if (spec.project) return path.join(cwd, ...spec.project);
    if (spec.global)  return path.join(home, ...spec.global);
    return null;
  }

  /** List supported clients with their resolved target paths. */
  function listClients(opts = {}) {
    const cwd  = opts.cwd  || process.cwd();
    const home = opts.home || os.homedir();
    const codexHome = path.resolve(cwd, opts.codexHome || (opts.env || process.env).CODEX_HOME || path.join(home, '.codex'));
    return Object.keys(CLIENTS).map((key) => {
      const spec = CLIENTS[key];
      const target = key === 'codex' ? path.join(codexHome, 'config.toml') : resolveTarget(spec, cwd, home, false);
      return {
        client: key,
        label:  spec.label,
        scope:  spec.scope,
        format: spec.format,
        target,
        globalTarget: spec.scope === 'both' ? resolveTarget(spec, cwd, home, true) : null,
      };
    });
  }

  function serverArgs(scriptPath, portable = false) {
    return portable ? ['-y', 'sigmap', '--mcp'] : [path.resolve(scriptPath), '--mcp'];
  }

  function _readJsonObject(filePath) {
    let settings;
    try { settings = JSON.parse(fs.readFileSync(filePath, 'utf8')); }
    catch (err) { throw new Error(`Invalid JSON in ${filePath}: ${err.message}`); }
    if (!settings || typeof settings !== 'object' || Array.isArray(settings)) {
      throw new Error(`Invalid JSON in ${filePath}: expected a top-level object`);
    }
    return settings;
  }

  /** Install into a JSON `mcpServers` config (create file/dir if absent). */
  function _installJson(filePath, scriptPath, portable = false, rejectInvalid = false) {
    let settings = {};
    if (fs.existsSync(filePath)) {
      if (rejectInvalid) settings = _readJsonObject(filePath);
      else try { settings = JSON.parse(fs.readFileSync(filePath, 'utf8')) || {}; }
      catch (err) {
        settings = {};
      }
    }
    if (rejectInvalid && settings.mcpServers !== undefined &&
        (!settings.mcpServers || typeof settings.mcpServers !== 'object' || Array.isArray(settings.mcpServers))) {
      throw new Error(`Invalid JSON in ${filePath}: mcpServers must be an object`);
    }
    if (!settings.mcpServers) settings.mcpServers = {};
    if (settings.mcpServers.sigmap) return 'already';
    settings.mcpServers.sigmap = {
      command: portable ? 'npx' : 'node',
      args: serverArgs(scriptPath, portable),
    };
    fs.mkdirSync(path.dirname(filePath), { recursive: true });
    fs.writeFileSync(filePath, JSON.stringify(settings, null, 2) + '\n');
    return 'installed';
  }

  /**
   * Install into VS Code's `.vscode/mcp.json`, which keys servers under `servers`
   * (not `mcpServers`) and expects an explicit transport `type`. A config written
   * by an older SigMap under `mcpServers` is migrated rather than left in place,
   * so re-running repairs it instead of leaving two entries VS Code cannot read.
   */
  function _installVscode(filePath, scriptPath) {
    let settings = {};
    if (fs.existsSync(filePath)) {
      try { settings = JSON.parse(fs.readFileSync(filePath, 'utf8')) || {}; }
      catch (_) { settings = {}; }
    }
    const stale = settings.mcpServers && settings.mcpServers.sigmap;
    if (stale) {
      delete settings.mcpServers.sigmap;
      if (Object.keys(settings.mcpServers).length === 0) delete settings.mcpServers;
    }
    if (!settings.servers) settings.servers = {};
    if (settings.servers.sigmap && !stale) return 'already';
    settings.servers.sigmap = { type: 'stdio', command: 'node', args: serverArgs(scriptPath) };
    fs.mkdirSync(path.dirname(filePath), { recursive: true });
    fs.writeFileSync(filePath, JSON.stringify(settings, null, 2) + '\n');
    return stale ? 'updated' : 'installed';
  }

  /** Install into Zed's `context_servers` config (create file/dir if absent). */
  function _installZed(filePath, scriptPath) {
    let settings = {};
    if (fs.existsSync(filePath)) {
      try { settings = JSON.parse(fs.readFileSync(filePath, 'utf8')) || {}; }
      catch (_) { settings = {}; }
    }
    if (!settings.context_servers) settings.context_servers = {};
    if (settings.context_servers.sigmap) return 'already';
    settings.context_servers.sigmap = { command: { path: 'node', args: serverArgs(scriptPath) } };
    fs.mkdirSync(path.dirname(filePath), { recursive: true });
    fs.writeFileSync(filePath, JSON.stringify(settings, null, 2) + '\n');
    return 'installed';
  }

  function _removeLegacyClaudeEntry(filePath) {
    if (!fs.existsSync(filePath)) return false;
    let settings;
    try { settings = JSON.parse(fs.readFileSync(filePath, 'utf8')) || {}; }
    catch (_) { return false; }
    if (!settings.mcpServers || !settings.mcpServers.sigmap) return false;
    delete settings.mcpServers.sigmap;
    if (Object.keys(settings.mcpServers).length === 0) delete settings.mcpServers;
    fs.writeFileSync(filePath, JSON.stringify(settings, null, 2) + '\n');
    return true;
  }

  function _removeLegacyOpenCodeEntry(filePath) {
    if (!fs.existsSync(filePath)) return false;
    let settings;
    try { settings = JSON.parse(fs.readFileSync(filePath, 'utf8')) || {}; }
    catch (_) { return false; }
    if (!settings.mcpServers || !settings.mcpServers.sigmap) return false;
    delete settings.mcpServers.sigmap;
    if (Object.keys(settings.mcpServers).length === 0) delete settings.mcpServers;
    fs.writeFileSync(filePath, JSON.stringify(settings, null, 2) + '\n');
    return true;
  }

  /** Remove only the old SigMap block written to Codex's ignored YAML path. */
  function _removeLegacyCodexYaml(filePath) {
    if (!fs.existsSync(filePath)) return false;
    const lines = fs.readFileSync(filePath, 'utf8').split(/\r?\n/);
    const root = lines.findIndex((line) => /^mcpServers:\s*(?:#.*)?$/.test(line));
    if (root === -1) return false;
    const endRoot = lines.findIndex((line, i) => i > root && /^\S/.test(line) && !/^\s*#/.test(line));
    const limit = endRoot === -1 ? lines.length : endRoot;
    const entry = lines.findIndex((line, i) => i > root && i < limit && /^  sigmap:\s*(?:#.*)?$/.test(line));
    if (entry === -1) return false;
    let end = entry + 1;
    while (end < limit && !/^ {0,2}\S/.test(lines[end])) end++;
    lines.splice(entry, end - entry);
    const nextRoot = lines.findIndex((line, i) => i > root && /^\S/.test(line) && !/^\s*#/.test(line));
    const afterRoot = nextRoot === -1 ? lines.length : nextRoot;
    if (!lines.slice(root + 1, afterRoot).some((line) => /^  \S/.test(line))) lines.splice(root, 1);
    fs.writeFileSync(filePath, lines.join('\n').replace(/\n*$/, '\n'));
    return true;
  }

  /** Install into Codex CLI TOML and migrate SigMap out of its former YAML file. */
  function _installCodex(filePath, legacyYamlPath) {
    let raw = fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
    const hasEntry = /^\[mcp_servers\.sigmap\]\s*$/m.test(raw);
    if (!hasEntry) {
      const block = [
        '[mcp_servers.sigmap]',
        'command = "npx"',
        'args = ["-y", "sigmap", "--mcp"]',
      ].join('\n');
      raw = raw ? raw.trimEnd() + '\n\n' + block + '\n' : block + '\n';
      fs.mkdirSync(path.dirname(filePath), { recursive: true });
      fs.writeFileSync(filePath, raw);
    }
    const migrated = _removeLegacyCodexYaml(legacyYamlPath);
    return migrated ? 'updated' : hasEntry ? 'already' : 'installed';
  }

  /** Install OpenCode's documented `mcp` local-server shape. */
  function _installOpenCode(filePath) {
    let settings = {};
    if (fs.existsSync(filePath)) settings = _readJsonObject(filePath);
    let migrated = false;
    if (settings.mcpServers && settings.mcpServers.sigmap) {
      delete settings.mcpServers.sigmap;
      if (Object.keys(settings.mcpServers).length === 0) delete settings.mcpServers;
      migrated = true;
    }
    if (settings.mcp === undefined) settings.mcp = {};
    else if (!settings.mcp || typeof settings.mcp !== 'object' || Array.isArray(settings.mcp)) {
      throw new Error(`Invalid JSON in ${filePath}: mcp must be an object`);
    }
    if (settings.mcp.sigmap) {
      if (!migrated) return 'already';
      fs.mkdirSync(path.dirname(filePath), { recursive: true });
      fs.writeFileSync(filePath, JSON.stringify(settings, null, 2) + '\n');
      return 'updated';
    }
    settings.mcp.sigmap = { type: 'local', command: ['npx', '-y', 'sigmap', '--mcp'], enabled: true };
    fs.mkdirSync(path.dirname(filePath), { recursive: true });
    fs.writeFileSync(filePath, JSON.stringify(settings, null, 2) + '\n');
    return migrated ? 'updated' : 'installed';
  }

  const HOST_READERS = {
    claude: { command: 'claude', args: ['mcp', 'list'], hint: 'Run `claude mcp list` and approve SigMap on first use.' },
    codex: { command: 'codex', args: ['mcp', 'list'], hint: 'Run `codex mcp list` and confirm SigMap is enabled.' },
    opencode: { command: 'opencode', args: ['mcp', 'list'], hint: 'Run `opencode mcp list` and confirm SigMap is listed.' },
  };

  /** Verify a client-specific install through the host CLI when it is available. */
  function verifyClient(client, opts = {}) {
    const reader = HOST_READERS[client];
    if (!reader) return { status: 'not-applicable' };
    const result = spawnSync(reader.command, reader.args, {
      cwd: opts.cwd || process.cwd(),
      env: opts.env || process.env,
      encoding: 'utf8',
      timeout: 15000,
      windowsHide: true,
      shell: process.platform === 'win32',
    });
    const output = `${result.stdout || ''}\n${result.stderr || ''}`;
    if ((result.error && result.error.code === 'ENOENT') || result.status === 127 || /is not recognized as (?:a name of a cmdlet|an internal or external command)|command not found/i.test(output)) {
      return { status: 'unavailable', command: reader.command, hint: reader.hint };
    }
    if (result.error || result.status !== 0) {
      return { status: 'failed', command: reader.command, reason: `${reader.command} mcp list failed` };
    }
    const lines = output.split(/\r?\n/);
    const entry = lines.find((line) => /\bsigmap\b/i.test(line));
    if (!entry || (client === 'opencode' && /\bfailed:/i.test(entry))) {
      return { status: 'failed', command: reader.command, reason: `${reader.command} mcp list did not report a usable SigMap server` };
    }
    return { status: 'verified', command: reader.command };
  }

  /**
   * Install the sigmap MCP server for a single client.
   * @returns { client, label, path, status } where status is
   *   'installed' | 'already' | 'unknown'.
   */
  function installClient(client, opts = {}) {
    const spec = CLIENTS[client];
    if (!spec) {
      return { client, status: 'unknown', valid: Object.keys(CLIENTS) };
    }
    const cwd        = opts.cwd  || process.cwd();
    const home       = opts.home || os.homedir();
    const env        = opts.env || process.env;
    const scriptPath = opts.scriptPath || path.join(cwd, 'gen-context.js');
    const codexHome  = path.resolve(cwd, env.CODEX_HOME || path.join(home, '.codex'));
    const filePath   = client === 'codex' ? path.join(codexHome, 'config.toml') : resolveTarget(spec, cwd, home, opts.global);

    let status;
    if (spec.format === 'vscode')       status = _installVscode(filePath, scriptPath);
    else if (spec.format === 'zed')     status = _installZed(filePath, scriptPath);
    else if (spec.format === 'codex')   status = _installCodex(filePath, path.join(codexHome, 'config.yaml'));
    else if (spec.format === 'opencode') {
      const legacyPath = opts.global ? path.join(home, '.config', 'opencode', 'config.json') : null;
      status = _installOpenCode(filePath);
      const migratedLegacy = legacyPath && _removeLegacyOpenCodeEntry(legacyPath);
      if (migratedLegacy) status = 'updated';
    }
    else {
      status = _installJson(filePath, scriptPath, client === 'claude', client === 'claude');
      const migrated = client === 'claude' && _removeLegacyClaudeEntry(path.join(cwd, '.claude', 'settings.json'));
      if (migrated) status = 'updated';
    }

    return { client, label: spec.label, path: filePath, status };
  }

  module.exports = { CLIENTS, listClients, installClient, resolveTarget, verifyClient };
  
};

// ── ./src/mcp/profile ──
__factories["./src/mcp/profile"] = function(module, exports) {
  
  /**
   * MCP tool profile (#966, from #878).
   *
   * Every tool definition is paid for in tokens at the start of every MCP session,
   * and a longer list gives the model more to choose between. `mcp.tools` picks
   * which of the shipped tools a server advertises (`tools/list`) and answers
   * (`tools/call`):
   *
   *   "all"      every shipped tool — the default, and what an absent key means
   *   "core"     the retrieval + grounding loop only (CORE below)
   *   [names]    exactly those tools
   *
   * One function resolves it for the server and for `sigmap doctor`, so the tool
   * count and the token figure cannot disagree. `log_session_usage` is not part of
   * any profile: `session.mcpCapture` alone decides whether that tool exists.
   *
   * A bad value never breaks a server. It falls back to "all" (or drops the names
   * that are not tools) and says why in `notes`, which `doctor` prints. The same
   * goes for a setting that was meant for this block and does not parse as one: an
   * `mcp` that is not an object, or a key beside `tools` that SigMap does not read —
   * a typo there would otherwise leave the profile silently on "all".
   */

  const { TOOLS, LOG_SESSION_USAGE } = __require('./src/mcp/tools');
  const { DEFAULTS } = __require('./src/config/defaults');

  /**
   * The grounding loop the MCP guide documents as "your agent's live loop": rank the
   * files, read the map, pin the exact signatures, read the anchored lines, size the
   * change, verify the answer. A profile that could not follow that loop would
   * contradict the page that explains why the tools exist.
   */
  const CORE = Object.freeze([
    'query_context',
    'read_context',
    'get_callee_signatures',
    'get_lines',
    'get_impact',
    'get_method_impact',
    'verify_suggestion',
  ]);

  const MAX_LISTED = 5;

  /** Estimated tokens for a tool list as a client receives it (chars/4, as everywhere in SigMap). */
  function definitionTokens(tools) {
    return Math.ceil(JSON.stringify(tools).length / 4);
  }

  function _shown(names) {
    const head = names.slice(0, MAX_LISTED).join(', ');
    return names.length > MAX_LISTED ? `${head}, … (${names.length - MAX_LISTED} more)` : head;
  }

  /**
   * Resolve `config.mcp.tools` against a tool list.
   *
   * @param {object} config  a loaded SigMap config; only `config.mcp` is read
   * @param {object[]} [tools]  the tools on offer (tests pass a subset); defaults to the shipped TOOLS
   * @returns {{ profile: 'all'|'core'|'custom', requested: *, tools: object[], names: string[],
   *             total: number, tokens: number, allTokens: number, coreTokens: number, notes: string[] }}
   */
  function resolveProfile(config, tools = TOOLS) {
    const block = config ? config.mcp : undefined;
    const hasBlock = block !== undefined && block !== null;
    const isObject = hasBlock && typeof block === 'object' && !Array.isArray(block);
    const mcp = isObject ? block : {};
    const requested = mcp.tools === undefined ? null : mcp.tools;
    const shipped = new Set(tools.map((t) => t.name));
    const notes = [];
    let profile = 'all';
    let selected = tools;

    const fallBack = (why) => notes.push(`${why} — advertising all ${tools.length} tools`);

    if (hasBlock && !isObject) {
      fallBack(`mcp must be an object such as { "tools": "core" } (got ${JSON.stringify(block)})`);
    } else if (isObject) {
      const known = Object.keys(DEFAULTS.mcp);
      const stray = Object.keys(mcp).filter((k) => !known.includes(k));
      if (stray.length > 0) {
        notes.push(`${stray.map((k) => `mcp.${k}`).join(', ')} ${stray.length === 1 ? 'is not a setting' : 'are not settings'} ` +
          `SigMap reads (it reads ${known.map((k) => `mcp.${k}`).join(', ')})`);
      }
    }

    if (requested === null) {
      // No key: the default, and the reason an existing config sees no change.
    } else if (typeof requested === 'string') {
      const v = requested.trim().toLowerCase();
      if (v === 'core') {
        profile = 'core';
        selected = tools.filter((t) => CORE.includes(t.name));
      } else if (v !== 'all') {
        fallBack(`mcp.tools is "${requested}"; expected "all", "core" or a list of tool names`);
      }
    } else if (Array.isArray(requested)) {
      const wanted = new Set();
      const ignored = [];
      for (const raw of requested) {
        const name = typeof raw === 'string' ? raw.trim() : '';
        if (shipped.has(name)) wanted.add(name);
        else ignored.push(typeof raw === 'string' ? raw : JSON.stringify(raw));
      }
      // Two different mistakes, two notes: one name is a real tool with its own switch,
      // the rest are not tools at all. Saying only the first would hide a typo.
      const capture = ignored.filter((n) => n === LOG_SESSION_USAGE.name);
      const unknown = ignored.filter((n) => n !== LOG_SESSION_USAGE.name);
      if (capture.length > 0) notes.push(`${LOG_SESSION_USAGE.name} is switched by session.mcpCapture, not listed in mcp.tools`);
      if (unknown.length > 0) notes.push(`mcp.tools names no such tool: ${_shown(unknown)}`);
      if (wanted.size === 0) {
        fallBack('mcp.tools lists no shipped tool');
      } else {
        profile = 'custom';
        selected = tools.filter((t) => wanted.has(t.name));
      }
    } else {
      fallBack(`mcp.tools must be "all", "core" or a list of tool names (got ${JSON.stringify(requested)})`);
    }

    return {
      profile,
      requested,
      tools: selected,
      names: selected.map((t) => t.name),
      total: tools.length,
      tokens: definitionTokens(selected),
      allTokens: definitionTokens(tools),
      coreTokens: definitionTokens(tools.filter((t) => CORE.includes(t.name))),
      notes,
    };
  }

  /** Whether the resolved profile advertises (and so answers) a tool. */
  function has(resolved, name) {
    return resolved.names.includes(name);
  }

  /**
   * One phrase for doctor and docs alike: the profile, its tool count and what its definitions
   * cost — `core (N of M tools, ~T tokens of definitions)`. With `captureOn` (session.mcpCapture)
   * the server also lists `log_session_usage`, so the phrase says what the client really receives.
   */
  function label(resolved, captureOn = false) {
    const kind = resolved.profile === 'custom' ? 'custom list' : resolved.profile;
    const count = resolved.profile === 'all'
      ? `${resolved.names.length} tools`
      : `${resolved.names.length} of ${resolved.total} tools`;
    const base = `${kind} (${count}, ~${resolved.tokens.toLocaleString('en-US')} tokens of definitions)`;
    if (!captureOn) return base;
    const all = definitionTokens(resolved.tools.concat([LOG_SESSION_USAGE]));
    return `${base} + ${LOG_SESSION_USAGE.name} (session.mcpCapture): ~${all.toLocaleString('en-US')} tokens in all`;
  }

  /**
   * The `tools/call` answer for a shipped tool the profile does not advertise. It is read by an
   * agent, so it states what is true and who can change it; it does not tell the reader to
   * edit anything.
   */
  function refusal(name, resolved) {
    const what = resolved.profile === 'custom'
      ? 'the tools listed in mcp.tools'
      : `the "${resolved.profile}" profile`;
    return `Tool not enabled: ${name}. This project's MCP server advertises ${what} (${resolved.names.length} of ${resolved.total} tools). ` +
      'The project owner can enable it by setting "mcp.tools": "all" in gen-context.config.json and restarting the server.';
  }

  /**
   * The one-line `instructions` of `server/discover`, naming only tools the client
   * can actually call. With every tool listed it is the sentence the server always sent.
   */
  function instructionsFor(resolved) {
    const lead = ['query_context', 'search_signatures'].filter((n) => has(resolved, n));
    const how = lead.length > 0
      ? `Call ${lead.join(' or ')} to rank and fetch signature blocks instead of reading whole files.`
      : has(resolved, 'read_context')
        ? 'Call read_context to read signature blocks instead of reading whole files.'
        : 'Use the listed tools to read signatures instead of whole files.';
    return `SigMap serves code signatures for the working directory. ${how}`;
  }

  module.exports = { CORE, resolveProfile, has, label, refusal, instructionsFor, definitionTokens };
  
};

// ── ./src/mcp/server ──
__factories["./src/mcp/server"] = function(module, exports) {
  
  /**
   * SigMap MCP server — zero npm dependencies.
   *
   * Wire protocol: JSON-RPC 2.0 over stdio.
   * One JSON object per line on both stdin and stdout.
   *
   * Supported methods:
   *   initialize        → serverInfo + capabilities + negotiated protocolVersion
   *   tools/list        → the tools `mcp.tools` selects: 22 by default (23 with
   *                       session.mcpCapture on), fewer with "core" (#878)
   *   tools/call        → dispatch to handler, return result; a shipped tool the
   *                       profile does not advertise is refused
   */

  const readline = require('readline');
  const crypto = require('crypto');
  const { TOOLS, LOG_SESSION_USAGE } = __require('./src/mcp/tools');
  const { resolveProfile, has: profileHas, refusal: profileRefusal, instructionsFor } = __require('./src/mcp/profile');
  const { ensureSelfIgnore } = __require('./src/util/context-dir');
  const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getMethodImpact, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput, getBudget, queryKnowledgeMap, logSessionUsage } = __require('./src/mcp/handlers');

  const SERVER_INFO = {
    name: 'sigmap',
    version: '8.85.0',
    description: 'SigMap MCP server — code signatures on demand',
  };

  // Protocol revisions this server actually speaks. The tools-only surface —
  // initialize / tools/list / tools/call plus the initialized/cancelled
  // notifications — is identical across these revisions, and the
  // @hasmcp/mcp-spec-test suite passes every applicable 2025-11-25 case against
  // it. 2026-07-28 is deliberately absent: that revision requires
  // server/discover, which is not implemented. Newest first: a client offering
  // a version outside this list is downgraded to [0], never echoed back —
  // echoing an unspeakable version is itself a spec violation (#544), and it
  // made the conformance suite believe 2026-07-28 was supported, producing six
  // phantom server/discover failures on a revision never really offered (#545).
  const SUPPORTED_PROTOCOL_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];

  // ---------------------------------------------------------------------------
  // JSON-RPC helpers
  // ---------------------------------------------------------------------------
  function respond(id, result) {
    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, result }) + '\n');
  }

  function respondError(id, code, message) {
    process.stdout.write(
      JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } }) + '\n'
    );
  }

  // ---------------------------------------------------------------------------
  // Connection identity (#951)
  // ---------------------------------------------------------------------------
  // One stdio server is one client connection. `log_session_usage` needs to tell
  // connections apart (an agent that sends no session id still gets exactly one)
  // and to name the agent, which only `initialize` knows. The token is random, so
  // two connections never share a session id.
  const connection = { client: null, token: null };

  function _connection() {
    if (!connection.token) connection.token = crypto.randomBytes(6).toString('hex');
    return connection;
  }

  /** Whether this project has opted in to the session-capture tool. Never throws. */
  function _sessionCaptureOn(cwd) {
    try {
      const cfg = __require('./src/config/loader').loadConfig(cwd) || {};
      return __require('./src/session/store').sessionConfig(cfg).mcpCapture === true;
    } catch (_) {
      return false;
    }
  }

  // The tool profile (#878) is read once, when the first message needs it, and held
  // for the life of the server. A host fetches `tools/list` when it starts the
  // server and caches it, so a config edit takes effect on the next start either
  // way; reading it once also keeps `tools/call` from re-reading the config.
  const profiles = new Map();

  /** The resolved `mcp.tools` profile for this project. Never throws: a broken config serves every tool. */
  function _toolProfile(cwd) {
    if (!profiles.has(cwd)) {
      let resolved;
      try {
        resolved = resolveProfile(__require('./src/config/loader').loadConfig(cwd) || {});
      } catch (_) {
        resolved = resolveProfile({});
      }
      profiles.set(cwd, resolved);
    }
    return profiles.get(cwd);
  }

  // ---------------------------------------------------------------------------
  // Method dispatcher
  // ---------------------------------------------------------------------------
  function dispatch(msg, cwd) {
    const { method, id, params } = msg;

    // Notifications (no id) need no response
    if (method === 'notifications/initialized' || method === 'notifications/cancelled') {
      return;
    }

    // server/discover (spec 2026-07-28) — session-less discovery, answerable
    // before any handshake, so a client can learn the honest version list
    // instead of offering versions and hoping. The response is a
    // CacheableResult: deterministic, so the TTL promise of stability holds.
    // Note supportedVersions does NOT include 2026-07-28 — answering discover
    // is forward-compatible plumbing, not a claim to serve that revision's
    // whole surface (per-result envelopes, inline _meta negotiation).
    if (method === 'server/discover') {
      respond(id, {
        resultType: 'complete',
        cacheScope: 'public',
        ttlMs: 3600000,
        supportedVersions: SUPPORTED_PROTOCOL_VERSIONS,
        capabilities: { tools: {} },
        serverInfo: SERVER_INFO,
        instructions: instructionsFor(_toolProfile(cwd)),
      });
      return;
    }

    if (method === 'initialize') {
      const offered = params && params.protocolVersion;
      const info = params && params.clientInfo;
      if (info && typeof info.name === 'string') _connection().client = info.name.slice(0, 80);
      respond(id, {
        protocolVersion: SUPPORTED_PROTOCOL_VERSIONS.includes(offered)
          ? offered
          : SUPPORTED_PROTOCOL_VERSIONS[0],
        serverInfo: SERVER_INFO,
        capabilities: { tools: {} },
      });
      return;
    }

    if (method === 'tools/list') {
      // No pagination: the full list fits one page, so any cursor a client
      // presents is one this server never issued — reject it (-32602, per the
      // spec's SHOULD) rather than silently restarting from page one.
      if (params && params.cursor !== undefined) {
        respondError(id, -32602, `Invalid cursor: ${String(params.cursor)}`);
        return;
      }
      const advertised = _toolProfile(cwd).tools;
      respond(id, { tools: _sessionCaptureOn(cwd) ? advertised.concat([LOG_SESSION_USAGE]) : advertised });
      return;
    }

    if (method === 'tools/call') {
      const name = params && params.name;
      const args = (params && params.arguments) || {};

      // A tool the profile does not advertise is not callable either: an unlisted
      // tool that still answered would make `mcp.tools` a suggestion rather than a
      // switch (the rule `log_session_usage` already follows). A name that is not a
      // tool at all falls through to "Unknown tool" below.
      const profile = _toolProfile(cwd);
      if (TOOLS.some((t) => t.name === name) && !profileHas(profile, name)) {
        respondError(id, -32601, profileRefusal(name, profile));
        return;
      }

      let text;
      try {
        if (name === 'read_context') text = readContext(args, cwd);
        else if (name === 'search_signatures') text = searchSignatures(args, cwd);
        else if (name === 'get_map') text = getMap(args, cwd);
        else if (name === 'create_checkpoint') text = createCheckpoint(args, cwd);
        else if (name === 'get_routing') text = getRouting(args, cwd);
        else if (name === 'explain_file') text = explainFile(args, cwd);
        else if (name === 'list_modules') text = listModules(args, cwd);
        else if (name === 'query_context') text = queryContext(args, cwd);
        else if (name === 'get_method_impact') text = getMethodImpact(args, cwd);
        else if (name === 'get_impact') text = getImpact(args, cwd);
        else if (name === 'get_lines') text = getLines(args, cwd);
        else if (name === 'read_memory') text = readMemory(args, cwd);
        else if (name === 'get_callee_signatures') text = getCalleeSignatures(args, cwd);
        else if (name === 'sigmap_notify_file_created') text = notifyFileCreated(args, cwd);
        else if (name === 'sigmap_notify_symbol_added') text = notifySymbolAdded(args, cwd);
        else if (name === 'sigmap_notify_file_deleted') text = notifyFileDeleted(args, cwd);
        else if (name === 'get_diff_context') text = getDiffContext(args, cwd);
        else if (name === 'get_architecture_overview') text = getArchitectureOverview(args, cwd);
        else if (name === 'verify_suggestion') text = verifySuggestion(args, cwd);
        else if (name === 'squeeze_output') text = squeezeOutput(args, cwd);
        else if (name === 'get_budget') text = getBudget(args, cwd);
        else if (name === 'query_knowledge_map') text = queryKnowledgeMap(args, cwd);
        // Not listed unless the project opted in, so not callable either: an unlisted
        // tool answering would make the opt-in a suggestion rather than a switch.
        else if (name === 'log_session_usage' && _sessionCaptureOn(cwd)) text = logSessionUsage(args, cwd, _connection());
        else {
          respondError(id, -32601, `Unknown tool: ${name}`);
          return;
        }
      } catch (err) {
        respondError(id, -32603, `Tool error: ${err.message}`);
        return;
      }

      // A long-lived server has no exit to hook, and a tool may just have created
      // `.context/` (overlay, checkpoint, caches): keep it out of git (#947).
      ensureSelfIgnore(cwd);

      respond(id, {
        content: [{ type: 'text', text: String(text) }],
      });
      return;
    }

    // Unknown method
    if (id !== undefined && id !== null) {
      respondError(id, -32601, `Method not found: ${method}`);
    }
  }

  // ---------------------------------------------------------------------------
  // Server entry point
  // ---------------------------------------------------------------------------
  function start(cwd) {
    const rl = readline.createInterface({ input: process.stdin, terminal: false });

    rl.on('line', (line) => {
      const trimmed = line.trim();
      if (!trimmed) return;

      let msg;
      try {
        msg = JSON.parse(trimmed);
      } catch (_) {
        // Cannot respond without a valid id — ignore malformed input
        return;
      }

      try {
        dispatch(msg, cwd);
      } catch (err) {
        const id = (msg && msg.id) != null ? msg.id : null;
        respondError(id, -32603, `Internal error: ${err.message}`);
      }
    });

    rl.on('close', () => {
      process.exit(0);
    });
  }

  module.exports = { start };
  
};

// ── ./src/mcp/tools ──
__factories["./src/mcp/tools"] = function(module, exports) {
  
  /**
   * MCP tool definitions for SigMap (22 tools).
   * read_context, search_signatures, get_map, create_checkpoint, get_routing,
   * explain_file, list_modules, query_context, get_method_impact, get_impact,
   * get_lines, read_memory, get_callee_signatures, sigmap_notify_file_created,
   * sigmap_notify_symbol_added, sigmap_notify_file_deleted, get_diff_context,
   * get_architecture_overview, verify_suggestion, squeeze_output, get_budget,
   * query_knowledge_map.
   *
   * Every definition is paid for in tokens at the start of every MCP session (#878),
   * so a description says what the tool returns and when to reach for it — nothing
   * else. Names, parameters, enums and `required` are the contract; the wording is
   * not. Which of these a server advertises is `mcp.tools` (see ./profile.js).
   */

  const TOOLS = [
    {
      name: 'read_context',
      description:
        'Read extracted code signatures for the whole project, or only a module path ' +
        '(~50–500 tokens scoped, ~500–4K for everything).',
      inputSchema: {
        type: 'object',
        properties: {
          module: {
            type: 'string',
            description: 'Optional subdirectory (e.g. "src/services"). Omit for the full context.',
          },
        },
        required: [],
      },
    },
    {
      name: 'search_signatures',
      description:
        'Search extracted signatures for a keyword, function name or class name; ' +
        'returns matching lines with their file paths.',
      inputSchema: {
        type: 'object',
        properties: {
          query: {
            type: 'string',
            description: 'Keyword (case-insensitive).',
          },
        },
        required: ['query'],
      },
    },
    {
      name: 'get_map',
      description:
        'Read a section of PROJECT_MAP.md: import graph, class hierarchy or route table. ' +
        'Needs gen-project-map.js to have been run.',
      inputSchema: {
        type: 'object',
        properties: {
          type: {
            type: 'string',
            enum: ['imports', 'classes', 'routes'],
            description: 'Section to retrieve: imports, classes or routes.',
          },
        },
        required: ['type'],
      },
    },
    {
      name: 'create_checkpoint',
      description:
        'Snapshot project state for a session handoff: recent commits, branch, ' +
        'token count and a compact context.',
      inputSchema: {
        type: 'object',
        properties: {
          note: {
            type: 'string',
            description: 'Optional note to include (e.g. what you were working on).',
          },
        },
        required: [],
      },
    },
    {
      name: 'get_routing',
      description:
        'Model routing hints: which files sit in which complexity tier ' +
        '(fast/balanced/powerful) and which model suits each type of task.',
      inputSchema: {
        type: 'object',
        properties: {},
        required: [],
      },
    },
    {
      name: 'explain_file',
      description:
        'Explain one file without reading its source: its signatures, what it imports ' +
        'and what imports it. Needs a generated context file.',
      inputSchema: {
        type: 'object',
        properties: {
          path: {
            type: 'string',
            description: 'Project-relative path (e.g. "src/services/auth.ts"), as shown in read_context.',
          },
        },
        required: ['path'],
      },
    },
    {
      name: 'list_modules',
      description:
        'List the top-level modules (srcDirs) in the context file by token count, ' +
        'to pick a module for read_context.',
      inputSchema: {
        type: 'object',
        properties: {},
        required: [],
      },
    },
    {
      name: 'query_context',
      description:
        'Rank files for a task or question and return the top-K with signatures and ' +
        'relevance scores — far cheaper than reading all context.',
      _meta: { 'anthropic/alwaysLoad': true },
      inputSchema: {
        type: 'object',
        properties: {
          query: {
            type: 'string',
            description: 'Task description or keywords (e.g. "add a new language extractor", "auth module").',
          },
          topK: {
            type: 'number',
            description: 'Maximum number of files to return (default: 10, max: 25).',
          },
        },
        required: ['query'],
      },
    },
    {
      name: 'get_method_impact',
      description:
        'Method-level blast radius for a symbol: every function that (transitively) calls it, ' +
        'or with direction "callees" every repo function it calls. Finer than get_impact — ' +
        'which functions break, not just which files. JS/TS, Python, Java, Go, Rust; deterministic.',
      inputSchema: {
        type: 'object',
        properties: {
          symbol: {
            type: 'string',
            description:
              'Function/method name, or "file#name" to disambiguate ' +
              '(e.g. "src/auth/session.js#validateToken").',
          },
          direction: {
            type: 'string',
            enum: ['callers', 'callees'],
            description: '"callers" (default) = blast radius; "callees" = what the symbol calls.',
          },
          depth: {
            type: 'number',
            description: 'BFS depth limit (default 0 = unlimited).',
          },
        },
        required: ['symbol'],
      },
    },
    {
      name: 'get_impact',
      description:
        'Blast radius of changing a file — check it before an edit: direct and transitive ' +
        'importers, affected tests, routes and controllers.',
      inputSchema: {
        type: 'object',
        properties: {
          file: {
            type: 'string',
            description: 'Project-relative path of the changed file, forward slashes (e.g. "src/extractors/python.js").',
          },
          depth: {
            type: 'number',
            description: 'BFS depth limit (default: 3). Use 0 for unlimited.',
          },
        },
        required: ['file'],
      },
    },
    {
      name: 'get_lines',
      description:
        'Fetch an exact line range from a file — use the `path:start-end` anchors in signatures ' +
        'instead of re-opening the whole file. Clamped to the file bounds, secret-redacted, ' +
        'sandboxed to the project root.',
      inputSchema: {
        type: 'object',
        properties: {
          file: {
            type: 'string',
            description: 'Project-relative path, forward slashes (e.g. "src/config/loader.js"), as in a signature anchor.',
          },
          start: {
            type: 'number',
            description: '1-based start line (inclusive).',
          },
          end: {
            type: 'number',
            description: '1-based end line (inclusive).',
          },
        },
        required: ['file', 'start', 'end'],
      },
    },
    {
      name: 'read_memory',
      description:
        'Recall the project decision log — recent notes left across sessions (via `sigmap note`) ' +
        'plus the last ranking-session focus. Call at the start of a task to answer ' +
        '"what were we doing and why" without re-reading the codebase.',
      inputSchema: {
        type: 'object',
        properties: {
          limit: {
            type: 'number',
            description: 'How many of the most recent notes to return (default: 10, max: 50).',
          },
        },
        required: [],
      },
    },
    {
      name: 'get_callee_signatures',
      description:
        'Return the EXACT current signature(s) of named symbols from the index, so you never ' +
        "guess a callee's parameter types from memory. Call before writing code that uses a " +
        'symbol; unknown names get a closest-match suggestion.',
      inputSchema: {
        type: 'object',
        properties: {
          symbols: {
            type: 'array',
            items: { type: 'string' },
            description: 'Symbol names to resolve (e.g. ["validateToken", "UserService"]).',
          },
        },
        required: ['symbols'],
      },
    },
    {
      name: 'sigmap_notify_file_created',
      description:
        'Call after writing or changing a file so its signatures are indexed live for this ' +
        'session (new symbols become resolvable by search_signatures / get_callee_signatures).',
      inputSchema: {
        type: 'object',
        properties: {
          path: { type: 'string', description: 'File path relative to the project root.' },
          content: { type: 'string', description: 'Optional file content; read from disk if omitted.' },
        },
        required: ['path'],
      },
    },
    {
      name: 'sigmap_notify_symbol_added',
      description:
        'Fast path: register one new symbol signature in the live index without re-reading the file.',
      inputSchema: {
        type: 'object',
        properties: {
          signature: { type: 'string', description: 'The signature line (e.g. "function check(key)").' },
          file: { type: 'string', description: 'File path the symbol belongs to (relative to root).' },
          line: { type: 'number', description: 'Optional 1-based line number.' },
        },
        required: ['signature', 'file'],
      },
    },
    {
      name: 'sigmap_notify_file_deleted',
      description:
        'Tell SigMap a file was deleted so its symbols leave the live index.',
      inputSchema: {
        type: 'object',
        properties: {
          path: { type: 'string', description: 'Deleted file path relative to the project root.' },
        },
        required: ['path'],
      },
    },
    {
      name: 'get_diff_context',
      description:
        'For every changed file (working tree, staged, or vs a base ref): its current signatures ' +
        'plus blast radius — importers, affected tests/routes — with a risk label. One call for ' +
        'a code review or a safe edit. Lists changed files shell-free.',
      inputSchema: {
        type: 'object',
        properties: {
          base: {
            type: 'string',
            description: 'Optional git ref to diff against (e.g. "main"): files changed between it and the WORKING TREE, committed and uncommitted alike. Omit for working-tree changes vs HEAD.',
          },
          staged: {
            type: 'boolean',
            description: 'When true (and no base), report only staged changes (`git diff --cached`).',
          },
          depth: {
            type: 'number',
            description: 'Blast-radius BFS depth limit (default: 2). Use 0 for unlimited.',
          },
        },
        required: [],
      },
    },
    {
      name: 'get_architecture_overview',
      description:
        'One-call map of the codebase: module breakdown (files/tokens), the most depended-on ' +
        'hub files, dependency-cycle count and route totals. Extends get_map; use it to orient ' +
        'before read_context / query_context.',
      inputSchema: {
        type: 'object',
        properties: {},
        required: [],
      },
    },
    {
      name: 'verify_suggestion',
      description:
        'Ground an AI code suggestion before writing it: check a snippet or answer against the ' +
        'repository AND the libraries actually installed in node_modules. Flags fake file paths, ' +
        'unresolvable imports, backticked calls in neither the repo nor the installed libraries, and ' +
        'non-existent npm scripts. Does not check member calls, calls in raw code, or whether a ' +
        'library API exists, and reports what it checked and what it did not. Deterministic, offline, no LLM.',
      inputSchema: {
        type: 'object',
        properties: {
          code: {
            type: 'string',
            description: 'The suggested code snippet or answer text to verify.',
          },
        },
        required: ['code'],
      },
    },
    {
      name: 'squeeze_output',
      description:
        'Compress noisy output (stack trace, CI/build log, JSON payload) before it enters context: ' +
        'keeps error frames, failing steps and JSON shape, strips the noise, adds the top frame\'s ' +
        'signature. Returns the squeezed text plus reduction stats; unchanged when nothing is ' +
        'squeezable. Deterministic, offline.',
      inputSchema: {
        type: 'object',
        properties: {
          content: {
            type: 'string',
            description: 'The raw output to compress.',
          },
        },
        required: ['content'],
      },
    },
    {
      name: 'get_budget',
      description:
        'Session spend ledger: estimated tokens SigMap has emitted this session (chars/4, local ' +
        'gain log — NOT the whole chat), optional budget remaining, and context freshness. ' +
        'Check mid-session and degrade gracefully near budget (terse encoding, squeeze, summarize).',
      inputSchema: {
        type: 'object',
        properties: {
          session: {
            type: 'string',
            description: 'Session key to report on (default: SIGMAP_SESSION env or the UTC day bucket).',
          },
          budgetTokens: {
            type: 'number',
            description: 'Budget override in estimated tokens (default: config sessionBudgetTokens).',
          },
        },
        required: [],
      },
    },
    {
      name: 'query_knowledge_map',
      description:
        'Query the typed knowledge map: nodes (file, symbol, library@version, route, env-var, ' +
        'migration, script) and edges (imports, calls, defines, tests, uses-lib, exposes-route, ' +
        'reads-env). { library } = upgrade impact (lib → importing files → callers → covering ' +
        'tests); { file } = a file\'s typed neighbors; { env } = files reading an environment ' +
        'variable. Deterministic, cached in .context, local-only.',
      inputSchema: {
        type: 'object',
        properties: {
          library: { type: 'string', description: 'Declared dependency name for the upgrade-impact walk' },
          file: { type: 'string', description: 'Repo-relative file path for a typed-neighbors view' },
          env: { type: 'string', description: 'Environment variable name — which files read it, and whether a committed .env example declares it' },
        },
      },
    },
  ];

  /**
   * The capture tool (#951, SI-2b). Deliberately NOT in TOOLS: it is advertised
   * only when `session.mcpCapture` is on, so a project that does not capture
   * sessions pays none of its definition tokens (#878) and the 22-tool surface
   * every client sees by default does not move.
   */
  const LOG_SESSION_USAGE = {
    name: 'log_session_usage',
    description:
      "Record this session's own token usage in SigMap's session store, labelled " +
      'agent-reported (SigMap cannot verify it). Call at the end of a task with the ' +
      'running session totals; a later call for the same session replaces the earlier ' +
      'one. Omit usage when unknown: it is recorded as unavailable, never as zero.',
    inputSchema: {
      type: 'object',
      properties: {
        id: { type: 'string', description: 'Session id. Omit to use one id for this MCP connection.' },
        model: { type: 'string', description: 'Model name as the host reports it.' },
        usage: {
          type: 'object',
          description: 'Billed tokens so far, per request category.',
          properties: {
            in: { type: 'number' },
            out: { type: 'number' },
            cacheRead: { type: 'number', description: 'Omit if the host does not report it.' },
            cacheWrite: { type: 'number', description: 'Omit if the host does not report it.' },
          },
          required: ['in', 'out'],
        },
      },
      required: [],
    },
  };

  module.exports = { TOOLS, LOG_SESSION_USAGE };
  
};

// ── ./src/nudge ──
__factories["./src/nudge"] = function(module, exports) {
  
  /**
   * Star nudge + run counter (v7.0.0).
   *
   * Records run counts in `.context/usage.json` and shows a one-time GitHub-star
   * message after the tool has been genuinely useful (≥10 runs, ≥8 successes).
   * The file lives in the project, so "once" means once per PROJECT, not per
   * machine — even under concurrent runs (an `wx` lock file makes the show
   * race-safe). Written by every generate, `ask` and `squeeze` run. Counts and
   * dates only; `--track`, `--no-track` and SIGMAP_NO_TRACK govern the two run
   * logs (`usage.ndjson`, `gain.ndjson`), not this counter (documented in
   * docs-vp/guide/config.md).
   */

  const fs = require('fs');
  const path = require('path');

  const RUN_THRESHOLD = 10;
  const SUCCESS_THRESHOLD = 8;

  function usagePath(cwd) { return path.join(cwd, '.context', 'usage.json'); }

  function defaultUsage() {
    return {
      totalRuns: 0, successfulRuns: 0, squeezeOffered: 0, squeezeAccepted: 0,
      starNudgeShown: false, firstRunDate: null, lastRunDate: null,
    };
  }

  function readUsage(cwd) {
    try { return { ...defaultUsage(), ...JSON.parse(fs.readFileSync(usagePath(cwd), 'utf8')) }; }
    catch (_) { return defaultUsage(); }
  }

  function writeUsageAtomic(cwd, usage) {
    const p = usagePath(cwd);
    fs.mkdirSync(path.dirname(p), { recursive: true });
    const tmp = `${p}.${process.pid}.tmp`;
    fs.writeFileSync(tmp, JSON.stringify(usage, null, 2));
    fs.renameSync(tmp, p); // atomic on POSIX
  }

  const STAR_MESSAGE = [
    '─────────────────────────────────────────────────────────',
    '  SigMap has helped you 10 times now.',
    '',
    "  If it's been useful, a GitHub star takes 5 seconds and",
    '  helps other developers find it:',
    '  → github.com/manojmallick/sigmap',
    '',
    "  (Won't ask again. Press Enter to continue.)",
    '─────────────────────────────────────────────────────────',
  ].join('\n');

  function showStarNudge(write) {
    (write || ((s) => process.stderr.write(s)))('\n' + STAR_MESSAGE + '\n');
  }

  /**
   * Record one run and, when the thresholds are first met, show the star nudge.
   * @param {string} cwd
   * @param {boolean} runSuccess
   * @param {object} [opts]
   * @param {boolean} [opts.silent]   record only — never print
   * @param {function} [opts.write]   sink for the message (default stderr)
   * @param {string} [opts.today]     override date (testing)
   * @param {object} [opts.bump]      counter deltas to merge (e.g. { squeezeAccepted: 1 })
   * @returns {{ usage, nudged }}
   */
  function checkStarNudge(cwd, runSuccess, opts = {}) {
    const usage = readUsage(cwd);
    usage.totalRuns += 1;
    if (runSuccess) usage.successfulRuns += 1;
    if (opts.bump) for (const k of Object.keys(opts.bump)) usage[k] = (usage[k] || 0) + opts.bump[k];

    const today = opts.today || new Date().toISOString().slice(0, 10);
    if (!usage.firstRunDate) usage.firstRunDate = today;
    usage.lastRunDate = today;

    let nudged = false;
    if (!usage.starNudgeShown && usage.totalRuns >= RUN_THRESHOLD && usage.successfulRuns >= SUCCESS_THRESHOLD) {
      // Race-safe single-show: only the process that creates the lock prints.
      let won = false;
      try { fs.closeSync(fs.openSync(usagePath(cwd) + '.nudge.lock', 'wx')); won = true; }
      catch (_) { won = false; }
      if (won && !opts.silent) showStarNudge(opts.write);
      nudged = won;
      usage.starNudgeShown = true;
    }

    writeUsageAtomic(cwd, usage);
    return { usage, nudged };
  }

  module.exports = { checkStarNudge, readUsage, usagePath, showStarNudge, RUN_THRESHOLD, SUCCESS_THRESHOLD };
  
};

// ── ./src/plan/planner ──
__factories["./src/plan/planner"] = function(module, exports) {
  
  const fs = require('fs');
  const { buildFromCwd } = __require('./src/graph/builder');
  const { getImpact } = __require('./src/graph/impact');
  const { buildSigIndex, rank, detectIntent, _queryWants } = __require('./src/retrieval/ranker');
  const { tokenize: queryTokens } = __require('./src/retrieval/tokenizer');
  const { tokenize: stemTokens } = __require('./src/retrieval/bm25');
  const { buildTestCoverageIndex } = __require('./src/analysis/test-coverage');
  const { isTestFile, isMockFile, isCiFile, isDocsFile, isGeneratedFile, isGeneratedDir } = __require('./src/util/file-class');

  // "Likely to change" is the ranker's `high` confidence band only — a normalised
  // score above 0.66 of the corpus range (see rank()). The list used to be the
  // `medium` band (0.33–0.66), which by construction left out the files the task
  // names and let in anything scoring a third of the top match (#774).
  const CHANGE_CONFIDENCE = 'high';
  const MAX_ENTRIES = 5;
  const MAX_REASON_TERMS = 3;

  module.exports = { createPlan, isChangeCandidate, matchReason, CHANGE_CONFIDENCE };

  /**
   * Whether a ranked file can be something the task changes. Tests, fixtures, CI
   * and docs rank on shared vocabulary, so they stay off the list unless the task
   * asks for them — the same condition the ranker's own penalties use.
   */
  function isChangeCandidate(file, wants) {
    if (isTestFile(file) || isMockFile(file)) return !!(wants && wants.tests);
    if (isCiFile(file)) return !!(wants && wants.ci);
    if (isDocsFile(file)) return !!(wants && wants.docs);
    return !(isGeneratedFile(file) || isGeneratedDir(file));
  }

  /**
   * Why a file is on the list, in the task's own words: which of them its path
   * and its signatures carry. A bare score cannot be discounted — "pattern" in a
   * path and "pattern" in an unrelated helper score alike — so each entry says
   * what matched and where.
   */
  function matchReason(goal, file, sigs) {
    const inPath = new Set(stemTokens(file));
    const inSigs = new Set(stemTokens((sigs || []).join('\n')));
    const parts = [];
    const seen = new Set();
    for (const word of String(goal).split(/[^A-Za-z0-9_]+/).filter(Boolean)) {
      const key = word.toLowerCase();
      if (seen.has(key)) continue;
      seen.add(key);
      const stems = stemTokens(word);
      const path = stems.some((t) => inPath.has(t));
      const sig = stems.some((t) => inSigs.has(t));
      if (!path && !sig) continue;
      parts.push(`"${key}" in ${path && sig ? 'path and signatures' : path ? 'path' : 'signatures'}`);
      if (parts.length === MAX_REASON_TERMS) break;
    }
    return parts.length ? parts.join('; ') : 'no task word in its path or signatures';
  }

  function createPlan(goal, cwd, config = {}) {
    // Step 1: Detect intent and rank files for the goal
    const intent = detectIntent(goal);
    const sigIndex = buildSigIndex(cwd);
    if (sigIndex.size === 0) {
      return { error: 'no context found' };
    }

    // The same words `ask` ranks with: a plan that could not find what `ask` finds would contradict it.
    const bodyWords = __require('./src/retrieval/body-words').forRepo(cwd, sigIndex, config);
    const ranked = rank(goal, sigIndex, { topK: 15, cwd, bodyWords });

    // Step 2: what to read, and what the task is likely to edit. Both come from
    // the high-confidence band; the change list keeps only implementation files
    // and carries, per entry, its score relative to the top match and its reason.
    const highConf = ranked.filter(r => r.confidence === 'high').slice(0, MAX_ENTRIES);
    const wants = _queryWants(queryTokens(goal));
    const topScore = ranked.length ? ranked[0].score : 0;
    const change = ranked
      .filter(r => r.confidence === CHANGE_CONFIDENCE && isChangeCandidate(r.file, wants))
      .slice(0, MAX_ENTRIES)
      .map(r => ({
        file: r.file,
        score: topScore > 0 ? Math.round((r.score / topScore) * 100) / 100 : 0,
        reason: matchReason(goal, r.file, r.sigs),
      }));

    // Step 3: Impact radius — union the reverse-dependency blast radius of EVERY
    // high-confidence file (not just the top one), bounded to 3 hops. Note the
    // dependency graph resolves relative imports only, so this is a *lower bound*
    // on real coupling (aliased/bare/dynamic imports are invisible). Previously
    // this passed `{ maxDepth: 3 }`, which getImpact ignores — it reads `depth`,
    // so the traversal silently ran unbounded (depth 0). Fixed to `depth: 3`.
    let impact = null;
    if (highConf.length > 0) {
      try {
        const graph = buildFromCwd(cwd);
        // getImpact already returns repo-relative, original-case paths (it renders
        // lowercased graph keys through the graph's realPaths map). Only the
        // separator needs normalising so dedup against the entry set matches.
        const clean = (f) => String(f).replace(/\\/g, '/');
        const entrySet = new Set(highConf.map(r => r.file));
        const direct = new Set();
        const transitive = new Set();
        // Entry files the import graph cannot read: their empty blast radius is
        // "not tracked", not "nothing depends on it" (#979).
        const untracked = [];
        for (const r of highConf) {
          const imp = getImpact(r.file, graph, { depth: 3, cwd });
          for (const f of (imp.direct || [])) direct.add(clean(f));
          for (const f of (imp.transitive || [])) transitive.add(clean(f));
          if (imp.graph) untracked.push({ file: r.file, language: imp.language });
        }
        // The files we plan to change are not their own blast radius; and a file
        // reached directly from one entry outranks a transitive reach from another.
        for (const e of entrySet) { direct.delete(e); transitive.delete(e); }
        for (const f of direct) transitive.delete(f);
        impact = { direct: [...direct], transitive: [...transitive] };
        // Added only when it applies, so a plan over readable languages is unchanged.
        if (untracked.length) impact.untracked = untracked;
      } catch (_) {
        // Graph build failed, continue without impact
      }
    }

    // Step 4: which of the files to inspect a test exercises, and which tests.
    // One index shared with `--analyze` (#862); it names the test files, which
    // the function-name token index used here before could not.
    const relatedTests = {};
    try {
      const coverage = buildTestCoverageIndex(cwd, { files: [...sigIndex.keys()], exclude: config.exclude });
      for (const r of highConf) {
        const tests = coverage.testsFor(r.file);
        if (tests.length) relatedTests[r.file] = tests;
      }
    } catch (_) {
      // Coverage index failed, continue without test info
    }
    const coveredFiles = Object.keys(relatedTests);

    return {
      goal,
      intent,
      inspectFirst: highConf.map(r => r.file),
      likelyToChange: change.map(c => c.file),
      // Same order as `likelyToChange`: { file, score, reason } per entry.
      likelyToChangeEvidence: change,
      impactRadius: impact,
      coveredFiles,
      // Covered source file → the test files that name or load it.
      relatedTests,
      // `testsAffected` retained for backward compatibility; it is the set of
      // covered source files. The test files themselves are in `relatedTests`.
      testsAffected: coveredFiles,
    };
  }
  
};

// ── ./src/plan/verify-plan ──
__factories["./src/plan/verify-plan"] = function(module, exports) {
  
  /**
   * verify-plan (IMPL.md §6.1 — Gap 2, step 2 of the `create` pipeline).
   *
   * Checks a plan (markdown) against the LIVE index before execution: do the
   * referenced files and symbols exist, is the blast radius acceptable, is the
   * scope in bounds? Catches Cause 1+2 at plan time — cheaper than after the
   * code is written. Reuses the verify primitives + the impact graph.
   * Zero-dependency, bundle-safe.
   *
   * A plan has two kinds of name in it, and checking them the same way makes the
   * creation path unreachable (#666): a plan that *introduces* `formatDate` fails
   * stage 2 for naming a symbol that, by construction, does not exist yet. So a
   * `Creates:` section (or `--creates`) marks introductions, which are verified in
   * REVERSE — they must NOT exist — and excluded from the reference checks. With
   * neither present, nothing changes: every name is a reference, as before.
   */

  const fs = require('fs');
  const path = require('path');
  const { extractFilePaths, extractSymbols } = __require('./src/verify/parsers');
  const { buildSymbolSet } = __require('./src/verify/hallucination-guard');
  const { confirmSymbols } = __require('./src/verify/source-confirm');
  const { closestMatch } = __require('./src/verify/closest-match');
  const { analyzeImpact } = __require('./src/graph/impact');

  const DEFAULT_BLAST_THRESHOLD = 20; // transitive+direct dependents → "high blast radius"
  const DEFAULT_SCOPE_THRESHOLD = 10; // distinct referenced files → "broad scope"

  /**
   * Heading/label that opens an introductions block, e.g. `## Creates`,
   * `**Creates:**`, `Creates:` — the plan format documented in cli.md.
   */
  const CREATES_RE = /^\s*(#{1,6}\s+)?\*{0,2}creates(?:\s+new)?\*{0,2}\s*(:)?\*{0,2}\s*(.*)$/i;
  /** Any other heading/label line closes the block. */
  const SECTION_END_RE = /^\s*(?:#{1,6}\s|(?:\*\*)?[A-Za-z][\w \t-]{0,40}(?:\*\*)?\s*:\s*$)/;

  /** Resolve a referenced path against cwd (handles a leading "./"). */
  function _fileExists(cwd, ref) {
    const clean = ref.replace(/^\.\//, '');
    for (const c of [path.resolve(cwd, clean), path.resolve(cwd, ref)]) {
      try { if (fs.existsSync(c)) return true; } catch (_) {}
    }
    return false;
  }

  /** Strip markdown list bullets, backticks, call parens and trailing prose. */
  function _cleanEntry(raw) {
    let s = String(raw || '').trim();
    s = s.replace(/^[-*+]\s+/, '').replace(/^\d+[.)]\s+/, '');
    const ticked = s.match(/`([^`]+)`/);
    if (ticked) s = ticked[1];
    s = s.split(/\s+[—–-]\s+/)[0];           // "foo() — does a thing"
    s = s.trim().replace(/\s*\([^)]*\)\s*$/, '').replace(/[,;.]+$/, '');
    return s.trim();
  }

  /**
   * Names a plan declares it will introduce.
   *
   * Reads a `Creates:` section — an inline list on the label line, the indented /
   * bulleted lines under it, or both — and stops at the next heading or label.
   * @param {string} text the plan as markdown
   * @returns {{ name: string, line: number }[]} deduped, first-seen line kept
   */
  function extractIntroductions(text) {
    const lines = String(text || '').split('\n');
    const seen = new Map();
    const add = (raw, line) => {
      const name = _cleanEntry(raw);
      if (!name || /\s/.test(name) || !/[A-Za-z0-9]/.test(name)) return;  // prose, not a name
      if (!seen.has(name)) seen.set(name, line);
    };

    for (let i = 0; i < lines.length; i++) {
      const m = CREATES_RE.exec(lines[i]);
      if (!m || (!m[1] && !m[2])) continue;   // a label or heading, never prose
      for (const part of String(m[3] || '').split(',')) add(part, i + 1);
      for (let j = i + 1; j < lines.length; j++) {
        const line = lines[j];
        if (line.trim() === '') continue;
        if (SECTION_END_RE.test(line) && !/^[\s]*[-*+]/.test(line)) { i = j - 1; break; }
        if (!/^\s*(?:[-*+]|\d+[.)])\s+/.test(line) && !/^\s{2,}\S/.test(line)) { i = j - 1; break; }
        for (const part of line.split(',')) add(part, j + 1);
        i = j;
      }
    }
    return [...seen.entries()].map(([name, line]) => ({ name, line }));
  }

  /** True when an introduction names a file rather than a symbol. */
  function _isPathLike(name) {
    return name.includes('/') || /\.[A-Za-z][A-Za-z0-9]*$/.test(name);
  }

  /**
   * Verify a plan against the live index.
   * @param {string} planText the plan as markdown
   * @param {string} cwd repo root
   * @param {object} [opts]
   * @param {number} [opts.blastThreshold=20]
   * @param {number} [opts.scopeThreshold=10]
   * @param {string[]} [opts.creates] names the plan introduces, in addition to
   *   any `Creates:` section — files (by path) or symbols (bare names)
   * @param {(ref:string)=>boolean} [opts.fileExists] override for testing
   * @param {(names: string[]) => { has: (name: string) => boolean }} [opts.confirmSymbols]
   *   override the source confirmation of a referenced symbol the index lacks (#914)
   * @returns {{ issues: object[], blast: object[], scope: object, introduces: object[], summary: object }}
   */
  function verifyPlan(planText, cwd, opts = {}) {
    const blastThreshold = opts.blastThreshold != null ? opts.blastThreshold : DEFAULT_BLAST_THRESHOLD;
    const scopeThreshold = opts.scopeThreshold != null ? opts.scopeThreshold : DEFAULT_SCOPE_THRESHOLD;
    const fileExists = opts.fileExists || ((ref) => _fileExists(cwd, ref));

    const text = String(planText || '');
    const filesRef = extractFilePaths(text);   // [{ path, line }]
    const symbolsRef = extractSymbols(text);   // [{ name, line }]
    const { set: symbolSet, symbolCandidates, fileKeys } = buildSymbolSet(cwd);

    // Introductions: the `Creates:` section plus any `--creates` names. Both are
    // explicit author intent, so they are merged into one list.
    const intro = new Map();
    for (const { name, line } of extractIntroductions(text)) intro.set(name, line);
    for (const raw of (opts.creates || [])) {
      const name = _cleanEntry(raw);
      if (name && !intro.has(name)) intro.set(name, null);
    }
    const introFiles = new Set();
    const introSymbols = new Set();
    for (const name of intro.keys()) (_isPathLike(name) ? introFiles : introSymbols).add(name);

    const issues = [];

    // 0. Introductions must NOT exist yet — the redefinition guard. Verified from
    // the declaration itself, so an introduction the plan never mentions again is
    // still checked.
    const introduces = [];
    for (const [name, line] of intro) {
      const kind = introFiles.has(name) ? 'file' : 'symbol';
      const exists = kind === 'file' ? fileExists(name) : symbolSet.has(name);
      introduces.push({ name, kind, line, exists });
      if (exists) {
        issues.push({ type: 'redefines-existing', ref: name, kind, line, severity: 'error' });
      }
    }

    // 1. Referenced files must exist — unless the plan says it creates them.
    const existingFiles = [];
    for (const f of filesRef) {
      if (introFiles.has(f.path)) continue;
      if (fileExists(f.path)) existingFiles.push(f.path);
      else issues.push({ type: 'missing-file', ref: f.path, line: f.line, severity: 'error' });
    }

    // 2. Referenced symbols must exist in the live index (suggest a near match) —
    // or in the source: the index keeps `maxIndexSigsPerFile` signatures a file and only
    // the files under the detected roots, and an `error` here blocks the plan on a
    // symbol that is real (#914). Only the references the index lacks are looked up.
    const missing = symbolsRef.filter((s) => !introSymbols.has(s.name) && !symbolSet.has(s.name));
    const confirmSource = opts.confirmSymbols
      || ((names) => confirmSymbols(cwd, names, { priority: fileKeys }).confirmed);
    const confirmed = missing.length ? confirmSource([...new Set(missing.map((s) => s.name))]) : null;
    for (const s of missing) {
      if (confirmed && confirmed.has(s.name)) continue;
      const match = closestMatch(s.name, symbolCandidates);
      issues.push({
        type: 'unknown-symbol', ref: s.name, line: s.line, severity: 'error',
        suggestion: match ? match.name : null,
      });
    }

    // 3. Blast radius for each existing referenced file (one graph build).
    const blast = [];
    if (existingFiles.length) {
      let impacts = [];
      try { impacts = analyzeImpact(existingFiles, cwd, {}); } catch (_) { impacts = []; }
      for (const { file, impact } of impacts) {
        const entry = { file, totalImpact: impact.totalImpact, tests: impact.tests.length };
        // Present only when the import graph cannot read the file: a 0 here is "not tracked" (#979).
        if (impact.graph) { entry.graph = impact.graph; entry.language = impact.language; }
        blast.push(entry);
        if (impact.totalImpact > blastThreshold) {
          issues.push({ type: 'high-blast-radius', ref: file, count: impact.totalImpact, severity: 'warn' });
        }
      }
      blast.sort((a, b) => b.totalImpact - a.totalImpact);
    }

    // 4. Scope — counted over files the plan touches, introduced or referenced.
    const scopeFiles = new Set([...filesRef.map((f) => f.path), ...introFiles]);
    const scope = { files: scopeFiles.size, symbols: symbolsRef.length, threshold: scopeThreshold };
    if (scopeFiles.size > scopeThreshold) {
      issues.push({ type: 'broad-scope', count: scopeFiles.size, threshold: scopeThreshold, severity: 'warn' });
    }

    const errors = issues.filter((i) => i.severity === 'error').length;
    const warnings = issues.filter((i) => i.severity === 'warn').length;
    return {
      issues,
      blast,
      scope,
      introduces,
      summary: {
        filesReferenced: filesRef.length,
        symbolsReferenced: symbolsRef.length,
        filesIntroduced: introFiles.size,
        symbolsIntroduced: introSymbols.size,
        errors,
        warnings,
        ok: errors === 0,
      },
    };
  }

  module.exports = { verifyPlan, extractIntroductions, DEFAULT_BLAST_THRESHOLD, DEFAULT_SCOPE_THRESHOLD };
  
};

// ── ./src/retrieval/bm25 ──
__factories["./src/retrieval/bm25"] = function(module, exports) {
  
  /**
   * SigMap identifier-aware BM25 re-ranker (zero dependencies, deterministic).
   *
   * Plain exact-token TF-IDF misses queries whose terms live *inside* code
   * identifiers — e.g. `component emit` never surfaces `componentEmits.ts`,
   * because "componentEmits" is one token that shares no exact term with the
   * query. This module fixes that with four small additions:
   *
   *   1. Identifier-aware tokenization — split camelCase and snake_case.
   *   2. Light stemming — plurals / inflections (`emits` → `emit`, `classified` → `classify`).
   *   3. Path-token boost — file path / basename tokens weigh PATH_BOOST× more.
   *   4. BM25 scoring instead of raw TF-IDF (length-normalized).
   *
   * On 85 curated tasks across 17 repos this lifted hit@5 from 75.3% → 82.4%
   * (MRR +16% relative). See issue #395.
   */

  // Stop words: common English + low-signal code verbs/nouns that appear in
  // nearly every signature and so carry little retrieval signal.
  const STOP = new Set(
    ('a an the of to in on for and or is are be by with as at from that this it its ' +
     'into get set add new return value test')
      .split(' ')
  );

  const SUFFIX = /(ing|edly|ed|er|ers|ation|ations|ment|ness|ity|ive|able|ible|ize|ise|al)$/;
  // Suffixes that inflect a word. They are the only ones that can take a final
  // `e` with them (`parse` -> `parsing`), so they are the only ones that put it back.
  const INFLECTION = new Set(['ing', 'edly', 'ed', 'er', 'ers']);
  // -ing/-ed may leave a short root (`mapping` -> `map`). Everything else needs a real
  // one: `order` is not `ord` + `er`, and `normal` is not `norm` + `al`.
  const MIN_ROOT = 5;
  // `classify`, `classifier`, `classification` -> `class`, so they meet a `file-class` path.
  // A root under 4 chars is left alone: `verify` is not `ver` + `ify`.
  const dropIfy = (s) => s.replace(/(ification|ifier|ify)$/, (m, _, at) => (at >= 4 ? '' : m));

  /**
   * Suffix stemmer, tuned for code identifiers rather than prose. Base and inflected
   * forms of a word reach the same stem — `classify`/`classified`, `parse`/`parsing`,
   * `order`/`ordering`, `register`/`registered` (#875) — and `classify` reaches
   * `class`, so `classified` meets a `file-class` path. Words of 3 chars or fewer pass
   * through unchanged; a result shorter than 3 chars reverts to the plural-folded token.
   *
   * Not idempotent for every word: a stem that still ends in a removable suffix
   * (`implemented` -> `implement`, which stems on to `impl`) is left as it is, because
   * merging those chains makes a verb like `implement` match every file that says
   * "implementation" and costs ranking precision (measured; see the #875 tests).
   *
   * @param {string} w
   * @returns {string}
   */
  function stem(w) {
    let s = STEMS.get(w);
    if (s === undefined) {
      s = stemWord(w);
      if (STEMS.size >= STEM_CACHE_MAX) STEMS.clear();
      STEMS.set(w, s);
    }
    return s;
  }

  // Pure, and a corpus repeats a small vocabulary across every query, so memoise.
  const STEMS = new Map();
  const STEM_CACHE_MAX = 50000;

  function stemWord(w) {
    if (w.length <= 3) return w;
    let s = w;
    s = s.replace(/ies$/, 'y');
    s = s.replace(/(sses|shes|ches|xes|zes)$/, (m) => m.slice(0, -2));
    s = s.replace(/([^s])s$/, '$1');
    // Plural folding is the one reduction that must survive an over-strip. The
    // derivational pass below is aggressive, and when it leaves a stub the guard
    // used to revert to the RAW input — so `users` went user -> us -> back to
    // `users`, while `user` went user -> us -> back to `user`, and the two never
    // unified. A query for "users" therefore scored 0 against `loginUser`, and
    // `ask "where do users log in"` matched nothing at all.
    const folded = s;
    s = s.replace(/([^aeiou])ied$/, '$1y');                                       // classified -> classify
    s = s.replace(/(ization|izations)$/, 'ize');
    s = dropIfy(s);
    let suffix = null;
    const m = SUFFIX.exec(s);
    if (m) {
      const root = s.slice(0, -m[1].length);
      if (/^(ing|edly|ed)$/.test(m[1]) || root.length >= MIN_ROOT) { s = root; suffix = m[1]; }
    }
    // `registered` is `register` + ed, and `register` is `regist` + er: peel the -er too.
    if (suffix && /^(ing|edly|ed)$/.test(suffix) && s.length - 2 >= MIN_ROOT && s.endsWith('er')) s = s.slice(0, -2);
    if (suffix) s = dropIfy(s);                                                   // classifying -> classify -> class
    if (suffix && s.length > 3 && /([bcdfghjkmnpqrtvwx])\1$/.test(s)) s = s.slice(0, -1);   // mapping -> map
    // Base and inflected forms meet with the `e` off (`parse`/`parsing` -> `pars`) — except
    // that a stem ending in a lone `s` is eaten by the plural rule when it is stemmed again
    // (`pars` -> `par`). Those keep the `e` (`parse`), and the inflected form gets it back.
    if (s.length > 3 && /[^aeiou]e$/.test(s) && !/[^s]se$/.test(s)) s = s.slice(0, -1);
    if (suffix && INFLECTION.has(suffix) && /[^s]s$/.test(s) && !/[^aeiou]us$/.test(s)) s += 'e';
    if (s.length >= 3) return s;
    return folded.length >= 3 ? folded : w;
  }

  /**
   * Split on non-alphanumeric characters AND camelCase / snake_case boundaries,
   * lowercase, drop stop words and single characters, then stem.
   *
   * @param {string} text
   * @returns {string[]}
   */
  function tokenize(text) {
    if (!text || typeof text !== 'string') return [];
    return text
      .replace(/[^A-Za-z0-9]+/g, ' ')
      .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
      .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
      .toLowerCase()
      .split(/\s+/)
      .filter((t) => t.length > 1 && !STOP.has(t))
      .map(stem)
      .filter(Boolean);
  }

  // The file path / basename is highly indicative of relevance, so its tokens
  // are counted PATH_BOOST times when building the document term-frequency map.
  const PATH_BOOST = 3;

  // Curated, high-precision code-domain synonym / abbreviation expansions. A query
  // for `authentication` should still surface a file whose signatures only say
  // `auth`. Kept deliberately tight — over-broad synonyms hurt precision. Groups
  // are expanded bidirectionally (every member maps to the others). Values are
  // tokenized+stemmed at load, so entries are written in natural form.
  const EXPANSION_GROUPS = [
    ['auth', 'authenticate', 'authentication', 'login', 'signin', 'credential'],
    ['authorize', 'authorization', 'permission', 'access'],
    ['config', 'configuration', 'settings', 'options'],
    ['db', 'database'],
    ['ctx', 'context'],
    ['req', 'request'],
    ['res', 'response'],
    ['err', 'error'],
    ['msg', 'message'],
    ['init', 'initialize', 'initialization', 'setup'],
    ['async', 'asynchronous'],
    ['sync', 'synchronize', 'synchronous'],
    ['repo', 'repository'],
    ['impl', 'implementation'],
    ['util', 'utility', 'helper'],
    ['param', 'parameter', 'argument'],
    ['fn', 'func', 'function'],
    ['btn', 'button'],
    ['calc', 'calculate', 'calculation'],
    ['gen', 'generate', 'generator'],
    ['val', 'validate', 'validation'],
    ['del', 'delete', 'remove'],
    ['dir', 'directory', 'folder'],
    ['env', 'environment'],
    ['doc', 'document', 'documentation'],
    ['id', 'identifier'],
    ['num', 'number'],
    ['str', 'string'],
  ];

  // The weight applied to an expanded (synonym) query term, so an exact match on
  // the literal query token always outranks a synonym-only match.
  const EXPANSION_WEIGHT = 0.15;

  // Module-doc prose is indexed as a `# module: ...` pseudo-signature (index-only,
  // see src/retrieval/module-doc.js). Per token it is a weaker relevance signal
  // than a real signature — descriptive rather than definitional — so it is scored
  // as its own BM25F field rather than pooled with the code terms.
  const MODULE_DOC_RE = /^#\s*(module|docs):/;

  // Line anchors are metadata, not content, and this ranker is documented as
  // anchor-invariant. The previous strip was end-anchored, so it only fired when
  // the anchor was the last thing on the line — but extractors append a doc hint
  // AFTER it ("... :27-59  # Compute a normalized centrality score"). 27% of
  // signatures therefore leaked their line numbers into the term space as tokens
  // like "27" and "59": 840 junk terms, inflating document length for exactly the
  // well-documented files, which BM25 then penalised via length normalisation.
  const ANCHOR_RE = /\s*:\d+(?:-\d+)?(?=\s|$)/g;

  function stripAnchor(line) {
    return String(line).replace(ANCHOR_RE, '');
  }
  // Tuned on the 30-task leak-free corpus. The 0.5-0.8 band is flat
  // (hit@5 63.3-66.7%, easy MRR steady at 0.825); adjacent values swing by up to
  // 6.7pp, which at 30 tasks is literally two tasks — noise, not signal. 0.6 is
  // chosen from the middle of that band rather than at its peak, because a
  // per-token weight below 1 is the principled position (prose is descriptive,
  // a signature is definitional) and picking the argmax of a 30-task sweep is
  // how you overfit a benchmark.
  const DOC_WEIGHT = 0.6;

  // Body words (retrieval.bodyWords, #905): the rare words of a file's source. Through v8.74 they
  // joined the prose field and carried its weight AND its length (`prose`). The sweep behind #943
  // (docs-vp/guide/retrieval-benchmark.md, "Weighting the body words") put them in a field of their
  // own: the weight stays prose's 0.6, and they add no length. Counting them lengthened exactly the
  // files with the most source to say, so every match on such a file scored less — and leaving them
  // out of the length was worth +2 or +3 on the third-party corpus at every weight tried.
  const BODY_FIELD = 'own';
  const BODY_WEIGHT = 0.6;
  const BODY_LENGTH = 'ignore';

  // Build a stemmed lookup: stem(member) → Set of the group's other stemmed members.
  const EXPANSIONS = (() => {
    const map = new Map();
    for (const group of EXPANSION_GROUPS) {
      const stemmed = [...new Set(group.map((w) => tokenize(w).join('')).filter(Boolean))];
      for (const s of stemmed) {
        if (!map.has(s)) map.set(s, new Set());
        for (const other of stemmed) if (other !== s) map.get(s).add(other);
      }
    }
    return map;
  })();

  /**
   * Expand stemmed query tokens with curated synonyms. Returns a Map of
   * token → weight (1 for the original query tokens, EXPANSION_WEIGHT for
   * synonyms). Original tokens always keep full weight even if also a synonym.
   *
   * With a repo-mined map (B2, #649 — `{ token: [[neighbor, w], …] }` from
   * mined-expansions.js), mined neighbors join at EXPANSION_WEIGHT × w. The
   * ordering invariant: original (1) > static (EXPANSION_WEIGHT) ≥ mined
   * (EXPANSION_WEIGHT × w, w ≤ 1), and an existing entry is never overridden.
   * Without the second argument, behavior is byte-identical to before.
   *
   * @param {string[]} qToks  stemmed, de-duplicated query tokens
   * @param {object} [mined]  mined expansions: token → [[neighbor, weight], …]
   * @returns {Map<string, number>}
   */
  function expandQuery(qToks, mined) {
    const weights = new Map();
    for (const t of qToks) weights.set(t, 1);
    for (const t of qToks) {
      const syns = EXPANSIONS.get(t);
      if (!syns) continue;
      for (const s of syns) if (!weights.has(s)) weights.set(s, EXPANSION_WEIGHT);
    }
    if (mined && typeof mined === 'object') {
      for (const t of qToks) {
        const neighbors = mined[t];
        if (!Array.isArray(neighbors)) continue;
        for (const pair of neighbors) {
          const s = pair && pair[0];
          const w = pair && pair[1];
          if (typeof s !== 'string' || typeof w !== 'number') continue;
          if (!weights.has(s)) weights.set(s, Math.min(EXPANSION_WEIGHT, EXPANSION_WEIGHT * w));
        }
      }
    }
    return weights;
  }

  /**
   * BM25 re-rank of candidates against a query. Each candidate is
   * `{ file, sigs }`; the returned objects preserve all original candidate
   * fields and add a numeric `score` (higher = more relevant), sorted best-first
   * with a deterministic path tie-break. A `score` of 0 means no query token
   * matched — callers typically drop those.
   *
   * @param {string} query
   * @param {{ file: string, sigs: string[] }[]} candidates
   * @param {object} [opts]
   * @param {Map<string,string>} [opts.bodyWords] file -> body words (retrieval.bodyWords, on by default)
   * @param {'prose'|'own'} [opts.bodyField] where body words go: `prose` joins the prose field,
   *        weight and length alike; `own` gives them a field of their own (default BODY_FIELD, #943)
   * @param {number} [opts.bodyWeight] with `own`: the field's weight (default BODY_WEIGHT)
   * @param {'count'|'ignore'} [opts.bodyLength] with `own`: whether body words lengthen the
   *        document for BM25's length normalisation (default BODY_LENGTH)
   * @returns {Array<object & { score: number }>}
   */
  function bm25rank(query, candidates, opts) {
    if (!Array.isArray(candidates) || candidates.length === 0) return [];

    const k1 = 1.5;
    const b = 0.75;

    const docWeight = (opts && typeof opts.docWeight === 'number') ? opts.docWeight : DOC_WEIGHT;
    // Body words (retrieval.bodyWords, on by default; src/retrieval/body-words.js): file -> the rare
    // words of its source that its signatures lack. Absent, nothing below changes.
    const bodyWords = (opts && opts.bodyWords instanceof Map) ? opts.bodyWords : null;
    // Where body words go (#943): into the prose field, weight and length alike, or into a
    // field of their own with a weight and a length treatment.
    const bodyOwn = ((opts && (opts.bodyField === 'own' || opts.bodyField === 'prose')) ? opts.bodyField : BODY_FIELD) === 'own';
    const bodyWeight = (opts && typeof opts.bodyWeight === 'number' && opts.bodyWeight >= 0) ? opts.bodyWeight : BODY_WEIGHT;
    const bodyInLength = ((opts && (opts.bodyLength === 'count' || opts.bodyLength === 'ignore')) ? opts.bodyLength : BODY_LENGTH) !== 'ignore';

    const docs = candidates.map((c) => {
      const pathToks = tokenize(c.file || '');
      // Ranking is anchor-invariant: `:start-end` line anchors are metadata,
      // not content — strip them before tokenizing so adding anchors to an
      // extractor never shifts BM25 length normalization or token counts.
      // BM25F-style fields. Module-doc prose and code signatures are different
      // kinds of evidence and must not share one term-frequency pool: prose is
      // ~30% of all indexed tokens, and a short file with a long header (few
      // signatures, lots of description) otherwise wins unrelated queries purely
      // through length normalisation.
      const docLines = [];
      const codeLines = [];
      for (const line of (c.sigs || [])) (MODULE_DOC_RE.test(line) ? docLines : codeLines).push(line);
      // TRIED AND REJECTED: splitting the declared symbol NAME into its own
      // weighted BM25F field, on the IR prior that a name is a "title" and params
      // are "body". Swept 1.0-4.0. hit@5 on the mined corpus rose 60.9% -> 65.2%,
      // which is a single task crossing the rank-5 line — over 113 combined tasks
      // hit@1 fell 52.2% -> 51.3%, hit@3 fell 66.4% -> 65.5%, hit@10 was identical
      // and MRR dropped. It moves correct answers DOWN and happens to nudge one
      // past a cutoff. A hit@5-only view would have shipped this.
      const codeToks = tokenize(codeLines.map((x) => stripAnchor(x)).join(' '));
      const docToks = tokenize(docLines.join(' '));
      // Body words are descriptive of the file, never definitional like a signature. They sit in
      // a field of their own at BODY_WEIGHT and add no length (`bodyField: 'prose'` is the
      // placement through v8.74: the prose field's weight and length) (#943).
      let bodyToks = null;
      if (bodyWords) {
        const extra = bodyWords.get(c.file);
        if (extra) {
          if (!bodyOwn) for (const t of tokenize(extra)) docToks.push(t);
          else bodyToks = tokenize(extra);
        }
      }
      const tf = new Map();
      const addField = (toks, weight) => { for (const t of toks) tf.set(t, (tf.get(t) || 0) + weight); };
      addField(codeToks, 1);
      addField(pathToks, PATH_BOOST);
      addField(docToks, docWeight);
      if (bodyToks) addField(bodyToks, bodyWeight);
      // Length accumulates with the SAME weights, or a field's influence leaks
      // back in through the normalisation term.
      const len = codeToks.length + (PATH_BOOST * pathToks.length) + (docWeight * docToks.length)
        + (bodyToks && bodyInLength ? bodyWeight * bodyToks.length : 0);
      return { cand: c, tf, len };
    });

    const N = docs.length || 1;
    const avgdl = docs.reduce((s, d) => s + d.len, 0) / N || 1;

    const df = new Map();
    for (const d of docs) {
      for (const t of d.tf.keys()) df.set(t, (df.get(t) || 0) + 1);
    }

    const qToks = [...new Set(tokenize(query))];
    // token → weight (1 exact, <1 synonym); opts.expansions carries the opt-in
    // repo-mined map (B2) from callers that enabled retrieval.minedExpansions.
    const qWeights = expandQuery(qToks, opts && opts.expansions);

    return docs
      .map((d) => {
        let score = 0;
        for (const [t, w] of qWeights) {
          const f = d.tf.get(t);
          if (!f) continue;
          const dfT = df.get(t);
          const idf = Math.log(1 + (N - dfT + 0.5) / (dfT + 0.5));
          score += w * ((idf * (f * (k1 + 1))) / (f + k1 * (1 - b + (b * d.len) / avgdl)));
        }
        return Object.assign({}, d.cand, { score });
      })
      .sort((a, c) => c.score - a.score || String(a.file).localeCompare(String(c.file)));
  }

  module.exports = { tokenize, stem, bm25rank, PATH_BOOST, STOP, expandQuery, EXPANSIONS, EXPANSION_WEIGHT, DOC_WEIGHT, BODY_FIELD, BODY_WEIGHT, BODY_LENGTH, MODULE_DOC_RE, stripAnchor };
  
};

// ── ./src/retrieval/body-words ──
__factories["./src/retrieval/body-words"] = function(module, exports) {
  
  /**
   * Body words (retrieval only, retrieval.bodyWords — on by default since v8.75.0): for each indexed file, the rare words of its source that its signature entry does not carry. Fed to BM25 in a field of their own (weight and length: BODY_WEIGHT and BODY_LENGTH in bm25.js) so a question in the words a file's body uses can reach a file whose signatures never say them. Zero-dependency, deterministic, bundle-safe.
   *
   * A signature map keeps a file's shape — names, parameters — and drops what the
   * body says. A person asking how something works describes it in the words the
   * code uses to do it (`revalidated`, `retrying`, `tls`), and those live in the
   * body, so the question and the right file share no token and the file scores
   * zero. On the labelled third-party corpus that was the largest single class of
   * miss, and nearly all of it held a rare word of the question in its source.
   *
   * Only RARE words are kept: a word held by most files (`import`, `value`) cannot
   * tell the answer apart and would only lengthen every document. Like the module
   * header prose this is added to the RANKING only — never to a generated context
   * file or to anything rendered into a prompt.
   */

  const fs = require('fs');
  const path = require('path');
  const { tokenize } = __require('./src/retrieval/tokenizer');
  const { PATTERNS } = __require('./src/security/patterns');

  // 3: the line filter below (2 was the scanner's patterns and a 20-character digit rule alone), so an older cache is rebuilt.
  const SCHEMA_VERSION = 3;
  const CACHE_FILE = 'body-words.json';

  // A word is rare when no more than this share of the indexed files hold it (and never
  // fewer than one file, so a word that appears in a single file always qualifies).
  const DISTINCTIVE_SHARE = 0.05;
  // The most words one file contributes. A sweep of this and the share above, measured on
  // every benchmark corpus, was flat from about 200 up; below 100 it began to lose gains.
  const PER_FILE = 200;
  const MIN_WORD_LENGTH = 3;
  // A word this long that holds a digit is a key, a hash or an identifier no question is written in
  // (an AWS access key id is 20 characters). `_isSecretLine` tests the raw tokens of a line before
  // tokenizing splits them; this is the same test on what is left.
  const OPAQUE_WORD_LENGTH = 20;
  // A line longer than this is a bundle, a data blob or a minified file: it carries no words a question
  // is asked in, and a pattern run over one long line is quadratic.
  const MAX_LINE_LENGTH = 2000;
  // A whole-file scan skips files over this size, as the grep baseline does.
  const MAX_SOURCE_BYTES = 1024 * 1024;

  // Words that frame a question rather than name its topic. A file holds some of them
  // whatever it is about, and in a small repository one file can hold one alone — which
  // would make `how` a rare word. They are never body words, and the benchmark
  // vocabulary evidence leaves them out of a question for the same reason.
  const FRAMING_WORDS = new Set((
    'how what when where which who whom whose why does did do can could would should will shall may might must whether '
    + 'there their them they these those then than such each other only same any all both some more most very also '
    + 'been being have has had was were are is be not but and for the you your its it our we can cannot'
  ).split(/\s+/));

  // Credential shapes the scanner's own patterns (src/security/patterns.js) do not name. They are kept
  // here, and not added there, because widening that list would change which SIGNATURES are redacted
  // and so the bytes of every generated context file; body words are free text and may be stricter.
  const EXTRA_SECRET_SHAPES = [
    // a credential-named key assigned anything, quoted or not, in JSON, YAML, .env, INI, Python or JS
    /\b(?:secret|password|passwd|passphrase|api[_-]?key|apikey|auth[_-]?token|access[_-]?token|secret[_-]?key|private[_-]?key|client[_-]?secret)\b["']?\s*[:=]\s*\S/i,
    /\bAuthorization\b["']?\s*[:=]\s*["']?(?:Bearer|Basic|Token)\s+\S/i,
    // a password in the userinfo of any URL (postgres://, mongodb+srv://, amqp://, https://user:pw@host)
    /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:[^\s/@]+@/i,
    // token families by prefix
    /\bgithub_pat_[A-Za-z0-9_]{20,}/,
    /\bnpm_[A-Za-z0-9]{20,}/,
    /\bya29\.[A-Za-z0-9_-]{10,}/,
    /\bSG\.[A-Za-z0-9_-]{16,}/,
  ];
  // A run of token characters this long that holds both a letter and a digit is a key, a hash or a
  // token — tested on the RAW line, because tokenize() would split `npm_aB3d…` at its underscores and
  // camelCase humps into pieces shorter than any length rule. `/` and `.` are not token characters,
  // so a path or a dotted name is not one run.
  const OPAQUE_RUN = /[A-Za-z0-9+_=-]{20,}/g;
  const PEM_BEGIN = /-----BEGIN [A-Z0-9 ]+-----/;
  const PEM_END = /-----END [A-Z0-9 ]+-----/;

  /** Whether one line of source may hold a credential. */
  function _isSecretLine(line) {
    for (const p of PATTERNS) if (p.regex.test(line)) return true; // textOnly included: body text is free text
    for (const re of EXTRA_SECRET_SHAPES) if (re.test(line)) return true;
    for (const m of line.matchAll(OPAQUE_RUN)) {
      if (/\d/.test(m[0]) && /[A-Za-z]/.test(m[0])) return true;
    }
    return false;
  }

  /**
   * The lines of a source with every line that may hold a credential blanked.
   *
   * Body words are the rare words of raw source, and a rare word is exactly what a credential is, so
   * unlike a signature they must be filtered: a cache that held `akiaiosfodnn7example` would carry the
   * key's id into a file that is not the source and is not redacted. This is a filter, not a guarantee —
   * a secret in a shape none of the rules names stays, and `.context/` is local.
   *
   * A PEM block is blanked from its BEGIN line to its END line, and so is any line over MAX_LINE_LENGTH.
   */
  function _safeLines(source) {
    const lines = source.split('\n');
    let inPem = false;
    for (let i = 0; i < lines.length; i++) {
      const line = lines[i];
      if (inPem) {
        if (PEM_END.test(line)) inPem = false;
        lines[i] = '';
      } else if (PEM_BEGIN.test(line)) {
        inPem = !PEM_END.test(line);
        lines[i] = '';
      } else if (line.length > MAX_LINE_LENGTH || _isSecretLine(line)) {
        lines[i] = '';
      }
    }
    return lines;
  }

  /** Words of one file's source, with the number of its lines that hold each. */
  function _lineFrequency(source) {
    const freq = new Map();
    for (const line of _safeLines(source)) {
      if (!line) continue;
      for (const w of tokenize(line)) {
        if (w.length >= OPAQUE_WORD_LENGTH && /\d/.test(w)) continue;
        freq.set(w, (freq.get(w) || 0) + 1);
      }
    }
    return freq;
  }

  /**
   * The body words of every file of an index.
   *
   * A word qualifies for a file when it is in the file's source, is not already in the
   * file's index entry (its path and signatures), is held by no more than `share` of the
   * files, is at least three characters, is not a number and is not a framing word. A
   * file keeps its `perFile` best, ordered by how many of its lines hold the word and
   * then alphabetically, so the result never depends on iteration order.
   *
   * @param {Map<string, string[]>} index file -> signature lines
   * @param {(file: string) => (string|null)} readSource a file's text, or null when it cannot be read
   * @param {{ share?: number, perFile?: number }} [opts]
   * @returns {Map<string, string>} file -> its words, space-separated; a file with none is absent
   */
  function buildBodyWords(index, readSource, opts) {
    const share = opts && typeof opts.share === 'number' ? opts.share : DISTINCTIVE_SHARE;
    const perFile = opts && Number.isInteger(opts.perFile) && opts.perFile > 0 ? opts.perFile : PER_FILE;
    const out = new Map();
    if (!(index instanceof Map) || index.size === 0) return out;

    // Pass 1: how many files hold each word.
    const df = new Map();
    let files = 0;
    const readable = [];
    for (const file of index.keys()) {
      let source = null;
      try { source = readSource(file); } catch (_) { source = null; }
      if (typeof source !== 'string') continue;
      files++;
      readable.push(file);
      for (const w of new Set(tokenize(source))) df.set(w, (df.get(w) || 0) + 1);
    }
    const cap = Math.max(1, Math.floor(share * files));

    // Pass 2: each file's qualifying words, best first.
    for (const file of readable) {
      let source = null;
      try { source = readSource(file); } catch (_) { source = null; }
      if (typeof source !== 'string') continue;
      const have = new Set(tokenize(`${file}\n${(index.get(file) || []).join('\n')}`));
      const picks = [];
      for (const [w, lines] of _lineFrequency(source)) {
        if (w.length < MIN_WORD_LENGTH || have.has(w) || FRAMING_WORDS.has(w) || /^\d+$/.test(w)) continue;
        if ((df.get(w) || 0) > cap) continue;
        picks.push([w, lines]);
      }
      if (picks.length === 0) continue;
      picks.sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1));
      out.set(file, picks.slice(0, perFile).map(([w]) => w).join(' '));
    }
    return out;
  }

  /**
   * A file's text under `root` (a real path), or null when it cannot be read, is too large for a
   * whole-file scan, is not a regular file, or lies outside `root`.
   *
   * Index keys are not trusted: a committed context file can name `../x`, an absolute path or a link
   * to anywhere, and a device such as /dev/zero reports size 0 and reads without end.
   */
  function _readUnder(root, file) {
    try {
      if (typeof file !== 'string' || file === '' || path.isAbsolute(file)) return null;
      const abs = path.resolve(root, file);
      const inside = (p) => p === root || p.startsWith(root + path.sep);
      if (!inside(abs)) return null;
      const real = fs.realpathSync(abs);
      if (!inside(real)) return null;
      const st = fs.statSync(real);
      if (!st.isFile() || st.size > MAX_SOURCE_BYTES) return null;
      return fs.readFileSync(real, 'utf8');
    } catch (_) {
      return null;
    }
  }

  /**
   * The body words of the files of `index`, read under `cwd`, with nothing written: for a benchmark
   * that scores a pinned checkout and must leave it untouched.
   *
   * @param {string} cwd
   * @param {Map<string, string[]>} index
   * @returns {Map<string, string>}
   */
  function buildFor(cwd, index) {
    let root = path.resolve(cwd);
    try { root = fs.realpathSync(root); } catch (_) { /* keep the resolved path */ }
    return buildBodyWords(index, (file) => _readUnder(root, file));
  }

  /**
   * The body words of a repository, from the cache in `.context/body-words.json` when it is
   * current, otherwise built from its index and written back. The cache is keyed by the mtime
   * of the complete index (`.context/sig-index.json`), which every `generate` rewrites, and by
   * the parameters it was built with. It is deliberately NOT keyed by the newest file in
   * `.context/`: `ask` rewrites `query-context.md` on every call, and rebuilding means reading
   * every source file. Without a complete index there is nothing to key by, so nothing is cached.
   *
   * Never throws: with no index or no readable source it returns an empty Map, and the ranker
   * then behaves exactly as it does without the signal.
   *
   * @param {string} cwd
   * @param {Map<string, string[]>} [index] the caller's signature index, to avoid building it twice
   * @returns {Map<string, string>}
   */
  function loadOrBuild(cwd, index) {
    try { cwd = fs.realpathSync(cwd); } catch (_) { /* keep the path as given */ }
    const cachePath = path.join(cwd, '.context', CACHE_FILE);
    let stamp = 0;
    try { stamp = fs.statSync(__require('./src/retrieval/sig-index-store').indexPath(cwd)).mtimeMs; } catch (_) { /* no complete index */ }
    // A cache that cannot be written (a read-only checkout, a sandbox) would be rebuilt by every query
    // of a long-lived process (the MCP server). The words of such a repository are kept for the life of
    // the process, per index stamp; where the cache can be written the file is the source of truth.
    const memoKey = stamp ? `${cwd}\0${stamp}\0${SCHEMA_VERSION}` : null;
    if (memoKey && _unwritable.has(memoKey)) return _unwritable.get(memoKey);
    try {
      const cached = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
      if (cached.schema === SCHEMA_VERSION && cached.builtFor === stamp && cached.share === DISTINCTIVE_SHARE
          && cached.perFile === PER_FILE && cached.words && typeof cached.words === 'object') {
        return new Map(Object.entries(cached.words));
      }
    } catch (_) { /* absent, stale or unreadable: rebuild */ }

    let built = new Map();
    try {
      built = buildFor(cwd, index instanceof Map ? index : __require('./src/retrieval/ranker').buildSigIndex(cwd));
    } catch (_) { built = new Map(); }

    if (!stamp) return built;
    try {
      // Sorted so the same repository always writes the same bytes; written beside and renamed, so a
      // reader never sees half a file.
      const words = {};
      for (const file of [...built.keys()].sort()) words[file] = built.get(file);
      fs.mkdirSync(path.dirname(cachePath), { recursive: true });
      const tmp = `${cachePath}.${process.pid}.tmp`;
      fs.writeFileSync(tmp, JSON.stringify({
        schema: SCHEMA_VERSION, builtFor: stamp, share: DISTINCTIVE_SHARE, perFile: PER_FILE, files: built.size, words,
      }), 'utf8');
      try { fs.renameSync(tmp, cachePath); } catch (e) { try { fs.unlinkSync(tmp); } catch (_) { /* gone */ } throw e; }
    } catch (_) {
      // a cache that cannot be written is only slower — once per index stamp, not once per query
      if (_unwritable.size >= 8) _unwritable.delete(_unwritable.keys().next().value);
      _unwritable.set(memoKey, built);
    }
    return built;
  }

  /** `{repository, index stamp}` -> the words of a repository whose cache could not be written. */
  const _unwritable = new Map();

  /**
   * The words the shipped ranker is handed for the repository at `cwd`: from the cache when its
   * `retrieval.bodyWords` is on, null when it is off. One answer for every command that ranks, so
   * `ask`, `--query`, `plan`, `evidence`, `validate --query` and the MCP tool cannot disagree.
   *
   * @param {string} cwd
   * @param {Map<string, string[]>} index
   * @param {object} [config] an already-loaded config; read from `cwd` when it names no `retrieval`
   * @returns {Map<string, string>|null}
   */
  function forRepo(cwd, index, config) {
    try {
      const cfg = config && config.retrieval ? config : __require('./src/config/loader').loadConfig(cwd);
      if (cfg && cfg.retrieval && cfg.retrieval.bodyWords) return loadOrBuild(cwd, index);
    } catch (_) { /* never fatal: ranking without the signal is the fallback */ }
    return null;
  }

  module.exports = { buildBodyWords, buildFor, loadOrBuild, forRepo, DISTINCTIVE_SHARE, PER_FILE, MIN_WORD_LENGTH, OPAQUE_WORD_LENGTH, MAX_LINE_LENGTH, MAX_SOURCE_BYTES, FRAMING_WORDS, SCHEMA_VERSION, CACHE_FILE };
  
};

// ── ./src/retrieval/enrich-from-maps ──
__factories["./src/retrieval/enrich-from-maps"] = function(module, exports) {
  
  /**
   * Retrieval surface-enrichment (#488, §7.4 Retrieval ceiling — opt-in via
   * `retrieval.surfaceEnrichment`, measure-gated).
   *
   * The map analyzers extract surfaces (routes) that never reach the rankable
   * signature index — a query like "payment webhook route" cannot match a
   * controller whose signatures never mention the route path. This module
   * appends deterministic pseudo-signatures (`route GET /api/users`) to the
   * defining file's signature list so the ranker's tokenizer can see them.
   *
   * Deterministic: rows are deduped and sorted; entries are copy-on-write so
   * arrays shared with the signature cache are never mutated.
   */

  const path = require('path');

  /**
   * Enrich a signature index with route pseudo-signatures.
   * @param {Map<string,string[]>} index cwd-relative file → sigs (mutated: enriched entries are replaced with fresh arrays)
   * @param {string} cwd
   * @returns {number} pseudo-signatures added
   */
  function enrichWithSurfaces(index, cwd) {
    if (!(index instanceof Map) || index.size === 0) return 0;

    let collectRoutes;
    try { ({ collectRoutes } = __require('./src/map/route-table')); } catch (_) { return 0; }

    const rels = [...index.keys()];
    const files = rels.map((rel) => path.join(cwd, rel));
    let routes = [];
    try { routes = collectRoutes(files, cwd) || []; } catch (_) { return 0; }

    const byFile = new Map();
    for (const r of routes) {
      const rel = String(r.file).replace(/\\/g, '/');
      if (!byFile.has(rel)) byFile.set(rel, new Set());
      byFile.get(rel).add(`route ${r.method} ${r.path}`);
    }

    let added = 0;
    for (const [rel, extras] of [...byFile.entries()].sort()) {
      const sigs = index.get(rel);
      if (!sigs) continue;
      const fresh = [...extras].sort().filter((x) => !sigs.includes(x));
      if (!fresh.length) continue;
      index.set(rel, [...sigs, ...fresh]); // copy-on-write: never mutate cached arrays
      added += fresh.length;
    }
    return added;
  }

  module.exports = { enrichWithSurfaces };
  
};

// ── ./src/retrieval/mined-expansions ──
__factories["./src/retrieval/mined-expansions"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');
  const { tokenize, EXPANSIONS, stripAnchor } = __require('./src/retrieval/bm25');
  const { isSelfIgnore } = __require('./src/util/context-dir');

  /**
   * Repo-mined query expansion (B2, #649).
   *
   * The static `EXPANSION_GROUPS` table is a global prior; this module mines a
   * per-repo one: tokens that co-occur within the same file's path + signature
   * vocabulary become weighted expansion candidates ("auth" ↔ "session" in a
   * repo whose auth files actually say session). Deterministic — same index in,
   * byte-identical JSON out — cached in `.context/` and regenerated with the
   * map. SigMap's answer to embeddings: learned from the repo, provable,
   * diffable. Consumption is opt-in via `retrieval.minedExpansions` and
   * measure-gated (`npm run benchmark:mined-expansions`).
   */

  // Keys are stems, so a cache written by a different stemmer matches nothing: bump
  // this whenever `stem()` changes (2: inflection-aware stemmer, #875).
  const SCHEMA_VERSION = 2;
  const CACHE_FILE = 'mined-expansions.json';

  // Precision filters. A token present in most files discriminates nothing
  // (df ceiling); one seen in a single file has no co-occurrence evidence
  // (df floor); a pair must repeat across files to count as a repo convention
  // rather than a coincidence; and each token keeps only its strongest few
  // neighbors so expansion never floods the query.
  const MIN_DF = 2;
  const MAX_DF_RATIO = 0.25;
  const MIN_COOC = 2;
  const TOP_K = 4;

  /**
   * Mine per-repo expansion candidates from a signature index.
   * @param {Map<string, string[]>} sigIndex  file → signature lines
   * @returns {{ schema: number, files: number, expansions: Object<string, Array<[string, number]>> }}
   */
  function mineExpansions(sigIndex) {
    const out = { schema: SCHEMA_VERSION, files: 0, expansions: {} };
    if (!(sigIndex instanceof Map) || sigIndex.size === 0) return out;

    // Per-file deduped token sets over path + anchor-stripped signatures.
    const fileSets = [];
    for (const [file, sigs] of sigIndex.entries()) {
      const toks = new Set(tokenize(
        String(file) + ' ' + (sigs || []).map((s) => stripAnchor(String(s))).join(' ')
      ));
      if (toks.size > 0) fileSets.push(toks);
    }
    out.files = fileSets.length;
    const N = fileSets.length;
    if (N < MIN_DF) return out;

    const df = new Map();
    for (const set of fileSets) {
      for (const t of set) df.set(t, (df.get(t) || 0) + 1);
    }
    const maxDf = Math.max(MIN_DF, Math.floor(N * MAX_DF_RATIO));
    const eligible = new Set([...df.keys()].filter((t) => df.get(t) >= MIN_DF && df.get(t) <= maxDf));

    // Pairwise co-occurrence over eligible tokens only.
    const cooc = new Map(); // "a|b" (a < b) → count
    for (const set of fileSets) {
      const toks = [...set].filter((t) => eligible.has(t)).sort();
      for (let i = 0; i < toks.length; i++) {
        for (let j = i + 1; j < toks.length; j++) {
          const key = `${toks[i]}|${toks[j]}`;
          cooc.set(key, (cooc.get(key) || 0) + 1);
        }
      }
    }

    // token → [neighbor, conditional probability] candidates.
    const perToken = new Map();
    const add = (a, b, count) => {
      // Pairs the static table already covers are excluded — the curated weight
      // applies there, and mining must not double-count it.
      const staticSyns = EXPANSIONS.get(a);
      if (staticSyns && staticSyns.has(b)) return;
      const w = Math.round((count / df.get(a)) * 1000) / 1000;
      if (!perToken.has(a)) perToken.set(a, []);
      perToken.get(a).push([b, w]);
    };
    for (const [key, count] of cooc.entries()) {
      if (count < MIN_COOC) continue;
      const [a, b] = key.split('|');
      add(a, b, count);
      add(b, a, count);
    }

    for (const tok of [...perToken.keys()].sort()) {
      const list = perToken.get(tok)
        .sort((x, y) => y[1] - x[1] || x[0].localeCompare(y[0]))
        .slice(0, TOP_K);
      out.expansions[tok] = list;
    }
    return out;
  }

  /** Canonical rendering: stable key order comes from mineExpansions itself. */
  function canonicalJson(mined) {
    return JSON.stringify(mined, null, 1);
  }

  /**
   * Load the mined map from `.context/` (keyed by newest context mtime, the
   * knowledge-map cache pattern) or mine it fresh from the repo's signature
   * index and persist it.
   * @param {string} cwd
   * @returns {{ schema: number, files: number, expansions: object }}
   */
  function loadOrMine(cwd) {
    try { cwd = fs.realpathSync(cwd); } catch (_) {}
    const cachePath = path.join(cwd, '.context', CACHE_FILE);
    let ctxMtime = 0;
    try {
      for (const f of fs.readdirSync(path.join(cwd, '.context'))) {
        // live.json is watcher telemetry, *.tmp is a write in flight and .gitignore is the
        // directory's own ignore file (#947): none of them changes the index.
        if (f === CACHE_FILE || f === 'live.json' || f.endsWith('.tmp') || isSelfIgnore(f)) continue;
        const st = fs.statSync(path.join(cwd, '.context', f));
        if (st.mtimeMs > ctxMtime) ctxMtime = st.mtimeMs;
      }
    } catch (_) {}
    try {
      const cached = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
      if (cached.schema === SCHEMA_VERSION && cached.builtFor === ctxMtime) return cached;
    } catch (_) {}
    let mined;
    try {
      const { buildSigIndex } = __require('./src/retrieval/ranker');
      mined = mineExpansions(buildSigIndex(cwd));
    } catch (_) {
      mined = { schema: SCHEMA_VERSION, files: 0, expansions: {} };
    }
    mined.builtFor = ctxMtime;
    try {
      fs.mkdirSync(path.dirname(cachePath), { recursive: true });
      fs.writeFileSync(cachePath, canonicalJson(mined));
    } catch (_) {}
    return mined;
  }

  module.exports = { mineExpansions, loadOrMine, canonicalJson, SCHEMA_VERSION, MIN_DF, MAX_DF_RATIO, MIN_COOC, TOP_K };
  
};

// ── ./src/retrieval/module-doc ──
__factories["./src/retrieval/module-doc"] = function(module, exports) {
  
  /**
   * Module-level documentation extractor (retrieval only).
   *
   * Signatures describe a file's SHAPE — names, params, return types. A module's
   * leading comment describes its PURPOSE, in prose, using the words a person
   * would actually search with. That prose is the bridge between a behavioural
   * query ("what fraction of the repo made it into the output") and the code
   * that implements it (`coverageScore(cwd, fileEntries, config)`), which shares
   * not one token with the query.
   *
   * This text is added to the RETRIEVAL INDEX ONLY — never to the generated
   * context file. The prompt artifact is token-budgeted and prose is expensive
   * there; the index is not injected into any prompt, so it can afford the words
   * that make a file findable.
   *
   * Zero-dependency, pure, bundle-safe.
   */

  // Enough to characterise a module without letting one verbose header dominate
  // BM25 length normalisation for the whole corpus.
  const MAX_CHARS = 400;
  const MAX_SCAN_LINES = 60;

  // Legal boilerplate is high-frequency noise: it appears in many files, shares no
  // vocabulary with real queries, and would flatten idf across the corpus.
  const BOILERPLATE = /\b(copyright|licensed under|SPDX-License|all rights reserved|permission is hereby granted)\b/i;

  const BLOCK_LANGS = new Set(['js', 'jsx', 'ts', 'tsx', 'java', 'go', 'rs', 'kt', 'swift', 'scala', 'cs', 'php', 'dart', 'c', 'cpp', 'h']);
  const HASH_LANGS = new Set(['py', 'rb', 'r', 'sh', 'yml', 'yaml', 'toml']);

  function _extOf(filePath) {
    const m = String(filePath).match(/\.([A-Za-z0-9]+)$/);
    return m ? m[1].toLowerCase() : '';
  }

  /** Strip comment furniture, JSDoc tags, and markup from one raw comment line. */
  function _cleanLine(line) {
    return String(line)
      .replace(/^\s*[/*#-]+\s?/, '')      // leading // /* * # ---
      .replace(/\*+\/\s*$/, '')            // trailing */
      .replace(/^\s*@\w+.*$/, '')          // @param / @returns tag lines
      .replace(/[*_`]/g, '')               // markdown emphasis / code ticks
      .trim();
  }

  /**
   * Extract a module's leading documentation prose.
   *
   * @param {string} src       file contents
   * @param {string} filePath  used only to pick a comment syntax
   * @returns {string} collapsed prose, capped, or '' when there is none
   */
  function extractModuleDoc(src, filePath) {
    if (!src || typeof src !== 'string') return '';
    const ext = _extOf(filePath);
    const lines = src.split('\n', MAX_SCAN_LINES);

    const collected = [];
    let inBlock = false;
    let started = false;

    for (const raw of lines) {
      const line = raw.trim();
      if (!started) {
        // Skip preamble that precedes the real header comment.
        if (!line) continue;
        if (line.startsWith('#!')) continue;                       // shebang
        if (/^['"]use strict['"];?$/.test(line)) continue;
        if (/^(package|import|from|using|#include)\b/.test(line)) continue;
      }

      if (BLOCK_LANGS.has(ext) || ext === '') {
        if (!inBlock && line.startsWith('/*')) { inBlock = true; started = true; }
        if (inBlock) {
          const cleaned = _cleanLine(line);
          if (cleaned) collected.push(cleaned);
          if (line.includes('*/')) break;
          continue;
        }
        if (line.startsWith('//')) {                                // run of // lines
          started = true;
          const cleaned = _cleanLine(line);
          if (cleaned) collected.push(cleaned);
          continue;
        }
        if (started || collected.length) break;
        break;                                                      // first real code — no header
      }

      if (HASH_LANGS.has(ext)) {
        if (/^("""|''')/.test(line)) {                              // python docstring
          started = true; inBlock = !inBlock;
          const cleaned = _cleanLine(line.replace(/^("""|''')/, '').replace(/("""|''')$/, ''));
          if (cleaned) collected.push(cleaned);
          if (!inBlock) break;
          continue;
        }
        if (inBlock) { const c = _cleanLine(line); if (c) collected.push(c); continue; }
        if (line.startsWith('#')) { started = true; const c = _cleanLine(line); if (c) collected.push(c); continue; }
        if (collected.length) break;
        break;
      }
      break;
    }

    const text = collected.join(' ').replace(/\s+/g, ' ').trim();
    if (!text || BOILERPLATE.test(text)) return '';
    if (text.length <= MAX_CHARS) return text;
    return text.slice(0, MAX_CHARS).replace(/\s+\S*$/, '');        // never cut mid-word
  }

  /** Render as an index-only pseudo-signature, or '' when there is no doc. */
  function moduleDocSig(src, filePath) {
    const doc = extractModuleDoc(src, filePath);
    return doc ? `# module: ${doc}` : '';
  }

  module.exports = { extractModuleDoc, moduleDocSig, MAX_CHARS };
  
};

// ── ./src/retrieval/ranker ──
__factories["./src/retrieval/ranker"] = function(module, exports) {
  
  /**
   * SigMap zero-dependency relevance ranker.
   *
   * Ranks all files in a signature index against a natural-language query.
   * Scoring weights:
   *   - keyword overlap (exact token match against sigs)
   *   - symbol match (token appears in a top-level identifier / function name)
   *   - partial prefix match (token is prefix of a sig token, length ≥ 4)
   *   - path relevance (query token appears in the file path)
   *   - recency boost (applied externally via recency map)
   *
   * Usage:
   *   const { rank } = __require('./src/retrieval/src/retrieval/ranker');
   *   const results = rank(query, sigIndex, { topK: 10 });
   *   // results: [{ file, score, sigs, tokens }]
   */

  const { loadWeights } = __require('./src/learning/weights');
  const { tokenize, STOP_WORDS } = __require('./src/retrieval/tokenizer');
  const { bm25rank, MODULE_DOC_RE, stem } = __require('./src/retrieval/bm25');
  const { isTestFile, isMockFile, isGeneratedDir, isDocsFile, isCiFile } = __require('./src/util/file-class');

  // ---------------------------------------------------------------------------
  // Default weights
  // ---------------------------------------------------------------------------
  const DEFAULT_WEIGHTS = {
    exactToken: 1.0,       // query token exactly in sig tokens
    // symbolMatch ABOVE pathMatch: defining the thing beats mentioning it.
    // Inverted (0.5 vs 0.8) until #808 — a test file naming the behaviour
    // repeatedly, or a path that merely contains the token, outscored the
    // implementation. Raising symbolMatch is the half that carries the fix;
    // pathMatch stays at 0.8 because a well-organised path is genuinely
    // informative, and cutting it too (to 0.45) on top of the IDF scaling below
    // double-suppressed it and cost 4.5pp of hit@5 on the hard corpus.
    symbolMatch: 0.9,      // bonus if token appears in a function/class name line
    prefixMatch: 0.3,      // partial prefix hit (query token ≥ 4 chars)
    pathMatch: 0.8,        // query token appears in the file path (scaled by path IDF)
    recencyBoost: 1.5,     // multiplier applied when file is in recencySet
    graphBoost: 0.4,       // additive bonus for 1-hop import neighbors of matching files
  };

  // Graph boost amounts for 2-hop traversal with decay (v6.7)
  const GRAPH_BOOST_AMOUNTS = {
    hop1: 0.40,   // direct import neighbor of a file with score > 0
    hop2: 0.15,   // 2 hops away (transitive), with decay
    callHop: 0.30, // call-graph file neighbor (opt-in retrieval.callGraphBoost)
  };

  // Max additive prior for import-graph centrality (opt-in retrieval.centralityBlend)
  const CENTRALITY_BLEND_WEIGHT = 0.3;

  // Per-intent weight profiles were removed in favour of a single weight set.
  // They were provably inert: scoreFile's score was discarded by rank(), so the
  // profiles only ever reached the explain table. Once the signal WAS wired into
  // the score (see SIGNAL_BLEND below), a sweep over the leak-free hard corpus
  // showed intent-specific profiles produced byte-identical metrics to the flat
  // DEFAULT_WEIGHTS at every blend value — so they earn nothing and are gone.
  // `detectIntent` is retained: it is still reported to the user and is the right
  // hook for shaping OUTPUT depth later.

  // How much the weighted keyword/symbol/path signal modulates the BM25 base.
  // Multiplicative and bounded, so it can only reorder files that already match —
  // it can never lift a zero-BM25 file into the results. Tuned on the leak-free
  // corpus: 0.5 gave hit@5 50.0% -> 56.7% and MRR 0.419 -> 0.447; higher values
  // held hit@5 but degraded MRR.
  const SIGNAL_BLEND = 0.5;

  // TRIED AND REJECTED: a same-line co-occurrence bonus, on the theory that a file
  // declaring `parseAuthToken` should outrank one mentioning `parseAuth` and
  // `token` on separate lines. Swept 0.15-1.0: hit@5 did not move on either the
  // 90-task authored corpus or the 32-task mined one, and MRR degraded
  // monotonically as the weight rose. Signatures are short and dense enough that
  // BM25's bag already captures this. Not reinstated without new evidence.

  // Penalty multipliers for negative signals
  const PENALTY_SIGNALS = {
    testFile:      0.4,    // every test convention, via util/file-class
    mockFile:      0.3,    // mocks/stubs/fakes/fixtures: test scaffolding
    generatedCode: 0.3,    // dist/build/.next in path
    docsFile:      0.2,    // docs/ dirs AND the root README/CHANGELOG family
    ciFile:        0.15,   // .github/workflows & friends: indexed, rarely the answer
    nodeModules:   0.0,    // node_modules (zero score)
    dataHolder:    0.3,    // generated POJO/entity: almost entirely accessors
  };

  // A file whose members are overwhelmingly trivial accessors is a data holder,
  // not logic. Path-based detection cannot see these: generated JPA/MyBatis
  // entities live in ordinary source trees. They match a query on any column
  // name they happen to carry (`getNote`/`setNote` matches "note" as strongly as
  // the service that actually implements order notes), so on an entity-heavy
  // repo they crowd real code out of the top results.
  const ACCESSOR_RE = /^\s*(get|set|is)[A-Z]\w*\s*\(/;
  const DATA_HOLDER_RATIO = 0.8;
  const DATA_HOLDER_MIN_MEMBERS = 6;

  // Query terms that mean the penalised category IS the target. Read from the
  // query tokens directly, NOT via detectIntent: that classifier is first-match-
  // wins over its pattern object, and `debug` precedes `test`, so "fix the failing
  // test" classifies as debug and never reaches the test branch.
  const WANTS_TESTS = new Set(['test', 'tests', 'spec', 'specs', 'unit', 'integration', 'e2e', 'assertion', 'assert', 'mock', 'fixture', 'coverage', 'testing']);
  const WANTS_DOCS = new Set(['doc', 'docs', 'documentation', 'readme', 'changelog', 'guide', 'tutorial']);
  const WANTS_CI = new Set(['ci', 'cd', 'pipeline', 'pipelines', 'workflow', 'workflows', 'actions', 'jenkins', 'travis', 'circleci', 'buildkite', 'deploy', 'deployment', 'release', 'publish']);
  const WANTS_MODELS = new Set(['entity', 'entities', 'model', 'models', 'pojo', 'dto', 'bean', 'getter', 'getters', 'setter', 'setters', 'accessor', 'accessors', 'field', 'fields', 'column', 'columns', 'schema']);

  /** Which penalised categories the query is explicitly asking for. */
  function _queryWants(queryTokens) {
    const wants = { tests: false, docs: false, models: false, ci: false };
    for (const t of queryTokens || []) {
      if (WANTS_TESTS.has(t)) wants.tests = true;
      if (WANTS_DOCS.has(t)) wants.docs = true;
      if (WANTS_MODELS.has(t)) wants.models = true;
      if (WANTS_CI.has(t)) wants.ci = true;
    }
    return wants;
  }

  /**
   * True when a file's members are overwhelmingly trivial accessors — a generated
   * entity or POJO rather than logic. Type declarations are excluded from the
   * ratio so a small class is not misjudged by its own `class X` line.
   */
  function _isDataHolder(sigs) {
    if (!Array.isArray(sigs)) return false;
    const members = sigs.filter((line) => /^\s/.test(line) || !/^(class|interface|enum|struct|function|module\.exports)\b/.test(line));
    if (members.length < DATA_HOLDER_MIN_MEMBERS) return false;
    const accessors = members.filter((line) => ACCESSOR_RE.test(line)).length;
    return accessors / members.length >= DATA_HOLDER_RATIO;
  }

  function _computePenalty(filePath, wants, sigs) {
    const pathLower = filePath.toLowerCase();
    if (pathLower.includes('node_modules')) return PENALTY_SIGNALS.nodeModules;
    // Every path category below is classified by `src/util/file-class.js`, the
    // same predicates the token-budget drop order uses. The ranker previously
    // inlined weaker copies that recognised only `foo.test.js` and `test/`, so
    // `routes_test.go` was never penalised (#808).
    //
    // A penalty must never fire on the very thing the user asked for. Before
    // this, "write tests for the ranker" multiplied every test file by 0.4 —
    // the query and the penalty were pulling in opposite directions.
    if (isTestFile(filePath)) {
      return (wants && wants.tests) ? 1.0 : PENALTY_SIGNALS.testFile;
    }
    if (isMockFile(filePath)) {
      return (wants && wants.tests) ? 1.0 : PENALTY_SIGNALS.mockFile;
    }
    if (isGeneratedDir(filePath)) return PENALTY_SIGNALS.generatedCode;
    if (isCiFile(filePath)) {
      return (wants && wants.ci) ? 1.0 : PENALTY_SIGNALS.ciFile;
    }
    if (isDocsFile(filePath)) {
      return (wants && wants.docs) ? 1.0 : PENALTY_SIGNALS.docsFile;
    }
    // Content-based, and last: a data holder is still a real source file, so it
    // is only demoted once the path-based categories have had their say.
    if (_isDataHolder(sigs)) {
      return (wants && wants.models) ? 1.0 : PENALTY_SIGNALS.dataHolder;
    }
    return 1.0;
  }

  // Detect hub files: those with fanout > 20% of all files in the graph
  function _computeHubs(graph) {
    if (!graph || !graph.reverse) return new Set();
    const fileCount = Math.max(1, graph.reverse.size);
    const threshold = Math.ceil(fileCount * 0.2);
    const hubs = new Set();
    for (const [file, deps] of graph.reverse) {
      if ((deps && deps.size >= threshold) || (Array.isArray(deps) && deps.length >= threshold)) {
        hubs.add(file);
      }
    }
    return hubs;
  }

  /**
   * The hop-1 bonus a file takes for its (count + 1)-th importing seed (#935).
   *
   * Undamped it is `GRAPH_BOOST_AMOUNTS.hop1` every time — the behaviour that was
   * calibrated on graphs of a few hundred files and that grows with a complete
   * graph. A damping rule bounds the ACCUMULATION only: the first bonus is the
   * designed lift for a direct neighbour of a match and is never damped, so a
   * rule can reorder files that matched on their own but never hide a neighbour.
   *
   * @param {{maxBonuses?:number, maxShare?:number, decay?:number}|null} damping
   * @param {number} base the file's score before any graph boost
   * @param {number} count hop-1 bonuses the file has already taken
   * @returns {number} the bonus to add; 0 means the seed adds nothing
   */
  function _hop1Bonus(damping, base, count) {
    const amount = GRAPH_BOOST_AMOUNTS.hop1;
    if (!damping || count === 0) return amount;
    if (damping.maxBonuses !== undefined && count >= damping.maxBonuses) return 0;
    if (damping.maxShare !== undefined && (count + 1) * amount > damping.maxShare * base) return 0;
    if (damping.decay !== undefined) return amount * Math.pow(damping.decay, count);
    return amount;
  }

  // Common utility paths that should be treated as hubs regardless of fanout
  // The graph builders disagree on key case: src/graph/builder.js lowercases every
  // node (normalizePath), while src/graph/call-graph.js keys by a case-preserving
  // path.resolve. Assuming either one breaks the other, so every graph lookup in
  // this file probes both forms — the same thing the centrality blend already does.
  function _graphKeys(p) {
    const norm = require('path').normalize(p);
    const lower = norm.toLowerCase();
    return lower === norm ? [norm] : [norm, lower];
  }
  function _graphGet(map, absPath) {
    for (const k of _graphKeys(absPath)) {
      const hit = map.get(k);
      if (hit !== undefined) return hit;
    }
    return undefined;
  }
  function _registerKeys(map, absPath, value) {
    for (const k of _graphKeys(absPath)) if (!map.has(k)) map.set(k, value);
  }

  function _isHub(filePath) {
    return /\/(utils|helpers|shared|common|constants|types|interfaces|index|zzz|globals)\.(ts|tsx|js|jsx|r|R)$/.test(filePath)
        || filePath.endsWith('/index.ts') || filePath.endsWith('/index.js')
        || filePath.endsWith('/R/utils.R') || filePath.endsWith('/R/zzz.R') || filePath.endsWith('/R/globals.R');
  }

  /**
   * Per-token corpus coverage: how many indexed files carry each query token in
   * their signatures, and how many carry it in their path.
   *
   * This is the diagnostic that answers "why did my query miss" — a token
   * matching zero files is the single most useful thing to show, and `ask` had
   * no way to surface it (#813). Computed only under `opts.explain`, so the
   * default ranking path pays nothing for it.
   *
   * @param {Map<string,string[]>} sigIndex
   * @param {string[]} queryTokens
   * @returns {Array<{token: string, sigFiles: number, pathFiles: number}>}
   */
  function _tokenCoverage(sigIndex, queryTokens) {
    const uniq = [...new Set(queryTokens)].filter((t) => !STOP_WORDS.has(t));
    const sigDf = new Map();
    const pathDf = new Map();
    // Counted over STEMS, because BM25 — which supplies the base score every
    // other signal multiplies — matches on stems. Counting raw tokens made this
    // table report "users matched nothing" on a query BM25 scored 1.24 via
    // `loginUser`: precisely the confidently-wrong reporting this view exists
    // to eliminate.
    const stems = new Map(uniq.map((t) => [t, stem(t)]));
    for (const [file, sigs] of sigIndex.entries()) {
      const sigTokens = new Set(tokenize((sigs || []).filter((l) => !MODULE_DOC_RE.test(l)).join(' ')).map(stem));
      const pathTokens = new Set(tokenize(file).map(stem));
      for (const t of uniq) {
        const st = stems.get(t);
        if (sigTokens.has(st)) sigDf.set(t, (sigDf.get(t) || 0) + 1);
        if (pathTokens.has(st)) pathDf.set(t, (pathDf.get(t) || 0) + 1);
      }
    }
    return uniq.map((t) => ({ token: t, sigFiles: sigDf.get(t) || 0, pathFiles: pathDf.get(t) || 0 }));
  }

  /**
   * Inverse document frequency of each query token across the corpus's PATH
   * tokens.
   *
   * `pathMatch` was a flat bonus, so a token that happens to equal the project
   * name lifted every file whose path contains it. On `gin`, "gin" matched the
   * repo name and pushed `ginS/gins.go` and `.github/workflows/gin.yml` over the
   * real source (#807). A token present in a large share of paths carries no
   * discriminating power, which is exactly what IDF encodes — the same intuition
   * the ranker already applies to signature tokens via BM25, now applied to
   * paths.
   *
   * Normalised to (0, 1] so a maximally rare token earns the full `pathMatch`
   * weight and a token present in every path earns ~0.
   *
   * @param {Map<string,string[]>} sigIndex
   * @param {string[]} queryTokens
   * @returns {Map<string, number>} token -> idf multiplier in (0, 1]
   */
  function _pathIdf(sigIndex, queryTokens) {
    const idf = new Map();
    const n = sigIndex.size;
    if (n === 0) return idf;
    const uniq = [...new Set(queryTokens)].filter((t) => !STOP_WORDS.has(t));
    if (uniq.length === 0) return idf;

    const df = new Map();
    for (const file of sigIndex.keys()) {
      const pathTokens = new Set(tokenize(file));
      for (const t of uniq) if (pathTokens.has(t)) df.set(t, (df.get(t) || 0) + 1);
    }
    const denom = Math.log(1 + n);
    for (const t of uniq) {
      const d = df.get(t) || 0;
      idf.set(t, denom > 0 ? Math.log(1 + (n - d) / (1 + d)) / denom : 1);
    }
    return idf;
  }

  /**
   * Score a single file against a query, returning detailed signal breakdown.
   *
   * @param {string}   filePath   - relative file path (e.g. 'src/extractors/python.js')
   * @param {string[]} sigs       - signature strings for this file
   * @param {string[]} queryTokens - pre-tokenized query
   * @param {object}   weights
   * @returns {{ score: number, signals: { exactToken: number, symbolMatch: number, prefixMatch: number, pathMatch: number, penalty: number } }}
   */
  function scoreFile(filePath, sigs, queryTokens, weights, wants, pathIdf) {
    if (!sigs || sigs.length === 0) return { score: 0, signals: { exactToken: 0, symbolMatch: 0, prefixMatch: 0, pathMatch: 0, penalty: 1.0 } };

    const w = weights || DEFAULT_WEIGHTS;
    const signals = { exactToken: 0, symbolMatch: 0, prefixMatch: 0, pathMatch: 0, penalty: _computePenalty(filePath, wants, sigs) };

    // Module-doc prose is excluded here on purpose. This signal measures overlap
    // with DECLARED IDENTIFIERS; prose relevance is BM25's job, where it is scored
    // as its own weighted field. Letting descriptive text inflate the identifier
    // signal double-counts it and measurably degraded MRR.
    const codeSigs = sigs.filter((line) => !MODULE_DOC_RE.test(line));
    const sigText = codeSigs.join(' ');
    const sigTokenSet = new Set(tokenize(sigText));

    // Build token set from the file path
    const pathTokenSet = new Set(tokenize(filePath));

    let score = 0;

    for (const qt of queryTokens) {
      if (STOP_WORDS.has(qt)) continue;

      // Exact token match in sigs
      if (sigTokenSet.has(qt)) {
        const bonus = w.exactToken;
        score += bonus;
        signals.exactToken += bonus;

        // Bonus: appears directly in a function/class/method name line
        const nameLineMatch = codeSigs.some((sig) => {
          const nt = tokenize(sig.replace(/[^a-zA-Z0-9_\s]/g, ' '));
          return nt.includes(qt);
        });
        if (nameLineMatch) {
          score += w.symbolMatch;
          signals.symbolMatch += w.symbolMatch;
        }
      }

      // Prefix match (e.g. query "python" matches "pythonDeps")
      if (qt.length >= 4) {
        for (const st of sigTokenSet) {
          if (st !== qt && st.startsWith(qt)) {
            score += w.prefixMatch;
            signals.prefixMatch += w.prefixMatch;
            break; // one bonus per query token
          }
        }
      }

      // Path token match, scaled by how discriminating the token is across all
      // indexed paths. A direct caller that passes no index (tests, external
      // consumers of the exported scoreFile) keeps the unscaled behaviour.
      if (pathTokenSet.has(qt)) {
        const scale = pathIdf && pathIdf.has(qt) ? pathIdf.get(qt) : 1;
        const bonus = w.pathMatch * scale;
        score += bonus;
        signals.pathMatch += bonus;
      }
    }

    // Apply penalty multiplier
    score *= signals.penalty;

    return { score, signals };
  }

  /**
   * Rank all files in a signature index against a query.
   *
   * @param {string}              query     - natural language query
   * @param {Map<string,string[]>} sigIndex - Map<file, sigs[]>
   * @param {object}  [opts]
   * @param {number}  [opts.topK=10]               - max results to return
   * @param {number}  [opts.recencyBoost=1.5]       - multiplier for recent files
   * @param {Set<string>} [opts.recencySet]         - set of recently-changed file paths
   * @param {object}  [opts.weights]               - override scoring weights
   * @param {string}  [opts.cwd]                   - project root for learned ranking weights
   * @param {{ forward: Map<string,string[]> }} [opts.graph] - dependency graph for neighbor boost
   * @param {{ forward: Map<string,string[]> }} [opts.callGraph] - file-level call-graph edges
   *        (from buildCallFileGraph) for the opt-in call-neighbor boost
   * @param {boolean} [opts.includeZeroScore=false] - keep files that scored 0.
   *        Off by default: a rank is a claim of relevance and 0.00 is the absence
   *        of one (#807). Multi-stage callers that boost after ranking opt in.
   * @param {boolean} [opts.explain=false] - attach the `--explain` surfaces
   *        (nearMiss, tokenCoverage, pathIdf, totalCandidates, indexSize) as
   *        properties on the returned array.
   * @param {Map<string,number>} [opts.centrality] - absolute file → normalized
   *        centrality (from computeCentrality) for the opt-in centrality blend
   * @param {Map<string,string>} [opts.bodyWords] - file → the rare words of its source
   *        (from body-words.loadOrBuild) for the retrieval.bodyWords signal (on by default)
   * @param {{maxBonuses?:number, maxShare?:number, decay?:number}} [opts.graphDamping]
   *        bounds how much hop-1 boost one file may ACCUMULATE from the import graph (#935):
   *        at most `maxBonuses` bonuses, at most `maxShare` x its own score in total, or each
   *        successive bonus scaled by `decay`. The first bonus is never damped. No rule is
   *        switched on by any config: the option exists so `run-graph-damping-sweep.mjs` can
   *        measure one, and the measured result is in docs-vp/guide/retrieval-benchmark.md.
   * @returns {{ file: string, score: number, sigs: string[], tokens: number, intent: string, signals: object }[]}
   */
  function rank(query, sigIndex, opts) {
    if (!query || typeof query !== 'string') return [];
    if (!sigIndex || !(sigIndex instanceof Map) || sigIndex.size === 0) return [];

    const topK = (opts && opts.topK) || 10;
    const recencyMultiplier = (opts && opts.recencyBoost) || DEFAULT_WEIGHTS.recencyBoost;
    const recencySet = (opts && opts.recencySet) || null;
    const graph = (opts && opts.graph && opts.graph.forward instanceof Map) ? opts.graph : null;
    const cwd = (opts && opts.cwd) || null;

    // Intent is reported to the user and shapes output depth; it no longer
    // selects scoring weights (see SIGNAL_BLEND).
    const intent = detectIntent(query);
    const weights = (opts && opts.weights) ? Object.assign({}, DEFAULT_WEIGHTS, opts.weights) : DEFAULT_WEIGHTS;
    // Learned per-file multipliers are a LOCAL, evolving signal (.context/weights.json).
    // Benchmarks and CI gates must opt out via { learned: false }, or a developer's
    // local learned state silently changes the score and CI stops being reproducible.
    const useLearned = !(opts && opts.learned === false);
    const learnedWeights = opts && opts.cwd && useLearned ? loadWeights(opts.cwd) : null;

    const queryTokens = tokenize(query);
    const queryWants = _queryWants(queryTokens);
    if (queryTokens.length === 0) {
      // Empty query: return top-K by file count (most signatures = most useful)
      const all = [];
      for (const [file, sigs] of sigIndex.entries()) {
        all.push({ file, score: sigs.length, sigs, tokens: Math.ceil(sigs.join('\n').length / 4), intent, signals: {} });
      }
      all.sort((a, b) => b.score - a.score || a.file.localeCompare(b.file));
      return all.slice(0, topK);
    }

    // Identifier-aware BM25 base relevance over the whole index (#395). BM25
    // splits camelCase/snake_case, stems, and boosts path tokens, so queries
    // whose terms live inside identifiers (e.g. "component emit" → componentEmits)
    // are matched. The existing negative-signal penalty and recency/graph/learned
    // boosts are layered on top; the per-token signals stay for the explain table.
    const bm25Scores = new Map();
    for (const c of bm25rank(query, [...sigIndex.entries()].map(([file, sigs]) => ({ file, sigs })), opts)) {
      bm25Scores.set(c.file, c.score);
    }

    // Two passes: scoreFile's weighted signal needs the max across the corpus to
    // normalise against, so collect first, then combine.
    const pathIdf = _pathIdf(sigIndex, queryTokens);

    const prescored = [];
    let maxSignal = 0;
    for (const [file, sigs] of sigIndex.entries()) {
      const result = scoreFile(file, sigs, queryTokens, weights, queryWants, pathIdf);
      if (result.score > maxSignal) maxSignal = result.score;
      prescored.push({ file, sigs, result });
    }

    const scored = [];
    for (const { file, sigs, result } of prescored) {
      const penalty = result.signals.penalty;
      const base = bm25Scores.get(file) || 0;
      // Blend the weighted keyword/symbol/path signal into the BM25 base. This
      // was previously computed and thrown away — `result.score` was never read,
      // which silently made DEFAULT_WEIGHTS and every intent profile dead config.
      const signalNorm = maxSignal > 0 ? result.score / maxSignal : 0;
      let score = base * penalty * (1 + SIGNAL_BLEND * signalNorm);
      const signals = result.signals;
      signals.bm25 = base;
      signals.signalBlend = signalNorm;

      // Recency boost
      if (recencySet && recencySet.has(file) && score > 0) {
        score *= recencyMultiplier;
        signals.recencyBoost = recencyMultiplier;
      }

      if (learnedWeights && score > 0) {
        const multiplier = learnedWeights[file] || 1.0;
        score *= multiplier;
        signals.learnedWeights = multiplier;
      }

      scored.push({
        file,
        score,
        sigs,
        tokens: Math.ceil(sigs.join('\n').length / 4),
        intent,
        signals,
      });
    }

    // Graph neighbor boost: 2-hop traversal with decay (v6.7)
    // Hop 1: add hop1 amount to direct import neighbors (score > 0)
    // Hop 2: add hop2 amount to neighbors of hop1 files (with decay)
    // Hub suppression: files with high fanout (>20%) are not boosted
    if (graph && cwd) {
      const path = require('path');
      // Every graph node is keyed by `path.normalize(p).toLowerCase()` (see
      // normalizePath in src/graph/builder.js and src/graph/call-graph.js).
      // Lookups MUST use the same key space: a bare path.resolve() preserves
      // case, so on any repo whose absolute path contains an uppercase letter
      // every .get() missed and this entire block was silently inert.
      const keyToIdx = new Map();
      for (let i = 0; i < scored.length; i++) {
        _registerKeys(keyToIdx, path.resolve(cwd, scored[i].file), i);
      }

      const hubs = _computeHubs(graph);
      const hop1Files = new Set(); // normalised keys that received a hop1 boost
      const hop1Seeds = [];        // original (un-normalised) paths, for hop-2 lookup

      // Hop 1: direct neighbors of scored files. Seeds snapshotted BEFORE the
      // loop (as the call-graph block below already does) so boosts never
      // cascade: a file whose only score is a hop-1 boost must not become a seed
      // itself mid-loop, or the effective seed set — and every boost total —
      // depends on index insertion order, which git history changes via the
      // recent-commits hoist. That made gate scores differ between a shallow CI
      // checkout and a developer clone of the same commit (#596).
      const hop1SeedEntries = scored.filter((e) => e.score > 0);
      // #851: a file may take ONE hop-1 bonus for free — that is the designed
      // lift for a direct neighbour of a match, and #596 pins it — but it may
      // only ACCUMULATE further bonuses if it matched the query on its own.
      //
      // Without that, hop1 was added once per importing seed, so popularity
      // became relevance: a shared utility with 23 importing seeds and bm25 0
      // collected 23 x 0.40 = 9.2 and ranked 3rd for a query it shares no token
      // with — above every genuine match but the top two. Whether it happened at
      // all turned on `_computeHubs`' threshold, `ceil(fileCount * 0.2)`, which
      // any single added file can step past: that utility has exactly 36
      // importers, so it was hub-suppressed at 180 graph nodes and not at 181.
      //
      // Capping everyone at one bonus instead was tried and is wrong: files that
      // DO match legitimately accumulate, and flattening them reordered the
      // matches among themselves, costing a real rank-5 answer its place.
      const hop1Matched = scored.map((e) => e.score > 0);
      const hop1Base = scored.map((e) => e.score);
      const hop1Count = new Map();
      const damping = (opts && opts.graphDamping) || null;
      for (const entry of hop1SeedEntries) {
        const neighbors = _graphGet(graph.forward, path.resolve(cwd, entry.file)) || [];
        for (const neighborAbs of neighbors) {
          const nk = path.normalize(neighborAbs);
          if (_isHub(nk) || hubs.has(nk) || hubs.has(nk.toLowerCase())) continue;
          const idx = _graphGet(keyToIdx, nk);
          if (idx !== undefined && (hop1Matched[idx] || !hop1Count.has(idx))) {
            const taken = hop1Count.get(idx) || 0;
            const bonus = _hop1Bonus(damping, hop1Base[idx], taken);
            if (bonus <= 0) continue;
            hop1Count.set(idx, taken + 1);
            scored[idx].score += bonus;
            scored[idx].signals.graphBoost = (scored[idx].signals.graphBoost || 0) + bonus;
            hop1Files.add(nk);
            hop1Seeds.push(neighborAbs);
          }
        }
      }

      // Hop 2: neighbors of hop1 files (only if they didn't get a direct score).
      // Eligibility frozen after hop-1 for the same reason: a file whose first
      // score is a hop-2 boost must not become hop-2-eligible mid-loop (#596).
      const hop2Eligible = scored.map((e) => e.score > 0);
      for (const hop1Key of hop1Seeds) {
        if (_graphGet(keyToIdx, hop1Key) === undefined) continue; // skip files not in index
        const neighbors = _graphGet(graph.forward, hop1Key) || [];
        for (const neighborAbs of neighbors) {
          const nk = path.normalize(neighborAbs);
          if (_isHub(nk) || hubs.has(nk) || hubs.has(nk.toLowerCase())) continue;
          if (hop1Files.has(nk)) continue; // skip already hop1-boosted
          const idx = _graphGet(keyToIdx, nk);
          if (idx !== undefined && hop2Eligible[idx]) {
            // Only boost files that have some baseline score (not noise)
            scored[idx].score += GRAPH_BOOST_AMOUNTS.hop2;
            scored[idx].signals.graphBoost = (scored[idx].signals.graphBoost || 0) + GRAPH_BOOST_AMOUNTS.hop2;
          }
        }
      }
    }

    // Call-graph neighbor boost (opt-in via retrieval.callGraphBoost): a file
    // whose functions call into — or are called by — a positively-scored file is
    // relevant even when no import edge exists (Go/Java same-package, dynamic
    // dispatch). Single hop; seeds snapshotted first so boosts never cascade.
    const callGraph = (opts && opts.callGraph && opts.callGraph.forward instanceof Map) ? opts.callGraph : null;
    if (callGraph && cwd) {
      const path = require('path');
      // buildCallFileGraph keys by a CASE-PRESERVING path.resolve, unlike the
      // import graph builder which lowercases — hence the dual-form probe.
      const keyToIdx = new Map();
      for (let i = 0; i < scored.length; i++) _registerKeys(keyToIdx, path.resolve(cwd, scored[i].file), i);
      const hubs = _computeHubs(callGraph);
      const seeds = scored.filter((e) => e.score > 0).map((e) => e.file);
      for (const file of seeds) {
        for (const neighborAbs of (_graphGet(callGraph.forward, path.resolve(cwd, file)) || [])) {
          const nk = path.normalize(neighborAbs);
          if (_isHub(nk) || hubs.has(nk) || hubs.has(nk.toLowerCase())) continue;
          const idx = _graphGet(keyToIdx, nk);
          if (idx !== undefined && scored[idx].file !== file) {
            scored[idx].score += GRAPH_BOOST_AMOUNTS.callHop;
            scored[idx].signals.callGraphBoost = (scored[idx].signals.callGraphBoost || 0) + GRAPH_BOOST_AMOUNTS.callHop;
          }
        }
      }
    }

    // Centrality blend (opt-in via retrieval.centralityBlend): a small additive
    // prior from import-graph centrality so heavily-referenced files rank above
    // one-off helpers on ambiguous queries. Applied only to positively-scored
    // files — a tie-breaker among matches, never a way to surface non-matches.
    const centrality = (opts && opts.centrality instanceof Map && opts.centrality.size > 0) ? opts.centrality : null;
    if (centrality && cwd) {
      const path = require('path');
      for (const entry of scored) {
        if (entry.score <= 0) continue;
        const abs = path.resolve(cwd, entry.file);
        // The graph builder lowercases paths (normalizePath) — probe both forms.
        const c = centrality.get(abs) || centrality.get(abs.toLowerCase());
        if (c) {
          const bonus = CENTRALITY_BLEND_WEIGHT * c;
          entry.score += bonus;
          entry.signals.centrality = bonus;
        }
      }
    }

    // Compute confidence levels based on score distribution
    if (scored.length > 0) {
      // A loop, not `Math.max(...scores)`: spread passes one argument per file,
      // which overflows the stack past ~125k files (#855).
      let maxScore = -Infinity;
      let minScore = Infinity;
      for (const { score } of scored) {
        if (score > maxScore) maxScore = score;
        if (score < minScore) minScore = score;
      }
      const scoreRange = maxScore - minScore || 1;

      // Confidence tiers: top 33% = high, next 33% = medium, rest = low
      for (const entry of scored) {
        if (entry.score <= 0) {
          entry.confidence = 'low';
        } else {
          const normalized = (entry.score - minScore) / scoreRange;
          entry.confidence = normalized > 0.66 ? 'high' : normalized > 0.33 ? 'medium' : 'low';
        }
      }
    }

    scored.sort((a, b) => b.score - a.score || a.file.localeCompare(b.file));

    // Zero-score suppression (#807). A rank is a claim of relevance, and 0.00 is
    // the absence of one — yet `slice(0, topK)` padded the table with whatever
    // sorted first among the files that matched nothing, so four
    // `.github/workflows/*.yml` scoring exactly zero were numbered 3-6 of a
    // routing query. When nothing scores, callers get an empty array and render
    // "no match" rather than filler.
    // `includeZeroScore` is for multi-stage callers that apply their OWN boost
    // after ranking and therefore need the full pool: a session note naming a
    // file is explicit user evidence, and `applyNoteBoost` is additive, so the
    // named file must still be present for the note to lift it into the
    // selection (#776). Those callers filter at their own selection boundary.
    const keepZero = !!(opts && opts.includeZeroScore);
    const ranked = keepZero ? scored : scored.filter((e) => e.score > 0);
    const out = ranked.slice(0, topK);

    // Explain surfaces (#813), attached as ARRAY PROPERTIES so the return value
    // stays a plain array for every existing caller and `JSON.stringify` output
    // is byte-identical unless a caller opts in.
    if (opts && opts.explain) {
      const nearMissCount = Number.isInteger(opts.nearMiss) && opts.nearMiss > 0 ? opts.nearMiss : 5;
      out.nearMiss = ranked.slice(topK, topK + nearMissCount);
      out.tokenCoverage = _tokenCoverage(sigIndex, queryTokens);
      out.pathIdf = pathIdf;
      out.totalCandidates = ranked.length;
      out.indexSize = sigIndex.size;
    }
    return out;
  }

  /**
   * All paths where sigmap adapters write their context files, in probe order.
   * The first existing file with a non-empty index wins when no explicit path
   * is supplied.
   */
  const ADAPTER_OUTPUT_PATHS = [
    ['.github', 'copilot-instructions.md'], // copilot (default)
    ['CLAUDE.md'],                           // claude
    ['AGENTS.md'],                           // codex
    ['.cursorrules'],                        // cursor
    ['.windsurfrules'],                      // windsurf
    ['.github', 'openai-context.md'],        // openai
    ['.github', 'gemini-context.md'],        // gemini
    ['llm-full.txt'],                        // llm-full
    ['llm.txt'],                             // llm
  ];

  /**
   * Parse a single context file into a Map<filePath, string[]>.
   *
   * Files that contain human-written content before an
   * "## Auto-generated signatures" marker (e.g. CLAUDE.md) are handled
   * by skipping everything above the marker before scanning for ### headers.
   *
   * @param {string} contextPath  - absolute path to the context file
   * @returns {Map<string, string[]>}
   */
  function _parseContextFile(contextPath) {
    const fs = require('fs');
    const index = new Map();

    if (!fs.existsSync(contextPath)) return index;

    let content = fs.readFileSync(contextPath, 'utf8');

    // Skip any human-written preamble that sits above the auto-generated block.
    const section = __require('./src/util/managed-section').findManagedSection(content);
    if (section) content = content.slice(section.index);

    const lines = content.split('\n');
    let currentFile = null;
    let inBlock = false;
    let sigs = [];

    for (const line of lines) {
      const headerMatch = line.match(/^###\s+(\S+)\s*$/);
      if (headerMatch) {
        if (currentFile !== null) index.set(currentFile, sigs);
        currentFile = headerMatch[1];
        sigs = [];
        inBlock = false;
        continue;
      }
      if (line.startsWith('```')) { inBlock = !inBlock; continue; }
      if (inBlock && currentFile && line.trim()) sigs.push(line.trim());
    }
    if (currentFile !== null) index.set(currentFile, sigs);

    return index;
  }

  /** Merge source index into target; prefer non-empty sig lists. */
  function _mergeSigIndex(target, source) {
    for (const [file, sigs] of source.entries()) {
      if (!sigs || sigs.length === 0) continue;
      if (!target.has(file) || target.get(file).length < sigs.length) {
        target.set(file, sigs);
      }
    }
    return target;
  }

  /**
   * Load signatures from .sigmap-cache.json (absolute paths → repo-relative keys).
   * @param {string} cwd
   * @returns {Map<string, string[]>}
   */
  function _buildSigIndexFromCache(cwd) {
    const fs = require('fs');
    const path = require('path');
    const index = new Map();
    try {
      const { loadCache } = __require('./src/cache/sig-cache');
      const pkgPath = path.join(cwd, 'package.json');
      let version = '0.0.0';
      if (fs.existsSync(pkgPath)) {
        version = JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version || version;
      }
      const cache = loadCache(cwd, version);
      // The cache holds the raw extraction, up to what the index keeps (#982); this fallback is
      // merged under the rule "the entry with more signatures wins", so it is cut to what the
      // index file's entries hold, or a raw, unredacted list would outrank a redacted one.
      let limit = 25;
      try { limit = __require('./src/cache/entry').entryConfig(cwd).maxSigsPerFile; } catch (_) { /* default */ }
      for (const [absPath, entry] of cache.entries()) {
        if (!entry || !entry.sigs || entry.sigs.length === 0) continue;
        const rel = path.relative(cwd, absPath).replace(/\\/g, '/');
        if (!rel || rel.startsWith('..')) continue;
        index.set(rel, entry.sigs.length > limit ? entry.sigs.slice(0, limit) : entry.sigs);
      }
    } catch (_) {}
    return index;
  }

  /**
   * Hot-cold and per-module strategies store most signatures outside the primary
   * copilot-instructions.md file. MCP tools must merge all sources.
   * @param {string} cwd
   * @returns {Map<string, string[]>}
   */
  function _enrichSigIndexFromStrategy(cwd, index, opts) {
    const fs = require('fs');
    const path = require('path');
    // Merge every strategy split file: context-cold.md (hot-cold) AND each
    // per-module context-<module>.md — the per-module strategy stores ALL
    // signatures in these, leaving the primary file as a thin overview, so
    // skipping them made ask/query_context see an empty index (#534).
    // Sorted for deterministic merge order.
    try {
      const ghDir = path.join(cwd, '.github');
      const splits = fs.readdirSync(ghDir)
        .filter((f) => /^context-[\w.-]+\.md$/.test(f))
        .sort();
      for (const f of splits) {
        _mergeSigIndex(index, _parseContextFile(path.join(ghDir, f)));
      }
    } catch (_) {}
    // The extraction cache is a fallback for a repo with no complete retrieval index. With one
    // it adds nothing, and a raw entry (unredacted, from a run under other settings) must not
    // outrank the index's own (#982).
    let full = null;
    try { full = __require('./src/retrieval/sig-index-store').readFullIndexMeta(cwd); } catch (_) { /* absent */ }
    if (!full || full.index.size === 0) _mergeSigIndex(index, _buildSigIndexFromCache(cwd));

    // The complete retrieval index (written by generate before applyTokenBudget)
    // takes precedence: it is the only source containing files the budget dropped,
    // and full signatures for files the budget collapsed to line anchors. It is
    // merged as the BASE rather than on top because _mergeSigIndex only replaces
    // when the source has MORE signatures — a collapsed entry has the same count
    // as its full form, so merging the other way would keep the anchors.
    let merged = index;
    let baseMs = null;
    // The signatures past what the ranker reads (#982), tracked only for a caller that asks.
    const wantMore = !!(opts && opts.full);
    let more = null;
    try {
      if (full && full.index.size > 0) {
        const base = wantMore ? new Map(full.index) : null;
        merged = _mergeSigIndex(full.index, index);
        baseMs = full.baseMs;
        if (wantMore) {
          more = new Map(full.more);
          // an entry the merge replaced is no longer the one these belong to
          for (const rel of [...more.keys()]) if (merged.get(rel) !== base.get(rel)) more.delete(rel);
        }
      }
    } catch (_) { /* absent → budgeted view is still served */ }

    const live = _applyLiveOverlay(cwd, merged, baseMs, more);
    if (!more || more.size === 0) return live;
    const out = new Map();
    for (const [rel, sigs] of live) out.set(rel, more.has(rel) ? sigs.concat(more.get(rel)) : sigs);
    return out;
  }

  /**
   * Put the live overlay (cache/overlay.js) over a merged index. Unlike the merge
   * above it REPLACES: an entry newer than the base index is the file's current
   * truth, whatever its signature count — which is what lets a rename, a removed
   * symbol or a deleted file show up before the next full run.
   *
   * "Base" is when the index began, or — with no retrieval index — when the newest
   * generated context file was written, so a freshly generated repo is never
   * overlaid with entries its own generation already saw.
   */
  function _applyLiveOverlay(cwd, index, baseMs, more) {
    try {
      const overlay = __require('./src/cache/overlay');
      const entries = overlay.load(cwd);
      if (entries.size === 0) return index;
      let since = baseMs;
      if (!Number.isFinite(since)) {
        const fs = require('fs');
        const path = require('path');
        since = 0;
        for (const parts of ADAPTER_OUTPUT_PATHS) {
          try { since = Math.max(since, fs.statSync(path.join(cwd, ...parts)).mtimeMs); } catch (_) {}
        }
      }
      overlay.apply(index, entries, since, more);
    } catch (_) { /* the overlay is an accelerator; the base index stands without it */ }
    return index;
  }

  /**
   * Build a signature index from the generated context file.
   * Returns Map<filePath, string[]> where filePath is the relative path
   * as it appears in the ### headers of the context file.
   *
   * Resolution priority:
   *  1. `opts.contextPath` — explicit path from --output or --adapter flag
   *  2. `customOutput` key in gen-context.config.json — persisted from a
   *     previous `--output <file>` generation run
   *  3. All known adapter output paths probed in order (first non-empty wins)
   *
   * `opts.full` returns every signature the index keeps (#982), the ones past what the ranker
   * reads included. Use it to look a symbol up (`verify`, `get_callee_signatures`); ranking and
   * the tools that list a file's signatures read the default, which is what they always read.
   *
   * @param {string} cwd
   * @param {{ contextPath?: string, full?: boolean }} [opts]
   * @returns {Map<string, string[]>}
   */
  function buildSigIndex(cwd, opts) {
    const fs   = require('fs');
    const path = require('path');

    // 1. Caller supplied an explicit path — use it directly.
    if (opts && opts.contextPath) {
      const index = _parseContextFile(opts.contextPath);
      return _enrichSigIndexFromStrategy(cwd, index, opts);
    }

    // 2. Check gen-context.config.json for a persisted customOutput path.
    try {
      const cfgPath = path.join(cwd, 'gen-context.config.json');
      if (fs.existsSync(cfgPath)) {
        const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
        if (cfg.customOutput) {
          const customPath = path.resolve(cwd, cfg.customOutput);
          const index = _parseContextFile(customPath);
          if (index.size > 0) return _enrichSigIndexFromStrategy(cwd, index, opts);
        }
      }
    } catch (_) {}

    // 3. Probe all known adapter output paths; return first non-empty index.
    for (const parts of ADAPTER_OUTPUT_PATHS) {
      const contextPath = path.join(cwd, ...parts);
      const index = _parseContextFile(contextPath);
      if (index.size > 0) return _enrichSigIndexFromStrategy(cwd, index, opts);
    }

    // 4. Primary file empty/missing (hot-cold) — still serve cold + cache.
    const fallback = new Map();
    return _enrichSigIndexFromStrategy(cwd, fallback, opts);
  }

  /**
   * Format ranked results as a markdown table string.
   *
   * @param {{ file: string, score: number, sigs: string[], tokens: number, intent: string, signals: object }[]} results
   * @param {string} query
   * @returns {string}
   */
  function formatRankTable(results, query) {
    if (!results || results.length === 0) {
      return `No matching files found for query: "${query}"\n`;
    }

    const intent = (results[0] && results[0].intent) || 'search';
    const lines = [
      `## Query: ${query}`,
      `Intent: ${intent}`,
      '',
      '| Rank | File | Score | Sigs | Penalty |',
      '|------|------|-------|------|---------|',
      ...results.map((r, i) => {
        const penalty = r.signals && r.signals.penalty ? r.signals.penalty.toFixed(2) : '1.00';
        return `| ${i + 1} | ${r.file} | ${r.score.toFixed(2)} | ${r.sigs.length} | ${penalty} |`;
      }),
      '',
    ];

    // Add signature details for top results
    for (const r of results.slice(0, 3)) {
      if (r.sigs.length > 0) {
        lines.push(`### ${r.file}`);
        if (r.signals) {
          const sig = r.signals;
          lines.push(`Signals: exactToken=${(sig.exactToken || 0).toFixed(2)} symbolMatch=${(sig.symbolMatch || 0).toFixed(2)} prefixMatch=${(sig.prefixMatch || 0).toFixed(2)} pathMatch=${(sig.pathMatch || 0).toFixed(2)} penalty=${(sig.penalty || 1).toFixed(2)}`);
        }
        lines.push('```');
        lines.push(...r.sigs.slice(0, 10));
        if (r.sigs.length > 10) lines.push(`... (${r.sigs.length - 10} more)`);
        lines.push('```');
        lines.push('');
      }
    }

    return lines.join('\n');
  }

  /**
   * Format ranked results as a structured JSON-serialisable object.
   *
   * @param {{ file: string, score: number, sigs: string[], tokens: number, intent: string, signals: object }[]} results
   * @param {string} query
   * @returns {object}
   */
  function formatRankJSON(results, query) {
    const intent = (results && results[0] && results[0].intent) || 'search';
    return {
      query,
      intent,
      results: (results || []).map((r, i) => ({
        rank: i + 1,
        file: r.file,
        score: r.score,
        sigs: r.sigs,
        tokens: r.tokens,
        signals: r.signals || {},
      })),
      totalResults: (results || []).length,
    };
  }

  // ---------------------------------------------------------------------------
  // Intent detection — 7 intents
  // ---------------------------------------------------------------------------
  // Nouns carry an optional plural: `\btest\b` does not match "tests", so
  // "write unit tests for the ranker" matched NO intent at all and fell through
  // to the 'search' default.
  /**
   * Human-readable reason a file was demoted, or '' when it was not.
   * Derived from the same predicates that set the multiplier, so the explain
   * output can never disagree with the score it is explaining.
   */
  function _penaltyReason(filePath, penalty) {
    if (!(penalty < 1)) return '';
    if (String(filePath).toLowerCase().includes('node_modules')) return 'node_modules';
    if (isTestFile(filePath)) return 'test file';
    if (isMockFile(filePath)) return 'mock/fixture';
    if (isGeneratedDir(filePath)) return 'build output';
    if (isCiFile(filePath)) return 'CI definition';
    if (isDocsFile(filePath)) return 'documentation';
    return 'data holder (accessors only)';
  }

  /**
   * Render the `--explain` diagnostic view (#813).
   *
   * Three sections, in the order a miss is actually diagnosed:
   *   1. per-token corpus coverage — a token matching zero files is the answer
   *      to "why did my query miss" far more often than anything else;
   *   2. the selected files with every contributing signal and, when demoted,
   *      the reason;
   *   3. near-miss candidates that scored above zero but below the cutoff.
   *
   * Opt-in: `rank()` only attaches these surfaces under `opts.explain`, so
   * default output is untouched.
   *
   * @param {Array} results - the array returned by rank(query, index, { explain: true })
   * @param {string} query
   * @returns {string}
   */
  function formatExplainTable(results, query) {
    const lines = [`## Explain: ${query}`, ''];
    const coverage = (results && results.tokenCoverage) || [];
    const idf = (results && results.pathIdf) || new Map();

    if (coverage.length > 0) {
      const dead = coverage.filter((c) => c.sigFiles === 0 && c.pathFiles === 0);
      lines.push(`Index: ${results.indexSize || 0} files · ${results.totalCandidates || 0} scored above zero`);
      lines.push('');
      lines.push('| Query token | Files w/ token in sigs | in path | Path IDF |');
      lines.push('|-------------|------------------------|---------|----------|');
      for (const c of coverage) {
        const v = idf.has(c.token) ? idf.get(c.token).toFixed(2) : '1.00';
        lines.push(`| ${c.token} | ${c.sigFiles} | ${c.pathFiles} | ${v} |`);
      }
      lines.push('');
      if (dead.length > 0) {
        lines.push(`Matched nothing: ${dead.map((d) => d.token).join(', ')} — these tokens contributed no score.`);
        lines.push('');
      }
    }

    if (!results || results.length === 0) {
      lines.push('No file scored above zero for this query.');
      lines.push('');
      return lines.join('\n');
    }

    lines.push('### Selected');
    lines.push('');
    lines.push('| Rank | File | Score | exact | symbol | prefix | path | bm25 | graph | call | central | learned | penalty | demoted for |');
    lines.push('|------|------|-------|-------|--------|--------|------|------|-------|------|---------|---------|---------|-------------|');
    results.forEach((r, i) => {
      const g = r.signals || {};
      const n = (v, d) => (typeof v === 'number' ? v : (d === undefined ? 0 : d)).toFixed(2);
      lines.push(`| ${i + 1} | ${r.file} | ${r.score.toFixed(2)} | ${n(g.exactToken)} | ${n(g.symbolMatch)} | ${n(g.prefixMatch)} | ${n(g.pathMatch)} | ${n(g.bm25)} | ${n(g.graphBoost)} | ${n(g.callGraphBoost)} | ${n(g.centrality)} | ${n(g.learnedWeights, 1)} | ${n(g.penalty, 1)} | ${_penaltyReason(r.file, g.penalty === undefined ? 1 : g.penalty) || '—'} |`);
    });
    lines.push('');

    const nearMiss = (results && results.nearMiss) || [];
    if (nearMiss.length > 0) {
      const cutoff = results[results.length - 1].score;
      lines.push(`### Near misses (below the cutoff of ${cutoff.toFixed(2)})`);
      lines.push('');
      lines.push('| File | Score | penalty | demoted for |');
      lines.push('|------|-------|---------|-------------|');
      for (const r of nearMiss) {
        const pen = r.signals && r.signals.penalty !== undefined ? r.signals.penalty : 1;
        lines.push(`| ${r.file} | ${r.score.toFixed(2)} | ${pen.toFixed(2)} | ${_penaltyReason(r.file, pen) || '—'} |`);
      }
      lines.push('');
    }

    return lines.join('\n');
  }

  const INTENT_PATTERNS = {
    debug:    /\b(bugs?|fix(es|ed)?|errors?|crash(es)?|exceptions?|broken|failing|failures?|issues?|problems?|regressions?)\b/i,
    explain:  /\b(explain|how does|what is|understand|overview|architecture|describe|walk me|teach)\b/i,
    refactor: /\b(refactor|restructure|redesign|clean up|extract|move|rename|simplify|optimi[sz]e)\b/i,
    review:   /\b(review|check|audit|security|pr|pull request|assess|validate)\b/i,
    test:     /\b(tests?|unit tests?|integration tests?|testing|specs?|assert(ion)?s?|mocks?|fixtures?)\b/i,
    integrate:/\b(imports?|integrate|connect|wire|bind|requires?|exports?|depends?|dependenc(y|ies)|graph)\b/i,
    navigate: /\b(find|locate|where|search|look for|show me|navigate|browse|list)\b/i,
  };

  /**
   * Every intent whose pattern matches, strongest first.
   *
   * A real request is routinely multi-intent — "fix the failing test" is both a
   * debug task and a test task — and reporting one label discards that. Worse,
   * the single-label version returned the FIRST key in INTENT_PATTERNS order, so
   * `debug` permanently shadowed `test`: no query containing "fix" or "failing"
   * could ever be labelled a test, no matter how test-shaped it was.
   *
   * Ranked by how many distinct terms each pattern matched, so the dominant
   * intent leads; ties fall back to declaration order for determinism.
   *
   * @param {string} query
   * @returns {string[]} matched intents, never empty (defaults to ['search'])
   */
  function detectIntents(query) {
    if (!query || typeof query !== 'string') return ['search'];
    const scored = [];
    let order = 0;
    for (const [intent, re] of Object.entries(INTENT_PATTERNS)) {
      const hits = query.match(new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g'));
      if (hits && hits.length) {
        scored.push({ intent, hits: new Set(hits.map((h) => h.toLowerCase())).size, order: order });
      }
      order++;
    }
    if (scored.length === 0) return ['search'];
    scored.sort((a, b) => (b.hits - a.hits) || (a.order - b.order));
    return scored.map((s) => s.intent);
  }

  /** Primary intent. Kept for callers that want a single label. */
  function detectIntent(query) {
    return detectIntents(query)[0];
  }

  module.exports = { rank, buildSigIndex, scoreFile, _queryWants, _isDataHolder, detectIntents, formatRankTable, formatRankJSON, formatExplainTable, DEFAULT_WEIGHTS, GRAPH_BOOST_AMOUNTS, CENTRALITY_BLEND_WEIGHT, detectIntent };
  
};

// ── ./src/retrieval/selection-quality ──
__factories["./src/retrieval/selection-quality"] = function(module, exports) {
  
  /**
   * Honesty checks on an `ask` selection (#806).
   *
   * `ask` printed `Coverage : 100%` and `Risk : NONE` over a result set holding a
   * test file, a README and a CI workflow. Neither reading was a lie on its own —
   * the coverage figure counts "of the source files under srcDirs, how many are
   * indexed", and the risk figure counts changed files in the working tree — but
   * printed bare, side by side, directly under the answer, they read as "this
   * answer is trustworthy". Same class as #762 (unlabelled coverage) and #764
   * (unmeasured rendered as measured).
   *
   * This module owns the one question those two numbers never asked: did the
   * selection actually contain any implementation? A query that returns only
   * tests, docs, CI and config has missed, and that is a signal the user can act
   * on — unlike a coverage percentage about a different population entirely.
   *
   * Zero dependencies, pure, deterministic.
   */

  const path = require('path');
  const { isTestFile, isMockFile, isGeneratedFile, isDocsFile, isCiFile } = __require('./src/util/file-class');
  const { CODE_EXTS } = __require('./src/analysis/coverage-score');

  /**
   * Configuration and data files, by extension or by the `*.config.*` convention.
   * Deliberately narrower than `src/util/file-class.js`'s categories: those cover
   * the classes the ranker demotes, and config is not one of them — it is indexed
   * at full weight because "where is the build configured" is a real question.
   */
  const CONFIG_EXTS = new Set(['.json', '.yml', '.yaml', '.toml', '.ini', '.cfg', '.properties', '.lock', '.env']);

  /** True when a selected path is configuration rather than implementation. */
  function isConfigPath(filePath) {
    const p = String(filePath).replace(/\\/g, '/');
    const base = p.slice(p.lastIndexOf('/') + 1);
    if (/\.config\.[a-z]+$/i.test(base)) return true;
    return CONFIG_EXTS.has(path.extname(base).toLowerCase());
  }

  /** Prose that is not under a docs/ root and carries no well-known doc name. */
  function isProsePath(filePath) {
    return /\.(md|mdx|rst|txt|adoc)$/i.test(String(filePath));
  }

  /**
   * Split a selection into the implementation files an answer can be grounded in
   * and the support files it cannot.
   *
   * "Support" is not a complaint — a CI workflow is the right answer to a CI
   * question. It becomes a signal only when it is ALL that came back.
   *
   * @param {Array<{file:string}>|string[]} selected
   * @returns {{ source: string[], support: string[], sourceFree: boolean, total: number }}
   */
  function classifySelection(selected) {
    const files = (selected || []).map((r) => (typeof r === 'string' ? r : r && r.file)).filter(Boolean);
    const source = [];
    const support = [];
    for (const f of files) {
      const isSupport =
        isTestFile(f) || isMockFile(f) || isGeneratedFile(f) ||
        isDocsFile(f) || isCiFile(f) || isConfigPath(f) || isProsePath(f);
      const isCode = CODE_EXTS.has(path.extname(String(f)).toLowerCase());
      if (isCode && !isSupport) source.push(f);
      else support.push(f);
    }
    return { source, support, sourceFree: files.length > 0 && source.length === 0, total: files.length };
  }

  /**
   * The composition of a selection, named — `3 source, 2 support (test, docs)`.
   * Printed next to the figures it qualifies so a reader can see at a glance what
   * the answer is standing on.
   */
  function formatComposition(classification) {
    const c = classification;
    if (!c || c.total === 0) return 'no files selected';
    const kinds = [];
    for (const f of c.support) {
      const kind = isTestFile(f) || isMockFile(f) ? 'test'
        : isCiFile(f) ? 'ci'
        : isDocsFile(f) || isProsePath(f) ? 'docs'
        : isGeneratedFile(f) ? 'generated'
        : 'config';
      if (!kinds.includes(kind)) kinds.push(kind);
    }
    const support = c.support.length > 0 ? `, ${c.support.length} support (${kinds.join(', ')})` : '';
    return `${c.source.length} source${support}`;
  }

  /**
   * Warning for a selection with no implementation in it, or null when at least
   * one source file came back.
   */
  function selectionWarning(classification) {
    const c = classification;
    if (!c || !c.sourceFree) return null;
    return `no source file in the selection — ${formatComposition(c)}; the query likely missed. `
      + `Re-run with --explain to see which tokens matched, or raise --top`;
  }

  module.exports = { classifySelection, selectionWarning, formatComposition, isConfigPath, CONFIG_EXTS };
  
};

// ── ./src/retrieval/sig-index-store ──
__factories["./src/retrieval/sig-index-store"] = function(module, exports) {
  
  /**
   * Complete, unbudgeted signature index for retrieval.
   *
   * WHY THIS EXISTS
   * ---------------
   * The generated context file (CLAUDE.md / AGENTS.md / copilot-instructions.md)
   * is a BUDGETED VIEW: `applyTokenBudget` drops and collapses files so the
   * artifact stays under `maxTokens`, because it is injected into every prompt.
   *
   * `buildSigIndex` used to parse that same artifact to build the ranker's index,
   * so retrieval inherited the prompt budget. Every file the budget dropped became
   * permanently unreachable by `sigmap ask` — no ranking change can surface a file
   * that is not in the index. On this repo that was 53 of 155 source files (34%),
   * and restoring them moved hit@5 from 50% to 90% on the retrieval corpus.
   *
   * The two artifacts have opposite requirements — the prompt file wants to be
   * small, the index wants to be complete — so they are now separate. This store
   * is written by `generate` BEFORE the budget is applied, and lives under
   * `.context/` (gitignored, never injected into a prompt).
   *
   * Zero-dependency, bundle-safe (fs + path only).
   */

  const fs = require('fs');
  const path = require('path');

  const INDEX_DIR = '.context';
  const INDEX_FILE = 'sig-index.json';
  const SCHEMA = 1;

  /** Absolute path to the retrieval index artifact. */
  function indexPath(cwd) {
    return path.join(cwd, INDEX_DIR, INDEX_FILE);
  }

  /**
   * Persist the complete signature index.
   *
   * @param {string} cwd
   * @param {Array<{filePath: string, sigs: string[]}>} fileEntries - every
   *        extracted entry, BEFORE applyTokenBudget has dropped or collapsed any.
   * @param {{ version?: string }} [opts]
   * @returns {{ path: string, files: number }}
   */
  function writeFullIndex(cwd, fileEntries, opts = {}) {
    const files = {};
    const more = {};
    let count = 0;
    for (const e of fileEntries || []) {
      if (!e || !e.filePath || !Array.isArray(e.sigs) || e.sigs.length === 0) continue;
      const rel = path.relative(cwd, e.filePath).replace(/\\/g, '/');
      if (!rel || rel.startsWith('..')) continue;
      files[rel] = e.sigs;
      // The signatures of a file past what the ranker reads (#982): kept for the tools that
      // look a symbol up, in a field of their own so `files` stays exactly what it was.
      if (Array.isArray(e.more) && e.more.length > 0) more[rel] = e.more;
      count++;
    }

    const out = indexPath(cwd);
    fs.mkdirSync(path.dirname(out), { recursive: true });
    // Write-then-rename so a concurrent `ask` never observes a half-written index.
    const tmp = `${out}.tmp`;
    fs.writeFileSync(tmp, JSON.stringify({
      schema: SCHEMA,
      sigmapVersion: opts.version || null,
      generated: new Date().toISOString(),
      // When the run began reading files (`generated` is when it finished). The
      // live overlay (cache/overlay.js) is measured against THIS: an overlay entry
      // older than it describes a change the run has already seen.
      startedAt: Number.isFinite(opts.startedAt) ? opts.startedAt : null,
      files,
      ...(Object.keys(more).length > 0 ? { more } : {}),
    }), 'utf8');
    fs.renameSync(tmp, out);
    return { path: out, files: count };
  }

  /**
   * Load the complete signature index, or an empty Map when absent/unreadable.
   *
   * Deliberately NOT version-busted (unlike .sigmap-cache.json): a stale but
   * complete index still retrieves the right files, whereas discarding it drops
   * retrieval back to the budgeted view — the exact failure this store exists to
   * prevent. Staleness is handled by re-running generate or by cache/freshen.
   *
   * @param {string} cwd
   * @returns {Map<string, string[]>}
   */
  function readFullIndex(cwd) {
    return readFullIndexMeta(cwd).index;
  }

  /**
   * The index together with the instant its run began, from a single parse.
   *
   * `baseMs` is `startedAt` when the index carries it, else the `generated`
   * stamp of an index written before `startedAt` existed (a few seconds late, so
   * an overlay entry made during that run is conservatively treated as superseded),
   * else null.
   *
   * `more` holds, for a file the index cut at what the ranker reads, the signatures after
   * that point (#982). `index` alone is what the ranker, `ask` and the listing tools read.
   *
   * @param {string} cwd
   * @returns {{ index: Map<string, string[]>, baseMs: number|null, more: Map<string, string[]> }}
   */
  function readFullIndexMeta(cwd) {
    const index = new Map();
    const more = new Map();
    let baseMs = null;
    try {
      const data = JSON.parse(fs.readFileSync(indexPath(cwd), 'utf8'));
      if (!data || data.schema !== SCHEMA || !data.files) return { index, baseMs, more };
      for (const [rel, sigs] of Object.entries(data.files)) {
        if (Array.isArray(sigs) && sigs.length > 0) index.set(rel, sigs);
      }
      if (data.more && typeof data.more === 'object') {
        for (const [rel, sigs] of Object.entries(data.more)) {
          if (Array.isArray(sigs) && sigs.length > 0 && index.has(rel)) more.set(rel, sigs);
        }
      }
      if (Number.isFinite(data.startedAt)) baseMs = data.startedAt;
      else if (data.generated && Number.isFinite(Date.parse(data.generated))) baseMs = Date.parse(data.generated);
    } catch (_) { /* absent or corrupt → caller falls back to the context file */ }
    return { index, baseMs, more };
  }

  /**
   * When the index's run began, without parsing the index.
   *
   * `writeFullIndex` emits `generated` and `startedAt` BEFORE `files`, so both sit
   * in the first few hundred bytes. Callers that run on every command (the `ask`
   * staleness check, `status`) read only that head instead of the whole artifact.
   * An index that does not carry the stamp in its head falls back to a full parse.
   *
   * @param {string} cwd
   * @returns {number|null}
   */
  function readIndexStamp(cwd) {
    let fd = null;
    try {
      fd = fs.openSync(indexPath(cwd), 'r');
      const buf = Buffer.alloc(512);
      const n = fs.readSync(fd, buf, 0, buf.length, 0);
      const head = buf.toString('utf8', 0, n);
      // An index the reader would not accept (another schema) has no usable stamp.
      const schema = /"schema":(\d+)/.exec(head);
      if (schema && Number(schema[1]) !== SCHEMA) return null;
      const started = /"startedAt":(\d+)/.exec(head);
      if (started) return Number(started[1]);
      const gen = /"generated":"([^"]+)"/.exec(head);
      if (gen && Number.isFinite(Date.parse(gen[1]))) return Date.parse(gen[1]);
    } catch (_) {
      return null; // absent
    } finally {
      if (fd !== null) { try { fs.closeSync(fd); } catch (_) {} }
    }
    return readFullIndexMeta(cwd).baseMs;
  }

  module.exports = { writeFullIndex, readFullIndex, readFullIndexMeta, readIndexStamp, indexPath, SCHEMA, INDEX_FILE };
  
};

// ── ./src/retrieval/tokenizer ──
__factories["./src/retrieval/tokenizer"] = function(module, exports) {
  
  /**
   * SigMap zero-dependency tokenizer.
   * Splits code identifiers: camelCase, snake_case, kebab-case, PascalCase,
   * removes stop words, and returns lower-case tokens.
   */

  const STOP_WORDS = new Set([
    'the', 'a', 'an', 'in', 'of', 'to', 'for', 'and', 'or', 'is', 'are',
    'that', 'this', 'it', 'with', 'from', 'by', 'be', 'as', 'on', 'at',
    'do', 'not', 'use', 'get', 'set', 'up', 'if', 'no', 'so', 'we',
  ]);

  /**
   * Tokenize any text (query or code signature) into unique lower-case tokens.
   * Handles:
   *   - camelCase  → ['camel', 'case']
   *   - PascalCase → ['pascal', 'case']
   *   - snake_case → ['snake', 'case']
   *   - kebab-case → ['kebab', 'case']
   *   - dot.notation → ['dot', 'notation']
   *   - File paths  → individual path components (no extension)
   *
   * @param {string} text
   * @param {object} [opts]
   * @param {boolean} [opts.removeStopWords=true]
   * @param {number}  [opts.minLength=2]
   * @returns {string[]}
   */
  function tokenize(text, opts) {
    if (!text || typeof text !== 'string') return [];
    const removeStop = opts && opts.removeStopWords === false ? false : true;
    const minLen = (opts && opts.minLength) || 2;

    const tokens = text
      // strip file extension (e.g. .js, .ts, .py)
      .replace(/\.\w{1,6}(?=\s|\/|$)/g, ' ')
      // camelCase / PascalCase split
      .replace(/([a-z])([A-Z])/g, '$1 $2')
      .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
      // snake_case / kebab-case / dot.notation
      .replace(/[_\-\.\/]/g, ' ')
      // drop remaining non-word characters
      .replace(/[^\w\s]/g, ' ')
      .toLowerCase()
      .split(/\s+/)
      .filter((t) => t.length >= minLen);

    if (!removeStop) return [...new Set(tokens)];
    return [...new Set(tokens.filter((t) => !STOP_WORDS.has(t)))];
  }

  module.exports = { tokenize, STOP_WORDS };
  
};

// ── ./src/retrieval/with-source ──
__factories["./src/retrieval/with-source"] = function(module, exports) {
  
  /**
   * `ask --with-source` — give back the bodies, not the files (#814).
   *
   * The map saves tokens by emitting signatures. An agent that then needs the
   * body opens the whole file, which is the exact cost the map exists to avoid:
   * the saving is real at the map level and partly handed back at the agent
   * level. The `:start-end` anchors every extractor already emits are enough to
   * close that loop — slice the top symbols' lines instead of the files holding
   * them, and add the blast radius so the agent sees what else a change there
   * touches without a second query.
   *
   * Strictly opt-in: anything that adds tokens must be asked for. Budgeted
   * against the project's single `maxTokens` knob rather than a second one, and
   * truncation is disclosed — a silently clipped body is worse than no body.
   *
   * Zero dependencies, deterministic (ordered by rank, never by filesystem).
   */

  const fs = require('fs');
  const path = require('path');

  /** Token estimate; same chars/4 heuristic as the CLI's `estimateTokens`. */
  const estimateTokens = (s) => Math.ceil(String(s).length / 4);

  /**
   * Declaration heads whose body is not worth a budget slot.
   *
   * A module's export list is already in the signature section verbatim, so
   * slicing its line back out spends budget to repeat what the agent has — and
   * it competes for the same per-file slots as the functions being exported.
   */
  const NON_BODY_HEAD = /^(module\.exports|export\s+(default\s+)?\{|exports\.)/;

  const DEFAULT_MAX_PER_FILE = 3;
  const DEFAULT_MAX_SYMBOLS = 12;
  const DEFAULT_BLAST_FILES = 5;
  /** A body longer than this is a module, not a symbol — pointer only. */
  const MAX_SYMBOL_LINES = 120;

  /**
   * Parse a signature's trailing `:start-end` line anchor.
   *
   * @param {string} sig
   * @returns {{ head: string, start: number, end: number }|null} null when the
   *   signature carries no anchor (an indented member, or a non-code section).
   */
  function parseAnchor(sig) {
    if (typeof sig !== 'string') return null;
    const m = sig.match(/\s*:(\d+)-(\d+)(?:\s*#.*)?\s*$/);
    if (!m) return null;
    const start = parseInt(m[1], 10);
    const end = parseInt(m[2], 10);
    if (!Number.isFinite(start) || !Number.isFinite(end) || end < start) return null;
    return { head: sig.slice(0, m.index).trim(), start, end };
  }

  /**
   * The anchored symbols worth slicing, in rank order.
   *
   * Breadth before depth: up to `maxPerFile` symbols from each file, files walked
   * in rank order. One file's long member list cannot eat the whole budget, which
   * is what a flat "top N anchors" ordering would do.
   *
   * @param {Array<{file:string, sigs:string[]}>} ranked
   * @param {{ maxPerFile?:number, maxSymbols?:number }} [opts]
   * @returns {Array<{ file:string, head:string, start:number, end:number }>}
   */
  function collectSymbols(ranked, opts = {}) {
    const maxPerFile = opts.maxPerFile || DEFAULT_MAX_PER_FILE;
    const maxSymbols = opts.maxSymbols || DEFAULT_MAX_SYMBOLS;
    const out = [];
    for (const entry of ranked || []) {
      if (!entry || !Array.isArray(entry.sigs)) continue;
      let taken = 0;
      for (const sig of entry.sigs) {
        if (taken >= maxPerFile) break;
        const a = parseAnchor(sig);
        if (!a) continue;
        if (NON_BODY_HEAD.test(a.head)) continue;
        if (a.end - a.start + 1 > MAX_SYMBOL_LINES) continue;
        out.push({ file: entry.file, head: a.head, start: a.start, end: a.end });
        taken++;
      }
      if (out.length >= maxSymbols) break;
    }
    return out.slice(0, maxSymbols);
  }

  /**
   * Read one symbol's lines, clamped to the file and secret-scanned with the same
   * redactor `get_lines` and the signature pipeline use.
   *
   * @returns {{ lines:string[], from:number, to:number }|null} null when the file
   *   is unreadable or the anchor points past its end.
   */
  function sliceSymbol(cwd, sym) {
    const abs = path.resolve(cwd, sym.file);
    const root = path.resolve(cwd);
    // Sandbox, matching `get_lines`: a ranked path is repo-relative by
    // construction, but the index is a file on disk and may be hand-edited.
    if (abs !== root && !abs.startsWith(root + path.sep)) return null;
    let all;
    try { all = fs.readFileSync(abs, 'utf8').split('\n'); } catch (_) { return null; }
    const from = Math.max(1, sym.start);
    const to = Math.min(all.length, sym.end);
    if (from > all.length) return null;
    let lines = all.slice(from - 1, to);
    try {
      const { scan } = __require('./src/security/scanner');
      lines = scan(lines, sym.file).safe;
    } catch (_) {} // non-fatal: a missing scanner must not drop the body
    return { lines, from, to };
  }

  /**
   * Blast radius for the files a source section covers — what else imports them.
   *
   * Reuses the same reverse-dependency walk as `--impact`, so `ask --with-source`
   * and `sigmap --impact <file>` cannot disagree about who depends on what.
   *
   * @returns {Array<{ file:string, direct:number, total:number }>}
   */
  function blastRadius(cwd, files, opts = {}) {
    const limit = opts.limit || DEFAULT_BLAST_FILES;
    const targets = [...new Set(files || [])].slice(0, limit);
    if (targets.length === 0) return [];
    let rows;
    try {
      const { analyzeImpact } = __require('./src/graph/impact');
      rows = analyzeImpact(targets, cwd, { depth: 2, srcDirs: opts.srcDirs, exclude: opts.exclude });
    } catch (_) { return []; }
    return rows.map(({ file, impact }) => ({
      file,
      direct: (impact && impact.direct ? impact.direct.length : 0),
      total: (impact && typeof impact.totalImpact === 'number' ? impact.totalImpact : 0),
      // Present only when the import graph cannot read the file (#979).
      ...(impact && impact.graph ? { graph: impact.graph, language: impact.language } : {}),
    }));
  }

  /**
   * Render the `--with-source` addendum for a ranked selection.
   *
   * @param {Array<{file:string, sigs:string[]}>} ranked
   * @param {string} cwd
   * @param {object} [opts]
   * @param {number} [opts.budgetTokens=0] token ceiling for the bodies; 0 or less
   *   admits nothing and is reported as such rather than silently ignored.
   * @returns {{
   *   text: string, included: number, skipped: number, candidates: number,
   *   spentTokens: number, budgetTokens: number, truncated: boolean,
   *   blast: Array<{file:string, direct:number, total:number}>
   * }}
   */
  function buildSourceSection(ranked, cwd, opts = {}) {
    const budgetTokens = Number.isFinite(opts.budgetTokens) ? opts.budgetTokens : 0;
    const symbols = collectSymbols(ranked, opts);
    const blocks = [];
    const covered = [];
    let spent = 0;
    let included = 0;

    for (const sym of symbols) {
      const slice = sliceSymbol(cwd, sym);
      if (!slice) continue;
      const block = [
        `### ${sym.file}:${slice.from}-${slice.to}${sym.head ? `  — ${sym.head}` : ''}`,
        '```',
        ...slice.lines,
        '```',
        '',
      ].join('\n');
      const cost = estimateTokens(block);
      // Budget is a ceiling, not a target: a body that does not fit is skipped
      // whole. Half a function is not a cheaper answer, it is a wrong one.
      if (spent + cost > budgetTokens) continue;
      blocks.push(block);
      if (!covered.includes(sym.file)) covered.push(sym.file);
      spent += cost;
      included++;
    }

    const blast = blastRadius(cwd, covered, opts);

    const skipped = symbols.length - included;
    const lines = [];
    if (blocks.length > 0) {
      lines.push('## Source (top symbols)', '');
      lines.push(...blocks);
    }
    if (blast.length > 0) {
      lines.push('## Blast radius', '```');
      for (const b of blast) {
        lines.push(b.graph
          ? `${b.file}  ← not tracked: ${__require('./src/graph/language-support').shortNote(b.language)}`
          : `${b.file}  ← ${b.direct} direct, ${b.total} total dependent file(s)`);
      }
      lines.push('```', '');
    }
    if (skipped > 0) {
      // Disclosure, not a footnote: the agent must know the section is partial
      // before it concludes the listed symbols are all there are.
      lines.push(
        `> ${included} of ${symbols.length} top symbol(s) included — `
        + `${skipped} omitted to stay within the ${budgetTokens.toLocaleString()}-token source budget `
        + `(raise \`maxTokens\` or pass \`--source-budget <tokens>\`).`,
        ''
      );
    }

    return {
      text: lines.join('\n'),
      included,
      skipped,
      candidates: symbols.length,
      spentTokens: spent,
      budgetTokens,
      truncated: skipped > 0,
      blast,
    };
  }

  module.exports = {
    parseAnchor, collectSymbols, sliceSymbol, blastRadius, buildSourceSection,
    DEFAULT_MAX_PER_FILE, DEFAULT_MAX_SYMBOLS, DEFAULT_BLAST_FILES, MAX_SYMBOL_LINES, NON_BODY_HEAD,
  };
  
};

// ── ./src/review/pr-evidence ──
__factories["./src/review/pr-evidence"] = function(module, exports) {
  
  /**
   * PR Evidence Report (v9.0 G3).
   *
   * A single, branded, deterministic Markdown artifact for code review: for each
   * changed file it folds together the signature context, blast radius (direct /
   * transitive importers, impacted tests + routes), cross-language related tests,
   * a risk label, and the `review-pr` findings (scope drift, god-node edits,
   * missing tests, security-sensitive files). Posted as a PR comment, it answers
   * "what changed, what it touches, and what to test" — without an LLM.
   *
   * Built entirely from shipped zero-dep modules (reviewPr, map/knowledge-map,
   * graph/impact, evidence/pack, extractors/dispatch). Carries NO wall-clock
   * timestamp, so the report is byte-stable given a fixed tree — diff-friendly
   * as a comment.
   */

  const fs = require('fs');
  const path = require('path');
  const { reviewPr } = __require('./src/review/review-pr');

  /**
   * Build the structured PR evidence for a changed-file list.
   * @param {Array<{path:string,status?:string}>|string[]} changedFiles
   * @param {string} cwd
   * @param {object} [opts]
   * @param {number} [opts.depth=2]   blast-radius BFS depth
   * @param {string} [opts.scope]     label for the diff scope (e.g. "vs main")
   * @returns {{ scope:string, files:object[], review:object }}
   */
  function buildPrEvidence(changedFiles, cwd, opts = {}) {
    const all = (changedFiles || []).map((f) =>
      typeof f === 'string' ? { path: f, status: 'M' } : { path: f.path, status: f.status || 'M' });

    const review = reviewPr(all, cwd, opts);
    // SigMap's own generated outputs are not part of the change under review (#918).
    const files = review.ignored.length ? all.filter((f) => !review.ignored.includes(f.path)) : all;

    let riskLabelFor = () => 'source';
    let findRelatedTests = () => [];
    try { ({ riskLabelFor, findRelatedTests } = __require('./src/evidence/pack')); } catch (_) { /* defaults */ }
    const { extractFile, langFor } = __require('./src/extractors/dispatch');

    const depth = Number.isFinite(opts.depth) ? opts.depth : 2;
    const srcPaths = files.filter((f) => f.status !== 'D' && langFor(f.path)).map((f) => f.path);

    // Blast radius + related tests are views over the knowledge-map store
    // (#635): cached typed edges instead of rebuilding the signature index and
    // import graph per call. The legacy rebuild remains the fallback.
    let impactByFile = new Map();
    let storeTests = null;
    try {
      const km = __require('./src/map/knowledge-map');
      const map = km.loadOrBuild(cwd);
      storeTests = km.relatedTestsView(map, files.filter((f) => f.status !== 'D').map((f) => f.path));
      impactByFile = new Map(srcPaths.map((p) => [p, km.impactView(map, p, depth, cwd)]));
    } catch (_) {
      try {
        const { analyzeImpact } = __require('./src/graph/impact');
        impactByFile = new Map(analyzeImpact(srcPaths, cwd, { depth }).map((r) => [r.file, r.impact]));
      } catch (_) { /* graph optional */ }
    }

    let allFiles = null; // built lazily, only when the store missed a file
    const relatedFor = (p) => {
      if (storeTests && storeTests.has(p)) return storeTests.get(p);
      if (allFiles === null) {
        try { const { buildSigIndex } = __require('./src/retrieval/ranker'); allFiles = [...buildSigIndex(cwd).keys()]; } catch (_) { allFiles = []; }
      }
      return findRelatedTests(p, allFiles);
    };

    // GR2: method-level blast radius per changed file (reviewPr already computed
    // it when the call graph resolved — reuse, don't rebuild the graph).
    const methodBlastByFile = new Map(
      (review.methodBlast && review.methodBlast.files || []).map((m) => [m.file, m])
    );

    const fileReports = files.map((f) => {
      const deleted = f.status === 'D';
      let signatures = [];
      if (!deleted && langFor(f.path)) {
        try { signatures = extractFile(f.path, fs.readFileSync(path.resolve(cwd, f.path), 'utf8')); } catch (_) { /* unreadable */ }
      }
      const impact = impactByFile.get(f.path) || null;
      return {
        methodBlast: methodBlastByFile.get(f.path.replace(/\\/g, '/')) || null,
        path: f.path,
        status: f.status,
        riskLabel: riskLabelFor(f.path),
        signatures,
        blast: impact ? {
          total: impact.totalImpact,
          direct: impact.direct || [],
          transitive: (impact.transitive || []).length,
          tests: impact.tests || [],
          routes: impact.routes || [],
          // Present only when the import graph cannot read the file (#979).
          ...(impact.graph ? { graph: impact.graph, language: impact.language } : {}),
        } : null,
        relatedTests: deleted ? [] : relatedFor(f.path),
      };
    });

    return { scope: opts.scope || 'diff', files: fileReports, review };
  }

  const STATUS_LABEL = { M: 'modified', A: 'added', D: 'deleted', R: 'renamed', C: 'copied' };

  /** Render the branded, deterministic "PR Evidence Report" Markdown. */
  function formatPrEvidenceMarkdown(evidence, opts = {}) {
    const L = [];
    const s = evidence.review.summary;
    const maxSigs = Number.isFinite(opts.maxSignatures) ? opts.maxSignatures : 30;

    L.push('## 🔍 PR Evidence Report');
    L.push('');
    L.push(
      `**${s.filesChanged} file(s) changed** — ${s.sourceChanged} source, ${s.testsChanged} test · ` +
      (s.ok ? '✅ no review findings' : `⚠️ ${s.findings} finding(s)`) +
      ` · scope: ${evidence.scope}`
    );
    if (s.generatedIgnored) L.push('', `_${s.generatedIgnored} SigMap-generated output(s) in the diff are not reviewed._`);
    L.push('');

    if (!s.ok) {
      L.push('### Review findings');
      for (const f of evidence.review.findings) {
        if (f.type === 'missing-tests') L.push(`- ⚠️ **missing tests** — \`${f.file}\` changed with no matching test`);
        else if (f.type === 'security-file') L.push(`- ⚠️ **sensitive path touched** (path heuristic, not a content scan) — \`${f.file}\``);
        else if (f.type === 'secret-detected') L.push(`- 🔑 **secret detected** (${f.secret}) — \`${f.file}\``);
        else if (f.type === 'god-node') L.push(`- ⚠️ **god node** — \`${f.file}\` → ${f.count} dependents (high blast radius)`);
        else if (f.type === 'method-blast') L.push(`- ⚠️ **method blast radius ${f.tier}** — \`${f.file}\` → ${f.functions} function(s) transitively call into this change (score ${f.score}/100)`);
        else if (f.type === 'scope-drift') L.push(`- ⚠️ **scope drift** — ${f.count} top-level dirs touched (${f.dirs.join(', ')})`);
      }
      L.push('');
    }

    L.push('### Changed files');
    for (const f of evidence.files) {
      const st = STATUS_LABEL[f.status] || f.status;
      L.push(`#### \`${f.path}\`  _(${st} · risk: ${f.riskLabel})_`);
      if (f.status === 'D') { L.push('_deleted_', ''); continue; }

      if (f.blast && f.blast.graph) {
        L.push(`**Blast radius:** not tracked — ${__require('./src/graph/language-support').shortNote(f.blast.language)}`);
      } else if (f.blast) {
        L.push(
          `**Blast radius:** ${f.blast.total} file(s) impacted — ${f.blast.direct.length} direct, ${f.blast.transitive} transitive` +
          (f.blast.tests.length ? `, ${f.blast.tests.length} test(s)` : '') +
          (f.blast.routes.length ? `, ${f.blast.routes.length} route(s)` : '')
        );
        if (f.blast.tests.length) L.push(`Tests to run: ${f.blast.tests.slice(0, 8).map((t) => '`' + t + '`').join(', ')}`);
      } else {
        L.push('**Blast radius:** _(not in dependency graph — new or leaf file)_');
      }
      if (f.methodBlast && (f.methodBlast.directCallers + f.methodBlast.transitiveCallers) > 0) {
        const mb = f.methodBlast;
        const total = mb.directCallers + mb.transitiveCallers;
        L.push(
          `**Method blast radius:** ${total} function(s) impacted (score ${mb.score}/100, ${mb.tier}) — ` +
          mb.impactedFunctions.slice(0, 6).map((id) => '`' + id + '`').join(', ') +
          (total > 6 ? ` +${total - 6} more` : '')
        );
      }
      if (f.relatedTests.length) L.push(`Related tests: ${f.relatedTests.slice(0, 8).map((t) => '`' + t + '`').join(', ')}`);

      if (f.signatures.length) {
        L.push('```');
        for (const sig of f.signatures.slice(0, maxSigs)) L.push(sig);
        if (f.signatures.length > maxSigs) L.push(`… +${f.signatures.length - maxSigs} more`);
        L.push('```');
      }
      L.push('');
    }

    L.push('---');
    L.push('_Deterministic PR Evidence Report — generated by [SigMap](https://sigmap.io). No LLM; byte-stable given a fixed tree._');
    return L.join('\n');
  }

  module.exports = { buildPrEvidence, formatPrEvidenceMarkdown };
  
};

// ── ./src/review/review-pr ──
__factories["./src/review/review-pr"] = function(module, exports) {
  
  /**
   * review-pr (IMPL.md §6 step 4 — last guard stage of the `create` pipeline).
   *
   * Audits a diff for drift and side effects after a PR is opened: scope drift,
   * edits to high-fan-in "god-node" files, source changes without matching tests,
   * and changes to security-sensitive files. Pure (takes a changed-file list),
   * zero-dependency, bundle-safe; reuses the impact graph for blast radius.
   */

  const fs = require('fs');
  const path = require('path');
  const { analyzeImpact } = __require('./src/graph/impact');
  const { PATTERNS } = __require('./src/security/patterns');
  const { findManagedSection, isEntirelyGenerated } = __require('./src/util/managed-section');

  const SECURITY_PATTERNS = [
    /(^|\/)\.env(\.|$)/i,
    /(^|\/)(secrets?|credentials?)(\/|\.|$)/i,
    /(^|\/)auth(\/|\.|-)/i,
    /(^|\/)package(-lock)?\.json$/,
    /(^|\/)(yarn\.lock|pnpm-lock\.yaml)$/,
    /(^|\/)\.github\/workflows\//,
    /(^|\/)Dockerfile/i,
    /\.(pem|key|crt|p12)$/i,
  ];

  const SRC_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.go', '.rs', '.java', '.rb', '.php']);
  const GOD_NODE_THRESHOLD = 15; // transitive dependents → high-fan-in "god node"
  const SCOPE_DIR_THRESHOLD = 5; // distinct top-level dirs → scope drift

  function isTestFile(p) {
    return /\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.(py|go)$|(^|\/)(tests?|__tests__|spec)\//.test(p);
  }
  function isSource(p) {
    return SRC_EXTS.has(path.extname(p).toLowerCase()) && !isTestFile(p);
  }

  // SigMap's own outputs (#918). A repo that commits what `sigmap` generates puts
  // `.context/*` and the adapter files into every diff next to the real change, and
  // they are not part of it: they inflated "files changed", added two top-level
  // dirs to the scope-drift count (so 4 real dirs read as 6 > 5 and failed the
  // review), and `.context/gain.ndjson` read as `risk: source`.
  //
  // `.context/` is SigMap's private directory, so it is recognised by path alone.
  // The adapter files are only SigMap's when NOTHING human-written is in them:
  // CLAUDE.md / AGENTS.md / copilot-instructions.md carry the generated block under
  // a marker, below whatever the team wrote. A file with text above the marker is
  // a file someone edits, so it stays in the review.
  const OWN_DIR = /^\.context\//;
  const OWN_JSON = '.github/copilot-instructions.cache.json';
  // `llm.txt` is deliberately absent: it is a template the team fills in by hand.
  const OWN_CONTEXT_FILES = new Set([
    '.github/copilot-instructions.md', 'CLAUDE.md', 'AGENTS.md', '.cursorrules', '.windsurfrules',
    '.github/openai-context.md', '.github/gemini-context.md', 'llms.txt', 'llm-full.txt',
  ]);
  // First lines of the outputs SigMap overwrites whole, which managed-section.js
  // does not know: cursor / windsurf, openai, and the two text indexes
  // (`# SigMap Context Index`, `# <name> — SigMap Context`).
  const WHOLE_FILE_OPENERS = [
    /^# Code signatures — generated by SigMap\b/,
    /^You are a coding assistant with full knowledge of this codebase\./,
    /^# (?:.* — )?SigMap Context(?: Index)?\s*$/,
  ];
  // The two blocks SigMap itself writes ABOVE the managed marker: the claude
  // adapter's `## Bash allowlist` (packages/adapters/claude.js) and the skills
  // block `sigmap skills` injects (src/skills/skills.js). The adapter sweep in
  // review-pr.test.js fails if either stops matching.
  const SKILLS_BLOCK = /<!-- sigmap-skills:start -->[\s\S]*?<!-- sigmap-skills:end -->/g;
  const ALLOWLIST_BLOCK = /## Bash allowlist\s*\n\s*<!-- sigmap-bash-allowlist -->[\s\S]*?```json[\s\S]*?```[ \t]*\n?(?:\s*Add the `permissions\.allow`[^\n]*\n?)?/;

  /** Whether a generated file's text is SigMap's from the first line (nothing human above the marker). */
  function _entirelyGenerated(text) {
    if (isEntirelyGenerated(text)) return true;
    const first = text.replace(/^(?:[ \t]*\r?\n)+/, '').split('\n', 1)[0].replace(/\r$/, '');
    if (WHOLE_FILE_OPENERS.some((re) => re.test(first))) return true;
    const section = findManagedSection(text);
    if (!section) return false;
    return text.slice(0, section.index).replace(SKILLS_BLOCK, '').replace(ALLOWLIST_BLOCK, '').trim() === '';
  }

  /**
   * Whether a changed path is a file SigMap wrote and no one edits.
   * @param {string} rel repo-relative path
   * @param {(rel:string)=>string} read returns the file's text; may throw
   * @returns {boolean}
   */
  function isSigmapOutput(rel, read) {
    const p = String(rel).replace(/\\/g, '/');
    if (OWN_DIR.test(p) || p === OWN_JSON) return true;
    if (!OWN_CONTEXT_FILES.has(p)) return false;
    try {
      const text = read(p);
      return typeof text === 'string' && _entirelyGenerated(text);
    } catch (_) {
      return false; // deleted or unreadable: cannot show it is all generated, so it counts
    }
  }

  /**
   * Audit a changed-file list.
   * @param {Array<{path:string,status:string}>|string[]} changedFiles
   * @param {string} cwd
   * @param {object} [opts]
   * @param {number} [opts.godNodeThreshold=15]
   * @param {number} [opts.scopeThreshold=5]
   * @returns {{ findings: object[], blast: object[], methodBlast: object|null, ignored: string[], summary: object }}
   *   `ignored` lists the SigMap-generated outputs left out of the review (#918)
   */
  function reviewPr(changedFiles, cwd, opts = {}) {
    const godThreshold = opts.godNodeThreshold != null ? opts.godNodeThreshold : GOD_NODE_THRESHOLD;
    const scopeThreshold = opts.scopeThreshold != null ? opts.scopeThreshold : SCOPE_DIR_THRESHOLD;
    const readFile = opts.readFile || ((p) => fs.readFileSync(path.resolve(cwd, p), 'utf8'));
    const all = (changedFiles || []).map((f) => (typeof f === 'string' ? { path: f, status: 'M' } : f));
    const ignored = all.filter((f) => isSigmapOutput(f.path, readFile)).map((f) => f.path);
    const files = ignored.length ? all.filter((f) => !ignored.includes(f.path)) : all;

    const findings = [];
    const paths = files.map((f) => f.path);
    const live = files.filter((f) => f.status !== 'D');
    const srcChanged = live.filter((f) => isSource(f.path)).map((f) => f.path);
    const testChanged = paths.filter(isTestFile);

    // 1. Missing tests: a changed source file with no matching changed test file.
    for (const s of srcChanged) {
      const stem = path.basename(s).replace(/\.[^.]+$/, '');
      const covered = testChanged.some((t) => path.basename(t).includes(stem));
      if (!covered) findings.push({ type: 'missing-tests', file: s, severity: 'warn' });
    }

    // 2a. Sensitive-path heuristic — flags files whose PATH looks security-relevant
    // (.env, auth/, lockfiles, workflows, key material). This is a path heuristic,
    // NOT a content scan: it flags touching the path regardless of what changed,
    // and cannot see a secret hidden in an innocently-named file. `basis` records
    // that honestly so consumers don't mistake it for a content check.
    for (const f of live) {
      if (SECURITY_PATTERNS.some((re) => re.test(f.path))) {
        findings.push({ type: 'security-file', file: f.path, severity: 'warn', basis: 'path-heuristic' });
      }
    }

    // 2b. Real secret scan — read each changed file's CONTENT and match known
    // secret patterns. This is the actual security check (content, not filename):
    // it catches a hardcoded key in a file the path heuristic would never flag.
    for (const f of live) {
      let content;
      try { content = readFile(f.path); } catch (_) { continue; } // absent/unreadable → skip
      if (typeof content !== 'string' || content.length > 2_000_000) continue; // skip huge/binary
      for (const pat of PATTERNS) {
        if (pat.regex.test(content)) {
          findings.push({ type: 'secret-detected', file: f.path, secret: pat.name, severity: 'high', basis: 'content-scan' });
          break; // one hit is enough to flag the file
        }
      }
    }

    // 3. God-node edits (high blast radius).
    const blast = [];
    if (srcChanged.length) {
      let impacts = [];
      try { impacts = analyzeImpact(srcChanged, cwd, {}); } catch (_) { impacts = []; }
      for (const { file, impact } of impacts) {
        blast.push({ file, totalImpact: impact.totalImpact });
        if (impact.totalImpact > godThreshold) {
          findings.push({ type: 'god-node', file, count: impact.totalImpact, severity: 'warn' });
        }
      }
      blast.sort((a, b) => b.totalImpact - a.totalImpact);
    }

    // 3b. Method-level blast radius (GR2) — how many FUNCTIONS transitively call
    // into the change, scored deterministically. Graph optional, like 3.
    let methodBlast = null;
    if (srcChanged.length) {
      try {
        const { methodBlastRadius } = __require('./src/graph/blast-radius');
        const mb = methodBlastRadius(srcChanged, cwd, opts.methodBlastOpts || {});
        if (mb.available) {
          methodBlast = mb;
          for (const f of mb.files) {
            if (f.tier === 'high' || f.tier === 'critical') {
              findings.push({
                type: 'method-blast', file: f.file, severity: 'warn',
                functions: f.directCallers + f.transitiveCallers, score: f.score, tier: f.tier,
              });
            }
          }
        }
      } catch (_) { /* call graph optional */ }
    }

    // 4. Scope drift: distinct top-level directories touched.
    const dirs = [...new Set(paths.map((p) => (p.includes('/') ? p.split('/')[0] : '.')))];
    if (dirs.length > scopeThreshold) {
      findings.push({ type: 'scope-drift', dirs, count: dirs.length, threshold: scopeThreshold, severity: 'warn' });
    }

    const byType = findings.reduce((a, f) => { a[f.type] = (a[f.type] || 0) + 1; return a; }, {});
    return {
      findings,
      blast,
      methodBlast,
      ignored,
      summary: {
        filesChanged: files.length,
        generatedIgnored: ignored.length,
        sourceChanged: srcChanged.length,
        testsChanged: testChanged.length,
        findings: findings.length,
        byType,
        ok: findings.length === 0,
      },
    };
  }

  module.exports = { reviewPr, isSigmapOutput, SECURITY_PATTERNS, GOD_NODE_THRESHOLD, SCOPE_DIR_THRESHOLD };
  
};

// ── ./src/routing/classifier ──
__factories["./src/routing/classifier"] = function(module, exports) {
  
  /**
   * Classify files by complexity tier for model routing hints.
   *
   * Tiers:
   *   'fast'     — simple files: config, markup, templates, trivial utilities
   *   'balanced' — standard application code: moderate functions and classes
   *   'powerful' — complex files: large classes, many exports, security-critical paths
   *
   * @param {string} filePath - absolute path to the file
   * @param {string[]} sigs   - extracted signatures for the file
   * @returns {'fast'|'balanced'|'powerful'}
   */
  function classify(filePath, sigs) {
    const lower = filePath.toLowerCase();
    const sigCount = sigs.length;

    // ── Fast tier heuristics ────────────────────────────────────────────────
    // Configuration, markup, templates, and trivial utilities are small tasks
    if (
      lower.endsWith('.json') ||
      lower.endsWith('.yml') ||
      lower.endsWith('.yaml') ||
      lower.endsWith('.toml') ||
      lower.endsWith('.env') ||
      lower.endsWith('.html') ||
      lower.endsWith('.htm') ||
      lower.endsWith('.css') ||
      lower.endsWith('.scss') ||
      lower.endsWith('.sass') ||
      lower.endsWith('.less') ||
      /dockerfile/i.test(lower) ||
      lower.endsWith('.sh') ||
      lower.endsWith('.bash') ||
      lower.endsWith('.zsh') ||
      lower.endsWith('.fish')
    ) {
      return 'fast';
    }

    // Config-like directories
    if (
      lower.includes('/config/') ||
      lower.includes('/configs/') ||
      lower.includes('/fixtures/') ||
      lower.includes('/migrations/') ||
      lower.includes('/seeds/')
    ) {
      return sigCount > 4 ? 'balanced' : 'fast';
    }

    // Test files — usually standard complexity
    if (/\.(test|spec)\.[a-z]+$/.test(lower) || /_test\.[a-z]+$/.test(lower)) {
      return 'balanced';
    }

    // ── Powerful tier heuristics — high-signal keywords in the path ─────────
    if (
      lower.includes('/security/') ||
      lower.includes('/auth/') ||
      lower.includes('/crypto/') ||
      lower.includes('/core/') ||
      lower.includes('/engine/') ||
      lower.includes('/compiler/') ||
      lower.includes('/parser/') ||
      lower.includes('/scheduler/') ||
      lower.includes('/orchestrat')
    ) {
      return 'powerful';
    }

    // Many exports → complex file
    if (sigCount >= 12) return 'powerful';

    // Large number of class-level methods (indented 2-space sigs)
    const methodCount = sigs.filter((s) => s.startsWith('  ')).length;
    if (methodCount >= 8) return 'powerful';

    // ── Balanced covers everything else ────────────────────────────────────
    if (sigCount <= 2) return 'fast';
    return 'balanced';
  }

  /**
   * Classify all file entries and group them by tier.
   *
   * @param {Array<{filePath: string, sigs: string[]}>} fileEntries
   * @returns {{ fast: string[], balanced: string[], powerful: string[] }}
   *   Each array contains relative paths (relative to cwd).
   */
  function classifyAll(fileEntries, cwd) {
    const path = require('path');
    const result = { fast: [], balanced: [], powerful: [] };
    for (const { filePath, sigs } of fileEntries) {
      const tier = classify(filePath, sigs);
      result[tier].push(path.relative(cwd, filePath));
    }
    return result;
  }

  module.exports = { classify, classifyAll };
  
};

// ── ./src/routing/hints ──
__factories["./src/routing/hints"] = function(module, exports) {
  
  /**
   * Model routing hint definitions for SigMap.
   *
   * Maps complexity tiers to the task types that belong to each. The model names
   * and prices a tier prints are NOT defined here: they come from the dated model
   * profile (src/config/models.js), the same table `gain --model` prices from, so
   * a name advised here is always one the pricing accepts (#778).
   *
   * These are embedded in the generated context file when `routing: true`
   * so that AI agents and developers know which model tier to invoke.
   */

  const { resolveProfile, tierModels, tierPriceRange, asOfLabel, TIER_ORDER } = __require('./src/config/models');

  const TIER_TASKS = {
    fast: {
      label: 'Fast (low-cost)',
      tasks: [
        'Autocomplete and inline suggestions',
        'Edit config or markup files',
        'Fix typos and rename symbols',
        'Format, lint, and trivial style changes',
        'Explain a short utility function',
        'Generate simple shell scripts or Dockerfiles',
      ],
    },

    balanced: {
      label: 'Balanced (mid-tier)',
      tasks: [
        'Write unit or integration tests',
        'Implement a well-scoped feature function',
        'Debug a runtime error with stack trace',
        'Refactor a module (< 200 lines)',
        'Generate a PR description',
        'Explain a multi-function module',
      ],
    },

    powerful: {
      label: 'Powerful (high-cost)',
      tasks: [
        'Cross-cutting architecture decisions',
        'Multi-file refactor spanning 5+ files',
        'Security audit (OWASP Top 10)',
        'Complex debugging across async boundaries',
        'Migration plan for a library/framework upgrade',
        'Designing a new module from requirements',
      ],
    },
  };

  /**
   * One tier as advice: its tasks plus the models and input-price span the
   * profile in force gives it.
   *
   * @param {string} tier - 'fast' | 'balanced' | 'powerful'
   * @param {object} [profile] - from resolveProfile(config); the shipped profile when omitted
   * @returns {{ label: string, tasks: string[], models: string[], examples: string, costHint: string }}
   */
  function tierInfo(tier, profile) {
    const p = profile || resolveProfile();
    const models = tierModels(p, tier);
    const range = tierPriceRange(p, tier);
    const costHint = !range
      ? 'no priced model in this tier'
      : (range.min === range.max ? `$${range.min}` : `$${range.min}–$${range.max}`) + ' / MTok input';
    return {
      label: TIER_TASKS[tier].label,
      tasks: TIER_TASKS[tier].tasks,
      models,
      examples: models.length ? models.join(', ') : (p.rosterDeclared ? '(none in your roster)' : '(none)'),
      costHint,
    };
  }

  /** The tiers under the shipped profile, for callers with no config in hand. */
  const TIERS = {};
  for (const tier of TIER_ORDER) TIERS[tier] = tierInfo(tier);

  /**
   * Format the routing section as markdown to append to the context file.
   *
   * @param {{ fast: string[], balanced: string[], powerful: string[] }} groups
   *   Relative file paths grouped by tier (from classifier.classifyAll).
   * @param {object} [profile] - from resolveProfile(config); the shipped profile when omitted
   * @returns {string} Markdown block to embed in the context output.
   */
  function formatRoutingSection(groups, profile) {
    const p = profile || resolveProfile();
    const lines = [
      '',
      '---',
      '',
      '## Model routing hints',
      '<!-- Generated by SigMap routing module — update gen-context.config.json to disable -->',
      '',
      'Select the model tier based on the task complexity and the files involved.',
      `Model names and prices: ${asOfLabel(p)} — a static table, not a live lookup.`,
      '',
    ];

    for (const tier of TIER_ORDER) {
      const info = tierInfo(tier, p);
      const files = groups[tier] || [];
      lines.push(`### ${info.label}`);
      lines.push(`**Examples:** ${info.examples}  `);
      lines.push(`**Cost:** ${info.costHint}`);
      lines.push('');
      lines.push('**Use for tasks like:**');
      for (const task of info.tasks) lines.push(`- ${task}`);
      lines.push('');
      if (files.length > 0) {
        lines.push('**Files in this tier:**');
        for (const f of files.slice(0, 15)) lines.push(`- \`${f}\``);
        if (files.length > 15) lines.push(`- … and ${files.length - 15} more`);
      } else {
        lines.push('**Files in this tier:** _(none detected)_');
      }
      lines.push('');
    }

    lines.push('> **Tip:** Run `node gen-context.js --routing` to regenerate routing hints.');
    lines.push('> See `docs/MODEL_ROUTING.md` for full routing guide and cost optimisation tips.');

    return lines.join('\n');
  }

  module.exports = { TIERS, tierInfo, formatRoutingSection };
  
};

// ── ./src/scaffold/persist ──
__factories["./src/scaffold/persist"] = function(module, exports) {
  
  /**
   * Scaffold persistence (IMPL.md §6.2 — 2d).
   *
   * Renders an accepted scaffold proposal to markdown and locates the on-disk
   * record (`.context/scaffold/latest.md`) so the `create` pipeline and agents can
   * read back the convention-matched proposal. Pure render; zero-dependency,
   * bundle-safe.
   */

  const path = require('path');

  /** Path to the persisted scaffold record. */
  function scaffoldPath(cwd) {
    return path.join(cwd, '.context', 'scaffold', 'latest.md');
  }

  /**
   * Render an accepted scaffold decision to a markdown record.
   * @param {object} decision a `proposeScaffold` result with `ok: true`
   * @param {object} [opts]
   * @param {string} [opts.timestamp] ISO timestamp (caller supplies — keeps this pure)
   * @returns {string}
   */
  function renderScaffoldMarkdown(decision, opts = {}) {
    const d = decision || {};
    const p = d.proposal || {};
    const pct = (n) => `${Math.round((n || 0) * 100)}%`;
    const lines = [
      `# Scaffold — ${d.name || '(unnamed)'}`,
      '',
      `- **Conventions:** ${d.tier || 'unknown'} (${pct(d.confidence)})`,
      `- **File:** \`${p.filename || ''}\` (${p.namingStyle || ''})`,
      `- **Export style:** ${p.exportStyle || ''}`,
      `- **Test file:** \`${p.testFile || ''}\`${p.testFramework ? ` (${p.testFramework})` : ''}`,
    ];
    if (d.warning) lines.push(`- **Warning:** ${d.warning}`);
    lines.push('');
    lines.push(`<sub>Generated by \`sigmap scaffold\`${opts.timestamp ? ` · ${opts.timestamp}` : ''}.</sub>`);
    lines.push('');
    return lines.join('\n');
  }

  module.exports = { scaffoldPath, renderScaffoldMarkdown };
  
};

// ── ./src/scaffold/propose ──
__factories["./src/scaffold/propose"] = function(module, exports) {
  
  /**
   * Scaffold proposal with a confidence floor (IMPL.md §5 — Cause 3).
   *
   * Proposes a convention-matched structure for a new module — filename in the
   * repo's dominant naming style, the export style to use, and a matching test
   * file — but only when the conventions are consistent enough. Below a hard
   * floor it refuses and surfaces the conflict, because a wrong proposal
   * systematizes bad code. Pure, zero-dependency, bundle-safe; reuses the
   * conventions primitives.
   */

  const { toNamingStyle, analyzeConflicts } = __require('./src/conventions/conflicts');

  // Soft threshold is configurable; the hard floor is not (IMPL.md §5.1).
  const DEFAULT_THRESHOLD = 0.7;
  const HARD_FLOOR = 0.5;

  /** Tier for a consistency score (matches the conventions tiers). */
  function _tier(pct) {
    if (pct >= 0.9) return 'consistent';
    if (pct >= 0.7) return 'mostly';
    return 'inconsistent';
  }

  /** Strip any extension/compound suffix from a requested name → bare stem. */
  function _stem(name) {
    const s = String(name || '').trim();
    const slash = s.lastIndexOf('/');
    const base = slash >= 0 ? s.slice(slash + 1) : s;
    const dot = base.indexOf('.');
    return dot > 0 ? base.slice(0, dot) : base;
  }

  /** Test file path for a styled stem given the detected framework + ext. */
  function _testFile(styledStem, framework, ext) {
    if (framework === 'pytest' || framework === 'unittest') {
      return `test_${toNamingStyle(styledStem, 'snake_case')}.py`;
    }
    return `${styledStem}.test.${ext}`;
  }

  /**
   * Propose a convention-matched scaffold, gated by a confidence floor.
   * @param {string} name desired module name (any casing; extension ignored)
   * @param {object} conventions an `extractConventions` result
   * @param {object} [opts]
   * @param {number} [opts.threshold=0.7] soft threshold (clamped to ≥ hard floor)
   * @param {boolean} [opts.force=false] allow proposing below the soft threshold
   *   (never below the hard floor)
   * @param {string} [opts.ext='js'] file extension for the proposed files
   * @returns {{ ok:boolean, refused:boolean, name:string, tier:string,
   *   confidence:number, threshold:number, hardFloor:number, forced:boolean,
   *   warning:string|null, reason:string, proposal:object|null, conflicts:object }}
   */
  function proposeScaffold(name, conventions, opts = {}) {
    const threshold = Math.max(HARD_FLOOR, opts.threshold != null ? opts.threshold : DEFAULT_THRESHOLD);
    const force = !!opts.force;
    const ext = opts.ext || 'js';
    const fileNaming = (conventions && conventions.fileNaming) || { dominant: null, dominantPct: 0, total: 0 };
    const exportStyle = (conventions && conventions.exportStyle) || { dominant: null };
    const confidence = fileNaming.dominantPct || 0;
    const tier = fileNaming.total > 0 ? _tier(confidence) : 'unknown';
    const conflicts = analyzeConflicts(conventions || {});

    const base = {
      ok: false, refused: true, name: String(name || ''), tier, confidence,
      threshold, hardFloor: HARD_FLOOR, forced: false, warning: null,
      reason: '', proposal: null, conflicts,
    };

    if (!fileNaming.dominant || fileNaming.total === 0) {
      return { ...base, reason: 'no file-naming convention detected — cannot propose a name' };
    }
    if (confidence < HARD_FLOOR) {
      return {
        ...base,
        reason: `file-naming consistency ${(confidence * 100).toFixed(0)}% is below the hard floor ${(HARD_FLOOR * 100).toFixed(0)}% — refusing (not overridable)`,
      };
    }
    if (confidence < threshold && !force) {
      return {
        ...base,
        reason: `file-naming consistency ${(confidence * 100).toFixed(0)}% is below the threshold ${(threshold * 100).toFixed(0)}% — refusing (use --force to override above the ${(HARD_FLOOR * 100).toFixed(0)}% floor)`,
      };
    }

    const styledStem = toNamingStyle(_stem(name), fileNaming.dominant);
    const forced = confidence < threshold && force;
    const proposal = {
      filename: `${styledStem}.${ext}`,
      namingStyle: fileNaming.dominant,
      exportStyle: exportStyle.dominant || 'named',
      testFile: _testFile(styledStem, conventions.testFramework, ext),
      testFramework: conventions.testFramework || null,
    };

    return {
      ...base,
      ok: true,
      refused: false,
      forced,
      warning: forced
        ? `proposed below the ${(threshold * 100).toFixed(0)}% threshold (--force); conventions are only ${tier}`
        : null,
      reason: forced ? 'forced proposal above the hard floor' : `conventions are ${tier} — proposing`,
      proposal,
    };
  }

  module.exports = { proposeScaffold, DEFAULT_THRESHOLD, HARD_FLOOR };
  
};

// ── ./src/scip/reader ──
__factories["./src/scip/reader"] = function(module, exports) {
  
  // Zero-dep SCIP index reader (#618, tier T4 of #542). SCIP is Sourcegraph's
  // protobuf index format; indexers exist for TS/Java/Python/Rust/C++/Ruby and
  // more, and a repo whose CI already produces `index.scip` has compiler-grade
  // signatures sitting on disk. This reads them — import only, nothing emitted.
  //
  // The wire subset needed is tiny: varints and length-delimited fields. Field
  // numbers are grounded from the scip bindings vendored by scip-typescript
  // (src/scip.ts getter → field-number pairs), and the reader is validated
  // against a real index produced by that tool:
  //   Index            metadata=1 · documents=2
  //   Metadata         tool_info=2 (ToolInfo: name=1 version=2)
  //   Document         relative_path=1 · occurrences=2 · symbols=3
  //   SymbolInformation symbol=1 · documentation=3
  //   Occurrence       range=1 (packed) · symbol=2 · symbol_roles=3 · enclosing_range=7
  // Anything unrecognized is skipped by wire type, so newer fields are inert.

  function readVarint(buf, pos) {
    let v = 0n, shift = 0n, p = pos;
    for (;;) {
      const b = buf[p++];
      v |= BigInt(b & 0x7f) << shift;
      if (!(b & 0x80)) break;
      shift += 7n;
    }
    return [Number(v), p];
  }

  /** Iterate [fieldNumber, value] pairs of one protobuf message. */
  function* fields(buf) {
    let p = 0;
    while (p < buf.length) {
      let key;
      [key, p] = readVarint(buf, p);
      const field = key >>> 3, wire = key & 7;
      if (wire === 0) { let v; [v, p] = readVarint(buf, p); yield [field, v]; }
      else if (wire === 2) { let len; [len, p] = readVarint(buf, p); yield [field, buf.slice(p, p + len)]; p += len; }
      else if (wire === 5) { p += 4; }
      else if (wire === 1) { p += 8; }
      else throw new Error(`scip: unknown wire type ${wire}`);
    }
  }

  function packedVarints(buf) {
    const out = [];
    let p = 0;
    while (p < buf.length) { let v; [v, p] = readVarint(buf, p); out.push(v); }
    return out;
  }

  const DEFINITION_ROLE = 0x1;

  /**
   * Parse a SCIP index buffer into a compact per-document structure.
   * Throws on malformed input — callers treat any throw as "no index".
   * @param {Buffer} buf
   * @returns {{ tool: string, documents: Map<string, { symbols: Map<string, string[]>, defs: Array<{symbol: string, range: number[]}> }> }}
   */
  function parseIndex(buf) {
    let tool = '';
    const documents = new Map();
    for (const [f, v] of fields(buf)) {
      if (f === 1) {
        for (const [mf, mv] of fields(v)) {
          if (mf === 2) {
            let name = '', version = '';
            for (const [tf, tv] of fields(mv)) {
              if (tf === 1) name = tv.toString('utf8');
              if (tf === 2) version = tv.toString('utf8');
            }
            tool = version ? `${name}@${version}` : name;
          }
        }
      } else if (f === 2) {
        let relPath = '';
        const symbols = new Map();
        const defs = [];
        for (const [df, dv] of fields(v)) {
          if (df === 1) relPath = dv.toString('utf8');
          else if (df === 3) {
            let symbol = '';
            const docs = [];
            for (const [sf, sv] of fields(dv)) {
              if (sf === 1) symbol = sv.toString('utf8');
              if (sf === 3) docs.push(sv.toString('utf8'));
            }
            if (symbol) symbols.set(symbol, docs);
          } else if (df === 2) {
            let range = null, symbol = '', roles = 0, enclosing = null;
            for (const [of, ov] of fields(dv)) {
              if (of === 1) range = Buffer.isBuffer(ov) ? packedVarints(ov) : [ov];
              if (of === 2) symbol = ov.toString('utf8');
              if (of === 3) roles = ov;
              if (of === 7) enclosing = Buffer.isBuffer(ov) ? packedVarints(ov) : [ov];
            }
            if ((roles & DEFINITION_ROLE) && symbol && range) defs.push({ symbol, range, enclosing });
          }
        }
        if (relPath) documents.set(relPath.replace(/\\/g, '/'), { symbols, defs });
      }
    }
    return { tool, documents };
  }

  module.exports = { parseIndex, fields, readVarint, packedVarints, DEFINITION_ROLE };
  
};

// ── ./src/security/patterns ──
__factories["./src/security/patterns"] = function(module, exports) {
  
  /**
   * Secret detection patterns for SigMap scanner.
   * Each pattern has a name and a regex tested against signature strings.
   */
  const PATTERNS = [
    {
      name: 'AWS Access Key',
      regex: /AKIA[0-9A-Z]{16}/,
    },
    {
      name: 'AWS Secret Key',
      // 40-char base64-like string following common AWS secret key assignment patterns
      regex: /(?:aws_secret|secret_access_key|SecretAccessKey)\s*[:=]\s*['"]?[0-9a-zA-Z/+]{40}/i,
    },
    {
      name: 'GCP API Key',
      regex: /AIza[0-9A-Za-z\-_]{35}/,
    },
    {
      name: 'GitHub Token',
      regex: /gh[pousr]_[A-Za-z0-9_]{36,}/,
    },
    {
      name: 'JWT Token',
      regex: /eyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/,
    },
    {
      name: 'DB Connection String',
      regex: /(mongodb|postgres|postgresql|mysql|redis):\/\/[^:]+:[^@]+@/i,
    },
    {
      name: 'SSH Private Key',
      regex: /-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/,
    },
    {
      name: 'Stripe Key',
      regex: /sk_(live|test)_[0-9a-zA-Z]{24,}/,
    },
    // The `sk-` family (#771). `sk_live_`/`sk_test_` above uses an UNDERSCORE;
    // OpenAI and Anthropic use a HYPHEN, so the Stripe pattern never covered
    // them and five of seven credential shapes passed through untouched. The
    // leading `\b` matters: without it `sk-` matches inside `risk-…`.
    // Anthropic and the OpenAI project form come first — both contain hyphens
    // after `sk-`, so the legacy alphanumeric-only pattern cannot claim them,
    // but ordering keeps the reported name right if either format widens.
    {
      name: 'Anthropic API Key',
      regex: /\bsk-ant-[A-Za-z0-9_-]{20,}/,
    },
    {
      name: 'OpenAI API Key',
      regex: /\bsk-proj-[A-Za-z0-9_-]{20,}/,
    },
    {
      name: 'OpenAI API Key (legacy)',
      regex: /\bsk-[A-Za-z0-9]{32,}/,
    },
    {
      name: 'Slack Token',
      regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}/,
    },
    {
      name: 'Slack Webhook',
      regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9]+\/B[A-Za-z0-9]+\/[A-Za-z0-9]+/,
    },
    {
      name: 'Twilio Key',
      regex: /SK[0-9a-fA-F]{32}/,
    },
    {
      name: 'Generic Secret',
      regex: /(secret|password|passwd|api_key|apikey|auth_token|access_token)\s*[:=]\s*['"][^'"]{8,}['"]/i,
    },
    {
      name: 'Generic Secret',
      // Unquoted values — `.env` / YAML / CLI shapes (`password=…`, `api_key: …`)
      // that the quoted pattern above misses (#668). Marked textOnly because an
      // unquoted value token is indistinguishable from a type annotation
      // (`password: PasswordHasher`), and the signature scanner would replace
      // the whole declaration; `sigmap redact` runs over real config/log text
      // where the aggressive match is exactly right (#680).
      textOnly: true,
      regex: /(secret|password|passwd|api_key|apikey|auth_token|access_token)\s*[:=]\s*[^\s'"]{8,}/i,
    },
  ];

  module.exports = { PATTERNS };
  
};

// ── ./src/security/redact ──
__factories["./src/security/redact"] = function(module, exports) {
  
  /**
   * Standalone text redaction (v8.24 G3a) — the same pattern bank the
   * generation-time scanner uses (security/patterns.js), applied to arbitrary
   * text. Unlike scanner.js (which replaces whole signature lines), this masks
   * only the matched secret substring so surrounding text stays readable.
   *
   * Zero dependencies; never throws — on any error the original text is
   * returned unredacted.
   */

  const { PATTERNS } = __require('./src/security/patterns');

  // Global variants of the pattern regexes (needed for replace-all per line).
  const GLOBAL_PATTERNS = PATTERNS.map((p) => ({
    name: p.name,
    regex: new RegExp(p.regex.source, p.regex.flags.includes('g') ? p.regex.flags : p.regex.flags + 'g'),
  }));

  /**
   * Redact secrets in arbitrary text.
   * @param {string} text
   * @returns {{
   *   text: string, redacted: boolean,
   *   findings: Array<{ line: number, pattern: string }>,
   *   counts: Object<string, number>
   * }}
   */
  function redactText(text) {
    if (typeof text !== 'string' || text.length === 0) {
      return { text: typeof text === 'string' ? text : '', redacted: false, findings: [], counts: {} };
    }
    try {
      const findings = [];
      const counts = {};
      const lines = text.split('\n');
      const out = lines.map((line, i) => {
        let masked = line;
        for (const p of GLOBAL_PATTERNS) {
          p.regex.lastIndex = 0;
          if (!p.regex.test(masked)) continue;
          p.regex.lastIndex = 0;
          masked = masked.replace(p.regex, `[REDACTED:${p.name}]`);
          findings.push({ line: i + 1, pattern: p.name });
          counts[p.name] = (counts[p.name] || 0) + 1;
        }
        return masked;
      });
      return { text: out.join('\n'), redacted: findings.length > 0, findings, counts };
    } catch (_) {
      return { text, redacted: false, findings: [], counts: {} };
    }
  }

  module.exports = { redactText };
  
};

// ── ./src/security/scanner ──
__factories["./src/security/scanner"] = function(module, exports) {
  
  const { PATTERNS } = __require('./src/security/patterns');

  /**
   * Scan an array of signature strings for secrets.
   *
   * @param {string[]} signatures - Array of extracted signature strings
   * @param {string} filePath - Source file path (used in redaction message)
   * @returns {{ safe: string[], redacted: boolean }}
   *   safe      — signatures with any secret-containing entries replaced
   *   redacted  — true if at least one signature was redacted
   */
  function scan(signatures, filePath) {
    if (!Array.isArray(signatures)) return { safe: [], redacted: false };

    try {
      let redacted = false;
      const safe = signatures.map((sig) => {
        if (typeof sig !== 'string') return sig;
        for (const pattern of PATTERNS) {
          // textOnly patterns are tuned for free-form config/log text (sigmap
          // redact). Signatures are code: an unquoted value token there is a
          // type annotation, not a secret (#680).
          if (pattern.textOnly) continue;
          if (pattern.regex.test(sig)) {
            redacted = true;
            return `[REDACTED — ${pattern.name} detected in ${filePath}]`;
          }
        }
        return sig;
      });
      return { safe, redacted };
    } catch (_) {
      // Never throw — return original signatures on any error
      return { safe: signatures, redacted: false };
    }
  }

  module.exports = { scan };
  
};

// ── ./src/session/capabilities ──
__factories["./src/session/capabilities"] = function(module, exports) {
  
  /**
   * What each agent can tell SigMap about its own usage (#951, SI-4).
   *
   * The one place an agent's capture capability is written down. The sessions
   * report, its coverage panel and the dashboard read these declarations and keep
   * no prose of their own (guard-tested), so a capability that changes is changed
   * here once.
   *
   * A capability is the list of `store.SOURCES` an agent can produce, each with the
   * way it arrives. It is a statement about what SigMap can RECEIVE, never about
   * what a model spent: an agent that can report is still unverifiable, and one
   * that cannot is not zero.
   */

  const { PROVENANCE } = __require('./src/session/store');

  const MCP_VIA = 'the log_session_usage MCP tool (session.mcpCapture) or `sigmap session log --from-json`';
  const HOOKS_VIA = 'hooks that read its transcript (`sigmap hooks install claude`)';

  /**
   * `agent` is the store's agent name (a key of its id prefixes). `match` are
   * lowercase fragments of an MCP client's `clientInfo.name` that identify it.
   * `capture` lists each way usage can reach the store, as a `store.SOURCES` value
   * and how; an empty list means the agent exposes no usage surface, and `note`
   * then says so.
   */
  const DECLARATIONS = [
    {
      agent: 'claude-code', name: 'Claude Code', match: ['claude'],
      capture: [{ source: 'transcript', via: HOOKS_VIA }, { source: 'agent-reported', via: MCP_VIA }],
      note: 'measured covers the main conversation only — subagent transcripts are not read',
    },
    { agent: 'cursor', name: 'Cursor', match: ['cursor'], capture: [{ source: 'agent-reported', via: MCP_VIA }], note: null },
    { agent: 'windsurf', name: 'Windsurf', match: ['windsurf'], capture: [{ source: 'agent-reported', via: MCP_VIA }], note: null },
    { agent: 'opencode', name: 'OpenCode', match: ['opencode'], capture: [{ source: 'agent-reported', via: MCP_VIA }], note: null },
    {
      agent: 'codex', name: 'Codex CLI', match: ['codex'], capture: [{ source: 'agent-reported', via: MCP_VIA }],
      note: 'no session-log ingester yet (spike #690)',
    },
    {
      agent: 'gemini', name: 'Gemini CLI', match: ['gemini'], capture: [{ source: 'agent-reported', via: MCP_VIA }],
      note: 'no session-log ingester yet (spike #691)',
    },
    {
      agent: 'copilot', name: 'GitHub Copilot', match: ['copilot'], capture: [],
      note: 'context-size estimate only — Copilot exposes no usage surface',
    },
    {
      agent: 'ci', name: 'CI', match: [], capture: [],
      note: 'a pipeline run has no transcript, so its usage is recorded as unavailable',
    },
  ];

  /** The declaration for a store agent name, or null when it is not declared. */
  function forAgent(agent) {
    return DECLARATIONS.find((d) => d.agent === agent) || null;
  }

  /**
   * The store agent name for an MCP client's `clientInfo.name`, or null when no
   * declaration claims it. Matching is by lowercase fragment; the first
   * declaration that matches wins, in declaration order.
   */
  function agentFromClient(clientName) {
    const n = String(clientName == null ? '' : clientName).toLowerCase();
    if (!n) return null;
    const hit = DECLARATIONS.find((d) => d.match.some((m) => n.includes(m)));
    return hit ? hit.agent : null;
  }

  /** The provenance labels an agent can produce, in declaration order. */
  function labelsOf(decl) {
    return decl.capture.map((c) => PROVENANCE[c.source]).filter(Boolean);
  }

  /** One line of prose for a declaration, built only from its fields. */
  function describe(decl) {
    if (decl.capture.length === 0) return `${decl.name}: ${decl.note || 'no usage surface'}`;
    const ways = decl.capture.map((c) => `${PROVENANCE[c.source]} via ${c.via}`).join('; or ');
    return `${decl.name}: ${ways}${decl.note ? `; ${decl.note}` : ''}`;
  }

  /** An agent that appears in the store with no declaration: SigMap claims nothing about it. */
  function describeUndeclared(agent) {
    return `${agent}: not declared — SigMap states no capture capability for it; its figures are whatever each record carries`;
  }

  module.exports = { DECLARATIONS, MCP_VIA, forAgent, agentFromClient, labelsOf, describe, describeUndeclared };
  
};

// ── ./src/session/capture ──
__factories["./src/session/capture"] = function(module, exports) {
  
  /**
   * Session capture (#922): the writers that feed `.context/sessions.ndjson`.
   *
   *   recordTranscript   parse a Claude Code transcript → one cumulative `usage` event
   *   recordFromJson     the generic fallback for any agent that can report its own usage
   *   recordFromMcp      the same, for an agent calling the `log_session_usage` MCP tool (#951)
   *   recordCi           an `agent: "ci"` record for a pipeline run
   *   handleHook         the Claude Code SessionStart / Stop / SessionEnd handler
   *
   * `handleHook` is the only code that runs inside a host agent's lifecycle, so it
   * is built to be harmless: it never throws, never exits non-zero (the caller
   * exits 0 unconditionally), and bounds its own work with a deadline rather than
   * a timer — a synchronous parse cannot be interrupted by one. Each thing it
   * records is attempted on its own: a usage event that cannot be written (a
   * hostile transcript field, a full disk) never costs the session its `end`.
   *
   * Zero dependencies.
   */

  const fs = require('fs');
  const path = require('path');
  const store = __require('./src/session/store');
  const { parseTranscript } = __require('./src/session/claude-transcript');
  const { tryGit } = __require('./src/util/git');

  const HOOK_EVENTS = ['SessionStart', 'Stop', 'SessionEnd'];

  function _branch(cwd) {
    return store.cleanStr(tryGit(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd }), 120);
  }

  /**
   * Parse a Claude Code transcript and append a cumulative `usage` event.
   * The transcript is untrusted; only an absolute `*.jsonl` regular file is read.
   *
   * @param {string} cwd
   * @param {string} id          agent-prefixed session id
   * @param {string} file        absolute transcript path
   * @param {{ deadlineMs?: number, skipIfUnchanged?: boolean }} [opts]
   * @returns {{ event: object|null, skipped?: boolean, error?: string, parsed?: object }}
   */
  function recordTranscript(cwd, id, file, opts = {}) {
    if (typeof file !== 'string' || !path.isAbsolute(file) || !/\.jsonl$/i.test(file)) {
      return { event: null, error: 'transcript must be an absolute path to a .jsonl file' };
    }
    if (opts.skipIfUnchanged) {
      // Stop fires after every turn: don't re-parse a transcript that has not grown.
      try {
        const st = fs.statSync(file);
        const prev = st.isFile() ? store.readSessions(cwd).sessions.find((s) => s.id === id) : null;
        if (prev && prev.offset === st.size && !prev.partial && st.size > 0) return { event: null, skipped: true };
      } catch (_) { /* fall through to a real parse */ }
    }
    const parsed = parseTranscript(file, { deadlineMs: opts.deadlineMs });
    const ev = {
      kind: 'usage', id, source: parsed.source, model: parsed.model,
      offset: parsed.offset, size: parsed.size, partial: parsed.partial,
      parseErrors: parsed.parseErrors, messages: parsed.messages, coverage: 'main',
    };
    if (parsed.usage) ev.usage = parsed.usage;
    if (parsed.models) ev.models = parsed.models;
    if (parsed.firstTs) ev.firstTs = parsed.firstTs;
    if (parsed.skippedSidechain) ev.skippedSidechain = parsed.skippedSidechain;
    if (parsed.cacheGaps) ev.cacheGaps = parsed.cacheGaps;
    if (parsed.error) ev.note = store.cleanStr(String(parsed.error), 60);
    return { event: store.appendEvent(cwd, ev), parsed };
  }

  function _count(v, name, optional) {
    if (v === undefined || v === null) {
      if (optional) return null;
      throw new Error(`usage.${name} is required`);
    }
    if (typeof v !== 'number' || !Number.isFinite(v) || v < 0) throw new Error(`usage.${name} must be a non-negative number`);
    return v;
  }

  /**
   * Record a session an agent reported itself (`session log --from-json`).
   * Expected shape: `{ id, agent?, model?, branch?, startedAt?, endedAt?, source?,
   * usage: { in, out, cacheRead?, cacheWrite? } }`. `in` and `out` are required.
   * A cache category the agent did not report is stored as `null` — unknown — and
   * rendered as n/a: it is NOT recorded as 0, which would claim the agent used none.
   * `source` may be `agent-reported` (default) or `estimate`.
   */
  function recordFromJson(cwd, obj, opts = {}) {
    if (!obj || typeof obj !== 'object' || Array.isArray(obj)) throw new Error('expected a JSON object');
    if (typeof obj.id !== 'string' || !obj.id.trim()) throw new Error('"id" is required');
    const agent = store.cleanStr(obj.agent, 20) || 'agent';
    const id = store.sessionId(agent, obj.id);
    const u = obj.usage;
    if (!u || typeof u !== 'object') throw new Error('"usage" is required: { in, out, cacheRead?, cacheWrite? }');
    const usage = {
      in: _count(u.in, 'in'), out: _count(u.out, 'out'),
      cacheRead: _count(u.cacheRead, 'cacheRead', true), cacheWrite: _count(u.cacheWrite, 'cacheWrite', true),
    };
    const source = obj.source === 'estimate' ? 'estimate' : 'agent-reported';
    const startedAt = store.cleanIso(obj.startedAt) || new Date().toISOString();
    const endedAt = store.cleanIso(obj.endedAt) || startedAt;
    const branch = typeof obj.branch === 'string' ? store.cleanStr(obj.branch, 120) : _branch(cwd);
    const model = store.cleanStr(obj.model, 80) || 'unknown';
    store.appendEvent(cwd, { kind: 'start', id, ts: startedAt, agent, branch });
    store.appendEvent(cwd, { kind: 'usage', id, ts: endedAt, source, model, usage, offset: 0 });
    store.appendEvent(cwd, { kind: 'end', id, ts: endedAt, reason: 'reported' });
    store.maybeCompact(cwd, opts.config);
    return { id, source };
  }

  /**
   * Record usage an MCP agent reported through `log_session_usage` (#951).
   *
   * The same events `recordFromJson` writes, with two differences that follow from
   * who is calling. A tool call is made by a model, so a malformed `usage` is
   * recorded as `unavailable` with the reason returned — it is never thrown at the
   * agent and never coerced into numbers. And the caller may not know its own
   * session id, so one is derived per MCP connection: every call from a
   * connection lands in one session, and two connections never share one.
   *
   * Reports are cumulative. The agent sends its running total and the latest
   * report for an id replaces the earlier one (the fold orders by offset, then
   * source, then time); a measured transcript record of the same id outranks it,
   * and an `unavailable` report never replaces a usable one.
   *
   * @param {string} cwd
   * @param {{ id?: string, model?: string, usage?: object }} args  the tool call's arguments
   * @param {{ client?: string, token: string }} conn  the connection: the client's name and a token unique to it
   * @param {{ config?: object }} [opts]
   * @returns {{ id: string, source: 'agent-reported'|'unavailable', reason: string|null, agent: string }}
   */
  function recordFromMcp(cwd, args, conn, opts = {}) {
    const a = args && typeof args === 'object' && !Array.isArray(args) ? args : {};
    const c = conn || {};
    const { agentFromClient } = __require('./src/session/capabilities');
    const agent = agentFromClient(c.client) || store.cleanStr(c.client, 20) || 'agent';

    const generated = `mcp-${store.cleanStr(c.token, 24) || Date.now().toString(36)}`;
    let id;
    if (typeof a.id === 'string' && a.id.trim()) {
      try { id = store.sessionId(agent, a.id); } catch (_) { id = null; }
    }
    if (!id) id = store.sessionId(agent, generated);

    let usage = null;
    let reason = null;
    const u = a.usage;
    if (u === undefined || u === null) {
      reason = 'no usage was supplied';
    } else if (typeof u !== 'object' || Array.isArray(u)) {
      reason = '"usage" must be an object: { in, out, cacheRead?, cacheWrite? }';
    } else {
      try {
        usage = {
          in: _count(u.in, 'in'), out: _count(u.out, 'out'),
          cacheRead: _count(u.cacheRead, 'cacheRead', true), cacheWrite: _count(u.cacheWrite, 'cacheWrite', true),
        };
      } catch (e) {
        reason = e.message;
      }
    }

    const ts = new Date().toISOString();
    const model = store.cleanStr(a.model, 80) || 'unknown';
    store.appendEvent(cwd, { kind: 'start', id, ts, agent, branch: _branch(cwd) });
    if (usage) {
      store.appendEvent(cwd, { kind: 'usage', id, ts, source: 'agent-reported', model, usage, offset: 0 });
    } else {
      store.appendEvent(cwd, { kind: 'usage', id, ts, source: 'unavailable', model, offset: 0, note: store.cleanStr(reason, 60) });
    }
    store.appendEvent(cwd, { kind: 'end', id, ts, reason: 'reported' });
    store.maybeCompact(cwd, opts.config);
    return { id, source: usage ? 'agent-reported' : 'unavailable', reason, agent };
  }

  const CI_ENVS = [
    { name: 'github-actions', test: 'GITHUB_ACTIONS', id: (e) => [e.GITHUB_RUN_ID, e.GITHUB_RUN_ATTEMPT].filter(Boolean).join('-'), branch: 'GITHUB_REF_NAME' },
    { name: 'gitlab-ci', test: 'GITLAB_CI', id: (e) => e.CI_PIPELINE_ID, branch: 'CI_COMMIT_REF_NAME' },
    { name: 'circleci', test: 'CIRCLECI', id: (e) => e.CIRCLE_WORKFLOW_ID, branch: 'CIRCLE_BRANCH' },
    { name: 'buildkite', test: 'BUILDKITE', id: (e) => e.BUILDKITE_BUILD_ID, branch: 'BUILDKITE_BRANCH' },
  ];

  /**
   * Append an `agent: "ci"` record for this pipeline run. Usage is `unavailable`
   * unless `usage` is supplied (a CI job has no transcript to measure).
   */
  function recordCi(cwd, opts = {}) {
    const env = opts.env || process.env;
    const hit = CI_ENVS.find((c) => env[c.test]);
    const runner = hit ? hit.name : 'ci';
    const rawId = (hit && hit.id(env)) || opts.id || Date.now().toString(36);
    const id = store.sessionId('ci', rawId);
    const branch = (hit && store.cleanStr(env[hit.branch], 120)) || _branch(cwd);
    const ts = new Date().toISOString();
    store.appendEvent(cwd, { kind: 'start', id, ts, agent: 'ci', branch, ci: true, runner });
    if (opts.usage) {
      store.appendEvent(cwd, { kind: 'usage', id, ts, source: 'agent-reported', model: 'unknown', usage: opts.usage, offset: 0 });
    } else {
      store.appendEvent(cwd, { kind: 'usage', id, ts, source: 'unavailable', model: 'unknown', offset: 0, note: 'ci run: no usage surface' });
    }
    store.appendEvent(cwd, { kind: 'end', id, ts, reason: 'ci' });
    store.maybeCompact(cwd, opts.config);
    return { id, runner };
  }

  /** Run one step of the handler; a failure is noted and the next step still runs. */
  function _attempt(out, label, fn) {
    try {
      return fn();
    } catch (e) {
      if (!out.error) out.error = `${label}: ${e && e.message ? e.message : String(e)}`;
      return undefined;
    }
  }

  /**
   * Handle one Claude Code hook invocation. NEVER throws.
   *
   * Reads only the documented common payload fields (`session_id`,
   * `transcript_path`) plus `source` / `reason`, and writes:
   *   SessionStart → a `start` event, `export SIGMAP_SESSION=<id>` into
   *                  $CLAUDE_ENV_FILE (so later `sigmap ask` calls join the session),
   *                  and the warm-start summary as `additionalContext`
   *   Stop         → a cumulative `usage` event (skipped when the transcript is unchanged)
   *   SessionEnd   → the final `usage` event, then an `end` event, then retention
   *
   * It never writes the summary into a file: the block is rebuilt at generation
   * time only (single-writer rule).
   *
   * @returns {{ stdout: string|null, id: string|null, actions: string[], error?: string }}
   */
  function handleHook(event, payload, cwd, opts = {}) {
    const out = { stdout: null, id: null, actions: [] };
    try {
      if (!HOOK_EVENTS.includes(event)) return out;
      if (!payload || typeof payload !== 'object' || typeof payload.session_id !== 'string' || !payload.session_id) return out;
      const id = store.sessionId('claude-code', payload.session_id);
      out.id = id;
      const env = opts.env || process.env;
      const config = opts.config || {};

      if (event === 'SessionStart') {
        _attempt(out, 'start', () => {
          store.appendEvent(cwd, {
            kind: 'start', id, agent: 'claude-code', branch: _branch(cwd),
            startSource: store.cleanStr(payload.source, 20) || undefined,
          });
          out.actions.push('start');
        });
        const envFile = env.CLAUDE_ENV_FILE;
        if (typeof envFile === 'string' && envFile) {
          _attempt(out, 'env', () => { fs.appendFileSync(envFile, `export SIGMAP_SESSION=${id}\n`); out.actions.push('env'); });
        }
        _attempt(out, 'summary', () => {
          const { buildSummary } = __require('./src/session/summary');
          const sum = buildSummary(cwd, { config, exclude: id, now: opts.now });
          if (sum && sum.text) {
            out.stdout = JSON.stringify({ hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: sum.text } });
            out.actions.push('summary');
          }
        });
        return out;
      }

      const tp = payload.transcript_path;
      const r = _attempt(out, 'usage', () => recordTranscript(cwd, id, tp, {
        deadlineMs: opts.deadlineMs, skipIfUnchanged: event === 'Stop',
      })) || { event: null };
      out.actions.push(r.skipped ? 'unchanged' : r.event ? 'usage' : 'no-usage');
      if (r.error && !out.error) out.error = r.error;
      if (event === 'Stop') return out;

      // SessionEnd: the end is recorded whatever became of the usage.
      _attempt(out, 'end', () => {
        store.appendEvent(cwd, { kind: 'end', id, reason: store.cleanStr(payload.reason, 40) || undefined });
        out.actions.push('end');
      });
      const c = store.maybeCompact(cwd, config, { now: opts.now });
      if (c && c.action === 'compacted') out.actions.push('compact');
    } catch (e) {
      out.error = e && e.message ? e.message : String(e);
    }
    return out;
  }

  module.exports = { HOOK_EVENTS, recordTranscript, recordFromJson, recordFromMcp, recordCi, handleHook };
  
};

// ── ./src/session/claude-transcript ──
__factories["./src/session/claude-transcript"] = function(module, exports) {
  
  /**
   * Claude Code transcript reader (#922).
   *
   * A Claude Code session transcript is a JSONL file the host agent writes. Its
   * schema is NOT documented, so everything here treats it as untrusted input:
   * a line that does not parse is skipped and counted, a message whose usage is not
   * a set of finite non-negative numbers is skipped and counted, a transcript with
   * no readable usage reports `source: 'unavailable'` — never zeros — and a string
   * taken from it (model, timestamp) is stripped of control characters and capped
   * before it can reach the store, a terminal or an instruction file.
   *
   * Measured on 36 local transcripts: the host repeats an assistant `message.id`
   * across several lines (one per content block) with IDENTICAL usage, and the
   * repeats are not adjacent (up to ~2,700 lines apart). So usage is counted ONCE
   * per `message.id`, tracked with a seen-set over the whole file. A full parse of
   * a 15.8 MB transcript takes ~120 ms, which is why the totals are cumulative and
   * recomputed from byte 0 rather than resumed from a watermark.
   *
   * Coverage: the main conversation only. Sidechain (subagent) lines are skipped
   * and counted in `skippedSidechain`; the event says `coverage: 'main'`.
   *
   * Only a regular file is opened: a FIFO named `*.jsonl` would block `open(2)`
   * for ever, and this runs inside a host agent's hook.
   *
   * Zero dependencies.
   */

  const fs = require('fs');
  const { cleanStr, cleanIso } = __require('./src/session/store');

  const CHUNK = 1 << 20;
  const DEFAULT_DEADLINE_MS = 1500;
  const DEFAULT_MAX_BYTES = 512 * 1024 * 1024;
  const MAX_MODELS = 8;
  const NL = 10;

  function _num(v) {
    return typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : null;
  }

  function _zero() {
    return { in: 0, out: 0, cacheRead: 0, cacheWrite: 0 };
  }

  /**
   * Parse a transcript file.
   *
   * @param {string} file
   * @param {{ deadlineMs?: number, maxBytes?: number, now?: () => number }} [opts]
   * @returns {{
   *   ok: boolean, error?: string, size: number, offset: number, partial: boolean,
   *   parseErrors: number, skippedSidechain: number, unkeyed: number, messages: number,
   *   cacheGaps: number,
   *   usage: {in:number,out:number,cacheRead:number|null,cacheWrite:number|null}|null,
   *   source: 'transcript'|'unavailable', model: string,
   *   models: Object<string, object>|null, firstTs: string|null, lastTs: string|null
   * }}
   *   A cache category the host reported on NO message is `null`; one it reported on
   *   some messages is summed over those, and `cacheGaps` counts the messages that omitted it.
   */
  function parseTranscript(file, opts = {}) {
    const now = opts.now || Date.now;
    const deadline = now() + (Number.isFinite(opts.deadlineMs) ? opts.deadlineMs : DEFAULT_DEADLINE_MS);
    const maxBytes = Number.isFinite(opts.maxBytes) ? opts.maxBytes : DEFAULT_MAX_BYTES;
    const res = {
      ok: false, size: 0, offset: 0, partial: false, parseErrors: 0, skippedSidechain: 0, unkeyed: 0,
      messages: 0, cacheGaps: 0, usage: null, source: 'unavailable', model: 'unknown', models: null, firstTs: null, lastTs: null,
    };

    let fd;
    try {
      // stat first: opening a FIFO or device would block before any check could run.
      if (!fs.statSync(file).isFile()) { res.error = 'not a regular file'; return res; }
      fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0));
      const st = fs.fstatSync(fd);
      if (!st.isFile()) { fs.closeSync(fd); res.error = 'not a regular file'; return res; }
      res.size = st.size;
    } catch (e) {
      if (fd !== undefined) { try { fs.closeSync(fd); } catch (_) { /* ignore */ } }
      res.error = e.code || e.message;
      return res;
    }

    const seen = new Set();
    const total = _zero();
    const byModel = new Map();
    let unknownModelMessages = 0;
    let missingCacheRead = 0;
    let missingCacheWrite = 0;
    let lines = 0;

    /** Handle one complete line; mutates the accumulators. */
    const onLine = (line) => {
      if (!line) return;
      if (line.indexOf('"usage"') === -1) {
        // Not worth a JSON.parse, but a line that is not even brace-delimited is damage.
        const t = line.trim();
        if (t && (t.charCodeAt(0) !== 123 || t.charCodeAt(t.length - 1) !== 125)) res.parseErrors++;
        return;
      }
      let o;
      try { o = JSON.parse(line); } catch (_) { res.parseErrors++; return; }
      if (!o || typeof o !== 'object' || o.type !== 'assistant') return;
      const m = o.message;
      if (!m || typeof m !== 'object' || !m.usage || typeof m.usage !== 'object') return;
      if (o.isSidechain === true) { res.skippedSidechain++; return; }

      const key = typeof m.id === 'string' && m.id ? m.id : null;
      if (key && seen.has(key)) return;
      const u = m.usage;
      const crMissing = u.cache_read_input_tokens === undefined;
      const cwMissing = u.cache_creation_input_tokens === undefined;
      const inTok = _num(u.input_tokens);
      const outTok = _num(u.output_tokens);
      const cr = crMissing ? 0 : _num(u.cache_read_input_tokens);
      const cw = cwMissing ? 0 : _num(u.cache_creation_input_tokens);
      if (inTok === null || outTok === null || cr === null || cw === null) { res.parseErrors++; return; }
      if (key) seen.add(key); else res.unkeyed++;

      res.messages++;
      if (crMissing) missingCacheRead++;
      if (cwMissing) missingCacheWrite++;
      total.in += inTok; total.out += outTok; total.cacheRead += cr; total.cacheWrite += cw;
      // `<synthetic>` is the host's own placeholder for a message no model produced: it says
      // nothing about which model ran, so it neither names one nor counts as an unnamed one.
      const named = cleanStr(m.model, 80);
      if (named === '<synthetic>') {
        /* no model signal */
      } else if (named) {
        let b = byModel.get(named);
        if (!b) { b = { ..._zero(), messages: 0 }; byModel.set(named, b); }
        b.in += inTok; b.out += outTok; b.cacheRead += cr; b.cacheWrite += cw; b.messages++;
      } else {
        unknownModelMessages++;
      }
      const ts = cleanIso(o.timestamp);
      if (ts) {
        if (res.firstTs === null) res.firstTs = ts;
        res.lastTs = ts;
      }
    };

    try {
      const buf = Buffer.allocUnsafe(CHUNK);
      let carry = Buffer.alloc(0);
      let pos = 0; // absolute offset of the first byte of `carry`
      let read = 0;
      let stop = false;
      while (!stop && read < maxBytes) {
        const n = fs.readSync(fd, buf, 0, Math.min(CHUNK, maxBytes - read), read);
        if (n <= 0) break;
        read += n;
        const data = carry.length ? Buffer.concat([carry, buf.subarray(0, n)]) : Buffer.from(buf.subarray(0, n));
        let start = 0;
        let nl;
        while ((nl = data.indexOf(NL, start)) !== -1) {
          onLine(data.toString('utf8', start, nl));
          start = nl + 1;
          res.offset = pos + start;
          if ((++lines & 1023) === 0 && now() > deadline) { res.partial = true; stop = true; break; }
        }
        carry = data.subarray(start);
        pos += start;
      }
      if (!stop && carry.length && read >= res.size) {
        // A final line with no newline: take it only if it is whole JSON. A half-written
        // tail (the host is still appending) is left for the next parse, not counted as damage.
        const tail = carry.toString('utf8');
        let whole = false;
        try { JSON.parse(tail); whole = true; } catch (_) { /* mid-write */ }
        if (whole) { onLine(tail); res.offset = pos + carry.length; }
      }
      if (!res.partial && res.offset < res.size && read < res.size) res.partial = true; // stopped at maxBytes
      res.ok = true;
    } catch (e) {
      res.error = e.code || e.message;
    } finally {
      try { fs.closeSync(fd); } catch (_) { /* ignore */ }
    }

    if (res.ok && res.messages > 0) {
      res.usage = {
        in: total.in,
        out: total.out,
        cacheRead: missingCacheRead === res.messages ? null : total.cacheRead,
        cacheWrite: missingCacheWrite === res.messages ? null : total.cacheWrite,
      };
      const someMissing = (n) => n > 0 && n < res.messages;
      res.cacheGaps = Math.max(someMissing(missingCacheRead) ? missingCacheRead : 0, someMissing(missingCacheWrite) ? missingCacheWrite : 0);
      res.source = 'transcript';
      if (byModel.size === 0) res.model = 'unknown';
      else if (byModel.size === 1 && unknownModelMessages === 0) res.model = [...byModel.keys()][0];
      else res.model = 'mixed';
      if (byModel.size > 1 || (byModel.size === 1 && unknownModelMessages > 0)) {
        const names = [...byModel.keys()].sort().slice(0, MAX_MODELS);
        res.models = Object.create(null);
        for (const n of names) res.models[n] = byModel.get(n);
      }
    }
    return res;
  }

  module.exports = { parseTranscript, DEFAULT_DEADLINE_MS };
  
};

// ── ./src/session/hooks-install ──
__factories["./src/session/hooks-install"] = function(module, exports) {
  
  /**
   * `sigmap hooks install claude` (#922): wire SigMap's session capture into
   * Claude Code's hooks.
   *
   * Which file. The command embeds an ABSOLUTE path to this install, so by default
   * it goes in `.claude/settings.local.json` — Claude Code's personal, uncommitted
   * settings file — rather than the committed `.claude/settings.json`, where one
   * machine's path would break every teammate's session. `shared: true` opts in to
   * the committed file anyway.
   *
   * Merge, never replace. The file is parsed, SigMap's own entries are added or
   * brought up to date, and every other key and hook is left exactly as found. A
   * file that is not valid JSON is refused, not overwritten.
   *
   * An entry is SigMap's when its command has the shape SigMap writes:
   * `node <entry> session hook <SessionStart|Stop|SessionEnd>`.
   *
   * Zero dependencies.
   */

  const fs = require('fs');
  const path = require('path');

  const EVENTS = ['SessionStart', 'SessionEnd'];
  const OPTIONAL_EVENTS = ['Stop'];
  // Documented SessionStart sources; the hook is useful on all of them.
  const START_MATCHER = 'startup|resume|clear|compact';
  // Seconds. The handler bounds its own work well inside this; it is the host's backstop.
  const TIMEOUT_S = 10;

  // The script path token: single-quoted (what we write; an embedded quote is `'\''`),
  // double-quoted, or bare.
  const OWN_COMMAND = /^\s*node\s+('(?:[^']|'\\'')*'|"[^"\n]*"|\S+)\s+session\s+hook\s+(SessionStart|Stop|SessionEnd)\s*$/;

  /**
   * POSIX single-quoting: nothing inside is expanded by the shell, so an install
   * path with a space, `$HOME`, a backtick or a quote reaches `node` intact. (Claude
   * Code runs hook commands through a POSIX shell, Git Bash on Windows.)
   */
  function shellQuote(text) {
    return `'${String(text).replace(/'/g, "'\\''")}'`;
  }

  function shellUnquote(token) {
    if (token[0] === "'") return token.slice(1, -1).replace(/'\\''/g, "'");
    if (token[0] === '"') {
      try { return JSON.parse(token); } catch (_) { return token.slice(1, -1); }
    }
    return token;
  }

  /** The command line registered for one event. */
  function hookCommand(scriptPath, event) {
    return `node ${shellQuote(path.resolve(scriptPath))} session hook ${event}`;
  }

  function isOwnCommand(cmd) {
    return typeof cmd === 'string' && OWN_COMMAND.test(cmd);
  }

  /** The entry script an own command runs; null when unreadable. */
  function scriptOf(cmd) {
    const m = typeof cmd === 'string' ? OWN_COMMAND.exec(cmd) : null;
    if (!m) return null;
    return shellUnquote(m[1]);
  }

  function targetFile(cwd, shared) {
    return path.join(cwd, '.claude', shared ? 'settings.json' : 'settings.local.json');
  }

  function _read(file) {
    if (!fs.existsSync(file)) return { settings: {}, exists: false };
    let settings;
    try { settings = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (e) { return { error: `${file} is not valid JSON (${e.message}); fix or remove it first` }; }
    if (!settings || typeof settings !== 'object' || Array.isArray(settings)) return { error: `${file} must contain a JSON object` };
    if (settings.hooks !== undefined && (!settings.hooks || typeof settings.hooks !== 'object' || Array.isArray(settings.hooks))) {
      return { error: `${file}: "hooks" must be an object` };
    }
    return { settings, exists: true };
  }

  /** Every `{group, hook}` own entry registered for an event. */
  function _ownEntries(settings, event) {
    const out = [];
    const groups = settings.hooks && Array.isArray(settings.hooks[event]) ? settings.hooks[event] : [];
    for (const group of groups) {
      if (!group || !Array.isArray(group.hooks)) continue;
      for (const hook of group.hooks) if (hook && isOwnCommand(hook.command)) out.push({ group, hook });
    }
    return out;
  }

  /**
   * Add (or bring up to date) SigMap's hooks.
   * @param {string} cwd
   * @param {string} scriptPath entry script the hooks should run
   * @param {{ stop?: boolean, shared?: boolean }} [opts]
   * @returns {{ path: string, changes: Array<{event:string, action:'added'|'updated'|'unchanged'}>, error?: string }}
   */
  function installClaudeHooks(cwd, scriptPath, opts = {}) {
    const file = targetFile(cwd, !!opts.shared);
    const read = _read(file);
    if (read.error) return { path: file, changes: [], error: read.error };
    const settings = read.settings;
    if (!settings.hooks) settings.hooks = {};
    const events = opts.stop ? EVENTS.concat(OPTIONAL_EVENTS) : EVENTS;
    const changes = [];
    for (const event of events) {
      const want = hookCommand(scriptPath, event);
      const own = _ownEntries(settings, event);
      if (own.length === 0) {
        if (!Array.isArray(settings.hooks[event])) settings.hooks[event] = [];
        const entry = { type: 'command', command: want, timeout: TIMEOUT_S };
        settings.hooks[event].push(event === 'SessionStart' ? { matcher: START_MATCHER, hooks: [entry] } : { hooks: [entry] });
        changes.push({ event, action: 'added' });
      } else if (own.every((e) => e.hook.command === want) && own.length === 1) {
        changes.push({ event, action: 'unchanged' });
      } else {
        // Bring the first up to date and drop any duplicate copies.
        own[0].hook.command = want;
        for (const dup of own.slice(1)) dup.group.hooks = dup.group.hooks.filter((h) => h !== dup.hook);
        changes.push({ event, action: 'updated' });
      }
    }
    if (changes.some((c) => c.action !== 'unchanged')) {
      fs.mkdirSync(path.dirname(file), { recursive: true });
      fs.writeFileSync(file, JSON.stringify(settings, null, 2) + '\n');
    }
    return { path: file, changes };
  }

  /**
   * Remove SigMap's hooks from both settings files, pruning only what becomes empty.
   * @returns {{ files: Array<{ path: string, removed: number }>, error?: string }}
   */
  function removeClaudeHooks(cwd) {
    const files = [];
    for (const shared of [false, true]) {
      const file = targetFile(cwd, shared);
      const read = _read(file);
      if (read.error) return { files, error: read.error };
      if (!read.exists || !read.settings.hooks) continue;
      const settings = read.settings;
      let removed = 0;
      for (const event of Object.keys(settings.hooks)) {
        const groups = settings.hooks[event];
        if (!Array.isArray(groups)) continue;
        for (const group of groups) {
          if (!group || !Array.isArray(group.hooks)) continue;
          const before = group.hooks.length;
          group.hooks = group.hooks.filter((h) => !(h && isOwnCommand(h.command)));
          removed += before - group.hooks.length;
        }
        settings.hooks[event] = groups.filter((g) => !(g && Array.isArray(g.hooks) && g.hooks.length === 0));
        if (settings.hooks[event].length === 0) delete settings.hooks[event];
      }
      if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
      if (removed > 0) {
        fs.writeFileSync(file, JSON.stringify(settings, null, 2) + '\n');
        files.push({ path: file, removed });
      }
    }
    return { files };
  }

  /**
   * What is wired, for `hooks status` and `doctor`.
   * @returns {{ wired: boolean, events: string[], files: object[], missingScript: string[] }}
   */
  function inspectClaudeHooks(cwd) {
    const files = [];
    const events = new Set();
    const missingScript = [];
    for (const shared of [false, true]) {
      const file = targetFile(cwd, shared);
      const read = _read(file);
      if (read.error) { files.push({ path: file, error: read.error }); continue; }
      if (!read.exists) continue;
      const found = [];
      for (const event of EVENTS.concat(OPTIONAL_EVENTS)) {
        for (const { hook } of _ownEntries(read.settings, event)) {
          found.push(event);
          events.add(event);
          const script = scriptOf(hook.command);
          if (script && !fs.existsSync(path.resolve(cwd, script))) missingScript.push(script);
        }
      }
      if (found.length) files.push({ path: file, events: found });
    }
    return {
      wired: events.has('SessionEnd') && events.has('SessionStart'),
      events: [...events], files, missingScript: [...new Set(missingScript)],
    };
  }

  module.exports = {
    EVENTS, OPTIONAL_EVENTS, START_MATCHER, TIMEOUT_S,
    hookCommand, shellQuote, shellUnquote, isOwnCommand, scriptOf, targetFile, installClaudeHooks, removeClaudeHooks, inspectClaudeHooks,
  };
  
};

// ── ./src/session/memory ──
__factories["./src/session/memory"] = function(module, exports) {
  
  const fs = require('fs');
  const path = require('path');

  module.exports = { loadSession, saveSession, mergeSessionContext, clearSession };

  const SESSION_TTL_MS = 4 * 60 * 60 * 1000;   // 4 hours — one coding session

  function sessionPath(cwd) {
    return path.join(cwd, '.context', 'session.json');
  }

  function loadSession(cwd) {
    const p = sessionPath(cwd);
    if (!fs.existsSync(p)) return null;
    try {
      const raw = JSON.parse(fs.readFileSync(p, 'utf8'));
      if (Date.now() - raw.ts > SESSION_TTL_MS) return null;  // expired
      return raw;
    } catch {
      return null;
    }
  }

  function saveSession(cwd, { intent, topFiles, query }) {
    const p = sessionPath(cwd);
    fs.mkdirSync(path.dirname(p), { recursive: true });
    fs.writeFileSync(p, JSON.stringify({
      ts: Date.now(),
      intent,
      topFiles,   // [{ file, score }] — top 5 from last ask
      lastQuery: query,
    }));
  }

  // Merge session context as additional ranking signal:
  // any file that appeared in the previous session's top-5 gets a +0.2 boost
  // Reduce to +0.1 if the intent has changed (topic switch guard)
  function mergeSessionContext(scores, session, currentIntent) {
    if (!session) return scores;

    const boostAmount = session.intent === currentIntent ? 0.20 : 0.10;
    const sessionBoost = new Map(session.topFiles.map(f => [f.file, boostAmount]));

    return scores.map(r => ({
      ...r,
      // Additive boost — cannot reduce a score
      score: r.score + (sessionBoost.get(r.file) || 0),
    }));
  }

  function clearSession(cwd) {
    const p = sessionPath(cwd);
    if (fs.existsSync(p)) fs.unlinkSync(p);
  }
  
};

// ── ./src/session/memory-inspect ──
__factories["./src/session/memory-inspect"] = function(module, exports) {
  
  /**
   * memory-inspect.js — one view over SigMap's existing cross-session stores.
   * No new storage: reads the JSON/NDJSON files the session, notes, weights,
   * evidence, and tracking modules already own under `.context/`.
   */

  const fs = require('fs');
  const path = require('path');

  /** store name → { file, kind } (kind drives the entry count). */
  const STORES = {
    session: { file: 'session.json', kind: 'json' },
    notes: { file: 'notes.ndjson', kind: 'ndjson' },
    weights: { file: 'weights.json', kind: 'weights' },
    evidence: { file: 'evidence-pack.json', kind: 'json' },
    gain: { file: 'gain.ndjson', kind: 'ndjson' },
    usage: { file: 'usage.ndjson', kind: 'ndjson' },
  };

  /** Stores `clearMemory` may delete ('gain'/'usage' have their own reset flows). */
  const CLEARABLE = ['session', 'notes', 'weights', 'evidence'];

  function storePath(cwd, name) {
    return path.join(cwd, '.context', STORES[name].file);
  }

  function countEntries(kind, filePath) {
    try {
      if (kind === 'ndjson') {
        return fs.readFileSync(filePath, 'utf8').split('\n').filter(Boolean).length;
      }
      if (kind === 'weights') {
        const w = JSON.parse(fs.readFileSync(filePath, 'utf8'));
        return Object.keys((w && w.files) || w || {}).length;
      }
      return 1; // json: a single snapshot object
    } catch (_) {
      return 0;
    }
  }

  /**
   * Describe every cross-session store.
   * @param {string} cwd
   * @returns {Array<{store:string, path:string, exists:boolean, entries:number, bytes:number, modified:string|null, clearable:boolean}>}
   */
  function inspectMemory(cwd) {
    return Object.entries(STORES).map(([store, { file, kind }]) => {
      const p = storePath(cwd, store);
      let stat = null;
      try { stat = fs.statSync(p); } catch (_) {}
      return {
        store,
        path: path.join('.context', file),
        exists: !!stat,
        entries: stat ? countEntries(kind, p) : 0,
        bytes: stat ? stat.size : 0,
        modified: stat ? new Date(stat.mtimeMs).toISOString() : null,
        clearable: CLEARABLE.includes(store),
      };
    });
  }

  /**
   * Delete one clearable store (or 'all' clearable stores).
   * @param {string} cwd
   * @param {string} store - session|notes|weights|evidence|all
   * @returns {string[]} names of stores actually removed
   */
  function clearMemory(cwd, store) {
    const targets = store === 'all' ? CLEARABLE : [store];
    for (const t of targets) {
      if (!CLEARABLE.includes(t)) {
        throw new Error(`unknown or protected store "${t}" — clearable: ${CLEARABLE.join(', ')}, all`);
      }
    }
    const removed = [];
    for (const t of targets) {
      try { fs.unlinkSync(storePath(cwd, t)); removed.push(t); } catch (_) {}
    }
    return removed;
  }

  module.exports = { inspectMemory, clearMemory, STORES, CLEARABLE };
  
};

// ── ./src/session/note-relevance ──
__factories["./src/session/note-relevance"] = function(module, exports) {
  
  /**
   * Notes as a retrieval signal (#776).
   *
   * `sigmap note` writes human-authored facts to `.context/notes.ndjson`, and
   * until now nothing in the retrieval path read them: every `readNotes` call
   * site was the `note` command listing its own notes, `status` counting them, or
   * the MCP `read_memory` tool. A note saying "the redaction logic lives in
   * src/security/patterns.js" could not influence a query about redaction — the
   * one thing a decision log is for.
   *
   * This module turns notes into a bounded, relevance-gated signal:
   *   - a note is considered only if it shares substantive vocabulary with the query
   *   - a relevant note boosts the files whose paths it names
   *   - relevant notes are rendered into the emitted context so the agent sees them
   *
   * Deliberately inert when no notes exist, so a repo that never ran `note` —
   * including every benchmark repo — produces byte-identical ranking.
   *
   * Deterministic, offline, zero dependencies. Reuses the ranker's tokenizer so
   * notes and queries are tokenized the same way the index is.
   */

  const { tokenize } = __require('./src/retrieval/bm25');

  /** Most recent notes considered for a single query. */
  const MAX_NOTES = 20;

  /**
   * Minimum share of a note's tokens that must also appear in the query.
   *
   * Gated rather than unconditional: appending every note to every answer would
   * make notes noise, and the issue's own criterion is that notes must not leak
   * into unrelated queries.
   */
  const RELEVANCE_FLOOR = 0.2;

  /**
   * Share of the query's own top score granted to a file a relevant note names.
   *
   * Relative, not a fixed constant: observed scores span roughly 4–30 depending
   * on the query and repo, so any absolute number would be decisive on one query
   * and invisible on another. Scaling by the top score makes the boost mean the
   * same thing everywhere — "worth about half of the best hit, weighted by how
   * well the note matches".
   *
   * It is ADDITIVE rather than multiplicative because a multiplier cannot lift a
   * zero-scoring file, and zero is exactly the case a note is most valuable in:
   * the ranker found no lexical overlap and a human already knew the answer. The
   * `max(top, 1)` floor keeps that case working when every score is 0.
   */
  const NOTE_BOOST = 0.5;

  /** Path-shaped tokens inside a note, e.g. `src/security/patterns.js`. */
  const PATH_RE = /\b[\w.@-]+(?:\/[\w.@-]+)+\.[A-Za-z0-9]+\b/g;

  /**
   * Overlap between a note and a query, as a share of the note's own tokens.
   *
   * Normalizing by the note (not the query) keeps a long note from scoring highly
   * just for being long, and lets a short, pointed note match strongly.
   *
   * @returns {number} 0–1
   */
  function relevance(noteText, queryTokens) {
    const noteTokens = tokenize(noteText || '');
    if (noteTokens.length === 0 || queryTokens.size === 0) return 0;
    let hits = 0;
    for (const t of noteTokens) if (queryTokens.has(t)) hits++;
    return Math.round((hits / noteTokens.length) * 1000) / 1000;
  }

  /** Repo-relative paths a note mentions. */
  function pathsIn(noteText) {
    return [...new Set(String(noteText || '').match(PATH_RE) || [])];
  }

  /**
   * Select the notes relevant to a query.
   *
   * @param {object[]} notes  entries from `readNotes` (chronological)
   * @param {string} query
   * @returns {Array<{text:string, ts:string, branch:string|null, score:number, paths:string[]}>}
   *          most relevant first; empty when nothing clears the floor
   */
  function selectRelevant(notes, query) {
    if (!Array.isArray(notes) || notes.length === 0 || !query) return [];
    const queryTokens = new Set(tokenize(query));
    if (queryTokens.size === 0) return [];

    const recent = notes.slice(-MAX_NOTES);
    const scored = [];
    for (const n of recent) {
      const score = relevance(n && n.text, queryTokens);
      if (score < RELEVANCE_FLOOR) continue;
      scored.push({
        text: n.text,
        ts: n.ts || '',
        branch: n.branch || null,
        score,
        paths: pathsIn(n.text),
      });
    }
    // Most relevant first; ties broken by recency (later ts wins), then text, so
    // the order is total and reproducible.
    scored.sort((a, b) => b.score - a.score || String(b.ts).localeCompare(String(a.ts)) || a.text.localeCompare(b.text));
    return scored;
  }

  /**
   * Re-order ranked results so files named by a relevant note rise.
   *
   * Applied AFTER ranking rather than inside `rank()` so the scoring core stays
   * free of session state and the benchmark harness is unaffected.
   *
   * @param {Array<{file:string, score:number}>} ranked
   * @param {Array<{paths:string[]}>} relevantNotes
   * @returns {Array} a new array; the input is not mutated
   */
  function applyNoteBoost(ranked, relevantNotes) {
    if (!Array.isArray(ranked) || ranked.length === 0) return ranked;
    if (!Array.isArray(relevantNotes) || relevantNotes.length === 0) return ranked;

    const named = new Set();
    for (const n of relevantNotes) for (const p of n.paths || []) named.add(p.replace(/^\.\//, ''));
    if (named.size === 0) return ranked;

    const matches = (file) => {
      const f = String(file).replace(/\\/g, '/');
      for (const p of named) {
        if (f === p || f.endsWith('/' + p) || p.endsWith('/' + f)) return true;
      }
      return false;
    };

    // Best note relevance per named path, so a strongly-matching note lifts more
    // than a marginal one.
    const weightFor = (file) => {
      let best = 0;
      for (const n of relevantNotes) {
        for (const p of (n.paths || [])) {
          const q = p.replace(/^\.\//, '');
          const f = String(file).replace(/\\/g, '/');
          if (f === q || f.endsWith('/' + q) || q.endsWith('/' + f)) {
            if (n.score > best) best = n.score;
          }
        }
      }
      return best;
    };

    const top = ranked.reduce((m, r) => (typeof r.score === 'number' && r.score > m ? r.score : m), 0);
    const scale = Math.max(top, 1);

    const out = ranked.map((r) => {
      if (!matches(r.file)) return r;
      const gain = scale * NOTE_BOOST * weightFor(r.file);
      return Object.assign({}, r, {
        score: Math.round((r.score + gain) * 1000) / 1000,
        signals: Object.assign({}, r.signals, { noteBoost: Math.round(gain * 1000) / 1000 }),
      });
    });
    out.sort((a, b) => b.score - a.score || String(a.file).localeCompare(String(b.file)));
    return out;
  }

  /** Render relevant notes as a `## Notes` context section, or '' when there are none. */
  function formatNotesSection(relevantNotes) {
    if (!Array.isArray(relevantNotes) || relevantNotes.length === 0) return '';
    const lines = ['## Notes', '', '_Human-authored notes matching this query (`sigmap note`)._', ''];
    for (const n of relevantNotes) {
      const when = String(n.ts).replace('T', ' ').slice(0, 16);
      const br = n.branch ? ` (${n.branch})` : '';
      lines.push(`- [${when}${br}] ${n.text}`);
    }
    lines.push('');
    return lines.join('\n');
  }

  module.exports = {
    selectRelevant,
    applyNoteBoost,
    formatNotesSection,
    relevance,
    pathsIn,
    MAX_NOTES,
    RELEVANCE_FLOOR,
    NOTE_BOOST,
  };
  
};

// ── ./src/session/notes ──
__factories["./src/session/notes"] = function(module, exports) {
  
  /**
   * Decision-log notes (Memory, v6.15.0).
   *
   * A tiny append-only log of human/agent notes that survives across sessions,
   * so an agent starting cold can recall "what were we doing / why". Stored as
   * NDJSON under `.context/` to match the project's other state logs
   * (usage.ndjson, benchmark-history.ndjson). Zero dependencies.
   *
   * Consumed by the `read_memory` MCP tool and the `sigmap note` / `sigmap status`
   * commands. Complements `src/session/memory.js` (ranking session) rather than
   * duplicating it.
   */

  const fs = require('fs');
  const path = require('path');
  const { tryGit } = __require('./src/util/git');

  const NOTES_FILE = path.join('.context', 'notes.ndjson');
  const MAX_TEXT = 2000;

  function notesPath(cwd) {
    return path.join(cwd, NOTES_FILE);
  }

  function _currentBranch(cwd) {
    return tryGit(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd }) || null;
  }

  /**
   * Append a note. Returns the stored entry.
   * @param {string} cwd
   * @param {string} text
   * @param {object} [opts]
   * @param {string|null} [opts.branch]  override branch (default: current git branch)
   * @param {string} [opts.tag]          optional category tag
   */
  function addNote(cwd, text, opts = {}) {
    const clean = String(text == null ? '' : text).trim().slice(0, MAX_TEXT);
    if (!clean) throw new Error('note text is empty');
    const entry = {
      ts: new Date().toISOString(),
      text: clean,
      branch: opts.branch !== undefined ? opts.branch : _currentBranch(cwd),
    };
    if (opts.tag) entry.tag = String(opts.tag).trim().slice(0, 40);
    const p = notesPath(cwd);
    fs.mkdirSync(path.dirname(p), { recursive: true });
    fs.appendFileSync(p, JSON.stringify(entry) + '\n');
    return entry;
  }

  /**
   * Read notes in chronological order (oldest first).
   * @param {string} cwd
   * @param {number} [limit=0]  keep only the most recent N (0 = all)
   * @returns {object[]}
   */
  function readNotes(cwd, limit = 0) {
    let raw;
    try { raw = fs.readFileSync(notesPath(cwd), 'utf8'); }
    catch (_) { return []; }
    const out = [];
    for (const line of raw.split('\n')) {
      const t = line.trim();
      if (!t) continue;
      try { out.push(JSON.parse(t)); } catch (_) { /* skip corrupt line */ }
    }
    if (limit > 0 && out.length > limit) return out.slice(out.length - limit);
    return out;
  }

  /** Format notes as a Markdown list (pass already-ordered notes). */
  function formatNotes(notes) {
    if (!notes || !notes.length) {
      return 'No notes recorded yet. Add one with: sigmap note "<text>"';
    }
    return notes.map((n) => {
      const when = String(n.ts || '').replace('T', ' ').slice(0, 16);
      const br = n.branch ? ` (${n.branch})` : '';
      const tag = n.tag ? ` #${n.tag}` : '';
      return `- [${when}${br}]${tag} ${n.text}`;
    }).join('\n');
  }

  /** Delete the notes log. Returns true if a file was removed. */
  function clearNotes(cwd) {
    try { fs.unlinkSync(notesPath(cwd)); return true; }
    catch (_) { return false; }
  }

  module.exports = { notesPath, addNote, readNotes, formatNotes, clearNotes };
  
};

// ── ./src/session/render ──
__factories["./src/session/render"] = function(module, exports) {
  
  /**
   * Rendering for `sigmap session list|show`, the `budget` measured block (#922) and
   * the sessions report (#951).
   *
   * Wording is part of the contract: the numbers are per-request BILLING
   * categories (input, output, cache read, cache write). They are never called
   * "context size", every row carries its provenance label, an unreadable usage
   * prints as unavailable, a category the agent never reported prints as n/a (not
   * 0), and totals are only summed within one provenance class — a partial sum is
   * shown as a floor (`≥`). Measured rows cover the main conversation only, and
   * the output says so wherever those numbers appear.
   *
   * Every string that came from a transcript or the store file is cleaned of
   * control characters before it is printed.
   */

  const { PROVENANCE, cleanStr, cleanIso, mergeUsage, usageOf } = __require('./src/session/store');

  const NOTE = 'billed tokens per request category — not context size';
  const COVERAGE_NOTE = 'measured = read from the agent\'s own transcript, main conversation only (subagent transcripts are not read)';
  const NA_NOTE = 'n/a = the agent did not report that category (it is not zero)';

  function _n(v) {
    return Number(v).toLocaleString('en-US');
  }

  function _when(ts) {
    const t = cleanIso(ts);
    return t ? t.slice(0, 16).replace('T', ' ') + 'Z' : 'unknown';
  }

  function _s(v, max) {
    return cleanStr(v, max || 40) || 'unknown';
  }

  function _cat(label, v, floor) {
    if (v === null || v === undefined) return `${label} n/a`;
    return `${label} ${floor ? '≥' : ''}${_n(v)}`;
  }

  /**
   * `in 1 · out 2 · cache read 3 · cache write 4`, or `unavailable`.
   * `unreported` (from a sum) marks categories some contributor did not report,
   * which makes that figure a floor.
   */
  function formatUsage(usage, unreported) {
    if (!usage) return 'unavailable';
    const part = new Set(unreported || []);
    return [
      _cat('in', usage.in, part.has('in')),
      _cat('out', usage.out, part.has('out')),
      _cat('cache read', usage.cacheRead, part.has('cacheRead')),
      _cat('cache write', usage.cacheWrite, part.has('cacheWrite')),
    ].join(' · ');
  }

  /**
   * Sum sessions that HAVE usage, one bucket per provenance class.
   * @returns {Object<string, { sessions: number, usage: object, unreported: string[] }>}
   */
  function totalsByProvenance(sessions) {
    const acc = {};
    for (const s of sessions) {
      const u = usageOf(s);
      if (!u) continue;
      const label = PROVENANCE[s.source];
      const b = acc[label] || (acc[label] = { sessions: 0, acc: null });
      b.sessions++;
      b.acc = mergeUsage(b.acc, u);
    }
    const out = {};
    for (const [label, b] of Object.entries(acc)) out[label] = { sessions: b.sessions, usage: b.acc.usage, unreported: b.acc.unreported };
    return out;
  }

  function _state(s) {
    if (s.partial) return 'partial';
    return s.ended ? 'ended' : 'open';
  }

  function renderList(sessions, rollups, info = {}) {
    const lines = [`[sigmap] ${sessions.length} session${sessions.length === 1 ? '' : 's'} (${NOTE})`];
    for (const s of sessions) {
      lines.push(`  ${_s(s.id, 60)}  ${_s(s.agent, 20).padEnd(11)} ${_when(s.startedAt)}  ${_state(s).padEnd(7)} ${_s(s.model)}  [${s.provenance}]  ${formatUsage(s.usage)}`);
    }
    const totals = totalsByProvenance(sessions);
    for (const [label, t] of Object.entries(totals)) {
      lines.push(`  total [${label}] ${t.sessions} session${t.sessions === 1 ? '' : 's'}: ${formatUsage(t.usage, t.unreported)}`);
    }
    if (Object.keys(totals).length > 1) lines.push('  (provenance classes are never summed into one total)');
    if (sessions.some((s) => s.source === 'transcript')) lines.push(`  ${COVERAGE_NOTE}`);
    if (sessions.some((s) => s.usage && (s.usage.cacheRead === null || s.usage.cacheWrite === null))) lines.push(`  ${NA_NOTE}`);
    if (rollups.length) lines.push(`  ${rollups.length} monthly rollup${rollups.length === 1 ? '' : 's'} of older sessions (see --json)`);
    if (info.corrupt) lines.push(`  skipped ${info.corrupt} unreadable line${info.corrupt === 1 ? '' : 's'} in .context/sessions.ndjson`);
    return lines.join('\n');
  }

  function renderShow(s) {
    const lines = [
      `[sigmap] session ${_s(s.id, 60)}`,
      `  agent       ${_s(s.agent, 20)}${s.ci ? ' (ci)' : ''}`,
      `  branch      ${_s(s.branch, 120)}`,
      `  started     ${_when(s.startedAt)}`,
      `  ended       ${s.ended ? `${_when(s.endedAt)}${s.endReason ? ` (${_s(s.endReason)})` : ''}` : 'not closed'}`,
      `  model       ${_s(s.model, 80)}${s.models ? ` (${Object.keys(s.models).map((m) => _s(m, 80)).join(', ')})` : ''}`,
      `  provenance  ${s.provenance}`,
      `  usage       ${formatUsage(s.usage)}   (${NOTE})`,
    ];
    if (s.partial) lines.push('  note        the transcript read stopped early; totals cover what was read');
    if (s.cacheGaps) lines.push(`  note        ${s.cacheGaps} message${s.cacheGaps === 1 ? '' : 's'} did not report a cache category; the figure sums the ones that did`);
    if (s.parseErrors) lines.push(`  parse       ${s.parseErrors} unreadable transcript line${s.parseErrors === 1 ? '' : 's'} skipped`);
    if (s.coverage) lines.push(`  coverage    ${_s(s.coverage, 20)} conversation only (subagent transcripts are not read)`);
    lines.push(`  queries     ${s.queries.length}`);
    lines.push(`  events      ${s.events}`);
    return lines.join('\n');
  }

  function _pl(n, word) {
    return `${_n(n)} ${word}${n === 1 ? '' : 's'}`;
  }

  function _dur(ms) {
    if (ms === null || ms === undefined || !Number.isFinite(ms)) return '—';
    const s = Math.round(ms / 1000);
    if (s < 60) return `${s}s`;
    const m = Math.floor(s / 60);
    if (m < 60) return `${m}m`;
    return `${Math.floor(m / 60)}h${String(m % 60).padStart(2, '0')}m`;
  }

  function _usd(n) {
    return n < 0.01 ? n.toFixed(4) : n.toFixed(2);
  }

  /** A session's cost: a floor that cites the table's date, or `n/a` with the reason. */
  function costText(cost, asOf) {
    if (!cost || cost.usd === null) return `n/a${cost && cost.why ? ` (${_s(cost.why, 80)})` : ''}`;
    return `≥ $${_usd(cost.usd)} (table as of ${_s(asOf, 12)})`;
  }

  /** A provenance class's cost: the priced sessions' floor, saying how many were priced. */
  function classCostText(t, asOf) {
    if (t.withUsage === 0) return 'n/a (no usage)';
    if (t.cost.usd === null) return `n/a (no priced session of ${t.withUsage})`;
    const part = t.cost.unpriced ? `${t.cost.priced} of ${t.withUsage} sessions priced; ` : '';
    return `≥ $${_usd(t.cost.usd)} (${part}table as of ${_s(asOf, 12)})`;
  }

  function _classLine(label, t, asOf) {
    const usage = t.usage ? formatUsage(t.usage, t.unreported) : 'unavailable';
    const withUsage = t.withUsage < t.sessions ? ` (${t.withUsage} with usage)` : '';
    return `[${label}] ${_pl(t.sessions, 'session')}${withUsage}: ${usage} · cost ${classCostText(t, asOf)}`;
  }

  /**
   * Render a `session/report.buildReport` result for the terminal.
   *
   * One line of totals per provenance class and no line that adds classes
   * together. Every dollar figure cites the pricing table's date, and every cost
   * is a floor (the table prices input tokens only).
   */
  function renderReport(r) {
    const n = r.sessions.length;
    const asOf = r.pricing.asOf;
    const lines = [`[sigmap] sessions report — ${_pl(n, 'session')} (${NOTE})`];
    if (n === 0) lines.push('  no sessions recorded yet — capture them with: sigmap hooks install claude');

    for (const s of r.sessions) {
      lines.push(`  ${_s(s.id, 60)}  ${_s(s.agent, 20)}  ${_when(s.startedAt)}  ${_dur(s.durationMs)}  ${_s(s.branch, 60)}  ${_s(s.model)}`);
      lines.push(`    [${s.provenance}] ${formatUsage(s.usage)}`);
      lines.push(`    cost ${costText(s.cost, asOf)}`);
    }

    if (n > 0) {
      lines.push('', '  totals — one line per provenance class; classes are never summed together');
      for (const [label, t] of Object.entries(r.totals)) lines.push(`    ${_classLine(label, t, asOf)}`);
      lines.push('', '  by branch');
      for (const b of r.branches) {
        lines.push(`    ${_s(b.branch, 60)}`);
        for (const [label, t] of Object.entries(b.classes)) lines.push(`      ${_classLine(label, t, asOf)}`);
      }
    }

    if (r.savings) {
      lines.push('', `  SigMap savings [${r.savings.provenance}]: ${_pl(r.savings.runs, 'logged run')} since ${_when(r.savings.since)} `
        + `saved ~${_n(r.savings.savedTokens)} tokens — not attributed to a session`);
    }

    lines.push('', '  coverage — what each agent can report (declared, not inferred)');
    for (const c of r.coverage) {
      lines.push(`    ${_s(c.text, 600)}${c.sessions ? `  [${_pl(c.sessions, 'session')} here]` : ''}`);
    }

    lines.push('', `  pricing ${_s(r.pricing.label, 80)}${r.pricing.stale ? ` — ⚠ ${r.pricing.days} days old; correct it under \`models\` in the config` : ''}`);
    lines.push(`  ${r.notes.cost}`);
    if (r.savings) lines.push(`  ${r.savings.note}`);
    if (r.sessions.some((s) => s.source === 'transcript')) lines.push(`  ${COVERAGE_NOTE}`);
    if (r.sessions.some((s) => s.usage && (s.usage.cacheRead === null || s.usage.cacheWrite === null))) lines.push(`  ${NA_NOTE}`);
    if (r.rollups) lines.push(`  ${_pl(r.rollups, 'monthly rollup')} of older sessions are not in this report`);
    if (r.corrupt) lines.push(`  skipped ${_pl(r.corrupt, 'unreadable line')} in .context/sessions.ndjson`);
    return lines.join('\n');
  }

  /** The `measured` block `budget` adds for a session found in the store. */
  function measuredBlock(session) {
    return {
      session: session.id,
      provenance: session.provenance,
      source: session.source,
      model: session.model,
      partial: session.partial,
      coverage: session.coverage || null,
      usage: session.usage,
      note: session.coverage === 'main' ? `${NOTE}; main conversation only` : NOTE,
    };
  }

  module.exports = { NOTE, COVERAGE_NOTE, NA_NOTE, formatUsage, totalsByProvenance, renderList, renderShow, renderReport, costText, classCostText, when: _when, duration: _dur, measuredBlock };
  
};

// ── ./src/session/report ──
__factories["./src/session/report"] = function(module, exports) {
  
  /**
   * The sessions report (#951, SI-4): the data behind `sigmap --report --sessions`
   * and the dashboard's sessions panel. Pure — it reads the store, the pricing
   * profile and the gain log, and returns plain data; `render.renderReport` and the
   * dashboard turn it into text and HTML.
   *
   * The epic's correctness contract (#682) is enforced here, not described:
   *
   *   - Usage is only ever merged by `sumClass`, which takes ONE provenance class
   *     and throws on a row of another. There is no grand total anywhere in the
   *     result, so no renderer can print one by accident (guard-tested: this file
   *     calls `mergeUsage` in exactly one place).
   *   - Cost is a FLOOR. The pricing profile carries a verified standard INPUT
   *     price per model and nothing else — no output or cache price — so only the
   *     `in` category is priced and every figure says so. A model that is not in
   *     the table is "unpriced", never $0.
   *   - SigMap's own savings are `modeled` and are not attributed to a session:
   *     the gain log keys a run by a day bucket or SIGMAP_SESSION, never by an
   *     agent's session id, so a time-window join would credit every overlapping
   *     session with the same savings.
   *   - Unknown is unknown: a session with no usage has no cost, a duration of an
   *     unclosed session is `null`, and nothing is rendered as zero.
   *
   * Zero dependencies.
   */

  const store = __require('./src/session/store');
  const capabilities = __require('./src/session/capabilities');

  const COST_NOTE = 'cost = input tokens × the pricing table\'s standard input price; output and cache tokens are not priced '
    + '(the profile carries no verified price for them), so every cost is a floor';
  const SAVINGS_NOTE = 'SigMap savings are modeled (baseline − emitted, chars/4) and are not attributable to a session: '
    + 'the gain log carries no agent session id';

  // A duration is only known when the record's start is the session's start. A transcript
  // carries that (the SessionStart hook, or its first message). An agent-reported or CI
  // record's "start" is the moment of the first report, so its span is not the session's
  // length — unknown, never `0s`.
  function _durationMs(s) {
    if (s.source !== 'transcript' || !s.ended) return null;
    const a = store.tsMs(s.startedAt);
    const b = store.tsMs(s.endedAt);
    if (Number.isNaN(a) || Number.isNaN(b) || b < a) return null;
    return b - a;
  }

  /**
   * The input-priced floor of one session, or why there is none.
   * A mixed-model session prices each named model's own input tokens; tokens of a
   * message that named no model stay unpriced, so the figure remains a floor.
   *
   * @returns {{ usd: number|null, pricedIn: number, partial: boolean, why: string|null }}
   */
  function costOf(session, profile, models) {
    const u = session.usage;
    if (!u) return { usd: null, pricedIn: 0, partial: false, why: 'usage unavailable' };
    const parts = session.model === 'mixed' && session.models
      ? Object.entries(session.models).map(([name, m]) => [name, m && m.in])
      : [[session.model, u.in]];
    let usd = 0;
    let pricedIn = 0;
    let any = false;
    const missing = [];
    for (const [name, tokens] of parts) {
      const hit = models.lookup(profile, name);
      if (!hit || hit.model.inputPerMtok == null || !Number.isFinite(tokens)) { missing.push(name); continue; }
      usd += tokens * hit.model.inputPerMtok / 1e6;
      pricedIn += tokens;
      any = true;
    }
    if (!any) {
      const named = missing.filter((n) => n && n !== 'unknown' && n !== 'mixed');
      return {
        usd: null, pricedIn: 0, partial: false,
        why: named.length ? `${named.join(', ')} is not in the pricing table` : 'the model is not known',
      };
    }
    return { usd, pricedIn, partial: pricedIn < u.in, why: null };
  }

  /**
   * Sum one provenance class. The ONLY place usage is merged: a row of another
   * class is an error, never a quiet addition.
   */
  function sumClass(label, rows) {
    let acc = null;
    let usd = 0;
    let priced = 0;
    let unpriced = 0;
    let withUsage = 0;
    for (const r of rows) {
      if (r.provenance !== label) {
        throw new Error(`cannot sum a "${r.provenance}" session into the "${label}" class`);
      }
      const u = store.usageOf(r);
      if (!u) continue;
      withUsage++;
      acc = store.mergeUsage(acc, u);
      if (r.cost.usd === null) unpriced++;
      else { usd += r.cost.usd; priced++; }
    }
    return {
      provenance: label,
      sessions: rows.length,
      withUsage,
      usage: acc ? acc.usage : null,
      unreported: acc ? acc.unreported : [],
      cost: { usd: priced ? usd : null, priced, unpriced },
    };
  }

  /** One bucket per provenance class present in `rows`, keys in sorted order. */
  function perClass(rows) {
    const groups = new Map();
    for (const r of rows) {
      if (!groups.has(r.provenance)) groups.set(r.provenance, []);
      groups.get(r.provenance).push(r);
    }
    const out = {};
    for (const label of [...groups.keys()].sort()) out[label] = sumClass(label, groups.get(label));
    return out;
  }

  function _savings(cwd, rows, readGain) {
    const starts = rows.map((r) => store.tsMs(r.startedAt)).filter((t) => !Number.isNaN(t));
    if (starts.length === 0) return null;
    const since = Math.min(...starts);
    let runs = 0;
    let saved = 0;
    for (const e of readGain(cwd)) {
      const t = Date.parse(e && e.ts);
      if (!Number.isFinite(t) || t < since) continue;
      if (!Number.isFinite(e.savedTokens) || e.savedTokens < 0) continue;
      runs++;
      saved += e.savedTokens;
    }
    if (runs === 0) return null;
    return { provenance: 'modeled', runs, savedTokens: saved, since: new Date(since).toISOString(), note: SAVINGS_NOTE };
  }

  /**
   * Build the report.
   *
   * @param {string} cwd
   * @param {{ config?: object, limit?: number, agent?: string|null, now?: number }} [opts]
   * @returns {{
   *   sessions: object[], totals: object, branches: object[], savings: object|null,
   *   coverage: object[], pricing: object, notes: object, rollups: number, corrupt: number
   * }}
   */
  function buildReport(cwd, opts = {}) {
    const models = __require('./src/config/models');
    const profile = models.resolveProfile(opts.config || {});
    const limit = Number.isFinite(opts.limit) && opts.limit > 0 ? opts.limit : 20;
    const all = store.readSessions(cwd);
    const picked = opts.agent ? all.sessions.filter((s) => s.agent === opts.agent) : all.sessions;

    const rows = picked.slice(-limit).map((s) => ({
      id: s.id,
      agent: s.agent,
      branch: s.branch || null,
      startedAt: s.startedAt,
      durationMs: _durationMs(s),
      state: s.partial ? 'partial' : (s.ended ? 'ended' : 'open'),
      model: s.model,
      provenance: s.provenance,
      source: s.source,
      usage: s.usage,
      cost: costOf(s, profile, models),
    }));

    const byBranch = new Map();
    for (const r of rows) {
      const key = r.branch || 'unknown';
      if (!byBranch.has(key)) byBranch.set(key, []);
      byBranch.get(key).push(r);
    }
    const branches = [...byBranch.keys()].sort().map((branch) => ({
      branch, sessions: byBranch.get(branch).length, classes: perClass(byBranch.get(branch)),
    }));

    const seen = new Map();
    for (const r of rows) seen.set(r.agent, (seen.get(r.agent) || 0) + 1);
    const coverage = capabilities.DECLARATIONS.map((d) => ({
      agent: d.agent, name: d.name, text: capabilities.describe(d), can: capabilities.labelsOf(d), sessions: seen.get(d.agent) || 0,
    }));
    for (const [agent, n] of [...seen.entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
      if (!agent || capabilities.forAgent(agent)) continue;
      coverage.push({ agent, name: agent, text: capabilities.describeUndeclared(agent), can: [], sessions: n });
    }

    const age = models.profileAge(profile, opts.now);
    const readGain = typeof opts.readGain === 'function' ? opts.readGain : __require('./src/tracking/logger').readGainLog;
    return {
      sessions: rows,
      totals: perClass(rows),
      branches,
      savings: _savings(cwd, rows, readGain),
      coverage,
      pricing: { asOf: profile.asOf, asOfSource: profile.asOfSource, label: models.asOfLabel(profile), days: age.days, stale: age.stale },
      notes: { usage: __require('./src/session/render').NOTE, cost: COST_NOTE },
      rollups: all.rollups.length,
      corrupt: all.corrupt || 0,
    };
  }

  module.exports = { buildReport, sumClass, perClass, costOf, COST_NOTE, SAVINGS_NOTE };
  
};

// ── ./src/session/store ──
__factories["./src/session/store"] = function(module, exports) {
  
  /**
   * Session store (#922, SI-2 of the Session Intelligence epic #682).
   *
   * `.context/sessions.ndjson` is an APPEND-ONLY, event-sourced log. Several agents
   * (and a CI job) may write it at once, so an upsert-in-place record would race;
   * instead every writer appends one self-contained line with a single O_APPEND
   * write, and readers FOLD the lines by session id.
   *
   * Event kinds
   *   start   a session began                       {agent, branch, source}
   *   usage   billed token totals so far            {source, model, usage, offset, ...}
   *   end     a session ended                       {reason}
   *   query   one `sigmap ask` during the session   {q | qh, files}
   *   rollup  written only by compaction            {month, agent, model, source, sessions, usage}
   *
   * Correctness contract (binding, from #682)
   *   - every number carries a provenance (`source`); totals are only ever summed
   *     within one provenance class, never blended;
   *   - unknown stays unknown: a session whose usage could not be read has
   *     `usage: null`, and a category an agent did not report is `null`, never 0;
   *   - token sums are per-request BILLING categories (in / out / cache read /
   *     cache write) — they are not "context size" and no output calls them that.
   *
   * A `usage` event carries CUMULATIVE totals (counted once per message) up to a
   * transcript byte `offset`; the fold keeps the event with the highest offset.
   * That makes a Stop + SessionEnd double-fire, or two parsers racing, idempotent:
   * both write the same totals and the fold takes one of them.
   *
   * The fold is order-independent: every field that can differ between lines is
   * decided by the event's own timestamp (ties: the later line), never by file order.
   *
   * Everything read back from the file is treated as untrusted text (a transcript
   * field ends up in it): strings are stripped of control characters and capped
   * before they reach a terminal, a summary, or an instruction file.
   *
   * Zero dependencies; local files only.
   */

  const fs = require('fs');
  const path = require('path');
  const crypto = require('crypto');
  const { redactText } = __require('./src/security/redact');

  const SCHEMA = 1;
  const STORE_FILE = path.join('.context', 'sessions.ndjson');
  const LOCK_FILE = path.join('.context', 'sessions.lock');
  const LOCK_STALE_MS = 30000;
  // A single write() of a short line is not interleaved with other appenders'.
  // Keeping events small is what keeps that true, so oversize is refused.
  const MAX_EVENT_BYTES = 4000;
  const MAX_QUERY_CHARS = 200;
  const MAX_TAIL_PASSES = 20;

  const KINDS = ['start', 'usage', 'end', 'query', 'rollup'];
  const CATEGORIES = ['in', 'out', 'cacheRead', 'cacheWrite'];
  // A host that has no notion of caching may leave these unreported; in/out always count.
  const OPTIONAL_CATEGORIES = ['cacheRead', 'cacheWrite'];
  const SOURCES = ['transcript', 'agent-reported', 'estimate', 'unavailable'];
  // Only used to break a tie between two usage events at the same offset.
  const SOURCE_RANK = { transcript: 3, 'agent-reported': 2, estimate: 1, unavailable: 0 };
  const PROVENANCE = {
    transcript: 'measured',
    'agent-reported': 'agent-reported',
    estimate: 'estimated (chars/4 ±5%)',
    unavailable: 'unavailable',
  };
  const PREFIXES = {
    'claude-code': 'cc', cursor: 'cur', codex: 'cod', ci: 'ci',
    copilot: 'cop', gemini: 'gem', windsurf: 'win', opencode: 'oc',
  };

  const DEFAULT_RETENTION_DAYS = 90;
  const LOG_QUERY_MODES = ['full', 'hashed', 'off'];

  function storePath(cwd) {
    return path.join(cwd, STORE_FILE);
  }

  function tsMs(ts) {
    const n = typeof ts === 'string' ? Date.parse(ts) : NaN;
    return Number.isFinite(n) ? n : NaN;
  }

  /**
   * A string safe to print, store and embed: control characters (including ESC and
   * newlines) become spaces, whitespace collapses, and the length is capped.
   * Returns null for anything that is not a non-empty string.
   */
  function cleanStr(v, max) {
    if (typeof v !== 'string') return null;
    const t = v.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, ' ').replace(/\s+/g, ' ').trim();
    return t ? t.slice(0, max || 80) : null;
  }

  /** An ISO-8601 timestamp, or null — a transcript's `timestamp` is not trusted to be one. */
  function cleanIso(v) {
    if (typeof v !== 'string' || v.length > 40) return null;
    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/.test(v)) return null;
    return Number.isNaN(Date.parse(v)) ? null : v;
  }

  /**
   * The `session` config block with every default applied and every bad value
   * replaced by its default (a typo in config must not disable capture silently
   * or crash a hook).
   */
  function sessionConfig(config) {
    const raw = (config && config.session && typeof config.session === 'object') ? config.session : {};
    const ret = (raw.retention && typeof raw.retention === 'object') ? raw.retention : {};
    const days = Number.isFinite(ret.days) && ret.days > 0 ? ret.days : DEFAULT_RETENTION_DAYS;
    const compact = ret.compact === 'off' ? 'off' : 'monthly';
    const logQueries = LOG_QUERY_MODES.includes(raw.logQueries) ? raw.logQueries : 'hashed';
    return { retention: { days, compact }, logQueries, injectSummary: raw.injectSummary === true, mcpCapture: raw.mcpCapture === true };
  }

  /** The agent-prefixed id for a raw agent session id (`cc-<uuid>`). */
  function sessionId(agent, raw) {
    const prefix = PREFIXES[agent]
      || String(agent || '').toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 8)
      || 'x';
    const clean = String(raw == null ? '' : raw).replace(/[^A-Za-z0-9._-]/g, '').slice(0, 80);
    if (!clean) throw new Error('session id is empty');
    return clean.startsWith(`${prefix}-`) ? clean : `${prefix}-${clean}`;
  }

  /** The agent an id belongs to, from its prefix; null when it has none we know. */
  function agentOfId(id) {
    const prefix = String(id || '').split('-')[0];
    for (const [agent, p] of Object.entries(PREFIXES)) if (p === prefix) return agent;
    return null;
  }

  /**
   * Append one event. One `write(2)` on an O_APPEND descriptor, so concurrent
   * writers interleave whole lines, never bytes.
   * @returns {object} the stored event
   */
  function appendEvent(cwd, event) {
    if (!event || !KINDS.includes(event.kind)) throw new Error(`unknown session event kind: ${event && event.kind}`);
    if (typeof event.id !== 'string' || !event.id) throw new Error('session event needs an id');
    const { kind, id, ts, ...rest } = event;
    const rec = { schema: SCHEMA, kind, id, ts: cleanIso(ts) || new Date().toISOString(), ...rest };
    const line = JSON.stringify(rec) + '\n';
    if (Buffer.byteLength(line) > MAX_EVENT_BYTES) throw new Error(`session event is larger than ${MAX_EVENT_BYTES} bytes`);
    const file = storePath(cwd);
    fs.mkdirSync(path.dirname(file), { recursive: true });
    const fd = fs.openSync(file, 'a');
    try { fs.writeSync(fd, line); } finally { fs.closeSync(fd); }
    return rec;
  }

  /**
   * Read every event. Unparseable lines and lines of another schema version are
   * skipped and COUNTED, never fatal — a half-written or future line must not
   * hide the rest of the history.
   * @returns {{ events: object[], corrupt: number, unsupported: number }}
   */
  function readEvents(cwd) {
    let raw;
    try { raw = fs.readFileSync(storePath(cwd), 'utf8'); } catch (_) { return { events: [], corrupt: 0, unsupported: 0 }; }
    return parseEvents(raw);
  }

  /** How compaction and the reader see one line: an event, a line to carry through untouched, or damage. */
  function classifyLine(line) {
    const t = line.trim();
    if (!t) return { type: 'blank' };
    let e;
    try { e = JSON.parse(t); } catch (_) { return { type: 'corrupt' }; }
    if (!e || typeof e !== 'object' || Array.isArray(e)) return { type: 'corrupt' };
    if (e.schema !== SCHEMA) return { type: 'foreign', line: t };           // another SigMap's schema: not ours to judge
    if (typeof e.id !== 'string' || !e.id) return { type: 'corrupt' };
    if (!KINDS.includes(e.kind)) return { type: 'foreign', line: t };       // a kind a newer minor added
    return { type: 'event', event: e, line: t };
  }

  function parseEvents(raw) {
    const events = [];
    let corrupt = 0;
    let unsupported = 0;
    for (const line of raw.split('\n')) {
      const c = classifyLine(line);
      if (c.type === 'event') events.push(c.event);
      else if (c.type === 'foreign') unsupported++;
      else if (c.type === 'corrupt') corrupt++;
    }
    return { events, corrupt, unsupported };
  }

  /**
   * A usage object with each category a finite non-negative number — or, for the
   * cache categories only, an explicit `null` ("this agent did not report it").
   * Anything else is not usage at all.
   */
  function _cats(u) {
    if (!u || typeof u !== 'object') return null;
    const out = {};
    for (const c of CATEGORIES) {
      const v = u[c];
      if (v === null && OPTIONAL_CATEGORIES.includes(c)) { out[c] = null; continue; }
      if (!Number.isFinite(v) || v < 0) return null;
      out[c] = v;
    }
    return out;
  }

  /**
   * Add two usage accumulators. A category is null only when NEITHER side reported
   * it; `unreported` names every category at least one side did not report, so a
   * sum that is a floor rather than a total can say so.
   * An accumulator is `{ usage, unreported }`; `null` is the identity.
   */
  function mergeUsage(a, b) {
    if (!a) return b;
    if (!b) return a;
    const usage = {};
    const unreported = new Set([...(a.unreported || []), ...(b.unreported || [])]);
    for (const c of CATEGORIES) {
      const av = a.usage[c];
      const bv = b.usage[c];
      if (av === null && bv === null) usage[c] = null;
      else usage[c] = (av || 0) + (bv || 0);
      if ((av === null) !== (bv === null)) unreported.add(c);
      if (av === null && bv === null) unreported.add(c);
    }
    return { usage, unreported: [...unreported].sort() };
  }

  /** The accumulator for one folded session (`null` when its usage is unavailable). */
  function usageOf(session) {
    if (!session || !session.usage) return null;
    return { usage: session.usage, unreported: CATEGORIES.filter((c) => session.usage[c] === null) };
  }

  function _usageTie(a, b) {
    const at = tsMs(a.ts);
    const bt = tsMs(b.ts);
    if (Number.isNaN(at) !== Number.isNaN(bt)) return !Number.isNaN(at);   // a real timestamp beats a bad one, whatever the order
    if (!Number.isNaN(at) && at !== bt) return at > bt;
    return true;                                                          // equal in every respect: the later line wins
  }

  function _better(a, b) {
    if (!b) return true;
    const ao = Number.isFinite(a.offset) ? a.offset : 0;
    const bo = Number.isFinite(b.offset) ? b.offset : 0;
    if (ao !== bo) return ao > bo;
    const ar = SOURCE_RANK[a.source] || 0;
    const br = SOURCE_RANK[b.source] || 0;
    if (ar !== br) return ar > br;
    return _usageTie(a, b);
  }

  /** Should a value stamped `ts` replace one stamped `prev`? Latest timestamp wins; ties and unstamped: the later line. */
  function _later(ts, prev) {
    const t = tsMs(ts);
    const p = tsMs(prev);
    if (Number.isNaN(p)) return true;
    if (Number.isNaN(t)) return false;
    return t >= p;
  }

  /**
   * Fold events into one record per session id, plus the compaction rollups.
   * Deterministic and independent of line order: sessions come back ordered by
   * start time, then id.
   * @returns {{ sessions: object[], rollups: object[] }}
   */
  function foldSessions(events) {
    const byId = new Map();
    const rollups = [];
    for (const e of events) {
      if (e.kind === 'rollup') { rollups.push(e); continue; }
      let s = byId.get(e.id);
      if (!s) {
        s = {
          id: e.id, agent: agentOfId(e.id), startedAt: null, endedAt: null, lastTs: null, endReason: null,
          branch: null, queries: [], events: 0, _best: null, _at: {},
        };
        byId.set(e.id, s);
      }
      s.events++;
      const ts = cleanIso(e.ts);
      const t = tsMs(ts);
      if (!Number.isNaN(t) && (s.lastTs == null || t > tsMs(s.lastTs))) s.lastTs = ts;
      const agent = cleanStr(e.agent, 20);
      if (agent && _later(ts, s._at.agent)) { s.agent = agent; s._at.agent = ts; }
      if (e.kind === 'start') {
        if (!Number.isNaN(t) && (s.startedAt == null || t < tsMs(s.startedAt))) s.startedAt = ts;
        if (!Number.isNaN(t) && (s.lastStartAt == null || t > tsMs(s.lastStartAt))) s.lastStartAt = ts;
        if (typeof e.branch === 'string' && _later(ts, s._at.branch)) { s.branch = cleanStr(e.branch, 120); s._at.branch = ts; }
        if (typeof e.startSource === 'string' && _later(ts, s._at.startSource)) { s.startSource = cleanStr(e.startSource, 20); s._at.startSource = ts; }
        if (e.ci === true) s.ci = true;
      } else if (e.kind === 'end') {
        // The end time and its reason come from the same (latest) `end`, never one from each.
        if (!Number.isNaN(t) && (s.endedAt == null || t >= tsMs(s.endedAt))) {
          s.endedAt = ts;
          s.endReason = cleanStr(e.reason, 40);
        }
      } else if (e.kind === 'query') {
        s.queries.push({
          ts, q: typeof e.q === 'string' ? cleanStr(e.q, MAX_QUERY_CHARS) : null,
          qh: typeof e.qh === 'string' ? cleanStr(e.qh, 32) : null,
          files: Array.isArray(e.files) ? e.files.map((f) => cleanStr(f, 200)).filter(Boolean) : [],
        });
      } else if (e.kind === 'usage') {
        if (_better(e, s._best)) s._best = e;
      }
    }
    const sessions = [];
    for (const s of byId.values()) {
      const b = s._best;
      delete s._best;
      delete s._at;
      const usage = b && b.source !== 'unavailable' ? _cats(b.usage) : null;
      s.usage = usage;
      s.source = usage ? b.source : 'unavailable';
      s.provenance = PROVENANCE[s.source];
      s.model = (b && cleanStr(b.model, 80)) || 'unknown';
      s.models = null;
      if (b && b.models && typeof b.models === 'object' && !Array.isArray(b.models)) {
        s.models = Object.create(null);
        for (const [name, v] of Object.entries(b.models).slice(0, 8)) {
          const n = cleanStr(name, 80);
          if (n && v && typeof v === 'object') s.models[n] = v;
        }
      }
      s.partial = !!(b && b.partial === true);
      s.offset = b && Number.isFinite(b.offset) ? b.offset : 0;
      s.parseErrors = b && Number.isFinite(b.parseErrors) ? b.parseErrors : 0;
      s.messages = b && Number.isFinite(b.messages) ? b.messages : null;
      s.cacheGaps = b && Number.isFinite(b.cacheGaps) ? b.cacheGaps : 0;
      s.coverage = b && typeof b.coverage === 'string' ? cleanStr(b.coverage, 20) : null;
      if (s.startedAt == null) s.startedAt = (b && cleanIso(b.firstTs)) || s.lastTs;
      // A `start` after the last `end` is a resumed session: open again.
      s.ended = s.endedAt != null && !(s.lastStartAt != null && tsMs(s.lastStartAt) > tsMs(s.endedAt));
      delete s.lastStartAt;
      sessions.push(s);
    }
    sessions.sort((a, b) => {
      const at = tsMs(a.startedAt), bt = tsMs(b.startedAt);
      if (at !== bt && !Number.isNaN(at) && !Number.isNaN(bt)) return at - bt;
      return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
    });
    return { sessions, rollups };
  }

  /** Read + fold in one call. */
  function readSessions(cwd) {
    const { events, corrupt, unsupported } = readEvents(cwd);
    return { ...foldSessions(events), corrupt, unsupported };
  }

  // ── privacy ──────────────────────────────────────────────────────────────

  /**
   * The query fields to store for a mode, redacted ON WRITE:
   *   off    → null (nothing is logged)
   *   hashed → { qh } a 12-hex sha256 prefix (counts and dedupe, not content)
   *   full   → { q }  the redacted text, capped
   */
  function queryRecord(text, mode) {
    if (mode === 'off') return null;
    const clean = String(text == null ? '' : text).trim();
    if (!clean) return null;
    if (mode === 'full') {
      let safe = clean;
      try { safe = redactText(clean).text; } catch (_) { /* redactText never throws; belt and braces */ }
      return { q: safe.slice(0, MAX_QUERY_CHARS) };
    }
    return { qh: crypto.createHash('sha256').update(clean).digest('hex').slice(0, 12) };
  }

  // ── retention ────────────────────────────────────────────────────────────

  /**
   * Run `fn` holding the compaction lock; `{locked:true}` when someone else has it.
   *
   * A lock is only ever stale after a crash. Two processes that find the same stale
   * lock at the same instant may both proceed; that is tolerated because compaction
   * is idempotent (each rewrites from what is on disk and copies the tail across),
   * so the worst case is one redundant rewrite, not a double count.
   */
  function withLock(cwd, fn) {
    const lock = path.join(cwd, LOCK_FILE);
    fs.mkdirSync(path.dirname(lock), { recursive: true });
    let fd;
    for (let attempt = 0; attempt < 2 && fd === undefined; attempt++) {
      try {
        fd = fs.openSync(lock, 'wx');
      } catch (e) {
        if (e.code !== 'EEXIST') throw e;
        let age = 0;
        try { age = Date.now() - fs.statSync(lock).mtimeMs; } catch (_) { continue; } // vanished: retry
        if (age <= LOCK_STALE_MS) return { locked: true };
        try { fs.unlinkSync(lock); } catch (_) { /* someone else cleared it */ }
      }
    }
    if (fd === undefined) return { locked: true };
    try {
      fs.writeSync(fd, String(process.pid));
      return { locked: false, value: fn() };
    } finally {
      try { fs.closeSync(fd); } catch (_) { /* already closed */ }
      try { fs.unlinkSync(lock); } catch (_) { /* already gone */ }
    }
  }

  function _month(ts) {
    return typeof ts === 'string' && /^\d{4}-\d{2}/.test(ts) ? ts.slice(0, 7) : 'unknown';
  }

  /**
   * Fold sessions older than `days` into monthly rollups and drop their raw events.
   * Rollups are keyed by (month, agent, model, source), so two provenance classes
   * never merge. A rollup of sessions whose usage was unavailable carries
   * `usage: null`; a category none of them reported is `null`, and `unreported`
   * names the categories some did not. Idempotent, and a no-op (no rewrite) when
   * nothing is old.
   *
   * Lines compaction does not understand are NOT its to delete: another schema
   * version, or a kind a newer SigMap added, is carried through byte for byte.
   * Only lines that are not JSON at all are dropped.
   *
   * The rewrite is tmp-file + rename. Appenders take no lock, so after the tmp
   * file is written the live file is re-checked and whatever was appended in the
   * meantime is copied across — repeatedly, until the size stops moving. What
   * remains is the instant between the last size check and the rename.
   *
   * @param {string} cwd
   * @param {{ days?: number, now?: number, _afterTmpWrite?: Function }} [opts]
   *        `_afterTmpWrite` is a test seam: it runs right after the tmp file is written.
   */
  function compact(cwd, opts = {}) {
    const days = Number.isFinite(opts.days) && opts.days > 0 ? opts.days : DEFAULT_RETENTION_DAYS;
    const now = Number.isFinite(opts.now) ? opts.now : Date.now();
    const file = storePath(cwd);
    if (!fs.existsSync(file)) return { action: 'none', sessions: 0, removedEvents: 0 };
    const res = withLock(cwd, () => {
      const buf = fs.readFileSync(file);
      const entries = [];
      for (const line of buf.toString('utf8').split('\n')) {
        const c = classifyLine(line);
        if (c.type === 'event' || c.type === 'foreign') entries.push(c);
      }
      const events = entries.filter((c) => c.type === 'event').map((c) => c.event);
      const { sessions } = foldSessions(events);
      const cutoff = now - days * 86400000;
      const old = new Set(sessions.filter((s) => {
        const t = tsMs(s.lastTs);
        return !Number.isNaN(t) && t < cutoff;
      }).map((s) => s.id));
      if (old.size === 0) return { action: 'none', sessions: 0, removedEvents: 0 };

      const groups = new Map();
      const group = (key, init) => {
        if (!groups.has(key)) groups.set(key, init);
        return groups.get(key);
      };
      for (const s of sessions) {
        if (!old.has(s.id)) continue;
        const m = _month(s.lastTs);
        const g = group([m, s.agent || 'unknown', s.model, s.source].join('|'),
          { month: m, agent: s.agent || 'unknown', model: s.model, source: s.source, sessions: 0, acc: null });
        g.sessions++;
        g.acc = mergeUsage(g.acc, usageOf(s));
      }
      for (const e of events) {
        if (e.kind !== 'rollup') continue;
        const g = group([e.month, e.agent, e.model, e.source].join('|'),
          { month: e.month, agent: e.agent, model: e.model, source: e.source, sessions: 0, acc: null });
        g.sessions += Number.isFinite(e.sessions) ? e.sessions : 0;
        const u = _cats(e.usage);
        if (u) g.acc = mergeUsage(g.acc, { usage: u, unreported: Array.isArray(e.unreported) ? e.unreported : [] });
      }

      const stamp = new Date(now).toISOString();
      const out = [];
      for (const key of [...groups.keys()].sort()) {
        const g = groups.get(key);
        const rec = {
          schema: SCHEMA, kind: 'rollup', id: `rollup-${g.month}-${g.agent}-${g.model}-${g.source}`.replace(/[^A-Za-z0-9._-]/g, '_'),
          ts: stamp, month: g.month, agent: g.agent, model: g.model, source: g.source, sessions: g.sessions,
          usage: g.acc ? g.acc.usage : null,
        };
        if (g.acc && g.acc.unreported.length) rec.unreported = g.acc.unreported;
        out.push(JSON.stringify(rec));
      }
      let kept = 0;
      let removed = 0;
      for (const c of entries) {
        if (c.type === 'foreign') { out.push(c.line); continue; }
        if (c.event.kind === 'rollup') continue;
        if (old.has(c.event.id)) { removed++; continue; }
        out.push(c.line);
        kept++;
      }
      const tmp = `${file}.${process.pid}.tmp`;
      try {
        fs.writeFileSync(tmp, out.join('\n') + '\n');
        if (typeof opts._afterTmpWrite === 'function') opts._afterTmpWrite();
        let copied = buf.length;
        for (let pass = 0; pass < MAX_TAIL_PASSES; pass++) {
          const size = fs.statSync(file).size;
          if (size <= copied) break;
          const fd = fs.openSync(file, 'r');
          const delta = Buffer.alloc(size - copied);
          try { fs.readSync(fd, delta, 0, delta.length, copied); } finally { fs.closeSync(fd); }
          fs.appendFileSync(tmp, delta);
          copied = size;
        }
        fs.renameSync(tmp, file);
      } finally {
        try { fs.unlinkSync(tmp); } catch (_) { /* renamed away, or never written */ }
      }
      return { action: 'compacted', sessions: old.size, removedEvents: removed, rollups: groups.size, keptEvents: kept };
    });
    return res.locked ? { action: 'locked', sessions: 0, removedEvents: 0 } : res.value;
  }

  /**
   * Compact when retention asks for it and the file is big enough to be worth a
   * read. Never throws — a failed housekeeping pass must not fail a hook.
   */
  function maybeCompact(cwd, config, opts = {}) {
    try {
      const sc = sessionConfig(config);
      if (sc.retention.compact === 'off') return { action: 'off' };
      let size = 0;
      try { size = fs.statSync(storePath(cwd)).size; } catch (_) { return { action: 'none' }; }
      if (size < (opts.minBytes != null ? opts.minBytes : 65536)) return { action: 'none' };
      return compact(cwd, { days: sc.retention.days, now: opts.now });
    } catch (e) {
      return { action: 'error', error: e.message };
    }
  }

  /** Store health for `doctor`. */
  function inspect(cwd) {
    const file = storePath(cwd);
    let bytes = 0;
    try { bytes = fs.statSync(file).size; } catch (_) { return { exists: false, path: file, bytes: 0, events: 0, corrupt: 0, unsupported: 0, sessions: 0, open: 0, rollups: 0 }; }
    const { sessions, rollups, corrupt, unsupported } = readSessions(cwd);
    let locked = false;
    try { locked = Date.now() - fs.statSync(path.join(cwd, LOCK_FILE)).mtimeMs > LOCK_STALE_MS; } catch (_) { /* no lock */ }
    return {
      exists: true, path: file, bytes, events: sessions.reduce((n, s) => n + s.events, 0),
      corrupt, unsupported, sessions: sessions.length, open: sessions.filter((s) => !s.ended).length,
      rollups: rollups.length, staleLock: locked,
    };
  }

  module.exports = {
    SCHEMA, STORE_FILE, KINDS, CATEGORIES, OPTIONAL_CATEGORIES, SOURCES, PROVENANCE, LOG_QUERY_MODES, DEFAULT_RETENTION_DAYS,
    storePath, sessionConfig, sessionId, agentOfId, appendEvent, readEvents, parseEvents, classifyLine, foldSessions,
    readSessions, queryRecord, compact, maybeCompact, inspect, tsMs, cleanStr, cleanIso, mergeUsage, usageOf,
  };
  
};

// ── ./src/session/summary ──
__factories["./src/session/summary"] = function(module, exports) {
  
  /**
   * Warm-start session summary (#922, SI-3 of #682).
   *
   * A deterministic, no-LLM rollup of the LAST session — what it spent, which
   * files its queries surfaced, the notes written since, the open threads — so the
   * next session on any agent starts warm.
   *
   * Contract
   *   - Deterministic: the same store + notes + branch state give a byte-identical
   *     block. The header carries the last session's own timestamp, never the
   *     generation time, and nothing in the body is relative to "now".
   *   - Hard budget of MAX_TOKENS (chars/4), enforced by dropping the least useful
   *     lines first; the window is the last session plus open threads, nothing older.
   *   - Stale collapse: past `contextTtlDays` (14 when unset) the block becomes one
   *     line carrying the ABSOLUTE date, not "N days ago".
   *   - Single writer: this module renders and, when asked, injects the block at
   *     generation time. No agent hook writes it mid-session.
   *   - Redaction: every free-text field passes through the secret redactor; query
   *     text appears only when `session.logQueries` is `full`.
   *   - Billed-token categories are labelled as such, with their provenance, and an
   *     unreadable usage renders as unavailable, never as zero.
   *
   * Zero dependencies.
   */

  const fs = require('fs');
  const path = require('path');
  const store = __require('./src/session/store');
  const { readNotes } = __require('./src/session/notes');
  const { redactText } = __require('./src/security/redact');
  const { tryGit } = __require('./src/util/git');
  const { formatUsage } = __require('./src/session/render');
  const { managedSectionLineStart } = __require('./src/util/managed-section');

  const SUMMARY_VERSION = 1;
  const MAX_TOKENS = 400;
  const DEFAULT_TTL_DAYS = 14;
  const MAX_NOTES = 5;
  const MAX_THREADS = 5;
  const MAX_FILES = 5;
  const MAX_LINE = 160;
  const THREAD_TAGS = new Set(['todo', 'open', 'thread', 'next']);

  const OPEN = '<!-- sigmap:session-summary';
  const CLOSE = '<!-- /sigmap:session-summary -->';

  /** Instruction files the opt-in injection may update (never created). */
  const TARGETS = [
    ['CLAUDE.md'],
    ['AGENTS.md'],
    ['.github', 'copilot-instructions.md'],
    ['.github', 'gemini-context.md'],
  ];

  function estimateTokens(s) {
    return Math.ceil(String(s).length / 4);
  }

  /** Text that cannot close the block's own markers or open a comment inside it. */
  function _neutral(text) {
    return String(text == null ? '' : text).replace(/<!--|-->/g, ' ');
  }

  function _clean(text) {
    let t = _neutral(text).replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ').replace(/\s+/g, ' ').trim();
    try { t = redactText(t).text; } catch (_) { /* redactText never throws */ }
    return t.length > MAX_LINE ? t.slice(0, MAX_LINE - 1) + '…' : t;
  }

  /** A git ref (or short hash) as it appears in the header: nothing outside a ref's usual characters. */
  function _ref(text, max) {
    return String(text == null ? '' : text).replace(/[^A-Za-z0-9._/@+#-]/g, '_').slice(0, max);
  }

  function _utc(ts) {
    const ms = store.tsMs(ts);
    return Number.isNaN(ms) ? 'unknown' : new Date(ms).toISOString().slice(0, 16).replace('T', ' ') + 'Z';
  }

  function _day(ts) {
    const ms = store.tsMs(ts);
    return Number.isNaN(ms) ? 'unknown' : new Date(ms).toISOString().slice(0, 10);
  }

  /** Top files surfaced by a session's queries, most-asked first, ties by path. */
  function _topFiles(session) {
    const counts = new Map();
    for (const q of session.queries) for (const f of q.files) counts.set(f, (counts.get(f) || 0) + 1);
    return [...counts.entries()]
      .sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))
      .map(([f, n]) => `${_clean(f)} (${n})`);
  }

  function _header(branch, head, lastTs) {
    const b = branch ? _ref(branch, 80) : '';
    const h = head ? _ref(head, 40) : '';
    const at = b ? `${b}${h ? '@' + h : ''}` : (h || 'no-git');
    return `${OPEN} v${SUMMARY_VERSION} · ${at} · ${lastTs} -->`;
  }

  /**
   * Build the summary for the most recent conversational session.
   *
   * @param {string} cwd
   * @param {{ config?: object, exclude?: string, now?: number, branch?: string|null,
   *           head?: string|null, notes?: object[] }} [opts]
   * @returns {null | { text: string, stale: boolean, sessionId: string, lastTs: string,
   *                    tokens: number, truncated: boolean }}
   *   null when the store holds no eligible session.
   */
  function buildSummary(cwd, opts = {}) {
    const config = opts.config || {};
    const now = Number.isFinite(opts.now) ? opts.now : Date.now();
    const cap = Number.isFinite(opts.maxTokens) && opts.maxTokens > 0 ? opts.maxTokens : MAX_TOKENS;
    const sc = store.sessionConfig(config);
    const { sessions } = store.readSessions(cwd);
    const eligible = sessions.filter((s) => s.id !== opts.exclude && s.agent !== 'ci' && s.lastTs);
    if (eligible.length === 0) return null;
    const last = eligible.reduce((best, s) => (store.tsMs(s.lastTs) >= store.tsMs(best.lastTs) ? s : best));

    const branch = opts.branch !== undefined ? opts.branch : (tryGit(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd }) || null);
    const head = opts.head !== undefined ? opts.head : (tryGit(['rev-parse', '--short', 'HEAD'], { cwd }) || null);
    const header = _header(branch, head, last.lastTs);

    const ttlDays = Number.isFinite(config.contextTtlDays) && config.contextTtlDays > 0 ? config.contextTtlDays : DEFAULT_TTL_DAYS;
    if (now - store.tsMs(last.lastTs) > ttlDays * 86400000) {
      const text = [
        header,
        `Session summary stale — the last recorded session ended ${_day(last.lastTs)} (past the ${ttlDays}-day TTL); nothing newer to carry over.`,
        CLOSE,
      ].join('\n');
      return { text, stale: true, sessionId: last.id, lastTs: last.lastTs, tokens: estimateTokens(text), truncated: false };
    }

    const notes = Array.isArray(opts.notes) ? opts.notes : readNotes(cwd);
    const startMs = store.tsMs(last.startedAt);
    const since = notes.filter((n) => !THREAD_TAGS.has(String(n.tag || '').toLowerCase())
      && !Number.isNaN(store.tsMs(n.ts)) && (Number.isNaN(startMs) || store.tsMs(n.ts) >= startMs));
    const threads = notes.filter((n) => THREAD_TAGS.has(String(n.tag || '').toLowerCase()));
    const noteLines = since.slice(-MAX_NOTES).map((n) => `- ${_clean(n.text)}`);
    const threadLines = threads.slice(-MAX_THREADS).map((n) => `- ${_clean(n.text)}`);
    const files = _topFiles(last).slice(0, MAX_FILES);

    const when = last.ended
      ? `${_utc(last.startedAt)} → ${_utc(last.endedAt)}${last.endReason ? ` (${_clean(last.endReason)})` : ''}`
      : `${_utc(last.startedAt)} → still open or not closed cleanly`;
    const basis = [last.provenance, last.coverage === 'main' ? 'main conversation' : null, last.partial ? 'partial read' : null].filter(Boolean);
    const usageLine = last.usage
      ? `- Billed tokens (${basis.join(', ')}): ${formatUsage(last.usage)} · model ${_clean(last.model)}`
      : '- Billed tokens: unavailable (no usage was readable for this session)';
    const mode = sc.logQueries;
    const qCount = last.queries.length;
    const render = (n, t, f) => {
      const q = qCount === 0
        ? '- Queries: none recorded'
        : `- Queries: ${qCount} recorded${mode === 'full' ? '' : ' (' + mode + ')'}${f.length ? ' · files surfaced: ' + f.join(', ') : ''}`;
      const out = [
        header,
        '## Last session (warm start)',
        `- ${_clean(last.agent || 'agent')}${last.branch ? ' on ' + _clean(last.branch) : ''} · ${when}`,
        usageLine,
        q,
      ];
      if (n.length) out.push('### Notes since', ...n);
      if (t.length) out.push('### Open threads', ...t);
      out.push(CLOSE);
      return out.join('\n');
    };

    let n = noteLines.slice();
    let t = threadLines.slice();
    let f = files.slice();
    let text = render(n, t, f);
    let truncated = false;
    // Drop the least useful lines first: oldest notes, then surfaced files, then threads.
    while (estimateTokens(text) > cap) {
      truncated = true;
      if (n.length) n.shift();
      else if (f.length) f.pop();
      else if (t.length) t.pop();
      else break;
      text = render(n, t, f);
    }
    if (estimateTokens(text) > cap) {
      text = text.slice(0, Math.max(0, cap * 4 - CLOSE.length - 2)) + '…\n' + CLOSE;
      truncated = true;
    }
    return { text, stale: false, sessionId: last.id, lastTs: last.lastTs, tokens: estimateTokens(text), truncated };
  }

  // ── instruction-file injection (opt-in: session.injectSummary) ───────────

  function _find(src) {
    const start = src.indexOf(OPEN);
    if (start === -1) return null;
    const close = src.indexOf(CLOSE, start);
    return close === -1 ? null : { start, end: close + CLOSE.length };
  }

  /** Put the block into file content: replace in place, else above the managed section, else append. */
  function injectBlock(existing, block) {
    const src = String(existing || '');
    const hit = _find(src);
    if (hit) return src.slice(0, hit.start) + block + src.slice(hit.end);
    const sigIdx = managedSectionLineStart(src);
    if (sigIdx !== -1) return src.slice(0, sigIdx) + block + '\n\n' + src.slice(sigIdx);
    if (src.trim() === '') return block + '\n';
    return src + (src.endsWith('\n') ? '\n' : '\n\n') + block + '\n';
  }

  /** Remove the block (and the blank line that separated it), leaving everything else. */
  function removeBlock(existing) {
    const src = String(existing || '');
    const hit = _find(src);
    if (!hit) return src;
    let end = hit.end;
    if (src.slice(end, end + 2) === '\n\n') end += 2;
    else if (src[end] === '\n') end += 1;
    const head = src.slice(0, hit.start);
    const tail = src.slice(end);
    // A block appended to the end of a file was preceded by the blank line inject added.
    if (tail === '' && head.endsWith('\n\n')) return head.slice(0, -1);
    return head + tail;
  }

  /**
   * Bring the instruction files in line with `session.injectSummary`:
   *   on  → inject/refresh the block (or remove it when there is nothing to say)
   *   off → remove a block an earlier run injected
   * Only files that already exist are touched, and only inside the markers.
   * Writes nothing when the content would not change, so a repo with no session
   * store is left byte-identical.
   *
   * @returns {{ enabled: boolean, files: Array<{ file: string, action: 'injected'|'updated'|'removed'|'unchanged' }> }}
   */
  function syncSummaryBlocks(cwd, config, opts = {}) {
    const sc = store.sessionConfig(config);
    const res = { enabled: sc.injectSummary, files: [] };
    let block = null;
    if (sc.injectSummary) {
      try { const s = buildSummary(cwd, { config, now: opts.now, branch: opts.branch, head: opts.head }); block = s ? s.text : null; } catch (_) { block = null; }
    }
    for (const parts of TARGETS) {
      const file = path.join(cwd, ...parts);
      let existing;
      try { existing = fs.readFileSync(file, 'utf8'); } catch (_) { continue; }
      const had = _find(existing) !== null;
      const next = block ? injectBlock(existing, block) : removeBlock(existing);
      if (next === existing) { if (had || block) res.files.push({ file: parts.join('/'), action: 'unchanged' }); continue; }
      fs.writeFileSync(file, next);
      res.files.push({ file: parts.join('/'), action: block ? (had ? 'updated' : 'injected') : 'removed' });
    }
    return res;
  }

  module.exports = {
    SUMMARY_VERSION, MAX_TOKENS, DEFAULT_TTL_DAYS, OPEN, CLOSE, TARGETS,
    buildSummary, injectBlock, removeBlock, syncSummaryBlocks, estimateTokens,
  };
  
};

// ── ./src/skills/skills ──
__factories["./src/skills/skills"] = function(module, exports) {
  
  /**
   * sigmap skills — canonical agent playbooks + multi-client installer (F3+F4, #517).
   *
   * Two deterministic skill documents (the spend-minimizing usage loop and the
   * config-optimizer playbook) emitted in each client's native skill/rules
   * format — the `mcp/install.js` CLIENTS pattern applied to skills. File-based
   * clients get sigmap-namespaced files we own outright; AGENTS.md (codex) gets
   * a marker-delimited block inserted ABOVE the `## Auto-generated signatures`
   * marker, since the codex adapter preserves content above it and replaces
   * everything below. Idempotent; human content is never touched.
   */

  const fs = require('fs');
  const path = require('path');
  const { managedSectionLineStart } = __require('./src/util/managed-section');

  const START = '<!-- sigmap-skills:start -->';
  const END = '<!-- sigmap-skills:end -->';

  const SKILLS = {
    'sigmap-usage-maximizer': {
      title: 'SigMap usage maximizer',
      description: 'Spend-minimizing loop for agents in a SigMap-indexed repo: ask before reading, read ranges, verify before trusting, squeeze big pastes, checkpoint, watch the budget.',
      body: [
        'Follow this loop before any file exploration in a repo with SigMap installed.',
        '',
        '1. **Ask before reading.** `sigmap ask "<task>"` (or the `query_context` MCP tool) ranks the relevant files as ~hundreds of tokens of signatures instead of thousands of raw-file tokens. Never open files to "look around".',
        '2. **Read ranges, not files.** Use the `get_lines` MCP tool — or `sigmap lines <file> :<line> --context <n>` where MCP is unavailable — with the `:start-end` line anchors carried on every signature to pull only the lines you need.',
        '3. **Ground before trusting.** Run the `verify_suggestion` MCP tool (or `sigmap verify-ai-output`) on generated code before applying it — it flags fabricated files, imports, symbols, and npm scripts against the live index.',
        '4. **Squeeze big pastes.** Any stack trace, CI/build log, or JSON blob goes through `sigmap squeeze` (or the `squeeze_output` MCP tool) before it enters context — the signal survives, the noise does not.',
        '5. **Checkpoint progress.** Use the `create_checkpoint` MCP tool or `sigmap note "<decision>"` so a follow-up session resumes without re-deriving state.',
        '6. **Watch the budget.** Check the `get_budget` MCP tool or `sigmap budget` (estimates from SigMap\'s local ledger — no LLM calls). Near the budget: summarize-then-drop older context instead of accumulating, and prefer terse output.',
      ].join('\n'),
    },
    'sigmap-task': {
      title: 'SigMap task loop',
      kind: 'prompt',
      description: 'Do a coding task grounded in SigMap: look up before reading, edit by line anchor, verify before reporting.',
      argumentHint: 'the change you want, in plain words',
      body: [
        'Work through these steps **in order**. Do not open any file before step 2.',
        'Every command runs from the integrated terminal — do not ask the user to run them for you.',
        '',
        '1. **Look up, do not search.** `npx sigmap ask "<the task>"` — this writes `.context/query-context.md`.',
        '2. **Read the map.** `cat .context/query-context.md`. It ranks the relevant files and lists their signatures with `:start-end` line anchors — a few hundred tokens where the same files read whole are tens of thousands. Say which files it surfaced before continuing. If nothing relevant appears, re-run step 1 with different wording; fall back to search only after two attempts, and say so.',
        '3. **Read the anchored range, by command.** A signature ending `:425-425` means line 425, not the 547-line file. Run `npx sigmap lines <file> :425 --context 10` — paste the anchor straight off the signature. Never `cat` a whole file when you hold an anchor for it: on a real repo a 220-line span costs ~2,700 tokens where the anchored window costs ~220.',
        '4. **Make the change.** Follow the conventions visible in the signatures — same layering, same response wrapper, same annotation style. Add no dependencies.',
        '5. **Verify before reporting.** Write what you changed to `.sigmap-notes.md`, naming every file by its **full repository-relative path** (a bare filename is reported as fake), then run `npx sigmap verify-ai-output .sigmap-notes.md`. It checks every name against the real index, offline, with no model call. Fix anything it flags and re-run before you reply.',
        '6. **Refresh the map.** `npx sigmap` — your edits made it stale.',
        '7. **Report.** The files you changed, the ranges you actually read, the step-1 token count, and the step-5 verify result. Say so if you fell back to searching or if verify flagged something.',
      ].join('\n'),
    },
    'sigmap-config-optimizer': {
      title: 'SigMap config optimizer',
      description: 'Playbook for getting a correct SigMap config on any repo: detect with sigmap tune, review the per-change reasons, apply, validate.',
      body: [
        'Playbook for configuring SigMap on a new or misconfigured repo.',
        '',
        '1. **Detect.** `sigmap tune` prints a recommended config diff — srcDirs pin, monorepo mode, adapters, excludes, budget — with one evidence-naming reason per change. Read-only.',
        '2. **Review.** Every reason names its evidence (workspace marker, client artifact, vendored dir, file-count estimate). Explicit user config is never proposed against.',
        '3. **Apply.** `sigmap tune --apply` merges the recommendations into `gen-context.config.json`, preserving every existing key. Idempotent — a second `tune` proposes nothing.',
        '4. **Validate.** `sigmap validate` confirms the generated context matches the config; `sigmap doctor` diagnoses anything left.',
      ].join('\n'),
    },
  };

  // Client registry — parent = artifact whose presence means "user uses this
  // client" (the `--setup` only-touch-existing rule for plain `skills install`).
  const SKILL_CLIENTS = {
    claude:   { label: 'Claude Code',    parent: ['.claude'],
                target: (cwd, skill) => path.join(cwd, '.claude', 'skills', skill, 'SKILL.md') },
    cursor:   { label: 'Cursor',         parent: ['.cursor'],
                target: (cwd, skill) => path.join(cwd, '.cursor', 'rules', `${skill}.mdc`) },
    windsurf: { label: 'Windsurf',       parent: ['.windsurf'],
                target: (cwd, skill) => path.join(cwd, '.windsurf', 'rules', `${skill}.md`) },
    copilot:  { label: 'GitHub Copilot', parent: ['.github'],
                target: (cwd, skill) => (SKILLS[skill] && SKILLS[skill].kind === 'prompt'
                  ? path.join(cwd, '.github', 'prompts', `${skill}.prompt.md`)
                  : path.join(cwd, '.github', 'instructions', `${skill}.instructions.md`)) },
    codex:    { label: 'Codex CLI (AGENTS.md)', parent: ['AGENTS.md'],
                target: (cwd) => path.join(cwd, 'AGENTS.md'), inject: true },
  };

  function _footer(version) {
    const ver = version ? ` v${version}` : '';
    return `<sub>Generated by SigMap${ver} · run \`sigmap skills install\` to refresh.</sub>`;
  }

  /** Render one skill's client-specific file content. */
  function renderSkill(client, skillName, version) {
    const skill = SKILLS[skillName];
    const body = `# ${skill.title}\n\n${skill.body}\n\n${_footer(version)}\n`;
    if (client === 'claude') {
      return `---\nname: ${skillName}\ndescription: ${skill.description}\n---\n\n${body}`;
    }
    if (client === 'cursor') {
      return `---\ndescription: ${skill.description}\nalwaysApply: false\n---\n\n${body}`;
    }
    if (client === 'copilot') {
      if (skill.kind === 'prompt') {
        return `---\nname: ${skillName}\nagent: 'agent'\ndescription: ${skill.description}\n`
          + `argument-hint: ${skill.argumentHint}\n---\n\n${body}`;
      }
      return `---\napplyTo: "**"\n---\n\n${body}`;
    }
    return body; // windsurf: plain markdown
  }

  /** Render the combined AGENTS.md block (both skills, marker-delimited). */
  function renderAgentsBlock(version) {
    const parts = [START, '## SigMap agent skills', ''];
    for (const name of Object.keys(SKILLS)) {
      parts.push(`### ${SKILLS[name].title}`, '', SKILLS[name].body, '');
    }
    parts.push(_footer(version), END);
    return parts.join('\n');
  }

  /**
   * Inject (or replace) the skills block in AGENTS.md content.
   * A new block is inserted ABOVE the `## Auto-generated signatures` marker —
   * the codex adapter's write() preserves content above that marker and
   * replaces everything below it. Never touches content outside the markers.
   */
  function injectSkillsBlock(existing, block) {
    const src = String(existing || '');
    const startIdx = src.indexOf(START);
    if (startIdx !== -1) {
      const endIdx = src.indexOf(END, startIdx);
      if (endIdx !== -1) {
        return src.slice(0, startIdx) + block + src.slice(endIdx + END.length);
      }
    }
    // The line the real managed section starts on, never a mention of the marker
    // in prose or a code block — a block injected there would split a human line (#873).
    const sigIdx = managedSectionLineStart(src);
    if (sigIdx !== -1) {
      return src.slice(0, sigIdx) + block + '\n\n' + src.slice(sigIdx);
    }
    if (src.trim() === '') return block + '\n';
    return src + (src.endsWith('\n') ? '\n' : '\n\n') + block + '\n';
  }

  function _writeIfChanged(filePath, content) {
    if (fs.existsSync(filePath)) {
      const existing = fs.readFileSync(filePath, 'utf8');
      if (existing === content) return 'already';
      fs.writeFileSync(filePath, content);
      return 'updated';
    }
    fs.mkdirSync(path.dirname(filePath), { recursive: true });
    fs.writeFileSync(filePath, content);
    return 'installed';
  }

  /**
   * Install both skills for one client.
   * @returns {{ client, label, results: Array<{skill, path, status}> }}
   *          status: 'installed' | 'updated' | 'already'; or { status:'unknown', valid } for a bad client.
   */
  function installSkills(client, opts = {}) {
    const spec = SKILL_CLIENTS[client];
    if (!spec) return { client, status: 'unknown', valid: Object.keys(SKILL_CLIENTS) };
    const cwd = opts.cwd || process.cwd();
    const version = opts.version || null;
    const results = [];

    if (spec.inject) {
      const filePath = spec.target(cwd);
      const existing = fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
      const next = injectSkillsBlock(existing, renderAgentsBlock(version));
      let status;
      if (next === existing) status = 'already';
      else { fs.writeFileSync(filePath, next); status = existing ? 'updated' : 'installed'; }
      results.push({ skill: Object.keys(SKILLS).join(' + '), path: filePath, status });
    } else {
      for (const skillName of Object.keys(SKILLS)) {
        const filePath = spec.target(cwd, skillName);
        results.push({ skill: skillName, path: filePath, status: _writeIfChanged(filePath, renderSkill(client, skillName, version)) });
      }
    }
    return { client, label: spec.label, results };
  }

  /** True when the client's parent artifact exists (plain-install eligibility). */
  function clientPresent(client, cwd) {
    const spec = SKILL_CLIENTS[client];
    return !!spec && fs.existsSync(path.join(cwd, ...spec.parent));
  }

  /** List clients with target paths, presence, and installed state. */
  function listSkillClients(opts = {}) {
    const cwd = opts.cwd || process.cwd();
    return Object.keys(SKILL_CLIENTS).map((client) => {
      const spec = SKILL_CLIENTS[client];
      const targets = spec.inject
        ? [spec.target(cwd)]
        : Object.keys(SKILLS).map((s) => spec.target(cwd, s));
      const installed = spec.inject
        ? (fs.existsSync(targets[0]) && fs.readFileSync(targets[0], 'utf8').includes(START))
        : targets.every((t) => fs.existsSync(t));
      return { client, label: spec.label, present: clientPresent(client, cwd), installed, targets };
    });
  }

  module.exports = { SKILLS, SKILL_CLIENTS, renderSkill, renderAgentsBlock, injectSkillsBlock, installSkills, listSkillClients, clientPresent, START, END };
  
};

// ── ./src/squeeze/cilog ──
__factories["./src/squeeze/cilog"] = function(module, exports) {
  
  /**
   * CI / build-log squeeze (v7.0.0).
   *
   * Strips timestamps, progress bars, and repeated noise; keeps every error line
   * plus a small context window around it. Never returns empty — when there are
   * no errors it falls back to a head/tail summary. Also reused by the stacktrace
   * squeezer to clean noise surrounding a trace.
   */

  const TS_PREFIX_RE = /^\s*(?:\[?\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[.,]\d+)?Z?\]?\s*|\[?\d{1,2}:\d{2}:\d{2}(?:[.,]\d+)?\]?\s*)+/;
  const PROGRESS_LINE_RE = /(?:^|\s)(?:\d{1,3}%|Downloading|Receiving objects|Resolving deltas|Compressing objects|npm (?:WARN|notice|http|sill|verb)|##\[(?:group|endgroup|command|section)\]|\[\d+\/\d+\]|ETA[: ]|█|━|▕|⣿)/;
  const ERROR_RE = /\b(?:error|err!|fail(?:ed|ure)?|exception|panic|fatal|traceback|ERR_|E[A-Z]{3,})\b|✗|❌/i;

  /** Remove a leading timestamp prefix from a single line. */
  function stripTimestamp(line) {
    return line.replace(TS_PREFIX_RE, '');
  }

  /**
   * @param {string} input
   * @param {object} [opts]
   * @param {number} [opts.context=2]  context lines kept around each error
   * @returns {{ squeezed: string, kept: string[], stripped: string[] }}
   */
  function squeezeCiLog(input, opts = {}) {
    const ctx = opts.context != null ? opts.context : 2;
    const lines = input.split('\n');
    const keep = new Set();
    const errorIdx = [];

    for (let i = 0; i < lines.length; i++) {
      if (ERROR_RE.test(lines[i])) {
        errorIdx.push(i);
        for (let j = Math.max(0, i - ctx); j <= Math.min(lines.length - 1, i + ctx); j++) keep.add(j);
      }
    }

    let body;
    let keptDesc;
    if (errorIdx.length === 0) {
      const head = lines.slice(0, 10).map(stripTimestamp);
      const tail = lines.length > 20 ? lines.slice(-10).map(stripTimestamp) : [];
      body = head.slice();
      if (tail.length) body.push(`… (${lines.length - 20} lines omitted) …`, ...tail);
      keptDesc = ['head/tail summary (no error lines found)'];
    } else {
      const sorted = [...keep].sort((a, b) => a - b);
      body = [];
      let prev = -2;
      for (const idx of sorted) {
        // Drop pure progress/noise lines unless they are themselves errors.
        const line = stripTimestamp(lines[idx]);
        if (PROGRESS_LINE_RE.test(line) && !ERROR_RE.test(line)) continue;
        if (idx > prev + 1) body.push(`… (${idx - prev - 1} lines) …`);
        body.push(line);
        prev = idx;
      }
      if (body.length === 0) body = errorIdx.map((i) => stripTimestamp(lines[i])); // safety net
      keptDesc = [`${errorIdx.length} error line(s) + ${ctx}-line context`];
    }

    return {
      squeezed: body.join('\n'),
      kept: keptDesc,
      stripped: [`${Math.max(0, lines.length - body.length)} timestamp/progress/noise line(s)`],
    };
  }

  module.exports = { squeezeCiLog, stripTimestamp, ERROR_RE };
  
};

// ── ./src/squeeze/classify ──
__factories["./src/squeeze/classify"] = function(module, exports) {
  
  /**
   * Squeeze input classifier (v7.0.0).
   *
   * Deterministic, zero-dep detector that labels a pasted blob as a
   * `stacktrace`, `cilog`, or `json` payload — or `null` (pass through). Pure
   * regex/heuristics; runs in well under 10ms even on large input.
   *
   * Order matters: stack traces are highest value and a CI log often *contains*
   * a trace, so stacktrace is checked first, then cilog, then json.
   */

  const FRAME_RE = [
    /^\s*at\s+.+\(.+:\d+:\d+\)\s*$/,          // JS: at fn (file:line:col)
    /^\s*at\s+.+:\d+:\d+\s*$/,                 // JS: at file:line:col
    /^\s*at\s+[\w$.<>]+\(.+\.\w+:\d+\)/,       // Java/Kotlin: at pkg.Cls.m(File.java:42)
    /^\s*File\s+".+",\s+line\s+\d+/,           // Python frame
    /^\s+\w+.*\([^)]*\.(go|rs):\d+\)/,         // Go/Rust frame with file:line
    /^\s*#\d+\s+0x[0-9a-f]+/,                  // native/gdb frame
  ];

  const STACK_HEADER_RE = [
    /Traceback \(most recent call last\)/,
    /Exception in thread/,
    /\bat Object\.<anonymous>\b/,
    /thread '.*' panicked at/,
    /^panic:/m,
    /goroutine \d+ \[/,
  ];

  function countFrames(lines) {
    let n = 0;
    for (const line of lines) {
      if (FRAME_RE.some((re) => re.test(line))) n++;
    }
    return n;
  }

  function matchesStackTrace(input, lines) {
    const frames = countFrames(lines);
    const header = STACK_HEADER_RE.some((re) => re.test(input));
    // A single explicit header (Traceback/panic) counts as strong evidence even
    // with few parsed frames; otherwise require 2+ frame-like lines.
    if (!header && frames < 2) return { match: false, confidence: 0, frames };
    // Confidence scales with frame count; a header alone floors it at 0.6.
    let confidence = Math.min(0.97, 0.15 * frames);
    if (header) confidence = Math.max(confidence, 0.6 + Math.min(0.3, 0.05 * frames));
    return { match: true, confidence: Number(confidence.toFixed(2)), frames };
  }

  const TS_RE = /(\b\d{1,2}:\d{2}:\d{2}\b)|(\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2})/;
  const PROGRESS_RE = /(\d{1,3}%)|(\bDownloading\b)|(\bnpm (WARN|notice|http)\b)|(##\[(group|endgroup|command)\])|(\[\d+\/\d+\])|(▕|█|━|⠿)|(\bETA\b)|(\r$)/;

  function matchesCiLog(input, lines) {
    if (lines.length < 8) return { match: false, confidence: 0 };
    let logish = 0;
    const seen = new Map();
    let repeats = 0;
    for (const line of lines) {
      if (TS_RE.test(line) || PROGRESS_RE.test(line)) logish++;
      const norm = line.replace(/\d+/g, '#').trim();
      if (norm) {
        const c = (seen.get(norm) || 0) + 1;
        seen.set(norm, c);
        if (c > 1) repeats++;
      }
    }
    const density = logish / lines.length;
    const repeatRatio = repeats / lines.length;
    if (density < 0.4 && repeatRatio < 0.4) return { match: false, confidence: 0 };
    const confidence = Math.min(0.95, Math.max(density, repeatRatio) + 0.15);
    return { match: true, confidence: Number(confidence.toFixed(2)) };
  }

  function matchesJsonPayload(input) {
    const trimmed = input.trim();
    if (/^[[{]/.test(trimmed)) {
      try {
        JSON.parse(trimmed);
        return { match: true, confidence: 0.95 };
      } catch (_) { /* not strict JSON — fall through to heuristic */ }
    }
    const lines = trimmed.split('\n');
    if (lines.length < 4) return { match: false, confidence: 0 };
    let kv = 0;
    for (const line of lines) {
      if (/^\s*"[^"]+"\s*:\s*.+/.test(line) || /^\s*[}\]],?\s*$/.test(line)) kv++;
    }
    const ratio = kv / lines.length;
    if (ratio < 0.6) return { match: false, confidence: 0 };
    return { match: true, confidence: Number(Math.min(0.9, ratio).toFixed(2)) };
  }

  /**
   * @param {string} input
   * @returns {{ category: 'stacktrace'|'cilog'|'json'|null, confidence: number }}
   */
  function classify(input) {
    if (typeof input !== 'string' || !input.trim()) return { category: null, confidence: 0 };
    const lines = input.split('\n');

    const st = matchesStackTrace(input, lines);
    if (st.match) return { category: 'stacktrace', confidence: st.confidence };

    const ci = matchesCiLog(input, lines);
    if (ci.match) return { category: 'cilog', confidence: ci.confidence };

    const js = matchesJsonPayload(input);
    if (js.match) return { category: 'json', confidence: js.confidence };

    return { category: null, confidence: 0 };
  }

  module.exports = { classify, countFrames };
  
};

// ── ./src/squeeze/index ──
__factories["./src/squeeze/index"] = function(module, exports) {
  
  /**
   * Squeeze orchestrator (v7.0.0): classify → squeeze → reduction → decision.
   *
   * Always-on and silent: callers run `squeeze()` on pasted input, then use
   * `shouldPrompt()` to decide whether the reduction is worth interrupting for.
   * Everything is deterministic and offline; the symbol index for stack-trace
   * enrichment is passed through via `opts.symbolIndex`.
   */

  const { classify } = __require('./src/squeeze/classify');
  const { squeezeStackTrace } = __require('./src/squeeze/stacktrace');
  const { squeezeCiLog } = __require('./src/squeeze/cilog');
  const { squeezeJsonPayload } = __require('./src/squeeze/jsonpayload');

  function estimateTokens(s) { return Math.ceil(String(s || '').length / 4); }

  /**
   * @param {string} input
   * @param {object} [opts]  forwarded to the category squeezer (srcDirs, symbolIndex, …)
   * @returns {{ category, confidence, original, squeezed, rawTokens, squeezedTokens, reduction, kept, stripped, enriched, applies }}
   */
  function squeeze(input, opts = {}) {
    const { category, confidence } = classify(input);
    const rawTokens = estimateTokens(input);
    const base = {
      category, confidence, original: input, squeezed: input,
      rawTokens, squeezedTokens: rawTokens, reduction: 0,
      kept: [], stripped: [], enriched: false, applies: false,
    };
    if (!category) return base;

    let r;
    if (category === 'stacktrace') r = squeezeStackTrace(input, opts);
    else if (category === 'cilog') r = squeezeCiLog(input, opts);
    else r = squeezeJsonPayload(input, opts);

    const squeezedTokens = estimateTokens(r.squeezed);
    const reduction = rawTokens > 0 ? (rawTokens - squeezedTokens) / rawTokens : 0;
    return {
      category, confidence,
      original: input, squeezed: r.squeezed,
      rawTokens, squeezedTokens,
      reduction: Math.max(0, Number(reduction.toFixed(4))),
      kept: r.kept || [], stripped: r.stripped || [], enriched: !!r.enriched,
      applies: squeezedTokens < rawTokens,
    };
  }

  /** True when the reduction clears the threshold (accepts 0–1 or 0–100). */
  function shouldPrompt(reduction, threshold) {
    const t = threshold > 1 ? threshold / 100 : threshold;
    return reduction >= t;
  }

  /** A compact human summary of what squeeze would do (for the prompt). */
  function formatSummary(result) {
    const pct = Math.round(result.reduction * 100);
    const lines = [
      `Input: ${result.rawTokens.toLocaleString()} tokens`,
      `Can reduce to ${result.squeezedTokens.toLocaleString()} tokens (${pct}% smaller):`,
    ];
    for (const k of result.kept) lines.push(`  ✓ Kept: ${k}`);
    for (const s of result.stripped) lines.push(`  ✗ Stripped: ${s}`);
    return lines.join('\n');
  }

  module.exports = { squeeze, shouldPrompt, formatSummary, estimateTokens };
  
};

// ── ./src/squeeze/jsonpayload ──
__factories["./src/squeeze/jsonpayload"] = function(module, exports) {
  
  /**
   * JSON-payload squeeze (v7.0.0).
   *
   * Collapses repeated array elements, truncates long string values, and
   * preserves the schema shape at every depth — so an LLM still sees the
   * structure of an API/GraphQL/validation error without the bulk.
   */

  const MAX_STR = 500;
  const ARRAY_KEEP = 2;

  function squeezeValue(v, opts) {
    const maxStr = opts.maxStr;
    const keep = opts.arrayKeep;
    if (Array.isArray(v)) {
      if (v.length <= keep + 1) return v.map((x) => squeezeValue(x, opts));
      const head = v.slice(0, keep).map((x) => squeezeValue(x, opts));
      head.push(`…${v.length - keep} more similar items`);
      return head;
    }
    if (v && typeof v === 'object') {
      const o = {};
      for (const k of Object.keys(v)) o[k] = squeezeValue(v[k], opts);
      return o;
    }
    if (typeof v === 'string' && v.length > maxStr) {
      return v.slice(0, maxStr) + `…(${v.length} chars)`;
    }
    return v;
  }

  /**
   * @param {string} input
   * @param {object} [opts]
   * @param {number} [opts.maxStr=500]    truncate strings longer than this
   * @param {number} [opts.arrayKeep=2]   array items kept before collapsing
   * @returns {{ squeezed, kept, stripped }}
   */
  function squeezeJsonPayload(input, opts = {}) {
    let parsed;
    try { parsed = JSON.parse(input); }
    catch (_) { return { squeezed: input, kept: ['(not valid JSON — unchanged)'], stripped: [] }; }
    const cfg = { maxStr: opts.maxStr != null ? opts.maxStr : MAX_STR, arrayKeep: opts.arrayKeep != null ? opts.arrayKeep : ARRAY_KEEP };
    const squeezed = JSON.stringify(squeezeValue(parsed, cfg), null, 2);
    return {
      squeezed,
      kept: ['schema shape preserved at all depths'],
      stripped: ['collapsed repeated array items; truncated long string values'],
    };
  }

  module.exports = { squeezeJsonPayload, squeezeValue };
  
};

// ── ./src/squeeze/stacktrace ──
__factories["./src/squeeze/stacktrace"] = function(module, exports) {
  
  /**
   * Stack-trace squeeze (v7.0.0) — the highest-value squeeze module.
   *
   * Dedupes repeated exceptions, strips vendor frames, keeps frames in the user's
   * own source dirs, and — the differentiator — **enriches the top kept frame**
   * with its real signature from the SigMap symbol index (`buildSigIndex`).
   * Generic log summarizers can't do this; SigMap has the repo's symbol map.
   *
   * Pure/deterministic. The symbol index is injected via `opts.symbolIndex` so
   * the module is unit-testable without touching the filesystem.
   */

  const path = require('path');

  const VENDOR_RE = /(?:^|[\\/])(?:node_modules|vendor|site-packages|dist|build|\.venv|venv|third_party|external|\.cargo|go\/pkg\/mod)[\\/]/;

  /** Parse a frame line across JS/TS, Python, Java/Kotlin, Go, Rust, native. */
  function parseFrame(line) {
    let m;
    if ((m = line.match(/^\s*at\s+(.+?)\s+\((.+?):(\d+):(\d+)\)/))) return { fn: m[1], file: m[2], line: +m[3], raw: line };
    if ((m = line.match(/^\s*at\s+(.+?):(\d+):(\d+)\s*$/))) return { fn: '', file: m[1], line: +m[2], raw: line };
    if ((m = line.match(/^\s*at\s+([\w$.<>]+)\((.+?):(\d+)\)/))) return { fn: m[1], file: m[2], line: +m[3], raw: line };
    if ((m = line.match(/^\s*File\s+"(.+?)",\s+line\s+(\d+)(?:,\s+in\s+(.+))?/))) return { fn: (m[3] || '').trim(), file: m[1], line: +m[2], raw: line };
    if ((m = line.match(/^\s*(.+\.(?:go|rs)):(\d+)/))) return { fn: '', file: m[1], line: +m[2], raw: line };
    return null;
  }

  function isVendor(file) { return VENDOR_RE.test(String(file).replace(/\\/g, '/')); }

  function inSrcDirs(file, srcDirs) {
    const f = String(file).replace(/\\/g, '/');
    return srcDirs.some((d) => {
      const dd = String(d).replace(/^\.\//, '').replace(/\/$/, '');
      return dd && (f === dd || f.startsWith(dd + '/') || f.includes('/' + dd + '/'));
    });
  }

  // A signature's `:start-end` anchor. The one-line doc hint follows it
  // (`foo(a)  :10-20  # does x`), so the anchor is not always the last thing on the line.
  const ANCHOR_RE = /\s:(\d+)(?:-(\d+))?(?:\s{2,}#.*)?$/;

  /**
   * Whether a signature DECLARES `name`, as opposed to merely mentioning it. An
   * export list (`module.exports = { a, b }`) names every function it exports but
   * defines none of them, and a parameter or a body can carry the name too, so the
   * name must sit in the declarator — ahead of the first `(`, `{` or `=`.
   */
  function declares(sig, name) {
    const head = sig.replace(ANCHOR_RE, '');
    return new RegExp('\\b' + name.replace(/[^\w$]/g, '') + '\\b').test(head.split(/[({=]/, 1)[0]);
  }

  /** Look up the real signature for a frame in the SigMap symbol index. */
  function enrichFrame(frame, symbolIndex) {
    if (!symbolIndex || !frame) return null;
    const want = String(frame.file).replace(/\\/g, '/');
    const base = path.basename(want);
    let key = null;
    for (const k0 of symbolIndex.keys()) {
      const k = String(k0).replace(/\\/g, '/');
      if (k === want || want.endsWith('/' + k) || k.endsWith('/' + want)) { key = k0; break; }
      if (!key && path.basename(k) === base) key = k0;
    }
    if (!key) return null;
    const sigs = symbolIndex.get(key) || [];
    const wantFn = frame.fn ? frame.fn.split('.').pop() : '';
    let byLine = null, byLineSpan = Infinity, byName = null;
    for (const sig of sigs) {
      const s = String(sig);
      const mm = s.match(ANCHOR_RE);
      if (mm) {
        const a = +mm[1], b = mm[2] ? +mm[2] : a;
        // The narrowest range around the line: a method, not the class that holds it.
        if (frame.line >= a && frame.line <= b && b - a < byLineSpan) { byLine = s; byLineSpan = b - a; }
      }
      if (wantFn && !byName && declares(s, wantFn)) byName = s;
    }
    const sig = byLine || byName;
    return sig ? { file: key, sig: sig.replace(ANCHOR_RE, '').trim() } : null;
  }

  /**
   * @param {string} input
   * @param {object} [opts]
   * @param {string[]} [opts.srcDirs]      user source dirs (default ['src'])
   * @param {Map}      [opts.symbolIndex]  SigMap signature index for enrichment
   * @param {number}   [opts.maxFrames=8]  cap on kept source frames
   * @returns {{ squeezed, kept, stripped, enriched }}
   */
  function squeezeStackTrace(input, opts = {}) {
    const srcDirs = (opts.srcDirs && opts.srcDirs.length) ? opts.srcDirs : ['src'];
    const maxFrames = opts.maxFrames != null ? opts.maxFrames : 8;
    const lines = input.split('\n');

    const headerCount = new Map();
    const headerOrder = [];
    const frames = [];
    for (const line of lines) {
      const f = parseFrame(line);
      if (f) { frames.push(f); continue; }
      const t = line.trim();
      if (!t) continue;
      if (!headerCount.has(t)) headerOrder.push(t);
      headerCount.set(t, (headerCount.get(t) || 0) + 1);
    }

    const seen = new Set();
    let dupFrames = 0;
    const nonVendor = [];
    const sourceFrames = [];
    let vendorCount = 0;
    for (const f of frames) {
      const k = f.file + ':' + f.line;
      if (seen.has(k)) { dupFrames++; continue; }
      seen.add(k);
      if (isVendor(f.file)) { vendorCount++; continue; }
      nonVendor.push(f);
      if (inSrcDirs(f.file, srcDirs)) sourceFrames.push(f);
    }

    // Prefer source frames; never return empty (fall back to top non-vendor, then raw).
    const shown = sourceFrames.length ? sourceFrames.slice(0, maxFrames)
      : (nonVendor.length ? nonVendor.slice(0, 3) : frames.slice(0, 3));

    const enrichment = shown.length ? enrichFrame(shown[0], opts.symbolIndex) : null;

    const out = [];
    for (const h of headerOrder) {
      const n = headerCount.get(h);
      out.push(n > 1 ? `${h}   (occurred ×${n})` : h);
    }
    for (let i = 0; i < shown.length; i++) {
      out.push('    ' + shown[i].raw.trim());
      if (i === 0 && enrichment) out.push(`      ↳ ${enrichment.sig}   [${enrichment.file}]`);
    }

    return {
      squeezed: out.join('\n'),
      kept: [
        `${headerOrder.length} unique exception(s)`,
        `top ${shown.length} ${sourceFrames.length ? 'source ' : ''}frame(s)`,
        ...(enrichment ? [`enriched ${path.basename(shown[0].file)}:${shown[0].line}`] : []),
      ],
      stripped: [`${vendorCount} vendor frame(s)`, `${dupFrames} duplicate frame(s)`],
      enriched: !!enrichment,
    };
  }

  module.exports = { squeezeStackTrace, parseFrame, isVendor, inSrcDirs, enrichFrame };
  
};

// ── ./src/tracking/aggregate ──
__factories["./src/tracking/aggregate"] = function(module, exports) {
  
  /**
   * SigMap usage aggregation for the `gain` dashboard.
   *
   * Pure, zero-dependency functions that turn raw NDJSON usage records into the
   * totals / by-operation / time-bucket shapes the terminal renderer consumes.
   *
   * Tolerant of BOTH schemas:
   *   - new:    { op, baselineTokens, actualTokens, savedTokens, savedPct, durationMs, model }
   *   - legacy: { rawTokens, finalTokens, reductionPct }   (from logger.js v0.9)
   *
   * "saved" is a counterfactual estimate (baseline − actual), never a measured
   * delta. Callers are responsible for labeling it as such in the UI.
   */

  const { resolvePrice } = __require('./src/tracking/pricing');
  const { resolveProfile, tokenBasis } = __require('./src/config/models');

  const clamp = (n, lo, hi) => Math.max(lo, Math.min(hi, n));

  /**
   * Normalize one raw record into a canonical shape.
   * @param {object} rec
   */
  function normalize(rec) {
    const baseline = num(rec.baselineTokens != null ? rec.baselineTokens : rec.rawTokens);
    const actual = num(rec.actualTokens != null ? rec.actualTokens : rec.finalTokens);
    const saved = rec.savedTokens != null ? num(rec.savedTokens) : Math.max(0, baseline - actual);
    const savedPct = rec.savedPct != null
      ? num(rec.savedPct)
      : rec.reductionPct != null
        ? num(rec.reductionPct)
        : baseline > 0 ? (saved / baseline) * 100 : 0;
    return {
      ts: rec.ts || null,
      op: normalizeOp(rec.op),
      baseline,
      actual,
      saved,
      savedPct: clamp(savedPct, 0, 100),
      durationMs: num(rec.durationMs),
      model: rec.model || null,
    };
  }

  function normalizeOp(op) {
    if (!op) return 'generate';
    return String(op);
  }

  function num(v) {
    const n = Number(v);
    return Number.isFinite(n) ? n : 0;
  }

  /**
   * Parse a --since value into a cutoff Date (or null for "all time").
   * Accepts: "7d", "30d", "12h", or an ISO date "2026-06-01".
   * @param {string} since
   * @param {number} [nowMs] - injectable clock for tests
   * @returns {Date|null}
   */
  function parseSince(since, nowMs) {
    if (!since) return null;
    const now = nowMs != null ? nowMs : Date.now();
    const rel = /^(\d+)([dhw])$/.exec(String(since).trim());
    if (rel) {
      const n = parseInt(rel[1], 10);
      const unit = rel[2];
      const ms = unit === 'h' ? 3.6e6 : unit === 'w' ? 6.048e8 : 8.64e7;
      return new Date(now - n * ms);
    }
    const d = new Date(since);
    return Number.isNaN(d.getTime()) ? null : d;
  }

  /**
   * Bucket records by calendar granularity.
   * @param {object[]} records - normalized records
   * @param {'day'|'week'|'month'} granularity
   * @returns {Array<{key,count,baseline,actual,saved,savedPct,ms}>} ascending by key
   */
  function bucketBy(records, granularity) {
    const map = new Map();
    for (const r of records) {
      if (!r.ts) continue;
      const key = bucketKey(r.ts, granularity);
      if (!key) continue;
      let b = map.get(key);
      if (!b) { b = { key, count: 0, baseline: 0, actual: 0, saved: 0, ms: 0 }; map.set(key, b); }
      b.count += 1;
      b.baseline += r.baseline;
      b.actual += r.actual;
      b.saved += r.saved;
      b.ms += r.durationMs;
    }
    return [...map.values()]
      .map((b) => ({ ...b, savedPct: b.baseline > 0 ? clamp((b.saved / b.baseline) * 100, 0, 100) : 0 }))
      .sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
  }

  function bucketKey(ts, granularity) {
    const d = new Date(ts);
    if (Number.isNaN(d.getTime())) return null;
    const y = d.getUTCFullYear();
    const m = String(d.getUTCMonth() + 1).padStart(2, '0');
    const day = String(d.getUTCDate()).padStart(2, '0');
    if (granularity === 'month') return `${y}-${m}`;
    if (granularity === 'week') {
      // ISO-ish: key by the Monday (UTC) of that week.
      const tmp = new Date(Date.UTC(y, d.getUTCMonth(), d.getUTCDate()));
      const dow = (tmp.getUTCDay() + 6) % 7; // 0 = Monday
      tmp.setUTCDate(tmp.getUTCDate() - dow);
      return `${tmp.getUTCFullYear()}-${String(tmp.getUTCMonth() + 1).padStart(2, '0')}-${String(tmp.getUTCDate()).padStart(2, '0')}`;
    }
    return `${y}-${m}-${day}`;
  }

  /**
   * Full aggregation for the `gain` dashboard.
   * @param {object[]} rawRecords
   * @param {object} [opts]
   * @param {string} [opts.model]   pricing model
   * @param {object} [opts.profile] model profile from resolveProfile(config); shipped when omitted
   * @param {string} [opts.since]   window filter
   * @param {number} [opts.top]     limit byOp rows (0 = all)
   * @param {number} [opts.nowMs]   injectable clock
   * @returns {object}
   */
  function aggregate(rawRecords, opts = {}) {
    const price = resolvePrice(opts.model, opts.profile);
    // Logged counts are chars/4; a configured charsPerToken re-bases the dollar
    // figure, and its absence is carried as `estimated` so the views say so.
    const basis = tokenBasis(opts.profile || resolveProfile(), price.model);
    price.tokenBasis = basis.label;
    price.tokensEstimated = basis.estimated;
    const cutoff = parseSince(opts.since, opts.nowMs);

    let records = (rawRecords || []).map(normalize);
    if (cutoff) records = records.filter((r) => r.ts && new Date(r.ts) >= cutoff);

    const totals = {
      count: records.length,
      baseline: 0,
      actual: 0,
      saved: 0,
      totalMs: 0,
      savedPct: 0,
      avgMs: 0,
      usdSaved: 0,
      firstTs: null,
      lastTs: null,
    };

    const opMap = new Map();
    for (const r of records) {
      totals.baseline += r.baseline;
      totals.actual += r.actual;
      totals.saved += r.saved;
      totals.totalMs += r.durationMs;
      if (r.ts) {
        if (!totals.firstTs || r.ts < totals.firstTs) totals.firstTs = r.ts;
        if (!totals.lastTs || r.ts > totals.lastTs) totals.lastTs = r.ts;
      }
      let o = opMap.get(r.op);
      if (!o) { o = { op: r.op, count: 0, baseline: 0, saved: 0, ms: 0 }; opMap.set(r.op, o); }
      o.count += 1;
      o.baseline += r.baseline;
      o.saved += r.saved;
      o.ms += r.durationMs;
    }

    totals.savedPct = totals.baseline > 0 ? clamp((totals.saved / totals.baseline) * 100, 0, 100) : 0;
    totals.avgMs = totals.count > 0 ? Math.round(totals.totalMs / totals.count) : 0;
    totals.usdSaved = totals.saved * basis.scale * price.perToken;

    let byOp = [...opMap.values()].map((o) => ({
      op: o.op,
      count: o.count,
      saved: o.saved,
      avgPct: o.baseline > 0 ? clamp((o.saved / o.baseline) * 100, 0, 100) : 0,
      avgMs: o.count > 0 ? Math.round(o.ms / o.count) : 0,
      usdSaved: o.saved * basis.scale * price.perToken,
      sharePct: totals.saved > 0 ? (o.saved / totals.saved) * 100 : 0,
    })).sort((a, b) => b.saved - a.saved);

    if (opts.top && opts.top > 0) byOp = byOp.slice(0, opts.top);

    return {
      // The JSON consumer sees the same disclosure the terminal footer prints, and
      // the one `ask --json` / `--cost --json` carry as `costBasis` (#816).
      costBasis: 'estimate — saved = whole-file baseline minus SigMap context (a counterfactual); '
        + 'dollars apply a dated input-token price table, not billed usage',
      price,
      totals,
      byOp,
      buckets: {
        daily: bucketBy(records, 'day'),
        weekly: bucketBy(records, 'week'),
        monthly: bucketBy(records, 'month'),
      },
    };
  }

  module.exports = { aggregate, bucketBy, parseSince, normalize };
  
};

// ── ./src/tracking/budget ──
__factories["./src/tracking/budget"] = function(module, exports) {
  
  /**
   * Session spend ledger (v8.23 F1) — a queryable view over the existing gain
   * log (.context/gain.ndjson, written by recordUsage).
   *
   * Honesty scope: this ledger counts tokens **SigMap emitted** (chars/4
   * estimates), not the host chat's total spend — conversation history, model
   * output, and other tools are invisible to a CLI. Every number here is an
   * estimate and is labeled as such in output.
   *
   * Session identity: `SIGMAP_SESSION` env var when the host sets one, else a
   * UTC day bucket (YYYY-MM-DD). Legacy gain entries (written before the
   * `session` field existed) match day-bucket sessions by timestamp prefix.
   *
   * Zero dependencies; local JSON only.
   */

  const fs = require('fs');
  const path = require('path');
  const { readGainLog } = __require('./src/tracking/logger');

  // Same generated-context surfaces cache/freshen.js watches.
  const CONTEXT_PATHS = [
    ['.github', 'copilot-instructions.md'],
    ['CLAUDE.md'], ['AGENTS.md'], ['.github', 'context-cold.md'],
  ];

  /** Session key: SIGMAP_SESSION override, else UTC day bucket. */
  function sessionKey(env) {
    const e = env || process.env;
    if (e.SIGMAP_SESSION) return String(e.SIGMAP_SESSION);
    return new Date().toISOString().slice(0, 10);
  }

  /** Newest mtime (ms) among generated context files, or 0 if none exist. */
  function contextMtime(cwd) {
    let newest = 0;
    for (const parts of CONTEXT_PATHS) {
      try { newest = Math.max(newest, fs.statSync(path.join(cwd, ...parts)).mtimeMs); } catch (_) {}
    }
    return newest;
  }

  /** Does a gain-log entry belong to this session? */
  function entryInSession(entry, session) {
    if (entry.session) return entry.session === session;
    // Legacy entry: match day-bucket sessions on the timestamp date.
    return /^\d{4}-\d{2}-\d{2}$/.test(session) && String(entry.ts || '').startsWith(session);
  }

  /**
   * Session spend status.
   * @param {string} cwd
   * @param {object} [opts]
   * @param {string} [opts.session]          session key (default: sessionKey())
   * @param {number} [opts.budgetTokens]     budget override (else config sessionBudgetTokens)
   * @param {number} [opts.contextTtlDays]   TTL override (else config contextTtlDays)
   * @param {object} [opts.config]           loaded config (for the two keys above)
   * @param {number} [opts.now]              clock override for tests (ms)
   * @returns {{
   *   session: string, unit: 'estimated-tokens', ops: number,
   *   spentTokens: number, baselineTokens: number, savedTokens: number,
   *   budgetTokens: number|null, remainingTokens: number|null, pctUsed: number|null,
   *   overBudget: boolean,
   *   context: { exists: boolean, ageMs: number|null, ageDays: number|null,
   *              ttlDays: number|null, stale: boolean }
   * }}
   */
  function budgetStatus(cwd, opts = {}) {
    const session = opts.session || sessionKey();
    const cfg = opts.config || {};
    const budget = opts.budgetTokens != null ? Number(opts.budgetTokens)
      : (Number.isFinite(cfg.sessionBudgetTokens) ? cfg.sessionBudgetTokens : null);
    const ttlDays = opts.contextTtlDays != null ? Number(opts.contextTtlDays)
      : (Number.isFinite(cfg.contextTtlDays) ? cfg.contextTtlDays : null);
    const now = opts.now != null ? opts.now : Date.now();

    let ops = 0, spent = 0, baseline = 0, saved = 0;
    for (const e of readGainLog(cwd)) {
      if (!entryInSession(e, session)) continue;
      ops++;
      spent += Number(e.actualTokens) || 0;
      baseline += Number(e.baselineTokens) || 0;
      saved += Number(e.savedTokens) || 0;
    }

    const mtime = contextMtime(cwd);
    const ageMs = mtime > 0 ? Math.max(0, now - mtime) : null;
    const ageDays = ageMs != null ? ageMs / 86400000 : null;

    const status = {
      session,
      unit: 'estimated-tokens',
      ops,
      spentTokens: spent,
      baselineTokens: baseline,
      savedTokens: saved,
      budgetTokens: budget,
      remainingTokens: budget != null ? Math.max(0, budget - spent) : null,
      pctUsed: budget > 0 ? Math.round((spent / budget) * 1000) / 10 : null,
      overBudget: budget != null && spent > budget,
      context: {
        exists: mtime > 0,
        ageMs,
        ageDays: ageDays != null ? Math.round(ageDays * 10) / 10 : null,
        ttlDays,
        stale: ttlDays != null && ageDays != null && ageDays > ttlDays,
      },
    };

    // #922: when this session is one the session store knows (a real agent session id,
    // e.g. SIGMAP_SESSION=cc-<uuid> exported by the Claude Code SessionStart hook), add
    // the host's billed tokens as a SEPARATE block. It is a different provenance class
    // from the chars/4 SigMap-emitted figures above, so it is never added into them and
    // nothing about the existing fields changes. Absent for day-bucket sessions.
    try {
      const { readSessions } = __require('./src/session/store');
      const { measuredBlock } = __require('./src/session/render');
      const found = readSessions(cwd).sessions.find((s) => s.id === session);
      if (found) status.measured = measuredBlock(found);
    } catch (_) { /* the ledger works without the session store */ }

    return status;
  }

  module.exports = { sessionKey, budgetStatus, contextMtime, entryInSession };
  
};

// ── ./src/tracking/logger ──
__factories["./src/tracking/logger"] = function(module, exports) {
  
  /**
   * SigMap usage logger (v0.9)
   *
   * Writes an append-only newline-delimited JSON (NDJSON) log at
   *   .context/usage.ndjson
   *
   * Each line is one JSON object describing a gen-context run.
   * Zero npm dependencies — pure Node.js fs.
   *
   * Enabled by:
   *   config.tracking: true   (gen-context.config.json)
   *   --track CLI flag
   */

  const fs = require('fs');
  const path = require('path');

  const LOG_FILE = path.join('.context', 'usage.ndjson');
  // Dedicated log for the `gain` dashboard (extended schema). Kept separate from
  // usage.ndjson so the legacy health/nudge history never collides with it.
  const GAIN_FILE = path.join('.context', 'gain.ndjson');

  /**
   * Append one run entry to the usage log.
   * @param {object} entry - Run metrics from runGenerate()
   * @param {string} cwd   - Project root (absolute path)
   */
  function logRun(entry, cwd) {
    try {
      const logPath = path.join(cwd, LOG_FILE);
      const dir = path.dirname(logPath);
      if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });

      const record = {
        ts: new Date().toISOString(),
        version: entry.version || '0.9.0',
        fileCount: entry.fileCount || 0,
        droppedCount: entry.droppedCount || 0,
        rawTokens: entry.rawTokens || 0,
        finalTokens: entry.finalTokens || 0,
        reductionPct: entry.rawTokens > 0
          ? parseFloat((100 - (entry.finalTokens / entry.rawTokens) * 100).toFixed(1))
          : 0,
        overBudget: entry.overBudget || false,
        budgetLimit: entry.budgetLimit || 6000,
      };

      fs.appendFileSync(logPath, JSON.stringify(record) + '\n', 'utf8');
    } catch (err) {
      // Never crash the main process — tracking is optional
      process.stderr.write(`[sigmap] tracking: could not write log: ${err.message}\n`);
    }
  }

  /**
   * Read and parse all usage log entries.
   * @param {string} cwd - Project root (absolute path)
   * @returns {object[]} Array of parsed log records (oldest first)
   */
  function readLog(cwd) {
    try {
      const logPath = path.join(cwd, LOG_FILE);
      if (!fs.existsSync(logPath)) return [];
      const raw = fs.readFileSync(logPath, 'utf8');
      return raw
        .split('\n')
        .filter(Boolean)
        .map((line) => {
          try { return JSON.parse(line); } catch (_) { return null; }
        })
        .filter(Boolean);
    } catch (_) {
      return [];
    }
  }

  /**
   * Read and parse all `gain` dashboard records (oldest first).
   * @param {string} cwd
   * @returns {object[]}
   */
  function readGainLog(cwd) {
    try {
      const logPath = path.join(cwd, GAIN_FILE);
      if (!fs.existsSync(logPath)) return [];
      return fs.readFileSync(logPath, 'utf8')
        .split('\n')
        .filter(Boolean)
        .map((line) => { try { return JSON.parse(line); } catch (_) { return null; } })
        .filter(Boolean);
    } catch (_) {
      return [];
    }
  }

  /**
   * Compute summary statistics from an array of log records.
   * @param {object[]} entries
   * @returns {object} Summary stats
   */
  function summarize(entries) {
    if (!entries || entries.length === 0) {
      return {
        totalRuns: 0,
        avgReductionPct: 0,
        avgFinalTokens: 0,
        avgRawTokens: 0,
        minFinalTokens: 0,
        maxFinalTokens: 0,
        firstRun: null,
        lastRun: null,
        overBudgetRuns: 0,
      };
    }

    const reductions = entries.map((e) => e.reductionPct || 0);
    const finals = entries.map((e) => e.finalTokens || 0);
    const raws = entries.map((e) => e.rawTokens || 0);

    const avg = (arr) => arr.reduce((a, b) => a + b, 0) / arr.length;

    return {
      totalRuns: entries.length,
      avgReductionPct: parseFloat(avg(reductions).toFixed(1)),
      avgFinalTokens: Math.round(avg(finals)),
      avgRawTokens: Math.round(avg(raws)),
      minFinalTokens: Math.min(...finals),
      maxFinalTokens: Math.max(...finals),
      firstRun: entries[0].ts || null,
      lastRun: entries[entries.length - 1].ts || null,
      overBudgetRuns: entries.filter((e) => e.overBudget).length,
    };
  }

  /**
   * Whether `gain` savings capture is enabled. Default: ON (privacy-safe,
   * local-only, counts only — no paths, source, or query text). This is
   * intentionally decoupled from the legacy `config.tracking` flag (which gates
   * the usage.ndjson health log and defaults OFF). Opt out of gain capture via:
   *   config.gainTracking === false   ·   --no-track   ·   SIGMAP_NO_TRACK=1
   * @param {object} [config]
   * @param {string[]} [argv]
   * @returns {boolean}
   */
  function isTrackingEnabled(config, argv) {
    const a = argv || (typeof process !== 'undefined' ? process.argv : []);
    if (process.env && process.env.SIGMAP_NO_TRACK) return false;
    if (a && a.includes('--no-track')) return false;
    if (config && config.gainTracking === false) return false;
    return true;
  }

  /**
   * Append one operation to the usage log using the extended `gain` schema.
   * Reuses the same NDJSON file as logRun and is tolerant of partial input.
   * Never throws — tracking must never break the main process.
   *
   * @param {object} entry
   * @param {string} entry.op             e.g. 'ask' | 'generate' | 'query' | 'mcp:get_map'
   * @param {number} entry.baselineTokens whole-file / candidate baseline (counterfactual)
   * @param {number} entry.actualTokens   tokens SigMap actually emitted
   * @param {number} [entry.durationMs]
   * @param {string} [entry.model]
   * @param {string} [entry.version]
   * @param {string} cwd
   */
  function recordUsage(entry, cwd) {
    try {
      const logPath = path.join(cwd, GAIN_FILE);
      const dir = path.dirname(logPath);
      if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });

      const baseline = Math.max(0, Number(entry.baselineTokens) || 0);
      const actual = Math.max(0, Number(entry.actualTokens) || 0);
      const saved = Math.max(0, baseline - actual);
      const ts = new Date().toISOString();
      const record = {
        ts,
        v: entry.version || '0.9.0',
        op: entry.op || 'generate',
        session: entry.session || process.env.SIGMAP_SESSION || ts.slice(0, 10),
        baselineTokens: baseline,
        actualTokens: actual,
        savedTokens: saved,
        savedPct: baseline > 0 ? parseFloat(((saved / baseline) * 100).toFixed(1)) : 0,
        durationMs: Math.max(0, Math.round(Number(entry.durationMs) || 0)),
        model: entry.model || null,
        ok: entry.ok !== false,
      };
      fs.appendFileSync(logPath, JSON.stringify(record) + '\n', 'utf8');
    } catch (err) {
      // Never crash the main process — tracking is optional.
      if (process.stderr) process.stderr.write(`[sigmap] tracking: could not write log: ${err.message}\n`);
    }
  }

  module.exports = { logRun, recordUsage, readLog, readGainLog, summarize, isTrackingEnabled, GAIN_FILE };
  
};

// ── ./src/tracking/pricing ──
__factories["./src/tracking/pricing"] = function(module, exports) {
  
  /**
   * SigMap pricing — input-token $/Mtok assumptions for `gain`, `--cost` and `ask`.
   *
   * These are ASSUMPTIONS used only to translate "tokens saved" into an estimated
   * dollar figure. The figures themselves live in the dated model profile
   * (src/config/models.js) — this module holds no price of its own, so the names
   * the routing advice prints and the names priced here cannot drift apart
   * (#688, #778). Override per project via the `models` config namespace, or pick
   * a model with `--model <name>`. Every view prints the model, the rate and the
   * profile date inline so the $ is never presented as exact. Zero npm dependencies.
   */

  const { resolveProfile, lookup, DEFAULT_MODEL } = __require('./src/config/models');

  const SHIPPED = resolveProfile();

  function _priceMap(profile) {
    const out = {};
    for (const [id, m] of Object.entries(profile.models)) {
      if (m.inputPerMtok != null) out[id] = m.inputPerMtok;
    }
    for (const [alias, id] of Object.entries(profile.aliases)) {
      if (out[id] != null) out[alias] = out[id];
    }
    return out;
  }

  // USD per 1,000,000 input tokens, keyed by every accepted name (ids + aliases)
  // of the shipped profile.
  const PRICES = _priceMap(SHIPPED);

  /**
   * Resolve a price (USD per token) for a model name.
   *
   * Unknown keys fall back to DEFAULT_MODEL rather than crashing the dashboard,
   * but the fallback is reported (#665): `requested` carries the original
   * (trimmed) input and `fallback` is true only when a non-empty, explicitly
   * requested key was unknown. A bare `resolvePrice()`/`resolvePrice('')` is the
   * documented default path, not a fallback.
   *
   * `model` is the profile's id for the name, so an alias (`claude-sonnet`)
   * reports the model it currently stands for.
   * @param {string} [model]
   * @param {object} [profile] - from resolveProfile(config); the shipped profile when omitted
   * @returns {{ model: string, perMtok: number, perToken: number, requested: string|null, fallback: boolean, asOf: string, asOfSource: string }}
   */
  function resolvePrice(model, profile) {
    const p = profile || SHIPPED;
    const requested = String(model == null ? '' : model).trim();
    const hit = lookup(p, requested || DEFAULT_MODEL);
    const known = !!(hit && hit.model.inputPerMtok != null);
    const used = known ? hit : lookup(p, DEFAULT_MODEL);
    const perMtok = used.model.inputPerMtok;
    return {
      model: used.id,
      perMtok,
      perToken: perMtok / 1_000_000,
      requested: requested || null,
      fallback: !known && requested !== '',
      asOf: p.asOf,
      asOfSource: p.asOfSource,
    };
  }

  /**
   * @param {object} [profile] - from resolveProfile(config); the shipped profile when omitted
   * @returns {string[]} current model names (ids, then aliases), plus explicit project choices
   */
  function listModels(profile) {
    const p = profile || SHIPPED;
    return Object.keys(profile ? _priceMap(profile) : PRICES).filter((name) => {
      const hit = lookup(p, name);
      return !hit.model.legacy || hit.model.source === 'config' || p.roster.includes(hit.id);
    });
  }

  module.exports = { PRICES, DEFAULT_MODEL, resolvePrice, listModels };
  
};

// ── ./src/tracking/usage-source ──
__factories["./src/tracking/usage-source"] = function(module, exports) {
  
  /**
   * One read path for run history (#773).
   *
   * Four surfaces published a token-reduction figure and no two were comparable:
   *
   *   --health   "no history", 0 runs      read usage.ndjson
   *   gain       2,047 operations, 96.5%   read gain.ndjson
   *   budget     142 ops, session window   read gain.ndjson, windowed
   *   --report   97.6%                     this run only
   *
   * The cause was not arithmetic. `tracking` defaults to FALSE, so
   * `.context/usage.ndjson` is never written — and that is the store `--health`,
   * `history` and the dashboard read. Meanwhile `recordUsage` writes
   * `.context/gain.ndjson` unconditionally. Two stores for one concept, and the
   * three surfaces that looked empty were reading the one nobody fills.
   *
   * (`.context/usage.json` is NOT a third token store despite appearances — it is
   * the star-nudge run counter and has nothing to do with tokens.)
   *
   * This module is the single read path. It normalises both stores into one
   * record shape and reports which contributed, so a caller can label what it is
   * showing rather than implying a population it does not have.
   */

  const fs = require('fs');
  const path = require('path');

  const USAGE_FILE = path.join('.context', 'usage.ndjson');
  const GAIN_FILE  = path.join('.context', 'gain.ndjson');

  function readNdjson(file) {
    try {
      if (!fs.existsSync(file)) return [];
      return fs.readFileSync(file, 'utf8')
        .split('\n')
        .filter(Boolean)
        .map((l) => { try { return JSON.parse(l); } catch (_) { return null; } })
        .filter(Boolean);
    } catch (_) { return []; }
  }

  /**
   * Normalised run record. Only `generate` operations are runs — `gain` also
   * records `ask` queries, which are a different population and must not be
   * counted as runs (that conflation is how "2,047" and "525" both described
   * the same log).
   *
   * @returns {{ts:string, version:string, rawTokens:number, finalTokens:number,
   *            reductionPct:number, source:'usage'|'gain'}[]} oldest first
   */
  function readRuns(cwd) {
    const out = [];

    for (const e of readNdjson(path.join(cwd, USAGE_FILE))) {
      if (!e || typeof e.rawTokens !== 'number') continue;
      out.push({
        ts: e.ts, version: e.version || 'unknown',
        rawTokens: e.rawTokens, finalTokens: e.finalTokens || 0,
        reductionPct: typeof e.reductionPct === 'number' ? e.reductionPct : 0,
        // Only the tracked store records these. `null` means NOT RECORDED, not
        // zero/false — rendering an unrecorded field as a measured value is the
        // same defect #764 fixed in `bench --submit`.
        fileCount: typeof e.fileCount === 'number' ? e.fileCount : null,
        overBudget: typeof e.overBudget === 'boolean' ? e.overBudget : null,
        source: 'usage',
      });
    }

    for (const e of readNdjson(path.join(cwd, GAIN_FILE))) {
      if (!e || e.op !== 'generate' || typeof e.baselineTokens !== 'number') continue;
      out.push({
        ts: e.ts, version: e.v || 'unknown',
        rawTokens: e.baselineTokens, finalTokens: e.actualTokens || 0,
        reductionPct: typeof e.savedPct === 'number' ? e.savedPct : 0,
        fileCount: null,   // gain does not record it
        overBudget: null,  // gain does not record it
        source: 'gain',
      });
    }

    // A run logged to both stores appears twice; the timestamps are written in
    // the same call, so dedupe on the second.
    const seen = new Set();
    return out
      .filter((r) => {
        const key = String(r.ts).slice(0, 19);
        if (seen.has(key)) return false;
        seen.add(key);
        return true;
      })
      .sort((a, b) => String(a.ts).localeCompare(String(b.ts)));
  }

  /** Which stores actually hold data, for labelling the window a figure covers. */
  function describeSource(cwd) {
    const tracked = readNdjson(path.join(cwd, USAGE_FILE)).length;
    const gain = readNdjson(path.join(cwd, GAIN_FILE)).filter((e) => e && e.op === 'generate').length;
    return {
      tracked, gain,
      total: readRuns(cwd).length,
      stores: [tracked ? 'usage.ndjson' : null, gain ? 'gain.ndjson' : null].filter(Boolean),
    };
  }

  /** Task-weighted reduction over the given runs, with the baseline named. */
  function summarizeRuns(runs) {
    if (!runs || runs.length === 0) {
      return { totalRuns: 0, avgReductionPct: null, rawTokens: 0, finalTokens: 0 };
    }
    const rawTokens = runs.reduce((n, r) => n + (r.rawTokens || 0), 0);
    const finalTokens = runs.reduce((n, r) => n + (r.finalTokens || 0), 0);
    const avg = runs.reduce((n, r) => n + (r.reductionPct || 0), 0) / runs.length;
    return {
      totalRuns: runs.length,
      avgReductionPct: parseFloat(avg.toFixed(1)),
      rawTokens, finalTokens,
    };
  }

  module.exports = { readRuns, describeSource, summarizeRuns, USAGE_FILE, GAIN_FILE };
  
};

// ── ./src/util/context-dir ──
__factories["./src/util/context-dir"] = function(module, exports) {
  
  /**
   * `.context/` — SigMap's own state directory — keeps itself out of git.
   *
   * It holds derived indexes (`sig-index.json`, `body-words.json`), run telemetry
   * (`gain.ndjson`, `usage.json`) and session records (`sessions.ndjson`, which
   * carry the questions asked). None of it is source, and the user's own
   * `.gitignore` is not ours to edit.
   *
   * Several published pages said `sigmap --init` gitignores the directory. Nothing
   * did: `--init` writes a config and a `.contextignore`, and every other command
   * wrote into `.context/` and left `git add .` to commit it (#947). The words
   * cache turning on by default in v8.75.0 raised the stakes.
   *
   * The fix is the one `.pytest_cache`, `.ruff_cache` and `.mypy_cache` use: the
   * directory carries its own `.gitignore` holding `*`. That works on the first
   * run, with or without `--init`, in a repo that has no root `.gitignore`, and
   * the pattern ignores the file that holds it, so no stray untracked file
   * replaces the one it hides.
   *
   * Deliberately NOT done:
   *   - creating `.context/` — a command that wrote nothing there gets nothing;
   *   - overwriting an existing `.context/.gitignore` — a user who wants some of
   *     the directory tracked edits it and is left alone;
   *   - untracking — ignore rules never touch files git already tracks, so a repo
   *     that committed `.context/` under an earlier version keeps tracking it
   *     until `git rm -r --cached .context` (`sigmap doctor` says so).
   *
   * Zero dependencies, synchronous, never throws.
   */

  const fs = require('fs');
  const path = require('path');

  const CONTEXT_DIR = '.context';
  const SELF_IGNORE = '.gitignore';

  const BODY = [
    '# SigMap local state: derived indexes, caches, run telemetry and session records.',
    '# None of it is source, so nothing in this directory is committed.',
    '# SigMap writes this file only when it is absent; edit it to track part of the directory.',
    '*',
    '',
  ].join('\n');

  /**
   * Make `<cwd>/.context/` ignore itself.
   *
   * @param {string} cwd project root
   * @returns {'created'|'present'|'absent'|'unwritable'}
   *   `absent` when there is no `.context/` directory (nothing is created),
   *   `present` when a `.context/.gitignore` already exists (left byte-for-byte),
   *   `unwritable` when the directory cannot take the file (read-only checkout).
   */
  function ensureSelfIgnore(cwd) {
    const dir = path.join(cwd, CONTEXT_DIR);
    try {
      if (!fs.statSync(dir).isDirectory()) return 'absent';
    } catch (_) { return 'absent'; }
    const file = path.join(dir, SELF_IGNORE);
    try {
      if (fs.existsSync(file)) return 'present';
      // `wx`: fail rather than overwrite if another process won the race.
      fs.writeFileSync(file, BODY, { flag: 'wx' });
      return 'created';
    } catch (e) {
      return e && e.code === 'EEXIST' ? 'present' : 'unwritable';
    }
  }

  /**
   * Whether a directory-entry name under `.context/` is the self-ignore file.
   * The scans that key a cache on the newest mtime in `.context/` skip it, so
   * creating it never invalidates a cache.
   */
  function isSelfIgnore(name) {
    return name === SELF_IGNORE;
  }

  module.exports = { ensureSelfIgnore, isSelfIgnore, CONTEXT_DIR, SELF_IGNORE };
  
};

// ── ./src/util/dir-listing ──
__factories["./src/util/dir-listing"] = function(module, exports) {
  
  /**
   * One listing of a directory per run (#971).
   *
   * A generate run walks the same directories several times, each walker with its own rules: the file
   * collector, the test collector, the manifest finder, the coverage count. Each asked the filesystem again
   * (9,116 listings of 3,532 directories on Django), and a listing is the dearest call a warm run still
   * makes. Inside a run (`begin()` ... `end()`) the first listing of a directory is kept and the others
   * are served from it; outside one, every call goes to the filesystem as it always did.
   *
   * What a run may not see change is the set of entries of a directory it has already listed. Everything
   * a run writes is a context or index file, never a source file, and the walkers that read a listing
   * after the outputs are written (the coverage count) only count source files.
   *
   * Callers get their own array each time, so sorting it in place is safe.
   *
   * Zero-dependency, bundle-safe.
   */

  const fs = require('fs');

  let memo = null;

  /** Start sharing listings (and forget any from a previous run). */
  function begin() { memo = new Map(); }

  /** Stop sharing; every listing goes to the filesystem again. */
  function end() { memo = null; }

  /**
   * `fs.readdirSync(dir, { withFileTypes: true })`, shared within a run. Throws what readdirSync throws,
   * for a directory that cannot be read, every time it is asked.
   *
   * @param {string} dir
   * @returns {fs.Dirent[]}
   */
  function list(dir) {
    if (!memo) return fs.readdirSync(dir, { withFileTypes: true });
    let held = memo.get(dir);
    if (held === undefined) {
      try { held = fs.readdirSync(dir, { withFileTypes: true }); } catch (err) { held = err; }
      memo.set(dir, held);
    }
    if (held instanceof Error) throw held;
    return held.slice();
  }

  module.exports = { begin, end, list };
  
};

// ── ./src/util/file-class ──
__factories["./src/util/file-class"] = function(module, exports) {
  
  /**
   * file-class.js — single source of truth for file-category classification.
   *
   * Two subsystems classify files and MUST agree:
   *   1. the token-budget drop order (`gen-context.js`) — what gets dropped first
   *   2. the retrieval penalty (`src/retrieval/ranker.js`) — what gets demoted
   *
   * Before this module they kept divergent private copies, and the ranker's was
   * strictly weaker: its test pattern recognised only `foo.test.js` and `test/`
   * path segments, so Go's `routes_test.go`, Python's `test_foo.py`, Rust's
   * `foo_test.rs` and the JVM's `FooTest.java` were never penalised at all. On
   * the gin routing question that let `routes_test.go` and `middleware_test.go`
   * rank ABOVE `gin.go`, and a root `README.md` rank above `routergroup.go`
   * (#808). The budget order had the correct patterns the whole time (#592).
   *
   * Zero dependencies. Pure string predicates — no fs access, so both the
   * bundled CLI core and every `src/` module can share them.
   */

  /** Normalise to forward slashes so Windows paths classify identically. */
  function _norm(filePath) {
    return String(filePath || '').replace(/\\/g, '/');
  }

  /**
   * Test files, across every convention the extractors support.
   *
   * Filename forms: `foo.test.ts`, `foo.spec.js`, `foo_test.go`, `test_foo.py`,
   * plus the PascalCase JVM/C#/Swift family (`FooTest.java`, `FooTests.kt`,
   * `FooSpec.scala`). The `[a-z0-9]` guard keeps `contest.java` and `Latest.java`
   * out — the suffix must fall on a real case boundary.
   *
   * Path-segment forms: `src/test/java/**`, `tests/`, `spec/`, `__tests__/`,
   * `e2e/` — the shape the entire JVM world uses. Without it "drop test files
   * first" ran INVERTED on JVM repos (#592).
   */
  function isTestFile(filePath) {
    const p = _norm(filePath);
    if (/\.(test|spec)\.[a-z]+$/.test(p) || /_test\.[a-z]+$/.test(p)) return true;
    if (/(^|\/)test_[^/]+\.[a-z]+$/.test(p)) return true;
    if (/[a-z0-9](Test|Spec)s?\.(java|kt|kts|scala|groovy|cs|swift|m|mm)$/.test(p)) return true;
    if (/\.(Tests?|Specs?)\.ps1$/i.test(p)) return true;
    if (/[a-z0-9]TestCase\.(m|mm)$/.test(p)) return true;
    return /(^|\/)(test|tests|spec|specs|__tests__|e2e)(\/|$)/i.test(p);
  }

  /** Mocks, stubs, fakes and fixtures — test scaffolding, not behaviour. */
  function isMockFile(filePath) {
    const p = _norm(filePath);
    return /\/(mock|mocks|stub|stubs|fake|fakes|demo|demos|__mocks__|fixtures)\//i.test(p) ||
      /\.(mock|stub|fake)\.[jt]sx?$/.test(p) ||
      /mock\.(ts|js|tsx|jsx)$/.test(p) ||
      /_mock\.[a-z]+$/i.test(p);
  }

  /** Machine-emitted sources. */
  function isGeneratedFile(filePath) {
    return /(\.generated\.|\.pb\.|_pb\.)/.test(_norm(filePath));
  }

  /** Build output and vendored trees. */
  function isGeneratedDir(filePath) {
    return /(^|\/)(dist|build|\.next|\.nuxt|out|\.venv|venv|vendor|target)(\/|$)/i.test(_norm(filePath));
  }

  // A comment line that opens with one of these says the file is machine-made. The bare
  // word must open a sentence ("Generated by …"): a wrapped line that merely STARTS with
  // a lowercase "generated JS client)" is prose, and read as a header it would drop a
  // hand-written file without a word.
  const _GENERATED_STRONG = /^\s*(?:\/\/+|\/\*+!?|\*|#|<!--)\s*(?:@generated\b|auto-?generated\b|code generated\b|this (?:file|code) (?:is|was) (?:auto-?)?generated\b)/i;
  const _GENERATED_BARE = /^\s*(?:\/\/+|\/\*+!?|\*|#|<!--)\s*(?:Generated|GENERATED)\b/;
  const _DO_NOT_EDIT = /\bDO NOT (?:EDIT|MODIFY)\b/i;
  // A comment line that names both a bundle and the act of generating it.
  const _BUNDLE_HEADER = /^\s*(?:\/\/+|\/\*+!?|\*|#)\s*.*\bbundle[ds]?\b.*\bgenerated\b|^\s*(?:\/\/+|\/\*+!?|\*|#)\s*.*\bgenerated\b.*\bbundle[ds]?\b/i;
  // What a bundler or a compiler writes at the top of its output and nobody writes by hand.
  const _BUILD_RUNTIME = [
    [/\bwebpackBootstrap\b|\b__webpack_require__\b/, 'webpack runtime'],
    [/\bvar __commonJS = |\bvar __toESM = |\bvar __defProp = Object\.defineProperty\b/, 'esbuild runtime helpers'],
    [/\bparcelRequire\b/, 'parcel runtime'],
    [/Object\.defineProperty\(exports,\s*["']__esModule["']/, 'compiled module (__esModule)'],
  ];

  /**
   * Why a file reads as generated, or null when it does not.
   *
   * Path and content only: the caller supplies the first and last bytes it read, so
   * this stays a pure predicate. Four independent signals, any one of which is
   * enough, none of them a size guess:
   *   - the path names a build-output directory or a `.generated.` / `.pb.` file;
   *   - a comment in the first lines OPENS with "generated" / "auto-generated" /
   *     `@generated`, or says "DO NOT EDIT", or names a generated bundle;
   *   - the file opens with a bundler's or compiler's own runtime helpers;
   *   - the last line points at a source map.
   *
   * A hand-written file that merely mentions generated code in prose ("reads
   * the files webpack generated") matches none of them: the comment has to open
   * with the word, or be about a bundle.
   *
   * @param {string} filePath - repo-relative
   * @param {string} [head] - the first few KiB of the file
   * @param {string} [tail] - the last few hundred bytes
   * @returns {string|null} a short human reason, or null
   */
  function generatedReason(filePath, head, tail) {
    const p = _norm(filePath);
    if (isGeneratedFile(p)) return 'machine-emitted file name';
    const dir = /(^|\/)(dist|build|\.next|\.nuxt|out|vendor|target)(\/|$)/i.exec(p);
    if (dir) return `build-output directory (${dir[2].toLowerCase()}/)`;
    const text = typeof head === 'string' ? head : '';
    const lines = text.split('\n', 14);
    for (const line of lines) {
      if (_GENERATED_STRONG.test(line) || _GENERATED_BARE.test(line)) return 'header says it is generated';
      if (_DO_NOT_EDIT.test(line) && /^\s*(?:\/\/+|\/\*+|\*|#)/.test(line)) return 'header says do not edit';
      if (_BUNDLE_HEADER.test(line)) return 'header says it is a generated bundle';
    }
    const top = text.slice(0, 4096);
    for (const [re, why] of _BUILD_RUNTIME) if (re.test(top)) return `opens with ${why}`;
    if (typeof tail === 'string' && /(?:\/\/[#@]|\/\*[#@])\s*sourceMappingURL=/.test(tail)) return 'points at a source map';
    return null;
  }

  /**
   * Prose documentation.
   *
   * Both a directory form (`docs/`, `website/`) and the well-known root
   * filenames. The root form is the half the ranker was missing: `README.md`
   * matched no directory segment, so it carried no penalty and outranked
   * implementation files on "how does" questions (#808). Deliberately keyed on
   * the conventional names rather than "any `.md`", so a repo whose content is
   * genuinely markdown is not blanket-demoted.
   *
   * A well-known name is documentation only when it is not source code. The
   * names double as ordinary domain nouns — `history.ts` is excalidraw's undo
   * stack, `security.py` is django's SecurityMiddleware, `changes.rb` is Rails'
   * attached-changes tracker — and matching them with ANY extension cost those
   * files 80% of their score (rank 20 instead of 1 on the question about undo
   * and redo; #900). The exception is a deny-list of programming-language
   * extensions, not an allow-list of prose ones: `README.Rmd`, `LICENSE.python`
   * and `Readme.scalatex` are real docs with extensions no prose list anticipates,
   * and across 66,691 tracked files in 50 repos the deny-list moves exactly the 8
   * source files and no document.
   */
  const DOC_BASENAME = /^(README|CHANGELOG|CHANGES|CONTRIBUTING|CODE_OF_CONDUCT|SECURITY|LICENCE|LICENSE|AUTHORS|NOTICE|HISTORY|UPGRADING|MIGRATING|MAINTAINERS|GOVERNANCE)(\.[a-z]+)?$/i;
  const SOURCE_EXT = /\.(?:[cm]?[jt]sx?|pyi?|rb|go|rs|java|kts?|scala|sc|groovy|cs|swift|php|lua|exs?|dart|c|h|cc|cpp|cxx|hpp|hh|mm?|r|sh|bash|zsh|ps1|psm1|pl|pm|gd|clj|cljs|erl|hs|fs|fsx|ml|vue|svelte|astro)$/i;

  function isDocsFile(filePath) {
    const p = _norm(filePath);
    // Deliberately NOT `wiki|man|website`: `src/wiki/generate.js` is the module
    // that BUILDS a wiki, and demoting it cost a gold retrieval task. Directory
    // names that double as domain nouns do not belong here.
    if (/(^|\/)(docs|doc|documentation)(\/|$)/i.test(p)) return true;
    const base = p.slice(p.lastIndexOf('/') + 1);
    return DOC_BASENAME.test(base) && !SOURCE_EXT.test(base);
  }

  /**
   * CI / pipeline definitions.
   *
   * SigMap extracts these on purpose (`src/extractors/pipeline.js`) because
   * "how does CI work" is a real question — so they are indexed, then demoted
   * for every query that is NOT about them. They previously had no category at
   * all, which is why four `.github/workflows/*.yml` files filled ranks 3-6 of a
   * routing query (#807) and Alamofire's `ci.yml` reached the top 5 (#808).
   */
  function isCiFile(filePath) {
    const p = _norm(filePath);
    if (/(^|\/)\.github\/(workflows|actions)(\/|$)/i.test(p)) return true;
    if (/(^|\/)\.(circleci|gitlab|buildkite|teamcity)(\/|$)/i.test(p)) return true;
    const base = p.slice(p.lastIndexOf('/') + 1);
    return /^(\.gitlab-ci\.ya?ml|\.travis\.ya?ml|\.drone\.ya?ml|appveyor\.ya?ml|bitbucket-pipelines\.ya?ml|azure-pipelines.*\.ya?ml|Jenkinsfile.*|cloudbuild\.ya?ml)$/i.test(base);
  }

  module.exports = {
    isTestFile,
    isMockFile,
    isGeneratedFile,
    isGeneratedDir,
    generatedReason,
    isDocsFile,
    isCiFile,
  };
  
};

// ── ./src/util/git ──
__factories["./src/util/git"] = function(module, exports) {
  
  /**
   * Shell-free git invocation.
   *
   * Uses `execFileSync('git', [...])`, which executes the git binary directly —
   * it never spawns a system shell (`/bin/sh -c`). That means:
   *   - no shell-injection surface (arguments are passed as an array, never
   *     interpolated into a command string), and
   *   - supply-chain scanners (e.g. Socket) do not flag a "Shell access" capability.
   *
   * stderr is discarded by default (replaces the old `2>/dev/null` redirects).
   */

  const { execFileSync } = require('child_process');

  function git(args, opts = {}) {
    return execFileSync('git', args, {
      encoding: 'utf8',
      stdio: ['ignore', 'pipe', 'ignore'],
      ...opts,
    });
  }

  // Convenience: run git and return trimmed stdout, or '' on any failure.
  function tryGit(args, opts = {}) {
    try { return git(args, opts).toString().trim(); }
    catch (_) { return ''; }
  }

  /**
   * Git ref names this accepts as a diff base. Anything else is refused rather
   * than passed through, so a ref can never smuggle an option into the argv.
   */
  const REF_RE = /^[A-Za-z0-9._/\-~^]+$/;

  /**
   * Files changed in one of the three diff modes, as repo-relative paths.
   *
   * WHY THIS EXISTS
   * ---------------
   * `--diff <ref>` ran `git diff <ref>..HEAD`, which is ref-vs-HEAD and therefore
   * **excludes the working tree** — while the flag is documented as "changes
   * since <ref>". A developer with local edits got a diff that omitted exactly
   * the files they were editing (#667). The correct range for "since <ref>" is
   * the two-dot-free `git diff <ref>`: ref vs working tree, committed and
   * uncommitted alike.
   *
   * The same wrong range existed in two places — the CLI and the
   * `get_diff_context` MCP tool — so this is one helper rather than two fixes,
   * and the two surfaces cannot answer the same question differently.
   *
   *   mode            range                 meaning
   *   ──────────────────────────────────────────────────────────────────
   *   (default)       git diff HEAD         working tree vs HEAD
   *   { base }        git diff <base>       working tree vs <base>
   *   { staged }      git diff --cached     index vs HEAD
   *
   * @param {string} cwd
   * @param {{ base?: string, staged?: boolean }} [mode]
   * @returns {string[]} repo-relative paths, empty on any failure
   */
  function changedFiles(cwd, mode = {}) {
    let args;
    if (mode.base) {
      if (!REF_RE.test(mode.base)) return [];
      args = ['diff', mode.base, '--name-only'];
    } else if (mode.staged) {
      args = ['diff', '--cached', '--name-only'];
    } else {
      args = ['diff', 'HEAD', '--name-only'];
    }
    return tryGit(args, { cwd }).split('\n').map((s) => s.trim()).filter(Boolean);
  }

  module.exports = { git, tryGit, changedFiles, REF_RE };
  
};

// ── ./src/util/host-limits ──
__factories["./src/util/host-limits"] = function(module, exports) {
  
  /**
   * host-limits.js — how much of an instruction file each host reads (#995).
   *
   * A host loads a bounded part of the file SigMap writes for it and says nothing
   * about the rest:
   *
   *   - Codex reads at most `project_doc_max_bytes` of an `AGENTS.md` (32 KiB unless
   *     the user's `~/.codex/config.toml` says otherwise), so a 43 KB file reaches the
   *     agent cut in the middle of a section.
   *   - Claude Code's own guidance is to keep `CLAUDE.md` short, about 200 lines; a
   *     file of 887 lines is mostly paid for and mostly unread.
   *
   * This module answers "what is the limit for this target" in one place, so the
   * writer that trims to it and `sigmap doctor` that reports against it cannot
   * disagree. Zero dependencies; the only I/O is one bounded read of the host's own
   * config file, with no TOML parser.
   */

  const fs = require('fs');
  const os = require('os');
  const path = require('path');

  const CODEX_DEFAULT_BYTES = 32 * 1024;
  const CLAUDE_DEFAULT_LINES = 200;

  /**
   * `project_doc_max_bytes` from Codex's own config, or null when it is absent.
   * `CODEX_HOME` moves the directory, exactly as it does for Codex itself.
   */
  function codexConfiguredBytes(env, home) {
    const dir = (env && env.CODEX_HOME) || path.join(home || os.homedir(), '.codex');
    try {
      const text = fs.readFileSync(path.join(dir, 'config.toml'), 'utf8').slice(0, 262144);
      const m = /^\s*project_doc_max_bytes\s*=\s*(\d[\d_]*)\s*(?:#.*)?$/m.exec(text);
      if (m) {
        const n = parseInt(m[1].replace(/_/g, ''), 10); // TOML allows 65_536
        if (n > 0) return n;
      }
    } catch (_) { /* no Codex config: the default applies */ }
    return null;
  }

  /**
   * The limit on the instruction file written for `target`, or null when the host has
   * none or the project turned the cap off (`codexMaxBytes` / `claudeMaxLines` of 0).
   *
   * @param {string} target - 'codex' | 'claude'
   * @param {object} [config] - loaded SigMap config
   * @param {object} [env] - process.env (for CODEX_HOME)
   * @param {string} [home] - home directory (for tests)
   * @returns {{ unit: 'bytes'|'lines', max: number, source: string, host: string }|null}
   */
  function hostLimit(target, config, env, home) {
    const cfg = config || {};
    if (target === 'codex') {
      if (cfg.codexMaxBytes === 0) return null;
      if (Number.isFinite(cfg.codexMaxBytes) && cfg.codexMaxBytes > 0) {
        return { unit: 'bytes', max: cfg.codexMaxBytes, source: 'codexMaxBytes in gen-context.config.json', host: 'Codex' };
      }
      const fromHost = codexConfiguredBytes(env || process.env, home);
      if (fromHost) return { unit: 'bytes', max: fromHost, source: "project_doc_max_bytes in Codex's config.toml", host: 'Codex' };
      return { unit: 'bytes', max: CODEX_DEFAULT_BYTES, source: "Codex's default project_doc_max_bytes", host: 'Codex' };
    }
    if (target === 'claude') {
      if (cfg.claudeMaxLines === 0) return null;
      if (Number.isFinite(cfg.claudeMaxLines) && cfg.claudeMaxLines > 0) {
        return { unit: 'lines', max: cfg.claudeMaxLines, source: 'claudeMaxLines in gen-context.config.json', host: 'Claude Code' };
      }
      return { unit: 'lines', max: CLAUDE_DEFAULT_LINES, source: "Claude Code's guidance for CLAUDE.md", host: 'Claude Code' };
    }
    return null;
  }

  /** The size of `text` in the limit's own unit. */
  function measure(unit, text) {
    const s = String(text == null ? '' : text);
    return unit === 'lines' ? s.split('\n').length : Buffer.byteLength(s, 'utf8');
  }

  /** `28.4 KiB` or `187 lines`. */
  function formatSize(unit, n) {
    return unit === 'lines' ? `${n.toLocaleString('en-US')} lines` : `${(n / 1024).toFixed(1)} KiB`;
  }

  module.exports = { hostLimit, measure, formatSize, codexConfiguredBytes, CODEX_DEFAULT_BYTES, CLAUDE_DEFAULT_LINES };
  
};

// ── ./src/util/ignore ──
__factories["./src/util/ignore"] = function(module, exports) {
  
  /**
   * `.contextignore` / `.repomixignore` — the one definition (#926).
   *
   * A full `generate` filters its file list through these patterns. The live
   * writers (the watcher, `freshen`, the MCP notify hooks) must apply the SAME
   * filter, or an overlay entry resurrects a file the full run deliberately
   * omitted and `ask` serves it.
   *
   * Zero-dependency, bundle-safe.
   */

  const fs = require('fs');
  const path = require('path');

  /**
   * Patterns from `.contextignore` then `.repomixignore`, comments and blanks
   * dropped. An unreadable file contributes nothing: ignore rules are advisory,
   * and a long-running watcher must not die over a permissions flip.
   *
   * @param {string} cwd
   * @returns {string[]}
   */
  function loadIgnorePatterns(cwd) {
    const patterns = [];
    for (const name of ['.contextignore', '.repomixignore']) {
      const p = path.join(cwd, name);
      let text;
      try { text = fs.readFileSync(p, 'utf8'); } catch (_) { continue; }
      for (const line of text.split('\n')) {
        const trimmed = line.trim();
        if (trimmed && !trimmed.startsWith('#')) patterns.push(trimmed);
      }
    }
    return patterns;
  }

  /**
   * @param {string} relPath - repo-relative, forward slashes
   * @param {string[]} patterns
   * @returns {boolean}
   */
  function matchesIgnore(relPath, patterns) {
    for (const pat of patterns) {
      const normalized = pat.replace(/\\/g, '/');
      // Strip trailing slash (gitignore style — directory patterns)
      const patternToUse = normalized.endsWith('/')
        ? normalized.slice(0, -1)
        : normalized;
      // Escape regex special chars but NOT brackets (keep them for character classes)
      const regexStr = patternToUse
        .replace(/[.+^${}()|\\]/g, '\\$&')
        .replace(/\*\*/g, '___DOUBLE___')
        .replace(/\*/g, '[^/]*')
        .replace(/___DOUBLE___/g, '.*');
      try {
        const regex = new RegExp(`(^|/)${regexStr}($|/)`);
        if (regex.test(relPath)) return true;
      } catch (_) {
        // Malformed bracket syntax or invalid regex — skip this pattern
      }
    }
    return false;
  }

  module.exports = { loadIgnorePatterns, matchesIgnore };
  
};

// ── ./src/util/late-last ──
__factories["./src/util/late-last"] = function(module, exports) {
  
  /**
   * Order a file's signature groups so that the entries for shapes an extractor LEARNED
   * to read (#996) come after every entry it always listed.
   *
   * An extractor lists at most 200 signatures a file and appends a "+N more" marker. Teach
   * it a new shape and, if the new entries are interleaved in file order, they push older
   * ones past that cap: zod's `api.ts` went from 116 entries to a full 200 and lost 43 functions
   * it used to list. Appending them instead means nothing previously listed can be displaced,
   * a file with no new-shape entry is byte-identical to what it was, and a file already at the
   * cap keeps exactly what it kept.
   *
   * A group is a declaration and its indented members. It is "late" when its head is one the
   * extractor could not read before: a `$` name, an anonymous default export, a const bound to
   * a call, a CommonJS assignment method, or a head the caller marked (a generic or typed arrow,
   * a class whose generic list has a default).
   */

  const NAME = /^(?:export\s+)?(?:default\s+)?(?:declare\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|function|class|interface|type|enum)\s+([\w$]+)/;
  const LATE_HEAD = new RegExp([
    '^export\\s+default\\s+(?:async\\s+)?(?:function\\s*\\(|\\()',                 // export default function () / export default (a) =>
    '^export\\s+const\\s+[\\w$]+\\s*=\\s*[\\w$.]+\\(\\.\\.\\.\\)',                 // export const x = make(...)
    '^[\\w$]+(?:\\.[\\w$]+)*\\.[\\w$]+\\s*=\\s*(?:async\\s+)?(?:function\\b|\\()',  // app.use = function use(fn)
  ].join('|'));

  /**
   * @param {string[]} sigs
   * @param {Array<[number, number]|null>} anchors parallel to sigs
   * @param {string[]} docHints parallel to sigs (may be sparse)
   * @param {Set<number>} [marked] indexes of heads the caller knows are new-shape
   * @returns {{ sigs: string[], anchors: Array, docHints: string[] }}
   */
  function lateLast(sigs, anchors, docHints, marked) {
    const groups = [];
    for (let i = 0; i < sigs.length; ) {
      let j = i + 1;
      while (j < sigs.length && /^\s/.test(sigs[j])) j++;
      groups.push([i, j]);
      i = j;
    }
    const isLate = (i) => {
      if ((marked && marked.has(i)) || LATE_HEAD.test(sigs[i])) return true;
      const m = NAME.exec(sigs[i]);
      return !!(m && m[1].includes('$'));
    };
    const first = [];
    const last = [];
    for (const g of groups) (isLate(g[0]) ? last : first).push(g);
    if (last.length === 0 || first.length === 0) return { sigs, anchors, docHints };
    const out = { sigs: [], anchors: [], docHints: [] };
    for (const [a, b] of first.concat(last)) {
      for (let k = a; k < b; k++) {
        out.sigs.push(sigs[k]);
        out.anchors.push(anchors[k]);
        out.docHints.push(docHints[k]);
      }
    }
    return out;
  }

  module.exports = { lateLast };
  
};

// ── ./src/util/managed-section ──
__factories["./src/util/managed-section"] = function(module, exports) {
  
  /**
   * managed-section.js — the one place that finds SigMap's generated block inside
   * a human-owned context file (CLAUDE.md, AGENTS.md, GEMINI.md,
   * copilot-instructions.md) and replaces it (#873).
   *
   * The contract every writer states is "never overwrite human-written content".
   * It was enforced by `existing.indexOf('## Auto-generated signatures')` — the
   * FIRST occurrence anywhere — followed by discarding everything after it. A file
   * that merely MENTIONED the marker (in prose, in a code block, in a doc about
   * SigMap itself) therefore lost every human line after the mention, on the next
   * run, with no warning and no way back when the file is untracked. The same
   * substring test also decided that a file was "legacy generated" and replaced it
   * whole. Four adapters, the CLI core writer, the skills injector and two readers
   * each carried their own copy of it.
   *
   * What counts as the managed section now:
   *
   *   stamped   the heading immediately followed by the stamp comment the writers
   *             emit (`<!-- Updated by gen-context.js -->`). Machine-written text
   *             that prose does not produce; the LAST one wins, because the
   *             generated block is always appended after every human line.
   *   bare      a heading on its own line with no stamp. Found, so readers and
   *             injectors can use it, but REPLACED only when what follows looks
   *             SigMap-generated — a human section that happens to share the title
   *             is appended after, with a warning, never cut.
   *
   * Neither is taken from inside a fenced code block, with one exception: a
   * stamped heading inside a fence still counts when a generated block follows it
   * (see findManagedSection). An unterminated fence is not a fence: otherwise one
   * stray ``` hides the real marker, and the writer would append a fresh block on
   * every run.
   *
   * Zero dependencies. Pure string functions — no fs — so the bundled CLI core,
   * the adapters and every src/ module share them.
   */

  const HEADING = '## Auto-generated signatures';
  const STAMP = '<!-- Updated by gen-context.js -->';

  /** What a writer appends when the file has no managed section yet. */
  const MARKER = `\n\n${HEADING}\n${STAMP}\n`;

  // Heading + stamp as two consecutive lines. NOT anchored to the start of a line:
  // files already damaged by the old slice have the heading glued to the end of
  // the prose line that quoted it, and recognising that shape lets the next run
  // repair them in place instead of appending a second block.
  const STAMPED_RE = new RegExp(`${HEADING}[ \\t]*\\r?\\n${STAMP.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`, 'g');
  const BARE_RE = new RegExp(`^${HEADING}[ \\t]*\\r?$`, 'gm');

  /**
   * How the first non-blank line of a block SigMap generated begins. One entry per
   * adapter format() plus the legacy forms; test/integration/managed-section.test.js
   * asserts every adapter still writes a block this recognises.
   */
  const GENERATED_OPENERS = [
    /^<!-- Generated by SigMap\b/,                                  // claude, copilot
    /^#{1,2} Code [Ss]ignatures\s*$/,                                // codex, CLI core, legacy
    /^You are a coding assistant with complete knowledge of this codebase\./, // gemini
  ];

  /** Offsets [start, end) of every balanced fenced code block in `text`. */
  function fencedRanges(text) {
    const lines = text.split('\n');
    const offsets = [];
    let off = 0;
    for (const l of lines) { offsets.push(off); off += l.length + 1; }

    const ignored = new Set(); // line indexes of openers that never closed
    for (;;) {
      const ranges = [];
      let open = null; // { line, char, len }
      for (let i = 0; i < lines.length; i++) {
        if (ignored.has(i)) continue;
        const m = lines[i].match(/^ {0,3}(`{3,}|~{3,})/);
        if (!m) continue;
        const char = m[1][0];
        if (open === null) {
          open = { line: i, char, len: m[1].length };
        } else if (char === open.char && m[1].length >= open.len
          && /^[ \t]*\r?$/.test(lines[i].slice(lines[i].indexOf(m[1]) + m[1].length))) {
          ranges.push([offsets[open.line], offsets[i] + lines[i].length]);
          open = null;
        }
      }
      if (open === null) return ranges;
      ignored.add(open.line); // an unterminated fence is not a fence — rescan without it
    }
  }

  const inside = (ranges, idx) => ranges.some(([a, b]) => idx >= a && idx < b);

  /** Text after the heading (and its stamp line, when present), without leading blank lines. */
  function afterHeading(text, index) {
    const nl = text.indexOf('\n', index);
    let rest = nl === -1 ? '' : text.slice(nl + 1);
    if (rest.startsWith(STAMP)) {
      const n2 = rest.indexOf('\n');
      rest = n2 === -1 ? '' : rest.slice(n2 + 1);
    }
    return rest.replace(/^(?:[ \t]*\r?\n)+/, '');
  }

  /** Whether the first non-blank line after a heading opens a SigMap-generated block. */
  function looksGenerated(text, index) {
    const rest = afterHeading(text, index);
    if (rest === '') return true; // nothing after it — nothing to lose
    const first = rest.split('\n', 1)[0].replace(/\r$/, '');
    return GENERATED_OPENERS.some((re) => re.test(first));
  }

  /**
   * Locate the managed section.
   * @param {string} text
   * @returns {{ index: number, stamped: boolean }|null} `index` is where the heading starts
   */
  function findManagedSection(text) {
    const src = String(text || '');
    if (!src.includes(HEADING)) return null;
    const fences = fencedRanges(src);

    // A stamped heading is trusted outside a fence. Inside one it must also be
    // followed by a generated block: a file the old bug truncated mid-fence has
    // its real heading "inside" an unclosed fence whose pairing the generated
    // block's own fences then shift, while a fence that merely QUOTES the marker
    // has no generated block after it.
    let found = null;
    STAMPED_RE.lastIndex = 0;
    for (let m; (m = STAMPED_RE.exec(src)) !== null;) {
      if (!inside(fences, m.index) || looksGenerated(src, m.index)) found = { index: m.index, stamped: true };
    }
    if (found) return found;

    BARE_RE.lastIndex = 0;
    for (let m; (m = BARE_RE.exec(src)) !== null;) {
      if (!inside(fences, m.index)) found = { index: m.index, stamped: false };
    }
    return found;
  }

  /**
   * Start of the managed section's line — where a block injected "above the
   * marker" must go, so it never lands in the middle of a prose line.
   * @returns {number} -1 when there is no managed section
   */
  function managedSectionLineStart(text) {
    const m = findManagedSection(text);
    if (!m) return -1;
    return String(text).lastIndexOf('\n', m.index - 1) + 1;
  }

  /** Whether the whole file is a generated block with no marker (the pre-marker format). */
  function isEntirelyGenerated(text) {
    const first = String(text || '').replace(/^(?:[ \t]*\r?\n)+/, '').split('\n', 1)[0].replace(/\r$/, '');
    return first !== '' && GENERATED_OPENERS.some((re) => re.test(first));
  }

  /**
   * Put `block` (the adapter's formatted output) into `existing` under the marker.
   *
   *   replaced   a managed section was found; everything before it is untouched
   *   appended   none was found (or a bare heading did not look generated);
   *              `existing` is untouched and the section follows it
   *   legacy     `opts.legacy` and the whole file was a pre-marker generated block
   *   created    `existing` was empty
   *
   * Never returns less human content than it was given, except by replacing a
   * section that is positively a SigMap block.
   *
   * @param {string} existing
   * @param {string} block
   * @param {{ legacy?: boolean }} [opts]  legacy: replace a file that is ENTIRELY a
   *        pre-marker generated block (copilot, gemini, codex did; claude never did)
   * @returns {{ content: string, action: 'replaced'|'appended'|'legacy'|'created', warning: string|null }}
   */
  function replaceManagedSection(existing, block, opts = {}) {
    const src = String(existing || '');
    const section = findManagedSection(src);
    // A stamped heading is machine-written and is replaced. A bare one is a line
    // somebody typed, so it is replaced only when what follows it is positively a
    // SigMap block — otherwise the file asked to be treated as managed and was not,
    // and replacing would discard human lines. That is the one case worth saying out loud.
    let warning = null;
    if (section && (section.stamped || looksGenerated(src, section.index))) {
      return {
        content: src.slice(0, section.index) + MARKER.trimStart() + block,
        action: 'replaced',
        warning: null,
      };
    }
    if (section) {
      const line = src.slice(0, section.index).split('\n').length;
      warning = `found "${HEADING}" at line ${line} but what follows it is not a SigMap-generated block — appended a new section instead of replacing it`;
    } else if (src === '') {
      return { content: MARKER + block, action: 'created', warning: null };
    } else if (opts.legacy && isEntirelyGenerated(src)) {
      return { content: MARKER.trimStart() + block, action: 'legacy', warning: null };
    }
    return { content: src + MARKER + block, action: 'appended', warning };
  }

  module.exports = {
    HEADING, STAMP, MARKER, GENERATED_OPENERS,
    findManagedSection, managedSectionLineStart, isEntirelyGenerated, looksGenerated, replaceManagedSection,
  };
  
};

// ── ./src/util/post-commit-hook ──
__factories["./src/util/post-commit-hook"] = function(module, exports) {
  
  /**
   * The git post-commit hook `sigmap --setup` installs (#784, #918).
   *
   * One module owns what a SigMap hook line looks like, so the installer, `doctor`
   * and the tests cannot disagree about it. The installer used to find "its" line
   * with `line.includes('gen-context.js')`, which went wrong both ways:
   *
   *   - a global install runs through the `sigmap` symlink, so the line it writes
   *     never contains `gen-context.js` and re-running `--setup` appended another
   *     copy — one more regeneration on every commit, each run;
   *   - the rewrite dropped EVERY line containing the substring, including a
   *     team's own `node scripts/gen-context.js …` step.
   *
   * A line is SigMap's when it has the shape SigMap writes: `node <sigmap entry>
   * --generate …`. Anything else in the hook is left alone.
   *
   * `--generate` is the v0.1.0 spelling of a bare run and is promised unchanged
   * (packages/core/README.md), so every hook already written keeps working.
   *
   * Zero dependencies; reads and writes only `.git/hooks/post-commit`.
   */

  const fs = require('fs');
  const path = require('path');

  /** The flag the hook passes; a documented alias of a bare `sigmap` run. */
  const HOOK_FLAG = '--generate';

  // `node "<path>/gen-context.js" --generate …` (a local install, or the original
  // `$(git rev-parse --show-toplevel)/gen-context.js` form) or
  // `node "<bin>/sigmap" --generate …` (a global / npx install, quoted or not).
  const OWN_LINE = /^\s*node\s+(?:"[^"\n]*(?:gen-context\.js|[/\\]sigmap)"|\S*(?:gen-context\.js|[/\\]sigmap))\s+--generate(?:\s|$)/;

  /** The line `--setup` writes for a given entry script. */
  function hookLine(scriptPath) {
    return `node ${JSON.stringify(path.resolve(scriptPath))} ${HOOK_FLAG} 2>/dev/null || true`;
  }

  /** Whether a line of a hook file is one SigMap wrote. */
  function isOwnLine(line) {
    return OWN_LINE.test(line);
  }

  /** The entry script a SigMap hook line runs, resolved against `cwd`; null when unreadable. */
  function scriptOf(line, cwd) {
    const m = line.match(/^\s*node\s+("[^"\n]*"|\S+)/);
    if (!m) return null;
    let target = m[1];
    if (target[0] === '"') {
      try { target = JSON.parse(target); } catch (_) { target = target.slice(1, -1); }
    }
    target = target.replace('$(git rev-parse --show-toplevel)', cwd);
    return path.resolve(cwd, target);
  }

  /**
   * Install the hook, or bring an existing one up to date. Idempotent: running it
   * again with the same entry changes nothing.
   *
   * @param {string} cwd
   * @param {string} scriptPath the entry script the hook should run
   * @returns {{ action: 'installed'|'updated'|'unchanged'|'skipped', path: string|null }}
   */
  function installPostCommitHook(cwd, scriptPath) {
    const hookDir = path.join(cwd, '.git', 'hooks');
    if (!fs.existsSync(hookDir)) return { action: 'skipped', path: null };
    const hookPath = path.join(hookDir, 'post-commit');
    const line = hookLine(scriptPath);

    if (!fs.existsSync(hookPath)) {
      fs.writeFileSync(hookPath, `#!/bin/sh\n${line}\n`);
      fs.chmodSync(hookPath, '755');
      return { action: 'installed', path: hookPath };
    }

    const existing = fs.readFileSync(hookPath, 'utf8');
    const lines = existing.split('\n');
    const own = lines.map((l, i) => (isOwnLine(l) ? i : -1)).filter((i) => i !== -1);

    if (own.length === 0) {
      fs.appendFileSync(hookPath, `\n${line}\n`);
      return { action: 'installed', path: hookPath };
    }
    if (own.length === 1 && lines[own[0]] === line) return { action: 'unchanged', path: hookPath };

    // Rewrite in place: the first SigMap line becomes the current one, any extra
    // copies go, and every other line keeps its place.
    const out = lines.map((l, i) => (i === own[0] ? line : l)).filter((l, i) => !own.slice(1).includes(i));
    fs.writeFileSync(hookPath, out.join('\n'));
    return { action: 'updated', path: hookPath };
  }

  /**
   * What is in the hook now, for `doctor`.
   *
   * @param {string} cwd
   * @returns {{ gitHooks: boolean, path: string, exists: boolean, copies: number,
   *   script: string|null, scriptExists: boolean|null, executable: boolean|null }}
   */
  function inspectPostCommitHook(cwd) {
    const hookDir = path.join(cwd, '.git', 'hooks');
    const hookPath = path.join(hookDir, 'post-commit');
    const res = { gitHooks: false, path: hookPath, exists: false, copies: 0, script: null, scriptExists: null, executable: null };
    try { res.gitHooks = fs.statSync(hookDir).isDirectory(); } catch (_) { return res; }
    let text;
    try { text = fs.readFileSync(hookPath, 'utf8'); res.exists = true; } catch (_) { return res; }
    const own = text.split('\n').filter(isOwnLine);
    res.copies = own.length;
    if (own.length) {
      res.script = scriptOf(own[0], cwd);
      res.scriptExists = res.script ? fs.existsSync(res.script) : false;
    }
    // Git runs a hook only when it is executable. Windows has no such bit.
    if (process.platform !== 'win32') {
      try { fs.accessSync(hookPath, fs.constants.X_OK); res.executable = true; } catch (_) { res.executable = false; }
    }
    return res;
  }

  module.exports = { HOOK_FLAG, hookLine, isOwnLine, scriptOf, installPostCommitHook, inspectPostCommitHook };
  
};

// ── ./src/util/statement-start ──
__factories["./src/util/statement-start"] = function(module, exports) {
  
  /**
   * Whether `index` begins a statement on its line: at the start of a line, or behind a `;` or a
   * `}` and any blanks (`} export const a = 1`).
   *
   * The extractors asked this with a lookbehind, `(?<=[;}][ \t]*)`. V8 up to Node 22 tries it at
   * every position and walks back over the whole run of blanks, so a long string literal masked
   * to spaces costs time with the square of its length: excalidraw's 790 KB base64 file did not
   * finish on Node 22. Looking back from a match instead costs one short walk per `export`.
   *
   * @param {string} text
   * @param {number} index  where the match begins
   * @returns {boolean}
   */
  function atStatementStart(text, index) {
    if (index <= 0) return true;
    const prev = text[index - 1];
    if (prev === '\n' || prev === '\r' || prev === '\u2028' || prev === '\u2029') return true;
    let i = index - 1;
    while (i >= 0 && (text[i] === ' ' || text[i] === '\t')) i--;
    return i >= 0 && (text[i] === ';' || text[i] === '}');
  }

  module.exports = { atStatementStart };
  
};

// ── ./src/util/truncate ──
__factories["./src/util/truncate"] = function(module, exports) {
  
  /**
   * Visible truncation for extractor caps (v8.11).
   *
   * Extractors cap per-file signatures and per-class members to protect the token
   * budget. Historically that truncation was SILENT — the tail of a large file
   * simply vanished with no trace, so "5 of 40 methods extracted" looked identical
   * to "fully extracted". These helpers keep the cap but append a visible marker
   * so the loss is always disclosed.
   *
   * Zero-dependency, bundle-safe.
   */

  /**
   * Cap a string array, appending a `… +N more <label>` marker when items drop.
   * @param {string[]} items
   * @param {number} limit
   * @param {string} label e.g. 'signatures'
   * @returns {string[]}
   */
  function capWithNotice(items, limit, label) {
    if (!Array.isArray(items) || items.length <= limit) return items;
    const dropped = items.length - limit;
    return items.slice(0, limit).concat(`… +${dropped} more ${label}`);
  }

  /**
   * Cap an array of member objects ({ text, ... }), appending a marker member
   * when items drop so the class block discloses the omission.
   * @param {Array<{text:string}>} members
   * @param {number} limit
   * @param {string} [label='methods']
   * @returns {Array<{text:string}>}
   */
  function capMembersWithNotice(members, limit, label = 'methods') {
    if (!Array.isArray(members) || members.length <= limit) return members;
    const dropped = members.length - limit;
    return members.slice(0, limit).concat({ text: `… +${dropped} more ${label}`, start: 0, end: 0 });
  }

  module.exports = { capWithNotice, capMembersWithNotice };
  
};

// ── ./src/verify/arity ──
__factories["./src/verify/arity"] = function(module, exports) {
  
  /**
   * Arity-checked verification (D1, #529).
   *
   * With JS/TS params exact (v8.27 balanced scanner) and Python params from the
   * AST, the signature index carries real parameter lists — so verification can
   * check not just "does this function exist" but "is this call's argument
   * count plausible". Deliberately conservative: only uniquely-resolved,
   * non-variadic, top-level functions from exact-param languages are checked,
   * and dotted method calls are never flagged.
   */

  const path = require('path');
  const { maskCode, readBalanced } = __require('./src/extractors/scan');

  // Files whose signature params are exact (JS/TS via scan.js, Python via AST,
  // Go via the balanced scanner — G4 #643). Java params are exact too (#646)
  // but `.java` is deliberately absent: Java has no top-level callables —
  // every method is an indented member and answer calls are dotted, both
  // excluded by design — so nothing from a .java file could ever be indexed.
  const EXACT_PARAM_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.go']);

  const CTRL_KEYWORDS = new Set([
    'if', 'for', 'while', 'switch', 'catch', 'return', 'typeof', 'await',
    'do', 'else', 'try', 'finally', 'new', 'in', 'of', 'not', 'and', 'or',
    'print', 'super', 'this',
  ]);

  // Top-level callable sig shapes (indented member sigs are excluded on purpose
  // — method calls are dotted in answers and dotted calls are skipped anyway).
  const CALLABLE_RES = [
    /^(?:export\s+)?(?:async\s+)?function\s+([A-Za-z_$][\w$]*)\s*\(/,
    /^(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?\(/,
    /^(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/,
    // Go: plain top-level funcs only — receiver methods (`func (r) Name(`) are
    // called dotted in answers, and dotted calls are never flagged.
    /^func\s+([A-Za-z_]\w*)\s*\(/,
  ];

  /** Strip the `  :start-end` anchor and `  # hint` tail from a sig line. */
  function cleanSig(sig) {
    return String(sig).replace(/\s{2}#\s.*$/, '').replace(/\s*:\d+(?:-\d+)?\s*$/, '');
  }

  /**
   * Parse a parameter-list string into an arity range.
   * Depth- and quote-aware top-level comma split; `=` defaults and trailing `?`
   * lower `min`; `...rest` / `*args` / `**kwargs` mark the signature variadic;
   * destructuring patterns count as one parameter.
   * @param {string} paramText text between the signature's parens
   * @returns {{ min: number, max: number, variadic: boolean }}
   */
  function parseParams(paramText) {
    const text = String(paramText || '').trim();
    if (!text) return { min: 0, max: 0, variadic: false };
    const masked = maskCode(text);
    const pieces = [];
    let depth = 0;
    let start = 0;
    for (let i = 0; i < masked.length; i++) {
      const ch = masked[i];
      if (ch === '(' || ch === '[' || ch === '{') depth++;
      else if (ch === ')' || ch === ']' || ch === '}') depth--;
      else if (ch === ',' && depth === 0) { pieces.push({ raw: text.slice(start, i), masked: masked.slice(start, i) }); start = i + 1; }
    }
    pieces.push({ raw: text.slice(start), masked: masked.slice(start) });

    let min = 0;
    let max = 0;
    let variadic = false;
    for (const piece of pieces) {
      const p = piece.raw.trim();
      if (!p) continue;
      if (/^(\.\.\.|\*)/.test(p)) { variadic = true; continue; }
      // Go variadics put `...` on the TYPE (`nums ...int`) — a depth-0 `...`
      // anywhere in the piece marks the signature variadic. A nested func
      // param's `...` (`f func(a ...int)`) sits at depth > 0 and never leaks.
      {
        let dd = 0;
        let goVariadic = false;
        const pm0 = piece.masked;
        for (let i = 0; i < pm0.length; i++) {
          const ch = pm0[i];
          if (ch === '(' || ch === '[' || ch === '{') dd++;
          else if (ch === ')' || ch === ']' || ch === '}') dd--;
          else if (ch === '.' && dd === 0 && pm0[i + 1] === '.' && pm0[i + 2] === '.') { goVariadic = true; break; }
        }
        if (goVariadic) { variadic = true; continue; }
      }
      max++;
      // Optional: a top-level `=` default (scan the masked piece at depth 0) or
      // a `?`-suffixed name (TS optional, survives type stripping as `x?`).
      let d = 0;
      let optional = /^[A-Za-z_$][\w$]*\s*\?$/.test(p);
      const pm = piece.masked;
      for (let i = 0; i < pm.length && !optional; i++) {
        const ch = pm[i];
        if (ch === '(' || ch === '[' || ch === '{') d++;
        else if (ch === ')' || ch === ']' || ch === '}') d--;
        else if (ch === '=' && d === 0 && pm[i + 1] !== '>' && pm[i - 1] !== '=' && pm[i - 1] !== '!' && pm[i - 1] !== '<' && pm[i - 1] !== '>') optional = true;
      }
      if (!optional) min++;
    }
    return { min, max, variadic };
  }

  /**
   * Build a per-name arity index from a SigMap signature index.
   * Only top-level callables from exact-param languages are included; a name
   * whose signatures disagree across files is marked ambiguous (never checked).
   * @param {Map<string, string[]>} sigIndex Map<file, sigs[]>
   * @returns {Map<string, { min, max, variadic, file, sig } | 'ambiguous'>}
   */
  function buildArityIndex(sigIndex) {
    const index = new Map();
    if (!sigIndex || !(sigIndex instanceof Map)) return index;
    for (const [file, sigs] of sigIndex.entries()) {
      if (!EXACT_PARAM_EXTS.has(path.extname(file))) continue;
      for (const sig of sigs || []) {
        const cleaned = cleanSig(sig);
        let name = null;
        for (const re of CALLABLE_RES) {
          const m = cleaned.match(re);
          if (m) { name = m[1]; break; }
        }
        if (!name) continue;
        const openIdx = cleaned.indexOf('(', cleaned.indexOf(name));
        if (openIdx === -1) continue;
        const masked = maskCode(cleaned);
        const closeIdx = readBalanced(masked, openIdx);
        if (closeIdx === -1) continue;
        const arity = parseParams(cleaned.slice(openIdx + 1, closeIdx));
        const entry = { ...arity, file, sig: cleaned.trim() };
        const existing = index.get(name);
        if (existing === undefined) index.set(name, entry);
        else if (existing === 'ambiguous') continue;
        else if (existing.min !== entry.min || existing.max !== entry.max || existing.variadic !== entry.variadic) {
          index.set(name, 'ambiguous');
        }
      }
    }
    return index;
  }

  /**
   * Extract call sites with argument counts from answer code.
   * Dotted/property calls and keyword-preceded definitions are skipped for
   * precision; nested calls and comma-containing strings count correctly
   * because the scan is over masked text.
   * @param {string} code
   * @returns {{ name: string, args: number, line: number }[]}
   */
  function extractCallArgCounts(code) {
    const src = String(code || '');
    const masked = maskCode(src);
    const calls = [];
    const re = /([A-Za-z_$][\w$]*)\s*\(/g;
    let m;
    while ((m = re.exec(masked)) !== null) {
      const name = m[1];
      if (CTRL_KEYWORDS.has(name)) continue;
      let k = m.index - 1;
      while (k >= 0 && (masked[k] === ' ' || masked[k] === '\t')) k--;
      if (k >= 0 && (masked[k] === '.' || masked[k] === '$')) continue;
      const before = masked.slice(Math.max(0, m.index - 12), m.index);
      if (/(?:function|def|class|new)\s+$/.test(before)) continue;
      const openIdx = m.index + m[0].length - 1;
      const closeIdx = readBalanced(masked, openIdx);
      if (closeIdx === -1) continue;
      const inner = masked.slice(openIdx + 1, closeIdx);
      let args = 0;
      // Emptiness is judged on the ORIGINAL text — masking blanks string
      // contents, so `f("a,b")` would otherwise look like zero arguments.
      if (src.slice(openIdx + 1, closeIdx).trim()) {
        args = 1;
        let depth = 0;
        for (let i = 0; i < inner.length; i++) {
          const ch = inner[i];
          if (ch === '(' || ch === '[' || ch === '{') depth++;
          else if (ch === ')' || ch === ']' || ch === '}') depth--;
          else if (ch === ',' && depth === 0) args++;
        }
      }
      calls.push({ name, args, line: src.slice(0, m.index).split('\n').length });
    }
    return calls;
  }

  /**
   * Check one call against the arity index.
   * @returns {null | { min, max, variadic, file, sig }} the offended entry, or null when fine/unknowable
   */
  function checkArity(name, argCount, arityIndex) {
    const entry = arityIndex.get(name);
    if (!entry || entry === 'ambiguous') return null;
    if (entry.variadic) return argCount < entry.min ? entry : null;
    if (argCount < entry.min || argCount > entry.max) return entry;
    return null;
  }

  module.exports = { parseParams, buildArityIndex, extractCallArgCounts, checkArity, cleanSig, EXACT_PARAM_EXTS };
  
};

// ── ./src/verify/closest-match ──
__factories["./src/verify/closest-match"] = function(module, exports) {
  
  /**
   * Closest-match suggestions for the Hallucination Guard (v6.15.0).
   *
   * Heuristic layer (plan §5 labels this "Medium" confidence): given a name the
   * detectors flagged as fake, find the nearest *real* candidate by Levenshtein
   * distance so the report can say "Did you mean `loadConfig()` in
   * src/config/loader.js:42?". Pure, deterministic, offline — no network, no LLM.
   *
   * All inputs are passed in (symbol/file/script candidate lists) so this module
   * stays unit-testable without touching the filesystem or the SigMap index.
   */

  /**
   * Levenshtein edit distance with an early-exit ceiling.
   * Returns `max + 1` as soon as the best achievable distance exceeds `max`,
   * so callers can cheaply reject far-apart strings.
   */
  function levenshtein(a, b, max = Infinity) {
    if (a === b) return 0;
    const al = a.length;
    const bl = b.length;
    if (al === 0) return bl;
    if (bl === 0) return al;
    if (Math.abs(al - bl) > max) return max + 1;

    let prev = new Array(bl + 1);
    let curr = new Array(bl + 1);
    for (let j = 0; j <= bl; j++) prev[j] = j;

    for (let i = 1; i <= al; i++) {
      curr[0] = i;
      let rowMin = curr[0];
      const ca = a.charCodeAt(i - 1);
      for (let j = 1; j <= bl; j++) {
        const cost = ca === b.charCodeAt(j - 1) ? 0 : 1;
        curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
        if (curr[j] < rowMin) rowMin = curr[j];
      }
      if (rowMin > max) return max + 1;
      const tmp = prev;
      prev = curr;
      curr = tmp;
    }
    return prev[bl];
  }

  /** Bucket a normalized edit distance into a confidence label (plan §5). */
  function suggestionConfidence(distance, targetLen) {
    const ratio = distance / Math.max(targetLen, 1);
    if (distance === 0 || ratio <= 0.2) return 'high';
    if (ratio <= 0.4) return 'medium';
    return 'low';
  }

  /**
   * Find the nearest candidate name to `target`.
   *
   * @param {string} target
   * @param {Array<string | { name: string, file?: string, line?: number }>} candidates
   * @param {object} [opts]
   * @param {number} [opts.maxRatio=0.5]  reject matches farther than ratio·len edits
   * @param {number} [opts.minLen=3]      skip very short targets (too noisy)
   * @returns {{ name, file, line, distance, confidence } | null}
   */
  function closestMatch(target, candidates, opts = {}) {
    const maxRatio = opts.maxRatio != null ? opts.maxRatio : 0.5;
    const minLen = opts.minLen != null ? opts.minLen : 3;
    if (!target || target.length < minLen) return null;
    if (!candidates || candidates.length === 0) return null;

    const lower = target.toLowerCase();
    const cap = Math.max(1, Math.ceil(target.length * maxRatio));
    let best = null;

    for (const c of candidates) {
      const name = typeof c === 'string' ? c : c && c.name;
      if (!name || name === target) continue;
      if (Math.abs(name.length - target.length) > cap) continue;
      const d = levenshtein(lower, name.toLowerCase(), cap);
      if (d > cap) continue;
      if (!best || d < best.distance ||
          (d === best.distance && name.length < best.name.length)) {
        best = {
          name,
          file: typeof c === 'object' ? c.file : undefined,
          line: typeof c === 'object' ? c.line : undefined,
          distance: d,
        };
        if (d === 0) break; // case-only difference — can't beat it
      }
    }

    if (!best) return null;
    best.confidence = suggestionConfidence(best.distance, target.length);
    return best;
  }

  /**
   * File extensions whose symbols are worth suggesting.
   *
   * A "did you mean?" for a *called function* only makes sense when the
   * candidate is itself a callable definition. `CODE_EXTS` (used for coverage)
   * is deliberately NOT reused here: it includes `.tf`, `.sql`, `.graphql`,
   * `.proto` and `.css`, whose top-level names are resources, tables, schema
   * fields and selectors. That is how `debounce()` came to be answered with
   * "did you mean `resource()` in test/fixtures/main.tf?" (#777).
   */
  const SUGGESTIBLE_EXTS = new Set([
    '.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.py', '.go', '.rs',
    '.java', '.kt', '.scala', '.swift', '.rb', '.php', '.cs', '.dart',
    '.c', '.cpp', '.h', '.hpp', '.m', '.mm', '.lua', '.ex', '.exs', '.r', '.jl',
    '.sh', '.bash', '.zsh', '.ps1', '.psm1', '.psd1', '.vue', '.svelte',
  ]);

  /**
   * Test and fixture paths, which must never source a suggestion (#777).
   *
   * Applying a suggestion is a code edit, so a name that only exists in a test
   * or a fixture would corrupt the answer it claims to correct — `structuredClone`
   * was answered with `structuralFixture()` from a test file.
   */
  const NON_SUGGESTIBLE_PATH_RE = new RegExp([
    '(?:^|/)(?:tests?|spec|specs|__tests__|__mocks__|__fixtures__|fixtures?|mocks?|e2e|benchmarks?)/',
    '\\.(?:test|spec)\\.[mc]?[jt]sx?$',
    '(?:^|/)test_[^/]+\\.py$',
    '_test\\.(?:py|go)$',
    '(?:Test|Tests|Spec|Specs)\\.(?:java|kt|scala|cs|swift|m|mm)$',
    'TestCase\\.(?:m|mm)$',
  ].join('|'), 'i');

  /** Whether a file may source a closest-match suggestion. */
  function isSuggestibleFile(file) {
    const f = String(file).replace(/\\/g, '/');
    if (NON_SUGGESTIBLE_PATH_RE.test(f)) return false;
    const dot = f.lastIndexOf('.');
    if (dot < 0) return false;
    return SUGGESTIBLE_EXTS.has(f.slice(dot).toLowerCase());
  }

  /**
   * Build `[{ name, file, line }]` symbol candidates from a SigMap signature
   * index (`Map<file, string[]>` whose entries may carry a `:start-end` anchor).
   *
   * Files that cannot source a useful suggestion are skipped by default; pass
   * `{ includeAll: true }` for the unfiltered pool.
   */
  function buildSymbolCandidates(sigIndex, opts = {}) {
    const out = [];
    const seen = new Set();
    if (!sigIndex) return out;
    // `includeAll` keeps the unfiltered pool available for callers that want it;
    // suggestions default to the filtered pool.
    const keep = opts.includeAll ? () => true : isSuggestibleFile;
    for (const [file, sigs] of sigIndex) {
      if (!keep(file)) continue;
      for (const sig of sigs) {
        const s = String(sig);
        const lineM = s.match(/:(\d+)(?:-\d+)?\s*$/);
        const line = lineM ? parseInt(lineM[1], 10) : null;
        const cleaned = s.replace(/\s*:\d+(?:-\d+)?\s*$/, '');
        const m = cleaned.match(/\b(?:async\s+function|function|class|def|interface|type|enum|const|let|var)\s+([A-Za-z_$][\w$]*)/)
          || cleaned.match(/([A-Za-z_$][\w$]*)\s*\(/)
          || cleaned.match(/([A-Za-z_$][\w$]*)/);
        if (!m) continue;
        const name = m[1];
        const key = name + '@' + file;
        if (seen.has(key)) continue;
        seen.add(key);
        out.push({ name, file, line });
      }
    }
    return out;
  }

  /** Format a suggestion object into a human one-liner for reports/CLI. */
  function formatSuggestion(match, asCall) {
    if (!match) return null;
    const sym = asCall ? `${match.name}()` : match.name;
    let where = '';
    if (match.file) {
      where = match.line ? ` in ${match.file}:${match.line}` : ` in ${match.file}`;
    }
    return `Did you mean \`${sym}\`${where}?`;
  }

  module.exports = {
    levenshtein,
    closestMatch,
    buildSymbolCandidates,
    isSuggestibleFile,
    SUGGESTIBLE_EXTS,
    suggestionConfidence,
    formatSuggestion,
  };
  
};

// ── ./src/verify/coverage ──
__factories["./src/verify/coverage"] = function(module, exports) {
  
  /**
   * What a `verify` run checked, what it could not, and whether the index it read
   * can be trusted (#989, #1007).
   *
   * `verify` is a name-level linter: it looks up the files, imports, backticked
   * calls and npm scripts an answer mentions in the repo and its index. A clean
   * verdict from it is a statement about THOSE claims, and only when the index it
   * read is there and current. Three states used to read the same as "all clear":
   *
   *   - no index        → the symbol check did not run at all (#1007)
   *   - a stale index   → symbols that were deleted or renamed since still resolve
   *   - nothing to check → an answer that names nothing checkable is an empty
   *                         check, not a clean answer
   *
   * This module is the one place that wording and the exit-code rule live, so the
   * CLI, the MCP tool and the HTML report cannot drift into three phrasings.
   *
   * Exit codes of `sigmap verify`: 0 clean · 1 issues found · 2 usage error ·
   * 3 nothing was found but the index is missing or stale, so that is not an
   * all-clear.
   *
   * Zero dependencies, deterministic, filesystem-only.
   */

  // Claim classes verify never reads, whatever the repo looks like. Kept as data
  // so the README, the docs and the output can be tested against the same list.
  const NOT_CHECKED = [
    'calls in fenced or raw code',
    'member calls (obj.method())',
    'library APIs (named imports from, and members of, installed libraries)',
  ];

  const CLASS_LABELS = {
    files: ['file path', 'file paths'],
    imports: ['import', 'imports'],
    symbols: ['backticked call', 'backticked calls'],
    scripts: ['npm script', 'npm scripts'],
  };

  /**
   * Whether the index verify reads is there and current.
   *
   * @param {string} cwd
   * @param {object} summary a `verify()` summary
   * @param {object} [config] loaded sigmap config (reads `srcDirs`, `exclude`)
   * @returns {{ state: 'ok'|'missing'|'stale', symbolsRan?: boolean, warning: string|null }}
   */
  function indexState(cwd, summary, config) {
    if (summary && summary.checks && summary.checks.symbols === false) {
      return { state: 'missing', symbolsRan: false, warning: 'no symbol index, so function names were not checked — run `sigmap` to build it, then verify again' };
    }
    // Installed libraries can make the symbol check run with none of the repo's own symbols
    // in it: a library call checks out, while a call to the repo's own function is flagged.
    if (summary && summary.repoSymbolsIndexed === 0) {
      return { state: 'missing', symbolsRan: true, warning: 'no repo index, so calls were checked against installed libraries only and the repo\'s own functions are not recognised — run `sigmap` to build it, then verify again' };
    }
    try {
      const cs = __require('./src/judge/context-source');
      const file = cs.resolveContextFile(cwd);
      if (!file) return { state: 'ok', warning: null };
      // verify reads through the index, which the live overlay keeps current (#926)
      const warning = cs.stalenessWarning(
        cs.contextStaleness(file, cwd, config || {}, { honorOverlay: true }),
        { tail: cs.STALE_TAILS.verify }
      );
      if (warning) return { state: 'stale', warning };
    } catch (_) { /* freshness is advisory: never fail a verdict over its own check */ }
    return { state: 'ok', warning: null };
  }

  /**
   * The coverage of one run, as plain data (it goes into `--json` too).
   *
   * @param {object} summary a `verify()` summary
   * @param {{ state: string }} index from `indexState`
   * @returns {{ claims: object, checked: string[], notChecked: string[], index: string, vacuous: boolean }}
   */
  function coverageOf(summary, index) {
    const checks = (summary && summary.checks) || {};
    const claims = (summary && summary.claims) || { files: 0, imports: 0, symbols: 0, scripts: 0, total: 0 };
    const checked = ['file paths', 'imports'];
    const notChecked = [];
    if (checks.symbols) checked.push('backticked calls');
    else notChecked.push('backticked calls (no symbol index)');
    if (checks.scripts) checked.push('npm scripts');
    notChecked.push(...NOT_CHECKED);
    return {
      claims,
      checked,
      notChecked,
      index: (index && index.state) || 'ok',
      vacuous: claims.total === 0,
    };
  }

  /**
   * The exit code a run earns: a finding is 1 whatever the index; a run with no
   * finding is 0 only when its index can be relied on.
   */
  function exitCodeFor(summary, coverage) {
    if (summary.total > 0) return 1;
    return coverage.index === 'ok' ? 0 : 3;
  }

  /** "7 claims — 2 file paths · 3 imports · 1 backticked call", classes with none left out. */
  function claimsLine(coverage) {
    const c = coverage.claims;
    if (!c.total) return 'checked 0 claims';
    const parts = Object.keys(CLASS_LABELS)
      .filter((k) => c[k] > 0)
      .map((k) => `${c[k]} ${CLASS_LABELS[k][c[k] === 1 ? 0 : 1]}`);
    return `checked ${c.total} claim${c.total === 1 ? '' : 's'} — ${parts.join(' · ')}`;
  }

  /** The two detail lines every report carries: what was checked, what was not. */
  function detailLines(coverage) {
    return [claimsLine(coverage), `not checked: ${coverage.notChecked.join(' · ')}`];
  }

  /**
   * Per-library footer lines for the installed libraries a run read (#990).
   * A library with no readable names is said to be unread, never "grounded against".
   */
  function libraryLines(libraries) {
    return (libraries || []).map((l) => {
      const pin = l.version ? `${l.name}@${l.version}` : l.name;
      if (!l.symbols) return `${pin}: no readable types — library imports not checked`;
      if (l.partial) return `${pin}: ${l.symbols} name${l.symbols === 1 ? '' : 's'} indexed (partial: not every name could be read, so a name that is absent is not proof)`;
      return `${pin}: ${l.symbols} name${l.symbols === 1 ? '' : 's'} indexed`;
    });
  }

  module.exports = { NOT_CHECKED, indexState, coverageOf, exitCodeFor, claimsLine, detailLines, libraryLines };
  
};

// ── ./src/verify/globals ──
__factories["./src/verify/globals"] = function(module, exports) {
  
  /**
   * Language globals the Hallucination Guard must never flag (#777).
   *
   * `fake-symbol` asks "is this name defined in the repo?" — a question that is
   * only meaningful for names the *language* does not already define. The guard
   * previously carried a hand-maintained inline list that stopped at
   * `encodeURIComponent`, so `structuredClone(obj)` — a Node and browser global
   * since Node 17 — was reported as a hallucination at `high` confidence, with a
   * suggested replacement drawn from a test fixture.
   *
   * Kept as grouped data rather than one literal so a missing global is a
   * one-line addition to the right group, and so the groups can be asserted
   * individually in tests.
   *
   * Zero dependencies, deterministic.
   */

  /** ECMAScript built-ins available in every JS runtime. */
  const ES_GLOBALS = [
    'Object', 'Array', 'String', 'Number', 'Boolean', 'Symbol', 'BigInt',
    'Math', 'JSON', 'Date', 'RegExp', 'Error', 'TypeError', 'RangeError',
    'SyntaxError', 'ReferenceError', 'EvalError', 'URIError', 'AggregateError',
    'Promise', 'Map', 'Set', 'WeakMap', 'WeakSet', 'WeakRef', 'Proxy', 'Reflect',
    'Function', 'Intl', 'globalThis', 'eval', 'parseInt', 'parseFloat',
    'isNaN', 'isFinite', 'encodeURIComponent', 'decodeURIComponent',
    'encodeURI', 'decodeURI', 'structuredClone', 'queueMicrotask',
    'ArrayBuffer', 'SharedArrayBuffer', 'DataView', 'Atomics',
    'Int8Array', 'Uint8Array', 'Uint8ClampedArray', 'Int16Array', 'Uint16Array',
    'Int32Array', 'Uint32Array', 'Float32Array', 'Float64Array',
    'BigInt64Array', 'BigUint64Array', 'Generator', 'AsyncGenerator',
  ];

  /** Web/Node platform globals — available in browsers, Node, or both. */
  const WEB_GLOBALS = [
    'console', 'fetch', 'Request', 'Response', 'Headers', 'FormData',
    'URL', 'URLSearchParams', 'AbortController', 'AbortSignal',
    'TextEncoder', 'TextDecoder', 'Blob', 'File', 'FileReader',
    'ReadableStream', 'WritableStream', 'TransformStream',
    'setTimeout', 'clearTimeout', 'setInterval', 'clearInterval',
    'setImmediate', 'clearImmediate', 'atob', 'btoa',
    'crypto', 'performance', 'structuredClone', 'EventTarget', 'Event',
    'CustomEvent', 'MessageChannel', 'MessagePort', 'BroadcastChannel',
    'WebSocket', 'Worker', 'navigator', 'location', 'document', 'window',
    'localStorage', 'sessionStorage', 'alert', 'requestAnimationFrame',
    'cancelAnimationFrame', 'IntersectionObserver', 'ResizeObserver',
    'MutationObserver', 'DOMParser', 'XMLHttpRequest',
  ];

  /** Node module-scope identifiers and globals. */
  const NODE_GLOBALS = [
    'require', 'module', 'exports', '__dirname', '__filename',
    'process', 'Buffer', 'global',
  ];

  /** Test-runner globals — present via the runner, never defined in the repo. */
  const TEST_GLOBALS = [
    'describe', 'it', 'test', 'expect', 'beforeEach', 'afterEach',
    'beforeAll', 'afterAll', 'before', 'after', 'jest', 'vi', 'suite',
  ];

  /** Python built-ins. */
  const PY_GLOBALS = [
    'print', 'len', 'range', 'str', 'int', 'float', 'dict', 'list', 'tuple',
    'set', 'frozenset', 'bool', 'bytes', 'bytearray', 'open', 'enumerate',
    'zip', 'map', 'filter', 'sorted', 'reversed', 'sum', 'min', 'max', 'abs',
    'round', 'pow', 'divmod', 'isinstance', 'issubclass', 'super', 'type',
    'getattr', 'setattr', 'hasattr', 'delattr', 'repr', 'hash', 'id', 'iter',
    'next', 'any', 'all', 'callable', 'format', 'vars', 'dir', 'input',
    'staticmethod', 'classmethod', 'property', 'slice', 'complex', 'ord', 'chr',
  ];

  /**
   * Python standard-library top-level modules (3.8 – 3.12, public names).
   *
   * Module names, not symbols — so deliberately NOT part of `GROUPS` (which
   * flattens into `LANG_GLOBALS`, the names `fake-symbol` never flags). Used to
   * recognise an `import os.path` as real without a package manifest, and to
   * leave a repo package that shadows one (`queue/`, `types/`) undecided rather
   * than flag a standard-library submodule it does not have (#909).
   */
  const PY_STDLIB = [
    '__future__', '__main__', '_thread', 'abc', 'aifc', 'argparse', 'array',
    'ast', 'asynchat', 'asyncio', 'asyncore', 'atexit', 'audioop', 'base64',
    'bdb', 'binascii', 'binhex', 'bisect', 'builtins', 'bz2', 'cProfile',
    'calendar', 'cgi', 'cgitb', 'chunk', 'cmath', 'cmd', 'code', 'codecs',
    'codeop', 'collections', 'colorsys', 'compileall', 'concurrent',
    'configparser', 'contextlib', 'contextvars', 'copy', 'copyreg', 'crypt',
    'csv', 'ctypes', 'curses', 'dataclasses', 'datetime', 'dbm', 'decimal',
    'difflib', 'dis', 'distutils', 'doctest', 'email', 'encodings', 'ensurepip',
    'enum', 'errno', 'faulthandler', 'fcntl', 'filecmp', 'fileinput', 'fnmatch',
    'fractions', 'ftplib', 'functools', 'gc', 'genericpath', 'getopt', 'getpass',
    'gettext', 'glob', 'graphlib', 'grp', 'gzip', 'hashlib', 'heapq', 'hmac',
    'html', 'http', 'idlelib', 'imaplib', 'imghdr', 'imp', 'importlib',
    'inspect', 'io', 'ipaddress', 'itertools', 'json', 'keyword', 'lib2to3',
    'linecache', 'locale', 'logging', 'lzma', 'mailbox', 'mailcap', 'marshal',
    'math', 'mimetypes', 'mmap', 'modulefinder', 'msilib', 'msvcrt',
    'multiprocessing', 'netrc', 'nis', 'nntplib', 'nt', 'ntpath', 'nturl2path',
    'numbers', 'opcode', 'operator', 'optparse', 'os', 'ossaudiodev', 'pathlib',
    'pdb', 'pickle', 'pickletools', 'pipes', 'pkgutil', 'platform', 'plistlib',
    'poplib', 'posix', 'posixpath', 'pprint', 'profile', 'pstats', 'pty', 'pwd',
    'py_compile', 'pyclbr', 'pydoc', 'pydoc_data', 'pyexpat', 'queue', 'quopri',
    'random', 're', 'readline', 'reprlib', 'resource', 'rlcompleter', 'runpy',
    'sched', 'secrets', 'select', 'selectors', 'shelve', 'shlex', 'shutil',
    'signal', 'site', 'smtpd', 'smtplib', 'sndhdr', 'socket', 'socketserver',
    'spwd', 'sqlite3', 'sre_compile', 'sre_constants', 'sre_parse', 'ssl', 'stat',
    'statistics', 'string', 'stringprep', 'struct', 'subprocess', 'sunau',
    'symtable', 'sys', 'sysconfig', 'syslog', 'tabnanny', 'tarfile', 'telnetlib',
    'tempfile', 'termios', 'textwrap', 'this', 'threading', 'time', 'timeit',
    'tkinter', 'token', 'tokenize', 'tomllib', 'trace', 'traceback',
    'tracemalloc', 'tty', 'turtle', 'turtledemo', 'types', 'typing',
    'unicodedata', 'unittest', 'urllib', 'uu', 'uuid', 'venv', 'warnings',
    'wave', 'weakref', 'webbrowser', 'winreg', 'winsound', 'wsgiref', 'xdrlib',
    'xml', 'xmlrpc', 'zipapp', 'zipfile', 'zipimport', 'zlib', 'zoneinfo',
  ];

  /**
   * Go standard-library top-level package directories (1.21 – 1.23).
   *
   * An import whose first path element is one of these is the standard library,
   * which needs no manifest to be real. A third-party module always starts with
   * a domain, so this list never claims one (#909).
   */
  const GO_STDLIB = [
    'archive', 'bufio', 'bytes', 'cmp', 'compress', 'container', 'context',
    'crypto', 'database', 'debug', 'embed', 'encoding', 'errors', 'expvar',
    'flag', 'fmt', 'go', 'hash', 'html', 'image', 'index', 'io', 'iter', 'log',
    'maps', 'math', 'mime', 'net', 'os', 'path', 'plugin', 'reflect', 'regexp',
    'runtime', 'slices', 'sort', 'strconv', 'strings', 'structs', 'sync',
    'syscall', 'testing', 'text', 'time', 'unicode', 'unique', 'unsafe',
  ];

  const GROUPS = {
    es: ES_GLOBALS,
    web: WEB_GLOBALS,
    node: NODE_GLOBALS,
    test: TEST_GLOBALS,
    python: PY_GLOBALS,
  };

  /** Every global, flattened — the set the guard checks against. */
  const LANG_GLOBALS = new Set(
    Object.values(GROUPS).reduce((acc, g) => acc.concat(g), [])
  );

  module.exports = { LANG_GLOBALS, GROUPS, ES_GLOBALS, WEB_GLOBALS, NODE_GLOBALS, TEST_GLOBALS, PY_GLOBALS, PY_STDLIB, GO_STDLIB };
  
};

// ── ./src/verify/hallucination-guard ──
__factories["./src/verify/hallucination-guard"] = function(module, exports) {
  
  /**
   * Hallucination Guard — deterministic core (Reliable MVP, v6.15.0).
   *
   * Given the text of an AI answer, flag claims that do not match the repo:
   *   - fake-file      : a referenced path is not on disk
   *   - fake-test-file : a referenced *test* path is not on disk (sub-type)
   *   - fake-import    : a relative import does not resolve; a bare import is
   *                      absent from package.json deps (builtins allow-listed); a
   *                      Python or Go import of the repo's own package does not
   *                      resolve (src/verify/imports.js, #909)
   *   - fake-import-name: a name imported from a repo module that resolves to one
   *                      file, and never occurs in it (#909)
   *   - fake-symbol    : a called function/class is absent from the symbol index
   *                      and is neither called nor defined anywhere in the source
   *                      (src/verify/source-confirm.js, #914)
   *   - fake-npm-script: `npm run X` where X is not a package.json script
   *
   * Each issue carries a `confidence` (detection certainty) and, where a near
   * match exists, a heuristic `suggestion` ("Did you mean …?"). No network, no
   * LLM. Reuses SigMap primitives (buildSigIndex) but every external dependency
   * is injectable via `opts` so the core stays unit-testable.
   */

  const fs = require('fs');
  const path = require('path');
  const parsers = __require('./src/verify/parsers');
  const { closestMatch, buildSymbolCandidates, formatSuggestion } = __require('./src/verify/closest-match');
  const { buildLibraryIndex } = __require('./src/verify/lib-index');
  const { buildArityIndex, extractCallArgCounts, checkArity } = __require('./src/verify/arity');
  const { buildImportContext, classifyImport, missingNames } = __require('./src/verify/imports');
  const { confirmSymbols } = __require('./src/verify/source-confirm');

  // A path that looks like a test file (JS/TS spec/test, Python test_/_test, or
  // a tests/__tests__ directory). Used to flag fake-test-file separately.
  const TEST_PATH_RE = /(?:\.(?:test|spec)\.[mc]?[jt]sx?$)|(?:(?:^|\/)__tests__\/)|(?:(?:^|\/)test_[^/]+\.py$)|(?:_test\.py$)|(?:(?:^|\/)tests?\/)/i;
  function isTestPath(p) { return TEST_PATH_RE.test(p); }

  const NODE_BUILTINS = new Set([
    'fs', 'path', 'os', 'util', 'events', 'stream', 'http', 'https', 'crypto',
    'child_process', 'url', 'querystring', 'assert', 'zlib', 'readline', 'net',
    'tls', 'dns', 'buffer', 'process', 'vm', 'module', 'console', 'timers',
    'string_decoder', 'perf_hooks', 'worker_threads', 'cluster', 'dgram', 'v8',
    'tty', 'repl', 'async_hooks', 'inspector', 'fs/promises', 'path/posix',
    'http2', 'diagnostics_channel',
  ]);

  // Core modules that exist only behind the `node:` scheme: `import test from 'node:test'`.
  const NODE_PREFIX_ONLY = new Set(['test', 'sqlite', 'sea']);

  const PY_BUILTINS = new Set([
    'os', 'sys', 're', 'json', 'math', 'typing', 'collections', 'itertools',
    'functools', 'datetime', 'pathlib', 'subprocess', 'abc', 'dataclasses',
    'enum', 'io', 'time', 'random', 'logging', 'argparse', 'unittest', 'asyncio',
    'copy', 'hashlib', 'threading', 'string', 'csv', 'glob', 'shutil', 'tempfile',
  ]);

  // Language globals live in ./globals as grouped data (#777). The inline list
  // this replaced stopped at `encodeURIComponent`, so `structuredClone` — a Node
  // and browser global since Node 17 — was reported as a hallucination.
  const { LANG_GLOBALS } = __require('./src/verify/globals');

  const REL_EXTS = ['', '.js', '.ts', '.tsx', '.jsx', '.mjs', '.cjs', '.json', '.py', '.r', '.R', '.vue'];
  const REL_INDEX = ['index.js', 'index.ts', 'index.tsx', 'index.jsx', '__init__.py'];

  // Obvious documentation-placeholder imports the model writes in illustrative
  // snippets — not real dependency claims. e.g. @scope/utils, some-module, ./local-file.
  const PLACEHOLDER_IMPORT_RE = new RegExp([
    '^@(?:scope|org|your-org|my-org|company|example)(?:/|$)', // @scope/utils
    '(?:^|/)(?:some|your|my)-(?:module|package|lib|component|file|dep)(?:$|/)', // some-module
    '(?:^|/)(?:local-file|your-file|my-file|module-name|package-name|your-package|example-package)(?:$|/)',
    '(?:^|/)path/to/', // ./path/to/x
  ].join('|'), 'i');

  /**
   * Build the set of known symbol identifiers from the SigMap signature index,
   * plus `{ name, file, line }` candidates (for closest-match suggestions).
   */
  function buildSymbolSet(cwd) {
    const set = new Set();
    let fileKeys = [];
    let symbolCandidates = [];
    let sigIndex = null;
    try {
      const { buildSigIndex } = __require('./src/retrieval/ranker');
      // every signature the index keeps: a symbol past what the ranker reads is still a real one (#982)
      const idx = buildSigIndex(cwd, { full: true });
      sigIndex = idx;
      fileKeys = [...idx.keys()];
      for (const sigs of idx.values()) {
        for (const sig of sigs) {
          const cleaned = String(sig).replace(/\s*:\d+(?:-\d+)?\s*$/, '');
          const ids = cleaned.match(/[A-Za-z_$][\w$]*/g) || [];
          for (const id of ids) set.add(id);
        }
      }
      symbolCandidates = buildSymbolCandidates(idx);
    } catch (_) {}
    return { set, fileKeys, symbolCandidates, sigIndex };
  }

  /** Load declared dependency names from package.json. */
  function loadDeps(cwd) {
    const deps = new Set();
    let hasPkg = false;
    try {
      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
      hasPkg = true;
      for (const k of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
        if (pkg[k] && typeof pkg[k] === 'object') {
          for (const name of Object.keys(pkg[k])) deps.add(name);
        }
      }
    } catch (_) {}
    return { deps, hasPkg };
  }

  /** Load the set of npm script names declared in package.json. */
  function loadScripts(cwd) {
    const scripts = new Set();
    try {
      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
      if (pkg.scripts && typeof pkg.scripts === 'object') {
        for (const name of Object.keys(pkg.scripts)) scripts.add(name);
      }
    } catch (_) {}
    return scripts;
  }

  /** Default file-existence check: resolve a referenced path against cwd. */
  function defaultFileExists(cwd, ref) {
    const clean = ref.replace(/^\.\//, '');
    for (const c of [path.resolve(cwd, clean), path.resolve(cwd, ref)]) {
      try {
        if (fs.existsSync(c)) return true;
      } catch (_) {}
    }
    return false;
  }

  /** Default relative-import resolver: fs candidates + basename match in index. */
  function defaultRelativeResolvable(cwd, mod, fileBasenames) {
    const base = path.resolve(cwd, mod);
    for (const e of REL_EXTS) {
      try {
        if (fs.existsSync(base + e)) return true;
      } catch (_) {}
    }
    for (const idx of REL_INDEX) {
      try {
        if (fs.existsSync(path.join(base, idx))) return true;
      } catch (_) {}
    }
    // Fall back to basename match against the indexed file set (the answer's
    // import is relative to a file we cannot know, so a name match is enough
    // to avoid false positives).
    const wantBase = path.basename(mod).replace(/\.[^.]+$/, '').toLowerCase();
    return fileBasenames.has(wantBase);
  }

  /**
   * Verify an AI answer against the repository.
   *
   * Each issue has the shape:
   *   { type, value, line, location, message, confidence, suggestion }
   * where `confidence` is the *detection* certainty ('high' for path/dep/script
   * checks, 'medium' for symbol checks) and `suggestion` is a heuristic
   * closest-match hint (or null).
   *
   * @param {string} answerText
   * @param {string} cwd
   * @param {object} [opts]
   * @param {Set<string>} [opts.symbolSet]      override known symbols
   * @param {Array}       [opts.symbolCandidates] override { name, file, line } list
   * @param {Array<string>} [opts.fileCandidates]  override repo file paths (suggestions)
   * @param {Set<string>} [opts.deps]           override package deps
   * @param {Set<string>} [opts.scripts]        override package.json script names
   * @param {boolean}     [opts.hasPkg]         whether a package.json exists
   * @param {(ref: string) => boolean} [opts.fileExists]          override file check
   * @param {(mod: string) => boolean} [opts.relativeResolvable]  override rel-import check
   * @param {object}      [opts.importContext]  override the Python/Go/JS-name resolution context (src/verify/imports.js)
   * @param {(names: string[]) => { has: (name: string) => boolean }} [opts.confirmSymbols]
   *        override the source confirmation of a symbol the index lacks (#914)
   * @param {boolean}     [opts.sourceConfirm]  false skips it; by default it runs only when verify built the symbol set itself
   * @returns {{ issues: object[], summary: object }}
   */
  function verify(answerText, cwd, opts = {}) {
    const ownSymbols = !opts.symbolSet;
    let symbolSet = opts.symbolSet;
    let fileBasenames = opts.fileBasenames;
    let symbolCandidates = opts.symbolCandidates || [];
    let fileCandidates = opts.fileCandidates || [];
    let arityIndex = opts.arityIndex || null;
    if (!symbolSet) {
      const built = buildSymbolSet(cwd);
      symbolSet = built.set;
      fileBasenames = new Set(built.fileKeys.map(
        (k) => path.basename(k).replace(/\.[^.]+$/, '').toLowerCase()
      ));
      symbolCandidates = built.symbolCandidates;
      fileCandidates = built.fileKeys;
      if (!arityIndex && built.sigIndex) {
        try { arityIndex = buildArityIndex(built.sigIndex); } catch (_) {}
      }
    }
    if (!fileBasenames) fileBasenames = new Set();
    // Whether the REPO had symbols, before installed libraries are unioned in: library
    // names alone make the symbol check run, against a set that holds none of the repo's own.
    const repoSymbolCount = symbolSet.size;

    // Installed-library grounding (G5/D5, the moat): union the exported symbols of
    // the libraries actually installed in node_modules, so genuine library calls
    // stop false-flagging as fake-symbol and the summary can pin the versions the
    // answer was verified against. Auto-runs only when the caller did not override
    // the symbol set (keeps hermetic callers unchanged); disable with libIndex:false.
    let libraries = opts.libraries || [];
    {
      let libSyms = opts.libSymbols;
      if (!libSyms && opts.libIndex !== false && !opts.symbolSet) {
        try {
          const li = buildLibraryIndex(cwd, { version: opts.version });
          libSyms = li.symbols;
          if (!opts.libraries) libraries = li.libraries;
        } catch (_) { libSyms = null; }
      }
      if (libSyms && libSyms.size) {
        const merged = new Set(symbolSet);
        for (const s of libSyms) merged.add(s);
        symbolSet = merged;
      }
    }

    let deps = opts.deps;
    let hasPkg = opts.hasPkg;
    if (!deps) {
      const loaded = loadDeps(cwd);
      deps = loaded.deps;
      if (hasPkg === undefined) hasPkg = loaded.hasPkg;
    }
    const scripts = opts.scripts || (hasPkg ? loadScripts(cwd) : new Set());

    const fileExists = opts.fileExists || ((ref) => defaultFileExists(cwd, ref));
    const relativeResolvable = opts.relativeResolvable
      || ((mod) => defaultRelativeResolvable(cwd, mod, fileBasenames));

    // Pre-derive basename candidates for file suggestions (compare on basename so
    // a wrong directory still surfaces the right file).
    const fileBasenameCandidates = fileCandidates.map((f) => ({ name: path.basename(f), file: f }));

    const issues = [];
    const dedupe = new Set();
    const add = (issue) => {
      const key = `${issue.type}::${issue.value}`;
      if (dedupe.has(key)) return;
      dedupe.add(key);
      if (!('suggestion' in issue)) issue.suggestion = null;
      issue.location = `L${issue.line}`;
      issues.push(issue);
    };

    // How many claims of each class this run actually decided (#989). "Nothing was
    // flagged" only means something next to "N were checked": an answer with no
    // checkable claim is not a clean answer, it is an empty check.
    const claims = { files: 0, imports: 0, symbols: 0, scripts: 0 };

    // 1. fake-file / fake-test-file
    //
    // A bare file name (`util.js`, no directory) names no path to look up. The answer
    // is relative to a place we cannot know, so it stands when the repo has a file
    // of that name anywhere — `src/util.js` answers "edit util.js" (#989).
    const indexedNames = new Set(fileCandidates.map((f) => path.basename(f)));
    const fileRefs = parsers.extractFilePaths(answerText);
    claims.files = fileRefs.length;
    for (const { path: p, line } of fileRefs) {
      if (fileExists(p)) continue;
      if (!p.includes('/') && indexedNames.has(p)) continue;
      const isTest = isTestPath(p);
      const match = closestMatch(path.basename(p), fileBasenameCandidates, { minLen: 4 });
      add({
        type: isTest ? 'fake-test-file' : 'fake-file',
        value: p,
        line,
        message: `${isTest ? 'Test file' : 'File'} not found on disk: ${p}`,
        confidence: 'high',
        suggestion: match ? formatSuggestion(match, false) : null,
      });
    }

    // 2. fake-import · fake-import-name
    //
    // `verifiedImports` records every import claim this pass positively resolved,
    // so `judge` can clear it: "not flagged" is not "checked" for a Python import
    // the repo cannot decide, and judge must tell the two apart (#909).
    const importCtx = opts.importContext || buildImportContext(cwd, fileCandidates);
    const verifiedImports = new Set();
    const checkNames = (imp) => {
      const miss = missingNames(imp, importCtx);
      if (!miss) return;
      const sameFile = symbolCandidates.filter((c) => c.file === miss.file);
      for (const name of miss.missing) {
        const match = sameFile.length ? closestMatch(name, sameFile, { minLen: 3, maxRatio: 0.34 }) : null;
        add({
          type: 'fake-import-name',
          value: name,
          line: imp.line,
          message: `Not exported by ${imp.module} (${miss.file}): ${name}`,
          confidence: 'medium',
          suggestion: match ? formatSuggestion(match, false) : null,
        });
      }
    };
    for (const imp of parsers.extractImports(answerText)) {
      if (PLACEHOLDER_IMPORT_RE.test(imp.module)) continue;

      // Python and Go: decided from the repo alone. Only `unresolved` is a
      // finding — a standard-library import is real, a third-party one is not
      // ours to judge offline, and a layout we cannot read stays unknown.
      if (imp.kind === 'py' || imp.kind === 'go') {
        const r = classifyImport(imp, importCtx);
        if (r.status === 'unresolved') {
          claims.imports++;
          add({ type: 'fake-import', value: imp.module, line: imp.line, message: `Import does not resolve: ${imp.module}`, confidence: 'high' });
          continue;
        }
        if (r.status === 'resolved') {
          claims.imports++;
          verifiedImports.add(imp.module);
          checkNames(imp);
          continue;
        }
        // Unknown. A Python relative import in a repo with no Python to read
        // falls through to the file-based resolver below; the rest is left alone.
        if (!(imp.kind === 'py' && imp.relative)) continue;
      }
      if (imp.relative) {
        claims.imports++;
        if (!relativeResolvable(imp.module)) {
          add({ type: 'fake-import', value: imp.module, line: imp.line, message: `Import does not resolve: ${imp.module}`, confidence: 'high' });
          continue;
        }
        verifiedImports.add(imp.module);
        checkNames(imp);
        continue;
      }
      // Bare module — only verifiable for JS when a package.json exists.
      const top = imp.module.split('/')[0];
      if (imp.kind === 'js') {
        // `node:` is the scheme for Node's own modules — a claim about the runtime,
        // not a package to find in package.json. It was reported as "Package not in
        // dependencies" (#989). A `node:` name this list does not know is left alone
        // rather than guessed at: Node adds core modules.
        if (imp.module.startsWith('node:')) {
          const core = imp.module.slice(5).split('/')[0];
          if (NODE_BUILTINS.has(core) || NODE_PREFIX_ONLY.has(core)) {
            claims.imports++;
            verifiedImports.add(imp.module);
          }
          continue;
        }
        if (!hasPkg) continue;
        claims.imports++;
        if (NODE_BUILTINS.has(imp.module) || NODE_BUILTINS.has(top)) { verifiedImports.add(imp.module); continue; }
        if (top.startsWith('@')) {
          const scoped = imp.module.split('/').slice(0, 2).join('/');
          if (deps.has(scoped) || deps.has(imp.module)) { verifiedImports.add(imp.module); continue; }
        } else if (deps.has(top) || deps.has(imp.module)) {
          verifiedImports.add(imp.module);
          continue;
        }
        const match = closestMatch(top, [...deps], { minLen: 3 });
        add({
          type: 'fake-import',
          value: imp.module,
          line: imp.line,
          message: `Package not in dependencies: ${imp.module}`,
          confidence: 'high',
          suggestion: match ? formatSuggestion({ name: match.name }, false) : null,
        });
      }
    }

    // 3. fake-symbol
    //
    // The symbol set is a summary — a file keeps `maxIndexSigsPerFile` signatures, only
    // the files under the detected roots are in it, an extractor lists only the
    // constructs it knows — so a name it lacks is not yet fake (#914, #910). The
    // names that would be flagged are looked up in the source, in one pass, and a
    // name that is called or defined there is dropped. Skipped when the caller
    // supplied its own symbol set: that set is then the whole truth.
    const sourceConfirmed = new Set();
    const confirmSource = opts.confirmSymbols
      || (ownSymbols && opts.sourceConfirm !== false
        ? (names) => confirmSymbols(cwd, names, { priority: fileCandidates }).confirmed
        : null);
    if (symbolSet.size > 0) {
      const pending = [];
      const calls = parsers.extractSymbols(answerText);
      claims.symbols = calls.length;
      for (const { name, line } of calls) {
        if (symbolSet.has(name)) continue;
        if (LANG_GLOBALS.has(name) || NODE_BUILTINS.has(name) || PY_BUILTINS.has(name)) continue;
        pending.push({ name, line });
      }
      const confirmed = pending.length && confirmSource ? confirmSource([...new Set(pending.map((p) => p.name))]) : null;
      for (const { name, line } of pending) {
        if (confirmed && confirmed.has(name)) { sourceConfirmed.add(name); continue; }
        // Similarity floor (#777): the default 0.5 ratio let `low`-confidence
        // matches through, so `debounce()` was answered with `drone()` — a
        // suggestion that would corrupt the answer if applied. 0.34 keeps the
        // high/medium band (`buildEvidencPack` → `buildEvidencePack`, `scanx` →
        // `scan`) and drops the rest, since no suggestion beats a wrong one.
        const match = closestMatch(name, symbolCandidates, { minLen: 4, maxRatio: 0.34 });
        add({
          type: 'fake-symbol',
          value: name,
          line,
          message: `Symbol not found in repo index: ${name}()`,
          confidence: 'medium',
          suggestion: match ? formatSuggestion(match, true) : null,
        });
      }
    }

    // 3b. arity-mismatch (D1, #529) — a call to a KNOWN repo function whose
    // argument count falls outside the signature's [min, max]. Conservative by
    // construction: only uniquely-resolved, top-level functions from
    // exact-param languages (JS/TS via the balanced scanner, Python via AST);
    // variadic signatures only flag too-few; dotted calls never flag.
    if (arityIndex && arityIndex.size > 0) {
      for (const block of parsers.extractCodeBlocks(answerText)) {
        if (block.lang && !/^(js|jsx|ts|tsx|javascript|typescript|python|py|go|golang)$/i.test(block.lang)) continue;
        for (const call of extractCallArgCounts(block.content)) {
          if (!symbolSet.has(call.name)) continue; // unknown symbols stay fake-symbol territory
          const entry = checkArity(call.name, call.args, arityIndex);
          if (!entry) continue;
          const range = entry.variadic ? `at least ${entry.min}`
            : (entry.min === entry.max ? String(entry.max) : `${entry.min}–${entry.max}`);
          add({
            type: 'arity-mismatch',
            value: `${call.name}(${call.args} args)`,
            line: block.line + call.line - 1,
            message: `${call.name}() called with ${call.args} argument(s) — repo signature takes ${range}`,
            confidence: 'medium',
            suggestion: `${entry.sig}  (${entry.file})`,
          });
        }
      }
    }

    // 4. fake-npm-script
    if (hasPkg && scripts.size > 0) {
      const invoked = parsers.extractNpmScripts(answerText);
      claims.scripts = invoked.length;
      for (const { name, line } of invoked) {
        if (scripts.has(name)) continue;
        const match = closestMatch(name, [...scripts], { minLen: 2 });
        add({
          type: 'fake-npm-script',
          value: name,
          line,
          message: `npm script not in package.json: ${name}`,
          confidence: 'high',
          suggestion: match ? formatSuggestion({ name: match.name }, false) : null,
        });
      }
    }

    issues.sort((a, b) => a.line - b.line);

    const byType = {
      'fake-file': 0, 'fake-test-file': 0, 'fake-import': 0,
      'fake-import-name': 0, 'fake-symbol': 0, 'fake-npm-script': 0,
    };
    for (const i of issues) byType[i.type] = (byType[i.type] || 0) + 1;

    const summary = {
      total: issues.length,
      byType,
      clean: issues.length === 0,
      symbolsIndexed: symbolSet.size,
      // The repo's own symbols, before installed libraries are unioned in (#989): library
      // names alone make the symbol check run, against a set that holds none of the repo's.
      repoSymbolsIndexed: repoSymbolCount,
      // Names the index lacked that the source calls or defines (#914) — not findings.
      symbolsConfirmed: sourceConfirmed.size,
      withSuggestion: issues.filter((i) => i.suggestion).length,
      librariesIndexed: libraries.length,
      libraries: libraries.map((l) => ({ name: l.name, version: l.version, symbols: l.symbols, typed: l.typed, ...(l.partial ? { partial: true } : {}) })),
      // Claims each class decided (#989): the number a clean verdict is a verdict ON.
      claims: { ...claims, total: claims.files + claims.imports + claims.symbols + claims.scripts },
      // Which claim classes actually ran (J1, #640): lets callers distinguish
      // "checked and clean" from "check skipped" — a symbol NOT flagged means
      // nothing when no symbol index exists.
      checks: {
        symbols: symbolSet.size > 0,
        files: true,
        relativeImports: true,
        bareImports: !!hasPkg,
        scripts: !!hasPkg && scripts.size > 0,
      },
      // Import claims this run positively resolved (#909) — what `judge` may clear.
      verifiedImports: [...verifiedImports],
    };

    return { issues, summary };
  }

  module.exports = { verify, buildSymbolSet, loadDeps, loadScripts, isTestPath };
  
};

// ── ./src/verify/imports ──
__factories["./src/verify/imports"] = function(module, exports) {
  
  /**
   * Local import resolution and named-import validity (J3 · D1, #909).
   *
   * `verify` has always asked of an import "does this module exist?" — for a JS
   * path, a JS package, a relative file. This module answers it for the
   * languages whose imports the repo alone can decide, and asks one question
   * more: of a name taken from a module the repo owns, "does that module have it?"
   *
   *   Python  a dotted import whose first segment is a repo package or module
   *           resolves to a file or a package — or it does not
   *   Go      an import under a go.mod module path names a directory holding
   *           Go files — or it does not
   *   JS/TS   a name imported from a relative module that resolves to ONE file
   *           occurs in that file
   *   Python  likewise, for `from pkg.mod import name`
   *
   * Every answer is one of three: `resolved`, `unresolved`, `unknown`. Only
   * `unresolved` is ever a finding. A standard-library import is `resolved`, a
   * third-party one `unknown` (or `resolved` when a manifest names it), and a
   * layout this module cannot read is `unknown` — a false "fake import" costs
   * more than a missed one, so every doubt is an `unknown`.
   *
   * Deterministic, offline, zero dependencies. Reads the index keys it is given
   * and, where an empty file leaves no index entry (`__init__.py`), the disk.
   */

  const fs = require('fs');
  const path = require('path');
  const { PY_STDLIB, GO_STDLIB } = __require('./src/verify/globals');

  const PY_STDLIB_SET = new Set(PY_STDLIB);
  const GO_STDLIB_SET = new Set(GO_STDLIB);

  const JS_EXTS = ['.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.mts', '.cts'];
  const JS_FILE_RE = /\.(?:[mc]?[jt]sx?)$/;
  const MAX_TEXT_BYTES = 1500000; // a module read to look for a name
  const MAX_DIR_PROBES = 2000;    // directories probed for a base-less relative import
  const MAX_GO_DIRS = 500;        // Go directories climbed looking for a go.mod

  const norm = (p) => String(p).replace(/\\/g, '/');
  const dirnameOf = (key) => (key.includes('/') ? key.slice(0, key.lastIndexOf('/')) : '');
  const stripExt = (key) => key.replace(/\.[^./]+$/, '');
  const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');

  /** True when `text` mentions `name` as a whole identifier. */
  function mentions(text, name) {
    return new RegExp('(?<![\\w$])' + escapeRe(name) + '(?![\\w$])').test(text);
  }

  /**
   * The shared, lazily-filled context one `verify()` call resolves against.
   * @param {string} cwd
   * @param {Iterable<string>} fileKeys  the indexed files (repo-relative or absolute)
   */
  function buildImportContext(cwd, fileKeys) {
    let keys = null;
    let keySet = null;
    const load = () => {
      keys = [];
      for (const k of fileKeys || []) {
        const rel = norm(path.isAbsolute(k) ? path.relative(cwd, k) : k).replace(/^\.\//, '');
        if (rel && !rel.startsWith('..')) keys.push(rel);
      }
      keySet = new Set(keys);
    };
    const exists = new Map();
    const texts = new Map();
    return {
      cwd,
      _py: null,
      _go: null,
      _jsByStem: null,
      // Normalised lazily: an answer with no Python or Go import never pays for it.
      get keys() { if (!keys) load(); return keys; },
      get keySet() { if (!keySet) load(); return keySet; },
      /** An indexed file, or one on disk. */
      exists(rel) {
        if (this.keySet.has(rel)) return true;
        if (!exists.has(rel)) {
          let ok = false;
          try { ok = fs.existsSync(path.join(cwd, rel)); } catch (_) {}
          exists.set(rel, ok);
        }
        return exists.get(rel);
      },
      /** A regular file (an extension-less path may name a directory). */
      isFile(rel) {
        if (this.keySet.has(rel)) return true;
        try { return fs.statSync(path.join(cwd, rel)).isFile(); } catch (_) { return false; }
      },
      readText(rel) {
        if (!texts.has(rel)) {
          let text = '';
          try {
            const abs = path.join(cwd, rel);
            if (fs.statSync(abs).size <= MAX_TEXT_BYTES) text = fs.readFileSync(abs, 'utf8');
          } catch (_) {}
          texts.set(rel, text);
        }
        return texts.get(rel);
      },
    };
  }

  // ── Python ──────────────────────────────────────────────────────────────────

  /**
   * Index the repo's Python: which names are importable at top level (and from
   * which root), and every segment-aligned suffix of every module path.
   *
   * A top-level package is the highest directory in an unbroken chain of
   * `__init__.py` — checked on disk, because an empty `__init__.py` carries no
   * signature and so never reaches the index.
   */
  function pyIndex(ctx) {
    if (ctx._py) return ctx._py;
    const tops = new Map();     // 'app' -> Set(roots)  e.g. {'src'}
    const suffixes = new Set(); // 'src/app/config', 'app/config', 'config'
    const dirs = new Set();
    const inits = new Map();
    const hasInit = (dir) => {
      if (!inits.has(dir)) inits.set(dir, ctx.exists((dir ? dir + '/' : '') + '__init__.py'));
      return inits.get(dir);
    };
    let count = 0;
    for (const key of ctx.keys) {
      if (!/\.pyi?$/.test(key)) continue;
      count++;
      const parts = key.replace(/\.pyi?$/, '').split('/');
      const file = parts.pop();
      const modParts = file === '__init__' ? parts : parts.concat(file);
      for (let i = 0; i < modParts.length; i++) suffixes.add(modParts.slice(i).join('/'));
      for (let i = 0; i <= parts.length; i++) dirs.add(parts.slice(0, i).join('/'));
      let d = parts.length;
      while (d > 0 && hasInit(parts.slice(0, d).join('/'))) d--;
      const top = d < parts.length ? parts[d] : (file === '__init__' ? null : file);
      if (top) {
        if (!tops.has(top)) tops.set(top, new Set());
        tops.get(top).add(parts.slice(0, d).join('/'));
      }
    }
    ctx._py = { count, tops, suffixes, dirs: [...dirs].sort() };
    return ctx._py;
  }

  /** `import a.b.c` / `from a.b import x` — the module path, absolute. */
  function resolvePyModule(ctx, dotted) {
    const py = pyIndex(ctx);
    const segs = dotted.split('.');
    const roots = py.tops.get(segs[0]);
    if (!roots) {
      return PY_STDLIB_SET.has(segs[0]) ? { status: 'resolved', via: 'stdlib' } : { status: 'unknown' };
    }
    const rel = segs.join('/');
    for (const root of roots) {
      const base = (root ? root + '/' : '') + rel;
      for (const cand of [base + '.py', base + '.pyi', base + '/__init__.py', base + '/__init__.pyi']) {
        if (ctx.exists(cand)) return { status: 'resolved', via: 'repo', file: cand };
      }
    }
    // A repo package that shadows a stdlib name (`queue/`, `types/`) is not
    // evidence the answer's `queue.Queue` is fake.
    if (PY_STDLIB_SET.has(segs[0])) return { status: 'unknown' };
    return { status: 'unresolved' };
  }

  /** `from .x.y import z` / `from ..x import z` — relative to a file we cannot know. */
  function resolvePyRelative(ctx, module) {
    const rest = module.replace(/^\.+/, '');
    if (!rest) return { status: 'resolved', via: 'package' };
    const py = pyIndex(ctx);
    if (py.count === 0) return { status: 'unknown' };
    const suffix = rest.split('.').join('/');
    if (py.suffixes.has(suffix)) return { status: 'resolved', via: 'repo' };
    // A module with no signature (constants only) is not in the index — probe the
    // directories that hold Python before calling it missing.
    let probes = 0;
    for (const dir of py.dirs) {
      if (++probes > MAX_DIR_PROBES) return { status: 'unknown' };
      const base = (dir ? dir + '/' : '') + suffix;
      if (ctx.exists(base + '.py') || ctx.exists(base + '.pyi') || ctx.exists(base + '/__init__.py')) {
        return { status: 'resolved', via: 'repo' };
      }
    }
    return { status: 'unresolved' };
  }

  /** The one file a Python import names, or null when it is not exactly one. */
  function pyModuleFile(ctx, imp) {
    if (!imp.relative) {
      const r = resolvePyModule(ctx, imp.module);
      return r.status === 'resolved' && r.file ? r.file : null;
    }
    const rest = imp.module.replace(/^\.+/, '');
    if (!rest) return null;
    const suffix = rest.split('.').join('/');
    const hits = [];
    for (const key of ctx.keys) {
      if (!/\.pyi?$/.test(key)) continue;
      const parts = key.replace(/\.pyi?$/, '').split('/');
      if (parts[parts.length - 1] === '__init__') parts.pop();
      const mod = parts.join('/');
      if (mod === suffix || mod.endsWith('/' + suffix)) hits.push(key);
    }
    return hits.length === 1 ? hits[0] : null;
  }

  // ── Go ──────────────────────────────────────────────────────────────────────

  /** Parse a go.mod: the module path, and every module it requires. */
  function parseGoMod(text) {
    const mod = text.match(/^\s*module\s+"?([^\s"]+)"?/m);
    if (!mod) return null;
    const requires = [];
    let inBlock = false;
    for (const raw of text.split('\n')) {
      const line = raw.replace(/\/\/.*$/, '').trim();
      if (inBlock) {
        if (line.startsWith(')')) { inBlock = false; continue; }
        const m = line.match(/^(\S+)\s+v/);
        if (m) requires.push(m[1]);
        continue;
      }
      if (/^require\s*\(/.test(line)) { inBlock = true; continue; }
      const one = line.match(/^require\s+(\S+)\s+v/);
      if (one) requires.push(one[1]);
    }
    return { module: mod[1], requires };
  }

  /** Every go.mod the repo's Go files sit under (the repo root and nested modules). */
  function goModules(ctx) {
    if (ctx._go) return ctx._go;
    const modules = [];
    const tried = new Set();
    const tryRoot = (root) => {
      if (tried.has(root)) return;
      tried.add(root);
      const file = (root ? root + '/' : '') + 'go.mod';
      if (!ctx.exists(file)) return;
      const parsed = parseGoMod(ctx.readText(file));
      if (parsed) modules.push({ root, module: parsed.module, requires: parsed.requires });
    };
    tryRoot('');
    const dirs = new Set();
    for (const key of ctx.keys) if (key.endsWith('.go')) dirs.add(dirnameOf(key));
    let probed = 0;
    for (const dir of [...dirs].sort()) {
      if (++probed > MAX_GO_DIRS) break;
      for (let d = dir; d; d = dirnameOf(d)) tryRoot(d);
    }
    ctx._go = modules;
    return ctx._go;
  }

  function dirHasGo(ctx, dir) {
    for (const key of ctx.keys) if (key.endsWith('.go') && dirnameOf(key) === dir) return true;
    try {
      return fs.readdirSync(path.join(ctx.cwd, dir)).some((f) => f.endsWith('.go'));
    } catch (_) {
      return false;
    }
  }

  /** A Go import path: local to a module, standard library, required, or unknown. */
  function resolveGoImport(ctx, importPath) {
    let best = null;
    for (const m of goModules(ctx)) {
      if (importPath === m.module || importPath.startsWith(m.module + '/')) {
        if (!best || m.module.length > best.module.length) best = m;
      }
    }
    if (best) {
      const rel = importPath === best.module ? '' : importPath.slice(best.module.length + 1);
      const dir = [best.root, rel].filter(Boolean).join('/');
      return dirHasGo(ctx, dir) ? { status: 'resolved', via: 'repo' } : { status: 'unresolved' };
    }
    if (GO_STDLIB_SET.has(importPath.split('/')[0])) return { status: 'resolved', via: 'stdlib' };
    for (const m of goModules(ctx)) {
      if (m.requires.some((r) => importPath === r || importPath.startsWith(r + '/'))) {
        return { status: 'resolved', via: 'go.mod' };
      }
    }
    return { status: 'unknown' };
  }

  // ── JS / TS ─────────────────────────────────────────────────────────────────

  function jsByStem(ctx) {
    if (ctx._jsByStem) return ctx._jsByStem;
    const map = new Map();
    for (const key of ctx.keys) {
      if (!JS_FILE_RE.test(key)) continue;
      const stem = path.posix.basename(key).replace(/\.[^.]+$/, '').toLowerCase();
      if (!map.has(stem)) map.set(stem, []);
      map.get(stem).push(key);
    }
    ctx._jsByStem = map;
    return map;
  }

  /**
   * The one file a relative JS/TS import names, or null when it is not exactly
   * one. The answer's import is relative to a file we cannot know, so it is read
   * from the repo root first, then by module name — and only when that is unique.
   */
  function jsModuleFile(ctx, module) {
    const base = path.posix.normalize(norm(module));
    if (!base.startsWith('..')) {
      for (const ext of [''].concat(JS_EXTS)) if (ctx.isFile(base + ext) && JS_FILE_RE.test(base + ext)) return base + ext;
      for (const ext of JS_EXTS) if (ctx.isFile(`${base}/index${ext}`)) return `${base}/index${ext}`;
    }
    const stem = path.posix.basename(module).replace(/\.[^.]+$/, '').toLowerCase();
    const cands = jsByStem(ctx).get(stem) || [];
    if (cands.length === 1) return cands[0];
    if (cands.length > 1) {
      const tail = stripExt(module.replace(/^(?:\.{1,2}\/)+/, ''));
      const narrowed = cands.filter((k) => stripExt(k) === tail || stripExt(k).endsWith('/' + tail));
      if (narrowed.length === 1) return narrowed[0];
    }
    return null;
  }

  // A module that re-exports wholesale, or builds its exports at run time, has
  // names the text does not show — never a finding.
  const JS_DYNAMIC_EXPORT_RE = /\bexport\s*\*|\bmodule\.exports\s*=\s*require\s*\(|\bObject\.assign\s*\(\s*(?:module\.)?exports\b|__exportStar|\bexports\s*\[/;
  const PY_DYNAMIC_EXPORT_RE = /^\s*from\s+[.\w]+\s+import\s+\*|^\s*def\s+__getattr__\s*\(|\bglobals\s*\(\s*\)\s*\[|\bimportlib\b|\b__import__\s*\(/m;

  // ── Public ──────────────────────────────────────────────────────────────────

  /**
   * Whether an import names something that exists.
   * @param {{ module: string, kind: string, relative: boolean }} imp
   * @param {object} ctx  from buildImportContext
   * @returns {{ status: 'resolved'|'unresolved'|'unknown', via?: string, file?: string }}
   */
  function classifyImport(imp, ctx) {
    if (imp.kind === 'py') return imp.relative ? resolvePyRelative(ctx, imp.module) : resolvePyModule(ctx, imp.module);
    if (imp.kind === 'go') return resolveGoImport(ctx, imp.module);
    return { status: 'unknown' };
  }

  /**
   * The names an import takes by name that its module does not have — only when
   * the module is a repo file that resolves uniquely and cannot re-export.
   * @returns {{ file: string, missing: string[] } | null}
   */
  function missingNames(imp, ctx) {
    if (!imp.names || imp.names.length === 0) return null;
    if (imp.kind === 'js') {
      if (!imp.relative) return null;
      const file = jsModuleFile(ctx, imp.module);
      if (!file || !JS_FILE_RE.test(file)) return null;
      const text = ctx.readText(file);
      if (!text || JS_DYNAMIC_EXPORT_RE.test(text)) return null;
      const missing = imp.names.filter((n) => !mentions(text, n));
      return missing.length ? { file, missing } : null;
    }
    if (imp.kind === 'py') {
      const file = pyModuleFile(ctx, imp);
      if (!file) return null;
      const text = ctx.readText(file);
      if (PY_DYNAMIC_EXPORT_RE.test(text)) return null;
      const pkgDir = /(?:^|\/)__init__\.pyi?$/.test(file) ? file.replace(/\/?__init__\.pyi?$/, '') : null;
      const submodule = (n) => pkgDir !== null && [`${n}.py`, `${n}.pyi`, `${n}/__init__.py`]
        .some((tail) => ctx.exists((pkgDir ? pkgDir + '/' : '') + tail));
      const missing = imp.names.filter((n) => !mentions(text, n) && !submodule(n));
      return missing.length ? { file, missing } : null;
    }
    return null;
  }

  module.exports = {
    buildImportContext,
    classifyImport,
    missingNames,
    parseGoMod,
  };
  
};

// ── ./src/verify/lib-index ──
__factories["./src/verify/lib-index"] = function(module, exports) {
  
  /**
   * Local-library signature index (v9.0 G5/D5 — the private-API grounding moat).
   *
   * Context7 knows only *public* library docs. SigMap can do something no
   * competitor can: index the signatures of the libraries **actually installed**
   * in `node_modules` and verify AI suggestions against repo + private +
   * installed-lib symbols. This module builds the installed-lib half.
   *
   * Two ecosystems, one index:
   *   - **JS/TS** — each **direct** dependency in `package.json` resolved under
   *     `node_modules/<dep>`; exports read from its TypeScript declaration entry
   *     (`types`/`typings`, `exports` types, `typesVersions`, else `index.d.ts`; or
   *     `node_modules/@types/<dep>` when the package ships none), and followed through
   *     the relative `export * from` barrels that most large libraries are made of (#990).
   *   - **Python** — each direct dependency in `requirements.txt`/`pyproject.toml`
   *     resolved in the project's venv `site-packages`; exports read from the
   *     package's `__init__.py`/`.pyi`. No Python runtime is spawned (North-Star #1).
   *
   * Pure, zero-dependency, deterministic: byte-stable given a fixed installed
   * tree. Bounded (per-file read cap + dep cap) and cached via
   * `src/cache/sig-cache.js` so repeat builds are near-free.
   */

  const fs = require('fs');
  const path = require('path');
  const { loadCache, saveCache, getChangedFiles, updateCacheEntries } = __require('./src/cache/sig-cache');

  const MAX_DTS_BYTES = 512 * 1024; // per-file read cap
  const MAX_DEPS = 1000;            // dep count cap
  const MAX_PARTS = 400;            // declaration files read for one library (barrels included)
  const MAX_DTS_FILE_BYTES = 4 * 1024 * 1024;  // one declaration file (valibot's is 630 KB, @types/node's larger)
  const MAX_PARTS_BYTES = 16 * 1024 * 1024;    // total bytes read for one library
  // `typesVersions` keys are TypeScript version ranges. A fixed assumption keeps the
  // answer the same on every machine, instead of depending on whichever compiler is installed.
  const ASSUMED_TS = [5, 9];
  const DEP_KEYS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
  const VENV_DIRS = ['.venv', 'venv', 'env', '.env'];

  /**
   * Extract exported symbol names from a `.d.ts` declaration file. Deterministic,
   * regex-based (declaration files are already normalized, so this is robust
   * without a full TS parser and stays zero-dependency).
   * @param {string} src
   * @returns {string[]} sorted unique exported names
   */
  function extractDtsExports(src) {
    const names = new Set();
    if (!src) return [];

    // export [declare] [default] function|const|let|var|class|interface|type|enum|namespace Name
    const declRe = /\bexport\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:function|const|let|var|class|interface|type|enum|namespace|module)\s+([A-Za-z_$][\w$]*)/g;
    let m;
    while ((m = declRe.exec(src)) !== null) names.add(m[1]);

    // export { a, b as c, default as d }
    const listRe = /\bexport\s*(?:type\s*)?\{([^}]*)\}/g;
    while ((m = listRe.exec(src)) !== null) {
      for (const part of m[1].split(',')) {
        const name = part.trim().split(/\s+as\s+/).pop().trim();
        if (/^[A-Za-z_$][\w$]*$/.test(name) && name !== 'default') names.add(name);
      }
    }

    // export as namespace Name  /  export = Name
    const nsRe = /\bexport\s+as\s+namespace\s+([A-Za-z_$][\w$]*)/g;
    while ((m = nsRe.exec(src)) !== null) names.add(m[1]);
    const assignRe = /\bexport\s*=\s*([A-Za-z_$][\w$]*)/g;
    while ((m = assignRe.exec(src)) !== null) names.add(m[1]);

    return [...names].sort();
  }

  /** Read direct dependency names declared in the project's package.json. */
  function directDeps(cwd) {
    const names = new Set();
    try {
      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
      for (const k of DEP_KEYS) {
        if (pkg[k] && typeof pkg[k] === 'object') {
          for (const n of Object.keys(pkg[k])) names.add(n);
        }
      }
    } catch (_) { /* no/invalid package.json → no deps */ }
    return [...names].sort();
  }

  function readJson(p) {
    try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; }
  }

  function isFile(p) {
    try { return fs.statSync(p).isFile(); } catch (_) { return false; }
  }

  /** `foo.js` → `foo.d.ts`, `foo.mjs` → `foo.d.mts`, `foo.cjs` → `foo.d.cts` (how TypeScript pairs them). */
  function declarationOf(rel) {
    const m = rel.match(/^(.*)\.(js|mjs|cjs)$/);
    if (!m) return rel;
    return `${m[1]}.d.${m[2] === 'js' ? 'ts' : m[2].replace('js', 'ts')}`;
  }

  /** Whether a `typesVersions` range key applies to the compiler version assumed above. */
  function rangeApplies(range) {
    if (range === '*') return true;
    const m = String(range).trim().match(/^>=?\s*(\d+)\.(\d+)/);
    if (!m) return false;
    const [maj, min] = [Number(m[1]), Number(m[2])];
    return maj < ASSUMED_TS[0] || (maj === ASSUMED_TS[0] && min <= ASSUMED_TS[1]);
  }

  /**
   * Where `typesVersions` sends a package-relative path: the first range that applies
   * and has a pattern matching it, as TypeScript does. The path itself when none does.
   */
  function applyTypesVersions(pkg, rel) {
    const tv = pkg && pkg.typesVersions;
    if (!tv || typeof tv !== 'object') return [rel];
    const want = rel.replace(/^\.\//, '');
    for (const range of Object.keys(tv)) {
      if (!rangeApplies(range) || !tv[range] || typeof tv[range] !== 'object') continue;
      const out = [];
      for (const pattern of Object.keys(tv[range])) {
        const targets = [].concat(tv[range][pattern]).filter((t) => typeof t === 'string');
        const star = pattern.indexOf('*');
        let captured = null;
        if (star === -1) {
          if (pattern.replace(/^\.\//, '') === want) captured = '';
        } else {
          const pre = pattern.slice(0, star).replace(/^\.\//, '');
          const post = pattern.slice(star + 1);
          if (want.startsWith(pre) && want.endsWith(post) && want.length >= pre.length + post.length) {
            captured = want.slice(pre.length, want.length - post.length);
          }
        }
        if (captured === null) continue;
        for (const t of targets) out.push(t.replace('*', captured));
      }
      if (out.length) return out;
    }
    return [rel];
  }

  /** The declaration (or, failing that, JS) paths a package.json `exports` map names for `subpath` ('.' is the root). */
  function exportsEntries(pkg, subpath = '.') {
    const ex = pkg && pkg.exports;
    if (!ex) return [];
    const out = [];
    const visit = (node, depth) => {
      if (node == null || depth > 6) return;
      if (typeof node === 'string') { out.push(node); return; }
      if (Array.isArray(node)) { for (const n of node) visit(n, depth + 1); return; }
      if (typeof node !== 'object') return;
      if ('types' in node) visit(node.types, depth + 1); // the `types` condition leads
      for (const k of Object.keys(node)) {
        if (k === 'types' || (k.startsWith('.') && k !== '.')) continue; // a subpath, not the root
        visit(node[k], depth + 1);
      }
    };
    const subpathMap = typeof ex === 'object' && !Array.isArray(ex) && Object.keys(ex).some((k) => k.startsWith('.'));
    if (subpathMap) visit(ex[subpath], 0);
    else if (subpath === '.') visit(ex, 0);
    return out;
  }

  /** `@scope/name` → `@types/scope__name`; `name` → `@types/name`. */
  function typesPackageName(dep) {
    return dep.startsWith('@') ? `@types/${dep.slice(1).replace('/', '__')}` : `@types/${dep}`;
  }

  /** Candidate declaration paths inside one package directory, best first. */
  function entryCandidates(pkg) {
    const out = [];
    const typesField = pkg.types || pkg.typings;
    if (typeof typesField === 'string') {
      out.push(...applyTypesVersions(pkg, typesField));
      out.push(path.join(typesField, 'index.d.ts')); // typesField may be a dir
    }
    for (const e of exportsEntries(pkg)) out.push(/\.d\.[cm]?ts$/.test(e) ? e : declarationOf(e));
    out.push(...applyTypesVersions(pkg, 'index.d.ts'));
    if (typeof pkg.main === 'string') out.push(declarationOf(pkg.main), pkg.main.replace(/\.(js|cjs|mjs)$/, '.d.ts'));
    return out;
  }

  function firstExisting(pkgDir, candidates) {
    for (const c of candidates) {
      const p = path.join(pkgDir, c);
      if (isFile(p) && p.startsWith(pkgDir)) return p;
    }
    return null;
  }

  /**
   * Resolve an installed dependency's version + entry `.d.ts` path.
   *
   * The package's own types come first — `types`/`typings`, the `exports` map's
   * `types` condition, `typesVersions`, `index.d.ts`, `main` — and then
   * `node_modules/@types/<dep>`, which is where an untyped package's declarations live.
   *
   * @returns {{ version: string|null, dtsPath: string|null, pkgDir: string, via: string|null }|null} null if not installed
   */
  function resolveEntry(cwd, dep) {
    const pkgDir = path.join(cwd, 'node_modules', dep);
    const pkg = readJson(path.join(pkgDir, 'package.json'));
    if (!pkg) return null;
    const version = typeof pkg.version === 'string' ? pkg.version : null;

    const own = firstExisting(pkgDir, entryCandidates(pkg));
    if (own) return { version, dtsPath: own, pkgDir, via: 'package' };

    const typesDir = path.join(cwd, 'node_modules', typesPackageName(dep));
    const typesPkg = readJson(path.join(typesDir, 'package.json'));
    if (typesPkg) {
      const theirs = firstExisting(typesDir, entryCandidates(typesPkg));
      if (theirs) return { version, dtsPath: theirs, pkgDir: typesDir, via: '@types' };
    }
    return { version, dtsPath: null, pkgDir, via: null }; // installed but untyped
  }

  /**
   * Where a relative re-export specifier lands on disk, inside `root`, or null.
   * `./x.js` and `./x.ts` are the declaration `./x.d.ts` (or `.d.cts`/`.d.mts`, in
   * the family of the file that names it); `./x` is `x.d.ts` or `x/index.d.ts`.
   */
  function resolveReexport(fromFile, spec, root) {
    const base = path.resolve(path.dirname(fromFile), spec);
    const fam = (fromFile.match(/\.d\.([cm]?ts)$/) || [null, 'ts'])[1];
    const stemmed = base.match(/^(.*)\.(?:js|mjs|cjs|ts|mts|cts)$/);
    let cands;
    if (/\.d\.[cm]?ts$/.test(base)) cands = [base];
    else if (stemmed) cands = [`${stemmed[1]}.d.${fam}`, `${stemmed[1]}.d.ts`, `${stemmed[1]}.d.mts`, `${stemmed[1]}.d.cts`];
    else cands = [`${base}.d.${fam}`, `${base}.d.ts`, `${base}.d.mts`, `${base}.d.cts`, path.join(base, `index.d.${fam}`), path.join(base, 'index.d.ts')];
    for (const c of cands) {
      if (c.startsWith(root + path.sep) && isFile(c)) return c;
    }
    return null;
  }

  /**
   * Where a bare re-export specifier lands: another installed package (`export * from
   * "types-ramda"`) or a subpath of the package itself (`export * from 'zustand/vanilla'`),
   * found the way Node finds them — up the node_modules chain from the file naming it.
   * @returns {{ file: string, root: string }|null}
   */
  function resolveBare(fromFile, spec) {
    const parts = spec.split('/');
    const name = spec.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
    const sub = spec.slice(name.length).replace(/^\//, '');
    let dir = path.dirname(fromFile);
    for (let i = 0; i < 24; i++) {
      const pkgDir = path.join(dir, 'node_modules', name);
      const pkg = readJson(path.join(pkgDir, 'package.json'));
      if (pkg) {
        let cands;
        if (!sub) cands = entryCandidates(pkg);
        else {
          cands = exportsEntries(pkg, './' + sub).map((e) => (/\.d\.[cm]?ts$/.test(e) ? e : declarationOf(e)));
          cands.push(`${sub}.d.ts`, path.join(sub, 'index.d.ts'), declarationOf(sub));
        }
        const file = firstExisting(pkgDir, cands);
        return file ? { file, root: pkgDir } : null;
      }
      const up = path.dirname(dir);
      if (up === dir) break;
      dir = up;
    }
    return null;
  }

  const EXPORT_STAR_RE = /\bexport\s*\*\s*(?:as\s+([A-Za-z_$][\w$]*)\s*)?from\s*(['"])([^'"\r\n]+)\2/g;

  /**
   * Every exported name of a library: its entry declaration file and the relative
   * `export * from` files behind it. A barrel (`export * from './external'`) holds no
   * names of its own, which is how zod and rxjs read as empty before (#990).
   *
   * `unread` counts what could not be enumerated — a re-export whose file is not there,
   * the read caps, and an `export =` whose members are not listed — so a caller can say
   * the list is partial instead of treating it as the whole.
   *
   * @returns {{ names: string[], parts: Array<[string, number]>, unread: number }}
   */
  function readDtsClosure(entryPath, root) {
    const names = new Set();
    const parts = [];
    const seen = new Set();
    const queue = [{ file: entryPath, root }];
    let unread = 0;
    let bytes = 0;
    while (queue.length) {
      const { file, root: pkgRoot } = queue.shift();
      if (seen.has(file)) continue;
      seen.add(file);
      if (parts.length >= MAX_PARTS || bytes >= MAX_PARTS_BYTES) { unread++; continue; }
      let src = '';
      let mtime = 0;
      try {
        const st = fs.statSync(file);
        mtime = st.mtimeMs;
        if (st.size > MAX_DTS_FILE_BYTES) { unread++; parts.push([file, mtime]); continue; }
        src = fs.readFileSync(file, 'utf8');
      } catch (_) { unread++; continue; }
      bytes += src.length;
      parts.push([file, mtime]);
      for (const n of extractDtsExports(src)) names.add(n);
      // `export = X` makes X's members the module's names, and X is a namespace or interface
      // whose members this extractor does not enumerate: the list is a floor, not the whole.
      if (/\bexport\s*=\s*[A-Za-z_$]/.test(src)) unread++;
      let m;
      EXPORT_STAR_RE.lastIndex = 0;
      while ((m = EXPORT_STAR_RE.exec(src)) !== null) {
        if (m[1]) names.add(m[1]); // export * as ns from '…'
        if (m[1]) continue; // its members are reached as ns.x, which is not a named import
        const spec = m[3];
        if (spec.startsWith('.')) {
          const target = resolveReexport(file, spec, pkgRoot);
          if (target) queue.push({ file: target, root: pkgRoot }); else unread++;
        } else {
          const target = resolveBare(file, spec);
          if (target) queue.push(target); else unread++;
        }
      }
    }
    return { names: [...names].sort(), parts, unread };
  }

  // ── Python ──────────────────────────────────────────────────────────────────

  /**
   * Extract exported symbol names from a Python module's `__init__.py`/`.pyi`.
   * Deterministic, regex-based, top-level only: `__all__`, `def`/`class`, public
   * module-level assignments, and `from … import …` re-exports (a package's
   * public API is largely re-exports). Private names (leading `_`) are skipped
   * unless listed in `__all__`.
   * @param {string} src
   * @returns {string[]} sorted unique exported names
   */
  function extractPyExports(src) {
    const names = new Set();
    if (!src) return [];

    // __all__ = [ 'a', 'b', ... ]  (authoritative when present; keeps privates)
    const allMatch = src.match(/^__all__\s*[:+]?=\s*[\[(]([\s\S]*?)[\])]/m);
    if (allMatch) {
      for (const m of allMatch[1].matchAll(/['"]([A-Za-z_]\w*)['"]/g)) names.add(m[1]);
    }

    // top-level def / class (column 0)
    for (const m of src.matchAll(/^(?:async\s+)?def\s+([A-Za-z_]\w*)/gm)) if (!m[1].startsWith('_')) names.add(m[1]);
    for (const m of src.matchAll(/^class\s+([A-Za-z_]\w*)/gm)) if (!m[1].startsWith('_')) names.add(m[1]);

    // top-level public assignments: NAME = …  /  NAME: type = …  (not ==, +=, etc.)
    for (const m of src.matchAll(/^([A-Za-z_]\w*)\s*(?::[^=\n]+)?=(?!=)/gm)) {
      if (!m[1].startsWith('_')) names.add(m[1]);
    }

    // re-exports: from .mod import Name, Other as Alias
    for (const m of src.matchAll(/^from\s+[^\n]+?\s+import\s+([^\n#]+)/gm)) {
      for (const part of m[1].split(',')) {
        const name = part.trim().replace(/[()]/g, '').split(/\s+as\s+/).pop().trim();
        if (/^[A-Za-z_]\w*$/.test(name) && !name.startsWith('_')) names.add(name);
      }
    }

    return [...names].sort();
  }

  /** Read direct Python dependency names from requirements.txt + pyproject.toml. */
  function pythonDirectDeps(cwd) {
    const names = new Set();
    try {
      const req = fs.readFileSync(path.join(cwd, 'requirements.txt'), 'utf8');
      for (const line of req.split('\n')) {
        const t = line.trim();
        if (!t || t.startsWith('#') || t.startsWith('-')) continue;
        const m = t.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)/);
        if (m) names.add(m[1]);
      }
    } catch (_) { /* none */ }
    try {
      const py = fs.readFileSync(path.join(cwd, 'pyproject.toml'), 'utf8');
      // PEP 621: [project] dependencies = ["foo>=1", "bar"]
      const projDeps = py.match(/^\s*dependencies\s*=\s*\[([\s\S]*?)\]/m);
      if (projDeps) for (const m of projDeps[1].matchAll(/['"]([A-Za-z0-9][A-Za-z0-9._-]*)/g)) names.add(m[1]);
      // Poetry: [tool.poetry.dependencies]\n foo = "^1"
      const poetry = py.match(/\[tool\.poetry\.dependencies\]([\s\S]*?)(?:\n\[|$)/);
      if (poetry) for (const m of poetry[1].matchAll(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s*=/gm)) {
        if (m[1] !== 'python') names.add(m[1]);
      }
    } catch (_) { /* none */ }
    return [...names].sort();
  }

  /** Locate the project's venv `site-packages` directories (no Python runtime). */
  function findSitePackages(cwd) {
    const out = [];
    for (const v of VENV_DIRS) {
      const base = path.join(cwd, v);
      const libDir = path.join(base, 'lib'); // POSIX: <venv>/lib/pythonX.Y/site-packages
      let pyDirs = [];
      try { pyDirs = fs.readdirSync(libDir).filter((d) => /^python\d/.test(d)).sort(); } catch (_) { /* none */ }
      for (const py of pyDirs) {
        const sp = path.join(libDir, py, 'site-packages');
        try { if (fs.statSync(sp).isDirectory()) out.push(sp); } catch (_) { /* next */ }
      }
      const winSp = path.join(base, 'Lib', 'site-packages'); // Windows
      try { if (fs.statSync(winSp).isDirectory()) out.push(winSp); } catch (_) { /* next */ }
    }
    return out;
  }

  /** PEP 503 name normalization (case-insensitive, `-`/`_`/`.` collapsed). */
  function normalizePy(name) {
    return String(name).toLowerCase().replace(/[-_.]+/g, '-');
  }

  /** Find an installed distribution's version from its `*.dist-info`/`*.egg-info`. */
  function findPyVersion(sitePkgsDir, dep) {
    const norm = normalizePy(dep);
    let entries;
    try { entries = fs.readdirSync(sitePkgsDir); } catch (_) { return null; }
    for (const e of entries.sort()) {
      const m = e.match(/^(.+?)-(\d[^-]*)\.(?:dist-info|egg-info)$/);
      if (m && normalizePy(m[1]) === norm) return m[2];
    }
    return null;
  }

  /**
   * Resolve a Python dependency to its installed module entry file + version.
   * @returns {{ version: string|null, sourcePath: string|null }|null} null if not installed
   */
  function resolvePyEntry(sitePkgsDirs, dep) {
    const candidates = [...new Set([dep, dep.replace(/-/g, '_'), dep.toLowerCase(), dep.toLowerCase().replace(/-/g, '_')])];
    for (const sp of sitePkgsDirs) {
      const version = findPyVersion(sp, dep);
      for (const cand of candidates) {
        for (const entry of ['__init__.pyi', '__init__.py']) { // package
          const p = path.join(sp, cand, entry);
          try { if (fs.statSync(p).isFile()) return { version, sourcePath: p }; } catch (_) { /* next */ }
        }
        for (const ext of ['.pyi', '.py']) { // single-module
          const p = path.join(sp, cand + ext);
          try { if (fs.statSync(p).isFile()) return { version, sourcePath: p }; } catch (_) { /* next */ }
        }
      }
    }
    return null;
  }

  /**
   * Build the installed-library signature index for `cwd`.
   *
   * @param {string} cwd
   * @param {object} [opts]
   * @param {string} [opts.version='0']  sigmap version, for cache busting
   * @param {boolean} [opts.cache=true]  use the on-disk sig-cache
   * @returns {{ symbols: Set<string>, libraries: Array<{name,version,symbols,typed,partial}>, count: number }}
   *   `partial` is present (true) only when a re-export behind the entry could not be read, so `symbols` is a floor
   */
  function buildLibraryIndex(cwd, opts = {}) {
    const version = opts.version || '0';
    const useCache = opts.cache !== false;

    // Collect entries from both ecosystems; each carries its extractor kind.
    const entries = []; // { name, version, sourcePath, kind: 'dts'|'py' }
    for (const dep of directDeps(cwd).slice(0, MAX_DEPS)) {
      const r = resolveEntry(cwd, dep);
      if (r) entries.push({ name: dep, version: r.version, sourcePath: r.dtsPath, pkgDir: r.pkgDir, kind: 'dts' });
    }
    const sitePkgs = findSitePackages(cwd);
    if (sitePkgs.length) {
      for (const dep of pythonDirectDeps(cwd).slice(0, MAX_DEPS)) {
        const r = resolvePyEntry(sitePkgs, dep);
        if (r) entries.push({ name: dep, version: r.version, sourcePath: r.sourcePath, kind: 'py' });
      }
    }

    const cache = useCache ? loadCache(cwd, version) : new Map();
    const files = entries.filter((e) => e.sourcePath && e.kind === 'py').map((e) => e.sourcePath);
    const { unchanged } = getChangedFiles(files, cache);
    const unchangedSet = new Set(unchanged);
    const mtimeOf = (p) => { try { return fs.statSync(p).mtimeMs; } catch (_) { return null; } };
    // A declaration entry is valid while every file it was read from is unchanged: a
    // barrel's names live in its children, so the entry file's own mtime says nothing (#990).
    const partsCurrent = (c, p) => !!c && Array.isArray(c.parts) && c.mtime === mtimeOf(p)
      && c.parts.every(([f, m]) => mtimeOf(f) === m);

    const symbols = new Set();
    const libraries = [];
    const fresh = [];

    let dirty = false;
    for (const e of entries) {
      let names;
      let unread = 0;
      if (!e.sourcePath) {
        names = [];
      } else if (e.kind === 'dts') {
        const hit = cache.get(e.sourcePath);
        if (useCache && partsCurrent(hit, e.sourcePath)) {
          names = hit.sigs || [];
          unread = hit.unread || 0;
        } else {
          const closure = readDtsClosure(e.sourcePath, e.pkgDir);
          names = closure.names;
          unread = closure.unread;
          cache.set(e.sourcePath, { mtime: mtimeOf(e.sourcePath), sigs: names, parts: closure.parts, unread });
          dirty = true;
        }
      } else if (unchangedSet.has(e.sourcePath) && cache.get(e.sourcePath)) {
        names = cache.get(e.sourcePath).sigs || [];
      } else {
        let src = '';
        try {
          if (fs.statSync(e.sourcePath).size <= MAX_DTS_BYTES) src = fs.readFileSync(e.sourcePath, 'utf8');
        } catch (_) { /* unreadable → empty */ }
        names = extractPyExports(src);
        fresh.push({ file: e.sourcePath, sigs: names });
      }
      for (const n of names) symbols.add(n);
      libraries.push({ name: e.name, version: e.version, symbols: names.length, typed: !!e.sourcePath, ...(unread > 0 ? { partial: true } : {}) });
    }

    if (useCache && (fresh.length || dirty)) {
      updateCacheEntries(cache, fresh);
      saveCache(cwd, version, cache);
    }

    libraries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
    return { symbols, libraries, count: symbols.size };
  }

  /** D8: render `name@version` pins for the typed/installed libraries. */
  function formatVersionPins(libraries) {
    return (libraries || [])
      .filter((l) => l.version)
      .map((l) => `${l.name}@${l.version}`);
  }

  /**
   * D8: collect `name@version` pins for direct dependencies — versions only, no
   * symbol extraction, no cache. Cheap enough to run on every context build so
   * the generated header can ground against what is actually installed (JS +
   * Python). Deterministic: sorted, then capped.
   * @param {string} cwd
   * @param {object} [opts]
   * @param {number} [opts.limit=40] max pins returned (after sort)
   * @returns {{ pins: string[], total: number }} pins capped to limit; total = all resolved
   */
  function collectVersionPins(cwd, opts = {}) {
    const limit = Number.isInteger(opts.limit) && opts.limit >= 0 ? opts.limit : 40;
    const pins = [];
    for (const dep of directDeps(cwd).slice(0, MAX_DEPS)) {
      const r = resolveEntry(cwd, dep);
      if (r && r.version) pins.push(`${dep}@${r.version}`);
    }
    const sitePkgs = findSitePackages(cwd);
    if (sitePkgs.length) {
      for (const dep of pythonDirectDeps(cwd).slice(0, MAX_DEPS)) {
        const r = resolvePyEntry(sitePkgs, dep);
        if (r && r.version) pins.push(`${dep}@${r.version}`);
      }
    }
    pins.sort();
    return { pins: limit ? pins.slice(0, limit) : pins, total: pins.length };
  }

  module.exports = {
    buildLibraryIndex, extractDtsExports, directDeps, resolveEntry, readDtsClosure, formatVersionPins,
    collectVersionPins,
    extractPyExports, pythonDirectDeps, findSitePackages, resolvePyEntry,
  };
  
};

// ── ./src/verify/parsers ──
__factories["./src/verify/parsers"] = function(module, exports) {
  
  /**
   * Parsers for the Hallucination Guard (verify-ai-output).
   *
   * Extract the verifiable claims an AI answer makes about a codebase:
   *   - file paths it references (POSIX or Windows separators)
   *   - import / require statements it shows — the module, and the names taken
   *     from it — in JS/TS, Python and Go
   *   - function / class symbols it calls or declares
   *   - fenced code blocks (so callers can scope checks to code vs prose)
   *
   * Everything here is deterministic and offline — pure string analysis.
   */

  // Extensions we are confident name a source/code/config file (no slash required).
  const KNOWN_CODE_EXT = new Set([
    'js', 'jsx', 'mjs', 'cjs', 'ts', 'tsx', 'py', 'pyw', 'rb', 'go', 'rs',
    'java', 'kt', 'swift', 'c', 'h', 'cpp', 'hpp', 'm', 'mm', 'cs', 'php', 'r',
    'vue', 'svelte', 'css', 'scss', 'less', 'html', 'json', 'yml', 'yaml',
    'toml', 'xml', 'sql', 'graphql', 'gql', 'proto', 'tf', 'md', 'sh',
    'gd', 'gdscript', 'ps1', 'psm1', 'psd1',
  ]);

  // Well-known "X.js" runtime/library product names — never repo files.
  const LIBRARY_TOKENS = new Set([
    'node.js', 'next.js', 'nuxt.js', 'vue.js', 'react.js', 'express.js', 'koa.js',
    'nest.js', 'three.js', 'd3.js', 'chart.js', 'ember.js', 'backbone.js',
    'angular.js', 'meteor.js', 'moment.js', 'anime.js', 'p5.js', 'next.config.js',
  ]);

  // Illustrative placeholder names the model writes in prose, not repo claims:
  // e.g. example.js, minimal-example.js, sample.ts, demo.js, placeholder.js.
  const PLACEHOLDER_RE = /(?:^|[-_.])(?:example|sample|demo|placeholder)(?:[-_.]|s?$)/i;
  // camelCase / Pascal placeholders: myExample.js, exampleConfig.js, fooSample.ts.
  // Requires a case boundary so ordinary words (resample.js) are NOT suppressed.
  const PLACEHOLDER_CAMEL_RE = /(?:^|[a-z])(?:Example|Sample|Demo|Placeholder)|(?:^|[-_.])(?:example|sample|demo|placeholder)(?=[A-Z])/;

  /**
   * Extract fenced code blocks.
   * @param {string} text
   * @returns {{ lang: string, content: string, line: number }[]}
   */
  function extractCodeBlocks(text) {
    const blocks = [];
    const lines = text.split('\n');
    let inBlock = false;
    let lang = '';
    let buf = [];
    let startLine = 0;
    for (let i = 0; i < lines.length; i++) {
      const m = lines[i].match(/^```(\w*)/);
      if (m) {
        if (!inBlock) {
          inBlock = true;
          lang = m[1] || '';
          buf = [];
          startLine = i + 2; // first content line (1-based)
        } else {
          blocks.push({ lang, content: buf.join('\n'), line: startLine });
          inBlock = false;
        }
        continue;
      }
      if (inBlock) buf.push(lines[i]);
    }
    return blocks;
  }

  /**
   * The fence language of every line: '' outside a fenced block, the lower-cased
   * info-string language inside one ('' for a bare fence is reported as 'text').
   * Lets a parser scope a claim shape to the block language that gives it meaning
   * — a Go `import "x"` is a package, a JS `import 'x'` a side-effect import.
   * @param {string[]} lines
   * @returns {string[]}
   */
  function fenceLanguages(lines) {
    const out = new Array(lines.length).fill('');
    let lang = null;
    for (let i = 0; i < lines.length; i++) {
      const m = lines[i].match(/^\s*```+\s*([\w+#.-]*)/);
      if (m) {
        lang = lang === null ? (m[1] || 'text').toLowerCase() : null;
        continue;
      }
      if (lang !== null) out[i] = lang;
    }
    return out;
  }

  /**
   * 1-based line of a character offset, via a precomputed table of line starts.
   * @param {string} text
   * @returns {(offset: number) => number}
   */
  function lineLocator(text) {
    const starts = [0];
    for (let i = 0; i < text.length; i++) if (text.charCodeAt(i) === 10) starts.push(i + 1);
    return (offset) => {
      let lo = 0;
      let hi = starts.length - 1;
      while (lo < hi) {
        const mid = (lo + hi + 1) >> 1;
        if (starts[mid] <= offset) lo = mid; else hi = mid - 1;
      }
      return lo + 1;
    };
  }

  // Fence languages in which a backslash is a path separator, not a string escape.
  const WINDOWS_FENCES = new Set(['bat', 'batch', 'cmd', 'dos', 'powershell', 'ps1', 'pwsh']);

  // A Windows-style repo path: `src\retrieval\ranker.js`. Every directory segment
  // needs two characters or more, which keeps a string escape (`a\nfile.txt`)
  // from reading as `a/nfile.txt`; an escaped `\\` and a drive-letter absolute
  // path never match, and neither can name a repo file. Like the POSIX form,
  // a dot-relative `.\lib\a.py` is not read — it is relative to an unknown file.
  const WINDOWS_PATH_RE = /(?:^|[\s`"'(\[<])([A-Za-z0-9_][\w.-]+(?:\\[A-Za-z0-9_.][\w.-]*)+\.[A-Za-z][A-Za-z0-9]*)(?![\w\\])/g;

  /**
   * Extract file-path references (deduped, first-seen line kept).
   * A token counts as a path when it has a `.<letter…>` extension AND
   * either contains a `/` or carries a known code/config extension. Windows
   * separators (`src\a\b.js`) are read too and reported with `/`, so one file is
   * one claim however the answer spells it.
   * @param {string} text
   * @returns {{ path: string, line: number }[]}
   */
  function extractFilePaths(text) {
    const lines = text.split('\n');
    const fences = fenceLanguages(lines);
    const seen = new Map();
    const re = /(?:^|[\s`"'(\[<])([A-Za-z0-9_][\w./-]*\.[A-Za-z][A-Za-z0-9]*)/g;
    const accept = (p, lineNo) => {
      if (/^https?:/i.test(p)) return;
      const ext = (p.split('.').pop() || '').toLowerCase();
      const hasSlash = p.includes('/');
      if (!hasSlash && !KNOWN_CODE_EXT.has(ext)) return;
      if (LIBRARY_TOKENS.has(p.toLowerCase())) return;
      const base = p.split('/').pop();
      if (PLACEHOLDER_RE.test(base) || PLACEHOLDER_CAMEL_RE.test(base)) return;
      if (!seen.has(p)) seen.set(p, lineNo);
    };
    for (let i = 0; i < lines.length; i++) {
      const line = lines[i];
      let m;
      re.lastIndex = 0;
      while ((m = re.exec(line)) !== null) accept(m[1], i + 1);

      if (line.indexOf('\\') === -1) continue;
      if (fences[i] && !WINDOWS_FENCES.has(fences[i])) continue; // a code string's escapes
      WINDOWS_PATH_RE.lastIndex = 0;
      while ((m = WINDOWS_PATH_RE.exec(line)) !== null) {
        const parts = m[1].split('\\');
        if (parts.slice(0, -1).some((seg) => seg.length < 2)) continue;
        // `dir\file` where the file starts with an escape letter (`tab\tsep.log`,
        // `line\nfile.txt`) is a string escape far more often than a path.
        if (parts.length === 2 && /^[ntrbfva0exu]/.test(parts[1])) continue;
        accept(parts.join('/'), i + 1);
      }
    }
    return [...seen.entries()].map(([p, line]) => ({ path: p, line }));
  }

  const IDENT = '[A-Za-z_$][\\w$]*';

  // import|export [type] <clause> from '<module>', where the clause is
  //   `D` · `{ a, b as c }` · `* as ns` · `D, { a }` · `D, * as ns`.
  // The braces may span lines (`[^{}]*` crosses newlines).
  const ESM_FROM_RE = new RegExp(
    '\\b(?:import|export)\\s+(?:type\\s+)?('
    + '(?:' + IDENT + '\\s*,\\s*)?\\{[^{}]*\\}'
    + '|(?:' + IDENT + '\\s*,\\s*)?\\*(?:\\s*as\\s+' + IDENT + ')?'
    + '|' + IDENT
    + ')\\s*from\\s*([\'"])([^\'"\\r\\n]+)\\2', 'g');

  // import 'x' — a side-effect import (a Go package inside a ```go fence).
  const SIDE_EFFECT_RE = /\bimport\s*(['"])([^'"\r\n]+)\1/g;

  // [const|let|var <binding> =] require('x') | import('x'). `\s*` crosses
  // newlines, so `require(\n  'x'\n)` and a destructuring split over lines read.
  const REQUIRE_RE = new RegExp(
    '(?:\\b(?:const|let|var)\\s+(\\{[^{}]*\\}|' + IDENT + ')\\s*=\\s*)?'
    + '\\b(?:require|import)\\s*\\(\\s*([\'"])([^\'"\\r\\n]+)\\2\\s*\\)', 'g');

  // Python: from x import y, z  |  from x import (\n y,\n z as w,\n)
  const PY_FROM_RE = /^[ \t]*from[ \t]+([.\w]+)[ \t]+import[ \t]+(\([^)]*\)|[^\n#;]+)/gm;

  // Python: import a.b as c, d — the WHOLE line, so a JS `import D, { a } from`
  // can never read as the module `D`.
  const PY_IMPORT_RE = /^[ \t]*import[ \t]+([A-Za-z_][\w.]*(?:[ \t]+as[ \t]+\w+)?(?:[ \t]*,[ \t]*[A-Za-z_][\w.]*(?:[ \t]+as[ \t]+\w+)?)*)[ \t]*(?:#.*)?$/gm;

  /** The names inside `{ a, b as c, type d }` / a CJS `{ a: b }` — the source names. */
  function braceNames(inner) {
    const names = [];
    const clean = inner.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
    for (let part of clean.split(',')) {
      part = part.trim().replace(/^(?:type|typeof)\s+/, '');
      const left = part.split(/\s+as\s+|\s*:\s*/)[0].trim();
      const id = left.match(/^[A-Za-z_$][\w$]*/);
      if (id && id[0] !== 'default') names.push(id[0]);
    }
    return names;
  }

  /** The names of a Python `import` clause; `*` is a wildcard, not a name. */
  function pyNames(clause) {
    const names = [];
    let wildcard = false;
    const clean = clause.replace(/[()]/g, ' ').replace(/#[^\n]*/g, '');
    for (const part of clean.split(/[,\n]/)) {
      const left = part.trim().split(/\s+as\s+/)[0].trim();
      if (left === '*') wildcard = true;
      else if (/^[A-Za-z_]\w*$/.test(left)) names.push(left);
    }
    return { names, wildcard };
  }

  /**
   * Extract import / require statements, with the names each takes from its
   * module (#672, #909).
   *
   * Reads, per language:
   *   JS/TS   `import D, { a, b as c } from 'x'` (braces may span lines),
   *           `import type`, `export { a } from`, `export * from`, `import 'x'`,
   *           `const { a, b } = require('x')` (and across lines), `require(\n'x'\n)`
   *   Python  `from x import a, b`, `from x import (\n a,\n b as c,\n)`, `import a.b as c`
   *   Go      `import "p"`, `import alias "p"` and `import ( … )` — inside a
   *           ```go / ```golang fence only, so prose is never read as a package
   *
   * `names` lists the bindings taken by name — never a default, a namespace or a
   * wildcard, which cannot be checked against a module's members (`wildcard`
   * records that one was there).
   *
   * @param {string} text
   * @returns {{ module: string, kind: 'js'|'py'|'go', relative: boolean, line: number, raw: string, names: string[], wildcard: boolean }[]}
   */
  function extractImports(text) {
    const lines = text.split('\n');
    const fences = fenceLanguages(lines);
    const lineOf = lineLocator(text);
    const byKey = new Map();
    const add = (module, kind, offsetOrLine, extra) => {
      if (!module) return;
      const line = extra && extra.atLine ? offsetOrLine : lineOf(offsetOrLine);
      const key = `${kind}|${module}|${line}`;
      const names = (extra && extra.names) || [];
      const wildcard = !!(extra && extra.wildcard);
      const prior = byKey.get(key);
      if (prior) {
        for (const n of names) if (!prior.names.includes(n)) prior.names.push(n);
        prior.wildcard = prior.wildcard || wildcard;
        return;
      }
      byKey.set(key, {
        module,
        kind,
        relative: kind !== 'go' && /^[./]/.test(module),
        line,
        raw: (lines[line - 1] || '').trim(),
        names: names.slice(),
        wildcard,
      });
    };
    const langAt = (offset) => fences[lineOf(offset) - 1] || '';

    let m;
    // JS/TS: import|export … from 'x'
    ESM_FROM_RE.lastIndex = 0;
    while ((m = ESM_FROM_RE.exec(text)) !== null) {
      const clause = m[1];
      const braces = clause.match(/\{([^{}]*)\}/);
      add(m[3], 'js', m.index, {
        names: braces ? braceNames(braces[1]) : [],
        wildcard: /\*/.test(clause),
      });
    }
    // JS side-effect import 'x' — a Go package inside a ```go fence, handled below.
    SIDE_EFFECT_RE.lastIndex = 0;
    while ((m = SIDE_EFFECT_RE.exec(text)) !== null) {
      if (/^(?:go|golang)$/.test(langAt(m.index))) continue;
      add(m[2], 'js', m.index);
    }
    // require('x') / dynamic import('x'), with an optional destructuring binding.
    REQUIRE_RE.lastIndex = 0;
    while ((m = REQUIRE_RE.exec(text)) !== null) {
      const binding = m[1];
      add(m[3], 'js', m.index, { names: binding && binding.startsWith('{') ? braceNames(binding.slice(1, -1)) : [] });
    }

    // Python: from x import …  |  import x
    PY_FROM_RE.lastIndex = 0;
    while ((m = PY_FROM_RE.exec(text)) !== null) {
      add(m[1], 'py', m.index, pyNames(m[2]));
    }
    PY_IMPORT_RE.lastIndex = 0;
    while ((m = PY_IMPORT_RE.exec(text)) !== null) {
      for (const part of m[1].split(',')) {
        const mod = part.trim().split(/\s+as\s+/)[0].trim();
        add(mod, 'py', m.index);
      }
    }

    // Go: only inside a go fence — `import "p"`, `import a "p"`, `import ( … )`.
    let inGoBlock = false;
    for (let i = 0; i < lines.length; i++) {
      if (!/^(?:go|golang)$/.test(fences[i])) { inGoBlock = false; continue; }
      const line = lines[i];
      if (inGoBlock) {
        if (/^\s*\)/.test(line)) { inGoBlock = false; continue; }
        const spec = line.match(/^\s*(?:[\w.]+\s+)?"([^"\n]+)"/);
        if (spec) add(spec[1], 'go', i + 1, { atLine: true });
        continue;
      }
      if (/^\s*import\s*\(\s*(?:\/\/.*)?$/.test(line)) { inGoBlock = true; continue; }
      const one = line.match(/^\s*import\s+(?:[\w.]+\s+)?"([^"\n]+)"/);
      if (one) add(one[1], 'go', i + 1, { atLine: true });
    }

    return [...byKey.values()].sort((a, b) => a.line - b.line);
  }

  /**
   * Extract npm/pnpm/yarn script invocations (`npm run <name>`).
   * Only the explicit `run` form is matched, to avoid confusing package-manager
   * subcommands (`yarn add`, `pnpm install`) with script names.
   * @param {string} text
   * @returns {{ name: string, line: number }[]}
   */
  function extractNpmScripts(text) {
    const lines = text.split('\n');
    const out = [];
    const seen = new Set();
    const re = /\b(?:npm|pnpm|yarn)\s+run(?:-script)?\s+([A-Za-z0-9:_-]+)/g;
    for (let i = 0; i < lines.length; i++) {
      let m;
      re.lastIndex = 0;
      while ((m = re.exec(lines[i])) !== null) {
        const name = m[1];
        if (seen.has(name)) continue;
        seen.add(name);
        out.push({ name, line: i + 1 });
      }
    }
    return out;
  }

  // `name(…)`, `name<T>(…)`, `name::<T>(…)` — a backticked call, optionally generic.
  // A declaration (`def f(`, `function f(`) is deliberately NOT read: it names an
  // existing symbol in an answer that describes code but proposes one in a plan.
  // It was also unsafe while a symbol was judged by a capped index — a reference
  // doc's `def clear(domain)` for a real method past the cut flagged as fake
  // (measured on httpx: 3 of 3, #909). #914 makes that verdict sound; reading
  // declarations stays a separate, measured widening of the claim set.
  const SYMBOL_RE = new RegExp('`(' + IDENT + ')(?:::<[^`<>()]*>|<[^`<>()]*>)?\\s*\\([^`]*\\)`', 'g');

  // Words that precede a parenthesis without naming a callee.
  const NOT_A_CALLEE = new Set([
    'if', 'for', 'while', 'switch', 'catch', 'return', 'function', 'func', 'def',
    'fn', 'fun', 'class', 'new', 'typeof', 'sizeof', 'await', 'yield', 'throw',
    'else', 'do', 'with', 'elif', 'lambda', 'assert', 'sub',
  ]);

  /**
   * Extract function/class symbol references that look like calls. Restricted to
   * backtick-wrapped calls (`foo(...)`, `foo<T>(...)`) for high precision; a
   * keyword before a parenthesis (`if (x)`, `func (r *T) F()`) is not a callee.
   * @param {string} text
   * @returns {{ name: string, line: number }[]}
   */
  function extractSymbols(text) {
    const lines = text.split('\n');
    const out = [];
    const seen = new Set();
    for (let i = 0; i < lines.length; i++) {
      let m;
      SYMBOL_RE.lastIndex = 0;
      while ((m = SYMBOL_RE.exec(lines[i])) !== null) {
        const name = m[1];
        if (NOT_A_CALLEE.has(name)) continue;
        const key = name + '@' + (i + 1);
        if (seen.has(key)) continue;
        seen.add(key);
        out.push({ name, line: i + 1 });
      }
    }
    return out;
  }

  module.exports = {
    extractCodeBlocks,
    extractFilePaths,
    extractImports,
    extractSymbols,
    extractNpmScripts,
  };
  
};

// ── ./src/verify/source-confirm ──
__factories["./src/verify/source-confirm"] = function(module, exports) {
  
  /**
   * Source-confirmed symbols (#914, closes #910).
   *
   * `fake-symbol` asked one question — "is this name in the symbol index?" — and the
   * index is a lossy summary of the repository: a file keeps `maxIndexSigsPerFile` (200,
   * and 25 before #982) signatures, only the files under the detected source roots are in it, and an
   * extractor lists only the constructs it knows. A real symbol outside it was
   * reported as fabricated (#910: httpx's `Cookies.extract_cookies`, 1,100 lines into
   * a file whose index entry stops at 25). Measured over 35 repositories' own docs,
   * 42% of the names `verify` flagged were defined in the checkout: 32% in files the
   * index does not hold, 7% in an indexed file the extractor did not list, 3% past
   * the cap.
   *
   * This asks the question the index only approximates, of the source itself, and
   * only of the names that would otherwise be flagged. A name is CONFIRMED when a
   * call or a definition form of it occurs in the code of some file of the checkout
   * — never the bare word, so prose cannot confirm it:
   *
   *   name(   name<T>(           a call, or a definition head
   *   name = (…   name: function   a function-valued binding, typed or not
   *   def|func|fn|fun|class|… [<T>] name   a keyword definition
   *   export const name   exports.name =   an exported binding, function-shaped or not
   *
   * Comments and strings are blanked first (`scan.js` / `call-graph.js` maskers, by
   * language family), so `// call clear() to reset`, a docstring or a SQL string
   * confirms nothing. This is the standard `judge` already applies to the context
   * (`hasStrongEvidence`, #909), turned on the source.
   *
   * It is a NECESSARY-condition check in the same spirit as #909's named-import
   * check: a name that is called or defined nowhere cannot be a real symbol of the
   * repository, so it stays flagged; a name that is called or defined somewhere is
   * not a fabrication, whether the repo or a library it uses owns it. Measured on 20,171
   * mutated names (a swapped letter, a suffix, a prefix) none was confirmed.
   *
   * Bounded and deterministic: nothing is read when there is nothing to confirm; the
   * walk is sorted, the indexed files come first, and a budget on bytes and files —
   * never a clock — ends it, so two runs agree. A name not confirmed within the
   * budget stays flagged exactly as before. Languages whose comments the maskers do
   * not read (Lua, PowerShell, SQL, markup) are not scanned.
   *
   * Zero dependencies, offline.
   */

  const fs = require('fs');
  const path = require('path');
  const { DEFAULTS } = __require('./src/config/defaults');

  /** A file larger than this is generated or vendored, never hand-written source. */
  const MAX_FILE_BYTES = 1500000;
  /** Total text read in one confirmation. The largest of 12 repositories measured held 27 MB of code. */
  const MAX_SCAN_BYTES = 64 * 1024 * 1024;
  /** Files read in one confirmation. */
  const MAX_SCAN_FILES = 25000;
  const MAX_DEPTH = 24;

  /** Trees that are somebody else's code, on top of the generator's own `exclude`. */
  const EXTRA_EXCLUDE = ['venv', 'site-packages', 'third_party', 'Pods', 'Carthage', 'bower_components'];

  const JS_FAMILY = new Set(['javascript', 'typescript', 'typescript_react', 'vue_sfc', 'svelte', 'astro']);
  const C_FAMILY = new Set(['java', 'kotlin', 'go', 'csharp', 'cpp', 'objc', 'php', 'swift', 'dart', 'scala']);
  const HASH_FAMILY = new Set(['python', 'ruby', 'elixir', 'gdscript', 'r', 'shell']);
  /** Languages with a multi-line `"""` text block (Dart also `'''`). */
  const TEXT_BLOCK_FAMILY = new Set(['java', 'kotlin', 'csharp', 'swift', 'dart', 'scala']);

  const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');

  /**
   * The patterns that confirm one name. Case-sensitive, whole-identifier.
   * @param {string} name
   * @returns {RegExp[]}
   */
  function symbolForms(name) {
    const id = escapeRe(name);
    const start = '(?<![\\w$])';
    const end = '(?![\\w$])';
    return [
      new RegExp(start + id + '\\s*(?:<[^<>()\\n]{0,80}>)?\\s*\\('),
      new RegExp(start + id + '\\s*(?::[^=;\\n]{1,80}=|<-|=|:)\\s*(?:async\\s+)?(?:function\\b|lambda\\b|\\\\?\\(|[\\w$]+\\s*=>)'),
      new RegExp(start + '(?:def|defp|defmacro|defmodule|function\\*?|func|fn|fun|sub|class|struct|interface|trait|enum|type|object|module|protocol|record)\\s+(?:<[^>\\n]*>\\s*)?(?:\\([^)\\n]*\\)\\s*)?(?:[\\w$.]+\\.)?' + id + end),
      new RegExp(start + '(?:export\\s+(?:default\\s+)?(?:declare\\s+)?(?:const|let|var)\\s+|(?:module\\.)?exports\\.)' + id + end),
    ];
  }

  /** Directory and file names the walk never enters: the generator's `exclude`, its own additions, and the project's. */
  function excludedNames(cwd) {
    const names = new Set([...DEFAULTS.exclude, ...EXTRA_EXCLUDE]);
    try {
      const cfg = JSON.parse(fs.readFileSync(path.join(cwd, 'gen-context.config.json'), 'utf8'));
      if (cfg && Array.isArray(cfg.exclude)) for (const n of cfg.exclude) if (typeof n === 'string') names.add(n);
    } catch (_) { /* no project config, or an unreadable one: the defaults stand */ }
    return names;
  }

  let _tools = null;
  /** Loaded on first use: a `verify` with nothing to confirm never pays for the extractors or the maskers. */
  function tools() {
    if (!_tools) {
      const { langFor } = __require('./src/extractors/dispatch');
      const { maskCode } = __require('./src/extractors/scan');
      const { maskPy, maskRust } = __require('./src/graph/call-graph');
      _tools = { langFor, maskCode, maskPy, maskRust };
    }
    return _tools;
  }

  /**
   * `maskCode` reads `"""` as an empty string and then a one-line one, which leaves
   * the body of a text block to be searched as code. Blank the whole block first —
   * length- and newline-preserving, like every masker here.
   */
  function blankTextBlocks(text, lang) {
    const re = lang === 'dart' ? /"""[\s\S]*?"""|'''[\s\S]*?'''/g : /"""[\s\S]*?"""/g;
    return text.replace(re, (block) => block.replace(/[^\n]/g, ' '));
  }

  /**
   * The masker for a source file, or null when its language is not one whose
   * comments and strings can be blanked (markup, data, Lua, PowerShell, SQL, …).
   * @param {string} rel repo-relative path
   * @returns {((text: string) => string)|null}
   */
  function maskerFor(rel) {
    const { langFor, maskCode, maskPy, maskRust } = tools();
    const lang = langFor(rel);
    if (!lang) return null;
    if (lang === 'rust') return maskRust;
    if (JS_FAMILY.has(lang)) return (t) => maskCode(t, { js: true });
    if (C_FAMILY.has(lang)) {
      return TEXT_BLOCK_FAMILY.has(lang) ? (t) => maskCode(blankTextBlocks(t, lang)) : (t) => maskCode(t);
    }
    if (HASH_FAMILY.has(lang)) return maskPy;
    return null;
  }

  /** A minified bundle defines and calls everything; it says nothing about the repository's own symbols. */
  const MINIFIED_RE = /\.min\.[cm]?js$|\.generated\.|\.pb\.|_pb\./;

  /**
   * Every source file of the checkout, sorted, minus excluded and dot directories.
   * Symlinks are not followed.
   * @param {string} cwd
   * @param {Set<string>} exclude
   * @returns {string[]} repo-relative, forward-slashed
   */
  function listSourceFiles(cwd, exclude) {
    const out = [];
    const walk = (dirRel, depth) => {
      if (depth > MAX_DEPTH) return;
      let entries;
      try { entries = fs.readdirSync(dirRel ? path.join(cwd, dirRel) : cwd, { withFileTypes: true }); } catch (_) { return; }
      entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
      for (const e of entries) {
        if (exclude.has(e.name)) continue;
        const rel = dirRel ? dirRel + '/' + e.name : e.name;
        if (e.isDirectory()) {
          if (!e.name.startsWith('.')) walk(rel, depth + 1);
        } else if (e.isFile() && !MINIFIED_RE.test(e.name) && maskerFor(rel)) {
          out.push(rel);
        }
      }
    };
    walk('', 0);
    return out;
  }

  /**
   * Which of `names` are called or defined in the source.
   *
   * @param {string} cwd  repo root
   * @param {Iterable<string>} names  identifiers an answer or a plan cites as symbols
   * @param {object} [opts]
   * @param {string[]} [opts.priority]  repo-relative files to read first — the indexed ones
   * @param {Iterable<string>} [opts.exclude]  names the walk skips (default: the generator's `exclude` plus the project's)
   * @param {number} [opts.maxBytes]
   * @param {number} [opts.maxFiles]
   * @returns {{ confirmed: Map<string, string>, files: number, bytes: number, truncated: boolean }}
   *   `confirmed` maps each confirmed name to the first file that confirmed it
   */
  function confirmSymbols(cwd, names, opts = {}) {
    const want = [...new Set(names || [])];
    const result = { confirmed: new Map(), files: 0, bytes: 0, truncated: false };
    if (!want.length) return result;

    const maxBytes = opts.maxBytes != null ? opts.maxBytes : MAX_SCAN_BYTES;
    const maxFiles = opts.maxFiles != null ? opts.maxFiles : MAX_SCAN_FILES;
    const exclude = opts.exclude ? new Set(opts.exclude) : excludedNames(cwd);

    // The indexed files first — they are where a name is most likely defined — then
    // the rest of the checkout, in sorted order so the budget always ends in the same place.
    const first = [...new Set(opts.priority || [])].filter((rel) => maskerFor(rel)).sort();
    const seen = new Set(first);
    const order = first.concat(listSourceFiles(cwd, exclude).filter((rel) => !seen.has(rel)));

    const forms = new Map(want.map((n) => [n, symbolForms(n)]));
    for (const rel of order) {
      if (result.confirmed.size === want.length) break;
      if (result.files >= maxFiles || result.bytes >= maxBytes) { result.truncated = true; break; }
      let text;
      try {
        const abs = path.join(cwd, rel);
        if (fs.statSync(abs).size > MAX_FILE_BYTES) continue;
        text = fs.readFileSync(abs, 'utf8');
      } catch (_) { continue; }
      result.files++;
      result.bytes += text.length;

      // Cheap first: only a file that mentions a name still wanted is worth masking.
      const pending = want.filter((n) => !result.confirmed.has(n) && text.includes(n));
      if (!pending.length) continue;
      const masked = maskerFor(rel)(text);
      for (const n of pending) {
        if (forms.get(n).some((re) => re.test(masked))) result.confirmed.set(n, rel);
      }
    }
    return result;
  }

  module.exports = { confirmSymbols, symbolForms, listSourceFiles, excludedNames, MAX_FILE_BYTES, MAX_SCAN_BYTES, MAX_SCAN_FILES };
  
};

// ── ./src/wiki/generate ──
__factories["./src/wiki/generate"] = function(module, exports) {
  
  /**
   * Wiki generation (D9) — `sigmap wiki`.
   *
   * Deterministic architecture narrative composed from data SigMap already
   * computes: the signature index, the dependency graph, conventions, and the
   * health score. Template prose only — no LLM, no network, no timestamps —
   * so two runs on an unchanged repo produce byte-identical markdown.
   */

  const fs = require('fs');
  const path = require('path');
  const { displayPath } = __require('./src/graph/path-key');

  const HUB_LIMIT = 8;
  const ENTRY_LIMIT = 8;
  const MODULE_LIMIT = 20;
  const KEY_FILE_LIMIT = 3;

  // Graph keys come from src/graph/builder's normalizePath (normalized +
  // lowercased). `realPaths` (carried on the graph) restores the original case;
  // without it we still relativize case-insensitively rather than climbing out.
  function _rel(cwd, f, realPaths) {
    return displayPath(f, cwd, realPaths);
  }

  function _pct(fraction) {
    return Math.round(fraction * 100);
  }

  /** Project name + version from package.json, falling back to the dir name. */
  function _identity(cwd) {
    try {
      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
      if (pkg && pkg.name) return { name: pkg.name, version: pkg.version || null };
    } catch (_) {}
    return { name: path.basename(cwd), version: null };
  }

  /** Module rollup from the signature index (keys are cwd-relative paths). */
  function _modules(index) {
    const groups = new Map();
    let totalTokens = 0;
    for (const [rel, sigs] of index.entries()) {
      const parts = String(rel).replace(/\\/g, '/').split('/');
      const mod = parts.length > 1 ? parts[0] : '.';
      const tokens = Math.ceil((sigs || []).join('\n').length / 4);
      totalTokens += tokens;
      if (!groups.has(mod)) groups.set(mod, { name: mod, files: 0, tokens: 0, fileSigs: [] });
      const g = groups.get(mod);
      g.files++;
      g.tokens += tokens;
      g.fileSigs.push({ file: rel, sigCount: (sigs || []).length });
    }
    const modules = [...groups.values()]
      .sort((a, b) => b.tokens - a.tokens || a.name.localeCompare(b.name))
      .slice(0, MODULE_LIMIT)
      .map((g) => ({
        name: g.name,
        files: g.files,
        tokens: g.tokens,
        keyFiles: g.fileSigs
          .sort((a, b) => b.sigCount - a.sigCount || a.file.localeCompare(b.file))
          .slice(0, KEY_FILE_LIMIT)
          .map((f) => f.file),
      }));
    return { modules, totalTokens };
  }

  /** Hubs, entry points, and cycle count from the dependency graph. */
  function _flow(cwd) {
    try {
      const { buildFromCwd } = __require('./src/graph/builder');
      const { detectCycles } = __require('./src/map/import-graph');
      const graph = buildFromCwd(cwd);
      if (!graph || !graph.forward || graph.forward.size === 0) return null;

      const importersOf = (f) => (graph.reverse.get(f) || []).length;
      const realPaths = graph.realPaths;
      const hubs = [...graph.reverse.entries()]
        .map(([f, importers]) => ({ file: _rel(cwd, f, realPaths), importers: importers.length }))
        .filter((h) => h.importers > 0)
        .sort((a, b) => b.importers - a.importers || a.file.localeCompare(b.file))
        .slice(0, HUB_LIMIT);

      const entryPoints = [...graph.forward.entries()]
        .filter(([f, deps]) => deps.length > 0 && importersOf(f) === 0)
        .map(([f, deps]) => ({ file: _rel(cwd, f, realPaths), imports: deps.length }))
        .sort((a, b) => b.imports - a.imports || a.file.localeCompare(b.file))
        .slice(0, ENTRY_LIMIT);

      let cycles = 0;
      try { cycles = detectCycles(graph.forward).length; } catch (_) {}

      return { hubs, entryPoints, cycles, edges: graph.forward.size };
    } catch (_) {
      return null;
    }
  }

  /** Conventions summary; index keys are resolved back to absolute paths. */
  function _conventions(cwd, index) {
    try {
      const { extractConventions } = __require('./src/conventions/extract');
      const files = [...index.keys()].map((rel) => path.join(cwd, rel));
      const c = extractConventions(cwd, files);
      return {
        fileNaming: c.fileNaming
          ? { dominant: c.fileNaming.dominant, pct: _pct(c.fileNaming.dominantPct || 0), tier: c.fileNaming.tier }
          : null,
        exportStyle: c.exportStyle
          ? { dominant: c.exportStyle.dominant, pct: _pct(c.exportStyle.dominantPct || 0), tier: c.exportStyle.tier }
          : null,
        testFramework: c.testFramework || null,
      };
    } catch (_) {
      return null;
    }
  }

  function _health(cwd) {
    try {
      const { score } = __require('./src/health/scorer');
      const h = score(cwd);
      return { score: h.score, grade: h.grade };
    } catch (_) {
      return null;
    }
  }

  /** The MCP tools the wiki's "Navigating" section points an agent at. */
  const WIKI_MCP_TOOLS = ['get_architecture_overview', 'get_map', 'get_callee_signatures'];

  /**
   * Build the wiki. Every data source is optional — a repo with no context file
   * or no resolvable graph still yields a valid document.
   * @param {string} cwd
   * @param {object} [opts]
   * @param {string} [opts.version] SigMap version stamped in the header
   * @param {object} [opts.config] the loaded config; when given, the MCP tools the wiki recommends
   *        are limited to the ones this project's server advertises (`mcp.tools`, #966)
   * @returns {{ data: object, markdown: string }}
   */
  function buildWiki(cwd, opts = {}) {
    let index = new Map();
    try {
      const { buildSigIndex } = __require('./src/retrieval/ranker');
      index = buildSigIndex(cwd);
    } catch (_) {}

    const identity = _identity(cwd);
    const { modules, totalTokens } = _modules(index);
    const flow = _flow(cwd);
    const conventions = index.size ? _conventions(cwd, index) : null;
    const health = _health(cwd);

    const data = {
      name: identity.name,
      version: identity.version,
      files: index.size,
      modules,
      totalTokens,
      flow,
      conventions,
      health,
    };

    let mcpTools;
    if (opts.config) {
      try {
        const profile = __require('./src/mcp/profile');
        const resolved = profile.resolveProfile(opts.config);
        mcpTools = WIKI_MCP_TOOLS.filter((n) => profile.has(resolved, n));
      } catch (_) { mcpTools = undefined; }
    }

    return { data, markdown: renderWikiMarkdown(data, opts.version, mcpTools) };
  }

  /**
   * Render the narrative markdown. Pure function of `data` — no clocks, no
   * randomness — so output is byte-stable for a fixed repo state.
   * @param {object} data
   * @param {string} [sigmapVersion]
   * @param {string[]} [mcpTools] the MCP tools to recommend (default: all three the wiki knows)
   * @returns {string}
   */
  function renderWikiMarkdown(data, sigmapVersion, mcpTools) {
    const L = [];
    const title = data.version ? `${data.name} v${data.version}` : data.name;
    L.push(`# ${title} — Architecture Wiki`);
    L.push('');
    L.push(`_Deterministically generated from signatures + dependency graph by SigMap${sigmapVersion ? ` v${sigmapVersion}` : ''} — no LLM. Regenerate: \`sigmap wiki\`._`);
    L.push('');

    L.push('## Overview');
    if (data.files === 0) {
      L.push('No signature index found yet — run `sigmap` (or `node gen-context.js`) to generate context, then regenerate this wiki.');
    } else {
      const fileWord = data.files === 1 ? 'indexed file' : 'indexed files';
      const modWord = data.modules.length === 1 ? 'top-level module' : 'top-level modules';
      L.push(`The codebase spans **${data.files} ${fileWord}** across **${data.modules.length} ${modWord}**, with ~${data.totalTokens} tokens of extracted signatures.`);
      if (data.health) {
        L.push(`Context health: **${data.health.score}/100 (${data.health.grade})**.`);
      }
    }
    L.push('');

    if (data.modules.length) {
      L.push('## Modules');
      L.push('| Module | Files | Sig tokens | Key files |');
      L.push('|--------|-------|------------|-----------|');
      for (const m of data.modules) {
        L.push(`| \`${m.name}\` | ${m.files} | ~${m.tokens} | ${m.keyFiles.map((f) => `\`${f}\``).join(', ')} |`);
      }
      const top = data.modules[0];
      L.push('');
      L.push(`The largest module by signature volume is \`${top.name}\` (${top.files} files, ~${top.tokens} tokens) — start there for the core logic.`);
      L.push('');
    }

    if (data.flow) {
      L.push('## Dependency flow');
      if (data.flow.hubs.length) {
        L.push('The most depended-on files — changes here have the widest blast radius:');
        L.push('');
        L.push('| Hub file | Importers |');
        L.push('|----------|-----------|');
        for (const h of data.flow.hubs) L.push(`| \`${h.file}\` | ${h.importers} |`);
        L.push('');
      }
      if (data.flow.entryPoints.length) {
        L.push('Entry points (imported by nothing, importing the rest):');
        L.push('');
        for (const e of data.flow.entryPoints) L.push(`- \`${e.file}\` → ${e.imports} imports`);
        L.push('');
      }
      L.push(data.flow.cycles
        ? `**Dependency cycles:** ${data.flow.cycles} — untangle these first when refactoring.`
        : '**Dependency cycles:** none detected.');
      L.push('');
    }

    if (data.conventions) {
      L.push('## Conventions');
      const c = data.conventions;
      const bits = [];
      if (c.fileNaming && c.fileNaming.dominant) bits.push(`file naming is predominantly **${c.fileNaming.dominant}** (${c.fileNaming.pct}%, ${c.fileNaming.tier})`);
      if (c.exportStyle && c.exportStyle.dominant) bits.push(`exports use the **${c.exportStyle.dominant}** style (${c.exportStyle.pct}%, ${c.exportStyle.tier})`);
      if (c.testFramework) bits.push(`tests run on **${c.testFramework}**`);
      L.push(bits.length
        ? `In this repo, ${bits.join('; ')}. New code should match.`
        : 'No dominant conventions detected (repo too small or styles mixed).');
      L.push('');
    }

    L.push('## Navigating');
    L.push('- `sigmap ask "<question>"` — ranked, budgeted mini-context for any task');
    L.push('- `sigmap --impact <file>` / `--callers <symbol>` — blast radius before you change something');
    L.push('- `sigmap evidence "<query>"` — machine-consumable Evidence Pack (JSON) for agents/CI');
    const mcp = Array.isArray(mcpTools) ? mcpTools : WIKI_MCP_TOOLS;
    if (mcp.length > 0) L.push(`- MCP: ${mcp.map((n) => `\`${n}\``).join(', ')} for live agent access`);
    L.push('');

    return L.join('\n');
  }

  module.exports = { buildWiki, renderWikiMarkdown };
  
};

// ── ./src/workspace/detector ──
__factories["./src/workspace/detector"] = function(module, exports) {
  
  const fs   = require('fs');
  const path = require('path');
  module.exports = { detectWorkspaces, inferPackage, scopeToPackage };

  function detectWorkspaces(cwd) {
    const pkgPath = path.join(cwd, 'package.json');
    if (!fs.existsSync(pkgPath)) return [];

    let pkg;
    try {
      pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
    } catch {
      return [];
    }

    const patterns = pkg.workspaces || [];
    const dirs = [];

    // Handle both flat array and object with packages field (Yarn v2 format)
    const patternArray = Array.isArray(patterns) ? patterns : (patterns.packages || []);

    for (const p of patternArray) {
      const base = p.replace(/\/\*\*?$/, '');
      const resolved = path.join(cwd, base);
      if (fs.existsSync(resolved)) {
        try {
          for (const entry of fs.readdirSync(resolved, { withFileTypes: true })) {
            if (entry.isDirectory()) dirs.push(path.join(resolved, entry.name));
          }
        } catch (_) {}
      }
    }

    return dirs;
  }

  // Infer package from query tokens: "add rate limiting to payments" → "packages/payments"
  function inferPackage(query, workspaceDirs, cwd) {
    const tokens = query.toLowerCase().split(/\W+/).filter(t => t.length > 2);

    // Find longest matching package name
    let bestMatch = null;
    let bestLen = 0;
    let bestMatchLen = 0;

    for (const dir of workspaceDirs) {
      const name = path.basename(dir).toLowerCase();
      for (const token of tokens) {
        const matchLen = _getMatchLength(name, token);
        // Only consider matches; use longest match, and break ties by longest package name
        if (matchLen > 0 && (matchLen > bestLen || (matchLen === bestLen && name.length > bestMatchLen))) {
          bestMatch = dir;
          bestLen = matchLen;
          bestMatchLen = name.length;
        }
      }
    }

    return bestMatch;
  }

  function _getMatchLength(name, token) {
    if (name === token) return 1000 + name.length;  // Exact match is best
    if (name.startsWith(token) && token.length >= 3) return 100 + token.length;
    if (token.startsWith(name) && name.length >= 3) return name.length;
    return 0;
  }

  // Return boost multiplier for files inside the inferred package
  function scopeToPackage(filePath, packageDir) {
    const normalized = filePath.replace(/\\/g, '/');
    const normalizedPkg = packageDir.replace(/\\/g, '/');

    // Ensure we match the directory boundary, not just a prefix
    // e.g., packages/payment should not match packages/payment-old
    if (normalized.startsWith(normalizedPkg)) {
      const afterPrefix = normalized.slice(normalizedPkg.length);
      // Check if next char is / or if it's the exact match
      if (afterPrefix === '' || afterPrefix[0] === '/') {
        return 0.30;
      }
    }
    return 0;
  }
  
};

// ═══ END SIGMAP BUNDLED MODULES ═══

const fs = require('fs');
const path = require('path');
const os = require('os');

// Shell-free subprocess helpers. execFileSync runs the binary directly (never
// /bin/sh), so there is no shell-injection surface and no "Shell access"
// capability for supply-chain scanners. stderr is discarded by default.
function __git(args, opts = {}) {
  const { execFileSync } = require('child_process');
  return execFileSync('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], ...opts });
}
function __tryGit(args, opts = {}) {
  try { return __git(args, opts).toString().trim(); }
  catch (_) { return ''; }
}

// Write a whole document to a file descriptor before the process exits. When
// stdout is a pipe, process.stdout.write returns after the first 64 KB and
// queues the rest, and process.exit() then discards what is still queued — a
// large `--json` document reached `jq` cut off mid-string (#998). A synchronous
// write that retries a full pipe has delivered every byte before the next line
// runs. Same shape as scripts/lib/write-sync.mjs, which fixed this for the
// benchmark gates.
function writeAll(fd, text) {
  const buf = Buffer.from(text);
  const pause = new Int32Array(new SharedArrayBuffer(4));
  for (let off = 0; off < buf.length;) {
    try {
      off += fs.writeSync(fd, buf, off);
    } catch (e) {
      if (e.code === 'EPIPE') return; // the reader closed early (`| head`): nothing is left to deliver
      if (e.code !== 'EAGAIN') throw e;
      Atomics.wait(pause, 0, 0, 1); // the pipe is full: give the reader a moment to drain it
    }
  }
}

const VERSION = '8.85.0';
// A module resolves to the same thing for the life of the process, and this is asked for in per-file loops
// (thousands of calls a run), so the answer is kept: each call used to cost a filesystem probe.
const __sourceOrBundled = new Map();
function requireSourceOrBundled(key) {
  if (__sourceOrBundled.has(key)) return __sourceOrBundled.get(key);
  let mod;
  try {
    const rel = key.replace(/^\.\//, '') + '.js';
    const abs = path.join(__dirname, rel);
    if (fs.existsSync(abs)) mod = require(abs);
  } catch (_) {}
  if (mod === undefined) mod = __require(key);
  __sourceOrBundled.set(key, mod);
  return mod;
}

// ---------------------------------------------------------------------------
// Config — delegate to src/config/loader.js
// ---------------------------------------------------------------------------
const { loadConfig } = requireSourceOrBundled('./src/config/loader');
const { DEFAULTS } = requireSourceOrBundled('./src/config/defaults');

// ---------------------------------------------------------------------------
// Language → extractor mapping (by file extension)
// ---------------------------------------------------------------------------
// Resolution delegates to src/extractors/dispatch.js — the single source of
// truth (#591). A CLI-local copy of this map had drifted: it lacked .lua,
// .gd, and .ex, silently sending those languages to the generic fallback in
// the generate pipeline while their extractors passed every direct test.
// Deleted rather than patched (#538).
const { EXT_MAP } = requireSourceOrBundled('./src/extractors/dispatch');

// Dockerfile handled separately (no extension)
function isDockerfile(filename) {
  return filename === 'Dockerfile' || filename.startsWith('Dockerfile.');
}

// ---------------------------------------------------------------------------
// .contextignore parser (gitignore-style subset)
// ---------------------------------------------------------------------------
// One definition (src/util/ignore.js), shared with the watcher, freshen and the
// notify hooks: they must apply the filter a full run applies.
function loadIgnorePatterns(cwd) {
  return requireSourceOrBundled('./src/util/ignore').loadIgnorePatterns(cwd);
}

function matchesIgnore(relPath, patterns) {
  return requireSourceOrBundled('./src/util/ignore').matchesIgnore(relPath, patterns);
}

// ---------------------------------------------------------------------------
// File walker
// ---------------------------------------------------------------------------
function walkDir(dir, exclude, maxDepth, depth = 0) {
  if (depth > maxDepth) return [];
  let results = [];
  let entries;
  try {
    entries = requireSourceOrBundled('./src/util/dir-listing').list(dir);
  } catch (_) {
    return [];
  }
  // Sort by name so the collected file list — and therefore the output section
  // order — is deterministic. Raw readdir order is filesystem-dependent and can
  // vary run to run, making the generated context non-byte-stable.
  entries.sort((a, b) => a.name.localeCompare(b.name));
  for (const entry of entries) {
    if (exclude.includes(entry.name)) continue;
    const full = path.join(dir, entry.name);
    if (entry.isDirectory()) {
      results = results.concat(walkDir(full, exclude, maxDepth, depth + 1));
    } else if (entry.isFile()) {
      results.push(full);
    }
  }
  return results;
}

function buildFileList(cwd, config) {
  const files = [];
  for (const srcDir of config.srcDirs) {
    const abs = path.join(cwd, srcDir);
    if (!fs.existsSync(abs)) continue;
    const found = walkDir(abs, config.exclude, config.maxDepth);
    // A loop, not `push(...found)`: spread passes every path as a call
    // argument, and past ~125k files that overflows the stack (#855).
    for (const f of found) files.push(f);
  }
  files.push(...declaredEntrypoints(cwd, config, files));
  // A declared entrypoint that is generated or ignored is not source even when srcDirs
  // reached it, and repeats the modules it was built from (#876).
  const kept = __skippedEntrypoints.size ? files.filter((f) => !__skippedEntrypoints.has(f)) : files;
  // Deduplicate
  return [...new Set(kept)];
}

/**
 * Source files a project declares as its own entrypoints in package.json
 * (`main` and every `bin` target), when they live outside srcDirs.
 *
 * A CLI's entrypoint is usually at the repo root, so a srcDirs of [src] left
 * it unindexed and therefore unreachable by `sigmap ask` — on this repo that
 * was gen-context.js, which holds the whole generator pipeline. Declared
 * entrypoints are load-bearing by definition, so they are always scanned.
 */
function collectTestEntries(cwd, config, existing, xcache) {
  // #825: the roots come from the shared primitive, so `validate`/`doctor`
  // cannot classify as stale a file this collector deliberately indexed.
  const { testRootDirs } = requireSourceOrBundled('./src/analysis/index-state');
  const have = new Set((existing || []).map((e) => e.filePath));
  const out = [];
  let moduleDocSig = null;
  try { ({ moduleDocSig } = requireSourceOrBundled('./src/retrieval/module-doc')); } catch (_) {}
  for (const root of testRootDirs(cwd)) {
    const abs = path.join(cwd, root);
    if (!fs.existsSync(abs)) continue;
    let files = [];
    try { files = walkDir(abs, config.exclude, config.maxDepth); } catch (_) { continue; }
    // Look at every candidate first, so that what the extraction cache does not hold is extracted
    // after one batched python3 process, not one per file; the results keep the walk's order.
    // A file the cache holds by its stat is not read at all.
    const xc = xcache ? requireSourceOrBundled('./src/cache/extract-cache') : null;
    // A Python file served from the cache never starts the AST tier, yet a cold run's header names it.
    const restoreLabel = (f) => {
      if (!/\.pyw?$/i.test(f)) return;
      try { requireSourceOrBundled('./src/extractors/python').restoreToolchain(xcache.toolchain); } catch (_) { /* label only */ }
    };
    const slots = [];
    const pending = [];
    for (const fp of files) {
      if (have.has(fp)) continue;
      const slot = { fp, src: '', sigs: null, doc: null, key: null, hash: null, st: null };
      if (xcache) {
        slot.key = 't:' + path.relative(cwd, fp).replace(/\\/g, '/');
        try { slot.st = fs.statSync(fp); } catch (_) { continue; }
        const hit = xcache.peek(slot.key, slot.st, 'g');
        if (hit) { slot.sigs = hit.s.slice(); slot.doc = hit.g; slots.push(slot); restoreLabel(fp); continue; }
      }
      try { slot.src = fs.readFileSync(fp, 'utf8'); } catch (_) { continue; }
      if (xcache) {
        slot.hash = xc.contentHash(slot.src);
        const hit = xcache.get(slot.key, slot.hash, slot.st);
        if (hit) {
          slot.sigs = hit.s.slice();
          if (hit.g === undefined && hit.s.length > 0) xcache.update(hit, { g: moduleDocSig ? (moduleDocSig(slot.src, fp) || '') : '' });
          slot.doc = hit.g;
          restoreLabel(fp);
        }
      }
      slots.push(slot);
      if (!slot.sigs) pending.push(slot);
    }
    if (pending.length > 0) {
      prefetchPythonAst(pending.map((p) => p.fp));
      const { extractFile } = requireSourceOrBundled('./src/extractors/dispatch');
      for (const p of pending) {
        try { p.sigs = extractFile(p.fp, p.src) || []; } catch (_) { p.sigs = null; continue; }
        if (xcache) {
          p.doc = p.sigs.length > 0 && moduleDocSig ? (moduleDocSig(p.src, p.fp) || '') : '';
          // Not kept when the AST tier failed on the file: the next run asks python3 again.
          const degraded = /\.pyw?$/i.test(p.fp) && requireSourceOrBundled('./src/extractors/python').wasDegraded(p.fp);
          if (!degraded) xcache.set(p.key, p.hash, p.sigs.length > 0 ? { s: p.sigs.slice(), g: p.doc } : { s: [] }, { size: p.st.size, mtimeMs: p.st.mtimeMs });
        }
      }
    }
    for (const slot of slots) {
      const { fp, sigs } = slot;
      if (!sigs || !sigs.length) continue;
      const doc = typeof slot.doc === 'string' ? slot.doc : (moduleDocSig ? moduleDocSig(slot.src, fp) : '');
      out.push({ filePath: fp, sigs: doc ? [doc, ...sigs] : sigs });
    }
  }
  return out;
}

/**
 * CI / pipeline definitions, which live OUTSIDE srcDirs by construction.
 *
 * v8.50.0 shipped the pipeline extractor but not this: `.github/workflows/` is
 * a root dotdir, never in `srcDirs` and never auto-detected as a source root,
 * so the generate pipeline never handed a workflow to the extractor. The
 * extractor was correct and unreachable — "where does deploy happen" returned
 * nothing on a real repo, which is the exact question it was built to answer.
 *
 * Same treatment as `collectTestEntries`: indexed so `sigmap ask` can reach
 * them, never rendered into the prompt artifact, so the generated context file
 * stays byte-identical for everyone who was not asking for this.
 *
 * @param {string} cwd
 * @param {object} config
 * @param {Array<{filePath:string}>} existing - entries already collected
 * @returns {Array<{filePath:string, sigs:string[]}>}
 */
function collectPipelineEntries(cwd, config, existing) {
  // Directories whose contents are CI definitions, plus the root itself for
  // the single-file forms (.gitlab-ci.yml, Jenkinsfile, compose files, …).
  // Shared with the index classifier for the same reason as TEST_ROOTS (#825).
  const { CI_DIRS } = requireSourceOrBundled('./src/analysis/index-state');
  const have = new Set((existing || []).map((e) => e.filePath));
  const out = [];
  const seen = new Set();

  let platformFor = null;
  let extractPipeline = null;
  try {
    const pipe = requireSourceOrBundled('./src/extractors/pipeline');
    platformFor = pipe.platformFor;
    extractPipeline = pipe.extract;
  } catch (_) { return out; }

  for (const dir of CI_DIRS) {
    const abs = path.join(cwd, dir);
    let names = [];
    try {
      if (!fs.statSync(abs).isDirectory()) continue;
      names = fs.readdirSync(abs).sort();
    } catch (_) { continue; }

    for (const name of names) {
      const fp = path.join(abs, name);
      try { if (!fs.statSync(fp).isFile()) continue; } catch (_) { continue; }
      if (have.has(fp) || seen.has(fp)) continue;

      // The extractor's own routing decides what counts as a pipeline file,
      // so this list cannot drift from `langFor`.
      const rel = path.relative(cwd, fp).replace(/\\/g, '/');
      if (!platformFor(rel)) continue;

      let src = '';
      try { src = fs.readFileSync(fp, 'utf8'); } catch (_) { continue; }
      let sigs = [];
      try { sigs = extractPipeline(src, rel) || []; } catch (_) { continue; }
      if (!sigs.length) continue;

      seen.add(fp);
      out.push({ filePath: fp, sigs });
    }
  }
  return out;
}

// Declared entrypoints left out of the index, and why (absolute path → reason), as of
// the last `declaredEntrypoints` call — what `sigmap explain` reports for them (#876).
const __skippedEntrypoints = new Map();

/** The first `head` and last `tail` bytes of a file as text, or null when it cannot be read. */
function readFileEnds(file, head, tail) {
  let fd;
  try {
    fd = fs.openSync(file, 'r');
    const size = fs.fstatSync(fd).size;
    const a = Buffer.alloc(Math.min(head, size));
    fs.readSync(fd, a, 0, a.length, 0);
    const b = Buffer.alloc(Math.min(tail, size));
    fs.readSync(fd, b, 0, b.length, size - b.length);
    return { head: a.toString('utf8'), tail: b.toString('utf8') };
  } catch (_) {
    return null;
  } finally {
    if (fd !== undefined) { try { fs.closeSync(fd); } catch (_) { /* already closed */ } }
  }
}

function declaredEntrypoints(cwd, config, existing) {
  const out = [];
  __skippedEntrypoints.clear();
  try {
    const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
    const have = new Set(existing);
    const ignorePatterns = loadIgnorePatterns(cwd);
    const refs = [];
    if (typeof pkg.main === 'string') refs.push(pkg.main);
    if (typeof pkg.bin === 'string') refs.push(pkg.bin);
    else if (pkg.bin && typeof pkg.bin === 'object') refs.push(...Object.values(pkg.bin).filter((v) => typeof v === 'string'));
    for (const ref of refs) {
      const abs = path.resolve(cwd, ref);
      const rel = path.relative(cwd, abs);
      if (!rel || rel.startsWith('..')) continue;                       // outside the repo
      if ((config.exclude || []).some((x) => rel.split(path.sep).includes(x))) continue;
      if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) continue;
      // Judged BEFORE the "already walked" test: with srcDirs ['.'] a bundle is
      // walked like any file, and is still not source (#876).
      const relPosix = rel.split(path.sep).join('/');
      if (matchesIgnore(relPosix, ignorePatterns)) { __skippedEntrypoints.set(abs, 'matched .contextignore'); continue; }
      const ends = readFileEnds(abs, 4096, 512);
      const why = _fileClass().generatedReason(relPosix, ends && ends.head, ends && ends.tail);
      if (why) { __skippedEntrypoints.set(abs, why); continue; }
      if (have.has(abs) || out.includes(abs)) continue;
      out.push(abs);
    }
  } catch (_) { /* no package.json, or unreadable → nothing to add */ }
  return out;
}

// ---------------------------------------------------------------------------
// Extractor loader (lazy, cached)
// ---------------------------------------------------------------------------
const _extractorCache = {};
function getExtractor(name) {
  if (_extractorCache[name]) return _extractorCache[name];
  try {
    const mod = requireSourceOrBundled(`./src/extractors/${name}`);
    _extractorCache[name] = mod;
    return mod;
  } catch (err) {
    console.warn(`[sigmap] failed to load extractor ${name}: ${err.message}`);
    return null;
  }
}

// Version of the repo-local typescript used for native extraction this run,
// or null when the regex tier served every file. Read by the adapter-output
// step so the generated header states the toolchain (determinism honesty:
// byte-stability holds per toolchain version, #609).
let _nativeTsVersion = null;

// All host-toolchain labels for this run (native TS + any LSP servers that
// actually served), rendered into the generated header's meta line.
function _toolchainLabel() {
  const parts = [];
  if (_nativeTsVersion) parts.push('typescript@' + _nativeTsVersion);
  // The Python AST tier runs by default whenever python3 is on PATH (#693), so
  // the same tree extracts differently on a host without it: label it (#970).
  try {
    const pyLabel = requireSourceOrBundled('./src/extractors/python').toolchainLabel();
    if (pyLabel) parts.push(pyLabel);
  } catch (_) {}
  try {
    const lspx = requireSourceOrBundled('./src/extractors/lsp_symbols');
    parts.push(...lspx.toolchainLabels());
  } catch (_) {}
  try {
    const scipx = requireSourceOrBundled('./src/extractors/scip_symbols');
    parts.push(...scipx.toolchainLabels());
  } catch (_) {}
  return parts.length ? parts.join(', ') : undefined;
}

// One python3 process per chunk of the run's Python files, not one per file
// (#970). Answers are kept by the extractor and read back by detectAndExtract;
// any failure leaves the per-file path in place.
function prefetchPythonAst(files) {
  try {
    requireSourceOrBundled('./src/extractors/python').prefetch(files);
  } catch (_) { /* the per-file path still works */ }
}

// Repo-relative paths of the files SigMap itself writes, per project root.
const __ownOutputs = new Map();

/**
 * Content with SigMap's own generated block left out, or '' when the whole file is
 * one (#993). A run that indexes the file the previous run wrote is not a fixed
 * point: the second map describes the first, the third describes the second, and
 * the section count moves with it (gin: 118 files, then 119). A human-owned file
 * (CLAUDE.md, AGENTS.md) keeps the lines above the managed section; an adapter's
 * output that is entirely generated is dropped.
 */
function withoutOwnOutput(content, rel, cwd) {
  if (typeof content !== 'string' || content === '') return content;
  const ms = requireSourceOrBundled('./src/util/managed-section');
  if (!__ownOutputs.has(cwd)) __ownOutputs.set(cwd, generatedOutputPaths(cwd, {}));
  if (__ownOutputs.get(cwd).has(rel) && ms.isEntirelyGenerated(content.slice(0, 400))) return '';
  if (!content.includes(ms.HEADING)) return content;
  const section = ms.findManagedSection(content);
  if (!section || !(section.stamped || ms.looksGenerated(content, section.index))) return content;
  return content.slice(0, ms.managedSectionLineStart(content));
}

function detectAndExtract(filePath, content, maxSigsPerFile, exactness, cwd) {
  const absFilePath = path.resolve(cwd || process.cwd(), filePath);
  const base = path.basename(filePath);
  content = withoutOwnOutput(content, path.relative(cwd || process.cwd(), absFilePath).replace(/\\/g, '/'), cwd || process.cwd());
  if (content === '') return [];

  // CI/pipeline definitions route by PATH before the extension map (#3, v8.50):
  // `.github/workflows/ci.yml` is a workflow first and YAML second. An empty
  // result falls through to the generic tier below, so a malformed pipeline
  // degrades to the old key scan rather than to nothing.
  try {
    const pipe = requireSourceOrBundled('./src/extractors/pipeline');
    if (pipe.platformFor(filePath)) {
      const pipeSigs = pipe.extract(content, filePath);
      if (Array.isArray(pipeSigs) && pipeSigs.length > 0) return pipeSigs.slice(0, maxSigsPerFile);
    }
  } catch (_) { /* fall through to the extension map */ }

  const ext = path.extname(base).toLowerCase();
  let extractorName = EXT_MAP[ext] || null;
  if (!extractorName && isDockerfile(base)) extractorName = 'dockerfile';
  // Feature 7: generic fallback — catches Nix, Elixir, Gleam, Zig, Go templates, etc.
  if (!extractorName) extractorName = 'generic';

  // T2 exactness (#609, opt-in): parse .ts with the target repo's own
  // typescript package when the flag is on and one resolves. Any failure —
  // no package, broken package, parse error — falls through to the regex
  // tier below, byte-identical to the flag being off.
  if (extractorName === 'typescript' && exactness && exactness.typescript) {
    try {
      const native = requireSourceOrBundled('./src/extractors/typescript_native');
      const resolved = native.resolveRepoTypescript(filePath);
      if (resolved) {
        const sigs = native.extract(content, filePath, resolved.ts);
        if (Array.isArray(sigs) && sigs.length > 0) {
          _nativeTsVersion = resolved.version;
          return sigs.slice(0, maxSigsPerFile);
        }
      }
    } catch (_) {}
  }

  // T4 spike (#618, opt-in): a CI-produced SCIP index at the repo root is
  // compiler-grade signatures already on disk — free at extraction time.
  // Same per-file quality guard as the LSP tier: never lose surface vs regex.
  if (exactness && exactness.scip) {
    try {
      const scipx = requireSourceOrBundled('./src/extractors/scip_symbols');
      const out = scipx.extractViaScip(filePath, cwd);
      if (out && Array.isArray(out.sigs) && out.sigs.length > 0) {
        const extractor = getExtractor(extractorName);
        const regexSigs = extractor ? (extractor.extract(content, absFilePath) || []) : [];
        if (out.sigs.length >= regexSigs.length) {
          scipx.acceptLabel(out.label);
          return out.sigs.slice(0, maxSigsPerFile);
        }
      }
    } catch (_) {}
  }

  // T3 spike (#612, opt-in): LSP documentSymbol via a server the machine
  // already has (clangd/gopls/rust-analyzer + config overrides). Cached per
  // content hash + server binary; any failure falls through to regex.
  if (exactness && exactness.lsp) {
    try {
      const lspx = requireSourceOrBundled('./src/extractors/lsp_symbols');
      const out = lspx.extractViaLsp(filePath, content, exactness.lspServers, cwd);
      if (out && Array.isArray(out.sigs) && out.sigs.length > 0) {
        // Quality guard (#612 finding): a server parsing a file standalone can
        // be macro-blind — clangd saw 7 of fmt/format.h's hundreds of symbols
        // because FMT_BEGIN_NAMESPACE never expanded — so the LSP result is
        // accepted only when it does not LOSE surface vs the regex tier.
        // Ties go to LSP: exact anchors. Measured: libuv (C) 943 vs 867 for
        // regex; fmt 45 vs 698, correctly refused per file by this guard.
        const extractor = getExtractor(extractorName);
        const regexSigs = extractor ? (extractor.extract(content, absFilePath) || []) : [];
        if (out.sigs.length >= regexSigs.length) {
          lspx.acceptLabel(out.label);
          return out.sigs.slice(0, maxSigsPerFile);
        }
      }
    } catch (_) {}
  }

  const extractor = getExtractor(extractorName);
  if (!extractor) return [];

  try {
    const sigs = extractor.extract(content, absFilePath);
    return Array.isArray(sigs) ? sigs.slice(0, maxSigsPerFile) : [];
  } catch (err) {
    console.warn(`[sigmap] extractor failed for ${filePath}: ${err.message}`);
    return [];
  }
}

function extractFileDeps(filePath, content, config) {
  if (config && config.depMap === false) return [];
  try {
    const { extractPythonDeps, extractTSDeps, extractRDeps, extractElixirDeps, extractLuaDeps, extractJavaDeps } = requireSourceOrBundled('./src/extractors/deps');
    const ext = path.extname(filePath).toLowerCase();
    if (ext === '.py' || ext === '.pyw') return extractPythonDeps(content);
    if (['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext)) return extractTSDeps(content);
    if (ext === '.r') return extractRDeps ? extractRDeps(content) : [];
    if (ext === '.ex' || ext === '.exs') return extractElixirDeps ? extractElixirDeps(content) : [];
    // Java/Kotlin had no mapping at all, so a file importing jackson showed
    // nothing while the POM beside it declared jackson. `.lua` was worse:
    // extractLuaDeps existed and was exported, but nothing ever called it.
    if (['.java', '.kt', '.kts'].includes(ext)) return extractJavaDeps ? extractJavaDeps(content) : [];
    if (ext === '.lua') return extractLuaDeps ? extractLuaDeps(content) : [];
  } catch (_) {}
  return [];
}

function extractSignatureName(sig) {
  const s = (sig || '').trim();
  const m = s.match(/(?:def|function|func|constructor|async\s+def|async\s+function)?\s*([A-Za-z_][A-Za-z0-9_]*)\s*\(/);
  return m ? m[1] : '';
}

function annotateCoverage(sigs, testIndex, enabled) {
  if (!enabled || !testIndex || testIndex.size === 0) return sigs;
  const { isTested } = requireSourceOrBundled('./src/extractors/coverage');
  return sigs.map((sig) => {
    const name = extractSignatureName(sig);
    if (!name) return sig;
    // Skip non-callable/type declarations.
    if (/^(class|interface|enum|type|module|trait|struct|record)\b/.test(sig.trim())) return sig;
    return `${sig}  ${isTested(name, testIndex) ? '✓' : '✗'}`;
  });
}

// ---------------------------------------------------------------------------
// Token budget enforcement
// ---------------------------------------------------------------------------
// Deterministic recency boost for recently-committed files so the token budget
// doesn't drop them first. Previously this used `Date.now()`, which encoded the
// (alphabetical) processing order as a monotonically increasing mtime — but on
// repos where nearly every file is "recently changed", consecutive files often
// landed on the *same* millisecond. Which files shared a millisecond (and so
// fell through to the filePath tie-break instead of sorting by a distinct
// mtime) shifted run to run, swapping which files survived at the budget cutoff
// and making the output non-byte-stable. A monotonic integer counter preserves
// the exact processing-order ranking Date.now() produced — recent files stay
// ahead of non-recent ones, ordered among themselves by walk order — but is
// collision-free and reproducible. RECENT_MTIME_BASE sits far above any real
// filesystem mtime (ms since epoch ≈ 1.7e12) so boosted files always out-rank
// non-boosted ones, and far below MAX_SAFE_INTEGER so the counter never
// overflows. Call nextRecentMtime() once per boosted file, in walk order. (#440)
const RECENT_MTIME_BASE = 1e15;
let _recentMtimeSeq = 0;
function nextRecentMtime() {
  return RECENT_MTIME_BASE + (_recentMtimeSeq++);
}

function estimateTokens(str) {
  return Math.ceil(str.length / 4);
}

// The budget drop-order and the retrieval penalty (src/retrieval/ranker.js)
// classify the same files and MUST agree. They previously kept independent
// copies of these predicates and the ranker's was strictly weaker, so
// `routes_test.go` was dropped-last-correctly by the budget yet never demoted
// by the ranker (#808). Both now resolve through one module; the definitions
// live in src/util/file-class.js and the history is documented there.
let __fileClassMod = null;
function _fileClass() {
  if (!__fileClassMod) __fileClassMod = requireSourceOrBundled('./src/util/file-class');
  return __fileClassMod;
}

function isTestFile(filePath) {
  return _fileClass().isTestFile(filePath);
}

function isConfigFile(filePath) {
  return /\.(config|conf)\.[a-z]+$/.test(filePath) ||
    path.extname(filePath) === '.json';
}

function isGeneratedFile(filePath) {
  return _fileClass().isGeneratedFile(filePath);
}

function isMockFile(filePath) {
  return _fileClass().isMockFile(filePath);
}

// The application entry point is the single most orientation-valuable file in
// a repo, yet it is often tiny (a main class with 2-3 signatures), so the
// fewest-sigs tie-break dropped it while keeping bulkier files: petclinic's
// budget dropped PetClinicApplication.java and an agent asking for the startup
// entry point could not reach it at all (#592). Deliberately narrow — bare
// main/app/application names plus the Spring `*Application.java` and C#
// `Program.cs` conventions. `index.*` is excluded: JS barrel files are hubs,
// not entry points, and protecting every one would crowd out real code.
function isEntryPointFile(filePath) {
  const base = path.basename(filePath.replace(/\\/g, '/'));
  return /^(main|app|application|__main__)\.[a-z]+$/i.test(base)
    || /Application\.(java|kt|kts)$/.test(base)
    || /^Program\.cs$/.test(base);
}

/**
 * Compute the effective token budget based on repo size and config.
 *
 * Formula:
 *   totalSigTokens  = sum of estimated tokens for all extracted sig blocks
 *   needed          = ceil(totalSigTokens * coverageTarget)   // tokens for target% coverage
 *   hardCap         = floor(modelContextLimit * maxTokensHeadroom)
 *   effective       = clamp(needed, 4000, hardCap)
 *
 * When autoMaxTokens is false the configured maxTokens is returned unchanged.
 *
 * @param {Array}  fileEntries - All file entries BEFORE budget enforcement
 * @param {object} config
 * @returns {number} effective token budget
 */
/**
 * True when the project pinned `maxTokens` and auto-scaling replaced it (#783).
 *
 * Requires `_userKeys` provenance from `loadConfig`: `config.maxTokens` is the
 * MERGED value, so comparing it alone cannot tell a pinned 500 from the shipped
 * default 6000 — which is why the old notice fired on repos that had never set
 * a budget, claiming a default as "your config".
 */
function _pinnedBudgetOverridden(config, effectiveMaxTokens) {
  if (!config || config.autoMaxTokens === false) return false;
  if (!Array.isArray(config._userKeys) || !config._userKeys.includes('maxTokens')) return false;
  return effectiveMaxTokens !== config.maxTokens;
}

function computeEffectiveMaxTokens(fileEntries, config) {
  if (config.autoMaxTokens === false) return config.maxTokens;

  const coverageTarget    = (config.coverageTarget    != null) ? config.coverageTarget    : 0.80;
  // #688: a declared model roster can lower the limit to its smallest window
  // (never raise it); an explicit modelContextLimit always wins.
  const __ctxLimit        = requireSourceOrBundled('./src/config/models').contextLimit(config);
  const modelContextLimit = __ctxLimit.limit;
  const maxTokensHeadroom = (config.maxTokensHeadroom != null) ? config.maxTokensHeadroom : 0.20;

  const totalSigTokens = fileEntries.reduce(
    (s, e) => s + estimateTokens((e.sigs || []).join('\n')), 0
  );
  if (totalSigTokens === 0) return config.maxTokens;

  const hardCap  = Math.floor(modelContextLimit * maxTokensHeadroom);
  const needed   = Math.ceil(totalSigTokens * coverageTarget);
  const MIN      = 4000;
  const effective = Math.min(Math.max(MIN, needed), hardCap);

  // Warn when repo is so large the hard cap prevents hitting the coverage target
  if (needed > hardCap) {
    const estimatedCovPct = Math.round((hardCap / totalSigTokens) * 100);
    const targetPct       = Math.round(coverageTarget * 100);
    if (estimatedCovPct < targetPct - 10) {
      console.warn(
        `[sigmap] auto-budget: ${fileEntries.length} files need ~${Math.round(needed / 1000)}K tokens ` +
        `for ${targetPct}% coverage`
      );
      console.warn(
        `[sigmap] auto-budget: capped at ${hardCap} ` +
        `(${Math.round(maxTokensHeadroom * 100)}% of ${Math.round(modelContextLimit / 1000)}K model limit` +
        `${__ctxLimit.source === 'roster' ? ` — smallest roster window, ${__ctxLimit.model}` : ''}) ` +
        `→ est. ${estimatedCovPct}% coverage`
      );
      console.warn(
        `[sigmap] auto-budget: tip — set strategy:"per-module" for full coverage on large repos`
      );
    }
  }

  return effective;
}

/**
 * Delete `.github/context-*.md` split files this run did not write (#555).
 *
 * Splits are discovered by filename pattern at read time, not by consulting
 * the config, so a file left behind by a previous `strategy` — or by a module
 * since dropped from `srcDirs` — keeps being merged into the retrieval index
 * and silently steers every query. Observed on a 524-file Java repo: a stale
 * 376 KB `context-mall-mbg.md` kept generated entities at ranks 1, 3 and 4
 * while both files implementing the feature fell outside the top 6, even
 * though `sig-index.json` correctly held zero entries for that module.
 *
 * @param {string} cwd
 * @param {string[]} keep  basenames this run wrote, e.g. ['context-core.md']
 * @returns {string[]} basenames removed
 */
function pruneStaleContextSplits(cwd, keep) {
  const ghDir = path.join(cwd, '.github');
  const kept = new Set(keep);
  const removed = [];
  let entries;
  try { entries = fs.readdirSync(ghDir); } catch (_) { return removed; }
  for (const f of entries) {
    if (!/^context-[\w.-]+\.md$/.test(f) || kept.has(f)) continue;
    try { fs.unlinkSync(path.join(ghDir, f)); removed.push(f); } catch (_) { /* best effort */ }
  }
  if (removed.length) {
    console.warn(`[sigmap] pruned ${removed.length} stale context split(s) from a previous `
      + `strategy/srcDirs: ${removed.join(', ')}`);
  }
  return removed;
}

function applyTokenBudget(fileEntries, maxTokens, cwd = process.cwd(), opts = {}) {
  // fileEntries: [{ filePath, sigs, mtime }]
  // Per-file rendered overhead: "### <path>", code fences, trailing blank line.
  // A signature-only budget undercounts this, so when many files survive the
  // section headers alone can blow maxTokens.
  //
  // The heading renders the path RELATIVE to the project root, so that is what it
  // costs. Pricing the absolute path made the map depend on how long the checkout
  // path is: the same commit lost 19 of 69 sections 180 characters deeper (#993).
  // The same goes for what a file IS — a project checked out under a directory
  // named `test`, `tests` or `mocks` made every file in it a test or a mock.
  const relOf = (e) => path.relative(cwd, String(e.filePath || ''));
  const sectionOverhead = (e) => estimateTokens(relOf(e)) + 6;
  const renderedTotal = (entries) =>
    entries.reduce((s, e) => s + estimateTokens(e.sigs.join('\n')) + sectionOverhead(e), 0);
  // The generated file also carries a fixed preamble the entry budget does not
  // see: the adapter header, the marker lines, and the SigMap command block.
  // That reserve used to be a hardcoded `max(200, 10%)` describing a "~150-token"
  // preamble — so when the command block grew to ~224 tokens (#754) a
  // `maxTokens: 500` run emitted 554 and only CI caught it. Measure the block
  // instead of guessing at it, so the reserve can never drift from it again.
  const { usageBlock } = requireSourceOrBundled('./src/format/usage-guidance');
  // Chrome around the block: adapter header, timestamp/version markers,
  // "# Code signatures", the coverage line and the budget disclosure. MEASURED
  // at 124 tokens (see the preamble guard in usage-block-strategies.test.js,
  // which fails if reality outgrows this) — an earlier guess of 80 was too
  // small and only CI caught it, which is the same failure mode as the
  // hardcoded 200 this replaced. The margin is deliberate.
  const PREAMBLE_CHROME_TOKENS = 176;
  const fixedPreamble = estimateTokens(usageBlock()) + PREAMBLE_CHROME_TOKENS;
  const budgetForEntries = Math.max(1, maxTokens - Math.max(fixedPreamble, Math.ceil(maxTokens * 0.10)));
  let total = renderedTotal(fileEntries);
  if (total <= budgetForEntries) return fileEntries;

  // Over budget — degrade gracefully, best file first:
  //   1. keep FULL signatures (params + return type) while they fit;
  //   2. when a file no longer fits with full sigs, collapse just THAT file to
  //      its line-anchor pointers (still discoverable via buildSigIndex / the
  //      ranker — it parses the context file, so an anchored file stays findable);
  //   3. drop a file only when even the anchor form won't fit.
  // The important, high-priority files therefore keep their real signatures —
  // the user-visible value — while only low-priority overflow degrades to
  // anchors instead of vanishing. (Earlier versions collapsed EVERY file to an
  // anchor the moment you went 1 token over budget, gutting all signatures.)
  const withPriority = fileEntries.map((e) => {
    let priority = 0;
    let dropReason = 'budget: low recency';
    const rel = relOf(e);
    if (isGeneratedFile(rel)) { priority = 10; dropReason = 'budget: generated file'; }
    else if (isMockFile(rel)) { priority = 9;  dropReason = 'budget: mock file'; }
    else if (isTestFile(rel)) { priority = 8;  dropReason = 'budget: test file'; }
    else if (isConfigFile(rel)) { priority = 6; dropReason = 'budget: config file'; }
    else if (isEntryPointFile(rel)) { priority = 3; dropReason = 'budget: entry point'; }
    else priority = 4;
    const loc = typeof e.loc === 'number' ? e.loc : (e.content ? e.content.split('\n').length : 1);
    const signalQuality = loc > 0 ? (e.sigs ? e.sigs.length : 0) / loc : 0;
    return { ...e, priority, dropReason, signalQuality };
  });

  // Best-first order: lowest drop-priority, then most-recent, then most-informative.
  // Final tie-break on filePath keeps the selection deterministic when priority,
  // mtime, and signalQuality all tie (common for test files sharing a git-checkout
  // mtime) — otherwise the choice fell through to filesystem readdir order, making
  // which files are kept vs dropped non-reproducible run to run.
  const bestFirst = withPriority.slice().sort((a, b) => {
    if (a.priority !== b.priority) return a.priority - b.priority;
    if ((b.mtime || 0) !== (a.mtime || 0)) return (b.mtime || 0) - (a.mtime || 0);
    if ((b.signalQuality || 0) !== (a.signalQuality || 0)) return (b.signalQuality || 0) - (a.signalQuality || 0);
    return a.filePath.localeCompare(b.filePath);
  });

  const entryCost = (e) => estimateTokens(e.sigs.join('\n')) + sectionOverhead(e);
  const collapseEntry = (e) => ({
    ...e,
    sigs: (e.sigs || []).map((s) => {
      const line = toIndexLine(s);
      return line && /:\d+-\d+/.test(line) ? line : s;
    }),
  });
  // Keep FULL signatures for the best files while they fit (signatures are the
  // value the user reads). When a file's full form no longer fits, fall back to
  // its anchor form (still discoverable via the ranker, which parses this file);
  // drop only when even the anchor won't fit. So the important files keep real
  // signatures and only the lowest-priority overflow degrades — instead of every
  // signature being gutted to an anchor the moment you go over budget.
  const finalByPath = new Map();
  const verboseDropped = [];
  let collapsedCount = 0;
  let used = 0;

  // Spend the budget FAIRLY ACROSS MODULES rather than strictly best-first
  // (#743). The global ordering let one module consume everything: on akka,
  // `akka-stream` took all 128 surviving slots while `akka-actor` (192 files)
  // and `akka-cluster` (28 files) got ZERO — two of three configured srcDirs
  // rendered invisible, and every task targeting them failed. Completer
  // extraction makes this worse, not better: more signatures per file means
  // the leading module exhausts the budget sooner.
  //
  // Round-robin over modules, taking each module's next-best file in turn, so
  // a module can be thinned but never erased. Within a module the existing
  // best-first order is preserved, and a SINGLE-module repo yields exactly the
  // former sequence — so only genuinely multi-module repos change.
  const moduleKeyFor = (filePath) => {
    const rel = path.relative(cwd, String(filePath || ''));
    if (!rel || rel.startsWith('..')) return '';
    const seg = rel.split(path.sep)[0];
    return seg === rel ? '' : seg; // a root-level file belongs to no module
  };
  const groups = new Map();
  for (const entry of bestFirst) {
    const key = moduleKeyFor(entry.filePath);
    if (!groups.has(key)) groups.set(key, []);
    groups.get(key).push(entry);
  }
  const admit = (entry) => {
    if (used + entryCost(entry) <= budgetForEntries) {
      finalByPath.set(entry.filePath, entry); used += entryCost(entry); return;
    }
    const slim = collapseEntry(entry);
    if (used + entryCost(slim) <= budgetForEntries) {
      finalByPath.set(entry.filePath, slim); used += entryCost(slim); collapsedCount++; return;
    }
    verboseDropped.push({ filePath: entry.filePath, reason: entry.dropReason });
  };
  if (groups.size <= 1) {
    for (const entry of bestFirst) admit(entry);
  } else {
    // A bounded FLOOR per module, then global best-first for the remainder.
    //
    // Two weaker designs were measured and rejected on the benchmark corpus:
    // equal round-robin recovered akka (0.4 -> 1.0) but thinned the modules
    // that mattered on rails (1.0 -> 0.8) and gin (1.0 -> 0.875); strictly
    // proportional share was worse still (akka 0.4 -> 0.2, rails 1.0 -> 0.6),
    // because a module sized at 7% of the repo gets too little to answer
    // anything while the large modules still lose ground.
    //
    // The floor only guarantees a FOOTHOLD — enough that a module can never be
    // erased, which is the #743 defect — and leaves the rest of the budget to
    // the existing best-first ranking, so large modules keep their weight.
    const MODULE_FLOOR_FILES = 24;
    // Cap what the floor may consume so a repo with many modules still leaves
    // room for the best-first pass — otherwise the floor degenerates into equal
    // round-robin, which measured worse (rails 1.0 -> 0.8, gin 1.0 -> 0.875).
    const FLOOR_BUDGET_SHARE = 0.6;
    const floorCeiling = Math.floor(budgetForEntries * FLOOR_BUDGET_SHARE);
    for (const [, list] of groups) {
      for (const entry of list.slice(0, MODULE_FLOOR_FILES)) {
        // The first file of every module is always offered, so no module can be
        // erased even once the floor allowance is spent — that is the #743 defect.
        if (used >= floorCeiling && finalByPath.size && entry !== list[0]) break;
        admit(entry);
      }
    }
    for (const entry of bestFirst) {
      if (finalByPath.has(entry.filePath)) continue;
      const i2 = verboseDropped.findIndex((d) => d.filePath === entry.filePath);
      if (i2 >= 0) verboseDropped.splice(i2, 1);
      admit(entry);
    }
  }

  // Restore the original file order for stable output.
  const kept = withPriority.filter((e) => finalByPath.has(e.filePath)).map((e) => finalByPath.get(e.filePath));

  // Record what was omitted so the artifact itself can say so (#587). The
  // stderr warning below is invisible to an agent that only reads the file:
  // 25 sections with no notice is indistinguishable from a 25-file repo.
  // Non-enumerable so every existing consumer still sees a plain array.
  if (verboseDropped.length > 0 || collapsedCount > 0) {
    Object.defineProperty(kept, '__omissions', {
      value: { dropped: verboseDropped.length, collapsed: collapsedCount, maxTokens },
      enumerable: false, writable: false, configurable: true,
    });
  }

  if (verboseDropped.length > 0 || collapsedCount > 0) {
    const parts = [];
    if (verboseDropped.length) parts.push(`dropped ${verboseDropped.length} file(s)`);
    if (collapsedCount) parts.push(`collapsed ${collapsedCount} low-priority file(s) to anchors`);
    // A caller that sizes the same entries for a second target (an adapter with a host limit) says
    // what it did itself; the generic line would report the second pass as if it were the first.
    if (!opts.quiet) console.warn(`[sigmap] budget: ${parts.join(', ')} to stay under ${maxTokens} tokens`);
    if (process.argv.includes('--verbose') && !opts.quiet) {
      for (const { filePath, reason } of verboseDropped) {
        console.warn(`[sigmap] dropped: ${path.relative(process.cwd(), filePath)} — ${reason}`);
      }
      console.warn(`[sigmap] included: ${kept.length} files (${collapsedCount} collapsed), dropped: ${verboseDropped.length}`);
    }
  }
  return kept;
}

// ---------------------------------------------------------------------------
// Recently committed files (git, optional)
// ---------------------------------------------------------------------------
// The extraction cache of the run in progress. Git's answers about history cannot change while HEAD does
// not, so they are kept in it too and a re-run asks git for a few identifiers instead of every diff.
let __runCache = null;
let __runHead;

/**
 * HEAD's commit id and the state of the repository's shallow boundary, once per run ('' outside a
 * repository). The commits `git log` reaches from HEAD, and what the oldest of them is diffed against,
 * change when a shallow clone is deepened or unshallowed with HEAD where it was.
 */
function __headOf(cwd) {
  if (__runHead === undefined) {
    const out = __tryGit(['rev-parse', 'HEAD', '--git-path', 'shallow'], { cwd }).split('\n');
    let shallow = '';
    if (out[0] && out[1]) {
      try { shallow = requireSourceOrBundled('./src/cache/extract-cache').sha1(fs.readFileSync(path.resolve(cwd, out[1].trim()))); } catch (_) { /* not shallow */ }
    }
    __runHead = out[0] ? `${out[0].trim()}|${shallow}` : '';
  }
  return __runHead;
}

function getRecentlyCommittedFiles(cwd, count) {
  const n = count || 10;
  try {
    const head = __runCache ? __headOf(cwd) : '';
    let names = head ? __runCache.memoGet(`recent:${n}`, head) : undefined;
    if (!names) {
      const out = __git(['log', '--name-only', '--format=', '-n', String(n)], { cwd });
      names = out.split('\n').map((f) => f.trim()).filter(Boolean);
      if (head) __runCache.memoSet(`recent:${n}`, head, names);
    }
    return new Set(names.map((f) => path.resolve(cwd, f)));
  } catch (_) {
    return new Set();
  }
}

// ---------------------------------------------------------------------------
// Diff mode: files changed in working tree or staging area
// ---------------------------------------------------------------------------
function getDiffFiles(cwd, stagedOnly) {
  try {
    const gitArgs = stagedOnly ? ['diff', '--cached', '--name-only'] : ['diff', 'HEAD', '--name-only'];
    const out = __git(gitArgs, { cwd });
    return new Set(
      out.split('\n').map((f) => f.trim()).filter(Boolean).map((f) => path.resolve(cwd, f))
    );
  } catch (_) {
    return new Set();
  }
}

function getFilesChangedSinceBase(cwd, baseRef) {
  // #667: this ran `git diff <ref>..HEAD`, which is ref-vs-HEAD and therefore
  // excludes the working tree — while the flag is documented as "changes since
  // <ref>". One shared helper now owns the three ranges, so the CLI and the
  // `get_diff_context` MCP tool cannot answer this question differently.
  const { changedFiles, REF_RE } = requireSourceOrBundled('./src/util/git');
  if (!REF_RE.test(baseRef)) {
    console.warn(`[sigmap] --diff: invalid base ref '${baseRef}'`);
    return new Set();
  }
  return new Set(changedFiles(cwd, { base: baseRef }).map((f) => path.resolve(cwd, f)));
}

function buildDiffSectionFromBase(cwd, baseRef, currentEntries, config) {
  const { diffSignatures, extractName } = requireSourceOrBundled('./src/extractors/prdiff');
  const lines = ['## diff (vs ' + baseRef + ')', '```'];

  for (const entry of currentEntries) {
    const rel = path.relative(cwd, entry.filePath);
    let baseSrc = '';
    try {
      const { execFileSync } = require('child_process');
      baseSrc = execFileSync('git', ['show', `${baseRef}:${rel}`], {
        cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
      });
    } catch (_) {
      baseSrc = '';
    }

    const baseSigs = baseSrc ? detectAndExtract(entry.filePath, baseSrc, config.maxSigsPerFile, config.exactness, cwd) : [];
    const d = diffSignatures(baseSigs, entry.sigs || []);

    const markers = [];
    for (const a of d.added.slice(0, 4)) {
      const n = extractName(a);
      if (n) markers.push(`+${n}`);
    }
    for (const r of d.removed.slice(0, 4)) {
      const n = extractName(r);
      if (n) markers.push(`-${n}`);
    }
    for (const m of d.modified.slice(0, 4)) markers.push(`~${m}`);
    if (markers.length === 0) continue;
    lines.push(`${rel}`);
    lines.push(`  ${[...new Set(markers)].slice(0, 6).join('  ')}`);
  }

  lines.push('```', '');
  return lines.length > 3 ? lines : [];
}

// ---------------------------------------------------------------------------
// Output formatter
// ---------------------------------------------------------------------------
function buildDepMap(fileEntries, cwd) {
  const lines = [];
  for (const entry of fileEntries) {
    const deps = entry.deps;
    if (!deps || deps.length === 0) continue;
    const rel = path.relative(cwd, entry.filePath);
    lines.push(`${rel} \u2190 ${deps.join(', ')}`);
  }
  return lines;
}

/**
 * The TODO lines of one file. Kept in the extraction cache when the run has one, so that a file
 * served from it by its stat is not read for this.
 */
function __todosOf(entry, cwd, extractTodos) {
  const held = __runCache ? __runCache.entryOf(path.relative(cwd, entry.filePath).replace(/\\/g, '/')) : undefined;
  if (held && Array.isArray(held.t)) return held.t;
  let src = entry.content;
  if (typeof src !== 'string') { try { src = fs.readFileSync(entry.filePath, 'utf8'); } catch (_) { src = ''; } }
  const found = extractTodos(src || '');
  if (held) __runCache.update(held, { t: found });
  return found;
}

function buildTodoSection(fileEntries, cwd, config) {
  if (config && config.todos === false) return [];
  const { extractTodos } = requireSourceOrBundled('./src/extractors/todos');
  const out = [];
  for (const entry of fileEntries) {
    const todos = __todosOf(entry, cwd, extractTodos);
    if (!todos || todos.length === 0) continue;
    const rel = path.relative(cwd, entry.filePath);
    for (const t of todos) {
      out.push(`${rel}:${t.line}  # ${t.tag}: ${t.text}`);
    }
  }
  return out.slice(0, 20);
}

function buildChangesSection(cwd, config, fileEntries) {
  if (config && config.changes === false) return [];
  const n = (config && config.changesCommits) || 5;
  try {
    let range = `HEAD~${n}..HEAD`;
    // The range is named by the commits at its two ends, so the diffs under it are the same whenever
    // those are (what lets a re-run reuse them). One listing of the first-parent chain gives both ends,
    // and the clamp of a shallow repository, exactly as the probing below would find it.
    let ident = null;
    if (__runCache && Number.isInteger(n) && n > 0) {
      try {
        const chain = __git(['rev-list', '--first-parent', '-n', String(n + 1), 'HEAD'], { cwd }).split('\n').filter(Boolean);
        const ancestors = chain.length - 1;
        // No commit before HEAD (a one-commit history or a depth-1 clone): there is no range to diff,
        // which the probing below arrives at only after trying every ancestor.
        if (chain.length === 1) return [];
        const back = ancestors >= n ? n : ((n - 1 >= 2 && ancestors >= 2) ? Math.min(n - 1, ancestors) : 1);
        if (chain[0] && chain[back]) {
          range = `HEAD~${back}..HEAD`;
          ident = {
            key: `${chain[0]}|${chain[back]}|${__attributesStamp(cwd)}`,
            branch: __git(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd }).trim(),
          };
        }
      } catch (_) { /* no history to read: below */ }
    }
    if (!ident) {
      try {
        __git(['rev-parse', '--verify', `HEAD~${n}`], { cwd });
      } catch (_) {
        // HEAD~n doesn't exist (shallow repo) — clamp to deepest valid ancestor
        let best = 1;
        for (let k = n - 1; k >= 2; k--) {
          try {
            __git(['rev-parse', '--verify', `HEAD~${k}`], { cwd });
            best = k;
            break;
          } catch (_) {}
        }
        range = `HEAD~${best}..HEAD`;
      }
    }

    const held = ident ? __runCache.memoGet('changes', ident.key) : undefined;
    const memo = ident ? (held || { names: null, deltas: {} }) : null;
    let dirty = !held; // something was derived that the cache did not hold
    let names = memo && memo.names;
    if (!names) {
      const namesOnly = __git(['diff', range, '--name-only'], { cwd });
      names = namesOnly.split('\n').map((l) => l.trim()).filter(Boolean);
      if (memo) { memo.names = names; dirty = true; }
    }
    const changed = new Set(names.map((f) => path.resolve(cwd, f)));
    if (changed.size === 0) {
      if (memo && dirty) __runCache.memoSet('changes', ident.key, memo);
      return [];
    }

    // Identify the tip by commit, never by relative age (#683): "5 minutes ago"
    // is false the moment the file is written and differs on every regeneration.
    const tipHash = __git(['rev-parse', '--short', 'HEAD'], { cwd }).trim();
    const tipBranch = (ident ? ident.branch : __git(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd }).trim()) || 'HEAD';

    const lines = [`## recent changes (${tipBranch}@${tipHash})`, '```'];
    let hasDelta = false;
    for (const entry of fileEntries) {
      if (!changed.has(entry.filePath)) continue;
      const rel = path.relative(cwd, entry.filePath);
      let delta;
      if (memo && Object.prototype.hasOwnProperty.call(memo.deltas, rel)) {
        delta = memo.deltas[rel];
      } else {
        let diff = '';
        try {
          diff = __git(['diff', range, '--', rel], { cwd });
        } catch (_) {
          continue;
        }
        const plus = [...diff.matchAll(/^\+.*(?:def\s+|function\s+|class\s+|func\s+)(\w+)/gm)].map((m) => `+${m[1]}`);
        const modDef = [...diff.matchAll(/^-.*(?:def\s+|function\s+|class\s+|func\s+)(\w+)/gm)].map((m) => `~${m[1]}`);
        // Hunk headers (Python/Go/Java: git shows enclosing func in @@ ... @@ context)
        const modCtx = [...diff.matchAll(/^@@[^@]*@@\s+(?:(?:async|export|public|private|static)\s+)*(?:def|function|class|func)\s+(\w+)/gm)].map((m) => `~${m[1]}`);
        // Context lines (TS/JS: git doesn't detect funcname, so scan the unchanged lines adjacent to hunks)
        const ctxFn = [...diff.matchAll(/^ +(?:export\s+)?(?:async\s+)?(?:default\s+)?(?:function\s+(\w+)|class\s+(\w+))/gm)].map((m) => `~${m[1] || m[2]}`);
        delta = [...new Set([...plus, ...modDef, ...modCtx, ...ctxFn])].slice(0, 4).join('  ');
        if (memo) { memo.deltas[rel] = delta; dirty = true; }
      }
      if (delta) {
        hasDelta = true;
        lines.push(`${rel.padEnd(45)} ${delta}`);
      }
    }
    if (memo && dirty) __runCache.memoSet('changes', ident.key, memo);
    lines.push('```', '');
    return hasDelta ? lines : [];
  } catch (_) {
    return [];
  }
}

/**
 * What in the working tree can change how git renders a diff without a new commit: the repository's
 * top-level .gitattributes (which can select a language's function-name pattern). Part of the key a
 * cached diff is valid for.
 */
function __attributesStamp(cwd) {
  try { return requireSourceOrBundled('./src/cache/extract-cache').sha1(fs.readFileSync(path.join(cwd, '.gitattributes'))); } catch (_) { return ''; }
}

function normalizeRelNoExt(rel) {
  return rel.replace(/\.[^.]+$/, '').replace(/\\/g, '/');
}

function resolveImpactRadius(fileEntries, cwd, config) {
  const map = new Map();
  if (!config || !config.impactRadius) return map;
  const rels = fileEntries.map((e) => path.relative(cwd, e.filePath));
  const keys = rels.map((r) => ({ rel: r, norm: normalizeRelNoExt(r), base: path.basename(normalizeRelNoExt(r)) }));

  for (const entry of fileEntries) {
    const importer = path.relative(cwd, entry.filePath);
    const importerTop = importer.split('/')[0];
    for (const dep of (entry.deps || [])) {
      const depNorm = dep.replace(/\\/g, '/').replace(/^\.\//, '').replace(/\.[^.]+$/, '');
      const matches = keys.filter((k) => {
        if (k.norm === depNorm) return true;
        // Path-segment or base-only match: both require same top-level directory
        // to prevent cross-subsystem matches (e.g. 'app' dep in server/ matching desktop/gui/app.py)
        const matchTop = k.rel.split('/')[0];
        if (k.norm.endsWith('/' + depNorm) || k.base === depNorm) return matchTop === importerTop;
        return false;
      });
      for (const m of matches) {
        if (!map.has(m.rel)) map.set(m.rel, []);
        map.get(m.rel).push(importer);
      }
    }
  }

  for (const [k, v] of map.entries()) {
    map.set(k, [...new Set(v)].slice(0, 5));
  }
  return map;
}

function formatOutput(fileEntries, cwd, routingEnabled, config, extras) {
  // One canonical usage block for every context file (CLAUDE.md, AGENTS.md,
  // copilot-instructions.md, …). Lives here — the single source all writers
  // consume — so adapters don't each invent their own (now-removed) variant.
  const { usageBlock } = requireSourceOrBundled('./src/format/usage-guidance');
  const lines = [
    '<!-- Generated by SigMap gen-context.js v' + VERSION + ' -->',
    '<!-- DO NOT EDIT below the marker line — run gen-context.js to regenerate -->',
    '',
    '# Code signatures',
    '',
    usageBlock(),
  ];

  // Compact dependency map section (shows import relationships, ~50-100 tokens)
  const depLines = buildDepMap(fileEntries, cwd);
  if ((!config || config.depMap !== false) && depLines.length) {
    lines.push('## deps');
    lines.push('```');
    lines.push(...depLines);
    lines.push('```');
    lines.push('');
  }

  let installedPins = new Set();

  // D8: installed direct-dependency version pins — grounds agents against what
  // is actually installed here (byte-stable given a fixed installed tree).
  if (!config || config.versionPins !== false) {
    try {
      const { collectVersionPins } = requireSourceOrBundled('./src/verify/lib-index');
      const { pins, total } = collectVersionPins(cwd);
      installedPins = new Set(pins.map((x) => String(x).split('@')[0]));
      if (pins.length) {
        lines.push('## versions (installed direct deps)');
        lines.push('```');
        lines.push(...pins);
        if (total > pins.length) lines.push(`… +${total - pins.length} more`);
        lines.push('```');
        lines.push('');
      }
    } catch (_) { /* no/uninstalled deps → skip */ }
  }

  // DECLARED dependencies, read from the manifests (#747 follow-up). The block
  // above resolves versions out of node_modules/site-packages, so it can only
  // ever describe npm and Python -- a Maven, Go, Cargo, Gem or Composer project
  // got NOTHING, which is why "only npm projects list their packages" was the
  // reported symptom. Declared pins are labelled separately rather than merged
  // into the block above: "what the manifest asks for" and "what is installed
  // here" are different claims, and the installed one is the stronger.
  if (!config || config.versionPins !== false) {
    try {
      const { collectDependencies, versionPins } = requireSourceOrBundled('./src/deps/inventory');
      const inv = collectDependencies(cwd);
      const { pins, total } = versionPins(inv, { limit: 30 });
      const fresh = pins.filter((x) => !installedPins.has(String(x).split('@')[0]));
      if (fresh.length) {
        const ecos = [...new Set(inv.deps.filter((d) => d.scope === 'runtime' && !d.platform)
          .map((d) => d.ecosystem))].sort();
        lines.push('## dependencies (declared' + (ecos.length ? ' \u2014 ' + ecos.join(', ') : '') + ')');
        lines.push('```');
        lines.push(...fresh);
        if (total > fresh.length) lines.push('\u2026 +' + (total - fresh.length) + ' more');
        lines.push('```');
        lines.push('');
      }
    } catch (_) { /* no manifests -> skip */ }
  }

  const todoLines = buildTodoSection(fileEntries, cwd, config || {});
  if (todoLines.length) {
    lines.push('## todos');
    lines.push('```');
    lines.push(...todoLines);
    lines.push('```');
    lines.push('');
  }

  // Volatile blocks — they change with every commit — are collected here and
  // rendered after all stable content under `cacheLayout: "stable-prefix"` (the
  // default), so the signature body is a prefix-cache hit across commits (#683).
  // `legacy` keeps them in their old position ahead of the signatures.
  const layout = requireSourceOrBundled('./src/format/cache-layout').resolveLayout(config).value;
  const stablePrefix = layout === 'stable-prefix';
  const tail = [];
  const volatile = stablePrefix ? tail : lines;

  const changesLines = buildChangesSection(cwd, config || {}, fileEntries);
  if (changesLines.length) volatile.push(...changesLines);

  if (extras && Array.isArray(extras.diffSection) && extras.diffSection.length) {
    volatile.push(...extras.diffSection);
  }

  const impactMap = resolveImpactRadius(fileEntries, cwd, config || {});

  // Group by top-level src dir
  const groups = {};
  for (const entry of fileEntries) {
    const rel = path.relative(cwd, entry.filePath);
    const parts = rel.split(path.sep);
    const group = parts.length > 1 ? parts[0] : '.';
    if (!groups[group]) groups[group] = [];
    groups[group].push({ rel, sigs: entry.sigs });
  }

  // D7: terse signature encoding — anchors preserved byte-exactly
  const terseOn = !!(config && config.terse);
  let encodeTerseSigs = null;
  if (terseOn) {
    try {
      const terseMod = requireSourceOrBundled('./src/format/terse');
      encodeTerseSigs = terseMod.encodeTerseSigs;
      const m = terseMod.measureTerse(fileEntries.map((e) => e.sigs));
      console.warn(`[sigmap] terse: sig block ${m.beforeTokens} → ${m.afterTokens} tokens (-${m.reductionPct}%)`);
    } catch (err) {
      encodeTerseSigs = null;
      console.warn(`[sigmap] terse encoding skipped: ${err.message}`);
    }
  }

  for (const [group, entries] of Object.entries(groups).sort()) {
    lines.push(`## ${group}`);
    lines.push('');
    for (const { rel, sigs } of entries) {
      if (sigs.length === 0) continue;
      const usedBy = impactMap.get(rel);
      const usedByStr = usedBy && usedBy.length ? ` (used by: ${usedBy.join(', ')})` : '';
      lines.push(`### ${rel}${usedByStr}`);
      lines.push('```');
      lines.push(...(encodeTerseSigs ? encodeTerseSigs(sigs) : sigs));
      lines.push('```');
      lines.push('');
    }
  }

  if (routingEnabled) {
    try {
      const { classifyAll } = requireSourceOrBundled('./src/routing/classifier');
      const { formatRoutingSection } = requireSourceOrBundled('./src/routing/hints');
      const groups = classifyAll(fileEntries, cwd);
      const { resolveProfile: __resolveProfile } = requireSourceOrBundled('./src/config/models');
      volatile.push(formatRoutingSection(groups, __resolveProfile(config)));
    } catch (err) {
      console.warn(`[sigmap] routing hints skipped: ${err.message}`);
    }
  }

  // Say what the budget left out — an omission the reader cannot see is the
  // same failure as an undisclosed truncation cap (#587, cf. #576).
  const omitted = fileEntries && fileEntries.__omissions;
  if (omitted && (omitted.dropped > 0 || omitted.collapsed > 0)) {
    const bits = [];
    if (omitted.dropped) bits.push(`${omitted.dropped} file(s) omitted`);
    if (omitted.collapsed) bits.push(`${omitted.collapsed} collapsed to anchors`);
    lines.push('');
    lines.push(`> **Not everything is here.** ${bits.join(', ')} to stay under the `
      + `${omitted.maxTokens}-token budget (tests and configs go first). `
      + 'The retrieval index still has them all — run `sigmap ask "<question>"` '
      + 'to pull in anything missing.');
  }

  if (stablePrefix) {
    lines.push('', requireSourceOrBundled('./src/format/cache-layout').VOLATILE_MARKER, ...tail);
  }

  return lines.join('\n');
}

// ---------------------------------------------------------------------------
// Output writers
// ---------------------------------------------------------------------------
function ensureDir(filePath) {
  const dir = path.dirname(filePath);
  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
}

// ---------------------------------------------------------------------------
// Resolve output path for a given adapter
// ---------------------------------------------------------------------------
// Takes config.output into account for the copilot adapter.
// Returns the full path where output should be written.
function resolveAdapterPath(adapter, cwd, config) {
  config = config || {};
  
  // Copilot uses config.output if available, otherwise default
  if (adapter === 'copilot') {
    return config.output 
      ? path.join(cwd, config.output)
      : path.join(cwd, '.github', 'copilot-instructions.md');
  }
  
  // Fixed paths for other adapters
  if (adapter === 'claude') return path.join(cwd, 'CLAUDE.md');
  if (adapter === 'cursor') return path.join(cwd, '.cursorrules');
  if (adapter === 'windsurf') return path.join(cwd, '.windsurfrules');
  if (adapter === 'codex') return path.join(cwd, 'AGENTS.md');
  
  return null;
}

// ---------------------------------------------------------------------------
// Cache output writer (v0.8)
// ---------------------------------------------------------------------------
function writeCacheOutput(content, cwd, config) {
  try {
    const { formatCache } = __require('./src/format/cache');
    const layoutMod = __require('./src/format/cache-layout');
    const ttl = layoutMod.resolveTtl(config).value;
    const cachePath = path.join(cwd, '.github', 'copilot-instructions.cache.json');
    ensureDir(cachePath);
    fs.writeFileSync(cachePath, formatCache(content, { ttl }), 'utf8');
    console.warn(`[sigmap] cache: wrote ${path.relative(cwd, cachePath)} (ttl ${ttl})`);
    const split = layoutMod.splitVolatile(content);
    if (!split.split) {
      console.warn('[sigmap] cache: legacy layout — no stable/volatile boundary, so the whole file is one cached block that every commit invalidates');
    }
    const { resolveProfile } = __require('./src/config/models');
    const profile = resolveProfile(config);
    for (const line of layoutMod.formatFit(layoutMod.fitCheck(split.stable, profile), profile)) console.warn(`[sigmap] ${line}`);
  } catch (err) {
    console.warn(`[sigmap] cache: failed to write cache output: ${err.message}`);
  }
}

// The files `writeOutputs` writes for these targets, as repo-relative paths — what
// the post-run summary names. It used to print a literal `.github/copilot-instructions.md`
// whatever was written (#918).
function outputPaths(targets, cwd, config) {
  const rel = (p) => path.relative(cwd, p).split(path.sep).join('/');
  const seen = new Set();
  for (const t of targets || []) {
    if (t === 'willow') continue; // posts atoms to a remote store; writes no file
    let p = resolveAdapterPath(t, cwd, config);
    if (!p) { try { p = __require('./packages/adapters/' + t).outputPath(cwd); } catch (_) { p = null; } }
    if (p) seen.add(rel(p));
  }
  if (config && config.customOutput) seen.add(rel(path.resolve(cwd, config.customOutput)));
  return [...seen];
}

/**
 * Fit the content written for a host under the limit that host reads (#995).
 *
 * Codex loads at most `project_doc_max_bytes` of an AGENTS.md (32 KiB by default) and
 * Claude Code asks for a short CLAUDE.md (about 200 lines); what lies past the limit is
 * cut without a word. So the file is measured as it will be WRITTEN, human lines above
 * SigMap's block included, and `shrink` re-sizes the same entries with the existing
 * budget until it fits: the lowest-priority files go first, by the order the main
 * budget already uses (tests, config, generated, least recently changed, fewest
 * signatures), and the artifact says how many it left out. The optional sections
 * (deps, versions, todos, changes) are dropped for this file only when the limit is
 * tighter than they are. A limit that the lines above the block already exceed is
 * said, and the block shrinks to its fixed header.
 *
 * `shrink(tokens, lean)` → { content, kept, total }. Without it (every strategy but the
 * single budgeted file) the content is returned as it is.
 */
function fitToHostLimit(target, content, cwd, config, adapterOpts, shrink) {
  if (typeof shrink !== 'function') return content;
  const hl = __require('./src/util/host-limits');
  const limit = hl.hostLimit(target, config, process.env);
  if (!limit) return content;
  let place;
  if (target === 'codex') {
    const mod = __require('./packages/adapters/codex');
    place = (c) => mod.place(stripFormatHeader(c), cwd, adapterOpts).content;
  } else {
    place = (c) => placeClaude(c, cwd).content;
  }
  const sizeOf = (c) => hl.measure(limit.unit, place(c));
  if (sizeOf(content) <= limit.max) return content;

  const label = target === 'codex' ? 'AGENTS.md' : 'CLAUDE.md';
  const said = `${hl.formatSize(limit.unit, limit.max)} (${limit.source})`;
  for (const lean of [false, true]) {
    const floor = shrink(0, lean);
    const floorSize = sizeOf(floor.content);
    if (floorSize > limit.max) {
      if (lean) {
        console.warn(`[sigmap] ${label}: ${hl.formatSize(limit.unit, floorSize)} with no signatures at all — the lines above SigMap's block are already over ${limit.host}'s limit of ${said}`);
        return floor.content;
      }
      continue; // the optional sections alone are over: try without them
    }
    // A fit exists. The size is a fixed part (the floor) plus a part that grows with the
    // budget in steps (a file is in or out), so: start from the linear estimate, reach up a
    // little after every fit, bisect after every miss, and keep the largest budget that fit.
    let lo = 0;
    let best = floor;
    let hi = shrink.startTokens || 1; // the main budget's own render did not fit
    let t = Math.floor(hi * (limit.max - floorSize) / Math.max(1, sizeOf(content) - floorSize) * 0.97);
    for (let i = 0; i < 8 && hi - lo > Math.max(4, Math.floor(lo * 0.03)); i++) {
      t = Math.max(lo + 1, Math.min(hi - 1, t));
      const probe = shrink(t, lean);
      if (sizeOf(probe.content) <= limit.max) { lo = t; best = probe; t = Math.floor(t * 1.15); }
      else { hi = t; t = Math.floor((lo + hi) / 2); }
    }
    const cur = best;
    console.warn(`[sigmap] ${label}: kept ${cur.kept} of ${cur.total} files to fit ${limit.host}'s limit of ${said}${lean ? ', without the deps, todos and changes sections' : ''}`);
    return cur.content;
  }
  return content;
}

function writeOutputs(content, targets, cwd, config, shrink) {
  config = config || {};
  // Adapters place their wall-clock stamp by layout (#683).
  const adapterOpts = {
    version: VERSION,
    toolchain: _toolchainLabel(),
    cacheLayout: __require('./src/format/cache-layout').resolveLayout(config).value,
  };
  // v3.0+: adapter-aware output targets
  const ADAPTER_TARGETS = new Set(['copilot', 'openai', 'gemini', 'codex']);

  const targetMap = {
    copilot: resolveAdapterPath('copilot', cwd, config),
    cursor: resolveAdapterPath('cursor', cwd, config),
    windsurf: resolveAdapterPath('windsurf', cwd, config),
  };

  for (const target of targets) {
    if (target === 'claude') {
      writeClaude(fitToHostLimit('claude', content, cwd, config, adapterOpts, shrink), cwd);
      continue;
    }
    // v3.0+ adapter targets (copilot, openai, gemini, codex) — use bundled adapter to format + write
    if (ADAPTER_TARGETS.has(target)) {
      try {
        const adapterMod = __require('./packages/adapters/' + target);
        // Adapters add their own header via format() — strip the formatOutput() header
        // so the content body (## src, ## deps, etc.) is passed without a pre-existing
        // header, preventing duplicate "# Code signatures" blocks on every run.
        const adapterContent = stripFormatHeader(target === 'codex'
          ? fitToHostLimit('codex', content, cwd, config, adapterOpts, shrink)
          : content);
        // copilot: honour config.output custom path (redirects away from default .github/copilot-instructions.md)
        if (target === 'copilot') {
          const outPath = resolveAdapterPath('copilot', cwd, config);
          const defaultPath = path.join(cwd, '.github', 'copilot-instructions.md');
          if (outPath !== defaultPath) {
            // custom path: format and write directly (no append logic)
            const formatted = adapterMod.format(adapterContent, adapterOpts);
            ensureDir(outPath);
            fs.writeFileSync(outPath, formatted, 'utf8');
            console.warn(`[sigmap] wrote ${path.relative(cwd, outPath)}`);
            continue;
          }
        }
        if (typeof adapterMod.write === 'function') {
          adapterMod.write(adapterContent, cwd, adapterOpts);
          const outPath = adapterMod.outputPath(cwd);
          console.warn(`[sigmap] wrote ${path.relative(cwd, outPath)} (appended signatures)`);
        } else {
          const formatted = adapterMod.format(adapterContent, adapterOpts);
          const outPath = adapterMod.outputPath(cwd);
          ensureDir(outPath);
          fs.writeFileSync(outPath, formatted, 'utf8');
          console.warn(`[sigmap] wrote ${path.relative(cwd, outPath)}`);
        }
      } catch (err) {
        console.warn(`[sigmap] adapter "${target}" failed: ${err.message}`);
      }
      continue;
    }
    const outPath = targetMap[target];
    if (!outPath) {
      console.warn(`[sigmap] unknown output target: ${target}`);
      continue;
    }
    ensureDir(outPath);
    fs.writeFileSync(outPath, content, 'utf8');
    console.warn(`[sigmap] wrote ${path.relative(cwd, outPath)}`);
  }

  // #922: keep the warm-start session summary in step with `session.injectSummary`.
  // Built here, at generation time, and nowhere else (single-writer rule). Writes
  // nothing when there is no session store and the option is off.
  try {
    const sync = __require('./src/session/summary').syncSummaryBlocks(cwd, config);
    for (const f of sync.files) {
      if (f.action !== 'unchanged') console.warn(`[sigmap] session summary ${f.action} in ${f.file}`);
    }
  } catch (_) { /* the summary is an extra; it must never fail a generate */ }
}

// Strip the formatOutput() header block before passing content to adapters.
// formatOutput() prepends "<!-- Generated... -->\n\n# Code signatures\n\n" which
// is the raw-file header. Adapters add their own header via format(), so passing
// pre-headered content produces duplicate headers on every run.
function stripFormatHeader(content) {
  if (!content || typeof content !== 'string') return content;
  // Header ends after "# Code signatures\n\n" (with blank line)
  const marker = '\n# Code signatures\n';
  const idx = content.indexOf(marker);
  if (idx === -1) return content;
  // Skip past the marker line and one blank line
  const afterMarker = content.slice(idx + marker.length);
  return afterMarker.startsWith('\n') ? afterMarker.slice(1) : afterMarker;
}

/** What CLAUDE.md would contain after `writeClaude`, without writing it (#995). */
function placeClaude(content, cwd) {
  const claudePath = path.join(cwd, 'CLAUDE.md');
  let existing = '';
  if (fs.existsSync(claudePath)) {
    existing = fs.readFileSync(claudePath, 'utf8');
  }
  // Strip the formatOutput() header — CLAUDE.md gets its own header via the marker
  const body = stripFormatHeader(content);
  const sigHeader = '# Code signatures\n\n';
  // The managed section is found by src/util/managed-section.js: a mention of the
  // marker in prose or a code block is never the marker, so human lines after it
  // are never discarded (#873).
  return __require('./src/util/managed-section').replaceManagedSection(existing, sigHeader + body);
}

function writeClaude(content, cwd) {
  const claudePath = path.join(cwd, 'CLAUDE.md');
  const placed = placeClaude(content, cwd);
  if (placed.warning) console.warn(`[sigmap] CLAUDE.md: ${placed.warning}`);
  fs.writeFileSync(claudePath, placed.content, 'utf8');
  console.warn(`[sigmap] wrote CLAUDE.md (appended signatures)`);
}

// ---------------------------------------------------------------------------
// Report
// ---------------------------------------------------------------------------
function _coverageBar(pct, width) {
  width = width || 16;
  const filled = Math.round(pct / 100 * width);
  return '\u2588'.repeat(filled) + '\u2591'.repeat(width - filled);
}

/**
 * Exit preserving any `process.exitCode` a command already set.
 *
 * A bare `process.exit(0)` in the dispatch tail silently overrides
 * `process.exitCode`, which is how the documented `--report` over-budget
 * gate came to never fire. Report paths must exit through this.
 */
function exitWithCode() {
  process.exit(process.exitCode || 0);
}

/**
 * Does the stable prefix of a generated context reach each model's minimum
 * cacheable length (#683)? Null under the legacy layout, which has no stable
 * prefix to measure — a verdict about the whole file would be meaningless
 * because the tail that changes every commit sits inside it.
 */
function buildCacheFit(content, config) {
  try {
    const layoutMod = __require('./src/format/cache-layout');
    const layout = layoutMod.resolveLayout(config).value;
    const split = layoutMod.splitVolatile(content);
    if (layout !== 'stable-prefix' || !split.split) return null;
    const { resolveProfile } = __require('./src/config/models');
    const profile = resolveProfile(config);
    const rows = layoutMod.fitCheck(split.stable, profile);
    return {
      layout,
      ttl: layoutMod.resolveTtl(config).value,
      asOf: profile.asOf,
      rows,
      lines: layoutMod.formatFit(rows, profile),
    };
  } catch (_) {
    return null;
  }
}

// Invalid cacheLayout / cacheTtl values fall back to their defaults — say so,
// once, rather than silently ignoring a setting the user made (#683).
function warnCacheConfig(config) {
  const layoutMod = __require('./src/format/cache-layout');
  const layout = layoutMod.resolveLayout(config);
  if (layout.invalid) {
    console.warn(`[sigmap] config: cacheLayout "${layout.invalid}" is not one of ${layoutMod.LAYOUTS.map((v) => `"${v}"`).join(', ')} — using "${layout.value}"`);
  }
  const ttl = layoutMod.resolveTtl(config);
  if (ttl.invalid) {
    console.warn(`[sigmap] config: cacheTtl "${ttl.invalid}" is not one of ${layoutMod.CACHE_TTLS.map((v) => `"${v}"`).join(', ')} — using "${ttl.value}"`);
  }
}

function printReport(inputTokens, finalTokens, fileCount, droppedCount, asJson, budgetLimit, coverageResult, isAutoBudget, configuredMaxTokens, cacheFit) {
  const reduction = inputTokens > 0 ? (100 - (finalTokens / inputTokens) * 100).toFixed(1) : 0;
  const overBudget = finalTokens > (budgetLimit || 6000);
  if (asJson) {
    const payload = {
      version: VERSION,
      timestamp: new Date().toISOString(),
      rawTokens: inputTokens,
      inputTokens,
      finalTokens,
      fileCount,
      droppedCount,
      reductionPct: parseFloat(reduction),
      overBudget,
      budgetLimit: budgetLimit || 6000,
      autoBudget: !!isAutoBudget,
    };
    if (cacheFit) {
      payload.cacheFit = { layout: cacheFit.layout, ttl: cacheFit.ttl, asOf: cacheFit.asOf, models: cacheFit.rows };
    }
    if (coverageResult) {
      payload.coverage = {
        score: coverageResult.score,
        grade: coverageResult.grade,
        confidence: coverageResult.confidence,
        totalFiles: coverageResult.total,
        includedFiles: coverageResult.included,
        droppedFiles: coverageResult.dropped,
        perModule: Object.fromEntries(
          Array.from(coverageResult.perModule.entries())
            .map(([k, v]) => [k, v])
        ),
      };
    }
    writeAll(1, JSON.stringify(payload) + '\n');
  } else {
    const budgetLabel = isAutoBudget
      ? `${budgetLimit || 6000} (auto-scaled)`
      : `${budgetLimit || 6000} (fixed)`;
    // The notice now prints once, earlier, on every path (#783) — emitting it
    // again here would double it under --report.
    console.log(`[sigmap] report:`);
    console.log(`  version         : ${VERSION}`);
    console.log(`  files processed : ${fileCount}`);
    console.log(`  files dropped   : ${droppedCount}`);
    console.log(`  input tokens    : ~${inputTokens}`);
    console.log(`  output tokens   : ~${finalTokens}`);
    console.log(`  budget limit    : ${budgetLabel}`);
    console.log(`  reduction       : ${reduction}%`);
    if (cacheFit && cacheFit.lines.length) {
      console.log('');
      for (const l of cacheFit.lines) console.log(`  ${l}`);
      console.log('');
    }
    if (coverageResult) {
      const skipNote = coverageResult.nonCodeSkipped > 0
        ? `  (${coverageResult.nonCodeSkipped} non-code files skipped — json, md, config)`
        : '';
      console.log(`  coverage        : ${__require('./src/analysis/coverage-score').formatCoverage(coverageResult, 'in-context')}`);
      if (skipNote) console.log(`                  ${skipNote}`);
      console.log(`  confidence      : ${coverageResult.confidence}`);
      if (coverageResult.perModule && coverageResult.perModule.size > 0) {
        console.log('');
        console.log('  Module Coverage:');
        for (const [dir, mod] of coverageResult.perModule) {
          if (mod.total === 0) continue;
          const bar = _coverageBar(mod.pct);
          const attention = mod.pct < 50 ? '  \u2190 attention needed' : '';
          console.log(`    ${dir.padEnd(18)} ${bar} ${String(mod.pct).padStart(3)}% (${mod.included}/${mod.total} files)${attention}`);
        }
        const lowModules = [...coverageResult.perModule.entries()].filter(([, m]) => m.pct < 50 && m.total > 0);
        if (lowModules.length > 0) {
          console.log('');
          console.log('  tip: modules marked "\u2190 attention needed" have <50% code-file coverage.');
          console.log('       Common causes:');
          console.log('         \u2022 token budget dropped files \u2014 raise maxTokens or use strategy:"per-module"');
          console.log('         \u2022 srcDir path includes non-code files \u2014 check .contextignore or exclude config');
          console.log('         \u2022 srcDir path is wrong \u2014 verify srcDirs in gen-context.config.json');
        }
      }
    }
    if (overBudget) console.warn(`[sigmap] WARNING: output (${finalTokens} tokens) exceeds budget (${budgetLimit || 6000})`);
  }

  // Exit 1 in CI if over budget — lets pipelines fail fast. Same semantics in
  // both renderings: JSON and text `--report` are one behaviour, not two.
  // `process.exitCode` only takes effect if the dispatch tail exits through
  // `exitWithCode()` rather than a bare `process.exit(0)`.
  if (overBudget) process.exitCode = 1;
}

// ---------------------------------------------------------------------------
// Watch mode
// ---------------------------------------------------------------------------

/**
 * Files SigMap itself writes, repo-relative: every adapter's output, the
 * single-file formats, a custom output, and the strategy split files. A watcher
 * that reacted to these would be woken by its own regeneration — on a repo whose
 * srcDir is the root, that is a loop (observed: one edit, eight regenerations in
 * ten seconds, before #926).
 */
function generatedOutputPaths(cwd, config) {
  const out = new Set(['llm.txt', 'llm-full.txt', 'llms.txt', '.sigmap-cache.json', '.github/copilot-instructions.cache.json']);
  const add = (abs) => {
    const rel = path.relative(cwd, abs).replace(/\\/g, '/');
    if (rel && !rel.startsWith('..')) out.add(rel);
  };
  try {
    const adapters = requireSourceOrBundled('./packages/adapters/index');
    for (const name of adapters.listAdapters()) {
      try { add(adapters.getAdapter(name).outputPath(cwd)); } catch (_) { /* no file path */ }
    }
  } catch (_) { /* best-effort */ }
  if (config.customOutput) add(path.resolve(cwd, config.customOutput));
  return out;
}

/**
 * How the watcher should treat a changed path:
 *   'file'    a full run would index it — patch it
 *   'outside' it sits under a srcDir that lies outside the project root; those
 *             files never reach the retrieval index, so only a full run (which
 *             rewrites the written context) is useful
 *   null      a full run would not index it — ignore the event
 *
 * It mirrors walkDir + buildFileList + runGenerate's ignore filter (no excluded
 * name on the way down, within the depth cap, not matched by .contextignore)
 * and additionally ignores what SigMap wrote itself. It looks at the PATH only,
 * so a file that was just deleted is still recognised as one the index may hold.
 *
 * @param {{ ignorePatterns: string[], outputs: Set<string> }} ctx
 * @returns {'file'|'outside'|null}
 */
function watchKind(cwd, config, abs, ctx) {
  const rel = path.relative(cwd, abs).replace(/\\/g, '/');
  if (!rel) return null;
  if (rel === '.context' || rel.startsWith('.context/')) return null;
  if (ctx.outputs.has(rel) || /^\.github\/context-[\w.-]+\.md$/.test(rel)) return null;
  if (matchesIgnore(rel, ctx.ignorePatterns)) return null;
  for (const srcDir of config.srcDirs) {
    const root = path.relative(cwd, path.join(cwd, srcDir)).replace(/\\/g, '/');
    const within = root === '' ? rel : (rel.startsWith(root + '/') ? rel.slice(root.length + 1) : null);
    if (within === null) continue;
    const parts = within.split('/');
    if (parts.some((part) => config.exclude.includes(part))) continue;
    if (parts.length - 1 > config.maxDepth) continue;
    return rel.startsWith('..') ? 'outside' : 'file';
  }
  return null;
}

/**
 * Re-index only `absFiles` into the live overlay: the single-file path the
 * watcher takes instead of a full run (#926). Each file goes through the SAME
 * stages a full run applies (extraction, secret redaction, coverage annotation,
 * module-doc enrichment), so a patched entry equals the regenerated one. A file
 * that is gone, or that now yields no signatures, is recorded as removed — a
 * full run would not list it either.
 *
 * A DIRECTORY event (a directory created, moved or removed) cannot be patched
 * file by file — the platform reports the directory, not its contents — so it
 * is reported back as `full` and the caller regenerates.
 *
 * @returns {{ files: number, removed: number, full: boolean }}
 */
function patchLiveFiles(cwd, config, absFiles, ctx) {
  const overlay = requireSourceOrBundled('./src/cache/overlay');
  // A patch is an index entry, so it keeps what a full run keeps (indexLimit), not the context-file budget.
  const { indexLimit, splitForIndex, moreForIndex, EXTRACT_CEILING } = requireSourceOrBundled('./src/cache/entry');
  const patchLimit = indexLimit(config);
  const readLimit = Math.max(patchLimit, EXTRACT_CEILING);
  const updates = [];
  let removed = 0;
  let full = false;
  for (const abs of absFiles) {
    if (watchKind(cwd, config, abs, ctx) !== 'file') continue;
    const key = overlay.relKey(cwd, abs);
    if (!key) continue;
    const at = Date.now(); // before the read: an edit during it stays uncovered
    let content = null;
    try {
      // lstat, not stat: a full run lists regular files only (walkDir's
      // Dirent.isFile() is false for a symlink), so a symlink is not indexed here either.
      const st = fs.lstatSync(abs);
      if (st.isDirectory()) { full = true; continue; }
      if (st.isFile()) content = fs.readFileSync(abs, 'utf8');
    } catch (_) {
      // Gone. If the index holds files UNDER this path it was a directory that
      // was removed or moved away; the platform will not name the files.
      const under = key + '/';
      for (const k of ctx.known()) if (k.startsWith(under)) { full = true; break; }
    }
    let sigs = content === null ? [] : detectAndExtract(abs, content, readLimit, config.exactness, cwd);
    if (sigs.length === 0) {
      // A removal only means something for a path the index holds. An editor's
      // swap or atomic-save temp file comes and goes without ever being indexed,
      // and must not leave an entry behind.
      if (ctx.known().has(key)) { updates.push([key, { at, deleted: true }]); ctx.known().delete(key); removed++; }
      continue;
    }
    const split = splitForIndex(finishFileSigs(sigs, abs, cwd, config, ctx.testIndex()), config);
    const entry = { at, sigs: indexSigsFor(abs, content, split.view, config) };
    if (split.more.length > 0) entry.more = moreForIndex(split.more, config);
    updates.push([key, entry]);
    ctx.known().add(key);
  }
  if (updates.length > 0) {
    // A patch that did not land is not a patch: let the caller regenerate.
    const wrote = overlay.update(cwd, (entries) => { for (const [k, e] of updates) overlay.put(entries, k, e); });
    if (!wrote) throw new Error('could not write .context/overlay.json');
  }
  return { files: updates.length, removed, full };
}

function watchMode(cwd, config) {
  console.warn('[sigmap] watching for changes (Ctrl+C to stop)…');
  const overlay = requireSourceOrBundled('./src/cache/overlay');
  const incremental = config.watchIncremental !== false;
  const debounceMs = config.watchDebounce || 300;
  const settleMs = Number.isFinite(config.watchSettleMs) && config.watchSettleMs >= 0 ? config.watchSettleMs : 5000;
  // A burst this large (a branch switch, a formatter over the tree) is cheaper
  // as one full run than as hundreds of single-file patches.
  const BURST = 200;

  const filterCtx = { ignorePatterns: loadIgnorePatterns(cwd), outputs: generatedOutputPaths(cwd, config) };
  // Paths the index (base + overlay) holds — what a removal can refer to.
  let known;
  const getKnown = () => {
    if (known) return known;
    known = new Set();
    try {
      for (const k of requireSourceOrBundled('./src/retrieval/sig-index-store').readFullIndex(cwd).keys()) known.add(k);
      for (const [k, e] of overlay.load(cwd)) { if (e.deleted) known.delete(k); else known.add(k); }
    } catch (_) { /* an unreadable index leaves removals unrecorded until the next full run */ }
    return known;
  };
  let testIndex;
  const getTestIndex = () => {
    if (testIndex !== undefined) return testIndex;
    testIndex = null;
    if (config.testCoverage) {
      try {
        testIndex = requireSourceOrBundled('./src/extractors/coverage').buildTestIndex(cwd, config.testDirs);
      } catch (_) { /* annotation is best-effort, as in a full run */ }
    }
    return testIndex;
  };

  const stats = { patches: 0, regens: 0 };
  let pending = new Set();
  let firstAt = 0;
  let wantFull = false;
  let debounce = null;
  let settle = null;

  const regenerate = (since) => {
    // A full run supersedes whatever the quiet-window regeneration was waiting to do.
    if (settle) { clearTimeout(settle); settle = null; }
    const t0 = Date.now();
    try {
      runGenerate(cwd, config, false);
    } catch (err) {
      // A long-running watcher outlives one bad run; the next change tries again.
      console.warn(`[sigmap] regeneration failed (${err.message}) — still watching`);
      return;
    }
    const done = Date.now();
    testIndex = undefined; // the tree it described has just been re-read
    known = undefined;
    stats.regens++;
    const patch = { lastRegenAt: new Date(done).toISOString(), lastRegenMs: done - t0, regens: stats.regens };
    if (since) { patch.lastLatencyMs = done - since; patch.lastLatencyPath = 'regen'; }
    overlay.writeLive(cwd, patch);
  };

  const scheduleSettle = () => {
    if (settle) clearTimeout(settle);
    settle = setTimeout(() => {
      settle = null;
      console.warn('[sigmap] quiet — regenerating the context files…');
      regenerate(0);
    }, settleMs);
  };

  const flush = () => {
    debounce = null;
    const batch = [...pending];
    pending = new Set();
    const since = firstAt || Date.now();
    firstAt = 0;
    // Both are re-read per batch: a .contextignore edit applies from the next
    // change, and coverage marks follow the tests that are on disk now.
    checkRoots();
    try { filterCtx.ignorePatterns = loadIgnorePatterns(cwd); } catch (_) { /* keep the previous patterns */ }
    testIndex = undefined;

    if (!incremental || wantFull || batch.length > BURST) {
      wantFull = false;
      console.warn('[sigmap] change detected, regenerating…');
      regenerate(since);
      return;
    }
    if (batch.length === 0) return;
    try {
      const t0 = Date.now();
      const r = patchLiveFiles(cwd, config, batch, Object.assign({ known: getKnown, testIndex: getTestIndex }, filterCtx));
      if (r.full) {
        console.warn('[sigmap] a directory changed, regenerating…');
        regenerate(since);
        return;
      }
      const done = Date.now();
      // Nothing the index would hold changed. A quiet-window regeneration that
      // an earlier patch armed stays armed — this event is not a reason to cancel it.
      if (r.files === 0) return;
      stats.patches++;
      overlay.writeLive(cwd, {
        lastPatchAt: new Date(done).toISOString(), lastPatchFiles: r.files, lastPatchMs: done - t0,
        lastLatencyMs: done - since, lastLatencyPath: 'patch', patches: stats.patches,
      });
      console.warn(`[sigmap] patched ${r.files} file(s) in ${done - t0} ms (save → index ${done - since} ms)`);
      scheduleSettle();
    } catch (err) {
      console.warn(`[sigmap] live patch failed (${err.message}) — regenerating…`);
      regenerate(since);
    }
  };

  const trigger = () => {
    if (!firstAt) firstAt = Date.now();
    if (debounce) clearTimeout(debounce);
    debounce = setTimeout(flush, debounceMs);
  };

  const onEvent = (abs) => (_event, filename) => {
    if (!filename) {
      if (incremental) wantFull = true; // the platform did not say which file
    } else if (String(filename) === path.basename(abs) && !fs.existsSync(path.join(abs, String(filename)))) {
      // The platform reports the watched root ITSELF (removed, moved away, or
      // replaced) under its own name. Nothing under it can be patched file by
      // file, and the root is not a path inside the root.
      if (incremental) wantFull = true;
    } else {
      const changed = path.join(abs, String(filename));
      // Unrelated events (excluded dirs, ignored paths, and above all our own
      // output written under a root srcDir) must not wake the pipeline.
      const kind = watchKind(cwd, config, changed, filterCtx);
      if (!kind) return;
      if (incremental) {
        if (kind === 'outside') wantFull = true; else pending.add(changed);
      }
    }
    trigger();
  };

  // A recursive watch is bound to the root's INODE on some platforms (Linux). Move
  // the root away and the platform says so; REPLACE it (`rm -rf src && mkdir src`,
  // a `git checkout` that recreates it) and it says nothing at all and keeps
  // watching the deleted directory — blind to the new one for good. So each root's
  // identity is checked, and a changed one is re-attached and re-indexed in full.
  const inodeOf = (abs) => { try { return fs.statSync(abs, { bigint: true }).ino; } catch (_) { return null; } };
  const attach = (abs) => {
    const handle = fs.watch(abs, { recursive: true }, onEvent(abs));
    handle.on('error', () => { /* the next identity check re-attaches */ });
    return handle;
  };
  const roots = config.srcDirs.map((srcDir) => {
    const abs = path.join(cwd, srcDir);
    const ino = inodeOf(abs);
    // First attach throws as it always did where recursive watching is unsupported.
    return { abs, ino, handle: ino === null ? null : attach(abs), retry: false };
  });
  const checkRoots = () => {
    let changed = false;
    for (const r of roots) {
      const cur = inodeOf(r.abs);
      if (cur === r.ino) {
        if (r.retry && cur !== null) { try { r.handle = attach(r.abs); r.retry = false; } catch (_) { /* try again next tick */ } }
        continue;
      }
      if (r.handle) { try { r.handle.close(); } catch (_) { /* already gone */ } r.handle = null; }
      r.ino = cur;
      r.retry = false;
      if (cur !== null) {
        try { r.handle = attach(r.abs); } catch (_) { r.retry = true; }
      }
      changed = true;
    }
    if (changed) wantFull = true;
    return changed;
  };
  const rootPoll = setInterval(() => { if (checkRoots()) trigger(); }, Math.max(100, Number(process.env.SIGMAP_WATCH_ROOT_POLL_MS) || 2000));
  rootPoll.unref();

  // A pid alone cannot say whether the watcher is alive: after a crash or a reboot
  // the number is reused by an unrelated process. A heartbeat can.
  // (SIGMAP_WATCH_HEARTBEAT_MS exists so a test can observe it in under 20 seconds.)
  const heartbeatMs = Math.max(200, Number(process.env.SIGMAP_WATCH_HEARTBEAT_MS) || 20000);
  const beat = setInterval(() => overlay.writeLive(cwd, { heartbeatAt: new Date().toISOString() }), heartbeatMs);
  beat.unref();

  // Written AFTER the watchers exist, so the file's presence means "watching" —
  // and a fresh watcher starts from nothing rather than a dead one's numbers.
  overlay.writeLive(cwd, {
    pid: process.pid,
    startedAt: new Date().toISOString(),
    incremental, settleMs, debounceMs,
    heartbeatAt: new Date().toISOString(),
    patches: 0, regens: 0,
  }, { replace: true });
}

// ---------------------------------------------------------------------------
// Git hook installer
// ---------------------------------------------------------------------------
function installHook(cwd, scriptPath) {
  const { installPostCommitHook } = requireSourceOrBundled('./src/util/post-commit-hook');
  const res = installPostCommitHook(cwd, scriptPath);
  if (res.action === 'skipped') {
    console.warn('[sigmap] .git/hooks not found — skipping hook install');
    return;
  }
  const shown = path.relative(cwd, res.path).split(path.sep).join('/');
  console.warn(res.action === 'unchanged' ? `[sigmap] post-commit hook already installed (${shown})` : `[sigmap] ${res.action} ${shown}`);
  // The hook above is only run if git is looking in this directory for hooks.
  const hooksPath = __tryGit(['config', '--get', 'core.hooksPath'], { cwd });
  if (hooksPath) console.warn(`[sigmap] warning: core.hooksPath is set to ${hooksPath} — git runs hooks from there, not ${path.dirname(shown)}/`);
}

// ---------------------------------------------------------------------------
// Example config writer
// ---------------------------------------------------------------------------
function writeInitConfig(cwd) {
  const dest = path.join(cwd, 'gen-context.config.json');
  if (fs.existsSync(dest)) {
    console.warn('[sigmap] gen-context.config.json already exists — skipping');
  } else {
    const example = path.join(__dirname, 'gen-context.config.json.example');
    if (fs.existsSync(example)) {
      fs.copyFileSync(example, dest);
    } else {
      // No example beside the script (a lone copy of the bundle, or the standalone binary):
      // the defaults, with the one choice the example makes — a new install starts on the
      // lean MCP profile (#966) — so `--init` means the same thing wherever it runs.
      const fresh = JSON.parse(JSON.stringify(DEFAULTS));
      fresh.mcp = Object.assign({}, fresh.mcp, { tools: 'core' });
      fs.writeFileSync(dest, JSON.stringify(fresh, null, 2) + '\n');
    }
    console.warn('[sigmap] wrote gen-context.config.json');
  }

  // Also scaffold .contextignore if it does not already exist
  const ignoreDest = path.join(cwd, '.contextignore');
  if (fs.existsSync(ignoreDest)) {
    console.warn('[sigmap] .contextignore already exists — skipping');
  } else {
    const ignoreContent = [
      '# SigMap ignore file — gitignore syntax',
      '# Files and directories listed here are excluded from signature extraction.',
      '# This file is union-merged with .repomixignore if present.',
      '',
      'node_modules/',
      'dist/',
      'build/',
      'out/',
      '.next/',
      'coverage/',
      'target/',
      'vendor/',
      '*.generated.*',
      '*.pb.*',
      '*_pb.*',
      '*.min.js',
      '*.min.css',
    ].join('\n') + '\n';
    fs.writeFileSync(ignoreDest, ignoreContent);
    console.warn('[sigmap] wrote .contextignore');
  }
}

// ---------------------------------------------------------------------------
// Core generate pipeline
// ---------------------------------------------------------------------------
// ---------------------------------------------------------------------------
// Strategy: per-module — one output file per top-level srcDir
// ---------------------------------------------------------------------------
function runPerModuleStrategy(cwd, config, fileEntries, inputTokenTotal) {
  // The overview IS the always-on primary output — the per-module files are
  // on-demand — so it must carry the usage block (#754). It was hand-built
  // here and never called usageBlock(), which left agents in per-module repos
  // with no idea the CLI existed.
  const { usageBlock } = requireSourceOrBundled('./src/format/usage-guidance');

  // Group entries by their top-level srcDir
  const modules = {};
  for (const entry of fileEntries) {
    const rel = path.relative(cwd, entry.filePath);
    const topDir = rel.split(path.sep)[0];
    if (!modules[topDir]) modules[topDir] = [];
    modules[topDir].push(entry);
  }

  const moduleNames = Object.keys(modules).sort();
  console.warn(`[sigmap] per-module: ${moduleNames.length} modules — ${moduleNames.join(', ')}`);

  // Thin overview → primary output (always-on, tiny)
  const overviewLines = [
    '<!-- Generated by SigMap gen-context.js v' + VERSION + ' — per-module overview -->',
    '<!-- Load the full module context file for detailed signatures -->',
    '',
    '# Codebase overview',
    '',
    usageBlock(),
    '## Modules',
    '',
    '| Module | Full context file |',
    '|--------|-------------------|',
  ];

  let totalOut = 0;
  const writtenSplits = [];
  for (const mod of moduleNames) {
    const outName = `context-${mod}.md`;
    const outPath = path.join(cwd, '.github', outName);
    const modEntries = modules[mod];

    // Per-module budget: each module gets its own full effective budget
    // (per-module strategy is the recommended path for large repos — no sharing needed)
    const modBudget = Math.max(1000, config.maxTokens);
    const budgeted = applyTokenBudget(modEntries, modBudget, cwd);

    const content = formatOutput(budgeted, cwd, false, config, null);
    ensureDir(outPath);
    fs.writeFileSync(outPath, content, 'utf8');
    const modTokens = estimateTokens(content);
    totalOut += modTokens;
    console.warn(`[sigmap] per-module: wrote .github/${outName} (~${modTokens} tokens, ${budgeted.length} files)`);

    overviewLines.push(`| \`${mod}\` | \`.github/${outName}\` |`);
    writtenSplits.push(outName);
  }
  pruneStaleContextSplits(cwd, writtenSplits);

  overviewLines.push('');
  overviewLines.push('> Run `sigmap ask "<question>"` first — it reads the retrieval index');
  overviewLines.push('> directly and returns the ranked files across ALL modules, so you do not');
  overviewLines.push('> have to pick one. Load a module file above only if you want its full');
  overviewLines.push('> signature list; for cross-module questions load both.');
  const overviewContent = overviewLines.join('\n') + '\n';
  const primaryTargets = config.outputs || ['copilot'];
  writeOutputs(overviewContent, primaryTargets, cwd, config);

  const overviewTokens = estimateTokens(overviewContent);
  console.warn(`[sigmap] per-module: overview ~${overviewTokens} tokens (always-on), modules total ~${totalOut} tokens (on-demand)`);
  return { inputTokenTotal, finalTokens: overviewTokens, fileCount: fileEntries.length, droppedCount: 0 };
}

// ---------------------------------------------------------------------------
// Strategy: hot/cold — hot injected always, cold available via MCP only
// ---------------------------------------------------------------------------
function runHotColdStrategy(cwd, config, fileEntries, recentFiles, inputTokenTotal) {
  const hotEntries = fileEntries.filter((e) => recentFiles.has(e.filePath));
  const coldEntries = fileEntries.filter((e) => !recentFiles.has(e.filePath));

  // Hot → primary output (auto-injected by IDE)
  // An empty hot set still has to carry the usage block (#754): "nothing changed
  // recently" is exactly when an agent most needs to be told to run `sigmap ask`
  // rather than conclude the repo is uncontexted.
  const hotContent = hotEntries.length > 0
    ? formatOutput(hotEntries, cwd, false, config, null)
    : [
        '<!-- Generated by SigMap — no recently changed files -->',
        '',
        '# Code signatures',
        '',
        'No files changed in the last ' + (config.hotCommits || 10) + ' commits, so nothing is',
        'auto-injected. Every signature is still indexed — retrieve per question.',
        '',
        requireSourceOrBundled('./src/format/usage-guidance').usageBlock(),
      ].join('\n');
  const primaryTargets = config.outputs || ['copilot'];
  writeOutputs(hotContent, primaryTargets, cwd, config);
  const hotTokens = estimateTokens(hotContent);

  // Cold → .github/context-cold.md (MCP reads this on demand)
  const coldPath = path.join(cwd, '.github', 'context-cold.md');
  const coldHeader = [
    '<!-- Generated by SigMap gen-context.js v' + VERSION + ' — cold context (MCP only) -->',
    '<!-- NOT auto-injected. Retrieve via MCP: read_context({ module: "..." }) -->',
    '',
  ].join('\n');
  const coldContent = coldHeader + formatOutput(coldEntries, cwd, false, config, null);
  ensureDir(coldPath);
  fs.writeFileSync(coldPath, coldContent, 'utf8');
  pruneStaleContextSplits(cwd, ['context-cold.md']);
  const coldTokens = estimateTokens(coldContent);

  console.warn('[sigmap] hot-cold:');
  console.warn(`  hot  (auto-injected) : ${hotEntries.length} files ~${hotTokens} tokens → primary output`);
  console.warn(`  cold (MCP on-demand) : ${coldEntries.length} files ~${coldTokens} tokens → .github/context-cold.md`);
  if (coldEntries.length > 0) {
    console.warn('  retrieve cold: read_context({ module: "<dir>" }) via MCP');
  }

  return { inputTokenTotal, finalTokens: hotTokens, fileCount: fileEntries.length, droppedCount: 0 };
}


// ---------------------------------------------------------------------------
// Strategy: index — a small always-on stub; signatures live in the index
// ---------------------------------------------------------------------------
/**
 * WHY THIS STRATEGY EXISTS (#1a, v8.50)
 * -------------------------------------
 * Under `full`, the generated context file carries the whole budgeted
 * signature dump and every adapter auto-injects it — on this repo that was
 * ~13,900 tokens paid on every session, before a single question was asked.
 *
 * That does not merely cost tokens; it SUPPRESSES retrieval. An agent holding
 * a superset of what `sigmap ask` would return is correct not to call it. The
 * push artifact was out-competing the pull path it exists to feed.
 *
 * `index` keeps the always-on file to a map — how to retrieve, what the
 * modules are, where the entry points are, and what versions are installed —
 * and leaves every signature in `.context/sig-index.json`, which `sigmap ask`
 * already reads. Measured on this repo: ~13,900 always-on tokens become ~500,
 * and a first answer costs stub + one query-context instead of the whole dump.
 *
 * The retrieval index is written BEFORE this runs, for every strategy. Under
 * `index` it is load-bearing rather than an optimisation — if it is missing,
 * the context file has no signatures to fall back to — so a failed write is
 * reported loudly here instead of being swallowed.
 */
function runIndexStrategy(cwd, config, fileEntries, inputTokenTotal, indexWritten) {
  const { usageBlock } = requireSourceOrBundled('./src/format/usage-guidance');

  // Module rollup: files and signatures per top-level directory.
  const modules = new Map();
  let totalSigs = 0;
  let indexTokens = 0;
  for (const entry of fileEntries) {
    const rel = path.relative(cwd, entry.filePath);
    const top = rel.split(path.sep).length > 1 ? rel.split(path.sep)[0] : '.';
    const acc = modules.get(top) || { files: 0, sigs: 0, tokens: 0 };
    acc.files += 1;
    acc.sigs += entry.sigs.length;
    acc.tokens += estimateTokens(entry.sigs.join('\n'));
    modules.set(top, acc);
    totalSigs += entry.sigs.length;
  }
  indexTokens = [...modules.values()].reduce((n, m) => n + m.tokens, 0);

  const lines = [
    '<!-- Generated by SigMap gen-context.js v' + VERSION + ' — index strategy -->',
    '<!-- DO NOT EDIT below the marker line — run gen-context.js to regenerate -->',
    '',
    '# Code map',
    '',
    'Signatures are **not** in this file. This is the map; the territory is the',
    'retrieval index. Look a file up before opening it.',
    '',
    usageBlock(),
  ];

  // ── Modules ──────────────────────────────────────────────────────────────
  if (modules.size) {
    const names = [...modules.keys()].sort();
    lines.push('## modules', '');
    lines.push('| Module | Files | Signatures |', '|--------|-------|------------|');
    for (const name of names) {
      const m = modules.get(name);
      lines.push(`| \`${name}\` | ${m.files} | ${m.sigs} |`);
    }
    lines.push('');
  }

  // ── Entry points ─────────────────────────────────────────────────────────
  // Declared entrypoints (package.json main/bin) first — in a JS repo that is
  // what actually names an entry — then the cross-language filename heuristic.
  const entrySet = new Set();
  try {
    for (const abs of declaredEntrypoints(cwd, config || {}, [])) {
      entrySet.add(path.relative(cwd, abs));
    }
  } catch (_) { /* no package.json → heuristic only */ }
  for (const e of fileEntries) {
    const rel = path.relative(cwd, e.filePath);
    if (isEntryPointFile(rel)) entrySet.add(rel);
  }
  const entries = [...entrySet].sort().slice(0, 12);
  if (entries.length) {
    lines.push('## entry points', '');
    lines.push(entries.map((e) => '`' + e + '`').join(', '));
    lines.push('');
  }

  // ── Version pins ─────────────────────────────────────────────────────────
  // From the declared manifests (#2a), so this works on a repo that has never
  // been installed; the inventory prefers a locked exact version when present.
  if (!config || config.versionPins !== false) {
    try {
      const { collectDependencies, versionPins } = requireSourceOrBundled('./src/deps/inventory');
      const { pins, total } = versionPins(collectDependencies(cwd), { limit: 30 });
      if (pins.length) {
        lines.push('## versions (direct deps)', '');
        lines.push('```');
        lines.push(...pins);
        if (total > pins.length) lines.push(`… +${total - pins.length} more`);
        lines.push('```');
        lines.push('');
      }
    } catch (_) { /* no readable manifest → skip the section */ }
  }

  // ── Pointer to the index ─────────────────────────────────────────────────
  const indexRel = path.join('.context', 'sig-index.json');
  lines.push('## retrieval', '');
  if (indexWritten) {
    lines.push(
      `${fileEntries.length} file(s) and ${totalSigs} signature(s) — about ${indexTokens} tokens —`,
      `are indexed in \`${indexRel}\`, which is **not** injected into any prompt.`,
      '',
      'Pull only what the task needs:',
      '',
      '```',
      'sigmap ask "<your question>"     # writes .context/query-context.md',
      'cat .context/query-context.md    # ranked files + signatures with :line anchors',
      'sigmap lines <file> :120 --context 10',
      '```',
      '',
      'To inject every signature instead, set `"strategy": "full"` in gen-context.config.json.',
    );
  } else {
    // Under `index` the stub has no signatures to fall back to, so this is a
    // hard failure to surface rather than a silent degradation.
    lines.push(
      `> **The retrieval index could not be written to \`${indexRel}\`.**`,
      '> `sigmap ask` has nothing to read. Re-run `sigmap` from the repo root, or',
      '> set `"strategy": "full"` to go back to inlining signatures in this file.',
    );
  }
  lines.push('');

  const content = lines.join('\n');
  // `index` writes no split files; anything left by a previous strategy would
  // still be merged into the retrieval index at read time (#555).
  pruneStaleContextSplits(cwd, []);
  const primaryTargets = config.outputs || ['copilot'];
  writeOutputs(content, primaryTargets, cwd, config);

  const stubTokens = estimateTokens(content);
  console.warn('[sigmap] index strategy:');
  console.warn(`  always-on stub  : ~${stubTokens} tokens → primary output`);
  console.warn(`  retrieval index : ${fileEntries.length} files ~${indexTokens} tokens → ${indexRel} (not injected)`);
  // Typical `.context/query-context.md`, measured across the field-test repos.
  // Used only to say WHEN the strategy pays off — never to claim a saving.
  const TYPICAL_QUERY_TOKENS = 1000;

  if (!indexWritten) {
    console.warn('[sigmap] ⚠ retrieval index was NOT written — `sigmap ask` will find nothing');
  } else if (indexTokens <= stubTokens) {
    // Below the stub's own fixed overhead (commands, module table, retrieval
    // instructions), inlining everything is simply cheaper.
    console.warn(`[sigmap] note: this repo's signatures (~${indexTokens} tokens) are smaller than the`);
    console.warn('[sigmap]       index stub itself — strategy:"full" is cheaper here.');
  } else {
    // `full` does NOT emit the whole index — applyTokenBudget drops files to
    // fit maxTokens. Comparing the stub against the UNCAPPED index overstated
    // the saving badly (fastapi: 64,667 claimed vs 19,910 actual), and capping
    // at the budget ceiling still overshot by ~26% because the budget is a
    // ceiling, not the outcome. So run the same budget pass `full` would run
    // and measure it. One sort+filter over entries already in memory.
    let fullWouldEmit = indexTokens;
    try {
      const budgeted = applyTokenBudget(fileEntries.slice(), config.maxTokens, cwd);
      fullWouldEmit = budgeted.reduce((n, e) => n + estimateTokens(e.sigs.join('\n')), 0);
    } catch (_) { /* fall back to the uncapped figure */ }
    const perTurn = Math.max(0, fullWouldEmit - stubTokens);
    console.warn(`  always-on saving: ~${perTurn} tokens per turn vs strategy:"full" (~${fullWouldEmit} after its budget)`);
    // Reporting the per-turn saving alone overstates the case on small repos:
    // one `ask` costs ~1k, so if the dump is smaller than stub + query, the
    // FIRST answer is more expensive under `index` even though every
    // subsequent turn is cheaper. Measured on express: full 1,374 vs
    // stub 537 + query 1,094 = 1,631. Say which side of that line this repo
    // falls on rather than letting the headline number imply a first-turn win.
    if (fullWouldEmit < stubTokens + TYPICAL_QUERY_TOKENS) {
      console.warn(`[sigmap] note: one ask costs ~${TYPICAL_QUERY_TOKENS} tokens, so the FIRST answer here is`);
      console.warn('[sigmap]       cheaper under strategy:"full". `index` wins from the second turn on,');
      console.warn('[sigmap]       or sooner if the agent asks less than once per turn.');
    }
  }

  return { inputTokenTotal, finalTokens: stubTokens, fileCount: fileEntries.length, droppedCount: 0 };
}

// ---------------------------------------------------------------------------
// Diff-mode pipeline — context for changed files only
// ---------------------------------------------------------------------------
function runDiff(cwd, config, stagedOnly, baseRef) {
  const diffFiles = baseRef ? getFilesChangedSinceBase(cwd, baseRef) : getDiffFiles(cwd, stagedOnly);

  if (diffFiles.size === 0) {
    const scope = baseRef ? `base ${baseRef}` : (stagedOnly ? 'staged' : 'working tree');
    console.warn(`[sigmap] --diff: no changed files found in ${scope} — running full generate`);
    runGenerate(cwd, config, false);
    return;
  }

  const ignorePatterns = loadIgnorePatterns(cwd);
  let allFiles = buildFileList(cwd, config);
  allFiles = allFiles.filter((f) => {
    const rel = path.relative(cwd, f).replace(/\\/g, '/');
    return !matchesIgnore(rel, ignorePatterns);
  });

  // Restrict to diff files, keeping only those already in srcDirs
  const diffFiltered = allFiles.filter((f) => diffFiles.has(f));

  if (diffFiltered.length === 0) {
    console.warn('[sigmap] --diff: changed files are outside tracked srcDirs — running full generate');
    runGenerate(cwd, config, false);
    return;
  }

  let inputTokenTotal = 0;
  let fileEntries = [];
  let testIndex = null;
  if (config.testCoverage) {
    try {
      const { buildTestIndex } = requireSourceOrBundled('./src/extractors/coverage');
      testIndex = buildTestIndex(cwd, config.testDirs);
    } catch (err) {
      console.warn(`[sigmap] coverage index failed: ${err.message}`);
    }
  }

  prefetchPythonAst(diffFiltered);
  for (const filePath of diffFiltered) {
    let content = '';
    try {
      content = fs.readFileSync(filePath, 'utf8');
    } catch (_) {
      continue;
    }

    let sigs = detectAndExtract(filePath, content, config.maxSigsPerFile, config.exactness, cwd);
    if (sigs.length === 0) continue;

    inputTokenTotal += estimateTokens(content);

    sigs = finishFileSigs(sigs, filePath, cwd, config, testIndex);

    fileEntries.push({ filePath, sigs, deps: extractFileDeps(filePath, content, config), content, mtime: nextRecentMtime() });
  }

  if (fileEntries.length === 0) {
    console.warn('[sigmap] --diff: no extractable signatures in changed files — running full generate');
    runGenerate(cwd, config, false);
    return;
  }

  const routingEnabled = !!(config.routing || process.argv.includes('--routing'));
  const diffSection = baseRef ? buildDiffSectionFromBase(cwd, baseRef, fileEntries, config) : [];
  const content = formatOutput(fileEntries, cwd, routingEnabled, config, { diffSection });
  const finalTokens = estimateTokens(content);
  writeOutputs(content, config.outputs, cwd, config);

  const scope = baseRef ? `diff-vs-${baseRef}` : (stagedOnly ? 'staged' : 'diff');
  console.warn(`[sigmap] ${scope} files: ${fileEntries.length}, diff tokens: ~${finalTokens}`);

  // v4.0: risk score per changed file
  try {
    const { buildFromCwd } = requireSourceOrBundled('./src/graph/builder');
    const graph = buildFromCwd(cwd, { silent: true });
    const reverseGraph = graph.reverse || new Map();

    function _isRouteFile(f) {
      return /\/(routes?|pages?|controllers?|handlers?|api)\//i.test(f)
        || /\.(route|page|controller|handler)\.\w+$/.test(f);
    }
    function _riskScore(filePath, sigs, revGraph) {
      let s = 0;
      if (sigs.some(sig => sig.includes('export') || sig.includes('module.exports'))) s += 2;
      const deps = revGraph.get(filePath) || new Set();
      if (deps.size > 3) s += 2;
      if (_isRouteFile(filePath)) s += 1;
      if (/\.(config|env|settings)\.\w+$/.test(filePath)) s += 1;
      return s >= 4 ? 'HIGH' : s >= 2 ? 'MEDIUM' : 'LOW';
    }

    console.warn(`[sigmap] Risk: Changed files (${fileEntries.length}):`);
    for (const fe of fileEntries) {
      const level = _riskScore(fe.filePath, fe.sigs, reverseGraph);
      const rel   = path.relative(cwd, fe.filePath).replace(/\\/g, '/');
      const deps  = reverseGraph.get(fe.filePath) || new Set();
      const reasons = [];
      if (fe.sigs.some(s => s.includes('export') || s.includes('module.exports'))) reasons.push('exports public API');
      if (deps.size > 0) reasons.push(`${deps.size} downstream dependent${deps.size === 1 ? '' : 's'}`);
      if (_isRouteFile(fe.filePath)) reasons.push('route file');
      if (/\.(config|env|settings)\.\w+$/.test(fe.filePath)) reasons.push('config file');
      const label = level === 'HIGH' ? '[HIGH]  ' : level === 'MEDIUM' ? '[MEDIUM]' : '[LOW]   ';
      console.warn(`  ${rel.padEnd(40)} ${label}${reasons.length ? '  — ' + reasons.join(', ') : ''}`);
    }
  } catch (_) {}

  if (process.argv.includes('--report')) {
    // Also show what the full run would cost for comparison
    const fullResult = runGenerate(cwd, config, true);
    console.log(`[sigmap] diff report:`);
    console.log(`  mode            : ${scope}`);
    console.log(`  diff files      : ${fileEntries.length}`);
    console.log(`  diff tokens     : ~${finalTokens}`);
    console.log(`  full tokens     : ~${fullResult.finalTokens}`);
    console.log(`  savings         : ~${fullResult.finalTokens - finalTokens} tokens`);
  }
}

// ---------------------------------------------------------------------------
// Per-file stages shared by the full run and the watcher's per-file patch (#926)
// ---------------------------------------------------------------------------

/**
 * What one file contributes to the generated context once it has been
 * extracted: secret redaction, then test-coverage annotation.
 */
function finishFileSigs(sigs, filePath, cwd, config, testIndex, redactedEarlier) {
  const { redactSecrets } = requireSourceOrBundled('./src/cache/entry');
  const result = redactSecrets(sigs, filePath, config);
  // `redactedEarlier`: the extraction cache already redacted this list (and says so on every run, as before).
  if (result.redacted || redactedEarlier) {
    console.warn(`[sigmap] secrets redacted in ${path.relative(cwd, filePath)}`);
  }
  return annotateCoverage(result.sigs, testIndex, !!config.testCoverage);
}

/**
 * The lines of a JavaScript or TypeScript file that declare something exported, for the
 * run summary and for `explain` (#996). A re-export is not a declaration: a barrel
 * (`export * from`, `export { a } from`, `export type { T }`) is meant to list nothing,
 * so it is never counted as a file the extractor failed on.
 */
const EXPORT_DECLARATION = /^\s*(?:export\s+(?:declare\s+)?(?:default\b|(?:async\s+)?function\b|(?:abstract\s+)?class\b|(?:const|let|var)\s+[\w$\{\[]|(?:const\s+)?enum\s+[\w$]|interface\s+[\w$]|type\s+[\w$])|(?:module\.)?exports\b\s*(?:\.[\w$]+|\[[^\]]+\])?\s*=(?!=))/;
function exportLinesOf(text) {
  const out = [];
  for (const line of String(text || '').split('\n')) {
    if (EXPORT_DECLARATION.test(line)) out.push(line.trim());
  }
  return out;
}

/** Remember a file that declares exports and produced no signatures at all (#996). */
function noteUnreadExporter(list, filePath, content, cwd) {
  if (!/\.[cm]?[jt]sx?$/.test(filePath) || /\.d\.[cm]?ts$/.test(filePath) || /\.min\.[cm]?js$/.test(filePath)) return;
  const rel = path.relative(cwd, filePath).split(path.sep).join('/');
  if (isTestFile(rel) || isGeneratedFile(rel)) return;
  let text = content;
  // A file served from the extraction cache is not read; this one produced nothing, so read it now.
  if (!text) { try { text = fs.readFileSync(filePath, 'utf8'); } catch (_) { return; } }
  if (exportLinesOf(text).length > 0) list.push(rel);
}

/**
 * The same file as the retrieval index stores it: a leading module-doc line and,
 * with `terse`, the compact encoding (src/cache/entry.js).
 *
 * ONE definition for the full run, the watcher's patch, freshen and the notify
 * hooks: a patched entry and a regenerated one cannot disagree about a file,
 * which is what lets the live overlay and a full run converge on the same index.
 */
function indexSigsFor(filePath, content, sigs, config, doc) {
  return requireSourceOrBundled('./src/cache/entry').indexSigsFor(filePath, content, sigs, config, doc);
}

// ---------------------------------------------------------------------------
// Content-hash extraction cache (#971)
// ---------------------------------------------------------------------------

/**
 * Open the extraction cache for this run, or null when it must not be used: switched off
 * (`extractCache: false`), or an opt-in tier is on whose answer comes from outside the file
 * (the repo's own typescript package, a language server, a SCIP index).
 */
function openExtractionCache(cwd, config, readLimit) {
  if (config.extractCache === false) return null;
  const ex = config.exactness || {};
  if (ex.typescript || ex.lsp || ex.scip) return null;
  try {
    const xc = requireSourceOrBundled('./src/cache/extract-cache');
    const py = requireSourceOrBundled('./src/extractors/python');
    const srcDir = path.join(__dirname, 'src');
    const sources = xc.treeHash(path.join(srcDir, 'extractors'), ['.js', '.py']) + xc.treeHash(path.join(srcDir, 'util'), ['truncate.js']) + xc.treeHash(path.join(srcDir, 'retrieval'), ['module-doc.js']);
    let core = '';
    try { core = xc.sha1(fs.readFileSync(__filename)); } catch (_) { /* the version still keys it */ }
    return xc.open(cwd, xc.fingerprint({ version: VERSION, sources, core, readLimit, depMap: config.depMap !== false, secretScan: !!config.secretScan, python: py.tierId(cwd) }));
  } catch (_) { return null; }
}

/**
 * What a run derives from a file's content besides its signatures, so that a file the cache
 * holds need not be read again: the imports it declares, its line count and token estimate,
 * and the leading module-doc line the retrieval index adds. (TODO lines are cached too, but only
 * for the files that reach the output: scanning every file for them is the dearest step there is.)
 */
function deriveFileFacts(filePath, content, config) {
  const facts = {
    d: extractFileDeps(filePath, content, config),
    l: content ? content.split('\n').length : 1,
    k: estimateTokens(content),
    g: '',
  };
  let doc = '';
  try { doc = requireSourceOrBundled('./src/retrieval/module-doc').moduleDocSig(content, filePath) || ''; } catch (_) { /* no doc line */ }
  // The header is prose lifted from the file: scanned before it is kept, like a signature.
  if (doc) facts.g = requireSourceOrBundled('./src/cache/entry').redactSecrets([doc], __FILE_TOKEN, config).sigs[0] || '';
  return facts;
}

// A redacted line names its file by absolute path. The cache holds redacted text (a credential must not
// reach `.context/extract-cache.json` any more than the context file), and a path in it would not survive
// moving the repository, so the path is stored as this token and given back on the way out.
const __FILE_TOKEN = '@@sigmap-file@@';
function __withPath(lines, filePath) {
  return lines.map((l) => (typeof l === 'string' && l.includes(__FILE_TOKEN) ? l.split(__FILE_TOKEN).join(filePath) : l));
}

/**
 * Give an entry a `content` it reads from disk on first use. A file served from the cache by
 * its stat is never read for the run; anything that still asks for the text gets it, once.
 * Not enumerable, so copying an entry (`{ ...e }`) does not read the file.
 */
function lazyContent(entry, filePath) {
  let value;
  let loaded = false;
  Object.defineProperty(entry, 'content', {
    enumerable: false,
    configurable: true,
    get() {
      if (!loaded) { try { value = fs.readFileSync(filePath, 'utf8'); } catch (_) { value = ''; } loaded = true; }
      return value;
    },
    set(v) { value = v; loaded = true; },
  });
}

// ---------------------------------------------------------------------------
// Core generate pipeline
// ---------------------------------------------------------------------------
function runGenerate(cwd, config, reportMode, reportJson = false) {
  // Directories are listed once for the whole run (src/util/dir-listing.js).
  let listing = null;
  try { listing = requireSourceOrBundled('./src/util/dir-listing'); listing.begin(); } catch (_) { listing = null; }
  try {
    return runGenerateOnce(cwd, config, reportMode, reportJson);
  } finally {
    if (listing) listing.end();
    __runCache = null; // a run that threw leaves no cache for the next caller to mistake for its own
  }
}

function runGenerateOnce(cwd, config, reportMode, reportJson = false) {
  const __genT0 = Date.now();
  const ignorePatterns = loadIgnorePatterns(cwd);
  let allFiles = buildFileList(cwd, config);

  // Apply .contextignore
  allFiles = allFiles.filter((f) => {
    const rel = path.relative(cwd, f).replace(/\\/g, '/');
    return !matchesIgnore(rel, ignorePatterns);
  });

  // v6.7: Load signature cache if enabled
  let cache = null;
  const { loadCache, saveCache, getChangedFiles, updateCacheEntries, pruneMissing } = requireSourceOrBundled('./src/cache/sig-cache');
  if (config.sigCache) {
    cache = loadCache(cwd, VERSION);
  }

  let inputTokenTotal = 0;
  let fileEntries = [];
  const unreadExporters = []; // files that declare exports and yielded no signature (#996)
  let testIndex = null;
  if (config.testCoverage) {
    try {
      const { buildTestIndex } = requireSourceOrBundled('./src/extractors/coverage');
      testIndex = buildTestIndex(cwd, config.testDirs);
    } catch (err) {
      console.warn(`[sigmap] coverage index failed: ${err.message}`);
    }
  }

  // One extraction per file feeds two views of it: the context file keeps the first
  // `maxSigsPerFile` signatures, the retrieval index keeps up to its own limit (#982).
  const { indexLimit, splitForIndex, moreForIndex, EXTRACT_CEILING } = requireSourceOrBundled('./src/cache/entry');
  const extractLimit = indexLimit(config);
  // What extraction is asked for: more than either limit, so that what the index cuts can
  // be counted (the extractors stop at 200 a file on their own; this bounds one without).
  const readLimit = Math.max(extractLimit, EXTRACT_CEILING);

  const xcache = cache ? null : openExtractionCache(cwd, config, readLimit);
  __runCache = xcache;
  __runHead = undefined;

  // Gather mtime and git-committed info (after the cache is open: git's answers are kept in it)
  const hotCommits = config.hotCommits || 10;
  const recentFiles = config.diffPriority ? getRecentlyCommittedFiles(cwd, hotCommits) : new Set();
  // A walked path is `cwd` + separator + the relative path, already normalised; only others need path.relative.
  const cwdPrefix = cwd.endsWith(path.sep) ? cwd : cwd + path.sep;
  const relOf = (f) => (f.startsWith(cwdPrefix) ? f.slice(cwdPrefix.length) : path.relative(cwd, f)).replace(/\\/g, '/');
  const isPy = (f) => /\.pyw?$/i.test(f);
  // One stat a file for the whole loop: it says whether the content cache can answer without reading the file,
  // and is the mtime the budget sorts by.
  const statOf = new Map();
  if (xcache) {
    for (const f of allFiles) { try { statOf.set(f, fs.statSync(f)); } catch (_) { /* unreadable: skipped below */ } }
  }

  // A file a cache still holds (under the same ceiling, as below) is never extracted, so it is not
  // prefetched. For the content cache the file's size and mtime only say "probably unchanged": a
  // wrong guess costs one batched python3 process, never a wrong answer.
  prefetchPythonAst(cache ? allFiles.filter((f) => {
    const cached = cache.get(f);
    try { return !cached || cached.cap !== readLimit || cached.mtime !== fs.statSync(f).mtimeMs; } catch (_) { return true; }
  }) : xcache ? allFiles.filter((f) => isPy(f) && !xcache.fresh(relOf(f), statOf.get(f))) : allFiles);
  for (const filePath of allFiles) {
    let content = '';
    let facts = null; // what the content cache derived for this file, when it served or stored one
    let redactedEarlier = false;
    let cached = null;
    let st = null;
    if (xcache) {
      st = statOf.get(filePath);
      if (!st) continue;
      cached = xcache.peek(relOf(filePath), st);
    }
    if (!cached) {
      try {
        content = fs.readFileSync(filePath, 'utf8');
      } catch (_) {
        continue;
      }
    }

    // v6.7: Check cache before extracting
    let sigs = [];
    if (cache) {
      const hit = cache.get(filePath);
      let mtime = 0;
      try { mtime = fs.statSync(filePath).mtimeMs; } catch (_) {}
      // An entry is reused only if it was extracted under the same ceiling: one from an
      // older version holds the first 25 signatures of the file, not the list the index keeps.
      if (hit && hit.mtime === mtime && hit.cap === readLimit) {
        sigs = hit.sigs;
      } else {
        sigs = detectAndExtract(filePath, content, readLimit, config.exactness, cwd);
        if (sigs.length > 0) {
          cache.set(filePath, { mtime, sigs, cap: readLimit });
        }
      }
    } else if (xcache) {
      // The content cache: the file's signatures are a function of its content (and of what the
      // cache's fingerprint covers), so the same content gives the same list without extracting.
      const rel = relOf(filePath);
      let kept = true; // false: the entry is used this run and not kept
      if (!cached) {
        const hash = requireSourceOrBundled('./src/cache/extract-cache').contentHash(content);
        cached = xcache.get(rel, hash, st);
        if (!cached) {
          const raw = detectAndExtract(filePath, content, readLimit, config.exactness, cwd);
          // What is kept is what the scanner leaves of the list; a scanner that cannot run throws, as it does below.
          const scanned = requireSourceOrBundled('./src/cache/entry').redactSecrets(raw, __FILE_TOKEN, config);
          const entryFacts = { s: scanned.sigs.slice(), x: scanned.redacted ? 1 : 0 };
          // A file the AST tier failed on was answered by the regex tier: that answer is not the AST tier's,
          // so it is not kept, and the next run asks python3 again.
          if (isPy(filePath) && requireSourceOrBundled('./src/extractors/python').wasDegraded(filePath)) {
            cached = entryFacts;
            kept = false;
          } else {
            cached = xcache.set(rel, hash, entryFacts, { size: st.size, mtimeMs: st.mtimeMs });
          }
        }
      }
      sigs = __withPath(cached.s, filePath);
      redactedEarlier = !!cached.x;
      if (isPy(filePath)) { try { requireSourceOrBundled('./src/extractors/python').restoreToolchain(xcache.toolchain); } catch (_) { /* label only */ } }
      if (sigs.length > 0) {
        if (typeof cached.l !== 'number') {
          const derived = deriveFileFacts(filePath, content, config);
          if (kept) xcache.update(cached, derived); else Object.assign(cached, derived);
        }
        facts = cached;
      }
    } else {
      sigs = detectAndExtract(filePath, content, readLimit, config.exactness, cwd);
    }
    if (sigs.length === 0) { noteUnreadExporter(unreadExporters, filePath, content, cwd); continue; }

    // Annotated and secret-scanned in full, so what the index keeps is scanned too;
    // the context file then takes the first `maxSigsPerFile` of the same list.
    const indexSigs = finishFileSigs(sigs, filePath, cwd, config, testIndex, redactedEarlier);
    sigs = indexSigs.slice(0, config.maxSigsPerFile);
    if (sigs.length === 0) continue; // a context limit of 0 keeps no file, as it always did

    // Baseline = estimated tokens of original source content for intuitive reduction stats.
    inputTokenTotal += facts ? facts.k : estimateTokens(content);

    let mtime = 0;
    if (st) mtime = st.mtimeMs;
    else {
      try {
        mtime = fs.statSync(filePath).mtimeMs;
      } catch (_) {}
    }

    // Boost recently committed files (give them a max mtime so they aren't
    // dropped first). A deterministic monotonic counter — not Date.now() — keeps
    // the budget selection byte-stable when many files are recent, while
    // preserving the original processing-order ranking (see nextRecentMtime, #440).
    if (recentFiles.has(filePath)) mtime = nextRecentMtime();

    const entry = { filePath, sigs, indexSigs, deps: facts ? facts.d.slice() : extractFileDeps(filePath, content, config), mtime };
    if (facts) {
      // What later steps read of the text, so that none of them needs the file itself.
      entry.loc = facts.l;
      entry.doc = __withPath([facts.g], filePath)[0];
      if (content) entry.content = content; else lazyContent(entry, filePath);
    } else {
      entry.content = content;
    }
    fileEntries.push(entry);
  }

  // A file that declares exports and yielded nothing is invisible to retrieval, `verify` and the
  // call graph. Say how many, and which, so the loss is not silent (#996).
  if (unreadExporters.length > 0 && !reportJson) {
    const n = unreadExporters.length;
    const shown = unreadExporters.slice().sort().slice(0, 5).join(', ');
    console.warn(`[sigmap] ${n} file${n === 1 ? '' : 's'} with exports produced 0 signatures: ${shown}${n > 5 ? ` (+${n - 5} more)` : ''} — \`sigmap explain <file>\` says what the extractor saw`);
  }

  // v6.5: Coverage feedback loop — warn if symbol density is suspiciously low
  const symbolsFound = fileEntries.reduce((n, f) => n + (f.sigs?.length || 0), 0);
  const filesFound   = fileEntries.length;
  const coverageRatio = filesFound > 0 ? symbolsFound / filesFound : 1;
  if (coverageRatio < 0.25 && !config.srcDirs?.length) {
    process.stderr.write('[sigmap] ⚠ low symbol coverage — source roots may be wrong\n');
    process.stderr.write('[sigmap]   run: sigmap roots --explain\n');
  }

  const strategy = config.strategy || 'full';
  const beforeCount = fileEntries.length;

  // Sort for output ordering: recently committed files appear first
  if (config.diffPriority && recentFiles.size > 0) {
    fileEntries.sort((a, b) => {
      const aRecent = recentFiles.has(a.filePath) ? 0 : 1;
      const bRecent = recentFiles.has(b.filePath) ? 0 : 1;
      return aRecent - bRecent;
    });
  }

  // v4.1: compute effective budget once; used by all strategies
  const effectiveMaxTokens = computeEffectiveMaxTokens(fileEntries, config);
  // Propagate to config so per-module / hot-cold strategies pick it up
  const configWithBudget = effectiveMaxTokens !== config.maxTokens
    ? Object.assign({}, config, { maxTokens: effectiveMaxTokens, _autoMaxTokens: effectiveMaxTokens })
    : config;

  // The extraction cache is written once everything that fills it has run: the main loop, the
  // test entries the index step collects and the git answers the output step asks for. A report
  // run collects no test entries and carries them over.
  const finishExtractionCache = () => {
    __runCache = null;
    if (!xcache) return;
    try { xcache.setToolchain(requireSourceOrBundled('./src/extractors/python').toolchainLabel()); } catch (_) { /* label only */ }
    if (reportMode) xcache.keep('t:');
    xcache.save();
    if (process.argv.includes('--verbose')) {
      console.warn(`[sigmap] extraction cache: ${xcache.stats.hits} hit(s), ${xcache.stats.misses} extracted (${xcache.loaded} entries loaded)`);
    }
  };

  // How many of the scanned files the retrieval index holds, for the run summary (null: no index was written).
  let __indexedSource = null;

  let result;
  if (!reportMode) {
    // Retrieval index (complete, unbudgeted) — written BEFORE applyTokenBudget
    // and before the strategy split, so it holds every extracted file for every
    // strategy. The generated context file is a budgeted VIEW for prompt
    // injection; the ranker must not inherit that budget or files dropped to fit
    // maxTokens become permanently unreachable by `sigmap ask`.
    let __indexWritten = false;
    try {
      const __store = requireSourceOrBundled('./src/retrieval/sig-index-store');
      // Honour --terse: `sigmap ask` renders .context/query-context.md straight
      // from these signatures, and that IS prompt-bound, so the user's format
      // choice has to survive into the index. Terse encoding preserves line
      // anchors byte-exactly, so get_lines still resolves.
      // Index-only enrichment: a module's leading comment describes its PURPOSE
      // in prose, which is the vocabulary a behavioural query actually uses.
      // Signatures carry shape, not intent — `coverageScore(cwd, fileEntries, config)`
      // shares no token with "what fraction of the repo made it into the output",
      // but that file's header says exactly that. Added to the retrieval index
      // ONLY: the prompt artifact is token-budgeted, the index is not.
      // Per-file enrichment lives in indexSigsFor (shared with the watcher's
      // per-file patch, so a patch and this run cannot disagree about a file).
      let __cutFiles = 0;
      let __cutSigs = 0;
      let __entries = fileEntries.map((e) => {
        // The module-doc line a cached file already holds spares reading the file; otherwise its text.
        const doc = typeof e.doc === 'string' ? e.doc : undefined;
        let src = doc !== undefined ? '' : e.content;
        if (typeof src !== 'string') { try { src = fs.readFileSync(e.filePath, 'utf8'); } catch (_) { src = ''; } }
        // `sigs` is what the ranker reads of the file, exactly as before; `more` the rest, for
        // the tools that look a symbol up (the index file keeps them in separate fields).
        const split = splitForIndex(e.indexSigs || e.sigs, config);
        if (split.dropped > 0) { __cutFiles++; __cutSigs += split.dropped; }
        return { filePath: e.filePath, deps: e.deps, mtime: e.mtime, sigs: indexSigsFor(e.filePath, src, split.view, config, doc), more: moreForIndex(split.more, config) };
      });
      // Test files: indexed, never rendered into the prompt. They were the one
      // whole category `sigmap ask` could not reach at all — srcDirs excludes
      // them, so "where are the tests for X" had no answer at any rank. The
      // prompt artifact stays clean because this list never reaches formatOutput.
      try {
        __entries = __entries.concat(collectTestEntries(cwd, config, __entries, xcache));
      } catch (_) { /* best-effort */ }
      // CI definitions live outside srcDirs by construction (`.github/workflows`
      // is a root dotdir), so without this the pipeline extractor is correct but
      // unreachable through generate — the defect v8.50.0 shipped with.
      try {
        __entries = __entries.concat(collectPipelineEntries(cwd, config, __entries));
      } catch (_) { /* best-effort */ }
      const __w = __store.writeFullIndex(cwd, __entries, { version: VERSION, startedAt: __genT0 });
      __indexWritten = __w.files > 0;
      if (__indexWritten) {
        // The same test writeFullIndex applies to an entry, over the source files only.
        __indexedSource = __entries.slice(0, fileEntries.length).filter((e) => {
          if (!e.sigs || e.sigs.length === 0) return false;
          const r = path.relative(cwd, e.filePath);
          return !!r && !r.startsWith('..');
        }).length;
      }
      // Said once per run, and only when it happened: a file past the limit is not fully indexed.
      if (__cutFiles > 0 && !reportJson) {
        console.warn(`[sigmap] index: ${__cutFiles} file(s) hold more signatures than the index keeps; ${__cutSigs} not indexed (maxIndexSigsPerFile is ${extractLimit}; most extractors stop at 200 a file)`);
      }
      // The index now reflects every change up to the instant this run began, so any
      // overlay entry older than that is superseded and is dropped.
      try { requireSourceOrBundled('./src/cache/overlay').prune(cwd, __genT0); } catch (_) { /* best-effort */ }
      if (process.argv.includes('--verbose')) {
        console.warn(`[sigmap] retrieval index: ${__w.files} file(s) → ${path.relative(cwd, __w.path)}`);
      }
    } catch (_) { /* non-fatal for every strategy but `index`, which reports it */ }

    if (strategy === 'index') {
      result = runIndexStrategy(cwd, configWithBudget, fileEntries, inputTokenTotal, __indexWritten);
    } else if (strategy === 'per-module') {
      result = runPerModuleStrategy(cwd, configWithBudget, fileEntries, inputTokenTotal);
    } else if (strategy === 'hot-cold') {
      result = runHotColdStrategy(cwd, configWithBudget, fileEntries, recentFiles, inputTokenTotal);
    } else {
      // 'full' — original behaviour
      // 'full' writes no split files — anything left from a previous
      // strategy would still be merged into the index at read time (#555).
      pruneStaleContextSplits(cwd, []);
      const allEntries = fileEntries;
      fileEntries = applyTokenBudget(fileEntries, effectiveMaxTokens, cwd);
      const droppedCount = beforeCount - fileEntries.length;
      const routingEnabled = !!(config.routing || process.argv.includes('--routing'));
      const content = formatOutput(fileEntries, cwd, routingEnabled, config, null);
      // Re-sizes the same entries for a target whose host reads less than the main file (#995).
      const shrinkForHost = (tokens, lean) => {
        const kept = applyTokenBudget(allEntries.slice(), tokens, cwd, { quiet: true });
        const cfg = lean ? Object.assign({}, config, { depMap: false, versionPins: false, todos: false, changes: false }) : config;
        return { content: formatOutput(kept, cwd, routingEnabled, cfg, null), kept: kept.length, total: allEntries.length };
      };
      shrinkForHost.startTokens = effectiveMaxTokens;
      const finalTokens = estimateTokens(content);
      const formatIdx = process.argv.indexOf('--format');
      const formatValue = formatIdx >= 0 ? process.argv[formatIdx + 1] : (config.format || 'default');
      // Feature 2: --mode write matrix
      const activeMode = process.argv.indexOf('--mode') >= 0
        ? process.argv[process.argv.indexOf('--mode') + 1]
        : (config.mode || 'default');
      if (activeMode === 'fast') {
        const llmTxtMod = requireSourceOrBundled('./src/format/llm-txt');
        const syncContext = { projectName: path.basename(cwd), fileEntries, srcDirs: config.srcDirs || [] };
        fs.writeFileSync(llmTxtMod.outputPath(cwd), llmTxtMod.format(syncContext, cwd, VERSION));
        console.warn(`[sigmap] --mode fast → llm.txt`);
      } else if (activeMode === 'full') {
        const llmFullMod = requireSourceOrBundled('./packages/adapters/llm-full');
        const syncContext = { projectName: path.basename(cwd), fileEntries, srcDirs: config.srcDirs || [] };
        llmFullMod.write(syncContext, cwd, { version: VERSION });
        console.warn(`[sigmap] --mode full → llm-full.txt`);
      } else if (activeMode === 'both') {
        const llmTxtMod  = requireSourceOrBundled('./src/format/llm-txt');
        const llmFullMod = requireSourceOrBundled('./packages/adapters/llm-full');
        const llmsMod    = requireSourceOrBundled('./src/format/llms-txt');
        const syncContext = { projectName: path.basename(cwd), fileEntries, srcDirs: config.srcDirs || [] };
        fs.writeFileSync(llmTxtMod.outputPath(cwd),  llmTxtMod.format(syncContext, cwd, VERSION));
        llmFullMod.write(syncContext, cwd, { version: VERSION });
        writeOutputs(content, config.outputs, cwd, config, shrinkForHost);
        const llmsContent = llmsMod.format(syncContext, cwd, [
          { path: llmTxtMod.outputPath(cwd),  label: 'llm.txt' },
          { path: llmFullMod.outputPath(cwd), label: 'llm-full.txt' },
        ], VERSION);
        fs.writeFileSync(llmsMod.outputPath(cwd), llmsContent);
        console.warn(`[sigmap] --mode both → copilot-instructions.md + llm.txt + llm-full.txt + llms.txt`);
      } else {
        writeOutputs(content, config.outputs, cwd, config, shrinkForHost);
      }
      if (formatValue === 'cache') writeCacheOutput(content, cwd, config);

      // --output <file>: write a copy of the formatted context to the custom path.
      if (config.customOutput) {
        try {
          const absCustom = path.resolve(cwd, config.customOutput);
          // Stable-prefix layout (#683): the wall-clock stamp trails the content.
          const stampAtTail = __require('./src/format/cache-layout').resolveLayout(config).value === 'stable-prefix';
          const stamp = `<!-- Updated: ${new Date().toISOString()} -->`;
          const SIGMAP_HEADER = [
            `<!-- Generated by SigMap v${VERSION} -->`,
            ...(stampAtTail ? [] : [stamp]),
            `<!-- Regenerate: node gen-context.js --output ${config.customOutput} -->`,
            '',
          ].join('\n');
          fs.mkdirSync(path.dirname(absCustom), { recursive: true });
          fs.writeFileSync(absCustom, SIGMAP_HEADER + content + (stampAtTail ? '\n' + stamp + '\n' : ''), 'utf8');
          console.warn(`[sigmap] wrote ${path.relative(cwd, absCustom)} (custom output)`);
        } catch (err) {
          console.warn(`[sigmap] --output write failed: ${err.message}`);
        }
      }

      result = { inputTokenTotal, finalTokens, fileCount: beforeCount, droppedCount, cacheFit: buildCacheFit(content, config) };
    }
  } else {
    // report mode: always run full pipeline for accurate stats
    const budgeted = applyTokenBudget([...fileEntries], effectiveMaxTokens, cwd);
    const droppedCount = beforeCount - budgeted.length;
    const content = formatOutput(budgeted, cwd, false, configWithBudget, null);
    const finalTokens = estimateTokens(content);
    // v4.0: compute coverage score for --report heatmap
    let coverageResult = null;
    try {
      const { coverageScore } = requireSourceOrBundled('./src/analysis/coverage-score');
      coverageResult = coverageScore(cwd, budgeted, configWithBudget);
    } catch (_) {}
    result = { inputTokenTotal, finalTokens, fileCount: beforeCount, droppedCount, coverageResult, cacheFit: buildCacheFit(content, configWithBudget) };
  }

  finishExtractionCache();

  // Budget-override notice (#783) — on EVERY path, not only under --report.
  // `autoMaxTokens` defaults to true and silently replaces a pinned budget;
  // the only trace on a default run was the word "auto-scaled" in the coverage
  // line. Gated on `_userKeys` so it speaks only about a value the project
  // actually set: the previous check compared the MERGED maxTokens, so it
  // announced "your maxTokens:6000 was overridden" in repos that had never
  // configured a budget at all.
  if (!reportJson) warnCacheConfig(config);
  if (_pinnedBudgetOverridden(config, effectiveMaxTokens) && !reportJson) {
    console.warn(`[sigmap] note: autoMaxTokens is active — your maxTokens:${config.maxTokens} config was overridden by auto-scaled budget (${effectiveMaxTokens})`);
    console.warn(`  to use your value, set "autoMaxTokens": false in gen-context.config.json`);
  }

  if (reportMode || process.argv.includes('--report')) {
    printReport(result.inputTokenTotal, result.finalTokens, result.fileCount, result.droppedCount, reportJson, effectiveMaxTokens, result.coverageResult, config.autoMaxTokens !== false && effectiveMaxTokens !== config.maxTokens, config.maxTokens, result.cacheFit);
  }

  // Usage tracking (v0.9) — legacy health log, opt-in via config.tracking / --track.
  const trackingEnabled = !!(config.tracking || process.argv.includes('--track'));
  if (trackingEnabled && !reportMode) {
    try {
      const { logRun } = requireSourceOrBundled('./src/tracking/logger');
      logRun({
        version: VERSION,
        fileCount: result.fileCount,
        droppedCount: result.droppedCount,
        rawTokens: result.inputTokenTotal,
        finalTokens: result.finalTokens,
        overBudget: result.finalTokens > effectiveMaxTokens,
        budgetLimit: effectiveMaxTokens,
        autoBudget: config.autoMaxTokens !== false && effectiveMaxTokens !== config.maxTokens,
      }, cwd);
    } catch (err) {
      console.warn(`[sigmap] tracking: ${err.message}`);
    }
  }

  // gain: capture generate savings (separate gain.ndjson; default ON, opt-out).
  if (!reportMode) {
    try {
      const { recordUsage, isTrackingEnabled } = requireSourceOrBundled('./src/tracking/logger');
      if (isTrackingEnabled(config, process.argv)) {
        recordUsage({
          version: VERSION,
          op: 'generate',
          baselineTokens: result.inputTokenTotal,
          actualTokens: result.finalTokens,
          durationMs: Date.now() - __genT0,
        }, cwd);
      }
    } catch (_) { /* gain capture is best-effort */ }
  }

  // Feature 8: post-run summary — 6-line stdout after every normal run
  if (!reportMode
    && !process.argv.includes('--json')
    && !process.argv.includes('--report')
    && !process.argv.includes('--quiet')) {
    const bar  = '\u2500'.repeat(43);
    // Every file the run extracted from, not the part that fit the budget (`fileEntries` is the latter by now).
    const syms = symbolsFound;
    const pct  = result.inputTokenTotal > 0
      ? Math.round((1 - result.finalTokens / result.inputTokenTotal) * 100)
      : 0;
    // v4.0: coverage score in post-run summary
    let coverageLine = '';
    try {
      const { coverageScore, coveragePct } = requireSourceOrBundled('./src/analysis/coverage-score');
      const cov = coverageScore(cwd, fileEntries, configWithBudget);
      const autoBudgetNote = (config.autoMaxTokens !== false && effectiveMaxTokens !== config.maxTokens)
        ? `  [budget: ${effectiveMaxTokens} auto-scaled]`
        : '';
      // Two populations, named, and neither graded by the other's size: what the retrieval index holds
      // (everything the run found symbols in; `sigmap ask` and the MCP tools reach all of it) and what
      // fits the budgeted context file. A complete index is not a D because its prompt view is small.
      if (__indexedSource !== null) {
        const n = (x) => x.toLocaleString();
        const idxPct = coveragePct(__indexedSource, result.fileCount);
        coverageLine = ` Indexed        : ${n(__indexedSource)} of ${n(result.fileCount)} files with symbols (${idxPct}%) \u2014 every one reachable with \`sigmap ask\``;
        const split = config.strategy && config.strategy !== 'full';
        if (!split) {
          coverageLine += `\n In context     : ${n(cov.included)} of ${n(cov.total)} source files (${cov.score}%) fit the context file${autoBudgetNote}`;
          if (cov.score < 40) {
            coverageLine += `\n [sigmap] tip: the rest stay indexed; strategy:"per-module" puts more of them in front of the agent`;
          }
        } else if (config.strategy !== 'index') {
          // The signatures are split across files, not budgeted into one: there is no single "fits the context file".
          coverageLine += `\n In context     : split by strategy "${config.strategy}" (see Output) \u2014 not one budgeted file`;
        } // `index`: the line above this block already says the always-on file holds no signatures

      } else {
        coverageLine = ` Coverage       : ${cov.grade} (${cov.score}%)  \u2014 ${cov.included} of ${cov.total} source files included${autoBudgetNote}`;
        // Extra warning line when coverage is still poor despite auto-scaling
        if (cov.score < 40 && config.strategy !== 'per-module' && config.strategy !== 'hot-cold'
          && config.strategy !== 'index') {
          coverageLine += '\n [sigmap] tip: large repo \u2014 consider strategy:"per-module" for full coverage';
        }
      }
    } catch (_) {}
    const lines = [
      bar,
      ` SigMap v${VERSION}`,
      ` Files scanned  : ${result.fileCount}`,
      ` Symbols found  : ${syms.toLocaleString()}`,
      // A source smaller than the fixed context header produces MORE tokens than it
      // read: `1 - final/raw` is then negative (\u2212872% on a one-file package), a number
      // `gain` records as 0 saved. Say there is no reduction instead of printing it (#918).
      result.finalTokens >= result.inputTokenTotal
        ? ` Token reduction: none  (${result.inputTokenTotal.toLocaleString()} \u2192 ${result.finalTokens.toLocaleString()} \u2014 the fixed context header outweighs a source this small)`
        : ` Token reduction: ${pct}%  (${result.inputTokenTotal.toLocaleString()} \u2192 ${result.finalTokens.toLocaleString()})`,
    ];
    // Under `index` the signatures are not gone, only moved out of the prompt.
    // Reporting the headline percentage without that caveat would overclaim.
    if (config.strategy === 'index') {
      lines.push(' Always-on only : signatures live in .context/sig-index.json — pulled by `sigmap ask`');
    }
    // The roots the run chose and how much of the REPOSITORY they cover: the figure `validate` and `doctor`
    // print too. The "Indexed" and "In context" lines grade populations the detector picked, so a run that
    // indexed 10 of 309 files read 100% on both (#997).
    try {
      const cov = requireSourceOrBundled('./src/analysis/coverage-score');
      const rc = cov.repositoryCoverage(cwd, config);
      if (rc.all > 0) {
        const names = config.srcDirs || [];
        lines.push(` Source roots   : ${names.slice(0, 4).join(', ') || '(none)'}${names.length > 4 ? ` (+${names.length - 4} more)` : ''}`);
        lines.push(` Repository     : ${cov.formatRepositoryCoverage(rc)}`);
        if (rc.pct < 80) {
          const left = rc.byDir.slice(0, 4).map((d) => `${d.dir} (${d.count.toLocaleString('en-US')})`).join(', ');
          lines.push(` [sigmap] \u26a0 ${100 - rc.pct}% of the repository's code is outside the source roots${left ? `: ${left}` : ''} \u2014 widen "srcDirs", or run: sigmap roots --explain`);
        }
      }
    } catch (_) { /* a failed count must not fail a run */ }
    if (coverageLine) lines.push(coverageLine);
    const __written = outputPaths(config.outputs, cwd, config);
    if (__written.length) {
      lines.push(` Output         : ${__written.slice(0, 3).join(', ')}${__written.length > 3 ? ` (+${__written.length - 3} more)` : ''}`);
    }
    lines.push(bar);
    lines.push(` Try: "explain the architecture" \u00b7 "find the auth module"`);
    lines.push(bar, '');
    process.stderr.write(lines.join('\n'));
  }

  // v6.7: Save cache if enabled
  if (config.sigCache && cache) {
    try {
      // #825: drop entries for files that no longer exist before writing the
      // map back, so a deleted file does not survive the full run that
      // `validate` tells the user to perform.
      pruneMissing(cache);
      saveCache(cwd, VERSION, cache);
    } catch (err) {
      console.warn(`[sigmap] cache save failed: ${err.message}`);
    }
  }

  // v7.0.1: count a plain context-generation run for the one-time star nudge.
  // Most users only ever run `sigmap` to build the context file — count that too,
  // not just ask/squeeze. Guard so a monorepo (many runGenerate calls per process)
  // counts as a single run. Interactive only — silent under --json/--report or non-TTY.
  if (!global.__sigmapGenCounted) {
    global.__sigmapGenCounted = true;
    try {
      const { checkStarNudge } = requireSourceOrBundled('./src/nudge');
      const showNudge = !!process.stderr.isTTY
        && !reportJson
        && !process.argv.includes('--json')
        && !process.argv.includes('--report')
        && !process.argv.includes('--quiet');
      checkStarNudge(global.__sigmapRootCwd || cwd, true, { silent: !showNudge });
    } catch (_) {}
  }

  // Each run may be the one that created `.context/`; --watch and the daemon never reach an exit (#947).
  try { requireSourceOrBundled('./src/util/context-dir').ensureSelfIgnore(cwd); } catch (_) {}

  return result;
}

// ---------------------------------------------------------------------------
// Monorepo support
// ---------------------------------------------------------------------------
const MONO_ROOTS  = ['packages', 'apps', 'services', 'libs'];
const PKG_MANIFESTS = ['package.json', 'pyproject.toml', 'Cargo.toml', 'go.mod', 'build.gradle', 'pom.xml', 'requirements.txt'];

function detectMonorepoPackages(cwd, config) {
  const packages = [];
  const seen = new Set();

  const addIfPackage = (pkgPath) => {
    if (seen.has(pkgPath)) return;
    seen.add(pkgPath);
    for (const manifest of PKG_MANIFESTS) {
      if (fs.existsSync(path.join(pkgPath, manifest))) {
        packages.push(pkgPath);
        return;
      }
    }
  };

  // Strategy 1: classic JS monorepo roots (packages/, apps/, services/, libs/)
  for (const monoDir of MONO_ROOTS) {
    const abs = path.join(cwd, monoDir);
    if (!fs.existsSync(abs)) continue;
    let entries;
    try { entries = fs.readdirSync(abs, { withFileTypes: true }); } catch (_) { continue; }
    for (const entry of entries) {
      if (!entry.isDirectory()) continue;
      addIfPackage(path.join(abs, entry.name));
    }
  }

  // Strategy 2: treat each srcDir that has a manifest as its own package
  // (covers server/web/desktop-style layouts)
  if (packages.length === 0 && config && config.srcDirs) {
    for (const srcDir of config.srcDirs) {
      const abs = path.join(cwd, srcDir);
      if (!fs.existsSync(abs)) continue;
      addIfPackage(abs);
    }
  }

  return packages;
}

function runMonorepo(cwd, config) {
  const packages = detectMonorepoPackages(cwd, config);
  if (packages.length === 0) {
    console.warn('[sigmap] no monorepo packages found — checked packages/, apps/, services/, libs/');
    return;
  }
  console.warn(`[sigmap] monorepo: found ${packages.length} packages`);

  for (const pkgPath of packages) {
    const pkgName = path.relative(cwd, pkgPath);
    console.warn(`[sigmap] monorepo: processing ${pkgName}`);
    // Per-package config: scan src/ and package root, inherit outputs from parent config
    const pkgConfig = {
      ...config,
      srcDirs: ['src', 'lib', 'app', '.'],
    };
    try {
      runGenerate(pkgPath, pkgConfig, false);
    } catch (err) {
      console.warn(`[sigmap] monorepo: failed for ${pkgName}: ${err.message}`);
    }
  }
  console.warn(`[sigmap] monorepo: done — wrote context files for ${packages.length} packages`);
}

// ---------------------------------------------------------------------------
// Multi-repo support  (--each)
// Run sigmap independently for every immediate subdirectory that looks like
// an independent git repo or project root.  Each sub-repo gets its own
// context files written inside it, using its own gen-context.config.json
// when present.
// ---------------------------------------------------------------------------
function detectRepoDirs(cwd) {
  let entries;
  try {
    entries = fs.readdirSync(cwd, { withFileTypes: true });
  } catch (_) {
    return [];
  }
  const repos = [];
  for (const entry of entries) {
    if (!entry.isDirectory()) continue;
    if (entry.name.startsWith('.')) continue;
    const abs = path.join(cwd, entry.name);
    // A directory qualifies if it has its own .git folder
    // OR contains a recognised project manifest (fallback for un-initialised repos)
    const hasGit = fs.existsSync(path.join(abs, '.git'));
    const hasManifest = PKG_MANIFESTS.some((m) => fs.existsSync(path.join(abs, m)));
    if (hasGit || hasManifest) repos.push(abs);
  }
  return repos;
}

function runEach(cwd, baseConfig, adapterOverride) {
  const repos = detectRepoDirs(cwd);
  if (repos.length === 0) {
    console.warn('[sigmap] --each: no project subdirectories found');
    console.warn('[sigmap]   A subdirectory qualifies when it contains .git or a package manifest');
    console.warn(`[sigmap]   (package.json / pyproject.toml / Cargo.toml / go.mod / etc.)`);
    return;
  }
  console.warn(`[sigmap] --each: found ${repos.length} repos — ${repos.map((r) => path.basename(r)).join(', ')}`);
  let ok = 0, failed = 0;
  for (const repoDir of repos) {
    const name = path.basename(repoDir);
    // Load each repo's own config independently, fall back to base config
    let repoConfig;
    try {
      repoConfig = loadConfig(repoDir);
    } catch (_) {
      repoConfig = { ...baseConfig };
    }
    // --adapter override: apply on top of per-repo config
    if (adapterOverride) {
      repoConfig = Object.assign({}, repoConfig, {
        outputs: adapterOverride === 'claude' ? ['claude'] : [adapterOverride],
        adapters: [adapterOverride],
      });
    }
    console.warn(`[sigmap] --each: processing ${name} …`);
    try {
      runGenerate(repoDir, repoConfig, false);
      ok++;
    } catch (err) {
      console.warn(`[sigmap] --each: FAILED for ${name}: ${err.message}`);
      failed++;
    }
  }
  console.warn(`[sigmap] --each: done — ${ok} succeeded${failed > 0 ? `, ${failed} failed` : ''}`);
}

// ---------------------------------------------------------------------------
// CLI entry point
// ---------------------------------------------------------------------------
/**
 * Classify a task description and return the recommended model tier.
 *
 * Rules (ordered):
 *  1. Match any 'powerful' keyword → 'powerful'
 *  2. Match any 'fast' keyword     → 'fast'
 *  3. Default                      → 'balanced'
 *
 * Model names and the price span come from the dated model profile, so every
 * name returned is one `gain --model` accepts (#778).
 *
 * @param {string} description - Natural-language task description
 * @param {object} [profile] - from resolveProfile(config); the shipped profile when omitted
 * @returns {{ tier: string, label: string, models: string, modelIds: string[], costHint: string, asOf: string, asOfSource: string, roster: boolean, basis: string }}
 */
function suggestTool(description, profile) {
  const lower = description.toLowerCase();
  const { tierInfo } = __require('./src/routing/hints');
  const { resolveProfile } = __require('./src/config/models');
  const p = profile || resolveProfile();

  const powerfulKeywords = [
    'architecture', 'cross-cutting', 'multi-file', 'security audit', 'owasp',
    'migration plan', 'framework upgrade', 'complex debug', 'async boundar',
    'multi-service', 'distributed system', 'performance audit', 'new module from',
    'redesign', 'from requirements',
  ];
  const fastKeywords = [
    'typo', 'rename symbol', 'format', 'lint', 'style change', 'trivial',
    'quick fix', 'inline suggest', 'autocomplete', 'config file',
    'dockerfile', 'shell script', '.yaml', '.yml', '.json', '.css',
    'html template', 'markup',
  ];

  let tier = 'balanced';
  if (powerfulKeywords.some((kw) => lower.includes(kw))) tier = 'powerful';
  else if (fastKeywords.some((kw) => lower.includes(kw))) tier = 'fast';

  const info = tierInfo(tier, p);
  return {
    tier, label: info.label, models: info.examples, modelIds: info.models, costHint: info.costHint,
    asOf: p.asOf, asOfSource: p.asOfSource, roster: p.rosterDeclared,
    basis: 'static keyword rule + dated model profile — not a measurement',
  };
}

function resolveProjectRoot(startDir) {
  try {
    const gitRoot = __git(['rev-parse', '--show-toplevel'], { cwd: startDir }).trim();
    if (gitRoot) return gitRoot;
  } catch (_) {}
  return startDir;
}

function detectInvokedAs() {
  const argv1 = process.argv[1] || '';
  const base = path.basename(argv1);
  const baseNoExt = base.endsWith('.js') ? base.slice(0, -3) : base;
  // npx: the script path goes through an _npx cache directory
  if (argv1.includes('/_npx/') || argv1.includes('\\_npx\\') ||
      argv1.includes('/.npm/_') || argv1.includes('\\.npm\\_')) {
    return 'npx sigmap';
  }
  // globally-installed bin aliases (no .js extension)
  if (baseNoExt === 'sigmap') return 'sigmap';
  if (baseNoExt === 'gen-context') return 'gen-context';
  // default: local file invocation
  return 'node gen-context.js';
}

/**
 * Every bare-word subcommand the dispatch chain below actually handles.
 *
 * Without this, an unrecognized first argument fell through all 37 `args[0] ===`
 * branches onto the DEFAULT GENERATE path and silently rewrote AGENTS.md,
 * CLAUDE.md, .github/copilot-instructions.md and .github/gemini-context.md with
 * exit 0 — a typo became an unintended write.
 *
 * Both the vocabulary and `--help` now derive from one table (#848). A literal
 * list here claimed to be in sync with help and was not: #661 found twelve
 * shipped commands help never mentioned. Adding a command means adding a
 * `USAGE` row in src/cli/command-table.js — there is nowhere else to add it.
 */
const CLI_TABLE = requireSourceOrBundled('./src/cli/command-table');
const KNOWN_COMMANDS = new Set(CLI_TABLE.commandNames());

/** Commands that only dispatch when a required flag is present. */
const FLAG_GATED_COMMANDS = new Map(CLI_TABLE.flagGated());

/** Levenshtein distance, capped — used only to suggest a near-miss command. */
function _editDistance(a, b) {
  if (a === b) return 0;
  if (Math.abs(a.length - b.length) > 2) return 99;
  let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
  for (let i = 1; i <= a.length; i++) {
    const row = [i];
    for (let j = 1; j <= b.length; j++) {
      row[j] = a[i - 1] === b[j - 1]
        ? prev[j - 1]
        : 1 + Math.min(prev[j - 1], prev[j], row[j - 1]);
    }
    prev = row;
  }
  return prev[b.length];
}

/** Nearest known command within edit distance 2, or null. */
function nearestCommand(word) {
  let best = null;
  let bestDist = 3;
  for (const known of [...KNOWN_COMMANDS, ...FLAG_GATED_COMMANDS.keys()]) {
    const d = _editDistance(word, known);
    if (d < bestDist) { bestDist = d; best = known; }
  }
  return best;
}

/**
 * Reject an unrecognized bare-word subcommand before anything is generated.
 * Returns an error message, or null when `args` should proceed to dispatch.
 */
function unknownCommandError(args, cmd) {
  const word = args[0];
  if (!word || word.startsWith('-')) return null;      // flags + bare invocation
  if (KNOWN_COMMANDS.has(word)) return null;

  const requiredFlag = FLAG_GATED_COMMANDS.get(word);
  if (requiredFlag) {
    if (args.includes(requiredFlag)) return null;
    return `[sigmap] '${word}' requires ${requiredFlag} — run ${cmd} --help`;
  }

  const suggestion = nearestCommand(word);
  const hint = suggestion ? `  Did you mean '${suggestion}'?` : '';
  return `[sigmap] unknown command '${word}' — run ${cmd} --help${hint}`;
}

/**
 * Print `--help`, rendered from the canonical command table (#848).
 *
 * The body used to be a template literal maintained alongside KNOWN_COMMANDS.
 * The adapter line is read from packages/adapters/ for the same reason: the
 * literal it replaced had fallen a release behind and omitted `willow`.
 */
function printHelp(cmd) {
  const { listAdapters } = requireSourceOrBundled('./packages/adapters/index');
  console.log(CLI_TABLE.renderHelp({
    cmd: cmd || 'node gen-context.js',
    version: VERSION,
    adapters: listAdapters(),
  }));
}

// ---------------------------------------------------------------------------
// MCP auto-registration
// ---------------------------------------------------------------------------
function _displayPath(p, cwd) {
  return p.startsWith(os.homedir()) ? '~' + p.slice(os.homedir().length) : path.relative(cwd, p);
}

function registerMcp(cwd, scriptPath) {
  const { CLIENTS, installClient } = requireSourceOrBundled('./src/mcp/install');
  const home = os.homedir();
  const requested = [];
  const add = (client, useGlobal = false) => requested.push({ client, global: useGlobal });
  const exists = (file) => file && fs.existsSync(file);

  if (exists(path.join(cwd, '.mcp.json')) || exists(path.join(cwd, '.claude', 'settings.json'))) add('claude');
  for (const client of ['cursor', 'vscode']) {
    const spec = CLIENTS[client];
    if (spec.project && exists(path.join(cwd, ...spec.project))) add(client);
  }
  const windsurf = CLIENTS.windsurf;
  if (exists(path.join(cwd, ...windsurf.project))) add('windsurf');
  if (exists(path.join(home, ...windsurf.global))) add('windsurf', true);
  const opencode = CLIENTS.opencode;
  if (exists(path.join(cwd, ...opencode.project))) add('opencode');
  if (exists(path.join(home, ...opencode.global)) || exists(path.join(home, '.config', 'opencode', 'config.json'))) add('opencode', true);
  const gemini = CLIENTS.gemini;
  if (exists(path.join(home, ...gemini.global))) add('gemini');
  const zed = CLIENTS.zed;
  if (exists(path.join(home, ...zed.global))) add('zed');
  const codexHome = process.env.CODEX_HOME || path.join(home, '.codex');
  if (exists(path.join(codexHome, 'config.toml')) || exists(path.join(codexHome, 'config.yaml'))) add('codex');

  for (const target of requested) {
    const result = installClient(target.client, { cwd, scriptPath, global: target.global });
    const verb = result.status === 'updated' ? 'migrated SigMap config to' : result.status === 'already' ? 'SigMap already registered in' : 'registered MCP server in';
    console.warn(`[sigmap] ${result.label}: ${verb} ${_displayPath(result.path, cwd)}`);
  }
  console.warn('[sigmap] Claude Code project config: .mcp.json');
  console.warn('[sigmap] Codex CLI config: ~/.codex/config.toml');
  console.warn('[sigmap] OpenCode config: opencode.json or ~/.config/opencode/opencode.json');
}

// ---------------------------------------------------------------------------
// v4.2 helpers
// ---------------------------------------------------------------------------
// Pricing lives in src/tracking/pricing.js (the verified, single-source table
// shared with the `gain` dashboard). The old inline MODEL_COSTS table was
// removed — it disagreed with pricing.js (e.g. gpt-4o at $5 vs $2.50 /Mtok).

function buildMiniContext(ranked, cwd, notesSection) {
  const lines = ['# SigMap Query Context', `Generated: ${new Date().toISOString()}`, ''];
  // Relevant notes lead the context (#776): a human already answered part of
  // this question, and the agent consuming the file should see that first.
  if (notesSection) lines.push(notesSection);
  for (const { file, sigs } of ranked) {
    lines.push(`## ${file}`, '```', ...sigs.slice(0, 20), '```', '');
  }
  return lines.join('\n');
}

// Surgical Context Phase 2 (v6.12.0): collapse one signature to a symbol-header
// pointer — `<declaration head>  :start-end` — dropping param lists, return types,
// and any body so the agent fetches the real lines on demand via the get_lines MCP tool.
function toIndexLine(sig) {
  if (typeof sig !== 'string') return '';
  // Anchor is `:start-end`, optionally followed by a `# doc hint` (Python extractor).
  const m = sig.match(/\s*:(\d+)-(\d+)(?:\s*#.*)?\s*$/);
  if (!m) {
    // No anchor (e.g. an indented member) — keep a trimmed head so it stays listed.
    return sig.trim().slice(0, 60);
  }
  const range = `:${m[1]}-${m[2]}`;
  let head = sig.slice(0, m.index).trim();
  const paren = head.indexOf('(');
  if (paren > 0) head = head.slice(0, paren).trim();      // drop params
  head = head.replace(/\s*[=→].*$/, '').trim();           // drop return type / assignment tail
  return head ? `${head}  ${range}` : range;
}

// Two-tier index output: emit only `file → [symbol:start-end]` headers (no bodies).
function buildIndexContext(ranked, cwd) {
  const lines = [
    '# SigMap Query Context (index mode)',
    `Generated: ${new Date().toISOString()}`,
    '> Symbol index only — fetch exact lines on demand via the `get_lines` MCP tool.',
    '',
  ];
  for (const { file, sigs } of ranked) {
    const idx = sigs.slice(0, 40).map(toIndexLine).filter(Boolean);
    lines.push(`## ${file}`, '```', ...idx, '```', '');
  }
  return lines.join('\n');
}

// `ask` printed `Risk : NONE` whether or not anything had been assessed (#806):
// outside a git repo the check throws and the old code answered 'UNKNOWN', but
// inside one a clean tree and a failed probe were both rendered as reassurance
// next to a coverage figure about an unrelated population. The level is now
// returned with the evidence behind it, so the renderer can say `not assessed`
// when nothing ran and name the basis when something did.
function computeCurrentRisk(cwd) {
  let count;
  try {
    const out = __git(['diff', '--name-only', 'HEAD'], { cwd, timeout: 3000 });
    count = out.trim().split('\n').filter(Boolean).length;
  } catch (_) { return { level: 'UNKNOWN', assessed: false, changed: null }; }
  // One scale for every `Risk` figure (#966): the default `ask` line applies it to the
  // selected files, `--verbose` to the whole tree.
  return { level: requireSourceOrBundled('./src/format/ask-output').riskLevel(count), assessed: true, changed: count };
}

// Which of `files` (as `ask` ranks them: relative to `cwd`) differ from HEAD. Never throws:
// no git, no answer, nothing flagged.
function changedAmong(cwd, files) {
  try {
    // `-z`: git quotes a path with non-ASCII characters (`"src/caf\303\251.js"`) unless
    // it is told not to, and a quoted path matches nothing the ranker printed.
    // `--relative`: git prints paths from the repo root, but `cwd` is only the git toplevel
    // when it was resolved (resolveProjectRoot); `--cwd <dir>` is taken as given, and the
    // ranked paths are then relative to <dir>. This makes git speak the same paths, and drops
    // changes outside <dir>, which cannot be in the selection.
    const out = __git(['diff', '--name-only', '-z', '--relative', 'HEAD'], { cwd, timeout: 3000 });
    const key = (p) => String(p).replace(/\\/g, '/').normalize('NFC');
    const changed = new Set(out.split('\0').filter(Boolean).map(key));
    return files.filter((f) => changed.has(key(f)));
  } catch (_) { return []; }
}

function getRawTokenCount(cwd, config) {
  let total = 0;
  const files = buildFileList(cwd, config);
  for (const fp of files) {
    try { total += estimateTokens(fs.readFileSync(fp, 'utf8')); } catch (_) {}
  }
  return total;
}

// Intent no longer selects scoring weights — the per-intent multipliers were
// measured to have zero effect on ranking (see src/retrieval/ranker.js).
// Kept as a single call site so the ask handler keeps one weights source.
function getIntentWeights(_intent) {
  const { DEFAULT_WEIGHTS } = requireSourceOrBundled('./src/retrieval/ranker');
  return Object.assign({}, DEFAULT_WEIGHTS);
}

function extractQuerySymbols(query) {
  return (query.match(/\b[A-Z][a-zA-Z]+|[a-z]+(?:[A-Z][a-z]+)+\b/g) || []);
}

function collectLearnFiles(args, flag, cwd) {
  const idx = args.indexOf(flag);
  if (idx < 0) return { rawCount: 0, files: [], warnings: [] };

  const { normalizeFile } = requireSourceOrBundled('./src/learning/weights');
  const seen = new Set();
  const files = [];
  const warnings = [];
  let rawCount = 0;

  for (let i = idx + 1; i < args.length; i++) {
    const value = args[i];
    if (!value || value.startsWith('--')) break;
    rawCount++;
    const normalized = normalizeFile(cwd, value);
    if (!normalized) {
      warnings.push(`${value} is outside the repo`);
      continue;
    }
    if (!fs.existsSync(path.join(cwd, normalized))) {
      warnings.push(`${normalized} does not exist`);
      continue;
    }
    if (!seen.has(normalized)) {
      seen.add(normalized);
      files.push(normalized);
    }
  }

  return { rawCount, files, warnings };
}

function main() {
  const args = process.argv.slice(2);

  // Feature 1: `sigmap run` alias — strip positional 'run' so existing logic handles it
  if (args[0] === 'run' && !args[0].startsWith('--')) {
    args.shift();
  }

  const invokedFrom = process.cwd();

  // `sigmap session hook <event>` (#922) runs inside a host agent's lifecycle, so it is handled
  // FIRST — before project-root resolution and before loadConfig. A malformed config, or an
  // `extends` URL (which loadConfig fetches synchronously, with a 10 s timeout), must not be
  // able to fail or stall it. It reads only the `session` and `contextTtlDays` keys straight
  // from gen-context.config.json (an `extends` is not followed) and EVERY path exits 0.
  // The destructuring keeps it out of the dispatch-region scan, which looks for `args[0] ===`.
  const [__cmd, __sub, __event] = args;
  if (__cmd === 'session' && __sub === 'hook') {
    process.on('uncaughtException', () => process.exit(0));
    let finished = false;
    let raw = '';
    const finish = () => {
      if (finished) return;
      finished = true;
      let stdout = null;
      try {
        let payload = null;
        try { payload = JSON.parse(raw); } catch (_) { /* a bad payload is a no-op */ }
        const base = process.env.CLAUDE_PROJECT_DIR || (payload && typeof payload.cwd === 'string' ? payload.cwd : null) || invokedFrom;
        let root = invokedFrom;
        if (path.isAbsolute(base) && fs.existsSync(base) && fs.statSync(base).isDirectory()) {
          root = base;
          try { root = resolveProjectRoot(base); } catch (_) { /* keep the directory as given */ }
        }
        const hookConfig = {};
        try {
          const userConfig = JSON.parse(fs.readFileSync(path.join(root, 'gen-context.config.json'), 'utf8'));
          if (userConfig && typeof userConfig === 'object') {
            if (userConfig.session && typeof userConfig.session === 'object') hookConfig.session = userConfig.session;
            if (Number.isFinite(userConfig.contextTtlDays)) hookConfig.contextTtlDays = userConfig.contextTtlDays;
          }
        } catch (_) { /* no config, or not JSON: defaults */ }
        const { handleHook } = requireSourceOrBundled('./src/session/capture');
        stdout = handleHook(__event, payload, root, { config: hookConfig }).stdout;
        // The session store lives in .context/ and can be the first thing written there (#947).
        requireSourceOrBundled('./src/util/context-dir').ensureSelfIgnore(root);
      } catch (_) { /* never fail the host session */ }
      if (stdout) process.stdout.write(stdout + '\n', () => process.exit(0));
      else process.exit(0);
    };
    if (process.stdin.isTTY) {
      finish();
    } else {
      process.stdin.setEncoding('utf8');
      process.stdin.on('data', (chunk) => { raw += chunk; if (raw.length > 1048576) finish(); });
      process.stdin.on('end', finish);
      process.stdin.on('error', finish);
    }
    setTimeout(finish, 1500); // a payload that never closes must not hang the host
    return;
  }

  // --cwd <dir>: restrict scanning to that directory instead of the project root
  const cwdFlagIdx = args.indexOf('--cwd');
  const cwdFlag = cwdFlagIdx !== -1 ? (args[cwdFlagIdx + 1] || '').trim() : null;
  if (cwdFlag !== null && (!cwdFlag || cwdFlag.startsWith('--'))) {
    console.error('[sigmap] --cwd requires a directory path');
    process.exit(1);
  }
  const cwd = cwdFlag
    ? path.resolve(invokedFrom, cwdFlag)
    : resolveProjectRoot(invokedFrom);
  // v7.0.1: remember the invocation root so the generation star-nudge always tracks
  // usage at the repo root, even when runGenerate is called per-package (monorepo).
  global.__sigmapRootCwd = cwd;
  const scriptPath = process.argv[1] || path.join(invokedFrom, 'gen-context.js');

  // `.context/` keeps itself out of git (#947): now, in case it already exists, and again at
  // exit, by when a command that created it has finished. Every command path ends in
  // process.exit(), which runs 'exit' listeners; the MCP server and runGenerate (the --watch
  // and daemon loops, which a SIGINT ends without one) call it themselves.
  try {
    const { ensureSelfIgnore } = requireSourceOrBundled('./src/util/context-dir');
    ensureSelfIgnore(cwd);
    process.on('exit', () => { try { ensureSelfIgnore(cwd); } catch (_) {} });
  } catch (_) {}

  if (cwdFlag) {
    if (!fs.existsSync(cwd)) {
      console.error(`[sigmap] --cwd directory does not exist: ${cwd}`);
      process.exit(1);
    }
    if (!fs.statSync(cwd).isDirectory()) {
      console.error(`[sigmap] --cwd must be a directory, not a file: ${cwd}`);
      process.exit(1);
    }
    console.warn(`[sigmap] --cwd: restricting scan to ${cwd}`);
  } else if (cwd !== invokedFrom) {
    console.warn(`[sigmap] using project root: ${cwd}`);
  }

  if (args.includes('--help') || args.includes('-h')) {
    printHelp(detectInvokedAs());
    process.exit(0);
  }

  if (args.includes('--version') || args.includes('-v')) {
    console.log(VERSION);
    process.exit(0);
  }

  // Reject typo'd subcommands BEFORE any generate path can write files.
  const cmdError = unknownCommandError(args, detectInvokedAs());
  if (cmdError) {
    console.error(cmdError);
    process.exit(1);
  }

  // MCP server — start before loading config (reads files on demand)
  if (args.includes('--mcp')) {
    const { start } = __require('./src/mcp/server');
    start(cwd);
    return; // keep process alive — server drives lifecycle via stdin
  }

  const config = loadConfig(cwd);

  // --cwd restricts scanning: override srcDirs so only the given directory is scanned
  if (cwdFlag) {
    config.srcDirs = ['.'];
  }

  // --coverage: enable test coverage annotation without editing config
  if (args.includes('--coverage')) {
    config.testCoverage = true;
  }

  // --terse: compact signature encoding without editing config (D7)
  if (args.includes('--terse')) {
    config.terse = true;
  }

  // ── --output <file> — parse early so every subsequent block can use it ─────
  // Resolves the custom output path and merges it into config.customOutput.
  // Also persists the resolved relative path to gen-context.config.json so
  // future --query calls (without --output) find the file automatically.
  (function resolveOutputFlag() {
    const outIdx = args.indexOf('--output');
    if (outIdx < 0) return;
    const raw = (args[outIdx + 1] || '').trim();
    if (!raw || raw.startsWith('--')) {
      console.error('[sigmap] --output requires a file path');
      console.error('  Example: node gen-context.js --output .context/ai-context.md');
      process.exit(1);
    }
    const abs  = path.resolve(cwd, raw);
    const rel  = path.relative(cwd, abs);
    config.customOutput = rel; // consumed by runGenerate

    // Persist to gen-context.config.json for future --query calls
    const cfgPath = path.join(cwd, 'gen-context.config.json');
    try {
      let savedCfg = {};
      if (fs.existsSync(cfgPath)) {
        try { savedCfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8')); } catch (_) {}
      }
      if (savedCfg.customOutput !== rel) {
        savedCfg.customOutput = rel;
        fs.writeFileSync(cfgPath, JSON.stringify(savedCfg, null, 2) + '\n', 'utf8');
      }
    } catch (err) {
      console.warn(`[sigmap] could not persist customOutput to config: ${err.message}`);
    }
  })();

  // Feature 2: `--mode fast|full|both`
  const modeIdx = args.indexOf('--mode');
  const mode = modeIdx !== -1
    ? args[modeIdx + 1]
    : (config.mode || 'default');
  const VALID_MODES = ['default', 'fast', 'full', 'both', 'index'];
  if (mode && !VALID_MODES.includes(mode)) {
    console.error(`[sigmap] unknown --mode "${mode}". Valid: ${VALID_MODES.join(', ')}`);
    process.exit(1);
  }

  // v4.2: `sigmap ask "<query>"` — unified pipeline
  if (args[0] === 'ask') {
    const __askT0 = Date.now();
    // v6.8: Handle --followup flag which may appear before or after query
    let query = args[1];
    if (query === '--followup' && args[2]) {
      query = args[2];
    } else if (query && query.startsWith('--') && query !== '--json' && query !== '--model') {
      // Allow --json and --model but not other flags as query
      console.error('[sigmap] Usage: sigmap ask "<query>" [--followup] [--json] [--verbose] [--explain] [--with-source] [--model <name>]');
      console.error('  Example: sigmap ask "fix the login bug" --followup');
      process.exit(1);
    }
    if (!query || query.startsWith('--')) {
      console.error('[sigmap] Usage: sigmap ask "<query>" [--followup] [--json] [--verbose] [--explain] [--with-source] [--model <name>] [--top <n>]');
      console.error('  Example: sigmap ask "fix the login bug" --followup');
      process.exit(1);
    }

    // `--top <n>` (#775) — documented in --help and parsed by `--query` and
    // `evidence`, but `ask` hardcoded topK: 5 and ignored it, so `--top 2` and
    // `--top 20` returned byte-identical context. An invalid value is an error
    // rather than a silent fall back to the default: silently doing something
    // other than what the flag said is the defect being fixed.
    let askTopK = 5;
    const __topIdx = args.indexOf('--top');
    if (__topIdx !== -1) {
      const raw = args[__topIdx + 1];
      const n = Number(raw);
      if (!raw || raw.startsWith('--') || !Number.isInteger(n) || n < 1) {
        console.error(`[sigmap] --top requires a positive integer (got: ${raw === undefined ? '<missing>' : raw})`);
        process.exit(1);
      }
      askTopK = n;
    }

    const { detectIntent, detectIntents, buildSigIndex, rank } = requireSourceOrBundled('./src/retrieval/ranker');
    const { coverageScore, formatCoverage } = requireSourceOrBundled('./src/analysis/coverage-score');

    // `ask --with-source` (#814): opt-in symbol bodies + blast radius. Default
    // output is untouched — anything that ADDS tokens has to be asked for.
    // The budget is the project's existing `maxTokens` knob minus what the
    // signature context already spent, so there is no second budget to tune;
    // `--source-budget <n>` overrides it for a one-off deep read.
    const __withSource = args.includes('--with-source');
    const __srcBudgetIdx = args.indexOf('--source-budget');
    const __srcBudgetFlag = (__srcBudgetIdx !== -1 && args[__srcBudgetIdx + 1] && !args[__srcBudgetIdx + 1].startsWith('--'))
      ? parseInt(args[__srcBudgetIdx + 1], 10)
      : null;
    const { loadSession, saveSession, mergeSessionContext } = requireSourceOrBundled('./src/session/memory');
    const { detectWorkspaces, inferPackage, scopeToPackage } = requireSourceOrBundled('./src/workspace/detector');

    let intent = detectIntent(query);
    let intentWeights = getIntentWeights(intent);

    const sigIndex = buildSigIndex(cwd);
    if (sigIndex.size === 0) {
      console.error('[sigmap] no context file found. Run: sigmap  (to generate first)');
      process.exit(1);
    }

    // v7.0.0: Squeeze — classify and minimize pasted stacktrace/CI-log/JSON
    // input before ranking. Always runs silently; only prompts (interactive
    // TTY) when the reduction clears the threshold. Never blocks pipes/CI.
    let squeezeOffered = false;
    let squeezeAccepted = false;
    if (!args.includes('--no-squeeze')) {
      try {
        const { squeeze: runSqueeze, shouldPrompt, formatSummary } = requireSourceOrBundled('./src/squeeze/index');
        const sq = runSqueeze(query, { srcDirs: config.srcDirs, symbolIndex: sigIndex });
        if (sq.applies && sq.reduction > 0) {
          squeezeOffered = true;
          const thrIdx = args.indexOf('--squeeze-threshold');
          const threshold = thrIdx !== -1 ? parseFloat(args[thrIdx + 1]) : 30;
          const auto = args.includes('--squeeze');
          const interactive = !!(process.stdin.isTTY && process.stderr.isTTY) && !args.includes('--json');
          let accept = false;
          if (auto) {
            accept = true;
          } else if (interactive && shouldPrompt(sq.reduction, threshold)) {
            process.stderr.write('\n' + formatSummary(sq) + '\n\n');
            process.stderr.write('Proceed with minimized input? [Y/n] ');
            const buf = Buffer.alloc(8);
            try {
              const n = fs.readSync(0, buf, 0, 8, null);
              const ans = buf.toString('utf8', 0, n).trim().toLowerCase();
              accept = ans === '' || ans === 'y' || ans === 'yes';
            } catch (_) { accept = false; }
          }
          if (accept) {
            query = sq.squeezed;
            intent = detectIntent(query);
            intentWeights = getIntentWeights(intent);
            squeezeAccepted = true;
          }
        }
      } catch (_) { /* squeeze is best-effort — never break ask */ }
    }

    // Opt-in call-graph neighbor boost (retrieval.callGraphBoost) — non-fatal
    let askCallGraph = null;
    if (config && config.retrieval && config.retrieval.callGraphBoost) {
      try { askCallGraph = requireSourceOrBundled('./src/graph/call-graph').buildRankingCallFileGraph(cwd); } catch (_) {}
    }
    // Opt-in route surface-enrichment (retrieval.surfaceEnrichment) — non-fatal
    if (config && config.retrieval && config.retrieval.surfaceEnrichment) {
      try { requireSourceOrBundled('./src/retrieval/enrich-from-maps').enrichWithSurfaces(sigIndex, cwd); } catch (_) {}
    }
    // Opt-in import-graph centrality blend (retrieval.centralityBlend) — non-fatal
    let askCentrality = null;
    if (config && config.retrieval && config.retrieval.centralityBlend) {
      try {
        const askCentralityGraph = requireSourceOrBundled('./src/graph/builder').buildRankingGraph(cwd);
        askCentrality = requireSourceOrBundled('./src/graph/centrality').computeCentrality(askCentralityGraph);
      } catch (_) {}
    }

    // Opt-in repo-mined query expansion (retrieval.minedExpansions) — non-fatal
    let askExpansions = null;
    if (config && config.retrieval && config.retrieval.minedExpansions) {
      try { askExpansions = requireSourceOrBundled('./src/retrieval/mined-expansions').loadOrMine(cwd).expansions; } catch (_) {}
    }
    // Body words (retrieval.bodyWords, on by default) — non-fatal
    let askBodyWords = null;
    if (config && config.retrieval && config.retrieval.bodyWords) {
      try { askBodyWords = requireSourceOrBundled('./src/retrieval/body-words').loadOrBuild(cwd, sigIndex); } catch (_) {}
    }

    // Notes as a retrieval signal (#776). `sigmap note` wrote human-authored
    // facts that nothing in the retrieval path ever read. A note matching the
    // query now boosts the files it names and is rendered into the emitted
    // context. Ranking a WIDER pool first matters: `rank()` slices to topK, so
    // boosting afterwards could never lift a noted file INTO the selection —
    // which is the whole point. With no relevant note the pool collapses back
    // to askTopK and the result is byte-identical to before.
    let __relevantNotes = [];
    try {
      const { readNotes } = requireSourceOrBundled('./src/session/notes');
      const { selectRelevant } = requireSourceOrBundled('./src/session/note-relevance');
      __relevantNotes = selectRelevant(readNotes(cwd), query);
    } catch (_) { __relevantNotes = []; }

    const __poolK = __relevantNotes.length > 0 ? Math.max(askTopK * 4, 25) : askTopK;
    const __explain = args.includes('--explain');
    let ranked = rank(query, sigIndex, { topK: __poolK, weights: intentWeights, cwd, callGraph: askCallGraph, centrality: askCentrality, expansions: askExpansions, bodyWords: askBodyWords, explain: __explain, includeZeroScore: __relevantNotes.length > 0 });
    // `rank()` hangs the explain surfaces off the returned ARRAY, and every
    // re-ranking step below (.map/.slice/.filter) builds a fresh array, so they
    // are captured here and re-attached to the final selection. Explaining the
    // pre-boost ranking would show a different order than `ask` actually used.
    const __explainMeta = __explain
      ? { nearMiss: ranked.nearMiss, tokenCoverage: ranked.tokenCoverage, pathIdf: ranked.pathIdf, totalCandidates: ranked.totalCandidates, indexSize: ranked.indexSize }
      : null;
    if (__relevantNotes.length > 0) {
      const { applyNoteBoost } = requireSourceOrBundled('./src/session/note-relevance');
      // The wider pool was ranked with includeZeroScore so a noted file could
      // be lifted; anything the note did NOT lift is still a non-match and is
      // dropped here, so zero-score rows never reach the selection (#807).
      ranked = applyNoteBoost(ranked, __relevantNotes).filter((r) => r.score > 0).slice(0, askTopK);
    }

    // v6.10: Workspace scoping — infer package from query and apply boost
    const workspaces = detectWorkspaces(cwd);
    const packageFlag = args[args.indexOf('--package') + 1];
    const globalFlag = args.includes('--global');

    let inferredPackage = null;
    if (!globalFlag && workspaces.length > 0) {
      if (packageFlag) {
        inferredPackage = workspaces.find(d => path.basename(d) === packageFlag) || null;
        if (!packageFlag || !inferredPackage) {
          process.stderr.write(`[sigmap] ⚠  package "${packageFlag}" not found — searching entire repo\n`);
        }
      } else {
        inferredPackage = inferPackage(query, workspaces, cwd);
      }
    }

    if (inferredPackage) {
      ranked = ranked.map(r => ({
        ...r,
        score: r.score + scopeToPackage(r.file, inferredPackage),
      })).sort((a, b) => b.score - a.score);

      if (!args.includes('--json') && !globalFlag) {
        process.stderr.write(`[sigmap] 📦 package scope: ${path.relative(cwd, inferredPackage)}\n`);
      }
    }

    // v6.8: --followup support — carry session context forward
    const isFollowup = args.includes('--followup');
    const session = isFollowup ? loadSession(cwd) : null;
    if (session) {
      ranked = mergeSessionContext(ranked, session, intent);
      ranked.sort((a, b) => b.score - a.score);
      if (!args.includes('--json')) {
        process.stderr.write(`[sigmap] ♻  followup — carrying context from: "${session.lastQuery.slice(0, 60)}"\n`);
      }
    }

    // v6.12: Delta context — restrict to files changed since a git ref (--since <ref>).
    const sinceIdx = args.indexOf('--since');
    let __sinceEmptied = null; // #966: the filter, not the query, left nothing — the empty hint must say so
    if (sinceIdx !== -1 && args[sinceIdx + 1]) {
      const baseRef = args[sinceIdx + 1];
      const changed = getFilesChangedSinceBase(cwd, baseRef);
      const before = ranked.length;
      ranked = ranked.filter((r) => changed.has(path.resolve(cwd, r.file)));
      if (before > 0 && ranked.length === 0) __sinceEmptied = { before, ref: baseRef };
      if (!args.includes('--json')) {
        process.stderr.write(`[sigmap] Δ since ${baseRef}: ${ranked.length}/${before} ranked files changed\n`);
      }
    }

    // `ask --explain` (#813): opt-in diagnostic view. Rendered after every
    // re-rank so it explains the order `ask` would really have used, and
    // returned before the context write so a diagnostic run has no side
    // effects on .context/ or the session.
    if (__explain) {
      const { formatExplainTable } = requireSourceOrBundled('./src/retrieval/ranker');
      const __view = ranked.slice(0, askTopK);
      Object.assign(__view, __explainMeta);
      writeAll(1, formatExplainTable(__view, query));
      process.exit(0);
    }

    // v6.8: Save session for future --followup calls
    saveSession(cwd, { intent, topFiles: ranked.slice(0, 5).map(r => ({ file: r.file, score: r.score })), query });
    // v6.12: Two-tier output — `--mode index` emits symbol pointers only (bodies via get_lines).
    const indexMode = mode === 'index' || args.includes('--index');
    const __notesSection = __relevantNotes.length > 0
      ? requireSourceOrBundled('./src/session/note-relevance').formatNotesSection(__relevantNotes)
      : '';
    const miniCtx = indexMode ? buildIndexContext(ranked, cwd) : buildMiniContext(ranked, cwd, __notesSection);
    const outPath = path.join(cwd, '.context', 'query-context.md');
    fs.mkdirSync(path.dirname(outPath), { recursive: true });

    // --with-source (#814): the signature context is written first, then the
    // bodies are budgeted against whatever room is left under `maxTokens`, so
    // the addendum can never push the signatures themselves over the ceiling.
    let __sourceSection = null;
    let __fullCtx = miniCtx;
    if (__withSource) {
      const __sigTok = estimateTokens(miniCtx);
      const __ceiling = Number.isFinite(__srcBudgetFlag) && __srcBudgetFlag > 0
        ? __srcBudgetFlag
        : Math.max(0, (config.maxTokens || 6000) - __sigTok);
      try {
        const { buildSourceSection } = requireSourceOrBundled('./src/retrieval/with-source');
        __sourceSection = buildSourceSection(ranked, cwd, {
          budgetTokens: __ceiling, srcDirs: config.srcDirs, exclude: config.exclude,
        });
        if (__sourceSection.text) __fullCtx = `${miniCtx}\n${__sourceSection.text}`;
      } catch (err) {
        process.stderr.write(`[sigmap] \u26a0  --with-source unavailable: ${err.message}\n`);
        __sourceSection = null;
      }
    }

    fs.writeFileSync(outPath, __fullCtx, 'utf8');
    const ctxTok = estimateTokens(__fullCtx);

    const allFiles = buildFileList(cwd, config);
    const fakeEntries = allFiles.map((f) => ({ filePath: f }));
    // #806: this figure was printed as a bare `Coverage : 100%` directly under
    // the answer, where it reads as "the right files were found". It is not
    // that measurement at all — the entries fed in are every file the scan
    // found, so it reports how much of srcDirs is readable, and it is 100% in
    // any healthy repo regardless of what the query returned. The #762
    // precedent applies: the defect is the missing population, not the number.
    let __cov = null;
    let coveragePct = 0;
    try {
      __cov = coverageScore(cwd, fakeEntries, config);
      coveragePct = __cov.score;
    } catch (_) {}

    // Realistic baseline: the full content of the files SigMap actually surfaced
    // for this query. Without SigMap you'd read these files in full; SigMap gives
    // you their signatures instead — so this is the true per-query saving. Falls
    // back to the whole-repo count only if nothing ranked.
    let rawTok = 0;
    for (const r of ranked) {
      try { rawTok += estimateTokens(fs.readFileSync(path.join(cwd, r.file), 'utf8')); } catch (_) {}
    }
    if (rawTok === 0) rawTok = getRawTokenCount(cwd, config);
    const savings = rawTok > 0 ? Math.round((1 - ctxTok / rawTok) * 100) : 0;
    const __mIdx = args.indexOf('--model');
    const model = (__mIdx !== -1 && args[__mIdx + 1] && !args[__mIdx + 1].startsWith('--')) ? args[__mIdx + 1] : 'gpt-4o';
    // Single source of truth for pricing — the verified pricing.js table, shared
    // with the `gain` dashboard (previously an inline MODEL_COSTS table disagreed
    // with it, e.g. gpt-4o priced at $5/Mtok here vs $2.50/Mtok there).
    const { resolvePrice: __resolvePrice } = requireSourceOrBundled('./src/tracking/pricing');
    const __askModels = requireSourceOrBundled('./src/config/models');
    const __askProfile = __askModels.resolveProfile(config);
    const __price = __resolvePrice(model, __askProfile);
    // #688: the cost applies the priced model's charsPerToken when one is
    // configured; without one it rests on the chars/4 count and says so.
    const __tokBasis = __askModels.tokenBasis(__askProfile, __price.model);
    const rateK = (__price.perMtok / 1000) * __tokBasis.scale; // USD per 1K chars/4 tokens
    const costRaw = ((rawTok / 1000) * rateK).toFixed(4);
    const costCtx = ((ctxTok / 1000) * rateK).toFixed(4);

    const __risk = computeCurrentRisk(cwd);
    const riskLevel = __risk.level;

    // #806: did the selection contain any implementation at all? Neither the
    // coverage figure nor the risk figure ever asked, and that is the one
    // question a reader is actually using them to answer.
    const { classifySelection, selectionWarning, formatComposition } =
      requireSourceOrBundled('./src/retrieval/selection-quality');
    const __selectionClass = classifySelection(ranked);
    const __selectionWarning = selectionWarning(__selectionClass);

    // #815: `judge` has warned about a stale index since v8.54.2 (#780); the
    // retrieval surfaces answered from the same ground in silence. Shared
    // module, so "stale" has one definition across judge, ask and MCP.
    let __staleWarn = null;
    try {
      const __cs = requireSourceOrBundled('./src/judge/context-source');
      const __ctxFile = __cs.resolveContextFile(cwd);
      if (__ctxFile) {
        __staleWarn = __cs.stalenessWarning(
          __cs.contextStaleness(__ctxFile, cwd, config, { honorOverlay: true }),
          { tail: __cs.STALE_TAILS.ask }
        );
      }
    } catch (_) {} // advisory: never fail an answer over its own freshness check

    // Reproducibility (#775): an `ask` result reported tokens and cost but never
    // which files it chose, where the cut fell, or a hash of what it emitted —
    // so the result could not be audited or reproduced from its own output.
    // The hash covers the written context with the `Generated:` timestamp line
    // removed, so the same query over the same repo hashes identically.
    const __selection = (() => {
      const count = Array.isArray(ranked) ? ranked.length : 0;
      const last = count > 0 ? ranked[count - 1] : null;
      const cutoff = last && typeof last.score === 'number' ? Math.round(last.score * 1000) / 1000 : null;
      // `crypto` is resolved OUTSIDE the guard on purpose: only a missing or
      // unreadable context file is an expected failure here, and a bare catch
      // around both would hide a coding error as "unavailable" — the same
      // silent-failure shape this issue exists to remove.
      const _crypto = require('crypto');
      let body = null;
      try { body = fs.readFileSync(outPath, 'utf8'); } catch (_) {}
      const hash = body === null
        ? 'sha256:unavailable'
        : 'sha256:' + _crypto.createHash('sha256').update(body.replace(/^Generated:.*$/m, '')).digest('hex').slice(0, 12);
      return { count, cutoff, hash };
    })();

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify({
        intent, coverage: coveragePct, contextTokens: ctxTok,
        // #806: the bare `coverage` number is kept for compatibility and now
        // ships with the population it measures, so a consumer cannot read it
        // as "the query found the right files".
        coveragePopulation: 'readable',
        coverageIncluded: __cov ? __cov.included : null,
        coverageTotal: __cov ? __cov.total : null,
        coverageBasis: 'share of source files under srcDirs that are readable — NOT whether the query found the right files',
        costBefore: costRaw, costAfter: costCtx, savingsPct: savings,
        pricedModel: __price.model,
        priceAsOf: __price.asOf,
        tokenBasis: __tokBasis.label,
        costBasis: 'estimate — counterfactual = full content of ranked files; input tokens only',
        riskLevel, riskAssessed: __risk.assessed, riskChangedFiles: __risk.changed,
        riskBasis: 'files changed in the working tree vs HEAD',
        sourceFiles: __selectionClass.source.length,
        supportFiles: __selectionClass.support.length,
        sourceFree: __selectionClass.sourceFree,
        stale: __staleWarn !== null, staleWarning: __staleWarn,
        withSource: __withSource,
        source: __sourceSection ? {
          included: __sourceSection.included, skipped: __sourceSection.skipped,
          candidates: __sourceSection.candidates, budgetTokens: __sourceSection.budgetTokens,
          spentTokens: __sourceSection.spentTokens, truncated: __sourceSection.truncated,
          blast: __sourceSection.blast,
        } : null,
        contextPath: path.relative(cwd, outPath),
        // #662: `cli.md` has documented `rankedFiles` since before v8.54.2 and
        // nothing ever emitted it, so a consumer written against the documented
        // contract got `undefined`. `ask` was also the one command whose ranked
        // selection could not be read back from its own JSON — `selectedFiles`
        // is a count and `contextPath` is a file to re-parse. Same per-result
        // shape `--query --json` uses, minus `sigs`: those are already in the
        // context file this very run wrote, and duplicating them would double
        // the payload for no new information. Scores are rounded exactly as
        // `cutoffScore` is, so a row and the cutoff compare as equals.
        rankedFiles: (ranked || []).map((r, i) => ({
          rank: i + 1,
          file: r.file,
          score: typeof r.score === 'number' ? Math.round(r.score * 1000) / 1000 : null,
          tokens: typeof r.tokens === 'number' ? r.tokens : null,
        })),
        topK: askTopK, selectedFiles: __selection.count, cutoffScore: __selection.cutoff,
        notes: __relevantNotes.map((n) => ({ text: n.text, score: n.score, paths: n.paths })),
        contextHash: __selection.hash,
      }) + '\n');
    } else {
      if (coveragePct < 70) {
        process.stderr.write(`[sigmap] ⚠  coverage ${coveragePct}% — consider running: sigmap validate\n`);
      }
      // Both warnings go to stderr so they cannot corrupt a piped context path,
      // and both are printed BEFORE the table: a reader who stops at the first
      // line still sees that the ground under it is in question.
      if (__staleWarn) {
        process.stderr.write(`[sigmap] ⚠  ${__staleWarn}\n`);
      }
      if (__selectionWarning) {
        process.stderr.write(`[sigmap] ⚠  ${__selectionWarning}\n`);
      }
      const __ao = requireSourceOrBundled('./src/format/ask-output');
      const __list = __ao.formatRankedList(ranked);
      const bar = '─'.repeat(44);
      const __box = [
        bar,
        ` sigmap ask  "${query}"`,
        ` Intent    : ${detectIntents(query).join(', ')}`,
        ` Context   : ${ctxTok.toLocaleString()} tokens  →  ${path.relative(cwd, outPath)}`,
        ` Selected  : ${__selection.count} of ${sigIndex.size} file(s) (--top ${askTopK})${__selection.cutoff !== null ? ` · cutoff score ${__selection.cutoff}` : ''}`,
        ` Hash      : ${__selection.hash}`,
        __relevantNotes.length > 0
          ? ` Notes     : ${__relevantNotes.length} matching (${__relevantNotes.map((n) => n.text.slice(0, 48)).join(' · ')})`
          : null,
        ` Selection : ${formatComposition(__selectionClass)}`,
        ` Coverage  : ${__cov ? formatCoverage(__cov, 'readable', { grade: false }) : 'not assessed'}`,
        ` Risk      : ${__risk.assessed
            ? `${__risk.level} (${__risk.changed} file(s) changed vs HEAD)`
            : 'not assessed (no git repo, or git unavailable)'}`,
        __sourceSection && __sourceSection.included > 0
          ? ` Source    : ${__sourceSection.included} of ${__sourceSection.candidates} top symbol(s), ${__sourceSection.spentTokens.toLocaleString()} of ${__sourceSection.budgetTokens.toLocaleString()} budget token(s)${__sourceSection.truncated ? ` · ${__sourceSection.skipped} omitted (over budget)` : ''}`
          : null,
        __withSource && (!__sourceSection || __sourceSection.included === 0)
          ? ` Source    : none included — no anchored symbol fit the ${__sourceSection ? __sourceSection.budgetTokens.toLocaleString() : '0'}-token budget (raise maxTokens or pass --source-budget <n>)`
          : null,
        ` Cost      : $${costCtx}/query  (was $${costRaw} · saved ${savings}%)`,
        ` ${' '.repeat(9)} est. @ ${__price.model} $${__price.perMtok}/Mtok input as of ${__price.asOf}; cost tokens ${__tokBasis.label}; "was" = full ranked files`,
        bar,
      ].filter(Boolean).join('\n');
      if (args.includes('--verbose')) {
        // The full box exactly as it always was, behind the ranked files (#966).
        console.log(__list.length > 0 ? `${__list.join('\n')}\n${__box}` : __box);
      } else {
        // Default (#966, from #879): the ranked files lead, then one summary line, and a
        // second line only when something is actionable. Intent, coverage, cost and the
        // whole-tree Risk are `--verbose` and `--json`; the warnings above stay on stderr.
        const __lines = __list.slice();
        __lines.push(__ao.formatSummary({
          selected: __selection.count, indexed: sigIndex.size, cutoff: __selection.cutoff,
          tokens: ctxTok, hash: __selection.hash, contextPath: path.relative(cwd, outPath),
        }));
        const __headsUp = __ao.formatHeadsUp({
          empty: __selection.count !== 0 ? null
            : __sinceEmptied ? `none of the ${__sinceEmptied.before} ranked files changed since ${__sinceEmptied.ref}`
            : __ao.NO_MATCH_HINT,
          notes: __relevantNotes.map((n) => n.text.slice(0, 48)),
          source: __ao.formatSourceStatus(__sourceSection, __withSource),
          risk: __risk.assessed && __risk.changed > 0
            ? __ao.selectionRisk(ranked.length, changedAmong(cwd, ranked.map((r) => r.file)).length)
            : null,
        });
        if (__headsUp) __lines.push(__headsUp);
        console.log(__lines.join('\n'));
      }
    }
    // gain: capture this query's savings for the `sigmap gain` dashboard.
    try {
      const { recordUsage, isTrackingEnabled } = requireSourceOrBundled('./src/tracking/logger');
      if (isTrackingEnabled(config, args)) {
        recordUsage({
          version: VERSION,
          op: 'ask',
          baselineTokens: rawTok,
          actualTokens: ctxTok,
          durationMs: Date.now() - __askT0,
          model,
        }, cwd);
        // #922: leave the query in the active agent session (SIGMAP_SESSION is exported by the
        // Claude Code SessionStart hook). Mode-gated and redacted on write; a no-op unless a
        // session store already exists, so a repo that never captured sessions is untouched.
        const __sid = process.env.SIGMAP_SESSION;
        if (__sid && /^[a-z][a-z0-9]{0,7}-[A-Za-z0-9._-]+$/.test(__sid)) {
          const _st = requireSourceOrBundled('./src/session/store');
          // Only a session the store already knows: a stray SIGMAP_SESSION (a day bucket, a
          // chat id) never gets queries attached to a record that does not exist.
          if (fs.existsSync(_st.storePath(cwd)) && _st.readSessions(cwd).sessions.some((x) => x.id === __sid)) {
            const qr = _st.queryRecord(query, _st.sessionConfig(config).logQueries);
            if (qr) _st.appendEvent(cwd, { kind: 'query', id: __sid, ...qr, files: ranked.slice(0, 5).map((r) => r.file) });
          }
        }
      }
    } catch (_) { /* gain capture is best-effort */ }

    // v7.0.0: record the run and show the one-time star nudge (interactive only).
    try {
      const { checkStarNudge } = requireSourceOrBundled('./src/nudge');
      const showNudge = !!process.stderr.isTTY && !args.includes('--json');
      checkStarNudge(cwd, true, {
        silent: !showNudge,
        bump: { squeezeOffered: squeezeOffered ? 1 : 0, squeezeAccepted: squeezeAccepted ? 1 : 0 },
      });
    } catch (_) {}
    process.exit(0);
  }

  // `sigmap evidence "<query>"` — Evidence Pack v1 (v8.0 E1).
  // Deterministic, machine-consumable signature+evidence map. Always writes the
  // JSON artifact to .context/evidence-pack.json; stdout carries the requested
  // mode (JSON default, or Markdown handoff with --markdown/--md).
  // ── sbom / deps (#2c', #2a, v8.50) ────────────────────────────────────────
  // SigMap emits the component list and stops there. A CVE feed would make
  // output non-deterministic, would mean owning a vulnerability database
  // forever, and is already solved by osv-scanner/Dependabot/Trivy.
  if (args[0] === 'sbom') {
    const { buildSbom, formatSbom, summarize } = requireSourceOrBundled('./src/deps/sbom');
    let built;
    try {
      built = buildSbom(cwd, {
        exactOnly: args.includes('--exact-only'),
        includeDev: !args.includes('--no-dev'),
      });
    } catch (e) {
      console.error('[sigmap] sbom: ' + e.message);
      process.exit(1);
    }

    if (built.stats.total === 0) {
      process.stderr.write('[sigmap] sbom: no dependencies found in any manifest at the repo root\n');
    }

    const rendered = formatSbom(built.bom);
    const outIdx = args.indexOf('--out');
    if (outIdx !== -1 && args[outIdx + 1]) {
      const outPath = path.resolve(cwd, args[outIdx + 1]);
      try {
        fs.mkdirSync(path.dirname(outPath), { recursive: true });
        fs.writeFileSync(outPath, rendered + '\n', 'utf8');
        process.stderr.write('[sigmap] sbom → ' + path.relative(cwd, outPath) + '\n');
      } catch (e) {
        console.error('[sigmap] sbom: could not write --out ' + outPath + ': ' + e.message);
        process.exit(1);
      }
    } else {
      writeAll(1, rendered + '\n');
    }
    for (const line of summarize(built.stats)) process.stderr.write(line + '\n');
    process.exit(0);
  }

  if (args[0] === 'deps') {
    const { collectDependencies } = requireSourceOrBundled('./src/deps/inventory');
    let inventory;
    try {
      inventory = collectDependencies(cwd);
    } catch (e) {
      console.error('[sigmap] deps: ' + e.message);
      process.exit(1);
    }

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(inventory, null, 2) + '\n');
      process.exit(0);
    }

    if (inventory.manifests.length === 0) {
      process.stderr.write('[sigmap] deps: no package manifest found at the repo root\n');
      process.exit(0);
    }

    const wanted = args.includes('--runtime') ? new Set(['runtime', 'peer']) : null;
    const rows = inventory.deps.filter((d) => !wanted || wanted.has(d.scope));

    const bar = '─'.repeat(44);
    const out = [bar];
    for (const m of inventory.manifests) {
      const id = [m.name, m.version].filter(Boolean).join('@') || '—';
      out.push(' ' + m.file + '  ' + id + '  (' + m.count + ' deps)');
    }
    out.push(bar);

    let ecosystem = null;
    for (const d of rows) {
      if (d.ecosystem !== ecosystem) {
        ecosystem = d.ecosystem;
        out.push(' [' + ecosystem + ']');
      }
      const version = d.resolved || d.version || '—';
      const pinned = d.resolved ? ' (locked)' : '';
      out.push('   ' + d.name.padEnd(42) + ' ' + version + pinned + '  ' + d.scope);
    }
    if (rows.length === 0) out.push('   (none declared)');
    out.push(bar);
    if (inventory.truncated > 0) {
      out.push(' ' + inventory.truncated + ' row(s) omitted by the per-manifest cap');
    }
    out.push(' Vulnerability scanning is deliberately out of scope — export and pipe:');
    out.push('   sigmap sbom --out sbom.json && osv-scanner --sbom sbom.json');
    out.push(bar, '');
    writeAll(1, out.join('\n'));
    process.exit(0);
  }

  if (args[0] === 'evidence') {
    const query = args[1];
    if (!query || query.startsWith('--')) {
      console.error('[sigmap] Usage: sigmap evidence "<query>" [--markdown] [--top <n>] [--budget <n>] [--out <path>]');
      console.error('  Example: sigmap evidence "how does auth work" --markdown');
      process.exit(1);
    }

    const { buildEvidencePack, formatJSON, formatMarkdown } = requireSourceOrBundled('./src/evidence/pack');

    const opts = { version: VERSION };
    const topIdx = args.indexOf('--top');
    if (topIdx !== -1 && args[topIdx + 1]) opts.top = parseInt(args[topIdx + 1], 10);
    const budgetIdx = args.indexOf('--budget');
    if (budgetIdx !== -1 && args[budgetIdx + 1]) opts.budget = parseInt(args[budgetIdx + 1], 10);
    else opts.budget = (config && config.maxTokens) || 6000;

    let pack;
    try {
      pack = buildEvidencePack(query, cwd, opts);
    } catch (e) {
      console.error('[sigmap] evidence: ' + e.message);
      process.exit(1);
    }

    if (pack.files.length === 0) {
      process.stderr.write('[sigmap] ⚠  no matching files indexed. Run: sigmap  (to generate context first)\n');
    }

    const jsonText = formatJSON(pack);
    const artifactPath = path.join(cwd, '.context', 'evidence-pack.json');
    try {
      fs.mkdirSync(path.dirname(artifactPath), { recursive: true });
      fs.writeFileSync(artifactPath, jsonText, 'utf8');
      process.stderr.write(`[sigmap] evidence pack → ${path.relative(cwd, artifactPath)} (${pack.files.length} files, ${pack.grounding.symbolCount} symbols)\n`);
    } catch (_) { /* artifact write is best-effort */ }

    const markdown = args.includes('--markdown') || args.includes('--md');
    const rendered = markdown ? formatMarkdown(pack) : jsonText;

    const outIdx = args.indexOf('--out');
    if (outIdx !== -1 && args[outIdx + 1]) {
      const outPath = path.resolve(cwd, args[outIdx + 1]);
      try {
        fs.mkdirSync(path.dirname(outPath), { recursive: true });
        fs.writeFileSync(outPath, rendered + '\n', 'utf8');
      } catch (e) {
        console.error('[sigmap] evidence: could not write --out ' + outPath + ': ' + e.message);
        process.exit(1);
      }
    }

    writeAll(1, rendered + '\n');
    process.exit(0);
  }

  // `sigmap gain` — token-savings dashboard (totals, by-operation, trends).
  if (args[0] === 'gain') {
    const valOf = (f, d) => { const i = args.indexOf(f); return i >= 0 && args[i + 1] ? args[i + 1] : d; };
    if (args.includes('--reset')) {
      try {
        const { GAIN_FILE } = requireSourceOrBundled('./src/tracking/logger');
        const p = path.join(cwd, GAIN_FILE);
        if (fs.existsSync(p)) fs.unlinkSync(p);
        console.log('[sigmap] gain: usage log cleared.');
      } catch (e) { console.error(`[sigmap] gain: ${e.message}`); }
      process.exit(0);
    }
    try {
      const { DEFAULT_MODEL, resolvePrice, listModels } = requireSourceOrBundled('./src/tracking/pricing');
      const __models = requireSourceOrBundled('./src/config/models');
      const __profile = __models.resolveProfile(config);
      if (args.includes('--models')) {
        // One table (#688): the names listed here are the names --suggest-tool prints.
        const lines = listModels(__profile).map((k) => {
          const pr = resolvePrice(k, __profile);
          const alias = pr.model !== k ? `  → ${pr.model}` : '';
          return `  ${k.padEnd(24)} $${pr.perMtok}/MTok${alias}${k === DEFAULT_MODEL ? '  (default)' : ''}`;
        });
        writeAll(1, `Known pricing models (sigmap gain --model <name>) — input prices ${__models.asOfLabel(__profile)}:\n${lines.join('\n')}\n`);
        process.exit(0);
      }
      if (args.indexOf('--model') >= 0) {
        const p = resolvePrice(valOf('--model', ''), __profile);
        if (p.fallback) {
          console.error(`[sigmap] unknown model '${p.requested}' — priced as ${p.model} ($${p.perMtok}/MTok); see: sigmap gain --models`);
        }
      }
      const { readGainLog } = requireSourceOrBundled('./src/tracking/logger');
      const { aggregate } = requireSourceOrBundled('./src/tracking/aggregate');
      const { renderSummary, renderBreakdown } = requireSourceOrBundled('./src/format/gain-terminal');
      const records = readGainLog(cwd);
      const agg = aggregate(records, {
        model: valOf('--model', DEFAULT_MODEL),
        profile: __profile,
        since: valOf('--since', null),
        top: parseInt(valOf('--top', args.includes('--all') ? '0' : '10'), 10),
      });
      if (args.includes('--json')) {
        writeAll(1, JSON.stringify(agg, null, 2) + '\n');
      } else {
        const out = args.includes('--all')
          ? renderSummary(agg, { version: VERSION }) + '\n' + renderBreakdown(agg)
          : renderSummary(agg, { version: VERSION });
        writeAll(1, out + '\n');
      }
    } catch (e) {
      console.error(`[sigmap] gain: ${e.message}`);
      console.error('  (gain modules require src/ — for single-file installs, regenerate the bundle)');
      process.exit(1);
    }
    process.exit(0);
  }

  // v4.2: `sigmap suggest-profile` — infer the task profile from the actual
  // staged CHANGES (test ratio, breadth, doc/config mix), not just one
  // commit-message keyword. The commit message is only a secondary disambiguator
  // for source-focused edits, and the sole (weak) signal when nothing is staged.
  if (args[0] === 'suggest-profile') {
    const short = args.includes('--short');
    let msg = '', diffRaw = '';
    try {
      msg     = __git(['log', '-1', '--format=%s'],        { cwd, timeout: 3000 }).trim();
      diffRaw = __git(['diff', '--cached', '--name-only'], { cwd, timeout: 3000 });
    } catch (_) {}

    const files = diffRaw.split('\n').map((s) => s.trim()).filter(Boolean);
    const isTest = (f) => /\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.(py|go)$|(^|\/)(tests?|__tests__|spec)\//i.test(f);
    const isSrc  = (f) => /\.(js|jsx|ts|tsx|mjs|cjs|py|go|rs|java|rb|php)$/i.test(f) && !isTest(f);
    const isDocCfg = (f) => /\.(md|json|ya?ml|toml|cfg|ini)$/i.test(f) || /(^|\/)\.github\//i.test(f);
    const fixMsg = /fix|bug|error|crash|exception/i.test(msg);
    const archMsg = /refactor|architect|redesign|module/i.test(msg);

    const testN = files.filter(isTest).length;
    const srcN  = files.filter(isSrc).length;
    const docCfgN = files.filter(isDocCfg).length;
    const dirs = new Set(files.map((f) => (f.includes('/') ? f.split('/')[0] : '.')));

    let profile = 'default';
    let reason;
    if (files.length === 0) {
      if      (fixMsg)  { profile = 'debug';        reason = `no staged files; commit hint: "${msg.slice(0, 50)}"`; }
      else if (archMsg) { profile = 'architecture'; reason = `no staged files; commit hint: "${msg.slice(0, 50)}"`; }
      else if (/review|pr|pull.request|check/i.test(msg)) { profile = 'review'; reason = `no staged files; commit hint: "${msg.slice(0, 50)}"`; }
      else              { reason = 'no staged files and no strong commit-message signal'; }
    } else if (dirs.size >= 4) {
      profile = 'architecture';
      reason  = `changes span ${dirs.size} top-level dirs (${[...dirs].slice(0, 4).join(', ')}…)`;
    } else if (testN > 0 && testN >= srcN) {
      profile = 'debug';
      reason  = `${testN} test file(s) staged (≥ ${srcN} source) — test-driven change`;
    } else if (srcN === 0 && docCfgN > 0) {
      profile = 'review';
      reason  = `only docs/config staged (${docCfgN} file(s)) — meta change`;
    } else if (srcN > 0 && archMsg) {
      profile = 'architecture';
      reason  = `${srcN} source file(s) + refactor-style commit`;
    } else if (srcN > 0 && fixMsg) {
      profile = 'debug';
      reason  = `${srcN} source file(s) + fix-style commit`;
    } else if (srcN > 0) {
      reason  = `${srcN} source file(s) staged, no strong task signal`;
    } else {
      reason  = 'staged changes do not match a known task profile';
    }

    if (short) {
      console.log(profile);
    } else {
      console.log(`[sigmap] suggested profile: --profile ${profile}`);
      console.log(`  Reason: ${reason}`);
    }
    process.exit(0);
  }

  // v4.2: `sigmap compare` — human-readable benchmark CLI
  if (args[0] === 'compare') {
    const bar = '─'.repeat(44);

    // The 21-repo comparison benchmark lives in the SOURCE checkout: the runner
    // script and the task corpus are both absent from the published package, so
    // outside a checkout the old unconditional spawn burned ~30-60s and then
    // died on `Could not parse benchmark output`. Probe for both before
    // spawning anything, and fall back to the user's own recorded history.
    // #760: compare now scores against the GREP AGENT, not random selection.
    // The honest corpus is what README, docs-vp and latest.json all publish
    // (86.4% vs 40.8%, 2.12x); the random baseline overstates, which is the
    // whole reason the honest corpus was introduced. This command was still
    // quoting 4.9x over random and disagreeing with every other surface.
    const benchScript = path.join(__dirname, 'scripts', 'run-honest-benchmark.mjs');
    const benchCorpus = path.join(__dirname, 'benchmarks', 'tasks');
    const hasCorpus = fs.existsSync(benchScript) && fs.existsSync(benchCorpus);
    const forceRun = args.includes('--run');

    if (forceRun && !hasCorpus) {
      console.error('[sigmap] compare --run needs the sigmap source checkout with its benchmark corpus.');
      console.error(`  missing: ${!fs.existsSync(benchScript) ? 'scripts/run-retrieval-benchmark.mjs' : 'benchmarks/tasks/'}`);
      console.error('  Run plain `sigmap compare` to see your local benchmark history instead.');
      process.exit(1);
    }

    if (!hasCorpus) {
      // Fallback: the user's own before/after numbers, from the same store
      // `share` reads. Reads only from cwd; writes nothing.
      const histPath = path.join(cwd, '.context', 'benchmark-history.ndjson');
      let entries = [];
      if (fs.existsSync(histPath)) {
        try {
          entries = fs.readFileSync(histPath, 'utf8').trim().split('\n')
            .map((l) => { try { return JSON.parse(l); } catch (_) { return null; } })
            .filter(Boolean);
        } catch (_) {}
      }

      const seriesOf = (type, field) => {
        const vals = entries.filter((e) => e.type === type && typeof e[field] === 'number');
        if (vals.length === 0) return null;
        return { first: vals[0][field], latest: vals[vals.length - 1][field], runs: vals.length };
      };
      const retrieval = seriesOf('retrieval', 'hitAt5');
      const tokens    = seriesOf('token-reduction', 'reduction');

      if (!retrieval && !tokens) {
        if (args.includes('--json')) {
          writeAll(1, JSON.stringify({ mode: 'history', available: false, runs: 0 }) + '\n');
        } else {
          console.log('[sigmap] compare: no local benchmark history yet.');
          console.log('  The 21-repo comparison needs the sigmap source checkout with its benchmark corpus.');
          console.log('  Record your own numbers first: run `sigmap --benchmark` in this repo.');
        }
        process.exit(0);
      }

      if (args.includes('--json')) {
        writeAll(1, JSON.stringify({
          mode: 'history',
          available: true,
          runs: Math.max(retrieval ? retrieval.runs : 0, tokens ? tokens.runs : 0),
          hitAt5: retrieval,
          tokenReduction: tokens,
        }, null, 2) + '\n');
      } else {
        const delta = (s, unit) => {
          const d = s.latest - s.first;
          const sign = d > 0 ? '+' : '';
          return s.runs > 1 ? `  (first ${s.first}${unit} → ${sign}${parseFloat(d.toFixed(3))}${unit})` : '';
        };
        const lines = [bar, ' SigMap — local benchmark history', bar];
        if (retrieval) lines.push(` hit@5          ${(retrieval.latest * 100).toFixed(1)}%${delta({ ...retrieval, first: parseFloat((retrieval.first * 100).toFixed(1)), latest: parseFloat((retrieval.latest * 100).toFixed(1)) }, '%')}`);
        if (tokens)    lines.push(` token savings  ${tokens.latest}%${delta(tokens, '%')}`);
        lines.push(bar);
        lines.push(' Live 21-repo comparison needs the sigmap source checkout;');
        lines.push(' run `sigmap compare --run` there for SigMap vs baseline.');
        console.log(lines.join('\n'));
      }
      process.exit(0);
    }

    const { execFileSync } = require('child_process');
    // Progress goes to STDERR. This was console.log, so `compare --json` emitted
    // a human line ahead of its payload and could never be piped into a parser —
    // the same defect as #757, one level up: diagnostics on the machine channel.
    console.error('[sigmap] Running comparison benchmark (this may take ~40s)...\n');

    let raw = '';
    try {
      // Shell-free: run the node binary directly with the script path as an argv.
      raw = execFileSync(
        process.execPath,
        [benchScript, '--json'],
        { cwd, timeout: 180_000, encoding: 'utf8' }
      );
    } catch (e) { raw = (e && e.stdout) ? e.stdout : ''; }

    // Strict parse first; then fall back to the last JSON-looking line. The
    // producer is supposed to emit the payload and nothing else, but it once
    // emitted it AFTER the terminal table and this command exited 1 for every
    // user, after a ~90s wait (#757). Degrade instead of failing outright.
    let results = null;
    try { results = JSON.parse(raw); } catch (_) {}
    if (!results) {
      const line = String(raw).trim().split('\n').reverse()
        .find((l) => l.trim().startsWith('{') && l.trim().endsWith('}'));
      if (line) { try { results = JSON.parse(line); } catch (_) {} }
    }
    const sum = results && results.summary;
    if (!(sum && sum.sigmap && sum.grepBaseline)) results = null;

    if (!results) {
      console.error('[sigmap] Could not parse benchmark output.');
      console.error('  Run manually: node scripts/run-retrieval-benchmark.mjs --skip-run --json');
      process.exit(1);
    }

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(results, null, 2) + '\n');
    } else {
      const pct = (v) => `${(v * 100).toFixed(1)}%`;
      // The old token row was `fileCount * 4000` — an assumed 4k-per-file
      // constant rendered beside a real signature count as if both were
      // observed. Report the MEASURED reduction from the saved benchmark
      // instead, and label it as saved rather than measured by this run.
      let tokenLine = null;
      try {
        const latest = JSON.parse(fs.readFileSync(path.join(__dirname, 'benchmarks', 'latest.json'), 'utf8'));
        const red = latest && latest.metrics && latest.metrics.overall_token_reduction_pct;
        if (typeof red === 'number') tokenLine = ` Token cut     ${red.toFixed(1)}% average (saved benchmark, 21 repos)`;
      } catch (_) {}
      console.log([
        bar,
        ' SigMap vs grep agent',
        bar,
        ` hit@5         ${pct(sum.sigmap.hitAt5)} vs ${pct(sum.grepBaseline.hitAt5)}   (${Number(sum.lift).toFixed(2)}× lift)`,
        ` Corpus        ${sum.tasks} tasks · ${sum.repos} repos (honest split)`,
        ...(tokenLine ? [tokenLine] : []),
        bar,
      ].join('\n'));
    }
    process.exit(0);
  }

  // v4.2: `sigmap share` — shareable one-liner with live benchmark numbers
  if (args[0] === 'share') {
    // #763: every number here must be traceable. This previously defaulted to
    // `reduction = 97, hitAt5 = 88` and emitted them as the USER'S OWN figures
    // on a repo that had never run a benchmark, and appended the string literal
    // `6× better results` — a claim measured nowhere, against a published lift
    // of 2.12×. The text is pasted publicly, so an unmeasured number here is
    // the most expensive kind.
    const histPath = path.join(cwd, '.context', 'benchmark-history.ndjson');
    let reduction = null, hitAt5 = null;

    if (fs.existsSync(histPath)) {
      try {
        const entries = fs.readFileSync(histPath, 'utf8').trim().split('\n')
          .map((l) => { try { return JSON.parse(l); } catch (_) { return null; } }).filter(Boolean);
        const tok = [...entries].reverse().find((e) => e.type === 'token-reduction');
        const ret = [...entries].reverse().find((e) => e.type === 'retrieval');
        // `!= null` rather than truthiness: a measured 0 is a real result.
        if (tok && tok.reduction != null) reduction = tok.reduction;
        if (ret && ret.hitAt5 != null)    hitAt5    = Math.round(ret.hitAt5 * 100);
      } catch (_) {}
    }

    // The published lift comes from the same source `compare` reads, so the two
    // commands cannot advertise different multipliers.
    let lift = null;
    try {
      const latest = JSON.parse(fs.readFileSync(path.join(__dirname, 'benchmarks', 'latest.json'), 'utf8'));
      if (latest && latest.honest && typeof latest.honest.lift === 'number') lift = latest.honest.lift;
    } catch (_) {}

    // Local figures are THIS repo's; the lift is SigMap's published claim. In a
    // block the user pastes publicly they would otherwise read as one set of
    // numbers, so the published one says so.
    const local = [];
    if (reduction != null) local.push(`${reduction}% fewer tokens`);
    if (hitAt5 != null)    local.push(`${hitAt5}% retrieval accuracy`);

    const parts = [];
    if (local.length) parts.push(`${local.join(' · ')} (this repo)`);
    else              parts.push('not benchmarked locally yet — run `sigmap compare`');
    if (lift != null) parts.push(`${lift.toFixed(2)}× vs a grep agent (published)`);

    const shareText = [
      'Generated with SigMap — the deterministic, verifiable grounding layer for AI code work',
      parts.join(' · '),
      'https://sigmap.io',
    ].join('\n');

    console.log(shareText);

    try {
      // Shell-free: spawn the clipboard binary directly and write the text to its
      // stdin — no shell, no pipe, no string-built command.
      const { execFileSync } = require('child_process');
      const [clipBin, clipArgs] = process.platform === 'darwin'
        ? ['pbcopy', []]
        : ['xclip', ['-selection', 'clipboard']];
      execFileSync(clipBin, clipArgs, { input: shareText, timeout: 2000 });
      console.log('\n[sigmap] Copied to clipboard.');
    } catch (_) {}

    process.exit(0);
  }

  // v6.8: `sigmap plan "<goal>"` — analyze what files need changes and impact radius
  if (args[0] === 'plan') {
    const goal = args[1];
    if (!goal || goal.startsWith('--')) {
      console.error('[sigmap] Usage: sigmap plan "<goal>"');
      console.error('  Example: sigmap plan "add rate limiting to the API"');
      process.exit(1);
    }

    const { createPlan } = requireSourceOrBundled('./src/plan/planner');
    const plan = createPlan(goal, cwd, config);

    if (plan.error) {
      console.error('[sigmap] no context file found. Run: sigmap (to generate first)');
      process.exit(1);
    }

    const relOf = (f) => path.relative(cwd, path.isAbsolute(f) ? f : path.join(cwd, f));
    const impact = plan.impactRadius;

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify({
        goal: plan.goal,
        intent: plan.intent,
        inspectFirst: plan.inspectFirst,
        likelyToChange: plan.likelyToChange,
        likelyToChangeEvidence: plan.likelyToChangeEvidence,
        impactRadius: impact,
        coveredFiles: plan.coveredFiles,
        relatedTests: plan.relatedTests,
        testsAffected: plan.testsAffected,
      }, null, 2) + '\n');
    } else {
      const bar = '─'.repeat(50);
      console.log(bar);
      console.log(` sigmap plan  "${goal}"`);
      console.log(` Intent     : ${plan.intent}`);
      console.log(bar);
      console.log('');
      console.log(' Inspect first (highest relevance):');
      if (plan.inspectFirst.length === 0) {
        console.log('   (no files found)');
      } else {
        plan.inspectFirst.forEach((f, i) => console.log(`   ${i + 1}. ${relOf(f)}`));
      }
      console.log('');
      // #862: every entry names its basis — score relative to the top match,
      // and the task words its path and signatures carry.
      console.log(' Likely to change (high-confidence implementation files · score vs top match · why):');
      const changes = plan.likelyToChangeEvidence || [];
      if (changes.length === 0) {
        console.log('   (no implementation file matched with high confidence)');
      } else {
        const width = changes.reduce((w, c) => Math.max(w, relOf(c.file).length), 0);
        changes.forEach((c, i) => console.log(`   ${i + 1}. ${relOf(c.file).padEnd(width)}  ${c.score.toFixed(2)}  ${c.reason}`));
      }
      if (impact && (impact.direct.length || impact.transitive.length)) {
        console.log('');
        console.log(' Impact radius (relative-import dependents, ≤3 hops — lower bound):');
        impact.direct.forEach(f => console.log(`   • ${relOf(f)}  (direct)`));
        impact.transitive.forEach(f => console.log(`   • ${relOf(f)}  (transitive)`));
      }
      // #979: a file the import graph cannot read has no blast radius to show —
      // say so instead of leaving the section out as if nothing depends on it.
      if (impact && impact.untracked && impact.untracked.length) {
        console.log('');
        console.log(' Impact radius not tracked:');
        const { shortNote } = requireSourceOrBundled('./src/graph/language-support');
        impact.untracked.forEach(u => console.log(`   • ${relOf(u.file)}  — ${shortNote(u.language)}`));
      }
      if (plan.coveredFiles.length > 0) {
        console.log('');
        console.log(' Files with test coverage (re-run their suites after changing):');
        plan.coveredFiles.forEach(f => {
          const tests = (plan.relatedTests && plan.relatedTests[f]) || [];
          const more = tests.length > 3 ? ` (+${tests.length - 3} more)` : '';
          console.log(`   • ${relOf(f)}  ←  ${tests.slice(0, 3).map(relOf).join(', ')}${more}`);
        });
      }
      console.log('');
      console.log(bar);
    }
    process.exit(0);
  }

  // v5.9: `sigmap bench --submit` — format local benchmark history as a shareable community block
  if (args[0] === 'bench' && args.includes('--submit')) {
    const versionMeta = (() => {
      try { return JSON.parse(fs.readFileSync(path.join(__dirname, 'version.json'), 'utf8')); }
      catch (_) { return {}; }
    })();

    const histPath = path.join(cwd, '.context', 'benchmark-history.ndjson');
    let localMetrics = null;
    if (fs.existsSync(histPath)) {
      try {
        const entries = fs.readFileSync(histPath, 'utf8').trim().split('\n')
          .map((l) => { try { return JSON.parse(l); } catch (_) { return null; } }).filter(Boolean);
        const ret = [...entries].reverse().find((e) => e.type === 'retrieval');
        const tok = [...entries].reverse().find((e) => e.type === 'token-reduction');
        if (ret || tok) {
          // #764: `||` collapsed a MISSING field to 0, and 0 then passed the
          // `!= null` render guard — so an entry that was never measured
          // printed `hit@5 : 0%` in a block the command asks users to paste
          // into a public Discussion, indistinguishable from a real score of
          // zero. Use `!= null` so absent stays absent and a measured 0 stays 0.
          const pickPct = (obj, pctKey, fracKey) => {
            if (!obj) return null;
            if (obj[pctKey] != null) return obj[pctKey];
            if (obj[fracKey] != null) return Math.round(obj[fracKey] * 100);
            return null;
          };
          localMetrics = {
            hitAt5Pct:       pickPct(ret, 'hitAt5Pct', 'hitAt5'),
            reductionPct:    tok ? (tok.reduction != null ? tok.reduction
                                    : (tok.avgReductionPct != null ? tok.avgReductionPct : null)) : null,
            runDate:         (ret || tok).ts ? new Date((ret || tok).ts).toISOString().slice(0, 10) : null,
          };
        }
      } catch (_) {}
    }

    const canonical = versionMeta.metrics || {};
    const submission = {
      sigmapVersion:     versionMeta.version || 'unknown',
      benchmarkId:       versionMeta.benchmark_id || 'unknown',
      canonicalHitAt5:   canonical.hit_at_5 != null ? Math.round(canonical.hit_at_5 * 1000) / 10 : null,
      canonicalReduction: canonical.overall_token_reduction_pct || null,
      local:             localMetrics,
      submittedAt:       new Date().toISOString().slice(0, 10),
    };

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(submission, null, 2) + '\n');
    } else {
      const bar = '─'.repeat(56);
      const lines = [
        bar,
        ' SigMap Community Benchmark Submission',
        bar,
        ` SigMap version : ${submission.sigmapVersion}`,
        ` Benchmark ID   : ${submission.benchmarkId}`,
        ` Submitted      : ${submission.submittedAt}`,
        bar,
        ' Canonical metrics (official release):',
        ` hit@5          : ${submission.canonicalHitAt5 != null ? submission.canonicalHitAt5 + '%' : 'n/a'}`,
        ` token reduction: ${submission.canonicalReduction != null ? submission.canonicalReduction + '%' : 'n/a'}`,
      ];
      if (localMetrics) {
        lines.push(bar, ' Local run metrics (this repo):');
        // Render `not run` rather than omitting the row: a silently missing
        // line reads as "this repo has no such metric", which is the same
        // ambiguity in a different shape.
        lines.push(` hit@5          : ${localMetrics.hitAt5Pct != null ? localMetrics.hitAt5Pct + '%' : 'not run'}`);
        lines.push(` token reduction: ${localMetrics.reductionPct != null ? localMetrics.reductionPct + '%' : 'not run'}`);
        if (localMetrics.runDate)               lines.push(` run date       : ${localMetrics.runDate}`);
      } else {
        lines.push(bar, ' Local run metrics: none yet — run node scripts/run-retrieval-benchmark.mjs');
      }
      lines.push(bar);
      lines.push(' Paste the block above into a GitHub Discussion to share your results.');
      lines.push(' https://github.com/manojmallick/sigmap/discussions');
      lines.push(bar);
      console.log(lines.join('\n'));
    }
    // #764: `--submit` asks the user to publish a local result. With nothing
    // measured, a green exit says "this block is ready to paste" when it
    // carries no local number — so `sigmap bench --submit > block.txt && post`
    // publishes an empty submission silently.
    //
    // Scoped to TEXT mode deliberately. The `--json` payload already states the
    // condition explicitly as `local: null`, which a consumer can check, and
    // that mode is a machine contract other tooling exits-0 against. Failing it
    // would break a caller that can already tell, to guard a risk it does not
    // have. The block is still printed either way — the canonical release
    // figures in it are real.
    const hasLocal = !!(localMetrics &&
      (localMetrics.hitAt5Pct != null || localMetrics.reductionPct != null));
    if (!hasLocal && !args.includes('--json')) {
      console.error('[sigmap] no local benchmark metric to submit — run `sigmap compare` or');
      console.error('         node scripts/run-retrieval-benchmark.mjs first.');
      process.exit(1);
    }
    process.exit(0);
  }

  // v5.2: `sigmap learn` — manual learning controls for ranking
  if (args[0] === 'learn') {
    const doReset = args.includes('--reset');
    const good = collectLearnFiles(args, '--good', cwd);
    const bad = collectLearnFiles(args, '--bad', cwd);

    if (doReset && (good.rawCount > 0 || bad.rawCount > 0)) {
      console.error('[sigmap] --reset cannot be combined with --good or --bad');
      process.exit(1);
    }

    if (doReset) {
      const { resetWeights } = requireSourceOrBundled('./src/learning/weights');
      resetWeights(cwd);
      console.log('[sigmap] weights reset — all files back to baseline');
      process.exit(0);
    }

    if (good.rawCount === 0 && bad.rawCount === 0) {
      console.error('[sigmap] Usage: sigmap learn --good <files...> [--bad <files...>] | sigmap learn --reset');
      process.exit(1);
    }

    for (const warning of [...good.warnings, ...bad.warnings]) {
      console.warn(`[sigmap] warning: ${warning}`);
    }

    if (good.files.length === 0 && bad.files.length === 0) {
      console.error('[sigmap] No valid files to learn from.');
      process.exit(1);
    }

    const { updateWeights } = requireSourceOrBundled('./src/learning/weights');
    const result = updateWeights(cwd, { goodFiles: good.files, badFiles: bad.files });
    const parts = [];
    if (result.good.length) parts.push(`boosted ${result.good.length} file(s)`);
    if (result.bad.length) parts.push(`penalized ${result.bad.length} file(s)`);
    console.log(`[sigmap] learned: ${parts.join(', ')}`);
    process.exit(0);
  }

  // v5.2: `sigmap weights` — explain learned ranking multipliers
  if (args[0] === 'weights') {
    const { loadWeights, exportWeights, importWeights } = requireSourceOrBundled('./src/learning/weights');

    if (args.includes('--export')) {
      const exportIdx = args.indexOf('--export');
      const maybeFile = args[exportIdx + 1];
      const exportFile = (maybeFile && !maybeFile.startsWith('--')) ? maybeFile : null;
      exportWeights(cwd, exportFile);
      if (exportFile) console.warn(`[sigmap] weights exported to ${exportFile}`);
      process.exit(0);
    }

    if (args.includes('--import')) {
      const importIdx = args.indexOf('--import');
      const importFile = args[importIdx + 1];
      if (!importFile || importFile.startsWith('--')) {
        console.error('[sigmap] --import requires a file path');
        process.exit(1);
      }
      const replace = args.includes('--replace');
      try {
        const result = importWeights(cwd, importFile, replace);
        const count = Object.keys(result).length;
        console.warn(`[sigmap] weights ${replace ? 'replaced' : 'merged'} from ${importFile} — ${count} file(s) with non-baseline weights`);
      } catch (err) {
        console.error(`[sigmap] weights import failed: ${err.message}`);
        process.exit(1);
      }
      process.exit(0);
    }

    const weights = loadWeights(cwd);
    const entries = Object.entries(weights).sort(([, a], [, b]) => b - a || 0);

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(weights, null, 2) + '\n');
      process.exit(0);
    }

    if (entries.length === 0) {
      console.log('[sigmap] No manual weights set. Run: sigmap learn --good <file> to boost a file.');
      process.exit(0);
    }

    console.log('[sigmap] Manual file weights — boost/penalty multipliers vs baseline:');
    for (const [file, mult] of entries) {
      const bar = mult >= 1
        ? `+${'█'.repeat(Math.max(1, Math.round((mult - 1) * 10)))}`
        : `-${'░'.repeat(Math.max(1, Math.round((1 - mult) * 10)))}`;
      console.log(`  ${file.padEnd(50)} x${mult.toFixed(2)}  ${bar}`);
    }
    console.log(`\n  ${entries.length} file(s) manually boosted/penalized (set via \`sigmap learn\`; decays toward 1.0 over time — not automatic learning).`);
    console.log('  To reset: sigmap learn --reset');
    process.exit(0);
  }

  // v4.3: `sigmap validate` — config + coverage + optional query symbol check
  if (args[0] === 'validate') {
    const issues   = [];
    const warnings = [];

    // Config checks
    for (const d of (config.srcDirs || [])) {
      if (!fs.existsSync(path.join(cwd, d)))
        issues.push(`srcDir '${d}' does not exist`);
    }
    if ((config.exclude || []).some((p) => p === 'src/**'))
      issues.push(`exclude pattern 'src/**' will exclude all source files`);
    if ((config.maxTokens || 0) < 1000)
      warnings.push(`maxTokens ${config.maxTokens} is very low — consider ≥ 4000`);
    if ((config.maxTokens || 0) > 50000)
      warnings.push(`maxTokens ${config.maxTokens} is very high — may exceed LLM context windows`);

    // Coverage check: files actually in context vs total source files.
    // These are two different populations — the persisted index can hold files
    // the current config no longer scopes (deletions, srcDir changes, a
    // different strategy), so a raw `index.size / fileList.length` ratio ran
    // past 100% (218% in this repo) and stopped meaning anything. Coverage is
    // the INTERSECTION over the in-scope list, which is <= 100% by
    // construction; the two residuals are reported separately because they say
    // different things: `notIndexed` is missing context, `staleEntries` is a
    // stale index.
    const { buildSigIndex: valBuildSigIndex } = requireSourceOrBundled('./src/retrieval/ranker');
    const valSigIndex  = valBuildSigIndex(cwd);
    const valFiles     = buildFileList(cwd, config);
    const valTotal     = valFiles.length;

    const valRel       = (f) => path.relative(cwd, path.resolve(cwd, f)).replace(/\\/g, '/');
    const valInScope   = new Set(valFiles.map(valRel));
    const valIndexed   = new Set([...valSigIndex.keys()].map(valRel));

    const _covScore = __require('./src/analysis/coverage-score');
    const valIdxCov = _covScore.indexedCoverage(valIndexed, valInScope);
    const valCovered = valIdxCov.included;

    // #825: `generate` indexes an AUGMENTED population — srcDirs widened by the
    // declared entrypoints, every test root and every CI definition — so
    // "indexed but not in buildFileList" is not the same thing as "stale".
    // Measuring it that way reported 266 stale entries on a healthy index here
    // (256 test, 10 CI) and advised a re-run that could not change the number.
    // The classifier owns the population; stale is only what it cannot justify.
    const _idxState = __require('./src/analysis/index-state');
    const valClass = _idxState.classifyIndexEntries(cwd, valIndexed, config);
    const valStale = valClass.stale;
    const valAugmented = valClass.augmented.length;

    // #848: the shared measurement, not a local copy. The hand-rolled ratio
    // here agreed with `coverageScore` on every populated repo and read 0%
    // where every other surface read 100% on an empty one.
    const coveragePct  = valIdxCov.score;
    const valNotIndexed = valTotal - valCovered;
    if (coveragePct < 70)
      warnings.push(`coverage ${coveragePct}% is below recommended 70% — increase maxTokens or expand srcDirs`);
    for (const remedy of _idxState.staleRemedies(valClass))
      warnings.push(`stale index entries: ${remedy}`);

    // Optional query check. Two complementary signals:
    //  (a) cased-symbol coverage — if the query literally names a camelCase /
    //      PascalCase symbol (loginUser, AuthMiddleware), confirm it lands in
    //      the top-5. This is a no-op for lowercase natural-language queries.
    //  (b) retrieval-confidence report — works for ANY query, including plain
    //      NL like "login rate limit". Built from the ranker's own score
    //      distribution: a zero top score means the current context has no
    //      lexical match at all; a near-tie between rank-1 and rank-2 means the
    //      ranking is flat and coverage is ambiguous. This replaces the old
    //      behaviour where an NL query silently produced no output whatsoever.
    let queryReport = null;
    const valQueryIdx = args.indexOf('--query');
    if (valQueryIdx !== -1) {
      const q = (args[valQueryIdx + 1] || '').trim();
      if (q && !q.startsWith('--')) {
        try {
          const { rank, buildSigIndex } = requireSourceOrBundled('./src/retrieval/ranker');
          const valIndex = buildSigIndex(cwd);
          // the words `ask` ranks with, so `validate` and `ask` cannot disagree about a query
          const valWords = requireSourceOrBundled('./src/retrieval/body-words').forRepo(cwd, valIndex, config);
          const ranked = rank(q, valIndex, { topK: 5, cwd, bodyWords: valWords });

          // (a) cased-symbol coverage
          const symbols = extractQuerySymbols(q);
          const missing = symbols.filter((sym) =>
            !ranked.some((r) => r.sigs && r.sigs.some((s) => s.toLowerCase().includes(sym.toLowerCase())))
          );
          if (missing.length > 0)
            warnings.push(`query "${q}" references symbols not in top-5 context: ${missing.join(', ')}`);
          else if (symbols.length > 0)
            console.log(`[sigmap] ✓ query coverage OK — all ${symbols.length} symbols found`);

          // (b) retrieval-confidence report
          const top = ranked[0] || null;
          const topScore = top ? (top.score || 0) : 0;
          const secondScore = ranked[1] ? (ranked[1].score || 0) : 0;
          const gapRatio = topScore > 0 ? (topScore - secondScore) / topScore : 0;
          let queryConfidence;
          if (topScore <= 0) queryConfidence = 'none';
          else if (ranked.length > 1 && gapRatio < 0.1) queryConfidence = 'low';
          else queryConfidence = (top && top.confidence) || 'medium';

          queryReport = {
            text: q,
            topFile: top ? top.file : null,
            topScore: parseFloat(topScore.toFixed(3)),
            confidence: queryConfidence,
          };

          if (queryConfidence === 'none')
            warnings.push(`query "${q}" has no lexical match in the current context — expand srcDirs or raise maxTokens`);
          else if (queryConfidence === 'low')
            warnings.push(`query "${q}" ranks flat (top ${top.file} score ${queryReport.topScore}, no dominant match) — context may not cover it well`);
          else if (!args.includes('--json'))
            console.log(`[sigmap] ✓ query "${q}" → ${top.file} (score ${queryReport.topScore}, confidence ${queryConfidence})`);
        } catch (_) {}
      }
    }

    // #805: a coverage figure computed over srcDirs cannot see a file the
    // detector never selected. Report what is outside, so a wrong srcDirs is
    // visible without reading the detector's output. Computed before the
    // json/human split so both surfaces report the same number.
    let __valOutside = { total: 0, byExt: [], dirs: [] };
    let __valRepo = null;
    try {
      __valOutside = __require('./src/analysis/coverage-score').outsideSrcDirs(cwd, config);
      __valRepo = __require('./src/analysis/coverage-score').repositoryCoverage(cwd, config);
    } catch (_) {}

    if (args.includes('--json')) {
      const payload = {
        valid: issues.length === 0,
        issues,
        warnings,
        coverage: coveragePct,
        indexedInScope: valCovered,
        notIndexed: valNotIndexed,
        staleEntries: valStale,
        augmentedEntries: valAugmented,
        augmentedByReason: valClass.byReason,
        missingEntries: valClass.missing.length,
        outOfScopeEntries: valClass.outOfScope.length,
        totalFiles: valTotal,
        outsideSrcDirs: __valOutside,
        repositoryCoverage: __valRepo ? { covered: __valRepo.covered, outside: __valRepo.outside, all: __valRepo.all, pct: __valRepo.pct } : null,
      };
      if (queryReport) payload.query = queryReport;
      writeAll(1, JSON.stringify(payload) + '\n');
    } else {
      for (const w of warnings) console.warn(`[sigmap] ⚠  ${w}`);
      if (issues.length === 0) {
        const residual = [
          valNotIndexed > 0 ? `${valNotIndexed} not indexed` : null,
          // Named, not counted as stale: these are the entries `generate`
          // indexes on purpose so `ask` can reach tests, CI and entrypoints.
          valAugmented > 0 ? `${valAugmented} beyond srcDirs (${_idxState.formatAugmented(valClass)})` : null,
          valStale > 0 ? `${valStale} stale` : null,
        ].filter(Boolean).join(', ');
        // #762: `indexed` — how much of the in-scope set the retrieval index
        // holds. Deliberately a different population from `--report`'s
        // in-context figure; both now say which, so 98% and 54% read as
        // answers to two questions rather than a contradiction.
        const _cov = __require('./src/analysis/coverage-score');
        const _line = _cov.formatCoverage(
          { score: coveragePct, grade: '' }, 'indexed',
          { included: valCovered, total: valTotal, grade: false }
        );
        // The repository figure first: the "indexed" line below grades the in-scope set only (#997).
        if (__valRepo && __valRepo.all > 0) {
          const _roots = config.srcDirs || [];
          console.log(`[sigmap] source roots: ${_roots.slice(0, 6).join(', ') || '(none)'}${_roots.length > 6 ? ` (+${_roots.length - 6} more)` : ''} \u2014 ${_cov.formatRepositoryCoverage(__valRepo)}`);
        }
        console.log(`[sigmap] ✓ config valid  coverage: ${_line}${residual ? `  — ${residual}` : ''}`);
        if (__valOutside.total > 0 && __valOutside.share >= 0.10) {
          const _exts = __valOutside.byExt.slice(0, 4).map((e) => `${e.count}${e.ext}`).join(' ');
          console.warn(`[sigmap] ⚠  ${__valOutside.total} of ${__valOutside.inScope + __valOutside.total} implementation file(s) OUTSIDE srcDirs (${Math.round(__valOutside.share * 100)}%) — ${_exts}`);
          console.warn(`[sigmap]    in: ${__valOutside.dirs.slice(0, 6).join(', ')}`);
          console.warn(`[sigmap]    srcDirs is (${(config.srcDirs || []).join(', ')}) — widen it or set "srcDirs" explicitly`);
        }
      } else {
        for (const iss of issues) console.error(`[sigmap] ✗ ${iss}`);
        process.exit(1);
      }
    }
    process.exit(0);
  }

  // v5.0: `sigmap judge --response <file> --context <file>` — groundedness scoring
  if (args[0] === 'judge') {
    const USAGE = '[sigmap] Usage: sigmap judge [--response <file>|-] [--context <file>] [--json] [--threshold 0.25] [--learn]';
    const respIdx = args.indexOf('--response');
    const ctxIdx  = args.indexOf('--context');
    const _ctxSource = requireSourceOrBundled('./src/judge/context-source');
    // Exit codes (#766): 0 pass · 1 fail or usage error · 2 nothing to judge.
    // `pass`/`fail` are unchanged so existing CI gates keep working.
    const EXIT_INCONCLUSIVE = 2;

    const respArg = respIdx >= 0 ? (args[respIdx + 1] || '').trim() : '';
    if (respIdx >= 0 && (!respArg || (respArg.startsWith('--')))) {
      console.error('[sigmap] --response requires a file path or `-` for stdin');
      process.exit(1);
    }

    // stdin support (#780): `--response -`, or a bare pipe with no --response.
    const wantsStdin = respArg === '-' || (respIdx < 0 && !process.stdin.isTTY);
    let responseText = '';
    let respLabel = respArg;
    if (wantsStdin) {
      respLabel = 'stdin';
      try { responseText = fs.readFileSync(0, 'utf8'); }
      catch (_) { responseText = ''; }
      // An explicit `-` asks for stdin and gets exit 2 when it is empty; a bare
      // invocation with nothing piped in simply supplied no response at all.
      if (!responseText.trim() && respIdx < 0) {
        console.error(USAGE);
        process.exit(1);
      }
    } else if (respIdx < 0) {
      console.error(USAGE);
      process.exit(1);
    } else {
      try { responseText = fs.readFileSync(path.resolve(cwd, respArg), 'utf8'); }
      catch (e) { console.error(`[sigmap] cannot read --response file: ${e.message}`); process.exit(1); }
    }

    // Config-driven defaults (J2): judge.threshold / learnBoostAbove /
    // learnPenalizeBelow from gen-context.config.json; --threshold overrides.
    const _judgeConfig = loadConfig(cwd) || {};

    // `--context` is optional (#780): default to the context this repo already
    // generated, and name it, so the common case needs no path at all.
    let ctxFile = ctxIdx >= 0 ? (args[ctxIdx + 1] || '').trim() : '';
    if (ctxIdx >= 0 && (!ctxFile || ctxFile.startsWith('--'))) {
      console.error('[sigmap] --context requires a file path');
      process.exit(1);
    }
    let ctxPath, ctxDefaulted = false;
    if (ctxFile) {
      ctxPath = path.resolve(cwd, ctxFile);
    } else {
      ctxPath = _ctxSource.resolveContextFile(cwd);
      ctxDefaulted = true;
      if (!ctxPath) {
        console.error('[sigmap] no generated context found — run `sigmap` first, or pass --context <file>');
        process.exit(1);
      }
      ctxFile = path.relative(cwd, ctxPath) || ctxPath;
    }

    let contextText = '';
    try { contextText = fs.readFileSync(ctxPath, 'utf8'); }
    catch (e) { console.error(`[sigmap] cannot read --context file: ${e.message}`); process.exit(1); }

    // Empty input is an input problem, not a judgement (#766).
    if (!responseText.trim()) {
      console.error(`[sigmap] response is empty: ${respLabel} — nothing to judge`);
    }
    if (!contextText.trim()) {
      console.error(`[sigmap] context is empty: ${ctxFile} — nothing to judge against`);
    }

    // Stale-context warning (#780): an answer judged against a context older
    // than the sources it describes is judged on ground that has moved.
    const _staleness = _ctxSource.contextStaleness(ctxPath, cwd, _judgeConfig);
    const _staleWarning = _ctxSource.stalenessWarning(_staleness);

    const judgeCfg = _judgeConfig.judge || {};
    const judgeOpts = {};
    if (typeof judgeCfg.threshold === 'number') judgeOpts.threshold = judgeCfg.threshold;
    if (typeof judgeCfg.learnBoostAbove === 'number') judgeOpts.learnBoostAbove = judgeCfg.learnBoostAbove;
    if (typeof judgeCfg.learnPenalizeBelow === 'number') judgeOpts.learnPenalizeBelow = judgeCfg.learnPenalizeBelow;
    const thrIdx = args.indexOf('--threshold');
    if (thrIdx >= 0) judgeOpts.threshold = parseFloat(args[thrIdx + 1]) || 0.25;
    // Structural claim grounding (J1): the verify engine checks claims against
    // the repo + installed-lib index, so cwd is always passed; --learn still
    // gates the weights feedback loop.
    judgeOpts.cwd = cwd;
    if (args.includes('--learn')) judgeOpts.learn = true;

    const { judge: runJudge } = requireSourceOrBundled('./src/judge/judge-engine');
    const result = runJudge(responseText, contextText, judgeOpts);

    // Surface the context provenance and freshness alongside the engine's own
    // warnings, so `--json` consumers see why a verdict may be untrustworthy.
    result.context = { file: ctxFile, defaulted: ctxDefaulted, stale: !!(_staleness && _staleness.stale) };
    if (_staleWarning) result.warnings = (result.warnings || []).concat(_staleWarning);

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(result) + '\n');
    } else {
      const bar = '─'.repeat(44);
      // Per-claim detail (#780): on anything but a clean pass the reader needs
      // to see WHICH claim was checked and how it resolved, without re-running
      // the command with --json.
      const showClaims = result.verdict !== 'pass' && result.claims && result.claims.checked.length > 0;
      const claimLines = showClaims
        ? ` Checked   :\n${result.claims.checked.map((c) => `   ${c.grounded ? '✓' : '✗'} ${c.kind.padEnd(6)} ${c.value}${c.kind === 'symbol' ? '()' : ''} — ${c.via || 'not grounded'}`).join('\n')}`
        : null;
      console.log([
        bar,
        ` sigmap judge`,
        ` Score     : ${result.score}`,
        ` Verdict   : ${result.verdict}`,
        result.confidence ? ` Confidence: ${result.confidence.level} (${result.confidence.basis.join(' · ')})` : null,
        ` Context   : ${ctxFile}${ctxDefaulted ? ' (default — no --context given)' : ''}`,
        result.claims && result.claims.total > 0
          ? ` Claims    : ${result.claims.grounded}/${result.claims.total} grounded (${result.claims.checked.filter((c) => c.via === 'context').length} context, ${result.claims.checked.filter((c) => c.via === 'repo').length} repo)`
          : null,
        claimLines,
        result.reasons.length ? ` Reasons   :\n   ${result.reasons.join('\n   ')}` : ` Reasons   : none`,
        result.warnings && result.warnings.length ? ` Warnings  :\n   ${result.warnings.join('\n   ')}` : null,
        result.learning
          ? ` Learning  : ${result.learning.applied ? result.learning.action : 'skipped'}${result.learning.files.length ? ` (${result.learning.files.join(', ')})` : ''}${result.learning.reason ? ` — ${result.learning.reason}` : ''}`
          : null,
        bar,
      ].filter(Boolean).join('\n'));
    }
    if (result.verdict === 'inconclusive') process.exit(EXIT_INCONCLUSIVE);
    process.exit(result.verdict === 'pass' ? 0 : 1);
  }

  // v5.0: `sigmap history` — show last N usage log entries with sparkline
  if (args[0] === 'history') {
    // #773: one read path. This read usage.ndjson alone, which `tracking: false`
    // (the default) never writes — so `history` reported "No usage log entries"
    // on a repo whose gain log held hundreds of generates.
    const _usage = requireSourceOrBundled('./src/tracking/usage-source');
    const entries = _usage.readRuns(cwd);
    const _src = _usage.describeSource(cwd);

    const nIdx = args.indexOf('--last');
    const n    = nIdx >= 0 ? (parseInt(args[nIdx + 1], 10) || 10) : 10;
    const last = entries.slice(-n);

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(last) + '\n');
      process.exit(0);
    }

    const SPARK_CHARS = '▁▂▃▄▅▆▇█';
    function sparkline(values) {
      if (values.length === 0) return '';
      const min = Math.min(...values);
      const max = Math.max(...values);
      const range = max - min || 1;
      return values.map((v) => {
        const idx = Math.round(((v - min) / range) * (SPARK_CHARS.length - 1));
        return SPARK_CHARS[idx];
      }).join('');
    }

    const bar = '─'.repeat(62);
    console.log(bar);
    // `Math.max(…, 1)` printed "(last 1 runs)" for an EMPTY log (#773).
    const _window = last.length === 0
      ? 'no runs recorded'
      : `last ${last.length} of ${entries.length} runs`;
    console.log(` sigmap history  (${_window}${_src.stores.length ? ` · ${_src.stores.join(' + ')}` : ''})`);
    console.log(bar);

    if (last.length === 0) {
      console.log(' No runs recorded yet. Run `sigmap` once, or set tracking: true for the richer log.');
    } else {
      console.log(` ${'Date'.padEnd(24)} ${'Files'.padStart(5)} ${'Tokens'.padStart(7)} ${'Reduction'.padStart(9)} ${'Budget?'.padStart(7)}`);
      console.log(` ${'─'.repeat(24)} ${'─'.repeat(5)} ${'─'.repeat(7)} ${'─'.repeat(9)} ${'─'.repeat(7)}`);
      for (const e of last) {
        const date = (e.ts || '').slice(0, 19).replace('T', ' ');
        // `—` where the source store does not record the field, rather than
        // rendering it as 0/no — an unrecorded value must not read as measured.
        const files = String(e.fileCount == null ? '—' : e.fileCount).padStart(5);
        const tok   = String(e.finalTokens || 0).padStart(7);
        const red   = `${e.reductionPct || 0}%`.padStart(9);
        const over  = (e.overBudget == null ? '       —' : (e.overBudget ? '  ⚠ yes' : '     no')).padStart(7);
        console.log(` ${date.padEnd(24)} ${files} ${tok} ${red} ${over}`);
      }
      console.log(bar);
      const tokens = last.map((e) => e.finalTokens || 0);
      console.log(` Token trend: ${sparkline(tokens)}`);
    }

    // Show benchmark trend row if .context/benchmark-history.ndjson exists
    const benchHistPath = path.join(cwd, '.context', 'benchmark-history.ndjson');
    if (fs.existsSync(benchHistPath)) {
      try {
        const benchEntries = fs.readFileSync(benchHistPath, 'utf8').trim().split('\n')
          .map((l) => { try { return JSON.parse(l); } catch (_) { return null; } }).filter(Boolean);
        const retrieval = benchEntries.filter((e) => e.type === 'retrieval').slice(-n);
        if (retrieval.length > 0) {
          const hits = retrieval.map((e) => e.hitAt5Pct || 0);
          console.log(` hit@5 trend: ${sparkline(hits)}  ${hits.at(-1)}% (latest)`);
        }
        const tokenBench = benchEntries.filter((e) => e.type === 'token-reduction').slice(-n);
        if (tokenBench.length > 0) {
          const reds = tokenBench.map((e) => e.reduction || e.avgReductionPct || 0);
          console.log(` tok reduce : ${sparkline(reds)}  ${reds.at(-1)}% (latest)`);
        }
      } catch (_) {}
    }

    console.log(bar);
    process.exit(0);
  }

  // Feature 6: `sigmap sync` — write all outputs + llms.txt + print compact diff
  if (args[0] === 'sync') {
    try {
      // Generate copilot-instructions.md first (existing output)
      runGenerate(cwd, config, false);
      const llmTxt = requireSourceOrBundled('./src/format/llm-txt');
      const llmsGen = requireSourceOrBundled('./src/format/llms-txt');
      const llmFullMod = requireSourceOrBundled('./packages/adapters/llm-full');

      // Gather file entries for llm.txt / llm-full.txt
      const ignorePatterns = loadIgnorePatterns(cwd);
      let syncFiles = buildFileList(cwd, config).filter((f) => {
        const rel = path.relative(cwd, f).replace(/\\/g, '/');
        return !matchesIgnore(rel, ignorePatterns);
      });
      const syncEntries = [];
      prefetchPythonAst(syncFiles);
      for (const fp of syncFiles) {
        let content = '';
        try { content = fs.readFileSync(fp, 'utf8'); } catch (_) { continue; }
        const sigs = detectAndExtract(fp, content, config.maxSigsPerFile || 25, config.exactness, cwd);
        if (sigs.length === 0) continue;
        syncEntries.push({ filePath: fp, sigs, language: null });
      }
      const syncContext = {
        projectName: path.basename(cwd),
        fileEntries: syncEntries,
        srcDirs: config.srcDirs || [],
      };

      const llmTxtPath   = llmTxt.outputPath(cwd);
      const llmFullPath  = llmFullMod.outputPath(cwd);
      const llmsTxtPath  = llmsGen.outputPath(cwd);

      fs.writeFileSync(llmTxtPath,  llmTxt.format(syncContext, cwd, VERSION));
      llmFullMod.write(syncContext, cwd, { version: VERSION });

      const prev  = fs.existsSync(llmsTxtPath) ? fs.readFileSync(llmsTxtPath, 'utf8') : '';
      const next  = llmsGen.format(syncContext, cwd, [
        { path: llmTxtPath,  label: 'llm.txt' },
        { path: llmFullPath, label: 'llm-full.txt' },
      ], VERSION);
      const changed = prev !== next ? 'updated' : 'no change';
      fs.writeFileSync(llmsTxtPath, next);

      console.log('[sigmap] sync complete');
      console.log(`  .github/copilot-instructions.md  updated`);
      console.log(`  llm.txt                          updated`);
      console.log(`  llm-full.txt                     updated`);
      console.log(`  llms.txt                         ${changed}`);
    } catch (err) {
      console.error(`[sigmap] sync error: ${err.message}`);
      process.exit(1);
    }
    process.exit(0);
  }

  // v6.5: `sigmap roots` — detect source roots
  if (args[0] === 'roots') {
    const { resolveSourceRoots } = requireSourceOrBundled('./src/discovery/source-root-resolver');
    const result = resolveSourceRoots(cwd);

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(result, null, 2) + '\n');
      process.exit(0);
    }

    if (args.includes('--fix')) {
      console.log('[sigmap] Current detected roots:', result.roots.join(', '));
      const readline = require('readline');
      const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
      rl.question('Enter correct srcDirs (comma-separated): ', answer => {
        const dirs = answer.split(',').map(d => d.trim()).filter(Boolean);
        const cfgPath = path.join(cwd, 'gen-context.config.json');
        const cfg = fs.existsSync(cfgPath) ? JSON.parse(fs.readFileSync(cfgPath, 'utf8')) : {};
        cfg.srcDirs = dirs;
        fs.writeFileSync(cfgPath, JSON.stringify(cfg, null, 2) + '\n');
        console.log(`[sigmap] Saved srcDirs: ${dirs.join(', ')} → gen-context.config.json`);
        rl.close();
        process.exit(0);
      });
      return;
    }

    // --explain (default)
    console.log('\nDetected languages:');
    for (const l of result.languages.slice(0, 4)) {
      console.log(`  ${l.name.padEnd(16)} ${l.weight.toFixed(2)}`);
    }
    console.log('\nDetected frameworks:');
    if (result.frameworks.length === 0) console.log('  (none)');
    for (const f of result.frameworks.slice(0, 3)) {
      console.log(`  ${f.name.padEnd(16)} ${f.confidence.toFixed(2)}`);
    }
    console.log('\nChosen source roots:');
    if (result.roots.length === 0) console.log('  (none — legacy fallback used)');
    result.roots.forEach((r, i) => {
      const exp = result.explanation?.find(e => e.dir === r);
      console.log(`  ${i + 1}. ${r.padEnd(20)} ${exp ? 'score ' + exp.score + (typeof exp.files === 'number' ? ` · ${exp.files.toLocaleString('en-US')} code file(s)` : '') : ''}`);
    });
    // The same figure `generate`, `validate` and `doctor` print, and what the cap left out (#997).
    try {
      const cov = requireSourceOrBundled('./src/analysis/coverage-score');
      const rcfg = Object.assign({}, requireSourceOrBundled('./src/config/loader').loadConfig(cwd), { srcDirs: result.roots });
      const rc = cov.repositoryCoverage(cwd, rcfg);
      if (rc.all > 0 && result.roots.length > 0) console.log(`\n${cov.formatRepositoryCoverage(rc)}`);
    } catch (_) { /* the figure is advice, not the answer */ }
    if (result.omitted > 0) console.log(result.omitted === 1 ? '1 more candidate directory scored above zero and was not chosen — pin "srcDirs" to take it' : `${result.omitted} more candidate directories scored above zero and were not chosen — pin "srcDirs" to take them`);
    // Name the evidence: a declared workspace and a layout-only match are
    // different facts, and reporting a bare yes/no is what let `roots` and
    // `--monorepo` disagree in silence (#781).
    const __monoWhy = result.monorepo && result.monorepo.evidence ? `  (${result.monorepo.evidence})` : '';
    console.log('\nMonorepo:', (result.isMonorepo ? 'yes' : 'no') + __monoWhy);
    console.log('Confidence:', result.confidence);
    process.exit(0);
  }

  // `sigmap tune [--apply|--dry-run] [--json]` — deterministic config optimizer:
  // recommend srcDirs/monorepo/adapters/exclude/autoMaxTokens from the existing
  // discovery stack, one reason per change. Read-only unless --apply.
  if (args[0] === 'tune') {
    const { buildTuneProposal, applyTuneProposal, formatTuneProposal } = requireSourceOrBundled('./src/config/tune');
    let proposal;
    try {
      proposal = buildTuneProposal(cwd);
    } catch (err) {
      console.error(`[sigmap] tune failed: ${err.message}`);
      process.exit(1);
    }
    if (args.includes('--apply') && proposal.changes.length > 0) {
      const res = applyTuneProposal(cwd, proposal);
      if (args.includes('--json')) {
        writeAll(1, JSON.stringify({ ...proposal, applied: res.applied, path: res.path }) + '\n');
      } else {
        console.log(formatTuneProposal(proposal));
        console.log(`[sigmap] tune: wrote ${res.applied.join(', ')} → ${path.relative(cwd, res.path)} — run: sigmap validate`);
      }
      process.exit(0);
    }
    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(proposal) + '\n');
    } else {
      console.log(formatTuneProposal(proposal));
    }
    process.exit(0);
  }

  // `sigmap skills list|install [--client <name>|--all] [--json]` — install the
  // agent playbooks (usage-maximizer, config-optimizer) in each client's native
  // skill/rules format. Plain `install` touches only clients whose parent
  // artifact exists; --client/--all create. Idempotent.
  if (args[0] === 'skills') {
    const { installSkills, listSkillClients, SKILL_CLIENTS } = requireSourceOrBundled('./src/skills/skills');
    const sub = args[1];
    const jsonOut = args.includes('--json');

    if (sub === 'list' || sub === undefined) {
      const clients = listSkillClients({ cwd });
      if (jsonOut) {
        writeAll(1, JSON.stringify(clients, null, 2) + '\n');
        process.exit(0);
      }
      console.log('Supported skill clients:\n');
      for (const c of clients) {
        const state = c.installed ? 'installed' : (c.present ? 'client present, skills not installed' : 'client not detected');
        console.log(`  ${c.client.padEnd(10)} ${c.label.padEnd(24)} ${state}`);
        for (const t of c.targets) console.log(`             ${path.relative(cwd, t)}`);
      }
      console.log('\nInstall with: sigmap skills install [--client <name> | --all]');
      process.exit(0);
    }

    if (sub === 'install') {
      const cIdx = args.indexOf('--client');
      const one = cIdx !== -1 ? args[cIdx + 1] : null;
      let targets;
      if (one) targets = [one];
      else if (args.includes('--all')) targets = Object.keys(SKILL_CLIENTS);
      else targets = listSkillClients({ cwd }).filter((c) => c.present).map((c) => c.client);
      if (targets.length === 0) {
        console.error('[sigmap] skills: no clients detected — use --client <name> or --all (see: sigmap skills list)');
        process.exit(1);
      }
      const out = targets.map((c) => installSkills(c, { cwd, version: VERSION }));
      const bad = out.find((r) => r.status === 'unknown');
      if (bad) {
        console.error(`[sigmap] skills: unknown client "${bad.client}" — valid: ${bad.valid.join(', ')}`);
        process.exit(1);
      }
      if (jsonOut) {
        writeAll(1, JSON.stringify(out, null, 2) + '\n');
        process.exit(0);
      }
      for (const r of out) {
        for (const res of r.results) {
          console.log(`  ${r.client.padEnd(10)} ${res.status.padEnd(10)} ${path.relative(cwd, res.path)}`);
        }
      }
      process.exit(0);
    }

    console.error('[sigmap] usage: sigmap skills [list | install [--client <name> | --all]] [--json]');
    process.exit(1);
  }

  // `sigmap note "<text>"` — append to the cross-session decision log.
  // With no text, lists recent notes (also `note --list [N]`).
  // `sigmap memory` — one view over the cross-session stores in .context/.
  if (args[0] === 'memory') {
    const jsonOut = args.includes('--json');
    const { inspectMemory, clearMemory } = requireSourceOrBundled('./src/session/memory-inspect');
    const clearIdx = args.indexOf('--clear');

    if (clearIdx !== -1) {
      const store = args[clearIdx + 1];
      if (!store || store.startsWith('--')) {
        console.error('[sigmap] usage: sigmap memory --clear <session|notes|weights|evidence|all>');
        process.exit(1);
      }
      let removed;
      try {
        removed = clearMemory(cwd, store);
      } catch (err) {
        console.error(`[sigmap] ${err.message}`);
        process.exit(1);
      }
      if (jsonOut) {
        writeAll(1, JSON.stringify({ cleared: removed }) + '\n');
      } else {
        console.log(removed.length
          ? `[sigmap] cleared: ${removed.join(', ')}`
          : `[sigmap] nothing to clear for "${store}"`);
      }
      process.exit(0);
    }

    const stores = inspectMemory(cwd);
    if (jsonOut) {
      writeAll(1, JSON.stringify({ stores }) + '\n');
      process.exit(0);
    }
    const fmtAge = (iso) => {
      if (!iso) return '—';
      const m = Math.floor((Date.now() - Date.parse(iso)) / 60000);
      const h = Math.floor(m / 60), d = Math.floor(h / 24);
      return d > 0 ? `${d}d ago` : h > 0 ? `${h}h ago` : `${m}m ago`;
    };
    const fmtKB = (b) => (b >= 1024 ? `${(b / 1024).toFixed(1)}KB` : `${b}B`);
    console.log('[sigmap] cross-session memory (.context/)');
    for (const s of stores) {
      const state = s.exists ? `${String(s.entries).padStart(5)} entries  ${fmtKB(s.bytes).padStart(8)}  ${fmtAge(s.modified)}` : '    — empty';
      console.log(`  ${s.store.padEnd(9)} ${state}${s.clearable ? '' : '   (reset via its own command)'}`);
    }
    console.log('  clear: sigmap memory --clear <session|notes|weights|evidence|all>');
    process.exit(0);
  }

  if (args[0] === 'budget') {
    const jsonOut = args.includes('--json');
    const { budgetStatus } = requireSourceOrBundled('./src/tracking/budget');
    let config = {};
    try { config = requireSourceOrBundled('./src/config/loader').loadConfig(cwd) || {}; } catch (_) {}
    const opts = { config };
    const sIdx = args.indexOf('--session');
    if (sIdx !== -1 && args[sIdx + 1] && !args[sIdx + 1].startsWith('--')) opts.session = args[sIdx + 1];
    const bIdx = args.indexOf('--budget');
    if (bIdx !== -1 && args[bIdx + 1] && !args[bIdx + 1].startsWith('--')) opts.budgetTokens = Number(args[bIdx + 1]);
    const st = budgetStatus(cwd, opts);
    if (jsonOut) {
      writeAll(1, JSON.stringify(st) + '\n');
      process.exit(0);
    }
    console.log('[sigmap] session spend (estimates — chars/4; SigMap-emitted tokens only)');
    console.log(`  session   ${st.session}`);
    console.log(`  ops       ${st.ops}`);
    console.log(`  spent     ~${st.spentTokens.toLocaleString()} tokens  (baseline ~${st.baselineTokens.toLocaleString()}, saved ~${st.savedTokens.toLocaleString()})`);
    if (st.budgetTokens != null) {
      console.log(`  budget    ${st.budgetTokens.toLocaleString()} → remaining ~${st.remainingTokens.toLocaleString()} (${st.pctUsed}% used)${st.overBudget ? '  ⚠ OVER BUDGET' : ''}`);
    } else {
      console.log('  budget    none set (config sessionBudgetTokens or --budget <tokens>)');
    }
    console.log(st.context.exists
      ? `  context   ${st.context.ageDays} day(s) old${st.context.stale ? `  ⚠ STALE (> ${st.context.ttlDays}d TTL) — re-run sigmap` : ''}`
      : '  context   none generated yet — run sigmap first');
    if (st.measured) {
      const { formatUsage, NOTE } = requireSourceOrBundled('./src/session/render');
      console.log(`  measured  ${formatUsage(st.measured.usage)}  [${st.measured.provenance}] — ${NOTE}${st.measured.coverage === 'main' ? '; main conversation only' : ''}`);
    }
    process.exit(0);
  }

  if (args[0] === 'redact') {
    const jsonOut = args.includes('--json');
    const { redactText } = requireSourceOrBundled('./src/security/redact');
    const fileArg = args.slice(1).find((a) => !a.startsWith('--'));
    let input;
    if (fileArg) {
      try {
        input = fs.readFileSync(path.resolve(cwd, fileArg), 'utf8');
      } catch (err) {
        console.error(`[sigmap] redact: cannot read ${fileArg}: ${err.message}`);
        process.exit(1);
      }
    } else if (!process.stdin.isTTY) {
      try {
        input = fs.readFileSync(0, 'utf8');
      } catch (err) {
        console.error(`[sigmap] redact: cannot read stdin: ${err.message}`);
        process.exit(1);
      }
    } else {
      console.error('[sigmap] usage: sigmap redact <file>   or   <cmd> | sigmap redact');
      process.exit(1);
    }
    const r = redactText(input);
    if (jsonOut) {
      writeAll(1, JSON.stringify(r) + '\n');
      process.exit(0);
    }
    writeAll(1, r.text);
    const parts = Object.entries(r.counts).map(([k, v]) => `${k}×${v}`);
    console.error(r.redacted
      ? `[sigmap] redact: masked ${r.findings.length} secret(s) — ${parts.join(', ')}`
      : '[sigmap] redact: no secrets found');
    process.exit(0);
  }

  // `sigmap lines <file> <start>-<end>` — the CLI twin of the get_lines MCP
  // tool. Without it, an agent in an MCP-less environment receives precise
  // `:start-end` anchors from `ask` and has no sanctioned way to spend them,
  // so it falls back to reading whole files and throws the saving away.
  // Delegates to the same handler as MCP so both paths share the sandbox,
  // the bounds clamping and the secret redaction.
  if (args[0] === 'lines') {
    const valOf = (f) => { const i = args.indexOf(f); return i >= 0 && args[i + 1] ? args[i + 1] : null; };
    const positional = [];
    const VALUE_FLAGS = new Set(['--cwd', '--context']);
    for (let i = 1; i < args.length; i++) {
      const a = args[i];
      if (a.startsWith('--')) { if (VALUE_FLAGS.has(a)) i++; continue; }
      positional.push(a);
    }
    const file = positional[0];
    const range = positional[1];
    if (!file || !range) {
      console.error('[sigmap] usage: sigmap lines <file> <start>-<end>   (or :<line> --context <n>)');
      process.exit(2);
    }

    // Accept `84-104`, a bare `94`, or the `:94` form copied straight off a
    // signature anchor — the whole point is to paste what `ask` printed.
    const ctx = Math.max(0, parseInt(valOf('--context') || '10', 10));
    let start;
    let end;
    const span = /^:?(\d+)\s*-\s*(\d+)$/.exec(range);
    const single = /^:?(\d+)$/.exec(range);
    if (span) { start = parseInt(span[1], 10); end = parseInt(span[2], 10); }
    else if (single) { const n = parseInt(single[1], 10); start = Math.max(1, n - ctx); end = n + ctx; }
    else {
      console.error(`[sigmap] lines: could not read range "${range}" — expected <start>-<end> or :<line>`);
      process.exit(2);
    }

    const { getLines } = requireSourceOrBundled('./src/mcp/handlers');
    const out = getLines({ file, start, end }, cwd);
    // The handler reports its own failures as prose; surface them on stderr
    // with a non-zero exit so a script can tell a hit from a miss.
    if (/^(Missing required argument|Refused:|File not found:|Could not read |Arguments )/.test(out)
        || /has only \d+ lines; requested/.test(out)) {
      console.error('[sigmap] ' + out);
      process.exit(1);
    }
    writeAll(1, out + '\n');
    process.exit(0);
  }

  if (args[0] === 'note') {
    const jsonOut = args.includes('--json');
    const { addNote, readNotes, formatNotes } = requireSourceOrBundled('./src/session/notes');
    const listIdx = args.indexOf('--list');
    // Build positionals, skipping value-taking flags and their values
    // (e.g. `--cwd <dir>`, `--list <N>`) so they never leak into the note text.
    const VALUE_FLAGS = new Set(['--cwd', '--list', '--tag']);
    const positional = [];
    for (let i = 1; i < args.length; i++) {
      const a = args[i];
      if (a.startsWith('--')) { if (VALUE_FLAGS.has(a)) i++; continue; }
      positional.push(a);
    }
    const wantsList = listIdx !== -1 || positional.length === 0;

    if (wantsList) {
      const limArg = listIdx !== -1 ? parseInt(args[listIdx + 1], 10) : parseInt(positional[0], 10);
      const limit = Number.isFinite(limArg) && limArg > 0 ? limArg : 10;
      const notes = readNotes(cwd, limit);
      if (jsonOut) {
        writeAll(1, JSON.stringify({ notes }) + '\n');
      } else {
        console.log(`[sigmap] ${notes.length} recent note${notes.length === 1 ? '' : 's'}`);
        console.log(formatNotes(notes.slice().reverse()));
      }
      process.exit(0);
    }

    const text = positional.join(' ');
    let entry;
    try {
      const tagIdx = args.indexOf('--tag');
      entry = addNote(cwd, text, tagIdx !== -1 && args[tagIdx + 1] && !args[tagIdx + 1].startsWith('--') ? { tag: args[tagIdx + 1] } : {});
    } catch (err) {
      console.error(`[sigmap] ${err.message}`);
      process.exit(1);
    }
    if (jsonOut) {
      writeAll(1, JSON.stringify({ added: entry }) + '\n');
    } else {
      console.log(`[sigmap] noted${entry.branch ? ` (${entry.branch})` : ''}: ${entry.text}`);
    }
    process.exit(0);
  }

  // `sigmap session log|list|show|summary|compact|hook` — session capture (#922).
  if (args[0] === 'session') {
    const sub = args[1] && !args[1].startsWith('--') ? args[1] : 'list';
    const jsonOut = args.includes('--json');
    const val = (flag) => {
      const i = args.indexOf(flag);
      return i !== -1 && args[i + 1] !== undefined && !args[i + 1].startsWith('--') ? args[i + 1] : null;
    };
    const fail = (msg) => { console.error(`[sigmap] session: ${msg}`); process.exit(1); };
    const _store = requireSourceOrBundled('./src/session/store');
    const _render = requireSourceOrBundled('./src/session/render');

    if (sub === 'log') {
      const fromJson = val('--from-json');
      const transcript = val('--transcript');
      try {
        const cap = requireSourceOrBundled('./src/session/capture');
        let id;
        if (args.includes('--ci')) {
          if (fromJson || transcript) fail('--ci records a pipeline run and takes no usage input');
          id = cap.recordCi(cwd, { config }).id;
        } else if (fromJson) {
          let text;
          try { text = fromJson === '-' ? fs.readFileSync(0, 'utf8') : fs.readFileSync(path.resolve(invokedFrom, fromJson), 'utf8'); }
          catch (e) { fail(`cannot read ${fromJson}: ${e.message}`); }
          let obj;
          try { obj = JSON.parse(text); } catch (e) { fail(`invalid JSON: ${e.message}`); }
          id = cap.recordFromJson(cwd, obj, { config }).id;
        } else if (transcript) {
          const agent = val('--agent') || 'claude-code';
          if (agent !== 'claude-code') fail(`no transcript adapter for "${agent}" — report its usage with --from-json instead`);
          const rawId = val('--id');
          if (!rawId) fail('--id <session_id> is required with --transcript');
          id = _store.sessionId(agent, rawId);
          const file = path.resolve(invokedFrom, transcript);
          let isFile = false;
          try { isFile = fs.statSync(file).isFile(); } catch (_) { /* reported below */ }
          if (!isFile) fail(`cannot read transcript ${transcript}: not a readable file`);
          const known = _store.readSessions(cwd).sessions.some((s) => s.id === id);
          const r = cap.recordTranscript(cwd, id, file, {});
          if (r.error) fail(r.error);
          if (!known) _store.appendEvent(cwd, { kind: 'start', id, ts: (r.parsed && r.parsed.firstTs) || undefined, agent, branch: null });
          if (args.includes('--end')) _store.appendEvent(cwd, { kind: 'end', id, reason: val('--reason') || 'manual' });
          _store.maybeCompact(cwd, config);
        } else {
          fail('nothing to log: pass --transcript <file> --id <session_id>, --from-json <file|->, or --ci');
        }
        const rec = _store.readSessions(cwd).sessions.find((s) => s.id === id);
        if (jsonOut) writeAll(1, JSON.stringify({ logged: rec || { id } }) + '\n');
        else console.log(`[sigmap] logged ${id} [${rec ? rec.provenance : 'unavailable'}] ${_render.formatUsage(rec ? rec.usage : null)}`);
      } catch (err) {
        fail(err.message);
      }
      process.exit(0);
    }

    if (sub === 'list') {
      const agent = val('--agent');
      const limArg = parseInt(val('--limit'), 10);
      const limit = Number.isFinite(limArg) && limArg > 0 ? limArg : 20;
      const all = _store.readSessions(cwd);
      let sessions = agent ? all.sessions.filter((s) => s.agent === agent) : all.sessions;
      sessions = sessions.slice(-limit);
      if (jsonOut) {
        writeAll(1, JSON.stringify({ sessions, rollups: all.rollups, totals: _render.totalsByProvenance(sessions), corrupt: all.corrupt }) + '\n');
      } else if (sessions.length === 0 && all.rollups.length === 0) {
        console.log('[sigmap] no sessions recorded yet — capture them with: sigmap hooks install claude');
      } else {
        console.log(_render.renderList(sessions, all.rollups, { corrupt: all.corrupt }));
      }
      process.exit(0);
    }

    if (sub === 'show') {
      const want = args[2] && !args[2].startsWith('--') ? args[2] : null;
      if (!want) fail('usage: sigmap session show <id>');
      const hits = _store.readSessions(cwd).sessions.filter((s) => s.id === want || s.id.startsWith(want));
      const exact = hits.find((s) => s.id === want);
      const hit = exact || (hits.length === 1 ? hits[0] : null);
      if (!hit) fail(hits.length > 1 ? `"${want}" matches ${hits.length} sessions — give more of the id` : `no session "${want}" (see: sigmap session list)`);
      if (jsonOut) writeAll(1, JSON.stringify({ session: hit }) + '\n');
      else console.log(_render.renderShow(hit));
      process.exit(0);
    }

    if (sub === 'summary') {
      // The last session is the only window there is, so `summary` and `summary --last` are the same call.
      const sum = requireSourceOrBundled('./src/session/summary').buildSummary(cwd, { config });
      if (jsonOut) writeAll(1, JSON.stringify({ summary: sum, window: 'last-session' }) + '\n');
      else if (!sum) console.log('[sigmap] no sessions recorded yet — capture them with: sigmap hooks install claude');
      else writeAll(1, sum.text + '\n');
      process.exit(0);
    }

    if (sub === 'compact') {
      const sc = _store.sessionConfig(config);
      if (sc.retention.compact === 'off') {
        if (jsonOut) writeAll(1, JSON.stringify({ action: 'off', sessions: 0, removedEvents: 0 }) + '\n');
        else console.log('[sigmap] session.retention.compact is "off" — compaction is disabled, every raw event is kept');
        process.exit(0);
      }
      const res = _store.compact(cwd, { days: sc.retention.days });
      if (jsonOut) writeAll(1, JSON.stringify(res) + '\n');
      else if (res.action === 'compacted') console.log(`[sigmap] compacted ${res.sessions} session(s) older than ${sc.retention.days}d into ${res.rollups} monthly rollup(s); dropped ${res.removedEvents} event(s)`);
      else if (res.action === 'locked') console.log('[sigmap] another sigmap process is compacting; try again in a moment');
      else console.log(`[sigmap] nothing older than ${sc.retention.days} day(s) to compact`);
      process.exit(0);
    }

    fail(`unknown subcommand "${sub}" — expected list | show | log | summary | compact`);
  }

  // `sigmap hooks install|status|remove` — wire session capture into Claude Code (#922).
  if (args[0] === 'hooks') {
    const sub = args[1];
    const jsonOut = args.includes('--json');
    const hi = requireSourceOrBundled('./src/session/hooks-install');
    const rel = (p) => path.relative(cwd, p) || p;
    if (sub === 'status') {
      const st = hi.inspectClaudeHooks(cwd);
      if (jsonOut) { writeAll(1, JSON.stringify(st) + '\n'); process.exit(0); }
      console.log(st.wired ? '[sigmap] Claude Code session hooks: wired' : '[sigmap] Claude Code session hooks: not wired (install: sigmap hooks install claude)');
      for (const f of st.files) console.log(`  ${rel(f.path)}  ${f.error ? 'unreadable: ' + f.error : f.events.join(', ')}`);
      for (const s of st.missingScript) console.log(`  ⚠ a hook runs ${s}, which no longer exists — re-run: sigmap hooks install claude`);
      process.exit(0);
    }
    if ((sub === 'install' || sub === 'remove') && args[2] === 'claude') {
      if (sub === 'remove') {
        const res = hi.removeClaudeHooks(cwd);
        if (res.error) { console.error(`[sigmap] hooks: ${res.error}`); process.exit(1); }
        if (jsonOut) writeAll(1, JSON.stringify(res) + '\n');
        else if (res.files.length === 0) console.log('[sigmap] no SigMap session hooks to remove');
        else for (const f of res.files) console.log(`[sigmap] removed ${f.removed} hook(s) from ${rel(f.path)}`);
        process.exit(0);
      }
      const res = hi.installClaudeHooks(cwd, scriptPath, { stop: args.includes('--stop'), shared: args.includes('--shared') });
      if (res.error) { console.error(`[sigmap] hooks: ${res.error}`); process.exit(1); }
      if (jsonOut) { writeAll(1, JSON.stringify(res) + '\n'); process.exit(0); }
      console.log(`[sigmap] Claude Code hooks → ${rel(res.path)}`);
      for (const c of res.changes) console.log(`  ${c.event}: ${c.action}`);
      if (/[\\/]_npx[\\/]/.test(path.resolve(scriptPath))) {
        console.warn('[sigmap] ⚠ this ran from an npx cache, which is temporary — the hooks would point at a path that disappears. Install sigmap (global or devDependency) and re-run.');
      }
      console.log('  Restart Claude Code sessions to load them. Each hook exits 0 whatever happens.');
      process.exit(0);
    }
    console.error('[sigmap] usage: sigmap hooks install claude [--stop] [--shared] | hooks status | hooks remove claude');
    process.exit(1);
  }

  // `sigmap status` — environment / repo state at a glance.
  if (args[0] === 'status') {
    const jsonOut = args.includes('--json');
    const gitOpts = { cwd };
    const st = { branch: null, dirty: 0, lastIndex: null, indexSource: null, indexVersion: null, indexFiles: null, changedSinceIndex: null, live: null, notes: 0, lastNote: null };

    st.branch = __tryGit(['rev-parse', '--abbrev-ref', 'HEAD'], gitOpts) || null;
    // Fallback for an unborn branch (fresh repo, no commits yet).
    if (!st.branch || st.branch === 'HEAD') {
      st.branch = __tryGit(['symbolic-ref', '--short', 'HEAD'], gitOpts) || st.branch;
    }
    try {
      const porcelain = __git(['status', '--porcelain'], gitOpts).trim();
      st.dirty = porcelain ? porcelain.split('\n').filter(Boolean).length : 0;
    } catch (_) {}

    // #825: this read the usage log and nothing else, so with tracking off —
    // the default — it reported "never" about an index `doctor` was calling up
    // to date in the same repo. The shared primitive falls back to the index
    // artifact's own stamp and discloses which source it used.
    const _idxState = __require('./src/analysis/index-state');
    try {
      const fresh = _idxState.indexFreshness(cwd);
      st.lastIndex = fresh.ts;
      st.indexSource = fresh.source;
      st.indexVersion = fresh.version;
      st.indexFiles = fresh.files;
    } catch (_) {}

    // Index freshness: count source files modified after the last index run,
    // over the same population `doctor` walks so the two cannot disagree.
    // The live overlay (#926): files it already describes are reflected in
    // queries, so they are not "changed since" the index — they are overlay depth.
    let __live = null;
    try { __live = _idxState.liveIndexState(cwd); } catch (_) {}
    if (st.lastIndex) {
      try {
        st.changedSinceIndex = _idxState.changedSince(cwd, config, Date.parse(st.lastIndex), __live ? __live.overlay : null);
      } catch (_) {}
    }
    if (__live) {
      st.live = {
        overlayDepth: __live.overlayDepth,
        watcher: __live.watcher,
        lastLatencyMs: __live.lastLatencyMs,
        lastLatencyPath: __live.lastLatencyPath,
        lastPatchAt: __live.lastPatchAt,
        lastRegenAt: __live.lastRegenAt,
        lastRegenMs: __live.lastRegenMs,
        patches: __live.patches,
        regens: __live.regens,
        settleMs: __live.settleMs,
        incremental: __live.incremental,
      };
    }

    try {
      const { readNotes } = requireSourceOrBundled('./src/session/notes');
      const notes = readNotes(cwd);
      st.notes = notes.length;
      if (notes.length) st.lastNote = notes[notes.length - 1];
    } catch (_) {}

    if (jsonOut) {
      writeAll(1, JSON.stringify(st) + '\n');
      process.exit(0);
    }

    const fmtAgo = (iso) => {
      if (!iso) return 'never';
      const ms = Date.now() - Date.parse(iso);
      if (!Number.isFinite(ms)) return iso;
      const m = Math.floor(ms / 60000), h = Math.floor(m / 60), d = Math.floor(h / 24);
      if (d > 0) return `${d}d ago`;
      if (h > 0) return `${h}h ago`;
      if (m > 0) return `${m}m ago`;
      return 'just now';
    };

    console.log('[sigmap] status');
    console.log(`  Branch:        ${st.branch || '(not a git repo)'}`);
    console.log(`  Working tree:  ${st.dirty === 0 ? 'clean' : `${st.dirty} file${st.dirty === 1 ? '' : 's'} changed`}`);
    if (st.lastIndex) {
      let fresh = `${fmtAgo(st.lastIndex)} (v${st.indexVersion || '?'}, ${st.indexFiles != null ? st.indexFiles + ' files' : 'n/a'})`;
      if (st.indexSource) fresh += ` — from ${st.indexSource}`;
      if (st.changedSinceIndex != null && st.changedSinceIndex > 0) fresh += ` — STALE: ${st.changedSinceIndex} file${st.changedSinceIndex === 1 ? '' : 's'} changed since`;
      console.log(`  Last index:    ${fresh}`);
    } else {
      console.log('  Last index:    never — run: sigmap');
    }
    if (st.live && (st.live.overlayDepth > 0 || st.live.watcher)) {
      const l = st.live;
      const bits = [];
      if (l.watcher) bits.push(l.watcher.running ? `watcher running (pid ${l.watcher.pid})` : 'last watcher is not running');
      bits.push(`${l.overlayDepth} file${l.overlayDepth === 1 ? '' : 's'} in the live overlay`);
      bits.push(l.lastLatencyMs != null ? `last save → index ${l.lastLatencyMs} ms (${l.lastLatencyPath || 'unknown path'})` : 'save → index latency unknown');
      if (l.watcher && l.watcher.running && l.incremental && l.settleMs != null) bits.push(`written files refresh after ${l.settleMs} ms quiet`);
      console.log(`  Live index:    ${bits.join(' · ')}`);
    }
    if (st.notes > 0) {
      console.log(`  Notes:         ${st.notes} (latest: ${st.lastNote.text.slice(0, 60)}${st.lastNote.text.length > 60 ? '…' : ''})`);
    } else {
      console.log('  Notes:         none — add with: sigmap note "<text>"');
    }
    process.exit(0);
  }

  // `sigmap mcp install <client>` / `sigmap mcp list` — one-command per-client
  // MCP wiring (v8.0 E4). Unlike `--setup` (wires every editor, only touches
  // existing configs), this targets one client and creates the config if absent.
  if (args[0] === 'mcp') {
    const { listClients, installClient, verifyClient } = requireSourceOrBundled('./src/mcp/install');
    const sub = args[1];

    if (sub === 'list') {
      const clients = listClients({ cwd });
      if (args.includes('--json')) {
        writeAll(1, JSON.stringify(clients, null, 2) + '\n');
        process.exit(0);
      }
      console.log('Supported MCP clients:\n');
      for (const c of clients) {
        const scope = c.scope === 'both' ? 'project (or --global)' : c.scope;
        console.log(`  ${c.client.padEnd(10)} ${c.label}`);
        console.log(`             ${_displayPath(c.target, cwd)}  [${scope}]`);
      }
      console.log('\nInstall with: sigmap mcp install <client>');
      process.exit(0);
    }

    if (sub === 'install') {
      const client = args[2];
      if (!client || client.startsWith('--')) {
        console.error('[sigmap] usage: sigmap mcp install <client>   (see: sigmap mcp list)');
        process.exit(1);
      }
      let result;
      try {
        result = installClient(client, {
          cwd,
          scriptPath,
          global: args.includes('--global'),
        });
      } catch (err) {
        console.error(`[sigmap] ${err.message}`);
        process.exit(1);
      }
      if (result.status === 'unknown') {
        console.error(`[sigmap] unknown client "${client}". Valid: ${result.valid.join(', ')}`);
        process.exit(1);
      }
      if (result.status === 'already') {
        console.log(`[sigmap] ${result.label}: sigmap already registered in ${_displayPath(result.path, cwd)}`);
      } else if (result.status === 'updated') {
        console.log(`[sigmap] ${result.label}: migrated SigMap config to ${_displayPath(result.path, cwd)}`);
      } else {
        console.log(`[sigmap] ${result.label}: registered MCP server in ${_displayPath(result.path, cwd)}`);
      }
      const verification = verifyClient(client, { cwd });
      if (verification.status === 'failed') {
        console.error(`[sigmap] ${result.label}: ${verification.reason}; check ${_displayPath(result.path, cwd)} and retry.`);
        process.exit(1);
      }
      if (verification.status === 'verified') {
        console.log(`[sigmap] ${result.label}: host confirmed the SigMap server.`);
      } else if (verification.status === 'unavailable') {
        console.warn(`[sigmap] ${result.label} CLI not found; ${verification.hint}`);
      }
      process.exit(0);
    }

    console.error('[sigmap] usage: sigmap mcp install <client> | sigmap mcp list');
    process.exit(1);
  }

  // `sigmap daemon start|stop|status` — run `--watch` as a detached background
  // process (D1). PID + log live under .context/. Mirrors the `mcp` sub-dispatch.
  if (args[0] === 'daemon') {
    const daemon = requireSourceOrBundled('./src/daemon/daemon');
    const sub = args[1];
    const jsonOut = args.includes('--json');

    if (sub === 'start') {
      const r = daemon.start(cwd, { scriptPath });
      if (jsonOut) { writeAll(1, JSON.stringify(r) + '\n'); process.exit(0); }
      if (r.status === 'already') {
        console.log(`[sigmap] daemon already running (pid ${r.pid})`);
      } else {
        console.log(`[sigmap] daemon started (pid ${r.pid}) — watching for changes`);
        console.log(`[sigmap] logs: ${_displayPath(r.logFile, cwd)}   stop with: sigmap daemon stop`);
      }
      process.exit(0);
    }

    if (sub === 'stop') {
      const r = daemon.stop(cwd);
      if (jsonOut) { writeAll(1, JSON.stringify(r) + '\n'); process.exit(0); }
      if (r.status === 'not-running') console.log('[sigmap] daemon not running');
      else if (r.status === 'stale') console.log(`[sigmap] removed stale pid file (pid ${r.pid} no longer alive)`);
      else console.log(`[sigmap] daemon stopped (pid ${r.pid})`);
      process.exit(0);
    }

    if (sub === 'status') {
      const r = daemon.status(cwd);
      if (jsonOut) { writeAll(1, JSON.stringify(r) + '\n'); process.exit(r.running ? 0 : 1); }
      if (r.running) console.log(`[sigmap] daemon running (pid ${r.pid}) — logs: ${_displayPath(r.logFile, cwd)}`);
      else console.log('[sigmap] daemon not running');
      process.exit(r.running ? 0 : 1);
    }

    console.error('[sigmap] usage: sigmap daemon start | stop | status');
    process.exit(1);
  }

  // `sigmap doctor` — diagnose config, index, freshness, coverage, and MCP
  // wiring; print an actionable fix for anything wrong. Exit 1 on a hard
  // failure (no context file / invalid config) so it is usable in CI.
  if (args[0] === 'doctor') {
    const { diagnose, formatDoctor, formatDoctorJSON } = requireSourceOrBundled('./src/doctor/diagnose');
    const result = diagnose(cwd);
    if (args.includes('--json')) {
      writeAll(1, formatDoctorJSON(result) + '\n');
    } else {
      console.log(formatDoctor(result));
    }
    process.exit(result.ok ? 0 : 1);
  }

  // D9: `sigmap wiki` — deterministic architecture narrative (no LLM).
  if (args[0] === 'wiki') {
    const { buildWiki } = requireSourceOrBundled('./src/wiki/generate');
    const result = buildWiki(cwd, { version: VERSION, config });
    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(result.data, null, 2) + '\n');
      process.exit(0);
    }
    const outIdx = args.indexOf('--out');
    const outRel = outIdx >= 0 && args[outIdx + 1] && !args[outIdx + 1].startsWith('--')
      ? args[outIdx + 1]
      : path.join('.context', 'WIKI.md');
    const outPath = path.resolve(cwd, outRel);
    try {
      fs.mkdirSync(path.dirname(outPath), { recursive: true });
      fs.writeFileSync(outPath, result.markdown, 'utf8');
    } catch (e) {
      console.error(`[sigmap] cannot write ${outPath}: ${e.message}`);
      process.exit(1);
    }
    console.log(`[sigmap] wiki → ${path.relative(cwd, outPath)} (${result.data.files} files · ${result.data.modules.length} modules)`);
    process.exit(0);
  }

  // Layer 3: `sigmap conventions` — extract & report repo coding conventions
  // (file naming, export style, test framework) for TS/JS/Python so generated
  // code matches the house style. Writes .context/conventions.json.
  if (args[0] === 'conventions') {
    const jsonOut = args.includes('--json');
    const { extractConventions } = requireSourceOrBundled('./src/conventions/extract');
    const files = buildFileList(cwd, config);
    const result = extractConventions(cwd, files);

    // `--inject`: write/update the conventions block in CLAUDE.md (idempotent).
    if (args.includes('--inject')) {
      const { renderConventionsBlock, injectConventions } = requireSourceOrBundled('./src/conventions/inject');
      const claudePath = path.join(cwd, 'CLAUDE.md');
      let existing = '';
      try { if (fs.existsSync(claudePath)) existing = fs.readFileSync(claudePath, 'utf8'); } catch (_) {}
      const block = renderConventionsBlock(result, VERSION);
      try {
        fs.writeFileSync(claudePath, injectConventions(existing, block));
      } catch (e) {
        console.error(`[sigmap] cannot write ${claudePath}: ${e.message}`);
        process.exit(1);
      }
      console.log(`[sigmap] conventions → injected block into ${path.relative(cwd, claudePath) || 'CLAUDE.md'}`);
      process.exit(0);
    }

    // `--update`: incremental rescan — refresh .context/conventions.json only when stale.
    if (args.includes('--update')) {
      const { planUpdate } = requireSourceOrBundled('./src/conventions/update');
      const outDir = path.join(cwd, '.context');
      const outPath = path.join(outDir, 'conventions.json');
      const plan = planUpdate(cwd, files, outPath);
      let wrote = false;
      if (plan.stale) {
        try {
          fs.mkdirSync(outDir, { recursive: true });
          fs.writeFileSync(outPath, JSON.stringify(result, null, 2) + '\n');
          wrote = true;
        } catch (e) {
          console.error(`[sigmap] cannot write ${outPath}: ${e.message}`);
          process.exit(1);
        }
      }
      const payload = { stale: plan.stale, wrote, snapshotExists: plan.snapshotExists, changed: plan.changed.length, scanned: result.scannedFiles };
      if (jsonOut) {
        writeAll(1, JSON.stringify(payload) + '\n');
        process.exit(0);
      }
      if (!plan.stale) {
        console.log(`[sigmap] conventions --update  ✓ up to date — ${result.scannedFiles} files, no changes since last scan`);
        process.exit(0);
      }
      const how = plan.snapshotExists ? `${plan.changed.length} changed file${plan.changed.length === 1 ? '' : 's'}` : 'initial scan';
      console.log(`[sigmap] conventions --update  rescanned (${how}) → wrote ${path.relative(cwd, outPath)}`);
      process.exit(0);
    }

    // `--fix`: exhaustive rename checklist — every file not matching the dominant style.
    if (args.includes('--fix')) {
      const { buildFixList } = requireSourceOrBundled('./src/conventions/fix');
      const fixList = buildFixList(cwd, files, result);
      if (jsonOut) {
        writeAll(1, JSON.stringify(fixList) + '\n');
        process.exit(0);
      }
      console.log('[sigmap] conventions --fix  (TS/JS/Python)');
      if (!fixList.dominant) {
        console.log('  no dominant file-naming convention — nothing to fix');
        process.exit(0);
      }
      if (fixList.count === 0) {
        console.log(`  ✓ no fixes needed — every file matches ${fixList.dominant}`);
        process.exit(0);
      }
      console.log(`  ${fixList.count} file${fixList.count === 1 ? '' : 's'} to rename to ${fixList.dominant}:`);
      for (const r of fixList.renames) console.log(`  - [ ] ${r.from}  →  ${r.to}`);
      process.exit(0);
    }

    // `--ci`: gate — fail when overall consistency is below a threshold (or regresses).
    if (args.includes('--ci')) {
      const { ciGate } = requireSourceOrBundled('./src/conventions/ci');
      const minIdx = args.indexOf('--min');
      const min = minIdx !== -1 && args[minIdx + 1] ? parseFloat(args[minIdx + 1]) : undefined;
      const noRegress = args.includes('--no-regress');
      let prior = null;
      if (noRegress) {
        try {
          const lines = fs.readFileSync(path.join(cwd, '.context', 'conventions-history.ndjson'), 'utf8').split('\n').filter(Boolean);
          if (lines.length) prior = JSON.parse(lines[lines.length - 1]);
        } catch (_) {}
      }
      const gate = ciGate(result, { min, noRegress }, prior);
      if (jsonOut) {
        writeAll(1, JSON.stringify(gate) + '\n');
        process.exit(gate.ok ? 0 : 1);
      }
      const pctC = (n) => `${(n * 100).toFixed(0)}%`;
      if (gate.ok) {
        console.log(`[sigmap] conventions --ci  ✓ PASS — consistency ${pctC(gate.score)} (min ${pctC(gate.min)})`);
        process.exit(0);
      }
      console.log(`[sigmap] conventions --ci  ✗ FAIL — consistency ${pctC(gate.score)} (min ${pctC(gate.min)})`);
      for (const r of gate.reasons) console.log(`  • ${r}`);
      process.exit(1);
    }

    // `--report`: consistency audit + score + trend vs the last run.
    if (args.includes('--report')) {
      const { scoreReport, snapshot } = requireSourceOrBundled('./src/conventions/report');
      const histPath = path.join(cwd, '.context', 'conventions-history.ndjson');
      let prior = null;
      try {
        const lines = fs.readFileSync(histPath, 'utf8').split('\n').filter(Boolean);
        if (lines.length) prior = JSON.parse(lines[lines.length - 1]);
      } catch (_) {}
      const report = scoreReport(result, prior);
      // Append the new snapshot to the history log.
      try {
        fs.mkdirSync(path.join(cwd, '.context'), { recursive: true });
        fs.appendFileSync(histPath, JSON.stringify(snapshot(result, new Date().toISOString())) + '\n');
      } catch (_) {}

      if (jsonOut) {
        writeAll(1, JSON.stringify(report) + '\n');
        process.exit(0);
      }
      const pctR = (n) => `${(n * 100).toFixed(0)}%`;
      const arrow = (d) => (d == null ? '' : d > 0.0005 ? ` ▲${(d * 100).toFixed(0)}pp` : d < -0.0005 ? ` ▼${(Math.abs(d) * 100).toFixed(0)}pp` : ' =');
      console.log('[sigmap] conventions --report  (TS/JS/Python)');
      console.log(`  overall consistency: ${pctR(report.score)}${arrow(report.scoreDelta)}${report.prevScore == null ? '  (first run)' : ''}`);
      for (const c of report.conventions) {
        if (c.total === 0) { console.log(`  ${c.name.padEnd(14)} n/a (no samples)`); continue; }
        console.log(`  ${c.name.padEnd(14)} ${c.dominant} ${pctR(c.dominantPct)} [${c.tier}]${arrow(c.delta)}`);
      }
      console.log(`  ${'test framework'.padEnd(14)} ${report.testFramework || 'none detected'}`);
      process.exit(0);
    }

    // `--conflicts`: surface why a convention is mixed (breakdown + rename suggestions).
    if (args.includes('--conflicts')) {
      const { analyzeConflicts } = requireSourceOrBundled('./src/conventions/conflicts');
      const report = analyzeConflicts(result);
      if (jsonOut) {
        writeAll(1, JSON.stringify(report) + '\n');
        process.exit(0);
      }
      const pctC = (n) => `${(n * 100).toFixed(0)}%`;
      if (!report.hasConflicts) {
        console.log('[sigmap] conventions --conflicts  (TS/JS/Python)');
        console.log('  no conflicts — conventions are consistent ✓');
        process.exit(0);
      }
      console.log('[sigmap] conventions --conflicts  (TS/JS/Python)');
      for (const c of report.conventions) {
        console.log(`\n  ${c.name} — dominant: ${c.dominant} ${pctC(c.dominantPct)} [${c.tier}]`);
        for (const v of c.variants) {
          const barLen = Math.max(1, Math.round(v.pct * 20));
          const bar = '█'.repeat(barLen);
          const tag = v.pattern === c.dominant ? ' (dominant)' : '';
          const ex = v.examples.length ? `  e.g. ${v.examples.join(', ')}` : '';
          console.log(`    ${v.pattern.padEnd(12)} ${String(v.count).padStart(4)}  ${pctC(v.pct).padStart(4)} ${bar}${tag}${ex}`);
        }
        if (c.renames.length) {
          console.log(`    rename to match ${c.dominant}:`);
          for (const r of c.renames) console.log(`      ${r.from}  →  ${r.to}`);
        }
      }
      process.exit(0);
    }

    const outDir = path.join(cwd, '.context');
    const outPath = path.join(outDir, 'conventions.json');
    try {
      fs.mkdirSync(outDir, { recursive: true });
      fs.writeFileSync(outPath, JSON.stringify(result, null, 2) + '\n');
    } catch (e) {
      console.error(`[sigmap] cannot write ${outPath}: ${e.message}`);
      process.exit(1);
    }

    if (jsonOut) {
      writeAll(1, JSON.stringify(result) + '\n');
      process.exit(0);
    }

    const pct = (n) => `${(n * 100).toFixed(0)}%`;
    const tierLabel = { consistent: 'consistent', mostly: 'mostly', inconsistent: 'mixed', unknown: 'n/a' };
    const line = (name, conv) => {
      if (!conv || conv.total === 0) return `  ${name.padEnd(14)} n/a (no samples)`;
      const variants = conv.variants.slice(1, 3).map((v) => `${v.label} ${pct(v.pct)}`).join(', ');
      const tail = variants ? `  ·  also: ${variants}` : '';
      return `  ${name.padEnd(14)} ${conv.dominant} ${pct(conv.dominantPct)} [${tierLabel[conv.tier]}]${tail}`;
    };

    console.log('[sigmap] conventions  (TS/JS/Python)');
    console.log(`  scanned        ${result.scannedFiles} file${result.scannedFiles === 1 ? '' : 's'}`);
    console.log(line('file naming', result.fileNaming));
    console.log(line('export style', result.exportStyle));
    console.log(`  ${'test framework'.padEnd(14)} ${result.testFramework || 'none detected'}`);
    console.log(`\n  → wrote ${path.relative(cwd, outPath)}`);
    process.exit(0);
  }

  // Layer 4: `sigmap scaffold <name>` — propose a convention-matched structure
  // for a new module, gated by a confidence floor (refuses if conventions are
  // too inconsistent; a wrong proposal systematizes bad code).
  if (args[0] === 'scaffold') {
    const jsonOut = args.includes('--json');
    const name = args[1] && !args[1].startsWith('--') ? args[1] : null;
    if (!name) {
      console.error('[sigmap] usage: sigmap scaffold <name> [--ext <e>] [--threshold <n>] [--force] [--json]');
      process.exit(1);
    }
    const thIdx = args.indexOf('--threshold');
    const threshold = thIdx !== -1 && args[thIdx + 1] ? parseFloat(args[thIdx + 1]) : undefined;
    const extIdx = args.indexOf('--ext');
    const ext = extIdx !== -1 && args[extIdx + 1] ? args[extIdx + 1].replace(/^\./, '') : undefined;
    const force = args.includes('--force');

    const { extractConventions } = requireSourceOrBundled('./src/conventions/extract');
    const { proposeScaffold } = requireSourceOrBundled('./src/scaffold/propose');
    const conventions = extractConventions(cwd, buildFileList(cwd, config));
    const decision = proposeScaffold(name, conventions, { threshold, ext, force });

    // §6.2 (2d): persist an accepted proposal so `create`/agents can read it back.
    let persistedTo = null;
    if (decision.ok) {
      const { scaffoldPath, renderScaffoldMarkdown } = requireSourceOrBundled('./src/scaffold/persist');
      const outPath = scaffoldPath(cwd);
      try {
        fs.mkdirSync(path.dirname(outPath), { recursive: true });
        fs.writeFileSync(outPath, renderScaffoldMarkdown(decision, { timestamp: new Date().toISOString() }));
        persistedTo = path.relative(cwd, outPath) || outPath;
      } catch (_) {}
    }

    if (jsonOut) {
      writeAll(1, JSON.stringify({ ...decision, persistedTo }) + '\n');
      process.exit(decision.ok ? 0 : 1);
    }

    const pctS = (n) => `${(n * 100).toFixed(0)}%`;
    if (decision.ok) {
      console.log(`[sigmap] scaffold "${decision.name}"  — conventions ${decision.tier} (${pctS(decision.confidence)})`);
      if (decision.warning) console.log(`  ⚠ ${decision.warning}`);
      const p = decision.proposal;
      console.log(`  file:           ${p.filename}  (${p.namingStyle})`);
      console.log(`  export style:   ${p.exportStyle}`);
      console.log(`  test file:      ${p.testFile}${p.testFramework ? `  (${p.testFramework})` : ''}`);
      if (persistedTo) console.log(`\n  → wrote ${persistedTo}`);
      process.exit(0);
    }

    console.log(`[sigmap] scaffold "${decision.name}" — REFUSED`);
    console.log(`  ${decision.reason}`);
    if (decision.conflicts && decision.conflicts.hasConflicts) {
      for (const c of decision.conflicts.conventions) {
        console.log(`\n  ${c.name} — dominant: ${c.dominant} ${pctS(c.dominantPct)} [${c.tier}]`);
        for (const v of c.variants) {
          console.log(`    ${v.pattern.padEnd(12)} ${pctS(v.pct).padStart(4)}${v.examples.length ? `  e.g. ${v.examples.join(', ')}` : ''}`);
        }
      }
    }
    process.exit(1);
  }

  // v7.0.0: `sigmap squeeze <file|->` — minimize a pasted stacktrace / CI-log / JSON blob
  if (args[0] === 'squeeze') {
    const jsonOut = args.includes('--json');
    // `--response <file|->` names the agent/tool response to squeeze explicitly
    // (mirrors `sigmap judge --response`); otherwise fall back to the positional arg.
    const respIdx = args.indexOf('--response');
    let target;
    if (respIdx !== -1) {
      const val = args[respIdx + 1];
      if (!val || val.startsWith('--')) {
        console.error('[sigmap] Usage: sigmap squeeze --response <file|-> [--json]');
        process.exit(1);
      }
      target = val;
    } else {
      target = args[1] && !args[1].startsWith('--') ? args[1] : '-';
    }
    let input = '';
    try {
      input = fs.readFileSync(target === '-' ? 0 : path.resolve(cwd, target), 'utf8');
    } catch (e) {
      console.error(`[sigmap] cannot read input: ${e.message}`);
      process.exit(1);
    }

    const { squeeze: runSqueeze, formatSummary } = requireSourceOrBundled('./src/squeeze/index');
    let symbolIndex = null;
    try {
      const { buildSigIndex } = requireSourceOrBundled('./src/retrieval/ranker');
      symbolIndex = buildSigIndex(cwd, { full: true });
    } catch (_) {}
    const sq = runSqueeze(input, { srcDirs: config.srcDirs, symbolIndex });

    try {
      const { checkStarNudge } = requireSourceOrBundled('./src/nudge');
      checkStarNudge(cwd, true, { silent: !process.stderr.isTTY || jsonOut, bump: { squeezeOffered: sq.applies ? 1 : 0 } });
    } catch (_) {}

    if (jsonOut) {
      writeAll(1, JSON.stringify({
        category: sq.category, confidence: sq.confidence,
        rawTokens: sq.rawTokens, squeezedTokens: sq.squeezedTokens,
        reduction: sq.reduction, enriched: sq.enriched, squeezed: sq.squeezed,
      }) + '\n');
      process.exit(0);
    }
    if (!sq.category) {
      process.stderr.write('[sigmap] no squeezable structure detected — input unchanged\n');
      writeAll(1, input);
      process.exit(0);
    }
    process.stderr.write(formatSummary(sq) + '\n\n');
    writeAll(1, sq.squeezed + '\n');
    process.exit(0);
  }

  // `sigmap verify-ai-output <answer.md>` — Hallucination Guard (deterministic core)
  // Gap 2 (step 2): `sigmap verify-plan <plan.md>` — check a plan against the
  // live index before execution (files/symbols exist, blast radius, scope).
  if (args[0] === 'verify-plan') {
    const target = args[1] && !args[1].startsWith('--') ? args[1] : null;
    const jsonOut = args.includes('--json');
    if (!target) {
      console.error('[sigmap] Usage: sigmap verify-plan <plan.md|-> [--creates <names>] [--json]');
      process.exit(1);
    }
    let planText = '';
    try {
      planText = fs.readFileSync(target === '-' ? 0 : path.resolve(cwd, target), 'utf8');
    } catch (e) {
      console.error(`[sigmap] cannot read plan: ${e.message}`);
      process.exit(1);
    }
    // #666: names the plan INTRODUCES are verified in reverse — they must not
    // exist yet. A `Creates:` section in the plan says the same thing; this
    // flag is for plans that carry no such section.
    const createsIdx = args.indexOf('--creates');
    const createsArg = createsIdx !== -1 && args[createsIdx + 1] && !args[createsIdx + 1].startsWith('--')
      ? args[createsIdx + 1] : null;
    const creates = createsArg ? createsArg.split(',').map((x) => x.trim()).filter(Boolean) : [];

    const { verifyPlan } = requireSourceOrBundled('./src/plan/verify-plan');
    const result = verifyPlan(planText, cwd, creates.length ? { creates } : {});

    if (jsonOut) {
      writeAll(1, JSON.stringify(result) + '\n');
      process.exit(result.summary.ok ? 0 : 1);
    }

    const s = result.summary;
    const introCount = s.filesIntroduced + s.symbolsIntroduced;
    console.log(`[sigmap] verify-plan — ${s.filesReferenced} file(s), ${s.symbolsReferenced} symbol(s) referenced`
      + (introCount ? `, ${introCount} introduced` : ''));
    // #979: a referenced file the import graph cannot read has no blast radius to
    // check; "in bounds" would be a claim about nothing.
    const untrackedBlast = (result.blast || []).filter((b) => b.graph);
    const printUntrackedBlast = () => {
      if (!untrackedBlast.length) return;
      const { shortNote } = requireSourceOrBundled('./src/graph/language-support');
      for (const b of untrackedBlast) console.log(`  ⚠ blast radius not tracked: ${b.file} — ${shortNote(b.language)}`);
    };
    if (result.issues.length === 0) {
      const blastClaim = untrackedBlast.length ? 'scope in bounds' : 'blast radius and scope in bounds';
      console.log(introCount
        ? `  ✓ plan checks out — references exist, introductions do not yet, ${blastClaim}`
        : `  ✓ plan checks out — all references exist, ${blastClaim}`);
      printUntrackedBlast();
      process.exit(0);
    }
    for (const i of result.issues) {
      const mark = i.severity === 'error' ? '✗' : '⚠';
      if (i.type === 'redefines-existing') console.log(`  ${mark} already exists: ${i.ref} — the plan lists it under Creates, but this ${i.kind} is already in the repo${i.line ? ` (line ${i.line})` : ''}`);
      else if (i.type === 'missing-file') console.log(`  ${mark} missing file: ${i.ref} (line ${i.line})`);
      else if (i.type === 'unknown-symbol') console.log(`  ${mark} unknown symbol: ${i.ref}()${i.suggestion ? ` — did you mean ${i.suggestion}()?` : ''} (line ${i.line})`);
      else if (i.type === 'high-blast-radius') console.log(`  ${mark} high blast radius: ${i.ref} → ${i.count} dependents`);
      else if (i.type === 'broad-scope') console.log(`  ${mark} broad scope: ${i.count} files (threshold ${i.threshold})`);
    }
    printUntrackedBlast();
    console.log(`\n  ${s.errors} error(s), ${s.warnings} warning(s)`);
    process.exit(s.ok ? 0 : 1);
  }

  // `sigmap verify` is the flagship alias for `verify-ai-output` — the grounding
  // guard that proves an AI answer is anchored to real signatures + line anchors.
  if (args[0] === 'verify-ai-output' || args[0] === 'verify') {
    const cmdName = args[0];
    const target = args[1];
    const jsonOut = args.includes('--json');
    const reportIdx = args.indexOf('--report');
    const reportOut = reportIdx !== -1
      ? (args[reportIdx + 1] && !args[reportIdx + 1].startsWith('--') ? args[reportIdx + 1] : 'sigmap-verify-report.html')
      : null;
    // Exit codes: 1 is "issues found", so a usage error must not share it — a CI job
    // that gates on `verify` has to tell a typo'd path from a fabricated symbol (#998).
    const usage = `[sigmap] Usage: sigmap ${cmdName} <answer.md> [--json] [--report [out.html]]`;
    if (!target || target.startsWith('--')) {
      console.error(usage);
      process.exit(2);
    }
    const absTarget = path.resolve(cwd, target);
    let answerText;
    try {
      if (!fs.statSync(absTarget).isFile()) throw Object.assign(new Error('not a file'), { code: 'ENOTFILE' });
      answerText = fs.readFileSync(absTarget, 'utf8');
    } catch (e) {
      console.error(e.code === 'ENOENT' ? `[sigmap] file not found: ${target}`
        : e.code === 'ENOTFILE' ? `[sigmap] not a file: ${target}`
        : `[sigmap] cannot read ${target}: ${e.code || e.message}`);
      console.error(usage);
      process.exit(2);
    }

    const { verify } = requireSourceOrBundled('./src/verify/hallucination-guard');
    const vcov = requireSourceOrBundled('./src/verify/coverage');
    const { issues, summary } = verify(answerText, cwd);
    const rel = path.relative(cwd, absTarget) || target;
    // What this run checked and whether its index can be relied on (#989). The
    // exit code follows: a finding is 1; no finding is 0 only with a current index.
    const vindex = vcov.indexState(cwd, summary, config);
    summary.coverage = vcov.coverageOf(summary, vindex);
    const vexit = vcov.exitCodeFor(summary, summary.coverage);
    const result = { file: rel, issues, summary };

    // Optional HTML report (Surface A) — written alongside any other output.
    if (reportOut) {
      const { renderReportHtml } = requireSourceOrBundled('./src/format/verify-report');
      const outAbs = path.resolve(cwd, reportOut);
      fs.writeFileSync(outAbs, renderReportHtml(result));
      if (!jsonOut) console.log(`[sigmap] report written: ${path.relative(cwd, outAbs) || reportOut}`);
    }

    if (jsonOut) {
      writeAll(1, JSON.stringify(result) + '\n');
      process.exit(vexit);
    }

    // The symbol check needs an index; without one it does not run, and a clean
    // verdict then covers fewer claim classes than the line would suggest (#1007).
    const symbolsSkipped = vindex.state === 'missing' && vindex.symbolsRan === false;
    const indexNote = vindex.warning ? `[sigmap] ⚠ ${symbolsSkipped ? 'symbol check skipped: ' : ''}${vindex.warning}` : null;
    const detail = () => { for (const l of vcov.detailLines(summary.coverage)) console.log(`  ${l}`); };

    if (summary.total === 0) {
      if (vindex.state !== 'ok') {
        console.log(`[sigmap] ⚠ ${rel} — no issues in the claims checked, but ${symbolsSkipped ? 'the symbol check did not run' : vindex.state === 'missing' ? 'there is no repo index' : 'the index is out of date'}`);
        console.log(indexNote);
      } else if (summary.coverage.vacuous) {
        console.log(`[sigmap] ⚠ ${rel} — nothing to check: the answer names no file path, import, backticked call or npm script`);
      } else {
        console.log(`[sigmap] ✓ ${rel} — no hallucinations detected (${summary.symbolsIndexed} symbols indexed)`);
      }
      detail();
      process.exit(vexit);
    }

    const labels = {
      'fake-file': 'Fake file', 'fake-test-file': 'Fake test file',
      'fake-import': 'Fake import', 'fake-import-name': 'Fake imported name',
      'fake-symbol': 'Fake symbol', 'fake-npm-script': 'Fake npm script',
    };
    const bt = summary.byType;
    console.log(`[sigmap] ✗ ${rel} — ${summary.total} issue${summary.total === 1 ? '' : 's'} found`);
    console.log(`  fake-file: ${bt['fake-file']}  fake-test-file: ${bt['fake-test-file']}  fake-import: ${bt['fake-import']}  fake-import-name: ${bt['fake-import-name']}  fake-symbol: ${bt['fake-symbol']}  fake-npm-script: ${bt['fake-npm-script']}`);
    console.log('');
    for (const issue of issues) {
      console.log(`  L${issue.line}  [${labels[issue.type] || issue.type}]  ${issue.message}`);
      if (issue.suggestion) console.log(`         ↳ ${issue.suggestion}`);
    }
    console.log('');
    if (indexNote) console.log(indexNote);
    detail();
    process.exit(vexit);
  }

  // Gap 2 (step 4): `sigmap review-pr` — diff audit (scope drift, god-nodes,
  // missing tests, security-sensitive files). Last guard stage of `create`.
  if (args[0] === 'review-pr') {
    const jsonOut = args.includes('--json');
    const staged = args.includes('--staged');
    const baseIdx = args.indexOf('--base');
    const baseArg = baseIdx !== -1 && args[baseIdx + 1] && !args[baseIdx + 1].startsWith('--') ? args[baseIdx + 1] : null;

    let nameStatus = '';
    if (staged) {
      nameStatus = __tryGit(['diff', '--cached', '--name-status'], { cwd });
    } else {
      let base = baseArg;
      if (!base) {
        for (const ref of ['main', 'develop']) {
          if (__tryGit(['rev-parse', '--verify', '--quiet', ref], { cwd })) { base = ref; break; }
        }
      }
      const mb = base ? (__tryGit(['merge-base', 'HEAD', base], { cwd }) || base) : 'HEAD~1';
      nameStatus = __tryGit(['diff', '--name-status', `${mb}..HEAD`], { cwd });
    }

    const changedFiles = nameStatus.split('\n').filter(Boolean).map((line) => {
      const parts = line.split('\t');
      const status = parts[0][0]; // M/A/D/R…
      const file = parts[parts.length - 1]; // rename → new path
      return { path: file, status };
    });

    // --markdown / --evidence: emit the branded, deterministic PR Evidence Report.
    if (args.includes('--markdown') || args.includes('--evidence')) {
      const { buildPrEvidence, formatPrEvidenceMarkdown } = requireSourceOrBundled('./src/review/pr-evidence');
      const scope = staged ? 'staged' : (baseArg ? `vs ${baseArg}` : 'branch');
      const ev = buildPrEvidence(changedFiles, cwd, { scope });
      writeAll(1, formatPrEvidenceMarkdown(ev) + '\n');
      process.exit(ev.review.summary.ok ? 0 : 1);
    }

    const { reviewPr } = requireSourceOrBundled('./src/review/review-pr');
    const result = reviewPr(changedFiles, cwd, {});

    if (jsonOut) {
      writeAll(1, JSON.stringify(result) + '\n');
      process.exit(result.summary.ok ? 0 : 1);
    }

    const s = result.summary;
    console.log(`[sigmap] review-pr — ${s.filesChanged} file(s) changed (${s.sourceChanged} source, ${s.testsChanged} test)`);
    if (s.generatedIgnored) console.log(`  (${s.generatedIgnored} SigMap-generated output(s) in the diff not reviewed)`);
    if (s.findings === 0) {
      console.log('  ✓ no findings — scope, tests, blast radius, and sensitive files all clear');
      process.exit(0);
    }
    const label = { 'missing-tests': 'missing tests', 'security-file': 'sensitive path (path heuristic)', 'secret-detected': 'secret detected', 'god-node': 'god node', 'scope-drift': 'scope drift' };
    for (const f of result.findings) {
      if (f.type === 'missing-tests') console.log(`  ⚠ ${label[f.type]}: ${f.file} changed with no matching test`);
      else if (f.type === 'security-file') console.log(`  ⚠ ${label[f.type]}: ${f.file}`);
      else if (f.type === 'secret-detected') console.log(`  ✗ ${label[f.type]}: ${f.secret} in ${f.file}`);
      else if (f.type === 'god-node') console.log(`  ⚠ ${label[f.type]}: ${f.file} → ${f.count} dependents`);
      else if (f.type === 'scope-drift') console.log(`  ⚠ ${label[f.type]}: ${f.count} top-level dirs (${f.dirs.join(', ')})`);
    }
    console.log(`\n  ${s.findings} finding(s)`);
    process.exit(1);
  }

  // Gap 2 (capstone): `sigmap create "<task>"` — orchestrate the 4 guard stages
  // (scaffold → verify-plan → verify-ai-output → review-pr) with n/4 numbering.
  if (args[0] === 'create') {
    const EXIT_NOTHING_RAN = 2;
    const jsonOut = args.includes('--json');
    const task = args[1] && !args[1].startsWith('--') ? args[1] : null;
    const flagVal = (flag) => { const i = args.indexOf(flag); return i !== -1 && args[i + 1] && !args[i + 1].startsWith('--') ? args[i + 1] : null; };
    const nameArg = flagVal('--name');
    const planFile = flagVal('--plan');
    const answerFile = flagVal('--answer');
    const staged = args.includes('--staged');
    const baseArg = flagVal('--base');
    const createsArg = flagVal('--creates');

    const ctx = { task };
    if (createsArg) ctx.creates = createsArg.split(',').map((x) => x.trim()).filter(Boolean);

    if (nameArg) {
      ctx.name = nameArg;
      try {
        const { extractConventions } = requireSourceOrBundled('./src/conventions/extract');
        ctx.conventions = extractConventions(cwd, buildFileList(cwd, config));
      } catch (_) {}
    }
    for (const [flag, file, key] of [['--plan', planFile, 'plan'], ['--answer', answerFile, 'answer']]) {
      if (!file) continue;
      try { ctx[key] = fs.readFileSync(path.resolve(cwd, file), 'utf8'); }
      catch (e) { console.error(`[sigmap] cannot read ${flag} file: ${e.message}`); process.exit(1); }
    }

    // review-pr inputs: changed files from git (same collection as review-pr).
    let nameStatus = '';
    if (staged) {
      nameStatus = __tryGit(['diff', '--cached', '--name-status'], { cwd });
    } else {
      let base = baseArg;
      if (!base) {
        for (const ref of ['main', 'develop']) {
          if (__tryGit(['rev-parse', '--verify', '--quiet', ref], { cwd })) { base = ref; break; }
        }
      }
      const mb = base ? (__tryGit(['merge-base', 'HEAD', base], { cwd }) || base) : 'HEAD~1';
      nameStatus = __tryGit(['diff', '--name-status', `${mb}..HEAD`], { cwd });
    }
    ctx.changedFiles = nameStatus.split('\n').filter(Boolean).map((line) => {
      const parts = line.split('\t');
      return { path: parts[parts.length - 1], status: parts[0][0] };
    });

    const { orchestrate } = requireSourceOrBundled('./src/create/orchestrate');
    const result = orchestrate(ctx, cwd);

    if (jsonOut) {
      writeAll(1, JSON.stringify(result) + '\n');
      process.exit(result.summary.nothingRan ? EXIT_NOTHING_RAN : (result.summary.ok ? 0 : 1));
    }

    console.log(`[sigmap] create${result.task ? ` "${result.task}"` : ''} — running deterministic guards (scaffold · verify-plan · verify-ai-output · review-pr); the LLM does the authoring`);
    for (const st of result.steps) {
      const mark = st.skipped ? '–' : (st.ok ? '✓' : '✗');
      const status = st.skipped ? `skipped (${st.reason})` : (st.ok ? 'ok' : 'FAILED');
      console.log(`  ${st.n}/${st.total} ${mark} ${st.name.padEnd(16)} ${status}`);
    }
    const su = result.summary;
    console.log(`\n  ${su.ran}/${su.total} ran · ${su.passed} passed · ${su.failed} failed · ${su.skipped} skipped`);
    // #767: 0 ran is not a pass. `failed === 0` is vacuously true over an empty
    // set, so a CI step shelling out to `create` read success from a run that
    // verified nothing. Exit 2 — "nothing to do" — distinguishes it from a
    // stage that ran and failed (1), matching `judge`'s inconclusive code.
    if (su.nothingRan) {
      console.log('\n  nothing ran — create verifies the inputs you give it:');
      for (const st of result.steps) {
        console.log(`    ${st.name.padEnd(17)} needs ${st.needs}`);
      }
      process.exit(EXIT_NOTHING_RAN);
    }
    process.exit(su.ok ? 0 : 1);
  }

  // Feature 1: `sigmap explain <file>` — why a file is included or excluded
  // The bare `--explain <file>` alias must not swallow `--query ... --explain`,
  // where --explain takes no argument and means "explain the RANKING" (#813).
  if (args[0] === 'explain' || (args.includes('--explain') && !args.includes('--query'))) {
    const target = args[0] === 'explain'
      ? args[1]
      : args[args.indexOf('--explain') + 1];

    if (!target || target.startsWith('--')) {
      console.error('[sigmap] Usage: sigmap explain <file>');
      process.exit(1);
    }

    const absPath = path.resolve(cwd, target);
    const rel     = path.relative(cwd, absPath);
    const jsonOut = args.includes('--json');

    // 0. The file has to exist (#772). Without this, a missing path fell
    // through to the "no signatures" branch and was reported as EXCLUDED with
    // `Fix: check that the file contains function/class definitions` — advice
    // that cannot help, at exit 0. The MCP `explain_file` handler already
    // checks existence; the CLI path did not.
    if (!fs.existsSync(absPath)) {
      if (jsonOut) {
        writeAll(1, JSON.stringify({ status: 'not-found', reason: 'file does not exist on disk', path: rel, fix: 'check the path — nothing at this location to explain' }) + '\n');
      } else {
        console.log(`[sigmap] ${rel} — NOT FOUND`);
        console.log(`  Reason: no such file on disk`);
        console.log(`  Fix:    check the path — nothing at this location to explain`);
      }
      process.exit(1);
    }

    // 1. Check .contextignore
    const ignorePatterns = loadIgnorePatterns(cwd);
    const ignored = matchesIgnore(rel.replace(/\\/g, '/'), ignorePatterns);
    if (ignored) {
      if (jsonOut) {
        writeAll(1, JSON.stringify({ status: 'excluded', reason: '.contextignore', fix: `remove the pattern or add '!${rel}' as an exception` }) + '\n');
      } else {
        console.log(`[sigmap] ${rel} — EXCLUDED`);
        console.log(`  Reason: matched .contextignore`);
        console.log(`  Fix:    remove the pattern or add '!${rel}' as an exception`);
      }
      process.exit(0);
    }

    // 1b. A declared `main` / `bin` is source only when it is not generated (#876).
    // `declaredEntrypoints` fills __skippedEntrypoints with every one it left out.
    const declaredKept = declaredEntrypoints(cwd, config, []);
    const skippedWhy = __skippedEntrypoints.get(absPath);
    if (skippedWhy) {
      const fix = 'index the sources it is built from (srcDirs); a generated entrypoint repeats them';
      if (jsonOut) {
        writeAll(1, JSON.stringify({ status: 'excluded', reason: 'generated entrypoint', detail: skippedWhy, fix }) + '\n');
      } else {
        console.log(`[sigmap] ${rel} — EXCLUDED`);
        console.log(`  Reason: generated entrypoint declared in package.json (${skippedWhy})`);
        console.log(`  Fix:    ${fix}`);
      }
      process.exit(0);
    }

    // 2. Check srcDirs membership — a declared entrypoint outside srcDirs is indexed all the same
    const inSrcDirs = declaredKept.includes(absPath)
      || (config.srcDirs || []).some(d => absPath.startsWith(path.resolve(cwd, d)));
    if (!inSrcDirs) {
      if (jsonOut) {
        writeAll(1, JSON.stringify({ status: 'excluded', reason: 'not in srcDirs', srcDirs: config.srcDirs, fix: 'add the containing directory to srcDirs in gen-context.config.json' }) + '\n');
      } else {
        console.log(`[sigmap] ${rel} — EXCLUDED`);
        console.log(`  Reason: not under any srcDir (${(config.srcDirs || []).join(', ')})`);
        console.log(`  Fix:    add the containing directory to srcDirs in gen-context.config.json`);
      }
      process.exit(0);
    }

    // 3. Detect extractor and extract sigs
    const base    = path.basename(absPath);
    const ext     = path.extname(base).toLowerCase();
    let extractorName = EXT_MAP[ext] || null;
    if (!extractorName && isDockerfile(base)) extractorName = 'dockerfile';
    if (!extractorName) extractorName = 'generic';

    let sigs = [];
    if (fs.existsSync(absPath)) {
      try {
        const content = fs.readFileSync(absPath, 'utf8');
        const extractor = getExtractor(extractorName);
        if (extractor) sigs = extractor.extract(content, absPath).slice(0, config.maxSigsPerFile || 25);
      } catch (_) {}
    }

    if (!sigs.length) {
      // A file that declares exports and still extracts as nothing is an extractor gap, not a
      // configuration problem: say what was there instead of advice that cannot apply (#996).
      let seen = [];
      try { seen = exportLinesOf(fs.readFileSync(absPath, 'utf8')); } catch (_) { /* unreadable: the generic answer */ }
      if (seen.length > 0) {
        const fix = 'no configuration change indexes it: the extractor does not read this declaration shape (see KNOWN_LIMITATIONS.md); the file stays reachable by its path';
        if (jsonOut) {
          writeAll(1, JSON.stringify({ status: 'excluded', reason: 'no signatures', extractor: extractorName, exports: seen.length, saw: seen.slice(0, 3), fix }) + '\n');
        } else {
          console.log(`[sigmap] ${rel} — EXCLUDED`);
          console.log(`  Reason: no extractable signatures (extractor: ${extractorName}) — ${seen.length} export line${seen.length === 1 ? '' : 's'}, none of a shape it reads`);
          for (const l of seen.slice(0, 3)) console.log(`  Saw:    ${l.length > 110 ? l.slice(0, 107) + '...' : l}`);
          console.log(`  Fix:    ${fix}`);
        }
        process.exit(0);
      }
      if (jsonOut) {
        writeAll(1, JSON.stringify({ status: 'excluded', reason: 'no signatures', extractor: extractorName, fix: 'check that the file contains function/class definitions' }) + '\n');
      } else {
        console.log(`[sigmap] ${rel} — EXCLUDED`);
        console.log(`  Reason: no extractable signatures (extractor: ${extractorName})`);
        console.log(`  Fix:    check that the file contains function/class definitions`);
      }
      process.exit(0);
    }

    // 4. Included
    if (jsonOut) {
      writeAll(1, JSON.stringify({ status: 'included', extractor: extractorName, signatures: sigs.length, preview: sigs.slice(0, 3), sigs }) + '\n');
    } else {
      console.log(`[sigmap] ${rel} — INCLUDED`);
      console.log(`  Extractor : ${extractorName}`);
      console.log(`  Signatures: ${sigs.length}`);
      console.log(`  Preview   : ${sigs.slice(0, 3).join(' · ')}`);
    }
    process.exit(0);
  }

  if (args.includes('--init')) {
    writeInitConfig(cwd);
    // §6.2 (2f): document the grounded-creation workflow in CLAUDE.md (idempotent).
    try {
      const { renderCreationWorkflowBlock, injectCreationWorkflow } = requireSourceOrBundled('./src/init/creation-workflow');
      const claudePath = path.join(cwd, 'CLAUDE.md');
      let existing = '';
      try { if (fs.existsSync(claudePath)) existing = fs.readFileSync(claudePath, 'utf8'); } catch (_) {}
      fs.writeFileSync(claudePath, injectCreationWorkflow(existing, renderCreationWorkflowBlock()));
      console.log(`[sigmap] init → Creation workflow block in ${path.relative(cwd, claudePath) || 'CLAUDE.md'}`);
    } catch (_) {}
    process.exit(0);
  }

  if (args.includes('--health')) {
    const { score } = __require('./src/health/scorer');
    const result = score(cwd);
    // v4.0: compute live coverage score to include in health output
    let coverageResult = null;
    try {
      const { coverageScore } = requireSourceOrBundled('./src/analysis/coverage-score');
      const { loadConfig: lc } = requireSourceOrBundled('./src/config/loader');
      const cfg = lc(cwd);
      // Use all files from srcDirs as proxies for "included" (no budget applied in health mode)
      const allFiles = buildFileList(cwd, cfg);
      const fakeEntries = allFiles.map(f => ({ filePath: f }));
      coverageResult = coverageScore(cwd, fakeEntries, cfg);
    } catch (_) {}
    // v6.7: Collect cache stats if enabled
    let cacheStats = null;
    try {
      const cachePath = path.join(cwd, '.sigmap-cache.json');
      if (fs.existsSync(cachePath)) {
        const raw = fs.readFileSync(cachePath, 'utf8');
        const data = JSON.parse(raw);
        const sizeKb = Math.round(Buffer.byteLength(raw) / 1024);
        const entries = Object.keys(data.entries || {}).length;
        const mtime = fs.statSync(cachePath).mtimeMs;
        cacheStats = { sizeKb, entries, mtimeMs: mtime };
      }
    } catch (_) {}
    if (args.includes('--json')) {
      // Feature 3 (VS Code) + Feature 5 (JetBrains): emit tokens + reduction for plugins
      const ctxPath = path.join(cwd, '.github', 'copilot-instructions.md');
      let tokens = 0;
      let reduction = result.tokenReductionPct || 0;
      if (fs.existsSync(ctxPath)) {
        try { tokens = estimateTokens(fs.readFileSync(ctxPath, 'utf8')); } catch (_) {}
      }
      const payload = { ...result, tokens, reduction };
      if (coverageResult) {
        payload.coverage = coverageResult.score;
        payload.coverageGrade = coverageResult.grade;
        payload.coverageConfidence = coverageResult.confidence;
        payload.coverageTotalFiles = coverageResult.total;
        payload.coverageIncludedFiles = coverageResult.included;
      }
      if (cacheStats) {
        payload.cacheStats = cacheStats;
      }
      writeAll(1, JSON.stringify(payload) + '\n');
    } else {
      console.log('[sigmap] health:');
      console.log(`  score           : ${result.score}/100 (grade ${result.grade})`);
      if (coverageResult) {
        // Labelled `readable`: this is a disk-access check, not a coverage claim (#762).
        console.log(`  file access     : ${__require('./src/analysis/coverage-score').formatCoverage(coverageResult, 'readable')}`);
      }
      console.log(`  strategy        : ${result.strategy}`);
      // #773: name the baseline and the window. A bare percentage here was
      // not comparable with `gain`, `budget` or `--report`, which measure
      // different populations over different windows.
      {
        const _src = __require('./src/tracking/usage-source').describeSource(cwd);
        const _red = result.tokenReductionPct !== null
          ? `${result.tokenReductionPct}% (mean of ${_src.total} generate run(s) · vs whole-file baseline)`
          : 'no runs recorded yet';
        console.log(`  token reduction : ${_red}`);
      }
      console.log(`  days since regen: ${result.daysSinceRegen !== null ? result.daysSinceRegen : 'context file not found'}`);
      if (result.strategyFreshnessDays !== null) {
        console.log(`  cold freshness  : ${result.strategyFreshnessDays} day(s)`);
      }
      if (cacheStats) {
        console.log(`  sig-cache       : ${cacheStats.entries} files cached  ${cacheStats.sizeKb}KB on disk`);
      }
      console.log(`  total runs      : ${result.totalRuns} (generate runs; \`gain\` counts every operation)`);
      console.log(`  over-budget runs: ${result.overBudgetRuns}`);
      console.log(`  p50 token count : ${result.p50TokenCount}`);
      console.log(`  p95 token count : ${result.p95TokenCount}`);
      console.log(`  overbudget streak: ${result.overBudgetStreak}`);
      console.log(`  repo languages  : ${result.extractorCoverage}% of supported langs used here (informational — not scored)`);
      console.log(`  ${'score basis'.padEnd(16)}: staleness · token reduction · over-budget rate`);
    }
    process.exit(0);
  }

  if (args.includes('--dashboard')) {
    try {
      const { score } = __require('./src/health/scorer');
      const health = score(cwd);
      const { generateDashboardHtml } = requireSourceOrBundled('./src/format/dashboard');
      const out = generateDashboardHtml(cwd, health);
      // #782: this wrote into benchmarks/reports/, a directory SigMap does not
      // own and which in a consumer repo either does not exist or means
      // something else — leaving an untracked file outside `.context/`, the
      // directory SigMap keeps out of git (#947). Every other artifact lives under it.
      const _outIdx = args.indexOf('--out');
      const _outArg = _outIdx !== -1 ? (args[_outIdx + 1] || '').trim() : '';
      const outPath = _outArg && !_outArg.startsWith('--')
        ? path.resolve(cwd, _outArg)
        : path.join(cwd, '.context', 'dashboard.html');
      fs.mkdirSync(path.dirname(outPath), { recursive: true });
      fs.writeFileSync(outPath, out.html, 'utf8');
      if (args.includes('--json')) {
        writeAll(1, JSON.stringify({ ok: true, file: path.relative(cwd, outPath), summary: out.data.summary }) + '\n');
      } else {
        console.log(`[sigmap] dashboard written: ${path.relative(cwd, outPath)}`);
      }
    } catch (err) {
      console.error(`[sigmap] dashboard error: ${err.message}`);
      process.exit(1);
    }
    process.exit(0);
  }

  if (args.includes('--suggest-tool')) {
    const idx = args.indexOf('--suggest-tool');
    const taskDesc = (args[idx + 1] || '').trim();
    if (!taskDesc || taskDesc.startsWith('--')) {
      console.error('[sigmap] --suggest-tool requires a task description');
      console.error('  Example: node gen-context.js --suggest-tool "refactor the auth module"');
      process.exit(1);
    }
    const __models = requireSourceOrBundled('./src/config/models');
    const __profile = __models.resolveProfile(config);
    const result = suggestTool(taskDesc, __profile);
    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(result) + '\n');
    } else {
      console.log('[sigmap] suggest-tool:');
      console.log(`  tier   : ${result.tier}`);
      console.log(`  label  : ${result.label}`);
      console.log(`  models : ${result.models}`);
      console.log(`  cost   : ${result.costHint}`);
      console.log(`  as of  : ${__models.asOfLabel(__profile).replace(/^as of /, '')} — ` +
        (result.roster ? 'your models.roster' : 'set "models.roster" in gen-context.config.json to name the models you have'));
    }
    process.exit(0);
  }

  if (args.includes('--benchmark') || args.includes('--eval')) {
    try {
      const { run, formatTable, formatMetrics } = __require('./src/eval/runner');
      const tasksFile = path.join(cwd, 'benchmarks', 'tasks', 'retrieval.jsonl');
      const result = run(tasksFile, cwd, { topK: 10 });
      if (args.includes('--json')) {
        // Compact output: strip ranked arrays to keep payload small
        const compact = {
          metrics: result.metrics,
          tasks: result.tasks.map((t) => ({
            id: t.id,
            query: t.query,
            hit5: t.hit5,
            rr: t.rr,
            precAt5: t.precAt5,
            tokens: t.tokens,
            top1: t.ranked[0] || null,
          })),
        };
        writeAll(1, JSON.stringify(compact) + '\n');
      } else {
        console.log(formatMetrics(result.metrics));
        if (result.tasks.length > 0) {
          console.log('');
          console.log(formatTable(result.tasks));
        }
      }
    } catch (err) {
      console.error(`[sigmap] benchmark error: ${err.message}`);
      process.exit(1);
    }
    process.exit(0);
  }

  if (args.includes('--analyze')) {
    try {
      const { analyzeFiles, formatAnalysisTable, formatAnalysisJSON } = requireSourceOrBundled('./src/eval/analyzer');
      const cfg    = config || {};
      const srcDirs = cfg.srcDirs || DEFAULTS.srcDirs;
      const exclude = cfg.exclude || DEFAULTS.exclude;
      const slow    = args.includes('--slow');

      // Collect files (reuse existing file-walker if accessible, else inline)
      const allFiles = [];
      function walkForAnalyze(dir, depth) {
        if (depth > (cfg.maxDepth || 6)) return;
        let entries;
        try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
        for (const e of entries) {
          if (exclude.some((x) => e.name === x || e.name.startsWith(x))) continue;
          const full = path.join(dir, e.name);
          if (e.isDirectory()) walkForAnalyze(full, depth + 1);
          else if (e.isFile()) allFiles.push(full);
        }
      }
      for (const sd of srcDirs) {
        const abs = path.join(cwd, sd);
        if (fs.existsSync(abs)) walkForAnalyze(abs, 0);
      }

      const stats = analyzeFiles(allFiles, cwd, { slow, maxSigs: cfg.maxSigsPerFile || 25 });

      if (args.includes('--json')) {
        const out = JSON.stringify(formatAnalysisJSON(stats)) + '\n';
        // Use the write callback to exit only after the OS has accepted all
        // bytes. Calling process.exit(0) synchronously after write() truncates
        // large outputs because the underlying pipe write is asynchronous even
        // when write() returns true.
        process.stdout.write(out, 'utf8', () => process.exit(0));
        return; // exit is handled by the callback above
      } else {
        const table = formatAnalysisTable(stats, slow);
        writeAll(1, table);
      }
    } catch (err) {
      console.error(`[sigmap] analyze error: ${err.message}`);
      process.exit(1);
    }
    process.exit(0);
  }

  if (args.includes('--diagnose-extractors')) {
    try {
      const fixturesDir = path.join(cwd, 'test', 'fixtures');
      const expectedDir = path.join(cwd, 'test', 'expected');
      if (!fs.existsSync(fixturesDir) || !fs.existsSync(expectedDir)) {
        console.error('[sigmap] test/fixtures or test/expected not found — run from the SigMap repo root');
        process.exit(1);
      }

      // Resolution goes through the dispatcher — the single source of truth
      // (#591). This map was a third copy, and it still pointed at `vue.js`
      // after that module was deleted, which is how a dead extractor survived.
      const { langFor } = requireSourceOrBundled('./src/extractors/dispatch');

      let passed = 0; let failed = 0;
      // Fixtures are walked recursively and keyed by RELATIVE PATH: path-routed
      // extractors (`.github/workflows/*.yml` → pipeline) only resolve when the
      // dispatcher sees the directory, not just the basename (#3, v8.50).
      // Only these top-level subdirectories hold extractor fixtures, and they exist
      // solely so PATH-routed extractors can be exercised at a routable location.
      // `r-package/` and `binary-smoke/` are sample PROJECTS consumed by other
      // suites — their files are not single-language snapshots and must not be
      // compared against test/expected/<lang>.txt.
      const FIXTURE_SUBDIRS = new Set(['.github']);
      const walkFixtures = (dir, prefix) => {
        const out = [];
        for (const name of fs.readdirSync(dir).sort()) {
          const full = path.join(dir, name);
          const rel = prefix ? path.join(prefix, name) : name;
          if (fs.statSync(full).isDirectory()) {
            if (!prefix && !FIXTURE_SUBDIRS.has(name)) continue;
            out.push(...walkFixtures(full, rel));
          } else out.push(rel);
        }
        return out;
      };
      const entries = walkFixtures(fixturesDir, '');

      for (const filename of entries) {
        const lang = langFor(filename);
        if (!lang) continue;

        const fixturePath = path.join(fixturesDir, filename);
        const expectedPath = path.join(expectedDir, `${lang}.txt`);
        if (!fs.existsSync(expectedPath)) {
          console.log(`  SKIP  ${lang.padEnd(12)} (no expected file)`);
          continue;
        }

        const src      = fs.readFileSync(fixturePath, 'utf8');
        const expected = fs.readFileSync(expectedPath, 'utf8').trim();

        let mod;
        try {
          mod = requireSourceOrBundled(`./src/extractors/${lang}`);
        } catch (e) {
          console.log(`  ERROR ${lang.padEnd(12)} loader failed: ${e.message}`);
          failed++;
          continue;
        }

        let actual;
        try {
          // Only the path-routed extractor takes a second argument; handing a
          // path to python.extract would switch it to the native AST tier.
          const sigs = lang === 'pipeline' ? mod.extract(src, filename) : mod.extract(src);
          actual = sigs.join('\n').trim();
        } catch (e) {
          console.log(`  ERROR ${lang.padEnd(12)} extract() threw: ${e.message}`);
          failed++;
          continue;
        }

        if (actual === expected) {
          console.log(`  PASS  ${lang}`);
          passed++;
        } else {
          console.log(`  FAIL  ${lang}`);
          // Show first diff line
          const aLines = actual.split('\n');
          const eLines = expected.split('\n');
          const maxLen = Math.max(aLines.length, eLines.length);
          for (let i = 0; i < maxLen; i++) {
            if (aLines[i] !== eLines[i]) {
              console.log(`         expected: ${(eLines[i] || '(missing)').slice(0, 100)}`);
              console.log(`         actual  : ${(aLines[i] || '(missing)').slice(0, 100)}`);
              break;
            }
          }
          failed++;
        }
      }

      console.log(`\n${passed} passed, ${failed} failed`);
      process.exit(failed > 0 ? 1 : 0);
    } catch (err) {
      console.error(`[sigmap] diagnose error: ${err.message}`);
      process.exit(1);
    }
  }

  if (args.includes('--query')) {
    try {
      const qIdx = args.indexOf('--query');
      const query = (args[qIdx + 1] || '').trim();
      if (!query || query.startsWith('--')) {
        console.error('[sigmap] --query requires a search string');
        console.error('  Example: node gen-context.js --query "add a new language extractor"');
        process.exit(1);
      }
      const { rank, buildSigIndex, formatRankTable, formatRankJSON, formatExplainTable } = requireSourceOrBundled('./src/retrieval/ranker');

      // Resolve the context file path to query against.
      // Priority: --output flag > --adapter flag > buildSigIndex probe order
      //   (customOutput from config is handled inside buildSigIndex itself)
      let queryOpts;
      const adpIdx = args.indexOf('--adapter');

      // 1. --output <file> pins to an explicit path
      if (config.customOutput) {
        queryOpts = { contextPath: path.resolve(cwd, config.customOutput) };
      }

      // 2. --adapter <name> pins to that adapter's output path (if --output not given)
      if (!queryOpts && adpIdx >= 0) {
        const adapterName = (args[adpIdx + 1] || '').trim().toLowerCase();
        const VALID_ADAPTERS = ['copilot', 'claude', 'cursor', 'windsurf', 'openai', 'gemini', 'codex'];
        if (VALID_ADAPTERS.includes(adapterName)) {
          try {
            const adapterMod = __require('./packages/adapters/' + adapterName);
            queryOpts = { contextPath: adapterMod.outputPath(cwd) };
          } catch (_) {}
        }
      }

      const index = buildSigIndex(cwd, queryOpts);
      if (index.size === 0) {
        console.error('[sigmap] no context file found. Run: node gen-context.js');
        if (adpIdx >= 0) {
          console.error('  (tried the path for --adapter ' + (args[adpIdx + 1] || '') + ')');
        }
        process.exit(1);
      }
      const topIdx = args.indexOf('--top');
      const topK = topIdx >= 0 ? Math.min(Math.max(1, parseInt(args[topIdx + 1], 10) || 10), 25)
                               : ((config && config.retrieval && config.retrieval.topK) || 10);
      const recencyBoost = (config && config.retrieval && config.retrieval.recencyBoost) || 1.5;
      // Opt-in call-graph neighbor boost (retrieval.callGraphBoost) — non-fatal
      let queryCallGraph = null;
      if (config && config.retrieval && config.retrieval.callGraphBoost) {
        try { queryCallGraph = requireSourceOrBundled('./src/graph/call-graph').buildRankingCallFileGraph(cwd); } catch (_) {}
      }
      // Opt-in route surface-enrichment (retrieval.surfaceEnrichment) — non-fatal
      if (config && config.retrieval && config.retrieval.surfaceEnrichment) {
        try { requireSourceOrBundled('./src/retrieval/enrich-from-maps').enrichWithSurfaces(index, cwd); } catch (_) {}
      }
      // Opt-in import-graph centrality blend (retrieval.centralityBlend) — non-fatal
      let queryCentrality = null;
      if (config && config.retrieval && config.retrieval.centralityBlend) {
        try {
          const centralityGraph = requireSourceOrBundled('./src/graph/builder').buildRankingGraph(cwd);
          queryCentrality = requireSourceOrBundled('./src/graph/centrality').computeCentrality(centralityGraph);
        } catch (_) {}
      }
      // Opt-in repo-mined query expansion (retrieval.minedExpansions) — non-fatal
      let queryExpansions = null;
      if (config && config.retrieval && config.retrieval.minedExpansions) {
        try { queryExpansions = requireSourceOrBundled('./src/retrieval/mined-expansions').loadOrMine(cwd).expansions; } catch (_) {}
      }
      // Body words (retrieval.bodyWords, on by default) — non-fatal
      let queryBodyWords = null;
      if (config && config.retrieval && config.retrieval.bodyWords) {
        try { queryBodyWords = requireSourceOrBundled('./src/retrieval/body-words').loadOrBuild(cwd, index); } catch (_) {}
      }
      const __queryExplain = args.includes('--explain');
      const results = rank(query, index, { topK, recencyBoost, cwd, callGraph: queryCallGraph, centrality: queryCentrality, expansions: queryExpansions, bodyWords: queryBodyWords, explain: __queryExplain });
      if (__queryExplain) {
        writeAll(1, formatExplainTable(results, query));
      } else if (args.includes('--context')) {
        const miniCtx  = buildMiniContext(results, cwd);
        const ctxOut   = path.join(cwd, '.context', 'query-context.md');
        fs.mkdirSync(path.dirname(ctxOut), { recursive: true });
        fs.writeFileSync(ctxOut, miniCtx, 'utf8');
        console.log(`[sigmap] query context → ${path.relative(cwd, ctxOut)}  (${estimateTokens(miniCtx)} tokens)`);
      } else if (args.includes('--json')) {
        writeAll(1, JSON.stringify(formatRankJSON(results, query)) + '\n');
      } else {
        writeAll(1, formatRankTable(results, query));
      }
    } catch (err) {
      console.error(`[sigmap] query error: ${err.message}`);
      process.exit(1);
    }
    process.exit(0);
  }

  // ── --each [--adapter <name>] ────────────────────────────────────────────
  // Must be checked before --adapter so that --each --adapter <name> is
  // handled here (per-repo) rather than running a single generate on the
  // parent directory.
  if (args.includes('--each')) {
    const VALID_ADAPTERS = ['copilot', 'claude', 'cursor', 'windsurf', 'openai', 'gemini', 'codex'];
    const adpIdx = args.indexOf('--adapter');
    const adapterOverride = adpIdx >= 0 ? (args[adpIdx + 1] || '').trim().toLowerCase() : null;
    if (adapterOverride && !VALID_ADAPTERS.includes(adapterOverride)) {
      console.error(`[sigmap] --each: unknown adapter "${adapterOverride}"`);
      console.error(`  Valid adapters: ${VALID_ADAPTERS.join(', ')}`);
      process.exit(1);
    }
    runEach(cwd, config, adapterOverride || null);
    process.exit(0);
  }

  // ── --adapter <name> ───────────────────────────────────────────────────────
  if (args.includes('--adapter')) {
    try {
      const adpIdx = args.indexOf('--adapter');
      const adapterName = (args[adpIdx + 1] || '').trim().toLowerCase();
      const VALID_ADAPTERS = ['copilot', 'claude', 'cursor', 'windsurf', 'openai', 'gemini', 'codex'];
      if (!adapterName || adapterName.startsWith('--')) {
        console.error('[sigmap] --adapter requires an adapter name');
        console.error(`  Valid adapters: ${VALID_ADAPTERS.join(', ')}`);
        console.error('  Example: node gen-context.js --adapter copilot');
        process.exit(1);
      }
      if (!VALID_ADAPTERS.includes(adapterName)) {
        console.error(`[sigmap] unknown adapter: "${adapterName}"`);
        console.error(`  Valid adapters: ${VALID_ADAPTERS.join(', ')}`);
        process.exit(1);
      }
      if (args.includes('--json')) {
        const adapterMod = __require('./packages/adapters/' + adapterName);
        const outPath = adapterMod.outputPath(cwd);
        writeAll(1, JSON.stringify({ adapter: adapterName, outputPath: outPath, version: VERSION }) + '\n');
        process.exit(0);
      }
      // Run generate with this adapter's output targets
      const singleAdapterConfig = Object.assign({}, config, {
        outputs: adapterName === 'claude' ? ['claude'] : [adapterName],
        adapters: [adapterName],
      });
      runGenerate(cwd, singleAdapterConfig, false);
      const adapterMod = __require('./packages/adapters/' + adapterName);
      console.warn(`[sigmap] adapter "${adapterName}" → ${path.relative(cwd, adapterMod.outputPath(cwd))}`);
    } catch (err) {
      console.error(`[sigmap] adapter error: ${err.message}`);
      process.exit(1);
    }
    process.exit(0);
  }

  // ── --impact <file> ────────────────────────────────────────────────────────
  if (args.includes('--impact')) {
    try {
      const impIdx = args.indexOf('--impact');
      const targetFile = (args[impIdx + 1] || '').trim();
      if (!targetFile || targetFile.startsWith('--')) {
        console.error('[sigmap] --impact requires a file path');
        console.error('  Example: node gen-context.js --impact src/extractors/python.js');
        process.exit(1);
      }
      const { analyzeImpact, formatImpact, formatImpactJSON } = requireSourceOrBundled('./src/graph/impact');
      const depthIdx = args.indexOf('--depth');
      const depth = depthIdx >= 0 ? Math.max(0, parseInt(args[depthIdx + 1], 10) || 3) : ((config && config.impact && config.impact.depth) || 3);
      const results = analyzeImpact(targetFile, cwd, { depth });
      if (args.includes('--json')) {
        const out = results.map((r) => formatImpactJSON(r.impact));
        writeAll(1, JSON.stringify(out.length === 1 ? out[0] : out) + '\n');
      } else {
        for (const r of results) {
          writeAll(1, formatImpact(r.impact) + '\n');
        }
      }
    } catch (err) {
      console.error(`[sigmap] impact error: ${err.message}`);
      process.exit(1);
    }
    process.exit(0);
  }

  // Method-level call-graph (D4): --callers <symbol> = method blast radius,
  // --callees <symbol> = what it calls. JS/TS + Python, deterministic.
  if (args.includes('--callers') || args.includes('--callees')) {
    try {
      const kind = args.includes('--callees') ? 'callees' : 'callers';
      const flag = kind === 'callees' ? '--callees' : '--callers';
      const symbol = (args[args.indexOf(flag) + 1] || '').trim();
      if (!symbol || symbol.startsWith('--')) {
        console.error(`[sigmap] ${flag} requires a symbol name (or file#symbol)`);
        console.error(`  Example: node gen-context.js ${flag} extractFileDeps`);
        process.exit(1);
      }
      const { methodImpact, methodCallees, formatCallGraph, formatCallGraphJSON } = requireSourceOrBundled('./src/graph/call-graph');
      const depthIdx = args.indexOf('--depth');
      const depth = depthIdx >= 0 ? Math.max(0, parseInt(args[depthIdx + 1], 10) || 0) : 0;
      const srcDirs = (config && Array.isArray(config.srcDirs) && config.srcDirs.length) ? config.srcDirs : undefined;
      const result = kind === 'callees'
        ? methodCallees(symbol, cwd, { depth, srcDirs })
        : methodImpact(symbol, cwd, { depth, srcDirs });
      if (args.includes('--json')) {
        writeAll(1, JSON.stringify(formatCallGraphJSON(result, kind)) + '\n');
      } else {
        writeAll(1, formatCallGraph(result, kind) + '\n');
      }
    } catch (err) {
      console.error(`[sigmap] call-graph error: ${err.message}`);
      process.exit(1);
    }
    process.exit(0);
  }

  if (args.includes('--report')) {
    // #951: `--report --sessions` is the captured-sessions report. It reads the
    // session store and the pricing profile and generates nothing, so it is
    // answered before `runGenerate` and has no over-budget exit code.
    if (args.includes('--sessions')) {
      const _sval = (flag) => {
        const i = args.indexOf(flag);
        return i !== -1 && args[i + 1] !== undefined && !args[i + 1].startsWith('--') ? args[i + 1] : null;
      };
      try {
        const limArg = parseInt(_sval('--limit'), 10);
        const sessionsReport = requireSourceOrBundled('./src/session/report').buildReport(cwd, {
          config, agent: _sval('--agent'), limit: Number.isFinite(limArg) && limArg > 0 ? limArg : 20,
        });
        if (args.includes('--json')) {
          writeAll(1, JSON.stringify(sessionsReport) + '\n');
        } else {
          console.log(requireSourceOrBundled('./src/session/render').renderReport(sessionsReport));
        }
      } catch (err) {
        console.error(`[sigmap] sessions report: ${err.message}`);
        process.exit(1);
      }
      process.exit(0);
    }
    if (args.includes('--history')) {
      try {
        const { readLog, summarize } = __require('./src/tracking/logger');
        const entries = readLog(cwd);
        const summary = summarize(entries);
        let chartInfo = null;
        if (args.includes('--chart')) {
          const { score } = __require('./src/health/scorer');
          const { renderHistoryCharts } = requireSourceOrBundled('./src/format/dashboard');
          chartInfo = renderHistoryCharts(cwd, score(cwd));
        }
        if (args.includes('--json')) {
          const payload = chartInfo
            ? {
                ...summary,
                chart: {
                  tokenReductionSparkline: chartInfo.tokenReductionSparkline,
                  hitAt5Sparkline: chartInfo.hitAt5Sparkline,
                  summary: chartInfo.summary,
                  charts: chartInfo.charts,
                },
              }
            : summary;
          writeAll(1, JSON.stringify(payload) + '\n');
        } else {
          console.log('[sigmap] usage history:');
          console.log(`  total runs      : ${summary.totalRuns}`);
          console.log(`  avg reduction   : ${summary.avgReductionPct}%`);
          console.log(`  avg tokens out  : ~${summary.avgFinalTokens}`);
          console.log(`  over-budget runs: ${summary.overBudgetRuns}`);
          if (summary.firstRun) console.log(`  first run       : ${summary.firstRun}`);
          if (summary.lastRun)  console.log(`  last run        : ${summary.lastRun}`);
          if (chartInfo) {
            console.log('');
            console.log(chartInfo.text);
          }
        }
      } catch (err) {
        console.warn(`[sigmap] tracking: ${err.message}`);
      }
      exitWithCode();
    }
    runGenerate(cwd, config, true, args.includes('--json'));
    exitWithCode();
  }

  if (args.includes('--monorepo') || config.monorepo) {
    runMonorepo(cwd, config);
    process.exit(0);
  }

  if (args.includes('--setup')) {
    runGenerate(cwd, config, false);
    installHook(cwd, scriptPath);
    registerMcp(cwd, scriptPath);
    watchMode(cwd, config);
    return; // keep process alive for watch
  }

  if (args.includes('--watch')) {
    runGenerate(cwd, config, false);
    watchMode(cwd, config);
    return; // keep process alive
  }

  if (args.includes('--diff')) {
    const idx = args.indexOf('--diff');
    const maybeBase = args[idx + 1];
    const baseRef = (maybeBase && !maybeBase.startsWith('--')) ? maybeBase : null;
    runDiff(cwd, config, args.includes('--staged'), baseRef);
    process.exit(0);
  }

  // v4.2: `--cost` — show token/$ cost estimate before and after SigMap
  if (args.includes('--cost')) {
    const __rawTok4 = getRawTokenCount(cwd, config);
    runGenerate(cwd, config, false);

    const __mIdxCost = args.indexOf('--model');
    const model = (__mIdxCost !== -1 && args[__mIdxCost + 1] && !args[__mIdxCost + 1].startsWith('--')) ? args[__mIdxCost + 1] : 'gpt-4o';
    // Single source of truth for pricing — shared with `gain` (pricing.js).
    const { resolvePrice: __resolvePriceCost } = requireSourceOrBundled('./src/tracking/pricing');
    const __costModels = requireSourceOrBundled('./src/config/models');
    const __costProfile = __costModels.resolveProfile(config);
    const __priceCost = __resolvePriceCost(model, __costProfile);
    // #688: counts are chars/4 unless the priced model has a charsPerToken.
    const __costBasis = __costModels.tokenBasis(__costProfile, __priceCost.model);
    const rateK = __priceCost.perMtok / 1000; // USD per 1K tokens
    const rawTok = Math.round(__rawTok4 * __costBasis.scale);

    const ctxPath = config.customOutput
      ? path.resolve(cwd, config.customOutput)
      : path.join(cwd, '.github', 'copilot-instructions.md');
    let outTok = 0;
    try { outTok = Math.round(estimateTokens(fs.readFileSync(ctxPath, 'utf8')) * __costBasis.scale); } catch (_) {}

    const savings = rawTok > 0 ? Math.round((1 - outTok / rawTok) * 100) : 0;
    const costRaw = (rawTok / 1000) * rateK;
    const costCtx = (outTok / 1000) * rateK;

    const out = {
      model:         __priceCost.model,
      priceAsOf:     __priceCost.asOf,
      tokenBasis:    __costBasis.label,
      rawTokens:     rawTok,
      contextTokens: outTok,
      costRaw:       costRaw.toFixed(4),
      costContext:   costCtx.toFixed(4),
      savingsPct:    savings,
      costBasis:     'estimate — counterfactual = whole-repo tokens; input tokens only',
    };

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify(out) + '\n');
    } else {
      console.log(`\n Cost estimate (${__priceCost.model} @ $${__priceCost.perMtok}/Mtok input as of ${__priceCost.asOf}; tokens ${__costBasis.label}):`);
      console.log(` Without SigMap : ${rawTok.toLocaleString()} tok  $${out.costRaw}/query  (counterfactual: whole repo)`);
      console.log(` With SigMap    : ${outTok.toLocaleString()} tok  $${out.costContext}/query`);
      console.log(` Savings        : ${savings}%  ($${(costRaw - costCtx).toFixed(4)} saved per query)\n`);
    }
    process.exit(0);
  }

  // v4.3: `--ci [--min-coverage N] [--json]` — GitHub Actions exit gate
  if (args.includes('--ci')) {
    const minCovIdx = args.indexOf('--min-coverage');
    const minCoverage = minCovIdx !== -1 ? Math.max(0, Math.min(100, parseInt(args[minCovIdx + 1], 10) || 80)) : 80;

    // #848: the `indexed` population, through the shared measurement.
    // `index.size / fileList.length` is not a ratio — the index holds entries
    // the current config no longer scopes, so this gate reported 241% coverage
    // in this repo and would have passed a threshold of 200%. `validate` was
    // fixed in #770; this surface kept the formula until it became a function.
    const { buildSigIndex: ciBuildSigIndex } = requireSourceOrBundled('./src/retrieval/ranker');
    const _ciCov      = requireSourceOrBundled('./src/analysis/coverage-score');
    const ciRel       = (f) => path.relative(cwd, path.resolve(cwd, f)).replace(/\\/g, '/');
    const ciIndexed   = new Set([...ciBuildSigIndex(cwd).keys()].map(ciRel));
    const ciInScope   = buildFileList(cwd, config).map(ciRel);
    const ciCoverage  = _ciCov.indexedCoverage(ciIndexed, ciInScope);
    const coveragePct = ciCoverage.score;

    const pass = coveragePct >= minCoverage;

    if (args.includes('--json')) {
      writeAll(1, JSON.stringify({ pass, coverage: coveragePct, threshold: minCoverage }) + '\n');
    } else if (pass) {
      console.log(`[sigmap] ✓ CI gate passed — coverage: ${_ciCov.formatCoverage(ciCoverage, 'indexed', { grade: false })} ≥ ${minCoverage}%`);
    } else {
      console.error(`[sigmap] ✗ CI gate FAILED — coverage: ${_ciCov.formatCoverage(ciCoverage, 'indexed', { grade: false })} < ${minCoverage}%`);
      console.error(`  Fix: increase maxTokens or expand srcDirs in gen-context.config.json`);
    }
    process.exit(pass ? 0 : 1);
  }

  // Default: generate once
  runGenerate(cwd, config, false);
}

main();