diff --git a/README.md b/README.md
index e563072..6d5d2ce 100644
--- a/README.md
+++ b/README.md
@@ -210,7 +210,7 @@ Glint adds per-file overhead (TS program build, module rewrite, TypeChecker call
 
 ### Caching
 
-Glint results are content-addressed and cached on disk under `node_modules/.cache/html-validate-ember/glint/`. Set `HVE_NO_CACHE=1` to bypass the cache.
+Glint results, the transform output and (for `validate-gts`) the report of each file are cached on disk under `node_modules/.cache/html-validate-ember/`. An entry is keyed on the file's content plus the content of every project file it imports, transitively (through relative paths and tsconfig `paths`), the project's ambient `.d.ts` files, the lockfile, the tsconfig and the plugin — so editing an imported component invalidates its consumers. Set `HVE_NO_CACHE=1` to bypass the caches.
 
 ## Silencing rules
 
diff --git a/lib/backend/ts6.ts b/lib/backend/ts6.ts
index 4dd0669..5cc3c18 100644
--- a/lib/backend/ts6.ts
+++ b/lib/backend/ts6.ts
@@ -9,7 +9,7 @@ import { createRequire } from 'node:module';
 import type * as TS from 'typescript';
 
 import { isComponentTag } from '../../blank.js';
-import { readCache, writeCache } from '../cache.js';
+import { cacheDependencies, readCache, writeCache } from '../cache.js';
 import type {
   OpenedFile,
   PreloadProgress,
@@ -479,7 +479,8 @@ export function createTs6Backend(deps: Ts6Deps, tsconfigPath: string): TypeBacke
       }
       // If a cached extraction exists for this file, skip the rewrite —
       // we'll never need its rewritten contents in the program.
-      if (readCache(filename, contents, tsconfigPath, 'ts6')) {
+      const dependencies = cacheDependencies(filename, contents, tsconfigPath);
+      if (readCache(filename, contents, tsconfigPath, 'ts6', dependencies)) {
         cached++;
         onProgress?.({ done, total: filenames.length, phase: 'rewrite' });
         continue;
@@ -503,11 +504,14 @@ export function createTs6Backend(deps: Ts6Deps, tsconfigPath: string): TypeBacke
         // `<template>` block. Without this, no-template files
         // perpetually show up under "analyzed" in the summary, which
         // reads as "why aren't these cached?" noise.
-        writeCache(filename, contents, tsconfigPath, 'ts6', {
-          attrTypeMap: new Map(),
-          componentTagMap: new Map(),
-          componentAttrMap: new Map(),
-        });
+        writeCache(
+          filename,
+          contents,
+          tsconfigPath,
+          'ts6',
+          { attrTypeMap: new Map(), componentTagMap: new Map(), componentAttrMap: new Map() },
+          dependencies,
+        );
         skips.rewriteEmpty.push({ file: filename });
         onProgress?.({ done, total: filenames.length, phase: 'rewrite' });
         continue;
diff --git a/lib/backend/tsgo.ts b/lib/backend/tsgo.ts
index 99c61c0..2a88e83 100644
--- a/lib/backend/tsgo.ts
+++ b/lib/backend/tsgo.ts
@@ -19,7 +19,7 @@ import { Preprocessor } from 'content-tag';
 import { preprocess as glimmerPreprocess, type AST } from '@glimmer/syntax';
 
 import { isComponentTag } from '../../blank.js';
-import { readCache, writeCache } from '../cache.js';
+import { cacheDependencies, readCache, writeCache } from '../cache.js';
 import { ts6Syntax } from './ts6.js';
 import type {
   CheckerLike,
@@ -509,16 +509,20 @@ export function createTsgoBackend(mods: TsgoModules, tsconfigPath: string): Type
         });
         continue;
       }
-      if (readCache(filename, contents, tsconfigPath, 'tsgo')) {
+      const dependencies = cacheDependencies(filename, contents, tsconfigPath);
+      if (readCache(filename, contents, tsconfigPath, 'tsgo', dependencies)) {
         cached++;
         continue;
       }
       if (templateBlocks(contents, filename).length === 0) {
-        writeCache(filename, contents, tsconfigPath, 'tsgo', {
-          attrTypeMap: new Map(),
-          componentTagMap: new Map(),
-          componentAttrMap: new Map(),
-        });
+        writeCache(
+          filename,
+          contents,
+          tsconfigPath,
+          'tsgo',
+          { attrTypeMap: new Map(), componentTagMap: new Map(), componentAttrMap: new Map() },
+          dependencies,
+        );
         skips.rewriteEmpty.push({ file: filename });
         continue;
       }
diff --git a/lib/cache.ts b/lib/cache.ts
index 3bc2b37..5e07708 100644
--- a/lib/cache.ts
+++ b/lib/cache.ts
@@ -3,8 +3,9 @@
 // The Glint pipeline (`extractAttrTypeMap`) is the dominant cost when
 // `--glint` is on — TS program rebuilds + per-file `rewriteModule` +
 // `getTypeChecker().getTypeAtLocation` calls. The result is a pure
-// function of (file content + tsconfig content + type backend + plugin
-// version + plugin source content), so we can cache it on disk and skip the work
+// function of (file content + the content of the files it depends on,
+// see `lib/deps.ts` + tsconfig content + type backend + plugin version
+// + plugin source content), so we can cache it on disk and skip the work
 // on repeat runs (CI, pre-commit hooks, IDE re-validation).
 //
 // Why plugin source content (not just version)? On release the package
@@ -20,8 +21,9 @@
 // One entry per file path, not per (content × tsconfig × version)
 // combination — so editing a file overwrites its previous entry rather
 // than leaving stale entries to accumulate. The stored entry carries
-// the file SHA, tsconfig SHA, and plugin version inside the JSON; the
-// reader compares stored vs. current and treats any mismatch as a miss.
+// the file SHA, dependency SHA, tsconfig SHA, and plugin version inside
+// the JSON; the reader compares stored vs. current and treats any
+// mismatch as a miss.
 //
 // `node_modules/.cache/` is the conventional ignored cache location used
 // by Babel, ESLint, etc. — your existing `.gitignore` already excludes
@@ -36,6 +38,7 @@ import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 
 import type { ComponentAttrs } from './builtin-components.js';
+import { dependencySha, sha256 } from './deps.js';
 
 // Walk up from this module looking for the nearest `package.json` so the
 // version is found regardless of whether we're running from source
@@ -130,6 +133,7 @@ interface CacheEntry {
   pluginSourceSha: string;
   tsconfigSha: string;
   fileSha: string;
+  dependencySha: string;
   attrTypeMap: Array<[string, AttrTypeInfo]>;
   componentTagMap: Array<[string, string]>;
   componentAttrMap: Array<[string, ComponentAttrs]>;
@@ -139,10 +143,6 @@ interface CacheEntry {
 // process; tsconfigs rarely change mid-run).
 const tsconfigShaCache = new Map<string, string>();
 
-function sha256(input: string): string {
-  return crypto.createHash('sha256').update(input).digest('hex');
-}
-
 function getTsconfigSha(tsconfigPath: string): string {
   const cached = tsconfigShaCache.get(tsconfigPath);
   if (cached !== undefined) return cached;
@@ -187,6 +187,15 @@ function deserializeMap<K, V>(arr: Array<[K, V]> | undefined): Map<K, V> {
   return new Map(arr ?? []);
 }
 
+/**
+ * The dependency sha a Glint result is read and written under. Computed
+ * once by the caller and passed to both `readCache` and `writeCache`; not
+ * computed at all when the cache is off.
+ */
+export function cacheDependencies(filename: string, contents: string, tsconfigPath: string): string {
+  return CACHE_DISABLED ? 'disabled' : dependencySha(filename, contents, tsconfigPath);
+}
+
 // Returns cached extraction results for `filename` when the stored
 // entry's SHAs match current (file content + tsconfig + plugin version).
 // Returns null on miss / stale / disabled / read or parse error.
@@ -195,6 +204,7 @@ export function readCache(
   contents: string,
   tsconfigPath: string,
   backend: string,
+  dependencies = dependencySha(filename, contents, tsconfigPath),
 ): ExtractionResult | null {
   if (CACHE_DISABLED) return null;
   const cacheDir = findCacheDir(filename);
@@ -220,7 +230,8 @@ export function readCache(
     parsed.backend !== backend ||
     parsed.pluginSourceSha !== PLUGIN_SOURCE_SHA ||
     parsed.tsconfigSha !== tsconfigSha ||
-    parsed.fileSha !== fileSha
+    parsed.fileSha !== fileSha ||
+    parsed.dependencySha !== dependencies
   ) {
     return null;
   }
@@ -234,13 +245,16 @@ export function readCache(
 // Write extraction results to the cache. Best-effort: failure is swallowed
 // (cache miss next time, but validation still works). Overwrites the
 // file's existing entry — there's only ever one cache file per source
-// file path.
+// file path. `dependencies` is the sha the result was computed under
+// (from the matching `readCache`), so a dependency edited during the
+// analysis cannot be stored as if it were reflected in the result.
 export function writeCache(
   filename: string,
   contents: string,
   tsconfigPath: string,
   backend: string,
   result: ExtractionResult,
+  dependencies = dependencySha(filename, contents, tsconfigPath),
 ): void {
   if (CACHE_DISABLED) return;
   const cacheDir = findCacheDir(filename);
@@ -252,6 +266,7 @@ export function writeCache(
       pluginSourceSha: PLUGIN_SOURCE_SHA,
       tsconfigSha: getTsconfigSha(tsconfigPath),
       fileSha: sha256(contents),
+      dependencySha: dependencies,
       attrTypeMap: serializeMap(result.attrTypeMap),
       componentTagMap: serializeMap(result.componentTagMap),
       componentAttrMap: serializeMap(result.componentAttrMap),
@@ -291,10 +306,17 @@ interface TransformCacheEntry {
 }
 
 /** Everything the transform's output depends on besides the plugin itself. */
-export function transformCacheKey(data: string, tsconfigPath: string | null, backendKind: string): string {
+// Without Glint nothing crosses file boundaries, so the closure is not
+// part of the key (and not computed).
+function dependenciesForKey(filename: string, contents: string, tsconfigPath: string | null): string {
+  return process.env['HVE_GLINT'] === '0' ? 'no-glint' : dependencySha(filename, contents, tsconfigPath);
+}
+
+export function transformCacheKey(filename: string, data: string, tsconfigPath: string | null, backendKind: string): string {
   return sha256(
     [
       data,
+      dependenciesForKey(filename, data, tsconfigPath),
       tsconfigPath ? getTsconfigSha(tsconfigPath) : 'no-tsconfig',
       backendKind,
       process.env['HVE_GLINT'] ?? '',
@@ -362,6 +384,7 @@ interface ReportCacheEntry<Result> extends CachedReport<Result> {
 }
 
 export function reportCacheKey(
+  filename: string,
   contents: string,
   config: unknown,
   htmlValidateVersion: string,
@@ -371,6 +394,7 @@ export function reportCacheKey(
   return sha256(
     [
       contents,
+      dependenciesForKey(filename, contents, tsconfigPath),
       JSON.stringify(config ?? null),
       htmlValidateVersion,
       tsconfigPath ? getTsconfigSha(tsconfigPath) : 'no-tsconfig',
diff --git a/lib/deps.ts b/lib/deps.ts
new file mode 100644
index 0000000..8ba72f9
--- /dev/null
+++ b/lib/deps.ts
@@ -0,0 +1,499 @@
+// What a file's Glint result depends on besides its own content: the
+// project files it imports, transitively, plus the project-wide inputs
+// that reach every file without an import (ambient declarations, module
+// augmentations, installed packages). The cache keys include
+// `dependencySha`, so a change anywhere upstream misses for every file
+// downstream — the shape of tsc's incremental `referencedMap`, keyed on
+// file content rather than on the exported signature, so stricter than
+// tsc, never looser.
+//
+// Imports are found by scanning the text for specifiers, not by parsing.
+// Resolution follows tsc: relative paths; tsconfig `paths` (longest
+// prefix wins) against `baseUrl` or the directory of the config that
+// declares them; `baseUrl`; `extends` (relative, and packages through
+// their `tsconfig` field or `tsconfig.json`), later entries overriding
+// earlier ones; TypeScript's `.js` → `.ts` rewrite; extension probing
+// with `.gts`/`.gjs` first; directory `index` files. A resolved file is
+// taken by its real path; anything under `node_modules` is a package and
+// covered by the lockfile sha. Workspace sources reached through a
+// symlink or a `../` path are project files.
+//
+// Memos re-validate against the file system: file records on mtime and
+// size, module resolution on the mtime of every directory it probed,
+// tsconfig paths on the config chain's content. The list of project-wide
+// input files is found once per process; their content is re-checked.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { createRequire } from 'node:module';
+
+const EXTENSIONS = ['.gts', '.gjs', '.ts', '.tsx', '.d.ts', '.js', '.mjs', '.cjs', '.jsx'];
+const SKIPPED_DIRS = new Set(['node_modules', 'dist', 'tmp']);
+const LOCKFILES = ['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock', 'bun.lock', 'bun.lockb'];
+const GLOBAL_DECLARATION = /^\s*(?:export\s+)?declare\s+(?:module|global)\b/m;
+
+export function sha256(input: string | Buffer): string {
+  return crypto.createHash('sha256').update(input).digest('hex');
+}
+
+function warnOnce(key: string, message: string): void {
+  if (warned.has(key)) return;
+  warned.add(key);
+  process.stderr.write(`[html-validate-ember] ${message}\n`);
+}
+const warned = new Set<string>();
+
+// A one-shot run (the CLI) sees the file system as it was at start, like a
+// non-watch `tsc`: memos are trusted after their first fill. A long-lived
+// host keeps re-validating them.
+let staticFileSystem = false;
+export function assumeStaticFileSystem(): void {
+  staticFileSystem = true;
+}
+
+// --- file content, memoised on mtime and size -------------------------------
+
+interface FileRecord {
+  mtimeMs: number;
+  size: number;
+  sha: string;
+  /** Specifiers, scanned on first use. */
+  imports: () => string[];
+}
+const fileRecords = new Map<string, FileRecord>();
+
+function fileRecord(file: string): FileRecord | null {
+  if (staticFileSystem) {
+    const cached = fileRecords.get(file);
+    if (cached) return cached;
+  }
+  let stat: fs.Stats;
+  try {
+    stat = fs.statSync(file);
+  } catch {
+    return null;
+  }
+  if (!stat.isFile()) return null;
+  const cached = fileRecords.get(file);
+  if (cached && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) return cached;
+  let contents: string;
+  try {
+    contents = fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+  let imports: string[] | undefined;
+  const record = {
+    mtimeMs: stat.mtimeMs,
+    size: stat.size,
+    sha: sha256(contents),
+    imports: () => (imports ??= importSpecifiers(contents)),
+  };
+  fileRecords.set(file, record);
+  return record;
+}
+
+/** `from '...'`, `import '...'` and `import('...')` specifiers, in order of appearance. */
+export function importSpecifiers(contents: string): string[] {
+  const found: string[] = [];
+  const pattern = /(?:\bfrom\s*|\bimport\s*\(?\s*)['"]([^'"\n]+)['"]/g;
+  for (const match of contents.matchAll(pattern)) {
+    const spec = match[1];
+    if (spec && !found.includes(spec)) found.push(spec);
+  }
+  return found;
+}
+
+// --- tsconfig `paths` ---------------------------------------------------------
+
+interface ProjectPaths {
+  /** Distinct per read of the config chain; part of the resolution memo key. */
+  id: number;
+  /** Absolute directory non-relative specifiers resolve against. */
+  baseUrl: string | null;
+  /** Absolute directory `paths` targets resolve against. */
+  pathsBase: string | null;
+  /** Pattern → absolute target patterns. */
+  paths: Array<[string, string[]]>;
+  /** Config files read, with their content sha, for re-validation. */
+  chain: Array<[string, string]>;
+}
+const projectPathsByTsconfig = new Map<string, ProjectPaths>();
+let projectPathsReads = 0;
+
+// tsconfig.json is JSON with comments and trailing commas.
+export function parseJsonc(text: string): unknown {
+  let out = '';
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i]!;
+    if (ch === '"') {
+      let j = i + 1;
+      while (j < text.length && text[j] !== '"') j += text[j] === '\\' ? 2 : 1;
+      out += text.slice(i, j + 1);
+      i = j + 1;
+    } else if (ch === '/' && text[i + 1] === '/') {
+      i = text.indexOf('\n', i);
+      if (i === -1) i = text.length;
+    } else if (ch === '/' && text[i + 1] === '*') {
+      const end = text.indexOf('*/', i + 2);
+      i = end === -1 ? text.length : end + 2;
+    } else {
+      out += ch;
+      i++;
+    }
+  }
+  return JSON.parse(out.replace(/,(\s*[}\]])/g, '$1'));
+}
+
+interface TsconfigShape {
+  extends?: unknown;
+  compilerOptions?: { baseUrl?: unknown; paths?: unknown };
+}
+
+// The merged `baseUrl` and `paths` of a config and its `extends` chain.
+// Like tsc: a child overrides its parents, a later `extends` entry
+// overrides an earlier one, `paths` is replaced as a whole and resolves
+// against the merged `baseUrl` or the directory of the config that
+// declares it.
+function readTsconfigChain(tsconfigPath: string, seen = new Set<string>()): ProjectPaths {
+  const result: ProjectPaths = { id: ++projectPathsReads, baseUrl: null, pathsBase: null, paths: [], chain: [] };
+  if (seen.has(tsconfigPath)) return result;
+  seen.add(tsconfigPath);
+  const record = fileRecord(tsconfigPath);
+  if (!record) return result;
+  result.chain.push([tsconfigPath, record.sha]);
+  let config: TsconfigShape;
+  try {
+    config = (parseJsonc(fs.readFileSync(tsconfigPath, 'utf8')) ?? {}) as TsconfigShape;
+  } catch (err) {
+    warnOnce(`tsconfig:${tsconfigPath}`, `${tsconfigPath}: cannot parse (${err instanceof Error ? err.message : String(err)}); imports through tsconfig paths are not tracked for the cache.`);
+    return result;
+  }
+  const dir = path.dirname(tsconfigPath);
+  const parents = Array.isArray(config.extends) ? config.extends : [config.extends];
+  for (const parent of parents) {
+    if (typeof parent !== 'string') continue;
+    const parentPath = resolveExtends(parent, dir);
+    if (!parentPath) continue;
+    const inherited = readTsconfigChain(parentPath, seen);
+    result.chain.push(...inherited.chain);
+    if (inherited.baseUrl) result.baseUrl = inherited.baseUrl;
+    if (inherited.pathsBase) {
+      result.pathsBase = inherited.pathsBase;
+      result.paths = inherited.paths;
+    }
+  }
+  const options = config.compilerOptions ?? {};
+  if (typeof options.baseUrl === 'string') result.baseUrl = path.resolve(dir, options.baseUrl);
+  if (options.paths && typeof options.paths === 'object') {
+    result.pathsBase = dir;
+    result.paths = Object.entries(options.paths as Record<string, unknown>)
+      .filter((entry): entry is [string, string[]] => Array.isArray(entry[1]))
+      .map(([pattern, targets]) => [pattern, targets.filter((t): t is string => typeof t === 'string')]);
+  }
+  return result;
+}
+
+function resolveExtends(spec: string, fromDir: string): string | null {
+  if (spec.startsWith('.') || path.isAbsolute(spec)) {
+    const abs = path.resolve(fromDir, spec);
+    return fs.existsSync(abs) ? abs : fs.existsSync(`${abs}.json`) ? `${abs}.json` : null;
+  }
+  const req = createRequire(path.join(fromDir, 'package.json'));
+  const attempts = path.extname(spec) ? [spec] : [`${spec}/tsconfig.json`, spec];
+  try {
+    const pkg = req(`${spec}/package.json`) as { tsconfig?: string };
+    if (typeof pkg.tsconfig === 'string') attempts.unshift(`${spec}/${pkg.tsconfig}`);
+  } catch {
+    // no package.json at the root of the specifier — fine for deep paths
+  }
+  for (const attempt of attempts) {
+    try {
+      return req.resolve(attempt);
+    } catch {
+      // next
+    }
+  }
+  return null;
+}
+
+function projectPaths(tsconfigPath: string): ProjectPaths {
+  const cached = projectPathsByTsconfig.get(tsconfigPath);
+  if (cached && (staticFileSystem || cached.chain.every(([file, sha]) => fileRecord(file)?.sha === sha))) return cached;
+  const fresh = readTsconfigChain(tsconfigPath);
+  projectPathsByTsconfig.set(tsconfigPath, fresh);
+  return fresh;
+}
+
+// --- module resolution -----------------------------------------------------------
+
+interface Resolution {
+  file: string | null;
+  /** Directories probed; the memo is valid while their mtimes hold. */
+  dirs: string[];
+}
+const resolutionByKey = new Map<string, Resolution>();
+const dirMtimes = new Map<string, number>();
+
+function dirMtime(dir: string): number {
+  try {
+    return fs.statSync(dir).mtimeMs;
+  } catch {
+    return -1;
+  }
+}
+
+// Drops memoised resolutions that probed a directory whose mtime moved —
+// a file was created, deleted or renamed there. One stat per known
+// directory per closure walk.
+function revalidateDirectories(): void {
+  if (staticFileSystem) return;
+  const changed = new Set<string>();
+  for (const [dir, mtime] of dirMtimes) {
+    const now = dirMtime(dir);
+    if (now !== mtime) {
+      changed.add(dir);
+      dirMtimes.set(dir, now);
+    }
+  }
+  if (changed.size === 0) return;
+  for (const [key, resolution] of resolutionByKey) {
+    if (resolution.dirs.some((dir) => changed.has(dir))) resolutionByKey.delete(key);
+  }
+  for (const [candidate, probe] of probeByCandidate) {
+    if (probe.dirs.some((dir) => changed.has(dir))) probeByCandidate.delete(candidate);
+  }
+}
+
+// The directory whose mtime moves when a file at `p` is created: the
+// nearest existing ancestor (creating `types/@ember/service.d.ts` first
+// changes `types/`).
+function watchedDirectory(p: string): string {
+  let dir = path.dirname(p);
+  while (dir !== path.dirname(dir) && !fs.existsSync(dir)) dir = path.dirname(dir);
+  return dir;
+}
+
+// A candidate path is probed once; the same `types/@ember/service` is
+// tried from every importing directory. Dropped with the memoised
+// resolutions when a watched directory changes.
+const probeByCandidate = new Map<string, { file: string | null; dirs: string[] }>();
+
+function probeFile(candidate: string, probed: Set<string>): string | null {
+  const memo = probeByCandidate.get(candidate);
+  if (memo) {
+    for (const dir of memo.dirs) probed.add(dir);
+    return memo.file;
+  }
+  const dirs = new Set<string>();
+  const file = probeUncached(candidate, dirs);
+  for (const dir of dirs) probed.add(dir);
+  probeByCandidate.set(candidate, { file, dirs: [...dirs] });
+  return file;
+}
+
+function probeUncached(candidate: string, probed: Set<string>): string | null {
+  const stem = candidate.replace(/\.(?:js|mjs|cjs|jsx)$/, '');
+  const attempts = [candidate, ...EXTENSIONS.map((ext) => stem + ext), ...EXTENSIONS.map((ext) => path.join(candidate, `index${ext}`))];
+  probed.add(watchedDirectory(candidate));
+  for (const attempt of attempts) {
+    try {
+      if (fs.statSync(attempt).isFile()) return fs.realpathSync.native(attempt);
+    } catch {
+      // next
+    }
+  }
+  if (fs.existsSync(candidate)) probed.add(candidate);
+  return null;
+}
+
+// tsc's findBestPatternMatch: the pattern with the longest prefix wins.
+function matchPaths(paths: Array<[string, string[]]>, spec: string): { wildcard: string; targets: string[] } | null {
+  let best: { wildcard: string; targets: string[]; prefixLength: number } | null = null;
+  for (const [pattern, targets] of paths) {
+    const star = pattern.indexOf('*');
+    if (star === -1) {
+      if (pattern === spec) return { wildcard: '', targets };
+      continue;
+    }
+    const prefix = pattern.slice(0, star);
+    const suffix = pattern.slice(star + 1);
+    if (spec.length < prefix.length + suffix.length || !spec.startsWith(prefix) || !spec.endsWith(suffix)) continue;
+    if (!best || prefix.length > best.prefixLength) {
+      best = { wildcard: spec.slice(prefix.length, spec.length - suffix.length), targets, prefixLength: prefix.length };
+    }
+  }
+  return best;
+}
+
+/** The project file `spec` refers to from `fromFile`, or null when it is a package or unresolved. */
+export function resolveProjectImport(spec: string, fromFile: string, tsconfigPath: string): string | null {
+  return resolveWith(spec, fromFile, projectPaths(tsconfigPath));
+}
+
+function resolveWith(spec: string, fromFile: string, paths: ProjectPaths): string | null {
+  const memoKey = `${paths.id}\0${path.dirname(fromFile)}\0${spec}`;
+  const memo = resolutionByKey.get(memoKey);
+  if (memo) return memo.file;
+  const probed = new Set<string>();
+  const file = resolveUncached(spec, fromFile, paths, probed);
+  for (const dir of probed) {
+    if (!dirMtimes.has(dir)) dirMtimes.set(dir, dirMtime(dir));
+  }
+  resolutionByKey.set(memoKey, { file, dirs: [...probed] });
+  return file;
+}
+
+function resolveUncached(spec: string, fromFile: string, { baseUrl, pathsBase, paths }: ProjectPaths, probed: Set<string>): string | null {
+  const candidates: string[] = [];
+  if (spec.startsWith('.') || path.isAbsolute(spec)) {
+    candidates.push(path.resolve(path.dirname(fromFile), spec));
+  } else {
+    const match = matchPaths(paths, spec);
+    if (match) {
+      const base = baseUrl ?? pathsBase!;
+      candidates.push(...match.targets.map((t) => path.resolve(base, t.replace('*', match.wildcard))));
+    }
+    if (baseUrl) candidates.push(path.resolve(baseUrl, spec));
+  }
+  for (const candidate of candidates) {
+    const found = probeFile(candidate, probed);
+    if (found && !found.split(path.sep).includes('node_modules')) return found;
+  }
+  return null;
+}
+
+// --- closure ----------------------------------------------------------------------
+
+/** Project files `file` imports, transitively (real absolute paths, sorted, without `file` itself). */
+// Directories are re-validated once per `dependencySha` (which walks
+// many closures), and on every direct call.
+let insideSha = false;
+let revalidatedInsideSha = false;
+
+export function dependencyClosure(file: string, contents: string, tsconfigPath: string, specifiers = importSpecifiers(contents)): string[] {
+  if (!insideSha || !revalidatedInsideSha) {
+    revalidateDirectories();
+    revalidatedInsideSha = insideSha;
+  }
+  const paths = projectPaths(tsconfigPath);
+  const root = path.resolve(file);
+  const seen = new Set<string>([root]);
+  const queue: Array<[string, string[]]> = [[root, specifiers]];
+  while (queue.length > 0) {
+    const [from, specs] = queue.pop()!;
+    for (const spec of specs) {
+      const dep = resolveWith(spec, from, paths);
+      if (!dep || seen.has(dep)) continue;
+      seen.add(dep);
+      const record = fileRecord(dep);
+      if (record) queue.push([dep, record.imports()]);
+    }
+  }
+  seen.delete(root);
+  return [...seen].sort();
+}
+
+// --- project-wide inputs -------------------------------------------------------
+
+// Files whose declarations reach every file without an import: `.d.ts`
+// files, and source files with `declare module` / `declare global`
+// (registry augmentations). The list is found once per process; the
+// content of each file is re-checked on every call.
+const projectInputFilesByRoot = new Map<string, string[]>();
+
+function projectInputFiles(projectRoot: string): string[] {
+  let files = projectInputFilesByRoot.get(projectRoot);
+  if (files) return files;
+  files = [];
+  const walk = (dir: string): void => {
+    let entries: fs.Dirent[];
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIPPED_DIRS.has(entry.name) && !entry.name.startsWith('.')) walk(full);
+      } else if (entry.name.endsWith('.d.ts')) {
+        files!.push(full);
+      } else if (/\.(?:ts|tsx|gts|gjs)$/.test(entry.name)) {
+        try {
+          if (GLOBAL_DECLARATION.test(fs.readFileSync(full, 'utf8'))) files!.push(full);
+        } catch {
+          // unreadable — skip
+        }
+      }
+    }
+  };
+  walk(projectRoot);
+  files.push(...LOCKFILES.map((name) => path.join(projectRoot, name)));
+  files.sort();
+  projectInputFilesByRoot.set(projectRoot, files);
+  return files;
+}
+
+function hashFiles(hash: crypto.Hash, projectRoot: string, files: string[]): void {
+  for (const file of files) {
+    const record = fileRecord(file);
+    if (!record) continue;
+    hash.update(path.relative(projectRoot, file));
+    hash.update(record.sha);
+    hash.update('\0');
+  }
+}
+
+// The project-wide inputs reach a `.gts`/`.gjs`/`.ts` file through its
+// own imports and the augmentations' declaring files, so their content
+// is hashed. A `.hbs` template has no imports: components reach it only
+// through the registry, so for it the inputs' whole import closure is
+// hashed — an edit to any file the registry reaches invalidates every
+// template. Both shas are computed once per run under a static file
+// system.
+const inputsShaByTsconfig = new Map<string, { own: string; closure: string }>();
+
+function projectInputsSha(tsconfigPath: string, withImports: boolean): string {
+  const memo = inputsShaByTsconfig.get(tsconfigPath);
+  if (memo && staticFileSystem) return withImports ? memo.closure : memo.own;
+  const projectRoot = path.dirname(tsconfigPath);
+  const inputs = projectInputFiles(projectRoot);
+  const closure = new Set<string>(inputs);
+  for (const input of inputs) {
+    const record = fileRecord(input);
+    if (!record) continue;
+    for (const dep of dependencyClosure(input, '', tsconfigPath, record.imports())) closure.add(dep);
+  }
+  const shaOf = (files: string[]) => {
+    const hash = crypto.createHash('sha256');
+    hashFiles(hash, projectRoot, files);
+    return hash.digest('hex');
+  };
+  const shas = { own: shaOf(inputs), closure: shaOf([...closure].sort()) };
+  inputsShaByTsconfig.set(tsconfigPath, shas);
+  return withImports ? shas.closure : shas.own;
+}
+
+/**
+ * Sha over everything `file`'s type information can depend on besides its
+ * own content: its import closure and the project-wide inputs (ambient
+ * declarations, module augmentations, the lockfile) — for a `.hbs`
+ * template, the inputs with everything they import.
+ */
+export function dependencySha(file: string, contents: string, tsconfigPath: string | null): string {
+  if (!tsconfigPath) return 'no-tsconfig';
+  insideSha = true;
+  try {
+    const projectRoot = path.dirname(tsconfigPath);
+    const hash = crypto.createHash('sha256');
+    hashFiles(hash, projectRoot, dependencyClosure(file, contents, tsconfigPath));
+    hash.update(projectInputsSha(tsconfigPath, file.endsWith('.hbs')));
+    return hash.digest('hex');
+  } finally {
+    insideSha = false;
+    revalidatedInsideSha = false;
+  }
+}
diff --git a/lib/glint.ts b/lib/glint.ts
index 9814920..a1824a1 100644
--- a/lib/glint.ts
+++ b/lib/glint.ts
@@ -16,7 +16,7 @@ import { preprocess as glimmerPreprocess, type AST } from '@glimmer/syntax';
 
 import { isComponentTag, isNativeTag } from '../blank.js';
 import type { ComponentAttrs } from './builtin-components.js';
-import { readCache, writeCache } from './cache.js';
+import { cacheDependencies, readCache, writeCache } from './cache.js';
 import type { AttrTypeInfo, ExtractionResult } from './cache.js';
 import { findTemplateSource } from './resolver/template-source.js';
 import {
@@ -738,7 +738,8 @@ export function extractAttrTypeMap(filename: string, contents: string): Extracti
   // (file content + tsconfig content + backend + plugin version) — repeat
   // runs (CI, pre-commit, IDE re-validation on unchanged files) skip the
   // entire pipeline. See `lib/cache.ts`.
-  const cached = readCache(filename, contents, tsconfigPath, backend.kind);
+  const dependencies = cacheDependencies(filename, contents, tsconfigPath);
+  const cached = readCache(filename, contents, tsconfigPath, backend.kind, dependencies);
   if (cached) {
     return cached;
   }
@@ -758,7 +759,7 @@ export function extractAttrTypeMap(filename: string, contents: string): Extracti
       componentTagMap: new Map(),
       componentAttrMap: new Map(),
     };
-    writeCache(filename, contents, tsconfigPath, backend.kind, empty);
+    writeCache(filename, contents, tsconfigPath, backend.kind, empty, dependencies);
     return empty;
   }
   const { sourceFile, checker, program, sites } = opened;
@@ -970,7 +971,7 @@ export function extractAttrTypeMap(filename: string, contents: string): Extracti
   }
 
   const result: ExtractionResult = { attrTypeMap, componentTagMap, componentAttrMap };
-  writeCache(filename, contents, tsconfigPath, backend.kind, result);
+  writeCache(filename, contents, tsconfigPath, backend.kind, result, dependencies);
   return result;
 }
 
diff --git a/run.ts b/run.ts
index a606938..5c95cc5 100644
--- a/run.ts
+++ b/run.ts
@@ -12,6 +12,7 @@ import { dedupeMultipassReport } from './lib/multipass-dedupe.js';
 import { backendKindFor, findTsconfig } from './lib/backend/index.js';
 import { readReportCache, reportCacheKey, writeReportCache } from './lib/cache.js';
 import type { CachedReport } from './lib/cache.js';
+import { assumeStaticFileSystem } from './lib/deps.js';
 
 // Walk up from `start` looking for a `.htmlvalidate.json` config file
 // and return its parsed contents (or null if none found / unreadable).
@@ -148,6 +149,7 @@ function printUsage(): void {
 }
 
 (async () => {
+  assumeStaticFileSystem();
   const args = process.argv.slice(2);
   const flagArgs = args.filter((a) => a.startsWith('--'));
   // Flags that take a value via `=value`. Anything not in this set
@@ -358,6 +360,7 @@ function printUsage(): void {
     try {
       const tsconfigPath = findTsconfig(file);
       key = reportCacheKey(
+        file,
         fs.readFileSync(file, 'utf8'),
         userConfig,
         htmlValidateVersion,
diff --git a/test/cache.test.ts b/test/cache.test.ts
index d133c15..4af37cd 100644
--- a/test/cache.test.ts
+++ b/test/cache.test.ts
@@ -172,17 +172,17 @@ describe('transform cache', () => {
 
   it('round-trips the passes, including the Map- and Set-shaped arrays', () => {
     const file = path.join(templatesDir, 'a.gts');
-    const key = transformCacheKey('<template></template>', tsconfigPath, 'ts6');
+    const key = transformCacheKey(file, '<template></template>', tsconfigPath, 'ts6');
     writeTransformCache(file, key, templates);
     expect(readTransformCache(file, key)).toEqual(templates);
   });
 
   it('misses when the key differs', () => {
     const file = path.join(templatesDir, 'a.gts');
-    writeTransformCache(file, transformCacheKey('v1', tsconfigPath, 'ts6'), templates);
-    expect(readTransformCache(file, transformCacheKey('v2', tsconfigPath, 'ts6'))).toBeNull();
-    expect(readTransformCache(file, transformCacheKey('v1', tsconfigPath, 'tsgo:typescript@7.0.0'))).toBeNull();
-    expect(readTransformCache(file, transformCacheKey('v1', tsconfigPath, 'ts6'))).toEqual(templates);
+    writeTransformCache(file, transformCacheKey(file, 'v1', tsconfigPath, 'ts6'), templates);
+    expect(readTransformCache(file, transformCacheKey(file, 'v2', tsconfigPath, 'ts6'))).toBeNull();
+    expect(readTransformCache(file, transformCacheKey(file, 'v1', tsconfigPath, 'tsgo:typescript@7.0.0'))).toBeNull();
+    expect(readTransformCache(file, transformCacheKey(file, 'v1', tsconfigPath, 'ts6'))).toEqual(templates);
   });
 });
 
@@ -194,7 +194,7 @@ describe('report cache', () => {
     results: [{ filePath: 'a.gts', messages: [{ ruleId: 'no-inline-style', severity: 2 }] }],
   };
   const key = (contents: string, config: unknown = { extends: ['html-validate:recommended'] }, version = '11.0.0', backend = 'ts6') =>
-    reportCacheKey(contents, config, version, tsconfigPath, backend);
+    reportCacheKey(path.join(templatesDir, 'a.gts'), contents, config, version, tsconfigPath, backend);
 
   it('round-trips a report', () => {
     const file = path.join(templatesDir, 'a.gts');
@@ -212,7 +212,7 @@ describe('report cache', () => {
     fs.writeFileSync(tsconfigPath, '{"compilerOptions":{"target":"es2020"}}');
     const otherTsconfig = path.join(projectRoot, 'tsconfig.other.json');
     fs.writeFileSync(otherTsconfig, '{}');
-    expect(readReportCache(file, reportCacheKey('v1', { extends: ['html-validate:recommended'] }, '11.0.0', otherTsconfig, 'ts6'))).toBeNull();
+    expect(readReportCache(file, reportCacheKey(file, 'v1', { extends: ['html-validate:recommended'] }, '11.0.0', otherTsconfig, 'ts6'))).toBeNull();
     process.env['HVE_MAX_CONDITIONAL_BRANCHES'] = '2';
     try {
       expect(readReportCache(file, key('v1'))).toBeNull();
diff --git a/test/deps-fixtures/app/components/cycle-a.gts b/test/deps-fixtures/app/components/cycle-a.gts
new file mode 100644
index 0000000..b237384
--- /dev/null
+++ b/test/deps-fixtures/app/components/cycle-a.gts
@@ -0,0 +1,2 @@
+import B from './cycle-b';
+<template><B /></template>
diff --git a/test/deps-fixtures/app/components/cycle-b.gts b/test/deps-fixtures/app/components/cycle-b.gts
new file mode 100644
index 0000000..4236665
--- /dev/null
+++ b/test/deps-fixtures/app/components/cycle-b.gts
@@ -0,0 +1,2 @@
+import A from './cycle-a';
+<template><A /></template>
diff --git a/test/deps-fixtures/app/components/dir/index.ts b/test/deps-fixtures/app/components/dir/index.ts
new file mode 100644
index 0000000..0896e12
--- /dev/null
+++ b/test/deps-fixtures/app/components/dir/index.ts
@@ -0,0 +1 @@
+export const fromDir = () => import('../leaf');
diff --git a/test/deps-fixtures/app/components/leaf-two.ts b/test/deps-fixtures/app/components/leaf-two.ts
new file mode 100644
index 0000000..1324e8f
--- /dev/null
+++ b/test/deps-fixtures/app/components/leaf-two.ts
@@ -0,0 +1 @@
+export default <template><i /></template>;
diff --git a/test/deps-fixtures/app/components/leaf.gts b/test/deps-fixtures/app/components/leaf.gts
new file mode 100644
index 0000000..a1615fa
--- /dev/null
+++ b/test/deps-fixtures/app/components/leaf.gts
@@ -0,0 +1 @@
+<template><span>{{@label}}</span></template>
diff --git a/test/deps-fixtures/app/components/mid.gts b/test/deps-fixtures/app/components/mid.gts
new file mode 100644
index 0000000..1411309
--- /dev/null
+++ b/test/deps-fixtures/app/components/mid.gts
@@ -0,0 +1,2 @@
+import Leaf from './leaf';
+<template><Leaf @label="x" /></template>
diff --git a/test/deps-fixtures/app/components/root.gts b/test/deps-fixtures/app/components/root.gts
new file mode 100644
index 0000000..26d49b3
--- /dev/null
+++ b/test/deps-fixtures/app/components/root.gts
@@ -0,0 +1,11 @@
+import Component from '@glimmer/component';
+import Mid from 'app/components/mid';
+import LeafTwo from './leaf-two.js';
+import fromDir from './dir';
+import type { Operations } from 'operations';
+import pkg from 'some-pkg';
+import 'side-effect-only';
+
+export default class Root extends Component {
+  <template><Mid /><LeafTwo /></template>
+}
diff --git a/test/deps-fixtures/app/components/unrelated.gts b/test/deps-fixtures/app/components/unrelated.gts
new file mode 100644
index 0000000..9d9bd24
--- /dev/null
+++ b/test/deps-fixtures/app/components/unrelated.gts
@@ -0,0 +1 @@
+<template><p>unrelated</p></template>
diff --git a/test/deps-fixtures/package.json b/test/deps-fixtures/package.json
new file mode 100644
index 0000000..2c7d3eb
--- /dev/null
+++ b/test/deps-fixtures/package.json
@@ -0,0 +1 @@
+{"name":"deps-fixture","private":true}
diff --git a/test/deps-fixtures/pnpm-lock.yaml b/test/deps-fixtures/pnpm-lock.yaml
new file mode 100644
index 0000000..b07d591
--- /dev/null
+++ b/test/deps-fixtures/pnpm-lock.yaml
@@ -0,0 +1 @@
+lockfileVersion: 9.0
diff --git a/test/deps-fixtures/tsconfig.base.json b/test/deps-fixtures/tsconfig.base.json
new file mode 100644
index 0000000..11c1dfc
--- /dev/null
+++ b/test/deps-fixtures/tsconfig.base.json
@@ -0,0 +1 @@
+{ "compilerOptions": { "baseUrl": ".", "strict": true } }
diff --git a/test/deps-fixtures/tsconfig.json b/test/deps-fixtures/tsconfig.json
new file mode 100644
index 0000000..8f73307
--- /dev/null
+++ b/test/deps-fixtures/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  // comments and trailing commas are allowed in tsconfig
+  "extends": "./tsconfig.base.json",
+  "compilerOptions": {
+    "paths": {
+      "app/*": ["./app/*"],
+      "*": ["./types/*"],
+    },
+  },
+}
diff --git a/test/deps-fixtures/types/global.d.ts b/test/deps-fixtures/types/global.d.ts
new file mode 100644
index 0000000..f46c1ee
--- /dev/null
+++ b/test/deps-fixtures/types/global.d.ts
@@ -0,0 +1 @@
+declare const t: (key: string) => string;
diff --git a/test/deps-fixtures/types/operations.d.ts b/test/deps-fixtures/types/operations.d.ts
new file mode 100644
index 0000000..1f5ada5
--- /dev/null
+++ b/test/deps-fixtures/types/operations.d.ts
@@ -0,0 +1 @@
+export interface Operations { id: string }
diff --git a/test/deps.test.ts b/test/deps.test.ts
new file mode 100644
index 0000000..227ec61
--- /dev/null
+++ b/test/deps.test.ts
@@ -0,0 +1,307 @@
+// Dependency closure for the cache keys. The scenarios are the ones
+// TypeScript's incremental build tests exercise (dependents invalidated
+// when an import changes, transitively; an unrelated file untouched;
+// cycles; ambient declarations reaching every file) — with one
+// difference: tsc compares the exported signature, this compares content,
+// so a change that tsc would ignore invalidates here too.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+
+import { dependencyClosure, dependencySha, importSpecifiers, parseJsonc, resolveProjectImport } from '../lib/deps.js';
+import { readCache, reportCacheKey, transformCacheKey, writeCache } from '../lib/cache.js';
+
+const FIXTURES = fileURLToPath(new URL('./deps-fixtures', import.meta.url));
+
+let root: string;
+let tsconfig: string;
+const component = (name: string) => path.join(root, 'app', 'components', name);
+const read = (name: string) => fs.readFileSync(component(name), 'utf8');
+const edit = (file: string, append: string) => fs.appendFileSync(file, append);
+const shaOf = (name: string) => dependencySha(component(name), read(name), tsconfig);
+
+beforeEach(() => {
+  root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'hve-deps-')));
+  fs.cpSync(FIXTURES, root, { recursive: true });
+  fs.mkdirSync(path.join(root, 'node_modules', 'some-pkg'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'node_modules', 'some-pkg', 'index.js'), 'export default 1;');
+  tsconfig = path.join(root, 'tsconfig.json');
+});
+afterEach(() => fs.rmSync(root, { recursive: true, force: true }));
+
+describe('importSpecifiers', () => {
+  it('finds static, side-effect, type and dynamic imports once each', () => {
+    expect(importSpecifiers(read('root.gts'))).toEqual([
+      '@glimmer/component',
+      'app/components/mid',
+      './leaf-two.js',
+      './dir',
+      'operations',
+      'some-pkg',
+      'side-effect-only',
+    ]);
+    expect(importSpecifiers(read('dir/index.ts'))).toEqual(['../leaf']);
+  });
+});
+
+describe('resolveProjectImport', () => {
+  it('resolves relative, paths-mapped, js-to-ts and directory imports to project files', () => {
+    const from = component('root.gts');
+    expect(resolveProjectImport('app/components/mid', from, tsconfig)).toBe(component('mid.gts'));
+    expect(resolveProjectImport('./leaf-two.js', from, tsconfig)).toBe(component('leaf-two.ts'));
+    expect(resolveProjectImport('./dir', from, tsconfig)).toBe(component('dir/index.ts'));
+    expect(resolveProjectImport('operations', from, tsconfig)).toBe(path.join(root, 'types', 'operations.d.ts'));
+  });
+
+  it('treats packages and unresolved specifiers as external', () => {
+    const from = component('root.gts');
+    expect(resolveProjectImport('@glimmer/component', from, tsconfig)).toBeNull();
+    expect(resolveProjectImport('some-pkg', from, tsconfig)).toBeNull();
+    expect(resolveProjectImport('./missing', from, tsconfig)).toBeNull();
+  });
+
+  it('reads paths and baseUrl through a jsonc tsconfig with extends', () => {
+    expect(resolveProjectImport('app/components/leaf', component('mid.gts'), tsconfig)).toBe(component('leaf.gts'));
+  });
+});
+
+describe('dependencyClosure', () => {
+  it('is the transitive set of project files, without the root or packages', () => {
+    expect(dependencyClosure(component('root.gts'), read('root.gts'), tsconfig)).toEqual(
+      [component('dir/index.ts'), component('leaf-two.ts'), component('leaf.gts'), component('mid.gts'), path.join(root, 'types', 'operations.d.ts')].sort(),
+    );
+  });
+
+  it('terminates on cycles and includes both sides', () => {
+    expect(dependencyClosure(component('cycle-a.gts'), read('cycle-a.gts'), tsconfig)).toEqual([component('cycle-b.gts')]);
+    expect(dependencyClosure(component('cycle-b.gts'), read('cycle-b.gts'), tsconfig)).toEqual([component('cycle-a.gts')]);
+  });
+
+  it('is empty without a tsconfig-relative project', () => {
+    expect(dependencySha(component('leaf.gts'), read('leaf.gts'), null)).toBe('no-tsconfig');
+  });
+});
+
+describe('dependencySha: invalidation', () => {
+  it('changes for every dependent, transitively, when a leaf changes', () => {
+    const before = { root: shaOf('root.gts'), mid: shaOf('mid.gts'), leaf: shaOf('leaf.gts') };
+    edit(component('leaf.gts'), '\n');
+    expect(shaOf('root.gts')).not.toBe(before.root);
+    expect(shaOf('mid.gts')).not.toBe(before.mid);
+    // The leaf's own content is not part of its dependency sha; that is the file sha's job.
+    expect(shaOf('leaf.gts')).toBe(before.leaf);
+  });
+
+  it('does not change when an unrelated file changes', () => {
+    const before = shaOf('root.gts');
+    edit(component('unrelated.gts'), '\n');
+    expect(shaOf('root.gts')).toBe(before);
+  });
+
+  // Ambient declarations and the lockfile are hashed once per process, so
+  // the change is shown with a second copy of the project.
+  it('differs for every file between projects whose ambient declarations or lockfile differ', () => {
+    const copy = (mutate: (dir: string) => void) => {
+      const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'hve-deps-copy-')));
+      fs.cpSync(root, dir, { recursive: true });
+      mutate(dir);
+      const at = (name: string) => path.join(dir, 'app', 'components', name);
+      return {
+        dir,
+        sha: (name: string) => dependencySha(at(name), fs.readFileSync(at(name), 'utf8'), path.join(dir, 'tsconfig.json')),
+      };
+    };
+    const same = copy(() => {});
+    const ambient = copy((dir) => edit(path.join(dir, 'types', 'global.d.ts'), '\n'));
+    const lockfile = copy((dir) => edit(path.join(dir, 'pnpm-lock.yaml'), '\n'));
+    try {
+      for (const name of ['root.gts', 'unrelated.gts']) {
+        expect(same.sha(name)).toBe(shaOf(name));
+        expect(ambient.sha(name)).not.toBe(shaOf(name));
+        expect(lockfile.sha(name)).not.toBe(shaOf(name));
+      }
+    } finally {
+      for (const { dir } of [same, ambient, lockfile]) fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('sees a dependency edited after it was first read', () => {
+    const before = shaOf('mid.gts');
+    // Same size, different content: mtime moves.
+    const leaf = component('leaf.gts');
+    fs.writeFileSync(leaf, read('leaf.gts').replace('span', 'div '));
+    fs.utimesSync(leaf, new Date(), new Date(Date.now() + 5000));
+    expect(shaOf('mid.gts')).not.toBe(before);
+  });
+});
+
+describe('cache keys include the closure', () => {
+  it('glint cache misses for the consumer after its import changes', () => {
+    const file = component('mid.gts');
+    const contents = read('mid.gts');
+    const result = { attrTypeMap: new Map(), componentTagMap: new Map([['2:1', 'span']]), componentAttrMap: new Map() };
+    writeCache(file, contents, tsconfig, 'ts6', result);
+    expect(readCache(file, contents, tsconfig, 'ts6')).not.toBeNull();
+    edit(component('leaf.gts'), '\n');
+    expect(readCache(file, contents, tsconfig, 'ts6')).toBeNull();
+  });
+
+  it('transform and report keys change when an import changes and not when an unrelated file does', () => {
+    const file = component('mid.gts');
+    const contents = read('mid.gts');
+    const keys = () => [transformCacheKey(file, contents, tsconfig, 'ts6'), reportCacheKey(file, contents, {}, '11.0.0', tsconfig, 'ts6')];
+    const before = keys();
+    edit(component('unrelated.gts'), '\n');
+    expect(keys()).toEqual(before);
+    edit(component('leaf.gts'), '\n');
+    expect(keys()[0]).not.toBe(before[0]);
+    expect(keys()[1]).not.toBe(before[1]);
+  });
+});
+
+describe('tsconfig reading', () => {
+  it('parses strings that end in a backslash and keeps comments inside strings', () => {
+    expect(parseJsonc('{ "outDir": "c:\\\\out\\\\", // c\n "url": "http://x/*", /* b */ "n": [1, 2,], }')).toEqual({
+      outDir: 'c:\\out\\',
+      url: 'http://x/*',
+      n: [1, 2],
+    });
+  });
+
+  it('keeps resolving when a tsconfig has a malformed paths entry or cannot be parsed', () => {
+    fs.writeFileSync(tsconfig, '{ "compilerOptions": { "baseUrl": ".", "paths": { "app/*": "./app/*", "*": ["./types/*"] } } }');
+    const from = component('root.gts');
+    expect(() => shaOf('root.gts')).not.toThrow();
+    expect(resolveProjectImport('operations', from, tsconfig)).toBe(path.join(root, 'types', 'operations.d.ts'));
+    expect(resolveProjectImport('app/components/mid', from, tsconfig)).toBe(component('mid.gts'));
+    fs.writeFileSync(tsconfig, '{ not json');
+    expect(() => shaOf('root.gts')).not.toThrow();
+  });
+
+  it('prefers the pattern with the longest prefix, like tsc', () => {
+    fs.mkdirSync(path.join(root, 'types', 'app', 'components'), { recursive: true });
+    fs.writeFileSync(path.join(root, 'types', 'app', 'components', 'mid.d.ts'), 'export {}');
+    fs.writeFileSync(tsconfig, '{ "compilerOptions": { "paths": { "*": ["./types/*"], "app/*": ["./app/*"] } } }');
+    expect(resolveProjectImport('app/components/mid', component('root.gts'), tsconfig)).toBe(component('mid.gts'));
+  });
+
+  it('resolves paths against the inherited baseUrl and lets a later extends entry win', () => {
+    fs.mkdirSync(path.join(root, 'src', 'lib', 'x'), { recursive: true });
+    fs.writeFileSync(path.join(root, 'src', 'lib', 'x', 'a.ts'), 'export {}');
+    fs.writeFileSync(path.join(root, 'tsconfig.a.json'), '{ "compilerOptions": { "baseUrl": "./app" } }');
+    fs.writeFileSync(path.join(root, 'tsconfig.b.json'), '{ "compilerOptions": { "baseUrl": "./src" } }');
+    fs.writeFileSync(tsconfig, '{ "extends": ["./tsconfig.a.json", "./tsconfig.b.json"], "compilerOptions": { "paths": { "x/*": ["./lib/x/*"] } } }');
+    expect(resolveProjectImport('x/a', component('root.gts'), tsconfig)).toBe(path.join(root, 'src', 'lib', 'x', 'a.ts'));
+  });
+
+  it('follows a package extends through its tsconfig field', () => {
+    const pkg = path.join(root, 'node_modules', '@acme', 'tsconfig');
+    fs.mkdirSync(pkg, { recursive: true });
+    fs.writeFileSync(path.join(pkg, 'package.json'), '{ "name": "@acme/tsconfig", "tsconfig": "base.json" }');
+    fs.writeFileSync(path.join(pkg, 'base.json'), '{ "compilerOptions": { "paths": { "app/*": ["./app/*"] } } }');
+    fs.writeFileSync(tsconfig, '{ "extends": "@acme/tsconfig" }');
+    // paths declared in node_modules resolve against that config's directory, like tsc
+    expect(resolveProjectImport('app/components/mid', component('root.gts'), tsconfig)).toBeNull();
+    fs.writeFileSync(path.join(pkg, 'base.json'), '{ "compilerOptions": { "baseUrl": "../../.." , "paths": { "app/*": ["./app/*"] } } }');
+    expect(resolveProjectImport('app/components/mid', component('root.gts'), tsconfig)).toBe(component('mid.gts'));
+  });
+
+  it('sees an edit to tsconfig paths', () => {
+    const before = shaOf('root.gts');
+    fs.writeFileSync(tsconfig, '{ "compilerOptions": { "paths": { "*": ["./types/*"] } } }');
+    expect(shaOf('root.gts')).not.toBe(before);
+  });
+});
+
+describe('workspace sources', () => {
+  it('tracks files outside the tsconfig directory reached through paths', () => {
+    const shared = path.join(path.dirname(root), path.basename(root) + '-shared');
+    fs.mkdirSync(shared, { recursive: true });
+    fs.writeFileSync(path.join(shared, 'button.gts'), '<template><button /></template>');
+    fs.writeFileSync(tsconfig, `{ "compilerOptions": { "paths": { "@acme/ui/*": ["../${path.basename(shared)}/*"] } } }`);
+    fs.writeFileSync(component('root.gts'), "import Button from '@acme/ui/button';\n<template><Button /></template>");
+    try {
+      const before = shaOf('root.gts');
+      expect(dependencyClosure(component('root.gts'), read('root.gts'), tsconfig)).toEqual([path.join(shared, 'button.gts')]);
+      edit(path.join(shared, 'button.gts'), '\n');
+      expect(shaOf('root.gts')).not.toBe(before);
+    } finally {
+      fs.rmSync(shared, { recursive: true, force: true });
+    }
+  });
+
+  it('tracks a workspace package linked into node_modules by its real path', () => {
+    const pkgSource = path.join(root, 'packages', 'ui');
+    fs.mkdirSync(pkgSource, { recursive: true });
+    fs.writeFileSync(path.join(pkgSource, 'button.gts'), '<template><button /></template>');
+    fs.mkdirSync(path.join(root, 'node_modules', '@acme'), { recursive: true });
+    fs.symlinkSync(pkgSource, path.join(root, 'node_modules', '@acme', 'ui'));
+    fs.writeFileSync(tsconfig, '{ "compilerOptions": { "baseUrl": "./node_modules" } }');
+    fs.writeFileSync(component('root.gts'), "import Button from '@acme/ui/button';\n<template><Button /></template>");
+    expect(dependencyClosure(component('root.gts'), read('root.gts'), tsconfig)).toEqual([path.join(pkgSource, 'button.gts')]);
+    expect(resolveProjectImport('some-pkg', component('root.gts'), tsconfig)).toBeNull();
+  });
+});
+
+describe('long-lived process', () => {
+  it('sees a dependency created after the import was first unresolved', () => {
+    fs.writeFileSync(component('root.gts'), "import Card from './card';\n<template><Card /></template>");
+    expect(dependencyClosure(component('root.gts'), read('root.gts'), tsconfig)).toEqual([]);
+    fs.writeFileSync(component('card.gts'), '<template><article /></template>');
+    fs.utimesSync(path.dirname(component('card.gts')), new Date(), new Date(Date.now() + 5000));
+    expect(dependencyClosure(component('root.gts'), read('root.gts'), tsconfig)).toEqual([component('card.gts')]);
+  });
+
+  it('reaches .hbs templates, and only those, through a registry file that imports components', () => {
+    fs.writeFileSync(
+      path.join(root, 'types', 'registry.d.ts'),
+      "import Leaf from '../app/components/leaf';\ndeclare module '@glint/environment-ember-loose/registry' { export default interface Registry { Leaf: typeof Leaf } }\n",
+    );
+    fs.mkdirSync(path.join(root, 'app', 'templates'), { recursive: true });
+    fs.writeFileSync(path.join(root, 'app', 'templates', 'page.hbs'), '<Leaf @label="x" />');
+    const copy = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'hve-deps-copy-')));
+    fs.cpSync(root, copy, { recursive: true });
+    edit(path.join(copy, 'app', 'components', 'leaf.gts'), '\n');
+    const sha = (dir: string, rel: string) => {
+      const at = path.join(dir, rel);
+      return dependencySha(at, fs.readFileSync(at, 'utf8'), path.join(dir, 'tsconfig.json'));
+    };
+    try {
+      expect(sha(copy, 'app/templates/page.hbs')).not.toBe(sha(root, 'app/templates/page.hbs'));
+      // a .gts that does not import leaf.gts is not affected
+      expect(sha(copy, 'app/components/unrelated.gts')).toBe(sha(root, 'app/components/unrelated.gts'));
+    } finally {
+      fs.rmSync(copy, { recursive: true, force: true });
+    }
+  });
+
+  it('counts a source file with a module augmentation as a project-wide input', () => {
+    const copy = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'hve-deps-copy-')));
+    fs.cpSync(root, copy, { recursive: true });
+    fs.writeFileSync(path.join(copy, 'app', 'components', 'registry.ts'), "declare module '@ember/service' { interface Registry { x: 1 } }\n");
+    try {
+      const at = path.join(copy, 'app', 'components', 'unrelated.gts');
+      expect(dependencySha(at, fs.readFileSync(at, 'utf8'), path.join(copy, 'tsconfig.json'))).not.toBe(shaOf('unrelated.gts'));
+    } finally {
+      fs.rmSync(copy, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('without Glint', () => {
+  it('leaves the closure out of the transform and report keys', () => {
+    const file = component('mid.gts');
+    const contents = read('mid.gts');
+    process.env['HVE_GLINT'] = '0';
+    try {
+      const before = [transformCacheKey(file, contents, tsconfig, 'ts6'), reportCacheKey(file, contents, {}, '11.0.0', tsconfig, 'ts6')];
+      edit(component('leaf.gts'), '\n');
+      expect([transformCacheKey(file, contents, tsconfig, 'ts6'), reportCacheKey(file, contents, {}, '11.0.0', tsconfig, 'ts6')]).toEqual(before);
+    } finally {
+      delete process.env['HVE_GLINT'];
+    }
+  });
+});
diff --git a/transform.ts b/transform.ts
index d3530aa..ca27ca5 100644
--- a/transform.ts
+++ b/transform.ts
@@ -306,7 +306,7 @@ function* transformGlimmer(source: Source): Generator<Source, void, unknown> {
   // Glint result. On a hit nothing below `computeTemplates` runs: no
   // content-tag parse, no Glint, no blanking.
   const tsconfigPath = findTsconfig(filename);
-  const key = transformCacheKey(data, tsconfigPath, tsconfigPath ? backendKindFor(tsconfigPath) : 'none');
+  const key = transformCacheKey(filename, data, tsconfigPath, tsconfigPath ? backendKindFor(tsconfigPath) : 'none');
   let templates = readTransformCache(filename, key);
   if (!templates) {
     templates = computeTemplates(filename, data);
diff --git a/tsconfig.test.json b/tsconfig.test.json
index c1fafe5..d655826 100644
--- a/tsconfig.test.json
+++ b/tsconfig.test.json
@@ -6,5 +6,5 @@
     "types": ["node"]
   },
   "include": ["*.ts", "lib/**/*.ts", "test/**/*.ts", "ecosystem/**/*.ts"],
-  "exclude": ["node_modules", "dist", "ecosystem/.cache"]
+  "exclude": ["node_modules", "dist", "ecosystem/.cache", "test/deps-fixtures"]
 }