fullshield 0.0.1 → 0.1.0

package/dist/compliance.js

@@ -0,0 +1,126 @@
+// src/compliance/index.ts
+var COMPLIANCE_DISCLAIMER = "This is not a certification or audit. FullShield produces an evidence-style mapping only; it does not certify PCI DSS, SOC 2, ISO, or any other standard.";
+var ROW = (ruleId, owasp, cwe, asvs, pci) => ({
+  ruleId,
+  owasp,
+  cwe,
+  asvs,
+  pci
+});
+var RULE_MAP = [
+  ROW("SAST-SQLI-001", "A03:2021 Injection", "CWE-89", "V5.3.4", "PCI DSS 6.2.4"),
+  ROW("SAST-NOSQLI-001", "A03:2021 Injection", "CWE-943", "V5.3.4", "PCI DSS 6.2.4"),
+  ROW("SAST-CMDI-001", "A03:2021 Injection", "CWE-78", "V5.3.3", "PCI DSS 6.2.4"),
+  ROW("SAST-PATH-001", "A01:2021 Broken Access Control", "CWE-22", "V12.3.1", "PCI DSS 6.2.4"),
+  ROW("SAST-EVAL-001", "A03:2021 Injection", "CWE-95", "V5.3.3", "PCI DSS 6.2.4"),
+  ROW("SAST-SSRF-001", "A10:2021 SSRF", "CWE-918", "V12.6.1", "PCI DSS 6.2.4"),
+  ROW("SAST-REDIRECT-001", "A01:2021 Broken Access Control", "CWE-601", "V5.1.1", "PCI DSS 6.4.2"),
+  ROW("SAST-PROTO-001", "A03:2021 Injection", "CWE-1321", "V5.3.3", "PCI DSS 6.2.4"),
+  ROW("SAST-XSS-001", "A03:2021 Injection", "CWE-79", "V5.3.3", "PCI DSS 6.2.4"),
+  ROW("SAST-JWT-001", "A07:2021 Identification Failures", "CWE-347", "V3.5.3", "PCI DSS 6.5.10"),
+  ROW("SAST-CRYPTO-001", "A02:2021 Cryptographic Failures", "CWE-338", "V6.2.1", "PCI DSS 3.6 / 4.2"),
+  ROW("SAST-AUTH-001", "A07:2021 Identification Failures", "CWE-306", "V4.1.1", "PCI DSS 8.2"),
+  ROW("SECRET-AWS-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2 / 8.3"),
+  ROW("SECRET-STRIPE-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2"),
+  ROW("SECRET-GITHUB-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 8.3"),
+  ROW("SECRET-SLACK-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 8.3"),
+  ROW("SECRET-GOOGLE-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 8.3"),
+  ROW("SECRET-AIKEY-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 8.3"),
+  ROW("SECRET-PRIVKEY-001", "A02:2021 Cryptographic Failures", "CWE-321", "V6.4.1", "PCI DSS 3.5 / 4.2"),
+  ROW("SECRET-DBURL-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2 / 8.3"),
+  ROW("SECRET-JWT-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.5"),
+  ROW("SECRET-ENVFILE-001", "A02:2021 Cryptographic Failures", "CWE-312", "V8.3.4", "PCI DSS 3.2"),
+  ROW("SECRET-ENTROPY-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 8.3"),
+  ROW("DEPS-VULN-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("DEPS-MALICIOUS-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3 / 12.10"),
+  ROW("DEPS-TYPOSQUAT-001", "A06:2021 Vulnerable Components", "CWE-494", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("DEPS-NOLOCK-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("DEPS-DEPRECATED-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("CONFIG-HELMET-001", "A05:2021 Security Misconfiguration", "CWE-693", "V14.4.3", "PCI DSS 6.4.3"),
+  ROW("CONFIG-BODYLIMIT-001", "A05:2021 Security Misconfiguration", "CWE-400", "V13.1.1", "PCI DSS 6.2.4"),
+  ROW("CONFIG-CORS-001", "A05:2021 Security Misconfiguration", "CWE-942", "V14.4.5", "PCI DSS 6.4.3"),
+  ROW("CONFIG-RATELIMIT-001", "A07:2021 Identification Failures", "CWE-307", "V2.2.1", "PCI DSS 8.3.4"),
+  ROW("CONFIG-ERRSTACK-001", "A04:2021 Insecure Design", "CWE-209", "V7.4.1", "PCI DSS 6.2.4"),
+  ROW("CONFIG-INSTALLSCRIPT-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("CONFIG-DOCKER-LATEST-001", "A05:2021 Security Misconfiguration", "CWE-1188", "V14.1.3", "PCI DSS 2.2"),
+  ROW("CONFIG-DOCKER-ROOT-001", "A05:2021 Security Misconfiguration", "CWE-250", "V14.1.3", "PCI DSS 2.2"),
+  ROW("CONFIG-DOCKER-ENV-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2"),
+  ROW("EDGE-CDN-001", "A05:2021 Security Misconfiguration", "CWE-693", "V14.4.3", "PCI DSS 1.2 / 6.4"),
+  ROW("EDGE-CSP-001", "A05:2021 Security Misconfiguration", "CWE-693", "V14.4.3", "PCI DSS 6.4.3"),
+  ROW("EDGE-EXPOSE-001", "A05:2021 Security Misconfiguration", "CWE-538", "V14.4.3", "PCI DSS 2.2 / 6.4"),
+  ROW("EDGE-HSTS-001", "A05:2021 Security Misconfiguration", "CWE-319", "V9.1.1", "PCI DSS 4.2"),
+  ROW("EDGE-REFERRER-001", "A05:2021 Security Misconfiguration", "CWE-201", "V14.4.3", "PCI DSS 6.4.3"),
+  ROW("EDGE-TLS-001", "A02:2021 Cryptographic Failures", "CWE-319", "V9.1.1", "PCI DSS 4.2"),
+  ROW("EDGE-XCTO-001", "A05:2021 Security Misconfiguration", "CWE-693", "V14.4.3", "PCI DSS 6.4.3"),
+  ROW("EDGE-XFO-001", "A05:2021 Security Misconfiguration", "CWE-1021", "V14.4.3", "PCI DSS 6.4.3"),
+  ROW("RASP-SQL-001", "A03:2021 Injection", "CWE-89", "V5.3.4", "PCI DSS 6.4.2"),
+  ROW("RASP-SHELL-001", "A03:2021 Injection", "CWE-78", "V5.3.3", "PCI DSS 6.4.2"),
+  ROW("RASP-PATH-001", "A01:2021 Broken Access Control", "CWE-22", "V12.3.1", "PCI DSS 6.4.2"),
+  ROW("RASP-NOSQL-001", "A03:2021 Injection", "CWE-943", "V5.3.4", "PCI DSS 6.4.2"),
+  ROW("RASP-SSRF-001", "A10:2021 SSRF", "CWE-918", "V12.6.1", "PCI DSS 1.3"),
+  ROW("RASP-PROTO-001", "A03:2021 Injection", "CWE-1321", "V5.3.3", "PCI DSS 6.4.2"),
+  ROW("AI-INJECT-001", "A03:2021 Injection", "CWE-1427", "V5.3.3", "PCI DSS 6.2.4"),
+  ROW("LLM-001", "A03:2021 Injection", "CWE-1426", "V5.3.3", "PCI DSS 6.2.4"),
+  ROW("LLM-002", "A03:2021 Injection", "CWE-94", "V5.3.3", "PCI DSS 6.2.4"),
+  ROW("LLM-003", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),
+  ROW("LLM-004", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2"),
+  ROW("LLM-005", "A04:2021 Insecure Design", "CWE-770", "V13.1.1", "PCI DSS 6.2.4"),
+  ROW("SUPPLY-INSTALLSCRIPT-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("SUPPLY-NPMRC-NET-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 12.10"),
+  ROW("SUPPLY-OBFUSCATE-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("SUPPLY-BEHAVIOR-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("SUPPLY-COOLDOWN-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("SUPPLY-LOCKURL-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
+  ROW("SUPPLY-CONFUSION-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
+  ROW("SUPPLY-PROVENANCE-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
+  ROW("IAC-GHA-UNPINNED-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
+  ROW("IAC-GHA-PRTARGET-001", "A01:2021 Broken Access Control", "CWE-269", "V4.1.1", "PCI DSS 7.2"),
+  ROW("IAC-GHA-PERMS-001", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),
+  ROW("IAC-GHA-SECRETLOG-001", "A09:2021 Security Logging Failures", "CWE-532", "V7.1.1", "PCI DSS 3.2 / 10.2"),
+  ROW("IAC-TF-S3PUBLIC-001", "A01:2021 Broken Access Control", "CWE-284", "V12.1.1", "PCI DSS 1.3 / 3.2"),
+  ROW("IAC-TF-SGOPEN-001", "A05:2021 Security Misconfiguration", "CWE-284", "V1.4.1", "PCI DSS 1.2 / 1.3"),
+  ROW("IAC-TF-UNENCRYPTED-001", "A02:2021 Cryptographic Failures", "CWE-311", "V6.2.1", "PCI DSS 3.4 / 4.2"),
+  ROW("IAC-K8S-PRIV-001", "A05:2021 Security Misconfiguration", "CWE-250", "V14.1.3", "PCI DSS 2.2"),
+  ROW("IAC-COMPOSE-PRIV-001", "A05:2021 Security Misconfiguration", "CWE-250", "V14.1.3", "PCI DSS 2.2"),
+  ROW("RASP-EGRESS-001", "A10:2021 SSRF", "CWE-918", "V12.6.1", "PCI DSS 1.3"),
+  ROW("RASP-HONEY-001", "A09:2021 Security Logging Failures", "CWE-778", "V7.1.1", "PCI DSS 10.2 / 11.5"),
+  ROW("RASP-FAIL-OPEN-001", "A05:2021 Security Misconfiguration", "CWE-755", "V14.4.3", "PCI DSS 6.4.3"),
+  ROW("RUNTIME-SQLI-001", "A03:2021 Injection", "CWE-89", "V5.3.4", "PCI DSS 6.4.2"),
+  ROW("RUNTIME-XSS-001", "A03:2021 Injection", "CWE-79", "V5.3.3", "PCI DSS 6.4.2"),
+  ROW("RUNTIME-PATH-001", "A01:2021 Broken Access Control", "CWE-22", "V12.3.1", "PCI DSS 6.4.2"),
+  ROW("RUNTIME-RATELIMIT-001", "A07:2021 Identification Failures", "CWE-307", "V2.2.1", "PCI DSS 8.3.4"),
+  ROW("RUNTIME-BODY-001", "A05:2021 Security Misconfiguration", "CWE-400", "V13.1.1", "PCI DSS 6.2.4"),
+  ROW("RUNTIME-ANOMALY-001", "A04:2021 Insecure Design", "CWE-754", "V14.4.3", "PCI DSS 10.2"),
+  ROW("AI-IDOR-001", "A01:2021 Broken Access Control", "CWE-639", "V4.1.1", "PCI DSS 7.2"),
+  ROW("AI-MASSASSIGN-001", "A01:2021 Broken Access Control", "CWE-915", "V5.1.1", "PCI DSS 6.2.4")
+];
+var byId = new Map(RULE_MAP.map((r) => [r.ruleId, r]));
+function mappingFor(ruleId) {
+  return byId.get(ruleId);
+}
+function renderCompliance(findings, standard = "pci") {
+  const rows = findings.map((f) => {
+    const m = mappingFor(f.ruleId);
+    return `${f.ruleId}	${f.severity ?? ""}	${f.file ?? ""}	${m?.pci ?? "unmapped"}	${m?.owasp ?? ""}	${m?.cwe ?? ""}`;
+  });
+  return [
+    `FullShield compliance mapping (${standard})`,
+    COMPLIANCE_DISCLAIMER,
+    "",
+    "ruleId	severity	file	pci	owasp	cwe",
+    ...rows,
+    "",
+    COMPLIANCE_DISCLAIMER
+  ].join("\n");
+}
+function collectRuleIdsFromSources(texts) {
+  const ids = /* @__PURE__ */ new Set();
+  const re = /\b((?:SAST|SECRET|DEPS|CONFIG|EDGE|AI|LLM|SUPPLY|IAC|RASP|RUNTIME)-[A-Z0-9]+-\d{3})\b/g;
+  for (const text of texts) {
+    let m;
+    while ((m = re.exec(text)) !== null) ids.add(m[1] ?? "");
+  }
+  return [...ids].sort();
+}
+
+export { COMPLIANCE_DISCLAIMER, RULE_MAP, collectRuleIdsFromSources, mappingFor, renderCompliance };

package/dist/confirm.js

@@ -0,0 +1,146 @@
+// src/confirm/index.ts
+var DESTRUCTIVE = /\b(drop|delete|update|insert|truncate|alter)\b|\brm\s|unlink|mkfs|\bdd\s|format\s|>\s*\/dev/i;
+var containers = /* @__PURE__ */ new Map();
+function registerConfirmContainer(entry) {
+  containers.set(entry.id, entry);
+}
+function resetConfirmContainers() {
+  containers.clear();
+}
+function hostnameOf(raw) {
+  const href = raw.includes("://") ? raw : `http://${raw}`;
+  const url = new URL(href);
+  const m = href.match(/^https?:\/\/([^/?#]+)/i);
+  let authority = m?.[1] ?? url.hostname;
+  if (authority.includes("@")) authority = authority.slice(authority.lastIndexOf("@") + 1);
+  let rawHost;
+  if (authority.startsWith("[")) {
+    const end = authority.indexOf("]");
+    rawHost = end >= 0 ? authority.slice(0, end + 1) : authority;
+  } else {
+    rawHost = authority.split(":")[0] ?? url.hostname;
+  }
+  return { host: url.hostname, href: url.href, rawHost };
+}
+function isLiteralLocal(host) {
+  return host === "localhost" || host === "127.0.0.1";
+}
+function isRegisteredContainer(host) {
+  for (const c of containers.values()) {
+    if (c.host === host || c.ip === host) return true;
+  }
+  return false;
+}
+function assertLocalTarget(raw, opts = {}) {
+  let host;
+  let rawHost;
+  try {
+    const parsed = hostnameOf(raw);
+    host = parsed.host;
+    rawHost = parsed.rawHost;
+  } catch {
+    throw new Error(`confirm: refused target ${raw}`);
+  }
+  if (isLiteralLocal(rawHost) && isLiteralLocal(host)) return;
+  if (isRegisteredContainer(host) || isRegisteredContainer(rawHost)) return;
+  if (opts.lookup) {
+    const ips = opts.lookup(host);
+    throw new Error(`confirm: refused target ${raw} (resolved ${ips.join(",")})`);
+  }
+  throw new Error(`confirm: refused target ${raw} (host ${host} is not localhost/127.0.0.1/FullShield container)`);
+}
+function buildCanary(kind, token) {
+  if (DESTRUCTIVE.test(token)) {
+    throw new Error("confirm: canary must be harmless (no DROP/DELETE/rm/dd)");
+  }
+  if (kind === "sql") return `1 UNION SELECT 0,'${token}'`;
+  if (kind === "shell") return `; echo ${token}`;
+  if (kind === "path") return "../canary.txt";
+  return token;
+}
+function curlProof(method, url, extra = "") {
+  return `curl -sS -X ${method} ${extra}${url}`.trim();
+}
+async function probe(fetchImpl, url, method, body, headers) {
+  try {
+    const res = await fetchImpl(url, {
+      method,
+      headers: {
+        ...body !== void 0 ? { "content-type": "application/json" } : {},
+        ...headers
+      },
+      body: body !== void 0 ? JSON.stringify(body) : void 0
+    });
+    const text = await res.text();
+    return { ok: res.ok, text };
+  } catch (err) {
+    return { ok: false, text: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function confirmTarget(baseUrl, opts) {
+  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_CONFIRM !== "1") {
+    return { confirmations: [], skipped: true };
+  }
+  try {
+    assertLocalTarget(baseUrl);
+  } catch (err) {
+    return {
+      confirmations: [
+        {
+          kind: "sql",
+          status: "unconfirmed",
+          detail: err instanceof Error ? err.message : String(err)
+        }
+      ]
+    };
+  }
+  const token = opts.canaryToken ?? `FULLSHIELD_CANARY_${Date.now().toString(16)}`;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const origin = baseUrl.replace(/\/$/, "");
+  const confirmations = [];
+  for (const route of opts.routes) {
+    try {
+      if (route.kind === "idor") {
+        const url2 = `${origin}${route.path}`;
+        const hit2 = await probe(fetchImpl, url2, route.method, void 0, {
+          "x-user": route.asUser ?? opts.users?.b ?? "bob"
+        });
+        const owner = route.expectOwner ?? opts.users?.a ?? "alice";
+        const confirmed2 = hit2.ok && hit2.text.includes(owner);
+        confirmations.push({
+          kind: "idor",
+          status: confirmed2 ? "confirmed" : "unconfirmed",
+          proof: curlProof(route.method, url2, `-H 'x-user: ${route.asUser ?? "bob"}' `),
+          detail: hit2.text.slice(0, 200)
+        });
+        continue;
+      }
+      const payload = buildCanary(route.kind, token);
+      const param = route.param ?? "q";
+      let url = `${origin}${route.path}`;
+      let body;
+      if (route.method === "GET") {
+        url += `?${encodeURIComponent(param)}=${encodeURIComponent(payload)}`;
+      } else {
+        body = { [param]: payload };
+      }
+      const hit = await probe(fetchImpl, url, route.method, body);
+      const confirmed = hit.text.includes(token) || route.kind === "path" && hit.text.includes("FULLSHIELD_CANARY");
+      confirmations.push({
+        kind: route.kind,
+        status: confirmed ? "confirmed" : "unconfirmed",
+        proof: curlProof(route.method, url),
+        detail: hit.text.slice(0, 200)
+      });
+    } catch (err) {
+      confirmations.push({
+        kind: route.kind,
+        status: "unconfirmed",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return { confirmations };
+}
+
+export { assertLocalTarget, buildCanary, confirmTarget, registerConfirmContainer, resetConfirmContainers };

package/dist/dashboard.js

@@ -0,0 +1,121 @@
+import { mkdirSync, existsSync } from 'fs';
+import { createRequire } from 'module';
+import { createServer } from 'http';
+import { join } from 'path';
+
+// src/dashboard/index.ts
+var require2 = createRequire(import.meta.url);
+function sqliteDb(file) {
+  const { DatabaseSync } = require2("node:sqlite");
+  const db = new DatabaseSync(file);
+  db.exec(
+    "CREATE TABLE IF NOT EXISTS scans (scannedAt TEXT NOT NULL, total INTEGER NOT NULL, highCrit INTEGER NOT NULL)"
+  );
+  return {
+    list() {
+      return db.prepare("SELECT scannedAt, total, highCrit FROM scans ORDER BY scannedAt").all();
+    },
+    insert(row) {
+      db.prepare("INSERT INTO scans (scannedAt, total, highCrit) VALUES (?, ?, ?)").run(
+        row.scannedAt,
+        row.total,
+        row.highCrit
+      );
+    },
+    close() {
+      db.close();
+    }
+  };
+}
+function openHistory(dir) {
+  const root = join(dir, ".fullshield");
+  mkdirSync(root, { recursive: true });
+  return sqliteDb(join(root, "history.db"));
+}
+function recordHistory(db, row) {
+  db.insert(row);
+}
+function assertDashboardHost(host) {
+  if (host === void 0 || host.length === 0) return false;
+  const h = host.split(":")[0]?.toLowerCase() ?? "";
+  return h === "localhost" || h === "127.0.0.1";
+}
+function createDashboardHandler(opts) {
+  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM !== "1") {
+    throw new Error("dashboard requires FULLSHIELD_EXPERIMENTAL_PLATFORM=1");
+  }
+  const db = opts.db ?? openHistory(opts.dbPath);
+  return (req, res) => {
+    if (!assertDashboardHost(typeof req.headers.host === "string" ? req.headers.host : void 0)) {
+      res.writeHead(400, { "content-type": "text/plain" });
+      res.end("invalid host");
+      return;
+    }
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname === "/api/ingest" && req.method !== "POST") {
+      res.writeHead(405, { allow: "POST" });
+      res.end("method not allowed");
+      return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/ingest") {
+      const chunks = [];
+      req.on("data", (c) => chunks.push(c));
+      req.on("end", () => {
+        try {
+          const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+          db.insert(body);
+          res.writeHead(204);
+          res.end();
+        } catch {
+          res.writeHead(400);
+          res.end("bad json");
+        }
+      });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/api/history") {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ scans: db.list() }));
+      return;
+    }
+    if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/index.html")) {
+      const scans = db.list();
+      const rows = scans.map((s) => `<tr><td>${s.scannedAt}</td><td>${s.total}</td><td>${s.highCrit}</td></tr>`).join("");
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(
+        `<!DOCTYPE html><html><body><h1>FullShield history</h1><table><tr><th>at</th><th>total</th><th>high+crit</th></tr>${rows}</table></body></html>`
+      );
+      return;
+    }
+    res.writeHead(404);
+    res.end("not found");
+  };
+}
+function startDashboard(opts) {
+  if (!existsSync(opts.dir)) mkdirSync(opts.dir, { recursive: true });
+  const db = openHistory(opts.dir);
+  const handler = createDashboardHandler({ dbPath: opts.dir, experimental: opts.experimental, db });
+  const server = createServer(handler);
+  return new Promise((resolve, reject) => {
+    server.listen(opts.port ?? 0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr !== null ? addr.port : 0;
+      resolve({
+        port,
+        close: () => new Promise((res, rej) => {
+          server.close((err) => {
+            try {
+              db.close();
+            } catch {
+            }
+            if (err) rej(err);
+            else res();
+          });
+        })
+      });
+    });
+    server.on("error", reject);
+  });
+}
+
+export { assertDashboardHost, createDashboardHandler, openHistory, recordHistory, startDashboard };

package/dist/iac.js

@@ -0,0 +1,84 @@
+import { existsSync, statSync, readFileSync, readdirSync } from 'fs';
+import { relative, join } from 'path';
+import { createHash } from 'crypto';
+
+// src/iac/index.ts
+function makeFindingId(ruleId, file, snippet) {
+  const normalized = (snippet ?? "").replace(/\s+/g, " ").trim();
+  return createHash("sha256").update(`${ruleId}\0${file ?? ""}\0${normalized}`).digest("hex").slice(0, 16);
+}
+
+// src/iac/index.ts
+function finding(ruleId, title, message, file, severity = "high") {
+  return {
+    id: makeFindingId(ruleId, file, message),
+    ruleId,
+    module: "config",
+    title,
+    severity,
+    confidence: "medium",
+    file,
+    message,
+    remediation: "Pin actions by SHA, drop pull_request_target, tighten permissions, close 0.0.0.0/0, encrypt storage, drop privileged."
+  };
+}
+function walk(dir, out = []) {
+  if (!existsSync(dir)) return out;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (["node_modules", "dist", ".git"].includes(entry.name)) continue;
+      walk(full, out);
+    } else if (entry.isFile()) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+function scanIac(dir, opts = {}) {
+  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_IAC !== "1") return [];
+  if (!existsSync(dir) || !statSync(dir).isDirectory()) return [];
+  const findings = [];
+  for (const file of walk(dir)) {
+    const rel = relative(dir, file).replaceAll("\\", "/");
+    const text = readFileSync(file, "utf8");
+    if (rel.includes(".github/workflows/") && /\.ya?ml$/.test(rel)) {
+      if (/uses:\s+\S+@v\d/.test(text) && !/uses:\s+\S+@[0-9a-f]{40}/.test(text)) {
+        findings.push(finding("IAC-GHA-UNPINNED-001", "GitHub Action not pinned to a commit SHA", "uses: tag instead of SHA", rel));
+      }
+      if (/pull_request_target/.test(text)) {
+        findings.push(finding("IAC-GHA-PRTARGET-001", "pull_request_target workflow", "untrusted PR can run with base secrets", rel, "critical"));
+      }
+      if (/permissions:\s*\n\s+contents:\s*write/.test(text) || /permissions:\s+write-all/.test(text)) {
+        findings.push(finding("IAC-GHA-PERMS-001", "Overly broad GitHub Actions permissions", "write-all or contents: write", rel));
+      }
+      if (/echo\s+\$\{\{\s*secrets\.|console\.(?:log|info|debug)\([^)]*secrets\./i.test(text)) {
+        findings.push(finding("IAC-GHA-SECRETLOG-001", "Secret written to workflow logs", "echo or console of secrets.*", rel, "critical"));
+      }
+    }
+    if (/\.tf$/.test(rel)) {
+      if (/acl\s*=\s*"public-read"|block_public_acls\s*=\s*false/.test(text)) {
+        findings.push(finding("IAC-TF-S3PUBLIC-001", "Public S3 bucket", "public-read or public ACLs enabled", rel, "critical"));
+      }
+      if (/0\.0\.0\.0\/0/.test(text) && /22|3306|5432/.test(text)) {
+        findings.push(finding("IAC-TF-SGOPEN-001", "Security group open to the world on a data/admin port", "0.0.0.0/0 on 22/3306/5432", rel, "critical"));
+      }
+      if (/encrypted\s*=\s*false/.test(text)) {
+        findings.push(finding("IAC-TF-UNENCRYPTED-001", "Unencrypted cloud storage", "encrypted = false", rel));
+      }
+    }
+    if (/deployment\.ya?ml$|pod\.ya?ml$/.test(rel) || rel.includes("k8s/")) {
+      if (/privileged:\s*true/.test(text) || /hostNetwork:\s*true/.test(text)) {
+        findings.push(finding("IAC-K8S-PRIV-001", "Privileged or hostNetwork Kubernetes pod", "privileged/hostNetwork true", rel, "critical"));
+      }
+    }
+    if (/compose\.ya?ml$|docker-compose\.ya?ml$/.test(rel)) {
+      if (/privileged:\s*true/.test(text)) {
+        findings.push(finding("IAC-COMPOSE-PRIV-001", "Privileged docker-compose service", "privileged: true", rel, "critical"));
+      }
+    }
+  }
+  return findings;
+}
+
+export { scanIac };

package/dist/incremental.js

@@ -0,0 +1,13 @@
+import { spawnSync } from 'child_process';
+
+// src/incremental/index.ts
+function resolveChangedFiles(cwd, opts = {}) {
+  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM !== "1") return [];
+  if (!opts.changed && !opts.since) return [];
+  const run = opts.git ?? ((args) => spawnSync("git", args, { cwd, encoding: "utf8" }).stdout ?? "");
+  const range = opts.since ?? "HEAD";
+  const out = opts.changed ? run(["diff", "--name-only", "--cached"]) : run(["diff", "--name-only", range]);
+  return out.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+}
+
+export { resolveChangedFiles };