fullshield 0.1.3 → 0.3.0

package/dist/index.js

@@ -1,14 +1,15 @@
 import { createHash } from 'crypto';
 import { readFile, mkdir, writeFile, stat, unlink, readdir, mkdtemp } from 'fs/promises';
-import { resolve, join, basename, dirname, relative, posix } from 'path';
+import { resolve, join, basename, dirname, posix, relative } from 'path';
 import { execFile, spawnSync, spawn, execFileSync } from 'child_process';
 import { createInterface } from 'readline';
 import { promisify } from 'util';
 import { performance } from 'perf_hooks';
-import { homedir, tmpdir } from 'os';
+import { homedir, availableParallelism, tmpdir } from 'os';
 import { existsSync, statSync, readFileSync, readdirSync, cpSync, mkdirSync, rmSync } from 'fs';
-import ignoreModule from 'ignore';
+import { Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
+import ignoreModule from 'ignore';
 import pc from 'picocolors';
 
 var __defProp = Object.defineProperty;
@@ -564,6 +565,7 @@ var init_incremental = __esm({
 // src/modules/secrets/history.ts
 var history_exports = {};
 __export(history_exports, {
+  historyCommitLimit: () => historyCommitLimit,
   scanGitHistory: () => scanGitHistory
 });
 function gitError(error) {
@@ -606,7 +608,13 @@ function remapHit(hit, file) {
     secret: hit.secret
   };
 }
-async function streamLogChanges(cwd) {
+function historyCommitLimit(raw = process.env.FULLSHIELD_HISTORY_MAX) {
+  if (raw === void 0 || raw.trim() === "") return 500;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 1) return 500;
+  return Math.min(parsed, 5e3);
+}
+async function streamLogChanges(cwd, maxCommits) {
   const changes = [];
   await gitOk(cwd, ["rev-parse", "--is-inside-work-tree"]);
   const child = spawn(
@@ -623,6 +631,8 @@ async function streamLogChanges(cwd) {
       "--format=FSCOMMIT:%H",
       "--no-textconv",
       "--no-ext-diff",
+      "-n",
+      String(maxCommits),
       "HEAD"
     ],
     { stdio: ["ignore", "pipe", "pipe"] }
@@ -691,8 +701,14 @@ async function headSecretKeys(cwd) {
   }
   return keys;
 }
-async function scanGitHistory(cwd) {
-  const changes = await streamLogChanges(cwd);
+async function commitCount(cwd) {
+  const raw = await gitOk(cwd, ["rev-list", "--count", "HEAD"]);
+  const total = Number(raw.trim());
+  return Number.isInteger(total) && total >= 0 ? total : 0;
+}
+async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
+  const total = await commitCount(cwd);
+  const changes = await streamLogChanges(cwd, maxCommits);
   const blobHits = /* @__PURE__ */ new Map();
   const first = /* @__PURE__ */ new Map();
   for (const change of changes) {
@@ -729,7 +745,13 @@ async function scanGitHistory(cwd) {
       secret: hit.secret
     });
   }
-  return { findings: hits.map((h) => h.finding), hits };
+  const scanned = Math.min(maxCommits, total);
+  const history = total > maxCommits ? `scanned ${scanned} of ${total} commits` : void 0;
+  return {
+    findings: hits.map((h) => h.finding),
+    hits,
+    ...history !== void 0 ? { history } : {}
+  };
 }
 var execFileAsync2, ZERO_HASH, MAX_BLOB, RAW_LINE;
 var init_history = __esm({
@@ -1077,7 +1099,8 @@ function walk(node, visit) {
   }
 }
 function attachParents(node, parent) {
-  node.parent = parent;
+  const current = node;
+  if (parent !== void 0 || current.parent === void 0) current.parent = parent;
   for (const key of Object.keys(node)) {
     if (SKIP_KEYS.has(String(key))) continue;
     const value = node[key];
@@ -1147,6 +1170,14 @@ function classesEnabled() {
 function mcpCfgEnabled() {
   return process.env.FULLSHIELD_EXPERIMENTAL_MCPCFG === "1";
 }
+function taintV2Enabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_TAINT_V2 === "1";
+}
+var DIFF_FLAG = "FULLSHIELD_EXPERIMENTAL_DIFF";
+var LICENSE_FLAG = "FULLSHIELD_EXPERIMENTAL_LICENSE";
+function licenseEnabled() {
+  return process.env[LICENSE_FLAG] === "1";
+}
 
 // src/modules/config/finding.ts
 init_finding();
@@ -1956,6 +1987,103 @@ function exactPinsFromManifest(pkg) {
 
 // src/modules/deps/reachability.ts
 init_finding();
+
+// src/modules/deps/symbol-reachability.ts
+function affectedFunctionNames(vuln) {
+  const names = /* @__PURE__ */ new Set();
+  for (const affected of vuln.affected ?? []) {
+    const list = affected.ecosystem_specific?.affected_functions;
+    if (!Array.isArray(list)) continue;
+    for (const item of list) {
+      if (typeof item === "string" && item.length > 0) names.add(item);
+    }
+  }
+  return [...names];
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function called(source, local) {
+  return new RegExp(`\\b${escapeRegExp(local)}\\s*\\(`).test(source);
+}
+function memberCalled(source, object, member) {
+  return new RegExp(`\\b${escapeRegExp(object)}\\s*\\.\\s*${escapeRegExp(member)}\\s*\\(`).test(source);
+}
+function sourceCallsAffectedSymbol(source, symbol) {
+  const esc2 = escapeRegExp(symbol);
+  const named = new RegExp(
+    `import\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`,
+    "g"
+  );
+  let match;
+  while ((match = named.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const star = /import\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s+['"][^'"]+['"]/g;
+  while ((match = star.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const subDefault = new RegExp(
+    `import\\s+([A-Za-z_$][\\w$]*)\\s+from\\s+['"][^'"]+/${esc2}['"]`
+  );
+  const sub = subDefault.exec(source);
+  if (sub?.[1] !== void 0 && called(source, sub[1])) return true;
+  const reqMember = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+['"]\\s*\\)\\s*\\.\\s*${esc2}`
+  );
+  const reqHit = reqMember.exec(source);
+  if (reqHit?.[1] !== void 0 && called(source, reqHit[1])) return true;
+  const reqNs = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNs.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const reqNamed = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNamed.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s*:\s*/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const reqSub = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+/${esc2}['"]\\s*\\)`
+  );
+  const subReq = reqSub.exec(source);
+  if (subReq?.[1] !== void 0 && called(source, subReq[1])) return true;
+  const barrel = new RegExp(`export\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`, "g");
+  while ((match = barrel.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const exported = (bits[1] ?? bits[0])?.trim();
+      if (exported === symbol) {
+        const local = bits[0]?.trim();
+        if (local !== void 0 && called(source, local)) return true;
+      }
+    }
+  }
+  return false;
+}
+function classifySymbolUse(symbols, sources) {
+  for (const symbol of symbols) {
+    for (const source of sources.values()) {
+      if (sourceCallsAffectedSymbol(source, symbol)) return "symbol-reachable";
+    }
+  }
+  return "symbol-not-called";
+}
+
+// src/modules/deps/reachability.ts
 function packageNameFromSnippet(snippet) {
   if (snippet.startsWith("@")) {
     const second = snippet.indexOf("@", 1);
@@ -1984,9 +2112,9 @@ function isProductionSource(rel) {
 }
 function indexPackageUsage(sources) {
   const usage = /* @__PURE__ */ new Map();
-  const bump = (pkg, called) => {
+  const bump = (pkg, called2) => {
     const prev = usage.get(pkg) ?? { called: false };
-    usage.set(pkg, { imported: true, called: prev.called || called });
+    usage.set(pkg, { imported: true, called: prev.called || called2 });
   };
   const nsRe = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
   const namedRe = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
@@ -2042,6 +2170,29 @@ function shortestDependencyPath(target, starts, edges) {
   }
   return void 0;
 }
+function collectDependencyPaths(target, starts, edges, limit = 8) {
+  const out = [];
+  const queue = [];
+  let steps = 0;
+  for (const start of starts) queue.push([start]);
+  while (queue.length > 0 && out.length < limit && steps < 4e3) {
+    steps += 1;
+    const path = queue.shift();
+    if (path === void 0) continue;
+    const last = path[path.length - 1];
+    if (last === void 0) continue;
+    if (last === target) {
+      if (path.length >= 2) out.push(path);
+      continue;
+    }
+    if (path.length >= 12) continue;
+    for (const next of edges.get(last) ?? []) {
+      if (path.includes(next)) continue;
+      queue.push([...path, next]);
+    }
+  }
+  return out;
+}
 function reachableFrom(target, roots, edges) {
   if (roots.has(target)) return true;
   return shortestDependencyPath(target, roots, edges) !== void 0;
@@ -2062,9 +2213,10 @@ function classifyReachability(pkgName, productionUsage, graph) {
   }
   if (graph !== void 0 && graph.edgesKnown) {
     const roots = importedDirectNames(productionUsage, graph);
-    const path = shortestDependencyPath(pkgName, roots, graph.edges);
+    const paths = collectDependencyPaths(pkgName, roots, graph.edges);
+    const path = paths[0];
     if (path !== void 0 && path.length >= 2) {
-      return { reachability: "reachable-via-dependency", path };
+      return { reachability: "reachable-via-dependency", path, paths };
     }
     return { reachability: "not-imported" };
   }
@@ -2074,10 +2226,10 @@ function classifyReachability(pkgName, productionUsage, graph) {
   return { reachability: "not-imported" };
 }
 function reachabilitySteps(reachability) {
-  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown") {
+  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
   }
-  if (reachability === "imported-not-called") return 1;
+  if (reachability === "imported-not-called" || reachability === "symbol-not-called") return 1;
   return 2;
 }
 function downgradeSeverity(severity, steps) {
@@ -2094,8 +2246,108 @@ function isDevOnly(pkgName, ctx) {
   if (inProd) return false;
   return directDev.has(pkgName) || reachableFrom(pkgName, directDev, edges);
 }
-function applyReachability(findings, ctx) {
-  return findings.map((finding3) => {
+var REACH_RANK = {
+  reachable: 0,
+  "symbol-reachable": 1,
+  "reachable-via-dependency": 2,
+  "imported-not-called": 3,
+  "symbol-not-called": 4,
+  "reachability-unknown": 5,
+  "not-imported": 6
+};
+function versionFromSnippet(snippet) {
+  const name = packageNameFromSnippet(snippet);
+  if (name === void 0) return snippet;
+  return snippet.slice(name.length + 1);
+}
+function pathFields(classified) {
+  const paths = classified.paths ?? (classified.path !== void 0 ? [classified.path] : []);
+  if (paths.length === 0) return {};
+  return {
+    dependencyPath: paths[0],
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
+function appendOtherPaths(message, paths) {
+  if (paths === void 0 || paths.length < 2) return message;
+  const rest = paths.slice(1).map((p) => p.join(" > ")).join("; ");
+  return `${message} Other paths: ${rest}.`;
+}
+function groupPackageAdvisories(findings) {
+  const passthrough = [];
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding3 of findings) {
+    if (finding3.ruleId !== "DEPS-VULN-001" && finding3.ruleId !== "DEPS-MALICIOUS-001") {
+      passthrough.push(finding3);
+      continue;
+    }
+    const name = packageNameFromSnippet(finding3.snippet ?? "") ?? finding3.snippet ?? finding3.id;
+    const advisory = finding3.references?.[0] ?? finding3.id;
+    const key = `${finding3.ruleId}\0${name}\0${advisory}`;
+    const list = groups.get(key);
+    if (list === void 0) groups.set(key, [finding3]);
+    else list.push(finding3);
+  }
+  const merged = [];
+  for (const list of groups.values()) {
+    const only = list[0];
+    if (list.length === 1 && only !== void 0) {
+      merged.push(only);
+      continue;
+    }
+    merged.push(mergeAdvisory(list));
+  }
+  return [...passthrough, ...merged];
+}
+function mergeAdvisory(list) {
+  const ranked = [...list].sort(
+    (a, b) => severityRank(b.severity) - severityRank(a.severity) || (REACH_RANK[a.reachability ?? "not-imported"] ?? 9) - (REACH_RANK[b.reachability ?? "not-imported"] ?? 9)
+  );
+  const primary = ranked[0];
+  if (primary === void 0) {
+    throw new Error("empty advisory group");
+  }
+  const name = packageNameFromSnippet(primary.snippet ?? "") ?? "package";
+  const versions = [...new Set(list.map((f) => versionFromSnippet(f.snippet ?? "")))].filter((v) => v.length > 0).sort();
+  const paths = [];
+  const seenPath = /* @__PURE__ */ new Set();
+  for (const finding3 of list) {
+    const candidates = finding3.dependencyPaths ?? (finding3.dependencyPath !== void 0 ? [finding3.dependencyPath] : []);
+    for (const path of candidates) {
+      const key = path.join("\0");
+      if (seenPath.has(key)) continue;
+      seenPath.add(key);
+      paths.push(path);
+    }
+  }
+  paths.sort((a, b) => a.length - b.length || a.join(">").localeCompare(b.join(">")));
+  const advisory = primary.references?.[0] ?? "";
+  const onManifest = list.find((f) => f.file === "package.json");
+  const file = onManifest?.file ?? primary.file;
+  const line = onManifest?.line ?? primary.line;
+  const snippet = versions.length > 0 ? `${name}@${versions.join(",")}` : primary.snippet ?? name;
+  let message = primary.message;
+  if (versions.length > 1) {
+    message = `${message} Versions: ${versions.join(", ")}.`;
+  }
+  if (paths.length > 1) {
+    message = `${message} Dependency paths: ${paths.map((p) => p.join(" > ")).join("; ")}.`;
+  }
+  return {
+    ...primary,
+    id: makeFindingId(primary.ruleId, file, `${name}|${advisory}|${versions.join(",")}`),
+    file,
+    line,
+    snippet,
+    message,
+    severity: primary.severity,
+    reachability: primary.reachability,
+    ...paths[0] !== void 0 ? { dependencyPath: paths[0] } : {},
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
+function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
+  const mapped = findings.map((finding3) => {
     if (finding3.ruleId === "DEPS-MALICIOUS-001") {
       if (finding3.snippet === void 0) return finding3;
       const pkg2 = packageNameFromSnippet(finding3.snippet);
@@ -2105,19 +2357,25 @@ function applyReachability(findings, ctx) {
         ...finding3,
         severity: "critical",
         reachability: classified2.reachability,
-        ...classified2.path !== void 0 ? { dependencyPath: classified2.path } : {}
+        ...pathFields(classified2)
       };
     }
     if (finding3.ruleId !== "DEPS-VULN-001" || finding3.snippet === void 0) return finding3;
     const pkg = packageNameFromSnippet(finding3.snippet);
     if (pkg === void 0 || pkg.length === 0) return finding3;
-    const classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    let classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    const named = symbols.get(finding3.id) ?? [];
+    if (named.length > 0 && ctx.sources !== void 0) {
+      const symbolClass = classifySymbolUse(named, ctx.sources);
+      classified = { reachability: symbolClass, path: classified.path, paths: classified.paths };
+    }
     const steps = reachabilitySteps(classified.reachability);
     let severity = steps === 0 ? finding3.severity : downgradeSeverity(finding3.severity, steps);
     let message = finding3.message;
     if (classified.path !== void 0) {
       const shown = classified.path.join(" > ");
       message = `${message} Reachable via ${shown}.`;
+      message = appendOtherPaths(message, classified.paths);
     }
     const devOnly = isDevOnly(pkg, ctx);
     if (devOnly) {
@@ -2127,11 +2385,12 @@ function applyReachability(findings, ctx) {
     return {
       ...finding3,
       reachability: classified.reachability,
-      ...classified.path !== void 0 ? { dependencyPath: classified.path } : {},
+      ...pathFields(classified),
       severity,
       message
     };
   });
+  return groupPackageAdvisories(mapped);
 }
 
 // src/modules/deps/semver.ts
@@ -4033,6 +4292,59 @@ function experimentalVex() {
   return process.env.FULLSHIELD_EXPERIMENTAL_VEX === "1";
 }
 
+// src/modules/deps/license.ts
+init_finding();
+var COPYLEFT = /(?:^|[^\w])(?:AGPL|GPL)(?:-|[^\w]|$)/i;
+function isCopyleftLicense(license) {
+  return COPYLEFT.test(license);
+}
+function licenseText(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && value !== null && "type" in value) {
+    const type = value.type;
+    if (typeof type === "string") return type;
+  }
+  return void 0;
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function scanCopyleftLicenses(cwd) {
+  const manifest = await readJson(join(cwd, "package.json"));
+  if (typeof manifest !== "object" || manifest === null) return [];
+  const names = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    const block = manifest[field];
+    if (typeof block === "object" && block !== null && !Array.isArray(block)) {
+      for (const name of Object.keys(block)) names.add(name);
+    }
+  }
+  const findings = [];
+  for (const name of names) {
+    const pkg = await readJson(join(cwd, "node_modules", name, "package.json"));
+    if (typeof pkg !== "object" || pkg === null) continue;
+    const license = licenseText(pkg.license);
+    if (license === void 0 || !isCopyleftLicense(license)) continue;
+    findings.push({
+      id: makeFindingId("DEPS-LICENSE-001", "package.json", `${name}|${license}`),
+      ruleId: "DEPS-LICENSE-001",
+      module: "deps",
+      title: `Copyleft dependency ${name}`,
+      severity: "medium",
+      confidence: "high",
+      file: "package.json",
+      snippet: `${name} ${license}`,
+      message: `${name} is licensed ${license}.`,
+      remediation: "Replace the dependency or get a legal review before shipping it in a commercial product."
+    });
+  }
+  return findings;
+}
+
 // src/fixer/eol.ts
 function detectEol(text) {
   return text.includes("\r\n") ? "\r\n" : "\n";
@@ -4147,7 +4459,7 @@ function walkJs(dir, out = []) {
   }
   return out;
 }
-function readJson(path) {
+function readJson2(path) {
   return JSON.parse(readFileSync(path, "utf8"));
 }
 var TOKEN_RE = /(?:~\/)?\.npmrc\b|\bNPM_TOKEN\b|\bGITHUB_TOKEN\b/;
@@ -4161,7 +4473,7 @@ function packageSources(dir) {
   let scripts = "";
   if (existsSync(manifestPath) && statSync(manifestPath).isFile()) {
     try {
-      const pkg = readJson(manifestPath);
+      const pkg = readJson2(manifestPath);
       const block = pkg.scripts ?? {};
       scripts = Object.values(block).join("\n");
     } catch {
@@ -4451,14 +4763,17 @@ var depsModule = {
         findings2.push(typosquatFinding("package.json", hit));
       }
       const osvHits2 = await queryOsv(pins, osvOpts);
+      const symbols2 = /* @__PURE__ */ new Map();
       for (const hit of osvHits2) {
         for (const vuln of hit.vulns) {
-          findings2.push(
-            isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name))
-          );
+          const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+          const names = affectedFunctionNames(vuln);
+          if (names.length > 0 && finding3.ruleId === "DEPS-VULN-001") symbols2.set(finding3.id, names);
+          findings2.push(finding3);
         }
       }
-      return applyReachability(findings2, await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest)));
+      const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
+      return applyReachability(findings2, noLockCtx, symbols2);
     }
     let contents;
     try {
@@ -4479,18 +4794,21 @@ var depsModule = {
       }
     }
     const osvHits = await queryOsv(packages, osvOpts);
+    const symbols = /* @__PURE__ */ new Map();
     for (const hit of osvHits) {
       for (const vuln of hit.vulns) {
-        findings.push(
-          isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name))
-        );
+        const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+        const names = affectedFunctionNames(vuln);
+        if (names.length > 0 && finding3.ruleId === "DEPS-VULN-001") symbols.set(finding3.id, names);
+        findings.push(finding3);
       }
     }
-    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph));
+    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
     if (experimentalVex()) {
       reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
       reached.push(...scanInstalledPackages(ctx.cwd, packages));
     }
+    if (licenseEnabled()) reached.push(...await scanCopyleftLicenses(ctx.cwd));
     return reached;
   }
 };
@@ -4520,7 +4838,7 @@ async function reachabilityCtx(cwd, files, graph) {
     } catch {
     }
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph };
+  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
 }
 
 // src/modules/mcp/index.ts
@@ -5081,6 +5399,26 @@ function isXssSanitizerCall(node) {
   return false;
 }
 var NO_RETURNERS = /* @__PURE__ */ new Set();
+var CALLBACK_METHODS = /* @__PURE__ */ new Set([
+  "then",
+  "catch",
+  "finally",
+  "map",
+  "forEach",
+  "filter",
+  "flatMap",
+  "find",
+  "reduce"
+]);
+var taintedThisFields = /* @__PURE__ */ new WeakMap();
+function enclosingClass(node) {
+  let current = node.parent;
+  while (current !== void 0) {
+    if (current.type === "ClassDeclaration" || current.type === "ClassExpression") return current;
+    current = current.parent;
+  }
+  return void 0;
+}
 function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
   if (node === void 0) return false;
   if (isTaintSource(node) || isFrameworkMemberTaint(node) || isFrameworkTaintCall(node) || isMcpArgsTaintSource(node)) {
@@ -5092,8 +5430,34 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
     case "Identifier":
       return tainted.has(node.name);
     case "MemberExpression":
+      if (taintV2Enabled() && node.object.type === "ThisExpression") {
+        const cls = enclosingClass(node);
+        const name = propName(node);
+        if (cls !== void 0 && name !== void 0 && taintedThisFields.get(cls)?.has(name) === true) {
+          return true;
+        }
+      }
       return exprIsTainted(node.object, tainted, returners);
+    case "ArrayExpression":
+      if (!taintV2Enabled()) return false;
+      return node.elements.some((el) => {
+        if (el === null) return false;
+        if (el.type === "SpreadElement") return exprIsTainted(el.argument, tainted, returners);
+        return exprIsTainted(el, tainted, returners);
+      });
+    case "ObjectExpression":
+      if (!taintV2Enabled()) return false;
+      return node.properties.some((prop) => {
+        if (prop.type === "SpreadElement") return exprIsTainted(prop.argument, tainted, returners);
+        if (prop.type !== "Property") return false;
+        return exprIsTainted(prop.value, tainted, returners);
+      });
     case "CallExpression":
+      if (taintV2Enabled() && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+        return node.arguments.some(
+          (arg) => arg.type !== "SpreadElement" && exprIsTainted(arg, tainted, returners)
+        );
+      }
       if (isSchemaValidatorCall(node)) return false;
       if (node.callee.type === "Identifier" && returners.has(node.callee.name)) return true;
       if (node.callee.type === "MemberExpression" && exprIsTainted(node.callee.object, tainted, returners)) {
@@ -5324,7 +5688,66 @@ function scopeReturnsTaint(scope, tainted, returners) {
   return yes;
 }
 var MAX_TAINT_HOPS = 5;
-function analyzeFile(ast, extraReturners = NO_RETURNERS) {
+function seedTaintV2(functions, facts, seeds, returners, nameToFn) {
+  let changed = false;
+  const mark = (fn, name) => {
+    if (name === void 0) return;
+    const set = seeds.get(fn) ?? /* @__PURE__ */ new Set();
+    if (set.has(name)) return;
+    set.add(name);
+    seeds.set(fn, set);
+    changed = true;
+  };
+  for (const fn of functions) {
+    const f = facts.get(fn);
+    if (f === void 0) continue;
+    let parent = fn.parent;
+    while (parent !== void 0 && !isFunctionNode(parent)) {
+      parent = parent.parent;
+    }
+    if (parent !== void 0 && isFunctionNode(parent)) {
+      const outer = facts.get(parent);
+      if (outer !== void 0) {
+        for (const name of outer.tainted) mark(fn, name);
+      }
+    }
+    walkScope(fn, (node) => {
+      if (node.type === "AssignmentExpression" && node.left.type === "MemberExpression") {
+        if (node.left.object.type === "ThisExpression" && exprIsTainted(node.right, f.tainted, returners)) {
+          const cls = enclosingClass(node);
+          const field = propName(node.left);
+          if (cls !== void 0 && field !== void 0) {
+            const fields = taintedThisFields.get(cls) ?? /* @__PURE__ */ new Set();
+            if (!fields.has(field)) {
+              fields.add(field);
+              taintedThisFields.set(cls, fields);
+              changed = true;
+            }
+          }
+        }
+      }
+      if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
+      const method = propName(node.callee);
+      if (method === void 0) return;
+      if (CALLBACK_METHODS.has(method) && exprIsTainted(node.callee.object, f.tainted, returners)) {
+        const callback = node.arguments[0];
+        if (callback !== void 0 && isFunctionNode(callback)) {
+          mark(callback, boundNames(callback.params[0])[0]);
+        }
+      }
+      if ((method === "call" || method === "apply") && node.callee.object.type === "Identifier") {
+        const target = nameToFn.get(node.callee.object.name);
+        if (target === void 0 || !isFunctionNode(target)) return;
+        const arg = node.arguments[1];
+        if (arg !== void 0 && arg.type !== "SpreadElement" && exprIsTainted(arg, f.tainted, returners)) {
+          mark(target, boundNames(target.params[0])[0]);
+        }
+      }
+    });
+  }
+  return changed;
+}
+function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   attachParents(ast);
   const facts = /* @__PURE__ */ new WeakMap();
   const functions = [];
@@ -5338,7 +5761,7 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   }
   const seeds = /* @__PURE__ */ new Map();
   for (const fn of functions) seeds.set(fn, /* @__PURE__ */ new Set());
-  const returners = new Set(extraReturners);
+  const returners = new Set(extraReturners2);
   for (let hop = 0; hop < MAX_TAINT_HOPS; hop += 1) {
     let changed = false;
     facts.set(ast, analyzeScope(ast, [], returners));
@@ -5378,6 +5801,9 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
         });
       });
     }
+    if (taintV2Enabled() && seedTaintV2(functions, facts, seeds, returners, nameToFn)) {
+      changed = true;
+    }
     if (!changed) break;
   }
   return facts;
@@ -5520,6 +5946,21 @@ function requireCall(node) {
   }
   return void 0;
 }
+function reexportsOf(ast) {
+  const out = /* @__PURE__ */ new Map();
+  walk(ast, (node) => {
+    if (node.type !== "ExportNamedDeclaration" || node.source === null || node.source === void 0) return;
+    const spec = literalString(node.source);
+    if (spec === void 0) return;
+    for (const specNode of node.specifiers) {
+      if (specNode.type !== "ExportSpecifier") continue;
+      const exported = specNode.exported.type === "Identifier" ? specNode.exported.name : void 0;
+      const local = specNode.local.type === "Identifier" ? specNode.local.name : exported;
+      if (exported !== void 0 && local !== void 0) out.set(exported, { spec, name: local });
+    }
+  });
+  return out;
+}
 function resolveRelative(fromFile, spec, files) {
   if (!spec.startsWith(".")) return void 0;
   const base = posix.normalize(posix.join(posix.dirname(fromFile), spec));
@@ -5597,6 +6038,22 @@ function runInterproc(parsed) {
       functions.set(`${fn.file}#${fn.name}`, fn);
     }
   }
+  if (taintV2Enabled()) {
+    const barrels = /* @__PURE__ */ new Map();
+    for (const p of parsed) barrels.set(p.file, reexportsOf(p.ast));
+    for (const ns of requires.values()) {
+      for (const [local, target] of ns) {
+        const hash = target.indexOf("#");
+        if (hash < 0) continue;
+        const file = target.slice(0, hash);
+        const name = target.slice(hash + 1);
+        const re = barrels.get(file)?.get(name);
+        if (re === void 0) continue;
+        const resolved = resolveRelative(file, re.spec, files);
+        if (resolved !== void 0) ns.set(local, `${resolved}#${re.name}`);
+      }
+    }
+  }
   const queue = [];
   for (const p of parsed) {
     const facts = analyzeFile(p.ast);
@@ -6112,7 +6569,10 @@ function isMongoReceiver(node, source) {
   const obj = node.callee.object;
   if (obj.type === "Identifier") {
     if (isCollectionName(obj.name)) return true;
-    if (isPascalModel(obj.name)) return !fileHasSqlOrm;
+    if (isPascalModel(obj.name)) {
+      if (/extends\s+BaseEntity\b/.test(source)) return false;
+      return !fileHasSqlOrm;
+    }
     return fileHasMongo;
   }
   if (obj.type === "MemberExpression") {
@@ -7174,6 +7634,136 @@ function scanPromptInjection(file, source) {
   return findings;
 }
 
+// src/runtime/lru.ts
+var LruMap = class {
+  constructor(max) {
+    this.max = max;
+    if (max < 1) throw new Error("LruMap max must be >= 1");
+  }
+  max;
+  map = /* @__PURE__ */ new Map();
+  get size() {
+    return this.map.size;
+  }
+  has(key) {
+    return this.map.has(key);
+  }
+  get(key) {
+    if (!this.map.has(key)) return void 0;
+    const value = this.map.get(key);
+    this.map.delete(key);
+    this.map.set(key, value);
+    return value;
+  }
+  set(key, value) {
+    if (this.map.has(key)) this.map.delete(key);
+    this.map.set(key, value);
+    while (this.map.size > this.max) {
+      const oldest = this.map.keys().next().value;
+      if (oldest === void 0) break;
+      this.map.delete(oldest);
+    }
+    return this;
+  }
+};
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+
+// src/core/parse-pool.ts
+var workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+var cache = new LruMap(64);
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
+  }
+  return Math.min(2, Math.max(1, availableParallelism() - 1));
+}
+function workerMemoryMb() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
+  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
+  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
+  return 512;
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit = cache.get(key);
+  if (hit !== void 0) return Promise.resolve(hit);
+  return new Promise((resolve5, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), {
+      workerData: { code },
+      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
+    });
+    let settled = false;
+    const finish = () => {
+      void worker.terminate();
+    };
+    const succeed = (ast) => {
+      if (settled) return;
+      settled = true;
+      cache.set(key, ast);
+      finish();
+      resolve5(ast);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      finish();
+      reject(error);
+    };
+    worker.once("message", (ast) => {
+      succeed(ast);
+    });
+    worker.once("error", (error) => {
+      fail(error);
+    });
+    worker.once("exit", (code2) => {
+      if (settled) return;
+      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
+    });
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
+
 // src/modules/sast/engine.ts
 var sastRules = [
   sqliRule,
@@ -7206,8 +7796,8 @@ function snippetOf(source, node) {
   if (node.range === void 0) return "";
   return source.slice(node.range[0], node.range[1]).replace(/\s+/g, " ").trim().slice(0, 120);
 }
-function findingsFromAst(filename, source, ast, extraReturners = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
-  const facts = analyzeFile(ast, extraReturners);
+function findingsFromAst(filename, source, ast, extraReturners2 = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
+  const facts = analyzeFile(ast, extraReturners2);
   const findings = [];
   for (const rule of sastRules) {
     const ctx = {
@@ -7285,51 +7875,203 @@ function findingsFromTemplate(filename, source) {
   xssRule.create(ctx);
   return findings;
 }
+function dedupeSastSinks(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const finding3 of findings) {
+    if (finding3.module !== "sast" || finding3.line === void 0) {
+      out.push(finding3);
+      continue;
+    }
+    const key = `${finding3.ruleId}\0${finding3.file ?? ""}\0${finding3.line}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(finding3);
+  }
+  return out;
+}
+function sastStreamThreshold() {
+  const raw = process.env.FULLSHIELD_SAST_STREAM_AT;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 4e3;
+}
+function sastBatchSize() {
+  const raw = process.env.FULLSHIELD_SAST_BATCH;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 150;
+}
+function skipFinding(rel, message) {
+  return {
+    id: makeFindingId("SAST-SKIP-001", rel, message),
+    ruleId: "SAST-SKIP-001",
+    module: "sast",
+    title: "File skipped by SAST",
+    severity: "info",
+    confidence: "high",
+    file: rel,
+    message,
+    remediation: "Raise sast.maxFileBytes in fullshield.config.json to parse this file, or leave it skipped."
+  };
+}
+function skipReason(source, maxBytes) {
+  if (source.includes("\0")) return "it contains NUL bytes";
+  const bytes = Buffer.byteLength(source);
+  if (bytes > maxBytes) return `${bytes} bytes exceeds the SAST parse limit of ${maxBytes} bytes`;
+  return void 0;
+}
+async function readScanSource(cwd, rel) {
+  try {
+    return await readFile(join(cwd, rel), "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function cloneAst(value) {
+  if (value === null || typeof value !== "object") return void 0;
+  try {
+    return structuredClone(value);
+  } catch {
+    return void 0;
+  }
+}
+async function parseInProcess(source) {
+  try {
+    return await parseSource(source);
+  } catch {
+    return void 0;
+  }
+}
+async function parseCode(source) {
+  if (!parsePoolEnabled()) return parseInProcess(source);
+  try {
+    const cloned = cloneAst((await parseWithPool([source]))[0]);
+    if (cloned !== void 0) return cloned;
+  } catch {
+  }
+  return parseInProcess(source);
+}
+function releaseParsed(parsed) {
+  for (const entry of parsed) {
+    entry.source = "";
+    entry.ast = void 0;
+  }
+  parsed.length = 0;
+}
+function extraReturners(rel, ast, files, returning) {
+  const ns = collectRequires(rel, ast, files);
+  const extra = new Set(returning.get(rel));
+  for (const [local, spec] of ns) {
+    const hash = spec.indexOf("#");
+    const file = hash >= 0 ? spec.slice(0, hash) : spec;
+    const exp = hash >= 0 ? spec.slice(hash + 1) : local;
+    if (returning.get(file)?.has(exp)) extra.add(local);
+  }
+  return extra;
+}
+async function runSastStreaming(ctx) {
+  const maxBytes = ctx.config.sast.maxFileBytes;
+  const findings = [];
+  const returning = /* @__PURE__ */ new Map();
+  const parseable = [];
+  const fileSet = /* @__PURE__ */ new Set();
+  let projectCsrf = false;
+  for (const rel of ctx.files) {
+    const isSource = SOURCE_EXT.test(rel);
+    const isTemplate = TEMPLATE_EXT.test(rel);
+    if (!isSource && !isTemplate) continue;
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const why = skipReason(source, maxBytes);
+    if (why !== void 0) {
+      findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+      continue;
+    }
+    if (sourceHasCsrfGuard(source)) projectCsrf = true;
+    if (isTemplate) {
+      findings.push(...findingsFromTemplate(rel, source));
+      continue;
+    }
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    returning.set(rel, functionsThatReturnTaint(ast));
+    parseable.push(rel);
+    fileSet.add(rel);
+  }
+  for (const rel of parseable) {
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    findings.push(
+      ...findingsFromAst(rel, source, ast, extraReturners(rel, ast, fileSet, returning), projectCsrf)
+    );
+  }
+  const batch = sastBatchSize();
+  for (let i = 0; i < parseable.length; i += batch) {
+    const parsed = [];
+    for (const rel of parseable.slice(i, i + batch)) {
+      const source = await readScanSource(ctx.cwd, rel);
+      if (source === void 0) continue;
+      const ast = await parseCode(source);
+      if (ast === void 0) continue;
+      parsed.push({ file: rel, source, ast });
+    }
+    findings.push(...runInterproc(parsed));
+    releaseParsed(parsed);
+  }
+  return dedupeSastSinks(findings);
+}
 var sastModule = {
   name: "sast",
   async run(ctx) {
+    const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
+    if (candidates.length > sastStreamThreshold()) return runSastStreaming(ctx);
+    const maxBytes = ctx.config.sast.maxFileBytes;
     const findings = [];
     const parsed = [];
-    for (const rel of ctx.files) {
-      const isSource = SOURCE_EXT.test(rel);
-      const isTemplate = TEMPLATE_EXT.test(rel);
-      if (!isSource && !isTemplate) continue;
-      let source;
-      try {
-        source = await readFile(join(ctx.cwd, rel), "utf8");
-      } catch {
+    for (const rel of candidates) {
+      const source = await readScanSource(ctx.cwd, rel);
+      if (source === void 0) continue;
+      const why = skipReason(source, maxBytes);
+      if (why !== void 0) {
+        findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
         continue;
       }
-      if (source.length > 1024 * 1024 || source.includes("\0")) continue;
-      if (isTemplate) {
+      if (TEMPLATE_EXT.test(rel)) {
         findings.push(...findingsFromTemplate(rel, source));
         continue;
       }
-      try {
-        const ast = await parseSource(source);
-        parsed.push({ file: rel, source, ast });
-      } catch {
-      }
+      const ast = await parseCode(source);
+      if (ast === void 0) continue;
+      parsed.push({ file: rel, source, ast });
     }
     const files = new Set(parsed.map((p) => p.file));
     const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
     const returning = /* @__PURE__ */ new Map();
-    for (const p of parsed) {
-      returning.set(p.file, functionsThatReturnTaint(p.ast));
+    for (const entry of parsed) {
+      returning.set(entry.file, functionsThatReturnTaint(entry.ast));
     }
-    for (const p of parsed) {
-      const ns = collectRequires(p.file, p.ast, files);
-      const extra = new Set(returning.get(p.file));
-      for (const [local, spec] of ns) {
-        const hash = spec.indexOf("#");
-        const file = hash >= 0 ? spec.slice(0, hash) : spec;
-        const exp = hash >= 0 ? spec.slice(hash + 1) : local;
-        if (returning.get(file)?.has(exp)) extra.add(local);
-      }
-      findings.push(...findingsFromAst(p.file, p.source, p.ast, extra, projectCsrf));
+    for (const entry of parsed) {
+      findings.push(
+        ...findingsFromAst(
+          entry.file,
+          entry.source,
+          entry.ast,
+          extraReturners(entry.file, entry.ast, files, returning),
+          projectCsrf
+        )
+      );
     }
     findings.push(...runInterproc(parsed));
-    return findings;
+    const out = dedupeSastSinks(findings);
+    releaseParsed(parsed);
+    return out;
   }
 };
 
@@ -7701,7 +8443,7 @@ function createAiClient(options) {
   const useFixtures = options.useFixtures ?? !isLiveAi();
   const model = options.model ?? process.env.FULLSHIELD_AI_MODEL ?? (useFixtures ? "recorded-fixture" : "qwen2.5-coder:7b");
   const provider = options.provider ?? process.env.FULLSHIELD_AI_PROVIDER ?? (useFixtures ? "fixture" : "ollama");
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   let spentUsd = 0;
   let networkCalls = 0;
   const liveCost = provider === "ollama" ? 0 : FIXTURE_COST;
@@ -7721,7 +8463,7 @@ function createAiClient(options) {
       const redactedPrompt = `${modeInstruction(req.mode)}
 ${wrapUntrustedCode(req.prompt)}`;
       const key = cacheKey(req.model ?? model, redactedPrompt);
-      const cached = cache.get(key);
+      const cached = cache2.get(key);
       if (cached !== void 0) {
         return { ...cached, cached: true, costUsd: 0 };
       }
@@ -7735,7 +8477,7 @@ ${wrapUntrustedCode(req.prompt)}`;
           cached: false,
           redactedPrompt
         };
-        cache.set(key, response2);
+        cache2.set(key, response2);
         return response2;
       }
       const fetchImpl = options.fetchImpl ?? fetch;
@@ -7785,21 +8527,42 @@ ${wrapUntrustedCode(req.prompt)}`;
         cached: false,
         redactedPrompt
       };
-      cache.set(key, response);
+      cache2.set(key, response);
       return response;
     }
   };
 }
+function isIsoDate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}(T[\d:.+\-Z]+)?$/.test(value)) return false;
+  return Number.isFinite(Date.parse(value));
+}
+function expiresAtMs(expires) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) return Date.parse(`${expires}T23:59:59.999Z`);
+  return Date.parse(expires);
+}
+function validSuppression(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const row = value;
+  if (typeof row.ruleId !== "string" || row.ruleId.length === 0) return void 0;
+  if (typeof row.owner !== "string" || row.owner.length === 0) return void 0;
+  if (typeof row.reason !== "string" || row.reason.length === 0) return void 0;
+  if (typeof row.expires !== "string" || !isIsoDate(row.expires)) return void 0;
+  const file = row.file === void 0 ? void 0 : row.file.replace(/\\/g, "/");
+  if (row.file !== void 0 && (typeof row.file !== "string" || row.file.length === 0)) return void 0;
+  return { ruleId: row.ruleId, file, owner: row.owner, reason: row.reason, expires: row.expires };
+}
 async function readBaseline(path) {
   try {
     const raw = JSON.parse(await readFile(path, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.findings)) return void 0;
+    if (raw.suppressions !== void 0 && !Array.isArray(raw.suppressions)) return void 0;
     return raw;
   } catch {
     return void 0;
   }
 }
 async function writeBaseline(path, findings) {
+  const existing = await readBaseline(path);
   const doc = {
     version: 1,
     findings: findings.map((f) => ({
@@ -7807,7 +8570,8 @@ async function writeBaseline(path, findings) {
       ruleId: f.ruleId,
       file: f.file,
       line: f.line
-    }))
+    })),
+    ...existing?.suppressions !== void 0 ? { suppressions: existing.suppressions } : {}
   };
   await writeFile(path, `${JSON.stringify(doc, null, 2)}
 `, "utf8");
@@ -7817,6 +8581,30 @@ function applyBaseline(findings, baseline) {
   const known = new Set(baseline.findings.map((f) => f.id));
   return findings.filter((f) => !known.has(f.id));
 }
+function applySuppressions(findings, rows, now = /* @__PURE__ */ new Date()) {
+  if (rows === void 0 || rows.length === 0) return { findings: [...findings], errors: [] };
+  const errors = [];
+  const active = [];
+  rows.forEach((row, index) => {
+    const parsed = validSuppression(row);
+    if (parsed === void 0) {
+      errors.push(`suppression ${index + 1} needs ruleId, owner, reason, and an ISO expires date`);
+      return;
+    }
+    if (expiresAtMs(parsed.expires) < now.getTime()) {
+      errors.push(
+        `suppression for ${parsed.ruleId} expired on ${parsed.expires} (owner: ${parsed.owner}); renew or remove it`
+      );
+      return;
+    }
+    active.push(parsed);
+  });
+  const kept = findings.filter((finding3) => {
+    const file = (finding3.file ?? "").replace(/\\/g, "/");
+    return !active.some((row) => row.ruleId === finding3.ruleId && (row.file === void 0 || row.file === file));
+  });
+  return { findings: kept, errors };
+}
 
 // src/core/config.ts
 init_finding();
@@ -7825,14 +8613,27 @@ var DEFAULT_CONFIG = {
   modules: [...MODULE_NAMES],
   failOn: "high",
   ignore: ["dist/**", "**/*.test.ts"],
+  defaultExcludes: true,
   baseline: ".fullshield-baseline.json",
   notify: { slackWebhookEnv: "FULLSHIELD_SLACK_WEBHOOK" },
   deps: { offline: false },
-  ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 }
+  ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 },
+  sast: { maxFileBytes: 1024 * 1024 }
 };
 var ConfigError = class extends Error {
 };
-var KNOWN_KEYS = /* @__PURE__ */ new Set(["modules", "failOn", "ignore", "baseline", "notify", "deps", "ai"]);
+var KNOWN_KEYS = /* @__PURE__ */ new Set([
+  "modules",
+  "failOn",
+  "ignore",
+  "defaultExcludes",
+  "excludes",
+  "baseline",
+  "notify",
+  "deps",
+  "ai",
+  "sast"
+]);
 function validate(raw, source) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new ConfigError(`${source}: config must be a JSON object`);
@@ -7934,6 +8735,32 @@ function validate(raw, source) {
     }
     out.ai = ai;
   }
+  if (record.defaultExcludes !== void 0) {
+    if (typeof record.defaultExcludes !== "boolean") {
+      throw new ConfigError(`${source}: "defaultExcludes" must be a boolean`);
+    }
+    out.defaultExcludes = record.defaultExcludes;
+  }
+  if (record.excludes !== void 0) {
+    if (!Array.isArray(record.excludes) || record.excludes.some((p) => typeof p !== "string")) {
+      throw new ConfigError(`${source}: "excludes" must be an array of glob strings`);
+    }
+    out.excludes = record.excludes;
+  }
+  if (record.sast !== void 0) {
+    if (typeof record.sast !== "object" || record.sast === null || Array.isArray(record.sast)) {
+      throw new ConfigError(`${source}: "sast" must be an object`);
+    }
+    const rawSast = record.sast;
+    const sast = { maxFileBytes: 1024 * 1024 };
+    if (rawSast.maxFileBytes !== void 0) {
+      if (typeof rawSast.maxFileBytes !== "number" || rawSast.maxFileBytes < 1) {
+        throw new ConfigError(`${source}: "sast.maxFileBytes" must be a positive number`);
+      }
+      sast.maxFileBytes = rawSast.maxFileBytes;
+    }
+    out.sast = sast;
+  }
   return out;
 }
 async function loadConfig(cwd, configPath) {
@@ -7960,10 +8787,26 @@ async function loadConfig(cwd, configPath) {
   return { ...structuredClone(DEFAULT_CONFIG), ...validate(raw, file) };
 }
 var ignoreFactory = ignoreModule.default;
-var ALWAYS_IGNORED = [".git/", "node_modules/", ".fullshield/"];
+var HARD_IGNORED = [".git/", ".fullshield/"];
+var DEFAULT_EXCLUDES = [
+  "node_modules/",
+  "dist/",
+  "build/",
+  ".next/",
+  "coverage/",
+  "vendor/",
+  "vendored/",
+  "third_party/",
+  "third-party/",
+  "compiled/",
+  "*.min.js"
+];
 async function walkFiles(options) {
   const ig = ignoreFactory();
-  ig.add(ALWAYS_IGNORED);
+  ig.add(HARD_IGNORED);
+  if (options.defaultExcludes !== false) {
+    ig.add(options.excludes ?? DEFAULT_EXCLUDES);
+  }
   try {
     ig.add(await readFile(join(options.cwd, ".gitignore"), "utf8"));
   } catch {
@@ -8012,23 +8855,6 @@ async function listStagedFiles(cwd) {
 // src/core/engine.ts
 init_suppression();
 init_finding();
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
 
 // src/policy/index.ts
 init_finding();
@@ -8198,7 +9024,7 @@ function resolvePolicyBranch(cwd, env = process.env) {
     return "*";
   }
 }
-function expiresAtMs(expires) {
+function expiresAtMs2(expires) {
   if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) {
     return Date.parse(`${expires}T23:59:59.999Z`);
   }
@@ -8220,7 +9046,7 @@ function applyPolicy(findings, policy, ctx = {}) {
   });
   const suppressed = /* @__PURE__ */ new Set();
   for (const exception of policy.exceptions ?? []) {
-    if (expiresAtMs(exception.expires) < now.getTime()) {
+    if (expiresAtMs2(exception.expires) < now.getTime()) {
       errors.push(
         `policy exception for ${exception.ruleId} expired on ${exception.expires} (owner: ${exception.owner}); renew or remove it`
       );
@@ -8289,7 +9115,12 @@ async function runScan(options = {}, modules = builtinModules) {
     options.modules ?? config.modules,
     loadedPolicy?.requiredModules
   );
-  let files = await walkFiles({ cwd, ignore: config.ignore });
+  let files = await walkFiles({
+    cwd,
+    ignore: config.ignore,
+    defaultExcludes: config.defaultExcludes,
+    excludes: config.excludes
+  });
   if (options.staged === true) {
     const staged = new Set(await listStagedFiles(cwd));
     files = files.filter((file) => staged.has(file));
@@ -8323,6 +9154,7 @@ async function runScan(options = {}, modules = builtinModules) {
     );
   }
   const extraHits = [];
+  let historyNotice;
   const secretsWanted = modulesRequested.includes("secrets");
   if (secretsAdvEnabled() && secretsWanted) {
     if (options.history === true) {
@@ -8330,6 +9162,7 @@ async function runScan(options = {}, modules = builtinModules) {
       const hist = await scanGitHistory2(cwd);
       extraHits.push(...hist.hits);
       collected.push(...hist.findings);
+      historyNotice = hist.history;
     }
     if (options.bundle !== void 0 && options.bundle.length > 0) {
       const { scanBundle: scanBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
@@ -8350,7 +9183,11 @@ async function runScan(options = {}, modules = builtinModules) {
   if (options.updateBaseline === true) {
     await writeBaseline(baselinePath, unsuppressed);
   }
-  let findings = sortFindings(applyBaseline(unsuppressed, await readBaseline(baselinePath)));
+  const baselineDoc = await readBaseline(baselinePath);
+  let findings = sortFindings(applyBaseline(unsuppressed, baselineDoc));
+  const suppressed = applySuppressions(findings, baselineDoc?.suppressions);
+  findings = sortFindings(suppressed.findings);
+  const suppressionErrors = suppressed.errors;
   if (secretsAdvEnabled() && secretsWanted && options.verifySecrets === true && options.iOwnTheseCredentials === true) {
     const { applyVerification: applyVerification2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
     const { scanTextForSecretHits: scanTextForSecretHits2 } = await Promise.resolve().then(() => (init_secrets(), secrets_exports));
@@ -8422,10 +9259,12 @@ async function runScan(options = {}, modules = builtinModules) {
       cwd,
       filesScanned: files.length,
       modulesRequested: [...modulesRequested],
-      modulesRun
+      modulesRun,
+      ...historyNotice !== void 0 ? { history: historyNotice } : {}
     },
     config,
-    policy: policyResult
+    policy: policyResult,
+    ...suppressionErrors.length > 0 ? { suppressionErrors } : {}
   };
 }
 function scan(options = {}) {
@@ -8761,6 +9600,27 @@ init_suppression();
 
 // src/reporters/console.ts
 init_finding();
+
+// src/reporters/redact.ts
+init_mask();
+var SECRET = /\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk_live_[A-Za-z0-9]{10,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
+function redactSecrets2(text) {
+  return text.replace(SECRET, (match) => maskSecret(match));
+}
+function redactFinding(finding3) {
+  return {
+    ...finding3,
+    title: redactSecrets2(finding3.title),
+    message: redactSecrets2(finding3.message),
+    remediation: redactSecrets2(finding3.remediation),
+    snippet: finding3.snippet === void 0 ? void 0 : redactSecrets2(finding3.snippet)
+  };
+}
+function redactScan(result) {
+  return { ...result, findings: result.findings.map(redactFinding) };
+}
+
+// src/reporters/console.ts
 var SEVERITY_COLOR = {
   critical: (t) => pc.bold(pc.red(t)),
   high: (t) => pc.red(t),
@@ -8800,7 +9660,8 @@ function renderFinding(finding3) {
   }
   return lines;
 }
-function renderConsoleReport(result) {
+function renderConsoleReport(input) {
+  const result = redactScan(input);
   const { findings, summary, metadata } = result;
   const lines = [];
   lines.push(
@@ -8808,6 +9669,7 @@ function renderConsoleReport(result) {
       ` \u2014 scanned ${metadata.filesScanned} files in ${metadata.durationMs}ms (modules: ${metadata.modulesRun.length > 0 ? metadata.modulesRun.join(", ") : "none"})`
     )
   );
+  if (metadata.history !== void 0) lines.push(metadata.history);
   if (metadata.modulesRun.length < metadata.modulesRequested.length) {
     const pending = metadata.modulesRequested.filter((m) => !metadata.modulesRun.includes(m));
     lines.push(
@@ -8815,15 +9677,23 @@ function renderConsoleReport(result) {
     );
   }
   const bySeverityDesc = [...SEVERITIES].reverse();
+  const ordered = bySeverityDesc.flatMap((severity) => findings.filter((f) => f.severity === severity));
+  const shown = ordered.slice(0, 10);
+  const hidden = ordered.length - shown.length;
   for (const severity of bySeverityDesc) {
-    const group = findings.filter((f) => f.severity === severity);
+    const group = shown.filter((f) => f.severity === severity);
     if (group.length === 0) continue;
     lines.push("");
-    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${group.length})`));
+    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${findings.filter((f) => f.severity === severity).length})`));
     for (const finding3 of group) {
       lines.push(...renderFinding(finding3));
+      lines.push(`    docs: rules/${finding3.ruleId}.md`);
     }
   }
+  if (hidden > 0) {
+    lines.push("");
+    lines.push(`${hidden} more \u2014 use --json`);
+  }
   lines.push("");
   if (summary.total === 0) {
     lines.push(pc.green("\u2714 No findings."));
@@ -8843,7 +9713,8 @@ function location2(finding3) {
   if (finding3.file === void 0) return "(project)";
   return finding3.line !== void 0 ? `${finding3.file}:${finding3.line}` : finding3.file;
 }
-function renderHtmlReport(result) {
+function renderHtmlReport(input) {
+  const result = redactScan(input);
   const sections = [];
   const bySeverityDesc = [...SEVERITIES].reverse();
   for (const severity of bySeverityDesc) {
@@ -8890,7 +9761,7 @@ ${items}`);
 
 // src/reporters/json.ts
 function publicFinding(finding3) {
-  const copy = { ...finding3 };
+  const copy = redactFinding(finding3);
   delete copy.aiVerdict;
   delete copy.exploitScenario;
   delete copy.aiReasoning;
@@ -8914,7 +9785,8 @@ function location3(finding3) {
   if (finding3.file === void 0) return "(project)";
   return finding3.line !== void 0 ? `${finding3.file}:${finding3.line}` : finding3.file;
 }
-function renderMarkdownReport(result) {
+function renderMarkdownReport(input) {
+  const result = redactScan(input);
   const lines = [
     "# FullShield report",
     "",
@@ -8966,7 +9838,8 @@ function sarifLevel(severity) {
 function uri(file) {
   return (file ?? "").replace(/\\/g, "/");
 }
-function renderSarifReport(result) {
+function renderSarifReport(input) {
+  const result = redactScan(input);
   const rules = /* @__PURE__ */ new Map();
   for (const finding3 of result.findings) {
     if (!rules.has(finding3.ruleId)) {
@@ -9073,6 +9946,257 @@ function validateSarif21(doc) {
   return errors;
 }
 
+// src/core/fingerprint.ts
+init_finding();
+function lineIndependentFingerprint(finding3) {
+  const file = (finding3.file ?? "").replace(/\\/g, "/");
+  const text = (finding3.snippet ?? finding3.message ?? "").replace(/\s+/g, " ").trim();
+  return makeFindingId(finding3.ruleId, file, `${finding3.severity}\0${text}`);
+}
+
+// src/reporters/ci.ts
+init_finding();
+var MESSAGE_CAP = 4e3;
+function posix2(file) {
+  return file.replace(/\\/g, "/");
+}
+function clip(text) {
+  return text.length <= MESSAGE_CAP ? text : `${text.slice(0, MESSAGE_CAP)}\u2026`;
+}
+function githubEscape(value, property) {
+  let out = value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A").replace(/:/g, "%3A");
+  if (property) out = out.replace(/,/g, "%2C");
+  return out;
+}
+function githubLevel(severity) {
+  if (severity === "critical" || severity === "high") return "error";
+  if (severity === "medium") return "warning";
+  return "notice";
+}
+function gitlabSeverity(severity) {
+  if (severity === "info") return "info";
+  if (severity === "low") return "minor";
+  if (severity === "medium") return "major";
+  if (severity === "high") return "critical";
+  return "blocker";
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function oneLine(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function renderGithubAnnotations(input) {
+  const result = redactScan(input);
+  if (result.findings.length === 0) {
+    return "::notice title=FullShield::No findings\n";
+  }
+  const lines = result.findings.map((finding3) => {
+    const props = [];
+    if (finding3.file !== void 0) props.push(`file=${githubEscape(posix2(finding3.file), true)}`);
+    if (finding3.line !== void 0) props.push(`line=${finding3.line}`);
+    if (finding3.column !== void 0) props.push(`col=${finding3.column + 1}`);
+    props.push(`title=${githubEscape(finding3.ruleId, true)}`);
+    const message = githubEscape(clip(finding3.message), false);
+    return `::${githubLevel(finding3.severity)} ${props.join(",")}::${message}`;
+  });
+  return `${lines.join("\n")}
+`;
+}
+function junitCase(finding3) {
+  const file = finding3.file !== void 0 ? posix2(finding3.file) : "fullshield";
+  const attrs = [
+    `name="${xmlEscape(finding3.ruleId)}"`,
+    `classname="${xmlEscape(file)}"`,
+    `file="${xmlEscape(file)}"`
+  ];
+  if (finding3.line !== void 0) attrs.push(`line="${finding3.line}"`);
+  const open = `<testcase ${attrs.join(" ")}>`;
+  if (!meetsThreshold(finding3.severity, "medium")) {
+    return `${open}<skipped message="${xmlEscape(oneLine(clip(finding3.message)))}"/></testcase>`;
+  }
+  const detail = clip(`${finding3.message}${finding3.remediation.length > 0 ? `
+Fix: ${finding3.remediation}` : ""}`);
+  return `${open}<failure type="${finding3.severity}" message="${xmlEscape(oneLine(clip(finding3.message)))}">${xmlEscape(detail)}</failure></testcase>`;
+}
+function renderJunitReport(input) {
+  const result = redactScan(input);
+  const header = '<?xml version="1.0" encoding="UTF-8"?>';
+  if (result.findings.length === 0) {
+    return `${header}
+<testsuites name="fullshield" tests="1" failures="0" skipped="0"><testsuite name="fullshield" tests="1" failures="0" skipped="0"><testcase name="scan" classname="fullshield"/></testsuite></testsuites>
+`;
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding3 of result.findings) {
+    const list = groups.get(finding3.module) ?? [];
+    list.push(finding3);
+    groups.set(finding3.module, list);
+  }
+  let failures = 0;
+  let skipped = 0;
+  const suites = [];
+  for (const [name, findings] of groups) {
+    let suiteFailures = 0;
+    let suiteSkipped = 0;
+    const cases = findings.map((finding3) => {
+      if (meetsThreshold(finding3.severity, "medium")) suiteFailures += 1;
+      else suiteSkipped += 1;
+      return junitCase(finding3);
+    });
+    failures += suiteFailures;
+    skipped += suiteSkipped;
+    suites.push(
+      `<testsuite name="${xmlEscape(name)}" tests="${findings.length}" failures="${suiteFailures}" skipped="${suiteSkipped}">${cases.join("")}</testsuite>`
+    );
+  }
+  return `${header}
+<testsuites name="fullshield" tests="${result.findings.length}" failures="${failures}" skipped="${skipped}">${suites.join("")}</testsuites>
+`;
+}
+function renderGitlabCodeQuality(input) {
+  const result = redactScan(input);
+  const report = result.findings.map((finding3) => {
+    const path = finding3.file !== void 0 ? posix2(finding3.file) : ".";
+    const location4 = { path };
+    if (finding3.line !== void 0) location4.lines = { begin: finding3.line };
+    return {
+      description: clip(finding3.message),
+      check_name: finding3.ruleId,
+      fingerprint: lineIndependentFingerprint(finding3),
+      severity: gitlabSeverity(finding3.severity),
+      location: location4
+    };
+  });
+  return `${JSON.stringify(report, null, 2)}
+`;
+}
+
+// src/diff/index.ts
+init_finding();
+function posix3(file) {
+  return (file ?? "").replace(/\\/g, "/");
+}
+function diffKey(finding3) {
+  return lineIndependentFingerprint(finding3);
+}
+function groupById(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding3 of findings) {
+    if (finding3.id === void 0 || finding3.id.length === 0) continue;
+    const list = groups.get(finding3.id) ?? [];
+    list.push(finding3);
+    groups.set(finding3.id, list);
+  }
+  return groups;
+}
+function pairMoves(removed, added) {
+  const removedIds = groupById(removed);
+  const addedIds = groupById(added);
+  const moved = [];
+  for (const [id, group] of removedIds) {
+    const match = addedIds.get(id);
+    if (group.length === 1 && match?.length === 1 && group[0] !== void 0 && match[0] !== void 0) {
+      moved.push({ before: group[0], after: match[0] });
+    }
+  }
+  return moved;
+}
+function byLocation(a, b) {
+  return (a.line ?? 0) - (b.line ?? 0) || a.id.localeCompare(b.id) || a.ruleId.localeCompare(b.ruleId);
+}
+function groupFindings(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding3 of findings) {
+    const key = diffKey(finding3);
+    const list = groups.get(key) ?? [];
+    list.push(finding3);
+    groups.set(key, list);
+  }
+  return groups;
+}
+function diffScans(before, after) {
+  const beforeGroups = groupFindings(before);
+  const afterGroups = groupFindings(after);
+  const unchanged = [];
+  const added = [];
+  const removed = [];
+  const moved = [];
+  const keys = [];
+  for (const key of beforeGroups.keys()) keys.push(key);
+  for (const key of afterGroups.keys()) {
+    if (!beforeGroups.has(key)) keys.push(key);
+  }
+  for (const key of keys) {
+    const left = [...beforeGroups.get(key) ?? []].sort(byLocation);
+    const right = [...afterGroups.get(key) ?? []].sort(byLocation);
+    const paired = Math.min(left.length, right.length);
+    for (let i = 0; i < paired; i += 1) {
+      const earlier = left[i];
+      const later = right[i];
+      if (earlier === void 0 || later === void 0) continue;
+      if ((earlier.line ?? 0) === (later.line ?? 0)) unchanged.push(later);
+      else moved.push({ before: earlier, after: later });
+    }
+    for (const finding3 of left.slice(paired)) removed.push(finding3);
+    for (const finding3 of right.slice(paired)) added.push(finding3);
+  }
+  const idMoves = pairMoves(removed, added);
+  const movedBefore = new Set(idMoves.map((item) => item.before));
+  const movedAfter = new Set(idMoves.map((item) => item.after));
+  return {
+    unchanged,
+    added: added.filter((finding3) => !movedAfter.has(finding3)),
+    removed: removed.filter((finding3) => !movedBefore.has(finding3)),
+    moved: [...moved, ...idMoves]
+  };
+}
+function parseScanDocument(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error("scan JSON must be an object with a findings array or a findings array");
+  }
+  const list = Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.findings) ? parsed.findings : void 0;
+  if (list === void 0) {
+    throw new Error("scan JSON must be an object with a findings array or a findings array");
+  }
+  return list.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new Error("scan JSON finding is missing ruleId or severity");
+    }
+    const record = item;
+    const ruleId = record.ruleId;
+    const severity = record.severity;
+    if (typeof ruleId !== "string" || ruleId.length === 0 || typeof severity !== "string") {
+      throw new Error("scan JSON finding is missing ruleId or severity");
+    }
+    if (!isSeverity(severity)) {
+      throw new Error(`scan JSON finding has an unknown severity "${severity}"`);
+    }
+    if (record.line !== void 0 && (typeof record.line !== "number" || !Number.isInteger(record.line) || record.line < 0)) {
+      throw new Error("scan JSON finding line must be an integer >= 0");
+    }
+    return item;
+  });
+}
+var ADDED_CAP = 20;
+function addedLine(finding3) {
+  const where = finding3.file !== void 0 ? ` ${posix3(finding3.file)}:${finding3.line ?? 0}` : "";
+  return `${finding3.severity} ${finding3.ruleId}${where}`;
+}
+function renderDiffText(diff) {
+  const lines = [
+    `fullshield diff: unchanged ${diff.unchanged.length}, added ${diff.added.length}, removed ${diff.removed.length}, moved ${diff.moved.length}`
+  ];
+  if (diff.added.length === 0) return lines.join("\n");
+  lines.push("added:");
+  for (const finding3 of diff.added.slice(0, ADDED_CAP)) lines.push(addedLine(finding3));
+  if (diff.added.length > ADDED_CAP) lines.push(`${diff.added.length - ADDED_CAP} more \u2014 use --json`);
+  return lines.join("\n");
+}
+
 // src/sbom/cyclonedx.ts
 function validateCycloneDx15(doc) {
   const errors = [];
@@ -9299,4 +10423,4 @@ function buildVex(findings, format, meta = { name: "app", version: "0.0.0" }) {
   return buildOpenVex(findings);
 }
 
-export { CONFIG_FILE_NAME, ConfigError, DEFAULT_CONFIG, IMPLEMENTED_MODULES, MODULE_NAMES, POLICY_FILE_NAME, POLICY_FLAG, POLICY_PEER_ERROR, PolicyError, SEVERITIES, analyzeWorkflowTampering, analyzeWormIndicators, applyBaseline, applyInlineSuppressions, applyPolicy, buildCycloneDxVex, buildOpenVex, buildSbom, buildVex, builtinModules, createAiClient, experimentalVex, failsCi, guardTools, isInternalAi, isLiveAi, isModuleName, isPolicyEnabled, isSeverity, loadConfig, loadPolicy, makeFindingId, mcpCfgEnabled2 as mcpCfgEnabled, mcpHomeConfigPaths, meetsThreshold, packageVersion, parseIgnore, parsePolicy, provenanceCoverage, readBaseline, renderConsoleReport, renderCycloneDx, renderHtmlReport, renderJsonReport, renderMarkdownReport, renderPrSummary, renderSarifReport, ruleDocsUrl, runAiFix, runFix, runScan, scan, scanMcpConfig, scanTextForSecrets, severityRank, sortFindings, summarize, validateCycloneDx15, validateCycloneDxVex, validateOpenVex, validateSarif21, walkFiles, writeBaseline };
+export { CONFIG_FILE_NAME, ConfigError, DEFAULT_CONFIG, DIFF_FLAG, IMPLEMENTED_MODULES, MODULE_NAMES, POLICY_FILE_NAME, POLICY_FLAG, POLICY_PEER_ERROR, PolicyError, SEVERITIES, analyzeWorkflowTampering, analyzeWormIndicators, applyBaseline, applyInlineSuppressions, applyPolicy, buildCycloneDxVex, buildOpenVex, buildSbom, buildVex, builtinModules, createAiClient, diffScans, experimentalVex, failsCi, guardTools, isInternalAi, isLiveAi, isModuleName, isPolicyEnabled, isSeverity, loadConfig, loadPolicy, makeFindingId, mcpCfgEnabled2 as mcpCfgEnabled, mcpHomeConfigPaths, meetsThreshold, packageVersion, parseIgnore, parsePolicy, parseScanDocument, provenanceCoverage, readBaseline, renderConsoleReport, renderCycloneDx, renderDiffText, renderGithubAnnotations, renderGitlabCodeQuality, renderHtmlReport, renderJsonReport, renderJunitReport, renderMarkdownReport, renderPrSummary, renderSarifReport, ruleDocsUrl, runAiFix, runFix, runScan, scan, scanMcpConfig, scanTextForSecrets, severityRank, sortFindings, summarize, validateCycloneDx15, validateCycloneDxVex, validateOpenVex, validateSarif21, walkFiles, writeBaseline };