fullshield 0.1.3 → 0.3.0

package/dist/mcp.js

@@ -1,14 +1,15 @@
 import { createHash } from 'crypto';
 import { readFile, mkdir, writeFile, stat, readdir } from 'fs/promises';
-import { resolve, join, basename, dirname, relative, posix } from 'path';
+import { resolve, join, basename, dirname, posix, relative } from 'path';
 import { execFile, spawnSync, spawn, execFileSync } from 'child_process';
 import { createInterface } from 'readline';
 import { promisify } from 'util';
 import { existsSync, statSync, readFileSync, readdirSync, mkdtempSync, cpSync, writeFileSync, rmSync } from 'fs';
-import { homedir, tmpdir } from 'os';
+import { homedir, availableParallelism, tmpdir } from 'os';
 import { performance } from 'perf_hooks';
-import ignoreModule from 'ignore';
+import { Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
+import ignoreModule from 'ignore';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -556,6 +557,7 @@ var init_incremental = __esm({
 // src/modules/secrets/history.ts
 var history_exports = {};
 __export(history_exports, {
+  historyCommitLimit: () => historyCommitLimit,
   scanGitHistory: () => scanGitHistory
 });
 function gitError(error) {
@@ -598,7 +600,13 @@ function remapHit(hit, file) {
     secret: hit.secret
   };
 }
-async function streamLogChanges(cwd) {
+function historyCommitLimit(raw = process.env.FULLSHIELD_HISTORY_MAX) {
+  if (raw === void 0 || raw.trim() === "") return 500;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 1) return 500;
+  return Math.min(parsed, 5e3);
+}
+async function streamLogChanges(cwd, maxCommits) {
   const changes = [];
   await gitOk(cwd, ["rev-parse", "--is-inside-work-tree"]);
   const child = spawn(
@@ -615,6 +623,8 @@ async function streamLogChanges(cwd) {
       "--format=FSCOMMIT:%H",
       "--no-textconv",
       "--no-ext-diff",
+      "-n",
+      String(maxCommits),
       "HEAD"
     ],
     { stdio: ["ignore", "pipe", "pipe"] }
@@ -683,8 +693,14 @@ async function headSecretKeys(cwd) {
   }
   return keys;
 }
-async function scanGitHistory(cwd) {
-  const changes = await streamLogChanges(cwd);
+async function commitCount(cwd) {
+  const raw = await gitOk(cwd, ["rev-list", "--count", "HEAD"]);
+  const total = Number(raw.trim());
+  return Number.isInteger(total) && total >= 0 ? total : 0;
+}
+async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
+  const total = await commitCount(cwd);
+  const changes = await streamLogChanges(cwd, maxCommits);
   const blobHits = /* @__PURE__ */ new Map();
   const first = /* @__PURE__ */ new Map();
   for (const change of changes) {
@@ -721,7 +737,13 @@ async function scanGitHistory(cwd) {
       secret: hit.secret
     });
   }
-  return { findings: hits.map((h) => h.finding), hits };
+  const scanned = Math.min(maxCommits, total);
+  const history = total > maxCommits ? `scanned ${scanned} of ${total} commits` : void 0;
+  return {
+    findings: hits.map((h) => h.finding),
+    hits,
+    ...history !== void 0 ? { history } : {}
+  };
 }
 var execFileAsync2, ZERO_HASH, MAX_BLOB, RAW_LINE;
 var init_history = __esm({
@@ -1069,7 +1091,8 @@ function walk(node, visit) {
   }
 }
 function attachParents(node, parent) {
-  node.parent = parent;
+  const current = node;
+  if (parent !== void 0 || current.parent === void 0) current.parent = parent;
   for (const key of Object.keys(node)) {
     if (SKIP_KEYS.has(String(key))) continue;
     const value = node[key];
@@ -1139,6 +1162,13 @@ function classesEnabled() {
 function mcpCfgEnabled() {
   return process.env.FULLSHIELD_EXPERIMENTAL_MCPCFG === "1";
 }
+function taintV2Enabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_TAINT_V2 === "1";
+}
+var LICENSE_FLAG = "FULLSHIELD_EXPERIMENTAL_LICENSE";
+function licenseEnabled() {
+  return process.env[LICENSE_FLAG] === "1";
+}
 
 // src/modules/config/finding.ts
 init_finding();
@@ -1945,6 +1975,103 @@ function exactPinsFromManifest(pkg) {
 
 // src/modules/deps/reachability.ts
 init_finding();
+
+// src/modules/deps/symbol-reachability.ts
+function affectedFunctionNames(vuln) {
+  const names = /* @__PURE__ */ new Set();
+  for (const affected of vuln.affected ?? []) {
+    const list = affected.ecosystem_specific?.affected_functions;
+    if (!Array.isArray(list)) continue;
+    for (const item of list) {
+      if (typeof item === "string" && item.length > 0) names.add(item);
+    }
+  }
+  return [...names];
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function called(source, local) {
+  return new RegExp(`\\b${escapeRegExp(local)}\\s*\\(`).test(source);
+}
+function memberCalled(source, object, member) {
+  return new RegExp(`\\b${escapeRegExp(object)}\\s*\\.\\s*${escapeRegExp(member)}\\s*\\(`).test(source);
+}
+function sourceCallsAffectedSymbol(source, symbol) {
+  const esc = escapeRegExp(symbol);
+  const named = new RegExp(
+    `import\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`,
+    "g"
+  );
+  let match;
+  while ((match = named.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const star = /import\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s+['"][^'"]+['"]/g;
+  while ((match = star.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const subDefault = new RegExp(
+    `import\\s+([A-Za-z_$][\\w$]*)\\s+from\\s+['"][^'"]+/${esc}['"]`
+  );
+  const sub = subDefault.exec(source);
+  if (sub?.[1] !== void 0 && called(source, sub[1])) return true;
+  const reqMember = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+['"]\\s*\\)\\s*\\.\\s*${esc}`
+  );
+  const reqHit = reqMember.exec(source);
+  if (reqHit?.[1] !== void 0 && called(source, reqHit[1])) return true;
+  const reqNs = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNs.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const reqNamed = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNamed.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s*:\s*/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const reqSub = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+/${esc}['"]\\s*\\)`
+  );
+  const subReq = reqSub.exec(source);
+  if (subReq?.[1] !== void 0 && called(source, subReq[1])) return true;
+  const barrel = new RegExp(`export\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`, "g");
+  while ((match = barrel.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const exported = (bits[1] ?? bits[0])?.trim();
+      if (exported === symbol) {
+        const local = bits[0]?.trim();
+        if (local !== void 0 && called(source, local)) return true;
+      }
+    }
+  }
+  return false;
+}
+function classifySymbolUse(symbols, sources) {
+  for (const symbol of symbols) {
+    for (const source of sources.values()) {
+      if (sourceCallsAffectedSymbol(source, symbol)) return "symbol-reachable";
+    }
+  }
+  return "symbol-not-called";
+}
+
+// src/modules/deps/reachability.ts
 function packageNameFromSnippet(snippet) {
   if (snippet.startsWith("@")) {
     const second = snippet.indexOf("@", 1);
@@ -1973,9 +2100,9 @@ function isProductionSource(rel) {
 }
 function indexPackageUsage(sources) {
   const usage = /* @__PURE__ */ new Map();
-  const bump = (pkg, called) => {
+  const bump = (pkg, called2) => {
     const prev = usage.get(pkg) ?? { called: false };
-    usage.set(pkg, { imported: true, called: prev.called || called });
+    usage.set(pkg, { imported: true, called: prev.called || called2 });
   };
   const nsRe = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
   const namedRe = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
@@ -2031,6 +2158,29 @@ function shortestDependencyPath(target, starts, edges) {
   }
   return void 0;
 }
+function collectDependencyPaths(target, starts, edges, limit = 8) {
+  const out = [];
+  const queue = [];
+  let steps = 0;
+  for (const start of starts) queue.push([start]);
+  while (queue.length > 0 && out.length < limit && steps < 4e3) {
+    steps += 1;
+    const path = queue.shift();
+    if (path === void 0) continue;
+    const last = path[path.length - 1];
+    if (last === void 0) continue;
+    if (last === target) {
+      if (path.length >= 2) out.push(path);
+      continue;
+    }
+    if (path.length >= 12) continue;
+    for (const next of edges.get(last) ?? []) {
+      if (path.includes(next)) continue;
+      queue.push([...path, next]);
+    }
+  }
+  return out;
+}
 function reachableFrom(target, roots, edges) {
   if (roots.has(target)) return true;
   return shortestDependencyPath(target, roots, edges) !== void 0;
@@ -2051,9 +2201,10 @@ function classifyReachability(pkgName, productionUsage, graph) {
   }
   if (graph !== void 0 && graph.edgesKnown) {
     const roots = importedDirectNames(productionUsage, graph);
-    const path = shortestDependencyPath(pkgName, roots, graph.edges);
+    const paths = collectDependencyPaths(pkgName, roots, graph.edges);
+    const path = paths[0];
     if (path !== void 0 && path.length >= 2) {
-      return { reachability: "reachable-via-dependency", path };
+      return { reachability: "reachable-via-dependency", path, paths };
     }
     return { reachability: "not-imported" };
   }
@@ -2063,10 +2214,10 @@ function classifyReachability(pkgName, productionUsage, graph) {
   return { reachability: "not-imported" };
 }
 function reachabilitySteps(reachability) {
-  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown") {
+  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
   }
-  if (reachability === "imported-not-called") return 1;
+  if (reachability === "imported-not-called" || reachability === "symbol-not-called") return 1;
   return 2;
 }
 function downgradeSeverity(severity, steps) {
@@ -2083,8 +2234,108 @@ function isDevOnly(pkgName, ctx) {
   if (inProd) return false;
   return directDev.has(pkgName) || reachableFrom(pkgName, directDev, edges);
 }
-function applyReachability(findings, ctx) {
-  return findings.map((finding4) => {
+var REACH_RANK = {
+  reachable: 0,
+  "symbol-reachable": 1,
+  "reachable-via-dependency": 2,
+  "imported-not-called": 3,
+  "symbol-not-called": 4,
+  "reachability-unknown": 5,
+  "not-imported": 6
+};
+function versionFromSnippet(snippet) {
+  const name = packageNameFromSnippet(snippet);
+  if (name === void 0) return snippet;
+  return snippet.slice(name.length + 1);
+}
+function pathFields(classified) {
+  const paths = classified.paths ?? (classified.path !== void 0 ? [classified.path] : []);
+  if (paths.length === 0) return {};
+  return {
+    dependencyPath: paths[0],
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
+function appendOtherPaths(message, paths) {
+  if (paths === void 0 || paths.length < 2) return message;
+  const rest = paths.slice(1).map((p) => p.join(" > ")).join("; ");
+  return `${message} Other paths: ${rest}.`;
+}
+function groupPackageAdvisories(findings) {
+  const passthrough = [];
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding4 of findings) {
+    if (finding4.ruleId !== "DEPS-VULN-001" && finding4.ruleId !== "DEPS-MALICIOUS-001") {
+      passthrough.push(finding4);
+      continue;
+    }
+    const name = packageNameFromSnippet(finding4.snippet ?? "") ?? finding4.snippet ?? finding4.id;
+    const advisory = finding4.references?.[0] ?? finding4.id;
+    const key = `${finding4.ruleId}\0${name}\0${advisory}`;
+    const list = groups.get(key);
+    if (list === void 0) groups.set(key, [finding4]);
+    else list.push(finding4);
+  }
+  const merged = [];
+  for (const list of groups.values()) {
+    const only = list[0];
+    if (list.length === 1 && only !== void 0) {
+      merged.push(only);
+      continue;
+    }
+    merged.push(mergeAdvisory(list));
+  }
+  return [...passthrough, ...merged];
+}
+function mergeAdvisory(list) {
+  const ranked = [...list].sort(
+    (a, b) => severityRank(b.severity) - severityRank(a.severity) || (REACH_RANK[a.reachability ?? "not-imported"] ?? 9) - (REACH_RANK[b.reachability ?? "not-imported"] ?? 9)
+  );
+  const primary = ranked[0];
+  if (primary === void 0) {
+    throw new Error("empty advisory group");
+  }
+  const name = packageNameFromSnippet(primary.snippet ?? "") ?? "package";
+  const versions = [...new Set(list.map((f) => versionFromSnippet(f.snippet ?? "")))].filter((v) => v.length > 0).sort();
+  const paths = [];
+  const seenPath = /* @__PURE__ */ new Set();
+  for (const finding4 of list) {
+    const candidates = finding4.dependencyPaths ?? (finding4.dependencyPath !== void 0 ? [finding4.dependencyPath] : []);
+    for (const path of candidates) {
+      const key = path.join("\0");
+      if (seenPath.has(key)) continue;
+      seenPath.add(key);
+      paths.push(path);
+    }
+  }
+  paths.sort((a, b) => a.length - b.length || a.join(">").localeCompare(b.join(">")));
+  const advisory = primary.references?.[0] ?? "";
+  const onManifest = list.find((f) => f.file === "package.json");
+  const file = onManifest?.file ?? primary.file;
+  const line = onManifest?.line ?? primary.line;
+  const snippet = versions.length > 0 ? `${name}@${versions.join(",")}` : primary.snippet ?? name;
+  let message = primary.message;
+  if (versions.length > 1) {
+    message = `${message} Versions: ${versions.join(", ")}.`;
+  }
+  if (paths.length > 1) {
+    message = `${message} Dependency paths: ${paths.map((p) => p.join(" > ")).join("; ")}.`;
+  }
+  return {
+    ...primary,
+    id: makeFindingId(primary.ruleId, file, `${name}|${advisory}|${versions.join(",")}`),
+    file,
+    line,
+    snippet,
+    message,
+    severity: primary.severity,
+    reachability: primary.reachability,
+    ...paths[0] !== void 0 ? { dependencyPath: paths[0] } : {},
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
+function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
+  const mapped = findings.map((finding4) => {
     if (finding4.ruleId === "DEPS-MALICIOUS-001") {
       if (finding4.snippet === void 0) return finding4;
       const pkg2 = packageNameFromSnippet(finding4.snippet);
@@ -2094,19 +2345,25 @@ function applyReachability(findings, ctx) {
         ...finding4,
         severity: "critical",
         reachability: classified2.reachability,
-        ...classified2.path !== void 0 ? { dependencyPath: classified2.path } : {}
+        ...pathFields(classified2)
       };
     }
     if (finding4.ruleId !== "DEPS-VULN-001" || finding4.snippet === void 0) return finding4;
     const pkg = packageNameFromSnippet(finding4.snippet);
     if (pkg === void 0 || pkg.length === 0) return finding4;
-    const classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    let classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    const named = symbols.get(finding4.id) ?? [];
+    if (named.length > 0 && ctx.sources !== void 0) {
+      const symbolClass = classifySymbolUse(named, ctx.sources);
+      classified = { reachability: symbolClass, path: classified.path, paths: classified.paths };
+    }
     const steps = reachabilitySteps(classified.reachability);
     let severity = steps === 0 ? finding4.severity : downgradeSeverity(finding4.severity, steps);
     let message = finding4.message;
     if (classified.path !== void 0) {
       const shown = classified.path.join(" > ");
       message = `${message} Reachable via ${shown}.`;
+      message = appendOtherPaths(message, classified.paths);
     }
     const devOnly = isDevOnly(pkg, ctx);
     if (devOnly) {
@@ -2116,11 +2373,12 @@ function applyReachability(findings, ctx) {
     return {
       ...finding4,
       reachability: classified.reachability,
-      ...classified.path !== void 0 ? { dependencyPath: classified.path } : {},
+      ...pathFields(classified),
       severity,
       message
     };
   });
+  return groupPackageAdvisories(mapped);
 }
 
 // src/modules/deps/semver.ts
@@ -4022,6 +4280,59 @@ function experimentalVex() {
   return process.env.FULLSHIELD_EXPERIMENTAL_VEX === "1";
 }
 
+// src/modules/deps/license.ts
+init_finding();
+var COPYLEFT = /(?:^|[^\w])(?:AGPL|GPL)(?:-|[^\w]|$)/i;
+function isCopyleftLicense(license) {
+  return COPYLEFT.test(license);
+}
+function licenseText(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && value !== null && "type" in value) {
+    const type = value.type;
+    if (typeof type === "string") return type;
+  }
+  return void 0;
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function scanCopyleftLicenses(cwd) {
+  const manifest = await readJson(join(cwd, "package.json"));
+  if (typeof manifest !== "object" || manifest === null) return [];
+  const names = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    const block = manifest[field];
+    if (typeof block === "object" && block !== null && !Array.isArray(block)) {
+      for (const name of Object.keys(block)) names.add(name);
+    }
+  }
+  const findings = [];
+  for (const name of names) {
+    const pkg = await readJson(join(cwd, "node_modules", name, "package.json"));
+    if (typeof pkg !== "object" || pkg === null) continue;
+    const license = licenseText(pkg.license);
+    if (license === void 0 || !isCopyleftLicense(license)) continue;
+    findings.push({
+      id: makeFindingId("DEPS-LICENSE-001", "package.json", `${name}|${license}`),
+      ruleId: "DEPS-LICENSE-001",
+      module: "deps",
+      title: `Copyleft dependency ${name}`,
+      severity: "medium",
+      confidence: "high",
+      file: "package.json",
+      snippet: `${name} ${license}`,
+      message: `${name} is licensed ${license}.`,
+      remediation: "Replace the dependency or get a legal review before shipping it in a commercial product."
+    });
+  }
+  return findings;
+}
+
 // src/fixer/eol.ts
 function detectEol(text) {
   return text.includes("\r\n") ? "\r\n" : "\n";
@@ -4120,7 +4431,7 @@ function walkJs(dir, out = []) {
   }
   return out;
 }
-function readJson(path) {
+function readJson2(path) {
   return JSON.parse(readFileSync(path, "utf8"));
 }
 var TOKEN_RE = /(?:~\/)?\.npmrc\b|\bNPM_TOKEN\b|\bGITHUB_TOKEN\b/;
@@ -4134,7 +4445,7 @@ function packageSources(dir) {
   let scripts = "";
   if (existsSync(manifestPath) && statSync(manifestPath).isFile()) {
     try {
-      const pkg = readJson(manifestPath);
+      const pkg = readJson2(manifestPath);
       const block = pkg.scripts ?? {};
       scripts = Object.values(block).join("\n");
     } catch {
@@ -4408,14 +4719,17 @@ var depsModule = {
         findings2.push(typosquatFinding("package.json", hit));
       }
       const osvHits2 = await queryOsv(pins, osvOpts);
+      const symbols2 = /* @__PURE__ */ new Map();
       for (const hit of osvHits2) {
         for (const vuln of hit.vulns) {
-          findings2.push(
-            isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name))
-          );
+          const finding4 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+          const names = affectedFunctionNames(vuln);
+          if (names.length > 0 && finding4.ruleId === "DEPS-VULN-001") symbols2.set(finding4.id, names);
+          findings2.push(finding4);
         }
       }
-      return applyReachability(findings2, await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest)));
+      const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
+      return applyReachability(findings2, noLockCtx, symbols2);
     }
     let contents;
     try {
@@ -4436,18 +4750,21 @@ var depsModule = {
       }
     }
     const osvHits = await queryOsv(packages, osvOpts);
+    const symbols = /* @__PURE__ */ new Map();
     for (const hit of osvHits) {
       for (const vuln of hit.vulns) {
-        findings.push(
-          isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name))
-        );
+        const finding4 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+        const names = affectedFunctionNames(vuln);
+        if (names.length > 0 && finding4.ruleId === "DEPS-VULN-001") symbols.set(finding4.id, names);
+        findings.push(finding4);
       }
     }
-    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph));
+    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
     if (experimentalVex()) {
       reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
       reached.push(...scanInstalledPackages(ctx.cwd, packages));
     }
+    if (licenseEnabled()) reached.push(...await scanCopyleftLicenses(ctx.cwd));
     return reached;
   }
 };
@@ -4477,7 +4794,7 @@ async function reachabilityCtx(cwd, files, graph) {
     } catch {
     }
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph };
+  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
 }
 
 // src/modules/mcp/index.ts
@@ -5015,6 +5332,26 @@ function isXssSanitizerCall(node) {
   return false;
 }
 var NO_RETURNERS = /* @__PURE__ */ new Set();
+var CALLBACK_METHODS = /* @__PURE__ */ new Set([
+  "then",
+  "catch",
+  "finally",
+  "map",
+  "forEach",
+  "filter",
+  "flatMap",
+  "find",
+  "reduce"
+]);
+var taintedThisFields = /* @__PURE__ */ new WeakMap();
+function enclosingClass(node) {
+  let current = node.parent;
+  while (current !== void 0) {
+    if (current.type === "ClassDeclaration" || current.type === "ClassExpression") return current;
+    current = current.parent;
+  }
+  return void 0;
+}
 function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
   if (node === void 0) return false;
   if (isTaintSource(node) || isFrameworkMemberTaint(node) || isFrameworkTaintCall(node) || isMcpArgsTaintSource(node)) {
@@ -5026,8 +5363,34 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
     case "Identifier":
       return tainted.has(node.name);
     case "MemberExpression":
+      if (taintV2Enabled() && node.object.type === "ThisExpression") {
+        const cls = enclosingClass(node);
+        const name = propName(node);
+        if (cls !== void 0 && name !== void 0 && taintedThisFields.get(cls)?.has(name) === true) {
+          return true;
+        }
+      }
       return exprIsTainted(node.object, tainted, returners);
+    case "ArrayExpression":
+      if (!taintV2Enabled()) return false;
+      return node.elements.some((el) => {
+        if (el === null) return false;
+        if (el.type === "SpreadElement") return exprIsTainted(el.argument, tainted, returners);
+        return exprIsTainted(el, tainted, returners);
+      });
+    case "ObjectExpression":
+      if (!taintV2Enabled()) return false;
+      return node.properties.some((prop) => {
+        if (prop.type === "SpreadElement") return exprIsTainted(prop.argument, tainted, returners);
+        if (prop.type !== "Property") return false;
+        return exprIsTainted(prop.value, tainted, returners);
+      });
     case "CallExpression":
+      if (taintV2Enabled() && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+        return node.arguments.some(
+          (arg) => arg.type !== "SpreadElement" && exprIsTainted(arg, tainted, returners)
+        );
+      }
       if (isSchemaValidatorCall(node)) return false;
       if (node.callee.type === "Identifier" && returners.has(node.callee.name)) return true;
       if (node.callee.type === "MemberExpression" && exprIsTainted(node.callee.object, tainted, returners)) {
@@ -5258,7 +5621,66 @@ function scopeReturnsTaint(scope, tainted, returners) {
   return yes;
 }
 var MAX_TAINT_HOPS = 5;
-function analyzeFile(ast, extraReturners = NO_RETURNERS) {
+function seedTaintV2(functions, facts, seeds, returners, nameToFn) {
+  let changed = false;
+  const mark = (fn, name) => {
+    if (name === void 0) return;
+    const set = seeds.get(fn) ?? /* @__PURE__ */ new Set();
+    if (set.has(name)) return;
+    set.add(name);
+    seeds.set(fn, set);
+    changed = true;
+  };
+  for (const fn of functions) {
+    const f = facts.get(fn);
+    if (f === void 0) continue;
+    let parent = fn.parent;
+    while (parent !== void 0 && !isFunctionNode(parent)) {
+      parent = parent.parent;
+    }
+    if (parent !== void 0 && isFunctionNode(parent)) {
+      const outer = facts.get(parent);
+      if (outer !== void 0) {
+        for (const name of outer.tainted) mark(fn, name);
+      }
+    }
+    walkScope(fn, (node) => {
+      if (node.type === "AssignmentExpression" && node.left.type === "MemberExpression") {
+        if (node.left.object.type === "ThisExpression" && exprIsTainted(node.right, f.tainted, returners)) {
+          const cls = enclosingClass(node);
+          const field = propName(node.left);
+          if (cls !== void 0 && field !== void 0) {
+            const fields = taintedThisFields.get(cls) ?? /* @__PURE__ */ new Set();
+            if (!fields.has(field)) {
+              fields.add(field);
+              taintedThisFields.set(cls, fields);
+              changed = true;
+            }
+          }
+        }
+      }
+      if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
+      const method = propName(node.callee);
+      if (method === void 0) return;
+      if (CALLBACK_METHODS.has(method) && exprIsTainted(node.callee.object, f.tainted, returners)) {
+        const callback = node.arguments[0];
+        if (callback !== void 0 && isFunctionNode(callback)) {
+          mark(callback, boundNames(callback.params[0])[0]);
+        }
+      }
+      if ((method === "call" || method === "apply") && node.callee.object.type === "Identifier") {
+        const target = nameToFn.get(node.callee.object.name);
+        if (target === void 0 || !isFunctionNode(target)) return;
+        const arg = node.arguments[1];
+        if (arg !== void 0 && arg.type !== "SpreadElement" && exprIsTainted(arg, f.tainted, returners)) {
+          mark(target, boundNames(target.params[0])[0]);
+        }
+      }
+    });
+  }
+  return changed;
+}
+function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   attachParents(ast);
   const facts = /* @__PURE__ */ new WeakMap();
   const functions = [];
@@ -5272,7 +5694,7 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   }
   const seeds = /* @__PURE__ */ new Map();
   for (const fn of functions) seeds.set(fn, /* @__PURE__ */ new Set());
-  const returners = new Set(extraReturners);
+  const returners = new Set(extraReturners2);
   for (let hop = 0; hop < MAX_TAINT_HOPS; hop += 1) {
     let changed = false;
     facts.set(ast, analyzeScope(ast, [], returners));
@@ -5312,6 +5734,9 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
         });
       });
     }
+    if (taintV2Enabled() && seedTaintV2(functions, facts, seeds, returners, nameToFn)) {
+      changed = true;
+    }
     if (!changed) break;
   }
   return facts;
@@ -5454,6 +5879,21 @@ function requireCall(node) {
   }
   return void 0;
 }
+function reexportsOf(ast) {
+  const out = /* @__PURE__ */ new Map();
+  walk(ast, (node) => {
+    if (node.type !== "ExportNamedDeclaration" || node.source === null || node.source === void 0) return;
+    const spec = literalString(node.source);
+    if (spec === void 0) return;
+    for (const specNode of node.specifiers) {
+      if (specNode.type !== "ExportSpecifier") continue;
+      const exported = specNode.exported.type === "Identifier" ? specNode.exported.name : void 0;
+      const local = specNode.local.type === "Identifier" ? specNode.local.name : exported;
+      if (exported !== void 0 && local !== void 0) out.set(exported, { spec, name: local });
+    }
+  });
+  return out;
+}
 function resolveRelative(fromFile, spec, files) {
   if (!spec.startsWith(".")) return void 0;
   const base = posix.normalize(posix.join(posix.dirname(fromFile), spec));
@@ -5531,6 +5971,22 @@ function runInterproc(parsed) {
       functions.set(`${fn.file}#${fn.name}`, fn);
     }
   }
+  if (taintV2Enabled()) {
+    const barrels = /* @__PURE__ */ new Map();
+    for (const p of parsed) barrels.set(p.file, reexportsOf(p.ast));
+    for (const ns of requires.values()) {
+      for (const [local, target] of ns) {
+        const hash = target.indexOf("#");
+        if (hash < 0) continue;
+        const file = target.slice(0, hash);
+        const name = target.slice(hash + 1);
+        const re = barrels.get(file)?.get(name);
+        if (re === void 0) continue;
+        const resolved = resolveRelative(file, re.spec, files);
+        if (resolved !== void 0) ns.set(local, `${resolved}#${re.name}`);
+      }
+    }
+  }
   const queue = [];
   for (const p of parsed) {
     const facts = analyzeFile(p.ast);
@@ -6046,7 +6502,10 @@ function isMongoReceiver(node, source) {
   const obj = node.callee.object;
   if (obj.type === "Identifier") {
     if (isCollectionName(obj.name)) return true;
-    if (isPascalModel(obj.name)) return !fileHasSqlOrm;
+    if (isPascalModel(obj.name)) {
+      if (/extends\s+BaseEntity\b/.test(source)) return false;
+      return !fileHasSqlOrm;
+    }
     return fileHasMongo;
   }
   if (obj.type === "MemberExpression") {
@@ -7108,6 +7567,136 @@ function scanPromptInjection(file, source) {
   return findings;
 }
 
+// src/runtime/lru.ts
+var LruMap = class {
+  constructor(max) {
+    this.max = max;
+    if (max < 1) throw new Error("LruMap max must be >= 1");
+  }
+  max;
+  map = /* @__PURE__ */ new Map();
+  get size() {
+    return this.map.size;
+  }
+  has(key) {
+    return this.map.has(key);
+  }
+  get(key) {
+    if (!this.map.has(key)) return void 0;
+    const value = this.map.get(key);
+    this.map.delete(key);
+    this.map.set(key, value);
+    return value;
+  }
+  set(key, value) {
+    if (this.map.has(key)) this.map.delete(key);
+    this.map.set(key, value);
+    while (this.map.size > this.max) {
+      const oldest = this.map.keys().next().value;
+      if (oldest === void 0) break;
+      this.map.delete(oldest);
+    }
+    return this;
+  }
+};
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+
+// src/core/parse-pool.ts
+var workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+var cache = new LruMap(64);
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
+  }
+  return Math.min(2, Math.max(1, availableParallelism() - 1));
+}
+function workerMemoryMb() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
+  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
+  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
+  return 512;
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit = cache.get(key);
+  if (hit !== void 0) return Promise.resolve(hit);
+  return new Promise((resolve5, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), {
+      workerData: { code },
+      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
+    });
+    let settled = false;
+    const finish = () => {
+      void worker.terminate();
+    };
+    const succeed = (ast) => {
+      if (settled) return;
+      settled = true;
+      cache.set(key, ast);
+      finish();
+      resolve5(ast);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      finish();
+      reject(error);
+    };
+    worker.once("message", (ast) => {
+      succeed(ast);
+    });
+    worker.once("error", (error) => {
+      fail(error);
+    });
+    worker.once("exit", (code2) => {
+      if (settled) return;
+      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
+    });
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
+
 // src/modules/sast/engine.ts
 var sastRules = [
   sqliRule,
@@ -7140,8 +7729,8 @@ function snippetOf(source, node) {
   if (node.range === void 0) return "";
   return source.slice(node.range[0], node.range[1]).replace(/\s+/g, " ").trim().slice(0, 120);
 }
-function findingsFromAst(filename, source, ast, extraReturners = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
-  const facts = analyzeFile(ast, extraReturners);
+function findingsFromAst(filename, source, ast, extraReturners2 = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
+  const facts = analyzeFile(ast, extraReturners2);
   const findings = [];
   for (const rule of sastRules) {
     const ctx = {
@@ -7219,51 +7808,203 @@ function findingsFromTemplate(filename, source) {
   xssRule.create(ctx);
   return findings;
 }
+function dedupeSastSinks(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const finding4 of findings) {
+    if (finding4.module !== "sast" || finding4.line === void 0) {
+      out.push(finding4);
+      continue;
+    }
+    const key = `${finding4.ruleId}\0${finding4.file ?? ""}\0${finding4.line}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(finding4);
+  }
+  return out;
+}
+function sastStreamThreshold() {
+  const raw = process.env.FULLSHIELD_SAST_STREAM_AT;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 4e3;
+}
+function sastBatchSize() {
+  const raw = process.env.FULLSHIELD_SAST_BATCH;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 150;
+}
+function skipFinding(rel, message) {
+  return {
+    id: makeFindingId("SAST-SKIP-001", rel, message),
+    ruleId: "SAST-SKIP-001",
+    module: "sast",
+    title: "File skipped by SAST",
+    severity: "info",
+    confidence: "high",
+    file: rel,
+    message,
+    remediation: "Raise sast.maxFileBytes in fullshield.config.json to parse this file, or leave it skipped."
+  };
+}
+function skipReason(source, maxBytes) {
+  if (source.includes("\0")) return "it contains NUL bytes";
+  const bytes = Buffer.byteLength(source);
+  if (bytes > maxBytes) return `${bytes} bytes exceeds the SAST parse limit of ${maxBytes} bytes`;
+  return void 0;
+}
+async function readScanSource(cwd, rel) {
+  try {
+    return await readFile(join(cwd, rel), "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function cloneAst(value) {
+  if (value === null || typeof value !== "object") return void 0;
+  try {
+    return structuredClone(value);
+  } catch {
+    return void 0;
+  }
+}
+async function parseInProcess(source) {
+  try {
+    return await parseSource(source);
+  } catch {
+    return void 0;
+  }
+}
+async function parseCode(source) {
+  if (!parsePoolEnabled()) return parseInProcess(source);
+  try {
+    const cloned = cloneAst((await parseWithPool([source]))[0]);
+    if (cloned !== void 0) return cloned;
+  } catch {
+  }
+  return parseInProcess(source);
+}
+function releaseParsed(parsed) {
+  for (const entry of parsed) {
+    entry.source = "";
+    entry.ast = void 0;
+  }
+  parsed.length = 0;
+}
+function extraReturners(rel, ast, files, returning) {
+  const ns = collectRequires(rel, ast, files);
+  const extra = new Set(returning.get(rel));
+  for (const [local, spec] of ns) {
+    const hash = spec.indexOf("#");
+    const file = hash >= 0 ? spec.slice(0, hash) : spec;
+    const exp = hash >= 0 ? spec.slice(hash + 1) : local;
+    if (returning.get(file)?.has(exp)) extra.add(local);
+  }
+  return extra;
+}
+async function runSastStreaming(ctx) {
+  const maxBytes = ctx.config.sast.maxFileBytes;
+  const findings = [];
+  const returning = /* @__PURE__ */ new Map();
+  const parseable = [];
+  const fileSet = /* @__PURE__ */ new Set();
+  let projectCsrf = false;
+  for (const rel of ctx.files) {
+    const isSource = SOURCE_EXT.test(rel);
+    const isTemplate = TEMPLATE_EXT.test(rel);
+    if (!isSource && !isTemplate) continue;
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const why = skipReason(source, maxBytes);
+    if (why !== void 0) {
+      findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+      continue;
+    }
+    if (sourceHasCsrfGuard(source)) projectCsrf = true;
+    if (isTemplate) {
+      findings.push(...findingsFromTemplate(rel, source));
+      continue;
+    }
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    returning.set(rel, functionsThatReturnTaint(ast));
+    parseable.push(rel);
+    fileSet.add(rel);
+  }
+  for (const rel of parseable) {
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    findings.push(
+      ...findingsFromAst(rel, source, ast, extraReturners(rel, ast, fileSet, returning), projectCsrf)
+    );
+  }
+  const batch = sastBatchSize();
+  for (let i = 0; i < parseable.length; i += batch) {
+    const parsed = [];
+    for (const rel of parseable.slice(i, i + batch)) {
+      const source = await readScanSource(ctx.cwd, rel);
+      if (source === void 0) continue;
+      const ast = await parseCode(source);
+      if (ast === void 0) continue;
+      parsed.push({ file: rel, source, ast });
+    }
+    findings.push(...runInterproc(parsed));
+    releaseParsed(parsed);
+  }
+  return dedupeSastSinks(findings);
+}
 var sastModule = {
   name: "sast",
   async run(ctx) {
+    const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
+    if (candidates.length > sastStreamThreshold()) return runSastStreaming(ctx);
+    const maxBytes = ctx.config.sast.maxFileBytes;
     const findings = [];
     const parsed = [];
-    for (const rel of ctx.files) {
-      const isSource = SOURCE_EXT.test(rel);
-      const isTemplate = TEMPLATE_EXT.test(rel);
-      if (!isSource && !isTemplate) continue;
-      let source;
-      try {
-        source = await readFile(join(ctx.cwd, rel), "utf8");
-      } catch {
+    for (const rel of candidates) {
+      const source = await readScanSource(ctx.cwd, rel);
+      if (source === void 0) continue;
+      const why = skipReason(source, maxBytes);
+      if (why !== void 0) {
+        findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
         continue;
       }
-      if (source.length > 1024 * 1024 || source.includes("\0")) continue;
-      if (isTemplate) {
+      if (TEMPLATE_EXT.test(rel)) {
         findings.push(...findingsFromTemplate(rel, source));
         continue;
       }
-      try {
-        const ast = await parseSource(source);
-        parsed.push({ file: rel, source, ast });
-      } catch {
-      }
+      const ast = await parseCode(source);
+      if (ast === void 0) continue;
+      parsed.push({ file: rel, source, ast });
     }
     const files = new Set(parsed.map((p) => p.file));
     const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
     const returning = /* @__PURE__ */ new Map();
-    for (const p of parsed) {
-      returning.set(p.file, functionsThatReturnTaint(p.ast));
-    }
-    for (const p of parsed) {
-      const ns = collectRequires(p.file, p.ast, files);
-      const extra = new Set(returning.get(p.file));
-      for (const [local, spec] of ns) {
-        const hash = spec.indexOf("#");
-        const file = hash >= 0 ? spec.slice(0, hash) : spec;
-        const exp = hash >= 0 ? spec.slice(hash + 1) : local;
-        if (returning.get(file)?.has(exp)) extra.add(local);
-      }
-      findings.push(...findingsFromAst(p.file, p.source, p.ast, extra, projectCsrf));
+    for (const entry of parsed) {
+      returning.set(entry.file, functionsThatReturnTaint(entry.ast));
+    }
+    for (const entry of parsed) {
+      findings.push(
+        ...findingsFromAst(
+          entry.file,
+          entry.source,
+          entry.ast,
+          extraReturners(entry.file, entry.ast, files, returning),
+          projectCsrf
+        )
+      );
     }
     findings.push(...runInterproc(parsed));
-    return findings;
+    const out = dedupeSastSinks(findings);
+    releaseParsed(parsed);
+    return out;
   }
 };
 
@@ -7618,7 +8359,7 @@ function createAiClient(options) {
   const useFixtures = options.useFixtures ?? !isLiveAi();
   const model = options.model ?? process.env.FULLSHIELD_AI_MODEL ?? (useFixtures ? "recorded-fixture" : "qwen2.5-coder:7b");
   const provider = options.provider ?? process.env.FULLSHIELD_AI_PROVIDER ?? (useFixtures ? "fixture" : "ollama");
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   let spentUsd = 0;
   let networkCalls = 0;
   const liveCost = provider === "ollama" ? 0 : FIXTURE_COST;
@@ -7638,7 +8379,7 @@ function createAiClient(options) {
       const redactedPrompt = `${modeInstruction(req.mode)}
 ${wrapUntrustedCode(req.prompt)}`;
       const key = cacheKey(req.model ?? model, redactedPrompt);
-      const cached = cache.get(key);
+      const cached = cache2.get(key);
       if (cached !== void 0) {
         return { ...cached, cached: true, costUsd: 0 };
       }
@@ -7652,7 +8393,7 @@ ${wrapUntrustedCode(req.prompt)}`;
           cached: false,
           redactedPrompt
         };
-        cache.set(key, response2);
+        cache2.set(key, response2);
         return response2;
       }
       const fetchImpl = options.fetchImpl ?? fetch;
@@ -7702,21 +8443,42 @@ ${wrapUntrustedCode(req.prompt)}`;
         cached: false,
         redactedPrompt
       };
-      cache.set(key, response);
+      cache2.set(key, response);
       return response;
     }
   };
 }
+function isIsoDate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}(T[\d:.+\-Z]+)?$/.test(value)) return false;
+  return Number.isFinite(Date.parse(value));
+}
+function expiresAtMs(expires) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) return Date.parse(`${expires}T23:59:59.999Z`);
+  return Date.parse(expires);
+}
+function validSuppression(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const row = value;
+  if (typeof row.ruleId !== "string" || row.ruleId.length === 0) return void 0;
+  if (typeof row.owner !== "string" || row.owner.length === 0) return void 0;
+  if (typeof row.reason !== "string" || row.reason.length === 0) return void 0;
+  if (typeof row.expires !== "string" || !isIsoDate(row.expires)) return void 0;
+  const file = row.file === void 0 ? void 0 : row.file.replace(/\\/g, "/");
+  if (row.file !== void 0 && (typeof row.file !== "string" || row.file.length === 0)) return void 0;
+  return { ruleId: row.ruleId, file, owner: row.owner, reason: row.reason, expires: row.expires };
+}
 async function readBaseline(path) {
   try {
     const raw = JSON.parse(await readFile(path, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.findings)) return void 0;
+    if (raw.suppressions !== void 0 && !Array.isArray(raw.suppressions)) return void 0;
     return raw;
   } catch {
     return void 0;
   }
 }
 async function writeBaseline(path, findings) {
+  const existing = await readBaseline(path);
   const doc = {
     version: 1,
     findings: findings.map((f) => ({
@@ -7724,7 +8486,8 @@ async function writeBaseline(path, findings) {
       ruleId: f.ruleId,
       file: f.file,
       line: f.line
-    }))
+    })),
+    ...existing?.suppressions !== void 0 ? { suppressions: existing.suppressions } : {}
   };
   await writeFile(path, `${JSON.stringify(doc, null, 2)}
 `, "utf8");
@@ -7734,6 +8497,30 @@ function applyBaseline(findings, baseline) {
   const known = new Set(baseline.findings.map((f) => f.id));
   return findings.filter((f) => !known.has(f.id));
 }
+function applySuppressions(findings, rows, now = /* @__PURE__ */ new Date()) {
+  if (rows === void 0 || rows.length === 0) return { findings: [...findings], errors: [] };
+  const errors = [];
+  const active = [];
+  rows.forEach((row, index) => {
+    const parsed = validSuppression(row);
+    if (parsed === void 0) {
+      errors.push(`suppression ${index + 1} needs ruleId, owner, reason, and an ISO expires date`);
+      return;
+    }
+    if (expiresAtMs(parsed.expires) < now.getTime()) {
+      errors.push(
+        `suppression for ${parsed.ruleId} expired on ${parsed.expires} (owner: ${parsed.owner}); renew or remove it`
+      );
+      return;
+    }
+    active.push(parsed);
+  });
+  const kept = findings.filter((finding4) => {
+    const file = (finding4.file ?? "").replace(/\\/g, "/");
+    return !active.some((row) => row.ruleId === finding4.ruleId && (row.file === void 0 || row.file === file));
+  });
+  return { findings: kept, errors };
+}
 
 // src/core/config.ts
 init_finding();
@@ -7742,14 +8529,27 @@ var DEFAULT_CONFIG = {
   modules: [...MODULE_NAMES],
   failOn: "high",
   ignore: ["dist/**", "**/*.test.ts"],
+  defaultExcludes: true,
   baseline: ".fullshield-baseline.json",
   notify: { slackWebhookEnv: "FULLSHIELD_SLACK_WEBHOOK" },
   deps: { offline: false },
-  ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 }
+  ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 },
+  sast: { maxFileBytes: 1024 * 1024 }
 };
 var ConfigError = class extends Error {
 };
-var KNOWN_KEYS = /* @__PURE__ */ new Set(["modules", "failOn", "ignore", "baseline", "notify", "deps", "ai"]);
+var KNOWN_KEYS = /* @__PURE__ */ new Set([
+  "modules",
+  "failOn",
+  "ignore",
+  "defaultExcludes",
+  "excludes",
+  "baseline",
+  "notify",
+  "deps",
+  "ai",
+  "sast"
+]);
 function validate(raw, source) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new ConfigError(`${source}: config must be a JSON object`);
@@ -7851,6 +8651,32 @@ function validate(raw, source) {
     }
     out.ai = ai;
   }
+  if (record.defaultExcludes !== void 0) {
+    if (typeof record.defaultExcludes !== "boolean") {
+      throw new ConfigError(`${source}: "defaultExcludes" must be a boolean`);
+    }
+    out.defaultExcludes = record.defaultExcludes;
+  }
+  if (record.excludes !== void 0) {
+    if (!Array.isArray(record.excludes) || record.excludes.some((p) => typeof p !== "string")) {
+      throw new ConfigError(`${source}: "excludes" must be an array of glob strings`);
+    }
+    out.excludes = record.excludes;
+  }
+  if (record.sast !== void 0) {
+    if (typeof record.sast !== "object" || record.sast === null || Array.isArray(record.sast)) {
+      throw new ConfigError(`${source}: "sast" must be an object`);
+    }
+    const rawSast = record.sast;
+    const sast = { maxFileBytes: 1024 * 1024 };
+    if (rawSast.maxFileBytes !== void 0) {
+      if (typeof rawSast.maxFileBytes !== "number" || rawSast.maxFileBytes < 1) {
+        throw new ConfigError(`${source}: "sast.maxFileBytes" must be a positive number`);
+      }
+      sast.maxFileBytes = rawSast.maxFileBytes;
+    }
+    out.sast = sast;
+  }
   return out;
 }
 async function loadConfig(cwd, configPath) {
@@ -7877,10 +8703,26 @@ async function loadConfig(cwd, configPath) {
   return { ...structuredClone(DEFAULT_CONFIG), ...validate(raw, file) };
 }
 var ignoreFactory = ignoreModule.default;
-var ALWAYS_IGNORED = [".git/", "node_modules/", ".fullshield/"];
+var HARD_IGNORED = [".git/", ".fullshield/"];
+var DEFAULT_EXCLUDES = [
+  "node_modules/",
+  "dist/",
+  "build/",
+  ".next/",
+  "coverage/",
+  "vendor/",
+  "vendored/",
+  "third_party/",
+  "third-party/",
+  "compiled/",
+  "*.min.js"
+];
 async function walkFiles(options) {
   const ig = ignoreFactory();
-  ig.add(ALWAYS_IGNORED);
+  ig.add(HARD_IGNORED);
+  if (options.defaultExcludes !== false) {
+    ig.add(options.excludes ?? DEFAULT_EXCLUDES);
+  }
   try {
     ig.add(await readFile(join(options.cwd, ".gitignore"), "utf8"));
   } catch {
@@ -7929,23 +8771,6 @@ async function listStagedFiles(cwd) {
 // src/core/engine.ts
 init_suppression();
 init_finding();
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
 
 // src/policy/index.ts
 init_finding();
@@ -8079,7 +8904,7 @@ function resolvePolicyBranch(cwd, env = process.env) {
     return "*";
   }
 }
-function expiresAtMs(expires) {
+function expiresAtMs2(expires) {
   if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) {
     return Date.parse(`${expires}T23:59:59.999Z`);
   }
@@ -8101,7 +8926,7 @@ function applyPolicy(findings, policy, ctx = {}) {
   });
   const suppressed = /* @__PURE__ */ new Set();
   for (const exception of policy.exceptions ?? []) {
-    if (expiresAtMs(exception.expires) < now.getTime()) {
+    if (expiresAtMs2(exception.expires) < now.getTime()) {
       errors.push(
         `policy exception for ${exception.ruleId} expired on ${exception.expires} (owner: ${exception.owner}); renew or remove it`
       );
@@ -8170,7 +8995,12 @@ async function runScan(options = {}, modules = builtinModules) {
     options.modules ?? config.modules,
     loadedPolicy?.requiredModules
   );
-  let files = await walkFiles({ cwd, ignore: config.ignore });
+  let files = await walkFiles({
+    cwd,
+    ignore: config.ignore,
+    defaultExcludes: config.defaultExcludes,
+    excludes: config.excludes
+  });
   if (options.staged === true) {
     const staged = new Set(await listStagedFiles(cwd));
     files = files.filter((file) => staged.has(file));
@@ -8204,6 +9034,7 @@ async function runScan(options = {}, modules = builtinModules) {
     );
   }
   const extraHits = [];
+  let historyNotice;
   const secretsWanted = modulesRequested.includes("secrets");
   if (secretsAdvEnabled() && secretsWanted) {
     if (options.history === true) {
@@ -8211,6 +9042,7 @@ async function runScan(options = {}, modules = builtinModules) {
       const hist = await scanGitHistory2(cwd);
       extraHits.push(...hist.hits);
       collected.push(...hist.findings);
+      historyNotice = hist.history;
     }
     if (options.bundle !== void 0 && options.bundle.length > 0) {
       const { scanBundle: scanBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
@@ -8231,7 +9063,11 @@ async function runScan(options = {}, modules = builtinModules) {
   if (options.updateBaseline === true) {
     await writeBaseline(baselinePath, unsuppressed);
   }
-  let findings = sortFindings(applyBaseline(unsuppressed, await readBaseline(baselinePath)));
+  const baselineDoc = await readBaseline(baselinePath);
+  let findings = sortFindings(applyBaseline(unsuppressed, baselineDoc));
+  const suppressed = applySuppressions(findings, baselineDoc?.suppressions);
+  findings = sortFindings(suppressed.findings);
+  const suppressionErrors = suppressed.errors;
   if (secretsAdvEnabled() && secretsWanted && options.verifySecrets === true && options.iOwnTheseCredentials === true) {
     const { applyVerification: applyVerification2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
     const { scanTextForSecretHits: scanTextForSecretHits2 } = await Promise.resolve().then(() => (init_secrets(), secrets_exports));
@@ -8303,10 +9139,12 @@ async function runScan(options = {}, modules = builtinModules) {
       cwd,
       filesScanned: files.length,
       modulesRequested: [...modulesRequested],
-      modulesRun
+      modulesRun,
+      ...historyNotice !== void 0 ? { history: historyNotice } : {}
     },
     config,
-    policy: policyResult
+    policy: policyResult,
+    ...suppressionErrors.length > 0 ? { suppressionErrors } : {}
   };
 }
 function scan(options = {}) {