fullshield 0.2.6 → 0.4.0

package/dist/agent.js

@@ -1,10 +1,10 @@
 import { createHash } from 'crypto';
-import { readFile, mkdir, writeFile, stat, readdir } from 'fs/promises';
+import { readFile, mkdir, writeFile, readdir, stat } from 'fs/promises';
 import { resolve, join, basename, dirname, posix, relative } from 'path';
 import { execFile, spawnSync, spawn, execFileSync } from 'child_process';
 import { createInterface } from 'readline';
 import { promisify } from 'util';
-import { existsSync, statSync, readFileSync, readdirSync, writeFileSync, unlinkSync } from 'fs';
+import { existsSync, mkdirSync, writeFileSync, statSync, readFileSync, rmSync, readdirSync, unlinkSync } from 'fs';
 import { performance } from 'perf_hooks';
 import { homedir, availableParallelism } from 'os';
 import { Worker } from 'worker_threads';
@@ -453,7 +453,7 @@ function scanTextForSecretHits(path, text) {
   return hits;
 }
 function scanTextForSecrets(path, text) {
-  return scanTextForSecretHits(path, text).map((hit) => hit.finding);
+  return scanTextForSecretHits(path, text).map((hit2) => hit2.finding);
 }
 var secretsRules, REMEDIATION, MAX_FILE_SIZE, secretsModule;
 var init_secrets = __esm({
@@ -557,6 +557,7 @@ var init_incremental = __esm({
 // src/modules/secrets/history.ts
 var history_exports = {};
 __export(history_exports, {
+  historyCommitLimit: () => historyCommitLimit,
   scanGitHistory: () => scanGitHistory
 });
 function gitError(error) {
@@ -590,16 +591,22 @@ async function readBlob(cwd, hash) {
     return void 0;
   }
 }
-function remapHit(hit, file) {
-  const snippet = hit.finding.snippet;
-  const line = hit.finding.line ?? 0;
-  const id = makeFindingId(hit.finding.ruleId, file, `${line}|${snippet ?? "file"}`);
+function remapHit(hit2, file) {
+  const snippet = hit2.finding.snippet;
+  const line = hit2.finding.line ?? 0;
+  const id = makeFindingId(hit2.finding.ruleId, file, `${line}|${snippet ?? "file"}`);
   return {
-    finding: { ...hit.finding, id, file },
-    secret: hit.secret
+    finding: { ...hit2.finding, id, file },
+    secret: hit2.secret
   };
 }
-async function streamLogChanges(cwd) {
+function historyCommitLimit(raw = process.env.FULLSHIELD_HISTORY_MAX) {
+  if (raw === void 0 || raw.trim() === "") return 500;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 1) return 500;
+  return Math.min(parsed, 5e3);
+}
+async function streamLogChanges(cwd, maxCommits) {
   const changes = [];
   await gitOk(cwd, ["rev-parse", "--is-inside-work-tree"]);
   const child = spawn(
@@ -616,6 +623,8 @@ async function streamLogChanges(cwd) {
       "--format=FSCOMMIT:%H",
       "--no-textconv",
       "--no-ext-diff",
+      "-n",
+      String(maxCommits),
       "HEAD"
     ],
     { stdio: ["ignore", "pipe", "pipe"] }
@@ -678,14 +687,20 @@ async function headSecretKeys(cwd) {
       hits = scanTextForSecretHits(path, text);
       seen.set(hash, hits);
     }
-    for (const hit of hits) {
-      keys.add(`${hit.finding.ruleId}\0${hit.finding.snippet ?? ""}`);
+    for (const hit2 of hits) {
+      keys.add(`${hit2.finding.ruleId}\0${hit2.finding.snippet ?? ""}`);
     }
   }
   return keys;
 }
-async function scanGitHistory(cwd) {
-  const changes = await streamLogChanges(cwd);
+async function commitCount(cwd) {
+  const raw = await gitOk(cwd, ["rev-list", "--count", "HEAD"]);
+  const total = Number(raw.trim());
+  return Number.isInteger(total) && total >= 0 ? total : 0;
+}
+async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
+  const total = await commitCount(cwd);
+  const changes = await streamLogChanges(cwd, maxCommits);
   const blobHits = /* @__PURE__ */ new Map();
   const first = /* @__PURE__ */ new Map();
   for (const change of changes) {
@@ -706,8 +721,8 @@ async function scanGitHistory(cwd) {
       hits2 = rawHits.filter((h) => allowed.has(h.finding.id));
       blobHits.set(change.hash, hits2);
     }
-    for (const hit of hits2) {
-      const mapped = remapHit(hit, change.path);
+    for (const hit2 of hits2) {
+      const mapped = remapHit(hit2, change.path);
       if (!first.has(mapped.finding.id)) {
         first.set(mapped.finding.id, { hit: mapped, commit: change.commit });
       }
@@ -715,14 +730,20 @@ async function scanGitHistory(cwd) {
   }
   const atHead = await headSecretKeys(cwd);
   const hits = [];
-  for (const { hit, commit } of first.values()) {
-    const stillAtHead = atHead.has(`${hit.finding.ruleId}\0${hit.finding.snippet ?? ""}`);
+  for (const { hit: hit2, commit } of first.values()) {
+    const stillAtHead = atHead.has(`${hit2.finding.ruleId}\0${hit2.finding.snippet ?? ""}`);
     hits.push({
-      finding: { ...hit.finding, introducedIn: commit, stillAtHead },
-      secret: hit.secret
+      finding: { ...hit2.finding, introducedIn: commit, stillAtHead },
+      secret: hit2.secret
     });
   }
-  return { findings: hits.map((h) => h.finding), hits };
+  const scanned = Math.min(maxCommits, total);
+  const history = total > maxCommits ? `scanned ${scanned} of ${total} commits` : void 0;
+  return {
+    findings: hits.map((h) => h.finding),
+    hits,
+    ...history !== void 0 ? { history } : {}
+  };
 }
 var execFileAsync2, ZERO_HASH, MAX_BLOB, RAW_LINE;
 var init_history = __esm({
@@ -955,15 +976,15 @@ function providerFor(ruleId, secret) {
 async function verifySecretHits(hits, options = {}) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const out = [];
-  for (const hit of hits) {
-    const secret = hit.secret;
+  for (const hit2 of hits) {
+    const secret = hit2.secret;
     if (secret === void 0 || secret.length === 0) {
-      out.push({ finding: { ...hit.finding, verification: "unknown" }, secret: hit.secret });
+      out.push({ finding: { ...hit2.finding, verification: "unknown" }, secret: hit2.secret });
       continue;
     }
-    const run = providerFor(hit.finding.ruleId, secret);
+    const run = providerFor(hit2.finding.ruleId, secret);
     const verification = run === void 0 ? "unknown" : await run(secret, fetchImpl);
-    out.push({ finding: { ...hit.finding, verification }, secret: hit.secret });
+    out.push({ finding: { ...hit2.finding, verification }, secret: hit2.secret });
   }
   return out;
 }
@@ -1070,7 +1091,8 @@ function walk(node, visit) {
   }
 }
 function attachParents(node, parent) {
-  node.parent = parent;
+  const current = node;
+  if (parent !== void 0 || current.parent === void 0) current.parent = parent;
   for (const key of Object.keys(node)) {
     if (SKIP_KEYS.has(String(key))) continue;
     const value = node[key];
@@ -1143,6 +1165,10 @@ function mcpCfgEnabled() {
 function taintV2Enabled() {
   return process.env.FULLSHIELD_EXPERIMENTAL_TAINT_V2 === "1";
 }
+var LICENSE_FLAG = "FULLSHIELD_EXPERIMENTAL_LICENSE";
+function licenseEnabled() {
+  return process.env[LICENSE_FLAG] === "1";
+}
 
 // src/modules/config/finding.ts
 init_finding();
@@ -1518,6 +1544,169 @@ var configModule = {
 // src/modules/deps/index.ts
 init_finding();
 
+// src/modules/deps/lockfile-modern.ts
+function addEdge(edges, from, to) {
+  if (from.length === 0 || to.length === 0 || from === to) return;
+  const list = edges.get(from) ?? /* @__PURE__ */ new Set();
+  list.add(to);
+  edges.set(from, list);
+}
+function graph(packages, edges, directProd, directDev, edgesKnown) {
+  return { packages, edges, directProd, directDev, edgesKnown };
+}
+function parseYarnBerry(contents) {
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  let current;
+  let inDeps = false;
+  let devBlock = false;
+  for (const raw of contents.split(/\r?\n/)) {
+    if (!raw.startsWith(" ") && raw.trimEnd().endsWith(":")) {
+      const key = raw.slice(0, -1).trim().replace(/^"|"$/g, "");
+      current = key.includes("@workspace:.") ? "" : nameFromBerryKey(key);
+      inDeps = false;
+      devBlock = false;
+      continue;
+    }
+    const version = /^\s+version:\s+(.+)$/.exec(raw)?.[1]?.replace(/["']/g, "").trim();
+    if (version !== void 0 && current !== void 0 && current.length > 0 && !inDeps) {
+      packages.push({ name: current, version: versionFromProtocol(version), path: `yarn:${current}` });
+      continue;
+    }
+    if (/^\s+dependencies:\s*$/.test(raw)) {
+      inDeps = true;
+      devBlock = false;
+      continue;
+    }
+    if (/^\s+devDependencies:\s*$/.test(raw)) {
+      inDeps = true;
+      devBlock = true;
+      continue;
+    }
+    if (!inDeps || current === void 0) continue;
+    const dep = /^\s{4}"?([^":]+)"?:\s+(.+)$/.exec(raw);
+    if (dep?.[1] === void 0) continue;
+    const depName = dep[1];
+    if (current.length === 0) {
+      if (devBlock) directDev.add(depName);
+      else directProd.add(depName);
+    } else {
+      addEdge(edges, current, depName);
+    }
+  }
+  return graph(packages, edges, directProd, directDev, true);
+}
+function nameFromBerryKey(key) {
+  const first = key.split(",")[0]?.trim() ?? key;
+  if (first.startsWith("@")) {
+    const match = /^(@[^@/]+\/[^@/]+)@/.exec(first);
+    return match?.[1];
+  }
+  const at = first.indexOf("@");
+  return at <= 0 ? first : first.slice(0, at);
+}
+function versionFromProtocol(raw) {
+  const patch = /^patch:(.+)#/.exec(raw);
+  const body = patch?.[1] ?? raw;
+  const npm = /^(?:npm:)?(@?[^@]+)@(.+)$/.exec(body);
+  if (npm?.[2] !== void 0) return npm[2];
+  return body;
+}
+function parsePnpmV9(contents) {
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  let block = "none";
+  let snapshot;
+  let inSnapshotDeps = false;
+  for (const raw of contents.split(/\r?\n/)) {
+    if (raw === "packages:") {
+      block = "packages";
+      snapshot = void 0;
+      continue;
+    }
+    if (raw === "snapshots:") {
+      block = "snapshots";
+      snapshot = void 0;
+      continue;
+    }
+    if (raw === "importers:" || raw.startsWith("lockfileVersion:")) {
+      block = "none";
+      continue;
+    }
+    if (block !== "snapshots" && /^\s{4}dependencies:\s*$/.test(raw)) {
+      block = "importer-deps";
+      continue;
+    }
+    if (/^\s{4}devDependencies:\s*$/.test(raw)) {
+      block = "importer-dev";
+      continue;
+    }
+    if (block === "packages") {
+      const header = /^\s{2}['"]?(@?[^@'\s]+)@([^:'"]+)['"]?:/.exec(raw);
+      if (header?.[1] !== void 0 && header[2] !== void 0) {
+        packages.push({ name: header[1], version: header[2], path: `pnpm:${header[1]}` });
+      }
+      continue;
+    }
+    if (block === "snapshots") {
+      const header = /^\s{2}['"]?(@?[^@'\s]+)@([^:'"]+)['"]?:/.exec(raw);
+      if (header?.[1] !== void 0) {
+        snapshot = header[1];
+        inSnapshotDeps = false;
+        continue;
+      }
+      if (/^\s+dependencies:\s*$/.test(raw)) {
+        inSnapshotDeps = true;
+        continue;
+      }
+      if (inSnapshotDeps && snapshot !== void 0) {
+        const dep = /^\s{6}['"]?([^'":]+)['"]?:/.exec(raw);
+        if (dep?.[1] !== void 0) addEdge(edges, snapshot, dep[1]);
+      }
+      continue;
+    }
+    if (block === "importer-deps" || block === "importer-dev") {
+      const dep = /^\s{6}['"]?([^'":]+)['"]?:/.exec(raw);
+      if (dep?.[1] !== void 0 && !raw.trim().startsWith("specifier") && !raw.trim().startsWith("version")) {
+        if (block === "importer-dev") directDev.add(dep[1]);
+        else directProd.add(dep[1]);
+      }
+    }
+  }
+  return graph(packages, edges, directProd, directDev, true);
+}
+function parseBunLock(contents) {
+  const stripped = contents.replace(/^\s*\/\/.*$/gm, "");
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  try {
+    const json = JSON.parse(stripped);
+    for (const [name, value] of Object.entries(json.packages ?? {})) {
+      if (!Array.isArray(value)) continue;
+      const entry = Array.from(value);
+      const spec = typeof entry[0] === "string" ? entry[0] : "";
+      const version = spec.includes("@") ? spec.slice(spec.lastIndexOf("@") + 1) : spec;
+      packages.push({ name, version, path: `bun:${name}` });
+      const meta = entry[1];
+      if (meta !== null && typeof meta === "object" && "dependencies" in meta) {
+        const deps = meta.dependencies;
+        if (deps !== null && typeof deps === "object") {
+          for (const dep of Object.keys(deps)) addEdge(edges, name, dep);
+        }
+      }
+    }
+  } catch {
+    return graph([], /* @__PURE__ */ new Map(), /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set(), false);
+  }
+  return graph(packages, edges, directProd, directDev, packages.length > 0);
+}
+
 // src/modules/deps/lockfile.ts
 function basename2(filename) {
   const parts = filename.replace(/\\/g, "/").split("/");
@@ -1547,7 +1736,7 @@ function objectKeys(value) {
   }
   return Object.keys(value);
 }
-function addEdge(edges, from, to) {
+function addEdge2(edges, from, to) {
   const set = edges.get(from) ?? /* @__PURE__ */ new Set();
   set.add(to);
   edges.set(from, set);
@@ -1627,7 +1816,7 @@ function parseYarnGraph(contents) {
       const depBerry = /^\s{4}(?:"([^"]+)"|(@?[\w./-]+)):/.exec(raw);
       const depName = depClassic?.[1] ?? depClassic?.[2] ?? depBerry?.[1] ?? depBerry?.[2];
       if (depName !== void 0) {
-        addEdge(edges, currentName, depName);
+        addEdge2(edges, currentName, depName);
         continue;
       }
       if (/^\s{2}\S/.test(raw)) inDeps = false;
@@ -1722,7 +1911,7 @@ function parsePnpmGraph(contents) {
         const dep = /^      (?:'([^']+)'|"([^"]+)"|([^:]+)):/.exec(raw);
         const depName = dep?.[1] ?? dep?.[2] ?? dep?.[3];
         if (depName !== void 0) {
-          addEdge(edges, currentPkg, depName);
+          addEdge2(edges, currentPkg, depName);
           continue;
         }
         if (/^    \S/.test(raw)) inPkgDeps = false;
@@ -1754,7 +1943,7 @@ function graphFromPackagesTable(packages) {
     const name = key === "" ? "" : nameFromPackagesKey(key);
     if (name === void 0 || name.length === 0) continue;
     for (const dep of [...objectKeys(value.dependencies), ...objectKeys(value.optionalDependencies)]) {
-      addEdge(edges, name, dep);
+      addEdge2(edges, name, dep);
     }
   }
   return { edges, directProd, directDev };
@@ -1764,7 +1953,7 @@ function graphFromDependenciesTree(deps, edges) {
     const child = value.dependencies;
     if (child === void 0 || typeof child !== "object" || child === null) continue;
     const nested = child;
-    for (const childName of Object.keys(nested)) addEdge(edges, name, childName);
+    for (const childName of Object.keys(nested)) addEdge2(edges, name, childName);
     graphFromDependenciesTree(nested, edges);
   }
 }
@@ -1777,8 +1966,16 @@ function parseLockfileGraph(filename, contents) {
     directDev: /* @__PURE__ */ new Set(),
     edgesKnown: false
   };
-  if (name === "yarn.lock") return parseYarnGraph(contents);
-  if (name === "pnpm-lock.yaml") return parsePnpmGraph(contents);
+  const modern = process.env.FULLSHIELD_EXPERIMENTAL_LOCKFILES === "1";
+  if (name === "yarn.lock") {
+    if (modern && contents.includes("__metadata")) return parseYarnBerry(contents);
+    return parseYarnGraph(contents);
+  }
+  if (name === "pnpm-lock.yaml") {
+    if (modern && /lockfileVersion:\s*['"]?9/.test(contents)) return parsePnpmV9(contents);
+    return parsePnpmGraph(contents);
+  }
+  if (modern && name === "bun.lock") return parseBunLock(contents);
   if (name !== "package-lock.json") return empty;
   try {
     const json = JSON.parse(contents);
@@ -1947,6 +2144,86 @@ function exactPinsFromManifest(pkg) {
   return out;
 }
 
+// src/modules/deps/evidence.ts
+var IMPORT_RE = /(?:require\(\s*['"]([^'"]+)['"]\s*\)|from\s+['"]([^'"]+)['"]|import\(\s*['"]([^'"]+)['"]\s*\))/g;
+function packageNameFromSpec(spec) {
+  if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:")) return void 0;
+  if (spec.startsWith("@")) {
+    const slash2 = spec.indexOf("/");
+    if (slash2 < 0) return void 0;
+    const rest = spec.slice(slash2 + 1);
+    const cut = rest.indexOf("/");
+    return cut === -1 ? spec : spec.slice(0, slash2 + 1 + cut);
+  }
+  const slash = spec.indexOf("/");
+  return slash === -1 ? spec : spec.slice(0, slash);
+}
+function collectImportSites(sources) {
+  const byPkg = /* @__PURE__ */ new Map();
+  const files = [...sources.keys()].sort();
+  for (const file of files) {
+    const text = sources.get(file) ?? "";
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+      const line = lines[i] ?? "";
+      IMPORT_RE.lastIndex = 0;
+      let match;
+      while ((match = IMPORT_RE.exec(line)) !== null) {
+        const spec = match[1] ?? match[2] ?? match[3];
+        if (spec === void 0) continue;
+        const pkg = packageNameFromSpec(spec);
+        if (pkg === void 0) continue;
+        const list = byPkg.get(pkg) ?? [];
+        list.push({ file, line: i + 1, specifier: spec, pkg });
+        byPkg.set(pkg, list);
+      }
+    }
+  }
+  for (const [pkg, list] of byPkg) {
+    list.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+    byPkg.set(pkg, list.slice(0, 5));
+  }
+  return byPkg;
+}
+function evidenceForFinding(finding3, sites, productionFiles, edgesKnown) {
+  if (finding3.ruleId !== "DEPS-VULN-001" && finding3.ruleId !== "DEPS-MALICIOUS-001") return void 0;
+  const snippet = finding3.snippet ?? "";
+  const at = snippet.startsWith("@") ? snippet.indexOf("@", 1) : snippet.indexOf("@");
+  const pkg = at <= 0 ? snippet : snippet.slice(0, at);
+  if (pkg.length === 0) return void 0;
+  const imports = (sites.get(pkg) ?? []).map((site) => ({
+    file: site.file,
+    line: site.line,
+    specifier: site.specifier
+  }));
+  const first = imports[0];
+  const path = finding3.dependencyPath;
+  let reason;
+  switch (finding3.reachability) {
+    case "not-imported":
+      reason = `No production file imports ${pkg}. Checked ${productionFiles.length} production file(s)${productionFiles.length > 0 ? `: ${productionFiles.slice(0, 8).join(", ")}` : ""}.`;
+      return { imports: [], reason };
+    case "reachability-unknown":
+      reason = edgesKnown ? `Reachability for ${pkg} is unknown.` : `Lockfile edges are missing, so ${pkg} is reachability-unknown.`;
+      return { imports, ...first !== void 0 ? {} : {}, reason };
+    case "reachable-via-dependency":
+      reason = path !== void 0 && path.length > 0 ? `Required through ${path.join(" > ")}.` : `Required by an imported package.`;
+      return { imports, ...path !== void 0 ? { dependencyPath: path } : {}, reason };
+    case "imported-not-called":
+      reason = first !== void 0 ? `Imported from ${first.file}:${first.line} and not called.` : `Imported and not called.`;
+      return { imports, reason };
+    case "symbol-reachable":
+      reason = first !== void 0 ? `A named vulnerable export is called from ${first.file}:${first.line}.` : `A named vulnerable export is called.`;
+      return { imports, reason };
+    case "symbol-not-called":
+      reason = `A named vulnerable export is not called.`;
+      return { imports, reason };
+    default:
+      reason = first !== void 0 ? `Imported from ${first.file}:${first.line}.` : `Imported by production code.`;
+      return { imports, ...path !== void 0 ? { dependencyPath: path } : {}, reason };
+  }
+}
+
 // src/modules/deps/reachability.ts
 init_finding();
 
@@ -2054,7 +2331,7 @@ function packageNameFromSnippet(snippet) {
   const at = snippet.indexOf("@");
   return at <= 0 ? snippet : snippet.slice(0, at);
 }
-function packageNameFromSpec(spec) {
+function packageNameFromSpec2(spec) {
   if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:")) return void 0;
   if (spec.startsWith("@")) {
     const parts = spec.split("/");
@@ -2090,7 +2367,7 @@ function indexPackageUsage(sources) {
         const local = m[1];
         const spec = m[2];
         if (local === void 0 || spec === void 0) continue;
-        const pkg = packageNameFromSpec(spec);
+        const pkg = packageNameFromSpec2(spec);
         if (pkg === void 0) continue;
         bump(pkg, localIsCalled(source, local));
       }
@@ -2100,7 +2377,7 @@ function indexPackageUsage(sources) {
     while ((named = namedRe.exec(source)) !== null) {
       const spec = named[2];
       if (spec === void 0) continue;
-      const pkg = packageNameFromSpec(spec);
+      const pkg = packageNameFromSpec2(spec);
       if (pkg === void 0) continue;
       const locals = (named[1] ?? "").split(",").map((s) => s.trim().split(/\s+as\s+/).pop() ?? "");
       bump(
@@ -2132,37 +2409,82 @@ function shortestDependencyPath(target, starts, edges) {
   }
   return void 0;
 }
+function collectDependencyPaths(target, starts, edges, limit = 8) {
+  const out = [];
+  const queue = [];
+  let steps = 0;
+  for (const start of starts) queue.push([start]);
+  while (queue.length > 0 && out.length < limit && steps < 4e3) {
+    steps += 1;
+    const path = queue.shift();
+    if (path === void 0) continue;
+    const last = path[path.length - 1];
+    if (last === void 0) continue;
+    if (last === target) {
+      if (path.length >= 2) out.push(path);
+      continue;
+    }
+    if (path.length >= 12) continue;
+    for (const next of edges.get(last) ?? []) {
+      if (path.includes(next)) continue;
+      queue.push([...path, next]);
+    }
+  }
+  return out;
+}
 function reachableFrom(target, roots, edges) {
   if (roots.has(target)) return true;
   return shortestDependencyPath(target, roots, edges) !== void 0;
 }
-function importedDirectNames(usage, graph) {
-  const directs = /* @__PURE__ */ new Set([...graph.directProd, ...graph.directDev]);
+function importedDirectNames(usage, graph2) {
+  const directs = /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]);
   const out = /* @__PURE__ */ new Set();
-  for (const [name, hit] of usage) {
-    if (!hit.imported) continue;
+  for (const [name, hit2] of usage) {
+    if (!hit2.imported) continue;
     if (directs.size === 0 || directs.has(name)) out.add(name);
   }
   return out;
 }
-function classifyReachability(pkgName, productionUsage, graph) {
-  const hit = productionUsage.get(pkgName);
-  if (hit?.imported === true) {
-    return { reachability: hit.called ? "reachable" : "imported-not-called" };
+function classifyReachability(pkgName, productionUsage, graph2) {
+  const hit2 = productionUsage.get(pkgName);
+  if (hit2?.imported === true) {
+    return { reachability: hit2.called ? "reachable" : "imported-not-called" };
   }
-  if (graph !== void 0 && graph.edgesKnown) {
-    const roots = importedDirectNames(productionUsage, graph);
-    const path = shortestDependencyPath(pkgName, roots, graph.edges);
+  if (graph2 !== void 0 && graph2.edgesKnown) {
+    const roots = importedDirectNames(productionUsage, graph2);
+    const paths = collectDependencyPaths(pkgName, roots, graph2.edges);
+    const path = paths[0];
     if (path !== void 0 && path.length >= 2) {
-      return { reachability: "reachable-via-dependency", path };
+      return { reachability: "reachable-via-dependency", path, paths };
     }
     return { reachability: "not-imported" };
   }
-  if (graph !== void 0 && !graph.edgesKnown) {
+  if (graph2 !== void 0 && !graph2.edgesKnown) {
     return { reachability: "reachability-unknown" };
   }
   return { reachability: "not-imported" };
 }
+function unusedDirectPackages(ctx) {
+  if (!ctx.graph.edgesKnown) return [];
+  const imported = importedDirectNames(ctx.productionUsage, ctx.graph);
+  return [...ctx.graph.directProd].filter((name) => {
+    if (ctx.productionUsage.get(name)?.imported === true) return false;
+    return !reachableFrom(name, imported, ctx.graph.edges);
+  }).sort();
+}
+function unusedDirectPlan(findings, ctx) {
+  const packages = unusedDirectPackages(ctx);
+  if (packages.length === 0) return void 0;
+  const names = new Set(packages);
+  let advisories = 0;
+  for (const finding3 of findings) {
+    if (finding3.ruleId !== "DEPS-VULN-001" && finding3.ruleId !== "DEPS-MALICIOUS-001") continue;
+    if (finding3.snippet === void 0) continue;
+    const pkg = packageNameFromSnippet(finding3.snippet);
+    if (pkg !== void 0 && names.has(pkg)) advisories += 1;
+  }
+  return { packages, advisories };
+}
 function reachabilitySteps(reachability) {
   if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
@@ -2184,8 +2506,108 @@ function isDevOnly(pkgName, ctx) {
   if (inProd) return false;
   return directDev.has(pkgName) || reachableFrom(pkgName, directDev, edges);
 }
+var REACH_RANK = {
+  reachable: 0,
+  "symbol-reachable": 1,
+  "reachable-via-dependency": 2,
+  "imported-not-called": 3,
+  "symbol-not-called": 4,
+  "reachability-unknown": 5,
+  "not-imported": 6
+};
+function versionFromSnippet(snippet) {
+  const name = packageNameFromSnippet(snippet);
+  if (name === void 0) return snippet;
+  return snippet.slice(name.length + 1);
+}
+function pathFields(classified) {
+  const paths = classified.paths ?? (classified.path !== void 0 ? [classified.path] : []);
+  if (paths.length === 0) return {};
+  return {
+    dependencyPath: paths[0],
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
+function appendOtherPaths(message, paths) {
+  if (paths === void 0 || paths.length < 2) return message;
+  const rest = paths.slice(1).map((p) => p.join(" > ")).join("; ");
+  return `${message} Other paths: ${rest}.`;
+}
+function groupPackageAdvisories(findings) {
+  const passthrough = [];
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding3 of findings) {
+    if (finding3.ruleId !== "DEPS-VULN-001" && finding3.ruleId !== "DEPS-MALICIOUS-001") {
+      passthrough.push(finding3);
+      continue;
+    }
+    const name = packageNameFromSnippet(finding3.snippet ?? "") ?? finding3.snippet ?? finding3.id;
+    const advisory = finding3.references?.[0] ?? finding3.id;
+    const key = `${finding3.ruleId}\0${name}\0${advisory}`;
+    const list = groups.get(key);
+    if (list === void 0) groups.set(key, [finding3]);
+    else list.push(finding3);
+  }
+  const merged = [];
+  for (const list of groups.values()) {
+    const only = list[0];
+    if (list.length === 1 && only !== void 0) {
+      merged.push(only);
+      continue;
+    }
+    merged.push(mergeAdvisory(list));
+  }
+  return [...passthrough, ...merged];
+}
+function mergeAdvisory(list) {
+  const ranked = [...list].sort(
+    (a, b) => severityRank(b.severity) - severityRank(a.severity) || (REACH_RANK[a.reachability ?? "not-imported"] ?? 9) - (REACH_RANK[b.reachability ?? "not-imported"] ?? 9)
+  );
+  const primary = ranked[0];
+  if (primary === void 0) {
+    throw new Error("empty advisory group");
+  }
+  const name = packageNameFromSnippet(primary.snippet ?? "") ?? "package";
+  const versions = [...new Set(list.map((f) => versionFromSnippet(f.snippet ?? "")))].filter((v) => v.length > 0).sort();
+  const paths = [];
+  const seenPath = /* @__PURE__ */ new Set();
+  for (const finding3 of list) {
+    const candidates = finding3.dependencyPaths ?? (finding3.dependencyPath !== void 0 ? [finding3.dependencyPath] : []);
+    for (const path of candidates) {
+      const key = path.join("\0");
+      if (seenPath.has(key)) continue;
+      seenPath.add(key);
+      paths.push(path);
+    }
+  }
+  paths.sort((a, b) => a.length - b.length || a.join(">").localeCompare(b.join(">")));
+  const advisory = primary.references?.[0] ?? "";
+  const onManifest = list.find((f) => f.file === "package.json");
+  const file = onManifest?.file ?? primary.file;
+  const line = onManifest?.line ?? primary.line;
+  const snippet = versions.length > 0 ? `${name}@${versions.join(",")}` : primary.snippet ?? name;
+  let message = primary.message;
+  if (versions.length > 1) {
+    message = `${message} Versions: ${versions.join(", ")}.`;
+  }
+  if (paths.length > 1) {
+    message = `${message} Dependency paths: ${paths.map((p) => p.join(" > ")).join("; ")}.`;
+  }
+  return {
+    ...primary,
+    id: makeFindingId(primary.ruleId, file, `${name}|${advisory}|${versions.join(",")}`),
+    file,
+    line,
+    snippet,
+    message,
+    severity: primary.severity,
+    reachability: primary.reachability,
+    ...paths[0] !== void 0 ? { dependencyPath: paths[0] } : {},
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
 function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
-  return findings.map((finding3) => {
+  const mapped = findings.map((finding3) => {
     if (finding3.ruleId === "DEPS-MALICIOUS-001") {
       if (finding3.snippet === void 0) return finding3;
       const pkg2 = packageNameFromSnippet(finding3.snippet);
@@ -2195,7 +2617,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
         ...finding3,
         severity: "critical",
         reachability: classified2.reachability,
-        ...classified2.path !== void 0 ? { dependencyPath: classified2.path } : {}
+        ...pathFields(classified2)
       };
     }
     if (finding3.ruleId !== "DEPS-VULN-001" || finding3.snippet === void 0) return finding3;
@@ -2205,7 +2627,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     const named = symbols.get(finding3.id) ?? [];
     if (named.length > 0 && ctx.sources !== void 0) {
       const symbolClass = classifySymbolUse(named, ctx.sources);
-      classified = { reachability: symbolClass, path: classified.path };
+      classified = { reachability: symbolClass, path: classified.path, paths: classified.paths };
     }
     const steps = reachabilitySteps(classified.reachability);
     let severity = steps === 0 ? finding3.severity : downgradeSeverity(finding3.severity, steps);
@@ -2213,6 +2635,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     if (classified.path !== void 0) {
       const shown = classified.path.join(" > ");
       message = `${message} Reachable via ${shown}.`;
+      message = appendOtherPaths(message, classified.paths);
     }
     const devOnly = isDevOnly(pkg, ctx);
     if (devOnly) {
@@ -2222,11 +2645,12 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     return {
       ...finding3,
       reachability: classified.reachability,
-      ...classified.path !== void 0 ? { dependencyPath: classified.path } : {},
+      ...pathFields(classified),
       severity,
       message
     };
   });
+  return groupPackageAdvisories(mapped);
 }
 
 // src/modules/deps/semver.ts
@@ -2283,6 +2707,176 @@ function osvSeverity(vuln) {
   return "high";
 }
 
+// src/modules/deps/upgrade-plan.ts
+function sentenceFor(bumps, unresolved) {
+  const parts = [];
+  if (bumps.length === 1) {
+    const bump = bumps[0];
+    if (bump !== void 0) {
+      const noun = bump.findings === 1 ? "finding" : "findings";
+      parts.push(`1 bump (${bump.name} ${bump.from} \u2192 ${bump.to}) resolves ${bump.findings} ${noun}.`);
+    }
+  } else if (bumps.length > 1) {
+    const listed = bumps.map((bump) => `${bump.name} ${bump.from} \u2192 ${bump.to}`).join(", ");
+    const total = bumps.reduce((sum, bump) => sum + bump.findings, 0);
+    const noun = total === 1 ? "finding" : "findings";
+    parts.push(`${bumps.length} bumps (${listed}) resolve ${total} ${noun}.`);
+  }
+  if (unresolved.length > 0) {
+    parts.push(`No fixed version in the OSV cache for ${unresolved.join(", ")}.`);
+  }
+  return parts.join(" ");
+}
+function chooseUpgradePlan(advisories) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const advisory of advisories) {
+    const list = byName.get(advisory.name);
+    if (list === void 0) byName.set(advisory.name, [advisory]);
+    else list.push(advisory);
+  }
+  const unresolved = [];
+  const candidates = [];
+  for (const [name, list] of byName) {
+    const from = list[0]?.from ?? "0.0.0";
+    if (list.some((advisory) => advisory.fixed === void 0)) {
+      unresolved.push(name);
+      continue;
+    }
+    let to = list[0]?.fixed;
+    for (const advisory of list) {
+      if (advisory.fixed !== void 0 && (to === void 0 || compareSemver(advisory.fixed, to) > 0)) {
+        to = advisory.fixed;
+      }
+    }
+    if (to === void 0 || compareSemver(to, from) <= 0) continue;
+    candidates.push({
+      name,
+      from,
+      to,
+      ids: list.map((advisory) => advisory.id)
+    });
+  }
+  unresolved.sort();
+  const chosen = smallestMaxCover(candidates);
+  if (chosen.length === 0 && unresolved.length === 0) return void 0;
+  const bumps = chosen.map((candidate) => ({
+    name: candidate.name,
+    from: candidate.from,
+    to: candidate.to,
+    safe: sameMajor(candidate.from, candidate.to),
+    findings: candidate.ids.length
+  }));
+  return { bumps, unresolved, sentence: sentenceFor(bumps, unresolved) };
+}
+function smallestMaxCover(candidates) {
+  const limit = Math.min(candidates.length, 12);
+  let best = [];
+  let bestCount = -1;
+  const walk2 = (index, picked, covered) => {
+    if (index === limit) {
+      if (covered.size > bestCount || covered.size === bestCount && betterTie(picked, best)) {
+        best = picked;
+        bestCount = covered.size;
+      }
+      return;
+    }
+    const next = candidates[index];
+    if (next === void 0) return;
+    walk2(index + 1, picked, covered);
+    const grown = new Set(covered);
+    for (const id of next.ids) grown.add(id);
+    walk2(index + 1, [...picked, next], grown);
+  };
+  walk2(0, [], /* @__PURE__ */ new Set());
+  return [...best].sort((a, b) => a.name.localeCompare(b.name));
+}
+function betterTie(picked, best) {
+  if (picked.length !== best.length) return picked.length < best.length;
+  const left = picked.map((item) => item.name).sort().join("\0");
+  const right = best.map((item) => item.name).sort().join("\0");
+  return left < right;
+}
+
+// src/supply/campaign.ts
+init_finding();
+var RPC_RE = /getSignaturesForAddress|eth_getLogs/;
+var NET_RE = /https\.request|http\.request|fetch\s*\(|axios\./;
+var EVAL_RE = /\beval\s*\(/;
+var STEAL_RE = /Login Data|leveldb|discord[\\/]Local Storage|wallet-extension|Ethereum\/keystore/i;
+var PLATFORM_RE = /process\.platform\s*===\s*['"]win32['"]|os\.platform\s*\(\s*\)/;
+var DOWNLOAD_RE = /https?:\/\/example\.invalid|createWriteStream|https\.get/;
+var SPAWN_RE = /child_process|spawn\s*\(|execFile\s*\(|\.exe['"]/;
+function hit(ruleId, title, message, file, severity) {
+  return {
+    id: makeFindingId(ruleId, file, message),
+    ruleId,
+    module: "deps",
+    title,
+    severity,
+    confidence: "high",
+    file,
+    message,
+    remediation: "Do not install this package. Remove it, delete node_modules, and reinstall from a clean lockfile."
+  };
+}
+function campaignFindings(files) {
+  const findings = [];
+  for (const source of files) {
+    const hasChain = RPC_RE.test(source.text);
+    const hasNet = NET_RE.test(source.text) || EVAL_RE.test(source.text);
+    if (hasChain && hasNet) {
+      findings.push(
+        hit(
+          "SUPPLY-CHAINC2-001",
+          "Package reads a blockchain RPC and then fetches or evaluates the result",
+          "static: RPC method combined with fetch or eval",
+          source.file,
+          "high"
+        )
+      );
+    }
+    const steals = STEAL_RE.test(source.text);
+    const callsNet = NET_RE.test(source.text);
+    if (steals && callsNet) {
+      findings.push(
+        hit(
+          "SUPPLY-STEALER-001",
+          "Package reads a local credential store and makes a network call",
+          "static: browser, chat, or wallet path combined with a network call",
+          source.file,
+          "critical"
+        )
+      );
+    }
+    const gated2 = PLATFORM_RE.test(source.text);
+    const downloads = DOWNLOAD_RE.test(source.text);
+    const spawns = SPAWN_RE.test(source.text);
+    if (gated2 && downloads && spawns) {
+      findings.push(
+        hit(
+          "SUPPLY-PLATFORMGATE-001",
+          "Package downloads and launches a file only on one platform",
+          "static: platform check combined with a download and a process spawn",
+          source.file,
+          "high"
+        )
+      );
+    }
+  }
+  return findings;
+}
+function securityPlaceholderFinding(name, locked, latest) {
+  if (latest !== "0.0.1-security") return void 0;
+  if (locked === "0.0.1-security") return void 0;
+  return hit(
+    "SUPPLY-SECHOLDER-001",
+    `Locked ${name}@${locked} was replaced on the registry by the security placeholder`,
+    `${name} latest is 0.0.1-security while the lockfile pins ${locked}`,
+    "package-lock.json",
+    "critical"
+  );
+}
+
 // src/modules/deps/popular.ts
 var POPULAR_PACKAGES = [
   "express",
@@ -4128,6 +4722,59 @@ function experimentalVex() {
   return process.env.FULLSHIELD_EXPERIMENTAL_VEX === "1";
 }
 
+// src/modules/deps/license.ts
+init_finding();
+var COPYLEFT = /(?:^|[^\w])(?:AGPL|GPL)(?:-|[^\w]|$)/i;
+function isCopyleftLicense(license) {
+  return COPYLEFT.test(license);
+}
+function licenseText(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && value !== null && "type" in value) {
+    const type = value.type;
+    if (typeof type === "string") return type;
+  }
+  return void 0;
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function scanCopyleftLicenses(cwd) {
+  const manifest = await readJson(join(cwd, "package.json"));
+  if (typeof manifest !== "object" || manifest === null) return [];
+  const names = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    const block = manifest[field];
+    if (typeof block === "object" && block !== null && !Array.isArray(block)) {
+      for (const name of Object.keys(block)) names.add(name);
+    }
+  }
+  const findings = [];
+  for (const name of names) {
+    const pkg = await readJson(join(cwd, "node_modules", name, "package.json"));
+    if (typeof pkg !== "object" || pkg === null) continue;
+    const license = licenseText(pkg.license);
+    if (license === void 0 || !isCopyleftLicense(license)) continue;
+    findings.push({
+      id: makeFindingId("DEPS-LICENSE-001", "package.json", `${name}|${license}`),
+      ruleId: "DEPS-LICENSE-001",
+      module: "deps",
+      title: `Copyleft dependency ${name}`,
+      severity: "medium",
+      confidence: "high",
+      file: "package.json",
+      snippet: `${name} ${license}`,
+      message: `${name} is licensed ${license}.`,
+      remediation: "Replace the dependency or get a legal review before shipping it in a commercial product."
+    });
+  }
+  return findings;
+}
+
 // src/fixer/eol.ts
 function detectEol(text) {
   return text.includes("\r\n") ? "\r\n" : "\n";
@@ -4226,7 +4873,7 @@ function walkJs(dir, out = []) {
   }
   return out;
 }
-function readJson(path) {
+function readJson2(path) {
   return JSON.parse(readFileSync(path, "utf8"));
 }
 var TOKEN_RE = /(?:~\/)?\.npmrc\b|\bNPM_TOKEN\b|\bGITHUB_TOKEN\b/;
@@ -4240,7 +4887,7 @@ function packageSources(dir) {
   let scripts = "";
   if (existsSync(manifestPath) && statSync(manifestPath).isFile()) {
     try {
-      const pkg = readJson(manifestPath);
+      const pkg = readJson2(manifestPath);
       const block = pkg.scripts ?? {};
       scripts = Object.values(block).join("\n");
     } catch {
@@ -4261,7 +4908,7 @@ ${scripts}`;
   if (!TOKEN_RE.test(text)) return [];
   const replicates = PUBLISH_RE.test(text) || REGISTRY_PUT_RE.test(text) || GITHUB_CREATE_RE.test(text) || WORKFLOW_PATH_RE.test(text);
   if (!replicates) return [];
-  const hit = sources.find(
+  const hit2 = sources.find(
     (s) => TOKEN_RE.test(s.text) && (PUBLISH_RE.test(s.text) || REGISTRY_PUT_RE.test(s.text) || GITHUB_CREATE_RE.test(s.text) || WORKFLOW_PATH_RE.test(s.text))
   ) ?? sources.find((s) => TOKEN_RE.test(s.text));
   return [
@@ -4269,7 +4916,7 @@ ${scripts}`;
       "SUPPLY-WORM-001",
       "Self-replicating worm indicators in dependency code",
       "static: npm/GitHub token read combined with publish, registry PUT, GitHub repo/workflow creation, or writing .github/workflows",
-      hit?.file,
+      hit2?.file,
       "critical"
     )
   ];
@@ -4279,13 +4926,13 @@ function analyzeWorkflowTampering(dir) {
   const text = `${sources.map((s) => s.text).join("\n")}
 ${scripts}`;
   if (!CI_WRITE_RE.test(text)) return [];
-  const hit = sources.find((s) => CI_WRITE_RE.test(s.text));
+  const hit2 = sources.find((s) => CI_WRITE_RE.test(s.text));
   return [
     finding(
       "SUPPLY-WORKFLOW-001",
       "Dependency writes GitHub workflow, git hooks, or CI config",
       "static: install script or package code writes .github/, .git/hooks/, or CI configuration",
-      hit?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
+      hit2?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
       "critical"
     )
   ];
@@ -4307,8 +4954,8 @@ function parentsOf(name, edges) {
   }
   return out;
 }
-function isDirect(name, graph) {
-  return graph.directProd.has(name) || graph.directDev.has(name);
+function isDirect(name, graph2) {
+  return graph2.directProd.has(name) || graph2.directDev.has(name);
 }
 function packagesWithAFixedRelease(findings) {
   const names = /* @__PURE__ */ new Set();
@@ -4326,17 +4973,17 @@ function targetVersion(finding3) {
 function kindFromLockfile(lockFile) {
   return lockfileKind(lockFile) ?? "npm";
 }
-function attachOverrideProposals(findings, graph, lockFile, manifestRaw) {
-  if (!graph.edgesKnown || manifestRaw === void 0) return findings;
+function attachOverrideProposals(findings, graph2, lockFile, manifestRaw) {
+  if (!graph2.edgesKnown || manifestRaw === void 0) return findings;
   const withFix = packagesWithAFixedRelease(findings);
   const kind = kindFromLockfile(lockFile);
   return findings.map((finding3) => {
     if (finding3.ruleId !== "DEPS-VULN-001" || finding3.snippet === void 0) return finding3;
     const name = packageNameFromSnippet2(finding3.snippet);
-    if (name.length === 0 || isDirect(name, graph)) return finding3;
+    if (name.length === 0 || isDirect(name, graph2)) return finding3;
     const version = targetVersion(finding3);
     if (version === void 0) return finding3;
-    const parentFixed = parentsOf(name, graph.edges).some((parent) => withFix.has(parent));
+    const parentFixed = parentsOf(name, graph2.edges).some((parent) => withFix.has(parent));
     if (parentFixed) return finding3;
     const after = withManifestOverride(manifestRaw, kind, name, version);
     const diff = unifiedDiff("package.json", manifestRaw, after);
@@ -4357,10 +5004,10 @@ function scanInstalledPackages(cwd, packages) {
     const dir = packageDir(cwd, pkg);
     if (dir === void 0) continue;
     const prefix = pkg.path.startsWith("node_modules/") ? pkg.path : `node_modules/${pkg.name}`;
-    for (const hit of [...analyzeWormIndicators(dir), ...analyzeWorkflowTampering(dir)]) {
+    for (const hit2 of [...analyzeWormIndicators(dir), ...analyzeWorkflowTampering(dir)]) {
       out.push({
-        ...hit,
-        file: hit.file !== void 0 && hit.file.length > 0 ? `${prefix}/${hit.file}` : prefix
+        ...hit2,
+        file: hit2.file !== void 0 && hit2.file.length > 0 ? `${prefix}/${hit2.file}` : prefix
       });
     }
   }
@@ -4439,19 +5086,19 @@ function maliciousFinding(lockFile, pkg, vuln) {
     references: [vuln.id, ...vuln.aliases ?? []]
   };
 }
-function typosquatFinding(lockFile, hit) {
-  const snippet = `${hit.name}@${hit.version}`;
+function typosquatFinding(lockFile, hit2) {
+  const snippet = `${hit2.name}@${hit2.version}`;
   return {
     id: makeFindingId("DEPS-TYPOSQUAT-001", lockFile, snippet),
     ruleId: "DEPS-TYPOSQUAT-001",
     module: "deps",
-    title: `Possible typosquat: ${hit.name}`,
+    title: `Possible typosquat: ${hit2.name}`,
     severity: "medium",
     confidence: "low",
     file: lockFile,
     snippet,
-    message: `Package "${hit.name}" is 1 character from popular package "${hit.lookalike}" (possible typosquat).`,
-    remediation: `Confirm you intended to install "${hit.name}". If not, remove it and depend on "${hit.lookalike}" instead.`
+    message: `Package "${hit2.name}" is 1 character from popular package "${hit2.lookalike}" (possible typosquat).`,
+    remediation: `Confirm you intended to install "${hit2.name}". If not, remove it and depend on "${hit2.lookalike}" instead.`
   };
 }
 function noLockFinding() {
@@ -4485,6 +5132,8 @@ function deprecatedFinding(lockFile, pkg) {
 var depsModule = {
   name: "deps",
   async run(ctx) {
+    depsModule.unusedDirect = void 0;
+    depsModule.upgradePlan = void 0;
     const lockFile = LOCKFILE_NAMES.find((name) => ctx.files.includes(name));
     const cacheDir = ctx.config.deps.cacheDir !== void 0 ? resolve(ctx.cwd, ctx.config.deps.cacheDir) : defaultCacheDir();
     const osvOpts = { cacheDir, offline: ctx.config.deps.offline };
@@ -4510,21 +5159,21 @@ var depsModule = {
       }
       const pins = exactPinsFromManifest(manifest);
       const directNames2 = await readDirectDependencyNames(ctx.cwd);
-      for (const hit of findTyposquats(pins, { directNames: directNames2 })) {
-        findings2.push(typosquatFinding("package.json", hit));
+      for (const hit2 of findTyposquats(pins, { directNames: directNames2 })) {
+        findings2.push(typosquatFinding("package.json", hit2));
       }
       const osvHits2 = await queryOsv(pins, osvOpts);
       const symbols2 = /* @__PURE__ */ new Map();
-      for (const hit of osvHits2) {
-        for (const vuln of hit.vulns) {
-          const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+      for (const hit2 of osvHits2) {
+        for (const vuln of hit2.vulns) {
+          const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit2.pkg, vuln) : vulnFinding("package.json", hit2.pkg, vuln, depLoc(hit2.pkg.name));
           const names = affectedFunctionNames(vuln);
           if (names.length > 0 && finding3.ruleId === "DEPS-VULN-001") symbols2.set(finding3.id, names);
           findings2.push(finding3);
         }
       }
       const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
-      return applyReachability(findings2, noLockCtx, symbols2);
+      return withWorkspaceAdvisories(ctx.cwd, manifestRaw, osvOpts, applyReachability(findings2, noLockCtx, symbols2));
     }
     let contents;
     try {
@@ -4532,12 +5181,12 @@ var depsModule = {
     } catch {
       return [];
     }
-    const graph = parseLockfileGraph(lockFile, contents);
-    const packages = graph.packages;
+    const graph2 = parseLockfileGraph(lockFile, contents);
+    const packages = graph2.packages;
     const findings = [];
     const directNames = await readDirectDependencyNames(ctx.cwd);
-    for (const hit of findTyposquats(packages, { directNames })) {
-      findings.push(typosquatFinding(lockFile, hit));
+    for (const hit2 of findTyposquats(packages, { directNames })) {
+      findings.push(typosquatFinding(lockFile, hit2));
     }
     for (const pkg of packages) {
       if (pkg.deprecated !== void 0) {
@@ -4546,22 +5195,129 @@ var depsModule = {
     }
     const osvHits = await queryOsv(packages, osvOpts);
     const symbols = /* @__PURE__ */ new Map();
-    for (const hit of osvHits) {
-      for (const vuln of hit.vulns) {
-        const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+    for (const hit2 of osvHits) {
+      for (const vuln of hit2.vulns) {
+        const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit2.pkg, vuln) : vulnFinding(lockFile, hit2.pkg, vuln, depLoc(hit2.pkg.name));
         const names = affectedFunctionNames(vuln);
         if (names.length > 0 && finding3.ruleId === "DEPS-VULN-001") symbols.set(finding3.id, names);
         findings.push(finding3);
       }
     }
-    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
+    const reachCtx = await reachabilityCtx(ctx.cwd, ctx.files, graph2);
+    let reached = applyReachability(findings, reachCtx, symbols);
     if (experimentalVex()) {
-      reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
+      reached = attachOverrideProposals(reached, graph2, lockFile, manifestRaw);
       reached.push(...scanInstalledPackages(ctx.cwd, packages));
     }
+    if (licenseEnabled()) reached.push(...await scanCopyleftLicenses(ctx.cwd));
+    depsModule.unusedDirect = unusedDirectPlan(reached, reachCtx);
+    const direct = /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]);
+    const advisories = [];
+    for (const hit2 of osvHits) {
+      if (!direct.has(hit2.pkg.name)) continue;
+      for (const vuln of hit2.vulns) {
+        if (isMaliciousAdvisory(vuln)) continue;
+        advisories.push({
+          name: hit2.pkg.name,
+          from: hit2.pkg.version,
+          id: vuln.id,
+          fixed: minFixedVersion(vuln.affected ?? [])
+        });
+      }
+    }
+    depsModule.upgradePlan = chooseUpgradePlan(advisories);
+    if (process.env.FULLSHIELD_EXPERIMENTAL_REACH_EVIDENCE === "1") {
+      const sites = collectImportSites(reachCtx.sources);
+      const files = [...reachCtx.sources.keys()].sort();
+      reached = reached.map((finding3) => {
+        const evidence = evidenceForFinding(finding3, sites, files, graph2.edgesKnown);
+        return evidence === void 0 ? finding3 : { ...finding3, reachabilityEvidence: evidence };
+      });
+    }
+    reached = await withWorkspaceAdvisories(ctx.cwd, manifestRaw, osvOpts, reached);
+    if (process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY === "1") {
+      reached.push(...campaignFindings([...reachCtx.sources.entries()].map(([file, text]) => ({ file, text }))));
+      for (const name of [...direct].sort()) {
+        const locked = packages.find((pkg) => pkg.name === name)?.version;
+        if (locked === void 0) continue;
+        const latest = await readPlaceholderLatest(join(cacheDir, "registry", `${name.replaceAll("/", "__")}.json`));
+        const placeholder = securityPlaceholderFinding(name, locked, latest);
+        if (placeholder !== void 0) reached.push(placeholder);
+      }
+    }
     return reached;
   }
 };
+function workspacesEnabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_WORKSPACES === "1";
+}
+function workspacePatterns(manifestRaw) {
+  try {
+    const manifest = JSON.parse(manifestRaw);
+    const field = manifest.workspaces;
+    if (Array.isArray(field)) return field.filter((item) => typeof item === "string");
+    if (field !== null && typeof field === "object" && Array.isArray(field.packages)) {
+      return field.packages.filter((item) => typeof item === "string");
+    }
+  } catch {
+    return [];
+  }
+  return [];
+}
+async function expandWorkspace(cwd, pattern) {
+  const normalized = pattern.replace(/\\/g, "/").replace(/^\.\//, "");
+  if (!normalized.includes("*")) return [normalized];
+  const slash = normalized.indexOf("/*");
+  if (slash < 0) return [];
+  const parent = normalized.slice(0, slash);
+  try {
+    const entries = await readdir(join(cwd, parent), { withFileTypes: true });
+    return entries.filter((entry) => entry.isDirectory()).map((entry) => `${parent}/${entry.name}`).sort();
+  } catch {
+    return [];
+  }
+}
+async function workspaceAdvisoryFindings(cwd, manifestRaw, osvOpts) {
+  const dirs = /* @__PURE__ */ new Set();
+  for (const pattern of workspacePatterns(manifestRaw)) {
+    for (const dir of await expandWorkspace(cwd, pattern)) dirs.add(dir);
+  }
+  const findings = [];
+  for (const dir of [...dirs].sort()) {
+    if (dir === "" || dir === ".") continue;
+    const lockName = LOCKFILE_NAMES.find((name) => existsSync(join(cwd, dir, name)));
+    if (lockName === void 0) continue;
+    let text;
+    try {
+      text = await readFile(join(cwd, dir, lockName), "utf8");
+    } catch {
+      continue;
+    }
+    const graph2 = parseLockfileGraph(lockName, text);
+    const hits = await queryOsv(graph2.packages, osvOpts);
+    const file = `${dir}/${lockName}`;
+    for (const hit2 of hits) {
+      for (const vuln of hit2.vulns) {
+        findings.push(
+          isMaliciousAdvisory(vuln) ? maliciousFinding(file, hit2.pkg, vuln) : vulnFinding(file, hit2.pkg, vuln)
+        );
+      }
+    }
+  }
+  return findings;
+}
+async function withWorkspaceAdvisories(cwd, manifestRaw, osvOpts, findings) {
+  if (!workspacesEnabled() || manifestRaw === void 0) return findings;
+  return [...findings, ...await workspaceAdvisoryFindings(cwd, manifestRaw, osvOpts)];
+}
+async function readPlaceholderLatest(file) {
+  try {
+    const raw = JSON.parse(await readFile(file, "utf8"));
+    return typeof raw.latest === "string" ? raw.latest : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function graphFromManifest(manifest) {
   const keys = (field) => {
     const block = manifest[field];
@@ -4578,7 +5334,7 @@ function graphFromManifest(manifest) {
     edgesKnown: false
   };
 }
-async function reachabilityCtx(cwd, files, graph) {
+async function reachabilityCtx(cwd, files, graph2) {
   const prodSources = /* @__PURE__ */ new Map();
   for (const rel of files) {
     if (!/\.[cm]?[jt]sx?$/.test(rel)) continue;
@@ -4588,7 +5344,7 @@ async function reachabilityCtx(cwd, files, graph) {
     } catch {
     }
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
+  return { productionUsage: indexPackageUsage(prodSources), graph: graph2, sources: prodSources };
 }
 
 // src/modules/mcp/index.ts
@@ -4940,10 +5696,143 @@ init_finding();
 // src/modules/sast/interproc.ts
 init_finding();
 
-// src/modules/sast/frameworks.ts
-var NEXT_HANDLERS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
-var NEST_HTTP = /^(Get|Post|Put|Patch|Delete|All|Head|Options)$/;
-var NEST_INPUT = /^(Body|Query|Param|Headers)$/;
+// src/runtime/lru.ts
+var LruMap = class {
+  constructor(max) {
+    this.max = max;
+    if (max < 1) throw new Error("LruMap max must be >= 1");
+  }
+  max;
+  map = /* @__PURE__ */ new Map();
+  get size() {
+    return this.map.size;
+  }
+  has(key) {
+    return this.map.has(key);
+  }
+  get(key) {
+    if (!this.map.has(key)) return void 0;
+    const value = this.map.get(key);
+    this.map.delete(key);
+    this.map.set(key, value);
+    return value;
+  }
+  set(key, value) {
+    if (this.map.has(key)) this.map.delete(key);
+    this.map.set(key, value);
+    while (this.map.size > this.max) {
+      const oldest = this.map.keys().next().value;
+      if (oldest === void 0) break;
+      this.map.delete(oldest);
+    }
+    return this;
+  }
+};
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+
+// src/core/parse-pool.ts
+var workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+var cache = new LruMap(64);
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
+  }
+  return Math.min(2, Math.max(1, availableParallelism() - 1));
+}
+function workerMemoryMb() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
+  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
+  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
+  return 512;
+}
+function parseCacheDir() {
+  return join(homedir(), ".cache", "fullshield", "parse");
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit2 = cache.get(key);
+  if (hit2 !== void 0) return Promise.resolve(hit2);
+  return new Promise((resolve5, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), {
+      workerData: { code },
+      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
+    });
+    let settled = false;
+    const finish = () => {
+      void worker.terminate();
+    };
+    const succeed = (ast) => {
+      if (settled) return;
+      settled = true;
+      cache.set(key, ast);
+      finish();
+      resolve5(ast);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      finish();
+      reject(error);
+    };
+    worker.once("message", (ast) => {
+      succeed(ast);
+    });
+    worker.once("error", (error) => {
+      fail(error);
+    });
+    worker.once("exit", (code2) => {
+      if (settled) return;
+      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
+    });
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
+
+// src/modules/sast/frameworks.ts
+var NEXT_HANDLERS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+var NEST_HTTP = /^(Get|Post|Put|Patch|Delete|All|Head|Options)$/;
+var NEST_INPUT = /^(Body|Query|Param|Headers)$/;
 var REQ_READERS = /* @__PURE__ */ new Set(["json", "formData", "text", "arrayBuffer"]);
 var HONO_READERS = /* @__PURE__ */ new Set(["query", "param", "header", "json", "parseBody", "text"]);
 function decoratorExpr(dec) {
@@ -5075,6 +5964,10 @@ function isMcpArgsTaintSource(node) {
 }
 
 // src/modules/sast/taint.ts
+var customTaint;
+function setCustomTaint(config) {
+  customTaint = config;
+}
 var SCHEMA_ROOT = /^(z|zod|joi|yup|schema)$/i;
 function objectChainMentions(node, pattern) {
   let current = node;
@@ -5220,6 +6113,61 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
       return false;
   }
 }
+function valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners) {
+  if (node === void 0) return false;
+  if (isCoercionCall(node) || isSchemaValidatorCall(node) || isMongoSanitizeCall(node)) return false;
+  if (node.type === "Identifier") {
+    if (nosqlSanitized.has(node.name)) return false;
+    return built.has(node.name) || tainted.has(node.name);
+  }
+  if (isRequestObjectNode(node)) return true;
+  if (node.type === "AwaitExpression") {
+    return valueFeedsFilter(node.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  if (node.type === "CallExpression" && node.callee.type === "Identifier" && filterReturners.has(node.callee.name)) {
+    return true;
+  }
+  if (node.type === "ObjectExpression") {
+    return node.properties.some((prop) => {
+      if (prop.type === "SpreadElement") {
+        return valueFeedsFilter(prop.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+      }
+      if (prop.type !== "Property") return false;
+      return valueFeedsFilter(prop.value, tainted, returners, nosqlSanitized, built, filterReturners);
+    });
+  }
+  if (node.type === "ArrayExpression") {
+    return node.elements.some((el) => {
+      if (el === null) return false;
+      if (el.type === "SpreadElement") {
+        return valueFeedsFilter(el.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+      }
+      return valueFeedsFilter(el, tainted, returners, nosqlSanitized, built, filterReturners);
+    });
+  }
+  if (node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+    return node.arguments.some(
+      (arg) => arg.type !== "SpreadElement" && valueFeedsFilter(arg, tainted, returners, nosqlSanitized, built, filterReturners)
+    );
+  }
+  if (node.type === "ChainExpression" || node.type === "TSAsExpression" || node.type === "TSNonNullExpression" || node.type === "TSTypeAssertion" || node.type === "MemberExpression") {
+    return exprIsTainted(node, tainted, returners);
+  }
+  return false;
+}
+function initIsBuiltFilter(node, tainted, returners, nosqlSanitized, built, filterReturners) {
+  if (node.type === "AwaitExpression") {
+    return initIsBuiltFilter(node.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  if (node.type === "Identifier") return built.has(node.name) && !nosqlSanitized.has(node.name);
+  if (node.type === "CallExpression" && node.callee.type === "Identifier" && filterReturners.has(node.callee.name)) {
+    return true;
+  }
+  if (node.type === "ObjectExpression" || node.type === "ArrayExpression") {
+    return valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  return node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign" && valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners);
+}
 function exprIsSanitized(node, tainted, names, isCall, returners = NO_RETURNERS) {
   if (node === void 0) return true;
   if (isCall(node)) return true;
@@ -5283,7 +6231,7 @@ function seedMcpToolParams(scope, tainted) {
     for (const name of boundNames(param)) tainted.add(name);
   }
 }
-function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
+function analyzeScope(scope, seed = [], returners = NO_RETURNERS, filterReturners = NO_RETURNERS, initialBuilt = NO_RETURNERS) {
   const tainted = new Set(seed);
   seedDestructuredRequestParams(scope, tainted);
   seedFrameworkParams(scope, tainted);
@@ -5291,6 +6239,8 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
   const urlSanitized = /* @__PURE__ */ new Set();
   const xssSanitized = /* @__PURE__ */ new Set();
   const nosqlSanitized = /* @__PURE__ */ new Set();
+  const sqlCleared = /* @__PURE__ */ new Set();
+  const customPath = /* @__PURE__ */ new Set();
   let changed = true;
   while (changed) {
     changed = false;
@@ -5301,6 +6251,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
           for (const name of boundNames(node.id)) nosqlSanitized.add(name);
         }
         if (isSchemaValidatorCall(init)) return;
+        applyCustomCall(init, boundNames(node.id), tainted, sqlCleared, customPath);
         if (isUrlSanitizerCall(init)) {
           for (const name of boundNames(node.id)) urlSanitized.add(name);
         }
@@ -5321,6 +6272,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
           for (const name of boundNames(node.left)) nosqlSanitized.add(name);
         }
         if (isSchemaValidatorCall(node.right)) return;
+        applyCustomCall(node.right, boundNames(node.left), tainted, sqlCleared, customPath);
         if (isUrlSanitizerCall(node.right)) {
           for (const name of boundNames(node.left)) urlSanitized.add(name);
         }
@@ -5347,7 +6299,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
       for (const name of boundNames(node.left)) resolved.add(name);
     }
   });
-  const pathSanitized = /* @__PURE__ */ new Set();
+  const pathSanitized = new Set(customPath);
   walkScope(scope, (node) => {
     if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
     if (propName(node.callee) !== "startsWith") return;
@@ -5389,17 +6341,92 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
       for (const name of boundNames(node.left)) requestObjects.add(name);
     }
   });
+  const builtFilters = new Set(initialBuilt);
+  let grew = true;
+  while (grew) {
+    grew = false;
+    const add = (names) => {
+      for (const name of names) {
+        if (nosqlSanitized.has(name) || builtFilters.has(name)) continue;
+        builtFilters.add(name);
+        grew = true;
+      }
+    };
+    walkScope(scope, (node) => {
+      if (node.type === "VariableDeclarator" && node.init !== null) {
+        if (initIsBuiltFilter(node.init, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+          add(boundNames(node.id));
+        }
+      }
+      if (node.type !== "AssignmentExpression") return;
+      if (node.left.type === "Identifier" && initIsBuiltFilter(node.right, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+        add([node.left.name]);
+      }
+      if (node.left.type === "MemberExpression" && node.left.object.type === "Identifier" && valueFeedsFilter(node.right, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+        add([node.left.object.name]);
+      }
+    });
+  }
   return {
     tainted,
     pathSanitized,
+    sqlCleared,
     urlSanitized,
     xssSanitized,
     nosqlSanitized,
     hasPasswordName,
     requestObjects,
+    builtFilters,
+    filterReturners: new Set(filterReturners),
     returners: new Set(returners)
   };
 }
+function locallyDeclared(scope) {
+  const names = /* @__PURE__ */ new Set();
+  if (isFunctionNode(scope)) {
+    for (const param of scope.params) {
+      for (const name of boundNames(param)) names.add(name);
+    }
+  }
+  walkScope(scope, (node) => {
+    if (node.type === "VariableDeclarator") {
+      for (const name of boundNames(node.id)) names.add(name);
+    }
+    if (node.type === "FunctionDeclaration" && node.id !== null) names.add(node.id.name);
+  });
+  return names;
+}
+function inheritedBuiltFilters(fn, facts) {
+  const local = locallyDeclared(fn);
+  const inherited = /* @__PURE__ */ new Set();
+  let parent = fn.parent;
+  while (parent !== void 0 && !isFunctionNode(parent)) {
+    parent = parent.parent;
+  }
+  const outer = parent === void 0 ? void 0 : facts.get(parent);
+  if (outer === void 0) return inherited;
+  for (const name of outer.builtFilters) {
+    if (!local.has(name)) inherited.add(name);
+  }
+  return inherited;
+}
+function scopeReturnsBuiltFilter(scope, facts) {
+  let yes = false;
+  walkScope(scope, (node) => {
+    if (node.type !== "ReturnStatement" || node.argument === null) return;
+    if (initIsBuiltFilter(
+      node.argument,
+      facts.tainted,
+      facts.returners,
+      facts.nosqlSanitized,
+      facts.builtFilters,
+      facts.filterReturners
+    )) {
+      yes = true;
+    }
+  });
+  return yes;
+}
 function functionName(fn) {
   if (fn.type === "FunctionDeclaration" && fn.id !== null) return fn.id.name;
   if (isFunctionNode(fn) && fn.id !== null && fn.id.type === "Identifier") return fn.id.name;
@@ -5474,7 +6501,7 @@ function seedTaintV2(functions, facts, seeds, returners, nameToFn) {
   }
   return changed;
 }
-function analyzeFile(ast, extraReturners = NO_RETURNERS) {
+function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   attachParents(ast);
   const facts = /* @__PURE__ */ new WeakMap();
   const functions = [];
@@ -5488,12 +6515,13 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   }
   const seeds = /* @__PURE__ */ new Map();
   for (const fn of functions) seeds.set(fn, /* @__PURE__ */ new Set());
-  const returners = new Set(extraReturners);
+  const returners = new Set(extraReturners2);
+  const filterReturners = /* @__PURE__ */ new Set();
   for (let hop = 0; hop < MAX_TAINT_HOPS; hop += 1) {
     let changed = false;
-    facts.set(ast, analyzeScope(ast, [], returners));
+    facts.set(ast, analyzeScope(ast, [], returners, filterReturners));
     for (const fn of functions) {
-      facts.set(fn, analyzeScope(fn, seeds.get(fn) ?? [], returners));
+      facts.set(fn, analyzeScope(fn, seeds.get(fn) ?? [], returners, filterReturners, inheritedBuiltFilters(fn, facts)));
     }
     for (const fn of functions) {
       const name = functionName(fn);
@@ -5503,6 +6531,10 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
         returners.add(name);
         changed = true;
       }
+      if (scopeReturnsBuiltFilter(fn, f) && !filterReturners.has(name)) {
+        filterReturners.add(name);
+        changed = true;
+      }
     }
     for (const fn of functions) {
       const f = facts.get(fn);
@@ -5535,6 +6567,54 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   }
   return facts;
 }
+var SQL_SINK_NAMES = /* @__PURE__ */ new Set(["query", "execute"]);
+var CMD_SINK_NAMES = /* @__PURE__ */ new Set(["exec", "execSync", "spawn", "spawnSync"]);
+var PATH_SINK_NAMES = /* @__PURE__ */ new Set(["readFile", "readFileSync", "writeFile", "writeFileSync"]);
+function sinkClasses(scope, tainted, returners) {
+  const found = /* @__PURE__ */ new Set();
+  walkScope(scope, (node) => {
+    if (node.type !== "CallExpression") return;
+    const name = calleeName(node);
+    const first = node.arguments[0];
+    if (name === void 0 || first === void 0 || first.type === "SpreadElement") return;
+    if (!exprIsTainted(first, tainted, returners)) return;
+    if (SQL_SINK_NAMES.has(name)) found.add("sqli");
+    if (CMD_SINK_NAMES.has(name)) found.add("cmdi");
+    if (PATH_SINK_NAMES.has(name)) found.add("path");
+  });
+  return [...found].sort();
+}
+function fileTaintSummary(ast) {
+  attachParents(ast);
+  const facts = analyzeFile(ast);
+  const returnsTaint = [];
+  const functions = [];
+  walk(ast, (node) => {
+    if (!isFunctionNode(node)) return;
+    const name = functionName(node);
+    const own = facts.get(node);
+    if (name === void 0 || own === void 0) return;
+    if (scopeReturnsTaint(node, own.tainted, own.returners)) returnsTaint.push(name);
+    const paramsToReturn = [];
+    const sinks = [];
+    node.params.forEach((param, index) => {
+      const pname = boundNames(param)[0];
+      if (pname === void 0) return;
+      const seeded = analyzeScope(node, [pname]);
+      if (scopeReturnsTaint(node, seeded.tainted, seeded.returners)) paramsToReturn.push(index);
+      for (const cls of sinkClasses(node, seeded.tainted, seeded.returners)) sinks.push({ param: index, class: cls });
+    });
+    functions.push({
+      name,
+      line: node.loc?.start.line ?? 0,
+      paramsToReturn,
+      sinks
+    });
+  });
+  returnsTaint.sort();
+  functions.sort((a, b) => a.line - b.line || a.name.localeCompare(b.name));
+  return { returnsTaint, functions };
+}
 function functionsThatReturnTaint(ast) {
   attachParents(ast);
   const names = /* @__PURE__ */ new Set();
@@ -5556,18 +6636,50 @@ function factsFor(node, map) {
   return map.get(enclosingScope(node)) ?? {
     tainted: /* @__PURE__ */ new Set(),
     pathSanitized: /* @__PURE__ */ new Set(),
+    sqlCleared: /* @__PURE__ */ new Set(),
     urlSanitized: /* @__PURE__ */ new Set(),
     xssSanitized: /* @__PURE__ */ new Set(),
     nosqlSanitized: /* @__PURE__ */ new Set(),
     hasPasswordName: false,
     requestObjects: /* @__PURE__ */ new Set(),
+    builtFilters: /* @__PURE__ */ new Set(),
+    filterReturners: /* @__PURE__ */ new Set(),
     returners: /* @__PURE__ */ new Set()
   };
 }
+function nodeHoldsBuiltFilter(node, map) {
+  const facts = factsFor(node, map);
+  if (node.type === "Identifier") return facts.builtFilters.has(node.name);
+  if (node.type === "AwaitExpression") return nodeHoldsBuiltFilter(node.argument, map);
+  if (node.type === "CallExpression" && node.callee.type === "Identifier") {
+    return facts.filterReturners.has(node.callee.name);
+  }
+  return false;
+}
 function nodeIsTainted(node, map) {
   const facts = factsFor(node, map);
   return exprIsTainted(node, facts.tainted, facts.returners);
 }
+function nodeIsSqlCleared(node, map) {
+  if (node.type === "Identifier") return factsFor(node, map).sqlCleared.has(node.name);
+  return false;
+}
+function applyCustomCall(init, names, tainted, sqlCleared, customPath) {
+  if (customTaint === void 0 || init === void 0 || init.type !== "CallExpression") return;
+  const called2 = calleeName(init);
+  if (called2 === void 0) return;
+  if (customTaint.sources.has(called2)) {
+    for (const name of names) tainted.add(name);
+  }
+  const clears = customTaint.sanitizers.get(called2);
+  if (clears === void 0) return;
+  if (clears.has("sqli")) {
+    for (const name of names) sqlCleared.add(name);
+  }
+  if (clears.has("path")) {
+    for (const name of names) customPath.add(name);
+  }
+}
 function nodeIsPathSanitized(node, map) {
   if (node.type !== "Identifier") return false;
   return factsFor(node, map).pathSanitized.has(node.name);
@@ -5590,6 +6702,147 @@ function nodeIsNosqlSanitized(node, map) {
   return false;
 }
 
+// src/modules/sast/summaries.ts
+function taintSummariesEnabled() {
+  return process.env.FULLSHIELD_TAINT_SUMMARIES === "1";
+}
+var configHash = "";
+function setTaintSummaryConfig(config) {
+  fileMemo.clear();
+  if (config === void 0) {
+    configHash = "";
+    return;
+  }
+  configHash = createHash("sha256").update(
+    JSON.stringify({
+      maxFileBytes: config.sast.maxFileBytes,
+      sources: config.sast.sources ?? [],
+      sanitizers: config.sast.sanitizers ?? [],
+      taintV2: taintV2Enabled(),
+      frameworks: frameworksEnabled(),
+      gaps: sastGapsEnabled(),
+      classes: classesEnabled(),
+      custom: process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1"
+    })
+  ).digest("hex");
+}
+function summaryDir() {
+  return process.env.FULLSHIELD_TAINT_SUMMARY_DIR ?? join(parseCacheDir(), "taint");
+}
+function taintSummaryKey(source, extra = "") {
+  return createHash("sha256").update(packageVersion()).update("\0").update(configHash).update("\0").update(extra).update("\0").update(source).digest("hex");
+}
+function summaryPath(key) {
+  return join(summaryDir(), `${key}.json`);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function readJson3(key) {
+  let text;
+  try {
+    text = readFileSync(summaryPath(key), "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    discard(key);
+    return void 0;
+  }
+}
+function discard(key) {
+  rmSync(summaryPath(key), { force: true });
+}
+function writeJson(key, value) {
+  const dir = summaryDir();
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(summaryPath(key), JSON.stringify(value));
+}
+function readFileSummary(key) {
+  const raw = readJson3(key);
+  if (typeof raw !== "object" || raw === null) {
+    if (raw !== void 0) discard(key);
+    return void 0;
+  }
+  const row = raw;
+  if (row.v !== 1 || !isStringArray(row.returnsTaint) || !Array.isArray(row.functions)) {
+    discard(key);
+    return void 0;
+  }
+  return row;
+}
+var fileMemo = /* @__PURE__ */ new Map();
+function cachedReturners(source, ast) {
+  const key = taintSummaryKey(source, "file");
+  const memo = fileMemo.get(key);
+  if (memo !== void 0) return new Set(memo.returnsTaint);
+  const cached = readFileSummary(key);
+  if (cached !== void 0) {
+    fileMemo.set(key, cached);
+    return new Set(cached.returnsTaint);
+  }
+  const summary = fileTaintSummary(ast);
+  const stored = { v: 1, returnsTaint: summary.returnsTaint, functions: summary.functions };
+  fileMemo.set(key, stored);
+  writeJson(key, stored);
+  return new Set(stored.returnsTaint);
+}
+function lists(facts) {
+  const names = (set) => [...set].sort();
+  return {
+    v: 1,
+    tainted: names(facts.tainted),
+    pathSanitized: names(facts.pathSanitized),
+    sqlCleared: names(facts.sqlCleared),
+    urlSanitized: names(facts.urlSanitized),
+    xssSanitized: names(facts.xssSanitized),
+    nosqlSanitized: names(facts.nosqlSanitized),
+    requestObjects: names(facts.requestObjects),
+    builtFilters: names(facts.builtFilters),
+    filterReturners: names(facts.filterReturners),
+    returners: names(facts.returners),
+    hasPasswordName: facts.hasPasswordName
+  };
+}
+function factsFrom(row) {
+  return {
+    tainted: new Set(row.tainted),
+    pathSanitized: new Set(row.pathSanitized),
+    sqlCleared: new Set(row.sqlCleared),
+    urlSanitized: new Set(row.urlSanitized),
+    xssSanitized: new Set(row.xssSanitized),
+    nosqlSanitized: new Set(row.nosqlSanitized),
+    requestObjects: new Set(row.requestObjects),
+    builtFilters: new Set(row.builtFilters),
+    filterReturners: new Set(row.filterReturners),
+    returners: new Set(row.returners),
+    hasPasswordName: row.hasPasswordName
+  };
+}
+function readFacts(key) {
+  const raw = readJson3(key);
+  if (typeof raw !== "object" || raw === null) {
+    if (raw !== void 0) discard(key);
+    return void 0;
+  }
+  const row = raw;
+  if (row.v !== 1 || !isStringArray(row.tainted) || !isStringArray(row.pathSanitized) || !isStringArray(row.sqlCleared) || !isStringArray(row.urlSanitized) || !isStringArray(row.xssSanitized) || !isStringArray(row.nosqlSanitized) || !isStringArray(row.requestObjects) || !isStringArray(row.builtFilters) || !isStringArray(row.filterReturners) || !isStringArray(row.returners) || typeof row.hasPasswordName !== "boolean") {
+    discard(key);
+    return void 0;
+  }
+  return factsFrom(row);
+}
+function cachedFunctionFacts(fileSource, fn, seed) {
+  const key = taintSummaryKey(fileSource, `seed:${fn.loc?.start.line ?? 0}:${seed.join(",")}`);
+  const cached = readFacts(key);
+  if (cached !== void 0) return cached;
+  const facts = analyzeFunctionWithSeed(fn, seed);
+  writeJson(key, lists(facts));
+  return facts;
+}
+
 // src/modules/sast/interproc.ts
 var MAX_HOPS = 5;
 function collectFunctions(file, ast) {
@@ -5700,22 +6953,22 @@ function collectInstances(ast, ns) {
     if (node.type !== "VariableDeclarator" || node.init === null) return;
     if (node.id.type !== "Identifier" || node.init.type !== "NewExpression") return;
     if (node.init.callee.type !== "Identifier") return;
-    const hit = ns.get(node.init.callee.name);
-    if (hit === void 0) return;
-    instances.set(node.id.name, hit.includes("#") ? hit.split("#")[0] ?? hit : hit);
+    const hit2 = ns.get(node.init.callee.name);
+    if (hit2 === void 0) return;
+    instances.set(node.id.name, hit2.includes("#") ? hit2.split("#")[0] ?? hit2 : hit2);
   });
   return instances;
 }
 function resolveCallee(node, ns, instances, currentFile, functions) {
   if (node.type !== "CallExpression") return void 0;
   if (node.callee.type === "Identifier") {
-    const hit = ns.get(node.callee.name);
-    if (hit !== void 0) {
-      if (hit.includes("#")) {
-        const [file, name] = hit.split("#");
+    const hit2 = ns.get(node.callee.name);
+    if (hit2 !== void 0) {
+      if (hit2.includes("#")) {
+        const [file, name] = hit2.split("#");
         if (file !== void 0 && name !== void 0) return { file, name };
       }
-      return { file: hit, name: node.callee.name };
+      return { file: hit2, name: node.callee.name };
     }
     if (functions.has(`${currentFile}#${node.callee.name}`)) {
       return { file: currentFile, name: node.callee.name };
@@ -5822,9 +7075,9 @@ function runInterproc(parsed) {
     if (fn === void 0) continue;
     const param = fn.params[seed.paramIndex];
     if (param === void 0) continue;
-    const facts = analyzeFunctionWithSeed(fn.node, [param]);
     const p = byFile.get(fn.file);
     if (p === void 0) continue;
+    const facts = taintSummariesEnabled() ? cachedFunctionFacts(p.source, fn.node, [param]) : analyzeFunctionWithSeed(fn.node, [param]);
     const ns = requires.get(fn.file) ?? /* @__PURE__ */ new Map();
     const inst = instances.get(fn.file) ?? /* @__PURE__ */ new Map();
     walk(fn.node, (node) => {
@@ -6247,6 +7500,178 @@ var jwtRule = {
   }
 };
 
+// src/modules/sast/validation.ts
+var PRIMITIVE = /* @__PURE__ */ new Set(["string", "number", "boolean", "IsString", "IsNumber", "IsInt", "IsBoolean"]);
+var OPEN = /* @__PURE__ */ new Set(["any", "unknown", "object", "array", "record", "lazy", "union", "tuple"]);
+var SCHEMA_ROOT2 = /* @__PURE__ */ new Set(["z", "zod", "Joi", "joi"]);
+var ROUTE_METHODS = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
+function validationEnabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_VALIDATION === "1";
+}
+function parentOf(node) {
+  return node.parent;
+}
+function mentions(node, names) {
+  let current = node;
+  for (let i = 0; i < 12 && current !== void 0; i += 1) {
+    if (current.type === "CallExpression") {
+      const name = calleeName(current);
+      if (name !== void 0 && names.has(name)) return true;
+      current = current.callee.type === "MemberExpression" ? current.callee.object : void 0;
+      continue;
+    }
+    if (current.type === "MemberExpression") {
+      const name = propName(current);
+      if (name !== void 0 && names.has(name)) return true;
+      current = current.object;
+      continue;
+    }
+    if (current.type === "Identifier" && names.has(current.name)) return true;
+    break;
+  }
+  return false;
+}
+function rootName(node) {
+  let current = node;
+  for (let i = 0; i < 8 && current !== void 0; i += 1) {
+    if (current.type === "Identifier") return current.name;
+    if (current.type === "CallExpression") {
+      current = current.callee;
+      continue;
+    }
+    if (current.type === "MemberExpression") {
+      current = current.object;
+      continue;
+    }
+    break;
+  }
+  return void 0;
+}
+function propertyName(prop) {
+  if (prop.type !== "Property") return void 0;
+  const key = prop.key;
+  if (key.type === "Identifier") return key.name;
+  if (key.type === "Literal" && typeof key.value === "string") return key.value;
+  return void 0;
+}
+function fieldsOfObjectSchema(node) {
+  if (node.type !== "CallExpression" || calleeName(node) !== "object") return /* @__PURE__ */ new Set();
+  const root = rootName(node.callee);
+  if (root === void 0 || !SCHEMA_ROOT2.has(root)) return /* @__PURE__ */ new Set();
+  const arg = node.arguments[0];
+  if (arg === void 0 || arg.type !== "ObjectExpression") return /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const prop of arg.properties) {
+    if (prop.type !== "Property") continue;
+    const name = propertyName(prop);
+    if (name === void 0) continue;
+    if (mentions(prop.value, OPEN)) continue;
+    if (mentions(prop.value, PRIMITIVE)) fields.add(name);
+  }
+  return fields;
+}
+function decoratorName2(decorator) {
+  const expr = decorator.type === "Decorator" ? decorator.expression : decorator;
+  if (expr === void 0) return void 0;
+  if (expr.type === "CallExpression") return calleeName(expr);
+  if (expr.type === "Identifier") return expr.name;
+  return void 0;
+}
+function fieldsOfClass(node) {
+  if (node.type !== "ClassDeclaration" && node.type !== "ClassExpression") return /* @__PURE__ */ new Set();
+  if (node.body.type !== "ClassBody") return /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const element of node.body.body) {
+    if (element.type !== "PropertyDefinition") continue;
+    const key = element.key;
+    const name = key.type === "Identifier" ? key.name : void 0;
+    if (name === void 0) continue;
+    const decorators = element.decorators ?? [];
+    if (decorators.some((decorator) => PRIMITIVE.has(decoratorName2(decorator) ?? ""))) fields.add(name);
+  }
+  return fields;
+}
+function programOf(node) {
+  let current = node;
+  while (current !== void 0 && current.type !== "Program") current = parentOf(current);
+  return current;
+}
+function bindings(program) {
+  const map = /* @__PURE__ */ new Map();
+  walk(program, (node) => {
+    if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.init !== null && node.init !== void 0) {
+      const fields = fieldsOfObjectSchema(node.init);
+      if (fields.size > 0) map.set(node.id.name, fields);
+    }
+    if (node.type === "ClassDeclaration" && node.id !== null) {
+      const fields = fieldsOfClass(node);
+      if (fields.size > 0) map.set(node.id.name, fields);
+    }
+  });
+  return map;
+}
+var bindingCache = /* @__PURE__ */ new WeakMap();
+function fieldsOfExpr(expr, known) {
+  if (expr.type === "Identifier") return new Set(known.get(expr.name) ?? []);
+  if (expr.type === "ClassExpression" || expr.type === "ClassDeclaration") return fieldsOfClass(expr);
+  const direct = fieldsOfObjectSchema(expr);
+  if (expr.type !== "CallExpression") return direct;
+  for (const arg of expr.arguments) {
+    if (arg.type === "SpreadElement") continue;
+    for (const name of fieldsOfExpr(arg, known)) direct.add(name);
+  }
+  return direct;
+}
+function isRouteCall2(node) {
+  if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return false;
+  const method = propName(node.callee);
+  if (method === void 0 || !ROUTE_METHODS.has(method)) return false;
+  return node.callee.object.type === "Identifier" && /^(app|router)$/i.test(node.callee.object.name);
+}
+function routeOf(node) {
+  let current = node;
+  while (current !== void 0) {
+    const parent = parentOf(current);
+    if (isFunctionNode(current) && parent !== void 0 && isRouteCall2(parent)) return parent;
+    current = parent;
+  }
+  return void 0;
+}
+function requestField(node) {
+  if (node.type !== "MemberExpression" || node.computed === true) return void 0;
+  const field = node.property.type === "Identifier" ? node.property.name : void 0;
+  if (field === void 0 || node.object.type !== "MemberExpression" || node.object.computed === true) return void 0;
+  const bag = node.object.property.type === "Identifier" ? node.object.property.name : void 0;
+  if (bag !== "body" && bag !== "query" && bag !== "params") return void 0;
+  if (node.object.object.type !== "Identifier" || node.object.object.name !== "req") return void 0;
+  return field;
+}
+var routeCache = /* @__PURE__ */ new WeakMap();
+function fieldsForRoute(route) {
+  const cached = routeCache.get(route);
+  if (cached !== void 0) return cached;
+  const program = programOf(route);
+  const known = program === void 0 ? /* @__PURE__ */ new Map() : bindingCache.get(program) ?? bindings(program);
+  if (program !== void 0) bindingCache.set(program, known);
+  const fields = /* @__PURE__ */ new Set();
+  if (route.type === "CallExpression") {
+    for (const arg of route.arguments) {
+      if (arg.type === "SpreadElement" || isFunctionNode(arg)) continue;
+      for (const name of fieldsOfExpr(arg, known)) fields.add(name);
+    }
+  }
+  routeCache.set(route, fields);
+  return fields;
+}
+function isValidatedRouteField(node) {
+  if (!validationEnabled()) return false;
+  const field = requestField(node);
+  if (field === void 0) return false;
+  const route = routeOf(node);
+  if (route === void 0) return false;
+  return fieldsForRoute(route).has(field);
+}
+
 // src/modules/sast/rules/nosqli.ts
 var MONGO_SINKS = /* @__PURE__ */ new Set([
   "find",
@@ -6331,6 +7756,7 @@ function isNosqlSafeValue(node, source, isNosqlSanitized) {
   if (isNosqlSanitized(node) || isCoercionCall(node) || isSchemaValidatorCall(node) || isMongoSanitizeCall(node)) {
     return true;
   }
+  if (isValidatedRouteField(node)) return true;
   return isSanitizeWrap(node, source);
 }
 function objectHasUnsafeTaintedValue(node, isTainted, isSafe) {
@@ -6394,6 +7820,14 @@ var nosqliRule = {
           return;
         }
         if (middleware) return;
+        if (ctx.holdsBuiltFilter(filter)) {
+          ctx.report({
+            node,
+            message: "A Mongo filter built from request input is passed to the query.",
+            confidence: "medium"
+          });
+          return;
+        }
         if (objectHasUnsafeTaintedValue(filter, (n) => ctx.isTainted(n), isSafe)) {
           ctx.report({
             node,
@@ -6570,7 +8004,7 @@ var sqliRule = {
       CallExpression(node) {
         if (node.type !== "CallExpression" || !isSqlSink2(node)) return;
         const sql = node.arguments[0];
-        if (sql !== void 0 && sql.type !== "SpreadElement" && ctx.isTainted(sql)) {
+        if (sql !== void 0 && sql.type !== "SpreadElement" && ctx.isTainted(sql) && !ctx.isSqlCleared(sql)) {
           ctx.report({
             node,
             message: "Tainted input is concatenated into a SQL string passed to query/execute."
@@ -6720,27 +8154,27 @@ function numberLiteral(node) {
   return node.value;
 }
 function containsIdentMember(node, objectName) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
     if (child.type === "MemberExpression" && child.object.type === "Identifier" && child.object.name === objectName) {
-      hit = true;
+      hit2 = true;
     }
   });
-  return hit;
+  return hit2;
 }
 function containsCallNamed(node, name) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
-    if (child.type === "CallExpression" && calleeName(child) === name) hit = true;
+    if (child.type === "CallExpression" && calleeName(child) === name) hit2 = true;
   });
-  return hit;
+  return hit2;
 }
 function containsOriginalName(node) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
-    if (child.type === "MemberExpression" && propName(child) === "originalname") hit = true;
+    if (child.type === "MemberExpression" && propName(child) === "originalname") hit2 = true;
   });
-  return hit;
+  return hit2;
 }
 function schemaLooksSafe(schema) {
   if (schema === void 0) return false;
@@ -7360,72 +8794,6 @@ function scanPromptInjection(file, source) {
   });
   return findings;
 }
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
-
-// src/core/parse-pool.ts
-var workerUrl = new URL("./parse-worker.mjs", import.meta.url);
-var cache = /* @__PURE__ */ new Map();
-function parsePoolEnabled() {
-  return process.env.FULLSHIELD_PARSE_POOL === "1";
-}
-function parsePoolSize() {
-  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
-  if (raw !== void 0 && raw !== "") {
-    const parsed = Number(raw);
-    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
-  }
-  return Math.max(1, availableParallelism() - 1);
-}
-function parseCacheKey(code) {
-  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
-}
-function parseOne(code) {
-  const key = parseCacheKey(code);
-  const hit = cache.get(key);
-  if (hit !== void 0) return Promise.resolve(hit);
-  return new Promise((resolve5, reject) => {
-    const worker = new Worker(fileURLToPath(workerUrl), { workerData: { code } });
-    worker.once("message", (ast) => {
-      cache.set(key, ast);
-      resolve5(ast);
-    });
-    worker.once("error", reject);
-  });
-}
-async function parseWithPool(codes) {
-  const size = parsePoolSize();
-  const out = new Array(codes.length);
-  let next = 0;
-  async function run() {
-    for (; ; ) {
-      const index = next;
-      next += 1;
-      if (index >= codes.length) return;
-      const code = codes[index];
-      if (code === void 0) return;
-      out[index] = await parseOne(code);
-    }
-  }
-  const workers = Math.min(size, Math.max(1, codes.length));
-  await Promise.all(Array.from({ length: workers }, () => run()));
-  return out;
-}
 
 // src/modules/sast/engine.ts
 var sastRules = [
@@ -7459,8 +8827,8 @@ function snippetOf(source, node) {
   if (node.range === void 0) return "";
   return source.slice(node.range[0], node.range[1]).replace(/\s+/g, " ").trim().slice(0, 120);
 }
-function findingsFromAst(filename, source, ast, extraReturners = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
-  const facts = analyzeFile(ast, extraReturners);
+function findingsFromAst(filename, source, ast, extraReturners2 = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
+  const facts = analyzeFile(ast, extraReturners2);
   const findings = [];
   for (const rule of sastRules) {
     const ctx = {
@@ -7486,10 +8854,12 @@ function findingsFromAst(filename, source, ast, extraReturners = /* @__PURE__ */
         });
       },
       isTainted: (node) => nodeIsTainted(node, facts),
+      isSqlCleared: (node) => nodeIsSqlCleared(node, facts),
       isPathSanitized: (node) => nodeIsPathSanitized(node, facts),
       isSanitizedFor: (node, kind) => nodeIsSanitizedFor(node, facts, kind),
       isNosqlSanitized: (node) => nodeIsNosqlSanitized(node, facts),
       isRequestObject: (node) => nodeIsRequestObject(node, facts),
+      holdsBuiltFilter: (node) => nodeHoldsBuiltFilter(node, facts),
       functionHasPasswordName: (node) => factsFor(node, facts).hasPasswordName,
       assignedName: (node) => assignedNameOf(node),
       projectCsrfProtected
@@ -7527,10 +8897,12 @@ function findingsFromTemplate(filename, source) {
       });
     },
     isTainted: () => false,
+    isSqlCleared: () => false,
     isPathSanitized: () => false,
     isSanitizedFor: () => false,
     isNosqlSanitized: () => false,
     isRequestObject: () => false,
+    holdsBuiltFilter: () => false,
     functionHasPasswordName: () => false,
     assignedName: () => void 0,
     projectCsrfProtected: false
@@ -7538,52 +8910,224 @@ function findingsFromTemplate(filename, source) {
   xssRule.create(ctx);
   return findings;
 }
+function dedupeSastSinks(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const finding3 of findings) {
+    if (finding3.module !== "sast" || finding3.line === void 0) {
+      out.push(finding3);
+      continue;
+    }
+    const key = `${finding3.ruleId}\0${finding3.file ?? ""}\0${finding3.line}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(finding3);
+  }
+  return out;
+}
+function sastStreamThreshold() {
+  const raw = process.env.FULLSHIELD_SAST_STREAM_AT;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 4e3;
+}
+function sastBatchSize() {
+  const raw = process.env.FULLSHIELD_SAST_BATCH;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 150;
+}
+function skipFinding(rel, message) {
+  return {
+    id: makeFindingId("SAST-SKIP-001", rel, message),
+    ruleId: "SAST-SKIP-001",
+    module: "sast",
+    title: "File skipped by SAST",
+    severity: "info",
+    confidence: "high",
+    file: rel,
+    message,
+    remediation: "Raise sast.maxFileBytes in fullshield.config.json to parse this file, or leave it skipped."
+  };
+}
+function skipReason(source, maxBytes) {
+  if (source.includes("\0")) return "it contains NUL bytes";
+  const bytes = Buffer.byteLength(source);
+  if (bytes > maxBytes) return `${bytes} bytes exceeds the SAST parse limit of ${maxBytes} bytes`;
+  return void 0;
+}
+async function readScanSource(cwd, rel) {
+  try {
+    return await readFile(join(cwd, rel), "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function cloneAst(value) {
+  if (value === null || typeof value !== "object") return void 0;
+  try {
+    return structuredClone(value);
+  } catch {
+    return void 0;
+  }
+}
+async function parseInProcess(source) {
+  try {
+    return await parseSource(source);
+  } catch {
+    return void 0;
+  }
+}
+async function parseCode(source) {
+  if (!parsePoolEnabled()) return parseInProcess(source);
+  try {
+    const cloned = cloneAst((await parseWithPool([source]))[0]);
+    if (cloned !== void 0) return cloned;
+  } catch {
+  }
+  return parseInProcess(source);
+}
+function releaseParsed(parsed) {
+  for (const entry of parsed) {
+    entry.source = "";
+    entry.ast = void 0;
+  }
+  parsed.length = 0;
+}
+function extraReturners(rel, ast, files, returning) {
+  const ns = collectRequires(rel, ast, files);
+  const extra = new Set(returning.get(rel));
+  for (const [local, spec] of ns) {
+    const hash = spec.indexOf("#");
+    const file = hash >= 0 ? spec.slice(0, hash) : spec;
+    const exp = hash >= 0 ? spec.slice(hash + 1) : local;
+    if (returning.get(file)?.has(exp)) extra.add(local);
+  }
+  return extra;
+}
+async function runSastStreaming(ctx) {
+  const maxBytes = ctx.config.sast.maxFileBytes;
+  const findings = [];
+  const returning = /* @__PURE__ */ new Map();
+  const parseable = [];
+  const fileSet = /* @__PURE__ */ new Set();
+  let projectCsrf = false;
+  for (const rel of ctx.files) {
+    const isSource = SOURCE_EXT.test(rel);
+    const isTemplate = TEMPLATE_EXT.test(rel);
+    if (!isSource && !isTemplate) continue;
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const why = skipReason(source, maxBytes);
+    if (why !== void 0) {
+      findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+      continue;
+    }
+    if (sourceHasCsrfGuard(source)) projectCsrf = true;
+    if (isTemplate) {
+      findings.push(...findingsFromTemplate(rel, source));
+      continue;
+    }
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    returning.set(rel, taintSummariesEnabled() ? cachedReturners(source, ast) : functionsThatReturnTaint(ast));
+    parseable.push(rel);
+    fileSet.add(rel);
+  }
+  for (const rel of parseable) {
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    findings.push(
+      ...findingsFromAst(rel, source, ast, extraReturners(rel, ast, fileSet, returning), projectCsrf)
+    );
+  }
+  const batch = sastBatchSize();
+  for (let i = 0; i < parseable.length; i += batch) {
+    const parsed = [];
+    for (const rel of parseable.slice(i, i + batch)) {
+      const source = await readScanSource(ctx.cwd, rel);
+      if (source === void 0) continue;
+      const ast = await parseCode(source);
+      if (ast === void 0) continue;
+      parsed.push({ file: rel, source, ast });
+    }
+    findings.push(...runInterproc(parsed));
+    releaseParsed(parsed);
+  }
+  return dedupeSastSinks(findings);
+}
 var sastModule = {
   name: "sast",
   async run(ctx) {
-    const findings = [];
-    const parsed = [];
-    for (const rel of ctx.files) {
-      const isSource = SOURCE_EXT.test(rel);
-      const isTemplate = TEMPLATE_EXT.test(rel);
-      if (!isSource && !isTemplate) continue;
-      let source;
-      try {
-        source = await readFile(join(ctx.cwd, rel), "utf8");
-      } catch {
-        continue;
-      }
-      if (source.length > 1024 * 1024 || source.includes("\0")) continue;
-      if (isTemplate) {
-        findings.push(...findingsFromTemplate(rel, source));
-        continue;
+    if (process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1") {
+      const sources = new Set((ctx.config.sast.sources ?? []).map((row) => row.callee));
+      const sanitizers = /* @__PURE__ */ new Map();
+      for (const row of ctx.config.sast.sanitizers ?? []) {
+        const classes = sanitizers.get(row.callee) ?? /* @__PURE__ */ new Set();
+        for (const name of row.clears) classes.add(name);
+        sanitizers.set(row.callee, classes);
       }
-      try {
-        const ast = parsePoolEnabled() ? (await parseWithPool([source]))[0] : await parseSource(source);
+      setCustomTaint({ sources, sanitizers });
+    } else {
+      setCustomTaint(void 0);
+    }
+    setTaintSummaryConfig(taintSummariesEnabled() ? ctx.config : void 0);
+    try {
+      const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
+      if (candidates.length > sastStreamThreshold()) return await runSastStreaming(ctx);
+      const maxBytes = ctx.config.sast.maxFileBytes;
+      const findings = [];
+      const parsed = [];
+      for (const rel of candidates) {
+        const source = await readScanSource(ctx.cwd, rel);
+        if (source === void 0) continue;
+        const why = skipReason(source, maxBytes);
+        if (why !== void 0) {
+          findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+          continue;
+        }
+        if (TEMPLATE_EXT.test(rel)) {
+          findings.push(...findingsFromTemplate(rel, source));
+          continue;
+        }
+        const ast = await parseCode(source);
         if (ast === void 0) continue;
         parsed.push({ file: rel, source, ast });
-      } catch {
       }
-    }
-    const files = new Set(parsed.map((p) => p.file));
-    const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
-    const returning = /* @__PURE__ */ new Map();
-    for (const p of parsed) {
-      returning.set(p.file, functionsThatReturnTaint(p.ast));
-    }
-    for (const p of parsed) {
-      const ns = collectRequires(p.file, p.ast, files);
-      const extra = new Set(returning.get(p.file));
-      for (const [local, spec] of ns) {
-        const hash = spec.indexOf("#");
-        const file = hash >= 0 ? spec.slice(0, hash) : spec;
-        const exp = hash >= 0 ? spec.slice(hash + 1) : local;
-        if (returning.get(file)?.has(exp)) extra.add(local);
+      const files = new Set(parsed.map((p) => p.file));
+      const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
+      const returning = /* @__PURE__ */ new Map();
+      for (const entry of parsed) {
+        returning.set(
+          entry.file,
+          taintSummariesEnabled() ? cachedReturners(entry.source, entry.ast) : functionsThatReturnTaint(entry.ast)
+        );
       }
-      findings.push(...findingsFromAst(p.file, p.source, p.ast, extra, projectCsrf));
+      for (const entry of parsed) {
+        findings.push(
+          ...findingsFromAst(
+            entry.file,
+            entry.source,
+            entry.ast,
+            extraReturners(entry.file, entry.ast, files, returning),
+            projectCsrf
+          )
+        );
+      }
+      findings.push(...runInterproc(parsed));
+      const out = dedupeSastSinks(findings);
+      releaseParsed(parsed);
+      return out;
+    } finally {
+      setCustomTaint(void 0);
+      setTaintSummaryConfig(void 0);
     }
-    findings.push(...runInterproc(parsed));
-    return findings;
   }
 };
 
@@ -7860,12 +9404,12 @@ ${text}`);
   const seeds = fixtureLogic(prompt);
   const findings = [];
   for (const seed of seeds) {
-    const hit = fileTexts.find((f) => f.file.includes(seed.fileHint) && f.text.includes(seed.fileHint === "user" ? "findById" : "Object.assign")) ?? fileTexts.find(
+    const hit2 = fileTexts.find((f) => f.file.includes(seed.fileHint) && f.text.includes(seed.fileHint === "user" ? "findById" : "Object.assign")) ?? fileTexts.find(
       (f) => f.text.includes(seed.ruleId === "AI-IDOR-001" ? "findById(req.params.id)" : "Object.assign(user, req.body)")
     );
-    if (hit === void 0) continue;
-    const line = hit.text.split(/\r?\n/).findIndex((l) => l.includes(seed.ruleId === "AI-IDOR-001" ? "findById" : "Object.assign")) + 1;
-    findings.push(asAiFinding(seed, hit.file, line > 0 ? line : 1));
+    if (hit2 === void 0) continue;
+    const line = hit2.text.split(/\r?\n/).findIndex((l) => l.includes(seed.ruleId === "AI-IDOR-001" ? "findById" : "Object.assign")) + 1;
+    findings.push(asAiFinding(seed, hit2.file, line > 0 ? line : 1));
   }
   return findings;
 }
@@ -8027,16 +9571,37 @@ ${wrapUntrustedCode(req.prompt)}`;
     }
   };
 }
+function isIsoDate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}(T[\d:.+\-Z]+)?$/.test(value)) return false;
+  return Number.isFinite(Date.parse(value));
+}
+function expiresAtMs(expires) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) return Date.parse(`${expires}T23:59:59.999Z`);
+  return Date.parse(expires);
+}
+function validSuppression(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const row = value;
+  if (typeof row.ruleId !== "string" || row.ruleId.length === 0) return void 0;
+  if (typeof row.owner !== "string" || row.owner.length === 0) return void 0;
+  if (typeof row.reason !== "string" || row.reason.length === 0) return void 0;
+  if (typeof row.expires !== "string" || !isIsoDate(row.expires)) return void 0;
+  const file = row.file === void 0 ? void 0 : row.file.replace(/\\/g, "/");
+  if (row.file !== void 0 && (typeof row.file !== "string" || row.file.length === 0)) return void 0;
+  return { ruleId: row.ruleId, file, owner: row.owner, reason: row.reason, expires: row.expires };
+}
 async function readBaseline(path) {
   try {
     const raw = JSON.parse(await readFile(path, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.findings)) return void 0;
+    if (raw.suppressions !== void 0 && !Array.isArray(raw.suppressions)) return void 0;
     return raw;
   } catch {
     return void 0;
   }
 }
 async function writeBaseline(path, findings) {
+  const existing = await readBaseline(path);
   const doc = {
     version: 1,
     findings: findings.map((f) => ({
@@ -8044,7 +9609,8 @@ async function writeBaseline(path, findings) {
       ruleId: f.ruleId,
       file: f.file,
       line: f.line
-    }))
+    })),
+    ...existing?.suppressions !== void 0 ? { suppressions: existing.suppressions } : {}
   };
   await writeFile(path, `${JSON.stringify(doc, null, 2)}
 `, "utf8");
@@ -8054,6 +9620,30 @@ function applyBaseline(findings, baseline) {
   const known = new Set(baseline.findings.map((f) => f.id));
   return findings.filter((f) => !known.has(f.id));
 }
+function applySuppressions(findings, rows, now = /* @__PURE__ */ new Date()) {
+  if (rows === void 0 || rows.length === 0) return { findings: [...findings], errors: [] };
+  const errors = [];
+  const active = [];
+  rows.forEach((row, index) => {
+    const parsed = validSuppression(row);
+    if (parsed === void 0) {
+      errors.push(`suppression ${index + 1} needs ruleId, owner, reason, and an ISO expires date`);
+      return;
+    }
+    if (expiresAtMs(parsed.expires) < now.getTime()) {
+      errors.push(
+        `suppression for ${parsed.ruleId} expired on ${parsed.expires} (owner: ${parsed.owner}); renew or remove it`
+      );
+      return;
+    }
+    active.push(parsed);
+  });
+  const kept = findings.filter((finding3) => {
+    const file = (finding3.file ?? "").replace(/\\/g, "/");
+    return !active.some((row) => row.ruleId === finding3.ruleId && (row.file === void 0 || row.file === file));
+  });
+  return { findings: kept, errors };
+}
 
 // src/core/config.ts
 init_finding();
@@ -8062,14 +9652,77 @@ var DEFAULT_CONFIG = {
   modules: [...MODULE_NAMES],
   failOn: "high",
   ignore: ["dist/**", "**/*.test.ts"],
+  defaultExcludes: true,
   baseline: ".fullshield-baseline.json",
   notify: { slackWebhookEnv: "FULLSHIELD_SLACK_WEBHOOK" },
   deps: { offline: false },
-  ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 }
+  ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 },
+  sast: { maxFileBytes: 1024 * 1024 }
 };
 var ConfigError = class extends Error {
 };
-var KNOWN_KEYS = /* @__PURE__ */ new Set(["modules", "failOn", "ignore", "baseline", "notify", "deps", "ai"]);
+var KNOWN_KEYS = /* @__PURE__ */ new Set([
+  "modules",
+  "failOn",
+  "ignore",
+  "defaultExcludes",
+  "excludes",
+  "baseline",
+  "notify",
+  "deps",
+  "ai",
+  "sast"
+]);
+var SAST_CLASSES = /* @__PURE__ */ new Set([
+  "sqli",
+  "nosqli",
+  "cmdi",
+  "path",
+  "xss",
+  "ssrf",
+  "redirect",
+  "eval",
+  "jwt",
+  "crypto",
+  "proto",
+  "secrets",
+  "deps",
+  "config"
+]);
+function parseSastSources(value, source) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new ConfigError(`${source}: "sast.sources" must be an array`);
+  return value.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new ConfigError(`${source}: "sast.sources" entries must be objects`);
+    }
+    const row = item;
+    if (typeof row.callee !== "string" || row.callee.length === 0) {
+      throw new ConfigError(`${source}: "sast.sources[].callee" must be a string`);
+    }
+    if (row.returns !== "tainted") {
+      throw new ConfigError(`${source}: "sast.sources[].returns" must be "tainted"`);
+    }
+    return { callee: row.callee, returns: "tainted" };
+  });
+}
+function parseSastSanitizers(value, source) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new ConfigError(`${source}: "sast.sanitizers" must be an array`);
+  return value.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new ConfigError(`${source}: "sast.sanitizers" entries must be objects`);
+    }
+    const row = item;
+    if (typeof row.callee !== "string" || row.callee.length === 0) {
+      throw new ConfigError(`${source}: "sast.sanitizers[].callee" must be a string`);
+    }
+    if (!Array.isArray(row.clears) || row.clears.some((name) => typeof name !== "string" || !SAST_CLASSES.has(name))) {
+      throw new ConfigError(`${source}: "sast.sanitizers[].clears" must be B4 class names`);
+    }
+    return { callee: row.callee, clears: row.clears.filter((name) => name !== "secrets" && name !== "deps") };
+  });
+}
 function validate(raw, source) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new ConfigError(`${source}: config must be a JSON object`);
@@ -8171,6 +9824,42 @@ function validate(raw, source) {
     }
     out.ai = ai;
   }
+  if (record.defaultExcludes !== void 0) {
+    if (typeof record.defaultExcludes !== "boolean") {
+      throw new ConfigError(`${source}: "defaultExcludes" must be a boolean`);
+    }
+    out.defaultExcludes = record.defaultExcludes;
+  }
+  if (record.excludes !== void 0) {
+    if (!Array.isArray(record.excludes) || record.excludes.some((p) => typeof p !== "string")) {
+      throw new ConfigError(`${source}: "excludes" must be an array of glob strings`);
+    }
+    out.excludes = record.excludes;
+  }
+  if (record.sast !== void 0) {
+    if (typeof record.sast !== "object" || record.sast === null || Array.isArray(record.sast)) {
+      throw new ConfigError(`${source}: "sast" must be an object`);
+    }
+    const rawSast = record.sast;
+    const sast = { maxFileBytes: 1024 * 1024 };
+    if (rawSast.maxFileBytes !== void 0) {
+      if (typeof rawSast.maxFileBytes !== "number" || rawSast.maxFileBytes < 1) {
+        throw new ConfigError(`${source}: "sast.maxFileBytes" must be a positive number`);
+      }
+      sast.maxFileBytes = rawSast.maxFileBytes;
+    }
+    const custom = process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1";
+    if (!custom && (rawSast.sources !== void 0 || rawSast.sanitizers !== void 0)) {
+      throw new ConfigError(
+        `${source}: unknown key "sast.sources" (FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS)`
+      );
+    }
+    if (custom) {
+      sast.sources = parseSastSources(rawSast.sources, source);
+      sast.sanitizers = parseSastSanitizers(rawSast.sanitizers, source);
+    }
+    out.sast = sast;
+  }
   return out;
 }
 async function loadConfig(cwd, configPath) {
@@ -8197,10 +9886,26 @@ async function loadConfig(cwd, configPath) {
   return { ...structuredClone(DEFAULT_CONFIG), ...validate(raw, file) };
 }
 var ignoreFactory = ignoreModule.default;
-var ALWAYS_IGNORED = [".git/", "node_modules/", ".fullshield/"];
+var HARD_IGNORED = [".git/", ".fullshield/"];
+var DEFAULT_EXCLUDES = [
+  "node_modules/",
+  "dist/",
+  "build/",
+  ".next/",
+  "coverage/",
+  "vendor/",
+  "vendored/",
+  "third_party/",
+  "third-party/",
+  "compiled/",
+  "*.min.js"
+];
 async function walkFiles(options) {
   const ig = ignoreFactory();
-  ig.add(ALWAYS_IGNORED);
+  ig.add(HARD_IGNORED);
+  if (options.defaultExcludes !== false) {
+    ig.add(options.excludes ?? DEFAULT_EXCLUDES);
+  }
   try {
     ig.add(await readFile(join(options.cwd, ".gitignore"), "utf8"));
   } catch {
@@ -8382,7 +10087,7 @@ function resolvePolicyBranch(cwd, env = process.env) {
     return "*";
   }
 }
-function expiresAtMs(expires) {
+function expiresAtMs2(expires) {
   if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) {
     return Date.parse(`${expires}T23:59:59.999Z`);
   }
@@ -8404,7 +10109,7 @@ function applyPolicy(findings, policy, ctx = {}) {
   });
   const suppressed = /* @__PURE__ */ new Set();
   for (const exception of policy.exceptions ?? []) {
-    if (expiresAtMs(exception.expires) < now.getTime()) {
+    if (expiresAtMs2(exception.expires) < now.getTime()) {
       errors.push(
         `policy exception for ${exception.ruleId} expired on ${exception.expires} (owner: ${exception.owner}); renew or remove it`
       );
@@ -8452,6 +10157,8 @@ function dedupe2(findings) {
 async function runScan(options = {}, modules = builtinModules) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const t0 = performance.now();
+  depsModule.unusedDirect = void 0;
+  depsModule.upgradePlan = void 0;
   const cwd = resolve(options.cwd ?? process.cwd());
   const stats = await stat(cwd).catch(() => null);
   if (stats === null || !stats.isDirectory()) {
@@ -8473,7 +10180,12 @@ async function runScan(options = {}, modules = builtinModules) {
     options.modules ?? config.modules,
     loadedPolicy?.requiredModules
   );
-  let files = await walkFiles({ cwd, ignore: config.ignore });
+  let files = await walkFiles({
+    cwd,
+    ignore: config.ignore,
+    defaultExcludes: config.defaultExcludes,
+    excludes: config.excludes
+  });
   if (options.staged === true) {
     const staged = new Set(await listStagedFiles(cwd));
     files = files.filter((file) => staged.has(file));
@@ -8507,6 +10219,7 @@ async function runScan(options = {}, modules = builtinModules) {
     );
   }
   const extraHits = [];
+  let historyNotice;
   const secretsWanted = modulesRequested.includes("secrets");
   if (secretsAdvEnabled() && secretsWanted) {
     if (options.history === true) {
@@ -8514,6 +10227,7 @@ async function runScan(options = {}, modules = builtinModules) {
       const hist = await scanGitHistory2(cwd);
       extraHits.push(...hist.hits);
       collected.push(...hist.findings);
+      historyNotice = hist.history;
     }
     if (options.bundle !== void 0 && options.bundle.length > 0) {
       const { scanBundle: scanBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
@@ -8534,13 +10248,17 @@ async function runScan(options = {}, modules = builtinModules) {
   if (options.updateBaseline === true) {
     await writeBaseline(baselinePath, unsuppressed);
   }
-  let findings = sortFindings(applyBaseline(unsuppressed, await readBaseline(baselinePath)));
+  const baselineDoc = await readBaseline(baselinePath);
+  let findings = sortFindings(applyBaseline(unsuppressed, baselineDoc));
+  const suppressed = applySuppressions(findings, baselineDoc?.suppressions);
+  findings = sortFindings(suppressed.findings);
+  const suppressionErrors = suppressed.errors;
   if (secretsAdvEnabled() && secretsWanted && options.verifySecrets === true && options.iOwnTheseCredentials === true) {
     const { applyVerification: applyVerification2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
     const { scanTextForSecretHits: scanTextForSecretHits2 } = await Promise.resolve().then(() => (init_secrets(), secrets_exports));
     const secretById = /* @__PURE__ */ new Map();
-    for (const hit of extraHits) {
-      if (hit.secret !== void 0) secretById.set(hit.finding.id, hit.secret);
+    for (const hit2 of extraHits) {
+      if (hit2.secret !== void 0) secretById.set(hit2.finding.id, hit2.secret);
     }
     for (const finding3 of findings) {
       if (finding3.module !== "secrets" || finding3.file === void 0 || secretById.has(finding3.id)) {
@@ -8554,8 +10272,8 @@ async function runScan(options = {}, modules = builtinModules) {
           continue;
         }
       }
-      for (const hit of scanTextForSecretHits2(finding3.file, text)) {
-        if (hit.secret !== void 0) secretById.set(hit.finding.id, hit.secret);
+      for (const hit2 of scanTextForSecretHits2(finding3.file, text)) {
+        if (hit2.secret !== void 0) secretById.set(hit2.finding.id, hit2.secret);
       }
     }
     findings = sortFindings(
@@ -8606,10 +10324,14 @@ async function runScan(options = {}, modules = builtinModules) {
       cwd,
       filesScanned: files.length,
       modulesRequested: [...modulesRequested],
-      modulesRun
+      modulesRun,
+      ...historyNotice !== void 0 ? { history: historyNotice } : {},
+      ...depsModule.unusedDirect !== void 0 ? { unusedDirect: depsModule.unusedDirect } : {},
+      ...depsModule.upgradePlan !== void 0 ? { upgradePlan: depsModule.upgradePlan } : {}
     },
     config,
-    policy: policyResult
+    policy: policyResult,
+    ...suppressionErrors.length > 0 ? { suppressionErrors } : {}
   };
 }
 function scan(options = {}) {