fullshield 0.2.6 → 0.4.0

package/dist/cli/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createHash } from 'crypto';
-import { writeFile, mkdir, readFile, stat, mkdtemp, unlink, readdir } from 'fs/promises';
+import { writeFile, readFile, mkdir, stat, mkdtemp, unlink, readdir } from 'fs/promises';
 import { resolve, join, dirname, relative, basename, posix } from 'path';
 import { readFileSync, existsSync, readdirSync, cpSync, mkdirSync, rmSync, statSync, writeFileSync, mkdtempSync, unlinkSync } from 'fs';
 import { homedir, tmpdir, availableParallelism } from 'os';
@@ -113,7 +113,8 @@ function walk(node, visit) {
   }
 }
 function attachParents(node, parent) {
-  node.parent = parent;
+  const current = node;
+  if (parent !== void 0 || current.parent === void 0) current.parent = parent;
   for (const key of Object.keys(node)) {
     if (SKIP_KEYS.has(String(key))) continue;
     const value = node[key];
@@ -192,8 +193,18 @@ function mcpCfgEnabled() {
 function taintV2Enabled() {
   return process.env.FULLSHIELD_EXPERIMENTAL_TAINT_V2 === "1";
 }
+function licenseEnabled() {
+  return process.env[LICENSE_FLAG] === "1";
+}
+function diffEnabled() {
+  return process.env[DIFF_FLAG] === "1";
+}
+var CI_REPORTS_FLAG, DIFF_FLAG, LICENSE_FLAG;
 var init_experimental = __esm({
   "src/modules/sast/experimental.ts"() {
+    CI_REPORTS_FLAG = "FULLSHIELD_EXPERIMENTAL_CI_REPORTS";
+    DIFF_FLAG = "FULLSHIELD_EXPERIMENTAL_DIFF";
+    LICENSE_FLAG = "FULLSHIELD_EXPERIMENTAL_LICENSE";
   }
 });
 function isSeverity(value) {
@@ -634,6 +645,173 @@ var init_config = __esm({
   }
 });
 
+// src/modules/deps/lockfile-modern.ts
+function addEdge(edges, from, to) {
+  if (from.length === 0 || to.length === 0 || from === to) return;
+  const list = edges.get(from) ?? /* @__PURE__ */ new Set();
+  list.add(to);
+  edges.set(from, list);
+}
+function graph(packages, edges, directProd, directDev, edgesKnown) {
+  return { packages, edges, directProd, directDev, edgesKnown };
+}
+function parseYarnBerry(contents) {
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  let current;
+  let inDeps = false;
+  let devBlock = false;
+  for (const raw of contents.split(/\r?\n/)) {
+    if (!raw.startsWith(" ") && raw.trimEnd().endsWith(":")) {
+      const key = raw.slice(0, -1).trim().replace(/^"|"$/g, "");
+      current = key.includes("@workspace:.") ? "" : nameFromBerryKey(key);
+      inDeps = false;
+      devBlock = false;
+      continue;
+    }
+    const version = /^\s+version:\s+(.+)$/.exec(raw)?.[1]?.replace(/["']/g, "").trim();
+    if (version !== void 0 && current !== void 0 && current.length > 0 && !inDeps) {
+      packages.push({ name: current, version: versionFromProtocol(version), path: `yarn:${current}` });
+      continue;
+    }
+    if (/^\s+dependencies:\s*$/.test(raw)) {
+      inDeps = true;
+      devBlock = false;
+      continue;
+    }
+    if (/^\s+devDependencies:\s*$/.test(raw)) {
+      inDeps = true;
+      devBlock = true;
+      continue;
+    }
+    if (!inDeps || current === void 0) continue;
+    const dep = /^\s{4}"?([^":]+)"?:\s+(.+)$/.exec(raw);
+    if (dep?.[1] === void 0) continue;
+    const depName = dep[1];
+    if (current.length === 0) {
+      if (devBlock) directDev.add(depName);
+      else directProd.add(depName);
+    } else {
+      addEdge(edges, current, depName);
+    }
+  }
+  return graph(packages, edges, directProd, directDev, true);
+}
+function nameFromBerryKey(key) {
+  const first = key.split(",")[0]?.trim() ?? key;
+  if (first.startsWith("@")) {
+    const match = /^(@[^@/]+\/[^@/]+)@/.exec(first);
+    return match?.[1];
+  }
+  const at = first.indexOf("@");
+  return at <= 0 ? first : first.slice(0, at);
+}
+function versionFromProtocol(raw) {
+  const patch = /^patch:(.+)#/.exec(raw);
+  const body = patch?.[1] ?? raw;
+  const npm = /^(?:npm:)?(@?[^@]+)@(.+)$/.exec(body);
+  if (npm?.[2] !== void 0) return npm[2];
+  return body;
+}
+function parsePnpmV9(contents) {
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  let block = "none";
+  let snapshot;
+  let inSnapshotDeps = false;
+  for (const raw of contents.split(/\r?\n/)) {
+    if (raw === "packages:") {
+      block = "packages";
+      snapshot = void 0;
+      continue;
+    }
+    if (raw === "snapshots:") {
+      block = "snapshots";
+      snapshot = void 0;
+      continue;
+    }
+    if (raw === "importers:" || raw.startsWith("lockfileVersion:")) {
+      block = "none";
+      continue;
+    }
+    if (block !== "snapshots" && /^\s{4}dependencies:\s*$/.test(raw)) {
+      block = "importer-deps";
+      continue;
+    }
+    if (/^\s{4}devDependencies:\s*$/.test(raw)) {
+      block = "importer-dev";
+      continue;
+    }
+    if (block === "packages") {
+      const header = /^\s{2}['"]?(@?[^@'\s]+)@([^:'"]+)['"]?:/.exec(raw);
+      if (header?.[1] !== void 0 && header[2] !== void 0) {
+        packages.push({ name: header[1], version: header[2], path: `pnpm:${header[1]}` });
+      }
+      continue;
+    }
+    if (block === "snapshots") {
+      const header = /^\s{2}['"]?(@?[^@'\s]+)@([^:'"]+)['"]?:/.exec(raw);
+      if (header?.[1] !== void 0) {
+        snapshot = header[1];
+        inSnapshotDeps = false;
+        continue;
+      }
+      if (/^\s+dependencies:\s*$/.test(raw)) {
+        inSnapshotDeps = true;
+        continue;
+      }
+      if (inSnapshotDeps && snapshot !== void 0) {
+        const dep = /^\s{6}['"]?([^'":]+)['"]?:/.exec(raw);
+        if (dep?.[1] !== void 0) addEdge(edges, snapshot, dep[1]);
+      }
+      continue;
+    }
+    if (block === "importer-deps" || block === "importer-dev") {
+      const dep = /^\s{6}['"]?([^'":]+)['"]?:/.exec(raw);
+      if (dep?.[1] !== void 0 && !raw.trim().startsWith("specifier") && !raw.trim().startsWith("version")) {
+        if (block === "importer-dev") directDev.add(dep[1]);
+        else directProd.add(dep[1]);
+      }
+    }
+  }
+  return graph(packages, edges, directProd, directDev, true);
+}
+function parseBunLock(contents) {
+  const stripped = contents.replace(/^\s*\/\/.*$/gm, "");
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  try {
+    const json = JSON.parse(stripped);
+    for (const [name, value] of Object.entries(json.packages ?? {})) {
+      if (!Array.isArray(value)) continue;
+      const entry = Array.from(value);
+      const spec = typeof entry[0] === "string" ? entry[0] : "";
+      const version = spec.includes("@") ? spec.slice(spec.lastIndexOf("@") + 1) : spec;
+      packages.push({ name, version, path: `bun:${name}` });
+      const meta = entry[1];
+      if (meta !== null && typeof meta === "object" && "dependencies" in meta) {
+        const deps = meta.dependencies;
+        if (deps !== null && typeof deps === "object") {
+          for (const dep of Object.keys(deps)) addEdge(edges, name, dep);
+        }
+      }
+    }
+  } catch {
+    return graph([], /* @__PURE__ */ new Map(), /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set(), false);
+  }
+  return graph(packages, edges, directProd, directDev, packages.length > 0);
+}
+var init_lockfile_modern = __esm({
+  "src/modules/deps/lockfile-modern.ts"() {
+  }
+});
+
 // src/modules/deps/lockfile.ts
 function basename2(filename) {
   const parts = filename.replace(/\\/g, "/").split("/");
@@ -663,7 +841,7 @@ function objectKeys(value) {
   }
   return Object.keys(value);
 }
-function addEdge(edges, from, to) {
+function addEdge2(edges, from, to) {
   const set = edges.get(from) ?? /* @__PURE__ */ new Set();
   set.add(to);
   edges.set(from, set);
@@ -743,7 +921,7 @@ function parseYarnGraph(contents) {
       const depBerry = /^\s{4}(?:"([^"]+)"|(@?[\w./-]+)):/.exec(raw);
       const depName = depClassic?.[1] ?? depClassic?.[2] ?? depBerry?.[1] ?? depBerry?.[2];
       if (depName !== void 0) {
-        addEdge(edges, currentName, depName);
+        addEdge2(edges, currentName, depName);
         continue;
       }
       if (/^\s{2}\S/.test(raw)) inDeps = false;
@@ -837,7 +1015,7 @@ function parsePnpmGraph(contents) {
         const dep = /^      (?:'([^']+)'|"([^"]+)"|([^:]+)):/.exec(raw);
         const depName = dep?.[1] ?? dep?.[2] ?? dep?.[3];
         if (depName !== void 0) {
-          addEdge(edges, currentPkg, depName);
+          addEdge2(edges, currentPkg, depName);
           continue;
         }
         if (/^    \S/.test(raw)) inPkgDeps = false;
@@ -872,7 +1050,7 @@ function graphFromPackagesTable(packages) {
     const name = key === "" ? "" : nameFromPackagesKey(key);
     if (name === void 0 || name.length === 0) continue;
     for (const dep of [...objectKeys(value.dependencies), ...objectKeys(value.optionalDependencies)]) {
-      addEdge(edges, name, dep);
+      addEdge2(edges, name, dep);
     }
   }
   return { edges, directProd, directDev };
@@ -882,7 +1060,7 @@ function graphFromDependenciesTree(deps, edges) {
     const child = value.dependencies;
     if (child === void 0 || typeof child !== "object" || child === null) continue;
     const nested = child;
-    for (const childName of Object.keys(nested)) addEdge(edges, name, childName);
+    for (const childName of Object.keys(nested)) addEdge2(edges, name, childName);
     graphFromDependenciesTree(nested, edges);
   }
 }
@@ -895,8 +1073,16 @@ function parseLockfileGraph(filename, contents) {
     directDev: /* @__PURE__ */ new Set(),
     edgesKnown: false
   };
-  if (name === "yarn.lock") return parseYarnGraph(contents);
-  if (name === "pnpm-lock.yaml") return parsePnpmGraph(contents);
+  const modern = process.env.FULLSHIELD_EXPERIMENTAL_LOCKFILES === "1";
+  if (name === "yarn.lock") {
+    if (modern && contents.includes("__metadata")) return parseYarnBerry(contents);
+    return parseYarnGraph(contents);
+  }
+  if (name === "pnpm-lock.yaml") {
+    if (modern && /lockfileVersion:\s*['"]?9/.test(contents)) return parsePnpmV9(contents);
+    return parsePnpmGraph(contents);
+  }
+  if (modern && name === "bun.lock") return parseBunLock(contents);
   if (name !== "package-lock.json") return empty;
   try {
     const json = JSON.parse(contents);
@@ -923,6 +1109,7 @@ function parseLockfileGraph(filename, contents) {
 var PNPM_KEY;
 var init_lockfile = __esm({
   "src/modules/deps/lockfile.ts"() {
+    init_lockfile_modern();
     PNPM_KEY = /^ {2}['"]?(?:\/)?(@?[^'"@\s/]+(?:\/[^'"@\s/]+)?)@([^'"(\s:]+)(?:\([^)]*\))?['"]?:\s*$/;
   }
 });
@@ -1081,6 +1268,91 @@ var init_pins = __esm({
   }
 });
 
+// src/modules/deps/evidence.ts
+function packageNameFromSpec(spec) {
+  if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:")) return void 0;
+  if (spec.startsWith("@")) {
+    const slash2 = spec.indexOf("/");
+    if (slash2 < 0) return void 0;
+    const rest = spec.slice(slash2 + 1);
+    const cut = rest.indexOf("/");
+    return cut === -1 ? spec : spec.slice(0, slash2 + 1 + cut);
+  }
+  const slash = spec.indexOf("/");
+  return slash === -1 ? spec : spec.slice(0, slash);
+}
+function collectImportSites(sources) {
+  const byPkg = /* @__PURE__ */ new Map();
+  const files = [...sources.keys()].sort();
+  for (const file of files) {
+    const text = sources.get(file) ?? "";
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+      const line = lines[i] ?? "";
+      IMPORT_RE.lastIndex = 0;
+      let match;
+      while ((match = IMPORT_RE.exec(line)) !== null) {
+        const spec = match[1] ?? match[2] ?? match[3];
+        if (spec === void 0) continue;
+        const pkg = packageNameFromSpec(spec);
+        if (pkg === void 0) continue;
+        const list = byPkg.get(pkg) ?? [];
+        list.push({ file, line: i + 1, specifier: spec, pkg });
+        byPkg.set(pkg, list);
+      }
+    }
+  }
+  for (const [pkg, list] of byPkg) {
+    list.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+    byPkg.set(pkg, list.slice(0, 5));
+  }
+  return byPkg;
+}
+function evidenceForFinding(finding6, sites, productionFiles, edgesKnown) {
+  if (finding6.ruleId !== "DEPS-VULN-001" && finding6.ruleId !== "DEPS-MALICIOUS-001") return void 0;
+  const snippet = finding6.snippet ?? "";
+  const at = snippet.startsWith("@") ? snippet.indexOf("@", 1) : snippet.indexOf("@");
+  const pkg = at <= 0 ? snippet : snippet.slice(0, at);
+  if (pkg.length === 0) return void 0;
+  const imports = (sites.get(pkg) ?? []).map((site) => ({
+    file: site.file,
+    line: site.line,
+    specifier: site.specifier
+  }));
+  const first = imports[0];
+  const path = finding6.dependencyPath;
+  let reason;
+  switch (finding6.reachability) {
+    case "not-imported":
+      reason = `No production file imports ${pkg}. Checked ${productionFiles.length} production file(s)${productionFiles.length > 0 ? `: ${productionFiles.slice(0, 8).join(", ")}` : ""}.`;
+      return { imports: [], reason };
+    case "reachability-unknown":
+      reason = edgesKnown ? `Reachability for ${pkg} is unknown.` : `Lockfile edges are missing, so ${pkg} is reachability-unknown.`;
+      return { imports, ...first !== void 0 ? {} : {}, reason };
+    case "reachable-via-dependency":
+      reason = path !== void 0 && path.length > 0 ? `Required through ${path.join(" > ")}.` : `Required by an imported package.`;
+      return { imports, ...path !== void 0 ? { dependencyPath: path } : {}, reason };
+    case "imported-not-called":
+      reason = first !== void 0 ? `Imported from ${first.file}:${first.line} and not called.` : `Imported and not called.`;
+      return { imports, reason };
+    case "symbol-reachable":
+      reason = first !== void 0 ? `A named vulnerable export is called from ${first.file}:${first.line}.` : `A named vulnerable export is called.`;
+      return { imports, reason };
+    case "symbol-not-called":
+      reason = `A named vulnerable export is not called.`;
+      return { imports, reason };
+    default:
+      reason = first !== void 0 ? `Imported from ${first.file}:${first.line}.` : `Imported by production code.`;
+      return { imports, ...path !== void 0 ? { dependencyPath: path } : {}, reason };
+  }
+}
+var IMPORT_RE;
+var init_evidence = __esm({
+  "src/modules/deps/evidence.ts"() {
+    IMPORT_RE = /(?:require\(\s*['"]([^'"]+)['"]\s*\)|from\s+['"]([^'"]+)['"]|import\(\s*['"]([^'"]+)['"]\s*\))/g;
+  }
+});
+
 // src/modules/deps/symbol-reachability.ts
 function affectedFunctionNames(vuln) {
   const names = /* @__PURE__ */ new Set();
@@ -1189,7 +1461,7 @@ function packageNameFromSnippet(snippet) {
   const at = snippet.indexOf("@");
   return at <= 0 ? snippet : snippet.slice(0, at);
 }
-function packageNameFromSpec(spec) {
+function packageNameFromSpec2(spec) {
   if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:")) return void 0;
   if (spec.startsWith("@")) {
     const parts = spec.split("/");
@@ -1225,7 +1497,7 @@ function indexPackageUsage(sources) {
         const local = m[1];
         const spec = m[2];
         if (local === void 0 || spec === void 0) continue;
-        const pkg = packageNameFromSpec(spec);
+        const pkg = packageNameFromSpec2(spec);
         if (pkg === void 0) continue;
         bump(pkg, localIsCalled(source, local));
       }
@@ -1235,7 +1507,7 @@ function indexPackageUsage(sources) {
     while ((named = namedRe.exec(source)) !== null) {
       const spec = named[2];
       if (spec === void 0) continue;
-      const pkg = packageNameFromSpec(spec);
+      const pkg = packageNameFromSpec2(spec);
       if (pkg === void 0) continue;
       const locals = (named[1] ?? "").split(",").map((s) => s.trim().split(/\s+as\s+/).pop() ?? "");
       bump(
@@ -1267,37 +1539,82 @@ function shortestDependencyPath(target, starts, edges) {
   }
   return void 0;
 }
+function collectDependencyPaths(target, starts, edges, limit = 8) {
+  const out = [];
+  const queue = [];
+  let steps = 0;
+  for (const start of starts) queue.push([start]);
+  while (queue.length > 0 && out.length < limit && steps < 4e3) {
+    steps += 1;
+    const path = queue.shift();
+    if (path === void 0) continue;
+    const last = path[path.length - 1];
+    if (last === void 0) continue;
+    if (last === target) {
+      if (path.length >= 2) out.push(path);
+      continue;
+    }
+    if (path.length >= 12) continue;
+    for (const next of edges.get(last) ?? []) {
+      if (path.includes(next)) continue;
+      queue.push([...path, next]);
+    }
+  }
+  return out;
+}
 function reachableFrom(target, roots, edges) {
   if (roots.has(target)) return true;
   return shortestDependencyPath(target, roots, edges) !== void 0;
 }
-function importedDirectNames(usage, graph) {
-  const directs = /* @__PURE__ */ new Set([...graph.directProd, ...graph.directDev]);
+function importedDirectNames(usage, graph2) {
+  const directs = /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]);
   const out = /* @__PURE__ */ new Set();
-  for (const [name, hit] of usage) {
-    if (!hit.imported) continue;
+  for (const [name, hit2] of usage) {
+    if (!hit2.imported) continue;
     if (directs.size === 0 || directs.has(name)) out.add(name);
   }
   return out;
 }
-function classifyReachability(pkgName, productionUsage, graph) {
-  const hit = productionUsage.get(pkgName);
-  if (hit?.imported === true) {
-    return { reachability: hit.called ? "reachable" : "imported-not-called" };
+function classifyReachability(pkgName, productionUsage, graph2) {
+  const hit2 = productionUsage.get(pkgName);
+  if (hit2?.imported === true) {
+    return { reachability: hit2.called ? "reachable" : "imported-not-called" };
   }
-  if (graph !== void 0 && graph.edgesKnown) {
-    const roots = importedDirectNames(productionUsage, graph);
-    const path = shortestDependencyPath(pkgName, roots, graph.edges);
+  if (graph2 !== void 0 && graph2.edgesKnown) {
+    const roots = importedDirectNames(productionUsage, graph2);
+    const paths = collectDependencyPaths(pkgName, roots, graph2.edges);
+    const path = paths[0];
     if (path !== void 0 && path.length >= 2) {
-      return { reachability: "reachable-via-dependency", path };
+      return { reachability: "reachable-via-dependency", path, paths };
     }
     return { reachability: "not-imported" };
   }
-  if (graph !== void 0 && !graph.edgesKnown) {
+  if (graph2 !== void 0 && !graph2.edgesKnown) {
     return { reachability: "reachability-unknown" };
   }
   return { reachability: "not-imported" };
 }
+function unusedDirectPackages(ctx) {
+  if (!ctx.graph.edgesKnown) return [];
+  const imported = importedDirectNames(ctx.productionUsage, ctx.graph);
+  return [...ctx.graph.directProd].filter((name) => {
+    if (ctx.productionUsage.get(name)?.imported === true) return false;
+    return !reachableFrom(name, imported, ctx.graph.edges);
+  }).sort();
+}
+function unusedDirectPlan(findings, ctx) {
+  const packages = unusedDirectPackages(ctx);
+  if (packages.length === 0) return void 0;
+  const names = new Set(packages);
+  let advisories = 0;
+  for (const finding6 of findings) {
+    if (finding6.ruleId !== "DEPS-VULN-001" && finding6.ruleId !== "DEPS-MALICIOUS-001") continue;
+    if (finding6.snippet === void 0) continue;
+    const pkg = packageNameFromSnippet(finding6.snippet);
+    if (pkg !== void 0 && names.has(pkg)) advisories += 1;
+  }
+  return { packages, advisories };
+}
 function reachabilitySteps(reachability) {
   if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
@@ -1319,8 +1636,99 @@ function isDevOnly(pkgName, ctx) {
   if (inProd) return false;
   return directDev.has(pkgName) || reachableFrom(pkgName, directDev, edges);
 }
+function versionFromSnippet(snippet) {
+  const name = packageNameFromSnippet(snippet);
+  if (name === void 0) return snippet;
+  return snippet.slice(name.length + 1);
+}
+function pathFields(classified) {
+  const paths = classified.paths ?? (classified.path !== void 0 ? [classified.path] : []);
+  if (paths.length === 0) return {};
+  return {
+    dependencyPath: paths[0],
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
+function appendOtherPaths(message, paths) {
+  if (paths === void 0 || paths.length < 2) return message;
+  const rest = paths.slice(1).map((p) => p.join(" > ")).join("; ");
+  return `${message} Other paths: ${rest}.`;
+}
+function groupPackageAdvisories(findings) {
+  const passthrough = [];
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of findings) {
+    if (finding6.ruleId !== "DEPS-VULN-001" && finding6.ruleId !== "DEPS-MALICIOUS-001") {
+      passthrough.push(finding6);
+      continue;
+    }
+    const name = packageNameFromSnippet(finding6.snippet ?? "") ?? finding6.snippet ?? finding6.id;
+    const advisory = finding6.references?.[0] ?? finding6.id;
+    const key = `${finding6.ruleId}\0${name}\0${advisory}`;
+    const list = groups.get(key);
+    if (list === void 0) groups.set(key, [finding6]);
+    else list.push(finding6);
+  }
+  const merged = [];
+  for (const list of groups.values()) {
+    const only = list[0];
+    if (list.length === 1 && only !== void 0) {
+      merged.push(only);
+      continue;
+    }
+    merged.push(mergeAdvisory(list));
+  }
+  return [...passthrough, ...merged];
+}
+function mergeAdvisory(list) {
+  const ranked = [...list].sort(
+    (a, b) => severityRank(b.severity) - severityRank(a.severity) || (REACH_RANK[a.reachability ?? "not-imported"] ?? 9) - (REACH_RANK[b.reachability ?? "not-imported"] ?? 9)
+  );
+  const primary = ranked[0];
+  if (primary === void 0) {
+    throw new Error("empty advisory group");
+  }
+  const name = packageNameFromSnippet(primary.snippet ?? "") ?? "package";
+  const versions = [...new Set(list.map((f) => versionFromSnippet(f.snippet ?? "")))].filter((v) => v.length > 0).sort();
+  const paths = [];
+  const seenPath = /* @__PURE__ */ new Set();
+  for (const finding6 of list) {
+    const candidates = finding6.dependencyPaths ?? (finding6.dependencyPath !== void 0 ? [finding6.dependencyPath] : []);
+    for (const path of candidates) {
+      const key = path.join("\0");
+      if (seenPath.has(key)) continue;
+      seenPath.add(key);
+      paths.push(path);
+    }
+  }
+  paths.sort((a, b) => a.length - b.length || a.join(">").localeCompare(b.join(">")));
+  const advisory = primary.references?.[0] ?? "";
+  const onManifest = list.find((f) => f.file === "package.json");
+  const file = onManifest?.file ?? primary.file;
+  const line = onManifest?.line ?? primary.line;
+  const snippet = versions.length > 0 ? `${name}@${versions.join(",")}` : primary.snippet ?? name;
+  let message = primary.message;
+  if (versions.length > 1) {
+    message = `${message} Versions: ${versions.join(", ")}.`;
+  }
+  if (paths.length > 1) {
+    message = `${message} Dependency paths: ${paths.map((p) => p.join(" > ")).join("; ")}.`;
+  }
+  return {
+    ...primary,
+    id: makeFindingId(primary.ruleId, file, `${name}|${advisory}|${versions.join(",")}`),
+    file,
+    line,
+    snippet,
+    message,
+    severity: primary.severity,
+    reachability: primary.reachability,
+    ...paths[0] !== void 0 ? { dependencyPath: paths[0] } : {},
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
 function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
-  return findings.map((finding6) => {
+  const mapped = findings.map((finding6) => {
     if (finding6.ruleId === "DEPS-MALICIOUS-001") {
       if (finding6.snippet === void 0) return finding6;
       const pkg2 = packageNameFromSnippet(finding6.snippet);
@@ -1330,7 +1738,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
         ...finding6,
         severity: "critical",
         reachability: classified2.reachability,
-        ...classified2.path !== void 0 ? { dependencyPath: classified2.path } : {}
+        ...pathFields(classified2)
       };
     }
     if (finding6.ruleId !== "DEPS-VULN-001" || finding6.snippet === void 0) return finding6;
@@ -1340,7 +1748,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     const named = symbols.get(finding6.id) ?? [];
     if (named.length > 0 && ctx.sources !== void 0) {
       const symbolClass = classifySymbolUse(named, ctx.sources);
-      classified = { reachability: symbolClass, path: classified.path };
+      classified = { reachability: symbolClass, path: classified.path, paths: classified.paths };
     }
     const steps = reachabilitySteps(classified.reachability);
     let severity = steps === 0 ? finding6.severity : downgradeSeverity(finding6.severity, steps);
@@ -1348,6 +1756,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     if (classified.path !== void 0) {
       const shown = classified.path.join(" > ");
       message = `${message} Reachable via ${shown}.`;
+      message = appendOtherPaths(message, classified.paths);
     }
     const devOnly = isDevOnly(pkg, ctx);
     if (devOnly) {
@@ -1357,16 +1766,27 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     return {
       ...finding6,
       reachability: classified.reachability,
-      ...classified.path !== void 0 ? { dependencyPath: classified.path } : {},
+      ...pathFields(classified),
       severity,
       message
     };
   });
+  return groupPackageAdvisories(mapped);
 }
+var REACH_RANK;
 var init_reachability = __esm({
   "src/modules/deps/reachability.ts"() {
     init_finding();
     init_symbol_reachability();
+    REACH_RANK = {
+      reachable: 0,
+      "symbol-reachable": 1,
+      "reachable-via-dependency": 2,
+      "imported-not-called": 3,
+      "symbol-not-called": 4,
+      "reachability-unknown": 5,
+      "not-imported": 6
+    };
   }
 });
 
@@ -1428,6 +1848,186 @@ var init_semver = __esm({
   }
 });
 
+// src/modules/deps/upgrade-plan.ts
+function sentenceFor(bumps, unresolved) {
+  const parts = [];
+  if (bumps.length === 1) {
+    const bump = bumps[0];
+    if (bump !== void 0) {
+      const noun = bump.findings === 1 ? "finding" : "findings";
+      parts.push(`1 bump (${bump.name} ${bump.from} \u2192 ${bump.to}) resolves ${bump.findings} ${noun}.`);
+    }
+  } else if (bumps.length > 1) {
+    const listed = bumps.map((bump) => `${bump.name} ${bump.from} \u2192 ${bump.to}`).join(", ");
+    const total = bumps.reduce((sum, bump) => sum + bump.findings, 0);
+    const noun = total === 1 ? "finding" : "findings";
+    parts.push(`${bumps.length} bumps (${listed}) resolve ${total} ${noun}.`);
+  }
+  if (unresolved.length > 0) {
+    parts.push(`No fixed version in the OSV cache for ${unresolved.join(", ")}.`);
+  }
+  return parts.join(" ");
+}
+function chooseUpgradePlan(advisories) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const advisory of advisories) {
+    const list = byName.get(advisory.name);
+    if (list === void 0) byName.set(advisory.name, [advisory]);
+    else list.push(advisory);
+  }
+  const unresolved = [];
+  const candidates = [];
+  for (const [name, list] of byName) {
+    const from = list[0]?.from ?? "0.0.0";
+    if (list.some((advisory) => advisory.fixed === void 0)) {
+      unresolved.push(name);
+      continue;
+    }
+    let to = list[0]?.fixed;
+    for (const advisory of list) {
+      if (advisory.fixed !== void 0 && (to === void 0 || compareSemver(advisory.fixed, to) > 0)) {
+        to = advisory.fixed;
+      }
+    }
+    if (to === void 0 || compareSemver(to, from) <= 0) continue;
+    candidates.push({
+      name,
+      from,
+      to,
+      ids: list.map((advisory) => advisory.id)
+    });
+  }
+  unresolved.sort();
+  const chosen = smallestMaxCover(candidates);
+  if (chosen.length === 0 && unresolved.length === 0) return void 0;
+  const bumps = chosen.map((candidate) => ({
+    name: candidate.name,
+    from: candidate.from,
+    to: candidate.to,
+    safe: sameMajor(candidate.from, candidate.to),
+    findings: candidate.ids.length
+  }));
+  return { bumps, unresolved, sentence: sentenceFor(bumps, unresolved) };
+}
+function smallestMaxCover(candidates) {
+  const limit = Math.min(candidates.length, 12);
+  let best = [];
+  let bestCount = -1;
+  const walk5 = (index, picked, covered) => {
+    if (index === limit) {
+      if (covered.size > bestCount || covered.size === bestCount && betterTie(picked, best)) {
+        best = picked;
+        bestCount = covered.size;
+      }
+      return;
+    }
+    const next = candidates[index];
+    if (next === void 0) return;
+    walk5(index + 1, picked, covered);
+    const grown = new Set(covered);
+    for (const id of next.ids) grown.add(id);
+    walk5(index + 1, [...picked, next], grown);
+  };
+  walk5(0, [], /* @__PURE__ */ new Set());
+  return [...best].sort((a, b) => a.name.localeCompare(b.name));
+}
+function betterTie(picked, best) {
+  if (picked.length !== best.length) return picked.length < best.length;
+  const left = picked.map((item) => item.name).sort().join("\0");
+  const right = best.map((item) => item.name).sort().join("\0");
+  return left < right;
+}
+var init_upgrade_plan = __esm({
+  "src/modules/deps/upgrade-plan.ts"() {
+    init_semver();
+  }
+});
+
+// src/supply/campaign.ts
+function hit(ruleId, title, message, file, severity) {
+  return {
+    id: makeFindingId(ruleId, file, message),
+    ruleId,
+    module: "deps",
+    title,
+    severity,
+    confidence: "high",
+    file,
+    message,
+    remediation: "Do not install this package. Remove it, delete node_modules, and reinstall from a clean lockfile."
+  };
+}
+function campaignFindings(files) {
+  const findings = [];
+  for (const source of files) {
+    const hasChain = RPC_RE.test(source.text);
+    const hasNet = NET_RE.test(source.text) || EVAL_RE.test(source.text);
+    if (hasChain && hasNet) {
+      findings.push(
+        hit(
+          "SUPPLY-CHAINC2-001",
+          "Package reads a blockchain RPC and then fetches or evaluates the result",
+          "static: RPC method combined with fetch or eval",
+          source.file,
+          "high"
+        )
+      );
+    }
+    const steals = STEAL_RE.test(source.text);
+    const callsNet = NET_RE.test(source.text);
+    if (steals && callsNet) {
+      findings.push(
+        hit(
+          "SUPPLY-STEALER-001",
+          "Package reads a local credential store and makes a network call",
+          "static: browser, chat, or wallet path combined with a network call",
+          source.file,
+          "critical"
+        )
+      );
+    }
+    const gated2 = PLATFORM_RE.test(source.text);
+    const downloads = DOWNLOAD_RE.test(source.text);
+    const spawns = SPAWN_RE.test(source.text);
+    if (gated2 && downloads && spawns) {
+      findings.push(
+        hit(
+          "SUPPLY-PLATFORMGATE-001",
+          "Package downloads and launches a file only on one platform",
+          "static: platform check combined with a download and a process spawn",
+          source.file,
+          "high"
+        )
+      );
+    }
+  }
+  return findings;
+}
+function securityPlaceholderFinding(name, locked, latest) {
+  if (latest !== "0.0.1-security") return void 0;
+  if (locked === "0.0.1-security") return void 0;
+  return hit(
+    "SUPPLY-SECHOLDER-001",
+    `Locked ${name}@${locked} was replaced on the registry by the security placeholder`,
+    `${name} latest is 0.0.1-security while the lockfile pins ${locked}`,
+    "package-lock.json",
+    "critical"
+  );
+}
+var RPC_RE, NET_RE, EVAL_RE, STEAL_RE, PLATFORM_RE, DOWNLOAD_RE, SPAWN_RE;
+var init_campaign = __esm({
+  "src/supply/campaign.ts"() {
+    init_finding();
+    RPC_RE = /getSignaturesForAddress|eth_getLogs/;
+    NET_RE = /https\.request|http\.request|fetch\s*\(|axios\./;
+    EVAL_RE = /\beval\s*\(/;
+    STEAL_RE = /Login Data|leveldb|discord[\\/]Local Storage|wallet-extension|Ethereum\/keystore/i;
+    PLATFORM_RE = /process\.platform\s*===\s*['"]win32['"]|os\.platform\s*\(\s*\)/;
+    DOWNLOAD_RE = /https?:\/\/example\.invalid|createWriteStream|https\.get/;
+    SPAWN_RE = /child_process|spawn\s*\(|execFile\s*\(|\.exe['"]/;
+  }
+});
+
 // src/modules/deps/popular.ts
 var POPULAR_PACKAGES;
 var init_popular = __esm({
@@ -3294,6 +3894,62 @@ var init_experimental2 = __esm({
   "src/supply/experimental.ts"() {
   }
 });
+function isCopyleftLicense(license) {
+  return COPYLEFT.test(license);
+}
+function licenseText(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && value !== null && "type" in value) {
+    const type = value.type;
+    if (typeof type === "string") return type;
+  }
+  return void 0;
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function scanCopyleftLicenses(cwd) {
+  const manifest = await readJson(join(cwd, "package.json"));
+  if (typeof manifest !== "object" || manifest === null) return [];
+  const names = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    const block = manifest[field];
+    if (typeof block === "object" && block !== null && !Array.isArray(block)) {
+      for (const name of Object.keys(block)) names.add(name);
+    }
+  }
+  const findings = [];
+  for (const name of names) {
+    const pkg = await readJson(join(cwd, "node_modules", name, "package.json"));
+    if (typeof pkg !== "object" || pkg === null) continue;
+    const license = licenseText(pkg.license);
+    if (license === void 0 || !isCopyleftLicense(license)) continue;
+    findings.push({
+      id: makeFindingId("DEPS-LICENSE-001", "package.json", `${name}|${license}`),
+      ruleId: "DEPS-LICENSE-001",
+      module: "deps",
+      title: `Copyleft dependency ${name}`,
+      severity: "medium",
+      confidence: "high",
+      file: "package.json",
+      snippet: `${name} ${license}`,
+      message: `${name} is licensed ${license}.`,
+      remediation: "Replace the dependency or get a legal review before shipping it in a commercial product."
+    });
+  }
+  return findings;
+}
+var COPYLEFT;
+var init_license = __esm({
+  "src/modules/deps/license.ts"() {
+    init_finding();
+    COPYLEFT = /(?:^|[^\w])(?:AGPL|GPL)(?:-|[^\w]|$)/i;
+  }
+});
 
 // src/fixer/eol.ts
 function detectEol(text) {
@@ -3407,7 +4063,7 @@ __export(supply_exports, {
   checkProvenance: () => checkProvenance,
   diffPackageVersions: () => diffPackageVersions,
   installGuard: () => installGuard,
-  packageNameFromSpec: () => packageNameFromSpec2,
+  packageNameFromSpec: () => packageNameFromSpec3,
   provenanceCoverage: () => provenanceCoverage
 });
 function assertRegistryUrl(url) {
@@ -3421,7 +4077,7 @@ function assertRegistryUrl(url) {
     throw new Error(`supply: only ${REGISTRY_HOST} is allowed (got ${parsed.hostname || url})`);
   }
 }
-function packageNameFromSpec2(spec) {
+function packageNameFromSpec3(spec) {
   if (spec.startsWith("@")) {
     const slash = spec.indexOf("/");
     if (slash < 0) return spec;
@@ -3459,7 +4115,7 @@ function walkJs(dir, out = []) {
   }
   return out;
 }
-function readJson(path) {
+function readJson2(path) {
   return JSON.parse(readFileSync(path, "utf8"));
 }
 function installScriptKeys(scripts) {
@@ -3470,7 +4126,7 @@ function analyzePackageDir(dir) {
   const findings = [];
   const manifestPath = join(dir, "package.json");
   if (!existsSync(manifestPath) || !statSync(manifestPath).isFile()) return findings;
-  const pkg = readJson(manifestPath);
+  const pkg = readJson2(manifestPath);
   const scripts = pkg.scripts ?? {};
   const keys = installScriptKeys(scripts);
   if (keys.length > 0) {
@@ -3490,13 +4146,13 @@ function analyzePackageDir(dir) {
   const readsNpmrc = sources.some((s) => s.text.includes(".npmrc") || s.text.includes(".ssh"));
   const hasNet = sources.some((s) => /https\.request|http\.request|fetch\s*\(|axios\./.test(s.text));
   if (readsNpmrc && hasNet) {
-    const hit = sources.find((s) => s.text.includes(".npmrc") || s.text.includes(".ssh"));
+    const hit2 = sources.find((s) => s.text.includes(".npmrc") || s.text.includes(".ssh"));
     findings.push(
       finding(
         "SUPPLY-NPMRC-NET-001",
         "Install-time code reads npm/ssh credentials and uses the network",
         "static: credential file read combined with http(s)/fetch",
-        hit?.file,
+        hit2?.file,
         "critical"
       )
     );
@@ -3520,8 +4176,8 @@ function analyzePackageDir(dir) {
   return findings;
 }
 function diffPackageVersions(oldDir, newDir) {
-  const oldManifest = existsSync(join(oldDir, "package.json")) ? readJson(join(oldDir, "package.json")) : {};
-  const nextManifest = existsSync(join(newDir, "package.json")) ? readJson(join(newDir, "package.json")) : {};
+  const oldManifest = existsSync(join(oldDir, "package.json")) ? readJson2(join(oldDir, "package.json")) : {};
+  const nextManifest = existsSync(join(newDir, "package.json")) ? readJson2(join(newDir, "package.json")) : {};
   const oldScripts = oldManifest.scripts ?? {};
   const nextScripts = nextManifest.scripts ?? {};
   const added = INSTALL_SCRIPT_KEYS.filter((k) => typeof nextScripts[k] === "string" && oldScripts[k] === void 0);
@@ -3562,14 +4218,24 @@ function checkLockfileIntegrity(lock) {
     if (name === "") continue;
     const resolved = entry.resolved;
     if (!resolved) continue;
+    if (entry.integrity === void 0 || entry.integrity.length === 0) {
+      findings.push(
+        finding(
+          "SUPPLY-LOCKINTEGRITY-001",
+          "Lockfile entry has no integrity hash",
+          `${name} resolved without an integrity hash`,
+          "package-lock.json"
+        )
+      );
+    }
     try {
-      const host = new URL(resolved).hostname;
-      if (host !== REGISTRY_HOST) {
+      const url = new URL(resolved);
+      if (url.protocol !== "https:" || url.hostname !== REGISTRY_HOST) {
         findings.push(
           finding(
             "SUPPLY-LOCKURL-001",
             "Lockfile entry resolves from a non-npm registry host",
-            `${name} resolved host ${host}`,
+            `${name} resolved host ${url.hostname || resolved}`,
             "package-lock.json"
           )
         );
@@ -3617,7 +4283,7 @@ async function installGuard(spec, opts = {}) {
   if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY !== "1") {
     return { findings: [], skipped: true };
   }
-  const name = packageNameFromSpec2(spec);
+  const name = packageNameFromSpec3(spec);
   const url = `https://${REGISTRY_HOST}/${encodeURIComponent(name)}`;
   assertRegistryUrl(url);
   if (opts.fetchPackument) await opts.fetchPackument(url);
@@ -3632,7 +4298,7 @@ function packageSources(dir) {
   let scripts = "";
   if (existsSync(manifestPath) && statSync(manifestPath).isFile()) {
     try {
-      const pkg = readJson(manifestPath);
+      const pkg = readJson2(manifestPath);
       const block = pkg.scripts ?? {};
       scripts = Object.values(block).join("\n");
     } catch {
@@ -3653,7 +4319,7 @@ ${scripts}`;
   if (!TOKEN_RE.test(text)) return [];
   const replicates = PUBLISH_RE.test(text) || REGISTRY_PUT_RE.test(text) || GITHUB_CREATE_RE.test(text) || WORKFLOW_PATH_RE.test(text);
   if (!replicates) return [];
-  const hit = sources.find(
+  const hit2 = sources.find(
     (s) => TOKEN_RE.test(s.text) && (PUBLISH_RE.test(s.text) || REGISTRY_PUT_RE.test(s.text) || GITHUB_CREATE_RE.test(s.text) || WORKFLOW_PATH_RE.test(s.text))
   ) ?? sources.find((s) => TOKEN_RE.test(s.text));
   return [
@@ -3661,7 +4327,7 @@ ${scripts}`;
       "SUPPLY-WORM-001",
       "Self-replicating worm indicators in dependency code",
       "static: npm/GitHub token read combined with publish, registry PUT, GitHub repo/workflow creation, or writing .github/workflows",
-      hit?.file,
+      hit2?.file,
       "critical"
     )
   ];
@@ -3671,13 +4337,13 @@ function analyzeWorkflowTampering(dir) {
   const text = `${sources.map((s) => s.text).join("\n")}
 ${scripts}`;
   if (!CI_WRITE_RE.test(text)) return [];
-  const hit = sources.find((s) => CI_WRITE_RE.test(s.text));
+  const hit2 = sources.find((s) => CI_WRITE_RE.test(s.text));
   return [
     finding(
       "SUPPLY-WORKFLOW-001",
       "Dependency writes GitHub workflow, git hooks, or CI config",
       "static: install script or package code writes .github/, .git/hooks/, or CI configuration",
-      hit?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
+      hit2?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
       "critical"
     )
   ];
@@ -3686,9 +4352,9 @@ function provenanceCoverage(packages, known) {
   let withProvenance = 0;
   let unknown = 0;
   for (const pkg of packages) {
-    const hit = known.get(`${pkg.name}@${pkg.version}`);
-    if (hit === true) withProvenance += 1;
-    else if (hit === void 0) unknown += 1;
+    const hit2 = known.get(`${pkg.name}@${pkg.version}`);
+    if (hit2 === true) withProvenance += 1;
+    else if (hit2 === void 0) unknown += 1;
   }
   const total = packages.length;
   return {
@@ -3728,8 +4394,8 @@ function parentsOf(name, edges) {
   }
   return out;
 }
-function isDirect(name, graph) {
-  return graph.directProd.has(name) || graph.directDev.has(name);
+function isDirect(name, graph2) {
+  return graph2.directProd.has(name) || graph2.directDev.has(name);
 }
 function packagesWithAFixedRelease(findings) {
   const names = /* @__PURE__ */ new Set();
@@ -3747,17 +4413,17 @@ function targetVersion(finding6) {
 function kindFromLockfile(lockFile) {
   return lockfileKind(lockFile) ?? "npm";
 }
-function attachOverrideProposals(findings, graph, lockFile, manifestRaw) {
-  if (!graph.edgesKnown || manifestRaw === void 0) return findings;
+function attachOverrideProposals(findings, graph2, lockFile, manifestRaw) {
+  if (!graph2.edgesKnown || manifestRaw === void 0) return findings;
   const withFix = packagesWithAFixedRelease(findings);
   const kind = kindFromLockfile(lockFile);
   return findings.map((finding6) => {
     if (finding6.ruleId !== "DEPS-VULN-001" || finding6.snippet === void 0) return finding6;
     const name = packageNameFromSnippet2(finding6.snippet);
-    if (name.length === 0 || isDirect(name, graph)) return finding6;
+    if (name.length === 0 || isDirect(name, graph2)) return finding6;
     const version = targetVersion(finding6);
     if (version === void 0) return finding6;
-    const parentFixed = parentsOf(name, graph.edges).some((parent) => withFix.has(parent));
+    const parentFixed = parentsOf(name, graph2.edges).some((parent) => withFix.has(parent));
     if (parentFixed) return finding6;
     const after = withManifestOverride(manifestRaw, kind, name, version);
     const diff = unifiedDiff("package.json", manifestRaw, after);
@@ -3778,10 +4444,10 @@ function scanInstalledPackages(cwd, packages) {
     const dir = packageDir(cwd, pkg);
     if (dir === void 0) continue;
     const prefix = pkg.path.startsWith("node_modules/") ? pkg.path : `node_modules/${pkg.name}`;
-    for (const hit of [...analyzeWormIndicators(dir), ...analyzeWorkflowTampering(dir)]) {
+    for (const hit2 of [...analyzeWormIndicators(dir), ...analyzeWorkflowTampering(dir)]) {
       out.push({
-        ...hit,
-        file: hit.file !== void 0 && hit.file.length > 0 ? `${prefix}/${hit.file}` : prefix
+        ...hit2,
+        file: hit2.file !== void 0 && hit2.file.length > 0 ? `${prefix}/${hit2.file}` : prefix
       });
     }
   }
@@ -3862,19 +4528,19 @@ function maliciousFinding(lockFile, pkg, vuln) {
     references: [vuln.id, ...vuln.aliases ?? []]
   };
 }
-function typosquatFinding(lockFile, hit) {
-  const snippet = `${hit.name}@${hit.version}`;
+function typosquatFinding(lockFile, hit2) {
+  const snippet = `${hit2.name}@${hit2.version}`;
   return {
     id: makeFindingId("DEPS-TYPOSQUAT-001", lockFile, snippet),
     ruleId: "DEPS-TYPOSQUAT-001",
     module: "deps",
-    title: `Possible typosquat: ${hit.name}`,
+    title: `Possible typosquat: ${hit2.name}`,
     severity: "medium",
     confidence: "low",
     file: lockFile,
     snippet,
-    message: `Package "${hit.name}" is 1 character from popular package "${hit.lookalike}" (possible typosquat).`,
-    remediation: `Confirm you intended to install "${hit.name}". If not, remove it and depend on "${hit.lookalike}" instead.`
+    message: `Package "${hit2.name}" is 1 character from popular package "${hit2.lookalike}" (possible typosquat).`,
+    remediation: `Confirm you intended to install "${hit2.name}". If not, remove it and depend on "${hit2.lookalike}" instead.`
   };
 }
 function noLockFinding() {
@@ -3905,46 +4571,121 @@ function deprecatedFinding(lockFile, pkg) {
     remediation: `Replace ${pkg.name} with a maintained alternative.`
   };
 }
-function graphFromManifest(manifest) {
-  const keys = (field) => {
-    const block = manifest[field];
-    if (block !== null && typeof block === "object" && !Array.isArray(block)) {
-      return new Set(Object.keys(block));
-    }
-    return /* @__PURE__ */ new Set();
-  };
-  return {
-    packages: [],
-    edges: /* @__PURE__ */ new Map(),
-    directProd: keys("dependencies"),
-    directDev: keys("devDependencies"),
-    edgesKnown: false
-  };
+function workspacesEnabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_WORKSPACES === "1";
 }
-async function reachabilityCtx(cwd, files, graph) {
-  const prodSources = /* @__PURE__ */ new Map();
-  for (const rel of files) {
-    if (!/\.[cm]?[jt]sx?$/.test(rel)) continue;
-    if (!isProductionSource(rel)) continue;
-    try {
-      prodSources.set(rel, await readFile(join(cwd, rel), "utf8"));
-    } catch {
+function workspacePatterns(manifestRaw) {
+  try {
+    const manifest = JSON.parse(manifestRaw);
+    const field = manifest.workspaces;
+    if (Array.isArray(field)) return field.filter((item) => typeof item === "string");
+    if (field !== null && typeof field === "object" && Array.isArray(field.packages)) {
+      return field.packages.filter((item) => typeof item === "string");
     }
+  } catch {
+    return [];
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
+  return [];
 }
-var LOCKFILE_NAMES, MANIFEST_FIELDS2, MALICIOUS_REMEDIATION, depsModule;
+async function expandWorkspace(cwd, pattern) {
+  const normalized = pattern.replace(/\\/g, "/").replace(/^\.\//, "");
+  if (!normalized.includes("*")) return [normalized];
+  const slash = normalized.indexOf("/*");
+  if (slash < 0) return [];
+  const parent = normalized.slice(0, slash);
+  try {
+    const entries = await readdir(join(cwd, parent), { withFileTypes: true });
+    return entries.filter((entry) => entry.isDirectory()).map((entry) => `${parent}/${entry.name}`).sort();
+  } catch {
+    return [];
+  }
+}
+async function workspaceAdvisoryFindings(cwd, manifestRaw, osvOpts) {
+  const dirs = /* @__PURE__ */ new Set();
+  for (const pattern of workspacePatterns(manifestRaw)) {
+    for (const dir of await expandWorkspace(cwd, pattern)) dirs.add(dir);
+  }
+  const findings = [];
+  for (const dir of [...dirs].sort()) {
+    if (dir === "" || dir === ".") continue;
+    const lockName = LOCKFILE_NAMES.find((name) => existsSync(join(cwd, dir, name)));
+    if (lockName === void 0) continue;
+    let text;
+    try {
+      text = await readFile(join(cwd, dir, lockName), "utf8");
+    } catch {
+      continue;
+    }
+    const graph2 = parseLockfileGraph(lockName, text);
+    const hits = await queryOsv(graph2.packages, osvOpts);
+    const file = `${dir}/${lockName}`;
+    for (const hit2 of hits) {
+      for (const vuln of hit2.vulns) {
+        findings.push(
+          isMaliciousAdvisory(vuln) ? maliciousFinding(file, hit2.pkg, vuln) : vulnFinding(file, hit2.pkg, vuln)
+        );
+      }
+    }
+  }
+  return findings;
+}
+async function withWorkspaceAdvisories(cwd, manifestRaw, osvOpts, findings) {
+  if (!workspacesEnabled() || manifestRaw === void 0) return findings;
+  return [...findings, ...await workspaceAdvisoryFindings(cwd, manifestRaw, osvOpts)];
+}
+async function readPlaceholderLatest(file) {
+  try {
+    const raw = JSON.parse(await readFile(file, "utf8"));
+    return typeof raw.latest === "string" ? raw.latest : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function graphFromManifest(manifest) {
+  const keys = (field) => {
+    const block = manifest[field];
+    if (block !== null && typeof block === "object" && !Array.isArray(block)) {
+      return new Set(Object.keys(block));
+    }
+    return /* @__PURE__ */ new Set();
+  };
+  return {
+    packages: [],
+    edges: /* @__PURE__ */ new Map(),
+    directProd: keys("dependencies"),
+    directDev: keys("devDependencies"),
+    edgesKnown: false
+  };
+}
+async function reachabilityCtx(cwd, files, graph2) {
+  const prodSources = /* @__PURE__ */ new Map();
+  for (const rel of files) {
+    if (!/\.[cm]?[jt]sx?$/.test(rel)) continue;
+    if (!isProductionSource(rel)) continue;
+    try {
+      prodSources.set(rel, await readFile(join(cwd, rel), "utf8"));
+    } catch {
+    }
+  }
+  return { productionUsage: indexPackageUsage(prodSources), graph: graph2, sources: prodSources };
+}
+var LOCKFILE_NAMES, MANIFEST_FIELDS2, MALICIOUS_REMEDIATION, depsModule;
 var init_deps = __esm({
   "src/modules/deps/index.ts"() {
     init_finding();
     init_lockfile();
     init_osv();
     init_pins();
+    init_evidence();
     init_reachability();
+    init_upgrade_plan();
+    init_campaign();
     init_symbol_reachability();
     init_semver();
     init_typosquat();
     init_experimental2();
+    init_experimental();
+    init_license();
     init_phase31();
     LOCKFILE_NAMES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
     MANIFEST_FIELDS2 = ["dependencies", "devDependencies", "optionalDependencies"];
@@ -3952,6 +4693,8 @@ var init_deps = __esm({
     depsModule = {
       name: "deps",
       async run(ctx) {
+        depsModule.unusedDirect = void 0;
+        depsModule.upgradePlan = void 0;
         const lockFile = LOCKFILE_NAMES.find((name) => ctx.files.includes(name));
         const cacheDir = ctx.config.deps.cacheDir !== void 0 ? resolve(ctx.cwd, ctx.config.deps.cacheDir) : defaultCacheDir();
         const osvOpts = { cacheDir, offline: ctx.config.deps.offline };
@@ -3977,21 +4720,21 @@ var init_deps = __esm({
           }
           const pins = exactPinsFromManifest(manifest);
           const directNames2 = await readDirectDependencyNames(ctx.cwd);
-          for (const hit of findTyposquats(pins, { directNames: directNames2 })) {
-            findings2.push(typosquatFinding("package.json", hit));
+          for (const hit2 of findTyposquats(pins, { directNames: directNames2 })) {
+            findings2.push(typosquatFinding("package.json", hit2));
           }
           const osvHits2 = await queryOsv(pins, osvOpts);
           const symbols2 = /* @__PURE__ */ new Map();
-          for (const hit of osvHits2) {
-            for (const vuln of hit.vulns) {
-              const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+          for (const hit2 of osvHits2) {
+            for (const vuln of hit2.vulns) {
+              const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit2.pkg, vuln) : vulnFinding("package.json", hit2.pkg, vuln, depLoc(hit2.pkg.name));
               const names = affectedFunctionNames(vuln);
               if (names.length > 0 && finding6.ruleId === "DEPS-VULN-001") symbols2.set(finding6.id, names);
               findings2.push(finding6);
             }
           }
           const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
-          return applyReachability(findings2, noLockCtx, symbols2);
+          return withWorkspaceAdvisories(ctx.cwd, manifestRaw, osvOpts, applyReachability(findings2, noLockCtx, symbols2));
         }
         let contents;
         try {
@@ -3999,12 +4742,12 @@ var init_deps = __esm({
         } catch {
           return [];
         }
-        const graph = parseLockfileGraph(lockFile, contents);
-        const packages = graph.packages;
+        const graph2 = parseLockfileGraph(lockFile, contents);
+        const packages = graph2.packages;
         const findings = [];
         const directNames = await readDirectDependencyNames(ctx.cwd);
-        for (const hit of findTyposquats(packages, { directNames })) {
-          findings.push(typosquatFinding(lockFile, hit));
+        for (const hit2 of findTyposquats(packages, { directNames })) {
+          findings.push(typosquatFinding(lockFile, hit2));
         }
         for (const pkg of packages) {
           if (pkg.deprecated !== void 0) {
@@ -4013,19 +4756,56 @@ var init_deps = __esm({
         }
         const osvHits = await queryOsv(packages, osvOpts);
         const symbols = /* @__PURE__ */ new Map();
-        for (const hit of osvHits) {
-          for (const vuln of hit.vulns) {
-            const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+        for (const hit2 of osvHits) {
+          for (const vuln of hit2.vulns) {
+            const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit2.pkg, vuln) : vulnFinding(lockFile, hit2.pkg, vuln, depLoc(hit2.pkg.name));
             const names = affectedFunctionNames(vuln);
             if (names.length > 0 && finding6.ruleId === "DEPS-VULN-001") symbols.set(finding6.id, names);
             findings.push(finding6);
           }
         }
-        let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
+        const reachCtx = await reachabilityCtx(ctx.cwd, ctx.files, graph2);
+        let reached = applyReachability(findings, reachCtx, symbols);
         if (experimentalVex()) {
-          reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
+          reached = attachOverrideProposals(reached, graph2, lockFile, manifestRaw);
           reached.push(...scanInstalledPackages(ctx.cwd, packages));
         }
+        if (licenseEnabled()) reached.push(...await scanCopyleftLicenses(ctx.cwd));
+        depsModule.unusedDirect = unusedDirectPlan(reached, reachCtx);
+        const direct = /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]);
+        const advisories = [];
+        for (const hit2 of osvHits) {
+          if (!direct.has(hit2.pkg.name)) continue;
+          for (const vuln of hit2.vulns) {
+            if (isMaliciousAdvisory(vuln)) continue;
+            advisories.push({
+              name: hit2.pkg.name,
+              from: hit2.pkg.version,
+              id: vuln.id,
+              fixed: minFixedVersion(vuln.affected ?? [])
+            });
+          }
+        }
+        depsModule.upgradePlan = chooseUpgradePlan(advisories);
+        if (process.env.FULLSHIELD_EXPERIMENTAL_REACH_EVIDENCE === "1") {
+          const sites = collectImportSites(reachCtx.sources);
+          const files = [...reachCtx.sources.keys()].sort();
+          reached = reached.map((finding6) => {
+            const evidence = evidenceForFinding(finding6, sites, files, graph2.edgesKnown);
+            return evidence === void 0 ? finding6 : { ...finding6, reachabilityEvidence: evidence };
+          });
+        }
+        reached = await withWorkspaceAdvisories(ctx.cwd, manifestRaw, osvOpts, reached);
+        if (process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY === "1") {
+          reached.push(...campaignFindings([...reachCtx.sources.entries()].map(([file, text]) => ({ file, text }))));
+          for (const name of [...direct].sort()) {
+            const locked = packages.find((pkg) => pkg.name === name)?.version;
+            if (locked === void 0) continue;
+            const latest = await readPlaceholderLatest(join(cacheDir, "registry", `${name.replaceAll("/", "__")}.json`));
+            const placeholder = securityPlaceholderFinding(name, locked, latest);
+            if (placeholder !== void 0) reached.push(placeholder);
+          }
+        }
         return reached;
       }
     };
@@ -4407,6 +5187,153 @@ var init_mcp = __esm({
   }
 });
 
+// src/runtime/lru.ts
+var LruMap;
+var init_lru = __esm({
+  "src/runtime/lru.ts"() {
+    LruMap = class {
+      constructor(max) {
+        this.max = max;
+        if (max < 1) throw new Error("LruMap max must be >= 1");
+      }
+      max;
+      map = /* @__PURE__ */ new Map();
+      get size() {
+        return this.map.size;
+      }
+      has(key) {
+        return this.map.has(key);
+      }
+      get(key) {
+        if (!this.map.has(key)) return void 0;
+        const value = this.map.get(key);
+        this.map.delete(key);
+        this.map.set(key, value);
+        return value;
+      }
+      set(key, value) {
+        if (this.map.has(key)) this.map.delete(key);
+        this.map.set(key, value);
+        while (this.map.size > this.max) {
+          const oldest = this.map.keys().next().value;
+          if (oldest === void 0) break;
+          this.map.delete(oldest);
+        }
+        return this;
+      }
+    };
+  }
+});
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+var init_version = __esm({
+  "src/core/version.ts"() {
+  }
+});
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
+  }
+  return Math.min(2, Math.max(1, availableParallelism() - 1));
+}
+function workerMemoryMb() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
+  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
+  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
+  return 512;
+}
+function parseCacheDir() {
+  return join(homedir(), ".cache", "fullshield", "parse");
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit2 = cache.get(key);
+  if (hit2 !== void 0) return Promise.resolve(hit2);
+  return new Promise((resolve8, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), {
+      workerData: { code },
+      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
+    });
+    let settled = false;
+    const finish = () => {
+      void worker.terminate();
+    };
+    const succeed = (ast) => {
+      if (settled) return;
+      settled = true;
+      cache.set(key, ast);
+      finish();
+      resolve8(ast);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      finish();
+      reject(error);
+    };
+    worker.once("message", (ast) => {
+      succeed(ast);
+    });
+    worker.once("error", (error) => {
+      fail(error);
+    });
+    worker.once("exit", (code2) => {
+      if (settled) return;
+      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
+    });
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
+var workerUrl, cache;
+var init_parse_pool = __esm({
+  "src/core/parse-pool.ts"() {
+    init_lru();
+    init_version();
+    workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+    cache = new LruMap(64);
+  }
+});
+
 // src/modules/sast/frameworks.ts
 function decoratorExpr(dec) {
   if (dec.type !== "Decorator") return void 0;
@@ -4555,6 +5482,9 @@ var init_mcp2 = __esm({
 });
 
 // src/modules/sast/taint.ts
+function setCustomTaint(config) {
+  customTaint = config;
+}
 function objectChainMentions(node, pattern) {
   let current = node;
   for (let i = 0; i < 8 && current !== void 0; i += 1) {
@@ -4686,6 +5616,61 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
       return false;
   }
 }
+function valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners) {
+  if (node === void 0) return false;
+  if (isCoercionCall(node) || isSchemaValidatorCall(node) || isMongoSanitizeCall(node)) return false;
+  if (node.type === "Identifier") {
+    if (nosqlSanitized.has(node.name)) return false;
+    return built.has(node.name) || tainted.has(node.name);
+  }
+  if (isRequestObjectNode(node)) return true;
+  if (node.type === "AwaitExpression") {
+    return valueFeedsFilter(node.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  if (node.type === "CallExpression" && node.callee.type === "Identifier" && filterReturners.has(node.callee.name)) {
+    return true;
+  }
+  if (node.type === "ObjectExpression") {
+    return node.properties.some((prop) => {
+      if (prop.type === "SpreadElement") {
+        return valueFeedsFilter(prop.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+      }
+      if (prop.type !== "Property") return false;
+      return valueFeedsFilter(prop.value, tainted, returners, nosqlSanitized, built, filterReturners);
+    });
+  }
+  if (node.type === "ArrayExpression") {
+    return node.elements.some((el) => {
+      if (el === null) return false;
+      if (el.type === "SpreadElement") {
+        return valueFeedsFilter(el.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+      }
+      return valueFeedsFilter(el, tainted, returners, nosqlSanitized, built, filterReturners);
+    });
+  }
+  if (node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+    return node.arguments.some(
+      (arg) => arg.type !== "SpreadElement" && valueFeedsFilter(arg, tainted, returners, nosqlSanitized, built, filterReturners)
+    );
+  }
+  if (node.type === "ChainExpression" || node.type === "TSAsExpression" || node.type === "TSNonNullExpression" || node.type === "TSTypeAssertion" || node.type === "MemberExpression") {
+    return exprIsTainted(node, tainted, returners);
+  }
+  return false;
+}
+function initIsBuiltFilter(node, tainted, returners, nosqlSanitized, built, filterReturners) {
+  if (node.type === "AwaitExpression") {
+    return initIsBuiltFilter(node.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  if (node.type === "Identifier") return built.has(node.name) && !nosqlSanitized.has(node.name);
+  if (node.type === "CallExpression" && node.callee.type === "Identifier" && filterReturners.has(node.callee.name)) {
+    return true;
+  }
+  if (node.type === "ObjectExpression" || node.type === "ArrayExpression") {
+    return valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  return node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign" && valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners);
+}
 function exprIsSanitized(node, tainted, names, isCall, returners = NO_RETURNERS) {
   if (node === void 0) return true;
   if (isCall(node)) return true;
@@ -4749,7 +5734,7 @@ function seedMcpToolParams(scope, tainted) {
     for (const name of boundNames(param)) tainted.add(name);
   }
 }
-function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
+function analyzeScope(scope, seed = [], returners = NO_RETURNERS, filterReturners = NO_RETURNERS, initialBuilt = NO_RETURNERS) {
   const tainted = new Set(seed);
   seedDestructuredRequestParams(scope, tainted);
   seedFrameworkParams(scope, tainted);
@@ -4757,6 +5742,8 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
   const urlSanitized = /* @__PURE__ */ new Set();
   const xssSanitized = /* @__PURE__ */ new Set();
   const nosqlSanitized = /* @__PURE__ */ new Set();
+  const sqlCleared = /* @__PURE__ */ new Set();
+  const customPath = /* @__PURE__ */ new Set();
   let changed = true;
   while (changed) {
     changed = false;
@@ -4767,6 +5754,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
           for (const name of boundNames(node.id)) nosqlSanitized.add(name);
         }
         if (isSchemaValidatorCall(init)) return;
+        applyCustomCall(init, boundNames(node.id), tainted, sqlCleared, customPath);
         if (isUrlSanitizerCall(init)) {
           for (const name of boundNames(node.id)) urlSanitized.add(name);
         }
@@ -4787,6 +5775,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
           for (const name of boundNames(node.left)) nosqlSanitized.add(name);
         }
         if (isSchemaValidatorCall(node.right)) return;
+        applyCustomCall(node.right, boundNames(node.left), tainted, sqlCleared, customPath);
         if (isUrlSanitizerCall(node.right)) {
           for (const name of boundNames(node.left)) urlSanitized.add(name);
         }
@@ -4813,7 +5802,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
       for (const name of boundNames(node.left)) resolved.add(name);
     }
   });
-  const pathSanitized = /* @__PURE__ */ new Set();
+  const pathSanitized = new Set(customPath);
   walkScope(scope, (node) => {
     if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
     if (propName(node.callee) !== "startsWith") return;
@@ -4855,17 +5844,92 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
       for (const name of boundNames(node.left)) requestObjects.add(name);
     }
   });
+  const builtFilters = new Set(initialBuilt);
+  let grew = true;
+  while (grew) {
+    grew = false;
+    const add = (names) => {
+      for (const name of names) {
+        if (nosqlSanitized.has(name) || builtFilters.has(name)) continue;
+        builtFilters.add(name);
+        grew = true;
+      }
+    };
+    walkScope(scope, (node) => {
+      if (node.type === "VariableDeclarator" && node.init !== null) {
+        if (initIsBuiltFilter(node.init, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+          add(boundNames(node.id));
+        }
+      }
+      if (node.type !== "AssignmentExpression") return;
+      if (node.left.type === "Identifier" && initIsBuiltFilter(node.right, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+        add([node.left.name]);
+      }
+      if (node.left.type === "MemberExpression" && node.left.object.type === "Identifier" && valueFeedsFilter(node.right, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+        add([node.left.object.name]);
+      }
+    });
+  }
   return {
     tainted,
     pathSanitized,
+    sqlCleared,
     urlSanitized,
     xssSanitized,
     nosqlSanitized,
     hasPasswordName,
     requestObjects,
+    builtFilters,
+    filterReturners: new Set(filterReturners),
     returners: new Set(returners)
   };
 }
+function locallyDeclared(scope) {
+  const names = /* @__PURE__ */ new Set();
+  if (isFunctionNode(scope)) {
+    for (const param of scope.params) {
+      for (const name of boundNames(param)) names.add(name);
+    }
+  }
+  walkScope(scope, (node) => {
+    if (node.type === "VariableDeclarator") {
+      for (const name of boundNames(node.id)) names.add(name);
+    }
+    if (node.type === "FunctionDeclaration" && node.id !== null) names.add(node.id.name);
+  });
+  return names;
+}
+function inheritedBuiltFilters(fn, facts) {
+  const local = locallyDeclared(fn);
+  const inherited = /* @__PURE__ */ new Set();
+  let parent = fn.parent;
+  while (parent !== void 0 && !isFunctionNode(parent)) {
+    parent = parent.parent;
+  }
+  const outer = parent === void 0 ? void 0 : facts.get(parent);
+  if (outer === void 0) return inherited;
+  for (const name of outer.builtFilters) {
+    if (!local.has(name)) inherited.add(name);
+  }
+  return inherited;
+}
+function scopeReturnsBuiltFilter(scope, facts) {
+  let yes = false;
+  walkScope(scope, (node) => {
+    if (node.type !== "ReturnStatement" || node.argument === null) return;
+    if (initIsBuiltFilter(
+      node.argument,
+      facts.tainted,
+      facts.returners,
+      facts.nosqlSanitized,
+      facts.builtFilters,
+      facts.filterReturners
+    )) {
+      yes = true;
+    }
+  });
+  return yes;
+}
 function functionName(fn) {
   if (fn.type === "FunctionDeclaration" && fn.id !== null) return fn.id.name;
   if (isFunctionNode(fn) && fn.id !== null && fn.id.type === "Identifier") return fn.id.name;
@@ -4939,7 +6003,7 @@ function seedTaintV2(functions, facts, seeds, returners, nameToFn) {
   }
   return changed;
 }
-function analyzeFile(ast, extraReturners = NO_RETURNERS) {
+function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   attachParents(ast);
   const facts = /* @__PURE__ */ new WeakMap();
   const functions = [];
@@ -4953,12 +6017,13 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   }
   const seeds = /* @__PURE__ */ new Map();
   for (const fn of functions) seeds.set(fn, /* @__PURE__ */ new Set());
-  const returners = new Set(extraReturners);
+  const returners = new Set(extraReturners2);
+  const filterReturners = /* @__PURE__ */ new Set();
   for (let hop = 0; hop < MAX_TAINT_HOPS; hop += 1) {
     let changed = false;
-    facts.set(ast, analyzeScope(ast, [], returners));
+    facts.set(ast, analyzeScope(ast, [], returners, filterReturners));
     for (const fn of functions) {
-      facts.set(fn, analyzeScope(fn, seeds.get(fn) ?? [], returners));
+      facts.set(fn, analyzeScope(fn, seeds.get(fn) ?? [], returners, filterReturners, inheritedBuiltFilters(fn, facts)));
     }
     for (const fn of functions) {
       const name = functionName(fn);
@@ -4968,6 +6033,10 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
         returners.add(name);
         changed = true;
       }
+      if (scopeReturnsBuiltFilter(fn, f) && !filterReturners.has(name)) {
+        filterReturners.add(name);
+        changed = true;
+      }
     }
     for (const fn of functions) {
       const f = facts.get(fn);
@@ -5000,6 +6069,51 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   }
   return facts;
 }
+function sinkClasses(scope, tainted, returners) {
+  const found = /* @__PURE__ */ new Set();
+  walkScope(scope, (node) => {
+    if (node.type !== "CallExpression") return;
+    const name = calleeName(node);
+    const first = node.arguments[0];
+    if (name === void 0 || first === void 0 || first.type === "SpreadElement") return;
+    if (!exprIsTainted(first, tainted, returners)) return;
+    if (SQL_SINK_NAMES.has(name)) found.add("sqli");
+    if (CMD_SINK_NAMES.has(name)) found.add("cmdi");
+    if (PATH_SINK_NAMES.has(name)) found.add("path");
+  });
+  return [...found].sort();
+}
+function fileTaintSummary(ast) {
+  attachParents(ast);
+  const facts = analyzeFile(ast);
+  const returnsTaint = [];
+  const functions = [];
+  walk(ast, (node) => {
+    if (!isFunctionNode(node)) return;
+    const name = functionName(node);
+    const own = facts.get(node);
+    if (name === void 0 || own === void 0) return;
+    if (scopeReturnsTaint(node, own.tainted, own.returners)) returnsTaint.push(name);
+    const paramsToReturn = [];
+    const sinks = [];
+    node.params.forEach((param, index) => {
+      const pname = boundNames(param)[0];
+      if (pname === void 0) return;
+      const seeded = analyzeScope(node, [pname]);
+      if (scopeReturnsTaint(node, seeded.tainted, seeded.returners)) paramsToReturn.push(index);
+      for (const cls of sinkClasses(node, seeded.tainted, seeded.returners)) sinks.push({ param: index, class: cls });
+    });
+    functions.push({
+      name,
+      line: node.loc?.start.line ?? 0,
+      paramsToReturn,
+      sinks
+    });
+  });
+  returnsTaint.sort();
+  functions.sort((a, b) => a.line - b.line || a.name.localeCompare(b.name));
+  return { returnsTaint, functions };
+}
 function functionsThatReturnTaint(ast) {
   attachParents(ast);
   const names = /* @__PURE__ */ new Set();
@@ -5021,18 +6135,50 @@ function factsFor(node, map) {
   return map.get(enclosingScope(node)) ?? {
     tainted: /* @__PURE__ */ new Set(),
     pathSanitized: /* @__PURE__ */ new Set(),
+    sqlCleared: /* @__PURE__ */ new Set(),
     urlSanitized: /* @__PURE__ */ new Set(),
     xssSanitized: /* @__PURE__ */ new Set(),
     nosqlSanitized: /* @__PURE__ */ new Set(),
     hasPasswordName: false,
     requestObjects: /* @__PURE__ */ new Set(),
+    builtFilters: /* @__PURE__ */ new Set(),
+    filterReturners: /* @__PURE__ */ new Set(),
     returners: /* @__PURE__ */ new Set()
   };
 }
+function nodeHoldsBuiltFilter(node, map) {
+  const facts = factsFor(node, map);
+  if (node.type === "Identifier") return facts.builtFilters.has(node.name);
+  if (node.type === "AwaitExpression") return nodeHoldsBuiltFilter(node.argument, map);
+  if (node.type === "CallExpression" && node.callee.type === "Identifier") {
+    return facts.filterReturners.has(node.callee.name);
+  }
+  return false;
+}
 function nodeIsTainted(node, map) {
   const facts = factsFor(node, map);
   return exprIsTainted(node, facts.tainted, facts.returners);
 }
+function nodeIsSqlCleared(node, map) {
+  if (node.type === "Identifier") return factsFor(node, map).sqlCleared.has(node.name);
+  return false;
+}
+function applyCustomCall(init, names, tainted, sqlCleared, customPath) {
+  if (customTaint === void 0 || init === void 0 || init.type !== "CallExpression") return;
+  const called2 = calleeName(init);
+  if (called2 === void 0) return;
+  if (customTaint.sources.has(called2)) {
+    for (const name of names) tainted.add(name);
+  }
+  const clears = customTaint.sanitizers.get(called2);
+  if (clears === void 0) return;
+  if (clears.has("sqli")) {
+    for (const name of names) sqlCleared.add(name);
+  }
+  if (clears.has("path")) {
+    for (const name of names) customPath.add(name);
+  }
+}
 function nodeIsPathSanitized(node, map) {
   if (node.type !== "Identifier") return false;
   return factsFor(node, map).pathSanitized.has(node.name);
@@ -5054,7 +6200,7 @@ function nodeIsNosqlSanitized(node, map) {
   if (node.type === "Identifier") return factsFor(node, map).nosqlSanitized.has(node.name);
   return false;
 }
-var SCHEMA_ROOT, NO_RETURNERS, CALLBACK_METHODS, taintedThisFields, MAX_TAINT_HOPS;
+var customTaint, SCHEMA_ROOT, NO_RETURNERS, CALLBACK_METHODS, taintedThisFields, MAX_TAINT_HOPS, SQL_SINK_NAMES, CMD_SINK_NAMES, PATH_SINK_NAMES;
 var init_taint = __esm({
   "src/modules/sast/taint.ts"() {
     init_ast();
@@ -5076,6 +6222,157 @@ var init_taint = __esm({
     ]);
     taintedThisFields = /* @__PURE__ */ new WeakMap();
     MAX_TAINT_HOPS = 5;
+    SQL_SINK_NAMES = /* @__PURE__ */ new Set(["query", "execute"]);
+    CMD_SINK_NAMES = /* @__PURE__ */ new Set(["exec", "execSync", "spawn", "spawnSync"]);
+    PATH_SINK_NAMES = /* @__PURE__ */ new Set(["readFile", "readFileSync", "writeFile", "writeFileSync"]);
+  }
+});
+function taintSummariesEnabled() {
+  return process.env.FULLSHIELD_TAINT_SUMMARIES === "1";
+}
+function setTaintSummaryConfig(config) {
+  fileMemo.clear();
+  if (config === void 0) {
+    configHash = "";
+    return;
+  }
+  configHash = createHash("sha256").update(
+    JSON.stringify({
+      maxFileBytes: config.sast.maxFileBytes,
+      sources: config.sast.sources ?? [],
+      sanitizers: config.sast.sanitizers ?? [],
+      taintV2: taintV2Enabled(),
+      frameworks: frameworksEnabled(),
+      gaps: sastGapsEnabled(),
+      classes: classesEnabled(),
+      custom: process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1"
+    })
+  ).digest("hex");
+}
+function summaryDir() {
+  return process.env.FULLSHIELD_TAINT_SUMMARY_DIR ?? join(parseCacheDir(), "taint");
+}
+function taintSummaryKey(source, extra = "") {
+  return createHash("sha256").update(packageVersion()).update("\0").update(configHash).update("\0").update(extra).update("\0").update(source).digest("hex");
+}
+function summaryPath(key) {
+  return join(summaryDir(), `${key}.json`);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function readJson3(key) {
+  let text;
+  try {
+    text = readFileSync(summaryPath(key), "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    discard(key);
+    return void 0;
+  }
+}
+function discard(key) {
+  rmSync(summaryPath(key), { force: true });
+}
+function writeJson(key, value) {
+  const dir = summaryDir();
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(summaryPath(key), JSON.stringify(value));
+}
+function readFileSummary(key) {
+  const raw = readJson3(key);
+  if (typeof raw !== "object" || raw === null) {
+    if (raw !== void 0) discard(key);
+    return void 0;
+  }
+  const row = raw;
+  if (row.v !== 1 || !isStringArray(row.returnsTaint) || !Array.isArray(row.functions)) {
+    discard(key);
+    return void 0;
+  }
+  return row;
+}
+function cachedReturners(source, ast) {
+  const key = taintSummaryKey(source, "file");
+  const memo = fileMemo.get(key);
+  if (memo !== void 0) return new Set(memo.returnsTaint);
+  const cached = readFileSummary(key);
+  if (cached !== void 0) {
+    fileMemo.set(key, cached);
+    return new Set(cached.returnsTaint);
+  }
+  const summary = fileTaintSummary(ast);
+  const stored = { v: 1, returnsTaint: summary.returnsTaint, functions: summary.functions };
+  fileMemo.set(key, stored);
+  writeJson(key, stored);
+  return new Set(stored.returnsTaint);
+}
+function lists(facts) {
+  const names = (set) => [...set].sort();
+  return {
+    v: 1,
+    tainted: names(facts.tainted),
+    pathSanitized: names(facts.pathSanitized),
+    sqlCleared: names(facts.sqlCleared),
+    urlSanitized: names(facts.urlSanitized),
+    xssSanitized: names(facts.xssSanitized),
+    nosqlSanitized: names(facts.nosqlSanitized),
+    requestObjects: names(facts.requestObjects),
+    builtFilters: names(facts.builtFilters),
+    filterReturners: names(facts.filterReturners),
+    returners: names(facts.returners),
+    hasPasswordName: facts.hasPasswordName
+  };
+}
+function factsFrom(row) {
+  return {
+    tainted: new Set(row.tainted),
+    pathSanitized: new Set(row.pathSanitized),
+    sqlCleared: new Set(row.sqlCleared),
+    urlSanitized: new Set(row.urlSanitized),
+    xssSanitized: new Set(row.xssSanitized),
+    nosqlSanitized: new Set(row.nosqlSanitized),
+    requestObjects: new Set(row.requestObjects),
+    builtFilters: new Set(row.builtFilters),
+    filterReturners: new Set(row.filterReturners),
+    returners: new Set(row.returners),
+    hasPasswordName: row.hasPasswordName
+  };
+}
+function readFacts(key) {
+  const raw = readJson3(key);
+  if (typeof raw !== "object" || raw === null) {
+    if (raw !== void 0) discard(key);
+    return void 0;
+  }
+  const row = raw;
+  if (row.v !== 1 || !isStringArray(row.tainted) || !isStringArray(row.pathSanitized) || !isStringArray(row.sqlCleared) || !isStringArray(row.urlSanitized) || !isStringArray(row.xssSanitized) || !isStringArray(row.nosqlSanitized) || !isStringArray(row.requestObjects) || !isStringArray(row.builtFilters) || !isStringArray(row.filterReturners) || !isStringArray(row.returners) || typeof row.hasPasswordName !== "boolean") {
+    discard(key);
+    return void 0;
+  }
+  return factsFrom(row);
+}
+function cachedFunctionFacts(fileSource, fn, seed) {
+  const key = taintSummaryKey(fileSource, `seed:${fn.loc?.start.line ?? 0}:${seed.join(",")}`);
+  const cached = readFacts(key);
+  if (cached !== void 0) return cached;
+  const facts = analyzeFunctionWithSeed(fn, seed);
+  writeJson(key, lists(facts));
+  return facts;
+}
+var configHash, fileMemo;
+var init_summaries = __esm({
+  "src/modules/sast/summaries.ts"() {
+    init_parse_pool();
+    init_version();
+    init_taint();
+    init_experimental();
+    configHash = "";
+    fileMemo = /* @__PURE__ */ new Map();
   }
 });
 function collectFunctions(file, ast) {
@@ -5186,22 +6483,22 @@ function collectInstances(ast, ns) {
     if (node.type !== "VariableDeclarator" || node.init === null) return;
     if (node.id.type !== "Identifier" || node.init.type !== "NewExpression") return;
     if (node.init.callee.type !== "Identifier") return;
-    const hit = ns.get(node.init.callee.name);
-    if (hit === void 0) return;
-    instances.set(node.id.name, hit.includes("#") ? hit.split("#")[0] ?? hit : hit);
+    const hit2 = ns.get(node.init.callee.name);
+    if (hit2 === void 0) return;
+    instances.set(node.id.name, hit2.includes("#") ? hit2.split("#")[0] ?? hit2 : hit2);
   });
   return instances;
 }
 function resolveCallee(node, ns, instances, currentFile, functions) {
   if (node.type !== "CallExpression") return void 0;
   if (node.callee.type === "Identifier") {
-    const hit = ns.get(node.callee.name);
-    if (hit !== void 0) {
-      if (hit.includes("#")) {
-        const [file, name] = hit.split("#");
+    const hit2 = ns.get(node.callee.name);
+    if (hit2 !== void 0) {
+      if (hit2.includes("#")) {
+        const [file, name] = hit2.split("#");
         if (file !== void 0 && name !== void 0) return { file, name };
       }
-      return { file: hit, name: node.callee.name };
+      return { file: hit2, name: node.callee.name };
     }
     if (functions.has(`${currentFile}#${node.callee.name}`)) {
       return { file: currentFile, name: node.callee.name };
@@ -5308,9 +6605,9 @@ function runInterproc(parsed) {
     if (fn === void 0) continue;
     const param = fn.params[seed.paramIndex];
     if (param === void 0) continue;
-    const facts = analyzeFunctionWithSeed(fn.node, [param]);
     const p = byFile.get(fn.file);
     if (p === void 0) continue;
+    const facts = taintSummariesEnabled() ? cachedFunctionFacts(p.source, fn.node, [param]) : analyzeFunctionWithSeed(fn.node, [param]);
     const ns = requires.get(fn.file) ?? /* @__PURE__ */ new Map();
     const inst = instances.get(fn.file) ?? /* @__PURE__ */ new Map();
     walk(fn.node, (node) => {
@@ -5404,6 +6701,7 @@ var init_interproc = __esm({
     init_finding();
     init_ast();
     init_experimental();
+    init_summaries();
     init_taint();
     MAX_HOPS = 5;
   }
@@ -5775,6 +7073,184 @@ var init_jwt = __esm({
   }
 });
 
+// src/modules/sast/validation.ts
+function validationEnabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_VALIDATION === "1";
+}
+function parentOf(node) {
+  return node.parent;
+}
+function mentions(node, names) {
+  let current = node;
+  for (let i = 0; i < 12 && current !== void 0; i += 1) {
+    if (current.type === "CallExpression") {
+      const name = calleeName(current);
+      if (name !== void 0 && names.has(name)) return true;
+      current = current.callee.type === "MemberExpression" ? current.callee.object : void 0;
+      continue;
+    }
+    if (current.type === "MemberExpression") {
+      const name = propName(current);
+      if (name !== void 0 && names.has(name)) return true;
+      current = current.object;
+      continue;
+    }
+    if (current.type === "Identifier" && names.has(current.name)) return true;
+    break;
+  }
+  return false;
+}
+function rootName(node) {
+  let current = node;
+  for (let i = 0; i < 8 && current !== void 0; i += 1) {
+    if (current.type === "Identifier") return current.name;
+    if (current.type === "CallExpression") {
+      current = current.callee;
+      continue;
+    }
+    if (current.type === "MemberExpression") {
+      current = current.object;
+      continue;
+    }
+    break;
+  }
+  return void 0;
+}
+function propertyName(prop) {
+  if (prop.type !== "Property") return void 0;
+  const key = prop.key;
+  if (key.type === "Identifier") return key.name;
+  if (key.type === "Literal" && typeof key.value === "string") return key.value;
+  return void 0;
+}
+function fieldsOfObjectSchema(node) {
+  if (node.type !== "CallExpression" || calleeName(node) !== "object") return /* @__PURE__ */ new Set();
+  const root = rootName(node.callee);
+  if (root === void 0 || !SCHEMA_ROOT2.has(root)) return /* @__PURE__ */ new Set();
+  const arg = node.arguments[0];
+  if (arg === void 0 || arg.type !== "ObjectExpression") return /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const prop of arg.properties) {
+    if (prop.type !== "Property") continue;
+    const name = propertyName(prop);
+    if (name === void 0) continue;
+    if (mentions(prop.value, OPEN)) continue;
+    if (mentions(prop.value, PRIMITIVE)) fields.add(name);
+  }
+  return fields;
+}
+function decoratorName2(decorator) {
+  const expr = decorator.type === "Decorator" ? decorator.expression : decorator;
+  if (expr === void 0) return void 0;
+  if (expr.type === "CallExpression") return calleeName(expr);
+  if (expr.type === "Identifier") return expr.name;
+  return void 0;
+}
+function fieldsOfClass(node) {
+  if (node.type !== "ClassDeclaration" && node.type !== "ClassExpression") return /* @__PURE__ */ new Set();
+  if (node.body.type !== "ClassBody") return /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const element of node.body.body) {
+    if (element.type !== "PropertyDefinition") continue;
+    const key = element.key;
+    const name = key.type === "Identifier" ? key.name : void 0;
+    if (name === void 0) continue;
+    const decorators = element.decorators ?? [];
+    if (decorators.some((decorator) => PRIMITIVE.has(decoratorName2(decorator) ?? ""))) fields.add(name);
+  }
+  return fields;
+}
+function programOf(node) {
+  let current = node;
+  while (current !== void 0 && current.type !== "Program") current = parentOf(current);
+  return current;
+}
+function bindings(program) {
+  const map = /* @__PURE__ */ new Map();
+  walk(program, (node) => {
+    if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.init !== null && node.init !== void 0) {
+      const fields = fieldsOfObjectSchema(node.init);
+      if (fields.size > 0) map.set(node.id.name, fields);
+    }
+    if (node.type === "ClassDeclaration" && node.id !== null) {
+      const fields = fieldsOfClass(node);
+      if (fields.size > 0) map.set(node.id.name, fields);
+    }
+  });
+  return map;
+}
+function fieldsOfExpr(expr, known) {
+  if (expr.type === "Identifier") return new Set(known.get(expr.name) ?? []);
+  if (expr.type === "ClassExpression" || expr.type === "ClassDeclaration") return fieldsOfClass(expr);
+  const direct = fieldsOfObjectSchema(expr);
+  if (expr.type !== "CallExpression") return direct;
+  for (const arg of expr.arguments) {
+    if (arg.type === "SpreadElement") continue;
+    for (const name of fieldsOfExpr(arg, known)) direct.add(name);
+  }
+  return direct;
+}
+function isRouteCall2(node) {
+  if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return false;
+  const method = propName(node.callee);
+  if (method === void 0 || !ROUTE_METHODS.has(method)) return false;
+  return node.callee.object.type === "Identifier" && /^(app|router)$/i.test(node.callee.object.name);
+}
+function routeOf(node) {
+  let current = node;
+  while (current !== void 0) {
+    const parent = parentOf(current);
+    if (isFunctionNode(current) && parent !== void 0 && isRouteCall2(parent)) return parent;
+    current = parent;
+  }
+  return void 0;
+}
+function requestField(node) {
+  if (node.type !== "MemberExpression" || node.computed === true) return void 0;
+  const field = node.property.type === "Identifier" ? node.property.name : void 0;
+  if (field === void 0 || node.object.type !== "MemberExpression" || node.object.computed === true) return void 0;
+  const bag = node.object.property.type === "Identifier" ? node.object.property.name : void 0;
+  if (bag !== "body" && bag !== "query" && bag !== "params") return void 0;
+  if (node.object.object.type !== "Identifier" || node.object.object.name !== "req") return void 0;
+  return field;
+}
+function fieldsForRoute(route) {
+  const cached = routeCache.get(route);
+  if (cached !== void 0) return cached;
+  const program = programOf(route);
+  const known = program === void 0 ? /* @__PURE__ */ new Map() : bindingCache.get(program) ?? bindings(program);
+  if (program !== void 0) bindingCache.set(program, known);
+  const fields = /* @__PURE__ */ new Set();
+  if (route.type === "CallExpression") {
+    for (const arg of route.arguments) {
+      if (arg.type === "SpreadElement" || isFunctionNode(arg)) continue;
+      for (const name of fieldsOfExpr(arg, known)) fields.add(name);
+    }
+  }
+  routeCache.set(route, fields);
+  return fields;
+}
+function isValidatedRouteField(node) {
+  if (!validationEnabled()) return false;
+  const field = requestField(node);
+  if (field === void 0) return false;
+  const route = routeOf(node);
+  if (route === void 0) return false;
+  return fieldsForRoute(route).has(field);
+}
+var PRIMITIVE, OPEN, SCHEMA_ROOT2, ROUTE_METHODS, bindingCache, routeCache;
+var init_validation = __esm({
+  "src/modules/sast/validation.ts"() {
+    init_ast();
+    PRIMITIVE = /* @__PURE__ */ new Set(["string", "number", "boolean", "IsString", "IsNumber", "IsInt", "IsBoolean"]);
+    OPEN = /* @__PURE__ */ new Set(["any", "unknown", "object", "array", "record", "lazy", "union", "tuple"]);
+    SCHEMA_ROOT2 = /* @__PURE__ */ new Set(["z", "zod", "Joi", "joi"]);
+    ROUTE_METHODS = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
+    bindingCache = /* @__PURE__ */ new WeakMap();
+    routeCache = /* @__PURE__ */ new WeakMap();
+  }
+});
+
 // src/modules/sast/rules/nosqli.ts
 function objectKey(prop) {
   if (prop.type !== "Property" || prop.key === void 0) return void 0;
@@ -5836,6 +7312,7 @@ function isNosqlSafeValue(node, source, isNosqlSanitized) {
   if (isNosqlSanitized(node) || isCoercionCall(node) || isSchemaValidatorCall(node) || isMongoSanitizeCall(node)) {
     return true;
   }
+  if (isValidatedRouteField(node)) return true;
   return isSanitizeWrap(node, source);
 }
 function objectHasUnsafeTaintedValue(node, isTainted, isSafe) {
@@ -5857,6 +7334,7 @@ var init_nosqli = __esm({
   "src/modules/sast/rules/nosqli.ts"() {
     init_ast();
     init_taint();
+    init_validation();
     MONGO_SINKS = /* @__PURE__ */ new Set([
       "find",
       "findOne",
@@ -5927,6 +7405,14 @@ var init_nosqli = __esm({
               return;
             }
             if (middleware) return;
+            if (ctx.holdsBuiltFilter(filter)) {
+              ctx.report({
+                node,
+                message: "A Mongo filter built from request input is passed to the query.",
+                confidence: "medium"
+              });
+              return;
+            }
             if (objectHasUnsafeTaintedValue(filter, (n) => ctx.isTainted(n), isSafe)) {
               ctx.report({
                 node,
@@ -6128,7 +7614,7 @@ var init_sqli = __esm({
           CallExpression(node) {
             if (node.type !== "CallExpression" || !isSqlSink2(node)) return;
             const sql = node.arguments[0];
-            if (sql !== void 0 && sql.type !== "SpreadElement" && ctx.isTainted(sql)) {
+            if (sql !== void 0 && sql.type !== "SpreadElement" && ctx.isTainted(sql) && !ctx.isSqlCleared(sql)) {
               ctx.report({
                 node,
                 message: "Tainted input is concatenated into a SQL string passed to query/execute."
@@ -6292,27 +7778,27 @@ function numberLiteral(node) {
   return node.value;
 }
 function containsIdentMember(node, objectName) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
     if (child.type === "MemberExpression" && child.object.type === "Identifier" && child.object.name === objectName) {
-      hit = true;
+      hit2 = true;
     }
   });
-  return hit;
+  return hit2;
 }
 function containsCallNamed(node, name) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
-    if (child.type === "CallExpression" && calleeName(child) === name) hit = true;
+    if (child.type === "CallExpression" && calleeName(child) === name) hit2 = true;
   });
-  return hit;
+  return hit2;
 }
 function containsOriginalName(node) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
-    if (child.type === "MemberExpression" && propName(child) === "originalname") hit = true;
+    if (child.type === "MemberExpression" && propName(child) === "originalname") hit2 = true;
   });
-  return hit;
+  return hit2;
 }
 function schemaLooksSafe(schema) {
   if (schema === void 0) return false;
@@ -6904,118 +8390,44 @@ var init_phase29 = __esm({
       gated(timingRule),
       gated(hashRule),
       gated(gqlRule)
-    ];
-  }
-});
-
-// src/ai/injection.ts
-function isCommentLine(line) {
-  const trimmed = line.trim();
-  return trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*");
-}
-function scanPromptInjection(file, source) {
-  const findings = [];
-  const lines = source.split(/\r?\n/);
-  lines.forEach((line, index) => {
-    if (!isCommentLine(line)) return;
-    if (!PHRASES.some((p) => p.test(line))) return;
-    findings.push({
-      id: makeFindingId("AI-INJECT-001", file, `${index + 1}|${line.trim()}`),
-      ruleId: "AI-INJECT-001",
-      module: "sast",
-      title: "Prompt-injection comment aimed at AI reviewers",
-      severity: "medium",
-      confidence: "high",
-      file,
-      line: index + 1,
-      snippet: line.trim().slice(0, 120),
-      message: "Code contains text attempting to manipulate AI reviewers.",
-      remediation: "Remove comments that try to instruct an AI reviewer.",
-      references: ["AI-INJECT-001"],
-      source: "deterministic"
-    });
-  });
-  return findings;
-}
-var PHRASES;
-var init_injection = __esm({
-  "src/ai/injection.ts"() {
-    init_finding();
-    PHRASES = [/ignore previous/i, /mark as safe/i, /ai reviewer/i];
-  }
-});
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
-var init_version = __esm({
-  "src/core/version.ts"() {
-  }
-});
-function parsePoolEnabled() {
-  return process.env.FULLSHIELD_PARSE_POOL === "1";
-}
-function parsePoolSize() {
-  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
-  if (raw !== void 0 && raw !== "") {
-    const parsed = Number(raw);
-    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
-  }
-  return Math.max(1, availableParallelism() - 1);
-}
-function parseCacheKey(code) {
-  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+    ];
+  }
+});
+
+// src/ai/injection.ts
+function isCommentLine(line) {
+  const trimmed = line.trim();
+  return trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*");
 }
-function parseOne(code) {
-  const key = parseCacheKey(code);
-  const hit = cache.get(key);
-  if (hit !== void 0) return Promise.resolve(hit);
-  return new Promise((resolve8, reject) => {
-    const worker = new Worker(fileURLToPath(workerUrl), { workerData: { code } });
-    worker.once("message", (ast) => {
-      cache.set(key, ast);
-      resolve8(ast);
+function scanPromptInjection(file, source) {
+  const findings = [];
+  const lines = source.split(/\r?\n/);
+  lines.forEach((line, index) => {
+    if (!isCommentLine(line)) return;
+    if (!PHRASES.some((p) => p.test(line))) return;
+    findings.push({
+      id: makeFindingId("AI-INJECT-001", file, `${index + 1}|${line.trim()}`),
+      ruleId: "AI-INJECT-001",
+      module: "sast",
+      title: "Prompt-injection comment aimed at AI reviewers",
+      severity: "medium",
+      confidence: "high",
+      file,
+      line: index + 1,
+      snippet: line.trim().slice(0, 120),
+      message: "Code contains text attempting to manipulate AI reviewers.",
+      remediation: "Remove comments that try to instruct an AI reviewer.",
+      references: ["AI-INJECT-001"],
+      source: "deterministic"
     });
-    worker.once("error", reject);
   });
+  return findings;
 }
-async function parseWithPool(codes) {
-  const size = parsePoolSize();
-  const out = new Array(codes.length);
-  let next = 0;
-  async function run() {
-    for (; ; ) {
-      const index = next;
-      next += 1;
-      if (index >= codes.length) return;
-      const code = codes[index];
-      if (code === void 0) return;
-      out[index] = await parseOne(code);
-    }
-  }
-  const workers = Math.min(size, Math.max(1, codes.length));
-  await Promise.all(Array.from({ length: workers }, () => run()));
-  return out;
-}
-var workerUrl, cache;
-var init_parse_pool = __esm({
-  "src/core/parse-pool.ts"() {
-    init_version();
-    workerUrl = new URL("./parse-worker.mjs", import.meta.url);
-    cache = /* @__PURE__ */ new Map();
+var PHRASES;
+var init_injection = __esm({
+  "src/ai/injection.ts"() {
+    init_finding();
+    PHRASES = [/ignore previous/i, /mark as safe/i, /ai reviewer/i];
   }
 });
 async function parseSource(code) {
@@ -7033,8 +8445,8 @@ function snippetOf(source, node) {
   if (node.range === void 0) return "";
   return source.slice(node.range[0], node.range[1]).replace(/\s+/g, " ").trim().slice(0, 120);
 }
-function findingsFromAst(filename, source, ast, extraReturners = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
-  const facts = analyzeFile(ast, extraReturners);
+function findingsFromAst(filename, source, ast, extraReturners2 = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
+  const facts = analyzeFile(ast, extraReturners2);
   const findings = [];
   for (const rule of sastRules) {
     const ctx = {
@@ -7060,10 +8472,12 @@ function findingsFromAst(filename, source, ast, extraReturners = /* @__PURE__ */
         });
       },
       isTainted: (node) => nodeIsTainted(node, facts),
+      isSqlCleared: (node) => nodeIsSqlCleared(node, facts),
       isPathSanitized: (node) => nodeIsPathSanitized(node, facts),
       isSanitizedFor: (node, kind) => nodeIsSanitizedFor(node, facts, kind),
       isNosqlSanitized: (node) => nodeIsNosqlSanitized(node, facts),
       isRequestObject: (node) => nodeIsRequestObject(node, facts),
+      holdsBuiltFilter: (node) => nodeHoldsBuiltFilter(node, facts),
       functionHasPasswordName: (node) => factsFor(node, facts).hasPasswordName,
       assignedName: (node) => assignedNameOf(node),
       projectCsrfProtected
@@ -7101,10 +8515,12 @@ function findingsFromTemplate(filename, source) {
       });
     },
     isTainted: () => false,
+    isSqlCleared: () => false,
     isPathSanitized: () => false,
     isSanitizedFor: () => false,
     isNosqlSanitized: () => false,
     isRequestObject: () => false,
+    holdsBuiltFilter: () => false,
     functionHasPasswordName: () => false,
     assignedName: () => void 0,
     projectCsrfProtected: false
@@ -7112,12 +8528,165 @@ function findingsFromTemplate(filename, source) {
   xssRule.create(ctx);
   return findings;
 }
+function dedupeSastSinks(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const finding6 of findings) {
+    if (finding6.module !== "sast" || finding6.line === void 0) {
+      out.push(finding6);
+      continue;
+    }
+    const key = `${finding6.ruleId}\0${finding6.file ?? ""}\0${finding6.line}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(finding6);
+  }
+  return out;
+}
+function sastStreamThreshold() {
+  const raw = process.env.FULLSHIELD_SAST_STREAM_AT;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 4e3;
+}
+function sastBatchSize() {
+  const raw = process.env.FULLSHIELD_SAST_BATCH;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 150;
+}
+function skipFinding(rel, message) {
+  return {
+    id: makeFindingId("SAST-SKIP-001", rel, message),
+    ruleId: "SAST-SKIP-001",
+    module: "sast",
+    title: "File skipped by SAST",
+    severity: "info",
+    confidence: "high",
+    file: rel,
+    message,
+    remediation: "Raise sast.maxFileBytes in fullshield.config.json to parse this file, or leave it skipped."
+  };
+}
+function skipReason(source, maxBytes) {
+  if (source.includes("\0")) return "it contains NUL bytes";
+  const bytes = Buffer.byteLength(source);
+  if (bytes > maxBytes) return `${bytes} bytes exceeds the SAST parse limit of ${maxBytes} bytes`;
+  return void 0;
+}
+async function readScanSource(cwd, rel) {
+  try {
+    return await readFile(join(cwd, rel), "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function cloneAst(value) {
+  if (value === null || typeof value !== "object") return void 0;
+  try {
+    return structuredClone(value);
+  } catch {
+    return void 0;
+  }
+}
+async function parseInProcess(source) {
+  try {
+    return await parseSource(source);
+  } catch {
+    return void 0;
+  }
+}
+async function parseCode(source) {
+  if (!parsePoolEnabled()) return parseInProcess(source);
+  try {
+    const cloned = cloneAst((await parseWithPool([source]))[0]);
+    if (cloned !== void 0) return cloned;
+  } catch {
+  }
+  return parseInProcess(source);
+}
+function releaseParsed(parsed) {
+  for (const entry of parsed) {
+    entry.source = "";
+    entry.ast = void 0;
+  }
+  parsed.length = 0;
+}
+function extraReturners(rel, ast, files, returning) {
+  const ns = collectRequires(rel, ast, files);
+  const extra = new Set(returning.get(rel));
+  for (const [local, spec] of ns) {
+    const hash = spec.indexOf("#");
+    const file = hash >= 0 ? spec.slice(0, hash) : spec;
+    const exp = hash >= 0 ? spec.slice(hash + 1) : local;
+    if (returning.get(file)?.has(exp)) extra.add(local);
+  }
+  return extra;
+}
+async function runSastStreaming(ctx) {
+  const maxBytes = ctx.config.sast.maxFileBytes;
+  const findings = [];
+  const returning = /* @__PURE__ */ new Map();
+  const parseable = [];
+  const fileSet = /* @__PURE__ */ new Set();
+  let projectCsrf = false;
+  for (const rel of ctx.files) {
+    const isSource = SOURCE_EXT.test(rel);
+    const isTemplate = TEMPLATE_EXT.test(rel);
+    if (!isSource && !isTemplate) continue;
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const why = skipReason(source, maxBytes);
+    if (why !== void 0) {
+      findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+      continue;
+    }
+    if (sourceHasCsrfGuard(source)) projectCsrf = true;
+    if (isTemplate) {
+      findings.push(...findingsFromTemplate(rel, source));
+      continue;
+    }
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    returning.set(rel, taintSummariesEnabled() ? cachedReturners(source, ast) : functionsThatReturnTaint(ast));
+    parseable.push(rel);
+    fileSet.add(rel);
+  }
+  for (const rel of parseable) {
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    findings.push(
+      ...findingsFromAst(rel, source, ast, extraReturners(rel, ast, fileSet, returning), projectCsrf)
+    );
+  }
+  const batch = sastBatchSize();
+  for (let i = 0; i < parseable.length; i += batch) {
+    const parsed = [];
+    for (const rel of parseable.slice(i, i + batch)) {
+      const source = await readScanSource(ctx.cwd, rel);
+      if (source === void 0) continue;
+      const ast = await parseCode(source);
+      if (ast === void 0) continue;
+      parsed.push({ file: rel, source, ast });
+    }
+    findings.push(...runInterproc(parsed));
+    releaseParsed(parsed);
+  }
+  return dedupeSastSinks(findings);
+}
 var sastRules, SOURCE_EXT, sastModule;
 var init_engine = __esm({
   "src/modules/sast/engine.ts"() {
     init_finding();
     init_ast();
     init_interproc();
+    init_summaries();
     init_taint();
     init_auth();
     init_cmdi();
@@ -7153,49 +8722,69 @@ var init_engine = __esm({
     sastModule = {
       name: "sast",
       async run(ctx) {
-        const findings = [];
-        const parsed = [];
-        for (const rel of ctx.files) {
-          const isSource = SOURCE_EXT.test(rel);
-          const isTemplate = TEMPLATE_EXT.test(rel);
-          if (!isSource && !isTemplate) continue;
-          let source;
-          try {
-            source = await readFile(join(ctx.cwd, rel), "utf8");
-          } catch {
-            continue;
-          }
-          if (source.length > 1024 * 1024 || source.includes("\0")) continue;
-          if (isTemplate) {
-            findings.push(...findingsFromTemplate(rel, source));
-            continue;
+        if (process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1") {
+          const sources = new Set((ctx.config.sast.sources ?? []).map((row) => row.callee));
+          const sanitizers = /* @__PURE__ */ new Map();
+          for (const row of ctx.config.sast.sanitizers ?? []) {
+            const classes = sanitizers.get(row.callee) ?? /* @__PURE__ */ new Set();
+            for (const name of row.clears) classes.add(name);
+            sanitizers.set(row.callee, classes);
           }
-          try {
-            const ast = parsePoolEnabled() ? (await parseWithPool([source]))[0] : await parseSource(source);
+          setCustomTaint({ sources, sanitizers });
+        } else {
+          setCustomTaint(void 0);
+        }
+        setTaintSummaryConfig(taintSummariesEnabled() ? ctx.config : void 0);
+        try {
+          const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
+          if (candidates.length > sastStreamThreshold()) return await runSastStreaming(ctx);
+          const maxBytes = ctx.config.sast.maxFileBytes;
+          const findings = [];
+          const parsed = [];
+          for (const rel of candidates) {
+            const source = await readScanSource(ctx.cwd, rel);
+            if (source === void 0) continue;
+            const why = skipReason(source, maxBytes);
+            if (why !== void 0) {
+              findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+              continue;
+            }
+            if (TEMPLATE_EXT.test(rel)) {
+              findings.push(...findingsFromTemplate(rel, source));
+              continue;
+            }
+            const ast = await parseCode(source);
             if (ast === void 0) continue;
             parsed.push({ file: rel, source, ast });
-          } catch {
           }
-        }
-        const files = new Set(parsed.map((p) => p.file));
-        const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
-        const returning = /* @__PURE__ */ new Map();
-        for (const p of parsed) {
-          returning.set(p.file, functionsThatReturnTaint(p.ast));
-        }
-        for (const p of parsed) {
-          const ns = collectRequires(p.file, p.ast, files);
-          const extra = new Set(returning.get(p.file));
-          for (const [local, spec] of ns) {
-            const hash = spec.indexOf("#");
-            const file = hash >= 0 ? spec.slice(0, hash) : spec;
-            const exp = hash >= 0 ? spec.slice(hash + 1) : local;
-            if (returning.get(file)?.has(exp)) extra.add(local);
+          const files = new Set(parsed.map((p) => p.file));
+          const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
+          const returning = /* @__PURE__ */ new Map();
+          for (const entry of parsed) {
+            returning.set(
+              entry.file,
+              taintSummariesEnabled() ? cachedReturners(entry.source, entry.ast) : functionsThatReturnTaint(entry.ast)
+            );
+          }
+          for (const entry of parsed) {
+            findings.push(
+              ...findingsFromAst(
+                entry.file,
+                entry.source,
+                entry.ast,
+                extraReturners(entry.file, entry.ast, files, returning),
+                projectCsrf
+              )
+            );
           }
-          findings.push(...findingsFromAst(p.file, p.source, p.ast, extra, projectCsrf));
+          findings.push(...runInterproc(parsed));
+          const out = dedupeSastSinks(findings);
+          releaseParsed(parsed);
+          return out;
+        } finally {
+          setCustomTaint(void 0);
+          setTaintSummaryConfig(void 0);
         }
-        findings.push(...runInterproc(parsed));
-        return findings;
       }
     };
   }
@@ -7579,7 +9168,7 @@ function scanTextForSecretHits(path, text) {
   return hits;
 }
 function scanTextForSecrets(path, text) {
-  return scanTextForSecretHits(path, text).map((hit) => hit.finding);
+  return scanTextForSecretHits(path, text).map((hit2) => hit2.finding);
 }
 var secretsRules, REMEDIATION, MAX_FILE_SIZE, secretsModule;
 var init_secrets = __esm({
@@ -7935,12 +9524,12 @@ ${text}`);
   const seeds = fixtureLogic(prompt);
   const findings = [];
   for (const seed of seeds) {
-    const hit = fileTexts.find((f) => f.file.includes(seed.fileHint) && f.text.includes(seed.fileHint === "user" ? "findById" : "Object.assign")) ?? fileTexts.find(
+    const hit2 = fileTexts.find((f) => f.file.includes(seed.fileHint) && f.text.includes(seed.fileHint === "user" ? "findById" : "Object.assign")) ?? fileTexts.find(
       (f) => f.text.includes(seed.ruleId === "AI-IDOR-001" ? "findById(req.params.id)" : "Object.assign(user, req.body)")
     );
-    if (hit === void 0) continue;
-    const line = hit.text.split(/\r?\n/).findIndex((l) => l.includes(seed.ruleId === "AI-IDOR-001" ? "findById" : "Object.assign")) + 1;
-    findings.push(asAiFinding(seed, hit.file, line > 0 ? line : 1));
+    if (hit2 === void 0) continue;
+    const line = hit2.text.split(/\r?\n/).findIndex((l) => l.includes(seed.ruleId === "AI-IDOR-001" ? "findById" : "Object.assign")) + 1;
+    findings.push(asAiFinding(seed, hit2.file, line > 0 ? line : 1));
   }
   return findings;
 }
@@ -8121,16 +9710,37 @@ var init_provider = __esm({
     FIXTURE_COST = 0.01;
   }
 });
+function isIsoDate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}(T[\d:.+\-Z]+)?$/.test(value)) return false;
+  return Number.isFinite(Date.parse(value));
+}
+function expiresAtMs(expires) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) return Date.parse(`${expires}T23:59:59.999Z`);
+  return Date.parse(expires);
+}
+function validSuppression(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const row = value;
+  if (typeof row.ruleId !== "string" || row.ruleId.length === 0) return void 0;
+  if (typeof row.owner !== "string" || row.owner.length === 0) return void 0;
+  if (typeof row.reason !== "string" || row.reason.length === 0) return void 0;
+  if (typeof row.expires !== "string" || !isIsoDate(row.expires)) return void 0;
+  const file = row.file === void 0 ? void 0 : row.file.replace(/\\/g, "/");
+  if (row.file !== void 0 && (typeof row.file !== "string" || row.file.length === 0)) return void 0;
+  return { ruleId: row.ruleId, file, owner: row.owner, reason: row.reason, expires: row.expires };
+}
 async function readBaseline(path) {
   try {
     const raw = JSON.parse(await readFile(path, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.findings)) return void 0;
+    if (raw.suppressions !== void 0 && !Array.isArray(raw.suppressions)) return void 0;
     return raw;
   } catch {
     return void 0;
   }
 }
 async function writeBaseline(path, findings) {
+  const existing = await readBaseline(path);
   const doc = {
     version: 1,
     findings: findings.map((f) => ({
@@ -8138,7 +9748,8 @@ async function writeBaseline(path, findings) {
       ruleId: f.ruleId,
       file: f.file,
       line: f.line
-    }))
+    })),
+    ...existing?.suppressions !== void 0 ? { suppressions: existing.suppressions } : {}
   };
   await writeFile(path, `${JSON.stringify(doc, null, 2)}
 `, "utf8");
@@ -8148,10 +9759,68 @@ function applyBaseline(findings, baseline) {
   const known = new Set(baseline.findings.map((f) => f.id));
   return findings.filter((f) => !known.has(f.id));
 }
+function applySuppressions(findings, rows, now = /* @__PURE__ */ new Date()) {
+  if (rows === void 0 || rows.length === 0) return { findings: [...findings], errors: [] };
+  const errors = [];
+  const active = [];
+  rows.forEach((row, index) => {
+    const parsed = validSuppression(row);
+    if (parsed === void 0) {
+      errors.push(`suppression ${index + 1} needs ruleId, owner, reason, and an ISO expires date`);
+      return;
+    }
+    if (expiresAtMs(parsed.expires) < now.getTime()) {
+      errors.push(
+        `suppression for ${parsed.ruleId} expired on ${parsed.expires} (owner: ${parsed.owner}); renew or remove it`
+      );
+      return;
+    }
+    active.push(parsed);
+  });
+  const kept = findings.filter((finding6) => {
+    const file = (finding6.file ?? "").replace(/\\/g, "/");
+    return !active.some((row) => row.ruleId === finding6.ruleId && (row.file === void 0 || row.file === file));
+  });
+  return { findings: kept, errors };
+}
 var init_baseline = __esm({
   "src/core/baseline.ts"() {
   }
 });
+function parseSastSources(value, source) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new ConfigError(`${source}: "sast.sources" must be an array`);
+  return value.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new ConfigError(`${source}: "sast.sources" entries must be objects`);
+    }
+    const row = item;
+    if (typeof row.callee !== "string" || row.callee.length === 0) {
+      throw new ConfigError(`${source}: "sast.sources[].callee" must be a string`);
+    }
+    if (row.returns !== "tainted") {
+      throw new ConfigError(`${source}: "sast.sources[].returns" must be "tainted"`);
+    }
+    return { callee: row.callee, returns: "tainted" };
+  });
+}
+function parseSastSanitizers(value, source) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new ConfigError(`${source}: "sast.sanitizers" must be an array`);
+  return value.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new ConfigError(`${source}: "sast.sanitizers" entries must be objects`);
+    }
+    const row = item;
+    if (typeof row.callee !== "string" || row.callee.length === 0) {
+      throw new ConfigError(`${source}: "sast.sanitizers[].callee" must be a string`);
+    }
+    if (!Array.isArray(row.clears) || row.clears.some((name) => typeof name !== "string" || !SAST_CLASSES.has(name))) {
+      throw new ConfigError(`${source}: "sast.sanitizers[].clears" must be B4 class names`);
+    }
+    return { callee: row.callee, clears: row.clears.filter((name) => name !== "secrets" && name !== "deps") };
+  });
+}
 function validate(raw, source) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new ConfigError(`${source}: config must be a JSON object`);
@@ -8253,6 +9922,42 @@ function validate(raw, source) {
     }
     out.ai = ai;
   }
+  if (record.defaultExcludes !== void 0) {
+    if (typeof record.defaultExcludes !== "boolean") {
+      throw new ConfigError(`${source}: "defaultExcludes" must be a boolean`);
+    }
+    out.defaultExcludes = record.defaultExcludes;
+  }
+  if (record.excludes !== void 0) {
+    if (!Array.isArray(record.excludes) || record.excludes.some((p) => typeof p !== "string")) {
+      throw new ConfigError(`${source}: "excludes" must be an array of glob strings`);
+    }
+    out.excludes = record.excludes;
+  }
+  if (record.sast !== void 0) {
+    if (typeof record.sast !== "object" || record.sast === null || Array.isArray(record.sast)) {
+      throw new ConfigError(`${source}: "sast" must be an object`);
+    }
+    const rawSast = record.sast;
+    const sast = { maxFileBytes: 1024 * 1024 };
+    if (rawSast.maxFileBytes !== void 0) {
+      if (typeof rawSast.maxFileBytes !== "number" || rawSast.maxFileBytes < 1) {
+        throw new ConfigError(`${source}: "sast.maxFileBytes" must be a positive number`);
+      }
+      sast.maxFileBytes = rawSast.maxFileBytes;
+    }
+    const custom = process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1";
+    if (!custom && (rawSast.sources !== void 0 || rawSast.sanitizers !== void 0)) {
+      throw new ConfigError(
+        `${source}: unknown key "sast.sources" (FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS)`
+      );
+    }
+    if (custom) {
+      sast.sources = parseSastSources(rawSast.sources, source);
+      sast.sanitizers = parseSastSanitizers(rawSast.sanitizers, source);
+    }
+    out.sast = sast;
+  }
   return out;
 }
 async function loadConfig(cwd, configPath) {
@@ -8278,7 +9983,7 @@ async function loadConfig(cwd, configPath) {
   }
   return { ...structuredClone(DEFAULT_CONFIG), ...validate(raw, file) };
 }
-var CONFIG_FILE_NAME, DEFAULT_CONFIG, ConfigError, KNOWN_KEYS;
+var CONFIG_FILE_NAME, DEFAULT_CONFIG, ConfigError, KNOWN_KEYS, SAST_CLASSES;
 var init_config2 = __esm({
   "src/core/config.ts"() {
     init_finding();
@@ -8287,19 +9992,51 @@ var init_config2 = __esm({
       modules: [...MODULE_NAMES],
       failOn: "high",
       ignore: ["dist/**", "**/*.test.ts"],
+      defaultExcludes: true,
       baseline: ".fullshield-baseline.json",
       notify: { slackWebhookEnv: "FULLSHIELD_SLACK_WEBHOOK" },
       deps: { offline: false },
-      ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 }
+      ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 },
+      sast: { maxFileBytes: 1024 * 1024 }
     };
     ConfigError = class extends Error {
     };
-    KNOWN_KEYS = /* @__PURE__ */ new Set(["modules", "failOn", "ignore", "baseline", "notify", "deps", "ai"]);
+    KNOWN_KEYS = /* @__PURE__ */ new Set([
+      "modules",
+      "failOn",
+      "ignore",
+      "defaultExcludes",
+      "excludes",
+      "baseline",
+      "notify",
+      "deps",
+      "ai",
+      "sast"
+    ]);
+    SAST_CLASSES = /* @__PURE__ */ new Set([
+      "sqli",
+      "nosqli",
+      "cmdi",
+      "path",
+      "xss",
+      "ssrf",
+      "redirect",
+      "eval",
+      "jwt",
+      "crypto",
+      "proto",
+      "secrets",
+      "deps",
+      "config"
+    ]);
   }
 });
 async function walkFiles(options) {
   const ig = ignoreFactory();
-  ig.add(ALWAYS_IGNORED);
+  ig.add(HARD_IGNORED);
+  if (options.defaultExcludes !== false) {
+    ig.add(options.excludes ?? DEFAULT_EXCLUDES);
+  }
   try {
     ig.add(await readFile(join(options.cwd, ".gitignore"), "utf8"));
   } catch {
@@ -8325,11 +10062,24 @@ async function walkFiles(options) {
   await walk5("");
   return files.sort();
 }
-var ignoreFactory, ALWAYS_IGNORED;
+var ignoreFactory, HARD_IGNORED, DEFAULT_EXCLUDES;
 var init_fileWalker = __esm({
   "src/core/fileWalker.ts"() {
     ignoreFactory = ignoreModule.default;
-    ALWAYS_IGNORED = [".git/", "node_modules/", ".fullshield/"];
+    HARD_IGNORED = [".git/", ".fullshield/"];
+    DEFAULT_EXCLUDES = [
+      "node_modules/",
+      "dist/",
+      "build/",
+      ".next/",
+      "coverage/",
+      "vendor/",
+      "vendored/",
+      "third_party/",
+      "third-party/",
+      "compiled/",
+      "*.min.js"
+    ];
   }
 });
 async function listStagedFiles(cwd) {
@@ -8543,7 +10293,7 @@ function resolvePolicyBranch(cwd, env = process.env) {
     return "*";
   }
 }
-function expiresAtMs(expires) {
+function expiresAtMs2(expires) {
   if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) {
     return Date.parse(`${expires}T23:59:59.999Z`);
   }
@@ -8565,7 +10315,7 @@ function applyPolicy(findings, policy, ctx = {}) {
   });
   const suppressed = /* @__PURE__ */ new Set();
   for (const exception of policy.exceptions ?? []) {
-    if (expiresAtMs(exception.expires) < now.getTime()) {
+    if (expiresAtMs2(exception.expires) < now.getTime()) {
       errors.push(
         `policy exception for ${exception.ruleId} expired on ${exception.expires} (owner: ${exception.owner}); renew or remove it`
       );
@@ -8634,6 +10384,7 @@ var init_incremental = __esm({
 // src/modules/secrets/history.ts
 var history_exports = {};
 __export(history_exports, {
+  historyCommitLimit: () => historyCommitLimit,
   scanGitHistory: () => scanGitHistory
 });
 function gitError(error) {
@@ -8667,16 +10418,22 @@ async function readBlob(cwd, hash) {
     return void 0;
   }
 }
-function remapHit(hit, file) {
-  const snippet = hit.finding.snippet;
-  const line = hit.finding.line ?? 0;
-  const id = makeFindingId(hit.finding.ruleId, file, `${line}|${snippet ?? "file"}`);
+function remapHit(hit2, file) {
+  const snippet = hit2.finding.snippet;
+  const line = hit2.finding.line ?? 0;
+  const id = makeFindingId(hit2.finding.ruleId, file, `${line}|${snippet ?? "file"}`);
   return {
-    finding: { ...hit.finding, id, file },
-    secret: hit.secret
+    finding: { ...hit2.finding, id, file },
+    secret: hit2.secret
   };
 }
-async function streamLogChanges(cwd) {
+function historyCommitLimit(raw = process.env.FULLSHIELD_HISTORY_MAX) {
+  if (raw === void 0 || raw.trim() === "") return 500;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 1) return 500;
+  return Math.min(parsed, 5e3);
+}
+async function streamLogChanges(cwd, maxCommits) {
   const changes = [];
   await gitOk(cwd, ["rev-parse", "--is-inside-work-tree"]);
   const child = spawn(
@@ -8693,6 +10450,8 @@ async function streamLogChanges(cwd) {
       "--format=FSCOMMIT:%H",
       "--no-textconv",
       "--no-ext-diff",
+      "-n",
+      String(maxCommits),
       "HEAD"
     ],
     { stdio: ["ignore", "pipe", "pipe"] }
@@ -8755,14 +10514,20 @@ async function headSecretKeys(cwd) {
       hits = scanTextForSecretHits(path, text);
       seen.set(hash, hits);
     }
-    for (const hit of hits) {
-      keys.add(`${hit.finding.ruleId}\0${hit.finding.snippet ?? ""}`);
+    for (const hit2 of hits) {
+      keys.add(`${hit2.finding.ruleId}\0${hit2.finding.snippet ?? ""}`);
     }
   }
   return keys;
 }
-async function scanGitHistory(cwd) {
-  const changes = await streamLogChanges(cwd);
+async function commitCount(cwd) {
+  const raw = await gitOk(cwd, ["rev-list", "--count", "HEAD"]);
+  const total = Number(raw.trim());
+  return Number.isInteger(total) && total >= 0 ? total : 0;
+}
+async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
+  const total = await commitCount(cwd);
+  const changes = await streamLogChanges(cwd, maxCommits);
   const blobHits = /* @__PURE__ */ new Map();
   const first = /* @__PURE__ */ new Map();
   for (const change of changes) {
@@ -8783,8 +10548,8 @@ async function scanGitHistory(cwd) {
       hits2 = rawHits.filter((h) => allowed.has(h.finding.id));
       blobHits.set(change.hash, hits2);
     }
-    for (const hit of hits2) {
-      const mapped = remapHit(hit, change.path);
+    for (const hit2 of hits2) {
+      const mapped = remapHit(hit2, change.path);
       if (!first.has(mapped.finding.id)) {
         first.set(mapped.finding.id, { hit: mapped, commit: change.commit });
       }
@@ -8792,14 +10557,20 @@ async function scanGitHistory(cwd) {
   }
   const atHead = await headSecretKeys(cwd);
   const hits = [];
-  for (const { hit, commit } of first.values()) {
-    const stillAtHead = atHead.has(`${hit.finding.ruleId}\0${hit.finding.snippet ?? ""}`);
+  for (const { hit: hit2, commit } of first.values()) {
+    const stillAtHead = atHead.has(`${hit2.finding.ruleId}\0${hit2.finding.snippet ?? ""}`);
     hits.push({
-      finding: { ...hit.finding, introducedIn: commit, stillAtHead },
-      secret: hit.secret
+      finding: { ...hit2.finding, introducedIn: commit, stillAtHead },
+      secret: hit2.secret
     });
   }
-  return { findings: hits.map((h) => h.finding), hits };
+  const scanned = Math.min(maxCommits, total);
+  const history = total > maxCommits ? `scanned ${scanned} of ${total} commits` : void 0;
+  return {
+    findings: hits.map((h) => h.finding),
+    hits,
+    ...history !== void 0 ? { history } : {}
+  };
 }
 var execFileAsync2, ZERO_HASH, MAX_BLOB, RAW_LINE;
 var init_history = __esm({
@@ -9032,15 +10803,15 @@ function providerFor(ruleId, secret) {
 async function verifySecretHits(hits, options = {}) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const out = [];
-  for (const hit of hits) {
-    const secret = hit.secret;
+  for (const hit2 of hits) {
+    const secret = hit2.secret;
     if (secret === void 0 || secret.length === 0) {
-      out.push({ finding: { ...hit.finding, verification: "unknown" }, secret: hit.secret });
+      out.push({ finding: { ...hit2.finding, verification: "unknown" }, secret: hit2.secret });
       continue;
     }
-    const run = providerFor(hit.finding.ruleId, secret);
+    const run = providerFor(hit2.finding.ruleId, secret);
     const verification = run === void 0 ? "unknown" : await run(secret, fetchImpl);
-    out.push({ finding: { ...hit.finding, verification }, secret: hit.secret });
+    out.push({ finding: { ...hit2.finding, verification }, secret: hit2.secret });
   }
   return out;
 }
@@ -9073,6 +10844,8 @@ function dedupe2(findings) {
 async function runScan(options = {}, modules = builtinModules) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const t0 = performance.now();
+  depsModule.unusedDirect = void 0;
+  depsModule.upgradePlan = void 0;
   const cwd = resolve(options.cwd ?? process.cwd());
   const stats = await stat(cwd).catch(() => null);
   if (stats === null || !stats.isDirectory()) {
@@ -9094,7 +10867,12 @@ async function runScan(options = {}, modules = builtinModules) {
     options.modules ?? config.modules,
     loadedPolicy?.requiredModules
   );
-  let files = await walkFiles({ cwd, ignore: config.ignore });
+  let files = await walkFiles({
+    cwd,
+    ignore: config.ignore,
+    defaultExcludes: config.defaultExcludes,
+    excludes: config.excludes
+  });
   if (options.staged === true) {
     const staged = new Set(await listStagedFiles(cwd));
     files = files.filter((file) => staged.has(file));
@@ -9128,6 +10906,7 @@ async function runScan(options = {}, modules = builtinModules) {
     );
   }
   const extraHits = [];
+  let historyNotice;
   const secretsWanted = modulesRequested.includes("secrets");
   if (secretsAdvEnabled() && secretsWanted) {
     if (options.history === true) {
@@ -9135,6 +10914,7 @@ async function runScan(options = {}, modules = builtinModules) {
       const hist = await scanGitHistory2(cwd);
       extraHits.push(...hist.hits);
       collected.push(...hist.findings);
+      historyNotice = hist.history;
     }
     if (options.bundle !== void 0 && options.bundle.length > 0) {
       const { scanBundle: scanBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
@@ -9155,13 +10935,17 @@ async function runScan(options = {}, modules = builtinModules) {
   if (options.updateBaseline === true) {
     await writeBaseline(baselinePath, unsuppressed);
   }
-  let findings = sortFindings(applyBaseline(unsuppressed, await readBaseline(baselinePath)));
+  const baselineDoc = await readBaseline(baselinePath);
+  let findings = sortFindings(applyBaseline(unsuppressed, baselineDoc));
+  const suppressed = applySuppressions(findings, baselineDoc?.suppressions);
+  findings = sortFindings(suppressed.findings);
+  const suppressionErrors = suppressed.errors;
   if (secretsAdvEnabled() && secretsWanted && options.verifySecrets === true && options.iOwnTheseCredentials === true) {
     const { applyVerification: applyVerification2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
     const { scanTextForSecretHits: scanTextForSecretHits2 } = await Promise.resolve().then(() => (init_secrets(), secrets_exports));
     const secretById = /* @__PURE__ */ new Map();
-    for (const hit of extraHits) {
-      if (hit.secret !== void 0) secretById.set(hit.finding.id, hit.secret);
+    for (const hit2 of extraHits) {
+      if (hit2.secret !== void 0) secretById.set(hit2.finding.id, hit2.secret);
     }
     for (const finding6 of findings) {
       if (finding6.module !== "secrets" || finding6.file === void 0 || secretById.has(finding6.id)) {
@@ -9175,8 +10959,8 @@ async function runScan(options = {}, modules = builtinModules) {
           continue;
         }
       }
-      for (const hit of scanTextForSecretHits2(finding6.file, text)) {
-        if (hit.secret !== void 0) secretById.set(hit.finding.id, hit.secret);
+      for (const hit2 of scanTextForSecretHits2(finding6.file, text)) {
+        if (hit2.secret !== void 0) secretById.set(hit2.finding.id, hit2.secret);
       }
     }
     findings = sortFindings(
@@ -9227,10 +11011,14 @@ async function runScan(options = {}, modules = builtinModules) {
       cwd,
       filesScanned: files.length,
       modulesRequested: [...modulesRequested],
-      modulesRun
+      modulesRun,
+      ...historyNotice !== void 0 ? { history: historyNotice } : {},
+      ...depsModule.unusedDirect !== void 0 ? { unusedDirect: depsModule.unusedDirect } : {},
+      ...depsModule.upgradePlan !== void 0 ? { upgradePlan: depsModule.upgradePlan } : {}
     },
     config,
-    policy: policyResult
+    policy: policyResult,
+    ...suppressionErrors.length > 0 ? { suppressionErrors } : {}
   };
 }
 function scan(options = {}) {
@@ -9371,6 +11159,16 @@ function validateCycloneDx15(doc) {
   if (!Array.isArray(root.components)) errors.push("components must be an array");
   return errors;
 }
+function reachProperties(finding6) {
+  const properties = [
+    { name: "fullshield:reachability", value: finding6.reachability ?? "unspecified" },
+    { name: "fullshield:devOnly", value: finding6.message.includes("(dev-only)") ? "true" : "false" }
+  ];
+  if (finding6.dependencyPath !== void 0 && finding6.dependencyPath.length > 0) {
+    properties.splice(1, 0, { name: "fullshield:dependencyPath", value: finding6.dependencyPath.join(" > ") });
+  }
+  return properties;
+}
 function renderCycloneDx(input) {
   const vulns = (input.findings ?? []).filter((f) => f.ruleId === "DEPS-VULN-001");
   return {
@@ -9381,13 +11179,18 @@ function renderCycloneDx(input) {
     metadata: {
       component: { type: "application", name: input.name, version: input.version }
     },
-    components: input.components.map((c) => ({
-      type: "library",
-      name: c.name,
-      version: c.version,
-      purl: c.purl ?? `pkg:npm/${encodeURIComponent(c.name)}@${c.version}`,
-      ...c.license !== void 0 ? { licenses: [{ license: { id: c.license } }] } : {}
-    })),
+    components: input.components.map((c) => {
+      const match = (input.findings ?? []).find((finding6) => finding6.snippet?.startsWith(`${c.name}@`));
+      const properties = input.includeReach === true && match !== void 0 ? reachProperties(match) : void 0;
+      return {
+        type: "library",
+        name: c.name,
+        version: c.version,
+        purl: c.purl ?? `pkg:npm/${encodeURIComponent(c.name)}@${c.version}`,
+        ...c.license !== void 0 ? { licenses: [{ license: { id: c.license } }] } : {},
+        ...properties !== void 0 ? { properties } : {}
+      };
+    }),
     vulnerabilities: vulns.map((f) => ({
       id: f.references?.find((r) => r.startsWith("GHSA-") || r.startsWith("CVE-")) ?? f.id,
       description: f.message,
@@ -9546,6 +11349,32 @@ function finding4(ruleId, title, message, file, severity = "high") {
     remediation: "Pin actions by SHA, drop pull_request_target, tighten permissions, close 0.0.0.0/0, encrypt storage, drop privileged."
   };
 }
+function runBodies(text) {
+  const bodies = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const match = /^(\s*)(?:-\s+)?run:\s*(.*)$/.exec(lines[i] ?? "");
+    if (match === null) continue;
+    const indent = match[1]?.length ?? 0;
+    let body = match[2] ?? "";
+    if (body === "|" || body === ">") {
+      const block = [];
+      for (let j = i + 1; j < lines.length; j += 1) {
+        const line = lines[j] ?? "";
+        if (line.trim() === "") {
+          block.push(line);
+          continue;
+        }
+        const lead = line.match(/^\s*/)?.[0].length ?? 0;
+        if (lead <= indent) break;
+        block.push(line);
+      }
+      body = block.join("\n");
+    }
+    bodies.push(body);
+  }
+  return bodies;
+}
 function walk3(dir, out = []) {
   if (!existsSync(dir)) return out;
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
@@ -9573,6 +11402,28 @@ function scanIac(dir, opts = {}) {
       if (/pull_request_target/.test(text)) {
         findings.push(finding4("IAC-GHA-PRTARGET-001", "pull_request_target workflow", "untrusted PR can run with base secrets", rel, "critical"));
       }
+      if (/pull_request_target/.test(text) && /actions\/checkout/.test(text) && /github\.event\.pull_request/.test(text)) {
+        findings.push(
+          finding4(
+            "IAC-GHA-PRCHECKOUT-001",
+            "pull_request_target checks out pull-request code",
+            "untrusted head can run with the base repository token",
+            rel,
+            "critical"
+          )
+        );
+      }
+      if (runBodies(text).some((body) => /\$\{\{\s*github\.event\./.test(body))) {
+        findings.push(
+          finding4(
+            "IAC-GHA-INJECT-001",
+            "Workflow run step interpolates github.event",
+            "untrusted event text is passed to the shell",
+            rel,
+            "critical"
+          )
+        );
+      }
       if (/permissions:\s*\n\s+contents:\s*write/.test(text) || /permissions:\s+write-all/.test(text)) {
         findings.push(finding4("IAC-GHA-PERMS-001", "Overly broad GitHub Actions permissions", "write-all or contents: write", rel));
       }
@@ -9723,14 +11574,22 @@ var init_compliance = __esm({
       ROW("SUPPLY-BEHAVIOR-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("SUPPLY-COOLDOWN-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("SUPPLY-LOCKURL-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
+      ROW("SUPPLY-LOCKINTEGRITY-001", "A08:2021 Integrity Failures", "CWE-353", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("SUPPLY-CONFUSION-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("SUPPLY-PROVENANCE-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("SUPPLY-WORM-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3 / 12.10"),
       ROW("SUPPLY-WORKFLOW-001", "A08:2021 Integrity Failures", "CWE-829", "V14.2.3", "PCI DSS 6.3.3"),
+      ROW("SUPPLY-CHAINC2-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3"),
+      ROW("SUPPLY-STEALER-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 12.10"),
+      ROW("SUPPLY-PLATFORMGATE-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
+      ROW("SUPPLY-SECHOLDER-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("IAC-GHA-UNPINNED-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("IAC-GHA-PRTARGET-001", "A01:2021 Broken Access Control", "CWE-269", "V4.1.1", "PCI DSS 7.2"),
       ROW("IAC-GHA-PERMS-001", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),
       ROW("IAC-GHA-SECRETLOG-001", "A09:2021 Security Logging Failures", "CWE-532", "V7.1.1", "PCI DSS 3.2 / 10.2"),
+      ROW("IAC-GHA-INJECT-001", "A03:2021 Injection", "CWE-94", "V5.2.4", "PCI DSS 6.2.4"),
+      ROW("IAC-GHA-PRCHECKOUT-001", "A01:2021 Broken Access Control", "CWE-829", "V4.1.1", "PCI DSS 6.2.4"),
+      ROW("DEPS-LICENSE-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("IAC-TF-S3PUBLIC-001", "A01:2021 Broken Access Control", "CWE-284", "V12.1.1", "PCI DSS 1.3 / 3.2"),
       ROW("IAC-TF-SGOPEN-001", "A05:2021 Security Misconfiguration", "CWE-284", "V1.4.1", "PCI DSS 1.2 / 1.3"),
       ROW("IAC-TF-UNENCRYPTED-001", "A02:2021 Cryptographic Failures", "CWE-311", "V6.2.1", "PCI DSS 3.4 / 4.2"),
@@ -9757,6 +11616,7 @@ var init_compliance = __esm({
       ROW("SAST-TIMING-001", "A07:2021 Identification Failures", "CWE-208", "V2.10.3", "PCI DSS 8.3"),
       ROW("SAST-HASH-001", "A02:2021 Cryptographic Failures", "CWE-916", "V6.2.2", "PCI DSS 8.3.1"),
       ROW("SAST-GQL-001", "A04:2021 Insecure Design", "CWE-770/200", "V13.1.1", "PCI DSS 6.2.4"),
+      ROW("SAST-SKIP-001", "A05:2021 Security Misconfiguration", "CWE-693", "V1.1.1", "PCI DSS 6.2.4"),
       ROW("CONFIG-TRUSTPROXY-001", "A07:2021 Identification Failures", "CWE-290", "V2.2.1", "PCI DSS 8.3.4"),
       ROW("SECRET-BUNDLE-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2 / 8.3"),
       ROW("DLP-SECRET-001", "A02:2021 Cryptographic Failures", "CWE-200", "V8.3.4", "PCI DSS 3.2 / 8.3"),
@@ -9776,6 +11636,23 @@ var init_compliance = __esm({
     byId = new Map(RULE_MAP.map((r) => [r.ruleId, r]));
   }
 });
+function nodeSqliteAvailable() {
+  try {
+    require2("node:sqlite");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function nodeSqliteUnavailableMessage(feature) {
+  return `${feature} requires Node 22.13+ (node:sqlite is not available on Node ${process.versions.node})`;
+}
+var require2;
+var init_sqlite = __esm({
+  "src/core/sqlite.ts"() {
+    require2 = createRequire(import.meta.url);
+  }
+});
 
 // src/dashboard/index.ts
 var dashboard_exports = {};
@@ -9789,7 +11666,7 @@ __export(dashboard_exports, {
   startDashboard: () => startDashboard
 });
 function sqliteDb(file) {
-  const { DatabaseSync } = require2("node:sqlite");
+  const { DatabaseSync } = require3("node:sqlite");
   let db;
   try {
     db = new DatabaseSync(file);
@@ -9840,6 +11717,9 @@ function sqliteDb(file) {
   };
 }
 function openHistory(dir) {
+  if (!nodeSqliteAvailable()) {
+    throw new Error(nodeSqliteUnavailableMessage("history"));
+  }
   const root = join(dir, ".fullshield");
   mkdirSync(root, { recursive: true });
   return sqliteDb(join(root, "history.db"));
@@ -9941,10 +11821,11 @@ function startDashboard(opts) {
     });
   });
 }
-var require2;
+var require3;
 var init_dashboard = __esm({
   "src/dashboard/index.ts"() {
-    require2 = createRequire(import.meta.url);
+    init_sqlite();
+    require3 = createRequire(import.meta.url);
   }
 });
 function finding5(ruleId, title, message, file, severity = "high") {
@@ -10086,9 +11967,9 @@ async function callMcpTool(session, name, args = {}) {
     return { findings: session.findings };
   }
   if (name === "explain_finding") {
-    const hit = session.findings.find((f) => f.ruleId === args.ruleId);
-    if (!hit) return { text: `no finding ${args.ruleId}` };
-    return { text: `${hit.title}: ${hit.message} ${hit.remediation}` };
+    const hit2 = session.findings.find((f) => f.ruleId === args.ruleId);
+    if (!hit2) return { text: `no finding ${args.ruleId}` };
+    return { text: `${hit2.title}: ${hit2.message} ${hit2.remediation}` };
   }
   if (name === "propose_fix") {
     return proposeOnly(session, args.ruleId);
@@ -10099,25 +11980,25 @@ async function callMcpTool(session, name, args = {}) {
   return { error: `unknown tool ${name}` };
 }
 function proposeOnly(session, ruleId) {
-  const hit = session.findings.find((f) => f.ruleId === ruleId);
-  if (!hit?.file || !session.cwd) return { diff: "", wrote: false };
-  const abs = join(session.cwd, hit.file);
+  const hit2 = session.findings.find((f) => f.ruleId === ruleId);
+  if (!hit2?.file || !session.cwd) return { diff: "", wrote: false };
+  const abs = join(session.cwd, hit2.file);
   const source = readFileSync(abs, "utf8");
-  const proposal = proposeFix(hit, source);
+  const proposal = proposeFix(hit2, source);
   return { diff: proposal?.diff ?? "", wrote: false };
 }
 function verifyInTemp(session, ruleId) {
-  const hit = session.findings.find((f) => f.ruleId === ruleId);
-  if (!hit?.file || !session.cwd) return { originalUntouched: true, tempApplied: false };
-  const original = join(session.cwd, hit.file);
+  const hit2 = session.findings.find((f) => f.ruleId === ruleId);
+  if (!hit2?.file || !session.cwd) return { originalUntouched: true, tempApplied: false };
+  const original = join(session.cwd, hit2.file);
   const before = readFileSync(original, "utf8");
   const mtime = statSync(original).mtimeMs;
-  const proposal = proposeFix(hit, before);
+  const proposal = proposeFix(hit2, before);
   if (!proposal?.diff) return { originalUntouched: true, tempApplied: false };
   const tmp = mkdtempSync(join(tmpdir(), "fullshield-mcp-verify-"));
   try {
     cpSync(session.cwd, tmp, { recursive: true });
-    const copy = join(tmp, hit.file);
+    const copy = join(tmp, hit2.file);
     const next = applyUnifiedDiff(readFileSync(copy, "utf8"), proposal.diff);
     writeFileSync(copy, next);
     const untouched = readFileSync(original, "utf8") === before && statSync(original).mtimeMs === mtime;
@@ -10341,16 +12222,16 @@ async function confirmTarget(baseUrl, opts) {
     try {
       if (route.kind === "idor") {
         const url2 = `${origin}${route.path}`;
-        const hit2 = await probe(fetchImpl, url2, route.method, void 0, {
+        const hit3 = await probe(fetchImpl, url2, route.method, void 0, {
           "x-user": route.asUser ?? opts.users?.b ?? "bob"
         });
         const owner = route.expectOwner ?? opts.users?.a ?? "alice";
-        const confirmed2 = hit2.ok && hit2.text.includes(owner);
+        const confirmed2 = hit3.ok && hit3.text.includes(owner);
         confirmations.push({
           kind: "idor",
           status: confirmed2 ? "confirmed" : "unconfirmed",
           proof: curlProof(route.method, url2, `-H 'x-user: ${route.asUser ?? "bob"}' `),
-          detail: hit2.text.slice(0, 200)
+          detail: hit3.text.slice(0, 200)
         });
         continue;
       }
@@ -10363,13 +12244,13 @@ async function confirmTarget(baseUrl, opts) {
       } else {
         body = { [param]: payload };
       }
-      const hit = await probe(fetchImpl, url, route.method, body);
-      const confirmed = hit.text.includes(token) || route.kind === "path" && hit.text.includes("FULLSHIELD_CANARY");
+      const hit2 = await probe(fetchImpl, url, route.method, body);
+      const confirmed = hit2.text.includes(token) || route.kind === "path" && hit2.text.includes("FULLSHIELD_CANARY");
       confirmations.push({
         kind: route.kind,
         status: confirmed ? "confirmed" : "unconfirmed",
         proof: curlProof(route.method, url),
-        detail: hit.text.slice(0, 200)
+        detail: hit2.text.slice(0, 200)
       });
     } catch (err) {
       confirmations.push({
@@ -10647,14 +12528,16 @@ function openVexStatement(finding6) {
     vulnerability: { name: vulnName(finding6) },
     products: [{ "@id": npmPurl(finding6.snippet) }]
   };
+  const detail = process.env.FULLSHIELD_EXPERIMENTAL_SBOM_REACH === "1" && finding6.reachabilityEvidence?.reason !== void 0 ? { detail: finding6.reachabilityEvidence.reason } : {};
   if (notImported(finding6)) {
     return {
       ...base,
       status: "not_affected",
-      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION
+      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION,
+      ...detail
     };
   }
-  return { ...base, status: "under_investigation" };
+  return { ...base, status: "under_investigation", ...detail };
 }
 function buildOpenVex(findings) {
   const statements = depFindings(findings).map(openVexStatement);
@@ -10942,6 +12825,28 @@ async function runFix(options = {}) {
     const after = applyUnifiedDiff(source, proposed.diff);
     byFile.set(sourceFile, after);
   }
+  const unused = result.metadata.unusedDirect?.packages ?? [];
+  if (unused.length > 0) {
+    let manifest = byFile.get("package.json");
+    if (manifest === void 0) {
+      try {
+        manifest = await readFile(join(cwd, "package.json"), "utf8");
+      } catch {
+        manifest = void 0;
+      }
+    }
+    if (manifest !== void 0) {
+      const next = removeDirectDependencies(manifest, unused);
+      const diff = dependencyRemovalDiff(manifest, unused);
+      if (diff.length > 0) {
+        patches.push({ file: "package.json", ruleId: "DEPS-VULN-001", safe: false, diff });
+        if (options.unsafe === true) {
+          byFile.set("package.json", next);
+          appliedOverride = true;
+        }
+      }
+    }
+  }
   const notice = appliedOverride ? "run npm install" : void 0;
   if (options.apply !== true) {
     return { applied: false, reverted: false, patches, findings: result.findings, notice };
@@ -10989,6 +12894,29 @@ async function restoreSnapshots(cwd, snapshots) {
     }
   }
 }
+function dependencyRemovalDiff(manifest, names) {
+  const drop = names.map((name) => `"${name}"`);
+  const removed = manifest.split("\n").filter((line) => drop.some((token) => line.includes(token)));
+  if (removed.length === 0) return "";
+  return ["--- a/package.json", "+++ b/package.json", ...removed.map((line) => `-${line}`)].join("\n");
+}
+function removeDirectDependencies(manifest, names) {
+  let parsed;
+  try {
+    parsed = JSON.parse(manifest);
+  } catch {
+    return manifest;
+  }
+  if (parsed.dependencies === void 0 || typeof parsed.dependencies !== "object") return manifest;
+  const drop = new Set(names);
+  const next = {};
+  for (const [name, version] of Object.entries(parsed.dependencies)) {
+    if (!drop.has(name)) next[name] = version;
+  }
+  parsed.dependencies = next;
+  const trailing = manifest.endsWith("\n") ? "\n" : "";
+  return `${JSON.stringify(parsed, null, 2)}${trailing}`;
+}
 function runProjectTests(cwd) {
   let pkg;
   try {
@@ -11169,6 +13097,153 @@ ${target.message}`
 // src/cli/program.ts
 init_version();
 
+// src/core/fingerprint.ts
+init_finding();
+function lineIndependentFingerprint(finding6) {
+  const file = (finding6.file ?? "").replace(/\\/g, "/");
+  const text = (finding6.snippet ?? finding6.message ?? "").replace(/\s+/g, " ").trim();
+  return makeFindingId(finding6.ruleId, file, `${finding6.severity}\0${text}`);
+}
+
+// src/reporters/ci.ts
+init_finding();
+
+// src/reporters/redact.ts
+init_mask();
+var SECRET = /\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk_live_[A-Za-z0-9]{10,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
+function redactSecrets2(text) {
+  return text.replace(SECRET, (match) => maskSecret(match));
+}
+function redactFinding(finding6) {
+  return {
+    ...finding6,
+    title: redactSecrets2(finding6.title),
+    message: redactSecrets2(finding6.message),
+    remediation: redactSecrets2(finding6.remediation),
+    snippet: finding6.snippet === void 0 ? void 0 : redactSecrets2(finding6.snippet)
+  };
+}
+function redactScan(result) {
+  return { ...result, findings: result.findings.map(redactFinding) };
+}
+
+// src/reporters/ci.ts
+var MESSAGE_CAP = 4e3;
+function posix2(file) {
+  return file.replace(/\\/g, "/");
+}
+function clip(text) {
+  return text.length <= MESSAGE_CAP ? text : `${text.slice(0, MESSAGE_CAP)}\u2026`;
+}
+function githubEscape(value, property) {
+  let out = value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A").replace(/:/g, "%3A");
+  if (property) out = out.replace(/,/g, "%2C");
+  return out;
+}
+function githubLevel(severity) {
+  if (severity === "critical" || severity === "high") return "error";
+  if (severity === "medium") return "warning";
+  return "notice";
+}
+function gitlabSeverity(severity) {
+  if (severity === "info") return "info";
+  if (severity === "low") return "minor";
+  if (severity === "medium") return "major";
+  if (severity === "high") return "critical";
+  return "blocker";
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function oneLine(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function renderGithubAnnotations(input) {
+  const result = redactScan(input);
+  if (result.findings.length === 0) {
+    return "::notice title=FullShield::No findings\n";
+  }
+  const lines = result.findings.map((finding6) => {
+    const props = [];
+    if (finding6.file !== void 0) props.push(`file=${githubEscape(posix2(finding6.file), true)}`);
+    if (finding6.line !== void 0) props.push(`line=${finding6.line}`);
+    if (finding6.column !== void 0) props.push(`col=${finding6.column + 1}`);
+    props.push(`title=${githubEscape(finding6.ruleId, true)}`);
+    const message = githubEscape(clip(finding6.message), false);
+    return `::${githubLevel(finding6.severity)} ${props.join(",")}::${message}`;
+  });
+  return `${lines.join("\n")}
+`;
+}
+function junitCase(finding6) {
+  const file = finding6.file !== void 0 ? posix2(finding6.file) : "fullshield";
+  const attrs = [
+    `name="${xmlEscape(finding6.ruleId)}"`,
+    `classname="${xmlEscape(file)}"`,
+    `file="${xmlEscape(file)}"`
+  ];
+  if (finding6.line !== void 0) attrs.push(`line="${finding6.line}"`);
+  const open = `<testcase ${attrs.join(" ")}>`;
+  if (!meetsThreshold(finding6.severity, "medium")) {
+    return `${open}<skipped message="${xmlEscape(oneLine(clip(finding6.message)))}"/></testcase>`;
+  }
+  const detail = clip(`${finding6.message}${finding6.remediation.length > 0 ? `
+Fix: ${finding6.remediation}` : ""}`);
+  return `${open}<failure type="${finding6.severity}" message="${xmlEscape(oneLine(clip(finding6.message)))}">${xmlEscape(detail)}</failure></testcase>`;
+}
+function renderJunitReport(input) {
+  const result = redactScan(input);
+  const header = '<?xml version="1.0" encoding="UTF-8"?>';
+  if (result.findings.length === 0) {
+    return `${header}
+<testsuites name="fullshield" tests="1" failures="0" skipped="0"><testsuite name="fullshield" tests="1" failures="0" skipped="0"><testcase name="scan" classname="fullshield"/></testsuite></testsuites>
+`;
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of result.findings) {
+    const list = groups.get(finding6.module) ?? [];
+    list.push(finding6);
+    groups.set(finding6.module, list);
+  }
+  let failures = 0;
+  let skipped = 0;
+  const suites = [];
+  for (const [name, findings] of groups) {
+    let suiteFailures = 0;
+    let suiteSkipped = 0;
+    const cases = findings.map((finding6) => {
+      if (meetsThreshold(finding6.severity, "medium")) suiteFailures += 1;
+      else suiteSkipped += 1;
+      return junitCase(finding6);
+    });
+    failures += suiteFailures;
+    skipped += suiteSkipped;
+    suites.push(
+      `<testsuite name="${xmlEscape(name)}" tests="${findings.length}" failures="${suiteFailures}" skipped="${suiteSkipped}">${cases.join("")}</testsuite>`
+    );
+  }
+  return `${header}
+<testsuites name="fullshield" tests="${result.findings.length}" failures="${failures}" skipped="${skipped}">${suites.join("")}</testsuites>
+`;
+}
+function renderGitlabCodeQuality(input) {
+  const result = redactScan(input);
+  const report = result.findings.map((finding6) => {
+    const path = finding6.file !== void 0 ? posix2(finding6.file) : ".";
+    const location4 = { path };
+    if (finding6.line !== void 0) location4.lines = { begin: finding6.line };
+    return {
+      description: clip(finding6.message),
+      check_name: finding6.ruleId,
+      fingerprint: lineIndependentFingerprint(finding6),
+      severity: gitlabSeverity(finding6.severity),
+      location: location4
+    };
+  });
+  return `${JSON.stringify(report, null, 2)}
+`;
+}
+
 // src/reporters/console.ts
 init_finding();
 var SEVERITY_COLOR = {
@@ -11210,7 +13285,160 @@ function renderFinding(finding6) {
   }
   return lines;
 }
-function renderConsoleReport(result) {
+var SEVERITY_RANK = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3,
+  info: 4
+};
+var SHOWN_VULN_REACH = /* @__PURE__ */ new Set([
+  "reachable",
+  "symbol-reachable",
+  "reachable-via-dependency",
+  "reachability-unknown"
+]);
+function packageNameFromSnippet3(snippet) {
+  if (snippet === void 0 || snippet.length === 0) return void 0;
+  if (snippet.startsWith("@")) {
+    const second = snippet.indexOf("@", 1);
+    return second === -1 ? snippet : snippet.slice(0, second);
+  }
+  const at = snippet.indexOf("@");
+  return at <= 0 ? snippet : snippet.slice(0, at);
+}
+function versionsFromSnippet(snippet) {
+  const name = packageNameFromSnippet3(snippet);
+  if (name === void 0 || snippet === void 0) return [];
+  const rest = snippet.slice(name.length + 1);
+  return rest.length === 0 ? [] : rest.split(",").filter((version) => version.length > 0);
+}
+function isDevOnly2(finding6) {
+  return finding6.message.includes("(dev-only)");
+}
+function isActionable(finding6) {
+  if (finding6.ruleId === "DEPS-MALICIOUS-001") return true;
+  if (finding6.ruleId === "DEPS-VULN-001") {
+    if (isDevOnly2(finding6)) return false;
+    return finding6.reachability !== void 0 && SHOWN_VULN_REACH.has(finding6.reachability);
+  }
+  if (finding6.module === "sast" || finding6.module === "secrets" || finding6.module === "config") {
+    return finding6.severity === "high" || finding6.severity === "critical" || finding6.confidence === "high";
+  }
+  return false;
+}
+function reachRank(finding6) {
+  const reachability = finding6.reachability;
+  if (reachability === "reachable" || reachability === "symbol-reachable") return 0;
+  if (reachability === "reachable-via-dependency") return 1;
+  if (reachability === "reachability-unknown") return 2;
+  if (reachability === void 0) return 4;
+  return 3;
+}
+function compareActionable(a, b) {
+  const maliciousA = a.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+  const maliciousB = b.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+  return maliciousA - maliciousB || SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || reachRank(a) - reachRank(b) || (a.file ?? "").localeCompare(b.file ?? "") || (a.line ?? 0) - (b.line ?? 0) || a.ruleId.localeCompare(b.ruleId);
+}
+function highestSeverity(findings) {
+  return findings.reduce(
+    (best, finding6) => SEVERITY_RANK[finding6.severity] < SEVERITY_RANK[best] ? finding6.severity : best,
+    findings[0]?.severity ?? "info"
+  );
+}
+function bestReachability(findings) {
+  let best;
+  let bestRank = 5;
+  for (const finding6 of findings) {
+    const rank = reachRank(finding6);
+    if (finding6.reachability !== void 0 && rank < bestRank) {
+      best = finding6.reachability;
+      bestRank = rank;
+    }
+  }
+  return best;
+}
+function shownConsoleRows(findings) {
+  return dependencyRows(findings.filter(isActionable));
+}
+function dependencyRows(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  const singles = [];
+  for (const finding6 of findings) {
+    const name = packageNameFromSnippet3(finding6.snippet);
+    if ((finding6.ruleId === "DEPS-VULN-001" || finding6.ruleId === "DEPS-MALICIOUS-001") && name !== void 0) {
+      const list = groups.get(name);
+      if (list === void 0) groups.set(name, [finding6]);
+      else list.push(finding6);
+    } else {
+      singles.push(finding6);
+    }
+  }
+  const rows = singles.map((finding6) => ({
+    findings: [finding6],
+    severity: finding6.severity,
+    reachability: finding6.reachability,
+    ruleId: finding6.ruleId,
+    file: finding6.file,
+    line: finding6.line,
+    versions: [],
+    grouped: false
+  }));
+  for (const [packageName, list] of groups) {
+    const ordered = [...list].sort(compareActionable);
+    const first = ordered[0];
+    if (first === void 0) continue;
+    const versions = [...new Set(list.flatMap((finding6) => versionsFromSnippet(finding6.snippet)))].sort();
+    const malicious = list.find((finding6) => finding6.ruleId === "DEPS-MALICIOUS-001");
+    rows.push({
+      findings: ordered,
+      severity: highestSeverity(list),
+      reachability: bestReachability(list),
+      ruleId: malicious?.ruleId ?? "DEPS-VULN-001",
+      file: first.file,
+      line: first.line,
+      packageName,
+      versions,
+      path: first.dependencyPath,
+      grouped: true
+    });
+  }
+  rows.sort((a, b) => {
+    const probeA = a.findings[0];
+    const probeB = b.findings[0];
+    if (probeA === void 0 || probeB === void 0) return 0;
+    const maliciousA = a.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+    const maliciousB = b.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+    return maliciousA - maliciousB || SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || reachRank({ ...probeA, reachability: a.reachability }) - reachRank({ ...probeB, reachability: b.reachability }) || (a.file ?? "").localeCompare(b.file ?? "") || (a.line ?? 0) - (b.line ?? 0) || a.ruleId.localeCompare(b.ruleId);
+  });
+  return rows;
+}
+function renderRow(row) {
+  if (!row.grouped) {
+    const only = row.findings[0];
+    if (only === void 0) return [];
+    return [...renderFinding(only), `    docs: rules/${only.ruleId}.md`];
+  }
+  const reach = row.reachability ?? "unspecified";
+  const lines = [
+    `  ${pc.bold(`[${row.ruleId}]`)} ${row.packageName} \u2014 ${row.findings.length} advisories, ${row.severity}, ${reach}`,
+    `    versions: ${row.versions.join(", ") || "unknown"}`
+  ];
+  if (row.path !== void 0 && row.path.length > 0) {
+    lines.push(`    path: ${row.path.join(" > ")}`);
+  }
+  if (row.file !== void 0) {
+    lines.push(`    ${row.file}${row.line !== void 0 ? `:${row.line}` : ""}`);
+  }
+  const evidenceImport = row.findings[0]?.reachabilityEvidence?.imports[0];
+  if (evidenceImport !== void 0) {
+    lines.push(`    import: ${evidenceImport.file}:${evidenceImport.line} ${evidenceImport.specifier}`);
+  }
+  lines.push(`    docs: rules/${row.ruleId}.md`);
+  return lines;
+}
+function renderConsoleReport(input, options = {}) {
+  const result = redactScan(input);
   const { findings, summary, metadata } = result;
   const lines = [];
   lines.push(
@@ -11218,34 +13446,64 @@ function renderConsoleReport(result) {
       ` \u2014 scanned ${metadata.filesScanned} files in ${metadata.durationMs}ms (modules: ${metadata.modulesRun.length > 0 ? metadata.modulesRun.join(", ") : "none"})`
     )
   );
+  if (metadata.history !== void 0) lines.push(metadata.history);
+  if (metadata.upgradePlan !== void 0 && metadata.upgradePlan.sentence.length > 0) {
+    lines.push(metadata.upgradePlan.sentence);
+  }
+  if (metadata.unusedDirect !== void 0) {
+    const count = metadata.unusedDirect.packages.length;
+    const advisories = metadata.unusedDirect.advisories;
+    const packageWord = count === 1 ? "package is" : "packages are";
+    const advisoryWord = advisories === 1 ? "advisory" : "advisories";
+    lines.push(
+      `${count} ${packageWord} never imported; removing them clears ${advisories} ${advisoryWord}.`
+    );
+  }
   if (metadata.modulesRun.length < metadata.modulesRequested.length) {
     const pending = metadata.modulesRequested.filter((m) => !metadata.modulesRun.includes(m));
     lines.push(
       pc.dim(`note: requested modules not implemented yet: ${pending.join(", ")}`)
     );
   }
-  const bySeverityDesc = [...SEVERITIES].reverse();
-  const ordered = bySeverityDesc.flatMap((severity) => findings.filter((f) => f.severity === severity));
-  const shown = ordered.slice(0, 10);
-  const hidden = ordered.length - shown.length;
-  for (const severity of bySeverityDesc) {
-    const group = shown.filter((f) => f.severity === severity);
-    if (group.length === 0) continue;
-    lines.push("");
-    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${findings.filter((f) => f.severity === severity).length})`));
-    for (const finding6 of group) {
-      lines.push(...renderFinding(finding6));
-      lines.push(`    docs: rules/${finding6.ruleId}.md`);
+  const showAll = options.all === true;
+  const folded = findings.filter((finding6) => !isActionable(finding6));
+  const rows = showAll ? [...findings].sort(compareActionable).map((finding6) => ({
+    findings: [finding6],
+    severity: finding6.severity,
+    reachability: finding6.reachability,
+    ruleId: finding6.ruleId,
+    file: finding6.file,
+    line: finding6.line,
+    versions: [],
+    grouped: false
+  })) : shownConsoleRows(findings);
+  const printed = showAll ? rows : rows.slice(0, 20);
+  const hiddenActionable = showAll ? 0 : rows.length - printed.length;
+  let previous;
+  for (const row of printed) {
+    if (row.severity !== previous) {
+      const count = printed.filter((item) => item.severity === row.severity).length;
+      lines.push("");
+      lines.push(SEVERITY_COLOR[row.severity](`${row.severity.toUpperCase()} (${count})`));
+      previous = row.severity;
     }
+    lines.push(...renderRow(row));
+  }
+  if (hiddenActionable > 0) {
+    lines.push("");
+    lines.push(`${hiddenActionable} more actionable \u2014 use --json`);
   }
-  if (hidden > 0) {
+  if (!showAll && folded.length > 0) {
     lines.push("");
-    lines.push(`${hidden} more \u2014 use --json`);
+    lines.push(
+      `${folded.length} more (not directly reachable, or below high confidence) \u2014 --all or see JSON`
+    );
   }
   lines.push("");
   if (summary.total === 0) {
     lines.push(pc.green("\u2714 No findings."));
   } else {
+    const bySeverityDesc = [...SEVERITIES].reverse();
     const counts = bySeverityDesc.filter((s) => summary.bySeverity[s] > 0).map((s) => `${summary.bySeverity[s]} ${s}`).join(", ");
     lines.push(pc.red(`\u2716 ${summary.total} finding(s): ${counts}`));
   }
@@ -11261,7 +13519,8 @@ function location2(finding6) {
   if (finding6.file === void 0) return "(project)";
   return finding6.line !== void 0 ? `${finding6.file}:${finding6.line}` : finding6.file;
 }
-function renderHtmlReport(result) {
+function renderHtmlReport(input) {
+  const result = redactScan(input);
   const sections = [];
   const bySeverityDesc = [...SEVERITIES].reverse();
   for (const severity of bySeverityDesc) {
@@ -11308,7 +13567,7 @@ ${items}`);
 
 // src/reporters/json.ts
 function publicFinding(finding6) {
-  const copy = { ...finding6 };
+  const copy = redactFinding(finding6);
   delete copy.aiVerdict;
   delete copy.exploitScenario;
   delete copy.aiReasoning;
@@ -11332,7 +13591,8 @@ function location3(finding6) {
   if (finding6.file === void 0) return "(project)";
   return finding6.line !== void 0 ? `${finding6.file}:${finding6.line}` : finding6.file;
 }
-function renderMarkdownReport(result) {
+function renderMarkdownReport(input) {
+  const result = redactScan(input);
   const lines = [
     "# FullShield report",
     "",
@@ -11373,8 +13633,6 @@ function renderMarkdownReport(result) {
   }
   return lines.join("\n");
 }
-
-// src/reporters/sarif.ts
 var SCHEMA_URI = "https://json.schemastore.org/sarif-2.1.0.json";
 function sarifLevel(severity) {
   if (severity === "critical" || severity === "high") return "error";
@@ -11384,14 +13642,37 @@ function sarifLevel(severity) {
 function uri(file) {
   return (file ?? "").replace(/\\/g, "/");
 }
-function renderSarifReport(result) {
+function sarifV2() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_SARIF_V2 === "1";
+}
+function ruleMarkdown(ruleId) {
+  const path = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "rules", `${ruleId}.md`);
+  if (!existsSync(path)) return void 0;
+  return readFileSync(path, "utf8").slice(0, 2048);
+}
+function relatedLocations(finding6) {
+  if (finding6.dependencyPath === void 0 || finding6.dependencyPath.length === 0) return void 0;
+  return finding6.dependencyPath.map((step) => ({
+    message: { text: step },
+    physicalLocation: {
+      artifactLocation: { uri: uri(finding6.file) },
+      ...finding6.line !== void 0 ? { region: { startLine: finding6.line } } : {}
+    }
+  }));
+}
+function renderSarifReport(input) {
+  const result = redactScan(input);
+  const v2 = sarifV2();
   const rules = /* @__PURE__ */ new Map();
   for (const finding6 of result.findings) {
     if (!rules.has(finding6.ruleId)) {
+      const markdown = v2 ? ruleMarkdown(finding6.ruleId) : void 0;
       rules.set(finding6.ruleId, {
         id: finding6.ruleId,
         name: finding6.ruleId,
-        shortDescription: { text: finding6.title }
+        shortDescription: { text: finding6.title },
+        ...markdown !== void 0 ? { help: { markdown } } : {},
+        ...v2 ? { properties: { precision: "unreviewed" } } : {}
       });
     }
   }
@@ -11420,6 +13701,7 @@ function renderSarifReport(result) {
               }
             }
           ] : [];
+          const related = v2 ? relatedLocations(finding6) : void 0;
           const codeFlows = finding6.trace !== void 0 && finding6.trace.length > 0 ? [
             {
               threadFlows: [
@@ -11442,7 +13724,12 @@ function renderSarifReport(result) {
             level: sarifLevel(finding6.severity),
             message: { text: finding6.message },
             locations: location4,
-            ...codeFlows !== void 0 ? { codeFlows } : {}
+            ...codeFlows !== void 0 ? { codeFlows } : {},
+            ...v2 ? {
+              partialFingerprints: { "fullshield/v1": lineIndependentFingerprint(finding6) },
+              ...related !== void 0 ? { relatedLocations: related } : {},
+              ...finding6.module === "deps" && finding6.reachability !== void 0 ? { properties: { reachability: finding6.reachability } } : {}
+            } : {}
           };
         })
       }
@@ -11451,16 +13738,285 @@ function renderSarifReport(result) {
   return JSON.stringify(doc, null, 2);
 }
 
+// src/diff/index.ts
+init_finding();
+init_experimental();
+function posix3(file) {
+  return (file ?? "").replace(/\\/g, "/");
+}
+function diffKey(finding6) {
+  return lineIndependentFingerprint(finding6);
+}
+function groupById(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of findings) {
+    if (finding6.id === void 0 || finding6.id.length === 0) continue;
+    const list = groups.get(finding6.id) ?? [];
+    list.push(finding6);
+    groups.set(finding6.id, list);
+  }
+  return groups;
+}
+function pairMoves(removed, added) {
+  const removedIds = groupById(removed);
+  const addedIds = groupById(added);
+  const moved = [];
+  for (const [id, group] of removedIds) {
+    const match = addedIds.get(id);
+    if (group.length === 1 && match?.length === 1 && group[0] !== void 0 && match[0] !== void 0) {
+      moved.push({ before: group[0], after: match[0] });
+    }
+  }
+  return moved;
+}
+function byLocation(a, b) {
+  return (a.line ?? 0) - (b.line ?? 0) || a.id.localeCompare(b.id) || a.ruleId.localeCompare(b.ruleId);
+}
+function groupFindings(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of findings) {
+    const key = diffKey(finding6);
+    const list = groups.get(key) ?? [];
+    list.push(finding6);
+    groups.set(key, list);
+  }
+  return groups;
+}
+function diffScans(before, after) {
+  const beforeGroups = groupFindings(before);
+  const afterGroups = groupFindings(after);
+  const unchanged = [];
+  const added = [];
+  const removed = [];
+  const moved = [];
+  const keys = [];
+  for (const key of beforeGroups.keys()) keys.push(key);
+  for (const key of afterGroups.keys()) {
+    if (!beforeGroups.has(key)) keys.push(key);
+  }
+  for (const key of keys) {
+    const left = [...beforeGroups.get(key) ?? []].sort(byLocation);
+    const right = [...afterGroups.get(key) ?? []].sort(byLocation);
+    const paired = Math.min(left.length, right.length);
+    for (let i = 0; i < paired; i += 1) {
+      const earlier = left[i];
+      const later = right[i];
+      if (earlier === void 0 || later === void 0) continue;
+      if ((earlier.line ?? 0) === (later.line ?? 0)) unchanged.push(later);
+      else moved.push({ before: earlier, after: later });
+    }
+    for (const finding6 of left.slice(paired)) removed.push(finding6);
+    for (const finding6 of right.slice(paired)) added.push(finding6);
+  }
+  const idMoves = pairMoves(removed, added);
+  const movedBefore = new Set(idMoves.map((item) => item.before));
+  const movedAfter = new Set(idMoves.map((item) => item.after));
+  return {
+    unchanged,
+    added: added.filter((finding6) => !movedAfter.has(finding6)),
+    removed: removed.filter((finding6) => !movedBefore.has(finding6)),
+    moved: [...moved, ...idMoves]
+  };
+}
+function parseScanDocument(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error("scan JSON must be an object with a findings array or a findings array");
+  }
+  const list = Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.findings) ? parsed.findings : void 0;
+  if (list === void 0) {
+    throw new Error("scan JSON must be an object with a findings array or a findings array");
+  }
+  return list.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new Error("scan JSON finding is missing ruleId or severity");
+    }
+    const record = item;
+    const ruleId = record.ruleId;
+    const severity = record.severity;
+    if (typeof ruleId !== "string" || ruleId.length === 0 || typeof severity !== "string") {
+      throw new Error("scan JSON finding is missing ruleId or severity");
+    }
+    if (!isSeverity(severity)) {
+      throw new Error(`scan JSON finding has an unknown severity "${severity}"`);
+    }
+    if (record.line !== void 0 && (typeof record.line !== "number" || !Number.isInteger(record.line) || record.line < 0)) {
+      throw new Error("scan JSON finding line must be an integer >= 0");
+    }
+    return item;
+  });
+}
+function addedFails(diff, failOn) {
+  return diff.added.some((finding6) => finding6.source !== "ai" && meetsThreshold(finding6.severity, failOn));
+}
+var ADDED_CAP = 20;
+function addedLine(finding6) {
+  const where = finding6.file !== void 0 ? ` ${posix3(finding6.file)}:${finding6.line ?? 0}` : "";
+  return `${finding6.severity} ${finding6.ruleId}${where}`;
+}
+function renderDiffText(diff) {
+  const lines = [
+    `fullshield diff: unchanged ${diff.unchanged.length}, added ${diff.added.length}, removed ${diff.removed.length}, moved ${diff.moved.length}`
+  ];
+  if (diff.added.length === 0) return lines.join("\n");
+  lines.push("added:");
+  for (const finding6 of diff.added.slice(0, ADDED_CAP)) lines.push(addedLine(finding6));
+  if (diff.added.length > ADDED_CAP) lines.push(`${diff.added.length - ADDED_CAP} more \u2014 use --json`);
+  return lines.join("\n");
+}
+
 // src/cli/program.ts
+init_experimental();
 init_policy();
 
+// src/deps-diff/index.ts
+init_semver();
+init_lockfile();
+var execFileAsync4 = promisify(execFile);
+var LOCK_NAMES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"];
+function diffLockedPackages(before, after, direct) {
+  const oldMap = new Map(before.map((pkg) => [pkg.name, pkg.version]));
+  const newMap = new Map(after.map((pkg) => [pkg.name, pkg.version]));
+  const names = [.../* @__PURE__ */ new Set([...oldMap.keys(), ...newMap.keys()])].sort();
+  const changes = [];
+  for (const name of names) {
+    const oldVersion = oldMap.get(name);
+    const newVersion = newMap.get(name);
+    const isDirect2 = direct.has(name);
+    if (oldVersion === void 0 && newVersion !== void 0) {
+      changes.push({ name, change: "added", newVersion, direct: isDirect2 });
+    } else if (oldVersion !== void 0 && newVersion === void 0) {
+      changes.push({ name, change: "removed", oldVersion, direct: isDirect2 });
+    } else if (oldVersion !== void 0 && newVersion !== void 0 && oldVersion !== newVersion) {
+      const order = compareSemver(newVersion, oldVersion);
+      changes.push({
+        name,
+        change: order >= 0 ? "upgraded" : "downgraded",
+        oldVersion,
+        newVersion,
+        direct: isDirect2
+      });
+    }
+  }
+  return changes;
+}
+function packagesFromLock(filename, contents) {
+  const graph2 = parseLockfileGraph(filename, contents);
+  return { packages: graph2.packages, direct: /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]) };
+}
+async function gitShow(cwd, spec, run = defaultGit) {
+  return run(cwd, ["show", spec]);
+}
+async function defaultGit(cwd, args) {
+  if (args[0] !== "show") throw new Error("deps-diff only runs git show");
+  const { stdout } = await execFileAsync4("git", args, { cwd, encoding: "utf8" });
+  return stdout;
+}
+async function lockAtRef(cwd, ref, run = defaultGit) {
+  for (const file of LOCK_NAMES) {
+    try {
+      const text = await gitShow(cwd, `${ref}:${file}`, run);
+      if (text.length > 0) return { file, text };
+    } catch {
+    }
+  }
+  throw new Error(`deps-diff cannot read a lockfile at ${ref} (FULLSHIELD_EXPERIMENTAL_DEPS_DIFF)`);
+}
+function releaseAgeLabel(publishedAt, nowMs, minHours = 72) {
+  if (publishedAt === void 0) return "unknown";
+  const published = Date.parse(publishedAt);
+  if (Number.isNaN(published)) return "unknown";
+  const hours = (nowMs - published) / 36e5;
+  return hours < minHours ? "new-release" : "aged";
+}
+var ExplainError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ExplainError";
+  }
+};
+function matchFinding(findings, rawId) {
+  const id = rawId.trim();
+  if (id.length < 6) {
+    throw new ExplainError(`id prefix must be at least 6 characters (FULLSHIELD_EXPERIMENTAL_EXPLAIN)`);
+  }
+  const exact = findings.find((finding6) => finding6.id === id);
+  if (exact !== void 0) return exact;
+  const matches = findings.filter((finding6) => finding6.id.startsWith(id));
+  if (matches.length === 1) {
+    const only = matches[0];
+    if (only !== void 0) return only;
+  }
+  if (matches.length === 0) {
+    const candidates = findings.slice(0, 5).map((finding6) => finding6.id);
+    throw new ExplainError(
+      `no finding matches ${id}${candidates.length > 0 ? `; candidates: ${candidates.join(", ")}` : ""} (FULLSHIELD_EXPERIMENTAL_EXPLAIN)`
+    );
+  }
+  throw new ExplainError(
+    `ambiguous id ${id}; candidates: ${matches.slice(0, 5).map((finding6) => finding6.id).join(", ")} (FULLSHIELD_EXPERIMENTAL_EXPLAIN)`
+  );
+}
+function contextLines(text, line) {
+  if (line === void 0) return [];
+  const rows = text.split(/\r?\n/);
+  const start = Math.max(0, line - 3);
+  const end = Math.min(rows.length, line + 2);
+  return rows.slice(start, end).map((row, index) => `${start + index + 1}|${row}`);
+}
+function renderExplain(finding6, fileText = "") {
+  const location4 = finding6.file !== void 0 ? `${finding6.file}${finding6.line !== void 0 ? `:${finding6.line}` : ""}` : "(project)";
+  const lines = [
+    `${finding6.ruleId} ${finding6.title}`,
+    `severity: ${finding6.severity}`,
+    `confidence: ${finding6.confidence}`,
+    `location: ${location4}`
+  ];
+  const context = contextLines(fileText, finding6.line);
+  if (context.length > 0) {
+    lines.push("context:");
+    lines.push(...context.map((row) => `  ${row}`));
+  }
+  if (finding6.snippet !== void 0) lines.push(`snippet: ${finding6.snippet}`);
+  if (finding6.trace !== void 0 && finding6.trace.length > 0) {
+    lines.push(
+      `trace: ${finding6.trace.map((step) => `${step.file}${step.line !== void 0 ? `:${step.line}` : ""} ${step.note}`).join(" \u2192 ")}`
+    );
+  }
+  if (finding6.reachability !== void 0) {
+    const path = finding6.dependencyPath !== void 0 ? ` (${finding6.dependencyPath.join(" > ")})` : "";
+    lines.push(`reachability: ${finding6.reachability}${path}`);
+  }
+  if (finding6.fix !== void 0) lines.push(`fix: ${finding6.fix.diff}`);
+  lines.push(`docs: rules/${finding6.ruleId}.md`);
+  return lines.join("\n");
+}
+async function explainFinding(options) {
+  const finding6 = matchFinding(options.findings, options.id);
+  let text = "";
+  if (finding6.file !== void 0) {
+    try {
+      text = await readFile(join(options.cwd, finding6.file), "utf8");
+    } catch {
+      text = "";
+    }
+  }
+  return renderExplain(finding6, text);
+}
+
+// src/cli/program.ts
+init_osv();
+init_semver();
+
 // src/sbom/index.ts
 init_engine2();
 init_lockfile();
 init_pins();
 init_cyclonedx();
 var LOCKFILE_NAMES2 = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
-async function buildSbom(cwd) {
+async function buildSbom(cwd, options = {}) {
   const result = await scan({ cwd, modules: ["deps"] });
   let name = "app";
   let version = "0.0.0";
@@ -11486,7 +14042,13 @@ async function buildSbom(cwd) {
   if (components.length === 0) {
     components = exactPinsFromManifest(manifest).map((p) => ({ name: p.name, version: p.version }));
   }
-  return renderCycloneDx({ name, version, components, findings: result.findings });
+  return renderCycloneDx({
+    name,
+    version,
+    components,
+    findings: result.findings,
+    includeReach: options.includeReach === true
+  });
 }
 
 // src/cli/program.ts
@@ -12139,6 +14701,9 @@ var FLAGS = [
   "FULLSHIELD_EXPERIMENTAL_POLICY",
   "FULLSHIELD_EXPERIMENTAL_HOST",
   "FULLSHIELD_EXPERIMENTAL_TAINT_V2",
+  "FULLSHIELD_EXPERIMENTAL_CI_REPORTS",
+  "FULLSHIELD_EXPERIMENTAL_DIFF",
+  "FULLSHIELD_EXPERIMENTAL_LICENSE",
   "FULLSHIELD_PARSE_POOL"
 ];
 function nodeOk(version) {
@@ -12200,6 +14765,31 @@ var KNOWN = [
     test: /cannot read config/,
     code: "FS-E004",
     hint: "Check the path passed to --config."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_CI_REPORTS/,
+    code: "FS-E005",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1 or pass --experimental-ci-reports."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_DIFF|scan JSON|cannot read diff/,
+    code: "FS-E006",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_DIFF=1 or pass --experimental-diff. Both inputs must be scan --json files."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_EXPLAIN|id prefix|no finding matches|ambiguous id/,
+    code: "FS-E007",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_EXPLAIN=1. Pass an id prefix of at least 6 characters from a scan JSON file."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_DEPS_DIFF|deps-diff cannot/,
+    code: "FS-E008",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_DEPS_DIFF=1. Pass a git ref that contains a lockfile."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS|sast\.sources|sast\.sanitizers/,
+    code: "FS-E009",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS=1 before naming sast.sources or sast.sanitizers."
   }
 ];
 var DOCS = "https://github.com/kathanp/fullshield/blob/main/docs/errors.md";
@@ -12251,7 +14841,16 @@ function parseFailOn(value) {
 function createProgram(io = defaultIO) {
   const program = new Command();
   program.name("fullshield").description("Full-cycle security scanner for Node.js/TypeScript backends").version(packageVersion()).option("--debug", "print stack traces on CLI errors");
-  program.command("scan").description("Scan a project directory for security findings").argument("[path]", "directory to scan", ".").option("--json", "machine-readable JSON output").option("--fail-on <severity>", "exit 1 if any finding is at or above this severity").option("--modules <modules>", "comma-separated subset of modules to run").option("--staged", "scan only files staged in git (pre-commit mode)").option("--offline", "use the OSV cache only (no network)").option("--offline-safe", "alias of --offline").option("--config <path>", "path to fullshield.config.json").option("--sarif <file>", "write a SARIF 2.1.0 report to this path").option("--markdown <file>", "write a Markdown report to this path").option("--html <file>", "write an HTML report to this path").option("--update-baseline", "record current findings as accepted (CI fails only on new ones)").option("--ai [mode]", "experimental: explain findings (off = zero AI network calls)").option("--emit-virtual-patches [file]", "experimental: write .fullshield/vpatches.json").option("--changed", "experimental: scan git staged/changed files only").option("--since <ref>", "experimental: scan files changed since a git ref").option(
+  program.command("scan").description("Scan a project directory for security findings").argument("[path]", "directory to scan", ".").option("--json", "machine-readable JSON output").option("--all", "print every finding in the console, with no 20-row cap").option("--fail-on <severity>", "exit 1 if any finding is at or above this severity").option("--modules <modules>", "comma-separated subset of modules to run").option("--staged", "scan only files staged in git (pre-commit mode)").option("--offline", "use the OSV cache only (no network)").option("--offline-safe", "alias of --offline").option("--config <path>", "path to fullshield.config.json").option("--sarif <file>", "write a SARIF 2.1.0 report to this path").option("--markdown <file>", "write a Markdown report to this path").option("--html <file>", "write an HTML report to this path").option(
+    "--experimental-ci-reports",
+    "experimental: GitHub annotations, JUnit, and GitLab Code Quality (FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)"
+  ).option(
+    "--github-annotations <file>",
+    "experimental: GitHub Actions workflow commands (requires FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)"
+  ).option("--junit <file>", "experimental: JUnit XML (requires FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)").option(
+    "--gitlab <file>",
+    "experimental: GitLab Code Quality JSON (requires FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)"
+  ).option("--update-baseline", "record current findings as accepted (CI fails only on new ones)").option("--ai [mode]", "experimental: explain findings (off = zero AI network calls)").option("--emit-virtual-patches [file]", "experimental: write .fullshield/vpatches.json").option("--changed", "experimental: scan git staged/changed files only").option("--since <ref>", "experimental: scan files changed since a git ref").option(
     "--experimental-sast-gaps",
     "experimental: ORM raw / sh -c / execa / zx sinks (FULLSHIELD_EXPERIMENTAL_SAST_GAPS=1)"
   ).option(
@@ -12276,6 +14875,27 @@ function createProgram(io = defaultIO) {
     "--experimental-vex",
     "experimental: worm/workflow indicators, overrides, provenance, VEX (FULLSHIELD_EXPERIMENTAL_VEX=1)"
   ).option(
+    "--experimental-reach-evidence",
+    "experimental: record why a dependency reachability class was chosen (FULLSHIELD_EXPERIMENTAL_REACH_EVIDENCE=1)"
+  ).option(
+    "--experimental-lockfiles",
+    "experimental: yarn berry, pnpm v9, and bun.lock (FULLSHIELD_EXPERIMENTAL_LOCKFILES=1)"
+  ).option(
+    "--experimental-supply",
+    "experimental: supply-chain campaign heuristics (FULLSHIELD_EXPERIMENTAL_SUPPLY=1)"
+  ).option(
+    "--experimental-workspaces",
+    "experimental: scan each workspace lockfile (FULLSHIELD_EXPERIMENTAL_WORKSPACES=1)"
+  ).option(
+    "--experimental-sarif-v2",
+    "experimental: extra SARIF fields (FULLSHIELD_EXPERIMENTAL_SARIF_V2=1)"
+  ).option(
+    "--experimental-custom-sanitizers",
+    "experimental: config-declared sources and sanitizers (FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS=1)"
+  ).option(
+    "--experimental-validation",
+    "experimental: route schema validation inference (FULLSHIELD_EXPERIMENTAL_VALIDATION=1)"
+  ).option("--taint-summaries", "cache per-function taint summaries (FULLSHIELD_TAINT_SUMMARIES=1)").option(
     "--experimental-mcpcfg",
     "experimental: MCP client/server config rules (FULLSHIELD_EXPERIMENTAL_MCPCFG=1)"
   ).option(
@@ -12304,12 +14924,45 @@ function createProgram(io = defaultIO) {
       if (opts.experimentalVex === true) {
         process.env.FULLSHIELD_EXPERIMENTAL_VEX = "1";
       }
+      if (opts.experimentalReachEvidence === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_REACH_EVIDENCE = "1";
+      }
+      if (opts.experimentalLockfiles === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_LOCKFILES = "1";
+      }
+      if (opts.experimentalSupply === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY = "1";
+      }
+      if (opts.experimentalWorkspaces === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_WORKSPACES = "1";
+      }
+      if (opts.experimentalSarifV2 === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_SARIF_V2 = "1";
+      }
+      if (opts.experimentalCustomSanitizers === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS = "1";
+      }
+      if (opts.experimentalValidation === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_VALIDATION = "1";
+      }
+      if (opts.taintSummaries === true) {
+        process.env.FULLSHIELD_TAINT_SUMMARIES = "1";
+      }
       if (opts.experimentalMcpcfg === true) {
         process.env.FULLSHIELD_EXPERIMENTAL_MCPCFG = "1";
       }
       if (opts.prSummary === true && process.env[POLICY_FLAG] !== "1") {
         throw new Error(`--pr-summary requires ${POLICY_FLAG}=1`);
       }
+      if (opts.experimentalCiReports === true) {
+        process.env[CI_REPORTS_FLAG] = "1";
+      }
+      const wantsCiReport = opts.githubAnnotations !== void 0 || opts.junit !== void 0 || opts.gitlab !== void 0;
+      if (wantsCiReport && process.env[CI_REPORTS_FLAG] !== "1") {
+        throw new Error(
+          `--github-annotations, --junit, and --gitlab require ${CI_REPORTS_FLAG}=1`
+        );
+      }
       const result = await scan({
         cwd: resolve(path),
         modules,
@@ -12337,6 +14990,15 @@ function createProgram(io = defaultIO) {
       if (opts.html !== void 0) {
         await writeFile(resolve(opts.html), renderHtmlReport(result), "utf8");
       }
+      if (opts.githubAnnotations !== void 0) {
+        await writeFile(resolve(opts.githubAnnotations), renderGithubAnnotations(result), "utf8");
+      }
+      if (opts.junit !== void 0) {
+        await writeFile(resolve(opts.junit), renderJunitReport(result), "utf8");
+      }
+      if (opts.gitlab !== void 0) {
+        await writeFile(resolve(opts.gitlab), renderGitlabCodeQuality(result), "utf8");
+      }
       await writeLastScan(resolve(path), result);
       if (opts.emitVirtualPatches !== void 0) {
         if (process.env.FULLSHIELD_EXPERIMENTAL_VPATCH !== "1") {
@@ -12350,7 +15012,9 @@ function createProgram(io = defaultIO) {
       if (opts.prSummary === true) {
         io.out(renderPrSummary(result.findings));
       } else {
-        io.out(opts.json === true ? renderJsonReport(result) : renderConsoleReport(result));
+        io.out(
+          opts.json === true ? renderJsonReport(result) : renderConsoleReport(result, { all: opts.all === true })
+        );
       }
       if (result.policy !== void 0 && result.policy.errors.length > 0) {
         for (const message of result.policy.errors) {
@@ -12358,6 +15022,12 @@ function createProgram(io = defaultIO) {
         }
         process.exitCode = 1;
       }
+      if (result.suppressionErrors !== void 0 && result.suppressionErrors.length > 0) {
+        for (const message of result.suppressionErrors) {
+          io.err(`fullshield: ${message}`);
+        }
+        process.exitCode = 1;
+      }
       const failOn = failOnOverride ?? result.policy?.failOn ?? result.config.failOn;
       if (result.findings.some((f) => failsCi(f, failOn))) {
         process.exitCode = 1;
@@ -12459,7 +15129,9 @@ function createProgram(io = defaultIO) {
       if (opts.format !== void 0 && opts.format !== "cyclonedx") {
         throw new Error(`unsupported SBOM format "${opts.format}" (valid: cyclonedx)`);
       }
-      const doc = await buildSbom(resolve(path));
+      const doc = await buildSbom(resolve(path), {
+        includeReach: process.env.FULLSHIELD_EXPERIMENTAL_SBOM_REACH === "1"
+      });
       const errors = validateCycloneDx15(doc);
       if (errors.length > 0) throw new Error(`invalid SBOM: ${errors.join("; ")}`);
       const json = JSON.stringify(doc, null, 2);
@@ -12613,6 +15285,87 @@ function createProgram(io = defaultIO) {
       process.exitCode = 2;
     }
   });
+  program.command("explain").description("Print one finding from a scan JSON file (requires FULLSHIELD_EXPERIMENTAL_EXPLAIN=1)").argument("<id>", "finding id or a prefix of at least 6 characters").option("--from <file>", "scan --json file").action(async (id, opts) => {
+    try {
+      if (process.env.FULLSHIELD_EXPERIMENTAL_EXPLAIN !== "1") {
+        throw new Error("explain requires FULLSHIELD_EXPERIMENTAL_EXPLAIN=1");
+      }
+      if (opts.from === void 0) throw new Error("explain needs --from <scan.json> (FULLSHIELD_EXPERIMENTAL_EXPLAIN)");
+      const raw = JSON.parse(await readFile(opts.from, "utf8"));
+      if (!Array.isArray(raw.findings)) throw new Error("explain --from is not scan JSON (FULLSHIELD_EXPERIMENTAL_EXPLAIN)");
+      const text = await explainFinding({
+        cwd: process.cwd(),
+        id,
+        findings: raw.findings
+      });
+      io.out(text);
+    } catch (error) {
+      io.err(formatCliError(error));
+      process.exitCode = 2;
+    }
+  });
+  program.command("deps-diff").description("Compare a lockfile at a git ref with the working tree (requires FULLSHIELD_EXPERIMENTAL_DEPS_DIFF=1)").argument("<ref>", "git ref to read with git show").argument("[path]", "project directory", ".").option("--json", "print JSON").option("--fail-on <severity>", "exit 1 when an introduced advisory is at or above this severity").option("--offline", "use the OSV cache only").action(async (ref, path, opts) => {
+    try {
+      if (process.env.FULLSHIELD_EXPERIMENTAL_DEPS_DIFF !== "1") {
+        throw new Error("deps-diff requires FULLSHIELD_EXPERIMENTAL_DEPS_DIFF=1");
+      }
+      const cwd = resolve(path);
+      const previous = await lockAtRef(cwd, ref);
+      let currentText = "";
+      try {
+        currentText = await readFile(join(cwd, previous.file), "utf8");
+      } catch {
+        currentText = "";
+      }
+      const before = packagesFromLock(previous.file, previous.text);
+      const after = packagesFromLock(previous.file, currentText);
+      const changes = diffLockedPackages(before.packages, after.packages, after.direct);
+      const moved = after.packages.filter(
+        (pkg) => changes.some((change) => change.name === pkg.name && change.change !== "removed" && change.newVersion === pkg.version)
+      );
+      const hits = await queryOsv(moved, {
+        cacheDir: join(cwd, "osv-cache"),
+        offline: opts.offline === true
+      });
+      const introduced = hits.flatMap(
+        (hit2) => hit2.vulns.map((vuln) => ({
+          name: hit2.pkg.name,
+          version: hit2.pkg.version,
+          id: vuln.id,
+          severity: osvSeverity(vuln)
+        }))
+      );
+      const added = changes.filter((change) => change.change === "added");
+      const ages = [];
+      for (const change of added) {
+        let published;
+        let installScripts = "unknown";
+        try {
+          const raw = JSON.parse(await readFile(join(cwd, "osv-cache", "registry", `${change.name}.json`), "utf8"));
+          published = raw.time;
+          if (raw.hasInstallScript === true) installScripts = "yes";
+          if (raw.hasInstallScript === false) installScripts = "no";
+        } catch {
+          published = void 0;
+        }
+        ages.push({
+          name: change.name,
+          version: change.newVersion,
+          age: releaseAgeLabel(published, Date.now()),
+          installScripts
+        });
+      }
+      const report = { changes, introduced, ages };
+      io.out(JSON.stringify(report, null, 2));
+      if (opts.failOn !== void 0) {
+        const threshold = parseFailOn(opts.failOn);
+        if (introduced.some((item) => meetsThreshold(item.severity, threshold))) process.exitCode = 1;
+      }
+    } catch (error) {
+      io.err(formatCliError(error));
+      process.exitCode = 2;
+    }
+  });
   program.command("confirm").description("Experimental exploit confirm (localhost/127.0.0.1/FullShield container only)").argument("<url>", "target base URL").action(async (url) => {
     try {
       if (process.env.FULLSHIELD_EXPERIMENTAL_CONFIRM !== "1") {
@@ -12748,8 +15501,8 @@ function createProgram(io = defaultIO) {
       let name = "app";
       let version = "0.0.0";
       try {
-        const { readFile: readFile19 } = await import('fs/promises');
-        const pkg = JSON.parse(await readFile19(join(cwd, "package.json"), "utf8"));
+        const { readFile: readFile22 } = await import('fs/promises');
+        const pkg = JSON.parse(await readFile22(join(cwd, "package.json"), "utf8"));
         if (typeof pkg.name === "string") name = pkg.name;
         if (typeof pkg.version === "string") version = pkg.version;
       } catch {
@@ -12770,6 +15523,31 @@ function createProgram(io = defaultIO) {
       process.exitCode = 2;
     }
   });
+  program.command("diff").description("Experimental comparison of two scan --json files (FULLSHIELD_EXPERIMENTAL_DIFF=1)").argument("<before>", "earlier scan JSON").argument("<after>", "later scan JSON").option("--experimental-diff", "enable this command (FULLSHIELD_EXPERIMENTAL_DIFF=1)").option("--json", "print the machine diff").option("--out <file>", "write the machine diff to this file").option("--fail-on <severity>", "exit 1 when an added finding is at or above this severity", "high").action(
+    async (beforePath, afterPath, opts) => {
+      try {
+        if (opts.experimentalDiff === true) process.env[DIFF_FLAG] = "1";
+        if (!diffEnabled()) throw new Error(`diff requires ${DIFF_FLAG}=1`);
+        const failOn = parseFailOn(opts.failOn ?? "high");
+        let beforeText;
+        let afterText;
+        try {
+          beforeText = await readFile(resolve(beforePath), "utf8");
+          afterText = await readFile(resolve(afterPath), "utf8");
+        } catch {
+          throw new Error("cannot read diff input");
+        }
+        const diff = diffScans(parseScanDocument(beforeText), parseScanDocument(afterText));
+        const json = JSON.stringify(diff, null, 2);
+        if (opts.out !== void 0) await writeFile(resolve(opts.out), json, "utf8");
+        io.out(opts.json === true ? json : renderDiffText(diff));
+        if (addedFails(diff, failOn)) process.exitCode = 1;
+      } catch (error) {
+        io.err(formatCliError(error));
+        process.exitCode = 2;
+      }
+    }
+  );
   program.command("doctor").description("Report Node, lockfile, cache, flags, config, and whether OSV is offline").argument("[path]", "project directory", ".").option("--offline", "do not describe OSV as allowed to use the network").option("--config <file>", "explicit config file").action(async (path, opts) => {
     try {
       io.out(await runDoctor(resolve(path), opts));