fullshield 0.2.6 → 0.4.0

package/dist/index.js

@@ -1,12 +1,12 @@
 import { createHash } from 'crypto';
-import { readFile, mkdir, writeFile, stat, unlink, readdir, mkdtemp } from 'fs/promises';
+import { readFile, mkdir, writeFile, readdir, stat, unlink, mkdtemp } from 'fs/promises';
 import { resolve, join, basename, dirname, posix, relative } from 'path';
 import { execFile, spawnSync, spawn, execFileSync } from 'child_process';
 import { createInterface } from 'readline';
 import { promisify } from 'util';
 import { performance } from 'perf_hooks';
+import { existsSync, mkdirSync, writeFileSync, statSync, readFileSync, rmSync, readdirSync, cpSync } from 'fs';
 import { homedir, availableParallelism, tmpdir } from 'os';
-import { existsSync, statSync, readFileSync, readdirSync, cpSync, mkdirSync, rmSync } from 'fs';
 import { Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
 import ignoreModule from 'ignore';
@@ -461,7 +461,7 @@ function scanTextForSecretHits(path, text) {
   return hits;
 }
 function scanTextForSecrets(path, text) {
-  return scanTextForSecretHits(path, text).map((hit) => hit.finding);
+  return scanTextForSecretHits(path, text).map((hit2) => hit2.finding);
 }
 var secretsRules, REMEDIATION, MAX_FILE_SIZE, secretsModule;
 var init_secrets = __esm({
@@ -565,6 +565,7 @@ var init_incremental = __esm({
 // src/modules/secrets/history.ts
 var history_exports = {};
 __export(history_exports, {
+  historyCommitLimit: () => historyCommitLimit,
   scanGitHistory: () => scanGitHistory
 });
 function gitError(error) {
@@ -598,16 +599,22 @@ async function readBlob(cwd, hash) {
     return void 0;
   }
 }
-function remapHit(hit, file) {
-  const snippet = hit.finding.snippet;
-  const line = hit.finding.line ?? 0;
-  const id = makeFindingId(hit.finding.ruleId, file, `${line}|${snippet ?? "file"}`);
+function remapHit(hit2, file) {
+  const snippet = hit2.finding.snippet;
+  const line = hit2.finding.line ?? 0;
+  const id = makeFindingId(hit2.finding.ruleId, file, `${line}|${snippet ?? "file"}`);
   return {
-    finding: { ...hit.finding, id, file },
-    secret: hit.secret
+    finding: { ...hit2.finding, id, file },
+    secret: hit2.secret
   };
 }
-async function streamLogChanges(cwd) {
+function historyCommitLimit(raw = process.env.FULLSHIELD_HISTORY_MAX) {
+  if (raw === void 0 || raw.trim() === "") return 500;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 1) return 500;
+  return Math.min(parsed, 5e3);
+}
+async function streamLogChanges(cwd, maxCommits) {
   const changes = [];
   await gitOk(cwd, ["rev-parse", "--is-inside-work-tree"]);
   const child = spawn(
@@ -624,6 +631,8 @@ async function streamLogChanges(cwd) {
       "--format=FSCOMMIT:%H",
       "--no-textconv",
       "--no-ext-diff",
+      "-n",
+      String(maxCommits),
       "HEAD"
     ],
     { stdio: ["ignore", "pipe", "pipe"] }
@@ -686,14 +695,20 @@ async function headSecretKeys(cwd) {
       hits = scanTextForSecretHits(path, text);
       seen.set(hash, hits);
     }
-    for (const hit of hits) {
-      keys.add(`${hit.finding.ruleId}\0${hit.finding.snippet ?? ""}`);
+    for (const hit2 of hits) {
+      keys.add(`${hit2.finding.ruleId}\0${hit2.finding.snippet ?? ""}`);
     }
   }
   return keys;
 }
-async function scanGitHistory(cwd) {
-  const changes = await streamLogChanges(cwd);
+async function commitCount(cwd) {
+  const raw = await gitOk(cwd, ["rev-list", "--count", "HEAD"]);
+  const total = Number(raw.trim());
+  return Number.isInteger(total) && total >= 0 ? total : 0;
+}
+async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
+  const total = await commitCount(cwd);
+  const changes = await streamLogChanges(cwd, maxCommits);
   const blobHits = /* @__PURE__ */ new Map();
   const first = /* @__PURE__ */ new Map();
   for (const change of changes) {
@@ -714,8 +729,8 @@ async function scanGitHistory(cwd) {
       hits2 = rawHits.filter((h) => allowed.has(h.finding.id));
       blobHits.set(change.hash, hits2);
     }
-    for (const hit of hits2) {
-      const mapped = remapHit(hit, change.path);
+    for (const hit2 of hits2) {
+      const mapped = remapHit(hit2, change.path);
       if (!first.has(mapped.finding.id)) {
         first.set(mapped.finding.id, { hit: mapped, commit: change.commit });
       }
@@ -723,14 +738,20 @@ async function scanGitHistory(cwd) {
   }
   const atHead = await headSecretKeys(cwd);
   const hits = [];
-  for (const { hit, commit } of first.values()) {
-    const stillAtHead = atHead.has(`${hit.finding.ruleId}\0${hit.finding.snippet ?? ""}`);
+  for (const { hit: hit2, commit } of first.values()) {
+    const stillAtHead = atHead.has(`${hit2.finding.ruleId}\0${hit2.finding.snippet ?? ""}`);
     hits.push({
-      finding: { ...hit.finding, introducedIn: commit, stillAtHead },
-      secret: hit.secret
+      finding: { ...hit2.finding, introducedIn: commit, stillAtHead },
+      secret: hit2.secret
     });
   }
-  return { findings: hits.map((h) => h.finding), hits };
+  const scanned = Math.min(maxCommits, total);
+  const history = total > maxCommits ? `scanned ${scanned} of ${total} commits` : void 0;
+  return {
+    findings: hits.map((h) => h.finding),
+    hits,
+    ...history !== void 0 ? { history } : {}
+  };
 }
 var execFileAsync2, ZERO_HASH, MAX_BLOB, RAW_LINE;
 var init_history = __esm({
@@ -963,15 +984,15 @@ function providerFor(ruleId, secret) {
 async function verifySecretHits(hits, options = {}) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const out = [];
-  for (const hit of hits) {
-    const secret = hit.secret;
+  for (const hit2 of hits) {
+    const secret = hit2.secret;
     if (secret === void 0 || secret.length === 0) {
-      out.push({ finding: { ...hit.finding, verification: "unknown" }, secret: hit.secret });
+      out.push({ finding: { ...hit2.finding, verification: "unknown" }, secret: hit2.secret });
       continue;
     }
-    const run = providerFor(hit.finding.ruleId, secret);
+    const run = providerFor(hit2.finding.ruleId, secret);
     const verification = run === void 0 ? "unknown" : await run(secret, fetchImpl);
-    out.push({ finding: { ...hit.finding, verification }, secret: hit.secret });
+    out.push({ finding: { ...hit2.finding, verification }, secret: hit2.secret });
   }
   return out;
 }
@@ -1078,7 +1099,8 @@ function walk(node, visit) {
   }
 }
 function attachParents(node, parent) {
-  node.parent = parent;
+  const current = node;
+  if (parent !== void 0 || current.parent === void 0) current.parent = parent;
   for (const key of Object.keys(node)) {
     if (SKIP_KEYS.has(String(key))) continue;
     const value = node[key];
@@ -1151,6 +1173,11 @@ function mcpCfgEnabled() {
 function taintV2Enabled() {
   return process.env.FULLSHIELD_EXPERIMENTAL_TAINT_V2 === "1";
 }
+var DIFF_FLAG = "FULLSHIELD_EXPERIMENTAL_DIFF";
+var LICENSE_FLAG = "FULLSHIELD_EXPERIMENTAL_LICENSE";
+function licenseEnabled() {
+  return process.env[LICENSE_FLAG] === "1";
+}
 
 // src/modules/config/finding.ts
 init_finding();
@@ -1526,6 +1553,169 @@ var configModule = {
 // src/modules/deps/index.ts
 init_finding();
 
+// src/modules/deps/lockfile-modern.ts
+function addEdge(edges, from, to) {
+  if (from.length === 0 || to.length === 0 || from === to) return;
+  const list = edges.get(from) ?? /* @__PURE__ */ new Set();
+  list.add(to);
+  edges.set(from, list);
+}
+function graph(packages, edges, directProd, directDev, edgesKnown) {
+  return { packages, edges, directProd, directDev, edgesKnown };
+}
+function parseYarnBerry(contents) {
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  let current;
+  let inDeps = false;
+  let devBlock = false;
+  for (const raw of contents.split(/\r?\n/)) {
+    if (!raw.startsWith(" ") && raw.trimEnd().endsWith(":")) {
+      const key = raw.slice(0, -1).trim().replace(/^"|"$/g, "");
+      current = key.includes("@workspace:.") ? "" : nameFromBerryKey(key);
+      inDeps = false;
+      devBlock = false;
+      continue;
+    }
+    const version = /^\s+version:\s+(.+)$/.exec(raw)?.[1]?.replace(/["']/g, "").trim();
+    if (version !== void 0 && current !== void 0 && current.length > 0 && !inDeps) {
+      packages.push({ name: current, version: versionFromProtocol(version), path: `yarn:${current}` });
+      continue;
+    }
+    if (/^\s+dependencies:\s*$/.test(raw)) {
+      inDeps = true;
+      devBlock = false;
+      continue;
+    }
+    if (/^\s+devDependencies:\s*$/.test(raw)) {
+      inDeps = true;
+      devBlock = true;
+      continue;
+    }
+    if (!inDeps || current === void 0) continue;
+    const dep = /^\s{4}"?([^":]+)"?:\s+(.+)$/.exec(raw);
+    if (dep?.[1] === void 0) continue;
+    const depName = dep[1];
+    if (current.length === 0) {
+      if (devBlock) directDev.add(depName);
+      else directProd.add(depName);
+    } else {
+      addEdge(edges, current, depName);
+    }
+  }
+  return graph(packages, edges, directProd, directDev, true);
+}
+function nameFromBerryKey(key) {
+  const first = key.split(",")[0]?.trim() ?? key;
+  if (first.startsWith("@")) {
+    const match = /^(@[^@/]+\/[^@/]+)@/.exec(first);
+    return match?.[1];
+  }
+  const at = first.indexOf("@");
+  return at <= 0 ? first : first.slice(0, at);
+}
+function versionFromProtocol(raw) {
+  const patch = /^patch:(.+)#/.exec(raw);
+  const body = patch?.[1] ?? raw;
+  const npm = /^(?:npm:)?(@?[^@]+)@(.+)$/.exec(body);
+  if (npm?.[2] !== void 0) return npm[2];
+  return body;
+}
+function parsePnpmV9(contents) {
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  let block = "none";
+  let snapshot;
+  let inSnapshotDeps = false;
+  for (const raw of contents.split(/\r?\n/)) {
+    if (raw === "packages:") {
+      block = "packages";
+      snapshot = void 0;
+      continue;
+    }
+    if (raw === "snapshots:") {
+      block = "snapshots";
+      snapshot = void 0;
+      continue;
+    }
+    if (raw === "importers:" || raw.startsWith("lockfileVersion:")) {
+      block = "none";
+      continue;
+    }
+    if (block !== "snapshots" && /^\s{4}dependencies:\s*$/.test(raw)) {
+      block = "importer-deps";
+      continue;
+    }
+    if (/^\s{4}devDependencies:\s*$/.test(raw)) {
+      block = "importer-dev";
+      continue;
+    }
+    if (block === "packages") {
+      const header = /^\s{2}['"]?(@?[^@'\s]+)@([^:'"]+)['"]?:/.exec(raw);
+      if (header?.[1] !== void 0 && header[2] !== void 0) {
+        packages.push({ name: header[1], version: header[2], path: `pnpm:${header[1]}` });
+      }
+      continue;
+    }
+    if (block === "snapshots") {
+      const header = /^\s{2}['"]?(@?[^@'\s]+)@([^:'"]+)['"]?:/.exec(raw);
+      if (header?.[1] !== void 0) {
+        snapshot = header[1];
+        inSnapshotDeps = false;
+        continue;
+      }
+      if (/^\s+dependencies:\s*$/.test(raw)) {
+        inSnapshotDeps = true;
+        continue;
+      }
+      if (inSnapshotDeps && snapshot !== void 0) {
+        const dep = /^\s{6}['"]?([^'":]+)['"]?:/.exec(raw);
+        if (dep?.[1] !== void 0) addEdge(edges, snapshot, dep[1]);
+      }
+      continue;
+    }
+    if (block === "importer-deps" || block === "importer-dev") {
+      const dep = /^\s{6}['"]?([^'":]+)['"]?:/.exec(raw);
+      if (dep?.[1] !== void 0 && !raw.trim().startsWith("specifier") && !raw.trim().startsWith("version")) {
+        if (block === "importer-dev") directDev.add(dep[1]);
+        else directProd.add(dep[1]);
+      }
+    }
+  }
+  return graph(packages, edges, directProd, directDev, true);
+}
+function parseBunLock(contents) {
+  const stripped = contents.replace(/^\s*\/\/.*$/gm, "");
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  try {
+    const json = JSON.parse(stripped);
+    for (const [name, value] of Object.entries(json.packages ?? {})) {
+      if (!Array.isArray(value)) continue;
+      const entry = Array.from(value);
+      const spec = typeof entry[0] === "string" ? entry[0] : "";
+      const version = spec.includes("@") ? spec.slice(spec.lastIndexOf("@") + 1) : spec;
+      packages.push({ name, version, path: `bun:${name}` });
+      const meta = entry[1];
+      if (meta !== null && typeof meta === "object" && "dependencies" in meta) {
+        const deps = meta.dependencies;
+        if (deps !== null && typeof deps === "object") {
+          for (const dep of Object.keys(deps)) addEdge(edges, name, dep);
+        }
+      }
+    }
+  } catch {
+    return graph([], /* @__PURE__ */ new Map(), /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set(), false);
+  }
+  return graph(packages, edges, directProd, directDev, packages.length > 0);
+}
+
 // src/modules/deps/lockfile.ts
 function basename2(filename) {
   const parts = filename.replace(/\\/g, "/").split("/");
@@ -1555,7 +1745,7 @@ function objectKeys(value) {
   }
   return Object.keys(value);
 }
-function addEdge(edges, from, to) {
+function addEdge2(edges, from, to) {
   const set = edges.get(from) ?? /* @__PURE__ */ new Set();
   set.add(to);
   edges.set(from, set);
@@ -1635,7 +1825,7 @@ function parseYarnGraph(contents) {
       const depBerry = /^\s{4}(?:"([^"]+)"|(@?[\w./-]+)):/.exec(raw);
       const depName = depClassic?.[1] ?? depClassic?.[2] ?? depBerry?.[1] ?? depBerry?.[2];
       if (depName !== void 0) {
-        addEdge(edges, currentName, depName);
+        addEdge2(edges, currentName, depName);
         continue;
       }
       if (/^\s{2}\S/.test(raw)) inDeps = false;
@@ -1730,7 +1920,7 @@ function parsePnpmGraph(contents) {
         const dep = /^      (?:'([^']+)'|"([^"]+)"|([^:]+)):/.exec(raw);
         const depName = dep?.[1] ?? dep?.[2] ?? dep?.[3];
         if (depName !== void 0) {
-          addEdge(edges, currentPkg, depName);
+          addEdge2(edges, currentPkg, depName);
           continue;
         }
         if (/^    \S/.test(raw)) inPkgDeps = false;
@@ -1765,7 +1955,7 @@ function graphFromPackagesTable(packages) {
     const name = key === "" ? "" : nameFromPackagesKey(key);
     if (name === void 0 || name.length === 0) continue;
     for (const dep of [...objectKeys(value.dependencies), ...objectKeys(value.optionalDependencies)]) {
-      addEdge(edges, name, dep);
+      addEdge2(edges, name, dep);
     }
   }
   return { edges, directProd, directDev };
@@ -1775,7 +1965,7 @@ function graphFromDependenciesTree(deps, edges) {
     const child = value.dependencies;
     if (child === void 0 || typeof child !== "object" || child === null) continue;
     const nested = child;
-    for (const childName of Object.keys(nested)) addEdge(edges, name, childName);
+    for (const childName of Object.keys(nested)) addEdge2(edges, name, childName);
     graphFromDependenciesTree(nested, edges);
   }
 }
@@ -1788,8 +1978,16 @@ function parseLockfileGraph(filename, contents) {
     directDev: /* @__PURE__ */ new Set(),
     edgesKnown: false
   };
-  if (name === "yarn.lock") return parseYarnGraph(contents);
-  if (name === "pnpm-lock.yaml") return parsePnpmGraph(contents);
+  const modern = process.env.FULLSHIELD_EXPERIMENTAL_LOCKFILES === "1";
+  if (name === "yarn.lock") {
+    if (modern && contents.includes("__metadata")) return parseYarnBerry(contents);
+    return parseYarnGraph(contents);
+  }
+  if (name === "pnpm-lock.yaml") {
+    if (modern && /lockfileVersion:\s*['"]?9/.test(contents)) return parsePnpmV9(contents);
+    return parsePnpmGraph(contents);
+  }
+  if (modern && name === "bun.lock") return parseBunLock(contents);
   if (name !== "package-lock.json") return empty;
   try {
     const json = JSON.parse(contents);
@@ -1958,6 +2156,86 @@ function exactPinsFromManifest(pkg) {
   return out;
 }
 
+// src/modules/deps/evidence.ts
+var IMPORT_RE = /(?:require\(\s*['"]([^'"]+)['"]\s*\)|from\s+['"]([^'"]+)['"]|import\(\s*['"]([^'"]+)['"]\s*\))/g;
+function packageNameFromSpec(spec) {
+  if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:")) return void 0;
+  if (spec.startsWith("@")) {
+    const slash2 = spec.indexOf("/");
+    if (slash2 < 0) return void 0;
+    const rest = spec.slice(slash2 + 1);
+    const cut = rest.indexOf("/");
+    return cut === -1 ? spec : spec.slice(0, slash2 + 1 + cut);
+  }
+  const slash = spec.indexOf("/");
+  return slash === -1 ? spec : spec.slice(0, slash);
+}
+function collectImportSites(sources) {
+  const byPkg = /* @__PURE__ */ new Map();
+  const files = [...sources.keys()].sort();
+  for (const file of files) {
+    const text = sources.get(file) ?? "";
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+      const line = lines[i] ?? "";
+      IMPORT_RE.lastIndex = 0;
+      let match;
+      while ((match = IMPORT_RE.exec(line)) !== null) {
+        const spec = match[1] ?? match[2] ?? match[3];
+        if (spec === void 0) continue;
+        const pkg = packageNameFromSpec(spec);
+        if (pkg === void 0) continue;
+        const list = byPkg.get(pkg) ?? [];
+        list.push({ file, line: i + 1, specifier: spec, pkg });
+        byPkg.set(pkg, list);
+      }
+    }
+  }
+  for (const [pkg, list] of byPkg) {
+    list.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+    byPkg.set(pkg, list.slice(0, 5));
+  }
+  return byPkg;
+}
+function evidenceForFinding(finding3, sites, productionFiles, edgesKnown) {
+  if (finding3.ruleId !== "DEPS-VULN-001" && finding3.ruleId !== "DEPS-MALICIOUS-001") return void 0;
+  const snippet = finding3.snippet ?? "";
+  const at = snippet.startsWith("@") ? snippet.indexOf("@", 1) : snippet.indexOf("@");
+  const pkg = at <= 0 ? snippet : snippet.slice(0, at);
+  if (pkg.length === 0) return void 0;
+  const imports = (sites.get(pkg) ?? []).map((site) => ({
+    file: site.file,
+    line: site.line,
+    specifier: site.specifier
+  }));
+  const first = imports[0];
+  const path = finding3.dependencyPath;
+  let reason;
+  switch (finding3.reachability) {
+    case "not-imported":
+      reason = `No production file imports ${pkg}. Checked ${productionFiles.length} production file(s)${productionFiles.length > 0 ? `: ${productionFiles.slice(0, 8).join(", ")}` : ""}.`;
+      return { imports: [], reason };
+    case "reachability-unknown":
+      reason = edgesKnown ? `Reachability for ${pkg} is unknown.` : `Lockfile edges are missing, so ${pkg} is reachability-unknown.`;
+      return { imports, ...first !== void 0 ? {} : {}, reason };
+    case "reachable-via-dependency":
+      reason = path !== void 0 && path.length > 0 ? `Required through ${path.join(" > ")}.` : `Required by an imported package.`;
+      return { imports, ...path !== void 0 ? { dependencyPath: path } : {}, reason };
+    case "imported-not-called":
+      reason = first !== void 0 ? `Imported from ${first.file}:${first.line} and not called.` : `Imported and not called.`;
+      return { imports, reason };
+    case "symbol-reachable":
+      reason = first !== void 0 ? `A named vulnerable export is called from ${first.file}:${first.line}.` : `A named vulnerable export is called.`;
+      return { imports, reason };
+    case "symbol-not-called":
+      reason = `A named vulnerable export is not called.`;
+      return { imports, reason };
+    default:
+      reason = first !== void 0 ? `Imported from ${first.file}:${first.line}.` : `Imported by production code.`;
+      return { imports, ...path !== void 0 ? { dependencyPath: path } : {}, reason };
+  }
+}
+
 // src/modules/deps/reachability.ts
 init_finding();
 
@@ -2065,7 +2343,7 @@ function packageNameFromSnippet(snippet) {
   const at = snippet.indexOf("@");
   return at <= 0 ? snippet : snippet.slice(0, at);
 }
-function packageNameFromSpec(spec) {
+function packageNameFromSpec2(spec) {
   if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:")) return void 0;
   if (spec.startsWith("@")) {
     const parts = spec.split("/");
@@ -2101,7 +2379,7 @@ function indexPackageUsage(sources) {
         const local = m[1];
         const spec = m[2];
         if (local === void 0 || spec === void 0) continue;
-        const pkg = packageNameFromSpec(spec);
+        const pkg = packageNameFromSpec2(spec);
         if (pkg === void 0) continue;
         bump(pkg, localIsCalled(source, local));
       }
@@ -2111,7 +2389,7 @@ function indexPackageUsage(sources) {
     while ((named = namedRe.exec(source)) !== null) {
       const spec = named[2];
       if (spec === void 0) continue;
-      const pkg = packageNameFromSpec(spec);
+      const pkg = packageNameFromSpec2(spec);
       if (pkg === void 0) continue;
       const locals = (named[1] ?? "").split(",").map((s) => s.trim().split(/\s+as\s+/).pop() ?? "");
       bump(
@@ -2143,37 +2421,82 @@ function shortestDependencyPath(target, starts, edges) {
   }
   return void 0;
 }
+function collectDependencyPaths(target, starts, edges, limit = 8) {
+  const out = [];
+  const queue = [];
+  let steps = 0;
+  for (const start of starts) queue.push([start]);
+  while (queue.length > 0 && out.length < limit && steps < 4e3) {
+    steps += 1;
+    const path = queue.shift();
+    if (path === void 0) continue;
+    const last = path[path.length - 1];
+    if (last === void 0) continue;
+    if (last === target) {
+      if (path.length >= 2) out.push(path);
+      continue;
+    }
+    if (path.length >= 12) continue;
+    for (const next of edges.get(last) ?? []) {
+      if (path.includes(next)) continue;
+      queue.push([...path, next]);
+    }
+  }
+  return out;
+}
 function reachableFrom(target, roots, edges) {
   if (roots.has(target)) return true;
   return shortestDependencyPath(target, roots, edges) !== void 0;
 }
-function importedDirectNames(usage, graph) {
-  const directs = /* @__PURE__ */ new Set([...graph.directProd, ...graph.directDev]);
+function importedDirectNames(usage, graph2) {
+  const directs = /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]);
   const out = /* @__PURE__ */ new Set();
-  for (const [name, hit] of usage) {
-    if (!hit.imported) continue;
+  for (const [name, hit2] of usage) {
+    if (!hit2.imported) continue;
     if (directs.size === 0 || directs.has(name)) out.add(name);
   }
   return out;
 }
-function classifyReachability(pkgName, productionUsage, graph) {
-  const hit = productionUsage.get(pkgName);
-  if (hit?.imported === true) {
-    return { reachability: hit.called ? "reachable" : "imported-not-called" };
+function classifyReachability(pkgName, productionUsage, graph2) {
+  const hit2 = productionUsage.get(pkgName);
+  if (hit2?.imported === true) {
+    return { reachability: hit2.called ? "reachable" : "imported-not-called" };
   }
-  if (graph !== void 0 && graph.edgesKnown) {
-    const roots = importedDirectNames(productionUsage, graph);
-    const path = shortestDependencyPath(pkgName, roots, graph.edges);
+  if (graph2 !== void 0 && graph2.edgesKnown) {
+    const roots = importedDirectNames(productionUsage, graph2);
+    const paths = collectDependencyPaths(pkgName, roots, graph2.edges);
+    const path = paths[0];
     if (path !== void 0 && path.length >= 2) {
-      return { reachability: "reachable-via-dependency", path };
+      return { reachability: "reachable-via-dependency", path, paths };
     }
     return { reachability: "not-imported" };
   }
-  if (graph !== void 0 && !graph.edgesKnown) {
+  if (graph2 !== void 0 && !graph2.edgesKnown) {
     return { reachability: "reachability-unknown" };
   }
   return { reachability: "not-imported" };
 }
+function unusedDirectPackages(ctx) {
+  if (!ctx.graph.edgesKnown) return [];
+  const imported = importedDirectNames(ctx.productionUsage, ctx.graph);
+  return [...ctx.graph.directProd].filter((name) => {
+    if (ctx.productionUsage.get(name)?.imported === true) return false;
+    return !reachableFrom(name, imported, ctx.graph.edges);
+  }).sort();
+}
+function unusedDirectPlan(findings, ctx) {
+  const packages = unusedDirectPackages(ctx);
+  if (packages.length === 0) return void 0;
+  const names = new Set(packages);
+  let advisories = 0;
+  for (const finding3 of findings) {
+    if (finding3.ruleId !== "DEPS-VULN-001" && finding3.ruleId !== "DEPS-MALICIOUS-001") continue;
+    if (finding3.snippet === void 0) continue;
+    const pkg = packageNameFromSnippet(finding3.snippet);
+    if (pkg !== void 0 && names.has(pkg)) advisories += 1;
+  }
+  return { packages, advisories };
+}
 function reachabilitySteps(reachability) {
   if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
@@ -2195,8 +2518,108 @@ function isDevOnly(pkgName, ctx) {
   if (inProd) return false;
   return directDev.has(pkgName) || reachableFrom(pkgName, directDev, edges);
 }
+var REACH_RANK = {
+  reachable: 0,
+  "symbol-reachable": 1,
+  "reachable-via-dependency": 2,
+  "imported-not-called": 3,
+  "symbol-not-called": 4,
+  "reachability-unknown": 5,
+  "not-imported": 6
+};
+function versionFromSnippet(snippet) {
+  const name = packageNameFromSnippet(snippet);
+  if (name === void 0) return snippet;
+  return snippet.slice(name.length + 1);
+}
+function pathFields(classified) {
+  const paths = classified.paths ?? (classified.path !== void 0 ? [classified.path] : []);
+  if (paths.length === 0) return {};
+  return {
+    dependencyPath: paths[0],
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
+function appendOtherPaths(message, paths) {
+  if (paths === void 0 || paths.length < 2) return message;
+  const rest = paths.slice(1).map((p) => p.join(" > ")).join("; ");
+  return `${message} Other paths: ${rest}.`;
+}
+function groupPackageAdvisories(findings) {
+  const passthrough = [];
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding3 of findings) {
+    if (finding3.ruleId !== "DEPS-VULN-001" && finding3.ruleId !== "DEPS-MALICIOUS-001") {
+      passthrough.push(finding3);
+      continue;
+    }
+    const name = packageNameFromSnippet(finding3.snippet ?? "") ?? finding3.snippet ?? finding3.id;
+    const advisory = finding3.references?.[0] ?? finding3.id;
+    const key = `${finding3.ruleId}\0${name}\0${advisory}`;
+    const list = groups.get(key);
+    if (list === void 0) groups.set(key, [finding3]);
+    else list.push(finding3);
+  }
+  const merged = [];
+  for (const list of groups.values()) {
+    const only = list[0];
+    if (list.length === 1 && only !== void 0) {
+      merged.push(only);
+      continue;
+    }
+    merged.push(mergeAdvisory(list));
+  }
+  return [...passthrough, ...merged];
+}
+function mergeAdvisory(list) {
+  const ranked = [...list].sort(
+    (a, b) => severityRank(b.severity) - severityRank(a.severity) || (REACH_RANK[a.reachability ?? "not-imported"] ?? 9) - (REACH_RANK[b.reachability ?? "not-imported"] ?? 9)
+  );
+  const primary = ranked[0];
+  if (primary === void 0) {
+    throw new Error("empty advisory group");
+  }
+  const name = packageNameFromSnippet(primary.snippet ?? "") ?? "package";
+  const versions = [...new Set(list.map((f) => versionFromSnippet(f.snippet ?? "")))].filter((v) => v.length > 0).sort();
+  const paths = [];
+  const seenPath = /* @__PURE__ */ new Set();
+  for (const finding3 of list) {
+    const candidates = finding3.dependencyPaths ?? (finding3.dependencyPath !== void 0 ? [finding3.dependencyPath] : []);
+    for (const path of candidates) {
+      const key = path.join("\0");
+      if (seenPath.has(key)) continue;
+      seenPath.add(key);
+      paths.push(path);
+    }
+  }
+  paths.sort((a, b) => a.length - b.length || a.join(">").localeCompare(b.join(">")));
+  const advisory = primary.references?.[0] ?? "";
+  const onManifest = list.find((f) => f.file === "package.json");
+  const file = onManifest?.file ?? primary.file;
+  const line = onManifest?.line ?? primary.line;
+  const snippet = versions.length > 0 ? `${name}@${versions.join(",")}` : primary.snippet ?? name;
+  let message = primary.message;
+  if (versions.length > 1) {
+    message = `${message} Versions: ${versions.join(", ")}.`;
+  }
+  if (paths.length > 1) {
+    message = `${message} Dependency paths: ${paths.map((p) => p.join(" > ")).join("; ")}.`;
+  }
+  return {
+    ...primary,
+    id: makeFindingId(primary.ruleId, file, `${name}|${advisory}|${versions.join(",")}`),
+    file,
+    line,
+    snippet,
+    message,
+    severity: primary.severity,
+    reachability: primary.reachability,
+    ...paths[0] !== void 0 ? { dependencyPath: paths[0] } : {},
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
 function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
-  return findings.map((finding3) => {
+  const mapped = findings.map((finding3) => {
     if (finding3.ruleId === "DEPS-MALICIOUS-001") {
       if (finding3.snippet === void 0) return finding3;
       const pkg2 = packageNameFromSnippet(finding3.snippet);
@@ -2206,7 +2629,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
         ...finding3,
         severity: "critical",
         reachability: classified2.reachability,
-        ...classified2.path !== void 0 ? { dependencyPath: classified2.path } : {}
+        ...pathFields(classified2)
       };
     }
     if (finding3.ruleId !== "DEPS-VULN-001" || finding3.snippet === void 0) return finding3;
@@ -2216,7 +2639,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     const named = symbols.get(finding3.id) ?? [];
     if (named.length > 0 && ctx.sources !== void 0) {
       const symbolClass = classifySymbolUse(named, ctx.sources);
-      classified = { reachability: symbolClass, path: classified.path };
+      classified = { reachability: symbolClass, path: classified.path, paths: classified.paths };
     }
     const steps = reachabilitySteps(classified.reachability);
     let severity = steps === 0 ? finding3.severity : downgradeSeverity(finding3.severity, steps);
@@ -2224,6 +2647,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     if (classified.path !== void 0) {
       const shown = classified.path.join(" > ");
       message = `${message} Reachable via ${shown}.`;
+      message = appendOtherPaths(message, classified.paths);
     }
     const devOnly = isDevOnly(pkg, ctx);
     if (devOnly) {
@@ -2233,11 +2657,12 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     return {
       ...finding3,
       reachability: classified.reachability,
-      ...classified.path !== void 0 ? { dependencyPath: classified.path } : {},
+      ...pathFields(classified),
       severity,
       message
     };
   });
+  return groupPackageAdvisories(mapped);
 }
 
 // src/modules/deps/semver.ts
@@ -2294,6 +2719,176 @@ function osvSeverity(vuln) {
   return "high";
 }
 
+// src/modules/deps/upgrade-plan.ts
+function sentenceFor(bumps, unresolved) {
+  const parts = [];
+  if (bumps.length === 1) {
+    const bump = bumps[0];
+    if (bump !== void 0) {
+      const noun = bump.findings === 1 ? "finding" : "findings";
+      parts.push(`1 bump (${bump.name} ${bump.from} \u2192 ${bump.to}) resolves ${bump.findings} ${noun}.`);
+    }
+  } else if (bumps.length > 1) {
+    const listed = bumps.map((bump) => `${bump.name} ${bump.from} \u2192 ${bump.to}`).join(", ");
+    const total = bumps.reduce((sum, bump) => sum + bump.findings, 0);
+    const noun = total === 1 ? "finding" : "findings";
+    parts.push(`${bumps.length} bumps (${listed}) resolve ${total} ${noun}.`);
+  }
+  if (unresolved.length > 0) {
+    parts.push(`No fixed version in the OSV cache for ${unresolved.join(", ")}.`);
+  }
+  return parts.join(" ");
+}
+function chooseUpgradePlan(advisories) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const advisory of advisories) {
+    const list = byName.get(advisory.name);
+    if (list === void 0) byName.set(advisory.name, [advisory]);
+    else list.push(advisory);
+  }
+  const unresolved = [];
+  const candidates = [];
+  for (const [name, list] of byName) {
+    const from = list[0]?.from ?? "0.0.0";
+    if (list.some((advisory) => advisory.fixed === void 0)) {
+      unresolved.push(name);
+      continue;
+    }
+    let to = list[0]?.fixed;
+    for (const advisory of list) {
+      if (advisory.fixed !== void 0 && (to === void 0 || compareSemver(advisory.fixed, to) > 0)) {
+        to = advisory.fixed;
+      }
+    }
+    if (to === void 0 || compareSemver(to, from) <= 0) continue;
+    candidates.push({
+      name,
+      from,
+      to,
+      ids: list.map((advisory) => advisory.id)
+    });
+  }
+  unresolved.sort();
+  const chosen = smallestMaxCover(candidates);
+  if (chosen.length === 0 && unresolved.length === 0) return void 0;
+  const bumps = chosen.map((candidate) => ({
+    name: candidate.name,
+    from: candidate.from,
+    to: candidate.to,
+    safe: sameMajor(candidate.from, candidate.to),
+    findings: candidate.ids.length
+  }));
+  return { bumps, unresolved, sentence: sentenceFor(bumps, unresolved) };
+}
+function smallestMaxCover(candidates) {
+  const limit = Math.min(candidates.length, 12);
+  let best = [];
+  let bestCount = -1;
+  const walk2 = (index, picked, covered) => {
+    if (index === limit) {
+      if (covered.size > bestCount || covered.size === bestCount && betterTie(picked, best)) {
+        best = picked;
+        bestCount = covered.size;
+      }
+      return;
+    }
+    const next = candidates[index];
+    if (next === void 0) return;
+    walk2(index + 1, picked, covered);
+    const grown = new Set(covered);
+    for (const id of next.ids) grown.add(id);
+    walk2(index + 1, [...picked, next], grown);
+  };
+  walk2(0, [], /* @__PURE__ */ new Set());
+  return [...best].sort((a, b) => a.name.localeCompare(b.name));
+}
+function betterTie(picked, best) {
+  if (picked.length !== best.length) return picked.length < best.length;
+  const left = picked.map((item) => item.name).sort().join("\0");
+  const right = best.map((item) => item.name).sort().join("\0");
+  return left < right;
+}
+
+// src/supply/campaign.ts
+init_finding();
+var RPC_RE = /getSignaturesForAddress|eth_getLogs/;
+var NET_RE = /https\.request|http\.request|fetch\s*\(|axios\./;
+var EVAL_RE = /\beval\s*\(/;
+var STEAL_RE = /Login Data|leveldb|discord[\\/]Local Storage|wallet-extension|Ethereum\/keystore/i;
+var PLATFORM_RE = /process\.platform\s*===\s*['"]win32['"]|os\.platform\s*\(\s*\)/;
+var DOWNLOAD_RE = /https?:\/\/example\.invalid|createWriteStream|https\.get/;
+var SPAWN_RE = /child_process|spawn\s*\(|execFile\s*\(|\.exe['"]/;
+function hit(ruleId, title, message, file, severity) {
+  return {
+    id: makeFindingId(ruleId, file, message),
+    ruleId,
+    module: "deps",
+    title,
+    severity,
+    confidence: "high",
+    file,
+    message,
+    remediation: "Do not install this package. Remove it, delete node_modules, and reinstall from a clean lockfile."
+  };
+}
+function campaignFindings(files) {
+  const findings = [];
+  for (const source of files) {
+    const hasChain = RPC_RE.test(source.text);
+    const hasNet = NET_RE.test(source.text) || EVAL_RE.test(source.text);
+    if (hasChain && hasNet) {
+      findings.push(
+        hit(
+          "SUPPLY-CHAINC2-001",
+          "Package reads a blockchain RPC and then fetches or evaluates the result",
+          "static: RPC method combined with fetch or eval",
+          source.file,
+          "high"
+        )
+      );
+    }
+    const steals = STEAL_RE.test(source.text);
+    const callsNet = NET_RE.test(source.text);
+    if (steals && callsNet) {
+      findings.push(
+        hit(
+          "SUPPLY-STEALER-001",
+          "Package reads a local credential store and makes a network call",
+          "static: browser, chat, or wallet path combined with a network call",
+          source.file,
+          "critical"
+        )
+      );
+    }
+    const gated2 = PLATFORM_RE.test(source.text);
+    const downloads = DOWNLOAD_RE.test(source.text);
+    const spawns = SPAWN_RE.test(source.text);
+    if (gated2 && downloads && spawns) {
+      findings.push(
+        hit(
+          "SUPPLY-PLATFORMGATE-001",
+          "Package downloads and launches a file only on one platform",
+          "static: platform check combined with a download and a process spawn",
+          source.file,
+          "high"
+        )
+      );
+    }
+  }
+  return findings;
+}
+function securityPlaceholderFinding(name, locked, latest) {
+  if (latest !== "0.0.1-security") return void 0;
+  if (locked === "0.0.1-security") return void 0;
+  return hit(
+    "SUPPLY-SECHOLDER-001",
+    `Locked ${name}@${locked} was replaced on the registry by the security placeholder`,
+    `${name} latest is 0.0.1-security while the lockfile pins ${locked}`,
+    "package-lock.json",
+    "critical"
+  );
+}
+
 // src/modules/deps/popular.ts
 var POPULAR_PACKAGES = [
   "express",
@@ -4139,6 +4734,59 @@ function experimentalVex() {
   return process.env.FULLSHIELD_EXPERIMENTAL_VEX === "1";
 }
 
+// src/modules/deps/license.ts
+init_finding();
+var COPYLEFT = /(?:^|[^\w])(?:AGPL|GPL)(?:-|[^\w]|$)/i;
+function isCopyleftLicense(license) {
+  return COPYLEFT.test(license);
+}
+function licenseText(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && value !== null && "type" in value) {
+    const type = value.type;
+    if (typeof type === "string") return type;
+  }
+  return void 0;
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function scanCopyleftLicenses(cwd) {
+  const manifest = await readJson(join(cwd, "package.json"));
+  if (typeof manifest !== "object" || manifest === null) return [];
+  const names = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    const block = manifest[field];
+    if (typeof block === "object" && block !== null && !Array.isArray(block)) {
+      for (const name of Object.keys(block)) names.add(name);
+    }
+  }
+  const findings = [];
+  for (const name of names) {
+    const pkg = await readJson(join(cwd, "node_modules", name, "package.json"));
+    if (typeof pkg !== "object" || pkg === null) continue;
+    const license = licenseText(pkg.license);
+    if (license === void 0 || !isCopyleftLicense(license)) continue;
+    findings.push({
+      id: makeFindingId("DEPS-LICENSE-001", "package.json", `${name}|${license}`),
+      ruleId: "DEPS-LICENSE-001",
+      module: "deps",
+      title: `Copyleft dependency ${name}`,
+      severity: "medium",
+      confidence: "high",
+      file: "package.json",
+      snippet: `${name} ${license}`,
+      message: `${name} is licensed ${license}.`,
+      remediation: "Replace the dependency or get a legal review before shipping it in a commercial product."
+    });
+  }
+  return findings;
+}
+
 // src/fixer/eol.ts
 function detectEol(text) {
   return text.includes("\r\n") ? "\r\n" : "\n";
@@ -4253,7 +4901,7 @@ function walkJs(dir, out = []) {
   }
   return out;
 }
-function readJson(path) {
+function readJson2(path) {
   return JSON.parse(readFileSync(path, "utf8"));
 }
 var TOKEN_RE = /(?:~\/)?\.npmrc\b|\bNPM_TOKEN\b|\bGITHUB_TOKEN\b/;
@@ -4267,7 +4915,7 @@ function packageSources(dir) {
   let scripts = "";
   if (existsSync(manifestPath) && statSync(manifestPath).isFile()) {
     try {
-      const pkg = readJson(manifestPath);
+      const pkg = readJson2(manifestPath);
       const block = pkg.scripts ?? {};
       scripts = Object.values(block).join("\n");
     } catch {
@@ -4288,7 +4936,7 @@ ${scripts}`;
   if (!TOKEN_RE.test(text)) return [];
   const replicates = PUBLISH_RE.test(text) || REGISTRY_PUT_RE.test(text) || GITHUB_CREATE_RE.test(text) || WORKFLOW_PATH_RE.test(text);
   if (!replicates) return [];
-  const hit = sources.find(
+  const hit2 = sources.find(
     (s) => TOKEN_RE.test(s.text) && (PUBLISH_RE.test(s.text) || REGISTRY_PUT_RE.test(s.text) || GITHUB_CREATE_RE.test(s.text) || WORKFLOW_PATH_RE.test(s.text))
   ) ?? sources.find((s) => TOKEN_RE.test(s.text));
   return [
@@ -4296,7 +4944,7 @@ ${scripts}`;
       "SUPPLY-WORM-001",
       "Self-replicating worm indicators in dependency code",
       "static: npm/GitHub token read combined with publish, registry PUT, GitHub repo/workflow creation, or writing .github/workflows",
-      hit?.file,
+      hit2?.file,
       "critical"
     )
   ];
@@ -4306,13 +4954,13 @@ function analyzeWorkflowTampering(dir) {
   const text = `${sources.map((s) => s.text).join("\n")}
 ${scripts}`;
   if (!CI_WRITE_RE.test(text)) return [];
-  const hit = sources.find((s) => CI_WRITE_RE.test(s.text));
+  const hit2 = sources.find((s) => CI_WRITE_RE.test(s.text));
   return [
     finding(
       "SUPPLY-WORKFLOW-001",
       "Dependency writes GitHub workflow, git hooks, or CI config",
       "static: install script or package code writes .github/, .git/hooks/, or CI configuration",
-      hit?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
+      hit2?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
       "critical"
     )
   ];
@@ -4321,9 +4969,9 @@ function provenanceCoverage(packages, known) {
   let withProvenance = 0;
   let unknown = 0;
   for (const pkg of packages) {
-    const hit = known.get(`${pkg.name}@${pkg.version}`);
-    if (hit === true) withProvenance += 1;
-    else if (hit === void 0) unknown += 1;
+    const hit2 = known.get(`${pkg.name}@${pkg.version}`);
+    if (hit2 === true) withProvenance += 1;
+    else if (hit2 === void 0) unknown += 1;
   }
   const total = packages.length;
   return {
@@ -4350,8 +4998,8 @@ function parentsOf(name, edges) {
   }
   return out;
 }
-function isDirect(name, graph) {
-  return graph.directProd.has(name) || graph.directDev.has(name);
+function isDirect(name, graph2) {
+  return graph2.directProd.has(name) || graph2.directDev.has(name);
 }
 function packagesWithAFixedRelease(findings) {
   const names = /* @__PURE__ */ new Set();
@@ -4369,17 +5017,17 @@ function targetVersion(finding3) {
 function kindFromLockfile(lockFile) {
   return lockfileKind(lockFile) ?? "npm";
 }
-function attachOverrideProposals(findings, graph, lockFile, manifestRaw) {
-  if (!graph.edgesKnown || manifestRaw === void 0) return findings;
+function attachOverrideProposals(findings, graph2, lockFile, manifestRaw) {
+  if (!graph2.edgesKnown || manifestRaw === void 0) return findings;
   const withFix = packagesWithAFixedRelease(findings);
   const kind = kindFromLockfile(lockFile);
   return findings.map((finding3) => {
     if (finding3.ruleId !== "DEPS-VULN-001" || finding3.snippet === void 0) return finding3;
     const name = packageNameFromSnippet2(finding3.snippet);
-    if (name.length === 0 || isDirect(name, graph)) return finding3;
+    if (name.length === 0 || isDirect(name, graph2)) return finding3;
     const version = targetVersion(finding3);
     if (version === void 0) return finding3;
-    const parentFixed = parentsOf(name, graph.edges).some((parent) => withFix.has(parent));
+    const parentFixed = parentsOf(name, graph2.edges).some((parent) => withFix.has(parent));
     if (parentFixed) return finding3;
     const after = withManifestOverride(manifestRaw, kind, name, version);
     const diff = unifiedDiff("package.json", manifestRaw, after);
@@ -4400,10 +5048,10 @@ function scanInstalledPackages(cwd, packages) {
     const dir = packageDir(cwd, pkg);
     if (dir === void 0) continue;
     const prefix = pkg.path.startsWith("node_modules/") ? pkg.path : `node_modules/${pkg.name}`;
-    for (const hit of [...analyzeWormIndicators(dir), ...analyzeWorkflowTampering(dir)]) {
+    for (const hit2 of [...analyzeWormIndicators(dir), ...analyzeWorkflowTampering(dir)]) {
       out.push({
-        ...hit,
-        file: hit.file !== void 0 && hit.file.length > 0 ? `${prefix}/${hit.file}` : prefix
+        ...hit2,
+        file: hit2.file !== void 0 && hit2.file.length > 0 ? `${prefix}/${hit2.file}` : prefix
       });
     }
   }
@@ -4482,19 +5130,19 @@ function maliciousFinding(lockFile, pkg, vuln) {
     references: [vuln.id, ...vuln.aliases ?? []]
   };
 }
-function typosquatFinding(lockFile, hit) {
-  const snippet = `${hit.name}@${hit.version}`;
+function typosquatFinding(lockFile, hit2) {
+  const snippet = `${hit2.name}@${hit2.version}`;
   return {
     id: makeFindingId("DEPS-TYPOSQUAT-001", lockFile, snippet),
     ruleId: "DEPS-TYPOSQUAT-001",
     module: "deps",
-    title: `Possible typosquat: ${hit.name}`,
+    title: `Possible typosquat: ${hit2.name}`,
     severity: "medium",
     confidence: "low",
     file: lockFile,
     snippet,
-    message: `Package "${hit.name}" is 1 character from popular package "${hit.lookalike}" (possible typosquat).`,
-    remediation: `Confirm you intended to install "${hit.name}". If not, remove it and depend on "${hit.lookalike}" instead.`
+    message: `Package "${hit2.name}" is 1 character from popular package "${hit2.lookalike}" (possible typosquat).`,
+    remediation: `Confirm you intended to install "${hit2.name}". If not, remove it and depend on "${hit2.lookalike}" instead.`
   };
 }
 function noLockFinding() {
@@ -4528,6 +5176,8 @@ function deprecatedFinding(lockFile, pkg) {
 var depsModule = {
   name: "deps",
   async run(ctx) {
+    depsModule.unusedDirect = void 0;
+    depsModule.upgradePlan = void 0;
     const lockFile = LOCKFILE_NAMES.find((name) => ctx.files.includes(name));
     const cacheDir = ctx.config.deps.cacheDir !== void 0 ? resolve(ctx.cwd, ctx.config.deps.cacheDir) : defaultCacheDir();
     const osvOpts = { cacheDir, offline: ctx.config.deps.offline };
@@ -4553,21 +5203,21 @@ var depsModule = {
       }
       const pins = exactPinsFromManifest(manifest);
       const directNames2 = await readDirectDependencyNames(ctx.cwd);
-      for (const hit of findTyposquats(pins, { directNames: directNames2 })) {
-        findings2.push(typosquatFinding("package.json", hit));
+      for (const hit2 of findTyposquats(pins, { directNames: directNames2 })) {
+        findings2.push(typosquatFinding("package.json", hit2));
       }
       const osvHits2 = await queryOsv(pins, osvOpts);
       const symbols2 = /* @__PURE__ */ new Map();
-      for (const hit of osvHits2) {
-        for (const vuln of hit.vulns) {
-          const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+      for (const hit2 of osvHits2) {
+        for (const vuln of hit2.vulns) {
+          const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit2.pkg, vuln) : vulnFinding("package.json", hit2.pkg, vuln, depLoc(hit2.pkg.name));
           const names = affectedFunctionNames(vuln);
           if (names.length > 0 && finding3.ruleId === "DEPS-VULN-001") symbols2.set(finding3.id, names);
           findings2.push(finding3);
         }
       }
       const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
-      return applyReachability(findings2, noLockCtx, symbols2);
+      return withWorkspaceAdvisories(ctx.cwd, manifestRaw, osvOpts, applyReachability(findings2, noLockCtx, symbols2));
     }
     let contents;
     try {
@@ -4575,12 +5225,12 @@ var depsModule = {
     } catch {
       return [];
     }
-    const graph = parseLockfileGraph(lockFile, contents);
-    const packages = graph.packages;
+    const graph2 = parseLockfileGraph(lockFile, contents);
+    const packages = graph2.packages;
     const findings = [];
     const directNames = await readDirectDependencyNames(ctx.cwd);
-    for (const hit of findTyposquats(packages, { directNames })) {
-      findings.push(typosquatFinding(lockFile, hit));
+    for (const hit2 of findTyposquats(packages, { directNames })) {
+      findings.push(typosquatFinding(lockFile, hit2));
     }
     for (const pkg of packages) {
       if (pkg.deprecated !== void 0) {
@@ -4589,22 +5239,129 @@ var depsModule = {
     }
     const osvHits = await queryOsv(packages, osvOpts);
     const symbols = /* @__PURE__ */ new Map();
-    for (const hit of osvHits) {
-      for (const vuln of hit.vulns) {
-        const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+    for (const hit2 of osvHits) {
+      for (const vuln of hit2.vulns) {
+        const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit2.pkg, vuln) : vulnFinding(lockFile, hit2.pkg, vuln, depLoc(hit2.pkg.name));
         const names = affectedFunctionNames(vuln);
         if (names.length > 0 && finding3.ruleId === "DEPS-VULN-001") symbols.set(finding3.id, names);
         findings.push(finding3);
       }
     }
-    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
+    const reachCtx = await reachabilityCtx(ctx.cwd, ctx.files, graph2);
+    let reached = applyReachability(findings, reachCtx, symbols);
     if (experimentalVex()) {
-      reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
+      reached = attachOverrideProposals(reached, graph2, lockFile, manifestRaw);
       reached.push(...scanInstalledPackages(ctx.cwd, packages));
     }
+    if (licenseEnabled()) reached.push(...await scanCopyleftLicenses(ctx.cwd));
+    depsModule.unusedDirect = unusedDirectPlan(reached, reachCtx);
+    const direct = /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]);
+    const advisories = [];
+    for (const hit2 of osvHits) {
+      if (!direct.has(hit2.pkg.name)) continue;
+      for (const vuln of hit2.vulns) {
+        if (isMaliciousAdvisory(vuln)) continue;
+        advisories.push({
+          name: hit2.pkg.name,
+          from: hit2.pkg.version,
+          id: vuln.id,
+          fixed: minFixedVersion(vuln.affected ?? [])
+        });
+      }
+    }
+    depsModule.upgradePlan = chooseUpgradePlan(advisories);
+    if (process.env.FULLSHIELD_EXPERIMENTAL_REACH_EVIDENCE === "1") {
+      const sites = collectImportSites(reachCtx.sources);
+      const files = [...reachCtx.sources.keys()].sort();
+      reached = reached.map((finding3) => {
+        const evidence = evidenceForFinding(finding3, sites, files, graph2.edgesKnown);
+        return evidence === void 0 ? finding3 : { ...finding3, reachabilityEvidence: evidence };
+      });
+    }
+    reached = await withWorkspaceAdvisories(ctx.cwd, manifestRaw, osvOpts, reached);
+    if (process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY === "1") {
+      reached.push(...campaignFindings([...reachCtx.sources.entries()].map(([file, text]) => ({ file, text }))));
+      for (const name of [...direct].sort()) {
+        const locked = packages.find((pkg) => pkg.name === name)?.version;
+        if (locked === void 0) continue;
+        const latest = await readPlaceholderLatest(join(cacheDir, "registry", `${name.replaceAll("/", "__")}.json`));
+        const placeholder = securityPlaceholderFinding(name, locked, latest);
+        if (placeholder !== void 0) reached.push(placeholder);
+      }
+    }
     return reached;
   }
 };
+function workspacesEnabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_WORKSPACES === "1";
+}
+function workspacePatterns(manifestRaw) {
+  try {
+    const manifest = JSON.parse(manifestRaw);
+    const field = manifest.workspaces;
+    if (Array.isArray(field)) return field.filter((item) => typeof item === "string");
+    if (field !== null && typeof field === "object" && Array.isArray(field.packages)) {
+      return field.packages.filter((item) => typeof item === "string");
+    }
+  } catch {
+    return [];
+  }
+  return [];
+}
+async function expandWorkspace(cwd, pattern) {
+  const normalized = pattern.replace(/\\/g, "/").replace(/^\.\//, "");
+  if (!normalized.includes("*")) return [normalized];
+  const slash = normalized.indexOf("/*");
+  if (slash < 0) return [];
+  const parent = normalized.slice(0, slash);
+  try {
+    const entries = await readdir(join(cwd, parent), { withFileTypes: true });
+    return entries.filter((entry) => entry.isDirectory()).map((entry) => `${parent}/${entry.name}`).sort();
+  } catch {
+    return [];
+  }
+}
+async function workspaceAdvisoryFindings(cwd, manifestRaw, osvOpts) {
+  const dirs = /* @__PURE__ */ new Set();
+  for (const pattern of workspacePatterns(manifestRaw)) {
+    for (const dir of await expandWorkspace(cwd, pattern)) dirs.add(dir);
+  }
+  const findings = [];
+  for (const dir of [...dirs].sort()) {
+    if (dir === "" || dir === ".") continue;
+    const lockName = LOCKFILE_NAMES.find((name) => existsSync(join(cwd, dir, name)));
+    if (lockName === void 0) continue;
+    let text;
+    try {
+      text = await readFile(join(cwd, dir, lockName), "utf8");
+    } catch {
+      continue;
+    }
+    const graph2 = parseLockfileGraph(lockName, text);
+    const hits = await queryOsv(graph2.packages, osvOpts);
+    const file = `${dir}/${lockName}`;
+    for (const hit2 of hits) {
+      for (const vuln of hit2.vulns) {
+        findings.push(
+          isMaliciousAdvisory(vuln) ? maliciousFinding(file, hit2.pkg, vuln) : vulnFinding(file, hit2.pkg, vuln)
+        );
+      }
+    }
+  }
+  return findings;
+}
+async function withWorkspaceAdvisories(cwd, manifestRaw, osvOpts, findings) {
+  if (!workspacesEnabled() || manifestRaw === void 0) return findings;
+  return [...findings, ...await workspaceAdvisoryFindings(cwd, manifestRaw, osvOpts)];
+}
+async function readPlaceholderLatest(file) {
+  try {
+    const raw = JSON.parse(await readFile(file, "utf8"));
+    return typeof raw.latest === "string" ? raw.latest : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function graphFromManifest(manifest) {
   const keys = (field) => {
     const block = manifest[field];
@@ -4621,7 +5378,7 @@ function graphFromManifest(manifest) {
     edgesKnown: false
   };
 }
-async function reachabilityCtx(cwd, files, graph) {
+async function reachabilityCtx(cwd, files, graph2) {
   const prodSources = /* @__PURE__ */ new Map();
   for (const rel of files) {
     if (!/\.[cm]?[jt]sx?$/.test(rel)) continue;
@@ -4631,7 +5388,7 @@ async function reachabilityCtx(cwd, files, graph) {
     } catch {
     }
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
+  return { productionUsage: indexPackageUsage(prodSources), graph: graph2, sources: prodSources };
 }
 
 // src/modules/mcp/index.ts
@@ -5006,9 +5763,142 @@ init_finding();
 // src/modules/sast/interproc.ts
 init_finding();
 
-// src/modules/sast/frameworks.ts
-var NEXT_HANDLERS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
-var NEST_HTTP = /^(Get|Post|Put|Patch|Delete|All|Head|Options)$/;
+// src/runtime/lru.ts
+var LruMap = class {
+  constructor(max) {
+    this.max = max;
+    if (max < 1) throw new Error("LruMap max must be >= 1");
+  }
+  max;
+  map = /* @__PURE__ */ new Map();
+  get size() {
+    return this.map.size;
+  }
+  has(key) {
+    return this.map.has(key);
+  }
+  get(key) {
+    if (!this.map.has(key)) return void 0;
+    const value = this.map.get(key);
+    this.map.delete(key);
+    this.map.set(key, value);
+    return value;
+  }
+  set(key, value) {
+    if (this.map.has(key)) this.map.delete(key);
+    this.map.set(key, value);
+    while (this.map.size > this.max) {
+      const oldest = this.map.keys().next().value;
+      if (oldest === void 0) break;
+      this.map.delete(oldest);
+    }
+    return this;
+  }
+};
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+
+// src/core/parse-pool.ts
+var workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+var cache = new LruMap(64);
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
+  }
+  return Math.min(2, Math.max(1, availableParallelism() - 1));
+}
+function workerMemoryMb() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
+  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
+  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
+  return 512;
+}
+function parseCacheDir() {
+  return join(homedir(), ".cache", "fullshield", "parse");
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit2 = cache.get(key);
+  if (hit2 !== void 0) return Promise.resolve(hit2);
+  return new Promise((resolve5, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), {
+      workerData: { code },
+      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
+    });
+    let settled = false;
+    const finish = () => {
+      void worker.terminate();
+    };
+    const succeed = (ast) => {
+      if (settled) return;
+      settled = true;
+      cache.set(key, ast);
+      finish();
+      resolve5(ast);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      finish();
+      reject(error);
+    };
+    worker.once("message", (ast) => {
+      succeed(ast);
+    });
+    worker.once("error", (error) => {
+      fail(error);
+    });
+    worker.once("exit", (code2) => {
+      if (settled) return;
+      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
+    });
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
+
+// src/modules/sast/frameworks.ts
+var NEXT_HANDLERS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+var NEST_HTTP = /^(Get|Post|Put|Patch|Delete|All|Head|Options)$/;
 var NEST_INPUT = /^(Body|Query|Param|Headers)$/;
 var REQ_READERS = /* @__PURE__ */ new Set(["json", "formData", "text", "arrayBuffer"]);
 var HONO_READERS = /* @__PURE__ */ new Set(["query", "param", "header", "json", "parseBody", "text"]);
@@ -5141,6 +6031,10 @@ function isMcpArgsTaintSource(node) {
 }
 
 // src/modules/sast/taint.ts
+var customTaint;
+function setCustomTaint(config) {
+  customTaint = config;
+}
 var SCHEMA_ROOT = /^(z|zod|joi|yup|schema)$/i;
 function objectChainMentions(node, pattern) {
   let current = node;
@@ -5286,6 +6180,61 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
       return false;
   }
 }
+function valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners) {
+  if (node === void 0) return false;
+  if (isCoercionCall(node) || isSchemaValidatorCall(node) || isMongoSanitizeCall(node)) return false;
+  if (node.type === "Identifier") {
+    if (nosqlSanitized.has(node.name)) return false;
+    return built.has(node.name) || tainted.has(node.name);
+  }
+  if (isRequestObjectNode(node)) return true;
+  if (node.type === "AwaitExpression") {
+    return valueFeedsFilter(node.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  if (node.type === "CallExpression" && node.callee.type === "Identifier" && filterReturners.has(node.callee.name)) {
+    return true;
+  }
+  if (node.type === "ObjectExpression") {
+    return node.properties.some((prop) => {
+      if (prop.type === "SpreadElement") {
+        return valueFeedsFilter(prop.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+      }
+      if (prop.type !== "Property") return false;
+      return valueFeedsFilter(prop.value, tainted, returners, nosqlSanitized, built, filterReturners);
+    });
+  }
+  if (node.type === "ArrayExpression") {
+    return node.elements.some((el) => {
+      if (el === null) return false;
+      if (el.type === "SpreadElement") {
+        return valueFeedsFilter(el.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+      }
+      return valueFeedsFilter(el, tainted, returners, nosqlSanitized, built, filterReturners);
+    });
+  }
+  if (node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+    return node.arguments.some(
+      (arg) => arg.type !== "SpreadElement" && valueFeedsFilter(arg, tainted, returners, nosqlSanitized, built, filterReturners)
+    );
+  }
+  if (node.type === "ChainExpression" || node.type === "TSAsExpression" || node.type === "TSNonNullExpression" || node.type === "TSTypeAssertion" || node.type === "MemberExpression") {
+    return exprIsTainted(node, tainted, returners);
+  }
+  return false;
+}
+function initIsBuiltFilter(node, tainted, returners, nosqlSanitized, built, filterReturners) {
+  if (node.type === "AwaitExpression") {
+    return initIsBuiltFilter(node.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  if (node.type === "Identifier") return built.has(node.name) && !nosqlSanitized.has(node.name);
+  if (node.type === "CallExpression" && node.callee.type === "Identifier" && filterReturners.has(node.callee.name)) {
+    return true;
+  }
+  if (node.type === "ObjectExpression" || node.type === "ArrayExpression") {
+    return valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  return node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign" && valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners);
+}
 function exprIsSanitized(node, tainted, names, isCall, returners = NO_RETURNERS) {
   if (node === void 0) return true;
   if (isCall(node)) return true;
@@ -5349,7 +6298,7 @@ function seedMcpToolParams(scope, tainted) {
     for (const name of boundNames(param)) tainted.add(name);
   }
 }
-function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
+function analyzeScope(scope, seed = [], returners = NO_RETURNERS, filterReturners = NO_RETURNERS, initialBuilt = NO_RETURNERS) {
   const tainted = new Set(seed);
   seedDestructuredRequestParams(scope, tainted);
   seedFrameworkParams(scope, tainted);
@@ -5357,6 +6306,8 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
   const urlSanitized = /* @__PURE__ */ new Set();
   const xssSanitized = /* @__PURE__ */ new Set();
   const nosqlSanitized = /* @__PURE__ */ new Set();
+  const sqlCleared = /* @__PURE__ */ new Set();
+  const customPath = /* @__PURE__ */ new Set();
   let changed = true;
   while (changed) {
     changed = false;
@@ -5367,6 +6318,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
           for (const name of boundNames(node.id)) nosqlSanitized.add(name);
         }
         if (isSchemaValidatorCall(init)) return;
+        applyCustomCall(init, boundNames(node.id), tainted, sqlCleared, customPath);
         if (isUrlSanitizerCall(init)) {
           for (const name of boundNames(node.id)) urlSanitized.add(name);
         }
@@ -5387,6 +6339,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
           for (const name of boundNames(node.left)) nosqlSanitized.add(name);
         }
         if (isSchemaValidatorCall(node.right)) return;
+        applyCustomCall(node.right, boundNames(node.left), tainted, sqlCleared, customPath);
         if (isUrlSanitizerCall(node.right)) {
           for (const name of boundNames(node.left)) urlSanitized.add(name);
         }
@@ -5413,7 +6366,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
       for (const name of boundNames(node.left)) resolved.add(name);
     }
   });
-  const pathSanitized = /* @__PURE__ */ new Set();
+  const pathSanitized = new Set(customPath);
   walkScope(scope, (node) => {
     if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
     if (propName(node.callee) !== "startsWith") return;
@@ -5455,17 +6408,92 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
       for (const name of boundNames(node.left)) requestObjects.add(name);
     }
   });
+  const builtFilters = new Set(initialBuilt);
+  let grew = true;
+  while (grew) {
+    grew = false;
+    const add = (names) => {
+      for (const name of names) {
+        if (nosqlSanitized.has(name) || builtFilters.has(name)) continue;
+        builtFilters.add(name);
+        grew = true;
+      }
+    };
+    walkScope(scope, (node) => {
+      if (node.type === "VariableDeclarator" && node.init !== null) {
+        if (initIsBuiltFilter(node.init, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+          add(boundNames(node.id));
+        }
+      }
+      if (node.type !== "AssignmentExpression") return;
+      if (node.left.type === "Identifier" && initIsBuiltFilter(node.right, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+        add([node.left.name]);
+      }
+      if (node.left.type === "MemberExpression" && node.left.object.type === "Identifier" && valueFeedsFilter(node.right, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+        add([node.left.object.name]);
+      }
+    });
+  }
   return {
     tainted,
     pathSanitized,
+    sqlCleared,
     urlSanitized,
     xssSanitized,
     nosqlSanitized,
     hasPasswordName,
     requestObjects,
+    builtFilters,
+    filterReturners: new Set(filterReturners),
     returners: new Set(returners)
   };
 }
+function locallyDeclared(scope) {
+  const names = /* @__PURE__ */ new Set();
+  if (isFunctionNode(scope)) {
+    for (const param of scope.params) {
+      for (const name of boundNames(param)) names.add(name);
+    }
+  }
+  walkScope(scope, (node) => {
+    if (node.type === "VariableDeclarator") {
+      for (const name of boundNames(node.id)) names.add(name);
+    }
+    if (node.type === "FunctionDeclaration" && node.id !== null) names.add(node.id.name);
+  });
+  return names;
+}
+function inheritedBuiltFilters(fn, facts) {
+  const local = locallyDeclared(fn);
+  const inherited = /* @__PURE__ */ new Set();
+  let parent = fn.parent;
+  while (parent !== void 0 && !isFunctionNode(parent)) {
+    parent = parent.parent;
+  }
+  const outer = parent === void 0 ? void 0 : facts.get(parent);
+  if (outer === void 0) return inherited;
+  for (const name of outer.builtFilters) {
+    if (!local.has(name)) inherited.add(name);
+  }
+  return inherited;
+}
+function scopeReturnsBuiltFilter(scope, facts) {
+  let yes = false;
+  walkScope(scope, (node) => {
+    if (node.type !== "ReturnStatement" || node.argument === null) return;
+    if (initIsBuiltFilter(
+      node.argument,
+      facts.tainted,
+      facts.returners,
+      facts.nosqlSanitized,
+      facts.builtFilters,
+      facts.filterReturners
+    )) {
+      yes = true;
+    }
+  });
+  return yes;
+}
 function functionName(fn) {
   if (fn.type === "FunctionDeclaration" && fn.id !== null) return fn.id.name;
   if (isFunctionNode(fn) && fn.id !== null && fn.id.type === "Identifier") return fn.id.name;
@@ -5540,7 +6568,7 @@ function seedTaintV2(functions, facts, seeds, returners, nameToFn) {
   }
   return changed;
 }
-function analyzeFile(ast, extraReturners = NO_RETURNERS) {
+function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   attachParents(ast);
   const facts = /* @__PURE__ */ new WeakMap();
   const functions = [];
@@ -5554,12 +6582,13 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   }
   const seeds = /* @__PURE__ */ new Map();
   for (const fn of functions) seeds.set(fn, /* @__PURE__ */ new Set());
-  const returners = new Set(extraReturners);
+  const returners = new Set(extraReturners2);
+  const filterReturners = /* @__PURE__ */ new Set();
   for (let hop = 0; hop < MAX_TAINT_HOPS; hop += 1) {
     let changed = false;
-    facts.set(ast, analyzeScope(ast, [], returners));
+    facts.set(ast, analyzeScope(ast, [], returners, filterReturners));
     for (const fn of functions) {
-      facts.set(fn, analyzeScope(fn, seeds.get(fn) ?? [], returners));
+      facts.set(fn, analyzeScope(fn, seeds.get(fn) ?? [], returners, filterReturners, inheritedBuiltFilters(fn, facts)));
     }
     for (const fn of functions) {
       const name = functionName(fn);
@@ -5569,6 +6598,10 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
         returners.add(name);
         changed = true;
       }
+      if (scopeReturnsBuiltFilter(fn, f) && !filterReturners.has(name)) {
+        filterReturners.add(name);
+        changed = true;
+      }
     }
     for (const fn of functions) {
       const f = facts.get(fn);
@@ -5601,6 +6634,54 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   }
   return facts;
 }
+var SQL_SINK_NAMES = /* @__PURE__ */ new Set(["query", "execute"]);
+var CMD_SINK_NAMES = /* @__PURE__ */ new Set(["exec", "execSync", "spawn", "spawnSync"]);
+var PATH_SINK_NAMES = /* @__PURE__ */ new Set(["readFile", "readFileSync", "writeFile", "writeFileSync"]);
+function sinkClasses(scope, tainted, returners) {
+  const found = /* @__PURE__ */ new Set();
+  walkScope(scope, (node) => {
+    if (node.type !== "CallExpression") return;
+    const name = calleeName(node);
+    const first = node.arguments[0];
+    if (name === void 0 || first === void 0 || first.type === "SpreadElement") return;
+    if (!exprIsTainted(first, tainted, returners)) return;
+    if (SQL_SINK_NAMES.has(name)) found.add("sqli");
+    if (CMD_SINK_NAMES.has(name)) found.add("cmdi");
+    if (PATH_SINK_NAMES.has(name)) found.add("path");
+  });
+  return [...found].sort();
+}
+function fileTaintSummary(ast) {
+  attachParents(ast);
+  const facts = analyzeFile(ast);
+  const returnsTaint = [];
+  const functions = [];
+  walk(ast, (node) => {
+    if (!isFunctionNode(node)) return;
+    const name = functionName(node);
+    const own = facts.get(node);
+    if (name === void 0 || own === void 0) return;
+    if (scopeReturnsTaint(node, own.tainted, own.returners)) returnsTaint.push(name);
+    const paramsToReturn = [];
+    const sinks = [];
+    node.params.forEach((param, index) => {
+      const pname = boundNames(param)[0];
+      if (pname === void 0) return;
+      const seeded = analyzeScope(node, [pname]);
+      if (scopeReturnsTaint(node, seeded.tainted, seeded.returners)) paramsToReturn.push(index);
+      for (const cls of sinkClasses(node, seeded.tainted, seeded.returners)) sinks.push({ param: index, class: cls });
+    });
+    functions.push({
+      name,
+      line: node.loc?.start.line ?? 0,
+      paramsToReturn,
+      sinks
+    });
+  });
+  returnsTaint.sort();
+  functions.sort((a, b) => a.line - b.line || a.name.localeCompare(b.name));
+  return { returnsTaint, functions };
+}
 function functionsThatReturnTaint(ast) {
   attachParents(ast);
   const names = /* @__PURE__ */ new Set();
@@ -5622,18 +6703,50 @@ function factsFor(node, map) {
   return map.get(enclosingScope(node)) ?? {
     tainted: /* @__PURE__ */ new Set(),
     pathSanitized: /* @__PURE__ */ new Set(),
+    sqlCleared: /* @__PURE__ */ new Set(),
     urlSanitized: /* @__PURE__ */ new Set(),
     xssSanitized: /* @__PURE__ */ new Set(),
     nosqlSanitized: /* @__PURE__ */ new Set(),
     hasPasswordName: false,
     requestObjects: /* @__PURE__ */ new Set(),
+    builtFilters: /* @__PURE__ */ new Set(),
+    filterReturners: /* @__PURE__ */ new Set(),
     returners: /* @__PURE__ */ new Set()
   };
 }
+function nodeHoldsBuiltFilter(node, map) {
+  const facts = factsFor(node, map);
+  if (node.type === "Identifier") return facts.builtFilters.has(node.name);
+  if (node.type === "AwaitExpression") return nodeHoldsBuiltFilter(node.argument, map);
+  if (node.type === "CallExpression" && node.callee.type === "Identifier") {
+    return facts.filterReturners.has(node.callee.name);
+  }
+  return false;
+}
 function nodeIsTainted(node, map) {
   const facts = factsFor(node, map);
   return exprIsTainted(node, facts.tainted, facts.returners);
 }
+function nodeIsSqlCleared(node, map) {
+  if (node.type === "Identifier") return factsFor(node, map).sqlCleared.has(node.name);
+  return false;
+}
+function applyCustomCall(init, names, tainted, sqlCleared, customPath) {
+  if (customTaint === void 0 || init === void 0 || init.type !== "CallExpression") return;
+  const called2 = calleeName(init);
+  if (called2 === void 0) return;
+  if (customTaint.sources.has(called2)) {
+    for (const name of names) tainted.add(name);
+  }
+  const clears = customTaint.sanitizers.get(called2);
+  if (clears === void 0) return;
+  if (clears.has("sqli")) {
+    for (const name of names) sqlCleared.add(name);
+  }
+  if (clears.has("path")) {
+    for (const name of names) customPath.add(name);
+  }
+}
 function nodeIsPathSanitized(node, map) {
   if (node.type !== "Identifier") return false;
   return factsFor(node, map).pathSanitized.has(node.name);
@@ -5656,6 +6769,147 @@ function nodeIsNosqlSanitized(node, map) {
   return false;
 }
 
+// src/modules/sast/summaries.ts
+function taintSummariesEnabled() {
+  return process.env.FULLSHIELD_TAINT_SUMMARIES === "1";
+}
+var configHash = "";
+function setTaintSummaryConfig(config) {
+  fileMemo.clear();
+  if (config === void 0) {
+    configHash = "";
+    return;
+  }
+  configHash = createHash("sha256").update(
+    JSON.stringify({
+      maxFileBytes: config.sast.maxFileBytes,
+      sources: config.sast.sources ?? [],
+      sanitizers: config.sast.sanitizers ?? [],
+      taintV2: taintV2Enabled(),
+      frameworks: frameworksEnabled(),
+      gaps: sastGapsEnabled(),
+      classes: classesEnabled(),
+      custom: process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1"
+    })
+  ).digest("hex");
+}
+function summaryDir() {
+  return process.env.FULLSHIELD_TAINT_SUMMARY_DIR ?? join(parseCacheDir(), "taint");
+}
+function taintSummaryKey(source, extra = "") {
+  return createHash("sha256").update(packageVersion()).update("\0").update(configHash).update("\0").update(extra).update("\0").update(source).digest("hex");
+}
+function summaryPath(key) {
+  return join(summaryDir(), `${key}.json`);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function readJson3(key) {
+  let text;
+  try {
+    text = readFileSync(summaryPath(key), "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    discard(key);
+    return void 0;
+  }
+}
+function discard(key) {
+  rmSync(summaryPath(key), { force: true });
+}
+function writeJson(key, value) {
+  const dir = summaryDir();
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(summaryPath(key), JSON.stringify(value));
+}
+function readFileSummary(key) {
+  const raw = readJson3(key);
+  if (typeof raw !== "object" || raw === null) {
+    if (raw !== void 0) discard(key);
+    return void 0;
+  }
+  const row = raw;
+  if (row.v !== 1 || !isStringArray(row.returnsTaint) || !Array.isArray(row.functions)) {
+    discard(key);
+    return void 0;
+  }
+  return row;
+}
+var fileMemo = /* @__PURE__ */ new Map();
+function cachedReturners(source, ast) {
+  const key = taintSummaryKey(source, "file");
+  const memo = fileMemo.get(key);
+  if (memo !== void 0) return new Set(memo.returnsTaint);
+  const cached = readFileSummary(key);
+  if (cached !== void 0) {
+    fileMemo.set(key, cached);
+    return new Set(cached.returnsTaint);
+  }
+  const summary = fileTaintSummary(ast);
+  const stored = { v: 1, returnsTaint: summary.returnsTaint, functions: summary.functions };
+  fileMemo.set(key, stored);
+  writeJson(key, stored);
+  return new Set(stored.returnsTaint);
+}
+function lists(facts) {
+  const names = (set) => [...set].sort();
+  return {
+    v: 1,
+    tainted: names(facts.tainted),
+    pathSanitized: names(facts.pathSanitized),
+    sqlCleared: names(facts.sqlCleared),
+    urlSanitized: names(facts.urlSanitized),
+    xssSanitized: names(facts.xssSanitized),
+    nosqlSanitized: names(facts.nosqlSanitized),
+    requestObjects: names(facts.requestObjects),
+    builtFilters: names(facts.builtFilters),
+    filterReturners: names(facts.filterReturners),
+    returners: names(facts.returners),
+    hasPasswordName: facts.hasPasswordName
+  };
+}
+function factsFrom(row) {
+  return {
+    tainted: new Set(row.tainted),
+    pathSanitized: new Set(row.pathSanitized),
+    sqlCleared: new Set(row.sqlCleared),
+    urlSanitized: new Set(row.urlSanitized),
+    xssSanitized: new Set(row.xssSanitized),
+    nosqlSanitized: new Set(row.nosqlSanitized),
+    requestObjects: new Set(row.requestObjects),
+    builtFilters: new Set(row.builtFilters),
+    filterReturners: new Set(row.filterReturners),
+    returners: new Set(row.returners),
+    hasPasswordName: row.hasPasswordName
+  };
+}
+function readFacts(key) {
+  const raw = readJson3(key);
+  if (typeof raw !== "object" || raw === null) {
+    if (raw !== void 0) discard(key);
+    return void 0;
+  }
+  const row = raw;
+  if (row.v !== 1 || !isStringArray(row.tainted) || !isStringArray(row.pathSanitized) || !isStringArray(row.sqlCleared) || !isStringArray(row.urlSanitized) || !isStringArray(row.xssSanitized) || !isStringArray(row.nosqlSanitized) || !isStringArray(row.requestObjects) || !isStringArray(row.builtFilters) || !isStringArray(row.filterReturners) || !isStringArray(row.returners) || typeof row.hasPasswordName !== "boolean") {
+    discard(key);
+    return void 0;
+  }
+  return factsFrom(row);
+}
+function cachedFunctionFacts(fileSource, fn, seed) {
+  const key = taintSummaryKey(fileSource, `seed:${fn.loc?.start.line ?? 0}:${seed.join(",")}`);
+  const cached = readFacts(key);
+  if (cached !== void 0) return cached;
+  const facts = analyzeFunctionWithSeed(fn, seed);
+  writeJson(key, lists(facts));
+  return facts;
+}
+
 // src/modules/sast/interproc.ts
 var MAX_HOPS = 5;
 function collectFunctions(file, ast) {
@@ -5766,22 +7020,22 @@ function collectInstances(ast, ns) {
     if (node.type !== "VariableDeclarator" || node.init === null) return;
     if (node.id.type !== "Identifier" || node.init.type !== "NewExpression") return;
     if (node.init.callee.type !== "Identifier") return;
-    const hit = ns.get(node.init.callee.name);
-    if (hit === void 0) return;
-    instances.set(node.id.name, hit.includes("#") ? hit.split("#")[0] ?? hit : hit);
+    const hit2 = ns.get(node.init.callee.name);
+    if (hit2 === void 0) return;
+    instances.set(node.id.name, hit2.includes("#") ? hit2.split("#")[0] ?? hit2 : hit2);
   });
   return instances;
 }
 function resolveCallee(node, ns, instances, currentFile, functions) {
   if (node.type !== "CallExpression") return void 0;
   if (node.callee.type === "Identifier") {
-    const hit = ns.get(node.callee.name);
-    if (hit !== void 0) {
-      if (hit.includes("#")) {
-        const [file, name] = hit.split("#");
+    const hit2 = ns.get(node.callee.name);
+    if (hit2 !== void 0) {
+      if (hit2.includes("#")) {
+        const [file, name] = hit2.split("#");
         if (file !== void 0 && name !== void 0) return { file, name };
       }
-      return { file: hit, name: node.callee.name };
+      return { file: hit2, name: node.callee.name };
     }
     if (functions.has(`${currentFile}#${node.callee.name}`)) {
       return { file: currentFile, name: node.callee.name };
@@ -5888,9 +7142,9 @@ function runInterproc(parsed) {
     if (fn === void 0) continue;
     const param = fn.params[seed.paramIndex];
     if (param === void 0) continue;
-    const facts = analyzeFunctionWithSeed(fn.node, [param]);
     const p = byFile.get(fn.file);
     if (p === void 0) continue;
+    const facts = taintSummariesEnabled() ? cachedFunctionFacts(p.source, fn.node, [param]) : analyzeFunctionWithSeed(fn.node, [param]);
     const ns = requires.get(fn.file) ?? /* @__PURE__ */ new Map();
     const inst = instances.get(fn.file) ?? /* @__PURE__ */ new Map();
     walk(fn.node, (node) => {
@@ -6313,6 +7567,178 @@ var jwtRule = {
   }
 };
 
+// src/modules/sast/validation.ts
+var PRIMITIVE = /* @__PURE__ */ new Set(["string", "number", "boolean", "IsString", "IsNumber", "IsInt", "IsBoolean"]);
+var OPEN = /* @__PURE__ */ new Set(["any", "unknown", "object", "array", "record", "lazy", "union", "tuple"]);
+var SCHEMA_ROOT2 = /* @__PURE__ */ new Set(["z", "zod", "Joi", "joi"]);
+var ROUTE_METHODS = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
+function validationEnabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_VALIDATION === "1";
+}
+function parentOf(node) {
+  return node.parent;
+}
+function mentions(node, names) {
+  let current = node;
+  for (let i = 0; i < 12 && current !== void 0; i += 1) {
+    if (current.type === "CallExpression") {
+      const name = calleeName(current);
+      if (name !== void 0 && names.has(name)) return true;
+      current = current.callee.type === "MemberExpression" ? current.callee.object : void 0;
+      continue;
+    }
+    if (current.type === "MemberExpression") {
+      const name = propName(current);
+      if (name !== void 0 && names.has(name)) return true;
+      current = current.object;
+      continue;
+    }
+    if (current.type === "Identifier" && names.has(current.name)) return true;
+    break;
+  }
+  return false;
+}
+function rootName(node) {
+  let current = node;
+  for (let i = 0; i < 8 && current !== void 0; i += 1) {
+    if (current.type === "Identifier") return current.name;
+    if (current.type === "CallExpression") {
+      current = current.callee;
+      continue;
+    }
+    if (current.type === "MemberExpression") {
+      current = current.object;
+      continue;
+    }
+    break;
+  }
+  return void 0;
+}
+function propertyName(prop) {
+  if (prop.type !== "Property") return void 0;
+  const key = prop.key;
+  if (key.type === "Identifier") return key.name;
+  if (key.type === "Literal" && typeof key.value === "string") return key.value;
+  return void 0;
+}
+function fieldsOfObjectSchema(node) {
+  if (node.type !== "CallExpression" || calleeName(node) !== "object") return /* @__PURE__ */ new Set();
+  const root = rootName(node.callee);
+  if (root === void 0 || !SCHEMA_ROOT2.has(root)) return /* @__PURE__ */ new Set();
+  const arg = node.arguments[0];
+  if (arg === void 0 || arg.type !== "ObjectExpression") return /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const prop of arg.properties) {
+    if (prop.type !== "Property") continue;
+    const name = propertyName(prop);
+    if (name === void 0) continue;
+    if (mentions(prop.value, OPEN)) continue;
+    if (mentions(prop.value, PRIMITIVE)) fields.add(name);
+  }
+  return fields;
+}
+function decoratorName2(decorator) {
+  const expr = decorator.type === "Decorator" ? decorator.expression : decorator;
+  if (expr === void 0) return void 0;
+  if (expr.type === "CallExpression") return calleeName(expr);
+  if (expr.type === "Identifier") return expr.name;
+  return void 0;
+}
+function fieldsOfClass(node) {
+  if (node.type !== "ClassDeclaration" && node.type !== "ClassExpression") return /* @__PURE__ */ new Set();
+  if (node.body.type !== "ClassBody") return /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const element of node.body.body) {
+    if (element.type !== "PropertyDefinition") continue;
+    const key = element.key;
+    const name = key.type === "Identifier" ? key.name : void 0;
+    if (name === void 0) continue;
+    const decorators = element.decorators ?? [];
+    if (decorators.some((decorator) => PRIMITIVE.has(decoratorName2(decorator) ?? ""))) fields.add(name);
+  }
+  return fields;
+}
+function programOf(node) {
+  let current = node;
+  while (current !== void 0 && current.type !== "Program") current = parentOf(current);
+  return current;
+}
+function bindings(program) {
+  const map = /* @__PURE__ */ new Map();
+  walk(program, (node) => {
+    if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.init !== null && node.init !== void 0) {
+      const fields = fieldsOfObjectSchema(node.init);
+      if (fields.size > 0) map.set(node.id.name, fields);
+    }
+    if (node.type === "ClassDeclaration" && node.id !== null) {
+      const fields = fieldsOfClass(node);
+      if (fields.size > 0) map.set(node.id.name, fields);
+    }
+  });
+  return map;
+}
+var bindingCache = /* @__PURE__ */ new WeakMap();
+function fieldsOfExpr(expr, known) {
+  if (expr.type === "Identifier") return new Set(known.get(expr.name) ?? []);
+  if (expr.type === "ClassExpression" || expr.type === "ClassDeclaration") return fieldsOfClass(expr);
+  const direct = fieldsOfObjectSchema(expr);
+  if (expr.type !== "CallExpression") return direct;
+  for (const arg of expr.arguments) {
+    if (arg.type === "SpreadElement") continue;
+    for (const name of fieldsOfExpr(arg, known)) direct.add(name);
+  }
+  return direct;
+}
+function isRouteCall2(node) {
+  if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return false;
+  const method = propName(node.callee);
+  if (method === void 0 || !ROUTE_METHODS.has(method)) return false;
+  return node.callee.object.type === "Identifier" && /^(app|router)$/i.test(node.callee.object.name);
+}
+function routeOf(node) {
+  let current = node;
+  while (current !== void 0) {
+    const parent = parentOf(current);
+    if (isFunctionNode(current) && parent !== void 0 && isRouteCall2(parent)) return parent;
+    current = parent;
+  }
+  return void 0;
+}
+function requestField(node) {
+  if (node.type !== "MemberExpression" || node.computed === true) return void 0;
+  const field = node.property.type === "Identifier" ? node.property.name : void 0;
+  if (field === void 0 || node.object.type !== "MemberExpression" || node.object.computed === true) return void 0;
+  const bag = node.object.property.type === "Identifier" ? node.object.property.name : void 0;
+  if (bag !== "body" && bag !== "query" && bag !== "params") return void 0;
+  if (node.object.object.type !== "Identifier" || node.object.object.name !== "req") return void 0;
+  return field;
+}
+var routeCache = /* @__PURE__ */ new WeakMap();
+function fieldsForRoute(route) {
+  const cached = routeCache.get(route);
+  if (cached !== void 0) return cached;
+  const program = programOf(route);
+  const known = program === void 0 ? /* @__PURE__ */ new Map() : bindingCache.get(program) ?? bindings(program);
+  if (program !== void 0) bindingCache.set(program, known);
+  const fields = /* @__PURE__ */ new Set();
+  if (route.type === "CallExpression") {
+    for (const arg of route.arguments) {
+      if (arg.type === "SpreadElement" || isFunctionNode(arg)) continue;
+      for (const name of fieldsOfExpr(arg, known)) fields.add(name);
+    }
+  }
+  routeCache.set(route, fields);
+  return fields;
+}
+function isValidatedRouteField(node) {
+  if (!validationEnabled()) return false;
+  const field = requestField(node);
+  if (field === void 0) return false;
+  const route = routeOf(node);
+  if (route === void 0) return false;
+  return fieldsForRoute(route).has(field);
+}
+
 // src/modules/sast/rules/nosqli.ts
 var MONGO_SINKS = /* @__PURE__ */ new Set([
   "find",
@@ -6397,6 +7823,7 @@ function isNosqlSafeValue(node, source, isNosqlSanitized) {
   if (isNosqlSanitized(node) || isCoercionCall(node) || isSchemaValidatorCall(node) || isMongoSanitizeCall(node)) {
     return true;
   }
+  if (isValidatedRouteField(node)) return true;
   return isSanitizeWrap(node, source);
 }
 function objectHasUnsafeTaintedValue(node, isTainted, isSafe) {
@@ -6460,6 +7887,14 @@ var nosqliRule = {
           return;
         }
         if (middleware) return;
+        if (ctx.holdsBuiltFilter(filter)) {
+          ctx.report({
+            node,
+            message: "A Mongo filter built from request input is passed to the query.",
+            confidence: "medium"
+          });
+          return;
+        }
         if (objectHasUnsafeTaintedValue(filter, (n) => ctx.isTainted(n), isSafe)) {
           ctx.report({
             node,
@@ -6636,7 +8071,7 @@ var sqliRule = {
       CallExpression(node) {
         if (node.type !== "CallExpression" || !isSqlSink2(node)) return;
         const sql = node.arguments[0];
-        if (sql !== void 0 && sql.type !== "SpreadElement" && ctx.isTainted(sql)) {
+        if (sql !== void 0 && sql.type !== "SpreadElement" && ctx.isTainted(sql) && !ctx.isSqlCleared(sql)) {
           ctx.report({
             node,
             message: "Tainted input is concatenated into a SQL string passed to query/execute."
@@ -6786,27 +8221,27 @@ function numberLiteral(node) {
   return node.value;
 }
 function containsIdentMember(node, objectName) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
     if (child.type === "MemberExpression" && child.object.type === "Identifier" && child.object.name === objectName) {
-      hit = true;
+      hit2 = true;
     }
   });
-  return hit;
+  return hit2;
 }
 function containsCallNamed(node, name) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
-    if (child.type === "CallExpression" && calleeName(child) === name) hit = true;
+    if (child.type === "CallExpression" && calleeName(child) === name) hit2 = true;
   });
-  return hit;
+  return hit2;
 }
 function containsOriginalName(node) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
-    if (child.type === "MemberExpression" && propName(child) === "originalname") hit = true;
+    if (child.type === "MemberExpression" && propName(child) === "originalname") hit2 = true;
   });
-  return hit;
+  return hit2;
 }
 function schemaLooksSafe(schema) {
   if (schema === void 0) return false;
@@ -7426,72 +8861,6 @@ function scanPromptInjection(file, source) {
   });
   return findings;
 }
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
-
-// src/core/parse-pool.ts
-var workerUrl = new URL("./parse-worker.mjs", import.meta.url);
-var cache = /* @__PURE__ */ new Map();
-function parsePoolEnabled() {
-  return process.env.FULLSHIELD_PARSE_POOL === "1";
-}
-function parsePoolSize() {
-  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
-  if (raw !== void 0 && raw !== "") {
-    const parsed = Number(raw);
-    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
-  }
-  return Math.max(1, availableParallelism() - 1);
-}
-function parseCacheKey(code) {
-  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
-}
-function parseOne(code) {
-  const key = parseCacheKey(code);
-  const hit = cache.get(key);
-  if (hit !== void 0) return Promise.resolve(hit);
-  return new Promise((resolve5, reject) => {
-    const worker = new Worker(fileURLToPath(workerUrl), { workerData: { code } });
-    worker.once("message", (ast) => {
-      cache.set(key, ast);
-      resolve5(ast);
-    });
-    worker.once("error", reject);
-  });
-}
-async function parseWithPool(codes) {
-  const size = parsePoolSize();
-  const out = new Array(codes.length);
-  let next = 0;
-  async function run() {
-    for (; ; ) {
-      const index = next;
-      next += 1;
-      if (index >= codes.length) return;
-      const code = codes[index];
-      if (code === void 0) return;
-      out[index] = await parseOne(code);
-    }
-  }
-  const workers = Math.min(size, Math.max(1, codes.length));
-  await Promise.all(Array.from({ length: workers }, () => run()));
-  return out;
-}
 
 // src/modules/sast/engine.ts
 var sastRules = [
@@ -7525,8 +8894,8 @@ function snippetOf(source, node) {
   if (node.range === void 0) return "";
   return source.slice(node.range[0], node.range[1]).replace(/\s+/g, " ").trim().slice(0, 120);
 }
-function findingsFromAst(filename, source, ast, extraReturners = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
-  const facts = analyzeFile(ast, extraReturners);
+function findingsFromAst(filename, source, ast, extraReturners2 = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
+  const facts = analyzeFile(ast, extraReturners2);
   const findings = [];
   for (const rule of sastRules) {
     const ctx = {
@@ -7552,10 +8921,12 @@ function findingsFromAst(filename, source, ast, extraReturners = /* @__PURE__ */
         });
       },
       isTainted: (node) => nodeIsTainted(node, facts),
+      isSqlCleared: (node) => nodeIsSqlCleared(node, facts),
       isPathSanitized: (node) => nodeIsPathSanitized(node, facts),
       isSanitizedFor: (node, kind) => nodeIsSanitizedFor(node, facts, kind),
       isNosqlSanitized: (node) => nodeIsNosqlSanitized(node, facts),
       isRequestObject: (node) => nodeIsRequestObject(node, facts),
+      holdsBuiltFilter: (node) => nodeHoldsBuiltFilter(node, facts),
       functionHasPasswordName: (node) => factsFor(node, facts).hasPasswordName,
       assignedName: (node) => assignedNameOf(node),
       projectCsrfProtected
@@ -7593,10 +8964,12 @@ function findingsFromTemplate(filename, source) {
       });
     },
     isTainted: () => false,
+    isSqlCleared: () => false,
     isPathSanitized: () => false,
     isSanitizedFor: () => false,
     isNosqlSanitized: () => false,
     isRequestObject: () => false,
+    holdsBuiltFilter: () => false,
     functionHasPasswordName: () => false,
     assignedName: () => void 0,
     projectCsrfProtected: false
@@ -7604,52 +8977,224 @@ function findingsFromTemplate(filename, source) {
   xssRule.create(ctx);
   return findings;
 }
+function dedupeSastSinks(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const finding3 of findings) {
+    if (finding3.module !== "sast" || finding3.line === void 0) {
+      out.push(finding3);
+      continue;
+    }
+    const key = `${finding3.ruleId}\0${finding3.file ?? ""}\0${finding3.line}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(finding3);
+  }
+  return out;
+}
+function sastStreamThreshold() {
+  const raw = process.env.FULLSHIELD_SAST_STREAM_AT;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 4e3;
+}
+function sastBatchSize() {
+  const raw = process.env.FULLSHIELD_SAST_BATCH;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 150;
+}
+function skipFinding(rel, message) {
+  return {
+    id: makeFindingId("SAST-SKIP-001", rel, message),
+    ruleId: "SAST-SKIP-001",
+    module: "sast",
+    title: "File skipped by SAST",
+    severity: "info",
+    confidence: "high",
+    file: rel,
+    message,
+    remediation: "Raise sast.maxFileBytes in fullshield.config.json to parse this file, or leave it skipped."
+  };
+}
+function skipReason(source, maxBytes) {
+  if (source.includes("\0")) return "it contains NUL bytes";
+  const bytes = Buffer.byteLength(source);
+  if (bytes > maxBytes) return `${bytes} bytes exceeds the SAST parse limit of ${maxBytes} bytes`;
+  return void 0;
+}
+async function readScanSource(cwd, rel) {
+  try {
+    return await readFile(join(cwd, rel), "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function cloneAst(value) {
+  if (value === null || typeof value !== "object") return void 0;
+  try {
+    return structuredClone(value);
+  } catch {
+    return void 0;
+  }
+}
+async function parseInProcess(source) {
+  try {
+    return await parseSource(source);
+  } catch {
+    return void 0;
+  }
+}
+async function parseCode(source) {
+  if (!parsePoolEnabled()) return parseInProcess(source);
+  try {
+    const cloned = cloneAst((await parseWithPool([source]))[0]);
+    if (cloned !== void 0) return cloned;
+  } catch {
+  }
+  return parseInProcess(source);
+}
+function releaseParsed(parsed) {
+  for (const entry of parsed) {
+    entry.source = "";
+    entry.ast = void 0;
+  }
+  parsed.length = 0;
+}
+function extraReturners(rel, ast, files, returning) {
+  const ns = collectRequires(rel, ast, files);
+  const extra = new Set(returning.get(rel));
+  for (const [local, spec] of ns) {
+    const hash = spec.indexOf("#");
+    const file = hash >= 0 ? spec.slice(0, hash) : spec;
+    const exp = hash >= 0 ? spec.slice(hash + 1) : local;
+    if (returning.get(file)?.has(exp)) extra.add(local);
+  }
+  return extra;
+}
+async function runSastStreaming(ctx) {
+  const maxBytes = ctx.config.sast.maxFileBytes;
+  const findings = [];
+  const returning = /* @__PURE__ */ new Map();
+  const parseable = [];
+  const fileSet = /* @__PURE__ */ new Set();
+  let projectCsrf = false;
+  for (const rel of ctx.files) {
+    const isSource = SOURCE_EXT.test(rel);
+    const isTemplate = TEMPLATE_EXT.test(rel);
+    if (!isSource && !isTemplate) continue;
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const why = skipReason(source, maxBytes);
+    if (why !== void 0) {
+      findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+      continue;
+    }
+    if (sourceHasCsrfGuard(source)) projectCsrf = true;
+    if (isTemplate) {
+      findings.push(...findingsFromTemplate(rel, source));
+      continue;
+    }
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    returning.set(rel, taintSummariesEnabled() ? cachedReturners(source, ast) : functionsThatReturnTaint(ast));
+    parseable.push(rel);
+    fileSet.add(rel);
+  }
+  for (const rel of parseable) {
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    findings.push(
+      ...findingsFromAst(rel, source, ast, extraReturners(rel, ast, fileSet, returning), projectCsrf)
+    );
+  }
+  const batch = sastBatchSize();
+  for (let i = 0; i < parseable.length; i += batch) {
+    const parsed = [];
+    for (const rel of parseable.slice(i, i + batch)) {
+      const source = await readScanSource(ctx.cwd, rel);
+      if (source === void 0) continue;
+      const ast = await parseCode(source);
+      if (ast === void 0) continue;
+      parsed.push({ file: rel, source, ast });
+    }
+    findings.push(...runInterproc(parsed));
+    releaseParsed(parsed);
+  }
+  return dedupeSastSinks(findings);
+}
 var sastModule = {
   name: "sast",
   async run(ctx) {
-    const findings = [];
-    const parsed = [];
-    for (const rel of ctx.files) {
-      const isSource = SOURCE_EXT.test(rel);
-      const isTemplate = TEMPLATE_EXT.test(rel);
-      if (!isSource && !isTemplate) continue;
-      let source;
-      try {
-        source = await readFile(join(ctx.cwd, rel), "utf8");
-      } catch {
-        continue;
-      }
-      if (source.length > 1024 * 1024 || source.includes("\0")) continue;
-      if (isTemplate) {
-        findings.push(...findingsFromTemplate(rel, source));
-        continue;
-      }
-      try {
-        const ast = parsePoolEnabled() ? (await parseWithPool([source]))[0] : await parseSource(source);
+    if (process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1") {
+      const sources = new Set((ctx.config.sast.sources ?? []).map((row) => row.callee));
+      const sanitizers = /* @__PURE__ */ new Map();
+      for (const row of ctx.config.sast.sanitizers ?? []) {
+        const classes = sanitizers.get(row.callee) ?? /* @__PURE__ */ new Set();
+        for (const name of row.clears) classes.add(name);
+        sanitizers.set(row.callee, classes);
+      }
+      setCustomTaint({ sources, sanitizers });
+    } else {
+      setCustomTaint(void 0);
+    }
+    setTaintSummaryConfig(taintSummariesEnabled() ? ctx.config : void 0);
+    try {
+      const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
+      if (candidates.length > sastStreamThreshold()) return await runSastStreaming(ctx);
+      const maxBytes = ctx.config.sast.maxFileBytes;
+      const findings = [];
+      const parsed = [];
+      for (const rel of candidates) {
+        const source = await readScanSource(ctx.cwd, rel);
+        if (source === void 0) continue;
+        const why = skipReason(source, maxBytes);
+        if (why !== void 0) {
+          findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+          continue;
+        }
+        if (TEMPLATE_EXT.test(rel)) {
+          findings.push(...findingsFromTemplate(rel, source));
+          continue;
+        }
+        const ast = await parseCode(source);
         if (ast === void 0) continue;
         parsed.push({ file: rel, source, ast });
-      } catch {
       }
-    }
-    const files = new Set(parsed.map((p) => p.file));
-    const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
-    const returning = /* @__PURE__ */ new Map();
-    for (const p of parsed) {
-      returning.set(p.file, functionsThatReturnTaint(p.ast));
-    }
-    for (const p of parsed) {
-      const ns = collectRequires(p.file, p.ast, files);
-      const extra = new Set(returning.get(p.file));
-      for (const [local, spec] of ns) {
-        const hash = spec.indexOf("#");
-        const file = hash >= 0 ? spec.slice(0, hash) : spec;
-        const exp = hash >= 0 ? spec.slice(hash + 1) : local;
-        if (returning.get(file)?.has(exp)) extra.add(local);
+      const files = new Set(parsed.map((p) => p.file));
+      const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
+      const returning = /* @__PURE__ */ new Map();
+      for (const entry of parsed) {
+        returning.set(
+          entry.file,
+          taintSummariesEnabled() ? cachedReturners(entry.source, entry.ast) : functionsThatReturnTaint(entry.ast)
+        );
+      }
+      for (const entry of parsed) {
+        findings.push(
+          ...findingsFromAst(
+            entry.file,
+            entry.source,
+            entry.ast,
+            extraReturners(entry.file, entry.ast, files, returning),
+            projectCsrf
+          )
+        );
       }
-      findings.push(...findingsFromAst(p.file, p.source, p.ast, extra, projectCsrf));
+      findings.push(...runInterproc(parsed));
+      const out = dedupeSastSinks(findings);
+      releaseParsed(parsed);
+      return out;
+    } finally {
+      setCustomTaint(void 0);
+      setTaintSummaryConfig(void 0);
     }
-    findings.push(...runInterproc(parsed));
-    return findings;
   }
 };
 
@@ -7943,12 +9488,12 @@ ${text}`);
   const seeds = fixtureLogic(prompt);
   const findings = [];
   for (const seed of seeds) {
-    const hit = fileTexts.find((f) => f.file.includes(seed.fileHint) && f.text.includes(seed.fileHint === "user" ? "findById" : "Object.assign")) ?? fileTexts.find(
+    const hit2 = fileTexts.find((f) => f.file.includes(seed.fileHint) && f.text.includes(seed.fileHint === "user" ? "findById" : "Object.assign")) ?? fileTexts.find(
       (f) => f.text.includes(seed.ruleId === "AI-IDOR-001" ? "findById(req.params.id)" : "Object.assign(user, req.body)")
     );
-    if (hit === void 0) continue;
-    const line = hit.text.split(/\r?\n/).findIndex((l) => l.includes(seed.ruleId === "AI-IDOR-001" ? "findById" : "Object.assign")) + 1;
-    findings.push(asAiFinding(seed, hit.file, line > 0 ? line : 1));
+    if (hit2 === void 0) continue;
+    const line = hit2.text.split(/\r?\n/).findIndex((l) => l.includes(seed.ruleId === "AI-IDOR-001" ? "findById" : "Object.assign")) + 1;
+    findings.push(asAiFinding(seed, hit2.file, line > 0 ? line : 1));
   }
   return findings;
 }
@@ -8110,16 +9655,37 @@ ${wrapUntrustedCode(req.prompt)}`;
     }
   };
 }
+function isIsoDate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}(T[\d:.+\-Z]+)?$/.test(value)) return false;
+  return Number.isFinite(Date.parse(value));
+}
+function expiresAtMs(expires) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) return Date.parse(`${expires}T23:59:59.999Z`);
+  return Date.parse(expires);
+}
+function validSuppression(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const row = value;
+  if (typeof row.ruleId !== "string" || row.ruleId.length === 0) return void 0;
+  if (typeof row.owner !== "string" || row.owner.length === 0) return void 0;
+  if (typeof row.reason !== "string" || row.reason.length === 0) return void 0;
+  if (typeof row.expires !== "string" || !isIsoDate(row.expires)) return void 0;
+  const file = row.file === void 0 ? void 0 : row.file.replace(/\\/g, "/");
+  if (row.file !== void 0 && (typeof row.file !== "string" || row.file.length === 0)) return void 0;
+  return { ruleId: row.ruleId, file, owner: row.owner, reason: row.reason, expires: row.expires };
+}
 async function readBaseline(path) {
   try {
     const raw = JSON.parse(await readFile(path, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.findings)) return void 0;
+    if (raw.suppressions !== void 0 && !Array.isArray(raw.suppressions)) return void 0;
     return raw;
   } catch {
     return void 0;
   }
 }
 async function writeBaseline(path, findings) {
+  const existing = await readBaseline(path);
   const doc = {
     version: 1,
     findings: findings.map((f) => ({
@@ -8127,7 +9693,8 @@ async function writeBaseline(path, findings) {
       ruleId: f.ruleId,
       file: f.file,
       line: f.line
-    }))
+    })),
+    ...existing?.suppressions !== void 0 ? { suppressions: existing.suppressions } : {}
   };
   await writeFile(path, `${JSON.stringify(doc, null, 2)}
 `, "utf8");
@@ -8137,6 +9704,30 @@ function applyBaseline(findings, baseline) {
   const known = new Set(baseline.findings.map((f) => f.id));
   return findings.filter((f) => !known.has(f.id));
 }
+function applySuppressions(findings, rows, now = /* @__PURE__ */ new Date()) {
+  if (rows === void 0 || rows.length === 0) return { findings: [...findings], errors: [] };
+  const errors = [];
+  const active = [];
+  rows.forEach((row, index) => {
+    const parsed = validSuppression(row);
+    if (parsed === void 0) {
+      errors.push(`suppression ${index + 1} needs ruleId, owner, reason, and an ISO expires date`);
+      return;
+    }
+    if (expiresAtMs(parsed.expires) < now.getTime()) {
+      errors.push(
+        `suppression for ${parsed.ruleId} expired on ${parsed.expires} (owner: ${parsed.owner}); renew or remove it`
+      );
+      return;
+    }
+    active.push(parsed);
+  });
+  const kept = findings.filter((finding3) => {
+    const file = (finding3.file ?? "").replace(/\\/g, "/");
+    return !active.some((row) => row.ruleId === finding3.ruleId && (row.file === void 0 || row.file === file));
+  });
+  return { findings: kept, errors };
+}
 
 // src/core/config.ts
 init_finding();
@@ -8145,14 +9736,77 @@ var DEFAULT_CONFIG = {
   modules: [...MODULE_NAMES],
   failOn: "high",
   ignore: ["dist/**", "**/*.test.ts"],
+  defaultExcludes: true,
   baseline: ".fullshield-baseline.json",
   notify: { slackWebhookEnv: "FULLSHIELD_SLACK_WEBHOOK" },
   deps: { offline: false },
-  ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 }
+  ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 },
+  sast: { maxFileBytes: 1024 * 1024 }
 };
 var ConfigError = class extends Error {
 };
-var KNOWN_KEYS = /* @__PURE__ */ new Set(["modules", "failOn", "ignore", "baseline", "notify", "deps", "ai"]);
+var KNOWN_KEYS = /* @__PURE__ */ new Set([
+  "modules",
+  "failOn",
+  "ignore",
+  "defaultExcludes",
+  "excludes",
+  "baseline",
+  "notify",
+  "deps",
+  "ai",
+  "sast"
+]);
+var SAST_CLASSES = /* @__PURE__ */ new Set([
+  "sqli",
+  "nosqli",
+  "cmdi",
+  "path",
+  "xss",
+  "ssrf",
+  "redirect",
+  "eval",
+  "jwt",
+  "crypto",
+  "proto",
+  "secrets",
+  "deps",
+  "config"
+]);
+function parseSastSources(value, source) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new ConfigError(`${source}: "sast.sources" must be an array`);
+  return value.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new ConfigError(`${source}: "sast.sources" entries must be objects`);
+    }
+    const row = item;
+    if (typeof row.callee !== "string" || row.callee.length === 0) {
+      throw new ConfigError(`${source}: "sast.sources[].callee" must be a string`);
+    }
+    if (row.returns !== "tainted") {
+      throw new ConfigError(`${source}: "sast.sources[].returns" must be "tainted"`);
+    }
+    return { callee: row.callee, returns: "tainted" };
+  });
+}
+function parseSastSanitizers(value, source) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new ConfigError(`${source}: "sast.sanitizers" must be an array`);
+  return value.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new ConfigError(`${source}: "sast.sanitizers" entries must be objects`);
+    }
+    const row = item;
+    if (typeof row.callee !== "string" || row.callee.length === 0) {
+      throw new ConfigError(`${source}: "sast.sanitizers[].callee" must be a string`);
+    }
+    if (!Array.isArray(row.clears) || row.clears.some((name) => typeof name !== "string" || !SAST_CLASSES.has(name))) {
+      throw new ConfigError(`${source}: "sast.sanitizers[].clears" must be B4 class names`);
+    }
+    return { callee: row.callee, clears: row.clears.filter((name) => name !== "secrets" && name !== "deps") };
+  });
+}
 function validate(raw, source) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new ConfigError(`${source}: config must be a JSON object`);
@@ -8254,6 +9908,42 @@ function validate(raw, source) {
     }
     out.ai = ai;
   }
+  if (record.defaultExcludes !== void 0) {
+    if (typeof record.defaultExcludes !== "boolean") {
+      throw new ConfigError(`${source}: "defaultExcludes" must be a boolean`);
+    }
+    out.defaultExcludes = record.defaultExcludes;
+  }
+  if (record.excludes !== void 0) {
+    if (!Array.isArray(record.excludes) || record.excludes.some((p) => typeof p !== "string")) {
+      throw new ConfigError(`${source}: "excludes" must be an array of glob strings`);
+    }
+    out.excludes = record.excludes;
+  }
+  if (record.sast !== void 0) {
+    if (typeof record.sast !== "object" || record.sast === null || Array.isArray(record.sast)) {
+      throw new ConfigError(`${source}: "sast" must be an object`);
+    }
+    const rawSast = record.sast;
+    const sast = { maxFileBytes: 1024 * 1024 };
+    if (rawSast.maxFileBytes !== void 0) {
+      if (typeof rawSast.maxFileBytes !== "number" || rawSast.maxFileBytes < 1) {
+        throw new ConfigError(`${source}: "sast.maxFileBytes" must be a positive number`);
+      }
+      sast.maxFileBytes = rawSast.maxFileBytes;
+    }
+    const custom = process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1";
+    if (!custom && (rawSast.sources !== void 0 || rawSast.sanitizers !== void 0)) {
+      throw new ConfigError(
+        `${source}: unknown key "sast.sources" (FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS)`
+      );
+    }
+    if (custom) {
+      sast.sources = parseSastSources(rawSast.sources, source);
+      sast.sanitizers = parseSastSanitizers(rawSast.sanitizers, source);
+    }
+    out.sast = sast;
+  }
   return out;
 }
 async function loadConfig(cwd, configPath) {
@@ -8280,10 +9970,26 @@ async function loadConfig(cwd, configPath) {
   return { ...structuredClone(DEFAULT_CONFIG), ...validate(raw, file) };
 }
 var ignoreFactory = ignoreModule.default;
-var ALWAYS_IGNORED = [".git/", "node_modules/", ".fullshield/"];
+var HARD_IGNORED = [".git/", ".fullshield/"];
+var DEFAULT_EXCLUDES = [
+  "node_modules/",
+  "dist/",
+  "build/",
+  ".next/",
+  "coverage/",
+  "vendor/",
+  "vendored/",
+  "third_party/",
+  "third-party/",
+  "compiled/",
+  "*.min.js"
+];
 async function walkFiles(options) {
   const ig = ignoreFactory();
-  ig.add(ALWAYS_IGNORED);
+  ig.add(HARD_IGNORED);
+  if (options.defaultExcludes !== false) {
+    ig.add(options.excludes ?? DEFAULT_EXCLUDES);
+  }
   try {
     ig.add(await readFile(join(options.cwd, ".gitignore"), "utf8"));
   } catch {
@@ -8501,7 +10207,7 @@ function resolvePolicyBranch(cwd, env = process.env) {
     return "*";
   }
 }
-function expiresAtMs(expires) {
+function expiresAtMs2(expires) {
   if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) {
     return Date.parse(`${expires}T23:59:59.999Z`);
   }
@@ -8523,7 +10229,7 @@ function applyPolicy(findings, policy, ctx = {}) {
   });
   const suppressed = /* @__PURE__ */ new Set();
   for (const exception of policy.exceptions ?? []) {
-    if (expiresAtMs(exception.expires) < now.getTime()) {
+    if (expiresAtMs2(exception.expires) < now.getTime()) {
       errors.push(
         `policy exception for ${exception.ruleId} expired on ${exception.expires} (owner: ${exception.owner}); renew or remove it`
       );
@@ -8571,6 +10277,8 @@ function dedupe2(findings) {
 async function runScan(options = {}, modules = builtinModules) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const t0 = performance.now();
+  depsModule.unusedDirect = void 0;
+  depsModule.upgradePlan = void 0;
   const cwd = resolve(options.cwd ?? process.cwd());
   const stats = await stat(cwd).catch(() => null);
   if (stats === null || !stats.isDirectory()) {
@@ -8592,7 +10300,12 @@ async function runScan(options = {}, modules = builtinModules) {
     options.modules ?? config.modules,
     loadedPolicy?.requiredModules
   );
-  let files = await walkFiles({ cwd, ignore: config.ignore });
+  let files = await walkFiles({
+    cwd,
+    ignore: config.ignore,
+    defaultExcludes: config.defaultExcludes,
+    excludes: config.excludes
+  });
   if (options.staged === true) {
     const staged = new Set(await listStagedFiles(cwd));
     files = files.filter((file) => staged.has(file));
@@ -8626,6 +10339,7 @@ async function runScan(options = {}, modules = builtinModules) {
     );
   }
   const extraHits = [];
+  let historyNotice;
   const secretsWanted = modulesRequested.includes("secrets");
   if (secretsAdvEnabled() && secretsWanted) {
     if (options.history === true) {
@@ -8633,6 +10347,7 @@ async function runScan(options = {}, modules = builtinModules) {
       const hist = await scanGitHistory2(cwd);
       extraHits.push(...hist.hits);
       collected.push(...hist.findings);
+      historyNotice = hist.history;
     }
     if (options.bundle !== void 0 && options.bundle.length > 0) {
       const { scanBundle: scanBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
@@ -8653,13 +10368,17 @@ async function runScan(options = {}, modules = builtinModules) {
   if (options.updateBaseline === true) {
     await writeBaseline(baselinePath, unsuppressed);
   }
-  let findings = sortFindings(applyBaseline(unsuppressed, await readBaseline(baselinePath)));
+  const baselineDoc = await readBaseline(baselinePath);
+  let findings = sortFindings(applyBaseline(unsuppressed, baselineDoc));
+  const suppressed = applySuppressions(findings, baselineDoc?.suppressions);
+  findings = sortFindings(suppressed.findings);
+  const suppressionErrors = suppressed.errors;
   if (secretsAdvEnabled() && secretsWanted && options.verifySecrets === true && options.iOwnTheseCredentials === true) {
     const { applyVerification: applyVerification2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
     const { scanTextForSecretHits: scanTextForSecretHits2 } = await Promise.resolve().then(() => (init_secrets(), secrets_exports));
     const secretById = /* @__PURE__ */ new Map();
-    for (const hit of extraHits) {
-      if (hit.secret !== void 0) secretById.set(hit.finding.id, hit.secret);
+    for (const hit2 of extraHits) {
+      if (hit2.secret !== void 0) secretById.set(hit2.finding.id, hit2.secret);
     }
     for (const finding3 of findings) {
       if (finding3.module !== "secrets" || finding3.file === void 0 || secretById.has(finding3.id)) {
@@ -8673,8 +10392,8 @@ async function runScan(options = {}, modules = builtinModules) {
           continue;
         }
       }
-      for (const hit of scanTextForSecretHits2(finding3.file, text)) {
-        if (hit.secret !== void 0) secretById.set(hit.finding.id, hit.secret);
+      for (const hit2 of scanTextForSecretHits2(finding3.file, text)) {
+        if (hit2.secret !== void 0) secretById.set(hit2.finding.id, hit2.secret);
       }
     }
     findings = sortFindings(
@@ -8725,10 +10444,14 @@ async function runScan(options = {}, modules = builtinModules) {
       cwd,
       filesScanned: files.length,
       modulesRequested: [...modulesRequested],
-      modulesRun
+      modulesRun,
+      ...historyNotice !== void 0 ? { history: historyNotice } : {},
+      ...depsModule.unusedDirect !== void 0 ? { unusedDirect: depsModule.unusedDirect } : {},
+      ...depsModule.upgradePlan !== void 0 ? { upgradePlan: depsModule.upgradePlan } : {}
     },
     config,
-    policy: policyResult
+    policy: policyResult,
+    ...suppressionErrors.length > 0 ? { suppressionErrors } : {}
   };
 }
 function scan(options = {}) {
@@ -8938,6 +10661,28 @@ async function runFix(options = {}) {
     const after = applyUnifiedDiff(source, proposed.diff);
     byFile.set(sourceFile, after);
   }
+  const unused = result.metadata.unusedDirect?.packages ?? [];
+  if (unused.length > 0) {
+    let manifest = byFile.get("package.json");
+    if (manifest === void 0) {
+      try {
+        manifest = await readFile(join(cwd, "package.json"), "utf8");
+      } catch {
+        manifest = void 0;
+      }
+    }
+    if (manifest !== void 0) {
+      const next = removeDirectDependencies(manifest, unused);
+      const diff = dependencyRemovalDiff(manifest, unused);
+      if (diff.length > 0) {
+        patches.push({ file: "package.json", ruleId: "DEPS-VULN-001", safe: false, diff });
+        if (options.unsafe === true) {
+          byFile.set("package.json", next);
+          appliedOverride = true;
+        }
+      }
+    }
+  }
   const notice = appliedOverride ? "run npm install" : void 0;
   if (options.apply !== true) {
     return { applied: false, reverted: false, patches, findings: result.findings, notice };
@@ -8985,6 +10730,29 @@ async function restoreSnapshots(cwd, snapshots) {
     }
   }
 }
+function dependencyRemovalDiff(manifest, names) {
+  const drop = names.map((name) => `"${name}"`);
+  const removed = manifest.split("\n").filter((line) => drop.some((token) => line.includes(token)));
+  if (removed.length === 0) return "";
+  return ["--- a/package.json", "+++ b/package.json", ...removed.map((line) => `-${line}`)].join("\n");
+}
+function removeDirectDependencies(manifest, names) {
+  let parsed;
+  try {
+    parsed = JSON.parse(manifest);
+  } catch {
+    return manifest;
+  }
+  if (parsed.dependencies === void 0 || typeof parsed.dependencies !== "object") return manifest;
+  const drop = new Set(names);
+  const next = {};
+  for (const [name, version] of Object.entries(parsed.dependencies)) {
+    if (!drop.has(name)) next[name] = version;
+  }
+  parsed.dependencies = next;
+  const trailing = manifest.endsWith("\n") ? "\n" : "";
+  return `${JSON.stringify(parsed, null, 2)}${trailing}`;
+}
 function runProjectTests(cwd) {
   let pkg;
   try {
@@ -9064,6 +10832,27 @@ init_suppression();
 
 // src/reporters/console.ts
 init_finding();
+
+// src/reporters/redact.ts
+init_mask();
+var SECRET = /\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk_live_[A-Za-z0-9]{10,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
+function redactSecrets2(text) {
+  return text.replace(SECRET, (match) => maskSecret(match));
+}
+function redactFinding(finding3) {
+  return {
+    ...finding3,
+    title: redactSecrets2(finding3.title),
+    message: redactSecrets2(finding3.message),
+    remediation: redactSecrets2(finding3.remediation),
+    snippet: finding3.snippet === void 0 ? void 0 : redactSecrets2(finding3.snippet)
+  };
+}
+function redactScan(result) {
+  return { ...result, findings: result.findings.map(redactFinding) };
+}
+
+// src/reporters/console.ts
 var SEVERITY_COLOR = {
   critical: (t) => pc.bold(pc.red(t)),
   high: (t) => pc.red(t),
@@ -9103,7 +10892,160 @@ function renderFinding(finding3) {
   }
   return lines;
 }
-function renderConsoleReport(result) {
+var SEVERITY_RANK = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3,
+  info: 4
+};
+var SHOWN_VULN_REACH = /* @__PURE__ */ new Set([
+  "reachable",
+  "symbol-reachable",
+  "reachable-via-dependency",
+  "reachability-unknown"
+]);
+function packageNameFromSnippet3(snippet) {
+  if (snippet === void 0 || snippet.length === 0) return void 0;
+  if (snippet.startsWith("@")) {
+    const second = snippet.indexOf("@", 1);
+    return second === -1 ? snippet : snippet.slice(0, second);
+  }
+  const at = snippet.indexOf("@");
+  return at <= 0 ? snippet : snippet.slice(0, at);
+}
+function versionsFromSnippet(snippet) {
+  const name = packageNameFromSnippet3(snippet);
+  if (name === void 0 || snippet === void 0) return [];
+  const rest = snippet.slice(name.length + 1);
+  return rest.length === 0 ? [] : rest.split(",").filter((version) => version.length > 0);
+}
+function isDevOnly2(finding3) {
+  return finding3.message.includes("(dev-only)");
+}
+function isActionable(finding3) {
+  if (finding3.ruleId === "DEPS-MALICIOUS-001") return true;
+  if (finding3.ruleId === "DEPS-VULN-001") {
+    if (isDevOnly2(finding3)) return false;
+    return finding3.reachability !== void 0 && SHOWN_VULN_REACH.has(finding3.reachability);
+  }
+  if (finding3.module === "sast" || finding3.module === "secrets" || finding3.module === "config") {
+    return finding3.severity === "high" || finding3.severity === "critical" || finding3.confidence === "high";
+  }
+  return false;
+}
+function reachRank(finding3) {
+  const reachability = finding3.reachability;
+  if (reachability === "reachable" || reachability === "symbol-reachable") return 0;
+  if (reachability === "reachable-via-dependency") return 1;
+  if (reachability === "reachability-unknown") return 2;
+  if (reachability === void 0) return 4;
+  return 3;
+}
+function compareActionable(a, b) {
+  const maliciousA = a.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+  const maliciousB = b.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+  return maliciousA - maliciousB || SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || reachRank(a) - reachRank(b) || (a.file ?? "").localeCompare(b.file ?? "") || (a.line ?? 0) - (b.line ?? 0) || a.ruleId.localeCompare(b.ruleId);
+}
+function highestSeverity(findings) {
+  return findings.reduce(
+    (best, finding3) => SEVERITY_RANK[finding3.severity] < SEVERITY_RANK[best] ? finding3.severity : best,
+    findings[0]?.severity ?? "info"
+  );
+}
+function bestReachability(findings) {
+  let best;
+  let bestRank = 5;
+  for (const finding3 of findings) {
+    const rank = reachRank(finding3);
+    if (finding3.reachability !== void 0 && rank < bestRank) {
+      best = finding3.reachability;
+      bestRank = rank;
+    }
+  }
+  return best;
+}
+function shownConsoleRows(findings) {
+  return dependencyRows(findings.filter(isActionable));
+}
+function dependencyRows(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  const singles = [];
+  for (const finding3 of findings) {
+    const name = packageNameFromSnippet3(finding3.snippet);
+    if ((finding3.ruleId === "DEPS-VULN-001" || finding3.ruleId === "DEPS-MALICIOUS-001") && name !== void 0) {
+      const list = groups.get(name);
+      if (list === void 0) groups.set(name, [finding3]);
+      else list.push(finding3);
+    } else {
+      singles.push(finding3);
+    }
+  }
+  const rows = singles.map((finding3) => ({
+    findings: [finding3],
+    severity: finding3.severity,
+    reachability: finding3.reachability,
+    ruleId: finding3.ruleId,
+    file: finding3.file,
+    line: finding3.line,
+    versions: [],
+    grouped: false
+  }));
+  for (const [packageName, list] of groups) {
+    const ordered = [...list].sort(compareActionable);
+    const first = ordered[0];
+    if (first === void 0) continue;
+    const versions = [...new Set(list.flatMap((finding3) => versionsFromSnippet(finding3.snippet)))].sort();
+    const malicious = list.find((finding3) => finding3.ruleId === "DEPS-MALICIOUS-001");
+    rows.push({
+      findings: ordered,
+      severity: highestSeverity(list),
+      reachability: bestReachability(list),
+      ruleId: malicious?.ruleId ?? "DEPS-VULN-001",
+      file: first.file,
+      line: first.line,
+      packageName,
+      versions,
+      path: first.dependencyPath,
+      grouped: true
+    });
+  }
+  rows.sort((a, b) => {
+    const probeA = a.findings[0];
+    const probeB = b.findings[0];
+    if (probeA === void 0 || probeB === void 0) return 0;
+    const maliciousA = a.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+    const maliciousB = b.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+    return maliciousA - maliciousB || SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || reachRank({ ...probeA, reachability: a.reachability }) - reachRank({ ...probeB, reachability: b.reachability }) || (a.file ?? "").localeCompare(b.file ?? "") || (a.line ?? 0) - (b.line ?? 0) || a.ruleId.localeCompare(b.ruleId);
+  });
+  return rows;
+}
+function renderRow(row) {
+  if (!row.grouped) {
+    const only = row.findings[0];
+    if (only === void 0) return [];
+    return [...renderFinding(only), `    docs: rules/${only.ruleId}.md`];
+  }
+  const reach = row.reachability ?? "unspecified";
+  const lines = [
+    `  ${pc.bold(`[${row.ruleId}]`)} ${row.packageName} \u2014 ${row.findings.length} advisories, ${row.severity}, ${reach}`,
+    `    versions: ${row.versions.join(", ") || "unknown"}`
+  ];
+  if (row.path !== void 0 && row.path.length > 0) {
+    lines.push(`    path: ${row.path.join(" > ")}`);
+  }
+  if (row.file !== void 0) {
+    lines.push(`    ${row.file}${row.line !== void 0 ? `:${row.line}` : ""}`);
+  }
+  const evidenceImport = row.findings[0]?.reachabilityEvidence?.imports[0];
+  if (evidenceImport !== void 0) {
+    lines.push(`    import: ${evidenceImport.file}:${evidenceImport.line} ${evidenceImport.specifier}`);
+  }
+  lines.push(`    docs: rules/${row.ruleId}.md`);
+  return lines;
+}
+function renderConsoleReport(input, options = {}) {
+  const result = redactScan(input);
   const { findings, summary, metadata } = result;
   const lines = [];
   lines.push(
@@ -9111,34 +11053,64 @@ function renderConsoleReport(result) {
       ` \u2014 scanned ${metadata.filesScanned} files in ${metadata.durationMs}ms (modules: ${metadata.modulesRun.length > 0 ? metadata.modulesRun.join(", ") : "none"})`
     )
   );
+  if (metadata.history !== void 0) lines.push(metadata.history);
+  if (metadata.upgradePlan !== void 0 && metadata.upgradePlan.sentence.length > 0) {
+    lines.push(metadata.upgradePlan.sentence);
+  }
+  if (metadata.unusedDirect !== void 0) {
+    const count = metadata.unusedDirect.packages.length;
+    const advisories = metadata.unusedDirect.advisories;
+    const packageWord = count === 1 ? "package is" : "packages are";
+    const advisoryWord = advisories === 1 ? "advisory" : "advisories";
+    lines.push(
+      `${count} ${packageWord} never imported; removing them clears ${advisories} ${advisoryWord}.`
+    );
+  }
   if (metadata.modulesRun.length < metadata.modulesRequested.length) {
     const pending = metadata.modulesRequested.filter((m) => !metadata.modulesRun.includes(m));
     lines.push(
       pc.dim(`note: requested modules not implemented yet: ${pending.join(", ")}`)
     );
   }
-  const bySeverityDesc = [...SEVERITIES].reverse();
-  const ordered = bySeverityDesc.flatMap((severity) => findings.filter((f) => f.severity === severity));
-  const shown = ordered.slice(0, 10);
-  const hidden = ordered.length - shown.length;
-  for (const severity of bySeverityDesc) {
-    const group = shown.filter((f) => f.severity === severity);
-    if (group.length === 0) continue;
-    lines.push("");
-    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${findings.filter((f) => f.severity === severity).length})`));
-    for (const finding3 of group) {
-      lines.push(...renderFinding(finding3));
-      lines.push(`    docs: rules/${finding3.ruleId}.md`);
+  const showAll = options.all === true;
+  const folded = findings.filter((finding3) => !isActionable(finding3));
+  const rows = showAll ? [...findings].sort(compareActionable).map((finding3) => ({
+    findings: [finding3],
+    severity: finding3.severity,
+    reachability: finding3.reachability,
+    ruleId: finding3.ruleId,
+    file: finding3.file,
+    line: finding3.line,
+    versions: [],
+    grouped: false
+  })) : shownConsoleRows(findings);
+  const printed = showAll ? rows : rows.slice(0, 20);
+  const hiddenActionable = showAll ? 0 : rows.length - printed.length;
+  let previous;
+  for (const row of printed) {
+    if (row.severity !== previous) {
+      const count = printed.filter((item) => item.severity === row.severity).length;
+      lines.push("");
+      lines.push(SEVERITY_COLOR[row.severity](`${row.severity.toUpperCase()} (${count})`));
+      previous = row.severity;
     }
+    lines.push(...renderRow(row));
+  }
+  if (hiddenActionable > 0) {
+    lines.push("");
+    lines.push(`${hiddenActionable} more actionable \u2014 use --json`);
   }
-  if (hidden > 0) {
+  if (!showAll && folded.length > 0) {
     lines.push("");
-    lines.push(`${hidden} more \u2014 use --json`);
+    lines.push(
+      `${folded.length} more (not directly reachable, or below high confidence) \u2014 --all or see JSON`
+    );
   }
   lines.push("");
   if (summary.total === 0) {
     lines.push(pc.green("\u2714 No findings."));
   } else {
+    const bySeverityDesc = [...SEVERITIES].reverse();
     const counts = bySeverityDesc.filter((s) => summary.bySeverity[s] > 0).map((s) => `${summary.bySeverity[s]} ${s}`).join(", ");
     lines.push(pc.red(`\u2716 ${summary.total} finding(s): ${counts}`));
   }
@@ -9154,7 +11126,8 @@ function location2(finding3) {
   if (finding3.file === void 0) return "(project)";
   return finding3.line !== void 0 ? `${finding3.file}:${finding3.line}` : finding3.file;
 }
-function renderHtmlReport(result) {
+function renderHtmlReport(input) {
+  const result = redactScan(input);
   const sections = [];
   const bySeverityDesc = [...SEVERITIES].reverse();
   for (const severity of bySeverityDesc) {
@@ -9201,7 +11174,7 @@ ${items}`);
 
 // src/reporters/json.ts
 function publicFinding(finding3) {
-  const copy = { ...finding3 };
+  const copy = redactFinding(finding3);
   delete copy.aiVerdict;
   delete copy.exploitScenario;
   delete copy.aiReasoning;
@@ -9225,7 +11198,8 @@ function location3(finding3) {
   if (finding3.file === void 0) return "(project)";
   return finding3.line !== void 0 ? `${finding3.file}:${finding3.line}` : finding3.file;
 }
-function renderMarkdownReport(result) {
+function renderMarkdownReport(input) {
+  const result = redactScan(input);
   const lines = [
     "# FullShield report",
     "",
@@ -9267,6 +11241,14 @@ function renderMarkdownReport(result) {
   return lines.join("\n");
 }
 
+// src/core/fingerprint.ts
+init_finding();
+function lineIndependentFingerprint(finding3) {
+  const file = (finding3.file ?? "").replace(/\\/g, "/");
+  const text = (finding3.snippet ?? finding3.message ?? "").replace(/\s+/g, " ").trim();
+  return makeFindingId(finding3.ruleId, file, `${finding3.severity}\0${text}`);
+}
+
 // src/reporters/sarif.ts
 var SCHEMA_URI = "https://json.schemastore.org/sarif-2.1.0.json";
 function sarifLevel(severity) {
@@ -9277,14 +11259,37 @@ function sarifLevel(severity) {
 function uri(file) {
   return (file ?? "").replace(/\\/g, "/");
 }
-function renderSarifReport(result) {
+function sarifV2() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_SARIF_V2 === "1";
+}
+function ruleMarkdown(ruleId) {
+  const path = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "rules", `${ruleId}.md`);
+  if (!existsSync(path)) return void 0;
+  return readFileSync(path, "utf8").slice(0, 2048);
+}
+function relatedLocations(finding3) {
+  if (finding3.dependencyPath === void 0 || finding3.dependencyPath.length === 0) return void 0;
+  return finding3.dependencyPath.map((step) => ({
+    message: { text: step },
+    physicalLocation: {
+      artifactLocation: { uri: uri(finding3.file) },
+      ...finding3.line !== void 0 ? { region: { startLine: finding3.line } } : {}
+    }
+  }));
+}
+function renderSarifReport(input) {
+  const result = redactScan(input);
+  const v2 = sarifV2();
   const rules = /* @__PURE__ */ new Map();
   for (const finding3 of result.findings) {
     if (!rules.has(finding3.ruleId)) {
+      const markdown = v2 ? ruleMarkdown(finding3.ruleId) : void 0;
       rules.set(finding3.ruleId, {
         id: finding3.ruleId,
         name: finding3.ruleId,
-        shortDescription: { text: finding3.title }
+        shortDescription: { text: finding3.title },
+        ...markdown !== void 0 ? { help: { markdown } } : {},
+        ...v2 ? { properties: { precision: "unreviewed" } } : {}
       });
     }
   }
@@ -9313,6 +11318,7 @@ function renderSarifReport(result) {
               }
             }
           ] : [];
+          const related = v2 ? relatedLocations(finding3) : void 0;
           const codeFlows = finding3.trace !== void 0 && finding3.trace.length > 0 ? [
             {
               threadFlows: [
@@ -9335,7 +11341,12 @@ function renderSarifReport(result) {
             level: sarifLevel(finding3.severity),
             message: { text: finding3.message },
             locations: location4,
-            ...codeFlows !== void 0 ? { codeFlows } : {}
+            ...codeFlows !== void 0 ? { codeFlows } : {},
+            ...v2 ? {
+              partialFingerprints: { "fullshield/v1": lineIndependentFingerprint(finding3) },
+              ...related !== void 0 ? { relatedLocations: related } : {},
+              ...finding3.module === "deps" && finding3.reachability !== void 0 ? { properties: { reachability: finding3.reachability } } : {}
+            } : {}
           };
         })
       }
@@ -9384,6 +11395,249 @@ function validateSarif21(doc) {
   return errors;
 }
 
+// src/reporters/ci.ts
+init_finding();
+var MESSAGE_CAP = 4e3;
+function posix2(file) {
+  return file.replace(/\\/g, "/");
+}
+function clip(text) {
+  return text.length <= MESSAGE_CAP ? text : `${text.slice(0, MESSAGE_CAP)}\u2026`;
+}
+function githubEscape(value, property) {
+  let out = value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A").replace(/:/g, "%3A");
+  if (property) out = out.replace(/,/g, "%2C");
+  return out;
+}
+function githubLevel(severity) {
+  if (severity === "critical" || severity === "high") return "error";
+  if (severity === "medium") return "warning";
+  return "notice";
+}
+function gitlabSeverity(severity) {
+  if (severity === "info") return "info";
+  if (severity === "low") return "minor";
+  if (severity === "medium") return "major";
+  if (severity === "high") return "critical";
+  return "blocker";
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function oneLine(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function renderGithubAnnotations(input) {
+  const result = redactScan(input);
+  if (result.findings.length === 0) {
+    return "::notice title=FullShield::No findings\n";
+  }
+  const lines = result.findings.map((finding3) => {
+    const props = [];
+    if (finding3.file !== void 0) props.push(`file=${githubEscape(posix2(finding3.file), true)}`);
+    if (finding3.line !== void 0) props.push(`line=${finding3.line}`);
+    if (finding3.column !== void 0) props.push(`col=${finding3.column + 1}`);
+    props.push(`title=${githubEscape(finding3.ruleId, true)}`);
+    const message = githubEscape(clip(finding3.message), false);
+    return `::${githubLevel(finding3.severity)} ${props.join(",")}::${message}`;
+  });
+  return `${lines.join("\n")}
+`;
+}
+function junitCase(finding3) {
+  const file = finding3.file !== void 0 ? posix2(finding3.file) : "fullshield";
+  const attrs = [
+    `name="${xmlEscape(finding3.ruleId)}"`,
+    `classname="${xmlEscape(file)}"`,
+    `file="${xmlEscape(file)}"`
+  ];
+  if (finding3.line !== void 0) attrs.push(`line="${finding3.line}"`);
+  const open = `<testcase ${attrs.join(" ")}>`;
+  if (!meetsThreshold(finding3.severity, "medium")) {
+    return `${open}<skipped message="${xmlEscape(oneLine(clip(finding3.message)))}"/></testcase>`;
+  }
+  const detail = clip(`${finding3.message}${finding3.remediation.length > 0 ? `
+Fix: ${finding3.remediation}` : ""}`);
+  return `${open}<failure type="${finding3.severity}" message="${xmlEscape(oneLine(clip(finding3.message)))}">${xmlEscape(detail)}</failure></testcase>`;
+}
+function renderJunitReport(input) {
+  const result = redactScan(input);
+  const header = '<?xml version="1.0" encoding="UTF-8"?>';
+  if (result.findings.length === 0) {
+    return `${header}
+<testsuites name="fullshield" tests="1" failures="0" skipped="0"><testsuite name="fullshield" tests="1" failures="0" skipped="0"><testcase name="scan" classname="fullshield"/></testsuite></testsuites>
+`;
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding3 of result.findings) {
+    const list = groups.get(finding3.module) ?? [];
+    list.push(finding3);
+    groups.set(finding3.module, list);
+  }
+  let failures = 0;
+  let skipped = 0;
+  const suites = [];
+  for (const [name, findings] of groups) {
+    let suiteFailures = 0;
+    let suiteSkipped = 0;
+    const cases = findings.map((finding3) => {
+      if (meetsThreshold(finding3.severity, "medium")) suiteFailures += 1;
+      else suiteSkipped += 1;
+      return junitCase(finding3);
+    });
+    failures += suiteFailures;
+    skipped += suiteSkipped;
+    suites.push(
+      `<testsuite name="${xmlEscape(name)}" tests="${findings.length}" failures="${suiteFailures}" skipped="${suiteSkipped}">${cases.join("")}</testsuite>`
+    );
+  }
+  return `${header}
+<testsuites name="fullshield" tests="${result.findings.length}" failures="${failures}" skipped="${skipped}">${suites.join("")}</testsuites>
+`;
+}
+function renderGitlabCodeQuality(input) {
+  const result = redactScan(input);
+  const report = result.findings.map((finding3) => {
+    const path = finding3.file !== void 0 ? posix2(finding3.file) : ".";
+    const location4 = { path };
+    if (finding3.line !== void 0) location4.lines = { begin: finding3.line };
+    return {
+      description: clip(finding3.message),
+      check_name: finding3.ruleId,
+      fingerprint: lineIndependentFingerprint(finding3),
+      severity: gitlabSeverity(finding3.severity),
+      location: location4
+    };
+  });
+  return `${JSON.stringify(report, null, 2)}
+`;
+}
+
+// src/diff/index.ts
+init_finding();
+function posix3(file) {
+  return (file ?? "").replace(/\\/g, "/");
+}
+function diffKey(finding3) {
+  return lineIndependentFingerprint(finding3);
+}
+function groupById(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding3 of findings) {
+    if (finding3.id === void 0 || finding3.id.length === 0) continue;
+    const list = groups.get(finding3.id) ?? [];
+    list.push(finding3);
+    groups.set(finding3.id, list);
+  }
+  return groups;
+}
+function pairMoves(removed, added) {
+  const removedIds = groupById(removed);
+  const addedIds = groupById(added);
+  const moved = [];
+  for (const [id, group] of removedIds) {
+    const match = addedIds.get(id);
+    if (group.length === 1 && match?.length === 1 && group[0] !== void 0 && match[0] !== void 0) {
+      moved.push({ before: group[0], after: match[0] });
+    }
+  }
+  return moved;
+}
+function byLocation(a, b) {
+  return (a.line ?? 0) - (b.line ?? 0) || a.id.localeCompare(b.id) || a.ruleId.localeCompare(b.ruleId);
+}
+function groupFindings(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding3 of findings) {
+    const key = diffKey(finding3);
+    const list = groups.get(key) ?? [];
+    list.push(finding3);
+    groups.set(key, list);
+  }
+  return groups;
+}
+function diffScans(before, after) {
+  const beforeGroups = groupFindings(before);
+  const afterGroups = groupFindings(after);
+  const unchanged = [];
+  const added = [];
+  const removed = [];
+  const moved = [];
+  const keys = [];
+  for (const key of beforeGroups.keys()) keys.push(key);
+  for (const key of afterGroups.keys()) {
+    if (!beforeGroups.has(key)) keys.push(key);
+  }
+  for (const key of keys) {
+    const left = [...beforeGroups.get(key) ?? []].sort(byLocation);
+    const right = [...afterGroups.get(key) ?? []].sort(byLocation);
+    const paired = Math.min(left.length, right.length);
+    for (let i = 0; i < paired; i += 1) {
+      const earlier = left[i];
+      const later = right[i];
+      if (earlier === void 0 || later === void 0) continue;
+      if ((earlier.line ?? 0) === (later.line ?? 0)) unchanged.push(later);
+      else moved.push({ before: earlier, after: later });
+    }
+    for (const finding3 of left.slice(paired)) removed.push(finding3);
+    for (const finding3 of right.slice(paired)) added.push(finding3);
+  }
+  const idMoves = pairMoves(removed, added);
+  const movedBefore = new Set(idMoves.map((item) => item.before));
+  const movedAfter = new Set(idMoves.map((item) => item.after));
+  return {
+    unchanged,
+    added: added.filter((finding3) => !movedAfter.has(finding3)),
+    removed: removed.filter((finding3) => !movedBefore.has(finding3)),
+    moved: [...moved, ...idMoves]
+  };
+}
+function parseScanDocument(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error("scan JSON must be an object with a findings array or a findings array");
+  }
+  const list = Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.findings) ? parsed.findings : void 0;
+  if (list === void 0) {
+    throw new Error("scan JSON must be an object with a findings array or a findings array");
+  }
+  return list.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new Error("scan JSON finding is missing ruleId or severity");
+    }
+    const record = item;
+    const ruleId = record.ruleId;
+    const severity = record.severity;
+    if (typeof ruleId !== "string" || ruleId.length === 0 || typeof severity !== "string") {
+      throw new Error("scan JSON finding is missing ruleId or severity");
+    }
+    if (!isSeverity(severity)) {
+      throw new Error(`scan JSON finding has an unknown severity "${severity}"`);
+    }
+    if (record.line !== void 0 && (typeof record.line !== "number" || !Number.isInteger(record.line) || record.line < 0)) {
+      throw new Error("scan JSON finding line must be an integer >= 0");
+    }
+    return item;
+  });
+}
+var ADDED_CAP = 20;
+function addedLine(finding3) {
+  const where = finding3.file !== void 0 ? ` ${posix3(finding3.file)}:${finding3.line ?? 0}` : "";
+  return `${finding3.severity} ${finding3.ruleId}${where}`;
+}
+function renderDiffText(diff) {
+  const lines = [
+    `fullshield diff: unchanged ${diff.unchanged.length}, added ${diff.added.length}, removed ${diff.removed.length}, moved ${diff.moved.length}`
+  ];
+  if (diff.added.length === 0) return lines.join("\n");
+  lines.push("added:");
+  for (const finding3 of diff.added.slice(0, ADDED_CAP)) lines.push(addedLine(finding3));
+  if (diff.added.length > ADDED_CAP) lines.push(`${diff.added.length - ADDED_CAP} more \u2014 use --json`);
+  return lines.join("\n");
+}
+
 // src/sbom/cyclonedx.ts
 function validateCycloneDx15(doc) {
   const errors = [];
@@ -9396,6 +11650,16 @@ function validateCycloneDx15(doc) {
   if (!Array.isArray(root.components)) errors.push("components must be an array");
   return errors;
 }
+function reachProperties(finding3) {
+  const properties = [
+    { name: "fullshield:reachability", value: finding3.reachability ?? "unspecified" },
+    { name: "fullshield:devOnly", value: finding3.message.includes("(dev-only)") ? "true" : "false" }
+  ];
+  if (finding3.dependencyPath !== void 0 && finding3.dependencyPath.length > 0) {
+    properties.splice(1, 0, { name: "fullshield:dependencyPath", value: finding3.dependencyPath.join(" > ") });
+  }
+  return properties;
+}
 function renderCycloneDx(input) {
   const vulns = (input.findings ?? []).filter((f) => f.ruleId === "DEPS-VULN-001");
   return {
@@ -9406,13 +11670,18 @@ function renderCycloneDx(input) {
     metadata: {
       component: { type: "application", name: input.name, version: input.version }
     },
-    components: input.components.map((c) => ({
-      type: "library",
-      name: c.name,
-      version: c.version,
-      purl: c.purl ?? `pkg:npm/${encodeURIComponent(c.name)}@${c.version}`,
-      ...c.license !== void 0 ? { licenses: [{ license: { id: c.license } }] } : {}
-    })),
+    components: input.components.map((c) => {
+      const match = (input.findings ?? []).find((finding3) => finding3.snippet?.startsWith(`${c.name}@`));
+      const properties = input.includeReach === true && match !== void 0 ? reachProperties(match) : void 0;
+      return {
+        type: "library",
+        name: c.name,
+        version: c.version,
+        purl: c.purl ?? `pkg:npm/${encodeURIComponent(c.name)}@${c.version}`,
+        ...c.license !== void 0 ? { licenses: [{ license: { id: c.license } }] } : {},
+        ...properties !== void 0 ? { properties } : {}
+      };
+    }),
     vulnerabilities: vulns.map((f) => ({
       id: f.references?.find((r) => r.startsWith("GHSA-") || r.startsWith("CVE-")) ?? f.id,
       description: f.message,
@@ -9423,7 +11692,7 @@ function renderCycloneDx(input) {
 
 // src/sbom/index.ts
 var LOCKFILE_NAMES2 = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
-async function buildSbom(cwd) {
+async function buildSbom(cwd, options = {}) {
   const result = await scan({ cwd, modules: ["deps"] });
   let name = "app";
   let version = "0.0.0";
@@ -9449,7 +11718,13 @@ async function buildSbom(cwd) {
   if (components.length === 0) {
     components = exactPinsFromManifest(manifest).map((p) => ({ name: p.name, version: p.version }));
   }
-  return renderCycloneDx({ name, version, components, findings: result.findings });
+  return renderCycloneDx({
+    name,
+    version,
+    components,
+    findings: result.findings,
+    includeReach: options.includeReach === true
+  });
 }
 var OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
 var OPENVEX_NOT_AFFECTED_JUSTIFICATION = "vulnerable_code_not_in_execute_path";
@@ -9484,14 +11759,16 @@ function openVexStatement(finding3) {
     vulnerability: { name: vulnName(finding3) },
     products: [{ "@id": npmPurl(finding3.snippet) }]
   };
+  const detail = process.env.FULLSHIELD_EXPERIMENTAL_SBOM_REACH === "1" && finding3.reachabilityEvidence?.reason !== void 0 ? { detail: finding3.reachabilityEvidence.reason } : {};
   if (notImported(finding3)) {
     return {
       ...base,
       status: "not_affected",
-      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION
+      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION,
+      ...detail
     };
   }
-  return { ...base, status: "under_investigation" };
+  return { ...base, status: "under_investigation", ...detail };
 }
 function buildOpenVex(findings) {
   const statements = depFindings(findings).map(openVexStatement);
@@ -9610,4 +11887,4 @@ function buildVex(findings, format, meta = { name: "app", version: "0.0.0" }) {
   return buildOpenVex(findings);
 }
 
-export { CONFIG_FILE_NAME, ConfigError, DEFAULT_CONFIG, IMPLEMENTED_MODULES, MODULE_NAMES, POLICY_FILE_NAME, POLICY_FLAG, POLICY_PEER_ERROR, PolicyError, SEVERITIES, analyzeWorkflowTampering, analyzeWormIndicators, applyBaseline, applyInlineSuppressions, applyPolicy, buildCycloneDxVex, buildOpenVex, buildSbom, buildVex, builtinModules, createAiClient, experimentalVex, failsCi, guardTools, isInternalAi, isLiveAi, isModuleName, isPolicyEnabled, isSeverity, loadConfig, loadPolicy, makeFindingId, mcpCfgEnabled2 as mcpCfgEnabled, mcpHomeConfigPaths, meetsThreshold, packageVersion, parseIgnore, parsePolicy, provenanceCoverage, readBaseline, renderConsoleReport, renderCycloneDx, renderHtmlReport, renderJsonReport, renderMarkdownReport, renderPrSummary, renderSarifReport, ruleDocsUrl, runAiFix, runFix, runScan, scan, scanMcpConfig, scanTextForSecrets, severityRank, sortFindings, summarize, validateCycloneDx15, validateCycloneDxVex, validateOpenVex, validateSarif21, walkFiles, writeBaseline };
+export { CONFIG_FILE_NAME, ConfigError, DEFAULT_CONFIG, DIFF_FLAG, IMPLEMENTED_MODULES, MODULE_NAMES, POLICY_FILE_NAME, POLICY_FLAG, POLICY_PEER_ERROR, PolicyError, SEVERITIES, analyzeWorkflowTampering, analyzeWormIndicators, applyBaseline, applyInlineSuppressions, applyPolicy, buildCycloneDxVex, buildOpenVex, buildSbom, buildVex, builtinModules, createAiClient, diffScans, experimentalVex, failsCi, guardTools, isInternalAi, isLiveAi, isModuleName, isPolicyEnabled, isSeverity, loadConfig, loadPolicy, makeFindingId, mcpCfgEnabled2 as mcpCfgEnabled, mcpHomeConfigPaths, meetsThreshold, packageVersion, parseIgnore, parsePolicy, parseScanDocument, provenanceCoverage, readBaseline, renderConsoleReport, renderCycloneDx, renderDiffText, renderGithubAnnotations, renderGitlabCodeQuality, renderHtmlReport, renderJsonReport, renderJunitReport, renderMarkdownReport, renderPrSummary, renderSarifReport, ruleDocsUrl, runAiFix, runFix, runScan, scan, scanMcpConfig, scanTextForSecrets, severityRank, sortFindings, summarize, validateCycloneDx15, validateCycloneDxVex, validateOpenVex, validateSarif21, walkFiles, writeBaseline };