fullshield 0.3.0 → 0.4.0

package/dist/cli/index.js

@@ -645,6 +645,173 @@ var init_config = __esm({
   }
 });
 
+// src/modules/deps/lockfile-modern.ts
+function addEdge(edges, from, to) {
+  if (from.length === 0 || to.length === 0 || from === to) return;
+  const list = edges.get(from) ?? /* @__PURE__ */ new Set();
+  list.add(to);
+  edges.set(from, list);
+}
+function graph(packages, edges, directProd, directDev, edgesKnown) {
+  return { packages, edges, directProd, directDev, edgesKnown };
+}
+function parseYarnBerry(contents) {
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  let current;
+  let inDeps = false;
+  let devBlock = false;
+  for (const raw of contents.split(/\r?\n/)) {
+    if (!raw.startsWith(" ") && raw.trimEnd().endsWith(":")) {
+      const key = raw.slice(0, -1).trim().replace(/^"|"$/g, "");
+      current = key.includes("@workspace:.") ? "" : nameFromBerryKey(key);
+      inDeps = false;
+      devBlock = false;
+      continue;
+    }
+    const version = /^\s+version:\s+(.+)$/.exec(raw)?.[1]?.replace(/["']/g, "").trim();
+    if (version !== void 0 && current !== void 0 && current.length > 0 && !inDeps) {
+      packages.push({ name: current, version: versionFromProtocol(version), path: `yarn:${current}` });
+      continue;
+    }
+    if (/^\s+dependencies:\s*$/.test(raw)) {
+      inDeps = true;
+      devBlock = false;
+      continue;
+    }
+    if (/^\s+devDependencies:\s*$/.test(raw)) {
+      inDeps = true;
+      devBlock = true;
+      continue;
+    }
+    if (!inDeps || current === void 0) continue;
+    const dep = /^\s{4}"?([^":]+)"?:\s+(.+)$/.exec(raw);
+    if (dep?.[1] === void 0) continue;
+    const depName = dep[1];
+    if (current.length === 0) {
+      if (devBlock) directDev.add(depName);
+      else directProd.add(depName);
+    } else {
+      addEdge(edges, current, depName);
+    }
+  }
+  return graph(packages, edges, directProd, directDev, true);
+}
+function nameFromBerryKey(key) {
+  const first = key.split(",")[0]?.trim() ?? key;
+  if (first.startsWith("@")) {
+    const match = /^(@[^@/]+\/[^@/]+)@/.exec(first);
+    return match?.[1];
+  }
+  const at = first.indexOf("@");
+  return at <= 0 ? first : first.slice(0, at);
+}
+function versionFromProtocol(raw) {
+  const patch = /^patch:(.+)#/.exec(raw);
+  const body = patch?.[1] ?? raw;
+  const npm = /^(?:npm:)?(@?[^@]+)@(.+)$/.exec(body);
+  if (npm?.[2] !== void 0) return npm[2];
+  return body;
+}
+function parsePnpmV9(contents) {
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  let block = "none";
+  let snapshot;
+  let inSnapshotDeps = false;
+  for (const raw of contents.split(/\r?\n/)) {
+    if (raw === "packages:") {
+      block = "packages";
+      snapshot = void 0;
+      continue;
+    }
+    if (raw === "snapshots:") {
+      block = "snapshots";
+      snapshot = void 0;
+      continue;
+    }
+    if (raw === "importers:" || raw.startsWith("lockfileVersion:")) {
+      block = "none";
+      continue;
+    }
+    if (block !== "snapshots" && /^\s{4}dependencies:\s*$/.test(raw)) {
+      block = "importer-deps";
+      continue;
+    }
+    if (/^\s{4}devDependencies:\s*$/.test(raw)) {
+      block = "importer-dev";
+      continue;
+    }
+    if (block === "packages") {
+      const header = /^\s{2}['"]?(@?[^@'\s]+)@([^:'"]+)['"]?:/.exec(raw);
+      if (header?.[1] !== void 0 && header[2] !== void 0) {
+        packages.push({ name: header[1], version: header[2], path: `pnpm:${header[1]}` });
+      }
+      continue;
+    }
+    if (block === "snapshots") {
+      const header = /^\s{2}['"]?(@?[^@'\s]+)@([^:'"]+)['"]?:/.exec(raw);
+      if (header?.[1] !== void 0) {
+        snapshot = header[1];
+        inSnapshotDeps = false;
+        continue;
+      }
+      if (/^\s+dependencies:\s*$/.test(raw)) {
+        inSnapshotDeps = true;
+        continue;
+      }
+      if (inSnapshotDeps && snapshot !== void 0) {
+        const dep = /^\s{6}['"]?([^'":]+)['"]?:/.exec(raw);
+        if (dep?.[1] !== void 0) addEdge(edges, snapshot, dep[1]);
+      }
+      continue;
+    }
+    if (block === "importer-deps" || block === "importer-dev") {
+      const dep = /^\s{6}['"]?([^'":]+)['"]?:/.exec(raw);
+      if (dep?.[1] !== void 0 && !raw.trim().startsWith("specifier") && !raw.trim().startsWith("version")) {
+        if (block === "importer-dev") directDev.add(dep[1]);
+        else directProd.add(dep[1]);
+      }
+    }
+  }
+  return graph(packages, edges, directProd, directDev, true);
+}
+function parseBunLock(contents) {
+  const stripped = contents.replace(/^\s*\/\/.*$/gm, "");
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  try {
+    const json = JSON.parse(stripped);
+    for (const [name, value] of Object.entries(json.packages ?? {})) {
+      if (!Array.isArray(value)) continue;
+      const entry = Array.from(value);
+      const spec = typeof entry[0] === "string" ? entry[0] : "";
+      const version = spec.includes("@") ? spec.slice(spec.lastIndexOf("@") + 1) : spec;
+      packages.push({ name, version, path: `bun:${name}` });
+      const meta = entry[1];
+      if (meta !== null && typeof meta === "object" && "dependencies" in meta) {
+        const deps = meta.dependencies;
+        if (deps !== null && typeof deps === "object") {
+          for (const dep of Object.keys(deps)) addEdge(edges, name, dep);
+        }
+      }
+    }
+  } catch {
+    return graph([], /* @__PURE__ */ new Map(), /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set(), false);
+  }
+  return graph(packages, edges, directProd, directDev, packages.length > 0);
+}
+var init_lockfile_modern = __esm({
+  "src/modules/deps/lockfile-modern.ts"() {
+  }
+});
+
 // src/modules/deps/lockfile.ts
 function basename2(filename) {
   const parts = filename.replace(/\\/g, "/").split("/");
@@ -674,7 +841,7 @@ function objectKeys(value) {
   }
   return Object.keys(value);
 }
-function addEdge(edges, from, to) {
+function addEdge2(edges, from, to) {
   const set = edges.get(from) ?? /* @__PURE__ */ new Set();
   set.add(to);
   edges.set(from, set);
@@ -754,7 +921,7 @@ function parseYarnGraph(contents) {
       const depBerry = /^\s{4}(?:"([^"]+)"|(@?[\w./-]+)):/.exec(raw);
       const depName = depClassic?.[1] ?? depClassic?.[2] ?? depBerry?.[1] ?? depBerry?.[2];
       if (depName !== void 0) {
-        addEdge(edges, currentName, depName);
+        addEdge2(edges, currentName, depName);
         continue;
       }
       if (/^\s{2}\S/.test(raw)) inDeps = false;
@@ -848,7 +1015,7 @@ function parsePnpmGraph(contents) {
         const dep = /^      (?:'([^']+)'|"([^"]+)"|([^:]+)):/.exec(raw);
         const depName = dep?.[1] ?? dep?.[2] ?? dep?.[3];
         if (depName !== void 0) {
-          addEdge(edges, currentPkg, depName);
+          addEdge2(edges, currentPkg, depName);
           continue;
         }
         if (/^    \S/.test(raw)) inPkgDeps = false;
@@ -883,7 +1050,7 @@ function graphFromPackagesTable(packages) {
     const name = key === "" ? "" : nameFromPackagesKey(key);
     if (name === void 0 || name.length === 0) continue;
     for (const dep of [...objectKeys(value.dependencies), ...objectKeys(value.optionalDependencies)]) {
-      addEdge(edges, name, dep);
+      addEdge2(edges, name, dep);
     }
   }
   return { edges, directProd, directDev };
@@ -893,7 +1060,7 @@ function graphFromDependenciesTree(deps, edges) {
     const child = value.dependencies;
     if (child === void 0 || typeof child !== "object" || child === null) continue;
     const nested = child;
-    for (const childName of Object.keys(nested)) addEdge(edges, name, childName);
+    for (const childName of Object.keys(nested)) addEdge2(edges, name, childName);
     graphFromDependenciesTree(nested, edges);
   }
 }
@@ -906,8 +1073,16 @@ function parseLockfileGraph(filename, contents) {
     directDev: /* @__PURE__ */ new Set(),
     edgesKnown: false
   };
-  if (name === "yarn.lock") return parseYarnGraph(contents);
-  if (name === "pnpm-lock.yaml") return parsePnpmGraph(contents);
+  const modern = process.env.FULLSHIELD_EXPERIMENTAL_LOCKFILES === "1";
+  if (name === "yarn.lock") {
+    if (modern && contents.includes("__metadata")) return parseYarnBerry(contents);
+    return parseYarnGraph(contents);
+  }
+  if (name === "pnpm-lock.yaml") {
+    if (modern && /lockfileVersion:\s*['"]?9/.test(contents)) return parsePnpmV9(contents);
+    return parsePnpmGraph(contents);
+  }
+  if (modern && name === "bun.lock") return parseBunLock(contents);
   if (name !== "package-lock.json") return empty;
   try {
     const json = JSON.parse(contents);
@@ -934,6 +1109,7 @@ function parseLockfileGraph(filename, contents) {
 var PNPM_KEY;
 var init_lockfile = __esm({
   "src/modules/deps/lockfile.ts"() {
+    init_lockfile_modern();
     PNPM_KEY = /^ {2}['"]?(?:\/)?(@?[^'"@\s/]+(?:\/[^'"@\s/]+)?)@([^'"(\s:]+)(?:\([^)]*\))?['"]?:\s*$/;
   }
 });
@@ -1092,6 +1268,91 @@ var init_pins = __esm({
   }
 });
 
+// src/modules/deps/evidence.ts
+function packageNameFromSpec(spec) {
+  if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:")) return void 0;
+  if (spec.startsWith("@")) {
+    const slash2 = spec.indexOf("/");
+    if (slash2 < 0) return void 0;
+    const rest = spec.slice(slash2 + 1);
+    const cut = rest.indexOf("/");
+    return cut === -1 ? spec : spec.slice(0, slash2 + 1 + cut);
+  }
+  const slash = spec.indexOf("/");
+  return slash === -1 ? spec : spec.slice(0, slash);
+}
+function collectImportSites(sources) {
+  const byPkg = /* @__PURE__ */ new Map();
+  const files = [...sources.keys()].sort();
+  for (const file of files) {
+    const text = sources.get(file) ?? "";
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+      const line = lines[i] ?? "";
+      IMPORT_RE.lastIndex = 0;
+      let match;
+      while ((match = IMPORT_RE.exec(line)) !== null) {
+        const spec = match[1] ?? match[2] ?? match[3];
+        if (spec === void 0) continue;
+        const pkg = packageNameFromSpec(spec);
+        if (pkg === void 0) continue;
+        const list = byPkg.get(pkg) ?? [];
+        list.push({ file, line: i + 1, specifier: spec, pkg });
+        byPkg.set(pkg, list);
+      }
+    }
+  }
+  for (const [pkg, list] of byPkg) {
+    list.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+    byPkg.set(pkg, list.slice(0, 5));
+  }
+  return byPkg;
+}
+function evidenceForFinding(finding6, sites, productionFiles, edgesKnown) {
+  if (finding6.ruleId !== "DEPS-VULN-001" && finding6.ruleId !== "DEPS-MALICIOUS-001") return void 0;
+  const snippet = finding6.snippet ?? "";
+  const at = snippet.startsWith("@") ? snippet.indexOf("@", 1) : snippet.indexOf("@");
+  const pkg = at <= 0 ? snippet : snippet.slice(0, at);
+  if (pkg.length === 0) return void 0;
+  const imports = (sites.get(pkg) ?? []).map((site) => ({
+    file: site.file,
+    line: site.line,
+    specifier: site.specifier
+  }));
+  const first = imports[0];
+  const path = finding6.dependencyPath;
+  let reason;
+  switch (finding6.reachability) {
+    case "not-imported":
+      reason = `No production file imports ${pkg}. Checked ${productionFiles.length} production file(s)${productionFiles.length > 0 ? `: ${productionFiles.slice(0, 8).join(", ")}` : ""}.`;
+      return { imports: [], reason };
+    case "reachability-unknown":
+      reason = edgesKnown ? `Reachability for ${pkg} is unknown.` : `Lockfile edges are missing, so ${pkg} is reachability-unknown.`;
+      return { imports, ...first !== void 0 ? {} : {}, reason };
+    case "reachable-via-dependency":
+      reason = path !== void 0 && path.length > 0 ? `Required through ${path.join(" > ")}.` : `Required by an imported package.`;
+      return { imports, ...path !== void 0 ? { dependencyPath: path } : {}, reason };
+    case "imported-not-called":
+      reason = first !== void 0 ? `Imported from ${first.file}:${first.line} and not called.` : `Imported and not called.`;
+      return { imports, reason };
+    case "symbol-reachable":
+      reason = first !== void 0 ? `A named vulnerable export is called from ${first.file}:${first.line}.` : `A named vulnerable export is called.`;
+      return { imports, reason };
+    case "symbol-not-called":
+      reason = `A named vulnerable export is not called.`;
+      return { imports, reason };
+    default:
+      reason = first !== void 0 ? `Imported from ${first.file}:${first.line}.` : `Imported by production code.`;
+      return { imports, ...path !== void 0 ? { dependencyPath: path } : {}, reason };
+  }
+}
+var IMPORT_RE;
+var init_evidence = __esm({
+  "src/modules/deps/evidence.ts"() {
+    IMPORT_RE = /(?:require\(\s*['"]([^'"]+)['"]\s*\)|from\s+['"]([^'"]+)['"]|import\(\s*['"]([^'"]+)['"]\s*\))/g;
+  }
+});
+
 // src/modules/deps/symbol-reachability.ts
 function affectedFunctionNames(vuln) {
   const names = /* @__PURE__ */ new Set();
@@ -1200,7 +1461,7 @@ function packageNameFromSnippet(snippet) {
   const at = snippet.indexOf("@");
   return at <= 0 ? snippet : snippet.slice(0, at);
 }
-function packageNameFromSpec(spec) {
+function packageNameFromSpec2(spec) {
   if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:")) return void 0;
   if (spec.startsWith("@")) {
     const parts = spec.split("/");
@@ -1236,7 +1497,7 @@ function indexPackageUsage(sources) {
         const local = m[1];
         const spec = m[2];
         if (local === void 0 || spec === void 0) continue;
-        const pkg = packageNameFromSpec(spec);
+        const pkg = packageNameFromSpec2(spec);
         if (pkg === void 0) continue;
         bump(pkg, localIsCalled(source, local));
       }
@@ -1246,7 +1507,7 @@ function indexPackageUsage(sources) {
     while ((named = namedRe.exec(source)) !== null) {
       const spec = named[2];
       if (spec === void 0) continue;
-      const pkg = packageNameFromSpec(spec);
+      const pkg = packageNameFromSpec2(spec);
       if (pkg === void 0) continue;
       const locals = (named[1] ?? "").split(",").map((s) => s.trim().split(/\s+as\s+/).pop() ?? "");
       bump(
@@ -1305,34 +1566,55 @@ function reachableFrom(target, roots, edges) {
   if (roots.has(target)) return true;
   return shortestDependencyPath(target, roots, edges) !== void 0;
 }
-function importedDirectNames(usage, graph) {
-  const directs = /* @__PURE__ */ new Set([...graph.directProd, ...graph.directDev]);
+function importedDirectNames(usage, graph2) {
+  const directs = /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]);
   const out = /* @__PURE__ */ new Set();
-  for (const [name, hit] of usage) {
-    if (!hit.imported) continue;
+  for (const [name, hit2] of usage) {
+    if (!hit2.imported) continue;
     if (directs.size === 0 || directs.has(name)) out.add(name);
   }
   return out;
 }
-function classifyReachability(pkgName, productionUsage, graph) {
-  const hit = productionUsage.get(pkgName);
-  if (hit?.imported === true) {
-    return { reachability: hit.called ? "reachable" : "imported-not-called" };
+function classifyReachability(pkgName, productionUsage, graph2) {
+  const hit2 = productionUsage.get(pkgName);
+  if (hit2?.imported === true) {
+    return { reachability: hit2.called ? "reachable" : "imported-not-called" };
   }
-  if (graph !== void 0 && graph.edgesKnown) {
-    const roots = importedDirectNames(productionUsage, graph);
-    const paths = collectDependencyPaths(pkgName, roots, graph.edges);
+  if (graph2 !== void 0 && graph2.edgesKnown) {
+    const roots = importedDirectNames(productionUsage, graph2);
+    const paths = collectDependencyPaths(pkgName, roots, graph2.edges);
     const path = paths[0];
     if (path !== void 0 && path.length >= 2) {
       return { reachability: "reachable-via-dependency", path, paths };
     }
     return { reachability: "not-imported" };
   }
-  if (graph !== void 0 && !graph.edgesKnown) {
+  if (graph2 !== void 0 && !graph2.edgesKnown) {
     return { reachability: "reachability-unknown" };
   }
   return { reachability: "not-imported" };
 }
+function unusedDirectPackages(ctx) {
+  if (!ctx.graph.edgesKnown) return [];
+  const imported = importedDirectNames(ctx.productionUsage, ctx.graph);
+  return [...ctx.graph.directProd].filter((name) => {
+    if (ctx.productionUsage.get(name)?.imported === true) return false;
+    return !reachableFrom(name, imported, ctx.graph.edges);
+  }).sort();
+}
+function unusedDirectPlan(findings, ctx) {
+  const packages = unusedDirectPackages(ctx);
+  if (packages.length === 0) return void 0;
+  const names = new Set(packages);
+  let advisories = 0;
+  for (const finding6 of findings) {
+    if (finding6.ruleId !== "DEPS-VULN-001" && finding6.ruleId !== "DEPS-MALICIOUS-001") continue;
+    if (finding6.snippet === void 0) continue;
+    const pkg = packageNameFromSnippet(finding6.snippet);
+    if (pkg !== void 0 && names.has(pkg)) advisories += 1;
+  }
+  return { packages, advisories };
+}
 function reachabilitySteps(reachability) {
   if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
@@ -1566,6 +1848,186 @@ var init_semver = __esm({
   }
 });
 
+// src/modules/deps/upgrade-plan.ts
+function sentenceFor(bumps, unresolved) {
+  const parts = [];
+  if (bumps.length === 1) {
+    const bump = bumps[0];
+    if (bump !== void 0) {
+      const noun = bump.findings === 1 ? "finding" : "findings";
+      parts.push(`1 bump (${bump.name} ${bump.from} \u2192 ${bump.to}) resolves ${bump.findings} ${noun}.`);
+    }
+  } else if (bumps.length > 1) {
+    const listed = bumps.map((bump) => `${bump.name} ${bump.from} \u2192 ${bump.to}`).join(", ");
+    const total = bumps.reduce((sum, bump) => sum + bump.findings, 0);
+    const noun = total === 1 ? "finding" : "findings";
+    parts.push(`${bumps.length} bumps (${listed}) resolve ${total} ${noun}.`);
+  }
+  if (unresolved.length > 0) {
+    parts.push(`No fixed version in the OSV cache for ${unresolved.join(", ")}.`);
+  }
+  return parts.join(" ");
+}
+function chooseUpgradePlan(advisories) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const advisory of advisories) {
+    const list = byName.get(advisory.name);
+    if (list === void 0) byName.set(advisory.name, [advisory]);
+    else list.push(advisory);
+  }
+  const unresolved = [];
+  const candidates = [];
+  for (const [name, list] of byName) {
+    const from = list[0]?.from ?? "0.0.0";
+    if (list.some((advisory) => advisory.fixed === void 0)) {
+      unresolved.push(name);
+      continue;
+    }
+    let to = list[0]?.fixed;
+    for (const advisory of list) {
+      if (advisory.fixed !== void 0 && (to === void 0 || compareSemver(advisory.fixed, to) > 0)) {
+        to = advisory.fixed;
+      }
+    }
+    if (to === void 0 || compareSemver(to, from) <= 0) continue;
+    candidates.push({
+      name,
+      from,
+      to,
+      ids: list.map((advisory) => advisory.id)
+    });
+  }
+  unresolved.sort();
+  const chosen = smallestMaxCover(candidates);
+  if (chosen.length === 0 && unresolved.length === 0) return void 0;
+  const bumps = chosen.map((candidate) => ({
+    name: candidate.name,
+    from: candidate.from,
+    to: candidate.to,
+    safe: sameMajor(candidate.from, candidate.to),
+    findings: candidate.ids.length
+  }));
+  return { bumps, unresolved, sentence: sentenceFor(bumps, unresolved) };
+}
+function smallestMaxCover(candidates) {
+  const limit = Math.min(candidates.length, 12);
+  let best = [];
+  let bestCount = -1;
+  const walk5 = (index, picked, covered) => {
+    if (index === limit) {
+      if (covered.size > bestCount || covered.size === bestCount && betterTie(picked, best)) {
+        best = picked;
+        bestCount = covered.size;
+      }
+      return;
+    }
+    const next = candidates[index];
+    if (next === void 0) return;
+    walk5(index + 1, picked, covered);
+    const grown = new Set(covered);
+    for (const id of next.ids) grown.add(id);
+    walk5(index + 1, [...picked, next], grown);
+  };
+  walk5(0, [], /* @__PURE__ */ new Set());
+  return [...best].sort((a, b) => a.name.localeCompare(b.name));
+}
+function betterTie(picked, best) {
+  if (picked.length !== best.length) return picked.length < best.length;
+  const left = picked.map((item) => item.name).sort().join("\0");
+  const right = best.map((item) => item.name).sort().join("\0");
+  return left < right;
+}
+var init_upgrade_plan = __esm({
+  "src/modules/deps/upgrade-plan.ts"() {
+    init_semver();
+  }
+});
+
+// src/supply/campaign.ts
+function hit(ruleId, title, message, file, severity) {
+  return {
+    id: makeFindingId(ruleId, file, message),
+    ruleId,
+    module: "deps",
+    title,
+    severity,
+    confidence: "high",
+    file,
+    message,
+    remediation: "Do not install this package. Remove it, delete node_modules, and reinstall from a clean lockfile."
+  };
+}
+function campaignFindings(files) {
+  const findings = [];
+  for (const source of files) {
+    const hasChain = RPC_RE.test(source.text);
+    const hasNet = NET_RE.test(source.text) || EVAL_RE.test(source.text);
+    if (hasChain && hasNet) {
+      findings.push(
+        hit(
+          "SUPPLY-CHAINC2-001",
+          "Package reads a blockchain RPC and then fetches or evaluates the result",
+          "static: RPC method combined with fetch or eval",
+          source.file,
+          "high"
+        )
+      );
+    }
+    const steals = STEAL_RE.test(source.text);
+    const callsNet = NET_RE.test(source.text);
+    if (steals && callsNet) {
+      findings.push(
+        hit(
+          "SUPPLY-STEALER-001",
+          "Package reads a local credential store and makes a network call",
+          "static: browser, chat, or wallet path combined with a network call",
+          source.file,
+          "critical"
+        )
+      );
+    }
+    const gated2 = PLATFORM_RE.test(source.text);
+    const downloads = DOWNLOAD_RE.test(source.text);
+    const spawns = SPAWN_RE.test(source.text);
+    if (gated2 && downloads && spawns) {
+      findings.push(
+        hit(
+          "SUPPLY-PLATFORMGATE-001",
+          "Package downloads and launches a file only on one platform",
+          "static: platform check combined with a download and a process spawn",
+          source.file,
+          "high"
+        )
+      );
+    }
+  }
+  return findings;
+}
+function securityPlaceholderFinding(name, locked, latest) {
+  if (latest !== "0.0.1-security") return void 0;
+  if (locked === "0.0.1-security") return void 0;
+  return hit(
+    "SUPPLY-SECHOLDER-001",
+    `Locked ${name}@${locked} was replaced on the registry by the security placeholder`,
+    `${name} latest is 0.0.1-security while the lockfile pins ${locked}`,
+    "package-lock.json",
+    "critical"
+  );
+}
+var RPC_RE, NET_RE, EVAL_RE, STEAL_RE, PLATFORM_RE, DOWNLOAD_RE, SPAWN_RE;
+var init_campaign = __esm({
+  "src/supply/campaign.ts"() {
+    init_finding();
+    RPC_RE = /getSignaturesForAddress|eth_getLogs/;
+    NET_RE = /https\.request|http\.request|fetch\s*\(|axios\./;
+    EVAL_RE = /\beval\s*\(/;
+    STEAL_RE = /Login Data|leveldb|discord[\\/]Local Storage|wallet-extension|Ethereum\/keystore/i;
+    PLATFORM_RE = /process\.platform\s*===\s*['"]win32['"]|os\.platform\s*\(\s*\)/;
+    DOWNLOAD_RE = /https?:\/\/example\.invalid|createWriteStream|https\.get/;
+    SPAWN_RE = /child_process|spawn\s*\(|execFile\s*\(|\.exe['"]/;
+  }
+});
+
 // src/modules/deps/popular.ts
 var POPULAR_PACKAGES;
 var init_popular = __esm({
@@ -3601,7 +4063,7 @@ __export(supply_exports, {
   checkProvenance: () => checkProvenance,
   diffPackageVersions: () => diffPackageVersions,
   installGuard: () => installGuard,
-  packageNameFromSpec: () => packageNameFromSpec2,
+  packageNameFromSpec: () => packageNameFromSpec3,
   provenanceCoverage: () => provenanceCoverage
 });
 function assertRegistryUrl(url) {
@@ -3615,7 +4077,7 @@ function assertRegistryUrl(url) {
     throw new Error(`supply: only ${REGISTRY_HOST} is allowed (got ${parsed.hostname || url})`);
   }
 }
-function packageNameFromSpec2(spec) {
+function packageNameFromSpec3(spec) {
   if (spec.startsWith("@")) {
     const slash = spec.indexOf("/");
     if (slash < 0) return spec;
@@ -3684,13 +4146,13 @@ function analyzePackageDir(dir) {
   const readsNpmrc = sources.some((s) => s.text.includes(".npmrc") || s.text.includes(".ssh"));
   const hasNet = sources.some((s) => /https\.request|http\.request|fetch\s*\(|axios\./.test(s.text));
   if (readsNpmrc && hasNet) {
-    const hit = sources.find((s) => s.text.includes(".npmrc") || s.text.includes(".ssh"));
+    const hit2 = sources.find((s) => s.text.includes(".npmrc") || s.text.includes(".ssh"));
     findings.push(
       finding(
         "SUPPLY-NPMRC-NET-001",
         "Install-time code reads npm/ssh credentials and uses the network",
         "static: credential file read combined with http(s)/fetch",
-        hit?.file,
+        hit2?.file,
         "critical"
       )
     );
@@ -3821,7 +4283,7 @@ async function installGuard(spec, opts = {}) {
   if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY !== "1") {
     return { findings: [], skipped: true };
   }
-  const name = packageNameFromSpec2(spec);
+  const name = packageNameFromSpec3(spec);
   const url = `https://${REGISTRY_HOST}/${encodeURIComponent(name)}`;
   assertRegistryUrl(url);
   if (opts.fetchPackument) await opts.fetchPackument(url);
@@ -3857,7 +4319,7 @@ ${scripts}`;
   if (!TOKEN_RE.test(text)) return [];
   const replicates = PUBLISH_RE.test(text) || REGISTRY_PUT_RE.test(text) || GITHUB_CREATE_RE.test(text) || WORKFLOW_PATH_RE.test(text);
   if (!replicates) return [];
-  const hit = sources.find(
+  const hit2 = sources.find(
     (s) => TOKEN_RE.test(s.text) && (PUBLISH_RE.test(s.text) || REGISTRY_PUT_RE.test(s.text) || GITHUB_CREATE_RE.test(s.text) || WORKFLOW_PATH_RE.test(s.text))
   ) ?? sources.find((s) => TOKEN_RE.test(s.text));
   return [
@@ -3865,7 +4327,7 @@ ${scripts}`;
       "SUPPLY-WORM-001",
       "Self-replicating worm indicators in dependency code",
       "static: npm/GitHub token read combined with publish, registry PUT, GitHub repo/workflow creation, or writing .github/workflows",
-      hit?.file,
+      hit2?.file,
       "critical"
     )
   ];
@@ -3875,13 +4337,13 @@ function analyzeWorkflowTampering(dir) {
   const text = `${sources.map((s) => s.text).join("\n")}
 ${scripts}`;
   if (!CI_WRITE_RE.test(text)) return [];
-  const hit = sources.find((s) => CI_WRITE_RE.test(s.text));
+  const hit2 = sources.find((s) => CI_WRITE_RE.test(s.text));
   return [
     finding(
       "SUPPLY-WORKFLOW-001",
       "Dependency writes GitHub workflow, git hooks, or CI config",
       "static: install script or package code writes .github/, .git/hooks/, or CI configuration",
-      hit?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
+      hit2?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
       "critical"
     )
   ];
@@ -3890,9 +4352,9 @@ function provenanceCoverage(packages, known) {
   let withProvenance = 0;
   let unknown = 0;
   for (const pkg of packages) {
-    const hit = known.get(`${pkg.name}@${pkg.version}`);
-    if (hit === true) withProvenance += 1;
-    else if (hit === void 0) unknown += 1;
+    const hit2 = known.get(`${pkg.name}@${pkg.version}`);
+    if (hit2 === true) withProvenance += 1;
+    else if (hit2 === void 0) unknown += 1;
   }
   const total = packages.length;
   return {
@@ -3932,8 +4394,8 @@ function parentsOf(name, edges) {
   }
   return out;
 }
-function isDirect(name, graph) {
-  return graph.directProd.has(name) || graph.directDev.has(name);
+function isDirect(name, graph2) {
+  return graph2.directProd.has(name) || graph2.directDev.has(name);
 }
 function packagesWithAFixedRelease(findings) {
   const names = /* @__PURE__ */ new Set();
@@ -3951,17 +4413,17 @@ function targetVersion(finding6) {
 function kindFromLockfile(lockFile) {
   return lockfileKind(lockFile) ?? "npm";
 }
-function attachOverrideProposals(findings, graph, lockFile, manifestRaw) {
-  if (!graph.edgesKnown || manifestRaw === void 0) return findings;
+function attachOverrideProposals(findings, graph2, lockFile, manifestRaw) {
+  if (!graph2.edgesKnown || manifestRaw === void 0) return findings;
   const withFix = packagesWithAFixedRelease(findings);
   const kind = kindFromLockfile(lockFile);
   return findings.map((finding6) => {
     if (finding6.ruleId !== "DEPS-VULN-001" || finding6.snippet === void 0) return finding6;
     const name = packageNameFromSnippet2(finding6.snippet);
-    if (name.length === 0 || isDirect(name, graph)) return finding6;
+    if (name.length === 0 || isDirect(name, graph2)) return finding6;
     const version = targetVersion(finding6);
     if (version === void 0) return finding6;
-    const parentFixed = parentsOf(name, graph.edges).some((parent) => withFix.has(parent));
+    const parentFixed = parentsOf(name, graph2.edges).some((parent) => withFix.has(parent));
     if (parentFixed) return finding6;
     const after = withManifestOverride(manifestRaw, kind, name, version);
     const diff = unifiedDiff("package.json", manifestRaw, after);
@@ -3982,10 +4444,10 @@ function scanInstalledPackages(cwd, packages) {
     const dir = packageDir(cwd, pkg);
     if (dir === void 0) continue;
     const prefix = pkg.path.startsWith("node_modules/") ? pkg.path : `node_modules/${pkg.name}`;
-    for (const hit of [...analyzeWormIndicators(dir), ...analyzeWorkflowTampering(dir)]) {
+    for (const hit2 of [...analyzeWormIndicators(dir), ...analyzeWorkflowTampering(dir)]) {
       out.push({
-        ...hit,
-        file: hit.file !== void 0 && hit.file.length > 0 ? `${prefix}/${hit.file}` : prefix
+        ...hit2,
+        file: hit2.file !== void 0 && hit2.file.length > 0 ? `${prefix}/${hit2.file}` : prefix
       });
     }
   }
@@ -4066,19 +4528,19 @@ function maliciousFinding(lockFile, pkg, vuln) {
     references: [vuln.id, ...vuln.aliases ?? []]
   };
 }
-function typosquatFinding(lockFile, hit) {
-  const snippet = `${hit.name}@${hit.version}`;
+function typosquatFinding(lockFile, hit2) {
+  const snippet = `${hit2.name}@${hit2.version}`;
   return {
     id: makeFindingId("DEPS-TYPOSQUAT-001", lockFile, snippet),
     ruleId: "DEPS-TYPOSQUAT-001",
     module: "deps",
-    title: `Possible typosquat: ${hit.name}`,
+    title: `Possible typosquat: ${hit2.name}`,
     severity: "medium",
     confidence: "low",
     file: lockFile,
     snippet,
-    message: `Package "${hit.name}" is 1 character from popular package "${hit.lookalike}" (possible typosquat).`,
-    remediation: `Confirm you intended to install "${hit.name}". If not, remove it and depend on "${hit.lookalike}" instead.`
+    message: `Package "${hit2.name}" is 1 character from popular package "${hit2.lookalike}" (possible typosquat).`,
+    remediation: `Confirm you intended to install "${hit2.name}". If not, remove it and depend on "${hit2.lookalike}" instead.`
   };
 }
 function noLockFinding() {
@@ -4109,6 +4571,76 @@ function deprecatedFinding(lockFile, pkg) {
     remediation: `Replace ${pkg.name} with a maintained alternative.`
   };
 }
+function workspacesEnabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_WORKSPACES === "1";
+}
+function workspacePatterns(manifestRaw) {
+  try {
+    const manifest = JSON.parse(manifestRaw);
+    const field = manifest.workspaces;
+    if (Array.isArray(field)) return field.filter((item) => typeof item === "string");
+    if (field !== null && typeof field === "object" && Array.isArray(field.packages)) {
+      return field.packages.filter((item) => typeof item === "string");
+    }
+  } catch {
+    return [];
+  }
+  return [];
+}
+async function expandWorkspace(cwd, pattern) {
+  const normalized = pattern.replace(/\\/g, "/").replace(/^\.\//, "");
+  if (!normalized.includes("*")) return [normalized];
+  const slash = normalized.indexOf("/*");
+  if (slash < 0) return [];
+  const parent = normalized.slice(0, slash);
+  try {
+    const entries = await readdir(join(cwd, parent), { withFileTypes: true });
+    return entries.filter((entry) => entry.isDirectory()).map((entry) => `${parent}/${entry.name}`).sort();
+  } catch {
+    return [];
+  }
+}
+async function workspaceAdvisoryFindings(cwd, manifestRaw, osvOpts) {
+  const dirs = /* @__PURE__ */ new Set();
+  for (const pattern of workspacePatterns(manifestRaw)) {
+    for (const dir of await expandWorkspace(cwd, pattern)) dirs.add(dir);
+  }
+  const findings = [];
+  for (const dir of [...dirs].sort()) {
+    if (dir === "" || dir === ".") continue;
+    const lockName = LOCKFILE_NAMES.find((name) => existsSync(join(cwd, dir, name)));
+    if (lockName === void 0) continue;
+    let text;
+    try {
+      text = await readFile(join(cwd, dir, lockName), "utf8");
+    } catch {
+      continue;
+    }
+    const graph2 = parseLockfileGraph(lockName, text);
+    const hits = await queryOsv(graph2.packages, osvOpts);
+    const file = `${dir}/${lockName}`;
+    for (const hit2 of hits) {
+      for (const vuln of hit2.vulns) {
+        findings.push(
+          isMaliciousAdvisory(vuln) ? maliciousFinding(file, hit2.pkg, vuln) : vulnFinding(file, hit2.pkg, vuln)
+        );
+      }
+    }
+  }
+  return findings;
+}
+async function withWorkspaceAdvisories(cwd, manifestRaw, osvOpts, findings) {
+  if (!workspacesEnabled() || manifestRaw === void 0) return findings;
+  return [...findings, ...await workspaceAdvisoryFindings(cwd, manifestRaw, osvOpts)];
+}
+async function readPlaceholderLatest(file) {
+  try {
+    const raw = JSON.parse(await readFile(file, "utf8"));
+    return typeof raw.latest === "string" ? raw.latest : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function graphFromManifest(manifest) {
   const keys = (field) => {
     const block = manifest[field];
@@ -4125,7 +4657,7 @@ function graphFromManifest(manifest) {
     edgesKnown: false
   };
 }
-async function reachabilityCtx(cwd, files, graph) {
+async function reachabilityCtx(cwd, files, graph2) {
   const prodSources = /* @__PURE__ */ new Map();
   for (const rel of files) {
     if (!/\.[cm]?[jt]sx?$/.test(rel)) continue;
@@ -4135,7 +4667,7 @@ async function reachabilityCtx(cwd, files, graph) {
     } catch {
     }
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
+  return { productionUsage: indexPackageUsage(prodSources), graph: graph2, sources: prodSources };
 }
 var LOCKFILE_NAMES, MANIFEST_FIELDS2, MALICIOUS_REMEDIATION, depsModule;
 var init_deps = __esm({
@@ -4144,7 +4676,10 @@ var init_deps = __esm({
     init_lockfile();
     init_osv();
     init_pins();
+    init_evidence();
     init_reachability();
+    init_upgrade_plan();
+    init_campaign();
     init_symbol_reachability();
     init_semver();
     init_typosquat();
@@ -4158,6 +4693,8 @@ var init_deps = __esm({
     depsModule = {
       name: "deps",
       async run(ctx) {
+        depsModule.unusedDirect = void 0;
+        depsModule.upgradePlan = void 0;
         const lockFile = LOCKFILE_NAMES.find((name) => ctx.files.includes(name));
         const cacheDir = ctx.config.deps.cacheDir !== void 0 ? resolve(ctx.cwd, ctx.config.deps.cacheDir) : defaultCacheDir();
         const osvOpts = { cacheDir, offline: ctx.config.deps.offline };
@@ -4183,21 +4720,21 @@ var init_deps = __esm({
           }
           const pins = exactPinsFromManifest(manifest);
           const directNames2 = await readDirectDependencyNames(ctx.cwd);
-          for (const hit of findTyposquats(pins, { directNames: directNames2 })) {
-            findings2.push(typosquatFinding("package.json", hit));
+          for (const hit2 of findTyposquats(pins, { directNames: directNames2 })) {
+            findings2.push(typosquatFinding("package.json", hit2));
           }
           const osvHits2 = await queryOsv(pins, osvOpts);
           const symbols2 = /* @__PURE__ */ new Map();
-          for (const hit of osvHits2) {
-            for (const vuln of hit.vulns) {
-              const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+          for (const hit2 of osvHits2) {
+            for (const vuln of hit2.vulns) {
+              const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit2.pkg, vuln) : vulnFinding("package.json", hit2.pkg, vuln, depLoc(hit2.pkg.name));
               const names = affectedFunctionNames(vuln);
               if (names.length > 0 && finding6.ruleId === "DEPS-VULN-001") symbols2.set(finding6.id, names);
               findings2.push(finding6);
             }
           }
           const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
-          return applyReachability(findings2, noLockCtx, symbols2);
+          return withWorkspaceAdvisories(ctx.cwd, manifestRaw, osvOpts, applyReachability(findings2, noLockCtx, symbols2));
         }
         let contents;
         try {
@@ -4205,12 +4742,12 @@ var init_deps = __esm({
         } catch {
           return [];
         }
-        const graph = parseLockfileGraph(lockFile, contents);
-        const packages = graph.packages;
+        const graph2 = parseLockfileGraph(lockFile, contents);
+        const packages = graph2.packages;
         const findings = [];
         const directNames = await readDirectDependencyNames(ctx.cwd);
-        for (const hit of findTyposquats(packages, { directNames })) {
-          findings.push(typosquatFinding(lockFile, hit));
+        for (const hit2 of findTyposquats(packages, { directNames })) {
+          findings.push(typosquatFinding(lockFile, hit2));
         }
         for (const pkg of packages) {
           if (pkg.deprecated !== void 0) {
@@ -4219,20 +4756,56 @@ var init_deps = __esm({
         }
         const osvHits = await queryOsv(packages, osvOpts);
         const symbols = /* @__PURE__ */ new Map();
-        for (const hit of osvHits) {
-          for (const vuln of hit.vulns) {
-            const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+        for (const hit2 of osvHits) {
+          for (const vuln of hit2.vulns) {
+            const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit2.pkg, vuln) : vulnFinding(lockFile, hit2.pkg, vuln, depLoc(hit2.pkg.name));
             const names = affectedFunctionNames(vuln);
             if (names.length > 0 && finding6.ruleId === "DEPS-VULN-001") symbols.set(finding6.id, names);
             findings.push(finding6);
           }
         }
-        let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
+        const reachCtx = await reachabilityCtx(ctx.cwd, ctx.files, graph2);
+        let reached = applyReachability(findings, reachCtx, symbols);
         if (experimentalVex()) {
-          reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
+          reached = attachOverrideProposals(reached, graph2, lockFile, manifestRaw);
           reached.push(...scanInstalledPackages(ctx.cwd, packages));
         }
         if (licenseEnabled()) reached.push(...await scanCopyleftLicenses(ctx.cwd));
+        depsModule.unusedDirect = unusedDirectPlan(reached, reachCtx);
+        const direct = /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]);
+        const advisories = [];
+        for (const hit2 of osvHits) {
+          if (!direct.has(hit2.pkg.name)) continue;
+          for (const vuln of hit2.vulns) {
+            if (isMaliciousAdvisory(vuln)) continue;
+            advisories.push({
+              name: hit2.pkg.name,
+              from: hit2.pkg.version,
+              id: vuln.id,
+              fixed: minFixedVersion(vuln.affected ?? [])
+            });
+          }
+        }
+        depsModule.upgradePlan = chooseUpgradePlan(advisories);
+        if (process.env.FULLSHIELD_EXPERIMENTAL_REACH_EVIDENCE === "1") {
+          const sites = collectImportSites(reachCtx.sources);
+          const files = [...reachCtx.sources.keys()].sort();
+          reached = reached.map((finding6) => {
+            const evidence = evidenceForFinding(finding6, sites, files, graph2.edgesKnown);
+            return evidence === void 0 ? finding6 : { ...finding6, reachabilityEvidence: evidence };
+          });
+        }
+        reached = await withWorkspaceAdvisories(ctx.cwd, manifestRaw, osvOpts, reached);
+        if (process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY === "1") {
+          reached.push(...campaignFindings([...reachCtx.sources.entries()].map(([file, text]) => ({ file, text }))));
+          for (const name of [...direct].sort()) {
+            const locked = packages.find((pkg) => pkg.name === name)?.version;
+            if (locked === void 0) continue;
+            const latest = await readPlaceholderLatest(join(cacheDir, "registry", `${name.replaceAll("/", "__")}.json`));
+            const placeholder = securityPlaceholderFinding(name, locked, latest);
+            if (placeholder !== void 0) reached.push(placeholder);
+          }
+        }
         return reached;
       }
     };
@@ -4614,27 +5187,174 @@ var init_mcp = __esm({
   }
 });
 
-// src/modules/sast/frameworks.ts
-function decoratorExpr(dec) {
-  if (dec.type !== "Decorator") return void 0;
-  return dec.expression;
-}
-function decoratorName(dec) {
-  const expr = decoratorExpr(dec);
-  if (expr === void 0) return void 0;
-  if (expr.type === "Identifier") return expr.name;
-  if (expr.type === "CallExpression") return calleeName(expr);
-  return void 0;
-}
-function nodeDecorators(node) {
-  const decs = node.decorators;
-  return Array.isArray(decs) ? decs : [];
-}
-function nestInputDecorator(param) {
-  if (!frameworksEnabled()) return void 0;
-  for (const dec of nodeDecorators(param)) {
-    const name = decoratorName(dec);
-    if (name !== void 0 && NEST_INPUT.test(name)) return name;
+// src/runtime/lru.ts
+var LruMap;
+var init_lru = __esm({
+  "src/runtime/lru.ts"() {
+    LruMap = class {
+      constructor(max) {
+        this.max = max;
+        if (max < 1) throw new Error("LruMap max must be >= 1");
+      }
+      max;
+      map = /* @__PURE__ */ new Map();
+      get size() {
+        return this.map.size;
+      }
+      has(key) {
+        return this.map.has(key);
+      }
+      get(key) {
+        if (!this.map.has(key)) return void 0;
+        const value = this.map.get(key);
+        this.map.delete(key);
+        this.map.set(key, value);
+        return value;
+      }
+      set(key, value) {
+        if (this.map.has(key)) this.map.delete(key);
+        this.map.set(key, value);
+        while (this.map.size > this.max) {
+          const oldest = this.map.keys().next().value;
+          if (oldest === void 0) break;
+          this.map.delete(oldest);
+        }
+        return this;
+      }
+    };
+  }
+});
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+var init_version = __esm({
+  "src/core/version.ts"() {
+  }
+});
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
+  }
+  return Math.min(2, Math.max(1, availableParallelism() - 1));
+}
+function workerMemoryMb() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
+  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
+  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
+  return 512;
+}
+function parseCacheDir() {
+  return join(homedir(), ".cache", "fullshield", "parse");
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit2 = cache.get(key);
+  if (hit2 !== void 0) return Promise.resolve(hit2);
+  return new Promise((resolve8, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), {
+      workerData: { code },
+      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
+    });
+    let settled = false;
+    const finish = () => {
+      void worker.terminate();
+    };
+    const succeed = (ast) => {
+      if (settled) return;
+      settled = true;
+      cache.set(key, ast);
+      finish();
+      resolve8(ast);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      finish();
+      reject(error);
+    };
+    worker.once("message", (ast) => {
+      succeed(ast);
+    });
+    worker.once("error", (error) => {
+      fail(error);
+    });
+    worker.once("exit", (code2) => {
+      if (settled) return;
+      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
+    });
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
+var workerUrl, cache;
+var init_parse_pool = __esm({
+  "src/core/parse-pool.ts"() {
+    init_lru();
+    init_version();
+    workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+    cache = new LruMap(64);
+  }
+});
+
+// src/modules/sast/frameworks.ts
+function decoratorExpr(dec) {
+  if (dec.type !== "Decorator") return void 0;
+  return dec.expression;
+}
+function decoratorName(dec) {
+  const expr = decoratorExpr(dec);
+  if (expr === void 0) return void 0;
+  if (expr.type === "Identifier") return expr.name;
+  if (expr.type === "CallExpression") return calleeName(expr);
+  return void 0;
+}
+function nodeDecorators(node) {
+  const decs = node.decorators;
+  return Array.isArray(decs) ? decs : [];
+}
+function nestInputDecorator(param) {
+  if (!frameworksEnabled()) return void 0;
+  for (const dec of nodeDecorators(param)) {
+    const name = decoratorName(dec);
+    if (name !== void 0 && NEST_INPUT.test(name)) return name;
   }
   return void 0;
 }
@@ -4762,6 +5482,9 @@ var init_mcp2 = __esm({
 });
 
 // src/modules/sast/taint.ts
+function setCustomTaint(config) {
+  customTaint = config;
+}
 function objectChainMentions(node, pattern) {
   let current = node;
   for (let i = 0; i < 8 && current !== void 0; i += 1) {
@@ -4893,6 +5616,61 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
       return false;
   }
 }
+function valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners) {
+  if (node === void 0) return false;
+  if (isCoercionCall(node) || isSchemaValidatorCall(node) || isMongoSanitizeCall(node)) return false;
+  if (node.type === "Identifier") {
+    if (nosqlSanitized.has(node.name)) return false;
+    return built.has(node.name) || tainted.has(node.name);
+  }
+  if (isRequestObjectNode(node)) return true;
+  if (node.type === "AwaitExpression") {
+    return valueFeedsFilter(node.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  if (node.type === "CallExpression" && node.callee.type === "Identifier" && filterReturners.has(node.callee.name)) {
+    return true;
+  }
+  if (node.type === "ObjectExpression") {
+    return node.properties.some((prop) => {
+      if (prop.type === "SpreadElement") {
+        return valueFeedsFilter(prop.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+      }
+      if (prop.type !== "Property") return false;
+      return valueFeedsFilter(prop.value, tainted, returners, nosqlSanitized, built, filterReturners);
+    });
+  }
+  if (node.type === "ArrayExpression") {
+    return node.elements.some((el) => {
+      if (el === null) return false;
+      if (el.type === "SpreadElement") {
+        return valueFeedsFilter(el.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+      }
+      return valueFeedsFilter(el, tainted, returners, nosqlSanitized, built, filterReturners);
+    });
+  }
+  if (node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+    return node.arguments.some(
+      (arg) => arg.type !== "SpreadElement" && valueFeedsFilter(arg, tainted, returners, nosqlSanitized, built, filterReturners)
+    );
+  }
+  if (node.type === "ChainExpression" || node.type === "TSAsExpression" || node.type === "TSNonNullExpression" || node.type === "TSTypeAssertion" || node.type === "MemberExpression") {
+    return exprIsTainted(node, tainted, returners);
+  }
+  return false;
+}
+function initIsBuiltFilter(node, tainted, returners, nosqlSanitized, built, filterReturners) {
+  if (node.type === "AwaitExpression") {
+    return initIsBuiltFilter(node.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  if (node.type === "Identifier") return built.has(node.name) && !nosqlSanitized.has(node.name);
+  if (node.type === "CallExpression" && node.callee.type === "Identifier" && filterReturners.has(node.callee.name)) {
+    return true;
+  }
+  if (node.type === "ObjectExpression" || node.type === "ArrayExpression") {
+    return valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  return node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign" && valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners);
+}
 function exprIsSanitized(node, tainted, names, isCall, returners = NO_RETURNERS) {
   if (node === void 0) return true;
   if (isCall(node)) return true;
@@ -4956,7 +5734,7 @@ function seedMcpToolParams(scope, tainted) {
     for (const name of boundNames(param)) tainted.add(name);
   }
 }
-function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
+function analyzeScope(scope, seed = [], returners = NO_RETURNERS, filterReturners = NO_RETURNERS, initialBuilt = NO_RETURNERS) {
   const tainted = new Set(seed);
   seedDestructuredRequestParams(scope, tainted);
   seedFrameworkParams(scope, tainted);
@@ -4964,6 +5742,8 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
   const urlSanitized = /* @__PURE__ */ new Set();
   const xssSanitized = /* @__PURE__ */ new Set();
   const nosqlSanitized = /* @__PURE__ */ new Set();
+  const sqlCleared = /* @__PURE__ */ new Set();
+  const customPath = /* @__PURE__ */ new Set();
   let changed = true;
   while (changed) {
     changed = false;
@@ -4974,6 +5754,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
           for (const name of boundNames(node.id)) nosqlSanitized.add(name);
         }
         if (isSchemaValidatorCall(init)) return;
+        applyCustomCall(init, boundNames(node.id), tainted, sqlCleared, customPath);
         if (isUrlSanitizerCall(init)) {
           for (const name of boundNames(node.id)) urlSanitized.add(name);
         }
@@ -4994,6 +5775,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
           for (const name of boundNames(node.left)) nosqlSanitized.add(name);
         }
         if (isSchemaValidatorCall(node.right)) return;
+        applyCustomCall(node.right, boundNames(node.left), tainted, sqlCleared, customPath);
         if (isUrlSanitizerCall(node.right)) {
           for (const name of boundNames(node.left)) urlSanitized.add(name);
         }
@@ -5020,7 +5802,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
       for (const name of boundNames(node.left)) resolved.add(name);
     }
   });
-  const pathSanitized = /* @__PURE__ */ new Set();
+  const pathSanitized = new Set(customPath);
   walkScope(scope, (node) => {
     if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
     if (propName(node.callee) !== "startsWith") return;
@@ -5062,17 +5844,92 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
       for (const name of boundNames(node.left)) requestObjects.add(name);
     }
   });
+  const builtFilters = new Set(initialBuilt);
+  let grew = true;
+  while (grew) {
+    grew = false;
+    const add = (names) => {
+      for (const name of names) {
+        if (nosqlSanitized.has(name) || builtFilters.has(name)) continue;
+        builtFilters.add(name);
+        grew = true;
+      }
+    };
+    walkScope(scope, (node) => {
+      if (node.type === "VariableDeclarator" && node.init !== null) {
+        if (initIsBuiltFilter(node.init, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+          add(boundNames(node.id));
+        }
+      }
+      if (node.type !== "AssignmentExpression") return;
+      if (node.left.type === "Identifier" && initIsBuiltFilter(node.right, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+        add([node.left.name]);
+      }
+      if (node.left.type === "MemberExpression" && node.left.object.type === "Identifier" && valueFeedsFilter(node.right, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+        add([node.left.object.name]);
+      }
+    });
+  }
   return {
     tainted,
     pathSanitized,
+    sqlCleared,
     urlSanitized,
     xssSanitized,
     nosqlSanitized,
     hasPasswordName,
     requestObjects,
+    builtFilters,
+    filterReturners: new Set(filterReturners),
     returners: new Set(returners)
   };
 }
+function locallyDeclared(scope) {
+  const names = /* @__PURE__ */ new Set();
+  if (isFunctionNode(scope)) {
+    for (const param of scope.params) {
+      for (const name of boundNames(param)) names.add(name);
+    }
+  }
+  walkScope(scope, (node) => {
+    if (node.type === "VariableDeclarator") {
+      for (const name of boundNames(node.id)) names.add(name);
+    }
+    if (node.type === "FunctionDeclaration" && node.id !== null) names.add(node.id.name);
+  });
+  return names;
+}
+function inheritedBuiltFilters(fn, facts) {
+  const local = locallyDeclared(fn);
+  const inherited = /* @__PURE__ */ new Set();
+  let parent = fn.parent;
+  while (parent !== void 0 && !isFunctionNode(parent)) {
+    parent = parent.parent;
+  }
+  const outer = parent === void 0 ? void 0 : facts.get(parent);
+  if (outer === void 0) return inherited;
+  for (const name of outer.builtFilters) {
+    if (!local.has(name)) inherited.add(name);
+  }
+  return inherited;
+}
+function scopeReturnsBuiltFilter(scope, facts) {
+  let yes = false;
+  walkScope(scope, (node) => {
+    if (node.type !== "ReturnStatement" || node.argument === null) return;
+    if (initIsBuiltFilter(
+      node.argument,
+      facts.tainted,
+      facts.returners,
+      facts.nosqlSanitized,
+      facts.builtFilters,
+      facts.filterReturners
+    )) {
+      yes = true;
+    }
+  });
+  return yes;
+}
 function functionName(fn) {
   if (fn.type === "FunctionDeclaration" && fn.id !== null) return fn.id.name;
   if (isFunctionNode(fn) && fn.id !== null && fn.id.type === "Identifier") return fn.id.name;
@@ -5161,11 +6018,12 @@ function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   const seeds = /* @__PURE__ */ new Map();
   for (const fn of functions) seeds.set(fn, /* @__PURE__ */ new Set());
   const returners = new Set(extraReturners2);
+  const filterReturners = /* @__PURE__ */ new Set();
   for (let hop = 0; hop < MAX_TAINT_HOPS; hop += 1) {
     let changed = false;
-    facts.set(ast, analyzeScope(ast, [], returners));
+    facts.set(ast, analyzeScope(ast, [], returners, filterReturners));
     for (const fn of functions) {
-      facts.set(fn, analyzeScope(fn, seeds.get(fn) ?? [], returners));
+      facts.set(fn, analyzeScope(fn, seeds.get(fn) ?? [], returners, filterReturners, inheritedBuiltFilters(fn, facts)));
     }
     for (const fn of functions) {
       const name = functionName(fn);
@@ -5175,6 +6033,10 @@ function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
         returners.add(name);
         changed = true;
       }
+      if (scopeReturnsBuiltFilter(fn, f) && !filterReturners.has(name)) {
+        filterReturners.add(name);
+        changed = true;
+      }
     }
     for (const fn of functions) {
       const f = facts.get(fn);
@@ -5207,6 +6069,51 @@ function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   }
   return facts;
 }
+function sinkClasses(scope, tainted, returners) {
+  const found = /* @__PURE__ */ new Set();
+  walkScope(scope, (node) => {
+    if (node.type !== "CallExpression") return;
+    const name = calleeName(node);
+    const first = node.arguments[0];
+    if (name === void 0 || first === void 0 || first.type === "SpreadElement") return;
+    if (!exprIsTainted(first, tainted, returners)) return;
+    if (SQL_SINK_NAMES.has(name)) found.add("sqli");
+    if (CMD_SINK_NAMES.has(name)) found.add("cmdi");
+    if (PATH_SINK_NAMES.has(name)) found.add("path");
+  });
+  return [...found].sort();
+}
+function fileTaintSummary(ast) {
+  attachParents(ast);
+  const facts = analyzeFile(ast);
+  const returnsTaint = [];
+  const functions = [];
+  walk(ast, (node) => {
+    if (!isFunctionNode(node)) return;
+    const name = functionName(node);
+    const own = facts.get(node);
+    if (name === void 0 || own === void 0) return;
+    if (scopeReturnsTaint(node, own.tainted, own.returners)) returnsTaint.push(name);
+    const paramsToReturn = [];
+    const sinks = [];
+    node.params.forEach((param, index) => {
+      const pname = boundNames(param)[0];
+      if (pname === void 0) return;
+      const seeded = analyzeScope(node, [pname]);
+      if (scopeReturnsTaint(node, seeded.tainted, seeded.returners)) paramsToReturn.push(index);
+      for (const cls of sinkClasses(node, seeded.tainted, seeded.returners)) sinks.push({ param: index, class: cls });
+    });
+    functions.push({
+      name,
+      line: node.loc?.start.line ?? 0,
+      paramsToReturn,
+      sinks
+    });
+  });
+  returnsTaint.sort();
+  functions.sort((a, b) => a.line - b.line || a.name.localeCompare(b.name));
+  return { returnsTaint, functions };
+}
 function functionsThatReturnTaint(ast) {
   attachParents(ast);
   const names = /* @__PURE__ */ new Set();
@@ -5228,18 +6135,50 @@ function factsFor(node, map) {
   return map.get(enclosingScope(node)) ?? {
     tainted: /* @__PURE__ */ new Set(),
     pathSanitized: /* @__PURE__ */ new Set(),
+    sqlCleared: /* @__PURE__ */ new Set(),
     urlSanitized: /* @__PURE__ */ new Set(),
     xssSanitized: /* @__PURE__ */ new Set(),
     nosqlSanitized: /* @__PURE__ */ new Set(),
     hasPasswordName: false,
     requestObjects: /* @__PURE__ */ new Set(),
+    builtFilters: /* @__PURE__ */ new Set(),
+    filterReturners: /* @__PURE__ */ new Set(),
     returners: /* @__PURE__ */ new Set()
   };
 }
+function nodeHoldsBuiltFilter(node, map) {
+  const facts = factsFor(node, map);
+  if (node.type === "Identifier") return facts.builtFilters.has(node.name);
+  if (node.type === "AwaitExpression") return nodeHoldsBuiltFilter(node.argument, map);
+  if (node.type === "CallExpression" && node.callee.type === "Identifier") {
+    return facts.filterReturners.has(node.callee.name);
+  }
+  return false;
+}
 function nodeIsTainted(node, map) {
   const facts = factsFor(node, map);
   return exprIsTainted(node, facts.tainted, facts.returners);
 }
+function nodeIsSqlCleared(node, map) {
+  if (node.type === "Identifier") return factsFor(node, map).sqlCleared.has(node.name);
+  return false;
+}
+function applyCustomCall(init, names, tainted, sqlCleared, customPath) {
+  if (customTaint === void 0 || init === void 0 || init.type !== "CallExpression") return;
+  const called2 = calleeName(init);
+  if (called2 === void 0) return;
+  if (customTaint.sources.has(called2)) {
+    for (const name of names) tainted.add(name);
+  }
+  const clears = customTaint.sanitizers.get(called2);
+  if (clears === void 0) return;
+  if (clears.has("sqli")) {
+    for (const name of names) sqlCleared.add(name);
+  }
+  if (clears.has("path")) {
+    for (const name of names) customPath.add(name);
+  }
+}
 function nodeIsPathSanitized(node, map) {
   if (node.type !== "Identifier") return false;
   return factsFor(node, map).pathSanitized.has(node.name);
@@ -5261,7 +6200,7 @@ function nodeIsNosqlSanitized(node, map) {
   if (node.type === "Identifier") return factsFor(node, map).nosqlSanitized.has(node.name);
   return false;
 }
-var SCHEMA_ROOT, NO_RETURNERS, CALLBACK_METHODS, taintedThisFields, MAX_TAINT_HOPS;
+var customTaint, SCHEMA_ROOT, NO_RETURNERS, CALLBACK_METHODS, taintedThisFields, MAX_TAINT_HOPS, SQL_SINK_NAMES, CMD_SINK_NAMES, PATH_SINK_NAMES;
 var init_taint = __esm({
   "src/modules/sast/taint.ts"() {
     init_ast();
@@ -5283,6 +6222,157 @@ var init_taint = __esm({
     ]);
     taintedThisFields = /* @__PURE__ */ new WeakMap();
     MAX_TAINT_HOPS = 5;
+    SQL_SINK_NAMES = /* @__PURE__ */ new Set(["query", "execute"]);
+    CMD_SINK_NAMES = /* @__PURE__ */ new Set(["exec", "execSync", "spawn", "spawnSync"]);
+    PATH_SINK_NAMES = /* @__PURE__ */ new Set(["readFile", "readFileSync", "writeFile", "writeFileSync"]);
+  }
+});
+function taintSummariesEnabled() {
+  return process.env.FULLSHIELD_TAINT_SUMMARIES === "1";
+}
+function setTaintSummaryConfig(config) {
+  fileMemo.clear();
+  if (config === void 0) {
+    configHash = "";
+    return;
+  }
+  configHash = createHash("sha256").update(
+    JSON.stringify({
+      maxFileBytes: config.sast.maxFileBytes,
+      sources: config.sast.sources ?? [],
+      sanitizers: config.sast.sanitizers ?? [],
+      taintV2: taintV2Enabled(),
+      frameworks: frameworksEnabled(),
+      gaps: sastGapsEnabled(),
+      classes: classesEnabled(),
+      custom: process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1"
+    })
+  ).digest("hex");
+}
+function summaryDir() {
+  return process.env.FULLSHIELD_TAINT_SUMMARY_DIR ?? join(parseCacheDir(), "taint");
+}
+function taintSummaryKey(source, extra = "") {
+  return createHash("sha256").update(packageVersion()).update("\0").update(configHash).update("\0").update(extra).update("\0").update(source).digest("hex");
+}
+function summaryPath(key) {
+  return join(summaryDir(), `${key}.json`);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function readJson3(key) {
+  let text;
+  try {
+    text = readFileSync(summaryPath(key), "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    discard(key);
+    return void 0;
+  }
+}
+function discard(key) {
+  rmSync(summaryPath(key), { force: true });
+}
+function writeJson(key, value) {
+  const dir = summaryDir();
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(summaryPath(key), JSON.stringify(value));
+}
+function readFileSummary(key) {
+  const raw = readJson3(key);
+  if (typeof raw !== "object" || raw === null) {
+    if (raw !== void 0) discard(key);
+    return void 0;
+  }
+  const row = raw;
+  if (row.v !== 1 || !isStringArray(row.returnsTaint) || !Array.isArray(row.functions)) {
+    discard(key);
+    return void 0;
+  }
+  return row;
+}
+function cachedReturners(source, ast) {
+  const key = taintSummaryKey(source, "file");
+  const memo = fileMemo.get(key);
+  if (memo !== void 0) return new Set(memo.returnsTaint);
+  const cached = readFileSummary(key);
+  if (cached !== void 0) {
+    fileMemo.set(key, cached);
+    return new Set(cached.returnsTaint);
+  }
+  const summary = fileTaintSummary(ast);
+  const stored = { v: 1, returnsTaint: summary.returnsTaint, functions: summary.functions };
+  fileMemo.set(key, stored);
+  writeJson(key, stored);
+  return new Set(stored.returnsTaint);
+}
+function lists(facts) {
+  const names = (set) => [...set].sort();
+  return {
+    v: 1,
+    tainted: names(facts.tainted),
+    pathSanitized: names(facts.pathSanitized),
+    sqlCleared: names(facts.sqlCleared),
+    urlSanitized: names(facts.urlSanitized),
+    xssSanitized: names(facts.xssSanitized),
+    nosqlSanitized: names(facts.nosqlSanitized),
+    requestObjects: names(facts.requestObjects),
+    builtFilters: names(facts.builtFilters),
+    filterReturners: names(facts.filterReturners),
+    returners: names(facts.returners),
+    hasPasswordName: facts.hasPasswordName
+  };
+}
+function factsFrom(row) {
+  return {
+    tainted: new Set(row.tainted),
+    pathSanitized: new Set(row.pathSanitized),
+    sqlCleared: new Set(row.sqlCleared),
+    urlSanitized: new Set(row.urlSanitized),
+    xssSanitized: new Set(row.xssSanitized),
+    nosqlSanitized: new Set(row.nosqlSanitized),
+    requestObjects: new Set(row.requestObjects),
+    builtFilters: new Set(row.builtFilters),
+    filterReturners: new Set(row.filterReturners),
+    returners: new Set(row.returners),
+    hasPasswordName: row.hasPasswordName
+  };
+}
+function readFacts(key) {
+  const raw = readJson3(key);
+  if (typeof raw !== "object" || raw === null) {
+    if (raw !== void 0) discard(key);
+    return void 0;
+  }
+  const row = raw;
+  if (row.v !== 1 || !isStringArray(row.tainted) || !isStringArray(row.pathSanitized) || !isStringArray(row.sqlCleared) || !isStringArray(row.urlSanitized) || !isStringArray(row.xssSanitized) || !isStringArray(row.nosqlSanitized) || !isStringArray(row.requestObjects) || !isStringArray(row.builtFilters) || !isStringArray(row.filterReturners) || !isStringArray(row.returners) || typeof row.hasPasswordName !== "boolean") {
+    discard(key);
+    return void 0;
+  }
+  return factsFrom(row);
+}
+function cachedFunctionFacts(fileSource, fn, seed) {
+  const key = taintSummaryKey(fileSource, `seed:${fn.loc?.start.line ?? 0}:${seed.join(",")}`);
+  const cached = readFacts(key);
+  if (cached !== void 0) return cached;
+  const facts = analyzeFunctionWithSeed(fn, seed);
+  writeJson(key, lists(facts));
+  return facts;
+}
+var configHash, fileMemo;
+var init_summaries = __esm({
+  "src/modules/sast/summaries.ts"() {
+    init_parse_pool();
+    init_version();
+    init_taint();
+    init_experimental();
+    configHash = "";
+    fileMemo = /* @__PURE__ */ new Map();
   }
 });
 function collectFunctions(file, ast) {
@@ -5393,22 +6483,22 @@ function collectInstances(ast, ns) {
     if (node.type !== "VariableDeclarator" || node.init === null) return;
     if (node.id.type !== "Identifier" || node.init.type !== "NewExpression") return;
     if (node.init.callee.type !== "Identifier") return;
-    const hit = ns.get(node.init.callee.name);
-    if (hit === void 0) return;
-    instances.set(node.id.name, hit.includes("#") ? hit.split("#")[0] ?? hit : hit);
+    const hit2 = ns.get(node.init.callee.name);
+    if (hit2 === void 0) return;
+    instances.set(node.id.name, hit2.includes("#") ? hit2.split("#")[0] ?? hit2 : hit2);
   });
   return instances;
 }
 function resolveCallee(node, ns, instances, currentFile, functions) {
   if (node.type !== "CallExpression") return void 0;
   if (node.callee.type === "Identifier") {
-    const hit = ns.get(node.callee.name);
-    if (hit !== void 0) {
-      if (hit.includes("#")) {
-        const [file, name] = hit.split("#");
+    const hit2 = ns.get(node.callee.name);
+    if (hit2 !== void 0) {
+      if (hit2.includes("#")) {
+        const [file, name] = hit2.split("#");
         if (file !== void 0 && name !== void 0) return { file, name };
       }
-      return { file: hit, name: node.callee.name };
+      return { file: hit2, name: node.callee.name };
     }
     if (functions.has(`${currentFile}#${node.callee.name}`)) {
       return { file: currentFile, name: node.callee.name };
@@ -5515,9 +6605,9 @@ function runInterproc(parsed) {
     if (fn === void 0) continue;
     const param = fn.params[seed.paramIndex];
     if (param === void 0) continue;
-    const facts = analyzeFunctionWithSeed(fn.node, [param]);
     const p = byFile.get(fn.file);
     if (p === void 0) continue;
+    const facts = taintSummariesEnabled() ? cachedFunctionFacts(p.source, fn.node, [param]) : analyzeFunctionWithSeed(fn.node, [param]);
     const ns = requires.get(fn.file) ?? /* @__PURE__ */ new Map();
     const inst = instances.get(fn.file) ?? /* @__PURE__ */ new Map();
     walk(fn.node, (node) => {
@@ -5611,6 +6701,7 @@ var init_interproc = __esm({
     init_finding();
     init_ast();
     init_experimental();
+    init_summaries();
     init_taint();
     MAX_HOPS = 5;
   }
@@ -5982,6 +7073,184 @@ var init_jwt = __esm({
   }
 });
 
+// src/modules/sast/validation.ts
+function validationEnabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_VALIDATION === "1";
+}
+function parentOf(node) {
+  return node.parent;
+}
+function mentions(node, names) {
+  let current = node;
+  for (let i = 0; i < 12 && current !== void 0; i += 1) {
+    if (current.type === "CallExpression") {
+      const name = calleeName(current);
+      if (name !== void 0 && names.has(name)) return true;
+      current = current.callee.type === "MemberExpression" ? current.callee.object : void 0;
+      continue;
+    }
+    if (current.type === "MemberExpression") {
+      const name = propName(current);
+      if (name !== void 0 && names.has(name)) return true;
+      current = current.object;
+      continue;
+    }
+    if (current.type === "Identifier" && names.has(current.name)) return true;
+    break;
+  }
+  return false;
+}
+function rootName(node) {
+  let current = node;
+  for (let i = 0; i < 8 && current !== void 0; i += 1) {
+    if (current.type === "Identifier") return current.name;
+    if (current.type === "CallExpression") {
+      current = current.callee;
+      continue;
+    }
+    if (current.type === "MemberExpression") {
+      current = current.object;
+      continue;
+    }
+    break;
+  }
+  return void 0;
+}
+function propertyName(prop) {
+  if (prop.type !== "Property") return void 0;
+  const key = prop.key;
+  if (key.type === "Identifier") return key.name;
+  if (key.type === "Literal" && typeof key.value === "string") return key.value;
+  return void 0;
+}
+function fieldsOfObjectSchema(node) {
+  if (node.type !== "CallExpression" || calleeName(node) !== "object") return /* @__PURE__ */ new Set();
+  const root = rootName(node.callee);
+  if (root === void 0 || !SCHEMA_ROOT2.has(root)) return /* @__PURE__ */ new Set();
+  const arg = node.arguments[0];
+  if (arg === void 0 || arg.type !== "ObjectExpression") return /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const prop of arg.properties) {
+    if (prop.type !== "Property") continue;
+    const name = propertyName(prop);
+    if (name === void 0) continue;
+    if (mentions(prop.value, OPEN)) continue;
+    if (mentions(prop.value, PRIMITIVE)) fields.add(name);
+  }
+  return fields;
+}
+function decoratorName2(decorator) {
+  const expr = decorator.type === "Decorator" ? decorator.expression : decorator;
+  if (expr === void 0) return void 0;
+  if (expr.type === "CallExpression") return calleeName(expr);
+  if (expr.type === "Identifier") return expr.name;
+  return void 0;
+}
+function fieldsOfClass(node) {
+  if (node.type !== "ClassDeclaration" && node.type !== "ClassExpression") return /* @__PURE__ */ new Set();
+  if (node.body.type !== "ClassBody") return /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const element of node.body.body) {
+    if (element.type !== "PropertyDefinition") continue;
+    const key = element.key;
+    const name = key.type === "Identifier" ? key.name : void 0;
+    if (name === void 0) continue;
+    const decorators = element.decorators ?? [];
+    if (decorators.some((decorator) => PRIMITIVE.has(decoratorName2(decorator) ?? ""))) fields.add(name);
+  }
+  return fields;
+}
+function programOf(node) {
+  let current = node;
+  while (current !== void 0 && current.type !== "Program") current = parentOf(current);
+  return current;
+}
+function bindings(program) {
+  const map = /* @__PURE__ */ new Map();
+  walk(program, (node) => {
+    if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.init !== null && node.init !== void 0) {
+      const fields = fieldsOfObjectSchema(node.init);
+      if (fields.size > 0) map.set(node.id.name, fields);
+    }
+    if (node.type === "ClassDeclaration" && node.id !== null) {
+      const fields = fieldsOfClass(node);
+      if (fields.size > 0) map.set(node.id.name, fields);
+    }
+  });
+  return map;
+}
+function fieldsOfExpr(expr, known) {
+  if (expr.type === "Identifier") return new Set(known.get(expr.name) ?? []);
+  if (expr.type === "ClassExpression" || expr.type === "ClassDeclaration") return fieldsOfClass(expr);
+  const direct = fieldsOfObjectSchema(expr);
+  if (expr.type !== "CallExpression") return direct;
+  for (const arg of expr.arguments) {
+    if (arg.type === "SpreadElement") continue;
+    for (const name of fieldsOfExpr(arg, known)) direct.add(name);
+  }
+  return direct;
+}
+function isRouteCall2(node) {
+  if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return false;
+  const method = propName(node.callee);
+  if (method === void 0 || !ROUTE_METHODS.has(method)) return false;
+  return node.callee.object.type === "Identifier" && /^(app|router)$/i.test(node.callee.object.name);
+}
+function routeOf(node) {
+  let current = node;
+  while (current !== void 0) {
+    const parent = parentOf(current);
+    if (isFunctionNode(current) && parent !== void 0 && isRouteCall2(parent)) return parent;
+    current = parent;
+  }
+  return void 0;
+}
+function requestField(node) {
+  if (node.type !== "MemberExpression" || node.computed === true) return void 0;
+  const field = node.property.type === "Identifier" ? node.property.name : void 0;
+  if (field === void 0 || node.object.type !== "MemberExpression" || node.object.computed === true) return void 0;
+  const bag = node.object.property.type === "Identifier" ? node.object.property.name : void 0;
+  if (bag !== "body" && bag !== "query" && bag !== "params") return void 0;
+  if (node.object.object.type !== "Identifier" || node.object.object.name !== "req") return void 0;
+  return field;
+}
+function fieldsForRoute(route) {
+  const cached = routeCache.get(route);
+  if (cached !== void 0) return cached;
+  const program = programOf(route);
+  const known = program === void 0 ? /* @__PURE__ */ new Map() : bindingCache.get(program) ?? bindings(program);
+  if (program !== void 0) bindingCache.set(program, known);
+  const fields = /* @__PURE__ */ new Set();
+  if (route.type === "CallExpression") {
+    for (const arg of route.arguments) {
+      if (arg.type === "SpreadElement" || isFunctionNode(arg)) continue;
+      for (const name of fieldsOfExpr(arg, known)) fields.add(name);
+    }
+  }
+  routeCache.set(route, fields);
+  return fields;
+}
+function isValidatedRouteField(node) {
+  if (!validationEnabled()) return false;
+  const field = requestField(node);
+  if (field === void 0) return false;
+  const route = routeOf(node);
+  if (route === void 0) return false;
+  return fieldsForRoute(route).has(field);
+}
+var PRIMITIVE, OPEN, SCHEMA_ROOT2, ROUTE_METHODS, bindingCache, routeCache;
+var init_validation = __esm({
+  "src/modules/sast/validation.ts"() {
+    init_ast();
+    PRIMITIVE = /* @__PURE__ */ new Set(["string", "number", "boolean", "IsString", "IsNumber", "IsInt", "IsBoolean"]);
+    OPEN = /* @__PURE__ */ new Set(["any", "unknown", "object", "array", "record", "lazy", "union", "tuple"]);
+    SCHEMA_ROOT2 = /* @__PURE__ */ new Set(["z", "zod", "Joi", "joi"]);
+    ROUTE_METHODS = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
+    bindingCache = /* @__PURE__ */ new WeakMap();
+    routeCache = /* @__PURE__ */ new WeakMap();
+  }
+});
+
 // src/modules/sast/rules/nosqli.ts
 function objectKey(prop) {
   if (prop.type !== "Property" || prop.key === void 0) return void 0;
@@ -6043,6 +7312,7 @@ function isNosqlSafeValue(node, source, isNosqlSanitized) {
   if (isNosqlSanitized(node) || isCoercionCall(node) || isSchemaValidatorCall(node) || isMongoSanitizeCall(node)) {
     return true;
   }
+  if (isValidatedRouteField(node)) return true;
   return isSanitizeWrap(node, source);
 }
 function objectHasUnsafeTaintedValue(node, isTainted, isSafe) {
@@ -6064,6 +7334,7 @@ var init_nosqli = __esm({
   "src/modules/sast/rules/nosqli.ts"() {
     init_ast();
     init_taint();
+    init_validation();
     MONGO_SINKS = /* @__PURE__ */ new Set([
       "find",
       "findOne",
@@ -6134,6 +7405,14 @@ var init_nosqli = __esm({
               return;
             }
             if (middleware) return;
+            if (ctx.holdsBuiltFilter(filter)) {
+              ctx.report({
+                node,
+                message: "A Mongo filter built from request input is passed to the query.",
+                confidence: "medium"
+              });
+              return;
+            }
             if (objectHasUnsafeTaintedValue(filter, (n) => ctx.isTainted(n), isSafe)) {
               ctx.report({
                 node,
@@ -6335,7 +7614,7 @@ var init_sqli = __esm({
           CallExpression(node) {
             if (node.type !== "CallExpression" || !isSqlSink2(node)) return;
             const sql = node.arguments[0];
-            if (sql !== void 0 && sql.type !== "SpreadElement" && ctx.isTainted(sql)) {
+            if (sql !== void 0 && sql.type !== "SpreadElement" && ctx.isTainted(sql) && !ctx.isSqlCleared(sql)) {
               ctx.report({
                 node,
                 message: "Tainted input is concatenated into a SQL string passed to query/execute."
@@ -6499,27 +7778,27 @@ function numberLiteral(node) {
   return node.value;
 }
 function containsIdentMember(node, objectName) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
     if (child.type === "MemberExpression" && child.object.type === "Identifier" && child.object.name === objectName) {
-      hit = true;
+      hit2 = true;
     }
   });
-  return hit;
+  return hit2;
 }
 function containsCallNamed(node, name) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
-    if (child.type === "CallExpression" && calleeName(child) === name) hit = true;
+    if (child.type === "CallExpression" && calleeName(child) === name) hit2 = true;
   });
-  return hit;
+  return hit2;
 }
 function containsOriginalName(node) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
-    if (child.type === "MemberExpression" && propName(child) === "originalname") hit = true;
+    if (child.type === "MemberExpression" && propName(child) === "originalname") hit2 = true;
   });
-  return hit;
+  return hit2;
 }
 function schemaLooksSafe(schema) {
   if (schema === void 0) return false;
@@ -7137,162 +8416,18 @@ function scanPromptInjection(file, source) {
       line: index + 1,
       snippet: line.trim().slice(0, 120),
       message: "Code contains text attempting to manipulate AI reviewers.",
-      remediation: "Remove comments that try to instruct an AI reviewer.",
-      references: ["AI-INJECT-001"],
-      source: "deterministic"
-    });
-  });
-  return findings;
-}
-var PHRASES;
-var init_injection = __esm({
-  "src/ai/injection.ts"() {
-    init_finding();
-    PHRASES = [/ignore previous/i, /mark as safe/i, /ai reviewer/i];
-  }
-});
-
-// src/runtime/lru.ts
-var LruMap;
-var init_lru = __esm({
-  "src/runtime/lru.ts"() {
-    LruMap = class {
-      constructor(max) {
-        this.max = max;
-        if (max < 1) throw new Error("LruMap max must be >= 1");
-      }
-      max;
-      map = /* @__PURE__ */ new Map();
-      get size() {
-        return this.map.size;
-      }
-      has(key) {
-        return this.map.has(key);
-      }
-      get(key) {
-        if (!this.map.has(key)) return void 0;
-        const value = this.map.get(key);
-        this.map.delete(key);
-        this.map.set(key, value);
-        return value;
-      }
-      set(key, value) {
-        if (this.map.has(key)) this.map.delete(key);
-        this.map.set(key, value);
-        while (this.map.size > this.max) {
-          const oldest = this.map.keys().next().value;
-          if (oldest === void 0) break;
-          this.map.delete(oldest);
-        }
-        return this;
-      }
-    };
-  }
-});
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
-var init_version = __esm({
-  "src/core/version.ts"() {
-  }
-});
-function parsePoolEnabled() {
-  return process.env.FULLSHIELD_PARSE_POOL === "1";
-}
-function parsePoolSize() {
-  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
-  if (raw !== void 0 && raw !== "") {
-    const parsed = Number(raw);
-    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
-  }
-  return Math.min(2, Math.max(1, availableParallelism() - 1));
-}
-function workerMemoryMb() {
-  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
-  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
-  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
-  return 512;
-}
-function parseCacheKey(code) {
-  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
-}
-function parseOne(code) {
-  const key = parseCacheKey(code);
-  const hit = cache.get(key);
-  if (hit !== void 0) return Promise.resolve(hit);
-  return new Promise((resolve8, reject) => {
-    const worker = new Worker(fileURLToPath(workerUrl), {
-      workerData: { code },
-      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
-    });
-    let settled = false;
-    const finish = () => {
-      void worker.terminate();
-    };
-    const succeed = (ast) => {
-      if (settled) return;
-      settled = true;
-      cache.set(key, ast);
-      finish();
-      resolve8(ast);
-    };
-    const fail = (error) => {
-      if (settled) return;
-      settled = true;
-      finish();
-      reject(error);
-    };
-    worker.once("message", (ast) => {
-      succeed(ast);
-    });
-    worker.once("error", (error) => {
-      fail(error);
-    });
-    worker.once("exit", (code2) => {
-      if (settled) return;
-      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
+      remediation: "Remove comments that try to instruct an AI reviewer.",
+      references: ["AI-INJECT-001"],
+      source: "deterministic"
     });
   });
+  return findings;
 }
-async function parseWithPool(codes) {
-  const size = parsePoolSize();
-  const out = new Array(codes.length);
-  let next = 0;
-  async function run() {
-    for (; ; ) {
-      const index = next;
-      next += 1;
-      if (index >= codes.length) return;
-      const code = codes[index];
-      if (code === void 0) return;
-      out[index] = await parseOne(code);
-    }
-  }
-  const workers = Math.min(size, Math.max(1, codes.length));
-  await Promise.all(Array.from({ length: workers }, () => run()));
-  return out;
-}
-var workerUrl, cache;
-var init_parse_pool = __esm({
-  "src/core/parse-pool.ts"() {
-    init_lru();
-    init_version();
-    workerUrl = new URL("./parse-worker.mjs", import.meta.url);
-    cache = new LruMap(64);
+var PHRASES;
+var init_injection = __esm({
+  "src/ai/injection.ts"() {
+    init_finding();
+    PHRASES = [/ignore previous/i, /mark as safe/i, /ai reviewer/i];
   }
 });
 async function parseSource(code) {
@@ -7337,10 +8472,12 @@ function findingsFromAst(filename, source, ast, extraReturners2 = /* @__PURE__ *
         });
       },
       isTainted: (node) => nodeIsTainted(node, facts),
+      isSqlCleared: (node) => nodeIsSqlCleared(node, facts),
       isPathSanitized: (node) => nodeIsPathSanitized(node, facts),
       isSanitizedFor: (node, kind) => nodeIsSanitizedFor(node, facts, kind),
       isNosqlSanitized: (node) => nodeIsNosqlSanitized(node, facts),
       isRequestObject: (node) => nodeIsRequestObject(node, facts),
+      holdsBuiltFilter: (node) => nodeHoldsBuiltFilter(node, facts),
       functionHasPasswordName: (node) => factsFor(node, facts).hasPasswordName,
       assignedName: (node) => assignedNameOf(node),
       projectCsrfProtected
@@ -7378,10 +8515,12 @@ function findingsFromTemplate(filename, source) {
       });
     },
     isTainted: () => false,
+    isSqlCleared: () => false,
     isPathSanitized: () => false,
     isSanitizedFor: () => false,
     isNosqlSanitized: () => false,
     isRequestObject: () => false,
+    holdsBuiltFilter: () => false,
     functionHasPasswordName: () => false,
     assignedName: () => void 0,
     projectCsrfProtected: false
@@ -7513,7 +8652,7 @@ async function runSastStreaming(ctx) {
     }
     const ast = await parseCode(source);
     if (ast === void 0) continue;
-    returning.set(rel, functionsThatReturnTaint(ast));
+    returning.set(rel, taintSummariesEnabled() ? cachedReturners(source, ast) : functionsThatReturnTaint(ast));
     parseable.push(rel);
     fileSet.add(rel);
   }
@@ -7547,6 +8686,7 @@ var init_engine = __esm({
     init_finding();
     init_ast();
     init_interproc();
+    init_summaries();
     init_taint();
     init_auth();
     init_cmdi();
@@ -7582,48 +8722,69 @@ var init_engine = __esm({
     sastModule = {
       name: "sast",
       async run(ctx) {
-        const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
-        if (candidates.length > sastStreamThreshold()) return runSastStreaming(ctx);
-        const maxBytes = ctx.config.sast.maxFileBytes;
-        const findings = [];
-        const parsed = [];
-        for (const rel of candidates) {
-          const source = await readScanSource(ctx.cwd, rel);
-          if (source === void 0) continue;
-          const why = skipReason(source, maxBytes);
-          if (why !== void 0) {
-            findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
-            continue;
+        if (process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1") {
+          const sources = new Set((ctx.config.sast.sources ?? []).map((row) => row.callee));
+          const sanitizers = /* @__PURE__ */ new Map();
+          for (const row of ctx.config.sast.sanitizers ?? []) {
+            const classes = sanitizers.get(row.callee) ?? /* @__PURE__ */ new Set();
+            for (const name of row.clears) classes.add(name);
+            sanitizers.set(row.callee, classes);
           }
-          if (TEMPLATE_EXT.test(rel)) {
-            findings.push(...findingsFromTemplate(rel, source));
-            continue;
-          }
-          const ast = await parseCode(source);
-          if (ast === void 0) continue;
-          parsed.push({ file: rel, source, ast });
-        }
-        const files = new Set(parsed.map((p) => p.file));
-        const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
-        const returning = /* @__PURE__ */ new Map();
-        for (const entry of parsed) {
-          returning.set(entry.file, functionsThatReturnTaint(entry.ast));
+          setCustomTaint({ sources, sanitizers });
+        } else {
+          setCustomTaint(void 0);
         }
-        for (const entry of parsed) {
-          findings.push(
-            ...findingsFromAst(
+        setTaintSummaryConfig(taintSummariesEnabled() ? ctx.config : void 0);
+        try {
+          const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
+          if (candidates.length > sastStreamThreshold()) return await runSastStreaming(ctx);
+          const maxBytes = ctx.config.sast.maxFileBytes;
+          const findings = [];
+          const parsed = [];
+          for (const rel of candidates) {
+            const source = await readScanSource(ctx.cwd, rel);
+            if (source === void 0) continue;
+            const why = skipReason(source, maxBytes);
+            if (why !== void 0) {
+              findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+              continue;
+            }
+            if (TEMPLATE_EXT.test(rel)) {
+              findings.push(...findingsFromTemplate(rel, source));
+              continue;
+            }
+            const ast = await parseCode(source);
+            if (ast === void 0) continue;
+            parsed.push({ file: rel, source, ast });
+          }
+          const files = new Set(parsed.map((p) => p.file));
+          const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
+          const returning = /* @__PURE__ */ new Map();
+          for (const entry of parsed) {
+            returning.set(
               entry.file,
-              entry.source,
-              entry.ast,
-              extraReturners(entry.file, entry.ast, files, returning),
-              projectCsrf
-            )
-          );
+              taintSummariesEnabled() ? cachedReturners(entry.source, entry.ast) : functionsThatReturnTaint(entry.ast)
+            );
+          }
+          for (const entry of parsed) {
+            findings.push(
+              ...findingsFromAst(
+                entry.file,
+                entry.source,
+                entry.ast,
+                extraReturners(entry.file, entry.ast, files, returning),
+                projectCsrf
+              )
+            );
+          }
+          findings.push(...runInterproc(parsed));
+          const out = dedupeSastSinks(findings);
+          releaseParsed(parsed);
+          return out;
+        } finally {
+          setCustomTaint(void 0);
+          setTaintSummaryConfig(void 0);
         }
-        findings.push(...runInterproc(parsed));
-        const out = dedupeSastSinks(findings);
-        releaseParsed(parsed);
-        return out;
       }
     };
   }
@@ -8007,7 +9168,7 @@ function scanTextForSecretHits(path, text) {
   return hits;
 }
 function scanTextForSecrets(path, text) {
-  return scanTextForSecretHits(path, text).map((hit) => hit.finding);
+  return scanTextForSecretHits(path, text).map((hit2) => hit2.finding);
 }
 var secretsRules, REMEDIATION, MAX_FILE_SIZE, secretsModule;
 var init_secrets = __esm({
@@ -8363,12 +9524,12 @@ ${text}`);
   const seeds = fixtureLogic(prompt);
   const findings = [];
   for (const seed of seeds) {
-    const hit = fileTexts.find((f) => f.file.includes(seed.fileHint) && f.text.includes(seed.fileHint === "user" ? "findById" : "Object.assign")) ?? fileTexts.find(
+    const hit2 = fileTexts.find((f) => f.file.includes(seed.fileHint) && f.text.includes(seed.fileHint === "user" ? "findById" : "Object.assign")) ?? fileTexts.find(
       (f) => f.text.includes(seed.ruleId === "AI-IDOR-001" ? "findById(req.params.id)" : "Object.assign(user, req.body)")
     );
-    if (hit === void 0) continue;
-    const line = hit.text.split(/\r?\n/).findIndex((l) => l.includes(seed.ruleId === "AI-IDOR-001" ? "findById" : "Object.assign")) + 1;
-    findings.push(asAiFinding(seed, hit.file, line > 0 ? line : 1));
+    if (hit2 === void 0) continue;
+    const line = hit2.text.split(/\r?\n/).findIndex((l) => l.includes(seed.ruleId === "AI-IDOR-001" ? "findById" : "Object.assign")) + 1;
+    findings.push(asAiFinding(seed, hit2.file, line > 0 ? line : 1));
   }
   return findings;
 }
@@ -8626,6 +9787,40 @@ var init_baseline = __esm({
   "src/core/baseline.ts"() {
   }
 });
+function parseSastSources(value, source) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new ConfigError(`${source}: "sast.sources" must be an array`);
+  return value.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new ConfigError(`${source}: "sast.sources" entries must be objects`);
+    }
+    const row = item;
+    if (typeof row.callee !== "string" || row.callee.length === 0) {
+      throw new ConfigError(`${source}: "sast.sources[].callee" must be a string`);
+    }
+    if (row.returns !== "tainted") {
+      throw new ConfigError(`${source}: "sast.sources[].returns" must be "tainted"`);
+    }
+    return { callee: row.callee, returns: "tainted" };
+  });
+}
+function parseSastSanitizers(value, source) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new ConfigError(`${source}: "sast.sanitizers" must be an array`);
+  return value.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new ConfigError(`${source}: "sast.sanitizers" entries must be objects`);
+    }
+    const row = item;
+    if (typeof row.callee !== "string" || row.callee.length === 0) {
+      throw new ConfigError(`${source}: "sast.sanitizers[].callee" must be a string`);
+    }
+    if (!Array.isArray(row.clears) || row.clears.some((name) => typeof name !== "string" || !SAST_CLASSES.has(name))) {
+      throw new ConfigError(`${source}: "sast.sanitizers[].clears" must be B4 class names`);
+    }
+    return { callee: row.callee, clears: row.clears.filter((name) => name !== "secrets" && name !== "deps") };
+  });
+}
 function validate(raw, source) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new ConfigError(`${source}: config must be a JSON object`);
@@ -8751,6 +9946,16 @@ function validate(raw, source) {
       }
       sast.maxFileBytes = rawSast.maxFileBytes;
     }
+    const custom = process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1";
+    if (!custom && (rawSast.sources !== void 0 || rawSast.sanitizers !== void 0)) {
+      throw new ConfigError(
+        `${source}: unknown key "sast.sources" (FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS)`
+      );
+    }
+    if (custom) {
+      sast.sources = parseSastSources(rawSast.sources, source);
+      sast.sanitizers = parseSastSanitizers(rawSast.sanitizers, source);
+    }
     out.sast = sast;
   }
   return out;
@@ -8778,7 +9983,7 @@ async function loadConfig(cwd, configPath) {
   }
   return { ...structuredClone(DEFAULT_CONFIG), ...validate(raw, file) };
 }
-var CONFIG_FILE_NAME, DEFAULT_CONFIG, ConfigError, KNOWN_KEYS;
+var CONFIG_FILE_NAME, DEFAULT_CONFIG, ConfigError, KNOWN_KEYS, SAST_CLASSES;
 var init_config2 = __esm({
   "src/core/config.ts"() {
     init_finding();
@@ -8808,6 +10013,22 @@ var init_config2 = __esm({
       "ai",
       "sast"
     ]);
+    SAST_CLASSES = /* @__PURE__ */ new Set([
+      "sqli",
+      "nosqli",
+      "cmdi",
+      "path",
+      "xss",
+      "ssrf",
+      "redirect",
+      "eval",
+      "jwt",
+      "crypto",
+      "proto",
+      "secrets",
+      "deps",
+      "config"
+    ]);
   }
 });
 async function walkFiles(options) {
@@ -9197,13 +10418,13 @@ async function readBlob(cwd, hash) {
     return void 0;
   }
 }
-function remapHit(hit, file) {
-  const snippet = hit.finding.snippet;
-  const line = hit.finding.line ?? 0;
-  const id = makeFindingId(hit.finding.ruleId, file, `${line}|${snippet ?? "file"}`);
+function remapHit(hit2, file) {
+  const snippet = hit2.finding.snippet;
+  const line = hit2.finding.line ?? 0;
+  const id = makeFindingId(hit2.finding.ruleId, file, `${line}|${snippet ?? "file"}`);
   return {
-    finding: { ...hit.finding, id, file },
-    secret: hit.secret
+    finding: { ...hit2.finding, id, file },
+    secret: hit2.secret
   };
 }
 function historyCommitLimit(raw = process.env.FULLSHIELD_HISTORY_MAX) {
@@ -9293,8 +10514,8 @@ async function headSecretKeys(cwd) {
       hits = scanTextForSecretHits(path, text);
       seen.set(hash, hits);
     }
-    for (const hit of hits) {
-      keys.add(`${hit.finding.ruleId}\0${hit.finding.snippet ?? ""}`);
+    for (const hit2 of hits) {
+      keys.add(`${hit2.finding.ruleId}\0${hit2.finding.snippet ?? ""}`);
     }
   }
   return keys;
@@ -9327,8 +10548,8 @@ async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
       hits2 = rawHits.filter((h) => allowed.has(h.finding.id));
       blobHits.set(change.hash, hits2);
     }
-    for (const hit of hits2) {
-      const mapped = remapHit(hit, change.path);
+    for (const hit2 of hits2) {
+      const mapped = remapHit(hit2, change.path);
       if (!first.has(mapped.finding.id)) {
         first.set(mapped.finding.id, { hit: mapped, commit: change.commit });
       }
@@ -9336,11 +10557,11 @@ async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
   }
   const atHead = await headSecretKeys(cwd);
   const hits = [];
-  for (const { hit, commit } of first.values()) {
-    const stillAtHead = atHead.has(`${hit.finding.ruleId}\0${hit.finding.snippet ?? ""}`);
+  for (const { hit: hit2, commit } of first.values()) {
+    const stillAtHead = atHead.has(`${hit2.finding.ruleId}\0${hit2.finding.snippet ?? ""}`);
     hits.push({
-      finding: { ...hit.finding, introducedIn: commit, stillAtHead },
-      secret: hit.secret
+      finding: { ...hit2.finding, introducedIn: commit, stillAtHead },
+      secret: hit2.secret
     });
   }
   const scanned = Math.min(maxCommits, total);
@@ -9582,15 +10803,15 @@ function providerFor(ruleId, secret) {
 async function verifySecretHits(hits, options = {}) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const out = [];
-  for (const hit of hits) {
-    const secret = hit.secret;
+  for (const hit2 of hits) {
+    const secret = hit2.secret;
     if (secret === void 0 || secret.length === 0) {
-      out.push({ finding: { ...hit.finding, verification: "unknown" }, secret: hit.secret });
+      out.push({ finding: { ...hit2.finding, verification: "unknown" }, secret: hit2.secret });
       continue;
     }
-    const run = providerFor(hit.finding.ruleId, secret);
+    const run = providerFor(hit2.finding.ruleId, secret);
     const verification = run === void 0 ? "unknown" : await run(secret, fetchImpl);
-    out.push({ finding: { ...hit.finding, verification }, secret: hit.secret });
+    out.push({ finding: { ...hit2.finding, verification }, secret: hit2.secret });
   }
   return out;
 }
@@ -9623,6 +10844,8 @@ function dedupe2(findings) {
 async function runScan(options = {}, modules = builtinModules) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const t0 = performance.now();
+  depsModule.unusedDirect = void 0;
+  depsModule.upgradePlan = void 0;
   const cwd = resolve(options.cwd ?? process.cwd());
   const stats = await stat(cwd).catch(() => null);
   if (stats === null || !stats.isDirectory()) {
@@ -9721,8 +10944,8 @@ async function runScan(options = {}, modules = builtinModules) {
     const { applyVerification: applyVerification2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
     const { scanTextForSecretHits: scanTextForSecretHits2 } = await Promise.resolve().then(() => (init_secrets(), secrets_exports));
     const secretById = /* @__PURE__ */ new Map();
-    for (const hit of extraHits) {
-      if (hit.secret !== void 0) secretById.set(hit.finding.id, hit.secret);
+    for (const hit2 of extraHits) {
+      if (hit2.secret !== void 0) secretById.set(hit2.finding.id, hit2.secret);
     }
     for (const finding6 of findings) {
       if (finding6.module !== "secrets" || finding6.file === void 0 || secretById.has(finding6.id)) {
@@ -9736,8 +10959,8 @@ async function runScan(options = {}, modules = builtinModules) {
           continue;
         }
       }
-      for (const hit of scanTextForSecretHits2(finding6.file, text)) {
-        if (hit.secret !== void 0) secretById.set(hit.finding.id, hit.secret);
+      for (const hit2 of scanTextForSecretHits2(finding6.file, text)) {
+        if (hit2.secret !== void 0) secretById.set(hit2.finding.id, hit2.secret);
       }
     }
     findings = sortFindings(
@@ -9789,7 +11012,9 @@ async function runScan(options = {}, modules = builtinModules) {
       filesScanned: files.length,
       modulesRequested: [...modulesRequested],
       modulesRun,
-      ...historyNotice !== void 0 ? { history: historyNotice } : {}
+      ...historyNotice !== void 0 ? { history: historyNotice } : {},
+      ...depsModule.unusedDirect !== void 0 ? { unusedDirect: depsModule.unusedDirect } : {},
+      ...depsModule.upgradePlan !== void 0 ? { upgradePlan: depsModule.upgradePlan } : {}
     },
     config,
     policy: policyResult,
@@ -9934,6 +11159,16 @@ function validateCycloneDx15(doc) {
   if (!Array.isArray(root.components)) errors.push("components must be an array");
   return errors;
 }
+function reachProperties(finding6) {
+  const properties = [
+    { name: "fullshield:reachability", value: finding6.reachability ?? "unspecified" },
+    { name: "fullshield:devOnly", value: finding6.message.includes("(dev-only)") ? "true" : "false" }
+  ];
+  if (finding6.dependencyPath !== void 0 && finding6.dependencyPath.length > 0) {
+    properties.splice(1, 0, { name: "fullshield:dependencyPath", value: finding6.dependencyPath.join(" > ") });
+  }
+  return properties;
+}
 function renderCycloneDx(input) {
   const vulns = (input.findings ?? []).filter((f) => f.ruleId === "DEPS-VULN-001");
   return {
@@ -9944,13 +11179,18 @@ function renderCycloneDx(input) {
     metadata: {
       component: { type: "application", name: input.name, version: input.version }
     },
-    components: input.components.map((c) => ({
-      type: "library",
-      name: c.name,
-      version: c.version,
-      purl: c.purl ?? `pkg:npm/${encodeURIComponent(c.name)}@${c.version}`,
-      ...c.license !== void 0 ? { licenses: [{ license: { id: c.license } }] } : {}
-    })),
+    components: input.components.map((c) => {
+      const match = (input.findings ?? []).find((finding6) => finding6.snippet?.startsWith(`${c.name}@`));
+      const properties = input.includeReach === true && match !== void 0 ? reachProperties(match) : void 0;
+      return {
+        type: "library",
+        name: c.name,
+        version: c.version,
+        purl: c.purl ?? `pkg:npm/${encodeURIComponent(c.name)}@${c.version}`,
+        ...c.license !== void 0 ? { licenses: [{ license: { id: c.license } }] } : {},
+        ...properties !== void 0 ? { properties } : {}
+      };
+    }),
     vulnerabilities: vulns.map((f) => ({
       id: f.references?.find((r) => r.startsWith("GHSA-") || r.startsWith("CVE-")) ?? f.id,
       description: f.message,
@@ -10339,6 +11579,10 @@ var init_compliance = __esm({
       ROW("SUPPLY-PROVENANCE-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("SUPPLY-WORM-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3 / 12.10"),
       ROW("SUPPLY-WORKFLOW-001", "A08:2021 Integrity Failures", "CWE-829", "V14.2.3", "PCI DSS 6.3.3"),
+      ROW("SUPPLY-CHAINC2-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3"),
+      ROW("SUPPLY-STEALER-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 12.10"),
+      ROW("SUPPLY-PLATFORMGATE-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
+      ROW("SUPPLY-SECHOLDER-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("IAC-GHA-UNPINNED-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("IAC-GHA-PRTARGET-001", "A01:2021 Broken Access Control", "CWE-269", "V4.1.1", "PCI DSS 7.2"),
       ROW("IAC-GHA-PERMS-001", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),
@@ -10723,9 +11967,9 @@ async function callMcpTool(session, name, args = {}) {
     return { findings: session.findings };
   }
   if (name === "explain_finding") {
-    const hit = session.findings.find((f) => f.ruleId === args.ruleId);
-    if (!hit) return { text: `no finding ${args.ruleId}` };
-    return { text: `${hit.title}: ${hit.message} ${hit.remediation}` };
+    const hit2 = session.findings.find((f) => f.ruleId === args.ruleId);
+    if (!hit2) return { text: `no finding ${args.ruleId}` };
+    return { text: `${hit2.title}: ${hit2.message} ${hit2.remediation}` };
   }
   if (name === "propose_fix") {
     return proposeOnly(session, args.ruleId);
@@ -10736,25 +11980,25 @@ async function callMcpTool(session, name, args = {}) {
   return { error: `unknown tool ${name}` };
 }
 function proposeOnly(session, ruleId) {
-  const hit = session.findings.find((f) => f.ruleId === ruleId);
-  if (!hit?.file || !session.cwd) return { diff: "", wrote: false };
-  const abs = join(session.cwd, hit.file);
+  const hit2 = session.findings.find((f) => f.ruleId === ruleId);
+  if (!hit2?.file || !session.cwd) return { diff: "", wrote: false };
+  const abs = join(session.cwd, hit2.file);
   const source = readFileSync(abs, "utf8");
-  const proposal = proposeFix(hit, source);
+  const proposal = proposeFix(hit2, source);
   return { diff: proposal?.diff ?? "", wrote: false };
 }
 function verifyInTemp(session, ruleId) {
-  const hit = session.findings.find((f) => f.ruleId === ruleId);
-  if (!hit?.file || !session.cwd) return { originalUntouched: true, tempApplied: false };
-  const original = join(session.cwd, hit.file);
+  const hit2 = session.findings.find((f) => f.ruleId === ruleId);
+  if (!hit2?.file || !session.cwd) return { originalUntouched: true, tempApplied: false };
+  const original = join(session.cwd, hit2.file);
   const before = readFileSync(original, "utf8");
   const mtime = statSync(original).mtimeMs;
-  const proposal = proposeFix(hit, before);
+  const proposal = proposeFix(hit2, before);
   if (!proposal?.diff) return { originalUntouched: true, tempApplied: false };
   const tmp = mkdtempSync(join(tmpdir(), "fullshield-mcp-verify-"));
   try {
     cpSync(session.cwd, tmp, { recursive: true });
-    const copy = join(tmp, hit.file);
+    const copy = join(tmp, hit2.file);
     const next = applyUnifiedDiff(readFileSync(copy, "utf8"), proposal.diff);
     writeFileSync(copy, next);
     const untouched = readFileSync(original, "utf8") === before && statSync(original).mtimeMs === mtime;
@@ -10978,16 +12222,16 @@ async function confirmTarget(baseUrl, opts) {
     try {
       if (route.kind === "idor") {
         const url2 = `${origin}${route.path}`;
-        const hit2 = await probe(fetchImpl, url2, route.method, void 0, {
+        const hit3 = await probe(fetchImpl, url2, route.method, void 0, {
           "x-user": route.asUser ?? opts.users?.b ?? "bob"
         });
         const owner = route.expectOwner ?? opts.users?.a ?? "alice";
-        const confirmed2 = hit2.ok && hit2.text.includes(owner);
+        const confirmed2 = hit3.ok && hit3.text.includes(owner);
         confirmations.push({
           kind: "idor",
           status: confirmed2 ? "confirmed" : "unconfirmed",
           proof: curlProof(route.method, url2, `-H 'x-user: ${route.asUser ?? "bob"}' `),
-          detail: hit2.text.slice(0, 200)
+          detail: hit3.text.slice(0, 200)
         });
         continue;
       }
@@ -11000,13 +12244,13 @@ async function confirmTarget(baseUrl, opts) {
       } else {
         body = { [param]: payload };
       }
-      const hit = await probe(fetchImpl, url, route.method, body);
-      const confirmed = hit.text.includes(token) || route.kind === "path" && hit.text.includes("FULLSHIELD_CANARY");
+      const hit2 = await probe(fetchImpl, url, route.method, body);
+      const confirmed = hit2.text.includes(token) || route.kind === "path" && hit2.text.includes("FULLSHIELD_CANARY");
       confirmations.push({
         kind: route.kind,
         status: confirmed ? "confirmed" : "unconfirmed",
         proof: curlProof(route.method, url),
-        detail: hit.text.slice(0, 200)
+        detail: hit2.text.slice(0, 200)
       });
     } catch (err) {
       confirmations.push({
@@ -11284,14 +12528,16 @@ function openVexStatement(finding6) {
     vulnerability: { name: vulnName(finding6) },
     products: [{ "@id": npmPurl(finding6.snippet) }]
   };
+  const detail = process.env.FULLSHIELD_EXPERIMENTAL_SBOM_REACH === "1" && finding6.reachabilityEvidence?.reason !== void 0 ? { detail: finding6.reachabilityEvidence.reason } : {};
   if (notImported(finding6)) {
     return {
       ...base,
       status: "not_affected",
-      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION
+      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION,
+      ...detail
     };
   }
-  return { ...base, status: "under_investigation" };
+  return { ...base, status: "under_investigation", ...detail };
 }
 function buildOpenVex(findings) {
   const statements = depFindings(findings).map(openVexStatement);
@@ -11579,6 +12825,28 @@ async function runFix(options = {}) {
     const after = applyUnifiedDiff(source, proposed.diff);
     byFile.set(sourceFile, after);
   }
+  const unused = result.metadata.unusedDirect?.packages ?? [];
+  if (unused.length > 0) {
+    let manifest = byFile.get("package.json");
+    if (manifest === void 0) {
+      try {
+        manifest = await readFile(join(cwd, "package.json"), "utf8");
+      } catch {
+        manifest = void 0;
+      }
+    }
+    if (manifest !== void 0) {
+      const next = removeDirectDependencies(manifest, unused);
+      const diff = dependencyRemovalDiff(manifest, unused);
+      if (diff.length > 0) {
+        patches.push({ file: "package.json", ruleId: "DEPS-VULN-001", safe: false, diff });
+        if (options.unsafe === true) {
+          byFile.set("package.json", next);
+          appliedOverride = true;
+        }
+      }
+    }
+  }
   const notice = appliedOverride ? "run npm install" : void 0;
   if (options.apply !== true) {
     return { applied: false, reverted: false, patches, findings: result.findings, notice };
@@ -11626,6 +12894,29 @@ async function restoreSnapshots(cwd, snapshots) {
     }
   }
 }
+function dependencyRemovalDiff(manifest, names) {
+  const drop = names.map((name) => `"${name}"`);
+  const removed = manifest.split("\n").filter((line) => drop.some((token) => line.includes(token)));
+  if (removed.length === 0) return "";
+  return ["--- a/package.json", "+++ b/package.json", ...removed.map((line) => `-${line}`)].join("\n");
+}
+function removeDirectDependencies(manifest, names) {
+  let parsed;
+  try {
+    parsed = JSON.parse(manifest);
+  } catch {
+    return manifest;
+  }
+  if (parsed.dependencies === void 0 || typeof parsed.dependencies !== "object") return manifest;
+  const drop = new Set(names);
+  const next = {};
+  for (const [name, version] of Object.entries(parsed.dependencies)) {
+    if (!drop.has(name)) next[name] = version;
+  }
+  parsed.dependencies = next;
+  const trailing = manifest.endsWith("\n") ? "\n" : "";
+  return `${JSON.stringify(parsed, null, 2)}${trailing}`;
+}
 function runProjectTests(cwd) {
   let pkg;
   try {
@@ -11994,7 +13285,159 @@ function renderFinding(finding6) {
   }
   return lines;
 }
-function renderConsoleReport(input) {
+var SEVERITY_RANK = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3,
+  info: 4
+};
+var SHOWN_VULN_REACH = /* @__PURE__ */ new Set([
+  "reachable",
+  "symbol-reachable",
+  "reachable-via-dependency",
+  "reachability-unknown"
+]);
+function packageNameFromSnippet3(snippet) {
+  if (snippet === void 0 || snippet.length === 0) return void 0;
+  if (snippet.startsWith("@")) {
+    const second = snippet.indexOf("@", 1);
+    return second === -1 ? snippet : snippet.slice(0, second);
+  }
+  const at = snippet.indexOf("@");
+  return at <= 0 ? snippet : snippet.slice(0, at);
+}
+function versionsFromSnippet(snippet) {
+  const name = packageNameFromSnippet3(snippet);
+  if (name === void 0 || snippet === void 0) return [];
+  const rest = snippet.slice(name.length + 1);
+  return rest.length === 0 ? [] : rest.split(",").filter((version) => version.length > 0);
+}
+function isDevOnly2(finding6) {
+  return finding6.message.includes("(dev-only)");
+}
+function isActionable(finding6) {
+  if (finding6.ruleId === "DEPS-MALICIOUS-001") return true;
+  if (finding6.ruleId === "DEPS-VULN-001") {
+    if (isDevOnly2(finding6)) return false;
+    return finding6.reachability !== void 0 && SHOWN_VULN_REACH.has(finding6.reachability);
+  }
+  if (finding6.module === "sast" || finding6.module === "secrets" || finding6.module === "config") {
+    return finding6.severity === "high" || finding6.severity === "critical" || finding6.confidence === "high";
+  }
+  return false;
+}
+function reachRank(finding6) {
+  const reachability = finding6.reachability;
+  if (reachability === "reachable" || reachability === "symbol-reachable") return 0;
+  if (reachability === "reachable-via-dependency") return 1;
+  if (reachability === "reachability-unknown") return 2;
+  if (reachability === void 0) return 4;
+  return 3;
+}
+function compareActionable(a, b) {
+  const maliciousA = a.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+  const maliciousB = b.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+  return maliciousA - maliciousB || SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || reachRank(a) - reachRank(b) || (a.file ?? "").localeCompare(b.file ?? "") || (a.line ?? 0) - (b.line ?? 0) || a.ruleId.localeCompare(b.ruleId);
+}
+function highestSeverity(findings) {
+  return findings.reduce(
+    (best, finding6) => SEVERITY_RANK[finding6.severity] < SEVERITY_RANK[best] ? finding6.severity : best,
+    findings[0]?.severity ?? "info"
+  );
+}
+function bestReachability(findings) {
+  let best;
+  let bestRank = 5;
+  for (const finding6 of findings) {
+    const rank = reachRank(finding6);
+    if (finding6.reachability !== void 0 && rank < bestRank) {
+      best = finding6.reachability;
+      bestRank = rank;
+    }
+  }
+  return best;
+}
+function shownConsoleRows(findings) {
+  return dependencyRows(findings.filter(isActionable));
+}
+function dependencyRows(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  const singles = [];
+  for (const finding6 of findings) {
+    const name = packageNameFromSnippet3(finding6.snippet);
+    if ((finding6.ruleId === "DEPS-VULN-001" || finding6.ruleId === "DEPS-MALICIOUS-001") && name !== void 0) {
+      const list = groups.get(name);
+      if (list === void 0) groups.set(name, [finding6]);
+      else list.push(finding6);
+    } else {
+      singles.push(finding6);
+    }
+  }
+  const rows = singles.map((finding6) => ({
+    findings: [finding6],
+    severity: finding6.severity,
+    reachability: finding6.reachability,
+    ruleId: finding6.ruleId,
+    file: finding6.file,
+    line: finding6.line,
+    versions: [],
+    grouped: false
+  }));
+  for (const [packageName, list] of groups) {
+    const ordered = [...list].sort(compareActionable);
+    const first = ordered[0];
+    if (first === void 0) continue;
+    const versions = [...new Set(list.flatMap((finding6) => versionsFromSnippet(finding6.snippet)))].sort();
+    const malicious = list.find((finding6) => finding6.ruleId === "DEPS-MALICIOUS-001");
+    rows.push({
+      findings: ordered,
+      severity: highestSeverity(list),
+      reachability: bestReachability(list),
+      ruleId: malicious?.ruleId ?? "DEPS-VULN-001",
+      file: first.file,
+      line: first.line,
+      packageName,
+      versions,
+      path: first.dependencyPath,
+      grouped: true
+    });
+  }
+  rows.sort((a, b) => {
+    const probeA = a.findings[0];
+    const probeB = b.findings[0];
+    if (probeA === void 0 || probeB === void 0) return 0;
+    const maliciousA = a.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+    const maliciousB = b.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+    return maliciousA - maliciousB || SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || reachRank({ ...probeA, reachability: a.reachability }) - reachRank({ ...probeB, reachability: b.reachability }) || (a.file ?? "").localeCompare(b.file ?? "") || (a.line ?? 0) - (b.line ?? 0) || a.ruleId.localeCompare(b.ruleId);
+  });
+  return rows;
+}
+function renderRow(row) {
+  if (!row.grouped) {
+    const only = row.findings[0];
+    if (only === void 0) return [];
+    return [...renderFinding(only), `    docs: rules/${only.ruleId}.md`];
+  }
+  const reach = row.reachability ?? "unspecified";
+  const lines = [
+    `  ${pc.bold(`[${row.ruleId}]`)} ${row.packageName} \u2014 ${row.findings.length} advisories, ${row.severity}, ${reach}`,
+    `    versions: ${row.versions.join(", ") || "unknown"}`
+  ];
+  if (row.path !== void 0 && row.path.length > 0) {
+    lines.push(`    path: ${row.path.join(" > ")}`);
+  }
+  if (row.file !== void 0) {
+    lines.push(`    ${row.file}${row.line !== void 0 ? `:${row.line}` : ""}`);
+  }
+  const evidenceImport = row.findings[0]?.reachabilityEvidence?.imports[0];
+  if (evidenceImport !== void 0) {
+    lines.push(`    import: ${evidenceImport.file}:${evidenceImport.line} ${evidenceImport.specifier}`);
+  }
+  lines.push(`    docs: rules/${row.ruleId}.md`);
+  return lines;
+}
+function renderConsoleReport(input, options = {}) {
   const result = redactScan(input);
   const { findings, summary, metadata } = result;
   const lines = [];
@@ -12004,34 +13447,63 @@ function renderConsoleReport(input) {
     )
   );
   if (metadata.history !== void 0) lines.push(metadata.history);
+  if (metadata.upgradePlan !== void 0 && metadata.upgradePlan.sentence.length > 0) {
+    lines.push(metadata.upgradePlan.sentence);
+  }
+  if (metadata.unusedDirect !== void 0) {
+    const count = metadata.unusedDirect.packages.length;
+    const advisories = metadata.unusedDirect.advisories;
+    const packageWord = count === 1 ? "package is" : "packages are";
+    const advisoryWord = advisories === 1 ? "advisory" : "advisories";
+    lines.push(
+      `${count} ${packageWord} never imported; removing them clears ${advisories} ${advisoryWord}.`
+    );
+  }
   if (metadata.modulesRun.length < metadata.modulesRequested.length) {
     const pending = metadata.modulesRequested.filter((m) => !metadata.modulesRun.includes(m));
     lines.push(
       pc.dim(`note: requested modules not implemented yet: ${pending.join(", ")}`)
     );
   }
-  const bySeverityDesc = [...SEVERITIES].reverse();
-  const ordered = bySeverityDesc.flatMap((severity) => findings.filter((f) => f.severity === severity));
-  const shown = ordered.slice(0, 10);
-  const hidden = ordered.length - shown.length;
-  for (const severity of bySeverityDesc) {
-    const group = shown.filter((f) => f.severity === severity);
-    if (group.length === 0) continue;
-    lines.push("");
-    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${findings.filter((f) => f.severity === severity).length})`));
-    for (const finding6 of group) {
-      lines.push(...renderFinding(finding6));
-      lines.push(`    docs: rules/${finding6.ruleId}.md`);
+  const showAll = options.all === true;
+  const folded = findings.filter((finding6) => !isActionable(finding6));
+  const rows = showAll ? [...findings].sort(compareActionable).map((finding6) => ({
+    findings: [finding6],
+    severity: finding6.severity,
+    reachability: finding6.reachability,
+    ruleId: finding6.ruleId,
+    file: finding6.file,
+    line: finding6.line,
+    versions: [],
+    grouped: false
+  })) : shownConsoleRows(findings);
+  const printed = showAll ? rows : rows.slice(0, 20);
+  const hiddenActionable = showAll ? 0 : rows.length - printed.length;
+  let previous;
+  for (const row of printed) {
+    if (row.severity !== previous) {
+      const count = printed.filter((item) => item.severity === row.severity).length;
+      lines.push("");
+      lines.push(SEVERITY_COLOR[row.severity](`${row.severity.toUpperCase()} (${count})`));
+      previous = row.severity;
     }
+    lines.push(...renderRow(row));
+  }
+  if (hiddenActionable > 0) {
+    lines.push("");
+    lines.push(`${hiddenActionable} more actionable \u2014 use --json`);
   }
-  if (hidden > 0) {
+  if (!showAll && folded.length > 0) {
     lines.push("");
-    lines.push(`${hidden} more \u2014 use --json`);
+    lines.push(
+      `${folded.length} more (not directly reachable, or below high confidence) \u2014 --all or see JSON`
+    );
   }
   lines.push("");
   if (summary.total === 0) {
     lines.push(pc.green("\u2714 No findings."));
   } else {
+    const bySeverityDesc = [...SEVERITIES].reverse();
     const counts = bySeverityDesc.filter((s) => summary.bySeverity[s] > 0).map((s) => `${summary.bySeverity[s]} ${s}`).join(", ");
     lines.push(pc.red(`\u2716 ${summary.total} finding(s): ${counts}`));
   }
@@ -12161,8 +13633,6 @@ function renderMarkdownReport(input) {
   }
   return lines.join("\n");
 }
-
-// src/reporters/sarif.ts
 var SCHEMA_URI = "https://json.schemastore.org/sarif-2.1.0.json";
 function sarifLevel(severity) {
   if (severity === "critical" || severity === "high") return "error";
@@ -12172,15 +13642,37 @@ function sarifLevel(severity) {
 function uri(file) {
   return (file ?? "").replace(/\\/g, "/");
 }
+function sarifV2() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_SARIF_V2 === "1";
+}
+function ruleMarkdown(ruleId) {
+  const path = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "rules", `${ruleId}.md`);
+  if (!existsSync(path)) return void 0;
+  return readFileSync(path, "utf8").slice(0, 2048);
+}
+function relatedLocations(finding6) {
+  if (finding6.dependencyPath === void 0 || finding6.dependencyPath.length === 0) return void 0;
+  return finding6.dependencyPath.map((step) => ({
+    message: { text: step },
+    physicalLocation: {
+      artifactLocation: { uri: uri(finding6.file) },
+      ...finding6.line !== void 0 ? { region: { startLine: finding6.line } } : {}
+    }
+  }));
+}
 function renderSarifReport(input) {
   const result = redactScan(input);
+  const v2 = sarifV2();
   const rules = /* @__PURE__ */ new Map();
   for (const finding6 of result.findings) {
     if (!rules.has(finding6.ruleId)) {
+      const markdown = v2 ? ruleMarkdown(finding6.ruleId) : void 0;
       rules.set(finding6.ruleId, {
         id: finding6.ruleId,
         name: finding6.ruleId,
-        shortDescription: { text: finding6.title }
+        shortDescription: { text: finding6.title },
+        ...markdown !== void 0 ? { help: { markdown } } : {},
+        ...v2 ? { properties: { precision: "unreviewed" } } : {}
       });
     }
   }
@@ -12209,6 +13701,7 @@ function renderSarifReport(input) {
               }
             }
           ] : [];
+          const related = v2 ? relatedLocations(finding6) : void 0;
           const codeFlows = finding6.trace !== void 0 && finding6.trace.length > 0 ? [
             {
               threadFlows: [
@@ -12231,7 +13724,12 @@ function renderSarifReport(input) {
             level: sarifLevel(finding6.severity),
             message: { text: finding6.message },
             locations: location4,
-            ...codeFlows !== void 0 ? { codeFlows } : {}
+            ...codeFlows !== void 0 ? { codeFlows } : {},
+            ...v2 ? {
+              partialFingerprints: { "fullshield/v1": lineIndependentFingerprint(finding6) },
+              ...related !== void 0 ? { relatedLocations: related } : {},
+              ...finding6.module === "deps" && finding6.reachability !== void 0 ? { properties: { reachability: finding6.reachability } } : {}
+            } : {}
           };
         })
       }
@@ -12373,13 +13871,152 @@ function renderDiffText(diff) {
 init_experimental();
 init_policy();
 
+// src/deps-diff/index.ts
+init_semver();
+init_lockfile();
+var execFileAsync4 = promisify(execFile);
+var LOCK_NAMES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"];
+function diffLockedPackages(before, after, direct) {
+  const oldMap = new Map(before.map((pkg) => [pkg.name, pkg.version]));
+  const newMap = new Map(after.map((pkg) => [pkg.name, pkg.version]));
+  const names = [.../* @__PURE__ */ new Set([...oldMap.keys(), ...newMap.keys()])].sort();
+  const changes = [];
+  for (const name of names) {
+    const oldVersion = oldMap.get(name);
+    const newVersion = newMap.get(name);
+    const isDirect2 = direct.has(name);
+    if (oldVersion === void 0 && newVersion !== void 0) {
+      changes.push({ name, change: "added", newVersion, direct: isDirect2 });
+    } else if (oldVersion !== void 0 && newVersion === void 0) {
+      changes.push({ name, change: "removed", oldVersion, direct: isDirect2 });
+    } else if (oldVersion !== void 0 && newVersion !== void 0 && oldVersion !== newVersion) {
+      const order = compareSemver(newVersion, oldVersion);
+      changes.push({
+        name,
+        change: order >= 0 ? "upgraded" : "downgraded",
+        oldVersion,
+        newVersion,
+        direct: isDirect2
+      });
+    }
+  }
+  return changes;
+}
+function packagesFromLock(filename, contents) {
+  const graph2 = parseLockfileGraph(filename, contents);
+  return { packages: graph2.packages, direct: /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]) };
+}
+async function gitShow(cwd, spec, run = defaultGit) {
+  return run(cwd, ["show", spec]);
+}
+async function defaultGit(cwd, args) {
+  if (args[0] !== "show") throw new Error("deps-diff only runs git show");
+  const { stdout } = await execFileAsync4("git", args, { cwd, encoding: "utf8" });
+  return stdout;
+}
+async function lockAtRef(cwd, ref, run = defaultGit) {
+  for (const file of LOCK_NAMES) {
+    try {
+      const text = await gitShow(cwd, `${ref}:${file}`, run);
+      if (text.length > 0) return { file, text };
+    } catch {
+    }
+  }
+  throw new Error(`deps-diff cannot read a lockfile at ${ref} (FULLSHIELD_EXPERIMENTAL_DEPS_DIFF)`);
+}
+function releaseAgeLabel(publishedAt, nowMs, minHours = 72) {
+  if (publishedAt === void 0) return "unknown";
+  const published = Date.parse(publishedAt);
+  if (Number.isNaN(published)) return "unknown";
+  const hours = (nowMs - published) / 36e5;
+  return hours < minHours ? "new-release" : "aged";
+}
+var ExplainError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ExplainError";
+  }
+};
+function matchFinding(findings, rawId) {
+  const id = rawId.trim();
+  if (id.length < 6) {
+    throw new ExplainError(`id prefix must be at least 6 characters (FULLSHIELD_EXPERIMENTAL_EXPLAIN)`);
+  }
+  const exact = findings.find((finding6) => finding6.id === id);
+  if (exact !== void 0) return exact;
+  const matches = findings.filter((finding6) => finding6.id.startsWith(id));
+  if (matches.length === 1) {
+    const only = matches[0];
+    if (only !== void 0) return only;
+  }
+  if (matches.length === 0) {
+    const candidates = findings.slice(0, 5).map((finding6) => finding6.id);
+    throw new ExplainError(
+      `no finding matches ${id}${candidates.length > 0 ? `; candidates: ${candidates.join(", ")}` : ""} (FULLSHIELD_EXPERIMENTAL_EXPLAIN)`
+    );
+  }
+  throw new ExplainError(
+    `ambiguous id ${id}; candidates: ${matches.slice(0, 5).map((finding6) => finding6.id).join(", ")} (FULLSHIELD_EXPERIMENTAL_EXPLAIN)`
+  );
+}
+function contextLines(text, line) {
+  if (line === void 0) return [];
+  const rows = text.split(/\r?\n/);
+  const start = Math.max(0, line - 3);
+  const end = Math.min(rows.length, line + 2);
+  return rows.slice(start, end).map((row, index) => `${start + index + 1}|${row}`);
+}
+function renderExplain(finding6, fileText = "") {
+  const location4 = finding6.file !== void 0 ? `${finding6.file}${finding6.line !== void 0 ? `:${finding6.line}` : ""}` : "(project)";
+  const lines = [
+    `${finding6.ruleId} ${finding6.title}`,
+    `severity: ${finding6.severity}`,
+    `confidence: ${finding6.confidence}`,
+    `location: ${location4}`
+  ];
+  const context = contextLines(fileText, finding6.line);
+  if (context.length > 0) {
+    lines.push("context:");
+    lines.push(...context.map((row) => `  ${row}`));
+  }
+  if (finding6.snippet !== void 0) lines.push(`snippet: ${finding6.snippet}`);
+  if (finding6.trace !== void 0 && finding6.trace.length > 0) {
+    lines.push(
+      `trace: ${finding6.trace.map((step) => `${step.file}${step.line !== void 0 ? `:${step.line}` : ""} ${step.note}`).join(" \u2192 ")}`
+    );
+  }
+  if (finding6.reachability !== void 0) {
+    const path = finding6.dependencyPath !== void 0 ? ` (${finding6.dependencyPath.join(" > ")})` : "";
+    lines.push(`reachability: ${finding6.reachability}${path}`);
+  }
+  if (finding6.fix !== void 0) lines.push(`fix: ${finding6.fix.diff}`);
+  lines.push(`docs: rules/${finding6.ruleId}.md`);
+  return lines.join("\n");
+}
+async function explainFinding(options) {
+  const finding6 = matchFinding(options.findings, options.id);
+  let text = "";
+  if (finding6.file !== void 0) {
+    try {
+      text = await readFile(join(options.cwd, finding6.file), "utf8");
+    } catch {
+      text = "";
+    }
+  }
+  return renderExplain(finding6, text);
+}
+
+// src/cli/program.ts
+init_osv();
+init_semver();
+
 // src/sbom/index.ts
 init_engine2();
 init_lockfile();
 init_pins();
 init_cyclonedx();
 var LOCKFILE_NAMES2 = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
-async function buildSbom(cwd) {
+async function buildSbom(cwd, options = {}) {
   const result = await scan({ cwd, modules: ["deps"] });
   let name = "app";
   let version = "0.0.0";
@@ -12405,7 +14042,13 @@ async function buildSbom(cwd) {
   if (components.length === 0) {
     components = exactPinsFromManifest(manifest).map((p) => ({ name: p.name, version: p.version }));
   }
-  return renderCycloneDx({ name, version, components, findings: result.findings });
+  return renderCycloneDx({
+    name,
+    version,
+    components,
+    findings: result.findings,
+    includeReach: options.includeReach === true
+  });
 }
 
 // src/cli/program.ts
@@ -13045,7 +14688,7 @@ function stateForGrace(sshd) {
 
 // src/cli/commands/doctor.ts
 init_config2();
-var MIN_NODE = [20, 11, 0];
+var MIN_NODE = [22, 13, 0];
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
 var FLAGS = [
   "FULLSHIELD_EXPERIMENTAL_SAST_GAPS",
@@ -13076,7 +14719,7 @@ function nodeOk(version) {
 async function runDoctor(cwd, options = {}) {
   const lines = [];
   const version = process.versions.node;
-  lines.push(`node: ${version} ${nodeOk(version) ? "ok" : "too old (need >= 20.11.0)"}`);
+  lines.push(`node: ${version} ${nodeOk(version) ? "ok" : "too old (need >= 22.13.0)"}`);
   const locks = LOCKFILES.filter((name) => existsSync(join(cwd, name)));
   lines.push(locks.length > 0 ? `lockfile: ${locks.join(", ")}` : "lockfile: none");
   const cacheDir = join(homedir(), ".cache", "fullshield", "osv");
@@ -13132,6 +14775,21 @@ var KNOWN = [
     test: /FULLSHIELD_EXPERIMENTAL_DIFF|scan JSON|cannot read diff/,
     code: "FS-E006",
     hint: "Set FULLSHIELD_EXPERIMENTAL_DIFF=1 or pass --experimental-diff. Both inputs must be scan --json files."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_EXPLAIN|id prefix|no finding matches|ambiguous id/,
+    code: "FS-E007",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_EXPLAIN=1. Pass an id prefix of at least 6 characters from a scan JSON file."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_DEPS_DIFF|deps-diff cannot/,
+    code: "FS-E008",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_DEPS_DIFF=1. Pass a git ref that contains a lockfile."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS|sast\.sources|sast\.sanitizers/,
+    code: "FS-E009",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS=1 before naming sast.sources or sast.sanitizers."
   }
 ];
 var DOCS = "https://github.com/kathanp/fullshield/blob/main/docs/errors.md";
@@ -13183,7 +14841,7 @@ function parseFailOn(value) {
 function createProgram(io = defaultIO) {
   const program = new Command();
   program.name("fullshield").description("Full-cycle security scanner for Node.js/TypeScript backends").version(packageVersion()).option("--debug", "print stack traces on CLI errors");
-  program.command("scan").description("Scan a project directory for security findings").argument("[path]", "directory to scan", ".").option("--json", "machine-readable JSON output").option("--fail-on <severity>", "exit 1 if any finding is at or above this severity").option("--modules <modules>", "comma-separated subset of modules to run").option("--staged", "scan only files staged in git (pre-commit mode)").option("--offline", "use the OSV cache only (no network)").option("--offline-safe", "alias of --offline").option("--config <path>", "path to fullshield.config.json").option("--sarif <file>", "write a SARIF 2.1.0 report to this path").option("--markdown <file>", "write a Markdown report to this path").option("--html <file>", "write an HTML report to this path").option(
+  program.command("scan").description("Scan a project directory for security findings").argument("[path]", "directory to scan", ".").option("--json", "machine-readable JSON output").option("--all", "print every finding in the console, with no 20-row cap").option("--fail-on <severity>", "exit 1 if any finding is at or above this severity").option("--modules <modules>", "comma-separated subset of modules to run").option("--staged", "scan only files staged in git (pre-commit mode)").option("--offline", "use the OSV cache only (no network)").option("--offline-safe", "alias of --offline").option("--config <path>", "path to fullshield.config.json").option("--sarif <file>", "write a SARIF 2.1.0 report to this path").option("--markdown <file>", "write a Markdown report to this path").option("--html <file>", "write an HTML report to this path").option(
     "--experimental-ci-reports",
     "experimental: GitHub annotations, JUnit, and GitLab Code Quality (FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)"
   ).option(
@@ -13217,6 +14875,27 @@ function createProgram(io = defaultIO) {
     "--experimental-vex",
     "experimental: worm/workflow indicators, overrides, provenance, VEX (FULLSHIELD_EXPERIMENTAL_VEX=1)"
   ).option(
+    "--experimental-reach-evidence",
+    "experimental: record why a dependency reachability class was chosen (FULLSHIELD_EXPERIMENTAL_REACH_EVIDENCE=1)"
+  ).option(
+    "--experimental-lockfiles",
+    "experimental: yarn berry, pnpm v9, and bun.lock (FULLSHIELD_EXPERIMENTAL_LOCKFILES=1)"
+  ).option(
+    "--experimental-supply",
+    "experimental: supply-chain campaign heuristics (FULLSHIELD_EXPERIMENTAL_SUPPLY=1)"
+  ).option(
+    "--experimental-workspaces",
+    "experimental: scan each workspace lockfile (FULLSHIELD_EXPERIMENTAL_WORKSPACES=1)"
+  ).option(
+    "--experimental-sarif-v2",
+    "experimental: extra SARIF fields (FULLSHIELD_EXPERIMENTAL_SARIF_V2=1)"
+  ).option(
+    "--experimental-custom-sanitizers",
+    "experimental: config-declared sources and sanitizers (FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS=1)"
+  ).option(
+    "--experimental-validation",
+    "experimental: route schema validation inference (FULLSHIELD_EXPERIMENTAL_VALIDATION=1)"
+  ).option("--taint-summaries", "cache per-function taint summaries (FULLSHIELD_TAINT_SUMMARIES=1)").option(
     "--experimental-mcpcfg",
     "experimental: MCP client/server config rules (FULLSHIELD_EXPERIMENTAL_MCPCFG=1)"
   ).option(
@@ -13245,6 +14924,30 @@ function createProgram(io = defaultIO) {
       if (opts.experimentalVex === true) {
         process.env.FULLSHIELD_EXPERIMENTAL_VEX = "1";
       }
+      if (opts.experimentalReachEvidence === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_REACH_EVIDENCE = "1";
+      }
+      if (opts.experimentalLockfiles === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_LOCKFILES = "1";
+      }
+      if (opts.experimentalSupply === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY = "1";
+      }
+      if (opts.experimentalWorkspaces === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_WORKSPACES = "1";
+      }
+      if (opts.experimentalSarifV2 === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_SARIF_V2 = "1";
+      }
+      if (opts.experimentalCustomSanitizers === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS = "1";
+      }
+      if (opts.experimentalValidation === true) {
+        process.env.FULLSHIELD_EXPERIMENTAL_VALIDATION = "1";
+      }
+      if (opts.taintSummaries === true) {
+        process.env.FULLSHIELD_TAINT_SUMMARIES = "1";
+      }
       if (opts.experimentalMcpcfg === true) {
         process.env.FULLSHIELD_EXPERIMENTAL_MCPCFG = "1";
       }
@@ -13309,7 +15012,9 @@ function createProgram(io = defaultIO) {
       if (opts.prSummary === true) {
         io.out(renderPrSummary(result.findings));
       } else {
-        io.out(opts.json === true ? renderJsonReport(result) : renderConsoleReport(result));
+        io.out(
+          opts.json === true ? renderJsonReport(result) : renderConsoleReport(result, { all: opts.all === true })
+        );
       }
       if (result.policy !== void 0 && result.policy.errors.length > 0) {
         for (const message of result.policy.errors) {
@@ -13424,7 +15129,9 @@ function createProgram(io = defaultIO) {
       if (opts.format !== void 0 && opts.format !== "cyclonedx") {
         throw new Error(`unsupported SBOM format "${opts.format}" (valid: cyclonedx)`);
       }
-      const doc = await buildSbom(resolve(path));
+      const doc = await buildSbom(resolve(path), {
+        includeReach: process.env.FULLSHIELD_EXPERIMENTAL_SBOM_REACH === "1"
+      });
       const errors = validateCycloneDx15(doc);
       if (errors.length > 0) throw new Error(`invalid SBOM: ${errors.join("; ")}`);
       const json = JSON.stringify(doc, null, 2);
@@ -13578,6 +15285,87 @@ function createProgram(io = defaultIO) {
       process.exitCode = 2;
     }
   });
+  program.command("explain").description("Print one finding from a scan JSON file (requires FULLSHIELD_EXPERIMENTAL_EXPLAIN=1)").argument("<id>", "finding id or a prefix of at least 6 characters").option("--from <file>", "scan --json file").action(async (id, opts) => {
+    try {
+      if (process.env.FULLSHIELD_EXPERIMENTAL_EXPLAIN !== "1") {
+        throw new Error("explain requires FULLSHIELD_EXPERIMENTAL_EXPLAIN=1");
+      }
+      if (opts.from === void 0) throw new Error("explain needs --from <scan.json> (FULLSHIELD_EXPERIMENTAL_EXPLAIN)");
+      const raw = JSON.parse(await readFile(opts.from, "utf8"));
+      if (!Array.isArray(raw.findings)) throw new Error("explain --from is not scan JSON (FULLSHIELD_EXPERIMENTAL_EXPLAIN)");
+      const text = await explainFinding({
+        cwd: process.cwd(),
+        id,
+        findings: raw.findings
+      });
+      io.out(text);
+    } catch (error) {
+      io.err(formatCliError(error));
+      process.exitCode = 2;
+    }
+  });
+  program.command("deps-diff").description("Compare a lockfile at a git ref with the working tree (requires FULLSHIELD_EXPERIMENTAL_DEPS_DIFF=1)").argument("<ref>", "git ref to read with git show").argument("[path]", "project directory", ".").option("--json", "print JSON").option("--fail-on <severity>", "exit 1 when an introduced advisory is at or above this severity").option("--offline", "use the OSV cache only").action(async (ref, path, opts) => {
+    try {
+      if (process.env.FULLSHIELD_EXPERIMENTAL_DEPS_DIFF !== "1") {
+        throw new Error("deps-diff requires FULLSHIELD_EXPERIMENTAL_DEPS_DIFF=1");
+      }
+      const cwd = resolve(path);
+      const previous = await lockAtRef(cwd, ref);
+      let currentText = "";
+      try {
+        currentText = await readFile(join(cwd, previous.file), "utf8");
+      } catch {
+        currentText = "";
+      }
+      const before = packagesFromLock(previous.file, previous.text);
+      const after = packagesFromLock(previous.file, currentText);
+      const changes = diffLockedPackages(before.packages, after.packages, after.direct);
+      const moved = after.packages.filter(
+        (pkg) => changes.some((change) => change.name === pkg.name && change.change !== "removed" && change.newVersion === pkg.version)
+      );
+      const hits = await queryOsv(moved, {
+        cacheDir: join(cwd, "osv-cache"),
+        offline: opts.offline === true
+      });
+      const introduced = hits.flatMap(
+        (hit2) => hit2.vulns.map((vuln) => ({
+          name: hit2.pkg.name,
+          version: hit2.pkg.version,
+          id: vuln.id,
+          severity: osvSeverity(vuln)
+        }))
+      );
+      const added = changes.filter((change) => change.change === "added");
+      const ages = [];
+      for (const change of added) {
+        let published;
+        let installScripts = "unknown";
+        try {
+          const raw = JSON.parse(await readFile(join(cwd, "osv-cache", "registry", `${change.name}.json`), "utf8"));
+          published = raw.time;
+          if (raw.hasInstallScript === true) installScripts = "yes";
+          if (raw.hasInstallScript === false) installScripts = "no";
+        } catch {
+          published = void 0;
+        }
+        ages.push({
+          name: change.name,
+          version: change.newVersion,
+          age: releaseAgeLabel(published, Date.now()),
+          installScripts
+        });
+      }
+      const report = { changes, introduced, ages };
+      io.out(JSON.stringify(report, null, 2));
+      if (opts.failOn !== void 0) {
+        const threshold = parseFailOn(opts.failOn);
+        if (introduced.some((item) => meetsThreshold(item.severity, threshold))) process.exitCode = 1;
+      }
+    } catch (error) {
+      io.err(formatCliError(error));
+      process.exitCode = 2;
+    }
+  });
   program.command("confirm").description("Experimental exploit confirm (localhost/127.0.0.1/FullShield container only)").argument("<url>", "target base URL").action(async (url) => {
     try {
       if (process.env.FULLSHIELD_EXPERIMENTAL_CONFIRM !== "1") {
@@ -13713,8 +15501,8 @@ function createProgram(io = defaultIO) {
       let name = "app";
       let version = "0.0.0";
       try {
-        const { readFile: readFile21 } = await import('fs/promises');
-        const pkg = JSON.parse(await readFile21(join(cwd, "package.json"), "utf8"));
+        const { readFile: readFile22 } = await import('fs/promises');
+        const pkg = JSON.parse(await readFile22(join(cwd, "package.json"), "utf8"));
         if (typeof pkg.name === "string") name = pkg.name;
         if (typeof pkg.version === "string") version = pkg.version;
       } catch {