fullshield 0.3.0 → 0.4.0

package/dist/compliance.js

@@ -78,6 +78,10 @@ var RULE_MAP = [
   ROW("SUPPLY-PROVENANCE-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
   ROW("SUPPLY-WORM-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3 / 12.10"),
   ROW("SUPPLY-WORKFLOW-001", "A08:2021 Integrity Failures", "CWE-829", "V14.2.3", "PCI DSS 6.3.3"),
+  ROW("SUPPLY-CHAINC2-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("SUPPLY-STEALER-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 12.10"),
+  ROW("SUPPLY-PLATFORMGATE-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
+  ROW("SUPPLY-SECHOLDER-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3"),
   ROW("IAC-GHA-UNPINNED-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
   ROW("IAC-GHA-PRTARGET-001", "A01:2021 Broken Access Control", "CWE-269", "V4.1.1", "PCI DSS 7.2"),
   ROW("IAC-GHA-PERMS-001", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),

package/dist/index.d.ts

@@ -59,6 +59,21 @@ interface Finding {
     stillAtHead?: boolean;
     /** Read-only identity check (`scan --verify-secrets`). Never includes the secret. */
     verification?: 'live' | 'revoked' | 'unknown';
+    /** Why the reachability class was chosen. Present only with FULLSHIELD_EXPERIMENTAL_REACH_EVIDENCE=1. */
+    reachabilityEvidence?: {
+        imports: Array<{
+            file: string;
+            line: number;
+            specifier: string;
+        }>;
+        calls?: Array<{
+            file: string;
+            line: number;
+            symbol: string;
+        }>;
+        dependencyPath?: string[];
+        reason: string;
+    };
 }
 interface FindingSummary {
     total: number;
@@ -95,9 +110,20 @@ interface AiConfig {
     /** Highest-severity findings sent to the model first. */
     maxFindings: number;
 }
+interface SastSourceConfig {
+    callee: string;
+    returns: 'tainted';
+}
+interface SastSanitizerConfig {
+    callee: string;
+    clears: string[];
+}
 interface SastConfig {
     /** Files larger than this are not parsed. Reported as SAST-SKIP-001. */
     maxFileBytes: number;
+    /** Present only when FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS=1. */
+    sources?: SastSourceConfig[];
+    sanitizers?: SastSanitizerConfig[];
 }
 interface ResolvedConfig {
     modules: ModuleName[];
@@ -234,6 +260,23 @@ interface ScanMetadata {
     modulesRun: ModuleName[];
     /** Set when `scan --history` stops at the commit cap. Exact text: `scanned N of M commits`. */
     history?: string;
+    /** Phase 48. Direct dependencies no project file imports. Absent when the list is empty. */
+    unusedDirect?: {
+        packages: string[];
+        advisories: number;
+    };
+    /** Phase 49. Direct version bumps taken from OSV `fixed` versions. Absent when there is nothing to say. */
+    upgradePlan?: {
+        bumps: Array<{
+            name: string;
+            from: string;
+            to: string;
+            safe: boolean;
+            findings: number;
+        }>;
+        unresolved: string[];
+        sentence: string;
+    };
 }
 interface PolicyScanResult {
     enabled: true;
@@ -443,8 +486,12 @@ declare function parseIgnore(line: string): {
  */
 declare function applyInlineSuppressions(findings: readonly Finding[], sources: Readonly<Record<string, string>>): Finding[];
 
-/** Human-readable report: findings grouped by severity, highest first. */
-declare function renderConsoleReport(input: ScanResult): string;
+interface ConsoleReportOptions {
+    /** Print every finding, with no 20-row cap. */
+    all?: boolean;
+}
+/** Human-readable report. Default view is the actionable rows. JSON is unchanged. */
+declare function renderConsoleReport(input: ScanResult, options?: ConsoleReportOptions): string;
 
 /** Standalone HTML report. Finding text is escaped; secrets are already masked. */
 declare function renderHtmlReport(input: ScanResult): string;
@@ -495,7 +542,9 @@ declare function parseScanDocument(text: string): DiffFinding[];
 /** Human summary. Lists at most 20 added findings. */
 declare function renderDiffText(diff: ScanDiff): string;
 
-declare function buildSbom(cwd: string): Promise<Record<string, unknown>>;
+declare function buildSbom(cwd: string, options?: {
+    includeReach?: boolean;
+}): Promise<Record<string, unknown>>;
 
 interface SbomComponent {
     name: string;
@@ -508,6 +557,8 @@ interface SbomInput {
     version: string;
     components: SbomComponent[];
     findings?: Finding[];
+    /** Phase 66. Off unless the caller sets it. */
+    includeReach?: boolean;
 }
 declare function validateCycloneDx15(doc: unknown): string[];
 declare function renderCycloneDx(input: SbomInput): Record<string, unknown>;