fullshield 0.3.0 → 0.4.0

package/dist/index.js

@@ -1,12 +1,12 @@
 import { createHash } from 'crypto';
-import { readFile, mkdir, writeFile, stat, unlink, readdir, mkdtemp } from 'fs/promises';
+import { readFile, mkdir, writeFile, readdir, stat, unlink, mkdtemp } from 'fs/promises';
 import { resolve, join, basename, dirname, posix, relative } from 'path';
 import { execFile, spawnSync, spawn, execFileSync } from 'child_process';
 import { createInterface } from 'readline';
 import { promisify } from 'util';
 import { performance } from 'perf_hooks';
+import { existsSync, mkdirSync, writeFileSync, statSync, readFileSync, rmSync, readdirSync, cpSync } from 'fs';
 import { homedir, availableParallelism, tmpdir } from 'os';
-import { existsSync, statSync, readFileSync, readdirSync, cpSync, mkdirSync, rmSync } from 'fs';
 import { Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
 import ignoreModule from 'ignore';
@@ -461,7 +461,7 @@ function scanTextForSecretHits(path, text) {
   return hits;
 }
 function scanTextForSecrets(path, text) {
-  return scanTextForSecretHits(path, text).map((hit) => hit.finding);
+  return scanTextForSecretHits(path, text).map((hit2) => hit2.finding);
 }
 var secretsRules, REMEDIATION, MAX_FILE_SIZE, secretsModule;
 var init_secrets = __esm({
@@ -599,13 +599,13 @@ async function readBlob(cwd, hash) {
     return void 0;
   }
 }
-function remapHit(hit, file) {
-  const snippet = hit.finding.snippet;
-  const line = hit.finding.line ?? 0;
-  const id = makeFindingId(hit.finding.ruleId, file, `${line}|${snippet ?? "file"}`);
+function remapHit(hit2, file) {
+  const snippet = hit2.finding.snippet;
+  const line = hit2.finding.line ?? 0;
+  const id = makeFindingId(hit2.finding.ruleId, file, `${line}|${snippet ?? "file"}`);
   return {
-    finding: { ...hit.finding, id, file },
-    secret: hit.secret
+    finding: { ...hit2.finding, id, file },
+    secret: hit2.secret
   };
 }
 function historyCommitLimit(raw = process.env.FULLSHIELD_HISTORY_MAX) {
@@ -695,8 +695,8 @@ async function headSecretKeys(cwd) {
       hits = scanTextForSecretHits(path, text);
       seen.set(hash, hits);
     }
-    for (const hit of hits) {
-      keys.add(`${hit.finding.ruleId}\0${hit.finding.snippet ?? ""}`);
+    for (const hit2 of hits) {
+      keys.add(`${hit2.finding.ruleId}\0${hit2.finding.snippet ?? ""}`);
     }
   }
   return keys;
@@ -729,8 +729,8 @@ async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
       hits2 = rawHits.filter((h) => allowed.has(h.finding.id));
       blobHits.set(change.hash, hits2);
     }
-    for (const hit of hits2) {
-      const mapped = remapHit(hit, change.path);
+    for (const hit2 of hits2) {
+      const mapped = remapHit(hit2, change.path);
       if (!first.has(mapped.finding.id)) {
         first.set(mapped.finding.id, { hit: mapped, commit: change.commit });
       }
@@ -738,11 +738,11 @@ async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
   }
   const atHead = await headSecretKeys(cwd);
   const hits = [];
-  for (const { hit, commit } of first.values()) {
-    const stillAtHead = atHead.has(`${hit.finding.ruleId}\0${hit.finding.snippet ?? ""}`);
+  for (const { hit: hit2, commit } of first.values()) {
+    const stillAtHead = atHead.has(`${hit2.finding.ruleId}\0${hit2.finding.snippet ?? ""}`);
     hits.push({
-      finding: { ...hit.finding, introducedIn: commit, stillAtHead },
-      secret: hit.secret
+      finding: { ...hit2.finding, introducedIn: commit, stillAtHead },
+      secret: hit2.secret
     });
   }
   const scanned = Math.min(maxCommits, total);
@@ -984,15 +984,15 @@ function providerFor(ruleId, secret) {
 async function verifySecretHits(hits, options = {}) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const out = [];
-  for (const hit of hits) {
-    const secret = hit.secret;
+  for (const hit2 of hits) {
+    const secret = hit2.secret;
     if (secret === void 0 || secret.length === 0) {
-      out.push({ finding: { ...hit.finding, verification: "unknown" }, secret: hit.secret });
+      out.push({ finding: { ...hit2.finding, verification: "unknown" }, secret: hit2.secret });
       continue;
     }
-    const run = providerFor(hit.finding.ruleId, secret);
+    const run = providerFor(hit2.finding.ruleId, secret);
     const verification = run === void 0 ? "unknown" : await run(secret, fetchImpl);
-    out.push({ finding: { ...hit.finding, verification }, secret: hit.secret });
+    out.push({ finding: { ...hit2.finding, verification }, secret: hit2.secret });
   }
   return out;
 }
@@ -1553,6 +1553,169 @@ var configModule = {
 // src/modules/deps/index.ts
 init_finding();
 
+// src/modules/deps/lockfile-modern.ts
+function addEdge(edges, from, to) {
+  if (from.length === 0 || to.length === 0 || from === to) return;
+  const list = edges.get(from) ?? /* @__PURE__ */ new Set();
+  list.add(to);
+  edges.set(from, list);
+}
+function graph(packages, edges, directProd, directDev, edgesKnown) {
+  return { packages, edges, directProd, directDev, edgesKnown };
+}
+function parseYarnBerry(contents) {
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  let current;
+  let inDeps = false;
+  let devBlock = false;
+  for (const raw of contents.split(/\r?\n/)) {
+    if (!raw.startsWith(" ") && raw.trimEnd().endsWith(":")) {
+      const key = raw.slice(0, -1).trim().replace(/^"|"$/g, "");
+      current = key.includes("@workspace:.") ? "" : nameFromBerryKey(key);
+      inDeps = false;
+      devBlock = false;
+      continue;
+    }
+    const version = /^\s+version:\s+(.+)$/.exec(raw)?.[1]?.replace(/["']/g, "").trim();
+    if (version !== void 0 && current !== void 0 && current.length > 0 && !inDeps) {
+      packages.push({ name: current, version: versionFromProtocol(version), path: `yarn:${current}` });
+      continue;
+    }
+    if (/^\s+dependencies:\s*$/.test(raw)) {
+      inDeps = true;
+      devBlock = false;
+      continue;
+    }
+    if (/^\s+devDependencies:\s*$/.test(raw)) {
+      inDeps = true;
+      devBlock = true;
+      continue;
+    }
+    if (!inDeps || current === void 0) continue;
+    const dep = /^\s{4}"?([^":]+)"?:\s+(.+)$/.exec(raw);
+    if (dep?.[1] === void 0) continue;
+    const depName = dep[1];
+    if (current.length === 0) {
+      if (devBlock) directDev.add(depName);
+      else directProd.add(depName);
+    } else {
+      addEdge(edges, current, depName);
+    }
+  }
+  return graph(packages, edges, directProd, directDev, true);
+}
+function nameFromBerryKey(key) {
+  const first = key.split(",")[0]?.trim() ?? key;
+  if (first.startsWith("@")) {
+    const match = /^(@[^@/]+\/[^@/]+)@/.exec(first);
+    return match?.[1];
+  }
+  const at = first.indexOf("@");
+  return at <= 0 ? first : first.slice(0, at);
+}
+function versionFromProtocol(raw) {
+  const patch = /^patch:(.+)#/.exec(raw);
+  const body = patch?.[1] ?? raw;
+  const npm = /^(?:npm:)?(@?[^@]+)@(.+)$/.exec(body);
+  if (npm?.[2] !== void 0) return npm[2];
+  return body;
+}
+function parsePnpmV9(contents) {
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  let block = "none";
+  let snapshot;
+  let inSnapshotDeps = false;
+  for (const raw of contents.split(/\r?\n/)) {
+    if (raw === "packages:") {
+      block = "packages";
+      snapshot = void 0;
+      continue;
+    }
+    if (raw === "snapshots:") {
+      block = "snapshots";
+      snapshot = void 0;
+      continue;
+    }
+    if (raw === "importers:" || raw.startsWith("lockfileVersion:")) {
+      block = "none";
+      continue;
+    }
+    if (block !== "snapshots" && /^\s{4}dependencies:\s*$/.test(raw)) {
+      block = "importer-deps";
+      continue;
+    }
+    if (/^\s{4}devDependencies:\s*$/.test(raw)) {
+      block = "importer-dev";
+      continue;
+    }
+    if (block === "packages") {
+      const header = /^\s{2}['"]?(@?[^@'\s]+)@([^:'"]+)['"]?:/.exec(raw);
+      if (header?.[1] !== void 0 && header[2] !== void 0) {
+        packages.push({ name: header[1], version: header[2], path: `pnpm:${header[1]}` });
+      }
+      continue;
+    }
+    if (block === "snapshots") {
+      const header = /^\s{2}['"]?(@?[^@'\s]+)@([^:'"]+)['"]?:/.exec(raw);
+      if (header?.[1] !== void 0) {
+        snapshot = header[1];
+        inSnapshotDeps = false;
+        continue;
+      }
+      if (/^\s+dependencies:\s*$/.test(raw)) {
+        inSnapshotDeps = true;
+        continue;
+      }
+      if (inSnapshotDeps && snapshot !== void 0) {
+        const dep = /^\s{6}['"]?([^'":]+)['"]?:/.exec(raw);
+        if (dep?.[1] !== void 0) addEdge(edges, snapshot, dep[1]);
+      }
+      continue;
+    }
+    if (block === "importer-deps" || block === "importer-dev") {
+      const dep = /^\s{6}['"]?([^'":]+)['"]?:/.exec(raw);
+      if (dep?.[1] !== void 0 && !raw.trim().startsWith("specifier") && !raw.trim().startsWith("version")) {
+        if (block === "importer-dev") directDev.add(dep[1]);
+        else directProd.add(dep[1]);
+      }
+    }
+  }
+  return graph(packages, edges, directProd, directDev, true);
+}
+function parseBunLock(contents) {
+  const stripped = contents.replace(/^\s*\/\/.*$/gm, "");
+  const packages = [];
+  const edges = /* @__PURE__ */ new Map();
+  const directProd = /* @__PURE__ */ new Set();
+  const directDev = /* @__PURE__ */ new Set();
+  try {
+    const json = JSON.parse(stripped);
+    for (const [name, value] of Object.entries(json.packages ?? {})) {
+      if (!Array.isArray(value)) continue;
+      const entry = Array.from(value);
+      const spec = typeof entry[0] === "string" ? entry[0] : "";
+      const version = spec.includes("@") ? spec.slice(spec.lastIndexOf("@") + 1) : spec;
+      packages.push({ name, version, path: `bun:${name}` });
+      const meta = entry[1];
+      if (meta !== null && typeof meta === "object" && "dependencies" in meta) {
+        const deps = meta.dependencies;
+        if (deps !== null && typeof deps === "object") {
+          for (const dep of Object.keys(deps)) addEdge(edges, name, dep);
+        }
+      }
+    }
+  } catch {
+    return graph([], /* @__PURE__ */ new Map(), /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set(), false);
+  }
+  return graph(packages, edges, directProd, directDev, packages.length > 0);
+}
+
 // src/modules/deps/lockfile.ts
 function basename2(filename) {
   const parts = filename.replace(/\\/g, "/").split("/");
@@ -1582,7 +1745,7 @@ function objectKeys(value) {
   }
   return Object.keys(value);
 }
-function addEdge(edges, from, to) {
+function addEdge2(edges, from, to) {
   const set = edges.get(from) ?? /* @__PURE__ */ new Set();
   set.add(to);
   edges.set(from, set);
@@ -1662,7 +1825,7 @@ function parseYarnGraph(contents) {
       const depBerry = /^\s{4}(?:"([^"]+)"|(@?[\w./-]+)):/.exec(raw);
       const depName = depClassic?.[1] ?? depClassic?.[2] ?? depBerry?.[1] ?? depBerry?.[2];
       if (depName !== void 0) {
-        addEdge(edges, currentName, depName);
+        addEdge2(edges, currentName, depName);
         continue;
       }
       if (/^\s{2}\S/.test(raw)) inDeps = false;
@@ -1757,7 +1920,7 @@ function parsePnpmGraph(contents) {
         const dep = /^      (?:'([^']+)'|"([^"]+)"|([^:]+)):/.exec(raw);
         const depName = dep?.[1] ?? dep?.[2] ?? dep?.[3];
         if (depName !== void 0) {
-          addEdge(edges, currentPkg, depName);
+          addEdge2(edges, currentPkg, depName);
           continue;
         }
         if (/^    \S/.test(raw)) inPkgDeps = false;
@@ -1792,7 +1955,7 @@ function graphFromPackagesTable(packages) {
     const name = key === "" ? "" : nameFromPackagesKey(key);
     if (name === void 0 || name.length === 0) continue;
     for (const dep of [...objectKeys(value.dependencies), ...objectKeys(value.optionalDependencies)]) {
-      addEdge(edges, name, dep);
+      addEdge2(edges, name, dep);
     }
   }
   return { edges, directProd, directDev };
@@ -1802,7 +1965,7 @@ function graphFromDependenciesTree(deps, edges) {
     const child = value.dependencies;
     if (child === void 0 || typeof child !== "object" || child === null) continue;
     const nested = child;
-    for (const childName of Object.keys(nested)) addEdge(edges, name, childName);
+    for (const childName of Object.keys(nested)) addEdge2(edges, name, childName);
     graphFromDependenciesTree(nested, edges);
   }
 }
@@ -1815,8 +1978,16 @@ function parseLockfileGraph(filename, contents) {
     directDev: /* @__PURE__ */ new Set(),
     edgesKnown: false
   };
-  if (name === "yarn.lock") return parseYarnGraph(contents);
-  if (name === "pnpm-lock.yaml") return parsePnpmGraph(contents);
+  const modern = process.env.FULLSHIELD_EXPERIMENTAL_LOCKFILES === "1";
+  if (name === "yarn.lock") {
+    if (modern && contents.includes("__metadata")) return parseYarnBerry(contents);
+    return parseYarnGraph(contents);
+  }
+  if (name === "pnpm-lock.yaml") {
+    if (modern && /lockfileVersion:\s*['"]?9/.test(contents)) return parsePnpmV9(contents);
+    return parsePnpmGraph(contents);
+  }
+  if (modern && name === "bun.lock") return parseBunLock(contents);
   if (name !== "package-lock.json") return empty;
   try {
     const json = JSON.parse(contents);
@@ -1985,6 +2156,86 @@ function exactPinsFromManifest(pkg) {
   return out;
 }
 
+// src/modules/deps/evidence.ts
+var IMPORT_RE = /(?:require\(\s*['"]([^'"]+)['"]\s*\)|from\s+['"]([^'"]+)['"]|import\(\s*['"]([^'"]+)['"]\s*\))/g;
+function packageNameFromSpec(spec) {
+  if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:")) return void 0;
+  if (spec.startsWith("@")) {
+    const slash2 = spec.indexOf("/");
+    if (slash2 < 0) return void 0;
+    const rest = spec.slice(slash2 + 1);
+    const cut = rest.indexOf("/");
+    return cut === -1 ? spec : spec.slice(0, slash2 + 1 + cut);
+  }
+  const slash = spec.indexOf("/");
+  return slash === -1 ? spec : spec.slice(0, slash);
+}
+function collectImportSites(sources) {
+  const byPkg = /* @__PURE__ */ new Map();
+  const files = [...sources.keys()].sort();
+  for (const file of files) {
+    const text = sources.get(file) ?? "";
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+      const line = lines[i] ?? "";
+      IMPORT_RE.lastIndex = 0;
+      let match;
+      while ((match = IMPORT_RE.exec(line)) !== null) {
+        const spec = match[1] ?? match[2] ?? match[3];
+        if (spec === void 0) continue;
+        const pkg = packageNameFromSpec(spec);
+        if (pkg === void 0) continue;
+        const list = byPkg.get(pkg) ?? [];
+        list.push({ file, line: i + 1, specifier: spec, pkg });
+        byPkg.set(pkg, list);
+      }
+    }
+  }
+  for (const [pkg, list] of byPkg) {
+    list.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+    byPkg.set(pkg, list.slice(0, 5));
+  }
+  return byPkg;
+}
+function evidenceForFinding(finding3, sites, productionFiles, edgesKnown) {
+  if (finding3.ruleId !== "DEPS-VULN-001" && finding3.ruleId !== "DEPS-MALICIOUS-001") return void 0;
+  const snippet = finding3.snippet ?? "";
+  const at = snippet.startsWith("@") ? snippet.indexOf("@", 1) : snippet.indexOf("@");
+  const pkg = at <= 0 ? snippet : snippet.slice(0, at);
+  if (pkg.length === 0) return void 0;
+  const imports = (sites.get(pkg) ?? []).map((site) => ({
+    file: site.file,
+    line: site.line,
+    specifier: site.specifier
+  }));
+  const first = imports[0];
+  const path = finding3.dependencyPath;
+  let reason;
+  switch (finding3.reachability) {
+    case "not-imported":
+      reason = `No production file imports ${pkg}. Checked ${productionFiles.length} production file(s)${productionFiles.length > 0 ? `: ${productionFiles.slice(0, 8).join(", ")}` : ""}.`;
+      return { imports: [], reason };
+    case "reachability-unknown":
+      reason = edgesKnown ? `Reachability for ${pkg} is unknown.` : `Lockfile edges are missing, so ${pkg} is reachability-unknown.`;
+      return { imports, ...first !== void 0 ? {} : {}, reason };
+    case "reachable-via-dependency":
+      reason = path !== void 0 && path.length > 0 ? `Required through ${path.join(" > ")}.` : `Required by an imported package.`;
+      return { imports, ...path !== void 0 ? { dependencyPath: path } : {}, reason };
+    case "imported-not-called":
+      reason = first !== void 0 ? `Imported from ${first.file}:${first.line} and not called.` : `Imported and not called.`;
+      return { imports, reason };
+    case "symbol-reachable":
+      reason = first !== void 0 ? `A named vulnerable export is called from ${first.file}:${first.line}.` : `A named vulnerable export is called.`;
+      return { imports, reason };
+    case "symbol-not-called":
+      reason = `A named vulnerable export is not called.`;
+      return { imports, reason };
+    default:
+      reason = first !== void 0 ? `Imported from ${first.file}:${first.line}.` : `Imported by production code.`;
+      return { imports, ...path !== void 0 ? { dependencyPath: path } : {}, reason };
+  }
+}
+
 // src/modules/deps/reachability.ts
 init_finding();
 
@@ -2092,7 +2343,7 @@ function packageNameFromSnippet(snippet) {
   const at = snippet.indexOf("@");
   return at <= 0 ? snippet : snippet.slice(0, at);
 }
-function packageNameFromSpec(spec) {
+function packageNameFromSpec2(spec) {
   if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:")) return void 0;
   if (spec.startsWith("@")) {
     const parts = spec.split("/");
@@ -2128,7 +2379,7 @@ function indexPackageUsage(sources) {
         const local = m[1];
         const spec = m[2];
         if (local === void 0 || spec === void 0) continue;
-        const pkg = packageNameFromSpec(spec);
+        const pkg = packageNameFromSpec2(spec);
         if (pkg === void 0) continue;
         bump(pkg, localIsCalled(source, local));
       }
@@ -2138,7 +2389,7 @@ function indexPackageUsage(sources) {
     while ((named = namedRe.exec(source)) !== null) {
       const spec = named[2];
       if (spec === void 0) continue;
-      const pkg = packageNameFromSpec(spec);
+      const pkg = packageNameFromSpec2(spec);
       if (pkg === void 0) continue;
       const locals = (named[1] ?? "").split(",").map((s) => s.trim().split(/\s+as\s+/).pop() ?? "");
       bump(
@@ -2197,34 +2448,55 @@ function reachableFrom(target, roots, edges) {
   if (roots.has(target)) return true;
   return shortestDependencyPath(target, roots, edges) !== void 0;
 }
-function importedDirectNames(usage, graph) {
-  const directs = /* @__PURE__ */ new Set([...graph.directProd, ...graph.directDev]);
+function importedDirectNames(usage, graph2) {
+  const directs = /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]);
   const out = /* @__PURE__ */ new Set();
-  for (const [name, hit] of usage) {
-    if (!hit.imported) continue;
+  for (const [name, hit2] of usage) {
+    if (!hit2.imported) continue;
     if (directs.size === 0 || directs.has(name)) out.add(name);
   }
   return out;
 }
-function classifyReachability(pkgName, productionUsage, graph) {
-  const hit = productionUsage.get(pkgName);
-  if (hit?.imported === true) {
-    return { reachability: hit.called ? "reachable" : "imported-not-called" };
+function classifyReachability(pkgName, productionUsage, graph2) {
+  const hit2 = productionUsage.get(pkgName);
+  if (hit2?.imported === true) {
+    return { reachability: hit2.called ? "reachable" : "imported-not-called" };
   }
-  if (graph !== void 0 && graph.edgesKnown) {
-    const roots = importedDirectNames(productionUsage, graph);
-    const paths = collectDependencyPaths(pkgName, roots, graph.edges);
+  if (graph2 !== void 0 && graph2.edgesKnown) {
+    const roots = importedDirectNames(productionUsage, graph2);
+    const paths = collectDependencyPaths(pkgName, roots, graph2.edges);
     const path = paths[0];
     if (path !== void 0 && path.length >= 2) {
       return { reachability: "reachable-via-dependency", path, paths };
     }
     return { reachability: "not-imported" };
   }
-  if (graph !== void 0 && !graph.edgesKnown) {
+  if (graph2 !== void 0 && !graph2.edgesKnown) {
     return { reachability: "reachability-unknown" };
   }
   return { reachability: "not-imported" };
 }
+function unusedDirectPackages(ctx) {
+  if (!ctx.graph.edgesKnown) return [];
+  const imported = importedDirectNames(ctx.productionUsage, ctx.graph);
+  return [...ctx.graph.directProd].filter((name) => {
+    if (ctx.productionUsage.get(name)?.imported === true) return false;
+    return !reachableFrom(name, imported, ctx.graph.edges);
+  }).sort();
+}
+function unusedDirectPlan(findings, ctx) {
+  const packages = unusedDirectPackages(ctx);
+  if (packages.length === 0) return void 0;
+  const names = new Set(packages);
+  let advisories = 0;
+  for (const finding3 of findings) {
+    if (finding3.ruleId !== "DEPS-VULN-001" && finding3.ruleId !== "DEPS-MALICIOUS-001") continue;
+    if (finding3.snippet === void 0) continue;
+    const pkg = packageNameFromSnippet(finding3.snippet);
+    if (pkg !== void 0 && names.has(pkg)) advisories += 1;
+  }
+  return { packages, advisories };
+}
 function reachabilitySteps(reachability) {
   if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
@@ -2447,6 +2719,176 @@ function osvSeverity(vuln) {
   return "high";
 }
 
+// src/modules/deps/upgrade-plan.ts
+function sentenceFor(bumps, unresolved) {
+  const parts = [];
+  if (bumps.length === 1) {
+    const bump = bumps[0];
+    if (bump !== void 0) {
+      const noun = bump.findings === 1 ? "finding" : "findings";
+      parts.push(`1 bump (${bump.name} ${bump.from} \u2192 ${bump.to}) resolves ${bump.findings} ${noun}.`);
+    }
+  } else if (bumps.length > 1) {
+    const listed = bumps.map((bump) => `${bump.name} ${bump.from} \u2192 ${bump.to}`).join(", ");
+    const total = bumps.reduce((sum, bump) => sum + bump.findings, 0);
+    const noun = total === 1 ? "finding" : "findings";
+    parts.push(`${bumps.length} bumps (${listed}) resolve ${total} ${noun}.`);
+  }
+  if (unresolved.length > 0) {
+    parts.push(`No fixed version in the OSV cache for ${unresolved.join(", ")}.`);
+  }
+  return parts.join(" ");
+}
+function chooseUpgradePlan(advisories) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const advisory of advisories) {
+    const list = byName.get(advisory.name);
+    if (list === void 0) byName.set(advisory.name, [advisory]);
+    else list.push(advisory);
+  }
+  const unresolved = [];
+  const candidates = [];
+  for (const [name, list] of byName) {
+    const from = list[0]?.from ?? "0.0.0";
+    if (list.some((advisory) => advisory.fixed === void 0)) {
+      unresolved.push(name);
+      continue;
+    }
+    let to = list[0]?.fixed;
+    for (const advisory of list) {
+      if (advisory.fixed !== void 0 && (to === void 0 || compareSemver(advisory.fixed, to) > 0)) {
+        to = advisory.fixed;
+      }
+    }
+    if (to === void 0 || compareSemver(to, from) <= 0) continue;
+    candidates.push({
+      name,
+      from,
+      to,
+      ids: list.map((advisory) => advisory.id)
+    });
+  }
+  unresolved.sort();
+  const chosen = smallestMaxCover(candidates);
+  if (chosen.length === 0 && unresolved.length === 0) return void 0;
+  const bumps = chosen.map((candidate) => ({
+    name: candidate.name,
+    from: candidate.from,
+    to: candidate.to,
+    safe: sameMajor(candidate.from, candidate.to),
+    findings: candidate.ids.length
+  }));
+  return { bumps, unresolved, sentence: sentenceFor(bumps, unresolved) };
+}
+function smallestMaxCover(candidates) {
+  const limit = Math.min(candidates.length, 12);
+  let best = [];
+  let bestCount = -1;
+  const walk2 = (index, picked, covered) => {
+    if (index === limit) {
+      if (covered.size > bestCount || covered.size === bestCount && betterTie(picked, best)) {
+        best = picked;
+        bestCount = covered.size;
+      }
+      return;
+    }
+    const next = candidates[index];
+    if (next === void 0) return;
+    walk2(index + 1, picked, covered);
+    const grown = new Set(covered);
+    for (const id of next.ids) grown.add(id);
+    walk2(index + 1, [...picked, next], grown);
+  };
+  walk2(0, [], /* @__PURE__ */ new Set());
+  return [...best].sort((a, b) => a.name.localeCompare(b.name));
+}
+function betterTie(picked, best) {
+  if (picked.length !== best.length) return picked.length < best.length;
+  const left = picked.map((item) => item.name).sort().join("\0");
+  const right = best.map((item) => item.name).sort().join("\0");
+  return left < right;
+}
+
+// src/supply/campaign.ts
+init_finding();
+var RPC_RE = /getSignaturesForAddress|eth_getLogs/;
+var NET_RE = /https\.request|http\.request|fetch\s*\(|axios\./;
+var EVAL_RE = /\beval\s*\(/;
+var STEAL_RE = /Login Data|leveldb|discord[\\/]Local Storage|wallet-extension|Ethereum\/keystore/i;
+var PLATFORM_RE = /process\.platform\s*===\s*['"]win32['"]|os\.platform\s*\(\s*\)/;
+var DOWNLOAD_RE = /https?:\/\/example\.invalid|createWriteStream|https\.get/;
+var SPAWN_RE = /child_process|spawn\s*\(|execFile\s*\(|\.exe['"]/;
+function hit(ruleId, title, message, file, severity) {
+  return {
+    id: makeFindingId(ruleId, file, message),
+    ruleId,
+    module: "deps",
+    title,
+    severity,
+    confidence: "high",
+    file,
+    message,
+    remediation: "Do not install this package. Remove it, delete node_modules, and reinstall from a clean lockfile."
+  };
+}
+function campaignFindings(files) {
+  const findings = [];
+  for (const source of files) {
+    const hasChain = RPC_RE.test(source.text);
+    const hasNet = NET_RE.test(source.text) || EVAL_RE.test(source.text);
+    if (hasChain && hasNet) {
+      findings.push(
+        hit(
+          "SUPPLY-CHAINC2-001",
+          "Package reads a blockchain RPC and then fetches or evaluates the result",
+          "static: RPC method combined with fetch or eval",
+          source.file,
+          "high"
+        )
+      );
+    }
+    const steals = STEAL_RE.test(source.text);
+    const callsNet = NET_RE.test(source.text);
+    if (steals && callsNet) {
+      findings.push(
+        hit(
+          "SUPPLY-STEALER-001",
+          "Package reads a local credential store and makes a network call",
+          "static: browser, chat, or wallet path combined with a network call",
+          source.file,
+          "critical"
+        )
+      );
+    }
+    const gated2 = PLATFORM_RE.test(source.text);
+    const downloads = DOWNLOAD_RE.test(source.text);
+    const spawns = SPAWN_RE.test(source.text);
+    if (gated2 && downloads && spawns) {
+      findings.push(
+        hit(
+          "SUPPLY-PLATFORMGATE-001",
+          "Package downloads and launches a file only on one platform",
+          "static: platform check combined with a download and a process spawn",
+          source.file,
+          "high"
+        )
+      );
+    }
+  }
+  return findings;
+}
+function securityPlaceholderFinding(name, locked, latest) {
+  if (latest !== "0.0.1-security") return void 0;
+  if (locked === "0.0.1-security") return void 0;
+  return hit(
+    "SUPPLY-SECHOLDER-001",
+    `Locked ${name}@${locked} was replaced on the registry by the security placeholder`,
+    `${name} latest is 0.0.1-security while the lockfile pins ${locked}`,
+    "package-lock.json",
+    "critical"
+  );
+}
+
 // src/modules/deps/popular.ts
 var POPULAR_PACKAGES = [
   "express",
@@ -4494,7 +4936,7 @@ ${scripts}`;
   if (!TOKEN_RE.test(text)) return [];
   const replicates = PUBLISH_RE.test(text) || REGISTRY_PUT_RE.test(text) || GITHUB_CREATE_RE.test(text) || WORKFLOW_PATH_RE.test(text);
   if (!replicates) return [];
-  const hit = sources.find(
+  const hit2 = sources.find(
     (s) => TOKEN_RE.test(s.text) && (PUBLISH_RE.test(s.text) || REGISTRY_PUT_RE.test(s.text) || GITHUB_CREATE_RE.test(s.text) || WORKFLOW_PATH_RE.test(s.text))
   ) ?? sources.find((s) => TOKEN_RE.test(s.text));
   return [
@@ -4502,7 +4944,7 @@ ${scripts}`;
       "SUPPLY-WORM-001",
       "Self-replicating worm indicators in dependency code",
       "static: npm/GitHub token read combined with publish, registry PUT, GitHub repo/workflow creation, or writing .github/workflows",
-      hit?.file,
+      hit2?.file,
       "critical"
     )
   ];
@@ -4512,13 +4954,13 @@ function analyzeWorkflowTampering(dir) {
   const text = `${sources.map((s) => s.text).join("\n")}
 ${scripts}`;
   if (!CI_WRITE_RE.test(text)) return [];
-  const hit = sources.find((s) => CI_WRITE_RE.test(s.text));
+  const hit2 = sources.find((s) => CI_WRITE_RE.test(s.text));
   return [
     finding(
       "SUPPLY-WORKFLOW-001",
       "Dependency writes GitHub workflow, git hooks, or CI config",
       "static: install script or package code writes .github/, .git/hooks/, or CI configuration",
-      hit?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
+      hit2?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
       "critical"
     )
   ];
@@ -4527,9 +4969,9 @@ function provenanceCoverage(packages, known) {
   let withProvenance = 0;
   let unknown = 0;
   for (const pkg of packages) {
-    const hit = known.get(`${pkg.name}@${pkg.version}`);
-    if (hit === true) withProvenance += 1;
-    else if (hit === void 0) unknown += 1;
+    const hit2 = known.get(`${pkg.name}@${pkg.version}`);
+    if (hit2 === true) withProvenance += 1;
+    else if (hit2 === void 0) unknown += 1;
   }
   const total = packages.length;
   return {
@@ -4556,8 +4998,8 @@ function parentsOf(name, edges) {
   }
   return out;
 }
-function isDirect(name, graph) {
-  return graph.directProd.has(name) || graph.directDev.has(name);
+function isDirect(name, graph2) {
+  return graph2.directProd.has(name) || graph2.directDev.has(name);
 }
 function packagesWithAFixedRelease(findings) {
   const names = /* @__PURE__ */ new Set();
@@ -4575,17 +5017,17 @@ function targetVersion(finding3) {
 function kindFromLockfile(lockFile) {
   return lockfileKind(lockFile) ?? "npm";
 }
-function attachOverrideProposals(findings, graph, lockFile, manifestRaw) {
-  if (!graph.edgesKnown || manifestRaw === void 0) return findings;
+function attachOverrideProposals(findings, graph2, lockFile, manifestRaw) {
+  if (!graph2.edgesKnown || manifestRaw === void 0) return findings;
   const withFix = packagesWithAFixedRelease(findings);
   const kind = kindFromLockfile(lockFile);
   return findings.map((finding3) => {
     if (finding3.ruleId !== "DEPS-VULN-001" || finding3.snippet === void 0) return finding3;
     const name = packageNameFromSnippet2(finding3.snippet);
-    if (name.length === 0 || isDirect(name, graph)) return finding3;
+    if (name.length === 0 || isDirect(name, graph2)) return finding3;
     const version = targetVersion(finding3);
     if (version === void 0) return finding3;
-    const parentFixed = parentsOf(name, graph.edges).some((parent) => withFix.has(parent));
+    const parentFixed = parentsOf(name, graph2.edges).some((parent) => withFix.has(parent));
     if (parentFixed) return finding3;
     const after = withManifestOverride(manifestRaw, kind, name, version);
     const diff = unifiedDiff("package.json", manifestRaw, after);
@@ -4606,10 +5048,10 @@ function scanInstalledPackages(cwd, packages) {
     const dir = packageDir(cwd, pkg);
     if (dir === void 0) continue;
     const prefix = pkg.path.startsWith("node_modules/") ? pkg.path : `node_modules/${pkg.name}`;
-    for (const hit of [...analyzeWormIndicators(dir), ...analyzeWorkflowTampering(dir)]) {
+    for (const hit2 of [...analyzeWormIndicators(dir), ...analyzeWorkflowTampering(dir)]) {
       out.push({
-        ...hit,
-        file: hit.file !== void 0 && hit.file.length > 0 ? `${prefix}/${hit.file}` : prefix
+        ...hit2,
+        file: hit2.file !== void 0 && hit2.file.length > 0 ? `${prefix}/${hit2.file}` : prefix
       });
     }
   }
@@ -4688,19 +5130,19 @@ function maliciousFinding(lockFile, pkg, vuln) {
     references: [vuln.id, ...vuln.aliases ?? []]
   };
 }
-function typosquatFinding(lockFile, hit) {
-  const snippet = `${hit.name}@${hit.version}`;
+function typosquatFinding(lockFile, hit2) {
+  const snippet = `${hit2.name}@${hit2.version}`;
   return {
     id: makeFindingId("DEPS-TYPOSQUAT-001", lockFile, snippet),
     ruleId: "DEPS-TYPOSQUAT-001",
     module: "deps",
-    title: `Possible typosquat: ${hit.name}`,
+    title: `Possible typosquat: ${hit2.name}`,
     severity: "medium",
     confidence: "low",
     file: lockFile,
     snippet,
-    message: `Package "${hit.name}" is 1 character from popular package "${hit.lookalike}" (possible typosquat).`,
-    remediation: `Confirm you intended to install "${hit.name}". If not, remove it and depend on "${hit.lookalike}" instead.`
+    message: `Package "${hit2.name}" is 1 character from popular package "${hit2.lookalike}" (possible typosquat).`,
+    remediation: `Confirm you intended to install "${hit2.name}". If not, remove it and depend on "${hit2.lookalike}" instead.`
   };
 }
 function noLockFinding() {
@@ -4734,6 +5176,8 @@ function deprecatedFinding(lockFile, pkg) {
 var depsModule = {
   name: "deps",
   async run(ctx) {
+    depsModule.unusedDirect = void 0;
+    depsModule.upgradePlan = void 0;
     const lockFile = LOCKFILE_NAMES.find((name) => ctx.files.includes(name));
     const cacheDir = ctx.config.deps.cacheDir !== void 0 ? resolve(ctx.cwd, ctx.config.deps.cacheDir) : defaultCacheDir();
     const osvOpts = { cacheDir, offline: ctx.config.deps.offline };
@@ -4759,21 +5203,21 @@ var depsModule = {
       }
       const pins = exactPinsFromManifest(manifest);
       const directNames2 = await readDirectDependencyNames(ctx.cwd);
-      for (const hit of findTyposquats(pins, { directNames: directNames2 })) {
-        findings2.push(typosquatFinding("package.json", hit));
+      for (const hit2 of findTyposquats(pins, { directNames: directNames2 })) {
+        findings2.push(typosquatFinding("package.json", hit2));
       }
       const osvHits2 = await queryOsv(pins, osvOpts);
       const symbols2 = /* @__PURE__ */ new Map();
-      for (const hit of osvHits2) {
-        for (const vuln of hit.vulns) {
-          const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+      for (const hit2 of osvHits2) {
+        for (const vuln of hit2.vulns) {
+          const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit2.pkg, vuln) : vulnFinding("package.json", hit2.pkg, vuln, depLoc(hit2.pkg.name));
           const names = affectedFunctionNames(vuln);
           if (names.length > 0 && finding3.ruleId === "DEPS-VULN-001") symbols2.set(finding3.id, names);
           findings2.push(finding3);
         }
       }
       const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
-      return applyReachability(findings2, noLockCtx, symbols2);
+      return withWorkspaceAdvisories(ctx.cwd, manifestRaw, osvOpts, applyReachability(findings2, noLockCtx, symbols2));
     }
     let contents;
     try {
@@ -4781,12 +5225,12 @@ var depsModule = {
     } catch {
       return [];
     }
-    const graph = parseLockfileGraph(lockFile, contents);
-    const packages = graph.packages;
+    const graph2 = parseLockfileGraph(lockFile, contents);
+    const packages = graph2.packages;
     const findings = [];
     const directNames = await readDirectDependencyNames(ctx.cwd);
-    for (const hit of findTyposquats(packages, { directNames })) {
-      findings.push(typosquatFinding(lockFile, hit));
+    for (const hit2 of findTyposquats(packages, { directNames })) {
+      findings.push(typosquatFinding(lockFile, hit2));
     }
     for (const pkg of packages) {
       if (pkg.deprecated !== void 0) {
@@ -4795,23 +5239,129 @@ var depsModule = {
     }
     const osvHits = await queryOsv(packages, osvOpts);
     const symbols = /* @__PURE__ */ new Map();
-    for (const hit of osvHits) {
-      for (const vuln of hit.vulns) {
-        const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+    for (const hit2 of osvHits) {
+      for (const vuln of hit2.vulns) {
+        const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit2.pkg, vuln) : vulnFinding(lockFile, hit2.pkg, vuln, depLoc(hit2.pkg.name));
         const names = affectedFunctionNames(vuln);
         if (names.length > 0 && finding3.ruleId === "DEPS-VULN-001") symbols.set(finding3.id, names);
         findings.push(finding3);
       }
     }
-    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
+    const reachCtx = await reachabilityCtx(ctx.cwd, ctx.files, graph2);
+    let reached = applyReachability(findings, reachCtx, symbols);
     if (experimentalVex()) {
-      reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
+      reached = attachOverrideProposals(reached, graph2, lockFile, manifestRaw);
       reached.push(...scanInstalledPackages(ctx.cwd, packages));
     }
     if (licenseEnabled()) reached.push(...await scanCopyleftLicenses(ctx.cwd));
+    depsModule.unusedDirect = unusedDirectPlan(reached, reachCtx);
+    const direct = /* @__PURE__ */ new Set([...graph2.directProd, ...graph2.directDev]);
+    const advisories = [];
+    for (const hit2 of osvHits) {
+      if (!direct.has(hit2.pkg.name)) continue;
+      for (const vuln of hit2.vulns) {
+        if (isMaliciousAdvisory(vuln)) continue;
+        advisories.push({
+          name: hit2.pkg.name,
+          from: hit2.pkg.version,
+          id: vuln.id,
+          fixed: minFixedVersion(vuln.affected ?? [])
+        });
+      }
+    }
+    depsModule.upgradePlan = chooseUpgradePlan(advisories);
+    if (process.env.FULLSHIELD_EXPERIMENTAL_REACH_EVIDENCE === "1") {
+      const sites = collectImportSites(reachCtx.sources);
+      const files = [...reachCtx.sources.keys()].sort();
+      reached = reached.map((finding3) => {
+        const evidence = evidenceForFinding(finding3, sites, files, graph2.edgesKnown);
+        return evidence === void 0 ? finding3 : { ...finding3, reachabilityEvidence: evidence };
+      });
+    }
+    reached = await withWorkspaceAdvisories(ctx.cwd, manifestRaw, osvOpts, reached);
+    if (process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY === "1") {
+      reached.push(...campaignFindings([...reachCtx.sources.entries()].map(([file, text]) => ({ file, text }))));
+      for (const name of [...direct].sort()) {
+        const locked = packages.find((pkg) => pkg.name === name)?.version;
+        if (locked === void 0) continue;
+        const latest = await readPlaceholderLatest(join(cacheDir, "registry", `${name.replaceAll("/", "__")}.json`));
+        const placeholder = securityPlaceholderFinding(name, locked, latest);
+        if (placeholder !== void 0) reached.push(placeholder);
+      }
+    }
     return reached;
   }
 };
+function workspacesEnabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_WORKSPACES === "1";
+}
+function workspacePatterns(manifestRaw) {
+  try {
+    const manifest = JSON.parse(manifestRaw);
+    const field = manifest.workspaces;
+    if (Array.isArray(field)) return field.filter((item) => typeof item === "string");
+    if (field !== null && typeof field === "object" && Array.isArray(field.packages)) {
+      return field.packages.filter((item) => typeof item === "string");
+    }
+  } catch {
+    return [];
+  }
+  return [];
+}
+async function expandWorkspace(cwd, pattern) {
+  const normalized = pattern.replace(/\\/g, "/").replace(/^\.\//, "");
+  if (!normalized.includes("*")) return [normalized];
+  const slash = normalized.indexOf("/*");
+  if (slash < 0) return [];
+  const parent = normalized.slice(0, slash);
+  try {
+    const entries = await readdir(join(cwd, parent), { withFileTypes: true });
+    return entries.filter((entry) => entry.isDirectory()).map((entry) => `${parent}/${entry.name}`).sort();
+  } catch {
+    return [];
+  }
+}
+async function workspaceAdvisoryFindings(cwd, manifestRaw, osvOpts) {
+  const dirs = /* @__PURE__ */ new Set();
+  for (const pattern of workspacePatterns(manifestRaw)) {
+    for (const dir of await expandWorkspace(cwd, pattern)) dirs.add(dir);
+  }
+  const findings = [];
+  for (const dir of [...dirs].sort()) {
+    if (dir === "" || dir === ".") continue;
+    const lockName = LOCKFILE_NAMES.find((name) => existsSync(join(cwd, dir, name)));
+    if (lockName === void 0) continue;
+    let text;
+    try {
+      text = await readFile(join(cwd, dir, lockName), "utf8");
+    } catch {
+      continue;
+    }
+    const graph2 = parseLockfileGraph(lockName, text);
+    const hits = await queryOsv(graph2.packages, osvOpts);
+    const file = `${dir}/${lockName}`;
+    for (const hit2 of hits) {
+      for (const vuln of hit2.vulns) {
+        findings.push(
+          isMaliciousAdvisory(vuln) ? maliciousFinding(file, hit2.pkg, vuln) : vulnFinding(file, hit2.pkg, vuln)
+        );
+      }
+    }
+  }
+  return findings;
+}
+async function withWorkspaceAdvisories(cwd, manifestRaw, osvOpts, findings) {
+  if (!workspacesEnabled() || manifestRaw === void 0) return findings;
+  return [...findings, ...await workspaceAdvisoryFindings(cwd, manifestRaw, osvOpts)];
+}
+async function readPlaceholderLatest(file) {
+  try {
+    const raw = JSON.parse(await readFile(file, "utf8"));
+    return typeof raw.latest === "string" ? raw.latest : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function graphFromManifest(manifest) {
   const keys = (field) => {
     const block = manifest[field];
@@ -4828,7 +5378,7 @@ function graphFromManifest(manifest) {
     edgesKnown: false
   };
 }
-async function reachabilityCtx(cwd, files, graph) {
+async function reachabilityCtx(cwd, files, graph2) {
   const prodSources = /* @__PURE__ */ new Map();
   for (const rel of files) {
     if (!/\.[cm]?[jt]sx?$/.test(rel)) continue;
@@ -4838,7 +5388,7 @@ async function reachabilityCtx(cwd, files, graph) {
     } catch {
     }
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
+  return { productionUsage: indexPackageUsage(prodSources), graph: graph2, sources: prodSources };
 }
 
 // src/modules/mcp/index.ts
@@ -5213,67 +5763,200 @@ init_finding();
 // src/modules/sast/interproc.ts
 init_finding();
 
-// src/modules/sast/frameworks.ts
-var NEXT_HANDLERS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
-var NEST_HTTP = /^(Get|Post|Put|Patch|Delete|All|Head|Options)$/;
-var NEST_INPUT = /^(Body|Query|Param|Headers)$/;
-var REQ_READERS = /* @__PURE__ */ new Set(["json", "formData", "text", "arrayBuffer"]);
-var HONO_READERS = /* @__PURE__ */ new Set(["query", "param", "header", "json", "parseBody", "text"]);
-function decoratorExpr(dec) {
-  if (dec.type !== "Decorator") return void 0;
-  return dec.expression;
-}
-function decoratorName(dec) {
-  const expr = decoratorExpr(dec);
-  if (expr === void 0) return void 0;
-  if (expr.type === "Identifier") return expr.name;
-  if (expr.type === "CallExpression") return calleeName(expr);
-  return void 0;
-}
-function nodeDecorators(node) {
-  const decs = node.decorators;
-  return Array.isArray(decs) ? decs : [];
-}
-function nestInputDecorator(param) {
-  if (!frameworksEnabled()) return void 0;
-  for (const dec of nodeDecorators(param)) {
-    const name = decoratorName(dec);
-    if (name !== void 0 && NEST_INPUT.test(name)) return name;
+// src/runtime/lru.ts
+var LruMap = class {
+  constructor(max) {
+    this.max = max;
+    if (max < 1) throw new Error("LruMap max must be >= 1");
   }
-  return void 0;
-}
-function nestDecoratorArgCount(param, name) {
-  for (const dec of nodeDecorators(param)) {
-    if (decoratorName(dec) !== name) continue;
-    const expr = decoratorExpr(dec);
-    if (expr?.type === "CallExpression") return expr.arguments.length;
-    return 0;
+  max;
+  map = /* @__PURE__ */ new Map();
+  get size() {
+    return this.map.size;
   }
-  return 0;
-}
-function isCtxIdent(node) {
-  return node.type === "Identifier" && node.name === "ctx";
-}
-function isCReq(node) {
-  return node.type === "MemberExpression" && node.object.type === "Identifier" && node.object.name === "c" && propName(node) === "req";
-}
-function isCtxRequest(node) {
-  return node.type === "MemberExpression" && isCtxIdent(node.object) && propName(node) === "request";
-}
-function isFrameworkMemberTaint(node) {
-  if (!frameworksEnabled() || node.type !== "MemberExpression") return false;
-  const name = propName(node);
-  if (name === void 0) return false;
-  if (isCtxIdent(node.object) && (REQUEST_SOURCE_PROPS.has(name) || name === "query")) return true;
-  if (isCtxRequest(node.object) && REQUEST_SOURCE_PROPS.has(name)) return true;
-  return false;
-}
-function isFrameworkTaintCall(node) {
-  if (!frameworksEnabled() || node.type !== "CallExpression") return false;
-  const name = calleeName(node);
-  if (name === void 0 || node.callee.type !== "MemberExpression") return false;
-  const obj = node.callee.object;
-  if (obj.type === "Identifier" && obj.name === "request" && REQ_READERS.has(name)) return true;
+  has(key) {
+    return this.map.has(key);
+  }
+  get(key) {
+    if (!this.map.has(key)) return void 0;
+    const value = this.map.get(key);
+    this.map.delete(key);
+    this.map.set(key, value);
+    return value;
+  }
+  set(key, value) {
+    if (this.map.has(key)) this.map.delete(key);
+    this.map.set(key, value);
+    while (this.map.size > this.max) {
+      const oldest = this.map.keys().next().value;
+      if (oldest === void 0) break;
+      this.map.delete(oldest);
+    }
+    return this;
+  }
+};
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+
+// src/core/parse-pool.ts
+var workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+var cache = new LruMap(64);
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
+  }
+  return Math.min(2, Math.max(1, availableParallelism() - 1));
+}
+function workerMemoryMb() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
+  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
+  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
+  return 512;
+}
+function parseCacheDir() {
+  return join(homedir(), ".cache", "fullshield", "parse");
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit2 = cache.get(key);
+  if (hit2 !== void 0) return Promise.resolve(hit2);
+  return new Promise((resolve5, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), {
+      workerData: { code },
+      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
+    });
+    let settled = false;
+    const finish = () => {
+      void worker.terminate();
+    };
+    const succeed = (ast) => {
+      if (settled) return;
+      settled = true;
+      cache.set(key, ast);
+      finish();
+      resolve5(ast);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      finish();
+      reject(error);
+    };
+    worker.once("message", (ast) => {
+      succeed(ast);
+    });
+    worker.once("error", (error) => {
+      fail(error);
+    });
+    worker.once("exit", (code2) => {
+      if (settled) return;
+      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
+    });
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
+
+// src/modules/sast/frameworks.ts
+var NEXT_HANDLERS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+var NEST_HTTP = /^(Get|Post|Put|Patch|Delete|All|Head|Options)$/;
+var NEST_INPUT = /^(Body|Query|Param|Headers)$/;
+var REQ_READERS = /* @__PURE__ */ new Set(["json", "formData", "text", "arrayBuffer"]);
+var HONO_READERS = /* @__PURE__ */ new Set(["query", "param", "header", "json", "parseBody", "text"]);
+function decoratorExpr(dec) {
+  if (dec.type !== "Decorator") return void 0;
+  return dec.expression;
+}
+function decoratorName(dec) {
+  const expr = decoratorExpr(dec);
+  if (expr === void 0) return void 0;
+  if (expr.type === "Identifier") return expr.name;
+  if (expr.type === "CallExpression") return calleeName(expr);
+  return void 0;
+}
+function nodeDecorators(node) {
+  const decs = node.decorators;
+  return Array.isArray(decs) ? decs : [];
+}
+function nestInputDecorator(param) {
+  if (!frameworksEnabled()) return void 0;
+  for (const dec of nodeDecorators(param)) {
+    const name = decoratorName(dec);
+    if (name !== void 0 && NEST_INPUT.test(name)) return name;
+  }
+  return void 0;
+}
+function nestDecoratorArgCount(param, name) {
+  for (const dec of nodeDecorators(param)) {
+    if (decoratorName(dec) !== name) continue;
+    const expr = decoratorExpr(dec);
+    if (expr?.type === "CallExpression") return expr.arguments.length;
+    return 0;
+  }
+  return 0;
+}
+function isCtxIdent(node) {
+  return node.type === "Identifier" && node.name === "ctx";
+}
+function isCReq(node) {
+  return node.type === "MemberExpression" && node.object.type === "Identifier" && node.object.name === "c" && propName(node) === "req";
+}
+function isCtxRequest(node) {
+  return node.type === "MemberExpression" && isCtxIdent(node.object) && propName(node) === "request";
+}
+function isFrameworkMemberTaint(node) {
+  if (!frameworksEnabled() || node.type !== "MemberExpression") return false;
+  const name = propName(node);
+  if (name === void 0) return false;
+  if (isCtxIdent(node.object) && (REQUEST_SOURCE_PROPS.has(name) || name === "query")) return true;
+  if (isCtxRequest(node.object) && REQUEST_SOURCE_PROPS.has(name)) return true;
+  return false;
+}
+function isFrameworkTaintCall(node) {
+  if (!frameworksEnabled() || node.type !== "CallExpression") return false;
+  const name = calleeName(node);
+  if (name === void 0 || node.callee.type !== "MemberExpression") return false;
+  const obj = node.callee.object;
+  if (obj.type === "Identifier" && obj.name === "request" && REQ_READERS.has(name)) return true;
   if (obj.type === "Identifier" && (obj.name === "formData" || obj.name === "searchParams") && name === "get") {
     return true;
   }
@@ -5348,6 +6031,10 @@ function isMcpArgsTaintSource(node) {
 }
 
 // src/modules/sast/taint.ts
+var customTaint;
+function setCustomTaint(config) {
+  customTaint = config;
+}
 var SCHEMA_ROOT = /^(z|zod|joi|yup|schema)$/i;
 function objectChainMentions(node, pattern) {
   let current = node;
@@ -5493,6 +6180,61 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
       return false;
   }
 }
+function valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners) {
+  if (node === void 0) return false;
+  if (isCoercionCall(node) || isSchemaValidatorCall(node) || isMongoSanitizeCall(node)) return false;
+  if (node.type === "Identifier") {
+    if (nosqlSanitized.has(node.name)) return false;
+    return built.has(node.name) || tainted.has(node.name);
+  }
+  if (isRequestObjectNode(node)) return true;
+  if (node.type === "AwaitExpression") {
+    return valueFeedsFilter(node.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  if (node.type === "CallExpression" && node.callee.type === "Identifier" && filterReturners.has(node.callee.name)) {
+    return true;
+  }
+  if (node.type === "ObjectExpression") {
+    return node.properties.some((prop) => {
+      if (prop.type === "SpreadElement") {
+        return valueFeedsFilter(prop.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+      }
+      if (prop.type !== "Property") return false;
+      return valueFeedsFilter(prop.value, tainted, returners, nosqlSanitized, built, filterReturners);
+    });
+  }
+  if (node.type === "ArrayExpression") {
+    return node.elements.some((el) => {
+      if (el === null) return false;
+      if (el.type === "SpreadElement") {
+        return valueFeedsFilter(el.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+      }
+      return valueFeedsFilter(el, tainted, returners, nosqlSanitized, built, filterReturners);
+    });
+  }
+  if (node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+    return node.arguments.some(
+      (arg) => arg.type !== "SpreadElement" && valueFeedsFilter(arg, tainted, returners, nosqlSanitized, built, filterReturners)
+    );
+  }
+  if (node.type === "ChainExpression" || node.type === "TSAsExpression" || node.type === "TSNonNullExpression" || node.type === "TSTypeAssertion" || node.type === "MemberExpression") {
+    return exprIsTainted(node, tainted, returners);
+  }
+  return false;
+}
+function initIsBuiltFilter(node, tainted, returners, nosqlSanitized, built, filterReturners) {
+  if (node.type === "AwaitExpression") {
+    return initIsBuiltFilter(node.argument, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  if (node.type === "Identifier") return built.has(node.name) && !nosqlSanitized.has(node.name);
+  if (node.type === "CallExpression" && node.callee.type === "Identifier" && filterReturners.has(node.callee.name)) {
+    return true;
+  }
+  if (node.type === "ObjectExpression" || node.type === "ArrayExpression") {
+    return valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners);
+  }
+  return node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign" && valueFeedsFilter(node, tainted, returners, nosqlSanitized, built, filterReturners);
+}
 function exprIsSanitized(node, tainted, names, isCall, returners = NO_RETURNERS) {
   if (node === void 0) return true;
   if (isCall(node)) return true;
@@ -5556,7 +6298,7 @@ function seedMcpToolParams(scope, tainted) {
     for (const name of boundNames(param)) tainted.add(name);
   }
 }
-function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
+function analyzeScope(scope, seed = [], returners = NO_RETURNERS, filterReturners = NO_RETURNERS, initialBuilt = NO_RETURNERS) {
   const tainted = new Set(seed);
   seedDestructuredRequestParams(scope, tainted);
   seedFrameworkParams(scope, tainted);
@@ -5564,6 +6306,8 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
   const urlSanitized = /* @__PURE__ */ new Set();
   const xssSanitized = /* @__PURE__ */ new Set();
   const nosqlSanitized = /* @__PURE__ */ new Set();
+  const sqlCleared = /* @__PURE__ */ new Set();
+  const customPath = /* @__PURE__ */ new Set();
   let changed = true;
   while (changed) {
     changed = false;
@@ -5574,6 +6318,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
           for (const name of boundNames(node.id)) nosqlSanitized.add(name);
         }
         if (isSchemaValidatorCall(init)) return;
+        applyCustomCall(init, boundNames(node.id), tainted, sqlCleared, customPath);
         if (isUrlSanitizerCall(init)) {
           for (const name of boundNames(node.id)) urlSanitized.add(name);
         }
@@ -5594,6 +6339,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
           for (const name of boundNames(node.left)) nosqlSanitized.add(name);
         }
         if (isSchemaValidatorCall(node.right)) return;
+        applyCustomCall(node.right, boundNames(node.left), tainted, sqlCleared, customPath);
         if (isUrlSanitizerCall(node.right)) {
           for (const name of boundNames(node.left)) urlSanitized.add(name);
         }
@@ -5620,7 +6366,7 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
       for (const name of boundNames(node.left)) resolved.add(name);
     }
   });
-  const pathSanitized = /* @__PURE__ */ new Set();
+  const pathSanitized = new Set(customPath);
   walkScope(scope, (node) => {
     if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
     if (propName(node.callee) !== "startsWith") return;
@@ -5662,17 +6408,92 @@ function analyzeScope(scope, seed = [], returners = NO_RETURNERS) {
       for (const name of boundNames(node.left)) requestObjects.add(name);
     }
   });
+  const builtFilters = new Set(initialBuilt);
+  let grew = true;
+  while (grew) {
+    grew = false;
+    const add = (names) => {
+      for (const name of names) {
+        if (nosqlSanitized.has(name) || builtFilters.has(name)) continue;
+        builtFilters.add(name);
+        grew = true;
+      }
+    };
+    walkScope(scope, (node) => {
+      if (node.type === "VariableDeclarator" && node.init !== null) {
+        if (initIsBuiltFilter(node.init, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+          add(boundNames(node.id));
+        }
+      }
+      if (node.type !== "AssignmentExpression") return;
+      if (node.left.type === "Identifier" && initIsBuiltFilter(node.right, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+        add([node.left.name]);
+      }
+      if (node.left.type === "MemberExpression" && node.left.object.type === "Identifier" && valueFeedsFilter(node.right, tainted, returners, nosqlSanitized, builtFilters, filterReturners)) {
+        add([node.left.object.name]);
+      }
+    });
+  }
   return {
     tainted,
     pathSanitized,
+    sqlCleared,
     urlSanitized,
     xssSanitized,
     nosqlSanitized,
     hasPasswordName,
     requestObjects,
+    builtFilters,
+    filterReturners: new Set(filterReturners),
     returners: new Set(returners)
   };
 }
+function locallyDeclared(scope) {
+  const names = /* @__PURE__ */ new Set();
+  if (isFunctionNode(scope)) {
+    for (const param of scope.params) {
+      for (const name of boundNames(param)) names.add(name);
+    }
+  }
+  walkScope(scope, (node) => {
+    if (node.type === "VariableDeclarator") {
+      for (const name of boundNames(node.id)) names.add(name);
+    }
+    if (node.type === "FunctionDeclaration" && node.id !== null) names.add(node.id.name);
+  });
+  return names;
+}
+function inheritedBuiltFilters(fn, facts) {
+  const local = locallyDeclared(fn);
+  const inherited = /* @__PURE__ */ new Set();
+  let parent = fn.parent;
+  while (parent !== void 0 && !isFunctionNode(parent)) {
+    parent = parent.parent;
+  }
+  const outer = parent === void 0 ? void 0 : facts.get(parent);
+  if (outer === void 0) return inherited;
+  for (const name of outer.builtFilters) {
+    if (!local.has(name)) inherited.add(name);
+  }
+  return inherited;
+}
+function scopeReturnsBuiltFilter(scope, facts) {
+  let yes = false;
+  walkScope(scope, (node) => {
+    if (node.type !== "ReturnStatement" || node.argument === null) return;
+    if (initIsBuiltFilter(
+      node.argument,
+      facts.tainted,
+      facts.returners,
+      facts.nosqlSanitized,
+      facts.builtFilters,
+      facts.filterReturners
+    )) {
+      yes = true;
+    }
+  });
+  return yes;
+}
 function functionName(fn) {
   if (fn.type === "FunctionDeclaration" && fn.id !== null) return fn.id.name;
   if (isFunctionNode(fn) && fn.id !== null && fn.id.type === "Identifier") return fn.id.name;
@@ -5762,11 +6583,12 @@ function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   const seeds = /* @__PURE__ */ new Map();
   for (const fn of functions) seeds.set(fn, /* @__PURE__ */ new Set());
   const returners = new Set(extraReturners2);
+  const filterReturners = /* @__PURE__ */ new Set();
   for (let hop = 0; hop < MAX_TAINT_HOPS; hop += 1) {
     let changed = false;
-    facts.set(ast, analyzeScope(ast, [], returners));
+    facts.set(ast, analyzeScope(ast, [], returners, filterReturners));
     for (const fn of functions) {
-      facts.set(fn, analyzeScope(fn, seeds.get(fn) ?? [], returners));
+      facts.set(fn, analyzeScope(fn, seeds.get(fn) ?? [], returners, filterReturners, inheritedBuiltFilters(fn, facts)));
     }
     for (const fn of functions) {
       const name = functionName(fn);
@@ -5776,6 +6598,10 @@ function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
         returners.add(name);
         changed = true;
       }
+      if (scopeReturnsBuiltFilter(fn, f) && !filterReturners.has(name)) {
+        filterReturners.add(name);
+        changed = true;
+      }
     }
     for (const fn of functions) {
       const f = facts.get(fn);
@@ -5808,6 +6634,54 @@ function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   }
   return facts;
 }
+var SQL_SINK_NAMES = /* @__PURE__ */ new Set(["query", "execute"]);
+var CMD_SINK_NAMES = /* @__PURE__ */ new Set(["exec", "execSync", "spawn", "spawnSync"]);
+var PATH_SINK_NAMES = /* @__PURE__ */ new Set(["readFile", "readFileSync", "writeFile", "writeFileSync"]);
+function sinkClasses(scope, tainted, returners) {
+  const found = /* @__PURE__ */ new Set();
+  walkScope(scope, (node) => {
+    if (node.type !== "CallExpression") return;
+    const name = calleeName(node);
+    const first = node.arguments[0];
+    if (name === void 0 || first === void 0 || first.type === "SpreadElement") return;
+    if (!exprIsTainted(first, tainted, returners)) return;
+    if (SQL_SINK_NAMES.has(name)) found.add("sqli");
+    if (CMD_SINK_NAMES.has(name)) found.add("cmdi");
+    if (PATH_SINK_NAMES.has(name)) found.add("path");
+  });
+  return [...found].sort();
+}
+function fileTaintSummary(ast) {
+  attachParents(ast);
+  const facts = analyzeFile(ast);
+  const returnsTaint = [];
+  const functions = [];
+  walk(ast, (node) => {
+    if (!isFunctionNode(node)) return;
+    const name = functionName(node);
+    const own = facts.get(node);
+    if (name === void 0 || own === void 0) return;
+    if (scopeReturnsTaint(node, own.tainted, own.returners)) returnsTaint.push(name);
+    const paramsToReturn = [];
+    const sinks = [];
+    node.params.forEach((param, index) => {
+      const pname = boundNames(param)[0];
+      if (pname === void 0) return;
+      const seeded = analyzeScope(node, [pname]);
+      if (scopeReturnsTaint(node, seeded.tainted, seeded.returners)) paramsToReturn.push(index);
+      for (const cls of sinkClasses(node, seeded.tainted, seeded.returners)) sinks.push({ param: index, class: cls });
+    });
+    functions.push({
+      name,
+      line: node.loc?.start.line ?? 0,
+      paramsToReturn,
+      sinks
+    });
+  });
+  returnsTaint.sort();
+  functions.sort((a, b) => a.line - b.line || a.name.localeCompare(b.name));
+  return { returnsTaint, functions };
+}
 function functionsThatReturnTaint(ast) {
   attachParents(ast);
   const names = /* @__PURE__ */ new Set();
@@ -5829,18 +6703,50 @@ function factsFor(node, map) {
   return map.get(enclosingScope(node)) ?? {
     tainted: /* @__PURE__ */ new Set(),
     pathSanitized: /* @__PURE__ */ new Set(),
+    sqlCleared: /* @__PURE__ */ new Set(),
     urlSanitized: /* @__PURE__ */ new Set(),
     xssSanitized: /* @__PURE__ */ new Set(),
     nosqlSanitized: /* @__PURE__ */ new Set(),
     hasPasswordName: false,
     requestObjects: /* @__PURE__ */ new Set(),
+    builtFilters: /* @__PURE__ */ new Set(),
+    filterReturners: /* @__PURE__ */ new Set(),
     returners: /* @__PURE__ */ new Set()
   };
 }
+function nodeHoldsBuiltFilter(node, map) {
+  const facts = factsFor(node, map);
+  if (node.type === "Identifier") return facts.builtFilters.has(node.name);
+  if (node.type === "AwaitExpression") return nodeHoldsBuiltFilter(node.argument, map);
+  if (node.type === "CallExpression" && node.callee.type === "Identifier") {
+    return facts.filterReturners.has(node.callee.name);
+  }
+  return false;
+}
 function nodeIsTainted(node, map) {
   const facts = factsFor(node, map);
   return exprIsTainted(node, facts.tainted, facts.returners);
 }
+function nodeIsSqlCleared(node, map) {
+  if (node.type === "Identifier") return factsFor(node, map).sqlCleared.has(node.name);
+  return false;
+}
+function applyCustomCall(init, names, tainted, sqlCleared, customPath) {
+  if (customTaint === void 0 || init === void 0 || init.type !== "CallExpression") return;
+  const called2 = calleeName(init);
+  if (called2 === void 0) return;
+  if (customTaint.sources.has(called2)) {
+    for (const name of names) tainted.add(name);
+  }
+  const clears = customTaint.sanitizers.get(called2);
+  if (clears === void 0) return;
+  if (clears.has("sqli")) {
+    for (const name of names) sqlCleared.add(name);
+  }
+  if (clears.has("path")) {
+    for (const name of names) customPath.add(name);
+  }
+}
 function nodeIsPathSanitized(node, map) {
   if (node.type !== "Identifier") return false;
   return factsFor(node, map).pathSanitized.has(node.name);
@@ -5863,6 +6769,147 @@ function nodeIsNosqlSanitized(node, map) {
   return false;
 }
 
+// src/modules/sast/summaries.ts
+function taintSummariesEnabled() {
+  return process.env.FULLSHIELD_TAINT_SUMMARIES === "1";
+}
+var configHash = "";
+function setTaintSummaryConfig(config) {
+  fileMemo.clear();
+  if (config === void 0) {
+    configHash = "";
+    return;
+  }
+  configHash = createHash("sha256").update(
+    JSON.stringify({
+      maxFileBytes: config.sast.maxFileBytes,
+      sources: config.sast.sources ?? [],
+      sanitizers: config.sast.sanitizers ?? [],
+      taintV2: taintV2Enabled(),
+      frameworks: frameworksEnabled(),
+      gaps: sastGapsEnabled(),
+      classes: classesEnabled(),
+      custom: process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1"
+    })
+  ).digest("hex");
+}
+function summaryDir() {
+  return process.env.FULLSHIELD_TAINT_SUMMARY_DIR ?? join(parseCacheDir(), "taint");
+}
+function taintSummaryKey(source, extra = "") {
+  return createHash("sha256").update(packageVersion()).update("\0").update(configHash).update("\0").update(extra).update("\0").update(source).digest("hex");
+}
+function summaryPath(key) {
+  return join(summaryDir(), `${key}.json`);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function readJson3(key) {
+  let text;
+  try {
+    text = readFileSync(summaryPath(key), "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    discard(key);
+    return void 0;
+  }
+}
+function discard(key) {
+  rmSync(summaryPath(key), { force: true });
+}
+function writeJson(key, value) {
+  const dir = summaryDir();
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(summaryPath(key), JSON.stringify(value));
+}
+function readFileSummary(key) {
+  const raw = readJson3(key);
+  if (typeof raw !== "object" || raw === null) {
+    if (raw !== void 0) discard(key);
+    return void 0;
+  }
+  const row = raw;
+  if (row.v !== 1 || !isStringArray(row.returnsTaint) || !Array.isArray(row.functions)) {
+    discard(key);
+    return void 0;
+  }
+  return row;
+}
+var fileMemo = /* @__PURE__ */ new Map();
+function cachedReturners(source, ast) {
+  const key = taintSummaryKey(source, "file");
+  const memo = fileMemo.get(key);
+  if (memo !== void 0) return new Set(memo.returnsTaint);
+  const cached = readFileSummary(key);
+  if (cached !== void 0) {
+    fileMemo.set(key, cached);
+    return new Set(cached.returnsTaint);
+  }
+  const summary = fileTaintSummary(ast);
+  const stored = { v: 1, returnsTaint: summary.returnsTaint, functions: summary.functions };
+  fileMemo.set(key, stored);
+  writeJson(key, stored);
+  return new Set(stored.returnsTaint);
+}
+function lists(facts) {
+  const names = (set) => [...set].sort();
+  return {
+    v: 1,
+    tainted: names(facts.tainted),
+    pathSanitized: names(facts.pathSanitized),
+    sqlCleared: names(facts.sqlCleared),
+    urlSanitized: names(facts.urlSanitized),
+    xssSanitized: names(facts.xssSanitized),
+    nosqlSanitized: names(facts.nosqlSanitized),
+    requestObjects: names(facts.requestObjects),
+    builtFilters: names(facts.builtFilters),
+    filterReturners: names(facts.filterReturners),
+    returners: names(facts.returners),
+    hasPasswordName: facts.hasPasswordName
+  };
+}
+function factsFrom(row) {
+  return {
+    tainted: new Set(row.tainted),
+    pathSanitized: new Set(row.pathSanitized),
+    sqlCleared: new Set(row.sqlCleared),
+    urlSanitized: new Set(row.urlSanitized),
+    xssSanitized: new Set(row.xssSanitized),
+    nosqlSanitized: new Set(row.nosqlSanitized),
+    requestObjects: new Set(row.requestObjects),
+    builtFilters: new Set(row.builtFilters),
+    filterReturners: new Set(row.filterReturners),
+    returners: new Set(row.returners),
+    hasPasswordName: row.hasPasswordName
+  };
+}
+function readFacts(key) {
+  const raw = readJson3(key);
+  if (typeof raw !== "object" || raw === null) {
+    if (raw !== void 0) discard(key);
+    return void 0;
+  }
+  const row = raw;
+  if (row.v !== 1 || !isStringArray(row.tainted) || !isStringArray(row.pathSanitized) || !isStringArray(row.sqlCleared) || !isStringArray(row.urlSanitized) || !isStringArray(row.xssSanitized) || !isStringArray(row.nosqlSanitized) || !isStringArray(row.requestObjects) || !isStringArray(row.builtFilters) || !isStringArray(row.filterReturners) || !isStringArray(row.returners) || typeof row.hasPasswordName !== "boolean") {
+    discard(key);
+    return void 0;
+  }
+  return factsFrom(row);
+}
+function cachedFunctionFacts(fileSource, fn, seed) {
+  const key = taintSummaryKey(fileSource, `seed:${fn.loc?.start.line ?? 0}:${seed.join(",")}`);
+  const cached = readFacts(key);
+  if (cached !== void 0) return cached;
+  const facts = analyzeFunctionWithSeed(fn, seed);
+  writeJson(key, lists(facts));
+  return facts;
+}
+
 // src/modules/sast/interproc.ts
 var MAX_HOPS = 5;
 function collectFunctions(file, ast) {
@@ -5973,22 +7020,22 @@ function collectInstances(ast, ns) {
     if (node.type !== "VariableDeclarator" || node.init === null) return;
     if (node.id.type !== "Identifier" || node.init.type !== "NewExpression") return;
     if (node.init.callee.type !== "Identifier") return;
-    const hit = ns.get(node.init.callee.name);
-    if (hit === void 0) return;
-    instances.set(node.id.name, hit.includes("#") ? hit.split("#")[0] ?? hit : hit);
+    const hit2 = ns.get(node.init.callee.name);
+    if (hit2 === void 0) return;
+    instances.set(node.id.name, hit2.includes("#") ? hit2.split("#")[0] ?? hit2 : hit2);
   });
   return instances;
 }
 function resolveCallee(node, ns, instances, currentFile, functions) {
   if (node.type !== "CallExpression") return void 0;
   if (node.callee.type === "Identifier") {
-    const hit = ns.get(node.callee.name);
-    if (hit !== void 0) {
-      if (hit.includes("#")) {
-        const [file, name] = hit.split("#");
+    const hit2 = ns.get(node.callee.name);
+    if (hit2 !== void 0) {
+      if (hit2.includes("#")) {
+        const [file, name] = hit2.split("#");
         if (file !== void 0 && name !== void 0) return { file, name };
       }
-      return { file: hit, name: node.callee.name };
+      return { file: hit2, name: node.callee.name };
     }
     if (functions.has(`${currentFile}#${node.callee.name}`)) {
       return { file: currentFile, name: node.callee.name };
@@ -6095,9 +7142,9 @@ function runInterproc(parsed) {
     if (fn === void 0) continue;
     const param = fn.params[seed.paramIndex];
     if (param === void 0) continue;
-    const facts = analyzeFunctionWithSeed(fn.node, [param]);
     const p = byFile.get(fn.file);
     if (p === void 0) continue;
+    const facts = taintSummariesEnabled() ? cachedFunctionFacts(p.source, fn.node, [param]) : analyzeFunctionWithSeed(fn.node, [param]);
     const ns = requires.get(fn.file) ?? /* @__PURE__ */ new Map();
     const inst = instances.get(fn.file) ?? /* @__PURE__ */ new Map();
     walk(fn.node, (node) => {
@@ -6520,6 +7567,178 @@ var jwtRule = {
   }
 };
 
+// src/modules/sast/validation.ts
+var PRIMITIVE = /* @__PURE__ */ new Set(["string", "number", "boolean", "IsString", "IsNumber", "IsInt", "IsBoolean"]);
+var OPEN = /* @__PURE__ */ new Set(["any", "unknown", "object", "array", "record", "lazy", "union", "tuple"]);
+var SCHEMA_ROOT2 = /* @__PURE__ */ new Set(["z", "zod", "Joi", "joi"]);
+var ROUTE_METHODS = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
+function validationEnabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_VALIDATION === "1";
+}
+function parentOf(node) {
+  return node.parent;
+}
+function mentions(node, names) {
+  let current = node;
+  for (let i = 0; i < 12 && current !== void 0; i += 1) {
+    if (current.type === "CallExpression") {
+      const name = calleeName(current);
+      if (name !== void 0 && names.has(name)) return true;
+      current = current.callee.type === "MemberExpression" ? current.callee.object : void 0;
+      continue;
+    }
+    if (current.type === "MemberExpression") {
+      const name = propName(current);
+      if (name !== void 0 && names.has(name)) return true;
+      current = current.object;
+      continue;
+    }
+    if (current.type === "Identifier" && names.has(current.name)) return true;
+    break;
+  }
+  return false;
+}
+function rootName(node) {
+  let current = node;
+  for (let i = 0; i < 8 && current !== void 0; i += 1) {
+    if (current.type === "Identifier") return current.name;
+    if (current.type === "CallExpression") {
+      current = current.callee;
+      continue;
+    }
+    if (current.type === "MemberExpression") {
+      current = current.object;
+      continue;
+    }
+    break;
+  }
+  return void 0;
+}
+function propertyName(prop) {
+  if (prop.type !== "Property") return void 0;
+  const key = prop.key;
+  if (key.type === "Identifier") return key.name;
+  if (key.type === "Literal" && typeof key.value === "string") return key.value;
+  return void 0;
+}
+function fieldsOfObjectSchema(node) {
+  if (node.type !== "CallExpression" || calleeName(node) !== "object") return /* @__PURE__ */ new Set();
+  const root = rootName(node.callee);
+  if (root === void 0 || !SCHEMA_ROOT2.has(root)) return /* @__PURE__ */ new Set();
+  const arg = node.arguments[0];
+  if (arg === void 0 || arg.type !== "ObjectExpression") return /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const prop of arg.properties) {
+    if (prop.type !== "Property") continue;
+    const name = propertyName(prop);
+    if (name === void 0) continue;
+    if (mentions(prop.value, OPEN)) continue;
+    if (mentions(prop.value, PRIMITIVE)) fields.add(name);
+  }
+  return fields;
+}
+function decoratorName2(decorator) {
+  const expr = decorator.type === "Decorator" ? decorator.expression : decorator;
+  if (expr === void 0) return void 0;
+  if (expr.type === "CallExpression") return calleeName(expr);
+  if (expr.type === "Identifier") return expr.name;
+  return void 0;
+}
+function fieldsOfClass(node) {
+  if (node.type !== "ClassDeclaration" && node.type !== "ClassExpression") return /* @__PURE__ */ new Set();
+  if (node.body.type !== "ClassBody") return /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const element of node.body.body) {
+    if (element.type !== "PropertyDefinition") continue;
+    const key = element.key;
+    const name = key.type === "Identifier" ? key.name : void 0;
+    if (name === void 0) continue;
+    const decorators = element.decorators ?? [];
+    if (decorators.some((decorator) => PRIMITIVE.has(decoratorName2(decorator) ?? ""))) fields.add(name);
+  }
+  return fields;
+}
+function programOf(node) {
+  let current = node;
+  while (current !== void 0 && current.type !== "Program") current = parentOf(current);
+  return current;
+}
+function bindings(program) {
+  const map = /* @__PURE__ */ new Map();
+  walk(program, (node) => {
+    if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.init !== null && node.init !== void 0) {
+      const fields = fieldsOfObjectSchema(node.init);
+      if (fields.size > 0) map.set(node.id.name, fields);
+    }
+    if (node.type === "ClassDeclaration" && node.id !== null) {
+      const fields = fieldsOfClass(node);
+      if (fields.size > 0) map.set(node.id.name, fields);
+    }
+  });
+  return map;
+}
+var bindingCache = /* @__PURE__ */ new WeakMap();
+function fieldsOfExpr(expr, known) {
+  if (expr.type === "Identifier") return new Set(known.get(expr.name) ?? []);
+  if (expr.type === "ClassExpression" || expr.type === "ClassDeclaration") return fieldsOfClass(expr);
+  const direct = fieldsOfObjectSchema(expr);
+  if (expr.type !== "CallExpression") return direct;
+  for (const arg of expr.arguments) {
+    if (arg.type === "SpreadElement") continue;
+    for (const name of fieldsOfExpr(arg, known)) direct.add(name);
+  }
+  return direct;
+}
+function isRouteCall2(node) {
+  if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return false;
+  const method = propName(node.callee);
+  if (method === void 0 || !ROUTE_METHODS.has(method)) return false;
+  return node.callee.object.type === "Identifier" && /^(app|router)$/i.test(node.callee.object.name);
+}
+function routeOf(node) {
+  let current = node;
+  while (current !== void 0) {
+    const parent = parentOf(current);
+    if (isFunctionNode(current) && parent !== void 0 && isRouteCall2(parent)) return parent;
+    current = parent;
+  }
+  return void 0;
+}
+function requestField(node) {
+  if (node.type !== "MemberExpression" || node.computed === true) return void 0;
+  const field = node.property.type === "Identifier" ? node.property.name : void 0;
+  if (field === void 0 || node.object.type !== "MemberExpression" || node.object.computed === true) return void 0;
+  const bag = node.object.property.type === "Identifier" ? node.object.property.name : void 0;
+  if (bag !== "body" && bag !== "query" && bag !== "params") return void 0;
+  if (node.object.object.type !== "Identifier" || node.object.object.name !== "req") return void 0;
+  return field;
+}
+var routeCache = /* @__PURE__ */ new WeakMap();
+function fieldsForRoute(route) {
+  const cached = routeCache.get(route);
+  if (cached !== void 0) return cached;
+  const program = programOf(route);
+  const known = program === void 0 ? /* @__PURE__ */ new Map() : bindingCache.get(program) ?? bindings(program);
+  if (program !== void 0) bindingCache.set(program, known);
+  const fields = /* @__PURE__ */ new Set();
+  if (route.type === "CallExpression") {
+    for (const arg of route.arguments) {
+      if (arg.type === "SpreadElement" || isFunctionNode(arg)) continue;
+      for (const name of fieldsOfExpr(arg, known)) fields.add(name);
+    }
+  }
+  routeCache.set(route, fields);
+  return fields;
+}
+function isValidatedRouteField(node) {
+  if (!validationEnabled()) return false;
+  const field = requestField(node);
+  if (field === void 0) return false;
+  const route = routeOf(node);
+  if (route === void 0) return false;
+  return fieldsForRoute(route).has(field);
+}
+
 // src/modules/sast/rules/nosqli.ts
 var MONGO_SINKS = /* @__PURE__ */ new Set([
   "find",
@@ -6604,6 +7823,7 @@ function isNosqlSafeValue(node, source, isNosqlSanitized) {
   if (isNosqlSanitized(node) || isCoercionCall(node) || isSchemaValidatorCall(node) || isMongoSanitizeCall(node)) {
     return true;
   }
+  if (isValidatedRouteField(node)) return true;
   return isSanitizeWrap(node, source);
 }
 function objectHasUnsafeTaintedValue(node, isTainted, isSafe) {
@@ -6667,6 +7887,14 @@ var nosqliRule = {
           return;
         }
         if (middleware) return;
+        if (ctx.holdsBuiltFilter(filter)) {
+          ctx.report({
+            node,
+            message: "A Mongo filter built from request input is passed to the query.",
+            confidence: "medium"
+          });
+          return;
+        }
         if (objectHasUnsafeTaintedValue(filter, (n) => ctx.isTainted(n), isSafe)) {
           ctx.report({
             node,
@@ -6843,7 +8071,7 @@ var sqliRule = {
       CallExpression(node) {
         if (node.type !== "CallExpression" || !isSqlSink2(node)) return;
         const sql = node.arguments[0];
-        if (sql !== void 0 && sql.type !== "SpreadElement" && ctx.isTainted(sql)) {
+        if (sql !== void 0 && sql.type !== "SpreadElement" && ctx.isTainted(sql) && !ctx.isSqlCleared(sql)) {
           ctx.report({
             node,
             message: "Tainted input is concatenated into a SQL string passed to query/execute."
@@ -6993,27 +8221,27 @@ function numberLiteral(node) {
   return node.value;
 }
 function containsIdentMember(node, objectName) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
     if (child.type === "MemberExpression" && child.object.type === "Identifier" && child.object.name === objectName) {
-      hit = true;
+      hit2 = true;
     }
   });
-  return hit;
+  return hit2;
 }
 function containsCallNamed(node, name) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
-    if (child.type === "CallExpression" && calleeName(child) === name) hit = true;
+    if (child.type === "CallExpression" && calleeName(child) === name) hit2 = true;
   });
-  return hit;
+  return hit2;
 }
 function containsOriginalName(node) {
-  let hit = false;
+  let hit2 = false;
   walk(node, (child) => {
-    if (child.type === "MemberExpression" && propName(child) === "originalname") hit = true;
+    if (child.type === "MemberExpression" && propName(child) === "originalname") hit2 = true;
   });
-  return hit;
+  return hit2;
 }
 function schemaLooksSafe(schema) {
   if (schema === void 0) return false;
@@ -7580,188 +8808,58 @@ function reportGqlServer(ctx, node, optsArg, mentionsProduction) {
   const opts = optsArg !== void 0 && optsArg.type !== "SpreadElement" ? optsArg : void 0;
   const introspection = objectProp2(opts, "introspection");
   const rules = objectProp2(opts, "validationRules");
-  const hasDepth = rules !== void 0 && containsCallNamed(rules, "depthLimit") || objectProp2(opts, "depthLimit") !== void 0 || /depthLimit|createComplexity|queryComplexity|costAnalysis/.test(ctx.source);
-  const introOn = boolLiteral(introspection) === true;
-  if (introOn && mentionsProduction) {
-    ctx.report({ node, message: "GraphQL introspection is enabled in production." });
-  }
-  if (!hasDepth) {
-    ctx.report({ node, message: "GraphQL server has no depth or complexity limit." });
-  }
-}
-var phase29Rules = [
-  gated(redosRule),
-  gated(deserRule),
-  gated(xxeRule),
-  gated(uploadRule),
-  gated(cookieRule),
-  gated(csrfRule),
-  gated(massAssignRule),
-  gated(timingRule),
-  gated(hashRule),
-  gated(gqlRule)
-];
-
-// src/ai/injection.ts
-init_finding();
-var PHRASES = [/ignore previous/i, /mark as safe/i, /ai reviewer/i];
-function isCommentLine(line) {
-  const trimmed = line.trim();
-  return trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*");
-}
-function scanPromptInjection(file, source) {
-  const findings = [];
-  const lines = source.split(/\r?\n/);
-  lines.forEach((line, index) => {
-    if (!isCommentLine(line)) return;
-    if (!PHRASES.some((p) => p.test(line))) return;
-    findings.push({
-      id: makeFindingId("AI-INJECT-001", file, `${index + 1}|${line.trim()}`),
-      ruleId: "AI-INJECT-001",
-      module: "sast",
-      title: "Prompt-injection comment aimed at AI reviewers",
-      severity: "medium",
-      confidence: "high",
-      file,
-      line: index + 1,
-      snippet: line.trim().slice(0, 120),
-      message: "Code contains text attempting to manipulate AI reviewers.",
-      remediation: "Remove comments that try to instruct an AI reviewer.",
-      references: ["AI-INJECT-001"],
-      source: "deterministic"
-    });
-  });
-  return findings;
-}
-
-// src/runtime/lru.ts
-var LruMap = class {
-  constructor(max) {
-    this.max = max;
-    if (max < 1) throw new Error("LruMap max must be >= 1");
-  }
-  max;
-  map = /* @__PURE__ */ new Map();
-  get size() {
-    return this.map.size;
-  }
-  has(key) {
-    return this.map.has(key);
-  }
-  get(key) {
-    if (!this.map.has(key)) return void 0;
-    const value = this.map.get(key);
-    this.map.delete(key);
-    this.map.set(key, value);
-    return value;
-  }
-  set(key, value) {
-    if (this.map.has(key)) this.map.delete(key);
-    this.map.set(key, value);
-    while (this.map.size > this.max) {
-      const oldest = this.map.keys().next().value;
-      if (oldest === void 0) break;
-      this.map.delete(oldest);
-    }
-    return this;
-  }
-};
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
-
-// src/core/parse-pool.ts
-var workerUrl = new URL("./parse-worker.mjs", import.meta.url);
-var cache = new LruMap(64);
-function parsePoolEnabled() {
-  return process.env.FULLSHIELD_PARSE_POOL === "1";
-}
-function parsePoolSize() {
-  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
-  if (raw !== void 0 && raw !== "") {
-    const parsed = Number(raw);
-    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
+  const hasDepth = rules !== void 0 && containsCallNamed(rules, "depthLimit") || objectProp2(opts, "depthLimit") !== void 0 || /depthLimit|createComplexity|queryComplexity|costAnalysis/.test(ctx.source);
+  const introOn = boolLiteral(introspection) === true;
+  if (introOn && mentionsProduction) {
+    ctx.report({ node, message: "GraphQL introspection is enabled in production." });
+  }
+  if (!hasDepth) {
+    ctx.report({ node, message: "GraphQL server has no depth or complexity limit." });
   }
-  return Math.min(2, Math.max(1, availableParallelism() - 1));
-}
-function workerMemoryMb() {
-  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
-  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
-  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
-  return 512;
 }
-function parseCacheKey(code) {
-  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+var phase29Rules = [
+  gated(redosRule),
+  gated(deserRule),
+  gated(xxeRule),
+  gated(uploadRule),
+  gated(cookieRule),
+  gated(csrfRule),
+  gated(massAssignRule),
+  gated(timingRule),
+  gated(hashRule),
+  gated(gqlRule)
+];
+
+// src/ai/injection.ts
+init_finding();
+var PHRASES = [/ignore previous/i, /mark as safe/i, /ai reviewer/i];
+function isCommentLine(line) {
+  const trimmed = line.trim();
+  return trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*");
 }
-function parseOne(code) {
-  const key = parseCacheKey(code);
-  const hit = cache.get(key);
-  if (hit !== void 0) return Promise.resolve(hit);
-  return new Promise((resolve5, reject) => {
-    const worker = new Worker(fileURLToPath(workerUrl), {
-      workerData: { code },
-      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
-    });
-    let settled = false;
-    const finish = () => {
-      void worker.terminate();
-    };
-    const succeed = (ast) => {
-      if (settled) return;
-      settled = true;
-      cache.set(key, ast);
-      finish();
-      resolve5(ast);
-    };
-    const fail = (error) => {
-      if (settled) return;
-      settled = true;
-      finish();
-      reject(error);
-    };
-    worker.once("message", (ast) => {
-      succeed(ast);
-    });
-    worker.once("error", (error) => {
-      fail(error);
-    });
-    worker.once("exit", (code2) => {
-      if (settled) return;
-      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
+function scanPromptInjection(file, source) {
+  const findings = [];
+  const lines = source.split(/\r?\n/);
+  lines.forEach((line, index) => {
+    if (!isCommentLine(line)) return;
+    if (!PHRASES.some((p) => p.test(line))) return;
+    findings.push({
+      id: makeFindingId("AI-INJECT-001", file, `${index + 1}|${line.trim()}`),
+      ruleId: "AI-INJECT-001",
+      module: "sast",
+      title: "Prompt-injection comment aimed at AI reviewers",
+      severity: "medium",
+      confidence: "high",
+      file,
+      line: index + 1,
+      snippet: line.trim().slice(0, 120),
+      message: "Code contains text attempting to manipulate AI reviewers.",
+      remediation: "Remove comments that try to instruct an AI reviewer.",
+      references: ["AI-INJECT-001"],
+      source: "deterministic"
     });
   });
-}
-async function parseWithPool(codes) {
-  const size = parsePoolSize();
-  const out = new Array(codes.length);
-  let next = 0;
-  async function run() {
-    for (; ; ) {
-      const index = next;
-      next += 1;
-      if (index >= codes.length) return;
-      const code = codes[index];
-      if (code === void 0) return;
-      out[index] = await parseOne(code);
-    }
-  }
-  const workers = Math.min(size, Math.max(1, codes.length));
-  await Promise.all(Array.from({ length: workers }, () => run()));
-  return out;
+  return findings;
 }
 
 // src/modules/sast/engine.ts
@@ -7823,10 +8921,12 @@ function findingsFromAst(filename, source, ast, extraReturners2 = /* @__PURE__ *
         });
       },
       isTainted: (node) => nodeIsTainted(node, facts),
+      isSqlCleared: (node) => nodeIsSqlCleared(node, facts),
       isPathSanitized: (node) => nodeIsPathSanitized(node, facts),
       isSanitizedFor: (node, kind) => nodeIsSanitizedFor(node, facts, kind),
       isNosqlSanitized: (node) => nodeIsNosqlSanitized(node, facts),
       isRequestObject: (node) => nodeIsRequestObject(node, facts),
+      holdsBuiltFilter: (node) => nodeHoldsBuiltFilter(node, facts),
       functionHasPasswordName: (node) => factsFor(node, facts).hasPasswordName,
       assignedName: (node) => assignedNameOf(node),
       projectCsrfProtected
@@ -7864,10 +8964,12 @@ function findingsFromTemplate(filename, source) {
       });
     },
     isTainted: () => false,
+    isSqlCleared: () => false,
     isPathSanitized: () => false,
     isSanitizedFor: () => false,
     isNosqlSanitized: () => false,
     isRequestObject: () => false,
+    holdsBuiltFilter: () => false,
     functionHasPasswordName: () => false,
     assignedName: () => void 0,
     projectCsrfProtected: false
@@ -7999,7 +9101,7 @@ async function runSastStreaming(ctx) {
     }
     const ast = await parseCode(source);
     if (ast === void 0) continue;
-    returning.set(rel, functionsThatReturnTaint(ast));
+    returning.set(rel, taintSummariesEnabled() ? cachedReturners(source, ast) : functionsThatReturnTaint(ast));
     parseable.push(rel);
     fileSet.add(rel);
   }
@@ -8030,48 +9132,69 @@ async function runSastStreaming(ctx) {
 var sastModule = {
   name: "sast",
   async run(ctx) {
-    const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
-    if (candidates.length > sastStreamThreshold()) return runSastStreaming(ctx);
-    const maxBytes = ctx.config.sast.maxFileBytes;
-    const findings = [];
-    const parsed = [];
-    for (const rel of candidates) {
-      const source = await readScanSource(ctx.cwd, rel);
-      if (source === void 0) continue;
-      const why = skipReason(source, maxBytes);
-      if (why !== void 0) {
-        findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
-        continue;
-      }
-      if (TEMPLATE_EXT.test(rel)) {
-        findings.push(...findingsFromTemplate(rel, source));
-        continue;
-      }
-      const ast = await parseCode(source);
-      if (ast === void 0) continue;
-      parsed.push({ file: rel, source, ast });
-    }
-    const files = new Set(parsed.map((p) => p.file));
-    const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
-    const returning = /* @__PURE__ */ new Map();
-    for (const entry of parsed) {
-      returning.set(entry.file, functionsThatReturnTaint(entry.ast));
+    if (process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1") {
+      const sources = new Set((ctx.config.sast.sources ?? []).map((row) => row.callee));
+      const sanitizers = /* @__PURE__ */ new Map();
+      for (const row of ctx.config.sast.sanitizers ?? []) {
+        const classes = sanitizers.get(row.callee) ?? /* @__PURE__ */ new Set();
+        for (const name of row.clears) classes.add(name);
+        sanitizers.set(row.callee, classes);
+      }
+      setCustomTaint({ sources, sanitizers });
+    } else {
+      setCustomTaint(void 0);
     }
-    for (const entry of parsed) {
-      findings.push(
-        ...findingsFromAst(
+    setTaintSummaryConfig(taintSummariesEnabled() ? ctx.config : void 0);
+    try {
+      const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
+      if (candidates.length > sastStreamThreshold()) return await runSastStreaming(ctx);
+      const maxBytes = ctx.config.sast.maxFileBytes;
+      const findings = [];
+      const parsed = [];
+      for (const rel of candidates) {
+        const source = await readScanSource(ctx.cwd, rel);
+        if (source === void 0) continue;
+        const why = skipReason(source, maxBytes);
+        if (why !== void 0) {
+          findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+          continue;
+        }
+        if (TEMPLATE_EXT.test(rel)) {
+          findings.push(...findingsFromTemplate(rel, source));
+          continue;
+        }
+        const ast = await parseCode(source);
+        if (ast === void 0) continue;
+        parsed.push({ file: rel, source, ast });
+      }
+      const files = new Set(parsed.map((p) => p.file));
+      const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
+      const returning = /* @__PURE__ */ new Map();
+      for (const entry of parsed) {
+        returning.set(
           entry.file,
-          entry.source,
-          entry.ast,
-          extraReturners(entry.file, entry.ast, files, returning),
-          projectCsrf
-        )
-      );
+          taintSummariesEnabled() ? cachedReturners(entry.source, entry.ast) : functionsThatReturnTaint(entry.ast)
+        );
+      }
+      for (const entry of parsed) {
+        findings.push(
+          ...findingsFromAst(
+            entry.file,
+            entry.source,
+            entry.ast,
+            extraReturners(entry.file, entry.ast, files, returning),
+            projectCsrf
+          )
+        );
+      }
+      findings.push(...runInterproc(parsed));
+      const out = dedupeSastSinks(findings);
+      releaseParsed(parsed);
+      return out;
+    } finally {
+      setCustomTaint(void 0);
+      setTaintSummaryConfig(void 0);
     }
-    findings.push(...runInterproc(parsed));
-    const out = dedupeSastSinks(findings);
-    releaseParsed(parsed);
-    return out;
   }
 };
 
@@ -8365,12 +9488,12 @@ ${text}`);
   const seeds = fixtureLogic(prompt);
   const findings = [];
   for (const seed of seeds) {
-    const hit = fileTexts.find((f) => f.file.includes(seed.fileHint) && f.text.includes(seed.fileHint === "user" ? "findById" : "Object.assign")) ?? fileTexts.find(
+    const hit2 = fileTexts.find((f) => f.file.includes(seed.fileHint) && f.text.includes(seed.fileHint === "user" ? "findById" : "Object.assign")) ?? fileTexts.find(
       (f) => f.text.includes(seed.ruleId === "AI-IDOR-001" ? "findById(req.params.id)" : "Object.assign(user, req.body)")
     );
-    if (hit === void 0) continue;
-    const line = hit.text.split(/\r?\n/).findIndex((l) => l.includes(seed.ruleId === "AI-IDOR-001" ? "findById" : "Object.assign")) + 1;
-    findings.push(asAiFinding(seed, hit.file, line > 0 ? line : 1));
+    if (hit2 === void 0) continue;
+    const line = hit2.text.split(/\r?\n/).findIndex((l) => l.includes(seed.ruleId === "AI-IDOR-001" ? "findById" : "Object.assign")) + 1;
+    findings.push(asAiFinding(seed, hit2.file, line > 0 ? line : 1));
   }
   return findings;
 }
@@ -8634,6 +9757,56 @@ var KNOWN_KEYS = /* @__PURE__ */ new Set([
   "ai",
   "sast"
 ]);
+var SAST_CLASSES = /* @__PURE__ */ new Set([
+  "sqli",
+  "nosqli",
+  "cmdi",
+  "path",
+  "xss",
+  "ssrf",
+  "redirect",
+  "eval",
+  "jwt",
+  "crypto",
+  "proto",
+  "secrets",
+  "deps",
+  "config"
+]);
+function parseSastSources(value, source) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new ConfigError(`${source}: "sast.sources" must be an array`);
+  return value.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new ConfigError(`${source}: "sast.sources" entries must be objects`);
+    }
+    const row = item;
+    if (typeof row.callee !== "string" || row.callee.length === 0) {
+      throw new ConfigError(`${source}: "sast.sources[].callee" must be a string`);
+    }
+    if (row.returns !== "tainted") {
+      throw new ConfigError(`${source}: "sast.sources[].returns" must be "tainted"`);
+    }
+    return { callee: row.callee, returns: "tainted" };
+  });
+}
+function parseSastSanitizers(value, source) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new ConfigError(`${source}: "sast.sanitizers" must be an array`);
+  return value.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new ConfigError(`${source}: "sast.sanitizers" entries must be objects`);
+    }
+    const row = item;
+    if (typeof row.callee !== "string" || row.callee.length === 0) {
+      throw new ConfigError(`${source}: "sast.sanitizers[].callee" must be a string`);
+    }
+    if (!Array.isArray(row.clears) || row.clears.some((name) => typeof name !== "string" || !SAST_CLASSES.has(name))) {
+      throw new ConfigError(`${source}: "sast.sanitizers[].clears" must be B4 class names`);
+    }
+    return { callee: row.callee, clears: row.clears.filter((name) => name !== "secrets" && name !== "deps") };
+  });
+}
 function validate(raw, source) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new ConfigError(`${source}: config must be a JSON object`);
@@ -8759,6 +9932,16 @@ function validate(raw, source) {
       }
       sast.maxFileBytes = rawSast.maxFileBytes;
     }
+    const custom = process.env.FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS === "1";
+    if (!custom && (rawSast.sources !== void 0 || rawSast.sanitizers !== void 0)) {
+      throw new ConfigError(
+        `${source}: unknown key "sast.sources" (FULLSHIELD_EXPERIMENTAL_CUSTOM_SANITIZERS)`
+      );
+    }
+    if (custom) {
+      sast.sources = parseSastSources(rawSast.sources, source);
+      sast.sanitizers = parseSastSanitizers(rawSast.sanitizers, source);
+    }
     out.sast = sast;
   }
   return out;
@@ -9094,6 +10277,8 @@ function dedupe2(findings) {
 async function runScan(options = {}, modules = builtinModules) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const t0 = performance.now();
+  depsModule.unusedDirect = void 0;
+  depsModule.upgradePlan = void 0;
   const cwd = resolve(options.cwd ?? process.cwd());
   const stats = await stat(cwd).catch(() => null);
   if (stats === null || !stats.isDirectory()) {
@@ -9192,8 +10377,8 @@ async function runScan(options = {}, modules = builtinModules) {
     const { applyVerification: applyVerification2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
     const { scanTextForSecretHits: scanTextForSecretHits2 } = await Promise.resolve().then(() => (init_secrets(), secrets_exports));
     const secretById = /* @__PURE__ */ new Map();
-    for (const hit of extraHits) {
-      if (hit.secret !== void 0) secretById.set(hit.finding.id, hit.secret);
+    for (const hit2 of extraHits) {
+      if (hit2.secret !== void 0) secretById.set(hit2.finding.id, hit2.secret);
     }
     for (const finding3 of findings) {
       if (finding3.module !== "secrets" || finding3.file === void 0 || secretById.has(finding3.id)) {
@@ -9207,8 +10392,8 @@ async function runScan(options = {}, modules = builtinModules) {
           continue;
         }
       }
-      for (const hit of scanTextForSecretHits2(finding3.file, text)) {
-        if (hit.secret !== void 0) secretById.set(hit.finding.id, hit.secret);
+      for (const hit2 of scanTextForSecretHits2(finding3.file, text)) {
+        if (hit2.secret !== void 0) secretById.set(hit2.finding.id, hit2.secret);
       }
     }
     findings = sortFindings(
@@ -9260,7 +10445,9 @@ async function runScan(options = {}, modules = builtinModules) {
       filesScanned: files.length,
       modulesRequested: [...modulesRequested],
       modulesRun,
-      ...historyNotice !== void 0 ? { history: historyNotice } : {}
+      ...historyNotice !== void 0 ? { history: historyNotice } : {},
+      ...depsModule.unusedDirect !== void 0 ? { unusedDirect: depsModule.unusedDirect } : {},
+      ...depsModule.upgradePlan !== void 0 ? { upgradePlan: depsModule.upgradePlan } : {}
     },
     config,
     policy: policyResult,
@@ -9474,6 +10661,28 @@ async function runFix(options = {}) {
     const after = applyUnifiedDiff(source, proposed.diff);
     byFile.set(sourceFile, after);
   }
+  const unused = result.metadata.unusedDirect?.packages ?? [];
+  if (unused.length > 0) {
+    let manifest = byFile.get("package.json");
+    if (manifest === void 0) {
+      try {
+        manifest = await readFile(join(cwd, "package.json"), "utf8");
+      } catch {
+        manifest = void 0;
+      }
+    }
+    if (manifest !== void 0) {
+      const next = removeDirectDependencies(manifest, unused);
+      const diff = dependencyRemovalDiff(manifest, unused);
+      if (diff.length > 0) {
+        patches.push({ file: "package.json", ruleId: "DEPS-VULN-001", safe: false, diff });
+        if (options.unsafe === true) {
+          byFile.set("package.json", next);
+          appliedOverride = true;
+        }
+      }
+    }
+  }
   const notice = appliedOverride ? "run npm install" : void 0;
   if (options.apply !== true) {
     return { applied: false, reverted: false, patches, findings: result.findings, notice };
@@ -9521,6 +10730,29 @@ async function restoreSnapshots(cwd, snapshots) {
     }
   }
 }
+function dependencyRemovalDiff(manifest, names) {
+  const drop = names.map((name) => `"${name}"`);
+  const removed = manifest.split("\n").filter((line) => drop.some((token) => line.includes(token)));
+  if (removed.length === 0) return "";
+  return ["--- a/package.json", "+++ b/package.json", ...removed.map((line) => `-${line}`)].join("\n");
+}
+function removeDirectDependencies(manifest, names) {
+  let parsed;
+  try {
+    parsed = JSON.parse(manifest);
+  } catch {
+    return manifest;
+  }
+  if (parsed.dependencies === void 0 || typeof parsed.dependencies !== "object") return manifest;
+  const drop = new Set(names);
+  const next = {};
+  for (const [name, version] of Object.entries(parsed.dependencies)) {
+    if (!drop.has(name)) next[name] = version;
+  }
+  parsed.dependencies = next;
+  const trailing = manifest.endsWith("\n") ? "\n" : "";
+  return `${JSON.stringify(parsed, null, 2)}${trailing}`;
+}
 function runProjectTests(cwd) {
   let pkg;
   try {
@@ -9660,7 +10892,159 @@ function renderFinding(finding3) {
   }
   return lines;
 }
-function renderConsoleReport(input) {
+var SEVERITY_RANK = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3,
+  info: 4
+};
+var SHOWN_VULN_REACH = /* @__PURE__ */ new Set([
+  "reachable",
+  "symbol-reachable",
+  "reachable-via-dependency",
+  "reachability-unknown"
+]);
+function packageNameFromSnippet3(snippet) {
+  if (snippet === void 0 || snippet.length === 0) return void 0;
+  if (snippet.startsWith("@")) {
+    const second = snippet.indexOf("@", 1);
+    return second === -1 ? snippet : snippet.slice(0, second);
+  }
+  const at = snippet.indexOf("@");
+  return at <= 0 ? snippet : snippet.slice(0, at);
+}
+function versionsFromSnippet(snippet) {
+  const name = packageNameFromSnippet3(snippet);
+  if (name === void 0 || snippet === void 0) return [];
+  const rest = snippet.slice(name.length + 1);
+  return rest.length === 0 ? [] : rest.split(",").filter((version) => version.length > 0);
+}
+function isDevOnly2(finding3) {
+  return finding3.message.includes("(dev-only)");
+}
+function isActionable(finding3) {
+  if (finding3.ruleId === "DEPS-MALICIOUS-001") return true;
+  if (finding3.ruleId === "DEPS-VULN-001") {
+    if (isDevOnly2(finding3)) return false;
+    return finding3.reachability !== void 0 && SHOWN_VULN_REACH.has(finding3.reachability);
+  }
+  if (finding3.module === "sast" || finding3.module === "secrets" || finding3.module === "config") {
+    return finding3.severity === "high" || finding3.severity === "critical" || finding3.confidence === "high";
+  }
+  return false;
+}
+function reachRank(finding3) {
+  const reachability = finding3.reachability;
+  if (reachability === "reachable" || reachability === "symbol-reachable") return 0;
+  if (reachability === "reachable-via-dependency") return 1;
+  if (reachability === "reachability-unknown") return 2;
+  if (reachability === void 0) return 4;
+  return 3;
+}
+function compareActionable(a, b) {
+  const maliciousA = a.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+  const maliciousB = b.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+  return maliciousA - maliciousB || SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || reachRank(a) - reachRank(b) || (a.file ?? "").localeCompare(b.file ?? "") || (a.line ?? 0) - (b.line ?? 0) || a.ruleId.localeCompare(b.ruleId);
+}
+function highestSeverity(findings) {
+  return findings.reduce(
+    (best, finding3) => SEVERITY_RANK[finding3.severity] < SEVERITY_RANK[best] ? finding3.severity : best,
+    findings[0]?.severity ?? "info"
+  );
+}
+function bestReachability(findings) {
+  let best;
+  let bestRank = 5;
+  for (const finding3 of findings) {
+    const rank = reachRank(finding3);
+    if (finding3.reachability !== void 0 && rank < bestRank) {
+      best = finding3.reachability;
+      bestRank = rank;
+    }
+  }
+  return best;
+}
+function shownConsoleRows(findings) {
+  return dependencyRows(findings.filter(isActionable));
+}
+function dependencyRows(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  const singles = [];
+  for (const finding3 of findings) {
+    const name = packageNameFromSnippet3(finding3.snippet);
+    if ((finding3.ruleId === "DEPS-VULN-001" || finding3.ruleId === "DEPS-MALICIOUS-001") && name !== void 0) {
+      const list = groups.get(name);
+      if (list === void 0) groups.set(name, [finding3]);
+      else list.push(finding3);
+    } else {
+      singles.push(finding3);
+    }
+  }
+  const rows = singles.map((finding3) => ({
+    findings: [finding3],
+    severity: finding3.severity,
+    reachability: finding3.reachability,
+    ruleId: finding3.ruleId,
+    file: finding3.file,
+    line: finding3.line,
+    versions: [],
+    grouped: false
+  }));
+  for (const [packageName, list] of groups) {
+    const ordered = [...list].sort(compareActionable);
+    const first = ordered[0];
+    if (first === void 0) continue;
+    const versions = [...new Set(list.flatMap((finding3) => versionsFromSnippet(finding3.snippet)))].sort();
+    const malicious = list.find((finding3) => finding3.ruleId === "DEPS-MALICIOUS-001");
+    rows.push({
+      findings: ordered,
+      severity: highestSeverity(list),
+      reachability: bestReachability(list),
+      ruleId: malicious?.ruleId ?? "DEPS-VULN-001",
+      file: first.file,
+      line: first.line,
+      packageName,
+      versions,
+      path: first.dependencyPath,
+      grouped: true
+    });
+  }
+  rows.sort((a, b) => {
+    const probeA = a.findings[0];
+    const probeB = b.findings[0];
+    if (probeA === void 0 || probeB === void 0) return 0;
+    const maliciousA = a.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+    const maliciousB = b.ruleId === "DEPS-MALICIOUS-001" ? 0 : 1;
+    return maliciousA - maliciousB || SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || reachRank({ ...probeA, reachability: a.reachability }) - reachRank({ ...probeB, reachability: b.reachability }) || (a.file ?? "").localeCompare(b.file ?? "") || (a.line ?? 0) - (b.line ?? 0) || a.ruleId.localeCompare(b.ruleId);
+  });
+  return rows;
+}
+function renderRow(row) {
+  if (!row.grouped) {
+    const only = row.findings[0];
+    if (only === void 0) return [];
+    return [...renderFinding(only), `    docs: rules/${only.ruleId}.md`];
+  }
+  const reach = row.reachability ?? "unspecified";
+  const lines = [
+    `  ${pc.bold(`[${row.ruleId}]`)} ${row.packageName} \u2014 ${row.findings.length} advisories, ${row.severity}, ${reach}`,
+    `    versions: ${row.versions.join(", ") || "unknown"}`
+  ];
+  if (row.path !== void 0 && row.path.length > 0) {
+    lines.push(`    path: ${row.path.join(" > ")}`);
+  }
+  if (row.file !== void 0) {
+    lines.push(`    ${row.file}${row.line !== void 0 ? `:${row.line}` : ""}`);
+  }
+  const evidenceImport = row.findings[0]?.reachabilityEvidence?.imports[0];
+  if (evidenceImport !== void 0) {
+    lines.push(`    import: ${evidenceImport.file}:${evidenceImport.line} ${evidenceImport.specifier}`);
+  }
+  lines.push(`    docs: rules/${row.ruleId}.md`);
+  return lines;
+}
+function renderConsoleReport(input, options = {}) {
   const result = redactScan(input);
   const { findings, summary, metadata } = result;
   const lines = [];
@@ -9670,34 +11054,63 @@ function renderConsoleReport(input) {
     )
   );
   if (metadata.history !== void 0) lines.push(metadata.history);
+  if (metadata.upgradePlan !== void 0 && metadata.upgradePlan.sentence.length > 0) {
+    lines.push(metadata.upgradePlan.sentence);
+  }
+  if (metadata.unusedDirect !== void 0) {
+    const count = metadata.unusedDirect.packages.length;
+    const advisories = metadata.unusedDirect.advisories;
+    const packageWord = count === 1 ? "package is" : "packages are";
+    const advisoryWord = advisories === 1 ? "advisory" : "advisories";
+    lines.push(
+      `${count} ${packageWord} never imported; removing them clears ${advisories} ${advisoryWord}.`
+    );
+  }
   if (metadata.modulesRun.length < metadata.modulesRequested.length) {
     const pending = metadata.modulesRequested.filter((m) => !metadata.modulesRun.includes(m));
     lines.push(
       pc.dim(`note: requested modules not implemented yet: ${pending.join(", ")}`)
     );
   }
-  const bySeverityDesc = [...SEVERITIES].reverse();
-  const ordered = bySeverityDesc.flatMap((severity) => findings.filter((f) => f.severity === severity));
-  const shown = ordered.slice(0, 10);
-  const hidden = ordered.length - shown.length;
-  for (const severity of bySeverityDesc) {
-    const group = shown.filter((f) => f.severity === severity);
-    if (group.length === 0) continue;
-    lines.push("");
-    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${findings.filter((f) => f.severity === severity).length})`));
-    for (const finding3 of group) {
-      lines.push(...renderFinding(finding3));
-      lines.push(`    docs: rules/${finding3.ruleId}.md`);
+  const showAll = options.all === true;
+  const folded = findings.filter((finding3) => !isActionable(finding3));
+  const rows = showAll ? [...findings].sort(compareActionable).map((finding3) => ({
+    findings: [finding3],
+    severity: finding3.severity,
+    reachability: finding3.reachability,
+    ruleId: finding3.ruleId,
+    file: finding3.file,
+    line: finding3.line,
+    versions: [],
+    grouped: false
+  })) : shownConsoleRows(findings);
+  const printed = showAll ? rows : rows.slice(0, 20);
+  const hiddenActionable = showAll ? 0 : rows.length - printed.length;
+  let previous;
+  for (const row of printed) {
+    if (row.severity !== previous) {
+      const count = printed.filter((item) => item.severity === row.severity).length;
+      lines.push("");
+      lines.push(SEVERITY_COLOR[row.severity](`${row.severity.toUpperCase()} (${count})`));
+      previous = row.severity;
     }
+    lines.push(...renderRow(row));
   }
-  if (hidden > 0) {
+  if (hiddenActionable > 0) {
     lines.push("");
-    lines.push(`${hidden} more \u2014 use --json`);
+    lines.push(`${hiddenActionable} more actionable \u2014 use --json`);
+  }
+  if (!showAll && folded.length > 0) {
+    lines.push("");
+    lines.push(
+      `${folded.length} more (not directly reachable, or below high confidence) \u2014 --all or see JSON`
+    );
   }
   lines.push("");
   if (summary.total === 0) {
     lines.push(pc.green("\u2714 No findings."));
   } else {
+    const bySeverityDesc = [...SEVERITIES].reverse();
     const counts = bySeverityDesc.filter((s) => summary.bySeverity[s] > 0).map((s) => `${summary.bySeverity[s]} ${s}`).join(", ");
     lines.push(pc.red(`\u2716 ${summary.total} finding(s): ${counts}`));
   }
@@ -9828,6 +11241,14 @@ function renderMarkdownReport(input) {
   return lines.join("\n");
 }
 
+// src/core/fingerprint.ts
+init_finding();
+function lineIndependentFingerprint(finding3) {
+  const file = (finding3.file ?? "").replace(/\\/g, "/");
+  const text = (finding3.snippet ?? finding3.message ?? "").replace(/\s+/g, " ").trim();
+  return makeFindingId(finding3.ruleId, file, `${finding3.severity}\0${text}`);
+}
+
 // src/reporters/sarif.ts
 var SCHEMA_URI = "https://json.schemastore.org/sarif-2.1.0.json";
 function sarifLevel(severity) {
@@ -9838,15 +11259,37 @@ function sarifLevel(severity) {
 function uri(file) {
   return (file ?? "").replace(/\\/g, "/");
 }
+function sarifV2() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_SARIF_V2 === "1";
+}
+function ruleMarkdown(ruleId) {
+  const path = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "rules", `${ruleId}.md`);
+  if (!existsSync(path)) return void 0;
+  return readFileSync(path, "utf8").slice(0, 2048);
+}
+function relatedLocations(finding3) {
+  if (finding3.dependencyPath === void 0 || finding3.dependencyPath.length === 0) return void 0;
+  return finding3.dependencyPath.map((step) => ({
+    message: { text: step },
+    physicalLocation: {
+      artifactLocation: { uri: uri(finding3.file) },
+      ...finding3.line !== void 0 ? { region: { startLine: finding3.line } } : {}
+    }
+  }));
+}
 function renderSarifReport(input) {
   const result = redactScan(input);
+  const v2 = sarifV2();
   const rules = /* @__PURE__ */ new Map();
   for (const finding3 of result.findings) {
     if (!rules.has(finding3.ruleId)) {
+      const markdown = v2 ? ruleMarkdown(finding3.ruleId) : void 0;
       rules.set(finding3.ruleId, {
         id: finding3.ruleId,
         name: finding3.ruleId,
-        shortDescription: { text: finding3.title }
+        shortDescription: { text: finding3.title },
+        ...markdown !== void 0 ? { help: { markdown } } : {},
+        ...v2 ? { properties: { precision: "unreviewed" } } : {}
       });
     }
   }
@@ -9875,6 +11318,7 @@ function renderSarifReport(input) {
               }
             }
           ] : [];
+          const related = v2 ? relatedLocations(finding3) : void 0;
           const codeFlows = finding3.trace !== void 0 && finding3.trace.length > 0 ? [
             {
               threadFlows: [
@@ -9897,7 +11341,12 @@ function renderSarifReport(input) {
             level: sarifLevel(finding3.severity),
             message: { text: finding3.message },
             locations: location4,
-            ...codeFlows !== void 0 ? { codeFlows } : {}
+            ...codeFlows !== void 0 ? { codeFlows } : {},
+            ...v2 ? {
+              partialFingerprints: { "fullshield/v1": lineIndependentFingerprint(finding3) },
+              ...related !== void 0 ? { relatedLocations: related } : {},
+              ...finding3.module === "deps" && finding3.reachability !== void 0 ? { properties: { reachability: finding3.reachability } } : {}
+            } : {}
           };
         })
       }
@@ -9946,14 +11395,6 @@ function validateSarif21(doc) {
   return errors;
 }
 
-// src/core/fingerprint.ts
-init_finding();
-function lineIndependentFingerprint(finding3) {
-  const file = (finding3.file ?? "").replace(/\\/g, "/");
-  const text = (finding3.snippet ?? finding3.message ?? "").replace(/\s+/g, " ").trim();
-  return makeFindingId(finding3.ruleId, file, `${finding3.severity}\0${text}`);
-}
-
 // src/reporters/ci.ts
 init_finding();
 var MESSAGE_CAP = 4e3;
@@ -10209,6 +11650,16 @@ function validateCycloneDx15(doc) {
   if (!Array.isArray(root.components)) errors.push("components must be an array");
   return errors;
 }
+function reachProperties(finding3) {
+  const properties = [
+    { name: "fullshield:reachability", value: finding3.reachability ?? "unspecified" },
+    { name: "fullshield:devOnly", value: finding3.message.includes("(dev-only)") ? "true" : "false" }
+  ];
+  if (finding3.dependencyPath !== void 0 && finding3.dependencyPath.length > 0) {
+    properties.splice(1, 0, { name: "fullshield:dependencyPath", value: finding3.dependencyPath.join(" > ") });
+  }
+  return properties;
+}
 function renderCycloneDx(input) {
   const vulns = (input.findings ?? []).filter((f) => f.ruleId === "DEPS-VULN-001");
   return {
@@ -10219,13 +11670,18 @@ function renderCycloneDx(input) {
     metadata: {
       component: { type: "application", name: input.name, version: input.version }
     },
-    components: input.components.map((c) => ({
-      type: "library",
-      name: c.name,
-      version: c.version,
-      purl: c.purl ?? `pkg:npm/${encodeURIComponent(c.name)}@${c.version}`,
-      ...c.license !== void 0 ? { licenses: [{ license: { id: c.license } }] } : {}
-    })),
+    components: input.components.map((c) => {
+      const match = (input.findings ?? []).find((finding3) => finding3.snippet?.startsWith(`${c.name}@`));
+      const properties = input.includeReach === true && match !== void 0 ? reachProperties(match) : void 0;
+      return {
+        type: "library",
+        name: c.name,
+        version: c.version,
+        purl: c.purl ?? `pkg:npm/${encodeURIComponent(c.name)}@${c.version}`,
+        ...c.license !== void 0 ? { licenses: [{ license: { id: c.license } }] } : {},
+        ...properties !== void 0 ? { properties } : {}
+      };
+    }),
     vulnerabilities: vulns.map((f) => ({
       id: f.references?.find((r) => r.startsWith("GHSA-") || r.startsWith("CVE-")) ?? f.id,
       description: f.message,
@@ -10236,7 +11692,7 @@ function renderCycloneDx(input) {
 
 // src/sbom/index.ts
 var LOCKFILE_NAMES2 = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
-async function buildSbom(cwd) {
+async function buildSbom(cwd, options = {}) {
   const result = await scan({ cwd, modules: ["deps"] });
   let name = "app";
   let version = "0.0.0";
@@ -10262,7 +11718,13 @@ async function buildSbom(cwd) {
   if (components.length === 0) {
     components = exactPinsFromManifest(manifest).map((p) => ({ name: p.name, version: p.version }));
   }
-  return renderCycloneDx({ name, version, components, findings: result.findings });
+  return renderCycloneDx({
+    name,
+    version,
+    components,
+    findings: result.findings,
+    includeReach: options.includeReach === true
+  });
 }
 var OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
 var OPENVEX_NOT_AFFECTED_JUSTIFICATION = "vulnerable_code_not_in_execute_path";
@@ -10297,14 +11759,16 @@ function openVexStatement(finding3) {
     vulnerability: { name: vulnName(finding3) },
     products: [{ "@id": npmPurl(finding3.snippet) }]
   };
+  const detail = process.env.FULLSHIELD_EXPERIMENTAL_SBOM_REACH === "1" && finding3.reachabilityEvidence?.reason !== void 0 ? { detail: finding3.reachabilityEvidence.reason } : {};
   if (notImported(finding3)) {
     return {
       ...base,
       status: "not_affected",
-      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION
+      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION,
+      ...detail
     };
   }
-  return { ...base, status: "under_investigation" };
+  return { ...base, status: "under_investigation", ...detail };
 }
 function buildOpenVex(findings) {
   const statements = depFindings(findings).map(openVexStatement);