fad-checker 1.0.0

package/lib/cve-report.js

@@ -0,0 +1,1455 @@
+/**
+ * lib/cve-report.js — generate self-contained HTML and Word-compatible (.doc)
+ * reports from matched CVE/EOL/obsolete/outdated findings.
+ *
+ * Word opens HTML saved as .doc natively — we use the same HTML body
+ * wrapped in Word XML namespace meta tags.
+ */
+const fs = require("fs");
+const path = require("path");
+
+function esc(s) {
+	if (s == null) return "";
+	return String(s)
+		.replace(/&/g, "&")
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;")
+		.replace(/"/g, "&quot;");
+}
+
+function computeStats(cveMatches) {
+	const buckets = { critical: 0, high: 0, medium: 0, low: 0, none: 0, unknown: 0, transitive: 0, direct: 0 };
+	for (const m of cveMatches || []) {
+		const sev = (m.cve.severity || "UNKNOWN").toLowerCase();
+		if (buckets[sev] != null) buckets[sev]++;
+		else buckets.unknown++;
+		if (m.dep?.scope === "transitive") buckets.transitive++;
+		else buckets.direct++;
+	}
+	buckets.total = (cveMatches || []).length;
+	return buckets;
+}
+
+const SEVERITY_BADGE = {
+	CRITICAL: { bg: "#7c0008", fg: "#fff" },
+	HIGH:     { bg: "#c92a2a", fg: "#fff" },
+	MEDIUM:   { bg: "#f08c00", fg: "#fff" },
+	LOW:      { bg: "#3b82f6", fg: "#fff" },
+	NONE:     { bg: "#aaa",    fg: "#fff" },
+	UNKNOWN:  { bg: "#666",    fg: "#fff" },
+};
+
+function badge(sev) {
+	const s = (sev || "UNKNOWN").toUpperCase();
+	const c = SEVERITY_BADGE[s] || SEVERITY_BADGE.UNKNOWN;
+	return `<span style="display:inline-block;padding:2px 8px;border-radius:3px;background:${c.bg};color:${c.fg};font-weight:600;font-size:11px;letter-spacing:.5px">${esc(s)}</span>`;
+}
+
+const CSS = `
+* { box-sizing: border-box; }
+body { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; color: #1f2937; margin: 24px; background: #f9fafb; }
+.report-header { border-bottom: 3px solid #6366f1; padding-bottom: 16px; margin-bottom: 20px; }
+h1 { margin: 0 0 4px 0; font-size: 28px; letter-spacing: -.5px; }
+.report-subtitle { color: #6b7280; font-size: 14px; font-weight: 500; margin-bottom: 12px; letter-spacing: .3px; }
+h2 { margin: 32px 0 12px; font-size: 20px; border-bottom: 2px solid #e5e7eb; padding-bottom: 6px; }
+.meta { color: #6b7280; font-size: 13px; margin-bottom: 16px; }
+.summary { display: flex; flex-wrap: wrap; gap: 12px; margin: 16px 0; }
+.summary .card { padding: 10px 16px; border-radius: 6px; background: #fff; border: 1px solid #e5e7eb; min-width: 120px; }
+.summary .card .v { font-size: 24px; font-weight: 700; }
+.summary .card .l { font-size: 11px; text-transform: uppercase; color: #6b7280; letter-spacing: .5px; }
+.summary .card.sev-critical { border-left: 4px solid #dc2626; }
+.summary .card.sev-critical .v { color: #dc2626; }
+.summary .card.sev-high { border-left: 4px solid #f97316; }
+.summary .card.sev-high .v { color: #f97316; }
+.summary .card.sev-medium { border-left: 4px solid #f59e0b; }
+.summary .card.sev-medium .v { color: #b45309; }
+.summary .card.sev-low { border-left: 4px solid #2563eb; }
+.summary .card.sev-low .v { color: #2563eb; }
+.summary .card.sev-vendored { border-left: 4px solid #6366f1; }
+.summary .card.sev-warn { border-left: 4px solid #f59e0b; background: #fffbeb; }
+.toc { position: sticky; top: 0; z-index: 50; background: #fff; border: 1px solid #e5e7eb; border-radius: 6px; padding: 8px 12px; margin: 16px 0; display: flex; flex-wrap: wrap; gap: 6px 14px; font-size: 12px; box-shadow: 0 1px 4px rgba(0,0,0,.04); }
+.toc a { color: #4338ca; text-decoration: none; padding: 2px 6px; border-radius: 3px; }
+.toc a:hover { background: #eef2ff; }
+.exec-summary .exec-top { margin-top: 8px; padding-top: 10px; border-top: 1px dashed #e5e7eb; }
+.exec-summary .exec-top-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .8px; color: #6b7280; margin-bottom: 6px; }
+.exec-summary .exec-top-list { list-style: none; padding: 0; margin: 0; font-size: 12px; }
+.exec-summary .exec-top-list li { display: flex; align-items: center; gap: 8px; padding: 3px 0; font-family: ui-monospace, monospace; }
+.exec-summary .exec-cve-link { color: #1d4ed8; text-decoration: none; font-weight: 600; }
+.exec-summary .exec-cve-link:hover { text-decoration: underline; }
+.exec-summary .exec-ver { color: #6b7280; }
+.exec-summary .exec-fix { color: #065f46; font-weight: 600; }
+.fp-intro { background: #f3f4f6; border-left: 3px solid #6b7280; padding: 10px 14px; margin: 8px 0 16px; font-size: 12px; color: #4b5563; line-height: 1.5; }
+td.cwe { font-family: ui-monospace, monospace; font-size: 11px; color: #4b5563; }
+td.cwe .cwe-link { color: #6366f1; text-decoration: none; }
+td.cwe .cwe-link:hover { text-decoration: underline; }
+td.cwe .cwe-empty { color: #d1d5db; }
+td.cwe .cwe-more { color: #9ca3af; font-style: italic; font-size: 10px; }
+td.published { font-family: ui-monospace, monospace; font-size: 11px; color: #6b7280; white-space: nowrap; }
+tr.cve-row.cpe-fp td { opacity: .55; }
+.jump-badge { display: inline-block; padding: 1px 8px; border-radius: 4px; font-size: 10px; font-weight: 700; text-transform: uppercase; letter-spacing: .5px; }
+.jump-badge.jump-major { background: #fee2e2; color: #991b1b; }
+.jump-badge.jump-minor { background: #fef3c7; color: #92400e; }
+.jump-badge.jump-patch { background: #e0f2fe; color: #075985; }
+.jump-badge.jump-pre, .jump-badge.jump-unknown { background: #f3f4f6; color: #6b7280; }
+tr.jump-patch td, tr.jump-pre td, tr.jump-unknown td { opacity: .75; }
+tr.cve-row .cpe-tag { display: inline-block; margin-top: 2px; font-size: 9px; font-weight: 600; text-transform: uppercase; letter-spacing: .5px; background: #f3f4f6; color: #6b7280; padding: 1px 5px; border-radius: 3px; }
+table { width: 100%; border-collapse: collapse; background: #fff; margin: 8px 0 24px; font-size: 13px; }
+th, td { padding: 8px 10px; text-align: left; border-bottom: 1px solid #e5e7eb; vertical-align: top; }
+th { background: #f3f4f6; font-weight: 600; font-size: 11px; text-transform: uppercase; letter-spacing: .5px; color: #4b5563; }
+tr:nth-child(even) { background: #fafafa; }
+td.dep { font-family: ui-monospace, monospace; font-size: 12px; }
+.defined-in { margin-top: 4px; font-family: ui-monospace, monospace; font-size: 10px; color: #6b7280; line-height: 1.4; }
+.defined-in .defined-label { color: #9ca3af; font-family: -apple-system, "Segoe UI", Roboto, sans-serif; text-transform: uppercase; letter-spacing: .4px; font-size: 9px; margin-right: 4px; }
+.defined-in code { background: #f3f4f6; padding: 1px 4px; border-radius: 3px; color: #374151; word-break: break-all; }
+code.path { font-family: ui-monospace, monospace; font-size: 0.9em; background: #f3f4f6; padding: 1px 6px; border-radius: 3px; color: #1f2937; font-weight: 400; }
+.exec-summary { border: 1px solid #e5e7eb; border-radius: 8px; padding: 16px 20px; margin: 16px 0; background: #fff; display: flex; flex-direction: column; gap: 8px; }
+.exec-summary .exec-head { display: flex; align-items: center; gap: 12px; }
+.exec-summary .exec-level { font-size: 12px; font-weight: 700; letter-spacing: 1px; padding: 4px 12px; border-radius: 999px; }
+.exec-summary .exec-title { font-size: 18px; font-weight: 600; color: #111827; }
+.exec-summary .exec-meta { font-size: 12px; color: #6b7280; }
+.exec-summary .exec-bullets { margin: 4px 0 0; padding-left: 22px; font-size: 13px; color: #374151; line-height: 1.6; }
+.exec-summary.exec-critical { border-color: #dc2626; }
+.exec-summary.exec-critical .exec-level { background: #dc2626; color: #fff; }
+.exec-summary.exec-high { border-color: #f97316; }
+.exec-summary.exec-high .exec-level { background: #f97316; color: #fff; }
+.exec-summary.exec-medium { border-color: #f59e0b; }
+.exec-summary.exec-medium .exec-level { background: #f59e0b; color: #fff; }
+.exec-summary.exec-low { border-color: #2563eb; }
+.exec-summary.exec-low .exec-level { background: #2563eb; color: #fff; }
+.exec-summary.exec-info { border-color: #10b981; }
+.exec-summary.exec-info .exec-level { background: #10b981; color: #fff; }
+.exec-summary.exec-unknown { border-color: #6b7280; }
+.exec-summary.exec-unknown .exec-level { background: #6b7280; color: #fff; }
+.defined-in .defined-more { color: #9ca3af; font-style: italic; }
+td.cve a { color: #1d4ed8; text-decoration: none; font-family: ui-monospace, monospace; }
+td.cve a:hover { text-decoration: underline; }
+td.desc { color: #4b5563; max-width: 480px; }
+.empty { color: #9ca3af; font-style: italic; padding: 12px 0; }
+.warnings { background: #fffbeb; border: 1px solid #fcd34d; padding: 12px 16px; border-radius: 6px; margin: 16px 0; }
+.warnings h3 { margin: 0 0 10px; font-size: 14px; color: #92400e; }
+.warnings .warn-block { background: #fff; border-left: 3px solid #f59e0b; padding: 8px 12px; margin: 8px 0; border-radius: 0 4px 4px 0; }
+.warnings .warn-block.warn-unresolved-versions { border-left-color: #ef4444; background: #fef2f2; }
+.warnings .warn-block.warn-private-libs { border-left-color: #6366f1; background: #eef2ff; }
+.warnings .warn-head { font-size: 13px; color: #92400e; margin-bottom: 4px; }
+.warnings .warn-unresolved-versions .warn-head { color: #991b1b; }
+.warnings .warn-private-libs .warn-head { color: #312e81; }
+.warnings .warn-private-libs code { background: #e0e7ff; }
+.warnings .warn-defined { font-size: 10px; color: #6b7280; margin-top: 2px; padding-left: 14px; }
+.warnings .warn-defined code.path { background: #f3f4f6; color: #374151; font-size: 10px; padding: 1px 4px; }
+.warnings .warn-defined-more { color: #9ca3af; font-style: italic; }
+.warnings .count { color: #6b7280; font-weight: 400; }
+.warnings .warn-path { font-size: 11px; color: #6b7280; margin-bottom: 4px; }
+.warnings .warn-msg { font-size: 12px; color: #374151; line-height: 1.45; }
+.warnings .warn-items { margin: 6px 0 0; padding-left: 18px; font-size: 11px; max-height: 180px; overflow: auto; }
+.warnings .warn-items li { margin-bottom: 2px; }
+.warnings .warn-items .more { color: #6b7280; font-style: italic; }
+.warnings code { background: #fef3c7; padding: 1px 4px; border-radius: 3px; font-size: 11px; }
+.warnings .warn-unresolved-versions code { background: #fecaca; }
+.confidence { font-size: 10px; color: #9ca3af; text-transform: uppercase; }
+.source { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 10px; background: #e5e7eb; color: #374151; margin: 1px 2px 1px 0; }
+.source.both { background: #c7d2fe; color: #312e81; }
+.source.snyk { background: #fce7f3; color: #831843; }
+.source.osv { background: #dcfce7; color: #166534; }
+.source.fad { background: #fef3c7; color: #92400e; }
+.source.nvd { background: #cffafe; color: #155e75; }
+.chip { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 10px; margin-left: 4px; }
+.chip.transitive { background: #fef3c7; color: #92400e; }
+.chip.direct { background: #d1fae5; color: #065f46; }
+.chip.parent { background: #ddd6fe; color: #5b21b6; }
+/* Maven / npm scope qualifiers added next to .chip.direct when relevant */
+.chip.scope-test { background: #fee2e2; color: #991b1b; }
+.chip.scope-provided { background: #fed7aa; color: #9a3412; }
+.chip.scope-runtime { background: #cffafe; color: #155e75; }
+.chip.scope-system { background: #f3f4f6; color: #4b5563; }
+.chip.scope-dev { background: #fee2e2; color: #991b1b; }
+.chip.scope-peer { background: #ede9fe; color: #5b21b6; }
+.chip.scope-optional { background: #f3f4f6; color: #6b7280; }
+.chip.scope-vendored { background: #e0e7ff; color: #3730a3; }
+.via { font-size: 10px; color: #6b7280; margin-top: 2px; font-family: ui-monospace, monospace; max-width: 220px; word-break: break-all; }
+h3 { margin: 24px 0 10px; font-size: 16px; color: #374151; }
+details.report-section { margin: 28px 0 0; }
+details.report-section[open] { margin-bottom: 8px; }
+details.report-section > summary { cursor: pointer; list-style: none; user-select: none; outline: none; padding: 0; }
+details.report-section > summary::-webkit-details-marker { display: none; }
+details.report-section > summary h2 { margin: 0; display: flex; align-items: center; gap: 8px; }
+details.report-section > summary h2::before { content: "▾"; color: #6366f1; font-size: 14px; transition: transform .15s ease; display: inline-block; }
+details.report-section:not([open]) > summary h2::before { transform: rotate(-90deg); }
+details.report-section > summary:hover h2 { color: #4338ca; }
+details.report-subsection { margin: 16px 0 0; }
+details.report-subsection > summary { cursor: pointer; list-style: none; user-select: none; outline: none; padding: 0; }
+details.report-subsection > summary::-webkit-details-marker { display: none; }
+details.report-subsection > summary h3 { margin: 0; display: flex; align-items: center; gap: 8px; }
+details.report-subsection > summary h3::before { content: "▾"; color: #9ca3af; font-size: 12px; transition: transform .15s ease; display: inline-block; }
+details.report-subsection:not([open]) > summary h3::before { transform: rotate(-90deg); }
+details.report-subsection > summary:hover h3 { color: #4b5563; }
+/* Hierarchical indentation: every subsection's content gets a padded,
+   bordered container. Nested subsections inherit + add to the indent so
+   children visually nest under their parent. */
+details.report-subsection > div { padding-left: 22px; margin-left: 6px; border-left: 2px solid #f3f4f6; padding-top: 4px; }
+details.report-subsection details.report-subsection > summary h3 { font-size: 14px; color: #4b5563; }
+details.report-subsection details.report-subsection details.report-subsection > summary h3 { font-size: 13px; color: #6b7280; font-weight: 500; }
+details.report-subsection details.report-subsection > div { border-left-color: #e5e7eb; }
+details.report-subsection details.report-subsection details.report-subsection > div { border-left-color: #d1d5db; }
+.toolbar { display: flex; gap: 8px; margin: 12px 0 8px; flex-wrap: wrap; align-items: center; }
+.toolbar .btn { display: inline-flex; align-items: center; gap: 4px; padding: 5px 12px; font-size: 12px; background: #fff; border: 1px solid #d1d5db; border-radius: 4px; cursor: pointer; color: #374151; font-family: inherit; }
+.toolbar .btn:hover { background: #f3f4f6; border-color: #9ca3af; }
+.toolbar .btn.primary { background: #4f46e5; color: #fff; border-color: #4f46e5; }
+.toolbar .btn.primary:hover { background: #4338ca; }
+.toolbar .toolbar-label { font-size: 11px; color: #6b7280; }
+.fix-recipe { background: #fff7ed; border: 1px solid #fed7aa; border-left: 4px solid #f97316; padding: 10px 14px; border-radius: 4px; margin: 6px 0; font-size: 12px; }
+.fix-recipe code { display: block; background: #1f2937; color: #f3f4f6; padding: 8px 10px; border-radius: 3px; font-size: 11px; margin-top: 6px; white-space: pre; overflow-x: auto; }
+.fix-recipe .recipe-title { font-weight: 600; margin-bottom: 2px; }
+.fix-recipe .recipe-meta { color: #92400e; }
+td.action { font-size: 11px; max-width: 280px; }
+td.action .pin { font-family: ui-monospace, monospace; background: #f3f4f6; padding: 2px 4px; border-radius: 2px; }
+td.action .update-hint { color: #6b7280; font-size: 10px; margin-top: 2px; }
+tr.cve-row { cursor: pointer; }
+tr.cve-row:hover { background: #eef2ff !important; }
+tr.cve-row.open { background: #e0e7ff !important; }
+tr.cve-row td:first-child::before { content: "▸"; display: inline-block; margin-right: 6px; color: #6b7280; transition: transform .15s ease; }
+tr.cve-row.open td:first-child::before { transform: rotate(90deg); color: #6366f1; }
+tr.detail-row { display: none; }
+tr.detail-row.open { display: table-row; }
+tr.detail-row > td { padding: 0; border-bottom: 2px solid #c7d2fe; background: #f9fafb; }
+.detail-panel { background: #f9fafb; border-left: 4px solid #6366f1; padding: 16px 24px; font-size: 12px; line-height: 1.6; width: 100%; }
+.detail-panel .panel-block { margin: 0; padding: 10px 0; border-bottom: 1px solid #e5e7eb; }
+.detail-panel .panel-block:last-child { border-bottom: none; }
+.detail-panel .panel-block .panel-title { font-size: 11px; color: #6b7280; text-transform: uppercase; letter-spacing: .5px; font-weight: 600; margin-bottom: 6px; }
+.detail-panel .panel-block .panel-title .count { color: #9ca3af; text-transform: none; letter-spacing: 0; font-weight: 400; margin-left: 4px; }
+.detail-panel .full-desc { white-space: pre-wrap; color: #1f2937; max-width: 1100px; line-height: 1.55; }
+.detail-panel .cvss-vector { font-family: ui-monospace, monospace; font-size: 11px; background: #1f2937; color: #f3f4f6; padding: 4px 8px; border-radius: 3px; display: inline-block; }
+.detail-panel .ref-group { margin: 6px 0; }
+.detail-panel .ref-group .ref-label { display: inline-block; font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: .5px; padding: 1px 6px; border-radius: 3px; margin-right: 4px; }
+.detail-panel .ref-group .ref-label.patch { background: #d1fae5; color: #065f46; }
+.detail-panel .ref-group .ref-label.exploit { background: #fee2e2; color: #991b1b; }
+.detail-panel .ref-group .ref-label.advisory { background: #dbeafe; color: #1e40af; }
+.detail-panel .ref-group .ref-label.vendor { background: #ede9fe; color: #5b21b6; }
+.detail-panel .ref-group .ref-label.third-party { background: #fef3c7; color: #92400e; }
+.detail-panel .ref-group .ref-label.mailing { background: #f3f4f6; color: #4b5563; }
+.detail-panel .ref-group .ref-label.fix { background: #d1fae5; color: #065f46; }
+.detail-panel .ref-group .ref-label.web { background: #f3f4f6; color: #6b7280; }
+.detail-panel .ref-group .ref-label.other { background: #f3f4f6; color: #6b7280; }
+.detail-panel .ref-list { margin: 4px 0 8px; padding-left: 18px; max-height: 220px; overflow-y: auto; }
+.detail-panel .ref-list li { font-size: 11px; word-break: break-all; line-height: 1.6; }
+.detail-panel .ref-list a { color: #1d4ed8; text-decoration: none; }
+.detail-panel .ref-list a:hover { text-decoration: underline; }
+.detail-panel .kv { display: flex; gap: 16px; flex-wrap: wrap; }
+.detail-panel .kv > div { min-width: 200px; }
+.detail-panel .kv label { display: block; font-size: 10px; color: #6b7280; text-transform: uppercase; letter-spacing: .5px; }
+.detail-panel .kv span { font-family: ui-monospace, monospace; font-size: 12px; }
+.detail-panel .via-list { font-family: ui-monospace, monospace; font-size: 11px; color: #4b5563; max-height: 200px; overflow-y: auto; }
+.detail-panel .via-list div { padding: 2px 0; }
+`;
+
+// Module-local render context — set at the start of buildBody so deep helpers
+// (renderEolTable, renderObsoleteTable, etc.) can read srcRoot without passing
+// it through every layer. Safe because buildBody is invoked synchronously.
+let RENDER_CTX = { srcRoot: null };
+function setRenderCtx(ctx) { RENDER_CTX = { ...RENDER_CTX, ...ctx }; }
+
+function depCell(dep, srcRoot = RENDER_CTX.srcRoot) {
+	let chip = "";
+	let via = "";
+	if (dep.scope === "transitive") {
+		chip = `<span class="chip transitive">transitive d${dep.depth || "?"}</span>`;
+		const paths = dep.viaPaths?.length ? dep.viaPaths : (dep.via?.length ? [dep.via] : []);
+		if (paths.length) {
+			const shown = paths.slice(0, 3).map(p => `<div class="via">via ${esc(p.join(" → "))}</div>`).join("");
+			const more = paths.length > 3 ? `<div class="via" style="color:#9ca3af">+${paths.length - 3} other path${paths.length - 3 > 1 ? "s" : ""}</div>` : "";
+			via = shown + more;
+		}
+	} else if (dep.scope === "parent") {
+		chip = `<span class="chip parent">parent POM</span>`;
+	} else {
+		// "direct" means "declared in this manifest" (not transitive, not parent).
+		// We additionally surface the *Maven scope* (test / provided / dev / peer
+		// / optional) when it's not the default compile — so the reader sees
+		// instantly why a dep ended up in the Dev chapter, for instance.
+		chip = `<span class="chip direct">direct</span>`;
+		const s = (dep.scope || "").toLowerCase();
+		const SCOPE_CHIPS = {
+			test:      `<span class="chip scope-test">test</span>`,
+			provided:  `<span class="chip scope-provided">provided</span>`,
+			runtime:   `<span class="chip scope-runtime">runtime</span>`,
+			system:    `<span class="chip scope-system">system</span>`,
+			dev:       `<span class="chip scope-dev">dev</span>`,
+			peer:      `<span class="chip scope-peer">peer</span>`,
+			optional:  `<span class="chip scope-optional">optional</span>`,
+			vendored:  `<span class="chip scope-vendored">vendored</span>`,
+		};
+		if (SCOPE_CHIPS[s]) chip += " " + SCOPE_CHIPS[s];
+	}
+	const { groupLine, nameLine } = depDisplayParts(dep);
+	const defined = renderDefinedIn(dep, srcRoot);
+	return `<td class="dep">${esc(groupLine)}<br>${esc(nameLine)}<br><span style="color:#6b7280">${esc(dep.version || "?")}</span> ${chip}${via}${defined}</td>`;
+}
+
+/**
+ * Render the "defined in" footer for a dep cell — the relative path(s) of the
+ * pom.xml / package-lock.json / yarn.lock where this dep is declared.
+ *
+ * Transitives from the Maven transitive resolver don't have a manifest path
+ * (they live on Maven Central, not in the source tree) — we return "" for them.
+ */
+function renderDefinedIn(dep, srcRoot) {
+	const paths = (dep.manifestPaths && dep.manifestPaths.length) ? dep.manifestPaths
+		: (dep.pomPaths && dep.pomPaths.length) ? dep.pomPaths
+		: [];
+	if (!paths.length) return "";
+	const rel = paths.map(p => makeRelative(p, srcRoot));
+	const shown = rel.slice(0, 3).map(p => `<code>${esc(p)}</code>`).join(", ");
+	const more = rel.length > 3 ? ` <span class="defined-more">+${rel.length - 3} more</span>` : "";
+	return `<div class="defined-in"><span class="defined-label">defined in:</span> ${shown}${more}</div>`;
+}
+
+function makeRelative(absPath, srcRoot) {
+	if (!srcRoot || !absPath) return absPath || "";
+	const path = require("path");
+	try {
+		const r = path.relative(srcRoot, absPath);
+		// If the path escapes the src root, show the absolute path instead
+		if (r.startsWith("..") || path.isAbsolute(r)) return absPath;
+		return r || ".";
+	} catch { return absPath; }
+}
+
+function depDisplayParts(dep) {
+	if (dep?.ecosystem === "npm") return { groupLine: "npm:", nameLine: dep.artifactId || "" };
+	return { groupLine: `${dep?.groupId ?? ""}:`, nameLine: dep?.artifactId || "" };
+}
+
+function depDisplayName(dep) {
+	if (dep?.ecosystem === "npm") return `npm:${dep.artifactId || ""}`;
+	return `${dep?.groupId ?? ""}:${dep?.artifactId || ""}`;
+}
+
+const REF_LABELS = {
+	patch: "Patch / Commit",
+	exploit: "Exploit / PoC",
+	advisory: "Security advisory",
+	vendor: "Vendor advisory",
+	"third-party": "Third-party advisory",
+	fix: "Upstream fix",
+	mailing: "Mailing list",
+	web: "Other",
+	other: "Other",
+};
+
+// Combine NVD-tagged refs + OSV-typed refs, classify each by URL + tags,
+// dedupe by URL, return { category: [urls] }.
+function groupExternalRefs(nvdRefs, osvRefs) {
+	const seen = new Map();   // url -> category
+	const out = { patch: [], exploit: [], advisory: [], vendor: [], "third-party": [], fix: [], mailing: [], web: [], other: [] };
+	const push = (url, cat) => {
+		if (!url) return;
+		if (seen.has(url)) return;
+		seen.set(url, cat);
+		(out[cat] || out.other).push(url);
+	};
+	for (const r of nvdRefs) {
+		const cat = classifyNvdRef(r);
+		push(r.url, cat);
+	}
+	for (const r of osvRefs) {
+		const cat = classifyOsvRef(r);
+		push(r.url, cat);
+	}
+	return out;
+}
+
+function classifyNvdRef(r) {
+	const tags = (r.tags || []).map(t => String(t).toLowerCase());
+	if (tags.includes("patch")) return "patch";
+	if (tags.includes("exploit")) return "exploit";
+	if (tags.includes("vendor advisory")) return "vendor";
+	if (tags.includes("third party advisory")) return "third-party";
+	if (tags.includes("mailing list")) return "mailing";
+	if (tags.some(t => t.includes("advisory"))) return "advisory";
+	return classifyByUrl(r.url);
+}
+
+function classifyOsvRef(r) {
+	const t = (r.type || "").toUpperCase();
+	if (t === "FIX") return "fix";
+	if (t === "ADVISORY") return "advisory";
+	if (t === "REPORT") return "exploit";
+	if (t === "PACKAGE") return "web";
+	return classifyByUrl(r.url);
+}
+
+function classifyByUrl(url) {
+	if (!url) return "other";
+	const u = url.toLowerCase();
+	if (/commit|\/pull\/|github\.com\/.+\/(commit|compare|pull|releases)/.test(u)) return "patch";
+	if (/exploit|poc|metasploit|packetstorm/.test(u)) return "exploit";
+	if (/(security|advisory|advisories|GHSA|cve-\d{4})/i.test(u) && /github\.com\/.+\/(security|advisories)/.test(u)) return "advisory";
+	if (/snyk\.io|tenable\.com|github\.com\/advisories/.test(u)) return "advisory";
+	if (/lists\.|mailman|mailing/.test(u)) return "mailing";
+	if (/oracle\.com|apache\.org\/security|redhat\.com\/security|cisco\.com|debian\.org|ubuntu\.com|suse\.com/.test(u)) return "vendor";
+	return "web";
+}
+
+// Short blurb for the row (first sentence / 240 chars) — full description is in the expandable panel
+function shortDesc(s) {
+	if (!s) return "";
+	const t = String(s).trim();
+	if (t.length <= 240) return t;
+	// Try to cut at the first sentence boundary near the limit
+	const cut = t.slice(0, 240);
+	const lastDot = cut.lastIndexOf(". ");
+	if (lastDot > 80) return cut.slice(0, lastDot + 1);
+	return cut + "…";
+}
+
+// Render a flat sub-block inside the CVE detail panel. `count` adds a "(n)"
+// hint next to the title. (Was previously a <details>; the user wanted these
+// always visible once the row's panel is open.)
+function section(title, contentHtml, opts = {}) {
+	const { count = null } = opts;
+	if (!contentHtml) return "";
+	const countHtml = count != null ? ` <span class="count">(${esc(count)})</span>` : "";
+	return `<div class="panel-block">
+		<div class="panel-title">${esc(title)}${countHtml}</div>
+		<div>${contentHtml}</div>
+	</div>`;
+}
+
+function renderDetailPanel(m) {
+	const cve = m.cve;
+	const dep = m.dep;
+	const sections = [];
+
+	// 1. Description
+	if (cve.description) {
+		sections.push(section("Description", `<div class="full-desc">${esc(cve.description)}</div>`));
+	}
+
+	// 2. Metadata
+	const kv = [];
+	if (cve.cvssVector) kv.push(`<div><label>${esc(cve.cvssVersion || "CVSS")}</label><span class="cvss-vector">${esc(cve.cvssVector)}</span></div>`);
+	if (cve.score != null) kv.push(`<div><label>Base score</label><span>${esc(cve.score.toFixed ? cve.score.toFixed(1) : cve.score)} (${esc(cve.severity || "?")})</span></div>`);
+	if (cve.fixVersion) kv.push(`<div><label>Fix version</label><span>${esc(cve.fixVersion)}</span></div>`);
+	if (cve.published) kv.push(`<div><label>Published</label><span>${esc(cve.published.slice(0, 10))}</span></div>`);
+	if (cve.modified) kv.push(`<div><label>Modified</label><span>${esc(cve.modified.slice(0, 10))}</span></div>`);
+	if (cve.ghsa) kv.push(`<div><label>GHSA</label><span><a href="https://github.com/advisories/${esc(cve.ghsa)}" target="_blank">${esc(cve.ghsa)}</a></span></div>`);
+	if (m.confidence) kv.push(`<div><label>Match confidence</label><span>${esc(m.confidence)}</span></div>`);
+	if (m.source) kv.push(`<div><label>Sources</label><span>${esc(m.source)}</span></div>`);
+	if (kv.length) sections.push(section("Metadata", `<div class="kv">${kv.join("")}</div>`));
+
+	// 3. External links — grouped
+	const grouped = groupExternalRefs(cve.nvdRefs || [], cve.osvRefs || []);
+	const order = ["patch", "exploit", "advisory", "vendor", "third-party", "fix", "mailing", "web", "other"];
+	const orderedKeys = order.filter(k => grouped[k]?.length);
+	if (orderedKeys.length) {
+		const totalRefs = Object.values(grouped).reduce((s, arr) => s + arr.length, 0);
+		const groupBlocks = orderedKeys.map(k => {
+			const label = REF_LABELS[k] || k;
+			const items = grouped[k].slice(0, 15).map(u => `<li><a href="${esc(u)}" target="_blank">${esc(u)}</a></li>`).join("");
+			const more = grouped[k].length > 15 ? `<li style="color:#9ca3af">+${grouped[k].length - 15} more</li>` : "";
+			return `<div class="ref-group">
+				<span class="ref-label ${esc(k)}">${esc(label)}</span><span style="color:#9ca3af;font-size:11px">${grouped[k].length} link${grouped[k].length > 1 ? "s" : ""}</span>
+				<ul class="ref-list">${items}${more}</ul>
+			</div>`;
+		}).join("");
+		sections.push(section("External links", groupBlocks, { count: totalRefs }));
+	}
+
+	// 4. CPE configurations
+	if (cve.cpes?.length) {
+		const cpes = cve.cpes.slice(0, 20).map(c => `<li>${esc(c)}</li>`).join("");
+		sections.push(section("Affected CPE configurations",
+			`<ul class="ref-list">${cpes}${cve.cpes.length > 20 ? `<li style="color:#9ca3af">+${cve.cpes.length - 20} more</li>` : ""}</ul>`,
+			{ count: cve.cpes.length, open: false }));
+	}
+
+	// 5. Aliases
+	if (cve.aliases?.length) {
+		const aliasItems = cve.aliases.map(a => {
+			if (a.startsWith("GHSA-")) return `<li><a href="https://github.com/advisories/${esc(a)}" target="_blank">${esc(a)}</a> (GitHub)</li>`;
+			if (a.startsWith("CVE-")) return `<li><a href="https://nvd.nist.gov/vuln/detail/${esc(a)}" target="_blank">${esc(a)}</a> (NVD)</li>`;
+			return `<li>${esc(a)}</li>`;
+		}).join("");
+		sections.push(section("Aliases", `<ul class="ref-list">${aliasItems}</ul>`, { open: false }));
+	}
+
+	// 6. Full dep chains (transitive only)
+	if (dep.scope === "transitive") {
+		const paths = dep.viaPaths?.length ? dep.viaPaths : (dep.via?.length ? [dep.via] : []);
+		if (paths.length) {
+			const items = paths.map((p, i) => `<div>${i + 1}. ${esc([...p, depDisplayName(dep)].join(" → "))}</div>`).join("");
+			sections.push(section("All dependency chains", `<div class="via-list">${items}</div>`, { count: paths.length }));
+		}
+	}
+
+	// 7. Declared-in POMs
+	if (dep.pomPaths?.length) {
+		const items = dep.pomPaths.slice(0, 10).map(p => `<div>${esc(p)}</div>`).join("");
+		sections.push(section("Declared in",
+			`<div class="via-list">${items}${dep.pomPaths.length > 10 ? `<div style="color:#9ca3af">+${dep.pomPaths.length - 10} more</div>` : ""}</div>`,
+			{ count: `${dep.pomPaths.length} POM${dep.pomPaths.length > 1 ? "s" : ""}`, open: false }));
+	}
+
+	return `<div class="detail-panel">${sections.join("")}</div>`;
+}
+
+function formatPubDate(iso) {
+	if (!iso) return "—";
+	const s = String(iso).slice(0, 10);
+	if (!/^\d{4}-\d{2}-\d{2}$/.test(s)) return "—";
+	return s;
+}
+function formatCwes(cwes) {
+	if (!Array.isArray(cwes) || !cwes.length) return `<span class="cwe-empty">—</span>`;
+	const top = cwes.slice(0, 2);
+	const more = cwes.length > 2 ? ` <span class="cwe-more">+${cwes.length - 2}</span>` : "";
+	return top.map(c => `<a href="https://cwe.mitre.org/data/definitions/${esc(String(c).replace(/^CWE-/i, ""))}.html" target="_blank" rel="noopener" class="cwe-link">${esc(c)}</a>`).join(" ") + more;
+}
+
+function renderCveRow(m, opts = {}) {
+	const { withAction } = opts;
+	const link = `https://nvd.nist.gov/vuln/detail/${encodeURIComponent(m.cve.id)}`;
+	const sourceParts = m.source ? String(m.source).split("+") : [];
+	const source = sourceParts.map(s => `<span class="source ${esc(s)}">${esc(s)}</span>`).join("");
+	const conf = m.confidence ? `<div class="confidence">${esc(m.confidence)}</div>` : "";
+	const actionCell = withAction ? `<td class="action">${renderActionCell(m)}</td>` : "";
+	const baseCols = 8; // Sev, CVE, Dep, CWE, Published, Description, Fix, Source
+	const colspan = withAction ? baseCols + 1 : baseCols;
+	const pub = formatPubDate(m.cve.published);
+	const cwes = formatCwes(m.cve.cwes);
+	// Click-to-expand: clicking anywhere on tr.cve-row toggles the next sibling
+	// tr.detail-row. JS toggle is at the bottom of the document; links inside
+	// cells stay clickable (the handler ignores anchor/button clicks).
+	return `<tr class="cve-row${m.cpeFiltered ? " cpe-fp" : ""}">
+		<td>${badge(m.cve.severity)}${m.cve.score != null ? `<div class="confidence">${esc(m.cve.score.toFixed(1))}</div>` : ""}</td>
+		<td class="cve"><a href="${link}" target="_blank">${esc(m.cve.id)}</a>${conf}${m.cpeFiltered ? `<div class="cpe-tag">CPE-filtered</div>` : ""}</td>
+		${depCell(m.dep)}
+		<td class="cwe">${cwes}</td>
+		<td class="published">${esc(pub)}</td>
+		<td class="desc">${esc(shortDesc(m.cve.description))}</td>
+		<td class="dep">${esc(m.cve.fixVersion || "—")}</td>
+		<td>${source}</td>
+		${actionCell}
+	</tr>
+	<tr class="detail-row"><td colspan="${colspan}">${renderDetailPanel(m)}</td></tr>`;
+}
+
+function renderActionCell(m) {
+	const root = m.dep.via?.[0];
+	const fix = m.cve.fixVersion;
+	let action = "";
+	if (fix) {
+		action += `Pin <span class="pin">${esc(depDisplayName(m.dep))}</span> ≥&nbsp;${esc(fix)}`;
+	} else {
+		action += `Add <span class="pin">&lt;exclusion&gt;</span> in root POM`;
+	}
+	if (root) {
+		const rootInfo = m._rootUpdate;
+		if (rootInfo?.latest && rootInfo.latest !== rootInfo.current) {
+			action += `<div class="update-hint">or update <code>${esc(root)}</code> ${esc(rootInfo.current)} → ${esc(rootInfo.latest)}</div>`;
+		} else {
+			action += `<div class="update-hint">pulled in by <code>${esc(root)}</code></div>`;
+		}
+	}
+	return action;
+}
+
+function renderCveTable(cveMatches, opts = {}) {
+	if (!cveMatches?.length) return `<div class="empty">No CVEs matched.</div>`;
+	const { withAction } = opts;
+	const rows = cveMatches.map(m => renderCveRow(m, opts)).join("\n");
+	const actionHeader = withAction ? `<th>Recommended action</th>` : "";
+	return `<table>
+		<thead><tr><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th>${actionHeader}</tr></thead>
+		<tbody>${rows}</tbody>
+	</table>`;
+}
+
+/**
+ * Build a snippet of pom.xml the user can paste into their root POM's
+ * <dependencyManagement> to pin a transitive to a safe version.
+ */
+function dependencyManagementSnippet(items) {
+	const inner = items.map(it => `        <dependency>
+            <groupId>${esc(it.groupId)}</groupId>
+            <artifactId>${esc(it.artifactId)}</artifactId>
+            <version>${esc(it.fixVersion)}</version>
+        </dependency>`).join("\n");
+	return `<dependencyManagement>
+    <dependencies>
+${inner}
+    </dependencies>
+</dependencyManagement>`;
+}
+
+function npmOverridesSnippet(items) {
+	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
+	return `{
+  "overrides": {
+${lines}
+  }
+}`;
+}
+
+function yarnResolutionsSnippet(items) {
+	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
+	return `{
+  "resolutions": {
+${lines}
+  }
+}`;
+}
+
+// Per-ecosystem fix-recipe metadata. Keys correspond to ecosystemType values.
+const ECO_RECIPE = {
+	maven: {
+		label: "Maven",
+		pinSection: "A. Pin vulnerable transitives in <dependencyManagement>",
+		pinIntro: cnt => `Paste into the root POM to immediately neutralise ${cnt} transitive vulnerabilit${cnt > 1 ? "ies" : "y"}:`,
+		snippet: dependencyManagementSnippet,
+		directSection: "B. Or update the direct dependencies pulling them in",
+	},
+	npm: {
+		label: "npm",
+		pinSection: "A. Pin vulnerable transitives via npm overrides",
+		pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>npm install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
+		snippet: npmOverridesSnippet,
+		directSection: "B. Or update the direct dependencies (and run npm install)",
+	},
+	yarn: {
+		label: "Yarn",
+		pinSection: "A. Pin vulnerable transitives via yarn resolutions",
+		pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>yarn install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
+		snippet: yarnResolutionsSnippet,
+		directSection: "B. Or update the direct dependencies (and run yarn install)",
+	},
+};
+
+/**
+ * From CVE matches (split direct/transitive) + outdatedResults + resolvedDeps,
+ * build a list of actionable fixes:
+ *   - byTransitive: pin coords (highest severity per coord, with fixVersion)
+ *   - byDirect: which direct dep brings in the most CVE, with outdated lookup
+ */
+function buildFixRecommendations(cveMatches, outdatedResults, resolvedDeps) {
+	const severityRank = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
+	const outByKey = new Map();
+	for (const o of outdatedResults || []) outByKey.set(`${o.dep.groupId}:${o.dep.artifactId}`, o);
+
+	// Group transitive matches by the leaf transitive coordinate
+	const byTransitive = new Map();
+	// Group transitive matches by the root direct that pulls them in
+	const byDirect = new Map();
+
+	for (const m of cveMatches) {
+		if (m.dep.scope !== "transitive") continue;
+		const tkey = `${m.dep.groupId}:${m.dep.artifactId}`;
+		const tEntry = byTransitive.get(tkey) || {
+			groupId: m.dep.groupId, artifactId: m.dep.artifactId,
+			ecosystem: m.dep.ecosystem || "maven",
+			ecosystemType: m.dep.ecosystemType || (m.dep.ecosystem === "npm" ? "npm" : "maven"),
+			currentVersion: m.dep.version, fixVersion: null,
+			maxSeverity: "UNKNOWN", cveIds: [], rootDirects: new Set(),
+		};
+		tEntry.cveIds.push(m.cve.id);
+		if (m.cve.fixVersion && (!tEntry.fixVersion ||
+			compareVersionsLoose(m.cve.fixVersion, tEntry.fixVersion) > 0)) {
+			tEntry.fixVersion = m.cve.fixVersion;
+		}
+		if ((severityRank[m.cve.severity] || 0) > (severityRank[tEntry.maxSeverity] || 0)) {
+			tEntry.maxSeverity = m.cve.severity;
+		}
+		const root = m.dep.via?.[0];
+		if (root) tEntry.rootDirects.add(root);
+		byTransitive.set(tkey, tEntry);
+
+		if (root) {
+			const dEntry = byDirect.get(root) || {
+				key: root, transitives: new Map(),
+				cveCount: 0, maxSeverity: "UNKNOWN",
+				ecosystemType: m.dep.ecosystemType || (m.dep.ecosystem === "npm" ? "npm" : "maven"),
+			};
+			dEntry.cveCount++;
+			if ((severityRank[m.cve.severity] || 0) > (severityRank[dEntry.maxSeverity] || 0)) {
+				dEntry.maxSeverity = m.cve.severity;
+			}
+			const tCount = dEntry.transitives.get(tkey) || 0;
+			dEntry.transitives.set(tkey, tCount + 1);
+			byDirect.set(root, dEntry);
+		}
+	}
+
+	// Sort transitive recos: max severity desc, then cve count desc
+	const transitivesList = [...byTransitive.values()].sort((a, b) =>
+		(severityRank[b.maxSeverity] || 0) - (severityRank[a.maxSeverity] || 0) ||
+		b.cveIds.length - a.cveIds.length);
+
+	// Enrich direct list with outdated info + current version from resolvedDeps
+	const directsList = [...byDirect.values()].map(d => {
+		const dep = resolvedDeps?.get(d.key);
+		const out = outByKey.get(d.key);
+		return {
+			...d,
+			currentVersion: dep?.version || null,
+			latest: out?.latest || null,
+			releaseDate: out?.releaseDate || null,
+			transitivesArr: [...d.transitives.entries()].map(([k, v]) => ({ key: k, cveCount: v })).sort((a, b) => b.cveCount - a.cveCount),
+		};
+	}).sort((a, b) =>
+		(severityRank[b.maxSeverity] || 0) - (severityRank[a.maxSeverity] || 0) ||
+		b.cveCount - a.cveCount);
+
+	return { transitivesList, directsList };
+}
+
+// Lightweight version comparator (sufficient for "pick highest fix version" when several CVEs share the same coord)
+function compareVersionsLoose(a, b) {
+	const seg = s => String(s).split(/[.\-]/).map(p => /^\d+$/.test(p) ? parseInt(p, 10) : p);
+	const sa = seg(a), sb = seg(b);
+	for (let i = 0; i < Math.max(sa.length, sb.length); i++) {
+		const x = sa[i], y = sb[i];
+		if (x === y) continue;
+		if (typeof x === "number" && typeof y === "number") return x - y;
+		return String(x ?? "").localeCompare(String(y ?? ""));
+	}
+	return 0;
+}
+
+function renderFixRecommendations(recos, allMatches = [], outdatedResults = []) {
+	// Section 7.0 — Direct deps to update. Aggregates every direct dep (not
+	// transitive, not parent, not vendored) that has at least one CVE and
+	// picks the highest fix-version found across its CVEs as the target.
+	const directs = buildDirectDepsToUpdate(allMatches, outdatedResults);
+	const directsSection = directs.length
+		? minorSection(`7.0 Direct deps to update (${directs.length})`, renderDirectDepsToUpdateTable(directs))
+		: "";
+
+	if (!recos.transitivesList.length && !recos.directsList.length) {
+		return directsSection || `<div class="empty">No actionable recommendations.</div>`;
+	}
+
+	// Group by ecosystemType so each tool gets its own pin/update advice.
+	const byEco = { maven: { trans: [], directs: [] }, npm: { trans: [], directs: [] }, yarn: { trans: [], directs: [] } };
+	for (const t of recos.transitivesList) {
+		const et = ecoTypeOf(t);
+		(byEco[et] || byEco.maven).trans.push(t);
+	}
+	for (const d of recos.directsList) {
+		const et = ecoTypeOf(d);
+		(byEco[et] || byEco.maven).directs.push(d);
+	}
+
+	const ecoOrder = ["maven", "npm", "yarn"];
+	const out = [directsSection];
+	let letterIdx = 0;
+	for (const eco of ecoOrder) {
+		const slice = byEco[eco];
+		if (!slice.trans.length && !slice.directs.length) continue;
+		const meta = ECO_RECIPE[eco];
+		const inner = renderRecommendationsForEco(slice, meta);
+		const letter = String.fromCharCode("a".charCodeAt(0) + letterIdx++);
+		out.push(minorSection(`7.${letter} ${meta.label} (${slice.trans.length + slice.directs.length} transitive recommendation${(slice.trans.length + slice.directs.length) > 1 ? "s" : ""})`, inner));
+	}
+	return out.join("") || `<div class="empty">No actionable recommendations.</div>`;
+}
+
+/**
+ * Aggregate direct (non-transitive, non-parent, non-vendored) deps that have
+ * at least one matched CVE. For each, pick the highest declared fixVersion
+ * across its CVEs, or fall back to Maven Central's latest if known.
+ */
+function buildDirectDepsToUpdate(matches, outdatedResults) {
+	const severityRank = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
+	const outByKey = new Map();
+	for (const o of outdatedResults || []) outByKey.set(`${o.dep.groupId}:${o.dep.artifactId}`, o);
+
+	const byKey = new Map();
+	for (const m of matches) {
+		const d = m.dep || {};
+		if (d.scope === "transitive" || d.scope === "parent" || d.scope === "vendored") continue;
+		const key = depDisplayName(d);
+		const e = byKey.get(key) || {
+			key,
+			coord: key,
+			ecosystemType: d.ecosystemType || (d.ecosystem === "npm" ? "npm" : "maven"),
+			currentVersion: d.version || null,
+			cveIds: [],
+			maxSeverity: "UNKNOWN",
+			fixVersion: null,
+		};
+		e.cveIds.push(m.cve.id);
+		if ((severityRank[m.cve.severity] || 0) > (severityRank[e.maxSeverity] || 0)) e.maxSeverity = m.cve.severity;
+		if (m.cve.fixVersion && (!e.fixVersion || compareVersionsLoose(m.cve.fixVersion, e.fixVersion) > 0)) {
+			e.fixVersion = m.cve.fixVersion;
+		}
+		byKey.set(key, e);
+	}
+	// Enrich with outdated lookup
+	for (const e of byKey.values()) {
+		const lookupKey = e.ecosystemType === "maven" ? e.coord : null;
+		const o = lookupKey ? outByKey.get(lookupKey) : null;
+		e.latest = o?.latest || null;
+	}
+	return [...byKey.values()].sort((a, b) =>
+		(severityRank[b.maxSeverity] || 0) - (severityRank[a.maxSeverity] || 0) ||
+		b.cveIds.length - a.cveIds.length);
+}
+
+function renderDirectDepsToUpdateTable(entries) {
+	const intro = `<div class="fp-intro">Every direct dep with at least one CVE matched. The "Pin to ≥" column shows the highest fix-version declared across the CVEs for that dep. When that's missing, the dep needs a manual triage (no clean fix is published).</div>`;
+	const rows = entries.map(e => `<tr>
+		<td>${badge(e.maxSeverity)}</td>
+		<td class="dep">${esc(e.coord)}</td>
+		<td class="dep">${esc(e.currentVersion || "?")}</td>
+		<td class="dep">${e.fixVersion ? `<span style="color:#065f46;font-weight:600">${esc(e.fixVersion)}</span>` : `<span style="color:#9ca3af">— (manual triage)</span>`}</td>
+		<td class="dep">${e.latest ? esc(e.latest) : `<span style="color:#9ca3af">—</span>`}</td>
+		<td class="confidence">${e.cveIds.length} CVE: ${esc(e.cveIds.slice(0, 4).join(", "))}${e.cveIds.length > 4 ? "…" : ""}</td>
+	</tr>`).join("\n");
+	return intro + `<table>
+		<thead><tr><th>Worst sev</th><th>Direct dependency</th><th>Current</th><th>Pin to ≥</th><th>Maven Central latest</th><th>CVEs covered</th></tr></thead>
+		<tbody>${rows}</tbody>
+	</table>`;
+}
+
+function ecoTypeOf(entry) {
+	if (entry.ecosystemType) return entry.ecosystemType;
+	if (entry.ecosystem === "npm") return "npm";
+	return "maven";
+}
+
+function renderRecommendationsForEco(slice, meta) {
+	const blocks = [];
+
+	// Section A: pin transitives (eco-specific snippet)
+	if (slice.trans.length) {
+		let html = "";
+		const pinnable = slice.trans.filter(t => t.fixVersion);
+		if (pinnable.length) {
+			const top = pinnable.slice(0, 30);
+			html += `<div class="fix-recipe">
+				<div class="recipe-title">${meta.pinIntro(pinnable.length)}</div>
+				<code>${esc(meta.snippet(top))}</code>
+				${pinnable.length > 30 ? `<div class="recipe-meta">${pinnable.length - 30} additional pins omitted from the snippet — see the table below.</div>` : ""}
+			</div>`;
+		}
+		const rows = slice.trans.map(t => `<tr>
+			<td>${badge(t.maxSeverity)}</td>
+			<td class="dep">${esc(t.ecosystem === "npm" ? "npm:" : `${t.groupId}:`)}<br>${esc(t.artifactId)}<br><span style="color:#6b7280">${esc(t.currentVersion)}</span></td>
+			<td class="dep">${t.fixVersion ? esc(t.fixVersion) : `<span style="color:#9ca3af">— (no clean fix declared)</span>`}</td>
+			<td class="confidence">${t.cveIds.length} CVE: ${esc(t.cveIds.slice(0, 4).join(", "))}${t.cveIds.length > 4 ? "…" : ""}</td>
+			<td class="dep">${[...t.rootDirects].slice(0, 3).map(r => esc(r)).join("<br>")}${t.rootDirects.size > 3 ? `<div class="confidence">+${t.rootDirects.size - 3} more</div>` : ""}</td>
+		</tr>`).join("\n");
+		html += `<table>
+			<thead><tr><th>Max Sev</th><th>Transitive (current)</th><th>Pin to ≥</th><th>CVE</th><th>Brought in by</th></tr></thead>
+			<tbody>${rows}</tbody>
+		</table>`;
+		blocks.push(minorSection(esc(meta.pinSection).replace("&lt;", "&lt;").replace("&gt;", "&gt;"), html));
+	}
+
+	// Section B: alternative — update the direct dep
+	if (slice.directs.length) {
+		let html = "";
+		const rows = slice.directs.map(d => {
+			const updateNote = d.latest && d.latest !== d.currentVersion
+				? `<span style="color:#065f46">${esc(d.currentVersion || "?")} → ${esc(d.latest)}</span>`
+				: `<span style="color:#9ca3af">${esc(d.currentVersion || "?")} (no update available)</span>`;
+			return `<tr>
+				<td>${badge(d.maxSeverity)}</td>
+				<td class="dep">${esc(d.key)}</td>
+				<td>${updateNote}${d.releaseDate ? `<div class="confidence">latest released ${esc(d.releaseDate)}</div>` : ""}</td>
+				<td class="confidence">${d.cveCount} CVE in transitives</td>
+				<td class="dep">${d.transitivesArr.slice(0, 4).map(t => esc(t.key) + ` (${t.cveCount})`).join("<br>")}${d.transitivesArr.length > 4 ? `<div class="confidence">+${d.transitivesArr.length - 4} more</div>` : ""}</td>
+			</tr>`;
+		}).join("\n");
+		html += `<table>
+			<thead><tr><th>Worst transitive sev</th><th>Direct dependency</th><th>Update path</th><th>Transitive CVE</th><th>Vulnerable transitives</th></tr></thead>
+			<tbody>${rows}</tbody>
+		</table>`;
+		blocks.push(minorSection(esc(meta.directSection), html));
+	}
+
+	return blocks.join("");
+}
+
+function renderEolTable(eolResults) {
+	if (!eolResults?.length) return `<div class="empty">No end-of-life frameworks detected.</div>`;
+	const rows = eolResults.map(e => `<tr>
+		<td class="dep">${esc(e.product)}</td>
+		<td class="dep">${esc(depDisplayName(e.dep))}<br><span style="color:#6b7280">${esc(e.dep.version || "?")}</span>${renderDefinedIn(e.dep, RENDER_CTX.srcRoot)}</td>
+		<td>${esc(e.eol || "")}</td>
+		<td>${esc(e.latest || "")}</td>
+		<td class="desc">${esc(e.notes || "")}</td>
+	</tr>`).join("\n");
+	return `<table>
+		<thead><tr><th>Product</th><th>Dependency</th><th>EOL date</th><th>Latest</th><th>Notes</th></tr></thead>
+		<tbody>${rows}</tbody>
+	</table>`;
+}
+
+function renderObsoleteTable(obs) {
+	if (!obs?.length) return `<div class="empty">No obsolete / deprecated libraries detected.</div>`;
+	const rows = obs.map(o => `<tr>
+		<td>${badge((o.severity || "MEDIUM").toUpperCase())}</td>
+		<td class="dep">${esc(depDisplayName(o.dep))}<br><span style="color:#6b7280">${esc(o.dep.version || "?")}</span>${renderDefinedIn(o.dep, RENDER_CTX.srcRoot)}</td>
+		<td class="dep">${esc(o.replacement || "—")}</td>
+		<td class="desc">${esc(o.reason || "")}</td>
+	</tr>`).join("\n");
+	return `<table>
+		<thead><tr><th>Severity</th><th>Obsolete</th><th>Replacement</th><th>Why</th></tr></thead>
+		<tbody>${rows}</tbody>
+	</table>`;
+}
+
+function renderOutdatedTable(out) {
+	if (!out?.length) return `<div class="empty">No outdated libraries (or --allLibs not set).</div>`;
+	// Annotate each row with a jump category to cut through noise: a 0.1.x bump
+	// rarely matters; a major-version delta usually does. Sort so big jumps
+	// surface first, and de-emphasise rows tagged "patch".
+	const ranked = out.map(o => ({ o, jump: versionJump(o.dep.version, o.latest) }))
+		.sort((a, b) => {
+			const ord = { major: 3, minor: 2, patch: 1, pre: 0, unknown: 0 };
+			return (ord[b.jump.kind] || 0) - (ord[a.jump.kind] || 0)
+				|| `${a.o.dep.groupId}:${a.o.dep.artifactId}`.localeCompare(`${b.o.dep.groupId}:${b.o.dep.artifactId}`);
+		});
+	const rows = ranked.map(({ o, jump }) => `<tr class="jump-${esc(jump.kind)}">
+		<td><span class="jump-badge jump-${esc(jump.kind)}">${esc(jump.label)}</span></td>
+		<td class="dep">${esc(depDisplayName(o.dep))}${renderDefinedIn(o.dep, RENDER_CTX.srcRoot)}</td>
+		<td class="dep">${esc(o.dep.version || "?")}</td>
+		<td class="dep">${esc(o.latest || "?")}</td>
+		<td>${esc(o.releaseDate || "")}</td>
+	</tr>`).join("\n");
+	return `<table>
+		<thead><tr><th>Jump</th><th>Dependency</th><th>Current</th><th>Latest</th><th>Released</th></tr></thead>
+		<tbody>${rows}</tbody>
+	</table>`;
+}
+
+/**
+ * Classify the gap between `current` and `latest` as major / minor / patch / pre / unknown.
+ * Used to triage Outdated rows so a patch-only diff doesn't drown majors.
+ */
+function versionJump(current, latest) {
+	if (!current || !latest) return { kind: "unknown", label: "?" };
+	const segs = s => String(s).split(/[.\-]/).map(x => /^\d+$/.test(x) ? parseInt(x, 10) : null);
+	const a = segs(current), b = segs(latest);
+	if (a[0] !== b[0]) {
+		if (a[0] != null && b[0] != null) {
+			return { kind: "major", label: `+${b[0] - a[0]} major` };
+		}
+	}
+	if (a[1] !== b[1]) return { kind: "minor", label: `+${(b[1] || 0) - (a[1] || 0)} minor` };
+	if (a[2] !== b[2]) return { kind: "patch", label: `+${(b[2] || 0) - (a[2] || 0)} patch` };
+	return { kind: "pre", label: "pre/qual" };
+}
+
+function summaryCards(stats, eol, obs, out, extra = {}) {
+	const cards = [
+		{ v: stats.critical, l: "Critical",    cls: "sev-critical" },
+		{ v: stats.high,     l: "High",        cls: "sev-high" },
+		{ v: stats.medium,   l: "Medium",      cls: "sev-medium" },
+		{ v: stats.low,      l: "Low",         cls: "sev-low" },
+		{ v: stats.total,    l: "Total CVEs" },
+		{ v: stats.direct,     l: "in Direct" },
+		{ v: stats.transitive, l: "in Transitive" },
+		{ v: extra.vendored ?? 0, l: "Vendored JS", cls: "sev-vendored" },
+		{ v: eol?.length || 0, l: "EOL" },
+		{ v: obs?.length || 0, l: "Obsolete" },
+		{ v: out?.length || 0, l: "Outdated" },
+		{ v: extra.warnings?.length || 0, l: "Scan alerts", cls: "sev-warn" },
+	];
+	return `<div class="summary">${cards.map(c => `<div class="card${c.cls ? " " + c.cls : ""}"><div class="v">${c.v}</div><div class="l">${esc(c.l)}</div></div>`).join("")}</div>`;
+}
+
+/**
+ * Merge duplicate (dep, cve) rows that have the same g:a:v + cve.id but
+ * different via paths (can happen when sources overlap or when the same
+ * transitive is brought in by multiple roots). Resulting row carries the
+ * union of viaPaths so the table shows one entry per real (dep, cve) pair.
+ */
+function mergeMatches(matches) {
+	const byKey = new Map();
+	for (const m of matches) {
+		const key = `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+		if (!byKey.has(key)) {
+			// Deep-ish copy so we can mutate dep.viaPaths
+			byKey.set(key, { ...m, dep: { ...m.dep, viaPaths: m.dep.viaPaths ? [...m.dep.viaPaths] : (m.dep.via ? [m.dep.via] : []) } });
+			continue;
+		}
+		const existing = byKey.get(key);
+		// Union of via paths
+		const incoming = m.dep.viaPaths || (m.dep.via ? [m.dep.via] : []);
+		for (const p of incoming) {
+			const sig = p.join("→");
+			if (!existing.dep.viaPaths.some(q => q.join("→") === sig)) existing.dep.viaPaths.push(p);
+		}
+		// Union of sources (e.g. "fad" + "osv" → "fad+osv")
+		if (m.source && existing.source && m.source !== existing.source) {
+			const set = new Set([...existing.source.split("+"), ...m.source.split("+")]);
+			existing.source = [...set].sort().join("+");
+		}
+	}
+	return [...byKey.values()];
+}
+
+function attachRootUpdates(cveMatches, outdatedResults, resolvedDeps) {
+	const outByKey = new Map();
+	for (const o of outdatedResults || []) outByKey.set(`${o.dep.groupId}:${o.dep.artifactId}`, o);
+	for (const m of cveMatches) {
+		if (m.dep.scope !== "transitive") continue;
+		const root = m.dep.via?.[0];
+		if (!root) continue;
+		const dep = resolvedDeps?.get(root);
+		const out = outByKey.get(root);
+		m._rootUpdate = { current: dep?.version || null, latest: out?.latest || null };
+	}
+}
+
+function majorSection(title, contentHtml, opts = {}) {
+	const { open = true, id } = opts;
+	const idAttr = id ? ` id="${esc(id)}"` : "";
+	return `<details class="report-section"${open ? " open" : ""}${idAttr}>
+		<summary><h2>${title}</h2></summary>
+		<div>${contentHtml}</div>
+	</details>`;
+}
+
+function minorSection(title, contentHtml, opts = {}) {
+	const { open = true } = opts;
+	return `<details class="report-subsection"${open ? " open" : ""}>
+		<summary><h3>${title}</h3></summary>
+		<div>${contentHtml}</div>
+	</details>`;
+}
+
+const WARNING_HEADINGS = {
+	"no-lockfile":            { icon: "⚠️", title: "JS manifest without lockfile" },
+	"yarn-berry-unsupported": { icon: "⚠️", title: "Yarn 2+/Berry lockfile" },
+	"unresolved-versions":    { icon: "⚠️", title: "Maven deps without a concrete version — silently skipped, run a real Maven/Snyk scan to complete" },
+	"private-libs":           { icon: "🔒", title: "Private / internal libraries — not on Maven Central, not scanned" },
+};
+
+/**
+ * Render one ecosystem's CVE rows:
+ *   - "All" sub-section first (direct + transitive split)
+ *   - "By <manifest kind>" wrapper section that ALWAYS appears, even with
+ *     only one manifest. Each child shows just the relative manifest path
+ *     as its title (no extra numbering noise).
+ *
+ * Transitive deps are skipped from per-manifest sub-sections because they
+ * don't have a defining manifest in the source tree.
+ */
+function renderEcoSection(matches, sectionPrefix, srcRoot, ecoKey) {
+	const direct = matches.filter(m => m.dep.scope !== "transitive");
+	const trans  = matches.filter(m => m.dep.scope === "transitive");
+
+	const allInner =
+		minorSection(`All — direct (${direct.length})`, renderCveTable(direct)) +
+		minorSection(`All — transitive (${trans.length})`, renderCveTable(trans, { withAction: true }), { open: trans.length <= 100 });
+	const blocks = [minorSection(`${sectionPrefix}.0 All (${matches.length})`, allInner)];
+
+	// Collect unique manifests that DIRECT deps reference.
+	const manifestMap = new Map();
+	for (const m of direct) {
+		const paths = (m.dep.manifestPaths?.length ? m.dep.manifestPaths
+			: m.dep.pomPaths?.length ? m.dep.pomPaths
+			: []);
+		for (const p of paths) {
+			const list = manifestMap.get(p) || [];
+			list.push(m);
+			manifestMap.set(p, list);
+		}
+	}
+	const sortedManifests = [...manifestMap.entries()]
+		.filter(([p]) => !!p)
+		.sort((a, b) => makeRelative(a[0], srcRoot).localeCompare(makeRelative(b[0], srcRoot)));
+
+	if (sortedManifests.length) {
+		const manifestKind = ECO_MANIFEST_KIND[ecoKey] || "manifest";
+		const perManifest = sortedManifests.map(([manifestPath, mList]) => {
+			const rel = makeRelative(manifestPath, srcRoot);
+			return minorSection(`<code class="path">${esc(rel)}</code> (${mList.length})`,
+				renderCveTable(mList), { open: mList.length <= 30 });
+		}).join("");
+		blocks.push(minorSection(`By ${manifestKind} (${sortedManifests.length} file${sortedManifests.length > 1 ? "s" : ""})`, perManifest, { open: false }));
+	}
+	return blocks.join("");
+}
+
+/**
+ * Render retire.js matches as a flat table — they're keyed by vendored file
+ * path, not by manifest, so the by-manifest split doesn't apply here.
+ */
+function renderRetireTable(matches) {
+	if (!matches || !matches.length) {
+		return `<div class="empty">No vulnerable vendored JavaScript files detected (or retire.js was skipped).</div>`;
+	}
+	const rank = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1 };
+	const sorted = [...matches].sort((a, b) =>
+		(rank[(b.cve.severity || "").toUpperCase()] || 0) - (rank[(a.cve.severity || "").toUpperCase()] || 0) ||
+		String(a.dep.vendoredFile || "").localeCompare(String(b.dep.vendoredFile || "")));
+	const rows = sorted.map(m => `<tr>
+		<td>${badge((m.cve.severity || "MEDIUM").toUpperCase())}</td>
+		<td class="dep">${esc(m.dep.artifactId)}<br><span style="color:#6b7280">${esc(m.dep.version || "?")}</span></td>
+		<td class="dep"><code class="path">${esc(m.dep.vendoredFile || "")}</code></td>
+		<td class="cve">${m.cve.id?.startsWith("CVE-") ? `<a href="https://nvd.nist.gov/vuln/detail/${esc(m.cve.id)}" target="_blank" rel="noopener">${esc(m.cve.id)}</a>` : esc(m.cve.id)}</td>
+		<td class="dep">${esc(m.cve.fixVersion || "—")}</td>
+		<td class="desc">${esc(shortDesc(m.cve.description))}</td>
+	</tr>`).join("\n");
+	return `<table>
+		<thead><tr><th>Sev</th><th>Library</th><th>Vendored file</th><th>CVE / GHSA</th><th>Fixed in</th><th>Summary</th></tr></thead>
+		<tbody>${rows}</tbody>
+	</table>`;
+}
+
+function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches }) {
+	const eolN = eolResults?.length || 0;
+	const obsN = obsoleteResults?.length || 0;
+	const outN = outdatedResults?.length || 0;
+	// Compute global criticality. CRITICAL prod CVE or critical retire finding → CRITICAL.
+	// EOL frameworks bump to at least HIGH.
+	const obsCrit = (obsoleteResults || []).filter(o => (o.severity || "").toUpperCase() === "CRITICAL").length;
+	let level = "INFO";
+	if (prodStats.critical > 0 || retireStats.critical > 0 || obsCrit > 0) level = "CRITICAL";
+	else if (prodStats.high > 0 || retireStats.high > 0 || eolN > 0) level = "HIGH";
+	else if (prodStats.medium > 0 || retireStats.medium > 0 || obsN > 0) level = "MEDIUM";
+	else if (prodStats.low > 0 || retireStats.low > 0 || outN > 0) level = "LOW";
+	else if (prodStats.total > 0) level = "UNKNOWN";
+
+	const bullets = [];
+	if (prodStats.total) bullets.push(`<strong>${prodStats.total}</strong> CVE in production deps (critical=${prodStats.critical}, high=${prodStats.high}, medium=${prodStats.medium}, low=${prodStats.low})`);
+	if (devStats.total)  bullets.push(`<strong>${devStats.total}</strong> CVE in dev/test deps`);
+	if (retireStats.total) bullets.push(`<strong>${retireStats.total}</strong> vulnerable vendored JS finding(s) (retire.js)`);
+	if (eolN) bullets.push(`<strong>${eolN}</strong> end-of-life framework${eolN > 1 ? "s" : ""}`);
+	if (obsN) bullets.push(`<strong>${obsN}</strong> obsolete / deprecated lib${obsN > 1 ? "s" : ""}`);
+	if (outN) bullets.push(`<strong>${outN}</strong> outdated lib${outN > 1 ? "s" : ""}`);
+	if (warnings?.length) bullets.push(`<strong>${warnings.length}</strong> scan-completeness alert${warnings.length > 1 ? "s" : ""} — see chapter 0`);
+
+	const topPreview = (topCriticalMatches || []).length ? `<div class="exec-top">
+		<div class="exec-top-title">Top ${topCriticalMatches.length} most critical (preview)</div>
+		<ul class="exec-top-list">${topCriticalMatches.map(m => `<li>
+			${badge((m.cve.severity || "HIGH").toUpperCase())}
+			<a class="exec-cve-link" href="#ch${m.dep?.scope === "vendored" ? "2" : "1"}">${esc(m.cve.id)}</a>
+			<code>${esc(depDisplayName(m.dep))}</code>
+			<span class="exec-ver">${esc(m.dep.version || "?")}</span>
+			${m.cve.fixVersion ? `<span class="exec-fix">→ ${esc(m.cve.fixVersion)}</span>` : ""}
+		</li>`).join("")}</ul>
+	</div>` : "";
+
+	return `<div class="exec-summary exec-${esc(level.toLowerCase())}">
+		<div class="exec-head">
+			<span class="exec-level">${esc(level)}</span>
+			<span class="exec-title">Executive Summary</span>
+		</div>
+		<div class="exec-meta">${esc(totalDeps)} dependencies scanned</div>
+		<ul class="exec-bullets">
+			${bullets.map(b => `<li>${b}</li>`).join("") || `<li>No findings detected.</li>`}
+		</ul>
+		${topPreview}
+	</div>`;
+}
+
+function renderWarnings(warnings) {
+	if (!warnings || !warnings.length) return "";
+	const blocks = warnings.map(w => {
+		const meta = WARNING_HEADINGS[w.type] || { icon: "⚠️", title: w.type };
+		const itemLimit = w.type === "private-libs" ? 200 : 50;
+		const items = renderWarningItems(w.items || [], itemLimit);
+		const manifest = w.manifestPath ? `<div class="warn-path"><code>${esc(makeRelative(w.manifestPath, RENDER_CTX.srcRoot))}</code></div>` : "";
+		return `<div class="warn-block warn-${esc(w.type)}">
+			<div class="warn-head">${meta.icon} <strong>${esc(meta.title)}</strong>${w.count ? ` <span class="count">(${w.count})</span>` : ""}</div>
+			${manifest}
+			<div class="warn-msg">${esc(w.message || "")}</div>
+			${items}
+		</div>`;
+	}).join("");
+	return `<div class="warnings warnings-chapter">${blocks}</div>`;
+}
+
+/**
+ * Render warning items. Each item is either:
+ *   - a string  → render as a single <code>
+ *   - an object { id, manifestPaths } → render the id plus its defining
+ *     manifest(s) so the team can locate where the entry is declared.
+ */
+function renderWarningItems(items, itemLimit) {
+	if (!items.length) return "";
+	const shown = items.slice(0, itemLimit);
+	const lis = shown.map(it => {
+		if (typeof it === "string") return `<li><code>${esc(it)}</code></li>`;
+		const id = it.id || "";
+		const paths = (it.manifestPaths || []).slice(0, 6);
+		const pathsHtml = paths.length
+			? `<div class="warn-defined">defined in: ${paths.map(p => `<code class="path">${esc(p)}</code>`).join(", ")}${it.manifestPaths.length > paths.length ? ` <span class="warn-defined-more">+${it.manifestPaths.length - paths.length} more</span>` : ""}</div>`
+			: "";
+		return `<li><code>${esc(id)}</code>${pathsHtml}</li>`;
+	}).join("");
+	const overflow = items.length > itemLimit ? `<li class="more">…and ${items.length - itemLimit} more</li>` : "";
+	return `<ul class="warn-items">${lis}${overflow}</ul>`;
+}
+
+function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, warnings }) {
+	setRenderCtx({ srcRoot: projectInfo?.src || null });
+	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
+	cveMatches    = mergeMatches(cveMatches || []);
+	devCveMatches = mergeMatches(devCveMatches || []);
+	retireMatches = retireMatches || [];
+	attachRootUpdates(cveMatches, outdatedResults, resolvedDeps);
+	attachRootUpdates(devCveMatches, outdatedResults, resolvedDeps);
+
+	// (D) Split cpe-filtered matches out so they don't inflate the headline
+	// counts. CPE refinement marks them when the dep version sits outside
+	// every vulnerable range NVD knows about — likely false positive.
+	const prodMatchesActive = cveMatches.filter(m => !m.cpeFiltered);
+	const prodMatchesFP     = cveMatches.filter(m =>  m.cpeFiltered);
+	const devMatchesActive  = devCveMatches.filter(m => !m.cpeFiltered);
+	const devMatchesFP      = devCveMatches.filter(m =>  m.cpeFiltered);
+
+	const prodStats   = computeStats(prodMatchesActive);
+	const devStats    = computeStats(devMatchesActive);
+	const retireStats = computeStats(retireMatches);
+
+	// Recos are built from prod matches only (dev/test issues aren't a release blocker).
+	const recos = buildFixRecommendations(prodMatchesActive, outdatedResults, resolvedDeps);
+
+	const cveContent       = renderCveBySectionByEco(prodMatchesActive, "1", projectInfo?.src);
+	const vendoredContent  = renderRetireTable(retireMatches);
+	const devCveContent    = renderCveBySectionByEco(devMatchesActive, "3", projectInfo?.src);
+	const fpContent        = renderFalsePositives([...prodMatchesFP, ...devMatchesFP]);
+
+	const toolbar = `<div class="toolbar">
+		<button class="btn" type="button" data-action="expand-all">⊕ Expand all</button>
+		<button class="btn" type="button" data-action="collapse-all">⊖ Collapse all</button>
+		<button class="btn primary" type="button" data-action="expand-cves">↧ Expand all CVE details</button>
+		<button class="btn" type="button" data-action="collapse-cves">↥ Collapse all CVE details</button>
+		<span class="toolbar-label">Click a section header or a CVE row to toggle.</span>
+	</div>`;
+
+	const exec = renderExecutiveSummary({
+		projectInfo, prodStats, devStats, retireStats,
+		eolResults, obsoleteResults, outdatedResults,
+		warnings, totalDeps: resolvedDeps?.size || 0,
+		topCriticalMatches: pickTopCriticalMatches(prodMatchesActive, retireMatches, 5),
+	});
+
+	// (C) Table of contents — rendered as a sticky nav. Only enumerates the
+	// chapters that actually have content (warnings, dev CVE, retire, FP appendix
+	// might be empty).
+	const toc = renderToc({
+		hasWarnings: !!(warnings?.length),
+		prodTotal: prodStats.total,
+		retireTotal: retireMatches.length,
+		devTotal: devStats.total,
+		eolTotal: eolResults?.length || 0,
+		obsoleteTotal: obsoleteResults?.length || 0,
+		outdatedTotal: outdatedResults?.length || 0,
+		fpTotal: prodMatchesFP.length + devMatchesFP.length,
+	});
+
+	return `
+		<header class="report-header">
+			<h1>FAD-Check Report</h1>
+			<div class="report-subtitle">Multi-ecosystem dependency security audit</div>
+			<div class="meta">
+				Project: <strong>${esc(projectInfo.name)}</strong> · <code class="path">${esc(projectInfo.src)}</code><br>
+				Generated: ${esc(projectInfo.generatedAt)}${projectInfo.toolVersion ? ` · fad-check ${esc(projectInfo.toolVersion)}` : ""}${projectInfo.cveDataDate ? ` · CVE data: ${esc(projectInfo.cveDataDate)}` : ""}
+			</div>
+		</header>
+		${exec}
+		${summaryCards(prodStats, eolResults, obsoleteResults, outdatedResults, { warnings, vendored: retireMatches.length })}
+		${toc}
+		${toolbar}
+
+		${(warnings?.length || 0) ? majorSection(`0. Warnings & scan-completeness (${warnings.length})`, renderWarnings(warnings), { open: true, id: "ch0" }) : ""}
+		${majorSection(`1. CVE Vulnerabilities — production (${prodStats.total})`, cveContent, { id: "ch1" })}
+		${majorSection(`2. Vendored JS scan — retire.js (${retireMatches.length})`, vendoredContent, { open: retireMatches.length > 0 && retireMatches.length <= 50, id: "ch2" })}
+		${majorSection(`3. CVE in dev dependencies (${devStats.total})`, devCveContent, { open: devStats.total > 0 && devStats.total <= 50, id: "ch3" })}
+		${majorSection(`4. End-of-Life Frameworks (${eolResults?.length || 0})`, renderEolTable(eolResults), { id: "ch4" })}
+		${majorSection(`5. Obsolete / Deprecated Libraries (${obsoleteResults?.length || 0})`, renderObsoleteTable(obsoleteResults), { id: "ch5" })}
+		${majorSection(`6. Outdated Libraries (${outdatedResults?.length || 0})`, renderOutdatedTable(outdatedResults), { open: (outdatedResults?.length || 0) <= 50, id: "ch6" })}
+		${majorSection(`7. Fix Recommendations`, renderFixRecommendations(recos, prodMatchesActive, outdatedResults), { open: false, id: "ch7" })}
+		${(prodMatchesFP.length + devMatchesFP.length) ? majorSection(`8. Appendix: Likely false positives (CPE-filtered) (${prodMatchesFP.length + devMatchesFP.length})`, fpContent, { open: false, id: "ch8" }) : ""}
+	`;
+}
+
+/**
+ * Pick the most impactful matches to preview in the exec summary.
+ * Sort by severity rank, prefer entries with a fix-version (more actionable),
+ * dedupe per dep coord so the preview shows diversity instead of 5 rows of
+ * the same tomcat CVE.
+ */
+function pickTopCriticalMatches(prodMatches, retireMatches, n) {
+	const rank = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
+	const all = [...prodMatches, ...retireMatches]
+		.filter(m => (rank[(m.cve?.severity || "").toUpperCase()] || 0) >= 3); // HIGH+
+	all.sort((a, b) => {
+		const sa = rank[(a.cve.severity || "").toUpperCase()] || 0;
+		const sb = rank[(b.cve.severity || "").toUpperCase()] || 0;
+		if (sb !== sa) return sb - sa;
+		// Prefer those with a known fixVersion (actionable)
+		const af = a.cve.fixVersion ? 1 : 0, bf = b.cve.fixVersion ? 1 : 0;
+		if (bf !== af) return bf - af;
+		return (a.cve.id || "").localeCompare(b.cve.id || "");
+	});
+	const seen = new Set();
+	const out = [];
+	for (const m of all) {
+		const dep = m.dep;
+		const k = `${dep.ecosystem === "npm" ? "npm:" : dep.groupId + ":"}${dep.artifactId}`;
+		if (seen.has(k)) continue;
+		seen.add(k);
+		out.push(m);
+		if (out.length >= n) break;
+	}
+	return out;
+}
+
+function renderToc({ hasWarnings, prodTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, fpTotal }) {
+	const entries = [];
+	if (hasWarnings)                  entries.push({ id: "ch0", label: "0. Warnings" });
+	entries.push({ id: "ch1", label: `1. Prod CVE (${prodTotal})` });
+	entries.push({ id: "ch2", label: `2. Vendored JS (${retireTotal})` });
+	entries.push({ id: "ch3", label: `3. Dev CVE (${devTotal})` });
+	entries.push({ id: "ch4", label: `4. EOL (${eolTotal})` });
+	entries.push({ id: "ch5", label: `5. Obsolete (${obsoleteTotal})` });
+	entries.push({ id: "ch6", label: `6. Outdated (${outdatedTotal})` });
+	entries.push({ id: "ch7", label: `7. Fix Recos` });
+	if (fpTotal)                      entries.push({ id: "ch8", label: `8. Likely FP (${fpTotal})` });
+	return `<nav class="toc">${entries.map(e => `<a href="#${e.id}">${esc(e.label)}</a>`).join("")}</nav>`;
+}
+
+function renderFalsePositives(matches) {
+	if (!matches.length) return `<div class="empty">No CPE-filtered findings.</div>`;
+	const intro = `<div class="fp-intro">These entries were initially matched by name but NVD's CPE configurations show your dep version is outside every vulnerable range. They are almost certainly false positives — kept here for audit transparency.</div>`;
+	return intro + renderCveTable(matches);
+}
+
+const ECO_LABELS = { maven: "Maven", npm: "npm (package-lock)", yarn: "Yarn" };
+const ECO_MANIFEST_KIND = { maven: "pom.xml", npm: "package-lock.json", yarn: "yarn.lock" };
+
+function renderCveBySectionByEco(matches, chapterPrefix, srcRoot) {
+	const ecoOrder = ["maven", "npm", "yarn"];
+	const byEco = { maven: [], npm: [], yarn: [] };
+	for (const m of matches) {
+		const et = m.dep?.ecosystemType || (m.dep?.ecosystem === "npm" ? "npm" : "maven");
+		(byEco[et] || byEco.maven).push(m);
+	}
+	const out = [];
+	let letterIdx = 0;
+	for (const eco of ecoOrder) {
+		const list = byEco[eco];
+		if (!list || !list.length) continue;
+		const letter = String.fromCharCode("a".charCodeAt(0) + letterIdx++);
+		out.push(minorSection(
+			`${chapterPrefix}.${letter} ${ECO_LABELS[eco]} (${list.length})`,
+			renderEcoSection(list, `${chapterPrefix}.${letter}`, srcRoot, eco)
+		));
+	}
+	return out.join("") || `<div class="empty">No CVE matches.</div>`;
+}
+
+const TOGGLE_SCRIPT = `
+<script>
+(function(){
+	function isInteractive(el){
+		if(!el) return false;
+		var t = el.tagName;
+		return t === 'A' || t === 'BUTTON' || t === 'INPUT' || t === 'SUMMARY' || t === 'DETAILS' || t === 'LABEL';
+	}
+	// CVE row click → toggle its detail panel
+	document.querySelectorAll('tr.cve-row').forEach(function(row){
+		row.addEventListener('click', function(e){
+			var t = e.target;
+			while(t && t !== row){
+				if(isInteractive(t)) return;
+				t = t.parentNode;
+			}
+			var next = row.nextElementSibling;
+			if(next && next.classList.contains('detail-row')){
+				var nowOpen = next.classList.toggle('open');
+				row.classList.toggle('open', nowOpen);
+			}
+		});
+	});
+	// Toolbar buttons
+	document.querySelectorAll('.toolbar .btn').forEach(function(btn){
+		btn.addEventListener('click', function(){
+			var action = btn.getAttribute('data-action');
+			if(action === 'expand-all'){
+				document.querySelectorAll('details').forEach(function(d){ d.open = true; });
+				document.querySelectorAll('tr.cve-row').forEach(function(r){
+					r.classList.add('open');
+					var n = r.nextElementSibling;
+					if(n && n.classList.contains('detail-row')) n.classList.add('open');
+				});
+			} else if(action === 'collapse-all'){
+				document.querySelectorAll('details').forEach(function(d){ d.open = false; });
+				document.querySelectorAll('tr.cve-row.open').forEach(function(r){ r.classList.remove('open'); });
+				document.querySelectorAll('tr.detail-row.open').forEach(function(r){ r.classList.remove('open'); });
+			} else if(action === 'expand-cves'){
+				document.querySelectorAll('tr.cve-row').forEach(function(r){
+					r.classList.add('open');
+					var n = r.nextElementSibling;
+					if(n && n.classList.contains('detail-row')) n.classList.add('open');
+				});
+			} else if(action === 'collapse-cves'){
+				document.querySelectorAll('tr.cve-row.open').forEach(function(r){ r.classList.remove('open'); });
+				document.querySelectorAll('tr.detail-row.open').forEach(function(r){ r.classList.remove('open'); });
+			}
+		});
+	});
+})();
+</script>`;
+
+function generateHtmlReport(payload) {
+	return `<!doctype html>
+<html><head><meta charset="utf-8"><title>FAD-Check Report</title><style>${CSS}</style></head>
+<body>${buildBody(payload)}${TOGGLE_SCRIPT}</body></html>`;
+}
+
+// Word can't run scripts and doesn't honour display:none reliably enough — so
+// the .doc variant ships with every section/detail/row already expanded.
+function generateWordReport(payload) {
+	let body = buildBody(payload);
+	// Force-open every <details> and every cve-row/detail-row in the static markup
+	body = body.replace(/<details ([^>]*?)>/g, (m, attrs) => {
+		if (attrs.includes(" open")) return m;
+		return `<details ${attrs} open>`;
+	});
+	body = body.replace(/<tr class="detail-row">/g, '<tr class="detail-row open">');
+	body = body.replace(/<tr class="cve-row">/g, '<tr class="cve-row open">');
+	// Drop the interactive toolbar (no buttons useful in a print/Word view)
+	body = body.replace(/<div class="toolbar">[\s\S]*?<\/div>/, "");
+	return `<html xmlns:o="urn:schemas-microsoft-com:office:office"
+        xmlns:w="urn:schemas-microsoft-com:office:word"
+        xmlns="http://www.w3.org/TR/REC-html40">
+<head>
+<meta charset="utf-8">
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+<meta name="ProgId" content="Word.Document">
+<meta name="Generator" content="Microsoft Word 15">
+<title>FAD-Check Report</title>
+<style>${CSS}
+/* In Word: keep every detail row expanded since scripts are disabled */
+tr.detail-row { display: table-row !important; }
+</style>
+</head>
+<body>${body}</body>
+</html>`;
+}
+
+async function writeReports({ cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, outputDir, warnings }) {
+	await fs.promises.mkdir(outputDir, { recursive: true });
+	const payload = { cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, warnings };
+	const htmlPath = path.join(outputDir, "cve-report.html");
+	const docPath = path.join(outputDir, "cve-report.doc");
+	await fs.promises.writeFile(htmlPath, generateHtmlReport(payload));
+	await fs.promises.writeFile(docPath, generateWordReport(payload));
+	return { htmlPath, docPath };
+}
+
+module.exports = {
+	computeStats,
+	generateHtmlReport,
+	generateWordReport,
+	writeReports,
+	esc,
+};