fad-checker 1.0.6 → 2.0.1

package/lib/dep-record.js

@@ -0,0 +1,60 @@
+/**
+ * lib/dep-record.js — contrat de données unifié partagé par tous les codecs.
+ *
+ * `coordKey` est la clé de la Map résolue ; elle ne collisionne jamais entre
+ * écosystèmes grâce au préfixe `ecosystem:`. `groupId`/`artifactId`/`pomPaths`
+ * sont conservés comme alias rétro-compat le temps de migrer tous les
+ * consommateurs vers `namespace`/`name`/`manifestPaths`.
+ */
+
+// NuGet, Composer et PyPI sont case-insensitive : on normalise la clé en lower
+// (l'affichage garde la casse d'origine via dep.name).
+function normalizeForKey(ecosystem, s) {
+	if (ecosystem === "nuget" || ecosystem === "composer" || ecosystem === "pypi") return String(s).toLowerCase();
+	return s;
+}
+
+// La clé de la Map résolue.
+// - Maven : clé BRUTE "g:a" (pas de préfixe "maven:"). Collision-free face aux
+//   préfixes des autres écosystèmes (un groupId reverse-DNS ne commence jamais
+//   par "npm:"/"nuget:"/…), et ça garde transitive.js + les tests inchangés.
+// - npm : "npm:<name>" où name peut inclure le scope (@org/pkg) — namespace reste "".
+// - composer : "composer:vendor/pkg". pypi/nuget : "<eco>:<name>".
+function coordKeyFor(ecosystem, namespace, name) {
+	if (ecosystem === "maven") {
+		const g = namespace || "";
+		return g ? `${g}:${name}` : name;
+	}
+	const ns = normalizeForKey(ecosystem, namespace || "");
+	const nm = normalizeForKey(ecosystem, name || "");
+	const joined = ns ? `${ns}/${nm}` : nm;
+	return `${ecosystem}:${joined}`;
+}
+
+function makeDepRecord(input) {
+	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType } = input;
+	const concrete = version && !/\$\{/.test(version) ? version : null;
+	const manifestPaths = manifestPath ? [manifestPath] : [];
+	return {
+		ecosystem,
+		ecosystemType: ecosystemType || ecosystem,
+		namespace: namespace || "",
+		name,
+		version: version || null,
+		versions: concrete ? [concrete] : [],
+		coordKey: coordKeyFor(ecosystem, namespace, name),
+		scope,
+		isDev: !!isDev,
+		manifestPaths,
+		// Alias rétro-compat : CHAMPS DUPLIQUÉS RÉELS (pas des getters — les depRecords
+		// sont spreadés dans des chemins chauds : cve-match.js:175, scan-completeness.js,
+		// cve-report.js:1036, snyk.js:105 — un getter serait perdu au spread).
+		// groupId/artifactId sont des strings jamais réassignées → pas de dérive.
+		// pomPaths PARTAGE la référence de manifestPaths → les push restent synchrones.
+		groupId: namespace || "",
+		artifactId: name,
+		pomPaths: manifestPaths,
+	};
+}
+
+module.exports = { makeDepRecord, coordKeyFor };

package/lib/deps-descriptor.js

@@ -0,0 +1,110 @@
+/**
+ * lib/deps-descriptor.js — serialize / deserialize an *anonymized* descriptor of
+ * the resolved dependency set, for PASSI-style offline→online→offline audits.
+ *
+ * Phase 1 (offline): collect deps → serializeDeps → write JSON. No paths, URLs,
+ *   hostnames or usernames leave the air-gapped machine — only public package
+ *   coordinates (ecosystem / namespace / name / version) + scope.
+ * Phase 2 (online): read JSON → deserializeDeps → run the scan flow to warm the
+ *   coordinate-keyed caches, then `--export-cache`.
+ * Phase 3 (offline): `--import-cache` + a normal `--offline` scan re-collects the
+ *   source locally (real paths) and gets cache hits → full detailed report.
+ *
+ * See docs/superpowers/specs/2026-05-30-anonymized-deps-descriptor-passi-design.md
+ *
+ * Pure functions: no I/O, no console. The caller does file read/write.
+ */
+const { makeDepRecord, coordKeyFor } = require("./dep-record");
+
+const SCHEMA = "fad-deps/1";
+
+// Fields kept in the descriptor — everything required to query the public vuln
+// databases and to group the report. Anything path/URL/host-bearing is dropped:
+//   manifestPath(s) / pomPaths, resolved (registry URL), integrity, from
+//   (parent chain), depth, lockType.
+const ANON_NOTE = "Anonymized: public coordinates only — no paths, URLs, or host info. Review before transfer.";
+
+/**
+ * serializeDeps(resolvedMap, opts) -> descriptor object (ready for JSON.stringify).
+ *
+ * opts:
+ *   generator    — tool id/version string for traceability (no env info)
+ *   generatedAt  — ISO timestamp (override for deterministic tests)
+ *   note         — human-readable banner (defaults to the anonymization notice)
+ */
+function serializeDeps(resolvedMap, opts = {}) {
+	const { generator = "fad-checker", generatedAt = new Date().toISOString(), note = ANON_NOTE } = opts;
+	const deps = [];
+	const byEcosystem = {};
+	for (const d of resolvedMap.values()) {
+		if (!d || !d.ecosystem || !d.name) continue;
+		const versions = Array.isArray(d.versions) && d.versions.length
+			? [...new Set(d.versions)]
+			: (d.version ? [d.version] : []);
+		deps.push({
+			ecosystem: d.ecosystem,
+			ecosystemType: d.ecosystemType || d.ecosystem,
+			namespace: d.namespace || "",
+			name: d.name,
+			version: d.version || (versions[0] || null),
+			versions,
+			scope: d.scope || "prod",
+			isDev: !!d.isDev,
+		});
+		byEcosystem[d.ecosystem] = (byEcosystem[d.ecosystem] || 0) + 1;
+	}
+	// Stable order so two runs over the same tree produce identical files (easier
+	// to diff/review and to detect tampering during transfer).
+	deps.sort((a, b) => (a.ecosystem + "\0" + a.namespace + "\0" + a.name).localeCompare(b.ecosystem + "\0" + b.namespace + "\0" + b.name));
+	return {
+		schema: SCHEMA,
+		generator,
+		generatedAt,
+		note,
+		summary: { total: deps.length, byEcosystem },
+		deps,
+	};
+}
+
+/**
+ * deserializeDeps(descriptor) -> { resolved, activeIds, runMaven, runNpm }.
+ *
+ * Rebuilds depRecords with EMPTY manifestPaths (the descriptor carries none) and
+ * a RECOMPUTED coordKey (never trusts the input). Throws on schema mismatch.
+ */
+function deserializeDeps(descriptor) {
+	if (!descriptor || typeof descriptor !== "object") throw new Error("invalid descriptor: not an object");
+	if (descriptor.schema !== SCHEMA) {
+		throw new Error(`unsupported descriptor schema: got "${descriptor.schema}", expected "${SCHEMA}"`);
+	}
+	const list = Array.isArray(descriptor.deps) ? descriptor.deps : [];
+	const resolved = new Map();
+	const ecosystems = new Set();
+	for (const e of list) {
+		if (!e || !e.ecosystem || !e.name) continue;
+		const rec = makeDepRecord({
+			ecosystem: e.ecosystem,
+			ecosystemType: e.ecosystemType || e.ecosystem,
+			namespace: e.namespace || "",
+			name: e.name,
+			version: e.version || null,
+			scope: e.scope || "prod",
+			isDev: !!e.isDev,
+			// manifestPath intentionally omitted → manifestPaths/pomPaths = []
+		});
+		// Restore the full multi-version set (makeDepRecord only derives it from the
+		// single `version`); CVE/OSV matching iterates `versions`.
+		if (Array.isArray(e.versions) && e.versions.length) rec.versions = [...new Set(e.versions)];
+		resolved.set(coordKeyFor(e.ecosystem, e.namespace || "", e.name), rec);
+		ecosystems.add(e.ecosystem);
+	}
+	const activeIds = [...ecosystems];
+	return {
+		resolved,
+		activeIds,
+		runMaven: ecosystems.has("maven"),
+		runNpm: ecosystems.has("npm") || ecosystems.has("yarn"),
+	};
+}
+
+module.exports = { serializeDeps, deserializeDeps, SCHEMA, ANON_NOTE };

package/lib/nvd.js

@@ -191,7 +191,7 @@ async function fetchOne(cveId, opts = {}) {
  * Rate limited per the NIST policy (use NVD_API_KEY for faster access).
  */
 async function enrichMatches(matches, opts = {}) {
-	const { offline } = opts;
+	const { offline, onProgress } = opts;
 	const uniqueCves = new Set();
 	for (const m of matches) if (m.cve?.id?.startsWith("CVE-")) uniqueCves.add(m.cve.id);
 	const hasKey = !!getNvdApiKey();
@@ -212,13 +212,13 @@ async function enrichMatches(matches, opts = {}) {
 		liveIds.push(cveId);
 	}
 
-	if (liveIds.length) {
+	if (liveIds.length && !onProgress) {
 		const etaSec = Math.ceil((liveIds.length / burst) * (NVD_WINDOW_MS / 1000));
 		const keyHint = hasKey ? "with API key (50/30s)" : "no API key — throttled to 5/30s, run `fad-checker --set-nvd-key <KEY>` (free, instant) to be 10× faster";
 		const cachedCount = byId.size;
 		const cachedHint = cachedCount ? `, ${cachedCount} cached` : "";
 		console.log(`🔍 NVD: enriching ${liveIds.length} CVEs${cachedHint} — ${keyHint}. ETA ~${etaSec}s.`);
-	} else if (uniqueCves.size) {
+	} else if (uniqueCves.size && !onProgress) {
 		console.log(`🔍 NVD: ${uniqueCves.size} CVEs (all cached).`);
 	}
 
@@ -229,6 +229,7 @@ async function enrichMatches(matches, opts = {}) {
 	const startedAt = [];
 	const startProgress = Date.now();
 	const printProgress = (final = false) => {
+		if (onProgress) { onProgress(done, liveIds.length); return; }
 		const elapsed = Math.round((Date.now() - startProgress) / 1000);
 		const pct = liveIds.length ? Math.round((done / liveIds.length) * 100) : 100;
 		const line = `   NVD: ${done}/${liveIds.length} (${pct}%) — ${elapsed}s elapsed`;

package/lib/osv.js

@@ -96,8 +96,18 @@ function pickPrimaryId(vuln) {
 	return cveAlias || vuln.id;
 }
 
-/** Build the OSV package-name key for a dep (Maven uses g:a, npm uses bare name). */
+// OSV ecosystem name per codec id. OSV.dev natively supports all of these.
+const OSV_ECO = { maven: "Maven", npm: "npm", yarn: "npm", nuget: "NuGet", composer: "Packagist", pypi: "PyPI" };
+
+/** OSV ecosystem string for a dep, derived from its codec id. */
+function osvEcosystemFor(dep) { return OSV_ECO[dep.ecosystem] || "Maven"; }
+
+/** Build the OSV package-name key for a dep — delegated to the dep's codec. */
 function osvPkgName(dep) {
+	const { getCodec } = require("./codecs");
+	const c = getCodec(dep.ecosystem);
+	if (c) return c.osvPackageName(dep);
+	// Fallback historique si le codec est introuvable.
 	return dep.ecosystem === "npm" ? dep.artifactId : `${dep.groupId}:${dep.artifactId}`;
 }
 
@@ -142,7 +152,7 @@ function vulnToMatch(dep, vuln) {
 }
 
 async function queryBatch(deps, opts = {}) {
-	const { verbose, offline, fetcher = globalThis.fetch } = opts;
+	const { verbose, offline, fetcher = globalThis.fetch, onProgress } = opts;
 	// Build query list + parallel cached/uncached split
 	const queries = [];
 	const indexMap = []; // index in `deps` → either { cached: vulns } or { queryIdx: N }
@@ -155,11 +165,10 @@ async function queryBatch(deps, opts = {}) {
 			indexMap[i] = { cached: hit };
 		} else {
 			indexMap[i] = { queryIdx: queries.length, cacheKey: ck };
-			// Ecosystem-aware query: OSV uses "npm" for npm packages (name only,
-			// no groupId), "Maven" for Maven (name = "g:a"). The dep record's
-			// `ecosystem` field defaults to "maven" — npm collector sets "npm".
-			const ecosystem = d.ecosystem === "npm" ? "npm" : "Maven";
-			const pkgName = ecosystem === "npm" ? d.artifactId : `${d.groupId}:${d.artifactId}`;
+			// Ecosystem + package name are both derived from the dep's codec, so
+			// adding a new ecosystem (NuGet/Packagist/PyPI) needs no change here.
+			const ecosystem = osvEcosystemFor(d);
+			const pkgName = osvPkgName(d);
 			queries.push({
 				package: { name: pkgName, ecosystem },
 				version: d.version,
@@ -178,7 +187,8 @@ async function queryBatch(deps, opts = {}) {
 		let batchIdx = 0;
 		for (const batch of batches) {
 			batchIdx++;
-			if (process.stdout.isTTY) process.stdout.write(`\r   OSV batch ${batchIdx}/${batches.length} (${batch.length} deps)…                  `);
+			if (onProgress) onProgress(batchIdx, batches.length);
+			else if (process.stdout.isTTY) process.stdout.write(`\r   OSV batch ${batchIdx}/${batches.length} (${batch.length} deps)…                  `);
 			else if (batches.length > 1) console.log(`   OSV batch ${batchIdx}/${batches.length} (${batch.length} deps)…`);
 			const res = await fetcher(`${OSV_BASE}/v1/querybatch`, {
 				method: "POST",
@@ -196,7 +206,8 @@ async function queryBatch(deps, opts = {}) {
 				allResults[(batchIdx - 1) * BATCH_SIZE + j] = results[j] || { vulns: [] };
 			}
 		}
-		if (process.stdout.isTTY) process.stdout.write(`\r   OSV batches complete (${batches.length})                          \n`);
+		if (onProgress) { /* finalized by caller */ }
+		else if (process.stdout.isTTY) process.stdout.write(`\r   OSV batches complete (${batches.length})                          \n`);
 
 		// Persist per-dep cache (stub list — details cached separately)
 		for (let i = 0; i < deps.length; i++) {
@@ -230,12 +241,13 @@ async function queryBatch(deps, opts = {}) {
 	}
 
 	if (liveIds.length) {
-		console.log(`   OSV details: ${liveIds.length} to fetch${allIds.size - liveIds.length ? `, ${allIds.size - liveIds.length} cached` : ""}…`);
+		if (!onProgress) console.log(`   OSV details: ${liveIds.length} to fetch${allIds.size - liveIds.length ? `, ${allIds.size - liveIds.length} cached` : ""}…`);
 		const concurrency = 10;
 		let cursor = 0;
 		let fetched = 0;
 		const startedAt = Date.now();
 		const printOsvProgress = (final = false) => {
+			if (onProgress) { onProgress(fetched, liveIds.length); return; }
 			const elapsed = Math.round((Date.now() - startedAt) / 1000);
 			const pct = Math.round((fetched / liveIds.length) * 100);
 			const line = `   OSV details: ${fetched}/${liveIds.length} (${pct}%) — ${elapsed}s`;
@@ -306,14 +318,11 @@ async function queryOsvForDeps(resolvedDeps, opts = {}) {
 			// need a concrete version. Lockfiles always provide one; package.json-
 			// only deps are skipped here.
 			if (d.ecosystem === "npm" && /^[\^~>=<*]|^(latest|next|workspace:|git\+|file:|link:)/.test(ver)) continue;
-			deps.push({
-				groupId: d.groupId, artifactId: d.artifactId, version: ver,
-				scope: d.scope, via: d.via, depth: d.depth, pomPaths: d.pomPaths,
-				manifestPaths: d.manifestPaths,
-				ecosystem: d.ecosystem || "maven",
-				ecosystemType: d.ecosystemType,
-				isDev: !!d.isDev,
-			});
+			// Spread the whole depRecord (carries namespace/name/coordKey, which the
+			// codec's osvPackageName + the report's dedup rely on) and override only
+			// the version for this per-version query. Cherry-picking fields here used
+			// to drop name/namespace → OSV queried `undefined` for composer/pypi/nuget.
+			deps.push({ ...d, version: ver });
 		}
 	}
 	return queryBatch(deps, opts);
@@ -325,5 +334,7 @@ module.exports = {
 	vulnToMatch,
 	severityFromOsv,
 	fixVersionFromOsv,
+	osvEcosystemFor,
+	osvPkgName,
 	OSV_CACHE_DIR,
 };

package/lib/outdated.js

@@ -9,7 +9,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const { compareMavenVersions } = require("./maven-version");
-const { webjarToNpm } = require("./npm/collect");
+const { webjarToNpm } = require("./codecs/npm/collect");
 
 const KNOWN_OBSOLETE = require("../data/known-obsolete.json");
 const EOL_MAPPING = require("../data/eol-mapping.json");
@@ -57,6 +57,16 @@ function findEolProduct(dep) {
 		}
 		return null;
 	}
+	if (dep.ecosystem === "composer") {
+		const full = `${dep.namespace || dep.groupId || ""}/${dep.name || dep.artifactId}`.toLowerCase();
+		return EOL_MAPPING.by_composer_name?.[full] || null;
+	}
+	if (dep.ecosystem === "pypi") {
+		return EOL_MAPPING.by_pypi_name?.[(dep.name || dep.artifactId || "").toLowerCase()] || null;
+	}
+	if (dep.ecosystem === "nuget") {
+		return EOL_MAPPING.by_nuget_name?.[(dep.name || dep.artifactId || "").toLowerCase()] || null;
+	}
 	const key = `${dep.groupId}:${dep.artifactId}`;
 	const direct = EOL_MAPPING.by_group_artifact?.[key];
 	if (direct) return direct;
@@ -241,18 +251,19 @@ function parseMavenMetadataLatest(xml) {
 }
 
 async function checkOutdatedDeps(resolvedDeps, opts = {}) {
-	const { verbose, offline, concurrency = 8, repos } = opts;
+	const { verbose, offline, concurrency = 8, repos, onProgress } = opts;
 	const cache = loadJsonCache(VERSION_CACHE_PATH);
 	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < VERSION_CACHE_MAX_AGE_MS;
 	if (!fresh && !offline) cache.entries = {};
-	const list = [...resolvedDeps.values()].filter(d => d.version && !/\$\{|SNAPSHOT/i.test(d.version) && d.ecosystem !== "npm");
+	// Maven Central only — npm/composer/pypi/nuget have their own registries (codec.checkRegistry).
+	const list = [...resolvedDeps.values()].filter(d => d.version && !/\$\{|SNAPSHOT/i.test(d.version) && d.ecosystem === "maven");
 	const results = [];
 
 	// Progress indicator — Maven Central can serve hundreds of deps in a few
 	// seconds with 8-way concurrency, but on first run (cold cache) the user
 	// would see total silence for 20-60s.
 	const liveCount = offline ? 0 : list.filter(d => !cache.entries[`${d.groupId}:${d.artifactId}`]).length;
-	if (liveCount && !offline) {
+	if (liveCount && !offline && !onProgress) {
 		console.log(`📅 Outdated: checking ${list.length} deps against Maven Central (${liveCount} live, ${list.length - liveCount} cached)…`);
 	}
 
@@ -260,6 +271,7 @@ async function checkOutdatedDeps(resolvedDeps, opts = {}) {
 	let processed = 0;
 	const startedAt = Date.now();
 	const printOutdatedProgress = (final = false) => {
+		if (onProgress) { onProgress(processed, list.length); return; }
 		if (!liveCount) return;
 		const elapsed = Math.round((Date.now() - startedAt) / 1000);
 		const pct = Math.round((processed / list.length) * 100);
@@ -297,6 +309,10 @@ module.exports = {
 	checkObsolete,
 	checkOutdatedDeps,
 	findEolProduct,
+	findCycleForVersion,
+	isEol,
 	isEolCacheFresh,
+	EOL_MAPPING,
+	EOL_CACHE_PATH,
 	KNOWN_OBSOLETE,
 };

package/lib/retire.js

@@ -24,6 +24,15 @@ const execFileP = promisify(execFile);
 const RETIRE_CACHE_DIR = path.join(os.homedir(), ".fad-checker", "retire-cache");
 const RETIRE_CACHE_TTL_MS = 24 * 3600 * 1000;
 
+// retire's own signature DB. By default retire caches it in /tmp/.retire-cache
+// (outside ~/.fad-checker/, with a 1h TTL → a network refetch on expiry). For the
+// PASSI offline workflow we instead keep a stable local copy INSIDE ~/.fad-checker/
+// so `--export-cache` carries it, and feed it to retire via `--jsrepo <file>`
+// (loaded from file, never the network — no TTL).
+const RETIRE_SIG_DIR = path.join(os.homedir(), ".fad-checker", "retire-signatures");
+const RETIRE_SIG_FILE = path.join(RETIRE_SIG_DIR, "jsrepository-v5.json");
+const RETIRE_REPO_URL = "https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository-v5.json";
+
 function cacheKey(srcDir) {
 	return crypto.createHash("md5").update(path.resolve(srcDir)).digest("hex") + ".json";
 }
@@ -50,6 +59,54 @@ function findRetireBin() {
 	return "retire"; // fall back to PATH
 }
 
+/**
+ * Fetch retire's signature DB to a stable file inside ~/.fad-checker/ so it can
+ * be bundled by --export-cache and reused offline via --jsrepo. Network call —
+ * online only. Returns { ok, path } | { ok:false, error }. Never throws.
+ */
+async function warmRetireSignatures(opts = {}) {
+	const { verbose, force } = opts;
+	if (!force && fs.existsSync(RETIRE_SIG_FILE)) {
+		if (verbose) console.log(`retire: signatures already present (${RETIRE_SIG_FILE})`);
+		return { ok: true, path: RETIRE_SIG_FILE, cached: true };
+	}
+	try {
+		const res = await fetch(RETIRE_REPO_URL);
+		if (!res.ok) throw new Error(`HTTP ${res.status}`);
+		const text = await res.text();
+		JSON.parse(text);   // validate it's the repo JSON before persisting
+		fs.mkdirSync(RETIRE_SIG_DIR, { recursive: true });
+		fs.writeFileSync(RETIRE_SIG_FILE, text);
+		if (verbose) console.log(`retire: signatures warmed → ${RETIRE_SIG_FILE}`);
+		return { ok: true, path: RETIRE_SIG_FILE };
+	} catch (e) {
+		if (verbose) console.warn(`retire: signature warm failed — ${e.message}`);
+		return { ok: false, error: e.message };
+	}
+}
+
+// Ensure a local signature file exists. Online: fetch it if missing. Offline:
+// only report whether it's already there (no network).
+async function ensureSignatures({ verbose, offline } = {}) {
+	if (fs.existsSync(RETIRE_SIG_FILE)) return true;
+	if (offline) return false;
+	const r = await warmRetireSignatures({ verbose });
+	return !!r.ok;
+}
+
+// Pure: build the retire CLI argv. `jsRepo` (a local signature file) is added
+// when available so retire loads signatures from disk instead of the network.
+function buildRetireArgs({ srcDir, outPath, ignoredDirs, jsRepo }) {
+	const args = [
+		"--outputformat", "json",
+		"--outputpath", outPath,
+		"--jspath", srcDir,
+		"--ignore", ignoredDirs,
+	];
+	if (jsRepo) { args.push("--jsrepo", jsRepo); }
+	return args;
+}
+
 /**
  * Run retire.js against `srcDir`. Returns the parsed JSON output (an array
  * of file-level findings) or null if retire is unavailable.
@@ -59,12 +116,9 @@ function findRetireBin() {
  */
 async function runRetire(srcDir, opts = {}) {
 	const { verbose, force, offline } = opts;
-	if (offline) {
-		const cached = readCache(srcDir);
-		if (cached) return cached;
-		if (verbose) console.warn("retire: --offline and no cache — skipped");
-		return null;
-	}
+	// No source tree (e.g. --import-anonymized) → nothing to scan for vendored JS.
+	if (!srcDir) { if (verbose) console.warn("retire: no source dir — skipped"); return null; }
+	// Findings-cache fast path (path-keyed). Works online and offline.
 	if (!force) {
 		const cached = readCache(srcDir);
 		if (cached) {
@@ -73,6 +127,15 @@ async function runRetire(srcDir, opts = {}) {
 		}
 	}
 
+	// No findings cache → we must scan. We need a signature DB. Offline, we can
+	// only proceed if a local signature file was previously warmed (and bundled
+	// via --export-cache / --import-cache); otherwise honor --offline and skip.
+	const haveSig = await ensureSignatures({ verbose, offline });
+	if (offline && !haveSig) {
+		if (verbose) console.warn("retire: --offline, no findings cache and no local signatures — skipped");
+		return null;
+	}
+
 	const bin = findRetireBin();
 	const ignoredDirs = [
 		"node_modules", "bower_components", "jspm_packages",
@@ -83,13 +146,8 @@ async function runRetire(srcDir, opts = {}) {
 	// retire.js refuses to write to /dev/stdout, so we use a real temp file
 	// and read it back. Falls back to stdout if --outputpath is rejected.
 	const tmpOut = path.join(os.tmpdir(), `fad-checker-retire-${process.pid}-${Date.now()}.json`);
-	const args = [
-		"--outputformat", "json",
-		"--outputpath", tmpOut,
-		"--jspath", srcDir,
-		"--ignore", ignoredDirs,
-	];
-	if (verbose) console.log(`retire: scanning ${srcDir}…`);
+	const args = buildRetireArgs({ srcDir, outPath: tmpOut, ignoredDirs, jsRepo: haveSig ? RETIRE_SIG_FILE : null });
+	if (verbose) console.log(`retire: scanning ${srcDir}…${haveSig ? " (local signatures)" : ""}`);
 
 	try {
 		// retire.js exits with code 13 when it finds vulnerabilities — that's
@@ -207,5 +265,11 @@ module.exports = {
 	runRetire,
 	normaliseRetireResults,
 	findRetireBin,
+	warmRetireSignatures,
+	ensureSignatures,
+	buildRetireArgs,
 	RETIRE_CACHE_DIR,
+	RETIRE_SIG_DIR,
+	RETIRE_SIG_FILE,
+	RETIRE_REPO_URL,
 };

package/lib/transitive.js

@@ -396,12 +396,12 @@ async function resolveTransitiveDeps(directDeps, opts = {}) {
 			// Progress visible whenever stdout is a TTY — transitive resolution
 			// dominates wall-clock time on first run and used to look like a hang.
 			// On non-TTY (pipes, CI, tests) we skip the \r-overwrite spam.
-			if (process.stdout.isTTY) process.stdout.write(`\r   resolved ${out.size} transitives, queue=${queue.length - head}          `);
+			if (verbose && process.stdout.isTTY) process.stdout.write(`\r   resolved ${out.size} transitives, queue=${queue.length - head}          `);
 		}
 	});
 	await Promise.all(workers);
-	if (process.stdout.isTTY) process.stdout.write(`\r   resolved ${out.size} transitives                              \n`);
-	else if (out.size) console.log(`   resolved ${out.size} transitives`);
+	if (verbose && process.stdout.isTTY) process.stdout.write(`\r   resolved ${out.size} transitives                              \n`);
+	else if (verbose && out.size) console.log(`   resolved ${out.size} transitives`);
 
 	return out;
 }

package/lib/ui.js

@@ -0,0 +1,87 @@
+/**
+ * lib/ui.js — shared CLI presentation: banner, section headers, severity colors,
+ * and a global step progress indicator for the cache/database update phase.
+ *
+ * The Progress indicator renders a "[n/N] <spinner> label — summary" checklist.
+ * TTY: one animated line per step, rewritten in place, finalized with ✓/⊘/✗.
+ * Non-TTY (pipes, CI, files): a single plain line per finished step, no escapes.
+ */
+const chalk = require("chalk");
+
+const isTTY = !!(process.stdout && process.stdout.isTTY) && process.env.TERM !== "dumb";
+const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+
+const TITLE_A = "fad-checker";
+const TITLE_B = "Autonomous Dependency Checker";
+
+function banner() {
+	const raw = `${TITLE_A} · ${TITLE_B}`;
+	const bar = "─".repeat(raw.length + 2);
+	console.log(chalk.cyan(`\n╭${bar}╮`));
+	console.log(chalk.cyan("│ ") + chalk.bold.white(TITLE_A) + chalk.cyan(" · ") + chalk.whiteBright(TITLE_B) + chalk.cyan(" │"));
+	console.log(chalk.cyan(`╰${bar}╯`));
+}
+
+function section(title) {
+	console.log(chalk.bold.cyan("\n▸ ") + chalk.bold(title));
+}
+
+// "  label   value" aligned key/value line under a section.
+function kv(label, value, { pad = 10 } = {}) {
+	console.log("  " + chalk.dim(String(label).padEnd(pad)) + " " + value);
+}
+
+function ok(msg) { console.log("  " + chalk.green("✓") + " " + msg); }
+function warn(msg) { console.log("  " + chalk.yellow("⚠") + " " + msg); }
+function info(msg) { console.log("  " + chalk.dim("·") + " " + msg); }
+
+function sevColor(sev) {
+	switch (String(sev || "").toUpperCase()) {
+		case "CRITICAL": return chalk.bold.red;
+		case "HIGH": return chalk.red;
+		case "MEDIUM": return chalk.yellow;
+		case "LOW": return chalk.blue;
+		default: return chalk.gray;
+	}
+}
+
+class Step {
+	constructor(n, total, label) {
+		this.n = n; this.total = total; this.label = label;
+		this.live = ""; this.frame = 0; this.timer = null; this.ended = false;
+		this.prefix = chalk.dim(`[${n}/${total}]`);
+		if (isTTY) {
+			this._render();
+			this.timer = setInterval(() => { this.frame++; this._render(); }, 80);
+			if (this.timer.unref) this.timer.unref();
+		}
+	}
+	_render() {
+		if (!isTTY || this.ended) return;
+		const sp = chalk.cyan(SPINNER[this.frame % SPINNER.length]);
+		const live = this.live ? chalk.dim(" " + this.live) : chalk.dim(" …");
+		process.stdout.write(`\r  ${this.prefix} ${sp} ${this.label}${live}\x1b[K`);
+	}
+	tick(processed, total) {
+		this.live = total ? `${processed}/${total}` : String(processed || "");
+		// rendering is driven by the timer; nothing to print on non-TTY
+	}
+	_finalize(symbol, color, summary) {
+		if (this.ended) return;
+		this.ended = true;
+		if (this.timer) { clearInterval(this.timer); this.timer = null; }
+		const line = `  ${this.prefix} ${color(symbol)} ${this.label}` + (summary ? chalk.dim(" — " + summary) : "");
+		if (isTTY) process.stdout.write(`\r${line}\x1b[K\n`);
+		else console.log(line);
+	}
+	done(summary) { this._finalize("✓", chalk.green, summary); }
+	skip(reason) { this._finalize("⊘", chalk.gray, reason); }
+	fail(msg) { this._finalize("✗", chalk.red, msg); }
+}
+
+class Progress {
+	constructor(total) { this.total = total || 0; this.n = 0; }
+	start(label) { this.n += 1; return new Step(this.n, this.total, label); }
+}
+
+module.exports = { banner, section, kv, ok, warn, info, sevColor, Progress, isTTY };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fad-checker",
-  "version": "1.0.6",
-  "description": "Fucking Autonomous Dependency Checker — Scans ALL pom/bom, npm/Yarn stuff and vendored JavaScript in a source tree, deal with private deps, multi modules & produces 1 HTML/DOC report with CVE, EOL, obsolete, outdated deps & fix recos",
+  "version": "2.0.1",
+  "description": "Scan ALL Maven, npm, Yarn, Composer, Python & C#/.NET dependencies in a source tree ONE SHOT without mvn/python/etc, deal with private deps, multi mvn modules, EOL, obsolete, outdated deps & give fix recos",
   "license": "MIT",
   "repository": "https://github.com/n8tz/fad-checker",
   "author": "pp9Ping <pp9Ping@gmail.com>",
@@ -25,9 +25,11 @@
   "dependencies": {
     "chalk": "^4.1.2",
     "commander": "^14.0.1",
+    "js-yaml": "^4.1.1",
     "p-limit": "^3.1.0",
     "retire": "^5.4.2",
     "rimraf": "^6.0.1",
+    "smol-toml": "^1.6.1",
     "xml2js": "^0.6.2"
   },
   "engines": {