fad-checker 2.1.0 → 2.1.2

package/fad-checker.js

@@ -20,7 +20,10 @@ const ui = require("./lib/ui");
 
 const core = require("./lib/core");
 
-const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf8"));
+// require() (not fs.readFileSync) so bun --compile statically bundles package.json
+// into the binary — otherwise the compiled exe tries to read it off disk at runtime
+// (from $bunfs/root) and crashes with ENOENT. Keeps the bun builds fully standalone.
+const pkg = require("./package.json");
 
 // -------- bash/zsh completion shortcut (must run before required-options parse) --------
 if (process.argv.includes("--completion")) {
@@ -269,20 +272,87 @@ if (options.src && options.target) {
 	}
 }
 
-async function checkMavenLibExist(groupId, artifactId, repos) {
+// Maven Central presence cache (~/.fad-checker/maven-exists-cache.json) — keyed by
+// "g:a", value true (on a repo) / false (absent → likely private). Persisted so an
+// online warm-up populates it, --export-cache ships it, and an --offline air-gapped
+// run reads it instead of probing the network. Returns:
+//   true  → present on a configured repo
+//   false → absent (likely private)
+//   null  → unknown (offline + not cached, or probe error) — caller must NOT guess
+const MAVEN_EXISTS_CACHE_PATH = require("path").join(require("./lib/outdated").CACHE_DIR, "maven-exists-cache.json");
+const MAVEN_EXISTS_MAX_AGE_MS = 7 * 24 * 3600 * 1000; // 7 days
+
+async function checkMavenLibExist(groupId, artifactId, repos, cache, opts = {}) {
 	const g = core.coord(groupId);
 	const a = core.coord(artifactId);
-	if (!g || !a) return false;
+	if (!g || !a) return null;
+	const key = `${g}:${a}`;
+	if (cache && Object.prototype.hasOwnProperty.call(cache.entries, key)) return cache.entries[key];
+	if (opts.offline) return null;  // air-gapped + not warmed: honestly unknown, never network
 	const p = `${g.replace(/\./g, "/")}/${a}/maven-metadata.xml`;
 	const { existsInAny } = require("./lib/maven-repo");
 	try {
 		const hit = await existsInAny(repos, p, { userAgent: "fad-checker-existence" });
-		if (hit) return true;
-		if (verbose) console.log(chalk.dim(`   not on any repo: ${g}:${a}`));
-		return false;
+		if (cache) cache.entries[key] = !!hit;
+		if (!hit && verbose) console.log(chalk.dim(`   not on any repo: ${g}:${a}`));
+		return !!hit;
 	} catch (err) {
 		if (verbose) console.info(chalk.dim(`   error querying repos: ${g}:${a} — ${err.message}`));
-		return false;
+		return null;  // probe failed → unknown, don't poison the cache or mislabel as private
+	}
+}
+
+/**
+ * Build an onProgress callback for the embedded-JAR scan so the user sees what's
+ * happening — the scan reads + unzips archives synchronously and can block for a
+ * while on big or numerous fat-jars (incl. the silent recursion through a fat-jar's
+ * bundled libs). The scanner reports EVERY archive (top-level + nested):
+ *   - On a TTY: one transient line, rewritten in place, naming the archive being
+ *     read right now (so a long pause clearly points at the culprit). Cleared at end.
+ *   - Off a TTY (CI/pipe): a throttled line every ~250 archives so logs show forward
+ *     motion without being spammed, plus a start and a final summary line.
+ * Returns a fresh closure per codec.
+ */
+function makeJarProgress() {
+	let total = 0, lastLogged = 0;
+	const STEP = 250;
+	return (ev) => {
+		if (!ev) return;
+		if (ev.phase === "start") {
+			total = ev.total || 0;
+			if (total && !ui.isTTY) ui.info(chalk.dim(`scanning ${total} embedded archive(s) (.jar/.war/.ear)…`));
+		} else if (ev.phase === "scan" && total) {
+			if (ui.isTTY) {
+				const head = total ? `${ev.scanned}/${total}+` : String(ev.scanned);
+				process.stdout.write(`\r  ${chalk.dim("·")} ${chalk.dim(`reading embedded JARs (${head})`)} ${chalk.dim(ev.path)}\x1b[K`);
+			} else if (ev.scanned - lastLogged >= STEP) {
+				lastLogged = ev.scanned;
+				ui.info(chalk.dim(`… ${ev.scanned} archive(s) read (current: ${ev.path})`));
+			}
+		} else if (ev.phase === "done") {
+			if (total && ui.isTTY) process.stdout.write("\r\x1b[K");
+			else if (total && !ui.isTTY) ui.info(chalk.dim(`scanned ${ev.scanned} archive(s) → ${ev.found} embedded coord(s)`));
+		}
+	};
+}
+
+/**
+ * Run `fn` (sync or async) while telling the user which phase is in flight, so a
+ * long pause is attributable instead of a silent hang. TTY: a transient line that's
+ * cleared when done. Non-TTY: a plain "· <label> …" line. Either way, a phase that
+ * takes >3s prints "· <label> took Ns" so slow steps self-report even without -v.
+ */
+async function timedPhase(label, fn) {
+	if (ui.isTTY) process.stdout.write(`  ${chalk.dim("·")} ${chalk.dim(label + " …")}\x1b[K`);
+	else ui.info(chalk.dim(label + " …"));
+	const t0 = Date.now();
+	try {
+		return await fn();
+	} finally {
+		const ms = Date.now() - t0;
+		if (ui.isTTY) process.stdout.write("\r\x1b[K");
+		if (ms > 3000) ui.info(chalk.dim(`${label} took ${(ms / 1000).toFixed(1)}s`));
+		else if (verbose) ui.info(chalk.dim(`${label} done in ${ms}ms`));
 	}
 }
 
@@ -332,13 +402,18 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 	const { detectCodecs, allCodecs, getCodec } = require("./lib/codecs");
 	const { resolveActiveCodecs } = require("./lib/codecs/select");
 	const eco = (options.ecosystem || "auto").toLowerCase();
-	const detected = (eco === "auto") ? detectCodecs(options.src).map(c => c.id) : allCodecs().map(c => c.id);
+	const detected = (eco === "auto")
+		? (await timedPhase("detecting ecosystems", () => detectCodecs(options.src))).map(c => c.id)
+		: allCodecs().map(c => c.id);
 	const noCodecs = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"].filter(id => options[id] === false);
 	const activeIds = resolveActiveCodecs(eco, detected, { noCodecs, noJs: !options.js });
 	const runMaven = activeIds.includes("maven");
 	const runNpm = activeIds.includes("npm") || activeIds.includes("yarn");
 
 	// --- Collect deps from every active codec into one Map (coordKeys never collide) ---
+	// Section header first so the embedded-JAR scan can print live progress under it
+	// (the scan reads + unzips archives synchronously and would otherwise block silently).
+	ui.section("Collection");
 	const resolved = new Map();
 	let mavenCtx = null;
 	const collectWarnings = [];
@@ -347,7 +422,7 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 		const codec = getCodec(id);
 		let res;
 		try {
-			res = await codec.collect(options.src, { ignoreTest: !!options.ignoreTest, deps2Exclude, verbose, scanJars: options.jars !== false, srcRoot: options.src });
+			res = await timedPhase(`collecting ${codec.label || id}`, () => codec.collect(options.src, { ignoreTest: !!options.ignoreTest, deps2Exclude, verbose, scanJars: options.jars !== false, srcRoot: options.src, onJarProgress: makeJarProgress() }));
 		} catch (err) {
 			console.warn(chalk.red(`❌  ${id} collect failed:`), chalk.dim(err.message));
 			continue;
@@ -358,7 +433,6 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 	}
 
 	// --- Collection summary ---
-	ui.section("Collection");
 	const ecoCount = {};
 	let embeddedCount = 0;
 	for (const d of resolved.values()) {
@@ -432,7 +506,18 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 			ui.ok("no missing Maven parent POMs");
 		}
 
+		// Private-lib detection asks each configured repo whether a missing coord
+		// exists (→ absent = likely private). Results are cached + bundled, so an
+		// --offline run reads the online-warmed cache instead of probing the network.
+		// A coord that's neither cached nor probeable (offline + cold) stays UNKNOWN —
+		// we never fake it as "private", which is what made offline both wrong and slow.
 		if (options.allLibs) {
+			const { loadJsonCache, saveJsonCache } = require("./lib/outdated");
+			const existsCache = loadJsonCache(MAVEN_EXISTS_CACHE_PATH);
+			const fresh = existsCache.meta?.fetchedAt && (Date.now() - existsCache.meta.fetchedAt) < MAVEN_EXISTS_MAX_AGE_MS;
+			if (!fresh && !options.offline) existsCache.entries = {};   // refresh stale probes when online
+			if (!existsCache.entries) existsCache.entries = {};
+
 			const anyMissingLibs = Object.keys(allPomMetadata.anyMissingById)
 				.filter(id => {
 					const parts = id.split(":");
@@ -442,14 +527,20 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 			const limit = pLimit(10);
 			const results = await Promise.all(anyMissingLibs.map(id => {
 				const [g, a] = id.split(":");
-				return limit(async () => ({ id, found: await checkMavenLibExist(g, a, mavenRepos) }));
+				return limit(async () => ({ id, found: await checkMavenLibExist(g, a, mavenRepos, existsCache, { offline: options.offline }) }));
 			}));
-			for (const r of results) if (r && r.found === false) privateLibIds.push(r.id);
+			let unknown = 0;
+			for (const r of results) {
+				if (r.found === false) privateLibIds.push(r.id);
+				else if (r.found === null) unknown++;
+			}
+			if (!options.offline) { existsCache.meta = { fetchedAt: Date.now() }; saveJsonCache(MAVEN_EXISTS_CACHE_PATH, existsCache); }
 			if (privateLibIds.length) {
 				ui.warn(`${privateLibIds.length} lib(s) absent from Maven Central (likely private):`);
 				for (const id of privateLibIds.slice(0, 10)) ui.info(chalk.magenta(id));
 				if (privateLibIds.length > 10) ui.info(chalk.dim(`…and ${privateLibIds.length - 10} more`));
 			}
+			if (unknown) ui.info(chalk.dim(`${unknown} lib(s) not in the presence cache — run online once (or --export-cache from an online host) to classify them`));
 		}
 
 		if (deps2Exclude) {

package/lib/codecs/index.js

@@ -8,6 +8,8 @@
  * @author: N.BRAUN
  * @email: pp9ping@gmail.com
  */
+const fs = require("fs");
+const path = require("path");
 const { assertCodecShape } = require("./codec.interface");
 const maven = require("./maven.codec");
 const npm = require("./npm.codec");
@@ -33,10 +35,72 @@ function allCodecs() {
 	return [...REGISTRY.values()].sort((a, b) => ORDER.indexOf(a.id) - ORDER.indexOf(b.id));
 }
 
+// Dirs skipped during detection. Starts from the INTERSECTION of every codec's own
+// skip set (a dir skipped here only if ALL codecs skip it → detection never misses a
+// manifest a codec would have found) plus well-known dependency/cache/tooling dirs
+// that are NEVER a project root (all dot-dirs or vendored-dep caches), so detection
+// can prune them safely. NOTE: "build" / "vendor" / "bin" / "obj" are deliberately
+// NOT here — maven keeps build/ for BOMs and several codecs scan vendor/.
+const DETECT_SKIP = new Set([
+	"node_modules", ".git", ".idea", ".vscode", "target", "dist", "out",   // intersection
+	".svn", ".hg", ".gradle", ".mvn", ".cache", ".m2", "bower_components",  // never a project root
+	"jspm_packages", "__pycache__", ".venv", ".tox", ".mypy_cache", "coverage", ".next", ".nuxt",
+]);
+
+const DETECT_CONCURRENCY = 48;
+
 // yarn est détecté via le même arbre JS que npm ; on ne le renvoie pas en
 // doublon de détection (npm.collect ramasse déjà yarn.lock).
-function detectCodecs(dir) {
-	return allCodecs().filter(c => c.id !== "yarn" && c.detect(dir));
+//
+// ONE shared walk instead of one full-tree walk per codec: we descend the tree once
+// and, per file, test it against each codec's manifestNames (supporting "*.ext"
+// globs). Short-circuits as soon as every codec has matched. readdir runs with bounded
+// concurrency — on a high-latency filesystem (WSL/9p, network mounts) the walk is
+// latency-bound, so issuing many readdirs at once is far faster than a serial walk.
+async function detectCodecs(dir) {
+	const codecs = allCodecs().filter(c => c.id !== "yarn");
+	const matchers = codecs.map(c => {
+		const exact = new Set();
+		const exts = [];
+		for (const n of c.manifestNames || []) {
+			if (n.startsWith("*.")) exts.push(n.slice(1)); // "*.csproj" → ".csproj"
+			else exact.add(n);
+		}
+		return { codec: c, exact, exts, found: false };
+	});
+	let remaining = matchers.length;
+	const queue = [dir];
+	let active = 0;
+
+	await new Promise(resolve => {
+		let settled = false;
+		const finish = () => { if (!settled) { settled = true; resolve(); } };
+		const pump = () => {
+			if (settled) return;
+			if (remaining === 0) return finish();
+			if (queue.length === 0 && active === 0) return finish();
+			while (active < DETECT_CONCURRENCY && queue.length && remaining > 0) {
+				const cur = queue.pop();
+				active++;
+				fs.promises.readdir(cur, { withFileTypes: true }).then(entries => {
+					for (const e of entries) {
+						if (e.isDirectory()) {
+							if (!DETECT_SKIP.has(e.name)) queue.push(path.join(cur, e.name));
+							continue;
+						}
+						if (!e.isFile()) continue;
+						const name = e.name;
+						for (const m of matchers) {
+							if (m.found) continue;
+							if (m.exact.has(name) || m.exts.some(ext => name.endsWith(ext))) { m.found = true; remaining--; }
+						}
+					}
+				}).catch(() => { /* unreadable dir → skip */ }).finally(() => { active--; pump(); });
+			}
+		};
+		pump();
+	});
+	return matchers.filter(m => m.found).map(m => m.codec);
 }
 
 module.exports = { getCodec, allCodecs, detectCodecs, ORDER };

package/lib/codecs/maven/jar-scan.js

@@ -24,7 +24,7 @@
  */
 const fs = require("fs");
 const path = require("path");
-const { unzipSync, strFromU8 } = require("fflate");
+const { unzipSync, inflateSync, strFromU8 } = require("fflate");
 const { makeDepRecord } = require("../../dep-record");
 
 const ARCHIVE_RE = /\.(jar|war|ear)$/i;
@@ -33,6 +33,15 @@ const SKIP_DIRS = new Set(["node_modules", ".git", "target", "build", "out", "di
 const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
 const MAX_DEPTH = 8;
 
+// The ONLY entries we ever decompress out of an archive: its own Maven coordinate
+// (pom.properties), its manifest, and any NESTED archive (a fat-jar's bundled libs,
+// which we recurse into). Everything else — .class files, resources — is skipped.
+function wantedEntry(name) {
+	return /^META-INF\/maven\/[^/]+\/[^/]+\/pom\.properties$/.test(name)
+		|| name === "META-INF/MANIFEST.MF"
+		|| ARCHIVE_RE.test(name);
+}
+
 /** Parse a META-INF/maven/.../pom.properties body → { groupId, artifactId, version } | null. */
 function coordFromPomProperties(text) {
 	const get = re => (String(text || "").match(re) || [])[1]?.trim();
@@ -90,6 +99,72 @@ function readEntries(buf, filter) {
 	}
 }
 
+const EOCD_SIG = 0x06054b50; // End Of Central Directory
+const CEN_SIG = 0x02014b50;  // central directory file header
+const LOC_SIG = 0x04034b50;  // local file header
+
+/**
+ * Read ONLY the `filter`-matched entries of an on-disk zip via positioned reads on
+ * the file descriptor — without ever loading the whole archive into RAM. We read
+ * the End-Of-Central-Directory record, then the central directory, then seek to and
+ * inflate just the wanted entries. A 200 MB library jar with a 1 KB pom.properties
+ * costs a few KB of reads instead of 200 MB; its .class files are never touched.
+ *
+ * Throws on anything this minimal parser doesn't handle (ZIP64, encryption, an
+ * unknown compression method, a malformed record) so the caller can fall back to
+ * the battle-tested fflate whole-buffer path. Sizes are taken from the central
+ * directory (authoritative even when a streaming writer zeroes the local header).
+ *
+ * @returns {Object<string, Uint8Array>} matched entries, same shape as readEntries()
+ */
+function readZipEntriesFromFd(fd, fileSize, filter) {
+	const back = Math.min(fileSize, 65557); // max EOCD comment (65535) + 22-byte record
+	const tail = Buffer.allocUnsafe(back);
+	fs.readSync(fd, tail, 0, back, fileSize - back);
+	let e = -1;
+	for (let i = tail.length - 22; i >= 0; i--) {
+		if (tail.readUInt32LE(i) === EOCD_SIG) { e = i; break; }
+	}
+	if (e < 0) throw new Error("no EOCD record");
+	const count = tail.readUInt16LE(e + 10);
+	const cdSize = tail.readUInt32LE(e + 12);
+	const cdOff = tail.readUInt32LE(e + 16);
+	if (count === 0xffff || cdSize === 0xffffffff || cdOff === 0xffffffff) throw new Error("ZIP64");
+
+	const cd = Buffer.allocUnsafe(cdSize);
+	fs.readSync(fd, cd, 0, cdSize, cdOff);
+	const out = {};
+	let p = 0;
+	for (let i = 0; i < count; i++) {
+		if (p + 46 > cd.length || cd.readUInt32LE(p) !== CEN_SIG) throw new Error("bad central record");
+		const flags = cd.readUInt16LE(p + 8);
+		const method = cd.readUInt16LE(p + 10);
+		const compSize = cd.readUInt32LE(p + 20);
+		const uncompSize = cd.readUInt32LE(p + 24);
+		const nameLen = cd.readUInt16LE(p + 28);
+		const extraLen = cd.readUInt16LE(p + 30);
+		const commentLen = cd.readUInt16LE(p + 32);
+		const localOff = cd.readUInt32LE(p + 42);
+		const name = cd.toString("utf8", p + 46, p + 46 + nameLen);
+		p += 46 + nameLen + extraLen + commentLen;
+		if (!filter(name)) continue;
+		if (flags & 0x1) throw new Error("encrypted entry");
+		if (compSize === 0xffffffff || uncompSize === 0xffffffff || localOff === 0xffffffff) throw new Error("ZIP64 entry");
+		// The local header's name/extra lengths can differ from the central record's,
+		// so read it to locate the actual start of the entry's data.
+		const loc = Buffer.allocUnsafe(30);
+		fs.readSync(fd, loc, 0, 30, localOff);
+		if (loc.readUInt32LE(0) !== LOC_SIG) throw new Error("bad local header");
+		const dataOff = localOff + 30 + loc.readUInt16LE(26) + loc.readUInt16LE(28);
+		const comp = compSize > 0 ? Buffer.allocUnsafe(compSize) : Buffer.alloc(0);
+		if (compSize > 0) fs.readSync(fd, comp, 0, compSize, dataOff);
+		if (method === 0) out[name] = comp;                                           // stored
+		else if (method === 8) out[name] = inflateSync(comp, { out: new Uint8Array(uncompSize) }); // deflate
+		else throw new Error("compression method " + method);
+	}
+	return out;
+}
+
 /**
  * Resolve a single archive's own coordinate + confidence from its entries.
  * Returns { coord, source } | null. `source` ∈ pom.properties|manifest|filename.
@@ -115,24 +190,14 @@ function coordForArchive(entries, fileName) {
 }
 
 /**
- * Recursively scan one archive buffer. Pushes embedded depRecords into `out` and
- * warnings into `warnings`. `displayPath` is the `!/`-joined logical path.
+ * Given an archive's already-extracted entries, record its coordinate and recurse
+ * into any nested archives. `ctx` carries { out, warnings, onProgress, scanned }.
  */
-function scanArchiveBuffer(buf, displayPath, fileName, out, warnings, depth) {
-	if (depth > MAX_DEPTH) { warnings.push({ type: "embedded-jar", message: `nesting too deep, skipped: ${displayPath}` }); return; }
-	if (buf.length > MAX_ARCHIVE_BYTES) { warnings.push({ type: "embedded-jar", message: `archive too large (${Math.round(buf.length / 1048576)}MB), skipped: ${displayPath}` }); return; }
-
-	// Read only what we need: this archive's identity files + any nested archives.
-	const entries = readEntries(buf, name =>
-		/^META-INF\/maven\/[^/]+\/[^/]+\/pom\.properties$/.test(name) ||
-		name === "META-INF/MANIFEST.MF" ||
-		ARCHIVE_RE.test(name));
-	if (entries === null) { warnings.push({ type: "embedded-jar", message: `could not read archive (corrupt/unsupported): ${displayPath}` }); return; }
-
+function processEntries(entries, displayPath, fileName, ctx, depth) {
 	const resolved = coordForArchive(entries, fileName);
 	if (resolved) {
-		const { coord, source } = resolved;
-		out.push(makeDepRecord({
+		const { coord } = resolved;
+		ctx.out.push(makeDepRecord({
 			ecosystem: "maven",
 			namespace: coord.groupId || "",
 			name: coord.artifactId,
@@ -142,7 +207,7 @@ function scanArchiveBuffer(buf, displayPath, fileName, out, warnings, depth) {
 			provenance: "embedded",
 		}));
 	} else {
-		warnings.push({ type: "embedded-jar", message: `embedded archive with no resolvable Maven coordinate (not scanned): ${displayPath}` });
+		ctx.warnings.push({ type: "embedded-jar", message: `embedded archive with no resolvable Maven coordinate (not scanned): ${displayPath}` });
 	}
 
 	// Recurse into nested archives (fat-jar libs).
@@ -150,10 +215,62 @@ function scanArchiveBuffer(buf, displayPath, fileName, out, warnings, depth) {
 		if (!ARCHIVE_RE.test(name)) continue;
 		const nestedBuf = entries[name];
 		if (!nestedBuf || !nestedBuf.length) continue;
-		scanArchiveBuffer(Buffer.from(nestedBuf), `${displayPath}!/${name}`, path.basename(name), out, warnings, depth + 1);
+		scanArchiveBuffer(Buffer.from(nestedBuf), `${displayPath}!/${name}`, path.basename(name), ctx, depth + 1);
 	}
 }
 
+/**
+ * Recursively scan one archive held in memory (a nested fat-jar lib). Only the
+ * coordinate/manifest/nested-archive entries are decompressed (via wantedEntry).
+ * `displayPath` is the `!/`-joined logical path.
+ */
+function scanArchiveBuffer(buf, displayPath, fileName, ctx, depth) {
+	if (depth > MAX_DEPTH) { ctx.warnings.push({ type: "embedded-jar", message: `nesting too deep, skipped: ${displayPath}` }); return; }
+	if (buf.length > MAX_ARCHIVE_BYTES) { ctx.warnings.push({ type: "embedded-jar", message: `archive too large (${Math.round(buf.length / 1048576)}MB), skipped: ${displayPath}` }); return; }
+	// Report before the (blocking) inflate so the displayed line names this archive.
+	ctx.scanned++;
+	ctx.onProgress?.({ phase: "scan", scanned: ctx.scanned, total: ctx.total, path: displayPath });
+
+	const entries = readEntries(buf, wantedEntry);
+	if (entries === null) { ctx.warnings.push({ type: "embedded-jar", message: `could not read archive (corrupt/unsupported): ${displayPath}` }); return; }
+	processEntries(entries, displayPath, fileName, ctx, depth);
+}
+
+/**
+ * Scan one TOP-LEVEL on-disk archive. Tries the lazy positioned-read path first
+ * (reads only the central directory + wanted entries — never the whole file), and
+ * falls back to reading the whole file + fflate on any case the lazy parser can't
+ * handle (ZIP64, encryption, corruption).
+ */
+function scanArchiveFile(abs, displayPath, fileName, ctx) {
+	ctx.scanned++;
+	ctx.onProgress?.({ phase: "scan", scanned: ctx.scanned, total: ctx.total, path: displayPath });
+
+	let size;
+	try { size = fs.statSync(abs).size; }
+	catch (e) { ctx.warnings.push({ type: "embedded-jar", message: `could not stat ${abs}: ${e.message}` }); return; }
+	// Skip oversized archives WITHOUT pulling them into RAM.
+	if (size > MAX_ARCHIVE_BYTES) { ctx.warnings.push({ type: "embedded-jar", message: `archive too large (${Math.round(size / 1048576)}MB), skipped: ${displayPath}` }); return; }
+
+	// Fast path: lazy central-directory read (no whole-file load, no .class inflate).
+	let fd;
+	try {
+		fd = fs.openSync(abs, "r");
+		const entries = readZipEntriesFromFd(fd, size, wantedEntry);
+		processEntries(entries, displayPath, fileName, ctx, 0);
+		return;
+	} catch { /* fall back to the whole-buffer path below */ }
+	finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* ignore */ } } }
+
+	// Fallback: read the whole file + fflate (handles ZIP64 etc.).
+	let buf;
+	try { buf = fs.readFileSync(abs); }
+	catch (e) { ctx.warnings.push({ type: "embedded-jar", message: `could not read ${abs}: ${e.message}` }); return; }
+	const entries = readEntries(buf, wantedEntry);
+	if (entries === null) { ctx.warnings.push({ type: "embedded-jar", message: `could not read archive (corrupt/unsupported): ${displayPath}` }); return; }
+	processEntries(entries, displayPath, fileName, ctx, 0);
+}
+
 /** Recursively list archive file paths under `dir`. */
 function findArchives(dir, acc = []) {
 	let entries;
@@ -170,22 +287,49 @@ function findArchives(dir, acc = []) {
 	return acc;
 }
 
+// Parallel equivalent of findArchives — concurrent readdir so a deep tree on a
+// high-latency filesystem isn't walked one round-trip at a time.
+async function findArchivesAsync(dir) {
+	const { walkDirs } = require("../../parallel-walk");
+	const acc = [];
+	await walkDirs(dir, {
+		skipDir: name => SKIP_DIRS.has(name) || name.startsWith("."),
+		onDir: (cur, entries) => {
+			for (const e of entries) if (e.isFile() && ARCHIVE_RE.test(e.name)) acc.push(path.join(cur, e.name));
+		},
+	});
+	return acc;
+}
+
 /**
  * Scan `rootDir` for embedded JAR/WAR/EAR coordinates.
+ *
+ * Reading + unzipping is synchronous and can be slow on a tree with many or large
+ * fat-jars, so `opts.onProgress` is invoked around the work — for EVERY archive,
+ * nested ones included — so the caller can tell the user what's happening (it would
+ * otherwise block silently, especially while recursing through a fat-jar's libs):
+ *   onProgress({ phase: "start", total })                  once; total = top-level archive count
+ *   onProgress({ phase: "scan", scanned, total, path })    before each archive is read (top-level + nested)
+ *   onProgress({ phase: "done", total, found, scanned })   once, when finished
+ *
  * @returns { deps: depRecord[], warnings: [{type,message}] }
  */
-function scanEmbeddedJars(rootDir, opts = {}) {
-	const out = [];
-	const warnings = [];
-	const archives = findArchives(rootDir);
+async function scanEmbeddedJars(rootDir, opts = {}) {
+	const archives = await findArchivesAsync(rootDir);
+	const ctx = {
+		out: [],
+		warnings: [],
+		onProgress: typeof opts.onProgress === "function" ? opts.onProgress : null,
+		scanned: 0,
+		total: archives.length,
+	};
+	ctx.onProgress?.({ phase: "start", total: archives.length });
 	for (const abs of archives) {
-		let buf;
-		try { buf = fs.readFileSync(abs); }
-		catch (e) { warnings.push({ type: "embedded-jar", message: `could not read ${abs}: ${e.message}` }); continue; }
-		const rel = opts.srcRoot ? path.relative(opts.srcRoot, abs) : abs;
-		scanArchiveBuffer(buf, rel.split(path.sep).join("/"), path.basename(abs), out, warnings, 0);
+		const rel = (opts.srcRoot ? path.relative(opts.srcRoot, abs) : abs).split(path.sep).join("/");
+		scanArchiveFile(abs, rel, path.basename(abs), ctx);
 	}
-	return { deps: out, warnings };
+	ctx.onProgress?.({ phase: "done", total: archives.length, found: ctx.out.length, scanned: ctx.scanned });
+	return { deps: ctx.out, warnings: ctx.warnings };
 }
 
 module.exports = {
@@ -196,4 +340,6 @@ module.exports = {
 	coordFromFilename,
 	coordForArchive,
 	scanArchiveBuffer,
+	readZipEntriesFromFd,
+	findArchivesAsync,
 };

package/lib/codecs/maven.codec.js

@@ -40,7 +40,7 @@ module.exports = {
 	// Expose _maven (store/propsByPom/pomFiles) pour que l'orchestrateur garde la
 	// phase de réécriture des POM nettoyés (lib/core.rewritePoms).
 	async collect(dir, opts = {}) {
-		const pomFiles = core.findPomFiles(dir);
+		const pomFiles = await core.findPomFilesAsync(dir);
 		const store = core.newMetadataStore();
 		const propsByPom = {};
 		for (const pom of pomFiles) {
@@ -58,7 +58,7 @@ module.exports = {
 		if (opts.scanJars !== false) {
 			try {
 				const { scanEmbeddedJars } = require("./maven/jar-scan");
-				const { deps: embedded, warnings: jarWarnings } = scanEmbeddedJars(dir, { srcRoot: opts.srcRoot || dir });
+				const { deps: embedded, warnings: jarWarnings } = await scanEmbeddedJars(dir, { srcRoot: opts.srcRoot || dir, onProgress: opts.onJarProgress });
 				for (const rec of embedded) deps.set(rec.coordKey, rec);
 				warnings.push(...jarWarnings);
 			} catch (e) { warnings.push({ type: "embedded-jar", message: `embedded-jar scan failed: ${e.message}` }); }

package/lib/codecs/npm/collect.js

@@ -137,7 +137,9 @@ function collectNpmDeps(rootDir, opts = {}) {
 	const { ignoreTest, deps2Exclude, verbose } = opts;
 	const out = new Map();
 	const warnings = [];
-	const manifestGroups = findJsManifests(rootDir);
+	// Caller may pass pre-discovered manifest groups (e.g. from the parallel
+	// findJsManifestsAsync walk) to avoid a second, serial tree traversal.
+	const manifestGroups = opts.manifestGroups || findJsManifests(rootDir);
 	let parsedCount = 0;
 
 	for (const group of manifestGroups) {

package/lib/codecs/npm/parse.js

@@ -388,6 +388,30 @@ function findJsManifests(rootDir, opts = {}) {
 	return found;
 }
 
+// Parallel equivalent of findJsManifests — concurrent readdir so the walk isn't
+// serialized one round-trip at a time on a high-latency filesystem.
+async function findJsManifestsAsync(rootDir, opts = {}) {
+	const { skipDirs = DEFAULT_JS_SKIP_DIRS } = opts;
+	const { walkDirs } = require("../../parallel-walk");
+	const found = [];
+	await walkDirs(rootDir, {
+		skipDir: name => skipDirs.has(name),
+		onDir: (cur, entries) => {
+			const here = { dir: cur, packageJson: null, packageLock: null, yarnLock: null, pnpmLock: null };
+			for (const e of entries) {
+				if (!e.isFile()) continue;
+				const p = path.join(cur, e.name);
+				if (e.name === "package.json") here.packageJson = p;
+				else if (e.name === "package-lock.json") here.packageLock = p;
+				else if (e.name === "yarn.lock") here.yarnLock = p;
+				else if (e.name === "pnpm-lock.yaml") here.pnpmLock = p;
+			}
+			if (here.packageJson || here.packageLock || here.yarnLock || here.pnpmLock) found.push(here);
+		},
+	});
+	return found;
+}
+
 module.exports = {
 	parsePackageJson,
 	parsePackageLock,
@@ -395,4 +419,5 @@ module.exports = {
 	parseYarnBerry,
 	parsePnpmLock,
 	findJsManifests,
+	findJsManifestsAsync,
 };

package/lib/codecs/npm.codec.js

@@ -49,7 +49,11 @@ module.exports = {
 	recipe: require("./recipes").npm,
 	// collect ramasse TOUTES les deps JS (package-lock + yarn.lock).
 	async collect(dir, opts = {}) {
-		const deps = collectNpmDeps(dir, opts);
+		// Parallel manifest discovery (concurrent readdir) — much faster than the
+		// serial walk on a high-latency filesystem; parsing then runs synchronously.
+		const { findJsManifestsAsync } = require("./npm/parse");
+		const manifestGroups = await findJsManifestsAsync(dir);
+		const deps = collectNpmDeps(dir, { ...opts, manifestGroups });
 		return { deps, warnings: deps.warnings || [] };
 	},
 };

package/lib/core.js

@@ -39,6 +39,20 @@ function findPomFiles(dir) {
 	return out;
 }
 
+// Parallel equivalent of findPomFiles — same result, but readdir runs concurrently
+// so the walk isn't serialized one round-trip at a time on a high-latency filesystem.
+async function findPomFilesAsync(dir) {
+	const { walkDirs } = require("./parallel-walk");
+	const out = [];
+	await walkDirs(dir, {
+		skipDir: name => SKIP_DIRS.has(name),
+		onDir: (cur, entries) => {
+			for (const e of entries) if (e.isFile() && e.name === "pom.xml") out.push(path.join(cur, e.name));
+		},
+	});
+	return out;
+}
+
 function newMetadataStore() {
 	return {
 		byPath: {},
@@ -346,6 +360,7 @@ async function rewritePoms(pomPath, allPomMetadata, allPropsByPom, opts) {
 module.exports = {
 	coord,
 	findPomFiles,
+	findPomFilesAsync,
 	newMetadataStore,
 	parsePom,
 	resolveParentPath,

package/lib/cve-report.js

@@ -17,7 +17,9 @@ const { computePriority, sortByPriority } = require("./priority");
 // back to the raw id (with a "—" placeholder name where the row asks for one).
 const CWE_NAMES = (() => {
 	try {
-		const raw = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "data", "cwe-names.json"), "utf8"));
+		// require() (not fs.readFileSync) so bun --compile bundles the data file
+		// into the standalone binary instead of reading it off disk at runtime.
+		const raw = { ...require("../data/cwe-names.json") };
 		delete raw._comment;
 		return raw;
 	} catch { return {}; }