fad-checker 2.1.1 → 2.2.0

package/lib/codecs/binary/sniff.js

@@ -0,0 +1,37 @@
+/**
+ * lib/codecs/binary/sniff.js — file-type confirmation for the binary codec.
+ *
+ * Two gates: extKind() (extension allowlist) AND sniffKind() (magic bytes). A
+ * candidate is accepted only when both agree, so an image renamed `.so` (PNG
+ * magic) is rejected. We never trust the extension alone.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+
+// Magic-byte signatures → family. Mach-O has four (32/64-bit + fat, both endian).
+function sniffKind(buf) {
+	if (!buf || buf.length < 4) return null;
+	const b0 = buf[0], b1 = buf[1], b2 = buf[2], b3 = buf[3];
+	if (b0 === 0x4d && b1 === 0x5a) return "pe";                                   // MZ
+	if (b0 === 0x7f && b1 === 0x45 && b2 === 0x4c && b3 === 0x46) return "elf";    // \x7FELF
+	if (b0 === 0x50 && b1 === 0x4b && b2 === 0x03 && b3 === 0x04) return "zip";    // PK\x03\x04
+	const be = ((b0 << 24) | (b1 << 16) | (b2 << 8) | b3) >>> 0;
+	const le = ((b3 << 24) | (b2 << 16) | (b1 << 8) | b0) >>> 0;
+	const machO = new Set([0xfeedface, 0xfeedfacf, 0xcafebabe, 0xcafebabf]);
+	if (machO.has(be) || machO.has(le)) return "macho";
+	return null;
+}
+
+const EXT_PE = /\.(dll|exe)$/i;
+const EXT_MACHO = /\.dylib$/i;
+const EXT_ELF = /\.so(\.\d+)*$/i;   // .so, .so.1, .so.1.2.3
+
+function extKind(name) {
+	if (EXT_PE.test(name)) return "pe";
+	if (EXT_MACHO.test(name)) return "macho";
+	if (EXT_ELF.test(name)) return "elf";
+	return null;
+}
+
+module.exports = { sniffKind, extKind };

package/lib/codecs/binary.codec.js

@@ -0,0 +1,54 @@
+/**
+ * lib/codecs/binary.codec.js — codec for committed NATIVE binaries
+ * (.dll/.exe/.so/.dylib) that no package manager governs.
+ *
+ * Plan 1 scope: discover + hash only. The records carry no resolved coordinate
+ * (just a filename); Plan 2's hash-id service fills `identity`, Plan 3 builds the
+ * unmanaged inventory + report. Until then the records are `provenance:"binary"`
+ * and the CVE/OSV/EOL/outdated stages skip them (no coordinate to query).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const { makeDepRecord } = require("../dep-record");
+const { scanBinaries } = require("./binary/scan");
+
+module.exports = {
+	id: "binary",
+	label: "Binaries",
+	osvEcosystem: null,                                   // no OSV ecosystem until identified
+	manifestNames: ["*.dll", "*.exe", "*.so", "*.dylib"], // lets detectCodecs include us in auto mode
+
+	detect(dir) {
+		try { return scanBinaries(dir, { onProgress: null }).length > 0; }
+		catch { return false; }
+	},
+
+	async collect(dir, opts = {}) {
+		const out = new Map();
+		const warnings = [];
+		let records;
+		try { records = scanBinaries(dir, { onProgress: opts.onBinaryProgress, srcRoot: opts.srcRoot || dir, excludePath: opts.excludePath, defaultExcludes: opts.defaultExcludes }); }
+		catch (e) { return { deps: out, warnings: [{ type: "scan-error", message: `binary scan failed: ${e.message}` }] }; }
+		for (const r of records) {
+			out.set(`binary:${r.path}`, makeDepRecord({
+				ecosystem: "binary",
+				name: r.declaredName,
+				version: null,
+				manifestPath: r.path,
+				provenance: "binary",
+				hashes: { sha1: r.sha1, sha256: r.sha256 },
+				declaredName: r.declaredName,
+			}));
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return `binary:${d.manifestPaths?.[0] || d.name}`; },
+	formatCoord(d) { return d.declaredName || d.name; },
+	osvPackageName() { return null; },
+	async checkRegistry() { return { deprecated: [], outdated: [], licensed: [] }; },
+	resolveEolProduct() { return null; },
+	recipe: require("./recipes").binary,
+	nativeScanners: [],
+};

package/lib/codecs/composer.codec.js

@@ -15,7 +15,7 @@ const { parseComposerLock, parseComposerJson, isConcrete } = require("./composer
 
 const SKIP = new Set(["vendor", ".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target"]);
 
-function findComposerManifests(dir) {
+function findComposerManifests(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const groups = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -29,11 +29,15 @@ function findComposerManifests(dir) {
 				composerLock: names.has("composer.lock") ? path.join(cur, "composer.lock") : null,
 			});
 		}
-		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		for (const e of entries) if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
 }
 
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "composer",
 	label: "Composer",
@@ -46,7 +50,7 @@ module.exports = {
 		const { ignoreTest, deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
-		for (const g of findComposerManifests(dir)) {
+		for (const g of findComposerManifests(dir, dirFilter(dir, opts))) {
 			if (g.composerLock) {
 				let parsed;
 				try { parsed = parseComposerLock(g.composerLock); }

package/lib/codecs/go/registry.js

@@ -13,11 +13,11 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+const { withPublic, authHeaderFor, normalise } = require("../../registries");
 
 const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
 const CACHE_PATH = path.join(CACHE_DIR, "go-proxy-cache.json");
 const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
-const PROXY = "https://proxy.golang.org";
 
 function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
 function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
@@ -34,18 +34,26 @@ function cmp(a, b) {
 	return 0;
 }
 
-async function fetchLatest(mod, { offline }) {
+// Custom GOPROXY first (same protocol: <base>/<escaped-module>/@latest), then proxy.golang.org.
+async function fetchLatest(mod, { offline, registries = [], fetcher = globalThis.fetch } = {}) {
 	if (offline) return null;
-	try {
-		const res = await fetch(`${PROXY}/${escapeModule(mod)}/@latest`, { headers: { "User-Agent": "fad-checker-go" } });
-		if (!res.ok) return { error: `HTTP ${res.status}` };
-		const j = await res.json();
-		return { latest: (j.Version || "").replace(/^v/, "") || null };
-	} catch (e) { return { error: e.message }; }
+	const bases = withPublic("go", registries);
+	let lastErr = null;
+	for (const base of bases) {
+		const url = normalise(base.url) + `${escapeModule(mod)}/@latest`;
+		const headers = { "User-Agent": "fad-checker-go", Accept: "application/json" };
+		const ah = authHeaderFor(base); if (ah) headers.Authorization = ah;
+		try {
+			const res = await fetcher(url, { headers });
+			if (res.ok) { const j = await res.json(); return { latest: (j.Version || "").replace(/^v/, "") || null }; }
+			lastErr = `HTTP ${res.status}`;
+		} catch (e) { lastErr = e.message; }
+	}
+	return { error: lastErr || "no data" };
 }
 
 async function checkGoRegistryDeps(deps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, registries = [] } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "go" && d.version);
 	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length || !allLibs) return result;
@@ -57,7 +65,7 @@ async function checkGoRegistryDeps(deps, opts = {}) {
 		const key = `${t.name}@${t.version}`;
 		let ex = cache.entries[key];
 		if (!ex) {
-			const r = await fetchLatest(t.name, { offline });
+			const r = await fetchLatest(t.name, { offline, registries });
 			ex = (r && !r.error) ? { latest: r.latest } : { latest: null };
 			if (r && !r.error) cache.entries[key] = ex;
 		}
@@ -71,4 +79,4 @@ async function checkGoRegistryDeps(deps, opts = {}) {
 	return result;
 }
 
-module.exports = { checkGoRegistryDeps, escapeModule };
+module.exports = { checkGoRegistryDeps, escapeModule, fetchLatest };

package/lib/codecs/go.codec.js

@@ -15,7 +15,7 @@ const G = require("./go/parse");
 
 const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target", "vendor", "testdata"]);
 
-function findGoDirs(dir) {
+function findGoDirs(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const groups = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -23,11 +23,15 @@ function findGoDirs(dir) {
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
 		if (names.has("go.mod") || names.has("go.sum")) groups.push({ dir: cur, names });
-		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		for (const e of entries) if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
 }
 
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "go",
 	label: "Go",
@@ -44,7 +48,7 @@ module.exports = {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
 			out.set(coordKeyFor("go", "", d.name), makeDepRecord({ ecosystem: "go", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: false }));
 		};
-		for (const g of findGoDirs(dir)) {
+		for (const g of findGoDirs(dir, dirFilter(dir, opts))) {
 			if (g.names.has("go.mod")) {
 				const fp = path.join(g.dir, "go.mod");
 				try {

package/lib/codecs/index.js

@@ -8,6 +8,8 @@
  * @author: N.BRAUN
  * @email: pp9ping@gmail.com
  */
+const fs = require("fs");
+const path = require("path");
 const { assertCodecShape } = require("./codec.interface");
 const maven = require("./maven.codec");
 const npm = require("./npm.codec");
@@ -17,12 +19,14 @@ const pypi = require("./pypi.codec");
 const nuget = require("./nuget.codec");
 const go = require("./go.codec");
 const ruby = require("./ruby.codec");
+const binary = require("./binary.codec");
 
 // Ordre stable pour le report (maven, npm, yarn, puis les nouveaux écosystèmes).
-const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"];
+// "binary" (committed native libs, no manifest) reste en dernier.
+const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby", "binary"];
 
 const REGISTRY = new Map();
-for (const c of [maven, npm, yarn, composer, pypi, nuget, go, ruby]) {
+for (const c of [maven, npm, yarn, composer, pypi, nuget, go, ruby, binary]) {
 	assertCodecShape(c);
 	REGISTRY.set(c.id, c);
 }
@@ -33,10 +37,75 @@ function allCodecs() {
 	return [...REGISTRY.values()].sort((a, b) => ORDER.indexOf(a.id) - ORDER.indexOf(b.id));
 }
 
+// Dirs skipped during detection. Starts from the INTERSECTION of every codec's own
+// skip set (a dir skipped here only if ALL codecs skip it → detection never misses a
+// manifest a codec would have found) plus well-known dependency/cache/tooling dirs
+// that are NEVER a project root (all dot-dirs or vendored-dep caches), so detection
+// can prune them safely. NOTE: "build" / "vendor" / "bin" / "obj" are deliberately
+// NOT here — maven keeps build/ for BOMs and several codecs scan vendor/.
+const DETECT_SKIP = new Set([
+	"node_modules", ".git", ".idea", ".vscode", "target", "dist", "out",   // intersection
+	".svn", ".hg", ".gradle", ".mvn", ".cache", ".m2", "bower_components",  // never a project root
+	"jspm_packages", "__pycache__", ".venv", ".tox", ".mypy_cache", "coverage", ".next", ".nuxt",
+]);
+
+const DETECT_CONCURRENCY = 48;
+
 // yarn est détecté via le même arbre JS que npm ; on ne le renvoie pas en
 // doublon de détection (npm.collect ramasse déjà yarn.lock).
-function detectCodecs(dir) {
-	return allCodecs().filter(c => c.id !== "yarn" && c.detect(dir));
+//
+// ONE shared walk instead of one full-tree walk per codec: we descend the tree once
+// and, per file, test it against each codec's manifestNames (supporting "*.ext"
+// globs). Short-circuits as soon as every codec has matched. readdir runs with bounded
+// concurrency — on a high-latency filesystem (WSL/9p, network mounts) the walk is
+// latency-bound, so issuing many readdirs at once is far faster than a serial walk.
+async function detectCodecs(dir, opts = {}) {
+	const { makeDirFilter } = require("../path-filter");
+	const skipDir = makeDirFilter({ srcRoot: dir, defaultSkip: DETECT_SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+	const codecs = allCodecs().filter(c => c.id !== "yarn");
+	const matchers = codecs.map(c => {
+		const exact = new Set();
+		const exts = [];
+		for (const n of c.manifestNames || []) {
+			if (n.startsWith("*.")) exts.push(n.slice(1)); // "*.csproj" → ".csproj"
+			else exact.add(n);
+		}
+		return { codec: c, exact, exts, found: false };
+	});
+	let remaining = matchers.length;
+	const queue = [dir];
+	let active = 0;
+
+	await new Promise(resolve => {
+		let settled = false;
+		const finish = () => { if (!settled) { settled = true; resolve(); } };
+		const pump = () => {
+			if (settled) return;
+			if (remaining === 0) return finish();
+			if (queue.length === 0 && active === 0) return finish();
+			while (active < DETECT_CONCURRENCY && queue.length && remaining > 0) {
+				const cur = queue.pop();
+				active++;
+				fs.promises.readdir(cur, { withFileTypes: true }).then(entries => {
+					for (const e of entries) {
+						if (e.isDirectory()) {
+							const child = path.join(cur, e.name);
+							if (!skipDir(child, e.name)) queue.push(child);
+							continue;
+						}
+						if (!e.isFile()) continue;
+						const name = e.name;
+						for (const m of matchers) {
+							if (m.found) continue;
+							if (m.exact.has(name) || m.exts.some(ext => name.endsWith(ext))) { m.found = true; remaining--; }
+						}
+					}
+				}).catch(() => { /* unreadable dir → skip */ }).finally(() => { active--; pump(); });
+			}
+		};
+		pump();
+	});
+	return matchers.filter(m => m.found).map(m => m.codec);
 }
 
 module.exports = { getCodec, allCodecs, detectCodecs, ORDER };

package/lib/codecs/maven/jar-scan.js

@@ -24,7 +24,7 @@
  */
 const fs = require("fs");
 const path = require("path");
-const { unzipSync, strFromU8 } = require("fflate");
+const { unzipSync, inflateSync, strFromU8 } = require("fflate");
 const { makeDepRecord } = require("../../dep-record");
 
 const ARCHIVE_RE = /\.(jar|war|ear)$/i;
@@ -33,6 +33,15 @@ const SKIP_DIRS = new Set(["node_modules", ".git", "target", "build", "out", "di
 const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
 const MAX_DEPTH = 8;
 
+// The ONLY entries we ever decompress out of an archive: its own Maven coordinate
+// (pom.properties), its manifest, and any NESTED archive (a fat-jar's bundled libs,
+// which we recurse into). Everything else — .class files, resources — is skipped.
+function wantedEntry(name) {
+	return /^META-INF\/maven\/[^/]+\/[^/]+\/pom\.properties$/.test(name)
+		|| name === "META-INF/MANIFEST.MF"
+		|| ARCHIVE_RE.test(name);
+}
+
 /** Parse a META-INF/maven/.../pom.properties body → { groupId, artifactId, version } | null. */
 function coordFromPomProperties(text) {
 	const get = re => (String(text || "").match(re) || [])[1]?.trim();
@@ -90,6 +99,72 @@ function readEntries(buf, filter) {
 	}
 }
 
+const EOCD_SIG = 0x06054b50; // End Of Central Directory
+const CEN_SIG = 0x02014b50;  // central directory file header
+const LOC_SIG = 0x04034b50;  // local file header
+
+/**
+ * Read ONLY the `filter`-matched entries of an on-disk zip via positioned reads on
+ * the file descriptor — without ever loading the whole archive into RAM. We read
+ * the End-Of-Central-Directory record, then the central directory, then seek to and
+ * inflate just the wanted entries. A 200 MB library jar with a 1 KB pom.properties
+ * costs a few KB of reads instead of 200 MB; its .class files are never touched.
+ *
+ * Throws on anything this minimal parser doesn't handle (ZIP64, encryption, an
+ * unknown compression method, a malformed record) so the caller can fall back to
+ * the battle-tested fflate whole-buffer path. Sizes are taken from the central
+ * directory (authoritative even when a streaming writer zeroes the local header).
+ *
+ * @returns {Object<string, Uint8Array>} matched entries, same shape as readEntries()
+ */
+function readZipEntriesFromFd(fd, fileSize, filter) {
+	const back = Math.min(fileSize, 65557); // max EOCD comment (65535) + 22-byte record
+	const tail = Buffer.allocUnsafe(back);
+	fs.readSync(fd, tail, 0, back, fileSize - back);
+	let e = -1;
+	for (let i = tail.length - 22; i >= 0; i--) {
+		if (tail.readUInt32LE(i) === EOCD_SIG) { e = i; break; }
+	}
+	if (e < 0) throw new Error("no EOCD record");
+	const count = tail.readUInt16LE(e + 10);
+	const cdSize = tail.readUInt32LE(e + 12);
+	const cdOff = tail.readUInt32LE(e + 16);
+	if (count === 0xffff || cdSize === 0xffffffff || cdOff === 0xffffffff) throw new Error("ZIP64");
+
+	const cd = Buffer.allocUnsafe(cdSize);
+	fs.readSync(fd, cd, 0, cdSize, cdOff);
+	const out = {};
+	let p = 0;
+	for (let i = 0; i < count; i++) {
+		if (p + 46 > cd.length || cd.readUInt32LE(p) !== CEN_SIG) throw new Error("bad central record");
+		const flags = cd.readUInt16LE(p + 8);
+		const method = cd.readUInt16LE(p + 10);
+		const compSize = cd.readUInt32LE(p + 20);
+		const uncompSize = cd.readUInt32LE(p + 24);
+		const nameLen = cd.readUInt16LE(p + 28);
+		const extraLen = cd.readUInt16LE(p + 30);
+		const commentLen = cd.readUInt16LE(p + 32);
+		const localOff = cd.readUInt32LE(p + 42);
+		const name = cd.toString("utf8", p + 46, p + 46 + nameLen);
+		p += 46 + nameLen + extraLen + commentLen;
+		if (!filter(name)) continue;
+		if (flags & 0x1) throw new Error("encrypted entry");
+		if (compSize === 0xffffffff || uncompSize === 0xffffffff || localOff === 0xffffffff) throw new Error("ZIP64 entry");
+		// The local header's name/extra lengths can differ from the central record's,
+		// so read it to locate the actual start of the entry's data.
+		const loc = Buffer.allocUnsafe(30);
+		fs.readSync(fd, loc, 0, 30, localOff);
+		if (loc.readUInt32LE(0) !== LOC_SIG) throw new Error("bad local header");
+		const dataOff = localOff + 30 + loc.readUInt16LE(26) + loc.readUInt16LE(28);
+		const comp = compSize > 0 ? Buffer.allocUnsafe(compSize) : Buffer.alloc(0);
+		if (compSize > 0) fs.readSync(fd, comp, 0, compSize, dataOff);
+		if (method === 0) out[name] = comp;                                           // stored
+		else if (method === 8) out[name] = inflateSync(comp, { out: new Uint8Array(uncompSize) }); // deflate
+		else throw new Error("compression method " + method);
+	}
+	return out;
+}
+
 /**
  * Resolve a single archive's own coordinate + confidence from its entries.
  * Returns { coord, source } | null. `source` ∈ pom.properties|manifest|filename.
@@ -115,24 +190,14 @@ function coordForArchive(entries, fileName) {
 }
 
 /**
- * Recursively scan one archive buffer. Pushes embedded depRecords into `out` and
- * warnings into `warnings`. `displayPath` is the `!/`-joined logical path.
+ * Given an archive's already-extracted entries, record its coordinate and recurse
+ * into any nested archives. `ctx` carries { out, warnings, onProgress, scanned }.
  */
-function scanArchiveBuffer(buf, displayPath, fileName, out, warnings, depth) {
-	if (depth > MAX_DEPTH) { warnings.push({ type: "embedded-jar", message: `nesting too deep, skipped: ${displayPath}` }); return; }
-	if (buf.length > MAX_ARCHIVE_BYTES) { warnings.push({ type: "embedded-jar", message: `archive too large (${Math.round(buf.length / 1048576)}MB), skipped: ${displayPath}` }); return; }
-
-	// Read only what we need: this archive's identity files + any nested archives.
-	const entries = readEntries(buf, name =>
-		/^META-INF\/maven\/[^/]+\/[^/]+\/pom\.properties$/.test(name) ||
-		name === "META-INF/MANIFEST.MF" ||
-		ARCHIVE_RE.test(name));
-	if (entries === null) { warnings.push({ type: "embedded-jar", message: `could not read archive (corrupt/unsupported): ${displayPath}` }); return; }
-
+function processEntries(entries, displayPath, fileName, ctx, depth) {
 	const resolved = coordForArchive(entries, fileName);
 	if (resolved) {
-		const { coord, source } = resolved;
-		out.push(makeDepRecord({
+		const { coord } = resolved;
+		ctx.out.push(makeDepRecord({
 			ecosystem: "maven",
 			namespace: coord.groupId || "",
 			name: coord.artifactId,
@@ -142,7 +207,7 @@ function scanArchiveBuffer(buf, displayPath, fileName, out, warnings, depth) {
 			provenance: "embedded",
 		}));
 	} else {
-		warnings.push({ type: "embedded-jar", message: `embedded archive with no resolvable Maven coordinate (not scanned): ${displayPath}` });
+		ctx.warnings.push({ type: "embedded-jar", message: `embedded archive with no resolvable Maven coordinate (not scanned): ${displayPath}` });
 	}
 
 	// Recurse into nested archives (fat-jar libs).
@@ -150,10 +215,62 @@ function scanArchiveBuffer(buf, displayPath, fileName, out, warnings, depth) {
 		if (!ARCHIVE_RE.test(name)) continue;
 		const nestedBuf = entries[name];
 		if (!nestedBuf || !nestedBuf.length) continue;
-		scanArchiveBuffer(Buffer.from(nestedBuf), `${displayPath}!/${name}`, path.basename(name), out, warnings, depth + 1);
+		scanArchiveBuffer(Buffer.from(nestedBuf), `${displayPath}!/${name}`, path.basename(name), ctx, depth + 1);
 	}
 }
 
+/**
+ * Recursively scan one archive held in memory (a nested fat-jar lib). Only the
+ * coordinate/manifest/nested-archive entries are decompressed (via wantedEntry).
+ * `displayPath` is the `!/`-joined logical path.
+ */
+function scanArchiveBuffer(buf, displayPath, fileName, ctx, depth) {
+	if (depth > MAX_DEPTH) { ctx.warnings.push({ type: "embedded-jar", message: `nesting too deep, skipped: ${displayPath}` }); return; }
+	if (buf.length > MAX_ARCHIVE_BYTES) { ctx.warnings.push({ type: "embedded-jar", message: `archive too large (${Math.round(buf.length / 1048576)}MB), skipped: ${displayPath}` }); return; }
+	// Report before the (blocking) inflate so the displayed line names this archive.
+	ctx.scanned++;
+	ctx.onProgress?.({ phase: "scan", scanned: ctx.scanned, total: ctx.total, path: displayPath });
+
+	const entries = readEntries(buf, wantedEntry);
+	if (entries === null) { ctx.warnings.push({ type: "embedded-jar", message: `could not read archive (corrupt/unsupported): ${displayPath}` }); return; }
+	processEntries(entries, displayPath, fileName, ctx, depth);
+}
+
+/**
+ * Scan one TOP-LEVEL on-disk archive. Tries the lazy positioned-read path first
+ * (reads only the central directory + wanted entries — never the whole file), and
+ * falls back to reading the whole file + fflate on any case the lazy parser can't
+ * handle (ZIP64, encryption, corruption).
+ */
+function scanArchiveFile(abs, displayPath, fileName, ctx) {
+	ctx.scanned++;
+	ctx.onProgress?.({ phase: "scan", scanned: ctx.scanned, total: ctx.total, path: displayPath });
+
+	let size;
+	try { size = fs.statSync(abs).size; }
+	catch (e) { ctx.warnings.push({ type: "embedded-jar", message: `could not stat ${abs}: ${e.message}` }); return; }
+	// Skip oversized archives WITHOUT pulling them into RAM.
+	if (size > MAX_ARCHIVE_BYTES) { ctx.warnings.push({ type: "embedded-jar", message: `archive too large (${Math.round(size / 1048576)}MB), skipped: ${displayPath}` }); return; }
+
+	// Fast path: lazy central-directory read (no whole-file load, no .class inflate).
+	let fd;
+	try {
+		fd = fs.openSync(abs, "r");
+		const entries = readZipEntriesFromFd(fd, size, wantedEntry);
+		processEntries(entries, displayPath, fileName, ctx, 0);
+		return;
+	} catch { /* fall back to the whole-buffer path below */ }
+	finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* ignore */ } } }
+
+	// Fallback: read the whole file + fflate (handles ZIP64 etc.).
+	let buf;
+	try { buf = fs.readFileSync(abs); }
+	catch (e) { ctx.warnings.push({ type: "embedded-jar", message: `could not read ${abs}: ${e.message}` }); return; }
+	const entries = readEntries(buf, wantedEntry);
+	if (entries === null) { ctx.warnings.push({ type: "embedded-jar", message: `could not read archive (corrupt/unsupported): ${displayPath}` }); return; }
+	processEntries(entries, displayPath, fileName, ctx, 0);
+}
+
 /** Recursively list archive file paths under `dir`. */
 function findArchives(dir, acc = []) {
 	let entries;
@@ -170,22 +287,54 @@ function findArchives(dir, acc = []) {
 	return acc;
 }
 
+// Parallel equivalent of findArchives — concurrent readdir so a deep tree on a
+// high-latency filesystem isn't walked one round-trip at a time.
+async function findArchivesAsync(dir, skipDir) {
+	const { walkDirs } = require("../../parallel-walk");
+	const skip = skipDir || ((child, name) => SKIP_DIRS.has(name) || name.startsWith("."));
+	const acc = [];
+	await walkDirs(dir, {
+		skipDir: skip,
+		onDir: (cur, entries) => {
+			for (const e of entries) if (e.isFile() && ARCHIVE_RE.test(e.name)) acc.push(path.join(cur, e.name));
+		},
+	});
+	return acc;
+}
+
 /**
  * Scan `rootDir` for embedded JAR/WAR/EAR coordinates.
+ *
+ * Reading + unzipping is synchronous and can be slow on a tree with many or large
+ * fat-jars, so `opts.onProgress` is invoked around the work — for EVERY archive,
+ * nested ones included — so the caller can tell the user what's happening (it would
+ * otherwise block silently, especially while recursing through a fat-jar's libs):
+ *   onProgress({ phase: "start", total })                  once; total = top-level archive count
+ *   onProgress({ phase: "scan", scanned, total, path })    before each archive is read (top-level + nested)
+ *   onProgress({ phase: "done", total, found, scanned })   once, when finished
+ *
  * @returns { deps: depRecord[], warnings: [{type,message}] }
  */
-function scanEmbeddedJars(rootDir, opts = {}) {
-	const out = [];
-	const warnings = [];
-	const archives = findArchives(rootDir);
+async function scanEmbeddedJars(rootDir, opts = {}) {
+	const { makeDirFilter } = require("../../path-filter");
+	const useDefaults = opts.defaultExcludes !== false;
+	const base = makeDirFilter({ srcRoot: opts.srcRoot || rootDir, defaultSkip: SKIP_DIRS, excludePath: opts.excludePath, useDefaults });
+	const skipDir = (child, name) => base(child, name) || (useDefaults && name.startsWith("."));
+	const archives = await findArchivesAsync(rootDir, skipDir);
+	const ctx = {
+		out: [],
+		warnings: [],
+		onProgress: typeof opts.onProgress === "function" ? opts.onProgress : null,
+		scanned: 0,
+		total: archives.length,
+	};
+	ctx.onProgress?.({ phase: "start", total: archives.length });
 	for (const abs of archives) {
-		let buf;
-		try { buf = fs.readFileSync(abs); }
-		catch (e) { warnings.push({ type: "embedded-jar", message: `could not read ${abs}: ${e.message}` }); continue; }
-		const rel = opts.srcRoot ? path.relative(opts.srcRoot, abs) : abs;
-		scanArchiveBuffer(buf, rel.split(path.sep).join("/"), path.basename(abs), out, warnings, 0);
+		const rel = (opts.srcRoot ? path.relative(opts.srcRoot, abs) : abs).split(path.sep).join("/");
+		scanArchiveFile(abs, rel, path.basename(abs), ctx);
 	}
-	return { deps: out, warnings };
+	ctx.onProgress?.({ phase: "done", total: archives.length, found: ctx.out.length, scanned: ctx.scanned });
+	return { deps: ctx.out, warnings: ctx.warnings };
 }
 
 module.exports = {
@@ -196,4 +345,6 @@ module.exports = {
 	coordFromFilename,
 	coordForArchive,
 	scanArchiveBuffer,
+	readZipEntriesFromFd,
+	findArchivesAsync,
 };

package/lib/codecs/maven.codec.js

@@ -40,7 +40,9 @@ module.exports = {
 	// Expose _maven (store/propsByPom/pomFiles) pour que l'orchestrateur garde la
 	// phase de réécriture des POM nettoyés (lib/core.rewritePoms).
 	async collect(dir, opts = {}) {
-		const pomFiles = core.findPomFiles(dir);
+		const { makeDirFilter } = require("../path-filter");
+		const skipDir = makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: core.SKIP_DIRS, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+		const pomFiles = await core.findPomFilesAsync(dir, skipDir);
 		const store = core.newMetadataStore();
 		const propsByPom = {};
 		for (const pom of pomFiles) {
@@ -58,7 +60,7 @@ module.exports = {
 		if (opts.scanJars !== false) {
 			try {
 				const { scanEmbeddedJars } = require("./maven/jar-scan");
-				const { deps: embedded, warnings: jarWarnings } = scanEmbeddedJars(dir, { srcRoot: opts.srcRoot || dir });
+				const { deps: embedded, warnings: jarWarnings } = await scanEmbeddedJars(dir, { srcRoot: opts.srcRoot || dir, excludePath: opts.excludePath, defaultExcludes: opts.defaultExcludes, onProgress: opts.onJarProgress });
 				for (const rec of embedded) deps.set(rec.coordKey, rec);
 				warnings.push(...jarWarnings);
 			} catch (e) { warnings.push({ type: "embedded-jar", message: `embedded-jar scan failed: ${e.message}` }); }

package/lib/codecs/npm/collect.js

@@ -137,7 +137,9 @@ function collectNpmDeps(rootDir, opts = {}) {
 	const { ignoreTest, deps2Exclude, verbose } = opts;
 	const out = new Map();
 	const warnings = [];
-	const manifestGroups = findJsManifests(rootDir);
+	// Caller may pass pre-discovered manifest groups (e.g. from the parallel
+	// findJsManifestsAsync walk) to avoid a second, serial tree traversal.
+	const manifestGroups = opts.manifestGroups || findJsManifests(rootDir);
 	let parsedCount = 0;
 
 	for (const group of manifestGroups) {