fad-checker 2.2.3 → 2.3.0

package/lib/cve-report.js

@@ -14,6 +14,7 @@ const { getCodec, allCodecs, ORDER } = require("./codecs");
 const { computePriority, sortByPriority } = require("./priority");
 const { buildInventory } = require("./unmanaged");
 const { buildEmbeddedInventory } = require("./embedded");
+const { renderCharts } = require("./charts");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
@@ -98,10 +99,13 @@ h1 { margin: 0 0 4px 0; font-size: 28px; letter-spacing: -.5px; }
 .report-subtitle { color: #6b7280; font-size: 14px; font-weight: 500; margin-bottom: 12px; letter-spacing: .3px; }
 h2 { margin: 32px 0 12px; font-size: 20px; border-bottom: 2px solid #e5e7eb; padding-bottom: 6px; }
 .meta { color: #6b7280; font-size: 13px; margin-bottom: 16px; }
-.summary { display: flex; flex-wrap: wrap; gap: 12px; margin: 16px 0; }
-.summary .card { padding: 10px 16px; border-radius: 6px; background: #fff; border: 1px solid #e5e7eb; min-width: 120px; }
-.summary .card .v { font-size: 24px; font-weight: 700; }
-.summary .card .l { font-size: 11px; text-transform: uppercase; color: #6b7280; letter-spacing: .5px; }
+/* Totals row — compact cards that FLEX-GROW to spread evenly across the full
+   render width (flex:1), so the set fills the line above the overview charts
+   instead of clustering on the left. */
+.summary { display: flex; flex-wrap: wrap; gap: 7px; margin: 14px 0; }
+.summary .card { flex: 1 1 0; padding: 6px 11px; border-radius: 5px; background: #fff; border: 1px solid #e5e7eb; min-width: 100px; }
+.summary .card .v { font-size: 20px; font-weight: 700; line-height: 1.1; }
+.summary .card .l { font-size: 11px; text-transform: uppercase; color: #6b7280; letter-spacing: .3px; white-space: nowrap; }
 .summary .card.sev-critical { border-left: 4px solid #dc2626; }
 .summary .card.sev-critical .v { color: #dc2626; }
 .summary .card.sev-high { border-left: 4px solid #f97316; }
@@ -112,13 +116,25 @@ h2 { margin: 32px 0 12px; font-size: 20px; border-bottom: 2px solid #e5e7eb; pad
 .summary .card.sev-low .v { color: #2563eb; }
 .summary .card.sev-vendored { border-left: 4px solid #6366f1; }
 .summary .card.sev-warn { border-left: 4px solid #f59e0b; background: #fffbeb; }
+/* Overview charts — four equal-width (25%) cards on one row, stretched to the
+   same height. All four donuts share one viewBox width (see lib/charts.js) so
+   they scale identically and stay the SAME size whatever the legend length.
+   The copy button overlays the top-right. */
+.charts-row { display: flex; flex-wrap: wrap; gap: 12px; margin: 12px 0 18px; align-items: stretch; }
+.charts-row .chart-card { flex: 1 1 0; min-width: 200px; position: relative; margin: 0; padding: 10px 12px; border: 1px solid #e5e7eb; border-radius: 8px; background: #fff; }
+.charts-row .chart-copy { position: absolute; top: 6px; right: 8px; padding: 2px 7px; font-size: 11px; z-index: 1; }
+.charts-row .chart-svg { display: block; width: 100%; height: auto; }
+.charts-row .chart-head { display: flex; align-items: center; gap: 8px; margin-bottom: 4px; }
+.charts-row .chart-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .4px; color: #4b5563; }
+.charts-row .chart-empty { color: #9ca3af; font-style: italic; font-size: 11px; padding: 14px 0; }
 .toc { position: sticky; top: 0; z-index: 50; background: #fff; border: 1px solid #e5e7eb; border-radius: 6px; padding: 8px 12px; margin: 16px 0; display: flex; flex-wrap: wrap; gap: 6px 14px; font-size: 12px; box-shadow: 0 1px 4px rgba(0,0,0,.04); }
 .toc a { color: #4338ca; text-decoration: none; padding: 2px 6px; border-radius: 3px; }
 .toc a:hover { background: #eef2ff; }
 .exec-summary .exec-top { margin-top: 8px; padding-top: 10px; border-top: 1px dashed #e5e7eb; }
 .exec-summary .exec-top-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .8px; color: #6b7280; margin-bottom: 6px; }
 .exec-summary .exec-top-list { list-style: none; padding: 0; margin: 0; font-size: 12px; }
-.exec-summary .exec-top-list li { display: flex; align-items: center; gap: 8px; padding: 3px 0; font-family: ui-monospace, monospace; }
+.exec-summary .exec-top-list li { display: flex; align-items: center; flex-wrap: wrap; gap: 6px; padding: 3px 0; font-family: ui-monospace, monospace; }
+.exec-summary .exec-cwes-chips { display: inline-flex; flex-wrap: wrap; gap: 4px; }
 .exec-summary .exec-cve-link { color: #1d4ed8; text-decoration: none; font-weight: 600; }
 .exec-summary .exec-cve-link:hover { text-decoration: underline; }
 .exec-summary .exec-ver { color: #6b7280; }
@@ -153,6 +169,17 @@ td.cwe .cwe-name { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; f
 .exec-summary .exec-cwe { display: inline-flex; align-items: baseline; gap: 4px; font-size: 11px; color: #4b5563; background: #eef2ff; border: 1px solid #c7d2fe; padding: 1px 6px; border-radius: 3px; margin-left: 2px; }
 .exec-summary .exec-cwe .exec-cwe-id { font-family: ui-monospace, monospace; font-weight: 600; color: #4338ca; }
 .exec-summary .exec-cwe .exec-cwe-name { color: #4b5563; }
+.exec-summary .exec-cwe .exec-cwe-count { font-family: ui-monospace, monospace; font-size: 10px; color: #6366f1; font-weight: 700; }
+/* transitive-fallback tag on a top-3 row */
+.exec-summary .exec-scope-tag { font-size: 9px; font-weight: 700; text-transform: uppercase; letter-spacing: .5px; color: #92400e; background: #fef3c7; border: 1px solid #fde68a; padding: 1px 5px; border-radius: 3px; }
+/* top-EOL block */
+.exec-summary .exec-eol { margin-top: 8px; padding-top: 10px; border-top: 1px dashed #e5e7eb; }
+.exec-summary .exec-eol-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .8px; color: #6b7280; margin-bottom: 6px; }
+.exec-summary .exec-eol-list { list-style: none; padding: 0; margin: 0; font-size: 12px; }
+.exec-summary .exec-eol-list li { display: flex; align-items: center; gap: 8px; padding: 3px 0; font-family: ui-monospace, monospace; }
+/* short summary of everything else */
+.exec-summary .exec-rest { margin-top: 8px; padding-top: 10px; border-top: 1px dashed #e5e7eb; font-size: 12px; color: #374151; line-height: 1.6; }
+.exec-summary .exec-rest .exec-rest-label { font-weight: 700; text-transform: uppercase; letter-spacing: .8px; color: #6b7280; font-size: 11px; margin-right: 4px; }
 td.published { font-family: ui-monospace, monospace; font-size: 11px; color: #6b7280; white-space: nowrap; }
 tr.cve-row.cpe-fp td { opacity: .55; }
 .jump-badge { display: inline-block; padding: 1px 8px; border-radius: 4px; font-size: 10px; font-weight: 700; text-transform: uppercase; letter-spacing: .5px; }
@@ -391,6 +418,53 @@ function makeRelative(absPath, srcRoot) {
 	} catch { return absPath; }
 }
 
+// Inventory of the manifest/lockfile descriptors fad actually parsed and fed into the
+// scan: the union of every declared dep's manifestPaths (relative to the src root), with
+// the ecosystem(s) and the count of direct deps each contributed. Transitive deps (resolved
+// from a registry, no local file) and committed binaries (embedded/native — inventoried in
+// chapters 1B/1C, not "descriptors") are excluded.
+function buildScannedManifests(resolvedDeps, srcRoot, parsedManifests = []) {
+	const byPath = new Map();
+	const touch = (relPath, eco) => {
+		let e = byPath.get(relPath);
+		if (!e) { e = { path: relPath, ecosystems: new Set(), count: 0 }; byPath.set(relPath, e); }
+		if (eco) e.ecosystems.add(eco);
+		return e;
+	};
+	// Files that contributed at least one scanned dependency (count = direct deps).
+	for (const dep of (resolvedDeps?.values?.() || [])) {
+		if (dep.scope === "transitive") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
+		const paths = (dep.manifestPaths && dep.manifestPaths.length) ? dep.manifestPaths
+			: (dep.pomPaths && dep.pomPaths.length) ? dep.pomPaths : [];
+		for (const p of paths) touch(makeRelative(p, srcRoot), dep.ecosystemType || dep.ecosystem || "?").count++;
+	}
+	// EVERY descriptor each codec reported parsing — incl. ones that contributed nothing
+	// (ranges-only / no lockfile). These land with count 0 so nothing is silently omitted.
+	for (const pm of (parsedManifests || [])) {
+		if (!pm || !pm.path) continue;
+		touch(makeRelative(pm.path, srcRoot), pm.ecosystemType);
+	}
+	return [...byPath.values()]
+		.map(e => ({ path: e.path, ecosystems: [...e.ecosystems].sort(), count: e.count }))
+		.sort((a, b) => a.path.localeCompare(b.path));
+}
+
+function renderScannedManifests(list) {
+	if (!list.length) return `<div class="empty">No dependency descriptors were parsed (deps came only from registries or committed binaries).</div>`;
+	const emptyN = list.filter(e => e.count === 0).length;
+	const intro = `<div class="fp-intro">Every manifest / lockfile descriptor fad-checker parsed for this scan (paths relative to the source root) — the complete list, including files that contributed <strong>no scannable dependency</strong> (only version ranges, or no lockfile)${emptyN ? `: ${emptyN} such file${emptyN > 1 ? "s" : ""} shown with <code>0</code>` : ""}. Transitive deps resolved from registries, and committed binaries (chapters 1B/1C), are not descriptors and are excluded here.</div>`;
+	const rows = list.map(e => `<tr>
+		<td class="dep"><code>${esc(e.path)}</code></td>
+		<td>${esc(e.ecosystems.map(x => ECO_LABELS[x] || x).join(", "))}</td>
+		<td>${e.count > 0 ? e.count : `<span style="color:#9ca3af">0 <span style="font-style:italic">— ranges / no lockfile</span></span>`}</td>
+	</tr>`).join("\n");
+	return intro + `<table>
+		<thead><tr><th>Descriptor</th><th>Ecosystem</th><th>Direct deps</th></tr></thead>
+		<tbody>${rows}</tbody>
+	</table>`;
+}
+
 // Présentation des coordonnées, déléguée au codec. Règle générique : le codec
 // fournit la coord canonique (maven "g:a", npm "name", composer "vendor/pkg"…) ;
 // Maven la porte déjà son namespace, les autres reçoivent un tag d'écosystème
@@ -980,7 +1054,7 @@ function renderObsoleteTable(obs) {
 	if (!obs?.length) return `<div class="empty">No obsolete / deprecated libraries detected.</div>`;
 	const rows = obs.map(o => `<tr>
 		<td>${badge((o.severity || "MEDIUM").toUpperCase())}</td>
-		<td class="dep">${esc(depDisplayName(o.dep))}<br><span style="color:#6b7280">${esc(o.dep.version || "?")}</span>${renderDefinedIn(o.dep, RENDER_CTX.srcRoot)}</td>
+		<td class="dep">${esc(depDisplayName(o.dep))}<br><span style="color:#6b7280">${esc(o.dep.version || "?")}</span>${renderDepOrigin(o.dep, RENDER_CTX.srcRoot)}</td>
 		<td class="dep">${esc(o.replacement || "—")}</td>
 		<td class="desc">${esc(o.reason || "")}</td>
 	</tr>`).join("\n");
@@ -1194,21 +1268,19 @@ function renderRetireTable(matches) {
 }
 
 /**
- * One "vulnerable to" clause for a match, in the format requested for the
- * Word-pasteable summary: prefer the primary CWE ("CWE-79 : Cross-site
- * Scripting"), fall back to the CVE id when no weakness is recorded.
+ * The "vulnerable to" clause for a match in the Word-pasteable summary: ALL of
+ * the finding's CWEs ("CWE-79 : Cross-site Scripting, CWE-89 : SQL Injection"),
+ * falling back to the CVE id when no weakness is recorded.
  */
 function execWeakness(m) {
 	const cwes = Array.isArray(m.cve.cwes) ? m.cve.cwes : [];
-	const primary = cwes.find(c => cweName(c)) || cwes[0];
-	if (primary) {
-		const label = cweName(primary);
-		return label ? `${primary} : ${label}` : primary;
+	if (cwes.length) {
+		return cwes.map(c => { const label = cweName(c); return label ? `${c} : ${label}` : c; }).join(", ");
 	}
 	return m.cve.id || "an unspecified weakness";
 }
 
-function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches, interactive = false }) {
+function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches, nativeBinaryCount = 0, interactive = false }) {
 	const eolN = eolResults?.length || 0;
 	const obsN = obsoleteResults?.length || 0;
 	const outN = outdatedResults?.length || 0;
@@ -1222,77 +1294,102 @@ function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats,
 	else if (prodStats.low > 0 || retireStats.low > 0 || outN > 0) level = "LOW";
 	else if (prodStats.total > 0) level = "UNKNOWN";
 
-	const bullets = [];
-	if (prodStats.total) bullets.push(`<strong>${prodStats.total}</strong> CVE in production deps (critical=${prodStats.critical}, high=${prodStats.high}, medium=${prodStats.medium}, low=${prodStats.low})`);
-	if (devStats.total)  bullets.push(`<strong>${devStats.total}</strong> CVE in dev/test deps`);
-	if (retireStats.total) bullets.push(`<strong>${retireStats.total}</strong> vulnerable vendored JS finding(s) (retire.js)`);
-	if (eolN) bullets.push(`<strong>${eolN}</strong> end-of-life framework${eolN > 1 ? "s" : ""}`);
-	if (obsN) bullets.push(`<strong>${obsN}</strong> obsolete / deprecated lib${obsN > 1 ? "s" : ""}`);
-	if (outN) bullets.push(`<strong>${outN}</strong> outdated lib${outN > 1 ? "s" : ""}`);
-	if (warnings?.length) bullets.push(`<strong>${warnings.length}</strong> scan-completeness alert${warnings.length > 1 ? "s" : ""} — see chapter 0`);
-
-	const topPreview = (topCriticalMatches || []).length ? `<div class="exec-top">
-		<div class="exec-top-title">Top ${topCriticalMatches.length} most critical (preview)</div>
-		<ul class="exec-top-list">${topCriticalMatches.map(m => {
-			// First known-CWE on the match gets surfaced in the summary so the
-			// reader has a one-line answer to "what kind of weakness is this?"
+	const top = topCriticalMatches || [];
+	const topEol = pickTopEol(eolResults, 2);
+
+	const cweChipHtml = (id, name) => `<span class="exec-cwe" title="${esc(id)}${name ? ": " + esc(name) : ""}"><span class="exec-cwe-id">${esc(id)}</span>${name ? `<span class="exec-cwe-name">${esc(name)}</span>` : ""}</span>`;
+
+	// ---- Block 1: the 3 most critical (direct prod, transitive fallback) ----
+	// Each row lists ALL of its CWEs right beside it (the weakness fingerprint
+	// of that specific finding) — NOT a separate report-wide CWE aggregate.
+	const topBlock = top.length ? `<div class="exec-top">
+		<div class="exec-top-title">Top ${top.length} most critical · direct production dependencies</div>
+		<ul class="exec-top-list">${top.map(m => {
 			const cwes = Array.isArray(m.cve.cwes) ? m.cve.cwes : [];
-			const primary = cwes.find(c => cweName(c)) || cwes[0];
-			const primaryName = primary ? cweName(primary) : "";
-			const cweChip = primary ? `<span class="exec-cwe" title="${esc(primary)}${primaryName ? ": " + esc(primaryName) : ""}"><span class="exec-cwe-id">${esc(primary)}</span>${primaryName ? `<span class="exec-cwe-name">${esc(primaryName)}</span>` : ""}</span>` : "";
+			const cweChips = cwes.length ? `<span class="exec-cwes-chips">${cwes.map(c => cweChipHtml(c, cweName(c))).join("")}</span>` : "";
+			const transitiveTag = m.dep?.scope === "transitive"
+				? `<span class="exec-scope-tag" title="Pulled in transitively — fewer than ${top.length} direct production findings, so the worst transitive ones fill the rest">transitive</span>` : "";
 			return `<li>
 				${badge((m.cve.severity || "HIGH").toUpperCase())}
 				<a class="exec-cve-link" href="#ch${m.dep?.scope === "vendored" ? "2" : "1"}">${esc(m.cve.id)}</a>
 				<code>${esc(depDisplayName(m.dep))}</code>
 				<span class="exec-ver">${esc(m.dep.version || "?")}</span>
 				${m.cve.fixVersion ? `<span class="exec-fix">→ ${esc(m.cve.fixVersion)}</span>` : ""}
-				${cweChip}
+				${cweChips}
+				${transitiveTag}
 			</li>`;
 		}).join("")}</ul>
 	</div>` : "";
 
+	// ---- Block 2: the 2 most-overdue end-of-life frameworks ----
+	const eolWhen = e => (e.eol && e.eol !== "true" ? `EOL since ${esc(e.eol)}` : "end-of-life");
+	const eolBlock = topEol.length ? `<div class="exec-eol">
+		<div class="exec-eol-title">${topEol.length === 1 ? "Top end-of-life framework" : `Top ${topEol.length} end-of-life frameworks`}</div>
+		<ul class="exec-eol-list">${topEol.map(e => `<li>
+				<a class="exec-cve-link" href="#ch4">${esc(e.product || e.productSlug || "")}${e.cycle ? " " + esc(e.cycle) : ""}</a>
+				<code>${esc(depDisplayName(e.dep))}</code>
+				<span class="exec-ver">${eolWhen(e)}</span>
+				${e.latest ? `<span class="exec-fix">→ latest ${esc(e.latest)}</span>` : ""}
+			</li>`).join("")}</ul>
+	</div>` : "";
+
+	// ---- Block 3: a very short summary of everything else ----
+	const restParts = [];
+	if (prodStats.total) restParts.push(`<strong>${prodStats.total}</strong> production CVE (critical=${prodStats.critical}, high=${prodStats.high}, medium=${prodStats.medium}, low=${prodStats.low})`);
+	if (devStats.total)  restParts.push(`<strong>${devStats.total}</strong> dev/test CVE`);
+	if (retireStats.total) restParts.push(`<strong>${retireStats.total}</strong> vulnerable vendored-JS`);
+	if (eolN) restParts.push(`<strong>${eolN}</strong> EOL framework${eolN > 1 ? "s" : ""}`);
+	if (obsN) restParts.push(`<strong>${obsN}</strong> obsolete`);
+	if (outN) restParts.push(`<strong>${outN}</strong> outdated`);
+	if (nativeBinaryCount) restParts.push(`<strong>${nativeBinaryCount}</strong> unmanaged native binar${nativeBinaryCount > 1 ? "ies" : "y"}`);
+	if (warnings?.length) restParts.push(`<strong>${warnings.length}</strong> scan alert${warnings.length > 1 ? "s" : ""}`);
+	const restBlock = `<div class="exec-rest"><span class="exec-rest-label">Everything else:</span> ${restParts.length ? restParts.join(" · ") : "no other findings"}</div>`;
+
 	// ---- Word-pasteable copy payload (built only for the interactive HTML) ----
 	let copyUi = "";
 	if (interactive) {
 		const stripTags = s => s.replace(/<[^>]+>/g, "");
-		const plainBullets = bullets.map(stripTags);
-		const top = topCriticalMatches || [];
 		const topSentences = top.map(m => ({
 			lib: depDisplayName(m.dep),
 			ver: m.dep.version || "?",
 			weakness: execWeakness(m),
 			crit: (m.cve.severity || "HIGH").toUpperCase(),
+			transitive: m.dep?.scope === "transitive",
 		}));
+		const eolSentence = e => {
+			const when = e.eol && e.eol !== "true" ? `end-of-life since ${e.eol}` : "end-of-life";
+			return `- "${e.product || e.productSlug || ""}${e.cycle ? " " + e.cycle : ""}" (${depDisplayName(e.dep)}) is ${when}${e.latest ? `; latest is ${e.latest}` : ""}`;
+		};
+		const restText = stripTags(restParts.join(" · ")) || "no other findings";
 
-		// Plain-text version (text/plain) — exact bullet format requested.
-		const plainLines = [];
-		plainLines.push(`EXECUTIVE SUMMARY — ${level}`);
-		plainLines.push(`${totalDeps} dependencies scanned`);
-		plainLines.push("");
-		if (plainBullets.length) for (const b of plainBullets) plainLines.push(`- ${b}`);
-		else plainLines.push("- No findings detected.");
+		// Plain-text (text/plain).
+		const plainLines = [`EXECUTIVE SUMMARY — ${level}`, `${totalDeps} dependencies scanned`];
 		if (topSentences.length) {
-			plainLines.push("");
-			plainLines.push(`Top ${topSentences.length} most critical:`);
-			for (const t of topSentences) {
-				plainLines.push(`- The library "${t.lib}" version "${t.ver}" is vulnerable to "${t.weakness}" ( ${t.crit} )`);
-			}
+			plainLines.push("", `Top ${topSentences.length} most critical (direct production dependencies):`);
+			for (const t of topSentences) plainLines.push(`- The library "${t.lib}" version "${t.ver}" is vulnerable to "${t.weakness}" ( ${t.crit} )${t.transitive ? " [transitive]" : ""}`);
+		}
+		if (topEol.length) {
+			plainLines.push("", `Top ${topEol.length} end-of-life framework${topEol.length > 1 ? "s" : ""}:`);
+			for (const e of topEol) plainLines.push(eolSentence(e));
 		}
+		plainLines.push("", `Everything else: ${restText}`);
 		const plainText = plainLines.join("\n");
 
-		// Rich version (text/html) — inline styles so Word keeps the formatting.
-		const richBullets = plainBullets.length
-			? `<ul style="margin:4px 0 0; padding-left:22px;">${plainBullets.map(b => `<li style="margin:2px 0;">${esc(b)}</li>`).join("")}</ul>`
-			: `<p style="margin:4px 0;">No findings detected.</p>`;
+		// Rich (text/html) — inline styles so Word keeps the formatting.
 		const richTop = topSentences.length
-			? `<p style="font-weight:bold; margin:12px 0 4px;">Top ${topSentences.length} most critical:</p>
+			? `<p style="font-weight:bold; margin:12px 0 4px;">Top ${topSentences.length} most critical (direct production dependencies):</p>
 			<ul style="margin:0; padding-left:22px;">${topSentences.map(t =>
-				`<li style="margin:3px 0;">The library "<b>${esc(t.lib)}</b>" version "<b>${esc(t.ver)}</b>" is vulnerable to "<b>${esc(t.weakness)}</b>" ( ${esc(t.crit)} )</li>`).join("")}</ul>`
+				`<li style="margin:3px 0;">The library "<b>${esc(t.lib)}</b>" version "<b>${esc(t.ver)}</b>" is vulnerable to "<b>${esc(t.weakness)}</b>" ( ${esc(t.crit)} )${t.transitive ? ` <i>[transitive]</i>` : ""}</li>`).join("")}</ul>`
 			: "";
+		const richEol = topEol.length
+			? `<p style="font-weight:bold; margin:12px 0 4px;">Top ${topEol.length} end-of-life framework${topEol.length > 1 ? "s" : ""}:</p>
+			<ul style="margin:0; padding-left:22px;">${topEol.map(e => `<li style="margin:3px 0;">${esc(stripTags(eolSentence(e)).replace(/^- /, ""))}</li>`).join("")}</ul>`
+			: "";
+		const richRest = `<p style="margin:12px 0 0;"><b>Everything else:</b> ${esc(restText)}</p>`;
 		const richHtml = `<div style="font-family:Calibri,Arial,sans-serif; font-size:11pt; color:#1f2937;">`
 			+ `<p style="font-size:14pt; font-weight:bold; margin:0 0 2px;">Executive Summary — ${esc(level)}</p>`
 			+ `<p style="margin:0 0 8px; color:#4b5563;">${esc(totalDeps)} dependencies scanned</p>`
-			+ richBullets + richTop + `</div>`;
+			+ richTop + richEol + richRest + `</div>`;
 
 		copyUi = `<button class="btn-copy exec-copy-btn" type="button" title="Copy the executive summary — paste it into Word with formatting preserved">📋 Copy summary</button>`
 			+ `<template class="exec-copy-rich">${richHtml}</template>`
@@ -1306,10 +1403,9 @@ function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats,
 			${copyUi}
 		</div>
 		<div class="exec-meta">${esc(totalDeps)} dependencies scanned</div>
-		<ul class="exec-bullets">
-			${bullets.map(b => `<li>${b}</li>`).join("") || `<li>No findings detected.</li>`}
-		</ul>
-		${topPreview}
+		${topBlock}
+		${eolBlock}
+		${restBlock}
 	</div>`;
 }
 
@@ -1389,7 +1485,7 @@ function renderLicenseChapter(licenseResults) {
 	return intro + blocks;
 }
 
-function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
+function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, parsedManifests = [], wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
 	cveMatches      = mergeMatches(cveMatches || []);
@@ -1439,20 +1535,27 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		<span class="toolbar-label">Click a section header or a CVE row to toggle.</span>
 	</div>`;
 
+	// Committed native binaries no package manager governs (provenance:"binary",
+	// no resolved version) — surfaced as a count in the exec summary's rest line.
+	const nativeBinaryCount = [...(resolvedDeps?.values?.() || [])].filter(d => d.provenance === "binary").length;
+
 	const exec = renderExecutiveSummary({
 		projectInfo, prodStats, devStats, retireStats,
 		eolResults, obsoleteResults, outdatedResults,
 		warnings, totalDeps: resolvedDeps?.size || 0,
-		topCriticalMatches: pickTopCriticalMatches(prodMatchesActive, retireMatches, 5),
+		topCriticalMatches: pickTopCriticalMatches(prodMatchesActive, 3),
+		nativeBinaryCount,
 		interactive: wrapTables, // copy button + scripts only in the HTML output
 	});
 
 	// (C) Table of contents — rendered as a sticky nav. Only enumerates the
 	// chapters that actually have content (warnings, dev CVE, retire, FP appendix
 	// might be empty).
+	const scanned = buildScannedManifests(resolvedDeps, projectInfo?.src, parsedManifests);
 	const toc = renderToc({
 		hasWarnings: !!(warnings?.length),
 		prodTotal: prodStats.total,
+		scannedTotal: scanned.length,
 		retireTotal: retireMatches.length,
 		devTotal: devStats.total,
 		eolTotal: eolResults?.length || 0,
@@ -1466,17 +1569,21 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		fpTotal: prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length,
 	});
 
+	// Overview charts row, rendered right under the compact totals.
+	const chartsRow = renderCharts({ prodMatches: prodMatchesActive }, { interactive: wrapTables });
+
 	const body = `
 		<header class="report-header">
 			<h1>FAD-Checker Report</h1>
 			<div class="report-subtitle">Multi-ecosystem dependency security audit</div>
 			<div class="meta">
-				Project: <strong>${esc(projectInfo.name)}</strong> · <code class="path">${esc(projectInfo.src)}</code><br>
+				Project: <strong>${esc(projectInfo.name)}</strong><br>
 				Generated: ${esc(projectInfo.generatedAt)}${projectInfo.toolVersion ? ` · fad-checker ${esc(projectInfo.toolVersion)}` : ""}${projectInfo.cveDataDate ? ` · CVE data: ${esc(projectInfo.cveDataDate)}` : ""}
 			</div>
 		</header>
 		${exec}
 		${summaryCards(prodStats, eolResults, obsoleteResults, outdatedResults, { warnings, vendored: retireMatches.length, licenseFlagged })}
+		${chartsRow}
 		${toc}
 		${toolbar}
 
@@ -1493,34 +1600,43 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		${majorSection(`7. Licenses (${licenseTotal}${licenseFlagged ? `, ${licenseFlagged} to review` : ""})`, licenseContent, { open: licenseFlagged > 0, id: "ch7" })}
 		${majorSection(`8. Fix Recommendations`, renderFixRecommendations(recos, prodMatchesActive, outdatedResults), { open: false, id: "ch8" })}
 		${(prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length) ? majorSection(`9. Appendix: Likely false positives (CPE-filtered) (${prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length})`, fpContent, { open: false, id: "ch9" }) : ""}
+		${majorSection(`10. Appendix: Scanned dependency descriptors (${scanned.length})`, renderScannedManifests(scanned), { open: false, id: "chsrc" })}
 	`;
 	return wrapTables ? wrapTablesWithCopyButtons(body) : body;
 }
 
+// Descending composite-priority comparator: KEV first, then the blended
+// CVSS+EPSS score, tie-broken on having an actionable fix, then CVE id.
+function byCvePriority(a, b) {
+	const pa = a.cve?.priority || computePriority(a.cve || {});
+	const pb = b.cve?.priority || computePriority(b.cve || {});
+	const ka = pa.sortKey || [0, 0], kb = pb.sortKey || [0, 0];
+	if (kb[0] !== ka[0]) return kb[0] - ka[0];
+	if (kb[1] !== ka[1]) return kb[1] - ka[1];
+	const af = a.cve?.fixVersion ? 1 : 0, bf = b.cve?.fixVersion ? 1 : 0;
+	if (bf !== af) return bf - af;
+	return String(a.cve?.id || "").localeCompare(String(b.cve?.id || ""));
+}
+
+function coordKeyOf(dep) {
+	return dep.coordKey || `${dep.ecosystem === "npm" ? "npm:" : (dep.groupId || "") + ":"}${dep.artifactId}`;
+}
+
 /**
- * Pick the most impactful matches to preview in the exec summary.
- * Sort by severity rank, prefer entries with a fix-version (more actionable),
- * dedupe per dep coord so the preview shows diversity instead of 5 rows of
- * the same tomcat CVE.
+ * Pick the N most critical matches for the exec summary, scoped to NON-DEV
+ * dependencies and biased to DIRECT (declared) deps: direct findings fill the
+ * slots first (ranked by composite priority); only if fewer than N direct
+ * findings exist do we top up with the worst TRANSITIVE ones (flagged as such
+ * downstream). Deduped per dep coord so the list shows distinct libraries.
  */
-function pickTopCriticalMatches(prodMatches, retireMatches, n) {
-	const rank = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
-	const all = [...prodMatches, ...retireMatches]
-		.filter(m => (rank[(m.cve?.severity || "").toUpperCase()] || 0) >= 3); // HIGH+
-	all.sort((a, b) => {
-		const sa = rank[(a.cve.severity || "").toUpperCase()] || 0;
-		const sb = rank[(b.cve.severity || "").toUpperCase()] || 0;
-		if (sb !== sa) return sb - sa;
-		// Prefer those with a known fixVersion (actionable)
-		const af = a.cve.fixVersion ? 1 : 0, bf = b.cve.fixVersion ? 1 : 0;
-		if (bf !== af) return bf - af;
-		return (a.cve.id || "").localeCompare(b.cve.id || "");
-	});
+function pickTopCriticalMatches(prodMatches, n) {
+	const isTransitive = m => m.dep?.scope === "transitive";
+	const direct = (prodMatches || []).filter(m => !isTransitive(m)).slice().sort(byCvePriority);
+	const transitive = (prodMatches || []).filter(isTransitive).slice().sort(byCvePriority);
 	const seen = new Set();
 	const out = [];
-	for (const m of all) {
-		const dep = m.dep;
-		const k = dep.coordKey || `${dep.ecosystem === "npm" ? "npm:" : dep.groupId + ":"}${dep.artifactId}`;
+	for (const m of [...direct, ...transitive]) {       // direct-first, transitive fallback
+		const k = coordKeyOf(m.dep);
 		if (seen.has(k)) continue;
 		seen.add(k);
 		out.push(m);
@@ -1529,7 +1645,26 @@ function pickTopCriticalMatches(prodMatches, retireMatches, n) {
 	return out;
 }
 
-function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vendoredJsTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
+/**
+ * The 2 (or N) most significant end-of-life findings for the exec summary:
+ * direct frameworks first, then the most overdue (oldest EOL date). Findings
+ * with no concrete EOL date (eol === "true") sort after dated ones.
+ */
+function pickTopEol(eolResults, n) {
+	const dateMs = e => {
+		if (!e || !e.eol || e.eol === "true") return Number.POSITIVE_INFINITY;
+		const t = Date.parse(e.eol);
+		return Number.isNaN(t) ? Number.POSITIVE_INFINITY : t;
+	};
+	const directRank = e => (e?.dep?.scope === "transitive" ? 1 : 0);
+	return (eolResults || []).slice().sort((a, b) => {
+		const da = directRank(a), db = directRank(b);
+		if (da !== db) return da - db;
+		return dateMs(a) - dateMs(b);
+	}).slice(0, n);
+}
+
+function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vendoredJsTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal, scannedTotal }) {
 	const entries = [];
 	if (hasWarnings)                  entries.push({ id: "ch0", label: "0. Warnings" });
 	entries.push({ id: "ch1", label: `1. Prod CVE (${prodTotal})` });
@@ -1544,6 +1679,7 @@ function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vend
 	entries.push({ id: "ch7", label: `7. Licenses (${licenseTotal || 0}${licenseFlagged ? `, ${licenseFlagged}⚠` : ""})` });
 	entries.push({ id: "ch8", label: `8. Fix Recos` });
 	if (fpTotal)                      entries.push({ id: "ch9", label: `9. Likely FP (${fpTotal})` });
+	entries.push({ id: "chsrc", label: `10. Scanned descriptors (${scannedTotal || 0})` });
 	return `<nav class="toc">${entries.map(e => `<a href="#${e.id}">${esc(e.label)}</a>`).join("")}</nav>`;
 }
 
@@ -1774,9 +1910,11 @@ const COPY_SCRIPT = `
 		return writeClipboard(clone.outerHTML, tableToTsv(table), btn);
 	}
 	document.querySelectorAll('.btn-copy').forEach(function(btn){
-		// The executive-summary button is wired separately (it copies a prose
-		// summary, not a table).
+		// The executive-summary button and the chart buttons are wired separately
+		// (prose summary / SVG→PNG). Skipping them here also avoids the table
+		// handler's stopPropagation() swallowing the chart click.
 		if (btn.classList.contains('exec-copy-btn')) return;
+		if (btn.classList.contains('chart-copy')) return;
 		btn.addEventListener('click', function(e){
 			e.stopPropagation();
 			var wrap = btn.closest('.table-wrap');
@@ -1849,10 +1987,86 @@ const TOGGLE_SCRIPT = `
 })();
 </script>`;
 
+// Chart copy: rasterise the clicked card's <svg> to PNG (SVG → Image → canvas →
+// toBlob) and put image/png on the clipboard so it pastes into Word as a picture.
+// A white background is painted first (Word has no page background) and the canvas
+// is scaled ×3 for a crisp paste. Falls back to copying the SVG markup as rich
+// HTML when the browser lacks image-clipboard support.
+const CHART_COPY_SCRIPT = `
+<script>
+(function(){
+	function flash(btn, ok){
+		if(!btn) return;
+		var t = btn.textContent;
+		btn.classList.add(ok ? 'flashing-ok' : 'flashing-err');
+		btn.textContent = ok ? '✓' : '✕';
+		setTimeout(function(){ btn.classList.remove('flashing-ok','flashing-err'); btn.textContent = t; }, 1100);
+	}
+	function fallbackHtml(svg, btn){
+		try {
+			var xml = new XMLSerializer().serializeToString(svg);
+			var item = new ClipboardItem({'text/html': new Blob([xml], {type:'text/html'})});
+			navigator.clipboard.write([item]).then(function(){ flash(btn,true); }).catch(function(){ flash(btn,false); });
+		} catch(e){ flash(btn,false); }
+	}
+	function roundRectPath(ctx, x, y, w, h, r){
+		if (ctx.roundRect){ ctx.beginPath(); ctx.roundRect(x, y, w, h, r); return; }
+		ctx.beginPath();
+		ctx.moveTo(x+r, y);
+		ctx.arcTo(x+w, y, x+w, y+h, r);
+		ctx.arcTo(x+w, y+h, x, y+h, r);
+		ctx.arcTo(x, y+h, x, y, r);
+		ctx.arcTo(x, y, x+w, y, r);
+		ctx.closePath();
+	}
+	function svgToPng(svg, ok, err){
+		try {
+			var xml = new XMLSerializer().serializeToString(svg);
+			var vb = svg.viewBox && svg.viewBox.baseVal;
+			var w = (vb && vb.width) || svg.clientWidth || 250;
+			var h = (vb && vb.height) || svg.clientHeight || 150;
+			var img = new Image();
+			img.onload = function(){
+				// Draw the chart inside a rounded white card with an outer margin,
+				// inner padding and a light border — so the pasted PNG matches the
+				// on-screen card instead of being a flush, square-cornered image.
+				var scale = 3, M = 8, P = 12, RAD = 8;
+				var cw = w + 2*P + 2*M, ch = h + 2*P + 2*M;
+				var c = document.createElement('canvas');
+				c.width = Math.round(cw*scale); c.height = Math.round(ch*scale);
+				var ctx = c.getContext('2d');
+				ctx.setTransform(scale,0,0,scale,0,0);          // transparent margin (corners show through)
+				roundRectPath(ctx, M, M, w + 2*P, h + 2*P, RAD);
+				ctx.fillStyle = '#ffffff'; ctx.fill();
+				ctx.lineWidth = 1; ctx.strokeStyle = '#e5e7eb'; ctx.stroke();
+				ctx.drawImage(img, M+P, M+P, w, h);
+				c.toBlob(function(blob){ blob ? ok(blob) : err(); }, 'image/png');
+			};
+			img.onerror = err;
+			img.src = 'data:image/svg+xml;charset=utf-8,' + encodeURIComponent(xml);
+		} catch(e){ err(); }
+	}
+	document.addEventListener('click', function(ev){
+		var btn = ev.target.closest && ev.target.closest('.chart-copy');
+		if(!btn) return;
+		var card = btn.closest('.chart-card');
+		var svg = card && card.querySelector('svg.chart-svg');
+		if(!svg) return;
+		svgToPng(svg, function(blob){
+			if(navigator.clipboard && window.ClipboardItem){
+				navigator.clipboard.write([new ClipboardItem({'image/png': blob})])
+					.then(function(){ flash(btn,true); })
+					.catch(function(){ fallbackHtml(svg, btn); });
+			} else { fallbackHtml(svg, btn); }
+		}, function(){ fallbackHtml(svg, btn); });
+	});
+})();
+</script>`;
+
 function generateHtmlReport(payload) {
 	return `<!doctype html>
 <html><head><meta charset="utf-8"><title>FAD-Checker Report</title><style>${CSS}</style></head>
-<body>${buildBody(payload)}${TOGGLE_SCRIPT}${COPY_SCRIPT}</body></html>`;
+<body>${buildBody(payload)}${TOGGLE_SCRIPT}${COPY_SCRIPT}${CHART_COPY_SCRIPT}</body></html>`;
 }
 
 // Word-specific CSS tweaks layered on top of the shared CSS:
@@ -2006,12 +2220,12 @@ ${WORD_SECTION_PR}
 // Render the HTML and/or Word report. Callers pass explicit target paths;
 // a null/omitted path skips that format (so `--report-html` alone writes only HTML).
 // Back-compat: `outputDir` still writes both under the default file names.
-async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
+async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings, parsedManifests }) {
 	if (outputDir) {
 		if (htmlPath === undefined) htmlPath = path.join(outputDir, "cve-report.html");
 		if (docPath === undefined) docPath = path.join(outputDir, "cve-report.doc");
 	}
-	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
+	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, parsedManifests };
 	const written = { htmlPath: null, docPath: null };
 	if (htmlPath) {
 		await fs.promises.mkdir(path.dirname(path.resolve(htmlPath)), { recursive: true });

package/lib/deps-descriptor.js

@@ -1,6 +1,6 @@
 /**
  * lib/deps-descriptor.js — serialize / deserialize an *anonymized* descriptor of
- * the resolved dependency set, for PASSI-style offline→online→offline audits.
+ * the resolved dependency set, for air-gapped offline→online→offline audits.
  *
  * Phase 1 (offline): collect deps → serializeDeps → write JSON. No paths, URLs,
  *   hostnames or usernames leave the air-gapped machine — only public package
@@ -10,7 +10,7 @@
  * Phase 3 (offline): `--import-cache` + a normal `--offline` scan re-collects the
  *   source locally (real paths) and gets cache hits → full detailed report.
  *
- * See docs/superpowers/specs/2026-05-30-anonymized-deps-descriptor-passi-design.md
+ * See the anonymized-deps-descriptor design spec.
  *
  * Pure functions: no I/O, no console. The caller does file read/write.
  *

package/lib/osv-db.js

@@ -9,7 +9,7 @@
  * and matches EVERY dep against it offline, deterministically, regardless of the per-dep
  * cache. That is exactly the model OSV-Scanner uses for air-gapped scans
  * (`--download-offline-databases`), and it makes fad's offline Maven recall complete and
- * cache-independent for a PASSI engagement.
+ * cache-independent for an air-gapped engagement.
  *
  * Maven only for now: range matching needs the ecosystem's version ordering, and fad has
  * a robust Maven comparator (lib/maven-version). npm/PyPI/etc. are a documented follow-up