dep-brain 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -2,10 +2,14 @@
 
 All notable changes to this project will be documented in this file.
 
-## Unreleased
+## 0.9.0
 
 - Workspace-aware analysis for npm workspaces.
 - Config loading and CI policy controls.
 - Improved duplicate detection and unused dependency heuristics.
 - Actionable recommendations for unused, duplicate, outdated, and risk findings.
 - Ranked top-issues summary output with `--top`.
+- Supply-chain trust scoring for risk findings.
+- Structured risk factors in JSON output.
+- Monorepo ownership summaries for workspace packages.
+- Workspace-level duplicate attribution and root-cause tracing.

package/README.md

@@ -21,6 +21,7 @@
 - Detect likely unused dependencies from source imports and scripts
 - Detect outdated packages
 - Highlight dependency risk signals
+- Score package trust using supply-chain metadata
 - Generate a simple project health score
 - Output reports in human-readable or JSON format
 
@@ -74,6 +75,12 @@ dep-brain --version
 
 If the root `package.json` defines `workspaces`, `dep-brain` analyzes each workspace package and reports per-package results. Aggregated counts are still shown at the top-level summary.
 
+Workspace analysis now includes:
+
+- per-workspace ownership summaries
+- root-level duplicate attribution back to contributing workspaces
+- top issues that stay tagged to the workspace that should act
+
 ## Example Output
 
 ```text
@@ -257,6 +264,8 @@ src/
 
 The project should optimize for trust, clarity, and actionability over flashy UI, generic graphs, or simply adding more checks.
 
+Risk findings now include a `trustScore` plus structured `riskFactors` such as publish recency, maintainer count, and repository presence.
+
 ## Repository Notes
 
 - Project brief: [docs/project-brief.md](./docs/project-brief.md)

package/depbrain.output.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "title": "Dependency Brain Analysis Output",
   "type": "object",
-  "required": ["outputVersion", "rootDir", "score", "scoreBreakdown", "policy", "duplicates", "unused", "outdated", "risks", "suggestions", "topIssues", "config"],
+  "required": ["outputVersion", "rootDir", "score", "scoreBreakdown", "policy", "ownershipSummary", "duplicates", "unused", "outdated", "risks", "suggestions", "topIssues", "config"],
   "additionalProperties": false,
   "properties": {
     "recommendation": {
@@ -17,6 +17,31 @@
         "reasons": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "riskFactors": {
+      "type": "object",
+      "required": ["daysSincePublish", "downloads", "maintainersCount", "versionCount", "recentReleaseCount", "hasRepository", "dependencyType"],
+      "additionalProperties": false,
+      "properties": {
+        "daysSincePublish": { "type": ["number", "null"] },
+        "downloads": { "type": ["number", "null"] },
+        "maintainersCount": { "type": ["number", "null"] },
+        "versionCount": { "type": ["number", "null"] },
+        "recentReleaseCount": { "type": ["number", "null"] },
+        "hasRepository": { "type": "boolean" },
+        "dependencyType": { "type": "string", "enum": ["dependencies", "devDependencies", "unknown"] }
+      }
+    },
+    "ownershipSummary": {
+      "type": "object",
+      "required": ["duplicates", "unused", "outdated", "risks"],
+      "additionalProperties": false,
+      "properties": {
+        "duplicates": { "type": "number" },
+        "unused": { "type": "number" },
+        "outdated": { "type": "number" },
+        "risks": { "type": "number" }
+      }
+    },
     "outputVersion": { "type": "string" },
     "rootDir": { "type": "string" },
     "score": { "type": "number" },
@@ -52,15 +77,30 @@
         "reasons": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "ownershipSummary": { "$ref": "#/properties/ownershipSummary" },
     "duplicates": {
       "type": "array",
       "items": {
         "type": "object",
-        "required": ["name", "versions", "instances", "confidence", "reasonCodes", "explanation", "recommendation"],
+        "required": ["name", "versions", "instances", "workspaceUsage", "rootCause", "confidence", "reasonCodes", "explanation", "recommendation"],
         "additionalProperties": false,
         "properties": {
           "name": { "type": "string" },
           "versions": { "type": "array", "items": { "type": "string" } },
+          "workspaceUsage": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["workspace", "section", "declaredVersion"],
+              "additionalProperties": false,
+              "properties": {
+                "workspace": { "type": "string" },
+                "section": { "type": "string", "enum": ["dependencies", "devDependencies"] },
+                "declaredVersion": { "type": "string" }
+              }
+            }
+          },
+          "rootCause": { "type": "array", "items": { "type": "string" } },
           "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
           "reasonCodes": { "type": "array", "items": { "type": "string" } },
           "explanation": { "type": "array", "items": { "type": "string" } },
@@ -120,7 +160,7 @@
       "type": "array",
       "items": {
         "type": "object",
-        "required": ["name", "reasons", "confidence", "reasonCodes", "explanation", "recommendation"],
+        "required": ["name", "reasons", "confidence", "reasonCodes", "explanation", "trustScore", "riskFactors", "recommendation"],
         "additionalProperties": false,
         "properties": {
           "name": { "type": "string" },
@@ -129,6 +169,8 @@
           "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
           "reasonCodes": { "type": "array", "items": { "type": "string" } },
           "explanation": { "type": "array", "items": { "type": "string" } },
+          "trustScore": { "type": "string", "enum": ["high", "medium", "low"] },
+          "riskFactors": { "$ref": "#/properties/riskFactors" },
           "recommendation": { "$ref": "#/properties/recommendation" }
         }
       }
@@ -147,6 +189,7 @@
           "priority": { "type": "string", "enum": ["high", "medium", "low"] },
           "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
           "summary": { "type": "string" },
+          "trustScore": { "type": "string", "enum": ["high", "medium", "low"] },
           "recommendation": { "$ref": "#/properties/recommendation" }
         }
       }

package/dist/checks/duplicate.js

@@ -4,6 +4,8 @@ export async function findDuplicateDependencies(graph) {
         name,
         versions: Array.from(new Set(instances.map((instance) => instance.version))).sort(),
         instances,
+        workspaceUsage: [],
+        rootCause: [],
         confidence: 0.98,
         reasonCodes: [
             "multiple_lockfile_versions",

package/dist/checks/risk.d.ts

@@ -1,5 +1,9 @@
 import type { DependencyGraph } from "../core/graph-builder.js";
 import type { RiskDependency } from "../core/analyzer.js";
 import type { CheckResult } from "../core/types.js";
-export declare function findRiskDependencies(graph: DependencyGraph): Promise<RiskDependency[]>;
+import { type PackageMetadata } from "../utils/npm-api.js";
+export interface RiskCheckOptions {
+    resolvePackageMetadata?: (name: string) => Promise<PackageMetadata | null>;
+}
+export declare function findRiskDependencies(graph: DependencyGraph, options?: RiskCheckOptions): Promise<RiskDependency[]>;
 export declare function runRiskCheck(graph: DependencyGraph): Promise<CheckResult>;

package/dist/checks/risk.js

@@ -1,50 +1,41 @@
 import { getPackageMetadata } from "../utils/npm-api.js";
 const TWO_YEARS_IN_DAYS = 365 * 2;
-export async function findRiskDependencies(graph) {
+const ONE_YEAR_IN_DAYS = 365;
+export async function findRiskDependencies(graph, options = {}) {
+    const resolvePackageMetadata = options.resolvePackageMetadata ?? getPackageMetadata;
     const names = Object.keys({
         ...graph.dependencies,
         ...graph.devDependencies
     });
     const results = await Promise.all(names.map(async (name) => {
-        const metadata = await getPackageMetadata(name);
-        const reasons = [];
+        const metadata = await resolvePackageMetadata(name);
         if (!metadata) {
             return null;
         }
-        if (metadata.daysSincePublish !== null && metadata.daysSincePublish > TWO_YEARS_IN_DAYS) {
-            reasons.push("No release in over 2 years");
-        }
-        if (metadata.downloads !== null && metadata.downloads < 1000) {
-            reasons.push("Low weekly download volume");
-        }
-        if (!metadata.repository) {
-            reasons.push("Missing repository metadata");
-        }
-        if (reasons.length === 0) {
+        const dependencyType = graph.dependencies[name]
+            ? "dependencies"
+            : graph.devDependencies[name]
+                ? "devDependencies"
+                : "unknown";
+        const assessment = assessRisk(metadata, dependencyType);
+        if (assessment.reasons.length === 0) {
             return null;
         }
         return {
             name,
-            reasons,
-            confidence: calculateRiskConfidence(reasons),
-            reasonCodes: reasons.map(toRiskReasonCode),
-            explanation: reasons,
-            recommendation: buildRiskRecommendation(reasons, calculateRiskConfidence(reasons))
+            reasons: assessment.reasons,
+            confidence: assessment.confidence,
+            reasonCodes: assessment.reasonCodes,
+            explanation: assessment.reasons,
+            trustScore: assessment.trustScore,
+            riskFactors: assessment.riskFactors,
+            recommendation: buildRiskRecommendation(assessment.reasons, assessment.confidence, assessment.trustScore)
         };
     }));
     return results
         .filter((item) => item !== null)
         .sort((left, right) => left.name.localeCompare(right.name));
 }
-function buildRiskRecommendation(reasons, confidence) {
-    return {
-        action: "review",
-        priority: confidence >= 0.79 ? "high" : "medium",
-        safety: "caution",
-        summary: "Review package trust signals and decide whether to keep, replace, or monitor it.",
-        reasons
-    };
-}
 export async function runRiskCheck(graph) {
     const risks = await findRiskDependencies(graph);
     return {
@@ -53,24 +44,89 @@ export async function runRiskCheck(graph) {
         issues: risks.map((item) => ({
             id: `risk:${item.name}`,
             message: `${item.name}: ${item.reasons.join("; ")}`,
-            severity: "warning",
+            severity: item.trustScore === "low"
+                ? "critical"
+                : item.trustScore === "medium"
+                    ? "warning"
+                    : "info",
             confidence: item.confidence,
             reasonCodes: item.reasonCodes,
             explanation: item.explanation,
             meta: {
                 name: item.name,
-                reasons: item.reasons
+                reasons: item.reasons,
+                trustScore: item.trustScore,
+                riskFactors: item.riskFactors
             }
         }))
     };
 }
-function calculateRiskConfidence(reasons) {
-    return Math.min(0.99, 0.55 + reasons.length * 0.12);
+function assessRisk(metadata, dependencyType) {
+    const reasons = [];
+    const reasonCodes = [];
+    let weight = 0;
+    if (metadata.daysSincePublish !== null && metadata.daysSincePublish > TWO_YEARS_IN_DAYS) {
+        reasons.push("No release in over 2 years");
+        reasonCodes.push("stale_release");
+        weight += 3;
+    }
+    else if (metadata.daysSincePublish !== null &&
+        metadata.daysSincePublish > ONE_YEAR_IN_DAYS) {
+        reasons.push("No release in over 12 months");
+        reasonCodes.push("aging_release");
+        weight += 2;
+    }
+    if (metadata.downloads !== null && metadata.downloads < 1000) {
+        reasons.push("Low weekly download volume");
+        reasonCodes.push("low_download_volume");
+        weight += 2;
+    }
+    if (!metadata.repository) {
+        reasons.push("Missing repository metadata");
+        reasonCodes.push("missing_repository_metadata");
+        weight += 2;
+    }
+    if (metadata.maintainersCount !== null && metadata.maintainersCount <= 1) {
+        reasons.push("Single maintainer package");
+        reasonCodes.push("single_maintainer");
+        weight += 2;
+    }
+    if (metadata.recentReleaseCount !== null && metadata.recentReleaseCount === 0) {
+        reasons.push("No releases published in the last 30 days");
+        reasonCodes.push("no_recent_release");
+        weight += 1;
+    }
+    if (metadata.versionCount !== null && metadata.versionCount <= 3) {
+        reasons.push("Very limited published version history");
+        reasonCodes.push("limited_version_history");
+        weight += 1;
+    }
+    const confidence = reasons.length === 0 ? 0.5 : Math.min(0.99, 0.52 + weight * 0.07);
+    const trustScore = weight >= 6 ? "low" : weight >= 3 ? "medium" : "high";
+    return {
+        confidence,
+        trustScore,
+        reasons,
+        reasonCodes,
+        riskFactors: {
+            daysSincePublish: metadata.daysSincePublish,
+            downloads: metadata.downloads,
+            maintainersCount: metadata.maintainersCount,
+            versionCount: metadata.versionCount,
+            recentReleaseCount: metadata.recentReleaseCount,
+            hasRepository: Boolean(metadata.repository),
+            dependencyType
+        }
+    };
 }
-function toRiskReasonCode(reason) {
-    const normalized = reason
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, "_")
-        .replace(/^_+|_+$/g, "");
-    return normalized || "risk_signal_detected";
+function buildRiskRecommendation(reasons, confidence, trustScore) {
+    return {
+        action: "review",
+        priority: trustScore === "low" || confidence >= 0.8 ? "high" : "medium",
+        safety: "caution",
+        summary: trustScore === "low"
+            ? "Low trust package; review whether to replace, pin, or monitor it closely."
+            : "Review package trust signals and decide whether to keep, replace, or monitor it.",
+        reasons
+    };
 }

package/dist/core/analyzer.d.ts

@@ -8,6 +8,17 @@ export interface DuplicateInstance {
     path: string;
     version: string;
 }
+export interface WorkspaceDependencyUsage {
+    workspace: string;
+    section: "dependencies" | "devDependencies";
+    declaredVersion: string;
+}
+export interface WorkspaceOwnershipSummary {
+    duplicates: number;
+    unused: number;
+    outdated: number;
+    risks: number;
+}
 export interface Recommendation {
     action: "remove" | "consolidate" | "upgrade" | "review";
     priority: "high" | "medium" | "low";
@@ -15,10 +26,22 @@ export interface Recommendation {
     summary: string;
     reasons: string[];
 }
+export interface RiskFactors {
+    daysSincePublish: number | null;
+    downloads: number | null;
+    maintainersCount: number | null;
+    versionCount: number | null;
+    recentReleaseCount: number | null;
+    hasRepository: boolean;
+    dependencyType: "dependencies" | "devDependencies" | "unknown";
+}
+export type TrustScore = "high" | "medium" | "low";
 export interface DuplicateDependency {
     name: string;
     versions: string[];
     instances: DuplicateInstance[];
+    workspaceUsage: WorkspaceDependencyUsage[];
+    rootCause: string[];
     confidence: number;
     reasonCodes: string[];
     explanation: string[];
@@ -51,6 +74,8 @@ export interface RiskDependency {
     confidence: number;
     reasonCodes: string[];
     explanation: string[];
+    trustScore: TrustScore;
+    riskFactors: RiskFactors;
     recommendation: Recommendation;
 }
 export interface TopIssue {
@@ -60,6 +85,7 @@ export interface TopIssue {
     priority: "high" | "medium" | "low";
     confidence: number;
     summary: string;
+    trustScore?: TrustScore;
     recommendation: Recommendation;
 }
 export interface AnalysisResult {
@@ -68,6 +94,7 @@ export interface AnalysisResult {
     score: number;
     scoreBreakdown: ScoreBreakdown;
     policy: PolicyResult;
+    ownershipSummary: WorkspaceOwnershipSummary;
     duplicates: DuplicateDependency[];
     unused: UnusedDependency[];
     outdated: OutdatedDependency[];
@@ -87,6 +114,7 @@ export interface PackageAnalysisResult {
     score: number;
     scoreBreakdown: ScoreBreakdown;
     policy: PolicyResult;
+    ownershipSummary: WorkspaceOwnershipSummary;
     duplicates: DuplicateDependency[];
     unused: UnusedDependency[];
     outdated: OutdatedDependency[];
@@ -94,7 +122,7 @@ export interface PackageAnalysisResult {
     suggestions: string[];
     topIssues: TopIssue[];
 }
-export declare const OUTPUT_VERSION = "1.2";
+export declare const OUTPUT_VERSION = "1.4";
 export interface ScoreBreakdown {
     baseScore: number;
     duplicates: number;

package/dist/core/analyzer.js

@@ -8,7 +8,7 @@ import { findWorkspacePackages } from "../utils/workspaces.js";
 import { buildDependencyGraph } from "./graph-builder.js";
 import { calculateHealthScore } from "./scorer.js";
 import { buildAnalysisContext } from "./context.js";
-export const OUTPUT_VERSION = "1.2";
+export const OUTPUT_VERSION = "1.4";
 export async function analyzeProject(options = {}) {
     const rootDir = path.resolve(options.rootDir ?? process.cwd());
     const loadedConfig = await loadDepBrainConfig(rootDir, options.configPath);
@@ -28,6 +28,11 @@ export async function analyzeProject(options = {}) {
         });
         packages.push({ ...result, name: workspace.name });
     }
+    const workspaceGraphs = await Promise.all(workspaces.map(async (workspace) => ({
+        name: workspace.name,
+        graph: await buildDependencyGraph(workspace.rootDir)
+    })));
+    const attributedDuplicates = addWorkspaceAttribution(duplicates, workspaceGraphs);
     const unused = packages.flatMap((pkg) => pkg.unused.map((item) => ({ ...item, package: pkg.name })));
     const outdated = packages.flatMap((pkg) => pkg.outdated.map((item) => ({ ...item, package: pkg.name })));
     const risks = packages.flatMap((pkg) => pkg.risks.map((item) => ({ ...item, package: pkg.name })));
@@ -52,7 +57,7 @@ export async function analyzeProject(options = {}) {
     ].slice(0, config.report.maxSuggestions);
     const policy = evaluatePolicy({
         score,
-        duplicates: duplicates.length,
+        duplicates: attributedDuplicates.length,
         unused: unused.length,
         outdated: outdated.length,
         risks: risks.length
@@ -63,12 +68,23 @@ export async function analyzeProject(options = {}) {
         score,
         scoreBreakdown,
         policy,
-        duplicates,
+        ownershipSummary: buildOwnershipSummary({
+            duplicates: attributedDuplicates,
+            unused,
+            outdated,
+            risks
+        }),
+        duplicates: attributedDuplicates,
         unused,
         outdated,
         risks,
         suggestions,
-        topIssues: buildTopIssues({ duplicates, unused, outdated, risks }),
+        topIssues: buildTopIssues({
+            duplicates: attributedDuplicates,
+            unused,
+            outdated,
+            risks
+        }),
         config,
         packages
     };
@@ -182,6 +198,12 @@ async function analyzeSingleProject(rootDir, config, options = {}) {
         score,
         scoreBreakdown,
         policy,
+        ownershipSummary: buildOwnershipSummary({
+            duplicates,
+            unused: scopedUnused,
+            outdated: scopedOutdated,
+            risks: scopedRisks
+        }),
         duplicates,
         unused: scopedUnused,
         outdated: scopedOutdated,
@@ -272,6 +294,8 @@ function mapDuplicateIssues(issues) {
         instances: Array.isArray(issue.meta?.instances)
             ? issue.meta?.instances
             : [],
+        workspaceUsage: normalizeWorkspaceUsage(issue.meta?.workspaceUsage),
+        rootCause: normalizeStringArray(issue.meta?.rootCause),
         confidence: normalizeConfidence(issue.confidence),
         reasonCodes: normalizeStringArray(issue.reasonCodes),
         explanation: normalizeStringArray(issue.explanation),
@@ -309,6 +333,8 @@ function mapRiskIssues(issues) {
         confidence: normalizeConfidence(issue.confidence),
         reasonCodes: normalizeStringArray(issue.reasonCodes),
         explanation: normalizeStringArray(issue.explanation),
+        trustScore: normalizeTrustScore(issue.meta?.trustScore),
+        riskFactors: normalizeRiskFactors(issue.meta?.riskFactors),
         recommendation: buildRiskRecommendation(issue)
     }));
 }
@@ -371,11 +397,14 @@ function buildOutdatedRecommendation(issue) {
 function buildRiskRecommendation(issue) {
     const reasons = normalizeStringArray(issue.explanation);
     const confidence = normalizeConfidence(issue.confidence);
+    const trustScore = normalizeTrustScore(issue.meta?.trustScore);
     return {
         action: "review",
-        priority: confidence >= 0.79 ? "high" : "medium",
+        priority: trustScore === "low" || confidence >= 0.79 ? "high" : "medium",
         safety: "caution",
-        summary: "Review package trust signals and decide whether to keep, replace, or monitor it.",
+        summary: trustScore === "low"
+            ? "Low trust package; review whether to replace, pin, or monitor it closely."
+            : "Review package trust signals and decide whether to keep, replace, or monitor it.",
         reasons
     };
 }
@@ -414,17 +443,60 @@ function buildTopIssues(input) {
             priority: item.recommendation.priority,
             confidence: item.confidence,
             summary: item.recommendation.summary,
+            trustScore: item.trustScore,
             recommendation: item.recommendation
         }))
     ];
     return issues
-        .sort((left, right) => comparePriority(right.priority, left.priority) || right.confidence - left.confidence)
+        .sort((left, right) => comparePriority(right.priority, left.priority) ||
+        compareTrustScore(right.trustScore, left.trustScore) ||
+        right.confidence - left.confidence)
         .slice(0, 5);
 }
 function comparePriority(left, right) {
     const rank = { high: 3, medium: 2, low: 1 };
     return rank[left] - rank[right];
 }
+function compareTrustScore(left, right) {
+    const rank = { low: 3, medium: 2, high: 1, undefined: 0 };
+    return rank[left ?? "undefined"] - rank[right ?? "undefined"];
+}
+function addWorkspaceAttribution(duplicates, workspaceGraphs) {
+    return duplicates.map((item) => {
+        const usage = [];
+        for (const workspace of workspaceGraphs) {
+            const runtimeVersion = workspace.graph.dependencies[item.name];
+            if (runtimeVersion) {
+                usage.push({
+                    workspace: workspace.name,
+                    section: "dependencies",
+                    declaredVersion: runtimeVersion
+                });
+            }
+            const devVersion = workspace.graph.devDependencies[item.name];
+            if (devVersion) {
+                usage.push({
+                    workspace: workspace.name,
+                    section: "devDependencies",
+                    declaredVersion: devVersion
+                });
+            }
+        }
+        return {
+            ...item,
+            workspaceUsage: usage,
+            rootCause: usage.map((entry) => `${entry.workspace} -> ${item.name}@${entry.declaredVersion}`)
+        };
+    });
+}
+function buildOwnershipSummary(input) {
+    return {
+        duplicates: input.duplicates.length,
+        unused: input.unused.length,
+        outdated: input.outdated.length,
+        risks: input.risks.length
+    };
+}
 function normalizeConfidence(value) {
     if (typeof value !== "number" || Number.isNaN(value)) {
         return 0.5;
@@ -437,6 +509,59 @@ function normalizeStringArray(value) {
     }
     return value.filter((entry) => typeof entry === "string");
 }
+function normalizeTrustScore(value) {
+    return value === "high" || value === "medium" || value === "low"
+        ? value
+        : "medium";
+}
+function normalizeRiskFactors(value) {
+    if (!value || typeof value !== "object") {
+        return {
+            daysSincePublish: null,
+            downloads: null,
+            maintainersCount: null,
+            versionCount: null,
+            recentReleaseCount: null,
+            hasRepository: false,
+            dependencyType: "unknown"
+        };
+    }
+    const factors = value;
+    return {
+        daysSincePublish: typeof factors.daysSincePublish === "number" ? factors.daysSincePublish : null,
+        downloads: typeof factors.downloads === "number" ? factors.downloads : null,
+        maintainersCount: typeof factors.maintainersCount === "number" ? factors.maintainersCount : null,
+        versionCount: typeof factors.versionCount === "number" ? factors.versionCount : null,
+        recentReleaseCount: typeof factors.recentReleaseCount === "number" ? factors.recentReleaseCount : null,
+        hasRepository: factors.hasRepository === true,
+        dependencyType: factors.dependencyType === "dependencies" || factors.dependencyType === "devDependencies"
+            ? factors.dependencyType
+            : "unknown"
+    };
+}
+function normalizeWorkspaceUsage(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value
+        .map((entry) => {
+        if (!entry || typeof entry !== "object") {
+            return null;
+        }
+        const usage = entry;
+        if (typeof usage.workspace !== "string" ||
+            typeof usage.declaredVersion !== "string" ||
+            (usage.section !== "dependencies" && usage.section !== "devDependencies")) {
+            return null;
+        }
+        return {
+            workspace: usage.workspace,
+            section: usage.section,
+            declaredVersion: usage.declaredVersion
+        };
+    })
+        .filter((entry) => entry !== null);
+}
 function buildScoreBreakdown(counts, config) {
     return {
         baseScore: 100,

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { analyzeProject } from "./core/analyzer.js";
-export type { AnalysisOptions, AnalysisResult, DuplicateDependency, OutdatedDependency, PolicyResult, PackageAnalysisResult, Recommendation, ScoreBreakdown, RiskDependency, TopIssue, UnusedDependency } from "./core/analyzer.js";
+export type { AnalysisOptions, AnalysisResult, DuplicateDependency, OutdatedDependency, PolicyResult, PackageAnalysisResult, Recommendation, RiskFactors, ScoreBreakdown, RiskDependency, TopIssue, TrustScore, UnusedDependency, WorkspaceDependencyUsage, WorkspaceOwnershipSummary } from "./core/analyzer.js";
 export { OUTPUT_VERSION } from "./core/analyzer.js";
 export type { AnalysisContext, CheckResult, Issue } from "./core/types.js";
 export type { DepBrainConfig, DepBrainConfigOverrides } from "./utils/config.js";

package/dist/reporters/console.js

@@ -3,7 +3,7 @@ export function renderConsoleReport(result) {
     if (result.topIssues.length > 0) {
         lines.push("Top Issues:");
         for (const item of result.topIssues) {
-            lines.push(`- [${item.priority.toUpperCase()}] ${item.kind} ${item.name}${item.package ? ` [${item.package}]` : ""} | confidence ${Math.round(item.confidence * 100)}% | ${item.summary}`);
+            lines.push(`- [${item.priority.toUpperCase()}] ${item.kind} ${item.name}${item.package ? ` [${item.package}]` : ""}${item.trustScore ? ` | trust ${item.trustScore.toUpperCase()}` : ""} | confidence ${Math.round(item.confidence * 100)}% | ${item.summary}`);
         }
         lines.push("");
     }
@@ -20,10 +20,10 @@ export function renderConsoleReport(result) {
         lines.push("");
         lines.push("Packages:");
         for (const pkg of result.packages) {
-            lines.push(`- ${pkg.name}: ${pkg.score}/100, D:${pkg.duplicates.length} U:${pkg.unused.length} O:${pkg.outdated.length} R:${pkg.risks.length}`);
+            lines.push(`- ${pkg.name}: ${pkg.score}/100, D:${pkg.ownershipSummary.duplicates} U:${pkg.ownershipSummary.unused} O:${pkg.ownershipSummary.outdated} R:${pkg.ownershipSummary.risks}`);
         }
     }
-    appendSection(lines, "Duplicate dependencies", result.duplicates.map((item) => formatEntry(`${item.name}: ${item.versions.join(", ")}`, item.confidence, item.explanation, item.recommendation)));
+    appendSection(lines, "Duplicate dependencies", result.duplicates.map((item) => formatEntry(`${item.name}: ${item.versions.join(", ")}${item.rootCause.length > 0 ? ` | via ${item.rootCause.join("; ")}` : ""}`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Unused dependencies", result.unused.map((item) => formatEntry(item.package
         ? `${item.name} (${item.section}) [${item.package}]`
         : `${item.name} (${item.section})`, item.confidence, item.explanation, item.recommendation)));
@@ -31,8 +31,8 @@ export function renderConsoleReport(result) {
         ? `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}] [${item.package}]`
         : `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}]`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Risky dependencies", result.risks.map((item) => formatEntry(item.package
-        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}]`
-        : `${item.name}: ${item.reasons.join("; ")}`, item.confidence, item.explanation, item.recommendation)));
+        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]`
+        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Policy reasons", result.policy.reasons);
     if (result.suggestions.length > 0) {
         lines.push("");

package/dist/reporters/markdown.js

@@ -5,7 +5,7 @@ export function renderMarkdownReport(result) {
     if (result.topIssues.length > 0) {
         lines.push("## Top Issues");
         for (const item of result.topIssues) {
-            lines.push(`- **${item.priority.toUpperCase()}** ${item.kind} \`${item.name}\`${item.package ? ` [${item.package}]` : ""} | confidence ${Math.round(item.confidence * 100)}% | ${item.summary}`);
+            lines.push(`- **${item.priority.toUpperCase()}** ${item.kind} \`${item.name}\`${item.package ? ` [${item.package}]` : ""}${item.trustScore ? ` | trust ${item.trustScore.toUpperCase()}` : ""} | confidence ${Math.round(item.confidence * 100)}% | ${item.summary}`);
         }
         lines.push("");
     }
@@ -17,7 +17,7 @@ export function renderMarkdownReport(result) {
     if (result.packages && result.packages.length > 0) {
         lines.push("## Packages");
         for (const pkg of result.packages) {
-            lines.push(`- ${pkg.name}: ${pkg.score}/100 (D:${pkg.duplicates.length} U:${pkg.unused.length} O:${pkg.outdated.length} R:${pkg.risks.length})`);
+            lines.push(`- ${pkg.name}: ${pkg.score}/100 (D:${pkg.ownershipSummary.duplicates} U:${pkg.ownershipSummary.unused} O:${pkg.ownershipSummary.outdated} R:${pkg.ownershipSummary.risks})`);
         }
         lines.push("");
     }
@@ -27,7 +27,7 @@ export function renderMarkdownReport(result) {
     lines.push(`- Outdated: ${result.outdated.length}`);
     lines.push(`- Risks: ${result.risks.length}`);
     lines.push("");
-    appendSection(lines, "Duplicate dependencies", result.duplicates.map((item) => formatEntry(`${item.name}: ${item.versions.join(", ")}`, item.confidence, item.explanation, item.recommendation)));
+    appendSection(lines, "Duplicate dependencies", result.duplicates.map((item) => formatEntry(`${item.name}: ${item.versions.join(", ")}${item.rootCause.length > 0 ? ` | via ${item.rootCause.join("; ")}` : ""}`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Unused dependencies", result.unused.map((item) => formatEntry(item.package
         ? `${item.name} (${item.section}) [${item.package}]`
         : `${item.name} (${item.section})`, item.confidence, item.explanation, item.recommendation)));
@@ -35,8 +35,8 @@ export function renderMarkdownReport(result) {
         ? `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}] [${item.package}]`
         : `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}]`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Risky dependencies", result.risks.map((item) => formatEntry(item.package
-        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}]`
-        : `${item.name}: ${item.reasons.join("; ")}`, item.confidence, item.explanation, item.recommendation)));
+        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]`
+        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Policy reasons", result.policy.reasons);
     if (result.suggestions.length > 0) {
         lines.push("## Suggestions");

package/dist/utils/npm-api.d.ts

@@ -3,6 +3,9 @@ export interface PackageMetadata {
     repository: string | null;
     downloads: number | null;
     daysSincePublish: number | null;
+    maintainersCount: number | null;
+    versionCount: number | null;
+    recentReleaseCount: number | null;
 }
 export declare function getLatestVersion(name: string): Promise<string | null>;
 export declare function getPackageMetadata(name: string): Promise<PackageMetadata | null>;

package/dist/utils/npm-api.js

@@ -39,14 +39,35 @@ async function fetchPackageMetadata(name) {
         const repository = typeof packageJson.repository === "string"
             ? packageJson.repository
             : packageJson.repository?.url ?? null;
+        const maintainersCount = Array.isArray(packageJson.maintainers)
+            ? packageJson.maintainers.length
+            : null;
+        const versionCount = packageJson.versions
+            ? Object.keys(packageJson.versions).length
+            : null;
+        const recentReleaseCount = countRecentReleases(packageJson.time ?? {});
         return {
             latestVersion,
             repository,
             downloads: downloadsJson.downloads ?? null,
-            daysSincePublish
+            daysSincePublish,
+            maintainersCount,
+            versionCount,
+            recentReleaseCount
         };
     }
     catch {
         return null;
     }
 }
+function countRecentReleases(time) {
+    const values = Object.entries(time)
+        .filter(([key]) => key !== "created" && key !== "modified")
+        .map(([, value]) => new Date(value).getTime())
+        .filter((value) => Number.isFinite(value));
+    if (values.length === 0) {
+        return null;
+    }
+    const thirtyDaysAgo = Date.now() - 30 * 24 * 60 * 60 * 1000;
+    return values.filter((value) => value >= thirtyDaysAgo).length;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dep-brain",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "CLI and library for dependency health analysis",
   "type": "module",
   "main": "dist/index.js",