dep-brain 1.0.2 → 1.2.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file.
 
+## 1.1.0
+
+- Added `--focus` modes for targeted duplicate, unused, outdated, risk, and health analysis.
+- Added `--ci` for low-noise CI defaults focused on duplicate and runtime risk enforcement.
+- Added `dep-brain init` to generate a starter `depbrain.config.json`.
+- Introduced capped health score deductions so large outdated/risk counts do not automatically collapse project health to `0/100`.
+- Added GitHub Action inputs for `focus` and `ci`.
+- Added regression coverage for focused analysis and capped scoring.
+
 ## 1.0.2
 
 - Treated npm `overrides` entries as intentional version pins so direct override packages are not flagged as unused.

package/README.md

@@ -50,6 +50,9 @@ The long-term goal is not just to list problems, but to answer:
 - SARIF output via `--sarif`
 - Ranked top issues via `--top`
 - Baseline mode via `--baseline`
+- Focused analysis via `--focus`
+- Low-noise CI defaults via `--ci`
+- Starter config generation via `dep-brain init`
 - Reusable GitHub Action via `action.yml`
 - Library entrypoint for programmatic use
 
@@ -70,10 +73,13 @@ npx dep-brain analyze ./path-to-project --fail-on-unused --json
 npx dep-brain analyze --md > depbrain.md
 npx dep-brain analyze --json --out depbrain.json
 npx dep-brain analyze --sarif --out depbrain.sarif
+npx dep-brain analyze --focus duplicates
+npx dep-brain analyze --ci
 npx dep-brain analyze --baseline depbrain-baseline.json
 npx dep-brain analyze --baseline depbrain-baseline.json --min-score 90 --fail-on-risks
 npx dep-brain report --from depbrain.json --md --out depbrain.md
 
+dep-brain init
 dep-brain config
 dep-brain config --config depbrain.config.json
 
@@ -82,6 +88,34 @@ dep-brain analyze --help
 dep-brain --version
 ```
 
+## Focus Modes
+
+Use `--focus` when you want a targeted signal instead of a full report:
+
+```bash
+dep-brain analyze --focus duplicates
+dep-brain analyze --focus health
+dep-brain analyze --focus risks
+```
+
+Supported values are `all`, `health`, `duplicates`, `unused`, `outdated`, and `risks`.
+
+## CI Preset
+
+```bash
+dep-brain analyze --ci
+```
+
+The CI preset applies low-noise defaults: a minimum score of `70`, failure on duplicates, and failure on risky dependencies.
+
+## Config Init
+
+```bash
+dep-brain init
+```
+
+Creates a starter `depbrain.config.json` with practical defaults for CI and common TypeScript/NestJS tooling.
+
 ## Workspaces
 
 If the root `package.json` defines `workspaces`, `dep-brain` analyzes each workspace package and reports per-package results. Aggregated counts are still shown at the top-level summary.
@@ -204,6 +238,21 @@ Create a `depbrain.config.json` file in the project root:
   "report": {
     "maxSuggestions": 3
   },
+  "plugins": {
+    "enabled": [],
+    "paths": []
+  },
+  "risk": {
+    "transitiveBloatThreshold": 50,
+    "typosquattingDistanceThreshold": 2
+  },
+  "dashboard": {
+    "outputPath": "depbrain-dashboard.html"
+  },
+  "notifications": {
+    "slackWebhookEnv": "DEPBRAIN_SLACK_WEBHOOK_URL",
+    "discordWebhookEnv": "DEPBRAIN_DISCORD_WEBHOOK_URL"
+  },
   "scoring": {
     "duplicateWeight": 5,
     "outdatedWeight": 1,
@@ -230,6 +279,13 @@ Supported sections:
 - `policy.failOnOutdated`
 - `policy.failOnRisks`
 - `report.maxSuggestions`
+- `plugins.enabled`
+- `plugins.paths`
+- `risk.transitiveBloatThreshold`
+- `risk.typosquattingDistanceThreshold`
+- `dashboard.outputPath`
+- `notifications.slackWebhookEnv`
+- `notifications.discordWebhookEnv`
 - `scoring.duplicateWeight`
 - `scoring.outdatedWeight`
 - `scoring.unusedWeight`

package/action.yml

@@ -23,6 +23,14 @@ inputs:
     description: Optional baseline JSON report used to ignore existing findings.
     required: false
     default: ""
+  focus:
+    description: Analysis focus. Use all, health, duplicates, unused, outdated, or risks.
+    required: false
+    default: "all"
+  ci:
+    description: Apply low-noise CI defaults.
+    required: false
+    default: "false"
   min-score:
     description: Minimum project health score required to pass.
     required: false
@@ -55,6 +63,8 @@ runs:
         INPUT_OUT: ${{ inputs.out }}
         INPUT_CONFIG: ${{ inputs.config }}
         INPUT_BASELINE: ${{ inputs.baseline }}
+        INPUT_FOCUS: ${{ inputs.focus }}
+        INPUT_CI: ${{ inputs.ci }}
         INPUT_MIN_SCORE: ${{ inputs.min-score }}
         INPUT_FAIL_ON_UNUSED: ${{ inputs.fail-on-unused }}
         INPUT_FAIL_ON_OUTDATED: ${{ inputs.fail-on-outdated }}
@@ -89,6 +99,14 @@ runs:
           args+=("--baseline" "$INPUT_BASELINE")
         fi
 
+        if [ "$INPUT_FOCUS" != "all" ]; then
+          args+=("--focus" "$INPUT_FOCUS")
+        fi
+
+        if [ "$INPUT_CI" = "true" ]; then
+          args+=("--ci")
+        fi
+
         if [ -n "$INPUT_MIN_SCORE" ]; then
           args+=("--min-score" "$INPUT_MIN_SCORE")
         fi

package/depbrain.config.json

@@ -19,6 +19,21 @@
   "report": {
     "maxSuggestions": 5
   },
+  "plugins": {
+    "enabled": [],
+    "paths": []
+  },
+  "risk": {
+    "transitiveBloatThreshold": 50,
+    "typosquattingDistanceThreshold": 2
+  },
+  "dashboard": {
+    "outputPath": "depbrain-dashboard.html"
+  },
+  "notifications": {
+    "slackWebhookEnv": "DEPBRAIN_SLACK_WEBHOOK_URL",
+    "discordWebhookEnv": "DEPBRAIN_DISCORD_WEBHOOK_URL"
+  },
   "scoring": {
     "duplicateWeight": 5,
     "outdatedWeight": 3,

package/depbrain.config.schema.json

@@ -36,6 +36,37 @@
         "maxSuggestions": { "type": "number" }
       }
     },
+    "plugins": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": { "type": "array", "items": { "type": "string" } },
+        "paths": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "risk": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "transitiveBloatThreshold": { "type": "number" },
+        "typosquattingDistanceThreshold": { "type": "number" }
+      }
+    },
+    "dashboard": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "outputPath": { "type": "string" }
+      }
+    },
+    "notifications": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "slackWebhookEnv": { "type": "string" },
+        "discordWebhookEnv": { "type": "string" }
+      }
+    },
     "scoring": {
       "type": "object",
       "additionalProperties": false,

package/depbrain.output.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "title": "Dependency Brain Analysis Output",
   "type": "object",
-  "required": ["outputVersion", "rootDir", "score", "scoreBreakdown", "policy", "ownershipSummary", "duplicates", "unused", "outdated", "risks", "suggestions", "topIssues", "config"],
+  "required": ["outputVersion", "rootDir", "score", "scoreBreakdown", "policy", "ownershipSummary", "duplicates", "unused", "outdated", "risks", "suggestions", "topIssues", "extensions", "config"],
   "additionalProperties": false,
   "properties": {
     "recommendation": {
@@ -175,6 +175,10 @@
       }
     },
     "suggestions": { "type": "array", "items": { "type": "string" } },
+    "extensions": {
+      "type": "object",
+      "additionalProperties": true
+    },
     "topIssues": {
       "type": "array",
       "items": {

package/dist/cli.js

@@ -4,6 +4,7 @@ import { renderConsoleReport } from "./reporters/console.js";
 import { renderJsonReport } from "./reporters/json.js";
 import { renderMarkdownReport } from "./reporters/markdown.js";
 import { renderSarifReport } from "./reporters/sarif.js";
+import { defaultConfig } from "./utils/config.js";
 import { promises as fs } from "node:fs";
 import path from "node:path";
 async function main() {
@@ -91,6 +92,22 @@ async function main() {
                 return;
             }
         }
+        if (command === "init") {
+            try {
+                const outputPath = optionValues.get("--out") ?? "depbrain.config.json";
+                const resolvedOut = resolveUserPath(outputPath);
+                const config = buildStarterConfig();
+                await fs.writeFile(resolvedOut, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+                console.log(`Created ${path.relative(process.cwd(), resolvedOut) || outputPath}`);
+                return;
+            }
+            catch (error) {
+                console.error("Failed to create config.");
+                console.error(error);
+                process.exitCode = 1;
+                return;
+            }
+        }
         console.error(`Unknown command: ${sanitizeForLog(command)}`);
         printHelp();
         process.exitCode = 1;
@@ -108,7 +125,8 @@ async function main() {
             rootDir: targetPath,
             configPath: optionValues.get("--config"),
             config: cliConfig,
-            baseline
+            baseline,
+            focus: parseFocus(optionValues.get("--focus"))
         });
         let output;
         if (flags.has("--json")) {
@@ -169,6 +187,11 @@ function buildCliConfig(flags, optionValues) {
     if (flags.has("--fail-on-unused")) {
         policy.failOnUnused = true;
     }
+    if (flags.has("--ci")) {
+        policy.minScore = policy.minScore ?? 70;
+        policy.failOnDuplicates = true;
+        policy.failOnRisks = true;
+    }
     return {
         policy
     };
@@ -186,9 +209,10 @@ function printHelp() {
     console.log("Dependency Brain");
     console.log("");
     console.log("Usage:");
-    console.log("  dep-brain analyze [path] [--json] [--md] [--sarif] [--top] [--out path] [--config path] [--baseline path] [--min-score n] [--fail-on-risks]");
+    console.log("  dep-brain analyze [path] [--json] [--md] [--sarif] [--top] [--focus kind] [--ci] [--out path] [--config path] [--baseline path] [--min-score n] [--fail-on-risks]");
     console.log("  dep-brain report --from <file> [--md] [--json] [--sarif] [--top] [--out path]");
     console.log("  dep-brain config [path] [--config path]");
+    console.log("  dep-brain init [--out depbrain.config.json]");
     console.log("  dep-brain help");
     console.log("  dep-brain --version");
     console.log("");
@@ -197,6 +221,8 @@ function printHelp() {
     console.log("  --md                Output Markdown report");
     console.log("  --sarif             Output SARIF format for Code Scanning");
     console.log("  --top               Output the ranked top issues only");
+    console.log("  --focus <kind>      Run all, health, duplicates, unused, outdated, or risks");
+    console.log("  --ci                Apply low-noise CI defaults");
     console.log("  --config <path>     Path to depbrain.config.json");
     console.log("  --baseline <path>   Ignore findings already present in a baseline JSON report");
     console.log("  --from <file>       Read analysis JSON from file");
@@ -209,6 +235,45 @@ function printHelp() {
     console.log("  --help              Show this help output");
     console.log("  --version           Show CLI version");
 }
+function parseFocus(value) {
+    if (value === "duplicates" ||
+        value === "unused" ||
+        value === "outdated" ||
+        value === "risks" ||
+        value === "health" ||
+        value === "all") {
+        return value;
+    }
+    return "all";
+}
+function buildStarterConfig() {
+    return {
+        ...defaultConfig,
+        ignore: {
+            ...defaultConfig.ignore,
+            unused: [
+                "@nestjs/platform-express",
+                "reflect-metadata",
+                "source-map-support",
+                "ts-loader",
+                "ts-node",
+                "tsconfig-paths"
+            ]
+        },
+        policy: {
+            ...defaultConfig.policy,
+            minScore: 70,
+            failOnDuplicates: true,
+            failOnRisks: true
+        },
+        scoring: {
+            duplicateWeight: 8,
+            outdatedWeight: 1,
+            unusedWeight: 2,
+            riskWeight: 4
+        }
+    };
+}
 async function loadPackageVersion() {
     try {
         const pkgPath = new URL("../package.json", import.meta.url);

package/dist/core/analyzer.d.ts

@@ -4,7 +4,9 @@ export interface AnalysisOptions {
     configPath?: string;
     config?: DepBrainConfigOverrides;
     baseline?: DepBrainBaseline;
+    focus?: AnalysisFocus;
 }
+export type AnalysisFocus = "all" | "duplicates" | "unused" | "outdated" | "risks" | "health";
 export interface DepBrainBaseline {
     duplicates?: Array<Partial<Pick<DuplicateDependency, "name">>>;
     unused?: Array<Partial<Pick<UnusedDependency, "name" | "section" | "package">>>;
@@ -108,6 +110,7 @@ export interface AnalysisResult {
     risks: RiskDependency[];
     suggestions: string[];
     topIssues: TopIssue[];
+    extensions: Record<string, unknown>;
     config: DepBrainConfig;
     packages?: PackageAnalysisResult[];
 }
@@ -128,6 +131,7 @@ export interface PackageAnalysisResult {
     risks: RiskDependency[];
     suggestions: string[];
     topIssues: TopIssue[];
+    extensions: Record<string, unknown>;
 }
 export declare const OUTPUT_VERSION = "1.4";
 export interface ScoreBreakdown {

package/dist/core/analyzer.js

@@ -6,27 +6,34 @@ import { runUnusedCheck } from "../checks/unused.js";
 import { loadDepBrainConfig } from "../utils/config.js";
 import { findWorkspacePackages } from "../utils/workspaces.js";
 import { buildDependencyGraph } from "./graph-builder.js";
-import { calculateHealthScore } from "./scorer.js";
+import { PluginManager } from "./plugin-manager.js";
+import { calculateHealthScore, calculateScoreDeductions } from "./scorer.js";
 import { buildAnalysisContext } from "./context.js";
 export const OUTPUT_VERSION = "1.4";
 export async function analyzeProject(options = {}) {
     const rootDir = path.resolve(options.rootDir ?? process.cwd());
     const loadedConfig = await loadDepBrainConfig(rootDir, options.configPath);
     const config = mergeConfig(loadedConfig, options.config);
+    const focus = options.focus ?? "all";
+    const plugins = await PluginManager.load(rootDir, config);
+    await plugins.runPreScan({ rootDir, config });
     const workspaces = await findWorkspacePackages(rootDir);
     if (workspaces.length === 0) {
-        return analyzeSingleProject(rootDir, config, {
-            baseline: options.baseline
+        const result = await analyzeSingleProject(rootDir, config, {
+            baseline: options.baseline,
+            focus
         });
+        return plugins.runPostScan(result);
     }
     const rootGraph = await buildDependencyGraph(rootDir);
-    const duplicateCheck = await runDuplicateCheck(rootGraph);
-    const filteredDuplicateIssues = filterIssues(duplicateCheck.issues, "duplicates", config);
-    const duplicates = mapDuplicateIssues(filteredDuplicateIssues);
+    const duplicates = shouldRunCheck("duplicate", focus)
+        ? mapDuplicateIssues(filterIssues((await runDuplicateCheck(rootGraph)).issues, "duplicates", config))
+        : [];
     const packages = [];
     for (const workspace of workspaces) {
         const result = await analyzeSingleProject(workspace.rootDir, config, {
-            packageName: workspace.name
+            packageName: workspace.name,
+            focus
         });
         packages.push({ ...result, name: workspace.name });
     }
@@ -76,7 +83,7 @@ export async function analyzeProject(options = {}) {
         outdated: outdated.length,
         risks: risks.length
     }, config);
-    return {
+    const result = {
         outputVersion: OUTPUT_VERSION,
         rootDir,
         score,
@@ -99,9 +106,11 @@ export async function analyzeProject(options = {}) {
             outdated,
             risks
         }),
+        extensions: {},
         config,
         packages
     };
+    return plugins.runPostScan(result);
 }
 function mergeConfig(base, overrides) {
     if (!overrides) {
@@ -128,6 +137,21 @@ function mergeConfig(base, overrides) {
         report: {
             maxSuggestions: overrides.report?.maxSuggestions ?? base.report.maxSuggestions
         },
+        plugins: {
+            enabled: overrides.plugins?.enabled ?? base.plugins.enabled,
+            paths: overrides.plugins?.paths ?? base.plugins.paths
+        },
+        risk: {
+            transitiveBloatThreshold: overrides.risk?.transitiveBloatThreshold ?? base.risk.transitiveBloatThreshold,
+            typosquattingDistanceThreshold: overrides.risk?.typosquattingDistanceThreshold ?? base.risk.typosquattingDistanceThreshold
+        },
+        dashboard: {
+            outputPath: overrides.dashboard?.outputPath ?? base.dashboard.outputPath
+        },
+        notifications: {
+            slackWebhookEnv: overrides.notifications?.slackWebhookEnv ?? base.notifications.slackWebhookEnv,
+            discordWebhookEnv: overrides.notifications?.discordWebhookEnv ?? base.notifications.discordWebhookEnv
+        },
         scoring: {
             duplicateWeight: overrides.scoring?.duplicateWeight ?? base.scoring.duplicateWeight,
             outdatedWeight: overrides.scoring?.outdatedWeight ?? base.scoring.outdatedWeight,
@@ -163,7 +187,7 @@ function evaluatePolicy(summary, config) {
 }
 async function analyzeSingleProject(rootDir, config, options = {}) {
     const context = await buildAnalysisContext(rootDir, config);
-    const results = await runChecks(context);
+    const results = await runChecks(context, options.focus ?? "all");
     const issueGroups = normalizeIssues(results, config);
     const duplicates = mapDuplicateIssues(issueGroups.duplicates);
     const unused = mapUnusedIssues(issueGroups.unused);
@@ -235,6 +259,7 @@ async function analyzeSingleProject(rootDir, config, options = {}) {
             outdated: baselineFiltered.outdated,
             risks: baselineFiltered.risks
         }),
+        extensions: {},
         config
     };
 }
@@ -255,7 +280,7 @@ function shouldIgnorePackage(name, bucket, config) {
         }
     });
 }
-async function runChecks(context) {
+async function runChecks(context, focus) {
     const checks = [
         {
             name: "duplicate",
@@ -276,10 +301,21 @@ async function runChecks(context) {
     ];
     const results = [];
     for (const check of checks) {
-        results.push(await check.run());
+        if (shouldRunCheck(check.name, focus)) {
+            results.push(await check.run());
+        }
     }
     return results;
 }
+function shouldRunCheck(checkName, focus) {
+    if (focus === "all" || focus === "health") {
+        return true;
+    }
+    return ((focus === "duplicates" && checkName === "duplicate") ||
+        (focus === "unused" && checkName === "unused") ||
+        (focus === "outdated" && checkName === "outdated") ||
+        (focus === "risks" && checkName === "risk"));
+}
 function normalizeIssues(results, config) {
     const map = new Map();
     for (const result of results) {
@@ -603,12 +639,22 @@ function normalizeWorkspaceUsage(value) {
         .filter((entry) => entry !== null);
 }
 function buildScoreBreakdown(counts, config) {
+    const deductions = calculateScoreDeductions({
+        duplicates: counts.duplicates,
+        outdated: counts.outdated,
+        unused: counts.unused,
+        risks: counts.risks,
+        duplicateWeight: config.scoring.duplicateWeight,
+        outdatedWeight: config.scoring.outdatedWeight,
+        unusedWeight: config.scoring.unusedWeight,
+        riskWeight: config.scoring.riskWeight
+    });
     return {
-        baseScore: 100,
-        duplicates: counts.duplicates * config.scoring.duplicateWeight,
-        outdated: counts.outdated * config.scoring.outdatedWeight,
-        unused: counts.unused * config.scoring.unusedWeight,
-        risks: counts.risks * config.scoring.riskWeight,
+        baseScore: deductions.baseScore,
+        duplicates: deductions.duplicates,
+        outdated: deductions.outdated,
+        unused: deductions.unused,
+        risks: deductions.risks,
         weights: {
             duplicateWeight: config.scoring.duplicateWeight,
             outdatedWeight: config.scoring.outdatedWeight,

package/dist/core/plugin-manager.d.ts

@@ -0,0 +1,20 @@
+import type { AnalysisResult } from "./analyzer.js";
+import type { DepBrainConfig } from "../utils/config.js";
+export interface ProjectContext {
+    rootDir: string;
+    config: DepBrainConfig;
+}
+export interface DepBrainPlugin {
+    name: string;
+    preScan?: (context: ProjectContext) => Promise<void> | void;
+    postScan?: (result: AnalysisResult) => Promise<AnalysisResult | void> | AnalysisResult | void;
+    reportHook?: (result: AnalysisResult) => Promise<Record<string, unknown> | void> | Record<string, unknown> | void;
+    cliCommands?: (cli: unknown) => void;
+}
+export declare class PluginManager {
+    private readonly plugins;
+    private constructor();
+    static load(rootDir: string, config: DepBrainConfig): Promise<PluginManager>;
+    runPreScan(context: ProjectContext): Promise<void>;
+    runPostScan(result: AnalysisResult): Promise<AnalysisResult>;
+}

package/dist/core/plugin-manager.js

@@ -0,0 +1,69 @@
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+export class PluginManager {
+    plugins;
+    constructor(plugins) {
+        this.plugins = plugins;
+    }
+    static async load(rootDir, config) {
+        const specs = [
+            ...config.plugins.enabled.map((name) => `dep-brain-plugin-${name}`),
+            ...config.plugins.paths
+        ];
+        const plugins = [];
+        for (const spec of specs) {
+            const plugin = await loadPlugin(rootDir, spec);
+            if (plugin) {
+                plugins.push(plugin);
+            }
+        }
+        return new PluginManager(plugins);
+    }
+    async runPreScan(context) {
+        for (const plugin of this.plugins) {
+            await plugin.preScan?.(context);
+        }
+    }
+    async runPostScan(result) {
+        let current = result;
+        for (const plugin of this.plugins) {
+            const next = await plugin.postScan?.(current);
+            if (next) {
+                current = next;
+            }
+            const reportSection = await plugin.reportHook?.(current);
+            if (reportSection) {
+                current.extensions[plugin.name] = {
+                    ...(asRecord(current.extensions[plugin.name]) ?? {}),
+                    ...reportSection
+                };
+            }
+        }
+        return current;
+    }
+}
+async function loadPlugin(rootDir, spec) {
+    try {
+        const resolved = spec.startsWith(".") || path.isAbsolute(spec)
+            ? path.resolve(rootDir, spec)
+            : spec;
+        const moduleUrl = path.isAbsolute(resolved) ? pathToFileURL(resolved).href : resolved;
+        const mod = await import(moduleUrl);
+        const exported = mod.default ?? mod.plugin ?? mod;
+        const candidate = typeof exported === "function" ? new exported() : exported;
+        return isPlugin(candidate) ? candidate : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isPlugin(value) {
+    return Boolean(value &&
+        typeof value === "object" &&
+        typeof value.name === "string");
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}

package/dist/core/scorer.d.ts

@@ -9,3 +9,10 @@ export interface ScoreInputs {
     riskWeight?: number;
 }
 export declare function calculateHealthScore(inputs: ScoreInputs): number;
+export declare function calculateScoreDeductions(inputs: ScoreInputs): {
+    baseScore: number;
+    duplicates: number;
+    outdated: number;
+    unused: number;
+    risks: number;
+};

package/dist/core/scorer.js

@@ -1,12 +1,21 @@
 export function calculateHealthScore(inputs) {
+    const breakdown = calculateScoreDeductions(inputs);
+    return Math.max(0, breakdown.baseScore -
+        breakdown.duplicates -
+        breakdown.outdated -
+        breakdown.unused -
+        breakdown.risks);
+}
+export function calculateScoreDeductions(inputs) {
     const duplicateWeight = inputs.duplicateWeight ?? 5;
     const outdatedWeight = inputs.outdatedWeight ?? 3;
     const unusedWeight = inputs.unusedWeight ?? 4;
     const riskWeight = inputs.riskWeight ?? 10;
-    const rawScore = 100 -
-        inputs.duplicates * duplicateWeight -
-        inputs.outdated * outdatedWeight -
-        inputs.unused * unusedWeight -
-        inputs.risks * riskWeight;
-    return Math.max(0, rawScore);
+    return {
+        baseScore: 100,
+        duplicates: Math.min(35, inputs.duplicates * duplicateWeight),
+        outdated: Math.min(25, inputs.outdated * outdatedWeight),
+        unused: Math.min(20, inputs.unused * unusedWeight),
+        risks: Math.min(30, inputs.risks * riskWeight)
+    };
 }

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export { analyzeProject } from "./core/analyzer.js";
-export type { AnalysisOptions, AnalysisResult, DepBrainBaseline, DuplicateDependency, OutdatedDependency, PolicyResult, PackageAnalysisResult, Recommendation, RiskFactors, ScoreBreakdown, RiskDependency, TopIssue, TrustScore, UnusedDependency, WorkspaceDependencyUsage, WorkspaceOwnershipSummary } from "./core/analyzer.js";
+export type { AnalysisOptions, AnalysisFocus, AnalysisResult, DepBrainBaseline, DuplicateDependency, OutdatedDependency, PolicyResult, PackageAnalysisResult, Recommendation, RiskFactors, ScoreBreakdown, RiskDependency, TopIssue, TrustScore, UnusedDependency, WorkspaceDependencyUsage, WorkspaceOwnershipSummary } from "./core/analyzer.js";
 export { OUTPUT_VERSION } from "./core/analyzer.js";
+export { PluginManager } from "./core/plugin-manager.js";
+export type { DepBrainPlugin, ProjectContext } from "./core/plugin-manager.js";
 export type { AnalysisContext, CheckResult, Issue } from "./core/types.js";
 export type { DepBrainConfig, DepBrainConfigOverrides } from "./utils/config.js";
 export type { WorkspacePackage } from "./utils/workspaces.js";

package/dist/index.js

@@ -1,2 +1,3 @@
 export { analyzeProject } from "./core/analyzer.js";
 export { OUTPUT_VERSION } from "./core/analyzer.js";
+export { PluginManager } from "./core/plugin-manager.js";

package/dist/utils/config.d.ts

@@ -19,6 +19,21 @@ export interface DepBrainConfig {
     report: {
         maxSuggestions: number;
     };
+    plugins: {
+        enabled: string[];
+        paths: string[];
+    };
+    risk: {
+        transitiveBloatThreshold: number;
+        typosquattingDistanceThreshold: number;
+    };
+    dashboard: {
+        outputPath: string;
+    };
+    notifications: {
+        slackWebhookEnv: string;
+        discordWebhookEnv: string;
+    };
     scoring: {
         duplicateWeight: number;
         outdatedWeight: number;
@@ -33,6 +48,10 @@ export interface DepBrainConfigOverrides {
     ignore?: Partial<DepBrainConfig["ignore"]>;
     policy?: Partial<DepBrainConfig["policy"]>;
     report?: Partial<DepBrainConfig["report"]>;
+    plugins?: Partial<DepBrainConfig["plugins"]>;
+    risk?: Partial<DepBrainConfig["risk"]>;
+    dashboard?: Partial<DepBrainConfig["dashboard"]>;
+    notifications?: Partial<DepBrainConfig["notifications"]>;
     scoring?: Partial<DepBrainConfig["scoring"]>;
     scan?: Partial<DepBrainConfig["scan"]>;
 }

package/dist/utils/config.js

@@ -21,6 +21,21 @@ export const defaultConfig = {
     report: {
         maxSuggestions: 5
     },
+    plugins: {
+        enabled: [],
+        paths: []
+    },
+    risk: {
+        transitiveBloatThreshold: 50,
+        typosquattingDistanceThreshold: 2
+    },
+    dashboard: {
+        outputPath: "depbrain-dashboard.html"
+    },
+    notifications: {
+        slackWebhookEnv: "DEPBRAIN_SLACK_WEBHOOK_URL",
+        discordWebhookEnv: "DEPBRAIN_DISCORD_WEBHOOK_URL"
+    },
     scoring: {
         duplicateWeight: 5,
         outdatedWeight: 3,
@@ -63,6 +78,21 @@ function normalizeConfig(loaded) {
         report: {
             maxSuggestions: normalizeNumber(loaded.report?.maxSuggestions, defaultConfig.report.maxSuggestions)
         },
+        plugins: {
+            enabled: normalizeStringArray(loaded.plugins?.enabled, defaultConfig.plugins.enabled),
+            paths: normalizeStringArray(loaded.plugins?.paths, defaultConfig.plugins.paths)
+        },
+        risk: {
+            transitiveBloatThreshold: normalizeNumber(loaded.risk?.transitiveBloatThreshold, defaultConfig.risk.transitiveBloatThreshold),
+            typosquattingDistanceThreshold: normalizeNumber(loaded.risk?.typosquattingDistanceThreshold, defaultConfig.risk.typosquattingDistanceThreshold)
+        },
+        dashboard: {
+            outputPath: normalizeString(loaded.dashboard?.outputPath, defaultConfig.dashboard.outputPath)
+        },
+        notifications: {
+            slackWebhookEnv: normalizeString(loaded.notifications?.slackWebhookEnv, defaultConfig.notifications.slackWebhookEnv),
+            discordWebhookEnv: normalizeString(loaded.notifications?.discordWebhookEnv, defaultConfig.notifications.discordWebhookEnv)
+        },
         scoring: {
             duplicateWeight: normalizeNumber(loaded.scoring?.duplicateWeight, defaultConfig.scoring.duplicateWeight),
             outdatedWeight: normalizeNumber(loaded.scoring?.outdatedWeight, defaultConfig.scoring.outdatedWeight),
@@ -86,3 +116,6 @@ function normalizeBoolean(value, fallback) {
 function normalizeNumber(value, fallback) {
     return typeof value === "number" && Number.isFinite(value) ? value : fallback;
 }
+function normalizeString(value, fallback) {
+    return typeof value === "string" && value.trim().length > 0 ? value : fallback;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dep-brain",
-  "version": "1.0.2",
+  "version": "1.2.0",
   "description": "CLI and library for explainable dependency intelligence",
   "type": "module",
   "main": "dist/index.js",