dependency-fitness-scorecardlisted

# Dependency Fitness Scorecard ## 1. System Architecture & Prerequisites Upgrading a dependency — or refusing to — is too often an emotional decision. The Scorecard turns each dependency into a report card: how alive is the maintainer, how steady are releases, how old are open issues, and how heavy is the footprint. It reads your `package-lock.json` + npm registry metadata (or PyPI JSON for Python) — Node 18+ stdlib, network optional against a mirrored registry. Metrics: - `lastPublishDays`, `releaseCadence` (median days between releases) - `openIssues`, `staleIssues30d` (issues with no update in 30 days) - `sizeBytes` (publish size), `depsCount` (transitive deps) - `maintenanceScore 0..100`, `confidence: high|medium|low` ## 2. Input/Output Data Contracts Input: `package-lock.json` (npm lockfile v2/v3) or `requirements.txt` for the plain version. Optional `--offline` to score from lockfile + local `node_modules` only. Output `dependency-scorecard.json` + `DEPENDENCY_SCORECARD.md`: ```json { "deps": 124, "atRisk": [ { "name": "legacy-etl", "score": 31, "lastPublishDays": 460, "reason": "no releases in 15 months" } ], "recommendations": [ "lib-x@2→3: safe, cadence 12d, score 94" ] } ``` Exit: `0` = no at-risk deps (score ≥ 40), `1` = at-risk deps present. ## 3. Production Reference Implementation ```js // dependency-fitness-scorecard.js const fs = require('fs'); const https = require('https'); const path = require('path'); const root = process.argv[2] || '.'; const