dependency-audit

# zuvo:dependency-audit Audit external dependency health and internal module coupling. Scores 10 dimensions with tiered tooling -- gracefully degrades when specialized tools are unavailable. **Scope:** Node.js / TypeScript projects (npm, pnpm, yarn, bun). **When to use:** Before releases, after adding many dependencies, periodic health check, after monorepo restructuring, before lock-in reviews. **When NOT to use:** Code quality (`zuvo:review`), DB-specific (`zuvo:db-audit`), full-stack performance (`zuvo:performance-audit`), OWASP (`/security-audit`). > **Scanner exit codes:** follow `../../shared/includes/scanner-invocation.md` — `npm/pip-audit/osv-scanner` exit non-zero WHEN they find vulns (success); never treat non-zero as failure. ## Known Limitations - Node.js/TypeScript only. Python, Go, Rust, and Java are not supported. - `npm query` selectors are npm-specific. pnpm/yarn/bun fall back to lockfile analysis. - D5 (bundle impact) uses Bundlephobia API for triage -- not precise without actual build statistics. - D7 (instability metrics) requires dependency-cruiser for Ca/Ce/I. Without it, only fan-in/fan-out via grep. - D10 (change coupling) requires 3+ months of git history. - Monorepo workspace scoping is partial -- tools operate on workspace root unless filtered. ## Mandatory File Loading Read every file below before starting. Print the checklist. ``` CORE FILES LOADED: 1. ../../shared/includes/codesift-setup.md -- [READ | MISSING -> STOP] 2. .....