# 007.0-DEV-SEPARATE-PROD-DEV-THRESHOLDS: Separate Production and Development Thresholds

## Release Goal

**Release 0.4: Configurable Thresholds**

Allow users to specify different age and security thresholds for production dependencies versus development dependencies. Production code typically requires stricter maturity and security rules than development tooling.

## How This Story Contributes

Enables teams to apply appropriate risk management to different dependency types. Production dependencies that ship to customers can require longer maturity periods and stricter security, while development tools can use more relaxed rules.

## User Story

**Format**: So that I can apply stricter rules to production code while maintaining update velocity for dev tools, as a developer, I want to configure different age and security thresholds for production versus development dependencies.

**INVEST Criteria Compliance**:

- **Independent**: Builds on configuration stories but provides distinct value
- **Negotiable**: Threshold combinations and defaults can be refined
- **Valuable**: Enables risk-appropriate filtering for different dependency types
- **Estimable**: Clear scope - add prod/dev distinction to existing thresholds
- **Small**: Single iteration to add dependency-type-specific configuration
- **Testable**: Can verify prod and dev dependencies use different thresholds

## Acceptance Criteria

- [ ] **Production Age Threshold**: Accepts `--prod-min-age=<days>` CLI flag
- [ ] **Development Age Threshold**: Accepts `--dev-min-age=<days>` CLI flag
- [ ] **Production Security Threshold**: Accepts `--prod-severity=<level>` CLI flag
- [ ] **Development Security Threshold**: Accepts `--dev-severity=<level>` CLI flag
- [ ] **Config File Support**: Reads `prod` and `dev` objects from config file
- [ ] **Dependency Type Detection**: Correctly identifies prod vs dev dependencies from package.json
- [ ] **Fallback Behavior**: Falls back to non-prefixed flags if prod/dev not specified
- [ ] **Default Behavior**: Uses same threshold for both if no distinction specified (backward compatible)
- [ ] **Validation**: Validates all threshold values appropriately
- [ ] **Output Indication**: Shows which dependency type each package is in output

## Requirements (Current Implementation or To Be Implemented)

- **REQ-CLI-FLAGS**: Support `--prod-min-age`, `--dev-min-age`, `--prod-severity`, `--dev-severity`
- **REQ-CONFIG-SCHEMA**: Support nested config: `{ "prod": { "minAge": 30, "minSeverity": "moderate" }, "dev": { "minAge": 7, "minSeverity": "high" } }`
- **REQ-DEPENDENCY-TYPE**: Determine if package is prod or dev from npm outdated output
- **REQ-FALLBACK-LOGIC**: Use `--min-age`/`--severity` for both if prod/dev not specified
- **REQ-PRECEDENCE**: Specific flag > general flag > config file > default
- **REQ-VALIDATION**: Validate all threshold values
- **REQ-OUTPUT-COLUMN**: Add "Type" column showing prod/dev in output

## Dependencies

- **005.0-DEV-CONFIGURABLE-AGE-THRESHOLD**: Builds on age threshold configuration
- **006.0-DEV-CONFIGURABLE-SECURITY-THRESHOLD**: Builds on severity threshold configuration

## Definition of Done

- [ ] All acceptance criteria met
- [ ] Code reviewed and approved
- [ ] Unit tests for threshold selection logic (prod vs dev)
- [ ] Tests for fallback behavior
- [ ] Tests for precedence rules
- [ ] Integration tests with mixed prod/dev dependencies
- [ ] Documentation updated (README.md shows all flags)
- [ ] Help text includes all prod/dev flags
- [ ] Backward compatible (no prod/dev distinction = same threshold for both)

---

## Story Notes

**Gall's Law Compliance**: Adds dependency-type awareness to existing threshold configuration without changing core filtering logic.

**Backward Compatibility**: If prod/dev thresholds not specified, uses same threshold for all dependencies (existing behavior maintained).

**Common Use Case**: Production dependencies (what customers run) get 30-day maturity + moderate severity threshold, while development tools (testing, linting, building) get 7-day maturity + high severity threshold.

**Package.json Structure**: npm outdated includes dependency type information, making this enhancement straightforward to implement.