@getcodesentinel/codesentinel 1.10.1 → 1.11.0

package/dist/index.js

@@ -127,7 +127,12 @@ var buildExternalAnalysisSummary = (targetPath, extraction, metadataByKey, confi
     }
   }
   const { depthByName, maxDepth } = computeDepths(nodeByName, directNames);
-  const centralityRanking = rankCentrality(nodes, dependentsByName, directNames, config.centralityTopN);
+  const centralityRanking = rankCentrality(
+    nodes,
+    dependentsByName,
+    directNames,
+    config.centralityTopN
+  );
   const topCentralNames = new Set(
     centralityRanking.slice(0, Math.max(1, Math.ceil(centralityRanking.length * 0.25))).map((entry) => entry.name)
   );
@@ -230,8 +235,12 @@ var buildExternalAnalysisSummary = (targetPath, extraction, metadataByKey, confi
     metrics: {
       totalDependencies: allDependencies.length,
       directDependencies: dependencies.length,
-      directProductionDependencies: dependencies.filter((dependency) => dependency.dependencyScope === "prod").length,
-      directDevelopmentDependencies: dependencies.filter((dependency) => dependency.dependencyScope === "dev").length,
+      directProductionDependencies: dependencies.filter(
+        (dependency) => dependency.dependencyScope === "prod"
+      ).length,
+      directDevelopmentDependencies: dependencies.filter(
+        (dependency) => dependency.dependencyScope === "dev"
+      ).length,
       transitiveDependencies: allDependencies.length - dependencies.length,
       dependencyDepth: maxDepth,
       lockfileKind: extraction.kind,
@@ -257,7 +266,8 @@ var DEFAULT_EXTERNAL_ANALYSIS_CONFIG = {
 var mapWithConcurrency = async (values, limit, handler) => {
   const effectiveLimit = Math.max(1, limit);
   const workerCount = Math.min(effectiveLimit, values.length);
-  const results = new Array(values.length);
+  const UNSET = /* @__PURE__ */ Symbol("map_with_concurrency_unset");
+  const results = new Array(values.length).fill(UNSET);
   let index = 0;
   const workers = Array.from({ length: workerCount }, async () => {
     while (true) {
@@ -267,12 +277,13 @@ var mapWithConcurrency = async (values, limit, handler) => {
         return;
       }
       const value = values[current];
-      if (value !== void 0) {
-        results[current] = await handler(value);
-      }
+      results[current] = await handler(value);
     }
   });
   await Promise.all(workers);
+  if (results.some((value) => value === UNSET)) {
+    throw new Error("map_with_concurrency_incomplete_results");
+  }
   return results;
 };
 var collectDependencyMetadata = async (extraction, metadataProvider, concurrency, onProgress) => {
@@ -473,9 +484,7 @@ var parsePnpmLockfile = (raw, directSpecs) => {
       version: nodeId.slice(at + 1),
       dependencies: [...deps].sort((a, b) => a.localeCompare(b))
     };
-  }).sort(
-    (a, b) => a.name.localeCompare(b.name) || a.version.localeCompare(b.version)
-  );
+  }).sort((a, b) => a.name.localeCompare(b.name) || a.version.localeCompare(b.version));
   return {
     kind: "pnpm",
     directDependencies: directSpecs,
@@ -579,7 +588,9 @@ var parseYarnLock = (raw, directSpecs) => {
   return {
     kind: "yarn",
     directDependencies: directSpecs,
-    nodes: [...deduped.values()].sort((a, b) => a.name.localeCompare(b.name) || a.version.localeCompare(b.version))
+    nodes: [...deduped.values()].sort(
+      (a, b) => a.name.localeCompare(b.name) || a.version.localeCompare(b.version)
+    )
   };
 };
 var parseBunLock = (_raw, _directSpecs) => {
@@ -855,7 +866,9 @@ var resolveRangeVersion = (versions, requested) => {
   if (clauses.length === 0) {
     return null;
   }
-  const parsedVersions = versions.map((version2) => ({ version: version2, parsed: parseSemver(version2) })).filter((candidate) => candidate.parsed !== null).sort((a, b) => compareSemver(b.parsed, a.parsed));
+  const parsedVersions = versions.map((version2) => ({ version: version2, parsed: parseSemver(version2) })).filter(
+    (candidate) => candidate.parsed !== null
+  ).sort((a, b) => compareSemver(b.parsed, a.parsed));
   for (const candidate of parsedVersions) {
     let clauseMatched = false;
     let clauseUnsupported = false;
@@ -929,7 +942,9 @@ var resolveRequestedVersion = (packument, requested) => {
       fallbackUsed: requested !== null
     };
   }
-  const semverSorted = versionKeys.map((version2) => ({ version: version2, parsed: parseSemver(version2) })).filter((candidate) => candidate.parsed !== null).sort((a, b) => compareSemver(b.parsed, a.parsed)).map((candidate) => candidate.version);
+  const semverSorted = versionKeys.map((version2) => ({ version: version2, parsed: parseSemver(version2) })).filter(
+    (candidate) => candidate.parsed !== null
+  ).sort((a, b) => compareSemver(b.parsed, a.parsed)).map((candidate) => candidate.version);
   const fallbackVersion = semverSorted[0] ?? versionKeys.sort((a, b) => b.localeCompare(a))[0];
   if (fallbackVersion === void 0) {
     return null;
@@ -1002,11 +1017,15 @@ var resolveRegistryGraphFromDirectSpecs = async (directSpecs, options) => {
       continue;
     }
     const manifest = (packument.versions ?? {})[resolved.version] ?? {};
-    const dependencies = Object.entries(manifest.dependencies ?? {}).filter(([dependencyName, dependencyRange]) => dependencyName.length > 0 && dependencyRange.length > 0).sort((a, b) => a[0].localeCompare(b[0]));
+    const dependencies = Object.entries(manifest.dependencies ?? {}).filter(
+      ([dependencyName, dependencyRange]) => dependencyName.length > 0 && dependencyRange.length > 0
+    ).sort((a, b) => a[0].localeCompare(b[0]));
     nodesByKey.set(nodeKey, {
       name: item.name,
       version: resolved.version,
-      dependencies: dependencies.map(([dependencyName, dependencyRange]) => `${dependencyName}@${dependencyRange}`)
+      dependencies: dependencies.map(
+        ([dependencyName, dependencyRange]) => `${dependencyName}@${dependencyRange}`
+      )
     });
     if (item.depth >= maxDepth && dependencies.length > 0) {
       truncated = true;
@@ -1183,7 +1202,8 @@ var parseDependencySpec = (value) => {
 var mapWithConcurrency2 = async (values, limit, handler) => {
   const effectiveLimit = Math.max(1, limit);
   const workerCount = Math.min(effectiveLimit, values.length);
-  const results = new Array(values.length);
+  const UNSET = /* @__PURE__ */ Symbol("map_with_concurrency_unset");
+  const results = new Array(values.length).fill(UNSET);
   let index = 0;
   const workers = Array.from({ length: workerCount }, async () => {
     while (true) {
@@ -1193,12 +1213,13 @@ var mapWithConcurrency2 = async (values, limit, handler) => {
         return;
       }
       const value = values[current];
-      if (value !== void 0) {
-        results[current] = await handler(value);
-      }
+      results[current] = await handler(value);
     }
   });
   await Promise.all(workers);
+  if (results.some((value) => value === UNSET)) {
+    throw new Error("map_with_concurrency_incomplete_results");
+  }
   return results;
 };
 var analyzeDependencyCandidate = async (input, metadataProvider) => {
@@ -1363,8 +1384,8 @@ var NpmRegistryMetadataProvider = class {
   }
 };
 var NoopMetadataProvider = class {
-  async getMetadata(_name, _version, _context) {
-    return null;
+  getMetadata(_name, _version, _context) {
+    return Promise.resolve(null);
   }
 };
 var analyzeDependencyExposureFromProject = async (input, onProgress) => {
@@ -1445,7 +1466,9 @@ var diffSets = (current, baseline) => {
   return { added, removed };
 };
 var diffScoreMap = (current, baseline) => {
-  const keys = [.../* @__PURE__ */ new Set([...current.keys(), ...baseline.keys()])].sort((a, b) => a.localeCompare(b));
+  const keys = [.../* @__PURE__ */ new Set([...current.keys(), ...baseline.keys()])].sort(
+    (a, b) => a.localeCompare(b)
+  );
   return keys.map((key) => {
     const before = baseline.get(key) ?? 0;
     const after = current.get(key) ?? 0;
@@ -1486,17 +1509,27 @@ var compareSnapshots = (current, baseline) => {
     singleMaintainerDependencies: [],
     abandonedDependencies: []
   };
-  const highRisk = diffSets(currentExternal.highRiskDependencies, baselineExternal.highRiskDependencies);
+  const highRisk = diffSets(
+    currentExternal.highRiskDependencies,
+    baselineExternal.highRiskDependencies
+  );
   const singleMaintainer = diffSets(
     currentExternal.singleMaintainerDependencies,
     baselineExternal.singleMaintainerDependencies
   );
-  const abandoned = diffSets(currentExternal.abandonedDependencies, baselineExternal.abandonedDependencies);
+  const abandoned = diffSets(
+    currentExternal.abandonedDependencies,
+    baselineExternal.abandonedDependencies
+  );
   const hotspots = diffSets(currentHotspots, baselineHotspots);
   const cycles = diffSets(currentCycles, baselineCycles);
   return {
-    repositoryScoreDelta: round43(current.analysis.risk.repositoryScore - baseline.analysis.risk.repositoryScore),
-    normalizedScoreDelta: round43(current.analysis.risk.normalizedScore - baseline.analysis.risk.normalizedScore),
+    repositoryScoreDelta: round43(
+      current.analysis.risk.repositoryScore - baseline.analysis.risk.repositoryScore
+    ),
+    normalizedScoreDelta: round43(
+      current.analysis.risk.normalizedScore - baseline.analysis.risk.normalizedScore
+    ),
     fileRiskChanges: diffScoreMap(currentFileScores, baselineFileScores),
     moduleRiskChanges: diffScoreMap(currentModuleScores, baselineModuleScores),
     newHotspots: hotspots.added,
@@ -1586,6 +1619,32 @@ var repositoryConfidence = (snapshot) => {
   );
   return round43(weighted / weight);
 };
+var repositoryDimensionScores = (snapshot) => {
+  const target = findTraceTarget(snapshot, "repository", snapshot.analysis.structural.targetPath);
+  if (target === void 0) {
+    return {
+      structural: null,
+      evolution: null,
+      external: null,
+      interactions: null
+    };
+  }
+  const structural = target.factors.find((factor) => factor.factorId === "repository.structural");
+  const evolution = target.factors.find((factor) => factor.factorId === "repository.evolution");
+  const external = target.factors.find((factor) => factor.factorId === "repository.external");
+  const interactions = target.factors.find(
+    (factor) => factor.factorId === "repository.composite.interactions"
+  );
+  const interactionScore = interactions === void 0 ? null : round43(
+    ((interactions.rawMetrics["structuralEvolution"] ?? 0) + (interactions.rawMetrics["centralInstability"] ?? 0) + (interactions.rawMetrics["dependencyAmplification"] ?? 0)) * 100
+  );
+  return {
+    structural: structural === void 0 ? null : round43((structural.rawMetrics["structuralDimension"] ?? 0) * 100),
+    evolution: evolution === void 0 ? null : round43((evolution.rawMetrics["evolutionDimension"] ?? 0) * 100),
+    external: external === void 0 ? null : round43((external.rawMetrics["externalDimension"] ?? 0) * 100),
+    interactions: interactionScore
+  };
+};
 var createReport = (snapshot, diff) => {
   const external = snapshot.analysis.external;
   return {
@@ -1596,7 +1655,8 @@ var createReport = (snapshot, diff) => {
       repositoryScore: snapshot.analysis.risk.repositoryScore,
       normalizedScore: snapshot.analysis.risk.normalizedScore,
       riskTier: toRiskTier(snapshot.analysis.risk.repositoryScore),
-      confidence: repositoryConfidence(snapshot)
+      confidence: repositoryConfidence(snapshot),
+      dimensionScores: repositoryDimensionScores(snapshot)
     },
     hotspots: hotspotItems(snapshot),
     structural: {
@@ -1616,10 +1676,18 @@ var createReport = (snapshot, diff) => {
       reason: external.reason
     } : {
       available: true,
-      highRiskDependencies: [...external.highRiskDependencies].sort((a, b) => a.localeCompare(b)),
-      highRiskDevelopmentDependencies: [...external.highRiskDevelopmentDependencies].sort((a, b) => a.localeCompare(b)),
-      singleMaintainerDependencies: [...external.singleMaintainerDependencies].sort((a, b) => a.localeCompare(b)),
-      abandonedDependencies: [...external.abandonedDependencies].sort((a, b) => a.localeCompare(b))
+      highRiskDependencies: [...external.highRiskDependencies].sort(
+        (a, b) => a.localeCompare(b)
+      ),
+      highRiskDevelopmentDependencies: [...external.highRiskDevelopmentDependencies].sort(
+        (a, b) => a.localeCompare(b)
+      ),
+      singleMaintainerDependencies: [...external.singleMaintainerDependencies].sort(
+        (a, b) => a.localeCompare(b)
+      ),
+      abandonedDependencies: [...external.abandonedDependencies].sort(
+        (a, b) => a.localeCompare(b)
+      )
     },
     appendix: {
       snapshotSchemaVersion: snapshot.schemaVersion,
@@ -1655,6 +1723,12 @@ var renderTextReport = (report) => {
   lines.push(`  riskTier: ${report.repository.riskTier}`);
   lines.push(`  confidence: ${report.repository.confidence ?? "n/a"}`);
   lines.push("");
+  lines.push("Dimension Scores (0-100)");
+  lines.push(`  structural: ${report.repository.dimensionScores.structural ?? "n/a"}`);
+  lines.push(`  evolution: ${report.repository.dimensionScores.evolution ?? "n/a"}`);
+  lines.push(`  external: ${report.repository.dimensionScores.external ?? "n/a"}`);
+  lines.push(`  interactions: ${report.repository.dimensionScores.interactions ?? "n/a"}`);
+  lines.push("");
   lines.push("Top Hotspots");
   for (const hotspot of report.hotspots) {
     lines.push(`  - ${hotspot.target} | score=${hotspot.score}`);
@@ -1677,14 +1751,18 @@ var renderTextReport = (report) => {
   if (!report.external.available) {
     lines.push(`  unavailable: ${report.external.reason}`);
   } else {
-    lines.push(`  highRiskDependencies: ${report.external.highRiskDependencies.join(", ") || "none"}`);
+    lines.push(
+      `  highRiskDependencies: ${report.external.highRiskDependencies.join(", ") || "none"}`
+    );
     lines.push(
       `  highRiskDevelopmentDependencies: ${report.external.highRiskDevelopmentDependencies.join(", ") || "none"}`
     );
     lines.push(
       `  singleMaintainerDependencies: ${report.external.singleMaintainerDependencies.join(", ") || "none"}`
     );
-    lines.push(`  abandonedDependencies: ${report.external.abandonedDependencies.join(", ") || "none"}`);
+    lines.push(
+      `  abandonedDependencies: ${report.external.abandonedDependencies.join(", ") || "none"}`
+    );
   }
   lines.push("");
   lines.push("Appendix");
@@ -1721,6 +1799,12 @@ var renderMarkdownReport = (report) => {
   lines.push(`- riskTier: \`${report.repository.riskTier}\``);
   lines.push(`- confidence: \`${report.repository.confidence ?? "n/a"}\``);
   lines.push("");
+  lines.push("## Dimension Scores (0-100)");
+  lines.push(`- structural: \`${report.repository.dimensionScores.structural ?? "n/a"}\``);
+  lines.push(`- evolution: \`${report.repository.dimensionScores.evolution ?? "n/a"}\``);
+  lines.push(`- external: \`${report.repository.dimensionScores.external ?? "n/a"}\``);
+  lines.push(`- interactions: \`${report.repository.dimensionScores.interactions ?? "n/a"}\``);
+  lines.push("");
   lines.push("## Top Hotspots");
   for (const hotspot of report.hotspots) {
     lines.push(`- **${hotspot.target}** (score: \`${hotspot.score}\`)`);
@@ -1737,21 +1821,27 @@ var renderMarkdownReport = (report) => {
   lines.push("");
   lines.push("## Structural Observations");
   lines.push(`- cycles detected: \`${report.structural.cycleCount}\``);
-  lines.push(`- cycles: ${report.structural.cycles.map((cycle) => `\`${cycle}\``).join(", ") || "none"}`);
+  lines.push(
+    `- cycles: ${report.structural.cycles.map((cycle) => `\`${cycle}\``).join(", ") || "none"}`
+  );
   lines.push(`- fragile clusters: \`${report.structural.fragileClusters.length}\``);
   lines.push("");
   lines.push("## External Exposure Summary");
   if (!report.external.available) {
     lines.push(`- unavailable: \`${report.external.reason}\``);
   } else {
-    lines.push(`- high-risk dependencies: ${report.external.highRiskDependencies.map((item) => `\`${item}\``).join(", ") || "none"}`);
+    lines.push(
+      `- high-risk dependencies: ${report.external.highRiskDependencies.map((item) => `\`${item}\``).join(", ") || "none"}`
+    );
     lines.push(
       `- high-risk development dependencies: ${report.external.highRiskDevelopmentDependencies.map((item) => `\`${item}\``).join(", ") || "none"}`
     );
     lines.push(
       `- single maintainer dependencies: ${report.external.singleMaintainerDependencies.map((item) => `\`${item}\``).join(", ") || "none"}`
     );
-    lines.push(`- abandoned dependencies: ${report.external.abandonedDependencies.map((item) => `\`${item}\``).join(", ") || "none"}`);
+    lines.push(
+      `- abandoned dependencies: ${report.external.abandonedDependencies.map((item) => `\`${item}\``).join(", ") || "none"}`
+    );
   }
   lines.push("");
   lines.push("## Appendix");
@@ -1871,7 +1961,9 @@ var validateGateConfig = (input) => {
     throw new GovernanceConfigurationError("max-repo-score must be a number in [0, 100]");
   }
   if (config.newHotspotScoreThreshold !== void 0 && (!Number.isFinite(config.newHotspotScoreThreshold) || config.newHotspotScoreThreshold < 0 || config.newHotspotScoreThreshold > 100)) {
-    throw new GovernanceConfigurationError("new-hotspot-score-threshold must be a number in [0, 100]");
+    throw new GovernanceConfigurationError(
+      "new-hotspot-score-threshold must be a number in [0, 100]"
+    );
   }
 };
 var evaluateGates = (input) => {
@@ -2021,7 +2113,9 @@ var renderCheckMarkdown = (snapshot, result) => {
   lines.push("## CodeSentinel CI Summary");
   lines.push(`- target: \`${snapshot.analysis.structural.targetPath}\``);
   lines.push(`- repositoryScore: \`${snapshot.analysis.risk.repositoryScore}\``);
-  lines.push(`- evaluatedGates: ${result.evaluatedGates.map((item) => `\`${item}\``).join(", ") || "none"}`);
+  lines.push(
+    `- evaluatedGates: ${result.evaluatedGates.map((item) => `\`${item}\``).join(", ") || "none"}`
+  );
   lines.push(`- violations: \`${result.violations.length}\``);
   lines.push(`- exitCode: \`${result.exitCode}\``);
   const repositoryTrace = snapshot.trace?.targets.find(
@@ -2392,7 +2486,10 @@ var createSummaryShape = (summary) => ({
       0,
       10
     ),
-    transitiveExposureDependenciesTop: summary.external.transitiveExposureDependencies.slice(0, 10)
+    transitiveExposureDependenciesTop: summary.external.transitiveExposureDependencies.slice(
+      0,
+      10
+    )
   } : {
     available: false,
     reason: summary.external.reason
@@ -2413,13 +2510,16 @@ var formatAnalyzeOutput = (summary, mode) => mode === "json" ? JSON.stringify(su
 // src/application/format-explain-output.ts
 var sortFactorByContribution = (left, right) => right.contribution - left.contribution || left.factorId.localeCompare(right.factorId);
 var toRiskBand = (score) => {
-  if (score < 25) {
+  if (score < 20) {
     return "low";
   }
-  if (score < 50) {
+  if (score < 40) {
     return "moderate";
   }
-  if (score < 75) {
+  if (score < 60) {
+    return "elevated";
+  }
+  if (score < 80) {
     return "high";
   }
   return "very_high";
@@ -2444,6 +2544,7 @@ var factorLabelById2 = {
 };
 var formatFactorLabel = (factorId) => factorLabelById2[factorId] ?? factorId;
 var formatNumber = (value) => value === null || value === void 0 ? "n/a" : `${value}`;
+var formatDimension = (value) => value === null ? "n/a" : `${value}`;
 var formatFactorSummary = (factor) => `${formatFactorLabel(factor.factorId)} (+${factor.contribution}, confidence=${factor.confidence})`;
 var formatFactorEvidence = (factor) => {
   if (factor.factorId === "repository.structural") {
@@ -2473,6 +2574,36 @@ var formatFactorEvidence = (factor) => {
   return "evidence available in trace";
 };
 var findRepositoryTarget = (targets) => targets.find((target) => target.targetType === "repository");
+var repositoryDimensionScores2 = (repositoryTarget) => {
+  if (repositoryTarget === void 0) {
+    return {
+      structural: null,
+      evolution: null,
+      external: null,
+      interactions: null
+    };
+  }
+  const structural = repositoryTarget.factors.find(
+    (factor) => factor.factorId === "repository.structural"
+  );
+  const evolution = repositoryTarget.factors.find(
+    (factor) => factor.factorId === "repository.evolution"
+  );
+  const external = repositoryTarget.factors.find(
+    (factor) => factor.factorId === "repository.external"
+  );
+  const interactions = repositoryTarget.factors.find(
+    (factor) => factor.factorId === "repository.composite.interactions"
+  );
+  return {
+    structural: structural === void 0 ? null : Number(((structural.rawMetrics["structuralDimension"] ?? 0) * 100).toFixed(4)),
+    evolution: evolution === void 0 ? null : Number(((evolution.rawMetrics["evolutionDimension"] ?? 0) * 100).toFixed(4)),
+    external: external === void 0 ? null : Number(((external.rawMetrics["externalDimension"] ?? 0) * 100).toFixed(4)),
+    interactions: interactions === void 0 ? null : Number(
+      (((interactions.rawMetrics["structuralEvolution"] ?? 0) + (interactions.rawMetrics["centralInstability"] ?? 0) + (interactions.rawMetrics["dependencyAmplification"] ?? 0)) * 100).toFixed(4)
+    )
+  };
+};
 var buildRepositoryActions = (payload, repositoryTarget) => {
   if (repositoryTarget === void 0) {
     return ["No repository trace available."];
@@ -2518,12 +2649,8 @@ var renderTargetText = (target) => {
   lines.push("  top factors:");
   const topFactors = [...target.factors].sort(sortFactorByContribution).slice(0, 5);
   for (const factor of topFactors) {
-    lines.push(
-      `    - ${formatFactorSummary(factor)}`
-    );
-    lines.push(
-      `      evidence: ${formatFactorEvidence(factor)}`
-    );
+    lines.push(`    - ${formatFactorSummary(factor)}`);
+    lines.push(`      evidence: ${formatFactorEvidence(factor)}`);
   }
   lines.push("  reduction levers:");
   for (const lever of target.reductionLevers) {
@@ -2537,11 +2664,17 @@ var renderText = (payload) => {
   const lines = [];
   const repositoryTarget = findRepositoryTarget(payload.selectedTargets) ?? findRepositoryTarget(payload.trace.targets);
   const repositoryTopFactors = repositoryTarget === void 0 ? [] : [...repositoryTarget.factors].sort(sortFactorByContribution).slice(0, 3);
+  const dimensionScores = repositoryDimensionScores2(repositoryTarget);
   const compositeFactors = repositoryTopFactors.filter((factor) => factor.family === "composite");
   lines.push(`target: ${payload.summary.structural.targetPath}`);
   lines.push(`repositoryScore: ${payload.summary.risk.repositoryScore}`);
   lines.push(`riskBand: ${toRiskBand(payload.summary.risk.repositoryScore)}`);
   lines.push(`selectedTargets: ${payload.selectedTargets.length}`);
+  lines.push("dimensionScores:");
+  lines.push(`  structural: ${formatDimension(dimensionScores.structural)}`);
+  lines.push(`  evolution: ${formatDimension(dimensionScores.evolution)}`);
+  lines.push(`  external: ${formatDimension(dimensionScores.external)}`);
+  lines.push(`  interactions: ${formatDimension(dimensionScores.interactions)}`);
   lines.push("");
   lines.push("explanation:");
   lines.push(
@@ -2570,6 +2703,7 @@ var renderMarkdown = (payload) => {
   const lines = [];
   const repositoryTarget = findRepositoryTarget(payload.selectedTargets) ?? findRepositoryTarget(payload.trace.targets);
   const repositoryTopFactors = repositoryTarget === void 0 ? [] : [...repositoryTarget.factors].sort(sortFactorByContribution).slice(0, 3);
+  const dimensionScores = repositoryDimensionScores2(repositoryTarget);
   const compositeFactors = repositoryTopFactors.filter((factor) => factor.family === "composite");
   lines.push(`# CodeSentinel Explanation`);
   lines.push(`- target: \`${payload.summary.structural.targetPath}\``);
@@ -2577,6 +2711,12 @@ var renderMarkdown = (payload) => {
   lines.push(`- riskBand: \`${toRiskBand(payload.summary.risk.repositoryScore)}\``);
   lines.push(`- selectedTargets: \`${payload.selectedTargets.length}\``);
   lines.push("");
+  lines.push("## Dimension Scores (0-100)");
+  lines.push(`- structural: \`${formatDimension(dimensionScores.structural)}\``);
+  lines.push(`- evolution: \`${formatDimension(dimensionScores.evolution)}\``);
+  lines.push(`- external: \`${formatDimension(dimensionScores.external)}\``);
+  lines.push(`- interactions: \`${formatDimension(dimensionScores.interactions)}\``);
+  lines.push("");
   lines.push(`## Summary`);
   lines.push(
     `- why risky: ${repositoryTopFactors.map(formatFactorSummary).join("; ") || "insufficient data"}`
@@ -2603,9 +2743,7 @@ var renderMarkdown = (payload) => {
       lines.push(
         `  - \`${formatFactorLabel(factor.factorId)}\` contribution=\`${factor.contribution}\` confidence=\`${factor.confidence}\``
       );
-      lines.push(
-        `    - evidence: \`${formatFactorEvidence(factor)}\``
-      );
+      lines.push(`    - evidence: \`${formatFactorEvidence(factor)}\``);
     }
     lines.push(`- Reduction levers:`);
     for (const lever of target.reductionLevers) {
@@ -3031,7 +3169,11 @@ var parseTsConfigFile = (configPath) => {
   return parsedCommandLine;
 };
 var collectFilesFromTsConfigGraph = (projectRoot) => {
-  const rootConfigPath = ts.findConfigFile(projectRoot, ts.sys.fileExists, "tsconfig.json");
+  const rootConfigPath = ts.findConfigFile(
+    projectRoot,
+    (filePath) => ts.sys.fileExists(filePath),
+    "tsconfig.json"
+  );
   if (rootConfigPath === void 0) {
     return null;
   }
@@ -3053,7 +3195,11 @@ var collectFilesFromTsConfigGraph = (projectRoot) => {
     }
     for (const reference of parsed.projectReferences ?? []) {
       const referencePath = resolve2(reference.path);
-      const referenceConfigPath = ts.sys.directoryExists(referencePath) ? ts.findConfigFile(referencePath, ts.sys.fileExists, "tsconfig.json") : referencePath;
+      const referenceConfigPath = ts.sys.directoryExists(referencePath) ? ts.findConfigFile(
+        referencePath,
+        (filePath) => ts.sys.fileExists(filePath),
+        "tsconfig.json"
+      ) : referencePath;
       if (referenceConfigPath !== void 0 && ts.sys.fileExists(referenceConfigPath)) {
         visitConfig(referenceConfigPath);
       }
@@ -3215,7 +3361,12 @@ var parseTypescriptProject = (projectPath, onProgress) => {
       const cacheKey = `${sourcePath}\0${specifier}`;
       let resolvedPath = resolverCache.get(cacheKey);
       if (resolvedPath === void 0 && !resolverCache.has(cacheKey)) {
-        const resolved = ts.resolveModuleName(specifier, sourcePath, options, ts.sys).resolvedModule;
+        const resolved = ts.resolveModuleName(
+          specifier,
+          sourcePath,
+          options,
+          ts.sys
+        ).resolvedModule;
         if (resolved !== void 0) {
           resolvedPath = normalizePath(resolve2(resolved.resolvedFileName));
         }
@@ -3299,7 +3450,10 @@ var buildAuthorAliasMap = (commits) => {
   const nameCountsByAuthorId = /* @__PURE__ */ new Map();
   const commitCountByAuthorId = /* @__PURE__ */ new Map();
   for (const commit of commits) {
-    commitCountByAuthorId.set(commit.authorId, (commitCountByAuthorId.get(commit.authorId) ?? 0) + 1);
+    commitCountByAuthorId.set(
+      commit.authorId,
+      (commitCountByAuthorId.get(commit.authorId) ?? 0) + 1
+    );
     const normalizedName = normalizeName(commit.authorName);
     const names = nameCountsByAuthorId.get(commit.authorId) ?? /* @__PURE__ */ new Map();
     if (normalizedName.length > 0) {
@@ -3307,19 +3461,21 @@ var buildAuthorAliasMap = (commits) => {
     }
     nameCountsByAuthorId.set(commit.authorId, names);
   }
-  const profiles = [...commitCountByAuthorId.entries()].map(([authorId, commitCount]) => {
-    const names = nameCountsByAuthorId.get(authorId);
-    const primaryName = names === void 0 ? "" : [...names.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))[0]?.[0] ?? "";
-    const normalizedAuthorId = authorId.toLowerCase();
-    const isBot = normalizedAuthorId.includes("[bot]");
-    return {
-      authorId,
-      commitCount,
-      primaryName,
-      emailStem: isBot ? null : extractEmailStem(authorId),
-      isBot
-    };
-  });
+  const profiles = [...commitCountByAuthorId.entries()].map(
+    ([authorId, commitCount]) => {
+      const names = nameCountsByAuthorId.get(authorId);
+      const primaryName = names === void 0 ? "" : [...names.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))[0]?.[0] ?? "";
+      const normalizedAuthorId = authorId.toLowerCase();
+      const isBot = normalizedAuthorId.includes("[bot]");
+      return {
+        authorId,
+        commitCount,
+        primaryName,
+        emailStem: isBot ? null : extractEmailStem(authorId),
+        isBot
+      };
+    }
+  );
   const groupsByStem = /* @__PURE__ */ new Map();
   for (const profile of profiles) {
     if (profile.emailStem === null || profile.emailStem.length < 4) {
@@ -3425,7 +3581,10 @@ var selectHotspots = (files, config) => {
   const sorted = [...files].sort(
     (a, b) => b.commitCount - a.commitCount || b.churnTotal - a.churnTotal || a.filePath.localeCompare(b.filePath)
   );
-  const hotspotCount = Math.max(config.hotspotMinFiles, Math.ceil(sorted.length * config.hotspotTopPercent));
+  const hotspotCount = Math.max(
+    config.hotspotMinFiles,
+    Math.ceil(sorted.length * config.hotspotTopPercent)
+  );
   const selected = sorted.slice(0, hotspotCount);
   const hotspots = selected.map((file, index) => ({
     filePath: file.filePath,
@@ -3734,7 +3893,10 @@ var GitCliHistoryProvider = class {
       "--find-renames"
     ]);
     onProgress?.({ stage: "git_log_received", bytes: Buffer.byteLength(output, "utf8") });
-    const commits = parseGitLog(output, (event) => onProgress?.(mapParseProgressToHistoryProgress(event)));
+    const commits = parseGitLog(
+      output,
+      (event) => onProgress?.(mapParseProgressToHistoryProgress(event))
+    );
     onProgress?.({ stage: "git_log_parsed", commits: commits.length });
     return commits;
   }
@@ -3920,7 +4082,10 @@ var dependencySignalWeightBudget = Object.values(dependencySignalWeights).reduce
   0
 );
 var computeDependencySignalScore = (ownSignals, inheritedSignals, inheritedSignalMultiplier) => {
-  const ownWeight = ownSignals.reduce((sum, signal) => sum + (dependencySignalWeights[signal] ?? 0), 0);
+  const ownWeight = ownSignals.reduce(
+    (sum, signal) => sum + (dependencySignalWeights[signal] ?? 0),
+    0
+  );
   const inheritedWeight = inheritedSignals.reduce(
     (sum, signal) => sum + (dependencySignalWeights[signal] ?? 0),
     0
@@ -3986,16 +4151,12 @@ var buildFactorTraces = (totalScore, inputs) => {
   }
   return traces;
 };
-var buildReductionLevers = (factors) => factors.filter((factor) => factor.contribution > 0).sort(
-  (a, b) => b.contribution - a.contribution || a.factorId.localeCompare(b.factorId)
-).slice(0, 3).map((factor) => ({
+var buildReductionLevers = (factors) => factors.filter((factor) => factor.contribution > 0).sort((a, b) => b.contribution - a.contribution || a.factorId.localeCompare(b.factorId)).slice(0, 3).map((factor) => ({
   factorId: factor.factorId,
   estimatedImpact: round45(factor.contribution)
 }));
 var buildTargetTrace = (targetType, targetId, totalScore, normalizedScore, factors) => {
-  const dominantFactors = [...factors].filter((factor) => factor.contribution > 0).sort(
-    (a, b) => b.contribution - a.contribution || a.factorId.localeCompare(b.factorId)
-  ).slice(0, 3).map((factor) => factor.factorId);
+  const dominantFactors = [...factors].filter((factor) => factor.contribution > 0).sort((a, b) => b.contribution - a.contribution || a.factorId.localeCompare(b.factorId)).slice(0, 3).map((factor) => factor.factorId);
   return {
     targetType,
     targetId,
@@ -4017,7 +4178,9 @@ var computeDependencyScores = (external, config) => {
   const transitiveCounts = external.dependencies.map(
     (dependency) => logScale(dependency.transitiveDependencies.length)
   );
-  const dependentCounts = external.dependencies.map((dependency) => logScale(dependency.dependents));
+  const dependentCounts = external.dependencies.map(
+    (dependency) => logScale(dependency.dependents)
+  );
   const chainDepths = external.dependencies.map((dependency) => dependency.dependencyDepth);
   const transitiveScale = buildQuantileScale(
     transitiveCounts,
@@ -4312,8 +4475,14 @@ var computeRiskSummary = (structural, evolution, external, config, traceCollecto
     let busFactorRisk = 0;
     const evolutionMetrics = evolutionByFile.get(filePath);
     if (evolution.available && evolutionMetrics !== void 0) {
-      frequencyRisk = normalizeWithScale(logScale(evolutionMetrics.commitCount), evolutionScales.commitCount);
-      churnRisk = normalizeWithScale(logScale(evolutionMetrics.churnTotal), evolutionScales.churnTotal);
+      frequencyRisk = normalizeWithScale(
+        logScale(evolutionMetrics.commitCount),
+        evolutionScales.commitCount
+      );
+      churnRisk = normalizeWithScale(
+        logScale(evolutionMetrics.churnTotal),
+        evolutionScales.churnTotal
+      );
       volatilityRisk = toUnitInterval(evolutionMetrics.recentVolatility);
       ownershipConcentrationRisk = toUnitInterval(evolutionMetrics.topAuthorShare);
       busFactorRisk = toUnitInterval(
@@ -4567,7 +4736,9 @@ var computeRiskSummary = (structural, evolution, external, config, traceCollecto
     externalPressure: round45(zone.externalPressure)
   }));
   if (collector !== void 0 && external.available) {
-    const dependencyByName = new Map(external.dependencies.map((dependency) => [dependency.name, dependency]));
+    const dependencyByName = new Map(
+      external.dependencies.map((dependency) => [dependency.name, dependency])
+    );
     for (const dependencyScore of dependencyComputation.dependencyScores) {
       const dependency = dependencyByName.get(dependencyScore.dependency);
       const context = dependencyComputation.dependencyContexts.get(dependencyScore.dependency);
@@ -4598,7 +4769,9 @@ var computeRiskSummary = (structural, evolution, external, config, traceCollecto
           normalizedMetrics: { stalenessRisk: context.stalenessRisk },
           weight: config.dependencyFactorWeights.staleness,
           amplification: null,
-          evidence: [{ kind: "dependency_metric", target: dependency.name, metric: "daysSinceLastRelease" }],
+          evidence: [
+            { kind: "dependency_metric", target: dependency.name, metric: "daysSinceLastRelease" }
+          ],
           confidence: hasMetadata ? 0.9 : 0.5
         },
         {
@@ -4611,7 +4784,9 @@ var computeRiskSummary = (structural, evolution, external, config, traceCollecto
           },
           weight: config.dependencyFactorWeights.maintainerConcentration,
           amplification: null,
-          evidence: [{ kind: "dependency_metric", target: dependency.name, metric: "maintainerCount" }],
+          evidence: [
+            { kind: "dependency_metric", target: dependency.name, metric: "maintainerCount" }
+          ],
           confidence: hasMetadata ? 0.9 : 0.5
         },
         {
@@ -4630,7 +4805,9 @@ var computeRiskSummary = (structural, evolution, external, config, traceCollecto
           },
           weight: config.dependencyFactorWeights.transitiveBurden + config.dependencyFactorWeights.centrality + config.dependencyFactorWeights.chainDepth,
           amplification: null,
-          evidence: [{ kind: "dependency_metric", target: dependency.name, metric: "dependencyDepth" }],
+          evidence: [
+            { kind: "dependency_metric", target: dependency.name, metric: "dependencyDepth" }
+          ],
           confidence: 1
         },
         {
@@ -4652,7 +4829,9 @@ var computeRiskSummary = (structural, evolution, external, config, traceCollecto
           normalizedMetrics: { popularityDampener: context.popularityDampener },
           weight: config.dependencySignals.popularityMaxDampening,
           amplification: null,
-          evidence: [{ kind: "dependency_metric", target: dependency.name, metric: "weeklyDownloads" }],
+          evidence: [
+            { kind: "dependency_metric", target: dependency.name, metric: "weeklyDownloads" }
+          ],
           confidence: context.rawMetrics.weeklyDownloads === null ? 0.4 : 0.9
         }
       ]);
@@ -5041,7 +5220,12 @@ var collectAnalysisInputs = async (inputPath, authorIdentityMode, options = {},
   };
 };
 var runAnalyzeCommand = async (inputPath, authorIdentityMode, options = {}, logger = createSilentLogger()) => {
-  const analysisInputs = await collectAnalysisInputs(inputPath, authorIdentityMode, options, logger);
+  const analysisInputs = await collectAnalysisInputs(
+    inputPath,
+    authorIdentityMode,
+    options,
+    logger
+  );
   logger.info("computing risk summary");
   const risk = computeRepositoryRiskSummary(analysisInputs);
   logger.info(`analysis completed (repositoryScore=${risk.repositoryScore})`);
@@ -5168,9 +5352,7 @@ var runCiCommand = async (inputPath, authorIdentityMode, options, logger = creat
     );
   }
   if (options.baselineSha !== void 0 && options.baselineRef !== "auto") {
-    throw new GovernanceConfigurationError(
-      "baseline-sha requires --baseline-ref auto"
-    );
+    throw new GovernanceConfigurationError("baseline-sha requires --baseline-ref auto");
   }
   const resolvedTargetPath = resolve4(inputPath ?? process.cwd());
   logger.info("building current snapshot");