@getcodesentinel/codesentinel 1.3.1

package/dist/index.js

@@ -0,0 +1,2685 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command, Option } from "commander";
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname, resolve as resolve3 } from "path";
+import { fileURLToPath } from "url";
+
+// src/application/format-analyze-output.ts
+var createSummaryShape = (summary) => ({
+  targetPath: summary.structural.targetPath,
+  structural: summary.structural.metrics,
+  evolution: summary.evolution.available ? {
+    available: true,
+    metrics: summary.evolution.metrics,
+    hotspotsTop: summary.evolution.hotspots.slice(0, 5).map((hotspot) => hotspot.filePath)
+  } : {
+    available: false,
+    reason: summary.evolution.reason
+  },
+  external: summary.external.available ? {
+    available: true,
+    metrics: summary.external.metrics,
+    highRiskDependenciesTop: summary.external.highRiskDependencies.slice(0, 10)
+  } : {
+    available: false,
+    reason: summary.external.reason
+  },
+  risk: {
+    repositoryScore: summary.risk.repositoryScore,
+    normalizedScore: summary.risk.normalizedScore,
+    hotspotsTop: summary.risk.hotspots.slice(0, 5).map((hotspot) => ({
+      file: hotspot.file,
+      score: hotspot.score
+    })),
+    fragileClusterCount: summary.risk.fragileClusters.length,
+    dependencyAmplificationZoneCount: summary.risk.dependencyAmplificationZones.length
+  }
+});
+var formatAnalyzeOutput = (summary, mode) => mode === "json" ? JSON.stringify(summary, null, 2) : JSON.stringify(createSummaryShape(summary), null, 2);
+
+// src/application/logger.ts
+var logLevelRank = {
+  error: 0,
+  warn: 1,
+  info: 2,
+  debug: 3
+};
+var noop = () => {
+};
+var createSilentLogger = () => ({
+  error: noop,
+  warn: noop,
+  info: noop,
+  debug: noop
+});
+var shouldLog = (configuredLevel, messageLevel) => {
+  if (configuredLevel === "silent") {
+    return false;
+  }
+  return logLevelRank[messageLevel] <= logLevelRank[configuredLevel];
+};
+var write = (messageLevel, message) => {
+  process.stderr.write(`[codesentinel] ${messageLevel.toUpperCase()} ${message}
+`);
+};
+var createStderrLogger = (level) => {
+  if (level === "silent") {
+    return createSilentLogger();
+  }
+  return {
+    error: (message) => {
+      if (shouldLog(level, "error")) {
+        write("error", message);
+      }
+    },
+    warn: (message) => {
+      if (shouldLog(level, "warn")) {
+        write("warn", message);
+      }
+    },
+    info: (message) => {
+      if (shouldLog(level, "info")) {
+        write("info", message);
+      }
+    },
+    debug: (message) => {
+      if (shouldLog(level, "debug")) {
+        write("debug", message);
+      }
+    }
+  };
+};
+var parseLogLevel = (value) => {
+  switch (value) {
+    case "silent":
+    case "error":
+    case "warn":
+    case "info":
+    case "debug":
+      return value;
+    default:
+      return "info";
+  }
+};
+
+// src/application/run-analyze-command.ts
+import { resolve as resolve2 } from "path";
+
+// ../code-graph/dist/index.js
+import { extname, isAbsolute, relative, resolve } from "path";
+import * as ts from "typescript";
+var edgeKey = (from, to) => `${from}\0${to}`;
+var createGraphData = (nodes, rawEdges) => {
+  const sortedNodes = [...nodes].sort((a, b) => a.id.localeCompare(b.id));
+  const knownNodeIds = new Set(sortedNodes.map((node) => node.id));
+  const uniqueEdgeMap = /* @__PURE__ */ new Map();
+  for (const edge of rawEdges) {
+    if (edge.from === edge.to) {
+      continue;
+    }
+    if (!knownNodeIds.has(edge.from) || !knownNodeIds.has(edge.to)) {
+      continue;
+    }
+    uniqueEdgeMap.set(edgeKey(edge.from, edge.to), edge);
+  }
+  const sortedEdges = [...uniqueEdgeMap.values()].sort((a, b) => {
+    const fromCompare = a.from.localeCompare(b.from);
+    if (fromCompare !== 0) {
+      return fromCompare;
+    }
+    return a.to.localeCompare(b.to);
+  });
+  const adjacency = /* @__PURE__ */ new Map();
+  for (const node of sortedNodes) {
+    adjacency.set(node.id, []);
+  }
+  for (const edge of sortedEdges) {
+    adjacency.get(edge.from)?.push(edge.to);
+  }
+  const adjacencyById = /* @__PURE__ */ new Map();
+  for (const [nodeId, targets] of adjacency.entries()) {
+    adjacencyById.set(nodeId, [...targets]);
+  }
+  return {
+    nodes: sortedNodes,
+    edges: sortedEdges,
+    adjacencyById
+  };
+};
+var runTarjanScc = (adjacencyById) => {
+  let index = 0;
+  const indices = /* @__PURE__ */ new Map();
+  const lowLink = /* @__PURE__ */ new Map();
+  const stack = [];
+  const onStack = /* @__PURE__ */ new Set();
+  const components = [];
+  const strongConnect = (nodeId) => {
+    indices.set(nodeId, index);
+    lowLink.set(nodeId, index);
+    index += 1;
+    stack.push(nodeId);
+    onStack.add(nodeId);
+    const neighbors = adjacencyById.get(nodeId) ?? [];
+    for (const nextId of neighbors) {
+      if (!indices.has(nextId)) {
+        strongConnect(nextId);
+        const nodeLowLink2 = lowLink.get(nodeId);
+        const nextLowLink = lowLink.get(nextId);
+        if (nodeLowLink2 !== void 0 && nextLowLink !== void 0 && nextLowLink < nodeLowLink2) {
+          lowLink.set(nodeId, nextLowLink);
+        }
+        continue;
+      }
+      if (onStack.has(nextId)) {
+        const nodeLowLink2 = lowLink.get(nodeId);
+        const nextIndex = indices.get(nextId);
+        if (nodeLowLink2 !== void 0 && nextIndex !== void 0 && nextIndex < nodeLowLink2) {
+          lowLink.set(nodeId, nextIndex);
+        }
+      }
+    }
+    const nodeLowLink = lowLink.get(nodeId);
+    const nodeIndex = indices.get(nodeId);
+    if (nodeLowLink === void 0 || nodeIndex === void 0 || nodeLowLink !== nodeIndex) {
+      return;
+    }
+    const component = [];
+    for (; ; ) {
+      const popped = stack.pop();
+      if (popped === void 0) {
+        break;
+      }
+      onStack.delete(popped);
+      component.push(popped);
+      if (popped === nodeId) {
+        break;
+      }
+    }
+    component.sort((a, b) => a.localeCompare(b));
+    components.push(component);
+  };
+  const nodeIds = [...adjacencyById.keys()].sort((a, b) => a.localeCompare(b));
+  for (const nodeId of nodeIds) {
+    if (!indices.has(nodeId)) {
+      strongConnect(nodeId);
+    }
+  }
+  components.sort((a, b) => {
+    const firstA = a[0] ?? "";
+    const firstB = b[0] ?? "";
+    return firstA.localeCompare(firstB);
+  });
+  return { components };
+};
+var hasSelfLoop = (nodeId, adjacencyById) => {
+  const targets = adjacencyById.get(nodeId) ?? [];
+  return targets.includes(nodeId);
+};
+var computeCyclesAndDepth = (graph) => {
+  const { components } = runTarjanScc(graph.adjacencyById);
+  const cycles = [];
+  const componentByNodeId = /* @__PURE__ */ new Map();
+  components.forEach((component, index) => {
+    for (const nodeId of component) {
+      componentByNodeId.set(nodeId, index);
+    }
+    if (component.length > 1) {
+      cycles.push({ nodes: [...component] });
+      return;
+    }
+    const onlyNode = component[0];
+    if (onlyNode !== void 0 && hasSelfLoop(onlyNode, graph.adjacencyById)) {
+      cycles.push({ nodes: [...component] });
+    }
+  });
+  const dagOutgoing = /* @__PURE__ */ new Map();
+  const inDegree = /* @__PURE__ */ new Map();
+  for (let i = 0; i < components.length; i += 1) {
+    dagOutgoing.set(i, /* @__PURE__ */ new Set());
+    inDegree.set(i, 0);
+  }
+  for (const edge of graph.edges) {
+    const fromComponent = componentByNodeId.get(edge.from);
+    const toComponent = componentByNodeId.get(edge.to);
+    if (fromComponent === void 0 || toComponent === void 0 || fromComponent === toComponent) {
+      continue;
+    }
+    const outgoing = dagOutgoing.get(fromComponent);
+    if (outgoing?.has(toComponent) === true) {
+      continue;
+    }
+    outgoing?.add(toComponent);
+    inDegree.set(toComponent, (inDegree.get(toComponent) ?? 0) + 1);
+  }
+  const queue = [];
+  const depthByComponent = /* @__PURE__ */ new Map();
+  for (let i = 0; i < components.length; i += 1) {
+    if ((inDegree.get(i) ?? 0) === 0) {
+      queue.push(i);
+      depthByComponent.set(i, 0);
+    }
+  }
+  let cursor = 0;
+  while (cursor < queue.length) {
+    const componentId = queue[cursor];
+    cursor += 1;
+    if (componentId === void 0) {
+      continue;
+    }
+    const currentDepth = depthByComponent.get(componentId) ?? 0;
+    const outgoing = dagOutgoing.get(componentId) ?? /* @__PURE__ */ new Set();
+    for (const nextComponent of outgoing) {
+      const nextDepth = depthByComponent.get(nextComponent) ?? 0;
+      if (currentDepth + 1 > nextDepth) {
+        depthByComponent.set(nextComponent, currentDepth + 1);
+      }
+      const remainingIncoming = (inDegree.get(nextComponent) ?? 0) - 1;
+      inDegree.set(nextComponent, remainingIncoming);
+      if (remainingIncoming === 0) {
+        queue.push(nextComponent);
+      }
+    }
+  }
+  const depthByNodeId = /* @__PURE__ */ new Map();
+  let graphDepth = 0;
+  components.forEach((component, componentId) => {
+    const componentDepth = depthByComponent.get(componentId) ?? 0;
+    if (componentDepth > graphDepth) {
+      graphDepth = componentDepth;
+    }
+    for (const nodeId of component) {
+      depthByNodeId.set(nodeId, componentDepth);
+    }
+  });
+  cycles.sort((a, b) => {
+    const firstA = a.nodes[0] ?? "";
+    const firstB = b.nodes[0] ?? "";
+    return firstA.localeCompare(firstB);
+  });
+  return {
+    depthByNodeId,
+    graphDepth,
+    cycles
+  };
+};
+var createGraphAnalysisSummary = (targetPath, graph) => {
+  const fanInById = /* @__PURE__ */ new Map();
+  const fanOutById = /* @__PURE__ */ new Map();
+  for (const node of graph.nodes) {
+    fanInById.set(node.id, 0);
+    fanOutById.set(node.id, graph.adjacencyById.get(node.id)?.length ?? 0);
+  }
+  for (const edge of graph.edges) {
+    fanInById.set(edge.to, (fanInById.get(edge.to) ?? 0) + 1);
+  }
+  const { cycles, depthByNodeId, graphDepth } = computeCyclesAndDepth(graph);
+  let maxFanIn = 0;
+  let maxFanOut = 0;
+  const files = graph.nodes.map((node) => {
+    const fanIn = fanInById.get(node.id) ?? 0;
+    const fanOut = fanOutById.get(node.id) ?? 0;
+    if (fanIn > maxFanIn) {
+      maxFanIn = fanIn;
+    }
+    if (fanOut > maxFanOut) {
+      maxFanOut = fanOut;
+    }
+    return {
+      id: node.id,
+      relativePath: node.relativePath,
+      directDependencies: graph.adjacencyById.get(node.id) ?? [],
+      fanIn,
+      fanOut,
+      depth: depthByNodeId.get(node.id) ?? 0
+    };
+  });
+  const metrics = {
+    nodeCount: graph.nodes.length,
+    edgeCount: graph.edges.length,
+    cycleCount: cycles.length,
+    graphDepth,
+    maxFanIn,
+    maxFanOut
+  };
+  return {
+    targetPath,
+    nodes: graph.nodes,
+    edges: graph.edges,
+    cycles,
+    files,
+    metrics
+  };
+};
+var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"]);
+var SCAN_EXCLUDES = [
+  "**/node_modules/**",
+  "**/.git/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/.next/**",
+  "**/coverage/**",
+  "**/.turbo/**",
+  "**/.cache/**",
+  "**/out/**"
+];
+var SCAN_INCLUDES = ["**/*"];
+var IGNORED_SEGMENTS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".next",
+  "coverage",
+  ".turbo",
+  ".cache",
+  "out"
+]);
+var normalizePath = (pathValue) => pathValue.replaceAll("\\", "/");
+var isProjectSourceFile = (filePath, projectRoot) => {
+  const extension = extname(filePath);
+  if (!SOURCE_EXTENSIONS.has(extension)) {
+    return false;
+  }
+  const relativePath = relative(projectRoot, filePath);
+  if (relativePath.startsWith("..")) {
+    return false;
+  }
+  const normalizedRelativePath = normalizePath(relativePath);
+  const segments = normalizedRelativePath.split("/");
+  return !segments.some((segment) => IGNORED_SEGMENTS.has(segment));
+};
+var discoverSourceFilesByScan = (projectRoot) => {
+  const files = ts.sys.readDirectory(
+    projectRoot,
+    [...SOURCE_EXTENSIONS],
+    SCAN_EXCLUDES,
+    SCAN_INCLUDES
+  );
+  return files.map((filePath) => resolve(filePath));
+};
+var parseTsConfigFile = (configPath) => {
+  const parsedCommandLine = ts.getParsedCommandLineOfConfigFile(
+    configPath,
+    {},
+    {
+      ...ts.sys,
+      onUnRecoverableConfigFileDiagnostic: () => {
+        throw new Error(`Failed to parse TypeScript configuration at ${configPath}`);
+      }
+    }
+  );
+  if (parsedCommandLine === void 0) {
+    throw new Error(`Failed to parse TypeScript configuration at ${configPath}`);
+  }
+  return parsedCommandLine;
+};
+var collectFilesFromTsConfigGraph = (projectRoot) => {
+  const rootConfigPath = ts.findConfigFile(projectRoot, ts.sys.fileExists, "tsconfig.json");
+  if (rootConfigPath === void 0) {
+    return null;
+  }
+  const visitedConfigPaths = /* @__PURE__ */ new Set();
+  const collectedFiles = /* @__PURE__ */ new Set();
+  let rootOptions = null;
+  const visitConfig = (configPath) => {
+    const absoluteConfigPath = resolve(configPath);
+    if (visitedConfigPaths.has(absoluteConfigPath)) {
+      return;
+    }
+    visitedConfigPaths.add(absoluteConfigPath);
+    const parsed = parseTsConfigFile(absoluteConfigPath);
+    if (rootOptions === null) {
+      rootOptions = parsed.options;
+    }
+    for (const filePath of parsed.fileNames) {
+      collectedFiles.add(resolve(filePath));
+    }
+    for (const reference of parsed.projectReferences ?? []) {
+      const referencePath = resolve(reference.path);
+      const referenceConfigPath = ts.sys.directoryExists(referencePath) ? ts.findConfigFile(referencePath, ts.sys.fileExists, "tsconfig.json") : referencePath;
+      if (referenceConfigPath !== void 0 && ts.sys.fileExists(referenceConfigPath)) {
+        visitConfig(referenceConfigPath);
+      }
+    }
+  };
+  visitConfig(rootConfigPath);
+  return {
+    fileNames: [...collectedFiles],
+    rootOptions: rootOptions ?? {
+      moduleResolution: ts.ModuleResolutionKind.NodeNext
+    },
+    visitedConfigCount: visitedConfigPaths.size
+  };
+};
+var createCompilerOptions = (base) => ({
+  ...base,
+  allowJs: true,
+  moduleResolution: base?.moduleResolution ?? ts.ModuleResolutionKind.NodeNext
+});
+var parseTsConfig = (projectRoot) => {
+  const collected = collectFilesFromTsConfigGraph(projectRoot);
+  if (collected === null) {
+    return {
+      fileNames: discoverSourceFilesByScan(projectRoot),
+      options: createCompilerOptions(void 0),
+      tsconfigCount: 0,
+      usedFallbackScan: true
+    };
+  }
+  if (collected.fileNames.length === 0) {
+    return {
+      fileNames: discoverSourceFilesByScan(projectRoot),
+      options: createCompilerOptions(collected.rootOptions),
+      tsconfigCount: collected.visitedConfigCount,
+      usedFallbackScan: true
+    };
+  }
+  return {
+    fileNames: collected.fileNames,
+    options: createCompilerOptions(collected.rootOptions),
+    tsconfigCount: collected.visitedConfigCount,
+    usedFallbackScan: false
+  };
+};
+var getSpecifierFromExpression = (expression) => {
+  if (ts.isStringLiteral(expression)) {
+    return expression.text;
+  }
+  if (ts.isNoSubstitutionTemplateLiteral(expression)) {
+    return expression.text;
+  }
+  return void 0;
+};
+var hasRuntimeImport = (importDeclaration) => {
+  const importClause = importDeclaration.importClause;
+  if (importClause === void 0) {
+    return true;
+  }
+  if (importClause.isTypeOnly) {
+    return false;
+  }
+  if (importClause.name !== void 0) {
+    return true;
+  }
+  const namedBindings = importClause.namedBindings;
+  if (namedBindings === void 0) {
+    return false;
+  }
+  if (ts.isNamespaceImport(namedBindings)) {
+    return true;
+  }
+  if (namedBindings.elements.length === 0) {
+    return true;
+  }
+  return namedBindings.elements.some((element) => !element.isTypeOnly);
+};
+var extractModuleSpecifiers = (sourceFile) => {
+  const specifiers = /* @__PURE__ */ new Set();
+  const visit = (node) => {
+    if (ts.isImportDeclaration(node)) {
+      if (hasRuntimeImport(node) && node.moduleSpecifier !== void 0) {
+        const specifier = getSpecifierFromExpression(node.moduleSpecifier);
+        if (specifier !== void 0) {
+          specifiers.add(specifier);
+        }
+      }
+      return;
+    }
+    if (ts.isExportDeclaration(node)) {
+      if (!node.isTypeOnly && node.moduleSpecifier !== void 0) {
+        const specifier = getSpecifierFromExpression(node.moduleSpecifier);
+        if (specifier !== void 0) {
+          specifiers.add(specifier);
+        }
+      }
+      return;
+    }
+    if (ts.isCallExpression(node)) {
+      if (node.expression.kind === ts.SyntaxKind.ImportKeyword && node.arguments.length > 0) {
+        const firstArgument = node.arguments[0];
+        if (firstArgument !== void 0) {
+          const specifier = getSpecifierFromExpression(firstArgument);
+          if (specifier !== void 0) {
+            specifiers.add(specifier);
+          }
+        }
+      }
+      if (ts.isIdentifier(node.expression) && node.expression.text === "require" && node.arguments.length > 0) {
+        const firstArgument = node.arguments[0];
+        if (firstArgument !== void 0) {
+          const specifier = getSpecifierFromExpression(firstArgument);
+          if (specifier !== void 0) {
+            specifiers.add(specifier);
+          }
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return [...specifiers];
+};
+var parseTypescriptProject = (projectPath, onProgress) => {
+  const projectRoot = isAbsolute(projectPath) ? projectPath : resolve(projectPath);
+  const { fileNames, options, tsconfigCount, usedFallbackScan } = parseTsConfig(projectRoot);
+  onProgress?.({ stage: "config_resolved", tsconfigCount, usedFallbackScan });
+  const sourceFilePaths = fileNames.filter((filePath) => isProjectSourceFile(filePath, projectRoot)).map((filePath) => normalizePath(resolve(filePath)));
+  const uniqueSourceFilePaths = [...new Set(sourceFilePaths)].sort((a, b) => a.localeCompare(b));
+  const sourceFilePathSet = new Set(uniqueSourceFilePaths);
+  onProgress?.({ stage: "files_discovered", totalSourceFiles: uniqueSourceFilePaths.length });
+  const program2 = ts.createProgram({
+    rootNames: uniqueSourceFilePaths,
+    options
+  });
+  onProgress?.({ stage: "program_created", totalSourceFiles: uniqueSourceFilePaths.length });
+  const nodeByAbsolutePath = /* @__PURE__ */ new Map();
+  for (const sourcePath of uniqueSourceFilePaths) {
+    const relativePath = normalizePath(relative(projectRoot, sourcePath));
+    const nodeId = relativePath;
+    nodeByAbsolutePath.set(sourcePath, {
+      id: nodeId,
+      absolutePath: sourcePath,
+      relativePath
+    });
+  }
+  const resolverCache = /* @__PURE__ */ new Map();
+  const edges = [];
+  for (const [index, sourcePath] of uniqueSourceFilePaths.entries()) {
+    const sourceFile = program2.getSourceFile(sourcePath);
+    if (sourceFile === void 0) {
+      continue;
+    }
+    const fromNode = nodeByAbsolutePath.get(sourcePath);
+    if (fromNode === void 0) {
+      continue;
+    }
+    const moduleSpecifiers = extractModuleSpecifiers(sourceFile);
+    for (const specifier of moduleSpecifiers) {
+      const cacheKey = `${sourcePath}\0${specifier}`;
+      let resolvedPath = resolverCache.get(cacheKey);
+      if (resolvedPath === void 0 && !resolverCache.has(cacheKey)) {
+        const resolved = ts.resolveModuleName(specifier, sourcePath, options, ts.sys).resolvedModule;
+        if (resolved !== void 0) {
+          resolvedPath = normalizePath(resolve(resolved.resolvedFileName));
+        }
+        resolverCache.set(cacheKey, resolvedPath);
+      }
+      if (resolvedPath === void 0 || !sourceFilePathSet.has(resolvedPath)) {
+        continue;
+      }
+      const toNode = nodeByAbsolutePath.get(resolvedPath);
+      if (toNode === void 0) {
+        continue;
+      }
+      edges.push({ from: fromNode.id, to: toNode.id });
+    }
+    const processed = index + 1;
+    if (processed === 1 || processed === uniqueSourceFilePaths.length || processed % 50 === 0) {
+      onProgress?.({
+        stage: "file_processed",
+        processed,
+        total: uniqueSourceFilePaths.length,
+        filePath: fromNode.id
+      });
+    }
+  }
+  onProgress?.({ stage: "edges_resolved", totalEdges: edges.length });
+  return {
+    nodes: [...nodeByAbsolutePath.values()],
+    edges
+  };
+};
+var buildProjectGraphSummary = (input) => {
+  const parsedProject = parseTypescriptProject(input.projectPath, input.onProgress);
+  const graphData = createGraphData(parsedProject.nodes, parsedProject.edges);
+  return createGraphAnalysisSummary(input.projectPath, graphData);
+};
+
+// ../dependency-firewall/dist/index.js
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var round4 = (value) => Number(value.toFixed(4));
+var normalizeNodes = (nodes) => {
+  const byName = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    const bucket = byName.get(node.name) ?? [];
+    bucket.push(node);
+    byName.set(node.name, bucket);
+  }
+  const normalized = [];
+  for (const [name, candidates] of byName.entries()) {
+    if (candidates.length === 0) {
+      continue;
+    }
+    candidates.sort((a, b) => b.version.localeCompare(a.version));
+    const selected = candidates[0];
+    if (selected === void 0) {
+      continue;
+    }
+    const deps = selected.dependencies.map((dep) => {
+      const at = dep.lastIndexOf("@");
+      return at <= 0 ? dep : dep.slice(0, at);
+    }).filter((depName) => depName.length > 0).sort((a, b) => a.localeCompare(b));
+    normalized.push({
+      key: `${name}@${selected.version}`,
+      name,
+      version: selected.version,
+      dependencies: deps
+    });
+  }
+  return normalized.sort((a, b) => a.name.localeCompare(b.name));
+};
+var computeDepths = (nodeByName, directNames) => {
+  const visiting = /* @__PURE__ */ new Set();
+  const depthByName = /* @__PURE__ */ new Map();
+  const compute = (name) => {
+    const known = depthByName.get(name);
+    if (known !== void 0) {
+      return known;
+    }
+    if (visiting.has(name)) {
+      return 0;
+    }
+    visiting.add(name);
+    const node = nodeByName.get(name);
+    if (node === void 0) {
+      visiting.delete(name);
+      depthByName.set(name, 0);
+      return 0;
+    }
+    let maxChildDepth = 0;
+    for (const dependencyName of node.dependencies) {
+      const childDepth = compute(dependencyName);
+      if (childDepth > maxChildDepth) {
+        maxChildDepth = childDepth;
+      }
+    }
+    visiting.delete(name);
+    const ownDepth = directNames.has(name) ? 0 : maxChildDepth + 1;
+    depthByName.set(name, ownDepth);
+    return ownDepth;
+  };
+  for (const name of nodeByName.keys()) {
+    compute(name);
+  }
+  let maxDepth = 0;
+  for (const depth of depthByName.values()) {
+    if (depth > maxDepth) {
+      maxDepth = depth;
+    }
+  }
+  return { depthByName, maxDepth };
+};
+var rankCentrality = (nodes, dependentsByName, directNames, topN) => [...nodes].map((node) => ({
+  name: node.name,
+  dependents: dependentsByName.get(node.name) ?? 0,
+  fanOut: node.dependencies.length,
+  direct: directNames.has(node.name)
+})).sort(
+  (a, b) => b.dependents - a.dependents || b.fanOut - a.fanOut || a.name.localeCompare(b.name)
+).slice(0, topN);
+var canPropagateSignal = (signal) => signal === "abandoned" || signal === "high_centrality" || signal === "deep_chain" || signal === "high_fanout";
+var collectTransitiveDependencies = (rootName, nodeByName) => {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...nodeByName.get(rootName)?.dependencies ?? []];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current === void 0 || seen.has(current) || current === rootName) {
+      continue;
+    }
+    seen.add(current);
+    const currentNode = nodeByName.get(current);
+    if (currentNode === void 0) {
+      continue;
+    }
+    for (const next of currentNode.dependencies) {
+      if (!seen.has(next)) {
+        stack.push(next);
+      }
+    }
+  }
+  return [...seen].sort((a, b) => a.localeCompare(b));
+};
+var buildExternalAnalysisSummary = (targetPath, extraction, metadataByKey, config) => {
+  const nodes = normalizeNodes(extraction.nodes);
+  const directNames = new Set(extraction.directDependencies.map((dep) => dep.name));
+  const directSpecByName = new Map(extraction.directDependencies.map((dep) => [dep.name, dep.requestedRange]));
+  const nodeByName = new Map(nodes.map((node) => [node.name, node]));
+  const dependentsByName = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    dependentsByName.set(node.name, dependentsByName.get(node.name) ?? 0);
+  }
+  for (const node of nodes) {
+    for (const dependencyName of node.dependencies) {
+      if (!nodeByName.has(dependencyName)) {
+        continue;
+      }
+      dependentsByName.set(dependencyName, (dependentsByName.get(dependencyName) ?? 0) + 1);
+    }
+  }
+  const { depthByName, maxDepth } = computeDepths(nodeByName, directNames);
+  const centralityRanking = rankCentrality(nodes, dependentsByName, directNames, config.centralityTopN);
+  const topCentralNames = new Set(
+    centralityRanking.slice(0, Math.max(1, Math.ceil(centralityRanking.length * 0.25))).map((entry) => entry.name)
+  );
+  const allDependencies = [];
+  let metadataAvailableCount = 0;
+  for (const node of nodes) {
+    const metadata = metadataByKey.get(node.key) ?? null;
+    if (metadata !== null) {
+      metadataAvailableCount += 1;
+    }
+    const dependencyDepth = depthByName.get(node.name) ?? 0;
+    const dependents = dependentsByName.get(node.name) ?? 0;
+    const riskSignals = [];
+    if ((metadata?.maintainerCount ?? 0) === 1) {
+      riskSignals.push("single_maintainer");
+    }
+    if ((metadata?.daysSinceLastRelease ?? 0) >= config.abandonedDaysThreshold) {
+      riskSignals.push("abandoned");
+    }
+    if (topCentralNames.has(node.name) && dependents > 0) {
+      riskSignals.push("high_centrality");
+    }
+    if (dependencyDepth >= config.deepChainThreshold) {
+      riskSignals.push("deep_chain");
+    }
+    if (node.dependencies.length >= config.fanOutHighThreshold) {
+      riskSignals.push("high_fanout");
+    }
+    if (metadata === null) {
+      riskSignals.push("metadata_unavailable");
+    }
+    allDependencies.push({
+      name: node.name,
+      direct: directNames.has(node.name),
+      requestedRange: directSpecByName.get(node.name) ?? null,
+      resolvedVersion: node.version,
+      transitiveDependencies: [],
+      dependencyDepth,
+      fanOut: node.dependencies.length,
+      dependents,
+      maintainerCount: metadata?.maintainerCount ?? null,
+      releaseFrequencyDays: metadata?.releaseFrequencyDays ?? null,
+      daysSinceLastRelease: metadata?.daysSinceLastRelease ?? null,
+      repositoryActivity30d: metadata?.repositoryActivity30d ?? null,
+      busFactor: metadata?.busFactor ?? null,
+      ownRiskSignals: [...riskSignals].sort((a, b) => a.localeCompare(b)),
+      inheritedRiskSignals: [],
+      riskSignals
+    });
+  }
+  allDependencies.sort((a, b) => a.name.localeCompare(b.name));
+  const allByName = new Map(allDependencies.map((dep) => [dep.name, dep]));
+  const dependencies = allDependencies.filter((dep) => dep.direct).map((dep) => {
+    const transitiveDependencies = collectTransitiveDependencies(dep.name, nodeByName);
+    const inheritedSignals = /* @__PURE__ */ new Set();
+    const allSignals = new Set(dep.ownRiskSignals);
+    for (const transitiveName of transitiveDependencies) {
+      const transitive = allByName.get(transitiveName);
+      if (transitive === void 0) {
+        continue;
+      }
+      for (const signal of transitive.riskSignals) {
+        if (canPropagateSignal(signal)) {
+          inheritedSignals.add(signal);
+          allSignals.add(signal);
+        }
+      }
+    }
+    return {
+      ...dep,
+      transitiveDependencies,
+      inheritedRiskSignals: [...inheritedSignals].sort((a, b) => a.localeCompare(b)),
+      riskSignals: [...allSignals].sort((a, b) => a.localeCompare(b))
+    };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+  const highRiskDependencies = dependencies.filter((dep) => dep.riskSignals.length > 1).sort((a, b) => b.riskSignals.length - a.riskSignals.length || a.name.localeCompare(b.name)).slice(0, config.maxHighRiskDependencies).map((dep) => dep.name);
+  const singleMaintainerDependencies = dependencies.filter((dep) => dep.ownRiskSignals.includes("single_maintainer")).map((dep) => dep.name).sort((a, b) => a.localeCompare(b));
+  const abandonedDependencies = dependencies.filter((dep) => dep.ownRiskSignals.includes("abandoned")).map((dep) => dep.name).sort((a, b) => a.localeCompare(b));
+  return {
+    targetPath,
+    available: true,
+    metrics: {
+      totalDependencies: allDependencies.length,
+      directDependencies: dependencies.length,
+      transitiveDependencies: allDependencies.length - dependencies.length,
+      dependencyDepth: maxDepth,
+      lockfileKind: extraction.kind,
+      metadataCoverage: allDependencies.length === 0 ? 0 : round4(metadataAvailableCount / allDependencies.length)
+    },
+    dependencies,
+    highRiskDependencies,
+    singleMaintainerDependencies,
+    abandonedDependencies,
+    centralityRanking
+  };
+};
+var DEFAULT_EXTERNAL_ANALYSIS_CONFIG = {
+  abandonedDaysThreshold: 540,
+  deepChainThreshold: 6,
+  fanOutHighThreshold: 25,
+  centralityTopN: 20,
+  maxHighRiskDependencies: 100,
+  metadataRequestConcurrency: 8
+};
+var LOCKFILE_CANDIDATES = [
+  { fileName: "pnpm-lock.yaml", kind: "pnpm" },
+  { fileName: "package-lock.json", kind: "npm" },
+  { fileName: "npm-shrinkwrap.json", kind: "npm-shrinkwrap" },
+  { fileName: "yarn.lock", kind: "yarn" },
+  { fileName: "bun.lock", kind: "bun" },
+  { fileName: "bun.lockb", kind: "bun" }
+];
+var loadPackageJson = (repositoryPath) => {
+  const packageJsonPath2 = join(repositoryPath, "package.json");
+  if (!existsSync(packageJsonPath2)) {
+    return null;
+  }
+  return {
+    path: packageJsonPath2,
+    raw: readFileSync(packageJsonPath2, "utf8")
+  };
+};
+var selectLockfile = (repositoryPath) => {
+  for (const candidate of LOCKFILE_CANDIDATES) {
+    const absolutePath = join(repositoryPath, candidate.fileName);
+    if (!existsSync(absolutePath)) {
+      continue;
+    }
+    return {
+      path: absolutePath,
+      kind: candidate.kind,
+      raw: readFileSync(absolutePath, "utf8")
+    };
+  }
+  return null;
+};
+var parsePackageJson = (raw) => {
+  const parsed = JSON.parse(raw);
+  const merged = /* @__PURE__ */ new Map();
+  for (const block of [
+    parsed.dependencies,
+    parsed.devDependencies,
+    parsed.optionalDependencies,
+    parsed.peerDependencies
+  ]) {
+    if (block === void 0) {
+      continue;
+    }
+    for (const [name, versionRange] of Object.entries(block)) {
+      merged.set(name, versionRange);
+    }
+  }
+  return [...merged.entries()].map(([name, requestedRange]) => ({ name, requestedRange })).sort((a, b) => a.name.localeCompare(b.name));
+};
+var parsePackageLock = (raw, directSpecs) => {
+  const parsed = JSON.parse(raw);
+  const nodes = [];
+  if (parsed.packages !== void 0) {
+    for (const [packagePath, packageData] of Object.entries(parsed.packages)) {
+      if (packagePath.length === 0 || packageData.version === void 0) {
+        continue;
+      }
+      const segments = packagePath.split("node_modules/");
+      const name = segments[segments.length - 1] ?? "";
+      if (name.length === 0) {
+        continue;
+      }
+      const dependencies = Object.entries(packageData.dependencies ?? {}).map(([depName, depRange]) => `${depName}@${String(depRange)}`).sort((a, b) => a.localeCompare(b));
+      nodes.push({
+        name,
+        version: packageData.version,
+        dependencies
+      });
+    }
+  } else if (parsed.dependencies !== void 0) {
+    for (const [name, dep] of Object.entries(parsed.dependencies)) {
+      if (dep.version === void 0) {
+        continue;
+      }
+      const dependencies = Object.entries(dep.dependencies ?? {}).map(([depName, depVersion]) => `${depName}@${String(depVersion)}`).sort((a, b) => a.localeCompare(b));
+      nodes.push({
+        name,
+        version: dep.version,
+        dependencies
+      });
+    }
+  }
+  nodes.sort((a, b) => a.name.localeCompare(b.name) || a.version.localeCompare(b.version));
+  return {
+    kind: "npm",
+    directDependencies: directSpecs,
+    nodes
+  };
+};
+var sanitizeValue = (value) => value.replace(/^['"]|['"]$/g, "").trim();
+var parsePackageKey = (rawKey) => {
+  const key = sanitizeValue(rawKey.replace(/:$/, ""));
+  const withoutSlash = key.startsWith("/") ? key.slice(1) : key;
+  const lastAt = withoutSlash.lastIndexOf("@");
+  if (lastAt <= 0) {
+    return null;
+  }
+  const name = withoutSlash.slice(0, lastAt);
+  const versionWithPeers = withoutSlash.slice(lastAt + 1);
+  const version2 = versionWithPeers.split("(")[0] ?? versionWithPeers;
+  if (name.length === 0 || version2.length === 0) {
+    return null;
+  }
+  return { name, version: version2 };
+};
+var parsePnpmLockfile = (raw, directSpecs) => {
+  const lines = raw.split("\n");
+  let state = "root";
+  let currentPackage = null;
+  let currentDependencyName = null;
+  const dependenciesByNode = /* @__PURE__ */ new Map();
+  for (const line of lines) {
+    if (line.trim().length === 0 || line.trimStart().startsWith("#")) {
+      continue;
+    }
+    if (line.startsWith("importers:")) {
+      state = "importers";
+      continue;
+    }
+    if (line.startsWith("packages:")) {
+      state = "packages";
+      continue;
+    }
+    if (state === "packages" || state === "packageDeps") {
+      const packageMatch = line.match(/^\s{2}([^\s].+):\s*$/);
+      if (packageMatch !== null) {
+        const parsedKey = parsePackageKey(packageMatch[1] ?? "");
+        if (parsedKey !== null) {
+          currentPackage = `${parsedKey.name}@${parsedKey.version}`;
+          dependenciesByNode.set(currentPackage, /* @__PURE__ */ new Set());
+          state = "packageDeps";
+          currentDependencyName = null;
+        }
+        continue;
+      }
+    }
+    if (state === "packageDeps" && currentPackage !== null) {
+      const depLine = line.match(/^\s{6}([^:\s]+):\s*(.+)$/);
+      if (depLine !== null) {
+        const depName = sanitizeValue(depLine[1] ?? "");
+        const depRef = sanitizeValue(depLine[2] ?? "");
+        const depVersion = depRef.split("(")[0] ?? depRef;
+        if (depName.length > 0 && depVersion.length > 0) {
+          dependenciesByNode.get(currentPackage)?.add(`${depName}@${depVersion}`);
+        }
+        currentDependencyName = null;
+        continue;
+      }
+      const depBlockLine = line.match(/^\s{6}([^:\s]+):\s*$/);
+      if (depBlockLine !== null) {
+        currentDependencyName = sanitizeValue(depBlockLine[1] ?? "");
+        continue;
+      }
+      const depVersionLine = line.match(/^\s{8}version:\s*(.+)$/);
+      if (depVersionLine !== null && currentDependencyName !== null) {
+        const depRef = sanitizeValue(depVersionLine[1] ?? "");
+        const depVersion = depRef.split("(")[0] ?? depRef;
+        if (depVersion.length > 0) {
+          dependenciesByNode.get(currentPackage)?.add(`${currentDependencyName}@${depVersion}`);
+        }
+        currentDependencyName = null;
+        continue;
+      }
+      if (line.match(/^\s{4}(dependencies|optionalDependencies):\s*$/) !== null) {
+        continue;
+      }
+    }
+  }
+  const nodes = [...dependenciesByNode.entries()].map(([nodeId, deps]) => {
+    const at = nodeId.lastIndexOf("@");
+    return {
+      name: nodeId.slice(0, at),
+      version: nodeId.slice(at + 1),
+      dependencies: [...deps].sort((a, b) => a.localeCompare(b))
+    };
+  }).sort(
+    (a, b) => a.name.localeCompare(b.name) || a.version.localeCompare(b.version)
+  );
+  return {
+    kind: "pnpm",
+    directDependencies: directSpecs,
+    nodes
+  };
+};
+var stripQuotes = (value) => value.replace(/^['"]|['"]$/g, "");
+var parseVersionSelector = (selector) => {
+  const npmIndex = selector.lastIndexOf("@npm:");
+  if (npmIndex >= 0) {
+    return selector.slice(npmIndex + 5);
+  }
+  const lastAt = selector.lastIndexOf("@");
+  if (lastAt <= 0) {
+    return null;
+  }
+  return selector.slice(lastAt + 1);
+};
+var parseYarnLock = (raw, directSpecs) => {
+  const lines = raw.split("\n");
+  const nodes = [];
+  let selectors = [];
+  let version2 = null;
+  let readingDependencies = false;
+  let dependencies = [];
+  const flushEntry = () => {
+    if (selectors.length === 0 || version2 === null) {
+      selectors = [];
+      version2 = null;
+      dependencies = [];
+      readingDependencies = false;
+      return;
+    }
+    for (const selector of selectors) {
+      const parsedVersion = parseVersionSelector(selector);
+      const at = selector.lastIndexOf("@");
+      const name = at <= 0 ? selector : selector.slice(0, at);
+      if (name.length === 0) {
+        continue;
+      }
+      nodes.push({
+        name,
+        version: version2,
+        dependencies: [...dependencies].sort((a, b) => a.localeCompare(b))
+      });
+      if (parsedVersion !== null) {
+        nodes.push({
+          name,
+          version: parsedVersion,
+          dependencies: [...dependencies].sort((a, b) => a.localeCompare(b))
+        });
+      }
+    }
+    selectors = [];
+    version2 = null;
+    dependencies = [];
+    readingDependencies = false;
+  };
+  for (const line of lines) {
+    if (line.trim().length === 0) {
+      continue;
+    }
+    if (!line.startsWith(" ") && line.endsWith(":")) {
+      flushEntry();
+      const keyText = line.slice(0, -1);
+      selectors = keyText.split(",").map((part) => stripQuotes(part.trim())).filter((part) => part.length > 0);
+      continue;
+    }
+    if (line.match(/^\s{2}version\s+/) !== null) {
+      const value = line.replace(/^\s{2}version\s+/, "").trim();
+      version2 = stripQuotes(value);
+      readingDependencies = false;
+      continue;
+    }
+    if (line.match(/^\s{2}dependencies:\s*$/) !== null) {
+      readingDependencies = true;
+      continue;
+    }
+    if (readingDependencies && line.match(/^\s{4}[^\s].+$/) !== null) {
+      const depLine = line.trim();
+      const firstSpace = depLine.indexOf(" ");
+      if (firstSpace <= 0) {
+        continue;
+      }
+      const depName = stripQuotes(depLine.slice(0, firstSpace));
+      const depRef = stripQuotes(depLine.slice(firstSpace + 1).trim());
+      const depVersion = parseVersionSelector(depRef) ?? depRef;
+      dependencies.push(`${depName}@${depVersion}`);
+      continue;
+    }
+    readingDependencies = false;
+  }
+  flushEntry();
+  const deduped = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    const key = `${node.name}@${node.version}`;
+    if (!deduped.has(key)) {
+      deduped.set(key, node);
+    }
+  }
+  return {
+    kind: "yarn",
+    directDependencies: directSpecs,
+    nodes: [...deduped.values()].sort((a, b) => a.name.localeCompare(b.name) || a.version.localeCompare(b.version))
+  };
+};
+var parseBunLock = (_raw, _directSpecs) => {
+  throw new Error("unsupported_lockfile_format");
+};
+var withDefaults = (overrides) => ({
+  ...DEFAULT_EXTERNAL_ANALYSIS_CONFIG,
+  ...overrides
+});
+var parseExtraction = (lockfileKind, lockfileRaw, directSpecs) => {
+  switch (lockfileKind) {
+    case "pnpm":
+      return parsePnpmLockfile(lockfileRaw, directSpecs);
+    case "npm":
+    case "npm-shrinkwrap":
+      return {
+        ...parsePackageLock(lockfileRaw, directSpecs),
+        kind: lockfileKind
+      };
+    case "yarn":
+      return parseYarnLock(lockfileRaw, directSpecs);
+    case "bun":
+      return parseBunLock(lockfileRaw, directSpecs);
+    default:
+      throw new Error("unsupported_lockfile_format");
+  }
+};
+var mapWithConcurrency = async (values, limit, handler) => {
+  const effectiveLimit = Math.max(1, limit);
+  const results = new Array(values.length);
+  let index = 0;
+  const workers = Array.from({ length: Math.min(effectiveLimit, values.length) }, async () => {
+    for (; ; ) {
+      const current = index;
+      index += 1;
+      if (current >= values.length) {
+        return;
+      }
+      const value = values[current];
+      if (value === void 0) {
+        return;
+      }
+      results[current] = await handler(value);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+};
+var analyzeDependencyExposure = async (input, metadataProvider, onProgress) => {
+  const packageJson = loadPackageJson(input.repositoryPath);
+  if (packageJson === null) {
+    return {
+      targetPath: input.repositoryPath,
+      available: false,
+      reason: "package_json_not_found"
+    };
+  }
+  onProgress?.({ stage: "package_json_loaded" });
+  const lockfile = selectLockfile(input.repositoryPath);
+  if (lockfile === null) {
+    return {
+      targetPath: input.repositoryPath,
+      available: false,
+      reason: "lockfile_not_found"
+    };
+  }
+  onProgress?.({ stage: "lockfile_selected", kind: lockfile.kind });
+  try {
+    const directSpecs = parsePackageJson(packageJson.raw);
+    const extraction = parseExtraction(lockfile.kind, lockfile.raw, directSpecs);
+    const config = withDefaults(input.config);
+    onProgress?.({
+      stage: "lockfile_parsed",
+      dependencyNodes: extraction.nodes.length,
+      directDependencies: extraction.directDependencies.length
+    });
+    onProgress?.({ stage: "metadata_fetch_started", total: extraction.nodes.length });
+    let completed = 0;
+    const metadataEntries = await mapWithConcurrency(
+      extraction.nodes,
+      config.metadataRequestConcurrency,
+      async (node) => {
+        const result = {
+          key: `${node.name}@${node.version}`,
+          metadata: await metadataProvider.getMetadata(node.name, node.version)
+        };
+        completed += 1;
+        onProgress?.({
+          stage: "metadata_fetch_progress",
+          completed,
+          total: extraction.nodes.length,
+          packageName: node.name
+        });
+        return result;
+      }
+    );
+    onProgress?.({ stage: "metadata_fetch_completed", total: extraction.nodes.length });
+    const metadataByKey = /* @__PURE__ */ new Map();
+    for (const entry of metadataEntries) {
+      metadataByKey.set(entry.key, entry.metadata);
+    }
+    const summary = buildExternalAnalysisSummary(input.repositoryPath, extraction, metadataByKey, config);
+    if (summary.available) {
+      onProgress?.({
+        stage: "summary_built",
+        totalDependencies: summary.metrics.totalDependencies,
+        directDependencies: summary.metrics.directDependencies
+      });
+    }
+    return summary;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "unknown";
+    if (message.includes("unsupported_lockfile_format")) {
+      return {
+        targetPath: input.repositoryPath,
+        available: false,
+        reason: "unsupported_lockfile_format"
+      };
+    }
+    return {
+      targetPath: input.repositoryPath,
+      available: false,
+      reason: "invalid_lockfile"
+    };
+  }
+};
+var ONE_DAY_MS = 24 * 60 * 60 * 1e3;
+var round42 = (value) => Number(value.toFixed(4));
+var parseDate = (iso) => {
+  if (iso === void 0) {
+    return null;
+  }
+  const value = Date.parse(iso);
+  return Number.isNaN(value) ? null : value;
+};
+var NpmRegistryMetadataProvider = class {
+  cache = /* @__PURE__ */ new Map();
+  async getMetadata(name, version2) {
+    const key = `${name}@${version2}`;
+    if (this.cache.has(key)) {
+      return this.cache.get(key) ?? null;
+    }
+    try {
+      const encodedName = encodeURIComponent(name);
+      const response = await fetch(`https://registry.npmjs.org/${encodedName}`);
+      if (!response.ok) {
+        this.cache.set(key, null);
+        return null;
+      }
+      const payload = await response.json();
+      const timeEntries = payload.time ?? {};
+      const publishDates = Object.entries(timeEntries).filter(([tag]) => tag !== "created" && tag !== "modified").map(([, date]) => parseDate(date)).filter((value) => value !== null).sort((a, b) => a - b);
+      const modifiedAt = parseDate(timeEntries["modified"]);
+      const now = Date.now();
+      const daysSinceLastRelease = modifiedAt === null ? null : Math.max(0, round42((now - modifiedAt) / ONE_DAY_MS));
+      let releaseFrequencyDays = null;
+      if (publishDates.length >= 2) {
+        const totalIntervals = publishDates.length - 1;
+        let sum = 0;
+        for (let i = 1; i < publishDates.length; i += 1) {
+          const current = publishDates[i];
+          const previous = publishDates[i - 1];
+          if (current !== void 0 && previous !== void 0) {
+            sum += current - previous;
+          }
+        }
+        releaseFrequencyDays = round42(sum / totalIntervals / ONE_DAY_MS);
+      }
+      const maintainers = payload.maintainers ?? [];
+      const maintainerCount = maintainers.length > 0 ? maintainers.length : null;
+      const metadata = {
+        name,
+        version: version2,
+        maintainerCount,
+        releaseFrequencyDays,
+        daysSinceLastRelease,
+        repositoryActivity30d: null,
+        busFactor: null
+      };
+      this.cache.set(key, metadata);
+      return metadata;
+    } catch {
+      this.cache.set(key, null);
+      return null;
+    }
+  }
+};
+var NoopMetadataProvider = class {
+  async getMetadata(_name, _version) {
+    return null;
+  }
+};
+var analyzeDependencyExposureFromProject = async (input, onProgress) => {
+  const metadataProvider = process.env["CODESENTINEL_EXTERNAL_METADATA"] === "none" ? new NoopMetadataProvider() : new NpmRegistryMetadataProvider();
+  return analyzeDependencyExposure(input, metadataProvider, onProgress);
+};
+
+// ../git-analyzer/dist/index.js
+import { execFileSync } from "child_process";
+var pairKey = (a, b) => `${a}\0${b}`;
+var round43 = (value) => Number(value.toFixed(4));
+var normalizeName = (value) => value.toLowerCase().replace(/[^a-z0-9\s]/g, " ").replace(/\s+/g, " ").trim();
+var extractEmailStem = (authorId) => {
+  const normalized = authorId.trim().toLowerCase();
+  const githubNoReplyMatch = normalized.match(/^\d+\+([^@]+)@users\.noreply\.github\.com$/);
+  if (githubNoReplyMatch?.[1] !== void 0) {
+    return githubNoReplyMatch[1].replace(/[._+-]/g, "");
+  }
+  const atIndex = normalized.indexOf("@");
+  if (atIndex <= 0) {
+    return null;
+  }
+  return normalized.slice(0, atIndex).replace(/[._+-]/g, "");
+};
+var areNamesCompatible = (left, right) => {
+  if (left.length === 0 || right.length === 0) {
+    return false;
+  }
+  if (left === right) {
+    return true;
+  }
+  if (left.startsWith(`${right} `) || right.startsWith(`${left} `)) {
+    return true;
+  }
+  return false;
+};
+var chooseCanonicalAuthorId = (profiles) => {
+  const ordered = [...profiles].sort((a, b) => {
+    const aIsNoReply = a.authorId.includes("@users.noreply.github.com");
+    const bIsNoReply = b.authorId.includes("@users.noreply.github.com");
+    if (aIsNoReply !== bIsNoReply) {
+      return aIsNoReply ? 1 : -1;
+    }
+    if (a.commitCount !== b.commitCount) {
+      return b.commitCount - a.commitCount;
+    }
+    return a.authorId.localeCompare(b.authorId);
+  });
+  return ordered[0]?.authorId ?? "";
+};
+var buildAuthorAliasMap = (commits) => {
+  const nameCountsByAuthorId = /* @__PURE__ */ new Map();
+  const commitCountByAuthorId = /* @__PURE__ */ new Map();
+  for (const commit of commits) {
+    commitCountByAuthorId.set(commit.authorId, (commitCountByAuthorId.get(commit.authorId) ?? 0) + 1);
+    const normalizedName = normalizeName(commit.authorName);
+    const names = nameCountsByAuthorId.get(commit.authorId) ?? /* @__PURE__ */ new Map();
+    if (normalizedName.length > 0) {
+      names.set(normalizedName, (names.get(normalizedName) ?? 0) + 1);
+    }
+    nameCountsByAuthorId.set(commit.authorId, names);
+  }
+  const profiles = [...commitCountByAuthorId.entries()].map(([authorId, commitCount]) => {
+    const names = nameCountsByAuthorId.get(authorId);
+    const primaryName = names === void 0 ? "" : [...names.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))[0]?.[0] ?? "";
+    const normalizedAuthorId = authorId.toLowerCase();
+    const isBot = normalizedAuthorId.includes("[bot]");
+    return {
+      authorId,
+      commitCount,
+      primaryName,
+      emailStem: isBot ? null : extractEmailStem(authorId),
+      isBot
+    };
+  });
+  const groupsByStem = /* @__PURE__ */ new Map();
+  for (const profile of profiles) {
+    if (profile.emailStem === null || profile.emailStem.length < 4) {
+      continue;
+    }
+    const current = groupsByStem.get(profile.emailStem) ?? [];
+    current.push(profile);
+    groupsByStem.set(profile.emailStem, current);
+  }
+  const aliasMap = /* @__PURE__ */ new Map();
+  for (const profile of profiles) {
+    aliasMap.set(profile.authorId, profile.authorId);
+  }
+  for (const group of groupsByStem.values()) {
+    if (group.length < 2) {
+      continue;
+    }
+    const compatible = [];
+    for (const profile of group) {
+      if (profile.isBot || profile.primaryName.length === 0) {
+        continue;
+      }
+      compatible.push(profile);
+    }
+    if (compatible.length < 2) {
+      continue;
+    }
+    const canonical = chooseCanonicalAuthorId(compatible);
+    const canonicalProfile = compatible.find((candidate) => candidate.authorId === canonical);
+    if (canonicalProfile === void 0) {
+      continue;
+    }
+    for (const profile of compatible) {
+      if (areNamesCompatible(profile.primaryName, canonicalProfile.primaryName)) {
+        aliasMap.set(profile.authorId, canonical);
+      }
+    }
+  }
+  return aliasMap;
+};
+var computeBusFactor = (authorDistribution, threshold) => {
+  if (authorDistribution.length === 0) {
+    return 0;
+  }
+  let coveredShare = 0;
+  for (let i = 0; i < authorDistribution.length; i += 1) {
+    const entry = authorDistribution[i];
+    if (entry === void 0) {
+      continue;
+    }
+    coveredShare += entry.share;
+    if (coveredShare >= threshold) {
+      return i + 1;
+    }
+  }
+  return authorDistribution.length;
+};
+var finalizeAuthorDistribution = (authorCommits) => {
+  const totalCommits = [...authorCommits.values()].reduce((sum, value) => sum + value, 0);
+  if (totalCommits === 0) {
+    return [];
+  }
+  return [...authorCommits.entries()].map(([authorId, commits]) => ({
+    authorId,
+    commits,
+    share: round43(commits / totalCommits)
+  })).sort((a, b) => b.commits - a.commits || a.authorId.localeCompare(b.authorId));
+};
+var buildCouplingMatrix = (coChangeByPair, fileCommitCount, consideredCommits, skippedLargeCommits, maxCouplingPairs) => {
+  const allPairs = [];
+  for (const [key, coChangeCommits] of coChangeByPair.entries()) {
+    const [fileA, fileB] = key.split("\0");
+    if (fileA === void 0 || fileB === void 0) {
+      continue;
+    }
+    const fileACommits = fileCommitCount.get(fileA) ?? 0;
+    const fileBCommits = fileCommitCount.get(fileB) ?? 0;
+    const denominator = fileACommits + fileBCommits - coChangeCommits;
+    const couplingScore = denominator === 0 ? 0 : round43(coChangeCommits / denominator);
+    allPairs.push({
+      fileA,
+      fileB,
+      coChangeCommits,
+      couplingScore
+    });
+  }
+  allPairs.sort(
+    (a, b) => b.coChangeCommits - a.coChangeCommits || b.couplingScore - a.couplingScore || a.fileA.localeCompare(b.fileA) || a.fileB.localeCompare(b.fileB)
+  );
+  const truncated = allPairs.length > maxCouplingPairs;
+  return {
+    pairs: truncated ? allPairs.slice(0, maxCouplingPairs) : allPairs,
+    totalPairCount: allPairs.length,
+    consideredCommits,
+    skippedLargeCommits,
+    truncated
+  };
+};
+var selectHotspots = (files, config) => {
+  if (files.length === 0) {
+    return { hotspots: [], threshold: 0 };
+  }
+  const sorted = [...files].sort(
+    (a, b) => b.commitCount - a.commitCount || b.churnTotal - a.churnTotal || a.filePath.localeCompare(b.filePath)
+  );
+  const hotspotCount = Math.max(config.hotspotMinFiles, Math.ceil(sorted.length * config.hotspotTopPercent));
+  const selected = sorted.slice(0, hotspotCount);
+  const hotspots = selected.map((file, index) => ({
+    filePath: file.filePath,
+    rank: index + 1,
+    commitCount: file.commitCount,
+    churnTotal: file.churnTotal
+  }));
+  const threshold = selected[selected.length - 1]?.commitCount ?? 0;
+  return { hotspots, threshold };
+};
+var computeRepositoryEvolutionSummary = (targetPath, commits, config) => {
+  const authorAliasById = config.authorIdentityMode === "likely_merge" ? buildAuthorAliasMap(commits) : /* @__PURE__ */ new Map();
+  const fileStats = /* @__PURE__ */ new Map();
+  const coChangeByPair = /* @__PURE__ */ new Map();
+  const headCommitTimestamp = commits.length === 0 ? null : commits[commits.length - 1]?.authoredAtUnix ?? null;
+  const recentWindowStart = headCommitTimestamp === null ? Number.NEGATIVE_INFINITY : headCommitTimestamp - config.recentWindowDays * 24 * 60 * 60;
+  let consideredCommits = 0;
+  let skippedLargeCommits = 0;
+  for (const commit of commits) {
+    const uniqueFiles = /* @__PURE__ */ new Set();
+    for (const fileChange of commit.fileChanges) {
+      uniqueFiles.add(fileChange.filePath);
+      const current = fileStats.get(fileChange.filePath) ?? {
+        commitCount: 0,
+        recentCommitCount: 0,
+        churnAdded: 0,
+        churnDeleted: 0,
+        authors: /* @__PURE__ */ new Map()
+      };
+      current.churnAdded += fileChange.additions;
+      current.churnDeleted += fileChange.deletions;
+      fileStats.set(fileChange.filePath, current);
+    }
+    for (const filePath of uniqueFiles) {
+      const current = fileStats.get(filePath);
+      if (current === void 0) {
+        continue;
+      }
+      current.commitCount += 1;
+      if (commit.authoredAtUnix >= recentWindowStart) {
+        current.recentCommitCount += 1;
+      }
+      const effectiveAuthorId = authorAliasById.get(commit.authorId) ?? commit.authorId;
+      current.authors.set(effectiveAuthorId, (current.authors.get(effectiveAuthorId) ?? 0) + 1);
+    }
+    const orderedFiles = [...uniqueFiles].sort((a, b) => a.localeCompare(b));
+    if (orderedFiles.length > 1) {
+      if (orderedFiles.length <= config.maxFilesPerCommitForCoupling) {
+        consideredCommits += 1;
+        for (let i = 0; i < orderedFiles.length - 1; i += 1) {
+          for (let j = i + 1; j < orderedFiles.length; j += 1) {
+            const fileA = orderedFiles[i];
+            const fileB = orderedFiles[j];
+            if (fileA === void 0 || fileB === void 0) {
+              continue;
+            }
+            const key = pairKey(fileA, fileB);
+            coChangeByPair.set(key, (coChangeByPair.get(key) ?? 0) + 1);
+          }
+        }
+      } else {
+        skippedLargeCommits += 1;
+      }
+    }
+  }
+  const files = [...fileStats.entries()].map(([filePath, stats]) => {
+    const authorDistribution = finalizeAuthorDistribution(stats.authors);
+    const topAuthorShare = authorDistribution[0]?.share ?? 0;
+    return {
+      filePath,
+      commitCount: stats.commitCount,
+      frequencyPer100Commits: commits.length === 0 ? 0 : round43(stats.commitCount / commits.length * 100),
+      churnAdded: stats.churnAdded,
+      churnDeleted: stats.churnDeleted,
+      churnTotal: stats.churnAdded + stats.churnDeleted,
+      recentCommitCount: stats.recentCommitCount,
+      recentVolatility: stats.commitCount === 0 ? 0 : round43(stats.recentCommitCount / stats.commitCount),
+      topAuthorShare,
+      busFactor: computeBusFactor(authorDistribution, config.busFactorCoverageThreshold),
+      authorDistribution
+    };
+  }).sort((a, b) => a.filePath.localeCompare(b.filePath));
+  const fileCommitCount = new Map(files.map((file) => [file.filePath, file.commitCount]));
+  const coupling = buildCouplingMatrix(
+    coChangeByPair,
+    fileCommitCount,
+    consideredCommits,
+    skippedLargeCommits,
+    config.maxCouplingPairs
+  );
+  const { hotspots, threshold } = selectHotspots(files, config);
+  return {
+    targetPath,
+    available: true,
+    files,
+    hotspots,
+    coupling,
+    metrics: {
+      totalCommits: commits.length,
+      totalFiles: files.length,
+      headCommitTimestamp,
+      recentWindowDays: config.recentWindowDays,
+      hotspotTopPercent: config.hotspotTopPercent,
+      hotspotThresholdCommitCount: threshold
+    }
+  };
+};
+var DEFAULT_EVOLUTION_CONFIG = {
+  authorIdentityMode: "likely_merge",
+  recentWindowDays: 30,
+  hotspotTopPercent: 0.1,
+  hotspotMinFiles: 1,
+  maxFilesPerCommitForCoupling: 200,
+  maxCouplingPairs: 500,
+  busFactorCoverageThreshold: 0.6
+};
+var createEffectiveConfig = (overrides) => ({
+  ...DEFAULT_EVOLUTION_CONFIG,
+  ...overrides
+});
+var analyzeRepositoryEvolution = (input, historyProvider, onProgress) => {
+  onProgress?.({ stage: "checking_git_repository" });
+  if (!historyProvider.isGitRepository(input.repositoryPath)) {
+    onProgress?.({ stage: "not_git_repository" });
+    return {
+      targetPath: input.repositoryPath,
+      available: false,
+      reason: "not_git_repository"
+    };
+  }
+  onProgress?.({ stage: "loading_commit_history" });
+  const commits = historyProvider.getCommitHistory(
+    input.repositoryPath,
+    (event) => onProgress?.({ stage: "history", event })
+  );
+  const config = createEffectiveConfig(input.config);
+  onProgress?.({ stage: "computing_metrics" });
+  const summary = computeRepositoryEvolutionSummary(input.repositoryPath, commits, config);
+  onProgress?.({ stage: "analysis_completed", available: summary.available });
+  return summary;
+};
+var GitCommandError = class extends Error {
+  args;
+  constructor(message, args) {
+    super(message);
+    this.name = "GitCommandError";
+    this.args = args;
+  }
+};
+var ExecGitCommandClient = class {
+  run(repositoryPath, args) {
+    try {
+      return execFileSync("git", ["-C", repositoryPath, ...args], {
+        encoding: "utf8",
+        maxBuffer: 1024 * 1024 * 64,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown git execution error";
+      throw new GitCommandError(message, args);
+    }
+  }
+};
+var COMMIT_RECORD_SEPARATOR = "";
+var COMMIT_FIELD_SEPARATOR = "";
+var GIT_LOG_FORMAT = `%x1e%H%x1f%at%x1f%an%x1f%ae`;
+var mapParseProgressToHistoryProgress = (event) => ({
+  stage: "git_log_parse_progress",
+  parsedRecords: event.parsedRecords,
+  totalRecords: event.totalRecords
+});
+var parseInteger = (value) => {
+  if (value.length === 0) {
+    return null;
+  }
+  const parsed = Number.parseInt(value, 10);
+  if (Number.isNaN(parsed)) {
+    return null;
+  }
+  return parsed;
+};
+var normalizeAuthorIdentity = (authorName, authorEmail) => {
+  const normalizedName = authorName.trim().replace(/\s+/g, " ").toLowerCase();
+  const normalizedEmail = authorEmail.trim().toLowerCase();
+  if (/\[bot\]/i.test(normalizedName) || /\[bot\]/i.test(normalizedEmail)) {
+    return normalizedEmail.length > 0 ? normalizedEmail : normalizedName;
+  }
+  const githubNoReplyMatch = normalizedEmail.match(/^\d+\+([^@]+)@users\.noreply\.github\.com$/);
+  const githubHandle = githubNoReplyMatch?.[1]?.trim().toLowerCase();
+  if (githubHandle !== void 0 && githubHandle.length > 0) {
+    return `${githubHandle}@users.noreply.github.com`;
+  }
+  if (normalizedEmail.length > 0) {
+    return normalizedEmail;
+  }
+  return normalizedName;
+};
+var parseRenamedPath = (pathSpec) => {
+  if (!pathSpec.includes(" => ")) {
+    return pathSpec;
+  }
+  const braceRenameMatch = pathSpec.match(/^(.*)\{(.+) => (.+)\}(.*)$/);
+  if (braceRenameMatch !== null) {
+    const [, prefix, , renamedTo, suffix] = braceRenameMatch;
+    return `${prefix}${renamedTo}${suffix}`;
+  }
+  const parts = pathSpec.split(" => ");
+  const finalPart = parts[parts.length - 1];
+  return finalPart ?? pathSpec;
+};
+var parseNumstatLine = (line) => {
+  const parts = line.split("	");
+  if (parts.length < 3) {
+    return null;
+  }
+  const additionsRaw = parts[0];
+  const deletionsRaw = parts[1];
+  const pathRaw = parts.slice(2).join("	");
+  if (additionsRaw === void 0 || deletionsRaw === void 0) {
+    return null;
+  }
+  const additions = additionsRaw === "-" ? 0 : parseInteger(additionsRaw);
+  const deletions = deletionsRaw === "-" ? 0 : parseInteger(deletionsRaw);
+  if (additions === null || deletions === null) {
+    return null;
+  }
+  const filePath = parseRenamedPath(pathRaw);
+  return {
+    filePath,
+    additions,
+    deletions
+  };
+};
+var parseGitLog = (rawLog, onProgress) => {
+  const records = rawLog.split(COMMIT_RECORD_SEPARATOR).map((record) => record.trim()).filter((record) => record.length > 0);
+  const commits = [];
+  for (const [index, record] of records.entries()) {
+    const lines = record.split("\n").map((line) => line.trimEnd()).filter((line) => line.length > 0);
+    if (lines.length === 0) {
+      continue;
+    }
+    const headerParts = lines[0]?.split(COMMIT_FIELD_SEPARATOR) ?? [];
+    if (headerParts.length !== 4) {
+      continue;
+    }
+    const [hash, authoredAtRaw, authorName, authorEmail] = headerParts;
+    if (hash === void 0 || authoredAtRaw === void 0 || authorName === void 0 || authorEmail === void 0) {
+      continue;
+    }
+    const authoredAtUnix = parseInteger(authoredAtRaw);
+    if (authoredAtUnix === null) {
+      continue;
+    }
+    const fileChanges = [];
+    for (const line of lines.slice(1)) {
+      const parsedLine = parseNumstatLine(line);
+      if (parsedLine !== null) {
+        fileChanges.push(parsedLine);
+      }
+    }
+    commits.push({
+      hash,
+      authorId: normalizeAuthorIdentity(authorName, authorEmail),
+      authorName,
+      authoredAtUnix,
+      fileChanges
+    });
+    const parsedRecords = index + 1;
+    if (parsedRecords === 1 || parsedRecords === records.length || parsedRecords % 500 === 0) {
+      onProgress?.({ parsedRecords, totalRecords: records.length });
+    }
+  }
+  commits.sort((a, b) => a.authoredAtUnix - b.authoredAtUnix || a.hash.localeCompare(b.hash));
+  return commits;
+};
+var NON_GIT_CODES = ["not a git repository", "not in a git directory"];
+var isNotGitError = (error) => {
+  const lower = error.message.toLowerCase();
+  return NON_GIT_CODES.some((code) => lower.includes(code));
+};
+var GitCliHistoryProvider = class {
+  constructor(gitClient) {
+    this.gitClient = gitClient;
+  }
+  isGitRepository(repositoryPath) {
+    try {
+      const output = this.gitClient.run(repositoryPath, ["rev-parse", "--is-inside-work-tree"]);
+      return output.trim() === "true";
+    } catch (error) {
+      if (error instanceof GitCommandError && isNotGitError(error)) {
+        return false;
+      }
+      throw error;
+    }
+  }
+  getCommitHistory(repositoryPath, onProgress) {
+    const output = this.gitClient.run(repositoryPath, [
+      "-c",
+      "core.quotepath=false",
+      "log",
+      "--use-mailmap",
+      "--no-merges",
+      "--date=unix",
+      `--pretty=format:${GIT_LOG_FORMAT}`,
+      "--numstat",
+      "--find-renames"
+    ]);
+    onProgress?.({ stage: "git_log_received", bytes: Buffer.byteLength(output, "utf8") });
+    const commits = parseGitLog(output, (event) => onProgress?.(mapParseProgressToHistoryProgress(event)));
+    onProgress?.({ stage: "git_log_parsed", commits: commits.length });
+    return commits;
+  }
+};
+var analyzeRepositoryEvolutionFromGit = (input, onProgress) => {
+  const historyProvider = new GitCliHistoryProvider(new ExecGitCommandClient());
+  return analyzeRepositoryEvolution(input, historyProvider, onProgress);
+};
+
+// ../risk-engine/dist/index.js
+var DEFAULT_RISK_ENGINE_CONFIG = {
+  // Base dimensional influence. Risk is never dominated by a single dimension by default.
+  dimensionWeights: {
+    structural: 0.44,
+    evolution: 0.36,
+    external: 0.2
+  },
+  // Interaction terms activate only when both related dimensions are high.
+  interactionWeights: {
+    structuralEvolution: 0.35,
+    centralInstability: 0.25,
+    dependencyAmplification: 0.2
+  },
+  structuralFactorWeights: {
+    fanIn: 0.3,
+    fanOut: 0.25,
+    depth: 0.2,
+    cycleParticipation: 0.25
+  },
+  evolutionFactorWeights: {
+    frequency: 0.26,
+    churn: 0.24,
+    recentVolatility: 0.2,
+    ownershipConcentration: 0.18,
+    busFactorRisk: 0.12
+  },
+  dependencyFactorWeights: {
+    signals: 0.38,
+    staleness: 0.16,
+    maintainerConcentration: 0.16,
+    transitiveBurden: 0.1,
+    centrality: 0.08,
+    chainDepth: 0.06,
+    busFactorRisk: 0.06
+  },
+  quantileClamp: {
+    lower: 0.05,
+    upper: 0.95
+  },
+  hotspotTopPercent: 0.12,
+  hotspotMinFiles: 3,
+  hotspotMaxFiles: 30,
+  couplingCluster: {
+    minCoChangeCommits: 2,
+    percentileThreshold: 0.9,
+    floorScore: 0.35
+  },
+  amplificationZone: {
+    pressureFloor: 0.2,
+    percentileThreshold: 0.85,
+    maxZones: 20
+  },
+  module: {
+    maxPrefixSegments: 2,
+    rootLabel: "(root)",
+    commonSourceRoots: ["src", "lib", "app", "packages"]
+  },
+  dependencySignals: {
+    inheritedSignalMultiplier: 0.45,
+    // At this age, staleness reaches 50% risk.
+    abandonedHalfLifeDays: 540,
+    missingMetadataPenalty: 0.5
+  },
+  externalDimension: {
+    topDependencyPercentile: 0.85,
+    dependencyDepthHalfLife: 6
+  }
+};
+var clamp01 = (value) => {
+  if (Number.isNaN(value)) {
+    return 0;
+  }
+  if (value <= 0) {
+    return 0;
+  }
+  if (value >= 1) {
+    return 1;
+  }
+  return value;
+};
+var round44 = (value) => Number(value.toFixed(4));
+var average = (values) => {
+  if (values.length === 0) {
+    return 0;
+  }
+  const total = values.reduce((sum, current) => sum + current, 0);
+  return total / values.length;
+};
+var percentile = (values, p) => {
+  if (values.length === 0) {
+    return 0;
+  }
+  if (values.length === 1) {
+    return values[0] ?? 0;
+  }
+  const sorted = [...values].sort((a, b) => a - b);
+  const position = clamp01(p) * (sorted.length - 1);
+  const lowerIndex = Math.floor(position);
+  const upperIndex = Math.ceil(position);
+  const lower = sorted[lowerIndex] ?? 0;
+  const upper = sorted[upperIndex] ?? lower;
+  if (lowerIndex === upperIndex) {
+    return lower;
+  }
+  const ratio = position - lowerIndex;
+  return lower + (upper - lower) * ratio;
+};
+var saturatingComposite = (baseline, amplifications) => {
+  let value = clamp01(baseline);
+  for (const amplification of amplifications) {
+    const boundedAmplification = clamp01(amplification);
+    value += (1 - value) * boundedAmplification;
+  }
+  return clamp01(value);
+};
+var halfLifeRisk = (value, halfLife) => {
+  if (value <= 0 || halfLife <= 0) {
+    return 0;
+  }
+  return clamp01(value / (value + halfLife));
+};
+var normalizeWeights = (weights, enabled) => {
+  let total = 0;
+  const result = { ...weights };
+  for (const key of Object.keys(result)) {
+    const enabledValue = enabled[key];
+    if (!enabledValue) {
+      result[key] = 0;
+      continue;
+    }
+    const value = Math.max(0, result[key]);
+    result[key] = value;
+    total += value;
+  }
+  if (total === 0) {
+    const activeKeys = Object.keys(result).filter((key) => enabled[key]);
+    if (activeKeys.length === 0) {
+      return result;
+    }
+    const uniform = 1 / activeKeys.length;
+    for (const key of activeKeys) {
+      result[key] = uniform;
+    }
+    return result;
+  }
+  for (const key of Object.keys(result)) {
+    if (enabled[key]) {
+      result[key] = result[key] / total;
+    }
+  }
+  return result;
+};
+var logScale = (value) => Math.log1p(Math.max(0, value));
+var buildQuantileScale = (values, lowerPercentile, upperPercentile) => {
+  if (values.length === 0) {
+    return { lower: 0, upper: 0 };
+  }
+  return {
+    lower: percentile(values, lowerPercentile),
+    upper: percentile(values, upperPercentile)
+  };
+};
+var normalizeWithScale = (value, scale) => {
+  if (scale.upper <= scale.lower) {
+    return value > 0 ? 1 : 0;
+  }
+  return clamp01((value - scale.lower) / (scale.upper - scale.lower));
+};
+var normalizePath2 = (path) => path.replaceAll("\\", "/");
+var dependencySignalWeights = {
+  single_maintainer: 0.3,
+  abandoned: 0.3,
+  high_centrality: 0.16,
+  deep_chain: 0.14,
+  high_fanout: 0.06,
+  metadata_unavailable: 0.04
+};
+var dependencySignalWeightBudget = Object.values(dependencySignalWeights).reduce(
+  (sum, value) => sum + value,
+  0
+);
+var computeDependencySignalScore = (ownSignals, inheritedSignals, inheritedSignalMultiplier) => {
+  const ownWeight = ownSignals.reduce((sum, signal) => sum + (dependencySignalWeights[signal] ?? 0), 0);
+  const inheritedWeight = inheritedSignals.reduce(
+    (sum, signal) => sum + (dependencySignalWeights[signal] ?? 0),
+    0
+  );
+  const weightedTotal = ownWeight + inheritedWeight * inheritedSignalMultiplier;
+  const maxWeightedTotal = dependencySignalWeightBudget * (1 + inheritedSignalMultiplier);
+  if (maxWeightedTotal <= 0) {
+    return 0;
+  }
+  return clamp01(weightedTotal / maxWeightedTotal);
+};
+var computeDependencyScores = (external, config) => {
+  if (!external.available) {
+    return {
+      dependencyScores: [],
+      repositoryExternalPressure: 0
+    };
+  }
+  const transitiveCounts = external.dependencies.map(
+    (dependency) => logScale(dependency.transitiveDependencies.length)
+  );
+  const dependentCounts = external.dependencies.map((dependency) => logScale(dependency.dependents));
+  const chainDepths = external.dependencies.map((dependency) => dependency.dependencyDepth);
+  const transitiveScale = buildQuantileScale(
+    transitiveCounts,
+    config.quantileClamp.lower,
+    config.quantileClamp.upper
+  );
+  const dependentScale = buildQuantileScale(
+    dependentCounts,
+    config.quantileClamp.lower,
+    config.quantileClamp.upper
+  );
+  const chainDepthScale = buildQuantileScale(
+    chainDepths,
+    config.quantileClamp.lower,
+    config.quantileClamp.upper
+  );
+  const dependencyScores = external.dependencies.map((dependency) => {
+    const signalScore = computeDependencySignalScore(
+      dependency.ownRiskSignals,
+      dependency.inheritedRiskSignals,
+      config.dependencySignals.inheritedSignalMultiplier
+    );
+    const maintainerConcentrationRisk = dependency.maintainerCount === null ? config.dependencySignals.missingMetadataPenalty : clamp01(1 / Math.max(1, dependency.maintainerCount));
+    const stalenessRisk = dependency.daysSinceLastRelease === null ? config.dependencySignals.missingMetadataPenalty : halfLifeRisk(
+      dependency.daysSinceLastRelease,
+      config.dependencySignals.abandonedHalfLifeDays
+    );
+    const transitiveBurdenRisk = normalizeWithScale(
+      logScale(dependency.transitiveDependencies.length),
+      transitiveScale
+    );
+    const centralityRisk = normalizeWithScale(logScale(dependency.dependents), dependentScale);
+    const chainDepthRisk = normalizeWithScale(dependency.dependencyDepth, chainDepthScale);
+    const busFactorRisk = dependency.busFactor === null ? config.dependencySignals.missingMetadataPenalty : clamp01(1 / Math.max(1, dependency.busFactor));
+    const weights = config.dependencyFactorWeights;
+    const normalizedScore = clamp01(
+      signalScore * weights.signals + stalenessRisk * weights.staleness + maintainerConcentrationRisk * weights.maintainerConcentration + transitiveBurdenRisk * weights.transitiveBurden + centralityRisk * weights.centrality + chainDepthRisk * weights.chainDepth + busFactorRisk * weights.busFactorRisk
+    );
+    return {
+      dependency: dependency.name,
+      score: round44(normalizedScore * 100),
+      normalizedScore: round44(normalizedScore),
+      ownRiskSignals: dependency.ownRiskSignals,
+      inheritedRiskSignals: dependency.inheritedRiskSignals
+    };
+  }).sort(
+    (a, b) => b.normalizedScore - a.normalizedScore || a.dependency.localeCompare(b.dependency)
+  );
+  const normalizedValues = dependencyScores.map((score) => score.normalizedScore);
+  const highDependencyRisk = dependencyScores.length === 0 ? 0 : percentile(normalizedValues, config.externalDimension.topDependencyPercentile);
+  const averageDependencyRisk = average(normalizedValues);
+  const depthRisk = halfLifeRisk(
+    external.metrics.dependencyDepth,
+    config.externalDimension.dependencyDepthHalfLife
+  );
+  const repositoryExternalPressure = clamp01(
+    highDependencyRisk * 0.5 + averageDependencyRisk * 0.3 + depthRisk * 0.2
+  );
+  return {
+    dependencyScores,
+    repositoryExternalPressure: round44(repositoryExternalPressure)
+  };
+};
+var mapEvolutionByFile = (evolution) => {
+  if (!evolution.available) {
+    return /* @__PURE__ */ new Map();
+  }
+  return new Map(
+    evolution.files.map((fileMetrics) => [normalizePath2(fileMetrics.filePath), fileMetrics])
+  );
+};
+var computeEvolutionScales = (evolutionByFile, config) => {
+  const evolutionFiles = [...evolutionByFile.values()];
+  return {
+    commitCount: buildQuantileScale(
+      evolutionFiles.map((metrics) => logScale(metrics.commitCount)),
+      config.quantileClamp.lower,
+      config.quantileClamp.upper
+    ),
+    churnTotal: buildQuantileScale(
+      evolutionFiles.map((metrics) => logScale(metrics.churnTotal)),
+      config.quantileClamp.lower,
+      config.quantileClamp.upper
+    ),
+    busFactor: buildQuantileScale(
+      evolutionFiles.map((metrics) => metrics.busFactor),
+      config.quantileClamp.lower,
+      config.quantileClamp.upper
+    )
+  };
+};
+var inferModuleName = (filePath, config) => {
+  const normalized = normalizePath2(filePath);
+  const parts = normalized.split("/").filter((part) => part.length > 0);
+  if (parts.length <= 1) {
+    return config.module.rootLabel;
+  }
+  const first = parts[0];
+  if (first === void 0) {
+    return config.module.rootLabel;
+  }
+  if (!config.module.commonSourceRoots.includes(first)) {
+    return first;
+  }
+  if (parts.length <= config.module.maxPrefixSegments) {
+    return first;
+  }
+  return parts.slice(0, config.module.maxPrefixSegments).join("/");
+};
+var buildFragileClusters = (structural, evolution, fileScoresByFile, config) => {
+  const clusters = [];
+  let cycleClusterCount = 0;
+  for (const cycle of structural.cycles) {
+    const files = [...new Set(cycle.nodes.map((node) => normalizePath2(node)))].filter(
+      (filePath) => fileScoresByFile.has(filePath)
+    );
+    if (files.length < 2) {
+      continue;
+    }
+    files.sort((a, b) => a.localeCompare(b));
+    const averageRisk = average(
+      files.map((filePath) => fileScoresByFile.get(filePath)?.normalizedScore ?? 0)
+    );
+    const cycleSizeRisk = clamp01((files.length - 1) / 5);
+    const score = round44(clamp01(averageRisk * 0.75 + cycleSizeRisk * 0.25) * 100);
+    cycleClusterCount += 1;
+    clusters.push({
+      id: `cycle:${cycleClusterCount}`,
+      kind: "structural_cycle",
+      files,
+      score
+    });
+  }
+  if (evolution.available && evolution.coupling.pairs.length > 0) {
+    const candidates = evolution.coupling.pairs.filter(
+      (pair) => pair.coChangeCommits >= config.couplingCluster.minCoChangeCommits
+    );
+    const threshold = Math.max(
+      config.couplingCluster.floorScore,
+      percentile(
+        candidates.map((pair) => pair.couplingScore),
+        config.couplingCluster.percentileThreshold
+      )
+    );
+    const selectedPairs = candidates.filter((pair) => pair.couplingScore >= threshold).map((pair) => ({
+      fileA: normalizePath2(pair.fileA),
+      fileB: normalizePath2(pair.fileB),
+      couplingScore: pair.couplingScore
+    })).filter(
+      (pair) => pair.fileA !== pair.fileB && fileScoresByFile.has(pair.fileA) && fileScoresByFile.has(pair.fileB)
+    );
+    const adjacency = /* @__PURE__ */ new Map();
+    for (const pair of selectedPairs) {
+      const aNeighbors = adjacency.get(pair.fileA) ?? /* @__PURE__ */ new Set();
+      aNeighbors.add(pair.fileB);
+      adjacency.set(pair.fileA, aNeighbors);
+      const bNeighbors = adjacency.get(pair.fileB) ?? /* @__PURE__ */ new Set();
+      bNeighbors.add(pair.fileA);
+      adjacency.set(pair.fileB, bNeighbors);
+    }
+    const visited = /* @__PURE__ */ new Set();
+    let couplingClusterCount = 0;
+    const orderedStarts = [...adjacency.keys()].sort((a, b) => a.localeCompare(b));
+    for (const start of orderedStarts) {
+      if (visited.has(start)) {
+        continue;
+      }
+      const stack = [start];
+      const files = [];
+      while (stack.length > 0) {
+        const current = stack.pop();
+        if (current === void 0 || visited.has(current)) {
+          continue;
+        }
+        visited.add(current);
+        files.push(current);
+        const neighbors = adjacency.get(current);
+        if (neighbors === void 0) {
+          continue;
+        }
+        for (const neighbor of neighbors) {
+          if (!visited.has(neighbor)) {
+            stack.push(neighbor);
+          }
+        }
+      }
+      if (files.length < 2) {
+        continue;
+      }
+      files.sort((a, b) => a.localeCompare(b));
+      const fileSet = new Set(files);
+      const componentPairs = selectedPairs.filter(
+        (pair) => fileSet.has(pair.fileA) && fileSet.has(pair.fileB)
+      );
+      const meanFileRisk = average(
+        files.map((filePath) => fileScoresByFile.get(filePath)?.normalizedScore ?? 0)
+      );
+      const meanCoupling = average(componentPairs.map((pair) => pair.couplingScore));
+      const score = round44(clamp01(meanFileRisk * 0.65 + meanCoupling * 0.35) * 100);
+      couplingClusterCount += 1;
+      clusters.push({
+        id: `coupling:${couplingClusterCount}`,
+        kind: "change_coupling",
+        files,
+        score
+      });
+    }
+  }
+  return clusters.sort(
+    (a, b) => b.score - a.score || a.kind.localeCompare(b.kind) || a.id.localeCompare(b.id)
+  );
+};
+var computeRiskSummary = (structural, evolution, external, config) => {
+  const dependencyComputation = computeDependencyScores(external, config);
+  const evolutionByFile = mapEvolutionByFile(evolution);
+  const evolutionScales = computeEvolutionScales(evolutionByFile, config);
+  const cycleFileSet = new Set(
+    structural.cycles.flatMap((cycle) => cycle.nodes.map((node) => normalizePath2(node)))
+  );
+  const fanInScale = buildQuantileScale(
+    structural.files.map((file) => logScale(file.fanIn)),
+    config.quantileClamp.lower,
+    config.quantileClamp.upper
+  );
+  const fanOutScale = buildQuantileScale(
+    structural.files.map((file) => logScale(file.fanOut)),
+    config.quantileClamp.lower,
+    config.quantileClamp.upper
+  );
+  const depthScale = buildQuantileScale(
+    structural.files.map((file) => file.depth),
+    config.quantileClamp.lower,
+    config.quantileClamp.upper
+  );
+  const dimensionWeights = normalizeWeights(config.dimensionWeights, {
+    structural: true,
+    evolution: evolution.available,
+    external: external.available
+  });
+  const fileRiskContexts = structural.files.map((file) => {
+    const filePath = normalizePath2(file.id);
+    const inCycle = cycleFileSet.has(filePath) ? 1 : 0;
+    const fanInRisk = normalizeWithScale(logScale(file.fanIn), fanInScale);
+    const fanOutRisk = normalizeWithScale(logScale(file.fanOut), fanOutScale);
+    const depthRisk = normalizeWithScale(file.depth, depthScale);
+    const structuralWeights = config.structuralFactorWeights;
+    const structuralFactor = clamp01(
+      fanInRisk * structuralWeights.fanIn + fanOutRisk * structuralWeights.fanOut + depthRisk * structuralWeights.depth + inCycle * structuralWeights.cycleParticipation
+    );
+    const structuralCentrality = clamp01((fanInRisk + fanOutRisk) / 2);
+    let evolutionFactor = 0;
+    const evolutionMetrics = evolutionByFile.get(filePath);
+    if (evolution.available && evolutionMetrics !== void 0) {
+      const frequencyRisk = normalizeWithScale(
+        logScale(evolutionMetrics.commitCount),
+        evolutionScales.commitCount
+      );
+      const churnRisk = normalizeWithScale(
+        logScale(evolutionMetrics.churnTotal),
+        evolutionScales.churnTotal
+      );
+      const volatilityRisk = clamp01(evolutionMetrics.recentVolatility);
+      const ownershipConcentrationRisk = clamp01(evolutionMetrics.topAuthorShare);
+      const busFactorRisk = clamp01(1 - normalizeWithScale(evolutionMetrics.busFactor, evolutionScales.busFactor));
+      const evolutionWeights = config.evolutionFactorWeights;
+      evolutionFactor = clamp01(
+        frequencyRisk * evolutionWeights.frequency + churnRisk * evolutionWeights.churn + volatilityRisk * evolutionWeights.recentVolatility + ownershipConcentrationRisk * evolutionWeights.ownershipConcentration + busFactorRisk * evolutionWeights.busFactorRisk
+      );
+    }
+    const dependencyAffinity = clamp01(structuralCentrality * 0.6 + evolutionFactor * 0.4);
+    const externalFactor = external.available ? clamp01(dependencyComputation.repositoryExternalPressure * dependencyAffinity) : 0;
+    const baseline = structuralFactor * dimensionWeights.structural + evolutionFactor * dimensionWeights.evolution + externalFactor * dimensionWeights.external;
+    const interactions = [
+      structuralFactor * evolutionFactor * config.interactionWeights.structuralEvolution,
+      structuralCentrality * evolutionFactor * config.interactionWeights.centralInstability,
+      externalFactor * Math.max(structuralFactor, evolutionFactor) * config.interactionWeights.dependencyAmplification
+    ];
+    const normalizedScore = saturatingComposite(baseline, interactions);
+    return {
+      file: filePath,
+      score: round44(normalizedScore * 100),
+      normalizedScore: round44(normalizedScore),
+      factors: {
+        structural: round44(structuralFactor),
+        evolution: round44(evolutionFactor),
+        external: round44(externalFactor)
+      },
+      structuralCentrality: round44(structuralCentrality)
+    };
+  }).sort((a, b) => b.score - a.score || a.file.localeCompare(b.file));
+  const fileScores = fileRiskContexts.map((context) => ({
+    file: context.file,
+    score: context.score,
+    normalizedScore: context.normalizedScore,
+    factors: context.factors
+  }));
+  const fileScoresByFile = new Map(fileScores.map((fileScore) => [fileScore.file, fileScore]));
+  const hotspotsCount = Math.min(
+    config.hotspotMaxFiles,
+    Math.max(config.hotspotMinFiles, Math.ceil(fileScores.length * config.hotspotTopPercent))
+  );
+  const hotspots = fileScores.slice(0, hotspotsCount).map((fileScore) => ({
+    file: fileScore.file,
+    score: fileScore.score,
+    factors: fileScore.factors
+  }));
+  const moduleFiles = /* @__PURE__ */ new Map();
+  for (const fileScore of fileScores) {
+    const moduleName = inferModuleName(fileScore.file, config);
+    const values = moduleFiles.get(moduleName) ?? [];
+    values.push(fileScore.normalizedScore);
+    moduleFiles.set(moduleName, values);
+  }
+  const moduleScores = [...moduleFiles.entries()].map(([module, values]) => {
+    const averageScore = average(values);
+    const peakScore = values.reduce((max, value) => Math.max(max, value), 0);
+    const normalizedScore = clamp01(averageScore * 0.65 + peakScore * 0.35);
+    return {
+      module,
+      score: round44(normalizedScore * 100),
+      normalizedScore: round44(normalizedScore),
+      fileCount: values.length
+    };
+  }).sort((a, b) => b.score - a.score || a.module.localeCompare(b.module));
+  const fragileClusters = buildFragileClusters(structural, evolution, fileScoresByFile, config);
+  const externalPressures = fileScores.map((fileScore) => fileScore.factors.external);
+  const pressureThreshold = Math.max(
+    config.amplificationZone.pressureFloor,
+    percentile(externalPressures, config.amplificationZone.percentileThreshold)
+  );
+  const dependencyAmplificationZones = fileScores.map((fileScore) => {
+    const intensity = clamp01(
+      fileScore.factors.external * Math.max(fileScore.factors.structural, fileScore.factors.evolution)
+    );
+    const normalizedZoneScore = clamp01(intensity * 0.7 + fileScore.normalizedScore * 0.3);
+    return {
+      file: fileScore.file,
+      score: round44(normalizedZoneScore * 100),
+      externalPressure: fileScore.factors.external
+    };
+  }).filter((zone) => external.available && zone.externalPressure >= pressureThreshold).sort((a, b) => b.score - a.score || a.file.localeCompare(b.file)).slice(0, config.amplificationZone.maxZones).map((zone) => ({
+    ...zone,
+    externalPressure: round44(zone.externalPressure)
+  }));
+  const structuralDimension = average(fileScores.map((fileScore) => fileScore.factors.structural));
+  const evolutionDimension = average(fileScores.map((fileScore) => fileScore.factors.evolution));
+  const externalDimension = dependencyComputation.repositoryExternalPressure;
+  const topCentralSlice = Math.max(1, Math.ceil(fileRiskContexts.length * 0.1));
+  const criticalInstability = average(
+    [...fileRiskContexts].sort(
+      (a, b) => b.structuralCentrality * b.factors.evolution - a.structuralCentrality * a.factors.evolution || a.file.localeCompare(b.file)
+    ).slice(0, topCentralSlice).map((context) => context.structuralCentrality * context.factors.evolution)
+  );
+  const dependencyAmplification = average(
+    dependencyAmplificationZones.map(
+      (zone) => clamp01(zone.externalPressure * zone.score / 100)
+    )
+  );
+  const repositoryBaseline = structuralDimension * dimensionWeights.structural + evolutionDimension * dimensionWeights.evolution + externalDimension * dimensionWeights.external;
+  const repositoryNormalizedScore = saturatingComposite(repositoryBaseline, [
+    structuralDimension * evolutionDimension * config.interactionWeights.structuralEvolution,
+    criticalInstability * config.interactionWeights.centralInstability,
+    dependencyAmplification * config.interactionWeights.dependencyAmplification
+  ]);
+  return {
+    repositoryScore: round44(repositoryNormalizedScore * 100),
+    normalizedScore: round44(repositoryNormalizedScore),
+    hotspots,
+    fragileClusters,
+    dependencyAmplificationZones,
+    fileScores,
+    moduleScores,
+    dependencyScores: dependencyComputation.dependencyScores
+  };
+};
+var mergeConfig = (overrides) => {
+  if (overrides === void 0) {
+    return DEFAULT_RISK_ENGINE_CONFIG;
+  }
+  return {
+    ...DEFAULT_RISK_ENGINE_CONFIG,
+    ...overrides,
+    dimensionWeights: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.dimensionWeights,
+      ...overrides.dimensionWeights
+    },
+    interactionWeights: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.interactionWeights,
+      ...overrides.interactionWeights
+    },
+    structuralFactorWeights: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.structuralFactorWeights,
+      ...overrides.structuralFactorWeights
+    },
+    evolutionFactorWeights: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.evolutionFactorWeights,
+      ...overrides.evolutionFactorWeights
+    },
+    dependencyFactorWeights: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.dependencyFactorWeights,
+      ...overrides.dependencyFactorWeights
+    },
+    quantileClamp: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.quantileClamp,
+      ...overrides.quantileClamp
+    },
+    couplingCluster: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.couplingCluster,
+      ...overrides.couplingCluster
+    },
+    amplificationZone: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.amplificationZone,
+      ...overrides.amplificationZone
+    },
+    module: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.module,
+      ...overrides.module
+    },
+    dependencySignals: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.dependencySignals,
+      ...overrides.dependencySignals
+    },
+    externalDimension: {
+      ...DEFAULT_RISK_ENGINE_CONFIG.externalDimension,
+      ...overrides.externalDimension
+    }
+  };
+};
+var computeRepositoryRiskSummary = (input) => {
+  const config = mergeConfig(input.config);
+  return computeRiskSummary(input.structural, input.evolution, input.external, config);
+};
+
+// src/application/run-analyze-command.ts
+var resolveTargetPath = (inputPath, cwd) => resolve2(cwd, inputPath ?? ".");
+var createExternalProgressReporter = (logger) => {
+  let lastLoggedProgress = 0;
+  return (event) => {
+    switch (event.stage) {
+      case "package_json_loaded":
+        logger.debug("external: package.json loaded");
+        break;
+      case "lockfile_selected":
+        logger.info(`external: lockfile selected (${event.kind})`);
+        break;
+      case "lockfile_parsed":
+        logger.info(
+          `external: parsed ${event.dependencyNodes} locked dependencies (${event.directDependencies} direct)`
+        );
+        break;
+      case "metadata_fetch_started":
+        logger.info(`external: fetching dependency metadata (${event.total} packages)`);
+        break;
+      case "metadata_fetch_progress": {
+        const currentPercent = event.total === 0 ? 100 : Math.floor(event.completed / event.total * 100);
+        if (event.completed === event.total || event.completed === 1 || event.completed - lastLoggedProgress >= 25) {
+          lastLoggedProgress = event.completed;
+          logger.info(
+            `external: metadata progress ${event.completed}/${event.total} (${currentPercent}%)`
+          );
+          logger.debug(`external: last package processed ${event.packageName}`);
+        }
+        break;
+      }
+      case "metadata_fetch_completed":
+        logger.info(`external: metadata fetch completed (${event.total} packages)`);
+        break;
+      case "summary_built":
+        logger.info(
+          `external: summary built (${event.totalDependencies} total, ${event.directDependencies} direct)`
+        );
+        break;
+    }
+  };
+};
+var createStructuralProgressReporter = (logger) => {
+  let lastProcessed = 0;
+  return (event) => {
+    switch (event.stage) {
+      case "config_resolved":
+        if (event.usedFallbackScan) {
+          logger.info(
+            `structural: using filesystem scan discovery (tsconfigs=${event.tsconfigCount})`
+          );
+        } else {
+          logger.info(`structural: discovered tsconfig graph (${event.tsconfigCount} configs)`);
+        }
+        break;
+      case "files_discovered":
+        logger.info(`structural: discovered ${event.totalSourceFiles} source files`);
+        break;
+      case "program_created":
+        logger.debug(`structural: TypeScript program created (${event.totalSourceFiles} files)`);
+        break;
+      case "file_processed":
+        if (event.processed === event.total || event.processed === 1 || event.processed - lastProcessed >= 50) {
+          lastProcessed = event.processed;
+          logger.info(`structural: resolved ${event.processed}/${event.total} files`);
+          logger.debug(`structural: last file processed ${event.filePath}`);
+        }
+        break;
+      case "edges_resolved":
+        logger.info(`structural: resolved ${event.totalEdges} dependency edges`);
+        break;
+    }
+  };
+};
+var createEvolutionProgressReporter = (logger) => {
+  let lastParsedRecords = 0;
+  return (event) => {
+    switch (event.stage) {
+      case "checking_git_repository":
+        logger.debug("evolution: checking git repository");
+        break;
+      case "not_git_repository":
+        logger.warn("evolution: target path is not a git repository");
+        break;
+      case "loading_commit_history":
+        logger.info("evolution: loading git history");
+        break;
+      case "history":
+        if (event.event.stage === "git_log_received") {
+          logger.info(`evolution: git log loaded (${event.event.bytes} bytes)`);
+          break;
+        }
+        if (event.event.stage === "git_log_parsed") {
+          logger.info(`evolution: parsed ${event.event.commits} commits`);
+          break;
+        }
+        if (event.event.stage === "git_log_parse_progress" && (event.event.parsedRecords === event.event.totalRecords || event.event.parsedRecords === 1 || event.event.parsedRecords - lastParsedRecords >= 500)) {
+          lastParsedRecords = event.event.parsedRecords;
+          const currentPercent = event.event.totalRecords === 0 ? 100 : Math.floor(event.event.parsedRecords / event.event.totalRecords * 100);
+          logger.info(
+            `evolution: parse progress ${event.event.parsedRecords}/${event.event.totalRecords} (${currentPercent}%)`
+          );
+        }
+        break;
+      case "computing_metrics":
+        logger.info("evolution: computing metrics");
+        break;
+      case "analysis_completed":
+        logger.debug(`evolution: analysis completed (available=${event.available})`);
+        break;
+    }
+  };
+};
+var runAnalyzeCommand = async (inputPath, authorIdentityMode, logger = createSilentLogger()) => {
+  const invocationCwd = process.env["INIT_CWD"] ?? process.cwd();
+  const targetPath = resolveTargetPath(inputPath, invocationCwd);
+  logger.info(`analyzing repository: ${targetPath}`);
+  logger.info("building structural graph");
+  const structural = buildProjectGraphSummary({
+    projectPath: targetPath,
+    onProgress: createStructuralProgressReporter(logger)
+  });
+  logger.debug(
+    `structural metrics: nodes=${structural.metrics.nodeCount}, edges=${structural.metrics.edgeCount}, cycles=${structural.metrics.cycleCount}`
+  );
+  logger.info(`analyzing git evolution (author identity: ${authorIdentityMode})`);
+  const evolution = analyzeRepositoryEvolutionFromGit({
+    repositoryPath: targetPath,
+    config: { authorIdentityMode }
+  }, createEvolutionProgressReporter(logger));
+  if (evolution.available) {
+    logger.debug(
+      `evolution metrics: commits=${evolution.metrics.totalCommits}, files=${evolution.metrics.totalFiles}, hotspotThreshold=${evolution.metrics.hotspotThresholdCommitCount}`
+    );
+  } else {
+    logger.warn(`evolution analysis unavailable: ${evolution.reason}`);
+  }
+  logger.info("analyzing external dependencies");
+  const external = await analyzeDependencyExposureFromProject(
+    { repositoryPath: targetPath },
+    createExternalProgressReporter(logger)
+  );
+  if (external.available) {
+    logger.debug(
+      `external metrics: total=${external.metrics.totalDependencies}, direct=${external.metrics.directDependencies}, transitive=${external.metrics.transitiveDependencies}`
+    );
+  } else {
+    logger.warn(`external analysis unavailable: ${external.reason}`);
+  }
+  logger.info("computing risk summary");
+  const risk = computeRepositoryRiskSummary({
+    structural,
+    evolution,
+    external
+  });
+  logger.info(`analysis completed (repositoryScore=${risk.repositoryScore})`);
+  const summary = {
+    structural,
+    evolution,
+    external,
+    risk
+  };
+  return summary;
+};
+
+// src/index.ts
+var program = new Command();
+var packageJsonPath = resolve3(dirname(fileURLToPath(import.meta.url)), "../package.json");
+var { version } = JSON.parse(readFileSync2(packageJsonPath, "utf8"));
+program.name("codesentinel").description("Structural and evolutionary risk analysis for TypeScript/JavaScript codebases").version(version);
+program.command("analyze").argument("[path]", "path to the project to analyze").addOption(
+  new Option(
+    "--author-identity <mode>",
+    "author identity mode: likely_merge (heuristic) or strict_email (deterministic)"
+  ).choices(["likely_merge", "strict_email"]).default("likely_merge")
+).addOption(
+  new Option(
+    "--log-level <level>",
+    "log verbosity: silent, error, warn, info, debug (logs are written to stderr)"
+  ).choices(["silent", "error", "warn", "info", "debug"]).default(parseLogLevel(process.env["CODESENTINEL_LOG_LEVEL"]))
+).addOption(
+  new Option(
+    "--output <mode>",
+    "output mode: summary (default) or json (full analysis object)"
+  ).choices(["summary", "json"]).default("summary")
+).option("--json", "shortcut for --output json").action(
+  async (path, options) => {
+    const logger = createStderrLogger(options.logLevel);
+    const summary = await runAnalyzeCommand(path, options.authorIdentity, logger);
+    const outputMode = options.json === true ? "json" : options.output;
+    process.stdout.write(`${formatAnalyzeOutput(summary, outputMode)}
+`);
+  }
+);
+if (process.argv.length <= 2) {
+  program.outputHelp();
+  process.exit(0);
+}
+var executablePath = process.argv[0] ?? "";
+var scriptPath = process.argv[1] ?? "";
+var argv = process.argv[2] === "--" ? [executablePath, scriptPath, ...process.argv.slice(3)] : process.argv;
+if (argv.length <= 2) {
+  program.outputHelp();
+  process.exit(0);
+}
+await program.parseAsync(argv);
+//# sourceMappingURL=index.js.map