@ctxo/cli 0.7.2 → 0.8.1

package/dist/{chunk-4M4V5V36.js → chunk-HXEPS2XY.js}

@@ -1,62 +1,153 @@
 #!/usr/bin/env node
+import {
+  atomicWrite,
+  createLogger
+} from "./chunk-6EKERTJ7.js";
 import {
   JsonIndexReader
-} from "./chunk-WXA2JJLH.js";
+} from "./chunk-2TVHKCCU.js";
 
-// src/core/logger.ts
-function isDebugEnabled(namespace) {
-  const debugEnv = process.env["DEBUG"] ?? "";
-  if (!debugEnv) return false;
-  const patterns = debugEnv.split(",").map((p) => p.trim());
-  return patterns.some((p) => {
-    if (p === "*" || p === "ctxo:*") return true;
-    if (p === namespace) return true;
-    if (p.endsWith(":*") && namespace.startsWith(p.slice(0, -1))) return true;
-    return false;
-  });
-}
-function createLogger(namespace) {
-  const prefix = `[${namespace}]`;
-  return {
-    debug(message, ...args) {
-      if (isDebugEnabled(namespace)) {
-        console.error(`${prefix} DEBUG ${message}`, ...args);
+// src/adapters/storage/sqlite-storage-adapter.ts
+import initSqlJs from "sql.js";
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+import { join as join2, dirname } from "path";
+
+// src/adapters/storage/community-snapshot-writer.ts
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  unlinkSync
+} from "fs";
+import { tmpdir } from "os";
+import { basename, join, resolve } from "path";
+var log = createLogger("ctxo:community-snapshot");
+var DEFAULT_HISTORY_LIMIT = 10;
+var HISTORY_DIR_NAME = "communities.history";
+var CURRENT_FILE_NAME = "communities.json";
+var NOCOMMIT_SHA = "nocommit";
+var CommunitySnapshotWriter = class {
+  indexDir;
+  historyDir;
+  historyLimit;
+  constructor(ctxoRoot, historyLimitOrOptions = DEFAULT_HISTORY_LIMIT) {
+    const options = typeof historyLimitOrOptions === "number" ? { historyLimit: historyLimitOrOptions } : historyLimitOrOptions;
+    this.indexDir = join(ctxoRoot, "index");
+    this.historyDir = join(this.indexDir, HISTORY_DIR_NAME);
+    this.historyLimit = options.historyLimit ?? DEFAULT_HISTORY_LIMIT;
+    assertSafeWritePath(ctxoRoot, options.allowProductionPath ?? false);
+  }
+  writeSnapshot(snapshot) {
+    mkdirSync(this.indexDir, { recursive: true });
+    mkdirSync(this.historyDir, { recursive: true });
+    const currentPath = join(this.indexDir, CURRENT_FILE_NAME);
+    if (existsSync(currentPath)) {
+      try {
+        const existingRaw = readFileSync(currentPath, "utf-8");
+        const existing = JSON.parse(existingRaw);
+        if (existing.commitSha && existing.commitSha !== NOCOMMIT_SHA) {
+          const historyFile = this.historyFilename(existing);
+          this.atomicWrite(join(this.historyDir, historyFile), existingRaw);
+        }
+      } catch (err) {
+        log.error(`failed to archive existing snapshot: ${err.message}`);
       }
-    },
-    info(message, ...args) {
-      console.error(`${prefix} ${message}`, ...args);
-    },
-    warn(message, ...args) {
-      console.error(`${prefix} WARN ${message}`, ...args);
-    },
-    error(message, ...args) {
-      console.error(`${prefix} ERROR ${message}`, ...args);
     }
-  };
+    const json = JSON.stringify(snapshot, null, 2);
+    this.atomicWrite(currentPath, json);
+    this.rotateHistory();
+  }
+  readCurrent() {
+    const path = join(this.indexDir, CURRENT_FILE_NAME);
+    if (!existsSync(path)) return void 0;
+    return this.safeParse(path);
+  }
+  listHistory(limit) {
+    if (!existsSync(this.historyDir)) return [];
+    const entries = readdirSync(this.historyDir).filter((name) => name.endsWith(".json")).sort().reverse();
+    const snapshots = [];
+    for (const name of entries) {
+      const snap = this.safeParse(join(this.historyDir, name));
+      if (!snap) continue;
+      if (!snap.commitSha || snap.commitSha === NOCOMMIT_SHA) continue;
+      snapshots.push(snap);
+      if (typeof limit === "number" && snapshots.length >= limit) break;
+    }
+    return snapshots;
+  }
+  atomicWrite(targetPath, content) {
+    atomicWrite(targetPath, content);
+  }
+  historyFilename(snapshot) {
+    const ts = snapshot.computedAt.replace(/[:.]/g, "-");
+    const sha = snapshot.commitSha || "nocommit";
+    const base = join(this.historyDir, `${ts}-${sha}`);
+    let candidate = `${base}.json`;
+    let n = 1;
+    while (existsSync(candidate)) {
+      candidate = `${base}.${n++}.json`;
+      if (n > 1e3) break;
+    }
+    return candidate.slice(this.historyDir.length + 1);
+  }
+  rotateHistory() {
+    if (!existsSync(this.historyDir)) return;
+    const entries = readdirSync(this.historyDir).filter((name) => name.endsWith(".json")).sort();
+    const excess = entries.length - this.historyLimit;
+    if (excess <= 0) return;
+    for (let i = 0; i < excess; i++) {
+      const target = join(this.historyDir, entries[i]);
+      try {
+        unlinkSync(target);
+      } catch (err) {
+        log.error(`failed to rotate ${basename(target)}: ${err.message}`);
+      }
+    }
+  }
+  safeParse(path) {
+    try {
+      const raw = readFileSync(path, "utf-8");
+      return JSON.parse(raw);
+    } catch (err) {
+      log.error(`failed to parse ${basename(path)}: ${err.message}`);
+      return void 0;
+    }
+  }
+};
+function assertSafeWritePath(ctxoRoot, allowProduction) {
+  const resolved = resolve(ctxoRoot);
+  const tmpRoot = resolve(tmpdir());
+  const inTmp = resolved.startsWith(tmpRoot);
+  if (inTmp || allowProduction) return;
+  throw new Error(
+    `CommunitySnapshotWriter: refusing to write to non-tmp path ${resolved}. Pass { allowProductionPath: true } for production CLI writes, or target a tmpdir-based path in tests.`
+  );
 }
 
 // src/adapters/storage/sqlite-storage-adapter.ts
-import initSqlJs from "sql.js";
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
-import { join, dirname } from "path";
-var log = createLogger("ctxo:storage");
+var log2 = createLogger("ctxo:storage");
 var SqliteStorageAdapter = class {
   db;
   dbPath;
   ctxoRoot;
-  constructor(ctxoRoot) {
+  communityWriter;
+  constructor(ctxoRoot, options = {}) {
     this.ctxoRoot = ctxoRoot;
-    this.dbPath = join(ctxoRoot, ".cache", "symbols.db");
+    this.dbPath = join2(ctxoRoot, ".cache", "symbols.db");
+    this.communityWriter = new CommunitySnapshotWriter(ctxoRoot, {
+      allowProductionPath: options.allowProductionPath
+    });
   }
   async init() {
     const SQL = await initSqlJs();
-    if (existsSync(this.dbPath)) {
+    if (existsSync2(this.dbPath)) {
       try {
-        const buffer = readFileSync(this.dbPath);
+        const buffer = readFileSync2(this.dbPath);
         this.db = new SQL.Database(buffer);
         this.verifyIntegrity();
       } catch {
-        log.warn("Corrupt DB detected, rebuilding from JSON index");
+        log2.warn("Corrupt DB detected, rebuilding from JSON index");
         this.db = new SQL.Database();
         this.createTables();
       }
@@ -68,9 +159,9 @@ var SqliteStorageAdapter = class {
   }
   async initEmpty() {
     const SQL = await initSqlJs();
-    if (existsSync(this.dbPath)) {
+    if (existsSync2(this.dbPath)) {
       try {
-        const buffer = readFileSync(this.dbPath);
+        const buffer = readFileSync2(this.dbPath);
         this.db = new SQL.Database(buffer);
       } catch {
         this.db = new SQL.Database();
@@ -312,9 +403,18 @@ var SqliteStorageAdapter = class {
     const db = this.database();
     const data = db.export();
     const buffer = Buffer.from(data);
-    mkdirSync(dirname(this.dbPath), { recursive: true });
+    mkdirSync2(dirname(this.dbPath), { recursive: true });
     writeFileSync(this.dbPath, buffer);
   }
+  readCommunities() {
+    return this.communityWriter.readCurrent();
+  }
+  writeCommunities(snapshot) {
+    this.communityWriter.writeSnapshot(snapshot);
+  }
+  listCommunityHistory(limit) {
+    return this.communityWriter.listHistory(limit);
+  }
   close() {
     if (this.db) {
       this.persist();
@@ -326,7 +426,7 @@ var SqliteStorageAdapter = class {
     try {
       this.persist();
     } catch (err) {
-      log.error(`Failed to persist DB: ${err.message}`);
+      log2.error(`Failed to persist DB: ${err.message}`);
     }
   }
   deleteFileData(db, filePath) {
@@ -374,12 +474,12 @@ var SqliteStorageAdapter = class {
 
 // src/adapters/git/simple-git-adapter.ts
 import { simpleGit } from "simple-git";
-var log2 = createLogger("ctxo:git");
+var log3 = createLogger("ctxo:git");
 var SimpleGitAdapter = class {
   git;
   constructor(projectRoot) {
     this.git = simpleGit(projectRoot);
-    log2.debug("Initialized with root: %s", projectRoot);
+    log3.debug("Initialized with root: %s", projectRoot);
   }
   async isAvailable() {
     try {
@@ -391,27 +491,27 @@ var SimpleGitAdapter = class {
   }
   async getCommitHistory(filePath, maxCount) {
     try {
-      const log5 = await this.git.log({
+      const log6 = await this.git.log({
         file: filePath,
         "--follow": null,
         ...maxCount ? { maxCount } : {}
       });
-      return log5.all.map((entry) => ({
+      return log6.all.map((entry) => ({
         hash: entry.hash,
         message: entry.message,
         date: entry.date,
         author: entry.author_name
       }));
     } catch (err) {
-      log2.error(` Failed to get history for ${filePath}: ${err.message}`);
+      log3.error(` Failed to get history for ${filePath}: ${err.message}`);
       return [];
     }
   }
   async getBatchHistory(maxCount = 20) {
     try {
-      const log5 = await this.git.log({ maxCount: maxCount * 50, "--name-only": null });
+      const log6 = await this.git.log({ maxCount: maxCount * 50, "--name-only": null });
       const result = /* @__PURE__ */ new Map();
-      for (const entry of log5.all) {
+      for (const entry of log6.all) {
         const record = {
           hash: entry.hash,
           message: entry.message,
@@ -433,7 +533,7 @@ var SimpleGitAdapter = class {
       }
       return result;
     } catch (err) {
-      log2.error(` Batch history failed: ${err.message}`);
+      log3.error(` Batch history failed: ${err.message}`);
       return /* @__PURE__ */ new Map();
     }
   }
@@ -442,26 +542,46 @@ var SimpleGitAdapter = class {
       const diff = await this.git.diffSummary([since]);
       return diff.files.map((f) => f.file.replace(/\\/g, "/"));
     } catch (err) {
-      log2.error(` Failed to get changed files since ${since}: ${err.message}`);
+      log3.error(` Failed to get changed files since ${since}: ${err.message}`);
       return [];
     }
   }
   async getFileChurn(filePath) {
     try {
-      const log5 = await this.git.log({ file: filePath, "--follow": null });
+      const log6 = await this.git.log({ file: filePath, "--follow": null });
       return {
         filePath,
-        commitCount: log5.total
+        commitCount: log6.total
       };
     } catch (err) {
-      log2.error(` Failed to get churn for ${filePath}: ${err.message}`);
+      log3.error(` Failed to get churn for ${filePath}: ${err.message}`);
       return { filePath, commitCount: 0 };
     }
   }
+  async getHeadSha() {
+    try {
+      const raw = await this.git.revparse(["--short", "HEAD"]);
+      const sha = raw.trim();
+      return sha.length > 0 ? sha : void 0;
+    } catch (err) {
+      log3.error(`Failed to resolve HEAD: ${err.message}`);
+      return void 0;
+    }
+  }
+  async countCommitsBetween(base) {
+    try {
+      const raw = await this.git.raw(["rev-list", "--count", `${base}..HEAD`]);
+      const n = parseInt(raw.trim(), 10);
+      return Number.isFinite(n) && n >= 0 ? n : void 0;
+    } catch (err) {
+      log3.error(`Failed to count commits since ${base}: ${err.message}`);
+      return void 0;
+    }
+  }
 };
 
 // src/adapters/stats/session-recorder-adapter.ts
-var log3 = createLogger("ctxo:stats");
+var log4 = createLogger("ctxo:stats");
 var SessionRecorderAdapter = class {
   db;
   onWrite;
@@ -507,7 +627,7 @@ var SessionRecorderAdapter = class {
       );
       this.flushToDisk();
     } catch (err) {
-      log3.error(`Failed to record session event: ${err.message}`);
+      log4.error(`Failed to record session event: ${err.message}`);
     }
   }
   queryStats(days) {
@@ -575,14 +695,14 @@ var SessionRecorderAdapter = class {
     try {
       this.onWrite?.();
     } catch (err) {
-      log3.error(`Failed to flush stats to disk: ${err.message}`);
+      log4.error(`Failed to flush stats to disk: ${err.message}`);
     }
   }
 };
 
 // src/adapters/workspace/single-package-workspace.ts
-import { existsSync as existsSync2, readdirSync } from "fs";
-import { join as join2, resolve } from "path";
+import { existsSync as existsSync3, readdirSync as readdirSync2 } from "fs";
+import { join as join3, resolve as resolve2 } from "path";
 var MANIFEST_CANDIDATES = [
   "package.json",
   "pyproject.toml",
@@ -595,24 +715,24 @@ var MANIFEST_CANDIDATES = [
 ];
 function findManifest(dir) {
   for (const name of MANIFEST_CANDIDATES) {
-    const candidate = join2(dir, name);
-    if (existsSync2(candidate)) return candidate;
+    const candidate = join3(dir, name);
+    if (existsSync3(candidate)) return candidate;
   }
   const csproj = findFirstByExt(dir, ".csproj") ?? findFirstByExt(dir, ".sln");
   if (csproj) return csproj;
-  return join2(dir, "package.json");
+  return join3(dir, "package.json");
 }
 function findFirstByExt(dir, ext) {
   try {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      if (entry.isFile() && entry.name.endsWith(ext)) return join2(dir, entry.name);
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+      if (entry.isFile() && entry.name.endsWith(ext)) return join3(dir, entry.name);
     }
   } catch {
   }
   return null;
 }
 function detectWorkspace(cwd) {
-  const root = resolve(cwd);
+  const root = resolve2(cwd);
   const pkg = {
     root,
     manifest: findManifest(root)
@@ -624,8 +744,8 @@ function detectWorkspace(cwd) {
 }
 
 // src/core/config/load-config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
 import { parse as parseYaml } from "yaml";
 import picomatch from "picomatch";
 
@@ -638,19 +758,42 @@ var IndexConfigSchema = z.object({
   ignore: z.array(z.string().min(1)).optional(),
   ignoreProjects: z.array(z.string().min(1)).optional()
 }).strict();
+var MaskingConfigSchema = z.object({
+  /**
+   * Glob patterns matched against community cluster labels. Matching labels
+   * are replaced with `[masked-cluster-N]` in MCP tool responses so
+   * org-sensitive folder names (e.g. `src/payment-vault`, `internal-*`)
+   * never surface to AI agents over the stdio channel.
+   */
+  clusterLabels: z.array(z.string().min(1)).optional()
+}).strict();
+var WatchConfigSchema = z.object({
+  /**
+   * Minimum number of files that must be re-indexed since the last
+   * community snapshot before `ctxo watch` recomputes one. Default: 5.
+   * On large monorepos Louvain + PageRank cost ~1 s of blocking CPU;
+   * bumping this (e.g. 25) avoids recomputing on every save.
+   */
+  snapshotMinFileChanges: z.number().int().min(1).optional()
+}).strict();
 var CtxoConfigSchema = z.object({
   version: z.union([z.string(), z.number()]).optional(),
   stats: StatsConfigSchema.optional(),
-  index: IndexConfigSchema.optional()
+  index: IndexConfigSchema.optional(),
+  masking: MaskingConfigSchema.optional(),
+  watch: WatchConfigSchema.optional()
 }).passthrough();
+var DEFAULT_WATCH_SNAPSHOT_MIN_FILE_CHANGES = 5;
 var DEFAULT_CONFIG = {
   version: "1.0",
   stats: { enabled: true },
-  index: { ignore: [], ignoreProjects: [] }
+  index: { ignore: [], ignoreProjects: [] },
+  masking: { clusterLabels: [] },
+  watch: { snapshotMinFileChanges: DEFAULT_WATCH_SNAPSHOT_MIN_FILE_CHANGES }
 };
 
 // src/core/config/load-config.ts
-var log4 = createLogger("ctxo:config");
+var log5 = createLogger("ctxo:config");
 function isValidGlob(pattern) {
   try {
     picomatch(pattern);
@@ -666,15 +809,15 @@ function validateGlobs(patterns, field, invalid) {
   }
 }
 function loadConfig(ctxoRoot) {
-  const path = join3(ctxoRoot, "config.yaml");
+  const path = join4(ctxoRoot, "config.yaml");
   const errors = [];
   const invalidGlobs = [];
-  if (!existsSync3(path)) {
+  if (!existsSync4(path)) {
     return { config: DEFAULT_CONFIG, errors, invalidGlobs, path, exists: false };
   }
   let raw;
   try {
-    raw = readFileSync2(path, "utf-8");
+    raw = readFileSync3(path, "utf-8");
   } catch (err) {
     errors.push(`Cannot read ${path}: ${err.message}`);
     return { config: DEFAULT_CONFIG, errors, invalidGlobs, path, exists: true };
@@ -684,7 +827,7 @@ function loadConfig(ctxoRoot) {
     parsed = parseYaml(raw);
   } catch (err) {
     errors.push(`Invalid YAML in ${path}: ${err.message}`);
-    log4.warn(`Invalid YAML in config.yaml, falling back to defaults: ${err.message}`);
+    log5.warn(`Invalid YAML in config.yaml, falling back to defaults: ${err.message}`);
     return { config: DEFAULT_CONFIG, errors, invalidGlobs, path, exists: true };
   }
   if (parsed === null || parsed === void 0) {
@@ -695,13 +838,13 @@ function loadConfig(ctxoRoot) {
     for (const issue of result.error.issues) {
       errors.push(`${issue.path.join(".") || "<root>"}: ${issue.message}`);
     }
-    log4.warn(`Invalid config.yaml (${errors.length} issue(s)), falling back to defaults`);
+    log5.warn(`Invalid config.yaml (${errors.length} issue(s)), falling back to defaults`);
     return { config: DEFAULT_CONFIG, errors, invalidGlobs, path, exists: true };
   }
   validateGlobs(result.data.index?.ignore, "index.ignore", invalidGlobs);
   validateGlobs(result.data.index?.ignoreProjects, "index.ignoreProjects", invalidGlobs);
   for (const pattern of invalidGlobs) {
-    log4.warn(`Invalid glob pattern in config.yaml \u2014 ${pattern}`);
+    log5.warn(`Invalid glob pattern in config.yaml \u2014 ${pattern}`);
   }
   return { config: result.data, errors, invalidGlobs, path, exists: true };
 }
@@ -714,6 +857,14 @@ function indexIgnorePatterns(config) {
 function indexIgnoreProjectPatterns(config) {
   return (config.index?.ignoreProjects ?? []).filter(isValidGlob);
 }
+function maskingClusterLabelPatterns(config) {
+  return (config.masking?.clusterLabels ?? []).filter(isValidGlob);
+}
+function watchSnapshotMinFileChanges(config) {
+  const value = config.watch?.snapshotMinFileChanges;
+  if (typeof value === "number" && Number.isFinite(value) && value >= 1) return value;
+  return DEFAULT_WATCH_SNAPSHOT_MIN_FILE_CHANGES;
+}
 function makeGlobMatcher(patterns) {
   if (patterns.length === 0) return () => false;
   const matchers = patterns.map((p) => picomatch(p, { dot: true }));
@@ -848,6 +999,148 @@ var RevertDetector = class {
   }
 };
 
+// src/core/overlay/drift-detector.ts
+var DEFAULT_JACCARD_THRESHOLD = 0.3;
+var DriftDetector = class {
+  jaccardThreshold;
+  suppressTransient;
+  constructor(options = {}) {
+    this.jaccardThreshold = options.jaccardThreshold ?? DEFAULT_JACCARD_THRESHOLD;
+    this.suppressTransient = options.suppressTransient ?? true;
+  }
+  detect(current, history) {
+    const snapshotsAvailable = history.length;
+    const previous = history[0];
+    const anchor = history[1];
+    if (!previous) {
+      return {
+        events: [],
+        confidence: "low",
+        snapshotsAvailable,
+        stability: { stable: 0, transient: 0, unverified: 0 },
+        hint: "No prior snapshot available \u2014 install the post-commit hook (`ctxo init`), run `ctxo watch`, or add `ctxo index --check` to CI so the drift history accumulates."
+      };
+    }
+    const currentByCommunityId = indexByCommunityId(current.communities);
+    const previousByCommunityId = indexByCommunityId(previous.communities);
+    const mapping = this.mapCommunities(currentByCommunityId, previousByCommunityId);
+    const currentAssignments = assignmentMap(current.communities);
+    const previousAssignments = assignmentMap(previous.communities);
+    const anchorAssignments = anchor ? assignmentMap(anchor.communities) : void 0;
+    const previousLabels = labelMap(previous.communities);
+    const currentLabels = labelMap(current.communities);
+    const anchorToPrev = anchor ? this.mapCommunities(previousByCommunityId, indexByCommunityId(anchor.communities)) : /* @__PURE__ */ new Map();
+    const rawEvents = [];
+    const stability = { stable: 0, transient: 0, unverified: 0 };
+    for (const [symbolId, currentId] of currentAssignments) {
+      const prevId = previousAssignments.get(symbolId);
+      if (prevId === void 0) continue;
+      const mappedPrevId = mapping.get(prevId);
+      if (mappedPrevId === currentId) continue;
+      let classification;
+      if (!anchorAssignments) {
+        classification = "unverified";
+      } else {
+        const anchorId = anchorAssignments.get(symbolId);
+        if (anchorId === void 0) {
+          classification = "unverified";
+        } else {
+          const anchorInPrevSpace = anchorToPrev.get(anchorId);
+          if (anchorInPrevSpace === prevId) {
+            classification = "stable";
+          } else if (anchorInPrevSpace !== void 0) {
+            const anchorInCurrentSpace = mapping.get(anchorInPrevSpace);
+            classification = anchorInCurrentSpace === currentId ? "transient" : "unverified";
+          } else {
+            classification = "unverified";
+          }
+        }
+      }
+      stability[classification]++;
+      rawEvents.push({
+        symbolId,
+        movedFrom: {
+          id: prevId,
+          label: previousLabels.get(prevId) ?? `community-${prevId}`
+        },
+        movedTo: {
+          id: currentId,
+          label: currentLabels.get(currentId) ?? `community-${currentId}`
+        },
+        firstSeenInNewCluster: current.computedAt,
+        stability: classification
+      });
+    }
+    const events = (this.suppressTransient ? rawEvents.filter((e) => e.stability !== "transient") : rawEvents).sort((a, b) => a.symbolId.localeCompare(b.symbolId));
+    return {
+      events,
+      confidence: confidenceFor(snapshotsAvailable),
+      snapshotsAvailable,
+      stability,
+      hint: hintFor(snapshotsAvailable)
+    };
+  }
+  mapCommunities(current, previous) {
+    const mapping = /* @__PURE__ */ new Map();
+    for (const [prevId, prevMembers] of previous) {
+      let bestCurrentId;
+      let bestOverlap = 0;
+      for (const [currentId, currentMembers] of current) {
+        const overlap = jaccard(prevMembers, currentMembers);
+        if (overlap > bestOverlap) {
+          bestOverlap = overlap;
+          bestCurrentId = currentId;
+        }
+      }
+      if (bestCurrentId !== void 0 && bestOverlap >= this.jaccardThreshold) {
+        mapping.set(prevId, bestCurrentId);
+      }
+    }
+    return mapping;
+  }
+};
+function indexByCommunityId(entries) {
+  const index = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const bucket = index.get(entry.communityId) ?? /* @__PURE__ */ new Set();
+    bucket.add(entry.symbolId);
+    index.set(entry.communityId, bucket);
+  }
+  return index;
+}
+function assignmentMap(entries) {
+  const map = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    map.set(entry.symbolId, entry.communityId);
+  }
+  return map;
+}
+function labelMap(entries) {
+  const labels = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (!labels.has(entry.communityId)) {
+      labels.set(entry.communityId, entry.communityLabel);
+    }
+  }
+  return labels;
+}
+function jaccard(a, b) {
+  if (a.size === 0 && b.size === 0) return 1;
+  let intersection = 0;
+  for (const x of a) if (b.has(x)) intersection++;
+  const union = a.size + b.size - intersection;
+  return union === 0 ? 0 : intersection / union;
+}
+function confidenceFor(snapshots) {
+  if (snapshots >= 7) return "high";
+  if (snapshots >= 3) return "medium";
+  return "low";
+}
+function hintFor(snapshots) {
+  if (snapshots >= 3) return void 0;
+  return "Install post-commit hook or run `ctxo index` more often to build a richer drift history.";
+}
+
 // src/core/overlay/architectural-overlay.ts
 var DEFAULT_RULES = [
   // Test layer (matched first — __tests__, .test.ts, tests/, fixtures)
@@ -1187,6 +1480,97 @@ var PageRankCalculator = class {
   }
 };
 
+// src/core/overlay/boundary-violation-detector.ts
+var HIGH_SEVERITY_THRESHOLD = 0;
+var MEDIUM_SEVERITY_THRESHOLD = 2;
+var MIN_SNAPSHOTS_FOR_CONFIDENCE = 2;
+var BoundaryViolationDetector = class {
+  detect(graph, current, history) {
+    const snapshotsAvailable = history.length;
+    const currentAssignments = assignmentMap2(current.communities);
+    const currentLabels = labelMap2(current.communities);
+    const historicalAssignments = history.map((snapshot) => ({
+      snapshot,
+      assignments: assignmentMap2(snapshot.communities),
+      labels: labelMap2(snapshot.communities)
+    }));
+    const violations = [];
+    for (const edge of graph.allEdges()) {
+      if (edge.from === edge.to) continue;
+      const fromCommunity = currentAssignments.get(edge.from);
+      const toCommunity = currentAssignments.get(edge.to);
+      if (fromCommunity === void 0 || toCommunity === void 0) continue;
+      if (fromCommunity === toCommunity) continue;
+      const fromLabel = currentLabels.get(fromCommunity) ?? `community-${fromCommunity}`;
+      const toLabel = currentLabels.get(toCommunity) ?? `community-${toCommunity}`;
+      const historicalCount = snapshotsAvailable < MIN_SNAPSHOTS_FOR_CONFIDENCE ? -1 : countHistoricalCrossCluster(historicalAssignments, edge.from, edge.to);
+      if (historicalCount === -1 || historicalCount <= MEDIUM_SEVERITY_THRESHOLD) {
+        violations.push({
+          from: {
+            symbolId: edge.from,
+            communityId: fromCommunity,
+            label: fromLabel
+          },
+          to: {
+            symbolId: edge.to,
+            communityId: toCommunity,
+            label: toLabel
+          },
+          edgeKind: edge.kind,
+          historicalEdgesBetweenClusters: historicalCount,
+          severity: historicalCount === HIGH_SEVERITY_THRESHOLD ? "high" : "medium"
+        });
+      }
+    }
+    violations.sort((a, b) => {
+      if (a.severity !== b.severity) return a.severity === "high" ? -1 : 1;
+      const cmp = a.from.symbolId.localeCompare(b.from.symbolId);
+      return cmp !== 0 ? cmp : a.to.symbolId.localeCompare(b.to.symbolId);
+    });
+    return {
+      violations,
+      confidence: confidenceFor2(snapshotsAvailable),
+      snapshotsAvailable,
+      hint: hintFor2(snapshotsAvailable)
+    };
+  }
+};
+function countHistoricalCrossCluster(history, fromSymbol, toSymbol) {
+  let count = 0;
+  for (const snap of history) {
+    const fromId = snap.assignments.get(fromSymbol);
+    const toId = snap.assignments.get(toSymbol);
+    if (fromId === void 0 || toId === void 0) continue;
+    if (fromId !== toId) count++;
+  }
+  return count;
+}
+function assignmentMap2(entries) {
+  const map = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    map.set(entry.symbolId, entry.communityId);
+  }
+  return map;
+}
+function labelMap2(entries) {
+  const labels = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (!labels.has(entry.communityId)) {
+      labels.set(entry.communityId, entry.communityLabel);
+    }
+  }
+  return labels;
+}
+function confidenceFor2(snapshots) {
+  if (snapshots >= 7) return "high";
+  if (snapshots >= 3) return "medium";
+  return "low";
+}
+function hintFor2(snapshots) {
+  if (snapshots >= MIN_SNAPSHOTS_FOR_CONFIDENCE) return void 0;
+  return "Insufficient snapshot history \u2014 enable `ctxo init` hook or add `ctxo index --check` to CI for boundary-violation signal.";
+}
+
 // src/core/co-change/co-change-analyzer.ts
 var MIN_SHARED_COMMITS = 2;
 var MIN_FREQUENCY = 0.1;
@@ -1259,14 +1643,16 @@ function loadCoChangeMap(matrix) {
 }
 
 export {
-  createLogger,
+  CommunitySnapshotWriter,
   SqliteStorageAdapter,
   SymbolGraph,
   RevertDetector,
+  DriftDetector,
   SimpleGitAdapter,
   ArchitecturalOverlay,
   DeadCodeDetector,
   PageRankCalculator,
+  BoundaryViolationDetector,
   aggregateCoChanges,
   loadCoChangeMap,
   SessionRecorderAdapter,
@@ -1275,6 +1661,8 @@ export {
   statsEnabled,
   indexIgnorePatterns,
   indexIgnoreProjectPatterns,
+  maskingClusterLabelPatterns,
+  watchSnapshotMinFileChanges,
   makeGlobMatcher
 };
-//# sourceMappingURL=chunk-4M4V5V36.js.map
+//# sourceMappingURL=chunk-HXEPS2XY.js.map