@monoes/monograph 1.5.6 → 1.5.8

package/src/pipeline/cluster-only.ts

@@ -1,64 +0,0 @@
-import type Database from 'better-sqlite3';
-import { loadGraphFromDb } from '../graph/loader.js';
-import { leiden } from './phases/leiden.js';
-import louvain from 'graphology-communities-louvain';
-
-export interface ClusterOnlyResult {
-  communityCount: number;
-  nodeCount: number;
-}
-
-/**
- * Re-run community detection without re-extracting the full pipeline.
- * Reads edges from the DB, runs Leiden (Louvain-based) community detection,
- * and writes community_id assignments back to the nodes table.
- */
-export async function runClusterOnly(db: Database.Database): Promise<ClusterOnlyResult> {
-  // Check if there are any edges at all
-  const edgeCount = (db.prepare('SELECT COUNT(*) as cnt FROM edges').get() as { cnt: number }).cnt;
-  if (edgeCount === 0) {
-    return { communityCount: 0, nodeCount: 0 };
-  }
-
-  // Build graphology graph from the DB
-  const graph = loadGraphFromDb(db as unknown as import('../storage/db.js').MonographDb);
-
-  if (graph.order === 0) {
-    return { communityCount: 0, nodeCount: 0 };
-  }
-
-  // Run community detection using Leiden (Louvain-based with refinement)
-  let communities: Record<string, number> = {};
-  try {
-    communities = leiden(graph, { seed: 42 });
-  } catch (e) {
-    console.warn('[monograph] Leiden failed in cluster-only, falling back to Louvain:', e);
-    try {
-      communities = louvain(graph, { randomWalk: false });
-    } catch {
-      // Assign all to community 0 as last resort
-      for (const nodeId of graph.nodes()) {
-        communities[nodeId] = 0;
-      }
-    }
-  }
-
-  // Write community assignments back to DB and count in a single pass
-  const updateStmt = db.prepare('UPDATE nodes SET community_id = ? WHERE id = ?');
-  const communityIds = new Set<number>();
-  let nodeCount = 0;
-  const updateAll = db.transaction(() => {
-    for (const nodeId in communities) {
-      const commId = communities[nodeId];
-      updateStmt.run(commId, nodeId);
-      communityIds.add(commId);
-      nodeCount++;
-    }
-  });
-  updateAll();
-
-  return {
-    communityCount: communityIds.size,
-    nodeCount,
-  };
-}

package/src/pipeline/effort.ts

@@ -1,50 +0,0 @@
-export type AnalysisEffort = 'low' | 'medium' | 'high';
-
-export interface EffortProfile {
-  runChurn: boolean;
-  runOwnership: boolean;
-  runHotspots: boolean;
-  runFileScores: boolean;
-  runSuffixArray: boolean;
-  runCrossReference: boolean;
-  maxFilesForExpensiveAnalysis: number;
-}
-
-const EFFORT_PROFILES: Record<AnalysisEffort, EffortProfile> = {
-  low: {
-    runChurn: false,
-    runOwnership: false,
-    runHotspots: false,
-    runFileScores: true,
-    runSuffixArray: false,
-    runCrossReference: false,
-    maxFilesForExpensiveAnalysis: 100,
-  },
-  medium: {
-    runChurn: true,
-    runOwnership: false,
-    runHotspots: true,
-    runFileScores: true,
-    runSuffixArray: false,
-    runCrossReference: true,
-    maxFilesForExpensiveAnalysis: 500,
-  },
-  high: {
-    runChurn: true,
-    runOwnership: true,
-    runHotspots: true,
-    runFileScores: true,
-    runSuffixArray: true,
-    runCrossReference: true,
-    maxFilesForExpensiveAnalysis: Infinity,
-  },
-};
-
-export function getEffortProfile(effort: AnalysisEffort = 'medium'): EffortProfile {
-  return EFFORT_PROFILES[effort];
-}
-
-export function parseEffort(s: string): AnalysisEffort {
-  if (s === 'low' || s === 'medium' || s === 'high') return s;
-  return 'medium';
-}

package/src/pipeline/orchestrator.ts

@@ -1,384 +0,0 @@
-import { resolve, join, extname } from 'path';
-import { execSync } from 'child_process';
-import { existsSync, readFileSync, statSync } from 'fs';
-import Graph from 'graphology';
-import { openDb, closeDb } from '../storage/db.js';
-import { PipelineRunner } from './runner.js';
-import { scanPhase } from './phases/scan.js';
-import { structurePhase } from './phases/structure.js';
-import { parsePhase } from './phases/parse.js';
-import { markdownPhase } from './phases/markdown.js';
-import { routesPhase } from './phases/routes.js';
-import { toolsPhase } from './phases/tools.js';
-import { ormPhase } from './phases/orm.js';
-import { crossFilePhase } from './phases/cross-file.js';
-import { scopeResolutionPhase, clearWorkspacePackageMapCache } from './phases/scope-resolution.js';
-import { mroPhase } from './phases/mro.js';
-import { communitiesPhase } from './phases/communities.js';
-import { processesPhase } from './phases/processes.js';
-import { godNodesPhase } from './phases/god-nodes.js';
-import { surprisesPhase } from './phases/surprises.js';
-import { suggestPhase } from './phases/suggest.js';
-import { variablesPhase } from './phases/variables-phase.js';
-import { wildcardSynthesisPhase } from './phases/wildcard-phase.js';
-import { frameworkDetectPhase } from './phases/framework-detect.js';
-import { importResolverPhase } from './phases/import-resolver.js';
-import { bridgeResolverPhase } from './phases/bridge-resolver.js';
-import type { PipelineOptions, PipelineContext } from './types.js';
-import { DEFAULT_OPTIONS } from './types.js';
-import type { MonographNode, MonographEdge, PipelineProgress, SuggestedQuestion } from '../types.js';
-import { generateGraphReport } from '../reporting/graph-report.js';
-import { analyzeChurn } from '../analysis/churn.js';
-import { ExtractionCache } from '../cache/extraction-cache.js';
-import { insertNodes, deleteNodesForFile } from '../storage/node-store.js';
-import { insertEdges, deleteEdgesForFile } from '../storage/edge-store.js';
-import { parseFile } from '../parsers/loader.js';
-import { isSupportedExtension } from '../parsers/loader.js';
-import { extractVariables, variableToNode } from './phases/variables.js';
-import { extractArrowFunctions, extractCsharpNamespaces } from './phases/parse.js';
-
-function getCurrentCommitHash(repoPath: string): string | null {
-  try {
-    return execSync('git rev-parse HEAD', { cwd: repoPath, encoding: 'utf8' }).trim();
-  } catch {
-    return null;
-  }
-}
-
-export interface BuildOptions extends Partial<PipelineOptions> {
-  onProgress?: (p: PipelineProgress) => void;
-  force?: boolean;
-  /** When true, skip the full rebuild if the index is already fresh (matches HEAD). Default false. */
-  incremental?: boolean;
-}
-
-// Cross-process build mutex. Callers arrive from several independent entry points
-// (session-start hook, MCP staleness auto-build, CLI, watcher), each with its own
-// ad-hoc lock file that the others don't know about — concurrent builds then fail
-// with "database is locked". Serialize here, the one place all builders pass through.
-async function acquireBuildLock(dbPath: string): Promise<(() => void) | null> {
-  const { writeFileSync, readFileSync, statSync, unlinkSync, mkdirSync } = await import('fs');
-  const { dirname } = await import('path');
-  const lockPath = dbPath + '.build-lock';
-  mkdirSync(dirname(lockPath), { recursive: true });
-  const tryAcquire = (): boolean => {
-    try { writeFileSync(lockPath, String(process.pid), { flag: 'wx' }); return true; }
-    catch { return false; }
-  };
-  if (!tryAcquire()) {
-    // Reclaim if the holder is dead or the lock is older than 30 minutes
-    let stale = false;
-    try {
-      const pid = parseInt(readFileSync(lockPath, 'utf8'), 10);
-      try { process.kill(pid, 0); } catch { stale = true; }
-      if (!stale && Date.now() - statSync(lockPath).mtimeMs > 30 * 60 * 1000) stale = true;
-    } catch { stale = true; }
-    if (!stale) return null;
-    try { unlinkSync(lockPath); } catch { /* raced with another reclaimer */ }
-    if (!tryAcquire()) return null;
-  }
-  return () => { try { unlinkSync(lockPath); } catch { /* already gone */ } };
-}
-
-export async function buildAsync(repoPath: string, options: BuildOptions = {}): Promise<void> {
-  const dbPath = resolve(join(repoPath, '.monomind', 'monograph.db'));
-  const fullOptions: PipelineOptions = { ...DEFAULT_OPTIONS, ...options };
-  clearWorkspacePackageMapCache(repoPath);
-
-  const releaseLock = await acquireBuildLock(dbPath);
-  if (!releaseLock) {
-    options.onProgress?.({ phase: 'skip', message: 'Another build is in progress — skipping' });
-    return;
-  }
-  try {
-    await buildAsyncLocked(repoPath, dbPath, fullOptions, options);
-  } finally {
-    releaseLock();
-  }
-}
-
-async function buildAsyncLocked(
-  repoPath: string,
-  dbPath: string,
-  fullOptions: PipelineOptions,
-  options: BuildOptions,
-): Promise<void> {
-
-  // Incremental guard: if the caller requested skip-when-fresh and force is
-  // not set, check staleness before opening the DB for a full write cycle.
-  if (options.incremental && !options.force) {
-    const { existsSync: _existsSync } = await import('fs');
-    if (_existsSync(dbPath)) {
-      const { checkStaleness } = await import('../staleness/git-staleness.js');
-      const tmpDb = openDb(dbPath);
-      try {
-        const report = checkStaleness(tmpDb, resolve(repoPath));
-        if (!report.isStale && report.currentCommit !== null) {
-          options.onProgress?.({ phase: 'skip', message: 'Index is fresh — skipping rebuild' });
-          return; // Already up-to-date
-        }
-      } finally {
-        closeDb(tmpDb);
-      }
-    }
-  }
-
-  // Parse-cache eviction — runs once at the start of a full (non-incremental)
-  // build. The cache only ever grows via writes (parse.ts's ExtractionCache);
-  // nothing else prunes entries for files that were deleted/renamed or
-  // haven't been touched in a long time, so it accumulates forever otherwise.
-  if (!options.incremental) {
-    try {
-      const parseCache = new ExtractionCache(resolve(join(repoPath, '.monomind', 'parse-cache')));
-      const removed = parseCache.prune();
-      if (removed > 0) {
-        options.onProgress?.({ phase: 'prune', message: `Parse cache: pruned ${removed} stale entries` });
-      }
-    } catch { /* non-fatal — cache pruning must never block a build */ }
-  }
-
-  const db = openDb(dbPath);
-
-  // The whole build is one SQL transaction: a phase throwing (e.g. issue
-  // #40's FK violation) used to leave whatever earlier phases had already
-  // autocommitted sitting in the DB, silently corrupting the index into a
-  // stale partial state that a later build wouldn't repair (cache hits skip
-  // re-scanning the files that would restore the missing rows). BEGIN/COMMIT/
-  // ROLLBACK are issued directly via db.exec() rather than better-sqlite3's
-  // `.transaction()` helper, which requires a synchronous callback — the
-  // phases below are async. This is still safe: every phase writes through
-  // this same single connection, so SQLite serializes them regardless of how
-  // the JS event loop interleaves the awaits between phases.
-  db.exec('BEGIN');
-  try {
-    const graph = new Graph({ multi: true, type: 'directed' });
-    const ctx: PipelineContext = {
-      repoPath: resolve(repoPath),
-      db, graph,
-      onProgress: options.onProgress ?? (() => {}),
-      options: fullOptions,
-    };
-
-    const runner = new PipelineRunner([
-      scanPhase, frameworkDetectPhase, structurePhase, parsePhase, variablesPhase,
-      markdownPhase, routesPhase, toolsPhase, ormPhase,
-      crossFilePhase, wildcardSynthesisPhase, importResolverPhase, scopeResolutionPhase,
-      bridgeResolverPhase,
-      mroPhase, communitiesPhase, processesPhase, godNodesPhase, surprisesPhase, suggestPhase,
-    ]);
-
-    const outputs = await runner.run(ctx);
-
-    // Sweep orphaned rows for files that were renamed/deleted since the last build.
-    // This MUST run unconditionally — even when every remaining file cache-hit
-    // (ctx.allFilesCached === true), a file may have been deleted from disk between
-    // builds, which produces zero cache misses but still leaves ghost rows in the DB
-    // unless we compare the DB's known file set against the current on-disk set.
-    const scanOut = outputs.get('scan') as { filePaths: string[] } | undefined;
-    if (scanOut) {
-      const liveFiles = new Set(scanOut.filePaths.map((f) => resolve(f)));
-      const staleFiles = (
-        db.prepare('SELECT DISTINCT file_path FROM nodes WHERE file_path IS NOT NULL').all() as { file_path: string }[]
-      )
-        .map((r) => r.file_path)
-        .filter((f) => !liveFiles.has(resolve(ctx.repoPath, f)));
-      if (staleFiles.length > 0) {
-        const deleteStale = db.transaction((files: string[]) => {
-          const deleteEdges = db.prepare(`
-            DELETE FROM edges WHERE source_id IN (SELECT id FROM nodes WHERE file_path = ?)
-               OR target_id IN (SELECT id FROM nodes WHERE file_path = ?)
-          `);
-          const deleteNodesStmt = db.prepare('DELETE FROM nodes WHERE file_path = ?');
-          for (const f of files) {
-            deleteEdges.run(f, f);
-            deleteNodesStmt.run(f);
-          }
-        });
-        deleteStale(staleFiles);
-      }
-    }
-
-    // Populate churnScore on File nodes from git history (6-month window)
-    try {
-      const churnResult = await analyzeChurn(ctx.repoPath, '6m');
-      if (churnResult.files.length > 0) {
-        // Only consider files that exist as graph nodes for normalization —
-        // build artifacts and config files inflate the denominator otherwise
-        const graphFiles = new Set(
-          (db.prepare("SELECT file_path FROM nodes WHERE label = 'File' AND file_path IS NOT NULL").all() as { file_path: string }[])
-            .map(r => r.file_path),
-        );
-        const graphChurn = churnResult.files.filter(f => graphFiles.has(f.path));
-        const maxWeighted = graphChurn.reduce((m, f) => f.weightedCommits > m ? f.weightedCommits : m, 0);
-        if (maxWeighted > 0) {
-          const updateProps = db.prepare(`
-            UPDATE nodes SET properties = json_set(COALESCE(properties, '{}'), '$.churnScore', ?)
-            WHERE file_path = ? AND label = 'File'
-          `);
-          db.transaction(() => {
-            for (const f of graphChurn) {
-              updateProps.run(f.weightedCommits / maxWeighted, f.path);
-            }
-          })();
-        }
-      }
-    } catch {
-      // churn analysis is non-fatal (e.g. no git history)
-    }
-
-    const hash = getCurrentCommitHash(resolve(repoPath));
-    if (hash) {
-      db.prepare("INSERT OR REPLACE INTO index_meta VALUES ('last_commit_hash', ?)").run(hash);
-    } else {
-      const msg = 'Could not determine git HEAD — staleness tracking will be unavailable';
-      if (options.onProgress) {
-        options.onProgress({ phase: 'warning', message: msg } as PipelineProgress);
-      } else {
-        process.stderr.write(`[monograph] ${msg}\n`);
-      }
-    }
-    db.prepare("INSERT OR REPLACE INTO index_meta VALUES ('indexed_at', ?)").run(new Date().toISOString());
-    db.exec('COMMIT');
-
-    // Skip expensive report regeneration when all files were cached (nothing changed) —
-    // this is purely a performance optimization, not correctness-critical, so it stays
-    // gated behind allFilesCached. This MUST run after COMMIT (issue #91): the async
-    // generateGraphReport overload opens its own DB connection, which in WAL mode only
-    // sees the last committed snapshot — run inside the open transaction, it would render
-    // the report from the previous build (or an empty DB on the first build).
-    if (!ctx.allFilesCached) {
-      try {
-        const suggestOut = outputs.get('suggest') as { questions: SuggestedQuestion[] } | undefined;
-        const questions = suggestOut?.questions ?? [];
-        await generateGraphReport(resolve(repoPath), undefined, dbPath, questions);
-      } catch {
-        // Report generation is non-fatal — the build itself already committed.
-      }
-    }
-  } catch (err) {
-    // Best-effort: if the connection is already broken (e.g. the failure was
-    // itself a corrupt-database error), rolling back can throw too — the
-    // original error is what matters and must not be masked by this one.
-    try { db.exec('ROLLBACK'); } catch { /* ignore */ }
-    throw err;
-  } finally {
-    closeDb(db);
-  }
-}
-
-const INCREMENTAL_THRESHOLD = 20;
-
-export async function buildIncrementalAsync(
-  repoPath: string,
-  changedAbsPaths: string[],
-  options: BuildOptions = {},
-): Promise<void> {
-  if (changedAbsPaths.length === 0) return;
-  if (changedAbsPaths.length > INCREMENTAL_THRESHOLD) {
-    return buildAsync(repoPath, options);
-  }
-
-  const dbPath = resolve(join(repoPath, '.monomind', 'monograph.db'));
-  if (!existsSync(dbPath)) {
-    return buildAsync(repoPath, options);
-  }
-
-  const releaseLock = await acquireBuildLock(dbPath);
-  if (!releaseLock) {
-    options.onProgress?.({ phase: 'skip', message: 'Another build is in progress — skipping incremental' });
-    return;
-  }
-  try {
-    await buildIncrementalLocked(resolve(repoPath), dbPath, changedAbsPaths, options);
-  } finally {
-    releaseLock();
-  }
-}
-
-async function buildIncrementalLocked(
-  resolvedRepo: string,
-  dbPath: string,
-  changedAbsPaths: string[],
-  options: BuildOptions,
-): Promise<void> {
-  const db = openDb(dbPath);
-  const maxSize = options.maxFileSizeBytes ?? DEFAULT_OPTIONS.maxFileSizeBytes;
-
-  db.exec('BEGIN');
-  try {
-    let parsed = 0;
-    let deleted = 0;
-
-    for (const absPath of changedAbsPaths) {
-      const ext = extname(absPath).toLowerCase();
-      if (!isSupportedExtension(ext)) continue;
-      if (ext === '.md' || ext === '.markdown') continue;
-
-      const relPath = absPath.startsWith(resolvedRepo)
-        ? absPath.slice(resolvedRepo.length + 1)
-        : absPath;
-
-      deleteEdgesForFile(db, relPath);
-      deleteNodesForFile(db, relPath);
-
-      if (!existsSync(absPath)) {
-        deleted++;
-        continue;
-      }
-
-      let source: string;
-      try {
-        const stat = statSync(absPath);
-        if (stat.size > maxSize) continue;
-        source = readFileSync(absPath, 'utf-8');
-      } catch { continue; }
-
-      const result = await parseFile(absPath, source, relPath);
-      const nodes: MonographNode[] = [...result.nodes];
-      const edges: MonographEdge[] = [...result.edges];
-
-      if (ext === '.cs') {
-        for (const ns of extractCsharpNamespaces(source, relPath)) {
-          nodes.push({
-            id: `${ns.filePath}::namespace::${ns.name}`,
-            name: ns.name, label: 'Namespace', normLabel: 'namespace',
-            filePath: ns.filePath, line: ns.line, isExported: true,
-          } as MonographNode);
-        }
-      }
-
-      if (['.ts', '.tsx', '.js', '.jsx'].includes(ext)) {
-        const varInfos = extractVariables(source, relPath);
-        nodes.push(...varInfos.map(v => variableToNode(v)));
-        for (const fn of extractArrowFunctions(source, relPath)) {
-          nodes.push({
-            id: `${fn.filePath}::fn::${fn.name}`,
-            name: fn.name, label: 'Function', normLabel: 'function',
-            filePath: fn.filePath, line: fn.line, isExported: fn.isExported,
-          } as MonographNode);
-        }
-      }
-
-      insertNodes(db, nodes);
-      insertEdges(db, edges);
-      parsed++;
-    }
-
-    const hash = getCurrentCommitHash(resolvedRepo);
-    if (hash) {
-      db.prepare("INSERT OR REPLACE INTO index_meta VALUES ('last_commit_hash', ?)").run(hash);
-    }
-    db.prepare("INSERT OR REPLACE INTO index_meta VALUES ('indexed_at', ?)").run(new Date().toISOString());
-    db.exec('COMMIT');
-
-    options.onProgress?.({
-      phase: 'incremental',
-      message: `Incremental: ${parsed} re-parsed, ${deleted} removed`,
-    });
-  } catch (err) {
-    try { db.exec('ROLLBACK'); } catch { /* ignore */ }
-    throw err;
-  } finally {
-    closeDb(db);
-  }
-}

package/src/pipeline/phases/boundary.ts

@@ -1,151 +0,0 @@
-import type Database from 'better-sqlite3';
-import { existsSync, readFileSync } from 'fs';
-import { join } from 'path';
-
-export interface ZoneConfig {
-  name: string;
-  glob: string;
-}
-
-export interface MonographConfig {
-  zones?: ZoneConfig[];
-  allowedImports?: [string, string][];
-}
-
-export interface BoundaryViolation {
-  fromPath: string;
-  toPath: string;
-  fromZone: string;
-  toZone: string;
-  edgeRelation: string;
-}
-
-/**
- * Convert a glob pattern to a regex.
- * Handles: ** to .*, * to [^/]*, escapes other regex chars.
- */
-function globToRegex(glob: string): RegExp {
-  const DOUBLE_STAR = '\x00DS\x00';
-  const pattern = glob
-    .replace(/\*\*/g, DOUBLE_STAR)
-    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-    .replace(/\*/g, '[^/]*')
-    .split(DOUBLE_STAR).join('.*');
-  return new RegExp('^' + pattern + '$');
-}
-
-/** Zone with its regex precompiled — built once per detectBoundaryViolations call. */
-interface CompiledZone {
-  name: string;
-  re: RegExp;
-}
-
-/** Compile a ZoneConfig[] into CompiledZone[] once to avoid reconstructing RegExps per path. */
-function compileZones(zones: ZoneConfig[]): CompiledZone[] {
-  return zones.map(z => ({ name: z.name, re: globToRegex(z.glob) }));
-}
-
-/**
- * Classify a file path into a zone name using precompiled regexes.
- * Returns null if no zone matches.
- */
-function classifyZoneCompiled(filePath: string, compiled: CompiledZone[]): string | null {
-  for (const z of compiled) {
-    if (z.re.test(filePath)) return z.name;
-  }
-  return null;
-}
-
-/**
- * Load .monographrc.json from repoRoot. Returns empty config if not found or invalid.
- */
-export function loadMonographConfig(repoRoot: string): MonographConfig {
-  const configPath = join(repoRoot, '.monographrc.json');
-  if (!existsSync(configPath)) return {};
-  try {
-    const raw = readFileSync(configPath, 'utf-8');
-    return JSON.parse(raw) as MonographConfig;
-  } catch {
-    return {};
-  }
-}
-
-/**
- * Classify a file path into a zone name. Returns null if no zone matches.
- * Compiles the glob patterns on every call — use classifyZoneCompiled with
- * precompiled zones for hot paths.
- */
-export function classifyZone(filePath: string, zones: ZoneConfig[]): string | null {
-  for (const zone of zones) {
-    const regex = globToRegex(zone.glob);
-    if (regex.test(filePath)) return zone.name;
-  }
-  return null;
-}
-
-/**
- * Check all edges in the DB for boundary violations.
- * Violations are cross-zone edges not present in the allowedImports allowlist.
- * Intra-zone imports are always allowed.
- * Returns [] if no .monographrc.json or no zones defined.
- */
-export function detectBoundaryViolations(
-  db: Database.Database,
-  repoRoot: string,
-): BoundaryViolation[] {
-  const config = loadMonographConfig(repoRoot);
-
-  if (!config.zones || config.zones.length === 0) return [];
-
-  const zones = config.zones;
-  const allowedSet = new Set<string>(
-    (config.allowedImports ?? []).map(([from, to]) => `${from}→${to}`),
-  );
-
-  // Precompile zone regexes once — avoids re-constructing RegExp objects per file path.
-  const compiledZones = compileZones(zones);
-
-  const rows = db.prepare(`
-    SELECT e.id, e.relation,
-           ns.file_path AS src_path,
-           nt.file_path AS tgt_path
-    FROM edges e
-    JOIN nodes ns ON ns.id = e.source_id
-    JOIN nodes nt ON nt.id = e.target_id
-    WHERE ns.file_path IS NOT NULL AND nt.file_path IS NOT NULL
-  `).all() as { id: string; relation: string; src_path: string; tgt_path: string }[];
-
-  // Cache per-path zone classification to avoid O(rows * zones) repeated regex tests.
-  const pathZoneCache = new Map<string, string | null>();
-  const classifyPath = (p: string): string | null => {
-    let zone = pathZoneCache.get(p);
-    if (zone === undefined) {
-      zone = classifyZoneCompiled(p, compiledZones);
-      pathZoneCache.set(p, zone);
-    }
-    return zone;
-  };
-
-  const violations: BoundaryViolation[] = [];
-
-  for (const row of rows) {
-    const fromZone = classifyPath(row.src_path);
-    const toZone = classifyPath(row.tgt_path);
-
-    if (fromZone === null || toZone === null) continue;
-    if (fromZone === toZone) continue;
-
-    const key = `${fromZone}→${toZone}`;
-    if (!allowedSet.has(key)) {
-      violations.push({
-        fromPath: row.src_path,
-        toPath: row.tgt_path,
-        fromZone,
-        toZone,
-        edgeRelation: row.relation,
-      });
-    }
-  }
-
-  return violations;
-}