openlore 2.0.6 → 2.0.8

package/dist/core/analyzer/call-graph.d.ts

@@ -14,7 +14,7 @@
 import type { ImportMap } from './import-resolver-bridge.js';
 export type EdgeConfidence = 'self_cls' | 'type_inference' | 'import' | 'http_endpoint' | 'same_file' | 'name_only' | 'type_name' | 'external';
 /** Broad relationship kind */
-export type EdgeKind = 'calls' | 'tested_by' | 'references' | 'depends_on';
+export type EdgeKind = 'calls' | 'tested_by' | 'references' | 'depends_on' | 'affects' | 'authored_by' | 'changed_in_pr';
 /** Semantic nature of the call at the call site */
 export type CallType = 'direct' | 'method' | 'awaited' | 'constructor';
 export interface FunctionNode {
@@ -73,6 +73,24 @@ export interface LayerViolation {
     calleeLayer: string;
     reason: string;
 }
+/**
+ * The layer a file belongs to, by the first matching prefix in declared order.
+ * Shared by the call-graph layer detector and the architecture guardrail (spec-23)
+ * so both agree on one layering convention.
+ */
+export declare function layerOf(filePath: string, layers: Record<string, string[]>): string | undefined;
+/**
+ * Classify a single directed edge (from → to) against a layer ordering. Declared
+ * key order is top → bottom; a lower layer depending on an upper layer is a
+ * violation. Returns the offending layer pair, or null when the edge is legal,
+ * unclassified, or intra-layer. The canonical layer-direction primitive — reused
+ * by `detectLayerViolations` (call edges) and the spec-23 architecture checker
+ * (file dependency edges).
+ */
+export declare function classifyLayerEdge(fromFile: string, toFile: string, layers: Record<string, string[]>): {
+    fromLayer: string;
+    toLayer: string;
+} | null;
 /**
  * A class or interface as a structural unit, grouping its methods.
  * Derived from FunctionNode.className after the call graph is built.

package/dist/core/analyzer/call-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call-graph.d.ts","sourceRoot":"","sources":["../../../src/core/analyzer/call-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAU7D,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,gBAAgB,GAChB,QAAQ,GACR,eAAe,GACf,WAAW,GACX,WAAW,GACX,WAAW,GACX,UAAU,CAAC;AAEf,8BAA8B;AAC9B,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,YAAY,GAAG,YAAY,CAAC;AAE3E,mDAAmD;AACnD,MAAM,MAAM,QAAQ,GAChB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,aAAa,CAAC;AAalB,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yGAAyG;IACzG,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mFAAmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,sDAAsD;AACtD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,cAAc,CAAC;IAC3B,yFAAyF;IACzF,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,WAAW,CAAC;CACzD;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjC,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,iFAAiF;IACjF,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,4DAA4D;IAC5D,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,4CAA4C;IAC5C,YAAY,EAAE,YAAY,EAAE,CAAC;IAC7B,uDAAuD;IACvD,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,YAAY,EAAE,YAAY,EAAE,CAAC;IAC7B,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;CACjC;AA26CD,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,IAAI,CAGlD;AAivBD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGlF;AAMD,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;OAWG;IACG,KAAK,CACT,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,EACjE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACjC,SAAS,CAAC,EAAE,SAAS,EACrB,eAAe,CAAC,EAAE,YAAY,EAAE,GAC/B,OAAO,CAAC,eAAe,CAAC;IAmc3B,OAAO,CAAC,qBAAqB;CA0C9B;AAMD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,mBAAmB,CAW/E"}
+{"version":3,"file":"call-graph.d.ts","sourceRoot":"","sources":["../../../src/core/analyzer/call-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAW7D,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,gBAAgB,GAChB,QAAQ,GACR,eAAe,GACf,WAAW,GACX,WAAW,GACX,WAAW,GACX,UAAU,CAAC;AAEf,8BAA8B;AAC9B,MAAM,MAAM,QAAQ,GAChB,OAAO,GACP,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,SAAS,GACT,aAAa,GACb,eAAe,CAAC;AAEpB,mDAAmD;AACnD,MAAM,MAAM,QAAQ,GAChB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,aAAa,CAAC;AAalB,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yGAAyG;IACzG,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mFAAmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,sDAAsD;AACtD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,cAAc,CAAC;IAC3B,yFAAyF;IACzF,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,CAK9F;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAC/B;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAS/C;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,WAAW,CAAC;CACzD;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjC,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,iFAAiF;IACjF,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,4DAA4D;IAC5D,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,4CAA4C;IAC5C,YAAY,EAAE,YAAY,EAAE,CAAC;IAC7B,uDAAuD;IACvD,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,YAAY,EAAE,YAAY,EAAE,CAAC;IAC7B,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;CACjC;AA6+CD,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,IAAI,CAGlD;AAivBD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGlF;AAMD,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;OAWG;IACG,KAAK,CACT,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,EACjE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACjC,SAAS,CAAC,EAAE,SAAS,EACrB,eAAe,CAAC,EAAE,YAAY,EAAE,GAC/B,OAAO,CAAC,eAAe,CAAC;IA8c3B,OAAO,CAAC,qBAAqB;CAyB9B;AAMD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,mBAAmB,CAW/E"}

package/dist/core/analyzer/call-graph.js

@@ -11,13 +11,46 @@
  *  - Entry points    — functions with no internal callers
  *  - Layer violations — cross-layer calls in the wrong direction
  */
-import { dirname, resolve as resolvePath } from 'node:path';
+import { dirname, join as joinPath } from 'node:path';
 import Parser from 'tree-sitter';
 import { FunctionRegistryTrie } from './function-registry-trie.js';
 import { inferTypesFromSource, resolveViaTypeInference } from './type-inference-engine.js';
 import { extractAllHttpEdges } from './http-route-parser.js';
 import { buildProjectedIac } from './iac/index.js';
+import { isIacLanguage } from './iac/types.js';
 import { logger } from '../../utils/logger.js';
+/**
+ * The layer a file belongs to, by the first matching prefix in declared order.
+ * Shared by the call-graph layer detector and the architecture guardrail (spec-23)
+ * so both agree on one layering convention.
+ */
+export function layerOf(filePath, layers) {
+    for (const [layerName, prefixes] of Object.entries(layers)) {
+        if (prefixes.some(p => filePath.includes(p)))
+            return layerName;
+    }
+    return undefined;
+}
+/**
+ * Classify a single directed edge (from → to) against a layer ordering. Declared
+ * key order is top → bottom; a lower layer depending on an upper layer is a
+ * violation. Returns the offending layer pair, or null when the edge is legal,
+ * unclassified, or intra-layer. The canonical layer-direction primitive — reused
+ * by `detectLayerViolations` (call edges) and the spec-23 architecture checker
+ * (file dependency edges).
+ */
+export function classifyLayerEdge(fromFile, toFile, layers) {
+    const order = Object.keys(layers);
+    const fromLayer = layerOf(fromFile, layers);
+    const toLayer = layerOf(toFile, layers);
+    if (!fromLayer || !toLayer || fromLayer === toLayer)
+        return null;
+    const fi = order.indexOf(fromLayer);
+    const ti = order.indexOf(toLayer);
+    if (fi === -1 || ti === -1)
+        return null;
+    return fi > ti ? { fromLayer, toLayer } : null;
+}
 // ============================================================================
 // CONSTANTS
 // ============================================================================
@@ -186,6 +219,79 @@ function findEnclosingFunction(nodes, callPos) {
     }
     return best;
 }
+/**
+ * Cross-domain code↔infra edges (spec-17).
+ *
+ * For each embedded IaC resource (Pulumi/CDK/CDKTF, declared inside a code file),
+ * find the narrowest enclosing code function in the same file by line containment
+ * and emit a `references` edge: enclosing function → resource. This is the single
+ * deterministic link that crosses the code↔infra boundary, so the existing graph
+ * traversal (which already walks `references` edges) answers "what infrastructure
+ * does this code provision?" and the reverse, end-to-end.
+ *
+ * Resources with no enclosing function (e.g. Pulumi declared at module top level)
+ * are left unlinked — there is no code unit to attribute them to. Standalone IaC
+ * (.tf/.yaml) has no co-located code functions, so nothing matches.
+ */
+function linkCodeToInfra(iacNodes, allNodes) {
+    // Index code (non-IaC, non-external) function nodes with known line ranges by file.
+    const codeByFile = new Map();
+    for (const n of allNodes.values()) {
+        if (n.isExternal)
+            continue;
+        if (isIacLanguage(n.language))
+            continue;
+        if (n.startLine === undefined || n.endLine === undefined)
+            continue;
+        const arr = codeByFile.get(n.filePath);
+        if (arr)
+            arr.push(n);
+        else
+            codeByFile.set(n.filePath, [n]);
+    }
+    if (codeByFile.size === 0)
+        return [];
+    const edges = [];
+    const seen = new Set();
+    // Deterministic: iterate resources in id order.
+    const sorted = [...iacNodes].sort((a, b) => a.id.localeCompare(b.id));
+    for (const res of sorted) {
+        if (!isIacLanguage(res.language))
+            continue;
+        if (res.startLine === undefined)
+            continue;
+        const candidates = codeByFile.get(res.filePath);
+        if (!candidates)
+            continue;
+        // Narrowest code function whose line range encloses the resource declaration.
+        let best;
+        let bestSpan = Infinity;
+        for (const fn of candidates) {
+            if (fn.startLine <= res.startLine && res.startLine <= fn.endLine) {
+                const span = fn.endLine - fn.startLine;
+                if (span < bestSpan) {
+                    bestSpan = span;
+                    best = fn;
+                }
+            }
+        }
+        if (!best || best.id === res.id)
+            continue;
+        const key = `${best.id}\0${res.id}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        edges.push({
+            callerId: best.id,
+            calleeId: res.id,
+            calleeName: res.name,
+            line: res.startLine,
+            confidence: 'import',
+            kind: 'references',
+        });
+    }
+    return edges;
+}
 // ============================================================================
 // DOCSTRING / SIGNATURE EXTRACTION HELPERS
 // ============================================================================
@@ -2274,6 +2380,13 @@ export class CallGraphBuilder {
                     allNodes.set(n.id, n);
             edges.push(...iac.edges);
             iacClasses = iac.classes;
+            // Pass 2c.1: Cross-domain code↔infra edges (spec-17).
+            // Embedded IaC (Pulumi/CDK/CDKTF) declares resources *inside* code files.
+            // Link the enclosing code function → the resource it provisions with a
+            // `references` edge, so analyze_impact/get_subgraph traverse the code↔infra
+            // boundary end-to-end. Standalone IaC (.tf/.yaml) has no co-located code, so
+            // no edge is created — those stay infra-only components, exactly as today.
+            edges.push(...linkCodeToInfra(iac.nodes, allNodes));
         }
         catch {
             // IaC extraction is best-effort; never fail the whole build
@@ -2338,7 +2451,10 @@ export class CallGraphBuilder {
             const resolveSource = (rel) => {
                 // Strip .js extension: TS ESM imports use './foo.js' to refer to './foo.ts'
                 const stripped = rel.replace(/\.js$/, '');
-                const base = resolvePath(dir, stripped);
+                // Form-preserving join (NOT resolve): the analyze pipeline passes repo-relative
+                // paths, so resolve() would force an absolute path that never matches the
+                // relative allFilePaths — silently zeroing out import-based tested_by edges.
+                const base = joinPath(dir, stripped);
                 return allFilePaths.find(p => p === base || p === `${base}.ts` || p === `${base}.tsx` ||
                     p === `${base}.js` || p === `${base}.jsx` || p === `${base}/index.ts`);
             };
@@ -2518,39 +2634,23 @@ export class CallGraphBuilder {
         };
     }
     detectLayerViolations(edges, nodes, layers) {
-        // Build ordered layer list (index 0 = top layer, higher index = lower layer)
-        const layerOrder = Object.keys(layers);
-        const getLayer = (filePath) => {
-            for (const [layerName, prefixes] of Object.entries(layers)) {
-                if (prefixes.some(p => filePath.includes(p)))
-                    return layerName;
-            }
-            return undefined;
-        };
         const violations = [];
         for (const edge of edges) {
             const caller = nodes.get(edge.callerId);
             const callee = nodes.get(edge.calleeId);
             if (!caller || !callee)
                 continue;
-            const callerLayer = getLayer(caller.filePath);
-            const calleeLayer = getLayer(callee.filePath);
-            if (!callerLayer || !calleeLayer || callerLayer === calleeLayer)
+            // Lower layer calling upper layer — violation (canonical primitive).
+            const cls = classifyLayerEdge(caller.filePath, callee.filePath, layers);
+            if (!cls)
                 continue;
-            const callerIdx = layerOrder.indexOf(callerLayer);
-            const calleeIdx = layerOrder.indexOf(calleeLayer);
-            if (callerIdx === -1 || calleeIdx === -1)
-                continue;
-            if (callerIdx > calleeIdx) {
-                // Lower layer calling upper layer — violation
-                violations.push({
-                    callerId: edge.callerId,
-                    calleeId: edge.calleeId,
-                    callerLayer,
-                    calleeLayer,
-                    reason: `${callerLayer} calls ${calleeLayer} (${caller.name} → ${callee.name})`,
-                });
-            }
+            violations.push({
+                callerId: edge.callerId,
+                calleeId: edge.calleeId,
+                callerLayer: cls.fromLayer,
+                calleeLayer: cls.toLayer,
+                reason: `${cls.fromLayer} calls ${cls.toLayer} (${caller.name} → ${callee.name})`,
+            });
         }
         return violations;
     }