Spot the bug in the dependency checker

function forbiddenDependencies(graph, domainModules, adapterModules) {
  const violations = [];
  for (const domain of domainModules) {
    for (const dependency of graph.get(domain) ?? []) {
      if (adapterModules.has(dependency)) {
        violations.push(`${domain} -> ${dependency}`);
      }
    }
  }
  return violations;
}

const graph = new Map([
  ['order', ['shared-money']],
  ['shared-money', ['postgres-decimal']],
]);