Share parser-owned package and runtime facts across dependency consumers.
Preserve uncertain loader requests and explicit wrapper bindings without
inventing unbound require authority in known modules. Cover selected source
grammar through the public MCP boundary and retain ambient/type dependencies.
Open each selected directory before loading its scoped policy, retaining
partial directory failures and cleanup ownership. Preserve explicit caller
negation precedence and source diagnostics across inventory projections.
Clarify how version comparison retains container provenance without claiming
semantic drift. Use independent unknown source inputs to keep candidate-limit
fixtures meaningful as conditional branch evaluation becomes more precise.
Fixes#6891Fixes#6882Fixes#6883Fixes#6859
Route legacy nested import-expression handling through the same exact-literal owner as dynamic imports, removing a duplicate string-only check.
Fixes#6654
Route exported external import-equals declarations through the same relationship owner as plain declarations so their required target is not dropped.
Fixes#6655
Use the shared exact-literal reader for dynamic imports, preserving expression-free templates and transparent TypeScript wrappers while leaving computed targets unknown.
Fixes#6654
* fix(source): retain CommonJS requires spelled as exact no-substitution templates
Admit expression-free template arguments at the CommonJS require gate and
read their single cooked quasi through the shared exact-literal reader.
Scope is the require path only: static ESM template declarations keep their
parse failures and dynamic import() keeps the explicit unknown/partial
<dynamic-import> relationship with no invented target.
Refs: #4382
* fix(source): admit TypeScript-wrapped exact require arguments via the shared literal reader
Address review: the require gate matched the outer AST node, so
runtime-transparent TS wrappers (as const, !, satisfies) around exact
strings or expression-free templates were still silently omitted even
though readExactJavaScriptLiteral unwraps them. Remove the gate and let
the shared exact-literal reader own argument exactness; computed
arguments remain silent and dynamic import() behavior is unchanged.
Refs: #4382
---------
Co-authored-by: Hemang Varshney <218273197+hemv-857@users.noreply.github.com>
Distinguish call-form require from TypeScript import-equals before resolving
inventory paths. Probe CommonJS files before indexes and honor package main
without requiring an index. Retain selected manifest directory identities and
reuse the path lookup owner for canonical ambiguity.
Validated with source/reader tests and a public CLI fixture controlled by the
pinned Node loader. Windows no-follow reader behavior remains unverified.
Refs #3895, #3896, #3973, #4017.
Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com>
Co-authored-by: IssueHunter Worker <issuehunter@users.noreply.github.com>
* fix(reference): report sloppy scripts, PHP, C# and enclosing Git facts
Importing the source/ subtree of a legacy PHP and C# checkout produced
four wrong or missing facts:
- Babel's unambiguous mode parses a module first and keeps its
strict-mode recovery errors after falling back to a script, so a valid
sloppy-mode `delete messages;` was reported as a parse failure and the
semantic IR marked the file as parser-recovered. Parsing now goes
through one owner that re-parses such a script as a script.
- .php and .cs files had no language; they are now detected as PHP and
C# (detection only, no parsing).
- A root without its own .git was reported as having no version
control even inside a checkout. The adapter now resolves the nearest
enclosing repository, as Git does, and reports `none` only when no
ancestor has one.
- The CLI recorded importer_version as null although the package
version is known.
* fix(reference): keep module strictness and classify C# and PHP as source
Review follow-up. `.mjs` and `.mts` files are modules by extension, but
the script fallback re-parsed them in sloppy mode and erased real
strict-mode errors. The parser boundary now owns the extension rule,
parses explicit modules as modules and applies the fallback only when
the mode is ambiguous; the require-binding analysis uses the same rule.
`.cs` and `.php` received a language but stayed classified as unknown,
so source-to-bundle comparison dropped them. Both are now source
extensions, like the other detected languages.
* fix(reference): honor package module scope and keep unknown-mode strict errors
Review follow-up. A `.js` file under a package.json with `"type":
"module"` is an ES module, but it went through the script fallback that
erases strict-mode errors. The import now reads each in-inventory
package.json and parses `.js` files in a module scope as modules. Other
`.js` and `.ts` sources keep an unknown mode, because bundlers treat them
as modules without that field: they are no longer forced to script, and
errors that only the module parse reports are kept as an entry limitation.
* fix(reference): bound package scopes and keep application parsing unchanged
Review follow-up.
- `.cjs` files parse as scripts, so module-only strict errors no longer
become limitations on CommonJS trees. `.cts` keeps an unknown mode
because TypeScript compiles ES import syntax there.
- An unreadable or linked package.json now bounds the module scope with
an unknown type instead of letting an outer `"type": "module"` apply.
- The application pipeline parses as on main again. Its module-only
strict errors keep a source partial; package-mode handling stays in the
reference importer.
* refactor(reference): keep unmarked module modes unknown instead of resolving package scope
Review follow-up. Resolving Node package scope for `.js` kept pulling in
more of Node's lookup semantics (require bindings, excluded or
directory-named manifests). Only extensions now select a mode: `.mjs`
and `.mts` parse as modules and `.cjs` as scripts. Every other source
keeps an unknown mode, so module-only strict errors stay visible as an
entry limitation instead of being dropped or asserted. This matches the
require-binding analysis, which also treats unmarked paths as unknown.
Reuse lexical ownership to exclude shadowed require calls while retaining native CommonJS and direct createRequire bindings. Preserve candidate edges when JavaScript or TypeScript runtime mode is unknown.
Co-authored-by: Rudy Celekli <rudy@gradiahq.com>
Share parser modes and collision-free composite keys, enforce architecture guards, and consolidate redundant unit assertions into filesystem, CLI, MCP, and producer-backed workflows. Preserve concurrent upstream boundary fixes and exclude legacy Objective-C class-name bookkeeping labels.
Validation: source/composition suites (3358 passing), focused canonical digest and MCP checks, typecheck/lint, Knip, formatting, architecture guards, and real Foundation archive and Apple legacy simulator CLI/MCP verification. No real Hopper, Ghidra, or IDA verification claim.
Remove forwarding wrappers and shadow aliases, migrate callers and verification scripts to their owners, and share one exhaustive semantic resource-bound projection.
morluto