fix(reference): preserve source scope and loader authority

Share parser-owned package and runtime facts across dependency consumers.
Preserve uncertain loader requests and explicit wrapper bindings without
inventing unbound require authority in known modules. Cover selected source
grammar through the public MCP boundary and retain ambient/type dependencies.

Open each selected directory before loading its scoped policy, retaining
partial directory failures and cleanup ownership. Preserve explicit caller
negation precedence and source diagnostics across inventory projections.

Clarify how version comparison retains container provenance without claiming
semantic drift. Use independent unknown source inputs to keep candidate-limit
fixtures meaningful as conditional branch evaluation becomes more precise.

Fixes #6891
Fixes #6882
Fixes #6883
Fixes #6859

src/domain/javascript/javascriptSourceParser.ts

@@ -15,6 +15,13 @@ export type ParsedJavaScriptSource = ReturnType<typeof parse>;
 // Babel's module classification includes erased TypeScript syntax. Keep the
 // runtime proof separate, including explicit filename mode, for every parser entry.
 type JavaScriptRuntimeContext = "module" | "commonjs" | "unknown";
+/** Package scope observed inside a source inventory; missing scope is unknown. */
+export type JavaScriptPackageType =
+  | "module"
+  | "commonjs"
+  | "unspecified"
+  | "unknown";
+
 const runtimeContextByProgram = new WeakMap<
   t.Program,
   JavaScriptRuntimeContext
@@ -53,6 +60,7 @@ const parseWithRuntimeContext = (
   source: string,
   sourcePath: string | undefined,
   options: ParserOptions,
+  packageContext?: JavaScriptPackageType,
 ): ParsedJavaScriptSource => {
   const file = parse(source, options);
   runtimeContextByProgram.set(
@@ -63,13 +71,19 @@ const parseWithRuntimeContext = (
         : "commonjs"
       : isExplicitModuleSourcePath(sourcePath)
         ? "module"
-        : file.program.body.some((node) => t.isTSExportAssignment(node))
-          ? // CommonJS isolation does not establish strict ESM semantics.
-            "commonjs"
-          : file.program.sourceType === "module" &&
-              hasRuntimeModuleDeclaration(file.program)
-            ? "module"
-            : "unknown",
+        : packageContext === "module" || packageContext === "commonjs"
+          ? packageContext
+          : packageContext === "unspecified" && /\.js$/iu.test(sourcePath ?? "")
+            ? file.program.sourceType === "module"
+              ? "module"
+              : "commonjs"
+            : file.program.body.some((node) => t.isTSExportAssignment(node))
+              ? // CommonJS isolation does not establish strict ESM semantics.
+                "commonjs"
+              : file.program.sourceType === "module" &&
+                  hasRuntimeModuleDeclaration(file.program)
+                ? "module"
+                : "unknown",
   );
   return file;
 };
@@ -141,8 +155,25 @@ export const parseRecoveredJavaScript = (
   source: string,
   sourcePath: string | undefined,
   options: Omit<ParserOptions, "sourceType" | "errorRecovery">,
+  observedPackageType?: JavaScriptPackageType,
 ): RecoveredJavaScriptParse => {
-  const sourceType = runtimeSourceTypeForPath(sourcePath);
+  const filenameType = runtimeSourceTypeForPath(sourcePath);
+  // Node package facts apply to .js/.ts sources, not explicit suffixes,
+  // declaration wrappers, or an unknown JSX compilation pipeline.
+  const packageContext =
+    /\.(?:js|ts)$/iu.test(sourcePath ?? "") &&
+    !/\.d\.ts$/iu.test(sourcePath ?? "")
+      ? observedPackageType
+      : undefined;
+  // Retain TypeScript import syntax for later CommonJS compilation.
+  const sourceType =
+    filenameType !== "unambiguous"
+      ? filenameType
+      : packageContext === "module"
+        ? "module"
+        : packageContext === "commonjs" && /\.js$/iu.test(sourcePath ?? "")
+          ? "commonjs"
+          : "unambiguous";
   if (sourceType !== "unambiguous") {
     const normalizedOptions = { ...options };
     if (sourceType === "commonjs") {
@@ -153,32 +184,50 @@ export const parseRecoveredJavaScript = (
       delete normalizedOptions.allowNewTargetOutsideFunction;
     }
     return {
-      file: parseWithRuntimeContext(source, sourcePath, {
-        ...normalizedOptions,
-        sourceType,
-        errorRecovery: true,
-      }),
+      file: parseWithRuntimeContext(
+        source,
+        sourcePath,
+        {
+          ...normalizedOptions,
+          sourceType,
+          errorRecovery: true,
+        },
+        packageContext,
+      ),
       moduleOnlyErrors: [],
     };
   }
-  const file = parseWithRuntimeContext(source, sourcePath, {
-    ...options,
-    sourceType: "unambiguous",
-    errorRecovery: true,
-  });
+  const file = parseWithRuntimeContext(
+    source,
+    sourcePath,
+    {
+      ...options,
+      sourceType: "unambiguous",
+      errorRecovery: true,
+    },
+    packageContext,
+  );
   if (file.program.sourceType !== "script" || file.errors.length === 0)
     return { file, moduleOnlyErrors: [] };
-  const script = parseWithRuntimeContext(source, sourcePath, {
-    ...options,
-    sourceType: "script",
-    errorRecovery: true,
-  });
+  const script = parseWithRuntimeContext(
+    source,
+    sourcePath,
+    {
+      ...options,
+      sourceType: "script",
+      errorRecovery: true,
+    },
+    packageContext,
+  );
   const scriptErrors = new Set(script.errors.map((error) => error.message));
   return {
     file: script,
-    moduleOnlyErrors: file.errors
-      .map((error) => error.message)
-      .filter((message) => !scriptErrors.has(message)),
+    moduleOnlyErrors:
+      javaScriptRuntimeContext(script.program) === "commonjs"
+        ? []
+        : file.errors
+            .map((error) => error.message)
+            .filter((message) => !scriptErrors.has(message)),
   };
 };