arkgate 2.12.0 → 3.0.0

package/dist/eslint/index.js

@@ -170,6 +170,368 @@ function isEdgeDenied(rules2, from, to, options) {
   return findDeniedEdgeRule(rules2, from, to, options) !== void 0;
 }
 
+// src/domain/configContract.ts
+var ARK_CONFIG_SCHEMA_VERSION = "1.0";
+var ARK_CONFIG_SCHEMA_URL = "https://unpkg.com/arkgate@2/schemas/ark.config.schema.json";
+var DEFAULT_LAYER_NAMES = [
+  "DomainModel",
+  "ApplicationOrchestration",
+  "PersistenceAdapters",
+  "IntegrationAdapters",
+  "WorkflowSagaEngine",
+  "BackgroundJobsScheduling",
+  "PresentationAdapters",
+  "ReportingReadModels",
+  "ExtensibilityMetadata",
+  "SecurityAuditObservability",
+  "Kernel"
+];
+var DEFAULT_ALLOWED_FLOWS = /* @__PURE__ */ new Set([
+  "PresentationAdapters->ApplicationOrchestration",
+  "ApplicationOrchestration->DomainModel",
+  "WorkflowSagaEngine->ApplicationOrchestration",
+  "WorkflowSagaEngine->DomainModel",
+  "BackgroundJobsScheduling->ApplicationOrchestration"
+]);
+function createDefaultRules() {
+  const rules2 = [];
+  for (const from of DEFAULT_LAYER_NAMES) {
+    for (const to of DEFAULT_LAYER_NAMES) {
+      if (from === to || DEFAULT_ALLOWED_FLOWS.has(`${from}->${to}`)) continue;
+      rules2.push({ from, to, allowed: false });
+    }
+  }
+  return rules2;
+}
+var DEFAULT_ARK_CONFIG_RULES = createDefaultRules();
+var stringArraySchema = {
+  type: "array",
+  items: { type: "string", minLength: 1 },
+  uniqueItems: true
+};
+var ARK_CONFIG_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: ARK_CONFIG_SCHEMA_URL,
+  title: "ArkGate architecture contract",
+  description: "Versioned contract consumed identically by ArkGate CLI, MCP, and ESLint surfaces.",
+  type: "object",
+  additionalProperties: false,
+  required: ["$schema", "schemaVersion", "include", "layers", "rules"],
+  properties: {
+    $schema: {
+      type: "string",
+      minLength: 1,
+      default: ARK_CONFIG_SCHEMA_URL,
+      description: "Editor-facing URL or local path for this JSON Schema."
+    },
+    schemaVersion: {
+      type: "string",
+      const: ARK_CONFIG_SCHEMA_VERSION,
+      default: ARK_CONFIG_SCHEMA_VERSION
+    },
+    name: { type: "string", minLength: 1 },
+    include: { ...stringArraySchema, minItems: 1, default: ["src"] },
+    exclude: { ...stringArraySchema, default: [] },
+    excludeGenerated: { type: "boolean", default: true },
+    frameworkOverlay: { type: "string", minLength: 1 },
+    layers: {
+      type: "array",
+      default: [],
+      items: { $ref: "#/$defs/layer" }
+    },
+    rules: {
+      type: "array",
+      default: DEFAULT_ARK_CONFIG_RULES,
+      items: { $ref: "#/$defs/rule" }
+    },
+    cyclePolicy: {
+      type: "string",
+      enum: ["strict", "soft", "framework-soft", "off"],
+      default: "strict"
+    },
+    dynamicImportAllowlist: { ...stringArraySchema, default: [] },
+    safety: {
+      $ref: "#/$defs/safety",
+      default: {
+        maxTsSuppressions: 0,
+        maxAnyCasts: 0,
+        allowInMemory: false,
+        allowDisabledPeerIsolation: false
+      }
+    }
+  },
+  $defs: {
+    layer: {
+      type: "object",
+      additionalProperties: false,
+      required: ["name", "patterns"],
+      properties: {
+        name: { type: "string", minLength: 1 },
+        patterns: { ...stringArraySchema, minItems: 1 },
+        exclude: stringArraySchema,
+        intentPrefixes: stringArraySchema,
+        description: { type: "string", minLength: 1 },
+        forbiddenGlobals: stringArraySchema,
+        mayImportInfrastructure: { type: "boolean" },
+        optional: { type: "boolean" }
+      }
+    },
+    rule: {
+      type: "object",
+      additionalProperties: false,
+      required: ["from", "to", "allowed"],
+      properties: {
+        from: { type: "string", minLength: 1 },
+        to: { type: "string", minLength: 1 },
+        allowed: { type: "boolean" },
+        message: { type: "string", minLength: 1 },
+        peerIsolation: { type: "boolean" },
+        sliceFolders: { ...stringArraySchema, minItems: 1 }
+      }
+    },
+    safety: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        maxTsSuppressions: { type: "integer", minimum: 0, default: 0 },
+        maxAnyCasts: { type: "integer", minimum: 0, default: 0 },
+        allowInMemory: { type: "boolean", default: false },
+        allowDisabledPeerIsolation: { type: "boolean", default: false }
+      }
+    }
+  }
+};
+var ArkConfigValidationError = class extends Error {
+  issues;
+  source;
+  constructor(source, issues) {
+    super(
+      `Invalid ArkGate config (${source}):
+${issues.map((issue) => `- ${issue.path}: ${issue.message}`).join("\n")}`
+    );
+    this.name = "ArkConfigValidationError";
+    this.source = source;
+    this.issues = issues;
+  }
+};
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function propertyPath(parent, key) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? `${parent}.${key}` : `${parent}[${JSON.stringify(key)}]`;
+}
+function valueType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function resolveSchemaRef(ref, root) {
+  const prefix = "#/$defs/";
+  if (!ref.startsWith(prefix)) return void 0;
+  return root.$defs[ref.slice(prefix.length)];
+}
+function validateNode(value, schema, path2, root, issues) {
+  if (schema.$ref) {
+    const referenced = resolveSchemaRef(schema.$ref, root);
+    if (!referenced) {
+      issues.push({ path: path2, message: `schema reference ${schema.$ref} cannot be resolved` });
+      return;
+    }
+    validateNode(value, referenced, path2, root, issues);
+    return;
+  }
+  if (schema.const !== void 0 && !Object.is(value, schema.const)) {
+    issues.push({ path: path2, message: `must equal ${JSON.stringify(schema.const)}` });
+    return;
+  }
+  if (schema.enum && !schema.enum.some((candidate) => Object.is(candidate, value))) {
+    issues.push({ path: path2, message: `must be one of ${schema.enum.map(String).join(", ")}` });
+    return;
+  }
+  if (schema.type === "object") {
+    if (!isObject(value)) {
+      issues.push({ path: path2, message: `must be an object; received ${valueType(value)}` });
+      return;
+    }
+    const properties = schema.properties ?? {};
+    for (const key of schema.required ?? []) {
+      if (value[key] === void 0) {
+        issues.push({ path: propertyPath(path2, key), message: "is required" });
+      }
+    }
+    if (schema.additionalProperties === false) {
+      for (const key of Object.keys(value)) {
+        if (!(key in properties)) {
+          issues.push({ path: propertyPath(path2, key), message: "unknown field" });
+        }
+      }
+    }
+    for (const [key, childSchema] of Object.entries(properties)) {
+      if (value[key] !== void 0) {
+        validateNode(value[key], childSchema, propertyPath(path2, key), root, issues);
+      }
+    }
+    return;
+  }
+  if (schema.type === "array") {
+    if (!Array.isArray(value)) {
+      issues.push({ path: path2, message: `must be an array; received ${valueType(value)}` });
+      return;
+    }
+    if (schema.minItems !== void 0 && value.length < schema.minItems) {
+      issues.push({ path: path2, message: `must contain at least ${schema.minItems} item(s)` });
+    }
+    if (schema.uniqueItems) {
+      const serialized = value.map((entry) => JSON.stringify(entry));
+      if (new Set(serialized).size !== serialized.length) {
+        issues.push({ path: path2, message: "must not contain duplicate items" });
+      }
+    }
+    if (schema.items) {
+      value.forEach(
+        (entry, index) => validateNode(entry, schema.items, `${path2}[${index}]`, root, issues)
+      );
+    }
+    return;
+  }
+  if (schema.type === "string") {
+    if (typeof value !== "string") {
+      issues.push({ path: path2, message: `must be a string; received ${valueType(value)}` });
+      return;
+    }
+    if (schema.minLength !== void 0 && value.length < schema.minLength) {
+      issues.push({ path: path2, message: `must contain at least ${schema.minLength} character(s)` });
+    }
+    return;
+  }
+  if (schema.type === "boolean") {
+    if (typeof value !== "boolean") {
+      issues.push({ path: path2, message: `must be a boolean; received ${valueType(value)}` });
+    }
+    return;
+  }
+  if (schema.type === "integer") {
+    if (!Number.isInteger(value)) {
+      issues.push({ path: path2, message: `must be an integer; received ${valueType(value)}` });
+      return;
+    }
+    if (schema.minimum !== void 0 && value < schema.minimum) {
+      issues.push({ path: path2, message: `must be at least ${schema.minimum}` });
+    }
+  }
+}
+function defaultedConfig(input) {
+  return {
+    ...input,
+    $schema: input.$schema === void 0 ? ARK_CONFIG_SCHEMA_URL : input.$schema,
+    schemaVersion: input.schemaVersion === void 0 ? ARK_CONFIG_SCHEMA_VERSION : input.schemaVersion,
+    include: input.include === void 0 ? ["src"] : input.include,
+    layers: input.layers === void 0 ? [] : input.layers,
+    rules: input.rules === void 0 ? DEFAULT_ARK_CONFIG_RULES.map((rule) => ({ ...rule })) : input.rules
+  };
+}
+function migrateArkConfig(input, source = "ark.config.json") {
+  if (!isObject(input)) {
+    throw new ArkConfigValidationError(source, [
+      { path: "$", message: `must be an object; received ${valueType(input)}` }
+    ]);
+  }
+  const migratedFrom = input.schemaVersion === void 0 ? "unversioned" : null;
+  if (input.schemaVersion !== void 0 && input.schemaVersion !== ARK_CONFIG_SCHEMA_VERSION) {
+    throw new ArkConfigValidationError(source, [
+      {
+        path: "$.schemaVersion",
+        message: `unsupported version ${JSON.stringify(input.schemaVersion)}; expected ${ARK_CONFIG_SCHEMA_VERSION}`
+      }
+    ]);
+  }
+  return { candidate: defaultedConfig(input), migratedFrom };
+}
+function loadArkConfigContract(input, source = "ark.config.json") {
+  const { candidate, migratedFrom } = migrateArkConfig(input, source);
+  const issues = [];
+  validateNode(
+    candidate,
+    ARK_CONFIG_SCHEMA,
+    "$",
+    ARK_CONFIG_SCHEMA,
+    issues
+  );
+  if (issues.length > 0) throw new ArkConfigValidationError(source, issues);
+  return { config: candidate, migratedFrom };
+}
+function parseArkConfigJson(json, source = "ark.config.json") {
+  let input;
+  try {
+    input = JSON.parse(json);
+  } catch (error) {
+    throw new ArkConfigValidationError(source, [
+      {
+        path: "$",
+        message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
+      }
+    ]);
+  }
+  return loadArkConfigContract(input, source);
+}
+
+// src/domain/adapterContract.ts
+function text(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function positiveInteger(value, fallback) {
+  return Number.isInteger(value) && Number(value) > 0 ? Number(value) : fallback;
+}
+function toAdapterDiagnostic(violation, fallbackSeverity = "error") {
+  const ruleId = text(violation.ruleId) ?? text(violation.code) ?? "ARK_UNKNOWN";
+  const severity = violation.severity === "warning" ? "warning" : fallbackSeverity;
+  const evidence = {
+    ...text(violation.target) ? { target: text(violation.target) } : {},
+    ...text(violation.fromLayer) ? { fromLayer: text(violation.fromLayer) } : {},
+    ...text(violation.toLayer) ? { toLayer: text(violation.toLayer) } : {},
+    ...typeof violation.typeOnly === "boolean" ? { typeOnly: violation.typeOnly } : {}
+  };
+  return {
+    ruleId,
+    severity,
+    message: text(violation.message) ?? ruleId,
+    location: {
+      file: text(violation.file) ?? "<unknown>",
+      line: positiveInteger(violation.line, 1),
+      column: positiveInteger(violation.column, 1)
+    },
+    evidence
+  };
+}
+
+// src/domain/sourcePolicy.ts
+var SOURCE_POLICY_MESSAGES = {
+  RAW_EVENT_PUBLISH: "Publish through a registered intent creator; raw event objects or intent strings bypass Ark contracts and tooling.",
+  PUBLISH_MISSING_SOURCE: "Strict Ark publish calls must include metadata.source."
+};
+function looksLikeArkIntent(value) {
+  return /^(Domain|Application|Adapter|Workflow|Job|Presentation|Reporting|Metadata|Security|Audit|Observability|Kernel)\.[A-Za-z0-9_.]+$/.test(
+    value
+  );
+}
+function classifyPublishFacts(facts) {
+  if (!facts.publishCall) return [];
+  const findings = [];
+  if (facts.rawIntentName !== void 0 && looksLikeArkIntent(facts.rawIntentName) || facts.objectHasIntent) {
+    findings.push({
+      ruleId: "RAW_EVENT_PUBLISH",
+      message: SOURCE_POLICY_MESSAGES.RAW_EVENT_PUBLISH
+    });
+  }
+  if (facts.arkPublishCandidate && !facts.hasSource) {
+    findings.push({
+      ruleId: "PUBLISH_MISSING_SOURCE",
+      message: SOURCE_POLICY_MESSAGES.PUBLISH_MISSING_SOURCE
+    });
+  }
+  return findings;
+}
+
 // src/eslint/index.ts
 function lintedFilename(context) {
   if (typeof context.physicalFilename === "string" && context.physicalFilename.length > 0) {
@@ -187,6 +549,15 @@ function lintedFilename(context) {
   }
   return "";
 }
+function reportAdapterDiagnostic(context, node, messageId, violation, data) {
+  const diagnostic = toAdapterDiagnostic({
+    ...violation,
+    line: violation.line ?? node.loc?.start?.line,
+    column: violation.column ?? (typeof node.loc?.start?.column === "number" ? node.loc.start.column + 1 : void 0)
+  });
+  context.report({ node, messageId, ...data ? { data } : {}, diagnostic });
+  return diagnostic;
+}
 function findConfigPath(startFile) {
   if (!startFile || startFile === "<input>" || startFile.startsWith("stdin")) return null;
   let dir = path.dirname(path.resolve(startFile));
@@ -201,14 +572,10 @@ function findConfigPath(startFile) {
 var _configCache = /* @__PURE__ */ new Map();
 function loadArkConfig(configPath) {
   if (_configCache.has(configPath)) return _configCache.get(configPath) ?? null;
-  try {
-    const raw = JSON.parse(fs.readFileSync(configPath, "utf8"));
-    _configCache.set(configPath, raw);
-    return raw;
-  } catch {
-    _configCache.set(configPath, null);
-    return null;
-  }
+  if (!fs.existsSync(configPath)) return null;
+  const config = parseArkConfigJson(fs.readFileSync(configPath, "utf8"), configPath).config;
+  _configCache.set(configPath, config);
+  return config;
 }
 function resolveRelativeImport(fromFile, specifier) {
   if (!specifier.startsWith(".")) return null;
@@ -239,6 +606,46 @@ function stringValue(node) {
 function propertyName(node) {
   return node?.name ?? stringValue(node);
 }
+function sourceCodeFor(context) {
+  return context.sourceCode ?? context.getSourceCode?.();
+}
+function referenceFor(context, node) {
+  let scope = sourceCodeFor(context)?.getScope?.(node);
+  while (scope) {
+    const reference = scope.references?.find((candidate) => candidate.identifier === node);
+    if (reference) return reference;
+    scope = scope.upper ?? void 0;
+  }
+  return void 0;
+}
+function isLocallyBound(context, node, name) {
+  const reference = referenceFor(context, node);
+  if (reference?.resolved) return (reference.resolved.defs?.length ?? 0) > 0;
+  let scope = sourceCodeFor(context)?.getScope?.(node);
+  while (scope) {
+    const variable = scope.set?.get(name);
+    if (variable) return (variable.defs?.length ?? 0) > 0;
+    scope = scope.upper ?? void 0;
+  }
+  return false;
+}
+function isValueIdentifierReference(context, node) {
+  const reference = referenceFor(context, node);
+  if (reference) return reference.isValueReference !== false;
+  return node.parent?.type === "VariableDeclarator" && node.parent.init === node;
+}
+function memberExpressionPath(node) {
+  if (node?.type === "Identifier" && node.name) {
+    return { root: node, segments: [node.name] };
+  }
+  if (!node) return void 0;
+  const memberLike = node.type === "MemberExpression" || Boolean(node.object && node.property);
+  if (!memberLike || node.computed === true) return void 0;
+  const base = memberExpressionPath(node.object);
+  const property = propertyName(node.property);
+  if (!base || !property) return void 0;
+  return { root: base.root, segments: [...base.segments, property] };
+}
 function calleePropertyName(node) {
   return propertyName(node.callee?.property);
 }
@@ -252,38 +659,14 @@ function objectHasMetadataSource(node) {
   const metadata = objectProperty(node, "metadata")?.value;
   return objectHasProperty(metadata, "source");
 }
-function looksLikeIntent(value) {
-  return /^(Domain|Application|Adapter|Workflow|Job|Presentation|Reporting|Metadata|Security|Audit|Observability|Kernel)\.[A-Za-z0-9_.]+$/.test(
-    value
-  );
-}
 function isPublishCall(node) {
   return calleePropertyName(node) === "publish";
 }
-function isDomainFileHeuristic(filename) {
-  const normalized = filename.split("\\").join("/").toLowerCase();
-  return normalized.includes("/domain/") || normalized.endsWith("/domain.ts");
-}
-function isInfraImportHeuristic(specifier) {
-  const normalized = specifier.toLowerCase();
-  return [
-    "adapter",
-    "adapters",
-    "infrastructure",
-    "persistence",
-    "repository",
-    "repositories",
-    "integration",
-    "database",
-    "db"
-  ].some((token) => normalized.includes(token));
-}
-var DEFAULT_FORBIDDEN_GLOBALS = ["fetch", "process", "Date.now", "Math.random"];
 var noDomainInfraImports = {
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow imports that violate ark.config.json layer rules (same contract as arkgate-check). Falls back to domain\u2192infra path heuristics when no config is found."
+      description: "Disallow imports that violate ark.config.json layer rules (same contract as arkgate-check)."
     },
     messages: {
       forbiddenImport: "Architecture: {{fromLayer}} must not import {{toLayer}} (ark.config.json). Specifier: {{specifier}}",
@@ -315,17 +698,24 @@ var noDomainInfraImports = {
           toPath: relTarget,
           layers: config.layers
         })) {
-          context.report({
+          reportAdapterDiagnostic(
+            context,
             node,
-            messageId: "forbiddenImport",
-            data: { fromLayer, toLayer, specifier: source }
-          });
+            "forbiddenImport",
+            {
+              ruleId: "LAYER_IMPORT_VIOLATION",
+              file: relFile,
+              fromLayer,
+              toLayer,
+              target: relTarget,
+              ...node.importKind === "type" ? { typeOnly: true } : {},
+              message: `${fromLayer} must not import ${toLayer}.`
+            },
+            { fromLayer, toLayer, specifier: source }
+          );
         }
         return;
       }
-      if (isDomainFileHeuristic(filename) && isInfraImportHeuristic(source)) {
-        context.report({ node, messageId: "forbiddenImportHeuristic" });
-      }
     };
     return {
       ImportDeclaration: check,
@@ -348,11 +738,21 @@ var noRawEventPublish = {
   create(context) {
     return {
       CallExpression(node) {
-        if (!isPublishCall(node)) return;
         const firstArg = node.arguments?.[0];
         const firstValue = stringValue(firstArg);
-        if (firstValue && looksLikeIntent(firstValue) || objectHasProperty(firstArg, "intent")) {
-          context.report({ node, messageId: "rawPublish" });
+        const findings = classifyPublishFacts({
+          publishCall: isPublishCall(node),
+          rawIntentName: firstValue,
+          objectHasIntent: objectHasProperty(firstArg, "intent"),
+          arkPublishCandidate: false,
+          hasSource: true
+        });
+        if (findings.some((finding) => finding.ruleId === "RAW_EVENT_PUBLISH")) {
+          const finding = findings.find((item) => item.ruleId === "RAW_EVENT_PUBLISH");
+          reportAdapterDiagnostic(context, node, "rawPublish", {
+            ...finding,
+            file: lintedFilename(context)
+          });
         }
       }
     };
@@ -372,13 +772,22 @@ var requirePublishSource = {
   create(context) {
     return {
       CallExpression(node) {
-        if (!isPublishCall(node)) return;
         const firstArg = node.arguments?.[0];
         const metadataArg = node.arguments?.[2];
-        if (objectHasMetadataSource(firstArg) || objectHasProperty(metadataArg, "source")) {
-          return;
+        const findings = classifyPublishFacts({
+          publishCall: isPublishCall(node),
+          rawIntentName: stringValue(firstArg),
+          objectHasIntent: objectHasProperty(firstArg, "intent"),
+          arkPublishCandidate: true,
+          hasSource: objectHasMetadataSource(firstArg) || objectHasProperty(metadataArg, "source")
+        });
+        const finding = findings.find((item) => item.ruleId === "PUBLISH_MISSING_SOURCE");
+        if (finding) {
+          reportAdapterDiagnostic(context, node, "missingSource", {
+            ...finding,
+            file: lintedFilename(context)
+          });
         }
-        context.report({ node, messageId: "missingSource" });
       }
     };
   }
@@ -387,7 +796,7 @@ var noForbiddenGlobals = {
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow ambient globals from the layer\u2019s forbiddenGlobals in ark.config.json (same purity surface as arkgate-check). Option `globals` overrides. Without config, defaults apply only on domain-like paths."
+      description: "Disallow ambient globals from the layer\u2019s forbiddenGlobals in ark.config.json (same purity surface as ark-check). Option `globals` explicitly overrides."
     },
     messages: {
       forbiddenGlobal: 'Ambient global "{{name}}" is forbidden in {{layer}} (ark.config.json); inject the capability through a port instead.',
@@ -425,32 +834,63 @@ var noForbiddenGlobals = {
       } else {
         globals = null;
       }
-    } else if (isDomainFileHeuristic(filename)) {
-      globals = new Set(DEFAULT_FORBIDDEN_GLOBALS);
     }
     if (!globals) {
       return {};
     }
-    const report = (node, name) => context.report({
-      node,
-      messageId: config ? "forbiddenGlobal" : "forbiddenGlobalDefault",
-      data: { name, layer: layerName }
-    });
+    const scopeAware = typeof sourceCodeFor(context)?.getScope === "function";
+    const report = (node, name) => {
+      const absFile = path.isAbsolute(filename) ? filename : path.resolve(filename);
+      const reportFile = root ? path.relative(root, absFile).split(path.sep).join("/") : filename;
+      reportAdapterDiagnostic(
+        context,
+        node,
+        config ? "forbiddenGlobal" : "forbiddenGlobalDefault",
+        {
+          ruleId: "FORBIDDEN_GLOBAL",
+          file: reportFile,
+          fromLayer: layerName,
+          target: name,
+          message: `${layerName} must not use the ambient global "${name}".`
+        },
+        { name, layer: layerName }
+      );
+    };
     return {
       MemberExpression(node) {
-        const base = node.object?.type === "Identifier" ? node.object.name : void 0;
-        if (!base) return;
-        const dotted = `${base}.${propertyName(node.property) ?? ""}`;
-        if (globals.has(dotted)) report(node, dotted);
-        else if (globals.has(base)) report(node, base);
+        if (node.parent?.type === "MemberExpression" && node.parent.object === node) return;
+        const path2 = memberExpressionPath(node);
+        if (!path2 || isLocallyBound(context, path2.root, path2.segments[0])) return;
+        const explicitGlobalThis = path2.segments[0] === "globalThis";
+        const normalized = explicitGlobalThis ? path2.segments.slice(1) : path2.segments;
+        let match;
+        for (let length = normalized.length; length >= (explicitGlobalThis ? 1 : 2); length -= 1) {
+          const candidate = normalized.slice(0, length).join(".");
+          if (globals.has(candidate)) {
+            match = candidate;
+            break;
+          }
+        }
+        if (match) report(node, match);
+        else if (!scopeAware && globals.has(path2.segments[0])) {
+          report(node, path2.segments[0]);
+        }
       },
       CallExpression(node) {
+        if (scopeAware) return;
         const callee = node.callee?.type === "Identifier" ? node.callee.name : void 0;
         if (callee && globals.has(callee)) report(node, callee);
       },
       NewExpression(node) {
+        if (scopeAware) return;
         const callee = node.callee?.type === "Identifier" ? node.callee.name : void 0;
         if (callee && globals.has(callee)) report(node, callee);
+      },
+      Identifier(node) {
+        if (!scopeAware || !node.name || !globals.has(node.name) || !isValueIdentifierReference(context, node) || isLocallyBound(context, node, node.name)) {
+          return;
+        }
+        report(node, node.name);
       }
     };
   }
@@ -489,4 +929,3 @@ export {
   requirePublishSource,
   resolveRelativeImport
 };
-//# sourceMappingURL=index.js.map