ucn 5.0.6 → 5.1.1

package/core/callers.js

@@ -148,6 +148,54 @@ function _javaPackageKey(relativePath) {
     return path.posix.dirname(packagePath);
 }
 
+/**
+ * Resolve a capitalized Java receiver NAME through the file's static imports
+ * to a static FIELD's declared type (fix #286c, jsoup-measured: `import
+ * static ...SimpleBufferedInput.BufferPool` binds `BufferPool.borrow()` to
+ * the SoftPool-typed field — javac resolves single-static-imports ahead of
+ * the capitalized static-call reading). Returns the declared type HEAD, or
+ * null when the name isn't a static-imported field (a static import naming a
+ * nested TYPE keeps type-qualified semantics), the field has no usable
+ * declared type, or the type head is package-qualified (unpinnable here —
+ * the #268(4a) qualified-field discipline).
+ */
+function _javaStaticImportedFieldType(index, fileEntry, receiverName) {
+    if (!receiverName || !fileEntry) return null;
+    // Single-static-imports only: the import record cannot distinguish a
+    // STATIC wildcard (`import static Owner.*` — imports fields) from a
+    // package wildcard (`import com.ex.*` — types only), and typing a
+    // receiver from a field javac never binds could exclude a true edge.
+    const candidates = [];
+    for (const im of (fileEntry.importBindings || [])) {
+        const mod = String(im.module || '');
+        if (im.name === receiverName && mod.endsWith('.' + receiverName)) {
+            const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[mod];
+            if (rel) candidates.push(rel);
+            break;
+        }
+    }
+    for (const rel of candidates) {
+        const entry = index.files.get(path.join(index.root, rel));
+        if (!entry) continue;
+        // The import binding shape also matches plain class imports
+        // (`import com.ex.BufferPool`): any resolved TYPE of the name —
+        // top-level or nested — keeps static-call semantics.
+        const namedType = (entry.symbols || []).some(s =>
+            s.name === receiverName &&
+            ['class', 'interface', 'enum', 'record', 'annotation'].includes(s.type));
+        if (namedType) return null;
+        const field = (entry.symbols || []).find(s =>
+            s.name === receiverName && s.className &&
+            (s.type === 'field' || s.memberType === 'field') &&
+            (s.modifiers || []).includes('static'));
+        if (!field) continue;
+        const head = String(field.fieldType || '').replace(/<[\s\S]*$/, '').trim();
+        if (!head || head.includes('.') || head.endsWith('[]')) return null;
+        return head;
+    }
+    return null;
+}
+
 function _javaConstructorDisposition(index, filePath, fileEntry, call, targetDefs) {
     const typeKinds = new Set(['class', 'record', 'enum']);
     const targets = (targetDefs || []).filter(d => typeKinds.has(d.type));
@@ -271,6 +319,8 @@ function findCallers(index, name, options = {}) {
     const typeQueryTargets = options.targetDefinitions || definitions;
     const targetIsTypeQuery = typeQueryTargets.length > 0 &&
         typeQueryTargets.every(target => IDENTITY_TYPE_KINDS.has(target.type));
+    const targetDefinitionFiles = new Set(
+        typeQueryTargets.map(definition => definition.file).filter(Boolean));
 
     // Possible-dispatch tiering inputs (nominal contract surface) — all fixed
     // per query, computed lazily once. targetTypes mirrors the receiver-class
@@ -435,7 +485,8 @@ function findCallers(index, name, options = {}) {
             const moduleFile = path.join(index.root, rel);
             if (!aliasTargetFiles.has(moduleFile)) continue;
             const exported = index.files.get(moduleFile)?.exportDetails || [];
-            if (!exported.some(e => e.type === 'module.exports' && e.name === name)) continue;
+            if (!exported.some(e => e.type === 'module.exports' &&
+                e.defaultLike && (e.localName || e.name) === name)) continue;
             if (!importAliasLocals.has(fp)) importAliasLocals.set(fp, new Set());
             importAliasLocals.get(fp).add(b.alias || b.name);
         }
@@ -557,6 +608,8 @@ function findCallers(index, name, options = {}) {
         try {
             const calls = getCachedCalls(index, filePath);
             if (!calls) continue;
+            const structuralLanguage =
+                langTraits(fileEntry.language)?.typeSystem === 'structural';
 
             for (let call of calls) {
                 // Skip if not matching our target name (also check alias resolution)
@@ -1792,6 +1845,21 @@ function findCallers(index, name, options = {}) {
                         options.targetDefinitions || definitions);
                     if (resolvedByExtensionMethod) receiverTypeValidated = true;
                 }
+                // A static-imported FIELD shadows the capitalized static-
+                // qualifier reading (fix #286c, jsoup-measured): javac binds
+                // `BufferPool.borrow()` to the SoftPool-typed field imported
+                // by `import static ...SimpleBufferedInput.BufferPool`, never
+                // to a class named BufferPool. The declared type is compiler-
+                // true — feed it to the normal nominal receiver physics.
+                if (call.isMethod && !call.receiverType && call.receiver &&
+                    fileEntry.language === 'java' && /^[A-Z]/.test(call.receiver)) {
+                    const staticFieldType = _javaStaticImportedFieldType(
+                        index, fileEntry, call.receiver);
+                    if (staticFieldType) {
+                        call = { ...call, receiverType: staticFieldType,
+                            receiverIsTypeQualified: false };
+                    }
+                }
                 if (collectAccount && call.isMethod && !call.receiverType &&
                     fileEntry.language === 'java' && /^[A-Z]/.test(call.receiver || '')) {
                     // Java permits inherited static methods to be invoked
@@ -2242,6 +2310,16 @@ function findCallers(index, name, options = {}) {
                     }
                 }
 
+                // Resolve this before the generic untyped-field guard below:
+                // `api.nested.run()` is syntactically a field receiver, but an
+                // exported namespace chain can make both hops compiler-exact.
+                const recvExportedNamespace = (!call.receiverIsModule && call.isMethod &&
+                    (call.receiver || call.receiverRoot) &&
+                    structuralLanguage)
+                    ? _importedNamespaceMemberOwnership(
+                        index, fileEntry, call, targetDefinitionFiles)
+                    : null;
+
                 // Go package-owned value receiver (`io.Discard.Write`). The
                 // imported package owns `Discard`; file/package method-name
                 // bindings cannot identify its concrete type. Keep the edge
@@ -2263,7 +2341,7 @@ function findCallers(index, name, options = {}) {
                 // allowing a same-file `query` definition to claim it.
                 if (collectAccount && call.isMethod && call.receiverField &&
                     !call.receiverType && !fieldHopType && !fieldDispatchType &&
-                    !resolvedBySameClass &&
+                    !resolvedBySameClass && !recvExportedNamespace &&
                     ['javascript', 'typescript', 'tsx', 'html'].includes(
                         fileEntry.language)) {
                     routeUnverified(
@@ -2553,7 +2631,9 @@ function findCallers(index, name, options = {}) {
                                 continue;
                             }
                             const resolvedAbs = path.join(index.root, rel);
-                            const verdict = _nameBindingReaches(index, resolvedAbs, b.name, tFiles);
+                            const verdict = b.defaultLike
+                                ? _defaultBindingReaches(index, resolvedAbs, tFiles)
+                                : _nameBindingReaches(index, resolvedAbs, b.name, tFiles);
                             if (verdict === 'yes') { reaches = true; break; }
                             if (verdict === 'unknown') undetermined = true;
                         }
@@ -2731,12 +2811,18 @@ function findCallers(index, name, options = {}) {
                 const recvSubmoduleRel = (!call.receiverIsModule && call.isMethod && call.receiver &&
                     langTraits(fileEntry.language)?.typeSystem === 'structural')
                     ? _submoduleReceiverModule(index, fileEntry, call.receiver) : null;
+                // A named/default import can itself be an exported namespace
+                // object: `import { z } from './index'; z.string()`, where
+                // index does `import * as z from './api'; export { z }`.
+                // Preserve that compiler-exact namespace identity without
+                // treating arbitrary imported object values as modules.
 
                 // Module receiver: httpx.get() / ns.helper() dispatches to a
                 // module export — it can never be a CLASS METHOD call. Applies
                 // only when every target is a class method; standalone-function
                 // and class (constructor) targets keep flowing on import evidence.
-                if (!bindingId && !resolvedBySameClass && call.isMethod && call.receiverIsModule &&
+                if ((!bindingId || recvExportedNamespace) && !resolvedBySameClass && call.isMethod &&
+                    (call.receiverIsModule || recvExportedNamespace) &&
                     langTraits(fileEntry.language)?.typeSystem === 'structural' &&
                     targetDefs.length > 0 && targetDefs.every(d => d.className)) {
                     isUncertain = true;
@@ -2758,17 +2844,22 @@ function findCallers(index, name, options = {}) {
                 // binding (name-level — the file importing the target for
                 // other names proves nothing): binding module external →
                 // excluded; resolves to a project file that doesn't reach a
-                // target (directly or one re-export hop) → visible, not
-                // excluded (deep barrel chains exceed the hop budget);
+                // target by a definitive name-level `no` → excluded as another
+                // definition; an unknown chain stays visible (deep barrels and
+                // dynamic CJS surfaces can exceed the modeled ownership);
                 // unresolved-but-project-looking → visible (resolver gap).
-                if (!bindingId && !resolvedBySameClass && call.isMethod &&
-                    (call.receiverIsModule || recvSubmoduleRel) &&
+                if ((!bindingId || recvExportedNamespace) && !resolvedBySameClass && call.isMethod &&
+                    (call.receiverIsModule || recvSubmoduleRel || recvExportedNamespace) &&
                     langTraits(fileEntry.language)?.typeSystem === 'structural') {
-                    const recvBindings = _structuralModuleBindings(fileEntry, call);
-                    const tFiles = new Set(targetDefs.map(d => d.file).filter(Boolean));
-                    if (recvBindings.length > 0 && !tFiles.has(filePath)) {
-                        let reaches = false;
-                        let projectish = false;
+                    const recvBindings = recvExportedNamespace
+                        ? [] : _structuralModuleBindings(fileEntry, call);
+                    const tFiles = targetDefinitionFiles;
+                    if ((recvBindings.length > 0 || recvExportedNamespace) && !tFiles.has(filePath)) {
+                        let reaches = recvExportedNamespace?.verdict === 'yes';
+                        let projectish = !!recvExportedNamespace;
+                        let undetermined = recvExportedNamespace?.verdict === 'unknown';
+                        let resolvedBindings = recvExportedNamespace ? 1 : 0;
+                        let definitiveOtherBindings = recvExportedNamespace?.verdict === 'no' ? 1 : 0;
                         for (const b of recvBindings) {
                             const rel = (fileEntry.moduleResolved && fileEntry.moduleResolved[b.module]) ||
                                 recvSubmoduleRel;
@@ -2778,10 +2869,12 @@ function findCallers(index, name, options = {}) {
                                 if (mod.startsWith('.') ||
                                     (firstSeg && _projectTopLevelNames(index).has(firstSeg))) {
                                     projectish = true;
+                                    undetermined = true;
                                 }
                                 continue;
                             }
                             projectish = true;
+                            resolvedBindings++;
                             const resolvedAbs = path.join(index.root, rel);
                             // Name-level ownership (fix #217 applied to module
                             // receivers — zod family D): `z._default(...)` asks
@@ -2791,17 +2884,29 @@ function findCallers(index, name, options = {}) {
                             // chase is definitive only on fully-modeled ESM/
                             // Python surfaces — 'unknown' (CJS, stars, module
                             // assignments) falls back to file-level reach.
-                            const verdict = _nameBindingReaches(index, resolvedAbs, call.name, tFiles);
+                            const ambiguousCjsMember =
+                                _cjsMemberOwnershipAmbiguous(index, resolvedAbs, call.name);
+                            const verdict = ambiguousCjsMember
+                                ? 'unknown'
+                                : _nameBindingReaches(index, resolvedAbs, call.name, tFiles);
                             if (verdict === 'yes' ||
-                                (verdict === 'unknown' && _importReaches(index, resolvedAbs, tFiles))) {
+                                (verdict === 'unknown' && !ambiguousCjsMember &&
+                                 _importReaches(index, resolvedAbs, tFiles))) {
                                 reaches = true; break;
                             }
+                            if (verdict === 'no') definitiveOtherBindings++;
+                            else undetermined = true;
                         }
                         if (!reaches) {
                             if (!projectish) {
                                 recordExcluded(filePath, call.line, 'external-package');
                                 continue;
                             }
+                            if (!undetermined && resolvedBindings > 0 &&
+                                definitiveOtherBindings === resolvedBindings) {
+                                recordExcluded(filePath, call.line, 'other-definition-import');
+                                continue;
+                            }
                             if (collectAccount) {
                                 routeUnverified(filePath, fileEntry, call, 'no-import-link', calledAs);
                                 continue;
@@ -3077,7 +3182,8 @@ function findCallers(index, name, options = {}) {
                                     if (sameNameTypeDefs.length > 1 ||
                                         (call.receiverTypeQualifier && call.receiverTypeFlowFile)) {
                                         const identity = _resolveStructuralFlowTypeIdentity(
-                                            index, call.receiverTypeFlowFile || filePath, knownType, targetDefs);
+                                            index, call.receiverTypeFlowFile || filePath, knownType, targetDefs,
+                                            call.receiverTypeFlowFile ? undefined : call.receiverTypeQualifier);
                                         if (identity === 'other') {
                                             receiverTypeValidated = false;
                                         } else if (identity === 'unknown') {
@@ -3093,7 +3199,8 @@ function findCallers(index, name, options = {}) {
                                 // exact declaration and walk its file-scoped
                                 // ancestry before treating it as unrelated.
                                 const identity = _resolveStructuralFlowTypeIdentity(
-                                    index, call.receiverTypeFlowFile || filePath, knownType, targetDefs);
+                                    index, call.receiverTypeFlowFile || filePath, knownType, targetDefs,
+                                    call.receiverTypeFlowFile ? undefined : call.receiverTypeQualifier);
                                 if (identity === 'target') {
                                     receiverTypeValidated = true;
                                 } else if (identity === 'unknown') {
@@ -4073,7 +4180,8 @@ function findCallers(index, name, options = {}) {
                     // module-ownership block above already routed the ones
                     // whose module doesn't reach the target. Submodule
                     // receivers (fix #224) are module receivers too.
-                    if (call.isMethod && !call.receiverIsModule && !recvSubmoduleRel) {
+                    if (call.isMethod && !call.receiverIsModule &&
+                        !recvSubmoduleRel && !call.moduleOwnedPath) {
                         const tTypes = dispatchTargetTypes(targetDefs2);
                         const typeQualifiedReceiver = !!(call.receiver && tTypes.has(call.receiver));
                         const knownDispatchType = call.receiverType ||
@@ -4153,6 +4261,22 @@ function findCallers(index, name, options = {}) {
                             (index.symbols.get(call.receiver) || []).length === 0 &&
                             !fileEntry.bindings?.some(b => b.name === call.receiver) &&
                             !call.receiverMemberAssigned) {
+                            // A candidate target that IS a member assignment
+                            // onto this same global (fix #286a, fastify-
+                            // measured: `console.log = () => {}` in a test's
+                            // beforeEach) patches the host object process-
+                            // wide — the assignment's own file cannot scope
+                            // it, so every `console.log(...)` site MAY
+                            // dispatch into the project def. Demote-only:
+                            // visible possible-dispatch, never confirmed,
+                            // never excluded.
+                            if (targetDefs2.some(d => d.memberAssigned &&
+                                d.assignedReceiver === call.receiver)) {
+                                routeUnverified(filePath, fileEntry, call, 'possible-dispatch', calledAs, {
+                                    dispatchVia: `${call.receiver} — builtin global patched in project`,
+                                });
+                                continue;
+                            }
                             recordExcluded(filePath, call.line, 'external-package');
                             continue;
                         }
@@ -4879,11 +5003,15 @@ function findCallees(index, definition, options = {}) {
 
             // Parser-proven lexical shadow: a parameter/local named `option`
             // cannot call an imported/project `option`. A nested local
-            // function with that name is the one safe exception and remains
-            // eligible for exact same-file resolution below.
+            // function — or a nested CLASS, whose bare name constructs it
+            // (fix #286f, flask-measured: `class Foo` inside test_custom_tag,
+            // `Foo("bar")` excluded local-shadow while the oracle pins the
+            // nested class) — is the safe exception and remains eligible for
+            // exact same-file resolution below.
             if (call.localShadow && !call.resolvedName && !call.resolvedNames) {
                 const localTarget = (index.symbols.get(call.name) || []).some(s =>
-                    s.file === def.file && !NON_CALLABLE_TYPES.has(s.type) &&
+                    s.file === def.file &&
+                    (s.type === 'class' || !NON_CALLABLE_TYPES.has(s.type)) &&
                     s.startLine >= def.startLine && s.endLine <= def.endLine &&
                     s.startLine <= call.line);
                 if (!localTarget) {
@@ -7834,7 +7962,7 @@ function _rustBindingResolvedFiles(index, fileEntry, filePath, binding) {
  *    trusted (a use/import of an external type can shadow it invisibly)
  *  - no project type def at all: external name — safe, can't conflate
  */
-function _resolveFlowTypeOrigin(index, producerFile, typeName, qualifier) {
+function _resolveFlowTypeOrigin(index, producerFile, typeName, qualifier = undefined) {
     const opCache = index._opFlowTypeOriginCache;
     const cacheKey = `${producerFile}\x00${typeName}\x00${qualifier || ''}`;
     if (opCache?.has(cacheKey)) return opCache.get(cacheKey);
@@ -7898,6 +8026,36 @@ function _resolveFlowTypeOrigin(index, producerFile, typeName, qualifier) {
                 }
             }
         }
+        // Structural module qualifier (fix #286e, flask-measured):
+        // `app: flask.Flask` names the type through the imported module.
+        // Resolve the module binding and pin the unique reachable
+        // declaration — name-chase through modeled re-exports first, the
+        // bounded file-level closure as fallback (the #277 rails). An
+        // unresolvable qualifier is 'unknown', never proximity-guessed.
+        if (fe && ['python', 'javascript', 'typescript', 'tsx'].includes(fe.language)) {
+            const resolvedRels = new Set();
+            const direct = fe.moduleResolved?.[qualifier];
+            if (direct) resolvedRels.add(direct);
+            for (const b of (fe.importBindings || [])) {
+                if (b.name !== qualifier && b.alias !== qualifier) continue;
+                const rel = fe.moduleResolved?.[b.module];
+                if (rel) resolvedRels.add(rel);
+            }
+            for (const rel of resolvedRels) {
+                const start = path.join(index.root, rel);
+                const named = typeDefs.filter(d => d.file === start ||
+                    _nameBindingReaches(index, start, typeName, new Set([d.file])) === 'yes');
+                if (new Set(named.map(d => d.file)).size === 1) {
+                    return finish({ fromFile: named[0].file });
+                }
+                const reachable = typeDefs.filter(d => d.file === start ||
+                    _importReaches(index, start, new Set([d.file])));
+                if (new Set(reachable.map(d => d.file)).size === 1) {
+                    return finish({ fromFile: reachable[0].file });
+                }
+            }
+            return finish(null);
+        }
         const inPkg = fe && _qualifiedProducerDefs(index, fe, qualifier, typeDefs);
         if (inPkg && inPkg.length > 0 && new Set(inPkg.map(d => d.file)).size === 1) {
             return finish({ fromFile: inPkg[0].file });
@@ -8276,12 +8434,24 @@ function _nameBindingReaches(index, startAbs, name, targetFiles, maxDepth = 4) {
             // makes widgets.helper the local helper even if widgets imports a
             // different helper several hops below. Parser-provided localName
             // keeps this proof limited to syntactically-owned CJS exports;
-            // dynamic assignments remain unknown.
+            // dynamic assignments remain unknown — including a COMPETING
+            // record for the same name without static ownership
+            // (`exports.run = run;` then `if (native) exports.run =
+            // require('./native').run;`) and a whole-surface reassignment
+            // (`module.exports = require('./impl')`): either one can rebind
+            // the member at runtime, so the static record alone never proves
+            // a dead end (fix #292).
             const localExports = (fe.exportDetails || []).filter(e =>
-                !e.source && (e.alias || e.name) === attr && e.localName);
-            if (localExports.some(e => (index.symbols.get(e.localName) || [])
-                .some(definition => definition.file === abs &&
-                    !NON_CALLABLE_TYPES.has(definition.type)))) {
+                !e.source && (e.alias || e.name) === attr);
+            const staticOwner = localExports.some(e => e.localName &&
+                (index.symbols.get(e.localName) || [])
+                    .some(definition => definition.file === abs &&
+                        !NON_CALLABLE_TYPES.has(definition.type)));
+            const competingDynamic = localExports.some(e => !e.localName) ||
+                (fe.exportDetails || []).some(e => !e.source &&
+                    e.defaultLike && e.type === 'module.exports' &&
+                    (e.alias || e.name) !== attr);
+            if (staticOwner && !competingDynamic) {
                 return 'no';
             }
 
@@ -8343,6 +8513,256 @@ function _nameBindingReaches(index, startAbs, name, targetFiles, maxDepth = 4) {
     return unknown ? 'unknown' : 'no';
 }
 
+/**
+ * A CommonJS object export whose requested member has no statically-owned
+ * local value cannot prove callable identity. For example,
+ * `module.exports = { run: available ? nativeRun : fallback }` exposes the
+ * local fallback only on one runtime branch. File-level import reachability
+ * must not upgrade that conditional value to a confirmed edge.
+ */
+function _cjsMemberOwnershipAmbiguous(index, file, memberName) {
+    const fe = index.files.get(file);
+    // Both CJS assignment families count: `module.exports = { x: cond ? a : b }`
+    // records type 'module.exports'; `exports.x = <dynamic>` records type
+    // 'exports' (fix #292 — the sequential native/fallback feature-detect idiom).
+    return !!fe && (fe.exportDetails || []).some(exp =>
+        (exp.type === 'module.exports' || exp.type === 'exports') &&
+        !exp.defaultLike && !exp.source &&
+        (exp.alias || exp.name) === memberName && !exp.localName);
+}
+
+/**
+ * Resolve a member reached through an exported ESM namespace object.
+ *
+ * Supported exact shapes:
+ *   import * as api from './impl'; export { api };
+ *   import * as api from './impl'; export default api;
+ *   export * as api from './impl';
+ *   export { api } from './barrel'; // recursively, when api is one above
+ *
+ * A plain exported object/value is deliberately not recognized. The caller
+ * must remain in the ordinary structural receiver tier unless the export path
+ * proves that the value is a module namespace exotic object.
+ *
+ * @returns {{ verdict: 'yes'|'no'|'unknown' }|null}
+ */
+function _namespaceExportMemberReaches(
+    index, startAbs, exportedName, memberName, targetFiles, maxDepth = 4,
+    visited = new Set(), memberPath = []
+) {
+    if (maxDepth < 0) return { verdict: 'unknown' };
+    const stateKey = `${startAbs}\x00${exportedName}\x00${memberPath.join('.')}\x00${memberName}`;
+    if (visited.has(stateKey)) return { verdict: 'unknown' };
+    visited.add(stateKey);
+    const fe = index.files.get(startAbs);
+    if (!fe) return null;
+
+    let recognized = false;
+    let unknown = false;
+    let explicitExport = false;
+    const followMember = moduleName => {
+        const rel = fe.moduleResolved?.[moduleName];
+        if (!rel) {
+            unknown = true;
+            return 'unknown';
+        }
+        const nextAbs = path.join(index.root, rel);
+        if (memberPath.length > 0) {
+            const nested = _namespaceExportMemberReaches(
+                index, nextAbs, memberPath[0], memberName, targetFiles,
+                maxDepth - 1, new Set(visited), memberPath.slice(1));
+            // The outer value is proven to be a namespace, but its requested
+            // field is an ordinary/unmodeled value rather than another proven
+            // namespace. That is uncertainty, never exclusion evidence.
+            return nested?.verdict || 'unknown';
+        }
+        return _nameBindingReaches(index, nextAbs, memberName, targetFiles, maxDepth - 1);
+    };
+    const absorb = verdict => {
+        if (verdict === 'yes') return true;
+        if (verdict === 'unknown') unknown = true;
+        return false;
+    };
+
+    for (const exp of (fe.exportDetails || [])) {
+        // `export * as api from './impl'` is direct namespace identity.
+        if (exp.type === 're-export-all' && exp.alias === exportedName) {
+            explicitExport = true;
+            recognized = true;
+            if (absorb(followMember(exp.source))) return { verdict: 'yes' };
+            continue;
+        }
+
+        const exposed = exp.type === 'default' ? 'default' : (exp.alias || exp.name);
+        if (exposed !== exportedName) continue;
+        explicitExport = true;
+
+        // `export { api } from './barrel'`: the source-side value may itself
+        // be a namespace export. Recurse under its source-side name.
+        if (exp.type === 're-export' && exp.source) {
+            const rel = fe.moduleResolved?.[exp.source];
+            if (!rel) {
+                unknown = true;
+                recognized = true;
+                continue;
+            }
+            const nested = _namespaceExportMemberReaches(
+                index, path.join(index.root, rel), exp.name, memberName,
+                targetFiles, maxDepth - 1, new Set(visited), memberPath);
+            if (nested) {
+                recognized = true;
+                if (nested.verdict === 'yes') return { verdict: 'yes' };
+                if (nested.verdict === 'unknown') unknown = true;
+            }
+            continue;
+        }
+
+        // `import * as api ...; export { api }` / `export default api`.
+        if (!exp.source && (exp.type === 'named' || exp.type === 'default')) {
+            const localName = exp.name;
+            const namespaceBindings = (fe.importBindings || []).filter(binding =>
+                (binding.alias || binding.name) === localName && binding.kind === 'namespace');
+            for (const binding of namespaceBindings) {
+                recognized = true;
+                if (absorb(followMember(binding.module))) return { verdict: 'yes' };
+            }
+        }
+    }
+
+    // `export * from './barrel'` forwards named namespace-object exports too.
+    // Explicit local/named exports shadow star exports, so only chase stars
+    // when this file has no explicit surface for the requested name. Default
+    // is never forwarded by export-star.
+    if (!explicitExport && exportedName !== 'default') {
+        const starExports = (fe.exportDetails || []).filter(exp =>
+            exp.type === 're-export-all' && !exp.alias && exp.source);
+        const starVerdicts = [];
+        for (const exp of starExports) {
+            const rel = fe.moduleResolved?.[exp.source];
+            if (!rel) {
+                unknown = true;
+                continue;
+            }
+            const nested = _namespaceExportMemberReaches(
+                index, path.join(index.root, rel), exportedName, memberName,
+                targetFiles, maxDepth - 1, new Set(visited), memberPath);
+            if (!nested) continue;
+            recognized = true;
+            starVerdicts.push(nested.verdict);
+        }
+        if (starVerdicts.length > 0) {
+            // With several export-star providers, another star may expose the
+            // same name and make the ESM binding ambiguous. We currently do
+            // not compute full `ResolveExport` sets, so multi-star barrels are
+            // demotion-only even when one path reaches the target.
+            if (starExports.length > 1) unknown = true;
+            else if (starVerdicts.includes('yes')) return { verdict: 'yes' };
+            if (starVerdicts.includes('unknown')) unknown = true;
+        }
+    }
+
+    if (!recognized) return null;
+    return { verdict: unknown ? 'unknown' : 'no' };
+}
+
+/**
+ * Determine whether a structural receiver imported by name/default is a
+ * statically exported namespace object, and if so whether its requested member
+ * can reach the pinned target files. Multiple live bindings must agree before
+ * a negative becomes exclusion-grade.
+ */
+function _importedNamespaceMemberOwnership(index, fileEntry, call, targetFiles) {
+    const receiver = call.receiver || call.receiverRoot;
+    const memberPath = call.receiver
+        ? [] : (call.receiverFields || (call.receiverField ? [call.receiverField] : []));
+    const bindings = (fileEntry.importBindings || []).filter(binding =>
+        (binding.alias || binding.name) === receiver &&
+        (binding.kind === 'named' || binding.kind === 'default' || binding.kind === 'namespace'));
+    if (bindings.length === 0) return null;
+
+    let recognized = 0;
+    let unknown = false;
+    for (const binding of bindings) {
+        const rel = fileEntry.moduleResolved?.[binding.module];
+        if (!rel) continue;
+        const startAbs = path.join(index.root, rel);
+        let result;
+        if (binding.kind === 'namespace') {
+            result = memberPath.length > 0
+                ? _namespaceExportMemberReaches(
+                    index, startAbs, memberPath[0], call.name, targetFiles,
+                    4, new Set(), memberPath.slice(1))
+                : { verdict: _nameBindingReaches(index, startAbs, call.name, targetFiles) };
+        } else {
+            const exportedName = binding.kind === 'default' ? 'default' : binding.name;
+            result = _namespaceExportMemberReaches(
+                index, startAbs, exportedName, call.name, targetFiles,
+                4, new Set(), memberPath);
+        }
+        if (!result) continue;
+        recognized++;
+        if (result.verdict === 'yes') return { verdict: 'yes' };
+        if (result.verdict === 'unknown') unknown = true;
+    }
+    if (recognized === 0) return null;
+    if (recognized !== bindings.length) unknown = true;
+    return { verdict: unknown ? 'unknown' : 'no' };
+}
+
+/**
+ * Ownership chase for a CommonJS default-like require binding:
+ * `const local = require('./module')`. The local binding name says nothing
+ * about the exporting file's symbol; the direct `module.exports = value`
+ * record does. A locally defined callable is a definitive dead end for a
+ * target in another file, an imported value is chased, and dynamic values
+ * remain unknown. This is exclusion-grade only when every live path is known.
+ */
+function _defaultBindingReaches(index, startAbs, targetFiles, maxDepth = 4, visited = new Set()) {
+    if (targetFiles.has(startAbs)) return 'yes';
+    if (maxDepth < 0 || visited.has(startAbs)) return 'unknown';
+    visited.add(startAbs);
+    const fe = index.files.get(startAbs);
+    if (!fe) return 'unknown';
+
+    const defaults = (fe.exportDetails || []).filter(exp =>
+        exp.type === 'module.exports' && exp.defaultLike);
+    if (defaults.length === 0) return 'unknown';
+
+    let unknown = false;
+    for (const exp of defaults) {
+        const localName = exp.localName || exp.name;
+        if (!localName) { unknown = true; continue; }
+        // Without parser-proven syntactic ownership (localName), the record's
+        // name falls back to the synthesized 'default' — which a DYNAMIC
+        // reassignment (`module.exports = require('./impl')`) shares with an
+        // earlier anonymous default. Only a local callable declared AT the
+        // record's own line proves that this record is the local value
+        // (fix #292 — a name-only match must never dead-end the live import
+        // path of the competing dynamic record).
+        const localCallable = (index.symbols.get(localName) || []).some(definition =>
+            definition.file === startAbs && !NON_CALLABLE_TYPES.has(definition.type) &&
+            (exp.localName || definition.startLine === exp.line ||
+                (definition.startLine <= exp.line && definition.endLine >= exp.line)));
+        if (localCallable) continue;
+
+        const bindings = (fe.importBindings || []).filter(binding =>
+            binding.name === localName || binding.alias === localName);
+        if (bindings.length === 0) { unknown = true; continue; }
+        for (const binding of bindings) {
+            const rel = fe.moduleResolved?.[binding.module];
+            if (!rel) { unknown = true; continue; }
+            const nextAbs = path.join(index.root, rel);
+            const verdict = binding.defaultLike
+                ? _defaultBindingReaches(
+                    index, nextAbs, targetFiles, maxDepth - 1, new Set(visited))
+                : _nameBindingReaches(index, nextAbs, binding.name, targetFiles, maxDepth - 1);
+            if (verdict === 'yes') return 'yes';
+            if (verdict === 'unknown') unknown = true;
+        }
+    }
+    return unknown ? 'unknown' : 'no';
+}
+
 /**
  * From-import submodule receivers (fix #224): `from . import jobs` binds
  * jobs.py as a plain NAME — the parser can't mark it a module alias (a
@@ -8688,8 +9108,8 @@ function _resolveReceiverTypeIdentity(index, filePath, knownType, targetDefs, li
  * CustomCommand extends click.Command), while parallel package versions may
  * reuse every class name (zod v3/v4 ZodArray -> ZodType).
  */
-function _resolveStructuralFlowTypeIdentity(index, originFile, knownType, targetDefs) {
-    const origin = _resolveFlowTypeOrigin(index, originFile, knownType);
+function _resolveStructuralFlowTypeIdentity(index, originFile, knownType, targetDefs, qualifier) {
+    const origin = _resolveFlowTypeOrigin(index, originFile, knownType, qualifier);
     if (!origin?.fromFile) return 'unknown';
     const targetOwners = new Set(targetDefs
         .map(d => d.className || (d.receiver && d.receiver.replace(/^\*/, '')))
@@ -9352,13 +9772,29 @@ function _calleeExportDefinitions(index, startAbs, exposedName, language, call,
             };
 
             const details = fe.exportDetails || [];
+            const localDetails = details.filter(e =>
+                !e.source && (e.alias || e.name) === attr);
+            const ambiguousCjsMember = localDetails.some(e =>
+                (e.type === 'module.exports' || e.type === 'exports') &&
+                !e.defaultLike && !e.localName);
             const localExposed = fe.language === 'python' ||
-                (fe.exports || []).includes(attr) ||
-                details.some(e => !e.source && (e.alias || e.name) === attr);
-            if (localExposed) {
-                for (const d of (index.symbols.get(attr) || [])) {
-                    if (d.file === abs && shapeMatches(d)) {
-                        matches.set(`${d.file}:${d.startLine}`, d);
+                (fe.exports || []).includes(attr) || localDetails.length > 0;
+            if (ambiguousCjsMember) {
+                // `module.exports = { run: condition ? native : fallback }`
+                // exposes no single callable identity. The caller direction
+                // routes this visible; trace-down must make the same abstention
+                // instead of selecting a same-named local fallback.
+                unknown = true;
+            } else if (localExposed) {
+                const localNames = new Set([attr]);
+                for (const detail of localDetails) {
+                    if (detail.localName) localNames.add(detail.localName);
+                }
+                for (const localName of localNames) {
+                    for (const d of (index.symbols.get(localName) || [])) {
+                        if (d.file === abs && shapeMatches(d)) {
+                            matches.set(`${d.file}:${d.startLine}`, d);
+                        }
                     }
                 }
             }
@@ -9368,8 +9804,9 @@ function _calleeExportDefinitions(index, startAbs, exposedName, language, call,
             // never to namespace.member() routing.
             if (options.allowDefaultExport && depth === 0) {
                 for (const e of details) {
-                    if (e.type !== 'module.exports' || !e.name) continue;
-                    for (const d of (index.symbols.get(e.name) || [])) {
+                    if (e.type !== 'module.exports' || !e.defaultLike || !e.name) continue;
+                    const localName = e.localName || e.name;
+                    for (const d of (index.symbols.get(localName) || [])) {
                         if (d.file === abs && shapeMatches(d)) {
                             matches.set(`${d.file}:${d.startLine}`, d);
                         }
@@ -12967,6 +13404,16 @@ function _typeOfCallResultFoldInner(index, fileEntry, filePath, record, ctx, con
         const cands = (index.symbols.get(name) || [])
             .filter(d => !NON_CALLABLE_TYPES.has(d.type) && d.returnType && !d.className);
         let matches = cands.filter(d => d.file === modFile);
+        // A named/default import may itself be an exported namespace object
+        // (`import { z } from 'zod/v3'; z.string()`). Resolve the producer
+        // name through that exact namespace identity before the older
+        // one-hop barrel fallback. Exported callable-alias symbols then carry
+        // the captured class member's declared return type into the chain.
+        if (matches.length === 0) {
+            matches = cands.filter(definition =>
+                _importedNamespaceMemberOwnership(
+                    index, fileEntry, record, new Set([definition.file]))?.verdict === 'yes');
+        }
         if (matches.length === 0) {
             const hop = index.importGraph.get(modFile);
             if (hop) matches = cands.filter(d => hop.has(d.file));