fix(javascript): preserve loader authority for exact suffixes (#9477)

* fix(javascript): require exact loader suffix case

* fix(javascript): share exact loader mode across import resolution

* test(process): align symlink fixture with filesystem checkpoints

* test(javascript): normalize the module resolution oracle path separators

* test(frida): assert the CLI spawn Evidence contract

* test(mcp): use an unsupported analysis-view parent

* test(browser): separate source-location line bounds from parity

* fix(javascript): preserve uncertain loader provenance

* test(javascript): cover uncertain require resolution

* fix(javascript): retain conditional Electron evidence

* fix(javascript): preserve timed semantic provenance

* fix(javascript): retain conditional builtin effects

* test(javascript): distinguish bundled host authority

* fix(javascript): preserve nested loader invocation identity

* test(javascript): qualify Electron fixture authority

* fix(javascript): preserve loader invocation authority

* fix(javascript): respect source order for resolver escapes

* fix(javascript): check nested loader callable mutations

* fix(javascript): retain conditional constructor requests

* fix(reference): retain constructor loader relationships

* fix(reference): follow nested loader callable paths

* refactor(javascript): share callable mutation interpretation

* fix(javascript): require exact package loader suffixes

* refactor(javascript): unify conditional relation evidence

* refactor(javascript): unify conditional node evidence

* fix(javascript): retain unknown authority for mixed case sources

* fix(javascript): preserve loader uncertainty for dotfiles

* fix(reference): classify javascript suffix dotfiles

* test(reference): cover suffix dotfiles through cli

* fix(javascript): retain equivalent conditional built-in origins

* fix(javascript): preserve wrapped resolver operation

* fix(javascript): retain nested conditional built-in receivers

* test(javascript): declare CommonJS in native addon fixtures

* fix(javascript): retain wrapped resolver candidates

* style: format merged native command schema

* fix(javascript): preserve uncertain loader authority

* test(javascript): require candidate preload evidence

* test(javascript): cover reference loader member writes

---------

Co-authored-by: ShuaixinHuang <1836656514@qq.com>

src/domain/javascript/javascriptSourceParserContext.test.ts

@@ -1,4 +1,9 @@
 import { expect, it } from "vitest";
+import {
+  isJsonModuleTarget,
+  isNativeAddonModuleTarget,
+  moduleResolutionModeForJavaScriptReference,
+} from "./javascriptModuleResolutionMode.js";
 import * as t from "@babel/types";
 
 import {
@@ -21,18 +26,54 @@ import {
   parserPluginsForPath,
 } from "./javascriptSourceParser.js";
 
+it("does not treat suffix-only dotfiles as JSON or native addon loaders", () => {
+  expect(isJsonModuleTarget(".json", "json")).toBe(false);
+  expect(isNativeAddonModuleTarget(".node", "native-addon")).toBe(false);
+  expect(isJsonModuleTarget("value.json", "json")).toBe(true);
+  expect(isNativeAddonModuleTarget("value.node", "native-addon")).toBe(true);
+});
+
 it.each([
+  ["entry.cjs", "require"],
+  ["entry.cts", "require"],
+  ["entry.CJS", "import"],
+  ["entry.CTS", "import"],
+  ["entry.TS", "compiler-dependent"],
+] as const)(
+  "uses exact loader evidence for static imports from %s",
+  (path, expected) => {
+    expect(
+      moduleResolutionModeForJavaScriptReference(path, "static-import"),
+    ).toBe(expected);
+  },
+);
+
+it.each([
+  [".js", "module", "unknown"],
+  [".ts", "commonjs", "unknown"],
+  [".mjs", "commonjs", "unknown"],
+  [".cjs", "module", "unknown"],
   ["entry.cjs", "module", "commonjs"],
   ["entry.cts", "module", "commonjs"],
   ["entry.mjs", "commonjs", "module"],
   ["entry.mts", "commonjs", "module"],
+  ["entry.MJS", "commonjs", "unknown"],
+  ["entry.CJS", "module", "unknown"],
+  ["entry.MTS", "commonjs", "unknown"],
+  ["entry.CTS", "module", "unknown"],
   ["entry.d.cts", "module", "unknown"],
+  ["entry.D.cts", "module", "unknown"],
   ["entry.d.ts", "commonjs", "unknown"],
   ["entry.d.mts", "commonjs", "module"],
   ["entry.jsx", "commonjs", "unknown"],
   ["entry.tsx", "commonjs", "unknown"],
   ["entry.js", "module", "module"],
   ["entry.ts", "commonjs", "commonjs"],
+  ["entry.JS", "module", "unknown"],
+  ["entry.JS", "commonjs", "unknown"],
+  ["entry.JS", "unspecified", "unknown"],
+  ["entry.TS", "module", "unknown"],
+  ["entry.TS", "commonjs", "unknown"],
   ["entry.js", "unspecified", "commonjs"],
   ["entry.ts", "unspecified", "unknown"],
   ["entry.js", "unknown", "unknown"],
@@ -64,6 +105,34 @@ it("does not derive factory authority from an ambient require in a proven module
   expect([...referenceSourceRequireCalls(file, "entry.js")]).toEqual([]);
 });
 
+it.each([
+  "entry.JS",
+  "entry.MJS",
+  "entry.CJS",
+  "entry.TS",
+  "entry.MTS",
+  "entry.CTS",
+  ".MJS",
+])("retains unknown host authority for mixed module syntax in %s", (path) => {
+  const { file } = parseRecoveredJavaScript(
+    'import {join} from "node:path"; require("./dep.cjs");',
+    path,
+    { plugins: parserPluginsForPath(path) },
+    "module",
+  );
+  expect(javaScriptRuntimeContext(file.program)).toBe("unknown");
+  expect(analyzeParsedJavaScriptSemantics(file).moduleLinks).toEqual(
+    expect.arrayContaining([
+      expect.objectContaining({ kind: "import", specifier: "node:path" }),
+      expect.objectContaining({
+        kind: "require",
+        specifier: "./dep.cjs",
+        loaderAuthority: "candidate",
+      }),
+    ]),
+  );
+});
+
 it.each([
   ["without source redeclarations", "", "", true],
   ["with a var redeclaration", "var require;\n", "", true],
@@ -112,6 +181,86 @@ it.each([
   },
 );
 
+it.each([
+  ["unbound", 'require("./dep.cjs");'],
+  ["var redeclaration", 'var require; require("./dep.cjs");'],
+  ["var initializer", 'var require; require = require("./dep.cjs");'],
+] as const)(
+  "does not infer a CommonJS wrapper from %s in unknown runtime context",
+  (_name, source) => {
+    const { file } = parseRecoveredJavaScript(
+      source,
+      "entry.MJS",
+      {},
+      "commonjs",
+    );
+    expect(javaScriptRuntimeContext(file.program)).toBe("unknown");
+    const links = analyzeParsedJavaScriptSemantics(file).moduleLinks;
+    expect(links.filter((link) => link.specifier === "./dep.cjs")).toEqual([
+      expect.objectContaining({
+        kind: "require",
+        loaderAuthority: "candidate",
+      }),
+    ]);
+  },
+);
+
+it.each([
+  ["module.exports = 1;", "default"],
+  ["var module; module.exports = 1;", "default"],
+  ["var exports; exports.value = 1;", "value"],
+] as const)("retains unknown-host export candidates for %s", (source, name) => {
+  const { file } = parseRecoveredJavaScript(
+    source,
+    "entry.MJS",
+    {},
+    "commonjs",
+  );
+  expect(analyzeParsedJavaScriptSemantics(file).moduleLinks).toEqual(
+    expect.arrayContaining([
+      expect.objectContaining({
+        kind: "commonjs-export",
+        exportedName: name,
+        loaderAuthority: "candidate",
+      }),
+    ]),
+  );
+});
+
+it("does not claim an unbound module export in a known ES module", () => {
+  const { file } = parseRecoveredJavaScript(
+    "module.exports = 1;",
+    "entry.mjs",
+    {},
+  );
+  expect(analyzeParsedJavaScriptSemantics(file).moduleLinks).toEqual([]);
+});
+
+it("retains conditional require provenance through aliases without claiming a host loader", () => {
+  const source =
+    'const { ipcMain: bus } = require("electron"); const alias = bus;';
+  const { file } = parseRecoveredJavaScript(
+    source,
+    "entry.MJS",
+    {},
+    "commonjs",
+  );
+  const ir = analyzeParsedJavaScriptSemantics(file);
+  for (const name of ["bus", "alias"]) {
+    const binding = ir.bindings.find((item) => item.name === name);
+    expect(binding?.provenance).toMatchObject({
+      status: "ambiguous",
+      origins: [
+        {
+          specifier: "electron",
+          importedPath: ["ipcMain"],
+          loaderAuthority: "candidate",
+        },
+      ],
+    });
+  }
+});
+
 it("detects JavaScript module syntax within an observed unspecified package", () => {
   const { file } = parseRecoveredJavaScript(
     "void import.meta.url;",