fix(javascript): preserve loader authority for exact suffixes (#9477)

* fix(javascript): require exact loader suffix case

* fix(javascript): share exact loader mode across import resolution

* test(process): align symlink fixture with filesystem checkpoints

* test(javascript): normalize the module resolution oracle path separators

* test(frida): assert the CLI spawn Evidence contract

* test(mcp): use an unsupported analysis-view parent

* test(browser): separate source-location line bounds from parity

* fix(javascript): preserve uncertain loader provenance

* test(javascript): cover uncertain require resolution

* fix(javascript): retain conditional Electron evidence

* fix(javascript): preserve timed semantic provenance

* fix(javascript): retain conditional builtin effects

* test(javascript): distinguish bundled host authority

* fix(javascript): preserve nested loader invocation identity

* test(javascript): qualify Electron fixture authority

* fix(javascript): preserve loader invocation authority

* fix(javascript): respect source order for resolver escapes

* fix(javascript): check nested loader callable mutations

* fix(javascript): retain conditional constructor requests

* fix(reference): retain constructor loader relationships

* fix(reference): follow nested loader callable paths

* refactor(javascript): share callable mutation interpretation

* fix(javascript): require exact package loader suffixes

* refactor(javascript): unify conditional relation evidence

* refactor(javascript): unify conditional node evidence

* fix(javascript): retain unknown authority for mixed case sources

* fix(javascript): preserve loader uncertainty for dotfiles

* fix(reference): classify javascript suffix dotfiles

* test(reference): cover suffix dotfiles through cli

* fix(javascript): retain equivalent conditional built-in origins

* fix(javascript): preserve wrapped resolver operation

* fix(javascript): retain nested conditional built-in receivers

* test(javascript): declare CommonJS in native addon fixtures

* fix(javascript): retain wrapped resolver candidates

* style: format merged native command schema

* fix(javascript): preserve uncertain loader authority

* test(javascript): require candidate preload evidence

* test(javascript): cover reference loader member writes

---------

Co-authored-by: ShuaixinHuang <1836656514@qq.com>

src/domain/javascript/javascriptStaticAnalysisState.ts

@@ -110,10 +110,17 @@ export interface JavaScriptFindingContext {
     site: t.Node,
     suffix: readonly string[],
   ) =>
-    | { readonly owner: t.NewExpression; readonly path: readonly string[] }
+    | {
+        readonly owner: t.NewExpression;
+        readonly path: readonly string[];
+        readonly authority: { readonly loader_authority?: "candidate" };
+      }
     | undefined;
   readonly xhrOpenRequest?: (node: t.Node) => boolean;
-  readonly rendererLoad?: (callee: t.Node, site: t.Node) => boolean;
+  readonly rendererLoad?: (
+    callee: t.Node,
+    site: t.Node,
+  ) => { readonly loader_authority?: "candidate" } | undefined;
   readonly rpcScan: JavaScriptRpcScan;
   /** Shared bounded argv/nullish argument shapes for optional-slot signatures. */
   readonly expressionShapes: JavaScriptExpressionShapeResolver;
@@ -123,12 +130,15 @@ export interface JavaScriptFindingContext {
   readonly openReceiverFacts?: ReadonlyMap<number, JavaScriptOpenReceiverFact>;
   /** Proven Electron export path segments by root offset. */
   readonly electronBindings?: ReadonlyMap<number, readonly string[]>;
+  /** Conditional Electron export paths, keyed by call/construction root. */
+  readonly electronCandidateBindings?: ReadonlyMap<number, readonly string[]>;
   /** Normalized invocation target from the shared Electron and intrinsic owners. */
   readonly electronInvocationPath?: (
     node: t.CallExpression | t.OptionalCallExpression,
   ) => readonly string[] | undefined;
   /** A possible shared-app mutation does not establish concrete API identity. */
   readonly electronAppPathChangePossible?: (node: t.Node) => boolean;
+  readonly electronCandidateAppPathChangePossible?: (node: t.Node) => boolean;
 }
 
 /** Candidate import, require, worker, or service-worker reference. */
@@ -139,6 +149,7 @@ export interface JavaScriptReferenceInput {
   readonly specifier: string | undefined;
   readonly resolutionBasePath?: string;
   readonly loader?: JavaScriptStaticReference["loader"];
+  readonly loaderAuthority?: "candidate";
 }
 
 /** Candidate route or network endpoint literal. */