fix(javascript): preserve map boundaries and loader provenance

Share embedded-map version admission and derive indexed overlap from represented mappings. Carry createRequire filename bases through worker facts and graph identity. Select factory export bindings at each bundler owner.

Validated accepted and malformed source maps through real CLI and stdio MCP codec workflows; verified loader and esbuild graph output against Node runtime controls. Rebased consumer checks passed.

Fixes #6803

Fixes #6614

Fixes #6798

Fixes #6797

src/domain/javascript/javascriptAstFingerprint.ts

@@ -5,10 +5,7 @@ import * as t from "@babel/types";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
-import {
-  runtimeFunctionParameters,
-  semanticStaticPropertyKey,
-} from "./javascriptAstValues.js";
+import { semanticStaticPropertyKey } from "./javascriptAstValues.js";
 import { stringValue } from "./javascriptStaticAnalysisHelpers.js";
 import {
   resolveSemanticBindingState,
@@ -36,15 +33,18 @@ export const fingerprintJavaScriptAst = (node: t.Node): string => {
 export const collectJavaScriptExports = (
   node: t.Node,
   bindings?: JavaScriptSemanticAnalysisState,
+  exportsParameter?: t.Identifier,
 ): StaticExports => {
   const exports = new Set<string>();
-  const parameter = t.isFunction(node)
-    ? runtimeFunctionParameters(node)[1]
-    : undefined;
   const factoryExports =
-    bindings !== undefined && t.isFunction(node) && t.isIdentifier(parameter)
-      ? resolveSemanticBindingState(bindings, parameter, parameter.name)
-          ?.bindingId
+    bindings !== undefined &&
+    t.isFunction(node) &&
+    exportsParameter !== undefined
+      ? resolveSemanticBindingState(
+          bindings,
+          exportsParameter,
+          exportsParameter.name,
+        )?.bindingId
       : undefined;
   const isExportsAlias = (reference: t.Node | null): boolean => {
     if (!t.isIdentifier(reference)) return false;

src/domain/javascript/javascriptStaticAnalysisBundler.ts

@@ -256,7 +256,13 @@ const recoverBundlerModule = (
   if (key.startsWith("[computed@") || key.startsWith("[unknown@"))
     accumulator.unknownFindings += 1;
   const fingerprint = fingerprintJavaScriptAst(factory);
-  const exportsValue = collectJavaScriptExports(factory, bindings);
+  const exportsParameter =
+    runtimeFunctionParameters(factory)[runtime === "esbuild-commonjs" ? 0 : 1];
+  const exportsValue = collectJavaScriptExports(
+    factory,
+    bindings,
+    t.isIdentifier(exportsParameter) ? exportsParameter : undefined,
+  );
   const requireName = factoryRequireName(factory);
   const requireParameter = runtimeFunctionParameters(factory)[2];
   const requireBindingId = t.isIdentifier(requireParameter)

src/domain/javascript/javascriptStaticAnalysisCalls.ts

@@ -91,6 +91,9 @@ export const inspectCall = (
       node,
       kind: "require",
       specifier: requireCall.specifier,
+      ...(requireCall.resolutionBasePath === undefined
+        ? {}
+        : { resolutionBasePath: requireCall.resolutionBasePath }),
     });
   const chunkLoad = chunkLoadSpecifier(node, bindings, context);
   if (chunkLoad !== null)
@@ -265,7 +268,10 @@ const requireCallSpecifier = (
   bindings: JavaScriptSemanticAnalysisState,
   context: FindingContext,
   resolveMemberChanged = false,
-): { readonly specifier: string | undefined } | null => {
+): {
+  readonly specifier: string | undefined;
+  readonly resolutionBasePath?: string;
+} | null => {
   const call = semanticRequireCallAt(
     node,
     bindings,
@@ -280,7 +286,12 @@ const requireCallSpecifier = (
     context.accumulator.unknownFindings += 1;
     return { specifier: undefined };
   }
-  return { specifier: argumentValue(call.arguments?.[0]) };
+  return {
+    specifier: argumentValue(call.arguments?.[0]),
+    ...(call.sourceRelativePath === undefined
+      ? {}
+      : { resolutionBasePath: call.sourceRelativePath }),
+  };
 };
 
 /** Examine member-loader receivers only after shared alias mutation facts settle. */
@@ -311,6 +322,9 @@ export const finishModuleRequireCalls = (
         node,
         kind: "require",
         specifier: call.specifier,
+        ...(call.resolutionBasePath === undefined
+          ? {}
+          : { resolutionBasePath: call.resolutionBasePath }),
       });
   }
   context.accumulator.pendingModuleRequireCalls.length = 0;
@@ -933,11 +947,14 @@ export const addReference = (
       : { specifier, expression: null };
   addLocatedFinding(context, {
     collection: context.accumulator.references,
-    key: `reference\0${input.kind}\0${reference.specifier ?? reference.expression}`,
+    key: `reference\0${input.kind}\0${reference.specifier ?? reference.expression}\0${input.resolutionBasePath ?? ""}`,
     node: input.node,
     value: {
       kind: input.kind,
       ...reference,
+      ...(input.resolutionBasePath === undefined
+        ? {}
+        : { resolution_base_path: input.resolutionBasePath }),
       module_key: null,
       location: range(input.node),
     },

src/domain/javascript/javascriptStaticAnalysisState.ts

@@ -113,6 +113,7 @@ export interface JavaScriptReferenceInput {
   readonly node: t.Node;
   readonly kind: JavaScriptStaticReference["kind"];
   readonly specifier: string | undefined;
+  readonly resolutionBasePath?: string;
 }
 
 /** Candidate route or network endpoint literal. */

src/domain/javascript/javascriptStaticAnalysisTypes.ts

@@ -31,6 +31,8 @@ interface JavaScriptStaticReferenceState {
   readonly module_key: string | null;
   /** Recovered factory runtime; absent in older or unbundled findings. */
   readonly module_runtime?: string;
+  /** Source-relative filename selected by a proven createRequire factory. */
+  readonly resolution_base_path?: string;
   readonly location: JavaScriptSourceRange;
 }