fix(javascript): resolve bundled exports by binding identity

Identify the factory exports parameter through the existing semantic binding owner, including renamed and minified Webpack parameters. Reject nested targets, bare alias rebinding, and shadowed identifiers. Prune the duplicated source happy path after validating the public CLI workflow.

Validation: public analyze-javascript-application CLI acceptance and focused semantic traversal/module-index tests.

Fixes #2171
This commit is contained in:
morluto
2026-10-13 04:12:14 +08:00
parent 921bb95755
commit 5ab0cbb48e
5 changed files with 150 additions and 25 deletions
@@ -232,8 +232,8 @@ const inspectNode = (
inspectElectronStaticNode(node, findings);
if (t.isCallExpression(node)) {
inspectBundlerBootstrap(source, node, accumulator, bindings);
inspectBundlerRegistration(source, node, accumulator);
inspectEsbuildWrapper(source, node, accumulator);
inspectBundlerRegistration(source, node, accumulator, bindings);
inspectEsbuildWrapper(source, node, accumulator, bindings);
inspectCall(source, node, findings);
} else if (t.isOptionalCallExpression(node)) {
inspectCall(source, node, findings);