fix(extractor): treat .apply() like .bind() — its argsArray is never a callback

Unlike .call(thisArg, cb1, cb2…), .apply() takes exactly two args:
thisArg and a single argsArray. The array is never a direct callback,
so emitting its identifier (e.g. Math.max.apply(null, numbers) → edge
to numbers) is a false-positive. Return [] immediately for .apply(),
same as .bind(). Update the unit test to assert no edges are emitted.

Author: carlos-alm

src/extractors/javascript.ts

@@ -2727,22 +2727,26 @@ function firstArgIsStringLiteral(argsNode: TreeSitterNode): boolean {
  * literal route path — matching Express/router shape and skipping
  * `cache.get(user.id)`-style calls.
  *
- * `.call()`/`.apply()`: the first argument is the `this` context (not a
- * callback). Subsequent identifier arguments are genuine callbacks of the
- * enclosing scope — e.g. `Array.prototype.forEach.call(arr, handler)` emits
- * `handler`. `.bind()` returns a new partially-applied function; all
- * arguments are absorbed and none are direct callbacks.
+ * `.call()`: the first argument is the `this` context (not a callback).
+ * Subsequent identifier arguments are genuine callbacks of the enclosing
+ * scope — e.g. `Array.prototype.forEach.call(arr, handler)` emits `handler`.
+ * `.bind()` returns a new partially-applied function; all arguments are
+ * absorbed and none are direct callbacks.
+ * `.apply()` takes exactly two arguments: `thisArg` and a single `argsArray`.
+ * The array is never a direct callback, so `.apply()` is treated like `.bind()`
+ * and returns immediately with no edges.
  */
 function extractCallbackReferenceCalls(callNode: TreeSitterNode): Call[] {
   const args = callNode.childForFieldName('arguments') || findChild(callNode, 'arguments');
   if (!args) return [];
 
   const calleeName = extractCalleeName(callNode);
 
-  // .bind() absorbs all arguments into a partially-applied function — no direct callbacks.
-  if (calleeName === 'bind') return [];
+  // .bind() and .apply() absorb all arguments — no direct callbacks.
+  // .apply(thisArg, argsArray): argsArray is a single array, never a callback.
+  if (calleeName === 'bind' || calleeName === 'apply') return [];
 
-  const skipFirstArg = calleeName === 'call' || calleeName === 'apply';
+  const skipFirstArg = calleeName === 'call';
 
   let memberExprArgsAllowed = calleeName !== null && CALLBACK_ACCEPTING_CALLEES.has(calleeName);
   if (memberExprArgsAllowed && calleeName !== null && HTTP_VERB_CALLEES.has(calleeName)) {

tests/parsers/javascript.test.ts

@@ -810,11 +810,9 @@ describe('JavaScript parser', () => {
       expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'collection' }));
     });
 
-    it('emits identifier args after the this-context for .apply()', () => {
+    it('emits nothing for .apply() — second arg is an arguments array, not a callback', () => {
       const symbols = parseJS(`fn.apply(ctx, handler);`);
-      expect(symbols.calls).toContainEqual(
-        expect.objectContaining({ name: 'handler', dynamic: true }),
-      );
+      expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'handler' }));
       expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'ctx' }));
     });