Compute the exports-aware public-API entry-point set: the package.jsonexports-mapped modules (non-private packages) plus the no-exports
source-index fallback. This encodes rule R4 (the exports-mapped copy is
public; a no-exports copy is internal). Exposed for the review brief,
which feeds it into ModuleGraph::public_export_keys to compute the
exports-aware public-API surface delta.
Human-readable title for a security catalogue category id, for the CLI
renderer. Re-exported so the fallow security command can label a
TaintedSink finding without reaching into the private security module.