Module extract 

Module extraction types: exports, imports, re-exports, and member info. Module extraction types.

Structs

ClassHeritageInfo

Additional heritage metadata for an exported class.

ComplexityContribution

A single complexity increment, located at its source line/column.

DynamicImportInfo

A dynamic import() call.

DynamicImportPattern

A dynamic import with a partially resolved pattern.

ExportInfo

An export declaration.

FlagUse

A feature flag use site.

FunctionComplexity

Complexity metrics for a single function/method/arrow.

ImportInfo

An import declaration.

LocalTypeDeclaration

A module-scope declaration that can be used as a TypeScript type.

MemberAccess

A static member access expression (e.g., Status.Active, MyClass.create()).

MemberInfo

A member of an enum, class, or namespace.

ModuleInfo

Extracted module information from a single file.

NamespaceObjectAlias

One alias entry tying an exported object’s dotted property path to a namespace import.

ParseResult

Result of parsing all files, including incremental cache statistics.

PublicSignatureTypeReference

A reference from an exported symbol’s public signature to a type name.

ReExportInfo

A re-export declaration.

RequireCallInfo

A require() call.

SanitizedSinkArg

A captured sink argument that is itself a recognized sanitizer call.

SecurityControlSite

A known defensive control call site.

SinkObjectProperty

Static object-literal property metadata attached to a captured sink argument. Nested object paths are flattened with dot-separated keys.

SinkSite

A captured sink site. The visitor records every existing non-literal call / member-assign / member-call / tagged-template / jsx-attr sink site, and a small allowlist of literal-aware sites where the literal value is the signal. It knows nothing about CWE categories.

TaintedBinding

A local binding tied to the flattened member-access path it was initialized from. The analyze layer matches source_path against the data-driven source catalogue; when it matches, local is treated as carrying untrusted input.

Enums

ComplexityContributionKind

The syntactic construct that produced a single complexity increment.

ComplexityMetric

Which complexity metric a ComplexityContribution adds to.

ExportName

Export identifier.

FlagUseKind

The kind of feature flag pattern detected.

ImportedName

How a symbol is imported.

MemberKind

The kind of member.

SanitizerScope

Sanitizer output domain. Kept intentionally narrow so a sanitizer for one domain cannot suppress a different sink family.

SecurityControlKind

Defensive control family detected on a source to sink path.

SinkArgKind

The shape of the argument captured at a sink site. Category-blind like SinkShape, but finer-grained: it lets the catalogue matcher require or exclude specific argument shapes. The discriminator is what distinguishes an unsafe SQL string concatenation or template-into-.execute() from a safely-parameterized sql`${x}` tagged template, an object-literal .execute({ sql, args }) argument, or a literal-aware sink argument.

SinkLiteralValue

Literal values attached to literal-aware security sink captures.

SinkShape

The syntactic shape of a captured security sink site. Category-blind: the extractor records the shape and the dotted/bare callee path; the analyze layer matches it against the data-driven catalogue. See crates/core/data/security_matchers.toml.

VisibilityTag

Visibility tag from JSDoc/TSDoc comments that suppresses unused-export detection.

Constants

PUBLIC_ENV_EXACT

Exact env var names that are public by convention (no prefix).

PUBLIC_ENV_PREFIXES

Env var-name prefixes that frameworks inline into the client bundle by convention. A read of one of these is normal and safe, so it does NOT count as a secret source (issue #890). Shared by the extract layer (so public env vars never become source signals) and the bespoke client-server-leak rule.

Functions

byte_offset_to_line_col

Convert a byte offset to a 1-based line number and 0-based byte column.

compute_line_offsets

Compute a table of line-start byte offsets from source text.

is_public_env_path

Whether a flattened member path is a PUBLIC env-secret read (process.env.NEXT_PUBLIC_X, import.meta.env.VITE_Y), which must not be recorded as a secret source. Non-env paths (req.query.id) are never public.

is_public_env_var

Whether an env var name is public-by-convention (build-inlined into the client bundle), and therefore not a secret.