Struct ModuleInfo 

pub struct ModuleInfo {

    pub file_id: FileId,
    pub exports: Vec<ExportInfo>,
    pub imports: Vec<ImportInfo>,
    pub re_exports: Vec<ReExportInfo>,
    pub dynamic_imports: Vec<DynamicImportInfo>,
    pub dynamic_import_patterns: Vec<DynamicImportPattern>,
    pub require_calls: Vec<RequireCallInfo>,
    pub package_path_references: Vec<String>,
    pub member_accesses: Vec<MemberAccess>,
    pub whole_object_uses: Vec<String>,
    pub has_cjs_exports: bool,
    pub has_angular_component_template_url: bool,
    pub content_hash: u64,
    pub suppressions: Vec<Suppression>,
    pub unknown_suppression_kinds: Vec<UnknownSuppressionKind>,
    pub unused_import_bindings: Vec<String>,
    pub type_referenced_import_bindings: Vec<String>,
    pub value_referenced_import_bindings: Vec<String>,
    pub line_offsets: Vec<u32>,
    pub complexity: Vec<FunctionComplexity>,
    pub flag_uses: Vec<FlagUse>,
    pub class_heritage: Vec<ClassHeritageInfo>,
    pub injection_tokens: Vec<(String, String)>,
    pub local_type_declarations: Vec<LocalTypeDeclaration>,
    pub public_signature_type_references: Vec<PublicSignatureTypeReference>,
    pub namespace_object_aliases: Vec<NamespaceObjectAlias>,
    pub iconify_prefixes: Vec<String>,
    pub iconify_icon_names: Vec<String>,
    pub auto_import_candidates: Vec<String>,
    pub directives: Vec<String>,
    pub client_only_dynamic_import_spans: Vec<u32>,
    pub security_sinks: Vec<SinkSite>,
    pub security_sinks_skipped: u32,
    pub security_unresolved_callee_sites: Vec<SkippedSecurityCalleeSite>,
    pub tainted_bindings: Vec<TaintedBinding>,
    pub sanitized_sink_args: Vec<SanitizedSinkArg>,
    pub security_control_sites: Vec<SecurityControlSite>,
    pub callee_uses: Vec<CalleeUse>,
    pub misplaced_directives: Vec<MisplacedDirectiveSite>,
    pub di_key_sites: Vec<DiKeySite>,
    pub has_dynamic_provide: bool,
    pub referenced_import_bindings: Vec<String>,
    pub component_props: Vec<ComponentProp>,
    pub has_props_attrs_fallthrough: bool,
    pub has_define_expose: bool,
    pub has_define_model: bool,
    pub has_unharvestable_props: bool,
    pub component_emits: Vec<ComponentEmit>,
    pub has_unharvestable_emits: bool,
    pub has_dynamic_emit: bool,
    pub has_emit_whole_object_use: bool,
    pub load_return_keys: Vec<LoadReturnKey>,
    pub has_unharvestable_load: bool,
    pub has_load_data_whole_use: bool,
    pub has_page_data_store_whole_use: bool,
    pub component_functions: Vec<ComponentFunction>,
    pub react_props: Vec<ComponentProp>,
    pub hook_uses: Vec<HookUse>,
    pub render_edges: Vec<RenderEdge>,
}

Extracted module information from a single file.

Fields

file_id: FileId

Unique identifier for this file.

exports: Vec<ExportInfo>

All export declarations in this module.

imports: Vec<ImportInfo>

All import declarations in this module.

re_exports: Vec<ReExportInfo>

All re-export declarations (e.g., export { foo } from './bar').

dynamic_imports: Vec<DynamicImportInfo>

All dynamic import() calls with string literal sources.

dynamic_import_patterns: Vec<DynamicImportPattern>

Dynamic import patterns.

require_calls: Vec<RequireCallInfo>

All require() calls.

package_path_references: Vec<String>

Package names statically referenced through package path resolution.

member_accesses: Vec<MemberAccess>

Static member access expressions (e.g., Status.Active).

whole_object_uses: Vec<String>

Identifiers used in whole-object access patterns.

has_cjs_exports: bool

Whether this module uses CommonJS exports.

has_angular_component_template_url: bool

Whether this module declares an Angular component templateUrl.

content_hash: u64

xxh3 hash of the file content for incremental caching.

suppressions: Vec<Suppression>

Inline suppression directives parsed from comments.

unknown_suppression_kinds: Vec<UnknownSuppressionKind>

Suppression tokens that did not parse to any known IssueKind. Surfaced as StaleSuppression findings via find_stale so users see typos or obsolete kind names instead of having the entire marker silently discarded. See issue #449.

unused_import_bindings: Vec<String>

Local names of import bindings that are never referenced in this file. Populated via oxc_semantic scope analysis. Used at graph-build time to skip adding references for imports whose binding is never read, improving unused-export detection precision.

type_referenced_import_bindings: Vec<String>

Local import bindings that are referenced from TypeScript type positions. Used to distinguish value-namespace and type-namespace references when a module exports both const X and type X.

value_referenced_import_bindings: Vec<String>

Local import bindings referenced from runtime/value positions.

line_offsets: Vec<u32>

Pre-computed byte offsets where each line starts.

complexity: Vec<FunctionComplexity>

Per-function complexity metrics.

flag_uses: Vec<FlagUse>

Feature flag use sites.

class_heritage: Vec<ClassHeritageInfo>

Heritage metadata for exported classes that declare implements.

injection_tokens: Vec<(String, String)>

Angular InjectionToken<Interface> declarations, as (token_export_name, interface_name) pairs. Recorded only for new InjectionToken<I>(...) initializers whose InjectionToken is imported from @angular/core. The analyze layer follows the token’s interface type argument to the classes that implement it so a template member call through inject(TOKEN) credits the concrete implementation. See issue #920 (follow-up to #911 / #913).

local_type_declarations: Vec<LocalTypeDeclaration>

Local type-capable declarations.

public_signature_type_references: Vec<PublicSignatureTypeReference>

Type references in exported public signatures.

namespace_object_aliases: Vec<NamespaceObjectAlias>

Aliases of namespace imports re-exported through an object literal.

iconify_prefixes: Vec<String>

Deduped Iconify collection prefixes found in static icon props.

iconify_icon_names: Vec<String>

Deduped Nuxt UI i-<collection>-<icon> icon class suffixes found in static script-side icon properties.

auto_import_candidates: Vec<String>

Bare identifiers that may be resolved by framework auto-imports.

directives: Vec<String>

File-level string directives in source order (e.g. "use client", "use server", "use strict"). Captured from Program::directives. Consumed by the security client-server-leak detector to identify React Server Component client boundaries.

client_only_dynamic_import_spans: Vec<u32>

Byte-offset starts of dynamic import() expressions wrapped in next/dynamic(() => import('./X'), { ssr: false }). The ssr:false option is Next.js’s sanctioned way to pull a client-only module, so a server-only module reached ONLY through such an import is NOT a client-server leak. The security client-server-leak BFS resolves each dynamic import to a graph edge; these span starts let the BFS exclude exactly those edges (matched against the edge’s import_span). Empty for files with no ssr:false dynamic import. Captured only by JS/TS extraction.

security_sinks: Vec<SinkSite>

Captured security sink sites (category-blind). Consumed by the catalogue-driven tainted_sink detector. Captured only by JS/TS extraction; empty for CSS/MDX/etc. See security_matchers.toml.

security_sinks_skipped: u32

Count of sink-shaped nodes whose callee could not be flattened to a static path (dynamic dispatch, computed members, aliased bindings). Surfaced in-band so an empty catalogue result with a non-zero count is not a clean bill.

security_unresolved_callee_sites: Vec<SkippedSecurityCalleeSite>

Compact span-level diagnostics for skipped security sink callees. Kept next to security_sinks_skipped so warm-cache and cold-cache security output can explain where the blind spots are concentrated without source snippets.

tainted_bindings: Vec<TaintedBinding>

Local bindings whose initializer (or destructured object) is a flattened member-access path. Used by the security tainted_sink detector to back-trace a sink argument to a known untrusted source: the analyze layer matches each binding’s source_path against the data-driven source catalogue (security_matchers.toml [[source]] rows) and treats the matching local names as source-tainted. Intra-module and name-based (no scope analysis); a conservative association, never a taint proof.

sanitized_sink_args: Vec<SanitizedSinkArg>

Sink arguments that were recognized as sanitizer calls at extraction time. Used for direct sink calls such as el.innerHTML = DOMPurify.sanitize(input).

security_control_sites: Vec<SecurityControlSite>

Known defensive control call sites found in this module. Consumed only by the fallow security --surface agent JSON path.

callee_uses: Vec<CalleeUse>

Statically flattenable callee paths invoked in this module, deduped per unique path (first occurrence wins). Consumed by the boundaries.calls.forbidden detector. Captured unconditionally because extraction is config-blind; the per-module cost is bounded by the unique-callee count.

misplaced_directives: Vec<MisplacedDirectiveSite>

"use client" / "use server" directive strings written as expression statements in program.body (misplaced, NOT in the leading prologue), so the RSC bundler silently ignores them. One entry per occurrence. Consumed by the misplaced-directive detector. Captured only by JS/TS extraction.

di_key_sites: Vec<DiKeySite>

Vue provide/inject and Svelte setContext/getContext call sites keyed by an identifier symbol. Consumed by the unprovided-inject detector to find an inject/getContext whose key is provided nowhere project-wide. Only identifier-keyed sites are recorded (string-literal and computed keys abstain). Captured by JS/TS and SFC extraction.

has_dynamic_provide: bool

true when this module contains a provide(...) / *.provide(...) / setContext(...) call whose key argument is NOT a plain identifier (spread, computed, member, loop variable). Such a call can provide an unknowable key, so the unprovided-inject detector abstains on ALL inject findings project-wide when any reachable module sets this flag. Mirrors the spread-return whole-object abstain used for Pinia stores.

referenced_import_bindings: Vec<String>

Local names of import bindings that ARE referenced somewhere in this file (script value/type position OR template/markup). The complement of unused_import_bindings among imports. Derived in release_resolution_payload (where both imports and unused_import_bindings are still present) so it survives the release and is readable by the analyze layer; it is never cached (recomputed on every cache load). Consumed by the unrendered-component detector to credit a Vue/Svelte SFC that some file actually imports-and-uses, distinguishing it from a component reachable only through a barrel re-export.

component_props: Vec<ComponentProp>

Vue <script setup> defineProps declared props. Consumed by the unused-component-prop detector to flag a prop referenced nowhere in its own SFC. Each entry carries used_in_script / used_in_template.

has_props_attrs_fallthrough: bool

true when the template spreads the whole props/attrs object (v-bind="$attrs" / v-bind="$props" / v-bind="props") or the defineProps return is destructured with a rest element. Either form can consume a prop indirectly, so the detector abstains on the whole file.

has_define_expose: bool

true when the SFC calls defineExpose(...). A prop may be re-exposed, so the detector conservatively abstains on the whole file.

has_define_model: bool

true when the SFC calls defineModel(...). Two-way model props are out of scope for v1, so the detector abstains on the whole file.

has_unharvestable_props: bool

true when defineProps was called with an unharvestable argument (a type-reference type argument such as defineProps<Props>() whose names require cross-file type resolution). The detector abstains on the whole file so a prop is never falsely flagged.

component_emits: Vec<ComponentEmit>

Vue <script setup> defineEmits declared events. Consumed by the unused-component-emit detector to flag an event emitted nowhere in its own SFC. Each entry carries used.

has_unharvestable_emits: bool

true when defineEmits was called with an unharvestable argument (a type-reference type argument such as defineEmits<MyEmits>(), a non-literal runtime form, or an unbound defineEmits([...])). The detector abstains on the whole file so an emit is never falsely flagged.

has_dynamic_emit: bool

true when an emit(<nonLiteral>) call was seen (the emitted event name cannot be known statically). The detector abstains on the whole file.

has_emit_whole_object_use: bool

true when the defineEmits return binding was used as a WHOLE value (passed to a function, returned, or spread), which can emit any event opaquely. The detector abstains on the whole file.

load_return_keys: Vec<LoadReturnKey>

SvelteKit load() return-object keys harvested from a +page.{ts,server.ts,js,server.js} file’s terminal return literal. Consumed by the unused-load-data-key detector. Empty for every file that is not a page-load producer (gated by basename at harvest time).

has_unharvestable_load: bool

true when this file’s load() body could not be harvested safely (a spread return, a non-object/non-literal return, more than one top-level return, a computed key, or a wrapped/re-exported load). The detector abstains on the whole file so a key is never falsely flagged.

has_load_data_whole_use: bool

true when this file passes the whole data object opaquely (script const X = data, fn(data) / fn(...data), or template data={data} / {...data} in a route component), so a child can read arbitrary keys the detector cannot see. Name-gated on the data binding. Read ONLY by the unused-load-data-key detector, so capturing it for all files is byte-identity-safe. See FP-1 in the plan.

has_page_data_store_whole_use: bool

true when this file uses the whole page.data / $page.data store object opaquely (e.g. Object.values(page.data), {...$page.data}), so a reflective read could consume any route’s key. Drives the unused-load-data-key detector’s project-wide abstain. Derived in release_resolution_payload from whole_object_uses BEFORE that vector is released (mirroring referenced_import_bindings), so it survives the release the detector runs after; it is never cached (recomputed each run from the cached whole_object_uses). Reassignment forms (const all = $page.data) are not whole-object-tracked and stay out of scope, matching the syntactic analyzer’s conservative posture.

component_functions: Vec<ComponentFunction>

React/JSX component definitions: functions/arrows whose body returns JSX. Captured only for .jsx/.tsx files when a React/Preact dependency is plausible. Consumed by the React unused-component-prop arm and the complexity-fold phase. Empty for non-React files.

react_props: Vec<ComponentProp>

React component props (reuses the shared ComponentProp struct). For React, used_in_template is always false and used_in_script means used-in-body. Empty for non-React files.

hook_uses: Vec<HookUse>

React hook call sites (useState / useEffect / useMemo / useCallback / custom use*). Drives hook-density complexity context. Empty for non-React files.

render_edges: Vec<RenderEdge>

React render edges: one component rendering another. Captured with the child’s written name; child-to-FileId resolution is deferred to graph build. Empty for non-React files.

Implementations

impl ModuleInfo

pub fn release_resolution_payload(&mut self)

Release extraction payload that resolution has already copied into the graph.

This keeps fields needed by analysis, health, security, LSP, coverage, and hash drift checks, while dropping vectors that otherwise duplicate data owned by ResolvedModule or already credited into the module graph.

Trait Implementations

impl Clone for ModuleInfo

fn clone(&self) -> ModuleInfo

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ModuleInfo

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.