fallow 2.81.0 → 2.83.0

package/types/output-contract.d.ts

@@ -1531,8 +1531,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnresolvedImport`] finding. Mirrors
  * [`UnusedFileFinding`]: flattens the bare finding and carries a typed
- * `actions` array (`resolve-import` primary plus `suppress-line`
- * secondary).
+ * `actions` array (`resolve-import` primary plus config and inline
+ * suppression actions).
  */
 export interface UnresolvedImportFinding {
 /**
@@ -2533,8 +2533,8 @@ vital_signs?: (VitalSigns | null)
 health_score?: (HealthScore | null)
 /**
  * Per-file health scores. Only present when --file-scores is used. Sorted
- * by maintainability_index ascending (worst first). Zero-function files
- * (barrels) are excluded by default.
+ * by risk-aware triage concern, combining low maintainability and high
+ * CRAP risk. Zero-function files (barrels) are excluded by default.
  */
 file_scores?: FileHealthScore[]
 /**
@@ -3740,10 +3740,33 @@ untracked_ratio_percent: number
 }
 export interface RuntimeCoverageFinding {
 /**
- * Stable content-hash ID of the form `fallow:prod:<hash>`, where `<hash>`
- * is the first 8 hex characters of SHA-256(file + function + line + 'prod').
+ * Per-finding suppression key of the form `fallow:prod:<hash>` (first 8 hex
+ * of SHA-256(file + function + line + 'prod')). Hashes the current line, so
+ * it changes when the function moves. Use this to suppress one finding.
  */
 id: string
+/**
+ * Cross-surface join key of the form `fallow:fn:<hash>`
+ * (`fallow_cov_protocol::function_identity_id`, hashes file + name +
+ * start_line). The same function shares ONE value across findings, hot
+ * paths, blast-radius, and importance entries (the per-finding `id` uses a
+ * per-surface salt, so it differs by surface), and across V8, Istanbul,
+ * and oxc producers (columns are excluded from the hash). Like `id`, it
+ * changes when the function's file, name, or start line changes; it is a
+ * cross-surface / cross-producer join key, not a line-move-immune one.
+ * `null` when the producing surface (or an un-migrated cloud) supplied no
+ * `FunctionIdentity`.
+ */
+stable_id?: (string | null)
+/**
+ * Content digest of the function's full-span source slice
+ * (`fallow_cov_protocol::source_hash_for`: first 8 bytes of SHA-256 as 16
+ * lowercase hex). Unlike `stable_id`, this is stable across line moves: a
+ * moved-but-unedited function keeps the same value, so baselines can
+ * suppress it after a pure line shift. `null` when the producing surface
+ * supplied no `source_hash`.
+ */
+source_hash?: (string | null)
 /**
  * File path relative to the project root.
  */
@@ -3825,6 +3848,12 @@ export interface RuntimeCoverageHotPath {
  * Stable content-hash ID of the form `fallow:hot:<hash>`.
  */
 id: string
+/**
+ * Cross-surface join key (`fallow:fn:<hash>`) for the hot function. Stable
+ * across line moves; shared with the same function's findings / blast /
+ * importance entries. `null` when no `FunctionIdentity` was supplied.
+ */
+stable_id?: (string | null)
 /**
  * File path relative to the project root.
  */
@@ -3865,6 +3894,12 @@ export interface RuntimeCoverageBlastRadiusEntry {
  * Stable content-hash ID of the form `fallow:blast:<hash>`.
  */
 id: string
+/**
+ * Cross-surface join key (`fallow:fn:<hash>`) for the function. Stable
+ * across line moves; shared with the same function's findings / hot-path /
+ * importance entries. `null` when no `FunctionIdentity` was supplied.
+ */
+stable_id?: (string | null)
 /**
  * File path relative to the project root.
  */
@@ -3897,6 +3932,12 @@ export interface RuntimeCoverageImportanceEntry {
  * Stable content-hash ID of the form `fallow:importance:<hash>`.
  */
 id: string
+/**
+ * Cross-surface join key (`fallow:fn:<hash>`) for the function. Stable
+ * across line moves; shared with the same function's findings / hot-path /
+ * blast-radius entries. `null` when no `FunctionIdentity` was supplied.
+ */
+stable_id?: (string | null)
 /**
  * File path relative to the project root.
  */
@@ -4939,8 +4980,8 @@ vital_signs?: (VitalSigns | null)
 health_score?: (HealthScore | null)
 /**
  * Per-file health scores. Only present when --file-scores is used. Sorted
- * by maintainability_index ascending (worst first). Zero-function files
- * (barrels) are excluded by default.
+ * by risk-aware triage concern, combining low maintainability and high
+ * CRAP risk. Zero-function files (barrels) are excluded by default.
  */
 file_scores?: FileHealthScore[]
 /**

package/scripts/postinstall.js

@@ -1,63 +0,0 @@
-const { getPlatformPackage } = require('./platform-package');
-const { verifyInstalled, SKIP_ENV } = require('./verify-binary');
-
-const pkg = (() => {
-  if (process.platform !== 'linux') {
-    return getPlatformPackage(process.platform, process.arch);
-  }
-
-  try {
-    const { familySync } = require('detect-libc');
-    return getPlatformPackage(process.platform, process.arch, familySync());
-  } catch {
-    return getPlatformPackage(process.platform, process.arch);
-  }
-})();
-
-if (!pkg) {
-  console.warn(
-    `fallow: No prebuilt binary for ${process.platform}-${process.arch}. ` +
-    `You can build from source: https://github.com/fallow-rs/fallow`
-  );
-  process.exit(0);
-}
-
-try {
-  require.resolve(`${pkg}/package.json`);
-} catch {
-  console.warn(
-    `fallow: Platform package ${pkg} not installed. ` +
-    `This may happen if you used --no-optional. ` +
-    `Run 'npm install' to fix.`
-  );
-  // Without the platform package there is nothing to verify; keep the existing
-  // soft-fail behavior for --no-optional installs.
-  process.exit(0);
-}
-
-async function main() {
-  const result = await verifyInstalled();
-  if (result.skipped) {
-    console.warn(
-      `fallow: binary verification skipped (${SKIP_ENV}=${process.env[SKIP_ENV]}). ` +
-      `Only set this when you are deliberately replacing the published binary. ` +
-      `See https://github.com/fallow-rs/fallow/blob/main/SECURITY.md for details.`
-    );
-    process.exit(0);
-  }
-  if (!result.ok) {
-    const where = result.binary ? ` ${result.binary}` : '';
-    console.error(
-      `fallow: binary verification failed${where} (${result.code}): ${result.message}. ` +
-      `This usually means the published platform package was tampered with. ` +
-      `See https://github.com/fallow-rs/fallow/blob/main/SECURITY.md for details. ` +
-      `Set ${SKIP_ENV}=1 only if you are deliberately replacing the binary.`
-    );
-    process.exit(1);
-  }
-}
-
-main().catch((err) => {
-  console.error(`fallow: binary verification failed (internal-error): ${err.message}`);
-  process.exit(1);
-});