fallow 3.16.0 → 3.18.0

package/types/output-contract.d.ts

@@ -102,7 +102,7 @@ kind: "type-aware-status"
 /**
  * Schema projection for the audit envelope's exact version.
  */
-export type AuditSchemaVersion = 9
+export type AuditSchemaVersion = 10
 /**
  * Fallow CLI version that produced this envelope. Renders to the JSON wire as
  * a bare string (e.g. `"2.74.0"`).
@@ -144,7 +144,7 @@ export type SemanticCompletenessRequirement = ("best-effort" | "complete")
 /**
  * Stable reason why semantic evidence is partial or unavailable.
  */
-export type SemanticGapReason = ("no-project" | "ambiguous-project" | "blocking-diagnostics" | "unknown-symbol" | "unknown-entry-point" | "evidence-limit" | "dynamic-behavior" | "virtual-dispatch" | "dynamic-member-access" | "decorated-declaration" | "optional-contract" | "accessor-pair" | "overload-set" | "attached-comment" | "abstract-declaration" | "incomplete-project-coverage" | "framework-contract-provenance" | "capacity" | "unsupported-syntax")
+export type SemanticGapReason = ("no-project" | "ambiguous-project" | "blocking-diagnostics" | "svelte-virtual-module-exports" | "unknown-symbol" | "unknown-entry-point" | "evidence-limit" | "dynamic-behavior" | "virtual-dispatch" | "dynamic-member-access" | "decorated-declaration" | "optional-contract" | "accessor-pair" | "overload-set" | "attached-comment" | "abstract-declaration" | "incomplete-project-coverage" | "framework-contract-provenance" | "capacity" | "unsupported-syntax")
 /**
  * Value or type namespace for one exact declaration or reference.
  */
@@ -184,7 +184,7 @@ export type TypeAwareAbstentionReason = ("no-project" | "ambiguous-project" | "b
 /**
  * Schema projection for the dead-code envelope's exact version.
  */
-export type CheckSchemaVersion = 8
+export type CheckSchemaVersion = 9
 /**
  * A suggested action attached to a finding in the JSON output. Each finding
  * carries an `actions` array; consumers (agents, IDE clients, CI bots) can
@@ -363,9 +363,9 @@ type: "jsdoc_tag"
  */
 export type DependencyOverrideSource = ("pnpm-workspace.yaml" | "package.json")
 /**
- * Why a dependency-override entry is misconfigured. `pnpm install` would
- * either fail at install time or silently no-op on these entries; surfacing
- * them statically catches the issue before pnpm does.
+ * Why a dependency-override entry is misconfigured. The active package
+ * manager may fail at install time or silently no-op on these entries;
+ * surfacing them statically catches the issue first.
  */
 export type DependencyOverrideMisconfigReason = ("unparsable-key" | "empty-value")
 /**
@@ -441,6 +441,12 @@ kind: "skipped-minified-file"
  */
 error: string
 kind: "source-read-failure"
+} | {
+kind: "bun-lockb-override-resolution-skipped"
+} | {
+kind: "bun-lock-override-resolution-skipped"
+} | {
+kind: "bun-resolutions-shadowed-by-overrides"
 })
 /**
  * Discriminant for [`CloneGroupAction::kind`]. Mirrors the action types
@@ -782,7 +788,7 @@ export type GitLabReviewPositionType = "text"
 /**
  * Schema-version discriminator for the review envelope.
  */
-export type ReviewEnvelopeSchema = ("fallow-review-envelope/v1" | "fallow-review-envelope/v2")
+export type ReviewEnvelopeSchema = ("fallow-review-envelope/v1" | "fallow-review-envelope/v2" | "fallow-review-envelope/v3")
 /**
  * Review-envelope provider tag.
  */
@@ -821,7 +827,7 @@ export type CoverageSetupRuntimeTarget = ("node" | "browser")
 /**
  * Schema-version discriminator for [`CoverageAnalyzeOutput`].
  */
-export type CoverageAnalyzeSchemaVersion = "1"
+export type CoverageAnalyzeSchemaVersion = ("1" | "2")
 /**
  * Discovery outcome for a [`LogicalGroup`].
  */
@@ -829,7 +835,7 @@ export type LogicalGroupStatus = ("ok" | "empty" | "invalid_path")
 /**
  * Exact schema version for [`HealthOutput`].
  */
-export type HealthSchemaVersion = 10
+export type HealthSchemaVersion = 11
 /**
  * Resolver mode label for grouped envelopes (dead-code, dupes, health).
  *
@@ -842,7 +848,7 @@ export type GroupByMode = ("owner" | "directory" | "package" | "section")
  * Schema projection for the duplication envelope's CLI and programmatic
  * version lineages.
  */
-export type DupesSchemaVersion = (2 | 8)
+export type DupesSchemaVersion = (3 | 9)
 /**
  * Wire-version discriminator for [`ImpactReport`]. Independent from the global
  * `SchemaVersion` (the impact report versions on its own cadence) and from the
@@ -851,7 +857,7 @@ export type DupesSchemaVersion = (2 | 8)
  * it, matching the other independently-versioned envelopes (e.g.
  * `CoverageAnalyzeSchemaVersion`).
  */
-export type ImpactReportSchemaVersion = "1"
+export type ImpactReportSchemaVersion = ("1" | "2")
 /**
  * Why Impact tracking is (or is not) active for a project. `Project` = an
  * explicit per-repo `enable`; `User` = the user-global default with no per-repo
@@ -867,12 +873,12 @@ export type ImpactTrendDirection = ("improving" | "declining" | "stable")
  * versions separately from the per-project `ImpactReportSchemaVersion` and the
  * on-disk `STORE_SCHEMA_VERSION`).
  */
-export type CrossRepoImpactSchemaVersion = "1"
+export type CrossRepoImpactSchemaVersion = ("1" | "2")
 /**
  * The `fallow security --format json` schema version. Independently versioned
  * from the main contract, mirroring `ImpactReportSchemaVersion`.
  */
-export type SecuritySchemaVersion = ("1" | "2" | "3" | "4" | "5" | "6" | "7")
+export type SecuritySchemaVersion = ("1" | "2" | "3" | "4" | "5" | "6" | "7" | "8")
 /**
  * Severity level for rules.
  *
@@ -954,7 +960,7 @@ export type SecurityBlindSpotsSchemaVersion = "1"
 /**
  * Schema projection for the combined envelope's exact version.
  */
-export type CombinedSchemaVersion = 10
+export type CombinedSchemaVersion = 11
 /**
  * Schema projection for the feature-flags envelope's exact version.
  */
@@ -975,7 +981,7 @@ export type FeatureFlagActionType = ("investigate-flag" | "suppress-line")
  * Independently-versioned wire-version newtype for the brief envelope.
  * Serializes as the integer `REVIEW_BRIEF_SCHEMA_VERSION`.
  */
-export type ReviewBriefSchemaVersion = number
+export type ReviewBriefSchemaVersion = 7
 /**
  * The exactly-three shippable decision categories (the SOLID-3). No cut category
  * (abstraction / deletion / convention / irreversibility) is representable: this
@@ -1940,6 +1946,11 @@ ambiguous_project: number
  * Candidates retained because structural diagnostics block scanning.
  */
 blocking_diagnostics: number
+/**
+ * Candidates retained because the raw TypeScript-Go host cannot expose
+ * named exports from Svelte virtual modules.
+ */
+svelte_virtual_module_exports: number
 /**
  * Candidates whose exact declaration identity could not be resolved.
  */
@@ -2278,20 +2289,23 @@ empty_catalog_groups?: EmptyCatalogGroupFinding[]
  */
 unresolved_catalog_references?: UnresolvedCatalogReferenceFinding[]
 /**
- * Entries in pnpm-workspace.yaml's overrides: section, package.json's
- * pnpm.overrides block, or package.json's top-level npm overrides object,
+ * Entries in pnpm-workspace.yaml's overrides section, package.json's
+ * pnpm.overrides block, npm or Bun's top-level overrides object, or Bun's
+ * top-level resolutions object,
  * whose target package is not declared by any workspace package and is
- * not present in pnpm-lock.yaml or package-lock.json. Default severity
- * is warn because projects without a readable lockfile fall back to
- * manifest-only checks; the hint field flags those conservative cases.
+ * not present in pnpm-lock.yaml, package-lock.json, npm-shrinkwrap.json,
+ * or bun.lock. Default severity is warn because projects without a
+ * readable lockfile fall back to manifest-only checks; the hint field
+ * flags those conservative cases. When the only lockfile is bun's binary
+ * bun.lockb, resolution cannot be read and the check emits nothing.
  * Wrapped in [`UnusedDependencyOverrideFinding`].
  */
 unused_dependency_overrides?: UnusedDependencyOverrideFinding[]
 /**
- * pnpm.overrides or npm overrides entries whose key or value does not
- * parse as a valid override spec (empty key, empty value, malformed
- * selector, unbalanced parent matcher). The package manager will reject
- * these at install time. Default severity is error. Wrapped in
+ * Package-manager override or resolution entries whose key or value does
+ * not parse in the declaration source's grammar (empty key, empty value,
+ * malformed selector, unbalanced parent matcher). The package manager may
+ * reject or ignore these at install time. Default severity is error. Wrapped in
  * [`MisconfiguredDependencyOverrideFinding`].
  */
 misconfigured_dependency_overrides?: MisconfiguredDependencyOverrideFinding[]
@@ -2449,7 +2463,24 @@ regression?: (RegressionResult | null)
  */
 _meta?: (Meta | null)
 /**
- * Workspace-discovery diagnostics surfaced during config load.
+ * Non-fatal diagnostics about the project itself, from all three stages
+ * that record them (issue #473):
+ *
+ * - workspace discovery, at config load: `undeclared-workspace`,
+ *   `malformed-package-json`, `glob-matched-no-package-json`,
+ *   `malformed-tsconfig`, `tsconfig-reference-dir-missing`;
+ * - source discovery, during the file walk: `skipped-large-file`,
+ *   `skipped-minified-file`, `source-read-failure`;
+ * - dead-code analysis, from the dependency-catalog and override
+ *   detectors: `malformed-pnpm-workspace-yaml`,
+ *   `bun-lockb-override-resolution-skipped`.
+ *
+ * Analysis-stage kinds therefore reach only the envelopes whose run
+ * includes a dead-code analyze pass, never a standalone
+ * `fallow dupes --format json`. `path` is project-root-relative with
+ * forward slashes; the array is omitted when empty. The same list is
+ * repeated on each top-level command's envelope so single-command
+ * consumers see it without having to look at a separate top-level field.
  */
 workspace_diagnostics?: WorkspaceDiagnostic[]
 /**
@@ -2633,12 +2664,12 @@ empty_catalog_groups: number
  */
 unresolved_catalog_references: number
 /**
- * Pnpm `overrides:` entries whose target package is not declared by any
- * workspace package and not present in the lockfile.
+ * Package-manager overrides whose target package is not declared by any
+ * workspace package and not present in the active readable lockfile.
  */
 unused_dependency_overrides: number
 /**
- * Pnpm `overrides:` entries whose key or value cannot be parsed.
+ * Package-manager overrides whose key or value cannot be parsed.
  */
 misconfigured_dependency_overrides: number
 /**
@@ -3881,7 +3912,7 @@ parent_package?: (string | null)
  */
 version_constraint?: (string | null)
 /**
- * The right-hand side of the entry: the version pnpm should force.
+ * The right-hand side of the entry: the version the package manager should force.
  */
 version_range: string
 source: DependencyOverrideSource
@@ -9031,6 +9062,18 @@ is_used: boolean
  * Files that reference this export directly.
  */
 direct_references: ExportReference[]
+/**
+ * Reachable direct references grouped by namespace. This is additive to
+ * `namespace` and `direct_references`, whose winning-lane meaning remains
+ * unchanged for backwards compatibility.
+ */
+direct_references_by_namespace?: NamespacedExportReferences[]
+/**
+ * A star-export collision that makes the traced name ambiguous. When
+ * present, `is_used: false` is an abstention rather than an unused-code
+ * verdict.
+ */
+star_export_ambiguity?: (StarExportAmbiguity | null)
 /**
  * Re-export chains that pass through this export.
  */
@@ -9057,6 +9100,36 @@ from_file: string
  */
 kind: string
 }
+/**
+ * Direct references that credit one namespace of an export binding.
+ */
+export interface NamespacedExportReferences {
+namespace: SemanticNamespace
+/**
+ * Number of reachable references in this namespace.
+ */
+reference_count: number
+/**
+ * Reachable references in deterministic graph order.
+ */
+references: ExportReference[]
+}
+/**
+ * The `export *` collision that keeps a name from being exported.
+ */
+export interface StarExportAmbiguity {
+/**
+ * Files that each declare a colliding declaration under the traced name
+ * (project-root-relative), sorted. These are the origins to fix: keep one,
+ * rename or explicitly re-export the rest.
+ */
+sources: string[]
+/**
+ * The namespaces the collision occurs in, type before value. A name can
+ * collide in type space, value space, or both.
+ */
+namespaces: SemanticNamespace[]
+}
 /**
  * A re-export chain showing how an export is propagated.
  */
@@ -9100,6 +9173,7 @@ member_kind: string
  * The export that declares this member (the class / enum / store name).
  */
 owner_export: string
+owner_namespace?: SemanticNamespace
 /**
  * Whether the owning export is considered used.
  */
@@ -9366,6 +9440,14 @@ callees?: (ChainHop[] | null)
  * Present only when `--callees` was requested.
  */
 unresolved_callees?: (UnresolvedCallee[] | null)
+/**
+ * Set when the name is unresolvable because two different `export *`
+ * sources of this file supply it. `symbol_found` is `false` in that case
+ * for the same reason it is false for an unknown name (the file exports
+ * nothing under it per ECMA-262 ResolveExport), so this field is the only
+ * thing that separates a barrel mistake from a typo.
+ */
+star_export_ambiguity?: (StarExportAmbiguity | null)
 /**
  * A human-readable summary of the trace outcome.
  */
@@ -9547,7 +9629,8 @@ comments: number
  */
 current_fingerprints: number
 /**
- * Distinct fingerprints found in existing comments.
+ * Distinct fingerprints with an open Fallow lifecycle, including
+ * provider-resolved discussions not yet closed by a Fallow marker.
  */
 existing_fingerprints: number
 /**
@@ -9555,7 +9638,7 @@ existing_fingerprints: number
  */
 new_fingerprints: number
 /**
- * Fingerprints commented earlier whose findings no longer exist.
+ * Fingerprints with open Fallow lifecycles whose findings no longer exist.
  */
 stale_fingerprints: number
 /**
@@ -9575,7 +9658,7 @@ provider_warning?: (string | null)
  */
 resolution_comments_posted: number
 /**
- * Stale discussion threads resolved (GitLab).
+ * Provider discussion threads resolved or re-closed.
  */
 threads_resolved: number
 /**
@@ -9885,8 +9968,10 @@ workspace_count: number
 workspaces: WorkspaceInfo[]
 /**
  * Workspace discovery diagnostics produced while reading workspace
- * declarations. Present for compatibility with the current wire contract,
- * even when empty.
+ * declarations. Paths are project-root-relative and use forward slashes,
+ * like `workspaces[].path` and like the `workspace_diagnostics[]` array on
+ * the analysis envelopes. Present for compatibility with the current wire
+ * contract, even when empty.
  */
 workspace_diagnostics: WorkspaceDiagnostic[]
 }
@@ -10061,7 +10146,10 @@ groups?: (HealthGroup[] | null)
  */
 _meta?: (Meta | null)
 /**
- * Workspace-discovery diagnostics surfaced during config load.
+ * Workspace-discovery, source-discovery, and analysis-stage diagnostics
+ * for the run. See `CheckOutput::workspace_diagnostics` for the full
+ * contract: the kinds each stage records, project-root-relative paths,
+ * omitted when empty.
  */
 workspace_diagnostics?: WorkspaceDiagnostic[]
 /**
@@ -10210,11 +10298,13 @@ groups?: (DuplicationGroup[] | null)
  */
 _meta?: (Meta | null)
 /**
- * Workspace-discovery diagnostics surfaced during config load
+ * Workspace-discovery and source-discovery diagnostics for the run
  * (issue #473). See `CheckOutput::workspace_diagnostics` for the full
  * contract; the same list is repeated on each top-level command's
  * envelope so single-command consumers see it without having to look at
- * a separate top-level field.
+ * a separate top-level field. A standalone `fallow dupes` run has no
+ * dead-code analyze pass, so the two analysis-stage kinds never appear
+ * here.
  */
 workspace_diagnostics?: WorkspaceDiagnostic[]
 /**
@@ -10563,20 +10653,23 @@ empty_catalog_groups?: EmptyCatalogGroupFinding[]
  */
 unresolved_catalog_references?: UnresolvedCatalogReferenceFinding[]
 /**
- * Entries in pnpm-workspace.yaml's overrides: section, package.json's
- * pnpm.overrides block, or package.json's top-level npm overrides object,
+ * Entries in pnpm-workspace.yaml's overrides section, package.json's
+ * pnpm.overrides block, npm or Bun's top-level overrides object, or Bun's
+ * top-level resolutions object,
  * whose target package is not declared by any workspace package and is
- * not present in pnpm-lock.yaml or package-lock.json. Default severity
- * is warn because projects without a readable lockfile fall back to
- * manifest-only checks; the hint field flags those conservative cases.
+ * not present in pnpm-lock.yaml, package-lock.json, npm-shrinkwrap.json,
+ * or bun.lock. Default severity is warn because projects without a
+ * readable lockfile fall back to manifest-only checks; the hint field
+ * flags those conservative cases. When the only lockfile is bun's binary
+ * bun.lockb, resolution cannot be read and the check emits nothing.
  * Wrapped in [`UnusedDependencyOverrideFinding`].
  */
 unused_dependency_overrides?: UnusedDependencyOverrideFinding[]
 /**
- * pnpm.overrides or npm overrides entries whose key or value does not
- * parse as a valid override spec (empty key, empty value, malformed
- * selector, unbalanced parent matcher). The package manager will reject
- * these at install time. Default severity is error. Wrapped in
+ * Package-manager override or resolution entries whose key or value does
+ * not parse in the declaration source's grammar (empty key, empty value,
+ * malformed selector, unbalanced parent matcher). The package manager may
+ * reject or ignore these at install time. Default severity is error. Wrapped in
  * [`MisconfiguredDependencyOverrideFinding`].
  */
 misconfigured_dependency_overrides?: MisconfiguredDependencyOverrideFinding[]
@@ -10993,6 +11086,10 @@ _meta?: (Meta | null)
  * distinguish "gate ran and passed" from "gate did not run" (absent).
  */
 gate?: (SecurityGate | null)
+/**
+ * Diagnostics owned by this security analysis run.
+ */
+workspace_diagnostics?: WorkspaceDiagnostic[]
 /**
  * Security candidates. Paths are project-root-relative, forward-slash.
  */
@@ -11610,6 +11707,10 @@ _meta?: (Meta | null)
  * Gate verdict, present only when `--gate <mode>` was set.
  */
 gate?: (SecurityGate | null)
+/**
+ * Diagnostics owned by the full security analysis summarized here.
+ */
+workspace_diagnostics?: WorkspaceDiagnostic[]
 summary: SecuritySummary
 }
 /**
@@ -11729,6 +11830,10 @@ export interface SecuritySurvivorsOutput {
 schema_version: SecuritySurvivorsSchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
+/**
+ * Diagnostics preserved from the candidate security report.
+ */
+workspace_diagnostics?: WorkspaceDiagnostic[]
 summary: SecuritySurvivorsSummary
 /**
  * Verifier-retained candidates keyed by finding id.
@@ -11811,6 +11916,10 @@ export interface SecurityBlindSpotsOutput {
 schema_version: SecurityBlindSpotsSchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
+/**
+ * Diagnostics owned by the security analysis used for this view.
+ */
+workspace_diagnostics?: WorkspaceDiagnostic[]
 summary: SecurityBlindSpotsSummary
 /**
  * Grouped unresolved callee diagnostics, derived from existing samples.
@@ -11889,6 +11998,15 @@ dupes?: (DupesReportPayload | null)
  * Health section of the combined run.
  */
 health?: (HealthReport | null)
+/**
+ * Workspace-discovery, source-discovery, and analysis-stage diagnostics
+ * for the run (issue #2366). See `CheckOutput::workspace_diagnostics` for
+ * the full contract: root-relative paths, omitted when empty. The
+ * combined envelope carries them here rather than inside a section, so a
+ * run that skips a section (`--skip check`, `--only health`,
+ * `--only dupes`) still reports every diagnostic its analyses recorded.
+ */
+workspace_diagnostics?: WorkspaceDiagnostic[]
 /**
  * Read-only follow-up commands aggregated across the combined run's
  * findings. See `CheckOutput::next_steps` for the contract.