fallow 3.3.0 → 3.4.2

package/README.md

@@ -119,7 +119,7 @@ Create a config file in your project root, or run `fallow init`:
 ```jsonc
 // .fallowrc.json
 {
-  "$schema": "https://raw.githubusercontent.com/fallow-rs/fallow/main/schema.json",
+  "$schema": "./node_modules/fallow/schema.json",
   "entry": ["src/workers/*.ts", "scripts/*.ts"],
   "ignorePatterns": ["**/*.generated.ts"],
   "rules": {
@@ -130,6 +130,16 @@ Create a config file in your project root, or run `fallow init`:
 }
 ```
 
+`$schema` gives editors autocomplete and validation and has no effect on
+analysis. As an npm package, `fallow` always ships a version-aligned schema at
+`./node_modules/fallow/schema.json`, which `fallow init` and
+`fallow recommend` point at by default: offline, no editor trust prompt. If
+you install fallow another way (cargo, homebrew, a bare binary) with no
+`node_modules/fallow` to point at, use the remote fallback instead:
+`https://raw.githubusercontent.com/fallow-rs/fallow/main/schema.json`. Some
+editors, including VS Code, refuse to load a remote schema URL until you
+explicitly trust the domain.
+
 Also supports TOML (`fallow init --toml` creates `fallow.toml`).
 
 ## Documentation

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.3.0",
+  "version": "3.4.2",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -18,6 +18,16 @@
       "description": "Path to config file (.fallowrc.json, .fallowrc.jsonc, fallow.toml, or .fallow.toml)",
       "short": "-c"
     },
+    {
+      "name": "--allow-remote-extends",
+      "type": "bool",
+      "required": false,
+      "description": "Allow trusted config files to extend HTTPS URLs",
+      "possible_values": [
+        "true",
+        "false"
+      ]
+    },
     {
       "name": "--format",
       "type": "string",
@@ -36,7 +46,9 @@
         "pr-comment-gitlab",
         "review-github",
         "review-gitlab",
-        "badge"
+        "badge",
+        "github-annotations",
+        "github-summary"
       ]
     },
     {
@@ -266,6 +278,12 @@
       "description": "Write the report to a file instead of stdout, for any --format (no ANSI codes). Useful on large projects where the terminal scrollback truncates the top. Progress and the confirmation stay on stderr",
       "short": "-o"
     },
+    {
+      "name": "--report-path-prefix",
+      "type": "string",
+      "required": false,
+      "description": "Prefix prepended to every path in the CI-facing formats (`github-annotations`, `github-summary`, `codeclimate`, `review-github`, `review-gitlab`). CI platforms address files by repository-root-relative path, so when the analyzed project lives in a subdirectory (e.g. `packages/app/`), paths need that offset. fallow detects the offset via the git toplevel automatically; this flag overrides the detection. Pass an empty string to disable rebasing and emit paths relative to `--root`"
+    },
     {
       "name": "--fail-on-regression",
       "type": "bool",
@@ -1448,6 +1466,18 @@
         }
       ]
     },
+    {
+      "name": "suppressions",
+      "description": "List active fallow-ignore suppression markers (read-only inventory)",
+      "flags": [
+        {
+          "name": "--file",
+          "type": "string",
+          "required": false,
+          "description": "Only list suppressions in the specified files. Accepts multiple values"
+        }
+      ]
+    },
     {
       "name": "explain",
       "description": "Explain one fallow issue type without running an analysis",
@@ -1753,6 +1783,18 @@
         }
       ]
     },
+    {
+      "name": "report",
+      "description": "Render a saved `--format json` results file in another format without re-running analysis (analyze once, render annotations and the job summary from the same file). v1 renders the GitHub-native formats only: `--format github-annotations` or `--format github-summary`",
+      "flags": [
+        {
+          "name": "--from",
+          "type": "string",
+          "required": true,
+          "description": "Path to a fallow JSON results file produced by `--format json` (dead-code, dupes, health, audit, security, or bare combined)"
+        }
+      ]
+    },
     {
       "name": "schema",
       "description": "Dump fallow's capability manifest (CLI commands and flags, issue types, MCP tools, framework plugins, env vars) as machine-readable JSON for agent introspection. Always JSON, regardless of --format",
@@ -6588,6 +6630,20 @@
         "license_note": null,
         "read_only": true
       },
+      {
+        "name": "list_suppressions",
+        "kind": "analysis",
+        "description": "List active fallow-ignore suppression markers grouped per file (line, kind, level, reason, and a stale cross-reference); a read-only governance inventory that always exits 0",
+        "cli_command": "fallow suppressions --format json --quiet",
+        "key_params": [
+          "workspace",
+          "changed_since",
+          "file"
+        ],
+        "license": "free",
+        "license_note": null,
+        "read_only": true
+      },
       {
         "name": "impact",
         "kind": "introspection",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.3.0",
+  "version": "3.4.2",
   "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
   "license": "MIT",
   "repository": {
@@ -36,7 +36,7 @@
     "tanstack-intent"
   ],
   "engines": {
-    "node": ">=16"
+    "node": ">=22"
   },
   "bin": {
     "fallow": "bin/fallow",
@@ -87,13 +87,13 @@
     "@tanstack/intent": "0.3.2"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.3.0",
-    "@fallow-cli/darwin-x64": "3.3.0",
-    "@fallow-cli/linux-x64-gnu": "3.3.0",
-    "@fallow-cli/linux-arm64-gnu": "3.3.0",
-    "@fallow-cli/linux-x64-musl": "3.3.0",
-    "@fallow-cli/linux-arm64-musl": "3.3.0",
-    "@fallow-cli/win32-arm64-msvc": "3.3.0",
-    "@fallow-cli/win32-x64-msvc": "3.3.0"
+    "@fallow-cli/darwin-arm64": "3.4.2",
+    "@fallow-cli/darwin-x64": "3.4.2",
+    "@fallow-cli/linux-x64-gnu": "3.4.2",
+    "@fallow-cli/linux-arm64-gnu": "3.4.2",
+    "@fallow-cli/linux-x64-musl": "3.4.2",
+    "@fallow-cli/linux-arm64-musl": "3.4.2",
+    "@fallow-cli/win32-arm64-msvc": "3.4.2",
+    "@fallow-cli/win32-x64-msvc": "3.4.2"
   }
 }

package/schema.json

@@ -4,7 +4,7 @@
   "type": "object",
   "properties": {
     "$schema": {
-      "description": "A string pointing at fallow's JSON Schema URL, used only by editors for autocomplete and validation of the config file; it has no effect on analysis and is stripped before serialization (serde skip_serializing, writeOnly in the schema). Set it to `https://fallow.dev/schema.json` to get editor IntelliSense; any other value is ignored by fallow.",
+      "description": "A string pointing at fallow's JSON Schema URL, used only by editors for autocomplete and validation of the config file; it has no effect on analysis and is stripped before serialization (serde skip_serializing, writeOnly in the schema). Set it to `./node_modules/fallow/schema.json` for npm installs (version-aligned, offline, avoids VS Code's untrusted-remote-schema prompt), or `https://raw.githubusercontent.com/fallow-rs/fallow/main/schema.json` for non-npm installs; any other value is ignored by fallow.",
       "type": [
         "string",
         "null"

package/skills/fallow/SKILL.md

@@ -106,11 +106,13 @@ Route by intent before reaching for the big analysis commands. Same matrix as `f
 | `dupes` | Code duplication detection | `--mode`, `--threshold`, `--top`, `--changed-since`, `--workspace`, `--changed-workspaces`, `--skip-local`, `--cross-language`, `--ignore-imports`, `--no-ignore-imports`, `--explain-skipped`, `--fail-on-regression`, `--tolerance`, `--regression-baseline`, `--save-regression-baseline` |
 | `health` | Function complexity analysis (also covers Angular templates as synthetic `<template>` findings: external `.html` files via `templateUrl` AND inline `@Component({ template: \`...\` })` literals; suppress external with `<!-- fallow-ignore-file complexity -->` at the top of the `.html` file, suppress inline with `// fallow-ignore-next-line complexity` directly above the `@Component` decorator) | `--complexity`, `--max-cyclomatic`, `--max-cognitive`, `--max-crap`, `--top`, `--sort`, `--file-scores`, `--hotspots`, `--ownership`, `--ownership-emails`, `--targets`, `--effort`, `--score`, `--min-score`, `--since`, `--min-commits`, `--save-snapshot`, `--trend`, `--coverage-gaps`, `--coverage`, `--coverage-root`, `--runtime-coverage`, `--min-invocations-hot`, `--min-observation-volume`, `--low-traffic-threshold`, `--css`, `--complexity-breakdown`, `--min-severity`, `--report-only`, `--workspace`, `--changed-workspaces`, `--baseline`, `--save-baseline` |
 | `flags` | Detect feature flag patterns (env vars, SDK calls, config objects) | `--top` |
+| `suppressions` | List active fallow-ignore suppression markers (read-only inventory) | `--file` |
 | `explain` | Explain one issue type without running analysis | `<issue-type>`, `--format json` |
 | `audit` | Combined dead-code + complexity + duplication + styling for changed files, returns a verdict; `fallow review` is an alias for `fallow audit --brief` (advisory orientation brief, always exits 0) | `--base`, `--gate`, `--brief`, `--max-decisions`, `--walkthrough-guide`, `--walkthrough-file`, `--show-deprioritized`, `--production`, `--production-dead-code`, `--production-health`, `--production-dupes`, `--workspace`, `--changed-workspaces`, `--ci`, `--fail-on-issues`, `--explain`, `--explain-skipped`, `--dead-code-baseline`, `--health-baseline`, `--dupes-baseline`, `--max-crap`, `--coverage`, `--coverage-root`, `--no-css`, `--css-deep`, `--no-css-deep`, `--include-entry-exports` |
 | `decision-surface` | Surface the consequential structural DECISIONS a change embeds (the apex of the review brief), each framed as a judgment question with the routed expert to ask | `--max-decisions` |
 | `impact` | Show what fallow has done for you: how many issues it is surfacing, the trend since the last recorded run, and how many commits it contained at the pre-commit gate | `--all`, `--sort`, `--limit` |
 | `security` | Surface opt-in local security candidates for agent verification (not confirmed vulnerabilities). Rule families include the graph rule `client-server-leak`, a data-driven `tainted-sink` catalogue, and the include-required `hardcoded-secret` category for provider-prefix credentials and high-entropy literals assigned to secret-shaped identifiers. Most catalogue rows require non-literal input; narrowly literal-aware rows flag deterministic unsafe literals. Rules default off; suppress a file with `// fallow-ignore-file security-sink`; scope categories with `security.categories`. Add project-local request object names with `security.requestReceivers`; it extends the built-in `req` / `request` / `ctx` / `context` / `event` allowlist for HTTP `query`, `params`, and `body` reads. `hardcoded-secret` runs only when listed in `security.categories.include`. | `--format human\|json\|sarif`, `--changed-since`, `--file`, `--diff-file`, `--workspace`, `--changed-workspaces`, `--surface`, `--ci`, `--fail-on-issues`, `--sarif-file`, `--summary` |
+| `report` | Render a saved `--format json` results file in another format without re-running analysis (analyze once, render annotations and the job summary from the same file). | `--from` |
 | `schema` | Dump CLI definition as JSON |  |
 | `ci-template` | Print or vendor CI integration templates |  |
 | `migrate` | Convert knip/jscpd config | `--dry-run`, `--from PATH` |

package/skills/fallow/references/cli-reference.md

@@ -509,7 +509,7 @@ fallow health --format json --quiet --trend
 {
   "kind": "health",
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.4.2",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -907,7 +907,7 @@ fallow audit \
 {
   "kind": "audit",
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.4.2",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -982,7 +982,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.4.2",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1083,7 +1083,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.3.0",
+  "version": "3.4.2",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1112,7 +1112,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.3.0",
+  "version": "3.4.2",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1632,7 +1632,8 @@ Available on all commands:
 |---|---|---|---|
 | `-r, --root` | `string` | - | Project root directory |
 | `-c, --config` | `string` | - | Config file path |
-| `-f, --format` | `human\|json\|sarif\|compact\|markdown\|codeclimate\|pr-comment-github\|pr-comment-gitlab\|review-github\|review-gitlab\|badge` | `human` | Output format (alias: --output) |
+| `--allow-remote-extends` | `bool` | `false` | Allow trusted config files to extend HTTPS URLs |
+| `-f, --format` | `human\|json\|sarif\|compact\|markdown\|codeclimate\|pr-comment-github\|pr-comment-gitlab\|review-github\|review-gitlab\|badge\|github-annotations\|github-summary` | `human` | Output format (alias: --output) |
 | `-q, --quiet` | `bool` | `false` | Suppress progress output |
 | `--no-cache` | `bool` | `false` | Disable incremental caching |
 | `--threads` | `string` | - | Number of parser threads |
@@ -1660,6 +1661,7 @@ Available on all commands:
 | `--fail-on-issues` | `bool` | `false` | Exit 1 if any issues found (promotes `warn` to `error`) |
 | `--sarif-file` | `string` | - | Write SARIF output to a file instead of stdout |
 | `-o, --output-file` | `string` | - | Write the report to a file instead of stdout, for any --format (no ANSI codes). Useful on large projects where the terminal scrollback truncates the top. Progress and the confirmation stay on stderr |
+| `--report-path-prefix` | `string` | - | Prefix prepended to every path in the CI-facing formats (`github-annotations`, `github-summary`, `codeclimate`, `review-github`, `review-gitlab`). CI platforms address files by repository-root-relative path, so when the analyzed project lives in a subdirectory (e.g. `packages/app/`), paths need that offset. fallow detects the offset via the git toplevel automatically; this flag overrides the detection. Pass an empty string to disable rebasing and emit paths relative to `--root` |
 | `--fail-on-regression` | `bool` | `false` | Fail if issue count increased beyond tolerance vs a regression baseline |
 | `--tolerance` | `string` | `0` | Allowed increase: `"2%"` (percentage) or `"5"` (absolute). Default: `"0"` |
 | `--regression-baseline` | `string` | - | Path to regression baseline file (default: `.fallow/regression-baseline.json`) |
@@ -1831,7 +1833,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 {
   "kind": "dead-code",
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.4.2",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1991,7 +1993,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 {
   "kind": "dupes",
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.4.2",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -2035,11 +2037,11 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "kind": "combined",
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.4.2",
   "elapsed_ms": 159,
   "check": {
     "schema_version": 7,
-    "version": "3.3.0",
+    "version": "3.4.2",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],

package/skills/fallow/references/mcp.md

@@ -34,6 +34,7 @@ When using fallow via MCP (`fallow-mcp`), the following tools are available:
 | `recommend` | introspection | free | `fallow recommend --format json --quiet` | `root` | Recommend a project-tailored config from framework/workspace/tooling detection: a loader-validated proposed_config and three-valued auto/default/taste decisions for cold-start onboarding |
 | `list_boundaries` | introspection | free | `fallow list --boundaries --format json --quiet` | - | Architecture boundary zones, access rules, and pre-expansion `autoDiscover` `logical_groups[]` (user-authored parent name, verbatim paths, discovered children, `status` enum, summed `file_count`). Returns `{"configured": false}` if no boundaries configured |
 | `feature_flags` | analysis | free | `fallow flags --format json --quiet` | `workspace`, `production` | Detect feature flag patterns (env vars, SDK calls, config objects). Set `top` to limit results |
+| `list_suppressions` | analysis | free | `fallow suppressions --format json --quiet` | `workspace`, `changed_since`, `file` | List active fallow-ignore suppression markers grouped per file (line, kind, level, reason, and a stale cross-reference); a read-only governance inventory that always exits 0 |
 | `impact` | introspection | free | `fallow impact --format json --quiet` | `root` | Read the local, opt-in Fallow Impact value report (`fallow impact --format json`). Runs no analysis: current surfacing counts, trend since the last recorded run, pre-commit gate containment, and (on impact v1.5+) resolved/suppressed attribution. History is read from a per-project file in the user's private config dir (never inside the repo). Read-only and `root`-only; the mutating `enable` / `disable` / `default` lifecycle is not exposed. A never-enabled project returns a populated `{"enabled": false, ...}` report (never `{}`); branch on `enabled` and `enabled_source` (`project` / `user` / `default`) then `record_count`, recommending `fallow impact enable` only when `explicit_decision` is `false` (never asked) and staying silent when `true` (deliberately disabled here). Local-developer signal: fallow never records in CI, so empty there and not a CI metric |
 | `impact_all` | introspection | free | `fallow impact --all --format json --quiet` | `sort`, `limit` | Roll every tracked fallow project on this machine into one cross-repo value report (hashed keys plus basename labels, never paths; local-dev only) |
 | `trace_export` | trace | free | `fallow dead-code --trace <file:export> --format json --quiet` | `file`, `export_name` | Trace why an export is used or unused (`fallow dead-code --trace FILE:EXPORT_NAME --format json`). Required `file` and `export_name`. Returns file reachability, entry-point status, direct references, re-export chains, and a reason string. If `export_name` is a class / enum / store MEMBER, returns a member trace instead (`member_name`, `member_kind`, `owner_export`, `owner_is_used`) plus a `--unused-<kind>-members` pointer; branch on field presence. Use before deleting a supposedly-unused export or debugging an unused-class-member finding |

package/types/output-contract.d.ts

@@ -24,7 +24,7 @@
 
 
 /**
- * Schemas for the JSON output of fallow commands. Object-shaped envelopes covered by the `FallowOutput` contract carry a top-level `kind` discriminator. Current kind values: `audit`, `explain`, `inspect_target`, `trace`, `review-envelope`, `review-reconcile`, `coverage-setup`, `coverage-analyze`, `list-boundaries`, `list-workspaces`, `health`, `dupes`, `dead-code-grouped`, `impact`, `impact-cross-repo`, `security`, `security-survivors`, `security-blind-spots`, `dead-code`, `combined`, `feature-flags`, `audit-brief`, `decision-surface`, `review-walkthrough-guide`, `review-walkthrough-validation`. Consumers should branch on `kind` instead of probing for unique field presence. `CodeClimateOutput` is a bare JSON array (per the Code Climate / GitLab Code Quality spec) and stays a sibling root branch discriminated by checking whether the document root is an array.
+ * Schemas for the JSON output of fallow commands. Object-shaped envelopes covered by the `FallowOutput` contract carry a top-level `kind` discriminator. Current kind values: `audit`, `explain`, `inspect_target`, `trace`, `review-envelope`, `review-reconcile`, `coverage-setup`, `coverage-analyze`, `list-boundaries`, `list-workspaces`, `health`, `dupes`, `dead-code-grouped`, `impact`, `impact-cross-repo`, `security`, `security-survivors`, `security-blind-spots`, `dead-code`, `combined`, `feature-flags`, `audit-brief`, `decision-surface`, `review-walkthrough-guide`, `review-walkthrough-validation`, `suppression-inventory`. Consumers should branch on `kind` instead of probing for unique field presence. `CodeClimateOutput` is a bare JSON array (per the Code Climate / GitLab Code Quality spec) and stays a sibling root branch discriminated by checking whether the document root is an array.
  */
 export type FallowJsonOutput = (FallowOutput | CodeClimateOutput)
 /**
@@ -94,6 +94,8 @@ kind: "decision-surface"
 kind: "review-walkthrough-guide"
 }) | (WalkthroughValidation & {
 kind: "review-walkthrough-validation"
+}) | (SuppressionInventoryOutput & {
+kind: "suppression-inventory"
 }))
 /**
  * Schema version for this output format (independent of tool version). Bump
@@ -375,6 +377,12 @@ kind: "skipped-large-file"
  */
 size_bytes: number
 kind: "skipped-minified-file"
+} | {
+/**
+ * Filesystem or UTF-8 decoding error from `read_to_string`.
+ */
+error: string
+kind: "source-read-failure"
 })
 /**
  * Discriminant for [`CloneGroupAction::kind`]. Mirrors the action types
@@ -871,6 +879,19 @@ export type DecisionSurfaceSchemaVersion = number
  * The discriminated action kinds a decision can carry.
  */
 export type DecisionActionType = ("ask-expert" | "suppress")
+/**
+ * The `fallow suppressions --format json` schema version. Independently
+ * versioned from the main contract, mirroring `SecuritySchemaVersion`.
+ */
+export type SuppressionInventorySchemaVersion = "1"
+/**
+ * Suppression marker scope.
+ */
+export type SuppressionInventoryLevel = ("file" | "line")
+/**
+ * How a suppression in the inventory was authored.
+ */
+export type SuppressionInventoryOrigin = "comment"
 /**
  * Discriminator value for [`CodeClimateIssue::kind`].
  */
@@ -7939,6 +7960,11 @@ grouped_by: GroupByMode
 total_issues: number
 groups: CheckGroupedEntry[]
 _meta?: (Meta | null)
+/**
+ * Diagnostics collected for the full analysis before issue grouping.
+ * See [`CheckOutput::workspace_diagnostics`] for the contract.
+ */
+workspace_diagnostics?: WorkspaceDiagnostic[]
 /**
  * Read-only follow-up commands computed from the full (ungrouped) findings.
  * See [`CheckOutput::next_steps`] for the contract.
@@ -10135,6 +10161,106 @@ change_anchor: string
  */
 reason: string
 }
+/**
+ * The `fallow suppressions --format json` envelope. `FallowOutput`
+ * discriminates it by the `kind: "suppression-inventory"` tag.
+ *
+ * A read-only projection over the suppression markers present in analyzed
+ * files this run: nothing here is a finding, and the command that emits it
+ * always exits 0.
+ */
+export interface SuppressionInventoryOutput {
+schema_version: SuppressionInventorySchemaVersion
+summary: SuppressionInventorySummary
+/**
+ * Per-file suppression listings, sorted by path then line.
+ */
+files: SuppressionInventoryFile[]
+}
+/**
+ * Project-level totals for the suppression inventory.
+ */
+export interface SuppressionInventorySummary {
+/**
+ * Total suppression markers in scope.
+ */
+total: number
+/**
+ * Number of files carrying at least one marker.
+ */
+files: number
+/**
+ * Markers without a human-authored `--` reason.
+ */
+without_reason: number
+/**
+ * Markers that also appear as stale-suppression findings this run. This
+ * is a JOIN against the existing stale-suppression detector's output
+ * (matched by file and kind), not a new detection.
+ */
+stale: number
+/**
+ * Marker counts per suppressed kind, sorted by count (descending) then
+ * kind. `kind` is `null` for blanket markers, mirroring the per-entry
+ * contract.
+ */
+by_kind: SuppressionKindCount[]
+}
+/**
+ * One `by_kind` row in the suppression inventory summary.
+ */
+export interface SuppressionKindCount {
+/**
+ * The suppressed issue kind in kebab-case, or `null` for blanket markers
+ * (rendered as "blanket" in human output; machine consumers branch on
+ * `null`).
+ */
+kind?: (string | null)
+/**
+ * Number of markers targeting this kind.
+ */
+count: number
+}
+/**
+ * One file's suppression listing.
+ */
+export interface SuppressionInventoryFile {
+/**
+ * Project-root-relative path, forward-slash separated.
+ */
+path: string
+/**
+ * Markers in this file, sorted by line.
+ */
+suppressions: SuppressionInventoryEntry[]
+}
+/**
+ * One suppression marker in the inventory.
+ */
+export interface SuppressionInventoryEntry {
+/**
+ * 1-based line of the suppression comment itself; 0 only if unknown.
+ */
+line: number
+/**
+ * The suppressed issue kind in kebab-case (e.g. `"unused-export"`), or
+ * `null` for a blanket marker that suppresses every kind on its target.
+ * Human output renders the blanket case as the literal word "blanket";
+ * the JSON contract deliberately keeps `null` so machine consumers
+ * branch on `null` instead of a magic string.
+ */
+kind?: (string | null)
+level: SuppressionInventoryLevel
+origin: SuppressionInventoryOrigin
+/**
+ * Human-authored reason after `--`; `null` when absent.
+ */
+reason?: (string | null)
+/**
+ * Whether a human-authored reason is present.
+ */
+reason_present: boolean
+}
 /**
  * Single CodeClimate-compatible issue inside [`CodeClimateOutput`].
  */