fallow 3.30.0 → 3.31.0

package/types/output-contract.d.ts

@@ -315,7 +315,7 @@ export type AuditIntroduced = boolean
  * commands differ: the `fallow audit` `new-only` gate fails only on introduced
  * findings, so an inherited `error` finding does not fail the audit, and the
  * combined command (`fallow` without a subcommand) exits 0 for machine
- * formats.
+ * formats unless `--fail-on-issues` or `--ci` is set.
  *
  * Complexity findings carry the same type. The `complexity-cyclomatic`,
  * `complexity-cognitive` and `complexity-crap` rules set it, and the
@@ -460,7 +460,15 @@ export type BaselineStalenessAdvisory = ("none" | "zero-overlap" | "partial")
  * `--workspace` and `--changed-workspaces` for the same reason. A consumer
  * must therefore not assume a given command emits a given name.
  */
-export type ScopeReason = ("diff" | "changed-since" | "changed-files" | "workspace" | "changed-workspaces" | "scope" | "file" | "issue-type-filter" | "production")
+export type ScopeReason = ("diff" | "changed-since" | "package-baselines" | "changed-files" | "workspace" | "changed-workspaces" | "scope" | "file" | "issue-type-filter" | "production" | "include-entry-exports")
+/**
+ * One reason why a missing id does not prove that the finding is gone.
+ *
+ * Serialized as kebab-case inside `inconclusive_reasons`. The set is OPEN: a
+ * name this build does not emit means "some reason", not an error, and the
+ * query stays inconclusive.
+ */
+export type FindingIdQueryReason = ("diff" | "changed-since" | "package-baselines" | "changed-files" | "workspace" | "changed-workspaces" | "scope" | "file" | "issue-type-filter" | "production" | "include-entry-exports" | "baseline" | "rule-off" | "filtered")
 /**
  * Status of a regression-check pass.
  */
@@ -740,6 +748,18 @@ kind: "flag-age-shallow-clone"
  */
 cause: string
 kind: "flag-age-unavailable"
+} | {
+/**
+ * The `ignoreDependencies` entry, as written in the config.
+ */
+pattern: string
+kind: "ignore-dependencies-glob-unmatched"
+} | {
+/**
+ * The `ignoreFindings` entry, as written in the config.
+ */
+pattern: string
+kind: "ignore-findings-pattern-unmatched"
 })
 /**
  * Discriminant for [`CloneGroupAction::kind`]. Mirrors the action types
@@ -1667,7 +1687,7 @@ duplication_demoted: number
  * gate and leaves the object absent.
  *
  * The names this build can emit are `error-severity-findings`, `regression`,
- * `stale-baseline`, `duplication-threshold`, `health-min-score`,
+ * `stale-baseline`, `baseline-growth`, `duplication-threshold`, `health-min-score`,
  * `health-min-severity`, `health-findings`, `health-coverage-gaps`,
  * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`,
  * `type-aware-require` and `parse-error`. The set is OPEN: a name a consumer does not
@@ -1699,7 +1719,7 @@ status: GateStatus
  * True when a `fail` from this gate makes the run exit non-zero. False
  * when the verdict is published for information only: the gate was never
  * armed, the run was told never to fail, or the combined machine formats
- * exit 0 for the gate.
+ * exit 0 for the gate (bare `fallow` without `--fail-on-issues`).
  */
 enforced: boolean
 /**
@@ -2818,6 +2838,12 @@ circular_dependencies: CircularDependencyFinding[]
  * suppression breaks the cycle).
  */
 re_export_cycles?: ReExportCycleFinding[]
+/**
+ * Dependency cycles between workspace packages, built from resolved
+ * cross-package imports. Wrapped in [`PackageCycleFinding`] so each
+ * entry carries a typed `actions` array natively.
+ */
+package_cycles?: PackageCycleFinding[]
 /**
  * Imports that cross architecture boundary rules. Wrapped in
  * [`BoundaryViolationFinding`] so each entry carries a typed `actions`
@@ -3046,6 +3072,14 @@ baseline?: (BaselineMatch | null)
  * can report `matched_entries: 0` on a healthy baseline.
  */
 baseline_staleness?: (BaselineStaleness | null)
+/**
+ * The answer to `--finding-id`, present only when the run received one
+ * or more `--finding-id` values. The report then holds only the
+ * requested findings. Read `missing` as resolved only when `conclusive`
+ * is true; a scope, a baseline or a filter can hide a finding that still
+ * exists. See [`crate::FindingIdQuery`].
+ */
+finding_id_query?: (FindingIdQuery | null)
 /**
  * Regression verdict against the baseline, in `--fail-on-regression` runs.
  */
@@ -3070,6 +3104,11 @@ gate_outcomes?: (GateOutcomes | null)
  * never "nothing failed". See [`crate::RequestOutcomes`].
  */
 request_outcomes?: (RequestOutcomes | null)
+/**
+ * Applied Git refs for exact workspace packages. Absent when no package
+ * baselines were selected, including runs with a global changed-since ref.
+ */
+package_baselines?: PackageBaselineStatus[]
 /**
  * `_meta` block with docs and rule definitions, when `--explain` was
  * passed.
@@ -3090,7 +3129,10 @@ _meta?: (Meta | null)
  *   detectors: `malformed-pnpm-workspace-yaml`,
  *   `bun-lockb-override-resolution-skipped`;
  * - framework plugins, while they read their own build configs:
- *   `plugin-config-unreadable`, `plugin-effect-not-modeled`.
+ *   `plugin-config-unreadable`, `plugin-effect-not-modeled`;
+ * - the dead-code result, for config patterns that matched nothing:
+ *   `ignore-dependencies-glob-unmatched`,
+ *   `ignore-findings-pattern-unmatched`.
  *
  * Analysis-stage and plugin-stage kinds therefore reach only the envelopes
  * whose run includes a dead-code analyze pass, never a standalone
@@ -3272,6 +3314,10 @@ circular_dependencies: number
  * re-exporting from each other in a loop).
  */
 re_export_cycles?: number
+/**
+ * Dependency cycles between workspace packages.
+ */
+package_cycles?: number
 /**
  * Imports that cross architecture boundary rules.
  */
@@ -3351,6 +3397,14 @@ export interface UnusedFileFinding {
  * Absolute path to the unused file.
  */
 path: string
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps: a `delete-file` primary and a `suppress-file`
  * secondary. Always emitted (possibly empty for forward-compat).
@@ -3582,6 +3636,14 @@ deprecated?: boolean
  * not deprecated or the tag carries no text.
  */
 deprecated_reason?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3657,6 +3719,14 @@ deprecated?: boolean
  * not deprecated or the tag carries no text.
  */
 deprecated_reason?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3722,6 +3792,14 @@ span_start: number
  * package-public leak across files or re-exports.
  */
 semantic?: (SemanticPrivateTypeLeak | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3794,6 +3872,14 @@ consumers: DeprecatedExportConsumer[]
  * are not visible, so the finding makes no removal claim.
  */
 public_api: boolean
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3856,6 +3942,14 @@ line: number
  * Workspace roots that import this package even though the declaring workspace does not.
  */
 used_in_workspaces?: string[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3909,6 +4003,14 @@ line: number
  * Workspace roots that import this package even though the declaring workspace does not.
  */
 used_in_workspaces?: string[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3962,6 +4064,14 @@ line: number
  * Workspace roots that import this package even though the declaring workspace does not.
  */
 used_in_workspaces?: string[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4015,6 +4125,14 @@ line: number
  * 0-based byte column offset.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4070,6 +4188,14 @@ line: number
  * 0-based byte column offset.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4134,6 +4260,14 @@ line: number
  * 0-based byte column offset.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4191,6 +4325,14 @@ col: number
  * Used by the LSP to underline just the specifier, not the entire import line.
  */
 specifier_col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4224,6 +4366,14 @@ package_name: string
  * Import sites where this unlisted dependency is used (file path, line, column).
  */
 imported_from: ImportSite[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4281,6 +4431,14 @@ export_name: string
  * Locations where this export name appears.
  */
 locations: DuplicateLocation[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4334,6 +4492,14 @@ path: string
  * 1-based line number of the dependency entry in package.json.
  */
 line: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4371,6 +4537,14 @@ path: string
  * 1-based line number of the dependency entry in package.json.
  */
 line: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4409,6 +4583,14 @@ path: string
  * 1-based line number of the dependency entry in package.json.
  */
 line: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4463,6 +4645,14 @@ edges?: CircularDependencyEdge[]
  * Whether this cycle crosses workspace package boundaries.
  */
 is_cross_package?: boolean
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4525,6 +4715,14 @@ export interface ReExportCycleFinding {
  */
 files: string[]
 kind: ReExportCycleKind
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4543,6 +4741,109 @@ introduced?: (AuditIntroduced | null)
  */
 effective_severity?: (EffectiveSeverity | null)
 }
+/**
+ * Wire-shape envelope for a [`PackageCycle`] finding. Mirrors
+ * [`CircularDependencyFinding`]: flattens the bare finding and carries a
+ * typed `actions` array (`refactor-cycle` primary plus `suppress-line`
+ * secondary).
+ */
+export interface PackageCycleFinding {
+/**
+ * Workspace package labels in cycle order. The first entry is the
+ * lexicographically smallest label; the last entry imports the first.
+ * A label is the package name. When two or more workspace packages
+ * share a name, the label is `name (root)` with the project-relative
+ * package root, so that each label names one package.
+ */
+packages: string[]
+/**
+ * Package root directories in cycle order: `package_roots[i]` is the
+ * root of `packages[i]`.
+ */
+package_roots: string[]
+/**
+ * Number of packages in the cycle.
+ */
+length: number
+/**
+ * One example import per hop, in cycle order: `edges[i]` goes from
+ * `packages[i]` to `packages[(i + 1) % length]`.
+ */
+edges: PackageCycleEdge[]
+/**
+ * True when the group of packages that holds this cycle has more
+ * cycles than fallow lists. The listing stops at 20 cycles per group,
+ * or earlier on a very dense package graph. Break a listed cycle and
+ * run again to see the rest.
+ */
+group_truncated: boolean
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
+}
+/**
+ * One package hop in a [`PackageCycle`]: `from_package` imports
+ * `to_package`, and `path` holds one example import for that hop.
+ *
+ * The example import is the first runtime import by `(path, line)`. When
+ * every import on the hop is type-only, it is the first type-only import.
+ */
+export interface PackageCycleEdge {
+/**
+ * Label of the importing workspace package, as in
+ * [`PackageCycle::packages`].
+ */
+from_package: string
+/**
+ * Label of the imported workspace package, as in
+ * [`PackageCycle::packages`].
+ */
+to_package: string
+/**
+ * File in `from_package` that holds the example import.
+ */
+path: string
+/**
+ * File in `to_package` that the example import resolves to.
+ */
+target_path: string
+/**
+ * 1-based line number of the example import.
+ */
+line: number
+/**
+ * 0-based byte column offset of the example import.
+ */
+col: number
+/**
+ * True when every import from `from_package` to `to_package` is
+ * type-only. A type-only hop has no runtime effect, but it can still
+ * force a build order (for example with declaration builds).
+ */
+type_only: boolean
+}
 /**
  * Wire-shape envelope for a [`BoundaryViolation`] finding. Mirrors
  * [`UnusedFileFinding`]: flattens the bare finding and carries a typed
@@ -4555,7 +4856,9 @@ export interface BoundaryViolationFinding {
  */
 from_path: string
 /**
- * The file being imported that violates the boundary.
+ * The file being imported that violates the boundary. When the import
+ * goes through a re-export chain, this is the origin module that
+ * declares the imported symbol, not the barrel.
  */
 to_path: string
 /**
@@ -4578,6 +4881,19 @@ line: number
  * 0-based byte column offset of the import statement.
  */
 col: number
+/**
+ * The barrel file that the source file imports directly, when the
+ * violation comes from a re-export chain. Absent for a direct import.
+ */
+via_path?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4614,6 +4930,14 @@ line: number
  * 0-based byte column offset used for diagnostics.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps.
  */
@@ -4662,6 +4986,14 @@ callee: string
  * consumers can see both the written path and the rule that fired.
  */
 pattern: string
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps.
  */
@@ -4719,6 +5051,14 @@ severity: PolicyViolationSeverity
  * The rule's author-provided message, when set.
  */
 message?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps.
  */
@@ -4751,6 +5091,14 @@ origin: SuppressionOrigin
  * comment or tag that has no reason.
  */
 missing_reason?: boolean
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted.
  */
@@ -4793,6 +5141,14 @@ line: number
  * output.
  */
 hardcoded_consumers?: string[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted.
  */
@@ -4828,6 +5184,14 @@ path: string
  * 1-based line number of the empty group header within the source file.
  */
 line: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted.
  */
@@ -4884,6 +5248,14 @@ line: number
  * catalog or to add the entry to the named catalog.
  */
 available_in_catalogs?: string[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted; position 0 is the discriminated
  * primary (see struct docs).
@@ -4954,6 +5326,14 @@ line: number
  * use the conservative package-manifest fallback.
  */
 hint?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted.
  */
@@ -5010,6 +5390,14 @@ path: string
  * 1-based line number of the entry within the source file.
  */
 line: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted.
  */
@@ -5057,6 +5445,14 @@ line: number
  * 0-based byte column offset of the export.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5105,6 +5501,14 @@ line: number
  * 0-based byte column offset of the barrel's first offending re-export.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5148,6 +5552,14 @@ line: number
  * 0-based byte column offset of the misplaced directive statement.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5193,6 +5605,14 @@ line: number
  * 0-based byte column offset of the inject / getContext call.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5249,6 +5669,14 @@ line: number
  * 0-based byte column offset.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5298,6 +5726,14 @@ line: number
  * 0-based byte column offset (file-level finding, always 0).
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5351,6 +5787,14 @@ line: number
  * 0-based byte column offset (file-level finding, always 0).
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5396,6 +5840,14 @@ line: number
  * 0-based byte column offset of the prop declaration.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5441,6 +5893,14 @@ line: number
  * 0-based byte column offset of the emit declaration.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5486,6 +5946,14 @@ line: number
  * 0-based byte column offset of the input declaration.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5531,6 +5999,14 @@ line: number
  * 0-based byte column offset of the output declaration.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5577,6 +6053,14 @@ line: number
  * 0-based byte column offset of the `dispatch('<name>')` call.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5618,6 +6102,14 @@ line: number
  * 0-based byte column offset of the export.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5665,6 +6157,14 @@ col: number
  * determinable.
  */
 route_dir?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5706,6 +6206,14 @@ depth: number
  * finding anchor is the first hop (`path` / `line` for suppression + CI).
  */
 hops: PropDrillHop[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5771,6 +6279,14 @@ component: string
  * at the render site).
  */
 child_component: string
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5829,6 +6345,14 @@ group_size: number
  * here, because the group is real regardless of suppression.
  */
 sharing_components: DuplicatePropShapeMember[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -6033,6 +6557,14 @@ unrecognised_format?: boolean
  * uses the same value for its stderr note.
  */
 saved_by?: string
+/**
+ * `legacy` when the loaded dead-code baseline has no `identity`, so its
+ * entries use the old key forms and some of them hold a line. The run
+ * still applies the file. `--save-baseline` rewrites it with line-free
+ * keys. Absent for a current baseline and on `dupes` and `health`. The
+ * value set is OPEN.
+ */
+format?: string
 /**
  * Which channels narrowed this run, present and non-empty exactly when
  * `change_scoped` is true. Both members are derived from one function, so
@@ -6050,6 +6582,75 @@ saved_by?: string
  */
 scope_reasons?: ScopeReason[]
 }
+/**
+ * The result of a `--finding-id` query, present only when the run received
+ * one or more `--finding-id` values.
+ *
+ * A requested id that is missing from a conclusive run means "fixed,
+ * suppressed, or ignored by config", never "unknown": an inline suppression
+ * comment or an `ignoreFindings` entry is a choice a person made to hide the
+ * finding, so it counts as absent. A missing id in a run that is not
+ * conclusive is unknown, never resolved.
+ *
+ * Every list keeps the order of `requested`. `found` and `missing` partition
+ * `requested`. `filtered` is a subset of `missing`.
+ */
+export interface FindingIdQuery {
+/**
+ * The requested ids, without duplicates, in the order of the arguments.
+ */
+requested: string[]
+/**
+ * The requested ids that this report contains.
+ */
+found: string[]
+/**
+ * The requested ids that this report does not contain. When `conclusive`
+ * is true, a missing id is fixed, suppressed, or ignored by config.
+ * Otherwise its state is unknown.
+ */
+missing: string[]
+/**
+ * The missing ids that the analysis still found before a filter of this
+ * run (scope, baseline, issue-type filter) removed them. Such a finding
+ * still exists.
+ */
+filtered: string[]
+/**
+ * True when no option of this run can hide a finding without a fix, and
+ * no requested id was filtered. Only then does a missing id mean that
+ * the analysis no longer reports the finding.
+ */
+conclusive: boolean
+/**
+ * Why the query is not conclusive, sorted. Empty exactly when
+ * `conclusive` is true.
+ */
+inconclusive_reasons: FindingIdQueryReason[]
+/**
+ * A stable hash (`af1:<16 hex digits>`) of every input other than the
+ * source code that decides which findings the run reports:
+ * - the fallow version;
+ * - the merged config after `extends` (without keys that only shape other
+ *   commands), the loaded external plugins and rule packs;
+ * - production mode, `includeEntryExports`, the effective rules, the
+ *   type-aware mode, requirement and project list, the file size limit;
+ * - the root-relative path and content of each repository `.gitignore`,
+ *   `.ignore` and `.git/info/exclude`, each `package.json`, each
+ *   `tsconfig*.json` and `jsconfig*.json` with the files its `extends`
+ *   names, and each file that matches a built-in or external plugin
+ *   config pattern (for example `vite.config.ts`).
+ *
+ * File content is normalized (CRLF to LF, trailing newlines removed).
+ * Known exclusions: the global git excludes file and other machine
+ * environment outside the `FALLOW_*` variables. Store the fingerprint
+ * with a verdict. A later query with another fingerprint is unknown, even
+ * when `conclusive` is true. An edit to a source file keeps it; an edit
+ * to a manifest or project config changes it, also when the edit fixes a
+ * dependency finding.
+ */
+analysis_fingerprint: string
+}
 /**
  * Result of regression detection (`--fail-on-regression`). Compares current
  * issue counts against a baseline from config or an explicit file.
@@ -6099,9 +6700,11 @@ reason?: (string | null)
  * empty object is never emitted: it would assert that something was asked and
  * all of it applied, which is a different and false claim.
  *
- * The names this build can emit are `changed-since`, `diff-filter` and
- * `sarif-file`. The reasons are `git-missing`, `not-a-repository`,
- * `git-failed` and `invalid-ref` for `changed-since`, `oversize`,
+ * The names this build can emit are `changed-since`, `diff-filter`,
+ * `package-baselines` and `sarif-file`. The reasons are `git-missing`,
+ * `not-a-repository`, `git-failed` and `invalid-ref` for `changed-since`,
+ * `unknown-workspace`, `git-missing`, `not-a-repository` and `git-failed`
+ * for `package-baselines`, `oversize`,
  * `unreadable`, `not-utf8`, `foreign-namespace` and `ambiguous-base` for
  * `diff-filter`, and `directory-create-failed`, `write-failed` and
  * `serialize-failed` for `sarif-file`. Every set is OPEN: a name a consumer
@@ -6117,8 +6720,9 @@ reason?: (string | null)
  * widened the analysis, which is what `affects` exists to prevent.
  *
  * `scope_size` is emitted for `diff-filter`, in added lines, and for
- * `changed-since`, in changed files that the run analyzed. `sarif-file`
- * measures no scope. A consumer reads the unit off the name, so a name that
+ * `changed-since`, in changed files that the run analyzed. `package-baselines`
+ * and `sarif-file` measure no scope; the applied package refs travel in
+ * `package_baselines`. A consumer reads the unit off the name, so a name that
  * starts to measure its own scope in a later release needs no change here.
  *
  * `invalid-ref` is reachable only through the programmatic API. The
@@ -6144,7 +6748,8 @@ affects: RequestEffect
  * `changed-since`, the diff source label (`--diff-file pr.diff`,
  * `--diff-stdin`, `$FALLOW_DIFF_FILE build/pr.diff`, or
  * `diffFile pr.diff` for the programmatic option) for `diff-filter`,
- * the target path for `sarif-file`. Echoed rather than normalised, so a
+ * `workspaces.changedSince` for `package-baselines`, the target path for
+ * `sarif-file`. Echoed rather than normalised, so a
  * consumer must not join it to the project root the way it joins every
  * other path-shaped field.
  */
@@ -6189,6 +6794,19 @@ reason?: (string | null)
  */
 message?: (string | null)
 }
+/**
+ * One applied baseline for an exact, project-relative workspace root.
+ */
+export interface PackageBaselineStatus {
+/**
+ * Workspace package root, relative to the analysis root with `/` separators.
+ */
+workspace_root: string
+/**
+ * Git ref used to select changed files in this package.
+ */
+reference: string
+}
 /**
  * A read-only follow-up command fallow surfaces from the current findings,
  * emitted as the top-level `next_steps` array on each command's JSON envelope.
@@ -11008,7 +11626,8 @@ type_only: boolean
 /**
  * Whether the edge carries a runtime value but no static one: the target
  * loads only on demand (`import()`, a lazy glob or template pattern) or
- * on another thread (a worker URL, `child_process.fork`). False for a
+ * on another thread (a worker URL, a worker loader request,
+ * `child_process.fork`). False for a
  * static hop and for a type-only hop.
  */
 dynamic: boolean
@@ -11351,6 +11970,13 @@ body: string
  * Stable finding fingerprint used for comment reconciliation.
  */
 fingerprint: string
+/**
+ * The fingerprint that an older Fallow release wrote into the
+ * `fallow-fingerprint:v2:` marker of this comment, when it is different
+ * from `fingerprint`. For one release, an existing comment whose marker
+ * holds this value is the same comment. Omitted when equal.
+ */
+legacy_fingerprint?: (string | null)
 /**
  * True when the body was cut to fit the provider size limit; omitted
  * when false.
@@ -11370,6 +11996,13 @@ position: GitLabReviewPosition
  * Stable finding fingerprint used for comment reconciliation.
  */
 fingerprint: string
+/**
+ * The fingerprint that an older Fallow release wrote into the
+ * `fallow-fingerprint:v2:` marker of this comment, when it is different
+ * from `fingerprint`. For one release, an existing comment whose marker
+ * holds this value is the same comment. Omitted when equal.
+ */
+legacy_fingerprint?: (string | null)
 /**
  * True when the body was cut to fit the provider size limit; omitted
  * when false.
@@ -12179,6 +12812,10 @@ gate_outcomes?: (GateOutcomes | null)
  * never "nothing failed". See [`crate::RequestOutcomes`].
  */
 request_outcomes?: (RequestOutcomes | null)
+/**
+ * Applied package Git refs, omitted outside package-baseline runs.
+ */
+package_baselines?: PackageBaselineStatus[]
 /**
  * `_meta` block with metric / rule definitions, emitted when `--explain`
  * is passed (always present in MCP responses).
@@ -12337,6 +12974,14 @@ total_issues: number
  * One bucket per resolver key.
  */
 groups: CheckGroupedEntry[]
+/**
+ * `true` when the `unused-load-data-key` detector abstained for the whole
+ * project. The abstain has no file, so it is on the root and not in a
+ * group. An empty `unused_load_data_keys` with this flag set does not
+ * mean the project is clean: the rule could not run safely. Serialized
+ * only when `true`, like the flat `CheckOutput` field.
+ */
+unused_load_data_keys_global_abstain?: boolean
 /**
  * This run's view of the loaded baseline, present only in baseline runs.
  * Carries the staleness counts, the advisory verdict and `gate_trips`, the
@@ -12346,6 +12991,14 @@ groups: CheckGroupedEntry[]
  * can report `matched_entries: 0` on a healthy baseline.
  */
 baseline_staleness?: (BaselineStaleness | null)
+/**
+ * The answer to `--finding-id`, present only when the run received one
+ * or more `--finding-id` values. The report then holds only the
+ * requested findings. Read `missing` as resolved only when `conclusive`
+ * is true; a scope, a baseline or a filter can hide a finding that still
+ * exists. See [`crate::FindingIdQuery`].
+ */
+finding_id_query?: (FindingIdQuery | null)
 /**
  * The verdict of every gate this run evaluated, keyed by name. The CLI
  * always emits it, with the command's default exit rule in it also when
@@ -12366,6 +13019,10 @@ gate_outcomes?: (GateOutcomes | null)
  * never "nothing failed". See [`crate::RequestOutcomes`].
  */
 request_outcomes?: (RequestOutcomes | null)
+/**
+ * Applied package Git refs, omitted outside package-baseline runs.
+ */
+package_baselines?: PackageBaselineStatus[]
 /**
  * `_meta` block with docs and rule definitions, when `--explain` was
  * passed.
@@ -12525,6 +13182,12 @@ circular_dependencies: CircularDependencyFinding[]
  * suppression breaks the cycle).
  */
 re_export_cycles?: ReExportCycleFinding[]
+/**
+ * Dependency cycles between workspace packages, built from resolved
+ * cross-package imports. Wrapped in [`PackageCycleFinding`] so each
+ * entry carries a typed `actions` array natively.
+ */
+package_cycles?: PackageCycleFinding[]
 /**
  * Imports that cross architecture boundary rules. Wrapped in
  * [`BoundaryViolationFinding`] so each entry carries a typed `actions`
@@ -13993,9 +14656,12 @@ elapsed_ms: ElapsedMs
 /**
  * The verdict of every gate this run evaluated, keyed by name. The CLI
  * always emits it, with the default exit rule of each section that ran
- * (`error-severity-findings`, `health-findings`). The machine formats of
- * the combined run exit 0 for findings, so most entries have `enforced:
- * false`. For the default exit rules (`error-severity-findings`,
+ * (`error-severity-findings`, `health-findings`). Without
+ * `--fail-on-issues` or `--ci`, the machine formats of the combined run
+ * exit 0 for findings, so most entries have `enforced: false`. With one of
+ * these flags, the findings rules and `duplication-threshold` are
+ * `enforced`, and every format exits 1 when one fails. For the default
+ * exit rules (`error-severity-findings`,
  * `health-findings`), `status` gives the verdict of the human run. An
  * advisory entry can report `fail` without a failure of the human run: an
  * example is a `stale-baseline` entry that `--fail-on-stale-baseline` did
@@ -14014,6 +14680,11 @@ gate_outcomes?: (GateOutcomes | null)
  * never "nothing failed". See [`crate::RequestOutcomes`].
  */
 request_outcomes?: (RequestOutcomes | null)
+/**
+ * Applied package Git refs of the `check` and `dupes` sections. The map
+ * does not narrow the `health` section.
+ */
+package_baselines?: PackageBaselineStatus[]
 /**
  * Per-section `_meta` blocks, when `--explain` was passed.
  */
@@ -16952,6 +17623,16 @@ export type EmptyCatalogGroup = EmptyCatalogGroupFinding;
  */
 export type MisconfiguredDependencyOverride = MisconfiguredDependencyOverrideFinding;
 
+/**
+ * Backwards-compat alias for the pre-#384 bare `PackageCycle` name.
+ * The wire shape is byte-identical: `PackageCycleFinding` flattens the bare
+ * finding's fields via `#[serde(flatten)]` and adds `actions[]` plus
+ * the optional audit-mode `introduced` flag. Consumers that imported
+ * `PackageCycle` from `fallow/types` pre-migration continue to work via
+ * this alias; new code should prefer `PackageCycleFinding`.
+ */
+export type PackageCycle = PackageCycleFinding;
+
 /**
  * Backwards-compat alias for the pre-#384 bare `PrivateTypeLeak` name.
  * The wire shape is byte-identical: `PrivateTypeLeakFinding` flattens the bare