fallow 3.30.0 → 3.32.0

package/types/output-contract.d.ts

@@ -112,7 +112,7 @@ kind: "similar-code-review"
 /**
  * Schema projection for the audit envelope's exact version.
  */
-export type AuditSchemaVersion = 11
+export type AuditSchemaVersion = 12
 /**
  * Fallow CLI version that produced this envelope. Renders to the JSON wire as
  * a bare string (e.g. `"2.74.0"`).
@@ -204,7 +204,7 @@ export type TypeAwareAbstentionReason = ("no-project" | "ambiguous-project" | "b
 /**
  * Schema projection for the dead-code envelope's exact version.
  */
-export type CheckSchemaVersion = 9
+export type CheckSchemaVersion = 10
 /**
  * A suggested action attached to a finding in the JSON output. Each finding
  * carries an `actions` array; consumers (agents, IDE clients, CI bots) can
@@ -261,7 +261,7 @@ export type IssueAction = (FixAction | SuppressLineAction | SuppressFileAction |
  * Discriminant string for [`FixAction`]. Kebab-case per the JSON output
  * contract.
  */
-export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "migrate-deprecated-export" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
+export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "migrate-deprecated-export" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "review-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
 /**
  * Singleton discriminant for [`SuppressLineAction`].
  */
@@ -315,7 +315,7 @@ export type AuditIntroduced = boolean
  * commands differ: the `fallow audit` `new-only` gate fails only on introduced
  * findings, so an inherited `error` finding does not fail the audit, and the
  * combined command (`fallow` without a subcommand) exits 0 for machine
- * formats.
+ * formats unless `--fail-on-issues` or `--ci` is set.
  *
  * Complexity findings carry the same type. The `complexity-cyclomatic`,
  * `complexity-cognitive` and `complexity-crap` rules set it, and the
@@ -380,7 +380,7 @@ export type ReExportCycleKind = ("multi-node" | "self-loop")
 /**
  * Which rule-pack rule kind produced a [`PolicyViolation`].
  */
-export type PolicyRuleKind = ("banned-call" | "banned-import" | "banned-effect" | "banned-export")
+export type PolicyRuleKind = ("banned-call" | "banned-import" | "banned-effect" | "banned-export" | "gdp-proof-producer")
 /**
  * Effective severity of a single [`PolicyViolation`]. Per-rule `severity`
  * overrides the `rules."policy-violation"` master; `off` rules emit nothing,
@@ -460,7 +460,15 @@ export type BaselineStalenessAdvisory = ("none" | "zero-overlap" | "partial")
  * `--workspace` and `--changed-workspaces` for the same reason. A consumer
  * must therefore not assume a given command emits a given name.
  */
-export type ScopeReason = ("diff" | "changed-since" | "changed-files" | "workspace" | "changed-workspaces" | "scope" | "file" | "issue-type-filter" | "production")
+export type ScopeReason = ("diff" | "changed-since" | "package-baselines" | "changed-files" | "workspace" | "changed-workspaces" | "scope" | "file" | "issue-type-filter" | "production" | "include-entry-exports")
+/**
+ * One reason why a missing id does not prove that the finding is gone.
+ *
+ * Serialized as kebab-case inside `inconclusive_reasons`. The set is OPEN: a
+ * name this build does not emit means "some reason", not an error, and the
+ * query stays inconclusive.
+ */
+export type FindingIdQueryReason = ("diff" | "changed-since" | "package-baselines" | "changed-files" | "workspace" | "changed-workspaces" | "scope" | "file" | "issue-type-filter" | "production" | "include-entry-exports" | "baseline" | "rule-off" | "filtered")
 /**
  * Status of a regression-check pass.
  */
@@ -554,7 +562,7 @@ kind: "malformed-tsconfig"
 kind: "tsconfig-reference-dir-missing"
 } | {
 /**
- * `serde_yaml_ng` parse error text.
+ * YAML parse error text.
  */
 error: string
 kind: "malformed-pnpm-workspace-yaml"
@@ -594,8 +602,15 @@ kind: "bun-lockb-override-resolution-skipped"
 } | {
 kind: "bun-lock-override-resolution-skipped"
 } | {
+kind: "pnpm-lock-override-resolution-skipped"
+} | {
+kind: "npm-lock-override-resolution-skipped"
+} | {
 kind: "bun-resolutions-shadowed-by-overrides"
 } | {
+cause: PnpmWorkspaceOverridesIgnoredCause
+kind: "pnpm-workspace-overrides-ignored"
+} | {
 kind: "node-modules-missing"
 } | {
 kind: "boundaries-not-configured"
@@ -682,6 +697,13 @@ kind: "ownership-unavailable"
 error: string
 kind: "trend-snapshot-unreadable"
 } | {
+/**
+ * Why the groups have no baseline, as a kebab-case token:
+ * `snapshot-has-no-groups` or `grouped-by-mismatch`. The set is open.
+ */
+cause: string
+kind: "trend-group-baseline-unavailable"
+} | {
 /**
  * The plugin that read the config, as it labels itself:
  * `module-federation` for a standalone `module-federation.config.*`,
@@ -740,7 +762,24 @@ kind: "flag-age-shallow-clone"
  */
 cause: string
 kind: "flag-age-unavailable"
+} | {
+/**
+ * The `ignoreDependencies` entry, as written in the config.
+ */
+pattern: string
+kind: "ignore-dependencies-glob-unmatched"
+} | {
+/**
+ * The `ignoreFindings` entry, as written in the config.
+ */
+pattern: string
+kind: "ignore-findings-pattern-unmatched"
 })
+/**
+ * Why the declared pnpm version ignores the `overrides` section of
+ * `pnpm-workspace.yaml`.
+ */
+export type PnpmWorkspaceOverridesIgnoredCause = ("package-json-overrides" | "pnpm-version")
 /**
  * Discriminant for [`CloneGroupAction::kind`]. Mirrors the action types
  * emitted by the legacy `build_clone_group_actions` walker.
@@ -819,6 +858,15 @@ export type CoverageInputFormat = ("istanbul" | "v8")
  * Whether CRAP findings in the report used one coverage-source kind or a mix.
  */
 export type CoverageSourceConsistency = ("uniform" | "mixed")
+/**
+ * One health section that a run produced.
+ *
+ * A section is in [`HealthReport::sections`] when the run computed it and
+ * the report carries its result, also when that result is empty. The value
+ * set is OPEN: a later release can add a section, so a consumer must accept
+ * a token that it does not know.
+ */
+export type HealthSection = ("complexity" | "vital-signs" | "score" | "file-scores" | "coverage-gaps" | "hotspots" | "targets" | "trend" | "runtime-coverage" | "css")
 /**
  * Lifecycle state for a configured threshold override.
  */
@@ -1182,6 +1230,12 @@ export type HealthSchemaVersion = 11
  * groups by GitLab CODEOWNERS `[Section]` header name.
  */
 export type GroupByMode = ("owner" | "directory" | "package" | "section")
+/**
+ * What the group trend compared, for one group.
+ *
+ * The value set is open: read an unknown value as "no trend for this group".
+ */
+export type GroupTrendStatus = ("compared" | "new_group" | "no_group_baseline")
 /**
  * Schema projection for the duplication envelope's CLI and programmatic
  * version lineages.
@@ -1298,7 +1352,7 @@ export type SecurityBlindSpotsSchemaVersion = "1"
 /**
  * Schema projection for the combined envelope's exact version.
  */
-export type CombinedSchemaVersion = 12
+export type CombinedSchemaVersion = 13
 /**
  * Schema projection for the feature-flags envelope's exact version.
  */
@@ -1343,7 +1397,7 @@ export type VendorFlagState = ("on" | "off" | "rolled_out" | "archived" | "exper
  * Independently-versioned wire-version newtype for the brief envelope.
  * Serializes as the integer `REVIEW_BRIEF_SCHEMA_VERSION`.
  */
-export type ReviewBriefSchemaVersion = 11
+export type ReviewBriefSchemaVersion = 12
 /**
  * The exactly-three shippable decision categories (the SOLID-3). No cut category
  * (abstraction / deletion / convention / irreversibility) is representable: this
@@ -1667,7 +1721,8 @@ duplication_demoted: number
  * gate and leaves the object absent.
  *
  * The names this build can emit are `error-severity-findings`, `regression`,
- * `stale-baseline`, `duplication-threshold`, `health-min-score`,
+ * `stale-baseline`, `baseline-growth`, `duplication-threshold`,
+ * `duplication-findings`, `health-min-score`,
  * `health-min-severity`, `health-findings`, `health-coverage-gaps`,
  * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`,
  * `type-aware-require` and `parse-error`. The set is OPEN: a name a consumer does not
@@ -1699,13 +1754,15 @@ status: GateStatus
  * True when a `fail` from this gate makes the run exit non-zero. False
  * when the verdict is published for information only: the gate was never
  * armed, the run was told never to fail, or the combined machine formats
- * exit 0 for the gate.
+ * exit 0 for the gate (bare `fallow` without `--fail-on-issues`).
  */
 enforced: boolean
 /**
  * The measured value the gate compared, when there is one: the duplication
  * percentage, the health score, the number of findings at or above the
- * severity floor, or the number of files in `files`. Whole numbers are
+ * severity floor, the number of `error` findings of `health-findings` and
+ * of `error-severity-findings`, or
+ * the number of files in `files`. Whole numbers are
  * carried as JSON numbers, so a count of three reads as `3.0`. Absent for
  * gates that compare no number.
  */
@@ -1718,7 +1775,9 @@ threshold?: (number | null)
 /**
  * How the limit was spelled, for a gate whose `threshold` number does not
  * carry its own unit. `health-min-severity` sets it to the severity floor
- * (`moderate`, `high` or `critical`); `regression` sets it to the
+ * (`moderate`, `high` or `critical`); `health-findings` and
+ * `error-severity-findings` set it to `error`, the rule severity they
+ * count; `regression` sets it to the
  * tolerance as the user wrote it (`"50%"` or `"5"`), because `threshold`
  * there is the allowance in issues and the percentage would otherwise be
  * unrecoverable on the grouped envelope, which carries no `regression`
@@ -2818,6 +2877,12 @@ circular_dependencies: CircularDependencyFinding[]
  * suppression breaks the cycle).
  */
 re_export_cycles?: ReExportCycleFinding[]
+/**
+ * Dependency cycles between workspace packages, built from resolved
+ * cross-package imports. Wrapped in [`PackageCycleFinding`] so each
+ * entry carries a typed `actions` array natively.
+ */
+package_cycles?: PackageCycleFinding[]
 /**
  * Imports that cross architecture boundary rules. Wrapped in
  * [`BoundaryViolationFinding`] so each entry carries a typed `actions`
@@ -2950,6 +3015,10 @@ dynamic_segment_name_conflicts?: DynamicSegmentNameConflictFinding[]
  * array natively. Default severity is `warn`.
  */
 unused_component_props?: UnusedComponentPropFinding[]
+/**
+ * Used optional component inputs absent from inspected reachable callers. Off by default.
+ */
+absent_component_props?: AbsentComponentPropFinding[]
 /**
  * Vue `<script setup>` `defineEmits` events emitted nowhere in their own SFC
  * (no `emit('<name>')` call). Wrapped in [`UnusedComponentEmitFinding`] so
@@ -3046,6 +3115,14 @@ baseline?: (BaselineMatch | null)
  * can report `matched_entries: 0` on a healthy baseline.
  */
 baseline_staleness?: (BaselineStaleness | null)
+/**
+ * The answer to `--finding-id`, present only when the run received one
+ * or more `--finding-id` values. The report then holds only the
+ * requested findings. Read `missing` as resolved only when `conclusive`
+ * is true; a scope, a baseline or a filter can hide a finding that still
+ * exists. See [`crate::FindingIdQuery`].
+ */
+finding_id_query?: (FindingIdQuery | null)
 /**
  * Regression verdict against the baseline, in `--fail-on-regression` runs.
  */
@@ -3070,6 +3147,11 @@ gate_outcomes?: (GateOutcomes | null)
  * never "nothing failed". See [`crate::RequestOutcomes`].
  */
 request_outcomes?: (RequestOutcomes | null)
+/**
+ * Applied Git refs for exact workspace packages. Absent when no package
+ * baselines were selected, including runs with a global changed-since ref.
+ */
+package_baselines?: PackageBaselineStatus[]
 /**
  * `_meta` block with docs and rule definitions, when `--explain` was
  * passed.
@@ -3090,7 +3172,10 @@ _meta?: (Meta | null)
  *   detectors: `malformed-pnpm-workspace-yaml`,
  *   `bun-lockb-override-resolution-skipped`;
  * - framework plugins, while they read their own build configs:
- *   `plugin-config-unreadable`, `plugin-effect-not-modeled`.
+ *   `plugin-config-unreadable`, `plugin-effect-not-modeled`;
+ * - the dead-code result, for config patterns that matched nothing:
+ *   `ignore-dependencies-glob-unmatched`,
+ *   `ignore-findings-pattern-unmatched`.
  *
  * Analysis-stage and plugin-stage kinds therefore reach only the envelopes
  * whose run includes a dead-code analyze pass, never a standalone
@@ -3210,6 +3295,10 @@ unrendered_components?: number
  * Vue, Svelte, or React props referenced nowhere inside their own component.
  */
 unused_component_props?: number
+/**
+ * Optional consumed props omitted by known reachable callers, for manual review.
+ */
+absent_component_props?: number
 /**
  * Vue `<script setup>` emits emitted nowhere inside their own SFC.
  */
@@ -3272,6 +3361,10 @@ circular_dependencies: number
  * re-exporting from each other in a loop).
  */
 re_export_cycles?: number
+/**
+ * Dependency cycles between workspace packages.
+ */
+package_cycles?: number
 /**
  * Imports that cross architecture boundary rules.
  */
@@ -3351,6 +3444,14 @@ export interface UnusedFileFinding {
  * Absolute path to the unused file.
  */
 path: string
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps: a `delete-file` primary and a `suppress-file`
  * secondary. Always emitted (possibly empty for forward-compat).
@@ -3582,6 +3683,14 @@ deprecated?: boolean
  * not deprecated or the tag carries no text.
  */
 deprecated_reason?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3657,6 +3766,14 @@ deprecated?: boolean
  * not deprecated or the tag carries no text.
  */
 deprecated_reason?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3722,6 +3839,14 @@ span_start: number
  * package-public leak across files or re-exports.
  */
 semantic?: (SemanticPrivateTypeLeak | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3794,6 +3919,14 @@ consumers: DeprecatedExportConsumer[]
  * are not visible, so the finding makes no removal claim.
  */
 public_api: boolean
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3856,6 +3989,20 @@ line: number
  * Workspace roots that import this package even though the declaring workspace does not.
  */
 used_in_workspaces?: string[]
+/**
+ * Workspace roots whose package.json declares this package for the files
+ * that import it. Only a root finding fills this field: these imports use
+ * the nearer workspace declaration, so the root declaration stays unused.
+ */
+declared_and_imported_in?: string[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3909,6 +4056,20 @@ line: number
  * Workspace roots that import this package even though the declaring workspace does not.
  */
 used_in_workspaces?: string[]
+/**
+ * Workspace roots whose package.json declares this package for the files
+ * that import it. Only a root finding fills this field: these imports use
+ * the nearer workspace declaration, so the root declaration stays unused.
+ */
+declared_and_imported_in?: string[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3962,6 +4123,20 @@ line: number
  * Workspace roots that import this package even though the declaring workspace does not.
  */
 used_in_workspaces?: string[]
+/**
+ * Workspace roots whose package.json declares this package for the files
+ * that import it. Only a root finding fills this field: these imports use
+ * the nearer workspace declaration, so the root declaration stays unused.
+ */
+declared_and_imported_in?: string[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4015,6 +4190,14 @@ line: number
  * 0-based byte column offset.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4070,6 +4253,14 @@ line: number
  * 0-based byte column offset.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4134,6 +4325,14 @@ line: number
  * 0-based byte column offset.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4191,6 +4390,14 @@ col: number
  * Used by the LSP to underline just the specifier, not the entire import line.
  */
 specifier_col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4224,6 +4431,14 @@ package_name: string
  * Import sites where this unlisted dependency is used (file path, line, column).
  */
 imported_from: ImportSite[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4281,6 +4496,14 @@ export_name: string
  * Locations where this export name appears.
  */
 locations: DuplicateLocation[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4334,6 +4557,14 @@ path: string
  * 1-based line number of the dependency entry in package.json.
  */
 line: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4371,6 +4602,14 @@ path: string
  * 1-based line number of the dependency entry in package.json.
  */
 line: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4409,6 +4648,14 @@ path: string
  * 1-based line number of the dependency entry in package.json.
  */
 line: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4463,6 +4710,14 @@ edges?: CircularDependencyEdge[]
  * Whether this cycle crosses workspace package boundaries.
  */
 is_cross_package?: boolean
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4525,6 +4780,14 @@ export interface ReExportCycleFinding {
  */
 files: string[]
 kind: ReExportCycleKind
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4543,6 +4806,109 @@ introduced?: (AuditIntroduced | null)
  */
 effective_severity?: (EffectiveSeverity | null)
 }
+/**
+ * Wire-shape envelope for a [`PackageCycle`] finding. Mirrors
+ * [`CircularDependencyFinding`]: flattens the bare finding and carries a
+ * typed `actions` array (`refactor-cycle` primary plus `suppress-line`
+ * secondary).
+ */
+export interface PackageCycleFinding {
+/**
+ * Workspace package labels in cycle order. The first entry is the
+ * lexicographically smallest label; the last entry imports the first.
+ * A label is the package name. When two or more workspace packages
+ * share a name, the label is `name (root)` with the project-relative
+ * package root, so that each label names one package.
+ */
+packages: string[]
+/**
+ * Package root directories in cycle order: `package_roots[i]` is the
+ * root of `packages[i]`.
+ */
+package_roots: string[]
+/**
+ * Number of packages in the cycle.
+ */
+length: number
+/**
+ * One example import per hop, in cycle order: `edges[i]` goes from
+ * `packages[i]` to `packages[(i + 1) % length]`.
+ */
+edges: PackageCycleEdge[]
+/**
+ * True when the group of packages that holds this cycle has more
+ * cycles than fallow lists. The listing stops at 20 cycles per group,
+ * or earlier on a very dense package graph. Break a listed cycle and
+ * run again to see the rest.
+ */
+group_truncated: boolean
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
+}
+/**
+ * One package hop in a [`PackageCycle`]: `from_package` imports
+ * `to_package`, and `path` holds one example import for that hop.
+ *
+ * The example import is the first runtime import by `(path, line)`. When
+ * every import on the hop is type-only, it is the first type-only import.
+ */
+export interface PackageCycleEdge {
+/**
+ * Label of the importing workspace package, as in
+ * [`PackageCycle::packages`].
+ */
+from_package: string
+/**
+ * Label of the imported workspace package, as in
+ * [`PackageCycle::packages`].
+ */
+to_package: string
+/**
+ * File in `from_package` that holds the example import.
+ */
+path: string
+/**
+ * File in `to_package` that the example import resolves to.
+ */
+target_path: string
+/**
+ * 1-based line number of the example import.
+ */
+line: number
+/**
+ * 0-based byte column offset of the example import.
+ */
+col: number
+/**
+ * True when every import from `from_package` to `to_package` is
+ * type-only. A type-only hop has no runtime effect, but it can still
+ * force a build order (for example with declaration builds).
+ */
+type_only: boolean
+}
 /**
  * Wire-shape envelope for a [`BoundaryViolation`] finding. Mirrors
  * [`UnusedFileFinding`]: flattens the bare finding and carries a typed
@@ -4555,7 +4921,9 @@ export interface BoundaryViolationFinding {
  */
 from_path: string
 /**
- * The file being imported that violates the boundary.
+ * The file being imported that violates the boundary. When the import
+ * goes through a re-export chain, this is the origin module that
+ * declares the imported symbol, not the barrel.
  */
 to_path: string
 /**
@@ -4578,6 +4946,19 @@ line: number
  * 0-based byte column offset of the import statement.
  */
 col: number
+/**
+ * The barrel file that the source file imports directly, when the
+ * violation comes from a re-export chain. Absent for a direct import.
+ */
+via_path?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -4614,6 +4995,14 @@ line: number
  * 0-based byte column offset used for diagnostics.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps.
  */
@@ -4662,6 +5051,14 @@ callee: string
  * consumers can see both the written path and the rule that fired.
  */
 pattern: string
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps.
  */
@@ -4711,7 +5108,8 @@ kind: PolicyRuleKind
  * What matched: the written callee path for `banned-call` (e.g.
  * `cp.exec`), the raw import specifier for `banned-import` (e.g.
  * `moment/locale/nl`), `<effect>: <callee>` for `banned-effect`, or the
- * exported name for `banned-export`.
+ * exported name for `banned-export`. For `gdp-proof-producer`, the canonical
+ * factory with its JSON-quoted literal label or `...` for a dynamic label.
  */
 matched: string
 severity: PolicyViolationSeverity
@@ -4719,6 +5117,14 @@ severity: PolicyViolationSeverity
  * The rule's author-provided message, when set.
  */
 message?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps.
  */
@@ -4751,6 +5157,14 @@ origin: SuppressionOrigin
  * comment or tag that has no reason.
  */
 missing_reason?: boolean
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted.
  */
@@ -4793,6 +5207,14 @@ line: number
  * output.
  */
 hardcoded_consumers?: string[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted.
  */
@@ -4828,6 +5250,14 @@ path: string
  * 1-based line number of the empty group header within the source file.
  */
 line: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted.
  */
@@ -4884,6 +5314,14 @@ line: number
  * catalog or to add the entry to the named catalog.
  */
 available_in_catalogs?: string[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted; position 0 is the discriminated
  * primary (see struct docs).
@@ -4954,6 +5392,14 @@ line: number
  * use the conservative package-manifest fallback.
  */
 hint?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted.
  */
@@ -5010,6 +5456,14 @@ path: string
  * 1-based line number of the entry within the source file.
  */
 line: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted.
  */
@@ -5057,6 +5511,14 @@ line: number
  * 0-based byte column offset of the export.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5105,6 +5567,14 @@ line: number
  * 0-based byte column offset of the barrel's first offending re-export.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5148,6 +5618,14 @@ line: number
  * 0-based byte column offset of the misplaced directive statement.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5193,6 +5671,14 @@ line: number
  * 0-based byte column offset of the inject / getContext call.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5249,6 +5735,14 @@ line: number
  * 0-based byte column offset.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5298,6 +5792,14 @@ line: number
  * 0-based byte column offset (file-level finding, always 0).
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5351,6 +5853,14 @@ line: number
  * 0-based byte column offset (file-level finding, always 0).
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5396,6 +5906,14 @@ line: number
  * 0-based byte column offset of the prop declaration.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5414,6 +5932,92 @@ introduced?: (AuditIntroduced | null)
  */
 effective_severity?: (EffectiveSeverity | null)
 }
+/**
+ * Wire-shape envelope for an [`AbsentComponentProp`] finding. There is no safe
+ * auto-fix: removing a declared prop is judgement-bearing (the prop may be part
+ * of a deliberately-stable public component API). Actions are manual
+ * remediation guidance plus a line-level suppress at the prop declaration.
+ */
+export interface AbsentComponentPropFinding {
+/**
+ * Source path of the input declaration.
+ */
+path: string
+/**
+ * Semantic declaration name, or SFC filename stem.
+ */
+component_name: string
+/**
+ * Public framework token.
+ */
+framework: string
+/**
+ * Public optional input name.
+ */
+prop_name: string
+/**
+ * 1-based declaration line.
+ */
+line: number
+/**
+ * 0-based declaration byte column.
+ */
+col: number
+/**
+ * Whether omission has a declared default.
+ */
+has_default: boolean
+/**
+ * Every inspected reachable caller, deterministically ordered.
+ */
+inspected_call_sites: ComponentPropCallSite[]
+/**
+ * Manual-review meaning and limits of static evidence.
+ */
+explanation: string
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
+}
+/**
+ * One inspected reachable component invocation.
+ */
+export interface ComponentPropCallSite {
+/**
+ * Caller source path.
+ */
+path: string
+/**
+ * 1-based opening-tag line.
+ */
+line: number
+/**
+ * 0-based original-source byte column.
+ */
+col: number
+}
 /**
  * Wire-shape envelope for an [`UnusedComponentEmit`] finding. There is no safe
  * auto-fix: removing a declared emit is judgement-bearing (the event may be
@@ -5441,6 +6045,14 @@ line: number
  * 0-based byte column offset of the emit declaration.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5486,6 +6098,14 @@ line: number
  * 0-based byte column offset of the input declaration.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5531,6 +6151,14 @@ line: number
  * 0-based byte column offset of the output declaration.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5577,6 +6205,14 @@ line: number
  * 0-based byte column offset of the `dispatch('<name>')` call.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5618,6 +6254,14 @@ line: number
  * 0-based byte column offset of the export.
  */
 col: number
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5665,6 +6309,14 @@ col: number
  * determinable.
  */
 route_dir?: (string | null)
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5706,6 +6358,14 @@ depth: number
  * finding anchor is the first hop (`path` / `line` for suppression + CI).
  */
 hops: PropDrillHop[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5771,6 +6431,14 @@ component: string
  * at the render site).
  */
 child_component: string
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5829,6 +6497,14 @@ group_size: number
  * here, because the group is real regardless of suppression.
  */
 sharing_components: DuplicatePropShapeMember[]
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -5962,6 +6638,18 @@ stale_entries: number
  * when every entry went unmatched.
  */
 current_findings: number
+/**
+ * Health only: the number of functions above a complexity threshold that
+ * the baseline does not accept. This is a count of functions, like
+ * `summary.functions_above_threshold`, not a count of baseline entries,
+ * and it is the value before `--top`. A run that does not list the
+ * complexity findings (for example `--score`) still reports it, so a
+ * reader can tell the new functions from the accepted ones.
+ *
+ * `dead-code` and `dupes` do not emit it. An envelope from a fallow
+ * version before this member does not carry it either.
+ */
+remaining_findings?: (number | null)
 /**
  * True when this run analyzed only part of the project, so a whole-project
  * baseline matches less of it for reasons that are not rot. The channels
@@ -6033,6 +6721,14 @@ unrecognised_format?: boolean
  * uses the same value for its stderr note.
  */
 saved_by?: string
+/**
+ * `legacy` when the loaded dead-code baseline has no `identity`, so its
+ * entries use the old key forms and some of them hold a line. The run
+ * still applies the file. `--save-baseline` rewrites it with line-free
+ * keys. Absent for a current baseline and on `dupes` and `health`. The
+ * value set is OPEN.
+ */
+format?: string
 /**
  * Which channels narrowed this run, present and non-empty exactly when
  * `change_scoped` is true. Both members are derived from one function, so
@@ -6050,6 +6746,75 @@ saved_by?: string
  */
 scope_reasons?: ScopeReason[]
 }
+/**
+ * The result of a `--finding-id` query, present only when the run received
+ * one or more `--finding-id` values.
+ *
+ * A requested id that is missing from a conclusive run means "fixed,
+ * suppressed, or ignored by config", never "unknown": an inline suppression
+ * comment or an `ignoreFindings` entry is a choice a person made to hide the
+ * finding, so it counts as absent. A missing id in a run that is not
+ * conclusive is unknown, never resolved.
+ *
+ * Every list keeps the order of `requested`. `found` and `missing` partition
+ * `requested`. `filtered` is a subset of `missing`.
+ */
+export interface FindingIdQuery {
+/**
+ * The requested ids, without duplicates, in the order of the arguments.
+ */
+requested: string[]
+/**
+ * The requested ids that this report contains.
+ */
+found: string[]
+/**
+ * The requested ids that this report does not contain. When `conclusive`
+ * is true, a missing id is fixed, suppressed, or ignored by config.
+ * Otherwise its state is unknown.
+ */
+missing: string[]
+/**
+ * The missing ids that the analysis still found before a filter of this
+ * run (scope, baseline, issue-type filter) removed them. Such a finding
+ * still exists.
+ */
+filtered: string[]
+/**
+ * True when no option of this run can hide a finding without a fix, and
+ * no requested id was filtered. Only then does a missing id mean that
+ * the analysis no longer reports the finding.
+ */
+conclusive: boolean
+/**
+ * Why the query is not conclusive, sorted. Empty exactly when
+ * `conclusive` is true.
+ */
+inconclusive_reasons: FindingIdQueryReason[]
+/**
+ * A stable hash (`af1:<16 hex digits>`) of every input other than the
+ * source code that decides which findings the run reports:
+ * - the fallow version;
+ * - the merged config after `extends` (without keys that only shape other
+ *   commands), the loaded external plugins and rule packs;
+ * - production mode, `includeEntryExports`, the effective rules, the
+ *   type-aware mode, requirement and project list, the file size limit;
+ * - the root-relative path and content of each repository `.gitignore`,
+ *   `.ignore` and `.git/info/exclude`, each `package.json`, each
+ *   `tsconfig*.json` and `jsconfig*.json` with the files its `extends`
+ *   names, and each file that matches a built-in or external plugin
+ *   config pattern (for example `vite.config.ts`).
+ *
+ * File content is normalized (CRLF to LF, trailing newlines removed).
+ * Known exclusions: the global git excludes file and other machine
+ * environment outside the `FALLOW_*` variables. Store the fingerprint
+ * with a verdict. A later query with another fingerprint is unknown, even
+ * when `conclusive` is true. An edit to a source file keeps it; an edit
+ * to a manifest or project config changes it, also when the edit fixes a
+ * dependency finding.
+ */
+analysis_fingerprint: string
+}
 /**
  * Result of regression detection (`--fail-on-regression`). Compares current
  * issue counts against a baseline from config or an explicit file.
@@ -6099,9 +6864,11 @@ reason?: (string | null)
  * empty object is never emitted: it would assert that something was asked and
  * all of it applied, which is a different and false claim.
  *
- * The names this build can emit are `changed-since`, `diff-filter` and
- * `sarif-file`. The reasons are `git-missing`, `not-a-repository`,
- * `git-failed` and `invalid-ref` for `changed-since`, `oversize`,
+ * The names this build can emit are `changed-since`, `diff-filter`,
+ * `package-baselines`, `sarif-file` and `group-filter`. The reasons are `git-missing`,
+ * `not-a-repository`, `git-failed` and `invalid-ref` for `changed-since`,
+ * `unknown-workspace`, `git-missing`, `not-a-repository` and `git-failed`
+ * for `package-baselines`, `oversize`,
  * `unreadable`, `not-utf8`, `foreign-namespace` and `ambiguous-base` for
  * `diff-filter`, and `directory-create-failed`, `write-failed` and
  * `serialize-failed` for `sarif-file`. Every set is OPEN: a name a consumer
@@ -6116,9 +6883,11 @@ reason?: (string | null)
  * whole object narrows the report tells its reader an unwritten SARIF file
  * widened the analysis, which is what `affects` exists to prevent.
  *
- * `scope_size` is emitted for `diff-filter`, in added lines, and for
- * `changed-since`, in changed files that the run analyzed. `sarif-file`
- * measures no scope. A consumer reads the unit off the name, so a name that
+ * `scope_size` is emitted for `diff-filter`, in added lines, for
+ * `changed-since`, in changed files that the run analyzed, and for
+ * `group-filter`, in groups that the run kept. `package-baselines`
+ * and `sarif-file` measure no scope; the applied package refs travel in
+ * `package_baselines`. A consumer reads the unit off the name, so a name that
  * starts to measure its own scope in a later release needs no change here.
  *
  * `invalid-ref` is reachable only through the programmatic API. The
@@ -6144,7 +6913,9 @@ affects: RequestEffect
  * `changed-since`, the diff source label (`--diff-file pr.diff`,
  * `--diff-stdin`, `$FALLOW_DIFF_FILE build/pr.diff`, or
  * `diffFile pr.diff` for the programmatic option) for `diff-filter`,
- * the target path for `sarif-file`. Echoed rather than normalised, so a
+ * `workspaces.changedSince` for `package-baselines`, the target path for
+ * `sarif-file`, the comma-joined selector patterns for `group-filter`.
+ * Echoed rather than normalised, so a
  * consumer must not join it to the project root the way it joins every
  * other path-shaped field.
  */
@@ -6161,7 +6932,7 @@ requested: string
  * rule dropped does not count, so a change to a README only gives `0`. A
  * combined run counts a file that any of its analyses kept, because a
  * per-analysis `production` setting can give its analyses different
- * files.
+ * files. `group-filter` counts the groups that the run kept.
  * Read the unit off the name the entry is keyed under, never across names,
  * and read an absent member as "not measured" rather than as zero.
  *
@@ -6189,6 +6960,19 @@ reason?: (string | null)
  */
 message?: (string | null)
 }
+/**
+ * One applied baseline for an exact, project-relative workspace root.
+ */
+export interface PackageBaselineStatus {
+/**
+ * Workspace package root, relative to the analysis root with `/` separators.
+ */
+workspace_root: string
+/**
+ * Git ref used to select changed files in this package.
+ */
+reference: string
+}
 /**
  * A read-only follow-up command fallow surfaces from the current findings,
  * emitted as the top-level `next_steps` array on each command's JSON envelope.
@@ -6365,6 +7149,15 @@ end_col: number
  * wants the source reads it from the file.
  */
 fragment?: string
+/**
+ * Whether the file path is a symlink, or lies under a symlinked
+ * directory, inside the project root. Omitted when `false`.
+ *
+ * A clone with a symlinked instance can be the same file under two
+ * paths, not copied code. `duplicates.ignoreSymlinks` (or
+ * `fallow dupes --ignore-symlinks`) removes these instances.
+ */
+is_symlink?: boolean
 }
 /**
  * Per-action wire shape attached to each `CloneGroupFinding` and
@@ -6579,6 +7372,15 @@ export interface HealthReport {
  */
 findings: HealthFinding[]
 summary: HealthSummary
+/**
+ * The sections that this run produced, in a fixed order. A renderer
+ * reads it to tell an empty section from a section that the run did not
+ * produce: `findings` is the complexity list only when `complexity` is
+ * in this array. The value set is OPEN (see [`HealthSection`]). Absent
+ * in an envelope from a fallow version before this member, and on a
+ * report that no health run built.
+ */
+sections?: (HealthSection[] | null)
 /**
  * Configured threshold override states. Entries are emitted for active
  * exceptions, stale exceptions, and full-run no-match cleanup hints.
@@ -9015,6 +9817,11 @@ score?: (number | null)
  * Letter grade from the snapshot.
  */
 grade?: (string | null)
+/**
+ * Formula used for the stored score; absent on legacy snapshots.
+ * A score delta is emitted only when this matches the current score formula.
+ */
+score_formula_version?: (number | null)
 /**
  * Coverage model used for CRAP computation in this snapshot.
  */
@@ -10842,17 +11649,26 @@ imported_by: string[]
  */
 type_only_imported_by: string[]
 /**
- * Whether the dependency is invoked from package.json scripts or CI configs.
+ * Whether the dependency is invoked from package.json scripts, CI configs
+ * or git hooks.
  */
 used_in_scripts: boolean
 /**
- * Whether the dependency is used at all.
+ * Whether the dependency is used at all: imported, invoked from scripts,
+ * or listed as a peer by a used package (`peer_of`).
  */
 is_used: boolean
 /**
  * Total import count.
  */
 import_count: number
+/**
+ * Used packages that list this dependency in their installed
+ * `peerDependencies`, required or optional, sorted by name. The
+ * unused-dependency check credits such a peer, because the package that
+ * lists it loads it at runtime. Absent when no used package lists it.
+ */
+peer_of?: string[]
 /**
  * The configs that declare this name as a Module Federation remote alias
  * under `remotes`, one per config. A remote alias is provided by a
@@ -10860,6 +11676,58 @@ import_count: number
  * Federation config declares the name (issue #2796).
  */
 sources?: TraceSource[]
+/**
+ * Why the unused devDependency check credits the dependency as tooling
+ * when no file imports it and no script, CI workflow or git hook runs it.
+ * When present, `is_used` is `true`. Absent otherwise.
+ */
+tooling_credit?: (ToolingCredit | null)
+/**
+ * The manifests that the unused-dependency check flags for this name,
+ * relative to the project root and sorted. The check reads each
+ * declaring manifest on its own. An import credits the nearest manifest
+ * that installs the package, so a name that one workspace uses can still
+ * be unused in the root manifest or in another workspace. Absent when no
+ * manifest is flagged.
+ */
+unused_in?: string[]
+}
+/**
+ * Why the unused devDependency check counts a dependency as used tooling
+ * although no source file imports it.
+ */
+export interface ToolingCredit {
+/**
+ * The evidence: `plugin-config` when the plugin that declares the
+ * dependency found its own config file, `plugin-reference` when a
+ * package.json script, a CI workflow or a git hook runs one of that
+ * plugin's packages, `ambient-types` for a type package that declares
+ * globals, `types-target` when the project declares or imports the
+ * package that a `@types/` package types, `types-config` when a config
+ * file, such as a tsconfig `types` entry, names the type package,
+ * `known-tooling` for a library from the tooling catalogue,
+ * `known-tooling-config` when a command-line tool from the catalogue has
+ * its own config file, and `own-peer` when the same manifest lists the
+ * devDependency in `peerDependencies`. The set is open.
+ */
+reason: string
+/**
+ * The plugin that declares the dependency as tooling.
+ */
+plugin?: (string | null)
+/**
+ * The config file found, relative to the project root, for
+ * `plugin-config` and `known-tooling-config`. A `package.json` path when
+ * the config is a package.json key. For `own-peer`, the manifest that
+ * lists the dependency.
+ */
+config?: (string | null)
+/**
+ * The package that a script, CI workflow or git hook runs, for
+ * `plugin-reference`, or the package that a `@types/` package types,
+ * for `types-target`.
+ */
+reference?: (string | null)
 }
 /**
  * Result of tracing a clone: all groups containing the code at a source
@@ -11008,7 +11876,8 @@ type_only: boolean
 /**
  * Whether the edge carries a runtime value but no static one: the target
  * loads only on demand (`import()`, a lazy glob or template pattern) or
- * on another thread (a worker URL, `child_process.fork`). False for a
+ * on another thread (a worker URL, a worker loader request,
+ * `child_process.fork`). False for a
  * static hop and for a type-only hop.
  */
 dynamic: boolean
@@ -11351,6 +12220,13 @@ body: string
  * Stable finding fingerprint used for comment reconciliation.
  */
 fingerprint: string
+/**
+ * The fingerprint that an older Fallow release wrote into the
+ * `fallow-fingerprint:v2:` marker of this comment, when it is different
+ * from `fingerprint`. For one release, an existing comment whose marker
+ * holds this value is the same comment. Omitted when equal.
+ */
+legacy_fingerprint?: (string | null)
 /**
  * True when the body was cut to fit the provider size limit; omitted
  * when false.
@@ -11370,6 +12246,13 @@ position: GitLabReviewPosition
  * Stable finding fingerprint used for comment reconciliation.
  */
 fingerprint: string
+/**
+ * The fingerprint that an older Fallow release wrote into the
+ * `fallow-fingerprint:v2:` marker of this comment, when it is different
+ * from `fingerprint`. For one release, an existing comment whose marker
+ * holds this value is the same comment. Omitted when equal.
+ */
+legacy_fingerprint?: (string | null)
 /**
  * True when the body was cut to fit the provider size limit; omitted
  * when false.
@@ -11834,6 +12717,15 @@ elapsed_ms: ElapsedMs
  */
 findings: HealthFinding[]
 summary: HealthSummary
+/**
+ * The sections that this run produced, in a fixed order. A renderer
+ * reads it to tell an empty section from a section that the run did not
+ * produce: `findings` is the complexity list only when `complexity` is
+ * in this array. The value set is OPEN (see [`HealthSection`]). Absent
+ * in an envelope from a fallow version before this member, and on a
+ * report that no health run built.
+ */
+sections?: (HealthSection[] | null)
 /**
  * Configured threshold override states. Entries are emitted for active
  * exceptions, stale exceptions, and full-run no-match cleanup hints.
@@ -11958,6 +12850,12 @@ grouped_by?: (GroupByMode | null)
  * Per-bucket recomputed metrics; present only in grouped output.
  */
 groups?: (HealthGroup[] | null)
+/**
+ * The `--group` selector patterns, as given, when the run kept only some
+ * groups. A group that is not in `groups` was filtered out by this
+ * selector. The project-level sections are not filtered.
+ */
+group_filter?: (string[] | null)
 /**
  * The verdict of every gate this run evaluated, keyed by name. The CLI
  * always emits it, with the command's default exit rule in it also when
@@ -12007,6 +12905,11 @@ next_steps?: NextStep[]
  * a single invocation. `files_analyzed` and `functions_above_threshold`
  * summarise the subset for parity with the project-level
  * project-level health summary.
+ *
+ * A group carries a per-file list (`findings`, `file_scores`, `hotspots`,
+ * `large_functions`, `targets`) only when the project report shows the same
+ * list. A `--score` run keeps the score and the counts of each group and
+ * omits the lists.
  */
 export interface HealthGroup {
 /**
@@ -12031,9 +12934,37 @@ files_analyzed: number
  * Number of findings in this group, mirroring the project-level
  * `summary.functions_above_threshold` semantics post-baseline /
  * post-`--top` truncation. When `--top` was supplied this reflects the
- * rendered finding count, not the un-truncated total.
+ * rendered finding count of the group, not the un-truncated total.
  */
 functions_above_threshold: number
+/**
+ * Number of critical-severity findings in this group, after the baseline
+ * filter and before `--top`. The project `summary.severity_critical_count`
+ * counts before the baseline filter, so with `--baseline` the group
+ * counts can add up to less.
+ */
+severity_critical_count: number
+/**
+ * Number of high-severity findings in this group, after the baseline
+ * filter and before `--top`. The project `summary.severity_high_count`
+ * counts before the baseline filter, so with `--baseline` the group
+ * counts can add up to less.
+ */
+severity_high_count: number
+/**
+ * Number of moderate-severity findings in this group, after the baseline
+ * filter and before `--top`. The project `summary.severity_moderate_count`
+ * counts before the baseline filter, so with `--baseline` the group
+ * counts can add up to less.
+ */
+severity_moderate_count: number
+/**
+ * Number of ranked hotspot entries in this group, before `--top`. This
+ * is the length of the group's ranked hotspot list. It is not
+ * `vital_signs.hotspot_count`, which counts only the files with a
+ * hotspot score of 50 or more and feeds the health score.
+ */
+hotspot_count: number
 /**
  * Whether CRAP findings in this group share a single coverage-source kind
  * (`uniform`) or combine Istanbul / estimated / inherited sources
@@ -12047,9 +12978,24 @@ coverage_source_consistency?: (CoverageSourceConsistency | null)
 vital_signs?: (VitalSigns | null)
 /**
  * Per-group health score recomputed from the per-group vital signs. Absent
- * when --score was not requested.
+ * when --score was not requested. The duplication penalty counts each
+ * clone group with two or more instances in total and one or more in
+ * this group, and counts only the lines of the instances in this group.
+ * A clone that spans two groups thus lowers the score of each group.
+ * `dupes --group-by` assigns each clone group to one owner instead.
  */
 health_score?: (HealthScore | null)
+/**
+ * Trend of this group against the same group in the baseline snapshot.
+ * Present only when `--trend` or `--trend-from` was requested and the
+ * baseline holds this group with the same `grouped_by` mode.
+ */
+trend?: (HealthTrend | null)
+/**
+ * Why `trend` is present or absent. Present only when a trend was
+ * requested and a baseline snapshot was loaded.
+ */
+trend_status?: (GroupTrendStatus | null)
 /**
  * Findings restricted to files in this group. Each entry is the typed
  * [`HealthFinding`] wrapper around a
@@ -12164,9 +13110,10 @@ baseline_staleness?: (BaselineStaleness | null)
 /**
  * The verdict of every gate this run armed, keyed by name, absent when
  * it armed none. `dupes` has no default exit rule: a run with no armed
- * gate always exits 0, so an absent object means that the run passed. A
- * gate fails the build when `status` is `fail` AND `enforced` is true.
- * See [`crate::GateOutcomes`].
+ * gate always exits 0, so an absent object means that the run passed.
+ * `--fail-on-issues` and `--ci` arm `duplication-findings`, which fails
+ * on any clone group. A gate fails the build when `status` is `fail` AND
+ * `enforced` is true. See [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -12179,6 +13126,10 @@ gate_outcomes?: (GateOutcomes | null)
  * never "nothing failed". See [`crate::RequestOutcomes`].
  */
 request_outcomes?: (RequestOutcomes | null)
+/**
+ * Applied package Git refs, omitted outside package-baseline runs.
+ */
+package_baselines?: PackageBaselineStatus[]
 /**
  * `_meta` block with metric / rule definitions, emitted when `--explain`
  * is passed (always present in MCP responses).
@@ -12310,6 +13261,15 @@ end_col: number
  * wants the source reads it from the file.
  */
 fragment?: string
+/**
+ * Whether the file path is a symlink, or lies under a symlinked
+ * directory, inside the project root. Omitted when `false`.
+ *
+ * A clone with a symlinked instance can be the same file under two
+ * paths, not copied code. `duplicates.ignoreSymlinks` (or
+ * `fallow dupes --ignore-symlinks`) removes these instances.
+ */
+is_symlink?: boolean
 /**
  * Resolver key for this specific instance (per-instance, not the
  * group-level largest-owner).
@@ -12337,6 +13297,14 @@ total_issues: number
  * One bucket per resolver key.
  */
 groups: CheckGroupedEntry[]
+/**
+ * `true` when the `unused-load-data-key` detector abstained for the whole
+ * project. The abstain has no file, so it is on the root and not in a
+ * group. An empty `unused_load_data_keys` with this flag set does not
+ * mean the project is clean: the rule could not run safely. Serialized
+ * only when `true`, like the flat `CheckOutput` field.
+ */
+unused_load_data_keys_global_abstain?: boolean
 /**
  * This run's view of the loaded baseline, present only in baseline runs.
  * Carries the staleness counts, the advisory verdict and `gate_trips`, the
@@ -12346,6 +13314,14 @@ groups: CheckGroupedEntry[]
  * can report `matched_entries: 0` on a healthy baseline.
  */
 baseline_staleness?: (BaselineStaleness | null)
+/**
+ * The answer to `--finding-id`, present only when the run received one
+ * or more `--finding-id` values. The report then holds only the
+ * requested findings. Read `missing` as resolved only when `conclusive`
+ * is true; a scope, a baseline or a filter can hide a finding that still
+ * exists. See [`crate::FindingIdQuery`].
+ */
+finding_id_query?: (FindingIdQuery | null)
 /**
  * The verdict of every gate this run evaluated, keyed by name. The CLI
  * always emits it, with the command's default exit rule in it also when
@@ -12366,6 +13342,10 @@ gate_outcomes?: (GateOutcomes | null)
  * never "nothing failed". See [`crate::RequestOutcomes`].
  */
 request_outcomes?: (RequestOutcomes | null)
+/**
+ * Applied package Git refs, omitted outside package-baseline runs.
+ */
+package_baselines?: PackageBaselineStatus[]
 /**
  * `_meta` block with docs and rule definitions, when `--explain` was
  * passed.
@@ -12525,6 +13505,12 @@ circular_dependencies: CircularDependencyFinding[]
  * suppression breaks the cycle).
  */
 re_export_cycles?: ReExportCycleFinding[]
+/**
+ * Dependency cycles between workspace packages, built from resolved
+ * cross-package imports. Wrapped in [`PackageCycleFinding`] so each
+ * entry carries a typed `actions` array natively.
+ */
+package_cycles?: PackageCycleFinding[]
 /**
  * Imports that cross architecture boundary rules. Wrapped in
  * [`BoundaryViolationFinding`] so each entry carries a typed `actions`
@@ -12657,6 +13643,10 @@ dynamic_segment_name_conflicts?: DynamicSegmentNameConflictFinding[]
  * array natively. Default severity is `warn`.
  */
 unused_component_props?: UnusedComponentPropFinding[]
+/**
+ * Used optional component inputs absent from inspected reachable callers. Off by default.
+ */
+absent_component_props?: AbsentComponentPropFinding[]
 /**
  * Vue `<script setup>` `defineEmits` events emitted nowhere in their own SFC
  * (no `emit('<name>')` call). Wrapped in [`UnusedComponentEmitFinding`] so
@@ -13993,9 +14983,13 @@ elapsed_ms: ElapsedMs
 /**
  * The verdict of every gate this run evaluated, keyed by name. The CLI
  * always emits it, with the default exit rule of each section that ran
- * (`error-severity-findings`, `health-findings`). The machine formats of
- * the combined run exit 0 for findings, so most entries have `enforced:
- * false`. For the default exit rules (`error-severity-findings`,
+ * (`error-severity-findings`, `health-findings`). Without
+ * `--fail-on-issues` or `--ci`, the machine formats of the combined run
+ * exit 0 for findings, so most entries have `enforced: false`. With one of
+ * these flags, the findings rules and `duplication-threshold` are
+ * `enforced`, the dupes section adds an enforced `duplication-findings`
+ * entry, and every format exits 1 when one fails. For the default
+ * exit rules (`error-severity-findings`,
  * `health-findings`), `status` gives the verdict of the human run. An
  * advisory entry can report `fail` without a failure of the human run: an
  * example is a `stale-baseline` entry that `--fail-on-stale-baseline` did
@@ -14014,6 +15008,11 @@ gate_outcomes?: (GateOutcomes | null)
  * never "nothing failed". See [`crate::RequestOutcomes`].
  */
 request_outcomes?: (RequestOutcomes | null)
+/**
+ * Applied package Git refs of the `check` and `dupes` sections. The map
+ * does not narrow the `health` section.
+ */
+package_baselines?: PackageBaselineStatus[]
 /**
  * Per-section `_meta` blocks, when `--explain` was passed.
  */
@@ -16952,6 +17951,16 @@ export type EmptyCatalogGroup = EmptyCatalogGroupFinding;
  */
 export type MisconfiguredDependencyOverride = MisconfiguredDependencyOverrideFinding;
 
+/**
+ * Backwards-compat alias for the pre-#384 bare `PackageCycle` name.
+ * The wire shape is byte-identical: `PackageCycleFinding` flattens the bare
+ * finding's fields via `#[serde(flatten)]` and adds `actions[]` plus
+ * the optional audit-mode `introduced` flag. Consumers that imported
+ * `PackageCycle` from `fallow/types` pre-migration continue to work via
+ * this alias; new code should prefer `PackageCycleFinding`.
+ */
+export type PackageCycle = PackageCycleFinding;
+
 /**
  * Backwards-compat alias for the pre-#384 bare `PrivateTypeLeak` name.
  * The wire shape is byte-identical: `PrivateTypeLeakFinding` flattens the bare