Struct FallowConfig 

pub struct FallowConfig {

    pub schema: Option<String>,
    pub extends: Vec<String>,
    pub entry: Vec<String>,
    pub ignore_patterns: Vec<String>,
    pub framework: Vec<ExternalPluginDef>,
    pub workspaces: Option<WorkspaceConfig>,
    pub ignore_dependencies: Vec<String>,
    pub ignore_unresolved_imports: Vec<String>,
    pub ignore_exports: Vec<IgnoreExportRule>,
    pub ignore_catalog_references: Vec<IgnoreCatalogReferenceRule>,
    pub ignore_dependency_overrides: Vec<IgnoreDependencyOverrideRule>,
    pub ignore_exports_used_in_file: IgnoreExportsUsedInFileConfig,
    pub ignore_decorators: Vec<String>,
    pub used_class_members: Vec<UsedClassMemberRule>,
    pub duplicates: DuplicatesConfig,
    pub health: HealthConfig,
    pub rules: RulesConfig,
    pub unused_component_props: UnusedComponentPropsConfig,
    pub boundaries: BoundaryConfig,
    pub flags: FlagsConfig,
    pub security: SecurityConfig,
    pub fix: FixConfig,
    pub resolve: ResolveConfig,
    pub production: ProductionConfig,
    pub plugins: Vec<String>,
    pub rule_packs: Vec<String>,
    pub dynamically_loaded: Vec<String>,
    pub overrides: Vec<ConfigOverride>,
    pub codeowners: Option<String>,
    pub public_packages: Vec<String>,
    pub regression: Option<RegressionConfig>,
    pub audit: AuditConfig,
    pub sealed: bool,
    pub include_entry_exports: bool,
    pub auto_imports: bool,
    pub cache: CacheConfig,
}

Fields

schema: Option<String>

A string pointing at fallow’s JSON Schema URL, used only by editors for autocomplete and validation of the config file; it has no effect on analysis and is stripped before serialization (serde skip_serializing, writeOnly in the schema). Set it to https://fallow.dev/schema.json to get editor IntelliSense; any other value is ignored by fallow.

extends: Vec<String>

An ordered array of parent config sources to inherit before this file’s own keys apply; each entry is a file-relative path, an npm:<package> specifier, or an https:// URL (http:// is rejected), deep-merged in order so objects merge field-by-field while arrays and scalars in this file replace the parent’s, with cycle and depth guards. Set it to share a base config across a monorepo or team; it is consumed at load and stripped before serialization (serde skip_serializing).

entry: Vec<String>

An array of project-root-relative glob patterns whose matching files are seeded as manual entry points, on top of the framework and package.json entries fallow discovers automatically, so their transitive imports are not reported as unused. Set it (e.g. ["src/main.ts"]) when a file is a real runtime root that no plugin or manifest declares; patterns are validated at load and matched against discovered files.

ignore_patterns: Vec<String>

An array of project-root-relative glob patterns for files to exclude from analysis entirely; entries are unioned with fallow’s built-in defaults (/node_modules/, /dist/, build/**, /.git/, /coverage/, **/.min.js, **/.min.mjs, **/.min.cjs, **/.bundle.js), so custom globs add to rather than replace them. Set it (e.g. ["generated/**"]) to drop generated or vendored trees from every detector; patterns are validated at load.

framework: Vec<ExternalPluginDef>

Declares inline external framework plugins as data (array of plugin objects), each with name plus optional enablers (package names that activate it) or richer detection (dependency/file-existence/all/any checks, taking priority over enablers), entryPoints (+ entryPointRole runtime/support/test), configPatterns, alwaysUsed, toolingDependencies, usedExports ({ pattern, exports }), and usedClassMembers. Set it to keep a custom or in-house framework’s entry points, config files, and conventions reachable without a Rust plugin; these definitions are appended to plugins discovered via plugins, .fallow/plugins/, and root fallow-plugin-* files (first occurrence of a name wins), and cannot do AST-based config parsing.

workspaces: Option<WorkspaceConfig>

Monorepo workspace configuration whose sole sub-key patterns (array of globs) adds workspace package roots beyond those discovered from package.json workspaces, pnpm-workspace.yaml, and tsconfig references. Optional and absent by default (discovery uses the manifests alone); set it only when workspaces live in directories the standard manifests do not declare.

ignore_dependencies: Vec<String>

A list of exact package names excluded from BOTH unused-dependency and unlisted-dependency detection, so a runtime-provided or otherwise-untracked package (e.g. bun:sqlite, a peer supplied at deploy time) is never flagged as unused when declared nor as unlisted when imported. Set it for packages fallow cannot observe being used and cannot observe being declared; matching is exact string equality against the package name, not a glob.

ignore_unresolved_imports: Vec<String>

A list of glob patterns that suppress only unresolved-import findings whose raw import specifier matches; it does not change dependency usage accounting or resolver behavior. Patterns match the import string as written (not a filesystem path), so list both @example/icons and @example/icons/** to cover a bare package and its subpaths; parent-relative generated specifiers like ../generated/** are valid, and broad values like ** can hide real missing modules.

ignore_exports: Vec<IgnoreExportRule>

A list of per-file rules that exempt named exports from unused-export and from duplicate-exports grouping for files matching a glob. Each entry is { file: <glob>, exports: [<name>, ...] } where exports: ["*"] exempts every export in the file and a name list exempts only those names; built for component-library barrels (shadcn/Radix/bits-ui index.ts) that intentionally re-export the same short names across many files.

ignore_catalog_references: Vec<IgnoreCatalogReferenceRule>

A list of rules that suppress unresolved-catalog-reference findings (a workspace package.json referencing a catalog: or catalog:<name> that the catalog does not declare); config-only because package.json has no inline-suppression comment surface. Each entry needs a package (exact match) plus optional catalog (exact catalog-name match) and consumer (glob on the consuming package.json path); use it for staged catalog migrations where the catalog edit lands in a separate change.

ignore_dependency_overrides: Vec<IgnoreDependencyOverrideRule>

A list of rules that suppress unused-dependency-override and misconfigured-dependency-override findings for pnpm overrides entries; config-only, matched against the override’s target package. Each entry needs a package (exact match) plus an optional source to scope the suppression to "pnpm-workspace.yaml" or "package.json".

ignore_exports_used_in_file: IgnoreExportsUsedInFileConfig

Controls whether an export referenced only by another symbol in the same file is treated as used (suppressed from unused-export) until it becomes completely unreferenced; references inside an export specifier itself (export { foo }, export default foo) do not count as same-file uses. Accepts true/false (default false, suppress nothing) or the knip-parity object { "type": true, "interface": true }, which restricts the suppression to type-only exports; fallow groups type aliases and interfaces under one kind, so both object fields behave identically.

ignore_decorators: Vec<String>

A list of decorator names that no longer grant a class member automatic exemption from unused-class-member: a member whose every decorator is in this set is checked normally, while a member carrying any decorator NOT listed here stays skipped (frameworks consume decorated members reflectively). Dotted entries match the full decorator path (ns.foo) and bare entries match the leftmost segment (so "decorators" collapses every @decorators.*); both "@step" and "step" are accepted (leading @ stripped), and an unmatched entry emits a one-time warning.

used_class_members: Vec<UsedClassMemberRule>

A list of class-member names or glob patterns treated as framework-used, so a method a library invokes reflectively (ag-Grid agInit/refresh, Web Component connectedCallback) is not reported as unused-class-member; it applies to class members only, not enum members. Each entry is either a plain string/glob ("agInit", "enter*", "*") applied to every class, or a scoped object { extends?, implements?, members: [...] } that applies only when the class matches that heritage clause (a scoped rule requires extends or implements); patterns matching zero members warn once.

duplicates: DuplicatesConfig

Configures clone detection: enabled (default true), mode (strict, mild default, weak, semantic, from least to most identifier/literal blinding; strict and mild are equivalent under fallow’s AST tokenizer, weak blinds string literals, semantic blinds all identifiers and literals for Type-2 renamed-variable detection), minTokens (50), minLines (5), minOccurrences (integer >= 2, deserialization fails below 2), threshold (max duplication percentage, 0 = no limit), ignore globs, ignoreDefaults (true, merge built-in generated-file ignores), skipLocal (only report cross-directory clones), crossLanguage (strip TS type annotations to match .ts against .js), ignoreImports (true, strip ES import/re-export/top-level require wiring from the token stream), and normalization (per-flag ignoreIdentifiers/ignoreStringValues/ignoreNumericValues overrides on top of mode). Raise minOccurrences to focus on widespread copy-paste, or set mode to semantic to catch renamed-variable clones.

health: HealthConfig

Sets complexity and health thresholds for fallow health (also applied in combined fallow and fallow audit): maxCyclomatic (20), maxCognitive (15), maxCrap (30.0, findings at or above this are reported), crapRefactorBand (5, cyclomatic band below maxCyclomatic where a secondary refactor action is added), maxUnitSize (max function lines before a large-function finding, 60), coverage/coverageRoot (Istanbul coverage path and path-prefix strip for accurate CRAP), ignore globs (remove files from findings AND the health score), thresholdOverrides (per-file/per-function ceilings via files/functions/maxCyclomatic/maxCognitive/maxCrap/maxUnitSize/reason), ownership (botPatterns and emailMode for --ownership), and suggestInlineSuppression (true, emit suppress-line action hints in JSON). Raise thresholds to relax which functions are flagged, wire coverage for real CRAP scores, or exempt generated/test files via ignore (drops them from the score too) or thresholdOverrides (keeps them visible under a higher ceiling).

rules: RulesConfig

Sets per-issue-type severity, keyed by kebab-case rule id: error reports and fails CI (non-zero exit), warn reports without failing, off disables detection and reporting entirely (e.g. { "unused-files": "error", "unused-exports": "warn", "private-type-leaks": "off" }). Set a rule off to silence it, warn to demote below CI gating, or error to promote a warn/off-default rule to gating; most rules default to error, dev/optional-dependency and component/store/inject/CSS/catalog rules default to warn, and opt-in rules (private-type-leaks, security-*, prop-drilling, thin-wrapper, duplicate-prop-shape, coverage-gaps, feature-flags, require-suppression-reason) default to off. Singular aliases (unused-file) and warning/none severity spellings are accepted.

unused_component_props: UnusedComponentPropsConfig

Options for the unused-component-props rule, currently only ignorePattern: a regex matched against each declared prop’s local destructure binding name (falling back to the public prop name when unaliased) to exempt intentionally-unused props such as the leading-underscore convention. Set { "ignorePattern": "^_" } to skip props like _stage; matching is unanchored (substring, like ESLint’s RegExp.test) so anchor with ^, the pattern is validated at config load (invalid regex fails load), and it applies to Vue, Svelte, Astro, and React/Preact props (unset leaves the rule unchanged).

boundaries: BoundaryConfig

Configures architecture boundary enforcement: which source directories belong to which named zone and which zones may import which others, reported as boundary-violation, boundary-coverage-violation, and boundary-call-violation findings (severity via rules.boundary-violation, default error). Set to enforce a layered/module architecture; the object holds preset (one of layered, hexagonal, feature-sliced, bulletproof, whose default zones/rules are merged in with the user-declared zones/rules taking precedence), zones (each with name, patterns, autoDiscover, optional root), rules (each with from, allow, allowTypeOnly target-zone lists), coverage (requireAllFiles plus allowUnmatched globs for files matching no zone), and calls (a forbidden list of {from, callee} banned-call rules per zone).

flags: FlagsConfig

Configures feature-flag detection: sdkPatterns (custom flag-evaluating call signatures, each { function, nameArg (zero-based arg index of the flag name, default 0), provider? }, merged with built-ins for LaunchDarkly, Statsig, Unleash, GrowthBook, Split, PostHog, Vercel Flags, ConfigCat, Flagsmith, Optimizely, and Eppo), envPrefixes (env-var prefixes marking process.env.* accesses as flags, merged with built-ins), and configObjectHeuristics (default false; when true, property accesses on objects whose name contains feature/flag/toggle are reported as low-confidence flags). Set sdkPatterns/envPrefixes to teach fallow a proprietary flag SDK or naming convention, or enable configObjectHeuristics for projects that read flags off config objects (higher false-positive rate). Feature-flag findings surface only when the feature-flags rule is enabled (default off).

security: SecurityConfig

Scopes the opt-in fallow security catalogue: which candidate categories run and which extra local identifiers count as HTTP request objects. Set when tuning security-candidate detection; the object holds categories (an object with include and/or exclude string arrays of catalogue category ids, where include restricts to a whitelist and exclude removes from the admitted set, both unset admits all ordinary categories) and requestReceivers (a string array of project-local names that extend, not replace, the built-in *.query/*.params/*.body source-receiver allowlist). The hardcoded-secret and secret-to-network categories are include-required: they fire only when explicitly listed in categories.include, even when no include list is otherwise set. The valid category ids are enumerated (with title, CWE, and include-required flag) in the security_categories block of fallow schema, and also listed by fallow security --help; they are not in this config-schema.

fix: FixConfig

Configures fallow fix behavior. Currently holds one nested section, catalog (a CatalogFixConfig), whose only key deletePrecedingComments (auto default, always, never) governs whether comment lines directly above a removed unused pnpm-workspace.yaml catalog entry are deleted with it.

resolve: ResolveConfig

Configures the module resolver. Its one key conditions is a list of additional package.json exports/imports condition names to honor, matched at higher priority than fallow’s built-ins (development, import, require, default, types, node, plus react-native/browser when the React Native or Expo plugin is active). Set it when a package’s exports map has custom branches (e.g. worker, deno, edge) that fallow should follow instead of the default branch.

production: ProductionConfig

Enables production mode, which excludes test/spec/story/dev files from discovery and forces unused-dev-dependencies and unused-optional-dependencies to off. Accepts a boolean (default false) applied to all analyses, or a per-analysis object { deadCode?, health?, dupes? } (each boolean, default false) that scopes production mode to individual analyses in combined fallow and fallow audit. Set it to analyze only shipped code; the --production/--no-production and --production-{dead-code,health,dupes} CLI flags and FALLOW_PRODUCTION* env vars override this value (CLI flags win, then per-analysis env, then global env, then config).

plugins: Vec<String>

List of paths (relative to the project root, must resolve within it) to external plugin definition files or directories in JSONC/JSON/TOML, loaded in addition to the auto-discovered .fallow/plugins/ directory and root fallow-plugin-* files. Set it to load plugin definitions kept outside those default locations; a path resolving outside the project root is skipped with a tracing::warn, and paths listed here are searched before the auto-discovered locations (first occurrence of a plugin name wins).

rule_packs: Vec<String>

Paths to declarative rule-pack files (JSON or JSONC), relative to the project root. Each pack declares banned-call, banned-import, or banned-effect rules that report as policy-violation findings. Packs are pure data: no project code is executed. Invalid or missing packs fail config load.

dynamically_loaded: Vec<String>

An array of project-root-relative glob patterns for files loaded at runtime by a mechanism the static graph cannot see (dynamic path resolution, config-driven loading); matching files are seeded as entry points so they and their imports stay reachable. Empty by default; set it (e.g. ["plugins/**/*.ts", "locales/**/*.json"]) for plugin or locale trees pulled in dynamically.

overrides: Vec<ConfigOverride>

An ordered list of per-file rule-severity overrides: each entry re-severities specific analysis rules for files its globs match, layered on top of the top-level rules defaults. Set to relax or tighten rules for a subset of paths (e.g. downgrade unused-exports to warn under a generated directory); each entry has files (glob-pattern array) and rules (a partial per-rule severity map of error/warn/off). Entries apply in list order and a file matched by several entries takes every matching entry’s overrides (later entries win on conflict); inter-file rules (duplicate-exports, circular-dependencies, re-export-cycle) have no effect in an override (fallow warns during analysis and points to the right mechanism: top-level ignoreExports for duplicate-exports, a file-level // fallow-ignore-file comment for the others).

codeowners: Option<String>

A project-root-relative path to a CODEOWNERS file, used by fallow health –hotspots –ownership to attribute declared owners and compute unowned/drifting ownership state; setting it overrides the default probe order (CODEOWNERS, .github/CODEOWNERS, .gitlab/CODEOWNERS, docs/CODEOWNERS). String, defaults to null (auto-probe the standard locations); set it only when the CODEOWNERS file lives at a non-standard location.

public_packages: Vec<String>

An array of internal workspace package names (or globs matched against workspace package names) whose public API is intentionally consumed outside the analyzed graph; their entry points and re-export surface become reachability roots, so their exported files, exports, and class members are not reported as unused. Set it (e.g. ["@myorg/shared-lib", "@myorg/*"]) for library packages in a monorepo that ship an API to external consumers; only meaningful when workspaces are present (an empty list or no workspaces is a no-op).

regression: Option<RegressionConfig>

Holds a saved issue-count baseline that the --fail-on-regression gate compares the current run against, failing only when counts grow beyond tolerance relative to the baseline. Usually written by --save-baseline rather than hand-authored; the object has a single baseline sub-key holding per-issue-type counts (total_issues plus per-kind fields like unused_exports, boundary_violations, policy_violations, each defaulting to 0). Absent means no baseline is embedded in config.

audit: AuditConfig

Sets in-repo defaults for fallow audit (the changed-files quality gate) so CLI flags need not repeat per run. Set to pin audit behavior; the object holds gate (new-only or all, which findings drive the verdict), css/cssDeep (booleans toggling styling analysis and the project-wide CSS reachability pass), deadCodeBaseline/healthBaseline/dupesBaseline (per-sub-analysis baseline file paths), and cacheMaxAgeDays (GC window in days for the reusable base-snapshot worktree cache). The matching CLI flag overrides each field.

sealed: bool

When true, restricts this config’s extends entries to file-relative paths that resolve inside the config file’s own directory; any https:// URL, npm: package, or relative path escaping that directory is rejected at load with a hard error. Boolean, defaults to false (URL, npm, and any-relative extends are permitted); set it to true to harden a config against pulling in remote or out-of-tree bases.

include_entry_exports: bool

When true, exports of entry-point files are subject to unused-export detection instead of being auto-credited as used, so a typo’d or stray export in a framework route or package entry (e.g. meatdata for metadata) is flagged; plugin used_exports allowlists are still honored. Boolean, defaults to false; the CLI flag –include-entry-exports applies the same behavior for one run.

auto_imports: bool

When true, drops Nuxt convention-based entry-pattern fallbacks: component fallbacks are dropped unless nuxt.config declares components:, and composable/util fallbacks are dropped unless it declares imports:, so genuinely-unreferenced convention files surface as unused-file. Boolean, defaults to false; set it for a Nuxt project that has explicitly configured its auto-import directories. Synthesis of auto-import graph edges (resolving <Card /> or useUserStore() to their convention files) happens regardless of this flag.

cache: CacheConfig

Overrides the location and size ceiling of fallow’s persistent extraction cache (default .fallow/cache.bin under the project root). Set to relocate the cache or cap its footprint; the object holds dir (cache directory, relative paths resolve from the project root) and maxSizeMb (extraction-cache size limit in megabytes). The FALLOW_CACHE_MAX_SIZE environment variable overrides maxSizeMb.

Implementations

impl FallowConfig

pub fn load(path: &Path) -> Result<Self, Report>

Load config from a fallow config file (TOML or JSON/JSONC).

The format is detected from the file extension:

• .toml → TOML
• .json → JSON (with JSONC comment stripping)

Supports extends for config inheritance. Extended configs are loaded and deep-merged before this config’s values are applied.

User-supplied glob patterns (entry, ignorePatterns, dynamicallyLoaded, duplicates.ignore, health.ignore, health.thresholdOverrides[].files, boundaries.zones[].patterns, overrides[].files, ignoreExports[].file, ignoreCatalogReferences[].consumer) are validated against absolute paths, .. traversal segments, and invalid glob syntax. Loading fails loud on any rejection so silent no-match configs surface to the user. See issue #463.

Errors

Returns an error when the config file cannot be read, merged, or deserialized, or when any user-supplied glob pattern is rejected.

pub fn validate_user_globs(&self) -> Result<(), Vec<GlobValidationError>>

Validate all user-supplied glob patterns and directory paths in this config.

Accumulates errors from every glob- or path-bearing field so the user sees ALL offending values in one run rather than fixing them one at a time.

Covered filesystem glob fields: entry, ignorePatterns, dynamicallyLoaded, duplicates.ignore, health.ignore, health.thresholdOverrides[].files, overrides[].files, ignoreExports[].file, ignoreCatalogReferences[].consumer, boundaries.zones[].patterns, boundaries.coverage.allowUnmatched, plus every glob-bearing field on inline framework[] plugin definitions (entry points, always-used, config patterns, used-exports patterns, and fileExists detection patterns; the last reaches glob::glob on disk so a .. segment there is a real path traversal).

Covered specifier glob fields: ignoreUnresolvedImports. These match raw import strings, so parent-relative specifiers like ../generated/** are valid and only glob syntax is checked.

Covered directory-path fields: boundaries.zones[].root and boundaries.zones[].autoDiscover. These are literal paths (not globs), so only the absolute-path + traversal checks apply.

Errors

Returns a non-empty Vec of glob_validation::GlobValidationError when any field contains a rejected value.

pub fn find_config_path(start: &Path) -> Option<PathBuf>

Find the config file path without loading it. Searches the same locations as find_and_load.

pub fn find_and_load(start: &Path) -> Result<Option<(Self, PathBuf)>, String>

Find and load config, searching from start up to the project root.

Errors

Returns an error if a config file is found but cannot be read or parsed.

pub fn json_schema() -> Value

Generate JSON Schema for the configuration format.

pub fn validate_resolved_boundaries( &self, root: &Path, ) -> Result<(), Vec<ZoneValidationError>>

Validate boundary zone references and zone-root-prefix conflicts AFTER preset and auto-discover expansion.

Runs the same expand sequence as FallowConfig::resolve (preset expansion gated on tsconfig rootDir, then expand_auto_discover) before invoking BoundaryConfig::validate_zone_references and BoundaryConfig::validate_root_prefixes, so Bulletproof-style presets whose authored rule references logical groups (features) still load cleanly.

Call sites (runtime_support::load_config_for_analysis in the CLI, core::lib::config_for_project for LSP and programmatic embedders) surface every collected error in a single rendered diagnostic, then exit with code 2. Previously these failures emitted tracing::error! and continued, producing a flood of false-positive boundary violations at analysis time (#468).

root is the project root used by expand_auto_discover to scan for child directories. Caller is responsible for passing the same root it later hands to resolve().

Errors

Returns a non-empty Vec<ZoneValidationError> aggregating every offending zone reference and redundant-root-prefix pattern; the empty case becomes Ok(()).

impl FallowConfig

pub fn resolve( self, root: PathBuf, output: OutputFormat, threads: usize, no_cache: bool, quiet: bool, cache_max_size_mb: Option<u32>, ) -> ResolvedConfig

Resolve into a fully resolved config with compiled globs.

Trait Implementations

impl Debug for FallowConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for FallowConfig

fn default() -> FallowConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for FallowConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for FallowConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for FallowConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.