Struct RulesConfig 

pub struct RulesConfig {

    pub unused_files: Severity,
    pub unused_exports: Severity,
    pub unused_types: Severity,
    pub private_type_leaks: Severity,
    pub private_type_leaks_configured: bool,
    pub deprecated_exports_in_use: Severity,
    pub unused_dependencies: Severity,
    pub unused_dev_dependencies: Severity,
    pub unused_optional_dependencies: Severity,
    pub unused_enum_members: Severity,
    pub unused_class_members: Severity,
    pub unused_store_members: Severity,
    pub unprovided_injects: Severity,
    pub unrendered_components: Severity,
    pub unused_component_props: Severity,
    pub unused_component_emits: Severity,
    pub unused_component_inputs: Severity,
    pub unused_component_outputs: Severity,
    pub unused_svelte_events: Severity,
    pub unused_server_actions: Severity,
    pub unused_load_data_keys: Severity,
    pub prop_drilling: Severity,
    pub thin_wrapper: Severity,
    pub duplicate_prop_shape: Severity,
    pub css_token_drift: Severity,
    pub css_duplicate_block: Severity,
    pub css_selector_complexity: Severity,
    pub css_dead_surface: Severity,
    pub css_broken_reference: Severity,
    pub complexity_cyclomatic: Severity,
    pub complexity_cognitive: Severity,
    pub complexity_crap: Severity,
    pub unresolved_imports: Severity,
    pub unlisted_dependencies: Severity,
    pub duplicate_exports: Severity,
    pub type_only_dependencies: Severity,
    pub test_only_dependencies: Severity,
    pub dev_dependencies_in_production: Severity,
    pub circular_dependencies: Severity,
    pub re_export_cycle: Severity,
    pub boundary_violation: Severity,
    pub coverage_gaps: Severity,
    pub feature_flags: Severity,
    pub stale_suppressions: Severity,
    pub require_suppression_reason: Severity,
    pub unused_catalog_entries: Severity,
    pub empty_catalog_groups: Severity,
    pub unresolved_catalog_references: Severity,
    pub unused_dependency_overrides: Severity,
    pub misconfigured_dependency_overrides: Severity,
    pub security_client_server_leak: Severity,
    pub security_sink: Severity,
    pub policy_violation: Severity,
    pub invalid_client_export: Severity,
    pub mixed_client_server_barrel: Severity,
    pub misplaced_directive: Severity,
    pub route_collision: Severity,
    pub dynamic_segment_name_conflict: Severity,
}

Per-issue-type severity configuration.

Controls which issue types cause CI failure, are reported as warnings, or are suppressed entirely. Most fields default to Severity::Error.

Rule names use kebab-case in config files (e.g., "unused-files": "error").

Fields

unused_files: Severity

A file reachable from no entry point. Defaults to error.

unused_exports: Severity

An exported symbol no other module imports. Defaults to error.

unused_types: Severity

An exported type no other module uses. Defaults to error.

private_type_leaks: Severity

An exported signature referencing a same-file private type. Opt-in; defaults to off.

private_type_leaks_configured: bool

Whether the user explicitly configured private-type-leaks (rather than the field taking its off default). Populated during config file loading, not by serde: type-aware hosts default this opt-in rule to warn, and this flag lets an explicit user off win over that default (issue #2170).

Because the field is serde(skip), any serialize/deserialize round-trip of FallowConfig silently resets it to false, which would re-enable the type-aware warn default for a user who explicitly set the rule to off. Do not route configs through a serde round-trip after FallowConfig::load without re-recording this flag.

deprecated_exports_in_use: Severity

An export marked @deprecated that still has at least one reachable reference. Opt-in; defaults to off. A per-path override resolves on the file that declares the export, not on the consumer.

unused_dependencies: Severity

A declared dependencies entry never observed used. Defaults to error.

unused_dev_dependencies: Severity

A declared devDependencies entry never observed used. Defaults to warn; production mode forces it to off.

unused_optional_dependencies: Severity

A declared optionalDependencies entry never observed used. Defaults to warn; production mode forces it to off.

unused_enum_members: Severity

An enum member read nowhere in the project. Defaults to error.

unused_class_members: Severity

A class member used nowhere; usedClassMembers and decorator exemptions carve out framework-invoked members. Defaults to error.

unused_store_members: Severity

Store members (Pinia state / getters / actions key, or a setup-store returned key) declared but never accessed by any consumer project-wide. Defaults to warn, not error like the closed-set class/enum member rules: a store has an OPEN declaration surface (plugins, $onAction, dynamic dispatch) so analyzer confidence is genuinely lower; warn encodes that without failing CI. Promotable to error once validated on a codebase.

unprovided_injects: Severity

Vue inject(KEY) / Svelte getContext(KEY) whose symbol KEY is provide/setContext’d nowhere in the project (the injected-never-provided dead-half). Defaults to warn, not error: a DI key has an open provide surface (plugins, app-level provide) so analyzer confidence is lower; warn encodes that without failing CI.

unrendered_components: Severity

Vue/Svelte single-file component reachable in the module graph but rendered nowhere in the project (the imported-but-never-rendered dead-half). Defaults to warn, not error: a component can be rendered reflectively (dynamic <component :is>), so analyzer confidence is lower; warn encodes that without failing CI.

unused_component_props: Severity

Vue <script setup> defineProps, Svelte 5 $props(), or React declared prop referenced nowhere inside its own component. The single-component dead-input direction. Defaults to warn, not error: a prop can be part of a deliberately-stable public component API, so analyzer confidence is lower; warn encodes that without failing CI.

unused_component_emits: Severity

Vue <script setup> defineEmits declared event emitted nowhere inside its own single-file component (no emit('<name>') call). The single-file dead-input direction. Defaults to warn, not error: an emit can be part of a deliberately-stable public component API, so analyzer confidence is lower; warn encodes that without failing CI.

unused_component_inputs: Severity

Angular @Input() / signal input() / model() declared input read nowhere inside its own component (neither the inline/external template nor the class body). The single-file dead-input direction, the Angular analogue of unused-component-prop. Defaults to warn, not error: an input can be part of a deliberately-stable public component API, so analyzer confidence is lower; warn encodes that without failing CI.

unused_component_outputs: Severity

Angular @Output() / signal output() declared output emitted nowhere inside its own component (no this.<output>.emit(...)). The single-file dead-output direction, the Angular analogue of unused-component-emit. Defaults to warn, not error: an output can be part of a deliberately-stable public component API, so analyzer confidence is lower; warn encodes that without failing CI.

unused_svelte_events: Severity

Svelte component dispatching a custom event via createEventDispatcher() whose event name is listened to nowhere in the analyzed project. The cross-file dead-output direction (no eslint-plugin-svelte / svelte-check rule covers the listener side). Defaults to warn, not error: a dispatched event can be part of a deliberately-stable public component API, or a listener may be added later, so analyzer confidence is lower; warn encodes that without failing CI.

unused_server_actions: Severity

Next.js Server Action (an export of a "use server" file) referenced by no code in the project: no import-and-call, no action={fn} binding, no <form action={fn}>. Cross-graph dead-export direction, reclassified out of unused-export for "use server" files. Defaults to warn, not error: the rule is new and false-negative-preferring, and reflective action-dispatch shapes can hide a real consumer; warn encodes that without failing CI until corpus-validated.

unused_load_data_keys: Severity

SvelteKit +page.{ts,server.ts,js,server.js} load() return-object key read by no consumer: not off the sibling +page.svelte’s data.<key>, nor project-wide via page.data.<key> / $page.data.<key>. Cross-file dead-input direction. Defaults to warn, not error: the rule is new and false-negative-preferring (a whole-object data pass abstains), and a load fetch can have side effects so deletion is a human call; warn encodes that without failing CI until corpus-validated.

prop_drilling: Severity

React/Preact prop forwarded unchanged through >= N intermediate pass-through components until a component that substantively consumes it. A graph-derived health signal. Defaults to off (opt-in), like private-type-leak / security-*: the located per-chain records and the small capped health penalty are dormant until the user enables the rule.

thin_wrapper: Severity

A React/Preact component whose entire body is return <Child {...props}/> (pure structural indirection, a candidate for inlining). A graph-derived health signal. Defaults to off (opt-in), like prop-drilling: the located per-wrapper records are dormant until the user enables the rule.

duplicate_prop_shape: Severity

Three or more React/Preact components across two or more files whose statically-harvested prop NAME set is identical after stripping ubiquitous DOM / passthrough names (a missing shared Props type / base component). A graph-derived structural-refactor health signal. Defaults to off (opt-in), like thin-wrapper: the located per-component records are dormant until the user enables the rule.

css_token_drift: Severity

A CSS / CSS-in-JS design-token DRIFT finding (a hardcoded value where a design token exists, e.g. a Tailwind arbitrary value). A styling-domain advisory surfaced in fallow audit; defaults to warn (verdict-neutral). Set to error to gate CI on styling drift, or off to silence.

css_duplicate_block: Severity

A CSS / CSS-in-JS DUPLICATE declaration block (copy-pasted rule body). A styling-domain advisory surfaced in fallow audit; defaults to warn (verdict-neutral). Set to error to gate, or off to silence.

css_selector_complexity: Severity

CSS selector / nesting / important-density complexity. A styling-domain advisory surfaced in fallow audit; defaults to warn (verdict-neutral). Set to error to gate, or off to silence.

css_dead_surface: Severity

CSS dead surface, such as unused scoped SFC classes. A styling-domain advisory surfaced in fallow audit; defaults to warn (verdict-neutral). Set to error to gate, or off to silence.

css_broken_reference: Severity

CSS broken references, such as missing classes or keyframes. A styling-domain advisory surfaced by deep CSS audit mode; defaults to warn (verdict-neutral). Set to error to gate, or off to silence.

complexity_cyclomatic: Severity

A function above the cyclomatic ceiling (health.maxCyclomatic or a thresholdOverrides entry). The threshold decides if the finding exists; this rule decides if it fails the run. Defaults to error. warn reports the finding without a failure, and off hides it. A finding above several ceilings takes the most severe of their rules. The rule applies before the health --min-severity band gate. After you set a kind to off, save the health baseline again: its entries for the hidden findings no longer match.

complexity_cognitive: Severity

A function above the cognitive ceiling (health.maxCognitive or a thresholdOverrides entry). The threshold decides if the finding exists; this rule decides if it fails the run. Defaults to error.

complexity_crap: Severity

A function above the CRAP ceiling (health.maxCrap or a thresholdOverrides entry). The threshold decides if the finding exists; this rule decides if it fails the run. Defaults to error. off hides the findings only. health.maxCrap: 0 also turns off the threshold-relative file-score signals.

unresolved_imports: Severity

An import specifier that resolves to no file or package. Defaults to error.

unlisted_dependencies: Severity

An imported package not declared in any relevant package.json. Defaults to error.

duplicate_exports: Severity

The same export name provided by multiple modules; ignoreExports excludes intentional barrel re-exports. Defaults to error.

type_only_dependencies: Severity

A production dependency imported only via type-only imports (a devDependencies candidate). Defaults to warn.

test_only_dependencies: Severity

A production dependency imported only by test files. Defaults to warn.

dev_dependencies_in_production: Severity

A devDependencies entry imported by production code, which a production-only install would omit and break at runtime. Defaults to warn.

circular_dependencies: Severity

A circular import chain between modules. Defaults to error.

re_export_cycle: Severity

A cycle or self-loop in the re-export subgraph (barrel files re-exporting from each other in a loop). Defaults to warn.

boundary_violation: Severity

An import crossing a forbidden architecture-boundary edge declared in the boundaries config. Defaults to error.

coverage_gaps: Severity

A runtime file or export with no test dependency path. Opt-in; defaults to off.

feature_flags: Severity

A detected feature-flag pattern (tuned via the flags config). Opt-in; defaults to off.

stale_suppressions: Severity

A fallow-ignore comment or @expected-unused tag that no longer matches any issue. Defaults to warn.

require_suppression_reason: Severity

Opt-in suppression hygiene rule: when enabled, every fallow-ignore-* comment and @expected-unused tag must carry a -- <reason> suffix.

unused_catalog_entries: Severity

A pnpm-workspace.yaml catalog entry referenced by no workspace package. Defaults to warn.

empty_catalog_groups: Severity

A named pnpm catalog group declaring no entries. Defaults to warn.

unresolved_catalog_references: Severity

A workspace package.json catalog: / catalog:<name> reference pointing at a catalog that does not declare the consumed package. Defaults to error; suppressible only via ignoreCatalogReferences.

unused_dependency_overrides: Severity

A pnpm, npm, or Bun override entry whose target package no workspace package.json declares and the active readable lockfile does not resolve. Defaults to warn.

misconfigured_dependency_overrides: Severity

A pnpm, npm, or Bun override or Bun resolutions entry whose key or value cannot be parsed in its declaration source’s grammar. Defaults to error.

security_client_server_leak: Severity

Opt-in (default off): a "use client" file that transitively imports a module reading a non-public process.env secret. Surfaced only by fallow security; never under bare fallow or the audit gate.

security_sink: Severity

Opt-in (default off): a syntactic tainted-sink candidate matched against the data-driven catalogue (security_matchers.toml). ONE knob gates ALL catalogue categories. Surfaced only by fallow security; never under bare fallow or the audit gate.

policy_violation: Severity

Master severity for rule-pack findings (rulePacks config). Defaults to warn so enabling a brand-new policy pack never hard-fails CI on its first run; individual pack rules opt up via "severity": "error". off is a kill switch that disables the whole evaluator (per-rule severity cannot resurrect it).

invalid_client_export: Severity

A "use client" file that exports a Next.js server-only / route-segment config name (e.g. metadata, revalidate, GET). Next.js rejects this at build time; fallow catches it statically. Defaults to warn.

mixed_client_server_barrel: Severity

A barrel file that re-exports BOTH a "use client" origin module AND a server-only origin module. Importing one name from such a barrel drags the other’s directive context across the React Server Components boundary (the Next.js App Router footgun). Defaults to warn.

misplaced_directive: Severity

A "use client" / "use server" directive written as an expression statement after a non-directive statement (an import, a const), so the RSC bundler parses it as an ordinary string and silently ignores it. The intended client/server boundary never takes effect. Defaults to warn.

route_collision: Severity

Two or more Next.js App Router route files that resolve to the same URL within one app-root. Next.js fails the build (“You cannot have two parallel pages that resolve to the same path”); fallow catches it statically and names every colliding file. Defaults to error: the project already fails next build, so flagging it as an error aligns fallow’s exit code with the build it mirrors.

dynamic_segment_name_conflict: Severity

Sibling Next.js dynamic route segments at one tree position using different param spellings ([id] vs [slug]). Next.js throws “You cannot use different slug names for the same dynamic path” at dev and production runtime when the position is hit; next build does NOT catch it (the build succeeds), so CI passes while the route crashes on its first request. fallow catches it statically. Defaults to error: the route is a deterministic runtime crash on first request, so failing CI is the honest signal even though next build stays green (this is the “error-runtime” severity tier, shared with route-collision).

Implementations

impl RulesConfig

pub const fn severity_for_kind(&self, kind: IssueKind) -> Severity

Map an IssueKind to its configured Severity in this config.

Single source of truth for the kind-to-severity mapping, shared by core suppression gating (severity_for_kind) and the agent capability manifest (fallow schema’s per-rule default_severity). Exhaustive by design: a new IssueKind variant is a compile error here, forcing the implementer to decide which RulesConfig field (if any) gates emission. Kinds with no matching field (Complexity, CodeDuplication, gated by their own command rather than a rule) return the non-Off Severity::Error; in core these short-circuit earlier via NON_CORE_KINDS so the value is unobservable there.

pub fn complexity_severity( &self, cyclomatic: bool, cognitive: bool, crap: bool, ) -> Severity

The gate severity of a complexity finding from the kinds that exceeded their threshold.

The most severe rule of the contributing kinds wins. The result is Off only when every contributing kind is off, and the finding is then dropped. A kind that did not contribute has no effect.

pub const fn apply_partial(&mut self, partial: &PartialRulesConfig)

Apply a partial rules config on top. Only Some fields override.

Trait Implementations

impl Clone for RulesConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RulesConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RulesConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RulesConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for RulesConfig

impl JsonSchema for RulesConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for RulesConfig

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for RulesConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RulesConfig