@@ -0,0 +1,12 @@
+### Fixed
+
+- `cargo fallow api --base <REF>` now reads the same libraries that
+  `visibility` treats as an external API. When `public-crates` of
+  `[workspace.metadata.fallow.visibility]` is set, the command reads only the
+  libraries that `public-crates` and `exclude-crates` name. A narrowed item of
+  an internal crate is then no `removed` finding.
+
+### Added
+
+- `cargo fallow api --public-crate <CRATE>` replaces `public-crates` for one
+  run. `--all-published` reads each published library and ignores the table.
@@ -5,6 +5,26 @@ published libraries of the workspace. A published library is a library whose
 `publish` is not `false`. The command compares HEAD with the merge base of HEAD
 and the ref, the same as `size --base`. `cargo fallow check` does not run it.
 
+The command reads the same libraries that `visibility` treats as an external
+API (see [Visibility](visibility.md)):
+
+- When `public-crates` of `[workspace.metadata.fallow.visibility]` is set, the
+  command reads only the libraries that `public-crates` and `exclude-crates`
+  name. A library with `publish = false` in the list counts too. Use this
+  when a workspace publishes internal crates only because a published crate
+  depends on them: a narrowed item of an internal crate is then no `removed`
+  finding.
+- Without `public-crates`, the command reads the published libraries and the
+  libraries of `exclude-crates`.
+- One selection reads both trees: the names of HEAD and the names of the
+  base. A library that a change removes together with its name still gives
+  `crate-removed`.
+- `--public-crate <CRATE>` replaces `public-crates`. The flag can repeat.
+- `--all-published` reads each published library and ignores both keys.
+
+A pattern of HEAD that matches no library is an error with the code
+`CARGO_FALLOW_INVALID_CONFIG`.
+
 ```bash
 cargo fallow api --base origin/main
 cargo fallow api --base origin/main -p app-core --format json
 
@@ -17,8 +17,8 @@ crate name or a package name, and `*` matches any text, for example
 `"my-api-*"`. The match is exact, so `my_api` and `my-api` differ: use the
 form of the crate name or of the package name. A pattern that matches no
 library is an error with the code `CARGO_FALLOW_INVALID_CONFIG`. The flag
-replaces the list of the key. `check`, `fix` and the `unused-feature` rule of
-`deps` read the key. fallow for TypeScript has the same option as
+replaces the list of the key. `check`, `fix`, `api` and the `unused-feature`
+rule of `deps` read the key. fallow for TypeScript has the same option as
 `publicPackages`.
 
 The exported items of these libraries are an external API. They are entry
 
@@ -3,7 +3,9 @@
 //!
 //! The command reads the full tree of the merge base, runs `cargo metadata
 //! --no-deps` on it, and builds the module graph of both versions. A
-//! published library is a library whose `publish` is not `false`. The
+//! published library is a library whose `publish` is not `false`. When
+//! `public-crates` of the `visibility` table is set, the published libraries
+//! are the libraries that it and `exclude-crates` name. The
 //! command compares the keys of [`surface`]: each public path of each item.
 //!
 //! - A key that only HEAD has is `added`. A key that only the base has is
@@ -64,6 +66,34 @@ pub struct ApiArgs {
     /// with no breaking version bump.
     #[arg(long)]
     fail_on_issues: bool,
+    /// A library whose API the command reads. The flag replaces
+    /// `public-crates` of the visibility table. A crate or package name, with
+    /// `*` as a glob. The flag can repeat.
+    #[arg(long, value_name = "CRATE", conflicts_with = "all_published")]
+    public_crate: Vec<String>,
+    /// Read each library that a registry can publish, and ignore
+    /// `public-crates` and `exclude-crates`.
+    #[arg(long)]
+    all_published: bool,
+}
+
+impl ApiArgs {
+    /// The libraries of HEAD that the run reads, before the base tree loads:
+    /// a bad table or pattern stops the run early.
+    fn head_selection(&self, head: &workspace::Workspace) -> Result<surface::Selection, CliError> {
+        if self.all_published {
+            return Ok(surface::Selection::published());
+        }
+        let (exclude, public) = crate::visibility::config::external_api(head)?;
+        if self.public_crate.is_empty() {
+            return Ok(surface::Selection { exclude, public });
+        }
+        crate::visibility::config::check_public(head, &self.public_crate)?;
+        Ok(surface::Selection {
+            exclude,
+            public: Some(self.public_crate.clone()),
+        })
+    }
 }
 
 /// The kind of one change.
@@ -181,12 +211,19 @@ pub fn run(args: &ApiArgs) -> Result<Section, CliError> {
     let root = head.root.as_std_path();
     let merge_base = crate::structure::git::merge_base(root, &args.base)?;
     let scope = Scope::load(&head, &args.common.scope)?;
+    let mut selection = args.head_selection(&head)?;
     progress.step("Reading the tree of the merge base");
     let tree = tree::checkout(root, &merge_base)?;
     let base = workspace::load(Some(&tree.root.join("Cargo.toml")), &cargo_flags)?;
+    // One selection reads both trees, so a change of the lists gives no
+    // crate finding. The table of the base adds its names: a library that a
+    // change removes together with its name still gives `crate-removed`.
+    if !args.all_published && args.public_crate.is_empty() {
+        selection.add_base(&base);
+    }
     progress.step("Reading the API of the published libraries");
-    let before = surface::surface(&base);
-    let after = surface::surface(&head);
+    let before = surface::surface(&base, &selection);
+    let after = surface::surface(&head, &selection);
     // `-p` keeps the findings of the packages that it names: a finding
     // belongs to its package, also when the item comes from another crate.
     let manifests: BTreeMap<&String, &String> = before
 
@@ -62,8 +62,56 @@ pub struct Surface {
     pub versions: BTreeMap<String, String>,
 }
 
+/// The libraries that `api` reads.
+#[derive(Debug, Clone, Default)]
+pub struct Selection {
+    /// The `exclude-crates` list of the `visibility` table.
+    pub exclude: Vec<String>,
+    /// The `public-crates` patterns of the `visibility` table, or `None`.
+    pub public: Option<Vec<String>>,
+}
+
+impl Selection {
+    /// The libraries that a registry can publish, with no table.
+    pub const fn published() -> Self {
+        Self {
+            exclude: Vec::new(),
+            public: None,
+        }
+    }
+
+    /// Adds the names of the table of the base tree. A base table that is not
+    /// valid adds nothing. Without `public-crates` at HEAD, the base list
+    /// adds nothing either.
+    pub fn add_base(&mut self, base: &Workspace) {
+        let Ok((exclude, public)) = crate::visibility::config::external_api(base) else {
+            return;
+        };
+        for name in exclude {
+            if !self.exclude.contains(&name) {
+                self.exclude.push(name);
+            }
+        }
+        if let (Some(list), Some(names)) = (&mut self.public, public) {
+            for name in names {
+                if !list.contains(&name) {
+                    list.push(name);
+                }
+            }
+        }
+    }
+
+    /// True when `api` reads the library: a library that `visibility` treats
+    /// as an external API. Without `public-crates`, these are the libraries
+    /// that a registry can publish and the excluded libraries.
+    fn reads(&self, krate: &graph::Crate) -> bool {
+        krate.kind.is_library()
+            && crate::visibility::is_api(krate, &self.exclude, self.public.as_deref())
+    }
+}
+
 /// Reads the API of each published library of `workspace`.
-pub fn surface(workspace: &Workspace) -> Surface {
+pub fn surface(workspace: &Workspace, selection: &Selection) -> Surface {
     let module_graph = graph::build(workspace, &graph::Production::default());
     let resolver = Resolver::new(&module_graph);
     let walker = Walker::new(workspace, &module_graph, &resolver);
@@ -74,7 +122,7 @@ pub fn surface(workspace: &Workspace) -> Surface {
             .insert(member.name.clone(), member.version.clone());
     }
     for (id, krate) in module_graph.crates.iter().enumerate() {
-        if !krate.published || !krate.kind.is_library() {
+        if !selection.reads(krate) {
             continue;
         }
         let Some(member) = workspace
 
@@ -76,9 +76,20 @@ pub fn api_crates(workspace: &Workspace) -> Option<(Vec<String>, Vec<String>)> {
         })
 }
 
+/// The `exclude-crates` list and the `public-crates` patterns of the table,
+/// for `api`. The patterns are `None` when the table has no `public-crates`.
+/// A pattern that matches no library is an error.
+pub fn external_api(workspace: &Workspace) -> Result<(Vec<String>, Option<Vec<String>>), CliError> {
+    let config: Config = crate::structure::config::section(workspace, KEY)?;
+    if let Some(patterns) = &config.public_crates {
+        check_public(workspace, patterns)?;
+    }
+    Ok((config.exclude_crates, config.public_crates))
+}
+
 /// Fails when a `public-crates` pattern matches no library of the workspace.
 /// A typo would make each library internal without notice.
-fn check_public(workspace: &Workspace, patterns: &[String]) -> Result<(), CliError> {
+pub fn check_public(workspace: &Workspace, patterns: &[String]) -> Result<(), CliError> {
     for pattern in patterns {
         let matched = workspace.members.iter().any(|member| {
             member
 
@@ -430,3 +430,111 @@ fn a_rule_set_to_off_removes_its_findings() {
     );
     assert!(kinds.contains("removed"), "{report:#}");
 }
+
+/// With `public-crates`, `api` reads only the libraries that the list names,
+/// so the removals of the unlisted `demo` give no finding. These are
+/// the libraries that `visibility` treats as an external API. A library
+/// with `publish = false` in the list counts too.
+#[test]
+fn public_crates_selects_the_libraries_of_api() {
+    let repo = Repo::new("0.3.2");
+    let manifest = repo.root().join("Cargo.toml");
+    let text = fs::read_to_string(&manifest).expect("read the manifest");
+    let with = |list: &str| {
+        fs::write(
+            &manifest,
+            format!("{text}\n[workspace.metadata.fallow.visibility]\npublic-crates = [{list}]\n"),
+        )
+        .expect("write the manifest");
+    };
+    with("\"fresh\", \"internal\"");
+    let (code, report) = repo.json(&["api", "--base", "main", "--fail-on-issues"]);
+    assert_eq!(code, 0, "{report:#}");
+    assert_eq!(
+        changes(&report),
+        [entry("fresh", "crate-added", "fresh")],
+        "{report:#}"
+    );
+    assert_eq!(report["summary"]["crates"], 2, "{report:#}");
+    with("\"nothing-*\"");
+    let (code, report) = repo.json(&["api", "--base", "main"]);
+    assert_eq!(code, 2, "{report:#}");
+    assert_eq!(report["code"], "CARGO_FALLOW_INVALID_CONFIG", "{report:#}");
+}
+
+/// A library that a change deletes together with its name in
+/// `public-crates` still gives `crate-removed`: the list of the base adds its
+/// names.
+#[test]
+fn a_library_removed_with_its_public_crates_name_is_crate_removed() {
+    let dir = tempfile::tempdir().expect("create a temporary directory");
+    let repo = Repo { dir };
+    let root = repo.root().to_path_buf();
+    let write_root = |members: &str, list: &str| {
+        fs::write(
+            root.join("Cargo.toml"),
+            format!(
+                "[workspace]\nmembers = [{members}]\nresolver = \"3\"\n\n[workspace.metadata.fallow.visibility]\npublic-crates = [{list}]\n"
+            ),
+        )
+        .expect("write the root manifest");
+    };
+    write_root("\"a\", \"b\"", "\"a\", \"b\"");
+    package(&root, "a", "0.1.0", "", "", "pub fn a() {}\n");
+    package(&root, "b", "0.1.0", "", "", "pub fn b() {}\n");
+    repo.git(&["init", "-q"]);
+    repo.git(&["add", "-A"]);
+    repo.git(&["commit", "-q", "-m", "base"]);
+    repo.git(&["checkout", "-q", "-b", "feature"]);
+    fs::remove_dir_all(root.join("b")).expect("remove b");
+    write_root("\"a\"", "\"a\"");
+    repo.git(&["add", "-A"]);
+    repo.git(&["commit", "-q", "-m", "head"]);
+    let (code, report) = repo.json(&["api", "--base", "main"]);
+    assert_eq!(code, 0, "{report:#}");
+    assert_eq!(
+        changes(&report),
+        [entry("b", "crate-removed", "b")],
+        "{report:#}"
+    );
+}
+
+/// `exclude-crates` adds a library without `public-crates`, as for
+/// `visibility`. `--public-crate` replaces the list, and `--all-published`
+/// reads each library that a registry can publish.
+#[test]
+fn the_flags_and_exclude_crates_select_the_libraries() {
+    let repo = Repo::new("0.3.2");
+    let manifest = repo.root().join("Cargo.toml");
+    let text = fs::read_to_string(&manifest).expect("read the manifest");
+    fs::write(
+        &manifest,
+        format!(
+            "{text}\n[workspace.metadata.fallow.visibility]\nexclude-crates = [\"internal\"]\n"
+        ),
+    )
+    .expect("write the manifest");
+    let crates = |args: &[&str]| -> Value {
+        let mut all = vec!["api", "--base", "main"];
+        all.extend_from_slice(args);
+        let (code, report) = repo.json(&all);
+        assert_eq!(code, 0, "{report:#}");
+        report["summary"]["crates"].clone()
+    };
+    assert_eq!(crates(&[]), 4);
+    assert_eq!(crates(&["--all-published"]), 3);
+    assert_eq!(
+        crates(&["--public-crate", "fresh"]),
+        2,
+        "fresh and the excluded internal"
+    );
+    let (code, _) = repo.json(&[
+        "api",
+        "--base",
+        "main",
+        "--public-crate",
+        "fresh",
+        "--all-published",
+    ]);
+    assert_eq!(code, 2);
+}