fallow 2.85.0 → 2.87.0

package/schema.json

@@ -1,11 +1,9 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "title": "FallowConfig",
-  "description": "User-facing configuration loaded from `.fallowrc.json`, `.fallowrc.jsonc`, `fallow.toml`, or `.fallow.toml`.\n\n# Examples\n\n```\nuse fallow_config::FallowConfig;\n\n// Default config has sensible defaults\nlet config = FallowConfig::default();\nassert!(config.entry.is_empty());\nassert!(!config.production);\n\n// Deserialize from JSON\nlet config: FallowConfig = serde_json::from_str(r#\"{\n    \"entry\": [\"src/main.ts\"],\n    \"production\": true\n}\"#).unwrap();\nassert_eq!(config.entry, vec![\"src/main.ts\"]);\nassert!(config.production);\n```",
   "type": "object",
   "properties": {
     "$schema": {
-      "description": "JSON Schema reference (ignored during deserialization).",
       "type": [
         "string",
         "null"
@@ -13,7 +11,6 @@
       "writeOnly": true
     },
     "extends": {
-      "description": "Base config files to extend from.\n\nSupports three resolution strategies:\n- **Relative paths**: `\"./base.json\"` — resolved relative to the config file.\n- **npm packages**: `\"npm:@co/config\"` — resolved by walking up `node_modules/`.\n  Package resolution checks `package.json` `exports`/`main` first, then falls back\n  to standard config file names. Subpaths are supported (e.g., `npm:@co/config/strict.json`).\n- **HTTPS URLs**: `\"https://example.com/fallow-base.json\"` — fetched remotely.\n  Only HTTPS is supported (no plain HTTP). URL-sourced configs may extend other\n  URLs or `npm:` packages, but not relative paths. Only JSON/JSONC format is\n  supported for remote configs. Timeout is configurable via\n  `FALLOW_EXTENDS_TIMEOUT_SECS` (default: 5s).\n\nBase configs are loaded first, then this config's values override them.\nLater entries in the array override earlier ones.\n\n**Note:** `npm:` resolution uses `node_modules/` directory walk-up and is\nincompatible with Yarn Plug'n'Play (PnP), which has no `node_modules/`.\nURL extends fetch on every run (no caching). For reliable CI, prefer `npm:`\nfor private or critical configs.",
       "type": "array",
       "items": {
         "type": "string"
@@ -21,7 +18,6 @@
       "writeOnly": true
     },
     "entry": {
-      "description": "Additional entry point glob patterns.",
       "type": "array",
       "items": {
         "type": "string"
@@ -29,7 +25,6 @@
       "default": []
     },
     "ignorePatterns": {
-      "description": "Glob patterns to ignore from analysis.",
       "type": "array",
       "items": {
         "type": "string"
@@ -37,7 +32,6 @@
       "default": []
     },
     "framework": {
-      "description": "Custom framework definitions (inline plugin definitions).",
       "type": "array",
       "items": {
         "$ref": "#/$defs/ExternalPluginDef"
@@ -45,7 +39,6 @@
       "default": []
     },
     "workspaces": {
-      "description": "Workspace overrides.",
       "anyOf": [
         {
           "$ref": "#/$defs/WorkspaceConfig"
@@ -57,7 +50,6 @@
       "default": null
     },
     "ignoreDependencies": {
-      "description": "Dependencies to ignore (always considered used and always considered available).\n\nListed dependencies are excluded from both unused dependency and unlisted\ndependency detection. Useful for runtime-provided packages like `bun:sqlite`\nor implicitly available dependencies.",
       "type": "array",
       "items": {
         "type": "string"
@@ -65,7 +57,6 @@
       "default": []
     },
     "ignoreUnresolvedImports": {
-      "description": "Import specifier glob patterns whose `unresolved-import` findings are\nexpected and should be suppressed.\n\nMatching is against the raw import specifier string, not a filesystem\npath. Exact specifiers and subpaths must be listed separately when both\nshould be ignored, for example `[\"@example/icons\", \"@example/icons/**\"]`.\nBroad patterns such as `\"**\"` can hide real missing modules, so keep\nthis list focused on generated or runtime-provided specifiers.",
       "type": "array",
       "items": {
         "type": "string"
@@ -73,7 +64,6 @@
       "default": []
     },
     "ignoreExports": {
-      "description": "Export ignore rules.",
       "type": "array",
       "items": {
         "$ref": "#/$defs/IgnoreExportRule"
@@ -81,33 +71,28 @@
       "default": []
     },
     "ignoreCatalogReferences": {
-      "description": "Rules for suppressing `unresolved-catalog-reference` findings.\n\nEach rule matches by package name, optionally scoped to a specific\ncatalog and/or consumer `package.json` glob. Useful for staged catalog\nmigrations where the catalog edit lands separately from the consumer\nedit, and for library-internal placeholder packages whose target\ncatalog isn't ready yet.",
       "type": "array",
       "items": {
         "$ref": "#/$defs/IgnoreCatalogReferenceRule"
       }
     },
     "ignoreDependencyOverrides": {
-      "description": "Rules for suppressing `unused-dependency-override` and\n`misconfigured-dependency-override` findings.\n\nEach rule matches by override target package, optionally scoped to the\ndeclaring source file (`pnpm-workspace.yaml` or `package.json`). Useful\nfor overrides targeting purely-transitive packages (CVE-fix pattern)\nwhere the conservative static algorithm would otherwise cry wolf.",
       "type": "array",
       "items": {
         "$ref": "#/$defs/IgnoreDependencyOverrideRule"
       }
     },
     "ignoreExportsUsedInFile": {
-      "description": "Suppress unused-export findings when the exported symbol is referenced\ninside the file that declares it. This mirrors Knip's\n`ignoreExportsUsedInFile` option while still reporting exports that have\nno references at all.",
       "$ref": "#/$defs/IgnoreExportsUsedInFileConfig",
       "default": false
     },
     "ignoreDecorators": {
-      "description": "Decorators that fallow should NOT treat as evidence of reflective use.\nMembers carrying only these decorators are checked for usage as if they\nwere undecorated. Members carrying any decorator NOT in this list stay\nskipped (frameworks like NestJS, Angular, TypeORM rely on reflection so\nthe conservative default is to keep skipping).\n\nMatching rule: entries containing `.` (e.g. `\"decorators.log\"`) match\nthe full dotted path of a decorator. Bare entries (e.g. `\"step\"` or\n`\"decorators\"`) match the leftmost segment; a bare `\"decorators\"` entry\nthus collapses every `@decorators.*` decorator. Both `\"@step\"` and\n`\"step\"` round-trip equivalently (a leading `@` is stripped before\nmatching).\n\nEntries that never match a decorator in the analyzed codebase produce\na one-time warning at end of run, mirroring the existing\n`usedClassMembers` warn-on-unmatched-pattern behavior. See issue #471.",
       "type": "array",
       "items": {
         "type": "string"
       }
     },
     "usedClassMembers": {
-      "description": "Class member method/property rules that should never be flagged as\nunused. Supports plain member names for global suppression and scoped\nobjects with `extends` / `implements` constraints for framework-invoked\nmethods that should only be suppressed on matching classes.",
       "type": "array",
       "items": {
         "$ref": "#/$defs/UsedClassMemberRule"
@@ -115,7 +100,6 @@
       "default": []
     },
     "duplicates": {
-      "description": "Duplication detection settings.",
       "$ref": "#/$defs/DuplicatesConfig",
       "default": {
         "enabled": true,
@@ -135,12 +119,12 @@
       }
     },
     "health": {
-      "description": "Complexity health metrics settings.",
       "$ref": "#/$defs/HealthConfig",
       "default": {
         "maxCyclomatic": 20,
         "maxCognitive": 15,
         "maxCrap": 30.0,
+        "crapRefactorBand": 5,
         "ignore": [],
         "ownership": {
           "botPatterns": [
@@ -157,7 +141,6 @@
       }
     },
     "rules": {
-      "description": "Per-issue-type severity rules.",
       "$ref": "#/$defs/RulesConfig",
       "default": {
         "unused-files": "error",
@@ -184,11 +167,12 @@
         "empty-catalog-groups": "warn",
         "unresolved-catalog-references": "error",
         "unused-dependency-overrides": "warn",
-        "misconfigured-dependency-overrides": "error"
+        "misconfigured-dependency-overrides": "error",
+        "security-client-server-leak": "off",
+        "security-sink": "off"
       }
     },
     "boundaries": {
-      "description": "Architecture boundary enforcement configuration.",
       "$ref": "#/$defs/BoundaryConfig",
       "default": {
         "zones": [],
@@ -196,14 +180,16 @@
       }
     },
     "flags": {
-      "description": "Feature flag detection configuration.",
       "$ref": "#/$defs/FlagsConfig",
       "default": {
         "configObjectHeuristics": false
       }
     },
+    "security": {
+      "$ref": "#/$defs/SecurityConfig",
+      "default": {}
+    },
     "fix": {
-      "description": "Auto-fix behavior settings.",
       "$ref": "#/$defs/FixConfig",
       "default": {
         "catalog": {
@@ -212,17 +198,14 @@
       }
     },
     "resolve": {
-      "description": "Module resolver configuration (custom conditions, etc.).",
       "$ref": "#/$defs/ResolveConfig",
       "default": {}
     },
     "production": {
-      "description": "Production mode: exclude test/dev files, only start/build scripts.\n\nAccepts the legacy boolean form (`true` applies to all analyses) or a\nper-analysis object (`{ \"deadCode\": false, \"health\": true, \"dupes\": false }`).",
       "$ref": "#/$defs/ProductionConfig",
       "default": false
     },
     "plugins": {
-      "description": "Paths to external plugin files or directories containing plugin files.\n\nSupports TOML, JSON, and JSONC formats.\n\nIn addition to these explicit paths, fallow automatically discovers:\n- `*.toml`, `*.json`, `*.jsonc` files in `.fallow/plugins/`\n- `fallow-plugin-*.{toml,json,jsonc}` files in the project root",
       "type": "array",
       "items": {
         "type": "string"
@@ -230,7 +213,6 @@
       "default": []
     },
     "dynamicallyLoaded": {
-      "description": "Glob patterns for files that are dynamically loaded at runtime\n(plugin directories, locale files, etc.). These files are treated as\nalways-used and will never be flagged as unused.",
       "type": "array",
       "items": {
         "type": "string"
@@ -238,7 +220,6 @@
       "default": []
     },
     "overrides": {
-      "description": "Per-file rule overrides matching oxlint's overrides pattern.",
       "type": "array",
       "items": {
         "$ref": "#/$defs/ConfigOverride"
@@ -246,14 +227,12 @@
       "default": []
     },
     "codeowners": {
-      "description": "Path to a CODEOWNERS file for `--group-by owner`.\n\nWhen unset, fallow auto-probes `CODEOWNERS`, `.github/CODEOWNERS`,\n`.gitlab/CODEOWNERS`, and `docs/CODEOWNERS`. Set this to use a\nnon-standard location.",
       "type": [
         "string",
         "null"
       ]
     },
     "publicPackages": {
-      "description": "Workspace package name patterns that are public libraries.\nExported API surface from these packages is not flagged as unused.",
       "type": "array",
       "items": {
         "type": "string"
@@ -261,7 +240,6 @@
       "default": []
     },
     "regression": {
-      "description": "Regression detection baseline embedded in config.\nStores issue counts from a known-good state for CI regression checks.\nPopulated by `--save-regression-baseline` (no path), read by `--fail-on-regression`.",
       "anyOf": [
         {
           "$ref": "#/$defs/RegressionConfig"
@@ -272,26 +250,21 @@
       ]
     },
     "audit": {
-      "description": "Audit command baseline paths (one per analysis: dead-code, health, dupes).\n\n`fallow audit` runs three analyses and each has its own baseline format.\nPaths in this section are resolved relative to the project root. CLI flags\n(`--dead-code-baseline`, `--health-baseline`, `--dupes-baseline`) override\nthese values when provided.",
       "$ref": "#/$defs/AuditConfig"
     },
     "sealed": {
-      "description": "Mark this config as sealed: `extends` paths must be file-relative and\nresolve within this config's own directory. `npm:` and `https:` extends\nare rejected. Useful for library publishers and monorepo sub-packages\nthat want to guarantee their config is self-contained and not subject\nto ancestor configs being injected via `extends`.\n\nDiscovery is unaffected (first-match-wins already stops the directory\nwalk at the nearest config). This only constrains `extends`.",
       "type": "boolean",
       "default": false
     },
     "includeEntryExports": {
-      "description": "Report unused exports in entry files instead of auto-marking them as\nused. Catches typos in framework exports (e.g. `meatdata` instead of\n`metadata`). The CLI flag `--include-entry-exports` (global) overrides\nthis when set; otherwise the config value is used.",
       "type": "boolean",
       "default": false
     },
     "autoImports": {
-      "description": "Resolve framework convention auto-imports (Nuxt components) as real\nmodule-graph edges, and stop treating the covered convention directories\nas always-used entry points.\n\nWhen `false` (default), auto-import edges are still synthesized additively\n(so a component's default export consumed via a `<Card />` template tag is\ncredited under `includeEntryExports`), but the convention directories stay\nregistered as entry points, so genuinely-unreferenced components are never\nreported as `unused-file`.\n\nWhen `true`, the Nuxt plugin drops its component entry patterns\n(`components/**`, `app/components/**`) so an unreferenced component is\nreported as `unused-file`. This is opt-in because non-flat projects\n(custom `prefix` / `pathPrefix` / `dirs` in `nuxt.config`, dynamic\n`<component :is>`, `@nuxt/content` MDC) are not fully modeled yet and could\nproduce false positives. As a guard, if `nuxt.config` declares a\n`components:` key the entry patterns are kept regardless. Composable and\nutil entry patterns are unaffected until convention resolution covers\nthem. See issue #704.",
       "type": "boolean",
       "default": false
     },
     "cache": {
-      "description": "Incremental cache tuning. Today the only knob is `maxSizeMb`, which\ncaps the on-disk cache and triggers LRU eviction during save. See\n[`CacheConfig`].",
       "$ref": "#/$defs/CacheConfig"
     }
   },
@@ -583,22 +556,19 @@
       ]
     },
     "IgnoreCatalogReferenceRule": {
-      "description": "Rule for suppressing an `unresolved-catalog-reference` finding.\n\nA finding is suppressed when ALL provided fields match the finding:\n- `package` matches the consumed package name exactly (case-sensitive).\n- `catalog`, if set, matches the referenced catalog name (`\"default\"` for\n  bare `catalog:` references; named catalogs use their declared key). When\n  omitted, any catalog matches.\n- `consumer`, if set, is a glob matched against the consumer `package.json`\n  path relative to the project root. When omitted, any consumer matches.\n\nTypical use cases:\n- Staged migrations: catalog entry is being added in a separate PR\n- Library-internal placeholder packages whose target catalog isn't ready yet",
+      "description": "Rule for suppressing an `unresolved-catalog-reference` finding.",
       "type": "object",
       "properties": {
         "package": {
-          "description": "Package name being referenced via the catalog protocol (exact match).",
           "type": "string"
         },
         "catalog": {
-          "description": "Catalog name to scope the suppression to. `None` matches any catalog.",
           "type": [
             "string",
             "null"
           ]
         },
         "consumer": {
-          "description": "Glob (root-relative) for the consumer `package.json`. `None` matches any consumer.",
           "type": [
             "string",
             "null"
@@ -611,15 +581,13 @@
       ]
     },
     "IgnoreDependencyOverrideRule": {
-      "description": "Rule for suppressing an `unused-dependency-override` or\n`misconfigured-dependency-override` finding.\n\nA finding is suppressed when ALL provided fields match the finding:\n- `package` matches the override's target package name exactly\n  (case-sensitive). For parent-chain overrides (`react>react-dom`), the\n  target is the rightmost segment (`react-dom`).\n- `source`, if set, scopes the suppression to overrides declared in that\n  source file. Accepts `\"pnpm-workspace.yaml\"` or `\"package.json\"`.\n  When omitted, both sources match.\n\nTypical use cases:\n- Library-internal CI tooling overrides we cannot drop yet\n- Overrides targeting purely-transitive packages (CVE-fix pattern)",
+      "description": "Rule for suppressing dependency-override findings.",
       "type": "object",
       "properties": {
         "package": {
-          "description": "Override target package name (exact match; case-sensitive).",
           "type": "string"
         },
         "source": {
-          "description": "Source file scope: `\"pnpm-workspace.yaml\"` or `\"package.json\"`.\n`None` matches both sources.",
           "type": [
             "string",
             "null"
@@ -632,29 +600,23 @@
       ]
     },
     "IgnoreExportsUsedInFileConfig": {
-      "description": "Controls whether exports referenced only inside their defining file are\nreported as unused exports.",
       "anyOf": [
         {
-          "description": "`true` suppresses both value and type exports that are referenced in\ntheir defining file. `false` preserves the default cross-file behavior.",
           "type": "boolean"
         },
         {
-          "description": "Knip-compatible fine-grained form. Fallow groups type aliases and\ninterfaces under `unused_types`, so either field enables type-export\nsuppression for same-file references.",
           "$ref": "#/$defs/IgnoreExportsUsedInFileByKind"
         }
       ]
     },
     "IgnoreExportsUsedInFileByKind": {
-      "description": "Knip-compatible `ignoreExportsUsedInFile` object form.",
       "type": "object",
       "properties": {
         "type": {
-          "description": "Suppress same-file references for exported type aliases.",
           "type": "boolean",
           "default": false
         },
         "interface": {
-          "description": "Suppress same-file references for exported interfaces.",
           "type": "boolean",
           "default": false
         }
@@ -828,6 +790,14 @@
           "format": "double",
           "default": 30.0
         },
+        "crapRefactorBand": {
+          "description": "Band below `maxCyclomatic` where CRAP-only findings also receive a\nsecondary `refactor-function` action (default: 5). Set to `0` to only\nsuggest refactoring when cyclomatic already meets the configured\nthreshold.",
+          "type": "integer",
+          "format": "uint16",
+          "minimum": 0,
+          "maximum": 65535,
+          "default": 5
+        },
         "ignore": {
           "description": "Glob patterns to exclude from complexity analysis.",
           "type": "array",
@@ -1012,6 +982,16 @@
         "misconfigured-dependency-overrides": {
           "$ref": "#/$defs/Severity",
           "default": "error"
+        },
+        "security-client-server-leak": {
+          "description": "Opt-in (default off): a `\"use client\"` file that transitively imports a\nmodule reading a non-public `process.env` secret. Surfaced only by\n`fallow security`; never under bare `fallow` or the `audit` gate.",
+          "$ref": "#/$defs/Severity",
+          "default": "off"
+        },
+        "security-sink": {
+          "description": "Opt-in (default off): a syntactic tainted-sink candidate matched against\nthe data-driven catalogue (`security_matchers.toml`). ONE knob gates ALL\ncatalogue categories. Surfaced only by `fallow security`; never under\nbare `fallow` or the `audit` gate.",
+          "$ref": "#/$defs/Severity",
+          "default": "off"
         }
       }
     },
@@ -1036,11 +1016,11 @@
       ]
     },
     "BoundaryConfig": {
-      "description": "Architecture boundary configuration.\n\nDefines zones (directory groupings) and rules (which zones may import from which).\nOptionally uses a built-in preset as a starting point.\n\n# Examples\n\n```\nuse fallow_config::BoundaryConfig;\n\nlet json = r#\"{\n    \"zones\": [\n        { \"name\": \"ui\", \"patterns\": [\"src/components/**\"] },\n        { \"name\": \"db\", \"patterns\": [\"src/db/**\"] }\n    ],\n    \"rules\": [\n        { \"from\": \"ui\", \"allow\": [\"db\"] }\n    ]\n}\"#;\nlet config: BoundaryConfig = serde_json::from_str(json).unwrap();\nassert_eq!(config.zones.len(), 2);\nassert_eq!(config.rules.len(), 1);\n```\n\nUsing a preset:\n\n```\nuse fallow_config::BoundaryConfig;\n\nlet json = r#\"{ \"preset\": \"layered\" }\"#;\nlet mut config: BoundaryConfig = serde_json::from_str(json).unwrap();\nconfig.expand(\"src\");\nassert_eq!(config.zones.len(), 4);\nassert_eq!(config.rules.len(), 4);\n```",
+      "description": "Architecture boundary configuration.",
       "type": "object",
       "properties": {
         "preset": {
-          "description": "Built-in architecture preset. When set, expands into default zones and rules.\nUser-defined zones and rules merge on top: zones with the same name replace\nthe preset zone; rules with the same `from` replace the preset rule.\nPreset patterns use `{rootDir}/{zone}/**` where rootDir is auto-detected\nfrom tsconfig.json (falls back to `src`).\nNote: preset patterns are flat (`src/<zone>/**`). For monorepos with\nper-package source directories, define zones explicitly instead.",
+          "description": "Optional built-in preset.",
           "anyOf": [
             {
               "$ref": "#/$defs/BoundaryPreset"
@@ -1051,7 +1031,7 @@
           ]
         },
         "zones": {
-          "description": "Named zones mapping directory patterns to architectural layers.",
+          "description": "Zone definitions.",
           "type": "array",
           "items": {
             "$ref": "#/$defs/BoundaryZone"
@@ -1059,7 +1039,7 @@
           "default": []
         },
         "rules": {
-          "description": "Import rules between zones. A zone with a rule entry can only import\nfrom the listed zones (plus itself). A zone without a rule entry is unrestricted.",
+          "description": "Zone import rules.",
           "type": "array",
           "items": {
             "$ref": "#/$defs/BoundaryRule"
@@ -1069,54 +1049,54 @@
       }
     },
     "BoundaryPreset": {
-      "description": "Built-in architecture presets.\n\nEach preset expands into a set of zones and import rules for a common\narchitecture pattern. User-defined zones and rules merge on top of the\npreset defaults (zones with the same name replace the preset zone;\nrules with the same `from` replace the preset rule).\n\n# Examples\n\n```\nuse fallow_config::BoundaryPreset;\n\nlet preset: BoundaryPreset = serde_json::from_str(r#\"\"layered\"\"#).unwrap();\nassert!(matches!(preset, BoundaryPreset::Layered));\n```",
+      "description": "Built-in architecture presets.",
       "oneOf": [
         {
-          "description": "Classic layered architecture: presentation → application → domain ← infrastructure.\nInfrastructure may also import from application (common in DI frameworks).",
+          "description": "Layered architecture.",
           "type": "string",
           "const": "layered"
         },
         {
-          "description": "Hexagonal / ports-and-adapters: adapters → ports → domain.",
+          "description": "Hexagonal / ports-and-adapters.",
           "type": "string",
           "const": "hexagonal"
         },
         {
-          "description": "Feature-Sliced Design: app > pages > widgets > features > entities > shared.\nEach layer may only import from layers below it.",
+          "description": "Feature-Sliced Design.",
           "type": "string",
           "const": "feature-sliced"
         },
         {
-          "description": "Bulletproof React: app → features → shared + server.\nFeature modules are isolated from each other via `autoDiscover`: every\nimmediate child of `src/features/` becomes its own `features/<name>` zone,\nand cross-feature imports are reported as boundary violations.\nTop-level files in `src/features/` are classified by the logical\n`features` parent zone, so barrels can re-export child features while\nnon-barrel top-level files still obey the `features` boundary rule.",
+          "description": "Bulletproof React.",
           "type": "string",
           "const": "bulletproof"
         }
       ]
     },
     "BoundaryZone": {
-      "description": "A named zone grouping files by directory pattern.",
+      "description": "A zone grouping files by directory pattern.",
       "type": "object",
       "properties": {
         "name": {
-          "description": "Zone identifier referenced in rules (e.g., `\"ui\"`, `\"database\"`, `\"shared\"`).",
+          "description": "Zone name.",
           "type": "string"
         },
         "patterns": {
-          "description": "Glob patterns (relative to project root) that define zone membership.\nA file belongs to the first zone whose pattern matches.",
+          "description": "Membership patterns.",
           "type": "array",
           "items": {
             "type": "string"
           }
         },
         "autoDiscover": {
-          "description": "Directories whose immediate child directories should become separate\nzones under this logical group.\n\nFor example, `{ \"name\": \"features\", \"autoDiscover\": [\"src/features\"] }`\ncreates zones such as `features/auth` and `features/billing`, each with\na pattern for its own subtree. Rules that reference `features` expand to\nevery discovered child zone. If `patterns` is also set, the parent zone\nremains as a fallback after discovered child zones.",
+          "description": "Directories whose children become zones.",
           "type": "array",
           "items": {
             "type": "string"
           }
         },
         "root": {
-          "description": "Optional subtree scope for monorepo per-package boundaries.\n\nWhen set, the zone's `patterns` are matched against paths *relative*\nto this directory rather than the project root. At classification\ntime, fallow checks that a candidate path starts with `root` and\nstrips that prefix before glob-matching the patterns against the\nremainder. Files outside the subtree never match the zone.\n\nUseful for monorepos where each package has the same internal\ndirectory layout: instead of writing `packages/app/src/**` and\n`packages/core/src/**` (which collide on shared zone names), set\n`root: \"packages/app/\"` and `patterns: [\"src/**\"]` per package.\n\nTrailing slash and leading `./` are normalized; backslashes are\nconverted to forward slashes. Patterns must NOT redundantly include\nthe root prefix: `root: \"packages/app/\"` with\n`patterns: [\"packages/app/src/**\"]` is rejected with\n`FALLOW-BOUNDARY-ROOT-REDUNDANT-PREFIX` because patterns are\nresolved relative to the root.",
+          "description": "Optional subtree scope.",
           "type": [
             "string",
             "null"
@@ -1132,11 +1112,11 @@
       "type": "object",
       "properties": {
         "from": {
-          "description": "The zone this rule applies to (the importing side).",
+          "description": "Source zone.",
           "type": "string"
         },
         "allow": {
-          "description": "Zones that `from` is allowed to import from. Self-imports are always allowed.\nAn empty list means the zone may not import from any other zone.",
+          "description": "Allowed target zones.",
           "type": "array",
           "items": {
             "type": "string"
@@ -1144,7 +1124,7 @@
           "default": []
         },
         "allowTypeOnly": {
-          "description": "Zones that `from` may type-only-import from even when not listed in\n`allow`. Mirrors the `allow` shape: a list of target zone names. A\ntype-only import declaration (`import type {...}`, `import type * as ns`,\nor a per-specifier inline `type` qualifier on every named specifier) to a\nlisted zone is not reported as a boundary violation. Mixed-specifier\nimports (`import { type Foo, Bar }`) that carry at least one value\nsymbol still fire because the runtime dependency on `Bar` is real.\nType-only re-exports (`export type { Foo } from \"...\"`) participate\nin the same allowance because they surface as edges flagged\n`is_type_only: true` and, like type-only imports, are erased at\ncompile time.",
+          "description": "Allowed type-only targets.",
           "type": "array",
           "items": {
             "type": "string"
@@ -1207,12 +1187,55 @@
         "function"
       ]
     },
+    "SecurityConfig": {
+      "description": "Scopes the data-driven security matcher catalogue used by `fallow security`.\nAn absent block (or both `include`/`exclude` unset) admits every category.",
+      "type": "object",
+      "properties": {
+        "categories": {
+          "description": "Include/exclude filter over catalogue category ids (e.g. `dangerous-html`).",
+          "anyOf": [
+            {
+              "$ref": "#/$defs/SecurityCategories"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "SecurityCategories": {
+      "description": "Include/exclude lists scoping the active security matcher categories. When\n`include` is set, only those categories are active; `exclude` removes\ncategories from the admitted set. Both unset admits every category.",
+      "type": "object",
+      "properties": {
+        "include": {
+          "description": "Catalogue category ids to admit. When set, all others are excluded.",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "type": "string"
+          }
+        },
+        "exclude": {
+          "description": "Catalogue category ids to remove from the admitted set.",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "additionalProperties": false
+    },
     "FixConfig": {
-      "description": "Auto-fix behavior settings.",
       "type": "object",
       "properties": {
         "catalog": {
-          "description": "Auto-fix behavior for pnpm catalog edits.",
           "$ref": "#/$defs/CatalogFixConfig",
           "default": {
             "deletePrecedingComments": "auto"
@@ -1221,34 +1244,20 @@
       }
     },
     "CatalogFixConfig": {
-      "description": "Auto-fix behavior for pnpm catalog entries.",
       "type": "object",
       "properties": {
         "deletePrecedingComments": {
-          "description": "Whether removing an unused catalog entry also removes the contiguous\nYAML comment block immediately above it.",
           "$ref": "#/$defs/CatalogPrecedingCommentPolicy",
           "default": "auto"
         }
       }
     },
     "CatalogPrecedingCommentPolicy": {
-      "description": "Policy for deleting comments immediately above removed catalog entries.",
-      "oneOf": [
-        {
-          "description": "Delete the comment block when it is separated from previous siblings by\na blank line, or when it directly follows the parent catalog header.",
-          "type": "string",
-          "const": "auto"
-        },
-        {
-          "description": "Always delete the contiguous comment block immediately above the entry.",
-          "type": "string",
-          "const": "always"
-        },
-        {
-          "description": "Never delete leading comments; leave them in place as orphan comments.",
-          "type": "string",
-          "const": "never"
-        }
+      "type": "string",
+      "enum": [
+        "auto",
+        "always",
+        "never"
       ]
     },
     "ResolveConfig": {
@@ -1265,34 +1274,27 @@
       }
     },
     "ProductionConfig": {
-      "description": "Production-mode defaults.",
       "anyOf": [
         {
-          "description": "Legacy/global form: `production = true` or `\"production\": true`.",
           "type": "boolean"
         },
         {
-          "description": "Per-analysis form.",
           "$ref": "#/$defs/PerAnalysisProductionConfig"
         }
       ]
     },
     "PerAnalysisProductionConfig": {
-      "description": "Per-analysis production-mode defaults.",
       "type": "object",
       "properties": {
         "deadCode": {
-          "description": "Production mode for dead-code analysis.",
           "type": "boolean",
           "default": false
         },
         "health": {
-          "description": "Production mode for health analysis.",
           "type": "boolean",
           "default": false
         },
         "dupes": {
-          "description": "Production mode for duplication analysis.",
           "type": "boolean",
           "default": false
         }
@@ -1304,14 +1306,12 @@
       "type": "object",
       "properties": {
         "files": {
-          "description": "Glob patterns to match files against (relative to config file location).",
           "type": "array",
           "items": {
             "type": "string"
           }
         },
         "rules": {
-          "description": "Partial rules — only specified fields override the base rules.",
           "$ref": "#/$defs/PartialRulesConfig",
           "default": {}
         }
@@ -1573,15 +1573,33 @@
               "type": "null"
             }
           ]
+        },
+        "security-client-server-leak": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "security-sink": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
         }
       }
     },
     "RegressionConfig": {
-      "description": "Regression baseline counts, embedded in the config file.\n\nWhen `--fail-on-regression` is used without `--regression-baseline <PATH>`,\nfallow reads the baseline from this config section.\nWhen `--save-regression-baseline` is used without a path argument,\nfallow writes the baseline into the config file.",
       "type": "object",
       "properties": {
         "baseline": {
-          "description": "Dead code issue counts baseline.",
           "anyOf": [
             {
               "$ref": "#/$defs/RegressionBaseline"
@@ -1594,7 +1612,6 @@
       }
     },
     "RegressionBaseline": {
-      "description": "Per-type issue counts for regression comparison.",
       "type": "object",
       "properties": {
         "totalIssues": {
@@ -1702,36 +1719,30 @@
       }
     },
     "AuditConfig": {
-      "description": "Per-analysis baseline paths for the `audit` command.\n\nEach field points to a baseline file produced by the corresponding\nsubcommand (`fallow dead-code --save-baseline`, `fallow health --save-baseline`,\n`fallow dupes --save-baseline`). `audit` passes each baseline through to its\nunderlying analysis; baseline-matched issues are excluded from the verdict.",
       "type": "object",
       "properties": {
         "gate": {
-          "description": "Which findings should make `fallow audit` fail.",
           "$ref": "#/$defs/AuditGate"
         },
         "deadCodeBaseline": {
-          "description": "Path to the dead-code baseline (produced by `fallow dead-code --save-baseline`).",
           "type": [
             "string",
             "null"
           ]
         },
         "healthBaseline": {
-          "description": "Path to the health baseline (produced by `fallow health --save-baseline`).",
           "type": [
             "string",
             "null"
           ]
         },
         "dupesBaseline": {
-          "description": "Path to the duplication baseline (produced by `fallow dupes --save-baseline`).",
           "type": [
             "string",
             "null"
           ]
         },
         "cacheMaxAgeDays": {
-          "description": "Maximum age (in days since last reuse or fresh create) of a persistent\nreusable base-snapshot worktree cache entry. Older entries are removed\nat the top of the next `fallow audit` invocation. The env var\n`FALLOW_AUDIT_CACHE_MAX_AGE_DAYS` wins over this field. Unset on both\nsides defaults to 30 days. Setting either source to `0` disables the\nsweep entirely (escape hatch for CI runners that prune caches\nout-of-band). Invalid env var values (non-integer, negative) silently\nfall back to this field / default rather than failing the audit.",
           "type": [
             "integer",
             "null"
@@ -1742,26 +1753,16 @@
       }
     },
     "AuditGate": {
-      "description": "Gating mode for `fallow audit`.",
-      "oneOf": [
-        {
-          "description": "Only findings introduced by the current changeset affect the verdict.",
-          "type": "string",
-          "const": "new-only"
-        },
-        {
-          "description": "All findings in changed files affect the verdict.",
-          "type": "string",
-          "const": "all"
-        }
+      "type": "string",
+      "enum": [
+        "new-only",
+        "all"
       ]
     },
     "CacheConfig": {
-      "description": "Incremental cache configuration.\n\nToday only `maxSizeMb` is exposed. The env var `FALLOW_CACHE_MAX_SIZE`\n(also in MB) wins over this field when both are set. The default cap is\n256 MB; values are interpreted as whole megabytes.",
       "type": "object",
       "properties": {
         "maxSizeMb": {
-          "description": "Maximum on-disk cache size in megabytes. When the serialized cache\nexceeds 80% of this cap during save, the oldest entries are evicted\ndown to 60% of the cap. Default: 256 MB.",
           "type": [
             "integer",
             "null"