fallow 2.97.0 → 2.98.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "2.97.0",
+  "version": "2.98.0",
   "description": "Deterministic codebase intelligence for TypeScript and JavaScript. Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, zero-config framework support.",
   "license": "MIT",
   "repository": {
@@ -83,13 +83,13 @@
     "@tanstack/intent": "0.0.42"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.97.0",
-    "@fallow-cli/darwin-x64": "2.97.0",
-    "@fallow-cli/linux-x64-gnu": "2.97.0",
-    "@fallow-cli/linux-arm64-gnu": "2.97.0",
-    "@fallow-cli/linux-x64-musl": "2.97.0",
-    "@fallow-cli/linux-arm64-musl": "2.97.0",
-    "@fallow-cli/win32-arm64-msvc": "2.97.0",
-    "@fallow-cli/win32-x64-msvc": "2.97.0"
+    "@fallow-cli/darwin-arm64": "2.98.0",
+    "@fallow-cli/darwin-x64": "2.98.0",
+    "@fallow-cli/linux-x64-gnu": "2.98.0",
+    "@fallow-cli/linux-arm64-gnu": "2.98.0",
+    "@fallow-cli/linux-x64-musl": "2.98.0",
+    "@fallow-cli/linux-arm64-musl": "2.98.0",
+    "@fallow-cli/win32-arm64-msvc": "2.98.0",
+    "@fallow-cli/win32-x64-msvc": "2.98.0"
   }
 }

package/schema.json

@@ -159,6 +159,9 @@
         "unrendered-components": "warn",
         "unused-component-props": "warn",
         "unused-component-emits": "warn",
+        "unused-component-inputs": "warn",
+        "unused-component-outputs": "warn",
+        "unused-svelte-events": "warn",
         "unused-server-actions": "warn",
         "unused-load-data-keys": "warn",
         "prop-drilling": "off",
@@ -1052,6 +1055,21 @@
           "$ref": "#/$defs/Severity",
           "default": "error"
         },
+        "unused-component-inputs": {
+          "description": "Angular `@Input()` / signal `input()` / `model()` declared input read\nnowhere inside its own component (neither the inline/external template nor\nthe class body). The single-file dead-input direction, the Angular\nanalogue of `unused-component-prop`. Defaults to `warn`, not `error`: an\ninput can be part of a deliberately-stable public component API, so\nanalyzer confidence is lower; warn encodes that without failing CI.",
+          "$ref": "#/$defs/Severity",
+          "default": "error"
+        },
+        "unused-component-outputs": {
+          "description": "Angular `@Output()` / signal `output()` declared output emitted nowhere\ninside its own component (no `this.<output>.emit(...)`). The single-file\ndead-output direction, the Angular analogue of `unused-component-emit`.\nDefaults to `warn`, not `error`: an output can be part of a\ndeliberately-stable public component API, so analyzer confidence is lower;\nwarn encodes that without failing CI.",
+          "$ref": "#/$defs/Severity",
+          "default": "error"
+        },
+        "unused-svelte-events": {
+          "description": "Svelte component dispatching a custom event via `createEventDispatcher()`\nwhose event name is listened to nowhere in the analyzed project. The\ncross-file dead-output direction (no eslint-plugin-svelte / svelte-check\nrule covers the listener side). Defaults to `warn`, not `error`: a\ndispatched event can be part of a deliberately-stable public component\nAPI, or a listener may be added later, so analyzer confidence is lower;\nwarn encodes that without failing CI.",
+          "$ref": "#/$defs/Severity",
+          "default": "warn"
+        },
         "unused-server-actions": {
           "description": "Next.js Server Action (an export of a `\"use server\"` file) referenced by\nno code in the project: no import-and-call, no `action={fn}` binding, no\n`<form action={fn}>`. Cross-graph dead-export direction, reclassified out\nof `unused-export` for `\"use server\"` files. Defaults to `warn`, not\n`error`: the rule is new and false-negative-preferring, and reflective\naction-dispatch shapes can hide a real consumer; warn encodes that\nwithout failing CI until corpus-validated.",
           "$ref": "#/$defs/Severity",
@@ -1731,6 +1749,36 @@
             }
           ]
         },
+        "unused-component-inputs": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "unused-component-outputs": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "unused-svelte-events": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "unused-server-actions": {
           "anyOf": [
             {

package/skills/fallow/SKILL.md

@@ -164,6 +164,9 @@ Run `fallow <command> --help` for the full flag list per command (see also refer
 | `unrendered-component` | `--unrendered-components` | - | `// fallow-ignore-next-line unrendered-component` | A Vue / Svelte component is reachable through a barrel but rendered nowhere |
 | `unused-component-prop` | `--unused-component-props` | - | `// fallow-ignore-next-line unused-component-prop` | A Vue defineProps prop or React component prop is referenced nowhere in its own component |
 | `unused-component-emit` | `--unused-component-emits` | - | `// fallow-ignore-next-line unused-component-emit` | A Vue <script setup> defineEmits event is emitted nowhere in its own component |
+| `unused-component-input` | `--unused-component-inputs` | - | `// fallow-ignore-next-line unused-component-input` | An Angular @Input() / signal input() / model() is read nowhere in its own component (class body or template); needs `@angular/core` dep |
+| `unused-component-output` | `--unused-component-outputs` | - | `// fallow-ignore-next-line unused-component-output` | An Angular @Output() / signal output() is emitted (.emit()) nowhere in its own component; needs `@angular/core` dep |
+| `unused-svelte-event` | `--unused-svelte-events` | - | `// fallow-ignore-next-line unused-svelte-event` | A Svelte createEventDispatcher event is listened to nowhere in the project; needs `svelte` dep |
 | `unused-server-action` | `--unused-server-actions` | - | `// fallow-ignore-next-line unused-server-action` | A Next.js Server Action exported from a "use server" file is referenced by no code in the project |
 | `unused-load-data-key` | `--unused-load-data-keys` | - | `// fallow-ignore-next-line unused-load-data-key` | A SvelteKit load() return-object key is read by no consumer (needs @sveltejs/kit dep) |
 | `prop-drilling` | - | - | `// fallow-ignore-next-line prop-drilling` | A React/Preact prop is forwarded unchanged through 3+ pass-through components to a distant consumer; Opt-in: set rules.prop-drilling to warn or error to enable. Defaults to off. |

package/skills/fallow/references/cli-reference.md

@@ -66,6 +66,9 @@ Common global flags for this command: [`--format`](#global-flags), [`--quiet`](#
 | `--unrendered-components` | A Vue / Svelte component is reachable through a barrel but rendered nowhere |
 | `--unused-component-props` | A Vue defineProps prop or React component prop is referenced nowhere in its own component |
 | `--unused-component-emits` | A Vue <script setup> defineEmits event is emitted nowhere in its own component |
+| `--unused-component-inputs` | An Angular @Input() / signal input() / model() is read nowhere in its own component (class body or template); needs `@angular/core` dep |
+| `--unused-component-outputs` | An Angular @Output() / signal output() is emitted (.emit()) nowhere in its own component; needs `@angular/core` dep |
+| `--unused-svelte-events` | A Svelte createEventDispatcher event is listened to nowhere in the project |
 | `--unused-server-actions` | A Next.js Server Action exported from a "use server" file is referenced by no code in the project |
 | `--unused-load-data-keys` | A SvelteKit load() return-object key is read by no consumer |
 | `--unresolved-imports` | Unresolved imports |
@@ -501,7 +504,7 @@ fallow health --format json --quiet --trend
 {
   "kind": "health",
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.98.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -888,7 +891,7 @@ fallow audit \
 {
   "kind": "audit",
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.98.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -963,7 +966,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.98.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1063,7 +1066,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "2.97.0",
+  "version": "2.98.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1092,7 +1095,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "2.97.0",
+  "version": "2.98.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1709,7 +1712,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 {
   "kind": "dead-code",
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.98.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1869,7 +1872,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 {
   "kind": "dupes",
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.98.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -1913,11 +1916,11 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "kind": "combined",
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.98.0",
   "elapsed_ms": 159,
   "check": {
     "schema_version": 7,
-    "version": "2.97.0",
+    "version": "2.98.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],

package/skills/fallow/references/gotchas.md

@@ -78,6 +78,18 @@ Don't use `--changed-since` when auditing the full project. Use it for PR checks
 
 ---
 
+## Svelte Event Findings Are Project-Wide Listener Checks
+
+`unused-svelte-event` reports a Svelte `createEventDispatcher` event that has no reachable listener in the project. This is different from `unused-component-emit`, which checks whether a Vue component ever emits its declared event.
+
+```bash
+fallow dead-code --format json --quiet --unused-svelte-events
+```
+
+Dynamic event names, dispatcher values that escape the component, and projects without a declared Svelte dependency are abstained to avoid false positives.
+
+---
+
 ## Filter Flags Are Additive
 
 Issue type filter flags (`--unused-exports`, `--unused-files`, etc.) are inclusive. They select which issue types to show. Using multiple flags shows the union.
@@ -323,6 +335,10 @@ Conservative semantics: a method carrying any decorator NOT in the list still ge
 
 The default empty list preserves today's skip-all behavior, so existing NestJS / Angular / TypeORM projects see no change.
 
+### Angular `@Input()` / `@Output()` are still covered by the component rules
+
+The skip above applies only to generic `unused-class-member` detection. The dedicated Angular component rules (`unused-component-input` for `@Input()` / signal `input()` / `model()`, and `unused-component-output` for `@Output()` / signal `output()`, both default `warn`, gated on `@angular/core`) scope usage to the component itself: an input is dead when it is read by no code in its own class body or template (inline `template` or external `templateUrl`), and an output is dead when it is emitted (`.emit()`) nowhere in its own component. The scope is the component, not the project: an input that a parent binds via `[input]="..."` but the component itself never reads IS flagged, because the parent binding is satisfied while the value goes unused inside the component. These rules abstain on the whole component for any `extends` clause, a `{...this}` spread, JS-reserved-word names, accessor (`get` / `set`) inputs, and observable-stream `@Output`s (only `new EventEmitter()` initializers are harvested); `model()` is treated as input-only. Suppress an individual finding with `// fallow-ignore-next-line unused-component-input` or `-output`.
+
 ---
 
 ## JSDoc Visibility Tags Keep Exports Alive

package/types/output-contract.d.ts

@@ -172,7 +172,7 @@ export type IssueAction = (FixAction | SuppressLineAction | SuppressFileAction |
  * Discriminant string for [`FixAction`]. Kebab-case per the JSON output
  * contract.
  */
-export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict")
+export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict")
 /**
  * Singleton discriminant for [`SuppressLineAction`].
  */
@@ -1134,6 +1134,28 @@ unused_component_props?: UnusedComponentPropFinding[]
  * `warn`.
  */
 unused_component_emits?: UnusedComponentEmitFinding[]
+/**
+ * Angular `@Input()` / signal `input()` / `model()` inputs read nowhere in
+ * their own component (neither the template nor the class body). Wrapped in
+ * [`UnusedComponentInputFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+unused_component_inputs?: UnusedComponentInputFinding[]
+/**
+ * Angular `@Output()` / signal `output()` outputs emitted nowhere in their
+ * own component (no `this.<output>.emit(...)`). Wrapped in
+ * [`UnusedComponentOutputFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+unused_component_outputs?: UnusedComponentOutputFinding[]
+/**
+ * Svelte components dispatching a custom event via `createEventDispatcher()`
+ * whose event name is listened to nowhere project-wide (cross-file
+ * dead-output direction). Wrapped in [`UnusedSvelteEventFinding`] so each
+ * entry carries a typed `actions` array natively. Default severity is
+ * `warn`.
+ */
+unused_svelte_events?: UnusedSvelteEventFinding[]
 /**
  * Next.js Server Actions (exports of `"use server"` files) that no code in
  * the project references. Reclassified out of `unused_exports` for
@@ -1277,6 +1299,19 @@ unused_component_props?: number
  * Vue `<script setup>` emits emitted nowhere inside their own SFC.
  */
 unused_component_emits?: number
+/**
+ * Angular `@Input()` bindings referenced nowhere inside their own component.
+ */
+unused_component_inputs?: number
+/**
+ * Angular `@Output()` bindings emitted nowhere inside their own component.
+ */
+unused_component_outputs?: number
+/**
+ * Svelte components dispatching a custom event via `createEventDispatcher`
+ * whose name is listened to nowhere in the project.
+ */
+unused_svelte_events?: number
 /**
  * Next.js Server Actions (exports of `"use server"` files) referenced by no
  * code in the project.
@@ -2745,7 +2780,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnprovidedInject`] finding. There is no safe
  * auto-fix: the fix is binary but judgement-bearing (add a `provide` for the
- * key, or delete the dead inject). The only action is a line-level suppress.
+ * key, or delete the dead inject). Actions are manual remediation guidance
+ * plus a line-level suppress.
  */
 export interface UnprovidedInjectFinding {
 /**
@@ -2782,8 +2818,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnrenderedComponent`] finding. There is no safe
  * auto-fix: the fix is binary but judgement-bearing (render the component
- * somewhere, or delete the dead component). The only action is a line-level
- * suppress.
+ * somewhere, or delete the dead component). Actions are manual remediation
+ * guidance plus a line-level suppress.
  */
 export interface UnrenderedComponentFinding {
 /**
@@ -2915,8 +2951,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnusedComponentProp`] finding. There is no safe
  * auto-fix: removing a declared prop is judgement-bearing (the prop may be part
- * of a deliberately-stable public component API). The only action is a
- * line-level suppress at the prop declaration.
+ * of a deliberately-stable public component API). Actions are manual
+ * remediation guidance plus a line-level suppress at the prop declaration.
  */
 export interface UnusedComponentPropFinding {
 /**
@@ -2953,8 +2989,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnusedComponentEmit`] finding. There is no safe
  * auto-fix: removing a declared emit is judgement-bearing (the event may be
- * part of a deliberately-stable public component API). The only action is a
- * line-level suppress at the emit declaration.
+ * part of a deliberately-stable public component API). Actions are manual
+ * remediation guidance plus a line-level suppress at the emit declaration.
  */
 export interface UnusedComponentEmitFinding {
 /**
@@ -2988,10 +3024,126 @@ actions: IssueAction[]
  */
 introduced?: (AuditIntroduced | null)
 }
+/**
+ * Wire-shape envelope for an [`UnusedComponentInput`] finding. There is no safe
+ * auto-fix: removing a declared input is judgement-bearing (the input may be
+ * part of a deliberately-stable public component API). The only action is a
+ * line-level suppress at the input declaration.
+ */
+export interface UnusedComponentInputFinding {
+/**
+ * The Angular component/directive `.ts` file declaring the unused input.
+ */
+path: string
+/**
+ * The component name (the `.ts` file stem).
+ */
+component_name: string
+/**
+ * The declared input name that is never read.
+ */
+input_name: string
+/**
+ * 1-based line number of the input declaration.
+ */
+line: number
+/**
+ * 0-based byte column offset of the input declaration.
+ */
+col: number
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+}
+/**
+ * Wire-shape envelope for an [`UnusedComponentOutput`] finding. There is no safe
+ * auto-fix: removing a declared output is judgement-bearing (the event may be
+ * part of a deliberately-stable public component API). The only action is a
+ * line-level suppress at the output declaration.
+ */
+export interface UnusedComponentOutputFinding {
+/**
+ * The Angular component/directive `.ts` file declaring the unused output.
+ */
+path: string
+/**
+ * The component name (the `.ts` file stem).
+ */
+component_name: string
+/**
+ * The declared output name that is never emitted.
+ */
+output_name: string
+/**
+ * 1-based line number of the output declaration.
+ */
+line: number
+/**
+ * 0-based byte column offset of the output declaration.
+ */
+col: number
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+}
+/**
+ * Wire-shape envelope for an [`UnusedSvelteEvent`] finding. There is no safe
+ * auto-fix: removing a dispatched event is judgement-bearing (the event may be
+ * part of a deliberately-stable public component API, or a listener may be
+ * added later). Actions are manual remediation guidance plus a line-level
+ * suppress at the `dispatch` call.
+ */
+export interface UnusedSvelteEventFinding {
+/**
+ * The `.svelte` component dispatching the unlistened event.
+ */
+path: string
+/**
+ * The component name (the `.svelte` file stem).
+ */
+component_name: string
+/**
+ * The dispatched event name that is listened to nowhere.
+ */
+event_name: string
+/**
+ * 1-based line number of the `dispatch('<name>')` call.
+ */
+line: number
+/**
+ * 0-based byte column offset of the `dispatch('<name>')` call.
+ */
+col: number
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+}
 /**
  * Wire-shape envelope for an [`UnusedServerAction`] finding. There is no safe
  * auto-fix: the fix is binary but judgement-bearing (wire the action up to a
- * consumer, or delete it). The only action is a line-level suppress.
+ * consumer, or delete it). Actions are manual remediation guidance plus a
+ * line-level suppress.
  */
 export interface UnusedServerActionFinding {
 /**
@@ -3024,7 +3176,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnusedLoadDataKey`] finding. There is no safe
  * auto-fix: a `load()` fetch can have side effects, so deleting the key is a
- * human call. The only action is a line-level suppress.
+ * human call. Actions are manual remediation guidance plus a line-level
+ * suppress.
  */
 export interface UnusedLoadDataKeyFinding {
 /**
@@ -7066,6 +7219,28 @@ unused_component_props?: UnusedComponentPropFinding[]
  * `warn`.
  */
 unused_component_emits?: UnusedComponentEmitFinding[]
+/**
+ * Angular `@Input()` / signal `input()` / `model()` inputs read nowhere in
+ * their own component (neither the template nor the class body). Wrapped in
+ * [`UnusedComponentInputFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+unused_component_inputs?: UnusedComponentInputFinding[]
+/**
+ * Angular `@Output()` / signal `output()` outputs emitted nowhere in their
+ * own component (no `this.<output>.emit(...)`). Wrapped in
+ * [`UnusedComponentOutputFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+unused_component_outputs?: UnusedComponentOutputFinding[]
+/**
+ * Svelte components dispatching a custom event via `createEventDispatcher()`
+ * whose event name is listened to nowhere project-wide (cross-file
+ * dead-output direction). Wrapped in [`UnusedSvelteEventFinding`] so each
+ * entry carries a typed `actions` array natively. Default severity is
+ * `warn`.
+ */
+unused_svelte_events?: UnusedSvelteEventFinding[]
 /**
  * Next.js Server Actions (exports of `"use server"` files) that no code in
  * the project references. Reclassified out of `unused_exports` for