fallow 2.97.0 → 2.99.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "2.97.0",
+  "version": "2.99.0",
   "description": "Deterministic codebase intelligence for TypeScript and JavaScript. Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, zero-config framework support.",
   "license": "MIT",
   "repository": {
@@ -83,13 +83,13 @@
     "@tanstack/intent": "0.0.42"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.97.0",
-    "@fallow-cli/darwin-x64": "2.97.0",
-    "@fallow-cli/linux-x64-gnu": "2.97.0",
-    "@fallow-cli/linux-arm64-gnu": "2.97.0",
-    "@fallow-cli/linux-x64-musl": "2.97.0",
-    "@fallow-cli/linux-arm64-musl": "2.97.0",
-    "@fallow-cli/win32-arm64-msvc": "2.97.0",
-    "@fallow-cli/win32-x64-msvc": "2.97.0"
+    "@fallow-cli/darwin-arm64": "2.99.0",
+    "@fallow-cli/darwin-x64": "2.99.0",
+    "@fallow-cli/linux-x64-gnu": "2.99.0",
+    "@fallow-cli/linux-arm64-gnu": "2.99.0",
+    "@fallow-cli/linux-x64-musl": "2.99.0",
+    "@fallow-cli/linux-arm64-musl": "2.99.0",
+    "@fallow-cli/win32-arm64-msvc": "2.99.0",
+    "@fallow-cli/win32-x64-msvc": "2.99.0"
   }
 }

package/schema.json

@@ -159,6 +159,9 @@
         "unrendered-components": "warn",
         "unused-component-props": "warn",
         "unused-component-emits": "warn",
+        "unused-component-inputs": "warn",
+        "unused-component-outputs": "warn",
+        "unused-svelte-events": "warn",
         "unused-server-actions": "warn",
         "unused-load-data-keys": "warn",
         "prop-drilling": "off",
@@ -175,6 +178,7 @@
         "coverage-gaps": "off",
         "feature-flags": "off",
         "stale-suppressions": "warn",
+        "require-suppression-reason": "off",
         "unused-catalog-entries": "warn",
         "empty-catalog-groups": "warn",
         "unresolved-catalog-references": "error",
@@ -1052,6 +1056,21 @@
           "$ref": "#/$defs/Severity",
           "default": "error"
         },
+        "unused-component-inputs": {
+          "description": "Angular `@Input()` / signal `input()` / `model()` declared input read\nnowhere inside its own component (neither the inline/external template nor\nthe class body). The single-file dead-input direction, the Angular\nanalogue of `unused-component-prop`. Defaults to `warn`, not `error`: an\ninput can be part of a deliberately-stable public component API, so\nanalyzer confidence is lower; warn encodes that without failing CI.",
+          "$ref": "#/$defs/Severity",
+          "default": "error"
+        },
+        "unused-component-outputs": {
+          "description": "Angular `@Output()` / signal `output()` declared output emitted nowhere\ninside its own component (no `this.<output>.emit(...)`). The single-file\ndead-output direction, the Angular analogue of `unused-component-emit`.\nDefaults to `warn`, not `error`: an output can be part of a\ndeliberately-stable public component API, so analyzer confidence is lower;\nwarn encodes that without failing CI.",
+          "$ref": "#/$defs/Severity",
+          "default": "error"
+        },
+        "unused-svelte-events": {
+          "description": "Svelte component dispatching a custom event via `createEventDispatcher()`\nwhose event name is listened to nowhere in the analyzed project. The\ncross-file dead-output direction (no eslint-plugin-svelte / svelte-check\nrule covers the listener side). Defaults to `warn`, not `error`: a\ndispatched event can be part of a deliberately-stable public component\nAPI, or a listener may be added later, so analyzer confidence is lower;\nwarn encodes that without failing CI.",
+          "$ref": "#/$defs/Severity",
+          "default": "warn"
+        },
         "unused-server-actions": {
           "description": "Next.js Server Action (an export of a `\"use server\"` file) referenced by\nno code in the project: no import-and-call, no `action={fn}` binding, no\n`<form action={fn}>`. Cross-graph dead-export direction, reclassified out\nof `unused-export` for `\"use server\"` files. Defaults to `warn`, not\n`error`: the rule is new and false-negative-preferring, and reflective\naction-dispatch shapes can hide a real consumer; warn encodes that\nwithout failing CI until corpus-validated.",
           "$ref": "#/$defs/Severity",
@@ -1121,6 +1140,11 @@
           "$ref": "#/$defs/Severity",
           "default": "warn"
         },
+        "require-suppression-reason": {
+          "description": "Opt-in suppression hygiene rule: when enabled, every `fallow-ignore-*`\ncomment and `@expected-unused` tag must carry a `-- <reason>` suffix.",
+          "$ref": "#/$defs/Severity",
+          "default": "off"
+        },
         "unused-catalog-entries": {
           "$ref": "#/$defs/Severity",
           "default": "warn"
@@ -1731,6 +1755,36 @@
             }
           ]
         },
+        "unused-component-inputs": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "unused-component-outputs": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "unused-svelte-events": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "unused-server-actions": {
           "anyOf": [
             {
@@ -1891,6 +1945,16 @@
             }
           ]
         },
+        "require-suppression-reason": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "unused-catalog-entries": {
           "anyOf": [
             {

package/skills/fallow/SKILL.md

@@ -164,13 +164,16 @@ Run `fallow <command> --help` for the full flag list per command (see also refer
 | `unrendered-component` | `--unrendered-components` | - | `// fallow-ignore-next-line unrendered-component` | A Vue / Svelte component is reachable through a barrel but rendered nowhere |
 | `unused-component-prop` | `--unused-component-props` | - | `// fallow-ignore-next-line unused-component-prop` | A Vue defineProps prop or React component prop is referenced nowhere in its own component |
 | `unused-component-emit` | `--unused-component-emits` | - | `// fallow-ignore-next-line unused-component-emit` | A Vue <script setup> defineEmits event is emitted nowhere in its own component |
+| `unused-component-input` | `--unused-component-inputs` | - | `// fallow-ignore-next-line unused-component-input` | An Angular @Input() / signal input() / model() is read nowhere in its own component (class body or template); needs `@angular/core` dep |
+| `unused-component-output` | `--unused-component-outputs` | - | `// fallow-ignore-next-line unused-component-output` | An Angular @Output() / signal output() is emitted (.emit()) nowhere in its own component; needs `@angular/core` dep |
+| `unused-svelte-event` | `--unused-svelte-events` | - | `// fallow-ignore-next-line unused-svelte-event` | A Svelte createEventDispatcher event is listened to nowhere in the project; needs `svelte` dep |
 | `unused-server-action` | `--unused-server-actions` | - | `// fallow-ignore-next-line unused-server-action` | A Next.js Server Action exported from a "use server" file is referenced by no code in the project |
 | `unused-load-data-key` | `--unused-load-data-keys` | - | `// fallow-ignore-next-line unused-load-data-key` | A SvelteKit load() return-object key is read by no consumer (needs @sveltejs/kit dep) |
 | `prop-drilling` | - | - | `// fallow-ignore-next-line prop-drilling` | A React/Preact prop is forwarded unchanged through 3+ pass-through components to a distant consumer; Opt-in: set rules.prop-drilling to warn or error to enable. Defaults to off. |
 | `thin-wrapper` | - | - | `// fallow-ignore-next-line thin-wrapper` | A React/Preact component whose whole body is a single spread-forwarded child render (a candidate for inlining); Opt-in: set rules.thin-wrapper to warn or error to enable. Defaults to off. |
 | `duplicate-prop-shape` | - | - | `// fallow-ignore-next-line duplicate-prop-shape` | Three or more React/Preact components across two or more files declare an identical prop-name set (a missing shared Props type); Opt-in: set rules.duplicate-prop-shape to warn or error to enable. Defaults to off. |
-| `route-collision` | - | - | - | Two or more Next.js App Router route files resolve to the same URL |
-| `dynamic-segment-name-conflict` | - | - | - | Sibling Next.js dynamic route segments use different slug names at the same position |
+| `route-collision` | - | - | `// fallow-ignore-file route-collision` | Two or more Next.js App Router route files resolve to the same URL |
+| `dynamic-segment-name-conflict` | - | - | `// fallow-ignore-file dynamic-segment-name-conflict` | Sibling Next.js dynamic route segments use different slug names at the same position |
 | `high-cyclomatic-complexity` | `--complexity` | - | `// fallow-ignore-next-line complexity` | Function has high cyclomatic complexity |
 | `high-cognitive-complexity` | `--complexity` | - | `// fallow-ignore-next-line complexity` | Function has high cognitive complexity |
 | `high-complexity` | `--complexity` | - | `// fallow-ignore-next-line complexity` | Function exceeds both complexity thresholds |

package/skills/fallow/references/cli-reference.md

@@ -66,6 +66,9 @@ Common global flags for this command: [`--format`](#global-flags), [`--quiet`](#
 | `--unrendered-components` | A Vue / Svelte component is reachable through a barrel but rendered nowhere |
 | `--unused-component-props` | A Vue defineProps prop or React component prop is referenced nowhere in its own component |
 | `--unused-component-emits` | A Vue <script setup> defineEmits event is emitted nowhere in its own component |
+| `--unused-component-inputs` | An Angular @Input() / signal input() / model() is read nowhere in its own component (class body or template); needs `@angular/core` dep |
+| `--unused-component-outputs` | An Angular @Output() / signal output() is emitted (.emit()) nowhere in its own component; needs `@angular/core` dep |
+| `--unused-svelte-events` | A Svelte createEventDispatcher event is listened to nowhere in the project |
 | `--unused-server-actions` | A Next.js Server Action exported from a "use server" file is referenced by no code in the project |
 | `--unused-load-data-keys` | A SvelteKit load() return-object key is read by no consumer |
 | `--unresolved-imports` | Unresolved imports |
@@ -501,7 +504,7 @@ fallow health --format json --quiet --trend
 {
   "kind": "health",
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.99.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -888,7 +891,7 @@ fallow audit \
 {
   "kind": "audit",
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.99.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -963,7 +966,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.99.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1063,7 +1066,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "2.97.0",
+  "version": "2.99.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1092,7 +1095,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "2.97.0",
+  "version": "2.99.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1709,7 +1712,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 {
   "kind": "dead-code",
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.99.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1869,7 +1872,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 {
   "kind": "dupes",
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.99.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -1913,11 +1916,11 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "kind": "combined",
   "schema_version": 7,
-  "version": "2.97.0",
+  "version": "2.99.0",
   "elapsed_ms": 159,
   "check": {
     "schema_version": 7,
-    "version": "2.97.0",
+    "version": "2.99.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],

package/skills/fallow/references/gotchas.md

@@ -78,6 +78,18 @@ Don't use `--changed-since` when auditing the full project. Use it for PR checks
 
 ---
 
+## Svelte Event Findings Are Project-Wide Listener Checks
+
+`unused-svelte-event` reports a Svelte `createEventDispatcher` event that has no reachable listener in the project. This is different from `unused-component-emit`, which checks whether a Vue component ever emits its declared event.
+
+```bash
+fallow dead-code --format json --quiet --unused-svelte-events
+```
+
+Dynamic event names, dispatcher values that escape the component, and projects without a declared Svelte dependency are abstained to avoid false positives.
+
+---
+
 ## Filter Flags Are Additive
 
 Issue type filter flags (`--unused-exports`, `--unused-files`, etc.) are inclusive. They select which issue types to show. Using multiple flags shows the union.
@@ -323,6 +335,10 @@ Conservative semantics: a method carrying any decorator NOT in the list still ge
 
 The default empty list preserves today's skip-all behavior, so existing NestJS / Angular / TypeORM projects see no change.
 
+### Angular `@Input()` / `@Output()` are still covered by the component rules
+
+The skip above applies only to generic `unused-class-member` detection. The dedicated Angular component rules (`unused-component-input` for `@Input()` / signal `input()` / `model()`, and `unused-component-output` for `@Output()` / signal `output()`, both default `warn`, gated on `@angular/core`) scope usage to the component itself: an input is dead when it is read by no code in its own class body or template (inline `template` or external `templateUrl`), and an output is dead when it is emitted (`.emit()`) nowhere in its own component. The scope is the component, not the project: an input that a parent binds via `[input]="..."` but the component itself never reads IS flagged, because the parent binding is satisfied while the value goes unused inside the component. These rules abstain on the whole component for any `extends` clause, a `{...this}` spread, JS-reserved-word names, accessor (`get` / `set`) inputs, and observable-stream `@Output`s (only `new EventEmitter()` initializers are harvested); `model()` is treated as input-only. Suppress an individual finding with `// fallow-ignore-next-line unused-component-input` or `-output`.
+
 ---
 
 ## JSDoc Visibility Tags Keep Exports Alive

package/types/output-contract.d.ts

@@ -138,10 +138,12 @@ export type AuditGate = ("new-only" | "all")
  * Current per-instance flips:
  *
  * - `remove-catalog-entry` (`unused-catalog-entries`): `true` only when the
- *   finding's `hardcoded_consumers` array is empty. When a workspace
- *   package still pins a hardcoded version of the same package, `fallow fix`
- *   skips the entry to avoid breaking `pnpm install`, and the action is
- *   emitted with `auto_fixable: false`.
+ *   finding's `hardcoded_consumers` array is empty and the source is
+ *   `pnpm-workspace.yaml`. When a workspace package still pins a hardcoded
+ *   version of the same package, `fallow fix` skips the entry to avoid
+ *   breaking `pnpm install`. Bun `package.json` catalog entries are also
+ *   emitted with `auto_fixable: false` because the current fixer is
+ *   YAML-only.
  * - `remove-dependency` vs `move-dependency` (dependency findings): when the
  *   finding's `used_in_workspaces` array is non-empty, the primary action
  *   flips to `move-dependency` with `auto_fixable: false` (`fallow fix` will
@@ -172,7 +174,7 @@ export type IssueAction = (FixAction | SuppressLineAction | SuppressFileAction |
  * Discriminant string for [`FixAction`]. Kebab-case per the JSON output
  * contract.
  */
-export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict")
+export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
 /**
  * Singleton discriminant for [`SuppressLineAction`].
  */
@@ -253,6 +255,10 @@ export type SuppressionOrigin = ({
  * The issue kind token from the comment (e.g., "unused-exports"), or None for blanket.
  */
 issue_kind?: (string | null)
+/**
+ * Human-authored reason after `--`, when present.
+ */
+reason?: (string | null)
 /**
  * Whether this was a file-level suppression.
  */
@@ -272,6 +278,10 @@ type: "comment"
  * The name of the export that was tagged.
  */
 export_name: string
+/**
+ * Human-authored reason after `--`, when present.
+ */
+reason?: (string | null)
 type: "jsdoc_tag"
 })
 /**
@@ -1032,24 +1042,25 @@ policy_violations?: PolicyViolationFinding[]
  */
 stale_suppressions?: StaleSuppression[]
 /**
- * Entries in pnpm-workspace.yaml's catalog: or catalogs: sections not
- * referenced by any workspace package via the catalog: protocol. Wrapped
- * in [`UnusedCatalogEntryFinding`] so each entry carries a typed
+ * Entries in package manager catalog sections not referenced by any
+ * workspace package via the catalog: protocol. Supports
+ * `pnpm-workspace.yaml` catalogs and Bun root `package.json` catalogs.
+ * Wrapped in [`UnusedCatalogEntryFinding`] so each entry carries a typed
  * `actions` array natively, with per-instance `auto_fixable` derived
- * from `hardcoded_consumers`.
+ * from `hardcoded_consumers` and the catalog source file.
  */
 unused_catalog_entries?: UnusedCatalogEntryFinding[]
 /**
- * Named groups under pnpm-workspace.yaml's catalogs: section that declare
- * no package entries. The top-level catalog: map is not reported. Wrapped
- * in [`EmptyCatalogGroupFinding`].
+ * Named groups under package manager catalogs sections that declare no
+ * package entries. The top-level catalog: map is not reported. Wrapped in
+ * [`EmptyCatalogGroupFinding`].
  */
 empty_catalog_groups?: EmptyCatalogGroupFinding[]
 /**
  * Workspace package.json references to catalogs (`catalog:` or
- * `catalog:<name>`) that do not declare the consumed package. pnpm install
- * will error until the named catalog grows to include the package or the
- * reference is switched / removed. Wrapped in
+ * `catalog:<name>`) that do not declare the consumed package. The package
+ * manager install will error until the named catalog grows to include the
+ * package or the reference is switched / removed. Wrapped in
  * [`UnresolvedCatalogReferenceFinding`] with the discriminated
  * `add-catalog-entry` / `update-catalog-reference` primary at position 0.
  */
@@ -1134,6 +1145,28 @@ unused_component_props?: UnusedComponentPropFinding[]
  * `warn`.
  */
 unused_component_emits?: UnusedComponentEmitFinding[]
+/**
+ * Angular `@Input()` / signal `input()` / `model()` inputs read nowhere in
+ * their own component (neither the template nor the class body). Wrapped in
+ * [`UnusedComponentInputFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+unused_component_inputs?: UnusedComponentInputFinding[]
+/**
+ * Angular `@Output()` / signal `output()` outputs emitted nowhere in their
+ * own component (no `this.<output>.emit(...)`). Wrapped in
+ * [`UnusedComponentOutputFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+unused_component_outputs?: UnusedComponentOutputFinding[]
+/**
+ * Svelte components dispatching a custom event via `createEventDispatcher()`
+ * whose event name is listened to nowhere project-wide (cross-file
+ * dead-output direction). Wrapped in [`UnusedSvelteEventFinding`] so each
+ * entry carries a typed `actions` array natively. Default severity is
+ * `warn`.
+ */
+unused_svelte_events?: UnusedSvelteEventFinding[]
 /**
  * Next.js Server Actions (exports of `"use server"` files) that no code in
  * the project references. Reclassified out of `unused_exports` for
@@ -1277,6 +1310,19 @@ unused_component_props?: number
  * Vue `<script setup>` emits emitted nowhere inside their own SFC.
  */
 unused_component_emits?: number
+/**
+ * Angular `@Input()` bindings referenced nowhere inside their own component.
+ */
+unused_component_inputs?: number
+/**
+ * Angular `@Output()` bindings emitted nowhere inside their own component.
+ */
+unused_component_outputs?: number
+/**
+ * Svelte components dispatching a custom event via `createEventDispatcher`
+ * whose name is listened to nowhere in the project.
+ */
+unused_svelte_events?: number
 /**
  * Next.js Server Actions (exports of `"use server"` files) referenced by no
  * code in the project.
@@ -1417,11 +1463,12 @@ type: FixActionType
  * FINDING, not per action type: the same `type` may carry
  * `auto_fixable: true` on one finding and `auto_fixable: false` on
  * another when per-instance guards in the applier discriminate (e.g.
- * `remove-catalog-entry` flips on `hardcoded_consumers`, the primary
- * dependency action flips between `remove-dependency` /
- * `move-dependency` on `used_in_workspaces`). Filter on this bool of
- * each individual action, not on `type`. See the [`IssueAction`]
- * enum-level docs for the full list of per-instance flips.
+ * `remove-catalog-entry` flips on `hardcoded_consumers` and catalog
+ * source file, the primary dependency action flips between
+ * `remove-dependency` / `move-dependency` on `used_in_workspaces`).
+ * Filter on this bool of each individual action, not on `type`. See the
+ * [`IssueAction`] enum-level docs for the full list of per-instance
+ * flips.
  */
 auto_fixable: boolean
 /**
@@ -2393,12 +2440,20 @@ line: number
  */
 col: number
 origin: SuppressionOrigin
+/**
+ * True when `rules.require-suppression-reason` reported a suppression
+ * comment or tag that has no reason.
+ */
+missing_reason?: boolean
+/**
+ * Suggested next steps. Always emitted.
+ */
+actions: IssueAction[]
 }
 /**
  * Wire-shape envelope for an [`UnusedCatalogEntry`] finding. Per-instance
- * `auto_fixable` flips to `false` when `hardcoded_consumers` is non-empty:
- * the entry cannot be removed safely while a workspace package still pins
- * the same package via a hardcoded version range.
+ * `auto_fixable` flips to `false` when `hardcoded_consumers` is non-empty or
+ * the source is not `pnpm-workspace.yaml`.
  */
 export interface UnusedCatalogEntryFinding {
 /**
@@ -2406,16 +2461,16 @@ export interface UnusedCatalogEntryFinding {
  */
 entry_name: string
 /**
- * Catalog group: `"default"` for the top-level `catalog:` map, or the
- * named catalog key for entries declared under `catalogs.<name>:`.
+ * Catalog group: `"default"` for the default catalog map, or the named
+ * catalog key for entries declared under `catalogs.<name>`.
  */
 catalog_name: string
 /**
- * Path to `pnpm-workspace.yaml`, relative to the analyzed root.
+ * Path to the catalog source file, relative to the analyzed root.
  */
 path: string
 /**
- * 1-based line number of the catalog entry within `pnpm-workspace.yaml`.
+ * 1-based line number of the catalog entry within the source file.
  */
 line: number
 /**
@@ -2437,20 +2492,20 @@ introduced?: (AuditIntroduced | null)
 }
 /**
  * Wire-shape envelope for an [`EmptyCatalogGroup`] finding. Carries a
- * straightforward `remove-empty-catalog-group` primary plus a YAML-comment
- * suppress.
+ * `remove-empty-catalog-group` primary. YAML-sourced findings also include a
+ * YAML-comment suppress action.
  */
 export interface EmptyCatalogGroupFinding {
 /**
- * Catalog group name declared under the top-level `catalogs:` map.
+ * Catalog group name declared under the `catalogs` map.
  */
 catalog_name: string
 /**
- * Path to `pnpm-workspace.yaml`, relative to the analyzed root.
+ * Path to the catalog source file, relative to the analyzed root.
  */
 path: string
 /**
- * 1-based line number of the empty group header within `pnpm-workspace.yaml`.
+ * 1-based line number of the empty group header within the source file.
  */
 line: number
 /**
@@ -2496,10 +2551,10 @@ path: string
  */
 line: number
 /**
- * Other catalogs (in the same `pnpm-workspace.yaml`) that DO declare this
- * package. Empty when no catalog has the package. Sorted lexicographically.
- * Lets agents and humans decide whether to switch the reference to a
- * different catalog or to add the entry to the named catalog.
+ * Other catalogs in the same catalog source that DO declare this package.
+ * Empty when no catalog has the package. Sorted lexicographically. Lets
+ * agents and humans decide whether to switch the reference to a different
+ * catalog or to add the entry to the named catalog.
  */
 available_in_catalogs?: string[]
 /**
@@ -2745,7 +2800,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnprovidedInject`] finding. There is no safe
  * auto-fix: the fix is binary but judgement-bearing (add a `provide` for the
- * key, or delete the dead inject). The only action is a line-level suppress.
+ * key, or delete the dead inject). Actions are manual remediation guidance
+ * plus a line-level suppress.
  */
 export interface UnprovidedInjectFinding {
 /**
@@ -2782,8 +2838,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnrenderedComponent`] finding. There is no safe
  * auto-fix: the fix is binary but judgement-bearing (render the component
- * somewhere, or delete the dead component). The only action is a line-level
- * suppress.
+ * somewhere, or delete the dead component). Actions are manual remediation
+ * guidance plus a line-level suppress.
  */
 export interface UnrenderedComponentFinding {
 /**
@@ -2915,8 +2971,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnusedComponentProp`] finding. There is no safe
  * auto-fix: removing a declared prop is judgement-bearing (the prop may be part
- * of a deliberately-stable public component API). The only action is a
- * line-level suppress at the prop declaration.
+ * of a deliberately-stable public component API). Actions are manual
+ * remediation guidance plus a line-level suppress at the prop declaration.
  */
 export interface UnusedComponentPropFinding {
 /**
@@ -2953,8 +3009,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnusedComponentEmit`] finding. There is no safe
  * auto-fix: removing a declared emit is judgement-bearing (the event may be
- * part of a deliberately-stable public component API). The only action is a
- * line-level suppress at the emit declaration.
+ * part of a deliberately-stable public component API). Actions are manual
+ * remediation guidance plus a line-level suppress at the emit declaration.
  */
 export interface UnusedComponentEmitFinding {
 /**
@@ -2988,10 +3044,126 @@ actions: IssueAction[]
  */
 introduced?: (AuditIntroduced | null)
 }
+/**
+ * Wire-shape envelope for an [`UnusedComponentInput`] finding. There is no safe
+ * auto-fix: removing a declared input is judgement-bearing (the input may be
+ * part of a deliberately-stable public component API). The only action is a
+ * line-level suppress at the input declaration.
+ */
+export interface UnusedComponentInputFinding {
+/**
+ * The Angular component/directive `.ts` file declaring the unused input.
+ */
+path: string
+/**
+ * The component name (the `.ts` file stem).
+ */
+component_name: string
+/**
+ * The declared input name that is never read.
+ */
+input_name: string
+/**
+ * 1-based line number of the input declaration.
+ */
+line: number
+/**
+ * 0-based byte column offset of the input declaration.
+ */
+col: number
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+}
+/**
+ * Wire-shape envelope for an [`UnusedComponentOutput`] finding. There is no safe
+ * auto-fix: removing a declared output is judgement-bearing (the event may be
+ * part of a deliberately-stable public component API). The only action is a
+ * line-level suppress at the output declaration.
+ */
+export interface UnusedComponentOutputFinding {
+/**
+ * The Angular component/directive `.ts` file declaring the unused output.
+ */
+path: string
+/**
+ * The component name (the `.ts` file stem).
+ */
+component_name: string
+/**
+ * The declared output name that is never emitted.
+ */
+output_name: string
+/**
+ * 1-based line number of the output declaration.
+ */
+line: number
+/**
+ * 0-based byte column offset of the output declaration.
+ */
+col: number
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+}
+/**
+ * Wire-shape envelope for an [`UnusedSvelteEvent`] finding. There is no safe
+ * auto-fix: removing a dispatched event is judgement-bearing (the event may be
+ * part of a deliberately-stable public component API, or a listener may be
+ * added later). Actions are manual remediation guidance plus a line-level
+ * suppress at the `dispatch` call.
+ */
+export interface UnusedSvelteEventFinding {
+/**
+ * The `.svelte` component dispatching the unlistened event.
+ */
+path: string
+/**
+ * The component name (the `.svelte` file stem).
+ */
+component_name: string
+/**
+ * The dispatched event name that is listened to nowhere.
+ */
+event_name: string
+/**
+ * 1-based line number of the `dispatch('<name>')` call.
+ */
+line: number
+/**
+ * 0-based byte column offset of the `dispatch('<name>')` call.
+ */
+col: number
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+}
 /**
  * Wire-shape envelope for an [`UnusedServerAction`] finding. There is no safe
  * auto-fix: the fix is binary but judgement-bearing (wire the action up to a
- * consumer, or delete it). The only action is a line-level suppress.
+ * consumer, or delete it). Actions are manual remediation guidance plus a
+ * line-level suppress.
  */
 export interface UnusedServerActionFinding {
 /**
@@ -3024,7 +3196,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnusedLoadDataKey`] finding. There is no safe
  * auto-fix: a `load()` fetch can have side effects, so deleting the key is a
- * human call. The only action is a line-level suppress.
+ * human call. Actions are manual remediation guidance plus a line-level
+ * suppress.
  */
 export interface UnusedLoadDataKeyFinding {
 /**
@@ -6964,24 +7137,25 @@ policy_violations?: PolicyViolationFinding[]
  */
 stale_suppressions?: StaleSuppression[]
 /**
- * Entries in pnpm-workspace.yaml's catalog: or catalogs: sections not
- * referenced by any workspace package via the catalog: protocol. Wrapped
- * in [`UnusedCatalogEntryFinding`] so each entry carries a typed
+ * Entries in package manager catalog sections not referenced by any
+ * workspace package via the catalog: protocol. Supports
+ * `pnpm-workspace.yaml` catalogs and Bun root `package.json` catalogs.
+ * Wrapped in [`UnusedCatalogEntryFinding`] so each entry carries a typed
  * `actions` array natively, with per-instance `auto_fixable` derived
- * from `hardcoded_consumers`.
+ * from `hardcoded_consumers` and the catalog source file.
  */
 unused_catalog_entries?: UnusedCatalogEntryFinding[]
 /**
- * Named groups under pnpm-workspace.yaml's catalogs: section that declare
- * no package entries. The top-level catalog: map is not reported. Wrapped
- * in [`EmptyCatalogGroupFinding`].
+ * Named groups under package manager catalogs sections that declare no
+ * package entries. The top-level catalog: map is not reported. Wrapped in
+ * [`EmptyCatalogGroupFinding`].
  */
 empty_catalog_groups?: EmptyCatalogGroupFinding[]
 /**
  * Workspace package.json references to catalogs (`catalog:` or
- * `catalog:<name>`) that do not declare the consumed package. pnpm install
- * will error until the named catalog grows to include the package or the
- * reference is switched / removed. Wrapped in
+ * `catalog:<name>`) that do not declare the consumed package. The package
+ * manager install will error until the named catalog grows to include the
+ * package or the reference is switched / removed. Wrapped in
  * [`UnresolvedCatalogReferenceFinding`] with the discriminated
  * `add-catalog-entry` / `update-catalog-reference` primary at position 0.
  */
@@ -7066,6 +7240,28 @@ unused_component_props?: UnusedComponentPropFinding[]
  * `warn`.
  */
 unused_component_emits?: UnusedComponentEmitFinding[]
+/**
+ * Angular `@Input()` / signal `input()` / `model()` inputs read nowhere in
+ * their own component (neither the template nor the class body). Wrapped in
+ * [`UnusedComponentInputFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+unused_component_inputs?: UnusedComponentInputFinding[]
+/**
+ * Angular `@Output()` / signal `output()` outputs emitted nowhere in their
+ * own component (no `this.<output>.emit(...)`). Wrapped in
+ * [`UnusedComponentOutputFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+unused_component_outputs?: UnusedComponentOutputFinding[]
+/**
+ * Svelte components dispatching a custom event via `createEventDispatcher()`
+ * whose event name is listened to nowhere project-wide (cross-file
+ * dead-output direction). Wrapped in [`UnusedSvelteEventFinding`] so each
+ * entry carries a typed `actions` array natively. Default severity is
+ * `warn`.
+ */
+unused_svelte_events?: UnusedSvelteEventFinding[]
 /**
  * Next.js Server Actions (exports of `"use server"` files) that no code in
  * the project references. Reclassified out of `unused_exports` for