fallow 3.0.0 → 3.2.0

package/README.md

@@ -1,8 +1,8 @@
 # fallow
 
-**Deterministic codebase intelligence for TypeScript, JavaScript, and styling.**
+**Codebase intelligence for TypeScript and JavaScript.**
 
-Quality, risk, architecture, dependencies, duplication, design-system drift, and safe cleanup evidence for humans, CI, and agents.
+Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift, for humans, CI, and the agents writing your code.
 
 [![CI](https://github.com/fallow-rs/fallow/actions/workflows/ci.yml/badge.svg)](https://github.com/fallow-rs/fallow/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/fallow.svg)](https://www.npmjs.com/package/fallow)

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.0.0",
+  "version": "3.2.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -2189,6 +2189,40 @@
       "license_note": null,
       "docs_url": "https://docs.fallow.tools/explanations/dead-code#test-only-dependencies"
     },
+    {
+      "id": "dev-dependency-in-production",
+      "rule_id": "fallow/dev-dependency-in-production",
+      "command": "dead-code",
+      "category": "Dependencies",
+      "description": "devDependency imported by production code with a runtime import",
+      "label": "Dev Dependencies Used in Production",
+      "config_key": "dev-dependencies-in-production",
+      "registry_index": 16,
+      "aliases": [],
+      "lsp": true,
+      "filter_flag": "--unused-deps",
+      "result_key": "dev_dependencies_in_production",
+      "summary_label": "Dev dependencies used in production",
+      "summary_docs_anchor": "dev-dependencies-in-production",
+      "sarif_rule_ids": [
+        "fallow/dev-dependency-in-production"
+      ],
+      "codeclimate_check_names": [
+        "fallow/dev-dependency-in-production"
+      ],
+      "ts_alias": {
+        "name": "DevDependencyInProduction",
+        "parent": "DevDependencyInProductionFinding"
+      },
+      "counts_in_total": true,
+      "fixable": false,
+      "suppressible": false,
+      "suppress_comment": null,
+      "note": null,
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://docs.fallow.tools/explanations/dead-code#dev-dependencies-in-production"
+    },
     {
       "id": "unused-enum-member",
       "rule_id": "fallow/unused-enum-member",
@@ -2403,7 +2437,7 @@
       "description": "Circular dependency chain detected",
       "label": "Circular Dependencies",
       "config_key": "circular-dependencies",
-      "registry_index": 16,
+      "registry_index": 17,
       "aliases": [
         "circular-dependencies"
       ],
@@ -2439,7 +2473,7 @@
       "description": "Two or more barrel files re-export from each other in a loop",
       "label": "Re-Export Cycles",
       "config_key": "re-export-cycle",
-      "registry_index": 17,
+      "registry_index": 18,
       "aliases": [
         "re-export-cycles",
         "reexport-cycle",
@@ -2477,7 +2511,7 @@
       "description": "Import crosses a configured architecture boundary",
       "label": "Boundary Violations",
       "config_key": "boundary-violation",
-      "registry_index": 18,
+      "registry_index": 19,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--boundary-violations",
@@ -2511,7 +2545,7 @@
       "description": "Source file matches no configured architecture boundary zone",
       "label": "Boundary Coverage",
       "config_key": "boundary-violation",
-      "registry_index": 19,
+      "registry_index": 20,
       "aliases": [
         "boundary-coverage-violations"
       ],
@@ -2544,7 +2578,7 @@
       "description": "Zoned file calls a callee its zone forbids",
       "label": "Boundary Call Violations",
       "config_key": "boundary-violation",
-      "registry_index": 20,
+      "registry_index": 21,
       "aliases": [
         "boundary-calls",
         "boundary-call-violations"
@@ -2578,7 +2612,7 @@
       "description": "Banned usage matched a rule-pack rule",
       "label": "Policy Violations",
       "config_key": "policy-violation",
-      "registry_index": 21,
+      "registry_index": 22,
       "aliases": [
         "policy-violations"
       ],
@@ -2611,7 +2645,7 @@
       "description": "Suppression comment or tag no longer matches any issue",
       "label": "Stale Suppressions",
       "config_key": "stale-suppressions",
-      "registry_index": 36,
+      "registry_index": 37,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--stale-suppressions",
@@ -2644,7 +2678,7 @@
       "description": "Suppression comment omits a required reason",
       "label": "Missing Suppression Reasons",
       "config_key": "require-suppression-reason",
-      "registry_index": 37,
+      "registry_index": 38,
       "aliases": [
         "missing-suppression-reasons"
       ],
@@ -2673,7 +2707,7 @@
       "description": "Catalog entry not referenced by any workspace package",
       "label": "Unused Catalog Entries",
       "config_key": "unused-catalog-entries",
-      "registry_index": 38,
+      "registry_index": 39,
       "aliases": [
         "catalog",
         "unused-catalog-entries"
@@ -2710,7 +2744,7 @@
       "description": "Named catalog group has no entries",
       "label": "Empty Catalog Groups",
       "config_key": "empty-catalog-groups",
-      "registry_index": 39,
+      "registry_index": 40,
       "aliases": [
         "empty-catalog",
         "empty-catalog-groups"
@@ -2747,7 +2781,7 @@
       "description": "package.json references a catalog that does not declare the package",
       "label": "Unresolved Catalog References",
       "config_key": "unresolved-catalog-references",
-      "registry_index": 40,
+      "registry_index": 41,
       "aliases": [
         "unresolved-catalog",
         "unresolved-catalog-references"
@@ -2784,7 +2818,7 @@
       "description": "pnpm.overrides entry targets a package not declared or resolved",
       "label": "Unused Dependency Overrides",
       "config_key": "unused-dependency-overrides",
-      "registry_index": 41,
+      "registry_index": 42,
       "aliases": [
         "unused-dependency-overrides",
         "unused-override",
@@ -2822,7 +2856,7 @@
       "description": "pnpm.overrides entry has an unparsable key or value",
       "label": "Misconfigured Dependency Overrides",
       "config_key": "misconfigured-dependency-overrides",
-      "registry_index": 42,
+      "registry_index": 43,
       "aliases": [
         "misconfigured-dependency-overrides",
         "misconfigured-override",
@@ -2860,7 +2894,7 @@
       "description": "\"use client\" file exports a server-only / route-config name",
       "label": "Invalid Client Exports",
       "config_key": "invalid-client-export",
-      "registry_index": 22,
+      "registry_index": 23,
       "aliases": [
         "invalid-client-exports"
       ],
@@ -2893,7 +2927,7 @@
       "description": "Barrel re-exports both a \"use client\" module and a server-only module",
       "label": "Mixed Client/Server Barrels",
       "config_key": "mixed-client-server-barrel",
-      "registry_index": 23,
+      "registry_index": 24,
       "aliases": [
         "mixed-client-server-barrels"
       ],
@@ -2926,7 +2960,7 @@
       "description": "\"use client\" / \"use server\" directive is not in the leading position and is ignored",
       "label": "Misplaced Directives",
       "config_key": "misplaced-directive",
-      "registry_index": 24,
+      "registry_index": 25,
       "aliases": [
         "misplaced-directives"
       ],
@@ -2959,7 +2993,7 @@
       "description": "inject() / getContext() reads a key that no provide() / setContext() supplies",
       "label": "Unprovided Injects",
       "config_key": "unprovided-injects",
-      "registry_index": 25,
+      "registry_index": 26,
       "aliases": [
         "unprovided-injects"
       ],
@@ -2992,7 +3026,7 @@
       "description": "A Vue / Svelte component is reachable through a barrel but rendered nowhere",
       "label": "Unrendered Components",
       "config_key": "unrendered-components",
-      "registry_index": 26,
+      "registry_index": 27,
       "aliases": [
         "unrendered-components"
       ],
@@ -3025,7 +3059,7 @@
       "description": "A Vue, Svelte, or React component prop is referenced nowhere in its own component",
       "label": "Unused Component Props",
       "config_key": "unused-component-props",
-      "registry_index": 27,
+      "registry_index": 28,
       "aliases": [
         "unused-component-props"
       ],
@@ -3058,7 +3092,7 @@
       "description": "A Vue <script setup> defineEmits event is emitted nowhere in its own component",
       "label": "Unused Component Emits",
       "config_key": "unused-component-emits",
-      "registry_index": 28,
+      "registry_index": 29,
       "aliases": [
         "unused-component-emits"
       ],
@@ -3091,7 +3125,7 @@
       "description": "An Angular @Input() / signal input() / model() input is read nowhere in its own component",
       "label": "Unused Component Inputs",
       "config_key": "unused-component-inputs",
-      "registry_index": 29,
+      "registry_index": 30,
       "aliases": [
         "unused-component-inputs"
       ],
@@ -3124,7 +3158,7 @@
       "description": "An Angular @Output() / signal output() output is emitted nowhere in its own component",
       "label": "Unused Component Outputs",
       "config_key": "unused-component-outputs",
-      "registry_index": 30,
+      "registry_index": 31,
       "aliases": [
         "unused-component-outputs"
       ],
@@ -3157,7 +3191,7 @@
       "description": "A Svelte component dispatches a createEventDispatcher event whose name is listened to nowhere in the project",
       "label": "Unused Svelte Events",
       "config_key": "unused-svelte-events",
-      "registry_index": 31,
+      "registry_index": 32,
       "aliases": [
         "unused-svelte-events"
       ],
@@ -3190,7 +3224,7 @@
       "description": "A Next.js Server Action exported from a \"use server\" file is referenced by no code in the project",
       "label": "Unused Server Actions",
       "config_key": "unused-server-actions",
-      "registry_index": 32,
+      "registry_index": 33,
       "aliases": [
         "unused-server-actions"
       ],
@@ -3223,7 +3257,7 @@
       "description": "A SvelteKit load() return-object key is read by no consumer",
       "label": "Unused Load Data Keys",
       "config_key": "unused-load-data-keys",
-      "registry_index": 33,
+      "registry_index": 34,
       "aliases": [
         "unused-load-data-keys"
       ],
@@ -3256,7 +3290,7 @@
       "description": "A React/Preact prop is forwarded unchanged through 3+ pass-through components to a distant consumer",
       "label": "Prop Drilling",
       "config_key": "prop-drilling",
-      "registry_index": 48,
+      "registry_index": 49,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -3285,7 +3319,7 @@
       "description": "A React/Preact component whose whole body is a single spread-forwarded child render (a candidate for inlining)",
       "label": "Thin Wrappers",
       "config_key": "thin-wrapper",
-      "registry_index": 49,
+      "registry_index": 50,
       "aliases": [
         "thin-wrappers"
       ],
@@ -3316,7 +3350,7 @@
       "description": "Three or more React/Preact components across two or more files declare an identical prop-name set (a missing shared Props type)",
       "label": "Duplicate Prop Shapes",
       "config_key": "duplicate-prop-shape",
-      "registry_index": 50,
+      "registry_index": 51,
       "aliases": [
         "duplicate-prop-shapes"
       ],
@@ -3347,7 +3381,7 @@
       "description": "Two or more Next.js App Router route files resolve to the same URL",
       "label": "Route Collisions",
       "config_key": "route-collision",
-      "registry_index": 34,
+      "registry_index": 35,
       "aliases": [
         "route-collisions"
       ],
@@ -3380,7 +3414,7 @@
       "description": "Sibling Next.js dynamic route segments use different slug names at the same position",
       "label": "Dynamic Segment Conflicts",
       "config_key": "dynamic-segment-name-conflict",
-      "registry_index": 35,
+      "registry_index": 36,
       "aliases": [
         "dynamic-segment-name-conflicts"
       ],
@@ -3548,7 +3582,7 @@
       "description": "CSS or CSS-in-JS hardcoded styling value bypasses the design token system",
       "label": "CSS Token Drift",
       "config_key": "css-token-drift",
-      "registry_index": 51,
+      "registry_index": 52,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -3575,7 +3609,7 @@
       "description": "CSS or CSS-in-JS declaration block is duplicated across rules",
       "label": "CSS Duplicate Block",
       "config_key": "css-duplicate-block",
-      "registry_index": 52,
+      "registry_index": 53,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -3602,7 +3636,7 @@
       "description": "CSS selector, nesting, or important usage is structurally complex",
       "label": "CSS Selector Complexity",
       "config_key": "css-selector-complexity",
-      "registry_index": 53,
+      "registry_index": 54,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -3629,7 +3663,7 @@
       "description": "CSS or CSS-in-JS surface appears unused",
       "label": "CSS Dead Surface",
       "config_key": "css-dead-surface",
-      "registry_index": 54,
+      "registry_index": 55,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -3656,7 +3690,7 @@
       "description": "CSS or CSS-in-JS reference resolves to no stylesheet definition",
       "label": "CSS Broken Reference",
       "config_key": "css-broken-reference",
-      "registry_index": 55,
+      "registry_index": 56,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4007,7 +4041,7 @@
       "description": "Detected feature flag pattern",
       "label": "Feature Flags",
       "config_key": "feature-flags",
-      "registry_index": 46,
+      "registry_index": 47,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,

package/issue-registry.json

@@ -544,6 +544,40 @@
       "license_note": null,
       "docs_url": "https://docs.fallow.tools/explanations/dead-code#test-only-dependencies"
     },
+    {
+      "id": "dev-dependency-in-production",
+      "rule_id": "fallow/dev-dependency-in-production",
+      "command": "dead-code",
+      "category": "Dependencies",
+      "description": "devDependency imported by production code with a runtime import",
+      "label": "Dev Dependencies Used in Production",
+      "config_key": "dev-dependencies-in-production",
+      "registry_index": 16,
+      "aliases": [],
+      "lsp": true,
+      "filter_flag": "--unused-deps",
+      "result_key": "dev_dependencies_in_production",
+      "summary_label": "Dev dependencies used in production",
+      "summary_docs_anchor": "dev-dependencies-in-production",
+      "sarif_rule_ids": [
+        "fallow/dev-dependency-in-production"
+      ],
+      "codeclimate_check_names": [
+        "fallow/dev-dependency-in-production"
+      ],
+      "ts_alias": {
+        "name": "DevDependencyInProduction",
+        "parent": "DevDependencyInProductionFinding"
+      },
+      "counts_in_total": true,
+      "fixable": false,
+      "suppressible": false,
+      "suppress_comment": null,
+      "note": null,
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://docs.fallow.tools/explanations/dead-code#dev-dependencies-in-production"
+    },
     {
       "id": "circular-dependency",
       "rule_id": "fallow/circular-dependency",
@@ -552,7 +586,7 @@
       "description": "Circular dependency chain detected",
       "label": "Circular Dependencies",
       "config_key": "circular-dependencies",
-      "registry_index": 16,
+      "registry_index": 17,
       "aliases": [
         "circular-dependencies"
       ],
@@ -588,7 +622,7 @@
       "description": "Two or more barrel files re-export from each other in a loop",
       "label": "Re-Export Cycles",
       "config_key": "re-export-cycle",
-      "registry_index": 17,
+      "registry_index": 18,
       "aliases": [
         "re-export-cycles",
         "reexport-cycle",
@@ -626,7 +660,7 @@
       "description": "Import crosses a configured architecture boundary",
       "label": "Boundary Violations",
       "config_key": "boundary-violation",
-      "registry_index": 18,
+      "registry_index": 19,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--boundary-violations",
@@ -660,7 +694,7 @@
       "description": "Source file matches no configured architecture boundary zone",
       "label": "Boundary Coverage",
       "config_key": "boundary-violation",
-      "registry_index": 19,
+      "registry_index": 20,
       "aliases": [
         "boundary-coverage-violations"
       ],
@@ -693,7 +727,7 @@
       "description": "Zoned file calls a callee its zone forbids",
       "label": "Boundary Call Violations",
       "config_key": "boundary-violation",
-      "registry_index": 20,
+      "registry_index": 21,
       "aliases": [
         "boundary-calls",
         "boundary-call-violations"
@@ -727,7 +761,7 @@
       "description": "Banned usage matched a rule-pack rule",
       "label": "Policy Violations",
       "config_key": "policy-violation",
-      "registry_index": 21,
+      "registry_index": 22,
       "aliases": [
         "policy-violations"
       ],
@@ -760,7 +794,7 @@
       "description": "\"use client\" file exports a server-only / route-config name",
       "label": "Invalid Client Exports",
       "config_key": "invalid-client-export",
-      "registry_index": 22,
+      "registry_index": 23,
       "aliases": [
         "invalid-client-exports"
       ],
@@ -793,7 +827,7 @@
       "description": "Barrel re-exports both a \"use client\" module and a server-only module",
       "label": "Mixed Client/Server Barrels",
       "config_key": "mixed-client-server-barrel",
-      "registry_index": 23,
+      "registry_index": 24,
       "aliases": [
         "mixed-client-server-barrels"
       ],
@@ -826,7 +860,7 @@
       "description": "\"use client\" / \"use server\" directive is not in the leading position and is ignored",
       "label": "Misplaced Directives",
       "config_key": "misplaced-directive",
-      "registry_index": 24,
+      "registry_index": 25,
       "aliases": [
         "misplaced-directives"
       ],
@@ -859,7 +893,7 @@
       "description": "inject() / getContext() reads a key that no provide() / setContext() supplies",
       "label": "Unprovided Injects",
       "config_key": "unprovided-injects",
-      "registry_index": 25,
+      "registry_index": 26,
       "aliases": [
         "unprovided-injects"
       ],
@@ -892,7 +926,7 @@
       "description": "A Vue / Svelte component is reachable through a barrel but rendered nowhere",
       "label": "Unrendered Components",
       "config_key": "unrendered-components",
-      "registry_index": 26,
+      "registry_index": 27,
       "aliases": [
         "unrendered-components"
       ],
@@ -925,7 +959,7 @@
       "description": "A Vue, Svelte, or React component prop is referenced nowhere in its own component",
       "label": "Unused Component Props",
       "config_key": "unused-component-props",
-      "registry_index": 27,
+      "registry_index": 28,
       "aliases": [
         "unused-component-props"
       ],
@@ -958,7 +992,7 @@
       "description": "A Vue <script setup> defineEmits event is emitted nowhere in its own component",
       "label": "Unused Component Emits",
       "config_key": "unused-component-emits",
-      "registry_index": 28,
+      "registry_index": 29,
       "aliases": [
         "unused-component-emits"
       ],
@@ -991,7 +1025,7 @@
       "description": "An Angular @Input() / signal input() / model() input is read nowhere in its own component",
       "label": "Unused Component Inputs",
       "config_key": "unused-component-inputs",
-      "registry_index": 29,
+      "registry_index": 30,
       "aliases": [
         "unused-component-inputs"
       ],
@@ -1024,7 +1058,7 @@
       "description": "An Angular @Output() / signal output() output is emitted nowhere in its own component",
       "label": "Unused Component Outputs",
       "config_key": "unused-component-outputs",
-      "registry_index": 30,
+      "registry_index": 31,
       "aliases": [
         "unused-component-outputs"
       ],
@@ -1057,7 +1091,7 @@
       "description": "A Svelte component dispatches a createEventDispatcher event whose name is listened to nowhere in the project",
       "label": "Unused Svelte Events",
       "config_key": "unused-svelte-events",
-      "registry_index": 31,
+      "registry_index": 32,
       "aliases": [
         "unused-svelte-events"
       ],
@@ -1090,7 +1124,7 @@
       "description": "A Next.js Server Action exported from a \"use server\" file is referenced by no code in the project",
       "label": "Unused Server Actions",
       "config_key": "unused-server-actions",
-      "registry_index": 32,
+      "registry_index": 33,
       "aliases": [
         "unused-server-actions"
       ],
@@ -1123,7 +1157,7 @@
       "description": "A SvelteKit load() return-object key is read by no consumer",
       "label": "Unused Load Data Keys",
       "config_key": "unused-load-data-keys",
-      "registry_index": 33,
+      "registry_index": 34,
       "aliases": [
         "unused-load-data-keys"
       ],
@@ -1156,7 +1190,7 @@
       "description": "Two or more Next.js App Router route files resolve to the same URL",
       "label": "Route Collisions",
       "config_key": "route-collision",
-      "registry_index": 34,
+      "registry_index": 35,
       "aliases": [
         "route-collisions"
       ],
@@ -1189,7 +1223,7 @@
       "description": "Sibling Next.js dynamic route segments use different slug names at the same position",
       "label": "Dynamic Segment Conflicts",
       "config_key": "dynamic-segment-name-conflict",
-      "registry_index": 35,
+      "registry_index": 36,
       "aliases": [
         "dynamic-segment-name-conflicts"
       ],
@@ -1222,7 +1256,7 @@
       "description": "Suppression comment or tag no longer matches any issue",
       "label": "Stale Suppressions",
       "config_key": "stale-suppressions",
-      "registry_index": 36,
+      "registry_index": 37,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--stale-suppressions",
@@ -1255,7 +1289,7 @@
       "description": "Suppression comment omits a required reason",
       "label": "Missing Suppression Reasons",
       "config_key": "require-suppression-reason",
-      "registry_index": 37,
+      "registry_index": 38,
       "aliases": [
         "missing-suppression-reasons"
       ],
@@ -1284,7 +1318,7 @@
       "description": "Catalog entry not referenced by any workspace package",
       "label": "Unused Catalog Entries",
       "config_key": "unused-catalog-entries",
-      "registry_index": 38,
+      "registry_index": 39,
       "aliases": [
         "catalog",
         "unused-catalog-entries"
@@ -1321,7 +1355,7 @@
       "description": "Named catalog group has no entries",
       "label": "Empty Catalog Groups",
       "config_key": "empty-catalog-groups",
-      "registry_index": 39,
+      "registry_index": 40,
       "aliases": [
         "empty-catalog",
         "empty-catalog-groups"
@@ -1358,7 +1392,7 @@
       "description": "package.json references a catalog that does not declare the package",
       "label": "Unresolved Catalog References",
       "config_key": "unresolved-catalog-references",
-      "registry_index": 40,
+      "registry_index": 41,
       "aliases": [
         "unresolved-catalog",
         "unresolved-catalog-references"
@@ -1395,7 +1429,7 @@
       "description": "pnpm.overrides entry targets a package not declared or resolved",
       "label": "Unused Dependency Overrides",
       "config_key": "unused-dependency-overrides",
-      "registry_index": 41,
+      "registry_index": 42,
       "aliases": [
         "unused-dependency-overrides",
         "unused-override",
@@ -1433,7 +1467,7 @@
       "description": "pnpm.overrides entry has an unparsable key or value",
       "label": "Misconfigured Dependency Overrides",
       "config_key": "misconfigured-dependency-overrides",
-      "registry_index": 42,
+      "registry_index": 43,
       "aliases": [
         "misconfigured-dependency-overrides",
         "misconfigured-override",
@@ -1471,7 +1505,7 @@
       "description": "Detected feature flag pattern",
       "label": "Feature Flags",
       "config_key": "feature-flags",
-      "registry_index": 46,
+      "registry_index": 47,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1498,7 +1532,7 @@
       "description": "A React/Preact prop is forwarded unchanged through 3+ pass-through components to a distant consumer",
       "label": "Prop Drilling",
       "config_key": "prop-drilling",
-      "registry_index": 48,
+      "registry_index": 49,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1527,7 +1561,7 @@
       "description": "A React/Preact component whose whole body is a single spread-forwarded child render (a candidate for inlining)",
       "label": "Thin Wrappers",
       "config_key": "thin-wrapper",
-      "registry_index": 49,
+      "registry_index": 50,
       "aliases": [
         "thin-wrappers"
       ],
@@ -1558,7 +1592,7 @@
       "description": "Three or more React/Preact components across two or more files declare an identical prop-name set (a missing shared Props type)",
       "label": "Duplicate Prop Shapes",
       "config_key": "duplicate-prop-shape",
-      "registry_index": 50,
+      "registry_index": 51,
       "aliases": [
         "duplicate-prop-shapes"
       ],
@@ -1589,7 +1623,7 @@
       "description": "CSS or CSS-in-JS hardcoded styling value bypasses the design token system",
       "label": "CSS Token Drift",
       "config_key": "css-token-drift",
-      "registry_index": 51,
+      "registry_index": 52,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1616,7 +1650,7 @@
       "description": "CSS or CSS-in-JS declaration block is duplicated across rules",
       "label": "CSS Duplicate Block",
       "config_key": "css-duplicate-block",
-      "registry_index": 52,
+      "registry_index": 53,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1643,7 +1677,7 @@
       "description": "CSS selector, nesting, or important usage is structurally complex",
       "label": "CSS Selector Complexity",
       "config_key": "css-selector-complexity",
-      "registry_index": 53,
+      "registry_index": 54,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1670,7 +1704,7 @@
       "description": "CSS or CSS-in-JS surface appears unused",
       "label": "CSS Dead Surface",
       "config_key": "css-dead-surface",
-      "registry_index": 54,
+      "registry_index": 55,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1697,7 +1731,7 @@
       "description": "CSS or CSS-in-JS reference resolves to no stylesheet definition",
       "label": "CSS Broken Reference",
       "config_key": "css-broken-reference",
-      "registry_index": 55,
+      "registry_index": 56,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fallow",
-  "version": "3.0.0",
-  "description": "Deterministic codebase intelligence for TypeScript and JavaScript. Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, zero-config framework support.",
+  "version": "3.2.0",
+  "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -87,13 +87,13 @@
     "@tanstack/intent": "0.3.2"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.0.0",
-    "@fallow-cli/darwin-x64": "3.0.0",
-    "@fallow-cli/linux-x64-gnu": "3.0.0",
-    "@fallow-cli/linux-arm64-gnu": "3.0.0",
-    "@fallow-cli/linux-x64-musl": "3.0.0",
-    "@fallow-cli/linux-arm64-musl": "3.0.0",
-    "@fallow-cli/win32-arm64-msvc": "3.0.0",
-    "@fallow-cli/win32-x64-msvc": "3.0.0"
+    "@fallow-cli/darwin-arm64": "3.2.0",
+    "@fallow-cli/darwin-x64": "3.2.0",
+    "@fallow-cli/linux-x64-gnu": "3.2.0",
+    "@fallow-cli/linux-arm64-gnu": "3.2.0",
+    "@fallow-cli/linux-x64-musl": "3.2.0",
+    "@fallow-cli/linux-arm64-musl": "3.2.0",
+    "@fallow-cli/win32-arm64-msvc": "3.2.0",
+    "@fallow-cli/win32-x64-msvc": "3.2.0"
   }
 }

package/schema.json

@@ -125,6 +125,7 @@
         "maxCognitive": 15,
         "maxCrap": 30.0,
         "crapRefactorBand": 5,
+        "maxUnitSize": 60,
         "coverage": null,
         "coverageRoot": null,
         "ignore": [],
@@ -177,6 +178,7 @@
         "duplicate-exports": "error",
         "type-only-dependencies": "warn",
         "test-only-dependencies": "warn",
+        "dev-dependencies-in-production": "warn",
         "circular-dependencies": "error",
         "re-export-cycle": "warn",
         "boundary-violation": "error",
@@ -835,6 +837,13 @@
           "maximum": 65535,
           "default": 5
         },
+        "maxUnitSize": {
+          "description": "Maximum function length in lines of code before it is reported as an\noversized \"large function\" (default: 60). Raise it globally, or per file\nvia `thresholdOverrides[].maxUnitSize`, to relax the bar for generated or\ntest files (where a `describe()` block spans hundreds of lines) without\ndisabling complexity checks on those files. This filters the reported\nlarge-functions list only; the descriptive unit-size profile and the\nhealth score still reflect raw sizes (use `health.ignore` to remove a\nfile from the score entirely).",
+          "type": "integer",
+          "format": "uint32",
+          "minimum": 0,
+          "default": 60
+        },
         "coverage": {
           "description": "Path to Istanbul-format coverage data for accurate per-function CRAP\nscores. Relative paths resolve against the project root. The CLI\n`--coverage` flag and `FALLOW_COVERAGE` environment variable override\nthis value.",
           "type": [
@@ -935,6 +944,15 @@
           ],
           "format": "double"
         },
+        "maxUnitSize": {
+          "description": "Local unit-size ceiling: maximum function length in lines of code before\nit is reported as an oversized \"large function\". Leave `functions` empty\nto relax the bar for every function in the matching files (which covers\nboth the `describe()` wrapper and the individual `it()` blocks in a test\nsuite).",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint32",
+          "minimum": 0
+        },
         "reason": {
           "description": "Human-readable rationale for the exception.",
           "type": [
@@ -1042,37 +1060,37 @@
         "unused-store-members": {
           "description": "Store members (Pinia `state` / `getters` / `actions` key, or a\nsetup-store returned key) declared but never accessed by any consumer\nproject-wide. Defaults to `warn`, not `error` like the closed-set\nclass/enum member rules: a store has an OPEN declaration surface\n(plugins, `$onAction`, dynamic dispatch) so analyzer confidence is\ngenuinely lower; warn encodes that without failing CI. Promotable to\n`error` once validated on a codebase.",
           "$ref": "#/$defs/Severity",
-          "default": "error"
+          "default": "warn"
         },
         "unprovided-injects": {
           "description": "Vue `inject(KEY)` / Svelte `getContext(KEY)` whose symbol KEY is\n`provide`/`setContext`'d nowhere in the project (the\ninjected-never-provided dead-half). Defaults to `warn`, not `error`:\na DI key has an open provide surface (plugins, app-level provide) so\nanalyzer confidence is lower; warn encodes that without failing CI.",
           "$ref": "#/$defs/Severity",
-          "default": "error"
+          "default": "warn"
         },
         "unrendered-components": {
           "description": "Vue/Svelte single-file component reachable in the module graph but\nrendered nowhere in the project (the imported-but-never-rendered\ndead-half). Defaults to `warn`, not `error`: a component can be rendered\nreflectively (dynamic `<component :is>`), so analyzer confidence is\nlower; warn encodes that without failing CI.",
           "$ref": "#/$defs/Severity",
-          "default": "error"
+          "default": "warn"
         },
         "unused-component-props": {
           "description": "Vue `<script setup>` `defineProps`, Svelte 5 `$props()`, or React\ndeclared prop referenced nowhere inside its own component. The\nsingle-component dead-input direction. Defaults to `warn`, not `error`: a\nprop can be part of a deliberately-stable public component API, so\nanalyzer confidence is lower; warn encodes that without failing CI.",
           "$ref": "#/$defs/Severity",
-          "default": "error"
+          "default": "warn"
         },
         "unused-component-emits": {
           "description": "Vue `<script setup>` `defineEmits` declared event emitted nowhere inside\nits own single-file component (no `emit('<name>')` call). The single-file\ndead-input direction. Defaults to `warn`, not `error`: an emit can be part\nof a deliberately-stable public component API, so analyzer confidence is\nlower; warn encodes that without failing CI.",
           "$ref": "#/$defs/Severity",
-          "default": "error"
+          "default": "warn"
         },
         "unused-component-inputs": {
           "description": "Angular `@Input()` / signal `input()` / `model()` declared input read\nnowhere inside its own component (neither the inline/external template nor\nthe class body). The single-file dead-input direction, the Angular\nanalogue of `unused-component-prop`. Defaults to `warn`, not `error`: an\ninput can be part of a deliberately-stable public component API, so\nanalyzer confidence is lower; warn encodes that without failing CI.",
           "$ref": "#/$defs/Severity",
-          "default": "error"
+          "default": "warn"
         },
         "unused-component-outputs": {
           "description": "Angular `@Output()` / signal `output()` declared output emitted nowhere\ninside its own component (no `this.<output>.emit(...)`). The single-file\ndead-output direction, the Angular analogue of `unused-component-emit`.\nDefaults to `warn`, not `error`: an output can be part of a\ndeliberately-stable public component API, so analyzer confidence is lower;\nwarn encodes that without failing CI.",
           "$ref": "#/$defs/Severity",
-          "default": "error"
+          "default": "warn"
         },
         "unused-svelte-events": {
           "description": "Svelte component dispatching a custom event via `createEventDispatcher()`\nwhose event name is listened to nowhere in the analyzed project. The\ncross-file dead-output direction (no eslint-plugin-svelte / svelte-check\nrule covers the listener side). Defaults to `warn`, not `error`: a\ndispatched event can be part of a deliberately-stable public component\nAPI, or a listener may be added later, so analyzer confidence is lower;\nwarn encodes that without failing CI.",
@@ -1082,7 +1100,7 @@
         "unused-server-actions": {
           "description": "Next.js Server Action (an export of a `\"use server\"` file) referenced by\nno code in the project: no import-and-call, no `action={fn}` binding, no\n`<form action={fn}>`. Cross-graph dead-export direction, reclassified out\nof `unused-export` for `\"use server\"` files. Defaults to `warn`, not\n`error`: the rule is new and false-negative-preferring, and reflective\naction-dispatch shapes can hide a real consumer; warn encodes that\nwithout failing CI until corpus-validated.",
           "$ref": "#/$defs/Severity",
-          "default": "error"
+          "default": "warn"
         },
         "unused-load-data-keys": {
           "description": "SvelteKit `+page.{ts,server.ts,js,server.js}` `load()` return-object key\nread by no consumer: not off the sibling `+page.svelte`'s `data.<key>`,\nnor project-wide via `page.data.<key>` / `$page.data.<key>`. Cross-file\ndead-input direction. Defaults to `warn`, not `error`: the rule is new and\nfalse-negative-preferring (a whole-object `data` pass abstains), and a\nload fetch can have side effects so deletion is a human call; warn encodes\nthat without failing CI until corpus-validated.",
@@ -1149,6 +1167,10 @@
           "$ref": "#/$defs/Severity",
           "default": "warn"
         },
+        "dev-dependencies-in-production": {
+          "$ref": "#/$defs/Severity",
+          "default": "warn"
+        },
         "circular-dependencies": {
           "$ref": "#/$defs/Severity",
           "default": "error"
@@ -1163,7 +1185,7 @@
         },
         "coverage-gaps": {
           "$ref": "#/$defs/Severity",
-          "default": "error"
+          "default": "off"
         },
         "feature-flags": {
           "$ref": "#/$defs/Severity",
@@ -1982,6 +2004,16 @@
             }
           ]
         },
+        "dev-dependencies-in-production": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "circular-dependencies": {
           "anyOf": [
             {
@@ -2298,6 +2330,12 @@
           "minimum": 0,
           "default": 0
         },
+        "devDependenciesInProduction": {
+          "type": "integer",
+          "format": "uint",
+          "minimum": 0,
+          "default": 0
+        },
         "boundaryViolations": {
           "type": "integer",
           "format": "uint",

package/skills/fallow/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fallow
-description: Codebase intelligence for JavaScript, TypeScript, and styling. Static analysis reports changed-code risk, cleanup opportunities, duplication, circular dependencies, complexity hotspots, architecture boundaries, design-system drift, feature flags, and opt-in security candidates. Runtime coverage can merge production execution data for hot-path review, cold-path deletion confidence, and stale-flag evidence. 123 framework plugins, zero configuration, sub-second static analysis. Use when asked to audit PR risk, find unused code or dependencies, detect duplicates, check styling consistency, inspect architecture boundaries, merge runtime coverage, auto-fix supported issues, or run fallow.
+description: Codebase intelligence for TypeScript and JavaScript. Static analysis of code and styles reports changed-code risk, cleanup opportunities, duplication, circular dependencies, complexity hotspots, architecture boundaries, design-system drift, feature flags, and opt-in security candidates. Runtime coverage can merge production execution data for hot-path review, cold-path deletion confidence, and stale-flag evidence. 123 framework plugins, zero configuration, sub-second static analysis. Use when asked to audit PR risk, find unused code or dependencies, detect duplicates, check styling consistency, inspect architecture boundaries, merge runtime coverage, auto-fix supported issues, or run fallow.
 license: MIT
 metadata:
   author: Bart Waardenburg
@@ -8,9 +8,9 @@ metadata:
   homepage: https://docs.fallow.tools
 ---
 
-# Fallow: codebase intelligence for JavaScript, TypeScript, and styling
+# Fallow: codebase intelligence for TypeScript and JavaScript
 
-Codebase intelligence for JavaScript, TypeScript, and styling. The static layer reports quality, changed-code risk, cleanup opportunities, circular dependencies, code duplication, complexity hotspots, architecture boundary violations, design-system styling drift, feature flag patterns, and opt-in security candidates. Runtime coverage merges production execution data into the same `fallow health` report for hot-path review, cold-path deletion confidence, and stale-flag evidence, with a single local capture available by default and continuous/cloud runtime monitoring available as an optional mode. 123 framework plugins, zero configuration, sub-second static analysis.
+Codebase intelligence for TypeScript and JavaScript. The static layer analyzes code and styles and reports quality, changed-code risk, cleanup opportunities, circular dependencies, code duplication, complexity hotspots, architecture boundary violations, design-system styling drift, feature flag patterns, and opt-in security candidates. Runtime coverage merges production execution data into the same `fallow health` report for hot-path review, cold-path deletion confidence, and stale-flag evidence, with a single local capture available by default and continuous/cloud runtime monitoring available as an optional mode. 123 framework plugins, zero configuration, sub-second static analysis.
 
 ## When to Use
 - Find cleanup opportunities: unused files, exports, types, members, dependencies, or stale flags.
@@ -135,6 +135,7 @@ Run `fallow <command> --help` for the full flag list per command (see also refer
 | `unused-optional-dependency` | `--unused-deps` | yes | - | Packages in `optionalDependencies` never imported (often platform-specific; verify before removing) |
 | `type-only-dependency` | `--unused-deps` | - | - | Production dependency only used via type-only imports; Only reported in --production mode; --unused-deps scopes it together with the other dependency kinds |
 | `test-only-dependency` | `--unused-deps` | - | - | Production deps only imported from test files (should be devDependencies) |
+| `dev-dependency-in-production` | `--unused-deps` | - | - | devDependency imported by production code with a runtime import |
 | `unused-enum-member` | `--unused-enum-members` | yes | `// fallow-ignore-next-line unused-enum-member` | Enum values never referenced |
 | `unused-class-member` | `--unused-class-members` | - | `// fallow-ignore-next-line unused-class-member` | Methods and properties |
 | `unused-store-member` | `--unused-store-members` | - | `// fallow-ignore-next-line unused-store-member` | Pinia store state/getter/action (needs `pinia` dep) |
@@ -223,7 +224,7 @@ When using fallow via MCP (`fallow-mcp`), the following tools are available:
 | `feature_flags` | analysis | free | `workspace`, `production` | Detect feature flag patterns (env vars, SDK calls, config objects). Set `top` to limit results |
 | `impact` | introspection | free | `root` | Read the local, opt-in Fallow Impact value report (`fallow impact --format json`). Runs no analysis: current surfacing counts, trend since the last recorded run, pre-commit gate containment, and (on impact v1.5+) resolved/suppressed attribution. History is read from a per-project file in the user's private config dir (never inside the repo). Read-only and `root`-only; the mutating `enable` / `disable` / `default` lifecycle is not exposed. A never-enabled project returns a populated `{"enabled": false, ...}` report (never `{}`); branch on `enabled` and `enabled_source` (`project` / `user` / `default`) then `record_count`, recommending `fallow impact enable` only when `explicit_decision` is `false` (never asked) and staying silent when `true` (deliberately disabled here). Local-developer signal: fallow never records in CI, so empty there and not a CI metric |
 | `impact_all` | introspection | free | `sort`, `limit` | Roll every tracked fallow project on this machine into one cross-repo value report (hashed keys plus basename labels, never paths; local-dev only) |
-| `trace_export` | trace | free | `file`, `export_name` | Trace why an export is used or unused (`fallow dead-code --trace FILE:EXPORT_NAME --format json`). Required `file` and `export_name`. Returns file reachability, entry-point status, direct references, re-export chains, and a reason string. Use before deleting a supposedly-unused export |
+| `trace_export` | trace | free | `file`, `export_name` | Trace why an export is used or unused (`fallow dead-code --trace FILE:EXPORT_NAME --format json`). Required `file` and `export_name`. Returns file reachability, entry-point status, direct references, re-export chains, and a reason string. If `export_name` is a class / enum / store MEMBER, returns a member trace instead (`member_name`, `member_kind`, `owner_export`, `owner_is_used`) plus a `--unused-<kind>-members` pointer; branch on field presence. Use before deleting a supposedly-unused export or debugging an unused-class-member finding |
 | `trace_file` | trace | free | `file` | Trace all graph edges for a file (`fallow dead-code --trace-file PATH --format json`). Required `file`. Returns reachability, exports, imports-from, imported-by, and re-exports. Use to decide whether a file is isolated, barrel-only, or imported by live entry points |
 | `trace_dependency` | trace | free | `package_name` | Trace where a dependency is imported (`fallow dead-code --trace-dependency PACKAGE --format json`). Required `package_name`. Returns importing files, type-only importers, total import count, `used_in_scripts` (true when invoked from package.json scripts or CI configs), and `is_used` (combined import + script signal; mirrors the unused-deps detector so build tools like `microbundle` or `vitest` are not falsely flagged as unused). Use before removing a dependency or moving between `dependencies` and `devDependencies` |
 | `trace_clone` | trace | free | `file`, `line`, `fingerprint` | Deep-dive a duplicate-code clone group (`fallow dupes --trace <spec> --format json`). Address by exactly one of: `file` + `line` (a source location), or `fingerprint` (a `dup:<id>` from a prior `find_dupes` `clone_groups[].fingerprint`, usually `dup:<8hex>` and widened only on rare report collisions). Returns the matched clone instance plus every clone group containing it; each traced group carries its `fingerprint`, an extract-function `suggestion` with estimated savings, and a best-effort `suggested_name` (omitted when no confident name). Supports `mode`, `min_tokens`, `min_lines`, `threshold`, `skip_local`, `cross_language`, `ignore_imports`. Use to consolidate duplication when you need exact sibling locations and a refactor target |
@@ -242,7 +243,7 @@ Most tools accept `root`, `config`, `no_cache`, and `threads` params. Exceptions
 
 All JSON responses include structured `actions` arrays on every finding (dead code, health, duplication), enabling programmatic fix application or suppression.
 
-`health.thresholdOverrides[]` lets projects keep known legacy functions visible as configured local ceilings instead of hiding them with suppressions. Each entry has `files` globs, optional exact `functions`, one or more of `maxCyclomatic`, `maxCognitive`, or `maxCrap`, and optional `reason`. Health JSON may include top-level `threshold_overrides[]` entries with `active`, `stale`, or `no_match` status, and complexity findings that use an override carry `effective_thresholds` plus `threshold_source: "override"`.
+`health.thresholdOverrides[]` lets projects keep known legacy functions visible as configured local ceilings instead of hiding them with suppressions. Each entry has `files` globs, optional exact `functions`, one or more of `maxCyclomatic`, `maxCognitive`, `maxCrap`, or `maxUnitSize`, and optional `reason`. Health JSON may include top-level `threshold_overrides[]` entries with `active`, `stale`, or `no_match` status, and complexity findings that use an override carry `effective_thresholds` plus `threshold_source: "override"`.
 
 `dead-code`, `health`, `dupes`, bare `fallow`, and `audit` JSON output also carry a top-level `next_steps` array of read-only follow-up commands computed from the run's findings: each entry is `{ id, command, reason }`. The `command` is runnable as-is (never a placeholder, never `fix` or any other mutating command); the stable kebab-case `id` (`setup`, `impact-report`, `trace-unused-export`, `trace-clone`, `complexity-breakdown`, `scope-workspaces`, `audit-changed`) maps to a verification step you should run BEFORE acting, for example tracing an export before deleting it. A leading `setup` step (command: `fallow schema`) appears only on unconfigured, non-CI projects with findings and doubles as the onboarding trigger below; it disappears after setup or `fallow init --decline`. An at-most-weekly `impact-report` step (command: `fallow impact`) carries the local value digest when impact tracking has non-zero results; it may ride a clean run. When running via MCP, dispatch on the `id` to the matching tool / `code_execute` host call (`trace_export`, `trace_clone`, `check_health` with `complexity_breakdown: true`, `audit`) rather than shelling out the CLI string. The array is deduplicated, capped at three, and omitted when empty; set `FALLOW_SUGGESTIONS=off` to suppress it.
 

package/skills/fallow/references/cli-reference.md

@@ -508,7 +508,7 @@ fallow health --format json --quiet --trend
 {
   "kind": "health",
   "schema_version": 7,
-  "version": "3.0.0",
+  "version": "3.2.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -532,7 +532,7 @@ fallow health --format json --quiet --trend
 }
 ```
 
-`health.thresholdOverrides[]` config entries can raise local cyclomatic, cognitive, or CRAP ceilings for matching files and optional exact function names. When an override affects output, health JSON includes top-level `threshold_overrides[]` state entries (`active`, `stale`, or `no_match`). Complexity findings evaluated with local ceilings include `effective_thresholds` and `threshold_source: "override"` so agents can see which thresholds drove the finding and avoid treating configured exceptions as hidden suppressions.
+`health.thresholdOverrides[]` config entries can raise local cyclomatic, cognitive, CRAP, or unit-size (large-function line-count) ceilings for matching files and optional exact function names. When an override affects output, health JSON includes top-level `threshold_overrides[]` state entries (`active`, `stale`, or `no_match`). Complexity findings evaluated with local ceilings include `effective_thresholds` and `threshold_source: "override"` so agents can see which thresholds drove the finding and avoid treating configured exceptions as hidden suppressions.
 
 When the unit size very-high-risk percentage is >= 3%, the JSON output includes a `large_functions` array listing functions exceeding 60 lines of code:
 
@@ -906,7 +906,7 @@ fallow audit \
 {
   "kind": "audit",
   "schema_version": 7,
-  "version": "3.0.0",
+  "version": "3.2.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -981,7 +981,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 7,
-  "version": "3.0.0",
+  "version": "3.2.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1082,7 +1082,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.0.0",
+  "version": "3.2.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1111,7 +1111,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.0.0",
+  "version": "3.2.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1820,7 +1820,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 {
   "kind": "dead-code",
   "schema_version": 7,
-  "version": "3.0.0",
+  "version": "3.2.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1980,7 +1980,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 {
   "kind": "dupes",
   "schema_version": 7,
-  "version": "3.0.0",
+  "version": "3.2.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -2024,11 +2024,11 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "kind": "combined",
   "schema_version": 7,
-  "version": "3.0.0",
+  "version": "3.2.0",
   "elapsed_ms": 159,
   "check": {
     "schema_version": 7,
-    "version": "3.0.0",
+    "version": "3.2.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],

package/types/output-contract.d.ts

@@ -186,7 +186,7 @@ export type IssueAction = (FixAction | SuppressLineAction | SuppressFileAction |
  * Discriminant string for [`FixAction`]. Kebab-case per the JSON output
  * contract.
  */
-export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
+export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
 /**
  * Singleton discriminant for [`SuppressLineAction`].
  */
@@ -1107,6 +1107,13 @@ type_only_dependencies: TypeOnlyDependencyFinding[]
  * devDependencies). Wrapped in [`TestOnlyDependencyFinding`].
  */
 test_only_dependencies?: TestOnlyDependencyFinding[]
+/**
+ * devDependencies imported by production (non-test, non-config) source code
+ * via a runtime/value import; they should be promoted to dependencies.
+ * The promote-side mirror of [`TestOnlyDependencyFinding`]. Wrapped in
+ * [`DevDependencyInProductionFinding`].
+ */
+dev_dependencies_in_production?: DevDependencyInProductionFinding[]
 /**
  * Circular dependency chains detected in the module graph. Wrapped in
  * [`CircularDependencyFinding`] so each entry carries a typed `actions`
@@ -1465,6 +1472,11 @@ type_only_dependencies: number
  * devDependencies).
  */
 test_only_dependencies: number
+/**
+ * devDependencies imported by production source code with a runtime/value
+ * import (should be promoted to dependencies).
+ */
+dev_dependencies_in_production: number
 /**
  * Cycles detected in the import graph.
  */
@@ -2269,6 +2281,37 @@ actions: IssueAction[]
  */
 introduced?: (AuditIntroduced | null)
 }
+/**
+ * Wire-shape envelope for a [`DevDependencyInProduction`] finding. Carries a
+ * `move-to-prod` primary (the promote-side mirror of
+ * [`TestOnlyDependencyFinding`]'s `move-to-dev`) plus the standard
+ * `ignoreDependencies` config suppress.
+ */
+export interface DevDependencyInProductionFinding {
+/**
+ * devDependency imported at runtime from production code, consider moving
+ * to dependencies.
+ */
+package_name: string
+/**
+ * Path to the package.json where the dependency is listed.
+ */
+path: string
+/**
+ * 1-based line number of the dependency entry in package.json.
+ */
+line: number
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+}
 /**
  * Wire-shape envelope for a [`CircularDependency`] finding. Mirrors
  * [`UnusedFileFinding`]: flattens the bare finding and carries a typed
@@ -4224,6 +4267,12 @@ export interface HealthEffectiveThresholds {
 max_cyclomatic: number
 max_cognitive: number
 max_crap: number
+/**
+ * Effective unit-size ceiling (maximum function length in lines) for the
+ * matched file, after applying any `thresholdOverrides` on top of the
+ * global `health.maxUnitSize` default.
+ */
+max_unit_size: number
 }
 /**
  * Suggested action attached to a [`ComplexityViolation`].
@@ -4297,6 +4346,14 @@ functions_above_threshold: number
 max_cyclomatic_threshold: number
 max_cognitive_threshold: number
 max_crap_threshold: number
+/**
+ * Effective global unit-size ceiling (`health.maxUnitSize`, maximum
+ * function length in lines) for this run. Sits alongside the other three
+ * `max_*_threshold` siblings so a consumer reading the summary sees every
+ * configured threshold. Per-file `thresholdOverrides` are not reflected
+ * here; this is the global default.
+ */
+max_unit_size_threshold: number
 files_scored?: (number | null)
 average_maintainability?: (number | null)
 coverage_model?: (CoverageModel | null)
@@ -4328,6 +4385,7 @@ export interface HealthConfiguredThresholds {
 max_cyclomatic?: (number | null)
 max_cognitive?: (number | null)
 max_crap?: (number | null)
+max_unit_size?: (number | null)
 }
 /**
  * Current complexity metrics for a matched threshold override entry.
@@ -7861,6 +7919,13 @@ type_only_dependencies: TypeOnlyDependencyFinding[]
  * devDependencies). Wrapped in [`TestOnlyDependencyFinding`].
  */
 test_only_dependencies?: TestOnlyDependencyFinding[]
+/**
+ * devDependencies imported by production (non-test, non-config) source code
+ * via a runtime/value import; they should be promoted to dependencies.
+ * The promote-side mirror of [`TestOnlyDependencyFinding`]. Wrapped in
+ * [`DevDependencyInProductionFinding`].
+ */
+dev_dependencies_in_production?: DevDependencyInProductionFinding[]
 /**
  * Circular dependency chains detected in the module graph. Wrapped in
  * [`CircularDependencyFinding`] so each entry carries a typed `actions`
@@ -9920,6 +9985,16 @@ export type BoundaryViolation = BoundaryViolationFinding;
  */
 export type CircularDependency = CircularDependencyFinding;
 
+/**
+ * Backwards-compat alias for the pre-#384 bare `DevDependencyInProduction` name.
+ * The wire shape is byte-identical: `DevDependencyInProductionFinding` flattens the bare
+ * finding's fields via `#[serde(flatten)]` and adds `actions[]` plus
+ * the optional audit-mode `introduced` flag. Consumers that imported
+ * `DevDependencyInProduction` from `fallow/types` pre-migration continue to work via
+ * this alias; new code should prefer `DevDependencyInProductionFinding`.
+ */
+export type DevDependencyInProduction = DevDependencyInProductionFinding;
+
 /**
  * Backwards-compat alias for the pre-#384 bare `DuplicateExport` name.
  * The wire shape is byte-identical: `DuplicateExportFinding` flattens the bare