fallow 3.25.0 → 3.27.0

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.25.0",
+  "version": "3.27.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -255,7 +255,7 @@
       "name": "--explain-skipped",
       "type": "bool",
       "required": false,
-      "description": "Show a per-pattern breakdown for default duplicate ignores",
+      "description": "Show per-pattern counts for skipped files: default duplicate ignores on dupes and audit, built-in discovery ignores on check, dead-code, audit and the default run",
       "possible_values": [
         "true",
         "false"
@@ -320,6 +320,16 @@
         "false"
       ]
     },
+    {
+      "name": "--fail-on-stale-baseline",
+      "type": "bool",
+      "required": false,
+      "description": "Exit with code 1 if a loaded --baseline has entries that match nothing in this run",
+      "possible_values": [
+        "true",
+        "false"
+      ]
+    },
     {
       "name": "--tolerance",
       "type": "string",
@@ -7252,7 +7262,7 @@
     ]
   },
   "plugins": {
-    "count": 125,
+    "count": 126,
     "note": "Built-in framework plugins, auto-activated when their enabler dependency is present; run fallow list --plugins for the set active in a specific project",
     "names": [
       "nextjs",
@@ -7326,6 +7336,7 @@
       "biome",
       "stylelint",
       "prettier",
+      "oxfmt",
       "oxlint",
       "markdownlint",
       "cspell",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.25.0",
+  "version": "3.27.0",
   "mcpName": "io.github.fallow-rs/fallow",
   "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
   "license": "MIT",
@@ -85,17 +85,17 @@
     "detect-libc": "2.1.2"
   },
   "devDependencies": {
-    "@tanstack/intent": "0.3.8"
+    "@tanstack/intent": "0.4.0"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.25.0",
-    "@fallow-cli/darwin-x64": "3.25.0",
-    "@fallow-cli/linux-x64-gnu": "3.25.0",
-    "@fallow-cli/linux-arm64-gnu": "3.25.0",
-    "@fallow-cli/linux-x64-musl": "3.25.0",
-    "@fallow-cli/linux-arm64-musl": "3.25.0",
-    "@fallow-cli/win32-arm64-msvc": "3.25.0",
-    "@fallow-cli/win32-x64-msvc": "3.25.0",
-    "fallow-type-aware": "3.25.0"
+    "@fallow-cli/darwin-arm64": "3.27.0",
+    "@fallow-cli/darwin-x64": "3.27.0",
+    "@fallow-cli/linux-x64-gnu": "3.27.0",
+    "@fallow-cli/linux-arm64-gnu": "3.27.0",
+    "@fallow-cli/linux-x64-musl": "3.27.0",
+    "@fallow-cli/linux-arm64-musl": "3.27.0",
+    "@fallow-cli/win32-arm64-msvc": "3.27.0",
+    "@fallow-cli/win32-x64-msvc": "3.27.0",
+    "fallow-type-aware": "3.27.0"
   }
 }

package/schema.json

@@ -36,7 +36,7 @@
       "default": []
     },
     "ignorePatterns": {
-      "description": "An array of project-root-relative glob patterns for files to exclude from analysis entirely; entries are unioned with fallow's built-in defaults (**/node_modules/**, **/dist/**, build/**, **/.git/**, **/coverage/**, **/*.min.js, **/*.min.mjs, **/*.min.cjs, **/*.bundle.js), so custom globs add to rather than replace them. Set it (e.g. `[\"generated/**\"]`) to drop generated or vendored trees from every detector; patterns are validated at load.",
+      "description": "An array of project-root-relative glob patterns for files to exclude from analysis entirely; entries are unioned with fallow's built-in defaults (**/node_modules/**, **/dist/**, **/build/**, **/.git/**, **/coverage/**, **/*.min.js, **/*.min.mjs, **/*.min.cjs, **/*.bundle.js), so custom globs add to rather than replace them. Set it (e.g. `[\"generated/**\"]`) to drop generated or vendored trees from every detector; patterns are validated at load.",
       "type": "array",
       "items": {
         "type": "string"
@@ -373,6 +373,8 @@
     }
   },
   "additionalProperties": false,
+  "allowComments": true,
+  "allowTrailingCommas": true,
   "$defs": {
     "ExternalPluginDef": {
       "description": "A declarative plugin definition loaded from a standalone file or inline config.\n\nExternal plugins provide the same static pattern capabilities as built-in\nplugins (entry points, always-used files, used exports, tooling dependencies),\nbut are defined in standalone files or inline in the fallow config rather than\ncompiled Rust code.\n\nThey cannot do AST-based config parsing (`resolve_config()`), but cover the\nvast majority of framework integration use cases.\n\nSupports JSONC, JSON, and TOML formats. All use camelCase field names.\n\n```json\n{\n  \"$schema\": \"https://raw.githubusercontent.com/fallow-rs/fallow/main/plugin-schema.json\",\n  \"name\": \"my-framework\",\n  \"enablers\": [\"my-framework\", \"@my-framework/core\"],\n  \"entryPoints\": [\"src/routes/**/*.{ts,tsx}\"],\n  \"configPatterns\": [\"my-framework.config.{ts,js}\"],\n  \"alwaysUsed\": [\"src/setup.ts\"],\n  \"toolingDependencies\": [\"my-framework-cli\"],\n  \"usedExports\": [\n    { \"pattern\": \"src/routes/**/*.{ts,tsx}\", \"exports\": [\"default\", \"loader\", \"action\"] }\n  ]\n}\n```",

package/skills/fallow/references/cli-reference.md

@@ -446,7 +446,7 @@ Human output groups paths under "Shared with your team (commit these)" and "Loca
 {
   "kind": "agent-install",
   "schema_version": 1,
-  "fallow_version": "3.24.1",
+  "fallow_version": "3.27.0",
   "root": "/abs/path",
   "mode": "install",
   "dry_run": false,
@@ -650,7 +650,7 @@ fallow health --format json --quiet --trend
 {
   "kind": "health",
   "schema_version": 7,
-  "version": "3.25.0",
+  "version": "3.27.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -1053,7 +1053,7 @@ fallow audit \
 {
   "kind": "audit",
   "schema_version": 7,
-  "version": "3.25.0",
+  "version": "3.27.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -1130,7 +1130,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 7,
-  "version": "3.25.0",
+  "version": "3.27.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1231,7 +1231,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.25.0",
+  "version": "3.27.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1260,7 +1260,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.25.0",
+  "version": "3.27.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1836,7 +1836,7 @@ Available on all commands:
 | `--group-by` | `owner\|directory\|package\|section` | - | Group output by CODEOWNERS ownership (`owner`), first path component (`directory`), workspace package (`package`, aliases: `workspace`, `pkg`), or GitLab CODEOWNERS `[Section]` headers (`section`, alias: `gl-section`). All output formats partition issues into labeled groups. `section` mode attaches an `owners` array to each group in JSON output |
 | `--performance` | `bool` | `false` | Show pipeline timing breakdown |
 | `--explain` | `bool` | `false` | JSON: include metric definitions in `_meta`. Human: print a `Description:` line under each section header. Always on for MCP. |
-| `--explain-skipped` | `bool` | `false` | Show a per-pattern breakdown for default duplicate ignores |
+| `--explain-skipped` | `bool` | `false` | Human/markdown only: show per-pattern counts for files skipped by the default duplicates ignores. `dupes` prints only that breakdown; on `check`, `dead-code`, `audit` and the default run the same flag reports source files the built-in discovery ignores removed |
 | `--summary` | `bool` | `false` | Show only category counts without individual items. Useful for dashboards and quick overviews |
 | `--ci` | `bool` | `false` | CI mode: `--format sarif --fail-on-issues --quiet` |
 | `--fail-on-issues` | `bool` | `false` | Exit 1 if any issues found (promotes `warn` to `error`) |
@@ -1844,6 +1844,7 @@ Available on all commands:
 | `-o, --output-file` | `string` | - | Write the report to a file instead of stdout, for any --format (no ANSI codes). Useful on large projects where the terminal scrollback truncates the top. Progress and the confirmation stay on stderr |
 | `--report-path-prefix` | `string` | - | Prefix prepended to every path in the CI-facing formats (`github-annotations`, `github-summary`, `codeclimate`, `review-github`, `review-gitlab`). CI platforms address files by repository-root-relative path, so when the analyzed project lives in a subdirectory (e.g. `packages/app/`), paths need that offset. fallow detects the offset via the git toplevel automatically; this flag overrides the detection. Pass an empty string to disable rebasing and emit paths relative to `--root` |
 | `--fail-on-regression` | `bool` | `false` | Fail if issue count increased beyond tolerance vs a regression baseline |
+| `--fail-on-stale-baseline` | `bool` | `false` | Exit with code 1 if a loaded --baseline has entries that match nothing in this run |
 | `--tolerance` | `string` | `0` | Allowed increase: `"2%"` (percentage) or `"5"` (absolute). Default: `"0"` |
 | `--regression-baseline` | `string` | - | Path to a standalone regression baseline file. Without it, fallow uses `regression.baseline` from the config |
 | `--save-regression-baseline` | `string` | - | Save current issue counts. With no path, update `regression.baseline` in the discovered fallow config or create `.fallowrc.json`; with a path, write a standalone baseline file |
@@ -2029,7 +2030,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 {
   "kind": "dead-code",
   "schema_version": 7,
-  "version": "3.25.0",
+  "version": "3.27.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -2189,7 +2190,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 {
   "kind": "dupes",
   "schema_version": 7,
-  "version": "3.25.0",
+  "version": "3.27.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -2233,11 +2234,11 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "kind": "combined",
   "schema_version": 7,
-  "version": "3.25.0",
+  "version": "3.27.0",
   "elapsed_ms": 159,
   "check": {
     "schema_version": 7,
-    "version": "3.25.0",
+    "version": "3.27.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],

package/types/output-contract.d.ts

@@ -135,6 +135,16 @@ export type ElapsedMs = number
  * Value of `audit.gate`: which findings drive the `fallow audit` verdict.
  */
 export type AuditGate = ("new-only" | "all")
+/**
+ * What a gate concluded on this run.
+ *
+ * Four-valued rather than a boolean because audit's verdict has a warn tier
+ * (`crates/cli/src/cli_report.rs` maps it onto three conclusions) and because
+ * a gate can stand down without passing. Widening a published boolean later
+ * would retype a required field and bump every carrying envelope, so the width
+ * is decided here.
+ */
+export type GateStatus = ("pass" | "warn" | "fail" | "skipped")
 /**
  * Analysis mode stored with baselines, snapshots, audit sides, and impact data.
  */
@@ -402,6 +412,14 @@ export type DependencyOverrideSource = ("pnpm-workspace.yaml" | "package.json")
  * surfacing them statically catches the issue first.
  */
 export type DependencyOverrideMisconfigReason = ("unparsable-key" | "empty-value")
+/**
+ * Which advisory a loaded baseline earned on this run.
+ *
+ * Mirrors `fallow_engine::baseline::BaselineStalenessWarning` so a consumer can
+ * render the same distinction the stderr warning makes, instead of inferring it
+ * from counts.
+ */
+export type BaselineStalenessAdvisory = ("none" | "zero-overlap" | "partial")
 /**
  * Status of a regression-check pass.
  */
@@ -428,6 +446,25 @@ path: string
  * with a next-step hint.
  */
 message: string
+/**
+ * True when this diagnostic reports a run whose RESULTS are degraded:
+ * something the user installed, wrote, or expected did not reach the
+ * analysis. Projected from [`WorkspaceDiagnosticKind::warns_on_stderr`],
+ * which is the same classification that decides whether the CLI prints a
+ * stderr line, so a CI log built from this field and a local non-quiet run
+ * say the same thing.
+ *
+ * Omitted when false, which is what keeps every clean run byte-identical.
+ * The two unconfigured-check kinds answer false on purpose: they fire in
+ * the product's default state on every project that never opted into
+ * boundaries or rule packs, so warning on them would warn forever. So does
+ * `excluded-by-default-ignore`, which is designed behavior on generated
+ * output; the alarm for that case is `no-source-files-analyzed`.
+ *
+ * Read this instead of hardcoding a kind allowlist: a degrading kind added
+ * in a later release then reaches an unchanged consumer.
+ */
+degrades_analysis?: boolean
 } & WorkspaceDiagnostic1)
 export type WorkspaceDiagnostic1 = ({
 kind: "undeclared-workspace"
@@ -500,6 +537,39 @@ kind: "node-modules-missing"
 kind: "boundaries-not-configured"
 } | {
 kind: "rule-packs-not-configured"
+} | {
+/**
+ * The built-in glob that matched, verbatim (for example
+ * `** /build/**`).
+ */
+pattern: string
+/**
+ * Candidate source files this pattern excluded in this walk, across
+ * every directory it matched, not just the one `path` anchors at.
+ * Exact: the walk counts each excluded candidate once.
+ */
+file_count: number
+/**
+ * Distinct directories this pattern matched at, `path` included, and
+ * not the number of directories that held the files. A
+ * directory-shaped pattern (`** /dist/**`) matches at the directory it
+ * names, so an excluded subtree counts once however many nested
+ * directories inside it held source: a `dist/` holding files in three
+ * sub-directories reports `1`. A file-shaped pattern (`** /*.min.js`)
+ * has no directory to collapse to and counts each matched file's own
+ * parent. Exact either way, and anything above `1` says `path` names
+ * one matched location out of several.
+ */
+directory_count: number
+kind: "excluded-by-default-ignore"
+} | {
+/**
+ * Candidate source files the built-in ignore patterns removed from
+ * this walk, summed across every pattern. `0` when the walk found no
+ * candidate to exclude in the first place.
+ */
+excluded_file_count: number
+kind: "no-source-files-analyzed"
 })
 /**
  * Discriminant for [`CloneGroupAction::kind`]. Mirrors the action types
@@ -1286,6 +1356,16 @@ elapsed_ms: ElapsedMs
 base_snapshot_skipped?: (boolean | null)
 summary: AuditSummary
 attribution: AuditAttribution
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * `_meta` block with metric / rule definitions, when `--explain` was
  * passed.
@@ -1368,6 +1448,78 @@ styling_introduced: number
 styling_inherited: number
 duplication_demoted: number
 }
+/**
+ * Every gate a run ARMED, keyed by name.
+ *
+ * Armed, not evaluated: a gate is armed by a flag or by config, never merely
+ * because the rule behind it exists. Fallow's default severity rules fail a
+ * run with no flag at all, so a `dead-code` run can exit 1 carrying no object
+ * whatsoever. Read an absent object as "no gate was asked for", never as
+ * "nothing failed".
+ *
+ * Absent from an envelope whenever it is empty, so a run that armed no gate is
+ * byte-identical to one produced before this object existed. An empty object
+ * is never emitted: it would assert that gates were armed and none tripped,
+ * which is a different and false claim.
+ *
+ * The names this build can emit are `error-severity-findings`, `regression`,
+ * `stale-baseline`, `duplication-threshold`, `health-min-score`,
+ * `health-min-severity`, `health-findings`, `health-coverage-gaps`,
+ * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`
+ * and `type-aware-require`. The set is OPEN: a name a consumer does not
+ * recognise means "some gate", not an error.
+ */
+export interface GateOutcomes {
+[k: string]: GateOutcome
+}
+/**
+ * One gate's verdict on one run.
+ *
+ * `status` and `enforced` answer different questions and legitimately
+ * disagree. `status` is what the rule concluded; `enforced` is whether a
+ * `fail` from this gate would make the run exit non-zero. A
+ * `health --report-only` run is an explicit request never to fail, so a
+ * failing gate there reports `status: fail` with `enforced: false`, and a
+ * stale-baseline verdict published without `--fail-on-stale-baseline` reports
+ * the same pair.
+ *
+ * **A gate fails the build when `status` is `fail` AND `enforced` is true.**
+ * Neither member decides it alone: `enforced` is true on every armed gate,
+ * including the ones that passed, so gating on it by itself fails every run
+ * that armed anything. Read `status` on its own to decide what to say, and
+ * remember that `warn` and `skipped` are neither a pass nor a failure.
+ */
+export interface GateOutcome {
+status: GateStatus
+/**
+ * True when a `fail` from this gate makes the run exit non-zero. False
+ * when the verdict is published for information only, because the gate was
+ * never armed or because the run was told never to fail.
+ */
+enforced: boolean
+/**
+ * The measured value the gate compared, when there is one: the duplication
+ * percentage, the health score, or the number of findings at or above the
+ * severity floor. Whole numbers are carried as JSON numbers, so a count of
+ * three reads as `3.0`. Absent for gates that compare no number.
+ */
+observed?: (number | null)
+/**
+ * The configured limit `observed` was compared against, when there is one.
+ * Absent for gates that compare no number.
+ */
+threshold?: (number | null)
+/**
+ * How the limit was spelled, for a gate whose `threshold` number does not
+ * carry its own unit. `health-min-severity` sets it to the severity floor
+ * (`moderate`, `high` or `critical`); `regression` sets it to the
+ * tolerance as the user wrote it (`"50%"` or `"5"`), because `threshold`
+ * there is the allowance in issues and the percentage would otherwise be
+ * unrecoverable on the grouped envelope, which carries no `regression`
+ * object. Absent for gates whose numbers speak for themselves.
+ */
+threshold_label?: (string | null)
+}
 /**
  * Metric and rule definitions emitted under `_meta` when `--explain` is
  * passed (always present in MCP responses). Helps AI agents and CI systems
@@ -2645,10 +2797,29 @@ baseline_deltas?: (BaselineDeltas | null)
  * Which baseline snapshot was matched, in baseline runs.
  */
 baseline?: (BaselineMatch | null)
+/**
+ * This run's view of the loaded baseline, present only in baseline runs.
+ * Carries the staleness counts, the advisory verdict and `gate_trips`, the
+ * same boolean `--fail-on-stale-baseline` exits on, so a CI integration
+ * reads one field instead of restating the rule. Read `change_scoped`
+ * before dividing `matched_entries` by `baseline_entries`: a narrowed run
+ * can report `matched_entries: 0` on a healthy baseline.
+ */
+baseline_staleness?: (BaselineStaleness | null)
 /**
  * Regression verdict against the baseline, in `--fail-on-regression` runs.
  */
 regression?: (RegressionResult | null)
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * `_meta` block with docs and rule definitions, when `--explain` was
  * passed.
@@ -2663,7 +2834,8 @@ _meta?: (Meta | null)
  *   `malformed-tsconfig`, `tsconfig-reference-dir-missing`;
  * - source discovery, during the file walk: `skipped-large-file`,
  *   `skipped-minified-file`, `skipped-source-dotdir`,
- *   `source-read-failure`, `source-parse-degraded`;
+ *   `excluded-by-default-ignore`, `source-read-failure`,
+ *   `source-parse-degraded`;
  * - dead-code analysis, from the dependency-catalog and override
  *   detectors: `malformed-pnpm-workspace-yaml`,
  *   `bun-lockb-override-resolution-skipped`.
@@ -2684,6 +2856,18 @@ _meta?: (Meta | null)
  * optional `reachability_caveats[]` array, and a reader who never scrolls
  * back up to this list still sees it. `fallow fix` reads the same array
  * and withholds the removal while a caveat stands.
+ *
+ * `excluded-by-default-ignore` is the one source-discovery kind that
+ * reports unseen files WITHOUT raising a caveat. It names a built-in
+ * ignore pattern (`** /dist/**`, `** /build/**`, `** /coverage/**`, or one
+ * of the four minified-bundle globs) that removed candidate source files
+ * from the walk, which is designed behavior on generated output rather
+ * than a degraded run, so it is advisory only and no finding inherits it.
+ * One entry per pattern, never per file, so the array stays bounded on a
+ * project of any size. Gitignored trees are pruned before the walk sees
+ * them and count zero, and `** /node_modules/**` is never reported:
+ * installed dependencies are not the first-party source the kind is
+ * about.
  */
 workspace_diagnostics?: WorkspaceDiagnostic[]
 /**
@@ -5054,6 +5238,86 @@ entries: number
  */
 matched: number
 }
+/**
+ * One run's machine-readable view of a loaded baseline.
+ *
+ * `stale` and `gate_trips` answer different questions and legitimately
+ * disagree. `stale` mirrors the unasked-for stderr advisory, which stays silent
+ * below a quarter of the baseline and on a run that produced no findings at
+ * all, because a cleaned project and a rotted baseline look identical from
+ * there. `gate_trips` mirrors the opt-in `--fail-on-stale-baseline` rule, which
+ * a repository asks for precisely to catch those cases, so it fires on any
+ * stale entry. A rotted baseline on a cleaned project reports
+ * `stale: false` with `gate_trips: true`; that is the contract, not a defect.
+ *
+ * `change_scoped` is the member a consumer must read before dividing
+ * `matched_entries` by `baseline_entries`. A run narrowed to part of the
+ * project compares a whole-project baseline against a slice of it and can
+ * report `matched_entries: 0` while the baseline is perfectly healthy, so both
+ * `stale` and `gate_trips` are false there by construction. The remedy for a
+ * tripped gate is always the same: re-save the baseline from a whole-project
+ * run with `--save-baseline`.
+ */
+export interface BaselineStaleness {
+/**
+ * Entries carried by the loaded baseline file. On health these are the
+ * complexity and CRAP finding entries; runtime-coverage suppressions and
+ * refactoring target keys carried by the same file are not counted.
+ */
+baseline_entries: number
+/**
+ * Entries that matched a current finding on this run and were filtered out
+ * of the report. On health this includes entries matched through a
+ * followed file move.
+ */
+matched_entries: number
+/**
+ * Entries that matched no current finding on this run:
+ * `baseline_entries - matched_entries`.
+ */
+stale_entries: number
+/**
+ * Findings this run produced before the baseline filtered them. Zero means
+ * there was nothing to compare, either because the project is clean or
+ * because the scope was empty, which is why `stale` stays false there even
+ * when every entry went unmatched.
+ */
+current_findings: number
+/**
+ * True when this run analyzed only part of the project, so a whole-project
+ * baseline matches less of it for reasons that are not rot. The channels
+ * differ per command and include a diff, a base ref, `--changed-since`,
+ * `--workspace`, `--changed-workspaces`, `--scope`, `--file`, an
+ * issue-type filter, and production mode. Both `stale` and `gate_trips`
+ * are false whenever this is true.
+ */
+change_scoped: boolean
+/**
+ * True exactly when the advisory stderr warning fired: not change-scoped,
+ * at least one current finding before baseline filtering, and either
+ * nothing matched or `stale_entries` reached a quarter of
+ * `baseline_entries`.
+ */
+stale: boolean
+warning: BaselineStalenessAdvisory
+/**
+ * True exactly when
+ * `!change_scoped && baseline_entries > 0 && matched_entries < baseline_entries`,
+ * which is the rule `--fail-on-stale-baseline` applies. Deliberately
+ * stricter than `stale`: any unmatched entry counts. It describes the
+ * baseline, not the run's exit code: `health --report-only` is an explicit
+ * request never to fail, so that run exits 0 and says so on stderr while
+ * still reporting `gate_trips: true` here.
+ */
+gate_trips: boolean
+/**
+ * Entries that matched only by following a file move. Only `health` can
+ * follow one, in its identity baseline mode; `dead-code` and `dupes` match
+ * entries by fingerprint and never classify one as moved, so they report
+ * `0`. Always `0` in health's count mode too.
+ */
+moved_entries: number
+}
 /**
  * Result of regression detection (`--fail-on-regression`). Compares current
  * issue counts against a baseline from config or an explicit file.
@@ -6002,50 +6266,7 @@ severity_moderate_count: number
 /**
  * Baseline staleness data, present only when a baseline was loaded.
  */
-baseline_staleness?: (HealthBaselineStaleness | null)
-}
-/**
- * Staleness of a loaded health baseline.
- *
- * Reports how many saved complexity and CRAP finding entries still matched a
- * current finding on this run, so consumers can see a rotting baseline before
- * it degrades to zero overlap. Runtime-coverage suppressions and refactoring
- * target keys carried by the same baseline are not counted here. Present in
- * the summary only when a baseline was loaded.
- */
-export interface HealthBaselineStaleness {
-/**
- * Complexity and CRAP finding entries carried by the loaded baseline.
- */
-baseline_entries: number
-/**
- * Entries that matched a current finding in the active baseline mode,
- * including entries matched through a followed file move.
- */
-matched_entries: number
-/**
- * Entries that matched no current finding on this run.
- */
-stale_entries: number
-/**
- * Entries that matched only by following a file move in identity mode.
- * Always zero in count mode.
- */
-moved_entries: number
-/**
- * True when this run analyzed a subset of the project (changed-file,
- * diff, or workspace scoping), so the baseline was compared against a
- * narrowed finding set and staleness cannot be judged. `stale` is always
- * false on scoped runs.
- */
-change_scoped: boolean
-/**
- * True exactly when the run was not change-scoped, at least one current
- * finding existed before baseline filtering, and `stale_entries` reached
- * a quarter of `baseline_entries`. Mirrors the human warning so machine
- * consumers do not have to reimplement the threshold.
- */
-stale: boolean
+baseline_staleness?: (BaselineStaleness | null)
 }
 /**
  * Report entry describing whether a threshold override is active, stale, or
@@ -10796,6 +11017,16 @@ grouped_by?: (GroupByMode | null)
  * Per-bucket recomputed metrics; present only in grouped output.
  */
 groups?: (HealthGroup[] | null)
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * `_meta` block with metric definitions, when `--explain` was passed.
  */
@@ -10970,6 +11201,25 @@ total_issues?: (number | null)
  * Grouped findings; present only in grouped output.
  */
 groups?: (DuplicationGroup[] | null)
+/**
+ * This run's view of the loaded baseline, present only in baseline runs.
+ * Carries the staleness counts, the advisory verdict and `gate_trips`, the
+ * same boolean `--fail-on-stale-baseline` exits on, so a CI integration
+ * reads one field instead of restating the rule. Read `change_scoped`
+ * before dividing `matched_entries` by `baseline_entries`: a narrowed run
+ * can report `matched_entries: 0` on a healthy baseline.
+ */
+baseline_staleness?: (BaselineStaleness | null)
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * `_meta` block with metric / rule definitions, emitted when `--explain`
  * is passed (always present in MCP responses).
@@ -11128,6 +11378,25 @@ total_issues: number
  * One bucket per resolver key.
  */
 groups: CheckGroupedEntry[]
+/**
+ * This run's view of the loaded baseline, present only in baseline runs.
+ * Carries the staleness counts, the advisory verdict and `gate_trips`, the
+ * same boolean `--fail-on-stale-baseline` exits on, so a CI integration
+ * reads one field instead of restating the rule. Read `change_scoped`
+ * before dividing `matched_entries` by `baseline_entries`: a narrowed run
+ * can report `matched_entries: 0` on a healthy baseline.
+ */
+baseline_staleness?: (BaselineStaleness | null)
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * `_meta` block with docs and rule definitions, when `--explain` was
  * passed.
@@ -11797,6 +12066,16 @@ schema_version: SecuritySchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
 config: SecurityOutputConfig
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * Security-specific rule and field metadata, emitted with `--explain`.
  */
@@ -12420,6 +12699,16 @@ schema_version: SecuritySchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
 config: SecurityOutputConfig
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * Security-specific rule and field metadata, emitted with `--explain`.
  */
@@ -12703,6 +12992,16 @@ export interface CombinedOutput {
 schema_version: CombinedSchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * Per-section `_meta` blocks, when `--explain` was passed.
  */
@@ -15244,3 +15543,8 @@ export type UnusedDependency = UnusedDependencyFinding | UnusedDevDependencyFind
  * this alias; new code should narrow on the specific wrapper variant.
  */
 export type UnusedMember = UnusedClassMemberFinding | UnusedEnumMemberFinding | UnusedStoreMemberFinding;
+
+/**
+ * @deprecated Renamed to BaselineStaleness in 3.27.0, when dead-code and dupes started carrying the same shape. The members are unchanged.
+ */
+export type HealthBaselineStaleness = BaselineStaleness;