fallow 3.26.0 → 3.27.0

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.26.0",
+  "version": "3.27.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.26.0",
+  "version": "3.27.0",
   "mcpName": "io.github.fallow-rs/fallow",
   "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
   "license": "MIT",
@@ -85,17 +85,17 @@
     "detect-libc": "2.1.2"
   },
   "devDependencies": {
-    "@tanstack/intent": "0.3.8"
+    "@tanstack/intent": "0.4.0"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.26.0",
-    "@fallow-cli/darwin-x64": "3.26.0",
-    "@fallow-cli/linux-x64-gnu": "3.26.0",
-    "@fallow-cli/linux-arm64-gnu": "3.26.0",
-    "@fallow-cli/linux-x64-musl": "3.26.0",
-    "@fallow-cli/linux-arm64-musl": "3.26.0",
-    "@fallow-cli/win32-arm64-msvc": "3.26.0",
-    "@fallow-cli/win32-x64-msvc": "3.26.0",
-    "fallow-type-aware": "3.26.0"
+    "@fallow-cli/darwin-arm64": "3.27.0",
+    "@fallow-cli/darwin-x64": "3.27.0",
+    "@fallow-cli/linux-x64-gnu": "3.27.0",
+    "@fallow-cli/linux-arm64-gnu": "3.27.0",
+    "@fallow-cli/linux-x64-musl": "3.27.0",
+    "@fallow-cli/linux-arm64-musl": "3.27.0",
+    "@fallow-cli/win32-arm64-msvc": "3.27.0",
+    "@fallow-cli/win32-x64-msvc": "3.27.0",
+    "fallow-type-aware": "3.27.0"
   }
 }

package/skills/fallow/references/cli-reference.md

@@ -446,7 +446,7 @@ Human output groups paths under "Shared with your team (commit these)" and "Loca
 {
   "kind": "agent-install",
   "schema_version": 1,
-  "fallow_version": "3.26.0",
+  "fallow_version": "3.27.0",
   "root": "/abs/path",
   "mode": "install",
   "dry_run": false,
@@ -650,7 +650,7 @@ fallow health --format json --quiet --trend
 {
   "kind": "health",
   "schema_version": 7,
-  "version": "3.26.0",
+  "version": "3.27.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -1053,7 +1053,7 @@ fallow audit \
 {
   "kind": "audit",
   "schema_version": 7,
-  "version": "3.26.0",
+  "version": "3.27.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -1130,7 +1130,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 7,
-  "version": "3.26.0",
+  "version": "3.27.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1231,7 +1231,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.26.0",
+  "version": "3.27.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1260,7 +1260,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.26.0",
+  "version": "3.27.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -2030,7 +2030,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 {
   "kind": "dead-code",
   "schema_version": 7,
-  "version": "3.26.0",
+  "version": "3.27.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -2190,7 +2190,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 {
   "kind": "dupes",
   "schema_version": 7,
-  "version": "3.26.0",
+  "version": "3.27.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -2234,11 +2234,11 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "kind": "combined",
   "schema_version": 7,
-  "version": "3.26.0",
+  "version": "3.27.0",
   "elapsed_ms": 159,
   "check": {
     "schema_version": 7,
-    "version": "3.26.0",
+    "version": "3.27.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],

package/types/output-contract.d.ts

@@ -135,6 +135,16 @@ export type ElapsedMs = number
  * Value of `audit.gate`: which findings drive the `fallow audit` verdict.
  */
 export type AuditGate = ("new-only" | "all")
+/**
+ * What a gate concluded on this run.
+ *
+ * Four-valued rather than a boolean because audit's verdict has a warn tier
+ * (`crates/cli/src/cli_report.rs` maps it onto three conclusions) and because
+ * a gate can stand down without passing. Widening a published boolean later
+ * would retype a required field and bump every carrying envelope, so the width
+ * is decided here.
+ */
+export type GateStatus = ("pass" | "warn" | "fail" | "skipped")
 /**
  * Analysis mode stored with baselines, snapshots, audit sides, and impact data.
  */
@@ -402,6 +412,14 @@ export type DependencyOverrideSource = ("pnpm-workspace.yaml" | "package.json")
  * surfacing them statically catches the issue first.
  */
 export type DependencyOverrideMisconfigReason = ("unparsable-key" | "empty-value")
+/**
+ * Which advisory a loaded baseline earned on this run.
+ *
+ * Mirrors `fallow_engine::baseline::BaselineStalenessWarning` so a consumer can
+ * render the same distinction the stderr warning makes, instead of inferring it
+ * from counts.
+ */
+export type BaselineStalenessAdvisory = ("none" | "zero-overlap" | "partial")
 /**
  * Status of a regression-check pass.
  */
@@ -428,6 +446,25 @@ path: string
  * with a next-step hint.
  */
 message: string
+/**
+ * True when this diagnostic reports a run whose RESULTS are degraded:
+ * something the user installed, wrote, or expected did not reach the
+ * analysis. Projected from [`WorkspaceDiagnosticKind::warns_on_stderr`],
+ * which is the same classification that decides whether the CLI prints a
+ * stderr line, so a CI log built from this field and a local non-quiet run
+ * say the same thing.
+ *
+ * Omitted when false, which is what keeps every clean run byte-identical.
+ * The two unconfigured-check kinds answer false on purpose: they fire in
+ * the product's default state on every project that never opted into
+ * boundaries or rule packs, so warning on them would warn forever. So does
+ * `excluded-by-default-ignore`, which is designed behavior on generated
+ * output; the alarm for that case is `no-source-files-analyzed`.
+ *
+ * Read this instead of hardcoding a kind allowlist: a degrading kind added
+ * in a later release then reaches an unchanged consumer.
+ */
+degrades_analysis?: boolean
 } & WorkspaceDiagnostic1)
 export type WorkspaceDiagnostic1 = ({
 kind: "undeclared-workspace"
@@ -525,6 +562,14 @@ file_count: number
  */
 directory_count: number
 kind: "excluded-by-default-ignore"
+} | {
+/**
+ * Candidate source files the built-in ignore patterns removed from
+ * this walk, summed across every pattern. `0` when the walk found no
+ * candidate to exclude in the first place.
+ */
+excluded_file_count: number
+kind: "no-source-files-analyzed"
 })
 /**
  * Discriminant for [`CloneGroupAction::kind`]. Mirrors the action types
@@ -1311,6 +1356,16 @@ elapsed_ms: ElapsedMs
 base_snapshot_skipped?: (boolean | null)
 summary: AuditSummary
 attribution: AuditAttribution
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * `_meta` block with metric / rule definitions, when `--explain` was
  * passed.
@@ -1393,6 +1448,78 @@ styling_introduced: number
 styling_inherited: number
 duplication_demoted: number
 }
+/**
+ * Every gate a run ARMED, keyed by name.
+ *
+ * Armed, not evaluated: a gate is armed by a flag or by config, never merely
+ * because the rule behind it exists. Fallow's default severity rules fail a
+ * run with no flag at all, so a `dead-code` run can exit 1 carrying no object
+ * whatsoever. Read an absent object as "no gate was asked for", never as
+ * "nothing failed".
+ *
+ * Absent from an envelope whenever it is empty, so a run that armed no gate is
+ * byte-identical to one produced before this object existed. An empty object
+ * is never emitted: it would assert that gates were armed and none tripped,
+ * which is a different and false claim.
+ *
+ * The names this build can emit are `error-severity-findings`, `regression`,
+ * `stale-baseline`, `duplication-threshold`, `health-min-score`,
+ * `health-min-severity`, `health-findings`, `health-coverage-gaps`,
+ * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`
+ * and `type-aware-require`. The set is OPEN: a name a consumer does not
+ * recognise means "some gate", not an error.
+ */
+export interface GateOutcomes {
+[k: string]: GateOutcome
+}
+/**
+ * One gate's verdict on one run.
+ *
+ * `status` and `enforced` answer different questions and legitimately
+ * disagree. `status` is what the rule concluded; `enforced` is whether a
+ * `fail` from this gate would make the run exit non-zero. A
+ * `health --report-only` run is an explicit request never to fail, so a
+ * failing gate there reports `status: fail` with `enforced: false`, and a
+ * stale-baseline verdict published without `--fail-on-stale-baseline` reports
+ * the same pair.
+ *
+ * **A gate fails the build when `status` is `fail` AND `enforced` is true.**
+ * Neither member decides it alone: `enforced` is true on every armed gate,
+ * including the ones that passed, so gating on it by itself fails every run
+ * that armed anything. Read `status` on its own to decide what to say, and
+ * remember that `warn` and `skipped` are neither a pass nor a failure.
+ */
+export interface GateOutcome {
+status: GateStatus
+/**
+ * True when a `fail` from this gate makes the run exit non-zero. False
+ * when the verdict is published for information only, because the gate was
+ * never armed or because the run was told never to fail.
+ */
+enforced: boolean
+/**
+ * The measured value the gate compared, when there is one: the duplication
+ * percentage, the health score, or the number of findings at or above the
+ * severity floor. Whole numbers are carried as JSON numbers, so a count of
+ * three reads as `3.0`. Absent for gates that compare no number.
+ */
+observed?: (number | null)
+/**
+ * The configured limit `observed` was compared against, when there is one.
+ * Absent for gates that compare no number.
+ */
+threshold?: (number | null)
+/**
+ * How the limit was spelled, for a gate whose `threshold` number does not
+ * carry its own unit. `health-min-severity` sets it to the severity floor
+ * (`moderate`, `high` or `critical`); `regression` sets it to the
+ * tolerance as the user wrote it (`"50%"` or `"5"`), because `threshold`
+ * there is the allowance in issues and the percentage would otherwise be
+ * unrecoverable on the grouped envelope, which carries no `regression`
+ * object. Absent for gates whose numbers speak for themselves.
+ */
+threshold_label?: (string | null)
+}
 /**
  * Metric and rule definitions emitted under `_meta` when `--explain` is
  * passed (always present in MCP responses). Helps AI agents and CI systems
@@ -2670,10 +2797,29 @@ baseline_deltas?: (BaselineDeltas | null)
  * Which baseline snapshot was matched, in baseline runs.
  */
 baseline?: (BaselineMatch | null)
+/**
+ * This run's view of the loaded baseline, present only in baseline runs.
+ * Carries the staleness counts, the advisory verdict and `gate_trips`, the
+ * same boolean `--fail-on-stale-baseline` exits on, so a CI integration
+ * reads one field instead of restating the rule. Read `change_scoped`
+ * before dividing `matched_entries` by `baseline_entries`: a narrowed run
+ * can report `matched_entries: 0` on a healthy baseline.
+ */
+baseline_staleness?: (BaselineStaleness | null)
 /**
  * Regression verdict against the baseline, in `--fail-on-regression` runs.
  */
 regression?: (RegressionResult | null)
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * `_meta` block with docs and rule definitions, when `--explain` was
  * passed.
@@ -5092,6 +5238,86 @@ entries: number
  */
 matched: number
 }
+/**
+ * One run's machine-readable view of a loaded baseline.
+ *
+ * `stale` and `gate_trips` answer different questions and legitimately
+ * disagree. `stale` mirrors the unasked-for stderr advisory, which stays silent
+ * below a quarter of the baseline and on a run that produced no findings at
+ * all, because a cleaned project and a rotted baseline look identical from
+ * there. `gate_trips` mirrors the opt-in `--fail-on-stale-baseline` rule, which
+ * a repository asks for precisely to catch those cases, so it fires on any
+ * stale entry. A rotted baseline on a cleaned project reports
+ * `stale: false` with `gate_trips: true`; that is the contract, not a defect.
+ *
+ * `change_scoped` is the member a consumer must read before dividing
+ * `matched_entries` by `baseline_entries`. A run narrowed to part of the
+ * project compares a whole-project baseline against a slice of it and can
+ * report `matched_entries: 0` while the baseline is perfectly healthy, so both
+ * `stale` and `gate_trips` are false there by construction. The remedy for a
+ * tripped gate is always the same: re-save the baseline from a whole-project
+ * run with `--save-baseline`.
+ */
+export interface BaselineStaleness {
+/**
+ * Entries carried by the loaded baseline file. On health these are the
+ * complexity and CRAP finding entries; runtime-coverage suppressions and
+ * refactoring target keys carried by the same file are not counted.
+ */
+baseline_entries: number
+/**
+ * Entries that matched a current finding on this run and were filtered out
+ * of the report. On health this includes entries matched through a
+ * followed file move.
+ */
+matched_entries: number
+/**
+ * Entries that matched no current finding on this run:
+ * `baseline_entries - matched_entries`.
+ */
+stale_entries: number
+/**
+ * Findings this run produced before the baseline filtered them. Zero means
+ * there was nothing to compare, either because the project is clean or
+ * because the scope was empty, which is why `stale` stays false there even
+ * when every entry went unmatched.
+ */
+current_findings: number
+/**
+ * True when this run analyzed only part of the project, so a whole-project
+ * baseline matches less of it for reasons that are not rot. The channels
+ * differ per command and include a diff, a base ref, `--changed-since`,
+ * `--workspace`, `--changed-workspaces`, `--scope`, `--file`, an
+ * issue-type filter, and production mode. Both `stale` and `gate_trips`
+ * are false whenever this is true.
+ */
+change_scoped: boolean
+/**
+ * True exactly when the advisory stderr warning fired: not change-scoped,
+ * at least one current finding before baseline filtering, and either
+ * nothing matched or `stale_entries` reached a quarter of
+ * `baseline_entries`.
+ */
+stale: boolean
+warning: BaselineStalenessAdvisory
+/**
+ * True exactly when
+ * `!change_scoped && baseline_entries > 0 && matched_entries < baseline_entries`,
+ * which is the rule `--fail-on-stale-baseline` applies. Deliberately
+ * stricter than `stale`: any unmatched entry counts. It describes the
+ * baseline, not the run's exit code: `health --report-only` is an explicit
+ * request never to fail, so that run exits 0 and says so on stderr while
+ * still reporting `gate_trips: true` here.
+ */
+gate_trips: boolean
+/**
+ * Entries that matched only by following a file move. Only `health` can
+ * follow one, in its identity baseline mode; `dead-code` and `dupes` match
+ * entries by fingerprint and never classify one as moved, so they report
+ * `0`. Always `0` in health's count mode too.
+ */
+moved_entries: number
+}
 /**
  * Result of regression detection (`--fail-on-regression`). Compares current
  * issue counts against a baseline from config or an explicit file.
@@ -6040,51 +6266,7 @@ severity_moderate_count: number
 /**
  * Baseline staleness data, present only when a baseline was loaded.
  */
-baseline_staleness?: (HealthBaselineStaleness | null)
-}
-/**
- * Staleness of a loaded health baseline.
- *
- * Reports how many saved complexity and CRAP finding entries still matched a
- * current finding on this run, so consumers can see a rotting baseline before
- * it degrades to zero overlap. Runtime-coverage suppressions and refactoring
- * target keys carried by the same baseline are not counted here. Present in
- * the summary only when a baseline was loaded.
- */
-export interface HealthBaselineStaleness {
-/**
- * Complexity and CRAP finding entries carried by the loaded baseline.
- */
-baseline_entries: number
-/**
- * Entries that matched a current finding in the active baseline mode,
- * including entries matched through a followed file move.
- */
-matched_entries: number
-/**
- * Entries that matched no current finding on this run.
- */
-stale_entries: number
-/**
- * Entries that matched only by following a file move in identity mode.
- * Always zero in count mode.
- */
-moved_entries: number
-/**
- * True when this run analyzed a subset of the project (changed-file,
- * diff, or workspace scoping, or production mode, which drops test, story
- * and dev files), so the baseline was compared against a narrowed finding
- * set and staleness cannot be judged. `stale` is always false on scoped
- * runs.
- */
-change_scoped: boolean
-/**
- * True exactly when the run was not change-scoped, at least one current
- * finding existed before baseline filtering, and `stale_entries` reached
- * a quarter of `baseline_entries`. Mirrors the human warning so machine
- * consumers do not have to reimplement the threshold.
- */
-stale: boolean
+baseline_staleness?: (BaselineStaleness | null)
 }
 /**
  * Report entry describing whether a threshold override is active, stale, or
@@ -10835,6 +11017,16 @@ grouped_by?: (GroupByMode | null)
  * Per-bucket recomputed metrics; present only in grouped output.
  */
 groups?: (HealthGroup[] | null)
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * `_meta` block with metric definitions, when `--explain` was passed.
  */
@@ -11009,6 +11201,25 @@ total_issues?: (number | null)
  * Grouped findings; present only in grouped output.
  */
 groups?: (DuplicationGroup[] | null)
+/**
+ * This run's view of the loaded baseline, present only in baseline runs.
+ * Carries the staleness counts, the advisory verdict and `gate_trips`, the
+ * same boolean `--fail-on-stale-baseline` exits on, so a CI integration
+ * reads one field instead of restating the rule. Read `change_scoped`
+ * before dividing `matched_entries` by `baseline_entries`: a narrowed run
+ * can report `matched_entries: 0` on a healthy baseline.
+ */
+baseline_staleness?: (BaselineStaleness | null)
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * `_meta` block with metric / rule definitions, emitted when `--explain`
  * is passed (always present in MCP responses).
@@ -11167,6 +11378,25 @@ total_issues: number
  * One bucket per resolver key.
  */
 groups: CheckGroupedEntry[]
+/**
+ * This run's view of the loaded baseline, present only in baseline runs.
+ * Carries the staleness counts, the advisory verdict and `gate_trips`, the
+ * same boolean `--fail-on-stale-baseline` exits on, so a CI integration
+ * reads one field instead of restating the rule. Read `change_scoped`
+ * before dividing `matched_entries` by `baseline_entries`: a narrowed run
+ * can report `matched_entries: 0` on a healthy baseline.
+ */
+baseline_staleness?: (BaselineStaleness | null)
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * `_meta` block with docs and rule definitions, when `--explain` was
  * passed.
@@ -11836,6 +12066,16 @@ schema_version: SecuritySchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
 config: SecurityOutputConfig
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * Security-specific rule and field metadata, emitted with `--explain`.
  */
@@ -12459,6 +12699,16 @@ schema_version: SecuritySchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
 config: SecurityOutputConfig
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * Security-specific rule and field metadata, emitted with `--explain`.
  */
@@ -12742,6 +12992,16 @@ export interface CombinedOutput {
 schema_version: CombinedSchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
+/**
+ * Every gate this run ARMED, keyed by name, absent when it armed none.
+ * Each entry is the same rule that decides the exit code, so a CI
+ * integration reads the verdict instead of guessing from a process status
+ * it usually cannot see. A gate fails the build when `status` is `fail`
+ * AND `enforced` is true. Armed, not evaluated: fallow's default severity
+ * rules fail a run with no flag at all, so an absent object means "no gate
+ * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
 /**
  * Per-section `_meta` blocks, when `--explain` was passed.
  */
@@ -15283,3 +15543,8 @@ export type UnusedDependency = UnusedDependencyFinding | UnusedDevDependencyFind
  * this alias; new code should narrow on the specific wrapper variant.
  */
 export type UnusedMember = UnusedClassMemberFinding | UnusedEnumMemberFinding | UnusedStoreMemberFinding;
+
+/**
+ * @deprecated Renamed to BaselineStaleness in 3.27.0, when dead-code and dupes started carrying the same shape. The members are unchanged.
+ */
+export type HealthBaselineStaleness = BaselineStaleness;