fallow 3.27.0 → 3.29.0

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.27.0",
+  "version": "3.29.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -132,7 +132,7 @@
       "name": "--baseline",
       "type": "string",
       "required": false,
-      "description": "Compare against a previously saved baseline file"
+      "description": "Compare against a previously saved baseline file. Used by bare `fallow`, `dead-code`, `dupes` and `health`; other subcommands reject it"
     },
     {
       "name": "--baseline-mode",
@@ -154,7 +154,7 @@
       "name": "--save-baseline",
       "type": "string",
       "required": false,
-      "description": "Save the current results as a baseline file"
+      "description": "Save the current results as a baseline file. Used by bare `fallow`, `dead-code`, `dupes` and `health`; other subcommands reject it. The path must resolve inside the project root, its Git work tree, the CI workspace or a temp directory"
     },
     {
       "name": "--production",
@@ -295,13 +295,13 @@
       "name": "--sarif-file",
       "type": "string",
       "required": false,
-      "description": "Write SARIF output to a file (in addition to the primary --format output)"
+      "description": "Write SARIF output to a file (in addition to the primary --format output). Used by bare `fallow`, `dead-code` and `security`. The path must resolve inside the project root, its Git work tree, the CI workspace or a temp directory"
     },
     {
       "name": "--output-file",
       "type": "string",
       "required": false,
-      "description": "Write the report to a file instead of stdout, for any --format (no ANSI codes). Useful on large projects where the terminal scrollback truncates the top. Progress and the confirmation stay on stderr",
+      "description": "Write the report to a file instead of stdout, for any --format (no ANSI codes). Useful on large projects where the terminal scrollback truncates the top. Progress and the confirmation stay on stderr. The path must resolve inside the project root, its Git work tree, the CI workspace or a temp directory",
       "short": "-o"
     },
     {
@@ -330,6 +330,16 @@
         "false"
       ]
     },
+    {
+      "name": "--fail-on-parse-error",
+      "type": "bool",
+      "required": false,
+      "description": "Exit with code 1 if fallow could not parse a source file cleanly",
+      "possible_values": [
+        "true",
+        "false"
+      ]
+    },
     {
       "name": "--tolerance",
       "type": "string",
@@ -347,7 +357,7 @@
       "name": "--save-regression-baseline",
       "type": "string",
       "required": false,
-      "description": "Save the current issue counts as a regression baseline. Omit PATH to update regression.baseline in the discovered fallow config, or create .fallowrc.json when none exists. Provide PATH to write a standalone file"
+      "description": "Save the current issue counts as a regression baseline. Omit PATH to update regression.baseline in the discovered fallow config, or create .fallowrc.json when none exists. Provide PATH to write a standalone file; PATH must resolve inside the project root, its Git work tree, the CI workspace or a temp directory"
     },
     {
       "name": "--only",
@@ -481,13 +491,13 @@
       "name": "--save-snapshot",
       "type": "string",
       "required": false,
-      "description": "Save a vital signs snapshot for trend tracking in combined mode. Provide a path or omit for the default `.fallow/snapshots/` location"
+      "description": "Save a vital signs snapshot for trend tracking in combined mode. Provide a path or omit for the default `.fallow/snapshots/` location. A given path must resolve inside the project root, its Git work tree, the CI workspace or a temp directory"
     },
     {
       "name": "--coverage",
       "type": "string",
       "required": false,
-      "description": "Path to Istanbul coverage data for exact CRAP scores in combined mode. Also settable via `FALLOW_COVERAGE` or `health.coverage`"
+      "description": "Path to Istanbul or raw V8 coverage data for exact CRAP scores in combined mode. Also settable via `FALLOW_COVERAGE` or `health.coverage`"
     },
     {
       "name": "--coverage-root",
@@ -495,6 +505,18 @@
       "required": false,
       "description": "Absolute prefix to strip from Istanbul file paths in combined mode. Also settable via `FALLOW_COVERAGE_ROOT` or `health.coverageRoot`"
     },
+    {
+      "name": "--dupes-baseline",
+      "type": "string",
+      "required": false,
+      "description": "Compare duplication clone groups against a saved baseline in combined mode (produced by `fallow dupes --save-baseline`)"
+    },
+    {
+      "name": "--health-baseline",
+      "type": "string",
+      "required": false,
+      "description": "Compare health findings against a saved baseline in combined mode (produced by `fallow health --save-baseline`)"
+    },
     {
       "name": "--include-entry-exports",
       "type": "bool",
@@ -597,6 +619,16 @@
             "false"
           ]
         },
+        {
+          "name": "--deprecated-exports-in-use",
+          "type": "bool",
+          "required": false,
+          "description": "Opt in to `@deprecated` exports that are still in use and only report that issue type",
+          "possible_values": [
+            "true",
+            "false"
+          ]
+        },
         {
           "name": "--unused-enum-members",
           "type": "bool",
@@ -1591,7 +1623,7 @@
           "name": "--min-severity",
           "type": "string",
           "required": false,
-          "description": "Only exit with error for findings at or above this severity. Use --min-severity critical to ignore moderate/high findings in CI. Composes with --min-score (the run fails if either gate trips)",
+          "description": "Only exit with error for findings at or above this severity. Use --min-severity critical to ignore moderate/high findings in CI. Composes with --min-score (the run fails if either gate trips). The complexity-* rules apply first: a finding whose rule is warn never fails the run, whatever its severity",
           "possible_values": [
             "moderate",
             "high",
@@ -1624,7 +1656,7 @@
           "name": "--save-snapshot",
           "type": "string",
           "required": false,
-          "description": "Save a vital signs snapshot for trend tracking. Defaults to `.fallow/snapshots/{timestamp}.json` if no path is given. Forces file-scores, hotspot, and score computation for complete metrics"
+          "description": "Save a vital signs snapshot for trend tracking. Defaults to `.fallow/snapshots/{timestamp}.json` if no path is given. A given path must resolve inside the project root, its Git work tree, the CI workspace or a temp directory. Forces file-scores, hotspot, and score computation for complete metrics"
         },
         {
           "name": "--trend",
@@ -1640,7 +1672,7 @@
           "name": "--coverage",
           "type": "string",
           "required": false,
-          "description": "Path to coverage data (coverage-final.json) for exact per-function CRAP scores. Generate with `jest --coverage`, `vitest run --coverage --provider istanbul`, or any Istanbul-compatible tool. Requires Istanbul format (not v8/c8 native format). Accepts a single Istanbul coverage map JSON file or a directory containing coverage-final.json. Use --coverage-root when the file was generated in a different environment (CI runner, Docker). Affects CRAP scores only, not --coverage-gaps. Also configurable via FALLOW_COVERAGE env var"
+          "description": "Path to coverage data for exact per-function CRAP scores. Accepts an Istanbul coverage map JSON file (coverage-final.json, from `jest --coverage`, `vitest run --coverage`, c8 or nyc), a directory containing coverage-final.json, a raw V8 coverage directory (`NODE_V8_COVERAGE=<dir> node --test`), or a single V8 coverage JSON file. Transpiled V8 scripts (tsx, bundles) map back to their source files through the source map that Node records in the dump. A script that differs from the file on disk and has no source map keeps the estimate. Use --coverage-root when the data was generated in a different environment (CI runner, Docker). Affects CRAP scores only, not --coverage-gaps. Also configurable via FALLOW_COVERAGE env var"
         },
         {
           "name": "--coverage-root",
@@ -1652,7 +1684,7 @@
           "name": "--runtime-coverage",
           "type": "string",
           "required": false,
-          "description": "File or directory containing runtime coverage input. Accepts a V8 coverage directory, a single V8 JSON file, or a single Istanbul coverage map JSON file (commonly coverage-final.json)"
+          "description": "File or directory containing runtime coverage input. Accepts a V8 coverage directory, a single V8 JSON file, or a single Istanbul coverage map JSON file (commonly coverage-final.json). A single local capture is free. Continuous or multi-capture monitoring needs a license (see `fallow license`)"
         },
         {
           "name": "--min-invocations-hot",
@@ -1779,7 +1811,7 @@
           "name": "--coverage",
           "type": "string",
           "required": false,
-          "description": "Path to Istanbul-format coverage data (coverage-final.json) for accurate per-function CRAP scores in the health sub-analysis. Also configurable via FALLOW_COVERAGE or health.coverage"
+          "description": "Path to Istanbul coverage data (coverage-final.json) or raw V8 coverage (a `NODE_V8_COVERAGE` directory or one V8 JSON file) for accurate per-function CRAP scores in the health sub-analysis. Also configurable via FALLOW_COVERAGE or health.coverage"
         },
         {
           "name": "--coverage-root",
@@ -1831,7 +1863,7 @@
           "name": "--runtime-coverage",
           "type": "string",
           "required": false,
-          "description": "Paid runtime-coverage sidecar input. Accepts a V8 directory, a single V8 JSON file, or an Istanbul coverage map JSON. Spawns the `fallow-cov` sidecar as part of the audit pipeline so the `hot-path-touched` verdict surfaces alongside dead-code and complexity findings without requiring a second `fallow health` invocation in CI. License-gated; the verdict is informational (no exit code change) until a future `--gate hot-path-touched` knob lands"
+          "description": "Runtime coverage input. Accepts a V8 directory, a single V8 JSON file, or an Istanbul coverage map JSON. Runs the `fallow-cov` sidecar inside the audit, so the `hot-path-touched` verdict shows next to the dead-code and complexity findings without a second `fallow health` run in CI. The verdict is informational and does not change the exit code. A single local capture is free. Continuous or multi-capture monitoring needs a license (see `fallow license`)"
         },
         {
           "name": "--min-invocations-hot",
@@ -1984,7 +2016,7 @@
           "name": "--runtime-coverage",
           "type": "string",
           "required": false,
-          "description": "Paid runtime-coverage sidecar input. Accepts a V8 directory, a single V8 JSON file, or an Istanbul coverage map JSON. When set, `fallow security` annotates tainted-sink candidates with production runtime state and uses that state as an additive ranking signal"
+          "description": "Runtime coverage input. Accepts a V8 directory, a single V8 JSON file, or an Istanbul coverage map JSON. When set, `fallow security` adds production runtime state to tainted-sink candidates and uses that state as an extra ranking signal. A single local capture is free. Continuous or multi-capture monitoring needs a license (see `fallow license`)"
         },
         {
           "name": "--min-invocations-hot",
@@ -2355,6 +2387,43 @@
       "license_note": null,
       "docs_url": "https://docs.fallow.tools/explanations/dead-code#private-type-leaks"
     },
+    {
+      "id": "deprecated-export-in-use",
+      "rule_id": "fallow/deprecated-export-in-use",
+      "command": "dead-code",
+      "category": "Dead code",
+      "description": "Export marked @deprecated is still referenced",
+      "label": "Deprecated Exports in Use",
+      "config_key": "deprecated-exports-in-use",
+      "registry_index": 5,
+      "aliases": [],
+      "lsp": false,
+      "filter_flag": "--deprecated-exports-in-use",
+      "result_key": "deprecated_exports_in_use",
+      "summary_label": "Deprecated exports in use",
+      "summary_docs_anchor": "deprecated-exports-in-use",
+      "sarif_rule_ids": [
+        "fallow/deprecated-export-in-use"
+      ],
+      "codeclimate_check_names": [
+        "fallow/deprecated-export-in-use"
+      ],
+      "ts_alias": {
+        "name": "DeprecatedExportInUse",
+        "parent": "DeprecatedExportInUseFinding"
+      },
+      "counts_in_total": true,
+      "fixable": false,
+      "suppressible": true,
+      "suppress_comment": "// fallow-ignore-next-line deprecated-export-in-use",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
+      "note": "Opt-in migration sweep; the rule defaults to off",
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://docs.fallow.tools/explanations/dead-code#deprecated-exports-in-use"
+    },
     {
       "id": "unused-dependency",
       "rule_id": "fallow/unused-dependency",
@@ -2363,7 +2432,7 @@
       "description": "Dependency listed but never imported",
       "label": "Unused Dependencies",
       "config_key": "unused-dependencies",
-      "registry_index": 5,
+      "registry_index": 6,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-deps",
@@ -2400,7 +2469,7 @@
       "description": "Dev dependency listed but never imported",
       "label": "Unused Dev Dependencies",
       "config_key": "unused-dev-dependencies",
-      "registry_index": 6,
+      "registry_index": 7,
       "aliases": [
         "unused-dev-deps",
         "unused-dev-dependencies"
@@ -2440,7 +2509,7 @@
       "description": "Optional dependency listed but never imported",
       "label": "Unused Optional Dependencies",
       "config_key": "unused-optional-dependencies",
-      "registry_index": 7,
+      "registry_index": 8,
       "aliases": [
         "unused-optional-deps",
         "unused-optional-dependencies"
@@ -2480,7 +2549,7 @@
       "description": "Production dependency only used via type-only imports",
       "label": "Type-Only Dependencies",
       "config_key": "type-only-dependencies",
-      "registry_index": 14,
+      "registry_index": 15,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-deps",
@@ -2517,7 +2586,7 @@
       "description": "Production dependency only imported by test files",
       "label": "Test-Only Dependencies",
       "config_key": "test-only-dependencies",
-      "registry_index": 15,
+      "registry_index": 16,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-deps",
@@ -2554,7 +2623,7 @@
       "description": "devDependency imported by production code with a runtime import",
       "label": "Dev Dependencies Used in Production",
       "config_key": "dev-dependencies-in-production",
-      "registry_index": 16,
+      "registry_index": 17,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-deps",
@@ -2591,7 +2660,7 @@
       "description": "Enum member is never referenced",
       "label": "Unused Enum Members",
       "config_key": "unused-enum-members",
-      "registry_index": 8,
+      "registry_index": 9,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-enum-members",
@@ -2628,7 +2697,7 @@
       "description": "Class member is never referenced",
       "label": "Unused Class Members",
       "config_key": "unused-class-members",
-      "registry_index": 9,
+      "registry_index": 10,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-class-members",
@@ -2665,7 +2734,7 @@
       "description": "Store member is never accessed by any consumer",
       "label": "Unused Store Members",
       "config_key": "unused-store-members",
-      "registry_index": 10,
+      "registry_index": 11,
       "aliases": [
         "unused-store-members"
       ],
@@ -2704,7 +2773,7 @@
       "description": "Import could not be resolved",
       "label": "Unresolved Imports",
       "config_key": "unresolved-imports",
-      "registry_index": 11,
+      "registry_index": 12,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unresolved-imports",
@@ -2741,7 +2810,7 @@
       "description": "Dependency used but not in package.json",
       "label": "Unlisted Dependencies",
       "config_key": "unlisted-dependencies",
-      "registry_index": 12,
+      "registry_index": 13,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unlisted-deps",
@@ -2778,7 +2847,7 @@
       "description": "Export name appears in multiple modules",
       "label": "Duplicate Exports",
       "config_key": "duplicate-exports",
-      "registry_index": 13,
+      "registry_index": 14,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--duplicate-exports",
@@ -2815,7 +2884,7 @@
       "description": "Circular dependency chain detected",
       "label": "Circular Dependencies",
       "config_key": "circular-dependencies",
-      "registry_index": 17,
+      "registry_index": 18,
       "aliases": [
         "circular-dependencies"
       ],
@@ -2854,7 +2923,7 @@
       "description": "Two or more barrel files re-export from each other in a loop",
       "label": "Re-Export Cycles",
       "config_key": "re-export-cycle",
-      "registry_index": 18,
+      "registry_index": 19,
       "aliases": [
         "re-export-cycles",
         "reexport-cycle",
@@ -2895,7 +2964,7 @@
       "description": "Import crosses a configured architecture boundary",
       "label": "Boundary Violations",
       "config_key": "boundary-violation",
-      "registry_index": 19,
+      "registry_index": 20,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--boundary-violations",
@@ -2932,7 +3001,7 @@
       "description": "Source file matches no configured architecture boundary zone",
       "label": "Boundary Coverage",
       "config_key": "boundary-violation",
-      "registry_index": 20,
+      "registry_index": 21,
       "aliases": [
         "boundary-coverage-violations"
       ],
@@ -2968,7 +3037,7 @@
       "description": "Zoned file calls a callee its zone forbids",
       "label": "Boundary Call Violations",
       "config_key": "boundary-violation",
-      "registry_index": 21,
+      "registry_index": 22,
       "aliases": [
         "boundary-calls",
         "boundary-call-violations"
@@ -3005,7 +3074,7 @@
       "description": "Banned usage matched a rule-pack rule",
       "label": "Policy Violations",
       "config_key": "policy-violation",
-      "registry_index": 22,
+      "registry_index": 23,
       "aliases": [
         "policy-violations"
       ],
@@ -3041,7 +3110,7 @@
       "description": "Suppression comment or tag no longer matches any issue",
       "label": "Stale Suppressions",
       "config_key": "stale-suppressions",
-      "registry_index": 37,
+      "registry_index": 38,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--stale-suppressions",
@@ -3077,7 +3146,7 @@
       "description": "Suppression comment omits a required reason",
       "label": "Missing Suppression Reasons",
       "config_key": "require-suppression-reason",
-      "registry_index": 38,
+      "registry_index": 39,
       "aliases": [
         "missing-suppression-reasons"
       ],
@@ -3109,7 +3178,7 @@
       "description": "Catalog entry not referenced by any workspace package",
       "label": "Unused Catalog Entries",
       "config_key": "unused-catalog-entries",
-      "registry_index": 39,
+      "registry_index": 40,
       "aliases": [
         "catalog",
         "unused-catalog-entries"
@@ -3149,7 +3218,7 @@
       "description": "Named catalog group has no entries",
       "label": "Empty Catalog Groups",
       "config_key": "empty-catalog-groups",
-      "registry_index": 40,
+      "registry_index": 41,
       "aliases": [
         "empty-catalog",
         "empty-catalog-groups"
@@ -3189,7 +3258,7 @@
       "description": "package.json references a catalog that does not declare the package",
       "label": "Unresolved Catalog References",
       "config_key": "unresolved-catalog-references",
-      "registry_index": 41,
+      "registry_index": 42,
       "aliases": [
         "unresolved-catalog",
         "unresolved-catalog-references"
@@ -3229,7 +3298,7 @@
       "description": "Package-manager override target is not declared or resolved",
       "label": "Unused Dependency Overrides",
       "config_key": "unused-dependency-overrides",
-      "registry_index": 42,
+      "registry_index": 43,
       "aliases": [
         "unused-dependency-overrides",
         "unused-override",
@@ -3270,7 +3339,7 @@
       "description": "Package-manager override has an unparsable key or value",
       "label": "Misconfigured Dependency Overrides",
       "config_key": "misconfigured-dependency-overrides",
-      "registry_index": 43,
+      "registry_index": 44,
       "aliases": [
         "misconfigured-dependency-overrides",
         "misconfigured-override",
@@ -3311,7 +3380,7 @@
       "description": "\"use client\" file exports a server-only / route-config name",
       "label": "Invalid Client Exports",
       "config_key": "invalid-client-export",
-      "registry_index": 23,
+      "registry_index": 24,
       "aliases": [
         "invalid-client-exports"
       ],
@@ -3349,7 +3418,7 @@
       "description": "Barrel re-exports both a \"use client\" module and a server-only module",
       "label": "Mixed Client/Server Barrels",
       "config_key": "mixed-client-server-barrel",
-      "registry_index": 24,
+      "registry_index": 25,
       "aliases": [
         "mixed-client-server-barrels"
       ],
@@ -3385,7 +3454,7 @@
       "description": "\"use client\" / \"use server\" directive is not in the leading position and is ignored",
       "label": "Misplaced Directives",
       "config_key": "misplaced-directive",
-      "registry_index": 25,
+      "registry_index": 26,
       "aliases": [
         "misplaced-directives"
       ],
@@ -3421,7 +3490,7 @@
       "description": "inject() / getContext() reads a key that no provide() / setContext() supplies",
       "label": "Unprovided Injects",
       "config_key": "unprovided-injects",
-      "registry_index": 26,
+      "registry_index": 27,
       "aliases": [
         "unprovided-injects"
       ],
@@ -3457,7 +3526,7 @@
       "description": "A Vue / Svelte component is reachable through a barrel but rendered nowhere",
       "label": "Unrendered Components",
       "config_key": "unrendered-components",
-      "registry_index": 27,
+      "registry_index": 28,
       "aliases": [
         "unrendered-components"
       ],
@@ -3493,7 +3562,7 @@
       "description": "A Vue, Svelte, or React component prop is referenced nowhere in its own component",
       "label": "Unused Component Props",
       "config_key": "unused-component-props",
-      "registry_index": 28,
+      "registry_index": 29,
       "aliases": [
         "unused-component-props"
       ],
@@ -3529,7 +3598,7 @@
       "description": "A Vue <script setup> defineEmits event is emitted nowhere in its own component",
       "label": "Unused Component Emits",
       "config_key": "unused-component-emits",
-      "registry_index": 29,
+      "registry_index": 30,
       "aliases": [
         "unused-component-emits"
       ],
@@ -3565,7 +3634,7 @@
       "description": "An Angular @Input() / signal input() / model() input is read nowhere in its own component",
       "label": "Unused Component Inputs",
       "config_key": "unused-component-inputs",
-      "registry_index": 30,
+      "registry_index": 31,
       "aliases": [
         "unused-component-inputs"
       ],
@@ -3601,7 +3670,7 @@
       "description": "An Angular @Output() / signal output() output is emitted nowhere in its own component",
       "label": "Unused Component Outputs",
       "config_key": "unused-component-outputs",
-      "registry_index": 31,
+      "registry_index": 32,
       "aliases": [
         "unused-component-outputs"
       ],
@@ -3637,7 +3706,7 @@
       "description": "A Svelte component dispatches a createEventDispatcher event whose name is listened to nowhere in the project",
       "label": "Unused Svelte Events",
       "config_key": "unused-svelte-events",
-      "registry_index": 32,
+      "registry_index": 33,
       "aliases": [
         "unused-svelte-events"
       ],
@@ -3673,7 +3742,7 @@
       "description": "A Next.js Server Action exported from a \"use server\" file is referenced by no code in the project",
       "label": "Unused Server Actions",
       "config_key": "unused-server-actions",
-      "registry_index": 33,
+      "registry_index": 34,
       "aliases": [
         "unused-server-actions"
       ],
@@ -3709,7 +3778,7 @@
       "description": "A SvelteKit load() return-object key is read by no consumer",
       "label": "Unused Load Data Keys",
       "config_key": "unused-load-data-keys",
-      "registry_index": 34,
+      "registry_index": 35,
       "aliases": [
         "unused-load-data-keys"
       ],
@@ -3745,7 +3814,7 @@
       "description": "A React/Preact prop is forwarded unchanged through 3+ pass-through components to a distant consumer",
       "label": "Prop Drilling",
       "config_key": "prop-drilling",
-      "registry_index": 49,
+      "registry_index": 50,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -3777,7 +3846,7 @@
       "description": "A React/Preact component whose whole body is a single spread-forwarded child render (a candidate for inlining)",
       "label": "Thin Wrappers",
       "config_key": "thin-wrapper",
-      "registry_index": 50,
+      "registry_index": 51,
       "aliases": [
         "thin-wrappers"
       ],
@@ -3811,7 +3880,7 @@
       "description": "Three or more React/Preact components across two or more files declare an identical prop-name set (a missing shared Props type)",
       "label": "Duplicate Prop Shapes",
       "config_key": "duplicate-prop-shape",
-      "registry_index": 51,
+      "registry_index": 52,
       "aliases": [
         "duplicate-prop-shapes"
       ],
@@ -3845,7 +3914,7 @@
       "description": "Two or more Next.js App Router route files resolve to the same URL",
       "label": "Route Collisions",
       "config_key": "route-collision",
-      "registry_index": 35,
+      "registry_index": 36,
       "aliases": [
         "route-collisions"
       ],
@@ -3883,7 +3952,7 @@
       "description": "Sibling Next.js dynamic route segments use different slug names at the same position",
       "label": "Dynamic Segment Conflicts",
       "config_key": "dynamic-segment-name-conflict",
-      "registry_index": 36,
+      "registry_index": 37,
       "aliases": [
         "dynamic-segment-name-conflicts"
       ],
@@ -4071,7 +4140,7 @@
       "description": "CSS or CSS-in-JS hardcoded styling value bypasses the design token system",
       "label": "CSS Token Drift",
       "config_key": "css-token-drift",
-      "registry_index": 52,
+      "registry_index": 53,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4101,7 +4170,7 @@
       "description": "CSS or CSS-in-JS declaration block is duplicated across rules",
       "label": "CSS Duplicate Block",
       "config_key": "css-duplicate-block",
-      "registry_index": 53,
+      "registry_index": 54,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4131,7 +4200,7 @@
       "description": "CSS selector, nesting, or important usage is structurally complex",
       "label": "CSS Selector Complexity",
       "config_key": "css-selector-complexity",
-      "registry_index": 54,
+      "registry_index": 55,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4161,7 +4230,7 @@
       "description": "CSS or CSS-in-JS surface appears unused",
       "label": "CSS Dead Surface",
       "config_key": "css-dead-surface",
-      "registry_index": 55,
+      "registry_index": 56,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4191,7 +4260,7 @@
       "description": "CSS or CSS-in-JS reference resolves to no stylesheet definition",
       "label": "CSS Broken Reference",
       "config_key": "css-broken-reference",
-      "registry_index": 56,
+      "registry_index": 57,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4581,7 +4650,7 @@
       "description": "Detected feature flag pattern",
       "label": "Feature Flags",
       "config_key": "feature-flags",
-      "registry_index": 47,
+      "registry_index": 48,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -6101,7 +6170,7 @@
     "FALLOW_CACHE_DIR": "Directory for fallow's persistent analysis cache. Relative paths resolve from the project root and override cache.dir.",
     "FALLOW_CACHE_MAX_SIZE": "Extraction cache size cap in megabytes (default 256). Wins over the cache.maxSizeMb config field.",
     "FALLOW_EXTENDS_TIMEOUT_SECS": "Timeout in seconds for fetching https:// configs referenced via the extends field (default 5).",
-    "FALLOW_COVERAGE": "Path to Istanbul coverage data (coverage-final.json) for accurate per-function CRAP scores. CLI --coverage flag overrides this; it wins over the health.coverage config field. Honored by the health, bare fallow, audit, and viz CLI commands and by the MCP audit and check_health tools on both their typed route and their CLI fallback, where the explicit coverage parameter overrides it. Viz reads it through the same precedence and has no coverage flag of its own.",
+    "FALLOW_COVERAGE": "Path to Istanbul coverage data (coverage-final.json) or raw V8 coverage (a NODE_V8_COVERAGE directory or one V8 JSON file) for accurate per-function CRAP scores. CLI --coverage flag overrides this; it wins over the health.coverage config field. Honored by the health, bare fallow, audit, and viz CLI commands and by the MCP audit and check_health tools on both their typed route and their CLI fallback, where the explicit coverage parameter overrides it. Viz reads it through the same precedence and has no coverage flag of its own.",
     "FALLOW_COVERAGE_ROOT": "Absolute coverage-data path prefix for rebasing Istanbul paths in CI or containers. CLI --coverage-root flag overrides this; it wins over the health.coverageRoot config field. Honored by the health, bare fallow, audit, and viz CLI commands and by the MCP audit and check_health tools on both their typed route and their CLI fallback, where the explicit coverage_root parameter overrides it. Viz reads it through the same precedence and has no coverage flag of its own.",
     "FALLOW_MAX_FILE_SIZE": "Per-file size ceiling in megabytes for source discovery (default 5; 0 = no limit). CLI --max-file-size flag overrides this.",
     "FALLOW_TYPE_AWARE": "Enable or disable TypeScript semantic (type-aware) analysis for the run (true/false/1/0/yes/no/on/off). Precedence: --type-aware/--no-type-aware CLI flags, then FALLOW_TYPE_AWARE, then the audit.typeAware config field, then typeAware.enabled.",
@@ -6640,7 +6709,7 @@
         ],
         "license": "free",
         "license_note": null,
-        "read_only": true,
+        "read_only": false,
         "code_mode_alias": "analyze"
       },
       {
@@ -6655,7 +6724,7 @@
         ],
         "license": "free",
         "license_note": null,
-        "read_only": true,
+        "read_only": false,
         "code_mode_alias": "checkChanged"
       },
       {
@@ -6748,7 +6817,7 @@
         ],
         "license": "free",
         "license_note": null,
-        "read_only": true,
+        "read_only": false,
         "code_mode_alias": "findDupes"
       },
       {
@@ -6769,7 +6838,7 @@
         ],
         "license": "free",
         "license_note": null,
-        "read_only": true,
+        "read_only": false,
         "code_mode_alias": "checkHealth"
       },
       {
@@ -7262,7 +7331,7 @@
     ]
   },
   "plugins": {
-    "count": 126,
+    "count": 127,
     "note": "Built-in framework plugins, auto-activated when their enabler dependency is present; run fallow list --plugins for the set active in a specific project",
     "names": [
       "nextjs",
@@ -7314,6 +7383,7 @@
       "rolldown",
       "rspack",
       "rsbuild",
+      "module-federation",
       "tsup",
       "tsdown",
       "pkg-utils",