fallow 3.27.0 → 3.29.0

package/types/output-contract.d.ts

@@ -261,7 +261,7 @@ export type IssueAction = (FixAction | SuppressLineAction | SuppressFileAction |
  * Discriminant string for [`FixAction`]. Kebab-case per the JSON output
  * contract.
  */
-export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
+export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "migrate-deprecated-export" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
 /**
  * Singleton discriminant for [`SuppressLineAction`].
  */
@@ -301,6 +301,27 @@ export type AddToConfigValue = (string | IgnoreExportsRule[] | {
  * hold `Option<AuditIntroduced>`. Renders to the JSON wire as a bare boolean.
  */
 export type AuditIntroduced = boolean
+/**
+ * Gate severity of one finding after rule resolution.
+ *
+ * It is the severity that `rules` and the matching `overrides[].rules` give
+ * the finding for its path. `--fail-on-issues` raises `warn` to `error`. A
+ * finding whose rule is `off` is not reported, so there is no `off` value.
+ * The type is separate from the health `severity` band, which ranks a
+ * finding and does not gate it.
+ *
+ * The `fallow dead-code` findings gate fails when a finding is `error`.
+ * Other gates (regression, stale baseline) decide on their own inputs. Two
+ * commands differ: the `fallow audit` `new-only` gate fails only on introduced
+ * findings, so an inherited `error` finding does not fail the audit, and the
+ * combined command (`fallow` without a subcommand) exits 0 for machine
+ * formats.
+ *
+ * Complexity findings carry the same type. The `complexity-cyclomatic`,
+ * `complexity-cognitive` and `complexity-crap` rules set it, and the
+ * `fallow health` findings gate and the audit verdict read it.
+ */
+export type EffectiveSeverity = ("error" | "warn")
 /**
  * A per-finding caveat on a dead-code verdict that a file this run never
  * fully analyzed can distort.
@@ -325,6 +346,10 @@ export type AuditIntroduced = boolean
  * caveat" rather than as an error.
  */
 export type ReachabilityCaveat = ("incomplete-file-analysis" | "incomplete-import-graph")
+/**
+ * How a consumer references a deprecated export.
+ */
+export type DeprecatedConsumerKind = ("named-import" | "default-import" | "namespace-import" | "re-export" | "dynamic-import" | "side-effect-import")
 /**
  * Where in package.json a dependency is listed.
  *
@@ -420,6 +445,22 @@ export type DependencyOverrideMisconfigReason = ("unparsable-key" | "empty-value
  * from counts.
  */
 export type BaselineStalenessAdvisory = ("none" | "zero-overlap" | "partial")
+/**
+ * One channel that narrowed a run to part of the project.
+ *
+ * Serialized as kebab-case inside `scope_reasons` and published as an OPEN
+ * set, the same tolerate-unknown contract `gate_outcomes` keys carry: a name
+ * this build does not emit means "some narrowing", not an error.
+ *
+ * Which names a command can emit differs per command, because the three
+ * narrowing predicates see different state. `dead-code` reads the flags
+ * themselves and can name every channel. `dupes` and `health` see an already
+ * resolved changed-file set and report `changed-files`, because at that point
+ * the flag that produced it is gone. `health` reports `workspace` for both
+ * `--workspace` and `--changed-workspaces` for the same reason. A consumer
+ * must therefore not assume a given command emits a given name.
+ */
+export type ScopeReason = ("diff" | "changed-since" | "changed-files" | "workspace" | "changed-workspaces" | "scope" | "file" | "issue-type-filter" | "production")
 /**
  * Status of a regression-check pass.
  */
@@ -428,6 +469,29 @@ export type RegressionStatus = ("pass" | "exceeded" | "skipped")
  * Interpretation of [`RegressionResult::tolerance`].
  */
 export type RegressionToleranceKind = ("absolute" | "percentage")
+/**
+ * What became of one request on this run.
+ *
+ * Two-valued today. The value set is OPEN so a later `partial` needs no bump,
+ * and it is deliberately not added now: nothing emits it, and a permanently
+ * unused value reads as a measurement nobody takes.
+ */
+export type RequestStatus = ("applied" | "not-applied")
+/**
+ * What a request governs, and therefore what its failure means.
+ *
+ * Published on every entry so a consumer selects on the class rather than on
+ * a name list. Without it the one sentence a consumer can write for the whole
+ * object ("the report is wider than requested") is false for any request that
+ * does not narrow, which is how a failed `--sarif-file` write came to be
+ * reported as an unscoped run. A request name added later carries its own
+ * class, so a consumer written today keeps saying the right thing about it.
+ *
+ * The value set is OPEN, like the names and the statuses: read a class this
+ * build does not recognise as "some request", not as an error, and do not read
+ * it as `scope`.
+ */
+export type RequestEffect = ("scope" | "artifact")
 /**
  * A diagnostic about a workspace-discovery candidate.
  *
@@ -570,6 +634,103 @@ kind: "excluded-by-default-ignore"
  */
 excluded_file_count: number
 kind: "no-source-files-analyzed"
+} | {
+/**
+ * Scoring error text.
+ */
+error: string
+kind: "file-scores-unavailable"
+} | {
+/**
+ * Which input stopped it, as a kebab-case token: `not-a-repository`,
+ * `no-commits`, `invalid-since` or `churn-file-unreadable`. The set is
+ * open.
+ *
+ * The cause decides the remedy, which is why it is on the wire: a run
+ * outside a repository is fixed by running fallow inside one, a
+ * branch without a commit by committing, a malformed `--since` by
+ * respelling the flag, and a churn file that changed under the run by
+ * rerunning it. A consumer reading only the kind would offer the first
+ * remedy for all four.
+ */
+cause: string
+kind: "hotspots-skipped"
+} | {
+/**
+ * `true` when the run also asked for ownership attribution, which a
+ * shallow clone skews further by inflating single-author dominance.
+ */
+ownership_requested: boolean
+kind: "shallow-clone"
+} | {
+kind: "unpinned-clock"
+} | {
+/**
+ * Which input failed, as a kebab-case token: `invalid-bot-pattern` or
+ * `codeowners-parse-failed`. The set is open.
+ */
+cause: string
+/**
+ * Underlying error text.
+ */
+error: string
+kind: "ownership-unavailable"
+} | {
+/**
+ * Filesystem or JSON error text.
+ */
+error: string
+kind: "trend-snapshot-unreadable"
+} | {
+/**
+ * The plugin that read the config, as it labels itself:
+ * `module-federation` for a standalone `module-federation.config.*`,
+ * or the bundler plugin (`webpack`, `rspack`, `rsbuild`, `vite`) that
+ * read the same options inline from its own config.
+ */
+plugin: string
+/**
+ * The config key that was present and not fully readable (`exposes`,
+ * `remotes`), or the Module Federation runtime function whose
+ * argument was not readable (`registerRemotes`, `loadRemote`, `init`,
+ * `createInstance`). The set is open.
+ */
+key: string
+/**
+ * Why it could not be read, as a kebab-case token:
+ * `not-object-literal`, `array-form`, `spread`,
+ * `unreadable-entries`, `unrecognized-call`,
+ * `import-target-unreadable` or `dynamic-argument`. The set is open.
+ *
+ * The reason decides the remedy, which is why it is on the wire: a
+ * value that is not an object literal is fixed by writing one, while
+ * unreadable entries are fixed by naming those entries in the config
+ * option the message points at.
+ */
+reason: string
+kind: "plugin-config-unreadable"
+} | {
+/**
+ * The plugin that read the config, as it labels itself (`nuxt`).
+ */
+plugin: string
+/**
+ * The config key whose effect is not modeled (`components`,
+ * `imports`), or the virtual module a file reads (`#components`,
+ * `#imports`). The set is open.
+ */
+key: string
+/**
+ * Why the effect is not modeled, as a kebab-case token:
+ * `key-effect-not-modeled` when the key's own value is the reason,
+ * `config-property-unreadable` when a top-level property of the same
+ * config file could not be read statically, so no surface in it can
+ * be classified at all. The set is open.
+ */
+reason: string
+kind: "plugin-effect-not-modeled"
+} | {
+kind: "coverage-auto-detected"
 })
 /**
  * Discriminant for [`CloneGroupAction::kind`]. Mirrors the action types
@@ -641,6 +802,10 @@ export type HealthFindingActionType = ("refactor-function" | "add-tests" | "incr
  * Coverage model used for CRAP score computation.
  */
 export type CoverageModel = ("static_binary" | "static_estimated" | "istanbul")
+/**
+ * Input format of the measured coverage behind `CoverageModel::Istanbul`.
+ */
+export type CoverageInputFormat = ("istanbul" | "v8")
 /**
  * Whether CRAP findings in the report used one coverage-source kind or a mix.
  */
@@ -1092,7 +1257,7 @@ export type SecurityUrlShape = ("fixed-origin-dynamic-path" | "dynamic-origin")
  */
 export type SecurityRuntimeState = ("runtime-hot" | "runtime-cold" | "never-executed" | "low-traffic" | "coverage-unavailable" | "runtime-unknown")
 /**
- * Defensive control family detected on a source to sink path.
+ * Family of a control pattern observed in a file on an import trace.
  */
 export type SecurityControlKind = ("sanitization" | "validation" | "authentication" | "authorization")
 /**
@@ -1140,7 +1305,7 @@ export type FeatureFlagActionType = ("investigate-flag" | "suppress-line")
  * Independently-versioned wire-version newtype for the brief envelope.
  * Serializes as the integer `REVIEW_BRIEF_SCHEMA_VERSION`.
  */
-export type ReviewBriefSchemaVersion = 10
+export type ReviewBriefSchemaVersion = 11
 /**
  * The exactly-three shippable decision categories (the SOLID-3). No cut category
  * (abstraction / deletion / convention / irreversibility) is representable: this
@@ -1357,13 +1522,13 @@ base_snapshot_skipped?: (boolean | null)
 summary: AuditSummary
 attribution: AuditAttribution
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -1449,24 +1614,25 @@ styling_inherited: number
 duplication_demoted: number
 }
 /**
- * Every gate a run ARMED, keyed by name.
+ * The verdict of every gate a run evaluated, keyed by name.
  *
- * Armed, not evaluated: a gate is armed by a flag or by config, never merely
- * because the rule behind it exists. Fallow's default severity rules fail a
- * run with no flag at all, so a `dead-code` run can exit 1 carrying no object
- * whatsoever. Read an absent object as "no gate was asked for", never as
- * "nothing failed".
+ * A gate is armed by a flag or by config. The default exit rule of a command
+ * is always in the object, also when no flag armed a gate:
+ * `error-severity-findings` on `dead-code`, `check` and the combined run
+ * (with `health-findings` when the combined run analyzed health),
+ * `health-findings` on `health`, `security-advisory` on `security` and
+ * `audit-verdict` on `audit`. A reader of the JSON sees a failing run without
+ * the exit code. `dupes` has no default exit rule, so a `dupes` run that armed
+ * no gate carries no object and always exits 0.
  *
- * Absent from an envelope whenever it is empty, so a run that armed no gate is
- * byte-identical to one produced before this object existed. An empty object
- * is never emitted: it would assert that gates were armed and none tripped,
- * which is a different and false claim.
+ * An empty object is never emitted. The typed programmatic API runs no CLI
+ * gate and leaves the object absent.
  *
  * The names this build can emit are `error-severity-findings`, `regression`,
  * `stale-baseline`, `duplication-threshold`, `health-min-score`,
  * `health-min-severity`, `health-findings`, `health-coverage-gaps`,
- * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`
- * and `type-aware-require`. The set is OPEN: a name a consumer does not
+ * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`,
+ * `type-aware-require` and `parse-error`. The set is OPEN: a name a consumer does not
  * recognise means "some gate", not an error.
  */
 export interface GateOutcomes {
@@ -1493,15 +1659,17 @@ export interface GateOutcome {
 status: GateStatus
 /**
  * True when a `fail` from this gate makes the run exit non-zero. False
- * when the verdict is published for information only, because the gate was
- * never armed or because the run was told never to fail.
+ * when the verdict is published for information only: the gate was never
+ * armed, the run was told never to fail, or the combined machine formats
+ * exit 0 for the gate.
  */
 enforced: boolean
 /**
  * The measured value the gate compared, when there is one: the duplication
- * percentage, the health score, or the number of findings at or above the
- * severity floor. Whole numbers are carried as JSON numbers, so a count of
- * three reads as `3.0`. Absent for gates that compare no number.
+ * percentage, the health score, the number of findings at or above the
+ * severity floor, or the number of files in `files`. Whole numbers are
+ * carried as JSON numbers, so a count of three reads as `3.0`. Absent for
+ * gates that compare no number.
  */
 observed?: (number | null)
 /**
@@ -1519,6 +1687,34 @@ threshold?: (number | null)
  * object. Absent for gates whose numbers speak for themselves.
  */
 threshold_label?: (string | null)
+/**
+ * The files the gate judged, for a gate that judges files rather than a
+ * number. Only `parse-error` sets it: one item per file that did not
+ * parse cleanly, sorted by path. Absent when the list is empty.
+ */
+files?: GateFile[]
+}
+/**
+ * One file a file-judging gate names, with the reason the gate counted it.
+ *
+ * Today only `parse-error` emits it. The item carries the same facts as the
+ * `source-parse-degraded` entry in `workspace_diagnostics[]` for that file,
+ * so a consumer can act on the gate without a join.
+ */
+export interface GateFile {
+/**
+ * The file path, relative to the project root, with `/` separators.
+ */
+path: string
+/**
+ * The number of parser errors for the file.
+ */
+error_count: number
+/**
+ * True when the parser stopped in the file instead of recovering, so the
+ * analysis saw only the part before the error.
+ */
+panicked: boolean
 }
 /**
  * Metric and rule definitions emitted under `_meta` when `--explain` is
@@ -2484,6 +2680,12 @@ unused_types: UnusedTypeFinding[]
  * typed `actions` array natively.
  */
 private_type_leaks: PrivateTypeLeakFinding[]
+/**
+ * Exports marked `@deprecated` that still have at least one consumer in
+ * a reachable file. Wrapped in [`DeprecatedExportInUseFinding`]. Opt-in: the
+ * `deprecated-exports-in-use` rule defaults to `off`.
+ */
+deprecated_exports_in_use?: DeprecatedExportInUseFinding[]
 /**
  * Dependencies listed in package.json but never imported. Wrapped in
  * [`UnusedDependencyFinding`] so each entry carries a typed `actions`
@@ -2811,15 +3013,25 @@ baseline_staleness?: (BaselineStaleness | null)
  */
 regression?: (RegressionResult | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
+/**
+ * Every narrowing or shaping request this run RECEIVED, keyed by name,
+ * absent when it was asked for nothing. An entry whose `status` is not
+ * `applied` means the run could not do what it was asked and reported
+ * something WIDER instead, so what follows is a valid report of a scope
+ * nobody requested. Honoured requests are published too, with
+ * `status: "applied"`, so an absent object means "nothing was asked for",
+ * never "nothing failed". See [`crate::RequestOutcomes`].
+ */
+request_outcomes?: (RequestOutcomes | null)
 /**
  * `_meta` block with docs and rule definitions, when `--explain` was
  * passed.
@@ -2838,10 +3050,12 @@ _meta?: (Meta | null)
  *   `source-parse-degraded`;
  * - dead-code analysis, from the dependency-catalog and override
  *   detectors: `malformed-pnpm-workspace-yaml`,
- *   `bun-lockb-override-resolution-skipped`.
+ *   `bun-lockb-override-resolution-skipped`;
+ * - framework plugins, while they read their own build configs:
+ *   `plugin-config-unreadable`, `plugin-effect-not-modeled`.
  *
- * Analysis-stage kinds therefore reach only the envelopes whose run
- * includes a dead-code analyze pass, never a standalone
+ * Analysis-stage and plugin-stage kinds therefore reach only the envelopes
+ * whose run includes a dead-code analyze pass, never a standalone
  * `fallow dupes --format json`. `path` is project-root-relative with
  * forward slashes; the array is omitted when empty. The same list is
  * repeated on each top-level command's envelope so single-command
@@ -2924,6 +3138,10 @@ unused_types: number
  * Public exports whose signature references same-file private types.
  */
 private_type_leaks: number
+/**
+ * Exports marked `@deprecated` that are still referenced.
+ */
+deprecated_exports_in_use: number
 /**
  * Combined count of unused entries across `dependencies`,
  * `devDependencies`, and `optionalDependencies`. The per-section
@@ -3105,6 +3323,13 @@ actions: IssueAction[]
  * the merge-base. `None` when serialized directly from Rust.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the reachability verdict behind this finding.
  * Sorted, deduplicated, and omitted from the wire when empty, so a run
@@ -3308,6 +3533,17 @@ span_start: number
  * Whether this finding comes from a barrel/index re-export rather than the source definition.
  */
 is_re_export: boolean
+/**
+ * Whether the export's leading JSDoc carries `@deprecated`. Absent from
+ * the wire when false.
+ */
+deprecated?: boolean
+/**
+ * Plain-text message of the `@deprecated` tag, capped at
+ * [`DEPRECATED_REASON_MAX_CHARS`] characters. Absent when the export is
+ * not deprecated or the tag carries no text.
+ */
+deprecated_reason?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3322,6 +3558,13 @@ semantic?: (SemanticCandidateDecision | null)
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the reachability verdict behind this finding.
  * Sorted, deduplicated, and omitted from the wire when empty. Never gates
@@ -3365,6 +3608,17 @@ span_start: number
  * Whether this finding comes from a barrel/index re-export rather than the source definition.
  */
 is_re_export: boolean
+/**
+ * Whether the export's leading JSDoc carries `@deprecated`. Absent from
+ * the wire when false.
+ */
+deprecated?: boolean
+/**
+ * Plain-text message of the `@deprecated` tag, capped at
+ * [`DEPRECATED_REASON_MAX_CHARS`] characters. Absent when the export is
+ * not deprecated or the tag carries no text.
+ */
+deprecated_reason?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3379,6 +3633,13 @@ semantic?: (SemanticCandidateDecision | null)
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the reachability verdict behind this finding.
  * A type export rests on exactly the reachability test an
@@ -3433,6 +3694,103 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
+}
+/**
+ * Wire-shape envelope for a [`DeprecatedExportInUse`] finding. Carries a
+ * manual `migrate-deprecated-export` primary action plus a `suppress-line`
+ * secondary. Never auto-fixable: fallow does not rewrite consumers.
+ */
+export interface DeprecatedExportInUseFinding {
+/**
+ * File that declares the deprecated export.
+ */
+path: string
+/**
+ * Name of the deprecated export.
+ */
+export_name: string
+/**
+ * Whether this is a type-only export.
+ */
+is_type_only: boolean
+/**
+ * 1-based line number of the export.
+ */
+line: number
+/**
+ * 0-based byte column offset of the export.
+ */
+col: number
+/**
+ * Byte offset of the export in the source file.
+ */
+span_start: number
+/**
+ * Plain-text message of the `@deprecated` tag, capped at
+ * [`DEPRECATED_REASON_MAX_CHARS`] characters. Absent when the tag
+ * carries no text.
+ */
+deprecated_reason?: (string | null)
+/**
+ * Exact number of distinct consumers: reference sites in reachable
+ * files, one per path, line, column and kind. `consumers` holds the
+ * first [`DEPRECATED_CONSUMER_SAMPLE_CAP`] of them, so the sample is
+ * complete when this count is at most the cap.
+ */
+consumer_count: number
+/**
+ * Consumer sample sorted by path, line, column and kind, capped at
+ * [`DEPRECATED_CONSUMER_SAMPLE_CAP`] entries.
+ */
+consumers: DeprecatedExportConsumer[]
+/**
+ * True when the export is part of the public API: it lives in an entry
+ * point, or a re-export chain reaches an entry point. External consumers
+ * are not visible, so the finding makes no removal claim.
+ */
+public_api: boolean
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
+}
+/**
+ * One file location that references a deprecated export.
+ */
+export interface DeprecatedExportConsumer {
+/**
+ * File that references the deprecated export.
+ */
+path: string
+/**
+ * 1-based line number of the import or re-export statement.
+ */
+line: number
+/**
+ * 0-based byte column offset of the import or re-export statement.
+ */
+col: number
+kind: DeprecatedConsumerKind
 }
 /**
  * Wire-shape envelope for an [`UnusedDependency`] finding consumed under
@@ -3470,6 +3828,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A dependency is
  * reported unused when NO module in the project imports its specifier,
@@ -3516,6 +3881,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A dependency is
  * reported unused when NO module in the project imports its specifier,
@@ -3562,6 +3934,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A dependency is
  * reported unused when NO module in the project imports its specifier,
@@ -3608,6 +3987,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A member's usage
  * is collected by walking the member accesses of every module the run
@@ -3660,6 +4046,13 @@ semantic?: (SemanticCandidateDecision | null)
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A class member's
  * usage is collected by the same reachability-free member-access walk an
@@ -3713,6 +4106,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A store member's
  * usage is collected by the same reachability-free member-access walk a
@@ -3763,6 +4163,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnlistedDependency`] finding. Carries an
@@ -3789,6 +4196,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * A location where an import occurs.
@@ -3839,6 +4253,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * A location where a duplicate export appears.
@@ -3885,6 +4306,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`TestOnlyDependency`] finding. Carries a
@@ -3915,6 +4343,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`DevDependencyInProduction`] finding. Carries a
@@ -3946,6 +4381,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`CircularDependency`] finding. Mirrors
@@ -3993,6 +4435,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * One import hop in a circular dependency: the file containing the import
@@ -4048,6 +4497,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`BoundaryViolation`] finding. Mirrors
@@ -4094,6 +4550,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`BoundaryCoverageViolation`] finding. Carries
@@ -4122,6 +4585,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`BoundaryCallViolation`] finding. Carries
@@ -4163,6 +4633,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`PolicyViolation`] finding. Carries actions for
@@ -4240,6 +4717,13 @@ missing_reason?: boolean
  * Suggested next steps. Always emitted.
  */
 actions: IssueAction[]
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedCatalogEntry`] finding. Per-instance
@@ -4280,6 +4764,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`EmptyCatalogGroup`] finding. Carries a
@@ -4308,6 +4799,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnresolvedCatalogReference`] finding. The
@@ -4358,6 +4856,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedDependencyOverride`] finding. Carries
@@ -4420,6 +4925,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`MisconfiguredDependencyOverride`] finding.
@@ -4469,6 +4981,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`InvalidClientExport`] finding. There is no safe
@@ -4510,6 +5029,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`MixedClientServerBarrel`] finding. There is no
@@ -4551,6 +5077,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`MisplacedDirective`] finding. There is no safe
@@ -4587,6 +5120,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnprovidedInject`] finding. There is no safe
@@ -4625,6 +5165,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnrenderedComponent`] finding. There is no safe
@@ -4674,6 +5221,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`RouteCollision`] finding. A route collision is a
@@ -4716,6 +5270,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`DynamicSegmentNameConflict`] finding. The
@@ -4762,6 +5323,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentProp`] finding. There is no safe
@@ -4800,6 +5368,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentEmit`] finding. There is no safe
@@ -4838,6 +5413,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentInput`] finding. There is no safe
@@ -4876,6 +5458,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentOutput`] finding. There is no safe
@@ -4914,6 +5503,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedSvelteEvent`] finding. There is no safe
@@ -4953,6 +5549,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedServerAction`] finding. There is no safe
@@ -4987,6 +5590,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedLoadDataKey`] finding. There is no safe
@@ -5027,6 +5637,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`PropDrillingChain`] finding. There is no safe
@@ -5061,6 +5678,14 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Rule severity of this finding. This type never gates the run, so the
+ * value does not change the exit code. `fallow report --from` reads it
+ * for the SARIF level, so the level does not depend on the config at
+ * render time. Absent in output from older versions. Not part of the
+ * finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * One hop in a prop-drilling chain: a component that received the prop and
@@ -5118,6 +5743,14 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Rule severity of this finding. This type never gates the run, so the
+ * value does not change the exit code. `fallow report --from` reads it
+ * for the SARIF level, so the level does not depend on the config at
+ * render time. Absent in output from older versions. Not part of the
+ * finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`DuplicatePropShape`] finding. There is no safe
@@ -5168,6 +5801,14 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Rule severity of this finding. This type never gates the run, so the
+ * value does not change the exit code. `fallow report --from` reads it
+ * for the SARIF level, so the level does not depend on the config at
+ * render time. Absent in output from older versions. Not part of the
+ * finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * One member of a duplicate-prop-shape group: the OTHER components that share
@@ -5289,7 +5930,8 @@ current_findings: number
  * differ per command and include a diff, a base ref, `--changed-since`,
  * `--workspace`, `--changed-workspaces`, `--scope`, `--file`, an
  * issue-type filter, and production mode. Both `stale` and `gate_trips`
- * are false whenever this is true.
+ * are false whenever this is true. `scope_reasons` names the channels
+ * that fired.
  */
 change_scoped: boolean
 /**
@@ -5301,13 +5943,21 @@ change_scoped: boolean
 stale: boolean
 warning: BaselineStalenessAdvisory
 /**
- * True exactly when
- * `!change_scoped && baseline_entries > 0 && matched_entries < baseline_entries`,
- * which is the rule `--fail-on-stale-baseline` applies. Deliberately
- * stricter than `stale`: any unmatched entry counts. It describes the
- * baseline, not the run's exit code: `health --report-only` is an explicit
- * request never to fail, so that run exits 0 and says so on stderr while
- * still reporting `gate_trips: true` here.
+ * True exactly when `unrecognised_format` is true, or
+ * `!change_scoped && baseline_entries > 0 && matched_entries < baseline_entries`.
+ * That is the rule `--fail-on-stale-baseline` applies. Deliberately
+ * stricter than `stale`: any unmatched entry counts, and so does a file
+ * this command could not read as its own, which protects nothing at all.
+ * The second half is suppressed by `change_scoped` and the first is not:
+ * which command wrote a file does not depend on how much of the project
+ * the run looked at.
+ *
+ * It describes the baseline, not the run's exit code: `health
+ * --report-only` is an explicit request never to fail, so that run exits 0
+ * and says so on stderr while still reporting `gate_trips: true` here, and
+ * `fallow audit` never judges a baseline at all, so its
+ * `gate_outcomes["stale-baseline"]` stands down beside a section that
+ * reports `true`.
  */
 gate_trips: boolean
 /**
@@ -5317,6 +5967,50 @@ gate_trips: boolean
  * `0`. Always `0` in health's count mode too.
  */
 moved_entries: number
+/**
+ * True when the loaded file is not a baseline of the command that read it:
+ * it names another command in its top-level `kind`, or it names none and
+ * carries no key this command's own format writes. Read this, not
+ * `baseline_entries == 0`, before telling anyone their baseline is the
+ * wrong file: a baseline saved from a project that had nothing to record
+ * is legitimately empty and is not a mistake.
+ *
+ * Present only when true, so an envelope from a run that loaded its own
+ * baseline is unchanged. All three commands set it, including `dead-code`,
+ * which classifies the file before its required fields could reject it.
+ * A file with no `kind` is the reading a baseline saved before that member
+ * existed gets, which is why the keys remain the fallback.
+ */
+unrecognised_format?: boolean
+/**
+ * The command that saved the loaded file, when `unrecognised_format` is
+ * true and the file names a writer this version knows: `dead-code`,
+ * `dupes` or `health`, the token the file carries in its top-level `kind`.
+ *
+ * Absent, never null, for this command's own baseline, for a file that
+ * names no writer (an empty file, or a baseline saved before `kind`
+ * existed) and for a `kind` token this version does not know. The value
+ * set is OPEN: a later release can add a writer, so treat an unknown value
+ * as "another command". The CLI computes it once per loaded baseline and
+ * uses the same value for its stderr note.
+ */
+saved_by?: string
+/**
+ * Which channels narrowed this run, present and non-empty exactly when
+ * `change_scoped` is true. Both members are derived from one function, so
+ * the boolean and the array cannot disagree.
+ *
+ * Read it to decide whether the narrowing is removable: a run narrowed
+ * only by `diff`, `changed-since`, `changed-files`, `scope`, `file` or
+ * `issue-type-filter` can be repeated unscoped to judge the baseline,
+ * while `production`, `workspace` and `changed-workspaces` are the
+ * caller's own choice about what to analyze and an unscoped repeat would
+ * contradict it.
+ *
+ * The name set is OPEN and the names a command can emit differ per
+ * command; see [`ScopeReason`].
+ */
+scope_reasons?: ScopeReason[]
 }
 /**
  * Result of regression detection (`--fail-on-regression`). Compares current
@@ -5354,6 +6048,109 @@ exceeded: boolean
  */
 reason?: (string | null)
 }
+/**
+ * Every narrowing or shaping request a run RECEIVED, keyed by name.
+ *
+ * Received, not failed: a request the run honoured is published with
+ * `status: "applied"`, so a consumer can say "scoped to the change"
+ * positively. Read an absent object as "nothing was asked for", never as
+ * "nothing failed".
+ *
+ * Absent from an envelope whenever it is empty, so a run that was asked for
+ * nothing is byte-identical to one produced before this object existed. An
+ * empty object is never emitted: it would assert that something was asked and
+ * all of it applied, which is a different and false claim.
+ *
+ * The names this build can emit are `changed-since`, `diff-filter` and
+ * `sarif-file`. The reasons are `git-missing`, `not-a-repository`,
+ * `git-failed` and `invalid-ref` for `changed-since`, `oversize`,
+ * `unreadable`, `not-utf8`, `foreign-namespace` and `ambiguous-base` for
+ * `diff-filter`, and `directory-create-failed`, `write-failed` and
+ * `serialize-failed` for `sarif-file`. Every set is OPEN: a name a consumer
+ * does not recognise means "some request", not an error.
+ *
+ * `sarif-file` reports a SECONDARY artifact rather than the scope of the
+ * report it travels in, and it is in the same object for the same reason the
+ * others are: the run was asked to do something and did something else, and
+ * nothing in the primary report says so. Which of the two an entry is, every
+ * entry says for itself: `affects` is `scope` for the narrowing requests and
+ * `artifact` for this one. Select on it. A consumer that instead assumes the
+ * whole object narrows the report tells its reader an unwritten SARIF file
+ * widened the analysis, which is what `affects` exists to prevent.
+ *
+ * `scope_size` is emitted for `diff-filter`, in added lines, and for
+ * `changed-since`, in changed files that the run analyzed. `sarif-file`
+ * measures no scope. A consumer reads the unit off the name, so a name that
+ * starts to measure its own scope in a later release needs no change here.
+ *
+ * `invalid-ref` is reachable only through the programmatic API. The
+ * `--changed-since` flag validates its value before a run starts and fails
+ * with exit 2 and an error document, which is the right side to err on: a
+ * malformed ref is invalid input rather than a report of the wrong scope.
+ */
+export interface RequestOutcomes {
+[k: string]: RequestOutcome
+}
+/**
+ * One request's fate on one run.
+ *
+ * `reason` and `message` are present exactly when `status` is not `applied`,
+ * and absent otherwise, so a consumer that only wants to know whether a
+ * report is scoped reads `status` alone.
+ */
+export interface RequestOutcome {
+status: RequestStatus
+affects: RequestEffect
+/**
+ * What was asked, as the user spelled it: the git ref for
+ * `changed-since`, the diff source label (`--diff-file pr.diff`,
+ * `--diff-stdin`, `$FALLOW_DIFF_FILE build/pr.diff`, or
+ * `diffFile pr.diff` for the programmatic option) for `diff-filter`,
+ * the target path for `sarif-file`. Echoed rather than normalised, so a
+ * consumer must not join it to the project root the way it joins every
+ * other path-shaped field.
+ */
+requested: string
+/**
+ * How much this request left in scope, in the request's own unit, when the
+ * run applied it AND measured that scope. Absent otherwise, including on
+ * every unapplied entry: a request that stood down narrowed nothing, so a
+ * number there would describe a scope nobody applied.
+ *
+ * The unit belongs to the name. `diff-filter` counts added lines, which is
+ * what its filter keeps a finding for. `changed-since` counts changed
+ * files that the run analyzed: a changed file that discovery or an ignore
+ * rule dropped does not count, so a change to a README only gives `0`. A
+ * combined run counts a file that any of its analyses kept, because a
+ * per-analysis `production` setting can give its analyses different
+ * files.
+ * Read the unit off the name the entry is keyed under, never across names,
+ * and read an absent member as "not measured" rather than as zero.
+ *
+ * The count is what the run INDEXED rather than the true total:
+ * `diff-filter` indexes at most one million added lines and reports that
+ * cap for a larger diff, so read any non-zero value as a lower bound.
+ *
+ * `0` is the case this member exists for: a request that applied over an
+ * EMPTY scope. Every finding then filters out and the report reads clean,
+ * so a consumer that sees no findings beside `scope_size: 0` learns that
+ * nothing was analyzable rather than that the code is clean.
+ */
+scope_size?: (number | null)
+/**
+ * Why the request was not applied, as a kebab-case token. Present exactly
+ * when `status` is not `applied`. The set is open per request name; the
+ * names this build can emit are listed on [`RequestOutcomes`].
+ */
+reason?: (string | null)
+/**
+ * One sentence naming what was asked, what happened instead, and the next
+ * step. Byte-identical to the stderr line for the same case, so a
+ * consumer that renders this never contradicts a log a human read.
+ * Present exactly when `status` is not `applied`.
+ */
+message?: (string | null)
+}
 /**
  * A read-only follow-up command fallow surfaces from the current findings,
  * emitted as the top-level `next_steps` array on each command's JSON envelope.
@@ -5923,6 +6720,14 @@ react_prop_count?: number
 react_hook_profile?: (ReactHookProfile | null)
 exceeded: ExceededThreshold
 severity: FindingSeverity
+/**
+ * Gate severity after the `complexity-*` rules and their
+ * `overrides[].rules` entries: `error` fails the run, `warn` does not.
+ * The most severe rule of the kinds in `exceeded` wins. It is separate
+ * from the band in `severity`, which ranks the finding and does not gate
+ * it. Absent in reports from older versions.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * CRAP score (change risk anti-pattern), when coverage data exists.
  */
@@ -6229,6 +7034,11 @@ average_maintainability?: (number | null)
  * Coverage model behind the CRAP scores, when coverage was used.
  */
 coverage_model?: (CoverageModel | null)
+/**
+ * Input format of the measured coverage (`istanbul` or `v8`). Present
+ * only with `coverage_model: "istanbul"`.
+ */
+coverage_input_format?: (CoverageInputFormat | null)
 /**
  * Whether CRAP findings mix coverage sources.
  */
@@ -7232,8 +8042,8 @@ watermark?: (RuntimeCoverageWatermark | null)
  */
 warnings?: RuntimeCoverageMessage[]
 /**
- * Whether an autonomous agent may act on this report (fallow-rs/fallow-cloud#316,
- * mirrors the cloud runtime-context contract). `false` when the capture
+ * Whether an autonomous agent may act on this report (mirrors
+ * the cloud runtime-context contract). `false` when the capture
  * carries no usable runtime evidence (no tracked functions); then
  * `actionability_verdict` is `insufficient_evidence` and
  * `actionability_reason` explains. F4: a non-action floor, never a gate on a
@@ -7463,7 +8273,7 @@ description: string
 auto_fixable: boolean
 }
 /**
- * Discriminator inputs that PRODUCED a finding's verdict (fallow-rs/fallow-cloud#321),
+ * Discriminator inputs that PRODUCED a finding's verdict,
  * emitted alongside the verdict so an agent can reproduce it and see the
  * minimum-observation confidence cap instead of re-deriving them from scratch.
  * F4: these make the EXISTING Fallow-owned discriminators legible; they are not
@@ -7659,7 +8469,7 @@ code: string
 message: string
 }
 /**
- * Provenance of a runtime-coverage report (fallow-rs/fallow-cloud#319), mirroring
+ * Provenance of a runtime-coverage report, mirroring
  * the cloud runtime-context `provenance` block so the local-capture and cloud
  * surfaces present one portable shape. F4: provenance is context only; it never
  * gates a verdict or confidence.
@@ -9859,6 +10669,12 @@ imported_by: string[]
  * Re-exports declared by this file.
  */
 re_exports: TracedReExport[]
+/**
+ * The configs that make this file an entry point through Module
+ * Federation `exposes`, one per config. Absent when no Federation config
+ * exposes the file (issue #2796).
+ */
+sources?: TraceSource[]
 }
 /**
  * An export with usage information.
@@ -9898,6 +10714,37 @@ imported_name: string
  */
 exported_name: string
 }
+/**
+ * A config that names a traced file or a traced dependency, and the key that
+ * names it.
+ */
+export interface TraceSource {
+/**
+ * The mechanism that names the file or the dependency:
+ * `module-federation`. The set is open.
+ */
+kind: string
+/**
+ * The plugin that read the config, as it labels itself:
+ * `module-federation` for a standalone `module-federation.config.*`,
+ * or the bundler plugin (`webpack`, `rspack`, `rsbuild`, `vite`,
+ * `nextjs`) that read the same options inline from its own config.
+ */
+plugin: string
+/**
+ * The file that names the file or the dependency, relative to the
+ * project root: the config file, or the source file of a Module
+ * Federation runtime call.
+ */
+config: string
+/**
+ * The config key or the runtime function that names the file or the
+ * dependency: `exposes` for an exposed file, `remotes` for a remote
+ * alias, and `registerRemotes`, `loadRemote`, `init` or `createInstance`
+ * for a remote that a runtime call names. The set is open.
+ */
+key: string
+}
 /**
  * Result of tracing a dependency: where it is used.
  */
@@ -9926,6 +10773,13 @@ is_used: boolean
  * Total import count.
  */
 import_count: number
+/**
+ * The configs that declare this name as a Module Federation remote alias
+ * under `remotes`, one per config. A remote alias is provided by a
+ * remote container at runtime, not by an npm package. Absent when no
+ * Federation config declares the name (issue #2796).
+ */
+sources?: TraceSource[]
 }
 /**
  * Result of tracing a clone: all groups containing the code at a source
@@ -11018,15 +11872,25 @@ grouped_by?: (GroupByMode | null)
  */
 groups?: (HealthGroup[] | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
+/**
+ * Every narrowing or shaping request this run RECEIVED, keyed by name,
+ * absent when it was asked for nothing. An entry whose `status` is not
+ * `applied` means the run could not do what it was asked and reported
+ * something WIDER instead, so what follows is a valid report of a scope
+ * nobody requested. Honoured requests are published too, with
+ * `status: "applied"`, so an absent object means "nothing was asked for",
+ * never "nothing failed". See [`crate::RequestOutcomes`].
+ */
+request_outcomes?: (RequestOutcomes | null)
 /**
  * `_meta` block with metric definitions, when `--explain` was passed.
  */
@@ -11211,15 +12075,23 @@ groups?: (DuplicationGroup[] | null)
  */
 baseline_staleness?: (BaselineStaleness | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run armed, keyed by name, absent when
+ * it armed none. `dupes` has no default exit rule: a run with no armed
+ * gate always exits 0, so an absent object means that the run passed. A
+ * gate fails the build when `status` is `fail` AND `enforced` is true.
+ * See [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
+/**
+ * Every narrowing or shaping request this run RECEIVED, keyed by name,
+ * absent when it was asked for nothing. An entry whose `status` is not
+ * `applied` means the run could not do what it was asked and reported
+ * something WIDER instead, so what follows is a valid report of a scope
+ * nobody requested. Honoured requests are published too, with
+ * `status: "applied"`, so an absent object means "nothing was asked for",
+ * never "nothing failed". See [`crate::RequestOutcomes`].
+ */
+request_outcomes?: (RequestOutcomes | null)
 /**
  * `_meta` block with metric / rule definitions, emitted when `--explain`
  * is passed (always present in MCP responses).
@@ -11388,15 +12260,25 @@ groups: CheckGroupedEntry[]
  */
 baseline_staleness?: (BaselineStaleness | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
+/**
+ * Every narrowing or shaping request this run RECEIVED, keyed by name,
+ * absent when it was asked for nothing. An entry whose `status` is not
+ * `applied` means the run could not do what it was asked and reported
+ * something WIDER instead, so what follows is a valid report of a scope
+ * nobody requested. Honoured requests are published too, with
+ * `status: "applied"`, so an absent object means "nothing was asked for",
+ * never "nothing failed". See [`crate::RequestOutcomes`].
+ */
+request_outcomes?: (RequestOutcomes | null)
 /**
  * `_meta` block with docs and rule definitions, when `--explain` was
  * passed.
@@ -11456,6 +12338,12 @@ unused_types: UnusedTypeFinding[]
  * typed `actions` array natively.
  */
 private_type_leaks: PrivateTypeLeakFinding[]
+/**
+ * Exports marked `@deprecated` that still have at least one consumer in
+ * a reachable file. Wrapped in [`DeprecatedExportInUseFinding`]. Opt-in: the
+ * `deprecated-exports-in-use` rule defaults to `off`.
+ */
+deprecated_exports_in_use?: DeprecatedExportInUseFinding[]
 /**
  * Dependencies listed in package.json but never imported. Wrapped in
  * [`UnusedDependencyFinding`] so each entry carries a typed `actions`
@@ -12067,15 +12955,25 @@ version: ToolVersion
 elapsed_ms: ElapsedMs
 config: SecurityOutputConfig
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
+/**
+ * Every narrowing or shaping request this run RECEIVED, keyed by name,
+ * absent when it was asked for nothing. An entry whose `status` is not
+ * `applied` means the run could not do what it was asked and reported
+ * something WIDER instead, so what follows is a valid report of a scope
+ * nobody requested. Honoured requests are published too, with
+ * `status: "applied"`, so an absent object means "nothing was asked for",
+ * never "nothing failed". See [`crate::RequestOutcomes`].
+ */
+request_outcomes?: (RequestOutcomes | null)
 /**
  * Security-specific rule and field metadata, emitted with `--explain`.
  */
@@ -12170,10 +13068,10 @@ new_count: number
 export interface SecurityFinding {
 /**
  * Stable per-finding correlation id, identical across runs for the same
- * rule + anchor path + line. An autonomous agent that triaged this
+ * rule + anchor path + line + column. An autonomous agent that triaged this
  * candidate on a prior run uses it to correlate the candidate after a
- * rebase. Equal to the SARIF `partialFingerprints` value for the same
- * finding (one shared helper computes both).
+ * rebase. Equal to the SARIF `partialFingerprints["fallowSecurity/v2"]`
+ * value for the same finding (one shared helper computes both).
  */
 finding_id: string
 kind: SecurityFindingKind
@@ -12591,7 +13489,8 @@ defensive_boundary: SecurityDefensiveBoundary
  */
 export interface SecurityDefensiveBoundary {
 /**
- * Known controls detected along this path.
+ * Control patterns observed in files on this import trace. These are
+ * verification hints, not proof of sink protection or value-level data flow.
  */
 controls: SecurityDefensiveControl[]
 /**
@@ -12601,7 +13500,9 @@ controls: SecurityDefensiveControl[]
 verification_prompt: string
 }
 /**
- * Defensive control found on an attack-surface path.
+ * Control pattern observed in a file on an attack-surface import trace.
+ * Its presence does not prove that it executes before the sink or protects
+ * the same input.
  */
 export interface SecurityDefensiveControl {
 kind: SecurityControlKind
@@ -12700,15 +13601,25 @@ version: ToolVersion
 elapsed_ms: ElapsedMs
 config: SecurityOutputConfig
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
+/**
+ * Every narrowing or shaping request this run RECEIVED, keyed by name,
+ * absent when it was asked for nothing. An entry whose `status` is not
+ * `applied` means the run could not do what it was asked and reported
+ * something WIDER instead, so what follows is a valid report of a scope
+ * nobody requested. Honoured requests are published too, with
+ * `status: "applied"`, so an absent object means "nothing was asked for",
+ * never "nothing failed". See [`crate::RequestOutcomes`].
+ */
+request_outcomes?: (RequestOutcomes | null)
 /**
  * Security-specific rule and field metadata, emitted with `--explain`.
  */
@@ -12993,15 +13904,29 @@ schema_version: CombinedSchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the default exit rule of each section that ran
+ * (`error-severity-findings`, `health-findings`). The machine formats of
+ * the combined run exit 0 for findings, so most entries have `enforced:
+ * false`. For the default exit rules (`error-severity-findings`,
+ * `health-findings`), `status` gives the verdict of the human run. An
+ * advisory entry can report `fail` without a failure of the human run: an
+ * example is a `stale-baseline` entry that `--fail-on-stale-baseline` did
+ * not arm. A gate fails the build when `status` is `fail` AND `enforced`
+ * is true. The typed
+ * programmatic API leaves it absent. See [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
+/**
+ * Every narrowing or shaping request this run RECEIVED, keyed by name,
+ * absent when it was asked for nothing. An entry whose `status` is not
+ * `applied` means the run could not do what it was asked and reported
+ * something WIDER instead, so what follows is a valid report of a scope
+ * nobody requested. Honoured requests are published too, with
+ * `status: "applied"`, so an absent object means "nothing was asked for",
+ * never "nothing failed". See [`crate::RequestOutcomes`].
+ */
+request_outcomes?: (RequestOutcomes | null)
 /**
  * Per-section `_meta` blocks, when `--explain` was passed.
  */
@@ -13013,7 +13938,7 @@ check?: (CheckOutput | null)
 /**
  * Duplication section of the combined run.
  */
-dupes?: (DupesReportPayload | null)
+dupes?: (CombinedDupesSection | null)
 /**
  * Health section of the combined run.
  */
@@ -13054,6 +13979,41 @@ health?: (Meta | null)
  */
 telemetry?: (TelemetryMeta | null)
 }
+/**
+ * Wire shape of the `dupes` section inside the bare combined envelope.
+ *
+ * The section is the standalone payload plus the view of the loaded
+ * duplication baseline. The standalone `dupes` envelope carries the same
+ * `baseline_staleness` key at its root.
+ */
+export interface CombinedDupesSection {
+/**
+ * All detected clone groups, each wrapped with typed actions.
+ */
+clone_groups: CloneGroupFinding[]
+/**
+ * Clone families, each wrapped with typed actions. Inner `groups`
+ * inside each `CloneFamilyFinding` are themselves wrapped as
+ * `CloneGroupFinding` entries carrying their own `actions[]` (and
+ * optional audit-mode `introduced` flag), so JSON-Schema strict
+ * consumers and TS consumers reading `clone_families[].groups[]` see
+ * the same shape as the top-level `clone_groups[]` array (preserves
+ * the issue #393 regression contract).
+ */
+clone_families: CloneFamilyFinding[]
+/**
+ * Mirrored directory pairs.
+ */
+mirrored_directories?: MirroredDirectory[]
+stats: DuplicationStats
+/**
+ * This run's view of the loaded duplication baseline, present only when
+ * `--dupes-baseline` loaded one. Read `change_scoped` before dividing
+ * `matched_entries` by `baseline_entries`: a narrowed run can report
+ * `matched_entries: 0` on a healthy baseline.
+ */
+baseline_staleness?: (BaselineStaleness | null)
+}
 /**
  * Envelope emitted by `fallow flags --format json`.
  */
@@ -13061,6 +14021,22 @@ export interface FeatureFlagsOutput {
 schema_version: FeatureFlagsSchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
+/**
+ * What the run was asked to narrow and whether it did. See
+ * [`crate::RequestOutcomes`] for the full contract.
+ *
+ * `fallow flags` accepts `--changed-since`, and an unresolvable ref widens
+ * the scan to the whole project rather than failing the run. Until this
+ * member existed the only account of that was a stderr line, which `--quiet`
+ * removes, so a flag inventory read as scoped to the change could silently
+ * be the whole project's (issue #2734).
+ *
+ * The command applies no diff filter, so the object carries the
+ * `changed-since` entry only. Omitted when the run was asked for nothing,
+ * which keeps a scan that passed no narrowing flag byte-identical and moves
+ * no `schema_version`.
+ */
+request_outcomes?: (RequestOutcomes | null)
 /**
  * Detected feature-flag findings.
  */
@@ -13283,6 +14259,11 @@ deltas: ReviewDeltas
  */
 weakening: WeakeningSignal[]
 routing: RoutingFacts
+/**
+ * Owner-group reach from the CODEOWNERS file. Absent when no CODEOWNERS
+ * file is found or the file cannot be read.
+ */
+ownership?: (OwnershipFacts | null)
 /**
  * Dead-code findings scoped to the audit changeset.
  */
@@ -13762,6 +14743,96 @@ expert: string[]
  */
 bus_factor_one?: boolean
 }
+/**
+ * How far a changeset reaches across CODEOWNERS owner groups.
+ *
+ * Computed from the CODEOWNERS file alone: no git history is read, so the
+ * section is present whenever a CODEOWNERS file is found, also when the churn
+ * walk behind `routing` finds nothing. Each file maps to its primary owner
+ * (the first owner of the last matching rule). A file that no rule matches,
+ * or that a GitLab negation rule matches, belongs to the `(unowned)` group.
+ * The owner strings use the same vocabulary as `routing.units[].expert`.
+ *
+ * Absent from the brief when no CODEOWNERS file is found, or when the file
+ * cannot be read or does not parse. A configured `codeowners` path that
+ * fails also prints a warning on stderr.
+ *
+ * `groups[].direct_count` counts all changed files, source or not, so the
+ * sum over all groups is the number of changed files, not the size of
+ * `impact_closure.in_diff`. Slice owners count only the files of the
+ * partition units, which are source files.
+ */
+export interface OwnershipFacts {
+/**
+ * Distinct owner groups across the changed files and the impact closure.
+ * The `(unowned)` group counts as one group. Exact, never capped.
+ */
+group_count: number
+/**
+ * Owner groups that own no changed file and appear only through the
+ * impact closure. Exact, never capped.
+ */
+transitive_only_count: number
+/**
+ * Changed files that belong to the `(unowned)` group.
+ */
+unowned_direct_count: number
+/**
+ * The owner groups, sorted by `direct_count` descending, then
+ * `affected_count` descending, then `owner`. At most [`OWNER_GROUP_CAP`]
+ * entries. The counts in each entry are exact.
+ */
+groups: OwnerGroupFact[]
+/**
+ * How many owner groups did not fit within [`OWNER_GROUP_CAP`] and are
+ * absent from `groups`. Zero when nothing was omitted.
+ */
+groups_omitted: number
+/**
+ * The owner set of each independent slice, aligned by index with
+ * `partition.independent_slices`. Present only when that list is present
+ * (two or more slices). A fact for the reviewer, never a demand to split.
+ */
+slices?: OwnershipSliceFact[]
+}
+/**
+ * One owner group and how many files of the changeset it owns.
+ */
+export interface OwnerGroupFact {
+/**
+ * The CODEOWNERS owner (`@user`, `@org/team`, or an email), or
+ * `(unowned)`.
+ */
+owner: string
+/**
+ * Changed files this group owns.
+ */
+direct_count: number
+/**
+ * Files of the impact closure (affected, not in the diff) this group owns.
+ */
+affected_count: number
+}
+/**
+ * The owners of one independent slice of the partition.
+ */
+export interface OwnershipSliceFact {
+/**
+ * The module directories of the slice, as in
+ * `partition.independent_slices`.
+ */
+module_dirs: string[]
+/**
+ * The distinct owners of the changed files in the slice, sorted. The
+ * `(unowned)` group is a distinct owner. Never empty.
+ */
+owners: string[]
+/**
+ * True when the slice has exactly one owner, so one owner group can
+ * review it on its own.
+ */
+separable: boolean
+}
 /**
  * The brief's branching section.
  */
@@ -14141,6 +15212,12 @@ deltas: ReviewDeltas
  */
 weakening: WeakeningSignal[]
 routing: RoutingFacts
+/**
+ * How far the change reaches across CODEOWNERS owner groups, computed
+ * from the CODEOWNERS file alone. Absent when no CODEOWNERS file is
+ * found or the file cannot be read.
+ */
+ownership?: (OwnershipFacts | null)
 decisions: DecisionSurface
 /**
  * Branching conservation across the changeset: total branching against
@@ -14397,6 +15474,22 @@ invalid_value?: (string | null)
  */
 export interface SuppressionInventoryOutput {
 schema_version: SuppressionInventorySchemaVersion
+/**
+ * What the run was asked to narrow and whether it did. See
+ * [`crate::RequestOutcomes`] for the full contract.
+ *
+ * `fallow suppressions` accepts `--changed-since`, and an unresolvable ref
+ * widens the inventory to the whole project rather than failing the run.
+ * Until this member existed the only account of that was a stderr line,
+ * which `--quiet` removes, so an inventory read as scoped to the change
+ * could silently be the whole project's (issue #2734).
+ *
+ * The command applies no diff filter, so the object carries the
+ * `changed-since` entry only. Omitted when the run was asked for nothing,
+ * which keeps an inventory that passed no narrowing flag byte-identical and
+ * leaves `schema_version` at `1`.
+ */
+request_outcomes?: (RequestOutcomes | null)
 summary: SuppressionInventorySummary
 /**
  * Per-file suppression listings, sorted by path then line.
@@ -15372,6 +16465,16 @@ export type BoundaryViolation = BoundaryViolationFinding;
  */
 export type CircularDependency = CircularDependencyFinding;
 
+/**
+ * Backwards-compat alias for the pre-#384 bare `DeprecatedExportInUse` name.
+ * The wire shape is byte-identical: `DeprecatedExportInUseFinding` flattens the bare
+ * finding's fields via `#[serde(flatten)]` and adds `actions[]` plus
+ * the optional audit-mode `introduced` flag. Consumers that imported
+ * `DeprecatedExportInUse` from `fallow/types` pre-migration continue to work via
+ * this alias; new code should prefer `DeprecatedExportInUseFinding`.
+ */
+export type DeprecatedExportInUse = DeprecatedExportInUseFinding;
+
 /**
  * Backwards-compat alias for the pre-#384 bare `DevDependencyInProduction` name.
  * The wire shape is byte-identical: `DevDependencyInProductionFinding` flattens the bare