fallow 3.28.0 → 3.29.0

package/issue-registry.json

@@ -177,6 +177,43 @@
       "license_note": null,
       "docs_url": "https://docs.fallow.tools/explanations/dead-code#private-type-leaks"
     },
+    {
+      "id": "deprecated-export-in-use",
+      "rule_id": "fallow/deprecated-export-in-use",
+      "command": "dead-code",
+      "category": "Dead code",
+      "description": "Export marked @deprecated is still referenced",
+      "label": "Deprecated Exports in Use",
+      "config_key": "deprecated-exports-in-use",
+      "registry_index": 5,
+      "aliases": [],
+      "lsp": false,
+      "filter_flag": "--deprecated-exports-in-use",
+      "result_key": "deprecated_exports_in_use",
+      "summary_label": "Deprecated exports in use",
+      "summary_docs_anchor": "deprecated-exports-in-use",
+      "sarif_rule_ids": [
+        "fallow/deprecated-export-in-use"
+      ],
+      "codeclimate_check_names": [
+        "fallow/deprecated-export-in-use"
+      ],
+      "ts_alias": {
+        "name": "DeprecatedExportInUse",
+        "parent": "DeprecatedExportInUseFinding"
+      },
+      "counts_in_total": true,
+      "fixable": false,
+      "suppressible": true,
+      "suppress_comment": "// fallow-ignore-next-line deprecated-export-in-use",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
+      "note": "Opt-in migration sweep; the rule defaults to off",
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://docs.fallow.tools/explanations/dead-code#deprecated-exports-in-use"
+    },
     {
       "id": "unused-dependency",
       "rule_id": "fallow/unused-dependency",
@@ -185,7 +222,7 @@
       "description": "Dependency listed but never imported",
       "label": "Unused Dependencies",
       "config_key": "unused-dependencies",
-      "registry_index": 5,
+      "registry_index": 6,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-deps",
@@ -222,7 +259,7 @@
       "description": "Dev dependency listed but never imported",
       "label": "Unused Dev Dependencies",
       "config_key": "unused-dev-dependencies",
-      "registry_index": 6,
+      "registry_index": 7,
       "aliases": [
         "unused-dev-deps",
         "unused-dev-dependencies"
@@ -262,7 +299,7 @@
       "description": "Optional dependency listed but never imported",
       "label": "Unused Optional Dependencies",
       "config_key": "unused-optional-dependencies",
-      "registry_index": 7,
+      "registry_index": 8,
       "aliases": [
         "unused-optional-deps",
         "unused-optional-dependencies"
@@ -302,7 +339,7 @@
       "description": "Enum member is never referenced",
       "label": "Unused Enum Members",
       "config_key": "unused-enum-members",
-      "registry_index": 8,
+      "registry_index": 9,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-enum-members",
@@ -339,7 +376,7 @@
       "description": "Class member is never referenced",
       "label": "Unused Class Members",
       "config_key": "unused-class-members",
-      "registry_index": 9,
+      "registry_index": 10,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-class-members",
@@ -376,7 +413,7 @@
       "description": "Store member is never accessed by any consumer",
       "label": "Unused Store Members",
       "config_key": "unused-store-members",
-      "registry_index": 10,
+      "registry_index": 11,
       "aliases": [
         "unused-store-members"
       ],
@@ -415,7 +452,7 @@
       "description": "Import could not be resolved",
       "label": "Unresolved Imports",
       "config_key": "unresolved-imports",
-      "registry_index": 11,
+      "registry_index": 12,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unresolved-imports",
@@ -452,7 +489,7 @@
       "description": "Dependency used but not in package.json",
       "label": "Unlisted Dependencies",
       "config_key": "unlisted-dependencies",
-      "registry_index": 12,
+      "registry_index": 13,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unlisted-deps",
@@ -489,7 +526,7 @@
       "description": "Export name appears in multiple modules",
       "label": "Duplicate Exports",
       "config_key": "duplicate-exports",
-      "registry_index": 13,
+      "registry_index": 14,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--duplicate-exports",
@@ -526,7 +563,7 @@
       "description": "Production dependency only used via type-only imports",
       "label": "Type-Only Dependencies",
       "config_key": "type-only-dependencies",
-      "registry_index": 14,
+      "registry_index": 15,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-deps",
@@ -563,7 +600,7 @@
       "description": "Production dependency only imported by test files",
       "label": "Test-Only Dependencies",
       "config_key": "test-only-dependencies",
-      "registry_index": 15,
+      "registry_index": 16,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-deps",
@@ -600,7 +637,7 @@
       "description": "devDependency imported by production code with a runtime import",
       "label": "Dev Dependencies Used in Production",
       "config_key": "dev-dependencies-in-production",
-      "registry_index": 16,
+      "registry_index": 17,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--unused-deps",
@@ -637,7 +674,7 @@
       "description": "Circular dependency chain detected",
       "label": "Circular Dependencies",
       "config_key": "circular-dependencies",
-      "registry_index": 17,
+      "registry_index": 18,
       "aliases": [
         "circular-dependencies"
       ],
@@ -676,7 +713,7 @@
       "description": "Two or more barrel files re-export from each other in a loop",
       "label": "Re-Export Cycles",
       "config_key": "re-export-cycle",
-      "registry_index": 18,
+      "registry_index": 19,
       "aliases": [
         "re-export-cycles",
         "reexport-cycle",
@@ -717,7 +754,7 @@
       "description": "Import crosses a configured architecture boundary",
       "label": "Boundary Violations",
       "config_key": "boundary-violation",
-      "registry_index": 19,
+      "registry_index": 20,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--boundary-violations",
@@ -754,7 +791,7 @@
       "description": "Source file matches no configured architecture boundary zone",
       "label": "Boundary Coverage",
       "config_key": "boundary-violation",
-      "registry_index": 20,
+      "registry_index": 21,
       "aliases": [
         "boundary-coverage-violations"
       ],
@@ -790,7 +827,7 @@
       "description": "Zoned file calls a callee its zone forbids",
       "label": "Boundary Call Violations",
       "config_key": "boundary-violation",
-      "registry_index": 21,
+      "registry_index": 22,
       "aliases": [
         "boundary-calls",
         "boundary-call-violations"
@@ -827,7 +864,7 @@
       "description": "Banned usage matched a rule-pack rule",
       "label": "Policy Violations",
       "config_key": "policy-violation",
-      "registry_index": 22,
+      "registry_index": 23,
       "aliases": [
         "policy-violations"
       ],
@@ -863,7 +900,7 @@
       "description": "\"use client\" file exports a server-only / route-config name",
       "label": "Invalid Client Exports",
       "config_key": "invalid-client-export",
-      "registry_index": 23,
+      "registry_index": 24,
       "aliases": [
         "invalid-client-exports"
       ],
@@ -901,7 +938,7 @@
       "description": "Barrel re-exports both a \"use client\" module and a server-only module",
       "label": "Mixed Client/Server Barrels",
       "config_key": "mixed-client-server-barrel",
-      "registry_index": 24,
+      "registry_index": 25,
       "aliases": [
         "mixed-client-server-barrels"
       ],
@@ -937,7 +974,7 @@
       "description": "\"use client\" / \"use server\" directive is not in the leading position and is ignored",
       "label": "Misplaced Directives",
       "config_key": "misplaced-directive",
-      "registry_index": 25,
+      "registry_index": 26,
       "aliases": [
         "misplaced-directives"
       ],
@@ -973,7 +1010,7 @@
       "description": "inject() / getContext() reads a key that no provide() / setContext() supplies",
       "label": "Unprovided Injects",
       "config_key": "unprovided-injects",
-      "registry_index": 26,
+      "registry_index": 27,
       "aliases": [
         "unprovided-injects"
       ],
@@ -1009,7 +1046,7 @@
       "description": "A Vue / Svelte component is reachable through a barrel but rendered nowhere",
       "label": "Unrendered Components",
       "config_key": "unrendered-components",
-      "registry_index": 27,
+      "registry_index": 28,
       "aliases": [
         "unrendered-components"
       ],
@@ -1045,7 +1082,7 @@
       "description": "A Vue, Svelte, or React component prop is referenced nowhere in its own component",
       "label": "Unused Component Props",
       "config_key": "unused-component-props",
-      "registry_index": 28,
+      "registry_index": 29,
       "aliases": [
         "unused-component-props"
       ],
@@ -1081,7 +1118,7 @@
       "description": "A Vue <script setup> defineEmits event is emitted nowhere in its own component",
       "label": "Unused Component Emits",
       "config_key": "unused-component-emits",
-      "registry_index": 29,
+      "registry_index": 30,
       "aliases": [
         "unused-component-emits"
       ],
@@ -1117,7 +1154,7 @@
       "description": "An Angular @Input() / signal input() / model() input is read nowhere in its own component",
       "label": "Unused Component Inputs",
       "config_key": "unused-component-inputs",
-      "registry_index": 30,
+      "registry_index": 31,
       "aliases": [
         "unused-component-inputs"
       ],
@@ -1153,7 +1190,7 @@
       "description": "An Angular @Output() / signal output() output is emitted nowhere in its own component",
       "label": "Unused Component Outputs",
       "config_key": "unused-component-outputs",
-      "registry_index": 31,
+      "registry_index": 32,
       "aliases": [
         "unused-component-outputs"
       ],
@@ -1189,7 +1226,7 @@
       "description": "A Svelte component dispatches a createEventDispatcher event whose name is listened to nowhere in the project",
       "label": "Unused Svelte Events",
       "config_key": "unused-svelte-events",
-      "registry_index": 32,
+      "registry_index": 33,
       "aliases": [
         "unused-svelte-events"
       ],
@@ -1225,7 +1262,7 @@
       "description": "A Next.js Server Action exported from a \"use server\" file is referenced by no code in the project",
       "label": "Unused Server Actions",
       "config_key": "unused-server-actions",
-      "registry_index": 33,
+      "registry_index": 34,
       "aliases": [
         "unused-server-actions"
       ],
@@ -1261,7 +1298,7 @@
       "description": "A SvelteKit load() return-object key is read by no consumer",
       "label": "Unused Load Data Keys",
       "config_key": "unused-load-data-keys",
-      "registry_index": 34,
+      "registry_index": 35,
       "aliases": [
         "unused-load-data-keys"
       ],
@@ -1297,7 +1334,7 @@
       "description": "Two or more Next.js App Router route files resolve to the same URL",
       "label": "Route Collisions",
       "config_key": "route-collision",
-      "registry_index": 35,
+      "registry_index": 36,
       "aliases": [
         "route-collisions"
       ],
@@ -1335,7 +1372,7 @@
       "description": "Sibling Next.js dynamic route segments use different slug names at the same position",
       "label": "Dynamic Segment Conflicts",
       "config_key": "dynamic-segment-name-conflict",
-      "registry_index": 36,
+      "registry_index": 37,
       "aliases": [
         "dynamic-segment-name-conflicts"
       ],
@@ -1373,7 +1410,7 @@
       "description": "Suppression comment or tag no longer matches any issue",
       "label": "Stale Suppressions",
       "config_key": "stale-suppressions",
-      "registry_index": 37,
+      "registry_index": 38,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--stale-suppressions",
@@ -1409,7 +1446,7 @@
       "description": "Suppression comment omits a required reason",
       "label": "Missing Suppression Reasons",
       "config_key": "require-suppression-reason",
-      "registry_index": 38,
+      "registry_index": 39,
       "aliases": [
         "missing-suppression-reasons"
       ],
@@ -1441,7 +1478,7 @@
       "description": "Catalog entry not referenced by any workspace package",
       "label": "Unused Catalog Entries",
       "config_key": "unused-catalog-entries",
-      "registry_index": 39,
+      "registry_index": 40,
       "aliases": [
         "catalog",
         "unused-catalog-entries"
@@ -1481,7 +1518,7 @@
       "description": "Named catalog group has no entries",
       "label": "Empty Catalog Groups",
       "config_key": "empty-catalog-groups",
-      "registry_index": 40,
+      "registry_index": 41,
       "aliases": [
         "empty-catalog",
         "empty-catalog-groups"
@@ -1521,7 +1558,7 @@
       "description": "package.json references a catalog that does not declare the package",
       "label": "Unresolved Catalog References",
       "config_key": "unresolved-catalog-references",
-      "registry_index": 41,
+      "registry_index": 42,
       "aliases": [
         "unresolved-catalog",
         "unresolved-catalog-references"
@@ -1561,7 +1598,7 @@
       "description": "Package-manager override target is not declared or resolved",
       "label": "Unused Dependency Overrides",
       "config_key": "unused-dependency-overrides",
-      "registry_index": 42,
+      "registry_index": 43,
       "aliases": [
         "unused-dependency-overrides",
         "unused-override",
@@ -1602,7 +1639,7 @@
       "description": "Package-manager override has an unparsable key or value",
       "label": "Misconfigured Dependency Overrides",
       "config_key": "misconfigured-dependency-overrides",
-      "registry_index": 43,
+      "registry_index": 44,
       "aliases": [
         "misconfigured-dependency-overrides",
         "misconfigured-override",
@@ -1643,7 +1680,7 @@
       "description": "Detected feature flag pattern",
       "label": "Feature Flags",
       "config_key": "feature-flags",
-      "registry_index": 47,
+      "registry_index": 48,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1673,7 +1710,7 @@
       "description": "A React/Preact prop is forwarded unchanged through 3+ pass-through components to a distant consumer",
       "label": "Prop Drilling",
       "config_key": "prop-drilling",
-      "registry_index": 49,
+      "registry_index": 50,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1705,7 +1742,7 @@
       "description": "A React/Preact component whose whole body is a single spread-forwarded child render (a candidate for inlining)",
       "label": "Thin Wrappers",
       "config_key": "thin-wrapper",
-      "registry_index": 50,
+      "registry_index": 51,
       "aliases": [
         "thin-wrappers"
       ],
@@ -1739,7 +1776,7 @@
       "description": "Three or more React/Preact components across two or more files declare an identical prop-name set (a missing shared Props type)",
       "label": "Duplicate Prop Shapes",
       "config_key": "duplicate-prop-shape",
-      "registry_index": 51,
+      "registry_index": 52,
       "aliases": [
         "duplicate-prop-shapes"
       ],
@@ -1773,7 +1810,7 @@
       "description": "CSS or CSS-in-JS hardcoded styling value bypasses the design token system",
       "label": "CSS Token Drift",
       "config_key": "css-token-drift",
-      "registry_index": 52,
+      "registry_index": 53,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1803,7 +1840,7 @@
       "description": "CSS or CSS-in-JS declaration block is duplicated across rules",
       "label": "CSS Duplicate Block",
       "config_key": "css-duplicate-block",
-      "registry_index": 53,
+      "registry_index": 54,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1833,7 +1870,7 @@
       "description": "CSS selector, nesting, or important usage is structurally complex",
       "label": "CSS Selector Complexity",
       "config_key": "css-selector-complexity",
-      "registry_index": 54,
+      "registry_index": 55,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1863,7 +1900,7 @@
       "description": "CSS or CSS-in-JS surface appears unused",
       "label": "CSS Dead Surface",
       "config_key": "css-dead-surface",
-      "registry_index": 55,
+      "registry_index": 56,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1893,7 +1930,7 @@
       "description": "CSS or CSS-in-JS reference resolves to no stylesheet definition",
       "label": "CSS Broken Reference",
       "config_key": "css-broken-reference",
-      "registry_index": 56,
+      "registry_index": 57,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.28.0",
+  "version": "3.29.0",
   "mcpName": "io.github.fallow-rs/fallow",
   "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
   "license": "MIT",
@@ -88,14 +88,14 @@
     "@tanstack/intent": "0.4.0"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.28.0",
-    "@fallow-cli/darwin-x64": "3.28.0",
-    "@fallow-cli/linux-x64-gnu": "3.28.0",
-    "@fallow-cli/linux-arm64-gnu": "3.28.0",
-    "@fallow-cli/linux-x64-musl": "3.28.0",
-    "@fallow-cli/linux-arm64-musl": "3.28.0",
-    "@fallow-cli/win32-arm64-msvc": "3.28.0",
-    "@fallow-cli/win32-x64-msvc": "3.28.0",
-    "fallow-type-aware": "3.28.0"
+    "@fallow-cli/darwin-arm64": "3.29.0",
+    "@fallow-cli/darwin-x64": "3.29.0",
+    "@fallow-cli/linux-x64-gnu": "3.29.0",
+    "@fallow-cli/linux-arm64-gnu": "3.29.0",
+    "@fallow-cli/linux-x64-musl": "3.29.0",
+    "@fallow-cli/linux-arm64-musl": "3.29.0",
+    "@fallow-cli/win32-arm64-msvc": "3.29.0",
+    "@fallow-cli/win32-x64-msvc": "3.29.0",
+    "fallow-type-aware": "3.29.0"
   }
 }

package/schema.json

@@ -190,13 +190,14 @@
       "$ref": "#/$defs/TypeAwareConfig"
     },
     "rules": {
-      "description": "Sets per-issue-type severity, keyed by kebab-case rule id: `error` reports and fails CI (non-zero exit), `warn` reports without failing, `off` disables detection and reporting entirely (e.g. `{ \"unused-files\": \"error\", \"unused-exports\": \"warn\", \"private-type-leaks\": \"off\" }`). Set a rule `off` to silence it, `warn` to demote below CI gating, or `error` to promote a warn/off-default rule to gating; most rules default to `error`, dev/optional-dependency and component/store/inject/CSS/catalog rules default to `warn`, and opt-in rules (`private-type-leaks`, `security-*`, `prop-drilling`, `thin-wrapper`, `duplicate-prop-shape`, `coverage-gaps`, `feature-flags`, `require-suppression-reason`) default to `off`. Singular aliases (`unused-file`) and `warning`/`none` severity spellings are accepted.",
+      "description": "Sets per-issue-type severity, keyed by kebab-case rule id: `error` reports and fails CI (non-zero exit), `warn` reports without failing, `off` disables detection and reporting entirely (e.g. `{ \"unused-files\": \"error\", \"unused-exports\": \"warn\", \"private-type-leaks\": \"off\" }`). Set a rule `off` to silence it, `warn` to demote below CI gating, or `error` to promote a warn/off-default rule to gating; most rules default to `error`, dev/optional-dependency and component/store/inject/CSS/catalog rules default to `warn`, and opt-in rules (`private-type-leaks`, `deprecated-exports-in-use`, `security-*`, `prop-drilling`, `thin-wrapper`, `duplicate-prop-shape`, `coverage-gaps`, `feature-flags`, `require-suppression-reason`) default to `off`. Singular aliases (`unused-file`) and `warning`/`none` severity spellings are accepted.",
       "$ref": "#/$defs/RulesConfig",
       "default": {
         "unused-files": "error",
         "unused-exports": "error",
         "unused-types": "error",
         "private-type-leaks": "off",
+        "deprecated-exports-in-use": "off",
         "unused-dependencies": "error",
         "unused-dev-dependencies": "warn",
         "unused-optional-dependencies": "warn",
@@ -220,6 +221,9 @@
         "css-selector-complexity": "warn",
         "css-dead-surface": "warn",
         "css-broken-reference": "warn",
+        "complexity-cyclomatic": "error",
+        "complexity-cognitive": "error",
+        "complexity-crap": "error",
         "unresolved-imports": "error",
         "unlisted-dependencies": "error",
         "duplicate-exports": "error",
@@ -363,7 +367,12 @@
       "default": false
     },
     "autoImports": {
-      "description": "When true, drops Nuxt convention-based entry-pattern fallbacks so genuinely-unreferenced convention files surface as unused-file. Component fallbacks are kept when nuxt.config customizes components: in a way fallow does not model, and composable/util fallbacks are kept when it customizes imports:; a config that scans no more than the Nuxt defaults (components: false, components: [], components: { dirs: [] }, components: true, imports: { scan: false }, imports: {}, imports: { dirs: [] }) is treated like the default and its fallbacks are dropped; imports: { autoImport: false } on its own is not, because it only switches the injection off while the same directories stay registered behind #imports. A nuxt.config that carries any top-level key fallow cannot read statically, a computed key, an accessor, or a spread such as { ...base, devtools: {} }, keeps both surfaces' fallbacks for that root, because the spread may hold the keys that decide. Each root is classified on its own config, so one custom nuxt.config in a monorepo does not keep every other workspace's fallbacks. Component names follow Nuxt: a component under components/global or components/islands is named after its own directory (components/global/Foo.vue is `<Foo>`), and .client, .server, .global and .island suffixes are stripped. A name imported or re-exported by hand from #components or #imports credits its convention file just like a template tag or a bare call; a namespace import names nothing and credits nothing. Boolean, defaults to false; set it for a Nuxt project that has explicitly configured its auto-import directories. Synthesis of auto-import graph edges (resolving `<Card />` or `useUserStore()` to their convention files) happens regardless of this flag.",
+      "description": "When true, drops Nuxt convention-based entry-pattern fallbacks so genuinely-unreferenced convention files surface as unused-file. Component fallbacks are kept when nuxt.config customizes components: in a way fallow does not model, and composable/util fallbacks are kept when it customizes imports:; a config that scans no more than the Nuxt defaults (components: false, components: [], components: { dirs: [] }, components: true, imports: { scan: false }, imports: {}, imports: { dirs: [] }) is treated like the default and its fallbacks are dropped; imports: { autoImport: false } on its own is not, because it only switches the injection off while the same directories stay registered behind #imports. A nuxt.config that carries any top-level key fallow cannot read statically, a computed key, an accessor, or a spread such as { ...base, devtools: {} }, keeps both surfaces' fallbacks for that root, because the spread may hold the keys that decide. Only top-level keys count when the config object is readable: a nested key such as a routeRules path ending in components does not keep a fallback. Nested components or imports keys in $production, $development, $test or `$env.<name>`, and components or imports hooks (a components:* key or a nested components object in hooks, also inside those overrides), count as that surface's key; such an override object or hooks object that fallow cannot read statically falls back to a text match for the keys. Each root is classified on its own config plus the configs of its local layers, so one custom nuxt.config in a monorepo does not keep every other workspace's fallbacks. A local layer is a directory named in extends, or a `layers/<name>` directory, that holds a nuxt.config; its convention files are entry points with the flag off and auto-import sources with it on, and `#layers/<name>/` resolves to it by its $meta.name (a `layers/<name>` directory without one uses its directory name). A remote or package layer is only a dependency reference. Component names follow Nuxt: a component under components/global or components/islands is named after its own directory (components/global/Foo.vue is `<Foo>`), and .client, .server, .global and .island suffixes are stripped. A name imported or re-exported by hand from #components or #imports credits its convention file just like a template tag or a bare call; a namespace import names nothing and credits nothing. Boolean, defaults to false; set it for a Nuxt project that has explicitly configured its auto-import directories. Synthesis of auto-import graph edges (resolving `<Card />` or `useUserStore()` to their convention files) happens regardless of this flag.",
+      "type": "boolean",
+      "default": false
+    },
+    "failOnParseError": {
+      "description": "When true, the run fails with exit code 1 if fallow could not parse a source file cleanly (a `source-parse-degraded` entry in `workspace_diagnostics[]`), and the `parse-error` entry of `gate_outcomes` names each such file. Boolean, defaults to false, so a file the parser rejects only warns. Applies to `fallow dead-code`, `fallow health`, `fallow audit` and the bare `fallow` run; the CLI flag `--fail-on-parse-error` arms the same gate for one run. Older fallow versions reject this key as unknown, so pair it with `minimumVersion` set to the release that added it.",
       "type": "boolean",
       "default": false
     },
@@ -1055,7 +1064,7 @@
           "default": 15
         },
         "maxCrap": {
-          "description": "Maximum allowed CRAP (Change Risk Anti-Patterns) score per function\n(default: 30.0). CRAP combines cyclomatic complexity with test\ncoverage: high complexity plus low coverage produces a high CRAP\nscore. Functions meeting or exceeding this threshold are reported.\nUse `--coverage` with Istanbul data for accurate per-function CRAP;\notherwise fallow estimates coverage from the module graph. Governs\nfindings and the threshold-relative file-score signals\n(`crap_above_threshold`, the `risk` triage tag, and the\n`add_test_coverage` refactoring target); measured values such as\n`crap_max` and the overall health score never move with it. Set to\n`0` to disable CRAP enforcement entirely: no findings, nothing counts\nabove threshold, and file-score rows disclose baseline breaches as\nexempt instead.",
+          "description": "Maximum allowed CRAP (Change Risk Anti-Patterns) score per function\n(default: 30.0). CRAP combines cyclomatic complexity with test\ncoverage: high complexity plus low coverage produces a high CRAP\nscore. Functions meeting or exceeding this threshold are reported.\nUse `--coverage` with Istanbul data for accurate per-function CRAP;\notherwise fallow estimates coverage from the module graph. Governs\nfindings and the threshold-relative file-score signals\n(`crap_above_threshold`, the `risk` triage tag, and the\n`add_test_coverage` refactoring target); measured values such as\n`crap_max` and the overall health score never move with it. Set to\n`0` to disable CRAP enforcement entirely: no findings, nothing counts\nabove threshold, and file-score rows disclose baseline breaches as\nexempt instead. The `complexity-crap` rule is different: it decides if\na finding fails the run, and `off` hides the findings but keeps the\nfile-score signals.",
           "type": "number",
           "format": "double",
           "default": 30.0
@@ -1076,7 +1085,7 @@
           "default": 60
         },
         "coverage": {
-          "description": "Path to Istanbul-format coverage data for accurate per-function CRAP\nscores. Relative paths resolve against the project root. The CLI\n`--coverage` flag and `FALLOW_COVERAGE` environment variable override\nthis value. Consulted by `fallow health`, bare `fallow`, `fallow audit`,\n`fallow viz`, and the MCP `audit` / `check_health` tools.",
+          "description": "Path to Istanbul coverage data (coverage-final.json) or raw V8 coverage\n(a `NODE_V8_COVERAGE` directory or one V8 JSON file) for accurate\nper-function CRAP scores. Relative paths resolve against the project root. The CLI\n`--coverage` flag and `FALLOW_COVERAGE` environment variable override\nthis value. Consulted by `fallow health`, bare `fallow`, `fallow audit`,\n`fallow viz`, and the MCP `audit` / `check_health` tools.",
           "type": [
             "string",
             "null"
@@ -1310,6 +1319,11 @@
           "$ref": "#/$defs/Severity",
           "default": "off"
         },
+        "deprecated-exports-in-use": {
+          "description": "An export marked `@deprecated` that still has at least one reachable\nreference. Opt-in; defaults to `off`. A per-path override resolves on\nthe file that declares the export, not on the consumer.",
+          "$ref": "#/$defs/Severity",
+          "default": "off"
+        },
         "unused-dependencies": {
           "description": "A declared `dependencies` entry never observed used. Defaults to\n`error`.",
           "$ref": "#/$defs/Severity",
@@ -1425,6 +1439,21 @@
           "$ref": "#/$defs/Severity",
           "default": "warn"
         },
+        "complexity-cyclomatic": {
+          "description": "A function above the cyclomatic ceiling (`health.maxCyclomatic` or a\n`thresholdOverrides` entry). The threshold decides if the finding\nexists; this rule decides if it fails the run. Defaults to `error`.\n`warn` reports the finding without a failure, and `off` hides it. A\nfinding above several ceilings takes the most severe of their rules.\nThe rule applies before the `health --min-severity` band gate.\nAfter you set a kind to `off`, save the health baseline again: its\nentries for the hidden findings no longer match.",
+          "$ref": "#/$defs/Severity",
+          "default": "error"
+        },
+        "complexity-cognitive": {
+          "description": "A function above the cognitive ceiling (`health.maxCognitive` or a\n`thresholdOverrides` entry). The threshold decides if the finding\nexists; this rule decides if it fails the run. Defaults to `error`.",
+          "$ref": "#/$defs/Severity",
+          "default": "error"
+        },
+        "complexity-crap": {
+          "description": "A function above the CRAP ceiling (`health.maxCrap` or a\n`thresholdOverrides` entry). The threshold decides if the finding\nexists; this rule decides if it fails the run. Defaults to `error`.\n`off` hides the findings only. `health.maxCrap: 0` also turns off the\nthreshold-relative file-score signals.",
+          "$ref": "#/$defs/Severity",
+          "default": "error"
+        },
         "unresolved-imports": {
           "description": "An import specifier that resolves to no file or package. Defaults to\n`error`.",
           "$ref": "#/$defs/Severity",
@@ -2049,6 +2078,17 @@
             }
           ]
         },
+        "deprecated-exports-in-use": {
+          "description": "Optional override for [`RulesConfig::deprecated_exports_in_use`].",
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "unused-dependencies": {
           "description": "Optional override for [`RulesConfig::unused_dependencies`].",
           "anyOf": [
@@ -2302,6 +2342,39 @@
             }
           ]
         },
+        "complexity-cyclomatic": {
+          "description": "Optional override for [`RulesConfig::complexity_cyclomatic`].",
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "complexity-cognitive": {
+          "description": "Optional override for [`RulesConfig::complexity_cognitive`].",
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "complexity-crap": {
+          "description": "Optional override for [`RulesConfig::complexity_crap`].",
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "unresolved-imports": {
           "description": "Optional override for [`RulesConfig::unresolved_imports`].",
           "anyOf": [