fallow 3.28.0 → 3.29.0

package/types/output-contract.d.ts

@@ -261,7 +261,7 @@ export type IssueAction = (FixAction | SuppressLineAction | SuppressFileAction |
  * Discriminant string for [`FixAction`]. Kebab-case per the JSON output
  * contract.
  */
-export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
+export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "migrate-deprecated-export" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
 /**
  * Singleton discriminant for [`SuppressLineAction`].
  */
@@ -301,6 +301,27 @@ export type AddToConfigValue = (string | IgnoreExportsRule[] | {
  * hold `Option<AuditIntroduced>`. Renders to the JSON wire as a bare boolean.
  */
 export type AuditIntroduced = boolean
+/**
+ * Gate severity of one finding after rule resolution.
+ *
+ * It is the severity that `rules` and the matching `overrides[].rules` give
+ * the finding for its path. `--fail-on-issues` raises `warn` to `error`. A
+ * finding whose rule is `off` is not reported, so there is no `off` value.
+ * The type is separate from the health `severity` band, which ranks a
+ * finding and does not gate it.
+ *
+ * The `fallow dead-code` findings gate fails when a finding is `error`.
+ * Other gates (regression, stale baseline) decide on their own inputs. Two
+ * commands differ: the `fallow audit` `new-only` gate fails only on introduced
+ * findings, so an inherited `error` finding does not fail the audit, and the
+ * combined command (`fallow` without a subcommand) exits 0 for machine
+ * formats.
+ *
+ * Complexity findings carry the same type. The `complexity-cyclomatic`,
+ * `complexity-cognitive` and `complexity-crap` rules set it, and the
+ * `fallow health` findings gate and the audit verdict read it.
+ */
+export type EffectiveSeverity = ("error" | "warn")
 /**
  * A per-finding caveat on a dead-code verdict that a file this run never
  * fully analyzed can distort.
@@ -325,6 +346,10 @@ export type AuditIntroduced = boolean
  * caveat" rather than as an error.
  */
 export type ReachabilityCaveat = ("incomplete-file-analysis" | "incomplete-import-graph")
+/**
+ * How a consumer references a deprecated export.
+ */
+export type DeprecatedConsumerKind = ("named-import" | "default-import" | "namespace-import" | "re-export" | "dynamic-import" | "side-effect-import")
 /**
  * Where in package.json a dependency is listed.
  *
@@ -618,13 +643,15 @@ kind: "file-scores-unavailable"
 } | {
 /**
  * Which input stopped it, as a kebab-case token: `not-a-repository`,
- * `invalid-since` or `churn-file-unreadable`. The set is open.
+ * `no-commits`, `invalid-since` or `churn-file-unreadable`. The set is
+ * open.
  *
  * The cause decides the remedy, which is why it is on the wire: a run
  * outside a repository is fixed by running fallow inside one, a
- * malformed `--since` by respelling the flag, and a churn file that
- * changed under the run by rerunning it. A consumer reading only the
- * kind would offer the first remedy for all three.
+ * branch without a commit by committing, a malformed `--since` by
+ * respelling the flag, and a churn file that changed under the run by
+ * rerunning it. A consumer reading only the kind would offer the first
+ * remedy for all four.
  */
 cause: string
 kind: "hotspots-skipped"
@@ -664,13 +691,16 @@ kind: "trend-snapshot-unreadable"
 plugin: string
 /**
  * The config key that was present and not fully readable (`exposes`,
- * `remotes`). The set is open.
+ * `remotes`), or the Module Federation runtime function whose
+ * argument was not readable (`registerRemotes`, `loadRemote`, `init`,
+ * `createInstance`). The set is open.
  */
 key: string
 /**
  * Why it could not be read, as a kebab-case token:
- * `not-object-literal`, `array-form`, `spread` or
- * `unreadable-entries`. The set is open.
+ * `not-object-literal`, `array-form`, `spread`,
+ * `unreadable-entries`, `unrecognized-call`,
+ * `import-target-unreadable` or `dynamic-argument`. The set is open.
  *
  * The reason decides the remedy, which is why it is on the wire: a
  * value that is not an object literal is fixed by writing one, while
@@ -686,7 +716,8 @@ kind: "plugin-config-unreadable"
 plugin: string
 /**
  * The config key whose effect is not modeled (`components`,
- * `imports`). The set is open.
+ * `imports`), or the virtual module a file reads (`#components`,
+ * `#imports`). The set is open.
  */
 key: string
 /**
@@ -771,6 +802,10 @@ export type HealthFindingActionType = ("refactor-function" | "add-tests" | "incr
  * Coverage model used for CRAP score computation.
  */
 export type CoverageModel = ("static_binary" | "static_estimated" | "istanbul")
+/**
+ * Input format of the measured coverage behind `CoverageModel::Istanbul`.
+ */
+export type CoverageInputFormat = ("istanbul" | "v8")
 /**
  * Whether CRAP findings in the report used one coverage-source kind or a mix.
  */
@@ -1222,7 +1257,7 @@ export type SecurityUrlShape = ("fixed-origin-dynamic-path" | "dynamic-origin")
  */
 export type SecurityRuntimeState = ("runtime-hot" | "runtime-cold" | "never-executed" | "low-traffic" | "coverage-unavailable" | "runtime-unknown")
 /**
- * Defensive control family detected on a source to sink path.
+ * Family of a control pattern observed in a file on an import trace.
  */
 export type SecurityControlKind = ("sanitization" | "validation" | "authentication" | "authorization")
 /**
@@ -1270,7 +1305,7 @@ export type FeatureFlagActionType = ("investigate-flag" | "suppress-line")
  * Independently-versioned wire-version newtype for the brief envelope.
  * Serializes as the integer `REVIEW_BRIEF_SCHEMA_VERSION`.
  */
-export type ReviewBriefSchemaVersion = 10
+export type ReviewBriefSchemaVersion = 11
 /**
  * The exactly-three shippable decision categories (the SOLID-3). No cut category
  * (abstraction / deletion / convention / irreversibility) is representable: this
@@ -1487,13 +1522,13 @@ base_snapshot_skipped?: (boolean | null)
 summary: AuditSummary
 attribution: AuditAttribution
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -1579,24 +1614,25 @@ styling_inherited: number
 duplication_demoted: number
 }
 /**
- * Every gate a run ARMED, keyed by name.
+ * The verdict of every gate a run evaluated, keyed by name.
  *
- * Armed, not evaluated: a gate is armed by a flag or by config, never merely
- * because the rule behind it exists. Fallow's default severity rules fail a
- * run with no flag at all, so a `dead-code` run can exit 1 carrying no object
- * whatsoever. Read an absent object as "no gate was asked for", never as
- * "nothing failed".
+ * A gate is armed by a flag or by config. The default exit rule of a command
+ * is always in the object, also when no flag armed a gate:
+ * `error-severity-findings` on `dead-code`, `check` and the combined run
+ * (with `health-findings` when the combined run analyzed health),
+ * `health-findings` on `health`, `security-advisory` on `security` and
+ * `audit-verdict` on `audit`. A reader of the JSON sees a failing run without
+ * the exit code. `dupes` has no default exit rule, so a `dupes` run that armed
+ * no gate carries no object and always exits 0.
  *
- * Absent from an envelope whenever it is empty, so a run that armed no gate is
- * byte-identical to one produced before this object existed. An empty object
- * is never emitted: it would assert that gates were armed and none tripped,
- * which is a different and false claim.
+ * An empty object is never emitted. The typed programmatic API runs no CLI
+ * gate and leaves the object absent.
  *
  * The names this build can emit are `error-severity-findings`, `regression`,
  * `stale-baseline`, `duplication-threshold`, `health-min-score`,
  * `health-min-severity`, `health-findings`, `health-coverage-gaps`,
- * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`
- * and `type-aware-require`. The set is OPEN: a name a consumer does not
+ * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`,
+ * `type-aware-require` and `parse-error`. The set is OPEN: a name a consumer does not
  * recognise means "some gate", not an error.
  */
 export interface GateOutcomes {
@@ -1623,15 +1659,17 @@ export interface GateOutcome {
 status: GateStatus
 /**
  * True when a `fail` from this gate makes the run exit non-zero. False
- * when the verdict is published for information only, because the gate was
- * never armed or because the run was told never to fail.
+ * when the verdict is published for information only: the gate was never
+ * armed, the run was told never to fail, or the combined machine formats
+ * exit 0 for the gate.
  */
 enforced: boolean
 /**
  * The measured value the gate compared, when there is one: the duplication
- * percentage, the health score, or the number of findings at or above the
- * severity floor. Whole numbers are carried as JSON numbers, so a count of
- * three reads as `3.0`. Absent for gates that compare no number.
+ * percentage, the health score, the number of findings at or above the
+ * severity floor, or the number of files in `files`. Whole numbers are
+ * carried as JSON numbers, so a count of three reads as `3.0`. Absent for
+ * gates that compare no number.
  */
 observed?: (number | null)
 /**
@@ -1649,6 +1687,34 @@ threshold?: (number | null)
  * object. Absent for gates whose numbers speak for themselves.
  */
 threshold_label?: (string | null)
+/**
+ * The files the gate judged, for a gate that judges files rather than a
+ * number. Only `parse-error` sets it: one item per file that did not
+ * parse cleanly, sorted by path. Absent when the list is empty.
+ */
+files?: GateFile[]
+}
+/**
+ * One file a file-judging gate names, with the reason the gate counted it.
+ *
+ * Today only `parse-error` emits it. The item carries the same facts as the
+ * `source-parse-degraded` entry in `workspace_diagnostics[]` for that file,
+ * so a consumer can act on the gate without a join.
+ */
+export interface GateFile {
+/**
+ * The file path, relative to the project root, with `/` separators.
+ */
+path: string
+/**
+ * The number of parser errors for the file.
+ */
+error_count: number
+/**
+ * True when the parser stopped in the file instead of recovering, so the
+ * analysis saw only the part before the error.
+ */
+panicked: boolean
 }
 /**
  * Metric and rule definitions emitted under `_meta` when `--explain` is
@@ -2614,6 +2680,12 @@ unused_types: UnusedTypeFinding[]
  * typed `actions` array natively.
  */
 private_type_leaks: PrivateTypeLeakFinding[]
+/**
+ * Exports marked `@deprecated` that still have at least one consumer in
+ * a reachable file. Wrapped in [`DeprecatedExportInUseFinding`]. Opt-in: the
+ * `deprecated-exports-in-use` rule defaults to `off`.
+ */
+deprecated_exports_in_use?: DeprecatedExportInUseFinding[]
 /**
  * Dependencies listed in package.json but never imported. Wrapped in
  * [`UnusedDependencyFinding`] so each entry carries a typed `actions`
@@ -2941,13 +3013,13 @@ baseline_staleness?: (BaselineStaleness | null)
  */
 regression?: (RegressionResult | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -3066,6 +3138,10 @@ unused_types: number
  * Public exports whose signature references same-file private types.
  */
 private_type_leaks: number
+/**
+ * Exports marked `@deprecated` that are still referenced.
+ */
+deprecated_exports_in_use: number
 /**
  * Combined count of unused entries across `dependencies`,
  * `devDependencies`, and `optionalDependencies`. The per-section
@@ -3247,6 +3323,13 @@ actions: IssueAction[]
  * the merge-base. `None` when serialized directly from Rust.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the reachability verdict behind this finding.
  * Sorted, deduplicated, and omitted from the wire when empty, so a run
@@ -3450,6 +3533,17 @@ span_start: number
  * Whether this finding comes from a barrel/index re-export rather than the source definition.
  */
 is_re_export: boolean
+/**
+ * Whether the export's leading JSDoc carries `@deprecated`. Absent from
+ * the wire when false.
+ */
+deprecated?: boolean
+/**
+ * Plain-text message of the `@deprecated` tag, capped at
+ * [`DEPRECATED_REASON_MAX_CHARS`] characters. Absent when the export is
+ * not deprecated or the tag carries no text.
+ */
+deprecated_reason?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3464,6 +3558,13 @@ semantic?: (SemanticCandidateDecision | null)
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the reachability verdict behind this finding.
  * Sorted, deduplicated, and omitted from the wire when empty. Never gates
@@ -3507,6 +3608,17 @@ span_start: number
  * Whether this finding comes from a barrel/index re-export rather than the source definition.
  */
 is_re_export: boolean
+/**
+ * Whether the export's leading JSDoc carries `@deprecated`. Absent from
+ * the wire when false.
+ */
+deprecated?: boolean
+/**
+ * Plain-text message of the `@deprecated` tag, capped at
+ * [`DEPRECATED_REASON_MAX_CHARS`] characters. Absent when the export is
+ * not deprecated or the tag carries no text.
+ */
+deprecated_reason?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3521,6 +3633,13 @@ semantic?: (SemanticCandidateDecision | null)
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the reachability verdict behind this finding.
  * A type export rests on exactly the reachability test an
@@ -3575,6 +3694,103 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
+}
+/**
+ * Wire-shape envelope for a [`DeprecatedExportInUse`] finding. Carries a
+ * manual `migrate-deprecated-export` primary action plus a `suppress-line`
+ * secondary. Never auto-fixable: fallow does not rewrite consumers.
+ */
+export interface DeprecatedExportInUseFinding {
+/**
+ * File that declares the deprecated export.
+ */
+path: string
+/**
+ * Name of the deprecated export.
+ */
+export_name: string
+/**
+ * Whether this is a type-only export.
+ */
+is_type_only: boolean
+/**
+ * 1-based line number of the export.
+ */
+line: number
+/**
+ * 0-based byte column offset of the export.
+ */
+col: number
+/**
+ * Byte offset of the export in the source file.
+ */
+span_start: number
+/**
+ * Plain-text message of the `@deprecated` tag, capped at
+ * [`DEPRECATED_REASON_MAX_CHARS`] characters. Absent when the tag
+ * carries no text.
+ */
+deprecated_reason?: (string | null)
+/**
+ * Exact number of distinct consumers: reference sites in reachable
+ * files, one per path, line, column and kind. `consumers` holds the
+ * first [`DEPRECATED_CONSUMER_SAMPLE_CAP`] of them, so the sample is
+ * complete when this count is at most the cap.
+ */
+consumer_count: number
+/**
+ * Consumer sample sorted by path, line, column and kind, capped at
+ * [`DEPRECATED_CONSUMER_SAMPLE_CAP`] entries.
+ */
+consumers: DeprecatedExportConsumer[]
+/**
+ * True when the export is part of the public API: it lives in an entry
+ * point, or a re-export chain reaches an entry point. External consumers
+ * are not visible, so the finding makes no removal claim.
+ */
+public_api: boolean
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
+}
+/**
+ * One file location that references a deprecated export.
+ */
+export interface DeprecatedExportConsumer {
+/**
+ * File that references the deprecated export.
+ */
+path: string
+/**
+ * 1-based line number of the import or re-export statement.
+ */
+line: number
+/**
+ * 0-based byte column offset of the import or re-export statement.
+ */
+col: number
+kind: DeprecatedConsumerKind
 }
 /**
  * Wire-shape envelope for an [`UnusedDependency`] finding consumed under
@@ -3612,6 +3828,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A dependency is
  * reported unused when NO module in the project imports its specifier,
@@ -3658,6 +3881,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A dependency is
  * reported unused when NO module in the project imports its specifier,
@@ -3704,6 +3934,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A dependency is
  * reported unused when NO module in the project imports its specifier,
@@ -3750,6 +3987,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A member's usage
  * is collected by walking the member accesses of every module the run
@@ -3802,6 +4046,13 @@ semantic?: (SemanticCandidateDecision | null)
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A class member's
  * usage is collected by the same reachability-free member-access walk an
@@ -3855,6 +4106,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A store member's
  * usage is collected by the same reachability-free member-access walk a
@@ -3905,6 +4163,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnlistedDependency`] finding. Carries an
@@ -3931,6 +4196,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * A location where an import occurs.
@@ -3981,6 +4253,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * A location where a duplicate export appears.
@@ -4027,6 +4306,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`TestOnlyDependency`] finding. Carries a
@@ -4057,6 +4343,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`DevDependencyInProduction`] finding. Carries a
@@ -4088,6 +4381,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`CircularDependency`] finding. Mirrors
@@ -4135,6 +4435,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * One import hop in a circular dependency: the file containing the import
@@ -4190,6 +4497,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`BoundaryViolation`] finding. Mirrors
@@ -4236,6 +4550,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`BoundaryCoverageViolation`] finding. Carries
@@ -4264,6 +4585,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`BoundaryCallViolation`] finding. Carries
@@ -4305,6 +4633,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`PolicyViolation`] finding. Carries actions for
@@ -4382,6 +4717,13 @@ missing_reason?: boolean
  * Suggested next steps. Always emitted.
  */
 actions: IssueAction[]
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedCatalogEntry`] finding. Per-instance
@@ -4422,6 +4764,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`EmptyCatalogGroup`] finding. Carries a
@@ -4450,6 +4799,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnresolvedCatalogReference`] finding. The
@@ -4500,6 +4856,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedDependencyOverride`] finding. Carries
@@ -4562,6 +4925,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`MisconfiguredDependencyOverride`] finding.
@@ -4611,6 +4981,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`InvalidClientExport`] finding. There is no safe
@@ -4652,6 +5029,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`MixedClientServerBarrel`] finding. There is no
@@ -4693,6 +5077,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`MisplacedDirective`] finding. There is no safe
@@ -4729,6 +5120,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnprovidedInject`] finding. There is no safe
@@ -4767,6 +5165,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnrenderedComponent`] finding. There is no safe
@@ -4816,6 +5221,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`RouteCollision`] finding. A route collision is a
@@ -4858,6 +5270,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`DynamicSegmentNameConflict`] finding. The
@@ -4904,6 +5323,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentProp`] finding. There is no safe
@@ -4942,6 +5368,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentEmit`] finding. There is no safe
@@ -4980,6 +5413,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentInput`] finding. There is no safe
@@ -5018,6 +5458,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentOutput`] finding. There is no safe
@@ -5056,6 +5503,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedSvelteEvent`] finding. There is no safe
@@ -5095,6 +5549,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedServerAction`] finding. There is no safe
@@ -5129,6 +5590,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedLoadDataKey`] finding. There is no safe
@@ -5169,6 +5637,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`PropDrillingChain`] finding. There is no safe
@@ -5203,6 +5678,14 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Rule severity of this finding. This type never gates the run, so the
+ * value does not change the exit code. `fallow report --from` reads it
+ * for the SARIF level, so the level does not depend on the config at
+ * render time. Absent in output from older versions. Not part of the
+ * finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * One hop in a prop-drilling chain: a component that received the prop and
@@ -5260,6 +5743,14 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Rule severity of this finding. This type never gates the run, so the
+ * value does not change the exit code. `fallow report --from` reads it
+ * for the SARIF level, so the level does not depend on the config at
+ * render time. Absent in output from older versions. Not part of the
+ * finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`DuplicatePropShape`] finding. There is no safe
@@ -5310,6 +5801,14 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Rule severity of this finding. This type never gates the run, so the
+ * value does not change the exit code. `fallow report --from` reads it
+ * for the SARIF level, so the level does not depend on the config at
+ * render time. Absent in output from older versions. Not part of the
+ * finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * One member of a duplicate-prop-shape group: the OTHER components that share
@@ -5483,6 +5982,19 @@ moved_entries: number
  * existed gets, which is why the keys remain the fallback.
  */
 unrecognised_format?: boolean
+/**
+ * The command that saved the loaded file, when `unrecognised_format` is
+ * true and the file names a writer this version knows: `dead-code`,
+ * `dupes` or `health`, the token the file carries in its top-level `kind`.
+ *
+ * Absent, never null, for this command's own baseline, for a file that
+ * names no writer (an empty file, or a baseline saved before `kind`
+ * existed) and for a `kind` token this version does not know. The value
+ * set is OPEN: a later release can add a writer, so treat an unknown value
+ * as "another command". The CLI computes it once per loaded baseline and
+ * uses the same value for its stderr note.
+ */
+saved_by?: string
 /**
  * Which channels narrowed this run, present and non-empty exactly when
  * `change_scoped` is true. Both members are derived from one function, so
@@ -5566,9 +6078,10 @@ reason?: (string | null)
  * whole object narrows the report tells its reader an unwritten SARIF file
  * widened the analysis, which is what `affects` exists to prevent.
  *
- * `scope_size` is emitted for `diff-filter` only today, in added lines. A
- * consumer reads the unit off the name, so a name that starts measuring its
- * own scope in a later release needs no change here.
+ * `scope_size` is emitted for `diff-filter`, in added lines, and for
+ * `changed-since`, in changed files that the run analyzed. `sarif-file`
+ * measures no scope. A consumer reads the unit off the name, so a name that
+ * starts to measure its own scope in a later release needs no change here.
  *
  * `invalid-ref` is reachable only through the programmatic API. The
  * `--changed-since` flag validates its value before a run starts and fails
@@ -5591,7 +6104,8 @@ affects: RequestEffect
 /**
  * What was asked, as the user spelled it: the git ref for
  * `changed-since`, the diff source label (`--diff-file pr.diff`,
- * `--diff-stdin`, `$FALLOW_DIFF_FILE build/pr.diff`) for `diff-filter`,
+ * `--diff-stdin`, `$FALLOW_DIFF_FILE build/pr.diff`, or
+ * `diffFile pr.diff` for the programmatic option) for `diff-filter`,
  * the target path for `sarif-file`. Echoed rather than normalised, so a
  * consumer must not join it to the project root the way it joins every
  * other path-shaped field.
@@ -5604,9 +6118,14 @@ requested: string
  * number there would describe a scope nobody applied.
  *
  * The unit belongs to the name. `diff-filter` counts added lines, which is
- * what its filter keeps a finding for. Read the unit off the name the entry
- * is keyed under, never across names, and read an absent member as "not
- * measured" rather than as zero.
+ * what its filter keeps a finding for. `changed-since` counts changed
+ * files that the run analyzed: a changed file that discovery or an ignore
+ * rule dropped does not count, so a change to a README only gives `0`. A
+ * combined run counts a file that any of its analyses kept, because a
+ * per-analysis `production` setting can give its analyses different
+ * files.
+ * Read the unit off the name the entry is keyed under, never across names,
+ * and read an absent member as "not measured" rather than as zero.
  *
  * The count is what the run INDEXED rather than the true total:
  * `diff-filter` indexes at most one million added lines and reports that
@@ -6201,6 +6720,14 @@ react_prop_count?: number
 react_hook_profile?: (ReactHookProfile | null)
 exceeded: ExceededThreshold
 severity: FindingSeverity
+/**
+ * Gate severity after the `complexity-*` rules and their
+ * `overrides[].rules` entries: `error` fails the run, `warn` does not.
+ * The most severe rule of the kinds in `exceeded` wins. It is separate
+ * from the band in `severity`, which ranks the finding and does not gate
+ * it. Absent in reports from older versions.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * CRAP score (change risk anti-pattern), when coverage data exists.
  */
@@ -6507,6 +7034,11 @@ average_maintainability?: (number | null)
  * Coverage model behind the CRAP scores, when coverage was used.
  */
 coverage_model?: (CoverageModel | null)
+/**
+ * Input format of the measured coverage (`istanbul` or `v8`). Present
+ * only with `coverage_model: "istanbul"`.
+ */
+coverage_input_format?: (CoverageInputFormat | null)
 /**
  * Whether CRAP findings mix coverage sources.
  */
@@ -7510,8 +8042,8 @@ watermark?: (RuntimeCoverageWatermark | null)
  */
 warnings?: RuntimeCoverageMessage[]
 /**
- * Whether an autonomous agent may act on this report (fallow-rs/fallow-cloud#316,
- * mirrors the cloud runtime-context contract). `false` when the capture
+ * Whether an autonomous agent may act on this report (mirrors
+ * the cloud runtime-context contract). `false` when the capture
  * carries no usable runtime evidence (no tracked functions); then
  * `actionability_verdict` is `insufficient_evidence` and
  * `actionability_reason` explains. F4: a non-action floor, never a gate on a
@@ -7741,7 +8273,7 @@ description: string
 auto_fixable: boolean
 }
 /**
- * Discriminator inputs that PRODUCED a finding's verdict (fallow-rs/fallow-cloud#321),
+ * Discriminator inputs that PRODUCED a finding's verdict,
  * emitted alongside the verdict so an agent can reproduce it and see the
  * minimum-observation confidence cap instead of re-deriving them from scratch.
  * F4: these make the EXISTING Fallow-owned discriminators legible; they are not
@@ -7937,7 +8469,7 @@ code: string
 message: string
 }
 /**
- * Provenance of a runtime-coverage report (fallow-rs/fallow-cloud#319), mirroring
+ * Provenance of a runtime-coverage report, mirroring
  * the cloud runtime-context `provenance` block so the local-capture and cloud
  * surfaces present one portable shape. F4: provenance is context only; it never
  * gates a verdict or confidence.
@@ -10137,6 +10669,12 @@ imported_by: string[]
  * Re-exports declared by this file.
  */
 re_exports: TracedReExport[]
+/**
+ * The configs that make this file an entry point through Module
+ * Federation `exposes`, one per config. Absent when no Federation config
+ * exposes the file (issue #2796).
+ */
+sources?: TraceSource[]
 }
 /**
  * An export with usage information.
@@ -10176,6 +10714,37 @@ imported_name: string
  */
 exported_name: string
 }
+/**
+ * A config that names a traced file or a traced dependency, and the key that
+ * names it.
+ */
+export interface TraceSource {
+/**
+ * The mechanism that names the file or the dependency:
+ * `module-federation`. The set is open.
+ */
+kind: string
+/**
+ * The plugin that read the config, as it labels itself:
+ * `module-federation` for a standalone `module-federation.config.*`,
+ * or the bundler plugin (`webpack`, `rspack`, `rsbuild`, `vite`,
+ * `nextjs`) that read the same options inline from its own config.
+ */
+plugin: string
+/**
+ * The file that names the file or the dependency, relative to the
+ * project root: the config file, or the source file of a Module
+ * Federation runtime call.
+ */
+config: string
+/**
+ * The config key or the runtime function that names the file or the
+ * dependency: `exposes` for an exposed file, `remotes` for a remote
+ * alias, and `registerRemotes`, `loadRemote`, `init` or `createInstance`
+ * for a remote that a runtime call names. The set is open.
+ */
+key: string
+}
 /**
  * Result of tracing a dependency: where it is used.
  */
@@ -10204,6 +10773,13 @@ is_used: boolean
  * Total import count.
  */
 import_count: number
+/**
+ * The configs that declare this name as a Module Federation remote alias
+ * under `remotes`, one per config. A remote alias is provided by a
+ * remote container at runtime, not by an npm package. Absent when no
+ * Federation config declares the name (issue #2796).
+ */
+sources?: TraceSource[]
 }
 /**
  * Result of tracing a clone: all groups containing the code at a source
@@ -11296,13 +11872,13 @@ grouped_by?: (GroupByMode | null)
  */
 groups?: (HealthGroup[] | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -11499,13 +12075,11 @@ groups?: (DuplicationGroup[] | null)
  */
 baseline_staleness?: (BaselineStaleness | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run armed, keyed by name, absent when
+ * it armed none. `dupes` has no default exit rule: a run with no armed
+ * gate always exits 0, so an absent object means that the run passed. A
+ * gate fails the build when `status` is `fail` AND `enforced` is true.
+ * See [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -11686,13 +12260,13 @@ groups: CheckGroupedEntry[]
  */
 baseline_staleness?: (BaselineStaleness | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -11764,6 +12338,12 @@ unused_types: UnusedTypeFinding[]
  * typed `actions` array natively.
  */
 private_type_leaks: PrivateTypeLeakFinding[]
+/**
+ * Exports marked `@deprecated` that still have at least one consumer in
+ * a reachable file. Wrapped in [`DeprecatedExportInUseFinding`]. Opt-in: the
+ * `deprecated-exports-in-use` rule defaults to `off`.
+ */
+deprecated_exports_in_use?: DeprecatedExportInUseFinding[]
 /**
  * Dependencies listed in package.json but never imported. Wrapped in
  * [`UnusedDependencyFinding`] so each entry carries a typed `actions`
@@ -12375,13 +12955,13 @@ version: ToolVersion
 elapsed_ms: ElapsedMs
 config: SecurityOutputConfig
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -12488,10 +13068,10 @@ new_count: number
 export interface SecurityFinding {
 /**
  * Stable per-finding correlation id, identical across runs for the same
- * rule + anchor path + line. An autonomous agent that triaged this
+ * rule + anchor path + line + column. An autonomous agent that triaged this
  * candidate on a prior run uses it to correlate the candidate after a
- * rebase. Equal to the SARIF `partialFingerprints` value for the same
- * finding (one shared helper computes both).
+ * rebase. Equal to the SARIF `partialFingerprints["fallowSecurity/v2"]`
+ * value for the same finding (one shared helper computes both).
  */
 finding_id: string
 kind: SecurityFindingKind
@@ -12909,7 +13489,8 @@ defensive_boundary: SecurityDefensiveBoundary
  */
 export interface SecurityDefensiveBoundary {
 /**
- * Known controls detected along this path.
+ * Control patterns observed in files on this import trace. These are
+ * verification hints, not proof of sink protection or value-level data flow.
  */
 controls: SecurityDefensiveControl[]
 /**
@@ -12919,7 +13500,9 @@ controls: SecurityDefensiveControl[]
 verification_prompt: string
 }
 /**
- * Defensive control found on an attack-surface path.
+ * Control pattern observed in a file on an attack-surface import trace.
+ * Its presence does not prove that it executes before the sink or protects
+ * the same input.
  */
 export interface SecurityDefensiveControl {
 kind: SecurityControlKind
@@ -13018,13 +13601,13 @@ version: ToolVersion
 elapsed_ms: ElapsedMs
 config: SecurityOutputConfig
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -13321,13 +13904,17 @@ schema_version: CombinedSchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the default exit rule of each section that ran
+ * (`error-severity-findings`, `health-findings`). The machine formats of
+ * the combined run exit 0 for findings, so most entries have `enforced:
+ * false`. For the default exit rules (`error-severity-findings`,
+ * `health-findings`), `status` gives the verdict of the human run. An
+ * advisory entry can report `fail` without a failure of the human run: an
+ * example is a `stale-baseline` entry that `--fail-on-stale-baseline` did
+ * not arm. A gate fails the build when `status` is `fail` AND `enforced`
+ * is true. The typed
+ * programmatic API leaves it absent. See [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -13351,7 +13938,7 @@ check?: (CheckOutput | null)
 /**
  * Duplication section of the combined run.
  */
-dupes?: (DupesReportPayload | null)
+dupes?: (CombinedDupesSection | null)
 /**
  * Health section of the combined run.
  */
@@ -13392,6 +13979,41 @@ health?: (Meta | null)
  */
 telemetry?: (TelemetryMeta | null)
 }
+/**
+ * Wire shape of the `dupes` section inside the bare combined envelope.
+ *
+ * The section is the standalone payload plus the view of the loaded
+ * duplication baseline. The standalone `dupes` envelope carries the same
+ * `baseline_staleness` key at its root.
+ */
+export interface CombinedDupesSection {
+/**
+ * All detected clone groups, each wrapped with typed actions.
+ */
+clone_groups: CloneGroupFinding[]
+/**
+ * Clone families, each wrapped with typed actions. Inner `groups`
+ * inside each `CloneFamilyFinding` are themselves wrapped as
+ * `CloneGroupFinding` entries carrying their own `actions[]` (and
+ * optional audit-mode `introduced` flag), so JSON-Schema strict
+ * consumers and TS consumers reading `clone_families[].groups[]` see
+ * the same shape as the top-level `clone_groups[]` array (preserves
+ * the issue #393 regression contract).
+ */
+clone_families: CloneFamilyFinding[]
+/**
+ * Mirrored directory pairs.
+ */
+mirrored_directories?: MirroredDirectory[]
+stats: DuplicationStats
+/**
+ * This run's view of the loaded duplication baseline, present only when
+ * `--dupes-baseline` loaded one. Read `change_scoped` before dividing
+ * `matched_entries` by `baseline_entries`: a narrowed run can report
+ * `matched_entries: 0` on a healthy baseline.
+ */
+baseline_staleness?: (BaselineStaleness | null)
+}
 /**
  * Envelope emitted by `fallow flags --format json`.
  */
@@ -13637,6 +14259,11 @@ deltas: ReviewDeltas
  */
 weakening: WeakeningSignal[]
 routing: RoutingFacts
+/**
+ * Owner-group reach from the CODEOWNERS file. Absent when no CODEOWNERS
+ * file is found or the file cannot be read.
+ */
+ownership?: (OwnershipFacts | null)
 /**
  * Dead-code findings scoped to the audit changeset.
  */
@@ -14116,6 +14743,96 @@ expert: string[]
  */
 bus_factor_one?: boolean
 }
+/**
+ * How far a changeset reaches across CODEOWNERS owner groups.
+ *
+ * Computed from the CODEOWNERS file alone: no git history is read, so the
+ * section is present whenever a CODEOWNERS file is found, also when the churn
+ * walk behind `routing` finds nothing. Each file maps to its primary owner
+ * (the first owner of the last matching rule). A file that no rule matches,
+ * or that a GitLab negation rule matches, belongs to the `(unowned)` group.
+ * The owner strings use the same vocabulary as `routing.units[].expert`.
+ *
+ * Absent from the brief when no CODEOWNERS file is found, or when the file
+ * cannot be read or does not parse. A configured `codeowners` path that
+ * fails also prints a warning on stderr.
+ *
+ * `groups[].direct_count` counts all changed files, source or not, so the
+ * sum over all groups is the number of changed files, not the size of
+ * `impact_closure.in_diff`. Slice owners count only the files of the
+ * partition units, which are source files.
+ */
+export interface OwnershipFacts {
+/**
+ * Distinct owner groups across the changed files and the impact closure.
+ * The `(unowned)` group counts as one group. Exact, never capped.
+ */
+group_count: number
+/**
+ * Owner groups that own no changed file and appear only through the
+ * impact closure. Exact, never capped.
+ */
+transitive_only_count: number
+/**
+ * Changed files that belong to the `(unowned)` group.
+ */
+unowned_direct_count: number
+/**
+ * The owner groups, sorted by `direct_count` descending, then
+ * `affected_count` descending, then `owner`. At most [`OWNER_GROUP_CAP`]
+ * entries. The counts in each entry are exact.
+ */
+groups: OwnerGroupFact[]
+/**
+ * How many owner groups did not fit within [`OWNER_GROUP_CAP`] and are
+ * absent from `groups`. Zero when nothing was omitted.
+ */
+groups_omitted: number
+/**
+ * The owner set of each independent slice, aligned by index with
+ * `partition.independent_slices`. Present only when that list is present
+ * (two or more slices). A fact for the reviewer, never a demand to split.
+ */
+slices?: OwnershipSliceFact[]
+}
+/**
+ * One owner group and how many files of the changeset it owns.
+ */
+export interface OwnerGroupFact {
+/**
+ * The CODEOWNERS owner (`@user`, `@org/team`, or an email), or
+ * `(unowned)`.
+ */
+owner: string
+/**
+ * Changed files this group owns.
+ */
+direct_count: number
+/**
+ * Files of the impact closure (affected, not in the diff) this group owns.
+ */
+affected_count: number
+}
+/**
+ * The owners of one independent slice of the partition.
+ */
+export interface OwnershipSliceFact {
+/**
+ * The module directories of the slice, as in
+ * `partition.independent_slices`.
+ */
+module_dirs: string[]
+/**
+ * The distinct owners of the changed files in the slice, sorted. The
+ * `(unowned)` group is a distinct owner. Never empty.
+ */
+owners: string[]
+/**
+ * True when the slice has exactly one owner, so one owner group can
+ * review it on its own.
+ */
+separable: boolean
+}
 /**
  * The brief's branching section.
  */
@@ -14495,6 +15212,12 @@ deltas: ReviewDeltas
  */
 weakening: WeakeningSignal[]
 routing: RoutingFacts
+/**
+ * How far the change reaches across CODEOWNERS owner groups, computed
+ * from the CODEOWNERS file alone. Absent when no CODEOWNERS file is
+ * found or the file cannot be read.
+ */
+ownership?: (OwnershipFacts | null)
 decisions: DecisionSurface
 /**
  * Branching conservation across the changeset: total branching against
@@ -15742,6 +16465,16 @@ export type BoundaryViolation = BoundaryViolationFinding;
  */
 export type CircularDependency = CircularDependencyFinding;
 
+/**
+ * Backwards-compat alias for the pre-#384 bare `DeprecatedExportInUse` name.
+ * The wire shape is byte-identical: `DeprecatedExportInUseFinding` flattens the bare
+ * finding's fields via `#[serde(flatten)]` and adds `actions[]` plus
+ * the optional audit-mode `introduced` flag. Consumers that imported
+ * `DeprecatedExportInUse` from `fallow/types` pre-migration continue to work via
+ * this alias; new code should prefer `DeprecatedExportInUseFinding`.
+ */
+export type DeprecatedExportInUse = DeprecatedExportInUseFinding;
+
 /**
  * Backwards-compat alias for the pre-#384 bare `DevDependencyInProduction` name.
  * The wire shape is byte-identical: `DevDependencyInProductionFinding` flattens the bare