fallow 3.28.0 → 3.30.0

package/types/output-contract.d.ts

@@ -261,7 +261,7 @@ export type IssueAction = (FixAction | SuppressLineAction | SuppressFileAction |
  * Discriminant string for [`FixAction`]. Kebab-case per the JSON output
  * contract.
  */
-export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
+export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "migrate-deprecated-export" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
 /**
  * Singleton discriminant for [`SuppressLineAction`].
  */
@@ -301,6 +301,27 @@ export type AddToConfigValue = (string | IgnoreExportsRule[] | {
  * hold `Option<AuditIntroduced>`. Renders to the JSON wire as a bare boolean.
  */
 export type AuditIntroduced = boolean
+/**
+ * Gate severity of one finding after rule resolution.
+ *
+ * It is the severity that `rules` and the matching `overrides[].rules` give
+ * the finding for its path. `--fail-on-issues` raises `warn` to `error`. A
+ * finding whose rule is `off` is not reported, so there is no `off` value.
+ * The type is separate from the health `severity` band, which ranks a
+ * finding and does not gate it.
+ *
+ * The `fallow dead-code` findings gate fails when a finding is `error`.
+ * Other gates (regression, stale baseline) decide on their own inputs. Two
+ * commands differ: the `fallow audit` `new-only` gate fails only on introduced
+ * findings, so an inherited `error` finding does not fail the audit, and the
+ * combined command (`fallow` without a subcommand) exits 0 for machine
+ * formats.
+ *
+ * Complexity findings carry the same type. The `complexity-cyclomatic`,
+ * `complexity-cognitive` and `complexity-crap` rules set it, and the
+ * `fallow health` findings gate and the audit verdict read it.
+ */
+export type EffectiveSeverity = ("error" | "warn")
 /**
  * A per-finding caveat on a dead-code verdict that a file this run never
  * fully analyzed can distort.
@@ -325,6 +346,10 @@ export type AuditIntroduced = boolean
  * caveat" rather than as an error.
  */
 export type ReachabilityCaveat = ("incomplete-file-analysis" | "incomplete-import-graph")
+/**
+ * How a consumer references a deprecated export.
+ */
+export type DeprecatedConsumerKind = ("named-import" | "default-import" | "namespace-import" | "re-export" | "dynamic-import" | "side-effect-import")
 /**
  * Where in package.json a dependency is listed.
  *
@@ -618,13 +643,15 @@ kind: "file-scores-unavailable"
 } | {
 /**
  * Which input stopped it, as a kebab-case token: `not-a-repository`,
- * `invalid-since` or `churn-file-unreadable`. The set is open.
+ * `no-commits`, `invalid-since` or `churn-file-unreadable`. The set is
+ * open.
  *
  * The cause decides the remedy, which is why it is on the wire: a run
  * outside a repository is fixed by running fallow inside one, a
- * malformed `--since` by respelling the flag, and a churn file that
- * changed under the run by rerunning it. A consumer reading only the
- * kind would offer the first remedy for all three.
+ * branch without a commit by committing, a malformed `--since` by
+ * respelling the flag, and a churn file that changed under the run by
+ * rerunning it. A consumer reading only the kind would offer the first
+ * remedy for all four.
  */
 cause: string
 kind: "hotspots-skipped"
@@ -664,13 +691,16 @@ kind: "trend-snapshot-unreadable"
 plugin: string
 /**
  * The config key that was present and not fully readable (`exposes`,
- * `remotes`). The set is open.
+ * `remotes`), or the Module Federation runtime function whose
+ * argument was not readable (`registerRemotes`, `loadRemote`, `init`,
+ * `createInstance`). The set is open.
  */
 key: string
 /**
  * Why it could not be read, as a kebab-case token:
- * `not-object-literal`, `array-form`, `spread` or
- * `unreadable-entries`. The set is open.
+ * `not-object-literal`, `array-form`, `spread`,
+ * `unreadable-entries`, `unrecognized-call`,
+ * `import-target-unreadable` or `dynamic-argument`. The set is open.
  *
  * The reason decides the remedy, which is why it is on the wire: a
  * value that is not an object literal is fixed by writing one, while
@@ -686,7 +716,8 @@ kind: "plugin-config-unreadable"
 plugin: string
 /**
  * The config key whose effect is not modeled (`components`,
- * `imports`). The set is open.
+ * `imports`), or the virtual module a file reads (`#components`,
+ * `#imports`). The set is open.
  */
 key: string
 /**
@@ -700,6 +731,15 @@ reason: string
 kind: "plugin-effect-not-modeled"
 } | {
 kind: "coverage-auto-detected"
+} | {
+kind: "flag-age-shallow-clone"
+} | {
+/**
+ * Why no history is available, as a kebab-case token:
+ * `not-a-repository` or `no-commits`. The set is open.
+ */
+cause: string
+kind: "flag-age-unavailable"
 })
 /**
  * Discriminant for [`CloneGroupAction::kind`]. Mirrors the action types
@@ -771,6 +811,10 @@ export type HealthFindingActionType = ("refactor-function" | "add-tests" | "incr
  * Coverage model used for CRAP score computation.
  */
 export type CoverageModel = ("static_binary" | "static_estimated" | "istanbul")
+/**
+ * Input format of the measured coverage behind `CoverageModel::Istanbul`.
+ */
+export type CoverageInputFormat = ("istanbul" | "v8")
 /**
  * Whether CRAP findings in the report used one coverage-source kind or a mix.
  */
@@ -870,6 +914,11 @@ export type RuntimeCoverageVerdict = ("safe_to_delete" | "review_required" | "co
  * Confidence level for a runtime coverage finding.
  */
 export type RuntimeCoverageConfidence = ("very_high" | "high" | "medium" | "low" | "none" | "unknown")
+/**
+ * The per-call cost that `optimization_target.cost_score` multiplies with
+ * `invocations`.
+ */
+export type RuntimeCoverageCostBasis = ("inner_iterations" | "cognitive")
 /**
  * Blast-radius risk band. The current thresholds are high at >=20 static
  * callers or >=1,000,000 traffic-weighted caller reach; medium at >=5 callers
@@ -1222,7 +1271,7 @@ export type SecurityUrlShape = ("fixed-origin-dynamic-path" | "dynamic-origin")
  */
 export type SecurityRuntimeState = ("runtime-hot" | "runtime-cold" | "never-executed" | "low-traffic" | "coverage-unavailable" | "runtime-unknown")
 /**
- * Defensive control family detected on a source to sink path.
+ * Family of a control pattern observed in a file on an import trace.
  */
 export type SecurityControlKind = ("sanitization" | "validation" | "authentication" | "authorization")
 /**
@@ -1266,11 +1315,35 @@ export type FeatureFlagConfidence = ("high" | "medium" | "low")
  * Feature flag action discriminants.
  */
 export type FeatureFlagActionType = ("investigate-flag" | "suppress-line")
+/**
+ * How the report measures the age of a flag.
+ */
+export type FlagAgeMode = ("blame" | "pickaxe" | "off")
+/**
+ * How a retirement row's flag was detected.
+ */
+export type RetirementFlagKind = ("environment_variable" | "sdk_call" | "config_object" | "constant" | "vendor_export")
+/**
+ * What a site does with the flag.
+ */
+export type FlagSiteRole = ("read" | "definition")
+/**
+ * Why a flag is a retirement candidate.
+ */
+export type RetirementReason = ("single-read-site" | "test-only" | "literal-constant" | "identical-branches" | "empty-branch" | "guards-dead-code" | "defined-never-read" | "fully-rolled-out" | "archived-in-vendor" | "missing-in-vendor" | "vendor-only")
+/**
+ * Action discriminants for a retirement row.
+ */
+export type RetirementActionType = "review-retirement"
+/**
+ * State of a flag in a `--flag-state` vendor export.
+ */
+export type VendorFlagState = ("on" | "off" | "rolled_out" | "archived" | "experiment")
 /**
  * Independently-versioned wire-version newtype for the brief envelope.
  * Serializes as the integer `REVIEW_BRIEF_SCHEMA_VERSION`.
  */
-export type ReviewBriefSchemaVersion = 10
+export type ReviewBriefSchemaVersion = 11
 /**
  * The exactly-three shippable decision categories (the SOLID-3). No cut category
  * (abstraction / deletion / convention / irreversibility) is representable: this
@@ -1487,13 +1560,13 @@ base_snapshot_skipped?: (boolean | null)
 summary: AuditSummary
 attribution: AuditAttribution
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -1579,24 +1652,25 @@ styling_inherited: number
 duplication_demoted: number
 }
 /**
- * Every gate a run ARMED, keyed by name.
+ * The verdict of every gate a run evaluated, keyed by name.
  *
- * Armed, not evaluated: a gate is armed by a flag or by config, never merely
- * because the rule behind it exists. Fallow's default severity rules fail a
- * run with no flag at all, so a `dead-code` run can exit 1 carrying no object
- * whatsoever. Read an absent object as "no gate was asked for", never as
- * "nothing failed".
+ * A gate is armed by a flag or by config. The default exit rule of a command
+ * is always in the object, also when no flag armed a gate:
+ * `error-severity-findings` on `dead-code`, `check` and the combined run
+ * (with `health-findings` when the combined run analyzed health),
+ * `health-findings` on `health`, `security-advisory` on `security` and
+ * `audit-verdict` on `audit`. A reader of the JSON sees a failing run without
+ * the exit code. `dupes` has no default exit rule, so a `dupes` run that armed
+ * no gate carries no object and always exits 0.
  *
- * Absent from an envelope whenever it is empty, so a run that armed no gate is
- * byte-identical to one produced before this object existed. An empty object
- * is never emitted: it would assert that gates were armed and none tripped,
- * which is a different and false claim.
+ * An empty object is never emitted. The typed programmatic API runs no CLI
+ * gate and leaves the object absent.
  *
  * The names this build can emit are `error-severity-findings`, `regression`,
  * `stale-baseline`, `duplication-threshold`, `health-min-score`,
  * `health-min-severity`, `health-findings`, `health-coverage-gaps`,
- * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`
- * and `type-aware-require`. The set is OPEN: a name a consumer does not
+ * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`,
+ * `type-aware-require` and `parse-error`. The set is OPEN: a name a consumer does not
  * recognise means "some gate", not an error.
  */
 export interface GateOutcomes {
@@ -1623,15 +1697,17 @@ export interface GateOutcome {
 status: GateStatus
 /**
  * True when a `fail` from this gate makes the run exit non-zero. False
- * when the verdict is published for information only, because the gate was
- * never armed or because the run was told never to fail.
+ * when the verdict is published for information only: the gate was never
+ * armed, the run was told never to fail, or the combined machine formats
+ * exit 0 for the gate.
  */
 enforced: boolean
 /**
  * The measured value the gate compared, when there is one: the duplication
- * percentage, the health score, or the number of findings at or above the
- * severity floor. Whole numbers are carried as JSON numbers, so a count of
- * three reads as `3.0`. Absent for gates that compare no number.
+ * percentage, the health score, the number of findings at or above the
+ * severity floor, or the number of files in `files`. Whole numbers are
+ * carried as JSON numbers, so a count of three reads as `3.0`. Absent for
+ * gates that compare no number.
  */
 observed?: (number | null)
 /**
@@ -1649,6 +1725,34 @@ threshold?: (number | null)
  * object. Absent for gates whose numbers speak for themselves.
  */
 threshold_label?: (string | null)
+/**
+ * The files the gate judged, for a gate that judges files rather than a
+ * number. Only `parse-error` sets it: one item per file that did not
+ * parse cleanly, sorted by path. Absent when the list is empty.
+ */
+files?: GateFile[]
+}
+/**
+ * One file a file-judging gate names, with the reason the gate counted it.
+ *
+ * Today only `parse-error` emits it. The item carries the same facts as the
+ * `source-parse-degraded` entry in `workspace_diagnostics[]` for that file,
+ * so a consumer can act on the gate without a join.
+ */
+export interface GateFile {
+/**
+ * The file path, relative to the project root, with `/` separators.
+ */
+path: string
+/**
+ * The number of parser errors for the file.
+ */
+error_count: number
+/**
+ * True when the parser stopped in the file instead of recovering, so the
+ * analysis saw only the part before the error.
+ */
+panicked: boolean
 }
 /**
  * Metric and rule definitions emitted under `_meta` when `--explain` is
@@ -2614,6 +2718,12 @@ unused_types: UnusedTypeFinding[]
  * typed `actions` array natively.
  */
 private_type_leaks: PrivateTypeLeakFinding[]
+/**
+ * Exports marked `@deprecated` that still have at least one consumer in
+ * a reachable file. Wrapped in [`DeprecatedExportInUseFinding`]. Opt-in: the
+ * `deprecated-exports-in-use` rule defaults to `off`.
+ */
+deprecated_exports_in_use?: DeprecatedExportInUseFinding[]
 /**
  * Dependencies listed in package.json but never imported. Wrapped in
  * [`UnusedDependencyFinding`] so each entry carries a typed `actions`
@@ -2941,13 +3051,13 @@ baseline_staleness?: (BaselineStaleness | null)
  */
 regression?: (RegressionResult | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -3066,6 +3176,10 @@ unused_types: number
  * Public exports whose signature references same-file private types.
  */
 private_type_leaks: number
+/**
+ * Exports marked `@deprecated` that are still referenced.
+ */
+deprecated_exports_in_use: number
 /**
  * Combined count of unused entries across `dependencies`,
  * `devDependencies`, and `optionalDependencies`. The per-section
@@ -3247,6 +3361,13 @@ actions: IssueAction[]
  * the merge-base. `None` when serialized directly from Rust.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the reachability verdict behind this finding.
  * Sorted, deduplicated, and omitted from the wire when empty, so a run
@@ -3450,6 +3571,17 @@ span_start: number
  * Whether this finding comes from a barrel/index re-export rather than the source definition.
  */
 is_re_export: boolean
+/**
+ * Whether the export's leading JSDoc carries `@deprecated`. Absent from
+ * the wire when false.
+ */
+deprecated?: boolean
+/**
+ * Plain-text message of the `@deprecated` tag, capped at
+ * [`DEPRECATED_REASON_MAX_CHARS`] characters. Absent when the export is
+ * not deprecated or the tag carries no text.
+ */
+deprecated_reason?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3464,6 +3596,13 @@ semantic?: (SemanticCandidateDecision | null)
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the reachability verdict behind this finding.
  * Sorted, deduplicated, and omitted from the wire when empty. Never gates
@@ -3507,6 +3646,17 @@ span_start: number
  * Whether this finding comes from a barrel/index re-export rather than the source definition.
  */
 is_re_export: boolean
+/**
+ * Whether the export's leading JSDoc carries `@deprecated`. Absent from
+ * the wire when false.
+ */
+deprecated?: boolean
+/**
+ * Plain-text message of the `@deprecated` tag, capped at
+ * [`DEPRECATED_REASON_MAX_CHARS`] characters. Absent when the export is
+ * not deprecated or the tag carries no text.
+ */
+deprecated_reason?: (string | null)
 /**
  * Suggested next steps. Always emitted (possibly empty for
  * forward-compat).
@@ -3521,6 +3671,13 @@ semantic?: (SemanticCandidateDecision | null)
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the reachability verdict behind this finding.
  * A type export rests on exactly the reachability test an
@@ -3575,6 +3732,103 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
+}
+/**
+ * Wire-shape envelope for a [`DeprecatedExportInUse`] finding. Carries a
+ * manual `migrate-deprecated-export` primary action plus a `suppress-line`
+ * secondary. Never auto-fixable: fallow does not rewrite consumers.
+ */
+export interface DeprecatedExportInUseFinding {
+/**
+ * File that declares the deprecated export.
+ */
+path: string
+/**
+ * Name of the deprecated export.
+ */
+export_name: string
+/**
+ * Whether this is a type-only export.
+ */
+is_type_only: boolean
+/**
+ * 1-based line number of the export.
+ */
+line: number
+/**
+ * 0-based byte column offset of the export.
+ */
+col: number
+/**
+ * Byte offset of the export in the source file.
+ */
+span_start: number
+/**
+ * Plain-text message of the `@deprecated` tag, capped at
+ * [`DEPRECATED_REASON_MAX_CHARS`] characters. Absent when the tag
+ * carries no text.
+ */
+deprecated_reason?: (string | null)
+/**
+ * Exact number of distinct consumers: reference sites in reachable
+ * files, one per path, line, column and kind. `consumers` holds the
+ * first [`DEPRECATED_CONSUMER_SAMPLE_CAP`] of them, so the sample is
+ * complete when this count is at most the cap.
+ */
+consumer_count: number
+/**
+ * Consumer sample sorted by path, line, column and kind, capped at
+ * [`DEPRECATED_CONSUMER_SAMPLE_CAP`] entries.
+ */
+consumers: DeprecatedExportConsumer[]
+/**
+ * True when the export is part of the public API: it lives in an entry
+ * point, or a re-export chain reaches an entry point. External consumers
+ * are not visible, so the finding makes no removal claim.
+ */
+public_api: boolean
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
+}
+/**
+ * One file location that references a deprecated export.
+ */
+export interface DeprecatedExportConsumer {
+/**
+ * File that references the deprecated export.
+ */
+path: string
+/**
+ * 1-based line number of the import or re-export statement.
+ */
+line: number
+/**
+ * 0-based byte column offset of the import or re-export statement.
+ */
+col: number
+kind: DeprecatedConsumerKind
 }
 /**
  * Wire-shape envelope for an [`UnusedDependency`] finding consumed under
@@ -3612,6 +3866,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A dependency is
  * reported unused when NO module in the project imports its specifier,
@@ -3658,6 +3919,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A dependency is
  * reported unused when NO module in the project imports its specifier,
@@ -3704,6 +3972,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A dependency is
  * reported unused when NO module in the project imports its specifier,
@@ -3750,6 +4025,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A member's usage
  * is collected by walking the member accesses of every module the run
@@ -3802,6 +4084,13 @@ semantic?: (SemanticCandidateDecision | null)
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A class member's
  * usage is collected by the same reachability-free member-access walk an
@@ -3855,6 +4144,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * Advisory caveats on the verdict behind this finding. A store member's
  * usage is collected by the same reachability-free member-access walk a
@@ -3905,6 +4201,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnlistedDependency`] finding. Carries an
@@ -3931,6 +4234,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * A location where an import occurs.
@@ -3981,6 +4291,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * A location where a duplicate export appears.
@@ -4027,6 +4344,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`TestOnlyDependency`] finding. Carries a
@@ -4057,6 +4381,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`DevDependencyInProduction`] finding. Carries a
@@ -4088,6 +4419,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`CircularDependency`] finding. Mirrors
@@ -4135,6 +4473,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * One import hop in a circular dependency: the file containing the import
@@ -4190,6 +4535,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`BoundaryViolation`] finding. Mirrors
@@ -4236,6 +4588,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`BoundaryCoverageViolation`] finding. Carries
@@ -4264,6 +4623,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`BoundaryCallViolation`] finding. Carries
@@ -4305,6 +4671,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`PolicyViolation`] finding. Carries actions for
@@ -4382,6 +4755,13 @@ missing_reason?: boolean
  * Suggested next steps. Always emitted.
  */
 actions: IssueAction[]
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedCatalogEntry`] finding. Per-instance
@@ -4422,6 +4802,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`EmptyCatalogGroup`] finding. Carries a
@@ -4450,6 +4837,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnresolvedCatalogReference`] finding. The
@@ -4500,6 +4894,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedDependencyOverride`] finding. Carries
@@ -4562,6 +4963,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`MisconfiguredDependencyOverride`] finding.
@@ -4611,6 +5019,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`InvalidClientExport`] finding. There is no safe
@@ -4652,6 +5067,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`MixedClientServerBarrel`] finding. There is no
@@ -4693,6 +5115,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`MisplacedDirective`] finding. There is no safe
@@ -4729,6 +5158,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnprovidedInject`] finding. There is no safe
@@ -4767,6 +5203,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnrenderedComponent`] finding. There is no safe
@@ -4816,6 +5259,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`RouteCollision`] finding. A route collision is a
@@ -4858,6 +5308,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`DynamicSegmentNameConflict`] finding. The
@@ -4904,6 +5361,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentProp`] finding. There is no safe
@@ -4942,6 +5406,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentEmit`] finding. There is no safe
@@ -4980,6 +5451,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentInput`] finding. There is no safe
@@ -5018,6 +5496,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedComponentOutput`] finding. There is no safe
@@ -5056,6 +5541,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedSvelteEvent`] finding. There is no safe
@@ -5095,6 +5587,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedServerAction`] finding. There is no safe
@@ -5129,6 +5628,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for an [`UnusedLoadDataKey`] finding. There is no safe
@@ -5169,6 +5675,13 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`PropDrillingChain`] finding. There is no safe
@@ -5203,6 +5716,14 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Rule severity of this finding. This type never gates the run, so the
+ * value does not change the exit code. `fallow report --from` reads it
+ * for the SARIF level, so the level does not depend on the config at
+ * render time. Absent in output from older versions. Not part of the
+ * finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * One hop in a prop-drilling chain: a component that received the prop and
@@ -5260,6 +5781,14 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Rule severity of this finding. This type never gates the run, so the
+ * value does not change the exit code. `fallow report --from` reads it
+ * for the SARIF level, so the level does not depend on the config at
+ * render time. Absent in output from older versions. Not part of the
+ * finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * Wire-shape envelope for a [`DuplicatePropShape`] finding. There is no safe
@@ -5310,6 +5839,14 @@ actions: IssueAction[]
  * the merge-base.
  */
 introduced?: (AuditIntroduced | null)
+/**
+ * Rule severity of this finding. This type never gates the run, so the
+ * value does not change the exit code. `fallow report --from` reads it
+ * for the SARIF level, so the level does not depend on the config at
+ * render time. Absent in output from older versions. Not part of the
+ * finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
 }
 /**
  * One member of a duplicate-prop-shape group: the OTHER components that share
@@ -5483,6 +6020,19 @@ moved_entries: number
  * existed gets, which is why the keys remain the fallback.
  */
 unrecognised_format?: boolean
+/**
+ * The command that saved the loaded file, when `unrecognised_format` is
+ * true and the file names a writer this version knows: `dead-code`,
+ * `dupes` or `health`, the token the file carries in its top-level `kind`.
+ *
+ * Absent, never null, for this command's own baseline, for a file that
+ * names no writer (an empty file, or a baseline saved before `kind`
+ * existed) and for a `kind` token this version does not know. The value
+ * set is OPEN: a later release can add a writer, so treat an unknown value
+ * as "another command". The CLI computes it once per loaded baseline and
+ * uses the same value for its stderr note.
+ */
+saved_by?: string
 /**
  * Which channels narrowed this run, present and non-empty exactly when
  * `change_scoped` is true. Both members are derived from one function, so
@@ -5566,9 +6116,10 @@ reason?: (string | null)
  * whole object narrows the report tells its reader an unwritten SARIF file
  * widened the analysis, which is what `affects` exists to prevent.
  *
- * `scope_size` is emitted for `diff-filter` only today, in added lines. A
- * consumer reads the unit off the name, so a name that starts measuring its
- * own scope in a later release needs no change here.
+ * `scope_size` is emitted for `diff-filter`, in added lines, and for
+ * `changed-since`, in changed files that the run analyzed. `sarif-file`
+ * measures no scope. A consumer reads the unit off the name, so a name that
+ * starts to measure its own scope in a later release needs no change here.
  *
  * `invalid-ref` is reachable only through the programmatic API. The
  * `--changed-since` flag validates its value before a run starts and fails
@@ -5591,7 +6142,8 @@ affects: RequestEffect
 /**
  * What was asked, as the user spelled it: the git ref for
  * `changed-since`, the diff source label (`--diff-file pr.diff`,
- * `--diff-stdin`, `$FALLOW_DIFF_FILE build/pr.diff`) for `diff-filter`,
+ * `--diff-stdin`, `$FALLOW_DIFF_FILE build/pr.diff`, or
+ * `diffFile pr.diff` for the programmatic option) for `diff-filter`,
  * the target path for `sarif-file`. Echoed rather than normalised, so a
  * consumer must not join it to the project root the way it joins every
  * other path-shaped field.
@@ -5604,9 +6156,14 @@ requested: string
  * number there would describe a scope nobody applied.
  *
  * The unit belongs to the name. `diff-filter` counts added lines, which is
- * what its filter keeps a finding for. Read the unit off the name the entry
- * is keyed under, never across names, and read an absent member as "not
- * measured" rather than as zero.
+ * what its filter keeps a finding for. `changed-since` counts changed
+ * files that the run analyzed: a changed file that discovery or an ignore
+ * rule dropped does not count, so a change to a README only gives `0`. A
+ * combined run counts a file that any of its analyses kept, because a
+ * per-analysis `production` setting can give its analyses different
+ * files.
+ * Read the unit off the name the entry is keyed under, never across names,
+ * and read an absent member as "not measured" rather than as zero.
  *
  * The count is what the run INDEXED rather than the true total:
  * `diff-filter` indexes at most one million added lines and reports that
@@ -6201,6 +6758,14 @@ react_prop_count?: number
 react_hook_profile?: (ReactHookProfile | null)
 exceeded: ExceededThreshold
 severity: FindingSeverity
+/**
+ * Gate severity after the `complexity-*` rules and their
+ * `overrides[].rules` entries: `error` fails the run, `warn` does not.
+ * The most severe rule of the kinds in `exceeded` wins. It is separate
+ * from the band in `severity`, which ranks the finding and does not gate
+ * it. Absent in reports from older versions.
+ */
+effective_severity?: (EffectiveSeverity | null)
 /**
  * CRAP score (change risk anti-pattern), when coverage data exists.
  */
@@ -6507,6 +7072,11 @@ average_maintainability?: (number | null)
  * Coverage model behind the CRAP scores, when coverage was used.
  */
 coverage_model?: (CoverageModel | null)
+/**
+ * Input format of the measured coverage (`istanbul` or `v8`). Present
+ * only with `coverage_model: "istanbul"`.
+ */
+coverage_input_format?: (CoverageInputFormat | null)
 /**
  * Whether CRAP findings mix coverage sources.
  */
@@ -7510,8 +8080,8 @@ watermark?: (RuntimeCoverageWatermark | null)
  */
 warnings?: RuntimeCoverageMessage[]
 /**
- * Whether an autonomous agent may act on this report (fallow-rs/fallow-cloud#316,
- * mirrors the cloud runtime-context contract). `false` when the capture
+ * Whether an autonomous agent may act on this report (mirrors
+ * the cloud runtime-context contract). `false` when the capture
  * carries no usable runtime evidence (no tracked functions); then
  * `actionability_verdict` is `insufficient_evidence` and
  * `actionability_reason` explains. F4: a non-action floor, never a gate on a
@@ -7741,7 +8311,7 @@ description: string
 auto_fixable: boolean
 }
 /**
- * Discriminator inputs that PRODUCED a finding's verdict (fallow-rs/fallow-cloud#321),
+ * Discriminator inputs that PRODUCED a finding's verdict,
  * emitted alongside the verdict so an agent can reproduce it and see the
  * minimum-observation confidence cap instead of re-deriving them from scratch.
  * F4: these make the EXISTING Fallow-owned discriminators legible; they are not
@@ -7830,6 +8400,48 @@ percentile: number
  * when empty.
  */
 actions?: RuntimeCoverageAction[]
+/**
+ * Per-call cost inputs and the speed-work score for this hot function.
+ * Omitted when the hot path has no `stable_id` or no static counterpart
+ * in this checkout.
+ */
+optimization_target?: (RuntimeCoverageOptimizationTarget | null)
+}
+/**
+ * Speed-work inputs for one hot function: how often it runs and how much
+ * work each call does. `importance` ranks the risk of a change; this block
+ * ranks where speed work gives the largest gain.
+ */
+export interface RuntimeCoverageOptimizationTarget {
+/**
+ * `invocations` multiplied by the per-call cost that `cost_basis` names.
+ * Uncapped integer. Compare it only between hot paths with the same
+ * `cost_basis`: sort by `cost_basis` first, then by `cost_score`
+ * descending. On the `cognitive` basis the per-call cost is at least 1.
+ */
+cost_score: number
+cost_basis: RuntimeCoverageCostBasis
+/**
+ * Static cognitive complexity of the function. A static proxy for the
+ * work per call, not a measurement.
+ */
+cognitive: number
+/**
+ * Static cyclomatic complexity of the function.
+ */
+cyclomatic: number
+/**
+ * Number of lines in the function body.
+ */
+line_count: number
+/**
+ * Peak executions of one block inside the function per call, from V8
+ * block coverage. `1.0` means no block ran more than once per call. A
+ * loop body that runs 3 times per call gives `3.0`. Calls to other
+ * functions do not change the value.
+ * Omitted when the coverage input has no block counts for the function.
+ */
+inner_iterations_per_call?: (number | null)
 }
 /**
  * One blast-radius entry in `runtime_coverage.blast_radius`: how far a
@@ -7937,7 +8549,7 @@ code: string
 message: string
 }
 /**
- * Provenance of a runtime-coverage report (fallow-rs/fallow-cloud#319), mirroring
+ * Provenance of a runtime-coverage report, mirroring
  * the cloud runtime-context `provenance` block so the local-capture and cloud
  * surfaces present one portable shape. F4: provenance is context only; it never
  * gates a verdict or confidence.
@@ -10137,6 +10749,12 @@ imported_by: string[]
  * Re-exports declared by this file.
  */
 re_exports: TracedReExport[]
+/**
+ * The configs that make this file an entry point through Module
+ * Federation `exposes`, one per config. Absent when no Federation config
+ * exposes the file (issue #2796).
+ */
+sources?: TraceSource[]
 }
 /**
  * An export with usage information.
@@ -10176,6 +10794,37 @@ imported_name: string
  */
 exported_name: string
 }
+/**
+ * A config that names a traced file or a traced dependency, and the key that
+ * names it.
+ */
+export interface TraceSource {
+/**
+ * The mechanism that names the file or the dependency:
+ * `module-federation`. The set is open.
+ */
+kind: string
+/**
+ * The plugin that read the config, as it labels itself:
+ * `module-federation` for a standalone `module-federation.config.*`,
+ * or the bundler plugin (`webpack`, `rspack`, `rsbuild`, `vite`,
+ * `nextjs`) that read the same options inline from its own config.
+ */
+plugin: string
+/**
+ * The file that names the file or the dependency, relative to the
+ * project root: the config file, or the source file of a Module
+ * Federation runtime call.
+ */
+config: string
+/**
+ * The config key or the runtime function that names the file or the
+ * dependency: `exposes` for an exposed file, `remotes` for a remote
+ * alias, and `registerRemotes`, `loadRemote`, `init` or `createInstance`
+ * for a remote that a runtime call names. The set is open.
+ */
+key: string
+}
 /**
  * Result of tracing a dependency: where it is used.
  */
@@ -10204,6 +10853,13 @@ is_used: boolean
  * Total import count.
  */
 import_count: number
+/**
+ * The configs that declare this name as a Module Federation remote alias
+ * under `remotes`, one per config. A remote alias is provided by a
+ * remote container at runtime, not by an npm package. Absent when no
+ * Federation config declares the name (issue #2796).
+ */
+sources?: TraceSource[]
 }
 /**
  * Result of tracing a clone: all groups containing the code at a source
@@ -10349,6 +11005,13 @@ to: string
  * chain is a real compile-time coupling.
  */
 type_only: boolean
+/**
+ * Whether the edge carries a runtime value but no static one: the target
+ * loads only on demand (`import()`, a lazy glob or template pattern) or
+ * on another thread (a worker URL, `child_process.fork`). False for a
+ * static hop and for a type-only hop.
+ */
+dynamic: boolean
 /**
  * 1-based line in `from` of the imported binding that creates this edge:
  * the first value-carrying symbol on the import, or the first symbol when
@@ -11296,13 +11959,13 @@ grouped_by?: (GroupByMode | null)
  */
 groups?: (HealthGroup[] | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -11499,13 +12162,11 @@ groups?: (DuplicationGroup[] | null)
  */
 baseline_staleness?: (BaselineStaleness | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run armed, keyed by name, absent when
+ * it armed none. `dupes` has no default exit rule: a run with no armed
+ * gate always exits 0, so an absent object means that the run passed. A
+ * gate fails the build when `status` is `fail` AND `enforced` is true.
+ * See [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -11686,13 +12347,13 @@ groups: CheckGroupedEntry[]
  */
 baseline_staleness?: (BaselineStaleness | null)
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -11764,6 +12425,12 @@ unused_types: UnusedTypeFinding[]
  * typed `actions` array natively.
  */
 private_type_leaks: PrivateTypeLeakFinding[]
+/**
+ * Exports marked `@deprecated` that still have at least one consumer in
+ * a reachable file. Wrapped in [`DeprecatedExportInUseFinding`]. Opt-in: the
+ * `deprecated-exports-in-use` rule defaults to `off`.
+ */
+deprecated_exports_in_use?: DeprecatedExportInUseFinding[]
 /**
  * Dependencies listed in package.json but never imported. Wrapped in
  * [`UnusedDependencyFinding`] so each entry carries a typed `actions`
@@ -12375,13 +13042,13 @@ version: ToolVersion
 elapsed_ms: ElapsedMs
 config: SecurityOutputConfig
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -12488,10 +13155,10 @@ new_count: number
 export interface SecurityFinding {
 /**
  * Stable per-finding correlation id, identical across runs for the same
- * rule + anchor path + line. An autonomous agent that triaged this
+ * rule + anchor path + line + column. An autonomous agent that triaged this
  * candidate on a prior run uses it to correlate the candidate after a
- * rebase. Equal to the SARIF `partialFingerprints` value for the same
- * finding (one shared helper computes both).
+ * rebase. Equal to the SARIF `partialFingerprints["fallowSecurity/v2"]`
+ * value for the same finding (one shared helper computes both).
  */
 finding_id: string
 kind: SecurityFindingKind
@@ -12909,7 +13576,8 @@ defensive_boundary: SecurityDefensiveBoundary
  */
 export interface SecurityDefensiveBoundary {
 /**
- * Known controls detected along this path.
+ * Control patterns observed in files on this import trace. These are
+ * verification hints, not proof of sink protection or value-level data flow.
  */
 controls: SecurityDefensiveControl[]
 /**
@@ -12919,7 +13587,9 @@ controls: SecurityDefensiveControl[]
 verification_prompt: string
 }
 /**
- * Defensive control found on an attack-surface path.
+ * Control pattern observed in a file on an attack-surface import trace.
+ * Its presence does not prove that it executes before the sink or protects
+ * the same input.
  */
 export interface SecurityDefensiveControl {
 kind: SecurityControlKind
@@ -13018,13 +13688,13 @@ version: ToolVersion
 elapsed_ms: ElapsedMs
 config: SecurityOutputConfig
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -13321,13 +13991,17 @@ schema_version: CombinedSchemaVersion
 version: ToolVersion
 elapsed_ms: ElapsedMs
 /**
- * Every gate this run ARMED, keyed by name, absent when it armed none.
- * Each entry is the same rule that decides the exit code, so a CI
- * integration reads the verdict instead of guessing from a process status
- * it usually cannot see. A gate fails the build when `status` is `fail`
- * AND `enforced` is true. Armed, not evaluated: fallow's default severity
- * rules fail a run with no flag at all, so an absent object means "no gate
- * was asked for", never "nothing failed". See [`crate::GateOutcomes`].
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the default exit rule of each section that ran
+ * (`error-severity-findings`, `health-findings`). The machine formats of
+ * the combined run exit 0 for findings, so most entries have `enforced:
+ * false`. For the default exit rules (`error-severity-findings`,
+ * `health-findings`), `status` gives the verdict of the human run. An
+ * advisory entry can report `fail` without a failure of the human run: an
+ * example is a `stale-baseline` entry that `--fail-on-stale-baseline` did
+ * not arm. A gate fails the build when `status` is `fail` AND `enforced`
+ * is true. The typed
+ * programmatic API leaves it absent. See [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -13351,7 +14025,7 @@ check?: (CheckOutput | null)
 /**
  * Duplication section of the combined run.
  */
-dupes?: (DupesReportPayload | null)
+dupes?: (CombinedDupesSection | null)
 /**
  * Health section of the combined run.
  */
@@ -13393,11 +14067,46 @@ health?: (Meta | null)
 telemetry?: (TelemetryMeta | null)
 }
 /**
- * Envelope emitted by `fallow flags --format json`.
+ * Wire shape of the `dupes` section inside the bare combined envelope.
+ *
+ * The section is the standalone payload plus the view of the loaded
+ * duplication baseline. The standalone `dupes` envelope carries the same
+ * `baseline_staleness` key at its root.
  */
-export interface FeatureFlagsOutput {
-schema_version: FeatureFlagsSchemaVersion
-version: ToolVersion
+export interface CombinedDupesSection {
+/**
+ * All detected clone groups, each wrapped with typed actions.
+ */
+clone_groups: CloneGroupFinding[]
+/**
+ * Clone families, each wrapped with typed actions. Inner `groups`
+ * inside each `CloneFamilyFinding` are themselves wrapped as
+ * `CloneGroupFinding` entries carrying their own `actions[]` (and
+ * optional audit-mode `introduced` flag), so JSON-Schema strict
+ * consumers and TS consumers reading `clone_families[].groups[]` see
+ * the same shape as the top-level `clone_groups[]` array (preserves
+ * the issue #393 regression contract).
+ */
+clone_families: CloneFamilyFinding[]
+/**
+ * Mirrored directory pairs.
+ */
+mirrored_directories?: MirroredDirectory[]
+stats: DuplicationStats
+/**
+ * This run's view of the loaded duplication baseline, present only when
+ * `--dupes-baseline` loaded one. Read `change_scoped` before dividing
+ * `matched_entries` by `baseline_entries`: a narrowed run can report
+ * `matched_entries: 0` on a healthy baseline.
+ */
+baseline_staleness?: (BaselineStaleness | null)
+}
+/**
+ * Envelope emitted by `fallow flags --format json`.
+ */
+export interface FeatureFlagsOutput {
+schema_version: FeatureFlagsSchemaVersion
+version: ToolVersion
 elapsed_ms: ElapsedMs
 /**
  * What the run was asked to narrow and whether it did. See
@@ -13441,6 +14150,15 @@ total_flags: number
  * change.
  */
 workspace_diagnostics?: WorkspaceDiagnostic[]
+/**
+ * One row per flag with the reasons the flag can be retired.
+ *
+ * Present only with `--retirement`. Without that option the key is
+ * omitted, so the envelope stays byte-identical and `schema_version`
+ * does not move. The per-site `feature_flags[]` array is the same with
+ * and without the option.
+ */
+retirement?: (FlagRetirementReport | null)
 /**
  * `_meta` block; see [`FeatureFlagsMeta`].
  */
@@ -13516,6 +14234,347 @@ dead_export_count: number
  */
 dead_exports: string[]
 }
+/**
+ * The `retirement` block of `fallow flags --retirement --format json`.
+ */
+export interface FlagRetirementReport {
+/**
+ * The analysis clock that ages count from, as an RFC 3339 UTC
+ * timestamp. `null` when the age mode is `off`, and also when no git
+ * history is available: outside a repository, on a branch without
+ * commits, or in a shallow clone. A `workspace_diagnostics` entry then
+ * gives the reason.
+ */
+generated_at_clock?: (string | null)
+age_mode: FlagAgeMode
+/**
+ * The vendor export that the report read. Present only with
+ * `--flag-state`.
+ */
+vendor_state?: (RetirementVendorState | null)
+summary: RetirementSummary
+/**
+ * Verdict of `--fail-on-regression` against a flags regression
+ * baseline. Present only when the gate ran.
+ */
+regression?: (FlagRegressionResult | null)
+/**
+ * Verdict of `--max-flag-age`. Present only with that option.
+ */
+max_flag_age?: (FlagAgeGate | null)
+/**
+ * One row per flag after the `--min-age`, `--reason`, `--sort` and
+ * `--top` options. A row with an empty `reasons` array is not a
+ * candidate.
+ */
+flags: RetirementFlag[]
+}
+/**
+ * The `--flag-state` vendor export that the report read.
+ */
+export interface RetirementVendorState {
+/**
+ * The vendor name from the export, for example `launchdarkly`.
+ */
+source: string
+/**
+ * When the export was made, as the export gives it.
+ */
+exported_at: string
+/**
+ * Days between `exported_at` and the analysis clock. `null` when the
+ * date cannot be read.
+ */
+export_age_days?: (number | null)
+/**
+ * Number of flags in the export.
+ */
+flags: number
+}
+/**
+ * Totals of the retirement report.
+ */
+export interface RetirementSummary {
+/**
+ * Distinct flags in the code in scope, before `--min-age` and
+ * `--reason`. The `vendor-only` rows of a `--flag-state` export do not
+ * count here, so the count does not change when a key is added in the
+ * vendor only. `by_reason` counts them.
+ */
+distinct_flags: number
+/**
+ * Rows in scope with at least one reason, `vendor-only` rows included.
+ */
+candidates: number
+/**
+ * Number of rows in scope per reason.
+ */
+by_reason: {
+[k: string]: number
+}
+}
+/**
+ * Verdict of the flags regression gate.
+ */
+export interface FlagRegressionResult {
+status: RegressionStatus
+/**
+ * The `--tolerance` value. Absent when the status is `skipped`.
+ */
+tolerance?: (number | null)
+/**
+ * How to read `tolerance`. Absent when the status is `skipped`.
+ */
+tolerance_kind?: (RegressionToleranceKind | null)
+/**
+ * The compared counts: `distinct_flags` first, then each `--reason`
+ * code. Empty when the status is `skipped`.
+ */
+metrics: FlagRegressionMetric[]
+/**
+ * Whether one count grew more than the tolerance.
+ */
+exceeded: boolean
+/**
+ * Why the gate did not run. Present only when the status is `skipped`.
+ */
+reason?: (string | null)
+}
+/**
+ * One count that the flags regression gate compares.
+ */
+export interface FlagRegressionMetric {
+/**
+ * `distinct_flags`, or a reason code from `--reason`.
+ */
+metric: string
+/**
+ * The count in the baseline.
+ */
+baseline: number
+/**
+ * The count in this run.
+ */
+current: number
+/**
+ * `current - baseline`.
+ */
+delta: number
+/**
+ * Whether the growth is more than the tolerance.
+ */
+exceeded: boolean
+}
+/**
+ * Verdict of `--max-flag-age`.
+ */
+export interface FlagAgeGate {
+status: RegressionStatus
+/**
+ * The `--max-flag-age` value in days.
+ */
+max_days: number
+/**
+ * Whether one flag in scope is older than `max_days`.
+ */
+exceeded: boolean
+/**
+ * Flags in the code in scope without a measured age. The gate cannot
+ * check these flags.
+ */
+unmeasured: number
+/**
+ * Why the gate did not run. Present only when the status is `skipped`.
+ */
+reason?: (string | null)
+/**
+ * The flags in scope that are older than `max_days`, oldest first.
+ * The `--reason`, `--min-age` and `--top` options do not change this
+ * list.
+ */
+flags: FlagAgeGateEntry[]
+}
+/**
+ * A flag that is older than `--max-flag-age`.
+ */
+export interface FlagAgeGateEntry {
+/**
+ * Flag identifier.
+ */
+flag_name: string
+kind: RetirementFlagKind
+/**
+ * Flag SDK, for SDK flags with a known provider.
+ */
+sdk_name?: (string | null)
+/**
+ * Workspace root of the flag, in a project with workspaces.
+ */
+workspace?: (string | null)
+/**
+ * Age of the flag in days.
+ */
+age_days: number
+}
+/**
+ * One flag in the retirement report.
+ */
+export interface RetirementFlag {
+/**
+ * Flag identifier.
+ */
+flag_name: string
+kind: RetirementFlagKind
+/**
+ * Flag SDK, for SDK flags with a known provider.
+ */
+sdk_name?: (string | null)
+/**
+ * Workspace root relative to the analysed root, when the project has
+ * workspaces and the flag is inside one. Part of the flag identity.
+ */
+workspace?: (string | null)
+/**
+ * Every site of the flag, sorted by path, line and column.
+ */
+sites: RetirementSite[]
+/**
+ * Number of sites in this row that read the flag.
+ */
+read_sites: number
+/**
+ * Whether every read site is in a test, story or mock file. Read sites
+ * of the same flag in other workspaces count too.
+ */
+test_only: boolean
+/**
+ * First commit that added the flag name. Set in `pickaxe` mode only.
+ */
+first_seen?: (FlagCommit | null)
+/**
+ * Oldest commit among the lines that still hold the flag.
+ */
+oldest_surviving_site?: (FlagCommit | null)
+/**
+ * Newest commit among the lines that still hold the flag.
+ */
+last_touched?: (FlagCommit | null)
+/**
+ * Days between the flag's oldest known commit and the analysis clock.
+ * In `blame` mode this is a lower bound.
+ */
+age_days?: (number | null)
+/**
+ * Retirement reasons, in report order. Empty for a flag that is not a
+ * candidate.
+ */
+reasons: RetirementReason[]
+/**
+ * Evidence for each reason.
+ */
+evidence: RetirementEvidence[]
+/**
+ * Follow-up actions. Empty for a flag that is not a candidate.
+ */
+actions: RetirementAction[]
+/**
+ * The vendor state of the flag. Present only with `--flag-state`, for
+ * a flag whose key is in the export.
+ */
+vendor?: (RetirementVendor | null)
+}
+/**
+ * One site of a flag in the retirement report.
+ */
+export interface RetirementSite {
+/**
+ * File path relative to the analysed root.
+ */
+path: string
+/**
+ * 1-based line.
+ */
+line: number
+/**
+ * 0-based byte column.
+ */
+col: number
+role: FlagSiteRole
+/**
+ * Whether the file is a test, story or mock file.
+ */
+in_test: boolean
+}
+/**
+ * A commit that git history links to a flag.
+ */
+export interface FlagCommit {
+/**
+ * Abbreviated commit hash.
+ */
+commit: string
+/**
+ * Commit date in UTC, as `YYYY-MM-DD`.
+ */
+date: string
+}
+/**
+ * One piece of evidence for a retirement reason.
+ */
+export interface RetirementEvidence {
+reason: RetirementReason
+/**
+ * File path relative to the analysed root. For `vendor-only`, the path
+ * of the `--flag-state` file: relative to the root when the file is
+ * inside it, else as given.
+ */
+path: string
+/**
+ * 1-based line.
+ */
+line: number
+/**
+ * What the evidence shows.
+ */
+detail: string
+}
+/**
+ * A follow-up action for a retirement candidate.
+ */
+export interface RetirementAction {
+type: RetirementActionType
+/**
+ * Always `false`: Fallow never removes a flag.
+ */
+auto_fixable: boolean
+/**
+ * Human-readable action description.
+ */
+description: string
+}
+/**
+ * The vendor state of one flag in the retirement report.
+ */
+export interface RetirementVendor {
+/**
+ * The key in the vendor export, before `flags.vendorKeyPrefix` is
+ * removed.
+ */
+key: string
+state: VendorFlagState
+/**
+ * Whether the flag serves one variation, when the export says so.
+ */
+serves_single_variation?: (boolean | null)
+/**
+ * When the vendor created the flag, as the export gives it.
+ */
+created_at?: (string | null)
+/**
+ * When the vendor last evaluated the flag, as the export gives it.
+ */
+last_evaluated_at?: (string | null)
+}
 /**
  * Optional `_meta` block for [`FeatureFlagsOutput`]. Both fields are optional
  * because the two contributors are independent: `feature_flags` details are
@@ -13637,6 +14696,11 @@ deltas: ReviewDeltas
  */
 weakening: WeakeningSignal[]
 routing: RoutingFacts
+/**
+ * Owner-group reach from the CODEOWNERS file. Absent when no CODEOWNERS
+ * file is found or the file cannot be read.
+ */
+ownership?: (OwnershipFacts | null)
 /**
  * Dead-code findings scoped to the audit changeset.
  */
@@ -14116,6 +15180,96 @@ expert: string[]
  */
 bus_factor_one?: boolean
 }
+/**
+ * How far a changeset reaches across CODEOWNERS owner groups.
+ *
+ * Computed from the CODEOWNERS file alone: no git history is read, so the
+ * section is present whenever a CODEOWNERS file is found, also when the churn
+ * walk behind `routing` finds nothing. Each file maps to its primary owner
+ * (the first owner of the last matching rule). A file that no rule matches,
+ * or that a GitLab negation rule matches, belongs to the `(unowned)` group.
+ * The owner strings use the same vocabulary as `routing.units[].expert`.
+ *
+ * Absent from the brief when no CODEOWNERS file is found, or when the file
+ * cannot be read or does not parse. A configured `codeowners` path that
+ * fails also prints a warning on stderr.
+ *
+ * `groups[].direct_count` counts all changed files, source or not, so the
+ * sum over all groups is the number of changed files, not the size of
+ * `impact_closure.in_diff`. Slice owners count only the files of the
+ * partition units, which are source files.
+ */
+export interface OwnershipFacts {
+/**
+ * Distinct owner groups across the changed files and the impact closure.
+ * The `(unowned)` group counts as one group. Exact, never capped.
+ */
+group_count: number
+/**
+ * Owner groups that own no changed file and appear only through the
+ * impact closure. Exact, never capped.
+ */
+transitive_only_count: number
+/**
+ * Changed files that belong to the `(unowned)` group.
+ */
+unowned_direct_count: number
+/**
+ * The owner groups, sorted by `direct_count` descending, then
+ * `affected_count` descending, then `owner`. At most [`OWNER_GROUP_CAP`]
+ * entries. The counts in each entry are exact.
+ */
+groups: OwnerGroupFact[]
+/**
+ * How many owner groups did not fit within [`OWNER_GROUP_CAP`] and are
+ * absent from `groups`. Zero when nothing was omitted.
+ */
+groups_omitted: number
+/**
+ * The owner set of each independent slice, aligned by index with
+ * `partition.independent_slices`. Present only when that list is present
+ * (two or more slices). A fact for the reviewer, never a demand to split.
+ */
+slices?: OwnershipSliceFact[]
+}
+/**
+ * One owner group and how many files of the changeset it owns.
+ */
+export interface OwnerGroupFact {
+/**
+ * The CODEOWNERS owner (`@user`, `@org/team`, or an email), or
+ * `(unowned)`.
+ */
+owner: string
+/**
+ * Changed files this group owns.
+ */
+direct_count: number
+/**
+ * Files of the impact closure (affected, not in the diff) this group owns.
+ */
+affected_count: number
+}
+/**
+ * The owners of one independent slice of the partition.
+ */
+export interface OwnershipSliceFact {
+/**
+ * The module directories of the slice, as in
+ * `partition.independent_slices`.
+ */
+module_dirs: string[]
+/**
+ * The distinct owners of the changed files in the slice, sorted. The
+ * `(unowned)` group is a distinct owner. Never empty.
+ */
+owners: string[]
+/**
+ * True when the slice has exactly one owner, so one owner group can
+ * review it on its own.
+ */
+separable: boolean
+}
 /**
  * The brief's branching section.
  */
@@ -14495,6 +15649,12 @@ deltas: ReviewDeltas
  */
 weakening: WeakeningSignal[]
 routing: RoutingFacts
+/**
+ * How far the change reaches across CODEOWNERS owner groups, computed
+ * from the CODEOWNERS file alone. Absent when no CODEOWNERS file is
+ * found or the file cannot be read.
+ */
+ownership?: (OwnershipFacts | null)
 decisions: DecisionSurface
 /**
  * Branching conservation across the changeset: total branching against
@@ -15742,6 +16902,16 @@ export type BoundaryViolation = BoundaryViolationFinding;
  */
 export type CircularDependency = CircularDependencyFinding;
 
+/**
+ * Backwards-compat alias for the pre-#384 bare `DeprecatedExportInUse` name.
+ * The wire shape is byte-identical: `DeprecatedExportInUseFinding` flattens the bare
+ * finding's fields via `#[serde(flatten)]` and adds `actions[]` plus
+ * the optional audit-mode `introduced` flag. Consumers that imported
+ * `DeprecatedExportInUse` from `fallow/types` pre-migration continue to work via
+ * this alias; new code should prefer `DeprecatedExportInUseFinding`.
+ */
+export type DeprecatedExportInUse = DeprecatedExportInUseFinding;
+
 /**
  * Backwards-compat alias for the pre-#384 bare `DevDependencyInProduction` name.
  * The wire shape is byte-identical: `DevDependencyInProductionFinding` flattens the bare