fallow 3.31.0 → 3.33.0

package/types/output-contract.d.ts

@@ -24,7 +24,7 @@
 
 
 /**
- * Schemas for the JSON output of fallow commands. Object-shaped envelopes covered by the `FallowOutput` contract carry a top-level `kind` discriminator. Current kind values: `audit`, `explain`, `inspect_target`, `trace`, `trace-error`, `review-envelope`, `review-reconcile`, `coverage-setup`, `coverage-analyze`, `list-boundaries`, `list-workspaces`, `health`, `dupes`, `dead-code-grouped`, `impact`, `impact-cross-repo`, `security`, `security-survivors`, `security-blind-spots`, `dead-code`, `combined`, `feature-flags`, `audit-brief`, `decision-surface`, `review-walkthrough-guide`, `review-walkthrough-validation`, `suppression-inventory`, `doctor`, `type-aware-status`, `similar-code`, `similar-code-inspect`, `similar-code-review`. Consumers should branch on `kind` instead of probing for unique field presence. `CodeClimateOutput` is a bare JSON array (per the Code Climate / GitLab Code Quality spec) and stays a sibling root branch discriminated by checking whether the document root is an array. `ErrorOutput` is the `--format json` failure document, emitted on stdout with a non-zero exit; it carries no `kind` and is discriminated by the `error: true` field.
+ * Schemas for the JSON output of fallow commands. Object-shaped envelopes covered by the `FallowOutput` contract carry a top-level `kind` discriminator. Current kind values: `audit`, `explain`, `inspect_target`, `trace`, `trace-error`, `review-envelope`, `review-reconcile`, `coverage-setup`, `coverage-analyze`, `list-boundaries`, `list-workspaces`, `health`, `dupes`, `dead-code-grouped`, `architecture-grouped`, `impact`, `impact-cross-repo`, `security`, `security-survivors`, `security-blind-spots`, `dead-code`, `architecture`, `combined`, `feature-flags`, `audit-brief`, `decision-surface`, `review-walkthrough-guide`, `review-walkthrough-validation`, `suppression-inventory`, `doctor`, `type-aware-status`, `similar-code`, `similar-code-inspect`, `similar-code-review`, `similar-code-status`, `similar-code-cache-clear`. Consumers should branch on `kind` instead of probing for unique field presence. `CodeClimateOutput` is a bare JSON array (per the Code Climate / GitLab Code Quality spec) and stays a sibling root branch discriminated by checking whether the document root is an array. `ErrorOutput` is the `--format json` failure document, emitted on stdout with a non-zero exit; it carries no `kind` and is discriminated by the `error: true` field.
  */
 export type FallowJsonOutput = (FallowOutput | CodeClimateOutput | ErrorOutput)
 /**
@@ -72,6 +72,8 @@ kind: "health"
 kind: "dupes"
 }) | (CheckGroupedOutput & {
 kind: "dead-code-grouped"
+}) | (ArchitectureGroupedOutput & {
+kind: "architecture-grouped"
 }) | ((ImpactReport | SemanticSymbolImpact) & {
 kind: "impact"
 }) | (CrossRepoImpactReport & {
@@ -84,6 +86,8 @@ kind: "security-survivors"
 kind: "security-blind-spots"
 }) | (CheckOutput & {
 kind: "dead-code"
+}) | (ArchitectureOutput & {
+kind: "architecture"
 }) | (CombinedOutput & {
 kind: "combined"
 }) | (FeatureFlagsOutput & {
@@ -108,11 +112,15 @@ kind: "similar-code"
 kind: "similar-code-inspect"
 }) | (SimilarCodeReviewOutput & {
 kind: "similar-code-review"
+}) | (SimilarCodeStatusOutput & {
+kind: "similar-code-status"
+}) | (SimilarCodeCacheClearOutput & {
+kind: "similar-code-cache-clear"
 }))
 /**
  * Schema projection for the audit envelope's exact version.
  */
-export type AuditSchemaVersion = 11
+export type AuditSchemaVersion = 12
 /**
  * Fallow CLI version that produced this envelope. Renders to the JSON wire as
  * a bare string (e.g. `"2.74.0"`).
@@ -204,7 +212,7 @@ export type TypeAwareAbstentionReason = ("no-project" | "ambiguous-project" | "b
 /**
  * Schema projection for the dead-code envelope's exact version.
  */
-export type CheckSchemaVersion = 9
+export type CheckSchemaVersion = 10
 /**
  * A suggested action attached to a finding in the JSON output. Each finding
  * carries an `actions` array; consumers (agents, IDE clients, CI bots) can
@@ -261,7 +269,7 @@ export type IssueAction = (FixAction | SuppressLineAction | SuppressFileAction |
  * Discriminant string for [`FixAction`]. Kebab-case per the JSON output
  * contract.
  */
-export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "migrate-deprecated-export" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
+export type FixActionType = ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "move-to-prod" | "refactor-cycle" | "refactor-re-export-cycle" | "refactor-boundary" | "export-type" | "migrate-deprecated-export" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override" | "resolve-policy-violation" | "move-to-server-module" | "split-mixed-barrel" | "hoist-directive" | "wire-server-action" | "provide-inject" | "use-load-data" | "render-component" | "use-component-prop" | "review-component-prop" | "emit-component-event" | "wire-svelte-event" | "resolve-route-collision" | "resolve-dynamic-segment-name-conflict" | "add-suppression-reason" | "remove-stale-suppression")
 /**
  * Singleton discriminant for [`SuppressLineAction`].
  */
@@ -380,7 +388,7 @@ export type ReExportCycleKind = ("multi-node" | "self-loop")
 /**
  * Which rule-pack rule kind produced a [`PolicyViolation`].
  */
-export type PolicyRuleKind = ("banned-call" | "banned-import" | "banned-effect" | "banned-export")
+export type PolicyRuleKind = ("banned-call" | "banned-import" | "banned-effect" | "banned-export" | "gdp-proof-producer")
 /**
  * Effective severity of a single [`PolicyViolation`]. Per-rule `severity`
  * overrides the `rules."policy-violation"` master; `off` rules emit nothing,
@@ -562,7 +570,7 @@ kind: "malformed-tsconfig"
 kind: "tsconfig-reference-dir-missing"
 } | {
 /**
- * `serde_yaml_ng` parse error text.
+ * YAML parse error text.
  */
 error: string
 kind: "malformed-pnpm-workspace-yaml"
@@ -602,8 +610,15 @@ kind: "bun-lockb-override-resolution-skipped"
 } | {
 kind: "bun-lock-override-resolution-skipped"
 } | {
+kind: "pnpm-lock-override-resolution-skipped"
+} | {
+kind: "npm-lock-override-resolution-skipped"
+} | {
 kind: "bun-resolutions-shadowed-by-overrides"
 } | {
+cause: PnpmWorkspaceOverridesIgnoredCause
+kind: "pnpm-workspace-overrides-ignored"
+} | {
 kind: "node-modules-missing"
 } | {
 kind: "boundaries-not-configured"
@@ -690,6 +705,13 @@ kind: "ownership-unavailable"
 error: string
 kind: "trend-snapshot-unreadable"
 } | {
+/**
+ * Why the groups have no baseline, as a kebab-case token:
+ * `snapshot-has-no-groups` or `grouped-by-mismatch`. The set is open.
+ */
+cause: string
+kind: "trend-group-baseline-unavailable"
+} | {
 /**
  * The plugin that read the config, as it labels itself:
  * `module-federation` for a standalone `module-federation.config.*`,
@@ -761,6 +783,11 @@ kind: "ignore-dependencies-glob-unmatched"
 pattern: string
 kind: "ignore-findings-pattern-unmatched"
 })
+/**
+ * Why the declared pnpm version ignores the `overrides` section of
+ * `pnpm-workspace.yaml`.
+ */
+export type PnpmWorkspaceOverridesIgnoredCause = ("package-json-overrides" | "pnpm-version")
 /**
  * Discriminant for [`CloneGroupAction::kind`]. Mirrors the action types
  * emitted by the legacy `build_clone_group_actions` walker.
@@ -839,6 +866,15 @@ export type CoverageInputFormat = ("istanbul" | "v8")
  * Whether CRAP findings in the report used one coverage-source kind or a mix.
  */
 export type CoverageSourceConsistency = ("uniform" | "mixed")
+/**
+ * One health section that a run produced.
+ *
+ * A section is in [`HealthReport::sections`] when the run computed it and
+ * the report carries its result, also when that result is empty. The value
+ * set is OPEN: a later release can add a section, so a consumer must accept
+ * a token that it does not know.
+ */
+export type HealthSection = ("complexity" | "vital-signs" | "score" | "file-scores" | "coverage-gaps" | "hotspots" | "targets" | "trend" | "runtime-coverage" | "css")
 /**
  * Lifecycle state for a configured threshold override.
  */
@@ -1093,6 +1129,21 @@ export type InspectSectionStatus = ("ok" | "partial" | "unavailable" | "error")
  * Granularity an [`InspectEvidenceSection`] payload covers.
  */
 export type InspectEvidenceScope = ("symbol" | "file" | "project_filtered_to_file")
+/**
+ * Wire-shape version of the [`DependencyUsage`] object.
+ *
+ * The object has its own version, because it is an optional part of the
+ * `DependencyTrace` envelope.
+ */
+export type DependencyUsageSchemaVersion = "1"
+/**
+ * How the usage was found.
+ */
+export type UsageConfidence = "syntactic"
+/**
+ * The shape of a project wrapper.
+ */
+export type WrapperShape = ("call" | "alias")
 /**
  * Wire-version discriminator for [`ImportPathTrace`]. Independent from the
  * global `SchemaVersion`: the import-path payload versions on its own cadence,
@@ -1202,11 +1253,24 @@ export type HealthSchemaVersion = 11
  * groups by GitLab CODEOWNERS `[Section]` header name.
  */
 export type GroupByMode = ("owner" | "directory" | "package" | "section")
+/**
+ * What the group trend compared, for one group.
+ *
+ * The value set is open: read an unknown value as "no trend for this group".
+ */
+export type GroupTrendStatus = ("compared" | "new_group" | "no_group_baseline")
 /**
  * Schema projection for the duplication envelope's CLI and programmatic
  * version lineages.
  */
 export type DupesSchemaVersion = (4 | 10)
+/**
+ * Schema projection for the architecture envelope's exact version.
+ *
+ * The schema emitter registers this type by name and points the
+ * `ArchitectureOutput` and `ArchitectureGroupedOutput` definitions at it.
+ */
+export type ArchitectureSchemaVersion = 1
 /**
  * Wire-version discriminator for [`ImpactReport`]. Independent from the global
  * `SchemaVersion` (the impact report versions on its own cadence) and from the
@@ -1318,7 +1382,7 @@ export type SecurityBlindSpotsSchemaVersion = "1"
 /**
  * Schema projection for the combined envelope's exact version.
  */
-export type CombinedSchemaVersion = 12
+export type CombinedSchemaVersion = 13
 /**
  * Schema projection for the feature-flags envelope's exact version.
  */
@@ -1363,7 +1427,7 @@ export type VendorFlagState = ("on" | "off" | "rolled_out" | "archived" | "exper
  * Independently-versioned wire-version newtype for the brief envelope.
  * Serializes as the integer `REVIEW_BRIEF_SCHEMA_VERSION`.
  */
-export type ReviewBriefSchemaVersion = 11
+export type ReviewBriefSchemaVersion = 12
 /**
  * The exactly-three shippable decision categories (the SOLID-3). No cut category
  * (abstraction / deletion / convention / irreversibility) is representable: this
@@ -1528,6 +1592,14 @@ export type SimilarCodeDomainOutcome = ("same-responsibility" | "related-but-dis
  * How review matched an external verdict to the current candidate.
  */
 export type SimilarCodeVerdictMatch = ("candidate-id" | "review-key" | "unverified" | "ambiguous-review-key")
+/**
+ * Version singleton for local-provider status output.
+ */
+export type SimilarCodeStatusSchemaVersion = "1"
+/**
+ * Version singleton for vector-cache clear output.
+ */
+export type SimilarCodeCacheClearSchemaVersion = "1"
 /**
  * Discriminator value for [`CodeClimateIssue::kind`].
  */
@@ -1687,7 +1759,8 @@ duplication_demoted: number
  * gate and leaves the object absent.
  *
  * The names this build can emit are `error-severity-findings`, `regression`,
- * `stale-baseline`, `baseline-growth`, `duplication-threshold`, `health-min-score`,
+ * `stale-baseline`, `baseline-growth`, `duplication-threshold`,
+ * `duplication-findings`, `health-min-score`,
  * `health-min-severity`, `health-findings`, `health-coverage-gaps`,
  * `health-runtime-coverage`, `security`, `security-advisory`, `audit-verdict`,
  * `type-aware-require` and `parse-error`. The set is OPEN: a name a consumer does not
@@ -1725,7 +1798,9 @@ enforced: boolean
 /**
  * The measured value the gate compared, when there is one: the duplication
  * percentage, the health score, the number of findings at or above the
- * severity floor, or the number of files in `files`. Whole numbers are
+ * severity floor, the number of `error` findings of `health-findings` and
+ * of `error-severity-findings`, or
+ * the number of files in `files`. Whole numbers are
  * carried as JSON numbers, so a count of three reads as `3.0`. Absent for
  * gates that compare no number.
  */
@@ -1738,7 +1813,9 @@ threshold?: (number | null)
 /**
  * How the limit was spelled, for a gate whose `threshold` number does not
  * carry its own unit. `health-min-severity` sets it to the severity floor
- * (`moderate`, `high` or `critical`); `regression` sets it to the
+ * (`moderate`, `high` or `critical`); `health-findings` and
+ * `error-severity-findings` set it to `error`, the rule severity they
+ * count; `regression` sets it to the
  * tolerance as the user wrote it (`"50%"` or `"5"`), because `threshold`
  * there is the allowance in issues and the percentage would otherwise be
  * unrecoverable on the grouped envelope, which carries no `regression`
@@ -2976,6 +3053,10 @@ dynamic_segment_name_conflicts?: DynamicSegmentNameConflictFinding[]
  * array natively. Default severity is `warn`.
  */
 unused_component_props?: UnusedComponentPropFinding[]
+/**
+ * Used optional component inputs absent from inspected reachable callers. Off by default.
+ */
+absent_component_props?: AbsentComponentPropFinding[]
 /**
  * Vue `<script setup>` `defineEmits` events emitted nowhere in their own SFC
  * (no `emit('<name>')` call). Wrapped in [`UnusedComponentEmitFinding`] so
@@ -3055,6 +3136,16 @@ thin_wrappers?: ThinWrapperFinding[]
  * enables it.
  */
 duplicate_prop_shapes?: DuplicatePropShapeFinding[]
+/**
+ * Number of `unused_exports`, `unused_types`, `unused_class_members` and
+ * `unused_enum_members` findings that this run did not report because
+ * their file is an unused file. Deleting the file removes them, so they
+ * add no information. `--show-cascade` or the `showCascade` config key
+ * keeps them in the report, and then this count is zero. The count is
+ * taken after the scope and the rules and before a baseline. Serialized
+ * only when not zero, so a run without such findings keeps its JSON.
+ */
+cascade_hidden?: number
 /**
  * Count deltas against the matched baseline, in baseline runs.
  */
@@ -3252,6 +3343,10 @@ unrendered_components?: number
  * Vue, Svelte, or React props referenced nowhere inside their own component.
  */
 unused_component_props?: number
+/**
+ * Optional consumed props omitted by known reachable callers, for manual review.
+ */
+absent_component_props?: number
 /**
  * Vue `<script setup>` emits emitted nowhere inside their own SFC.
  */
@@ -3942,6 +4037,12 @@ line: number
  * Workspace roots that import this package even though the declaring workspace does not.
  */
 used_in_workspaces?: string[]
+/**
+ * Workspace roots whose package.json declares this package for the files
+ * that import it. Only a root finding fills this field: these imports use
+ * the nearer workspace declaration, so the root declaration stays unused.
+ */
+declared_and_imported_in?: string[]
 /**
  * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
  * `~<k>` suffix when several findings of one type share an identity.
@@ -4003,6 +4104,12 @@ line: number
  * Workspace roots that import this package even though the declaring workspace does not.
  */
 used_in_workspaces?: string[]
+/**
+ * Workspace roots whose package.json declares this package for the files
+ * that import it. Only a root finding fills this field: these imports use
+ * the nearer workspace declaration, so the root declaration stays unused.
+ */
+declared_and_imported_in?: string[]
 /**
  * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
  * `~<k>` suffix when several findings of one type share an identity.
@@ -4064,6 +4171,12 @@ line: number
  * Workspace roots that import this package even though the declaring workspace does not.
  */
 used_in_workspaces?: string[]
+/**
+ * Workspace roots whose package.json declares this package for the files
+ * that import it. Only a root finding fills this field: these imports use
+ * the nearer workspace declaration, so the root declaration stays unused.
+ */
+declared_and_imported_in?: string[]
 /**
  * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
  * `~<k>` suffix when several findings of one type share an identity.
@@ -5043,7 +5156,8 @@ kind: PolicyRuleKind
  * What matched: the written callee path for `banned-call` (e.g.
  * `cp.exec`), the raw import specifier for `banned-import` (e.g.
  * `moment/locale/nl`), `<effect>: <callee>` for `banned-effect`, or the
- * exported name for `banned-export`.
+ * exported name for `banned-export`. For `gdp-proof-producer`, the canonical
+ * factory with its JSON-quoted literal label or `...` for a dynamic label.
  */
 matched: string
 severity: PolicyViolationSeverity
@@ -5866,6 +5980,92 @@ introduced?: (AuditIntroduced | null)
  */
 effective_severity?: (EffectiveSeverity | null)
 }
+/**
+ * Wire-shape envelope for an [`AbsentComponentProp`] finding. There is no safe
+ * auto-fix: removing a declared prop is judgement-bearing (the prop may be part
+ * of a deliberately-stable public component API). Actions are manual
+ * remediation guidance plus a line-level suppress at the prop declaration.
+ */
+export interface AbsentComponentPropFinding {
+/**
+ * Source path of the input declaration.
+ */
+path: string
+/**
+ * Semantic declaration name, or SFC filename stem.
+ */
+component_name: string
+/**
+ * Public framework token.
+ */
+framework: string
+/**
+ * Public optional input name.
+ */
+prop_name: string
+/**
+ * 1-based declaration line.
+ */
+line: number
+/**
+ * 0-based declaration byte column.
+ */
+col: number
+/**
+ * Whether omission has a declared default.
+ */
+has_default: boolean
+/**
+ * Every inspected reachable caller, deterministically ordered.
+ */
+inspected_call_sites: ComponentPropCallSite[]
+/**
+ * Manual-review meaning and limits of static evidence.
+ */
+explanation: string
+/**
+ * Stable id of this finding: `dc1:<rule>:<16 hex digits>`, with a
+ * `~<k>` suffix when several findings of one type share an identity.
+ * Line and column are not inputs, so the id survives line shifts,
+ * reformats and reorders. A rename of the file or the symbol gives a
+ * new id. Absent in output from older versions.
+ */
+finding_id?: (string | null)
+/**
+ * Suggested next steps. Always emitted (possibly empty for
+ * forward-compat).
+ */
+actions: IssueAction[]
+/**
+ * Set by the audit pass when this finding is introduced relative to
+ * the merge-base.
+ */
+introduced?: (AuditIntroduced | null)
+/**
+ * Gate severity of this finding after `rules` and `overrides[].rules`
+ * resolve for its path. CI formats read it for the annotation, SARIF
+ * and CodeClimate level. Absent in output from older versions. Not
+ * part of the finding identity, baseline keys or fingerprints.
+ */
+effective_severity?: (EffectiveSeverity | null)
+}
+/**
+ * One inspected reachable component invocation.
+ */
+export interface ComponentPropCallSite {
+/**
+ * Caller source path.
+ */
+path: string
+/**
+ * 1-based opening-tag line.
+ */
+line: number
+/**
+ * 0-based original-source byte column.
+ */
+col: number
+}
 /**
  * Wire-shape envelope for an [`UnusedComponentEmit`] finding. There is no safe
  * auto-fix: removing a declared emit is judgement-bearing (the event may be
@@ -6486,6 +6686,18 @@ stale_entries: number
  * when every entry went unmatched.
  */
 current_findings: number
+/**
+ * Health only: the number of functions above a complexity threshold that
+ * the baseline does not accept. This is a count of functions, like
+ * `summary.functions_above_threshold`, not a count of baseline entries,
+ * and it is the value before `--top`. A run that does not list the
+ * complexity findings (for example `--score`) still reports it, so a
+ * reader can tell the new functions from the accepted ones.
+ *
+ * `dead-code` and `dupes` do not emit it. An envelope from a fallow
+ * version before this member does not carry it either.
+ */
+remaining_findings?: (number | null)
 /**
  * True when this run analyzed only part of the project, so a whole-project
  * baseline matches less of it for reasons that are not rot. The channels
@@ -6558,11 +6770,12 @@ unrecognised_format?: boolean
  */
 saved_by?: string
 /**
- * `legacy` when the loaded dead-code baseline has no `identity`, so its
- * entries use the old key forms and some of them hold a line. The run
- * still applies the file. `--save-baseline` rewrites it with line-free
- * keys. Absent for a current baseline and on `dupes` and `health`. The
- * value set is OPEN.
+ * `legacy` when the loaded baseline uses an old key form. For dead-code,
+ * the file has no `identity`, so some entries hold a line. For `dupes`,
+ * some entries use the clone key that older versions shared between
+ * unrelated groups whose code did not parse on its own. The run still
+ * applies the file. `--save-baseline` rewrites it with current keys.
+ * Absent for a current baseline and on `health`. The value set is OPEN.
  */
 format?: string
 /**
@@ -6701,7 +6914,7 @@ reason?: (string | null)
  * all of it applied, which is a different and false claim.
  *
  * The names this build can emit are `changed-since`, `diff-filter`,
- * `package-baselines` and `sarif-file`. The reasons are `git-missing`,
+ * `package-baselines`, `sarif-file` and `group-filter`. The reasons are `git-missing`,
  * `not-a-repository`, `git-failed` and `invalid-ref` for `changed-since`,
  * `unknown-workspace`, `git-missing`, `not-a-repository` and `git-failed`
  * for `package-baselines`, `oversize`,
@@ -6719,8 +6932,9 @@ reason?: (string | null)
  * whole object narrows the report tells its reader an unwritten SARIF file
  * widened the analysis, which is what `affects` exists to prevent.
  *
- * `scope_size` is emitted for `diff-filter`, in added lines, and for
- * `changed-since`, in changed files that the run analyzed. `package-baselines`
+ * `scope_size` is emitted for `diff-filter`, in added lines, for
+ * `changed-since`, in changed files that the run analyzed, and for
+ * `group-filter`, in groups that the run kept. `package-baselines`
  * and `sarif-file` measure no scope; the applied package refs travel in
  * `package_baselines`. A consumer reads the unit off the name, so a name that
  * starts to measure its own scope in a later release needs no change here.
@@ -6749,7 +6963,8 @@ affects: RequestEffect
  * `--diff-stdin`, `$FALLOW_DIFF_FILE build/pr.diff`, or
  * `diffFile pr.diff` for the programmatic option) for `diff-filter`,
  * `workspaces.changedSince` for `package-baselines`, the target path for
- * `sarif-file`. Echoed rather than normalised, so a
+ * `sarif-file`, the comma-joined selector patterns for `group-filter`.
+ * Echoed rather than normalised, so a
  * consumer must not join it to the project root the way it joins every
  * other path-shaped field.
  */
@@ -6766,7 +6981,7 @@ requested: string
  * rule dropped does not count, so a change to a README only gives `0`. A
  * combined run counts a file that any of its analyses kept, because a
  * per-analysis `production` setting can give its analyses different
- * files.
+ * files. `group-filter` counts the groups that the run kept.
  * Read the unit off the name the entry is keyed under, never across names,
  * and read an absent member as "not measured" rather than as zero.
  *
@@ -6983,6 +7198,15 @@ end_col: number
  * wants the source reads it from the file.
  */
 fragment?: string
+/**
+ * Whether the file path is a symlink, or lies under a symlinked
+ * directory, inside the project root. Omitted when `false`.
+ *
+ * A clone with a symlinked instance can be the same file under two
+ * paths, not copied code. `duplicates.ignoreSymlinks` (or
+ * `fallow dupes --ignore-symlinks`) removes these instances.
+ */
+is_symlink?: boolean
 }
 /**
  * Per-action wire shape attached to each `CloneGroupFinding` and
@@ -7197,6 +7421,15 @@ export interface HealthReport {
  */
 findings: HealthFinding[]
 summary: HealthSummary
+/**
+ * The sections that this run produced, in a fixed order. A renderer
+ * reads it to tell an empty section from a section that the run did not
+ * produce: `findings` is the complexity list only when `complexity` is
+ * in this array. The value set is OPEN (see [`HealthSection`]). Absent
+ * in an envelope from a fallow version before this member, and on a
+ * report that no health run built.
+ */
+sections?: (HealthSection[] | null)
 /**
  * Configured threshold override states. Entries are emitted for active
  * exceptions, stale exceptions, and full-run no-match cleanup hints.
@@ -7436,7 +7669,9 @@ threshold_source?: (ThresholdSource | null)
 actions: HealthFindingAction[]
 /**
  * Audit-mode flag indicating whether the finding is new versus the base
- * snapshot.
+ * snapshot. A complexity finding is new when no base finding has the same
+ * path and function name, or when a metric that it exceeds has a higher
+ * value than in that base finding.
  */
 introduced?: (boolean | null)
 }
@@ -9633,6 +9868,11 @@ score?: (number | null)
  * Letter grade from the snapshot.
  */
 grade?: (string | null)
+/**
+ * Formula used for the stored score; absent on legacy snapshots.
+ * A score delta is emitted only when this matches the current score formula.
+ */
+score_formula_version?: (number | null)
 /**
  * Coverage model used for CRAP computation in this snapshot.
  */
@@ -11452,25 +11692,35 @@ export interface DependencyTrace {
  */
 package_name: string
 /**
- * Files that import this dependency.
+ * Files that import this dependency, each listed once.
  */
 imported_by: string[]
 /**
- * Files that import this dependency with type-only imports.
+ * Files whose every import of this dependency is type-only, each listed
+ * once.
  */
 type_only_imported_by: string[]
 /**
- * Whether the dependency is invoked from package.json scripts or CI configs.
+ * Whether the dependency is invoked from package.json scripts, CI configs
+ * or git hooks.
  */
 used_in_scripts: boolean
 /**
- * Whether the dependency is used at all.
+ * Whether the dependency is used at all: imported, invoked from scripts,
+ * or listed as a peer by a used package (`peer_of`).
  */
 is_used: boolean
 /**
- * Total import count.
+ * Number of files that import this dependency.
  */
 import_count: number
+/**
+ * Used packages that list this dependency in their installed
+ * `peerDependencies`, required or optional, sorted by name. The
+ * unused-dependency check credits such a peer, because the package that
+ * lists it loads it at runtime. Absent when no used package lists it.
+ */
+peer_of?: string[]
 /**
  * The configs that declare this name as a Module Federation remote alias
  * under `remotes`, one per config. A remote alias is provided by a
@@ -11478,211 +11728,518 @@ import_count: number
  * Federation config declares the name (issue #2796).
  */
 sources?: TraceSource[]
+/**
+ * Why the unused devDependency check credits the dependency as tooling
+ * when no file imports it and no script, CI workflow or git hook runs it.
+ * When present, `is_used` is `true`. Absent otherwise.
+ */
+tooling_credit?: (ToolingCredit | null)
+/**
+ * The manifests that the unused-dependency check flags for this name,
+ * relative to the project root and sorted. The check reads each
+ * declaring manifest on its own. An import credits the nearest manifest
+ * that installs the package, so a name that one workspace uses can still
+ * be unused in the root manifest or in another workspace. Absent when no
+ * manifest is flagged.
+ */
+unused_in?: string[]
+/**
+ * How the code uses each imported name of the dependency. Present on
+ * `fallow trace --dependency`, and on the MCP `trace_dependency` tool
+ * when a usage parameter is set. Absent on
+ * `fallow dead-code --trace-dependency`. The object has its own
+ * `schema_version`.
+ */
+usage?: (DependencyUsage | null)
 }
 /**
- * Result of tracing a clone: all groups containing the code at a source
- * location or addressed by a stable clone fingerprint.
+ * Why the unused devDependency check counts a dependency as used tooling
+ * although no source file imports it.
  */
-export interface CloneTrace {
+export interface ToolingCredit {
 /**
- * File passed to the trace request, root-relative when a group matches.
+ * The evidence: `plugin-config` when the plugin that declares the
+ * dependency found its own config file, `plugin-reference` when a
+ * package.json script, a CI workflow or a git hook runs one of that
+ * plugin's packages, `ambient-types` for a type package that declares
+ * globals, `types-target` when the project declares or imports the
+ * package that a `@types/` package types, `types-config` when a config
+ * file, such as a tsconfig `types` entry, names the type package,
+ * `known-tooling` for a library from the tooling catalogue,
+ * `known-tooling-config` when a command-line tool from the catalogue has
+ * its own config file, and `own-peer` when the same manifest lists the
+ * devDependency in `peerDependencies`. The set is open.
  */
-file: string
+reason: string
 /**
- * 1-based line passed to the trace request or representative group line.
+ * The plugin that declares the dependency as tooling.
  */
-line: number
+plugin?: (string | null)
 /**
- * The matched clone instance, if one exists.
+ * The config file found, relative to the project root, for
+ * `plugin-config` and `known-tooling-config`. A `package.json` path when
+ * the config is a package.json key. For `own-peer`, the manifest that
+ * lists the dependency.
  */
-matched_instance?: (CloneInstance | null)
+config?: (string | null)
 /**
- * Clone groups matched by the trace request.
+ * The package that a script, CI workflow or git hook runs, for
+ * `plugin-reference`, or the package that a `@types/` package types,
+ * for `types-target`.
  */
-clone_groups: TracedCloneGroup[]
+reference?: (string | null)
 }
 /**
- * One clone group returned from a clone trace request.
+ * How the code uses each imported name of a dependency.
  */
-export interface TracedCloneGroup {
+export interface DependencyUsage {
+schema_version: DependencyUsageSchemaVersion
+confidence: UsageConfidence
 /**
- * Stable content fingerprint, usually `dup:<8hex>` and widened on rare
- * report collisions.
+ * One entry per imported name, sorted by `name` in byte order. With a
+ * specifier filter, only the selected names, each present even when no
+ * file imports it.
  */
-fingerprint: string
+specifiers: SpecifierUsage[]
+unresolved: FileLevelUnresolved
 /**
- * Number of tokens in the duplicated block.
+ * One page of usage sites. Absent unless sites were requested.
  */
-token_count: number
+sites?: (UsageSitePage | null)
 /**
- * Number of lines in the duplicated block.
+ * The files that import the users of the dependency. Absent unless a
+ * closure depth was requested.
  */
-line_count: number
+closure?: (ConsumerClosure | null)
+}
 /**
- * Maximum directory-tree or same-file line distance between instances.
+ * The usage of one imported name.
  */
-spread: number
+export interface SpecifierUsage {
 /**
- * Lowest all-pairs similarity for a near-miss clone group.
+ * The imported name: `default` for a default import, the first member for
+ * a namespace member, and `*` for a bare namespace use.
  */
-similarity?: number
+name: string
 /**
- * Root-relative clone instances in this group.
+ * Files with a static import binding of the name, a namespace member use
+ * of it, or a re-export of it from the package.
  */
-instances: CloneInstance[]
-suggestion: RefactoringSuggestion
+file_count: number
 /**
- * Best-effort name for the extracted function. Advisory only.
+ * The files in `file_count` where every binding of the name is type-only:
+ * an `import type`, or a value import that the file reads only in type
+ * positions.
  */
-suggested_name?: (string | null)
-}
+type_only_file_count: number
 /**
- * Result of computing the impact closure for a single file as the seed.
+ * Direct calls of the name, not through a project wrapper. The
+ * initializer of a call wrapper (`useSelector.withTypes()`) is a direct
+ * call and counts here.
  */
-export interface ImpactClosureTrace {
+call_site_count: number
+unresolved: SpecifierUnresolved
 /**
- * The seed file, root-relative.
+ * Project wrappers of the name, sorted by `file`, then `export`.
  */
-seed: string
+wrappers: UsageWrapper[]
+}
 /**
- * Root-relative paths transitively affected by the seed.
+ * Uses of one imported name that the trace cannot resolve to a call. The key
+ * set is closed in schema version 1.
  */
-affected_not_shown: string[]
+export interface SpecifierUnresolved {
 /**
- * Coordination gaps between the seed and consumers.
+ * The name is the whole initializer of a declarator that is not a
+ * wrapper: `const s = useSelector`.
  */
-coordination_gap: ImpactClosureGap[]
-}
+value_alias: number
 /**
- * One coordination-gap entry in an [`ImpactClosureTrace`].
+ * Any other value use that is not a call: an argument, an array
+ * element, a property value or an optional call.
  */
-export interface ImpactClosureGap {
+non_call_reference: number
 /**
- * Root-relative path of the consumer module.
+ * The name is a JSX element: `<Provider>`.
  */
-consumer_file: string
+jsx_element: number
 /**
- * Exported symbol names the consumer references.
+ * The file re-exports the name from the package, or re-exports a
+ * project wrapper of the name. The trace does not follow the consumers
+ * of the re-export.
  */
-consumed_symbols: string[]
+re_export: number
 /**
- * Scope note for the syntactic trace.
+ * A wrapper consumer that exports the wrapper again. The trace does not
+ * follow the second hop.
  */
-note: string
-}
+nested_wrapper: number
 /**
- * Result of asking how one module reaches another: the shortest import path.
- *
- * `reachable` is the only field that separates "no route exists" from "the
- * route is empty because both ends are the same module". Both report
- * `hops: 0`, so a consumer must read `reachable`, never the hop count.
+ * Files with a runtime binding of the name and no usage site, for
+ * example a use in a Vue, Svelte or Astro template.
  */
-export interface ImportPathTrace {
-schema_version: ImportPathTraceSchemaVersion
+binding_without_site: number
+}
 /**
- * The module the walk started from, root-relative.
+ * A top-level exported declarator that wraps an imported name. The trace
+ * follows one hop from the wrapper to its consumers.
  */
-from: string
+export interface UsageWrapper {
 /**
- * The module the walk was looking for, root-relative.
+ * The file that declares the wrapper, root-relative.
  */
-to: string
+file: string
 /**
- * Whether `to` is reachable from `from` by following import edges.
+ * The exported name of the wrapper.
  */
-reachable: boolean
+export: string
+shape: WrapperShape
 /**
- * Number of import edges on the reported route. `0` both when the two ends
- * are the same module and when there is no route at all.
+ * 1-based line of the wrapper initializer.
  */
-hops: number
+line: number
 /**
- * The route, in import order. Empty whenever `hops` is `0`.
+ * Distinct files with a call of the wrapper, the file of the wrapper
+ * included.
  */
-path: ImportPathHop[]
+consumer_file_count: number
 /**
- * Human-readable summary of the outcome.
+ * Calls of the wrapper itself. A call of a member of the value that a
+ * call wrapper returns (`store.dispatch()`) is a `non_call_reference`.
  */
-reason: string
+call_site_count: number
 }
 /**
- * One import edge on an [`ImportPathTrace`].
+ * Uses that hide which names a file reads. The key set is closed in schema
+ * version 1.
  */
-export interface ImportPathHop {
+export interface FileLevelUnresolved {
 /**
- * The importing module, root-relative.
+ * `import("package")` expressions.
  */
-from: string
+dynamic_import: number
 /**
- * The imported module, root-relative.
+ * `require("package")` calls.
  */
-to: string
+require: number
 /**
- * Whether every symbol on this edge is type-only, so the hop is erased at
- * build time. Type-only hops are reported, never skipped: an `import type`
- * chain is a real compile-time coupling.
+ * `import "package"` statements.
  */
-type_only: boolean
+side_effect_import: number
 /**
- * Whether the edge carries a runtime value but no static one: the target
- * loads only on demand (`import()`, a lazy glob or template pattern) or
- * on another thread (a worker URL, a worker loader request,
- * `child_process.fork`). False for a
- * static hop and for a type-only hop.
+ * `export * from "package"` statements.
  */
-dynamic: boolean
+star_re_export: number
 /**
- * 1-based line in `from` of the imported binding that creates this edge:
- * the first value-carrying symbol on the import, or the first symbol when
- * every symbol is type-only. On a multi-line import that is the binding's
- * own line, not the `import` keyword's. Absent when the edge carries no
- * span or the source could not be read.
+ * Files that import the package through a specifier that does not name
+ * the package, for example a path alias.
  */
-import_line?: (number | null)
+unattributed_file: number
 }
 /**
- * The result of a symbol-level call-chain trace. Its own surface (`kind:
- * "trace"`), NOT folded into the ranked brief.
+ * One page of usage sites.
  */
-export interface SymbolChainTrace {
+export interface UsageSitePage {
 /**
- * The file containing the traced symbol (project-root-relative).
+ * The sites on this page, sorted by `file`, `line`, `col`, kind,
+ * `specifier`, then `via`.
  */
-file: string
+items: UsageSite[]
 /**
- * The traced symbol name.
+ * The number of sites on all pages.
  */
-symbol: string
+total: number
 /**
- * Whether the symbol's defining export was found in the graph. When
- * `false`, the chains are empty and `reason` explains why.
+ * The largest number of items on a page.
  */
-symbol_found: boolean
+limit: number
 /**
- * The chain depth applied to both directions.
+ * An opaque token for the next page. Absent on the last page.
  */
-depth: number
+next_cursor?: (string | null)
+}
 /**
- * Whether this trace is best-effort (always `true`: symbol-level chains are
- * labeled best-effort, syntactic per ADR-001).
+ * One use of the dependency in the code.
  */
-best_effort: boolean
+export interface UsageSite {
 /**
- * Caller chain hops (UP). Present only when `--callers` was requested.
+ * The file, root-relative.
  */
-callers?: (ChainHop[] | null)
+file: string
 /**
- * Callee chain hops (DOWN) resolved to an import-symbol edge. Present only
- * when `--callees` was requested.
+ * 1-based line.
  */
-callees?: (ChainHop[] | null)
+line: number
 /**
- * Callees referenced at a call site in the symbol's module that the
- * syntactic walk could NOT resolve to an import-symbol edge (locals,
- * globals, dynamic dispatch, re-bound callees). Reported, never dropped.
- * Present only when `--callees` was requested.
+ * 0-based byte column.
  */
-unresolved_callees?: (UnresolvedCallee[] | null)
+col: number
+/**
+ * The imported name. Absent on file-level kinds.
+ */
+specifier?: (string | null)
+/**
+ * The local binding that the code uses. Absent on file-level kinds.
+ */
+local_name?: (string | null)
+/**
+ * The static member after the imported name, for example `withTypes`.
+ */
+member?: (string | null)
+/**
+ * How the code uses the dependency at this site. The known values are
+ * `call`, `wrapper_definition`, `value_alias`, `non_call_reference`,
+ * `jsx_element`, `re_export`, `nested_wrapper`, `dynamic_import`,
+ * `require`, `side_effect_import` and `star_re_export`. The set is open:
+ * read an unknown kind as an unresolved site.
+ */
+kind: string
+/**
+ * The wrapper that the site goes through, as `FILE:EXPORT`.
+ */
+via?: (string | null)
+}
+/**
+ * The files that import the users of the dependency, found by a reverse walk
+ * of the import graph.
+ */
+export interface ConsumerClosure {
+/**
+ * The largest depth of the walk.
+ */
+depth: number
+/**
+ * The number of files in `files`.
+ */
+file_count: number
+/**
+ * The files, sorted by `depth`, then `file`. The seed files are not
+ * listed.
+ */
+files: ClosureFile[]
+/**
+ * Whether a file at the largest depth has an importer that the walk did
+ * not visit.
+ */
+truncated: boolean
+}
+/**
+ * One file of a [`ConsumerClosure`].
+ */
+export interface ClosureFile {
+/**
+ * The file, root-relative.
+ */
+file: string
+/**
+ * The number of import edges from the nearest seed file.
+ */
+depth: number
+}
+/**
+ * Result of tracing a clone: all groups containing the code at a source
+ * location or addressed by a stable clone fingerprint.
+ */
+export interface CloneTrace {
+/**
+ * File passed to the trace request, root-relative when a group matches.
+ */
+file: string
+/**
+ * 1-based line passed to the trace request or representative group line.
+ */
+line: number
+/**
+ * The matched clone instance, if one exists.
+ */
+matched_instance?: (CloneInstance | null)
+/**
+ * Clone groups matched by the trace request.
+ */
+clone_groups: TracedCloneGroup[]
+}
+/**
+ * One clone group returned from a clone trace request.
+ */
+export interface TracedCloneGroup {
+/**
+ * Stable content fingerprint, usually `dup:<8hex>` and widened on rare
+ * report collisions.
+ */
+fingerprint: string
+/**
+ * Number of tokens in the duplicated block.
+ */
+token_count: number
+/**
+ * Number of lines in the duplicated block.
+ */
+line_count: number
+/**
+ * Maximum directory-tree or same-file line distance between instances.
+ */
+spread: number
+/**
+ * Lowest all-pairs similarity for a near-miss clone group.
+ */
+similarity?: number
+/**
+ * Root-relative clone instances in this group.
+ */
+instances: CloneInstance[]
+suggestion: RefactoringSuggestion
+/**
+ * Best-effort name for the extracted function. Advisory only.
+ */
+suggested_name?: (string | null)
+}
+/**
+ * Result of computing the impact closure for a single file as the seed.
+ */
+export interface ImpactClosureTrace {
+/**
+ * The seed file, root-relative.
+ */
+seed: string
+/**
+ * Root-relative paths transitively affected by the seed.
+ */
+affected_not_shown: string[]
+/**
+ * Coordination gaps between the seed and consumers.
+ */
+coordination_gap: ImpactClosureGap[]
+}
+/**
+ * One coordination-gap entry in an [`ImpactClosureTrace`].
+ */
+export interface ImpactClosureGap {
+/**
+ * Root-relative path of the consumer module.
+ */
+consumer_file: string
+/**
+ * Exported symbol names the consumer references.
+ */
+consumed_symbols: string[]
+/**
+ * Scope note for the syntactic trace.
+ */
+note: string
+}
+/**
+ * Result of asking how one module reaches another: the shortest import path.
+ *
+ * `reachable` is the only field that separates "no route exists" from "the
+ * route is empty because both ends are the same module". Both report
+ * `hops: 0`, so a consumer must read `reachable`, never the hop count.
+ */
+export interface ImportPathTrace {
+schema_version: ImportPathTraceSchemaVersion
+/**
+ * The module the walk started from, root-relative.
+ */
+from: string
+/**
+ * The module the walk was looking for, root-relative.
+ */
+to: string
+/**
+ * Whether `to` is reachable from `from` by following import edges.
+ */
+reachable: boolean
+/**
+ * Number of import edges on the reported route. `0` both when the two ends
+ * are the same module and when there is no route at all.
+ */
+hops: number
+/**
+ * The route, in import order. Empty whenever `hops` is `0`.
+ */
+path: ImportPathHop[]
+/**
+ * Human-readable summary of the outcome.
+ */
+reason: string
+}
+/**
+ * One import edge on an [`ImportPathTrace`].
+ */
+export interface ImportPathHop {
+/**
+ * The importing module, root-relative.
+ */
+from: string
+/**
+ * The imported module, root-relative.
+ */
+to: string
+/**
+ * Whether every symbol on this edge is type-only, so the hop is erased at
+ * build time. Type-only hops are reported, never skipped: an `import type`
+ * chain is a real compile-time coupling.
+ */
+type_only: boolean
+/**
+ * Whether the edge carries a runtime value but no static one: the target
+ * loads only on demand (`import()`, a lazy glob or template pattern) or
+ * on another thread (a worker URL, a worker loader request,
+ * `child_process.fork`). False for a
+ * static hop and for a type-only hop.
+ */
+dynamic: boolean
+/**
+ * 1-based line in `from` of the imported binding that creates this edge:
+ * the first value-carrying symbol on the import, or the first symbol when
+ * every symbol is type-only. On a multi-line import that is the binding's
+ * own line, not the `import` keyword's. Absent when the edge carries no
+ * span or the source could not be read.
+ */
+import_line?: (number | null)
+}
+/**
+ * The result of a symbol-level call-chain trace. Its own surface (`kind:
+ * "trace"`), NOT folded into the ranked brief.
+ */
+export interface SymbolChainTrace {
+/**
+ * The file containing the traced symbol (project-root-relative).
+ */
+file: string
+/**
+ * The traced symbol name.
+ */
+symbol: string
+/**
+ * Whether the symbol's defining export was found in the graph. When
+ * `false`, the chains are empty and `reason` explains why.
+ */
+symbol_found: boolean
+/**
+ * The chain depth applied to both directions.
+ */
+depth: number
+/**
+ * Whether this trace is best-effort (always `true`: symbol-level chains are
+ * labeled best-effort, syntactic per ADR-001).
+ */
+best_effort: boolean
+/**
+ * Caller chain hops (UP). Present only when `--callers` was requested.
+ */
+callers?: (ChainHop[] | null)
+/**
+ * Callee chain hops (DOWN) resolved to an import-symbol edge. Present only
+ * when `--callees` was requested.
+ */
+callees?: (ChainHop[] | null)
+/**
+ * Callees referenced at a call site in the symbol's module that the
+ * syntactic walk could NOT resolve to an import-symbol edge (locals,
+ * globals, dynamic dispatch, re-bound callees). Reported, never dropped.
+ * Present only when `--callees` was requested.
+ */
+unresolved_callees?: (UnresolvedCallee[] | null)
 /**
  * Set when the name is unresolvable because two different `export *`
  * sources of this file supply it. `symbol_found` is `false` in that case
@@ -12467,6 +13024,15 @@ elapsed_ms: ElapsedMs
  */
 findings: HealthFinding[]
 summary: HealthSummary
+/**
+ * The sections that this run produced, in a fixed order. A renderer
+ * reads it to tell an empty section from a section that the run did not
+ * produce: `findings` is the complexity list only when `complexity` is
+ * in this array. The value set is OPEN (see [`HealthSection`]). Absent
+ * in an envelope from a fallow version before this member, and on a
+ * report that no health run built.
+ */
+sections?: (HealthSection[] | null)
 /**
  * Configured threshold override states. Entries are emitted for active
  * exceptions, stale exceptions, and full-run no-match cleanup hints.
@@ -12591,6 +13157,12 @@ grouped_by?: (GroupByMode | null)
  * Per-bucket recomputed metrics; present only in grouped output.
  */
 groups?: (HealthGroup[] | null)
+/**
+ * The `--group` selector patterns, as given, when the run kept only some
+ * groups. A group that is not in `groups` was filtered out by this
+ * selector. The project-level sections are not filtered.
+ */
+group_filter?: (string[] | null)
 /**
  * The verdict of every gate this run evaluated, keyed by name. The CLI
  * always emits it, with the command's default exit rule in it also when
@@ -12640,6 +13212,11 @@ next_steps?: NextStep[]
  * a single invocation. `files_analyzed` and `functions_above_threshold`
  * summarise the subset for parity with the project-level
  * project-level health summary.
+ *
+ * A group carries a per-file list (`findings`, `file_scores`, `hotspots`,
+ * `large_functions`, `targets`) only when the project report shows the same
+ * list. A `--score` run keeps the score and the counts of each group and
+ * omits the lists.
  */
 export interface HealthGroup {
 /**
@@ -12664,25 +13241,68 @@ files_analyzed: number
  * Number of findings in this group, mirroring the project-level
  * `summary.functions_above_threshold` semantics post-baseline /
  * post-`--top` truncation. When `--top` was supplied this reflects the
- * rendered finding count, not the un-truncated total.
+ * rendered finding count of the group, not the un-truncated total.
  */
 functions_above_threshold: number
 /**
- * Whether CRAP findings in this group share a single coverage-source kind
- * (`uniform`) or combine Istanbul / estimated / inherited sources
- * (`mixed`). Absent when no grouped finding carries CRAP source data.
+ * Number of critical-severity findings in this group, after the baseline
+ * filter and before `--top`. The project `summary.severity_critical_count`
+ * counts before the baseline filter, so with `--baseline` the group
+ * counts can add up to less.
  */
-coverage_source_consistency?: (CoverageSourceConsistency | null)
+severity_critical_count: number
 /**
- * Per-group vital signs recomputed from the files in this group. Absent
- * when --score-only suppressed top-level vital signs.
+ * Number of high-severity findings in this group, after the baseline
+ * filter and before `--top`. The project `summary.severity_high_count`
+ * counts before the baseline filter, so with `--baseline` the group
+ * counts can add up to less.
  */
-vital_signs?: (VitalSigns | null)
+severity_high_count: number
 /**
- * Per-group health score recomputed from the per-group vital signs. Absent
- * when --score was not requested.
+ * Number of moderate-severity findings in this group, after the baseline
+ * filter and before `--top`. The project `summary.severity_moderate_count`
+ * counts before the baseline filter, so with `--baseline` the group
+ * counts can add up to less.
+ */
+severity_moderate_count: number
+/**
+ * Number of ranked hotspot entries in this group, before `--top`. This
+ * is the length of the group's ranked hotspot list. It is not
+ * `vital_signs.hotspot_count`, which counts only the files with a
+ * hotspot score of 50 or more and feeds the health score.
+ */
+hotspot_count: number
+/**
+ * Whether CRAP findings in this group share a single coverage-source kind
+ * (`uniform`) or combine Istanbul / estimated / inherited sources
+ * (`mixed`). Absent when no grouped finding carries CRAP source data.
+ */
+coverage_source_consistency?: (CoverageSourceConsistency | null)
+/**
+ * Per-group vital signs recomputed from the files in this group. Absent
+ * when --score-only suppressed top-level vital signs.
+ */
+vital_signs?: (VitalSigns | null)
+/**
+ * Per-group health score recomputed from the per-group vital signs. Absent
+ * when --score was not requested. The duplication penalty counts each
+ * clone group with two or more instances in total and one or more in
+ * this group, and counts only the lines of the instances in this group.
+ * A clone that spans two groups thus lowers the score of each group.
+ * `dupes --group-by` assigns each clone group to one owner instead.
  */
 health_score?: (HealthScore | null)
+/**
+ * Trend of this group against the same group in the baseline snapshot.
+ * Present only when `--trend` or `--trend-from` was requested and the
+ * baseline holds this group with the same `grouped_by` mode.
+ */
+trend?: (HealthTrend | null)
+/**
+ * Why `trend` is present or absent. Present only when a trend was
+ * requested and a baseline snapshot was loaded.
+ */
+trend_status?: (GroupTrendStatus | null)
 /**
  * Findings restricted to files in this group. Each entry is the typed
  * [`HealthFinding`] wrapper around a
@@ -12797,9 +13417,10 @@ baseline_staleness?: (BaselineStaleness | null)
 /**
  * The verdict of every gate this run armed, keyed by name, absent when
  * it armed none. `dupes` has no default exit rule: a run with no armed
- * gate always exits 0, so an absent object means that the run passed. A
- * gate fails the build when `status` is `fail` AND `enforced` is true.
- * See [`crate::GateOutcomes`].
+ * gate always exits 0, so an absent object means that the run passed.
+ * `--fail-on-issues` and `--ci` arm `duplication-findings`, which fails
+ * on any clone group. A gate fails the build when `status` is `fail` AND
+ * `enforced` is true. See [`crate::GateOutcomes`].
  */
 gate_outcomes?: (GateOutcomes | null)
 /**
@@ -12947,6 +13568,15 @@ end_col: number
  * wants the source reads it from the file.
  */
 fragment?: string
+/**
+ * Whether the file path is a symlink, or lies under a symlinked
+ * directory, inside the project root. Omitted when `false`.
+ *
+ * A clone with a symlinked instance can be the same file under two
+ * paths, not copied code. `duplicates.ignoreSymlinks` (or
+ * `fallow dupes --ignore-symlinks`) removes these instances.
+ */
+is_symlink?: boolean
 /**
  * Resolver key for this specific instance (per-instance, not the
  * group-level largest-owner).
@@ -12982,6 +13612,13 @@ groups: CheckGroupedEntry[]
  * only when `true`, like the flat `CheckOutput` field.
  */
 unused_load_data_keys_global_abstain?: boolean
+/**
+ * Number of export and member findings that the run hid because their
+ * file is an unused file. The count covers the whole run, so it is on
+ * the root and not in a group. Serialized only when not zero, like the
+ * flat `CheckOutput` field.
+ */
+cascade_hidden?: number
 /**
  * This run's view of the loaded baseline, present only in baseline runs.
  * Carries the staleness counts, the advisory verdict and `gate_trips`, the
@@ -13320,6 +13957,10 @@ dynamic_segment_name_conflicts?: DynamicSegmentNameConflictFinding[]
  * array natively. Default severity is `warn`.
  */
 unused_component_props?: UnusedComponentPropFinding[]
+/**
+ * Used optional component inputs absent from inspected reachable callers. Off by default.
+ */
+absent_component_props?: AbsentComponentPropFinding[]
 /**
  * Vue `<script setup>` `defineEmits` events emitted nowhere in their own SFC
  * (no `emit('<name>')` call). Wrapped in [`UnusedComponentEmitFinding`] so
@@ -13399,6 +14040,106 @@ thin_wrappers?: ThinWrapperFinding[]
  * enables it.
  */
 duplicate_prop_shapes?: DuplicatePropShapeFinding[]
+/**
+ * Number of `unused_exports`, `unused_types`, `unused_class_members` and
+ * `unused_enum_members` findings that this run did not report because
+ * their file is an unused file. Deleting the file removes them, so they
+ * add no information. `--show-cascade` or the `showCascade` config key
+ * keeps them in the report, and then this count is zero. The count is
+ * taken after the scope and the rules and before a baseline. Serialized
+ * only when not zero, so a run without such findings keeps its JSON.
+ */
+cascade_hidden?: number
+}
+/**
+ * Envelope emitted by `fallow architecture --group-by ... --format json`.
+ *
+ * The body is the `CheckGroupedOutput` body of `fallow dead-code`: issues are partitioned into resolver buckets (CODEOWNERS team, directory prefix, workspace package, or GitLab CODEOWNERS section), and each bucket carries the same issue-array shape as `ArchitectureOutput`, plus per-group `key` / `owners` / `total_issues`.
+ */
+export interface ArchitectureGroupedOutput {
+schema_version: ArchitectureSchemaVersion
+version: ToolVersion
+elapsed_ms: ElapsedMs
+grouped_by: GroupByMode
+/**
+ * Total findings across all groups.
+ */
+total_issues: number
+/**
+ * One bucket per resolver key.
+ */
+groups: CheckGroupedEntry[]
+/**
+ * `true` when the `unused-load-data-key` detector abstained for the whole
+ * project. The abstain has no file, so it is on the root and not in a
+ * group. An empty `unused_load_data_keys` with this flag set does not
+ * mean the project is clean: the rule could not run safely. Serialized
+ * only when `true`, like the flat `CheckOutput` field.
+ */
+unused_load_data_keys_global_abstain?: boolean
+/**
+ * Number of export and member findings that the run hid because their
+ * file is an unused file. The count covers the whole run, so it is on
+ * the root and not in a group. Serialized only when not zero, like the
+ * flat `CheckOutput` field.
+ */
+cascade_hidden?: number
+/**
+ * This run's view of the loaded baseline, present only in baseline runs.
+ * Carries the staleness counts, the advisory verdict and `gate_trips`, the
+ * same boolean `--fail-on-stale-baseline` exits on, so a CI integration
+ * reads one field instead of restating the rule. Read `change_scoped`
+ * before dividing `matched_entries` by `baseline_entries`: a narrowed run
+ * can report `matched_entries: 0` on a healthy baseline.
+ */
+baseline_staleness?: (BaselineStaleness | null)
+/**
+ * The answer to `--finding-id`, present only when the run received one
+ * or more `--finding-id` values. The report then holds only the
+ * requested findings. Read `missing` as resolved only when `conclusive`
+ * is true; a scope, a baseline or a filter can hide a finding that still
+ * exists. See [`crate::FindingIdQuery`].
+ */
+finding_id_query?: (FindingIdQuery | null)
+/**
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
+ */
+gate_outcomes?: (GateOutcomes | null)
+/**
+ * Every narrowing or shaping request this run RECEIVED, keyed by name,
+ * absent when it was asked for nothing. An entry whose `status` is not
+ * `applied` means the run could not do what it was asked and reported
+ * something WIDER instead, so what follows is a valid report of a scope
+ * nobody requested. Honoured requests are published too, with
+ * `status: "applied"`, so an absent object means "nothing was asked for",
+ * never "nothing failed". See [`crate::RequestOutcomes`].
+ */
+request_outcomes?: (RequestOutcomes | null)
+/**
+ * Applied package Git refs, omitted outside package-baseline runs.
+ */
+package_baselines?: PackageBaselineStatus[]
+/**
+ * `_meta` block with docs and rule definitions, when `--explain` was
+ * passed.
+ */
+_meta?: (Meta | null)
+/**
+ * Diagnostics collected for the full analysis before issue grouping.
+ * See [`CheckOutput::workspace_diagnostics`] for the contract.
+ */
+workspace_diagnostics?: WorkspaceDiagnostic[]
+/**
+ * Read-only follow-up commands computed from the full (ungrouped) findings.
+ * See [`CheckOutput::next_steps`] for the contract.
+ */
+next_steps?: NextStep[]
 }
 /**
  * The rendered impact report, derived purely from the store.
@@ -14550,101 +15291,594 @@ needs_human_review: number
 unverdicted: number
 }
 /**
- * One verifier-retained candidate row.
+ * One verifier-retained candidate row.
+ */
+export interface SecuritySurvivor {
+/**
+ * Stable candidate id from `security_findings[].finding_id`.
+ */
+finding_id: string
+verdict: SecurityVerifierVerdictStatus
+/**
+ * Short machine-oriented verdict reason.
+ */
+reason?: (string | null)
+/**
+ * Longer free-form verdict explanation.
+ */
+rationale?: (string | null)
+/**
+ * Optional verifier-provided confidence or review priority.
+ */
+confidence?: (string | null)
+/**
+ * Optional verifier-provided impact statement.
+ */
+impact?: (string | null)
+/**
+ * Optional verifier-owned remediation direction.
+ */
+fix_direction?: (string | null)
+candidate: SecurityFinding
+}
+/**
+ * The `fallow security blind-spots --format json` envelope.
+ */
+export interface SecurityBlindSpotsOutput {
+schema_version: SecurityBlindSpotsSchemaVersion
+version: ToolVersion
+elapsed_ms: ElapsedMs
+/**
+ * Diagnostics owned by the security analysis used for this view.
+ */
+workspace_diagnostics?: WorkspaceDiagnostic[]
+summary: SecurityBlindSpotsSummary
+/**
+ * Grouped unresolved callee diagnostics, derived from existing samples.
+ */
+groups: SecurityBlindSpotGroup[]
+}
+/**
+ * Aggregate counts for blind-spot output.
+ */
+export interface SecurityBlindSpotsSummary {
+/**
+ * Files containing at least one unresolved callee.
+ */
+unresolved_edge_files: number
+/**
+ * Total unresolved callee sites in the analysis.
+ */
+unresolved_callee_sites: number
+/**
+ * Callee sites captured in the bounded diagnostic sample.
+ */
+sampled_callee_sites: number
+}
+/**
+ * One actionable blind-spot group.
+ */
+export interface SecurityBlindSpotGroup {
+reason: SkippedSecurityCalleeReason
+expression_kind: SkippedSecurityCalleeExpressionKind
+/**
+ * Count in the bounded diagnostic sample.
+ */
+sampled_count: number
+/**
+ * Top files in this bounded diagnostic sample.
+ */
+files: SecurityBlindSpotFile[]
+/**
+ * Suggested next action for this group.
+ */
+suggestion: string
+}
+/**
+ * One file inside a blind-spot group.
+ */
+export interface SecurityBlindSpotFile {
+/**
+ * File path relative to the analysed root.
+ */
+path: string
+/**
+ * Count in the bounded diagnostic sample.
+ */
+sampled_count: number
+}
+/**
+ * Envelope emitted by `fallow architecture --format json`.
+ *
+ * The body is the `CheckOutput` body of `fallow dead-code`: the same issue arrays, `summary`, `entry_points`, actions and `gate_outcomes`. The architecture arrays (`circular_dependencies`, `re_export_cycles`, `package_cycles`, `boundary_violations`, `boundary_coverage_violations`, `boundary_call_violations`, `policy_violations`) carry the findings. The combined and audit envelopes do not use this envelope; their `check` block stays `CheckOutput`.
+ */
+export interface ArchitectureOutput {
+schema_version: ArchitectureSchemaVersion
+version: ToolVersion
+elapsed_ms: ElapsedMs
+/**
+ * Total findings across all issue arrays; excludes `next_steps`.
+ */
+total_issues: number
+/**
+ * Entry-point totals per source, when the analysis recorded them.
+ */
+entry_points?: (EntryPoints | null)
+summary: CheckSummary
+/**
+ * Files not reachable from any entry point. Wrapped in
+ * [`UnusedFileFinding`] so each entry carries a typed `actions` array
+ * natively, replacing the pre-2.76 post-pass injection.
+ */
+unused_files: UnusedFileFinding[]
+/**
+ * Exports never imported by other modules. Wrapped in
+ * [`UnusedExportFinding`] so each entry carries a typed `actions`
+ * array natively.
+ */
+unused_exports: UnusedExportFinding[]
+/**
+ * Type exports never imported by other modules. Wrapped in
+ * [`UnusedTypeFinding`]: the inner [`UnusedExport`] struct is shared
+ * with `unused_exports` but the wrapper emits a type-targeted fix
+ * description.
+ */
+unused_types: UnusedTypeFinding[]
+/**
+ * Exported symbols whose public signature references same-file private
+ * types. Wrapped in [`PrivateTypeLeakFinding`] so each entry carries a
+ * typed `actions` array natively.
+ */
+private_type_leaks: PrivateTypeLeakFinding[]
+/**
+ * Exports marked `@deprecated` that still have at least one consumer in
+ * a reachable file. Wrapped in [`DeprecatedExportInUseFinding`]. Opt-in: the
+ * `deprecated-exports-in-use` rule defaults to `off`.
+ */
+deprecated_exports_in_use?: DeprecatedExportInUseFinding[]
+/**
+ * Dependencies listed in package.json but never imported. Wrapped in
+ * [`UnusedDependencyFinding`] so each entry carries a typed `actions`
+ * array natively. The fix action swaps from `remove-dependency` to
+ * `move-dependency` when `used_in_workspaces` is non-empty.
+ */
+unused_dependencies: UnusedDependencyFinding[]
+/**
+ * Dev dependencies listed in package.json but never imported. Wrapped
+ * in [`UnusedDevDependencyFinding`]: same bare struct as
+ * `unused_dependencies` with a `devDependencies`-targeted fix
+ * description.
+ */
+unused_dev_dependencies: UnusedDevDependencyFinding[]
+/**
+ * Optional dependencies listed in package.json but never imported.
+ * Wrapped in [`UnusedOptionalDependencyFinding`] with an
+ * `optionalDependencies`-targeted fix description.
+ */
+unused_optional_dependencies: UnusedOptionalDependencyFinding[]
+/**
+ * Enum members never accessed. Wrapped in
+ * [`UnusedEnumMemberFinding`] so each entry carries a typed `actions`
+ * array natively.
+ */
+unused_enum_members: UnusedEnumMemberFinding[]
+/**
+ * Class members never accessed. Wrapped in
+ * [`UnusedClassMemberFinding`]: same inner [`UnusedMember`] struct as
+ * `unused_enum_members`, with a class-targeted fix description and the
+ * `auto_fixable: false` default to reflect dependency-injection
+ * patterns.
+ */
+unused_class_members: UnusedClassMemberFinding[]
+/**
+ * Store members (Pinia `state` / `getters` / `actions` key, or a
+ * setup-store returned key) declared but never accessed by any consumer
+ * project-wide. Wrapped in [`UnusedStoreMemberFinding`]: same inner
+ * [`UnusedMember`] struct as `unused_class_members`, with a
+ * store-targeted fix description. Cross-graph: the store binding is
+ * imported (the module is reachable) yet a specific member is dead.
+ */
+unused_store_members?: UnusedStoreMemberFinding[]
+/**
+ * Import specifiers that could not be resolved. Wrapped in
+ * [`UnresolvedImportFinding`] so each entry carries a typed `actions`
+ * array natively.
+ */
+unresolved_imports: UnresolvedImportFinding[]
+/**
+ * Dependencies used in code but not listed in package.json. Wrapped in
+ * [`UnlistedDependencyFinding`].
+ */
+unlisted_dependencies: UnlistedDependencyFinding[]
+/**
+ * Exports with the same name across multiple modules. Wrapped in
+ * [`DuplicateExportFinding`] so each entry carries a typed `actions`
+ * array natively, with the position-0 `add-to-config` `ignoreExports`
+ * snippet wired in at wrapper construction.
+ */
+duplicate_exports: DuplicateExportFinding[]
+/**
+ * Production dependencies only used via type-only imports (could be
+ * devDependencies). Only populated in production mode. Wrapped in
+ * [`TypeOnlyDependencyFinding`].
+ */
+type_only_dependencies: TypeOnlyDependencyFinding[]
+/**
+ * Production dependencies only imported by test files (could be
+ * devDependencies). Wrapped in [`TestOnlyDependencyFinding`].
+ */
+test_only_dependencies?: TestOnlyDependencyFinding[]
+/**
+ * devDependencies imported by production (non-test, non-config) source code
+ * via a runtime/value import; they should be promoted to dependencies.
+ * The promote-side mirror of [`TestOnlyDependencyFinding`]. Wrapped in
+ * [`DevDependencyInProductionFinding`].
+ */
+dev_dependencies_in_production?: DevDependencyInProductionFinding[]
+/**
+ * Circular dependency chains detected in the module graph. Wrapped in
+ * [`CircularDependencyFinding`] so each entry carries a typed `actions`
+ * array natively.
+ */
+circular_dependencies: CircularDependencyFinding[]
+/**
+ * Cycles or self-loops in the re-export edge subgraph (barrel files
+ * re-exporting from each other in a loop). Wrapped in
+ * [`ReExportCycleFinding`] so each entry carries a typed `actions`
+ * array natively (a `refactor-re-export-cycle` informational primary
+ * plus a `suppress-file` secondary; cycles are file-scoped so a single
+ * suppression breaks the cycle).
+ */
+re_export_cycles?: ReExportCycleFinding[]
+/**
+ * Dependency cycles between workspace packages, built from resolved
+ * cross-package imports. Wrapped in [`PackageCycleFinding`] so each
+ * entry carries a typed `actions` array natively.
+ */
+package_cycles?: PackageCycleFinding[]
+/**
+ * Imports that cross architecture boundary rules. Wrapped in
+ * [`BoundaryViolationFinding`] so each entry carries a typed `actions`
+ * array natively.
+ */
+boundary_violations?: BoundaryViolationFinding[]
+/**
+ * Files that matched no architecture boundary zone while
+ * `boundaries.coverage.requireAllFiles` was enabled.
+ */
+boundary_coverage_violations?: BoundaryCoverageViolationFinding[]
+/**
+ * Calls from zoned files to callees forbidden for that zone via
+ * `boundaries.calls.forbidden`. Wrapped in
+ * [`BoundaryCallViolationFinding`] so each entry carries a typed
+ * `actions` array natively.
+ */
+boundary_call_violations?: BoundaryCallViolationFinding[]
+/**
+ * Banned calls, imports, and catalogue-derived effects matched by
+ * declarative rule packs
+ * (`rulePacks` config). Wrapped in [`PolicyViolationFinding`] so each
+ * entry carries a typed `actions` array natively. Each finding carries
+ * its effective per-rule severity.
+ */
+policy_violations?: PolicyViolationFinding[]
+/**
+ * Suppression comments or JSDoc tags that no longer match any issue.
+ */
+stale_suppressions?: StaleSuppression[]
+/**
+ * Entries in package manager catalog sections not referenced by any
+ * workspace package via the catalog: protocol. Supports
+ * `pnpm-workspace.yaml` catalogs and Bun root `package.json` catalogs.
+ * Wrapped in [`UnusedCatalogEntryFinding`] so each entry carries a typed
+ * `actions` array natively, with per-instance `auto_fixable` derived
+ * from `hardcoded_consumers` and the catalog source file.
+ */
+unused_catalog_entries?: UnusedCatalogEntryFinding[]
+/**
+ * Named groups under package manager catalogs sections that declare no
+ * package entries. The top-level catalog: map is not reported. Wrapped in
+ * [`EmptyCatalogGroupFinding`].
+ */
+empty_catalog_groups?: EmptyCatalogGroupFinding[]
+/**
+ * Workspace package.json references to catalogs (`catalog:` or
+ * `catalog:<name>`) that do not declare the consumed package. The package
+ * manager install will error until the named catalog grows to include the
+ * package or the reference is switched / removed. Wrapped in
+ * [`UnresolvedCatalogReferenceFinding`] with the discriminated
+ * `add-catalog-entry` / `update-catalog-reference` primary at position 0.
+ */
+unresolved_catalog_references?: UnresolvedCatalogReferenceFinding[]
+/**
+ * Entries in pnpm-workspace.yaml's overrides section, package.json's
+ * pnpm.overrides block, npm or Bun's top-level overrides object, or Bun's
+ * top-level resolutions object,
+ * whose target package is not declared by any workspace package and is
+ * not present in pnpm-lock.yaml, package-lock.json, npm-shrinkwrap.json,
+ * or bun.lock. Default severity is warn because projects without a
+ * readable lockfile fall back to manifest-only checks; the hint field
+ * flags those conservative cases. When the only lockfile is bun's binary
+ * bun.lockb, resolution cannot be read and the check emits nothing.
+ * Wrapped in [`UnusedDependencyOverrideFinding`].
+ */
+unused_dependency_overrides?: UnusedDependencyOverrideFinding[]
+/**
+ * Package-manager override or resolution entries whose key or value does
+ * not parse in the declaration source's grammar (empty key, empty value,
+ * malformed selector, unbalanced parent matcher). The package manager may
+ * reject or ignore these at install time. Default severity is error. Wrapped in
+ * [`MisconfiguredDependencyOverrideFinding`].
+ */
+misconfigured_dependency_overrides?: MisconfiguredDependencyOverrideFinding[]
+/**
+ * `"use client"` files that export a Next.js server-only / route-segment
+ * config name (e.g. `metadata`, `revalidate`, `GET`). Next.js rejects this
+ * at build time. Wrapped in [`InvalidClientExportFinding`] so each entry
+ * carries a typed `actions` array natively. Default severity is `warn`.
+ */
+invalid_client_exports?: InvalidClientExportFinding[]
+/**
+ * Barrel files that re-export BOTH a `"use client"` origin module AND a
+ * server-only origin module (the Next.js App Router footgun). Wrapped in
+ * [`MixedClientServerBarrelFinding`] so each entry carries a typed
+ * `actions` array natively. Default severity is `warn`.
+ */
+mixed_client_server_barrels?: MixedClientServerBarrelFinding[]
+/**
+ * `"use client"` / `"use server"` directives written as expression
+ * statements after a non-directive statement, so the RSC bundler parses
+ * them as ordinary strings and silently ignores them. Wrapped in
+ * [`MisplacedDirectiveFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+misplaced_directives?: MisplacedDirectiveFinding[]
+/**
+ * Vue `inject(KEY)` / Svelte `getContext(KEY)` calls whose symbol KEY is
+ * provided nowhere in the project (the injected-never-provided dead-half).
+ * Wrapped in [`UnprovidedInjectFinding`] so each entry carries a typed
+ * `actions` array natively. Default severity is `warn`.
+ */
+unprovided_injects?: UnprovidedInjectFinding[]
+/**
+ * Vue/Svelte single-file components that are reachable but rendered nowhere
+ * (the imported-but-never-rendered dead-half). Wrapped in
+ * [`UnrenderedComponentFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+unrendered_components?: UnrenderedComponentFinding[]
+/**
+ * Next.js App Router route files that resolve to the same URL within one
+ * app-root (a guaranteed `next build` failure). Wrapped in
+ * [`RouteCollisionFinding`] so each entry carries a typed `actions` array
+ * natively. One finding per colliding file. Default severity is `warn`.
+ */
+route_collisions?: RouteCollisionFinding[]
+/**
+ * Sibling Next.js dynamic route segments at one tree position using
+ * different param spellings (a dev / runtime error; `next build` does NOT
+ * catch it). Wrapped in [`DynamicSegmentNameConflictFinding`] so each entry
+ * carries a typed `actions` array natively. Default severity is `warn`.
+ */
+dynamic_segment_name_conflicts?: DynamicSegmentNameConflictFinding[]
+/**
+ * Vue `<script setup>` `defineProps`, Svelte 5 `$props()`, and React props
+ * referenced nowhere in their own component. Wrapped in
+ * [`UnusedComponentPropFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
+ */
+unused_component_props?: UnusedComponentPropFinding[]
+/**
+ * Used optional component inputs absent from inspected reachable callers. Off by default.
+ */
+absent_component_props?: AbsentComponentPropFinding[]
+/**
+ * Vue `<script setup>` `defineEmits` events emitted nowhere in their own SFC
+ * (no `emit('<name>')` call). Wrapped in [`UnusedComponentEmitFinding`] so
+ * each entry carries a typed `actions` array natively. Default severity is
+ * `warn`.
+ */
+unused_component_emits?: UnusedComponentEmitFinding[]
+/**
+ * Angular `@Input()` / signal `input()` / `model()` inputs read nowhere in
+ * their own component (neither the template nor the class body). Wrapped in
+ * [`UnusedComponentInputFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
  */
-export interface SecuritySurvivor {
+unused_component_inputs?: UnusedComponentInputFinding[]
 /**
- * Stable candidate id from `security_findings[].finding_id`.
+ * Angular `@Output()` / signal `output()` outputs emitted nowhere in their
+ * own component (no `this.<output>.emit(...)`). Wrapped in
+ * [`UnusedComponentOutputFinding`] so each entry carries a typed `actions`
+ * array natively. Default severity is `warn`.
  */
-finding_id: string
-verdict: SecurityVerifierVerdictStatus
+unused_component_outputs?: UnusedComponentOutputFinding[]
 /**
- * Short machine-oriented verdict reason.
+ * Svelte components dispatching a custom event via `createEventDispatcher()`
+ * whose event name is listened to nowhere project-wide (cross-file
+ * dead-output direction). Wrapped in [`UnusedSvelteEventFinding`] so each
+ * entry carries a typed `actions` array natively. Default severity is
+ * `warn`.
  */
-reason?: (string | null)
+unused_svelte_events?: UnusedSvelteEventFinding[]
 /**
- * Longer free-form verdict explanation.
+ * Next.js Server Actions (exports of `"use server"` files) that no code in
+ * the project references. Reclassified out of `unused_exports` for
+ * `"use server"` files. Wrapped in [`UnusedServerActionFinding`] so each
+ * entry carries a typed `actions` array natively. Default severity is
+ * `warn`.
  */
-rationale?: (string | null)
+unused_server_actions?: UnusedServerActionFinding[]
 /**
- * Optional verifier-provided confidence or review priority.
+ * SvelteKit `+page.{ts,server.ts,js,server.js}` `load()` return-object keys
+ * read by no consumer. Wrapped in [`UnusedLoadDataKeyFinding`] so each entry
+ * carries a typed `actions` array natively. Default severity is `warn`.
  */
-confidence?: (string | null)
+unused_load_data_keys?: UnusedLoadDataKeyFinding[]
 /**
- * Optional verifier-provided impact statement.
+ * `true` when the `unused-load-data-key` detector abstained project-wide
+ * because a whole-object use of `page.data` / `$page.data` was seen
+ * somewhere (S1 observability: an empty `unused_load_data_keys` with this
+ * flag set is NOT a clean bill, it means the rule could not run safely).
+ * Serialized only when `true` so the default JSON contract is unchanged.
  */
-impact?: (string | null)
+unused_load_data_keys_global_abstain?: boolean
 /**
- * Optional verifier-owned remediation direction.
+ * React/Preact props forwarded unchanged through `>= N` intermediate
+ * pass-through components until a consumer (located per-chain records).
+ * Wrapped in [`PropDrillingChainFinding`] so each entry carries a typed
+ * `actions` array natively. Health signal: the rule defaults to `off`
+ * (opt-in), so this is dormant and populated ONLY when the user enables it.
  */
-fix_direction?: (string | null)
-candidate: SecurityFinding
-}
+prop_drilling_chains?: PropDrillingChainFinding[]
 /**
- * The `fallow security blind-spots --format json` envelope.
+ * React/Preact components whose entire body is a single spread-forwarded
+ * child render (`return <Child {...props}/>`): pure structural indirection,
+ * a candidate for inlining at call sites. Wrapped in [`ThinWrapperFinding`]
+ * so each entry carries a typed `actions` array natively. Health signal: the
+ * rule defaults to `off` (opt-in), so this is dormant and populated ONLY
+ * when the user enables it.
  */
-export interface SecurityBlindSpotsOutput {
-schema_version: SecurityBlindSpotsSchemaVersion
-version: ToolVersion
-elapsed_ms: ElapsedMs
+thin_wrappers?: ThinWrapperFinding[]
 /**
- * Diagnostics owned by the security analysis used for this view.
+ * React/Preact components that participate in a duplicate-prop-shape group:
+ * three or more components across two or more files whose statically-known
+ * prop NAME set is identical after stripping ubiquitous DOM / passthrough
+ * names (a missing shared `Props` type / base component). Wrapped in
+ * [`DuplicatePropShapeFinding`] so each entry carries a typed `actions`
+ * array and its sibling roster natively. Health signal: the rule defaults to
+ * `off` (opt-in), so this is dormant and populated ONLY when the user
+ * enables it.
  */
-workspace_diagnostics?: WorkspaceDiagnostic[]
-summary: SecurityBlindSpotsSummary
+duplicate_prop_shapes?: DuplicatePropShapeFinding[]
 /**
- * Grouped unresolved callee diagnostics, derived from existing samples.
+ * Number of `unused_exports`, `unused_types`, `unused_class_members` and
+ * `unused_enum_members` findings that this run did not report because
+ * their file is an unused file. Deleting the file removes them, so they
+ * add no information. `--show-cascade` or the `showCascade` config key
+ * keeps them in the report, and then this count is zero. The count is
+ * taken after the scope and the rules and before a baseline. Serialized
+ * only when not zero, so a run without such findings keeps its JSON.
  */
-groups: SecurityBlindSpotGroup[]
-}
+cascade_hidden?: number
 /**
- * Aggregate counts for blind-spot output.
+ * Count deltas against the matched baseline, in baseline runs.
  */
-export interface SecurityBlindSpotsSummary {
+baseline_deltas?: (BaselineDeltas | null)
 /**
- * Files containing at least one unresolved callee.
+ * Which baseline snapshot was matched, in baseline runs.
  */
-unresolved_edge_files: number
+baseline?: (BaselineMatch | null)
 /**
- * Total unresolved callee sites in the analysis.
+ * This run's view of the loaded baseline, present only in baseline runs.
+ * Carries the staleness counts, the advisory verdict and `gate_trips`, the
+ * same boolean `--fail-on-stale-baseline` exits on, so a CI integration
+ * reads one field instead of restating the rule. Read `change_scoped`
+ * before dividing `matched_entries` by `baseline_entries`: a narrowed run
+ * can report `matched_entries: 0` on a healthy baseline.
  */
-unresolved_callee_sites: number
+baseline_staleness?: (BaselineStaleness | null)
 /**
- * Callee sites captured in the bounded diagnostic sample.
+ * The answer to `--finding-id`, present only when the run received one
+ * or more `--finding-id` values. The report then holds only the
+ * requested findings. Read `missing` as resolved only when `conclusive`
+ * is true; a scope, a baseline or a filter can hide a finding that still
+ * exists. See [`crate::FindingIdQuery`].
  */
-sampled_callee_sites: number
-}
+finding_id_query?: (FindingIdQuery | null)
 /**
- * One actionable blind-spot group.
+ * Regression verdict against the baseline, in `--fail-on-regression` runs.
  */
-export interface SecurityBlindSpotGroup {
-reason: SkippedSecurityCalleeReason
-expression_kind: SkippedSecurityCalleeExpressionKind
+regression?: (RegressionResult | null)
 /**
- * Count in the bounded diagnostic sample.
+ * The verdict of every gate this run evaluated, keyed by name. The CLI
+ * always emits it, with the command's default exit rule in it also when
+ * no flag armed a gate, so a CI integration reads the verdict instead of
+ * guessing from a process status it usually cannot see. A gate fails the
+ * build when `status` is `fail` AND `enforced` is true. The typed
+ * programmatic API runs no CLI gate and leaves it absent. See
+ * [`crate::GateOutcomes`].
  */
-sampled_count: number
+gate_outcomes?: (GateOutcomes | null)
 /**
- * Top files in this bounded diagnostic sample.
+ * Every narrowing or shaping request this run RECEIVED, keyed by name,
+ * absent when it was asked for nothing. An entry whose `status` is not
+ * `applied` means the run could not do what it was asked and reported
+ * something WIDER instead, so what follows is a valid report of a scope
+ * nobody requested. Honoured requests are published too, with
+ * `status: "applied"`, so an absent object means "nothing was asked for",
+ * never "nothing failed". See [`crate::RequestOutcomes`].
  */
-files: SecurityBlindSpotFile[]
+request_outcomes?: (RequestOutcomes | null)
 /**
- * Suggested next action for this group.
+ * Applied Git refs for exact workspace packages. Absent when no package
+ * baselines were selected, including runs with a global changed-since ref.
  */
-suggestion: string
-}
+package_baselines?: PackageBaselineStatus[]
 /**
- * One file inside a blind-spot group.
+ * `_meta` block with docs and rule definitions, when `--explain` was
+ * passed.
  */
-export interface SecurityBlindSpotFile {
+_meta?: (Meta | null)
 /**
- * File path relative to the analysed root.
+ * Non-fatal diagnostics about the project itself, from all three stages
+ * that record them (issue #473):
+ *
+ * - workspace discovery, at config load: `undeclared-workspace`,
+ *   `malformed-package-json`, `glob-matched-no-package-json`,
+ *   `malformed-tsconfig`, `tsconfig-reference-dir-missing`;
+ * - source discovery, during the file walk: `skipped-large-file`,
+ *   `skipped-minified-file`, `skipped-source-dotdir`,
+ *   `excluded-by-default-ignore`, `source-read-failure`,
+ *   `source-parse-degraded`;
+ * - dead-code analysis, from the dependency-catalog and override
+ *   detectors: `malformed-pnpm-workspace-yaml`,
+ *   `bun-lockb-override-resolution-skipped`;
+ * - framework plugins, while they read their own build configs:
+ *   `plugin-config-unreadable`, `plugin-effect-not-modeled`;
+ * - the dead-code result, for config patterns that matched nothing:
+ *   `ignore-dependencies-glob-unmatched`,
+ *   `ignore-findings-pattern-unmatched`.
+ *
+ * Analysis-stage and plugin-stage kinds therefore reach only the envelopes
+ * whose run includes a dead-code analyze pass, never a standalone
+ * `fallow dupes --format json`. `path` is project-root-relative with
+ * forward slashes; the array is omitted when empty. The same list is
+ * repeated on each top-level command's envelope so single-command
+ * consumers see it without having to look at a separate top-level field.
+ *
+ * A diagnostic here is advisory and never withholds a finding. Where an
+ * entry reports a source file this run never fully analyzed
+ * (`source-parse-degraded`, `source-read-failure`, `skipped-large-file`,
+ * `skipped-minified-file`, `skipped-source-dotdir`) it can distort a
+ * verdict, so the affected `unused_files[]`, `unused_exports[]`, and
+ * dependency entries additionally carry the caveat themselves in their own
+ * optional `reachability_caveats[]` array, and a reader who never scrolls
+ * back up to this list still sees it. `fallow fix` reads the same array
+ * and withholds the removal while a caveat stands.
+ *
+ * `excluded-by-default-ignore` is the one source-discovery kind that
+ * reports unseen files WITHOUT raising a caveat. It names a built-in
+ * ignore pattern (`** /dist/**`, `** /build/**`, `** /coverage/**`, or one
+ * of the four minified-bundle globs) that removed candidate source files
+ * from the walk, which is designed behavior on generated output rather
+ * than a degraded run, so it is advisory only and no finding inherits it.
+ * One entry per pattern, never per file, so the array stays bounded on a
+ * project of any size. Gitignored trees are pruned before the walk sees
+ * them and count zero, and `** /node_modules/**` is never reported:
+ * installed dependencies are not the first-party source the kind is
+ * about.
  */
-path: string
+workspace_diagnostics?: WorkspaceDiagnostic[]
 /**
- * Count in the bounded diagnostic sample.
+ * Read-only follow-up commands computed from this run's findings, emitted
+ * at the JSON root so an agent acting on the output is pointed at fallow's
+ * adjacent verification capabilities (trace, complexity breakdown, audit,
+ * workspace scoping). Each command is runnable as-is and never mutating;
+ * see [`NextStep`] for both contracts. Omitted when empty or when
+ * `FALLOW_SUGGESTIONS=off`; does NOT contribute to `total_issues`.
  */
-sampled_count: number
+next_steps?: NextStep[]
 }
 /**
  * Bare `fallow --format json` envelope.
@@ -14660,7 +15894,8 @@ elapsed_ms: ElapsedMs
  * `--fail-on-issues` or `--ci`, the machine formats of the combined run
  * exit 0 for findings, so most entries have `enforced: false`. With one of
  * these flags, the findings rules and `duplication-threshold` are
- * `enforced`, and every format exits 1 when one fails. For the default
+ * `enforced`, the dupes section adds an enforced `duplication-findings`
+ * entry, and every format exits 1 when one fails. For the default
  * exit rules (`error-severity-findings`,
  * `health-findings`), `status` gives the verdict of the human run. An
  * advisory entry can report `fail` without a failure of the human run: an
@@ -17339,6 +18574,88 @@ outcome: SimilarCodeDomainOutcome
  */
 rationale: string
 }
+/**
+ * Machine-readable readiness of the exact local companion and pinned model.
+ */
+export interface SimilarCodeStatusOutput {
+schema_version: SimilarCodeStatusSchemaVersion
+version: ToolVersion
+/**
+ * Companion protocol version.
+ */
+protocol_version: number
+/**
+ * Embedding calculation semantics implemented by the companion.
+ */
+embedding_semantics_version: number
+/**
+ * Exact companion package version.
+ */
+companion_version: string
+/**
+ * Whether every pinned model artifact is ready and verified.
+ */
+model_ready: boolean
+/**
+ * Immutable model identifier.
+ */
+model_id: string
+/**
+ * Immutable model revision.
+ */
+model_revision: string
+/**
+ * Embedding width.
+ */
+dimensions: number
+/**
+ * Maximum tokenizer length.
+ */
+max_tokens: number
+/**
+ * Model license identifier.
+ */
+license: string
+/**
+ * Local model cache directory.
+ */
+cache_dir: string
+/**
+ * Expected download size for all pinned artifacts.
+ */
+download_bytes: number
+/**
+ * Whether source analysis stays local and offline.
+ */
+analysis_offline: boolean
+/**
+ * Whether all installed artifacts passed integrity validation.
+ */
+integrity_verified: boolean
+/**
+ * Actionable readiness problem when the model is unavailable.
+ */
+problem?: (string | null)
+/**
+ * Whether this setup invocation downloaded new bytes.
+ */
+downloaded?: (boolean | null)
+}
+/**
+ * Result of explicitly clearing the derived project-namespaced vector cache.
+ */
+export interface SimilarCodeCacheClearOutput {
+schema_version: SimilarCodeCacheClearSchemaVersion
+version: ToolVersion
+/**
+ * Whether an existing vector cache was removed.
+ */
+removed: boolean
+/**
+ * Whether model artifacts were removed. Version 1 always emits false.
+ */
+model_removed: boolean
+}
 /**
  * Single CodeClimate-compatible issue inside [`CodeClimateOutput`].
  */