fallow 3.36.0 → 3.38.0

package/README.md

@@ -28,7 +28,7 @@ npx fallow fix --dry-run         # Preview automatic cleanup
 
 ## Output and exit codes
 
-Add `--format json --quiet` to any command for one typed JSON document on stdout. Exit code 1 means findings, not failure; 0 is clean (or an audit pass or warn verdict); 2 is a validation or runtime error, reported as a JSON error envelope rather than a stack trace. License, coverage setup, network, and security-gate workflows use additional documented codes; read `fallow schema.exit_codes` instead of suppressing the process status.
+Add `--format json --quiet` to any command for one typed JSON document on stdout. Exit code 1 means findings, not failure; 0 means no enforced gate failed (or an audit pass or warn verdict). Bare `fallow` in a machine format exits 0 on findings unless you pass `--fail-on-issues`; 2 is a validation or runtime error, reported as a JSON error envelope rather than a stack trace. License, coverage setup, network, and security-gate workflows use additional documented codes; read `fallow schema.exit_codes` instead of suppressing the process status.
 
 Parsing the output in TypeScript? Import the typed shapes, version-pinned to the CLI you install:
 

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.36.0",
+  "version": "3.38.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -67,6 +67,26 @@
         "false"
       ]
     },
+    {
+      "name": "--lean",
+      "type": "bool",
+      "required": false,
+      "description": "Trim JSON for agent context: leave out empty arrays and zero dead-code summary counts, group workspace diagnostics, cap health tables, and move repeated action text to `_meta.actions`. Requires JSON output. Applies to dead-code, health and the combined report; other commands reject it. Run without `--lean` for the full diagnostic list and the complete tables",
+      "possible_values": [
+        "true",
+        "false"
+      ]
+    },
+    {
+      "name": "--full-tables",
+      "type": "bool",
+      "required": false,
+      "description": "With `--lean`, keep every row of the health tables (`hotspots`, `file_scores`, `large_functions`)",
+      "possible_values": [
+        "true",
+        "false"
+      ]
+    },
     {
       "name": "--quiet",
       "type": "bool",
@@ -1289,6 +1309,26 @@
             "false"
           ]
         },
+        {
+          "name": "--resume",
+          "type": "bool",
+          "required": false,
+          "description": "Continue an interrupted or partial run: reuse the killed and confirmed survived mutants in its journal and run only the others. A journal of other inputs exits 2",
+          "possible_values": [
+            "true",
+            "false"
+          ]
+        },
+        {
+          "name": "--kill-matrix",
+          "type": "bool",
+          "required": false,
+          "description": "Collect all killing tests and report redundant-test candidates for individual review. Run every covering test without stopping at a failure",
+          "possible_values": [
+            "true",
+            "false"
+          ]
+        },
         {
           "name": "paths",
           "type": "string",
@@ -1332,9 +1372,30 @@
             "true",
             "false"
           ]
+        },
+        {
+          "name": "--cloud",
+          "type": "bool",
+          "required": false,
+          "description": "OPT-IN: attach Fallow Cloud production evidence for a `--file` target as the `cloud` evidence section: calls, errors, CPU and never-run branches per function. The API key is $FALLOW_API_KEY, else the key that `fallow cloud login` stored. A missing key, a plan gate or an unreachable cloud is a section status, never a failed run",
+          "possible_values": [
+            "true",
+            "false"
+          ]
+        },
+        {
+          "name": "--repo",
+          "type": "string",
+          "required": false,
+          "description": "Fallow Cloud repository for `--cloud`. Precedence: this flag > $FALLOW_REPO > the `origin` git remote"
         }
       ]
     },
+    {
+      "name": "cloud",
+      "description": "Connect this machine to Fallow Cloud",
+      "flags": []
+    },
     {
       "name": "trace",
       "description": "Trace a symbol's call chain, or the shortest import path between two modules (best-effort, syntactic; OFF the ranked path)",
@@ -1841,6 +1902,12 @@
           "required": false,
           "description": "Maximum CRAP score threshold (overrides config, default 30.0). Functions meeting or exceeding this score are reported alongside complexity findings. Pair with `--coverage` for accurate scoring"
         },
+        {
+          "name": "--max-file-lines",
+          "type": "string",
+          "required": false,
+          "description": "Maximum physical lines per file (overrides config `health.maxFileLines`, default 0 = off). A longer file is reported as a complexity finding with `exceeded: \"file_lines\"`"
+        },
         {
           "name": "--top",
           "type": "string",
@@ -4536,9 +4603,11 @@
       "sarif_rule_ids": [
         "fallow/thin-wrapper"
       ],
-      "codeclimate_check_names": null,
+      "codeclimate_check_names": [
+        "fallow/thin-wrapper"
+      ],
       "ts_alias": null,
-      "counts_in_total": false,
+      "counts_in_total": true,
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line thin-wrapper",
@@ -4570,9 +4639,11 @@
       "sarif_rule_ids": [
         "fallow/duplicate-prop-shape"
       ],
-      "codeclimate_check_names": null,
+      "codeclimate_check_names": [
+        "fallow/duplicate-prop-shape"
+      ],
       "ts_alias": null,
-      "counts_in_total": false,
+      "counts_in_total": true,
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line duplicate-prop-shape",
@@ -4780,6 +4851,36 @@
       "license_note": null,
       "docs_url": "https://fallow.tools/docs/explanations/health/#crap-score"
     },
+    {
+      "id": "long-file",
+      "rule_id": "fallow/long-file",
+      "command": "health",
+      "category": "Health",
+      "description": "File has more lines than the file-length threshold",
+      "label": null,
+      "config_key": null,
+      "registry_index": null,
+      "aliases": [],
+      "lsp": false,
+      "filter_flag": "--complexity",
+      "result_key": null,
+      "summary_label": null,
+      "summary_docs_anchor": null,
+      "sarif_rule_ids": null,
+      "codeclimate_check_names": null,
+      "ts_alias": null,
+      "counts_in_total": false,
+      "fixable": false,
+      "suppressible": true,
+      "suppress_comment": "// fallow-ignore-file complexity",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
+      "note": null,
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://fallow.tools/docs/explanations/health/#file-length"
+    },
     {
       "id": "refactoring-target",
       "rule_id": "fallow/refactoring-target",
@@ -6995,8 +7096,8 @@
     "github-summary"
   ],
   "exit_codes": {
-    "0": "Success (no error-severity issues found)",
-    "1": "Error-severity issues found (per rules config, or --fail-on-issues promotes warn to error)",
+    "0": "Success: no enforced gate failed. Bare fallow in a machine format (json, sarif, codeclimate, the GitHub formats, the comment and review formats) does not enforce findings without --fail-on-issues, so it exits 0 on findings. Read gate_outcomes: status \"fail\" with enforced false is a failing gate that did not set the exit code",
+    "1": "An enforced gate failed, for example error-severity findings (per rules config, or --fail-on-issues promotes warn to error). This is an analysis result, not a tool failure",
     "2": "Error (invalid config, invalid input, etc.). When --format json is active, errors are emitted as structured JSON on stdout: {\"error\": true, \"message\": \"...\", \"exit_code\": 2}",
     "3": "Requested resource unavailable: config --path found no config, or a license is missing, invalid, or beyond its offline hard-fail window",
     "4": "Runtime coverage sidecar is unavailable, unverifiable, protocol-incompatible, or terminated unexpectedly",
@@ -7034,7 +7135,7 @@
     "FALLOW_MAX_FILE_SIZE": "Per-file size ceiling in megabytes for source discovery (default 5; 0 = no limit). CLI --max-file-size flag overrides this.",
     "FALLOW_TYPE_AWARE": "Enable or disable TypeScript semantic (type-aware) analysis for the run (true/false/1/0/yes/no/on/off). Precedence: --type-aware/--no-type-aware CLI flags, then FALLOW_TYPE_AWARE, then the audit.typeAware config field, then typeAware.enabled.",
     "FALLOW_TYPE_AWARE_TIMEOUT_SECS": "Wall clock in seconds allowed for one TypeScript semantic sidecar request (default 120; unset, 0, or a non-numeric value keeps the default). Raise it for very large TypeScript programs, where a semantic query scans the whole program.",
-    "FALLOW_TYPE_AWARE_BACKEND": "Experimental. Type-checker backend for the TypeScript semantic sidecar: typescript-go (default) or tsrs. The tsrs backend needs the exact pinned tsrs npm package where fallow-type-aware can resolve it. An unknown value makes the type-aware pass unavailable.",
+    "FALLOW_TYPE_AWARE_BACKEND": "Experimental. Type-checker backend for the TypeScript semantic sidecar: typescript-go (default) or tsrs. The tsrs backend needs a tsrs npm package in the supported range of the type-aware protocol manifest, where fallow-type-aware can resolve it. An unknown value makes the type-aware pass unavailable.",
     "FALLOW_TYPE_AWARE_BIN": "Trusted executable override for the TypeScript semantic refinement sidecar used by dead-code --type-aware. Relative paths resolve from the caller's working directory before --root is applied; project node_modules and PATH are intentionally not searched. Default: sibling of the active Fallow executable.",
     "FALLOW_AUDIT_BASE": "Pins the fallow audit comparison base ref when no --base/--changed-since is passed (e.g. upstream/main).",
     "FALLOW_AUDIT_CACHE_MAX_AGE_DAYS": "GC threshold in days for reusable audit base-snapshot caches (default 30; 0 disables the sweep).",
@@ -7046,9 +7147,10 @@
     "FALLOW_COV_BIN": "Explicit path override for the fallow-cov runtime-coverage sidecar binary.",
     "FALLOW_COV_BINARY_PATH": "Secondary explicit path override for the fallow-cov sidecar, checked after FALLOW_COV_BIN (air-gapped installs, distro-packaged sidecars, shared Docker images).",
     "FALLOW_RUNTIME_COVERAGE_SOURCE": "Set to cloud to select cloud runtime coverage in fallow coverage analyze without passing --cloud.",
-    "FALLOW_REPO": "owner/repo fallback for fallow coverage analyze --cloud when --repo is not passed (otherwise parsed from the git origin remote).",
+    "FALLOW_REPO": "owner/repo fallback for fallow coverage analyze --cloud and fallow inspect --cloud when --repo is not passed (otherwise parsed from the git origin remote).",
     "FALLOW_API_URL": "Base URL override for Fallow Cloud API calls (license refresh, trial, coverage uploads).",
-    "FALLOW_API_KEY": "Fallow Cloud bearer token for coverage upload commands, and the fallback bearer for fallow license refresh when the stored license JWT is missing or too stale.",
+    "FALLOW_API_KEY": "Fallow Cloud bearer token for coverage upload and cloud read commands (wins over the key that fallow cloud login stored), and the fallback bearer for fallow license refresh when the stored license JWT is missing or too stale.",
+    "FALLOW_CREDENTIAL_STORE": "Credential store for the key that fallow cloud login writes: auto (default: OS keychain, else ~/.config/fallow/credentials), file (credentials file only) or none (no stored key is read or written).",
     "FALLOW_CA_BUNDLE": "Path to a PEM certificate bundle for Fallow Cloud and provider HTTP calls (replaces the default WebPKI roots).",
     "FALLOW_UPDATE_CHECK": "Set to off/0/false to disable the human-TTY upgrade nudge and its background version check.",
     "FALLOW_CLAUDE_CODE_HINT": "Set to off/0/false/no/disabled to suppress the one-line Claude Code plugin hint on stderr. Fallow writes the hint only inside a Claude Code session (CLAUDECODE or CLAUDE_CODE_CHILD_SESSION), for human output without --quiet, outside CI, and when no Fallow plugin or skill is set up for the project. Default on.",

package/issue-registry.json

@@ -1939,9 +1939,11 @@
       "sarif_rule_ids": [
         "fallow/thin-wrapper"
       ],
-      "codeclimate_check_names": null,
+      "codeclimate_check_names": [
+        "fallow/thin-wrapper"
+      ],
       "ts_alias": null,
-      "counts_in_total": false,
+      "counts_in_total": true,
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line thin-wrapper",
@@ -1973,9 +1975,11 @@
       "sarif_rule_ids": [
         "fallow/duplicate-prop-shape"
       ],
-      "codeclimate_check_names": null,
+      "codeclimate_check_names": [
+        "fallow/duplicate-prop-shape"
+      ],
       "ts_alias": null,
-      "counts_in_total": false,
+      "counts_in_total": true,
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line duplicate-prop-shape",
@@ -3157,6 +3161,36 @@
       "license_note": null,
       "docs_url": "https://fallow.tools/docs/cli/security/"
     },
+    {
+      "id": "long-file",
+      "rule_id": "fallow/long-file",
+      "command": "health",
+      "category": "Health",
+      "description": "File has more lines than the file-length threshold",
+      "label": null,
+      "config_key": null,
+      "registry_index": null,
+      "aliases": [],
+      "lsp": false,
+      "filter_flag": "--complexity",
+      "result_key": null,
+      "summary_label": null,
+      "summary_docs_anchor": null,
+      "sarif_rule_ids": null,
+      "codeclimate_check_names": null,
+      "ts_alias": null,
+      "counts_in_total": false,
+      "fixable": false,
+      "suppressible": true,
+      "suppress_comment": "// fallow-ignore-file complexity",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
+      "note": null,
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://fallow.tools/docs/explanations/health/#file-length"
+    },
     {
       "id": "mass-assignment",
       "rule_id": "security/mass-assignment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.36.0",
+  "version": "3.38.0",
   "mcpName": "io.github.fallow-rs/fallow",
   "description": "Codebase intelligence for TypeScript and JavaScript: health, complexity, duplication, architecture, styling drift, and unused code from one graph. CLI, LSP, and MCP server. Zero config for over 100 frameworks.",
   "license": "MIT",
@@ -54,6 +54,7 @@
     "./scripts/*": "./scripts/*",
     "./skills/*": "./skills/*",
     "./schema.json": "./schema.json",
+    "./rule-pack-schema.json": "./rule-pack-schema.json",
     "./capabilities.json": "./capabilities.json",
     "./issue-registry.json": "./issue-registry.json"
   },
@@ -67,11 +68,13 @@
   "files": [
     "bin",
     "scripts",
+    "!scripts/*.test.js",
     "skills",
     "!skills/_artifacts",
     "types",
     "README.md",
     "schema.json",
+    "rule-pack-schema.json",
     "capabilities.json",
     "issue-registry.json"
   ],
@@ -86,17 +89,17 @@
     "detect-libc": "2.1.2"
   },
   "devDependencies": {
-    "@tanstack/intent": "0.5.5"
+    "@tanstack/intent": "0.5.6"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.36.0",
-    "@fallow-cli/darwin-x64": "3.36.0",
-    "@fallow-cli/linux-x64-gnu": "3.36.0",
-    "@fallow-cli/linux-arm64-gnu": "3.36.0",
-    "@fallow-cli/linux-x64-musl": "3.36.0",
-    "@fallow-cli/linux-arm64-musl": "3.36.0",
-    "@fallow-cli/win32-arm64-msvc": "3.36.0",
-    "@fallow-cli/win32-x64-msvc": "3.36.0",
-    "fallow-type-aware": "3.36.0"
+    "@fallow-cli/darwin-arm64": "3.38.0",
+    "@fallow-cli/darwin-x64": "3.38.0",
+    "@fallow-cli/linux-x64-gnu": "3.38.0",
+    "@fallow-cli/linux-arm64-gnu": "3.38.0",
+    "@fallow-cli/linux-x64-musl": "3.38.0",
+    "@fallow-cli/linux-arm64-musl": "3.38.0",
+    "@fallow-cli/win32-arm64-msvc": "3.38.0",
+    "@fallow-cli/win32-x64-msvc": "3.38.0",
+    "fallow-type-aware": "3.38.0"
   }
 }

package/rule-pack-schema.json

@@ -0,0 +1,264 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "RulePackDef",
+  "description": "A declarative rule pack loaded from a standalone JSON or JSONC file listed\nin the `rulePacks` config key.\n\nRule packs are pure data: loading a pack never executes project code. They\nencode project-specific policy (banned calls, banned imports, and\ncatalogue-backed banned effects) evaluated over fallow's static extraction\ndata, reporting as `policy-violation`\nfindings.\n\n```jsonc\n{\n  \"$schema\": \"https://raw.githubusercontent.com/fallow-rs/fallow/main/rule-pack-schema.json\",\n  \"version\": 1,\n  \"name\": \"team-policy\",\n  \"description\": \"House rules for the platform team\",\n  \"rules\": [\n    {\n      \"id\": \"no-child-process\",\n      \"kind\": \"banned-call\",\n      \"callees\": [\"child_process.*\"],\n      \"message\": \"Use the sandboxed runner instead.\",\n      \"severity\": \"error\"\n    },\n    {\n      \"id\": \"no-network\",\n      \"kind\": \"banned-effect\",\n      \"effects\": [\"network\"],\n      \"message\": \"Keep this package side-effect free.\"\n    },\n    {\n      \"id\": \"no-moment\",\n      \"kind\": \"banned-import\",\n      \"specifiers\": [\"moment\"],\n      \"message\": \"Use date-fns.\"\n    }\n  ]\n}\n```",
+  "type": "object",
+  "properties": {
+    "version": {
+      "description": "Pack format version. Must be `1`; the field exists so future rule\nkinds can be added without breaking older fallow builds silently.",
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0
+    },
+    "name": {
+      "description": "Pack name, unique across all loaded packs. Must use only ASCII\nletters, digits, `.`, `_`, and `-` so `\"<pack>/<id>\"` is unambiguous in\noutput, baselines, and scoped suppression comments.",
+      "type": "string"
+    },
+    "description": {
+      "description": "Optional human description of the pack's intent.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "rules": {
+      "description": "The policy rules this pack enforces. Must be non-empty: an empty pack\nwould silently enforce nothing.",
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/RulePackRule"
+      }
+    }
+  },
+  "additionalProperties": false,
+  "required": [
+    "version",
+    "name",
+    "rules"
+  ],
+  "$defs": {
+    "RulePackRule": {
+      "description": "One declarative policy rule inside a rule pack.\n\n`callees` applies only to `banned-call` rules; `specifiers` and\n`ignoreTypeOnly` apply only to `banned-import` rules; `effects` applies\nonly to `banned-effect` rules; `exports` applies only to `banned-export`\nrules. `allowedFiles` and `proofKinds` apply only to `gdp-proof-producer`\nrules. `zones` can scope any rule kind to files classified into one of the\nnamed boundary zones. Setting a field on the wrong kind is a load error\n(fail loud, never silently ignore policy).",
+      "type": "object",
+      "properties": {
+        "id": {
+          "description": "Rule id, unique within the pack. Must use only ASCII letters, digits,\n`.`, `_`, and `-` so `\"<pack>/<id>\"` is unambiguous in output,\nbaselines, and scoped suppression comments.",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Which check this rule performs.",
+          "$ref": "#/$defs/RulePackRuleKind"
+        },
+        "callees": {
+          "description": "Callee patterns to ban (`banned-call` only). Matching is segment-aware\nand import-resolved, identical to `boundaries.calls.forbidden`:\n`child_process.*` covers `import { exec } from \"node:child_process\"`,\nthe bare specifier, and namespace/default imports; `fetch` matches only\nthe global `fetch`; a leading `*.member` matches any object.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "specifiers": {
+          "description": "Import specifiers to ban (`banned-import` only). Matched segment-aware\nagainst the RAW specifier: `moment` covers `moment` and\n`moment/locale/nl` but not `moment-timezone`. A trailing `/*` form,\nsuch as `@org/ui/*`, matches subpaths only (`@org/ui/internal`) and\nnot the package root (`@org/ui`). Aliased or rewritten specifiers\n(e.g. `npm:moment`) are not matched.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "effects": {
+          "description": "Effect classes to ban (`banned-effect` only). Effects are derived from\n`security_matchers.toml` catalogue rows and matched against captured\ncall sites after import-resolution canonicalization.",
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/EffectKind"
+          }
+        },
+        "exports": {
+          "description": "Export names to ban (`banned-export` only). `\"default\"` matches the\ndefault export; any other entry matches an exported name exactly; a\nsingle trailing `*` makes it a prefix match (`internal*`). No other\nglob syntax is supported. Re-exports are out of scope for this rule.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "allowedFiles": {
+          "description": "Project-root-relative globs allowed to call `@gdp-ts/core.defineProof`\n(`gdp-proof-producer` only). At least one pattern is required.\nA single `*` stays within one path segment; use `**` to match across directories.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "proofKinds": {
+          "description": "Exact literal proof labels checked by a `gdp-proof-producer` rule.\nEmpty or absent checks every recognized factory call, including calls\nwith dynamic labels. A nonempty list checks only static string labels.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "ignoreTypeOnly": {
+          "description": "When `true`, type-only imports (`import type ...` and type-only\nre-exports) are ignored by `banned-import`; type-only exports are\nignored by `banned-export`. Defaults to `false`: type-only sites are\nflagged too.",
+          "type": "boolean"
+        },
+        "files": {
+          "description": "Optional include globs (project-root-relative). Empty or absent means\nthe rule applies to every analyzed file.\nA single `*` stays within one path segment; use `**` to match across directories.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "exclude": {
+          "description": "Optional exclude globs (project-root-relative), applied after `files`.\nA single `*` stays within one path segment; use `**` to match across directories.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "zones": {
+          "description": "Optional boundary zones this rule applies to. Empty or absent means the\nrule applies regardless of zone; non-empty values require matching\nconfigured boundaries and combine with `files`/`exclude` as AND.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "message": {
+          "description": "Author-provided message naming the sanctioned alternative. Rendered\nnext to each finding.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "severity": {
+          "description": "Per-rule severity overriding the `rules.\"policy-violation\"` master.\n`off` disables this rule. When the master itself is `off`, the whole\nevaluator is disabled and per-rule severity cannot resurrect it.",
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "kind"
+      ]
+    },
+    "RulePackRuleKind": {
+      "description": "Which check a rule-pack rule performs.",
+      "oneOf": [
+        {
+          "description": "Ban call sites whose callee path matches one of `callees`.",
+          "type": "string",
+          "const": "banned-call"
+        },
+        {
+          "description": "Ban imports and re-exports whose raw specifier matches one of\n`specifiers`.",
+          "type": "string",
+          "const": "banned-import"
+        },
+        {
+          "description": "Ban call sites whose catalogue-derived effect matches one of `effects`.",
+          "type": "string",
+          "const": "banned-effect"
+        },
+        {
+          "description": "Ban exported names that match one of `exports`.",
+          "type": "string",
+          "const": "banned-export"
+        },
+        {
+          "description": "Restrict gdp-ts proof factory calls to explicitly allowed modules.",
+          "type": "string",
+          "const": "gdp-proof-producer"
+        }
+      ]
+    },
+    "EffectKind": {
+      "description": "Internal side-effect taxonomy derived from security catalogue rows.",
+      "oneOf": [
+        {
+          "description": "No observable side effect.",
+          "type": "string",
+          "const": "pure"
+        },
+        {
+          "description": "Structured-data read/query evaluation (XML external entities, XPath).",
+          "type": "string",
+          "const": "read"
+        },
+        {
+          "description": "In-memory state mutation (mass assignment, prototype pollution).",
+          "type": "string",
+          "const": "write"
+        },
+        {
+          "description": "Network I/O (HTTP clients, request-forgery sinks).",
+          "type": "string",
+          "const": "network"
+        },
+        {
+          "description": "Filesystem access (path traversal, file permission changes).",
+          "type": "string",
+          "const": "storage"
+        },
+        {
+          "description": "In-process code evaluation (`eval`, `Function`, string timers).",
+          "type": "string",
+          "const": "process"
+        },
+        {
+          "description": "OS shell command execution.",
+          "type": "string",
+          "const": "shell"
+        },
+        {
+          "description": "Cryptographic primitives (weak algorithm or key usage).",
+          "type": "string",
+          "const": "crypto"
+        },
+        {
+          "description": "Random-number generation in security-sensitive contexts.",
+          "type": "string",
+          "const": "randomness"
+        },
+        {
+          "description": "DOM injection (`innerHTML`-style XSS sinks).",
+          "type": "string",
+          "const": "dom"
+        },
+        {
+          "description": "Database query execution (SQL/NoSQL injection sinks).",
+          "type": "string",
+          "const": "database"
+        },
+        {
+          "description": "Callback invoked by a framework rather than a direct effect.",
+          "type": "string",
+          "const": "framework-callback"
+        },
+        {
+          "description": "Effect the catalogue cannot classify.",
+          "type": "string",
+          "const": "unknown"
+        }
+      ]
+    },
+    "Severity": {
+      "description": "Severity level for rules.\n\nControls whether an issue type sets a non-zero exit code (`error`), is\nreported without an effect on the exit code (`warn`), or is suppressed\nentirely (`off`). `--fail-on-issues` promotes `warn` to `error`. The\ndead-code count gate of the GitHub Action counts `warn` findings unless its\n`fail-on-issues` input is `false`.",
+      "oneOf": [
+        {
+          "description": "Report and set a non-zero exit code.",
+          "type": "string",
+          "const": "error"
+        },
+        {
+          "description": "Report without an effect on the exit code.",
+          "type": "string",
+          "const": "warn"
+        },
+        {
+          "description": "Don't detect or report.",
+          "type": "string",
+          "const": "off"
+        }
+      ]
+    }
+  }
+}