v2.71.0: typed fallow/types, pnpm unresolved-catalog detection, schema-generated VS Code types

Highlights

• Typed JSON output via import type ... from "fallow/types" for any TypeScript consumer of npx fallow --format json. The npm fallow package now ships the same generated .d.ts the VS Code extension uses, with SchemaVersion pinned to literal 6 at codegen time so future major-version drift is a compile error at consumer call sites instead of silent breakage. (Closes #339)
• New unresolved-catalog-references rule flags pnpm catalog: / catalog:<name> references whose target catalog has no entry for the consumed package. pnpm install fails with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_CATALOG_PROTOCOL on these references; fallow surfaces them statically at fallow check time, before any install. Each finding carries an available_in_catalogs list so agents and humans can flip the reference to a catalog that actually declares the package, and a config-only ignoreCatalogReferences: [{ package, catalog?, consumer? }] array suppresses the case (staged catalog migrations, library-internal placeholders). (Closes #334)
• VS Code extension TypeScript types are now generated from docs/output-schema.json instead of hand-maintained. The hand-written types had drifted repeatedly (most recently #323 crashing the Unused Code tree); the contract is now derived in prebuild and verified by a dedicated CI check:codegen step. Existing FallowCheckResult / FallowDupesResult / FallowCombinedResult aliases stay re-exported so consumer code keeps compiling. (Closes #326)
• Supply-chain hardening: the release workflow now splits npm and vsce / ovsx publishing into separate prep (no token) and publish (id-token + token) jobs, runs cargo publish --no-verify so transitive build.rs cannot read CARGO_REGISTRY_TOKEN, and pins every privileged publisher CLI (npm@11.14.1, @vscode/vsce, ovsx). All npm publish invocations are --ignore-scripts. (#344)

Upgrade note

The new unresolved-catalog-references rule defaults to error. If your workspace already has a broken catalog reference, fallow check will flip from green on v2.70 to red on v2.71. To absorb the change without action, set the rule to warn in your fallow config:

{
  "rules": {
    "unresolved-catalog-references": "warn"
  }
}

Pin back to "error" once the broken references are resolved. Suppression is config-only (package.json has no comment syntax) via ignoreCatalogReferences.

Fixed

• Combined, audit, and flags JSON output emit schema_version: 6 (was 3). Three top-level envelope writers had hardcoded schema_version: 3 independently of the central SCHEMA_VERSION constant, so the bare fallow --format json invocation, fallow audit --format json, and fallow flags --format json stayed pinned at version 3 while every per-command output progressed through 4, 5, and 6. All three sites now read from report::SCHEMA_VERSION directly. No --format json schema content changed; only the metadata field's value harmonized upward.

Security

• Drops the unmaintained serde_yml 0.0.12 crate (RUSTSEC-2025-0068, unsound segfault advisory) in favour of serde_yaml_ng 0.10. One-line use rename; no behavior change in the pnpm catalog parser.

Full Changelog: v2.70.0...v2.71.0