@visulima/vis 1.0.0-alpha.11 → 1.0.0-alpha.13

package/schemas/vis-config.schema.json

@@ -4,498 +4,3479 @@
     "title": "vis.config.ts",
     "description": "Workspace configuration for @visulima/vis. Used by defineConfig() in vis.config.ts. This schema is for non-TypeScript editors; TypeScript users get autocomplete from defineConfig() types.",
     "type": "object",
-    "additionalProperties": false,
     "properties": {
         "ai": {
             "type": "object",
-            "description": "AI analysis configuration.",
-            "additionalProperties": false,
             "properties": {
-                "cacheTtl": { "type": "number", "description": "Cache TTL in milliseconds." },
+                "cacheTtl": {
+                    "type": "number",
+                    "description": "Cache TTL in milliseconds. Overrides default (1h / 30min for security)."
+                },
                 "priority": {
                     "type": "object",
-                    "description": "Override default provider priority. Higher number = preferred.",
-                    "additionalProperties": { "type": "number" }
-                },
-                "provider": { "type": "string", "description": "Use a specific provider (e.g. \"claude\", \"gemini\")." }
-            }
-        },
-        "codeowners": {
-            "type": "object",
-            "description": "Controls vis sync codeowners output.",
-            "additionalProperties": false,
-            "properties": {
-                "orderBy": {
-                    "type": "string",
-                    "enum": ["file-source", "project-id"],
-                    "default": "file-source"
+                    "additionalProperties": {
+                        "type": "number"
+                    },
+                    "description": "Override default provider priority. Higher number = preferred."
                 },
                 "provider": {
                     "type": "string",
-                    "enum": ["github", "gitlab", "bitbucket", "other"],
-                    "default": "github"
-                },
-                "globalPaths": {
-                    "type": "object",
-                    "description": "Workspace-level paths and their owners (e.g. \"/.github/**\": [\"@org/platform\"]).",
-                    "additionalProperties": {
-                        "type": "array",
-                        "items": { "type": "string" }
-                    }
+                    "description": "Use a specific provider instead of auto-detecting (e.g., `\"claude\"`, `\"gemini\"`)."
                 }
-            }
+            },
+            "additionalProperties": false,
+            "description": "AI analysis configuration"
+        },
+        "branchScopedCache": {
+            "type": "boolean",
+            "description": "Scope the task-runner cache directory by the current git branch. When `true`, caches are stored under `<cacheDir>/branches/<slug>` so `main` and feature branches stop thrashing each other — generated artefacts (schemas, `.d.ts` snapshots) that legitimately differ across branches no longer oscillate the cache contents.\n\nFalls back to the unscoped path on detached HEAD, non-git workspaces, or when git isn't available.",
+            "default": false
+        },
+        "codeowners": {
+            "$ref": "#/$defs/CodeownersConfig",
+            "description": "Code ownership configuration. Controls how `vis sync codeowners` renders the generated CODEOWNERS file."
         },
         "constraints": {
             "type": "object",
-            "description": "Project dependency constraints enforced before running tasks.",
-            "additionalProperties": false,
             "properties": {
+                "dependencyKindRules": {
+                    "type": "object",
+                    "properties": {
+                        "noDevDependencyOnProductionDep": {
+                            "type": "boolean",
+                            "description": "When true, a \"library\" project must not have workspace-internal devDependencies on other libraries that are also in its production dependencies. Prevents publishing libraries that silently rely on dev-only workspace packages.",
+                            "default": false
+                        },
+                        "noProductionDependencyOnApplication": {
+                            "type": "boolean",
+                            "description": "When true, production `dependencies` must not point to \"application\" type projects. devDependencies on applications are allowed (e.g., for testing).",
+                            "default": false
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Rules based on the dependency kind (static vs devDependency vs peerDependency)"
+                },
                 "enforceLayerRelationships": {
                     "type": "boolean",
-                    "description": "Projects can only depend on the same or lower layer: configuration < library < scaffolding < tool < automation < application.",
+                    "description": "When true, projects can only depend on projects at the same or lower layer in the hierarchy:\n\n  configuration < library < scaffolding < tool < automation < application\n\nProjects without an explicit `layer` are unconstrained.",
                     "default": false
                 },
                 "tagRelationships": {
                     "type": "object",
-                    "description": "Tag-based rules. Key = source tag, value = allowed dependency tags.",
                     "additionalProperties": {
                         "type": "array",
-                        "items": { "type": "string" }
-                    }
+                        "items": {
+                            "type": "string"
+                        }
+                    },
+                    "description": "Tag-based dependency rules"
                 },
                 "typeBoundaries": {
                     "type": "object",
-                    "additionalProperties": false,
                     "properties": {
-                        "enforceApplicationBoundary": {
-                            "type": "boolean",
-                            "description": "No project may depend on an application.",
-                            "default": true
-                        },
                         "allowedDependencyTypes": {
                             "type": "object",
-                            "description": "Maps project types to allowed dependency types.",
                             "additionalProperties": {
                                 "type": "array",
-                                "items": { "type": "string" }
-                            }
+                                "items": {
+                                    "type": "string"
+                                }
+                            },
+                            "description": "Custom rules mapping project types to allowed dependency types. Example: `{ \"application\": [\"library\"] }` means applications can only depend on libraries."
+                        },
+                        "enforceApplicationBoundary": {
+                            "type": "boolean",
+                            "description": "When true, no project may depend on an \"application\" type project. Applications are typically deployment targets, not libraries.",
+                            "default": true
                         }
-                    }
-                },
-                "dependencyKindRules": {
-                    "type": "object",
+                    },
                     "additionalProperties": false,
-                    "properties": {
-                        "noDevDependencyOnProductionDep": { "type": "boolean", "default": false },
-                        "noProductionDependencyOnApplication": { "type": "boolean", "default": false }
-                    }
+                    "description": "Project-type-based dependency rules"
                 }
-            }
+            },
+            "additionalProperties": false,
+            "description": "Project dependency constraints. Enforced after building the project graph, before running tasks."
         },
-        "install": {
+        "create": {
             "type": "object",
-            "description": "Installer backend selection. Lets `vis install` (and friends) use aube — a fast Rust-native PM that reads/writes pnpm/npm/yarn/bun lockfiles in place — or pin a specific conventional PM. Aube must be installed separately; vis does not bundle it.",
-            "additionalProperties": false,
             "properties": {
-                "backend": {
+                "auth": {
+                    "type": "string",
+                    "description": "Authorization token for downloading private repository templates. Passed as Bearer token to the git host API. Can also be set via GIGET_AUTH, GITHUB_TOKEN, or GH_TOKEN environment variables."
+                },
+                "defaultEditor": {
                     "type": "string",
-                    "enum": ["auto", "aube", "pnpm", "npm", "yarn", "bun"],
-                    "default": "auto",
-                    "description": "Which PM runs install/add/remove. `auto` uses aube when it is on PATH and falls back to the lockfile-detected PM. Explicit names error if the binary is missing. CLI flag `--installer` and env var `VIS_INSTALLER` override this."
+                    "const": "vscode",
+                    "description": "Default editor to configure after scaffolding. When set, `vis create` automatically generates editor config files.",
+                    "examples": [
+                        "vscode"
+                    ]
+                },
+                "defaultPm": {
+                    "type": "string",
+                    "enum": [
+                        "bun",
+                        "npm",
+                        "pnpm",
+                        "yarn"
+                    ],
+                    "description": "Default package manager for new standalone projects. When set, skips the PM selection prompt in interactive mode."
+                },
+                "defaultProvider": {
+                    "type": "string",
+                    "enum": [
+                        "bitbucket",
+                        "github",
+                        "gitlab",
+                        "sourcehut"
+                    ],
+                    "description": "Default giget provider for `owner/repo` shorthand inputs.",
+                    "default": "github"
+                },
+                "gitInit": {
+                    "type": "boolean",
+                    "description": "Initialize a git repository after scaffolding standalone projects.",
+                    "default": false
+                },
+                "install": {
+                    "type": "boolean",
+                    "description": "Install dependencies automatically after scaffolding.",
+                    "default": true
+                },
+                "preferOffline": {
+                    "type": "boolean",
+                    "description": "Prefer locally cached templates over re-downloading. Useful for offline development or slow connections.",
+                    "default": false
+                },
+                "registry": {
+                    "anyOf": [
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "boolean",
+                            "const": false
+                        }
+                    ],
+                    "description": "Custom template registry URL. When set, giget checks this registry for template metadata before falling back to direct provider resolution. Set to `false` to disable registry lookup entirely."
+                },
+                "templates": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "Named template aliases for quick access. Maps short names to full giget source strings."
                 }
-            }
+            },
+            "additionalProperties": false,
+            "description": "Configuration for the `vis create` scaffolding command. Controls template downloads (via giget), default options, and post-creation behavior."
         },
-        "inferTargets": {
-            "default": false,
-            "oneOf": [
-                { "type": "boolean" },
+        "editorconfig": {
+            "type": "boolean",
+            "description": "Discover `.editorconfig` for indent / line-ending defaults during file transformations (sort-package-json, migrate, hook, pm overrides, workspace catalog rewrites). Per-command flags can still override.",
+            "default": true
+        },
+        "extends": {
+            "anyOf": [
                 {
-                    "type": "object",
-                    "description": "Per-detector opt-out map. Keys must be one of the 36 built-in detector names; set a key to `false` to disable that detector. Detectors omitted from the object stay enabled. Unknown keys log a warning at config-load time.",
-                    "additionalProperties": { "type": "boolean" },
-                    "propertyNames": {
-                        "enum": [
-                            "nuxt",
-                            "next",
-                            "remix",
-                            "astro",
-                            "gatsby",
-                            "docusaurus",
-                            "vite",
-                            "vitepress",
-                            "nest",
-                            "rolldown",
-                            "tsdown",
-                            "tsup",
-                            "packem",
-                            "rollup",
-                            "webpack",
-                            "vitest",
-                            "jest",
-                            "bun",
-                            "playwright",
-                            "cypress",
-                            "storybook",
-                            "typescript",
-                            "typedoc",
-                            "eslint",
-                            "prettier",
-                            "biome",
-                            "oxlint",
-                            "oxfmt",
-                            "stylelint",
-                            "knip",
-                            "deno",
-                            "prisma",
-                            "drizzle",
-                            "graphql-codegen",
-                            "api-extractor",
-                            "changeset"
-                        ]
+                    "type": "string"
+                },
+                {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
                     }
                 }
             ],
-            "description": "Project Crystal-style inference. Synthesizes default targets (`build`, `test`, `dev`, `lint`, `format`, `typecheck`, `docs`, `db:*`, …) for each project by sniffing config files and `package.json` dependencies. Ships with 36 detectors covering app frameworks (nuxt, next, remix, astro, gatsby, docusaurus), bundlers (vite, rolldown, tsdown, tsup, packem, rollup, webpack), test runners (vitest, jest, bun, deno, playwright, cypress), lint/format tools (eslint, prettier, biome, oxlint, oxfmt, stylelint, knip), docs (typedoc, vitepress), DB tooling (prisma, drizzle), and release plumbing (graphql-codegen, api-extractor, changeset). Inferred targets are the lowest-priority layer — package.json scripts, project.json, and vis.task.ts always win on a per-target-name basis. Boolean `true` enables every detector; the object form opts individual detectors in or out by name. See `vis list --inferred` to inspect what each project resolves to."
+            "description": "Inherit configuration from one or more parent configs. Entries are resolved left-to-right (later wins) and the consumer's own values always override anything pulled in from `extends`.\n\nEach entry is either:\n- a relative path (`./shared.config.ts`, `../shared.config.ts`) —   resolved against the file declaring `extends`;\n- an npm package name (`@acme/vis-preset`) — resolved via Node.js   module resolution from the consumer file.\n\nAbsolute paths are rejected — they break across machines and CI. Cycles raise `VisConfigCycleError` during load."
         },
-        "create": {
+        "fileGroups": {
             "type": "object",
-            "description": "Configuration for vis create scaffolding command.",
-            "additionalProperties": false,
-            "properties": {
-                "auth": { "type": "string", "description": "Authorization token for private templates." },
-                "defaultEditor": { "type": "string", "enum": ["vscode"] },
-                "defaultPm": { "type": "string", "enum": ["pnpm", "npm", "yarn", "bun"] },
-                "defaultProvider": { "type": "string", "enum": ["github", "gitlab", "bitbucket", "sourcehut"], "default": "github" },
-                "gitInit": { "type": "boolean", "default": false },
-                "install": { "type": "boolean", "default": true },
-                "preferOffline": { "type": "boolean", "default": false },
-                "registry": {
-                    "oneOf": [{ "type": "string" }, { "type": "boolean", "const": false }]
-                },
-                "templates": {
-                    "type": "object",
-                    "description": "Named template aliases mapping short names to giget source strings.",
-                    "additionalProperties": { "type": "string" }
+            "additionalProperties": {
+                "type": "array",
+                "items": {
+                    "type": "string"
                 }
-            }
-        },
-        "overrides": {
-            "type": "object",
-            "description": "Package override mappings applied during migration.",
-            "additionalProperties": { "type": "string" }
+            },
+            "description": "Named file-group patterns, reusable from target `inputs` via the `@filegroup:&lt;name>` token. File groups are resolved relative to each project root at discovery time."
         },
-        "preflight": {
+        "generator": {
             "type": "object",
-            "description": "Preflight checks gating `vis run` / `vis ci`. Each check can be opted out individually; the CLI flag `--no-preflight` disables them all.",
-            "additionalProperties": false,
             "properties": {
-                "lockfile": {
+                "auth": {
+                    "type": "string",
+                    "description": "Authorization token forwarded to giget when fetching `git://`/`npm://` remote templates. Falls back to `GIGET_AUTH` / `GITHUB_TOKEN` / `GH_TOKEN` env vars."
+                },
+                "preferOffline": {
                     "type": "boolean",
-                    "default": true,
-                    "description": "Detect lockfile drift by comparing the lockfile mtime against the package manager's install marker (e.g. `node_modules/.modules.yaml` for pnpm). When the lockfile is newer than the marker, the run fails with the right reinstall command for CI vs TTY."
+                    "description": "Prefer locally cached remote templates over re-downloading. Overridable per invocation via `--prefer-offline`.",
+                    "default": false
+                },
+                "templates": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Extra directories to scan for templates. Each directory is checked for both native templates (`&lt;name>.ts`) and moon-format directories (containing `template.yml`)."
                 }
-            }
-        },
-        "security": {
-            "type": "object",
-            "description": "Supply-chain security settings.",
+            },
             "additionalProperties": false,
-            "properties": {
-                "allowBuilds": {
-                    "type": "object",
-                    "description": "Allow (true) or deny (false) build scripts per package.",
-                    "additionalProperties": { "type": "boolean" }
-                },
-                "blockExoticSubdeps": { "type": "boolean", "default": false },
-                "minimumReleaseAge": { "type": "number", "description": "Minutes since publish before allowing install.", "default": 0 },
-                "minimumReleaseAgeExclude": { "type": "array", "items": { "type": "string" } },
-                "socket": {
+            "description": "Configuration for the `vis generate` in-repo scaffolding command. Points at additional template directories beyond the defaults (`.vis/templates/` and `.moon/templates/`)."
+        },
+        "inferTargets": {
+            "anyOf": [
+                {
                     "type": "object",
-                    "additionalProperties": false,
-                    "properties": {
-                        "acceptedRisks": {
-                            "type": "object",
-                            "additionalProperties": {
-                                "type": "object",
-                                "required": ["reason", "acceptedAt", "acceptedScore"],
-                                "properties": {
-                                    "reason": { "type": "string" },
-                                    "acceptedAt": { "type": "string", "format": "date-time" },
-                                    "acceptedScore": { "type": "number" }
-                                }
-                            }
-                        },
-                        "apiToken": { "type": "string" },
-                        "cacheTtlMs": { "type": "number", "default": 3600000 },
-                        "enabled": { "type": "boolean", "default": false },
-                        "minimumScore": { "type": "number", "default": 0.4 },
-                        "timeoutMs": { "type": "number", "default": 15000 }
+                    "additionalProperties": {
+                        "type": "boolean"
                     }
                 },
-                "strictDepBuilds": { "type": "boolean", "default": false },
-                "trustPolicy": { "type": "string", "enum": ["off", "no-downgrade"], "default": "off" },
-                "trustPolicyExclude": { "type": "array", "items": { "type": "string" } },
-                "trustPolicyIgnoreAfter": { "type": "number" },
-                "typosquatAllowlist": { "type": "array", "items": { "type": "string" } }
-            }
-        },
-        "sortPackageJson": {
-            "type": "object",
-            "additionalProperties": false,
-            "properties": {
-                "sortScripts": { "type": "boolean", "default": false }
-            }
+                {
+                    "type": "boolean"
+                }
+            ],
+            "description": "Auto-create targets from detected config files (Project Crystal-style). Inferred targets sit *below* explicit ones — anything in `package.json#scripts`, `project.json#targets`, or `vis.task.ts` wins per-key, so opting in never overrides existing setups.\n\nBuilt-in detectors and the targets they synthesize:\n\n- **App frameworks** — `nuxt` (build/dev/preview/generate),   `next` (build/dev/start), `remix` (build/dev/start), `astro`   (build/dev), `gatsby` (build/develop/serve), `docusaurus`   (build/start/serve).\n- **Bundlers** — `vite` (build/dev/preview), `rolldown` (build),   `tsdown` (build), `tsup` (build), `packem` (build), `rollup`   (build), `webpack` (build).\n- **Docs sites** — `vitepress` (docs:build/docs:dev/docs:preview),   `typedoc` (docs).\n- **Server frameworks** — `nest` (build/start/start:dev).\n- **Test runners** — `vitest` (test/test:watch), `jest`   (test/test:watch), `bun` (test), `playwright` (test:e2e),   `cypress` (test:e2e/cypress:open).\n- **Stories** — `storybook` (storybook/build-storybook).\n- **Type checking** — `typescript` (typecheck via `tsc --noEmit`).\n- **Lint / format** — `eslint` (lint), `prettier` (format /   format:check), `biome` (lint, format), `oxlint` (lint),   `oxfmt` (format / format:check), `stylelint` (lint:css),   `knip` (knip).\n- **Runtimes** — `deno` (test/lint/fmt/check).\n- **Database tooling** — `prisma` (db:generate/db:migrate/   db:push/db:studio), `drizzle` (db:generate/db:migrate/   db:push/db:studio).\n- **Codegen / release** — `graphql-codegen` (codegen),   `api-extractor` (api-extract), `changeset` (changeset:version /   changeset:publish / changeset:status).\n\nTrigger: presence of any matching config file in the project root. Most detectors additionally match when their framework appears in `dependencies` / `devDependencies` / `peerDependencies` / `optionalDependencies` — covering convention-only setups (e.g. vitest with default config). Detectors that intentionally require a config file (because the package frequently appears transitively and a dep-only match would synthesize broken commands): `vite`, `rolldown`, `rollup`, `webpack`, `storybook`, `nest`, `remix`, `vitepress`, `bun`, `deno`, `changeset`.\n\nConflict resolution: detectors are evaluated in registration order (see `BUILT_IN_DETECTORS`) and the first to claim a target name wins. Per-name priorities: `build` → nuxt > next > remix > astro > gatsby > docusaurus > vite > nest > rolldown > tsdown > tsup > packem > rollup > webpack; `test` → vitest > jest > bun > deno; `test:e2e` → playwright > cypress; `lint` → eslint > biome > oxlint > deno; `format` → prettier > biome > oxfmt; `db:*` → prisma > drizzle.\n\nAlso accepts an object form (`{ vite: false, vitest: true }`) to opt individual detectors in or out by name. Detectors omitted from the object run at their default (enabled). Useful when one detector misfires for a given workspace without disabling the rest.",
+            "default": false
         },
-        "toolchain": {
+        "install": {
             "type": "object",
-            "description": "Toolchain (Node / pnpm / python / ...) management. Delegates to proto / mise / fnm / volta / asdf / nvm / corepack.",
-            "additionalProperties": false,
             "properties": {
-                "autoInstall": {
-                    "type": "boolean",
-                    "description": "Run the right manager install on engines.node mismatch before vis run / vis ci proceed. Default: true when a manager is detected on PATH."
-                },
-                "preferredManager": {
+                "backend": {
                     "type": "string",
-                    "enum": ["proto", "mise", "fnm", "volta", "asdf", "nvm", "corepack", "none"],
-                    "description": "Explicit manager override, bypasses auto-detection. Note: self-activate is resolved automatically for pnpm/yarn + packageManager pins and is not a valid override."
+                    "enum": [
+                        "aube",
+                        "auto",
+                        "bun",
+                        "npm",
+                        "pnpm",
+                        "yarn"
+                    ],
+                    "description": "Which package manager performs install/add/remove/etc.\n- `auto` (default): use `aube` when it is on PATH; otherwise   fall back to the lockfile-detected PM.\n- explicit name: always use that PM. Errors when the named   binary is missing rather than silently falling back.",
+                    "default": "auto"
                 },
-                "tools": {
-                    "type": "object",
-                    "description": "Override engines/packageManager-derived pins.",
-                    "additionalProperties": false,
-                    "properties": {
-                        "bun": { "type": "string" },
-                        "deno": { "type": "string" },
-                        "go": { "type": "string" },
-                        "node": { "type": "string" },
-                        "npm": { "type": "string" },
-                        "pnpm": { "type": "string" },
-                        "python": { "type": "string" },
-                        "ruby": { "type": "string" },
-                        "rust": { "type": "string" },
-                        "yarn": { "type": "string" }
-                    }
-                }
-            }
-        },
-        "staged": {
-            "description": "Staged file patterns and commands (replaces lint-staged). Accepts string, string[], {title, task}, or mixed arrays. Function-form tasks are supported at runtime but are not JSON-schema-representable.",
-            "type": "object",
-            "additionalProperties": {
-                "oneOf": [
-                    { "type": "string" },
-                    { "type": "array", "items": { "oneOf": [{ "type": "string" }, { "type": "object" }] } },
-                    {
-                        "type": "object",
-                        "required": ["title"],
-                        "properties": {
-                            "title": { "type": "string" }
+                "corepack": {
+                    "anyOf": [
+                        {
+                            "type": "string",
+                            "const": "auto"
+                        },
+                        {
+                            "type": "boolean"
                         }
-                    }
-                ]
-            }
-        },
-        "targetDefaults": {
-            "type": "object",
-            "description": "Default target configurations applied to all projects with a matching target.",
-            "additionalProperties": { "$ref": "project.schema.json#/$defs/targetConfiguration" }
-        },
-        "fileGroups": {
-            "type": "object",
-            "description": "Named file-group patterns, reusable via @filegroup:<name> in target inputs. Strings may be bare globs or URI form (file://, glob://, env://, func://, dep://).",
-            "additionalProperties": {
-                "type": "array",
-                "items": { "$ref": "project.schema.json#/$defs/inputString" }
-            }
+                    ],
+                    "description": "Whether to dispatch PM invocations through `corepack`.\n- `\"auto\"` (default): use corepack only when the workspace   pins a PM via the `packageManager` field AND `corepack` is   on PATH AND the PM is one corepack manages (pnpm/yarn/npm).\n- `true`: always prefix `corepack` when the binary is on PATH   and the PM is corepack-managed (errors loudly otherwise).\n- `false`: never go through corepack — invoke the PM directly.\n\nMirrors nypm's `corepack: true` flag. Bun, deno, and aube are never wrapped — corepack does not manage them.",
+                    "default": "auto"
+                }
+            },
+            "additionalProperties": false,
+            "description": "Installer backend selection for `vis install` / `vis add` / `vis remove` / `vis update` / `vis ci`.\n\nLets users opt into [aube](https://github.com/endevco/aube) — a Rust-native package manager that reads/writes pnpm/npm/yarn/bun lockfiles in place — as the default installer, while keeping a single switch to fall back to the conventional PM detected from the lockfile.\n\nResolution precedence (highest first): 1. CLI flag (`--installer &lt;name>` / `--no-aube`) 2. Env var `VIS_INSTALLER` 3. This config field 4. Auto-detect (the default)\n\nAube must be installed separately — `vis` does not bundle it. Install via npm (`@endevco/aube`), `mise use -g aube`, or `brew install endevco/tap/aube`."
         },
         "namedInputs": {
             "type": "object",
-            "description": "Named input patterns inherited by every project target.",
             "additionalProperties": {
                 "type": "array",
                 "items": {
-                    "oneOf": [
-                        { "$ref": "project.schema.json#/$defs/inputString" },
-                        { "$ref": "project.schema.json#/$defs/fileSetInput" },
-                        { "$ref": "project.schema.json#/$defs/environmentInput" },
-                        { "$ref": "project.schema.json#/$defs/runtimeInput" },
-                        { "$ref": "project.schema.json#/$defs/externalDependencyInput" }
+                    "anyOf": [
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "anyOf": [
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "fileset": {
+                                            "anyOf": [
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "base": {
+                                                            "type": "string",
+                                                            "enum": [
+                                                                "package",
+                                                                "workspace"
+                                                            ],
+                                                            "description": "Anchor for the pattern."
+                                                        },
+                                                        "pattern": {
+                                                            "type": "string",
+                                                            "description": "Glob pattern (may start with `!` for negation)."
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "base",
+                                                        "pattern"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "Object form of a fileset pattern, for anchoring to the workspace root."
+                                                },
+                                                {
+                                                    "type": "string"
+                                                }
+                                            ]
+                                        }
+                                    },
+                                    "required": [
+                                        "fileset"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "An input based on file patterns.\n\n`fileset` may be a bare glob string (package-root relative) or an object form `{ pattern, base }` to anchor explicitly to the workspace root. Negation (`!` prefix) works in both forms."
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "runtime": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "required": [
+                                        "runtime"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "An input based on a runtime command."
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "env": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "required": [
+                                        "env"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "An input based on environment variables."
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "externalDependencies": {
+                                            "type": "array",
+                                            "items": {
+                                                "type": "string"
+                                            }
+                                        }
+                                    },
+                                    "required": [
+                                        "externalDependencies"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "An input based on external dependency versions."
+                                }
+                            ],
+                            "description": "Defines an input for cache invalidation."
+                        }
                     ]
                 }
-            }
+            },
+            "description": "Named input patterns inherited by every project target. Equivalent to task-runner's `namedInputs` but configurable from the vis config."
         },
-        "taskDefaults": {
+        "overrides": {
+            "type": "object",
+            "additionalProperties": {
+                "type": "string"
+            },
+            "description": "Package override mappings applied during migration (e.g., `{ \"lodash\": \"lodash-es\" }`)"
+        },
+        "plugins": {
             "type": "array",
-            "description": "Cascading task-default blocks scoped by project metadata.",
             "items": {
-                "type": "object",
-                "required": ["targets"],
-                "additionalProperties": false,
-                "properties": {
-                    "scope": {
-                        "type": "object",
-                        "description": "Scope predicate — all fields must match for the block to apply.",
-                        "additionalProperties": false,
-                        "properties": {
-                            "tags": { "type": "array", "items": { "type": "string" } },
-                            "projectType": { "type": "string", "enum": ["library", "application"] },
-                            "layer": {
-                                "oneOf": [
-                                    { "type": "string", "enum": ["configuration", "library", "scaffolding", "tool", "automation", "application"] },
-                                    {
+                "$ref": "#/$defs/VisPlugin"
+            },
+            "description": "Plugins — each plugin registers typed hooks that fire at run / task / cache boundaries. See  {@link  VisPlugin }  for the contract. Prefer plugins over per-target shell hooks when behaviour needs access to task metadata, results, or cache state."
+        },
+        "policy": {
+            "type": "object",
+            "properties": {
+                "bannedDeps": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "anyOf": [
+                            {
+                                "type": "string"
+                            },
+                            {
+                                "type": "object",
+                                "properties": {
+                                    "packages": {
                                         "type": "array",
-                                        "items": { "type": "string", "enum": ["configuration", "library", "scaffolding", "tool", "automation", "application"] }
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "paths": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "reason": {
+                                        "type": "string"
+                                    },
+                                    "replacement": {
+                                        "type": "string"
                                     }
-                                ]
+                                },
+                                "required": [
+                                    "reason"
+                                ],
+                                "additionalProperties": false
+                            }
+                        ]
+                    },
+                    "description": "Map of dep names or globs → reason (or `{ reason, replacement, packages?, paths? }`). Internal/workspace deps are never flagged here; the workspace-protocol lint owns those.\n\nOptional `packages` (globs over the declaring package's `name`) and `paths` (globs over the workspace-relative `packageDir`) narrow where the rule applies. With both set, either match is enough. Omit both to ban anywhere — the default."
+                },
+                "customTypes": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. See `workspaceProtocol.autofix` for the contract — same semantics, applied to drift rewrites across engines / packageManager / volta / devEngines.\n\nNote: `--fix` strips any `+sha512.&lt;hash&gt;` suffix from `packageManager` on bump — content-integrity hashes are tied to a specific package, not a version, so users must regenerate via their PM (`pnpm install` re-pins; `corepack use pnpm@X` etc.).",
+                            "default": true
+                        },
+                        "extraTypes": {
+                            "type": "array",
+                            "items": {
+                                "$ref": "#/$defs/ExtraCustomType"
                             },
-                            "stack": {
-                                "oneOf": [
-                                    { "type": "string", "enum": ["backend", "frontend", "data", "infrastructure", "systems"] },
-                                    { "type": "array", "items": { "type": "string", "enum": ["backend", "frontend", "data", "infrastructure", "systems"] } }
-                                ]
+                            "description": "User-defined custom-type pin locations. Each entry tells the customTypes lint to read additional version pins from a non-standard JSON path inside every workspace package.json, cluster them by `(name × depName)` like the built-in types, and rewrite them with `--fix`.\n\nThe original built-ins (`engines`, `volta`, `packageManager`, `devEngines.runtime`, `devEngines.packageManager`) keep running unconditionally — these layer on top.\n\nStrategies:\n- `versionsByName`: the JSON at `path` is `{ [depName]: version }`   (like `engines` or `pnpm.overrides`).\n- `name@version`: the JSON at `path` is a string of the form   `name@version` (like `packageManager`). The leading `name@`   is preserved; only the version segment is rewritten.\n- `string`: the JSON at `path` is a bare version string. The   `depName` field is required and identifies the dep cluster.\n\n`name` must not collide with a built-in type name. `path` is a dot-separated walk into the package.json (e.g. `pnpm.overrides`)."
+                        },
+                        "ignore": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
                             },
-                            "language": {
-                                "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }]
-                            }
+                            "description": "Dep names exempt from the drift check (exact match against the field name within the block — e.g. `node`, `pnpm`)."
+                        },
+                        "resolve": {
+                            "type": "string",
+                            "enum": [
+                                "highest",
+                                "lowest"
+                            ],
+                            "description": "Resolution strategy used when `--fix` runs.\n- `highest` (default): align every drifting instance to the   highest declared version.\n- `lowest`: align to the lowest.",
+                            "default": "highest"
                         }
                     },
-                    "targets": {
-                        "type": "object",
-                        "additionalProperties": { "$ref": "project.schema.json#/$defs/targetConfiguration" }
-                    }
-                }
-            }
-        },
-        "taskRunnerOptions": {
-            "type": "object",
-            "description": "Task runner engine options.",
-            "additionalProperties": false,
-            "properties": {
-                "parallel": { "oneOf": [{ "type": "number" }, { "type": "boolean" }], "default": 3 },
-                "smartLockfileHashing": { "type": "boolean", "default": false },
-                "frameworkInference": { "type": "boolean", "default": false },
-                "autoFingerprint": { "type": "boolean", "default": false },
-                "cacheDiagnostics": { "type": "boolean", "default": false },
-                "cacheDirectory": { "type": "string" },
-                "dryRun": { "type": "boolean", "default": false },
-                "summarize": { "type": "boolean", "default": false },
-                "skipNxCache": { "type": "boolean" },
-                "globalInputs": { "type": "array", "items": { "type": "string" } },
-                "globalEnv": { "type": "array", "items": { "type": "string" } },
-                "maxCacheAge": { "type": "number" },
-                "maxCacheSize": { "type": "string" },
-                "remoteCache": {
+                    "additionalProperties": false,
+                    "description": "Tweak the custom-types lint that flags drift in `engines.{node,pnpm,...}`, `packageManager`, `volta.{node,pnpm,yarn}`, and the proposed `devEngines.{runtime,packageManager}` array form.\n\nEach (customType × name) cluster is tracked independently — `engines.node` and `volta.node` don't cross-couple here. Use a versionGroup once that lands if you need to enforce they agree."
+                },
+                "redefineRoot": {
                     "type": "object",
-                    "required": ["url"],
+                    "properties": {
+                        "ignore": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Dep names that are exempt from the redefine-root rule (exact match)."
+                        }
+                    },
                     "additionalProperties": false,
+                    "description": "Tweak the redefine-root lint that flags non-root packages duplicating deps already pinned at the workspace root."
+                },
+                "workspaceProtocol": {
+                    "type": "object",
                     "properties": {
-                        "url": {
-                            "type": "string",
-                            "description": "Cache server URL. HTTP: 'https://cache.example.com'. REAPI: 'grpcs://host:port' (TLS) or 'grpc://host:port' (cleartext)."
-                        },
-                        "backend": {
-                            "type": "string",
-                            "enum": ["http", "reapi"],
-                            "default": "http",
-                            "description": "Wire-protocol selector. 'http' is Turborepo-compatible; 'reapi' speaks the Bazel Remote Execution API over gRPC (bazel-remote, BuildBuddy, BuildBarn, EngFlow)."
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. Some workspaces want detection without rewrite (e.g. dual-licensed packages where `workspace:*` is unsafe).\n- `true` (default): `--fix` rewrites the specifier.\n- `false`: never rewrite — report the violation only.\n- `\"prompt\"`: ask before each rewrite. Falls back to report-only   when stdin isn't a TTY (CI). Reserved; not yet implemented.\n\nNote: when `false` (or `\"prompt\"`), `--fix` still **fails CI** on detected violations — the rule is \"report only\", not \"ignore\". Drop the rule from the lint selection if you want a clean exit.",
+                            "default": true
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the workspace-protocol lint that flags internal deps not using the `workspace:` protocol."
+                },
+                "workspaceVersions": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. See `workspaceProtocol.autofix` for the contract — same semantics, applied to drift rewrites.\n\nAlso gates the `--propose-min` catalog suggestion writer: when `false` / `\"prompt\"`, `--fix --propose-min` reports the proposed catalog entries but does not write `pnpm-workspace.yaml`. Same \"report only, still fails CI\" note applies as on `workspaceProtocol.autofix`.",
+                            "default": true
                         },
-                        "mode": {
-                            "type": "string",
-                            "enum": ["read", "readwrite", "write"],
-                            "default": "readwrite",
-                            "description": "Cache mode. 'read' pulls only, 'write' pushes only, 'readwrite' does both."
+                        "ignore": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Dep names exempt from the version-drift check (exact match)."
                         },
-                        "token": {
+                        "resolve": {
                             "type": "string",
-                            "description": "HTTP backend bearer token sent as 'Authorization: Bearer …'. For REAPI, use 'bearerToken' instead."
+                            "enum": [
+                                "catalog",
+                                "highest",
+                                "lowest"
+                            ],
+                            "description": "Resolution strategy used when `--fix` runs.\n- `highest` (default): rewrite every drifting instance to the   highest sibling specifier.\n- `lowest`: rewrite to the lowest.\n- `catalog`: rewrite any dep already pinned in a workspace catalog   to `catalog:` / `catalog:&lt;name>`. Catalog must exist; this lint   does not create the catalog (see `vis lint --resolve catalog --propose`).",
+                            "default": "highest"
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the workspace-versions lint that flags external deps declared at inconsistent versions across the workspace."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Workspace dep-policy lints exposed via `vis lint`. Each block opts in to a single rule; the command flags (`--workspace-protocol`, `--no-redefine-root`, `--banned-deps`) toggle them per-run."
+        },
+        "preflight": {
+            "type": "object",
+            "properties": {
+                "lockfile": {
+                    "type": "boolean",
+                    "description": "Detect \"lockfile changed but `node_modules` is stale\" before running tasks. Compares lockfile mtime against the package-manager-specific install marker (`node_modules/.modules.yaml` for pnpm, `.package-lock.json` for npm, etc.). Warns in TTY, hard-fails in CI.",
+                    "default": true
+                }
+            },
+            "additionalProperties": false,
+            "description": "Pre-flight checks fired before `vis run` starts the orchestrator. Each check is opt-out (`false`) — defaults are sensible for the common monorepo case."
+        },
+        "secrets": {
+            "type": "object",
+            "properties": {
+                "baseline": {
+                    "type": "string",
+                    "description": "Path to a baseline of previously-triaged findings (relative to workspace root)."
+                },
+                "config": {
+                    "type": "object",
+                    "properties": {
+                        "extendBundled": {
+                            "type": "boolean",
+                            "description": "Layer the user's rules on top of the bundled ruleset. Default: `true`."
+                        },
+                        "inline": {
+                            "type": "object",
+                            "properties": {
+                                "allowlist": {},
+                                "allowlists": {
+                                    "type": "array",
+                                    "items": {}
+                                },
+                                "description": {
+                                    "type": "string"
+                                },
+                                "rules": {
+                                    "type": "array",
+                                    "items": {}
+                                },
+                                "title": {
+                                    "type": "string"
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Inline rule overrides. Wins over `path` when both are set."
+                        },
+                        "path": {
+                            "type": "string",
+                            "description": "Path to a JSON config (gitleaks-compatible)."
+                        },
+                        "presets": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Bundled presets layered on top of the default ruleset (e.g. `\"weak-passwords\"`)."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Where the ruleset comes from. Omit for the bundled gitleaks default."
+                },
+                "redact": {
+                    "type": "boolean",
+                    "description": "Redact secret values in findings."
+                },
+                "rules": {
+                    "type": "object",
+                    "properties": {
+                        "exclude": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Drop findings whose ruleId matches."
+                        },
+                        "include": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Only report findings whose ruleId matches."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Rule-id filters applied after scanning."
+                },
+                "walk": {
+                    "type": "object",
+                    "properties": {
+                        "excludeFromFiles": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Paths to additional `.gitignore`-syntax files (e.g. `.secretsignore`)."
+                        },
+                        "excludePatterns": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Gitignore-syntax patterns (supports negation, directory markers, leading `/`). Applied on top of `.gitignore`."
+                        },
+                        "gitignore": {
+                            "type": "boolean",
+                            "description": "Respect `.gitignore`. Default: `true`."
+                        },
+                        "includeHidden": {
+                            "type": "boolean",
+                            "description": "Include hidden (dotfile) entries. Default: `false`."
+                        },
+                        "maxFileSize": {
+                            "type": "number",
+                            "description": "Max file size in bytes. Default 10 MiB."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Walker / filesystem traversal."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Default options for `vis secrets`. CLI flags always take precedence; this block provides workspace-wide defaults so teams can commit config once and every invocation picks it up."
+        },
+        "security": {
+            "type": "object",
+            "properties": {
+                "allowBuilds": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "boolean"
+                    },
+                    "description": "Map of package names/patterns to allow (true) or deny (false) build scripts. Packages not listed are denied by default. Equivalent to pnpm's `allowBuilds` setting."
+                },
+                "blockExoticSubdeps": {
+                    "type": "boolean",
+                    "description": "When true, prevents transitive dependencies from using exotic sources (git repositories, direct tarball URLs). Only direct dependencies may use such sources. Equivalent to pnpm's `blockExoticSubdeps`.",
+                    "default": false
+                },
+                "minimumReleaseAge": {
+                    "type": "number",
+                    "description": "Minimum number of minutes that must pass after a version is published before vis will allow installation. Reduces risk of installing compromised packages that are typically discovered within hours. Equivalent to pnpm's `minimumReleaseAge`.",
+                    "examples": [
+                        1440
+                    ],
+                    "default": 0
+                },
+                "minimumReleaseAgeExclude": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Package names/patterns excluded from minimumReleaseAge check. Equivalent to pnpm's `minimumReleaseAgeExclude`.",
+                    "examples": [
+                        [
+                            "webpack",
+                            "react",
+                            "@myorg/*"
+                        ]
+                    ]
+                },
+                "socket": {
+                    "type": "object",
+                    "properties": {
+                        "acceptedRisks": {
+                            "type": "object",
+                            "additionalProperties": {
+                                "type": "object",
+                                "properties": {
+                                    "acceptedAt": {
+                                        "type": "string",
+                                        "description": "ISO 8601 timestamp when the risk was accepted."
+                                    },
+                                    "acceptedScore": {
+                                        "type": "number",
+                                        "description": "The overall Socket.dev score at the time of acceptance."
+                                    },
+                                    "reason": {
+                                        "type": "string",
+                                        "description": "User-provided reason for accepting the risk."
+                                    }
+                                },
+                                "required": [
+                                    "acceptedAt",
+                                    "acceptedScore",
+                                    "reason"
+                                ],
+                                "additionalProperties": false
+                            },
+                            "description": "Packages whose low Socket.dev scores or alerts have been reviewed and explicitly accepted. These packages skip the confirmation prompt during `vis add` and show as \"acknowledged\" in `vis audit`.\n\nKey format: package name (`\"lodash\"`), name@version (`\"lodash@4.17.21\"`), or glob (`\"@myorg/*\"`). Unversioned keys match all versions of that package."
+                        },
+                        "apiToken": {
+                            "type": "string",
+                            "description": "Custom Socket.dev API token. Falls back to the public API token. Set via VIS_SOCKET_TOKEN environment variable or here."
+                        },
+                        "cacheTtlMs": {
+                            "type": "number",
+                            "description": "Cache TTL in milliseconds for Socket.dev reports.",
+                            "default": "3_600_000 (1 hour)"
+                        },
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Enable Socket.dev security scanning on install/update/check commands.",
+                            "default": false
+                        },
+                        "minimumScore": {
+                            "type": "number",
+                            "description": "Minimum overall Socket.dev score (0–1) for a package to be accepted without a confirmation prompt during `vis add`. Packages scoring below this threshold trigger an interactive prompt asking the user to confirm. Set to 0 to disable.",
+                            "default": 0.4
+                        },
+                        "timeoutMs": {
+                            "type": "number",
+                            "description": "Request timeout in milliseconds for the Socket.dev API.",
+                            "default": "15_000 (15 seconds)"
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Socket.dev security intelligence configuration. When enabled, vis fetches package security scores, alerts, and report data from the Socket.dev API during install, update, and check commands."
+                },
+                "strictDepBuilds": {
+                    "type": "boolean",
+                    "description": "When true, installation will fail (exit non-zero) if any dependencies have unreviewed build scripts. Equivalent to pnpm's `strictDepBuilds`.",
+                    "default": false
+                },
+                "trustPolicy": {
+                    "type": "string",
+                    "enum": [
+                        "no-downgrade",
+                        "off"
+                    ],
+                    "description": "Trust level checking for package publishing.\n- \"off\": No trust checking (default)\n- \"no-downgrade\": Fail if a package's trust level has decreased   compared to previous releases (e.g., was published by trusted   publisher, now only has provenance). Equivalent to pnpm's `trustPolicy`.",
+                    "default": "off"
+                },
+                "trustPolicyExclude": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Package selectors excluded from trust policy checks. Equivalent to pnpm's `trustPolicyExclude`.",
+                    "examples": [
+                        [
+                            "chokidar@4.0.3",
+                            "@babel/core@7.28.5"
+                        ]
+                    ]
+                },
+                "trustPolicyIgnoreAfter": {
+                    "type": "number",
+                    "description": "Ignore the trust policy check for packages published more than the specified number of minutes ago. Useful for older packages that pre-date provenance support. Equivalent to pnpm's `trustPolicyIgnoreAfter` (10.27+).",
+                    "examples": [
+                        43200
+                    ]
+                },
+                "typosquatAllowlist": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Package names to skip during typosquat detection. Use this for internal packages or known-safe names that happen to look similar to popular packages.",
+                    "examples": [
+                        [
+                            "my-internal-axois",
+                            "@myorg/recat"
+                        ]
+                    ]
+                }
+            },
+            "additionalProperties": false,
+            "description": "Supply chain security settings. These settings are inspired by pnpm's security features and are applied universally across all package managers (pnpm, npm, yarn, bun).\n\nFor pnpm users: these map directly to pnpm-workspace.yaml settings. For npm/yarn/bun users: vis enforces these at the vis layer since those package managers lack native support."
+        },
+        "sharedWorktreeCache": {
+            "type": "boolean",
+            "description": "Share the cache between sibling git worktrees. When the workspace is a linked worktree (created with `git worktree add`), the cache root is relocated from `&lt;linkedRoot>/.task-runner-cache` to the *main* worktree's `.task-runner-cache`. Multiple parallel agents working in sibling worktrees then share a single cache instead of rebuilding the same hash N times.\n\nSingle-checkout repos (where `.git` is a directory) are unaffected.\n\nSet to `false` to opt out — useful when worktrees deliberately need independent caches, e.g. for hermetic experiments.",
+            "default": true
+        },
+        "sortPackageJson": {
+            "type": "object",
+            "properties": {
+                "editorconfig": {
+                    "type": "boolean",
+                    "description": "Discover `.editorconfig` for indent / line-ending defaults (default: true)."
+                },
+                "formatBugs": {
+                    "type": "boolean",
+                    "description": "Collapse `bugs: { url }` to the bare string form when `url` is the only field (default: true)."
+                },
+                "formatRepository": {
+                    "type": "boolean",
+                    "description": "Collapse `repository: { type, url }` to the GitHub `owner/repo` shorthand (default: true)."
+                },
+                "sortExports": {
+                    "type": "boolean",
+                    "description": "Sort `exports` condition keys in canonical order (default: true)."
+                },
+                "sortScripts": {
+                    "type": "boolean",
+                    "description": "Alphabetize script commands (default: false)"
+                }
+            },
+            "additionalProperties": false,
+            "description": "sort-package-json command defaults"
+        },
+        "staged": {
+            "$ref": "#/$defs/StagedConfig",
+            "description": "Staged file patterns and commands (replaces lint-staged).\n\nAccepts all lint-staged config forms:\n- `string` or `string[]` commands\n- Sync/async functions returning `string | string[]`\n- `{ title, task }` objects for named side-effect tasks\n- Mixed arrays of strings and functions\n- A top-level generate-task function"
+        },
+        "strictEnv": {
+            "type": "boolean",
+            "description": "When `true`, every task command is scanned for `${VAR}` / `$VAR` references before spawn. If a referenced var is unset in the task's effective env (envFile + service env + per-task `env` + `process.env`), the task fails with an actionable error naming the missing variable, instead of letting the shell silently substitute an empty string.\n\nOverride per run with `--strict-env` / `--no-strict-env`. Override per target with `options.strictEnv`.",
+            "default": false
+        },
+        "targetDefaults": {
+            "type": "object",
+            "additionalProperties": {
+                "type": "object",
+                "properties": {
+                    "aliases": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        },
+                        "description": "Alternate names that resolve to this target on the CLI. Useful for shortening long canonical names (`test` ↔ `t`) or for offering migration-friendly aliases when renaming targets. Aliases must be globally unique within the workspace."
+                    },
+                    "description": {
+                        "type": "string",
+                        "description": "One-line description surfaced by `vis list` and (in future) per-task `--help`. Kept short — longer docs belong in project READMEs or vis.config.ts comments."
+                    },
+                    "inferred": {
+                        "type": "boolean",
+                        "description": "True when the target was synthesized by a Project Crystal-style detector (see  {@link  ../inference } ) rather than declared by a package.json script, project.json, or vis.task.ts file. Surfaced by `vis list --inferred` and used by tooling to distinguish implicit defaults from explicit user intent."
+                    },
+                    "options": {
+                        "$ref": "#/$defs/VisTargetOptions",
+                        "description": "Vis-specific target options."
+                    },
+                    "preset": {
+                        "$ref": "#/$defs/TargetPreset",
+                        "description": "Preset applied before user-specified options."
+                    },
+                    "type": {
+                        "$ref": "#/$defs/TargetType",
+                        "description": "Semantic task type. Affects caching defaults and CI filtering.",
+                        "default": "test"
+                    },
+                    "always": {
+                        "type": "boolean",
+                        "description": "When `true`, this target runs after the main task graph completes — even if upstream tasks failed. Useful for cleanup, teardown, notifications, or anything that should fire regardless of build outcome. Always-tasks are not part of the normal dependency graph and never block other tasks."
+                    },
+                    "cache": {
+                        "type": "boolean",
+                        "description": "Whether this target is cacheable"
+                    },
+                    "cacheOnWarning": {
+                        "type": "boolean",
+                        "description": "When `false`, exit-0 runs whose terminal output matched any  {@link  TargetConfiguration.warningPattern }  are not seeded into the cache. Defaults to `true` — warnings are surfaced on the result (`hadWarnings: true`) but caching still happens, matching the \"succeeded with warnings is incremental\" behaviour rush, lage and wireit users have repeatedly asked for."
+                    },
+                    "cacheRestore": {
+                        "type": "object",
+                        "properties": {
+                            "preserveMtime": {
+                                "type": "boolean",
+                                "description": "Restore each file's modification time from the captured tar header (second precision). When `false`, restored files take the current wall-clock time, matching the legacy behaviour."
+                            },
+                            "preservePerms": {
+                                "type": "boolean",
+                                "description": "Restore each file's POSIX mode bits (rwx triplets, low 12 bits). When `false`, restored files take the process umask. Only meaningful on POSIX hosts; Windows ignores tar mode."
+                            }
+                        },
+                        "additionalProperties": false,
+                        "description": "Fine-grained controls over how cached outputs are rehydrated. See  {@link  CacheRestoreOptions } . Both fields default to `true` (faithful restore); flip individually when downstream tooling needs the legacy \"now\"-stamped behaviour."
+                    },
+                    "command": {
+                        "type": "string",
+                        "description": "The command to run (alternative to executor)"
+                    },
+                    "configurations": {
+                        "type": "object",
+                        "additionalProperties": {
+                            "type": "object",
+                            "additionalProperties": {}
+                        },
+                        "description": "Named configurations (e.g., \"production\", \"development\")"
+                    },
+                    "dependsOn": {
+                        "type": "array",
+                        "items": {
+                            "anyOf": [
+                                {
+                                    "type": "string"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "dependencies": {
+                                            "type": "boolean",
+                                            "description": "Whether this is a dependency on the same project"
+                                        },
+                                        "params": {
+                                            "type": "string",
+                                            "enum": [
+                                                "forward",
+                                                "ignore"
+                                            ],
+                                            "description": "Params to pass through"
+                                        },
+                                        "projects": {
+                                            "anyOf": [
+                                                {
+                                                    "type": "string"
+                                                },
+                                                {
+                                                    "type": "array",
+                                                    "items": {
+                                                        "type": "string"
+                                                    }
+                                                }
+                                            ],
+                                            "description": "The project name (if different from the current project)"
+                                        },
+                                        "target": {
+                                            "type": "string",
+                                            "description": "The target name"
+                                        }
+                                    },
+                                    "required": [
+                                        "target"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "Defines a dependency on another target."
+                                }
+                            ]
+                        },
+                        "description": "Other targets this target depends on"
+                    },
+                    "executor": {
+                        "type": "string",
+                        "description": "The executor/command to run"
+                    },
+                    "inputs": {
+                        "type": "array",
+                        "items": {
+                            "anyOf": [
+                                {
+                                    "type": "string"
+                                },
+                                {
+                                    "anyOf": [
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "fileset": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "object",
+                                                            "properties": {
+                                                                "base": {
+                                                                    "type": "string",
+                                                                    "enum": [
+                                                                        "package",
+                                                                        "workspace"
+                                                                    ],
+                                                                    "description": "Anchor for the pattern."
+                                                                },
+                                                                "pattern": {
+                                                                    "type": "string",
+                                                                    "description": "Glob pattern (may start with `!` for negation)."
+                                                                }
+                                                            },
+                                                            "required": [
+                                                                "base",
+                                                                "pattern"
+                                                            ],
+                                                            "additionalProperties": false,
+                                                            "description": "Object form of a fileset pattern, for anchoring to the workspace root."
+                                                        },
+                                                        {
+                                                            "type": "string"
+                                                        }
+                                                    ]
+                                                }
+                                            },
+                                            "required": [
+                                                "fileset"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on file patterns.\n\n`fileset` may be a bare glob string (package-root relative) or an object form `{ pattern, base }` to anchor explicitly to the workspace root. Negation (`!` prefix) works in both forms."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "runtime": {
+                                                    "type": "string"
+                                                }
+                                            },
+                                            "required": [
+                                                "runtime"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on a runtime command."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "env": {
+                                                    "type": "string"
+                                                }
+                                            },
+                                            "required": [
+                                                "env"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on environment variables."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "externalDependencies": {
+                                                    "type": "array",
+                                                    "items": {
+                                                        "type": "string"
+                                                    }
+                                                }
+                                            },
+                                            "required": [
+                                                "externalDependencies"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on external dependency versions."
+                                        }
+                                    ],
+                                    "description": "Defines an input for cache invalidation."
+                                }
+                            ]
+                        },
+                        "description": "Input patterns for cache invalidation"
+                    },
+                    "outputs": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        },
+                        "description": "Output patterns produced by this target"
+                    },
+                    "parallelism": {
+                        "type": "boolean",
+                        "description": "Whether this target supports parallel execution"
+                    },
+                    "warningPattern": {
+                        "anyOf": [
+                            {
+                                "type": "string"
+                            },
+                            {
+                                "type": "array",
+                                "items": {
+                                    "type": "string"
+                                }
+                            }
+                        ],
+                        "description": "Regex source string(s) that mark a successful task as having emitted warnings. The orchestrator scans the task's combined terminal output after a 0-exit and, on first match, sets `hadWarnings` on the result. Combine with `cacheOnWarning: false` to skip caching for warning-tainted runs. Both bare strings and arrays are accepted; arrays are tested in order.\n\n  ```ts   warningPattern: [\"\\\\bwarning\\\\b\", \"TS\\\\d{4}\"]   ```"
+                    },
+                    "when": {
+                        "type": "object",
+                        "properties": {
+                            "branch": {
+                                "anyOf": [
+                                    {
+                                        "type": "string"
+                                    },
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    }
+                                ],
+                                "description": "Match against the current git branch (HEAD)."
+                            },
+                            "ci": {
+                                "type": "boolean",
+                                "description": "Run only when invoked inside CI when `true`, only outside CI when `false`. Detects CI via the `CI` env var (the convention GitHub Actions, GitLab, CircleCI, Jenkins, etc. all share)."
+                            },
+                            "env": {
+                                "anyOf": [
+                                    {
+                                        "anyOf": [
+                                            {
+                                                "type": "string"
+                                            },
+                                            {
+                                                "type": "object",
+                                                "properties": {
+                                                    "equals": {
+                                                        "type": "string",
+                                                        "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                    },
+                                                    "exists": {
+                                                        "type": "boolean",
+                                                        "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                    },
+                                                    "name": {
+                                                        "type": "string",
+                                                        "description": "Variable name."
+                                                    }
+                                                },
+                                                "required": [
+                                                    "name"
+                                                ],
+                                                "additionalProperties": false
+                                            }
+                                        ],
+                                        "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                    },
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "anyOf": [
+                                                {
+                                                    "type": "string"
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "equals": {
+                                                            "type": "string",
+                                                            "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                        },
+                                                        "exists": {
+                                                            "type": "boolean",
+                                                            "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                        },
+                                                        "name": {
+                                                            "type": "string",
+                                                            "description": "Variable name."
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "name"
+                                                    ],
+                                                    "additionalProperties": false
+                                                }
+                                            ],
+                                            "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                        }
+                                    }
+                                ],
+                                "description": "Match against environment variables. A bare string asserts the variable is set and non-empty; the object form lets you match an exact value or just assert presence/absence."
+                            },
+                            "not": {
+                                "type": "object",
+                                "properties": {
+                                    "branch": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string"
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string"
+                                                }
+                                            }
+                                        ]
+                                    },
+                                    "ci": {
+                                        "type": "boolean"
+                                    },
+                                    "env": {
+                                        "anyOf": [
+                                            {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string"
+                                                    },
+                                                    {
+                                                        "type": "object",
+                                                        "properties": {
+                                                            "equals": {
+                                                                "type": "string",
+                                                                "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                            },
+                                                            "exists": {
+                                                                "type": "boolean",
+                                                                "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                            },
+                                                            "name": {
+                                                                "type": "string",
+                                                                "description": "Variable name."
+                                                            }
+                                                        },
+                                                        "required": [
+                                                            "name"
+                                                        ],
+                                                        "additionalProperties": false
+                                                    }
+                                                ],
+                                                "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "string"
+                                                        },
+                                                        {
+                                                            "type": "object",
+                                                            "properties": {
+                                                                "equals": {
+                                                                    "type": "string",
+                                                                    "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                },
+                                                                "exists": {
+                                                                    "type": "boolean",
+                                                                    "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                },
+                                                                "name": {
+                                                                    "type": "string",
+                                                                    "description": "Variable name."
+                                                                }
+                                                            },
+                                                            "required": [
+                                                                "name"
+                                                            ],
+                                                            "additionalProperties": false
+                                                        }
+                                                    ],
+                                                    "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                }
+                                            }
+                                        ]
+                                    },
+                                    "os": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string",
+                                                "enum": [
+                                                    "aix",
+                                                    "darwin",
+                                                    "freebsd",
+                                                    "linux",
+                                                    "openbsd",
+                                                    "sunos",
+                                                    "windows",
+                                                    "win32"
+                                                ],
+                                                "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string",
+                                                    "enum": [
+                                                        "aix",
+                                                        "darwin",
+                                                        "freebsd",
+                                                        "linux",
+                                                        "openbsd",
+                                                        "sunos",
+                                                        "windows",
+                                                        "win32"
+                                                    ],
+                                                    "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                }
+                                            }
+                                        ]
+                                    }
+                                },
+                                "additionalProperties": false,
+                                "description": "Negative mirrors. A task runs only when *all* `not.*` clauses fail."
+                            },
+                            "os": {
+                                "anyOf": [
+                                    {
+                                        "type": "string",
+                                        "enum": [
+                                            "aix",
+                                            "darwin",
+                                            "freebsd",
+                                            "linux",
+                                            "openbsd",
+                                            "sunos",
+                                            "windows",
+                                            "win32"
+                                        ],
+                                        "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                    },
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string",
+                                            "enum": [
+                                                "aix",
+                                                "darwin",
+                                                "freebsd",
+                                                "linux",
+                                                "openbsd",
+                                                "sunos",
+                                                "windows",
+                                                "win32"
+                                            ],
+                                            "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                        }
+                                    }
+                                ],
+                                "description": "Match `process.platform` (`\"linux\" | \"darwin\" | \"win32\" | \"freebsd\" | \"openbsd\" | \"sunos\" | \"aix\"`). Pass `\"windows\"` as an alias for `\"win32\"` — easier to remember and matches what people type."
+                            }
+                        },
+                        "additionalProperties": false,
+                        "description": "Predicate that gates execution. When the condition evaluates to `false` for the current environment, the task is skipped (marked `\"skipped\"`, not failed). Combine with `os`, `env`, `branch`, and `ci` clauses for granular control:\n\n  ```ts   when: { os: \"linux\", ci: true, env: \"DEPLOY_TOKEN\" }   ```"
+                    }
+                },
+                "additionalProperties": false
+            },
+            "description": "Target default configurations"
+        },
+        "taskDefaults": {
+            "type": "array",
+            "items": {
+                "$ref": "#/$defs/TaskDefaultsBlock"
+            },
+            "description": "Cascading task-default blocks. Each block may scope its targets to a subset of projects via `scope`. Blocks are evaluated in order; later blocks override earlier ones when the same field is set.\n\nScope matching is additive — if `scope` is omitted, the block applies to every project."
+        },
+        "taskGroups": {
+            "type": "object",
+            "additionalProperties": {
+                "type": "array",
+                "items": {
+                    "anyOf": [
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "object",
+                            "properties": {
+                                "dependencies": {
+                                    "type": "boolean"
+                                },
+                                "projects": {
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "type": "array",
+                                            "items": {
+                                                "type": "string"
+                                            }
+                                        }
+                                    ]
+                                },
+                                "target": {
+                                    "type": "string"
+                                }
+                            },
+                            "required": [
+                                "target"
+                            ],
+                            "additionalProperties": false
+                        },
+                        {
+                            "type": "object",
+                            "properties": {
+                                "group": {
+                                    "type": "string"
+                                }
+                            },
+                            "required": [
+                                "group"
+                            ],
+                            "additionalProperties": false
+                        }
+                    ]
+                }
+            },
+            "description": "Named bundles of target dependencies, referenceable from any task's `dependsOn`. `dependsOn: [{ group: \"lint\" }]` expands to every entry in the named group; nested groups are resolved recursively and a cycle raises during discovery."
+        },
+        "taskRunnerOptions": {
+            "type": "object",
+            "properties": {
+                "autoEnvVars": {
+                    "type": "boolean",
+                    "description": "Scan each task's resolved command text for `$VAR`/`${VAR}` references and automatically fingerprint those env vars. Catches tasks like `curl ${VERCEL_URL}/api` where the user forgot to declare the reference in `envVars`/`globalEnv`.",
+                    "default": false
+                },
+                "autoFingerprint": {
+                    "type": "boolean",
+                    "description": "Enable auto-fingerprinting mode (Vite Task-style). When enabled, the task runner automatically tracks which files a task accesses during execution and uses that for cache invalidation instead of requiring manual input configuration.\n\nFalls back to explicit inputs (Nx-style) when file tracking is not supported on the current platform.",
+                    "default": false
+                },
+                "cacheDiagnostics": {
+                    "type": "boolean",
+                    "description": "Whether to show cache miss diagnostics (why a cache miss occurred).",
+                    "default": false
+                },
+                "cacheDirectory": {
+                    "type": "string",
+                    "description": "Directory for storing cache"
+                },
+                "dryRun": {
+                    "type": "boolean",
+                    "description": "Dry-run mode: compute hashes and check cache but don't execute tasks. Useful for debugging cache hits/misses.",
+                    "default": false
+                },
+                "envVars": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Custom environment variables to include in hash"
+                },
+                "fingerprintEnvPatterns": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Environment variable patterns to include in auto-fingerprint. Supports wildcard patterns like \"VITE_*\". Only used when autoFingerprint is enabled."
+                },
+                "frameworkInference": {
+                    "type": "boolean",
+                    "description": "Enable framework environment variable inference. When true, automatically detects common frontend frameworks and includes their public env var prefixes in the task hash:\n- Next.js: NEXT_PUBLIC_*\n- Vite: VITE_*\n- Create React App: REACT_APP_*\n- Gatsby: GATSBY_*\n- Nuxt: NUXT_PUBLIC_*\n- Expo: EXPO_PUBLIC_*\n\nMatches Turborepo's framework inference behavior.",
+                    "default": false
+                },
+                "globalEnv": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Global environment variables that invalidate ALL task hashes. Matches Turborepo's `globalEnv`."
+                },
+                "globalInputs": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Global input files that invalidate ALL task hashes when changed. These are workspace-root-relative paths.\n\nDefault: [\"package-lock.json\", \"pnpm-lock.yaml\", \"yarn.lock\", \"tsconfig.base.json\", \".env\"]\n\nWhen any global input changes, every task's hash changes, forcing a full rebuild. This matches Turborepo's `globalDependencies`."
+                },
+                "incrementalFileHashing": {
+                    "type": "boolean",
+                    "description": "When `true`, file hashes are cached in a persistent mtime+size indexed snapshot under `node_modules/.cache/task-runner/`. On subsequent runs, unchanged files skip content re-reads — cuts cold-cache fingerprint time dramatically on large workspaces.\n\nChanged or new files still get full content hashing. Safe to leave on by default; overhead when nothing matches is a single `stat` call per file.",
+                    "default": false
+                },
+                "maxCacheAge": {
+                    "type": "number",
+                    "description": "Maximum age of cache entries in milliseconds"
+                },
+                "maxCacheSize": {
+                    "type": "string",
+                    "description": "Maximum cache size (e.g., \"1GB\")"
+                },
+                "namedInputs": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "array",
+                        "items": {
+                            "anyOf": [
+                                {
+                                    "type": "string"
+                                },
+                                {
+                                    "anyOf": [
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "fileset": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "object",
+                                                            "properties": {
+                                                                "base": {
+                                                                    "type": "string",
+                                                                    "enum": [
+                                                                        "package",
+                                                                        "workspace"
+                                                                    ],
+                                                                    "description": "Anchor for the pattern."
+                                                                },
+                                                                "pattern": {
+                                                                    "type": "string",
+                                                                    "description": "Glob pattern (may start with `!` for negation)."
+                                                                }
+                                                            },
+                                                            "required": [
+                                                                "base",
+                                                                "pattern"
+                                                            ],
+                                                            "additionalProperties": false,
+                                                            "description": "Object form of a fileset pattern, for anchoring to the workspace root."
+                                                        },
+                                                        {
+                                                            "type": "string"
+                                                        }
+                                                    ]
+                                                }
+                                            },
+                                            "required": [
+                                                "fileset"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on file patterns.\n\n`fileset` may be a bare glob string (package-root relative) or an object form `{ pattern, base }` to anchor explicitly to the workspace root. Negation (`!` prefix) works in both forms."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "runtime": {
+                                                    "type": "string"
+                                                }
+                                            },
+                                            "required": [
+                                                "runtime"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on a runtime command."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "env": {
+                                                    "type": "string"
+                                                }
+                                            },
+                                            "required": [
+                                                "env"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on environment variables."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "externalDependencies": {
+                                                    "type": "array",
+                                                    "items": {
+                                                        "type": "string"
+                                                    }
+                                                }
+                                            },
+                                            "required": [
+                                                "externalDependencies"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on external dependency versions."
+                                        }
+                                    ],
+                                    "description": "Defines an input for cache invalidation."
+                                }
+                            ]
+                        }
+                    },
+                    "description": "Named inputs for cache invalidation"
+                },
+                "namespaceByGlobalEnv": {
+                    "type": "boolean",
+                    "description": "When `true`, the cache directory is partitioned by a hash of the resolved `globalEnv` values. Changing a globalEnv var moves cache writes into a new namespace; rolling it back reuses the old namespace and its hits. Without this option, any globalEnv change silently busts every cached entry.\n\nKeep disabled when globalEnv is stable across runs — the extra path depth offers no value, and misconfigured namespaces can hide stale hits.",
+                    "default": false
+                },
+                "parallel": {
+                    "type": [
+                        "number",
+                        "boolean"
+                    ],
+                    "description": "Maximum number of parallel tasks"
+                },
+                "remoteCache": {
+                    "type": "object",
+                    "properties": {
+                        "allowInsecureBearer": {
+                            "type": "boolean",
+                            "description": "Opt out of the REAPI safety check that refuses to send a bearer token over cleartext gRPC. Required only when the connection terminates inside a trusted boundary (loopback dev cache, mesh mTLS sidecar that strips/re-encrypts on the next hop). Default `false` — production callers should reach for `grpcs://` first.\n\nREAPI-only."
+                        },
+                        "backend": {
+                            "type": "string",
+                            "enum": [
+                                "http",
+                                "reapi"
+                            ],
+                            "description": "Wire-protocol selector. `\"http\"` is the Turborepo-compatible single-tarball cache; `\"reapi\"` switches to the Bazel Remote Execution API gRPC client, unlocking `bazel-remote`, BuildBuddy, BuildBarn, EngFlow as drop-in backends.",
+                            "default": "http"
+                        },
+                        "bearerToken": {
+                            "type": "string",
+                            "description": "Bearer token sent in REAPI's `authorization: Bearer {token}` gRPC metadata header. REAPI-only — HTTP backend uses `token`."
+                        },
+                        "compression": {
+                            "type": "string",
+                            "enum": [
+                                "brotli",
+                                "gzip"
+                            ],
+                            "description": "HTTP-only: tarball compression on the wire.",
+                            "default": "gzip"
+                        },
+                        "instanceName": {
+                            "type": "string",
+                            "description": "REAPI-only `instance_name` for multi-tenant servers (a single gRPC endpoint can host multiple logical caches keyed on the `instance_name` prefix)."
+                        },
+                        "localCasRoot": {
+                            "type": "string",
+                            "description": "Local CAS root used by the per-blob  {@link  RemoteCacheBackend }  methods. The HTTP wire format is still single-tarball; on retrieve the bridge extracts blobs into this root so a follow-up `fetchBlob` is just a local read."
+                        },
+                        "mode": {
+                            "type": "string",
+                            "enum": [
+                                "read",
+                                "readwrite",
+                                "write"
+                            ],
+                            "description": "Canonical cache mode flag.\n\n- `\"read\"`: Pull cache hits, never push. Sensible default for   local dev so a developer doesn't poison the shared cache while   their workspace is dirty.\n- `\"write\"`: Push results, never read. Useful for refill /   warm-up jobs that should always re-execute and re-upload.\n- `\"readwrite\"`: Both. Default for CI.",
+                            "default": "readwrite"
+                        },
+                        "signing": {
+                            "type": "object",
+                            "properties": {
+                                "secret": {
+                                    "type": "string",
+                                    "description": "Shared secret. Must be at least 16 characters."
+                                },
+                                "verifyOnDownload": {
+                                    "type": "boolean",
+                                    "description": "Reject downloads whose signature doesn't match or is missing. Set to `true` once every upload on your server is signed.",
+                                    "default": false
+                                }
+                            },
+                            "required": [
+                                "secret"
+                            ],
+                            "additionalProperties": false,
+                            "description": "HTTP-only: HMAC-SHA256 signing for upload integrity."
+                        },
+                        "teamId": {
+                            "type": "string",
+                            "description": "Team / namespace for cache isolation."
+                        },
+                        "timeout": {
+                            "type": "number",
+                            "description": "Per-call request timeout in milliseconds.",
+                            "default": 30000
+                        },
+                        "token": {
+                            "type": "string",
+                            "description": "HTTP authentication token sent as `Authorization: Bearer …`. For REAPI, use `bearerToken` instead — same wire mechanic, but a separate field so REAPI's cleartext-bearer guard can distinguish \"user explicitly opted into a gRPC token\" from \"user set HTTP auth and accidentally selected the REAPI backend\"."
+                        },
+                        "url": {
+                            "type": "string",
+                            "description": "Cache server URL.\n\n- HTTP: `https://cache.example.com`\n- REAPI: `grpcs://host:port` (TLS, recommended) or `grpc://host:port`   (cleartext — bearer tokens are refused unless `allowInsecureBearer`)."
+                        }
+                    },
+                    "required": [
+                        "url"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Remote cache configuration. When configured, the task runner checks the remote cache after a local miss and uploads results after execution. See  {@link  RemoteCacheOptions }  for the full HTTP and REAPI surface."
+                },
+                "skipNxCache": {
+                    "type": "boolean",
+                    "description": "Whether to skip cache reads"
+                },
+                "smartLockfileHashing": {
+                    "type": "boolean",
+                    "description": "Enable smart lockfile hashing. Instead of hashing the entire lockfile (which busts ALL caches), only hash the resolved versions of each package's actual dependencies. This matches Turborepo's smart lockfile hashing behavior.",
+                    "default": false
+                },
+                "summarize": {
+                    "type": "boolean",
+                    "description": "Generate a detailed JSON run summary after execution. When true, writes a summary file to `.task-runner/runs/` containing all task inputs, outputs, hashes, timings, and cache status.\n\nUseful for debugging cache misses and comparing runs. Matches Turborepo's `--summarize` flag.",
+                    "default": false
+                },
+                "targetDefaults": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "object",
+                        "properties": {
+                            "always": {
+                                "type": "boolean",
+                                "description": "When `true`, this target runs after the main task graph completes — even if upstream tasks failed. Useful for cleanup, teardown, notifications, or anything that should fire regardless of build outcome. Always-tasks are not part of the normal dependency graph and never block other tasks."
+                            },
+                            "cache": {
+                                "type": "boolean",
+                                "description": "Whether this target is cacheable"
+                            },
+                            "cacheOnWarning": {
+                                "type": "boolean",
+                                "description": "When `false`, exit-0 runs whose terminal output matched any  {@link  TargetConfiguration.warningPattern }  are not seeded into the cache. Defaults to `true` — warnings are surfaced on the result (`hadWarnings: true`) but caching still happens, matching the \"succeeded with warnings is incremental\" behaviour rush, lage and wireit users have repeatedly asked for."
+                            },
+                            "cacheRestore": {
+                                "type": "object",
+                                "properties": {
+                                    "preserveMtime": {
+                                        "type": "boolean",
+                                        "description": "Restore each file's modification time from the captured tar header (second precision). When `false`, restored files take the current wall-clock time, matching the legacy behaviour."
+                                    },
+                                    "preservePerms": {
+                                        "type": "boolean",
+                                        "description": "Restore each file's POSIX mode bits (rwx triplets, low 12 bits). When `false`, restored files take the process umask. Only meaningful on POSIX hosts; Windows ignores tar mode."
+                                    }
+                                },
+                                "additionalProperties": false,
+                                "description": "Fine-grained controls over how cached outputs are rehydrated. See  {@link  CacheRestoreOptions } . Both fields default to `true` (faithful restore); flip individually when downstream tooling needs the legacy \"now\"-stamped behaviour."
+                            },
+                            "command": {
+                                "type": "string",
+                                "description": "The command to run (alternative to executor)"
+                            },
+                            "configurations": {
+                                "type": "object",
+                                "additionalProperties": {
+                                    "type": "object",
+                                    "additionalProperties": {}
+                                },
+                                "description": "Named configurations (e.g., \"production\", \"development\")"
+                            },
+                            "dependsOn": {
+                                "type": "array",
+                                "items": {
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "dependencies": {
+                                                    "type": "boolean",
+                                                    "description": "Whether this is a dependency on the same project"
+                                                },
+                                                "params": {
+                                                    "type": "string",
+                                                    "enum": [
+                                                        "forward",
+                                                        "ignore"
+                                                    ],
+                                                    "description": "Params to pass through"
+                                                },
+                                                "projects": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "string"
+                                                        },
+                                                        {
+                                                            "type": "array",
+                                                            "items": {
+                                                                "type": "string"
+                                                            }
+                                                        }
+                                                    ],
+                                                    "description": "The project name (if different from the current project)"
+                                                },
+                                                "target": {
+                                                    "type": "string",
+                                                    "description": "The target name"
+                                                }
+                                            },
+                                            "required": [
+                                                "target"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "Defines a dependency on another target."
+                                        }
+                                    ]
+                                },
+                                "description": "Other targets this target depends on"
+                            },
+                            "executor": {
+                                "type": "string",
+                                "description": "The executor/command to run"
+                            },
+                            "inputs": {
+                                "type": "array",
+                                "items": {
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "anyOf": [
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "fileset": {
+                                                            "anyOf": [
+                                                                {
+                                                                    "type": "object",
+                                                                    "properties": {
+                                                                        "base": {
+                                                                            "type": "string",
+                                                                            "enum": [
+                                                                                "package",
+                                                                                "workspace"
+                                                                            ],
+                                                                            "description": "Anchor for the pattern."
+                                                                        },
+                                                                        "pattern": {
+                                                                            "type": "string",
+                                                                            "description": "Glob pattern (may start with `!` for negation)."
+                                                                        }
+                                                                    },
+                                                                    "required": [
+                                                                        "base",
+                                                                        "pattern"
+                                                                    ],
+                                                                    "additionalProperties": false,
+                                                                    "description": "Object form of a fileset pattern, for anchoring to the workspace root."
+                                                                },
+                                                                {
+                                                                    "type": "string"
+                                                                }
+                                                            ]
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "fileset"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on file patterns.\n\n`fileset` may be a bare glob string (package-root relative) or an object form `{ pattern, base }` to anchor explicitly to the workspace root. Negation (`!` prefix) works in both forms."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "runtime": {
+                                                            "type": "string"
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "runtime"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on a runtime command."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "env": {
+                                                            "type": "string"
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "env"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on environment variables."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "externalDependencies": {
+                                                            "type": "array",
+                                                            "items": {
+                                                                "type": "string"
+                                                            }
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "externalDependencies"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on external dependency versions."
+                                                }
+                                            ],
+                                            "description": "Defines an input for cache invalidation."
+                                        }
+                                    ]
+                                },
+                                "description": "Input patterns for cache invalidation"
+                            },
+                            "options": {
+                                "type": "object",
+                                "additionalProperties": {},
+                                "description": "Options passed to the executor"
+                            },
+                            "outputs": {
+                                "type": "array",
+                                "items": {
+                                    "type": "string"
+                                },
+                                "description": "Output patterns produced by this target"
+                            },
+                            "parallelism": {
+                                "type": "boolean",
+                                "description": "Whether this target supports parallel execution"
+                            },
+                            "warningPattern": {
+                                "anyOf": [
+                                    {
+                                        "type": "string"
+                                    },
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    }
+                                ],
+                                "description": "Regex source string(s) that mark a successful task as having emitted warnings. The orchestrator scans the task's combined terminal output after a 0-exit and, on first match, sets `hadWarnings` on the result. Combine with `cacheOnWarning: false` to skip caching for warning-tainted runs. Both bare strings and arrays are accepted; arrays are tested in order.\n\n  ```ts   warningPattern: [\"\\\\bwarning\\\\b\", \"TS\\\\d{4}\"]   ```"
+                            },
+                            "when": {
+                                "type": "object",
+                                "properties": {
+                                    "branch": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string"
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string"
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match against the current git branch (HEAD)."
+                                    },
+                                    "ci": {
+                                        "type": "boolean",
+                                        "description": "Run only when invoked inside CI when `true`, only outside CI when `false`. Detects CI via the `CI` env var (the convention GitHub Actions, GitLab, CircleCI, Jenkins, etc. all share)."
+                                    },
+                                    "env": {
+                                        "anyOf": [
+                                            {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string"
+                                                    },
+                                                    {
+                                                        "type": "object",
+                                                        "properties": {
+                                                            "equals": {
+                                                                "type": "string",
+                                                                "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                            },
+                                                            "exists": {
+                                                                "type": "boolean",
+                                                                "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                            },
+                                                            "name": {
+                                                                "type": "string",
+                                                                "description": "Variable name."
+                                                            }
+                                                        },
+                                                        "required": [
+                                                            "name"
+                                                        ],
+                                                        "additionalProperties": false
+                                                    }
+                                                ],
+                                                "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "string"
+                                                        },
+                                                        {
+                                                            "type": "object",
+                                                            "properties": {
+                                                                "equals": {
+                                                                    "type": "string",
+                                                                    "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                },
+                                                                "exists": {
+                                                                    "type": "boolean",
+                                                                    "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                },
+                                                                "name": {
+                                                                    "type": "string",
+                                                                    "description": "Variable name."
+                                                                }
+                                                            },
+                                                            "required": [
+                                                                "name"
+                                                            ],
+                                                            "additionalProperties": false
+                                                        }
+                                                    ],
+                                                    "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match against environment variables. A bare string asserts the variable is set and non-empty; the object form lets you match an exact value or just assert presence/absence."
+                                    },
+                                    "not": {
+                                        "type": "object",
+                                        "properties": {
+                                            "branch": {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string"
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "type": "string"
+                                                        }
+                                                    }
+                                                ]
+                                            },
+                                            "ci": {
+                                                "type": "boolean"
+                                            },
+                                            "env": {
+                                                "anyOf": [
+                                                    {
+                                                        "anyOf": [
+                                                            {
+                                                                "type": "string"
+                                                            },
+                                                            {
+                                                                "type": "object",
+                                                                "properties": {
+                                                                    "equals": {
+                                                                        "type": "string",
+                                                                        "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                    },
+                                                                    "exists": {
+                                                                        "type": "boolean",
+                                                                        "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                    },
+                                                                    "name": {
+                                                                        "type": "string",
+                                                                        "description": "Variable name."
+                                                                    }
+                                                                },
+                                                                "required": [
+                                                                    "name"
+                                                                ],
+                                                                "additionalProperties": false
+                                                            }
+                                                        ],
+                                                        "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "anyOf": [
+                                                                {
+                                                                    "type": "string"
+                                                                },
+                                                                {
+                                                                    "type": "object",
+                                                                    "properties": {
+                                                                        "equals": {
+                                                                            "type": "string",
+                                                                            "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                        },
+                                                                        "exists": {
+                                                                            "type": "boolean",
+                                                                            "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                        },
+                                                                        "name": {
+                                                                            "type": "string",
+                                                                            "description": "Variable name."
+                                                                        }
+                                                                    },
+                                                                    "required": [
+                                                                        "name"
+                                                                    ],
+                                                                    "additionalProperties": false
+                                                                }
+                                                            ],
+                                                            "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                        }
+                                                    }
+                                                ]
+                                            },
+                                            "os": {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string",
+                                                        "enum": [
+                                                            "aix",
+                                                            "darwin",
+                                                            "freebsd",
+                                                            "linux",
+                                                            "openbsd",
+                                                            "sunos",
+                                                            "windows",
+                                                            "win32"
+                                                        ],
+                                                        "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "type": "string",
+                                                            "enum": [
+                                                                "aix",
+                                                                "darwin",
+                                                                "freebsd",
+                                                                "linux",
+                                                                "openbsd",
+                                                                "sunos",
+                                                                "windows",
+                                                                "win32"
+                                                            ],
+                                                            "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                        }
+                                                    }
+                                                ]
+                                            }
+                                        },
+                                        "additionalProperties": false,
+                                        "description": "Negative mirrors. A task runs only when *all* `not.*` clauses fail."
+                                    },
+                                    "os": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string",
+                                                "enum": [
+                                                    "aix",
+                                                    "darwin",
+                                                    "freebsd",
+                                                    "linux",
+                                                    "openbsd",
+                                                    "sunos",
+                                                    "windows",
+                                                    "win32"
+                                                ],
+                                                "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string",
+                                                    "enum": [
+                                                        "aix",
+                                                        "darwin",
+                                                        "freebsd",
+                                                        "linux",
+                                                        "openbsd",
+                                                        "sunos",
+                                                        "windows",
+                                                        "win32"
+                                                    ],
+                                                    "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match `process.platform` (`\"linux\" | \"darwin\" | \"win32\" | \"freebsd\" | \"openbsd\" | \"sunos\" | \"aix\"`). Pass `\"windows\"` as an alias for `\"win32\"` — easier to remember and matches what people type."
+                                    }
+                                },
+                                "additionalProperties": false,
+                                "description": "Predicate that gates execution. When the condition evaluates to `false` for the current environment, the task is skipped (marked `\"skipped\"`, not failed). Combine with `os`, `env`, `branch`, and `ci` clauses for granular control:\n\n  ```ts   when: { os: \"linux\", ci: true, env: \"DEPLOY_TOKEN\" }   ```"
+                            }
+                        },
+                        "additionalProperties": false
+                    },
+                    "description": "Target-specific default configurations"
+                },
+                "untrackedEnvVars": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Environment variables that should be passed to tasks but NOT included in the cache fingerprint. Useful for CI-specific vars. Only used when autoFingerprint is enabled."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Task runner options forwarded verbatim to `defaultTaskRunner`.\n\nIncludes `remoteCache` (HTTP or REAPI gRPC backend), `cacheDirectory`, `parallel`, `globalEnv`, `globalInputs`, `targetDefaults`, etc. See `TaskRunnerOptions` for the full surface."
+        },
+        "toolchain": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+                "preferredManager": {
+                    "type": "string",
+                    "enum": [
+                        "asdf",
+                        "corepack",
+                        "fnm",
+                        "mise",
+                        "none",
+                        "nvm",
+                        "proto",
+                        "volta"
+                    ]
+                },
+                "autoInstall": {
+                    "type": "boolean",
+                    "description": "When a tool pin doesn't match the running version, try to fix it automatically before `vis run` / `vis ci` proceed. Defaults to `true` when  {@link  findInstalledManagers }  reports at least one installed manager, `false` otherwise.\n\nSet to `false` to keep the doctor-style warning behaviour and make users run `vis toolchain install` themselves."
+                },
+                "tools": {
+                    "type": "object",
+                    "properties": {
+                        "bun": {
+                            "type": "string"
+                        },
+                        "deno": {
+                            "type": "string"
+                        },
+                        "go": {
+                            "type": "string"
+                        },
+                        "node": {
+                            "type": "string"
+                        },
+                        "npm": {
+                            "type": "string"
+                        },
+                        "pnpm": {
+                            "type": "string"
+                        },
+                        "python": {
+                            "type": "string"
+                        },
+                        "ruby": {
+                            "type": "string"
+                        },
+                        "rust": {
+                            "type": "string"
+                        },
+                        "yarn": {
+                            "type": "string"
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Overrides for engines/packageManager-derived pins."
+                }
+            },
+            "description": "Toolchain (Node / pnpm / python / rust / ...) management. vis delegates to whichever version manager (proto, mise, fnm, volta, asdf, nvm, corepack) the developer already has — it does not ship its own.\n\nRe-exported from `./toolchain` so the public config type stays in lockstep with the resolver implementation. `self-activate` is narrowed out of `preferredManager` here — it's auto-resolved for pnpm/yarn `packageManager` pins and isn't meaningful as an override."
+        },
+        "tui": {
+            "type": "object",
+            "properties": {
+                "autoExit": {
+                    "type": [
+                        "boolean",
+                        "number"
+                    ],
+                    "description": "Auto-exit the TUI after tasks complete.\n- `false`: Stay open until the user presses `q` (default)\n- `true`: Show quit dialog with 3-second countdown after completion\n- `number`: Show quit dialog with custom countdown in seconds"
+                }
+            },
+            "additionalProperties": false,
+            "description": "Terminal UI configuration"
+        },
+        "update": {
+            "type": "object",
+            "properties": {
+                "depFields": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Dependency fields to scan for outdated packages. Beyond the standard fields, supports:\n- `\"overrides\"` (npm)\n- `\"resolutions\"` (yarn)\n- `\"pnpm.overrides\"`",
+                    "default": [
+                        "dependencies",
+                        "devDependencies",
+                        "optionalDependencies",
+                        "peerDependencies"
+                    ]
+                },
+                "exclude": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "format": {
+                    "type": "string",
+                    "enum": [
+                        "json",
+                        "minimal",
+                        "table"
+                    ]
+                },
+                "ignore": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Package names or glob patterns to permanently ignore during updates. Ignored packages are skipped and listed in the output so you know they were not checked.",
+                    "examples": [
+                        [
+                            "eslint",
+                            "@types/*"
+                        ]
+                    ]
+                },
+                "include": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "includeLocked": {
+                    "type": "boolean",
+                    "description": "Include packages with pinned/exact versions (no `^` or `~` prefix). By default, pinned versions are skipped during update checks.",
+                    "default": false
+                },
+                "install": {
+                    "type": "boolean"
+                },
+                "maxConcurrentRequests": {
+                    "type": "number",
+                    "description": "Maximum number of concurrent registry requests during outdated checks. Higher values speed up large workspaces but risk hitting registry rate limits or self-hosted Verdaccio caps.",
+                    "default": 8
+                },
+                "minimumReleaseAge": {
+                    "type": "number",
+                    "description": "Minimum number of minutes since a version was published before vis will consider it for updates. This mirrors pnpm's `minimumReleaseAge` — a single setting that applies to both install and update.\n\nNot set by default. If your package manager config (`pnpm-workspace.yaml`) has `minimumReleaseAge`, vis will read it from there as a fallback.",
+                    "examples": [
+                        1440
+                    ]
+                },
+                "minimumReleaseAgeExclude": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Package names/patterns excluded from the minimumReleaseAge check.",
+                    "examples": [
+                        [
+                            "webpack",
+                            "@myorg/*"
+                        ]
+                    ]
+                },
+                "packageMode": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string",
+                        "enum": [
+                            "latest",
+                            "minor",
+                            "patch"
+                        ]
+                    },
+                    "description": "Per-package or per-pattern update target overrides. Keys are exact package names, glob patterns, or regex patterns wrapped in `/` (e.g., `/^@vue/`). Values are `\"latest\"`, `\"minor\"`, or `\"patch\"`.",
+                    "examples": [
+                        {
+                            "typescript": "minor",
+                            "/^@vue/": "patch"
+                        }
+                    ]
+                },
+                "prerelease": {
+                    "type": "boolean"
+                },
+                "releaseChannel": {
+                    "type": "string",
+                    "enum": [
+                        "any",
+                        "same",
+                        "stable"
+                    ],
+                    "description": "Which release channels to consider when picking the target version.\n- `\"stable\"` (default) — only ship stable releases (no prereleases).\n- `\"same\"` — match the prerelease channel of the *current* range:   if you're on `react@19.0.0-rc.1`, only `rc.*` candidates qualify;   if you're on a stable, only stable candidates. Prevents   accidentally promoting a prerelease pin to a stable major bump.\n- `\"any\"` — equivalent to `--prerelease`. Any channel is fair game.\n\n`--release-channel` on the CLI overrides this. If `prerelease: true` is set without `releaseChannel`, vis treats it as `\"any\"`.",
+                    "default": "stable"
+                },
+                "security": {
+                    "type": "boolean"
+                },
+                "target": {
+                    "type": "string",
+                    "enum": [
+                        "latest",
+                        "minor",
+                        "patch"
+                    ]
+                }
+            },
+            "additionalProperties": false,
+            "description": "Update command defaults"
+        },
+        "versionConstraint": {
+            "type": "string",
+            "description": "Minimum vis CLI version required by this workspace. When the running vis binary is older than this constraint, vis exits with an actionable error before executing any command.\n\nAccepts a semver range string (e.g. `\">=1.0.0\"`, `\"^1.2.0\"`).",
+            "examples": [
+                ">=1.0.0"
+            ]
+        }
+    },
+    "additionalProperties": false,
+    "$defs": {
+        "CodeownersConfig": {
+            "type": "object",
+            "properties": {
+                "globalPaths": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        }
+                    },
+                    "description": "Workspace-level paths that apply outside any project (e.g., `.github/**`)."
+                },
+                "orderBy": {
+                    "type": "string",
+                    "enum": [
+                        "file-source",
+                        "project-id"
+                    ],
+                    "description": "Sort order for generated entries — mirrors moon's `orderBy`."
+                },
+                "provider": {
+                    "type": "string",
+                    "enum": [
+                        "bitbucket",
+                        "github",
+                        "gitlab",
+                        "other"
+                    ],
+                    "description": "Provider determines whether `channel` is emitted (GitHub supports it via comment)."
+                }
+            },
+            "additionalProperties": false
+        },
+        "VisPlugin": {
+            "type": "object",
+            "properties": {
+                "hooks": {
+                    "type": "object",
+                    "properties": {
+                        "run:after": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired after the entire task graph completes (including any failures). `results` maps task ID →  {@link  TaskResult } ."
+                            }
                         },
-                        "teamId": { "type": "string", "description": "Team / namespace for cache isolation." },
-                        "timeout": { "type": "number", "default": 30000, "description": "Per-call request timeout in milliseconds." },
-                        "compression": {
-                            "type": "string",
-                            "enum": ["gzip", "brotli"],
-                            "default": "gzip",
-                            "description": "HTTP-only: tarball compression on the wire."
+                        "run:before": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired once before any task in the graph starts, after workspace discovery and graph construction. Throwing aborts the run."
+                            }
                         },
-                        "signing": {
-                            "type": "object",
-                            "additionalProperties": false,
-                            "required": ["secret"],
-                            "description": "HTTP-only HMAC-SHA256 signing for upload integrity.",
-                            "properties": {
-                                "secret": { "type": "string", "minLength": 16, "description": "Shared secret. Must be at least 16 characters." },
-                                "verifyOnDownload": { "type": "boolean", "default": false, "description": "Reject downloads whose signature doesn't match." }
+                        "task:after": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired after a task completes (success, failure, or cache hit). Receives the final  {@link  TaskResult } ."
                             }
                         },
-                        "localCasRoot": {
-                            "type": "string",
-                            "description": "Local CAS root used by per-blob backend methods. The HTTP bridge extracts retrieved tarballs into this root so follow-up fetchBlob calls hit local disk."
+                        "task:before": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired before each task begins execution — after scheduling, before the executor runs the command. Throwing aborts that single task."
+                            }
                         },
-                        "bearerToken": {
-                            "type": "string",
-                            "description": "REAPI-only: bearer token sent in gRPC 'authorization: Bearer …' metadata."
+                        "task:cacheHit": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired when a task hit the local or remote cache."
+                            }
                         },
-                        "instanceName": {
-                            "type": "string",
-                            "description": "REAPI-only: 'instance_name' for multi-tenant servers (single gRPC endpoint hosting multiple logical caches)."
+                        "task:cacheMiss": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired when auto-fingerprint cache diagnostics reports a miss, carrying the human-readable reason string."
+                            }
                         },
-                        "allowInsecureBearer": {
-                            "type": "boolean",
-                            "default": false,
-                            "description": "REAPI-only: opt out of the safety check that refuses bearer tokens over cleartext gRPC. Only set when the connection terminates inside a trusted boundary (loopback, mTLS sidecar)."
+                        "task:failure": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired when a task exits non-zero."
+                            }
                         },
-                        "read": {
-                            "type": "boolean",
-                            "deprecated": true,
-                            "description": "Deprecated. Use 'mode' instead. Setting both still works but emits a one-time warning."
+                        "task:stderr": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired with a stderr chunk as a running task emits it. Plugins that ship logs live (Slack, Datadog) should prefer this over `task:after` so they don't wait for the full buffer."
+                            }
                         },
-                        "write": {
-                            "type": "boolean",
-                            "deprecated": true,
-                            "description": "Deprecated. Use 'mode' instead. Setting both still works but emits a one-time warning."
+                        "task:stdout": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired with a stdout chunk as a running task emits it. See `task:stderr` for semantics."
+                            }
                         }
-                    }
+                    },
+                    "additionalProperties": false,
+                    "description": "Declarative handlers — the common shape. One entry per hook name; pass a function or an array of functions (all run serially in order)."
+                },
+                "name": {
+                    "type": "string",
+                    "description": "Plugin name — surfaced in debug logs."
                 }
-            }
+            },
+            "required": [
+                "name"
+            ],
+            "additionalProperties": false,
+            "description": "Public plugin contract. Implementations register handlers by returning a partial  {@link  VisHooks }  map from `hooks`, or by mutating the Hookable instance directly via `setup(hooks)` for advanced cases (dynamic registration, removeHook, etc.).\n\nPlugins are loaded in the order they appear in `visConfig.plugins`. Handler execution order within a hook follows registration order, so earlier plugins see events first."
         },
-        "tui": {
+        "ExtraCustomType": {
             "type": "object",
+            "properties": {
+                "depName": {
+                    "type": "string",
+                    "description": "Required when `strategy === \"string\"`. The dep-cluster key the bare version string at `path` should be associated with."
+                },
+                "name": {
+                    "type": "string",
+                    "description": "Display name for this customType. Used as the cluster key prefix in lint output and JSON. Must not collide with the built-in names."
+                },
+                "path": {
+                    "type": "string",
+                    "description": "Dot-separated walk into package.json (e.g. `pnpm.overrides`, `myTool.runtime`)."
+                },
+                "strategy": {
+                    "type": "string",
+                    "enum": [
+                        "name@version",
+                        "name~version",
+                        "string",
+                        "versionsByName"
+                    ],
+                    "description": "How to interpret the JSON found at `path`.\n- `name@version` — single string `pnpm@9.0.0` (with optional `+sha512.…` hash).\n- `name~version` — single string `node~20.0.0`, mirrors syncpack's tilde form.\n- `string` — bare version literal (requires `depName`).\n- `versionsByName` — `{ name: version }` object such as `engines`."
+                }
+            },
+            "required": [
+                "name",
+                "path",
+                "strategy"
+            ],
             "additionalProperties": false,
+            "description": "One user-declared customTypes entry. See `policy.customTypes.extraTypes` for the full contract — this is just the row shape."
+        },
+        "StagedConfig": {
+            "type": "object",
+            "additionalProperties": {
+                "$ref": "#/$defs/StagedTask"
+            },
+            "description": "Config object mapping glob patterns (basename or path-style) to tasks. A top-level function form lets the user generate the entire config from the staged file list."
+        },
+        "StagedTask": {
+            "anyOf": [
+                {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                {
+                    "type": "string"
+                },
+                {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            ],
+            "description": "A task value as authored by the user. Command strings are split into argv and invoked with the matched file paths appended. Arrays run serially. Functions receive the matched paths and return further task values (possibly async). `{ title, task }` objects run `task` directly with no argv construction."
+        },
+        "VisTargetOptions": {
+            "type": "object",
             "properties": {
-                "autoExit": {
-                    "oneOf": [{ "type": "boolean" }, { "type": "number" }],
-                    "description": "Auto-exit TUI after completion. false=stay open, true=3s countdown, number=custom seconds.",
+                "affectedFiles": {
+                    "$ref": "#/$defs/AffectedFilesMode",
+                    "description": "How to forward affected files to the task process. Only used when invoked via `vis affected &lt;target>`.",
+                    "default": false
+                },
+                "envFile": {
+                    "anyOf": [
+                        {
+                            "type": "boolean"
+                        },
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    ],
+                    "description": "Load environment variables from dotenv file(s) before running.\n- `string`: a single file path (relative to project root).\n- `string[]`: multiple files — later entries override earlier ones,   so put more-specific files last (e.g. `[\".env\", \".env.local\"]`).\n- `true`: auto-cascade in the Next/Vite order:   `.env` → `.env.{NODE_ENV}` → `.env.local` → `.env.{NODE_ENV}.local`.   Skips `.env.local` when NODE_ENV is `test`, matching Next.js."
+                },
+                "interactive": {
+                    "type": "boolean",
+                    "description": "When true, the task is serialized with respect to parallel execution and must be run on the main process (claims stdin). Used for commands that read from the terminal.",
+                    "default": false
+                },
+                "internal": {
+                    "type": "boolean",
+                    "description": "When true, the task is hidden from CLI listings and can only be invoked as a dependency of another task.",
+                    "default": false
+                },
+                "killGracePeriodMs": {
+                    "type": "number",
+                    "description": "Milliseconds the timeout watchdog waits between sending SIGTERM and SIGKILL when the `timeout` budget fires. Tasks that ignore SIGTERM (e.g. test runners holding open child processes) get force-killed after this grace window so a stuck task can't outlive its budget.\n\nSet to `0` to skip escalation and rely on SIGTERM only.",
+                    "default": 5000
+                },
+                "mutex": {
+                    "type": "string",
+                    "description": "Serializes all tasks that share the same mutex name. Useful for tasks that contend on a shared resource (e.g., a database migration)."
+                },
+                "outputStyle": {
+                    "type": "string",
+                    "enum": [
+                        "normal",
+                        "quiet"
+                    ],
+                    "description": "Per-target output verbosity. Overrides the global `--output-style` flag for this specific target.\n\n- `\"normal\"` (default): print every task's terminal output\n- `\"quiet\"`: only print output when the task fails. Successful   and cached tasks contribute their status line and timing, but   their captured stdout/stderr is suppressed.\n\nUseful when a routinely-noisy task (a linter or test runner with verbose progress output) should stay quiet during green builds but reveal everything when it fails."
+                },
+                "persistent": {
+                    "type": "boolean",
+                    "description": "When true, the task is a long-running / never-ending process. Persistent tasks are scheduled last, execute after all cacheable tasks complete, and are never cached.",
+                    "default": false
+                },
+                "preset": {
+                    "$ref": "#/$defs/TargetPreset",
+                    "description": "A preset that pre-fills a common bundle of options. User-provided fields always take precedence over the preset."
+                },
+                "pty": {
+                    "type": "boolean",
+                    "description": "Run the task through a pseudo-terminal so color-aware tools (vitest, eslint, biome, …) render as if attached to a real TTY instead of a pipe. Output is captured via task-runner's `TerminalBuffer` so ANSI escapes are normalized into the final rendered state before reaching the reporter.\n\nForces cache to off — PTY output can include timing-dependent frames (spinners) that aren't safe to replay from a cache.",
+                    "default": false
+                },
+                "retryCount": {
+                    "type": "number",
+                    "description": "Number of times to retry the task on failure. Uses an exponential backoff by default (1s, 2s, 4s, ...).",
+                    "default": 0
+                },
+                "retryDelay": {
+                    "anyOf": [
+                        {
+                            "type": "number"
+                        },
+                        {
+                            "type": "string",
+                            "const": "exponential"
+                        }
+                    ],
+                    "description": "Delay between retry attempts in milliseconds, or `\"exponential\"` for 2^attempt * 1000 ms.",
+                    "default": "exponential"
+                },
+                "runFromWorkspaceRoot": {
+                    "type": "boolean",
+                    "description": "When true, the command executes with the workspace root as CWD instead of the project root.",
                     "default": false
+                },
+                "runInCI": {
+                    "$ref": "#/$defs/RunInCI",
+                    "description": "Controls whether the task runs in CI environments.",
+                    "default": true
+                },
+                "runnerTags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Capability tags that gate this task to runners advertising the same tag. The CLI's `--runner-tags=gpu,slow` flag (or `VIS_RUNNER_TAGS` env var) tells vis what the current runner supports; tasks whose `runnerTags` share at least one tag with the runner set are eligible. Untagged tasks (no `runnerTags` or an empty array) are general-purpose and always run.\n\nUse this for special-purpose CI lanes — e.g. a GPU runner that should only pick up visual-regression suites, or a nightly job that runs `slow` integration tests. When neither flag nor env is set, the filter is inactive and every task runs."
+                },
+                "service": {
+                    "$ref": "#/$defs/ServiceConfig",
+                    "description": "Marks this target as a long-lived service that can be started via `vis service start &lt;id>` and auto-attached when other tasks declare it in `dependsOn`. Implies persistent + non-cacheable behaviour (set `preset: \"server\"` to inherit the rest of the bundle).\n\nThe presence of this block — not `preset: \"server\"` alone — is what makes a target eligible for the cross-invocation registry. `preset: \"server\"` without `service` keeps today's in-run-only behaviour."
+                },
+                "shell": {
+                    "type": "string",
+                    "description": "Per-target shell override. When set, the command runs through this shell instead of the platform default."
+                },
+                "strictEnv": {
+                    "type": "boolean",
+                    "description": "Override the workspace `strictEnv` setting for this target. When truthy, the target fails if its command references an env var that resolves to neither the task's effective env nor `process.env`. When `false`, the target opts out of a workspace `strictEnv: true` (e.g. for a one-off command that legitimately tolerates an unset variable)."
+                },
+                "timeout": {
+                    "type": "number",
+                    "description": "Maximum wall-clock milliseconds a single task run is allowed to take before being killed. `0` / `undefined` means no timeout.\n\nWhen the timeout fires the task is sent SIGTERM and, if it has not exited within `killGracePeriodMs`, SIGKILL. The task exits with a failure status carrying the `[timeout]` marker in `terminalOutput`. Retries count per-attempt, not cumulatively.\n\nUse this to prevent runaway tasks from eating CI wall-clock time up to the job-level cutoff."
+                },
+                "unixShell": {
+                    "type": "string",
+                    "description": "Per-target unix shell override, used on Linux and macOS. Takes precedence over `shell` on unix-like systems."
+                },
+                "windowsShell": {
+                    "type": "string",
+                    "description": "Per-target windows shell override, used on Windows. Takes precedence over `shell` on Windows."
                 }
-            }
+            },
+            "additionalProperties": false,
+            "description": "Vis-specific target options that extend the task-runner's base `TargetConfiguration`. These live under `target.options` and are interpreted by vis before handing the task off to task-runner.\n\nConditional execution (`when:`) and finally tasks (`always:`) live at the target top level, not under `options` — they're handled by the task-runner orchestrator. See `@visulima/task-runner`'s `WhenCondition`."
         },
-        "update": {
+        "AffectedFilesMode": {
+            "type": [
+                "string",
+                "boolean"
+            ],
+            "enum": [
+                "args",
+                "both",
+                "env",
+                false
+            ],
+            "description": "Controls how affected files are forwarded to a task.\n- `false` (default): Do not forward.\n- `\"args\"`: Append affected paths as additional command arguments.\n- `\"env\"`: Expose them via `VIS_AFFECTED_FILES` environment variable.\n- `\"both\"`: Both of the above."
+        },
+        "TargetPreset": {
+            "type": "string",
+            "enum": [
+                "server",
+                "utility"
+            ],
+            "description": "Preset bundles of target options.\n- `server`: Long-running local dev server — caching off, not in CI,   interactive, persistent.\n- `utility`: Short-lived helper — caching off, not in CI."
+        },
+        "RunInCI": {
+            "anyOf": [
+                {
+                    "type": "string",
+                    "const": "affected"
+                },
+                {
+                    "type": "string",
+                    "const": "always"
+                },
+                {
+                    "type": "boolean"
+                }
+            ],
+            "description": "Controls whether a target runs in CI.\n- `true` (default): Always run.\n- `false`: Never run in CI (local-only).\n- `\"affected\"`: Only when the project is affected by the current change set.\n- `\"always\"`: Always run, even if unaffected."
+        },
+        "ServiceConfig": {
             "type": "object",
-            "description": "Defaults for vis check and vis update commands.",
-            "additionalProperties": false,
             "properties": {
-                "depFields": { "type": "array", "items": { "type": "string" } },
-                "exclude": { "type": "array", "items": { "type": "string" } },
-                "format": { "type": "string", "enum": ["table", "json", "minimal"] },
-                "ignore": { "type": "array", "items": { "type": "string" } },
-                "include": { "type": "array", "items": { "type": "string" } },
-                "includeLocked": { "type": "boolean", "default": false },
-                "install": { "type": "boolean" },
-                "minimumReleaseAge": { "type": "number" },
-                "minimumReleaseAgeExclude": { "type": "array", "items": { "type": "string" } },
-                "packageMode": {
+                "env": {
                     "type": "object",
-                    "additionalProperties": { "type": "string", "enum": ["latest", "minor", "patch"] }
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "Env vars to expose to dependent tasks when this service is registered. Merged into the dependent task's env after the task's own envFile and before the task's explicit `env` overrides — the dependent task wins on key collisions.\n\nNote: only this `env` map propagates to dependents. The service target's own `envFile` is loaded into the **service process** at start time but is *not* forwarded — dependents must declare any shared values they need either here or in their own envFile. This boundary is intentional: envFiles often contain operator-only secrets (deploy keys, admin tokens) that should not leak into downstream test commands."
+                },
+                "killGracePeriodMs": {
+                    "type": "number",
+                    "description": "Grace period in milliseconds between SIGTERM and SIGKILL when the service is stopped.",
+                    "default": 5000
                 },
-                "prerelease": { "type": "boolean" },
-                "security": { "type": "boolean" },
-                "target": { "type": "string", "enum": ["latest", "minor", "patch"] }
-            }
+                "port": {
+                    "type": "number",
+                    "description": "Optional port the service listens on. Used as the default for `readiness.tcp.port` when no explicit probe is configured, and surfaced by `vis service list`."
+                },
+                "readiness": {
+                    "type": "object",
+                    "properties": {
+                        "tcp": {
+                            "type": "object",
+                            "properties": {
+                                "host": {
+                                    "type": "string"
+                                },
+                                "port": {
+                                    "type": "number"
+                                },
+                                "timeoutMs": {
+                                    "type": "number"
+                                }
+                            },
+                            "required": [
+                                "port"
+                            ],
+                            "additionalProperties": false
+                        }
+                    },
+                    "required": [
+                        "tcp"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Readiness probe configuration. v1 supports TCP only."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Configuration block declared on a target to mark it as a long-lived \"service\" — eligible to be started/stopped via `vis service` and auto-attached when other tasks depend on it.\n\nTargets must also carry `preset: \"server\"` (or the equivalent `persistent: true`) for the service-mode lifecycle to apply."
         },
-        "versionConstraint": {
+        "TargetType": {
             "type": "string",
-            "description": "Minimum vis CLI version required. Accepts semver ranges (e.g. \">=1.0.0\", \"^1.2.0\")."
+            "enum": [
+                "build",
+                "run",
+                "test"
+            ],
+            "description": "Semantic classification for a target.\n- `build`: Generates one or more artifacts; cached by default.\n- `test`: Validation task (lint, typecheck, unit test). Default type.\n- `run`: One-off or long-running process. Not cached by default."
+        },
+        "TaskDefaultsBlock": {
+            "type": "object",
+            "properties": {
+                "scope": {
+                    "$ref": "#/$defs/TaskDefaultsScope",
+                    "description": "Optional scope predicate; if omitted, the block applies universally."
+                },
+                "targets": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "object",
+                        "properties": {
+                            "aliases": {
+                                "type": "array",
+                                "items": {
+                                    "type": "string"
+                                },
+                                "description": "Alternate names that resolve to this target on the CLI. Useful for shortening long canonical names (`test` ↔ `t`) or for offering migration-friendly aliases when renaming targets. Aliases must be globally unique within the workspace."
+                            },
+                            "description": {
+                                "type": "string",
+                                "description": "One-line description surfaced by `vis list` and (in future) per-task `--help`. Kept short — longer docs belong in project READMEs or vis.config.ts comments."
+                            },
+                            "inferred": {
+                                "type": "boolean",
+                                "description": "True when the target was synthesized by a Project Crystal-style detector (see  {@link  ../inference } ) rather than declared by a package.json script, project.json, or vis.task.ts file. Surfaced by `vis list --inferred` and used by tooling to distinguish implicit defaults from explicit user intent."
+                            },
+                            "options": {
+                                "$ref": "#/$defs/VisTargetOptions",
+                                "description": "Vis-specific target options."
+                            },
+                            "preset": {
+                                "$ref": "#/$defs/TargetPreset",
+                                "description": "Preset applied before user-specified options."
+                            },
+                            "type": {
+                                "$ref": "#/$defs/TargetType",
+                                "description": "Semantic task type. Affects caching defaults and CI filtering.",
+                                "default": "test"
+                            },
+                            "always": {
+                                "type": "boolean",
+                                "description": "When `true`, this target runs after the main task graph completes — even if upstream tasks failed. Useful for cleanup, teardown, notifications, or anything that should fire regardless of build outcome. Always-tasks are not part of the normal dependency graph and never block other tasks."
+                            },
+                            "cache": {
+                                "type": "boolean",
+                                "description": "Whether this target is cacheable"
+                            },
+                            "cacheOnWarning": {
+                                "type": "boolean",
+                                "description": "When `false`, exit-0 runs whose terminal output matched any  {@link  TargetConfiguration.warningPattern }  are not seeded into the cache. Defaults to `true` — warnings are surfaced on the result (`hadWarnings: true`) but caching still happens, matching the \"succeeded with warnings is incremental\" behaviour rush, lage and wireit users have repeatedly asked for."
+                            },
+                            "cacheRestore": {
+                                "type": "object",
+                                "properties": {
+                                    "preserveMtime": {
+                                        "type": "boolean",
+                                        "description": "Restore each file's modification time from the captured tar header (second precision). When `false`, restored files take the current wall-clock time, matching the legacy behaviour."
+                                    },
+                                    "preservePerms": {
+                                        "type": "boolean",
+                                        "description": "Restore each file's POSIX mode bits (rwx triplets, low 12 bits). When `false`, restored files take the process umask. Only meaningful on POSIX hosts; Windows ignores tar mode."
+                                    }
+                                },
+                                "additionalProperties": false,
+                                "description": "Fine-grained controls over how cached outputs are rehydrated. See  {@link  CacheRestoreOptions } . Both fields default to `true` (faithful restore); flip individually when downstream tooling needs the legacy \"now\"-stamped behaviour."
+                            },
+                            "command": {
+                                "type": "string",
+                                "description": "The command to run (alternative to executor)"
+                            },
+                            "configurations": {
+                                "type": "object",
+                                "additionalProperties": {
+                                    "type": "object",
+                                    "additionalProperties": {}
+                                },
+                                "description": "Named configurations (e.g., \"production\", \"development\")"
+                            },
+                            "dependsOn": {
+                                "type": "array",
+                                "items": {
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "dependencies": {
+                                                    "type": "boolean",
+                                                    "description": "Whether this is a dependency on the same project"
+                                                },
+                                                "params": {
+                                                    "type": "string",
+                                                    "enum": [
+                                                        "forward",
+                                                        "ignore"
+                                                    ],
+                                                    "description": "Params to pass through"
+                                                },
+                                                "projects": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "string"
+                                                        },
+                                                        {
+                                                            "type": "array",
+                                                            "items": {
+                                                                "type": "string"
+                                                            }
+                                                        }
+                                                    ],
+                                                    "description": "The project name (if different from the current project)"
+                                                },
+                                                "target": {
+                                                    "type": "string",
+                                                    "description": "The target name"
+                                                }
+                                            },
+                                            "required": [
+                                                "target"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "Defines a dependency on another target."
+                                        }
+                                    ]
+                                },
+                                "description": "Other targets this target depends on"
+                            },
+                            "executor": {
+                                "type": "string",
+                                "description": "The executor/command to run"
+                            },
+                            "inputs": {
+                                "type": "array",
+                                "items": {
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "anyOf": [
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "fileset": {
+                                                            "anyOf": [
+                                                                {
+                                                                    "type": "object",
+                                                                    "properties": {
+                                                                        "base": {
+                                                                            "type": "string",
+                                                                            "enum": [
+                                                                                "package",
+                                                                                "workspace"
+                                                                            ],
+                                                                            "description": "Anchor for the pattern."
+                                                                        },
+                                                                        "pattern": {
+                                                                            "type": "string",
+                                                                            "description": "Glob pattern (may start with `!` for negation)."
+                                                                        }
+                                                                    },
+                                                                    "required": [
+                                                                        "base",
+                                                                        "pattern"
+                                                                    ],
+                                                                    "additionalProperties": false,
+                                                                    "description": "Object form of a fileset pattern, for anchoring to the workspace root."
+                                                                },
+                                                                {
+                                                                    "type": "string"
+                                                                }
+                                                            ]
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "fileset"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on file patterns.\n\n`fileset` may be a bare glob string (package-root relative) or an object form `{ pattern, base }` to anchor explicitly to the workspace root. Negation (`!` prefix) works in both forms."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "runtime": {
+                                                            "type": "string"
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "runtime"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on a runtime command."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "env": {
+                                                            "type": "string"
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "env"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on environment variables."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "externalDependencies": {
+                                                            "type": "array",
+                                                            "items": {
+                                                                "type": "string"
+                                                            }
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "externalDependencies"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on external dependency versions."
+                                                }
+                                            ],
+                                            "description": "Defines an input for cache invalidation."
+                                        }
+                                    ]
+                                },
+                                "description": "Input patterns for cache invalidation"
+                            },
+                            "outputs": {
+                                "type": "array",
+                                "items": {
+                                    "type": "string"
+                                },
+                                "description": "Output patterns produced by this target"
+                            },
+                            "parallelism": {
+                                "type": "boolean",
+                                "description": "Whether this target supports parallel execution"
+                            },
+                            "warningPattern": {
+                                "anyOf": [
+                                    {
+                                        "type": "string"
+                                    },
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    }
+                                ],
+                                "description": "Regex source string(s) that mark a successful task as having emitted warnings. The orchestrator scans the task's combined terminal output after a 0-exit and, on first match, sets `hadWarnings` on the result. Combine with `cacheOnWarning: false` to skip caching for warning-tainted runs. Both bare strings and arrays are accepted; arrays are tested in order.\n\n  ```ts   warningPattern: [\"\\\\bwarning\\\\b\", \"TS\\\\d{4}\"]   ```"
+                            },
+                            "when": {
+                                "type": "object",
+                                "properties": {
+                                    "branch": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string"
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string"
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match against the current git branch (HEAD)."
+                                    },
+                                    "ci": {
+                                        "type": "boolean",
+                                        "description": "Run only when invoked inside CI when `true`, only outside CI when `false`. Detects CI via the `CI` env var (the convention GitHub Actions, GitLab, CircleCI, Jenkins, etc. all share)."
+                                    },
+                                    "env": {
+                                        "anyOf": [
+                                            {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string"
+                                                    },
+                                                    {
+                                                        "type": "object",
+                                                        "properties": {
+                                                            "equals": {
+                                                                "type": "string",
+                                                                "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                            },
+                                                            "exists": {
+                                                                "type": "boolean",
+                                                                "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                            },
+                                                            "name": {
+                                                                "type": "string",
+                                                                "description": "Variable name."
+                                                            }
+                                                        },
+                                                        "required": [
+                                                            "name"
+                                                        ],
+                                                        "additionalProperties": false
+                                                    }
+                                                ],
+                                                "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "string"
+                                                        },
+                                                        {
+                                                            "type": "object",
+                                                            "properties": {
+                                                                "equals": {
+                                                                    "type": "string",
+                                                                    "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                },
+                                                                "exists": {
+                                                                    "type": "boolean",
+                                                                    "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                },
+                                                                "name": {
+                                                                    "type": "string",
+                                                                    "description": "Variable name."
+                                                                }
+                                                            },
+                                                            "required": [
+                                                                "name"
+                                                            ],
+                                                            "additionalProperties": false
+                                                        }
+                                                    ],
+                                                    "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match against environment variables. A bare string asserts the variable is set and non-empty; the object form lets you match an exact value or just assert presence/absence."
+                                    },
+                                    "not": {
+                                        "type": "object",
+                                        "properties": {
+                                            "branch": {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string"
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "type": "string"
+                                                        }
+                                                    }
+                                                ]
+                                            },
+                                            "ci": {
+                                                "type": "boolean"
+                                            },
+                                            "env": {
+                                                "anyOf": [
+                                                    {
+                                                        "anyOf": [
+                                                            {
+                                                                "type": "string"
+                                                            },
+                                                            {
+                                                                "type": "object",
+                                                                "properties": {
+                                                                    "equals": {
+                                                                        "type": "string",
+                                                                        "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                    },
+                                                                    "exists": {
+                                                                        "type": "boolean",
+                                                                        "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                    },
+                                                                    "name": {
+                                                                        "type": "string",
+                                                                        "description": "Variable name."
+                                                                    }
+                                                                },
+                                                                "required": [
+                                                                    "name"
+                                                                ],
+                                                                "additionalProperties": false
+                                                            }
+                                                        ],
+                                                        "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "anyOf": [
+                                                                {
+                                                                    "type": "string"
+                                                                },
+                                                                {
+                                                                    "type": "object",
+                                                                    "properties": {
+                                                                        "equals": {
+                                                                            "type": "string",
+                                                                            "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                        },
+                                                                        "exists": {
+                                                                            "type": "boolean",
+                                                                            "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                        },
+                                                                        "name": {
+                                                                            "type": "string",
+                                                                            "description": "Variable name."
+                                                                        }
+                                                                    },
+                                                                    "required": [
+                                                                        "name"
+                                                                    ],
+                                                                    "additionalProperties": false
+                                                                }
+                                                            ],
+                                                            "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                        }
+                                                    }
+                                                ]
+                                            },
+                                            "os": {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string",
+                                                        "enum": [
+                                                            "aix",
+                                                            "darwin",
+                                                            "freebsd",
+                                                            "linux",
+                                                            "openbsd",
+                                                            "sunos",
+                                                            "windows",
+                                                            "win32"
+                                                        ],
+                                                        "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "type": "string",
+                                                            "enum": [
+                                                                "aix",
+                                                                "darwin",
+                                                                "freebsd",
+                                                                "linux",
+                                                                "openbsd",
+                                                                "sunos",
+                                                                "windows",
+                                                                "win32"
+                                                            ],
+                                                            "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                        }
+                                                    }
+                                                ]
+                                            }
+                                        },
+                                        "additionalProperties": false,
+                                        "description": "Negative mirrors. A task runs only when *all* `not.*` clauses fail."
+                                    },
+                                    "os": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string",
+                                                "enum": [
+                                                    "aix",
+                                                    "darwin",
+                                                    "freebsd",
+                                                    "linux",
+                                                    "openbsd",
+                                                    "sunos",
+                                                    "windows",
+                                                    "win32"
+                                                ],
+                                                "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string",
+                                                    "enum": [
+                                                        "aix",
+                                                        "darwin",
+                                                        "freebsd",
+                                                        "linux",
+                                                        "openbsd",
+                                                        "sunos",
+                                                        "windows",
+                                                        "win32"
+                                                    ],
+                                                    "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match `process.platform` (`\"linux\" | \"darwin\" | \"win32\" | \"freebsd\" | \"openbsd\" | \"sunos\" | \"aix\"`). Pass `\"windows\"` as an alias for `\"win32\"` — easier to remember and matches what people type."
+                                    }
+                                },
+                                "additionalProperties": false,
+                                "description": "Predicate that gates execution. When the condition evaluates to `false` for the current environment, the task is skipped (marked `\"skipped\"`, not failed). Combine with `os`, `env`, `branch`, and `ci` clauses for granular control:\n\n  ```ts   when: { os: \"linux\", ci: true, env: \"DEPLOY_TOKEN\" }   ```"
+                            }
+                        },
+                        "additionalProperties": false
+                    },
+                    "description": "Target default configurations."
+                }
+            },
+            "required": [
+                "targets"
+            ],
+            "additionalProperties": false,
+            "description": "A single task-defaults block — a set of target defaults gated by an optional scope predicate."
+        },
+        "TaskDefaultsScope": {
+            "type": "object",
+            "properties": {
+                "language": {
+                    "anyOf": [
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    ],
+                    "description": "Match on primary language."
+                },
+                "layer": {
+                    "anyOf": [
+                        {
+                            "type": "string",
+                            "enum": [
+                                "application",
+                                "automation",
+                                "configuration",
+                                "library",
+                                "scaffolding",
+                                "tool"
+                            ],
+                            "description": "Project layer, used for constraint inheritance and query filtering."
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "anyOf": [
+                                    {
+                                        "type": "string",
+                                        "const": "application"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "automation"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "configuration"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "library"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "scaffolding"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "tool"
+                                    },
+                                    {
+                                        "not": {}
+                                    }
+                                ],
+                                "description": "Project layer, used for constraint inheritance and query filtering."
+                            }
+                        }
+                    ],
+                    "description": "Match on project layer."
+                },
+                "projectType": {
+                    "type": "string",
+                    "enum": [
+                        "application",
+                        "library"
+                    ],
+                    "description": "Match on project type."
+                },
+                "stack": {
+                    "anyOf": [
+                        {
+                            "type": "string",
+                            "enum": [
+                                "backend",
+                                "data",
+                                "frontend",
+                                "infrastructure",
+                                "systems"
+                            ],
+                            "description": "Tech stack."
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "anyOf": [
+                                    {
+                                        "type": "string",
+                                        "const": "backend"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "data"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "frontend"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "infrastructure"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "systems"
+                                    },
+                                    {
+                                        "not": {}
+                                    }
+                                ],
+                                "description": "Tech stack."
+                            }
+                        }
+                    ],
+                    "description": "Match on project stack."
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Match projects tagged with any of these tags."
+                }
+            },
+            "additionalProperties": false,
+            "description": "A scope predicate used by  {@link  VisConfig.taskDefaults } . All listed constraints must match for the block to apply."
         }
     }
 }