@visulima/vis 1.0.0-alpha.2 → 1.0.0-alpha.20

package/schemas/vis-config.schema.json

@@ -0,0 +1,4306 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://visulima.com/schemas/vis-config.schema.json",
+    "title": "vis.config.ts",
+    "description": "Workspace configuration for @visulima/vis. Used by defineConfig() in vis.config.ts. This schema is for non-TypeScript editors; TypeScript users get autocomplete from defineConfig() types.",
+    "type": "object",
+    "properties": {
+        "ai": {
+            "type": "object",
+            "properties": {
+                "cacheTtl": {
+                    "type": "number",
+                    "description": "Cache TTL in milliseconds. Overrides default (1h / 30min for security)."
+                },
+                "priority": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "number"
+                    },
+                    "description": "Override default provider priority. Higher number = preferred."
+                },
+                "provider": {
+                    "type": "string",
+                    "description": "Use a specific provider instead of auto-detecting (e.g., `\"claude\"`, `\"gemini\"`)."
+                }
+            },
+            "additionalProperties": false,
+            "description": "AI analysis configuration"
+        },
+        "branchScopedCache": {
+            "type": "boolean",
+            "description": "Scope the task-runner cache directory by the current git branch. When `true`, caches are stored under `<cacheDir>/branches/<slug>` so `main` and feature branches stop thrashing each other — generated artefacts (schemas, `.d.ts` snapshots) that legitimately differ across branches no longer oscillate the cache contents.\n\nFalls back to the unscoped path on detached HEAD, non-git workspaces, or when git isn't available.",
+            "default": false
+        },
+        "codeowners": {
+            "$ref": "#/$defs/CodeownersConfig",
+            "description": "Code ownership configuration. Controls how `vis sync codeowners` renders the generated CODEOWNERS file."
+        },
+        "constraints": {
+            "type": "object",
+            "properties": {
+                "dependencyKindRules": {
+                    "type": "object",
+                    "properties": {
+                        "noDevDependencyOnProductionDep": {
+                            "type": "boolean",
+                            "description": "When true, a \"library\" project must not have workspace-internal devDependencies on other libraries that are also in its production dependencies. Prevents publishing libraries that silently rely on dev-only workspace packages.",
+                            "default": false
+                        },
+                        "noProductionDependencyOnApplication": {
+                            "type": "boolean",
+                            "description": "When true, production `dependencies` must not point to deployment-target projects — `application`, `service`, or `tool`. devDependencies on those are allowed (e.g., for testing).",
+                            "default": false
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Rules based on the dependency kind (static vs devDependency vs peerDependency)"
+                },
+                "enforceLayerRelationships": {
+                    "type": "boolean",
+                    "description": "When true, projects can only depend on projects at the same or lower layer in the hierarchy:\n\n  configuration < library < scaffolding < tool < automation < application\n\nProjects without an explicit `layer` are unconstrained.",
+                    "default": false
+                },
+                "tagRelationships": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        }
+                    },
+                    "description": "Tag-based dependency rules"
+                },
+                "typeBoundaries": {
+                    "type": "object",
+                    "properties": {
+                        "allowedDependencyTypes": {
+                            "type": "object",
+                            "additionalProperties": {
+                                "type": "array",
+                                "items": {
+                                    "type": "string"
+                                }
+                            },
+                            "description": "Custom rules mapping project types to allowed dependency types. Example: `{ \"application\": [\"library\"] }` means applications can only depend on libraries."
+                        },
+                        "enforceApplicationBoundary": {
+                            "type": "boolean",
+                            "description": "When true, no project may depend on a deployment target — projects of type `application`, `service`, or `tool`. Deployment targets are standalone artefacts, not reusable libraries.",
+                            "default": true
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Project-type-based dependency rules"
+                }
+            },
+            "additionalProperties": false,
+            "description": "Project dependency constraints. Enforced after building the project graph, before running tasks."
+        },
+        "create": {
+            "type": "object",
+            "properties": {
+                "auth": {
+                    "type": "string",
+                    "description": "Authorization token for downloading private repository templates. Passed as Bearer token to the git host API. Can also be set via GIGET_AUTH, GITHUB_TOKEN, or GH_TOKEN environment variables."
+                },
+                "defaultEditor": {
+                    "type": "string",
+                    "const": "vscode",
+                    "description": "Default editor to configure after scaffolding. When set, `vis create` automatically generates editor config files.",
+                    "examples": [
+                        "vscode"
+                    ]
+                },
+                "defaultPm": {
+                    "type": "string",
+                    "enum": [
+                        "bun",
+                        "npm",
+                        "pnpm",
+                        "yarn"
+                    ],
+                    "description": "Default package manager for new standalone projects. When set, skips the PM selection prompt in interactive mode."
+                },
+                "defaultProvider": {
+                    "type": "string",
+                    "enum": [
+                        "bitbucket",
+                        "github",
+                        "gitlab",
+                        "sourcehut"
+                    ],
+                    "description": "Default giget provider for `owner/repo` shorthand inputs.",
+                    "default": "github"
+                },
+                "gitInit": {
+                    "type": "boolean",
+                    "description": "Initialize a git repository after scaffolding standalone projects.",
+                    "default": false
+                },
+                "install": {
+                    "type": "boolean",
+                    "description": "Install dependencies automatically after scaffolding.",
+                    "default": true
+                },
+                "preferOffline": {
+                    "type": "boolean",
+                    "description": "Prefer locally cached templates over re-downloading. Useful for offline development or slow connections.",
+                    "default": false
+                },
+                "registry": {
+                    "anyOf": [
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "boolean",
+                            "const": false
+                        }
+                    ],
+                    "description": "Custom template registry URL. When set, giget checks this registry for template metadata before falling back to direct provider resolution. Set to `false` to disable registry lookup entirely."
+                },
+                "templates": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "Named template aliases for quick access. Maps short names to full giget source strings."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Configuration for the `vis create` scaffolding command. Controls template downloads (via giget), default options, and post-creation behavior."
+        },
+        "editorconfig": {
+            "type": "boolean",
+            "description": "Discover `.editorconfig` for indent / line-ending defaults during file transformations (sort-package-json, migrate, hook, pm overrides, workspace catalog rewrites). Per-command flags can still override.",
+            "default": true
+        },
+        "extends": {
+            "anyOf": [
+                {
+                    "type": "string"
+                },
+                {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            ],
+            "description": "Inherit configuration from one or more parent configs. Entries are resolved left-to-right (later wins) and the consumer's own values always override anything pulled in from `extends`.\n\nEach entry is either:\n- a relative path (`./shared.config.ts`, `../shared.config.ts`) —   resolved against the file declaring `extends`;\n- an npm package name (`@acme/vis-preset`) — resolved via Node.js   module resolution from the consumer file.\n\nAbsolute paths are rejected — they break across machines and CI. Cycles raise `VisConfigCycleError` during load."
+        },
+        "fileGroups": {
+            "type": "object",
+            "additionalProperties": {
+                "type": "array",
+                "items": {
+                    "type": "string"
+                }
+            },
+            "description": "Named file-group patterns, reusable from target `inputs` via the `@filegroup:&lt;name>` token. File groups are resolved relative to each project root at discovery time."
+        },
+        "generator": {
+            "type": "object",
+            "properties": {
+                "auth": {
+                    "type": "string",
+                    "description": "Authorization token forwarded to giget when fetching `git://`/`npm://` remote templates. Falls back to `GIGET_AUTH` / `GITHUB_TOKEN` / `GH_TOKEN` env vars."
+                },
+                "preferOffline": {
+                    "type": "boolean",
+                    "description": "Prefer locally cached remote templates over re-downloading. Overridable per invocation via `--prefer-offline`.",
+                    "default": false
+                },
+                "templates": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Extra directories to scan for templates. Each directory is checked for both native templates (`&lt;name>.ts`) and moon-format directories (containing `template.yml`)."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Configuration for the `vis generate` in-repo scaffolding command. Points at additional template directories beyond the defaults (`.vis/templates/` and `.moon/templates/`)."
+        },
+        "inferTargets": {
+            "anyOf": [
+                {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "boolean"
+                    }
+                },
+                {
+                    "type": "boolean"
+                }
+            ],
+            "description": "Auto-create targets from detected config files (Project Crystal-style). Inferred targets sit *below* explicit ones — anything in `package.json#scripts`, `project.json#targets`, or `vis.task.ts` wins per-key, so opting in never overrides existing setups.\n\nBuilt-in detectors and the targets they synthesize:\n\n- **App frameworks** — `nuxt` (build/dev/preview/generate),   `next` (build/dev/start), `remix` (build/dev/start), `astro`   (build/dev), `gatsby` (build/develop/serve), `docusaurus`   (build/start/serve).\n- **Bundlers** — `vite` (build/dev/preview), `rolldown` (build),   `tsdown` (build), `tsup` (build), `packem` (build), `rollup`   (build), `webpack` (build).\n- **Docs sites** — `vitepress` (docs:build/docs:dev/docs:preview),   `typedoc` (docs).\n- **Server frameworks** — `nest` (build/start/start:dev).\n- **Test runners** — `vitest` (test/test:watch), `jest`   (test/test:watch), `bun` (test), `playwright` (test:e2e),   `cypress` (test:e2e/cypress:open).\n- **Stories** — `storybook` (storybook/build-storybook).\n- **Type checking** — `typescript` (typecheck via `tsc --noEmit`).\n- **Lint / format** — `eslint` (lint), `prettier` (format /   format:check), `biome` (lint, format), `oxlint` (lint),   `oxfmt` (format / format:check), `stylelint` (lint:css),   `knip` (knip).\n- **Runtimes** — `deno` (test/lint/fmt/check).\n- **Database tooling** — `prisma` (db:generate/db:migrate/   db:push/db:studio), `drizzle` (db:generate/db:migrate/   db:push/db:studio).\n- **Codegen / release** — `graphql-codegen` (codegen),   `api-extractor` (api-extract), `changeset` (changeset:version /   changeset:publish / changeset:status).\n\nTrigger: presence of any matching config file in the project root. Most detectors additionally match when their framework appears in `dependencies` / `devDependencies` / `peerDependencies` / `optionalDependencies` — covering convention-only setups (e.g. vitest with default config). Detectors that intentionally require a config file (because the package frequently appears transitively and a dep-only match would synthesize broken commands): `vite`, `rolldown`, `rollup`, `webpack`, `storybook`, `nest`, `remix`, `vitepress`, `bun`, `deno`, `changeset`.\n\nConflict resolution: detectors are evaluated in registration order (see `BUILT_IN_DETECTORS`) and the first to claim a target name wins. Per-name priorities: `build` → nuxt > next > remix > astro > gatsby > docusaurus > vite > nest > rolldown > tsdown > tsup > packem > rollup > webpack; `test` → vitest > jest > bun > deno; `test:e2e` → playwright > cypress; `lint` → eslint > biome > oxlint > deno; `format` → prettier > biome > oxfmt; `db:*` → prisma > drizzle.\n\nAlso accepts an object form (`{ vite: false, vitest: true }`) to opt individual detectors in or out by name. Detectors omitted from the object run at their default (enabled). Useful when one detector misfires for a given workspace without disabling the rest.",
+            "default": false
+        },
+        "install": {
+            "type": "object",
+            "properties": {
+                "backend": {
+                    "type": "string",
+                    "enum": [
+                        "aube",
+                        "auto",
+                        "bun",
+                        "npm",
+                        "pnpm",
+                        "yarn"
+                    ],
+                    "description": "Which package manager performs install/add/remove/etc.\n- `auto` (default): use `aube` when it is on PATH; otherwise   fall back to the lockfile-detected PM.\n- explicit name: always use that PM. Errors when the named   binary is missing rather than silently falling back.",
+                    "default": "auto"
+                },
+                "corepack": {
+                    "anyOf": [
+                        {
+                            "type": "string",
+                            "const": "auto"
+                        },
+                        {
+                            "type": "boolean"
+                        }
+                    ],
+                    "description": "Whether to dispatch PM invocations through `corepack`.\n- `\"auto\"` (default): use corepack only when the workspace   pins a PM via the `packageManager` field AND `corepack` is   on PATH AND the PM is one corepack manages (pnpm/yarn/npm).\n- `true`: always prefix `corepack` when the binary is on PATH   and the PM is corepack-managed (errors loudly otherwise).\n- `false`: never go through corepack — invoke the PM directly.\n\nMirrors nypm's `corepack: true` flag. Bun, deno, and aube are never wrapped — corepack does not manage them.",
+                    "default": "auto"
+                }
+            },
+            "additionalProperties": false,
+            "description": "Installer backend selection for `vis install` / `vis add` / `vis remove` / `vis update` / `vis ci`.\n\nLets users opt into [aube](https://github.com/endevco/aube) — a Rust-native package manager that reads/writes pnpm/npm/yarn/bun lockfiles in place — as the default installer, while keeping a single switch to fall back to the conventional PM detected from the lockfile.\n\nResolution precedence (highest first): 1. CLI flag (`--installer &lt;name>` / `--no-aube`) 2. Env var `VIS_INSTALLER` 3. This config field 4. Auto-detect (the default)\n\nAube must be installed separately — `vis` does not bundle it. Install via npm (`@endevco/aube`), `mise use -g aube`, or `brew install endevco/tap/aube`."
+        },
+        "mcpPromote": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean",
+                    "description": "Show the vis-mcp promotion notice on successful command completion.",
+                    "default": true
+                }
+            },
+            "additionalProperties": false,
+            "description": "`vis-mcp` promotion notice shown after successful commands when an AI CLI (Claude Code, Cursor, Windsurf, Continue, Zed, Cline) is installed but `@visulima/vis-mcp` is not wired into its config.\n\nShown at most once every 14 days; skipped in CI, non-TTY shells, during `--help`/`--version`/`ai`/`mcp` invocations, and when `VIS_NO_MCP_PROMOTE=1` is set. Set `enabled: false` to silence permanently for this workspace."
+        },
+        "namedInputs": {
+            "type": "object",
+            "additionalProperties": {
+                "type": "array",
+                "items": {
+                    "anyOf": [
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "anyOf": [
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "fileset": {
+                                            "anyOf": [
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "base": {
+                                                            "type": "string",
+                                                            "enum": [
+                                                                "package",
+                                                                "workspace"
+                                                            ],
+                                                            "description": "Anchor for the pattern."
+                                                        },
+                                                        "pattern": {
+                                                            "type": "string",
+                                                            "description": "Glob pattern (may start with `!` for negation)."
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "base",
+                                                        "pattern"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "Object form of a fileset pattern, for anchoring to the workspace root."
+                                                },
+                                                {
+                                                    "type": "string"
+                                                }
+                                            ]
+                                        }
+                                    },
+                                    "required": [
+                                        "fileset"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "An input based on file patterns.\n\n`fileset` may be a bare glob string (package-root relative) or an object form `{ pattern, base }` to anchor explicitly to the workspace root. Negation (`!` prefix) works in both forms."
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "runtime": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "required": [
+                                        "runtime"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "An input based on a runtime command."
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "env": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "required": [
+                                        "env"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "An input based on environment variables."
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "externalDependencies": {
+                                            "type": "array",
+                                            "items": {
+                                                "type": "string"
+                                            }
+                                        }
+                                    },
+                                    "required": [
+                                        "externalDependencies"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "An input based on external dependency versions."
+                                }
+                            ],
+                            "description": "Defines an input for cache invalidation."
+                        }
+                    ]
+                }
+            },
+            "description": "Named input patterns inherited by every project target. Equivalent to task-runner's `namedInputs` but configurable from the vis config."
+        },
+        "overrides": {
+            "type": "object",
+            "additionalProperties": {
+                "type": "string"
+            },
+            "description": "Package override mappings applied during migration (e.g., `{ \"lodash\": \"lodash-es\" }`)"
+        },
+        "plugins": {
+            "type": "array",
+            "items": {
+                "$ref": "#/$defs/VisPlugin"
+            },
+            "description": "Plugins — each plugin registers typed hooks that fire at run / task / cache boundaries. See  {@link  VisPlugin }  for the contract. Prefer plugins over per-target shell hooks when behaviour needs access to task metadata, results, or cache state."
+        },
+        "policy": {
+            "type": "object",
+            "properties": {
+                "bannedDeps": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "anyOf": [
+                            {
+                                "type": "string"
+                            },
+                            {
+                                "type": "object",
+                                "properties": {
+                                    "packages": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "paths": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "reason": {
+                                        "type": "string"
+                                    },
+                                    "replacement": {
+                                        "type": "string"
+                                    }
+                                },
+                                "required": [
+                                    "reason"
+                                ],
+                                "additionalProperties": false
+                            }
+                        ]
+                    },
+                    "description": "Map of dep names or globs → reason (or `{ reason, replacement, packages?, paths? }`). Internal/workspace deps are never flagged here; the workspace-protocol lint owns those.\n\nOptional `packages` (globs over the declaring package's `name`) and `paths` (globs over the workspace-relative `packageDir`) narrow where the rule applies. With both set, either match is enough. Omit both to ban anywhere — the default."
+                },
+                "customTypes": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. See `workspaceProtocol.autofix` for the contract — same semantics, applied to drift rewrites across engines / packageManager / volta / devEngines.\n\nNote: `--fix` strips any `+sha512.&lt;hash&gt;` suffix from `packageManager` on bump — content-integrity hashes are tied to a specific package, not a version, so users must regenerate via their PM (`pnpm install` re-pins; `corepack use pnpm@X` etc.).",
+                            "default": true
+                        },
+                        "extraTypes": {
+                            "type": "array",
+                            "items": {
+                                "$ref": "#/$defs/ExtraCustomType"
+                            },
+                            "description": "User-defined custom-type pin locations. Each entry tells the customTypes lint to read additional version pins from a non-standard JSON path inside every workspace package.json, cluster them by `(name × depName)` like the built-in types, and rewrite them with `--fix`.\n\nThe original built-ins (`engines`, `volta`, `packageManager`, `devEngines.runtime`, `devEngines.packageManager`) keep running unconditionally — these layer on top.\n\nStrategies:\n- `versionsByName`: the JSON at `path` is `{ [depName]: version }`   (like `engines` or `pnpm.overrides`).\n- `name@version`: the JSON at `path` is a string of the form   `name@version` (like `packageManager`). The leading `name@`   is preserved; only the version segment is rewritten.\n- `string`: the JSON at `path` is a bare version string. The   `depName` field is required and identifies the dep cluster.\n\n`name` must not collide with a built-in type name. `path` is a dot-separated walk into the package.json (e.g. `pnpm.overrides`)."
+                        },
+                        "ignore": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Dep names exempt from the drift check (exact match against the field name within the block — e.g. `node`, `pnpm`)."
+                        },
+                        "resolve": {
+                            "type": "string",
+                            "enum": [
+                                "highest",
+                                "lowest"
+                            ],
+                            "description": "Resolution strategy used when `--fix` runs.\n- `highest` (default): align every drifting instance to the   highest declared version.\n- `lowest`: align to the lowest.",
+                            "default": "highest"
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the custom-types lint that flags drift in `engines.{node,pnpm,...}`, `packageManager`, `volta.{node,pnpm,yarn}`, and the proposed `devEngines.{runtime,packageManager}` array form.\n\nEach (customType × name) cluster is tracked independently — `engines.node` and `volta.node` don't cross-couple here. Use a versionGroup once that lands if you need to enforce they agree."
+                },
+                "deadWorkspacePatterns": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. See `workspaceProtocol.autofix` for the contract — applied here to dropping unmatched patterns from the workspace config file.",
+                            "default": true
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the dead-workspace-patterns lint that flags entries in `pnpm-workspace.yaml#packages` / `package.json#workspaces` which resolve to zero on-disk directories."
+                },
+                "emptyDeps": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. See `workspaceProtocol.autofix` for the contract — applied here to removing the empty key.",
+                            "default": true
+                        },
+                        "ignoreBlocks": {
+                            "type": "array",
+                            "items": {
+                                "type": "string",
+                                "enum": [
+                                    "dependencies",
+                                    "devDependencies",
+                                    "optionalDependencies",
+                                    "peerDependencies"
+                                ]
+                            },
+                            "description": "Block names exempt from the rule (e.g. `[\"peerDependencies\"]` to keep the key around as a marker even when empty)."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the empty-deps lint that flags empty `dependencies` / `devDependencies` / `peerDependencies` / `optionalDependencies` blocks across the workspace."
+                },
+                "redefineRoot": {
+                    "type": "object",
+                    "properties": {
+                        "ignore": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Dep names that are exempt from the redefine-root rule (exact match)."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the redefine-root lint that flags non-root packages duplicating deps already pinned at the workspace root."
+                },
+                "rootDeps": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. See `workspaceProtocol.autofix` for the contract — applied here to moving entries from `dependencies` to `devDependencies` on the root package.json.",
+                            "default": true
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the root-deps lint that flags runtime `dependencies` declared on the private workspace root (they should live in `devDependencies`)."
+                },
+                "rootPackageManager": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. See `workspaceProtocol.autofix` for the contract. `--fix` only writes when `suggested` is set — a missing `packageManager` field has no canonical default.",
+                            "default": true
+                        },
+                        "suggested": {
+                            "type": "string",
+                            "description": "Canonical specifier (`name@version`) to write when `--fix` runs and the field is absent. Required to enable autofix — vis won't guess the workspace's preferred manager.",
+                            "examples": [
+                                "pnpm@10.32.1"
+                            ]
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the root-package-manager lint that flags a missing or malformed `packageManager` field on the workspace root."
+                },
+                "rootPrivate": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. See `workspaceProtocol.autofix` for the contract — applied here to inserting `\"private\": true`.",
+                            "default": true
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the root-private lint that flags a workspace root package.json missing `\"private\": true`. Only fires when the root looks like a workspace (npm/yarn/bun `workspaces` field or `pnpm-workspace.yaml`)."
+                },
+                "similarDeps": {
+                    "type": "object",
+                    "properties": {
+                        "extraFamilies": {
+                            "type": "array",
+                            "items": {
+                                "$ref": "#/$defs/SimilarDepFamily"
+                            },
+                            "description": "Additional families merged with the built-ins. Same `id` wins → user override fully replaces the built-in entry."
+                        },
+                        "ignoreFamilies": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Family ids to skip entirely (matches `SimilarDepFamily.id`)."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the similar-deps lint that flags drift across related dep families (e.g. `react` and `react-dom`, all of `@babel/*`).\n\nThe lint is report-only — aligning a family requires picking a single canonical specifier across heterogeneous range syntaxes (`^`, `~`, exact), which is too lossy without user input."
+                },
+                "typesInDeps": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. See `workspaceProtocol.autofix` for the contract — applied here to moving the entry to `devDependencies`. Existing dev pins are preserved on conflict.",
+                            "default": true
+                        },
+                        "ignore": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Dep names exempt from the rule (exact match, e.g. `@types/node`)."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the types-in-deps lint that flags `@types/*` declared in `dependencies` on a private package (they belong in `devDependencies` since the package never ships)."
+                },
+                "workspaceProtocol": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. Some workspaces want detection without rewrite (e.g. dual-licensed packages where `workspace:*` is unsafe).\n- `true` (default): `--fix` rewrites the specifier.\n- `false`: never rewrite — report the violation only.\n- `\"prompt\"`: ask before each rewrite. Falls back to report-only   when stdin isn't a TTY (CI). Reserved; not yet implemented.\n\nNote: when `false` (or `\"prompt\"`), `--fix` still **fails CI** on detected violations — the rule is \"report only\", not \"ignore\". Drop the rule from the lint selection if you want a clean exit.",
+                            "default": true
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the workspace-protocol lint that flags internal deps not using the `workspace:` protocol."
+                },
+                "workspaceVersions": {
+                    "type": "object",
+                    "properties": {
+                        "autofix": {
+                            "anyOf": [
+                                {
+                                    "type": "string",
+                                    "const": "prompt"
+                                },
+                                {
+                                    "type": "boolean"
+                                }
+                            ],
+                            "description": "Three-state autofix opt-out. See `workspaceProtocol.autofix` for the contract — same semantics, applied to drift rewrites.\n\nAlso gates the `--propose-min` catalog suggestion writer: when `false` / `\"prompt\"`, `--fix --propose-min` reports the proposed catalog entries but does not write `pnpm-workspace.yaml`. Same \"report only, still fails CI\" note applies as on `workspaceProtocol.autofix`.",
+                            "default": true
+                        },
+                        "ignore": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Dep names exempt from the version-drift check (exact match)."
+                        },
+                        "resolve": {
+                            "type": "string",
+                            "enum": [
+                                "catalog",
+                                "highest",
+                                "lowest"
+                            ],
+                            "description": "Resolution strategy used when `--fix` runs.\n- `highest` (default): rewrite every drifting instance to the   highest sibling specifier.\n- `lowest`: rewrite to the lowest.\n- `catalog`: rewrite any dep already pinned in a workspace catalog   to `catalog:` / `catalog:&lt;name>`. Catalog must exist; this lint   does not create the catalog (see `vis lint --resolve catalog --propose`).",
+                            "default": "highest"
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Tweak the workspace-versions lint that flags external deps declared at inconsistent versions across the workspace."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Workspace dep-policy lints exposed via `vis lint`. Each block opts in to a single rule; the command flags (`--workspace-protocol`, `--no-redefine-root`, `--banned-deps`) toggle them per-run."
+        },
+        "preflight": {
+            "type": "object",
+            "properties": {
+                "lockfile": {
+                    "type": "boolean",
+                    "description": "Detect \"lockfile changed but `node_modules` is stale\" before running tasks. Compares lockfile mtime against the package-manager-specific install marker (`node_modules/.modules.yaml` for pnpm, `.package-lock.json` for npm, etc.). Warns in TTY, hard-fails in CI.",
+                    "default": true
+                }
+            },
+            "additionalProperties": false,
+            "description": "Pre-flight checks fired before `vis run` starts the orchestrator. Each check is opt-out (`false`) — defaults are sensible for the common monorepo case."
+        },
+        "run": {
+            "type": "object",
+            "properties": {
+                "ciGrouping": {
+                    "type": "string",
+                    "enum": [
+                        "auto",
+                        "azure",
+                        "buildkite",
+                        "github",
+                        "gitlab",
+                        "off"
+                    ],
+                    "description": "Wrap each task's CI log block in collapsible groups so users can fold/unfold per-task output in the host CI's web UI. Failed tasks always render expanded so the failure is visible without an extra click.\n\n- `auto` (default): pick the format from the detected runner —   `GITHUB_ACTIONS=true` → `github` (`::group::`),   `GITLAB_CI=true` → `gitlab` (`section_start:` ANSI sequences),   `BUILDKITE=true` → `buildkite` (`---` collapsed headers),   `TF_BUILD=True` → `azure` (`##[group]`),   no grouping otherwise.\n- `off`: never group (raw separators only — useful when   piping through tools that mangle the directives).\n- `azure` / `buildkite` / `github` / `gitlab`: force the format   regardless of detected environment (useful for self-hosted   runners that don't set the standard env vars).\n\nCircleCI is intentionally not auto-detected: its 2.0+ format has no inline grouping directive — steps auto-group in the web UI without any markup from the runner."
+                },
+                "services": {
+                    "type": "string",
+                    "enum": [
+                        "auto",
+                        "ephemeral",
+                        "off",
+                        "persistent"
+                    ],
+                    "description": "One knob controlling auto-start of missing service deps.\n- `auto` (default in TTY): pick by task — `dev` → ephemeral,   others → persistent.\n- `ephemeral`: services die with the run (no registry entry).\n- `persistent`: services persist across runs in the registry.\n- `off` (default in CI / non-TTY): print diagnostics and abort."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Behavior of `vis run` when invoked tasks declare service dependencies that aren't running in the workspace registry. CLI `--services=&lt;mode>` overrides this block."
+        },
+        "secrets": {
+            "type": "object",
+            "properties": {
+                "baseline": {
+                    "type": "string",
+                    "description": "Path to a baseline of previously-triaged findings (relative to workspace root)."
+                },
+                "config": {
+                    "type": "object",
+                    "properties": {
+                        "extendBundled": {
+                            "type": "boolean",
+                            "description": "Layer the user's rules on top of the bundled ruleset. Default: `true`."
+                        },
+                        "inline": {
+                            "type": "object",
+                            "properties": {
+                                "allowlist": {},
+                                "allowlists": {
+                                    "type": "array",
+                                    "items": {}
+                                },
+                                "description": {
+                                    "type": "string"
+                                },
+                                "rules": {
+                                    "type": "array",
+                                    "items": {}
+                                },
+                                "title": {
+                                    "type": "string"
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Inline rule overrides. Wins over `path` when both are set."
+                        },
+                        "path": {
+                            "type": "string",
+                            "description": "Path to a JSON config (gitleaks-compatible)."
+                        },
+                        "presets": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Bundled presets layered on top of the default ruleset (e.g. `\"weak-passwords\"`)."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Where the ruleset comes from. Omit for the bundled gitleaks default."
+                },
+                "redact": {
+                    "type": "boolean",
+                    "description": "Redact secret values in findings."
+                },
+                "rules": {
+                    "type": "object",
+                    "properties": {
+                        "exclude": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Drop findings whose ruleId matches."
+                        },
+                        "include": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Only report findings whose ruleId matches."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Rule-id filters applied after scanning."
+                },
+                "walk": {
+                    "type": "object",
+                    "properties": {
+                        "excludeFromFiles": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Paths to additional `.gitignore`-syntax files (e.g. `.secretsignore`)."
+                        },
+                        "excludePatterns": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Gitignore-syntax patterns (supports negation, directory markers, leading `/`). Applied on top of `.gitignore`."
+                        },
+                        "gitignore": {
+                            "type": "boolean",
+                            "description": "Respect `.gitignore`. Default: `true`."
+                        },
+                        "includeHidden": {
+                            "type": "boolean",
+                            "description": "Include hidden (dotfile) entries. Default: `false`."
+                        },
+                        "maxFileSize": {
+                            "type": "number",
+                            "description": "Max file size in bytes. Default 10 MiB."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Walker / filesystem traversal."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Default options for `vis secrets`. CLI flags always take precedence; this block provides workspace-wide defaults so teams can commit config once and every invocation picks it up."
+        },
+        "security": {
+            "type": "object",
+            "properties": {
+                "acceptedRisks": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "object",
+                        "properties": {
+                            "acceptedAt": {
+                                "type": "string",
+                                "description": "ISO 8601 timestamp when the risk was accepted."
+                            },
+                            "acceptedScore": {
+                                "type": "number",
+                                "description": "The overall Socket.dev score at the time of acceptance, in the range `[0, 1]` (mirrors `policies.score.minimum`). Only relevant for the `score` policy; ignored elsewhere."
+                            },
+                            "expiresAt": {
+                                "type": "string",
+                                "description": "ISO 8601 date (or datetime). After this point the acceptance stops applying and vis emits a warning. Leave undefined for non-expiring entries. Values that fail to parse as a Date are rejected by the loader rather than silently treated as \"always expired\"."
+                            },
+                            "policies": {
+                                "type": "array",
+                                "items": {
+                                    "$ref": "#/$defs/PolicyName"
+                                },
+                                "description": "Which policies this acceptance covers. When undefined the acceptance applies to every policy finding on this package."
+                            },
+                            "reason": {
+                                "type": "string",
+                                "description": "User-provided reason for accepting the risk."
+                            }
+                        },
+                        "required": [
+                            "acceptedAt",
+                            "reason"
+                        ],
+                        "additionalProperties": false
+                    },
+                    "description": "Packages whose policy findings have been reviewed and explicitly accepted. Matched against every policy unless `policies` narrows the scope. Replaces the legacy `security.socket.acceptedRisks` map.\n\nKey format: package name (`\"lodash\"`), name@version (`\"lodash@4.17.21\"`), or glob (`\"@myorg/*\"`). Unversioned keys match all versions of that package."
+                },
+                "audit": {
+                    "type": "object",
+                    "properties": {
+                        "advisories": {
+                            "type": "object",
+                            "properties": {
+                                "allowedHosts": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    },
+                                    "description": "Extra hosts permitted as `audit.advisories.source`. The built-in allowlist is enforced even if this field is omitted; entries here add to it.",
+                                    "examples": [
+                                        [
+                                            "mirror.corp.example.com"
+                                        ]
+                                    ]
+                                },
+                                "refreshIntervalHours": {
+                                    "type": "number",
+                                    "description": "Number of hours after `lastSyncIso` before `vis audit` prints a \"your advisory cache may be stale\" notice. `vis audit` never auto-syncs — the user runs `vis advisories sync` themselves.",
+                                    "default": 24
+                                },
+                                "source": {
+                                    "type": "string",
+                                    "description": "OSV mirror base URL (no trailing slash). Defaults to the public Google Cloud Storage bucket. Override to point at a corporate mirror; the hostname must appear in `allowedHosts` (or one of the built-in defaults) and the scheme must be `https://`.",
+                                    "default": "https://osv-vulnerabilities.storage.googleapis.com"
+                                },
+                                "verify": {
+                                    "type": "object",
+                                    "properties": {
+                                        "enabled": {
+                                            "type": "boolean",
+                                            "description": "Enable signature verification. The sync flow downloads `&lt;eco>/all.zip.sig` next to the zip and aborts if it cannot verify against `expectedIssuer` / `expectedSubject`.",
+                                            "default": false
+                                        },
+                                        "expectedIssuer": {
+                                            "type": "string",
+                                            "description": "OIDC issuer that signed the bundle."
+                                        },
+                                        "expectedSubject": {
+                                            "type": "string",
+                                            "description": "OIDC subject (workload identity) that signed the bundle."
+                                        }
+                                    },
+                                    "additionalProperties": false,
+                                    "description": "Sigstore signature verification for the OSV dump. Requires the native binding to be built with the `verify-signatures` Cargo feature (default in the release build). Off by default — the upstream OSV bucket does not ship signatures today."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Offline advisory cache settings."
+                        },
+                        "apply": {
+                            "type": "object",
+                            "properties": {
+                                "transitive": {
+                                    "type": "object",
+                                    "properties": {
+                                        "enabled": {
+                                            "type": "boolean",
+                                            "description": "When true, allows `--fix-transitive` to run in CI environments. Defaults to false because rewriting overrides is a higher blast radius than bumping a direct dep.",
+                                            "default": false
+                                        }
+                                    },
+                                    "additionalProperties": false,
+                                    "description": "Gates for `vis audit --fix-transitive`. Two-lock: the CLI requires `--yes` AND this flag set to `true` before it will rewrite override entries in CI."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Gates for the auto-fix flow (`vis audit --fix` / `--fix-transitive`). The CLI prompts outside CI; inside CI the flags refuse to run unless `--yes` is set and, for transitives, `apply.transitive.enabled = true`."
+                        },
+                        "offlineByDefault": {
+                            "type": "boolean",
+                            "description": "When true, `vis audit` skips network calls and queries the offline cache. Equivalent to the CLI `--offline` flag.",
+                            "default": false
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Offline OSV advisory + `vis audit` configuration.\n\nControls `vis audit --offline` and `vis advisories sync` behavior:\n- `audit.advisories.source` is the OSV mirror to download from. It   must be `https://` and resolve to a host in `allowedHosts` (or one   of the built-in defaults).\n- `audit.offlineByDefault` flips the default of `--offline`.\n\nVulnerability severity gating and reachability filtering live under `policies.vulnerability` (see below)."
+                },
+                "allowBins": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "boolean"
+                    },
+                    "description": "Map of bin names (or `pkg#bin` qualifiers) blessed for shadowing. When two installed packages expose the same bin name, vis flags the collision in `vis security list` and the post-install drift report — set the bin (or `pkg#bin`) to `true` here to suppress the warning once you've reviewed the conflict.\n\nPort of LavaMoat allow-scripts' experimental `allowBins`. Bare names match any conflicting bin with that name; the `pkg#bin` form scopes the approval to a single package's bin."
+                },
+                "blockExoticSubdeps": {
+                    "type": "boolean",
+                    "description": "When true, prevents transitive dependencies from using exotic sources (git repositories, direct tarball URLs). Only direct dependencies may use such sources. Equivalent to pnpm's `blockExoticSubdeps`.",
+                    "default": false
+                },
+                "pinVersions": {
+                    "type": "boolean",
+                    "description": "When true, `security.policies.installScripts.allow` keys are matched as `name@version`. A version bump on an approved package drops it from the allowlist until the new version is explicitly re-approved (port of LavaMoat allow-scripts' version-aware policy matcher).\n\nAfter a version bump, run `vis approve-builds` or `vis security list` — both surface a \"Version drift\" block with the suggested new key (`old-key  →  new-key`) so you can update `vis.config.ts` by hand.",
+                    "default": false
+                },
+                "policies": {
+                    "type": "object",
+                    "properties": {
+                        "firstSeen": {
+                            "type": "object",
+                            "properties": {
+                                "exclude": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    },
+                                    "description": "Package names/patterns excluded from the firstSeen check. Equivalent to pnpm's `minimumReleaseAgeExclude`.",
+                                    "examples": [
+                                        [
+                                            "webpack",
+                                            "react",
+                                            "@myorg/*"
+                                        ]
+                                    ]
+                                },
+                                "minutes": {
+                                    "type": "number",
+                                    "description": "Minutes after publish before install is allowed."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Minimum number of minutes that must pass after a version is published before vis will allow installation. Migrated from the legacy `security.minimumReleaseAge` field. Equivalent to pnpm's `minimumReleaseAge`.",
+                            "examples": [
+                                {
+                                    "minutes": 1440,
+                                    "exclude": [
+                                        "@myorg/*"
+                                    ]
+                                }
+                            ],
+                            "default": 0
+                        },
+                        "installScripts": {
+                            "type": "object",
+                            "properties": {
+                                "allow": {
+                                    "type": "object",
+                                    "additionalProperties": {
+                                        "type": "boolean"
+                                    },
+                                    "description": "Map of package names/patterns to allow (true) or deny (false) build scripts. Packages not listed are denied by default. Equivalent to pnpm's `allowBuilds`."
+                                },
+                                "strict": {
+                                    "type": "boolean",
+                                    "description": "When true, installation will fail (exit non-zero) if any dependencies have unreviewed build scripts. Equivalent to pnpm's `strictDepBuilds`.",
+                                    "default": false
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Build-script (pre/install/postinstall/prepare) controls. Migrated from the legacy `security.allowBuilds` / `security.strictDepBuilds` fields.",
+                            "examples": [
+                                {
+                                    "allow": {
+                                        "esbuild": true
+                                    },
+                                    "strict": true
+                                }
+                            ]
+                        },
+                        "license": {
+                            "type": "object",
+                            "properties": {
+                                "allow": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    },
+                                    "description": "SPDX identifiers that are explicitly permitted. When set, any package whose declared license is not on this list is blocked."
+                                },
+                                "deny": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    },
+                                    "description": "SPDX identifiers that are explicitly forbidden. Always wins over `allow` when both reference the same identifier."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "SPDX license allow / deny lists. Deny wins on any sub-license match in SPDX expressions (`(MIT OR GPL-3.0)` against `deny: [\"GPL-3.0\"]` is blocked). Packages with no declared license are flagged when `allow` is set."
+                        },
+                        "malware": {
+                            "type": "object",
+                            "properties": {
+                                "mode": {
+                                    "type": "string",
+                                    "enum": [
+                                        "block",
+                                        "off",
+                                        "warn"
+                                    ],
+                                    "description": "- `\"block\"` — emit a block decision.\n- `\"warn\"`  — surface as a warning; do not gate exit code.\n- `\"off\"`   — disable the policy entirely."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Behavior when the Socket.dev feed flags a package as malicious (`alerts[].type === \"Malware\"`).\n\nThe default is cross-field: `{ mode: \"block\" }` whenever `security.socket.enabled !== false` (the engine cannot evaluate malware without Socket data), and `\"off\"` otherwise. Consumers resolve this default at evaluation time."
+                        },
+                        "publisherChange": {
+                            "type": "object",
+                            "properties": {
+                                "exclude": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    },
+                                    "description": "Package selectors excluded from the check. Equivalent to pnpm's `trustPolicyExclude`.",
+                                    "examples": [
+                                        [
+                                            "chokidar@4.0.3"
+                                        ]
+                                    ]
+                                },
+                                "ignoreAfter": {
+                                    "type": "number",
+                                    "description": "Ignore packages published more than N minutes ago. Useful for older packages that pre-date provenance support. Equivalent to pnpm's `trustPolicyIgnoreAfter`."
+                                },
+                                "mode": {
+                                    "type": "string",
+                                    "enum": [
+                                        "no-downgrade",
+                                        "off"
+                                    ],
+                                    "description": "- `\"off\"`           — no trust checking (default).\n- `\"no-downgrade\"`  — block when a package's trust level   has decreased compared to previous releases (e.g., was   published by trusted publisher, now only has provenance)."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Trust-level checking for package publishing. Migrated from the legacy `security.trustPolicy*` fields. Equivalent to pnpm's `trustPolicy`.",
+                            "examples": [
+                                {
+                                    "mode": "no-downgrade",
+                                    "ignoreAfter": 43200
+                                }
+                            ]
+                        },
+                        "score": {
+                            "type": "object",
+                            "properties": {
+                                "minimum": {
+                                    "type": "number",
+                                    "description": "Minimum overall Socket.dev score (0–1). Set to 0 to disable the gate while keeping Socket data fetched.\n\nConsulted by `vis add`, `audit`, `doctor`, `check`, and `update`; resolved once in `buildSocketOptions`, then threaded through every consumer. Falls back to `DEFAULT_LOW_SCORE_THRESHOLD` (`0.4`) when unset."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Socket.dev overall-score threshold. Packages scoring below `minimum` trigger a block decision (or interactive prompt during `vis add`). Migrated from the legacy `security.socket.minimumScore` field.",
+                            "examples": [
+                                {
+                                    "minimum": 0.4
+                                }
+                            ]
+                        },
+                        "unexpectedDeps": {
+                            "type": "object",
+                            "properties": {
+                                "allow": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    },
+                                    "description": "Allow-list of dependency names that may appear in the resolved package set. Glob patterns are supported.",
+                                    "examples": [
+                                        [
+                                            "lodash",
+                                            "axios",
+                                            "@myorg/*"
+                                        ]
+                                    ]
+                                },
+                                "baselineLockfile": {
+                                    "type": "string",
+                                    "description": "Path (absolute or relative to the workspace root) to a baseline lockfile snapshot. The policy diffs the current lockfile against this baseline and flags any package that didn't exist before.",
+                                    "examples": [
+                                        "./security/lockfile.baseline.yaml"
+                                    ]
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Net-new transitive dependency detection. Either provide a static allow-list, a baseline lockfile path (recommended), or both — the intersection is enforced.",
+                            "examples": [
+                                {
+                                    "baselineLockfile": "./security/lockfile.baseline.yaml"
+                                }
+                            ]
+                        },
+                        "vulnerability": {
+                            "type": "object",
+                            "properties": {
+                                "failOn": {
+                                    "type": "string",
+                                    "enum": [
+                                        "critical",
+                                        "high",
+                                        "low",
+                                        "medium"
+                                    ],
+                                    "description": "Severity threshold that makes `vis audit` exit non-zero. Equivalent to the CLI `--fail-on` flag.",
+                                    "examples": [
+                                        "high"
+                                    ]
+                                },
+                                "usage": {
+                                    "type": "object",
+                                    "properties": {
+                                        "alwaysAssumeUsed": {
+                                            "type": "array",
+                                            "items": {
+                                                "type": "string"
+                                            },
+                                            "description": "Packages to always treat as reachable even if no static import is found.",
+                                            "examples": [
+                                                [
+                                                    "esbuild",
+                                                    "webpack-cli"
+                                                ]
+                                            ]
+                                        },
+                                        "enabled": {
+                                            "type": "boolean",
+                                            "description": "Enable the reachability filter by default. Equivalent to `--usage` on the CLI; `--no-usage` disables.",
+                                            "default": false
+                                        }
+                                    },
+                                    "additionalProperties": false,
+                                    "description": "Reachability filter — only report vulnerabilities in packages the workspace statically imports."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "OSV vulnerability gating. Migrated from the legacy `security.audit.failOn` + `security.audit.usage` fields."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Supply-chain policy gates. Each sub-block enables one policy and configures its behavior. When a sub-block is omitted the policy is inactive. `acceptedRisks` (above) silences specific packages without disabling a policy globally.\n\nThe 8 policies are inspired by Socket.dev's classification:\n- `malware`            — Socket-flagged malicious packages\n- `firstSeen`         — packages published less than N minutes ago\n- `unexpectedDeps`    — packages outside an allow-list / baseline\n- `publisherChange`   — maintainer set changed between installs\n- `installScripts`    — preinstall/install/postinstall scripts\n- `score`              — Socket overall score below threshold\n- `vulnerability`      — OSV vulnerability findings\n- `license`            — SPDX allow / deny lists"
+                },
+                "socket": {
+                    "type": "object",
+                    "properties": {
+                        "apiToken": {
+                            "type": "string",
+                            "description": "Custom Socket.dev API token. Falls back to the public API token. Set via VIS_SOCKET_TOKEN environment variable or here."
+                        },
+                        "cacheTtlMs": {
+                            "type": "number",
+                            "description": "Cache TTL in milliseconds for Socket.dev reports.",
+                            "default": "3_600_000 (1 hour)"
+                        },
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Enable Socket.dev security scanning on install/update/check commands.",
+                            "default": false
+                        },
+                        "timeoutMs": {
+                            "type": "number",
+                            "description": "Request timeout in milliseconds for the Socket.dev API.",
+                            "default": "15_000 (15 seconds)"
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Socket.dev data-source configuration. Connection knobs only — score thresholds and accepted-risk overrides moved to `policies.score` and `security.acceptedRisks` respectively."
+                },
+                "marshalls": {
+                    "type": "object",
+                    "properties": {
+                        "archivedRepo": {
+                            "type": "object",
+                            "properties": {
+                                "allowlist": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    },
+                                    "description": "Package names to skip."
+                                },
+                                "enabled": {
+                                    "type": "boolean",
+                                    "description": "Default: marshall is on. Set false to disable."
+                                },
+                                "githubToken": {
+                                    "type": "string",
+                                    "description": "GitHub PAT for the API call (5k/hr vs 60/hr)."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Archived-repo marshall (GitHub repository status)."
+                        },
+                        "author": {
+                            "type": "object",
+                            "properties": {
+                                "allowlist": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                },
+                                "dormantErrorDays": {
+                                    "type": "number",
+                                    "description": "Days since the publisher's last release before flagging as error."
+                                },
+                                "dormantWarnDays": {
+                                    "type": "number",
+                                    "description": "Days since the publisher's last release before flagging as warning."
+                                },
+                                "enabled": {
+                                    "type": "boolean"
+                                },
+                                "newPublisherWindowDays": {
+                                    "type": "number",
+                                    "description": "Window for the \"new publisher on an established package\" check."
+                                },
+                                "recentVersionErrorDays": {
+                                    "type": "number",
+                                    "description": "Days since the resolved version was published — error threshold."
+                                },
+                                "recentVersionWarnDays": {
+                                    "type": "number",
+                                    "description": "Days since the resolved version was published — warning threshold."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Author / publisher heuristics."
+                        },
+                        "downloads": {
+                            "type": "object",
+                            "properties": {
+                                "allowlist": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                },
+                                "enabled": {
+                                    "type": "boolean"
+                                },
+                                "errorThreshold": {
+                                    "type": "number",
+                                    "description": "Below this monthly count → error (default: 20)."
+                                },
+                                "warnThreshold": {
+                                    "type": "number",
+                                    "description": "Below this monthly count → warning (default: 1000)."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Monthly download-count floor."
+                        },
+                        "expiredDomains": {
+                            "type": "object",
+                            "properties": {
+                                "allowDomains": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    },
+                                    "description": "Domains exempted from the check (legacy / internal)."
+                                },
+                                "allowlist": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                },
+                                "dnsServers": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    },
+                                    "description": "DNS resolvers to query (default: system)."
+                                },
+                                "enabled": {
+                                    "type": "boolean"
+                                },
+                                "timeoutMs": {
+                                    "type": "number",
+                                    "description": "Per-domain DNS timeout (default: 5000)."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Maintainer-email-domain NS lookup."
+                        },
+                        "metadata": {
+                            "type": "object",
+                            "properties": {
+                                "allowlist": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                },
+                                "checks": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string",
+                                        "enum": [
+                                            "license",
+                                            "readme",
+                                            "repo"
+                                        ]
+                                    },
+                                    "description": "Subset of checks to run. Default: all three."
+                                },
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "README / license / repository presence checks."
+                        },
+                        "newBin": {
+                            "type": "object",
+                            "properties": {
+                                "allowlist": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                },
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "New CLI-bin script introduced in this version."
+                        },
+                        "provenance": {
+                            "type": "object",
+                            "properties": {
+                                "allowlist": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                },
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "Provenance regression check."
+                        },
+                        "signatures": {
+                            "type": "object",
+                            "properties": {
+                                "allowlist": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                },
+                                "enabled": {
+                                    "type": "boolean",
+                                    "description": "Default: marshall is *off*. Set true to enable."
+                                },
+                                "keysUrl": {
+                                    "type": "string",
+                                    "description": "Override the keys endpoint (default: npm registry)."
+                                },
+                                "treatExpiredAs": {
+                                    "type": "string",
+                                    "enum": [
+                                        "error",
+                                        "warning"
+                                    ],
+                                    "description": "How to treat an expired-but-known key. Default: \"warning\"."
+                                }
+                            },
+                            "additionalProperties": false,
+                            "description": "ECDSA P-256 verification against npm's signing keys. Disabled by default because npm coverage still has gaps that produce noisy warnings on legitimate packages."
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Pre-install marshall pipeline — packument-derived supply-chain gates (author, provenance, new-bin, metadata, downloads, expired-domains, signatures, archived-repo) that run before `vis add` / `vis install <pkg>` / `vis update <pkg>` hand off to the underlying package manager. Every entry is optional; omit a key and the marshall runs with defaults. Set `enabled: false` on a specific marshall to skip it without touching env vars."
+                },
+                "typosquatAllowlist": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Package names to skip during typosquat detection. Use this for internal packages or known-safe names that happen to look similar to popular packages.",
+                    "examples": [
+                        [
+                            "my-internal-axois",
+                            "@myorg/recat"
+                        ]
+                    ]
+                }
+            },
+            "additionalProperties": false,
+            "description": "Supply chain security settings. These settings are inspired by pnpm's security features and are applied universally across all package managers (pnpm, npm, yarn, bun).\n\nFor pnpm users: these map directly to pnpm-workspace.yaml settings. For npm/yarn/bun users: vis enforces these at the vis layer since those package managers lack native support."
+        },
+        "sharedWorktreeCache": {
+            "type": "boolean",
+            "description": "Share the cache between sibling git worktrees. When the workspace is a linked worktree (created with `git worktree add`), the cache root is relocated from `&lt;linkedRoot>/.vis/cache` to the *main* worktree's `.vis/cache`. Multiple parallel agents working in sibling worktrees then share a single cache instead of rebuilding the same hash N times.\n\nSingle-checkout repos (where `.git` is a directory) are unaffected.\n\nSet to `false` to opt out — useful when worktrees deliberately need independent caches, e.g. for hermetic experiments.",
+            "default": true
+        },
+        "sortPackageJson": {
+            "type": "object",
+            "properties": {
+                "editorconfig": {
+                    "type": "boolean",
+                    "description": "Discover `.editorconfig` for indent / line-ending defaults (default: true)."
+                },
+                "formatBugs": {
+                    "type": "boolean",
+                    "description": "Collapse `bugs: { url }` to the bare string form when `url` is the only field (default: true)."
+                },
+                "formatRepository": {
+                    "type": "boolean",
+                    "description": "Collapse `repository: { type, url }` to the GitHub `owner/repo` shorthand (default: true)."
+                },
+                "sortExports": {
+                    "type": "boolean",
+                    "description": "Sort `exports` condition keys in canonical order (default: true)."
+                },
+                "sortScripts": {
+                    "type": "boolean",
+                    "description": "Alphabetize script commands (default: false)"
+                }
+            },
+            "additionalProperties": false,
+            "description": "sort-package-json command defaults"
+        },
+        "sponsor": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean",
+                    "description": "Show the sponsor notice on successful command completion.",
+                    "default": true
+                }
+            },
+            "additionalProperties": false,
+            "description": "Sponsorship notice shown after successful commands.\n\nvis prints a one-line \"consider sponsoring visulima\" notice at most once every 14 days (skipped in CI, non-TTY, and when `VIS_NO_SPONSOR=1` is set). Set `enabled: false` to silence it permanently for this workspace."
+        },
+        "staged": {
+            "$ref": "#/$defs/StagedConfig",
+            "description": "Staged file patterns and commands (replaces lint-staged).\n\nAccepts all lint-staged config forms:\n- `string` or `string[]` commands\n- Sync/async functions returning `string | string[]`\n- `{ title, task }` objects for named side-effect tasks\n- Mixed arrays of strings and functions\n- A top-level generate-task function"
+        },
+        "strictEnv": {
+            "type": "boolean",
+            "description": "When `true`, every task command is scanned for `${VAR}` / `$VAR` references before spawn. If a referenced var is unset in the task's effective env (envFile + service env + per-task `env` + `process.env`), the task fails with an actionable error naming the missing variable, instead of letting the shell silently substitute an empty string.\n\nOverride per run with `--strict-env` / `--no-strict-env`. Override per target with `options.strictEnv`.",
+            "default": false
+        },
+        "tasks": {
+            "type": "object",
+            "additionalProperties": {
+                "type": "object",
+                "properties": {
+                    "aliases": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        },
+                        "description": "Alternate names that resolve to this target on the CLI. Useful for shortening long canonical names (`test` ↔ `t`) or for offering migration-friendly aliases when renaming targets. Aliases must be globally unique within the workspace."
+                    },
+                    "description": {
+                        "type": "string",
+                        "description": "One-line description surfaced by `vis list` and (in future) per-task `--help`. Kept short — longer docs belong in project READMEs or vis.config.ts comments."
+                    },
+                    "inferred": {
+                        "type": "boolean",
+                        "description": "True when the target was synthesized by a Project Crystal-style detector (see  {@link  ../inference } ) rather than declared by a package.json script, project.json, or vis.task.ts file. Surfaced by `vis list --inferred` and used by tooling to distinguish implicit defaults from explicit user intent."
+                    },
+                    "options": {
+                        "$ref": "#/$defs/VisTargetOptions",
+                        "description": "Vis-specific target options."
+                    },
+                    "preset": {
+                        "$ref": "#/$defs/TargetPreset",
+                        "description": "Preset applied before user-specified options."
+                    },
+                    "type": {
+                        "$ref": "#/$defs/TargetType",
+                        "description": "Semantic task type. Affects caching defaults and CI filtering.",
+                        "default": "test"
+                    },
+                    "always": {
+                        "type": "boolean",
+                        "description": "When `true`, this target runs after the main task graph completes — even if upstream tasks failed. Useful for cleanup, teardown, notifications, or anything that should fire regardless of build outcome. Always-tasks are not part of the normal dependency graph and never block other tasks."
+                    },
+                    "cache": {
+                        "type": "boolean",
+                        "description": "Whether this target is cacheable"
+                    },
+                    "cacheOnWarning": {
+                        "type": "boolean",
+                        "description": "When `false`, exit-0 runs whose terminal output matched any  {@link  TargetConfiguration.warningPattern }  are not seeded into the cache. Defaults to `true` — warnings are surfaced on the result (`hadWarnings: true`) but caching still happens, matching the \"succeeded with warnings is incremental\" behaviour rush, lage and wireit users have repeatedly asked for."
+                    },
+                    "cacheRestore": {
+                        "type": "object",
+                        "properties": {
+                            "preserveMtime": {
+                                "type": "boolean",
+                                "description": "Restore each file's modification time from the captured tar header (second precision). When `false`, restored files take the current wall-clock time, matching the legacy behaviour."
+                            },
+                            "preservePerms": {
+                                "type": "boolean",
+                                "description": "Restore each file's POSIX mode bits (rwx triplets, low 12 bits). When `false`, restored files take the process umask. Only meaningful on POSIX hosts; Windows ignores tar mode."
+                            }
+                        },
+                        "additionalProperties": false,
+                        "description": "Fine-grained controls over how cached outputs are rehydrated. See  {@link  CacheRestoreOptions } . Both fields default to `true` (faithful restore); flip individually when downstream tooling needs the legacy \"now\"-stamped behaviour."
+                    },
+                    "command": {
+                        "type": "string",
+                        "description": "The command to run (alternative to executor)"
+                    },
+                    "configurations": {
+                        "type": "object",
+                        "additionalProperties": {
+                            "type": "object",
+                            "additionalProperties": {}
+                        },
+                        "description": "Named configurations (e.g., \"production\", \"development\")"
+                    },
+                    "concurrencyGroup": {
+                        "type": "string",
+                        "description": "Workspace-level concurrency group this target opts into. The scheduler caps the *combined* in-flight count of every task whose target carries the same group name to the value declared in  {@link  TaskRunnerOptions.concurrencyGroups } . Use this when several targets share an external resource (a single Postgres, a developer's Docker daemon, an account-wide deploy lock) so the cap follows the resource, not any single target name.\n\nTargets that name a group not declared in `concurrencyGroups` run uncapped — a typo shouldn't deadlock the graph. Caps don't apply to tasks marked `always: true`; those run in a separate finalisation phase outside the scheduler."
+                    },
+                    "dependsOn": {
+                        "type": "array",
+                        "items": {
+                            "anyOf": [
+                                {
+                                    "type": "string"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "dependencies": {
+                                            "type": "boolean",
+                                            "description": "Whether this is a dependency on the same project"
+                                        },
+                                        "params": {
+                                            "type": "string",
+                                            "enum": [
+                                                "forward",
+                                                "ignore"
+                                            ],
+                                            "description": "Params to pass through"
+                                        },
+                                        "projects": {
+                                            "anyOf": [
+                                                {
+                                                    "type": "string"
+                                                },
+                                                {
+                                                    "type": "array",
+                                                    "items": {
+                                                        "type": "string"
+                                                    }
+                                                }
+                                            ],
+                                            "description": "The project name (if different from the current project)"
+                                        },
+                                        "target": {
+                                            "type": "string",
+                                            "description": "The target name"
+                                        }
+                                    },
+                                    "required": [
+                                        "target"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "Defines a dependency on another target."
+                                }
+                            ]
+                        },
+                        "description": "Other targets this target depends on"
+                    },
+                    "executor": {
+                        "type": "string",
+                        "description": "The executor/command to run"
+                    },
+                    "inputs": {
+                        "type": "array",
+                        "items": {
+                            "anyOf": [
+                                {
+                                    "type": "string"
+                                },
+                                {
+                                    "anyOf": [
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "fileset": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "object",
+                                                            "properties": {
+                                                                "base": {
+                                                                    "type": "string",
+                                                                    "enum": [
+                                                                        "package",
+                                                                        "workspace"
+                                                                    ],
+                                                                    "description": "Anchor for the pattern."
+                                                                },
+                                                                "pattern": {
+                                                                    "type": "string",
+                                                                    "description": "Glob pattern (may start with `!` for negation)."
+                                                                }
+                                                            },
+                                                            "required": [
+                                                                "base",
+                                                                "pattern"
+                                                            ],
+                                                            "additionalProperties": false,
+                                                            "description": "Object form of a fileset pattern, for anchoring to the workspace root."
+                                                        },
+                                                        {
+                                                            "type": "string"
+                                                        }
+                                                    ]
+                                                }
+                                            },
+                                            "required": [
+                                                "fileset"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on file patterns.\n\n`fileset` may be a bare glob string (package-root relative) or an object form `{ pattern, base }` to anchor explicitly to the workspace root. Negation (`!` prefix) works in both forms."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "runtime": {
+                                                    "type": "string"
+                                                }
+                                            },
+                                            "required": [
+                                                "runtime"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on a runtime command."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "env": {
+                                                    "type": "string"
+                                                }
+                                            },
+                                            "required": [
+                                                "env"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on environment variables."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "externalDependencies": {
+                                                    "type": "array",
+                                                    "items": {
+                                                        "type": "string"
+                                                    }
+                                                }
+                                            },
+                                            "required": [
+                                                "externalDependencies"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on external dependency versions."
+                                        }
+                                    ],
+                                    "description": "Defines an input for cache invalidation."
+                                }
+                            ]
+                        },
+                        "description": "Input patterns for cache invalidation"
+                    },
+                    "maxConcurrent": {
+                        "type": "number",
+                        "description": "Maximum number of in-flight instances of this target across the whole graph. When set, the scheduler refuses to start an additional task whose `target.target` equals this target's name once the running count reaches `maxConcurrent`. Independent of `--parallel`: the global cap still bounds total in-flight tasks, and `maxConcurrent` further bounds the per-target subset.\n\nUse for tests/deploys that share an external resource (DB, port, mock server). Set to `1` to serialize. Values `<= 0` are ignored.\n\nIf multiple projects declare different values for the same target name, the runner uses the smallest declared cap. Caps don't apply to tasks marked `always: true`; those run in a separate finalisation phase outside the scheduler."
+                    },
+                    "outputs": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        },
+                        "description": "Output patterns produced by this target"
+                    },
+                    "parallelism": {
+                        "type": "boolean",
+                        "description": "Whether this target supports parallel execution"
+                    },
+                    "warningPattern": {
+                        "anyOf": [
+                            {
+                                "type": "string"
+                            },
+                            {
+                                "type": "array",
+                                "items": {
+                                    "type": "string"
+                                }
+                            }
+                        ],
+                        "description": "Regex source string(s) that mark a successful task as having emitted warnings. The orchestrator scans the task's combined terminal output after a 0-exit and, on first match, sets `hadWarnings` on the result. Combine with `cacheOnWarning: false` to skip caching for warning-tainted runs. Both bare strings and arrays are accepted; arrays are tested in order.\n\n  ```ts   warningPattern: [\"\\\\bwarning\\\\b\", \"TS\\\\d{4}\"]   ```"
+                    },
+                    "when": {
+                        "type": "object",
+                        "properties": {
+                            "branch": {
+                                "anyOf": [
+                                    {
+                                        "type": "string"
+                                    },
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    }
+                                ],
+                                "description": "Match against the current git branch (HEAD)."
+                            },
+                            "ci": {
+                                "type": "boolean",
+                                "description": "Run only when invoked inside CI when `true`, only outside CI when `false`. Detects CI via the `CI` env var (the convention GitHub Actions, GitLab, CircleCI, Jenkins, etc. all share)."
+                            },
+                            "env": {
+                                "anyOf": [
+                                    {
+                                        "anyOf": [
+                                            {
+                                                "type": "string"
+                                            },
+                                            {
+                                                "type": "object",
+                                                "properties": {
+                                                    "equals": {
+                                                        "type": "string",
+                                                        "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                    },
+                                                    "exists": {
+                                                        "type": "boolean",
+                                                        "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                    },
+                                                    "name": {
+                                                        "type": "string",
+                                                        "description": "Variable name."
+                                                    }
+                                                },
+                                                "required": [
+                                                    "name"
+                                                ],
+                                                "additionalProperties": false
+                                            }
+                                        ],
+                                        "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                    },
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "anyOf": [
+                                                {
+                                                    "type": "string"
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "equals": {
+                                                            "type": "string",
+                                                            "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                        },
+                                                        "exists": {
+                                                            "type": "boolean",
+                                                            "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                        },
+                                                        "name": {
+                                                            "type": "string",
+                                                            "description": "Variable name."
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "name"
+                                                    ],
+                                                    "additionalProperties": false
+                                                }
+                                            ],
+                                            "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                        }
+                                    }
+                                ],
+                                "description": "Match against environment variables. A bare string asserts the variable is set and non-empty; the object form lets you match an exact value or just assert presence/absence."
+                            },
+                            "not": {
+                                "type": "object",
+                                "properties": {
+                                    "branch": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string"
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string"
+                                                }
+                                            }
+                                        ]
+                                    },
+                                    "ci": {
+                                        "type": "boolean"
+                                    },
+                                    "env": {
+                                        "anyOf": [
+                                            {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string"
+                                                    },
+                                                    {
+                                                        "type": "object",
+                                                        "properties": {
+                                                            "equals": {
+                                                                "type": "string",
+                                                                "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                            },
+                                                            "exists": {
+                                                                "type": "boolean",
+                                                                "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                            },
+                                                            "name": {
+                                                                "type": "string",
+                                                                "description": "Variable name."
+                                                            }
+                                                        },
+                                                        "required": [
+                                                            "name"
+                                                        ],
+                                                        "additionalProperties": false
+                                                    }
+                                                ],
+                                                "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "string"
+                                                        },
+                                                        {
+                                                            "type": "object",
+                                                            "properties": {
+                                                                "equals": {
+                                                                    "type": "string",
+                                                                    "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                },
+                                                                "exists": {
+                                                                    "type": "boolean",
+                                                                    "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                },
+                                                                "name": {
+                                                                    "type": "string",
+                                                                    "description": "Variable name."
+                                                                }
+                                                            },
+                                                            "required": [
+                                                                "name"
+                                                            ],
+                                                            "additionalProperties": false
+                                                        }
+                                                    ],
+                                                    "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                }
+                                            }
+                                        ]
+                                    },
+                                    "os": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string",
+                                                "enum": [
+                                                    "aix",
+                                                    "darwin",
+                                                    "freebsd",
+                                                    "linux",
+                                                    "openbsd",
+                                                    "sunos",
+                                                    "windows",
+                                                    "win32"
+                                                ],
+                                                "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string",
+                                                    "enum": [
+                                                        "aix",
+                                                        "darwin",
+                                                        "freebsd",
+                                                        "linux",
+                                                        "openbsd",
+                                                        "sunos",
+                                                        "windows",
+                                                        "win32"
+                                                    ],
+                                                    "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                }
+                                            }
+                                        ]
+                                    }
+                                },
+                                "additionalProperties": false,
+                                "description": "Negative mirrors. A task runs only when *all* `not.*` clauses fail."
+                            },
+                            "os": {
+                                "anyOf": [
+                                    {
+                                        "type": "string",
+                                        "enum": [
+                                            "aix",
+                                            "darwin",
+                                            "freebsd",
+                                            "linux",
+                                            "openbsd",
+                                            "sunos",
+                                            "windows",
+                                            "win32"
+                                        ],
+                                        "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                    },
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string",
+                                            "enum": [
+                                                "aix",
+                                                "darwin",
+                                                "freebsd",
+                                                "linux",
+                                                "openbsd",
+                                                "sunos",
+                                                "windows",
+                                                "win32"
+                                            ],
+                                            "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                        }
+                                    }
+                                ],
+                                "description": "Match `process.platform` (`\"linux\" | \"darwin\" | \"win32\" | \"freebsd\" | \"openbsd\" | \"sunos\" | \"aix\"`). Pass `\"windows\"` as an alias for `\"win32\"` — easier to remember and matches what people type."
+                            }
+                        },
+                        "additionalProperties": false,
+                        "description": "Predicate that gates execution. When the condition evaluates to `false` for the current environment, the task is skipped (marked `\"skipped\"`, not failed). Combine with `os`, `env`, `branch`, and `ci` clauses for granular control:\n\n  ```ts   when: { os: \"linux\", ci: true, env: \"DEPLOY_TOKEN\" }   ```"
+                    }
+                },
+                "additionalProperties": false
+            },
+            "description": "Workspace-wide task defaults keyed by target name. Applied universally to every project that exposes a matching target. Use `scopedTasks` when defaults should only apply to a subset of projects."
+        },
+        "scopedTasks": {
+            "type": "array",
+            "items": {
+                "$ref": "#/$defs/ScopedTasksBlock"
+            },
+            "description": "Cascading scoped-task blocks. Each block may narrow its tasks to a subset of projects via `match`. Blocks are evaluated in order; later blocks override earlier ones when the same field is set.\n\nMatch predicates are additive — if `match` is omitted, the block applies to every project."
+        },
+        "taskGroups": {
+            "type": "object",
+            "additionalProperties": {
+                "type": "array",
+                "items": {
+                    "anyOf": [
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "object",
+                            "properties": {
+                                "dependencies": {
+                                    "type": "boolean"
+                                },
+                                "projects": {
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "type": "array",
+                                            "items": {
+                                                "type": "string"
+                                            }
+                                        }
+                                    ]
+                                },
+                                "target": {
+                                    "type": "string"
+                                }
+                            },
+                            "required": [
+                                "target"
+                            ],
+                            "additionalProperties": false
+                        },
+                        {
+                            "type": "object",
+                            "properties": {
+                                "group": {
+                                    "type": "string"
+                                }
+                            },
+                            "required": [
+                                "group"
+                            ],
+                            "additionalProperties": false
+                        }
+                    ]
+                }
+            },
+            "description": "Named bundles of target dependencies, referenceable from any task's `dependsOn`. `dependsOn: [{ group: \"lint\" }]` expands to every entry in the named group; nested groups are resolved recursively and a cycle raises during discovery."
+        },
+        "taskRunner": {
+            "type": "object",
+            "properties": {
+                "autoEnvVars": {
+                    "type": "boolean",
+                    "description": "Scan each task's resolved command text for `$VAR`/`${VAR}` references and automatically fingerprint those env vars. Catches tasks like `curl ${VERCEL_URL}/api` where the user forgot to declare the reference in `envVars`/`globalEnv`.",
+                    "default": false
+                },
+                "autoFingerprint": {
+                    "type": "boolean",
+                    "description": "Enable auto-fingerprinting mode (Vite Task-style). When enabled, the task runner automatically tracks which files a task accesses during execution and uses that for cache invalidation instead of requiring manual input configuration.\n\nFalls back to explicit inputs (Nx-style) when file tracking is not supported on the current platform.",
+                    "default": false
+                },
+                "cacheDiagnostics": {
+                    "type": "boolean",
+                    "description": "Whether to show cache miss diagnostics (why a cache miss occurred).",
+                    "default": false
+                },
+                "cacheDirectory": {
+                    "type": "string",
+                    "description": "Directory for storing cache"
+                },
+                "dataDirectory": {
+                    "type": "string",
+                    "description": "Directory used to persist run summaries (`runs/`), `last-summary.json`, and other run-scoped state. Defaults to `{workspaceRoot}/.task-runner` when omitted so standalone task-runner consumers keep their existing layout. Vis sets this to `{workspaceRoot}/.vis` so all per-workspace state lives under a single directory."
+                },
+                "dryRun": {
+                    "type": "boolean",
+                    "description": "Dry-run mode: compute hashes and check cache but don't execute tasks. Useful for debugging cache hits/misses.",
+                    "default": false
+                },
+                "envVars": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Custom environment variables to include in hash"
+                },
+                "fingerprintEnvPatterns": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Environment variable patterns to include in auto-fingerprint. Supports wildcard patterns like \"VITE_*\". Only used when autoFingerprint is enabled."
+                },
+                "frameworkInference": {
+                    "type": "boolean",
+                    "description": "Enable framework environment variable inference. When true, automatically detects common frontend frameworks and includes their public env var prefixes in the task hash:\n- Next.js: NEXT_PUBLIC_*\n- Vite: VITE_*\n- Create React App: REACT_APP_*\n- Gatsby: GATSBY_*\n- Nuxt: NUXT_PUBLIC_*\n- Expo: EXPO_PUBLIC_*\n\nMatches Turborepo's framework inference behavior.",
+                    "default": false
+                },
+                "globalEnv": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Global environment variables that invalidate ALL task hashes. Matches Turborepo's `globalEnv`."
+                },
+                "globalInputs": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Global input files that invalidate ALL task hashes when changed. These are workspace-root-relative paths.\n\nDefault: [\"package-lock.json\", \"pnpm-lock.yaml\", \"yarn.lock\", \"tsconfig.base.json\", \".env\"]\n\nWhen any global input changes, every task's hash changes, forcing a full rebuild. This matches Turborepo's `globalDependencies`."
+                },
+                "incrementalFileHashing": {
+                    "type": "boolean",
+                    "description": "When `true`, file hashes are cached in a persistent mtime+size indexed snapshot under `node_modules/.cache/task-runner/`. On subsequent runs, unchanged files skip content re-reads — cuts cold-cache fingerprint time dramatically on large workspaces.\n\nChanged or new files still get full content hashing. Safe to leave on by default; overhead when nothing matches is a single `stat` call per file.",
+                    "default": false
+                },
+                "concurrencyGroups": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "number"
+                    },
+                    "description": "Workspace-level concurrency group caps. Maps a group name to the maximum number of in-flight tasks across every target whose `concurrencyGroup` field equals the same name. Independent of `parallel`: the global cap still bounds total tasks, and group caps further bound the named subset.\n\nCommon shape — one cap per shared resource:\n\n  ```ts   concurrencyGroups: {     \"db-bound\": 2,    // any target hitting the local Postgres     \"deploy-lock\": 1, // any deploy target   }   ```\n\nTargets opt in via  {@link  TargetConfiguration.concurrencyGroup } . Values `<= 0` are ignored."
+                },
+                "maxCacheAge": {
+                    "type": "number",
+                    "description": "Maximum age of cache entries in milliseconds"
+                },
+                "maxCacheSize": {
+                    "type": "string",
+                    "description": "Maximum cache size (e.g., \"1GB\")"
+                },
+                "namedInputs": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "array",
+                        "items": {
+                            "anyOf": [
+                                {
+                                    "type": "string"
+                                },
+                                {
+                                    "anyOf": [
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "fileset": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "object",
+                                                            "properties": {
+                                                                "base": {
+                                                                    "type": "string",
+                                                                    "enum": [
+                                                                        "package",
+                                                                        "workspace"
+                                                                    ],
+                                                                    "description": "Anchor for the pattern."
+                                                                },
+                                                                "pattern": {
+                                                                    "type": "string",
+                                                                    "description": "Glob pattern (may start with `!` for negation)."
+                                                                }
+                                                            },
+                                                            "required": [
+                                                                "base",
+                                                                "pattern"
+                                                            ],
+                                                            "additionalProperties": false,
+                                                            "description": "Object form of a fileset pattern, for anchoring to the workspace root."
+                                                        },
+                                                        {
+                                                            "type": "string"
+                                                        }
+                                                    ]
+                                                }
+                                            },
+                                            "required": [
+                                                "fileset"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on file patterns.\n\n`fileset` may be a bare glob string (package-root relative) or an object form `{ pattern, base }` to anchor explicitly to the workspace root. Negation (`!` prefix) works in both forms."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "runtime": {
+                                                    "type": "string"
+                                                }
+                                            },
+                                            "required": [
+                                                "runtime"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on a runtime command."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "env": {
+                                                    "type": "string"
+                                                }
+                                            },
+                                            "required": [
+                                                "env"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on environment variables."
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "externalDependencies": {
+                                                    "type": "array",
+                                                    "items": {
+                                                        "type": "string"
+                                                    }
+                                                }
+                                            },
+                                            "required": [
+                                                "externalDependencies"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "An input based on external dependency versions."
+                                        }
+                                    ],
+                                    "description": "Defines an input for cache invalidation."
+                                }
+                            ]
+                        }
+                    },
+                    "description": "Named inputs for cache invalidation"
+                },
+                "namespaceByGlobalEnv": {
+                    "type": "boolean",
+                    "description": "When `true`, the cache directory is partitioned by a hash of the resolved `globalEnv` values. Changing a globalEnv var moves cache writes into a new namespace; rolling it back reuses the old namespace and its hits. Without this option, any globalEnv change silently busts every cached entry.\n\nKeep disabled when globalEnv is stable across runs — the extra path depth offers no value, and misconfigured namespaces can hide stale hits.",
+                    "default": false
+                },
+                "onFingerprint": {
+                    "not": {},
+                    "description": "Plugin extension point invoked during task fingerprinting. Fires once per task after the built-in inputs (filesets, runtime, env) have been gathered and before the hash is sealed. Contributions made through the supplied  {@link  FingerprintContributor }  are mixed deterministically into the final hash.\n\nThrowing aborts fingerprinting for that task — the task fails before any cache lookup runs, so a buggy plugin can't silently corrupt cache state.\n\nWired by `vis` to bridge into the `task:fingerprint` hook; standalone task-runner consumers can pass a callback directly."
+                },
+                "parallel": {
+                    "type": [
+                        "number",
+                        "boolean"
+                    ],
+                    "description": "Maximum number of parallel tasks"
+                },
+                "remoteCache": {
+                    "type": "object",
+                    "properties": {
+                        "allowInsecureBearer": {
+                            "type": "boolean",
+                            "description": "Opt out of the REAPI safety check that refuses to send a bearer token over cleartext gRPC. Required only when the connection terminates inside a trusted boundary (loopback dev cache, mesh mTLS sidecar that strips/re-encrypts on the next hop). Default `false` — production callers should reach for `grpcs://` first.\n\nREAPI-only."
+                        },
+                        "backend": {
+                            "type": "string",
+                            "enum": [
+                                "http",
+                                "reapi"
+                            ],
+                            "description": "Wire-protocol selector. `\"http\"` is the Turborepo-compatible single-tarball cache; `\"reapi\"` switches to the Bazel Remote Execution API gRPC client, unlocking `bazel-remote`, BuildBuddy, BuildBarn, EngFlow as drop-in backends.",
+                            "default": "http"
+                        },
+                        "bearerToken": {
+                            "type": "string",
+                            "description": "Bearer token sent in REAPI's `authorization: Bearer {token}` gRPC metadata header. REAPI-only — HTTP backend uses `token`."
+                        },
+                        "compression": {
+                            "type": "string",
+                            "enum": [
+                                "brotli",
+                                "gzip"
+                            ],
+                            "description": "HTTP-only: tarball compression on the wire.",
+                            "default": "gzip"
+                        },
+                        "instanceName": {
+                            "type": "string",
+                            "description": "REAPI-only `instance_name` for multi-tenant servers (a single gRPC endpoint can host multiple logical caches keyed on the `instance_name` prefix)."
+                        },
+                        "localCasRoot": {
+                            "type": "string",
+                            "description": "Local CAS root used by the per-blob  {@link  RemoteCacheBackend }  methods. The HTTP wire format is still single-tarball; on retrieve the bridge extracts blobs into this root so a follow-up `fetchBlob` is just a local read."
+                        },
+                        "mode": {
+                            "type": "string",
+                            "enum": [
+                                "read",
+                                "readwrite",
+                                "write"
+                            ],
+                            "description": "Canonical cache mode flag.\n\n- `\"read\"`: Pull cache hits, never push. Sensible default for   local dev so a developer doesn't poison the shared cache while   their workspace is dirty.\n- `\"write\"`: Push results, never read. Useful for refill /   warm-up jobs that should always re-execute and re-upload.\n- `\"readwrite\"`: Both. Default for CI.",
+                            "default": "readwrite"
+                        },
+                        "signing": {
+                            "type": "object",
+                            "properties": {
+                                "secret": {
+                                    "type": "string",
+                                    "description": "Shared secret. Must be at least 16 characters."
+                                },
+                                "verifyOnDownload": {
+                                    "type": "boolean",
+                                    "description": "Reject downloads whose signature doesn't match or is missing. Set to `true` once every upload on your server is signed.",
+                                    "default": false
+                                }
+                            },
+                            "required": [
+                                "secret"
+                            ],
+                            "additionalProperties": false,
+                            "description": "HTTP-only: HMAC-SHA256 signing for upload integrity."
+                        },
+                        "teamId": {
+                            "type": "string",
+                            "description": "Team / namespace for cache isolation."
+                        },
+                        "timeout": {
+                            "type": "number",
+                            "description": "Per-call request timeout in milliseconds.",
+                            "default": 30000
+                        },
+                        "token": {
+                            "type": "string",
+                            "description": "HTTP authentication token sent as `Authorization: Bearer …`. For REAPI, use `bearerToken` instead — same wire mechanic, but a separate field so REAPI's cleartext-bearer guard can distinguish \"user explicitly opted into a gRPC token\" from \"user set HTTP auth and accidentally selected the REAPI backend\"."
+                        },
+                        "url": {
+                            "type": "string",
+                            "description": "Cache server URL.\n\n- HTTP: `https://cache.example.com`\n- REAPI: `grpcs://host:port` (TLS, recommended) or `grpc://host:port`   (cleartext — bearer tokens are refused unless `allowInsecureBearer`)."
+                        }
+                    },
+                    "required": [
+                        "url"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Remote cache configuration. When configured, the task runner checks the remote cache after a local miss and uploads results after execution. See  {@link  RemoteCacheOptions }  for the full HTTP and REAPI surface."
+                },
+                "skipNxCache": {
+                    "type": "boolean",
+                    "description": "Whether to skip cache reads"
+                },
+                "smartLockfileHashing": {
+                    "type": "boolean",
+                    "description": "Enable smart lockfile hashing. Instead of hashing the entire lockfile (which busts ALL caches), only hash the resolved versions of each package's actual dependencies. This matches Turborepo's smart lockfile hashing behavior.",
+                    "default": false
+                },
+                "summarize": {
+                    "type": "boolean",
+                    "description": "Generate a detailed JSON run summary after execution. When true, writes a summary file to `.task-runner/runs/` containing all task inputs, outputs, hashes, timings, and cache status.\n\nUseful for debugging cache misses and comparing runs. Matches Turborepo's `--summarize` flag.",
+                    "default": false
+                },
+                "targetDefaults": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "object",
+                        "properties": {
+                            "always": {
+                                "type": "boolean",
+                                "description": "When `true`, this target runs after the main task graph completes — even if upstream tasks failed. Useful for cleanup, teardown, notifications, or anything that should fire regardless of build outcome. Always-tasks are not part of the normal dependency graph and never block other tasks."
+                            },
+                            "cache": {
+                                "type": "boolean",
+                                "description": "Whether this target is cacheable"
+                            },
+                            "cacheOnWarning": {
+                                "type": "boolean",
+                                "description": "When `false`, exit-0 runs whose terminal output matched any  {@link  TargetConfiguration.warningPattern }  are not seeded into the cache. Defaults to `true` — warnings are surfaced on the result (`hadWarnings: true`) but caching still happens, matching the \"succeeded with warnings is incremental\" behaviour rush, lage and wireit users have repeatedly asked for."
+                            },
+                            "cacheRestore": {
+                                "type": "object",
+                                "properties": {
+                                    "preserveMtime": {
+                                        "type": "boolean",
+                                        "description": "Restore each file's modification time from the captured tar header (second precision). When `false`, restored files take the current wall-clock time, matching the legacy behaviour."
+                                    },
+                                    "preservePerms": {
+                                        "type": "boolean",
+                                        "description": "Restore each file's POSIX mode bits (rwx triplets, low 12 bits). When `false`, restored files take the process umask. Only meaningful on POSIX hosts; Windows ignores tar mode."
+                                    }
+                                },
+                                "additionalProperties": false,
+                                "description": "Fine-grained controls over how cached outputs are rehydrated. See  {@link  CacheRestoreOptions } . Both fields default to `true` (faithful restore); flip individually when downstream tooling needs the legacy \"now\"-stamped behaviour."
+                            },
+                            "command": {
+                                "type": "string",
+                                "description": "The command to run (alternative to executor)"
+                            },
+                            "configurations": {
+                                "type": "object",
+                                "additionalProperties": {
+                                    "type": "object",
+                                    "additionalProperties": {}
+                                },
+                                "description": "Named configurations (e.g., \"production\", \"development\")"
+                            },
+                            "concurrencyGroup": {
+                                "type": "string",
+                                "description": "Workspace-level concurrency group this target opts into. The scheduler caps the *combined* in-flight count of every task whose target carries the same group name to the value declared in  {@link  TaskRunnerOptions.concurrencyGroups } . Use this when several targets share an external resource (a single Postgres, a developer's Docker daemon, an account-wide deploy lock) so the cap follows the resource, not any single target name.\n\nTargets that name a group not declared in `concurrencyGroups` run uncapped — a typo shouldn't deadlock the graph. Caps don't apply to tasks marked `always: true`; those run in a separate finalisation phase outside the scheduler."
+                            },
+                            "dependsOn": {
+                                "type": "array",
+                                "items": {
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "dependencies": {
+                                                    "type": "boolean",
+                                                    "description": "Whether this is a dependency on the same project"
+                                                },
+                                                "params": {
+                                                    "type": "string",
+                                                    "enum": [
+                                                        "forward",
+                                                        "ignore"
+                                                    ],
+                                                    "description": "Params to pass through"
+                                                },
+                                                "projects": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "string"
+                                                        },
+                                                        {
+                                                            "type": "array",
+                                                            "items": {
+                                                                "type": "string"
+                                                            }
+                                                        }
+                                                    ],
+                                                    "description": "The project name (if different from the current project)"
+                                                },
+                                                "target": {
+                                                    "type": "string",
+                                                    "description": "The target name"
+                                                }
+                                            },
+                                            "required": [
+                                                "target"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "Defines a dependency on another target."
+                                        }
+                                    ]
+                                },
+                                "description": "Other targets this target depends on"
+                            },
+                            "executor": {
+                                "type": "string",
+                                "description": "The executor/command to run"
+                            },
+                            "inputs": {
+                                "type": "array",
+                                "items": {
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "anyOf": [
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "fileset": {
+                                                            "anyOf": [
+                                                                {
+                                                                    "type": "object",
+                                                                    "properties": {
+                                                                        "base": {
+                                                                            "type": "string",
+                                                                            "enum": [
+                                                                                "package",
+                                                                                "workspace"
+                                                                            ],
+                                                                            "description": "Anchor for the pattern."
+                                                                        },
+                                                                        "pattern": {
+                                                                            "type": "string",
+                                                                            "description": "Glob pattern (may start with `!` for negation)."
+                                                                        }
+                                                                    },
+                                                                    "required": [
+                                                                        "base",
+                                                                        "pattern"
+                                                                    ],
+                                                                    "additionalProperties": false,
+                                                                    "description": "Object form of a fileset pattern, for anchoring to the workspace root."
+                                                                },
+                                                                {
+                                                                    "type": "string"
+                                                                }
+                                                            ]
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "fileset"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on file patterns.\n\n`fileset` may be a bare glob string (package-root relative) or an object form `{ pattern, base }` to anchor explicitly to the workspace root. Negation (`!` prefix) works in both forms."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "runtime": {
+                                                            "type": "string"
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "runtime"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on a runtime command."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "env": {
+                                                            "type": "string"
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "env"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on environment variables."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "externalDependencies": {
+                                                            "type": "array",
+                                                            "items": {
+                                                                "type": "string"
+                                                            }
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "externalDependencies"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on external dependency versions."
+                                                }
+                                            ],
+                                            "description": "Defines an input for cache invalidation."
+                                        }
+                                    ]
+                                },
+                                "description": "Input patterns for cache invalidation"
+                            },
+                            "options": {
+                                "type": "object",
+                                "additionalProperties": {},
+                                "description": "Options passed to the executor"
+                            },
+                            "maxConcurrent": {
+                                "type": "number",
+                                "description": "Maximum number of in-flight instances of this target across the whole graph. When set, the scheduler refuses to start an additional task whose `target.target` equals this target's name once the running count reaches `maxConcurrent`. Independent of `--parallel`: the global cap still bounds total in-flight tasks, and `maxConcurrent` further bounds the per-target subset.\n\nUse for tests/deploys that share an external resource (DB, port, mock server). Set to `1` to serialize. Values `<= 0` are ignored.\n\nIf multiple projects declare different values for the same target name, the runner uses the smallest declared cap. Caps don't apply to tasks marked `always: true`; those run in a separate finalisation phase outside the scheduler."
+                            },
+                            "outputs": {
+                                "type": "array",
+                                "items": {
+                                    "type": "string"
+                                },
+                                "description": "Output patterns produced by this target"
+                            },
+                            "parallelism": {
+                                "type": "boolean",
+                                "description": "Whether this target supports parallel execution"
+                            },
+                            "warningPattern": {
+                                "anyOf": [
+                                    {
+                                        "type": "string"
+                                    },
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    }
+                                ],
+                                "description": "Regex source string(s) that mark a successful task as having emitted warnings. The orchestrator scans the task's combined terminal output after a 0-exit and, on first match, sets `hadWarnings` on the result. Combine with `cacheOnWarning: false` to skip caching for warning-tainted runs. Both bare strings and arrays are accepted; arrays are tested in order.\n\n  ```ts   warningPattern: [\"\\\\bwarning\\\\b\", \"TS\\\\d{4}\"]   ```"
+                            },
+                            "when": {
+                                "type": "object",
+                                "properties": {
+                                    "branch": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string"
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string"
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match against the current git branch (HEAD)."
+                                    },
+                                    "ci": {
+                                        "type": "boolean",
+                                        "description": "Run only when invoked inside CI when `true`, only outside CI when `false`. Detects CI via the `CI` env var (the convention GitHub Actions, GitLab, CircleCI, Jenkins, etc. all share)."
+                                    },
+                                    "env": {
+                                        "anyOf": [
+                                            {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string"
+                                                    },
+                                                    {
+                                                        "type": "object",
+                                                        "properties": {
+                                                            "equals": {
+                                                                "type": "string",
+                                                                "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                            },
+                                                            "exists": {
+                                                                "type": "boolean",
+                                                                "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                            },
+                                                            "name": {
+                                                                "type": "string",
+                                                                "description": "Variable name."
+                                                            }
+                                                        },
+                                                        "required": [
+                                                            "name"
+                                                        ],
+                                                        "additionalProperties": false
+                                                    }
+                                                ],
+                                                "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "string"
+                                                        },
+                                                        {
+                                                            "type": "object",
+                                                            "properties": {
+                                                                "equals": {
+                                                                    "type": "string",
+                                                                    "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                },
+                                                                "exists": {
+                                                                    "type": "boolean",
+                                                                    "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                },
+                                                                "name": {
+                                                                    "type": "string",
+                                                                    "description": "Variable name."
+                                                                }
+                                                            },
+                                                            "required": [
+                                                                "name"
+                                                            ],
+                                                            "additionalProperties": false
+                                                        }
+                                                    ],
+                                                    "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match against environment variables. A bare string asserts the variable is set and non-empty; the object form lets you match an exact value or just assert presence/absence."
+                                    },
+                                    "not": {
+                                        "type": "object",
+                                        "properties": {
+                                            "branch": {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string"
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "type": "string"
+                                                        }
+                                                    }
+                                                ]
+                                            },
+                                            "ci": {
+                                                "type": "boolean"
+                                            },
+                                            "env": {
+                                                "anyOf": [
+                                                    {
+                                                        "anyOf": [
+                                                            {
+                                                                "type": "string"
+                                                            },
+                                                            {
+                                                                "type": "object",
+                                                                "properties": {
+                                                                    "equals": {
+                                                                        "type": "string",
+                                                                        "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                    },
+                                                                    "exists": {
+                                                                        "type": "boolean",
+                                                                        "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                    },
+                                                                    "name": {
+                                                                        "type": "string",
+                                                                        "description": "Variable name."
+                                                                    }
+                                                                },
+                                                                "required": [
+                                                                    "name"
+                                                                ],
+                                                                "additionalProperties": false
+                                                            }
+                                                        ],
+                                                        "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "anyOf": [
+                                                                {
+                                                                    "type": "string"
+                                                                },
+                                                                {
+                                                                    "type": "object",
+                                                                    "properties": {
+                                                                        "equals": {
+                                                                            "type": "string",
+                                                                            "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                        },
+                                                                        "exists": {
+                                                                            "type": "boolean",
+                                                                            "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                        },
+                                                                        "name": {
+                                                                            "type": "string",
+                                                                            "description": "Variable name."
+                                                                        }
+                                                                    },
+                                                                    "required": [
+                                                                        "name"
+                                                                    ],
+                                                                    "additionalProperties": false
+                                                                }
+                                                            ],
+                                                            "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                        }
+                                                    }
+                                                ]
+                                            },
+                                            "os": {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string",
+                                                        "enum": [
+                                                            "aix",
+                                                            "darwin",
+                                                            "freebsd",
+                                                            "linux",
+                                                            "openbsd",
+                                                            "sunos",
+                                                            "windows",
+                                                            "win32"
+                                                        ],
+                                                        "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "type": "string",
+                                                            "enum": [
+                                                                "aix",
+                                                                "darwin",
+                                                                "freebsd",
+                                                                "linux",
+                                                                "openbsd",
+                                                                "sunos",
+                                                                "windows",
+                                                                "win32"
+                                                            ],
+                                                            "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                        }
+                                                    }
+                                                ]
+                                            }
+                                        },
+                                        "additionalProperties": false,
+                                        "description": "Negative mirrors. A task runs only when *all* `not.*` clauses fail."
+                                    },
+                                    "os": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string",
+                                                "enum": [
+                                                    "aix",
+                                                    "darwin",
+                                                    "freebsd",
+                                                    "linux",
+                                                    "openbsd",
+                                                    "sunos",
+                                                    "windows",
+                                                    "win32"
+                                                ],
+                                                "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string",
+                                                    "enum": [
+                                                        "aix",
+                                                        "darwin",
+                                                        "freebsd",
+                                                        "linux",
+                                                        "openbsd",
+                                                        "sunos",
+                                                        "windows",
+                                                        "win32"
+                                                    ],
+                                                    "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match `process.platform` (`\"linux\" | \"darwin\" | \"win32\" | \"freebsd\" | \"openbsd\" | \"sunos\" | \"aix\"`). Pass `\"windows\"` as an alias for `\"win32\"` — easier to remember and matches what people type."
+                                    }
+                                },
+                                "additionalProperties": false,
+                                "description": "Predicate that gates execution. When the condition evaluates to `false` for the current environment, the task is skipped (marked `\"skipped\"`, not failed). Combine with `os`, `env`, `branch`, and `ci` clauses for granular control:\n\n  ```ts   when: { os: \"linux\", ci: true, env: \"DEPLOY_TOKEN\" }   ```"
+                            }
+                        },
+                        "additionalProperties": false
+                    },
+                    "description": "Target-specific default configurations"
+                },
+                "untrackedEnvVars": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Environment variables that should be passed to tasks but NOT included in the cache fingerprint. Useful for CI-specific vars. Only used when autoFingerprint is enabled."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Task runner options forwarded verbatim to `defaultTaskRunner`.\n\nIncludes `remoteCache` (HTTP or REAPI gRPC backend), `cacheDirectory`, `parallel`, `globalEnv`, `globalInputs`, etc. See `TaskRunnerOptions` for the full surface."
+        },
+        "toolchain": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+                "preferredManager": {
+                    "type": "string",
+                    "enum": [
+                        "asdf",
+                        "corepack",
+                        "fnm",
+                        "mise",
+                        "none",
+                        "nvm",
+                        "proto",
+                        "volta"
+                    ]
+                },
+                "autoInstall": {
+                    "type": "boolean",
+                    "description": "When a tool pin doesn't match the running version, try to fix it automatically before `vis run` / `vis ci` proceed. Defaults to `true` when  {@link  findInstalledManagers }  reports at least one installed manager, `false` otherwise.\n\nSet to `false` to keep the doctor-style warning behaviour and make users run `vis toolchain install` themselves."
+                },
+                "tools": {
+                    "type": "object",
+                    "properties": {
+                        "bun": {
+                            "type": "string"
+                        },
+                        "deno": {
+                            "type": "string"
+                        },
+                        "go": {
+                            "type": "string"
+                        },
+                        "node": {
+                            "type": "string"
+                        },
+                        "npm": {
+                            "type": "string"
+                        },
+                        "pnpm": {
+                            "type": "string"
+                        },
+                        "python": {
+                            "type": "string"
+                        },
+                        "ruby": {
+                            "type": "string"
+                        },
+                        "rust": {
+                            "type": "string"
+                        },
+                        "yarn": {
+                            "type": "string"
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Overrides for engines/packageManager-derived pins."
+                }
+            },
+            "description": "Toolchain (Node / pnpm / python / rust / ...) management. vis delegates to whichever version manager (proto, mise, fnm, volta, asdf, nvm, corepack) the developer already has — it does not ship its own.\n\nRe-exported from `./toolchain` so the public config type stays in lockstep with the resolver implementation. `self-activate` is narrowed out of `preferredManager` here — it's auto-resolved for pnpm/yarn `packageManager` pins and isn't meaningful as an override."
+        },
+        "tui": {
+            "type": "object",
+            "properties": {
+                "autoExit": {
+                    "type": [
+                        "boolean",
+                        "number"
+                    ],
+                    "description": "Auto-exit the TUI after tasks complete.\n- `false`: Stay open until the user presses `q` (default)\n- `true`: Show quit dialog with 3-second countdown after completion\n- `number`: Show quit dialog with custom countdown in seconds"
+                }
+            },
+            "additionalProperties": false,
+            "description": "Terminal UI configuration"
+        },
+        "update": {
+            "type": "object",
+            "properties": {
+                "depFields": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Dependency fields to scan for outdated packages. Beyond the standard fields, supports:\n- `\"overrides\"` (npm)\n- `\"resolutions\"` (yarn)\n- `\"pnpm.overrides\"`",
+                    "default": [
+                        "dependencies",
+                        "devDependencies",
+                        "optionalDependencies",
+                        "peerDependencies"
+                    ]
+                },
+                "exclude": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "format": {
+                    "type": "string",
+                    "enum": [
+                        "json",
+                        "minimal",
+                        "table"
+                    ]
+                },
+                "ignore": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Package names or glob patterns to permanently ignore during updates. Ignored packages are skipped and listed in the output so you know they were not checked.",
+                    "examples": [
+                        [
+                            "eslint",
+                            "@types/*"
+                        ]
+                    ]
+                },
+                "include": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "includeLocked": {
+                    "type": "boolean",
+                    "description": "Include packages with pinned/exact versions (no `^` or `~` prefix). By default, pinned versions are skipped during update checks.",
+                    "default": false
+                },
+                "install": {
+                    "type": "boolean"
+                },
+                "maxConcurrentRequests": {
+                    "type": "number",
+                    "description": "Maximum number of concurrent registry requests during outdated checks. Higher values speed up large workspaces but risk hitting registry rate limits or self-hosted Verdaccio caps.",
+                    "default": 8
+                },
+                "minimumReleaseAge": {
+                    "type": "number",
+                    "description": "Minimum number of minutes since a version was published before vis will consider it for updates. This mirrors pnpm's `minimumReleaseAge` — a single setting that applies to both install and update.\n\nNot set by default. If your package manager config (`pnpm-workspace.yaml`) has `minimumReleaseAge`, vis will read it from there as a fallback.",
+                    "examples": [
+                        1440
+                    ]
+                },
+                "minimumReleaseAgeExclude": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Package names/patterns excluded from the minimumReleaseAge check.",
+                    "examples": [
+                        [
+                            "webpack",
+                            "@myorg/*"
+                        ]
+                    ]
+                },
+                "packageMode": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string",
+                        "enum": [
+                            "latest",
+                            "minor",
+                            "patch"
+                        ]
+                    },
+                    "description": "Per-package or per-pattern update target overrides. Keys are exact package names, glob patterns, or regex patterns wrapped in `/` (e.g., `/^@vue/`). Values are `\"latest\"`, `\"minor\"`, or `\"patch\"`.",
+                    "examples": [
+                        {
+                            "typescript": "minor",
+                            "/^@vue/": "patch"
+                        }
+                    ]
+                },
+                "prerelease": {
+                    "type": "boolean"
+                },
+                "releaseChannel": {
+                    "type": "string",
+                    "enum": [
+                        "any",
+                        "same",
+                        "stable"
+                    ],
+                    "description": "Which release channels to consider when picking the target version.\n- `\"stable\"` (default) — only ship stable releases (no prereleases).\n- `\"same\"` — match the prerelease channel of the *current* range:   if you're on `react@19.0.0-rc.1`, only `rc.*` candidates qualify;   if you're on a stable, only stable candidates. Prevents   accidentally promoting a prerelease pin to a stable major bump.\n- `\"any\"` — equivalent to `--prerelease`. Any channel is fair game.\n\n`--release-channel` on the CLI overrides this. If `prerelease: true` is set without `releaseChannel`, vis treats it as `\"any\"`.",
+                    "default": "stable"
+                },
+                "security": {
+                    "type": "boolean"
+                },
+                "target": {
+                    "type": "string",
+                    "enum": [
+                        "latest",
+                        "minor",
+                        "patch"
+                    ]
+                }
+            },
+            "additionalProperties": false,
+            "description": "Update command defaults"
+        },
+        "versionConstraint": {
+            "type": "string",
+            "description": "Minimum vis CLI version required by this workspace. When the running vis binary is older than this constraint, vis exits with an actionable error before executing any command.\n\nAccepts a semver range string (e.g. `\">=1.0.0\"`, `\"^1.2.0\"`).",
+            "examples": [
+                ">=1.0.0"
+            ]
+        }
+    },
+    "additionalProperties": false,
+    "$defs": {
+        "CodeownersConfig": {
+            "type": "object",
+            "properties": {
+                "globalPaths": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        }
+                    },
+                    "description": "Workspace-level paths that apply outside any project (e.g., `.github/**`)."
+                },
+                "orderBy": {
+                    "type": "string",
+                    "enum": [
+                        "file-source",
+                        "project-id"
+                    ],
+                    "description": "Sort order for generated entries — mirrors moon's `orderBy`."
+                },
+                "provider": {
+                    "type": "string",
+                    "enum": [
+                        "bitbucket",
+                        "github",
+                        "gitlab",
+                        "other"
+                    ],
+                    "description": "Provider determines whether `channel` is emitted (GitHub supports it via comment)."
+                }
+            },
+            "additionalProperties": false
+        },
+        "VisPlugin": {
+            "type": "object",
+            "properties": {
+                "hooks": {
+                    "type": "object",
+                    "properties": {
+                        "run:after": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired after the entire task graph completes (including any failures). `results` maps task ID →  {@link  TaskResult } ."
+                            }
+                        },
+                        "run:before": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired once before any task in the graph starts, after workspace discovery and graph construction. Throwing aborts the run."
+                            }
+                        },
+                        "service:attach": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired after `vis run` auto-attaches to one or more registered services. `taskIds` lists the in-graph dependents that consumed the service's `env` block; an empty array means the service was registered but no kept task depended on it."
+                            }
+                        },
+                        "service:start": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired after a service is registered and its readiness probe succeeds. Sourced from both `vis service start` (and `restart`'s post-start phase) and any future programmatic call sites."
+                            }
+                        },
+                        "service:stop": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired after a registered service is stopped (SIGTERM/SIGKILL acknowledged, registry entry deleted). Not fired when stop is called against an unknown id — only when there was an alive entry to terminate."
+                            }
+                        },
+                        "task:after": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired after a task completes (success, failure, or cache hit). Receives the final  {@link  TaskResult } ."
+                            }
+                        },
+                        "task:before": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired before each task begins execution — after scheduling, before the executor runs the command. Throwing aborts that single task."
+                            }
+                        },
+                        "task:cacheHit": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired when a task hit the local or remote cache."
+                            }
+                        },
+                        "task:cacheMiss": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired when auto-fingerprint cache diagnostics reports a miss, carrying the human-readable reason string."
+                            }
+                        },
+                        "task:failure": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired when a task exits non-zero."
+                            }
+                        },
+                        "task:fingerprint": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired during fingerprint construction, after built-in inputs are gathered and before the hash is sealed. Plugins call `contributor.contribute(key, value)` to mix arbitrary strings into the task hash — the hasher namespaces and sorts contributions deterministically so call order doesn't change the result.\n\nThrowing aborts hashing for the offending task and surfaces as a task failure before any cache lookup runs. Use this to guarantee a buggy plugin can't quietly poison cache state."
+                            }
+                        },
+                        "task:retry": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired right before a failed task is re-spawned by the retry controller. `attempt` is 1-indexed and counts the retry that's about to start (so the original failed run was attempt 0). `prevExitCode` is the failing exit status that triggered the retry (the full TaskResult isn't materialized at the retry boundary — only the per-attempt close event is available).\n\nThrowing aborts the retry; the previous failure becomes the final result."
+                            }
+                        },
+                        "task:stderr": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired with a stderr chunk as a running task emits it. Plugins that ship logs live (Slack, Datadog) should prefer this over `task:after` so they don't wait for the full buffer."
+                            }
+                        },
+                        "task:stdout": {
+                            "type": "array",
+                            "items": {
+                                "not": {},
+                                "description": "Fired with a stdout chunk as a running task emits it. See `task:stderr` for semantics."
+                            }
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Declarative handlers — the common shape. One entry per hook name; pass a function or an array of functions (all run serially in order)."
+                },
+                "name": {
+                    "type": "string",
+                    "description": "Plugin name — surfaced in debug logs."
+                }
+            },
+            "required": [
+                "name"
+            ],
+            "additionalProperties": false,
+            "description": "Public plugin contract. Implementations register handlers by returning a partial  {@link  VisHooks }  map from `hooks`, or by mutating the Hookable instance directly via `setup(hooks)` for advanced cases (dynamic registration, removeHook, etc.).\n\nPlugins are loaded in the order they appear in `visConfig.plugins`. Handler execution order within a hook follows registration order, so earlier plugins see events first."
+        },
+        "ExtraCustomType": {
+            "type": "object",
+            "properties": {
+                "depName": {
+                    "type": "string",
+                    "description": "Required when `strategy === \"string\"`. The dep-cluster key the bare version string at `path` should be associated with."
+                },
+                "name": {
+                    "type": "string",
+                    "description": "Display name for this customType. Used as the cluster key prefix in lint output and JSON. Must not collide with the built-in names."
+                },
+                "path": {
+                    "type": "string",
+                    "description": "Dot-separated walk into package.json (e.g. `pnpm.overrides`, `myTool.runtime`)."
+                },
+                "strategy": {
+                    "type": "string",
+                    "enum": [
+                        "name@version",
+                        "name~version",
+                        "string",
+                        "versionsByName"
+                    ],
+                    "description": "How to interpret the JSON found at `path`.\n- `name@version` — single string `pnpm@9.0.0` (with optional `+sha512.…` hash).\n- `name~version` — single string `node~20.0.0`, mirrors syncpack's tilde form.\n- `string` — bare version literal (requires `depName`).\n- `versionsByName` — `{ name: version }` object such as `engines`."
+                }
+            },
+            "required": [
+                "name",
+                "path",
+                "strategy"
+            ],
+            "additionalProperties": false,
+            "description": "One user-declared customTypes entry. See `policy.customTypes.extraTypes` for the full contract — this is just the row shape."
+        },
+        "SimilarDepFamily": {
+            "type": "object",
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "description": "Stable id; used in report output and config overrides."
+                },
+                "label": {
+                    "type": "string",
+                    "description": "Pretty label for the report. Defaults to `id` when omitted."
+                },
+                "members": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Dep names that belong to this family verbatim."
+                },
+                "prefixes": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Dep-name prefixes (literal, no glob). Match if `depName.startsWith(prefix)`."
+                }
+            },
+            "required": [
+                "id"
+            ],
+            "additionalProperties": false,
+            "description": "One family of upstream-coupled packages.\n\n`members` is an exact-match list. `prefixes` accept any dep whose name starts with the prefix — useful for monorepos that ship many subpackages under one scope (e.g. `@babel/`, `@storybook/`, `@nx/`). A family can use either or both; a dep matching either list belongs to the family."
+        },
+        "PolicyName": {
+            "type": "string",
+            "enum": [
+                "firstSeen",
+                "installScripts",
+                "license",
+                "malware",
+                "publisherChange",
+                "score",
+                "unexpectedDeps",
+                "vulnerability"
+            ]
+        },
+        "StagedConfig": {
+            "type": "object",
+            "additionalProperties": {
+                "$ref": "#/$defs/StagedTask"
+            },
+            "description": "Config object mapping glob patterns (basename or path-style) to tasks. A top-level function form lets the user generate the entire config from the staged file list."
+        },
+        "StagedTask": {
+            "anyOf": [
+                {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                {
+                    "type": "string"
+                },
+                {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            ],
+            "description": "A task value as authored by the user. Command strings are split into argv and invoked with the matched file paths appended. Arrays run serially. Functions receive the matched paths and return further task values (possibly async). `{ title, task }` objects run `task` directly with no argv construction."
+        },
+        "VisTargetOptions": {
+            "type": "object",
+            "properties": {
+                "affectedFiles": {
+                    "$ref": "#/$defs/AffectedFilesMode",
+                    "description": "How to forward affected files to the task process. Only used when invoked via `vis affected &lt;target>`.",
+                    "default": false
+                },
+                "envFile": {
+                    "anyOf": [
+                        {
+                            "type": "boolean"
+                        },
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    ],
+                    "description": "Load environment variables from dotenv file(s) before running.\n- `string`: a single file path (relative to project root).\n- `string[]`: multiple files — later entries override earlier ones,   so put more-specific files last (e.g. `[\".env\", \".env.local\"]`).\n- `true`: auto-cascade in the Next/Vite order:   `.env` → `.env.{NODE_ENV}` → `.env.local` → `.env.{NODE_ENV}.local`.   Skips `.env.local` when NODE_ENV is `test`, matching Next.js."
+                },
+                "interactive": {
+                    "type": "boolean",
+                    "description": "When true, the task is serialized with respect to parallel execution and must be run on the main process (claims stdin). Used for commands that read from the terminal.",
+                    "default": false
+                },
+                "internal": {
+                    "type": "boolean",
+                    "description": "When true, the task is hidden from CLI listings and can only be invoked as a dependency of another task.",
+                    "default": false
+                },
+                "killGracePeriodMs": {
+                    "type": "number",
+                    "description": "Milliseconds the timeout watchdog waits between sending SIGTERM and SIGKILL when the `timeout` budget fires. Tasks that ignore SIGTERM (e.g. test runners holding open child processes) get force-killed after this grace window so a stuck task can't outlive its budget.\n\nSet to `0` to skip escalation and rely on SIGTERM only.",
+                    "default": 5000
+                },
+                "mutex": {
+                    "type": "string",
+                    "description": "Serializes all tasks that share the same mutex name. Useful for tasks that contend on a shared resource (e.g., a database migration)."
+                },
+                "outputStyle": {
+                    "type": "string",
+                    "enum": [
+                        "normal",
+                        "quiet"
+                    ],
+                    "description": "Per-target output verbosity. Overrides the global `--output-style` flag for this specific target.\n\n- `\"normal\"` (default): print every task's terminal output\n- `\"quiet\"`: only print output when the task fails. Successful   and cached tasks contribute their status line and timing, but   their captured stdout/stderr is suppressed.\n\nUseful when a routinely-noisy task (a linter or test runner with verbose progress output) should stay quiet during green builds but reveal everything when it fails."
+                },
+                "persistent": {
+                    "type": "boolean",
+                    "description": "When true, the task is a long-running / never-ending process. Persistent tasks are scheduled last, execute after all cacheable tasks complete, and are never cached.",
+                    "default": false
+                },
+                "preset": {
+                    "$ref": "#/$defs/TargetPreset",
+                    "description": "A preset that pre-fills a common bundle of options. User-provided fields always take precedence over the preset."
+                },
+                "pty": {
+                    "type": "boolean",
+                    "description": "Run the task through a pseudo-terminal so color-aware tools (vitest, eslint, biome, …) render as if attached to a real TTY instead of a pipe. Output is captured via task-runner's `TerminalBuffer` so ANSI escapes are normalized into the final rendered state before reaching the reporter.\n\nForces cache to off — PTY output can include timing-dependent frames (spinners) that aren't safe to replay from a cache.",
+                    "default": false
+                },
+                "retryCount": {
+                    "type": "number",
+                    "description": "Number of times to retry the task on failure. Uses an exponential backoff by default (1s, 2s, 4s, ...).",
+                    "default": 0
+                },
+                "retryDelay": {
+                    "anyOf": [
+                        {
+                            "type": "number"
+                        },
+                        {
+                            "type": "string",
+                            "const": "exponential"
+                        }
+                    ],
+                    "description": "Delay between retry attempts in milliseconds, or `\"exponential\"` for 2^attempt * 1000 ms.",
+                    "default": "exponential"
+                },
+                "runFromWorkspaceRoot": {
+                    "type": "boolean",
+                    "description": "When true, the command executes with the workspace root as CWD instead of the project root.",
+                    "default": false
+                },
+                "runInCI": {
+                    "$ref": "#/$defs/RunInCI",
+                    "description": "Controls whether the task runs in CI environments.",
+                    "default": true
+                },
+                "runnerTags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Capability tags that gate this task to runners advertising the same tag. The CLI's `--runner-tags=gpu,slow` flag (or `VIS_RUNNER_TAGS` env var) tells vis what the current runner supports; tasks whose `runnerTags` share at least one tag with the runner set are eligible. Untagged tasks (no `runnerTags` or an empty array) are general-purpose and always run.\n\nUse this for special-purpose CI lanes — e.g. a GPU runner that should only pick up visual-regression suites, or a nightly job that runs `slow` integration tests. When neither flag nor env is set, the filter is inactive and every task runs."
+                },
+                "service": {
+                    "$ref": "#/$defs/ServiceConfig",
+                    "description": "Marks this target as a long-lived service that can be started via `vis service start &lt;id>` and auto-attached when other tasks declare it in `dependsOn`. Implies persistent + non-cacheable behaviour (set `preset: \"server\"` to inherit the rest of the bundle).\n\nThe presence of this block — not `preset: \"server\"` alone — is what makes a target eligible for the cross-invocation registry. `preset: \"server\"` without `service` keeps today's in-run-only behaviour."
+                },
+                "shell": {
+                    "type": "string",
+                    "description": "Per-target shell override. When set, the command runs through this shell instead of the platform default."
+                },
+                "strictEnv": {
+                    "type": "boolean",
+                    "description": "Override the workspace `strictEnv` setting for this target. When truthy, the target fails if its command references an env var that resolves to neither the task's effective env nor `process.env`. When `false`, the target opts out of a workspace `strictEnv: true` (e.g. for a one-off command that legitimately tolerates an unset variable)."
+                },
+                "timeout": {
+                    "type": "number",
+                    "description": "Maximum wall-clock milliseconds a single task run is allowed to take before being killed. `0` / `undefined` means no timeout.\n\nWhen the timeout fires the task is sent SIGTERM and, if it has not exited within `killGracePeriodMs`, SIGKILL. The task exits with a failure status carrying the `[timeout]` marker in `terminalOutput`. Retries count per-attempt, not cumulatively.\n\nUse this to prevent runaway tasks from eating CI wall-clock time up to the job-level cutoff."
+                },
+                "unixShell": {
+                    "type": "string",
+                    "description": "Per-target unix shell override, used on Linux and macOS. Takes precedence over `shell` on unix-like systems."
+                },
+                "windowsShell": {
+                    "type": "string",
+                    "description": "Per-target windows shell override, used on Windows. Takes precedence over `shell` on Windows."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Vis-specific target options that extend the task-runner's base `TargetConfiguration`. These live under `target.options` and are interpreted by vis before handing the task off to task-runner.\n\nConditional execution (`when:`) and finally tasks (`always:`) live at the target top level, not under `options` — they're handled by the task-runner orchestrator. See `@visulima/task-runner`'s `WhenCondition`."
+        },
+        "AffectedFilesMode": {
+            "type": [
+                "string",
+                "boolean"
+            ],
+            "enum": [
+                "args",
+                "both",
+                "env",
+                false
+            ],
+            "description": "Controls how affected files are forwarded to a task.\n- `false` (default): Do not forward.\n- `\"args\"`: Append affected paths as additional command arguments.\n- `\"env\"`: Expose them via `VIS_AFFECTED_FILES` environment variable.\n- `\"both\"`: Both of the above."
+        },
+        "TargetPreset": {
+            "type": "string",
+            "enum": [
+                "server",
+                "utility"
+            ],
+            "description": "Preset bundles of target options.\n- `server`: Long-running local dev server — caching off, not in CI,   interactive, persistent.\n- `utility`: Short-lived helper — caching off, not in CI."
+        },
+        "RunInCI": {
+            "anyOf": [
+                {
+                    "type": "string",
+                    "const": "affected"
+                },
+                {
+                    "type": "string",
+                    "const": "always"
+                },
+                {
+                    "type": "boolean"
+                }
+            ],
+            "description": "Controls whether a target runs in CI.\n- `true` (default): Always run.\n- `false`: Never run in CI (local-only).\n- `\"affected\"`: Only when the project is affected by the current change set.\n- `\"always\"`: Always run, even if unaffected."
+        },
+        "ServiceConfig": {
+            "type": "object",
+            "properties": {
+                "env": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "Env vars to expose to dependent tasks when this service is registered. Merged into the dependent task's env after the task's own envFile and before the task's explicit `env` overrides — the dependent task wins on key collisions.\n\nNote: only this `env` map propagates to dependents. The service target's own `envFile` is loaded into the **service process** at start time but is *not* forwarded — dependents must declare any shared values they need either here or in their own envFile. This boundary is intentional: envFiles often contain operator-only secrets (deploy keys, admin tokens) that should not leak into downstream test commands."
+                },
+                "killGracePeriodMs": {
+                    "type": "number",
+                    "description": "Grace period in milliseconds between SIGTERM and SIGKILL when the service is stopped.",
+                    "default": 5000
+                },
+                "port": {
+                    "type": "number",
+                    "description": "Optional port the service listens on. Used as the default for `readiness.tcp.port` when no explicit probe is configured, and surfaced by `vis service list`."
+                },
+                "readiness": {
+                    "type": "object",
+                    "properties": {
+                        "tcp": {
+                            "type": "object",
+                            "properties": {
+                                "host": {
+                                    "type": "string"
+                                },
+                                "port": {
+                                    "type": "number"
+                                },
+                                "timeoutMs": {
+                                    "type": "number"
+                                }
+                            },
+                            "required": [
+                                "port"
+                            ],
+                            "additionalProperties": false
+                        }
+                    },
+                    "required": [
+                        "tcp"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Readiness probe configuration. v1 supports TCP only."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Configuration block declared on a target to mark it as a long-lived \"service\" — eligible to be started/stopped via `vis service` and auto-attached when other tasks depend on it.\n\nTargets must also carry `preset: \"server\"` (or the equivalent `persistent: true`) for the service-mode lifecycle to apply."
+        },
+        "TargetType": {
+            "type": "string",
+            "enum": [
+                "build",
+                "run",
+                "test"
+            ],
+            "description": "Semantic classification for a target.\n- `build`: Generates one or more artifacts; cached by default.\n- `test`: Validation task (lint, typecheck, unit test). Default type.\n- `run`: One-off or long-running process. Not cached by default."
+        },
+        "ScopedTasksBlock": {
+            "type": "object",
+            "properties": {
+                "match": {
+                    "$ref": "#/$defs/ScopedTasksMatch",
+                    "description": "Optional match predicate; if omitted, the block applies universally."
+                },
+                "tasks": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "object",
+                        "properties": {
+                            "aliases": {
+                                "type": "array",
+                                "items": {
+                                    "type": "string"
+                                },
+                                "description": "Alternate names that resolve to this target on the CLI. Useful for shortening long canonical names (`test` ↔ `t`) or for offering migration-friendly aliases when renaming targets. Aliases must be globally unique within the workspace."
+                            },
+                            "description": {
+                                "type": "string",
+                                "description": "One-line description surfaced by `vis list` and (in future) per-task `--help`. Kept short — longer docs belong in project READMEs or vis.config.ts comments."
+                            },
+                            "inferred": {
+                                "type": "boolean",
+                                "description": "True when the target was synthesized by a Project Crystal-style detector (see  {@link  ../inference } ) rather than declared by a package.json script, project.json, or vis.task.ts file. Surfaced by `vis list --inferred` and used by tooling to distinguish implicit defaults from explicit user intent."
+                            },
+                            "options": {
+                                "$ref": "#/$defs/VisTargetOptions",
+                                "description": "Vis-specific target options."
+                            },
+                            "preset": {
+                                "$ref": "#/$defs/TargetPreset",
+                                "description": "Preset applied before user-specified options."
+                            },
+                            "type": {
+                                "$ref": "#/$defs/TargetType",
+                                "description": "Semantic task type. Affects caching defaults and CI filtering.",
+                                "default": "test"
+                            },
+                            "always": {
+                                "type": "boolean",
+                                "description": "When `true`, this target runs after the main task graph completes — even if upstream tasks failed. Useful for cleanup, teardown, notifications, or anything that should fire regardless of build outcome. Always-tasks are not part of the normal dependency graph and never block other tasks."
+                            },
+                            "cache": {
+                                "type": "boolean",
+                                "description": "Whether this target is cacheable"
+                            },
+                            "cacheOnWarning": {
+                                "type": "boolean",
+                                "description": "When `false`, exit-0 runs whose terminal output matched any  {@link  TargetConfiguration.warningPattern }  are not seeded into the cache. Defaults to `true` — warnings are surfaced on the result (`hadWarnings: true`) but caching still happens, matching the \"succeeded with warnings is incremental\" behaviour rush, lage and wireit users have repeatedly asked for."
+                            },
+                            "cacheRestore": {
+                                "type": "object",
+                                "properties": {
+                                    "preserveMtime": {
+                                        "type": "boolean",
+                                        "description": "Restore each file's modification time from the captured tar header (second precision). When `false`, restored files take the current wall-clock time, matching the legacy behaviour."
+                                    },
+                                    "preservePerms": {
+                                        "type": "boolean",
+                                        "description": "Restore each file's POSIX mode bits (rwx triplets, low 12 bits). When `false`, restored files take the process umask. Only meaningful on POSIX hosts; Windows ignores tar mode."
+                                    }
+                                },
+                                "additionalProperties": false,
+                                "description": "Fine-grained controls over how cached outputs are rehydrated. See  {@link  CacheRestoreOptions } . Both fields default to `true` (faithful restore); flip individually when downstream tooling needs the legacy \"now\"-stamped behaviour."
+                            },
+                            "command": {
+                                "type": "string",
+                                "description": "The command to run (alternative to executor)"
+                            },
+                            "configurations": {
+                                "type": "object",
+                                "additionalProperties": {
+                                    "type": "object",
+                                    "additionalProperties": {}
+                                },
+                                "description": "Named configurations (e.g., \"production\", \"development\")"
+                            },
+                            "concurrencyGroup": {
+                                "type": "string",
+                                "description": "Workspace-level concurrency group this target opts into. The scheduler caps the *combined* in-flight count of every task whose target carries the same group name to the value declared in  {@link  TaskRunnerOptions.concurrencyGroups } . Use this when several targets share an external resource (a single Postgres, a developer's Docker daemon, an account-wide deploy lock) so the cap follows the resource, not any single target name.\n\nTargets that name a group not declared in `concurrencyGroups` run uncapped — a typo shouldn't deadlock the graph. Caps don't apply to tasks marked `always: true`; those run in a separate finalisation phase outside the scheduler."
+                            },
+                            "dependsOn": {
+                                "type": "array",
+                                "items": {
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "dependencies": {
+                                                    "type": "boolean",
+                                                    "description": "Whether this is a dependency on the same project"
+                                                },
+                                                "params": {
+                                                    "type": "string",
+                                                    "enum": [
+                                                        "forward",
+                                                        "ignore"
+                                                    ],
+                                                    "description": "Params to pass through"
+                                                },
+                                                "projects": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "string"
+                                                        },
+                                                        {
+                                                            "type": "array",
+                                                            "items": {
+                                                                "type": "string"
+                                                            }
+                                                        }
+                                                    ],
+                                                    "description": "The project name (if different from the current project)"
+                                                },
+                                                "target": {
+                                                    "type": "string",
+                                                    "description": "The target name"
+                                                }
+                                            },
+                                            "required": [
+                                                "target"
+                                            ],
+                                            "additionalProperties": false,
+                                            "description": "Defines a dependency on another target."
+                                        }
+                                    ]
+                                },
+                                "description": "Other targets this target depends on"
+                            },
+                            "executor": {
+                                "type": "string",
+                                "description": "The executor/command to run"
+                            },
+                            "inputs": {
+                                "type": "array",
+                                "items": {
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "anyOf": [
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "fileset": {
+                                                            "anyOf": [
+                                                                {
+                                                                    "type": "object",
+                                                                    "properties": {
+                                                                        "base": {
+                                                                            "type": "string",
+                                                                            "enum": [
+                                                                                "package",
+                                                                                "workspace"
+                                                                            ],
+                                                                            "description": "Anchor for the pattern."
+                                                                        },
+                                                                        "pattern": {
+                                                                            "type": "string",
+                                                                            "description": "Glob pattern (may start with `!` for negation)."
+                                                                        }
+                                                                    },
+                                                                    "required": [
+                                                                        "base",
+                                                                        "pattern"
+                                                                    ],
+                                                                    "additionalProperties": false,
+                                                                    "description": "Object form of a fileset pattern, for anchoring to the workspace root."
+                                                                },
+                                                                {
+                                                                    "type": "string"
+                                                                }
+                                                            ]
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "fileset"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on file patterns.\n\n`fileset` may be a bare glob string (package-root relative) or an object form `{ pattern, base }` to anchor explicitly to the workspace root. Negation (`!` prefix) works in both forms."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "runtime": {
+                                                            "type": "string"
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "runtime"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on a runtime command."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "env": {
+                                                            "type": "string"
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "env"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on environment variables."
+                                                },
+                                                {
+                                                    "type": "object",
+                                                    "properties": {
+                                                        "externalDependencies": {
+                                                            "type": "array",
+                                                            "items": {
+                                                                "type": "string"
+                                                            }
+                                                        }
+                                                    },
+                                                    "required": [
+                                                        "externalDependencies"
+                                                    ],
+                                                    "additionalProperties": false,
+                                                    "description": "An input based on external dependency versions."
+                                                }
+                                            ],
+                                            "description": "Defines an input for cache invalidation."
+                                        }
+                                    ]
+                                },
+                                "description": "Input patterns for cache invalidation"
+                            },
+                            "maxConcurrent": {
+                                "type": "number",
+                                "description": "Maximum number of in-flight instances of this target across the whole graph. When set, the scheduler refuses to start an additional task whose `target.target` equals this target's name once the running count reaches `maxConcurrent`. Independent of `--parallel`: the global cap still bounds total in-flight tasks, and `maxConcurrent` further bounds the per-target subset.\n\nUse for tests/deploys that share an external resource (DB, port, mock server). Set to `1` to serialize. Values `<= 0` are ignored.\n\nIf multiple projects declare different values for the same target name, the runner uses the smallest declared cap. Caps don't apply to tasks marked `always: true`; those run in a separate finalisation phase outside the scheduler."
+                            },
+                            "outputs": {
+                                "type": "array",
+                                "items": {
+                                    "type": "string"
+                                },
+                                "description": "Output patterns produced by this target"
+                            },
+                            "parallelism": {
+                                "type": "boolean",
+                                "description": "Whether this target supports parallel execution"
+                            },
+                            "warningPattern": {
+                                "anyOf": [
+                                    {
+                                        "type": "string"
+                                    },
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    }
+                                ],
+                                "description": "Regex source string(s) that mark a successful task as having emitted warnings. The orchestrator scans the task's combined terminal output after a 0-exit and, on first match, sets `hadWarnings` on the result. Combine with `cacheOnWarning: false` to skip caching for warning-tainted runs. Both bare strings and arrays are accepted; arrays are tested in order.\n\n  ```ts   warningPattern: [\"\\\\bwarning\\\\b\", \"TS\\\\d{4}\"]   ```"
+                            },
+                            "when": {
+                                "type": "object",
+                                "properties": {
+                                    "branch": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string"
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string"
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match against the current git branch (HEAD)."
+                                    },
+                                    "ci": {
+                                        "type": "boolean",
+                                        "description": "Run only when invoked inside CI when `true`, only outside CI when `false`. Detects CI via the `CI` env var (the convention GitHub Actions, GitLab, CircleCI, Jenkins, etc. all share)."
+                                    },
+                                    "env": {
+                                        "anyOf": [
+                                            {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string"
+                                                    },
+                                                    {
+                                                        "type": "object",
+                                                        "properties": {
+                                                            "equals": {
+                                                                "type": "string",
+                                                                "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                            },
+                                                            "exists": {
+                                                                "type": "boolean",
+                                                                "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                            },
+                                                            "name": {
+                                                                "type": "string",
+                                                                "description": "Variable name."
+                                                            }
+                                                        },
+                                                        "required": [
+                                                            "name"
+                                                        ],
+                                                        "additionalProperties": false
+                                                    }
+                                                ],
+                                                "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "anyOf": [
+                                                        {
+                                                            "type": "string"
+                                                        },
+                                                        {
+                                                            "type": "object",
+                                                            "properties": {
+                                                                "equals": {
+                                                                    "type": "string",
+                                                                    "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                },
+                                                                "exists": {
+                                                                    "type": "boolean",
+                                                                    "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                },
+                                                                "name": {
+                                                                    "type": "string",
+                                                                    "description": "Variable name."
+                                                                }
+                                                            },
+                                                            "required": [
+                                                                "name"
+                                                            ],
+                                                            "additionalProperties": false
+                                                        }
+                                                    ],
+                                                    "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match against environment variables. A bare string asserts the variable is set and non-empty; the object form lets you match an exact value or just assert presence/absence."
+                                    },
+                                    "not": {
+                                        "type": "object",
+                                        "properties": {
+                                            "branch": {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string"
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "type": "string"
+                                                        }
+                                                    }
+                                                ]
+                                            },
+                                            "ci": {
+                                                "type": "boolean"
+                                            },
+                                            "env": {
+                                                "anyOf": [
+                                                    {
+                                                        "anyOf": [
+                                                            {
+                                                                "type": "string"
+                                                            },
+                                                            {
+                                                                "type": "object",
+                                                                "properties": {
+                                                                    "equals": {
+                                                                        "type": "string",
+                                                                        "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                    },
+                                                                    "exists": {
+                                                                        "type": "boolean",
+                                                                        "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                    },
+                                                                    "name": {
+                                                                        "type": "string",
+                                                                        "description": "Variable name."
+                                                                    }
+                                                                },
+                                                                "required": [
+                                                                    "name"
+                                                                ],
+                                                                "additionalProperties": false
+                                                            }
+                                                        ],
+                                                        "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "anyOf": [
+                                                                {
+                                                                    "type": "string"
+                                                                },
+                                                                {
+                                                                    "type": "object",
+                                                                    "properties": {
+                                                                        "equals": {
+                                                                            "type": "string",
+                                                                            "description": "Match this exact value. Mutually exclusive with `exists`."
+                                                                        },
+                                                                        "exists": {
+                                                                            "type": "boolean",
+                                                                            "description": "Assert the variable is set & non-empty (`true`) or unset/empty (`false`)."
+                                                                        },
+                                                                        "name": {
+                                                                            "type": "string",
+                                                                            "description": "Variable name."
+                                                                        }
+                                                                    },
+                                                                    "required": [
+                                                                        "name"
+                                                                    ],
+                                                                    "additionalProperties": false
+                                                                }
+                                                            ],
+                                                            "description": "An environment-variable match. The string form is shorthand for `{ name, exists: true }` (set + non-empty). The object form supports either presence assertions or exact-value matching."
+                                                        }
+                                                    }
+                                                ]
+                                            },
+                                            "os": {
+                                                "anyOf": [
+                                                    {
+                                                        "type": "string",
+                                                        "enum": [
+                                                            "aix",
+                                                            "darwin",
+                                                            "freebsd",
+                                                            "linux",
+                                                            "openbsd",
+                                                            "sunos",
+                                                            "windows",
+                                                            "win32"
+                                                        ],
+                                                        "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                    },
+                                                    {
+                                                        "type": "array",
+                                                        "items": {
+                                                            "type": "string",
+                                                            "enum": [
+                                                                "aix",
+                                                                "darwin",
+                                                                "freebsd",
+                                                                "linux",
+                                                                "openbsd",
+                                                                "sunos",
+                                                                "windows",
+                                                                "win32"
+                                                            ],
+                                                            "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                        }
+                                                    }
+                                                ]
+                                            }
+                                        },
+                                        "additionalProperties": false,
+                                        "description": "Negative mirrors. A task runs only when *all* `not.*` clauses fail."
+                                    },
+                                    "os": {
+                                        "anyOf": [
+                                            {
+                                                "type": "string",
+                                                "enum": [
+                                                    "aix",
+                                                    "darwin",
+                                                    "freebsd",
+                                                    "linux",
+                                                    "openbsd",
+                                                    "sunos",
+                                                    "windows",
+                                                    "win32"
+                                                ],
+                                                "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                            },
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string",
+                                                    "enum": [
+                                                        "aix",
+                                                        "darwin",
+                                                        "freebsd",
+                                                        "linux",
+                                                        "openbsd",
+                                                        "sunos",
+                                                        "windows",
+                                                        "win32"
+                                                    ],
+                                                    "description": "Aliased platform list — `\"windows\"` is sugar for Node's `\"win32\"`."
+                                                }
+                                            }
+                                        ],
+                                        "description": "Match `process.platform` (`\"linux\" | \"darwin\" | \"win32\" | \"freebsd\" | \"openbsd\" | \"sunos\" | \"aix\"`). Pass `\"windows\"` as an alias for `\"win32\"` — easier to remember and matches what people type."
+                                    }
+                                },
+                                "additionalProperties": false,
+                                "description": "Predicate that gates execution. When the condition evaluates to `false` for the current environment, the task is skipped (marked `\"skipped\"`, not failed). Combine with `os`, `env`, `branch`, and `ci` clauses for granular control:\n\n  ```ts   when: { os: \"linux\", ci: true, env: \"DEPLOY_TOKEN\" }   ```"
+                            }
+                        },
+                        "additionalProperties": false
+                    },
+                    "description": "Task default configurations, keyed by target name."
+                }
+            },
+            "required": [
+                "tasks"
+            ],
+            "additionalProperties": false,
+            "description": "A single scoped-tasks block — a set of task defaults gated by an optional match predicate."
+        },
+        "ScopedTasksMatch": {
+            "type": "object",
+            "properties": {
+                "language": {
+                    "anyOf": [
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    ],
+                    "description": "Match on primary language."
+                },
+                "layer": {
+                    "anyOf": [
+                        {
+                            "type": "string",
+                            "enum": [
+                                "application",
+                                "automation",
+                                "configuration",
+                                "library",
+                                "scaffolding",
+                                "tool"
+                            ],
+                            "description": "Project layer, used for constraint inheritance and query filtering."
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "anyOf": [
+                                    {
+                                        "type": "string",
+                                        "const": "application"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "automation"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "configuration"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "library"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "scaffolding"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "tool"
+                                    },
+                                    {
+                                        "not": {}
+                                    }
+                                ],
+                                "description": "Project layer, used for constraint inheritance and query filtering."
+                            }
+                        }
+                    ],
+                    "description": "Match on project layer."
+                },
+                "projectType": {
+                    "type": "string",
+                    "enum": [
+                        "application",
+                        "library",
+                        "service",
+                        "tool"
+                    ],
+                    "description": "Match on project type."
+                },
+                "stack": {
+                    "anyOf": [
+                        {
+                            "type": "string",
+                            "enum": [
+                                "backend",
+                                "data",
+                                "frontend",
+                                "infrastructure",
+                                "systems"
+                            ],
+                            "description": "Tech stack."
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "anyOf": [
+                                    {
+                                        "type": "string",
+                                        "const": "backend"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "data"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "frontend"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "infrastructure"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "const": "systems"
+                                    },
+                                    {
+                                        "not": {}
+                                    }
+                                ],
+                                "description": "Tech stack."
+                            }
+                        }
+                    ],
+                    "description": "Match on project stack."
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Match projects tagged with any of these tags."
+                }
+            },
+            "additionalProperties": false,
+            "description": "A predicate used by  {@link  VisConfig.scopedTasks } . All listed constraints must match for the block to apply."
+        }
+    }
+}