@visulima/vis 1.0.0-alpha.37 → 1.0.0-alpha.38

package/schemas/vis-config.schema.json

@@ -833,6 +833,10 @@
             "additionalProperties": false,
             "description": "Pre-flight checks fired before `vis run` starts the orchestrator. Each check is opt-out (`false`) — defaults are sensible for the common monorepo case."
         },
+        "release": {
+            "$ref": "#/$defs/VisReleaseConfig",
+            "description": "Configuration for the `vis release` subsystem. Controls change-file authoring, version computation, channel routing, publish behavior, and CI integration. See `packages/tooling/vis/rfc/design-release-manager.md`."
+        },
         "run": {
             "type": "object",
             "properties": {
@@ -2100,14 +2104,14 @@
                     "description": "When `true`, the cache directory is partitioned by a hash of the resolved `globalEnv` values. Changing a globalEnv var moves cache writes into a new namespace; rolling it back reuses the old namespace and its hits. Without this option, any globalEnv change silently busts every cached entry.\n\nKeep disabled when globalEnv is stable across runs — the extra path depth offers no value, and misconfigured namespaces can hide stale hits.",
                     "default": false
                 },
-                "onFingerprint": {
-                    "not": {},
-                    "description": "Plugin extension point invoked during task fingerprinting. Fires once per task after the built-in inputs (filesets, runtime, env) have been gathered and before the hash is sealed. Contributions made through the supplied  {@link  FingerprintContributor }  are mixed deterministically into the final hash.\n\nThrowing aborts fingerprinting for that task — the task fails before any cache lookup runs, so a buggy plugin can't silently corrupt cache state.\n\nWired by `vis` to bridge into the `task:fingerprint` hook; standalone task-runner consumers can pass a callback directly."
-                },
                 "onDiagnostic": {
                     "not": {},
                     "description": "Non-fatal diagnostic sink, forwarded to the task hasher. Fires when a cacheable task's file-set inputs resolve to zero files (the signature of a dropped `namedInputs`, a wrong `{projectRoot}`, or a glob matching nothing — a task that will reuse one cache entry forever). `vis` wires this to its logger."
                 },
+                "onFingerprint": {
+                    "not": {},
+                    "description": "Plugin extension point invoked during task fingerprinting. Fires once per task after the built-in inputs (filesets, runtime, env) have been gathered and before the hash is sealed. Contributions made through the supplied  {@link  FingerprintContributor }  are mixed deterministically into the final hash.\n\nThrowing aborts fingerprinting for that task — the task fails before any cache lookup runs, so a buggy plugin can't silently corrupt cache state.\n\nWired by `vis` to bridge into the `task:fingerprint` hook; standalone task-runner consumers can pass a callback directly."
+                },
                 "parallel": {
                     "type": [
                         "number",
@@ -2257,8 +2261,8 @@
                                 },
                                 "verifyOnDownload": {
                                     "type": "boolean",
-                                    "description": "Reject downloads whose signature doesn't match or is missing. Set to `true` once every upload on your server is signed.",
-                                    "default": false
+                                    "description": "Reject downloads whose signature doesn't match or is missing.\n\nDefaults to `true` whenever a  {@link  RemoteCacheSigning.secret }  is configured: signing implies the intent to authenticate artifacts, so the secure default is to verify. Set to `false` only during a migration window where some uploads on your server are not yet signed — be aware this re-opens the cache-poisoning attack surface (a server or MITM can strip the signature header and have unsigned artifacts extracted as build outputs).",
+                                    "default": true
                                 }
                             },
                             "required": [
@@ -3921,6 +3925,1390 @@
             "additionalProperties": false,
             "description": "One family of upstream-coupled packages.\n\n`members` is an exact-match list. `prefixes` accept any dep whose name starts with the prefix — useful for monorepos that ship many subpackages under one scope (e.g. `@babel/`, `@storybook/`, `@nx/`). A family can use either or both; a dep matching either list belongs to the family."
         },
+        "VisReleaseConfig": {
+            "type": "object",
+            "properties": {
+                "access": {
+                    "type": "string",
+                    "enum": [
+                        "public",
+                        "restricted"
+                    ],
+                    "description": "Default npm `--access` flag. Default: `\"public\"`."
+                },
+                "acknowledgeUnstable": {
+                    "type": "boolean",
+                    "description": "Suppress the unstable warning printed on first invocation (RFC §21.2)."
+                },
+                "aggregateRelease": {
+                    "anyOf": [
+                        {
+                            "type": "boolean"
+                        },
+                        {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                },
+                                "title": {
+                                    "type": "string"
+                                }
+                            },
+                            "required": [
+                                "enabled"
+                            ],
+                            "additionalProperties": false
+                        }
+                    ],
+                    "description": "Single GH release per wave vs per-package."
+                },
+                "aggregateReleaseTagPattern": {
+                    "type": "string",
+                    "description": "Pattern for the workspace-level aggregate release tag (when `aggregateRelease.enabled`). Tokens: `{date}`, `{version}` (latest bumped pkg's version). Default: `\"release-{date}\"`."
+                },
+                "allowCustomCommands": {
+                    "anyOf": [
+                        {
+                            "type": "boolean"
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    ],
+                    "description": "Trust gate for per-package custom commands."
+                },
+                "baseBranch": {
+                    "type": "string",
+                    "description": "Branch used for `--from` baseline in `status`/`generate`. Default: `\"main\"`."
+                },
+                "bumpDevDependencies": {
+                    "anyOf": [
+                        {
+                            "type": "boolean"
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    ],
+                    "description": "Opt-in cascade for `devDependencies` bumps (changesets #944 parity).\n\nBy default, when a workspace package is bumped, only its `dependencies` / `peerDependencies` / `optionalDependencies` consumers are considered for propagation — devDependency consumers are silently ignored because consumers of the dependent don't observe the devDep at runtime.\n\nSome teams disagree (especially for type-only packages or build plugins) and want a devDep bump to still trigger a patch on its consumer so the lockfile stays in sync across machines. Set this to:\n\n  - `true` — every devDep cascade fires (patch-level on the     dependent), regardless of the source package.   - `string[]` — narrow allow-list of source package names. Only     bumps to packages whose name appears in the list will cascade     through devDependencies. Useful when only specific     \"infrastructure\" packages should propagate via devDeps.\n\nDefault: `false` (devDep cascades remain off — historical behaviour)."
+                },
+                "bumpMinorPreMajor": {
+                    "type": "boolean",
+                    "description": "For pre-1.0 versions, demote `major` bumps to `minor`. Common for 0.x libraries that don't want their first breaking change to leap to 2.0. Maps to release-please's `bump-minor-pre-major`. Default `false`."
+                },
+                "bumpPatchForMinorPreMajor": {
+                    "type": "boolean",
+                    "description": "Companion to `bumpMinorPreMajor` — also demote `minor` bumps to `patch` for pre-1.0 versions. Maps to release-please's `bump-patch-for-minor-pre-major`. No-op without `bumpMinorPreMajor`. Default `false`."
+                },
+                "changedFilePatterns": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Globs that count toward \"package changed\" detection."
+                },
+                "changelog": {
+                    "anyOf": [
+                        {
+                            "type": "boolean",
+                            "const": false
+                        },
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "array",
+                            "minItems": 2,
+                            "maxItems": 2,
+                            "prefixItems": [
+                                {
+                                    "type": "string"
+                                },
+                                {
+                                    "type": "object",
+                                    "additionalProperties": {}
+                                }
+                            ]
+                        }
+                    ],
+                    "description": "Changelog formatter selection. Pass `false` to disable changelog output, one of the built-in names (`\"default\"`, `\"github\"`, `\"keep-a-changelog\"`), a path to a custom module, or a `[path, options]` tuple."
+                },
+                "changesDir": {
+                    "type": "string",
+                    "description": "Directory holding change files. Default: `\".vis/release\"`."
+                },
+                "channels": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "$ref": "#/$defs/ChannelConfig"
+                    },
+                    "description": "Per-channel routing config (semantic-release-style)."
+                },
+                "currentVersionResolver": {
+                    "type": "string",
+                    "enum": [
+                        "disk",
+                        "git-tag",
+                        "registry"
+                    ],
+                    "description": "Source of truth for \"what is the current version of this package?\", controlling how `oldVersion` is resolved when building the release plan.\n\n  `\"disk\"` (default) — read `package.json#version` (or the equivalent       manifest field for non-npm versionActions). Preserves vis's       historical behaviour and is the right choice when the manifest       on disk is the canonical source.   `\"registry\"` — query the package registry via the package's       `versionActions.readPublishedVersion()`. Useful when the manifest       drifts between repo and registry (e.g. teams that publish       out-of-band) and you want the registry to win.   `\"git-tag\"` — find the highest `releaseTagPattern`-matching tag in       the current commit's ancestry and parse the version out of it.       Matches nx's `git-tag` resolver and release-please's tag-based       lookup.\n\n`\"registry\"` and `\"git-tag\"` fall back to the manifest version when their primary source cannot produce a valid semver (e.g. registry 404 on a freshly-added package, no matching tag yet, etc.) and surface a plan warning so the operator sees what happened.\n\nOverridable per-package via `packages.<name>.currentVersionResolver`.\n\nThe `--first-release` CLI flag is the bootstrap shortcut for this setting — it forces `\"disk\"` regardless of config and additionally skips remote-tag collision checks, so the very first run on a greenfield monorepo can't trip over missing tags or registry 404s."
+                },
+                "defaultManaged": {
+                    "type": "boolean",
+                    "description": "Default `release.managed` for unconfigured packages. Default: `false`."
+                },
+                "dependencyBumpRules": {
+                    "$ref": "#/$defs/DependencyBumpRules",
+                    "description": "Default dep-bump rules (overridable per-package)."
+                },
+                "detectCatalogChanges": {
+                    "type": "boolean",
+                    "description": "Opt-in cascade for `pnpm-workspace.yaml` catalog version bumps (changesets #1707 parity).\n\npnpm's `catalog:` / `catalogs:` blocks let multiple packages share a single version range. When the operator bumps a catalog entry (e.g. `react: ^18.2.0` → `react: ^18.3.0`) every consumer package pulls the new version on its next `pnpm install`. Without detection, vis sees no change to the consumer's `package.json` and skips it — so the published tarball ends up shipping a stale `\"react\": \"catalog:\"` reference that resolves differently across machines.\n\nWhen `true`, vis diffs `pnpm-workspace.yaml` between `HEAD~1` (the previous release commit) and `HEAD` (working tree). Every catalog dep that moved triggers a `patch` bump on each consumer package, attributed as `BumpReason.CATALOG_CHANGED` in the release plan. Set on the consumer's dep cascade rules to widen the bump level via the same `dependencyBumpRules` knob used for direct dependency bumps.\n\nDefault: `false` (backwards-compat — the prior behaviour was to silently ignore catalog changes during plan assembly)."
+                },
+                "fixed": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/ReleaseGroupConfig"
+                    },
+                    "description": "Fixed groups: members share the same version, all bump on any change.\n\nTwo accepted shapes (backwards-compatible — the original `string[][]` keeps working):\n\n  - `string[]`            — bare list of package names / globs.                             Implicitly `{ changelog: { mode: \"per-package\" } }`.   - `{ packages, changelog }` — object form, lets you opt into a                                 SHARED changelog file for the group                                 (changesets #1059 parity). When                                 `changelog.mode === \"shared\"`, every                                 member's entry is rendered into one                                 group file (default                                 `<first-member-dir>/GROUP-CHANGELOG.md`)."
+                },
+                "floatingMajorTag": {
+                    "type": "boolean",
+                    "description": "Floating major-version tag. When `true`, every non-prerelease, non-private release also force-updates a `<safe-name>-v<major>` tag to point at the release commit. `safe-name` is the package name with the leading `@` stripped and `/` replaced by `-`:\n\n  - `@acme/action` → `acme-action-v1`   - `@vendor/cli`  → `vendor-cli-v1`   - unscoped `cli` → `cli-v1`\n\nUseful for reusable GitHub Actions consumers who pin to `acme/action@acme-action-v1` and expect automatic patch / minor delivery without a tag-rev migration. The scope is included so two packages with the same unscoped name from different scopes (`@acme/cli` + `@vendor/cli`) don't both retarget the same floating tag.\n\nSkipped on:   - Prereleases (per-channel `prerelease` configured). The float     would otherwise yank the major pointer across an unstable     pre-release boundary.   - Packages whose `releaseTagPattern` already includes `{major}`     (the pattern is already serving the same role).   - Private packages (`package.json#private === true`) and     packages that set `skipNpmPublish: true` — there's no     published artifact for a consumer to pin against, so a     floating tag would just clutter the tag history.\n\nDefault: `false`. Semantic-release parity: #1515."
+                },
+                "formatChangedFiles": {
+                    "type": "boolean",
+                    "description": "Run the project's Prettier over the files the version step writes (package.json bumps + CHANGELOG.md entries) before committing them (RFC §14 step 7). Scoped to the changed files only — never the whole tree. Resolves the project's own Prettier from the workspace root; soft-fails if Prettier isn't installed.\n\nDefault: `false` (opt-in — a project that doesn't use Prettier, or whose Prettier config conflicts with how vis writes JSON, leaves this off)."
+                },
+                "githubHost": {
+                    "type": "string",
+                    "description": "Self-hosted GitHub Enterprise host (e.g. `\"github.acme.com\"` — no scheme). Translates to the `GH_HOST` env var that the `gh` CLI consumes natively, so all adapter calls land on the right instance. Operators can also export `GH_HOST` directly; this config knob is the typed, vis.config.ts-discoverable equivalent. Ignored when `provider` resolves to anything other than `github`."
+                },
+                "gitlabHost": {
+                    "type": "string",
+                    "description": "Self-hosted GitLab host (e.g. `\"gitlab.example.com\"`). Translates to the `GITLAB_HOST` env var that `glab` consumes natively, so all adapter calls land on the right instance. Ignored when `provider` resolves to anything other than `gitlab`."
+                },
+                "gitSignCommits": {
+                    "type": "boolean",
+                    "description": "Sign release-flow commits with `git commit -S`. Set to `true` in workspaces that enforce `commit.gpgsign = true`. The active git identity must have a configured signing key (gpg, ssh, x509). Default `false`."
+                },
+                "gitUser": {
+                    "$ref": "#/$defs/GitUserConfig",
+                    "description": "Git committer identity used by CI workflows."
+                },
+                "groupPreVersionCommands": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "Group-scoped preVersion command. Runs once before any package in the group is versioned. `groupName` matches a `fixed`/`linked` array's index (group-0, group-1, …) or a named entry (future)."
+                },
+                "httpProxy": {
+                    "type": "string",
+                    "description": "HTTPS proxy URL (e.g. `\"http://proxy.acme.com:8080\"`) for enterprise networks that route outbound HTTPS through a proxy.\n\nWired through to two surfaces:\n\n  1. `gh` / `glab` CLI subprocesses get `HTTPS_PROXY` and      `HTTP_PROXY` set on their env so they tunnel through the      proxy exactly as if the operator had exported the vars      manually.\n\n  2. Every internal `fetch()` call (registry probes in      version-actions/{cargo,python,maven,container}.ts and the      shared `safeFetchVersionMetadata` helper) attaches an undici      `ProxyAgent` via the `dispatcher` option, so Node's built-in      fetch routes through the proxy as well.\n\nNode 22's bundled undici handles the proxy plumbing — no `https-proxy-agent` dep needed."
+                },
+                "ignore": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Globs of packages to exclude from release entirely."
+                },
+                "include": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Globs that override `ignore` and `private` exclusion."
+                },
+                "linked": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/ReleaseGroupConfig"
+                    },
+                    "description": "Linked groups: members share bump levels but only changed members publish. Accepts the same dual-shape format as `fixed` — see the `ReleaseGroupConfig` doc comment for details."
+                },
+                "notifications": {
+                    "$ref": "#/$defs/NotificationsConfig",
+                    "description": "Notifications — post-release fan-out to chat / webhook destinations. See  {@link  NotificationsConfig } . Each channel runs in parallel; per-channel failures log a warning but do NOT fail the publish."
+                },
+                "oneCommitPerPackage": {
+                    "type": "boolean",
+                    "description": "Emit one release commit per package (a `release(channel): pkg@version [skip ci]` message) instead of a single aggregate commit for the whole wave (RFC §19.5). Mirrors the per-package commit history that multi-semantic-release produced — useful for projects migrating off it that want to preserve `git log` shape. Only honoured when `aggregateRelease` is falsy. Shared artifacts (lockfile + consumed change-file deletions) ride along in the final package's commit.\n\nDefault: `false` (one aggregate commit per wave)."
+                },
+                "packages": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "$ref": "#/$defs/PerPackageReleaseConfig"
+                    },
+                    "description": "Per-package overrides (matches `package.json[\"vis-release\"]`)."
+                },
+                "postPublishCommand": {
+                    "type": "string",
+                    "description": "Shell command run after all publishes complete."
+                },
+                "postVersionCommand": {
+                    "type": "string",
+                    "description": "Shell command run after versioning, before publish."
+                },
+                "prePublishCommand": {
+                    "type": "string",
+                    "description": "Shell command run after versioning, before publish."
+                },
+                "preVersionCommand": {
+                    "type": "string",
+                    "description": "Shell command run before any versioning."
+                },
+                "privatePackages": {
+                    "type": "object",
+                    "properties": {
+                        "tag": {
+                            "type": "boolean"
+                        },
+                        "version": {
+                            "type": "boolean"
+                        }
+                    },
+                    "required": [
+                        "tag",
+                        "version"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Whether to version + tag private packages."
+                },
+                "provider": {
+                    "type": "string",
+                    "enum": [
+                        "github",
+                        "gitlab",
+                        "auto"
+                    ],
+                    "description": "Forge provider for remote operations (PR comments, releases, version PRs)."
+                },
+                "publish": {
+                    "$ref": "#/$defs/PublishConfig",
+                    "description": "Publish-related config."
+                },
+                "releaseNoteTemplate": {
+                    "type": "object",
+                    "properties": {
+                        "footer": {
+                            "type": "string"
+                        },
+                        "header": {
+                            "type": "string"
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Wrap each per-package GitHub / GitLab release body with operator- supplied header / footer text. Common use: link a migration guide above the auto-generated body, or paste a sponsorship blurb below.\n\nBoth fields are template strings supporting tokens:   - `{name}` — package name   - `{version}` — new version   - `{previousVersion}` — previous version   - `{date}` — `YYYY-MM-DD`   - `{repo}` — `owner/repo` slug   - `{contributors}` — bullet list of authors collected from the     entire wave's change-file `author:` frontmatter (release-please     #292). Wave-scoped — every per-package release in the wave     sees the same set, so cascade and dependency-only bumps still     credit the upstream author. Block-only — keep this token on     its own line, typically under a heading; inline use like     `Thanks {contributors}!` will produce broken markdown.     Authors are de-duplicated case-insensitively, markdown-escaped,     and filtered through the github formatter's `internalAuthors`     list (when configured). Empty string when no change file in     the wave declared an author.\n\nWhen set, the rendered body is composed as `header\\n\\n<body>\\n\\nfooter`. Empty / unset fields are skipped (no leading / trailing blank line).\n\n> **Aggregate-release mode (`release.aggregateRelease: true`)**: the > header and footer are NOT applied. The aggregate release body is > already operator-templated via `release.aggregateRelease.title` > and the per-package list is auto-rendered. If you want a custom > prefix/suffix on the aggregate body, override > `release.aggregateRelease.title` directly.\n\nRelease-please parity: #1274."
+                },
+                "releaseTagPattern": {
+                    "type": "string",
+                    "description": "Git tag template — overridable per-package via `package.json[\"vis-release\"][\"releaseTagPattern\"]`. Tokens: `{name}`, `{unscopedName}`, `{version}`, `{major}`, `{minor}`, `{patch}`, `{date}`, `{channel}`. Default: `\"{name}@{version}\"`."
+                },
+                "signing": {
+                    "type": "object",
+                    "properties": {
+                        "key": {
+                            "type": "string"
+                        },
+                        "mode": {
+                            "type": "string",
+                            "enum": [
+                                "gpg",
+                                "sigstore",
+                                "ssh"
+                            ]
+                        }
+                    },
+                    "required": [
+                        "mode"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Sign release tags. Wraps `git tag -s` / `-u <key>` and adds a `gitsign`-based code path for sigstore-style keyless signing.\n\nModes:   - `\"gpg\"`      — `git tag -s` (or `-u <key>` when `key` is set).                    Relies on `user.signingkey` in git config.   - `\"ssh\"`      — Same `-s` flag, but the operator must have                    `gpg.format=ssh` + `user.signingkey=<path-to-key>`                    configured. Doctor surfaces missing config with a                    warning at preflight.   - `\"sigstore\"` — Experimental (\"preview\"). Uses `gitsign` when on                    PATH, otherwise falls back to GPG with a warning.\n\nPer-package signing is not supported (release tags are a workspace- wide artefact). Default: undefined (no signing).\n\nRelease-please parity: #1738, #1314."
+                },
+                "snapshot": {
+                    "$ref": "#/$defs/SnapshotConfig",
+                    "description": "Snapshot config."
+                },
+                "successWalk": {
+                    "$ref": "#/$defs/SuccessWalkConfig",
+                    "description": "Post-release notification walk. Configures the \"🎉 This is included in version X.Y.Z\" comment + `released` label pass that runs after a successful publish wave.\n\n**Default OFF.** Leave undefined and the walk never runs — vis will not touch third-party PRs referenced in changelog bodies. Set to `{}` to opt in with defaults, or pass an object to override the comment template / labels / prerelease behaviour."
+                },
+                "updateInternalDependencies": {
+                    "$ref": "#/$defs/UpdateInternalDependenciesMode",
+                    "description": "Dep-propagation mode. Default: `\"out-of-range\"`."
+                },
+                "versionPr": {
+                    "$ref": "#/$defs/VersionPrConfig",
+                    "description": "Version-PR config."
+                },
+                "workspaceChangelog": {
+                    "anyOf": [
+                        {
+                            "type": "boolean",
+                            "const": false
+                        },
+                        {
+                            "type": "object",
+                            "properties": {
+                                "file": {
+                                    "type": "string"
+                                },
+                                "waveHeading": {
+                                    "type": "string"
+                                }
+                            },
+                            "additionalProperties": false
+                        }
+                    ],
+                    "description": "Workspace-level changelog config (RFC §6.1 / nx parity). When set, renders one CHANGELOG.md at the workspace root in addition to per-package files."
+                }
+            },
+            "additionalProperties": false
+        },
+        "ChannelConfig": {
+            "type": "object",
+            "properties": {
+                "mode": {
+                    "$ref": "#/$defs/ChannelMode",
+                    "description": "CI behavior: `auto-publish` (push triggers publish) or `version-pr` (review gate)."
+                },
+                "prerelease": {
+                    "type": "string",
+                    "description": "Pre-release identifier (e.g. `\"alpha\"`, `\"beta\"`, `\"rc\"`). Omit for stable channels."
+                },
+                "range": {
+                    "type": "string",
+                    "description": "For maintenance branches: `\"match\"` keeps releases inside the branch's semver range."
+                },
+                "tag": {
+                    "type": "string",
+                    "description": "npm dist-tag for publishes on this channel. Use `\"branch-name\"` to mirror the branch name."
+                }
+            },
+            "required": [
+                "tag"
+            ],
+            "additionalProperties": false
+        },
+        "ChannelMode": {
+            "type": "string",
+            "enum": [
+                "auto-publish",
+                "version-pr"
+            ]
+        },
+        "DependencyBumpRules": {
+            "type": "object",
+            "properties": {
+                "dependencies": {
+                    "anyOf": [
+                        {
+                            "$ref": "#/$defs/DependencyBumpRule"
+                        },
+                        {
+                            "type": "boolean",
+                            "const": false
+                        }
+                    ]
+                },
+                "devDependencies": {
+                    "anyOf": [
+                        {
+                            "$ref": "#/$defs/DependencyBumpRule"
+                        },
+                        {
+                            "type": "boolean",
+                            "const": false
+                        }
+                    ]
+                },
+                "peerDependencies": {
+                    "anyOf": [
+                        {
+                            "$ref": "#/$defs/DependencyBumpRule"
+                        },
+                        {
+                            "type": "boolean",
+                            "const": false
+                        }
+                    ]
+                },
+                "optionalDependencies": {
+                    "anyOf": [
+                        {
+                            "$ref": "#/$defs/DependencyBumpRule"
+                        },
+                        {
+                            "type": "boolean",
+                            "const": false
+                        }
+                    ]
+                }
+            },
+            "additionalProperties": false
+        },
+        "DependencyBumpRule": {
+            "type": "object",
+            "properties": {
+                "bumpAs": {
+                    "$ref": "#/$defs/BumpAs",
+                    "description": "Bump level to apply to the dependent. `\"match\"` = same as source."
+                },
+                "trigger": {
+                    "$ref": "#/$defs/BumpLevel",
+                    "description": "Minimum source bump that activates this rule."
+                }
+            },
+            "required": [
+                "bumpAs",
+                "trigger"
+            ],
+            "additionalProperties": false
+        },
+        "BumpAs": {
+            "anyOf": [
+                {
+                    "$ref": "#/$defs/BumpLevel"
+                },
+                {
+                    "type": "string",
+                    "const": "match"
+                }
+            ]
+        },
+        "BumpLevel": {
+            "type": "string",
+            "enum": [
+                "major",
+                "minor",
+                "patch",
+                "none"
+            ],
+            "description": "Public types for the vis release subsystem.\n\nImported via `@visulima/vis/release/types` sub-export. See the RFC at `packages/tooling/vis/rfc/design-release-manager.md` for the full design.\n\nStability: every type here is part of vis's public API surface — breaking changes require a vis major version bump (RFC §21.1)."
+        },
+        "ReleaseGroupConfig": {
+            "anyOf": [
+                {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                {
+                    "type": "object",
+                    "properties": {
+                        "changelog": {
+                            "$ref": "#/$defs/ReleaseGroupChangelogConfig"
+                        },
+                        "name": {
+                            "type": "string",
+                            "description": "Optional name for the group. Used as the heading in the shared changelog when set; defaults to a \"group-N\"-style identifier derived from the array index."
+                        },
+                        "packages": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "description": "Package names or globs that belong to this group."
+                        }
+                    },
+                    "required": [
+                        "packages"
+                    ],
+                    "additionalProperties": false
+                }
+            ],
+            "description": "Dual-shape config for `release.fixed` / `release.linked` entries.\n\nBare `string[]` is interpreted as `{ packages, changelog: { mode: \"per-package\" } }` — keeps existing configs working without migration."
+        },
+        "ReleaseGroupChangelogConfig": {
+            "type": "object",
+            "properties": {
+                "mode": {
+                    "type": "string",
+                    "enum": [
+                        "per-package",
+                        "shared"
+                    ]
+                },
+                "path": {
+                    "type": "string",
+                    "description": "Override file path. Default: `<first-member-dir>/GROUP-CHANGELOG.md`."
+                }
+            },
+            "required": [
+                "mode"
+            ],
+            "additionalProperties": false,
+            "description": "Per-group changelog routing.\n\n  - `\"per-package\"` (default) — every member writes to its own     `<pkg-dir>/CHANGELOG.md` exactly as if it weren't grouped.   - `\"shared\"` — every member's entry is rendered into ONE shared     file. `path` overrides the default location     (`<first-member-dir>/GROUP-CHANGELOG.md`). Useful for `core/utils`     pairs and other tightly-coupled package sets where one     consolidated changelog reads better than N tiny ones."
+        },
+        "GitUserConfig": {
+            "type": "object",
+            "properties": {
+                "email": {
+                    "type": "string"
+                },
+                "name": {
+                    "type": "string"
+                }
+            },
+            "required": [
+                "email",
+                "name"
+            ],
+            "additionalProperties": false
+        },
+        "NotificationsConfig": {
+            "type": "object",
+            "properties": {
+                "discord": {
+                    "anyOf": [
+                        {
+                            "$ref": "#/$defs/DiscordConfig"
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "$ref": "#/$defs/DiscordConfig"
+                            }
+                        }
+                    ],
+                    "description": "Built-in Discord channel(s). Single config or array. Each posts a formatted embed with title + bullet-list of packages."
+                },
+                "plugins": {
+                    "type": "array",
+                    "items": {
+                        "anyOf": [
+                            {
+                                "type": "string"
+                            },
+                            {
+                                "type": "array",
+                                "minItems": 2,
+                                "maxItems": 2,
+                                "prefixItems": [
+                                    {
+                                        "type": "string"
+                                    },
+                                    {
+                                        "type": "object",
+                                        "additionalProperties": {}
+                                    }
+                                ]
+                            }
+                        ]
+                    },
+                    "description": "Custom channels loaded from a path. The module must export a default `NotificationChannel` (object with `.send`) OR a factory `(options) => NotificationChannel` for the tuple `[path, options]` form."
+                },
+                "skipPrerelease": {
+                    "type": "boolean",
+                    "description": "Skip notifications on prerelease waves (when every published version has a `-…` suffix). Default `true` — most teams want Slack noise only on stable releases."
+                },
+                "slack": {
+                    "anyOf": [
+                        {
+                            "$ref": "#/$defs/SlackConfig"
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "$ref": "#/$defs/SlackConfig"
+                            }
+                        }
+                    ],
+                    "description": "Built-in Slack channel(s). Each posts a Block Kit message with a header + package list + context block."
+                },
+                "webhook": {
+                    "anyOf": [
+                        {
+                            "$ref": "#/$defs/WebhookConfig"
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "$ref": "#/$defs/WebhookConfig"
+                            }
+                        }
+                    ],
+                    "description": "Generic webhook(s) for Teams / Mattermost / internal dashboards."
+                }
+            },
+            "additionalProperties": false
+        },
+        "DiscordConfig": {
+            "type": "object",
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "description": "Optional disambiguator for log lines + doctor checks."
+                },
+                "includeSkipped": {
+                    "type": "boolean",
+                    "description": "Skip the `Skipped (N):` block. Default false (skipped are surfaced)."
+                },
+                "title": {
+                    "type": "string",
+                    "description": "Title template — see `expandNotificationTemplate` for tokens (`{count}`, `{packages}`, `{firstName}`, `{firstVersion}`, `{channel}`, `{repo}`, `{date}`). When omitted, a sensible \"🚀 Released N packages\" default is used."
+                },
+                "avatarUrl": {
+                    "type": "string",
+                    "description": "Override the embed avatar."
+                },
+                "color": {
+                    "type": "number",
+                    "description": "Embed colour as an integer RGB (e.g. `0x3B82F6` = blue-500)."
+                },
+                "username": {
+                    "type": "string",
+                    "description": "Bot display name override."
+                },
+                "webhook": {
+                    "type": "string",
+                    "description": "Discord webhook URL. Server+channel scoped."
+                }
+            },
+            "required": [
+                "webhook"
+            ],
+            "additionalProperties": false
+        },
+        "SlackConfig": {
+            "type": "object",
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "description": "Optional disambiguator for log lines + doctor checks."
+                },
+                "includeSkipped": {
+                    "type": "boolean",
+                    "description": "Skip the `Skipped (N):` block. Default false (skipped are surfaced)."
+                },
+                "title": {
+                    "type": "string",
+                    "description": "Title template — see `expandNotificationTemplate` for tokens (`{count}`, `{packages}`, `{firstName}`, `{firstVersion}`, `{channel}`, `{repo}`, `{date}`). When omitted, a sensible \"🚀 Released N packages\" default is used."
+                },
+                "channelOverride": {
+                    "type": "string",
+                    "description": "Override the channel the webhook posts to. Only honoured when the webhook was created with multi-channel posting allowed (rare)."
+                },
+                "iconEmoji": {
+                    "type": "string",
+                    "description": "Bot icon emoji (e.g. `\":rocket:\"`)."
+                },
+                "username": {
+                    "type": "string",
+                    "description": "Bot display name override."
+                },
+                "webhook": {
+                    "type": "string",
+                    "description": "Slack incoming-webhook URL. Workspace+channel scoped. Use env substitution if you don't want it inline: `webhook: \"${SLACK_WEBHOOK_URL}\"`."
+                }
+            },
+            "required": [
+                "webhook"
+            ],
+            "additionalProperties": false
+        },
+        "WebhookConfig": {
+            "type": "object",
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "description": "Optional disambiguator for log lines + doctor checks."
+                },
+                "includeSkipped": {
+                    "type": "boolean",
+                    "description": "Skip the `Skipped (N):` block. Default false (skipped are surfaced)."
+                },
+                "title": {
+                    "type": "string",
+                    "description": "Title template — see `expandNotificationTemplate` for tokens (`{count}`, `{packages}`, `{firstName}`, `{firstVersion}`, `{channel}`, `{repo}`, `{date}`). When omitted, a sensible \"🚀 Released N packages\" default is used."
+                },
+                "body": {
+                    "description": "Body template. When omitted, the full `NotificationContext` is sent verbatim as JSON. When provided, every string leaf is run through `expandNotificationTemplate`."
+                },
+                "headers": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "Additional headers (values run through template interpolation)."
+                },
+                "method": {
+                    "type": "string",
+                    "enum": [
+                        "POST",
+                        "PUT"
+                    ],
+                    "description": "HTTP method. Default `POST`."
+                },
+                "url": {
+                    "type": "string",
+                    "description": "Target URL."
+                }
+            },
+            "required": [
+                "url"
+            ],
+            "additionalProperties": false
+        },
+        "PerPackageReleaseConfig": {
+            "type": "object",
+            "properties": {
+                "additionalPaths": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Extra directories (or globs) that logically belong to this package. Used by `vis release check --strict` to attribute changes outside the package's own directory to this package — e.g. a shared `docs/api/` directory whose updates should still trip the \"covered by a change file?\" gate for the package they document.\n\nGlobs are workspace-root-relative (NOT package-directory-relative). Examples:\n\n  ```ts   release: {     packages: {       \"@scope/cli\": {         additionalPaths: [\"docs/cli/**\", \"examples/cli/**\"],       },     },   }   ```\n\nDefault: `undefined` (only the package's own directory is attributed to it). Release-please parity: #1921."
+                },
+                "buildCommand": {
+                    "type": "string",
+                    "description": "Custom shell command run before publish (requires `allowCustomCommands`)."
+                },
+                "buildContext": {
+                    "type": "string",
+                    "description": "Build context passed to `docker buildx build` (the final positional argument). Honoured by the `container` versionActions; defaults to the package directory."
+                },
+                "cargoTomlPath": {
+                    "type": "string",
+                    "description": "Relative path from the package directory to `Cargo.toml` for the `cargo` versionActions. Set automatically by the `cargo()` preset from its `crateDir` option. Defaults to `\"Cargo.toml\"`."
+                },
+                "cascadeTo": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "$ref": "#/$defs/DependencyBumpRule"
+                    },
+                    "description": "Source-side cascade: glob → rule."
+                },
+                "changedFilePatterns": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Per-pkg override of `release.changedFilePatterns`. Replaces (does not merge)."
+                },
+                "checkPublished": {
+                    "type": "string",
+                    "description": "Custom shell command that prints currently-published version to stdout."
+                },
+                "containerBuildArgs": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "Extra `--build-arg KEY=VALUE` pairs forwarded to `docker buildx build`. Useful for stamping the version into the image at build time. Consumed by the `container` versionActions."
+                },
+                "containerImage": {
+                    "type": "string",
+                    "description": "Fully-qualified container image reference, e.g. `\"ghcr.io/scope/foo\"`. Required by the `container` versionActions (no built-in default since the registry hostname is operator- specific). Set automatically by the `container()` preset."
+                },
+                "containerPlatforms": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Target platforms passed to `docker buildx build --platform`. Defaults to `[\"linux/amd64\", \"linux/arm64\"]`. Single-arch builds can pass a one-entry array."
+                },
+                "containerSigning": {
+                    "type": "string",
+                    "const": "cosign",
+                    "description": "Post-push signing scheme for the `container` versionActions. `\"cosign\"` runs `cosign sign --yes <image>:<version>` against the just-pushed immutable tag. Future schemes (sigstore-bundle, notation, etc.) can extend this union."
+                },
+                "containerSkipLatest": {
+                    "type": "boolean",
+                    "description": "Skip the conventional `:latest` floating tag on push. Useful for pre-release / channel-specific images that shouldn't move the shared `latest` pointer."
+                },
+                "currentVersionResolver": {
+                    "type": "string",
+                    "enum": [
+                        "disk",
+                        "git-tag",
+                        "registry"
+                    ],
+                    "description": "Per-package override of the workspace-level `currentVersionResolver`. Same set of modes: `\"disk\"`, `\"registry\"`, `\"git-tag\"`. Useful when one package in the monorepo lags behind the registry / git-tag baseline (e.g. a newly-added package that hasn't been published yet)."
+                },
+                "dependencyBumpRules": {
+                    "$ref": "#/$defs/DependencyBumpRules",
+                    "description": "Per-pkg override of inbound dep-bump rules."
+                },
+                "extraFiles": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/ExtraFileRule"
+                    },
+                    "description": "Per-package `extra-files` rules with paths relative to the package directory. Merged with workspace-level `release.publish.extraFiles` (per-package wins on path collision)."
+                },
+                "jsrConfigPath": {
+                    "type": "string",
+                    "description": "Relative path from the package directory to the JSR manifest (`jsr.json` or `deno.json`) for the `jsr` versionActions. Set automatically by the `jsr()` preset from its `manifestPath` option. Defaults to `\"jsr.json\"`."
+                },
+                "jsrPublishArgs": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Extra arguments forwarded verbatim to `jsr publish` for the `jsr` versionActions (the `jsr()` preset wires this from its `publishArgs` / `allowSlowTypes` options). The most common entry is `\"--allow-slow-types\"`, which JSR requires for packages whose public API has types it can't statically infer. `--allow-dirty` is always passed by vis (the version is bumped on disk before publish) and need not be listed here."
+                },
+                "managed": {
+                    "type": "boolean",
+                    "description": "Hard opt-in/out — overrides every other rule."
+                },
+                "mavenMetadataUrl": {
+                    "type": "string",
+                    "description": "Override the Maven Central metadata URL used by the `maven` versionActions for already-published detection. Set this when publishing to a custom repository (Artifactory, Nexus, GitHub Packages); the URL should point at `<base>/<groupId>/<artifactId>/maven-metadata.xml`. Pass `\"\"` (empty string) to disable the metadata check entirely."
+                },
+                "pomPath": {
+                    "type": "string",
+                    "description": "Override the path to `pom.xml` for the `maven` versionActions, relative to the package directory. Defaults to `\"pom.xml\"`."
+                },
+                "publishCommand": {
+                    "anyOf": [
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    ],
+                    "description": "Custom shell command run instead of `npm publish` (requires `allowCustomCommands`)."
+                },
+                "pythonProjectDir": {
+                    "type": "string",
+                    "description": "Relative path from the package directory to the directory containing `pyproject.toml` for the `python` versionActions. Set automatically by the `pyproject()` preset from its `projectDir` option. Defaults to the package directory."
+                },
+                "registry": {
+                    "type": "string",
+                    "description": "Custom registry URL (overrides `publish.registry`)."
+                },
+                "releaseTagPattern": {
+                    "type": "string",
+                    "description": "Override the workspace-wide releaseTagPattern. Tokens: `{name}`, `{unscopedName}`, `{version}`, `{major}`, `{minor}`, `{patch}`, `{date}`, `{channel}`."
+                },
+                "skipNpmPublish": {
+                    "type": "boolean",
+                    "description": "Skip the npm publish step but still create a git tag."
+                },
+                "uvLockPath": {
+                    "type": "string",
+                    "description": "Relative path from the package directory (or workspace root, for uv-workspace setups) to `uv.lock`. Set when the operator wants vis to acknowledge a uv-managed lockfile during doctor checks.\n\nvis does NOT mutate `uv.lock` itself — uv regenerates it on `uv sync` / `uv build`. The path is recorded only so doctor can warn when the file is missing despite the operator configuring uv-aware tooling. Operators wanting `uv.lock` in the release commit should run `uv lock` between `vis release version` and the commit step (typically wired via `postVersionCommand`).\n\nrelease-please parity: #2561."
+                },
+                "uvWorkspace": {
+                    "type": "object",
+                    "properties": {
+                        "root": {
+                            "type": "string"
+                        }
+                    },
+                    "required": [
+                        "root"
+                    ],
+                    "additionalProperties": false,
+                    "description": "uv workspace configuration. When set, the `python` versionActions and the `pyproject()` preset treat this package as a member of a uv workspace rooted at `uvWorkspace.root` (relative to the package directory — typically `\"..\"` or the path up to the repo root).\n\nDoctor checks:   - the root's pyproject.toml exists at `<root>/pyproject.toml`   - `[tool.uv.workspace] members` lists the package's project     directory (relative path from the workspace root)\n\nSet automatically by the `pyproject({ uvWorkspace })` preset.\n\nrelease-please parity: #2560."
+                },
+                "versionActions": {
+                    "type": "string",
+                    "description": "Built-in id (`\"npm\"`, `\"native-addon\"`, `\"private\"`, `\"shell\"`, `\"cargo\"`, `\"python\"`, `\"maven\"`, `\"container\"`, `\"jsr\"`) or a path to a custom implementation module."
+                }
+            },
+            "additionalProperties": false
+        },
+        "ExtraFileRule": {
+            "anyOf": [
+                {
+                    "$ref": "#/$defs/ExtraFileAnnotationRule"
+                },
+                {
+                    "$ref": "#/$defs/ExtraFileRegexRule"
+                }
+            ],
+            "description": "Union of every extra-files rule shape. The regex form is the historical default; the annotation form was added for release-please ergonomics.\n\nWhen `type` is omitted, the rule is treated as a regex rule (preserves backwards-compat for every existing vis.config.ts in the wild)."
+        },
+        "ExtraFileAnnotationRule": {
+            "type": "object",
+            "properties": {
+                "anchor": {
+                    "type": "string",
+                    "description": "Limit the semver-replacement to occurrences anchored by this literal prefix on the marked line. Useful when the file has multiple version-shaped substrings (e.g. a lockfile or a Dockerfile referencing both APP_VERSION and a base-image tag).\n\nExample — `ENV APP_VERSION=\"0.1.0\"` with `anchor: \"APP_VERSION\"` only touches the version after that prefix. When omitted, the FIRST semver substring on the marked line is replaced.\n\n**Strongly recommended** for any file that contains more than one version-shaped substring (lockfiles, Dockerfiles with both APP and base-image tags, multi-version compose files). The default \"first semver wins\" behaviour is convenient for single-version files but a footgun on lockfiles — annotating a `package-lock .json` without an anchor would happily rewrite the first nested dep's `version`."
+                },
+                "marker": {
+                    "type": "string",
+                    "description": "Override the marker string. Default `\"x-release-please-version\"` (release-please compatibility). Match is plain substring (no regex), case-sensitive."
+                },
+                "path": {
+                    "type": "string",
+                    "description": "File path. Workspace-root-relative when declared on `release.publish.extraFiles`; package-directory-relative when on `release.packages.<name>.extraFiles`."
+                },
+                "type": {
+                    "type": "string",
+                    "const": "annotation",
+                    "description": "Switch to annotation-comment mode. The substitution engine looks for lines tagged with the configured marker — by default `x-release-please-version` (release-please compatibility). The marked line (or the line immediately following an own-line marker) has its semver-shaped substring replaced with the new version."
+                }
+            },
+            "required": [
+                "path",
+                "type"
+            ],
+            "additionalProperties": false,
+            "description": "Annotation-comment file-substitution rule — release-please parity.\n\nInstead of authoring a regex, the operator drops an `x-release-please- version` (or custom-named) marker comment in the target file and vis locates the semver-shaped substring on the marked line (or the line immediately following an own-line marker) and replaces it with the new version. Far more ergonomic than the regex form for the common case of \"bump this version string here\".\n\nTwo recognised placements:\n\n  1. **Inline** — marker on the same line as the version:      ```ts      export const VERSION = \"0.1.0\"; // x-release-please-version      ```\n\n  2. **Preceding-line** — marker on the line just above the version:      ```dockerfile      # x-release-please-version      ENV APP_VERSION=\"0.1.0\"      ```\n\nLike the regex path, missing files / no marker found surface as `plan.warnings` rather than throwing."
+        },
+        "ExtraFileRegexRule": {
+            "type": "object",
+            "properties": {
+                "flags": {
+                    "type": "string",
+                    "description": "Regex flags (default `\"g\"`). Combine as needed: `\"gm\"`, `\"gmi\"`, etc."
+                },
+                "path": {
+                    "type": "string",
+                    "description": "File path. Workspace-root-relative when declared on `release.publish.extraFiles`; package-directory-relative when on `release.packages.<name>.extraFiles`."
+                },
+                "replace": {
+                    "type": "string",
+                    "description": "Substitution template. `{version}` is replaced with the new version literal. Standard regex backreferences (`$1`, `$2`, `$&`) work too. When omitted, the entire match is replaced with the new version."
+                },
+                "search": {
+                    "type": "string",
+                    "description": "JavaScript regex source (without delimiters)."
+                },
+                "type": {
+                    "type": "string",
+                    "const": "regex",
+                    "description": "Explicit type discriminator. Defaults to `\"regex\"` when omitted — legacy rules without a `type` field continue to work as regex rules."
+                }
+            },
+            "required": [
+                "path",
+                "search"
+            ],
+            "additionalProperties": false,
+            "description": "Regex-based file-substitution rule used by `publish.extraFiles` (workspace) or `packages.<name>.extraFiles` (per-package) to keep version strings in non-package.json files in sync with the release."
+        },
+        "PublishConfig": {
+            "type": "object",
+            "properties": {
+                "addReleases": {
+                    "type": [
+                        "boolean",
+                        "string"
+                    ],
+                    "enum": [
+                        false,
+                        "bottom",
+                        "top"
+                    ],
+                    "description": "Semantic-release/github parity — when set, prepend (\"top\") or append (\"bottom\") a \"Related releases\" block to the per-package GitHub release body that links to the immediately previous N releases of the same package. Aids navigation in the Releases UI (\"what did 1.4.2 fix?\" is a single click from 1.5.0's release page).\n\nHonoured only on the GitHub adapter; GitLab logs a warning and skips the block. Aggregate-release mode is skipped — there's no per-package prior release to point at.\n\nDefault `false` (no link block)."
+                },
+                "catalogResolution": {
+                    "$ref": "#/$defs/CatalogResolutionMode",
+                    "description": "How to resolve `catalog:` protocols."
+                },
+                "cleanPackageJson": {
+                    "anyOf": [
+                        {
+                            "type": "boolean"
+                        },
+                        {
+                            "$ref": "#/$defs/CleanPackageJsonConfig"
+                        }
+                    ],
+                    "description": "Strip/keep config for the published `package.json`. `false` ships unmodified."
+                },
+                "discussionCategory": {
+                    "type": "string",
+                    "description": "GitHub-only: link each created release to a Discussion in the named category (e.g. `\"Announcements\"`, `\"Releases\"`). The category must already exist on the repository; GitHub creates the discussion automatically. Ignored on GitLab."
+                },
+                "draftRelease": {
+                    "type": "boolean",
+                    "description": "Create the forge release (GitHub Release / GitLab Release) as a draft. A draft release is invisible to consumers until a human publishes it through the UI — useful when release notes need a human review before going public. Default `false`.\n\nMaps to GitHub's `draft: true` API field and GitLab's released_at being absent (GitLab models drafts implicitly via no released_at)."
+                },
+                "extraFiles": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/ExtraFileRule"
+                    },
+                    "description": "Bump version strings in arbitrary files alongside package.json. Each rule's `path` is workspace-root-relative; per-package rules (under `packages.<name>.extraFiles`) resolve relative to the package directory.\n\nThe `search` is a JavaScript regex source. Default `flags: \"g\"` for global replacement. The `replace` template supports the `{version}` token and standard regex backreferences (`$1`, `$2`, `$&`, etc.). When `replace` is absent, the entire match is substituted with the new version.\n\nExamples — README badge, TS constant, Cargo.toml field:   `{ path: \"README.md\", search: \"v\\\\d+\\\\.\\\\d+\\\\.\\\\d+\" }`   `{ path: \"src/version.ts\", search: 'VERSION = \"[^\"]+\"',      replace: 'VERSION = \"{version}\"' }`   `{ path: \"Cargo.toml\", search: '^version = \"[^\"]+\"',      replace: 'version = \"{version}\"', flags: \"m\" }`\n\nFailed matches are non-fatal — the publish carries on, but a warning surfaces so misconfigured rules don't silently rot."
+                },
+                "guards": {
+                    "$ref": "#/$defs/PublishGuardsConfig",
+                    "description": "Pre-publish security gates. Each gate is opt-in."
+                },
+                "noRelease": {
+                    "type": "boolean",
+                    "description": "Skip creating the GitHub / GitLab Release entirely while still pushing the git tag and publishing the package to the registry. Useful for teams that maintain release notes elsewhere (a docs site, in-product changelog, etc.) and don't want the duplicate forge artifact.\n\nDefault `false`. Release-please parity: #1295."
+                },
+                "packManager": {
+                    "$ref": "#/$defs/PackManager",
+                    "description": "Which manager to invoke for `<pm> pack`."
+                },
+                "preferStaticToken": {
+                    "type": "boolean",
+                    "description": "Auth-precedence escape hatch for the multi-language actions (cargo, python). Default `false`.\n\nDefault behaviour (false): when both an OIDC env signal (`ACTIONS_ID_TOKEN_REQUEST_URL`) AND a static token (`CARGO_REGISTRY_TOKEN` / `TWINE_PASSWORD`) are present, OIDC wins — an operator who enabled OIDC trusted publishing wants OIDC by default and a leftover token in the env shouldn't silently switch auth modes (M-3).\n\nSet `true` to flip the precedence: when both signals are present, the static token wins. Useful for operators migrating off OIDC, shadow-publishing during a cutover, or working around a temporary trusted-publishing outage at the registry."
+                },
+                "protocolResolution": {
+                    "$ref": "#/$defs/ProtocolResolutionMode",
+                    "description": "How to resolve `workspace:` protocols."
+                },
+                "publishArgs": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Extra args appended to publish (`--provenance`, etc.). Skipped for managers that don't support them."
+                },
+                "publishStrategy": {
+                    "$ref": "#/$defs/PublishStrategy",
+                    "description": "Publish strategy — see RFC §11.3."
+                },
+                "registry": {
+                    "type": "string",
+                    "description": "Override default registry."
+                },
+                "releaseAssets": {
+                    "$ref": "#/$defs/ReleaseAssetsConfig",
+                    "description": "Post-publish asset attestation work."
+                },
+                "stage": {
+                    "anyOf": [
+                        {
+                            "type": "boolean"
+                        },
+                        {
+                            "type": "object",
+                            "properties": {
+                                "pollIntervalMs": {
+                                    "type": "number",
+                                    "description": "Sleep between consecutive `npm stage view` checks while waiting. Default: 15_000 (15 seconds)."
+                                },
+                                "timeoutMs": {
+                                    "type": "number",
+                                    "description": "Hard deadline before the wait gives up and skips the publish. Default: 1_800_000 (30 minutes)."
+                                }
+                            },
+                            "additionalProperties": false
+                        }
+                    ],
+                    "description": "Use npm's staged-publishing flow (`npm stage publish`) instead of `npm publish`. The published version is invisible to consumers until a maintainer approves it via 2FA (`vis release stage approve` or the npmjs.com web UI). Requires npm CLI ≥ 11.15.0 and `registry.npmjs.org` as the registry; doctor warns when those preconditions aren't met.\n\nPublish blocks on the human-review gate so downstream pipeline steps (tags, GH release, post-hooks) only run against actually-live packages. Rejection and timeout are NOT CI failures — they flow through the skipped[] result so `vis release publish` exits 0; the unapproved package just doesn't get its downstream side-effects.\n\nPass `true` for defaults (30-min timeout, 15s poll). Pass an object to override per-workspace. Snapshots always publish directly (preview content shouldn't gate on review)."
+                }
+            },
+            "additionalProperties": false
+        },
+        "CatalogResolutionMode": {
+            "type": "string",
+            "enum": [
+                "auto",
+                "in-place",
+                "delegate"
+            ]
+        },
+        "CleanPackageJsonConfig": {
+            "type": "object",
+            "properties": {
+                "keep": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Fields to keep — overrides default strip behaviour."
+                },
+                "strip": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Fields to strip from the published package.json (extends defaults)."
+                }
+            },
+            "additionalProperties": false
+        },
+        "PublishGuardsConfig": {
+            "type": "object",
+            "properties": {
+                "audit": {
+                    "type": "string",
+                    "enum": [
+                        "critical",
+                        "high",
+                        "low",
+                        "moderate",
+                        "off"
+                    ],
+                    "description": "Run `npm audit --omit=dev` against the resolved package and fail at the configured severity. Skips devDependency CVEs (which don't ship to consumers). `\"off\"` disables."
+                },
+                "exportsExist": {
+                    "type": "boolean",
+                    "description": "Verify every leaf path declared in `package.json#exports` / `main` / `module` / `types` / `bin` exists post-build. Wildcard exports (`./feat/*.js`) check that the directory is non-empty after build.\n\nCatches \"deleted file but forgot to update exports\" before publish."
+                },
+                "lifecycleScripts": {
+                    "anyOf": [
+                        {
+                            "type": "string",
+                            "const": "off"
+                        },
+                        {
+                            "type": "string",
+                            "const": "strict"
+                        },
+                        {
+                            "type": "string",
+                            "const": "warn"
+                        },
+                        {
+                            "type": "object",
+                            "properties": {
+                                "allow": {
+                                    "type": "object",
+                                    "additionalProperties": {
+                                        "type": "string"
+                                    }
+                                },
+                                "mode": {
+                                    "type": "string",
+                                    "enum": [
+                                        "off",
+                                        "strict",
+                                        "warn"
+                                    ]
+                                }
+                            },
+                            "required": [
+                                "mode"
+                            ],
+                            "additionalProperties": false
+                        }
+                    ],
+                    "description": "Gate on lifecycle scripts (`preinstall` / `install` / `postinstall`) declared on the package being published. These run on the consumer's machine at install time, so unauthorized additions are a supply-chain vector.\n\nModes: `\"off\"` (skip), `\"warn\"` (log + continue), `\"strict\"` (fail). Object form provides an exact-match `allow` table — only commands matching the listed value pass through."
+                },
+                "packSecretScan": {
+                    "anyOf": [
+                        {
+                            "type": "boolean"
+                        },
+                        {
+                            "type": "object",
+                            "properties": {
+                                "ignore": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            },
+                            "additionalProperties": false
+                        }
+                    ],
+                    "description": "Scan the resolved tarball contents (post `npm pack`) for secrets. Catches `.npmignore`/`files` misconfigurations that would ship `.env`, AWS keys, etc. Different scope than log redaction — this gates what actually leaves the machine.\n\n`true` runs the default `@visulima/secret-scanner` ruleset. Object form lets callers narrow the rule set or skip files."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Pre-publish security gates — run after the manifest is rewritten and the tarball is packed but BEFORE `npm publish` is invoked. Each gate is opt-in; defaults aim for \"useful for new repos, easy to disable for established ones\"."
+        },
+        "PackManager": {
+            "type": "string",
+            "enum": [
+                "auto",
+                "npm",
+                "pnpm",
+                "yarn",
+                "bun"
+            ]
+        },
+        "ProtocolResolutionMode": {
+            "type": "string",
+            "enum": [
+                "pack",
+                "in-place",
+                "none"
+            ]
+        },
+        "PublishStrategy": {
+            "type": "string",
+            "enum": [
+                "npm-publish-tarball",
+                "native"
+            ]
+        },
+        "ReleaseAssetsConfig": {
+            "type": "object",
+            "properties": {
+                "stampHashes": {
+                    "type": "boolean",
+                    "description": "Compute SHA256 + SHA512 of the published tarball and append them to the release body. Lets consumers verify the registry tarball matches the audited build, defending against post-publish substitution."
+                },
+                "uploadTarball": {
+                    "type": "boolean",
+                    "description": "Upload the published tarball as a release asset alongside the GH release. Belt-and-suspenders alongside `stampHashes` — registry tampering is detectable by hash comparison."
+                }
+            },
+            "additionalProperties": false
+        },
+        "SnapshotConfig": {
+            "type": "object",
+            "properties": {
+                "backend": {
+                    "$ref": "#/$defs/SnapshotBackend"
+                },
+                "cleanupOnPrClose": {
+                    "type": "boolean",
+                    "description": "Whether to delete published snapshots on PR-close (no-op for `pkg-pr-new`)."
+                },
+                "registry": {
+                    "type": "string",
+                    "description": "When backend is `pkg-pr-new`, the registry URL is supplied automatically."
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/SnapshotTagKind"
+                    },
+                    "description": "Multi-tag publish — pick which tag types to emit per snapshot."
+                },
+                "versionTemplate": {
+                    "type": "string",
+                    "description": "Version template — interpolation tokens: `{tag}`, `{shortSha}`, `{sha}`, `{branch}`, `{pr}`, `{timestamp}`."
+                }
+            },
+            "additionalProperties": false
+        },
+        "SnapshotBackend": {
+            "anyOf": [
+                {
+                    "type": "string",
+                    "const": "pkg-pr-new"
+                },
+                {
+                    "type": "string",
+                    "const": "registry"
+                },
+                {
+                    "type": "object",
+                    "properties": {
+                        "auth": {
+                            "type": "string"
+                        },
+                        "url": {
+                            "type": "string"
+                        }
+                    },
+                    "required": [
+                        "url"
+                    ],
+                    "additionalProperties": false
+                }
+            ]
+        },
+        "SnapshotTagKind": {
+            "type": "string",
+            "enum": [
+                "sha",
+                "short-sha",
+                "branch",
+                "pr"
+            ]
+        },
+        "SuccessWalkConfig": {
+            "type": "object",
+            "properties": {
+                "commentBody": {
+                    "type": "string",
+                    "description": "Comment body template posted on every referenced PR / issue. Tokens:   - `{version}` — the published version (e.g. `1.2.0`)   - `{name}`    — the published package name   - `{tag}`     — the git tag created for this release   - `{url}`     — the forge release URL when available\n\nDefault mirrors semantic-release's `successComment`."
+                },
+                "enabled": {
+                    "type": "boolean",
+                    "description": "Enable the walk. Default `true` when `successWalk` is present in the config. Setting `enabled: false` is functionally equivalent to omitting `successWalk` entirely (no walk runs) — the difference is one of intent: an explicit `enabled: false` documents that the operator has considered the walk and disabled it.\n\nLeaving `successWalk` undefined at the top level is the recommended \"off\" stance — see the interface docstring."
+                },
+                "labels": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Labels added to every walked PR / issue. Default `[\"released\"]`."
+                },
+                "skipPrerelease": {
+                    "type": "boolean",
+                    "description": "Skip the walk entirely on prerelease channels — the typical \"don't notify users their PR shipped in a beta\" guardrail. Default `true`."
+                }
+            },
+            "additionalProperties": false,
+            "description": "Post-release notification walk — semantic-release parity.\n\n**Default OFF.** Set `release.successWalk: {}` to opt in with defaults. Leaving `successWalk` undefined in the workspace config is the explicit \"don't touch third-party PRs\" stance — sticky comments and the `released` label are an irreversible side effect on every PR mentioned in a changelog body, so we never apply them implicitly.\n\nWhen opted in, after a successful publish wave vis walks every PR / issue referenced in the rendered changelog entries and:   1. Posts (or upserts) a sticky comment announcing the release version.   2. Adds the configured labels (default `[\"released\"]`).\n\nFailure to walk a single ref is non-fatal — the publish itself already succeeded; we don't want a forge API blip rolling that back."
+        },
+        "UpdateInternalDependenciesMode": {
+            "type": "string",
+            "enum": [
+                "patch",
+                "minor",
+                "out-of-range"
+            ]
+        },
+        "VersionPrConfig": {
+            "type": "object",
+            "properties": {
+                "assignees": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Auto-assign these users (logins) as the PR assignees on creation. Existing assignees are preserved; this only adds. Defaults to unassigned."
+                },
+                "autoMerge": {
+                    "type": "boolean",
+                    "description": "Enable GitHub's auto-merge once status checks pass. Maps to `gh pr merge --auto`. Requires the repo to have auto-merge enabled in settings. Default `false`."
+                },
+                "autoMergeMethod": {
+                    "type": "string",
+                    "enum": [
+                        "merge",
+                        "rebase",
+                        "squash"
+                    ],
+                    "description": "Merge strategy for auto-merge — defaults to `\"squash\"`. Honoured only when `autoMerge: true`."
+                },
+                "autoRebase": {
+                    "type": "boolean",
+                    "description": "Periodically rebase the version-PR branch on top of `base` so the PR doesn't drift behind. Default `false`. Enable when the version-PR sits open for long periods and conflicts with other PRs are likely. The actual rebase runs via `vis release ci rebase-pr` (which the CI workflow can schedule on a cron)."
+                },
+                "branch": {
+                    "type": "string"
+                },
+                "commentMarker": {
+                    "type": "string",
+                    "description": "Sentinel comment marker for sticky-update detection."
+                },
+                "labels": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Labels applied to the version-PR. Defaults to `[\"autorelease: pending\"]`. Set to `[]` to disable. The label is added on every PR refresh — external automation can rely on it being present until the lifecycle moves on (`autorelease: tagged` post-publish, etc.)."
+                },
+                "preamble": {
+                    "type": "string",
+                    "description": "Markdown prepended to the PR body."
+                },
+                "reviewers": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Auto-request reviews from these users / teams on PR creation. Format: GitHub usernames or `org/team`. Existing reviewers are preserved."
+                },
+                "title": {
+                    "type": "string"
+                }
+            },
+            "additionalProperties": false
+        },
         "ScopedTasksBlock": {
             "type": "object",
             "properties": {