@visulima/vis 6.0.1 → 6.1.1

package/dist/config/index.d.ts

@@ -1,25 +1,6 @@
 import { TargetConfiguration, ChildEnvOptions, TaskResult, Task, FingerprintContributor, ConstraintsConfig, NamedInputs, TaskRunnerOptions } from '@visulima/task-runner';
 export type { FingerprintContributor } from '@visulima/task-runner';
 import { VisReleaseConfig } from "../release/types.js";
-/**
- * One family of upstream-coupled packages.
- *
- * `members` is an exact-match list. `prefixes` accept any dep whose
- * name starts with the prefix — useful for monorepos that ship many
- * subpackages under one scope (e.g. `@babel/`, `@storybook/`,
- * `@nx/`). A family can use either or both; a dep matching either
- * list belongs to the family.
- */
-interface SimilarDepFamily {
-  /** Stable id; used in report output and config overrides. */
-  id: string;
-  /** Pretty label for the report. Defaults to `id` when omitted. */
-  label?: string;
-  /** Dep names that belong to this family verbatim. */
-  members?: string[];
-  /** Dep-name prefixes (literal, no glob). Match if `depName.startsWith(prefix)`. */
-  prefixes?: string[];
-}
 /** Adapter IDs that can format (adapter `kind` is `"fmt"` or `"both"`). */
 type FmtAdapterId = "biome" | "dprint" | "oxfmt" | "prettier" | "ruff-fmt";
 /** Adapter IDs that can lint (adapter `kind` is `"lint"` or `"both"`). */
@@ -693,33 +674,6 @@ interface VisPlugin {
    */
   setup?: (hooks: Hookable<VisHooks>) => Promise<void> | void;
 }
-/**
- * Per-adapter override applied by `vis lint` / `vis fmt`. Keyed by
- * adapter id under `lint.adapters` / `fmt.adapters`. Every field is
- * optional — set only what you need to change.
- */
-interface LintFmtAdapterOverride {
-  /**
-   * Set to `false` to skip this adapter even when its config file or
-   * package.json entry is detected. Defaults to `true` (run when
-   * detected).
-   */
-  enabled?: boolean;
-  /**
-   * Extra arguments appended verbatim to every invocation of this
-   * adapter. Useful for tool-specific flags vis doesn't expose
-   * directly (e.g. `eslint --rulesdir`).
-   */
-  extraArgs?: string[];
-}
-/**
- * The 8 Socket.dev-style supply-chain policies. Used in `security.policies`
- * and `security.acceptedRisks[*].policies`. Kept as a const tuple so callers
- * can import the runtime array (`POLICY_NAMES`) for iteration without
- * drifting from the union type.
- */
-declare const POLICY_NAMES: readonly ["firstSeen", "installScripts", "license", "malware", "publisherChange", "score", "unexpectedDeps", "vulnerability"];
-type PolicyName = (typeof POLICY_NAMES)[number];
 /**
  * Recognised input sources for the codeowners aggregator.
  *
@@ -762,6 +716,56 @@ interface CodeownersConfig {
   /** Enabled input sources. Defaults to `["project-json"]`. */
   sources?: CodeownersSource[];
 }
+/**
+ * Declared code-owner assignment for a path glob within a project.
+ * Mirrors moon's `owners` shape so migrations can round-trip cleanly.
+ */
+interface OwnersEntry {
+  /** Optional notification channel (e.g. Slack, Teams). */
+  channel?: string;
+  /** Owner handles (e.g. `@visulima/core-team`). */
+  owners: string[];
+  /** File/glob pattern relative to the project root. */
+  path: string;
+}
+/**
+ * Per-adapter override applied by `vis lint` / `vis fmt`. Keyed by
+ * adapter id under `lint.adapters` / `fmt.adapters`. Every field is
+ * optional — set only what you need to change.
+ */
+interface LintFmtAdapterOverride {
+  /**
+   * Set to `false` to skip this adapter even when its config file or
+   * package.json entry is detected. Defaults to `true` (run when
+   * detected).
+   */
+  enabled?: boolean;
+  /**
+   * Extra arguments appended verbatim to every invocation of this
+   * adapter. Useful for tool-specific flags vis doesn't expose
+   * directly (e.g. `eslint --rulesdir`).
+   */
+  extraArgs?: string[];
+}
+/**
+ * One family of upstream-coupled packages.
+ *
+ * `members` is an exact-match list. `prefixes` accept any dep whose
+ * name starts with the prefix — useful for monorepos that ship many
+ * subpackages under one scope (e.g. `@babel/`, `@storybook/`,
+ * `@nx/`). A family can use either or both; a dep matching either
+ * list belongs to the family.
+ */
+interface SimilarDepFamily {
+  /** Stable id; used in report output and config overrides. */
+  id: string;
+  /** Pretty label for the report. Defaults to `id` when omitted. */
+  label?: string;
+  /** Dep names that belong to this family verbatim. */
+  members?: string[];
+  /** Dep-name prefixes (literal, no glob). Match if `depName.startsWith(prefix)`. */
+  prefixes?: string[];
+}
 /**
  * One user-declared customTypes entry. See `policy.customTypes.extraTypes`
  * for the full contract — this is just the row shape.
@@ -788,18 +792,6 @@ interface ExtraCustomType {
    */
   strategy: "name@version" | "name~version" | "string" | "versionsByName";
 }
-/**
- * Declared code-owner assignment for a path glob within a project.
- * Mirrors moon's `owners` shape so migrations can round-trip cleanly.
- */
-interface OwnersEntry {
-  /** Optional notification channel (e.g. Slack, Teams). */
-  channel?: string;
-  /** Owner handles (e.g. `@visulima/core-team`). */
-  owners: string[];
-  /** File/glob pattern relative to the project root. */
-  path: string;
-}
 /**
  * Per-project TypeScript overlay loaded from `vis.task.ts`. Adds a
  * dynamic, type-safe layer for target overrides on top of `project.json`,
@@ -877,22 +869,6 @@ interface ProjectJson {
   /** Vis-style target definitions (merged on top of package.json scripts). */
   targets?: Record<string, VisTargetConfiguration>;
 }
-/**
- * A predicate used by {@link VisConfig.scopedTasks}.
- * All listed constraints must match for the block to apply.
- */
-interface ScopedTasksMatch {
-  /** Match on primary language. */
-  language?: string | string[];
-  /** Match on project layer. */
-  layer?: ProjectJson["layer"] | ProjectJson["layer"][];
-  /** Match on project type. */
-  projectType?: "application" | "library" | "service" | "tool";
-  /** Match on project stack. */
-  stack?: ProjectJson["stack"] | ProjectJson["stack"][];
-  /** Match projects tagged with any of these tags. */
-  tags?: string[];
-}
 /**
  * A single scoped-tasks block — a set of task defaults gated by an
  * optional match predicate.
@@ -903,104 +879,1167 @@ interface ScopedTasksBlock {
   /** Task default configurations, keyed by target name. */
   tasks: Record<string, Partial<VisTargetConfiguration>>;
 }
-interface VisConfig {
+/**
+ * The 8 Socket.dev-style supply-chain policies. Used in `security.policies`
+ * and `security.acceptedRisks[*].policies`. Kept as a const tuple so callers
+ * can import the runtime array (`POLICY_NAMES`) for iteration without
+ * drifting from the union type.
+ */
+declare const POLICY_NAMES: readonly ["firstSeen", "installScripts", "license", "malware", "publisherChange", "score", "unexpectedDeps", "vulnerability"];
+type PolicyName = (typeof POLICY_NAMES)[number];
+interface VisPolicyConfig {
   /**
-   * Workspace-relative glob patterns for changed files outside every
-   * project that `vis affected`, `vis run --affected`, `vis ci` and
-   * `vis ci ignore` should not count as a change.
-   *
-   * By default a changed file that belongs to no project (a root
-   * `tsconfig.json`, `package.json`, …) is a global change and marks every
-   * project affected. A changed file matching one of these patterns is
-   * skipped instead. The patterns are only checked for files that belong
-   * to NO project: a file inside a project root is never filtered, so a
-   * broad pattern like `*.md` cannot hide a real package change.
-   *
-   * Patterns use `path.matchesGlob` syntax, where `*` does not cross `/`:
-   * `*.md` matches `README.md` but not `docs/guide.md`.
+   * Map of dep names or globs → reason (or `{ reason, replacement, packages?, paths? }`).
+   * Internal/workspace deps are never flagged here; the
+   * workspace-protocol lint owns those.
    *
-   * Do NOT list paths whose changes really do affect projects, such as
-   * bundler-inlined shared source or the root `tsconfig.json`: an edit
-   * there would then run nothing.
-   * @example ["api-snapshots/**", "plans/**", "*.md"]
+   * Optional `packages` (globs over the declaring package's `name`) and
+   * `paths` (globs over the workspace-relative `packageDir`) narrow where
+   * the rule applies. With both set, either match is enough. Omit both
+   * to ban anywhere — the default.
+   * @example
+   * ```
+   * bannedDeps: {
+   *   request: "deprecated; use undici",
+   *   moment: { reason: "huge bundle, frozen upstream", replacement: "date-fns" },
+   *   "@radix-ui/*": "we standardized on shadcn",
+   *   react: { reason: "no react in shared libs", paths: ["packages/shared/*"] },
+   *   "next": { reason: "apps only", packages: ["@app/*"] },
+   * }
+   * ```
    */
-  affectedIgnore?: string[];
-  /** AI analysis configuration */
-  ai?: {
-    /** Cache TTL in milliseconds. Overrides default (1h / 30min for security). */
-    cacheTtl?: number;
-    /** Override default provider priority. Higher number = preferred. */
-    priority?: Record<string, number>;
-    /** Use a specific provider instead of auto-detecting (e.g., `"claude"`, `"gemini"`). */
-    provider?: string;
-  };
+  bannedDeps?: Record<string, string | {
+    packages?: string[];
+    paths?: string[];
+    reason: string;
+    replacement?: string;
+  }>;
   /**
-   * Scope the task-runner cache directory by the current git branch.
-   * When `true`, caches are stored under `&lt;cacheDir>/branches/&lt;slug>`
-   * so `main` and feature branches stop thrashing each other —
-   * generated artefacts (schemas, `.d.ts` snapshots) that legitimately
-   * differ across branches no longer oscillate the cache contents.
+   * Tweak the custom-types lint that flags drift in `engines.{node,pnpm,...}`,
+   * `packageManager`, `volta.{node,pnpm,yarn}`, and the proposed
+   * `devEngines.{runtime,packageManager}` array form.
    *
-   * Falls back to the unscoped path on detached HEAD, non-git
-   * workspaces, or when git isn't available.
-   * @default false
+   * Each (customType × name) cluster is tracked independently —
+   * `engines.node` and `volta.node` don't cross-couple here. Use a
+   * versionGroup once that lands if you need to enforce they agree.
    */
-  branchScopedCache?: boolean;
+  customTypes?: {
+    /**
+     * Three-state autofix opt-out. See `workspaceProtocol.autofix`
+     * for the contract — same semantics, applied to drift rewrites
+     * across engines / packageManager / volta / devEngines.
+     *
+     * Note: `--fix` strips any `+sha512.&lt;hash&gt;` suffix from
+     * `packageManager` on bump — content-integrity hashes are tied
+     * to a specific package, not a version, so users must regenerate
+     * via their PM (`pnpm install` re-pins; `corepack use pnpm@X` etc.).
+     * @default true
+     */
+    autofix?: "prompt" | boolean;
+    /**
+     * User-defined custom-type pin locations. Each entry tells the
+     * customTypes lint to read additional version pins from a
+     * non-standard JSON path inside every workspace package.json,
+     * cluster them by `(name × depName)` like the built-in types,
+     * and rewrite them with `--fix`.
+     *
+     * The original built-ins (`engines`, `volta`, `packageManager`,
+     * `devEngines.runtime`, `devEngines.packageManager`) keep
+     * running unconditionally — these layer on top.
+     *
+     * Strategies:
+     * - `versionsByName`: the JSON at `path` is `{ [depName]: version }`
+     *   (like `engines` or `pnpm.overrides`).
+     * - `name@version`: the JSON at `path` is a string of the form
+     *   `name@version` (like `packageManager`). The leading `name@`
+     *   is preserved; only the version segment is rewritten.
+     * - `string`: the JSON at `path` is a bare version string. The
+     *   `depName` field is required and identifies the dep cluster.
+     *
+     * `name` must not collide with a built-in type name. `path` is
+     * a dot-separated walk into the package.json (e.g. `pnpm.overrides`).
+     * @example
+     * ```ts
+     * extraTypes: [
+     *   { name: "pnpmOverridesLegacy", path: "pnpm.overrides", strategy: "versionsByName" },
+     *   { name: "myToolPin",           path: "myTool.runtime", strategy: "name@version" },
+     *   { name: "minNode",             path: "config.minNode", strategy: "string", depName: "node" },
+     * ]
+     * ```
+     */
+    extraTypes?: ExtraCustomType[];
+    /**
+     * Dep names exempt from the drift check (exact match against the
+     * field name within the block — e.g. `node`, `pnpm`).
+     */
+    ignore?: string[];
+    /**
+     * Resolution strategy used when `--fix` runs.
+     * - `highest` (default): align every drifting instance to the
+     *   highest declared version.
+     * - `lowest`: align to the lowest.
+     * @default "highest"
+     */
+    resolve?: "highest" | "lowest";
+  };
   /**
-   * Code ownership configuration. Controls how `vis sync codeowners`
-   * renders the generated CODEOWNERS file.
+   * Tweak the dead-workspace-patterns lint that flags entries in
+   * `pnpm-workspace.yaml#packages` / `package.json#workspaces` which
+   * resolve to zero on-disk directories.
    */
-  codeowners?: CodeownersConfig;
+  deadWorkspacePatterns?: {
+    /**
+     * Three-state autofix opt-out. See `workspaceProtocol.autofix`
+     * for the contract — applied here to dropping unmatched patterns
+     * from the workspace config file.
+     * @default true
+     */
+    autofix?: "prompt" | boolean;
+  };
   /**
-   * Composer packages as task projects. Off by default: a `composer.json` in a
-   * subdirectory gets validate and, when its scripts define them, test and lint targets.
+   * Tweak the empty-deps lint that flags empty `dependencies` /
+   * `devDependencies` / `peerDependencies` / `optionalDependencies`
+   * blocks across the workspace.
    */
-  composer?: {
-    discover?: boolean;
+  emptyDeps?: {
+    /**
+     * Three-state autofix opt-out. See `workspaceProtocol.autofix`
+     * for the contract — applied here to removing the empty key.
+     * @default true
+     */
+    autofix?: "prompt" | boolean;
+    /**
+     * Block names exempt from the rule (e.g. `["peerDependencies"]`
+     * to keep the key around as a marker even when empty).
+     */
+    ignoreBlocks?: ("dependencies" | "devDependencies" | "optionalDependencies" | "peerDependencies")[];
   };
   /**
-   * Project dependency constraints.
-   * Enforced after building the project graph, before running tasks.
+   * Tweak the redefine-root lint that flags non-root packages duplicating
+   * deps already pinned at the workspace root.
    */
-  constraints?: ConstraintsConfig;
+  redefineRoot?: {
+    /** Dep names that are exempt from the redefine-root rule (exact match). */
+    ignore?: string[];
+  };
   /**
-   * Configuration for the `vis create` scaffolding command.
-   * Controls template downloads (via giget), default options, and
-   * post-creation behavior.
+   * Tweak the root-deps lint that flags runtime `dependencies` declared
+   * on the private workspace root (they should live in `devDependencies`).
    */
-  create?: {
+  rootDeps?: {
     /**
-     * Authorization token for downloading private repository templates.
-     * Passed as Bearer token to the git host API.
-     * Can also be set via GIGET_AUTH, GITHUB_TOKEN, or GH_TOKEN environment variables.
+     * Three-state autofix opt-out. See `workspaceProtocol.autofix`
+     * for the contract — applied here to moving entries from
+     * `dependencies` to `devDependencies` on the root package.json.
+     * @default true
      */
-    auth?: string;
+    autofix?: "prompt" | boolean;
+  };
+  /**
+   * Tweak the root-package-manager lint that flags a missing or
+   * malformed `packageManager` field on the workspace root.
+   */
+  rootPackageManager?: {
     /**
-     * Default editor to configure after scaffolding.
-     * When set, `vis create` automatically generates editor config files.
-     * @example "vscode"
+     * Three-state autofix opt-out. See `workspaceProtocol.autofix`
+     * for the contract. `--fix` only writes when `suggested` is set —
+     * a missing `packageManager` field has no canonical default.
+     * @default true
      */
-    defaultEditor?: "vscode";
+    autofix?: "prompt" | boolean;
     /**
-     * Default package manager for new standalone projects.
-     * When set, skips the PM selection prompt in interactive mode.
+     * Canonical specifier (`name@version`) to write when `--fix` runs
+     * and the field is absent. Required to enable autofix —
+     * vis won't guess the workspace's preferred manager.
+     * @example "pnpm@10.32.1"
      */
-    defaultPm?: "bun" | "npm" | "pnpm" | "yarn";
+    suggested?: string;
+  };
+  /**
+   * Tweak the root-private lint that flags a workspace root package.json
+   * missing `"private": true`. Only fires when the root looks like a
+   * workspace (npm/yarn/bun `workspaces` field or `pnpm-workspace.yaml`).
+   */
+  rootPrivate?: {
     /**
-     * Default giget provider for `owner/repo` shorthand inputs.
-     * @default "github"
+     * Three-state autofix opt-out. See `workspaceProtocol.autofix`
+     * for the contract — applied here to inserting `"private": true`.
+     * @default true
      */
-    defaultProvider?: "bitbucket" | "github" | "gitlab" | "sourcehut";
+    autofix?: "prompt" | boolean;
+  };
+  /**
+   * Tweak the similar-deps lint that flags drift across related dep
+   * families (e.g. `react` and `react-dom`, all of `@babel/*`).
+   *
+   * The lint is report-only — aligning a family requires picking a
+   * single canonical specifier across heterogeneous range syntaxes
+   * (`^`, `~`, exact), which is too lossy without user input.
+   */
+  similarDeps?: {
     /**
-     * Template used by a bare `vis create`. Accepts any template input, including an
-     * organization scope (`@acme` opens the `@acme/create` manifest picker, `@acme:app`
-     * selects one entry directly). In a terminal the usual prompts still run, minus the template step.
-     * @example "@acme"
+     * Additional families merged with the built-ins. Same `id` wins
+     * → user override fully replaces the built-in entry.
+     * @example
+     * ```
+     * extraFamilies: [
+     *   { id: "vue", label: "Vue", members: ["vue", "vue-router", "pinia"] },
+     * ]
+     * ```
      */
-    defaultTemplate?: string;
+    extraFamilies?: SimilarDepFamily[];
+    /** Family ids to skip entirely (matches `SimilarDepFamily.id`). */
+    ignoreFamilies?: string[];
+  };
+  /**
+   * Tweak the types-in-deps lint that flags `@types/*` declared in
+   * `dependencies` on a private package (they belong in
+   * `devDependencies` since the package never ships).
+   */
+  typesInDeps?: {
     /**
-     * Initialize a git repository after scaffolding standalone projects.
-     * @default false
+     * Three-state autofix opt-out. See `workspaceProtocol.autofix`
+     * for the contract — applied here to moving the entry to
+     * `devDependencies`. Existing dev pins are preserved on conflict.
+     * @default true
+     */
+    autofix?: "prompt" | boolean;
+    /** Dep names exempt from the rule (exact match, e.g. `@types/node`). */
+    ignore?: string[];
+  };
+  /**
+   * Tweak the workspace-protocol lint that flags internal deps not
+   * using the `workspace:` protocol.
+   */
+  workspaceProtocol?: {
+    /**
+     * Three-state autofix opt-out. Some workspaces want detection
+     * without rewrite (e.g. dual-licensed packages where `workspace:*`
+     * is unsafe).
+     * - `true` (default): `--fix` rewrites the specifier.
+     * - `false`: never rewrite — report the violation only.
+     * - `"prompt"`: ask before each rewrite. Falls back to report-only
+     *   when stdin isn't a TTY (CI). Reserved; not yet implemented.
+     *
+     * Note: when `false` (or `"prompt"`), `--fix` still **fails CI** on
+     * detected violations — the rule is "report only", not "ignore".
+     * Drop the rule from the lint selection if you want a clean exit.
+     * @default true
+     * @example
+     * ```
+     * policy: {
+     *   workspaceProtocol: { autofix: false },
+     * }
+     * ```
+     */
+    autofix?: "prompt" | boolean;
+  };
+  /**
+   * Tweak the workspace-versions lint that flags external deps declared
+   * at inconsistent versions across the workspace.
+   */
+  workspaceVersions?: {
+    /**
+     * Three-state autofix opt-out. See `workspaceProtocol.autofix`
+     * for the contract — same semantics, applied to drift rewrites.
+     *
+     * Also gates the `--propose-min` catalog suggestion writer:
+     * when `false` / `"prompt"`, `--fix --propose-min` reports the
+     * proposed catalog entries but does not write
+     * `pnpm-workspace.yaml`. Same "report only, still fails CI"
+     * note applies as on `workspaceProtocol.autofix`.
+     * @default true
+     */
+    autofix?: "prompt" | boolean;
+    /** Dep names exempt from the version-drift check (exact match). */
+    ignore?: string[];
+    /**
+     * Resolution strategy used when `--fix` runs.
+     * - `highest` (default): rewrite every drifting instance to the
+     *   highest sibling specifier.
+     * - `lowest`: rewrite to the lowest.
+     * - `catalog`: rewrite any dep already pinned in a workspace catalog
+     *   to `catalog:` / `catalog:&lt;name>`. Catalog must exist; this lint
+     *   does not create the catalog (see `vis lint --resolve catalog --propose`).
+     * @default "highest"
+     */
+    resolve?: "catalog" | "highest" | "lowest";
+  };
+}
+interface VisSecurityConfig {
+  /**
+   * Packages whose policy findings have been reviewed and explicitly
+   * accepted. Matched against every policy unless `policies` narrows the
+   * scope. Replaces the legacy `security.socket.acceptedRisks` map.
+   *
+   * Key format: package name (`"lodash"`), name@version
+   * (`"lodash@4.17.21"`), or glob (`"@myorg/*"`). Unversioned keys match
+   * all versions of that package.
+   * @example
+   * ```
+   * acceptedRisks: {
+   *   "some-risky-pkg": {
+   *     reason: "Internal fork, low score expected",
+   *     acceptedAt: "2026-03-15T10:00:00Z",
+   *     acceptedScore: 0.25,
+   *     policies: ["score"],
+   *     expiresAt: "2026-12-31",
+   *   },
+   * }
+   * ```
+   */
+  acceptedRisks?: Record<string, {
+    /** ISO 8601 timestamp when the risk was accepted. */
+    acceptedAt: string;
+    /**
+     * The overall Socket.dev score at the time of acceptance,
+     * in the range `[0, 1]` (mirrors `policies.score.minimum`).
+     * Only relevant for the `score` policy; ignored elsewhere.
+     */
+    acceptedScore?: number;
+    /**
+     * ISO 8601 date (or datetime). After this point the acceptance
+     * stops applying and vis emits a warning. Leave undefined for
+     * non-expiring entries. Values that fail to parse as a Date
+     * are rejected by the loader rather than silently treated as
+     * "always expired".
+     */
+    expiresAt?: string;
+    /**
+     * Which policies this acceptance covers. When undefined the
+     * acceptance applies to every policy finding on this package.
+     */
+    policies?: PolicyName[];
+    /** User-provided reason for accepting the risk. */
+    reason: string;
+  }>;
+  /**
+   * Map of bin names (or `pkg#bin` qualifiers) blessed for shadowing.
+   * When two installed packages expose the same bin name, vis flags
+   * the collision in `vis security list` and the post-install drift
+   * report — set the bin (or `pkg#bin`) to `true` here to suppress
+   * the warning once you've reviewed the conflict.
+   *
+   * Port of LavaMoat allow-scripts' experimental `allowBins`.
+   * Bare names match any conflicting bin with that name; the
+   * `pkg#bin` form scopes the approval to a single package's bin.
+   * @example
+   * ```
+   * allowBins: {
+   *   tsc: true,                // bless any 'tsc' bin
+   *   "typescript#tsc": true,   // bless only typescript's 'tsc'
+   * }
+   * ```
+   */
+  allowBins?: Record<string, boolean>;
+  /**
+   * Offline OSV advisory + `vis audit` configuration.
+   *
+   * Controls `vis audit --offline` and `vis advisories sync` behavior:
+   * - `audit.advisories.source` is the OSV mirror to download from. It
+   *   must be `https://` and resolve to a host in `allowedHosts` (or one
+   *   of the built-in defaults).
+   * - `audit.offlineByDefault` flips the default of `--offline`.
+   *
+   * Vulnerability severity gating and reachability filtering live under
+   * `policies.vulnerability` (see below).
+   */
+  audit?: {
+    /**
+     * Offline advisory cache settings.
+     */
+    advisories?: {
+      /**
+       * Extra hosts permitted as `audit.advisories.source`. The
+       * built-in allowlist is enforced even if this field is
+       * omitted; entries here add to it.
+       * @example ["mirror.corp.example.com"]
+       */
+      allowedHosts?: string[];
+      /**
+       * Bloom-filter prefilter for OSV `MAL-*` (malicious-package)
+       * advisories. Probes a ~380 KB filter fetched from
+       * `endevco/osv-bloom` and escalates hits to the existing
+       * advisory query path for `(name, version)` confirmation.
+       *
+       * Cost: ~380 KB on the wire, refreshed every 10 minutes
+       * upstream. False-positive rate is ~0.1%, so a typical
+       * 1000-package lockfile triggers zero or one extra
+       * round trip per audit.
+       *
+       * Independent of `audit.advisories.source` / `verify` —
+       * those control the full OSV ingest. The bloom is
+       * MAL-* only and aimed at cold-start preflight and
+       * ephemeral CI runners that haven't synced the full DB.
+       */
+      bloom?: {
+        /**
+         * Extra hosts permitted as `bloom.source`. The
+         * built-in allowlist (`endevco.github.io`) is enforced
+         * even if this field is omitted; entries here add to it.
+         */
+        allowedHosts?: string[];
+        /**
+         * Prefilter mode:
+         * - `off`: never run the bloom check.
+         * - `on`: run when a local filter is cached; on
+         *   fetch failure, fall back to the cached filter or
+         *   skip the prefilter (audit continues against the
+         *   non-bloom path).
+         * - `required`: hard-fail the audit when the bloom
+         *   refresh fails or the local cache is missing.
+         *   Use in hardened CI together with
+         *   `audit.advisories.source`.
+         * @default "off"
+         */
+        mode?: "off" | "on" | "required";
+        /**
+         * Bloom mirror base URL (no trailing slash). Defaults
+         * to the public `endevco/osv-bloom` GH Pages site.
+         * Override only if you mirror the bloom artifacts
+         * internally; the hostname must appear in
+         * `allowedHosts`.
+         * @default "https://endevco.github.io/osv-bloom"
+         */
+        source?: string;
+      };
+      /**
+       * Number of hours after `lastSyncIso` before `vis audit`
+       * prints a "your advisory cache may be stale" notice.
+       * `vis audit` never auto-syncs — the user runs
+       * `vis advisories sync` themselves.
+       * @default 24
+       */
+      refreshIntervalHours?: number;
+      /**
+       * OSV mirror base URL (no trailing slash). Defaults to the
+       * public Google Cloud Storage bucket. Override to point at a
+       * corporate mirror; the hostname must appear in `allowedHosts`
+       * (or one of the built-in defaults) and the scheme must be
+       * `https://`.
+       * @default "https://osv-vulnerabilities.storage.googleapis.com"
+       */
+      source?: string;
+      /**
+       * Sigstore signature verification for the OSV dump.
+       * Requires the native binding to be built with the
+       * `verify-signatures` Cargo feature (default in the release
+       * build). Off by default — the upstream OSV bucket does not
+       * ship signatures today.
+       */
+      verify?: {
+        /**
+         * Enable signature verification. The sync flow downloads
+         * `&lt;eco>/all.zip.sig` next to the zip and aborts if it
+         * cannot verify against `expectedIssuer` / `expectedSubject`.
+         * @default false
+         */
+        enabled?: boolean;
+        /** OIDC issuer that signed the bundle. */
+        expectedIssuer?: string;
+        /** OIDC subject (workload identity) that signed the bundle. */
+        expectedSubject?: string;
+      };
+    };
+    /**
+     * Gates for the auto-fix flow (`vis audit --fix` /
+     * `--fix-transitive`). The CLI prompts outside CI; inside CI
+     * the flags refuse to run unless `--yes` is set and, for
+     * transitives, `apply.transitive.enabled = true`.
+     */
+    apply?: {
+      /**
+       * Gates for `vis audit --fix-transitive`. Two-lock: the
+       * CLI requires `--yes` AND this flag set to `true` before
+       * it will rewrite override entries in CI.
+       */
+      transitive?: {
+        /**
+         * When true, allows `--fix-transitive` to run in CI
+         * environments. Defaults to false because rewriting
+         * overrides is a higher blast radius than bumping a
+         * direct dep.
+         * @default false
+         */
+        enabled?: boolean;
+      };
+    };
+    /**
+     * Vulnerability scanner backend.
+     *
+     * - `auto` (default): delegate to `aube audit` when aube is the
+     *   active installer (its scanner reads the same lockfile and
+     *   produces equivalent severity ratings); otherwise run vis's
+     *   own OSV/Socket scanner.
+     * - `aube`: always delegate to `aube audit`. Errors if `aube` is
+     *   not on PATH.
+     * - `vis`: always use vis's built-in scanner — never delegate.
+     *
+     * Delegation avoids redundant work (aube already has a
+     * full-fidelity audit pass that respects its own exclusions
+     * via `aube-workspace.yaml::auditConfig`) and lets users get
+     * a single, consistent result regardless of which entry point
+     * they invoke.
+     * @default "auto"
+     */
+    backend?: "aube" | "auto" | "vis";
+    /**
+     * When true, `vis audit` skips network calls and queries the
+     * offline cache. Equivalent to the CLI `--offline` flag.
+     * @default false
+     */
+    offlineByDefault?: boolean;
+  };
+  /**
+   * When true, prevents transitive dependencies from using exotic sources
+   * (git repositories, direct tarball URLs). Only direct dependencies may
+   * use such sources. Equivalent to pnpm's `blockExoticSubdeps`.
+   * @default false
+   */
+  blockExoticSubdeps?: boolean;
+  /**
+   * deps.dev (Google Open Source Insights) data-source configuration.
+   * Public, unauthenticated; pulls Scorecard data + advisories from
+   * `api.deps.dev`. Complements or replaces Socket.dev. Heavily cached.
+   * @see https://docs.deps.dev/api/v3/
+   */
+  depsDev?: {
+    /**
+     * Cache TTL for advisory entries (immutable once published). 7 days.
+     * @default 604800000
+     */
+    advisoryCacheTtlMs?: number;
+    /**
+     * Enable deps.dev scanning on install/update/check/audit commands.
+     * @default false
+     */
+    enabled?: boolean;
+    /**
+     * Cache TTL for OpenSSF Scorecard project data (refreshes weekly). 24 hours.
+     * @default 86400000
+     */
+    projectCacheTtlMs?: number;
+    /**
+     * Request timeout in milliseconds.
+     * @default 15000
+     */
+    timeoutMs?: number;
+    /**
+     * Cache TTL for npm version metadata (immutable). 7 days.
+     * @default 604800000
+     */
+    versionCacheTtlMs?: number;
+  };
+  /**
+   * Package names exempted from the `blockExoticSubdeps` check.
+   * Bare names and a trailing `*` glob (`@scope/*`) are supported.
+   * Use for an internal package legitimately published as a git or
+   * tarball dependency.
+   * @example ["@myorg/legacy", "internal-*"]
+   */
+  exoticSubdepsAllow?: string[];
+  /**
+   * Pre-install marshall pipeline — packument-derived supply-chain
+   * gates (author, provenance, s1ngularity, new-bin, metadata,
+   * downloads, expired-domains, signatures, archived-repo) that run before
+   * `vis add` / `vis install &lt;pkg>` / `vis update &lt;pkg>` hand off to
+   * the underlying package manager. Every entry is optional; omit a
+   * key and the marshall runs with defaults. Set `enabled: false`
+   * on a specific marshall to skip it without touching env vars.
+   */
+  marshalls?: {
+    /** Archived-repo marshall (GitHub repository status). */
+    archivedRepo?: {
+      /** Package names to skip. */
+      allowlist?: string[];
+      /** Default: marshall is on. Set false to disable. */
+      enabled?: boolean;
+      /** GitHub PAT for the API call (5k/hr vs 60/hr). */
+      githubToken?: string;
+    };
+    /** Author / publisher heuristics. */
+    author?: {
+      allowlist?: string[];
+      /** Days since the publisher's last release before flagging as error. */
+      dormantErrorDays?: number;
+      /** Days since the publisher's last release before flagging as warning. */
+      dormantWarnDays?: number;
+      enabled?: boolean;
+      /** Window for the "new publisher on an established package" check. */
+      newPublisherWindowDays?: number;
+      /** Days since the resolved version was published — error threshold. */
+      recentVersionErrorDays?: number;
+      /** Days since the resolved version was published — warning threshold. */
+      recentVersionWarnDays?: number;
+    };
+    /** npm `deprecated`-flag check on the resolved version. */
+    deprecation?: {
+      allowlist?: string[];
+      enabled?: boolean;
+    };
+    /** Monthly download-count floor. */
+    downloads?: {
+      allowlist?: string[];
+      enabled?: boolean;
+      /** Below this monthly count → error (default: 20). */
+      errorThreshold?: number;
+      /** Below this monthly count → warning (default: 1000). */
+      warnThreshold?: number;
+    };
+    /** Maintainer-email-domain NS lookup. */
+    expiredDomains?: {
+      /** Domains exempted from the check (legacy / internal). */
+      allowDomains?: string[];
+      allowlist?: string[];
+      /** DNS resolvers to query (default: system). */
+      dnsServers?: string[];
+      enabled?: boolean;
+      /** Per-domain DNS timeout (default: 5000). */
+      timeoutMs?: number;
+    };
+    /** README / license / repository presence checks. */
+    metadata?: {
+      allowlist?: string[];
+      /** Subset of checks to run. Default: all three. */
+      checks?: ("license" | "readme" | "repo")[];
+      enabled?: boolean;
+    };
+    /** New CLI-bin script introduced in this version. */
+    newBin?: {
+      allowlist?: string[];
+      enabled?: boolean;
+    };
+    /** Whole-package age heuristics (newly created / unmaintained). */
+    packageAge?: {
+      allowlist?: string[];
+      enabled?: boolean;
+      /** Package created fewer than this many days ago → error. Default 22. */
+      newPackageDays?: number;
+      /** No publish within this many days → warning. Default 365. */
+      unmaintainedDays?: number;
+    };
+    /** Provenance regression check. */
+    provenance?: {
+      allowlist?: string[];
+      enabled?: boolean;
+    };
+    /**
+     * Composite "compromised-publish shape" detector — flags a single
+     * version that simultaneously introduced/changed an install hook
+     * AND dropped the provenance attestation a prior stable version
+     * carried (the August 2025 s1ngularity / Nx fingerprint).
+     */
+    s1ngularity?: {
+      allowlist?: string[];
+      enabled?: boolean;
+    };
+    /**
+     * ECDSA P-256 verification against npm's signing keys. Disabled
+     * by default because npm coverage still has gaps that produce
+     * noisy warnings on legitimate packages.
+     */
+    signatures?: {
+      allowlist?: string[];
+      /** Default: marshall is *off*. Set true to enable. */
+      enabled?: boolean;
+      /** Override the keys endpoint (default: npm registry). */
+      keysUrl?: string;
+      /** How to treat an expired-but-known key. Default: "warning". */
+      treatExpiredAs?: "error" | "warning";
+    };
+  };
+  /**
+   * When true, `security.policies.installScripts.allow` keys are matched
+   * as `name@version`. A version bump on an approved package drops it from
+   * the allowlist until the new version is explicitly re-approved (port
+   * of LavaMoat allow-scripts' version-aware policy matcher).
+   *
+   * After a version bump, run `vis approve-builds` or `vis security list`
+   * — both surface a "Version drift" block with the suggested new key
+   * (`old-key  →  new-key`) so you can update `vis.config.ts` by hand.
+   * @default false
+   */
+  pinVersions?: boolean;
+  /**
+   * Supply-chain policy gates. Each sub-block enables one policy and
+   * configures its behavior. When a sub-block is omitted the policy is
+   * inactive. `acceptedRisks` (above) silences specific packages without
+   * disabling a policy globally.
+   *
+   * The 8 policies are inspired by Socket.dev's classification:
+   * - `malware`            — Socket-flagged malicious packages
+   * - `firstSeen`         — packages published less than N minutes ago
+   * - `unexpectedDeps`    — packages outside an allow-list / baseline
+   * - `publisherChange`   — maintainer set changed between installs
+   * - `installScripts`    — preinstall/install/postinstall scripts
+   * - `score`              — Socket overall score below threshold
+   * - `vulnerability`      — OSV vulnerability findings
+   * - `license`            — SPDX allow / deny lists
+   */
+  policies?: {
+    /**
+     * Minimum number of minutes that must pass after a version is
+     * published before vis will allow installation. Migrated from
+     * the legacy `security.minimumReleaseAge` field. Equivalent to
+     * pnpm's `minimumReleaseAge`.
+     * @default 0
+     * @example { minutes: 1440, exclude: ["@myorg/*"] } // 24 hours
+     */
+    firstSeen?: {
+      /**
+       * Package names/patterns excluded from the firstSeen check.
+       * Equivalent to pnpm's `minimumReleaseAgeExclude`.
+       * @example ["webpack", "react", "@myorg/*"]
+       */
+      exclude?: string[];
+      /** Minutes after publish before install is allowed. */
+      minutes?: number;
+    };
+    /**
+     * Build-script (pre/install/postinstall/prepare) controls.
+     * Migrated from the legacy `security.allowBuilds` /
+     * `security.strictDepBuilds` fields.
+     * @example { allow: { esbuild: true }, strict: true }
+     */
+    installScripts?: {
+      /**
+       * Map of package names/patterns to allow (true) or deny
+       * (false) build scripts. Packages not listed are denied
+       * by default. Equivalent to pnpm's `allowBuilds`.
+       */
+      allow?: Record<string, boolean>;
+      /**
+       * When true, installation will fail (exit non-zero) if any
+       * dependencies have unreviewed build scripts. Equivalent to
+       * pnpm's `strictDepBuilds`.
+       * @default false
+       */
+      strict?: boolean;
+    };
+    /**
+     * SPDX license allow / deny lists. Deny wins on any sub-license
+     * match in SPDX expressions (`(MIT OR GPL-3.0)` against
+     * `deny: ["GPL-3.0"]` is blocked). Packages with no declared
+     * license are flagged when `allow` is set.
+     * @example
+     * ```
+     * license: {
+     *   allow: ["MIT", "Apache-2.0", "BSD-3-Clause"],
+     *   deny: ["GPL-3.0", "AGPL-3.0"],
+     * }
+     * ```
+     */
+    license?: {
+      /**
+       * SPDX identifiers that are explicitly permitted. When set,
+       * any package whose declared license is not on this list is
+       * blocked.
+       */
+      allow?: string[];
+      /**
+       * SPDX identifiers that are explicitly forbidden. Always
+       * wins over `allow` when both reference the same identifier.
+       */
+      deny?: string[];
+    };
+    /**
+     * Behavior when the Socket.dev feed flags a package as malicious
+     * (`alerts[].type === "Malware"`).
+     *
+     * The default is cross-field: `{ mode: "block" }` whenever
+     * `security.socket.enabled !== false` (the engine cannot evaluate
+     * malware without Socket data), and `"off"` otherwise. Consumers
+     * resolve this default at evaluation time.
+     */
+    malware?: {
+      /**
+       * - `"block"` — emit a block decision.
+       * - `"warn"`  — surface as a warning; do not gate exit code.
+       * - `"off"`   — disable the policy entirely.
+       */
+      mode?: "block" | "off" | "warn";
+    };
+    /**
+     * Trust-level checking for package publishing. Migrated from the
+     * legacy `security.trustPolicy*` fields. Equivalent to pnpm's
+     * `trustPolicy`.
+     * @example { mode: "no-downgrade", ignoreAfter: 43200 } // 30 days
+     */
+    publisherChange?: {
+      /**
+       * Package selectors excluded from the check.
+       * Equivalent to pnpm's `trustPolicyExclude`.
+       * @example ["chokidar@4.0.3"]
+       */
+      exclude?: string[];
+      /**
+       * Ignore packages published more than N minutes ago. Useful
+       * for older packages that pre-date provenance support.
+       * Equivalent to pnpm's `trustPolicyIgnoreAfter`.
+       */
+      ignoreAfter?: number;
+      /**
+       * - `"off"`           — no trust checking (default).
+       * - `"no-downgrade"`  — block when a package's trust level
+       *   has decreased compared to previous releases (e.g., was
+       *   published by trusted publisher, now only has provenance).
+       */
+      mode?: "no-downgrade" | "off";
+    };
+    /**
+     * Socket.dev overall-score threshold. Packages scoring below
+     * `minimum` trigger a block decision (or interactive prompt
+     * during `vis add`). Migrated from the legacy
+     * `security.socket.minimumScore` field.
+     * @example { minimum: 0.4 }
+     */
+    score?: {
+      /**
+       * Minimum overall Socket.dev score (0–1). Set to 0 to
+       * disable the gate while keeping Socket data fetched.
+       *
+       * Consulted by `vis add`, `audit`, `doctor`, `check`, and
+       * `update`; resolved once in `buildSocketOptions`, then
+       * threaded through every consumer. Falls back to
+       * `DEFAULT_LOW_SCORE_THRESHOLD` (`0.4`) when unset.
+       */
+      minimum?: number;
+    };
+    /**
+     * Net-new transitive dependency detection. Either provide a
+     * static allow-list, a baseline lockfile path (recommended), or
+     * both — the intersection is enforced.
+     * @example { baselineLockfile: "./security/lockfile.baseline.yaml" }
+     */
+    unexpectedDeps?: {
+      /**
+       * Allow-list of dependency names that may appear in the
+       * resolved package set. Glob patterns are supported.
+       * @example ["lodash", "axios", "@myorg/*"]
+       */
+      allow?: string[];
+      /**
+       * Path (absolute or relative to the workspace root) to a
+       * baseline lockfile snapshot. The policy diffs the current
+       * lockfile against this baseline and flags any package that
+       * didn't exist before.
+       * @example "./security/lockfile.baseline.yaml"
+       */
+      baselineLockfile?: string;
+    };
+    /**
+     * OSV vulnerability gating. Migrated from the legacy
+     * `security.audit.failOn` + `security.audit.usage` fields.
+     */
+    vulnerability?: {
+      /**
+       * Severity threshold that makes `vis audit` exit non-zero.
+       * Equivalent to the CLI `--fail-on` flag.
+       * @example "high"
+       */
+      failOn?: "critical" | "high" | "low" | "medium";
+      /**
+       * Reachability filter — only report vulnerabilities in
+       * packages the workspace statically imports.
+       */
+      usage?: {
+        /**
+         * Packages to always treat as reachable even if no
+         * static import is found.
+         * @example ["esbuild", "webpack-cli"]
+         */
+        alwaysAssumeUsed?: string[];
+        /**
+         * Enable the reachability filter by default. Equivalent
+         * to `--usage` on the CLI; `--no-usage` disables.
+         * @default false
+         */
+        enabled?: boolean;
+      };
+    };
+  };
+  /**
+   * Which provider wins merge conflicts when multiple are enabled (e.g.
+   * both Socket.dev and deps.dev return data for the same package). The
+   * primary provider's `score` is kept; alerts from secondaries are
+   * appended and deduped by `key`. Defaults to whichever provider is
+   * enabled first in this order: socket → deps-dev → snyk.
+   */
+  primaryProvider?: "deps-dev" | "snyk" | "socket";
+  /**
+   * Snyk data-source configuration. Snyk only contributes vulnerability
+   * data (no maintenance / quality / supply-chain / license signal);
+   * those axes stay neutral. Requires both an org id and an API token —
+   * if either is missing the provider is skipped.
+   * @see https://docs.snyk.io/snyk-api/using-specific-snyk-apis/issues-list-issues-for-a-package
+   */
+  snyk?: {
+    /**
+     * Snyk API token. Set via VIS_SNYK_TOKEN environment variable or
+     * here.
+     */
+    apiToken?: string;
+    /**
+     * Snyk REST API version date sent as the `version` query param.
+     * @default "2024-10-15"
+     */
+    apiVersion?: string;
+    /**
+     * Cache TTL in milliseconds for Snyk issue lookups. 6 hours.
+     * @default 21600000
+     */
+    cacheTtlMs?: number;
+    /**
+     * Enable Snyk security scanning on install/update/check/audit
+     * commands.
+     * @default false
+     */
+    enabled?: boolean;
+    /**
+     * Snyk organization id (the REST endpoint is org-scoped). Set via
+     * VIS_SNYK_ORG environment variable or here.
+     */
+    orgId?: string;
+    /**
+     * Request timeout in milliseconds for the Snyk API. 15 seconds.
+     * @default 15000
+     */
+    timeoutMs?: number;
+  };
+  /**
+   * Socket.dev data-source configuration. Connection knobs only — score
+   * thresholds and accepted-risk overrides moved to `policies.score` and
+   * `security.acceptedRisks` respectively.
+   * @see https://socket.dev
+   */
+  socket?: {
+    /**
+     * Custom Socket.dev API token. Falls back to the public API token.
+     * Set via VIS_SOCKET_TOKEN environment variable or here.
+     */
+    apiToken?: string;
+    /**
+     * Cache TTL in milliseconds for Socket.dev reports. 1 hour.
+     * @default 3600000
+     */
+    cacheTtlMs?: number;
+    /**
+     * Enable Socket.dev security scanning on install/update/check commands.
+     * @default false
+     */
+    enabled?: boolean;
+    /**
+     * Request timeout in milliseconds for the Socket.dev API. 15 seconds.
+     * @default 15000
+     */
+    timeoutMs?: number;
+  };
+  /**
+   * Package names to skip during typosquat detection.
+   * Use this for internal packages or known-safe names that happen to
+   * look similar to popular packages.
+   * @example ["my-internal-axois", "@myorg/recat"]
+   */
+  typosquatAllowlist?: string[];
+}
+interface VisUpdateConfig {
+  /**
+   * Dependency fields to scan for outdated packages.
+   * Beyond the standard fields, supports:
+   * - `"overrides"` (npm)
+   * - `"resolutions"` (yarn)
+   * - `"pnpm.overrides"`
+   * @default ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]
+   */
+  depFields?: string[];
+  exclude?: string[];
+  format?: "json" | "minimal" | "table";
+  /**
+   * Package names or glob patterns to permanently ignore during updates.
+   * Ignored packages are skipped and listed in the output so you know
+   * they were not checked.
+   * @example ["eslint", "@types/*"]
+   */
+  ignore?: string[];
+  include?: string[];
+  /**
+   * Include packages with pinned/exact versions (no `^` or `~` prefix).
+   * By default, pinned versions are skipped during update checks.
+   * @default false
+   */
+  includeLocked?: boolean;
+  install?: boolean;
+  /**
+   * Maximum number of concurrent registry requests during outdated checks.
+   * Higher values speed up large workspaces but risk hitting registry rate
+   * limits or self-hosted Verdaccio caps.
+   * @default 8
+   */
+  maxConcurrentRequests?: number;
+  /**
+   * Minimum number of minutes since a version was published before
+   * vis will consider it for updates. This mirrors pnpm's
+   * `minimumReleaseAge` — a single setting that applies to both
+   * install and update.
+   *
+   * Not set by default. If your package manager config
+   * (`pnpm-workspace.yaml`) has `minimumReleaseAge`, vis will
+   * read it from there as a fallback.
+   * @example 1440 // 24 hours
+   */
+  minimumReleaseAge?: number;
+  /**
+   * Package names/patterns excluded from the minimumReleaseAge check.
+   * @example ["webpack", "@myorg/*"]
+   */
+  minimumReleaseAgeExclude?: string[];
+  /**
+   * Per-package or per-pattern update target overrides.
+   * Keys are exact package names, glob patterns, or regex patterns
+   * wrapped in `/` (e.g., `/^@vue/`).
+   * Values are `"latest"`, `"minor"`, or `"patch"`.
+   * @example { "typescript": "minor", "/^@vue/": "patch" }
+   */
+  packageMode?: Record<string, "latest" | "minor" | "patch">;
+  prerelease?: boolean;
+  /**
+   * Which release channels to consider when picking the target version.
+   * - `"stable"` (default) — only ship stable releases (no prereleases).
+   * - `"same"` — match the prerelease channel of the *current* range:
+   *   if you're on `react@19.0.0-rc.1`, only `rc.*` candidates qualify;
+   *   if you're on a stable, only stable candidates. Prevents
+   *   accidentally promoting a prerelease pin to a stable major bump.
+   * - `"any"` — equivalent to `--prerelease`. Any channel is fair game.
+   *
+   * `--release-channel` on the CLI overrides this. If `prerelease: true`
+   * is set without `releaseChannel`, vis treats it as `"any"`.
+   * @default "stable"
+   */
+  releaseChannel?: "any" | "same" | "stable";
+  security?: boolean;
+  target?: "latest" | "minor" | "patch";
+}
+/**
+ * Same shape as `T`. Wrapping a section type in it makes the schema
+ * generator emit the section as a nested object, as it does for an inline
+ * type literal, instead of a `$ref` to a named definition. This keeps the
+ * published JSON schema unchanged when a section moves to its own module.
+ */
+type Inline<T> = { [K in keyof T]: T[K]; };
+/**
+ * A predicate used by {@link VisConfig.scopedTasks}.
+ * All listed constraints must match for the block to apply.
+ */
+interface ScopedTasksMatch {
+  /** Match on primary language. */
+  language?: string | string[];
+  /** Match on project layer. */
+  layer?: ProjectJson["layer"] | ProjectJson["layer"][];
+  /** Match on project type. */
+  projectType?: "application" | "library" | "service" | "tool";
+  /** Match on project stack. */
+  stack?: ProjectJson["stack"] | ProjectJson["stack"][];
+  /** Match projects tagged with any of these tags. */
+  tags?: string[];
+}
+interface VisConfig {
+  /**
+   * Workspace-relative glob patterns for changed files outside every
+   * project that `vis affected`, `vis run --affected`, `vis ci` and
+   * `vis ci ignore` should not count as a change.
+   *
+   * By default a changed file that belongs to no project (a root
+   * `tsconfig.json`, `package.json`, …) is a global change and marks every
+   * project affected. A changed file matching one of these patterns is
+   * skipped instead. The patterns are only checked for files that belong
+   * to NO project: a file inside a project root is never filtered, so a
+   * broad pattern like `*.md` cannot hide a real package change.
+   *
+   * Patterns use `path.matchesGlob` syntax, where `*` does not cross `/`:
+   * `*.md` matches `README.md` but not `docs/guide.md`.
+   *
+   * Do NOT list paths whose changes really do affect projects, such as
+   * bundler-inlined shared source or the root `tsconfig.json`: an edit
+   * there would then run nothing.
+   * @example ["api-snapshots/**", "plans/**", "*.md"]
+   */
+  affectedIgnore?: string[];
+  /** AI analysis configuration */
+  ai?: {
+    /** Cache TTL in milliseconds. Overrides default (1h / 30min for security). */
+    cacheTtl?: number;
+    /** Override default provider priority. Higher number = preferred. */
+    priority?: Record<string, number>;
+    /** Use a specific provider instead of auto-detecting (e.g., `"claude"`, `"gemini"`). */
+    provider?: string;
+  };
+  /**
+   * Scope the task-runner cache directory by the current git branch.
+   * When `true`, caches are stored under `&lt;cacheDir>/branches/&lt;slug>`
+   * so `main` and feature branches stop thrashing each other —
+   * generated artefacts (schemas, `.d.ts` snapshots) that legitimately
+   * differ across branches no longer oscillate the cache contents.
+   *
+   * Falls back to the unscoped path on detached HEAD, non-git
+   * workspaces, or when git isn't available.
+   * @default false
+   */
+  branchScopedCache?: boolean;
+  /**
+   * Code ownership configuration. Controls how `vis sync codeowners`
+   * renders the generated CODEOWNERS file.
+   */
+  codeowners?: CodeownersConfig;
+  /**
+   * Composer packages as task projects. Off by default: a `composer.json` in a
+   * subdirectory gets validate and, when its scripts define them, test and lint targets.
+   */
+  composer?: {
+    discover?: boolean;
+  };
+  /**
+   * Project dependency constraints.
+   * Enforced after building the project graph, before running tasks.
+   */
+  constraints?: ConstraintsConfig;
+  /**
+   * Configuration for the `vis create` scaffolding command.
+   * Controls template downloads (via giget), default options, and
+   * post-creation behavior.
+   */
+  create?: {
+    /**
+     * Authorization token for downloading private repository templates.
+     * Passed as Bearer token to the git host API.
+     * Can also be set via GIGET_AUTH, GITHUB_TOKEN, or GH_TOKEN environment variables.
+     */
+    auth?: string;
+    /**
+     * Default editor to configure after scaffolding.
+     * When set, `vis create` automatically generates editor config files.
+     * @example "vscode"
+     */
+    defaultEditor?: "vscode";
+    /**
+     * Default package manager for new standalone projects.
+     * When set, skips the PM selection prompt in interactive mode.
+     */
+    defaultPm?: "bun" | "npm" | "pnpm" | "yarn";
+    /**
+     * Default giget provider for `owner/repo` shorthand inputs.
+     * @default "github"
+     */
+    defaultProvider?: "bitbucket" | "github" | "gitlab" | "sourcehut";
+    /**
+     * Template used by a bare `vis create`. Accepts any template input, including an
+     * organization scope (`@acme` opens the `@acme/create` manifest picker, `@acme:app`
+     * selects one entry directly). In a terminal the usual prompts still run, minus the template step.
+     * @example "@acme"
+     */
+    defaultTemplate?: string;
+    /**
+     * Initialize a git repository after scaffolding standalone projects.
+     * @default false
      */
     gitInit?: boolean;
     /**
@@ -1376,326 +2415,48 @@ interface VisConfig {
    *
    * Shown at most once every 14 days; skipped in CI, non-TTY shells,
    * during `--help`/`--version`/`ai`/`mcp` invocations, and when
-   * `VIS_NO_MCP_PROMOTE=1` is set. Set `enabled: false` to silence
-   * permanently for this workspace.
-   * @example
-   * ```
-   * mcpPromote: { enabled: false }
-   * ```
-   */
-  mcpPromote?: {
-    /**
-     * Show the vis-mcp promotion notice on successful command completion.
-     * @default true
-     */
-    enabled?: boolean;
-  };
-  /**
-   * Named input patterns inherited by every project target. Equivalent
-   * to task-runner's `namedInputs` but configurable from the vis config.
-   */
-  namedInputs?: NamedInputs;
-  /**
-   * NuGet projects as task projects. Off by default: each directory with one `*.csproj` or
-   * `*.fsproj` (outside `bin`, `obj` and `node_modules`) gets build, test and format:check
-   * targets when this is set. POSIX only: the inferred commands are not verified on Windows.
-   */
-  nuget?: {
-    discover?: boolean;
-  };
-  /** Package override mappings applied during migration (e.g., `{ "lodash": "lodash-es" }`) */
-  overrides?: Record<string, string>;
-  /**
-   * Plugins — each plugin registers typed hooks that fire at run /
-   * task / cache boundaries. See {@link VisPlugin} for the contract.
-   * Prefer plugins over per-target shell hooks when behaviour needs
-   * access to task metadata, results, or cache state.
-   */
-  plugins?: VisPlugin[];
-  /**
-   * Workspace dep-policy lints exposed via `vis lint`. Each block opts in
-   * to a single rule; the command flags (`--workspace-protocol`,
-   * `--no-redefine-root`, `--banned-deps`) toggle them per-run.
-   */
-  policy?: {
-    /**
-     * Map of dep names or globs → reason (or `{ reason, replacement, packages?, paths? }`).
-     * Internal/workspace deps are never flagged here; the
-     * workspace-protocol lint owns those.
-     *
-     * Optional `packages` (globs over the declaring package's `name`) and
-     * `paths` (globs over the workspace-relative `packageDir`) narrow where
-     * the rule applies. With both set, either match is enough. Omit both
-     * to ban anywhere — the default.
-     * @example
-     * ```
-     * bannedDeps: {
-     *   request: "deprecated; use undici",
-     *   moment: { reason: "huge bundle, frozen upstream", replacement: "date-fns" },
-     *   "@radix-ui/*": "we standardized on shadcn",
-     *   react: { reason: "no react in shared libs", paths: ["packages/shared/*"] },
-     *   "next": { reason: "apps only", packages: ["@app/*"] },
-     * }
-     * ```
-     */
-    bannedDeps?: Record<string, string | {
-      packages?: string[];
-      paths?: string[];
-      reason: string;
-      replacement?: string;
-    }>;
-    /**
-     * Tweak the custom-types lint that flags drift in `engines.{node,pnpm,...}`,
-     * `packageManager`, `volta.{node,pnpm,yarn}`, and the proposed
-     * `devEngines.{runtime,packageManager}` array form.
-     *
-     * Each (customType × name) cluster is tracked independently —
-     * `engines.node` and `volta.node` don't cross-couple here. Use a
-     * versionGroup once that lands if you need to enforce they agree.
-     */
-    customTypes?: {
-      /**
-       * Three-state autofix opt-out. See `workspaceProtocol.autofix`
-       * for the contract — same semantics, applied to drift rewrites
-       * across engines / packageManager / volta / devEngines.
-       *
-       * Note: `--fix` strips any `+sha512.&lt;hash&gt;` suffix from
-       * `packageManager` on bump — content-integrity hashes are tied
-       * to a specific package, not a version, so users must regenerate
-       * via their PM (`pnpm install` re-pins; `corepack use pnpm@X` etc.).
-       * @default true
-       */
-      autofix?: "prompt" | boolean;
-      /**
-       * User-defined custom-type pin locations. Each entry tells the
-       * customTypes lint to read additional version pins from a
-       * non-standard JSON path inside every workspace package.json,
-       * cluster them by `(name × depName)` like the built-in types,
-       * and rewrite them with `--fix`.
-       *
-       * The original built-ins (`engines`, `volta`, `packageManager`,
-       * `devEngines.runtime`, `devEngines.packageManager`) keep
-       * running unconditionally — these layer on top.
-       *
-       * Strategies:
-       * - `versionsByName`: the JSON at `path` is `{ [depName]: version }`
-       *   (like `engines` or `pnpm.overrides`).
-       * - `name@version`: the JSON at `path` is a string of the form
-       *   `name@version` (like `packageManager`). The leading `name@`
-       *   is preserved; only the version segment is rewritten.
-       * - `string`: the JSON at `path` is a bare version string. The
-       *   `depName` field is required and identifies the dep cluster.
-       *
-       * `name` must not collide with a built-in type name. `path` is
-       * a dot-separated walk into the package.json (e.g. `pnpm.overrides`).
-       * @example
-       * ```ts
-       * extraTypes: [
-       *   { name: "pnpmOverridesLegacy", path: "pnpm.overrides", strategy: "versionsByName" },
-       *   { name: "myToolPin",           path: "myTool.runtime", strategy: "name@version" },
-       *   { name: "minNode",             path: "config.minNode", strategy: "string", depName: "node" },
-       * ]
-       * ```
-       */
-      extraTypes?: ExtraCustomType[];
-      /**
-       * Dep names exempt from the drift check (exact match against the
-       * field name within the block — e.g. `node`, `pnpm`).
-       */
-      ignore?: string[];
-      /**
-       * Resolution strategy used when `--fix` runs.
-       * - `highest` (default): align every drifting instance to the
-       *   highest declared version.
-       * - `lowest`: align to the lowest.
-       * @default "highest"
-       */
-      resolve?: "highest" | "lowest";
-    };
-    /**
-     * Tweak the dead-workspace-patterns lint that flags entries in
-     * `pnpm-workspace.yaml#packages` / `package.json#workspaces` which
-     * resolve to zero on-disk directories.
-     */
-    deadWorkspacePatterns?: {
-      /**
-       * Three-state autofix opt-out. See `workspaceProtocol.autofix`
-       * for the contract — applied here to dropping unmatched patterns
-       * from the workspace config file.
-       * @default true
-       */
-      autofix?: "prompt" | boolean;
-    };
-    /**
-     * Tweak the empty-deps lint that flags empty `dependencies` /
-     * `devDependencies` / `peerDependencies` / `optionalDependencies`
-     * blocks across the workspace.
-     */
-    emptyDeps?: {
-      /**
-       * Three-state autofix opt-out. See `workspaceProtocol.autofix`
-       * for the contract — applied here to removing the empty key.
-       * @default true
-       */
-      autofix?: "prompt" | boolean;
-      /**
-       * Block names exempt from the rule (e.g. `["peerDependencies"]`
-       * to keep the key around as a marker even when empty).
-       */
-      ignoreBlocks?: ("dependencies" | "devDependencies" | "optionalDependencies" | "peerDependencies")[];
-    };
-    /**
-     * Tweak the redefine-root lint that flags non-root packages duplicating
-     * deps already pinned at the workspace root.
-     */
-    redefineRoot?: {
-      /** Dep names that are exempt from the redefine-root rule (exact match). */
-      ignore?: string[];
-    };
-    /**
-     * Tweak the root-deps lint that flags runtime `dependencies` declared
-     * on the private workspace root (they should live in `devDependencies`).
-     */
-    rootDeps?: {
-      /**
-       * Three-state autofix opt-out. See `workspaceProtocol.autofix`
-       * for the contract — applied here to moving entries from
-       * `dependencies` to `devDependencies` on the root package.json.
-       * @default true
-       */
-      autofix?: "prompt" | boolean;
-    };
-    /**
-     * Tweak the root-package-manager lint that flags a missing or
-     * malformed `packageManager` field on the workspace root.
-     */
-    rootPackageManager?: {
-      /**
-       * Three-state autofix opt-out. See `workspaceProtocol.autofix`
-       * for the contract. `--fix` only writes when `suggested` is set —
-       * a missing `packageManager` field has no canonical default.
-       * @default true
-       */
-      autofix?: "prompt" | boolean;
-      /**
-       * Canonical specifier (`name@version`) to write when `--fix` runs
-       * and the field is absent. Required to enable autofix —
-       * vis won't guess the workspace's preferred manager.
-       * @example "pnpm@10.32.1"
-       */
-      suggested?: string;
-    };
-    /**
-     * Tweak the root-private lint that flags a workspace root package.json
-     * missing `"private": true`. Only fires when the root looks like a
-     * workspace (npm/yarn/bun `workspaces` field or `pnpm-workspace.yaml`).
-     */
-    rootPrivate?: {
-      /**
-       * Three-state autofix opt-out. See `workspaceProtocol.autofix`
-       * for the contract — applied here to inserting `"private": true`.
-       * @default true
-       */
-      autofix?: "prompt" | boolean;
-    };
-    /**
-     * Tweak the similar-deps lint that flags drift across related dep
-     * families (e.g. `react` and `react-dom`, all of `@babel/*`).
-     *
-     * The lint is report-only — aligning a family requires picking a
-     * single canonical specifier across heterogeneous range syntaxes
-     * (`^`, `~`, exact), which is too lossy without user input.
-     */
-    similarDeps?: {
-      /**
-       * Additional families merged with the built-ins. Same `id` wins
-       * → user override fully replaces the built-in entry.
-       * @example
-       * ```
-       * extraFamilies: [
-       *   { id: "vue", label: "Vue", members: ["vue", "vue-router", "pinia"] },
-       * ]
-       * ```
-       */
-      extraFamilies?: SimilarDepFamily[];
-      /** Family ids to skip entirely (matches `SimilarDepFamily.id`). */
-      ignoreFamilies?: string[];
-    };
-    /**
-     * Tweak the types-in-deps lint that flags `@types/*` declared in
-     * `dependencies` on a private package (they belong in
-     * `devDependencies` since the package never ships).
-     */
-    typesInDeps?: {
-      /**
-       * Three-state autofix opt-out. See `workspaceProtocol.autofix`
-       * for the contract — applied here to moving the entry to
-       * `devDependencies`. Existing dev pins are preserved on conflict.
-       * @default true
-       */
-      autofix?: "prompt" | boolean;
-      /** Dep names exempt from the rule (exact match, e.g. `@types/node`). */
-      ignore?: string[];
-    };
-    /**
-     * Tweak the workspace-protocol lint that flags internal deps not
-     * using the `workspace:` protocol.
-     */
-    workspaceProtocol?: {
-      /**
-       * Three-state autofix opt-out. Some workspaces want detection
-       * without rewrite (e.g. dual-licensed packages where `workspace:*`
-       * is unsafe).
-       * - `true` (default): `--fix` rewrites the specifier.
-       * - `false`: never rewrite — report the violation only.
-       * - `"prompt"`: ask before each rewrite. Falls back to report-only
-       *   when stdin isn't a TTY (CI). Reserved; not yet implemented.
-       *
-       * Note: when `false` (or `"prompt"`), `--fix` still **fails CI** on
-       * detected violations — the rule is "report only", not "ignore".
-       * Drop the rule from the lint selection if you want a clean exit.
-       * @default true
-       * @example
-       * ```
-       * policy: {
-       *   workspaceProtocol: { autofix: false },
-       * }
-       * ```
-       */
-      autofix?: "prompt" | boolean;
-    };
+   * `VIS_NO_MCP_PROMOTE=1` is set. Set `enabled: false` to silence
+   * permanently for this workspace.
+   * @example
+   * ```
+   * mcpPromote: { enabled: false }
+   * ```
+   */
+  mcpPromote?: {
     /**
-     * Tweak the workspace-versions lint that flags external deps declared
-     * at inconsistent versions across the workspace.
+     * Show the vis-mcp promotion notice on successful command completion.
+     * @default true
      */
-    workspaceVersions?: {
-      /**
-       * Three-state autofix opt-out. See `workspaceProtocol.autofix`
-       * for the contract — same semantics, applied to drift rewrites.
-       *
-       * Also gates the `--propose-min` catalog suggestion writer:
-       * when `false` / `"prompt"`, `--fix --propose-min` reports the
-       * proposed catalog entries but does not write
-       * `pnpm-workspace.yaml`. Same "report only, still fails CI"
-       * note applies as on `workspaceProtocol.autofix`.
-       * @default true
-       */
-      autofix?: "prompt" | boolean;
-      /** Dep names exempt from the version-drift check (exact match). */
-      ignore?: string[];
-      /**
-       * Resolution strategy used when `--fix` runs.
-       * - `highest` (default): rewrite every drifting instance to the
-       *   highest sibling specifier.
-       * - `lowest`: rewrite to the lowest.
-       * - `catalog`: rewrite any dep already pinned in a workspace catalog
-       *   to `catalog:` / `catalog:&lt;name>`. Catalog must exist; this lint
-       *   does not create the catalog (see `vis lint --resolve catalog --propose`).
-       * @default "highest"
-       */
-      resolve?: "catalog" | "highest" | "lowest";
-    };
+    enabled?: boolean;
+  };
+  /**
+   * Named input patterns inherited by every project target. Equivalent
+   * to task-runner's `namedInputs` but configurable from the vis config.
+   */
+  namedInputs?: NamedInputs;
+  /**
+   * NuGet projects as task projects. Off by default: each directory with one `*.csproj` or
+   * `*.fsproj` (outside `bin`, `obj` and `node_modules`) gets build, test and format:check
+   * targets when this is set. POSIX only: the inferred commands are not verified on Windows.
+   */
+  nuget?: {
+    discover?: boolean;
   };
+  /** Package override mappings applied during migration (e.g., `{ "lodash": "lodash-es" }`) */
+  overrides?: Record<string, string>;
+  /**
+   * Plugins — each plugin registers typed hooks that fire at run /
+   * task / cache boundaries. See {@link VisPlugin} for the contract.
+   * Prefer plugins over per-target shell hooks when behaviour needs
+   * access to task metadata, results, or cache state.
+   */
+  plugins?: VisPlugin[];
+  /**
+   * Workspace dep-policy lints exposed via `vis lint`. Each block opts in
+   * to a single rule; the command flags (`--workspace-protocol`,
+   * `--no-redefine-root`, `--banned-deps`) toggle them per-run.
+   */
+  policy?: Inline<VisPolicyConfig>;
   /**
    * Pre-flight checks fired before `vis run` starts the orchestrator.
    * Each check is opt-out (`false`) — defaults are sensible for the
@@ -1880,682 +2641,7 @@ interface VisConfig {
    * For npm/yarn/bun users: vis enforces these at the vis layer since
    * those package managers lack native support.
    */
-  security?: {
-    /**
-     * Packages whose policy findings have been reviewed and explicitly
-     * accepted. Matched against every policy unless `policies` narrows the
-     * scope. Replaces the legacy `security.socket.acceptedRisks` map.
-     *
-     * Key format: package name (`"lodash"`), name@version
-     * (`"lodash@4.17.21"`), or glob (`"@myorg/*"`). Unversioned keys match
-     * all versions of that package.
-     * @example
-     * ```
-     * acceptedRisks: {
-     *   "some-risky-pkg": {
-     *     reason: "Internal fork, low score expected",
-     *     acceptedAt: "2026-03-15T10:00:00Z",
-     *     acceptedScore: 0.25,
-     *     policies: ["score"],
-     *     expiresAt: "2026-12-31",
-     *   },
-     * }
-     * ```
-     */
-    acceptedRisks?: Record<string, {
-      /** ISO 8601 timestamp when the risk was accepted. */
-      acceptedAt: string;
-      /**
-       * The overall Socket.dev score at the time of acceptance,
-       * in the range `[0, 1]` (mirrors `policies.score.minimum`).
-       * Only relevant for the `score` policy; ignored elsewhere.
-       */
-      acceptedScore?: number;
-      /**
-       * ISO 8601 date (or datetime). After this point the acceptance
-       * stops applying and vis emits a warning. Leave undefined for
-       * non-expiring entries. Values that fail to parse as a Date
-       * are rejected by the loader rather than silently treated as
-       * "always expired".
-       */
-      expiresAt?: string;
-      /**
-       * Which policies this acceptance covers. When undefined the
-       * acceptance applies to every policy finding on this package.
-       */
-      policies?: PolicyName[];
-      /** User-provided reason for accepting the risk. */
-      reason: string;
-    }>;
-    /**
-     * Map of bin names (or `pkg#bin` qualifiers) blessed for shadowing.
-     * When two installed packages expose the same bin name, vis flags
-     * the collision in `vis security list` and the post-install drift
-     * report — set the bin (or `pkg#bin`) to `true` here to suppress
-     * the warning once you've reviewed the conflict.
-     *
-     * Port of LavaMoat allow-scripts' experimental `allowBins`.
-     * Bare names match any conflicting bin with that name; the
-     * `pkg#bin` form scopes the approval to a single package's bin.
-     * @example
-     * ```
-     * allowBins: {
-     *   tsc: true,                // bless any 'tsc' bin
-     *   "typescript#tsc": true,   // bless only typescript's 'tsc'
-     * }
-     * ```
-     */
-    allowBins?: Record<string, boolean>;
-    /**
-     * Offline OSV advisory + `vis audit` configuration.
-     *
-     * Controls `vis audit --offline` and `vis advisories sync` behavior:
-     * - `audit.advisories.source` is the OSV mirror to download from. It
-     *   must be `https://` and resolve to a host in `allowedHosts` (or one
-     *   of the built-in defaults).
-     * - `audit.offlineByDefault` flips the default of `--offline`.
-     *
-     * Vulnerability severity gating and reachability filtering live under
-     * `policies.vulnerability` (see below).
-     */
-    audit?: {
-      /**
-       * Offline advisory cache settings.
-       */
-      advisories?: {
-        /**
-         * Extra hosts permitted as `audit.advisories.source`. The
-         * built-in allowlist is enforced even if this field is
-         * omitted; entries here add to it.
-         * @example ["mirror.corp.example.com"]
-         */
-        allowedHosts?: string[];
-        /**
-         * Bloom-filter prefilter for OSV `MAL-*` (malicious-package)
-         * advisories. Probes a ~380 KB filter fetched from
-         * `endevco/osv-bloom` and escalates hits to the existing
-         * advisory query path for `(name, version)` confirmation.
-         *
-         * Cost: ~380 KB on the wire, refreshed every 10 minutes
-         * upstream. False-positive rate is ~0.1%, so a typical
-         * 1000-package lockfile triggers zero or one extra
-         * round trip per audit.
-         *
-         * Independent of `audit.advisories.source` / `verify` —
-         * those control the full OSV ingest. The bloom is
-         * MAL-* only and aimed at cold-start preflight and
-         * ephemeral CI runners that haven't synced the full DB.
-         */
-        bloom?: {
-          /**
-           * Extra hosts permitted as `bloom.source`. The
-           * built-in allowlist (`endevco.github.io`) is enforced
-           * even if this field is omitted; entries here add to it.
-           */
-          allowedHosts?: string[];
-          /**
-           * Prefilter mode:
-           * - `off`: never run the bloom check.
-           * - `on`: run when a local filter is cached; on
-           *   fetch failure, fall back to the cached filter or
-           *   skip the prefilter (audit continues against the
-           *   non-bloom path).
-           * - `required`: hard-fail the audit when the bloom
-           *   refresh fails or the local cache is missing.
-           *   Use in hardened CI together with
-           *   `audit.advisories.source`.
-           * @default "off"
-           */
-          mode?: "off" | "on" | "required";
-          /**
-           * Bloom mirror base URL (no trailing slash). Defaults
-           * to the public `endevco/osv-bloom` GH Pages site.
-           * Override only if you mirror the bloom artifacts
-           * internally; the hostname must appear in
-           * `allowedHosts`.
-           * @default "https://endevco.github.io/osv-bloom"
-           */
-          source?: string;
-        };
-        /**
-         * Number of hours after `lastSyncIso` before `vis audit`
-         * prints a "your advisory cache may be stale" notice.
-         * `vis audit` never auto-syncs — the user runs
-         * `vis advisories sync` themselves.
-         * @default 24
-         */
-        refreshIntervalHours?: number;
-        /**
-         * OSV mirror base URL (no trailing slash). Defaults to the
-         * public Google Cloud Storage bucket. Override to point at a
-         * corporate mirror; the hostname must appear in `allowedHosts`
-         * (or one of the built-in defaults) and the scheme must be
-         * `https://`.
-         * @default "https://osv-vulnerabilities.storage.googleapis.com"
-         */
-        source?: string;
-        /**
-         * Sigstore signature verification for the OSV dump.
-         * Requires the native binding to be built with the
-         * `verify-signatures` Cargo feature (default in the release
-         * build). Off by default — the upstream OSV bucket does not
-         * ship signatures today.
-         */
-        verify?: {
-          /**
-           * Enable signature verification. The sync flow downloads
-           * `&lt;eco>/all.zip.sig` next to the zip and aborts if it
-           * cannot verify against `expectedIssuer` / `expectedSubject`.
-           * @default false
-           */
-          enabled?: boolean;
-          /** OIDC issuer that signed the bundle. */
-          expectedIssuer?: string;
-          /** OIDC subject (workload identity) that signed the bundle. */
-          expectedSubject?: string;
-        };
-      };
-      /**
-       * Gates for the auto-fix flow (`vis audit --fix` /
-       * `--fix-transitive`). The CLI prompts outside CI; inside CI
-       * the flags refuse to run unless `--yes` is set and, for
-       * transitives, `apply.transitive.enabled = true`.
-       */
-      apply?: {
-        /**
-         * Gates for `vis audit --fix-transitive`. Two-lock: the
-         * CLI requires `--yes` AND this flag set to `true` before
-         * it will rewrite override entries in CI.
-         */
-        transitive?: {
-          /**
-           * When true, allows `--fix-transitive` to run in CI
-           * environments. Defaults to false because rewriting
-           * overrides is a higher blast radius than bumping a
-           * direct dep.
-           * @default false
-           */
-          enabled?: boolean;
-        };
-      };
-      /**
-       * Vulnerability scanner backend.
-       *
-       * - `auto` (default): delegate to `aube audit` when aube is the
-       *   active installer (its scanner reads the same lockfile and
-       *   produces equivalent severity ratings); otherwise run vis's
-       *   own OSV/Socket scanner.
-       * - `aube`: always delegate to `aube audit`. Errors if `aube` is
-       *   not on PATH.
-       * - `vis`: always use vis's built-in scanner — never delegate.
-       *
-       * Delegation avoids redundant work (aube already has a
-       * full-fidelity audit pass that respects its own exclusions
-       * via `aube-workspace.yaml::auditConfig`) and lets users get
-       * a single, consistent result regardless of which entry point
-       * they invoke.
-       * @default "auto"
-       */
-      backend?: "aube" | "auto" | "vis";
-      /**
-       * When true, `vis audit` skips network calls and queries the
-       * offline cache. Equivalent to the CLI `--offline` flag.
-       * @default false
-       */
-      offlineByDefault?: boolean;
-    };
-    /**
-     * When true, prevents transitive dependencies from using exotic sources
-     * (git repositories, direct tarball URLs). Only direct dependencies may
-     * use such sources. Equivalent to pnpm's `blockExoticSubdeps`.
-     * @default false
-     */
-    blockExoticSubdeps?: boolean;
-    /**
-     * deps.dev (Google Open Source Insights) data-source configuration.
-     * Public, unauthenticated; pulls Scorecard data + advisories from
-     * `api.deps.dev`. Complements or replaces Socket.dev. Heavily cached.
-     * @see https://docs.deps.dev/api/v3/
-     */
-    depsDev?: {
-      /**
-       * Cache TTL for advisory entries (immutable once published). 7 days.
-       * @default 604800000
-       */
-      advisoryCacheTtlMs?: number;
-      /**
-       * Enable deps.dev scanning on install/update/check/audit commands.
-       * @default false
-       */
-      enabled?: boolean;
-      /**
-       * Cache TTL for OpenSSF Scorecard project data (refreshes weekly). 24 hours.
-       * @default 86400000
-       */
-      projectCacheTtlMs?: number;
-      /**
-       * Request timeout in milliseconds.
-       * @default 15000
-       */
-      timeoutMs?: number;
-      /**
-       * Cache TTL for npm version metadata (immutable). 7 days.
-       * @default 604800000
-       */
-      versionCacheTtlMs?: number;
-    };
-    /**
-     * Package names exempted from the `blockExoticSubdeps` check.
-     * Bare names and a trailing `*` glob (`@scope/*`) are supported.
-     * Use for an internal package legitimately published as a git or
-     * tarball dependency.
-     * @example ["@myorg/legacy", "internal-*"]
-     */
-    exoticSubdepsAllow?: string[];
-    /**
-     * Pre-install marshall pipeline — packument-derived supply-chain
-     * gates (author, provenance, s1ngularity, new-bin, metadata,
-     * downloads, expired-domains, signatures, archived-repo) that run before
-     * `vis add` / `vis install &lt;pkg>` / `vis update &lt;pkg>` hand off to
-     * the underlying package manager. Every entry is optional; omit a
-     * key and the marshall runs with defaults. Set `enabled: false`
-     * on a specific marshall to skip it without touching env vars.
-     */
-    marshalls?: {
-      /** Archived-repo marshall (GitHub repository status). */
-      archivedRepo?: {
-        /** Package names to skip. */
-        allowlist?: string[];
-        /** Default: marshall is on. Set false to disable. */
-        enabled?: boolean;
-        /** GitHub PAT for the API call (5k/hr vs 60/hr). */
-        githubToken?: string;
-      };
-      /** Author / publisher heuristics. */
-      author?: {
-        allowlist?: string[];
-        /** Days since the publisher's last release before flagging as error. */
-        dormantErrorDays?: number;
-        /** Days since the publisher's last release before flagging as warning. */
-        dormantWarnDays?: number;
-        enabled?: boolean;
-        /** Window for the "new publisher on an established package" check. */
-        newPublisherWindowDays?: number;
-        /** Days since the resolved version was published — error threshold. */
-        recentVersionErrorDays?: number;
-        /** Days since the resolved version was published — warning threshold. */
-        recentVersionWarnDays?: number;
-      };
-      /** npm `deprecated`-flag check on the resolved version. */
-      deprecation?: {
-        allowlist?: string[];
-        enabled?: boolean;
-      };
-      /** Monthly download-count floor. */
-      downloads?: {
-        allowlist?: string[];
-        enabled?: boolean;
-        /** Below this monthly count → error (default: 20). */
-        errorThreshold?: number;
-        /** Below this monthly count → warning (default: 1000). */
-        warnThreshold?: number;
-      };
-      /** Maintainer-email-domain NS lookup. */
-      expiredDomains?: {
-        /** Domains exempted from the check (legacy / internal). */
-        allowDomains?: string[];
-        allowlist?: string[];
-        /** DNS resolvers to query (default: system). */
-        dnsServers?: string[];
-        enabled?: boolean;
-        /** Per-domain DNS timeout (default: 5000). */
-        timeoutMs?: number;
-      };
-      /** README / license / repository presence checks. */
-      metadata?: {
-        allowlist?: string[];
-        /** Subset of checks to run. Default: all three. */
-        checks?: ("license" | "readme" | "repo")[];
-        enabled?: boolean;
-      };
-      /** New CLI-bin script introduced in this version. */
-      newBin?: {
-        allowlist?: string[];
-        enabled?: boolean;
-      };
-      /** Whole-package age heuristics (newly created / unmaintained). */
-      packageAge?: {
-        allowlist?: string[];
-        enabled?: boolean;
-        /** Package created fewer than this many days ago → error. Default 22. */
-        newPackageDays?: number;
-        /** No publish within this many days → warning. Default 365. */
-        unmaintainedDays?: number;
-      };
-      /** Provenance regression check. */
-      provenance?: {
-        allowlist?: string[];
-        enabled?: boolean;
-      };
-      /**
-       * Composite "compromised-publish shape" detector — flags a single
-       * version that simultaneously introduced/changed an install hook
-       * AND dropped the provenance attestation a prior stable version
-       * carried (the August 2025 s1ngularity / Nx fingerprint).
-       */
-      s1ngularity?: {
-        allowlist?: string[];
-        enabled?: boolean;
-      };
-      /**
-       * ECDSA P-256 verification against npm's signing keys. Disabled
-       * by default because npm coverage still has gaps that produce
-       * noisy warnings on legitimate packages.
-       */
-      signatures?: {
-        allowlist?: string[];
-        /** Default: marshall is *off*. Set true to enable. */
-        enabled?: boolean;
-        /** Override the keys endpoint (default: npm registry). */
-        keysUrl?: string;
-        /** How to treat an expired-but-known key. Default: "warning". */
-        treatExpiredAs?: "error" | "warning";
-      };
-    };
-    /**
-     * When true, `security.policies.installScripts.allow` keys are matched
-     * as `name@version`. A version bump on an approved package drops it from
-     * the allowlist until the new version is explicitly re-approved (port
-     * of LavaMoat allow-scripts' version-aware policy matcher).
-     *
-     * After a version bump, run `vis approve-builds` or `vis security list`
-     * — both surface a "Version drift" block with the suggested new key
-     * (`old-key  →  new-key`) so you can update `vis.config.ts` by hand.
-     * @default false
-     */
-    pinVersions?: boolean;
-    /**
-     * Supply-chain policy gates. Each sub-block enables one policy and
-     * configures its behavior. When a sub-block is omitted the policy is
-     * inactive. `acceptedRisks` (above) silences specific packages without
-     * disabling a policy globally.
-     *
-     * The 8 policies are inspired by Socket.dev's classification:
-     * - `malware`            — Socket-flagged malicious packages
-     * - `firstSeen`         — packages published less than N minutes ago
-     * - `unexpectedDeps`    — packages outside an allow-list / baseline
-     * - `publisherChange`   — maintainer set changed between installs
-     * - `installScripts`    — preinstall/install/postinstall scripts
-     * - `score`              — Socket overall score below threshold
-     * - `vulnerability`      — OSV vulnerability findings
-     * - `license`            — SPDX allow / deny lists
-     */
-    policies?: {
-      /**
-       * Minimum number of minutes that must pass after a version is
-       * published before vis will allow installation. Migrated from
-       * the legacy `security.minimumReleaseAge` field. Equivalent to
-       * pnpm's `minimumReleaseAge`.
-       * @default 0
-       * @example { minutes: 1440, exclude: ["@myorg/*"] } // 24 hours
-       */
-      firstSeen?: {
-        /**
-         * Package names/patterns excluded from the firstSeen check.
-         * Equivalent to pnpm's `minimumReleaseAgeExclude`.
-         * @example ["webpack", "react", "@myorg/*"]
-         */
-        exclude?: string[];
-        /** Minutes after publish before install is allowed. */
-        minutes?: number;
-      };
-      /**
-       * Build-script (pre/install/postinstall/prepare) controls.
-       * Migrated from the legacy `security.allowBuilds` /
-       * `security.strictDepBuilds` fields.
-       * @example { allow: { esbuild: true }, strict: true }
-       */
-      installScripts?: {
-        /**
-         * Map of package names/patterns to allow (true) or deny
-         * (false) build scripts. Packages not listed are denied
-         * by default. Equivalent to pnpm's `allowBuilds`.
-         */
-        allow?: Record<string, boolean>;
-        /**
-         * When true, installation will fail (exit non-zero) if any
-         * dependencies have unreviewed build scripts. Equivalent to
-         * pnpm's `strictDepBuilds`.
-         * @default false
-         */
-        strict?: boolean;
-      };
-      /**
-       * SPDX license allow / deny lists. Deny wins on any sub-license
-       * match in SPDX expressions (`(MIT OR GPL-3.0)` against
-       * `deny: ["GPL-3.0"]` is blocked). Packages with no declared
-       * license are flagged when `allow` is set.
-       * @example
-       * ```
-       * license: {
-       *   allow: ["MIT", "Apache-2.0", "BSD-3-Clause"],
-       *   deny: ["GPL-3.0", "AGPL-3.0"],
-       * }
-       * ```
-       */
-      license?: {
-        /**
-         * SPDX identifiers that are explicitly permitted. When set,
-         * any package whose declared license is not on this list is
-         * blocked.
-         */
-        allow?: string[];
-        /**
-         * SPDX identifiers that are explicitly forbidden. Always
-         * wins over `allow` when both reference the same identifier.
-         */
-        deny?: string[];
-      };
-      /**
-       * Behavior when the Socket.dev feed flags a package as malicious
-       * (`alerts[].type === "Malware"`).
-       *
-       * The default is cross-field: `{ mode: "block" }` whenever
-       * `security.socket.enabled !== false` (the engine cannot evaluate
-       * malware without Socket data), and `"off"` otherwise. Consumers
-       * resolve this default at evaluation time.
-       */
-      malware?: {
-        /**
-         * - `"block"` — emit a block decision.
-         * - `"warn"`  — surface as a warning; do not gate exit code.
-         * - `"off"`   — disable the policy entirely.
-         */
-        mode?: "block" | "off" | "warn";
-      };
-      /**
-       * Trust-level checking for package publishing. Migrated from the
-       * legacy `security.trustPolicy*` fields. Equivalent to pnpm's
-       * `trustPolicy`.
-       * @example { mode: "no-downgrade", ignoreAfter: 43200 } // 30 days
-       */
-      publisherChange?: {
-        /**
-         * Package selectors excluded from the check.
-         * Equivalent to pnpm's `trustPolicyExclude`.
-         * @example ["chokidar@4.0.3"]
-         */
-        exclude?: string[];
-        /**
-         * Ignore packages published more than N minutes ago. Useful
-         * for older packages that pre-date provenance support.
-         * Equivalent to pnpm's `trustPolicyIgnoreAfter`.
-         */
-        ignoreAfter?: number;
-        /**
-         * - `"off"`           — no trust checking (default).
-         * - `"no-downgrade"`  — block when a package's trust level
-         *   has decreased compared to previous releases (e.g., was
-         *   published by trusted publisher, now only has provenance).
-         */
-        mode?: "no-downgrade" | "off";
-      };
-      /**
-       * Socket.dev overall-score threshold. Packages scoring below
-       * `minimum` trigger a block decision (or interactive prompt
-       * during `vis add`). Migrated from the legacy
-       * `security.socket.minimumScore` field.
-       * @example { minimum: 0.4 }
-       */
-      score?: {
-        /**
-         * Minimum overall Socket.dev score (0–1). Set to 0 to
-         * disable the gate while keeping Socket data fetched.
-         *
-         * Consulted by `vis add`, `audit`, `doctor`, `check`, and
-         * `update`; resolved once in `buildSocketOptions`, then
-         * threaded through every consumer. Falls back to
-         * `DEFAULT_LOW_SCORE_THRESHOLD` (`0.4`) when unset.
-         */
-        minimum?: number;
-      };
-      /**
-       * Net-new transitive dependency detection. Either provide a
-       * static allow-list, a baseline lockfile path (recommended), or
-       * both — the intersection is enforced.
-       * @example { baselineLockfile: "./security/lockfile.baseline.yaml" }
-       */
-      unexpectedDeps?: {
-        /**
-         * Allow-list of dependency names that may appear in the
-         * resolved package set. Glob patterns are supported.
-         * @example ["lodash", "axios", "@myorg/*"]
-         */
-        allow?: string[];
-        /**
-         * Path (absolute or relative to the workspace root) to a
-         * baseline lockfile snapshot. The policy diffs the current
-         * lockfile against this baseline and flags any package that
-         * didn't exist before.
-         * @example "./security/lockfile.baseline.yaml"
-         */
-        baselineLockfile?: string;
-      };
-      /**
-       * OSV vulnerability gating. Migrated from the legacy
-       * `security.audit.failOn` + `security.audit.usage` fields.
-       */
-      vulnerability?: {
-        /**
-         * Severity threshold that makes `vis audit` exit non-zero.
-         * Equivalent to the CLI `--fail-on` flag.
-         * @example "high"
-         */
-        failOn?: "critical" | "high" | "low" | "medium";
-        /**
-         * Reachability filter — only report vulnerabilities in
-         * packages the workspace statically imports.
-         */
-        usage?: {
-          /**
-           * Packages to always treat as reachable even if no
-           * static import is found.
-           * @example ["esbuild", "webpack-cli"]
-           */
-          alwaysAssumeUsed?: string[];
-          /**
-           * Enable the reachability filter by default. Equivalent
-           * to `--usage` on the CLI; `--no-usage` disables.
-           * @default false
-           */
-          enabled?: boolean;
-        };
-      };
-    };
-    /**
-     * Which provider wins merge conflicts when multiple are enabled (e.g.
-     * both Socket.dev and deps.dev return data for the same package). The
-     * primary provider's `score` is kept; alerts from secondaries are
-     * appended and deduped by `key`. Defaults to whichever provider is
-     * enabled first in this order: socket → deps-dev → snyk.
-     */
-    primaryProvider?: "deps-dev" | "snyk" | "socket";
-    /**
-     * Snyk data-source configuration. Snyk only contributes vulnerability
-     * data (no maintenance / quality / supply-chain / license signal);
-     * those axes stay neutral. Requires both an org id and an API token —
-     * if either is missing the provider is skipped.
-     * @see https://docs.snyk.io/snyk-api/using-specific-snyk-apis/issues-list-issues-for-a-package
-     */
-    snyk?: {
-      /**
-       * Snyk API token. Set via VIS_SNYK_TOKEN environment variable or
-       * here.
-       */
-      apiToken?: string;
-      /**
-       * Snyk REST API version date sent as the `version` query param.
-       * @default "2024-10-15"
-       */
-      apiVersion?: string;
-      /**
-       * Cache TTL in milliseconds for Snyk issue lookups. 6 hours.
-       * @default 21600000
-       */
-      cacheTtlMs?: number;
-      /**
-       * Enable Snyk security scanning on install/update/check/audit
-       * commands.
-       * @default false
-       */
-      enabled?: boolean;
-      /**
-       * Snyk organization id (the REST endpoint is org-scoped). Set via
-       * VIS_SNYK_ORG environment variable or here.
-       */
-      orgId?: string;
-      /**
-       * Request timeout in milliseconds for the Snyk API. 15 seconds.
-       * @default 15000
-       */
-      timeoutMs?: number;
-    };
-    /**
-     * Socket.dev data-source configuration. Connection knobs only — score
-     * thresholds and accepted-risk overrides moved to `policies.score` and
-     * `security.acceptedRisks` respectively.
-     * @see https://socket.dev
-     */
-    socket?: {
-      /**
-       * Custom Socket.dev API token. Falls back to the public API token.
-       * Set via VIS_SOCKET_TOKEN environment variable or here.
-       */
-      apiToken?: string;
-      /**
-       * Cache TTL in milliseconds for Socket.dev reports. 1 hour.
-       * @default 3600000
-       */
-      cacheTtlMs?: number;
-      /**
-       * Enable Socket.dev security scanning on install/update/check commands.
-       * @default false
-       */
-      enabled?: boolean;
-      /**
-       * Request timeout in milliseconds for the Socket.dev API. 15 seconds.
-       * @default 15000
-       */
-      timeoutMs?: number;
-    };
-    /**
-     * Package names to skip during typosquat detection.
-     * Use this for internal packages or known-safe names that happen to
-     * look similar to popular packages.
-     * @example ["my-internal-axois", "@myorg/recat"]
-     */
-    typosquatAllowlist?: string[];
-  };
+  security?: Inline<VisSecurityConfig>;
   /**
    * Share the cache between sibling git worktrees. When the workspace is a
    * linked worktree (created with `git worktree add`), the cache root is
@@ -2688,83 +2774,7 @@ interface VisConfig {
     autoExit?: boolean | number;
   };
   /** Update command defaults */
-  update?: {
-    /**
-     * Dependency fields to scan for outdated packages.
-     * Beyond the standard fields, supports:
-     * - `"overrides"` (npm)
-     * - `"resolutions"` (yarn)
-     * - `"pnpm.overrides"`
-     * @default ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]
-     */
-    depFields?: string[];
-    exclude?: string[];
-    format?: "json" | "minimal" | "table";
-    /**
-     * Package names or glob patterns to permanently ignore during updates.
-     * Ignored packages are skipped and listed in the output so you know
-     * they were not checked.
-     * @example ["eslint", "@types/*"]
-     */
-    ignore?: string[];
-    include?: string[];
-    /**
-     * Include packages with pinned/exact versions (no `^` or `~` prefix).
-     * By default, pinned versions are skipped during update checks.
-     * @default false
-     */
-    includeLocked?: boolean;
-    install?: boolean;
-    /**
-     * Maximum number of concurrent registry requests during outdated checks.
-     * Higher values speed up large workspaces but risk hitting registry rate
-     * limits or self-hosted Verdaccio caps.
-     * @default 8
-     */
-    maxConcurrentRequests?: number;
-    /**
-     * Minimum number of minutes since a version was published before
-     * vis will consider it for updates. This mirrors pnpm's
-     * `minimumReleaseAge` — a single setting that applies to both
-     * install and update.
-     *
-     * Not set by default. If your package manager config
-     * (`pnpm-workspace.yaml`) has `minimumReleaseAge`, vis will
-     * read it from there as a fallback.
-     * @example 1440 // 24 hours
-     */
-    minimumReleaseAge?: number;
-    /**
-     * Package names/patterns excluded from the minimumReleaseAge check.
-     * @example ["webpack", "@myorg/*"]
-     */
-    minimumReleaseAgeExclude?: string[];
-    /**
-     * Per-package or per-pattern update target overrides.
-     * Keys are exact package names, glob patterns, or regex patterns
-     * wrapped in `/` (e.g., `/^@vue/`).
-     * Values are `"latest"`, `"minor"`, or `"patch"`.
-     * @example { "typescript": "minor", "/^@vue/": "patch" }
-     */
-    packageMode?: Record<string, "latest" | "minor" | "patch">;
-    prerelease?: boolean;
-    /**
-     * Which release channels to consider when picking the target version.
-     * - `"stable"` (default) — only ship stable releases (no prereleases).
-     * - `"same"` — match the prerelease channel of the *current* range:
-     *   if you're on `react@19.0.0-rc.1`, only `rc.*` candidates qualify;
-     *   if you're on a stable, only stable candidates. Prevents
-     *   accidentally promoting a prerelease pin to a stable major bump.
-     * - `"any"` — equivalent to `--prerelease`. Any channel is fair game.
-     *
-     * `--release-channel` on the CLI overrides this. If `prerelease: true`
-     * is set without `releaseChannel`, vis treats it as `"any"`.
-     * @default "stable"
-     */
-    releaseChannel?: "any" | "same" | "stable";
-    security?: boolean;
-    target?: "latest" | "minor" | "patch";
-  };
+  update?: Inline<VisUpdateConfig>;
   /**
    * Minimum vis CLI version required by this workspace. When the
    * running vis binary is older than this constraint, vis exits with