llmnav 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -6,6 +6,28 @@ The npm package follows Semantic Versioning. The `llmnav/N` source protocol is v
 
 ## [Unreleased]
 
+## [0.6.2] — 2026-08-11
+
+### Added
+
+* Added generated boundary signals for persistent dotted JSON filename protocols, versioned schema literals, and TypeScript Tauri invoke adapters.
+
+### Fixed
+
+* Stopped classifying high-fan-in domain contract hubs as broad utilities solely because they export many declarations.
+* Made tag-driven publication create an idempotent GitHub Release after npm integrity verification or publication succeeds.
+
+## [0.6.1] — 2026-08-10
+
+### Added
+
+* Added compact `audit --summary` output and repository-contained `audit --output <path>` reports.
+* Added nested workspace package entrypoint discovery and Rust/Tauri command, module, and platform-lifecycle signals.
+
+### Fixed
+
+* Excluded Bun and pnpm package-manager caches from default source discovery.
+
 ## [0.6.0] — 2026-08-10
 
 ### Added

package/README.md

@@ -18,7 +18,7 @@ LLMNav is not a documentation generator, an embedding database, or a reason to a
 * Machine-readable changed-card, affected-boundary, and affected-catalog output
 * Exported API and effective configuration contract fingerprints
 * TypeScript and Go declaration enrichment with declaration-level body hashes
-* Generated route, event, schema, migration, and command boundaries
+* Generated artifact, route, event, schema, migration, runtime, and command boundaries
 * SARIF 2.1.0 diagnostic output
 * Optional deterministic card-range search shards for very large repositories
 * Strict repository-local imports for generated definition and reference indexes
@@ -169,7 +169,7 @@ Line-comment cards require an explicit terminator and work with `//`, `#`, and `
 | Command | Purpose |
 | --- | --- |
 | `llmnav init` | Create configuration, registry, schemas, agent instructions, and the initial cache |
-| `llmnav audit` | Rank unannotated architectural boundary candidates without modifying source |
+| `llmnav audit` | Rank unannotated architectural boundary candidates, with compact or file-backed output |
 | `llmnav check` | Validate cards, relations, coverage rules, and registry state |
 | `llmnav format` | Rewrite safe cards into canonical order and spacing |
 | `llmnav generate` | Incrementally compile and transactionally commit generated artifacts |
@@ -250,7 +250,7 @@ Do not annotate trivial getters, generated files, obvious wrappers, every test f
 
 ## Current implementation boundary
 
-Version 0.6 adds a deterministic coverage audit that prioritizes public entrypoints, structural boundaries, and high fan-in modules while suppressing declaration files, test support code, simple barrels, and broad utilities. It suggests narrow coverage rules but never writes cards or invents semantic roles.
+Version 0.6 adds a deterministic coverage audit that prioritizes root and nested-package entrypoints, structural boundaries, persistent artifact filename protocols, versioned schema literals, Rust/Tauri runtime signals, TypeScript Tauri invoke adapters, and high fan-in modules. It suppresses declaration files, dependency caches, test support code, simple barrels, and low-fan-in broad utilities. It suggests narrow coverage rules but never writes cards or invents semantic roles. Use `llmnav audit --summary --json` for a compact automation result or `llmnav audit --json --output .llmnav/audit.json` to keep the full candidate report out of captured stdout.
 
 LLMNav does not discover sibling repositories automatically and does not ship an MCP server, embedding database, hosted service, SCIP generator, or complete language-aware call graph. External tools may export the documented compact graph-input schema. Generated structure never writes derived edges into source cards.
 

package/docs/api.md

@@ -60,7 +60,7 @@ console.log(stats.parsedFiles, stats.reusedFiles);
 
 Stat hints are an optimization, not deterministic output. The returned `fileState` contains only repository-relative generated data.
 
-Attached symbol declarations expose generated `language`, `exported`, `visibility`, optional Go `receiver`, `endOffset`, and declaration `bodyHash` fields. Indexed cards also expose sorted route, event, schema, migration, and command `boundaries` with confidence and evidence.
+Attached symbol declarations expose generated `language`, `exported`, `visibility`, optional Go `receiver`, `endOffset`, and declaration `bodyHash` fields. Indexed cards also expose sorted artifact, route, event, schema, migration, runtime, and command `boundaries` with confidence and evidence.
 
 ## Audit annotation coverage
 

package/docs/architecture.md

@@ -64,13 +64,13 @@ Each card carries three independent hashes.
 
 Symbol attachment records the detected language, public/exported status, visibility, Go receiver when present, declaration span, and a declaration-level body hash. TypeScript and Go use dedicated deterministic declaration patterns; JavaScript, Rust, Python, and generic C-like declarations retain the compatible fallback patterns.
 
-Generated cards may contain a sorted `boundaries` array. LLMNav detects `route`, `event`, `schema`, `migration`, and `command` boundaries from repository-relative paths and controlled semantic effects or risks. Each record includes `confidence` and explicit evidence such as `path`, `effect`, or `risk`. These hints are generated navigation data and are never copied into source comments.
+Generated cards may contain a sorted `boundaries` array. LLMNav detects `artifact`, `route`, `event`, `schema`, `migration`, `runtime`, and `command` boundaries from repository-relative paths, controlled semantic effects or risks, and narrow source evidence. Source evidence includes persistent dotted JSON filename builders, versioned schema literals, Tauri commands and invoke adapters, and platform lifecycle code. Each record includes `confidence` and explicit evidence. These hints are generated navigation data and are never copied into source comments.
 
 Generation compares the previous and current primary indexes to emit `affectedBoundaries`. The report preserves the card change and hash dimensions while adding module IDs, structural boundary records, outbound relation targets, and reverse semantic dependents. It is returned through the API and `generate --json`; it is not stored in source cards.
 
 ## Annotation coverage audit
 
-The read-only audit combines package entrypoints, public re-export reachability, generated structural boundaries, import fan-in, exported declaration counts, and source size. It lowers the priority of broad utilities, declaration files, non-production support paths, and pure re-export barrels. Every candidate retains its score inputs and deterministic repository-relative path.
+The read-only audit combines package entrypoints, public re-export reachability, generated structural boundaries, import fan-in, exported declaration counts, and source size. It lowers the priority of named utilities and low-fan-in export hubs, declaration files, non-production support paths, and pure re-export barrels. High-fan-in domain contract hubs do not receive the broad-utility penalty merely because they export many declarations. Every candidate retains its score inputs and deterministic repository-relative path.
 
 This analyzer deliberately stops before semantic generation. Structure can identify a file worth inspecting, but it cannot safely invent a durable ID, role, ownership statement, invariant, risk, or relation. Accepted boundaries become explicit source cards, path-specific coverage rules, and retrieval regression queries through normal review.
 

package/docs/cli.md

@@ -32,14 +32,14 @@ Creates project configuration, schema, registry, lexicon, evaluation file, agent
 ## `llmnav audit`
 
 ```sh
-llmnav audit [--fail-on none|high|medium|low] [--json]
+llmnav audit [--summary] [--output path] [--fail-on none|high|medium|low] [--json]
 ```
 
-Reads the selected source set and ranks files that lack file or module cards. Signals include package entrypoints, public re-exports, generated command/route/schema/migration/event boundaries, import fan-in, exported declarations, and source size. Declaration files are omitted; test support code, broad utilities, and pure re-export barrels receive penalties. Candidates whose penalties reduce their score to zero are omitted.
+Reads the selected source set and ranks files that lack file or module cards. Signals include root and nested-package entrypoints, public re-exports, generated command/route/schema/migration/event boundaries, Rust/Tauri runtime boundaries, import fan-in, exported declarations, and source size. Declaration files are omitted; dependency caches, test support code, broad utilities, and pure re-export barrels are excluded or penalized. Candidates whose penalties reduce their score to zero are omitted.
 
 The command never modifies source, configuration, registries, or generated caches. Its output is advisory and exits with status 0 by default. `--fail-on high` fails only for high candidates; `medium` fails for high or medium; `low` fails for any candidate. Invalid thresholds exit with status 2.
 
-JSON output uses schemaVersion 1, repository-relative paths, deterministic ordering, explainable `reasons` and `signals`, and a path-specific `suggestedCoverageRule` for high and medium candidates. Suggestions require human or agent review: LLMNav cannot infer a durable role, ownership boundary, invariant, or semantic ID from structure alone.
+JSON output uses schemaVersion 1, repository-relative paths, deterministic ordering, explainable `reasons` and `signals`, and a path-specific `suggestedCoverageRule` for high and medium candidates. `--summary` omits candidate details. `--output <path>` writes the selected report inside the repository and emits only a compact confirmation envelope to stdout; escaping paths and symbolic-link traversal are rejected. Suggestions require human or agent review: LLMNav cannot infer a durable role, ownership boundary, invariant, or semantic ID from structure alone.
 
 ## `llmnav check`
 

package/docs/configuration.md

@@ -71,7 +71,7 @@ Every source root must remain inside the repository and cannot be a symbolic lin
 
 `includeExtensions` is an allowlist. LLMNav does not scan Markdown or YAML by default because documentation examples routinely contain card syntax.
 
-`excludeDirectories` matches directory names at any depth. `excludeFiles` uses repository-relative globs with `*`, `?`, and `**`.
+`excludeDirectories` matches directory names at any depth. Defaults exclude dependency and tool output including `node_modules`, `.bun-cache`, `.pnpm-store`, `.cache`, build directories, and language targets. `excludeFiles` uses repository-relative globs with `*`, `?`, and `**`.
 
 ## Coverage rules
 

package/docs/publishing.md

@@ -31,7 +31,7 @@ npm run release:check
 
 ## 3. Configure npm authentication
 
-The supplied release workflow uses GitHub's OIDC token through npm Trusted Publishers. The GitHub source repository is private, so the workflow explicitly disables provenance; npm accepts provenance only from public source repositories. If the repository becomes public, enable provenance in both `package.json` and the workflow after a successful release check.
+The supplied release workflow uses GitHub's OIDC token through npm Trusted Publishers. The GitHub source repository is private, so the workflow explicitly disables provenance; npm accepts provenance only from public source repositories. If the repository becomes public, enable provenance in both `package.json` and the workflow after a successful release check. The same tag workflow creates an idempotent GitHub Release only after the npm registry check or publication succeeds.
 
 The workflow references a GitHub environment named `npm`. Create that environment for release protection, or remove the `environment` line when no environment gate is desired.
 
@@ -65,7 +65,7 @@ git tag v0.6.0
 git push origin v0.6.0
 ```
 
-The release workflow rejects a tag that does not match `package.json`. If the exact version is already present in npm, the workflow succeeds only when the registry tarball integrity matches the tagged package; a mismatched package fails closed.
+The release workflow rejects a tag that does not match `package.json`. If the exact version is already present in npm, the workflow succeeds only when the registry tarball integrity matches the tagged package; a mismatched package fails closed. It then reuses an existing GitHub Release for the tag or creates one with generated release notes. Registry, GitHub API, and Release creation errors other than an expected missing Release fail the workflow.
 
 ## 6. Verify from a clean directory
 

package/docs/quickstart.md

@@ -19,7 +19,7 @@ Source roots and evaluation files must remain inside the repository. The generat
 npx llmnav audit
 ```
 
-Start with high and medium candidates. The audit explains whether a file is a package entrypoint, public API, generated structural boundary, or high fan-in module. It does not write source or invent card contents. Declaration files and common non-production or utility shapes are suppressed so the result is a review queue, not a demand to annotate every file.
+Start with high and medium candidates. The audit explains whether a file is a package entrypoint, public API, generated structural boundary, or high fan-in module. Narrow source signals also identify versioned schema literals, persistent dotted JSON filename protocols, and Tauri invoke adapters. It does not write source or invent card contents. Declaration files and common non-production or low-fan-in utility shapes are suppressed so the result is a review queue, not a demand to annotate every file.
 
 After accepting a candidate, write its durable meaning by inspecting the source, add a narrow `coverageRules` entry for that exact boundary, and add a real task-language query to `.llmnav/eval/queries.jsonl`. Use `npx llmnav audit --fail-on high` in CI only after the initial review.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llmnav",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "A deterministic semantic navigation layer for LLM coding agents.",
   "type": "module",
   "bin": {

package/src/audit.js

@@ -47,8 +47,7 @@ export async function auditProject(root) {
     for (const target of unique) importedBy.get(target)?.add(file);
   }
 
-  const packageJson = await readJsonSafe(path.join(root, "package.json"), {});
-  const entrypoints = collectPackageEntrypoints(packageJson, fileByPath);
+  const entrypoints = await collectWorkspacePackageEntrypoints(root, fileByPath);
   const publicApiPaths = collectPublicApiPaths(entrypoints, fileByPath);
   const candidates = [];
 
@@ -58,6 +57,7 @@ export async function auditProject(root) {
     const boundaries = detectBoundaries({
       relativePath: file,
       card: { effect: [], risk: [] },
+      source: record.source ?? "",
     }).map((boundary) => boundary.kind);
     const exportedDeclarations = countExportedDeclarations(record.source ?? "", file);
     const entrypoint = entrypoints.has(file);
@@ -66,7 +66,7 @@ export async function auditProject(root) {
     const reexportBarrel = isReexportBarrel(record.source ?? "", file);
     const basename = path.posix.basename(file, path.posix.extname(file)).toLowerCase();
     const broadUtility = UTILITY_NAME_PATTERN.test(basename) ||
-      (exportedDeclarations >= 10 && !entrypoint && !publicApi && boundaries.length === 0);
+      (exportedDeclarations >= 10 && importers <= 1 && !entrypoint && !publicApi && boundaries.length === 0);
     const nonProduction = NON_PRODUCTION_PATH_PATTERN.test(file);
     const largeSource = record.sourceBytes >= LARGE_SOURCE_BYTES;
     const hasSignal = entrypoint || publicApi || boundaries.length > 0 || importers > 0 || exportedDeclarations > 0 || largeSource;
@@ -174,14 +174,34 @@ function buildCoverageSuggestion(file) {
   };
 }
 
-function collectPackageEntrypoints(packageJson, fileByPath) {
+async function collectWorkspacePackageEntrypoints(root, fileByPath) {
+  const packageDirectories = new Set([""]);
+  for (const file of fileByPath.keys()) {
+    let directory = path.posix.dirname(file);
+    while (directory !== "." && directory !== "") {
+      packageDirectories.add(directory);
+      const parent = path.posix.dirname(directory);
+      if (parent === directory || parent === ".") break;
+      directory = parent;
+    }
+  }
+  const entrypoints = new Set();
+  for (const directory of [...packageDirectories].sort(compareText)) {
+    const packageJson = await readJsonSafe(path.join(root, directory, "package.json"), null);
+    if (!packageJson || typeof packageJson !== "object") continue;
+    for (const entrypoint of collectPackageEntrypoints(packageJson, fileByPath, directory)) entrypoints.add(entrypoint);
+  }
+  return entrypoints;
+}
+
+function collectPackageEntrypoints(packageJson, fileByPath, packageDirectory = "") {
   const raw = [packageJson?.main, packageJson?.module, ...collectStringLeaves(packageJson?.bin), ...collectStringLeaves(packageJson?.exports)];
   const entrypoints = new Set();
   for (const value of raw) {
     if (typeof value !== "string" || /\.d\.[cm]?ts$/u.test(value)) continue;
     const normalized = normalizePackagePath(value);
     if (!normalized) continue;
-    const resolved = resolveProjectPath(normalized, fileByPath);
+    const resolved = resolveProjectPath(path.posix.join(packageDirectory, normalized), fileByPath);
     if (resolved) entrypoints.add(resolved);
   }
   return entrypoints;
@@ -237,12 +257,52 @@ function isReexportBarrel(source, file) {
 }
 
 function resolveLocalSpecifier(fromFile, specifier, fileByPath) {
+  if (/\.rs$/u.test(fromFile)) return resolveRustSpecifier(fromFile, specifier, fileByPath);
   if (!specifier.startsWith(".")) return null;
   const base = path.posix.normalize(path.posix.join(path.posix.dirname(fromFile), toPosix(specifier)));
   if (base.startsWith("../") || base === "..") return null;
   return resolveProjectPath(base, fileByPath);
 }
 
+function resolveRustSpecifier(fromFile, specifier, fileByPath) {
+  const normalized = specifier
+    .replace(/\s+as\s+.+$/u, "")
+    .replace(/::\{[\s\S]*$/u, "")
+    .replace(/::\*$/u, "")
+    .trim();
+  if (!normalized || /[{}(),]/u.test(normalized)) return null;
+  const parts = normalized.split("::").filter(Boolean);
+  const sourceIndex = fromFile.split("/").lastIndexOf("src");
+  const crateSource = sourceIndex >= 0 ? fromFile.split("/").slice(0, sourceIndex + 1).join("/") : path.posix.dirname(fromFile);
+  let base;
+  if (parts[0] === "crate") {
+    parts.shift();
+    base = crateSource;
+  } else if (parts[0] === "self") {
+    parts.shift();
+    base = rustModuleDirectory(fromFile);
+  } else if (parts[0] === "super") {
+    while (parts[0] === "super") {
+      parts.shift();
+      base = path.posix.dirname(base ?? rustModuleDirectory(fromFile));
+    }
+  } else {
+    base = rustModuleDirectory(fromFile);
+  }
+  if (parts.length === 0) return null;
+  const candidate = path.posix.join(base, ...parts);
+  return [
+    `${candidate}.rs`,
+    `${candidate}/mod.rs`,
+  ].find((value) => fileByPath.has(value)) ?? null;
+}
+
+function rustModuleDirectory(fromFile) {
+  const basename = path.posix.basename(fromFile);
+  if (basename === "lib.rs" || basename === "main.rs" || basename === "mod.rs") return path.posix.dirname(fromFile);
+  return path.posix.join(path.posix.dirname(fromFile), path.posix.basename(fromFile, ".rs"));
+}
+
 function resolveProjectPath(candidate, fileByPath) {
   const values = [candidate];
   const extension = path.posix.extname(candidate);

package/src/boundaries.js

@@ -1,9 +1,9 @@
 /* llmnav/1 module
 id=llmnav.structure.boundaries
-role=Detect route, event, schema, migration, and command boundaries from generated local evidence.
+role=Detect durable artifact, route, event, schema, migration, runtime, and command boundaries from generated local evidence.
 owns=boundary kinds|confidence assignment|boundary evidence
 excludes=framework execution|source annotations
-search=boundary detection|route schema migration|command event
+search=boundary detection|artifact route schema migration|command event runtime
 rel=workflow>llmnav.index.generate
 stability=architecture
 */
@@ -11,13 +11,14 @@ stability=architecture
 import path from "node:path";
 import { compareText, toPosix } from "./util.js";
 
-export const BOUNDARY_KINDS = Object.freeze(["command", "event", "migration", "route", "schema"]);
+export const BOUNDARY_KINDS = Object.freeze(["artifact", "command", "event", "migration", "route", "runtime", "schema"]);
 
 export function detectBoundaries(record) {
   const relativePath = toPosix(record.relativePath).toLowerCase();
   const basename = path.posix.basename(relativePath);
   const effects = record.card.effect ?? [];
   const risks = record.card.risk ?? [];
+  const source = record.source ?? "";
   const boundaries = new Map();
   const add = (kind, confidence, evidence) => {
     const current = boundaries.get(kind);
@@ -39,12 +40,32 @@ export function detectBoundaries(record) {
       /(?:schema\.(?:json|ya?ml)|\.(?:proto|graphql|gql))$/u.test(relativePath)) {
     add("schema", "high", "path");
   }
+  if (/\bschemaVersion\s*:\s*["'][^"'\r\n]+\/v\d+(?:\.\d+)*["']/u.test(source)) {
+    add("schema", "high", "versioned-schema-literal");
+  }
+  if (/\bexport\s+(?:async\s+)?function\s+[A-Za-z_$][\w$]*FileName\b/u.test(source) &&
+      /["'`][^"'`\r\n]*\.[a-z0-9-]+\.json["'`]/iu.test(source)) {
+    add("artifact", "medium", "persistent-json-filename");
+  }
   if (risks.includes("migration") || /(?:^|\/)(?:migrations?|migrate)(?:\/|$)/u.test(relativePath)) {
     add("migration", "high", risks.includes("migration") ? "risk" : "path");
   }
   if (/(?:^|\/)(?:commands?|cli|bin)(?:\/|$)/u.test(relativePath) || /(?:command|cmd)\.[^.]+$/u.test(basename)) {
     add("command", "high", "path");
   }
+  if (/\.rs$/u.test(relativePath) && /#\[tauri::command\]|tauri::generate_handler!/u.test(source)) {
+    add("command", "high", "tauri-command");
+  }
+  if (/\.[cm]?[jt]sx?$/u.test(relativePath) &&
+      /\bgetTauriInvoke\s*\(/u.test(source) &&
+      /\binvoke(?:\s*<[^;\r\n]+?>)?\s*\(/u.test(source)) {
+    add("command", "high", "tauri-invoke");
+  }
+  if (/\.rs$/u.test(relativePath) &&
+      /#\[cfg\((?:windows|unix|target_(?:os|family))/u.test(source) &&
+      /\b(?:Drop|shutdown|terminate|kill|process_group|job_object)\b/iu.test(source)) {
+    add("runtime", "medium", "platform-lifecycle");
+  }
 
   return [...boundaries.values()].sort((left, right) => compareText(left.kind, right.kind));
 }

package/src/cli.js

@@ -31,7 +31,7 @@ import {
   SPEC_VERSION,
   STABILITIES,
 } from "./spec.js";
-import { parseInteger } from "./util.js";
+import { assertNoSymlinkTraversal, atomicWrite, parseInteger, relativePosix } from "./util.js";
 import { diagnosticsToSarif } from "./sarif.js";
 import { loadGraphInputs } from "./graph-input.js";
 import { renderGraphNode } from "./graph.js";
@@ -40,7 +40,7 @@ import { loadPromptPrefixBundle } from "./prompt-bundle.js";
 import { diagnosticsToEditor, getEditorIntegration } from "./editor.js";
 import { AUDIT_PRIORITIES, auditHasFindings, auditProject } from "./audit.js";
 
-const VALUE_OPTIONS = new Set(["--root", "--format", "--top", "--depth", "--budget", "--max-edges", "--agents", "--file", "--fail-on"]);
+const VALUE_OPTIONS = new Set(["--root", "--format", "--top", "--depth", "--budget", "--max-edges", "--agents", "--file", "--fail-on", "--output"]);
 
 const COMMAND_OPTIONS = Object.freeze({
   init: new Set(["--agents", "--package-scripts", "--force", "--root", "--json"]),
@@ -53,7 +53,7 @@ const COMMAND_OPTIONS = Object.freeze({
   context: new Set(["--depth", "--budget", "--max-edges", "--root", "--json"]),
   eval: new Set(["--file", "--top", "--root", "--json"]),
   doctor: new Set(["--root", "--json"]),
-  audit: new Set(["--root", "--json", "--fail-on"]),
+  audit: new Set(["--root", "--json", "--summary", "--fail-on", "--output"]),
   spec: new Set(["--root", "--json"]),
   tools: new Set(["--json"]),
   bundle: new Set(["--root", "--json"]),
@@ -300,10 +300,27 @@ async function runAudit(root, args, json) {
   if (failOn !== "none" && !AUDIT_PRIORITIES.includes(failOn)) {
     throw usageError(`audit --fail-on must be one of none, ${AUDIT_PRIORITIES.join(", ")}.`);
   }
+  const outputOption = getOption(args, "--output");
+  const outputPath = outputOption ? path.resolve(root, outputOption) : null;
+  if (outputPath) {
+    try {
+      await assertNoSymlinkTraversal(root, outputPath, "audit output file");
+    } catch (error) {
+      throw usageError(error instanceof Error ? error.message : String(error));
+    }
+  }
   const result = await auditProject(root);
   const report = { ...result, failOn };
+  const selectedReport = hasFlag(args, "--summary")
+    ? { schemaVersion: result.schemaVersion, repositoryId: result.repositoryId, summary: result.summary, failOn }
+    : report;
+  if (outputPath) {
+    await atomicWrite(outputPath, `${JSON.stringify(selectedReport, null, 2)}\n`);
+  }
   if (json) {
-    console.log(JSON.stringify(report, null, 2));
+    console.log(JSON.stringify(outputPath
+      ? { schemaVersion: result.schemaVersion, repositoryId: result.repositoryId, summary: result.summary, failOn, output: relativePosix(root, outputPath) }
+      : selectedReport, null, 2));
   } else {
     const { summary } = result;
     console.log(
@@ -314,6 +331,7 @@ async function runAudit(root, args, json) {
       console.log(`${candidate.priority} ${candidate.path} score=${candidate.score} ${candidate.reasons.join(",")}`);
     }
     if (summary.low > 0) console.log(`${summary.low} low-priority candidate(s) are available in --json output.`);
+    if (outputPath) console.log(`wrote ${relativePosix(root, outputPath)}`);
   }
   return auditHasFindings(result, failOn) ? 1 : 0;
 }
@@ -474,7 +492,7 @@ Usage
   llmnav context <semantic-id> [--depth 1] [--budget 2500] [--max-edges 24]
   llmnav eval [--file path] [--top 5]
   llmnav doctor
-  llmnav audit [--fail-on none|high|medium|low]
+  llmnav audit [--summary] [--output path] [--fail-on none|high|medium|low]
   llmnav spec
   llmnav tools [--json]
   llmnav bundle [--json]

package/src/index.d.ts

@@ -58,7 +58,7 @@ export interface Declaration {
 }
 
 export interface DetectedBoundary {
-  kind: "command" | "event" | "migration" | "route" | "schema";
+  kind: "artifact" | "command" | "event" | "migration" | "route" | "runtime" | "schema";
   confidence: "high" | "medium";
   evidence: string[];
 }

package/src/spec.js

@@ -10,7 +10,7 @@ rel=workflow>llmnav.rules.validate
 stability=contract
 */
 
-export const PACKAGE_VERSION = "0.6.0";
+export const PACKAGE_VERSION = "0.6.2";
 export const SPEC_VERSION = "1";
 
 export const SCOPES = Object.freeze(["file", "module", "symbol"]);
@@ -163,6 +163,8 @@ export const DEFAULT_EXCLUDED_DIRECTORIES = Object.freeze([
   ".astro",
   ".turbo",
   ".cache",
+  ".bun-cache",
+  ".pnpm-store",
   "target",
   "bin",
   "obj",