llmnav 0.6.1 → 0.6.2

package/CHANGELOG.md

@@ -6,6 +6,17 @@ The npm package follows Semantic Versioning. The `llmnav/N` source protocol is v
 
 ## [Unreleased]
 
+## [0.6.2] — 2026-08-11
+
+### Added
+
+* Added generated boundary signals for persistent dotted JSON filename protocols, versioned schema literals, and TypeScript Tauri invoke adapters.
+
+### Fixed
+
+* Stopped classifying high-fan-in domain contract hubs as broad utilities solely because they export many declarations.
+* Made tag-driven publication create an idempotent GitHub Release after npm integrity verification or publication succeeds.
+
 ## [0.6.1] — 2026-08-10
 
 ### Added

package/README.md

@@ -18,7 +18,7 @@ LLMNav is not a documentation generator, an embedding database, or a reason to a
 * Machine-readable changed-card, affected-boundary, and affected-catalog output
 * Exported API and effective configuration contract fingerprints
 * TypeScript and Go declaration enrichment with declaration-level body hashes
-* Generated route, event, schema, migration, and command boundaries
+* Generated artifact, route, event, schema, migration, runtime, and command boundaries
 * SARIF 2.1.0 diagnostic output
 * Optional deterministic card-range search shards for very large repositories
 * Strict repository-local imports for generated definition and reference indexes
@@ -250,7 +250,7 @@ Do not annotate trivial getters, generated files, obvious wrappers, every test f
 
 ## Current implementation boundary
 
-Version 0.6 adds a deterministic coverage audit that prioritizes root and nested-package entrypoints, structural boundaries, Rust/Tauri runtime signals, and high fan-in modules while suppressing declaration files, dependency caches, test support code, simple barrels, and broad utilities. It suggests narrow coverage rules but never writes cards or invents semantic roles. Use `llmnav audit --summary --json` for a compact automation result or `llmnav audit --json --output .llmnav/audit.json` to keep the full candidate report out of captured stdout.
+Version 0.6 adds a deterministic coverage audit that prioritizes root and nested-package entrypoints, structural boundaries, persistent artifact filename protocols, versioned schema literals, Rust/Tauri runtime signals, TypeScript Tauri invoke adapters, and high fan-in modules. It suppresses declaration files, dependency caches, test support code, simple barrels, and low-fan-in broad utilities. It suggests narrow coverage rules but never writes cards or invents semantic roles. Use `llmnav audit --summary --json` for a compact automation result or `llmnav audit --json --output .llmnav/audit.json` to keep the full candidate report out of captured stdout.
 
 LLMNav does not discover sibling repositories automatically and does not ship an MCP server, embedding database, hosted service, SCIP generator, or complete language-aware call graph. External tools may export the documented compact graph-input schema. Generated structure never writes derived edges into source cards.
 

package/docs/api.md

@@ -60,7 +60,7 @@ console.log(stats.parsedFiles, stats.reusedFiles);
 
 Stat hints are an optimization, not deterministic output. The returned `fileState` contains only repository-relative generated data.
 
-Attached symbol declarations expose generated `language`, `exported`, `visibility`, optional Go `receiver`, `endOffset`, and declaration `bodyHash` fields. Indexed cards also expose sorted route, event, schema, migration, and command `boundaries` with confidence and evidence.
+Attached symbol declarations expose generated `language`, `exported`, `visibility`, optional Go `receiver`, `endOffset`, and declaration `bodyHash` fields. Indexed cards also expose sorted artifact, route, event, schema, migration, runtime, and command `boundaries` with confidence and evidence.
 
 ## Audit annotation coverage
 

package/docs/architecture.md

@@ -64,13 +64,13 @@ Each card carries three independent hashes.
 
 Symbol attachment records the detected language, public/exported status, visibility, Go receiver when present, declaration span, and a declaration-level body hash. TypeScript and Go use dedicated deterministic declaration patterns; JavaScript, Rust, Python, and generic C-like declarations retain the compatible fallback patterns.
 
-Generated cards may contain a sorted `boundaries` array. LLMNav detects `route`, `event`, `schema`, `migration`, and `command` boundaries from repository-relative paths and controlled semantic effects or risks. Each record includes `confidence` and explicit evidence such as `path`, `effect`, or `risk`. These hints are generated navigation data and are never copied into source comments.
+Generated cards may contain a sorted `boundaries` array. LLMNav detects `artifact`, `route`, `event`, `schema`, `migration`, `runtime`, and `command` boundaries from repository-relative paths, controlled semantic effects or risks, and narrow source evidence. Source evidence includes persistent dotted JSON filename builders, versioned schema literals, Tauri commands and invoke adapters, and platform lifecycle code. Each record includes `confidence` and explicit evidence. These hints are generated navigation data and are never copied into source comments.
 
 Generation compares the previous and current primary indexes to emit `affectedBoundaries`. The report preserves the card change and hash dimensions while adding module IDs, structural boundary records, outbound relation targets, and reverse semantic dependents. It is returned through the API and `generate --json`; it is not stored in source cards.
 
 ## Annotation coverage audit
 
-The read-only audit combines package entrypoints, public re-export reachability, generated structural boundaries, import fan-in, exported declaration counts, and source size. It lowers the priority of broad utilities, declaration files, non-production support paths, and pure re-export barrels. Every candidate retains its score inputs and deterministic repository-relative path.
+The read-only audit combines package entrypoints, public re-export reachability, generated structural boundaries, import fan-in, exported declaration counts, and source size. It lowers the priority of named utilities and low-fan-in export hubs, declaration files, non-production support paths, and pure re-export barrels. High-fan-in domain contract hubs do not receive the broad-utility penalty merely because they export many declarations. Every candidate retains its score inputs and deterministic repository-relative path.
 
 This analyzer deliberately stops before semantic generation. Structure can identify a file worth inspecting, but it cannot safely invent a durable ID, role, ownership statement, invariant, risk, or relation. Accepted boundaries become explicit source cards, path-specific coverage rules, and retrieval regression queries through normal review.
 

package/docs/publishing.md

@@ -31,7 +31,7 @@ npm run release:check
 
 ## 3. Configure npm authentication
 
-The supplied release workflow uses GitHub's OIDC token through npm Trusted Publishers. The GitHub source repository is private, so the workflow explicitly disables provenance; npm accepts provenance only from public source repositories. If the repository becomes public, enable provenance in both `package.json` and the workflow after a successful release check.
+The supplied release workflow uses GitHub's OIDC token through npm Trusted Publishers. The GitHub source repository is private, so the workflow explicitly disables provenance; npm accepts provenance only from public source repositories. If the repository becomes public, enable provenance in both `package.json` and the workflow after a successful release check. The same tag workflow creates an idempotent GitHub Release only after the npm registry check or publication succeeds.
 
 The workflow references a GitHub environment named `npm`. Create that environment for release protection, or remove the `environment` line when no environment gate is desired.
 
@@ -65,7 +65,7 @@ git tag v0.6.0
 git push origin v0.6.0
 ```
 
-The release workflow rejects a tag that does not match `package.json`. If the exact version is already present in npm, the workflow succeeds only when the registry tarball integrity matches the tagged package; a mismatched package fails closed.
+The release workflow rejects a tag that does not match `package.json`. If the exact version is already present in npm, the workflow succeeds only when the registry tarball integrity matches the tagged package; a mismatched package fails closed. It then reuses an existing GitHub Release for the tag or creates one with generated release notes. Registry, GitHub API, and Release creation errors other than an expected missing Release fail the workflow.
 
 ## 6. Verify from a clean directory
 

package/docs/quickstart.md

@@ -19,7 +19,7 @@ Source roots and evaluation files must remain inside the repository. The generat
 npx llmnav audit
 ```
 
-Start with high and medium candidates. The audit explains whether a file is a package entrypoint, public API, generated structural boundary, or high fan-in module. It does not write source or invent card contents. Declaration files and common non-production or utility shapes are suppressed so the result is a review queue, not a demand to annotate every file.
+Start with high and medium candidates. The audit explains whether a file is a package entrypoint, public API, generated structural boundary, or high fan-in module. Narrow source signals also identify versioned schema literals, persistent dotted JSON filename protocols, and Tauri invoke adapters. It does not write source or invent card contents. Declaration files and common non-production or low-fan-in utility shapes are suppressed so the result is a review queue, not a demand to annotate every file.
 
 After accepting a candidate, write its durable meaning by inspecting the source, add a narrow `coverageRules` entry for that exact boundary, and add a real task-language query to `.llmnav/eval/queries.jsonl`. Use `npx llmnav audit --fail-on high` in CI only after the initial review.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llmnav",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "A deterministic semantic navigation layer for LLM coding agents.",
   "type": "module",
   "bin": {

package/src/audit.js

@@ -66,7 +66,7 @@ export async function auditProject(root) {
     const reexportBarrel = isReexportBarrel(record.source ?? "", file);
     const basename = path.posix.basename(file, path.posix.extname(file)).toLowerCase();
     const broadUtility = UTILITY_NAME_PATTERN.test(basename) ||
-      (exportedDeclarations >= 10 && !entrypoint && !publicApi && boundaries.length === 0);
+      (exportedDeclarations >= 10 && importers <= 1 && !entrypoint && !publicApi && boundaries.length === 0);
     const nonProduction = NON_PRODUCTION_PATH_PATTERN.test(file);
     const largeSource = record.sourceBytes >= LARGE_SOURCE_BYTES;
     const hasSignal = entrypoint || publicApi || boundaries.length > 0 || importers > 0 || exportedDeclarations > 0 || largeSource;

package/src/boundaries.js

@@ -1,9 +1,9 @@
 /* llmnav/1 module
 id=llmnav.structure.boundaries
-role=Detect route, event, schema, migration, and command boundaries from generated local evidence.
+role=Detect durable artifact, route, event, schema, migration, runtime, and command boundaries from generated local evidence.
 owns=boundary kinds|confidence assignment|boundary evidence
 excludes=framework execution|source annotations
-search=boundary detection|route schema migration|command event
+search=boundary detection|artifact route schema migration|command event runtime
 rel=workflow>llmnav.index.generate
 stability=architecture
 */
@@ -11,7 +11,7 @@ stability=architecture
 import path from "node:path";
 import { compareText, toPosix } from "./util.js";
 
-export const BOUNDARY_KINDS = Object.freeze(["command", "event", "migration", "route", "runtime", "schema"]);
+export const BOUNDARY_KINDS = Object.freeze(["artifact", "command", "event", "migration", "route", "runtime", "schema"]);
 
 export function detectBoundaries(record) {
   const relativePath = toPosix(record.relativePath).toLowerCase();
@@ -40,6 +40,13 @@ export function detectBoundaries(record) {
       /(?:schema\.(?:json|ya?ml)|\.(?:proto|graphql|gql))$/u.test(relativePath)) {
     add("schema", "high", "path");
   }
+  if (/\bschemaVersion\s*:\s*["'][^"'\r\n]+\/v\d+(?:\.\d+)*["']/u.test(source)) {
+    add("schema", "high", "versioned-schema-literal");
+  }
+  if (/\bexport\s+(?:async\s+)?function\s+[A-Za-z_$][\w$]*FileName\b/u.test(source) &&
+      /["'`][^"'`\r\n]*\.[a-z0-9-]+\.json["'`]/iu.test(source)) {
+    add("artifact", "medium", "persistent-json-filename");
+  }
   if (risks.includes("migration") || /(?:^|\/)(?:migrations?|migrate)(?:\/|$)/u.test(relativePath)) {
     add("migration", "high", risks.includes("migration") ? "risk" : "path");
   }
@@ -49,6 +56,11 @@ export function detectBoundaries(record) {
   if (/\.rs$/u.test(relativePath) && /#\[tauri::command\]|tauri::generate_handler!/u.test(source)) {
     add("command", "high", "tauri-command");
   }
+  if (/\.[cm]?[jt]sx?$/u.test(relativePath) &&
+      /\bgetTauriInvoke\s*\(/u.test(source) &&
+      /\binvoke(?:\s*<[^;\r\n]+?>)?\s*\(/u.test(source)) {
+    add("command", "high", "tauri-invoke");
+  }
   if (/\.rs$/u.test(relativePath) &&
       /#\[cfg\((?:windows|unix|target_(?:os|family))/u.test(source) &&
       /\b(?:Drop|shutdown|terminate|kill|process_group|job_object)\b/iu.test(source)) {

package/src/index.d.ts

@@ -58,7 +58,7 @@ export interface Declaration {
 }
 
 export interface DetectedBoundary {
-  kind: "command" | "event" | "migration" | "route" | "schema";
+  kind: "artifact" | "command" | "event" | "migration" | "route" | "runtime" | "schema";
   confidence: "high" | "medium";
   evidence: string[];
 }

package/src/spec.js

@@ -10,7 +10,7 @@ rel=workflow>llmnav.rules.validate
 stability=contract
 */
 
-export const PACKAGE_VERSION = "0.6.1";
+export const PACKAGE_VERSION = "0.6.2";
 export const SPEC_VERSION = "1";
 
 export const SCOPES = Object.freeze(["file", "module", "symbol"]);