v2.0.0 — Project tree consolidation (breaking change)

Breaking changes

This release consolidates nark's project-root files. Two legacy filenames have been removed entirely (no fallback reads, no migration shim):

Before (root)	After (under .nark/)
.narkrc.json (removed)	.nark/config.yaml
.narkrc.yaml (removed)	.nark/config.yaml
.nark-suppressions.json (removed)	.nark/suppressions.json

Runtime artifacts (scan reports, audit data, violation details) now live in ~/.nark/projects/<encoded>/ — nark scan no longer writes anything to your project tree.

Why

Two reasons:

• Predictability — running nark scan in a fresh repo previously created files at the root and edited your .gitignore. It now writes nothing in your project tree.
• Intent-clear .nark/ folder — anything inside the local .nark/ folder is meant to be committed (team-shared config + suppressions). Git tracks files not directories, so an empty .nark/ is invisible to git.

Migration

If you had a 1.x setup:

# config — convert JSON to YAML if needed, move into .nark/
mkdir -p .nark
mv .narkrc.yaml .nark/config.yaml          # if you used YAML
# OR convert .narkrc.json → .nark/config.yaml manually

# suppressions — same format, new path
mv .nark-suppressions.json .nark/suppressions.json

# .gitignore — remove .nark/ if it was there. nark no longer touches your .gitignore.

Then commit .nark/config.yaml and .nark/suppressions.json so your team shares them.

Other

• nark suppressions add and nark triage mark now mkdir -p .nark/ automatically — no need to create the folder yourself.
• The CLI message after nark suppressions add says "Commit .nark/suppressions.json to share this suppression with your team."

Verified

• npm install -g nark@2.0.0 resolves cleanly
• Smoke-tested against a fresh repo — zero files written to project tree on nark scan
• 2767 unit/contract tests pass; pre-existing v2 ground-truth fixture failures unchanged