@aiwg/cli 2026.7.17 → 2026.7.18

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Joe Magly
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -4,20 +4,21 @@ Lightweight AIWG CLI for signed, versioned resources from
 [`releases.aiwg.io`](https://releases.aiwg.io/).
 
 ```bash
-npm install --global @aiwg/cli@next
+npm install --global @aiwg/cli
 
-aiwg discover "architecture evolution" \
-  --resource-source web \
-  --aiwg-version canary
+aiwg discover "architecture evolution"
+aiwg show skill architecture-evolution
 ```
 
 ## Release status
 
 This package follows AIWG CalVer in exact lockstep with the `aiwg` package.
-The current beta supports signed web-backed `discover` and `show`, exact or
-channel resource selection, verified caching, and warm offline reads. The
-larger `aiwg` package remains the local/full distribution while web parity is
-completed for mutating commands such as `use` and `regenerate`.
+It selects the signed `stable` web channel automatically when no resource
+flags are supplied. Operators can still select an exact version or another
+channel with `--aiwg-version`, force local resources with
+`--resource-source local`, use verified caching, and perform warm offline
+reads. The larger `aiwg` package remains the local/full distribution while
+web parity is completed for mutating commands such as `use` and `regenerate`.
 
 Resource bundles and precomputed indices are distributed by the release host,
 not as additional npm packages.

package/dist/src/artifacts/cli.js

@@ -17,9 +17,12 @@
  * @tests @test/unit/artifacts/cli.test.ts
  */
 import path from 'node:path';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
 import { GRAPH_CONFIGS, OPERATIONAL_DISCOVERY_TYPES, OPERATIONAL_SHOW_TYPES, isOperationalShowType, loadUserGraphConfigs, loadGlobalGraphConfigs, orderedGraphEntries, } from './types.js';
 import { SUPPORTED_VIEWS } from './corpus-views/renderers.js';
 import { parseResourceSelector, readVerifiedRegularFile, } from '../resources/web-release.js';
+import { findPackageRoot } from '../cli/find-package-root.js';
 const MAX_RESOURCE_TRUST_ROOT_BYTES = 64 * 1024;
 function webReleaseOptionsFromEnvironment() {
     const baseUrl = process.env.AIWG_RESOURCE_BASE_URL;
@@ -82,6 +85,27 @@ function parseBackendFlag(args) {
 function parseSearchBackendFlag(args) {
     return parseBackendFlag(args) ?? 'fortemi-core';
 }
+/**
+ * The full `aiwg` package owns a local corpus, while `@aiwg/cli` intentionally
+ * ships only executable code and embedded runtime metadata. Select web
+ * resources automatically for the lightweight distribution so a normal
+ * `aiwg discover` / `aiwg show` invocation works immediately after install.
+ *
+ * Resolve from this module rather than process.argv so the exported API gets
+ * the same package-aware default as the npm binary.
+ */
+function defaultResourceSource() {
+    const packageRoot = findPackageRoot(path.dirname(fileURLToPath(import.meta.url)));
+    if (!packageRoot)
+        return 'local';
+    try {
+        const manifest = JSON.parse(readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+        return manifest.name === '@aiwg/cli' ? 'web' : 'local';
+    }
+    catch {
+        return 'local';
+    }
+}
 function parseResourceSourceFlag(args) {
     const indices = args
         .map((arg, index) => arg === '--resource-source' ? index : -1)
@@ -91,7 +115,7 @@ function parseResourceSourceFlag(args) {
         process.exit(1);
     }
     if (indices.length === 0)
-        return 'local';
+        return defaultResourceSource();
     const value = args[indices[0] + 1];
     if (value === 'local' || value === 'web' || value === 'auto')
         return value;

package/dist/src/resources/web-release.js

@@ -23,7 +23,11 @@ const MAX_SIGNATURE_BYTES = 64 * 1024;
 const MAX_COMPLETION_MARKER_BYTES = 4 * 1024;
 const MAX_CHANNEL_CACHE_CANDIDATES = 128;
 const MAX_RELEASE_CACHE_CANDIDATES = 32;
-const RESOURCE_FETCH_TIMEOUT_MS = 15_000;
+// A cold lightweight-CLI install downloads the signed release manifest
+// (~2 MiB) and Fortemi export (~11 MiB today). Fifteen seconds proved too
+// aggressive on otherwise healthy container and remote-network paths. Keep a
+// finite total-request bound, but allow normal first-run transfer variance.
+const RESOURCE_FETCH_TIMEOUT_MS = 60_000;
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.7.17",
+  "version": "2026.7.18",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",
@@ -23,6 +23,7 @@
     "./package.json": "./package.json"
   },
   "files": [
+    "LICENSE",
     "bin/",
     "dist/src/",
     "!dist/**/*.d.ts",