@aqaf/cli 1.1.0 → 1.1.1

package/README.md

@@ -1,9 +1,9 @@
-# @aqaf/cli — npm distribution (release candidate / not published)
+# @aqaf/cli — published npm distribution
 
 This package exposes the **same Python AQAF analyzer** to JS/TS projects, not a second independent scoring implementation. Requires **Node 18+ and Python 3.9+**. No `postinstall` scripts, network calls or execution of target project code. Never run the analyzer on an untrusted repository via arbitrary user hooks: AQAF only reads data.
 
 ```bash
-npm install ./aqaf-cli-1.1.0.tgz
+npm install @aqaf/cli@1.1.1
 npx aqaf . --format json
 ```
 
@@ -15,7 +15,7 @@ const report = scan(process.cwd(), { pack: 'web', profile: 'npm_library' });
 console.log(report.findings);
 ```
 
-For a Windows terminal with multiple Python installations set `AQAF_PYTHON`. Package name `@aqaf/cli` is provisional, requires ownership of npm scope. Publish only after name availability, license, package integrity, CI and authority checks.
+For a Windows terminal with multiple Python installations set `AQAF_PYTHON`. The public package is https://www.npmjs.com/package/@aqaf/cli The 1.1.1 release includes project discovery, scope filtering, optional documentation and book-informed reviews. See the release evidence for channel installation verification. The hosted cross-platform matrix remains pending; do not infer those results from this local check. For a global CLI use `npm install --global @aqaf/cli@1.1.1`. Further publication requires owner approval.
 
 ## Owner release preparation
 
@@ -42,3 +42,22 @@ To recheck an existing trusted candidate, pass its exact `.tgz` path to that
 script. It never uploads and does not need npm registry credentials. The active
 build-only npm candidate workflow tests Linux/macOS/Windows with Node 18/24 and
 Python 3.9/3.12; configuration alone is not proof those jobs have passed.
+
+## Experimental review option (unreleased 1.2.0)
+
+Use `scan(repo, {reviewSignals: true})` or CLI `--review-signals` for bounded JS/TS
+review observations. `reviewSignals` must be boolean. The separate `review` result
+is experimental, unreviewed and unscored; normal findings, scores and baseline
+gates are unchanged. Default calls omit it. No target code or credential decoding
+is performed. This source candidate has not been published.
+
+Source candidate 1.3.0 respects `.gitignore` by default. Use
+`scan(repo, {respectGitignore: false})` for an explicit opt-out. Candidate scope
+options include `scopePolicy`, `scopeConfig`, `inventoryAll`, `component`,
+`reviewMaxFiles`, `reviewMaxBytes`, `reviewFileBytes`, `reviewOffset`,
+`reviewCursorIn` and `reviewCursorOut`. `reviewSignals` remains opt-in and unscored.
+The archive includes only Python/JSON runtime files; bytecode caches are excluded.
+
+The bundled Python runtime also supports `aqaf projects discover ROOT`, the opt-in local `projects` catalogue commands, and `aqaf docs check ROOT`. Use `invoke(['projects', 'discover', root])` from the Node API for additive commands. Discovery and documentation checks never execute target code; catalogue storage uses Python's standard-library SQLite. Experimental probabilities and observations are uncalibrated and unscored.
+
+Add `--review-knowledge` to an assessment for the optional book-informed human review agenda. It uses 31 attributed secondary notes and leaves questions unknown until reviewed; it does not change scores or run target checks.

package/index.js

@@ -8,7 +8,7 @@ function invoke(args, opts = {}) {
   const pythonCandidates = opts.python ? [opts.python] : process.env.AQAF_PYTHON ? [process.env.AQAF_PYTHON] : (process.platform === 'win32' ? ['py', 'python', 'python3'] : ['python3','python']);
   for (const command of pythonCandidates) {
     const pre = command === 'py' ? ['-3'] : [];
-    const env = { ...process.env, ...(opts.env || {}), PYTHONPATH: [vendor, process.env.PYTHONPATH].filter(Boolean).join(path.delimiter) };
+    const env = { ...process.env, ...(opts.env || {}), PYTHONDONTWRITEBYTECODE: '1', PYTHONPATH: [vendor, process.env.PYTHONPATH].filter(Boolean).join(path.delimiter) };
     const result = spawnSync(command, [...pre, '-m', 'aqaf', ...args], {
       cwd: opts.cwd || process.cwd(), env, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024,
       stdio: opts.stdio || 'pipe', windowsHide: true
@@ -23,6 +23,25 @@ function scan(repo, options = {}) {
   const argv = [repo, '--format', 'json', '--output', '-'];
   if (options.profile) argv.push('--profile', options.profile);
   if (options.pack) argv.push('--pack', options.pack);
+  if (options.reviewSignals !== undefined && typeof options.reviewSignals !== 'boolean') throw new TypeError('reviewSignals must be boolean');
+  if (options.reviewSignals) argv.push('--review-signals');
+  for (const [name, flag] of [['respectGitignore','gitignore'],['inventoryAll','inventory-all']]) {
+    if (options[name] !== undefined && typeof options[name] !== 'boolean') throw new TypeError(`${name} must be boolean`);
+    if (options[name] === true) argv.push(`--${flag}`);
+    if (name === 'respectGitignore' && options[name] === false) argv.push('--no-gitignore');
+  }
+  for (const [name,flag] of [['scopePolicy','scope-policy'],['scopeConfig','scope-config'],['component','component'],['reviewCursorIn','review-cursor-in'],['reviewCursorOut','review-cursor-out']]) {
+    if (options[name] !== undefined) {
+      if (typeof options[name] !== 'string') throw new TypeError(`${name} must be a string`);
+      argv.push(`--${flag}`, options[name]);
+    }
+  }
+  for (const [name,flag] of [['reviewMaxFiles','review-max-files'],['reviewMaxBytes','review-max-bytes'],['reviewFileBytes','review-file-bytes'],['reviewOffset','review-offset']]) {
+    if (options[name] !== undefined) {
+      if (!Number.isSafeInteger(options[name]) || options[name] < (name === 'reviewOffset' ? 0 : 1)) throw new TypeError(`${name} must be a bounded integer`);
+      argv.push(`--${flag}`, String(options[name]));
+    }
+  }
   for (const capability of (options.capabilities || [])) argv.push('--capability', capability);
   if (options.profileDir) argv.push('--profile-dir', options.profileDir);
   const result = invoke(argv, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aqaf/cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Local-first architecture assessment, Node.js distribution wrapper around the bundled AQAF Python engine",
   "type": "commonjs",
   "main": "./index.js",
@@ -12,7 +12,8 @@
   },
   "files": [
     "bin/",
-    "vendor/",
+    "vendor/**/*.py",
+    "vendor/**/*.json",
     "index.js",
     "README.md",
     "LICENSE"

package/vendor/aqaf/__init__.py

@@ -1,2 +1,2 @@
 """AQAF local, offline, heuristic architecture assessment."""
-__version__ = '1.1.0'
+__version__ = '1.1.1'