@anna-ai/cli 0.1.0

package/dist/test/index.js

@@ -0,0 +1,260 @@
+//#region src/test/host-api-acl.ts
+const NAMESPACED = {
+	tools: true,
+	chat: true,
+	artifact: true,
+	llm: true,
+	fs: true,
+	storage: true,
+	prefs: true,
+	window: true
+};
+function deriveAcl(manifest) {
+	const ha = manifest.ui?.host_api ?? {};
+	const allowed = new Set();
+	const allowedTools = new Set();
+	let toolsWildcard = false;
+	for (const ref of ha.tools ?? []) {
+		if (ref === "required:*" || ref === "optional:*" || ref === "*") {
+			toolsWildcard = true;
+			continue;
+		}
+		const bare = ref.includes(":") ? ref.split(":", 2)[1] : ref;
+		allowedTools.add(bare);
+	}
+	if (allowedTools.size > 0 || toolsWildcard) allowed.add("tools.invoke");
+	for (const ns of Object.keys(NAMESPACED)) {
+		if (ns === "tools") continue;
+		for (const method of ha[ns] ?? []) allowed.add(`${ns}.${method}`);
+	}
+	return {
+		allowed,
+		allowedTools,
+		toolsWildcard
+	};
+}
+function isToolAllowed(acl, toolId) {
+	if (acl.toolsWildcard) return true;
+	return acl.allowedTools.has(toolId);
+}
+
+//#endregion
+//#region src/test/runtime.ts
+const DEFAULT_TOKEN_TTL_MS = 5 * 60 * 1e3;
+function randHex(n) {
+	let s = "";
+	for (let i = 0; i < n; i += 1) s += Math.floor(Math.random() * 16).toString(16);
+	return s;
+}
+var CallLogImpl = class {
+	records = [];
+	push(r) {
+		this.records.push(r);
+	}
+	all() {
+		return this.records.slice();
+	}
+	byNs(prefix) {
+		return this.records.filter((r) => `${r.ns}.${r.method}` === prefix || r.ns === prefix);
+	}
+	last() {
+		return this.records[this.records.length - 1] ?? null;
+	}
+	lastOf(prefix) {
+		const xs = this.byNs(prefix);
+		return xs[xs.length - 1] ?? null;
+	}
+	clear() {
+		this.records.length = 0;
+	}
+};
+var EventBusImpl = class {
+	listeners = new Map();
+	wildcard = new Set();
+	emit(name, payload) {
+		for (const fn of this.listeners.get(name) ?? []) try {
+			fn(payload);
+		} catch {}
+		for (const fn of this.wildcard) try {
+			fn(name, payload);
+		} catch {}
+	}
+	on(name, fn) {
+		let set = this.listeners.get(name);
+		if (!set) {
+			set = new Set();
+			this.listeners.set(name, set);
+		}
+		set.add(fn);
+		return () => set.delete(fn);
+	}
+	/** Internal: tap all events for the auth.refresh handler etc. */
+	onAny(fn) {
+		this.wildcard.add(fn);
+		return () => this.wildcard.delete(fn);
+	}
+};
+/**
+* Default mock implementations for namespaces that have safe in-memory
+* behavior. Bundle authors can override any of these via `mocks`.
+*/
+function makeDefaultMocks(state) {
+	return {
+		"storage.get": (args) => {
+			const key = args.key ?? "";
+			return state.storage.get(key) ?? null;
+		},
+		"storage.set": (args) => {
+			const { key, value } = args;
+			state.storage.set(key, value);
+			return null;
+		},
+		"storage.delete": (args) => {
+			const key = args.key ?? "";
+			state.storage.delete(key);
+			return null;
+		},
+		"prefs.get": (args) => {
+			const key = args.key ?? "";
+			return state.prefs.get(key) ?? null;
+		},
+		"prefs.set": (args) => {
+			const { key, value } = args;
+			state.prefs.set(key, value);
+			return null;
+		},
+		"chat.write_message": () => null,
+		"window.set_title": () => null
+	};
+}
+async function mountBundle(opts) {
+	const acl = deriveAcl(opts.manifest);
+	const calls = new CallLogImpl();
+	const events = new EventBusImpl();
+	const startedAt = Date.now();
+	const ttl = opts.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS;
+	const wid = opts.wid ?? `harness-${randHex(8)}`;
+	let token = opts.token ?? randHex(24);
+	const state = {
+		storage: new Map(),
+		prefs: new Map()
+	};
+	const mocks = {
+		...makeDefaultMocks(state),
+		...opts.mocks ?? {}
+	};
+	events.onAny((name, payload) => {
+		if (name === "auth.refresh") {
+			const next = payload?.token;
+			if (typeof next === "string" && next) token = next;
+		}
+	});
+	let seq = 0;
+	async function dispatch(ns, method, args) {
+		seq += 1;
+		const rec = {
+			seq,
+			t: Date.now() - startedAt,
+			ns,
+			method,
+			args,
+			outcome: null
+		};
+		calls.push(rec);
+		const key = `${ns}.${method}`;
+		if (!acl.allowed.has(key)) {
+			rec.outcome = "denied";
+			rec.errorCode = "DENIED";
+			rec.errorMessage = `host API '${key}' not declared in manifest.ui.host_api`;
+			throw new HostApiError(rec.errorCode, rec.errorMessage);
+		}
+		if (ns === "tools" && method === "invoke") {
+			const toolId = args.tool_id ?? "";
+			if (!isToolAllowed(acl, toolId)) {
+				rec.outcome = "denied";
+				rec.errorCode = "DENIED";
+				rec.errorMessage = `tool '${toolId}' not declared in manifest.ui.host_api.tools`;
+				throw new HostApiError(rec.errorCode, rec.errorMessage);
+			}
+		}
+		const handler = mocks[key];
+		if (!handler) {
+			rec.outcome = "error";
+			rec.errorCode = "NO_MOCK";
+			rec.errorMessage = `no mock registered for '${key}' (add via opts.mocks or harness.mock)`;
+			throw new HostApiError(rec.errorCode, rec.errorMessage);
+		}
+		try {
+			const result = await Promise.resolve(handler(args, {
+				ns,
+				method
+			}));
+			rec.outcome = "ok";
+			rec.result = result;
+			return result;
+		} catch (e) {
+			rec.outcome = "error";
+			const err = e;
+			rec.errorCode = err.code ?? "MOCK_ERROR";
+			rec.errorMessage = err.message ?? String(e);
+			throw e;
+		}
+	}
+	const facet = (ns) => (method) => (args) => dispatch(ns, method, args ?? {});
+	const runtime = {
+		get hello() {
+			return {
+				wid,
+				t: token,
+				user_id: opts.userId ?? 1
+			};
+		},
+		call: dispatch,
+		on: (name, fn) => events.on(name, fn),
+		tools: { invoke: (args) => dispatch("tools", "invoke", args) },
+		storage: {
+			get: (key) => dispatch("storage", "get", { key }),
+			set: (key, value) => dispatch("storage", "set", {
+				key,
+				value
+			})
+		},
+		chat: { write_message: (text, optsArg) => dispatch("chat", "write_message", {
+			text,
+			...optsArg ?? {}
+		}) },
+		artifact: { create: (args) => dispatch("artifact", "create", args) },
+		llm: { complete: (args) => dispatch("llm", "complete", args) },
+		fs: new Proxy({}, { get: (_t, prop) => facet("fs")(prop) }),
+		prefs: {
+			get: (key) => dispatch("prefs", "get", { key }),
+			set: (key, value) => dispatch("prefs", "set", {
+				key,
+				value
+			})
+		},
+		window: { set_title: (title) => dispatch("window", "set_title", { title }) }
+	};
+	return {
+		runtime,
+		calls,
+		events,
+		acl,
+		mock(key, handler) {
+			mocks[key] = handler;
+		},
+		wait: (ms) => new Promise((res) => setTimeout(res, ms))
+	};
+}
+/** Error class thrown for ACL denials or missing mocks. */
+var HostApiError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "HostApiError";
+		this.code = code;
+	}
+};
+
+//#endregion
+export { HostApiError, deriveAcl, isToolAllowed, mountBundle };

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@anna-ai/cli",
+  "version": "0.1.0",
+  "description": "Anna App developer CLI: scaffold, validate, harness (Phase 2 MVP: init + validate).",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "anna-app": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/cli.d.ts",
+      "import": "./dist/cli.js"
+    },
+    "./test": {
+      "types": "./dist/test/index.d.ts",
+      "import": "./dist/test/index.js"
+    }
+  },
+  "files": [
+    "dist/",
+    "templates/",
+    "vendor/",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "tsc --noEmit",
+    "sync:schema": "node scripts/sync-schema.mjs",
+    "check:runtime-pin": "node scripts/check-runtime-pin.mjs",
+    "prepublishOnly": "pnpm lint && pnpm test && pnpm build"
+  },
+  "dependencies": {
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
+    "commander": "^12.1.0",
+    "kleur": "^4.1.5",
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "@types/ws": "^8.5.13",
+    "tsdown": "^0.9.6",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.8"
+  },
+  "engines": {
+    "node": ">=22"
+  }
+}

package/templates/minimal/README.md

@@ -0,0 +1,9 @@
+# __SLUG__
+
+Scaffolded by `anna-app init`. Next steps:
+
+```bash
+anna-app validate           # static checks
+anna-app validate --strict  # + host_api ACL coverage
+anna-app dev                # local harness — opens http://127.0.0.1:5180/dev/<wid>?t=<dev-token>
+```

package/templates/minimal/app.json

@@ -0,0 +1,7 @@
+{
+  "name": "__SLUG__",
+  "tagline": "TODO",
+  "description": "TODO",
+  "category": "productivity",
+  "pricing_model": "free"
+}

package/templates/minimal/bundle/app.js

@@ -0,0 +1,36 @@
+// Minimal Anna App bundle entry. Replace with real logic.
+const TOOL_ID = "__TOOL_ID__";
+
+async function main() {
+  const status = document.getElementById("status");
+  const btn = document.getElementById("primary-btn");
+  if (!status || !btn) return;
+
+  let anna;
+  try {
+    anna = await AnnaAppRuntime.connect();
+  } catch (e) {
+    status.textContent = "Standalone preview (no host).";
+    return;
+  }
+
+  await anna.window.set_title({ title: "__SLUG__" });
+  status.textContent = "Ready.";
+
+  btn.addEventListener("click", async () => {
+    status.textContent = "Running…";
+    try {
+      const out = await anna.tools.invoke({
+        tool_id: TOOL_ID,
+        method: "ping",
+        args: {},
+      });
+      await anna.storage.set({ key: "__SLUG__:last", value: Date.now() });
+      status.textContent = JSON.stringify(out, null, 2);
+    } catch (e) {
+      status.textContent = "Error: " + e.message;
+    }
+  });
+}
+
+main();

package/templates/minimal/bundle/index.html

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>__SLUG__</title>
+    <script src="/static/anna-apps/_sdk/0.1.0/index.js" defer></script>
+    <script src="./app.js" type="module" defer></script>
+  </head>
+  <body>
+    <h1>__SLUG__</h1>
+    <button id="primary-btn">Run</button>
+    <pre id="status">…</pre>
+  </body>
+</html>

package/templates/minimal/executas/__SLUG__/plugin.py

@@ -0,0 +1,60 @@
+"""Minimal stdio plugin scaffold for the __SLUG__ Anna App."""
+
+import json
+import sys
+
+MANIFEST = {
+    "name": "__TOOL_ID__",
+    "version": "0.1.0",
+    "tools": [
+        {
+            "name": "ping",
+            "description": "Smoke-test method.",
+            "parameters": {
+                "type": "object",
+                "properties": {},
+                "additionalProperties": False,
+            },
+        }
+    ],
+}
+
+
+def invoke(method: str, args: dict) -> dict:
+    if method == "ping":
+        return {"pong": True}
+    raise ValueError(f"unknown method: {method}")
+
+
+def main() -> None:
+    for line in sys.stdin:
+        line = line.strip()
+        if not line:
+            continue
+        req = json.loads(line)
+        try:
+            if req.get("method") == "describe":
+                result = MANIFEST
+            elif req.get("method") == "health":
+                result = {"status": "ok"}
+            elif req.get("method") == "invoke":
+                result = invoke(req["params"]["tool"], req["params"].get("arguments", {}))
+            else:
+                raise ValueError(f"unknown rpc: {req.get('method')}")
+            sys.stdout.write(json.dumps({"jsonrpc": "2.0", "id": req.get("id"), "result": result}) + "\n")
+        except Exception as e:  # noqa: BLE001
+            sys.stdout.write(
+                json.dumps(
+                    {
+                        "jsonrpc": "2.0",
+                        "id": req.get("id"),
+                        "error": {"code": -32601, "message": str(e)},
+                    }
+                )
+                + "\n"
+            )
+        sys.stdout.flush()
+
+
+if __name__ == "__main__":
+    main()

package/templates/minimal/executas/__SLUG__/pyproject.toml

@@ -0,0 +1,12 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "__TOOL_ID__"
+version = "0.1.0"
+description = "Executa for the __SLUG__ Anna App"
+requires-python = ">=3.10"
+
+[project.scripts]
+"__TOOL_ID__" = "__SLUG___executa.plugin:main"

package/templates/minimal/manifest.json

@@ -0,0 +1,38 @@
+{
+  "schema": 2,
+  "permissions": ["tools.invoke", "storage.read", "storage.write"],
+  "required_executas": [
+    {
+      "tool_id": "__TOOL_ID__"
+    }
+  ],
+  "tags": ["__SLUG__"],
+  "ui": {
+    "bundle": {
+      "format": "static-spa",
+      "entry": "index.html",
+      "external_origins": []
+    },
+    "views": [
+      {
+        "name": "main",
+        "title": "__SLUG__",
+        "default": true,
+        "default_size": { "w": 480, "h": 360 },
+        "min_size": { "w": 320, "h": 240 }
+      }
+    ],
+    "host_api": {
+      "tools": ["__TOOL_ID__"],
+      "storage": ["get", "set"],
+      "window": ["set_title", "ready"]
+    },
+    "csp_overrides": {},
+    "state_merge": "last_writer_wins"
+  },
+  "dev": {
+    "fixtures": ["fixtures/*.jsonl"],
+    "seed_storage": {},
+    "user_id": 1
+  }
+}

package/vendor/anna-app-schema/README.md

@@ -0,0 +1,22 @@
+# @anna/app-schema (v0.1.0)
+
+Versioned schema bundle for the Anna App platform. Generated by
+`scripts/export_app_schema.py` in matrix-nexus; do not edit by hand.
+
+## Contents
+
+* `manifest/AppManifest.json` — JSON Schema for the app manifest.
+* `manifest/UiManifestSection.json` — JSON Schema for the `ui` block.
+* `host_api/methods.json` — Flat `(namespace, method)` table mirroring
+  the dispatcher's `_DISPATCH` map. `no_auth=true` methods skip the
+  `host_api` ACL gate.
+* `events/AnnaAppEvent.json` — SSE event union (the `kind` enum).
+* `dispatcher_version.txt` — Single source-of-truth bundle version;
+  harnesses must refuse to start when their copy disagrees.
+
+## Regenerate
+
+```bash
+uv run python scripts/export_app_schema.py        # write
+uv run python scripts/export_app_schema.py --check # CI gate
+```

package/vendor/anna-app-schema/dispatcher_version.txt

@@ -0,0 +1 @@
+0.1.0

package/vendor/anna-app-schema/events/AnnaAppEvent.json

@@ -0,0 +1,38 @@
+{
+  "$id": "https://schemas.anna.partners/anna-app-event.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": true,
+  "description": "SSE envelope union for `event: data_model/AnnaAppEvent` frames. Bundle consumers should treat unknown `kind` values as forward-compatible additions and ignore them.",
+  "properties": {
+    "by_client_id": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "kind": {
+      "enum": [
+        "artifact_appended",
+        "chat_message_from_app",
+        "close_view",
+        "geometry_changed",
+        "open_view",
+        "ping",
+        "runtime_state_synced",
+        "status_changed",
+        "title_changed",
+        "window_focus_changed"
+      ],
+      "type": "string"
+    },
+    "window_uuid": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "kind"
+  ],
+  "title": "AnnaAppEvent",
+  "type": "object",
+  "version": "0.1.0"
+}