@anna-ai/cli 0.1.19 → 0.1.22

package/dist/cli.js

@@ -160,14 +160,22 @@ function checkHostApiAllowance(usages, manifest, bundleMethods) {
 //#endregion
 //#region src/validate/ui-section.ts
 /**
-* Static validation of `manifest.ui` — direct port of
+* Static validation of `manifest.ui` — port of
 * `src/services/anna_app_validator.py::validate_ui_section_static` from
 * matrix-nexus. Keep these algorithms byte-equivalent: any divergence here
 * means `anna-app validate` will lie about what production accepts.
+*
+* One intentional divergence: this CLI validates the **source** manifest
+* *before* publish, so it must additionally tolerate the `bundled:<handle>`
+* placeholder form in `host_api.tools` / `required_executas[].tool_id`.
+* Those placeholders are resolved to real tool_ids at publish time by
+* `substituteBundledRefs` (src/publish/bundled-executas.ts); production
+* (the Python validator) only ever sees the substituted manifest, where
+* the `bundled:` prefix is gone.
 */
 const VIEW_NAME_PATTERN = /^[a-z0-9_-]{1,40}$/;
 const BUNDLE_PATH_PATTERN = /^[A-Za-z0-9_./\-]+$/;
-const HOST_API_TOOL_REF_PATTERN = /^(?:required:\*|optional:\*|required:[A-Za-z0-9_.\-]+|optional:[A-Za-z0-9_.\-]+|[A-Za-z0-9_.\-]+)$/;
+const HOST_API_TOOL_REF_PATTERN = /^(?:required:\*|optional:\*|(?:required:|optional:)?bundled:[A-Za-z0-9_.\-]+|required:[A-Za-z0-9_.\-]+|optional:[A-Za-z0-9_.\-]+|[A-Za-z0-9_.\-]+)$/;
 const CSP_OVERRIDABLE_DIRECTIVES = new Set([
 	"connect-src",
 	"img-src",
@@ -211,7 +219,8 @@ function validateUiSectionStatic(manifest) {
 			continue;
 		}
 		if (ref === "required:*" || ref === "optional:*") continue;
-		const bare = ref.includes(":") ? ref.split(":", 2)[1] : ref;
+		const colon = ref.indexOf(":");
+		const bare = ref.startsWith("required:") || ref.startsWith("optional:") ? ref.slice(colon + 1) : ref;
 		if (!requiredIds.has(bare) && !optionalIds.has(bare)) errors.push(`host_api.tools 引用未在 manifest 中声明的 tool_id: ${ref}`);
 	}
 	const cspOverrides = ui.csp_overrides ?? {};
@@ -451,7 +460,7 @@ program.command("validate").description("Run schema + ACL checks on a manifest+b
 	process.exit(code);
 });
 program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").option("--executa <spec>", "Explicit executa registration; repeatable. Spec: comma-separated key=value (dir=<path>[,tool_id=<id>][,type=python|node|go|binary][,command=\"<argv>\"]). When only `dir=` is given, the executa is auto-detected from executa.json / pyproject.toml / package.json / go.mod. Overrides directory auto-discovery under <manifest-dir>/executas/.", (val, prev) => prev ? [...prev, val] : [val]).option("--no-llm", "Disable LLM bridge (anna.llm/agent return llm_disabled)").option("--mock-llm <fixture>", "Serve canned LLM responses from a JSONL fixture").option("--llm-account <host>", "Saved account host to use (default: current)").option("--llm-app-slug <slug>", "Override the manifest slug used to register / look up the dev AnnaApp (default: manifest.slug)").option("--storage <mode>", "Storage backend: \"legacy\" (in-memory runtime_state, default) or \"aps\" (real nexus APS via /api/v1/storage/* — requires `anna-app login`).", "legacy").action(async (opts) => {
-	const { runDev, parseExecutaSpec } = await import("./dev-D8o7xi0W.js");
+	const { runDev, parseExecutaSpec } = await import("./dev-BS_8yoSm.js");
 	const cwd = opts.cwd ?? process.cwd();
 	let executas;
 	if (opts.executa && opts.executa.length > 0) {
@@ -486,7 +495,7 @@ program.command("dev").description("Run a local harness (in-process dispatcher +
 });
 const fixture = program.command("fixture").description("Inspect / replay harness recordings (Phase 6)");
 fixture.command("verify <file>").description("Schema + invariant checks on a harness JSONL recording").option("--json", "Emit machine-readable JSON", false).action(async (file, opts) => {
-	const { runFixtureVerify } = await import("./fixture-CATHyLLI.js");
+	const { runFixtureVerify } = await import("./fixture-CYwxbiQD.js");
 	const code = await runFixtureVerify({
 		file,
 		json: opts.json
@@ -494,7 +503,7 @@ fixture.command("verify <file>").description("Schema + invariant checks on a har
 	process.exit(code);
 });
 fixture.command("summarize <file>").description("Print a human-readable digest of a harness recording").option("--json", "Emit machine-readable JSON", false).action(async (file, opts) => {
-	const { runFixtureSummarize } = await import("./fixture-CATHyLLI.js");
+	const { runFixtureSummarize } = await import("./fixture-CYwxbiQD.js");
 	const code = await runFixtureSummarize({
 		file,
 		json: opts.json
@@ -502,7 +511,7 @@ fixture.command("summarize <file>").description("Print a human-readable digest o
 	process.exit(code);
 });
 fixture.command("replay <file>").description("Dry-run replay of a harness recording (Phase 6 MVP)").option("--manifest <path>", "manifest.json path", "manifest.json").action(async (file, opts) => {
-	const { runFixtureReplay } = await import("./fixture-CATHyLLI.js");
+	const { runFixtureReplay } = await import("./fixture-CYwxbiQD.js");
 	const code = await runFixtureReplay({
 		file,
 		manifest: opts.manifest
@@ -510,12 +519,12 @@ fixture.command("replay <file>").description("Dry-run replay of a harness record
 	process.exit(code);
 });
 program.command("doctor").description("Check environment for `anna-app dev` (uv, matrix-nexus, dev key)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (optional)").action(async (opts) => {
-	const { runDoctor } = await import("./doctor-CgJYokiR.js");
+	const { runDoctor } = await import("./doctor-DKrt-Kda.js");
 	const code = await runDoctor({ matrixNexusRoot: opts.matrixNexusRoot });
 	process.exit(code);
 });
 program.command("login").description("Device-flow login against a nexus host; saves a PAT to ~/.config/anna/credentials.json").requiredOption("--host <url>", "nexus base URL, e.g. https://nexus.example.com").option("--no-browser", "Do not open a browser window automatically", false).action(async (opts) => {
-	const { runLogin } = await import("./login-CsIVbrmf.js");
+	const { runLogin } = await import("./login-BGqFjQwH.js");
 	const code = await runLogin({
 		host: opts.host,
 		noBrowser: opts.browser === false
@@ -523,7 +532,7 @@ program.command("login").description("Device-flow login against a nexus host; sa
 	process.exit(code);
 });
 program.command("logout").description("Remove a saved PAT entry").option("--host <url>", "Account to remove (default: current)").option("--all", "Remove every saved account", false).action(async (opts) => {
-	const { runLogout } = await import("./logout-gfmKQxMj.js");
+	const { runLogout } = await import("./logout-CGIRKH3y.js");
 	const code = await runLogout({
 		host: opts.host,
 		all: opts.all
@@ -531,18 +540,10 @@ program.command("logout").description("Remove a saved PAT entry").option("--host
 	process.exit(code);
 });
 program.command("whoami").description("Show the current account (and any others)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runWhoami } = await import("./whoami-BS5wy-Nh.js");
+	const { runWhoami } = await import("./whoami-BoFLEUcp.js");
 	const code = await runWhoami({ json: opts.json });
 	process.exit(code);
 });
-program.command("apps:list").description("List dev apps installed for the current PAT").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsList } = await import("./apps-ClgEOdKD.js");
-	const code = await runAppsList({
-		account: opts.account,
-		json: opts.json
-	});
-	process.exit(code);
-});
 const executa = program.command("executa").description("Standalone Executa plugin scaffolding + local runner");
 executa.command("init <dir>").description("Scaffold a standalone Executa plugin (python | node | go)").option("--slug <slug>", "Plugin slug (lowercase, hyphens)", "").option("--template <name>", "Language template: python | node | go", "python").option("--tool-id <id>", "Override the minted tool_id (default: tool-dev-<slug>)").option("--force", "Overwrite existing dir if non-empty", false).action(async (dir, opts) => {
 	const slug = opts.slug || dir.split(/[\\/]/).pop() || "my-executa";
@@ -555,7 +556,7 @@ executa.command("init <dir>").description("Scaffold a standalone Executa plugin
 		console.error(`✗ unknown template "${opts.template}" — expected python | node | go`);
 		process.exit(2);
 	}
-	const { runExecutaInit } = await import("./executa-init-COEmKDOE.js");
+	const { runExecutaInit } = await import("./executa-init-Jp-h9OI7.js");
 	const code = runExecutaInit({
 		targetDir: dir,
 		slug,
@@ -565,13 +566,13 @@ executa.command("init <dir>").description("Scaffold a standalone Executa plugin
 	});
 	process.exit(code);
 });
-executa.command("register").description("Register a standalone executa with nexus so `executa dev --storage real` (and future agent / sampling real-mode flows) can mint tokens for it").requiredOption("--tool-id <id>", "Executa tool_id (matches manifest.name)").option("--slug <slug>", "App slug (default: executa-<tool_id>; must be lowercase + hyphens)").option("--name <name>", "Human-readable display name (default: <tool_id>)").option("--account <host>", "Saved account host (default: current)").action(async (opts) => {
-	const { runExecutaRegister } = await import("./executa-register-66WKIwQQ.js");
+executa.command("register").description("Register a HARNESS AnnaApp(kind=executa) so `executa dev --storage real` (and agent / sampling / image / upload real-mode flows) can mint tokens for a local executa subprocess. Does NOT publish the executa itself — use `executa publish` for that. Lists/deletes via `apps list` / `apps delete`.").requiredOption("--tool-id <id>", "Executa tool_id (matches manifest.name)").option("--slug <slug>", "App slug (default: executa-<tool_id>; must be lowercase + hyphens)").option("--name <name>", "Human-readable display name (default: <tool_id>)").option("--account <host>", "Saved account host (default: current)").action(async (opts) => {
+	const { runExecutaRegister } = await import("./executa-register-CulDtwYZ.js");
 	const code = await runExecutaRegister(opts);
 	process.exit(code);
 });
 executa.command("dev").description("Run one Executa plugin in isolation (REPL or one-shot describe/invoke)").option("--dir <path>", "Executa project dir (default: CWD)").option("--spec <spec>", "Override discovery: comma-separated key=value (tool_id=...,type=...,command=\"...\")").option("--describe", "Print MANIFEST and exit", false).option("--health", "Print health and exit", false).option("--invoke <tool>", "Invoke one tool and exit").option("--args <json>", "JSON object passed as tool arguments", "{}").option("--json", "One-shot: emit compact JSON (no banners)", false).option("--no-sampling", "Hard-disable sampling reverse RPC (returns sampling_disabled)").option("--mock-sampling <fixture>", "Serve canned sampling responses from a JSONL fixture (offline)").option("--app-slug <slug>", "Forward sampling to nexus on behalf of this dev AnnaApp slug").option("--sampling-account <host>", "Saved account host for nexus sampling (default: current)").option("--no-agent", "Hard-disable agent reverse RPC (returns agent_not_granted)").option("--mock-agent <fixture>", "Serve canned agent/* responses from a JSONL fixture (offline)").option("--agent-account <host>", "Saved account host for nexus agent (default: --sampling-account or current)").option("--storage <mode>", "Storage backend: off | memory | mock | real (default: memory)").option("--mock-storage <fixture>", "Serve canned storage/* + files/* responses from a JSONL fixture").option("--storage-account <host>", "Saved account host for nexus storage (default: --sampling-account or current)").option("--storage-scopes <list>", "Comma-separated scopes for real storage tokens (default: user,app,tool)").option("--no-image", "Hard-disable image reverse RPC (returns image_not_granted)").option("--mock-image <fixture>", "Serve canned image/generate + image/edit responses from a JSONL fixture").option("--image-account <host>", "Saved account host for nexus image (default: --sampling-account or current)").option("--no-upload", "Hard-disable host/uploadFile reverse RPC (returns upload_not_granted)").option("--mock-upload <fixture>", "Serve canned host/uploadFile responses from a JSONL fixture").option("--upload-account <host>", "Saved account host for nexus uploads (default: --sampling-account or current)").action(async (opts) => {
-	const { runExecutaDev } = await import("./executa-dev-BeC6a8S8.js");
+	const { runExecutaDev } = await import("./executa-dev-BvS9zTpO.js");
 	const storageMode = opts.storage === void 0 ? void 0 : (() => {
 		const m = opts.storage;
 		if (m === "off" || m === "memory" || m === "mock" || m === "real") return m;
@@ -606,6 +607,328 @@ executa.command("dev").description("Run one Executa plugin in isolation (REPL or
 	});
 	process.exit(code);
 });
+const apps = program.command("apps").description("Anna App publish lifecycle commands");
+apps.command("list").description("List the Anna Apps you authored, with lifecycle status").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	const { runAppsList } = await import("./apps-BTn9EN0x.js");
+	process.exit(await runAppsList({
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("publish").description("Publish or update an Anna App (manifest.json in cwd)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--dry-run", "Resolve identity + diff but don't upload", false).option("--executa-id <handle=id>", "Override a bundled executa handle with a real tool_id (repeatable)", (val, prev) => [...prev, val], []).option("--skip-executa-publish", "Use cached/overridden tool_ids; don't recursively publish bundled executas", false).option("--no-bundled-executas", "Disable bundled-executa orchestration (legacy behaviour)").option("--no-bundle", "Skip UI bundle upload even if the manifest declares a UI").option("--bundle-dir <dir>", "UI bundle directory (default: <cwd>/bundle)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	if (opts.bump && ![
+		"patch",
+		"minor",
+		"major"
+	].includes(opts.bump)) {
+		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
+		process.exit(2);
+	}
+	const { runAppsPublish } = await import("./apps-publish-DfZTOxBJ.js");
+	process.exit(await runAppsPublish({
+		cwd: opts.cwd,
+		manifest: opts.manifest,
+		bump: opts.bump,
+		noWrite: opts.write === false,
+		dryRun: opts.dryRun,
+		executaId: opts.executaId,
+		skipExecutaPublish: opts.skipExecutaPublish,
+		noBundledExecutas: opts.bundledExecutas === false,
+		noBundle: opts.bundle === false,
+		bundleDir: opts.bundleDir,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("push").description("Upsert the mutable working draft (manifest + bundle, no freeze)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--dry-run", "Resolve identity + diff but don't upsert", false).option("--executa-id <handle=id>", "Override a bundled executa handle with a real tool_id (repeatable)", (val, prev) => [...prev, val], []).option("--skip-executa-publish", "Use cached/overridden tool_ids; don't recursively register bundled executas", false).option("--no-bundled-executas", "Disable bundled-executa orchestration (legacy behaviour)").option("--no-bundle", "Skip working UI bundle upload even if the manifest declares a UI").option("--bundle-dir <dir>", "UI bundle directory (default: <cwd>/bundle)").option("--if-match <revision>", "Optimistic-lock: require this working revision").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	if (opts.bump && ![
+		"patch",
+		"minor",
+		"major"
+	].includes(opts.bump)) {
+		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
+		process.exit(2);
+	}
+	let ifMatch;
+	if (opts.ifMatch !== void 0) {
+		ifMatch = Number.parseInt(opts.ifMatch, 10);
+		if (!Number.isFinite(ifMatch)) {
+			console.error(`✗ --if-match must be an integer revision (got: ${opts.ifMatch})`);
+			process.exit(2);
+		}
+	}
+	const { runAppsPush } = await import("./apps-push-B9XT2uwF.js");
+	process.exit(await runAppsPush({
+		cwd: opts.cwd,
+		manifest: opts.manifest,
+		bump: opts.bump,
+		noWrite: opts.write === false,
+		dryRun: opts.dryRun,
+		executaId: opts.executaId,
+		skipExecutaPublish: opts.skipExecutaPublish,
+		noBundledExecutas: opts.bundledExecutas === false,
+		noBundle: opts.bundle === false,
+		bundleDir: opts.bundleDir,
+		ifMatch,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("cut <version>").description("Snapshot the working draft into an immutable version (freeze deps)").option("--changelog <text>", "Override the working draft changelog for this version").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't cut", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
+	const { runAppsCut } = await import("./apps-cut-DtEkddIk.js");
+	process.exit(await runAppsCut({
+		version,
+		changelog: opts.changelog,
+		slug: opts.slug,
+		cwd: opts.cwd,
+		dryRun: opts.dryRun,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("discard").description("Drop the mutable working draft (leaves cut versions intact)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't discard", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	const { runAppsDiscard } = await import("./apps-discard-y3_IwcbQ.js");
+	process.exit(await runAppsDiscard({
+		slug: opts.slug,
+		cwd: opts.cwd,
+		dryRun: opts.dryRun,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("release <version>").description("Freeze & publish an existing remote version (go live)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--allow-create", "If the version isn't on the server, run 'apps publish' first, then release", false).option("--dry-run", "Resolve target + pre-flight but don't publish", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
+	const { runAppsRelease } = await import("./apps-release-BLH9XSxB.js");
+	process.exit(await runAppsRelease({
+		version,
+		slug: opts.slug,
+		cwd: opts.cwd,
+		allowCreate: opts.allowCreate,
+		dryRun: opts.dryRun,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("sync-meta").description("Push mutable store metadata (name/tagline/…) from the manifest").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--dry-run", "Print the metadata diff but don't PATCH", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	const { runAppsSyncMeta } = await import("./apps-sync-meta-D9eKMMUp.js");
+	process.exit(await runAppsSyncMeta({
+		cwd: opts.cwd,
+		manifest: opts.manifest,
+		dryRun: opts.dryRun,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("submit-review [slug]").description("Move an app into review (DRAFT/REJECTED → PENDING_REVIEW)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
+	const { runAppsSubmitReview } = await import("./apps-submit-review-DLwCxeAs.js");
+	process.exit(await runAppsSubmitReview({
+		slug,
+		cwd: opts.cwd,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("status <slug>").description("Show server-known state for one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
+	const { runAppsStatus } = await import("./apps-status-DQ9RvlME.js");
+	process.exit(await runAppsStatus({
+		slug,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("versions <slug>").description("List all server versions of one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
+	const { runAppsVersions } = await import("./apps-versions-2Tmk0nsx.js");
+	process.exit(await runAppsVersions({
+		slug,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("grants <slug>").description("Show currently granted scopes/quota for one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
+	const { runAppsGrants } = await import("./apps-grants-BGWlpee0.js");
+	process.exit(await runAppsGrants({
+		slug,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("unpublish <slug>").description("Flip a PUBLISHED app back to APPROVED (private)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
+	const { runAppsUnpublish } = await import("./apps-destructive-DSTrcFUP.js");
+	process.exit(await runAppsUnpublish({
+		slug,
+		yes: opts.yes,
+		confirm: opts.confirm,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("archive <slug>").description("Archive an Anna App (hides it from end users)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
+	const { runAppsArchive } = await import("./apps-destructive-DSTrcFUP.js");
+	process.exit(await runAppsArchive({
+		slug,
+		yes: opts.yes,
+		confirm: opts.confirm,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("unarchive <slug>").description("Restore an archived Anna App back to APPROVED").option("--yes", "Acknowledge the operation", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
+	const { runAppsUnarchive } = await import("./apps-destructive-DSTrcFUP.js");
+	process.exit(await runAppsUnarchive({
+		slug,
+		yes: opts.yes,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+apps.command("delete <slug>").description("Hard-delete an Anna App (refused by server if installs exist)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
+	const { runAppsDelete } = await import("./apps-destructive-DSTrcFUP.js");
+	process.exit(await runAppsDelete({
+		slug,
+		yes: opts.yes,
+		confirm: opts.confirm,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+executa.command("list").description("List Executas owned by the current PAT").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	const { runExecutaList } = await import("./executa-reads-CQ6S8gHY.js");
+	process.exit(await runExecutaList({
+		account: opts.account,
+		json: opts.json
+	}));
+});
+executa.command("status <ref>").description("Show server-known state for one Executa (slug or tool_id)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
+	const { runExecutaStatus } = await import("./executa-reads-CQ6S8gHY.js");
+	process.exit(await runExecutaStatus({
+		ref,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+executa.command("versions <ref>").description("List immutable version snapshots for one Executa").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
+	const { runExecutaVersions } = await import("./executa-reads-CQ6S8gHY.js");
+	process.exit(await runExecutaVersions({
+		ref,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+executa.command("publish").description("Mint or update an Executa (executa.json in cwd)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "executa.json path", "executa.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--publish", "After freezing the version, flip visibility to PUBLIC", false).option("--dry-run", "Resolve identity + diff but don't upload", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	if (opts.bump && ![
+		"patch",
+		"minor",
+		"major"
+	].includes(opts.bump)) {
+		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
+		process.exit(2);
+	}
+	const { runExecutaPublish } = await import("./executa-publish-B88_9gbp.js");
+	process.exit(await runExecutaPublish({
+		cwd: opts.cwd,
+		manifest: opts.manifest,
+		bump: opts.bump,
+		noWrite: opts.write === false,
+		publish: opts.publish,
+		dryRun: opts.dryRun,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+executa.command("unpublish <slug>").description("Flip an Executa's visibility back to private").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
+	const { runExecutaUnpublish } = await import("./executa-destructive-COQE4Xqi.js");
+	process.exit(await runExecutaUnpublish({
+		slug,
+		yes: opts.yes,
+		confirm: opts.confirm,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+executa.command("yank <ref>").description("Hard-delete one Executa version (<slug>@<version>)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
+	const { runExecutaYank } = await import("./executa-destructive-COQE4Xqi.js");
+	process.exit(await runExecutaYank({
+		ref,
+		yes: opts.yes,
+		confirm: opts.confirm,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+executa.command("delete <slug>").description("Hard-delete an Executa").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
+	const { runExecutaDelete } = await import("./executa-destructive-COQE4Xqi.js");
+	process.exit(await runExecutaDelete({
+		slug,
+		yes: opts.yes,
+		confirm: opts.confirm,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+executa.command("cache-clear").description("Delete the local `.anna/executa.json` identity cache. Use after the server-side Executa has been deleted/recreated, or when switching host. Next `executa publish` will re-mint via the idempotency key.").option("--cwd <dir>", "Project root (default: cwd)").action(async (opts) => {
+	const { resolve: resolve$1 } = await import("node:path");
+	const { existsSync: existsSync$1 } = await import("node:fs");
+	const { executaCachePath, invalidateExecutaCache } = await import("./executa-cache-WBkCLic7.js");
+	const cwd = resolve$1(opts.cwd ?? process.cwd());
+	const p = executaCachePath(cwd);
+	if (!existsSync$1(p)) {
+		console.log(`(no cache at ${p})`);
+		process.exit(0);
+	}
+	invalidateExecutaCache(cwd);
+	console.log(`✓ removed ${p}`);
+	process.exit(0);
+});
+const token = program.command("token").description("Manage developer PATs (list / revoke / scopes)");
+token.command("list").description("List the caller's PATs (most-recent first)").option("--include-revoked", "Also show revoked PATs", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	const { runTokenList } = await import("./token-B9JUPelx.js");
+	process.exit(await runTokenList({
+		includeRevoked: opts.includeRevoked,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+token.command("revoke <id>").description("Revoke one of the caller's PATs by id").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (id, opts) => {
+	const idNum = Number.parseInt(id, 10);
+	if (!Number.isFinite(idNum) || idNum <= 0) {
+		console.error(`✗ token id must be a positive integer (got: ${id})`);
+		process.exit(2);
+	}
+	const { runTokenRevoke } = await import("./token-B9JUPelx.js");
+	process.exit(await runTokenRevoke({
+		id: idNum,
+		account: opts.account,
+		json: opts.json
+	}));
+});
+token.command("scopes").description("Print the available PAT scope catalogue").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	const { runTokenScopes } = await import("./token-B9JUPelx.js");
+	process.exit(await runTokenScopes({
+		account: opts.account,
+		json: opts.json
+	}));
+});
+program.command("publish").description("Auto-detect cwd and publish (apps publish OR executa publish)").option("--cwd <dir>", "Project root (default: cwd)").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--publish", "(executa) flip visibility to PUBLIC after upload", false).option("--dry-run", "Resolve identity + diff but don't upload", false).option("--no-bundle", "(apps) skip UI bundle upload").option("--bundle-dir <dir>", "(apps) UI bundle directory (default: <cwd>/bundle)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	if (opts.bump && ![
+		"patch",
+		"minor",
+		"major"
+	].includes(opts.bump)) {
+		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
+		process.exit(2);
+	}
+	const { runTopLevelPublish } = await import("./publish-C1wcf-qI.js");
+	process.exit(await runTopLevelPublish({
+		cwd: opts.cwd,
+		bump: opts.bump,
+		noWrite: opts.write === false,
+		publish: opts.publish,
+		dryRun: opts.dryRun,
+		noBundle: opts.bundle === false,
+		bundleDir: opts.bundleDir,
+		account: opts.account,
+		json: opts.json
+	}));
+});
 program.parseAsync(process.argv).catch((e) => {
 	console.error(e);
 	process.exit(2);

package/dist/client-Dn9zThOd.js

@@ -0,0 +1,150 @@
+import { canonicalHost } from "./credentials-BTv2IfUZ.js";
+
+//#region src/api/client.ts
+var CliError = class extends Error {
+	exitCode;
+	status;
+	body;
+	constructor(message, exitCode, opts) {
+		super(message);
+		this.exitCode = exitCode;
+		this.status = opts?.status;
+		this.body = opts?.body;
+	}
+};
+var ScopeError = class extends CliError {
+	needed;
+	missing;
+	have;
+	constructor(opts) {
+		super(`missing PAT scope(s): ${opts.missing.join(", ") || "(unknown)"}`, 3, {
+			status: 403,
+			body: opts.body
+		});
+		this.needed = opts.needed;
+		this.missing = opts.missing;
+		this.have = opts.have;
+	}
+};
+var NexusClient = class {
+	host;
+	pat;
+	fetchImpl;
+	userAgent;
+	constructor(opts) {
+		this.host = canonicalHost(opts.host);
+		this.pat = opts.pat;
+		this.fetchImpl = opts.fetchImpl ?? fetch;
+		this.userAgent = opts.userAgent ?? "anna-app-cli";
+	}
+	async request(opts) {
+		const url = new URL(this.host + opts.path);
+		if (opts.query) for (const [k, v] of Object.entries(opts.query)) {
+			if (v === void 0 || v === null) continue;
+			url.searchParams.set(k, String(v));
+		}
+		const headers = {
+			authorization: `Bearer ${this.pat}`,
+			"user-agent": this.userAgent,
+			accept: "application/json",
+			...opts.headers ?? {}
+		};
+		let body;
+		if (opts.multipart) {
+			const fd = new FormData();
+			for (const [k, v] of Object.entries(opts.multipart.fields)) fd.append(k, v);
+			body = fd;
+		} else if (opts.body !== void 0) {
+			headers["content-type"] = "application/json";
+			body = JSON.stringify(opts.body);
+		}
+		const method = opts.method ?? "GET";
+		const allowed = new Set(opts.allowStatuses ?? []);
+		let res;
+		try {
+			res = await this.fetchImpl(url, {
+				method,
+				headers,
+				body
+			});
+		} catch (e) {
+			throw new CliError(`network error contacting ${this.host}: ${e.message}`, 6);
+		}
+		if (res.status >= 500 && !opts.noRetry && !allowed.has(res.status) && method === "GET") try {
+			res = await this.fetchImpl(url, {
+				method,
+				headers,
+				body
+			});
+		} catch (e) {
+			throw new CliError(`network error contacting ${this.host}: ${e.message}`, 6);
+		}
+		const idempotentHit = res.headers.get("x-anna-idempotent") === "hit";
+		let parsed = null;
+		const text = await res.text();
+		if (text.length > 0) try {
+			parsed = JSON.parse(text);
+		} catch {
+			parsed = text;
+		}
+		if (!res.ok && !allowed.has(res.status)) this.throwForStatus(res.status, parsed);
+		return {
+			data: parsed,
+			status: res.status,
+			headers: res.headers,
+			idempotentHit
+		};
+	}
+	throwForStatus(status, body) {
+		if (status === 401) throw new CliError("PAT rejected by server (401). Run `anna-app login --host …` to refresh.", 2, {
+			status,
+			body
+		});
+		if (status === 403) {
+			const det = extractDetail(body);
+			if (det && typeof det === "object" && det.detail === "missing_scope") {
+				const dd = det;
+				throw new ScopeError({
+					needed: dd.needed ?? [],
+					missing: dd.missing ?? [],
+					have: dd.have ?? [],
+					body
+				});
+			}
+			throw new CliError(`forbidden (403): ${describeBody(body)}`, 3, {
+				status,
+				body
+			});
+		}
+		if (status >= 500) throw new CliError(`server error (${status}): ${describeBody(body)}`, 6, {
+			status,
+			body
+		});
+		throw new CliError(`request failed (${status}): ${describeBody(body)}`, 5, {
+			status,
+			body
+		});
+	}
+};
+function extractDetail(body) {
+	if (body && typeof body === "object" && "detail" in body) {
+		const d = body.detail;
+		if (typeof d === "string") return { detail: d };
+		if (d && typeof d === "object") return d;
+	}
+	return null;
+}
+function describeBody(body) {
+	if (typeof body === "string") return body.slice(0, 240);
+	if (body && typeof body === "object") {
+		const det = body.detail;
+		if (typeof det === "string") return det;
+		try {
+			return JSON.stringify(body).slice(0, 240);
+		} catch {}
+	}
+	return String(body ?? "(empty body)");
+}
+
+//#endregion
+export { CliError, NexusClient, ScopeError };