@anna-ai/cli 0.1.22 → 0.1.26

package/dist/cli.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { printMascot } from "./mascot-wlYTJqMs.js";
+import { findMatrixNexusRoot, nexusSchemaDir } from "./nexus-root-BlPwOusj.js";
 import { dirname, extname, join, relative, resolve } from "node:path";
 import { createRequire } from "node:module";
 import { Command } from "commander";
@@ -62,16 +63,17 @@ function runInit(opts) {
 
 //#endregion
 //#region src/schema-bundle.ts
-function resolveSchemaDir() {
+function resolveSchemaDir(dirOverride) {
 	if (process.env.ANNA_APP_SCHEMA_DIR) return process.env.ANNA_APP_SCHEMA_DIR;
+	if (dirOverride) return dirOverride;
 	const req = createRequire(import.meta.url);
 	const methodsAbs = req.resolve("@anna-ai/app-schema/methods");
 	return resolve(dirname(methodsAbs), "..");
 }
-function loadSchemaBundle() {
+function loadSchemaBundle(dirOverride) {
 	let dir;
 	try {
-		dir = resolveSchemaDir();
+		dir = resolveSchemaDir(dirOverride);
 	} catch (e) {
 		throw new Error(`Could not locate @anna-ai/app-schema: ${e.message}\nRun \`pnpm install\` (or set ANNA_APP_SCHEMA_DIR to a local checkout).`);
 	}
@@ -137,11 +139,16 @@ function hostApiAllows(manifest, ns, method) {
 	if (!manifest.ui) return false;
 	if (ns === "window") return true;
 	const grants = manifest.ui.host_api ?? {};
+	if (ns === "tools" && (method === "invoke" || method === "list")) {
+		const tools = grants.tools;
+		if (tools && tools.length > 0) return true;
+		const declared = (manifest.required_executas?.length ?? 0) + (manifest.optional_executas?.length ?? 0);
+		return declared > 0;
+	}
 	const methods = grants[ns];
 	if (!methods || methods.length === 0) return false;
 	if (methods.includes("*")) return true;
 	if (methods.includes(method)) return true;
-	if (ns === "tools" && (method === "invoke" || method === "list")) return true;
 	return false;
 }
 function checkHostApiAllowance(usages, manifest, bundleMethods) {
@@ -388,8 +395,10 @@ function readBundleSources(dir) {
 function runValidate(opts) {
 	const errors = [];
 	const warnings = [];
-	const bundle = loadSchemaBundle();
-	console.log(kleur.gray(`[validate] @anna-ai/app-schema dispatcher_version=${bundle.dispatcherVersion}  (${bundle.dir})`));
+	const nexusRoot = findMatrixNexusRoot(opts.matrixNexusRoot, opts.cwd);
+	const schemaOverride = nexusRoot ? nexusSchemaDir(nexusRoot) : null;
+	const bundle = loadSchemaBundle(schemaOverride ?? void 0);
+	console.log(kleur.gray(`[validate] @anna-ai/app-schema dispatcher_version=${bundle.dispatcherVersion}  (${bundle.dir})` + (schemaOverride ? "  [nexus-source]" : "")));
 	const manifest = readManifest(opts.manifestPath);
 	const schemaIssues = validateManifestSchema(bundle, manifest);
 	for (const i of schemaIssues) errors.push(`schema ${i.path}: ${i.message}`);
@@ -448,19 +457,20 @@ program.command("init <dir>").description("Scaffold a new Anna App project").opt
 	});
 	process.exit(code);
 });
-program.command("validate").description("Run schema + ACL checks on a manifest+bundle").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--strict", "Enable strict checks (host_api ACL grep)", false).action(async (opts) => {
+program.command("validate").description("Run schema + ACL checks on a manifest+bundle").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--strict", "Enable strict checks (host_api ACL grep)", false).option("--matrix-nexus-root <path>", "matrix-nexus checkout: validate against its in-tree (possibly unpublished) @anna-ai/app-schema bundle instead of the npm package (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").action(async (opts) => {
 	const cwd = process.cwd();
 	const result = runValidate({
 		cwd,
 		manifestPath: resolve(cwd, opts.manifest),
 		bundleDir: opts.bundle ? resolve(cwd, opts.bundle) : null,
-		strict: opts.strict
+		strict: opts.strict,
+		matrixNexusRoot: opts.matrixNexusRoot
 	});
 	const code = printResult(result);
 	process.exit(code);
 });
 program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").option("--executa <spec>", "Explicit executa registration; repeatable. Spec: comma-separated key=value (dir=<path>[,tool_id=<id>][,type=python|node|go|binary][,command=\"<argv>\"]). When only `dir=` is given, the executa is auto-detected from executa.json / pyproject.toml / package.json / go.mod. Overrides directory auto-discovery under <manifest-dir>/executas/.", (val, prev) => prev ? [...prev, val] : [val]).option("--no-llm", "Disable LLM bridge (anna.llm/agent return llm_disabled)").option("--mock-llm <fixture>", "Serve canned LLM responses from a JSONL fixture").option("--llm-account <host>", "Saved account host to use (default: current)").option("--llm-app-slug <slug>", "Override the manifest slug used to register / look up the dev AnnaApp (default: manifest.slug)").option("--storage <mode>", "Storage backend: \"legacy\" (in-memory runtime_state, default) or \"aps\" (real nexus APS via /api/v1/storage/* — requires `anna-app login`).", "legacy").action(async (opts) => {
-	const { runDev, parseExecutaSpec } = await import("./dev-BS_8yoSm.js");
+	const { runDev, parseExecutaSpec } = await import("./dev-C5r439wM.js");
 	const cwd = opts.cwd ?? process.cwd();
 	let executas;
 	if (opts.executa && opts.executa.length > 0) {
@@ -495,7 +505,7 @@ program.command("dev").description("Run a local harness (in-process dispatcher +
 });
 const fixture = program.command("fixture").description("Inspect / replay harness recordings (Phase 6)");
 fixture.command("verify <file>").description("Schema + invariant checks on a harness JSONL recording").option("--json", "Emit machine-readable JSON", false).action(async (file, opts) => {
-	const { runFixtureVerify } = await import("./fixture-CYwxbiQD.js");
+	const { runFixtureVerify } = await import("./fixture-BvP5umlN.js");
 	const code = await runFixtureVerify({
 		file,
 		json: opts.json
@@ -503,7 +513,7 @@ fixture.command("verify <file>").description("Schema + invariant checks on a har
 	process.exit(code);
 });
 fixture.command("summarize <file>").description("Print a human-readable digest of a harness recording").option("--json", "Emit machine-readable JSON", false).action(async (file, opts) => {
-	const { runFixtureSummarize } = await import("./fixture-CYwxbiQD.js");
+	const { runFixtureSummarize } = await import("./fixture-BvP5umlN.js");
 	const code = await runFixtureSummarize({
 		file,
 		json: opts.json
@@ -511,7 +521,7 @@ fixture.command("summarize <file>").description("Print a human-readable digest o
 	process.exit(code);
 });
 fixture.command("replay <file>").description("Dry-run replay of a harness recording (Phase 6 MVP)").option("--manifest <path>", "manifest.json path", "manifest.json").action(async (file, opts) => {
-	const { runFixtureReplay } = await import("./fixture-CYwxbiQD.js");
+	const { runFixtureReplay } = await import("./fixture-BvP5umlN.js");
 	const code = await runFixtureReplay({
 		file,
 		manifest: opts.manifest
@@ -519,12 +529,12 @@ fixture.command("replay <file>").description("Dry-run replay of a harness record
 	process.exit(code);
 });
 program.command("doctor").description("Check environment for `anna-app dev` (uv, matrix-nexus, dev key)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (optional)").action(async (opts) => {
-	const { runDoctor } = await import("./doctor-DKrt-Kda.js");
+	const { runDoctor } = await import("./doctor-giNqYnla.js");
 	const code = await runDoctor({ matrixNexusRoot: opts.matrixNexusRoot });
 	process.exit(code);
 });
 program.command("login").description("Device-flow login against a nexus host; saves a PAT to ~/.config/anna/credentials.json").requiredOption("--host <url>", "nexus base URL, e.g. https://nexus.example.com").option("--no-browser", "Do not open a browser window automatically", false).action(async (opts) => {
-	const { runLogin } = await import("./login-BGqFjQwH.js");
+	const { runLogin } = await import("./login-BGZjMAlh.js");
 	const code = await runLogin({
 		host: opts.host,
 		noBrowser: opts.browser === false
@@ -532,7 +542,7 @@ program.command("login").description("Device-flow login against a nexus host; sa
 	process.exit(code);
 });
 program.command("logout").description("Remove a saved PAT entry").option("--host <url>", "Account to remove (default: current)").option("--all", "Remove every saved account", false).action(async (opts) => {
-	const { runLogout } = await import("./logout-CGIRKH3y.js");
+	const { runLogout } = await import("./logout-mh2_QlyM.js");
 	const code = await runLogout({
 		host: opts.host,
 		all: opts.all
@@ -540,7 +550,7 @@ program.command("logout").description("Remove a saved PAT entry").option("--host
 	process.exit(code);
 });
 program.command("whoami").description("Show the current account (and any others)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runWhoami } = await import("./whoami-BoFLEUcp.js");
+	const { runWhoami } = await import("./whoami-l_kIkfbI.js");
 	const code = await runWhoami({ json: opts.json });
 	process.exit(code);
 });
@@ -556,7 +566,7 @@ executa.command("init <dir>").description("Scaffold a standalone Executa plugin
 		console.error(`✗ unknown template "${opts.template}" — expected python | node | go`);
 		process.exit(2);
 	}
-	const { runExecutaInit } = await import("./executa-init-Jp-h9OI7.js");
+	const { runExecutaInit } = await import("./executa-init-DXea7yRN.js");
 	const code = runExecutaInit({
 		targetDir: dir,
 		slug,
@@ -566,13 +576,24 @@ executa.command("init <dir>").description("Scaffold a standalone Executa plugin
 	});
 	process.exit(code);
 });
-executa.command("register").description("Register a HARNESS AnnaApp(kind=executa) so `executa dev --storage real` (and agent / sampling / image / upload real-mode flows) can mint tokens for a local executa subprocess. Does NOT publish the executa itself — use `executa publish` for that. Lists/deletes via `apps list` / `apps delete`.").requiredOption("--tool-id <id>", "Executa tool_id (matches manifest.name)").option("--slug <slug>", "App slug (default: executa-<tool_id>; must be lowercase + hyphens)").option("--name <name>", "Human-readable display name (default: <tool_id>)").option("--account <host>", "Saved account host (default: current)").action(async (opts) => {
-	const { runExecutaRegister } = await import("./executa-register-CulDtwYZ.js");
+executa.command("register").description("Register a HARNESS AnnaApp(kind=executa) so `executa dev --storage real` (and agent / sampling / image / upload real-mode flows) can mint tokens for a local executa subprocess. Does NOT publish the executa itself — use `executa publish` for that. Lists/deletes via `apps list` / `apps delete`.").requiredOption("--tool-id <id>", "Executa tool_id (matches executa.json tool_id / executable_name)").option("--slug <slug>", "App slug (default: executa-<tool_id>; must be lowercase + hyphens)").option("--name <name>", "Human-readable display name (default: <tool_id>)").option("--account <host>", "Saved account host (default: current)").action(async (opts) => {
+	const { runExecutaRegister } = await import("./executa-register-BUiPzPIU.js");
 	const code = await runExecutaRegister(opts);
 	process.exit(code);
 });
+executa.command("install").description("Install a local-dev shim for an Executa under its minted tool_id so the Agent can discover it via 'Rediscover Local' (for distribution_type: local). Resolves the tool_id from .anna/executa.json (written by `executa publish` / `apps push`) unless --tool-id is given.").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Install the shim under this exact id (default: minted id from .anna/executa.json, else executa.json tool_id)").option("--bin-dir <path>", "Install dir for the shim (default: ~/.anna/executa/bin)").option("--force", "Overwrite an existing shim of the same name", false).option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	const { runExecutaInstall } = await import("./executa-install-DjXE_-U-.js");
+	const code = await runExecutaInstall({
+		dir: opts.dir,
+		toolId: opts.toolId,
+		binDir: opts.binDir,
+		force: opts.force,
+		json: opts.json
+	});
+	process.exit(code);
+});
 executa.command("dev").description("Run one Executa plugin in isolation (REPL or one-shot describe/invoke)").option("--dir <path>", "Executa project dir (default: CWD)").option("--spec <spec>", "Override discovery: comma-separated key=value (tool_id=...,type=...,command=\"...\")").option("--describe", "Print MANIFEST and exit", false).option("--health", "Print health and exit", false).option("--invoke <tool>", "Invoke one tool and exit").option("--args <json>", "JSON object passed as tool arguments", "{}").option("--json", "One-shot: emit compact JSON (no banners)", false).option("--no-sampling", "Hard-disable sampling reverse RPC (returns sampling_disabled)").option("--mock-sampling <fixture>", "Serve canned sampling responses from a JSONL fixture (offline)").option("--app-slug <slug>", "Forward sampling to nexus on behalf of this dev AnnaApp slug").option("--sampling-account <host>", "Saved account host for nexus sampling (default: current)").option("--no-agent", "Hard-disable agent reverse RPC (returns agent_not_granted)").option("--mock-agent <fixture>", "Serve canned agent/* responses from a JSONL fixture (offline)").option("--agent-account <host>", "Saved account host for nexus agent (default: --sampling-account or current)").option("--storage <mode>", "Storage backend: off | memory | mock | real (default: memory)").option("--mock-storage <fixture>", "Serve canned storage/* + files/* responses from a JSONL fixture").option("--storage-account <host>", "Saved account host for nexus storage (default: --sampling-account or current)").option("--storage-scopes <list>", "Comma-separated scopes for real storage tokens (default: user,app,tool)").option("--no-image", "Hard-disable image reverse RPC (returns image_not_granted)").option("--mock-image <fixture>", "Serve canned image/generate + image/edit responses from a JSONL fixture").option("--image-account <host>", "Saved account host for nexus image (default: --sampling-account or current)").option("--no-upload", "Hard-disable host/uploadFile reverse RPC (returns upload_not_granted)").option("--mock-upload <fixture>", "Serve canned host/uploadFile responses from a JSONL fixture").option("--upload-account <host>", "Saved account host for nexus uploads (default: --sampling-account or current)").action(async (opts) => {
-	const { runExecutaDev } = await import("./executa-dev-BvS9zTpO.js");
+	const { runExecutaDev } = await import("./executa-dev-Cr9Yepph.js");
 	const storageMode = opts.storage === void 0 ? void 0 : (() => {
 		const m = opts.storage;
 		if (m === "off" || m === "memory" || m === "mock" || m === "real") return m;
@@ -609,7 +630,7 @@ executa.command("dev").description("Run one Executa plugin in isolation (REPL or
 });
 const apps = program.command("apps").description("Anna App publish lifecycle commands");
 apps.command("list").description("List the Anna Apps you authored, with lifecycle status").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsList } = await import("./apps-BTn9EN0x.js");
+	const { runAppsList } = await import("./apps-3VcdHIBK.js");
 	process.exit(await runAppsList({
 		account: opts.account,
 		json: opts.json
@@ -624,7 +645,7 @@ apps.command("publish").description("Publish or update an Anna App (manifest.jso
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runAppsPublish } = await import("./apps-publish-DfZTOxBJ.js");
+	const { runAppsPublish } = await import("./apps-publish-Do7M5je3.js");
 	process.exit(await runAppsPublish({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -640,7 +661,7 @@ apps.command("publish").description("Publish or update an Anna App (manifest.jso
 		json: opts.json
 	}));
 });
-apps.command("push").description("Upsert the mutable working draft (manifest + bundle, no freeze)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--dry-run", "Resolve identity + diff but don't upsert", false).option("--executa-id <handle=id>", "Override a bundled executa handle with a real tool_id (repeatable)", (val, prev) => [...prev, val], []).option("--skip-executa-publish", "Use cached/overridden tool_ids; don't recursively register bundled executas", false).option("--no-bundled-executas", "Disable bundled-executa orchestration (legacy behaviour)").option("--no-bundle", "Skip working UI bundle upload even if the manifest declares a UI").option("--bundle-dir <dir>", "UI bundle directory (default: <cwd>/bundle)").option("--if-match <revision>", "Optimistic-lock: require this working revision").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+apps.command("push").description("Upsert the mutable working draft (manifest + bundle, no freeze)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--dry-run", "Resolve identity + diff but don't upsert", false).option("--executa-id <handle=id>", "Override a bundled executa handle with a real tool_id (repeatable)", (val, prev) => [...prev, val], []).option("--skip-executa-publish", "Use cached/overridden tool_ids; don't recursively register bundled executas", false).option("--no-bundled-executas", "Disable bundled-executa orchestration (legacy behaviour)").option("--no-bundle", "Skip working UI bundle upload even if the manifest declares a UI").option("--bundle-dir <dir>", "UI bundle directory (default: <cwd>/bundle)").option("--no-install-local", "Don't install local-dev shims for bundled `local` executas (skip Rediscover-Local prep)").option("--if-match <revision>", "Optimistic-lock: require this working revision").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
 	if (opts.bump && ![
 		"patch",
 		"minor",
@@ -657,7 +678,7 @@ apps.command("push").description("Upsert the mutable working draft (manifest + b
 			process.exit(2);
 		}
 	}
-	const { runAppsPush } = await import("./apps-push-B9XT2uwF.js");
+	const { runAppsPush } = await import("./apps-push-CixatuQG.js");
 	process.exit(await runAppsPush({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -669,13 +690,14 @@ apps.command("push").description("Upsert the mutable working draft (manifest + b
 		noBundledExecutas: opts.bundledExecutas === false,
 		noBundle: opts.bundle === false,
 		bundleDir: opts.bundleDir,
+		noInstallLocal: opts.installLocal === false,
 		ifMatch,
 		account: opts.account,
 		json: opts.json
 	}));
 });
 apps.command("cut <version>").description("Snapshot the working draft into an immutable version (freeze deps)").option("--changelog <text>", "Override the working draft changelog for this version").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't cut", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
-	const { runAppsCut } = await import("./apps-cut-DtEkddIk.js");
+	const { runAppsCut } = await import("./apps-cut-BCicQFRY.js");
 	process.exit(await runAppsCut({
 		version,
 		changelog: opts.changelog,
@@ -687,7 +709,7 @@ apps.command("cut <version>").description("Snapshot the working draft into an im
 	}));
 });
 apps.command("discard").description("Drop the mutable working draft (leaves cut versions intact)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't discard", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsDiscard } = await import("./apps-discard-y3_IwcbQ.js");
+	const { runAppsDiscard } = await import("./apps-discard-BoY4zMJw.js");
 	process.exit(await runAppsDiscard({
 		slug: opts.slug,
 		cwd: opts.cwd,
@@ -697,7 +719,7 @@ apps.command("discard").description("Drop the mutable working draft (leaves cut
 	}));
 });
 apps.command("release <version>").description("Freeze & publish an existing remote version (go live)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--allow-create", "If the version isn't on the server, run 'apps publish' first, then release", false).option("--dry-run", "Resolve target + pre-flight but don't publish", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
-	const { runAppsRelease } = await import("./apps-release-BLH9XSxB.js");
+	const { runAppsRelease } = await import("./apps-release-DJFG4BV3.js");
 	process.exit(await runAppsRelease({
 		version,
 		slug: opts.slug,
@@ -709,7 +731,7 @@ apps.command("release <version>").description("Freeze & publish an existing remo
 	}));
 });
 apps.command("sync-meta").description("Push mutable store metadata (name/tagline/…) from the manifest").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--dry-run", "Print the metadata diff but don't PATCH", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsSyncMeta } = await import("./apps-sync-meta-D9eKMMUp.js");
+	const { runAppsSyncMeta } = await import("./apps-sync-meta-CQQC_Heb.js");
 	process.exit(await runAppsSyncMeta({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -719,7 +741,7 @@ apps.command("sync-meta").description("Push mutable store metadata (name/tagline
 	}));
 });
 apps.command("submit-review [slug]").description("Move an app into review (DRAFT/REJECTED → PENDING_REVIEW)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsSubmitReview } = await import("./apps-submit-review-DLwCxeAs.js");
+	const { runAppsSubmitReview } = await import("./apps-submit-review-BVmZlhmB.js");
 	process.exit(await runAppsSubmitReview({
 		slug,
 		cwd: opts.cwd,
@@ -728,7 +750,7 @@ apps.command("submit-review [slug]").description("Move an app into review (DRAFT
 	}));
 });
 apps.command("status <slug>").description("Show server-known state for one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsStatus } = await import("./apps-status-DQ9RvlME.js");
+	const { runAppsStatus } = await import("./apps-status-F6aVlzDW.js");
 	process.exit(await runAppsStatus({
 		slug,
 		account: opts.account,
@@ -736,7 +758,7 @@ apps.command("status <slug>").description("Show server-known state for one Anna
 	}));
 });
 apps.command("versions <slug>").description("List all server versions of one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsVersions } = await import("./apps-versions-2Tmk0nsx.js");
+	const { runAppsVersions } = await import("./apps-versions-BIKsJzIT.js");
 	process.exit(await runAppsVersions({
 		slug,
 		account: opts.account,
@@ -744,7 +766,7 @@ apps.command("versions <slug>").description("List all server versions of one Ann
 	}));
 });
 apps.command("grants <slug>").description("Show currently granted scopes/quota for one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsGrants } = await import("./apps-grants-BGWlpee0.js");
+	const { runAppsGrants } = await import("./apps-grants-DgvymPBT.js");
 	process.exit(await runAppsGrants({
 		slug,
 		account: opts.account,
@@ -752,7 +774,7 @@ apps.command("grants <slug>").description("Show currently granted scopes/quota f
 	}));
 });
 apps.command("unpublish <slug>").description("Flip a PUBLISHED app back to APPROVED (private)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsUnpublish } = await import("./apps-destructive-DSTrcFUP.js");
+	const { runAppsUnpublish } = await import("./apps-destructive-DWF4eTHn.js");
 	process.exit(await runAppsUnpublish({
 		slug,
 		yes: opts.yes,
@@ -762,7 +784,7 @@ apps.command("unpublish <slug>").description("Flip a PUBLISHED app back to APPRO
 	}));
 });
 apps.command("archive <slug>").description("Archive an Anna App (hides it from end users)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsArchive } = await import("./apps-destructive-DSTrcFUP.js");
+	const { runAppsArchive } = await import("./apps-destructive-DWF4eTHn.js");
 	process.exit(await runAppsArchive({
 		slug,
 		yes: opts.yes,
@@ -772,7 +794,7 @@ apps.command("archive <slug>").description("Archive an Anna App (hides it from e
 	}));
 });
 apps.command("unarchive <slug>").description("Restore an archived Anna App back to APPROVED").option("--yes", "Acknowledge the operation", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsUnarchive } = await import("./apps-destructive-DSTrcFUP.js");
+	const { runAppsUnarchive } = await import("./apps-destructive-DWF4eTHn.js");
 	process.exit(await runAppsUnarchive({
 		slug,
 		yes: opts.yes,
@@ -781,7 +803,7 @@ apps.command("unarchive <slug>").description("Restore an archived Anna App back
 	}));
 });
 apps.command("delete <slug>").description("Hard-delete an Anna App (refused by server if installs exist)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsDelete } = await import("./apps-destructive-DSTrcFUP.js");
+	const { runAppsDelete } = await import("./apps-destructive-DWF4eTHn.js");
 	process.exit(await runAppsDelete({
 		slug,
 		yes: opts.yes,
@@ -791,14 +813,14 @@ apps.command("delete <slug>").description("Hard-delete an Anna App (refused by s
 	}));
 });
 executa.command("list").description("List Executas owned by the current PAT").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaList } = await import("./executa-reads-CQ6S8gHY.js");
+	const { runExecutaList } = await import("./executa-reads-CjGZq1yP.js");
 	process.exit(await runExecutaList({
 		account: opts.account,
 		json: opts.json
 	}));
 });
 executa.command("status <ref>").description("Show server-known state for one Executa (slug or tool_id)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
-	const { runExecutaStatus } = await import("./executa-reads-CQ6S8gHY.js");
+	const { runExecutaStatus } = await import("./executa-reads-CjGZq1yP.js");
 	process.exit(await runExecutaStatus({
 		ref,
 		account: opts.account,
@@ -806,7 +828,7 @@ executa.command("status <ref>").description("Show server-known state for one Exe
 	}));
 });
 executa.command("versions <ref>").description("List immutable version snapshots for one Executa").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
-	const { runExecutaVersions } = await import("./executa-reads-CQ6S8gHY.js");
+	const { runExecutaVersions } = await import("./executa-reads-CjGZq1yP.js");
 	process.exit(await runExecutaVersions({
 		ref,
 		account: opts.account,
@@ -822,7 +844,7 @@ executa.command("publish").description("Mint or update an Executa (executa.json
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runExecutaPublish } = await import("./executa-publish-B88_9gbp.js");
+	const { runExecutaPublish } = await import("./executa-publish-IXWSwva0.js");
 	process.exit(await runExecutaPublish({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -835,7 +857,7 @@ executa.command("publish").description("Mint or update an Executa (executa.json
 	}));
 });
 executa.command("unpublish <slug>").description("Flip an Executa's visibility back to private").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runExecutaUnpublish } = await import("./executa-destructive-COQE4Xqi.js");
+	const { runExecutaUnpublish } = await import("./executa-destructive-PL2ooHpZ.js");
 	process.exit(await runExecutaUnpublish({
 		slug,
 		yes: opts.yes,
@@ -845,7 +867,7 @@ executa.command("unpublish <slug>").description("Flip an Executa's visibility ba
 	}));
 });
 executa.command("yank <ref>").description("Hard-delete one Executa version (<slug>@<version>)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
-	const { runExecutaYank } = await import("./executa-destructive-COQE4Xqi.js");
+	const { runExecutaYank } = await import("./executa-destructive-PL2ooHpZ.js");
 	process.exit(await runExecutaYank({
 		ref,
 		yes: opts.yes,
@@ -855,7 +877,7 @@ executa.command("yank <ref>").description("Hard-delete one Executa version (<slu
 	}));
 });
 executa.command("delete <slug>").description("Hard-delete an Executa").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runExecutaDelete } = await import("./executa-destructive-COQE4Xqi.js");
+	const { runExecutaDelete } = await import("./executa-destructive-PL2ooHpZ.js");
 	process.exit(await runExecutaDelete({
 		slug,
 		yes: opts.yes,
@@ -867,7 +889,7 @@ executa.command("delete <slug>").description("Hard-delete an Executa").option("-
 executa.command("cache-clear").description("Delete the local `.anna/executa.json` identity cache. Use after the server-side Executa has been deleted/recreated, or when switching host. Next `executa publish` will re-mint via the idempotency key.").option("--cwd <dir>", "Project root (default: cwd)").action(async (opts) => {
 	const { resolve: resolve$1 } = await import("node:path");
 	const { existsSync: existsSync$1 } = await import("node:fs");
-	const { executaCachePath, invalidateExecutaCache } = await import("./executa-cache-WBkCLic7.js");
+	const { executaCachePath, invalidateExecutaCache } = await import("./executa-cache-Kx3rfQD-.js");
 	const cwd = resolve$1(opts.cwd ?? process.cwd());
 	const p = executaCachePath(cwd);
 	if (!existsSync$1(p)) {
@@ -880,7 +902,7 @@ executa.command("cache-clear").description("Delete the local `.anna/executa.json
 });
 const token = program.command("token").description("Manage developer PATs (list / revoke / scopes)");
 token.command("list").description("List the caller's PATs (most-recent first)").option("--include-revoked", "Also show revoked PATs", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runTokenList } = await import("./token-B9JUPelx.js");
+	const { runTokenList } = await import("./token-Cg7BZGp6.js");
 	process.exit(await runTokenList({
 		includeRevoked: opts.includeRevoked,
 		account: opts.account,
@@ -893,7 +915,7 @@ token.command("revoke <id>").description("Revoke one of the caller's PATs by id"
 		console.error(`✗ token id must be a positive integer (got: ${id})`);
 		process.exit(2);
 	}
-	const { runTokenRevoke } = await import("./token-B9JUPelx.js");
+	const { runTokenRevoke } = await import("./token-Cg7BZGp6.js");
 	process.exit(await runTokenRevoke({
 		id: idNum,
 		account: opts.account,
@@ -901,7 +923,7 @@ token.command("revoke <id>").description("Revoke one of the caller's PATs by id"
 	}));
 });
 token.command("scopes").description("Print the available PAT scope catalogue").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runTokenScopes } = await import("./token-B9JUPelx.js");
+	const { runTokenScopes } = await import("./token-Cg7BZGp6.js");
 	process.exit(await runTokenScopes({
 		account: opts.account,
 		json: opts.json
@@ -916,7 +938,7 @@ program.command("publish").description("Auto-detect cwd and publish (apps publis
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runTopLevelPublish } = await import("./publish-C1wcf-qI.js");
+	const { runTopLevelPublish } = await import("./publish-BYWuujP3.js");
 	process.exit(await runTopLevelPublish({
 		cwd: opts.cwd,
 		bump: opts.bump,

package/dist/{confirm-DxHkk9Wn.js → confirm-h_qMrx0I.js}

@@ -1,4 +1,4 @@
-import { CliError } from "./client-Dn9zThOd.js";
+import { CliError } from "./client-D-_z1ALk.js";
 import { yellow } from "kleur/colors";
 import { createInterface } from "node:readline/promises";
 

package/dist/{dev-E7mqXj5S.js → dev-3okZmzNM.js}

@@ -1,3 +1,4 @@
+import { findMatrixNexusRoot, nexusSchemaDir } from "./nexus-root-BlPwOusj.js";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
@@ -31,6 +32,11 @@ async function runDev(opts) {
 	}
 	const matrixNexusRoot = await resolveMatrixNexusRoot(opts.matrixNexusRoot, cwd);
 	const mode = matrixNexusRoot ? "nexus-source" : "uvx";
+	let schemaSource = null;
+	if (matrixNexusRoot && !process.env.ANNA_APP_SCHEMA_DIR) {
+		schemaSource = nexusSchemaDir(matrixNexusRoot);
+		if (schemaSource) process.env.ANNA_APP_SCHEMA_DIR = schemaSource;
+	}
 	const storageMode = opts.storageMode === "aps" ? "aps" : "legacy";
 	if (opts.storageMode && opts.storageMode !== "legacy" && opts.storageMode !== "aps") {
 		console.error(red(`✗ --storage must be "legacy" or "aps", got "${opts.storageMode}"`));
@@ -43,8 +49,8 @@ async function runDev(opts) {
 		}
 		process.env.ANNA_APP_RUNTIME_STORAGE_MODE = "aps";
 	}
-	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-Id8K8gr-.js");
-	const { HarnessServer } = await import("./server-_IG8Igje.js");
+	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-hzqNFm9-.js");
+	const { HarnessServer } = await import("./server-Cp7mYV9t.js");
 	const bridge = new PythonBridge({
 		mode,
 		matrixNexusRoot: matrixNexusRoot ?? void 0,
@@ -56,7 +62,12 @@ async function runDev(opts) {
 	if (mode === "nexus-source") {
 		console.log(`  matrix-nexus root ${dim(matrixNexusRoot)}`);
 		console.log(`  runtime           ${dim("nexus-source (uv run)")}`);
-	} else console.log(`  runtime           ${dim(`uvx anna-app-runtime-local@${PINNED_RUNTIME_VERSION}`)}`);
+		console.log(`  browser sdk       ${dim("in-tree packages/anna-app-runtime/dist")}`);
+		console.log(`  schema            ${dim(schemaSource ? "in-tree packages/anna-app-schema" : process.env.ANNA_APP_SCHEMA_DIR ? `override ${process.env.ANNA_APP_SCHEMA_DIR}` : "npm @anna-ai/app-schema")}`);
+	} else {
+		console.log(`  runtime           ${dim(`uvx anna-app-runtime-local@${PINNED_RUNTIME_VERSION}`)}`);
+		console.log(`  browser sdk       ${dim("npm @anna-ai/app-runtime")}`);
+	}
 	console.log(`  spawning python bridge…`);
 	try {
 		await bridge.start();
@@ -79,7 +90,7 @@ async function runDev(opts) {
 	if (executas.length > 0) console.log(`  executas          ${dim(executas.map((e) => e.tool_id).join(", "))}`);
 	const bundledResolved = resolveBundledHandles(dirname(manifestPath), executas);
 	if (Object.keys(bundledResolved).length > 0) {
-		const { substituteBundledRefs, writeBundleToolIdSidecar } = await import("./bundled-executas-CNaV2C_O.js");
+		const { substituteBundledRefs, writeBundleToolIdSidecar } = await import("./bundled-executas-DeBhDjd8.js");
 		try {
 			manifest = substituteBundledRefs(manifest, bundledResolved);
 			writeBundleToolIdSidecar(bundleDir, bundledResolved);
@@ -149,8 +160,8 @@ async function runDev(opts) {
 * registered `appSlug`.
 */
 async function resolveRealLlm(args) {
-	const { getAccount } = await import("./credentials-DklPMD22.js");
-	const { ensureDevAppRegistered } = await import("./dev-app-cache-D-r6ZpEk.js");
+	const { getAccount } = await import("./credentials-Chkoidh5.js");
+	const { ensureDevAppRegistered } = await import("./dev-app-cache-TSjL4D4n.js");
 	const acc = getAccount(args.account);
 	if (!acc) {
 		console.error(red("✗ no developer PAT on disk — run `anna-app login --host <nexus-url>` first.\n  (or use `--no-llm` / `--mock-llm <fixture>` to develop offline.)"));
@@ -179,7 +190,7 @@ async function resolveRealLlm(args) {
 			account: args.account,
 			appSlug: entry.slug,
 			onAppSlugNotFound: async () => {
-				const { invalidateDevAppCache } = await import("./dev-app-cache-D-r6ZpEk.js");
+				const { invalidateDevAppCache } = await import("./dev-app-cache-TSjL4D4n.js");
 				invalidateDevAppCache(args.cwd);
 				const fresh = getAccount(args.account);
 				if (!fresh) throw new Error("PAT not found while re-registering dev app — run `anna-app login` again");
@@ -486,21 +497,7 @@ function parseExecutaSpec(spec, cwd) {
 	};
 }
 async function resolveMatrixNexusRoot(explicit, cwd) {
-	const candidates = [explicit, process.env.ANNA_NEXUS_ROOT];
-	let dir = cwd;
-	while (true) {
-		candidates.push(dir);
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	candidates.push(resolve(cwd, "..", "matrix-nexus"));
-	for (const c of candidates) {
-		if (!c) continue;
-		const abs = isAbsolute(c) ? c : resolve(cwd, c);
-		if (existsSync(resolve(abs, "packages/anna-app-runtime-local/pyproject.toml"))) return abs;
-	}
-	return null;
+	return findMatrixNexusRoot(explicit, cwd);
 }
 
 //#endregion

package/dist/dev-C5r439wM.js

@@ -0,0 +1,4 @@
+import "./nexus-root-BlPwOusj.js";
+import { parseExecutaSpec, runDev } from "./dev-3okZmzNM.js";
+
+export { parseExecutaSpec, runDev };

package/dist/{doctor-DKrt-Kda.js → doctor-giNqYnla.js}

@@ -1,5 +1,6 @@
-import { PINNED_RUNTIME_VERSION } from "./bridge-BuklhzeE.js";
-import { dirname, isAbsolute, resolve } from "node:path";
+import { findMatrixNexusRoot, nexusSchemaDir } from "./nexus-root-BlPwOusj.js";
+import { PINNED_RUNTIME_VERSION } from "./bridge-DxBd0Fl9.js";
+import { resolve } from "node:path";
 import { existsSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { bold, dim, green, red, yellow } from "kleur/colors";
@@ -26,9 +27,13 @@ async function runDoctor(opts) {
 			console.log(dim(`    first 'anna-app dev' will install via 'uvx anna-app-runtime-local@${PINNED_RUNTIME_VERSION}' (one-time)`));
 		}
 	}
-	const nexus = await resolveNexusRoot(opts.matrixNexusRoot, process.cwd());
-	if (nexus) console.log(`  ${green("✓")} nexus   ${dim(nexus)} ${dim("(contributor mode)")}`);
-	else console.log(`  ${yellow("·")} nexus   ${dim("not found")} ${dim("(uvx mode will be used)")}`);
+	const nexus = findMatrixNexusRoot(opts.matrixNexusRoot, process.cwd());
+	if (nexus) {
+		console.log(`  ${green("✓")} nexus   ${dim(nexus)} ${dim("(contributor mode)")}`);
+		const schemaDir = nexusSchemaDir(nexus);
+		if (schemaDir) console.log(`  ${green("✓")} schema  ${dim(schemaDir)} ${dim("(in-tree; used by dev/validate)")}`);
+		else console.log(`  ${yellow("·")} schema  ${yellow("in-tree packages/anna-app-schema not found")} ${dim("(npm bundle will be used)")}`);
+	} else console.log(`  ${yellow("·")} nexus   ${dim("not found")} ${dim("(uvx mode will be used)")}`);
 	const keyPath = resolve(homedir(), ".anna-app", "dev.key");
 	if (!existsSync(keyPath)) console.log(`  ${yellow("·")} key     ${dim(keyPath)} ${yellow("(missing — will be auto-created on first run)")}`);
 	else {
@@ -47,23 +52,6 @@ async function runDoctor(opts) {
 	console.log(red(`\n  ${failed} required check(s) failed`));
 	return 1;
 }
-async function resolveNexusRoot(explicit, cwd) {
-	const candidates = [explicit, process.env.ANNA_NEXUS_ROOT];
-	let dir = cwd;
-	while (true) {
-		candidates.push(dir);
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	candidates.push(resolve(cwd, "..", "matrix-nexus"));
-	for (const c of candidates) {
-		if (!c) continue;
-		const abs = isAbsolute(c) ? c : resolve(cwd, c);
-		if (existsSync(resolve(abs, "packages/anna-app-runtime-local/pyproject.toml"))) return abs;
-	}
-	return null;
-}
 
 //#endregion
 export { runDoctor };

package/dist/{executa-cache-WBkCLic7.js → executa-cache-Kx3rfQD-.js}

@@ -1,4 +1,4 @@
 import "./credentials-BTv2IfUZ.js";
-import { executaCacheMatches, executaCachePath, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
+import { executaCacheMatches, executaCachePath, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-CXiEgFZY.js";
 
 export { executaCachePath, invalidateExecutaCache };

package/dist/{executa-destructive-COQE4Xqi.js → executa-destructive-PL2ooHpZ.js}

@@ -1,8 +1,8 @@
 import "./credentials-BTv2IfUZ.js";
-import { CliError } from "./client-Dn9zThOd.js";
-import { deleteMyTool, listMyTools, listToolVersions, unpublishTool, yankToolVersion } from "./executas-Cep6KEo0.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-sbea9HtH.js";
-import { ensureDestructiveAllowed } from "./confirm-DxHkk9Wn.js";
+import { CliError } from "./client-D-_z1ALk.js";
+import { deleteMyTool, listMyTools, listToolVersions, unpublishTool, yankToolVersion } from "./executas-CK3er6f9.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-BpSOfVCP.js";
+import { ensureDestructiveAllowed } from "./confirm-h_qMrx0I.js";
 import { dim, green, yellow } from "kleur/colors";
 
 //#region src/commands/executa-destructive.ts