@anna-ai/cli 0.1.32 → 0.1.34

package/dist/{executa-publish-Ah6J7jYd.js → executa-publish-CGz5wM1Q.js}

@@ -1,9 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-BhFed1B-.js";
-import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-Do1D7xC0.js";
-import { loadExecutaManifest } from "./manifest-DOMrcdCK.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
+import { loadExecutaManifest } from "./manifest-DlIcwLQs.js";
+import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-CvQY_w2U.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-Do5Sq64E.js";
 import { join, relative, resolve, sep } from "node:path";
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
@@ -206,6 +207,21 @@ async function runExecutaPublish(opts) {
 			description: manifest.description,
 			...distributionPayload(manifest.distribution)
 		});
+		if (!isSkill && manifest.distribution?.binaryArtifacts && opts.freeze !== false) {
+			const upLog = (msg) => {
+				if (!opts.json && !opts.quiet) console.log(msg);
+			};
+			const up = await uploadExecutaBinaries({
+				client,
+				host,
+				dir: cwd,
+				manifest,
+				toolId,
+				log: upLog
+			});
+			upLog(green(`✓ binary artifacts published `) + dim(`(${up.uploaded.length} uploaded, ${up.skipped.length} cached)`));
+		}
+		if (!isSkill && manifest.distribution?.type === "binary" && manifest.distribution?.binaryUrls && !opts.json && !opts.quiet) console.log(yellow("! distribution.binary_urls uses the pull-mirror track: the platform fetches these URLs at cut/release, which requires them to be PUBLICLY downloadable. Private source URLs are deprecated — switch to distribution.binary_artifacts (direct upload) if this source is (or may become) private."));
 		const preFreeze = isSkill ? await getMySkill(client, executaId) : await getMyTool(client, executaId);
 		const currentVis = preFreeze.visibility ?? "private";
 		const targetVis = opts.publish ? "public" : currentVis === "public" ? "public" : "app_bundled";

package/dist/executa-publish-DHICU6S0.js

@@ -0,0 +1,11 @@
+import "./credentials-BTv2IfUZ.js";
+import "./client-D-_z1ALk.js";
+import "./_lifecycle-shared-RyiRITI5.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./manifest-DlIcwLQs.js";
+import "./executas-CvQY_w2U.js";
+import { runExecutaPublish } from "./executa-publish-CGz5wM1Q.js";
+import "./binary-upload-CKMU5Rfw.js";
+import "./executa-upload-binaries-Do5Sq64E.js";
+
+export { runExecutaPublish };

package/dist/{executa-reads-BXDJWWw6.js → executa-reads-BmwT_Yjp.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import { getMyTool, listMyTools, listToolVersions } from "./executas-BhFed1B-.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { getMyTool, listMyTools, listToolVersions } from "./executas-CvQY_w2U.js";
 import { bold, cyan, dim, green } from "kleur/colors";
 
 //#region src/commands/executa-reads.ts

package/dist/executa-trusted-publisher-tVwzjI2d.js

@@ -0,0 +1,91 @@
+import { canonicalHost } from "./credentials-BTv2IfUZ.js";
+import { CliError } from "./client-D-_z1ALk.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
+import { addTrustedPublisher, listTrustedPublishers, removeTrustedPublisher } from "./binary-upload-CKMU5Rfw.js";
+import { resolve } from "node:path";
+import { bold, cyan, dim, green } from "kleur/colors";
+
+//#region src/commands/executa-trusted-publisher.ts
+function resolveToolId(opts, host) {
+	if (opts.toolId) return opts.toolId;
+	const dir = resolve(opts.dir ?? process.cwd());
+	const identity = readExecutaIdentity(dir);
+	if (!identity) throw new CliError(`no .anna/executa.json identity cache in ${dir} — run \`anna-app executa publish\` / \`anna-app apps push\` once, or pass --tool-id`, 4);
+	if (identity.host !== canonicalHost(host)) throw new CliError(`identity cache in ${dir} belongs to ${identity.host}, but the current PAT targets ${canonicalHost(host)} — use --account or pass --tool-id`, 4);
+	return identity.tool_id;
+}
+function setup(opts) {
+	const { client, host } = resolveClient({
+		account: opts.account,
+		fetchImpl: opts.fetchImpl
+	});
+	return {
+		client,
+		host,
+		toolId: resolveToolId(opts, host)
+	};
+}
+function printPublisher(p) {
+	console.log(`  #${p.id} ${bold(p.repository)} ${cyan(p.workflow)}` + (p.environment ? dim(` env=${p.environment}`) : dim(" env=(any)")) + (p.last_used_at ? dim(` last used ${p.last_used_at}`) : dim(" never used")));
+}
+async function runTrustedPublisherAdd(opts) {
+	return withErrorHandling(async () => {
+		if (!/^[^/\s]+\/[^/\s]+$/.test(opts.repository)) throw new CliError(`--repository must be "owner/repo" (got "${opts.repository}")`, 2);
+		const { client, toolId } = setup(opts);
+		const created = await addTrustedPublisher(client, toolId, {
+			repository: opts.repository,
+			workflow: opts.workflow,
+			environment: opts.environment
+		});
+		if (opts.json) {
+			console.log(JSON.stringify({
+				tool_id: toolId,
+				trusted_publisher: created
+			}, null, 2));
+			return 0;
+		}
+		console.log(green(`✓ trusted publisher registered for ${toolId}:`));
+		printPublisher(created);
+		console.log(dim("→ that workflow can now run ") + cyan("anna-app executa upload-binaries --oidc") + dim(" with `permissions: id-token: write` and no PAT"));
+		return 0;
+	});
+}
+async function runTrustedPublisherList(opts) {
+	return withErrorHandling(async () => {
+		const { client, toolId } = setup(opts);
+		const rows = await listTrustedPublishers(client, toolId);
+		if (opts.json) {
+			console.log(JSON.stringify({
+				tool_id: toolId,
+				trusted_publishers: rows
+			}, null, 2));
+			return 0;
+		}
+		if (rows.length === 0) {
+			console.log(dim(`(no trusted publishers registered for ${toolId})`));
+			return 0;
+		}
+		console.log(bold(`trusted publishers for ${toolId}:`));
+		for (const p of rows) printPublisher(p);
+		return 0;
+	});
+}
+async function runTrustedPublisherRemove(opts) {
+	return withErrorHandling(async () => {
+		const { client, toolId } = setup(opts);
+		await removeTrustedPublisher(client, toolId, opts.publisherId);
+		if (opts.json) {
+			console.log(JSON.stringify({
+				tool_id: toolId,
+				removed: opts.publisherId
+			}, null, 2));
+			return 0;
+		}
+		console.log(green(`✓ removed trusted publisher #${opts.publisherId} from ${toolId}`));
+		return 0;
+	});
+}
+
+//#endregion
+export { runTrustedPublisherAdd, runTrustedPublisherList, runTrustedPublisherRemove };

package/dist/executa-upload-binaries-CYMtWJU7.js

@@ -0,0 +1,9 @@
+import "./credentials-BTv2IfUZ.js";
+import "./client-D-_z1ALk.js";
+import "./_lifecycle-shared-RyiRITI5.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./manifest-DlIcwLQs.js";
+import "./binary-upload-CKMU5Rfw.js";
+import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-Do5Sq64E.js";
+
+export { runExecutaUploadBinaries };

package/dist/executa-upload-binaries-Do5Sq64E.js

@@ -0,0 +1,277 @@
+import { canonicalHost } from "./credentials-BTv2IfUZ.js";
+import { CliError } from "./client-D-_z1ALk.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
+import { loadExecutaManifest } from "./manifest-DlIcwLQs.js";
+import { fetchGitHubIdToken, finalizeBinaryUpload, initBinaryUpload, mintUploadSession, mintUploadSessionViaOidc, uploadBinaryPart } from "./binary-upload-CKMU5Rfw.js";
+import { isAbsolute, resolve } from "node:path";
+import { closeSync, createReadStream, existsSync, openSync, readSync, statSync } from "node:fs";
+import { bold, cyan, dim, green, yellow } from "kleur/colors";
+import { createHash } from "node:crypto";
+
+//#region src/commands/executa-upload-binaries.ts
+const MAX_ARTIFACT_BYTES = 1024 * 1024 * 1024;
+const PART_RETRIES = 3;
+/** Expand `{version}` / `{platform}` / `{tool_id}` placeholders. */
+function expandArtifactPath(template, vars) {
+	return template.replaceAll("{version}", vars.version).replaceAll("{platform}", vars.platform).replaceAll("{tool_id}", vars.toolId);
+}
+async function sha256File(path) {
+	const hash = createHash("sha256");
+	for await (const chunk of createReadStream(path)) hash.update(chunk);
+	return hash.digest("hex");
+}
+/**
+* Resolve `distribution.binary_artifacts` into a validated, hashed upload
+* plan. Throws `CliError(4)` on missing files / oversize artifacts.
+*/
+async function resolveArtifactPlan(manifest, dir, toolId) {
+	const artifacts = manifest.distribution?.binaryArtifacts;
+	if (!artifacts || Object.keys(artifacts).length === 0) throw new CliError("executa.json declares no `distribution.binary_artifacts` — this command pushes LOCAL build artifacts directly to the platform. Add e.g.\n  \"distribution\": { \"type\": \"binary\", \"binary_artifacts\": {\n    \"darwin-arm64\": { \"path\": \"dist/my-tool-{version}-darwin-arm64.tar.gz\", \"entrypoint\": \"my-tool\" }\n  } }\n(projects using public `binary_urls` are pull-mirrored at `apps cut` instead)", 4);
+	const out = [];
+	for (const [platform, art] of Object.entries(artifacts)) {
+		const expanded = expandArtifactPath(art.path, {
+			version: manifest.version,
+			platform,
+			toolId
+		});
+		const absPath = isAbsolute(expanded) ? expanded : resolve(dir, expanded);
+		if (!existsSync(absPath)) throw new CliError(`binary_artifacts["${platform}"]: ${absPath} does not exist — build the artifact first (path placeholders: {version} {platform} {tool_id})`, 4);
+		const st = statSync(absPath);
+		if (!st.isFile()) throw new CliError(`binary_artifacts["${platform}"]: ${absPath} is not a file`, 4);
+		if (st.size <= 0 || st.size > MAX_ARTIFACT_BYTES) throw new CliError(`binary_artifacts["${platform}"]: ${absPath} is ${st.size} bytes — must be 1..${MAX_ARTIFACT_BYTES} (1 GiB)`, 4);
+		const filename = absPath.split(/[\\/]/).pop();
+		out.push({
+			platform,
+			absPath,
+			decl: {
+				filename,
+				sha256: await sha256File(absPath),
+				byte_size: st.size,
+				format: art.format,
+				entrypoint: art.entrypoint
+			}
+		});
+	}
+	out.sort((a, b) => a.platform.localeCompare(b.platform));
+	return out;
+}
+/** Read one part (byte range) of a file into a fresh buffer. */
+function readFilePart(path, start, length) {
+	const buf = Buffer.alloc(length);
+	const fd = openSync(path, "r");
+	try {
+		let off = 0;
+		while (off < length) {
+			const n = readSync(fd, buf, off, length - off, start + off);
+			if (n <= 0) break;
+			off += n;
+		}
+		if (off !== length) throw new CliError(`short read on ${path} (${off}/${length} bytes)`, 4);
+		return buf;
+	} finally {
+		closeSync(fd);
+	}
+}
+/**
+* Drive parts for every platform the init plan marked `upload`.
+* Sequential parts with per-part retry — resume comes from `uploaded_parts`.
+*/
+async function uploadPlannedParts(t, toolId, plan, init, log, retryDelayMs = 500) {
+	const outcome = {
+		uploadId: init.upload_id,
+		skipped: [],
+		uploaded: [],
+		partsSent: 0
+	};
+	for (const entry of plan) {
+		const asset = init.assets[entry.platform];
+		if (!asset) throw new CliError(`server plan is missing platform ${entry.platform}`, 6);
+		if (asset.status === "exists") {
+			outcome.skipped.push(entry.platform);
+			log(dim(`⏭ ${entry.platform}: skipped (content already published)`));
+			continue;
+		}
+		const partSize = asset.part_size;
+		const partCount = asset.part_count;
+		const already = new Set(asset.uploaded_parts ?? []);
+		if (already.size > 0) log(dim(`↩ ${entry.platform}: resuming — ${already.size}/${partCount} part(s) already received`));
+		for (let index = 0; index < partCount; index++) {
+			if (already.has(index)) continue;
+			const start = index * partSize;
+			const length = Math.min(partSize, entry.decl.byte_size - start);
+			const bytes = readFilePart(entry.absPath, start, length);
+			let lastError;
+			let sent = false;
+			for (let attempt = 1; attempt <= PART_RETRIES; attempt++) try {
+				await uploadBinaryPart(t, toolId, init.upload_id, entry.platform, index, bytes);
+				sent = true;
+				break;
+			} catch (e) {
+				lastError = e;
+				const status = e.status;
+				if (status && status < 500 && status !== 429) throw e;
+				if (attempt < PART_RETRIES && retryDelayMs > 0) await new Promise((r) => setTimeout(r, retryDelayMs * attempt));
+			}
+			if (!sent) throw lastError;
+			outcome.partsSent += 1;
+			log(dim(`↑ ${entry.platform}: part ${index + 1}/${partCount} (${length} bytes)`));
+		}
+		outcome.uploaded.push(entry.platform);
+	}
+	return outcome;
+}
+/**
+* Reusable direct-upload flow: hash artifacts → mint upload token → init →
+* push missing parts → finalize. Shared by the standalone
+* `executa upload-binaries` command, `executa publish` (pre-freeze upload)
+* and `apps cut` (bundled-executa pre-upload).
+*
+* Throws `CliError` on any failure; all-`exists` plans finalize instantly
+* (content-addressed idempotency), so re-runs are cheap.
+*/
+async function uploadExecutaBinaries(opts) {
+	const log = opts.log ?? (() => {});
+	const { host, dir, manifest, toolId } = opts;
+	log(dim(`hashing artifacts for ${toolId} (v${manifest.version})…`));
+	const plan = await resolveArtifactPlan(manifest, dir, toolId);
+	let uploadToken = opts.uploadToken;
+	if (!uploadToken) {
+		if (!opts.client) throw new CliError("uploadExecutaBinaries needs either a PAT client or a pre-minted uploadToken", 2);
+		({upload_token: uploadToken} = await mintUploadSession(opts.client, toolId));
+	}
+	const transport = {
+		host,
+		uploadToken,
+		fetchImpl: opts.fetchImpl
+	};
+	const assets = {};
+	for (const e of plan) assets[e.platform] = e.decl;
+	const init = await initBinaryUpload(transport, toolId, {
+		executa_version: manifest.version,
+		assets,
+		dry_run: opts.dryRun === true
+	});
+	const planOut = {};
+	for (const e of plan) planOut[e.platform] = {
+		...e.decl,
+		status: init.assets[e.platform]?.status
+	};
+	if (opts.dryRun) return {
+		toolId,
+		version: manifest.version,
+		uploadId: init.upload_id,
+		dryRun: true,
+		skipped: plan.filter((e) => init.assets[e.platform]?.status === "exists").map((e) => e.platform),
+		uploaded: [],
+		plan: planOut,
+		assets: {}
+	};
+	const outcome = await uploadPlannedParts(transport, toolId, plan, init, log);
+	const finalized = await finalizeBinaryUpload(transport, toolId, init.upload_id);
+	return {
+		toolId,
+		version: manifest.version,
+		uploadId: init.upload_id,
+		dryRun: false,
+		skipped: outcome.skipped,
+		uploaded: outcome.uploaded,
+		plan: planOut,
+		assets: finalized.assets
+	};
+}
+async function runExecutaUploadBinaries(opts) {
+	return withErrorHandling(async () => {
+		const dir = resolve(opts.dir ?? process.cwd());
+		const manifest = loadExecutaManifest(dir);
+		const log = (msg) => {
+			if (!opts.json) console.log(msg);
+		};
+		let client;
+		let host;
+		let uploadToken;
+		if (opts.oidc) {
+			const rawHost = opts.host ?? process.env.ANNA_APP_HOST;
+			if (!rawHost) throw new CliError("--oidc needs the Nexus host — pass --host or set ANNA_APP_HOST", 2);
+			host = canonicalHost(rawHost);
+			log(dim(`using GitHub OIDC trusted publishing (host=${host})`));
+		} else {
+			const resolved = resolveClient({
+				account: opts.account,
+				host: opts.host,
+				fetchImpl: opts.fetchImpl
+			});
+			client = resolved.client;
+			host = resolved.host;
+			log(dim(`using PAT from ${resolved.source} (host=${host})`));
+		}
+		let toolId = opts.toolId;
+		if (!toolId) {
+			const identity = readExecutaIdentity(dir);
+			if (!identity) throw new CliError(`no .anna/executa.json identity cache in ${dir} — run \`anna-app executa publish\` (standalone) or \`anna-app apps push\` (bundled) once to mint the executa, or pass --tool-id`, 4);
+			if (identity.host !== canonicalHost(host)) throw new CliError(`identity cache in ${dir} belongs to ${identity.host}, but the current target is ${canonicalHost(host)} — use --account/--host or re-publish against this host`, 4);
+			toolId = identity.tool_id;
+		}
+		if (opts.oidc) {
+			const idToken = await fetchGitHubIdToken({ fetchImpl: opts.fetchImpl });
+			({upload_token: uploadToken} = await mintUploadSessionViaOidc({
+				host,
+				toolId,
+				oidcToken: idToken,
+				fetchImpl: opts.fetchImpl
+			}));
+			log(dim("✓ upload token minted via OIDC exchange (no PAT involved)"));
+		}
+		const result = await uploadExecutaBinaries({
+			client,
+			host,
+			dir,
+			manifest,
+			toolId,
+			uploadToken,
+			dryRun: opts.dryRun === true,
+			fetchImpl: opts.fetchImpl,
+			log
+		});
+		if (opts.dryRun) {
+			if (opts.json) {
+				console.log(JSON.stringify({
+					tool_id: toolId,
+					version: manifest.version,
+					dry_run: true,
+					upload_id: result.uploadId,
+					assets: result.plan
+				}, null, 2));
+				return 0;
+			}
+			console.log(yellow(`[dry-run] upload plan for ${toolId} v${manifest.version}:`));
+			for (const [platform, decl] of Object.entries(result.plan)) {
+				const status = decl.status ?? "?";
+				console.log(`  ${platform}: ${status === "exists" ? green("exists (skip)") : cyan("upload")} ` + dim(`${decl.byte_size} bytes, sha256=${decl.sha256.slice(0, 12)}…`));
+			}
+			return 0;
+		}
+		if (opts.json) {
+			console.log(JSON.stringify({
+				tool_id: toolId,
+				version: manifest.version,
+				host,
+				upload_id: result.uploadId,
+				skipped: result.skipped,
+				uploaded: result.uploaded,
+				assets: result.assets
+			}, null, 2));
+			return 0;
+		}
+		console.log(green(`✓ ${toolId}: binaries published `) + dim(`(${result.uploaded.length} uploaded, ${result.skipped.length} cached)`));
+		for (const [platform, a] of Object.entries(result.assets)) {
+			console.log(`  ${bold(platform)} ${dim(`sha256=${a.sha256.slice(0, 12)}…`)}`);
+			console.log(`    ${cyan(a.url)}`);
+		}
+		console.log(dim("→ binaries are served from the platform CDN; `apps cut` / release will pin these hashes"));
+		return 0;
+	});
+}
+
+//#endregion
+export { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts };

package/dist/{manifest-DOMrcdCK.js → manifest-DlIcwLQs.js}

@@ -206,15 +206,19 @@ function parseDistributionProfile(d, ctx) {
 	const executableName = pickString(d, "executable_name");
 	const supportsProtocol = pickBool(d, "supports_protocol");
 	const binaryUrls = parseBinaryUrls(d["binary_urls"], ctx);
+	const binaryArtifacts = parseBinaryArtifacts(d["binary_artifacts"], ctx);
 	const capabilities = parseCapabilities(d["capabilities"], ctx);
 	if (PACKAGE_BACKED.has(distType) && !packageName) throw new CliError(`executa.json \`${ctx}.package_name\` is required for \`${ctx}.type: "${distType}"\``, 4);
-	if (distType === "binary" && (!binaryUrls || Object.keys(binaryUrls).length === 0)) throw new CliError(`executa.json \`${ctx}.binary_urls\` is required (and non-empty) for \`${ctx}.type: "binary"\``, 4);
+	if (binaryArtifacts && distType !== "binary") throw new CliError(`executa.json \`${ctx}.binary_artifacts\` is only valid for \`${ctx}.type: "binary"\``, 4);
+	if (binaryArtifacts && binaryUrls) throw new CliError(`executa.json \`${ctx}\` declares BOTH \`binary_urls\` and \`binary_artifacts\` — pick exactly one: \`binary_urls\` (a public GET-able source the platform pull-mirrors at cut) or \`binary_artifacts\` (local files pushed directly via \`anna-app executa upload-binaries\`; works for private repos)`, 4);
+	if (distType === "binary" && (!binaryUrls || Object.keys(binaryUrls).length === 0) && (!binaryArtifacts || Object.keys(binaryArtifacts).length === 0)) throw new CliError(`executa.json \`${ctx}\` requires exactly one of \`binary_urls\` (non-empty) or \`binary_artifacts\` (non-empty) for \`${ctx}.type: "binary"\``, 4);
 	return {
 		type: distType,
 		packageName,
 		executableName,
 		supportsProtocol,
 		binaryUrls,
+		binaryArtifacts,
 		capabilities
 	};
 }
@@ -238,6 +242,57 @@ function parseBinaryUrls(value, ctx = "distribution") {
 	}
 	return out;
 }
+/**
+* Canonical `<os>-<arch>` platform keys accepted for `binary_artifacts`
+* (mirrors ALLOWED_PLATFORMS in matrix-nexus
+* src/services/executa_binary_upload.py — both ends validate independently).
+*/
+const BINARY_ARTIFACT_PLATFORMS = new Set([
+	"darwin-arm64",
+	"darwin-x86_64",
+	"linux-x86_64",
+	"linux-arm64",
+	"linux-aarch64",
+	"windows-x86_64",
+	"windows-arm64"
+]);
+const MAX_BINARY_ARTIFACT_PLATFORMS = 8;
+/** Infer the archive format from a path suffix (`.tar.gz`/`.tgz`/`.zip`). */
+function inferArtifactFormat(path) {
+	const lower = path.toLowerCase();
+	if (lower.endsWith(".tar.gz") || lower.endsWith(".tgz")) return "tar.gz";
+	if (lower.endsWith(".zip")) return "zip";
+	return void 0;
+}
+function parseBinaryArtifacts(value, ctx = "distribution") {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value !== "object" || Array.isArray(value)) throw new CliError(`executa.json \`${ctx}.binary_artifacts\` must be an object mapping platform → { path, entrypoint?, format? }`, 4);
+	const entries = Object.entries(value);
+	if (entries.length > MAX_BINARY_ARTIFACT_PLATFORMS) throw new CliError(`executa.json \`${ctx}.binary_artifacts\` declares more than ${MAX_BINARY_ARTIFACT_PLATFORMS} platforms`, 4);
+	const out = {};
+	for (const [platform, decl] of entries) {
+		if (!BINARY_ARTIFACT_PLATFORMS.has(platform)) throw new CliError(`executa.json \`${ctx}.binary_artifacts["${platform}"]\` — unknown platform key; expected one of ` + [...BINARY_ARTIFACT_PLATFORMS].join(" | "), 4);
+		if (decl === null || typeof decl !== "object" || Array.isArray(decl)) throw new CliError(`executa.json \`${ctx}.binary_artifacts["${platform}"]\` must be an object \`{ path, entrypoint?, format? }\``, 4);
+		const d = decl;
+		const path = pickString(d, "path");
+		if (!path || !path.trim()) throw new CliError(`executa.json \`${ctx}.binary_artifacts["${platform}"]\` missing required \`path\``, 4);
+		const declared = pickString(d, "format");
+		let format;
+		if (declared !== void 0) if (declared === "tar.gz" || declared === "tgz") format = "tar.gz";
+		else if (declared === "zip") format = "zip";
+		else throw new CliError(`executa.json \`${ctx}.binary_artifacts["${platform}"].format\` "${declared}" is invalid — expected tar.gz | tgz | zip (bare executables must be archived)`, 4);
+		else {
+			format = inferArtifactFormat(path);
+			if (!format) throw new CliError(`executa.json \`${ctx}.binary_artifacts["${platform}"]\` — cannot infer archive format from "${path}"; use a .tar.gz/.tgz/.zip suffix or set \`format\` explicitly`, 4);
+		}
+		out[platform] = {
+			path,
+			entrypoint: pickString(d, "entrypoint"),
+			format
+		};
+	}
+	return out;
+}
 function parseCapabilities(value, ctx = "distribution") {
 	if (value === void 0 || value === null) return void 0;
 	if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) throw new CliError(`executa.json \`${ctx}.capabilities\` must be an array of strings`, 4);

package/dist/{publish-GpvkaBIx.js → publish-DW_D3uQ4.js}

@@ -1,16 +1,18 @@
 import "./credentials-BTv2IfUZ.js";
 import "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import "./bundled-executas-_H1A9M50.js";
-import "./executas-BhFed1B-.js";
-import "./executa-cache-Do1D7xC0.js";
-import { runExecutaPublish } from "./executa-publish-Ah6J7jYd.js";
-import "./manifest-DOMrcdCK.js";
-import "./app-cache-BqnTkxUw.js";
-import "./listing-meta-BlY7XMrw.js";
-import "./app-bundle-upload-CqT9KUOl.js";
-import { runAppsPublish } from "./apps-publish-BKqVsS1W.js";
+import { withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./bundled-executas-rSIkaA6-.js";
+import "./manifest-DlIcwLQs.js";
+import "./executas-CvQY_w2U.js";
+import { runExecutaPublish } from "./executa-publish-CGz5wM1Q.js";
+import "./binary-upload-CKMU5Rfw.js";
+import "./executa-upload-binaries-Do5Sq64E.js";
+import "./app-cache-Cr3tKbux.js";
+import "./listing-meta-C0HsNjIB.js";
+import "./app-bundle-upload-CrBRnzf4.js";
+import { runAppsPublish } from "./apps-publish-qc_E4b_R.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { red, yellow } from "kleur/colors";

package/dist/{server-BMcGaUTy.js → server-BHWGGZsf.js}

@@ -1,5 +1,5 @@
 import { canonicalHost, getAccount } from "./credentials-BTv2IfUZ.js";
-import { BridgeRequestError } from "./bridge-CbjqAm0H.js";
+import { BridgeRequestError } from "./bridge-Dvck0e9c.js";
 import { dirname, join, normalize, resolve } from "node:path";
 import { createRequire } from "node:module";
 import { createReadStream, existsSync, readFileSync, statSync, watch } from "node:fs";

package/dist/{storage-BkF4XyI0.js → storage-aii8EyPC.js}

@@ -1,5 +1,5 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { hostOf, requireAccount, withCode } from "./dev-account-DqEFCmVg.js";
+import { hostOf, requireAccount, withCode } from "./dev-account-CfVdGa9j.js";
 import { resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 

package/dist/{token-uedeaAy7.js → token-COnYMRB-.js}

@@ -1,6 +1,6 @@
 import "./credentials-BTv2IfUZ.js";
 import "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 
 //#region src/api/tokens.ts

package/dist/{working-orchestration-1jzRuk34.js → working-orchestration-B8KdAh5S.js}

@@ -1,11 +1,11 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { createApp, findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-_H1A9M50.js";
-import { runExecutaPublish } from "./executa-publish-Ah6J7jYd.js";
-import { loadExecutaManifest } from "./manifest-DOMrcdCK.js";
-import { runExecutaInstall } from "./executa-install-BW9jjY7u.js";
-import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-BqnTkxUw.js";
+import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-rSIkaA6-.js";
+import { loadExecutaManifest } from "./manifest-DlIcwLQs.js";
+import { runExecutaPublish } from "./executa-publish-CGz5wM1Q.js";
+import { runExecutaInstall } from "./executa-install-Dz7hBUsn.js";
+import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { join, resolve } from "node:path";
 import { dim, green, yellow } from "kleur/colors";
 import { homedir } from "node:os";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anna-ai/cli",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Anna App developer CLI: scaffold, validate, harness (Phase 2 MVP: init + validate).",
   "license": "MIT",
   "type": "module",