@anna-ai/cli 0.1.33 → 0.1.35

package/dist/{_lifecycle-shared-CUK2CE76.js → _lifecycle-shared-RyiRITI5.js}

@@ -11,7 +11,8 @@ function resolveClient(opts = {}) {
 		return {
 			client: new NexusClient({
 				host,
-				pat: envPat
+				pat: envPat,
+				fetchImpl: opts.fetchImpl
 			}),
 			host,
 			source: "env"
@@ -22,7 +23,8 @@ function resolveClient(opts = {}) {
 	return {
 		client: new NexusClient({
 			host: acc.host,
-			pat: acc.pat
+			pat: acc.pat,
+			fetchImpl: opts.fetchImpl
 		}),
 		host: acc.host,
 		source: "credentials"

package/dist/{account-bqao7Gp5.js → account-B4rdVDyg.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { setDeveloperHandle } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { reportError, resolveClient } from "./_lifecycle-shared-CUK2CE76.js";
+import { reportError, resolveClient } from "./_lifecycle-shared-RyiRITI5.js";
 import { bold, dim, green, red } from "kleur/colors";
 
 //#region src/commands/account.ts

package/dist/{agent-CzPryLi6.js → agent-DAOr_aiE.js}

@@ -1,5 +1,5 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { hostOf, mintAppSession, requireAccount, withCode } from "./dev-account-DqEFCmVg.js";
+import { hostOf, mintAppSession, requireAccount, withCode } from "./dev-account-CfVdGa9j.js";
 import { resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 

package/dist/{app-bundle-upload-CqT9KUOl.js → app-bundle-upload-DmVKWAj9.js}

@@ -1,6 +1,6 @@
 import { finalizeBundle, finalizeWorkingBundle, getBundle, initBundle, initWorkingBundle, uploadBundleFile, uploadWorkingBundleFile } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { canonicalize } from "./executa-publish-Ah6J7jYd.js";
+import { canonicalize } from "./executa-publish-kh4Ucd3o.js";
 import { join, relative, sep } from "node:path";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
@@ -28,8 +28,8 @@ const CONTENT_TYPES = {
 	txt: "text/plain",
 	md: "text/markdown"
 };
-const MAX_TOTAL_BYTES = 50 * 1024 * 1024;
-const MAX_FILE_BYTES = 10 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 1024 * 1024 * 1024;
+const MAX_FILE_BYTES = 100 * 1024 * 1024;
 const MAX_FILES = 2e3;
 const UPLOAD_PARALLEL = 4;
 function guessContentType(name) {

package/dist/{apps-dvknZYI2.js → apps-C_Oln_om.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { listMyApps } from "./apps-DlVsVHQ5.js";
 import "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import { bold, cyan, dim, green, magenta, red, yellow } from "kleur/colors";
 
 //#region src/commands/apps.ts

package/dist/apps-cut-MjSe2ph7.js

@@ -0,0 +1,159 @@
+import { canonicalHost } from "./credentials-BTv2IfUZ.js";
+import "./nexus-root-BlPwOusj.js";
+import { cutWorkingDraft } from "./apps-DlVsVHQ5.js";
+import { CliError } from "./client-D-_z1ALk.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
+import { readExecutasLock, writeExecutasLock } from "./bundled-executas-rSIkaA6-.js";
+import { loadAppManifest, loadExecutaManifest } from "./manifest-CAF3_r1T.js";
+import "./executas-CvQY_w2U.js";
+import "./executa-publish-kh4Ucd3o.js";
+import "./binary-upload-CKMU5Rfw.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-DURJTXRI.js";
+import "./dev-GUFWek03.js";
+import "./executa-install-Dz7hBUsn.js";
+import "./app-cache-Cr3tKbux.js";
+import { resolveAppBySlugOrCache } from "./working-orchestration-D7cW2Bf2.js";
+import { resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { bold, cyan, dim, green, yellow } from "kleur/colors";
+
+//#region src/commands/apps-cut.ts
+/**
+* Pre-cut step (design executa-binary-direct-upload.md §7.3): every bundled
+* executa that declares `distribution.binary_artifacts` gets its bytes
+* pushed to the platform BEFORE the freeze, so the server-side executa
+* version snapshot pins CDN URLs + sha256 (and `ensure_binaries_ready`
+* passes without any pull-mirror fetch). Content-addressed idempotency
+* makes re-cuts free: an already-published artifact set is all-`exists`.
+*
+* Executas using `binary_urls` (pull-mirror track) or no distribution are
+* untouched. Missing tool_id (never pushed) is a hard error — the freeze
+* would fail anyway, so surface the actionable message here.
+*/
+async function preUploadBundledBinaries(params) {
+	const { client, host, cwd, dryRun, json } = params;
+	const log = (msg) => {
+		if (!json) console.log(msg);
+	};
+	if (!existsSync(resolve(cwd, "manifest.json"))) return;
+	let appManifest;
+	try {
+		appManifest = loadAppManifest(cwd);
+	} catch {
+		return;
+	}
+	if (appManifest.bundledExecutas.length === 0) return;
+	const lock = readExecutasLock(cwd, host);
+	for (const decl of appManifest.bundledExecutas) {
+		const dir = resolve(cwd, decl.path);
+		let exManifest;
+		try {
+			exManifest = loadExecutaManifest(dir);
+		} catch {
+			continue;
+		}
+		const artifacts = exManifest.distribution?.binaryArtifacts;
+		if (!artifacts || Object.keys(artifacts).length === 0) {
+			if (exManifest.distribution?.type === "binary" && exManifest.distribution?.binaryUrls) log(yellow(`! "${decl.handle}" uses binary_urls (pull-mirror): the platform must be able to GET these URLs anonymously at cut/release. Private source URLs are deprecated — switch to binary_artifacts (direct upload) if the source is private.`));
+			continue;
+		}
+		const identity = readExecutaIdentity(dir);
+		const toolId = (identity && identity.host === canonicalHost(host) ? identity.tool_id : void 0) ?? lock?.executas[decl.handle]?.tool_id;
+		if (!toolId) throw new CliError(`bundled executa "${decl.handle}" declares binary_artifacts but has no minted tool_id — run \`anna-app apps push\` once to register it, then re-run cut`, 4);
+		if (dryRun) {
+			log(yellow(`[dry-run] would upload binary_artifacts for "${decl.handle}" (${toolId})`));
+			continue;
+		}
+		log(dim(`↑ uploading binary artifacts for "${decl.handle}" (${toolId})…`));
+		const up = await uploadExecutaBinaries({
+			client,
+			host,
+			dir,
+			manifest: exManifest,
+			toolId,
+			fetchImpl: params.fetchImpl,
+			log
+		});
+		log(green(`✓ "${decl.handle}": binaries ready `) + dim(`(${up.uploaded.length} uploaded, ${up.skipped.length} cached)`));
+	}
+}
+async function runAppsCut(opts) {
+	return withErrorHandling(async () => {
+		const { client, host } = resolveClient({
+			account: opts.account,
+			fetchImpl: opts.fetchImpl
+		});
+		const app = await resolveAppBySlugOrCache(client, host, {
+			slug: opts.slug,
+			cwd: opts.cwd
+		});
+		await preUploadBundledBinaries({
+			client,
+			host,
+			cwd: resolve(opts.cwd ?? process.cwd()),
+			dryRun: opts.dryRun === true,
+			json: opts.json === true,
+			fetchImpl: opts.fetchImpl
+		});
+		if (opts.dryRun) {
+			if (!opts.json) console.log(yellow(`[dry-run] would cut version ${opts.version} for apps/${app.slug} (app_id=${app.id})`));
+			return 0;
+		}
+		let result;
+		try {
+			result = await cutWorkingDraft(client, app.id, {
+				version: opts.version,
+				changelog: opts.changelog
+			});
+		} catch (e) {
+			if (e instanceof CliError && e.status === 409) throw new CliError(`version ${opts.version} already cut for apps/${app.slug}; choose a higher SemVer (e.g. bump patch/minor) and retry`, 9);
+			if (e instanceof CliError && (e.status === 400 || e.status === 422)) throw new CliError(`cannot cut: ${e.message} — fix the working draft and \`apps push\` again`, 4);
+			throw e;
+		}
+		if (result.frozen_executas.length > 0) {
+			const cwd = resolve(opts.cwd ?? process.cwd());
+			const lock = readExecutasLock(cwd, host);
+			if (lock) {
+				const byToolId = new Map(Object.entries(lock.executas).map(([h, e]) => [e.tool_id, h]));
+				for (const fr of result.frozen_executas) {
+					const handle = byToolId.get(fr.tool_id);
+					if (handle && lock.executas[handle]) lock.executas[handle] = {
+						...lock.executas[handle],
+						tool_id: fr.tool_id,
+						source: "cut"
+					};
+				}
+				writeExecutasLock(cwd, {
+					$schema: "anna-executas-lock/v1",
+					host: canonicalHost(host),
+					executas: lock.executas
+				});
+			}
+		}
+		if (opts.json) {
+			console.log(JSON.stringify({
+				app_id: app.id,
+				slug: app.slug,
+				host,
+				version_id: result.version_id,
+				version: result.version,
+				frozen_executas: result.frozen_executas,
+				bundle: result.bundle
+			}, null, 2));
+			return 0;
+		}
+		console.log(green(`✓ apps/${app.slug}: cut immutable version ${result.version} `) + dim(`(version_id=${result.version_id})`));
+		for (const fr of result.frozen_executas) console.log(dim(`  froze ${fr.tool_id} → executa_version=${fr.executa_version_id}`) + (fr.version ? dim(` (v${fr.version})`) : ""));
+		if (result.bundle && typeof result.bundle === "object") {
+			const prefix = result.bundle.object_prefix;
+			if (prefix) console.log(dim(`  bundle frozen at ${prefix}`));
+		}
+		console.log(dim(`→ run `) + cyan(`anna-app apps release ${result.version}`) + dim(` to go live`));
+		console.log(bold(cyan(`status: ${app.status}`)));
+		return 0;
+	});
+}
+
+//#endregion
+export { runAppsCut };

package/dist/{apps-destructive-B6RFjokU.js → apps-destructive-a2YBmWFm.js}

@@ -1,8 +1,8 @@
 import "./credentials-BTv2IfUZ.js";
 import { archiveApp, deleteApp, findAppBySlug, unarchiveApp, unpublishApp } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import { ensureDestructiveAllowed } from "./confirm-BuT56E_B.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { ensureDestructiveAllowed } from "./confirm-BSoOy1X2.js";
 import { dim, green, yellow } from "kleur/colors";
 
 //#region src/commands/apps-destructive.ts

package/dist/{apps-discard-hVZxAQyj.js → apps-discard-BWLVVMu7.js}

@@ -2,16 +2,18 @@ import "./credentials-BTv2IfUZ.js";
 import "./nexus-root-BlPwOusj.js";
 import { deleteWorkingDraft, getWorkingDraft } from "./apps-DlVsVHQ5.js";
 import "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import "./bundled-executas-_H1A9M50.js";
-import "./executas-BhFed1B-.js";
-import "./executa-cache-Do1D7xC0.js";
-import "./executa-publish-Ah6J7jYd.js";
-import "./manifest-DOMrcdCK.js";
-import "./dev-Re6NyNDS.js";
-import "./executa-install-BW9jjY7u.js";
-import "./app-cache-BqnTkxUw.js";
-import { resolveAppBySlugOrCache } from "./working-orchestration-1jzRuk34.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./bundled-executas-rSIkaA6-.js";
+import "./manifest-CAF3_r1T.js";
+import "./executas-CvQY_w2U.js";
+import "./executa-publish-kh4Ucd3o.js";
+import "./binary-upload-CKMU5Rfw.js";
+import "./executa-upload-binaries-DURJTXRI.js";
+import "./dev-GUFWek03.js";
+import "./executa-install-Dz7hBUsn.js";
+import "./app-cache-Cr3tKbux.js";
+import { resolveAppBySlugOrCache } from "./working-orchestration-D7cW2Bf2.js";
 import { dim, green, yellow } from "kleur/colors";
 
 //#region src/commands/apps-discard.ts

package/dist/{apps-grants-DnXCnkH5.js → apps-grants-lmllFB02.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getAppGrants } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import { bold, cyan, dim } from "kleur/colors";
 
 //#region src/commands/apps-grants.ts

package/dist/{apps-publish-BKqVsS1W.js → apps-publish--EmBa0zN.js}

@@ -1,13 +1,13 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { createApp, createVersion, findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-_H1A9M50.js";
-import { bumpVersion, bundleHash, manifestHash, rewriteVersion, runExecutaPublish } from "./executa-publish-Ah6J7jYd.js";
-import { loadAppManifest } from "./manifest-DOMrcdCK.js";
-import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-BqnTkxUw.js";
-import { syncAppListingMeta } from "./listing-meta-BlY7XMrw.js";
-import { isExistingDir, uploadAppBundle } from "./app-bundle-upload-CqT9KUOl.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-rSIkaA6-.js";
+import { loadAppManifest } from "./manifest-CAF3_r1T.js";
+import { bumpVersion, bundleHash, manifestHash, rewriteVersion, runExecutaPublish } from "./executa-publish-kh4Ucd3o.js";
+import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
+import { syncAppListingMeta } from "./listing-meta-CtVtyaWu.js";
+import { isExistingDir, uploadAppBundle } from "./app-bundle-upload-DmVKWAj9.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
 
@@ -75,6 +75,7 @@ async function runAppsPublish(opts) {
 					cwd: execCwd,
 					account: opts.account,
 					quiet: true,
+					profile: opts.profile,
 					capture: (r) => {
 						captured = r;
 					}

package/dist/apps-publish-B7reDBe1.js

@@ -0,0 +1,17 @@
+import "./credentials-BTv2IfUZ.js";
+import "./apps-DlVsVHQ5.js";
+import "./client-D-_z1ALk.js";
+import "./_lifecycle-shared-RyiRITI5.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./bundled-executas-rSIkaA6-.js";
+import "./manifest-CAF3_r1T.js";
+import "./executas-CvQY_w2U.js";
+import "./executa-publish-kh4Ucd3o.js";
+import "./binary-upload-CKMU5Rfw.js";
+import "./executa-upload-binaries-DURJTXRI.js";
+import "./app-cache-Cr3tKbux.js";
+import "./listing-meta-CtVtyaWu.js";
+import "./app-bundle-upload-DmVKWAj9.js";
+import { runAppsPublish } from "./apps-publish--EmBa0zN.js";
+
+export { runAppsPublish };

package/dist/{apps-push-B3wZr9B4.js → apps-push-CkJ1gtpy.js}

@@ -2,18 +2,20 @@ import "./credentials-BTv2IfUZ.js";
 import "./nexus-root-BlPwOusj.js";
 import { getApp, getWorkingDraft, upsertWorkingDraft } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import "./bundled-executas-_H1A9M50.js";
-import "./executas-BhFed1B-.js";
-import "./executa-cache-Do1D7xC0.js";
-import { bumpVersion, bundleHash, manifestHash, rewriteVersion } from "./executa-publish-Ah6J7jYd.js";
-import { loadAppManifest } from "./manifest-DOMrcdCK.js";
-import "./dev-Re6NyNDS.js";
-import "./executa-install-BW9jjY7u.js";
-import "./app-cache-BqnTkxUw.js";
-import { installLocalBundledShims, resolveAppIdentity, resolveBundledExecutas } from "./working-orchestration-1jzRuk34.js";
-import { syncAppListingMeta } from "./listing-meta-BlY7XMrw.js";
-import { isExistingDir, uploadWorkingBundle } from "./app-bundle-upload-CqT9KUOl.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./bundled-executas-rSIkaA6-.js";
+import { loadAppManifest } from "./manifest-CAF3_r1T.js";
+import "./executas-CvQY_w2U.js";
+import { bumpVersion, bundleHash, manifestHash, rewriteVersion } from "./executa-publish-kh4Ucd3o.js";
+import "./binary-upload-CKMU5Rfw.js";
+import "./executa-upload-binaries-DURJTXRI.js";
+import "./dev-GUFWek03.js";
+import "./executa-install-Dz7hBUsn.js";
+import "./app-cache-Cr3tKbux.js";
+import { installLocalBundledShims, resolveAppIdentity, resolveBundledExecutas } from "./working-orchestration-D7cW2Bf2.js";
+import { syncAppListingMeta } from "./listing-meta-CtVtyaWu.js";
+import { isExistingDir, uploadWorkingBundle } from "./app-bundle-upload-DmVKWAj9.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
 
@@ -41,6 +43,7 @@ async function runAppsPush(opts) {
 			dryRun: opts.dryRun,
 			freeze: false,
 			lockSource: "working",
+			profile: opts.profile,
 			account: opts.account,
 			json: opts.json
 		});
@@ -49,6 +52,7 @@ async function runAppsPush(opts) {
 			manifest,
 			cwd,
 			resolved,
+			profile: opts.profile,
 			json: opts.json
 		});
 		const identity = await resolveAppIdentity({

package/dist/{apps-release-CyAPmWPU.js → apps-release-J-Sjkoym.js}

@@ -1,8 +1,8 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getApp, getBundle, listVersions, publishVersion } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import { readAppIdentity } from "./app-cache-BqnTkxUw.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
 
@@ -59,7 +59,7 @@ async function runAppsRelease(opts) {
 		if (!target) {
 			if (opts.allowCreate) {
 				if (!opts.json) console.log(yellow(`version ${opts.version} not found remotely; running 'apps publish' first (--allow-create)…`));
-				const { runAppsPublish } = await import("./apps-publish-Djpw5cfG.js");
+				const { runAppsPublish } = await import("./apps-publish-B7reDBe1.js");
 				const code = await runAppsPublish({
 					cwd: opts.cwd,
 					account: opts.account,

package/dist/{apps-rename-slug-D2BrWasG.js → apps-rename-slug-DYrk4Zpt.js}

@@ -1,9 +1,9 @@
 import "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, patchApp } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { reportError, resolveClient } from "./_lifecycle-shared-CUK2CE76.js";
-import { loadAppManifest } from "./manifest-DOMrcdCK.js";
-import { readAppIdentity, writeAppIdentity } from "./app-cache-BqnTkxUw.js";
+import { reportError, resolveClient } from "./_lifecycle-shared-RyiRITI5.js";
+import { loadAppManifest } from "./manifest-CAF3_r1T.js";
+import { readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { writeFileSync } from "node:fs";
 import { bold, dim, green, red, yellow } from "kleur/colors";
 

package/dist/{apps-status-DV8V_y35.js → apps-status-CcCoYu6i.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getApp, listVersions } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 
 //#region src/commands/apps-status.ts

package/dist/{apps-submit-review-DMFQI8JZ.js → apps-submit-review-DNrQc2ws.js}

@@ -1,8 +1,8 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getApp, submitForReview } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import { readAppIdentity } from "./app-cache-BqnTkxUw.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { resolve } from "node:path";
 import { bold, cyan, green } from "kleur/colors";
 

package/dist/{apps-sync-meta-BOb6J_wz.js → apps-sync-meta-CL2PCMCv.js}

@@ -1,10 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import { loadAppManifest } from "./manifest-DOMrcdCK.js";
-import { readAppIdentity } from "./app-cache-BqnTkxUw.js";
-import { syncAppListingMeta } from "./listing-meta-BlY7XMrw.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { loadAppManifest } from "./manifest-CAF3_r1T.js";
+import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
+import { syncAppListingMeta } from "./listing-meta-CtVtyaWu.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green } from "kleur/colors";
 
@@ -70,6 +70,8 @@ async function runAppsSyncMeta(opts) {
 		console.log(`  ${dim("name     :")} ${manifest.name}`);
 		if (manifest.category) console.log(`  ${dim("category :")} ${manifest.category}`);
 		if (manifest.tagline) console.log(`  ${dim("tagline  :")} ${manifest.tagline}`);
+		const cleared = Object.entries(meta).filter(([, v]) => v === "").map(([k]) => k);
+		if (cleared.length > 0) console.log(`  ${dim("cleared  :")} ${cleared.join(", ")}`);
 		if (sync.logoUpload?.logo_url) console.log(`  ${dim("logo     :")} ${sync.logoUpload.logo_url}`);
 		if (sync.screenshotUploads && sync.screenshotUploads.length > 0) console.log(`  ${dim("shots    :")} ${sync.screenshotUploads.length} uploaded`);
 		console.log(bold(cyan(`status: ${finalApp.status}`)));

package/dist/{apps-versions-D1lixrmM.js → apps-versions-2BR8xo7C.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, listVersions } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import { bold, cyan, dim, green } from "kleur/colors";
 
 //#region src/commands/apps-versions.ts

package/dist/binary-upload-CKMU5Rfw.js

@@ -0,0 +1,181 @@
+import { CliError } from "./client-D-_z1ALk.js";
+
+//#region src/api/binary-upload.ts
+/** Exchange the PAT for a short-lived upload token bound to one tool_id. */
+async function mintUploadSession(client, toolId) {
+	const res = await client.request({
+		path: "/api/v1/anna-apps/dev/upload-session/mint",
+		method: "POST",
+		body: { tool_id: toolId }
+	});
+	return res.data;
+}
+/**
+* The id-token audience BOTH ends pin (server:
+* settings.ANNA_APS_OIDC_AUDIENCE). A token minted for any other relying
+* party is rejected by the exchange endpoint.
+*/
+const APS_OIDC_AUDIENCE = "anna-aps";
+/**
+* Fetch a GitHub Actions OIDC id-token from the runner's token service.
+*
+* Requires `permissions: id-token: write` on the workflow/job — GitHub then
+* injects ACTIONS_ID_TOKEN_REQUEST_URL / ACTIONS_ID_TOKEN_REQUEST_TOKEN.
+* Throws a CliError with an actionable message when unavailable.
+*/
+async function fetchGitHubIdToken(opts) {
+	const env = opts?.env ?? process.env;
+	const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+	const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+	if (!requestUrl || !requestToken) throw new CliError("GitHub OIDC token service unavailable — --oidc only works inside GitHub Actions with `permissions: id-token: write` on the job", 2);
+	const audience = opts?.audience ?? APS_OIDC_AUDIENCE;
+	const url = `${requestUrl}${requestUrl.includes("?") ? "&" : "?"}audience=${encodeURIComponent(audience)}`;
+	const fetchImpl = opts?.fetchImpl ?? fetch;
+	let res;
+	try {
+		res = await fetchImpl(url, { headers: {
+			authorization: `Bearer ${requestToken}`,
+			accept: "application/json"
+		} });
+	} catch (e) {
+		throw new CliError(`failed to reach the GitHub OIDC token service: ${e.message}`, 6);
+	}
+	if (!res.ok) throw new CliError(`GitHub OIDC token service returned ${res.status}`, 6, { status: res.status });
+	const data = await res.json();
+	if (!data.value) throw new CliError("GitHub OIDC token service returned no token value", 6);
+	return data.value;
+}
+/**
+* Exchange a GitHub Actions id-token for an upload token — zero long-term
+* secrets. Requires a Trusted Publisher registration on the executa
+* (`anna-app executa trusted-publisher add`).
+*/
+async function mintUploadSessionViaOidc(opts) {
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	let res;
+	try {
+		res = await fetchImpl(`${opts.host}/api/v1/anna-apps/dev/upload-session/oidc-exchange`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				accept: "application/json"
+			},
+			body: JSON.stringify({
+				tool_id: opts.toolId,
+				oidc_token: opts.oidcToken
+			})
+		});
+	} catch (e) {
+		throw new CliError(`network error contacting ${opts.host}: ${e.message}`, 6);
+	}
+	let parsed = null;
+	const text = await res.text();
+	if (text.length > 0) try {
+		parsed = JSON.parse(text);
+	} catch {
+		parsed = text;
+	}
+	if (!res.ok) {
+		const { code, message } = describeUploadError(parsed);
+		throw new CliError(`OIDC exchange failed (${res.status}${code ? ` ${code}` : ""}): ${message}`, res.status === 401 ? 2 : res.status >= 500 ? 6 : 3, {
+			status: res.status,
+			body: parsed
+		});
+	}
+	return parsed;
+}
+async function listTrustedPublishers(client, toolId) {
+	const res = await client.request({ path: `/api/v1/anna-apps/dev/executas/${encodeURIComponent(toolId)}/trusted-publishers` });
+	return res.data.trusted_publishers;
+}
+async function addTrustedPublisher(client, toolId, body) {
+	const res = await client.request({
+		path: `/api/v1/anna-apps/dev/executas/${encodeURIComponent(toolId)}/trusted-publishers`,
+		method: "POST",
+		body
+	});
+	return res.data;
+}
+async function removeTrustedPublisher(client, toolId, publisherId) {
+	await client.request({
+		path: `/api/v1/anna-apps/dev/executas/${encodeURIComponent(toolId)}/trusted-publishers/${publisherId}`,
+		method: "DELETE"
+	});
+}
+/** Extract `{code, message}` from a structured upload error body. */
+function describeUploadError(body) {
+	if (body && typeof body === "object") {
+		const det = body.detail;
+		if (det && typeof det === "object") {
+			const d = det;
+			if (d.message) return {
+				code: d.code,
+				message: d.message
+			};
+		}
+		if (typeof det === "string") return { message: det };
+	}
+	if (typeof body === "string" && body) return { message: body.slice(0, 240) };
+	return { message: "(empty body)" };
+}
+async function uploadRequest(t, path, opts) {
+	const fetchImpl = t.fetchImpl ?? fetch;
+	const headers = {
+		authorization: `Bearer ${t.uploadToken}`,
+		accept: "application/json"
+	};
+	let body;
+	if (opts.rawBody !== void 0) {
+		headers["content-type"] = "application/octet-stream";
+		body = opts.rawBody;
+	} else if (opts.body !== void 0) {
+		headers["content-type"] = "application/json";
+		body = JSON.stringify(opts.body);
+	}
+	let res;
+	try {
+		res = await fetchImpl(t.host + path, {
+			method: "POST",
+			headers,
+			body
+		});
+	} catch (e) {
+		throw new CliError(`network error contacting ${t.host}: ${e.message}`, 6);
+	}
+	let parsed = null;
+	const text = await res.text();
+	if (text.length > 0) try {
+		parsed = JSON.parse(text);
+	} catch {
+		parsed = text;
+	}
+	if (!res.ok) {
+		const { code, message } = describeUploadError(parsed);
+		if (res.status === 401) throw new CliError(`upload token rejected (401${code ? ` ${code}` : ""}): ${message}`, 2, {
+			status: res.status,
+			body: parsed
+		});
+		const exit = res.status >= 500 ? 6 : res.status === 403 ? 3 : 5;
+		throw new CliError(`binary upload failed (${res.status}${code ? ` ${code}` : ""}): ${message}`, exit, {
+			status: res.status,
+			body: parsed
+		});
+	}
+	return parsed;
+}
+/** Declare the per-platform manifest; returns the upload plan (resumable). */
+async function initBinaryUpload(t, toolId, body) {
+	return uploadRequest(t, `/api/v1/anna-apps/dev/executas/${encodeURIComponent(toolId)}/binaries/init`, { body });
+}
+/** Upload one raw chunk (≤ part_size). Idempotent per (platform, index). */
+async function uploadBinaryPart(t, toolId, uploadId, platform, index, bytes) {
+	const qs = `?platform=${encodeURIComponent(platform)}&index=${index}`;
+	await uploadRequest(t, `/api/v1/anna-apps/dev/executas/${encodeURIComponent(toolId)}/binaries/${encodeURIComponent(uploadId)}/part${qs}`, { rawBody: bytes });
+}
+/** Assemble + server-side verify + persist. Returns per-platform CDN URLs. */
+async function finalizeBinaryUpload(t, toolId, uploadId) {
+	return uploadRequest(t, `/api/v1/anna-apps/dev/executas/${encodeURIComponent(toolId)}/binaries/${encodeURIComponent(uploadId)}/finalize`, { body: {} });
+}
+
+//#endregion
+export { addTrustedPublisher, fetchGitHubIdToken, finalizeBinaryUpload, initBinaryUpload, listTrustedPublishers, mintUploadSession, mintUploadSessionViaOidc, removeTrustedPublisher, uploadBinaryPart };

package/dist/bridge-CzeSuRRL.js

@@ -0,0 +1,3 @@
+import { BridgeRequestError, PINNED_RUNTIME_VERSION, PythonBridge } from "./bridge-Dvck0e9c.js";
+
+export { PINNED_RUNTIME_VERSION, PythonBridge };