@anna-ai/cli 0.1.33 → 0.1.35

package/dist/{executa-dev-B5Uz982M.js → executa-dev-CAw5X64R.js}

@@ -1,5 +1,5 @@
 import "./nexus-root-BlPwOusj.js";
-import { parseExecutaSpec } from "./dev-Re6NyNDS.js";
+import { parseExecutaSpec } from "./dev-GUFWek03.js";
 import { isAbsolute, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
@@ -35,7 +35,7 @@ async function runExecutaDev(opts) {
 	const oneShot = !!(opts.describe || opts.health || opts.invoke);
 	const quiet = oneShot && (opts.json ?? false);
 	const { getAccount } = await import("./credentials-Chkoidh5.js");
-	const { ensureDevExecutaRegistered } = await import("./dev-app-cache-Dv1dZ_bw.js");
+	const { ensureDevExecutaRegistered } = await import("./dev-app-cache-B3Wa5t6X.js");
 	const needsRealMint = !opts.noSampling && !opts.mockSampling || !opts.noAgent && !opts.mockAgent || !opts.noImage && !opts.mockImage || !opts.noUpload && !opts.mockUpload || opts.storage === "real";
 	let effectiveAppSlug = opts.appSlug;
 	let autoRegistered = false;
@@ -57,7 +57,7 @@ async function runExecutaDev(opts) {
 			}
 		}
 	}
-	const { SamplingBridge } = await import("./sampling-XBIEYU4A.js");
+	const { SamplingBridge } = await import("./sampling-BpJcd6BC.js");
 	const simulateUnsupportedResponseFormat = opts.samplingUnsupportedFormat;
 	const sampling = opts.noSampling ? new SamplingBridge({ mode: "off" }) : opts.mockSampling ? new SamplingBridge({
 		mode: "mock",
@@ -69,7 +69,7 @@ async function runExecutaDev(opts) {
 		appSlug: effectiveAppSlug,
 		simulateUnsupportedResponseFormat
 	}) : new SamplingBridge({ mode: "off" });
-	const { AgentBridge } = await import("./agent-CzPryLi6.js");
+	const { AgentBridge } = await import("./agent-DAOr_aiE.js");
 	const agent = opts.noAgent ? new AgentBridge({ mode: "off" }) : opts.mockAgent ? new AgentBridge({
 		mode: "mock",
 		mockFile: opts.mockAgent
@@ -78,7 +78,7 @@ async function runExecutaDev(opts) {
 		account: opts.agentAccount ?? opts.samplingAccount,
 		appSlug: effectiveAppSlug
 	}) : new AgentBridge({ mode: "off" });
-	const { StorageBridge } = await import("./storage-BkF4XyI0.js");
+	const { StorageBridge } = await import("./storage-aii8EyPC.js");
 	const storageMode = opts.storage ?? (opts.mockStorage ? "mock" : "memory");
 	const storage = new StorageBridge({
 		mode: storageMode,
@@ -88,8 +88,8 @@ async function runExecutaDev(opts) {
 		scopes: opts.storageScopes ? opts.storageScopes.split(",").map((s) => s.trim()).filter(Boolean) : void 0,
 		pluginName: parsed.tool_id
 	});
-	const { ExecutaRunner } = await import("./runner-BxYjAmih.js");
-	const { ImageBridge } = await import("./image-BLPyUbGQ.js");
+	const { ExecutaRunner } = await import("./runner-Bka_coxb.js");
+	const { ImageBridge } = await import("./image-B4UrufYH.js");
 	const image = opts.noImage ? new ImageBridge({ mode: "off" }) : opts.mockImage ? new ImageBridge({
 		mode: "mock",
 		mockFile: opts.mockImage
@@ -98,7 +98,7 @@ async function runExecutaDev(opts) {
 		account: opts.imageAccount ?? opts.samplingAccount,
 		appSlug: effectiveAppSlug
 	}) : new ImageBridge({ mode: "off" });
-	const { HostUploadBridge } = await import("./host_upload-BVzAqvX1.js");
+	const { HostUploadBridge } = await import("./host_upload-DrbQ-vk2.js");
 	const hostUpload = opts.noUpload ? new HostUploadBridge({ mode: "off" }) : opts.mockUpload ? new HostUploadBridge({
 		mode: "mock",
 		mockFile: opts.mockUpload

package/dist/{executa-install-BW9jjY7u.js → executa-install-Dz7hBUsn.js}

@@ -1,5 +1,5 @@
-import { readExecutaIdentity } from "./executa-cache-Do1D7xC0.js";
-import { parseExecutaSpec } from "./dev-Re6NyNDS.js";
+import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
+import { parseExecutaSpec } from "./dev-GUFWek03.js";
 import { isAbsolute, join, resolve } from "node:path";
 import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";

package/dist/executa-install-nOFLBwxv.js

@@ -0,0 +1,7 @@
+import "./credentials-BTv2IfUZ.js";
+import "./nexus-root-BlPwOusj.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./dev-GUFWek03.js";
+import { runExecutaInstall } from "./executa-install-Dz7hBUsn.js";
+
+export { runExecutaInstall };

package/dist/executa-publish-B_7k1gOf.js

@@ -0,0 +1,11 @@
+import "./credentials-BTv2IfUZ.js";
+import "./client-D-_z1ALk.js";
+import "./_lifecycle-shared-RyiRITI5.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./manifest-CAF3_r1T.js";
+import "./executas-CvQY_w2U.js";
+import { runExecutaPublish } from "./executa-publish-kh4Ucd3o.js";
+import "./binary-upload-CKMU5Rfw.js";
+import "./executa-upload-binaries-DURJTXRI.js";
+
+export { runExecutaPublish };

package/dist/{executa-publish-Ah6J7jYd.js → executa-publish-kh4Ucd3o.js}

@@ -1,9 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-BhFed1B-.js";
-import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-Do1D7xC0.js";
-import { loadExecutaManifest } from "./manifest-DOMrcdCK.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
+import { loadExecutaManifest } from "./manifest-CAF3_r1T.js";
+import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-CvQY_w2U.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-DURJTXRI.js";
 import { join, relative, resolve, sep } from "node:path";
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
@@ -109,7 +110,7 @@ function distributionPayload(d) {
 async function runExecutaPublish(opts) {
 	return withErrorHandling(async () => {
 		const cwd = resolve(opts.cwd ?? process.cwd());
-		const manifest = loadExecutaManifest(cwd, opts.manifest);
+		const manifest = loadExecutaManifest(cwd, opts.manifest, opts.profile);
 		const isSkill = manifest.executa_type === "skill";
 		const { client, host, source } = resolveClient({ account: opts.account });
 		if (!opts.json && !opts.quiet) console.log(dim(`using PAT from ${source} (host=${host})`));
@@ -206,6 +207,21 @@ async function runExecutaPublish(opts) {
 			description: manifest.description,
 			...distributionPayload(manifest.distribution)
 		});
+		if (!isSkill && manifest.distribution?.binaryArtifacts && opts.freeze !== false) {
+			const upLog = (msg) => {
+				if (!opts.json && !opts.quiet) console.log(msg);
+			};
+			const up = await uploadExecutaBinaries({
+				client,
+				host,
+				dir: cwd,
+				manifest,
+				toolId,
+				log: upLog
+			});
+			upLog(green(`✓ binary artifacts published `) + dim(`(${up.uploaded.length} uploaded, ${up.skipped.length} cached)`));
+		}
+		if (!isSkill && manifest.distribution?.type === "binary" && manifest.distribution?.binaryUrls && !opts.json && !opts.quiet) console.log(yellow("! distribution.binary_urls uses the pull-mirror track: the platform fetches these URLs at cut/release, which requires them to be PUBLICLY downloadable. Private source URLs are deprecated — switch to distribution.binary_artifacts (direct upload) if this source is (or may become) private."));
 		const preFreeze = isSkill ? await getMySkill(client, executaId) : await getMyTool(client, executaId);
 		const currentVis = preFreeze.visibility ?? "private";
 		const targetVis = opts.publish ? "public" : currentVis === "public" ? "public" : "app_bundled";

package/dist/{executa-reads-BXDJWWw6.js → executa-reads-BmwT_Yjp.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-CUK2CE76.js";
-import { getMyTool, listMyTools, listToolVersions } from "./executas-BhFed1B-.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { getMyTool, listMyTools, listToolVersions } from "./executas-CvQY_w2U.js";
 import { bold, cyan, dim, green } from "kleur/colors";
 
 //#region src/commands/executa-reads.ts

package/dist/executa-trusted-publisher-tVwzjI2d.js

@@ -0,0 +1,91 @@
+import { canonicalHost } from "./credentials-BTv2IfUZ.js";
+import { CliError } from "./client-D-_z1ALk.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
+import { addTrustedPublisher, listTrustedPublishers, removeTrustedPublisher } from "./binary-upload-CKMU5Rfw.js";
+import { resolve } from "node:path";
+import { bold, cyan, dim, green } from "kleur/colors";
+
+//#region src/commands/executa-trusted-publisher.ts
+function resolveToolId(opts, host) {
+	if (opts.toolId) return opts.toolId;
+	const dir = resolve(opts.dir ?? process.cwd());
+	const identity = readExecutaIdentity(dir);
+	if (!identity) throw new CliError(`no .anna/executa.json identity cache in ${dir} — run \`anna-app executa publish\` / \`anna-app apps push\` once, or pass --tool-id`, 4);
+	if (identity.host !== canonicalHost(host)) throw new CliError(`identity cache in ${dir} belongs to ${identity.host}, but the current PAT targets ${canonicalHost(host)} — use --account or pass --tool-id`, 4);
+	return identity.tool_id;
+}
+function setup(opts) {
+	const { client, host } = resolveClient({
+		account: opts.account,
+		fetchImpl: opts.fetchImpl
+	});
+	return {
+		client,
+		host,
+		toolId: resolveToolId(opts, host)
+	};
+}
+function printPublisher(p) {
+	console.log(`  #${p.id} ${bold(p.repository)} ${cyan(p.workflow)}` + (p.environment ? dim(` env=${p.environment}`) : dim(" env=(any)")) + (p.last_used_at ? dim(` last used ${p.last_used_at}`) : dim(" never used")));
+}
+async function runTrustedPublisherAdd(opts) {
+	return withErrorHandling(async () => {
+		if (!/^[^/\s]+\/[^/\s]+$/.test(opts.repository)) throw new CliError(`--repository must be "owner/repo" (got "${opts.repository}")`, 2);
+		const { client, toolId } = setup(opts);
+		const created = await addTrustedPublisher(client, toolId, {
+			repository: opts.repository,
+			workflow: opts.workflow,
+			environment: opts.environment
+		});
+		if (opts.json) {
+			console.log(JSON.stringify({
+				tool_id: toolId,
+				trusted_publisher: created
+			}, null, 2));
+			return 0;
+		}
+		console.log(green(`✓ trusted publisher registered for ${toolId}:`));
+		printPublisher(created);
+		console.log(dim("→ that workflow can now run ") + cyan("anna-app executa upload-binaries --oidc") + dim(" with `permissions: id-token: write` and no PAT"));
+		return 0;
+	});
+}
+async function runTrustedPublisherList(opts) {
+	return withErrorHandling(async () => {
+		const { client, toolId } = setup(opts);
+		const rows = await listTrustedPublishers(client, toolId);
+		if (opts.json) {
+			console.log(JSON.stringify({
+				tool_id: toolId,
+				trusted_publishers: rows
+			}, null, 2));
+			return 0;
+		}
+		if (rows.length === 0) {
+			console.log(dim(`(no trusted publishers registered for ${toolId})`));
+			return 0;
+		}
+		console.log(bold(`trusted publishers for ${toolId}:`));
+		for (const p of rows) printPublisher(p);
+		return 0;
+	});
+}
+async function runTrustedPublisherRemove(opts) {
+	return withErrorHandling(async () => {
+		const { client, toolId } = setup(opts);
+		await removeTrustedPublisher(client, toolId, opts.publisherId);
+		if (opts.json) {
+			console.log(JSON.stringify({
+				tool_id: toolId,
+				removed: opts.publisherId
+			}, null, 2));
+			return 0;
+		}
+		console.log(green(`✓ removed trusted publisher #${opts.publisherId} from ${toolId}`));
+		return 0;
+	});
+}
+
+//#endregion
+export { runTrustedPublisherAdd, runTrustedPublisherList, runTrustedPublisherRemove };

package/dist/executa-upload-binaries-DURJTXRI.js

@@ -0,0 +1,277 @@
+import { canonicalHost } from "./credentials-BTv2IfUZ.js";
+import { CliError } from "./client-D-_z1ALk.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
+import { loadExecutaManifest } from "./manifest-CAF3_r1T.js";
+import { fetchGitHubIdToken, finalizeBinaryUpload, initBinaryUpload, mintUploadSession, mintUploadSessionViaOidc, uploadBinaryPart } from "./binary-upload-CKMU5Rfw.js";
+import { isAbsolute, resolve } from "node:path";
+import { closeSync, createReadStream, existsSync, openSync, readSync, statSync } from "node:fs";
+import { bold, cyan, dim, green, yellow } from "kleur/colors";
+import { createHash } from "node:crypto";
+
+//#region src/commands/executa-upload-binaries.ts
+const MAX_ARTIFACT_BYTES = 1024 * 1024 * 1024;
+const PART_RETRIES = 3;
+/** Expand `{version}` / `{platform}` / `{tool_id}` placeholders. */
+function expandArtifactPath(template, vars) {
+	return template.replaceAll("{version}", vars.version).replaceAll("{platform}", vars.platform).replaceAll("{tool_id}", vars.toolId);
+}
+async function sha256File(path) {
+	const hash = createHash("sha256");
+	for await (const chunk of createReadStream(path)) hash.update(chunk);
+	return hash.digest("hex");
+}
+/**
+* Resolve `distribution.binary_artifacts` into a validated, hashed upload
+* plan. Throws `CliError(4)` on missing files / oversize artifacts.
+*/
+async function resolveArtifactPlan(manifest, dir, toolId) {
+	const artifacts = manifest.distribution?.binaryArtifacts;
+	if (!artifacts || Object.keys(artifacts).length === 0) throw new CliError("executa.json declares no `distribution.binary_artifacts` — this command pushes LOCAL build artifacts directly to the platform. Add e.g.\n  \"distribution\": { \"type\": \"binary\", \"binary_artifacts\": {\n    \"darwin-arm64\": { \"path\": \"dist/my-tool-{version}-darwin-arm64.tar.gz\", \"entrypoint\": \"my-tool\" }\n  } }\n(projects using public `binary_urls` are pull-mirrored at `apps cut` instead)", 4);
+	const out = [];
+	for (const [platform, art] of Object.entries(artifacts)) {
+		const expanded = expandArtifactPath(art.path, {
+			version: manifest.version,
+			platform,
+			toolId
+		});
+		const absPath = isAbsolute(expanded) ? expanded : resolve(dir, expanded);
+		if (!existsSync(absPath)) throw new CliError(`binary_artifacts["${platform}"]: ${absPath} does not exist — build the artifact first (path placeholders: {version} {platform} {tool_id})`, 4);
+		const st = statSync(absPath);
+		if (!st.isFile()) throw new CliError(`binary_artifacts["${platform}"]: ${absPath} is not a file`, 4);
+		if (st.size <= 0 || st.size > MAX_ARTIFACT_BYTES) throw new CliError(`binary_artifacts["${platform}"]: ${absPath} is ${st.size} bytes — must be 1..${MAX_ARTIFACT_BYTES} (1 GiB)`, 4);
+		const filename = absPath.split(/[\\/]/).pop();
+		out.push({
+			platform,
+			absPath,
+			decl: {
+				filename,
+				sha256: await sha256File(absPath),
+				byte_size: st.size,
+				format: art.format,
+				entrypoint: art.entrypoint
+			}
+		});
+	}
+	out.sort((a, b) => a.platform.localeCompare(b.platform));
+	return out;
+}
+/** Read one part (byte range) of a file into a fresh buffer. */
+function readFilePart(path, start, length) {
+	const buf = Buffer.alloc(length);
+	const fd = openSync(path, "r");
+	try {
+		let off = 0;
+		while (off < length) {
+			const n = readSync(fd, buf, off, length - off, start + off);
+			if (n <= 0) break;
+			off += n;
+		}
+		if (off !== length) throw new CliError(`short read on ${path} (${off}/${length} bytes)`, 4);
+		return buf;
+	} finally {
+		closeSync(fd);
+	}
+}
+/**
+* Drive parts for every platform the init plan marked `upload`.
+* Sequential parts with per-part retry — resume comes from `uploaded_parts`.
+*/
+async function uploadPlannedParts(t, toolId, plan, init, log, retryDelayMs = 500) {
+	const outcome = {
+		uploadId: init.upload_id,
+		skipped: [],
+		uploaded: [],
+		partsSent: 0
+	};
+	for (const entry of plan) {
+		const asset = init.assets[entry.platform];
+		if (!asset) throw new CliError(`server plan is missing platform ${entry.platform}`, 6);
+		if (asset.status === "exists") {
+			outcome.skipped.push(entry.platform);
+			log(dim(`⏭ ${entry.platform}: skipped (content already published)`));
+			continue;
+		}
+		const partSize = asset.part_size;
+		const partCount = asset.part_count;
+		const already = new Set(asset.uploaded_parts ?? []);
+		if (already.size > 0) log(dim(`↩ ${entry.platform}: resuming — ${already.size}/${partCount} part(s) already received`));
+		for (let index = 0; index < partCount; index++) {
+			if (already.has(index)) continue;
+			const start = index * partSize;
+			const length = Math.min(partSize, entry.decl.byte_size - start);
+			const bytes = readFilePart(entry.absPath, start, length);
+			let lastError;
+			let sent = false;
+			for (let attempt = 1; attempt <= PART_RETRIES; attempt++) try {
+				await uploadBinaryPart(t, toolId, init.upload_id, entry.platform, index, bytes);
+				sent = true;
+				break;
+			} catch (e) {
+				lastError = e;
+				const status = e.status;
+				if (status && status < 500 && status !== 429) throw e;
+				if (attempt < PART_RETRIES && retryDelayMs > 0) await new Promise((r) => setTimeout(r, retryDelayMs * attempt));
+			}
+			if (!sent) throw lastError;
+			outcome.partsSent += 1;
+			log(dim(`↑ ${entry.platform}: part ${index + 1}/${partCount} (${length} bytes)`));
+		}
+		outcome.uploaded.push(entry.platform);
+	}
+	return outcome;
+}
+/**
+* Reusable direct-upload flow: hash artifacts → mint upload token → init →
+* push missing parts → finalize. Shared by the standalone
+* `executa upload-binaries` command, `executa publish` (pre-freeze upload)
+* and `apps cut` (bundled-executa pre-upload).
+*
+* Throws `CliError` on any failure; all-`exists` plans finalize instantly
+* (content-addressed idempotency), so re-runs are cheap.
+*/
+async function uploadExecutaBinaries(opts) {
+	const log = opts.log ?? (() => {});
+	const { host, dir, manifest, toolId } = opts;
+	log(dim(`hashing artifacts for ${toolId} (v${manifest.version})…`));
+	const plan = await resolveArtifactPlan(manifest, dir, toolId);
+	let uploadToken = opts.uploadToken;
+	if (!uploadToken) {
+		if (!opts.client) throw new CliError("uploadExecutaBinaries needs either a PAT client or a pre-minted uploadToken", 2);
+		({upload_token: uploadToken} = await mintUploadSession(opts.client, toolId));
+	}
+	const transport = {
+		host,
+		uploadToken,
+		fetchImpl: opts.fetchImpl
+	};
+	const assets = {};
+	for (const e of plan) assets[e.platform] = e.decl;
+	const init = await initBinaryUpload(transport, toolId, {
+		executa_version: manifest.version,
+		assets,
+		dry_run: opts.dryRun === true
+	});
+	const planOut = {};
+	for (const e of plan) planOut[e.platform] = {
+		...e.decl,
+		status: init.assets[e.platform]?.status
+	};
+	if (opts.dryRun) return {
+		toolId,
+		version: manifest.version,
+		uploadId: init.upload_id,
+		dryRun: true,
+		skipped: plan.filter((e) => init.assets[e.platform]?.status === "exists").map((e) => e.platform),
+		uploaded: [],
+		plan: planOut,
+		assets: {}
+	};
+	const outcome = await uploadPlannedParts(transport, toolId, plan, init, log);
+	const finalized = await finalizeBinaryUpload(transport, toolId, init.upload_id);
+	return {
+		toolId,
+		version: manifest.version,
+		uploadId: init.upload_id,
+		dryRun: false,
+		skipped: outcome.skipped,
+		uploaded: outcome.uploaded,
+		plan: planOut,
+		assets: finalized.assets
+	};
+}
+async function runExecutaUploadBinaries(opts) {
+	return withErrorHandling(async () => {
+		const dir = resolve(opts.dir ?? process.cwd());
+		const manifest = loadExecutaManifest(dir);
+		const log = (msg) => {
+			if (!opts.json) console.log(msg);
+		};
+		let client;
+		let host;
+		let uploadToken;
+		if (opts.oidc) {
+			const rawHost = opts.host ?? process.env.ANNA_APP_HOST;
+			if (!rawHost) throw new CliError("--oidc needs the Nexus host — pass --host or set ANNA_APP_HOST", 2);
+			host = canonicalHost(rawHost);
+			log(dim(`using GitHub OIDC trusted publishing (host=${host})`));
+		} else {
+			const resolved = resolveClient({
+				account: opts.account,
+				host: opts.host,
+				fetchImpl: opts.fetchImpl
+			});
+			client = resolved.client;
+			host = resolved.host;
+			log(dim(`using PAT from ${resolved.source} (host=${host})`));
+		}
+		let toolId = opts.toolId;
+		if (!toolId) {
+			const identity = readExecutaIdentity(dir);
+			if (!identity) throw new CliError(`no .anna/executa.json identity cache in ${dir} — run \`anna-app executa publish\` (standalone) or \`anna-app apps push\` (bundled) once to mint the executa, or pass --tool-id`, 4);
+			if (identity.host !== canonicalHost(host)) throw new CliError(`identity cache in ${dir} belongs to ${identity.host}, but the current target is ${canonicalHost(host)} — use --account/--host or re-publish against this host`, 4);
+			toolId = identity.tool_id;
+		}
+		if (opts.oidc) {
+			const idToken = await fetchGitHubIdToken({ fetchImpl: opts.fetchImpl });
+			({upload_token: uploadToken} = await mintUploadSessionViaOidc({
+				host,
+				toolId,
+				oidcToken: idToken,
+				fetchImpl: opts.fetchImpl
+			}));
+			log(dim("✓ upload token minted via OIDC exchange (no PAT involved)"));
+		}
+		const result = await uploadExecutaBinaries({
+			client,
+			host,
+			dir,
+			manifest,
+			toolId,
+			uploadToken,
+			dryRun: opts.dryRun === true,
+			fetchImpl: opts.fetchImpl,
+			log
+		});
+		if (opts.dryRun) {
+			if (opts.json) {
+				console.log(JSON.stringify({
+					tool_id: toolId,
+					version: manifest.version,
+					dry_run: true,
+					upload_id: result.uploadId,
+					assets: result.plan
+				}, null, 2));
+				return 0;
+			}
+			console.log(yellow(`[dry-run] upload plan for ${toolId} v${manifest.version}:`));
+			for (const [platform, decl] of Object.entries(result.plan)) {
+				const status = decl.status ?? "?";
+				console.log(`  ${platform}: ${status === "exists" ? green("exists (skip)") : cyan("upload")} ` + dim(`${decl.byte_size} bytes, sha256=${decl.sha256.slice(0, 12)}…`));
+			}
+			return 0;
+		}
+		if (opts.json) {
+			console.log(JSON.stringify({
+				tool_id: toolId,
+				version: manifest.version,
+				host,
+				upload_id: result.uploadId,
+				skipped: result.skipped,
+				uploaded: result.uploaded,
+				assets: result.assets
+			}, null, 2));
+			return 0;
+		}
+		console.log(green(`✓ ${toolId}: binaries published `) + dim(`(${result.uploaded.length} uploaded, ${result.skipped.length} cached)`));
+		for (const [platform, a] of Object.entries(result.assets)) {
+			console.log(`  ${bold(platform)} ${dim(`sha256=${a.sha256.slice(0, 12)}…`)}`);
+			console.log(`    ${cyan(a.url)}`);
+		}
+		console.log(dim("→ binaries are served from the platform CDN; `apps cut` / release will pin these hashes"));
+		return 0;
+	});
+}
+
+//#endregion
+export { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts };

package/dist/executa-upload-binaries-DrwpzQp3.js

@@ -0,0 +1,9 @@
+import "./credentials-BTv2IfUZ.js";
+import "./client-D-_z1ALk.js";
+import "./_lifecycle-shared-RyiRITI5.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./manifest-CAF3_r1T.js";
+import "./binary-upload-CKMU5Rfw.js";
+import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-DURJTXRI.js";
+
+export { runExecutaUploadBinaries };

package/dist/{listing-meta-BlY7XMrw.js → listing-meta-CtVtyaWu.js}

@@ -27,20 +27,29 @@ function isRemoteAsset(src) {
 /**
 * Build the metadata payload from the manifest (only defined fields). The
 * logo is handled separately and never appears here when sourced from a file.
+*
+* Optional listing URLs (cover/homepage/support/privacy) are *clearable*:
+* `loadAppManifest` normalises an explicit `""`/`null` in the local metadata
+* file to the `""` sentinel, which is forwarded on the PATCH so the server
+* value is emptied (the store UI hides falsy links). An absent key stays
+* `undefined` and is omitted from the payload — "leave unchanged".
 */
 function buildMeta(manifest) {
 	const meta = {};
 	const add = (key, value) => {
 		if (value !== void 0 && value !== null && value !== "") meta[key] = value;
 	};
+	const addClearable = (key, value) => {
+		if (value !== void 0) meta[key] = value;
+	};
 	add("name", manifest.name);
 	add("category", manifest.category);
 	add("tagline", manifest.tagline);
 	add("description", manifest.description);
-	add("cover_url", manifest.coverUrl);
-	add("homepage_url", manifest.homepageUrl);
-	add("support_url", manifest.supportUrl);
-	add("privacy_url", manifest.privacyUrl);
+	addClearable("cover_url", manifest.coverUrl);
+	addClearable("homepage_url", manifest.homepageUrl);
+	addClearable("support_url", manifest.supportUrl);
+	addClearable("privacy_url", manifest.privacyUrl);
 	add("pricing_model", manifest.pricingModel);
 	return meta;
 }