@anna-ai/cli 0.1.34 → 0.1.36

package/dist/{app-bundle-upload-CrBRnzf4.js → app-bundle-upload-DmVKWAj9.js}

@@ -1,6 +1,6 @@
 import { finalizeBundle, finalizeWorkingBundle, getBundle, initBundle, initWorkingBundle, uploadBundleFile, uploadWorkingBundleFile } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
-import { canonicalize } from "./executa-publish-CGz5wM1Q.js";
+import { canonicalize } from "./executa-publish-kh4Ucd3o.js";
 import { join, relative, sep } from "node:path";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";

package/dist/{apps-cut-C14A3V93.js → apps-cut-DU9B7ZV8.js}

@@ -5,15 +5,15 @@ import { CliError } from "./client-D-_z1ALk.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
 import { readExecutasLock, writeExecutasLock } from "./bundled-executas-rSIkaA6-.js";
-import { loadAppManifest, loadExecutaManifest } from "./manifest-DlIcwLQs.js";
+import { loadAppManifest, loadExecutaManifest } from "./manifest-CAF3_r1T.js";
 import "./executas-CvQY_w2U.js";
-import "./executa-publish-CGz5wM1Q.js";
+import "./executa-publish-kh4Ucd3o.js";
 import "./binary-upload-CKMU5Rfw.js";
-import { uploadExecutaBinaries } from "./executa-upload-binaries-Do5Sq64E.js";
-import "./dev-GUFWek03.js";
-import "./executa-install-Dz7hBUsn.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-DURJTXRI.js";
+import "./dev-CNFzSiD9.js";
+import "./executa-install-4hdrbusW.js";
 import "./app-cache-Cr3tKbux.js";
-import { resolveAppBySlugOrCache } from "./working-orchestration-B8KdAh5S.js";
+import { resolveAppBySlugOrCache } from "./working-orchestration-B_4WOk3X.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";

package/dist/{apps-discard-B49iiOX6.js → apps-discard-BgI0e8FR.js}

@@ -5,15 +5,15 @@ import "./client-D-_z1ALk.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import "./executa-cache-BFoUtb4J.js";
 import "./bundled-executas-rSIkaA6-.js";
-import "./manifest-DlIcwLQs.js";
+import "./manifest-CAF3_r1T.js";
 import "./executas-CvQY_w2U.js";
-import "./executa-publish-CGz5wM1Q.js";
+import "./executa-publish-kh4Ucd3o.js";
 import "./binary-upload-CKMU5Rfw.js";
-import "./executa-upload-binaries-Do5Sq64E.js";
-import "./dev-GUFWek03.js";
-import "./executa-install-Dz7hBUsn.js";
+import "./executa-upload-binaries-DURJTXRI.js";
+import "./dev-CNFzSiD9.js";
+import "./executa-install-4hdrbusW.js";
 import "./app-cache-Cr3tKbux.js";
-import { resolveAppBySlugOrCache } from "./working-orchestration-B8KdAh5S.js";
+import { resolveAppBySlugOrCache } from "./working-orchestration-B_4WOk3X.js";
 import { dim, green, yellow } from "kleur/colors";
 
 //#region src/commands/apps-discard.ts

package/dist/{apps-publish-qc_E4b_R.js → apps-publish--EmBa0zN.js}

@@ -3,11 +3,11 @@ import { createApp, createVersion, findAppBySlug, getApp } from "./apps-DlVsVHQ5
 import { CliError } from "./client-D-_z1ALk.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-rSIkaA6-.js";
-import { loadAppManifest } from "./manifest-DlIcwLQs.js";
-import { bumpVersion, bundleHash, manifestHash, rewriteVersion, runExecutaPublish } from "./executa-publish-CGz5wM1Q.js";
+import { loadAppManifest } from "./manifest-CAF3_r1T.js";
+import { bumpVersion, bundleHash, manifestHash, rewriteVersion, runExecutaPublish } from "./executa-publish-kh4Ucd3o.js";
 import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
-import { syncAppListingMeta } from "./listing-meta-C0HsNjIB.js";
-import { isExistingDir, uploadAppBundle } from "./app-bundle-upload-CrBRnzf4.js";
+import { syncAppListingMeta } from "./listing-meta-CtVtyaWu.js";
+import { isExistingDir, uploadAppBundle } from "./app-bundle-upload-DmVKWAj9.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
 
@@ -75,6 +75,7 @@ async function runAppsPublish(opts) {
 					cwd: execCwd,
 					account: opts.account,
 					quiet: true,
+					profile: opts.profile,
 					capture: (r) => {
 						captured = r;
 					}

package/dist/{apps-publish-B9CnifEx.js → apps-publish-B7reDBe1.js}

@@ -4,14 +4,14 @@ import "./client-D-_z1ALk.js";
 import "./_lifecycle-shared-RyiRITI5.js";
 import "./executa-cache-BFoUtb4J.js";
 import "./bundled-executas-rSIkaA6-.js";
-import "./manifest-DlIcwLQs.js";
+import "./manifest-CAF3_r1T.js";
 import "./executas-CvQY_w2U.js";
-import "./executa-publish-CGz5wM1Q.js";
+import "./executa-publish-kh4Ucd3o.js";
 import "./binary-upload-CKMU5Rfw.js";
-import "./executa-upload-binaries-Do5Sq64E.js";
+import "./executa-upload-binaries-DURJTXRI.js";
 import "./app-cache-Cr3tKbux.js";
-import "./listing-meta-C0HsNjIB.js";
-import "./app-bundle-upload-CrBRnzf4.js";
-import { runAppsPublish } from "./apps-publish-qc_E4b_R.js";
+import "./listing-meta-CtVtyaWu.js";
+import "./app-bundle-upload-DmVKWAj9.js";
+import { runAppsPublish } from "./apps-publish--EmBa0zN.js";
 
 export { runAppsPublish };

package/dist/{apps-push-DnINd0Cx.js → apps-push-BOGVEDQ3.js}

@@ -5,17 +5,17 @@ import { CliError } from "./client-D-_z1ALk.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import "./executa-cache-BFoUtb4J.js";
 import "./bundled-executas-rSIkaA6-.js";
-import { loadAppManifest } from "./manifest-DlIcwLQs.js";
+import { loadAppManifest } from "./manifest-CAF3_r1T.js";
 import "./executas-CvQY_w2U.js";
-import { bumpVersion, bundleHash, manifestHash, rewriteVersion } from "./executa-publish-CGz5wM1Q.js";
+import { bumpVersion, bundleHash, manifestHash, rewriteVersion } from "./executa-publish-kh4Ucd3o.js";
 import "./binary-upload-CKMU5Rfw.js";
-import "./executa-upload-binaries-Do5Sq64E.js";
-import "./dev-GUFWek03.js";
-import "./executa-install-Dz7hBUsn.js";
+import "./executa-upload-binaries-DURJTXRI.js";
+import "./dev-CNFzSiD9.js";
+import "./executa-install-4hdrbusW.js";
 import "./app-cache-Cr3tKbux.js";
-import { installLocalBundledShims, resolveAppIdentity, resolveBundledExecutas } from "./working-orchestration-B8KdAh5S.js";
-import { syncAppListingMeta } from "./listing-meta-C0HsNjIB.js";
-import { isExistingDir, uploadWorkingBundle } from "./app-bundle-upload-CrBRnzf4.js";
+import { installLocalBundledShims, resolveAppIdentity, resolveBundledExecutas } from "./working-orchestration-B_4WOk3X.js";
+import { syncAppListingMeta } from "./listing-meta-CtVtyaWu.js";
+import { isExistingDir, uploadWorkingBundle } from "./app-bundle-upload-DmVKWAj9.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
 
@@ -43,6 +43,7 @@ async function runAppsPush(opts) {
 			dryRun: opts.dryRun,
 			freeze: false,
 			lockSource: "working",
+			profile: opts.profile,
 			account: opts.account,
 			json: opts.json
 		});
@@ -51,6 +52,7 @@ async function runAppsPush(opts) {
 			manifest,
 			cwd,
 			resolved,
+			profile: opts.profile,
 			json: opts.json
 		});
 		const identity = await resolveAppIdentity({

package/dist/{apps-release--7R2cmPg.js → apps-release-J-Sjkoym.js}

@@ -59,7 +59,7 @@ async function runAppsRelease(opts) {
 		if (!target) {
 			if (opts.allowCreate) {
 				if (!opts.json) console.log(yellow(`version ${opts.version} not found remotely; running 'apps publish' first (--allow-create)…`));
-				const { runAppsPublish } = await import("./apps-publish-B9CnifEx.js");
+				const { runAppsPublish } = await import("./apps-publish-B7reDBe1.js");
 				const code = await runAppsPublish({
 					cwd: opts.cwd,
 					account: opts.account,

package/dist/{apps-rename-slug-CGykNHM5.js → apps-rename-slug-DYrk4Zpt.js}

@@ -2,7 +2,7 @@ import "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, patchApp } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
 import { reportError, resolveClient } from "./_lifecycle-shared-RyiRITI5.js";
-import { loadAppManifest } from "./manifest-DlIcwLQs.js";
+import { loadAppManifest } from "./manifest-CAF3_r1T.js";
 import { readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { writeFileSync } from "node:fs";
 import { bold, dim, green, red, yellow } from "kleur/colors";

package/dist/{apps-sync-meta-dy9j-5n8.js → apps-sync-meta-CL2PCMCv.js}

@@ -2,9 +2,9 @@ import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
-import { loadAppManifest } from "./manifest-DlIcwLQs.js";
+import { loadAppManifest } from "./manifest-CAF3_r1T.js";
 import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
-import { syncAppListingMeta } from "./listing-meta-C0HsNjIB.js";
+import { syncAppListingMeta } from "./listing-meta-CtVtyaWu.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green } from "kleur/colors";
 
@@ -70,6 +70,8 @@ async function runAppsSyncMeta(opts) {
 		console.log(`  ${dim("name     :")} ${manifest.name}`);
 		if (manifest.category) console.log(`  ${dim("category :")} ${manifest.category}`);
 		if (manifest.tagline) console.log(`  ${dim("tagline  :")} ${manifest.tagline}`);
+		const cleared = Object.entries(meta).filter(([, v]) => v === "").map(([k]) => k);
+		if (cleared.length > 0) console.log(`  ${dim("cleared  :")} ${cleared.join(", ")}`);
 		if (sync.logoUpload?.logo_url) console.log(`  ${dim("logo     :")} ${sync.logoUpload.logo_url}`);
 		if (sync.screenshotUploads && sync.screenshotUploads.length > 0) console.log(`  ${dim("shots    :")} ${sync.screenshotUploads.length} uploaded`);
 		console.log(bold(cyan(`status: ${finalApp.status}`)));

package/dist/{bridge-Dvck0e9c.js → bridge-D6c4Asou.js}

@@ -9,7 +9,7 @@ import { createInterface } from "node:readline";
 * `uvx <pkg>@<version>` so end users always run the dispatcher version
 * the CLI was tested against.
 */
-const PINNED_RUNTIME_VERSION = "0.2.0a12";
+const PINNED_RUNTIME_VERSION = "0.2.0a13";
 /**
 * Throwable from a {@link RequestHandler} to send a structured JSON-RPC
 * error back to the python bridge with a stable string ``code`` (e.g.

package/dist/bridge-DlrXzdZQ.js

@@ -0,0 +1,3 @@
+import { BridgeRequestError, PINNED_RUNTIME_VERSION, PythonBridge } from "./bridge-D6c4Asou.js";
+
+export { PINNED_RUNTIME_VERSION, PythonBridge };

package/dist/cli.js

@@ -145,6 +145,10 @@ function hostApiAllows(manifest, ns, method) {
 		const declared = (manifest.required_executas?.length ?? 0) + (manifest.optional_executas?.length ?? 0);
 		return declared > 0;
 	}
+	if (ns === "credentials" && (method === "list_accounts" || method === "get_token")) {
+		const providers = grants.credentials;
+		return !!providers && providers.length > 0;
+	}
 	const methods = grants[ns];
 	if (!methods || methods.length === 0) return false;
 	if (methods.includes("*")) return true;
@@ -470,7 +474,7 @@ program.command("validate").description("Run schema + ACL checks on a manifest+b
 	process.exit(code);
 });
 program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").option("--executa <spec>", "Explicit executa registration; repeatable. Spec: comma-separated key=value (dir=<path>[,tool_id=<id>][,type=python|node|go|binary][,command=\"<argv>\"]). When only `dir=` is given, the executa is auto-detected from executa.json / pyproject.toml / package.json / go.mod. Overrides directory auto-discovery under <manifest-dir>/executas/.", (val, prev) => prev ? [...prev, val] : [val]).option("--no-llm", "Disable LLM bridge (anna.llm/agent return llm_disabled)").option("--mock-llm <fixture>", "Serve canned LLM responses from a JSONL fixture").option("--llm-account <host>", "Saved account host to use (default: current)").option("--llm-app-slug <slug>", "Override the manifest slug used to register / look up the dev AnnaApp (default: manifest.slug)").option("--storage <mode>", "Storage backend: \"legacy\" (in-memory runtime_state, default) or \"aps\" (real nexus APS via /api/v1/storage/* — requires `anna-app login`).", "legacy").action(async (opts) => {
-	const { runDev, parseExecutaSpec } = await import("./dev-CZLOk2qE.js");
+	const { runDev, parseExecutaSpec } = await import("./dev-D4KOnT0B.js");
 	const cwd = opts.cwd ?? process.cwd();
 	let executas;
 	if (opts.executa && opts.executa.length > 0) {
@@ -529,7 +533,7 @@ fixture.command("replay <file>").description("Dry-run replay of a harness record
 	process.exit(code);
 });
 program.command("doctor").description("Check environment for `anna-app dev` (uv, matrix-nexus, dev key)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (optional)").action(async (opts) => {
-	const { runDoctor } = await import("./doctor-C3Nx8E2L.js");
+	const { runDoctor } = await import("./doctor-DtQQOPdR.js");
 	const code = await runDoctor({ matrixNexusRoot: opts.matrixNexusRoot });
 	process.exit(code);
 });
@@ -592,7 +596,7 @@ executa.command("register").description("Register a HARNESS AnnaApp(kind=executa
 	process.exit(code);
 });
 executa.command("install").description("Install a local-dev shim for an Executa under its minted tool_id so the Agent can discover it via 'Rediscover Local' (for distribution_type: local). Resolves the tool_id from .anna/executa.json (written by `executa publish` / `apps push`) unless --tool-id is given.").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Install the shim under this exact id (default: minted id from .anna/executa.json, else executa.json tool_id)").option("--bin-dir <path>", "Install dir for the shim (default: ~/.anna/executa/bin)").option("--force", "Overwrite an existing shim of the same name", false).option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaInstall } = await import("./executa-install-nOFLBwxv.js");
+	const { runExecutaInstall } = await import("./executa-install-hO5EVXL9.js");
 	const code = await runExecutaInstall({
 		dir: opts.dir,
 		toolId: opts.toolId,
@@ -603,7 +607,7 @@ executa.command("install").description("Install a local-dev shim for an Executa
 	process.exit(code);
 });
 executa.command("dev").description("Run one Executa plugin in isolation (REPL or one-shot describe/invoke)").option("--dir <path>", "Executa project dir (default: CWD)").option("--spec <spec>", "Override discovery: comma-separated key=value (tool_id=...,type=...,command=\"...\")").option("--describe", "Print MANIFEST and exit", false).option("--health", "Print health and exit", false).option("--invoke <tool>", "Invoke one tool and exit").option("--args <json>", "JSON object passed as tool arguments", "{}").option("--json", "One-shot: emit compact JSON (no banners)", false).option("--no-sampling", "Hard-disable sampling reverse RPC (returns sampling_disabled)").option("--mock-sampling <fixture>", "Serve canned sampling responses from a JSONL fixture (offline)").option("--sampling-unsupported-format", "Simulate a model without json_schema support — exercises responseFormat onUnsupported branches (-32010 / downgrade)").option("--app-slug <slug>", "Forward sampling to nexus on behalf of this dev AnnaApp slug").option("--sampling-account <host>", "Saved account host for nexus sampling (default: current)").option("--no-agent", "Hard-disable agent reverse RPC (returns agent_not_granted)").option("--mock-agent <fixture>", "Serve canned agent/* responses from a JSONL fixture (offline)").option("--agent-account <host>", "Saved account host for nexus agent (default: --sampling-account or current)").option("--storage <mode>", "Storage backend: off | memory | mock | real (default: memory)").option("--mock-storage <fixture>", "Serve canned storage/* + files/* responses from a JSONL fixture").option("--storage-account <host>", "Saved account host for nexus storage (default: --sampling-account or current)").option("--storage-scopes <list>", "Comma-separated scopes for real storage tokens (default: user,app,tool)").option("--no-image", "Hard-disable image reverse RPC (returns image_not_granted)").option("--mock-image <fixture>", "Serve canned image/generate + image/edit responses from a JSONL fixture").option("--image-account <host>", "Saved account host for nexus image (default: --sampling-account or current)").option("--no-upload", "Hard-disable host/uploadFile reverse RPC (returns upload_not_granted)").option("--mock-upload <fixture>", "Serve canned host/uploadFile responses from a JSONL fixture").option("--upload-account <host>", "Saved account host for nexus uploads (default: --sampling-account or current)").action(async (opts) => {
-	const { runExecutaDev } = await import("./executa-dev-CAw5X64R.js");
+	const { runExecutaDev } = await import("./executa-dev-BWApRNpg.js");
 	const storageMode = opts.storage === void 0 ? void 0 : (() => {
 		const m = opts.storage;
 		if (m === "off" || m === "memory" || m === "mock" || m === "real") return m;
@@ -648,7 +652,7 @@ apps.command("list").description("List the Anna Apps you authored, with lifecycl
 	}));
 });
 apps.command("rename-slug <new-slug>").description("Rename an app's public slug (DRAFT/REJECTED, never-published, zero installs only). Updates local app.json + .anna/app.json on success.").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (newSlug, opts) => {
-	const { runAppsRenameSlug } = await import("./apps-rename-slug-CGykNHM5.js");
+	const { runAppsRenameSlug } = await import("./apps-rename-slug-DYrk4Zpt.js");
 	process.exit(await runAppsRenameSlug({
 		newSlug,
 		cwd: opts.cwd,
@@ -657,7 +661,7 @@ apps.command("rename-slug <new-slug>").description("Rename an app's public slug
 		json: opts.json
 	}));
 });
-apps.command("publish").description("Publish or update an Anna App (manifest.json in cwd)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--dry-run", "Resolve identity + diff but don't upload", false).option("--executa-id <handle=id>", "Override a bundled executa handle with a real tool_id (repeatable)", (val, prev) => [...prev, val], []).option("--skip-executa-publish", "Use cached/overridden tool_ids; don't recursively publish bundled executas", false).option("--no-bundled-executas", "Disable bundled-executa orchestration (legacy behaviour)").option("--no-bundle", "Skip UI bundle upload even if the manifest declares a UI").option("--bundle-dir <dir>", "UI bundle directory (default: <cwd>/bundle)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+apps.command("publish").description("Publish or update an Anna App (manifest.json in cwd)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--dry-run", "Resolve identity + diff but don't upload", false).option("--executa-id <handle=id>", "Override a bundled executa handle with a real tool_id (repeatable)", (val, prev) => [...prev, val], []).option("--skip-executa-publish", "Use cached/overridden tool_ids; don't recursively publish bundled executas", false).option("--no-bundled-executas", "Disable bundled-executa orchestration (legacy behaviour)").option("--no-bundle", "Skip UI bundle upload even if the manifest declares a UI").option("--bundle-dir <dir>", "UI bundle directory (default: <cwd>/bundle)").option("--profile <name>", "Select a bundled executa `distribution.profiles` entry for this run (overrides each executa.json `active`, e.g. --profile local)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
 	if (opts.bump && ![
 		"patch",
 		"minor",
@@ -666,7 +670,7 @@ apps.command("publish").description("Publish or update an Anna App (manifest.jso
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runAppsPublish } = await import("./apps-publish-B9CnifEx.js");
+	const { runAppsPublish } = await import("./apps-publish-B7reDBe1.js");
 	process.exit(await runAppsPublish({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -678,11 +682,12 @@ apps.command("publish").description("Publish or update an Anna App (manifest.jso
 		noBundledExecutas: opts.bundledExecutas === false,
 		noBundle: opts.bundle === false,
 		bundleDir: opts.bundleDir,
+		profile: opts.profile,
 		account: opts.account,
 		json: opts.json
 	}));
 });
-apps.command("push").description("Upsert the mutable working draft (manifest + bundle, no freeze)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--dry-run", "Resolve identity + diff but don't upsert", false).option("--executa-id <handle=id>", "Override a bundled executa handle with a real tool_id (repeatable)", (val, prev) => [...prev, val], []).option("--skip-executa-publish", "Use cached/overridden tool_ids; don't recursively register bundled executas", false).option("--no-bundled-executas", "Disable bundled-executa orchestration (legacy behaviour)").option("--no-bundle", "Skip working UI bundle upload even if the manifest declares a UI").option("--bundle-dir <dir>", "UI bundle directory (default: <cwd>/bundle)").option("--no-install-local", "Don't install local-dev shims for bundled `local` executas (skip Rediscover-Local prep)").option("--if-match <revision>", "Optimistic-lock: require this working revision").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+apps.command("push").description("Upsert the mutable working draft (manifest + bundle, no freeze)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--dry-run", "Resolve identity + diff but don't upsert", false).option("--executa-id <handle=id>", "Override a bundled executa handle with a real tool_id (repeatable)", (val, prev) => [...prev, val], []).option("--skip-executa-publish", "Use cached/overridden tool_ids; don't recursively register bundled executas", false).option("--no-bundled-executas", "Disable bundled-executa orchestration (legacy behaviour)").option("--no-bundle", "Skip working UI bundle upload even if the manifest declares a UI").option("--bundle-dir <dir>", "UI bundle directory (default: <cwd>/bundle)").option("--no-install-local", "Don't install local-dev shims for bundled `local` executas (skip Rediscover-Local prep)").option("--profile <name>", "Select a bundled executa `distribution.profiles` entry for this push (overrides each executa.json `active`; e.g. --profile local for a dev push while `active` stays `binary`)").option("--if-match <revision>", "Optimistic-lock: require this working revision").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
 	if (opts.bump && ![
 		"patch",
 		"minor",
@@ -699,7 +704,7 @@ apps.command("push").description("Upsert the mutable working draft (manifest + b
 			process.exit(2);
 		}
 	}
-	const { runAppsPush } = await import("./apps-push-DnINd0Cx.js");
+	const { runAppsPush } = await import("./apps-push-BOGVEDQ3.js");
 	process.exit(await runAppsPush({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -712,13 +717,14 @@ apps.command("push").description("Upsert the mutable working draft (manifest + b
 		noBundle: opts.bundle === false,
 		bundleDir: opts.bundleDir,
 		noInstallLocal: opts.installLocal === false,
+		profile: opts.profile,
 		ifMatch,
 		account: opts.account,
 		json: opts.json
 	}));
 });
 apps.command("cut <version>").description("Snapshot the working draft into an immutable version (freeze deps)").option("--changelog <text>", "Override the working draft changelog for this version").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't cut", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
-	const { runAppsCut } = await import("./apps-cut-C14A3V93.js");
+	const { runAppsCut } = await import("./apps-cut-DU9B7ZV8.js");
 	process.exit(await runAppsCut({
 		version,
 		changelog: opts.changelog,
@@ -730,7 +736,7 @@ apps.command("cut <version>").description("Snapshot the working draft into an im
 	}));
 });
 apps.command("discard").description("Drop the mutable working draft (leaves cut versions intact)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't discard", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsDiscard } = await import("./apps-discard-B49iiOX6.js");
+	const { runAppsDiscard } = await import("./apps-discard-BgI0e8FR.js");
 	process.exit(await runAppsDiscard({
 		slug: opts.slug,
 		cwd: opts.cwd,
@@ -740,7 +746,7 @@ apps.command("discard").description("Drop the mutable working draft (leaves cut
 	}));
 });
 apps.command("release <version>").description("Freeze & publish an existing remote version (go live)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--allow-create", "If the version isn't on the server, run 'apps publish' first, then release", false).option("--dry-run", "Resolve target + pre-flight but don't publish", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
-	const { runAppsRelease } = await import("./apps-release--7R2cmPg.js");
+	const { runAppsRelease } = await import("./apps-release-J-Sjkoym.js");
 	process.exit(await runAppsRelease({
 		version,
 		slug: opts.slug,
@@ -752,7 +758,7 @@ apps.command("release <version>").description("Freeze & publish an existing remo
 	}));
 });
 apps.command("sync-meta").description("Push mutable store metadata (name/tagline/…) from the manifest").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--logo <path>", "Local logo file to upload (overrides app.json logo_file)").option("--dry-run", "Print the metadata diff but don't PATCH", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsSyncMeta } = await import("./apps-sync-meta-dy9j-5n8.js");
+	const { runAppsSyncMeta } = await import("./apps-sync-meta-CL2PCMCv.js");
 	process.exit(await runAppsSyncMeta({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -857,7 +863,7 @@ executa.command("versions <ref>").description("List immutable version snapshots
 		json: opts.json
 	}));
 });
-executa.command("publish").description("Mint or update an Executa (executa.json in cwd)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "executa.json path", "executa.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--publish", "After freezing the version, flip visibility to PUBLIC", false).option("--dry-run", "Resolve identity + diff but don't upload", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+executa.command("publish").description("Mint or update an Executa (executa.json in cwd)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "executa.json path", "executa.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--publish", "After freezing the version, flip visibility to PUBLIC", false).option("--dry-run", "Resolve identity + diff but don't upload", false).option("--profile <name>", "Select a `distribution.profiles` entry for this run (overrides executa.json `active`, e.g. --profile local)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
 	if (opts.bump && ![
 		"patch",
 		"minor",
@@ -866,7 +872,7 @@ executa.command("publish").description("Mint or update an Executa (executa.json
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runExecutaPublish } = await import("./executa-publish-DHICU6S0.js");
+	const { runExecutaPublish } = await import("./executa-publish-B_7k1gOf.js");
 	process.exit(await runExecutaPublish({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -874,12 +880,13 @@ executa.command("publish").description("Mint or update an Executa (executa.json
 		noWrite: opts.write === false,
 		publish: opts.publish,
 		dryRun: opts.dryRun,
+		profile: opts.profile,
 		account: opts.account,
 		json: opts.json
 	}));
 });
 executa.command("upload-binaries").description("Push the local binary_artifacts declared in executa.json straight to the platform CDN (no public source URL needed — works for private repos). Requires a minted identity (.anna/executa.json from `executa publish` / `apps push`) or --tool-id.").option("--dir <path>", "Executa project dir (default: CWD)").option("--dry-run", "Hash artifacts + validate the plan server-side without uploading", false).option("--oidc", "Mint the upload token from the GitHub Actions OIDC id-token instead of a PAT (zero long-term secrets; needs `permissions: id-token: write` and a registered trusted publisher)", false).option("--tool-id <id>", "Explicit tool_id (skip the identity cache)").option("--host <url>", "Nexus host (required with --oidc unless ANNA_APP_HOST is set)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaUploadBinaries } = await import("./executa-upload-binaries-CYMtWJU7.js");
+	const { runExecutaUploadBinaries } = await import("./executa-upload-binaries-DrwpzQp3.js");
 	process.exit(await runExecutaUploadBinaries({
 		dir: opts.dir,
 		dryRun: opts.dryRun,
@@ -993,7 +1000,7 @@ program.command("publish").description("Auto-detect cwd and publish (apps publis
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runTopLevelPublish } = await import("./publish-DW_D3uQ4.js");
+	const { runTopLevelPublish } = await import("./publish-DwIJWl46.js");
 	process.exit(await runTopLevelPublish({
 		cwd: opts.cwd,
 		bump: opts.bump,

package/dist/{dev-GUFWek03.js → dev-CNFzSiD9.js}

@@ -49,8 +49,8 @@ async function runDev(opts) {
 		}
 		process.env.ANNA_APP_RUNTIME_STORAGE_MODE = "aps";
 	}
-	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-CzeSuRRL.js");
-	const { HarnessServer } = await import("./server-BHWGGZsf.js");
+	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-DlrXzdZQ.js");
+	const { HarnessServer } = await import("./server-CB-oHVfr.js");
 	const bridge = new PythonBridge({
 		mode,
 		matrixNexusRoot: matrixNexusRoot ?? void 0,

package/dist/dev-D4KOnT0B.js

@@ -0,0 +1,4 @@
+import "./nexus-root-BlPwOusj.js";
+import { parseExecutaSpec, runDev } from "./dev-CNFzSiD9.js";
+
+export { parseExecutaSpec, runDev };

package/dist/{doctor-C3Nx8E2L.js → doctor-DtQQOPdR.js}

@@ -1,5 +1,5 @@
 import { findMatrixNexusRoot, nexusSchemaDir } from "./nexus-root-BlPwOusj.js";
-import { PINNED_RUNTIME_VERSION } from "./bridge-Dvck0e9c.js";
+import { PINNED_RUNTIME_VERSION } from "./bridge-D6c4Asou.js";
 import { resolve } from "node:path";
 import { existsSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";

package/dist/{executa-dev-CAw5X64R.js → executa-dev-BWApRNpg.js}

@@ -1,5 +1,5 @@
 import "./nexus-root-BlPwOusj.js";
-import { parseExecutaSpec } from "./dev-GUFWek03.js";
+import { parseExecutaSpec } from "./dev-CNFzSiD9.js";
 import { isAbsolute, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";

package/dist/{executa-install-Dz7hBUsn.js → executa-install-4hdrbusW.js}

@@ -1,5 +1,5 @@
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { parseExecutaSpec } from "./dev-GUFWek03.js";
+import { parseExecutaSpec } from "./dev-CNFzSiD9.js";
 import { isAbsolute, join, resolve } from "node:path";
 import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";

package/dist/executa-install-hO5EVXL9.js

@@ -0,0 +1,7 @@
+import "./credentials-BTv2IfUZ.js";
+import "./nexus-root-BlPwOusj.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./dev-CNFzSiD9.js";
+import { runExecutaInstall } from "./executa-install-4hdrbusW.js";
+
+export { runExecutaInstall };

package/dist/{executa-publish-DHICU6S0.js → executa-publish-B_7k1gOf.js}

@@ -2,10 +2,10 @@ import "./credentials-BTv2IfUZ.js";
 import "./client-D-_z1ALk.js";
 import "./_lifecycle-shared-RyiRITI5.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./manifest-DlIcwLQs.js";
+import "./manifest-CAF3_r1T.js";
 import "./executas-CvQY_w2U.js";
-import { runExecutaPublish } from "./executa-publish-CGz5wM1Q.js";
+import { runExecutaPublish } from "./executa-publish-kh4Ucd3o.js";
 import "./binary-upload-CKMU5Rfw.js";
-import "./executa-upload-binaries-Do5Sq64E.js";
+import "./executa-upload-binaries-DURJTXRI.js";
 
 export { runExecutaPublish };

package/dist/{executa-publish-CGz5wM1Q.js → executa-publish-kh4Ucd3o.js}

@@ -2,9 +2,9 @@ import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-D-_z1ALk.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-DlIcwLQs.js";
+import { loadExecutaManifest } from "./manifest-CAF3_r1T.js";
 import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-CvQY_w2U.js";
-import { uploadExecutaBinaries } from "./executa-upload-binaries-Do5Sq64E.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-DURJTXRI.js";
 import { join, relative, resolve, sep } from "node:path";
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
@@ -110,7 +110,7 @@ function distributionPayload(d) {
 async function runExecutaPublish(opts) {
 	return withErrorHandling(async () => {
 		const cwd = resolve(opts.cwd ?? process.cwd());
-		const manifest = loadExecutaManifest(cwd, opts.manifest);
+		const manifest = loadExecutaManifest(cwd, opts.manifest, opts.profile);
 		const isSkill = manifest.executa_type === "skill";
 		const { client, host, source } = resolveClient({ account: opts.account });
 		if (!opts.json && !opts.quiet) console.log(dim(`using PAT from ${source} (host=${host})`));

package/dist/{executa-upload-binaries-Do5Sq64E.js → executa-upload-binaries-DURJTXRI.js}

@@ -2,7 +2,7 @@ import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-D-_z1ALk.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-DlIcwLQs.js";
+import { loadExecutaManifest } from "./manifest-CAF3_r1T.js";
 import { fetchGitHubIdToken, finalizeBinaryUpload, initBinaryUpload, mintUploadSession, mintUploadSessionViaOidc, uploadBinaryPart } from "./binary-upload-CKMU5Rfw.js";
 import { isAbsolute, resolve } from "node:path";
 import { closeSync, createReadStream, existsSync, openSync, readSync, statSync } from "node:fs";

package/dist/{executa-upload-binaries-CYMtWJU7.js → executa-upload-binaries-DrwpzQp3.js}

@@ -2,8 +2,8 @@ import "./credentials-BTv2IfUZ.js";
 import "./client-D-_z1ALk.js";
 import "./_lifecycle-shared-RyiRITI5.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./manifest-DlIcwLQs.js";
+import "./manifest-CAF3_r1T.js";
 import "./binary-upload-CKMU5Rfw.js";
-import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-Do5Sq64E.js";
+import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-DURJTXRI.js";
 
 export { runExecutaUploadBinaries };

package/dist/{listing-meta-C0HsNjIB.js → listing-meta-CtVtyaWu.js}

@@ -27,20 +27,29 @@ function isRemoteAsset(src) {
 /**
 * Build the metadata payload from the manifest (only defined fields). The
 * logo is handled separately and never appears here when sourced from a file.
+*
+* Optional listing URLs (cover/homepage/support/privacy) are *clearable*:
+* `loadAppManifest` normalises an explicit `""`/`null` in the local metadata
+* file to the `""` sentinel, which is forwarded on the PATCH so the server
+* value is emptied (the store UI hides falsy links). An absent key stays
+* `undefined` and is omitted from the payload — "leave unchanged".
 */
 function buildMeta(manifest) {
 	const meta = {};
 	const add = (key, value) => {
 		if (value !== void 0 && value !== null && value !== "") meta[key] = value;
 	};
+	const addClearable = (key, value) => {
+		if (value !== void 0) meta[key] = value;
+	};
 	add("name", manifest.name);
 	add("category", manifest.category);
 	add("tagline", manifest.tagline);
 	add("description", manifest.description);
-	add("cover_url", manifest.coverUrl);
-	add("homepage_url", manifest.homepageUrl);
-	add("support_url", manifest.supportUrl);
-	add("privacy_url", manifest.privacyUrl);
+	addClearable("cover_url", manifest.coverUrl);
+	addClearable("homepage_url", manifest.homepageUrl);
+	addClearable("support_url", manifest.supportUrl);
+	addClearable("privacy_url", manifest.privacyUrl);
 	add("pricing_model", manifest.pricingModel);
 	return meta;
 }

package/dist/{manifest-DlIcwLQs.js → manifest-CAF3_r1T.js}

@@ -43,6 +43,13 @@ function loadAppManifest(cwd, manifestPath) {
 	const metadataLabel = hasAppJson ? "app.json" : "manifest.json";
 	const pickMeta = (k) => (appJsonRaw && pickString(appJsonRaw, k)) ?? pickString(raw, k);
 	const pickMetaArray = (k) => (appJsonRaw && pickStringArray(appJsonRaw, k)) ?? pickStringArray(raw, k);
+	const pickClearableMeta = (k) => {
+		const owner = appJsonRaw && k in appJsonRaw ? appJsonRaw : k in raw ? raw : null;
+		if (!owner) return void 0;
+		const v = owner[k];
+		if (v === null || v === "") return "";
+		return typeof v === "string" ? v : void 0;
+	};
 	const slug = pickMeta("slug");
 	const name = pickMeta("name") ?? slug ?? "";
 	const version = pickMeta("version") ?? "0.1.0";
@@ -67,11 +74,11 @@ function loadAppManifest(cwd, manifestPath) {
 		changelog: pickMeta("changelog"),
 		logoUrl: pickMeta("logo_url"),
 		logoFile: pickMeta("logo_file"),
-		coverUrl: pickMeta("cover_url"),
+		coverUrl: pickClearableMeta("cover_url"),
 		screenshots: pickMetaArray("screenshots"),
-		homepageUrl: pickMeta("homepage_url"),
-		supportUrl: pickMeta("support_url"),
-		privacyUrl: pickMeta("privacy_url"),
+		homepageUrl: pickClearableMeta("homepage_url"),
+		supportUrl: pickClearableMeta("support_url"),
+		privacyUrl: pickClearableMeta("privacy_url"),
 		pricingModel: pickMeta("pricing_model")
 	};
 }
@@ -92,7 +99,7 @@ function parseBundledExecutas(value, label) {
 	}
 	return out;
 }
-function loadExecutaManifest(cwd, manifestPath) {
+function loadExecutaManifest(cwd, manifestPath, profileOverride) {
 	const path = resolve(cwd, manifestPath ?? "executa.json");
 	if (!existsSync(path)) throw new CliError(`no executa.json at ${path}`, 4);
 	const raw = readJson(path);
@@ -124,7 +131,7 @@ function loadExecutaManifest(cwd, manifestPath) {
 		changelog: pickString(raw, "changelog") ?? void 0,
 		skillContent,
 		executionMode: pickString(raw, "execution_mode") ?? void 0,
-		distribution: parseExecutaDistribution(raw["distribution"], t)
+		distribution: parseExecutaDistribution(raw["distribution"], t, profileOverride)
 	};
 }
 /**
@@ -155,20 +162,32 @@ function loadExecutaManifest(cwd, manifestPath) {
 *      still caught), but the returned `ExecutaDistribution` carries the
 *      fields of the *active* profile plus `active`/`profiles` for
 *      introspection. Downstream publish code stays profile-agnostic.
+*
+* The optional `profileOverride` (from the CLI `--profile <name>` flag)
+* selects a declared profile for THIS invocation without touching the
+* on-disk `active` field — so `active` can stay pinned to the production
+* default (e.g. `binary`) while a developer temporarily pushes with
+* `--profile local`. It is rejected if the block is the flat form (no
+* `profiles`) or names an undeclared profile.
 */
-function parseExecutaDistribution(value, executaType) {
+function parseExecutaDistribution(value, executaType, profileOverride) {
 	if (value === void 0 || value === null) return void 0;
 	if (typeof value !== "object" || Array.isArray(value)) throw new CliError("executa.json `distribution` must be an object with a `type` field (or `profiles` for the switchable multi-mode form)", 4);
 	if (executaType === "skill") throw new CliError("executa.json `distribution` is only valid for `executa_type: \"tool\"` — skills are declarative Markdown and are not installed as a process", 4);
 	const d = value;
-	if (d["profiles"] !== void 0) return parseProfiledDistribution(d);
+	if (d["profiles"] !== void 0) return parseProfiledDistribution(d, profileOverride);
+	if (profileOverride !== void 0) throw new CliError(`--profile "${profileOverride}" was given but executa.json \`distribution\` is the flat single-mode form (no \`profiles\`) — declare a \`profiles\` map to switch between modes`, 4);
 	return parseDistributionProfile(d, "distribution");
 }
 /**
 * Resolve the multi-profile `distribution` form into the selected profile.
 * Validates *all* profiles and records them under `profiles`.
+*
+* Selection precedence: `profileOverride` (CLI `--profile`) > `active` field >
+* the sole profile when exactly one is declared. The override never mutates
+* the on-disk `active`; it only picks which profile this run publishes.
 */
-function parseProfiledDistribution(d) {
+function parseProfiledDistribution(d, profileOverride) {
 	if (d["type"] !== void 0) throw new CliError("executa.json `distribution` cannot set both `type` (flat form) and `profiles` (switchable form) — pick one", 4);
 	const profilesRaw = d["profiles"];
 	if (profilesRaw === null || typeof profilesRaw !== "object" || Array.isArray(profilesRaw)) throw new CliError("executa.json `distribution.profiles` must be an object mapping a profile name → distribution config", 4);
@@ -181,7 +200,10 @@ function parseProfiledDistribution(d) {
 	}
 	const active = pickString(d, "active");
 	let selected;
-	if (active !== void 0) {
+	if (profileOverride !== void 0) {
+		if (!(profileOverride in profiles)) throw new CliError(`--profile "${profileOverride}" is not a declared \`distribution.profiles\` entry — expected one of ${Object.keys(profiles).join(" | ")}`, 4);
+		selected = profileOverride;
+	} else if (active !== void 0) {
 		if (!(active in profiles)) throw new CliError(`executa.json \`distribution.active\` "${active}" is not a declared profile — expected one of ${Object.keys(profiles).join(" | ")}`, 4);
 		selected = active;
 	} else if (profileEntries.length === 1) selected = profileEntries[0][0];

package/dist/{publish-DW_D3uQ4.js → publish-DwIJWl46.js}

@@ -4,15 +4,15 @@ import { CliError } from "./client-D-_z1ALk.js";
 import { withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
 import "./executa-cache-BFoUtb4J.js";
 import "./bundled-executas-rSIkaA6-.js";
-import "./manifest-DlIcwLQs.js";
+import "./manifest-CAF3_r1T.js";
 import "./executas-CvQY_w2U.js";
-import { runExecutaPublish } from "./executa-publish-CGz5wM1Q.js";
+import { runExecutaPublish } from "./executa-publish-kh4Ucd3o.js";
 import "./binary-upload-CKMU5Rfw.js";
-import "./executa-upload-binaries-Do5Sq64E.js";
+import "./executa-upload-binaries-DURJTXRI.js";
 import "./app-cache-Cr3tKbux.js";
-import "./listing-meta-C0HsNjIB.js";
-import "./app-bundle-upload-CrBRnzf4.js";
-import { runAppsPublish } from "./apps-publish-qc_E4b_R.js";
+import "./listing-meta-CtVtyaWu.js";
+import "./app-bundle-upload-DmVKWAj9.js";
+import { runAppsPublish } from "./apps-publish--EmBa0zN.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { red, yellow } from "kleur/colors";

package/dist/{server-BHWGGZsf.js → server-CB-oHVfr.js}

@@ -1,5 +1,5 @@
 import { canonicalHost, getAccount } from "./credentials-BTv2IfUZ.js";
-import { BridgeRequestError } from "./bridge-Dvck0e9c.js";
+import { BridgeRequestError } from "./bridge-D6c4Asou.js";
 import { dirname, join, normalize, resolve } from "node:path";
 import { createRequire } from "node:module";
 import { createReadStream, existsSync, readFileSync, statSync, watch } from "node:fs";

package/dist/test/index.d.ts

@@ -16,6 +16,8 @@ interface HostApi {
   storage?: string[];
   prefs?: string[];
   window?: string[];
+  /** Provider ids (e.g. "google") — NOT method names. */
+  credentials?: string[];
 }
 interface ManifestForAcl {
   required_executas?: Array<{

package/dist/test/index.js

@@ -7,7 +7,8 @@ const NAMESPACED = {
 	fs: true,
 	storage: true,
 	prefs: true,
-	window: true
+	window: true,
+	credentials: true
 };
 function deriveAcl(manifest) {
 	const ha = manifest.ui?.host_api ?? {};
@@ -26,8 +27,12 @@ function deriveAcl(manifest) {
 		for (const r of [...manifest.required_executas ?? [], ...manifest.optional_executas ?? []]) if (r.tool_id) allowedTools.add(r.tool_id);
 	}
 	if (allowedTools.size > 0 || toolsWildcard) allowed.add("tools.invoke");
+	if ((ha.credentials ?? []).length > 0) {
+		allowed.add("credentials.list_accounts");
+		allowed.add("credentials.get_token");
+	}
 	for (const ns of Object.keys(NAMESPACED)) {
-		if (ns === "tools") continue;
+		if (ns === "tools" || ns === "credentials") continue;
 		for (const method of ha[ns] ?? []) allowed.add(`${ns}.${method}`);
 	}
 	return {

package/dist/{working-orchestration-B8KdAh5S.js → working-orchestration-B_4WOk3X.js}

@@ -2,9 +2,9 @@ import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { createApp, findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
 import { CliError } from "./client-D-_z1ALk.js";
 import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-rSIkaA6-.js";
-import { loadExecutaManifest } from "./manifest-DlIcwLQs.js";
-import { runExecutaPublish } from "./executa-publish-CGz5wM1Q.js";
-import { runExecutaInstall } from "./executa-install-Dz7hBUsn.js";
+import { loadExecutaManifest } from "./manifest-CAF3_r1T.js";
+import { runExecutaPublish } from "./executa-publish-kh4Ucd3o.js";
+import { runExecutaInstall } from "./executa-install-4hdrbusW.js";
 import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { join, resolve } from "node:path";
 import { dim, green, yellow } from "kleur/colors";
@@ -60,6 +60,7 @@ async function resolveBundledExecutas(params) {
 			account: params.account,
 			quiet: true,
 			freeze,
+			profile: params.profile,
 			capture: (r) => {
 				captured = r;
 			}
@@ -129,7 +130,7 @@ async function installLocalBundledShims(params) {
 		const dir = resolve(cwd, decl.path);
 		let exManifest;
 		try {
-			exManifest = loadExecutaManifest(dir);
+			exManifest = loadExecutaManifest(dir, void 0, params.profile);
 		} catch {
 			continue;
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anna-ai/cli",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "description": "Anna App developer CLI: scaffold, validate, harness (Phase 2 MVP: init + validate).",
   "license": "MIT",
   "type": "module",
@@ -33,8 +33,8 @@
     "prepublishOnly": "pnpm lint && pnpm test && pnpm build && node scripts/check-runtime-pin.mjs && node scripts/check-sdk-pin.mjs"
   },
   "dependencies": {
-    "@anna-ai/app-runtime": "^0.10.0",
-    "@anna-ai/app-schema": "^0.12.0",
+    "@anna-ai/app-runtime": "^0.11.0",
+    "@anna-ai/app-schema": "^0.13.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "commander": "^12.1.0",

package/dist/bridge-CzeSuRRL.js

@@ -1,3 +0,0 @@
-import { BridgeRequestError, PINNED_RUNTIME_VERSION, PythonBridge } from "./bridge-Dvck0e9c.js";
-
-export { PINNED_RUNTIME_VERSION, PythonBridge };

package/dist/dev-CZLOk2qE.js

@@ -1,4 +0,0 @@
-import "./nexus-root-BlPwOusj.js";
-import { parseExecutaSpec, runDev } from "./dev-GUFWek03.js";
-
-export { parseExecutaSpec, runDev };

package/dist/executa-install-nOFLBwxv.js

@@ -1,7 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import "./nexus-root-BlPwOusj.js";
-import "./executa-cache-BFoUtb4J.js";
-import "./dev-GUFWek03.js";
-import { runExecutaInstall } from "./executa-install-Dz7hBUsn.js";
-
-export { runExecutaInstall };