@anna-ai/cli 0.1.45 → 0.1.47

package/dist/{_lifecycle-shared-RyiRITI5.js → _lifecycle-shared-_9BzQ9Y2.js}

@@ -1,5 +1,5 @@
 import { canonicalHost, getAccount } from "./credentials-BTv2IfUZ.js";
-import { CliError, NexusClient, ScopeError } from "./client-D-_z1ALk.js";
+import { CliError, NexusClient, ScopeError } from "./client-sMzq2PWG.js";
 import { dim, red, yellow } from "kleur/colors";
 
 //#region src/commands/_lifecycle-shared.ts

package/dist/{account-B4rdVDyg.js → account-BBMYzSH7.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { setDeveloperHandle } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { reportError, resolveClient } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { reportError, resolveClient } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { bold, dim, green, red } from "kleur/colors";
 
 //#region src/commands/account.ts

package/dist/{app-bundle-upload-DgoZIhQG.js → app-bundle-upload-CzWR9jxI.js}

@@ -1,6 +1,6 @@
 import { finalizeBundle, finalizeWorkingBundle, getBundle, initBundle, initWorkingBundle, uploadBundleFile, uploadWorkingBundleFile } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { canonicalize } from "./executa-publish-DueD_0hh.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { canonicalize } from "./executa-publish-BKnsUoZq.js";
 import { join, relative, sep } from "node:path";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";

package/dist/{apps-C_Oln_om.js → apps-BQcbrExH.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { listMyApps } from "./apps-DlVsVHQ5.js";
-import "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { bold, cyan, dim, green, magenta, red, yellow } from "kleur/colors";
 
 //#region src/commands/apps.ts

package/dist/{apps-cut-BC1j7tcw.js → apps-cut-DWodD5oE.js}

@@ -1,19 +1,19 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import "./nexus-root-BlPwOusj.js";
 import { cutWorkingDraft } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { readExecutasLock, writeExecutasLock } from "./bundled-executas-rSIkaA6-.js";
-import { loadAppManifest, loadExecutaManifest } from "./manifest-CAF3_r1T.js";
+import { readExecutasLock, writeExecutasLock } from "./bundled-executas-BRyQkI9u.js";
+import { loadAppManifest, loadExecutaManifest } from "./manifest-B_DjigtQ.js";
 import "./executas-CvQY_w2U.js";
-import "./executa-publish-DueD_0hh.js";
-import "./binary-upload-CKMU5Rfw.js";
-import { uploadExecutaBinaries } from "./executa-upload-binaries-DURJTXRI.js";
-import "./dev-DKXNkQzp.js";
-import "./executa-install-ht8Fz4wc.js";
+import "./executa-publish-BKnsUoZq.js";
+import "./binary-upload-DVhQ0uY0.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-DwWQ18Dq.js";
+import "./dev-ClCDRplP.js";
+import "./executa-install-CM4x4doq.js";
 import "./app-cache-Cr3tKbux.js";
-import { resolveAppBySlugOrCache } from "./working-orchestration-bLFeqem7.js";
+import { resolveAppBySlugOrCache } from "./working-orchestration-CKXkvXVC.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";

package/dist/{apps-destructive-a2YBmWFm.js → apps-destructive-BVjpOxNF.js}

@@ -1,8 +1,8 @@
 import "./credentials-BTv2IfUZ.js";
 import { archiveApp, deleteApp, findAppBySlug, unarchiveApp, unpublishApp } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
-import { ensureDestructiveAllowed } from "./confirm-BSoOy1X2.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
+import { ensureDestructiveAllowed } from "./confirm-ChZAVrZe.js";
 import { dim, green, yellow } from "kleur/colors";
 
 //#region src/commands/apps-destructive.ts

package/dist/{apps-discard-Be-0TnPa.js → apps-discard-5z0K4-o3.js}

@@ -1,19 +1,19 @@
 import "./credentials-BTv2IfUZ.js";
 import "./nexus-root-BlPwOusj.js";
 import { deleteWorkingDraft, getWorkingDraft } from "./apps-DlVsVHQ5.js";
-import "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./bundled-executas-rSIkaA6-.js";
-import "./manifest-CAF3_r1T.js";
+import "./bundled-executas-BRyQkI9u.js";
+import "./manifest-B_DjigtQ.js";
 import "./executas-CvQY_w2U.js";
-import "./executa-publish-DueD_0hh.js";
-import "./binary-upload-CKMU5Rfw.js";
-import "./executa-upload-binaries-DURJTXRI.js";
-import "./dev-DKXNkQzp.js";
-import "./executa-install-ht8Fz4wc.js";
+import "./executa-publish-BKnsUoZq.js";
+import "./binary-upload-DVhQ0uY0.js";
+import "./executa-upload-binaries-DwWQ18Dq.js";
+import "./dev-ClCDRplP.js";
+import "./executa-install-CM4x4doq.js";
 import "./app-cache-Cr3tKbux.js";
-import { resolveAppBySlugOrCache } from "./working-orchestration-bLFeqem7.js";
+import { resolveAppBySlugOrCache } from "./working-orchestration-CKXkvXVC.js";
 import { dim, green, yellow } from "kleur/colors";
 
 //#region src/commands/apps-discard.ts

package/dist/{apps-grants-lmllFB02.js → apps-grants-baOFOxnO.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getAppGrants } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { bold, cyan, dim } from "kleur/colors";
 
 //#region src/commands/apps-grants.ts

package/dist/{apps-publish-CqN0w8sw.js → apps-publish-Ck-2BEu3.js}

@@ -1,13 +1,13 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { createApp, createVersion, findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
-import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-rSIkaA6-.js";
-import { loadAppManifest } from "./manifest-CAF3_r1T.js";
-import { bumpVersion, bundleHash, manifestHash, rewriteVersion, runExecutaPublish } from "./executa-publish-DueD_0hh.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
+import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-BRyQkI9u.js";
+import { loadAppManifest } from "./manifest-B_DjigtQ.js";
+import { bumpVersion, bundleHash, manifestHash, rewriteVersion, runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
 import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
-import { syncAppListingMeta } from "./listing-meta-CSopUol3.js";
-import { isExistingDir, uploadAppBundle } from "./app-bundle-upload-DgoZIhQG.js";
+import { syncAppListingMeta } from "./listing-meta-35VYXW5a.js";
+import { isExistingDir, uploadAppBundle } from "./app-bundle-upload-CzWR9jxI.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
 

package/dist/apps-publish-CrpTz6WY.js

@@ -0,0 +1,17 @@
+import "./credentials-BTv2IfUZ.js";
+import "./apps-DlVsVHQ5.js";
+import "./client-sMzq2PWG.js";
+import "./_lifecycle-shared-_9BzQ9Y2.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./bundled-executas-BRyQkI9u.js";
+import "./manifest-B_DjigtQ.js";
+import "./executas-CvQY_w2U.js";
+import "./executa-publish-BKnsUoZq.js";
+import "./binary-upload-DVhQ0uY0.js";
+import "./executa-upload-binaries-DwWQ18Dq.js";
+import "./app-cache-Cr3tKbux.js";
+import "./listing-meta-35VYXW5a.js";
+import "./app-bundle-upload-CzWR9jxI.js";
+import { runAppsPublish } from "./apps-publish-Ck-2BEu3.js";
+
+export { runAppsPublish };

package/dist/{apps-push-BDApmojT.js → apps-push-CNOI2ruX.js}

@@ -1,21 +1,21 @@
 import "./credentials-BTv2IfUZ.js";
 import "./nexus-root-BlPwOusj.js";
 import { getApp, getWorkingDraft, upsertWorkingDraft } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./bundled-executas-rSIkaA6-.js";
-import { loadAppManifest } from "./manifest-CAF3_r1T.js";
+import "./bundled-executas-BRyQkI9u.js";
+import { loadAppManifest } from "./manifest-B_DjigtQ.js";
 import "./executas-CvQY_w2U.js";
-import { bumpVersion, bundleHash, manifestHash, rewriteVersion } from "./executa-publish-DueD_0hh.js";
-import "./binary-upload-CKMU5Rfw.js";
-import "./executa-upload-binaries-DURJTXRI.js";
-import "./dev-DKXNkQzp.js";
-import "./executa-install-ht8Fz4wc.js";
+import { bumpVersion, bundleHash, manifestHash, rewriteVersion } from "./executa-publish-BKnsUoZq.js";
+import "./binary-upload-DVhQ0uY0.js";
+import "./executa-upload-binaries-DwWQ18Dq.js";
+import "./dev-ClCDRplP.js";
+import "./executa-install-CM4x4doq.js";
 import "./app-cache-Cr3tKbux.js";
-import { installLocalBundledShims, resolveAppIdentity, resolveBundledExecutas } from "./working-orchestration-bLFeqem7.js";
-import { syncAppListingMeta } from "./listing-meta-CSopUol3.js";
-import { isExistingDir, uploadWorkingBundle } from "./app-bundle-upload-DgoZIhQG.js";
+import { installLocalBundledShims, resolveAppIdentity, resolveBundledExecutas } from "./working-orchestration-CKXkvXVC.js";
+import { syncAppListingMeta } from "./listing-meta-35VYXW5a.js";
+import { isExistingDir, uploadWorkingBundle } from "./app-bundle-upload-CzWR9jxI.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
 

package/dist/{apps-release-KoREGpKk.js → apps-release-DuaJI9iX.js}

@@ -1,7 +1,7 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getApp, getBundle, listVersions, publishVersion } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
@@ -59,7 +59,7 @@ async function runAppsRelease(opts) {
 		if (!target) {
 			if (opts.allowCreate) {
 				if (!opts.json) console.log(yellow(`version ${opts.version} not found remotely; running 'apps publish' first (--allow-create)…`));
-				const { runAppsPublish } = await import("./apps-publish-DiSpTGHD.js");
+				const { runAppsPublish } = await import("./apps-publish-CrpTz6WY.js");
 				const code = await runAppsPublish({
 					cwd: opts.cwd,
 					account: opts.account,
@@ -113,6 +113,7 @@ async function runAppsRelease(opts) {
 		}
 		const released = await publishVersion(client, app.id, target.id);
 		const finalApp = await getApp(client, app.id);
+		const pendingReview = released.release_review_state === "pending" && !released.is_latest;
 		if (opts.json) {
 			console.log(JSON.stringify({
 				host,
@@ -120,12 +121,17 @@ async function runAppsRelease(opts) {
 				slug: app.slug,
 				version: released.version,
 				version_id: released.id,
-				is_latest: released.is_latest ?? true,
+				is_latest: released.is_latest ?? !pendingReview,
 				published_at: released.published_at ?? null,
-				status: finalApp.status
+				status: finalApp.status,
+				release_review_state: released.release_review_state ?? null
 			}, null, 2));
 			return 0;
 		}
+		if (pendingReview) {
+			console.log(yellow(`○ apps/${app.slug}: version ${released.version} submitted for release review`) + dim(` (id=${released.id}) — it goes live once an admin approves; the current live version keeps serving users`));
+			return 0;
+		}
 		console.log(green(`✓ apps/${app.slug}: released version ${released.version}`) + dim(` (id=${released.id})`));
 		console.log(bold(cyan(`status: ${finalApp.status}`)) + " — now live in the store");
 		return 0;

package/dist/{apps-rename-slug-DYrk4Zpt.js → apps-rename-slug-BGpitGyw.js}

@@ -1,8 +1,8 @@
 import "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, patchApp } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { reportError, resolveClient } from "./_lifecycle-shared-RyiRITI5.js";
-import { loadAppManifest } from "./manifest-CAF3_r1T.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { reportError, resolveClient } from "./_lifecycle-shared-_9BzQ9Y2.js";
+import { loadAppManifest } from "./manifest-B_DjigtQ.js";
 import { readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { writeFileSync } from "node:fs";
 import { bold, dim, green, red, yellow } from "kleur/colors";

package/dist/{apps-status-CcCoYu6i.js → apps-status-BVIL6DYc.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getApp, listVersions } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 
 //#region src/commands/apps-status.ts

package/dist/{apps-submit-review-DNrQc2ws.js → apps-submit-review-BmPjkoe9.js}

@@ -1,7 +1,7 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getApp, submitForReview } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { resolve } from "node:path";
 import { bold, cyan, green } from "kleur/colors";

package/dist/{apps-sync-meta-32oHqPlp.js → apps-sync-meta-87RK1Usm.js}

@@ -1,10 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
-import { loadAppManifest } from "./manifest-CAF3_r1T.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
+import { loadAppManifest } from "./manifest-B_DjigtQ.js";
 import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
-import { syncAppListingMeta } from "./listing-meta-CSopUol3.js";
+import { syncAppListingMeta } from "./listing-meta-35VYXW5a.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green } from "kleur/colors";
 

package/dist/{apps-versions-2BR8xo7C.js → apps-versions-DfapYfW-.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
 import { findAppBySlug, listVersions } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { bold, cyan, dim, green } from "kleur/colors";
 
 //#region src/commands/apps-versions.ts

package/dist/{binary-upload-CKMU5Rfw.js → binary-upload-DVhQ0uY0.js}

@@ -1,4 +1,4 @@
-import { CliError } from "./client-D-_z1ALk.js";
+import { CliError } from "./client-sMzq2PWG.js";
 
 //#region src/api/binary-upload.ts
 /** Exchange the PAT for a short-lived upload token bound to one tool_id. */

package/dist/bridge-BP28T06H.js

@@ -0,0 +1,3 @@
+import { BridgeRequestError, PINNED_RUNTIME_VERSION, PythonBridge } from "./bridge-sFHqOOat.js";
+
+export { PINNED_RUNTIME_VERSION, PythonBridge };

package/dist/{bridge-BBCJZ0jY.js → bridge-sFHqOOat.js}

@@ -9,7 +9,7 @@ import { createInterface } from "node:readline";
 * `uvx <pkg>@<version>` so end users always run the dispatcher version
 * the CLI was tested against.
 */
-const PINNED_RUNTIME_VERSION = "0.2.0a20";
+const PINNED_RUNTIME_VERSION = "0.2.0a21";
 /**
 * Throwable from a {@link RequestHandler} to send a structured JSON-RPC
 * error back to the python bridge with a stable string ``code`` (e.g.

package/dist/{bundled-executas-rSIkaA6-.js → bundled-executas-BRyQkI9u.js}

@@ -1,5 +1,5 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { CliError } from "./client-D-_z1ALk.js";
+import { CliError } from "./client-sMzq2PWG.js";
 import { dirname, resolve } from "node:path";
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 

package/dist/{bundled-executas-Bp9Z6aiR.js → bundled-executas-DvdaUh2i.js}

@@ -1,5 +1,5 @@
 import "./credentials-BTv2IfUZ.js";
-import "./client-D-_z1ALk.js";
-import { collectBundledHandles, lockPath, parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-rSIkaA6-.js";
+import "./client-sMzq2PWG.js";
+import { collectBundledHandles, lockPath, parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-BRyQkI9u.js";
 
 export { substituteBundledRefs, writeBundleToolIdSidecar };

package/dist/cli.js

@@ -474,7 +474,7 @@ program.command("validate").description("Run schema + ACL checks on a manifest+b
 	process.exit(code);
 });
 program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").option("--executa <spec>", "Explicit executa registration; repeatable. Spec: comma-separated key=value (dir=<path>[,tool_id=<id>][,type=python|node|go|binary][,command=\"<argv>\"]). When only `dir=` is given, the executa is auto-detected from executa.json / pyproject.toml / package.json / go.mod. Overrides directory auto-discovery under <manifest-dir>/executas/.", (val, prev) => prev ? [...prev, val] : [val]).option("--no-llm", "Disable LLM bridge (anna.llm/agent return llm_disabled)").option("--mock-llm <fixture>", "Serve canned LLM responses from a JSONL fixture").option("--llm-account <host>", "Saved account host to use (default: current)").option("--llm-app-slug <slug>", "Override the manifest slug used to register / look up the dev AnnaApp (default: manifest.slug)").option("--storage <mode>", "Storage backend: \"legacy\" (in-memory runtime_state, default) or \"aps\" (real nexus APS via /api/v1/storage/* — requires `anna-app login`).", "legacy").option("--web <mode>", "Web backend: \"local\" (keyless ddgs + stdlib fetcher, free, default) or \"real\" (platform web service via /api/v1/copilot/app/web/* — production provider chain + normal CU billing; requires `anna-app login`).", "local").action(async (opts) => {
-	const { runDev, parseExecutaSpec } = await import("./dev-CiTv4GH0.js");
+	const { runDev, parseExecutaSpec } = await import("./dev-C251jRh2.js");
 	const cwd = opts.cwd ?? process.cwd();
 	let executas;
 	if (opts.executa && opts.executa.length > 0) {
@@ -534,7 +534,7 @@ fixture.command("replay <file>").description("Dry-run replay of a harness record
 	process.exit(code);
 });
 program.command("doctor").description("Check environment for `anna-app dev` (uv, matrix-nexus, dev key)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (optional)").action(async (opts) => {
-	const { runDoctor } = await import("./doctor-DMF6MyoA.js");
+	const { runDoctor } = await import("./doctor-CHnkbamq.js");
 	const code = await runDoctor({ matrixNexusRoot: opts.matrixNexusRoot });
 	process.exit(code);
 });
@@ -561,7 +561,7 @@ program.command("whoami").description("Show the current account (and any others)
 });
 const account = program.command("account").description("Manage your developer account (handle / namespace)");
 account.command("set-handle <handle>").description("Set or rename your developer handle — the @handle namespace your apps publish under (@handle/slug). Required before creating your first app.").option("--host <url>", "Account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (handle, opts) => {
-	const { runAccountSetHandle } = await import("./account-B4rdVDyg.js");
+	const { runAccountSetHandle } = await import("./account-BBMYzSH7.js");
 	const code = await runAccountSetHandle({
 		handle,
 		account: opts.host,
@@ -597,7 +597,7 @@ executa.command("register").description("Register a HARNESS AnnaApp(kind=executa
 	process.exit(code);
 });
 executa.command("install").description("Install a local-dev shim for an Executa under its minted tool_id so the Agent can discover it via 'Rediscover Local' (for distribution_type: local). Resolves the tool_id from .anna/executa.json (written by `executa publish` / `apps push`) unless --tool-id is given.").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Install the shim under this exact id (default: minted id from .anna/executa.json, else executa.json tool_id)").option("--bin-dir <path>", "Install dir for the shim (default: ~/.anna/executa/bin)").option("--force", "Overwrite an existing shim of the same name", false).option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaInstall } = await import("./executa-install-BNG5AwEG.js");
+	const { runExecutaInstall } = await import("./executa-install-V5fSZRdO.js");
 	const code = await runExecutaInstall({
 		dir: opts.dir,
 		toolId: opts.toolId,
@@ -608,7 +608,7 @@ executa.command("install").description("Install a local-dev shim for an Executa
 	process.exit(code);
 });
 executa.command("dev").description("Run one Executa plugin in isolation (REPL or one-shot describe/invoke)").option("--dir <path>", "Executa project dir (default: CWD)").option("--spec <spec>", "Override discovery: comma-separated key=value (tool_id=...,type=...,command=\"...\")").option("--describe", "Print MANIFEST and exit", false).option("--health", "Print health and exit", false).option("--invoke <tool>", "Invoke one tool and exit").option("--args <json>", "JSON object passed as tool arguments", "{}").option("--json", "One-shot: emit compact JSON (no banners)", false).option("--no-sampling", "Hard-disable sampling reverse RPC (returns sampling_disabled)").option("--mock-sampling <fixture>", "Serve canned sampling responses from a JSONL fixture (offline)").option("--sampling-unsupported-format", "Simulate a model without json_schema support — exercises responseFormat onUnsupported branches (-32010 / downgrade)").option("--app-slug <slug>", "Forward sampling to nexus on behalf of this dev AnnaApp slug").option("--sampling-account <host>", "Saved account host for nexus sampling (default: current)").option("--no-agent", "Hard-disable agent reverse RPC (returns agent_not_granted)").option("--mock-agent <fixture>", "Serve canned agent/* responses from a JSONL fixture (offline)").option("--agent-account <host>", "Saved account host for nexus agent (default: --sampling-account or current)").option("--storage <mode>", "Storage backend: off | memory | mock | real (default: memory)").option("--mock-storage <fixture>", "Serve canned storage/* + files/* responses from a JSONL fixture").option("--storage-account <host>", "Saved account host for nexus storage (default: --sampling-account or current)").option("--storage-scopes <list>", "Comma-separated scopes for real storage tokens (default: user,app,tool)").option("--no-image", "Hard-disable image reverse RPC (returns image_not_granted)").option("--mock-image <fixture>", "Serve canned image/generate + image/edit responses from a JSONL fixture").option("--image-account <host>", "Saved account host for nexus image (default: --sampling-account or current)").option("--no-upload", "Hard-disable host/uploadFile reverse RPC (returns upload_not_granted)").option("--mock-upload <fixture>", "Serve canned host/uploadFile responses from a JSONL fixture").option("--upload-account <host>", "Saved account host for nexus uploads (default: --sampling-account or current)").action(async (opts) => {
-	const { runExecutaDev } = await import("./executa-dev-CXgAPTJx.js");
+	const { runExecutaDev } = await import("./executa-dev-CSzM-Oha.js");
 	const storageMode = opts.storage === void 0 ? void 0 : (() => {
 		const m = opts.storage;
 		if (m === "off" || m === "memory" || m === "mock" || m === "real") return m;
@@ -646,14 +646,14 @@ executa.command("dev").description("Run one Executa plugin in isolation (REPL or
 });
 const apps = program.command("apps").description("Anna App publish lifecycle commands");
 apps.command("list").description("List the Anna Apps you authored, with lifecycle status").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsList } = await import("./apps-C_Oln_om.js");
+	const { runAppsList } = await import("./apps-BQcbrExH.js");
 	process.exit(await runAppsList({
 		account: opts.account,
 		json: opts.json
 	}));
 });
 apps.command("rename-slug <new-slug>").description("Rename an app's public slug (DRAFT/REJECTED, never-published, zero installs only). Updates local app.json + .anna/app.json on success.").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (newSlug, opts) => {
-	const { runAppsRenameSlug } = await import("./apps-rename-slug-DYrk4Zpt.js");
+	const { runAppsRenameSlug } = await import("./apps-rename-slug-BGpitGyw.js");
 	process.exit(await runAppsRenameSlug({
 		newSlug,
 		cwd: opts.cwd,
@@ -671,7 +671,7 @@ apps.command("publish").description("Publish or update an Anna App (manifest.jso
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runAppsPublish } = await import("./apps-publish-DiSpTGHD.js");
+	const { runAppsPublish } = await import("./apps-publish-CrpTz6WY.js");
 	process.exit(await runAppsPublish({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -705,7 +705,7 @@ apps.command("push").description("Upsert the mutable working draft (manifest + b
 			process.exit(2);
 		}
 	}
-	const { runAppsPush } = await import("./apps-push-BDApmojT.js");
+	const { runAppsPush } = await import("./apps-push-CNOI2ruX.js");
 	process.exit(await runAppsPush({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -725,7 +725,7 @@ apps.command("push").description("Upsert the mutable working draft (manifest + b
 	}));
 });
 apps.command("cut <version>").description("Snapshot the working draft into an immutable version (freeze deps)").option("--changelog <text>", "Override the working draft changelog for this version").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't cut", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
-	const { runAppsCut } = await import("./apps-cut-BC1j7tcw.js");
+	const { runAppsCut } = await import("./apps-cut-DWodD5oE.js");
 	process.exit(await runAppsCut({
 		version,
 		changelog: opts.changelog,
@@ -737,7 +737,7 @@ apps.command("cut <version>").description("Snapshot the working draft into an im
 	}));
 });
 apps.command("discard").description("Drop the mutable working draft (leaves cut versions intact)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't discard", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsDiscard } = await import("./apps-discard-Be-0TnPa.js");
+	const { runAppsDiscard } = await import("./apps-discard-5z0K4-o3.js");
 	process.exit(await runAppsDiscard({
 		slug: opts.slug,
 		cwd: opts.cwd,
@@ -747,7 +747,7 @@ apps.command("discard").description("Drop the mutable working draft (leaves cut
 	}));
 });
 apps.command("release <version>").description("Freeze & publish an existing remote version (go live)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--allow-create", "If the version isn't on the server, run 'apps publish' first, then release", false).option("--dry-run", "Resolve target + pre-flight but don't publish", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
-	const { runAppsRelease } = await import("./apps-release-KoREGpKk.js");
+	const { runAppsRelease } = await import("./apps-release-DuaJI9iX.js");
 	process.exit(await runAppsRelease({
 		version,
 		slug: opts.slug,
@@ -759,7 +759,7 @@ apps.command("release <version>").description("Freeze & publish an existing remo
 	}));
 });
 apps.command("sync-meta").description("Push mutable store metadata (name/tagline/…) from the manifest").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--logo <path>", "Local logo file to upload (overrides app.json logo_file)").option("--dry-run", "Print the metadata diff but don't PATCH", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsSyncMeta } = await import("./apps-sync-meta-32oHqPlp.js");
+	const { runAppsSyncMeta } = await import("./apps-sync-meta-87RK1Usm.js");
 	process.exit(await runAppsSyncMeta({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -770,7 +770,7 @@ apps.command("sync-meta").description("Push mutable store metadata (name/tagline
 	}));
 });
 apps.command("submit-review [slug]").description("Move an app into review (DRAFT/REJECTED → PENDING_REVIEW)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsSubmitReview } = await import("./apps-submit-review-DNrQc2ws.js");
+	const { runAppsSubmitReview } = await import("./apps-submit-review-BmPjkoe9.js");
 	process.exit(await runAppsSubmitReview({
 		slug,
 		cwd: opts.cwd,
@@ -779,7 +779,7 @@ apps.command("submit-review [slug]").description("Move an app into review (DRAFT
 	}));
 });
 apps.command("status <slug>").description("Show server-known state for one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsStatus } = await import("./apps-status-CcCoYu6i.js");
+	const { runAppsStatus } = await import("./apps-status-BVIL6DYc.js");
 	process.exit(await runAppsStatus({
 		slug,
 		account: opts.account,
@@ -787,7 +787,7 @@ apps.command("status <slug>").description("Show server-known state for one Anna
 	}));
 });
 apps.command("versions <slug>").description("List all server versions of one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsVersions } = await import("./apps-versions-2BR8xo7C.js");
+	const { runAppsVersions } = await import("./apps-versions-DfapYfW-.js");
 	process.exit(await runAppsVersions({
 		slug,
 		account: opts.account,
@@ -795,7 +795,7 @@ apps.command("versions <slug>").description("List all server versions of one Ann
 	}));
 });
 apps.command("grants <slug>").description("Show currently granted scopes/quota for one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsGrants } = await import("./apps-grants-lmllFB02.js");
+	const { runAppsGrants } = await import("./apps-grants-baOFOxnO.js");
 	process.exit(await runAppsGrants({
 		slug,
 		account: opts.account,
@@ -803,7 +803,7 @@ apps.command("grants <slug>").description("Show currently granted scopes/quota f
 	}));
 });
 apps.command("unpublish <slug>").description("Flip a PUBLISHED app back to APPROVED (private)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsUnpublish } = await import("./apps-destructive-a2YBmWFm.js");
+	const { runAppsUnpublish } = await import("./apps-destructive-BVjpOxNF.js");
 	process.exit(await runAppsUnpublish({
 		slug,
 		yes: opts.yes,
@@ -813,7 +813,7 @@ apps.command("unpublish <slug>").description("Flip a PUBLISHED app back to APPRO
 	}));
 });
 apps.command("archive <slug>").description("Archive an Anna App (hides it from end users)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsArchive } = await import("./apps-destructive-a2YBmWFm.js");
+	const { runAppsArchive } = await import("./apps-destructive-BVjpOxNF.js");
 	process.exit(await runAppsArchive({
 		slug,
 		yes: opts.yes,
@@ -823,7 +823,7 @@ apps.command("archive <slug>").description("Archive an Anna App (hides it from e
 	}));
 });
 apps.command("unarchive <slug>").description("Restore an archived Anna App back to APPROVED").option("--yes", "Acknowledge the operation", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsUnarchive } = await import("./apps-destructive-a2YBmWFm.js");
+	const { runAppsUnarchive } = await import("./apps-destructive-BVjpOxNF.js");
 	process.exit(await runAppsUnarchive({
 		slug,
 		yes: opts.yes,
@@ -832,7 +832,7 @@ apps.command("unarchive <slug>").description("Restore an archived Anna App back
 	}));
 });
 apps.command("delete <slug>").description("Hard-delete an Anna App (refused by server if installs exist)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsDelete } = await import("./apps-destructive-a2YBmWFm.js");
+	const { runAppsDelete } = await import("./apps-destructive-BVjpOxNF.js");
 	process.exit(await runAppsDelete({
 		slug,
 		yes: opts.yes,
@@ -842,14 +842,14 @@ apps.command("delete <slug>").description("Hard-delete an Anna App (refused by s
 	}));
 });
 executa.command("list").description("List Executas owned by the current PAT").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaList } = await import("./executa-reads-BmwT_Yjp.js");
+	const { runExecutaList } = await import("./executa-reads-BYKUADoL.js");
 	process.exit(await runExecutaList({
 		account: opts.account,
 		json: opts.json
 	}));
 });
 executa.command("status <ref>").description("Show server-known state for one Executa (slug or tool_id)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
-	const { runExecutaStatus } = await import("./executa-reads-BmwT_Yjp.js");
+	const { runExecutaStatus } = await import("./executa-reads-BYKUADoL.js");
 	process.exit(await runExecutaStatus({
 		ref,
 		account: opts.account,
@@ -857,7 +857,7 @@ executa.command("status <ref>").description("Show server-known state for one Exe
 	}));
 });
 executa.command("versions <ref>").description("List immutable version snapshots for one Executa").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
-	const { runExecutaVersions } = await import("./executa-reads-BmwT_Yjp.js");
+	const { runExecutaVersions } = await import("./executa-reads-BYKUADoL.js");
 	process.exit(await runExecutaVersions({
 		ref,
 		account: opts.account,
@@ -873,7 +873,7 @@ executa.command("publish").description("Mint or update an Executa (executa.json
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runExecutaPublish } = await import("./executa-publish-2lAhRQvN.js");
+	const { runExecutaPublish } = await import("./executa-publish-6awuH4Ma.js");
 	process.exit(await runExecutaPublish({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -887,7 +887,7 @@ executa.command("publish").description("Mint or update an Executa (executa.json
 	}));
 });
 executa.command("upload-binaries").description("Push the local binary_artifacts declared in executa.json straight to the platform CDN (no public source URL needed — works for private repos). Requires a minted identity (.anna/executa.json from `executa publish` / `apps push`) or --tool-id.").option("--dir <path>", "Executa project dir (default: CWD)").option("--dry-run", "Hash artifacts + validate the plan server-side without uploading", false).option("--oidc", "Mint the upload token from the GitHub Actions OIDC id-token instead of a PAT (zero long-term secrets; needs `permissions: id-token: write` and a registered trusted publisher)", false).option("--tool-id <id>", "Explicit tool_id (skip the identity cache)").option("--host <url>", "Nexus host (required with --oidc unless ANNA_APP_HOST is set)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaUploadBinaries } = await import("./executa-upload-binaries-DrwpzQp3.js");
+	const { runExecutaUploadBinaries } = await import("./executa-upload-binaries-FWM2yXfB.js");
 	process.exit(await runExecutaUploadBinaries({
 		dir: opts.dir,
 		dryRun: opts.dryRun,
@@ -900,11 +900,11 @@ executa.command("upload-binaries").description("Push the local binary_artifacts
 });
 const trustedPublisher = executa.command("trusted-publisher").description("Manage the GitHub Actions identities allowed to publish binaries for an executa via OIDC (zero-secret CI; pairs with `executa upload-binaries --oidc`)");
 trustedPublisher.command("add").description("Register a {repository, workflow, environment?} triple").requiredOption("--repository <owner/repo>", "GitHub repository").requiredOption("--workflow <file>", "Workflow file, e.g. \"publish.yml\"").option("--environment <name>", "GitHub Environment gate (default: any)").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Explicit tool_id (skip the identity cache)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runTrustedPublisherAdd } = await import("./executa-trusted-publisher-tVwzjI2d.js");
+	const { runTrustedPublisherAdd } = await import("./executa-trusted-publisher-BGqz6hMt.js");
 	process.exit(await runTrustedPublisherAdd(opts));
 });
 trustedPublisher.command("list").description("List registered trusted publishers").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Explicit tool_id (skip the identity cache)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runTrustedPublisherList } = await import("./executa-trusted-publisher-tVwzjI2d.js");
+	const { runTrustedPublisherList } = await import("./executa-trusted-publisher-BGqz6hMt.js");
 	process.exit(await runTrustedPublisherList(opts));
 });
 trustedPublisher.command("remove <publisher-id>").description("Remove a trusted publisher registration by id").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Explicit tool_id (skip the identity cache)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (publisherId, opts) => {
@@ -913,14 +913,14 @@ trustedPublisher.command("remove <publisher-id>").description("Remove a trusted
 		console.error(`✗ publisher-id must be a positive integer (got "${publisherId}")`);
 		process.exit(2);
 	}
-	const { runTrustedPublisherRemove } = await import("./executa-trusted-publisher-tVwzjI2d.js");
+	const { runTrustedPublisherRemove } = await import("./executa-trusted-publisher-BGqz6hMt.js");
 	process.exit(await runTrustedPublisherRemove({
 		...opts,
 		publisherId: id
 	}));
 });
 executa.command("unpublish <slug>").description("Flip an Executa's visibility back to private").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runExecutaUnpublish } = await import("./executa-destructive-DCfQ1ez5.js");
+	const { runExecutaUnpublish } = await import("./executa-destructive-Du7RGJgn.js");
 	process.exit(await runExecutaUnpublish({
 		slug,
 		yes: opts.yes,
@@ -930,7 +930,7 @@ executa.command("unpublish <slug>").description("Flip an Executa's visibility ba
 	}));
 });
 executa.command("yank <ref>").description("Hard-delete one Executa version (<slug>@<version>)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
-	const { runExecutaYank } = await import("./executa-destructive-DCfQ1ez5.js");
+	const { runExecutaYank } = await import("./executa-destructive-Du7RGJgn.js");
 	process.exit(await runExecutaYank({
 		ref,
 		yes: opts.yes,
@@ -940,7 +940,7 @@ executa.command("yank <ref>").description("Hard-delete one Executa version (<slu
 	}));
 });
 executa.command("delete <slug>").description("Hard-delete an Executa").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runExecutaDelete } = await import("./executa-destructive-DCfQ1ez5.js");
+	const { runExecutaDelete } = await import("./executa-destructive-Du7RGJgn.js");
 	process.exit(await runExecutaDelete({
 		slug,
 		yes: opts.yes,
@@ -965,7 +965,7 @@ executa.command("cache-clear").description("Delete the local `.anna/executa.json
 });
 const token = program.command("token").description("Manage developer PATs (list / revoke / scopes)");
 token.command("list").description("List the caller's PATs (most-recent first)").option("--include-revoked", "Also show revoked PATs", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runTokenList } = await import("./token-COnYMRB-.js");
+	const { runTokenList } = await import("./token-TgBQumgy.js");
 	process.exit(await runTokenList({
 		includeRevoked: opts.includeRevoked,
 		account: opts.account,
@@ -978,7 +978,7 @@ token.command("revoke <id>").description("Revoke one of the caller's PATs by id"
 		console.error(`✗ token id must be a positive integer (got: ${id})`);
 		process.exit(2);
 	}
-	const { runTokenRevoke } = await import("./token-COnYMRB-.js");
+	const { runTokenRevoke } = await import("./token-TgBQumgy.js");
 	process.exit(await runTokenRevoke({
 		id: idNum,
 		account: opts.account,
@@ -986,7 +986,7 @@ token.command("revoke <id>").description("Revoke one of the caller's PATs by id"
 	}));
 });
 token.command("scopes").description("Print the available PAT scope catalogue").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runTokenScopes } = await import("./token-COnYMRB-.js");
+	const { runTokenScopes } = await import("./token-TgBQumgy.js");
 	process.exit(await runTokenScopes({
 		account: opts.account,
 		json: opts.json
@@ -1001,7 +1001,7 @@ program.command("publish").description("Auto-detect cwd and publish (apps publis
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runTopLevelPublish } = await import("./publish-B67_cXdw.js");
+	const { runTopLevelPublish } = await import("./publish-Bg4TkKoX.js");
 	process.exit(await runTopLevelPublish({
 		cwd: opts.cwd,
 		bump: opts.bump,

package/dist/{client-D-_z1ALk.js → client-sMzq2PWG.js}

@@ -111,7 +111,7 @@ var NexusClient = class {
 					body
 				});
 			}
-			throw new CliError(`forbidden (403): ${describeBody(body)}`, 3, {
+			throw new CliError(`forbidden (403): ${describeBody(body)}` + (/verified developer/i.test(describeBody(body)) ? `\n  Developer access is self-serve now — activate it in the web console: ${this.host}/developer` : ""), 3, {
 				status,
 				body
 			});

package/dist/{confirm-BSoOy1X2.js → confirm-ChZAVrZe.js}

@@ -1,4 +1,4 @@
-import { CliError } from "./client-D-_z1ALk.js";
+import { CliError } from "./client-sMzq2PWG.js";
 import { yellow } from "kleur/colors";
 import { createInterface } from "node:readline/promises";
 

package/dist/dev-C251jRh2.js

@@ -0,0 +1,4 @@
+import "./nexus-root-BlPwOusj.js";
+import { parseExecutaSpec, runDev } from "./dev-ClCDRplP.js";
+
+export { parseExecutaSpec, runDev };

package/dist/{dev-DKXNkQzp.js → dev-ClCDRplP.js}

@@ -61,8 +61,8 @@ async function runDev(opts) {
 		}
 		process.env.ANNA_APP_RUNTIME_WEB_MODE = "real";
 	}
-	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-CCubXGh7.js");
-	const { HarnessServer } = await import("./server-DKGo2PmS.js");
+	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-BP28T06H.js");
+	const { HarnessServer } = await import("./server-Dr_htFv8.js");
 	const bridge = new PythonBridge({
 		mode,
 		matrixNexusRoot: matrixNexusRoot ?? void 0,
@@ -102,7 +102,7 @@ async function runDev(opts) {
 	if (executas.length > 0) console.log(`  executas          ${dim(executas.map((e) => e.tool_id).join(", "))}`);
 	const bundledResolved = resolveBundledHandles(dirname(manifestPath), executas);
 	if (Object.keys(bundledResolved).length > 0) {
-		const { substituteBundledRefs, writeBundleToolIdSidecar } = await import("./bundled-executas-Bp9Z6aiR.js");
+		const { substituteBundledRefs, writeBundleToolIdSidecar } = await import("./bundled-executas-DvdaUh2i.js");
 		try {
 			manifest = substituteBundledRefs(manifest, bundledResolved);
 			writeBundleToolIdSidecar(bundleDir, bundledResolved);

package/dist/{doctor-DMF6MyoA.js → doctor-CHnkbamq.js}

@@ -1,5 +1,5 @@
 import { findMatrixNexusRoot, nexusSchemaDir } from "./nexus-root-BlPwOusj.js";
-import { PINNED_RUNTIME_VERSION } from "./bridge-BBCJZ0jY.js";
+import { PINNED_RUNTIME_VERSION } from "./bridge-sFHqOOat.js";
 import { resolve } from "node:path";
 import { existsSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";

package/dist/{executa-destructive-DCfQ1ez5.js → executa-destructive-Du7RGJgn.js}

@@ -1,8 +1,8 @@
 import "./credentials-BTv2IfUZ.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { deleteMyTool, listMyTools, listToolVersions, unpublishTool, yankToolVersion } from "./executas-CvQY_w2U.js";
-import { ensureDestructiveAllowed } from "./confirm-BSoOy1X2.js";
+import { ensureDestructiveAllowed } from "./confirm-ChZAVrZe.js";
 import { dim, green, yellow } from "kleur/colors";
 
 //#region src/commands/executa-destructive.ts

package/dist/{executa-dev-CXgAPTJx.js → executa-dev-CSzM-Oha.js}

@@ -1,5 +1,5 @@
 import "./nexus-root-BlPwOusj.js";
-import { parseExecutaSpec } from "./dev-DKXNkQzp.js";
+import { parseExecutaSpec } from "./dev-ClCDRplP.js";
 import { isAbsolute, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";

package/dist/{executa-install-ht8Fz4wc.js → executa-install-CM4x4doq.js}

@@ -1,5 +1,5 @@
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { parseExecutaSpec } from "./dev-DKXNkQzp.js";
+import { parseExecutaSpec } from "./dev-ClCDRplP.js";
 import { isAbsolute, join, resolve } from "node:path";
 import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";

package/dist/executa-install-V5fSZRdO.js

@@ -0,0 +1,7 @@
+import "./credentials-BTv2IfUZ.js";
+import "./nexus-root-BlPwOusj.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./dev-ClCDRplP.js";
+import { runExecutaInstall } from "./executa-install-CM4x4doq.js";
+
+export { runExecutaInstall };

package/dist/executa-publish-6awuH4Ma.js

@@ -0,0 +1,11 @@
+import "./credentials-BTv2IfUZ.js";
+import "./client-sMzq2PWG.js";
+import "./_lifecycle-shared-_9BzQ9Y2.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./manifest-B_DjigtQ.js";
+import "./executas-CvQY_w2U.js";
+import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
+import "./binary-upload-DVhQ0uY0.js";
+import "./executa-upload-binaries-DwWQ18Dq.js";
+
+export { runExecutaPublish };

package/dist/{executa-publish-DueD_0hh.js → executa-publish-BKnsUoZq.js}

@@ -1,10 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-CAF3_r1T.js";
+import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
 import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-CvQY_w2U.js";
-import { uploadExecutaBinaries } from "./executa-upload-binaries-DURJTXRI.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-DwWQ18Dq.js";
 import { join, relative, resolve, sep } from "node:path";
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";

package/dist/{executa-reads-BmwT_Yjp.js → executa-reads-BYKUADoL.js}

@@ -1,6 +1,6 @@
 import "./credentials-BTv2IfUZ.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { getMyTool, listMyTools, listToolVersions } from "./executas-CvQY_w2U.js";
 import { bold, cyan, dim, green } from "kleur/colors";
 

package/dist/{executa-trusted-publisher-tVwzjI2d.js → executa-trusted-publisher-BGqz6hMt.js}

@@ -1,8 +1,8 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { addTrustedPublisher, listTrustedPublishers, removeTrustedPublisher } from "./binary-upload-CKMU5Rfw.js";
+import { addTrustedPublisher, listTrustedPublishers, removeTrustedPublisher } from "./binary-upload-DVhQ0uY0.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green } from "kleur/colors";
 

package/dist/{executa-upload-binaries-DURJTXRI.js → executa-upload-binaries-DwWQ18Dq.js}

@@ -1,9 +1,9 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-CAF3_r1T.js";
-import { fetchGitHubIdToken, finalizeBinaryUpload, initBinaryUpload, mintUploadSession, mintUploadSessionViaOidc, uploadBinaryPart } from "./binary-upload-CKMU5Rfw.js";
+import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
+import { fetchGitHubIdToken, finalizeBinaryUpload, initBinaryUpload, mintUploadSession, mintUploadSessionViaOidc, uploadBinaryPart } from "./binary-upload-DVhQ0uY0.js";
 import { isAbsolute, resolve } from "node:path";
 import { closeSync, createReadStream, existsSync, openSync, readSync, statSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";

package/dist/executa-upload-binaries-FWM2yXfB.js

@@ -0,0 +1,9 @@
+import "./credentials-BTv2IfUZ.js";
+import "./client-sMzq2PWG.js";
+import "./_lifecycle-shared-_9BzQ9Y2.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./manifest-B_DjigtQ.js";
+import "./binary-upload-DVhQ0uY0.js";
+import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-DwWQ18Dq.js";
+
+export { runExecutaUploadBinaries };

package/dist/{listing-meta-CSopUol3.js → listing-meta-35VYXW5a.js}

@@ -1,5 +1,5 @@
 import { patchApp, uploadAppLogo, uploadAppScreenshot } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
+import { CliError } from "./client-sMzq2PWG.js";
 import { extname, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 
@@ -39,8 +39,7 @@ const LISTING_META_LIMITS = {
 	cover_url: 500,
 	homepage_url: 500,
 	support_url: 500,
-	privacy_url: 500,
-	pricing_model: 20
+	privacy_url: 500
 };
 function checkListingLimit(key, value) {
 	const max = LISTING_META_LIMITS[key];
@@ -74,7 +73,6 @@ function buildMeta(manifest) {
 	addClearable("homepage_url", manifest.homepageUrl);
 	addClearable("support_url", manifest.supportUrl);
 	addClearable("privacy_url", manifest.privacyUrl);
-	add("pricing_model", manifest.pricingModel);
 	return meta;
 }
 /**

package/dist/{manifest-CAF3_r1T.js → manifest-B_DjigtQ.js}

@@ -1,4 +1,4 @@
-import { CliError } from "./client-D-_z1ALk.js";
+import { CliError } from "./client-sMzq2PWG.js";
 import { resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 
@@ -78,8 +78,7 @@ function loadAppManifest(cwd, manifestPath) {
 		screenshots: pickMetaArray("screenshots"),
 		homepageUrl: pickClearableMeta("homepage_url"),
 		supportUrl: pickClearableMeta("support_url"),
-		privacyUrl: pickClearableMeta("privacy_url"),
-		pricingModel: pickMeta("pricing_model")
+		privacyUrl: pickClearableMeta("privacy_url")
 	};
 }
 const HANDLE_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;

package/dist/{publish-B67_cXdw.js → publish-Bg4TkKoX.js}

@@ -1,18 +1,18 @@
 import "./credentials-BTv2IfUZ.js";
 import "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./bundled-executas-rSIkaA6-.js";
-import "./manifest-CAF3_r1T.js";
+import "./bundled-executas-BRyQkI9u.js";
+import "./manifest-B_DjigtQ.js";
 import "./executas-CvQY_w2U.js";
-import { runExecutaPublish } from "./executa-publish-DueD_0hh.js";
-import "./binary-upload-CKMU5Rfw.js";
-import "./executa-upload-binaries-DURJTXRI.js";
+import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
+import "./binary-upload-DVhQ0uY0.js";
+import "./executa-upload-binaries-DwWQ18Dq.js";
 import "./app-cache-Cr3tKbux.js";
-import "./listing-meta-CSopUol3.js";
-import "./app-bundle-upload-DgoZIhQG.js";
-import { runAppsPublish } from "./apps-publish-CqN0w8sw.js";
+import "./listing-meta-35VYXW5a.js";
+import "./app-bundle-upload-CzWR9jxI.js";
+import { runAppsPublish } from "./apps-publish-Ck-2BEu3.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { red, yellow } from "kleur/colors";

package/dist/{server-DKGo2PmS.js → server-Dr_htFv8.js}

@@ -1,5 +1,5 @@
 import { canonicalHost, getAccount } from "./credentials-BTv2IfUZ.js";
-import { BridgeRequestError } from "./bridge-BBCJZ0jY.js";
+import { BridgeRequestError } from "./bridge-sFHqOOat.js";
 import { dirname, join, normalize, resolve } from "node:path";
 import { createRequire } from "node:module";
 import { createReadStream, existsSync, readFileSync, statSync, watch } from "node:fs";

package/dist/{token-COnYMRB-.js → token-TgBQumgy.js}

@@ -1,6 +1,6 @@
 import "./credentials-BTv2IfUZ.js";
-import "./client-D-_z1ALk.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-RyiRITI5.js";
+import "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 
 //#region src/api/tokens.ts

package/dist/{working-orchestration-bLFeqem7.js → working-orchestration-CKXkvXVC.js}

@@ -1,10 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { createApp, findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-D-_z1ALk.js";
-import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-rSIkaA6-.js";
-import { loadExecutaManifest } from "./manifest-CAF3_r1T.js";
-import { runExecutaPublish } from "./executa-publish-DueD_0hh.js";
-import { runExecutaInstall } from "./executa-install-ht8Fz4wc.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-BRyQkI9u.js";
+import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
+import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
+import { runExecutaInstall } from "./executa-install-CM4x4doq.js";
 import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { join, resolve } from "node:path";
 import { dim, green, yellow } from "kleur/colors";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anna-ai/cli",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "description": "Anna App developer CLI: scaffold, validate, harness (Phase 2 MVP: init + validate).",
   "license": "MIT",
   "type": "module",

package/templates/minimal/app.json

@@ -2,6 +2,5 @@
   "name": "__SLUG__",
   "tagline": "TODO",
   "description": "TODO",
-  "category": "productivity",
-  "pricing_model": "free"
+  "category": "productivity"
 }

package/dist/apps-publish-DiSpTGHD.js

@@ -1,17 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import "./apps-DlVsVHQ5.js";
-import "./client-D-_z1ALk.js";
-import "./_lifecycle-shared-RyiRITI5.js";
-import "./executa-cache-BFoUtb4J.js";
-import "./bundled-executas-rSIkaA6-.js";
-import "./manifest-CAF3_r1T.js";
-import "./executas-CvQY_w2U.js";
-import "./executa-publish-DueD_0hh.js";
-import "./binary-upload-CKMU5Rfw.js";
-import "./executa-upload-binaries-DURJTXRI.js";
-import "./app-cache-Cr3tKbux.js";
-import "./listing-meta-CSopUol3.js";
-import "./app-bundle-upload-DgoZIhQG.js";
-import { runAppsPublish } from "./apps-publish-CqN0w8sw.js";
-
-export { runAppsPublish };

package/dist/bridge-CCubXGh7.js

@@ -1,3 +0,0 @@
-import { BridgeRequestError, PINNED_RUNTIME_VERSION, PythonBridge } from "./bridge-BBCJZ0jY.js";
-
-export { PINNED_RUNTIME_VERSION, PythonBridge };

package/dist/dev-CiTv4GH0.js

@@ -1,4 +0,0 @@
-import "./nexus-root-BlPwOusj.js";
-import { parseExecutaSpec, runDev } from "./dev-DKXNkQzp.js";
-
-export { parseExecutaSpec, runDev };

package/dist/executa-install-BNG5AwEG.js

@@ -1,7 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import "./nexus-root-BlPwOusj.js";
-import "./executa-cache-BFoUtb4J.js";
-import "./dev-DKXNkQzp.js";
-import { runExecutaInstall } from "./executa-install-ht8Fz4wc.js";
-
-export { runExecutaInstall };

package/dist/executa-publish-2lAhRQvN.js

@@ -1,11 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import "./client-D-_z1ALk.js";
-import "./_lifecycle-shared-RyiRITI5.js";
-import "./executa-cache-BFoUtb4J.js";
-import "./manifest-CAF3_r1T.js";
-import "./executas-CvQY_w2U.js";
-import { runExecutaPublish } from "./executa-publish-DueD_0hh.js";
-import "./binary-upload-CKMU5Rfw.js";
-import "./executa-upload-binaries-DURJTXRI.js";
-
-export { runExecutaPublish };

package/dist/executa-upload-binaries-DrwpzQp3.js

@@ -1,9 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import "./client-D-_z1ALk.js";
-import "./_lifecycle-shared-RyiRITI5.js";
-import "./executa-cache-BFoUtb4J.js";
-import "./manifest-CAF3_r1T.js";
-import "./binary-upload-CKMU5Rfw.js";
-import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-DURJTXRI.js";
-
-export { runExecutaUploadBinaries };