@anna-ai/cli 0.1.46 → 0.1.49

package/dist/{account-BBMYzSH7.js → account-CPnwqXeh.js}

@@ -1,5 +1,5 @@
 import "./credentials-BTv2IfUZ.js";
-import { setDeveloperHandle } from "./apps-DlVsVHQ5.js";
+import { setDeveloperHandle } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { reportError, resolveClient } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { bold, dim, green, red } from "kleur/colors";

package/dist/{app-bundle-upload-BNBH9x6a.js → app-bundle-upload-Ca0r-kPy.js}

@@ -1,6 +1,6 @@
-import { finalizeBundle, finalizeWorkingBundle, getBundle, initBundle, initWorkingBundle, uploadBundleFile, uploadWorkingBundleFile } from "./apps-DlVsVHQ5.js";
+import { finalizeBundle, finalizeWorkingBundle, getBundle, initBundle, initWorkingBundle, uploadBundleFile, uploadWorkingBundleFile } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
-import { canonicalize } from "./executa-publish-DiyLvmyl.js";
+import { canonicalize } from "./executa-publish-BKnsUoZq.js";
 import { join, relative, sep } from "node:path";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";

package/dist/{apps-BQcbrExH.js → apps-CzqMRLbS.js}

@@ -1,5 +1,5 @@
 import "./credentials-BTv2IfUZ.js";
-import { listMyApps } from "./apps-DlVsVHQ5.js";
+import { listMyApps } from "./apps-HbfURK6y.js";
 import "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { bold, cyan, dim, green, magenta, red, yellow } from "kleur/colors";
@@ -30,6 +30,7 @@ async function runAppsList(opts) {
 					name: a.name,
 					status: a.status,
 					is_dev: a.is_dev ?? false,
+					review_candidate_version: a.review_candidate_version ?? null,
 					updated_at: a.updated_at ?? null
 				}))
 			}, null, 2));
@@ -42,7 +43,8 @@ async function runAppsList(opts) {
 		}
 		for (const a of apps) {
 			const dev = a.is_dev ? " " + yellow("[dev]") : "";
-			console.log(`  ${statusTag(a.status)}${dev} ${bold(a.slug)} ${dim(`(id=${a.id})`)}`);
+			const inReview = a.review_candidate_version ? " " + yellow(`(v${a.review_candidate_version} in review)`) : "";
+			console.log(`  ${statusTag(a.status)}${dev} ${bold(a.slug)} ${dim(`(id=${a.id})`)}${inReview}`);
 			if (a.name && a.name !== a.slug) console.log(`        ${dim(a.name)}`);
 		}
 		return 0;

package/dist/{apps-DlVsVHQ5.js → apps-HbfURK6y.js}

@@ -133,6 +133,13 @@ async function getAppGrants(client, appId) {
 	});
 	return r.status === 404 ? null : r.data;
 }
+async function getAppPermissions(client, appId) {
+	const r = await client.request({
+		path: `/api/v1/apps/${appId}/permissions`,
+		allowStatuses: [404]
+	});
+	return r.status === 404 ? null : r.data;
+}
 /**
 * Set (or rename) the caller's developer handle — the per-developer
 * namespace for `@handle/slug` public app refs.
@@ -263,4 +270,4 @@ async function finalizeWorkingBundle(client, appId, skipRemoteCheck = false) {
 }
 
 //#endregion
-export { archiveApp, createApp, createVersion, cutWorkingDraft, deleteApp, deleteWorkingDraft, finalizeBundle, finalizeWorkingBundle, findAppBySlug, getApp, getAppGrants, getBundle, getWorkingDraft, initBundle, initWorkingBundle, listMyApps, listVersions, patchApp, publishVersion, setDeveloperHandle, submitForReview, unarchiveApp, unpublishApp, uploadAppLogo, uploadAppScreenshot, uploadBundleFile, uploadWorkingBundleFile, upsertWorkingDraft };
+export { archiveApp, createApp, createVersion, cutWorkingDraft, deleteApp, deleteWorkingDraft, finalizeBundle, finalizeWorkingBundle, findAppBySlug, getApp, getAppGrants, getAppPermissions, getBundle, getWorkingDraft, initBundle, initWorkingBundle, listMyApps, listVersions, patchApp, publishVersion, setDeveloperHandle, submitForReview, unarchiveApp, unpublishApp, uploadAppLogo, uploadAppScreenshot, uploadBundleFile, uploadWorkingBundleFile, upsertWorkingDraft };

package/dist/{apps-cut-BQHvzBpJ.js → apps-cut-BhTJwILv.js}

@@ -1,19 +1,19 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import "./nexus-root-BlPwOusj.js";
-import { cutWorkingDraft } from "./apps-DlVsVHQ5.js";
+import { cutWorkingDraft } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
 import { readExecutasLock, writeExecutasLock } from "./bundled-executas-BRyQkI9u.js";
-import { loadAppManifest, loadExecutaManifest } from "./manifest-DZyXkzg5.js";
+import { loadAppManifest, loadExecutaManifest } from "./manifest-B_DjigtQ.js";
 import "./executas-CvQY_w2U.js";
-import "./executa-publish-DiyLvmyl.js";
+import "./executa-publish-BKnsUoZq.js";
 import "./binary-upload-DVhQ0uY0.js";
-import { uploadExecutaBinaries } from "./executa-upload-binaries-pCHYUcie.js";
-import "./dev-ClCDRplP.js";
-import "./executa-install-CM4x4doq.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-DwWQ18Dq.js";
+import "./dev-Bfv3WQC0.js";
+import "./executa-install-DAposiBw.js";
 import "./app-cache-Cr3tKbux.js";
-import { resolveAppBySlugOrCache } from "./working-orchestration-Ny4fR7gv.js";
+import { resolveAppBySlugOrCache } from "./working-orchestration-CpBJLs50.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";

package/dist/{apps-destructive-BVjpOxNF.js → apps-destructive-PlaU93EX.js}

@@ -1,5 +1,5 @@
 import "./credentials-BTv2IfUZ.js";
-import { archiveApp, deleteApp, findAppBySlug, unarchiveApp, unpublishApp } from "./apps-DlVsVHQ5.js";
+import { archiveApp, deleteApp, findAppBySlug, unarchiveApp, unpublishApp } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { ensureDestructiveAllowed } from "./confirm-ChZAVrZe.js";

package/dist/{apps-discard-CFQWOr9x.js → apps-discard-CFi-GzpU.js}

@@ -1,19 +1,19 @@
 import "./credentials-BTv2IfUZ.js";
 import "./nexus-root-BlPwOusj.js";
-import { deleteWorkingDraft, getWorkingDraft } from "./apps-DlVsVHQ5.js";
+import { deleteWorkingDraft, getWorkingDraft } from "./apps-HbfURK6y.js";
 import "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
 import "./bundled-executas-BRyQkI9u.js";
-import "./manifest-DZyXkzg5.js";
+import "./manifest-B_DjigtQ.js";
 import "./executas-CvQY_w2U.js";
-import "./executa-publish-DiyLvmyl.js";
+import "./executa-publish-BKnsUoZq.js";
 import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-pCHYUcie.js";
-import "./dev-ClCDRplP.js";
-import "./executa-install-CM4x4doq.js";
+import "./executa-upload-binaries-DwWQ18Dq.js";
+import "./dev-Bfv3WQC0.js";
+import "./executa-install-DAposiBw.js";
 import "./app-cache-Cr3tKbux.js";
-import { resolveAppBySlugOrCache } from "./working-orchestration-Ny4fR7gv.js";
+import { resolveAppBySlugOrCache } from "./working-orchestration-CpBJLs50.js";
 import { dim, green, yellow } from "kleur/colors";
 
 //#region src/commands/apps-discard.ts

package/dist/apps-grants-DqaX8UTy.js

@@ -0,0 +1,70 @@
+import "./credentials-BTv2IfUZ.js";
+import { findAppBySlug, getAppGrants, getAppPermissions } from "./apps-HbfURK6y.js";
+import { CliError } from "./client-sMzq2PWG.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
+import { bold, cyan, dim, yellow } from "kleur/colors";
+
+//#region src/commands/apps-grants.ts
+/** Pick the `*_grant` sections off a bundled executa's custom_config. */
+function executaGrantSections(ex) {
+	const cfg = ex.custom_config;
+	if (!cfg || typeof cfg !== "object") return {};
+	const out = {};
+	for (const [k, v] of Object.entries(cfg)) if (k.endsWith("_grant")) out[k] = v;
+	return out;
+}
+async function runAppsGrants(opts) {
+	return withErrorHandling(async () => {
+		const { client, host } = resolveClient({ account: opts.account });
+		const app = await findAppBySlug(client, opts.slug);
+		if (!app) throw new CliError(`no app with slug "${opts.slug}" on ${host}`, 5);
+		const perms = await getAppPermissions(client, app.id);
+		const grants = perms?.app ?? await getAppGrants(client, app.id);
+		if (opts.json) {
+			console.log(JSON.stringify({
+				host,
+				app_id: app.id,
+				slug: app.slug,
+				grants,
+				...perms ? {
+					executa_grants: (perms.executas ?? []).map((ex) => ({
+						name: ex.name,
+						executa_id: ex.executa_id,
+						is_enabled: ex.is_enabled,
+						...executaGrantSections(ex)
+					})),
+					satisfied: perms.satisfied ?? true,
+					missing: perms.missing ?? []
+				} : {}
+			}, null, 2));
+			return 0;
+		}
+		console.log(bold(cyan(`apps/${app.slug}`)) + " " + dim(`grants`));
+		if (!grants) {
+			console.log(dim("  (no grants endpoint data available)"));
+			return 0;
+		}
+		console.log(JSON.stringify(grants, null, 2));
+		if (perms) {
+			const executas = perms.executas ?? [];
+			if (executas.length > 0) {
+				console.log(bold(cyan("bundled executa grants")));
+				for (const ex of executas) {
+					console.log(`  ${String(ex.name ?? ex.executa_id)}:`);
+					const sections = executaGrantSections(ex);
+					if (Object.keys(sections).length === 0) console.log(dim("    (no grants configured)"));
+					else for (const [k, v] of Object.entries(sections)) console.log(`    ${k}: ${JSON.stringify(v)}`);
+				}
+			}
+			const missing = perms.missing ?? [];
+			if (missing.length > 0) {
+				console.log(yellow("! missing grants (enable in the Anna dashboard permissions modal):"));
+				for (const m of missing) console.log(yellow(`  - ${m}`));
+			}
+		}
+		return 0;
+	});
+}
+
+//#endregion
+export { runAppsGrants };

package/dist/apps-publish-4IIbF2xr.js

@@ -0,0 +1,17 @@
+import "./credentials-BTv2IfUZ.js";
+import "./apps-HbfURK6y.js";
+import "./client-sMzq2PWG.js";
+import "./_lifecycle-shared-_9BzQ9Y2.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./bundled-executas-BRyQkI9u.js";
+import "./manifest-B_DjigtQ.js";
+import "./executas-CvQY_w2U.js";
+import "./executa-publish-BKnsUoZq.js";
+import "./binary-upload-DVhQ0uY0.js";
+import "./executa-upload-binaries-DwWQ18Dq.js";
+import "./app-cache-Cr3tKbux.js";
+import "./listing-meta-DgweMStT.js";
+import "./app-bundle-upload-Ca0r-kPy.js";
+import { runAppsPublish } from "./apps-publish-8N9x4VEM.js";
+
+export { runAppsPublish };

package/dist/{apps-publish-DFKd-Egv.js → apps-publish-8N9x4VEM.js}

@@ -1,13 +1,13 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { createApp, createVersion, findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
+import { createApp, createVersion, findAppBySlug, getApp } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-BRyQkI9u.js";
-import { loadAppManifest } from "./manifest-DZyXkzg5.js";
-import { bumpVersion, bundleHash, manifestHash, rewriteVersion, runExecutaPublish } from "./executa-publish-DiyLvmyl.js";
+import { loadAppManifest } from "./manifest-B_DjigtQ.js";
+import { bumpVersion, bundleHash, manifestHash, rewriteVersion, runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
 import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
-import { syncAppListingMeta } from "./listing-meta-DvxLn9NY.js";
-import { isExistingDir, uploadAppBundle } from "./app-bundle-upload-BNBH9x6a.js";
+import { syncAppListingMeta } from "./listing-meta-DgweMStT.js";
+import { isExistingDir, uploadAppBundle } from "./app-bundle-upload-Ca0r-kPy.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
 

package/dist/{apps-push-Bpv100k_.js → apps-push-CnSeLwdo.js}

@@ -1,21 +1,21 @@
 import "./credentials-BTv2IfUZ.js";
 import "./nexus-root-BlPwOusj.js";
-import { getApp, getWorkingDraft, upsertWorkingDraft } from "./apps-DlVsVHQ5.js";
+import { getApp, getWorkingDraft, upsertWorkingDraft } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
 import "./bundled-executas-BRyQkI9u.js";
-import { loadAppManifest } from "./manifest-DZyXkzg5.js";
+import { loadAppManifest } from "./manifest-B_DjigtQ.js";
 import "./executas-CvQY_w2U.js";
-import { bumpVersion, bundleHash, manifestHash, rewriteVersion } from "./executa-publish-DiyLvmyl.js";
+import { bumpVersion, bundleHash, manifestHash, rewriteVersion } from "./executa-publish-BKnsUoZq.js";
 import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-pCHYUcie.js";
-import "./dev-ClCDRplP.js";
-import "./executa-install-CM4x4doq.js";
+import "./executa-upload-binaries-DwWQ18Dq.js";
+import "./dev-Bfv3WQC0.js";
+import "./executa-install-DAposiBw.js";
 import "./app-cache-Cr3tKbux.js";
-import { installLocalBundledShims, resolveAppIdentity, resolveBundledExecutas } from "./working-orchestration-Ny4fR7gv.js";
-import { syncAppListingMeta } from "./listing-meta-DvxLn9NY.js";
-import { isExistingDir, uploadWorkingBundle } from "./app-bundle-upload-BNBH9x6a.js";
+import { installLocalBundledShims, resolveAppIdentity, resolveBundledExecutas } from "./working-orchestration-CpBJLs50.js";
+import { syncAppListingMeta } from "./listing-meta-DgweMStT.js";
+import { isExistingDir, uploadWorkingBundle } from "./app-bundle-upload-Ca0r-kPy.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
 

package/dist/{apps-release-Goi4Psmt.js → apps-release-DGQv6DDl.js}

@@ -1,5 +1,5 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { findAppBySlug, getApp, getBundle, listVersions, publishVersion } from "./apps-DlVsVHQ5.js";
+import { findAppBySlug, getApp, getBundle, listVersions, publishVersion } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
@@ -59,7 +59,7 @@ async function runAppsRelease(opts) {
 		if (!target) {
 			if (opts.allowCreate) {
 				if (!opts.json) console.log(yellow(`version ${opts.version} not found remotely; running 'apps publish' first (--allow-create)…`));
-				const { runAppsPublish } = await import("./apps-publish-zeKU-9TE.js");
+				const { runAppsPublish } = await import("./apps-publish-4IIbF2xr.js");
 				const code = await runAppsPublish({
 					cwd: opts.cwd,
 					account: opts.account,

package/dist/{apps-rename-slug-qKXdUDDn.js → apps-rename-slug-CCEU_7JJ.js}

@@ -1,8 +1,8 @@
 import "./credentials-BTv2IfUZ.js";
-import { findAppBySlug, patchApp } from "./apps-DlVsVHQ5.js";
+import { findAppBySlug, patchApp } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { reportError, resolveClient } from "./_lifecycle-shared-_9BzQ9Y2.js";
-import { loadAppManifest } from "./manifest-DZyXkzg5.js";
+import { loadAppManifest } from "./manifest-B_DjigtQ.js";
 import { readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { writeFileSync } from "node:fs";
 import { bold, dim, green, red, yellow } from "kleur/colors";

package/dist/{apps-status-BVIL6DYc.js → apps-status-C4Cxc2DF.js}

@@ -1,5 +1,5 @@
 import "./credentials-BTv2IfUZ.js";
-import { findAppBySlug, getApp, listVersions } from "./apps-DlVsVHQ5.js";
+import { findAppBySlug, getApp, listVersions } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
@@ -23,6 +23,7 @@ async function runAppsStatus(opts) {
 				visibility: full.visibility ?? null,
 				is_published: full.is_published ?? false,
 				review_message: full.review_message ?? null,
+				review_candidate_version: full.review_candidate_version ?? null,
 				latest_version: latest ? {
 					id: latest.id,
 					version: latest.version,
@@ -39,6 +40,10 @@ async function runAppsStatus(opts) {
 		console.log(`  ${dim("status    :")} ${colorStatus(full.status)}` + (full.is_published ? " " + green("[published]") : ""));
 		if (latest) console.log(`  ${dim("latest    :")} v${latest.version} (id=${latest.id}, published=${latest.published_at ?? "—"})`);
 		else console.log(`  ${dim("latest    :")} ${dim("(no versions yet)")}`);
+		if (full.review_candidate_version) {
+			const isReleaseReview = (full.status || "").toUpperCase() === "PUBLISHED";
+			console.log(`  ${dim("in review :")} ${yellow(`v${full.review_candidate_version}`)} ${dim(isReleaseReview ? "(release under review — awaiting admin approval)" : "(pinned at submit-review)")}`);
+		}
 		if (full.review_message) console.log(`  ${dim("reviewer  :")} ${full.review_message}`);
 		console.log(`  ${dim("versions  :")} ${versions.length} total`);
 		return 0;

package/dist/{apps-submit-review-BmPjkoe9.js → apps-submit-review--hZFZRJ3.js}

@@ -1,10 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { findAppBySlug, getApp, submitForReview } from "./apps-DlVsVHQ5.js";
+import { findAppBySlug, getApp, submitForReview } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { resolve } from "node:path";
-import { bold, cyan, green } from "kleur/colors";
+import { bold, cyan, dim, green } from "kleur/colors";
 
 //#region src/commands/apps-submit-review.ts
 async function runAppsSubmitReview(opts) {
@@ -26,17 +26,23 @@ async function runAppsSubmitReview(opts) {
 		}
 		const app = await submitForReview(client, appId);
 		const finalApp = await getApp(client, appId);
+		const candidate = app.review_candidate_version ?? finalApp.review_candidate_version ?? null;
 		if (opts.json) {
 			console.log(JSON.stringify({
 				host,
 				app_id: appId,
 				slug: serverSlug,
-				status: finalApp.status
+				status: finalApp.status,
+				review_candidate_version: candidate
 			}, null, 2));
 			return 0;
 		}
 		console.log(green(`✓ apps/${serverSlug}: submitted for review`));
 		console.log(bold(cyan(`status: ${app.status ?? finalApp.status}`)));
+		if (candidate) {
+			console.log(`under review: ${bold(`v${candidate}`)}`);
+			console.log(dim("versions cut after this point are NOT part of this review round — re-run `apps submit-review` to re-pin to the newest cut"));
+		}
 		return 0;
 	});
 }

package/dist/{apps-sync-meta-Ch3kECAO.js → apps-sync-meta-DnFwFNl5.js}

@@ -1,10 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
+import { findAppBySlug, getApp } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
-import { loadAppManifest } from "./manifest-DZyXkzg5.js";
+import { loadAppManifest } from "./manifest-B_DjigtQ.js";
 import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
-import { syncAppListingMeta } from "./listing-meta-DvxLn9NY.js";
+import { syncAppListingMeta } from "./listing-meta-DgweMStT.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green } from "kleur/colors";
 

package/dist/{apps-versions-DfapYfW-.js → apps-versions-C7NzG5Dk.js}

@@ -1,8 +1,8 @@
 import "./credentials-BTv2IfUZ.js";
-import { findAppBySlug, listVersions } from "./apps-DlVsVHQ5.js";
+import { findAppBySlug, listVersions } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
-import { bold, cyan, dim, green } from "kleur/colors";
+import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 
 //#region src/commands/apps-versions.ts
 async function runAppsVersions(opts) {
@@ -16,12 +16,14 @@ async function runAppsVersions(opts) {
 				host,
 				app_id: app.id,
 				slug: app.slug,
+				review_candidate_version: app.review_candidate_version ?? null,
 				versions: versions.map((v) => ({
 					id: v.id,
 					version: v.version,
 					is_latest: v.is_latest ?? false,
 					published_at: v.published_at ?? null,
-					created_at: v.created_at ?? null
+					created_at: v.created_at ?? null,
+					release_review_state: v.release_review_state ?? null
 				}))
 			}, null, 2));
 			return 0;
@@ -32,9 +34,12 @@ async function runAppsVersions(opts) {
 			return 0;
 		}
 		for (const v of versions) {
-			const tag = v.is_latest ? green("[latest]") : dim("        ");
-			console.log(`  ${tag} v${v.version} ${dim(`(id=${v.id}, published=${v.published_at ?? "—"})`)}`);
+			const inReview = v.version === app.review_candidate_version;
+			const tag = v.is_latest ? green("[latest]") : inReview ? yellow("[review]") : dim("        ");
+			const rereview = v.release_review_state === "pending" ? " " + yellow("(re-review pending)") : v.release_review_state === "rejected" ? " " + red("(re-review rejected)") : "";
+			console.log(`  ${tag} v${v.version} ${dim(`(id=${v.id}, published=${v.published_at ?? "—"})`)}${rereview}`);
 		}
+		if (app.status.toUpperCase() === "PUBLISHED" && !versions.some((v) => v.is_latest)) console.log(yellow("  ! app is PUBLISHED but no version is released — ") + yellow("new installs will fail; run `anna-app apps release <version>`"));
 		return 0;
 	});
 }

package/dist/cli.js

@@ -474,7 +474,7 @@ program.command("validate").description("Run schema + ACL checks on a manifest+b
 	process.exit(code);
 });
 program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").option("--executa <spec>", "Explicit executa registration; repeatable. Spec: comma-separated key=value (dir=<path>[,tool_id=<id>][,type=python|node|go|binary][,command=\"<argv>\"]). When only `dir=` is given, the executa is auto-detected from executa.json / pyproject.toml / package.json / go.mod. Overrides directory auto-discovery under <manifest-dir>/executas/.", (val, prev) => prev ? [...prev, val] : [val]).option("--no-llm", "Disable LLM bridge (anna.llm/agent return llm_disabled)").option("--mock-llm <fixture>", "Serve canned LLM responses from a JSONL fixture").option("--llm-account <host>", "Saved account host to use (default: current)").option("--llm-app-slug <slug>", "Override the manifest slug used to register / look up the dev AnnaApp (default: manifest.slug)").option("--storage <mode>", "Storage backend: \"legacy\" (in-memory runtime_state, default) or \"aps\" (real nexus APS via /api/v1/storage/* — requires `anna-app login`).", "legacy").option("--web <mode>", "Web backend: \"local\" (keyless ddgs + stdlib fetcher, free, default) or \"real\" (platform web service via /api/v1/copilot/app/web/* — production provider chain + normal CU billing; requires `anna-app login`).", "local").action(async (opts) => {
-	const { runDev, parseExecutaSpec } = await import("./dev-C251jRh2.js");
+	const { runDev, parseExecutaSpec } = await import("./dev-CnDh2_7r.js");
 	const cwd = opts.cwd ?? process.cwd();
 	let executas;
 	if (opts.executa && opts.executa.length > 0) {
@@ -561,7 +561,7 @@ program.command("whoami").description("Show the current account (and any others)
 });
 const account = program.command("account").description("Manage your developer account (handle / namespace)");
 account.command("set-handle <handle>").description("Set or rename your developer handle — the @handle namespace your apps publish under (@handle/slug). Required before creating your first app.").option("--host <url>", "Account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (handle, opts) => {
-	const { runAccountSetHandle } = await import("./account-BBMYzSH7.js");
+	const { runAccountSetHandle } = await import("./account-CPnwqXeh.js");
 	const code = await runAccountSetHandle({
 		handle,
 		account: opts.host,
@@ -597,7 +597,7 @@ executa.command("register").description("Register a HARNESS AnnaApp(kind=executa
 	process.exit(code);
 });
 executa.command("install").description("Install a local-dev shim for an Executa under its minted tool_id so the Agent can discover it via 'Rediscover Local' (for distribution_type: local). Resolves the tool_id from .anna/executa.json (written by `executa publish` / `apps push`) unless --tool-id is given.").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Install the shim under this exact id (default: minted id from .anna/executa.json, else executa.json tool_id)").option("--bin-dir <path>", "Install dir for the shim (default: ~/.anna/executa/bin)").option("--force", "Overwrite an existing shim of the same name", false).option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaInstall } = await import("./executa-install-V5fSZRdO.js");
+	const { runExecutaInstall } = await import("./executa-install-LaAOSkY0.js");
 	const code = await runExecutaInstall({
 		dir: opts.dir,
 		toolId: opts.toolId,
@@ -608,7 +608,7 @@ executa.command("install").description("Install a local-dev shim for an Executa
 	process.exit(code);
 });
 executa.command("dev").description("Run one Executa plugin in isolation (REPL or one-shot describe/invoke)").option("--dir <path>", "Executa project dir (default: CWD)").option("--spec <spec>", "Override discovery: comma-separated key=value (tool_id=...,type=...,command=\"...\")").option("--describe", "Print MANIFEST and exit", false).option("--health", "Print health and exit", false).option("--invoke <tool>", "Invoke one tool and exit").option("--args <json>", "JSON object passed as tool arguments", "{}").option("--json", "One-shot: emit compact JSON (no banners)", false).option("--no-sampling", "Hard-disable sampling reverse RPC (returns sampling_disabled)").option("--mock-sampling <fixture>", "Serve canned sampling responses from a JSONL fixture (offline)").option("--sampling-unsupported-format", "Simulate a model without json_schema support — exercises responseFormat onUnsupported branches (-32010 / downgrade)").option("--app-slug <slug>", "Forward sampling to nexus on behalf of this dev AnnaApp slug").option("--sampling-account <host>", "Saved account host for nexus sampling (default: current)").option("--no-agent", "Hard-disable agent reverse RPC (returns agent_not_granted)").option("--mock-agent <fixture>", "Serve canned agent/* responses from a JSONL fixture (offline)").option("--agent-account <host>", "Saved account host for nexus agent (default: --sampling-account or current)").option("--storage <mode>", "Storage backend: off | memory | mock | real (default: memory)").option("--mock-storage <fixture>", "Serve canned storage/* + files/* responses from a JSONL fixture").option("--storage-account <host>", "Saved account host for nexus storage (default: --sampling-account or current)").option("--storage-scopes <list>", "Comma-separated scopes for real storage tokens (default: user,app,tool)").option("--no-image", "Hard-disable image reverse RPC (returns image_not_granted)").option("--mock-image <fixture>", "Serve canned image/generate + image/edit responses from a JSONL fixture").option("--image-account <host>", "Saved account host for nexus image (default: --sampling-account or current)").option("--no-upload", "Hard-disable host/uploadFile reverse RPC (returns upload_not_granted)").option("--mock-upload <fixture>", "Serve canned host/uploadFile responses from a JSONL fixture").option("--upload-account <host>", "Saved account host for nexus uploads (default: --sampling-account or current)").action(async (opts) => {
-	const { runExecutaDev } = await import("./executa-dev-CSzM-Oha.js");
+	const { runExecutaDev } = await import("./executa-dev-DYO87dzg.js");
 	const storageMode = opts.storage === void 0 ? void 0 : (() => {
 		const m = opts.storage;
 		if (m === "off" || m === "memory" || m === "mock" || m === "real") return m;
@@ -646,14 +646,14 @@ executa.command("dev").description("Run one Executa plugin in isolation (REPL or
 });
 const apps = program.command("apps").description("Anna App publish lifecycle commands");
 apps.command("list").description("List the Anna Apps you authored, with lifecycle status").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsList } = await import("./apps-BQcbrExH.js");
+	const { runAppsList } = await import("./apps-CzqMRLbS.js");
 	process.exit(await runAppsList({
 		account: opts.account,
 		json: opts.json
 	}));
 });
 apps.command("rename-slug <new-slug>").description("Rename an app's public slug (DRAFT/REJECTED, never-published, zero installs only). Updates local app.json + .anna/app.json on success.").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (newSlug, opts) => {
-	const { runAppsRenameSlug } = await import("./apps-rename-slug-qKXdUDDn.js");
+	const { runAppsRenameSlug } = await import("./apps-rename-slug-CCEU_7JJ.js");
 	process.exit(await runAppsRenameSlug({
 		newSlug,
 		cwd: opts.cwd,
@@ -671,7 +671,7 @@ apps.command("publish").description("Publish or update an Anna App (manifest.jso
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runAppsPublish } = await import("./apps-publish-zeKU-9TE.js");
+	const { runAppsPublish } = await import("./apps-publish-4IIbF2xr.js");
 	process.exit(await runAppsPublish({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -705,7 +705,7 @@ apps.command("push").description("Upsert the mutable working draft (manifest + b
 			process.exit(2);
 		}
 	}
-	const { runAppsPush } = await import("./apps-push-Bpv100k_.js");
+	const { runAppsPush } = await import("./apps-push-CnSeLwdo.js");
 	process.exit(await runAppsPush({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -725,7 +725,7 @@ apps.command("push").description("Upsert the mutable working draft (manifest + b
 	}));
 });
 apps.command("cut <version>").description("Snapshot the working draft into an immutable version (freeze deps)").option("--changelog <text>", "Override the working draft changelog for this version").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't cut", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
-	const { runAppsCut } = await import("./apps-cut-BQHvzBpJ.js");
+	const { runAppsCut } = await import("./apps-cut-BhTJwILv.js");
 	process.exit(await runAppsCut({
 		version,
 		changelog: opts.changelog,
@@ -737,7 +737,7 @@ apps.command("cut <version>").description("Snapshot the working draft into an im
 	}));
 });
 apps.command("discard").description("Drop the mutable working draft (leaves cut versions intact)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't discard", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsDiscard } = await import("./apps-discard-CFQWOr9x.js");
+	const { runAppsDiscard } = await import("./apps-discard-CFi-GzpU.js");
 	process.exit(await runAppsDiscard({
 		slug: opts.slug,
 		cwd: opts.cwd,
@@ -747,7 +747,7 @@ apps.command("discard").description("Drop the mutable working draft (leaves cut
 	}));
 });
 apps.command("release <version>").description("Freeze & publish an existing remote version (go live)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--allow-create", "If the version isn't on the server, run 'apps publish' first, then release", false).option("--dry-run", "Resolve target + pre-flight but don't publish", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
-	const { runAppsRelease } = await import("./apps-release-Goi4Psmt.js");
+	const { runAppsRelease } = await import("./apps-release-DGQv6DDl.js");
 	process.exit(await runAppsRelease({
 		version,
 		slug: opts.slug,
@@ -759,7 +759,7 @@ apps.command("release <version>").description("Freeze & publish an existing remo
 	}));
 });
 apps.command("sync-meta").description("Push mutable store metadata (name/tagline/…) from the manifest").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--logo <path>", "Local logo file to upload (overrides app.json logo_file)").option("--dry-run", "Print the metadata diff but don't PATCH", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsSyncMeta } = await import("./apps-sync-meta-Ch3kECAO.js");
+	const { runAppsSyncMeta } = await import("./apps-sync-meta-DnFwFNl5.js");
 	process.exit(await runAppsSyncMeta({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -770,7 +770,7 @@ apps.command("sync-meta").description("Push mutable store metadata (name/tagline
 	}));
 });
 apps.command("submit-review [slug]").description("Move an app into review (DRAFT/REJECTED → PENDING_REVIEW)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsSubmitReview } = await import("./apps-submit-review-BmPjkoe9.js");
+	const { runAppsSubmitReview } = await import("./apps-submit-review--hZFZRJ3.js");
 	process.exit(await runAppsSubmitReview({
 		slug,
 		cwd: opts.cwd,
@@ -779,7 +779,7 @@ apps.command("submit-review [slug]").description("Move an app into review (DRAFT
 	}));
 });
 apps.command("status <slug>").description("Show server-known state for one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsStatus } = await import("./apps-status-BVIL6DYc.js");
+	const { runAppsStatus } = await import("./apps-status-C4Cxc2DF.js");
 	process.exit(await runAppsStatus({
 		slug,
 		account: opts.account,
@@ -787,7 +787,7 @@ apps.command("status <slug>").description("Show server-known state for one Anna
 	}));
 });
 apps.command("versions <slug>").description("List all server versions of one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsVersions } = await import("./apps-versions-DfapYfW-.js");
+	const { runAppsVersions } = await import("./apps-versions-C7NzG5Dk.js");
 	process.exit(await runAppsVersions({
 		slug,
 		account: opts.account,
@@ -795,7 +795,7 @@ apps.command("versions <slug>").description("List all server versions of one Ann
 	}));
 });
 apps.command("grants <slug>").description("Show currently granted scopes/quota for one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsGrants } = await import("./apps-grants-baOFOxnO.js");
+	const { runAppsGrants } = await import("./apps-grants-DqaX8UTy.js");
 	process.exit(await runAppsGrants({
 		slug,
 		account: opts.account,
@@ -803,7 +803,7 @@ apps.command("grants <slug>").description("Show currently granted scopes/quota f
 	}));
 });
 apps.command("unpublish <slug>").description("Flip a PUBLISHED app back to APPROVED (private)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsUnpublish } = await import("./apps-destructive-BVjpOxNF.js");
+	const { runAppsUnpublish } = await import("./apps-destructive-PlaU93EX.js");
 	process.exit(await runAppsUnpublish({
 		slug,
 		yes: opts.yes,
@@ -813,7 +813,7 @@ apps.command("unpublish <slug>").description("Flip a PUBLISHED app back to APPRO
 	}));
 });
 apps.command("archive <slug>").description("Archive an Anna App (hides it from end users)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsArchive } = await import("./apps-destructive-BVjpOxNF.js");
+	const { runAppsArchive } = await import("./apps-destructive-PlaU93EX.js");
 	process.exit(await runAppsArchive({
 		slug,
 		yes: opts.yes,
@@ -823,7 +823,7 @@ apps.command("archive <slug>").description("Archive an Anna App (hides it from e
 	}));
 });
 apps.command("unarchive <slug>").description("Restore an archived Anna App back to APPROVED").option("--yes", "Acknowledge the operation", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsUnarchive } = await import("./apps-destructive-BVjpOxNF.js");
+	const { runAppsUnarchive } = await import("./apps-destructive-PlaU93EX.js");
 	process.exit(await runAppsUnarchive({
 		slug,
 		yes: opts.yes,
@@ -832,7 +832,7 @@ apps.command("unarchive <slug>").description("Restore an archived Anna App back
 	}));
 });
 apps.command("delete <slug>").description("Hard-delete an Anna App (refused by server if installs exist)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsDelete } = await import("./apps-destructive-BVjpOxNF.js");
+	const { runAppsDelete } = await import("./apps-destructive-PlaU93EX.js");
 	process.exit(await runAppsDelete({
 		slug,
 		yes: opts.yes,
@@ -873,7 +873,7 @@ executa.command("publish").description("Mint or update an Executa (executa.json
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runExecutaPublish } = await import("./executa-publish-DRK9wla1.js");
+	const { runExecutaPublish } = await import("./executa-publish-6awuH4Ma.js");
 	process.exit(await runExecutaPublish({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -887,7 +887,7 @@ executa.command("publish").description("Mint or update an Executa (executa.json
 	}));
 });
 executa.command("upload-binaries").description("Push the local binary_artifacts declared in executa.json straight to the platform CDN (no public source URL needed — works for private repos). Requires a minted identity (.anna/executa.json from `executa publish` / `apps push`) or --tool-id.").option("--dir <path>", "Executa project dir (default: CWD)").option("--dry-run", "Hash artifacts + validate the plan server-side without uploading", false).option("--oidc", "Mint the upload token from the GitHub Actions OIDC id-token instead of a PAT (zero long-term secrets; needs `permissions: id-token: write` and a registered trusted publisher)", false).option("--tool-id <id>", "Explicit tool_id (skip the identity cache)").option("--host <url>", "Nexus host (required with --oidc unless ANNA_APP_HOST is set)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaUploadBinaries } = await import("./executa-upload-binaries-BRjsS5Xx.js");
+	const { runExecutaUploadBinaries } = await import("./executa-upload-binaries-FWM2yXfB.js");
 	process.exit(await runExecutaUploadBinaries({
 		dir: opts.dir,
 		dryRun: opts.dryRun,
@@ -1001,7 +1001,7 @@ program.command("publish").description("Auto-detect cwd and publish (apps publis
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runTopLevelPublish } = await import("./publish-D2c3F4GL.js");
+	const { runTopLevelPublish } = await import("./publish-D5O5JKRb.js");
 	process.exit(await runTopLevelPublish({
 		cwd: opts.cwd,
 		bump: opts.bump,

package/dist/{dev-ClCDRplP.js → dev-Bfv3WQC0.js}

@@ -175,7 +175,7 @@ async function runDev(opts) {
 */
 async function resolveRealLlm(args) {
 	const { getAccount } = await import("./credentials-Chkoidh5.js");
-	const { ensureDevAppRegistered } = await import("./dev-app-cache-B3Wa5t6X.js");
+	const { ensureDevAppRegistered } = await import("./dev-app-cache-Dw2JESld.js");
 	const acc = getAccount(args.account);
 	if (!acc) {
 		console.error(red("✗ no developer PAT on disk — run `anna-app login --host <nexus-url>` first.\n  (or use `--no-llm` / `--mock-llm <fixture>` to develop offline.)"));
@@ -204,7 +204,7 @@ async function resolveRealLlm(args) {
 			account: args.account,
 			appSlug: entry.slug,
 			onAppSlugNotFound: async () => {
-				const { invalidateDevAppCache } = await import("./dev-app-cache-B3Wa5t6X.js");
+				const { invalidateDevAppCache } = await import("./dev-app-cache-Dw2JESld.js");
 				invalidateDevAppCache(args.cwd);
 				const fresh = getAccount(args.account);
 				if (!fresh) throw new Error("PAT not found while re-registering dev app — run `anna-app login` again");

package/dist/dev-CnDh2_7r.js

@@ -0,0 +1,4 @@
+import "./nexus-root-BlPwOusj.js";
+import { parseExecutaSpec, runDev } from "./dev-Bfv3WQC0.js";
+
+export { parseExecutaSpec, runDev };

package/dist/{dev-app-cache-B3Wa5t6X.js → dev-app-cache-Dw2JESld.js}

@@ -16,8 +16,12 @@ const CACHE_FILE = "dev-app.json";
 *   2 — server now writes the full dev grant bundle (llm + image + upload);
 *       re-register so pre-existing dev apps pick up `upload_grant` /
 *       `image_grant` (fixes host/uploadFile → APP_NOT_GRANTED, forum #159)
+*   3 — server widened `llm_grant.allowed_tools` from [] to the full
+*       sandbox tool registry (nexus 1.1.0-beta.115, forum #192); stale
+*       rows made every sandbox session resolve zero tools
+*       (granted_tools: [] + NO_TOOLS_AVAILABLE, forum #225)
 */
-const DEV_APP_CACHE_VERSION = 2;
+const DEV_APP_CACHE_VERSION = 3;
 function cachePath(cwd) {
 	return resolve(cwd, CACHE_DIR, CACHE_FILE);
 }
@@ -136,8 +140,11 @@ const EXECUTA_CACHE_FILE = "dev-executa.json";
 *   1 — initial (llm_grant only)
 *   2 — adds image_grant + upload_grant; fixes `allowedPurposes` to
 *       protocol whitelist {image_input,image_reference,user_artifact}
+*   3 — server widened `llm_grant.allowed_tools` from [] to the full
+*       sandbox tool registry (nexus 1.1.0-beta.115, forum #192); same
+*       staleness as DEV_APP_CACHE_VERSION 3 for the from_sampling path
 */
-const EXECUTA_CACHE_VERSION = 2;
+const EXECUTA_CACHE_VERSION = 3;
 function executaCachePath(cwd) {
 	return resolve(cwd, CACHE_DIR, EXECUTA_CACHE_FILE);
 }

package/dist/{executa-dev-CSzM-Oha.js → executa-dev-DYO87dzg.js}

@@ -1,5 +1,5 @@
 import "./nexus-root-BlPwOusj.js";
-import { parseExecutaSpec } from "./dev-ClCDRplP.js";
+import { parseExecutaSpec } from "./dev-Bfv3WQC0.js";
 import { isAbsolute, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
@@ -35,7 +35,7 @@ async function runExecutaDev(opts) {
 	const oneShot = !!(opts.describe || opts.health || opts.invoke);
 	const quiet = oneShot && (opts.json ?? false);
 	const { getAccount } = await import("./credentials-Chkoidh5.js");
-	const { ensureDevExecutaRegistered } = await import("./dev-app-cache-B3Wa5t6X.js");
+	const { ensureDevExecutaRegistered } = await import("./dev-app-cache-Dw2JESld.js");
 	const needsRealMint = !opts.noSampling && !opts.mockSampling || !opts.noAgent && !opts.mockAgent || !opts.noImage && !opts.mockImage || !opts.noUpload && !opts.mockUpload || opts.storage === "real";
 	let effectiveAppSlug = opts.appSlug;
 	let autoRegistered = false;

package/dist/{executa-install-CM4x4doq.js → executa-install-DAposiBw.js}

@@ -1,5 +1,5 @@
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { parseExecutaSpec } from "./dev-ClCDRplP.js";
+import { parseExecutaSpec } from "./dev-Bfv3WQC0.js";
 import { isAbsolute, join, resolve } from "node:path";
 import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";

package/dist/executa-install-LaAOSkY0.js

@@ -0,0 +1,7 @@
+import "./credentials-BTv2IfUZ.js";
+import "./nexus-root-BlPwOusj.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./dev-Bfv3WQC0.js";
+import { runExecutaInstall } from "./executa-install-DAposiBw.js";
+
+export { runExecutaInstall };

package/dist/{executa-publish-DRK9wla1.js → executa-publish-6awuH4Ma.js}

@@ -2,10 +2,10 @@ import "./credentials-BTv2IfUZ.js";
 import "./client-sMzq2PWG.js";
 import "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./manifest-DZyXkzg5.js";
+import "./manifest-B_DjigtQ.js";
 import "./executas-CvQY_w2U.js";
-import { runExecutaPublish } from "./executa-publish-DiyLvmyl.js";
+import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
 import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-pCHYUcie.js";
+import "./executa-upload-binaries-DwWQ18Dq.js";
 
 export { runExecutaPublish };

package/dist/{executa-publish-DiyLvmyl.js → executa-publish-BKnsUoZq.js}

@@ -2,9 +2,9 @@ import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-DZyXkzg5.js";
+import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
 import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-CvQY_w2U.js";
-import { uploadExecutaBinaries } from "./executa-upload-binaries-pCHYUcie.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-DwWQ18Dq.js";
 import { join, relative, resolve, sep } from "node:path";
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";

package/dist/{executa-upload-binaries-pCHYUcie.js → executa-upload-binaries-DwWQ18Dq.js}

@@ -2,7 +2,7 @@ import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-DZyXkzg5.js";
+import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
 import { fetchGitHubIdToken, finalizeBinaryUpload, initBinaryUpload, mintUploadSession, mintUploadSessionViaOidc, uploadBinaryPart } from "./binary-upload-DVhQ0uY0.js";
 import { isAbsolute, resolve } from "node:path";
 import { closeSync, createReadStream, existsSync, openSync, readSync, statSync } from "node:fs";

package/dist/{executa-upload-binaries-BRjsS5Xx.js → executa-upload-binaries-FWM2yXfB.js}

@@ -2,8 +2,8 @@ import "./credentials-BTv2IfUZ.js";
 import "./client-sMzq2PWG.js";
 import "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./manifest-DZyXkzg5.js";
+import "./manifest-B_DjigtQ.js";
 import "./binary-upload-DVhQ0uY0.js";
-import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-pCHYUcie.js";
+import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-DwWQ18Dq.js";
 
 export { runExecutaUploadBinaries };

package/dist/{listing-meta-DvxLn9NY.js → listing-meta-DgweMStT.js}

@@ -1,4 +1,4 @@
-import { patchApp, uploadAppLogo, uploadAppScreenshot } from "./apps-DlVsVHQ5.js";
+import { patchApp, uploadAppLogo, uploadAppScreenshot } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { extname, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
@@ -39,8 +39,7 @@ const LISTING_META_LIMITS = {
 	cover_url: 500,
 	homepage_url: 500,
 	support_url: 500,
-	privacy_url: 500,
-	pricing_model: 20
+	privacy_url: 500
 };
 function checkListingLimit(key, value) {
 	const max = LISTING_META_LIMITS[key];
@@ -74,7 +73,6 @@ function buildMeta(manifest) {
 	addClearable("homepage_url", manifest.homepageUrl);
 	addClearable("support_url", manifest.supportUrl);
 	addClearable("privacy_url", manifest.privacyUrl);
-	add("pricing_model", manifest.pricingModel);
 	return meta;
 }
 /**

package/dist/{manifest-DZyXkzg5.js → manifest-B_DjigtQ.js}

@@ -78,8 +78,7 @@ function loadAppManifest(cwd, manifestPath) {
 		screenshots: pickMetaArray("screenshots"),
 		homepageUrl: pickClearableMeta("homepage_url"),
 		supportUrl: pickClearableMeta("support_url"),
-		privacyUrl: pickClearableMeta("privacy_url"),
-		pricingModel: pickMeta("pricing_model")
+		privacyUrl: pickClearableMeta("privacy_url")
 	};
 }
 const HANDLE_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;

package/dist/{publish-D2c3F4GL.js → publish-D5O5JKRb.js}

@@ -1,18 +1,18 @@
 import "./credentials-BTv2IfUZ.js";
-import "./apps-DlVsVHQ5.js";
+import "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
 import "./bundled-executas-BRyQkI9u.js";
-import "./manifest-DZyXkzg5.js";
+import "./manifest-B_DjigtQ.js";
 import "./executas-CvQY_w2U.js";
-import { runExecutaPublish } from "./executa-publish-DiyLvmyl.js";
+import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
 import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-pCHYUcie.js";
+import "./executa-upload-binaries-DwWQ18Dq.js";
 import "./app-cache-Cr3tKbux.js";
-import "./listing-meta-DvxLn9NY.js";
-import "./app-bundle-upload-BNBH9x6a.js";
-import { runAppsPublish } from "./apps-publish-DFKd-Egv.js";
+import "./listing-meta-DgweMStT.js";
+import "./app-bundle-upload-Ca0r-kPy.js";
+import { runAppsPublish } from "./apps-publish-8N9x4VEM.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { red, yellow } from "kleur/colors";

package/dist/{working-orchestration-Ny4fR7gv.js → working-orchestration-CpBJLs50.js}

@@ -1,10 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { createApp, findAppBySlug, getApp } from "./apps-DlVsVHQ5.js";
+import { createApp, findAppBySlug, getApp } from "./apps-HbfURK6y.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-BRyQkI9u.js";
-import { loadExecutaManifest } from "./manifest-DZyXkzg5.js";
-import { runExecutaPublish } from "./executa-publish-DiyLvmyl.js";
-import { runExecutaInstall } from "./executa-install-CM4x4doq.js";
+import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
+import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
+import { runExecutaInstall } from "./executa-install-DAposiBw.js";
 import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { join, resolve } from "node:path";
 import { dim, green, yellow } from "kleur/colors";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anna-ai/cli",
-  "version": "0.1.46",
+  "version": "0.1.49",
   "description": "Anna App developer CLI: scaffold, validate, harness (Phase 2 MVP: init + validate).",
   "license": "MIT",
   "type": "module",

package/templates/minimal/app.json

@@ -2,6 +2,5 @@
   "name": "__SLUG__",
   "tagline": "TODO",
   "description": "TODO",
-  "category": "productivity",
-  "pricing_model": "free"
+  "category": "productivity"
 }

package/dist/apps-grants-baOFOxnO.js

@@ -1,34 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import { findAppBySlug, getAppGrants } from "./apps-DlVsVHQ5.js";
-import { CliError } from "./client-sMzq2PWG.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
-import { bold, cyan, dim } from "kleur/colors";
-
-//#region src/commands/apps-grants.ts
-async function runAppsGrants(opts) {
-	return withErrorHandling(async () => {
-		const { client, host } = resolveClient({ account: opts.account });
-		const app = await findAppBySlug(client, opts.slug);
-		if (!app) throw new CliError(`no app with slug "${opts.slug}" on ${host}`, 5);
-		const grants = await getAppGrants(client, app.id);
-		if (opts.json) {
-			console.log(JSON.stringify({
-				host,
-				app_id: app.id,
-				slug: app.slug,
-				grants
-			}, null, 2));
-			return 0;
-		}
-		console.log(bold(cyan(`apps/${app.slug}`)) + " " + dim(`grants`));
-		if (!grants) {
-			console.log(dim("  (no grants endpoint data available)"));
-			return 0;
-		}
-		console.log(JSON.stringify(grants, null, 2));
-		return 0;
-	});
-}
-
-//#endregion
-export { runAppsGrants };

package/dist/apps-publish-zeKU-9TE.js

@@ -1,17 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import "./apps-DlVsVHQ5.js";
-import "./client-sMzq2PWG.js";
-import "./_lifecycle-shared-_9BzQ9Y2.js";
-import "./executa-cache-BFoUtb4J.js";
-import "./bundled-executas-BRyQkI9u.js";
-import "./manifest-DZyXkzg5.js";
-import "./executas-CvQY_w2U.js";
-import "./executa-publish-DiyLvmyl.js";
-import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-pCHYUcie.js";
-import "./app-cache-Cr3tKbux.js";
-import "./listing-meta-DvxLn9NY.js";
-import "./app-bundle-upload-BNBH9x6a.js";
-import { runAppsPublish } from "./apps-publish-DFKd-Egv.js";
-
-export { runAppsPublish };

package/dist/dev-C251jRh2.js

@@ -1,4 +0,0 @@
-import "./nexus-root-BlPwOusj.js";
-import { parseExecutaSpec, runDev } from "./dev-ClCDRplP.js";
-
-export { parseExecutaSpec, runDev };

package/dist/executa-install-V5fSZRdO.js

@@ -1,7 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import "./nexus-root-BlPwOusj.js";
-import "./executa-cache-BFoUtb4J.js";
-import "./dev-ClCDRplP.js";
-import { runExecutaInstall } from "./executa-install-CM4x4doq.js";
-
-export { runExecutaInstall };