@anna-ai/cli 0.1.49 → 0.1.51

package/dist/{executa-publish-BKnsUoZq.js → executa-publish-BuakG1RK.js}

@@ -2,9 +2,9 @@ import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
+import { loadExecutaManifest, protocolHostCapabilities } from "./manifest-BCHiC184.js";
 import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-CvQY_w2U.js";
-import { uploadExecutaBinaries } from "./executa-upload-binaries-DwWQ18Dq.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-D0JWYOtK.js";
 import { join, relative, resolve, sep } from "node:path";
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
@@ -169,7 +169,8 @@ async function runExecutaPublish(opts) {
 					executa_type: manifest.executa_type,
 					slug: manifest.slug,
 					version: manifest.version,
-					...distributionPayload(manifest.distribution)
+					...distributionPayload(manifest.distribution),
+					...manifest.protocolManifest ? { manifest_cache: manifest.protocolManifest } : {}
 				};
 				if (manifest.executa_type === "skill") {
 					finalPayload.skill_content = manifest.skillContent;
@@ -202,12 +203,22 @@ async function runExecutaPublish(opts) {
 			version: manifest.version,
 			...manifest.executionMode ? { skill_execution_mode: manifest.executionMode } : {}
 		});
-		else await updateMyTool(client, executaId, {
-			name: manifest.name,
-			description: manifest.description,
-			version: manifest.version,
-			...distributionPayload(manifest.distribution)
-		});
+		else {
+			await updateMyTool(client, executaId, {
+				name: manifest.name,
+				description: manifest.description,
+				version: manifest.version,
+				...distributionPayload(manifest.distribution),
+				...manifest.protocolManifest ? { manifest_cache: manifest.protocolManifest } : {}
+			});
+			if (!opts.json && !opts.quiet) {
+				if (manifest.protocolManifest && manifest.protocolManifestPath) {
+					const caps = protocolHostCapabilities(manifest.protocolManifest);
+					const capsNote = caps.length > 0 ? `${caps.length} host capabilit${caps.length === 1 ? "y" : "ies"}: ${caps.join(", ")}` : "no host_capabilities declared";
+					console.log(dim(`  synced protocol manifest (${capsNote}) from ${manifest.protocolManifestPath.replace(cwd + "/", "")}`));
+				} else if (manifest.distribution) console.log(yellow("! no protocol manifest found (no `manifest.json` next to executa.json, no `manifest_file` field) — host-capability permissions (host.upload / aps.* / llm.* / web.*) declared by the plugin will NOT be grantable in the Executa permissions UI until an agent-side describe backfills them. Export the plugin's describe manifest to manifest.json and re-publish."));
+			}
+		}
 		if (!isSkill && manifest.distribution?.binaryArtifacts && opts.freeze !== false) {
 			const upLog = (msg) => {
 				if (!opts.json && !opts.quiet) console.log(msg);
@@ -254,7 +265,10 @@ async function runExecutaPublish(opts) {
 			first_publish: firstPublish,
 			published_public: publishedToPublic,
 			visibility: finalExecuta.visibility ?? null,
-			latest_version_id: latest?.id ?? null
+			latest_version_id: latest?.id ?? null,
+			executa_type: manifest.executa_type,
+			manifest_synced: Boolean(manifest.protocolManifest),
+			host_capabilities: protocolHostCapabilities(manifest.protocolManifest)
 		};
 		opts.capture?.(result);
 		if (opts.quiet) return 0;
@@ -270,6 +284,19 @@ async function runExecutaPublish(opts) {
 		return 0;
 	});
 }
+/**
+* One-line protocol-manifest sync note for a bundled `executa publish`
+* result, printed by the `apps publish` / `apps push` orchestration
+* (the nested publish itself runs `quiet`). `null` → nothing to print.
+*/
+function manifestSyncNote(r) {
+	if (r.executa_type !== "tool") return null;
+	if (r.manifest_synced) {
+		const caps = r.host_capabilities;
+		return dim("    protocol manifest synced (" + (caps.length > 0 ? `host capabilities: ${caps.join(", ")}` : "no host_capabilities declared") + ")");
+	}
+	return yellow("  ! no protocol manifest for this bundled executa — add manifest.json (the plugin's describe response) next to its executa.json so declared host capabilities (host.upload / aps.* / llm.* / web.*) become grantable in the Executa permissions UI");
+}
 
 //#endregion
-export { bumpVersion, bundleHash, canonicalize, manifestHash, rewriteVersion, runExecutaPublish };
+export { bumpVersion, bundleHash, canonicalize, manifestHash, manifestSyncNote, rewriteVersion, runExecutaPublish };

package/dist/{executa-publish-6awuH4Ma.js → executa-publish-CVlMaHIY.js}

@@ -2,10 +2,10 @@ import "./credentials-BTv2IfUZ.js";
 import "./client-sMzq2PWG.js";
 import "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./manifest-B_DjigtQ.js";
+import "./manifest-BCHiC184.js";
 import "./executas-CvQY_w2U.js";
-import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
+import { manifestSyncNote, runExecutaPublish } from "./executa-publish-BuakG1RK.js";
 import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-DwWQ18Dq.js";
+import "./executa-upload-binaries-D0JWYOtK.js";
 
 export { runExecutaPublish };

package/dist/{executa-upload-binaries-FWM2yXfB.js → executa-upload-binaries-BVWs6MFF.js}

@@ -2,8 +2,8 @@ import "./credentials-BTv2IfUZ.js";
 import "./client-sMzq2PWG.js";
 import "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./manifest-B_DjigtQ.js";
+import "./manifest-BCHiC184.js";
 import "./binary-upload-DVhQ0uY0.js";
-import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-DwWQ18Dq.js";
+import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-D0JWYOtK.js";
 
 export { runExecutaUploadBinaries };

package/dist/{executa-upload-binaries-DwWQ18Dq.js → executa-upload-binaries-D0JWYOtK.js}

@@ -2,7 +2,7 @@ import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
+import { loadExecutaManifest } from "./manifest-BCHiC184.js";
 import { fetchGitHubIdToken, finalizeBinaryUpload, initBinaryUpload, mintUploadSession, mintUploadSessionViaOidc, uploadBinaryPart } from "./binary-upload-DVhQ0uY0.js";
 import { isAbsolute, resolve } from "node:path";
 import { closeSync, createReadStream, existsSync, openSync, readSync, statSync } from "node:fs";

package/dist/{listing-meta-DgweMStT.js → listing-meta-rIni8tjd.js}

@@ -1,4 +1,4 @@
-import { patchApp, uploadAppLogo, uploadAppScreenshot } from "./apps-HbfURK6y.js";
+import { patchApp, uploadAppLogo, uploadAppScreenshot } from "./apps-BRBufSyX.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { extname, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";

package/dist/{manifest-B_DjigtQ.js → manifest-BCHiC184.js}

@@ -1,5 +1,5 @@
 import { CliError } from "./client-sMzq2PWG.js";
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 
 //#region src/publish/manifest.ts
@@ -118,6 +118,7 @@ function loadExecutaManifest(cwd, manifestPath, profileOverride) {
 		skillContent = readFileSync(contentPath, "utf-8");
 		if (!skillContent.trim()) throw new CliError(`skill content file "${contentFile}" is empty`, 4);
 	}
+	const protocol = loadProtocolManifest(path, raw, t);
 	return {
 		kind: "executa",
 		path,
@@ -130,10 +131,55 @@ function loadExecutaManifest(cwd, manifestPath, profileOverride) {
 		changelog: pickString(raw, "changelog") ?? void 0,
 		skillContent,
 		executionMode: pickString(raw, "execution_mode") ?? void 0,
-		distribution: parseExecutaDistribution(raw["distribution"], t, profileOverride)
+		distribution: parseExecutaDistribution(raw["distribution"], t, profileOverride),
+		protocolManifest: protocol?.manifest,
+		protocolManifestPath: protocol?.path
 	};
 }
 /**
+* Load the Executa JSON-RPC protocol manifest for a `tool` Executa.
+*
+* Resolution (relative to the directory holding `executa.json`):
+*   1. explicit `executa.json` `manifest_file` path — must exist;
+*   2. sibling `manifest.json` convention — optional.
+*
+* Returns `undefined` when no protocol manifest is available (the server
+* `manifest_cache` field is then simply not synced — backwards compatible).
+*/
+function loadProtocolManifest(executaJsonPath, raw, executaType) {
+	const declared = raw["manifest_file"];
+	if (declared !== void 0 && typeof declared !== "string") throw new CliError("executa.json `manifest_file` must be a string path", 4);
+	if (executaType === "skill") {
+		if (declared) throw new CliError("executa.json `manifest_file` is only valid for `executa_type: \"tool\"` — skills have no JSON-RPC protocol manifest", 4);
+		return void 0;
+	}
+	const dir = dirname(executaJsonPath);
+	const path = resolve(dir, declared ?? "manifest.json");
+	if (!existsSync(path)) {
+		if (declared) throw new CliError(`executa.json \`manifest_file\` points at "${declared}" but ${path} does not exist`, 4);
+		return void 0;
+	}
+	const manifest = readJson(path);
+	const caps = manifest["host_capabilities"] ?? manifest["hostCapabilities"];
+	if (caps !== void 0 && caps !== null) {
+		const isStrArray = Array.isArray(caps) && caps.every((c) => typeof c === "string");
+		const isBoolMap = !Array.isArray(caps) && typeof caps === "object" && Object.values(caps).every((v) => typeof v === "boolean");
+		if (!isStrArray && !isBoolMap) throw new CliError(`protocol manifest ${path} \`host_capabilities\` must be an array of strings (or a {capability: bool} map)`, 4);
+	}
+	return {
+		manifest,
+		path
+	};
+}
+/** Declared host capability strings of a protocol manifest (normalised). */
+function protocolHostCapabilities(manifest) {
+	if (!manifest) return [];
+	const caps = manifest["host_capabilities"] ?? manifest["hostCapabilities"];
+	if (Array.isArray(caps)) return caps.filter((c) => typeof c === "string");
+	if (caps && typeof caps === "object") return Object.entries(caps).filter(([, v]) => v === true).map(([k]) => k);
+	return [];
+}
+/**
 * Parse + validate the optional `executa.json` `distribution` object.
 *
 * Returns `undefined` when absent (a dev-only Executa). Skills never carry
@@ -335,4 +381,4 @@ function pickStringArray(o, k) {
 }
 
 //#endregion
-export { loadAppManifest, loadExecutaManifest };
+export { loadAppManifest, loadExecutaManifest, protocolHostCapabilities };

package/dist/{publish-D5O5JKRb.js → publish-CIaosgo4.js}

@@ -1,18 +1,23 @@
 import "./credentials-BTv2IfUZ.js";
-import "./apps-HbfURK6y.js";
+import "./nexus-root-BlPwOusj.js";
+import "./apps-BRBufSyX.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
 import "./bundled-executas-BRyQkI9u.js";
-import "./manifest-B_DjigtQ.js";
+import "./manifest-BCHiC184.js";
 import "./executas-CvQY_w2U.js";
-import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
+import { runExecutaPublish } from "./executa-publish-BuakG1RK.js";
 import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-DwWQ18Dq.js";
+import "./executa-upload-binaries-D0JWYOtK.js";
+import "./dev-BB1oS-1o.js";
+import "./executa-install-n1oRAoYJ.js";
 import "./app-cache-Cr3tKbux.js";
-import "./listing-meta-DgweMStT.js";
-import "./app-bundle-upload-Ca0r-kPy.js";
-import { runAppsPublish } from "./apps-publish-8N9x4VEM.js";
+import "./working-orchestration-BRU7FV-b.js";
+import "./apps-cut-L7T8b5RS.js";
+import "./listing-meta-rIni8tjd.js";
+import "./apps-push-d1C0eePp.js";
+import { runAppsPublish } from "./apps-publish-CGfzN7tI.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { red, yellow } from "kleur/colors";
@@ -21,9 +26,8 @@ import { red, yellow } from "kleur/colors";
 function detectProjectKind(cwd) {
 	const hasManifest = existsSync(resolve(cwd, "manifest.json"));
 	const hasExecuta = existsSync(resolve(cwd, "executa.json"));
-	if (hasManifest && hasExecuta) return "ambiguous";
-	if (hasManifest) return "app";
 	if (hasExecuta) return "executa";
+	if (hasManifest) return "app";
 	return "unknown";
 }
 
@@ -33,7 +37,6 @@ async function runTopLevelPublish(opts) {
 	return withErrorHandling(async () => {
 		const cwd = resolve(opts.cwd ?? process.cwd());
 		const kind = detectProjectKind(cwd);
-		if (kind === "ambiguous") throw new CliError(`cannot auto-detect: ${cwd} has BOTH manifest.json and executa.json. Run \`anna-app apps publish\` or \`anna-app executa publish\` explicitly.`, 4);
 		if (kind === "unknown") throw new CliError(`no manifest.json or executa.json found in ${cwd}`, 4);
 		if (kind === "app") return runAppsPublish({
 			cwd,

package/dist/{server-Dr_htFv8.js → server-poDjwty-.js}

@@ -1,5 +1,5 @@
 import { canonicalHost, getAccount } from "./credentials-BTv2IfUZ.js";
-import { BridgeRequestError } from "./bridge-sFHqOOat.js";
+import { BridgeRequestError } from "./bridge-Bo8eu3-d.js";
 import { dirname, join, normalize, resolve } from "node:path";
 import { createRequire } from "node:module";
 import { createReadStream, existsSync, readFileSync, statSync, watch } from "node:fs";

package/dist/{storage-aii8EyPC.js → storage-CZ4c4ibf.js}

@@ -1,5 +1,5 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { hostOf, requireAccount, withCode } from "./dev-account-CfVdGa9j.js";
+import { hostOf, requireAccount, withCode } from "./dev-account-IrYL4u4F.js";
 import { resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 

package/dist/{working-orchestration-CpBJLs50.js → working-orchestration-BRU7FV-b.js}

@@ -1,10 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { createApp, findAppBySlug, getApp } from "./apps-HbfURK6y.js";
+import { createApp, findAppBySlug, getApp } from "./apps-BRBufSyX.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-BRyQkI9u.js";
-import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
-import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
-import { runExecutaInstall } from "./executa-install-DAposiBw.js";
+import { loadExecutaManifest } from "./manifest-BCHiC184.js";
+import { manifestSyncNote, runExecutaPublish } from "./executa-publish-BuakG1RK.js";
+import { runExecutaInstall } from "./executa-install-n1oRAoYJ.js";
 import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { join, resolve } from "node:path";
 import { dim, green, yellow } from "kleur/colors";
@@ -72,7 +72,11 @@ async function resolveBundledExecutas(params) {
 			path: decl.path,
 			source: params.lockSource ?? (freeze ? "published" : "working")
 		};
-		if (!json) console.log(green(`  ✓ bundled:${decl.handle} → ${captured.tool_id}`) + dim(` (v${captured.version}${captured.idempotent_hit ? ", unchanged" : ""})`));
+		if (!json) {
+			console.log(green(`  ✓ bundled:${decl.handle} → ${captured.tool_id}`) + dim(` (v${captured.version}${captured.idempotent_hit ? ", unchanged" : ""})`));
+			const note = manifestSyncNote(captured);
+			if (note) console.log(note);
+		}
 	}
 	for (const o of overrides) if (!(o.handle in resolved)) {
 		resolved[o.handle] = o.toolId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anna-ai/cli",
-  "version": "0.1.49",
+  "version": "0.1.51",
   "description": "Anna App developer CLI: scaffold, validate, harness (Phase 2 MVP: init + validate).",
   "license": "MIT",
   "type": "module",
@@ -33,8 +33,8 @@
     "prepublishOnly": "pnpm lint && pnpm test && pnpm build && node scripts/check-runtime-pin.mjs && node scripts/check-sdk-pin.mjs"
   },
   "dependencies": {
-    "@anna-ai/app-runtime": "^0.15.0",
-    "@anna-ai/app-schema": "^0.19.0",
+    "@anna-ai/app-runtime": "^0.16.0",
+    "@anna-ai/app-schema": "^0.22.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "commander": "^12.1.0",

package/dist/apps-publish-4IIbF2xr.js

@@ -1,17 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import "./apps-HbfURK6y.js";
-import "./client-sMzq2PWG.js";
-import "./_lifecycle-shared-_9BzQ9Y2.js";
-import "./executa-cache-BFoUtb4J.js";
-import "./bundled-executas-BRyQkI9u.js";
-import "./manifest-B_DjigtQ.js";
-import "./executas-CvQY_w2U.js";
-import "./executa-publish-BKnsUoZq.js";
-import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-DwWQ18Dq.js";
-import "./app-cache-Cr3tKbux.js";
-import "./listing-meta-DgweMStT.js";
-import "./app-bundle-upload-Ca0r-kPy.js";
-import { runAppsPublish } from "./apps-publish-8N9x4VEM.js";
-
-export { runAppsPublish };

package/dist/apps-publish-8N9x4VEM.js

@@ -1,272 +0,0 @@
-import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { createApp, createVersion, findAppBySlug, getApp } from "./apps-HbfURK6y.js";
-import { CliError } from "./client-sMzq2PWG.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
-import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-BRyQkI9u.js";
-import { loadAppManifest } from "./manifest-B_DjigtQ.js";
-import { bumpVersion, bundleHash, manifestHash, rewriteVersion, runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
-import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
-import { syncAppListingMeta } from "./listing-meta-DgweMStT.js";
-import { isExistingDir, uploadAppBundle } from "./app-bundle-upload-Ca0r-kPy.js";
-import { resolve } from "node:path";
-import { bold, cyan, dim, green, yellow } from "kleur/colors";
-
-//#region src/commands/apps-publish.ts
-async function runAppsPublish(opts) {
-	return withErrorHandling(async () => {
-		const cwd = resolve(opts.cwd ?? process.cwd());
-		const manifest = loadAppManifest(cwd, opts.manifest);
-		const { client, host, source } = resolveClient({ account: opts.account });
-		if (!opts.json) {
-			console.log(dim(`using PAT from ${source} (host=${host})`));
-			console.log(yellow("⚠ `apps publish` mints an immutable version directly. The Option-C working-draft flow is now preferred:"));
-			console.log(dim("    anna-app apps push            ") + dim("# upsert the mutable working draft (safe every commit)"));
-			console.log(dim("    anna-app apps cut <version>   ") + dim("# snapshot + freeze executa deps"));
-		}
-		if (opts.bump) {
-			const next = bumpVersion(manifest.version, opts.bump);
-			if (!opts.json) console.log(yellow(`↑ bumping manifest.version: ${manifest.version} → ${next}`));
-			if (!opts.noWrite && !opts.dryRun) rewriteVersion(manifest.metadataPath, manifest.metadataRaw, next);
-			manifest.version = next;
-			manifest.metadataRaw.version = next;
-			if (manifest.metadataRaw !== manifest.raw && "version" in manifest.raw) manifest.raw.version = next;
-		}
-		const overrides = parseExecutaIdOverrides(opts.executaId);
-		const bundledActive = !opts.noBundledExecutas && (manifest.bundledExecutas.length > 0 || overrides.length > 0);
-		let publishManifestRaw = manifest.raw;
-		if (bundledActive) {
-			const { referenced } = validateBundledHandles(manifest.raw, manifest.bundledExecutas, overrides);
-			const overrideMap = new Map(overrides.map((o) => [o.handle, o.toolId]));
-			const lock = readExecutasLock(cwd, host);
-			const resolved = {};
-			const lockEntries = {};
-			for (const decl of manifest.bundledExecutas) {
-				if (overrideMap.has(decl.handle)) {
-					const id = overrideMap.get(decl.handle);
-					resolved[decl.handle] = id;
-					lockEntries[decl.handle] = {
-						tool_id: id,
-						path: decl.path,
-						source: "override"
-					};
-					if (!opts.json) console.log(dim(`  bundled:${decl.handle} → ${id} (override)`));
-					continue;
-				}
-				if (opts.skipExecutaPublish) {
-					const cachedId = lock?.executas[decl.handle]?.tool_id;
-					if (!cachedId) throw new CliError(`--skip-executa-publish set but no cached tool_id for "${decl.handle}" in .anna/executas.lock.json (run without --skip-executa-publish first, or pass --executa-id ${decl.handle}=<tool-id>)`, 4);
-					resolved[decl.handle] = cachedId;
-					lockEntries[decl.handle] = {
-						tool_id: cachedId,
-						path: decl.path,
-						source: "cache"
-					};
-					if (!opts.json) console.log(dim(`  bundled:${decl.handle} → ${cachedId} (cache)`));
-					continue;
-				}
-				const execCwd = resolve(cwd, decl.path);
-				if (opts.dryRun) {
-					if (!opts.json) console.log(yellow(`  [dry-run] would publish bundled executa "${decl.handle}" from ${decl.path}`));
-					continue;
-				}
-				if (!opts.json) console.log(dim(`  publishing bundled executa "${decl.handle}" (${decl.path})…`));
-				let captured;
-				const code = await runExecutaPublish({
-					cwd: execCwd,
-					account: opts.account,
-					quiet: true,
-					profile: opts.profile,
-					capture: (r) => {
-						captured = r;
-					}
-				});
-				if (code !== 0 || !captured) throw new CliError(`failed to publish bundled executa "${decl.handle}" (${decl.path})`, code === 0 ? 4 : code);
-				resolved[decl.handle] = captured.tool_id;
-				lockEntries[decl.handle] = {
-					tool_id: captured.tool_id,
-					path: decl.path,
-					source: "published"
-				};
-				if (!opts.json) console.log(green(`  ✓ bundled:${decl.handle} → ${captured.tool_id}`) + dim(` (v${captured.version}${captured.idempotent_hit ? ", unchanged" : ""})`));
-			}
-			for (const o of overrides) if (!(o.handle in resolved)) {
-				resolved[o.handle] = o.toolId;
-				lockEntries[o.handle] = {
-					tool_id: o.toolId,
-					source: "override"
-				};
-				if (!opts.json) console.log(dim(`  bundled:${o.handle} → ${o.toolId} (override)`));
-			}
-			const missing = [...referenced].filter((h) => !(h in resolved));
-			if (missing.length > 0 && !opts.dryRun) throw new CliError(`could not resolve bundled handle(s): ${missing.sort().join(", ")}`, 4);
-			if (!opts.dryRun) {
-				const merged = {
-					$schema: "anna-executas-lock/v1",
-					host: canonicalHost(host),
-					executas: {
-						...lock?.executas ?? {},
-						...lockEntries
-					}
-				};
-				writeExecutasLock(cwd, merged);
-				publishManifestRaw = substituteBundledRefs(manifest.raw, resolved);
-				const bundleEntry = manifest.raw.ui?.bundle?.entry;
-				if (bundleEntry) {
-					const bundleDir$1 = resolve(cwd, "bundle");
-					if (Object.keys(resolved).length > 0) {
-						const sidecar = writeBundleToolIdSidecar(bundleDir$1, resolved);
-						if (!opts.json) console.log(dim(`  wrote ${sidecar.replace(cwd + "/", "")}`));
-					}
-				}
-			}
-		}
-		let cached = readAppIdentity(cwd);
-		if (cached && cached.host !== canonicalHost(host)) cached = null;
-		let appId;
-		let serverSlug;
-		let firstPublish = false;
-		let appIdFromCache = false;
-		if (cached && appCacheMatches(cached, host, manifest.slug)) {
-			appId = cached.app_id;
-			serverSlug = cached.slug;
-			appIdFromCache = true;
-		} else {
-			const found = await findAppBySlug(client, manifest.slug);
-			if (found) {
-				appId = found.id;
-				serverSlug = found.slug;
-			} else {
-				if (opts.dryRun) {
-					if (!opts.json) console.log(yellow(`[dry-run] would create AnnaApp slug=${manifest.slug}, then upload version ${manifest.version}`));
-					return 0;
-				}
-				const created = await createApp(client, {
-					slug: manifest.slug,
-					name: manifest.name,
-					category: manifest.category,
-					tagline: manifest.tagline,
-					description: manifest.description
-				});
-				appId = created.id;
-				serverSlug = created.slug;
-				firstPublish = true;
-			}
-			writeAppIdentity(cwd, {
-				$schema: "anna-app-identity/v1",
-				host: canonicalHost(host),
-				app_id: appId,
-				slug: serverSlug,
-				first_published_at: cached?.first_published_at ?? new Date().toISOString()
-			});
-		}
-		if (opts.dryRun) {
-			if (!opts.json) {
-				console.log(yellow(`[dry-run] resolved app_id=${appId} slug=${serverSlug}; would POST version ${manifest.version}`));
-				const uiEntry = publishManifestRaw.ui?.bundle?.entry;
-				const dryBundleDir = resolve(cwd, opts.bundleDir ?? "bundle");
-				if (uiEntry && !opts.noBundle && isExistingDir(dryBundleDir)) console.log(yellow(`[dry-run] would upload UI bundle from ${dryBundleDir} (entry=${uiEntry})`));
-			}
-			return 0;
-		}
-		const hashInput = {
-			version: manifest.version,
-			manifest: publishManifestRaw
-		};
-		const hashBundleEntry = publishManifestRaw.ui?.bundle?.entry;
-		const hashBundleDir = resolve(cwd, opts.bundleDir ?? "bundle");
-		const hash = hashBundleEntry && !opts.noBundle && isExistingDir(hashBundleDir) ? bundleHash(hashInput, hashBundleDir) : manifestHash(hashInput);
-		let verResp;
-		try {
-			verResp = await createVersion(client, appId, {
-				version: manifest.version,
-				changelog: manifest.changelog,
-				manifest: publishManifestRaw
-			}, hash);
-		} catch (e) {
-			if (appIdFromCache && e instanceof CliError && e.status === 404) {
-				if (!opts.json) console.log(yellow(`\u26a0 cached app_id=${appId} not found on server (deleted?); re-resolving identity and retrying\u2026`));
-				const found = await findAppBySlug(client, manifest.slug);
-				if (found) {
-					appId = found.id;
-					serverSlug = found.slug;
-				} else {
-					const created = await createApp(client, {
-						slug: manifest.slug,
-						name: manifest.name,
-						category: manifest.category,
-						tagline: manifest.tagline,
-						description: manifest.description
-					});
-					appId = created.id;
-					serverSlug = created.slug;
-					firstPublish = true;
-				}
-				writeAppIdentity(cwd, {
-					$schema: "anna-app-identity/v1",
-					host: canonicalHost(host),
-					app_id: appId,
-					slug: serverSlug,
-					first_published_at: cached?.first_published_at ?? new Date().toISOString()
-				});
-				verResp = await createVersion(client, appId, {
-					version: manifest.version,
-					changelog: manifest.changelog,
-					manifest: publishManifestRaw
-				}, hash);
-			} else throw e;
-		}
-		let bundleResult = null;
-		const uiBundle = publishManifestRaw.ui?.bundle;
-		const bundleDir = resolve(cwd, opts.bundleDir ?? "bundle");
-		if (uiBundle?.entry && !opts.noBundle) if (!isExistingDir(bundleDir)) {
-			if (!opts.json) console.log(yellow(`⚠ manifest declares ui.bundle.entry="${uiBundle.entry}" but bundle dir not found (${bundleDir}); skipping UI bundle upload`));
-		} else bundleResult = await uploadAppBundle({
-			client,
-			appId,
-			versionId: verResp.version.id,
-			bundleDir,
-			entryPath: uiBundle.entry,
-			bundleFormat: uiBundle.format,
-			externalOrigins: Array.isArray(uiBundle.external_origins) ? uiBundle.external_origins : [],
-			log: opts.json ? void 0 : (m) => console.log(dim(m))
-		});
-		try {
-			await syncAppListingMeta(client, appId, manifest, { cwd });
-		} catch (err) {
-			if (!opts.json) console.log(yellow(`! listing metadata sync skipped: ${err.message}`));
-		}
-		const finalApp = await getApp(client, appId);
-		if (opts.json) {
-			console.log(JSON.stringify({
-				app_id: appId,
-				slug: serverSlug,
-				host,
-				version: verResp.version.version,
-				version_id: verResp.version.id,
-				content_hash: hash,
-				idempotent_hit: verResp.idempotentHit,
-				first_publish: firstPublish,
-				status: finalApp.status,
-				bundle: bundleResult ? {
-					status: bundleResult.status,
-					bundle_status: bundleResult.detail.status,
-					file_count: bundleResult.detail.file_count,
-					total_size_bytes: bundleResult.detail.total_size_bytes,
-					sha256_manifest: bundleResult.detail.sha256_manifest
-				} : null
-			}, null, 2));
-			return 0;
-		}
-		if (verResp.idempotentHit) console.log(green(`✓ apps/${serverSlug}: version ${manifest.version} already live (content hash unchanged)`));
-		else console.log(green(`✓ apps/${serverSlug}: version ${manifest.version} published (id=${verResp.version.id})`));
-		if (firstPublish) console.log(dim(`  first publish — wrote .anna/app.json`));
-		if (bundleResult) if (bundleResult.status === "skipped") console.log(dim(`  UI bundle unchanged — skipped`));
-		else console.log(green(`  ✓ UI bundle: ${bundleResult.fileCount} files, ${(bundleResult.totalBytes / 1024).toFixed(1)} KB → ${bundleResult.detail.status}`));
-		console.log(bold(cyan(`status: ${finalApp.status}`)));
-		if (!verResp.idempotentHit) console.log(dim(`→ run `) + cyan(`anna-app apps release ${manifest.version}`) + dim(` to freeze & publish this version`));
-		return 0;
-	});
-}
-
-//#endregion
-export { runAppsPublish };