@anna-ai/cli 0.1.49 → 0.1.52

package/dist/{apps-sync-meta-DnFwFNl5.js → apps-sync-meta-BwN8g6TO.js}

@@ -1,10 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { findAppBySlug, getApp } from "./apps-HbfURK6y.js";
+import { findAppBySlug, getApp } from "./apps-BRBufSyX.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
-import { loadAppManifest } from "./manifest-B_DjigtQ.js";
+import { loadAppManifest } from "./manifest-BCHiC184.js";
 import { readAppIdentity } from "./app-cache-Cr3tKbux.js";
-import { syncAppListingMeta } from "./listing-meta-DgweMStT.js";
+import { syncAppListingMeta } from "./listing-meta-rIni8tjd.js";
 import { resolve } from "node:path";
 import { bold, cyan, dim, green } from "kleur/colors";
 

package/dist/{apps-versions-C7NzG5Dk.js → apps-versions-gfG_sBFv.js}

@@ -1,5 +1,5 @@
 import "./credentials-BTv2IfUZ.js";
-import { findAppBySlug, listVersions } from "./apps-HbfURK6y.js";
+import { findAppBySlug, listVersions } from "./apps-BRBufSyX.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";

package/dist/{bridge-sFHqOOat.js → bridge-Bo8eu3-d.js}

@@ -9,7 +9,7 @@ import { createInterface } from "node:readline";
 * `uvx <pkg>@<version>` so end users always run the dispatcher version
 * the CLI was tested against.
 */
-const PINNED_RUNTIME_VERSION = "0.2.0a21";
+const PINNED_RUNTIME_VERSION = "0.2.0a23";
 /**
 * Throwable from a {@link RequestHandler} to send a structured JSON-RPC
 * error back to the python bridge with a stable string ``code`` (e.g.

package/dist/bridge-nv-le8ff.js

@@ -0,0 +1,3 @@
+import { BridgeRequestError, PINNED_RUNTIME_VERSION, PythonBridge } from "./bridge-Bo8eu3-d.js";
+
+export { PINNED_RUNTIME_VERSION, PythonBridge };

package/dist/cli.js

@@ -111,18 +111,132 @@ function validateManifestSchema(bundle, manifest) {
 		message: `${e.message ?? "invalid"}${e.params ? " " + JSON.stringify(e.params) : ""}`
 	}));
 }
-const ANNA_CALL_RE = /\banna\.([a-z]+)\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\(/g;
+/**
+* Blank out string-literal and comment contents (same length, newlines
+* kept, so offsets/line numbers stay exact). Template interpolation bodies
+* (`${…}`) are code and are preserved. Regex literals are NOT recognised
+* (the `/` division ambiguity): a quote delimiter inside one can at worst
+* blank the rest of that line — quoted strings cannot span lines — which
+* errs toward missing a call, never toward a false report.
+*/
+function stripStringsAndComments(source) {
+	const out = source.split("");
+	const n = source.length;
+	const blank = (idx) => {
+		const ch = out[idx];
+		if (ch !== "\n" && ch !== "\r") out[idx] = " ";
+	};
+	const stack = [{
+		kind: "code",
+		braces: 0
+	}];
+	let i = 0;
+	while (i < n) {
+		const top = stack[stack.length - 1];
+		const c = source[i];
+		if (top.kind === "tpl") {
+			if (c === "\\") {
+				blank(i);
+				if (i + 1 < n) blank(i + 1);
+				i += 2;
+				continue;
+			}
+			if (c === "`") {
+				blank(i);
+				stack.pop();
+				i++;
+				continue;
+			}
+			if (c === "$" && source[i + 1] === "{") {
+				i += 2;
+				stack.push({
+					kind: "code",
+					braces: 0
+				});
+				continue;
+			}
+			blank(i);
+			i++;
+			continue;
+		}
+		const next = source[i + 1];
+		if (c === "/" && next === "/") {
+			while (i < n && source[i] !== "\n") {
+				blank(i);
+				i++;
+			}
+			continue;
+		}
+		if (c === "/" && next === "*") {
+			blank(i);
+			blank(i + 1);
+			i += 2;
+			while (i < n && !(source[i] === "*" && source[i + 1] === "/")) {
+				blank(i);
+				i++;
+			}
+			if (i < n) {
+				blank(i);
+				blank(i + 1);
+				i += 2;
+			}
+			continue;
+		}
+		if (c === "'" || c === "\"") {
+			blank(i);
+			i++;
+			while (i < n && source[i] !== c && source[i] !== "\n") {
+				if (source[i] === "\\") {
+					blank(i);
+					i++;
+					if (i < n) blank(i);
+					i++;
+					continue;
+				}
+				blank(i);
+				i++;
+			}
+			if (i < n && source[i] === c) {
+				blank(i);
+				i++;
+			}
+			continue;
+		}
+		if (c === "`") {
+			blank(i);
+			stack.push({ kind: "tpl" });
+			i++;
+			continue;
+		}
+		if (c === "{") {
+			top.braces++;
+			i++;
+			continue;
+		}
+		if (c === "}") {
+			if (top.braces > 0) top.braces--;
+			else if (stack.length > 1) stack.pop();
+			i++;
+			continue;
+		}
+		i++;
+	}
+	return out.join("");
+}
+const ANNA_CALL_RE = /\banna\s*\.\s*([a-z]+)\s*\.\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*\(/g;
 function scanHostApiCalls(files) {
 	const out = [];
 	for (const f of files) {
-		const lines = f.content.split("\n");
-		for (let i = 0; i < lines.length; i++) {
-			const line = lines[i];
-			ANNA_CALL_RE.lastIndex = 0;
-			let m;
-			while ((m = ANNA_CALL_RE.exec(line)) !== null) out.push({
+		const code = stripStringsAndComments(f.content);
+		ANNA_CALL_RE.lastIndex = 0;
+		let m;
+		let line = 1;
+		let cursor = 0;
+		while ((m = ANNA_CALL_RE.exec(code)) !== null) {
+			for (; cursor < m.index; cursor++) if (code.charCodeAt(cursor) === 10) line++;
+			out.push({
 				file: f.path,
-				line: i + 1,
+				line,
 				ns: m[1],
 				method: m[2]
 			});
@@ -237,7 +351,17 @@ function validateUiSectionStatic(manifest) {
 	const cspOverrides = ui.csp_overrides ?? {};
 	const badDirectives = Object.keys(cspOverrides).filter((d) => !CSP_OVERRIDABLE_DIRECTIVES.has(d)).sort();
 	if (badDirectives.length) errors.push(`csp_overrides 含不允许的 directive: ${JSON.stringify(badDirectives)}`);
-	for (const d of ["script-src", "style-src"]) for (const v of cspOverrides[d] ?? []) if (v !== "'self'" && !v.startsWith("'sha256-") && !v.startsWith("'nonce-")) errors.push(`csp_overrides[${d}] 仅允许 'self' / 'sha256-...' / 'nonce-...': ${v}`);
+	for (const d of ["script-src", "style-src"]) {
+		const literals = d === "script-src" ? ["'self'", "'wasm-unsafe-eval'"] : ["'self'"];
+		for (const v of cspOverrides[d] ?? []) if (!literals.includes(v) && !v.startsWith("'sha256-") && !v.startsWith("'nonce-")) {
+			const allowed = [
+				...literals,
+				"'sha256-...'",
+				"'nonce-...'"
+			].join(" / ");
+			errors.push(`csp_overrides[${d}] 仅允许 ${allowed}: ${v}`);
+		}
+	}
 	return errors;
 }
 
@@ -473,8 +597,8 @@ program.command("validate").description("Run schema + ACL checks on a manifest+b
 	const code = printResult(result);
 	process.exit(code);
 });
-program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").option("--executa <spec>", "Explicit executa registration; repeatable. Spec: comma-separated key=value (dir=<path>[,tool_id=<id>][,type=python|node|go|binary][,command=\"<argv>\"]). When only `dir=` is given, the executa is auto-detected from executa.json / pyproject.toml / package.json / go.mod. Overrides directory auto-discovery under <manifest-dir>/executas/.", (val, prev) => prev ? [...prev, val] : [val]).option("--no-llm", "Disable LLM bridge (anna.llm/agent return llm_disabled)").option("--mock-llm <fixture>", "Serve canned LLM responses from a JSONL fixture").option("--llm-account <host>", "Saved account host to use (default: current)").option("--llm-app-slug <slug>", "Override the manifest slug used to register / look up the dev AnnaApp (default: manifest.slug)").option("--storage <mode>", "Storage backend: \"legacy\" (in-memory runtime_state, default) or \"aps\" (real nexus APS via /api/v1/storage/* — requires `anna-app login`).", "legacy").option("--web <mode>", "Web backend: \"local\" (keyless ddgs + stdlib fetcher, free, default) or \"real\" (platform web service via /api/v1/copilot/app/web/* — production provider chain + normal CU billing; requires `anna-app login`).", "local").action(async (opts) => {
-	const { runDev, parseExecutaSpec } = await import("./dev-CnDh2_7r.js");
+program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").option("--executa <spec>", "Explicit executa registration; repeatable. Spec: comma-separated key=value (dir=<path>[,tool_id=<id>][,type=python|node|go|binary][,command=\"<argv>\"]). When only `dir=` is given, the executa is auto-detected from executa.json / pyproject.toml / package.json / go.mod. Overrides directory auto-discovery under <manifest-dir>/executas/.", (val, prev) => prev ? [...prev, val] : [val]).option("--no-llm", "Disable LLM bridge (anna.llm/agent return llm_disabled)").option("--mock-llm <fixture>", "Serve canned LLM responses from a JSONL fixture").option("--llm-account <host>", "Saved account host to use (default: current)").option("--llm-app-slug <slug>", "Override the manifest slug used to register / look up the dev AnnaApp (default: manifest.slug)").option("--storage <mode>", "Storage backend: \"legacy\" (in-memory runtime_state, default) or \"aps\" (real nexus APS via /api/v1/storage/* — requires `anna-app login`).", "legacy").option("--no-strict-caps", "Downgrade the production-parity storage capability gate to a warning (by default, storage/* fails with -32021 when host_capabilities declares no aps.* entry — exactly like production).").option("--web <mode>", "Web backend: \"local\" (keyless ddgs + stdlib fetcher, free, default) or \"real\" (platform web service via /api/v1/copilot/app/web/* — production provider chain + normal CU billing; requires `anna-app login`).", "local").action(async (opts) => {
+	const { runDev, parseExecutaSpec } = await import("./dev-CQIZHt7u.js");
 	const cwd = opts.cwd ?? process.cwd();
 	let executas;
 	if (opts.executa && opts.executa.length > 0) {
@@ -504,13 +628,14 @@ program.command("dev").description("Run a local harness (in-process dispatcher +
 		llmAccount: opts.llmAccount,
 		llmAppSlug: opts.llmAppSlug,
 		storageMode: opts.storage,
+		strictCaps: opts.strictCaps !== false,
 		webMode: opts.web
 	});
 	process.exit(code);
 });
 const fixture = program.command("fixture").description("Inspect / replay harness recordings (Phase 6)");
 fixture.command("verify <file>").description("Schema + invariant checks on a harness JSONL recording").option("--json", "Emit machine-readable JSON", false).action(async (file, opts) => {
-	const { runFixtureVerify } = await import("./fixture-BF1Z0Rry.js");
+	const { runFixtureVerify } = await import("./fixture-CizypXzX.js");
 	const code = await runFixtureVerify({
 		file,
 		json: opts.json
@@ -518,7 +643,7 @@ fixture.command("verify <file>").description("Schema + invariant checks on a har
 	process.exit(code);
 });
 fixture.command("summarize <file>").description("Print a human-readable digest of a harness recording").option("--json", "Emit machine-readable JSON", false).action(async (file, opts) => {
-	const { runFixtureSummarize } = await import("./fixture-BF1Z0Rry.js");
+	const { runFixtureSummarize } = await import("./fixture-CizypXzX.js");
 	const code = await runFixtureSummarize({
 		file,
 		json: opts.json
@@ -526,7 +651,7 @@ fixture.command("summarize <file>").description("Print a human-readable digest o
 	process.exit(code);
 });
 fixture.command("replay <file>").description("Dry-run replay of a harness recording (Phase 6 MVP)").option("--manifest <path>", "manifest.json path", "manifest.json").action(async (file, opts) => {
-	const { runFixtureReplay } = await import("./fixture-BF1Z0Rry.js");
+	const { runFixtureReplay } = await import("./fixture-CizypXzX.js");
 	const code = await runFixtureReplay({
 		file,
 		manifest: opts.manifest
@@ -534,12 +659,12 @@ fixture.command("replay <file>").description("Dry-run replay of a harness record
 	process.exit(code);
 });
 program.command("doctor").description("Check environment for `anna-app dev` (uv, matrix-nexus, dev key)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (optional)").action(async (opts) => {
-	const { runDoctor } = await import("./doctor-CHnkbamq.js");
+	const { runDoctor } = await import("./doctor-qFe9sXxR.js");
 	const code = await runDoctor({ matrixNexusRoot: opts.matrixNexusRoot });
 	process.exit(code);
 });
 program.command("login").description("Device-flow login against a nexus host; saves a PAT to ~/.config/anna/credentials.json").requiredOption("--host <url>", "nexus base URL, e.g. https://nexus.example.com").option("--no-browser", "Do not open a browser window automatically", false).action(async (opts) => {
-	const { runLogin } = await import("./login-DbETuUxy.js");
+	const { runLogin } = await import("./login-BleVDjXE.js");
 	const code = await runLogin({
 		host: opts.host,
 		noBrowser: opts.browser === false
@@ -547,7 +672,7 @@ program.command("login").description("Device-flow login against a nexus host; sa
 	process.exit(code);
 });
 program.command("logout").description("Remove a saved PAT entry").option("--host <url>", "Account to remove (default: current)").option("--all", "Remove every saved account", false).action(async (opts) => {
-	const { runLogout } = await import("./logout-BzIEf-HU.js");
+	const { runLogout } = await import("./logout-BO4brBaY.js");
 	const code = await runLogout({
 		host: opts.host,
 		all: opts.all
@@ -555,13 +680,13 @@ program.command("logout").description("Remove a saved PAT entry").option("--host
 	process.exit(code);
 });
 program.command("whoami").description("Show the current account (and any others)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runWhoami } = await import("./whoami-Bn38ns8r.js");
+	const { runWhoami } = await import("./whoami-rvVc_nQ9.js");
 	const code = await runWhoami({ json: opts.json });
 	process.exit(code);
 });
 const account = program.command("account").description("Manage your developer account (handle / namespace)");
 account.command("set-handle <handle>").description("Set or rename your developer handle — the @handle namespace your apps publish under (@handle/slug). Required before creating your first app.").option("--host <url>", "Account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (handle, opts) => {
-	const { runAccountSetHandle } = await import("./account-CPnwqXeh.js");
+	const { runAccountSetHandle } = await import("./account-C-IeQNNr.js");
 	const code = await runAccountSetHandle({
 		handle,
 		account: opts.host,
@@ -581,7 +706,7 @@ executa.command("init <dir>").description("Scaffold a standalone Executa plugin
 		console.error(`✗ unknown template "${opts.template}" — expected python | node | go`);
 		process.exit(2);
 	}
-	const { runExecutaInit } = await import("./executa-init-DKy7DMSD.js");
+	const { runExecutaInit } = await import("./executa-init-BM0HR-K7.js");
 	const code = runExecutaInit({
 		targetDir: dir,
 		slug,
@@ -592,12 +717,12 @@ executa.command("init <dir>").description("Scaffold a standalone Executa plugin
 	process.exit(code);
 });
 executa.command("register").description("Register a HARNESS AnnaApp(kind=executa) so `executa dev --storage real` (and agent / sampling / image / upload real-mode flows) can mint tokens for a local executa subprocess. Does NOT publish the executa itself — use `executa publish` for that. Lists/deletes via `apps list` / `apps delete`.").requiredOption("--tool-id <id>", "Executa tool_id (matches executa.json tool_id / executable_name)").option("--slug <slug>", "App slug (default: executa-<tool_id>; must be lowercase + hyphens)").option("--name <name>", "Human-readable display name (default: <tool_id>)").option("--account <host>", "Saved account host (default: current)").action(async (opts) => {
-	const { runExecutaRegister } = await import("./executa-register-CmqKsoAU.js");
+	const { runExecutaRegister } = await import("./executa-register-CDKG3L5c.js");
 	const code = await runExecutaRegister(opts);
 	process.exit(code);
 });
 executa.command("install").description("Install a local-dev shim for an Executa under its minted tool_id so the Agent can discover it via 'Rediscover Local' (for distribution_type: local). Resolves the tool_id from .anna/executa.json (written by `executa publish` / `apps push`) unless --tool-id is given.").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Install the shim under this exact id (default: minted id from .anna/executa.json, else executa.json tool_id)").option("--bin-dir <path>", "Install dir for the shim (default: ~/.anna/executa/bin)").option("--force", "Overwrite an existing shim of the same name", false).option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaInstall } = await import("./executa-install-LaAOSkY0.js");
+	const { runExecutaInstall } = await import("./executa-install-Dnerah9u.js");
 	const code = await runExecutaInstall({
 		dir: opts.dir,
 		toolId: opts.toolId,
@@ -608,7 +733,7 @@ executa.command("install").description("Install a local-dev shim for an Executa
 	process.exit(code);
 });
 executa.command("dev").description("Run one Executa plugin in isolation (REPL or one-shot describe/invoke)").option("--dir <path>", "Executa project dir (default: CWD)").option("--spec <spec>", "Override discovery: comma-separated key=value (tool_id=...,type=...,command=\"...\")").option("--describe", "Print MANIFEST and exit", false).option("--health", "Print health and exit", false).option("--invoke <tool>", "Invoke one tool and exit").option("--args <json>", "JSON object passed as tool arguments", "{}").option("--json", "One-shot: emit compact JSON (no banners)", false).option("--no-sampling", "Hard-disable sampling reverse RPC (returns sampling_disabled)").option("--mock-sampling <fixture>", "Serve canned sampling responses from a JSONL fixture (offline)").option("--sampling-unsupported-format", "Simulate a model without json_schema support — exercises responseFormat onUnsupported branches (-32010 / downgrade)").option("--app-slug <slug>", "Forward sampling to nexus on behalf of this dev AnnaApp slug").option("--sampling-account <host>", "Saved account host for nexus sampling (default: current)").option("--no-agent", "Hard-disable agent reverse RPC (returns agent_not_granted)").option("--mock-agent <fixture>", "Serve canned agent/* responses from a JSONL fixture (offline)").option("--agent-account <host>", "Saved account host for nexus agent (default: --sampling-account or current)").option("--storage <mode>", "Storage backend: off | memory | mock | real (default: memory)").option("--mock-storage <fixture>", "Serve canned storage/* + files/* responses from a JSONL fixture").option("--storage-account <host>", "Saved account host for nexus storage (default: --sampling-account or current)").option("--storage-scopes <list>", "Comma-separated scopes for real storage tokens (default: user,app,tool)").option("--no-image", "Hard-disable image reverse RPC (returns image_not_granted)").option("--mock-image <fixture>", "Serve canned image/generate + image/edit responses from a JSONL fixture").option("--image-account <host>", "Saved account host for nexus image (default: --sampling-account or current)").option("--no-upload", "Hard-disable host/uploadFile reverse RPC (returns upload_not_granted)").option("--mock-upload <fixture>", "Serve canned host/uploadFile responses from a JSONL fixture").option("--upload-account <host>", "Saved account host for nexus uploads (default: --sampling-account or current)").action(async (opts) => {
-	const { runExecutaDev } = await import("./executa-dev-DYO87dzg.js");
+	const { runExecutaDev } = await import("./executa-dev-BeYhrj-n.js");
 	const storageMode = opts.storage === void 0 ? void 0 : (() => {
 		const m = opts.storage;
 		if (m === "off" || m === "memory" || m === "mock" || m === "real") return m;
@@ -646,14 +771,14 @@ executa.command("dev").description("Run one Executa plugin in isolation (REPL or
 });
 const apps = program.command("apps").description("Anna App publish lifecycle commands");
 apps.command("list").description("List the Anna Apps you authored, with lifecycle status").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsList } = await import("./apps-CzqMRLbS.js");
+	const { runAppsList } = await import("./apps-CTIiH6a_.js");
 	process.exit(await runAppsList({
 		account: opts.account,
 		json: opts.json
 	}));
 });
 apps.command("rename-slug <new-slug>").description("Rename an app's public slug (DRAFT/REJECTED, never-published, zero installs only). Updates local app.json + .anna/app.json on success.").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (newSlug, opts) => {
-	const { runAppsRenameSlug } = await import("./apps-rename-slug-CCEU_7JJ.js");
+	const { runAppsRenameSlug } = await import("./apps-rename-slug-4_5lsDwg.js");
 	process.exit(await runAppsRenameSlug({
 		newSlug,
 		cwd: opts.cwd,
@@ -662,7 +787,7 @@ apps.command("rename-slug <new-slug>").description("Rename an app's public slug
 		json: opts.json
 	}));
 });
-apps.command("publish").description("Publish or update an Anna App (manifest.json in cwd)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--dry-run", "Resolve identity + diff but don't upload", false).option("--executa-id <handle=id>", "Override a bundled executa handle with a real tool_id (repeatable)", (val, prev) => [...prev, val], []).option("--skip-executa-publish", "Use cached/overridden tool_ids; don't recursively publish bundled executas", false).option("--no-bundled-executas", "Disable bundled-executa orchestration (legacy behaviour)").option("--no-bundle", "Skip UI bundle upload even if the manifest declares a UI").option("--bundle-dir <dir>", "UI bundle directory (default: <cwd>/bundle)").option("--profile <name>", "Select a bundled executa `distribution.profiles` entry for this run (overrides each executa.json `active`, e.g. --profile local)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+apps.command("publish").description("Publish an Anna App version (composite: push + cut, freeze at cut)").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bump <kind>", "Bump version: patch|minor|major").option("--no-write", "Skip writing the bumped version back to disk", false).option("--dry-run", "Resolve identity + diff but don't upload", false).option("--executa-id <handle=id>", "Override a bundled executa handle with a real tool_id (repeatable)", (val, prev) => [...prev, val], []).option("--skip-executa-publish", "Use cached/overridden tool_ids; don't recursively publish bundled executas", false).option("--no-bundled-executas", "Disable bundled-executa orchestration (legacy behaviour)").option("--no-bundle", "Skip UI bundle upload even if the manifest declares a UI").option("--bundle-dir <dir>", "UI bundle directory (default: <cwd>/bundle)").option("--profile <name>", "Select a bundled executa `distribution.profiles` entry for this run (overrides each executa.json `active`, e.g. --profile local)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
 	if (opts.bump && ![
 		"patch",
 		"minor",
@@ -671,7 +796,7 @@ apps.command("publish").description("Publish or update an Anna App (manifest.jso
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runAppsPublish } = await import("./apps-publish-4IIbF2xr.js");
+	const { runAppsPublish } = await import("./apps-publish-AdXryRYo.js");
 	process.exit(await runAppsPublish({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -705,7 +830,7 @@ apps.command("push").description("Upsert the mutable working draft (manifest + b
 			process.exit(2);
 		}
 	}
-	const { runAppsPush } = await import("./apps-push-CnSeLwdo.js");
+	const { runAppsPush } = await import("./apps-push-WBfD0JyE.js");
 	process.exit(await runAppsPush({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -725,7 +850,7 @@ apps.command("push").description("Upsert the mutable working draft (manifest + b
 	}));
 });
 apps.command("cut <version>").description("Snapshot the working draft into an immutable version (freeze deps)").option("--changelog <text>", "Override the working draft changelog for this version").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't cut", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
-	const { runAppsCut } = await import("./apps-cut-BhTJwILv.js");
+	const { runAppsCut } = await import("./apps-cut-eOVb1-0y.js");
 	process.exit(await runAppsCut({
 		version,
 		changelog: opts.changelog,
@@ -737,7 +862,7 @@ apps.command("cut <version>").description("Snapshot the working draft into an im
 	}));
 });
 apps.command("discard").description("Drop the mutable working draft (leaves cut versions intact)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--dry-run", "Resolve target but don't discard", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsDiscard } = await import("./apps-discard-CFi-GzpU.js");
+	const { runAppsDiscard } = await import("./apps-discard-7ERq2pmS.js");
 	process.exit(await runAppsDiscard({
 		slug: opts.slug,
 		cwd: opts.cwd,
@@ -747,7 +872,7 @@ apps.command("discard").description("Drop the mutable working draft (leaves cut
 	}));
 });
 apps.command("release <version>").description("Freeze & publish an existing remote version (go live)").option("--slug <slug>", "App slug (default: resolve from .anna/app.json cache)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--allow-create", "If the version isn't on the server, run 'apps publish' first, then release", false).option("--dry-run", "Resolve target + pre-flight but don't publish", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (version, opts) => {
-	const { runAppsRelease } = await import("./apps-release-DGQv6DDl.js");
+	const { runAppsRelease } = await import("./apps-release-DAV-DB_Q.js");
 	process.exit(await runAppsRelease({
 		version,
 		slug: opts.slug,
@@ -759,7 +884,7 @@ apps.command("release <version>").description("Freeze & publish an existing remo
 	}));
 });
 apps.command("sync-meta").description("Push mutable store metadata (name/tagline/…) from the manifest").option("--cwd <dir>", "Project root (default: cwd)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--logo <path>", "Local logo file to upload (overrides app.json logo_file)").option("--dry-run", "Print the metadata diff but don't PATCH", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsSyncMeta } = await import("./apps-sync-meta-DnFwFNl5.js");
+	const { runAppsSyncMeta } = await import("./apps-sync-meta-BwN8g6TO.js");
 	process.exit(await runAppsSyncMeta({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -770,7 +895,7 @@ apps.command("sync-meta").description("Push mutable store metadata (name/tagline
 	}));
 });
 apps.command("submit-review [slug]").description("Move an app into review (DRAFT/REJECTED → PENDING_REVIEW)").option("--cwd <dir>", "Project root for identity cache (default: cwd)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsSubmitReview } = await import("./apps-submit-review--hZFZRJ3.js");
+	const { runAppsSubmitReview } = await import("./apps-submit-review-CxoKgexX.js");
 	process.exit(await runAppsSubmitReview({
 		slug,
 		cwd: opts.cwd,
@@ -779,7 +904,7 @@ apps.command("submit-review [slug]").description("Move an app into review (DRAFT
 	}));
 });
 apps.command("status <slug>").description("Show server-known state for one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsStatus } = await import("./apps-status-C4Cxc2DF.js");
+	const { runAppsStatus } = await import("./apps-status-hMrRz356.js");
 	process.exit(await runAppsStatus({
 		slug,
 		account: opts.account,
@@ -787,7 +912,7 @@ apps.command("status <slug>").description("Show server-known state for one Anna
 	}));
 });
 apps.command("versions <slug>").description("List all server versions of one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsVersions } = await import("./apps-versions-C7NzG5Dk.js");
+	const { runAppsVersions } = await import("./apps-versions-gfG_sBFv.js");
 	process.exit(await runAppsVersions({
 		slug,
 		account: opts.account,
@@ -795,7 +920,7 @@ apps.command("versions <slug>").description("List all server versions of one Ann
 	}));
 });
 apps.command("grants <slug>").description("Show currently granted scopes/quota for one Anna App").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsGrants } = await import("./apps-grants-DqaX8UTy.js");
+	const { runAppsGrants } = await import("./apps-grants-DVoSb6-r.js");
 	process.exit(await runAppsGrants({
 		slug,
 		account: opts.account,
@@ -803,7 +928,7 @@ apps.command("grants <slug>").description("Show currently granted scopes/quota f
 	}));
 });
 apps.command("unpublish <slug>").description("Flip a PUBLISHED app back to APPROVED (private)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsUnpublish } = await import("./apps-destructive-PlaU93EX.js");
+	const { runAppsUnpublish } = await import("./apps-destructive-DcG3T1Mx.js");
 	process.exit(await runAppsUnpublish({
 		slug,
 		yes: opts.yes,
@@ -813,7 +938,7 @@ apps.command("unpublish <slug>").description("Flip a PUBLISHED app back to APPRO
 	}));
 });
 apps.command("archive <slug>").description("Archive an Anna App (hides it from end users)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsArchive } = await import("./apps-destructive-PlaU93EX.js");
+	const { runAppsArchive } = await import("./apps-destructive-DcG3T1Mx.js");
 	process.exit(await runAppsArchive({
 		slug,
 		yes: opts.yes,
@@ -823,7 +948,7 @@ apps.command("archive <slug>").description("Archive an Anna App (hides it from e
 	}));
 });
 apps.command("unarchive <slug>").description("Restore an archived Anna App back to APPROVED").option("--yes", "Acknowledge the operation", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsUnarchive } = await import("./apps-destructive-PlaU93EX.js");
+	const { runAppsUnarchive } = await import("./apps-destructive-DcG3T1Mx.js");
 	process.exit(await runAppsUnarchive({
 		slug,
 		yes: opts.yes,
@@ -832,7 +957,7 @@ apps.command("unarchive <slug>").description("Restore an archived Anna App back
 	}));
 });
 apps.command("delete <slug>").description("Hard-delete an Anna App (refused by server if installs exist)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runAppsDelete } = await import("./apps-destructive-PlaU93EX.js");
+	const { runAppsDelete } = await import("./apps-destructive-DcG3T1Mx.js");
 	process.exit(await runAppsDelete({
 		slug,
 		yes: opts.yes,
@@ -842,14 +967,14 @@ apps.command("delete <slug>").description("Hard-delete an Anna App (refused by s
 	}));
 });
 executa.command("list").description("List Executas owned by the current PAT").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaList } = await import("./executa-reads-BYKUADoL.js");
+	const { runExecutaList } = await import("./executa-reads-BJpmB-B1.js");
 	process.exit(await runExecutaList({
 		account: opts.account,
 		json: opts.json
 	}));
 });
 executa.command("status <ref>").description("Show server-known state for one Executa (slug or tool_id)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
-	const { runExecutaStatus } = await import("./executa-reads-BYKUADoL.js");
+	const { runExecutaStatus } = await import("./executa-reads-BJpmB-B1.js");
 	process.exit(await runExecutaStatus({
 		ref,
 		account: opts.account,
@@ -857,7 +982,7 @@ executa.command("status <ref>").description("Show server-known state for one Exe
 	}));
 });
 executa.command("versions <ref>").description("List immutable version snapshots for one Executa").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
-	const { runExecutaVersions } = await import("./executa-reads-BYKUADoL.js");
+	const { runExecutaVersions } = await import("./executa-reads-BJpmB-B1.js");
 	process.exit(await runExecutaVersions({
 		ref,
 		account: opts.account,
@@ -873,7 +998,7 @@ executa.command("publish").description("Mint or update an Executa (executa.json
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runExecutaPublish } = await import("./executa-publish-6awuH4Ma.js");
+	const { runExecutaPublish } = await import("./executa-publish-CVlMaHIY.js");
 	process.exit(await runExecutaPublish({
 		cwd: opts.cwd,
 		manifest: opts.manifest,
@@ -887,7 +1012,7 @@ executa.command("publish").description("Mint or update an Executa (executa.json
 	}));
 });
 executa.command("upload-binaries").description("Push the local binary_artifacts declared in executa.json straight to the platform CDN (no public source URL needed — works for private repos). Requires a minted identity (.anna/executa.json from `executa publish` / `apps push`) or --tool-id.").option("--dir <path>", "Executa project dir (default: CWD)").option("--dry-run", "Hash artifacts + validate the plan server-side without uploading", false).option("--oidc", "Mint the upload token from the GitHub Actions OIDC id-token instead of a PAT (zero long-term secrets; needs `permissions: id-token: write` and a registered trusted publisher)", false).option("--tool-id <id>", "Explicit tool_id (skip the identity cache)").option("--host <url>", "Nexus host (required with --oidc unless ANNA_APP_HOST is set)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runExecutaUploadBinaries } = await import("./executa-upload-binaries-FWM2yXfB.js");
+	const { runExecutaUploadBinaries } = await import("./executa-upload-binaries-BVWs6MFF.js");
 	process.exit(await runExecutaUploadBinaries({
 		dir: opts.dir,
 		dryRun: opts.dryRun,
@@ -900,11 +1025,11 @@ executa.command("upload-binaries").description("Push the local binary_artifacts
 });
 const trustedPublisher = executa.command("trusted-publisher").description("Manage the GitHub Actions identities allowed to publish binaries for an executa via OIDC (zero-secret CI; pairs with `executa upload-binaries --oidc`)");
 trustedPublisher.command("add").description("Register a {repository, workflow, environment?} triple").requiredOption("--repository <owner/repo>", "GitHub repository").requiredOption("--workflow <file>", "Workflow file, e.g. \"publish.yml\"").option("--environment <name>", "GitHub Environment gate (default: any)").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Explicit tool_id (skip the identity cache)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runTrustedPublisherAdd } = await import("./executa-trusted-publisher-BGqz6hMt.js");
+	const { runTrustedPublisherAdd } = await import("./executa-trusted-publisher-n9IbAO5D.js");
 	process.exit(await runTrustedPublisherAdd(opts));
 });
 trustedPublisher.command("list").description("List registered trusted publishers").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Explicit tool_id (skip the identity cache)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runTrustedPublisherList } = await import("./executa-trusted-publisher-BGqz6hMt.js");
+	const { runTrustedPublisherList } = await import("./executa-trusted-publisher-n9IbAO5D.js");
 	process.exit(await runTrustedPublisherList(opts));
 });
 trustedPublisher.command("remove <publisher-id>").description("Remove a trusted publisher registration by id").option("--dir <path>", "Executa project dir (default: CWD)").option("--tool-id <id>", "Explicit tool_id (skip the identity cache)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (publisherId, opts) => {
@@ -913,14 +1038,14 @@ trustedPublisher.command("remove <publisher-id>").description("Remove a trusted
 		console.error(`✗ publisher-id must be a positive integer (got "${publisherId}")`);
 		process.exit(2);
 	}
-	const { runTrustedPublisherRemove } = await import("./executa-trusted-publisher-BGqz6hMt.js");
+	const { runTrustedPublisherRemove } = await import("./executa-trusted-publisher-n9IbAO5D.js");
 	process.exit(await runTrustedPublisherRemove({
 		...opts,
 		publisherId: id
 	}));
 });
 executa.command("unpublish <slug>").description("Flip an Executa's visibility back to private").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runExecutaUnpublish } = await import("./executa-destructive-Du7RGJgn.js");
+	const { runExecutaUnpublish } = await import("./executa-destructive-C06mgvfJ.js");
 	process.exit(await runExecutaUnpublish({
 		slug,
 		yes: opts.yes,
@@ -930,7 +1055,7 @@ executa.command("unpublish <slug>").description("Flip an Executa's visibility ba
 	}));
 });
 executa.command("yank <ref>").description("Hard-delete one Executa version (<slug>@<version>)").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (ref, opts) => {
-	const { runExecutaYank } = await import("./executa-destructive-Du7RGJgn.js");
+	const { runExecutaYank } = await import("./executa-destructive-C06mgvfJ.js");
 	process.exit(await runExecutaYank({
 		ref,
 		yes: opts.yes,
@@ -940,7 +1065,7 @@ executa.command("yank <ref>").description("Hard-delete one Executa version (<slu
 	}));
 });
 executa.command("delete <slug>").description("Hard-delete an Executa").option("--yes", "Acknowledge the destructive operation", false).option("--confirm <slug>", "Slug confirmation (must match target)").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (slug, opts) => {
-	const { runExecutaDelete } = await import("./executa-destructive-Du7RGJgn.js");
+	const { runExecutaDelete } = await import("./executa-destructive-C06mgvfJ.js");
 	process.exit(await runExecutaDelete({
 		slug,
 		yes: opts.yes,
@@ -965,7 +1090,7 @@ executa.command("cache-clear").description("Delete the local `.anna/executa.json
 });
 const token = program.command("token").description("Manage developer PATs (list / revoke / scopes)");
 token.command("list").description("List the caller's PATs (most-recent first)").option("--include-revoked", "Also show revoked PATs", false).option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runTokenList } = await import("./token-TgBQumgy.js");
+	const { runTokenList } = await import("./token-DeAZLyVz.js");
 	process.exit(await runTokenList({
 		includeRevoked: opts.includeRevoked,
 		account: opts.account,
@@ -978,7 +1103,7 @@ token.command("revoke <id>").description("Revoke one of the caller's PATs by id"
 		console.error(`✗ token id must be a positive integer (got: ${id})`);
 		process.exit(2);
 	}
-	const { runTokenRevoke } = await import("./token-TgBQumgy.js");
+	const { runTokenRevoke } = await import("./token-DeAZLyVz.js");
 	process.exit(await runTokenRevoke({
 		id: idNum,
 		account: opts.account,
@@ -986,7 +1111,7 @@ token.command("revoke <id>").description("Revoke one of the caller's PATs by id"
 	}));
 });
 token.command("scopes").description("Print the available PAT scope catalogue").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runTokenScopes } = await import("./token-TgBQumgy.js");
+	const { runTokenScopes } = await import("./token-DeAZLyVz.js");
 	process.exit(await runTokenScopes({
 		account: opts.account,
 		json: opts.json
@@ -1001,7 +1126,7 @@ program.command("publish").description("Auto-detect cwd and publish (apps publis
 		console.error(`✗ --bump must be patch|minor|major (got: ${opts.bump})`);
 		process.exit(2);
 	}
-	const { runTopLevelPublish } = await import("./publish-D5O5JKRb.js");
+	const { runTopLevelPublish } = await import("./publish-4C5_TgyZ.js");
 	process.exit(await runTopLevelPublish({
 		cwd: opts.cwd,
 		bump: opts.bump,

package/dist/dev-CQIZHt7u.js

@@ -0,0 +1,4 @@
+import "./nexus-root-BlPwOusj.js";
+import { parseExecutaSpec, runDev } from "./dev-uagVfV9Y.js";
+
+export { parseExecutaSpec, runDev };