@agentproto/app-kit 1.3.1 → 1.4.0

package/README.md

@@ -91,6 +91,37 @@ An app may also declare `requires: ["@acme/shared", ...]` — app ids that must
 applied to the same scope before this one can run. The runtime validates the
 graph when mounting apps via `app_apply`.
 
+### Placement, requirements, and A2A exposure
+
+Four optional `APP.md` keys describe where an app can run and what it exposes.
+They are **semantics only** — nothing schedules or serves on them yet. All are
+validated by `defineApp` (`AppDefinitionError`) and `loadAppHandle`
+(`AppLoadError`), surfaced on `AppHandle`, and written by `emit` only when they
+differ from the default.
+
+```yaml
+placement: any            # "local" | "box" | "any" | "split"   (default "any")
+requires:
+  browser: false          # needs the user's real browser (Bureau / local-browser)
+  fs: false               # needs the user's local filesystem beyond app data
+  gpu: false
+  secrets: []             # env/secret names the app needs
+  apps: []                # other app ids this app depends on
+exposes:                  # A2A-visible surfaces (default: none exposed)
+  agents: []              # ids from `agents:`
+  workflows: []           # ids from `workflows:`
+accepts:
+  tasks: false            # accept A2A tasks (default false)
+```
+
+- An unknown `placement`, or an `exposes.*` id that isn't one of the app's own
+  agents/workflows, is a validation error.
+- `requires` also still accepts the legacy flat array (`requires: ["@acme/shared"]`,
+  equivalent to `requires: { apps: [...] }`).
+- On the handle: `placement`, `exposes`, `accepts` and `requirements` (every key
+  resolved to its default) are always present. `handle.requires` stays the flat
+  list of app ids (absent when none) so existing dependency checks keep working.
+
 ## UI surfaces, artifacts, dev-launch, and the artifact surface
 
 Beyond agents and workflows, an app can declare four optional surfaces that
@@ -367,6 +398,61 @@ per bundle path, output captured to `.agentproto/ui-build.log`) → serve.
 Omit `build` to keep committing the bundle, unchanged from before this
 existed.
 
+## Boundaries — fs zones for app-spawned sessions
+
+Set `boundaries: { enforce: "required" | "best-effort" }` on `defineApp` (or
+`boundaries:` in `APP.md`'s frontmatter) to declare how strictly the daemon
+must confine sessions the app spawns — `app_run`, and workflow agent steps
+whose workflow carries this app's `appId`:
+
+```ts
+defineApp({
+  id: "@acme/transcriber",
+  boundaries: { enforce: "required" },
+  // ...
+})
+```
+
+For every such session the daemon builds one **boundary** with three zones:
+
+| Zone | Contents | Access |
+| --- | --- | --- |
+| read-only | the installed app dir (source, `.agentproto/`, `scripts/`) | read |
+| writable | the app's `data/` dir, and the workflow run's `$run.workspace` (`app_run` has no run workspace: writable is `data/` only) | read + write |
+| everything else | including the daemon's own workspace and any host monorepo the app happens to be installed inside | denied |
+
+The boundary is enforced on two independent surfaces:
+
+1. **Daemon file/command tools** (`file_read`, `file_write`, `directory_*`,
+   `command_execute`, …) — always enforced, identity-based: the daemon
+   recovers the caller's boundary from its own session record, resolves
+   relative paths against the app dir, and rejects reads/writes outside the
+   zones (including through symlinks). This does not depend on the harness.
+2. **The harness's own native tools** (a claude-code session's Bash, Write,
+   Edit, …) — enforced by wrapping the harness in an OS sandbox
+   (`@agentproto/command-sandbox`: macOS Seatbelt or Linux bubblewrap) built
+   from the same zones, plus, on adapters that support it, excluding the host
+   repository's `CLAUDE.md`/`AGENTS.md` from context so an app session never
+   inherits instructions from the monorepo it's installed inside.
+
+Surface 2 needs an adapter that supports fs zones and an available OS sandbox
+backend. When it can't be enforced:
+
+- `boundaries.enforce: "best-effort"` (the default) still spawns the session
+  — daemon tools remain confined — and emits a `session:harness-warning`
+  naming the reason (no sandbox backend on this platform, the adapter doesn't
+  support `fsZones`, or `commandSandbox: "off"` was requested explicitly).
+- `boundaries.enforce: "required"` refuses the spawn instead of downgrading
+  silently (`app_boundary_unenforceable`).
+
+**Deferred:** the `AGENT.md` `tools:` allowlist becoming an *enforced*
+allowlist on adapters that support it (today it's advisory — an agent can
+still reach native Bash next to an allowlisted `command_execute`). Also out
+of scope for this phase: a network-capable sandboxed process reaching the
+daemon's HTTP API directly (bypasses the identity-based check the MCP path
+uses), and boundary enforcement on daemon-wide MCP tools other than
+file/command/terminal.
+
 ## Runtime note
 
 `toMastraAgents` is the path where a `body` becomes a **true** model

package/dist/define-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-app.d.ts","sourceRoot":"","sources":["../src/define-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,KAAK,EAEV,aAAa,EACb,SAAS,EACT,aAAa,EAGd,MAAM,YAAY,CAAA;AAInB,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,CA8IvD;AAiID,YAAY,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"define-app.d.ts","sourceRoot":"","sources":["../src/define-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,KAAK,EAEV,aAAa,EACb,SAAS,EACT,aAAa,EAGd,MAAM,YAAY,CAAA;AAKnB,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,CAyKvD;AAiID,YAAY,EAAE,aAAa,EAAE,CAAA"}

package/dist/emit.d.ts

@@ -32,7 +32,7 @@
  */
 import type { WorkflowHandle } from "@agentproto/workflow";
 import type { WorkspaceHandle } from "@agentproto/workspace";
-import type { AgentEntry, AppArtifactDecl, AppArtifactSurface, AppDataDefinition, AppDevDefinition, AppSkillSurface, AppUiDefinition, EmittedApp } from "./types.js";
+import type { AgentEntry, AppAccepts, AppArtifactDecl, AppArtifactSurface, AppBoundariesDefinition, AppDataDefinition, AppDevDefinition, AppExposes, AppPlacement, AppRequirements, AppSkillSurface, AppUiDefinition, EmittedApp } from "./types.js";
 interface EmitInput {
     readonly agents: readonly AgentEntry[];
     readonly workflows: readonly WorkflowHandle[];
@@ -42,6 +42,10 @@ interface EmitInput {
     readonly version?: string;
     readonly description?: string;
     readonly requires?: readonly string[];
+    readonly requirements?: AppRequirements;
+    readonly placement?: AppPlacement;
+    readonly exposes?: AppExposes;
+    readonly accepts?: AppAccepts;
     readonly ui?: AppUiDefinition;
     readonly artifact?: AppArtifactSurface;
     readonly skill?: AppSkillSurface;
@@ -49,6 +53,7 @@ interface EmitInput {
     readonly dev?: AppDevDefinition;
     readonly data?: AppDataDefinition;
     readonly externalReadRoots?: readonly string[];
+    readonly boundaries?: AppBoundariesDefinition;
     readonly category?: string;
 }
 export declare function emitApp(app: EmitInput, dir: string): Promise<EmittedApp>;

package/dist/emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../src/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAGpK,UAAU,SAAS;IACjB,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAA;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAA;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAiH9E"}
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../src/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAGpP,UAAU,SAAS;IACjB,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAA;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe,CAAA;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAA;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAA;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAuH9E"}

package/dist/index.d.ts

@@ -41,6 +41,8 @@ export { emitApp } from "./emit.js";
 export { loadAppHandle, AppLoadError, resolveAppUIRoot, peekAppUi } from "./load-app.js";
 export type { AppUiPeek } from "./load-app.js";
 export { loadAppBundledTools } from "./load-app-tools.js";
+export { packApp, unpackApp, aggregateSha256, collectFiles, isManifest, safeId, AGENTAPP_FORMAT, AgentAppPackError, } from "./pack.js";
+export type { AgentAppManifest, BundleFile, AgentAppPackErrorCode } from "./pack.js";
 export { refKey, stripOwner } from "./refs.js";
-export type { AppDefinition, AppHandle, AgentEntry, DoctypeHandle, WorkspaceShorthand, WorkspaceInput, AppUiDefinition, AppUiBuildConfig, AppArtifactSurface, AppSkillSurface, AppArtifactDecl, AppDevLaunchConfig, AppDataDefinition, AppDevDefinition, ToMastraAgentOptions, EmittedApp, } from "./types.js";
+export type { AppDefinition, AppHandle, AgentEntry, DoctypeHandle, WorkspaceShorthand, WorkspaceInput, AppUiDefinition, AppUiBuildConfig, AppArtifactSurface, AppSkillSurface, AppArtifactDecl, AppDevLaunchConfig, AppBoundariesDefinition, AppDataDefinition, AppDevDefinition, AppPlacement, AppRequirements, AppExposes, AppAccepts, ToMastraAgentOptions, EmittedApp, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACxF,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC9C,YAAY,EACV,aAAa,EACb,SAAS,EACT,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,GACX,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACxF,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,YAAY,EACZ,UAAU,EACV,MAAM,EACN,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACpF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC9C,YAAY,EACV,aAAa,EACb,SAAS,EACT,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,UAAU,GACX,MAAM,YAAY,CAAA"}

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { join, relative, isAbsolute, dirname, resolve } from 'path';
+import { join, relative, isAbsolute, dirname, resolve, basename } from 'path';
 import { defineWorkspace } from '@agentproto/workspace';
-import { mkdir, writeFile, copyFile, cp, readFile, readdir } from 'fs/promises';
+import { mkdir, writeFile, copyFile, cp, readFile, mkdtemp, readdir, rm, stat } from 'fs/promises';
 import matter2 from 'gray-matter';
 import { parseAgentManifest, agentFromManifest } from '@agentproto/agent/manifest';
 import { loadWorkflowHandle } from '@agentproto/workflow-loader';
@@ -10,6 +10,9 @@ import { parseDriverManifest, driverDefinitionFromManifest, driverFromManifest }
 import { normalizeToolId } from '@agentproto/driver';
 import { defineCliDriver } from '@agentproto/driver-cli';
 import { defineHttpDriver } from '@agentproto/driver-http';
+import { createHash } from 'crypto';
+import { tmpdir } from 'os';
+import { spawn } from 'child_process';
 
 /**
  * @agentproto/app-kit v0.1.0
@@ -112,7 +115,10 @@ async function emitApp(app, dir) {
     agents: agentRefs,
     workflows: workflowRefs2,
     ...app.workspace ? { workspace: app.workspace.id } : {},
-    ...app.requires !== void 0 ? { requires: app.requires } : {},
+    ...requiresFrontmatter(app),
+    ...app.placement !== void 0 && app.placement !== "any" ? { placement: app.placement } : {},
+    ...app.exposes && (app.exposes.agents.length > 0 || app.exposes.workflows.length > 0) ? { exposes: { agents: app.exposes.agents, workflows: app.exposes.workflows } } : {},
+    ...app.accepts?.tasks ? { accepts: { tasks: true } } : {},
     ...uiFrontmatter !== void 0 ? { ui: uiFrontmatter } : {},
     ...artifactFrontmatter !== void 0 ? { artifact: artifactFrontmatter } : {},
     ...skillFrontmatter !== void 0 ? { skill: skillFrontmatter } : {},
@@ -120,6 +126,7 @@ async function emitApp(app, dir) {
     ...app.dev !== void 0 ? { dev: app.dev } : {},
     ...app.data !== void 0 ? { data: app.data } : {},
     ...app.externalReadRoots !== void 0 ? { externalReadRoots: app.externalReadRoots } : {},
+    ...app.boundaries !== void 0 ? { boundaries: app.boundaries } : {},
     ...app.category !== void 0 ? { category: app.category } : {}
   };
   await writeFile(appPath, toManifest(appFrontmatter, app.description ?? ""), "utf8");
@@ -133,6 +140,15 @@ async function emitApp(app, dir) {
     ...skillPath ? { skillPath } : {}
   };
 }
+function requiresFrontmatter(app) {
+  const r = app.requirements;
+  if (r && (r.browser || r.fs || r.gpu || r.secrets.length > 0)) {
+    return {
+      requires: { browser: r.browser, fs: r.fs, gpu: r.gpu, secrets: r.secrets, apps: r.apps }
+    };
+  }
+  return app.requires !== void 0 ? { requires: app.requires } : {};
+}
 function toManifest(handle, body) {
   const data = JSON.parse(JSON.stringify(handle));
   return matter2.stringify(`
@@ -140,6 +156,86 @@ ${body}
 `, data);
 }
 
+// src/manifest-fields.ts
+var APP_PLACEMENTS = ["local", "box", "any", "split"];
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function stringList(v, key, fail) {
+  if (v === void 0) return [];
+  if (!Array.isArray(v) || !v.every((e) => typeof e === "string" && e.trim() !== "")) {
+    throw fail(`'${key}' must be an array of non-empty strings.`);
+  }
+  return [...v];
+}
+function bool(v, key, fail) {
+  if (v === void 0) return false;
+  if (typeof v !== "boolean") throw fail(`'${key}' must be a boolean.`);
+  return v;
+}
+function normalizeManifestFields(input, declared, fail) {
+  let placement = "any";
+  if (input.placement !== void 0) {
+    if (typeof input.placement !== "string" || !APP_PLACEMENTS.includes(input.placement)) {
+      throw fail(
+        `'placement' must be one of ${APP_PLACEMENTS.map((p) => `"${p}"`).join(", ")}, got ${JSON.stringify(input.placement)}.`
+      );
+    }
+    placement = input.placement;
+  }
+  let requires;
+  let requirements = { browser: false, fs: false, gpu: false, secrets: [], apps: [] };
+  const r = input.requires;
+  if (r !== void 0) {
+    if (Array.isArray(r)) {
+      if (!r.every((e) => typeof e === "string")) {
+        throw fail("'requires' must be an array of strings or an object { browser, fs, gpu, secrets, apps }.");
+      }
+      requires = [...r];
+      requirements = { ...requirements, apps: requires };
+    } else if (isRecord(r)) {
+      const apps = stringList(r.apps, "requires.apps", fail);
+      requirements = {
+        browser: bool(r.browser, "requires.browser", fail),
+        fs: bool(r.fs, "requires.fs", fail),
+        gpu: bool(r.gpu, "requires.gpu", fail),
+        secrets: stringList(r.secrets, "requires.secrets", fail),
+        apps
+      };
+      if (apps.length > 0) requires = apps;
+    } else {
+      throw fail("'requires' must be an array of strings or an object { browser, fs, gpu, secrets, apps }.");
+    }
+  }
+  let exposes = { agents: [], workflows: [] };
+  if (input.exposes !== void 0) {
+    if (!isRecord(input.exposes)) throw fail("'exposes' must be an object { agents, workflows }.");
+    const agents = stringList(input.exposes.agents, "exposes.agents", fail);
+    const workflows = stringList(input.exposes.workflows, "exposes.workflows", fail);
+    for (const id of agents) {
+      if (!declared.agents.includes(id)) {
+        throw fail(
+          `'exposes.agents' names '${id}' but the app declares no such agent. Declared: [${declared.agents.join(", ") || "none"}].`
+        );
+      }
+    }
+    for (const id of workflows) {
+      if (!declared.workflows.includes(id)) {
+        throw fail(
+          `'exposes.workflows' names '${id}' but the app declares no such workflow. Declared: [${declared.workflows.join(", ") || "none"}].`
+        );
+      }
+    }
+    exposes = { agents, workflows };
+  }
+  let accepts = { tasks: false };
+  if (input.accepts !== void 0) {
+    if (!isRecord(input.accepts)) throw fail("'accepts' must be an object { tasks }.");
+    accepts = { tasks: bool(input.accepts.tasks, "accepts.tasks", fail) };
+  }
+  return { placement, requires, requirements, exposes, accepts };
+}
+
 // src/define-app.ts
 var AppDefinitionError = class extends Error {
   constructor(message) {
@@ -194,7 +290,23 @@ function defineApp(def) {
   const name = def.name;
   const version = def.version ?? (id ? "0.1.0" : void 0);
   const description = def.description;
-  const requires = def.requires ? Object.freeze([...def.requires]) : void 0;
+  const fields = normalizeManifestFields(
+    { placement: def.placement, requires: def.requires, exposes: def.exposes, accepts: def.accepts },
+    { agents: agents.map((e) => e.agent.id), workflows: workflows.map((w) => w.id) },
+    (msg) => new AppDefinitionError(msg)
+  );
+  const requires = fields.requires ? Object.freeze([...fields.requires]) : void 0;
+  const requirements = Object.freeze({
+    ...fields.requirements,
+    secrets: Object.freeze([...fields.requirements.secrets]),
+    apps: Object.freeze([...fields.requirements.apps])
+  });
+  const placement = fields.placement;
+  const exposes = Object.freeze({
+    agents: Object.freeze([...fields.exposes.agents]),
+    workflows: Object.freeze([...fields.exposes.workflows])
+  });
+  const accepts = Object.freeze({ ...fields.accepts });
   const ui = def.ui ? Object.freeze({ ...def.ui }) : void 0;
   const artifact = def.artifact ? Object.freeze({ ...def.artifact }) : void 0;
   const skill = def.skill ? Object.freeze({ ...def.skill }) : void 0;
@@ -202,6 +314,7 @@ function defineApp(def) {
   const dev = def.dev ? Object.freeze({ launch: Object.freeze(def.dev.launch.map((l) => Object.freeze({ ...l }))) }) : void 0;
   const externalReadRoots = def.externalReadRoots ? Object.freeze([...def.externalReadRoots]) : void 0;
   const data = def.data ? Object.freeze({ ...def.data }) : void 0;
+  const boundaries = def.boundaries ? Object.freeze({ ...def.boundaries }) : void 0;
   const category = def.category;
   validateAttachment(agents, workflows);
   validateUniqueIds(tools, "tool");
@@ -223,6 +336,10 @@ function defineApp(def) {
     ...version !== void 0 ? { version } : {},
     ...description !== void 0 ? { description } : {},
     ...requires !== void 0 ? { requires } : {},
+    requirements,
+    placement,
+    exposes,
+    accepts,
     ...ui !== void 0 ? { ui } : {},
     ...artifact !== void 0 ? { artifact } : {},
     ...skill !== void 0 ? { skill } : {},
@@ -230,6 +347,7 @@ function defineApp(def) {
     ...dev !== void 0 ? { dev } : {},
     ...data !== void 0 ? { data } : {},
     ...externalReadRoots !== void 0 ? { externalReadRoots } : {},
+    ...boundaries !== void 0 ? { boundaries } : {},
     ...category !== void 0 ? { category } : {},
     async toMastraAgents(opts, only) {
       const targets = only ? selectAgents(frozenAgents, only) : frozenAgents;
@@ -261,6 +379,10 @@ function defineApp(def) {
           ...version !== void 0 ? { version } : {},
           ...description !== void 0 ? { description } : {},
           ...requires !== void 0 ? { requires } : {},
+          requirements,
+          placement,
+          exposes,
+          accepts,
           ...ui !== void 0 ? { ui } : {},
           ...artifact !== void 0 ? { artifact } : {},
           ...skill !== void 0 ? { skill } : {},
@@ -268,6 +390,7 @@ function defineApp(def) {
           ...dev !== void 0 ? { dev } : {},
           ...data !== void 0 ? { data } : {},
           ...externalReadRoots !== void 0 ? { externalReadRoots } : {},
+          ...boundaries !== void 0 ? { boundaries } : {},
           ...category !== void 0 ? { category } : {}
         },
         dir
@@ -595,11 +718,11 @@ function parseAppFrontmatter(data, appPath) {
       `'${appPath}': frontmatter 'workflows' must be an array of { id, path }.`
     );
   }
-  if (data.requires !== void 0) {
-    if (!Array.isArray(data.requires) || !data.requires.every((e) => typeof e === "string")) {
-      throw new AppLoadError(`'${appPath}': frontmatter 'requires' must be an array of strings.`);
-    }
-  }
+  normalizeManifestFields(
+    data,
+    { agents: data.agents.map((a) => a.id), workflows: data.workflows.map((w) => w.id) },
+    (msg) => new AppLoadError(`'${appPath}': frontmatter ${msg}`)
+  );
   if (data.data !== void 0) {
     const d = data.data;
     if (typeof d !== "object" || d === null || d.dir !== void 0 && (typeof d.dir !== "string" || d.dir.trim() === "")) {
@@ -615,6 +738,14 @@ function parseAppFrontmatter(data, appPath) {
       );
     }
   }
+  if (data.boundaries !== void 0) {
+    const b = data.boundaries;
+    if (typeof b !== "object" || b === null || Array.isArray(b) || b.enforce !== void 0 && b.enforce !== "required" && b.enforce !== "best-effort") {
+      throw new AppLoadError(
+        `'${appPath}': frontmatter 'boundaries' must be an object whose optional 'enforce' is "required" or "best-effort".`
+      );
+    }
+  }
   if (data.category !== void 0 && (typeof data.category !== "string" || data.category.trim() === "")) {
     throw new AppLoadError(`'${appPath}': frontmatter 'category' must be a non-empty string.`);
   }
@@ -725,6 +856,9 @@ async function loadAppHandle(dir) {
     ...fm.version !== void 0 ? { version: fm.version } : {},
     ...fm.description !== void 0 ? { description: fm.description } : {},
     ...fm.requires !== void 0 ? { requires: fm.requires } : {},
+    ...fm.placement !== void 0 ? { placement: fm.placement } : {},
+    ...fm.exposes !== void 0 ? { exposes: fm.exposes } : {},
+    ...fm.accepts !== void 0 ? { accepts: fm.accepts } : {},
     ...ui !== void 0 ? { ui } : {},
     ...fm.artifact !== void 0 ? { artifact: { path: resolveRef(dir, fm.artifact.path), ...fm.artifact.title !== void 0 ? { title: fm.artifact.title } : {}, ...fm.artifact.description !== void 0 ? { description: fm.artifact.description } : {} } } : {},
     ...fm.skill !== void 0 ? { skill: { path: resolveRef(dir, fm.skill.path), ...fm.skill.title !== void 0 ? { title: fm.skill.title } : {}, ...fm.skill.description !== void 0 ? { description: fm.skill.description } : {} } } : {},
@@ -732,10 +866,230 @@ async function loadAppHandle(dir) {
     ...fm.dev !== void 0 ? { dev: fm.dev } : {},
     ...fm.data !== void 0 ? { data: fm.data } : {},
     ...fm.externalReadRoots !== void 0 ? { externalReadRoots: fm.externalReadRoots } : {},
+    ...fm.boundaries !== void 0 ? { boundaries: fm.boundaries } : {},
     ...fm.category !== void 0 ? { category: fm.category } : {}
   });
 }
+var AGENTAPP_FORMAT = "agentapp/v1";
+var DEFAULT_VERSION = "0.1.0";
+var SKIP_DIR_NAMES = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+var AgentAppPackError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "AgentAppPackError";
+    this.code = code;
+  }
+};
+async function pathExists(p) {
+  try {
+    await stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function safeId(id) {
+  return String(id || "app").replace(/^@/, "").replace(/[^A-Za-z0-9._-]+/g, "-");
+}
+function isManifest(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const m = value;
+  return typeof m.format === "string" && typeof m.id === "string" && typeof m.version === "string" && Array.isArray(m.agents) && Array.isArray(m.workflows) && Array.isArray(m.files) && typeof m.fileCount === "number" && typeof m.totalSize === "number" && typeof m.sha256 === "string";
+}
+async function collectFiles(root) {
+  const files = [];
+  async function walk(relDir) {
+    const absDir = join(root, relDir);
+    for (const entry of await readdir(absDir, { withFileTypes: true })) {
+      if (entry.isDirectory() && SKIP_DIR_NAMES.has(entry.name)) continue;
+      const rel = relDir ? join(relDir, entry.name) : entry.name;
+      const abs = join(absDir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(rel);
+      } else if (entry.isFile()) {
+        const st = await stat(abs);
+        files.push({ path: rel, size: st.size });
+      }
+    }
+  }
+  await walk("");
+  return files;
+}
+async function aggregateSha256(root, files) {
+  const hash = createHash("sha256");
+  for (const file of files) {
+    hash.update(await readFile(join(root, file)));
+  }
+  return hash.digest("hex");
+}
+function runTar(args, opts) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn("tar", args, { stdio: "ignore", cwd: opts?.cwd });
+    child.once("error", reject);
+    child.once("exit", (code) => resolvePromise(code ?? 0));
+  });
+}
+function extractIds(value) {
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const entry of value) {
+    if (typeof entry === "string") {
+      if (entry) out.push(entry);
+    } else if (entry && typeof entry === "object") {
+      const id = entry.id;
+      if (typeof id === "string" && id) out.push(id);
+    }
+  }
+  return out;
+}
+function extractPaths(front, key) {
+  const value = front[key];
+  if (value === void 0 || value === null) return void 0;
+  const items = Array.isArray(value) ? value : [value];
+  const out = [];
+  for (const item of items) {
+    if (typeof item === "string") {
+      if (item) out.push(basename(item));
+    } else if (item && typeof item === "object") {
+      const p = item.path;
+      if (typeof p === "string" && p) out.push(basename(p));
+    }
+  }
+  return out.length > 0 ? out : void 0;
+}
+function extractMeta(front) {
+  const id = typeof front.id === "string" && front.id.length > 0 ? front.id : typeof front.slug === "string" && front.slug.length > 0 ? front.slug : "app";
+  const version = typeof front.version === "string" && front.version.length > 0 ? front.version : DEFAULT_VERSION;
+  const name = typeof front.name === "string" ? front.name : void 0;
+  const description = typeof front.description === "string" ? front.description : void 0;
+  const ui = extractPaths(front, "ui");
+  return {
+    id,
+    ...name !== void 0 ? { name } : {},
+    version,
+    ...description !== void 0 ? { description } : {},
+    agents: extractIds(front.agents),
+    workflows: extractIds(front.workflows),
+    ...ui !== void 0 ? { ui } : {}
+  };
+}
+async function packApp(input) {
+  const appDirAbs = resolve(input.appDir);
+  const appMdPath = join(appDirAbs, ".agentproto", "APP.md");
+  if (!await pathExists(appMdPath)) {
+    throw new AgentAppPackError(
+      "not-an-app",
+      `${appDirAbs} is not an agentproto app (missing ${appMdPath}).`
+    );
+  }
+  const raw = await readFile(appMdPath, "utf8");
+  const front = matter2(raw).data;
+  const meta = extractMeta(front);
+  const outAbs = input.out !== void 0 ? resolve(input.out) : resolve(process.cwd(), `${safeId(meta.id)}-${meta.version}.agentapp`);
+  await mkdir(dirname(outAbs), { recursive: true });
+  const files = (await collectFiles(appDirAbs)).filter((f) => f.path !== "manifest.json").filter((f) => join(appDirAbs, f.path) !== outAbs).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const fileCount = files.length;
+  const totalSize = files.reduce((sum, f) => sum + f.size, 0);
+  const sha256 = await aggregateSha256(
+    appDirAbs,
+    files.map((f) => f.path)
+  );
+  const manifest = {
+    format: AGENTAPP_FORMAT,
+    id: meta.id,
+    ...meta.name !== void 0 ? { name: meta.name } : {},
+    version: meta.version,
+    ...meta.description !== void 0 ? { description: meta.description } : {},
+    agents: meta.agents,
+    workflows: meta.workflows,
+    ...meta.ui !== void 0 ? { ui: meta.ui } : {},
+    files: files.map((f) => f.path),
+    fileCount,
+    totalSize,
+    sha256,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    agentprotoVersion: ">=0.1.0"
+  };
+  const staging = await mkdtemp(join(tmpdir(), "agentapp-"));
+  try {
+    await cp(appDirAbs, staging, {
+      recursive: true,
+      filter: (source) => !SKIP_DIR_NAMES.has(basename(source))
+    });
+    await writeFile(join(staging, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n", "utf8");
+    const entries = (await readdir(staging)).sort();
+    const packCode = await runTar(["-czf", outAbs, ...entries], { cwd: staging });
+    if (packCode !== 0) {
+      throw new AgentAppPackError("tar-failed", `tar failed with exit code ${packCode}`);
+    }
+  } finally {
+    await rm(staging, { recursive: true, force: true });
+  }
+  return { file: outAbs, manifest };
+}
+function isUnsafeBundlePath(p) {
+  if (p === "" || isAbsolute(p)) return true;
+  return p.split(/[\\/]/).includes("..");
+}
+async function unpackApp(input) {
+  const bundleAbs = resolve(input.file);
+  if (!await pathExists(bundleAbs)) {
+    throw new AgentAppPackError("bundle-not-found", `bundle not found: ${bundleAbs}`);
+  }
+  const temp = await mkdtemp(join(tmpdir(), "agentapp-"));
+  try {
+    const unpackCode = await runTar(["-xzf", bundleAbs, "-C", temp]);
+    if (unpackCode !== 0) {
+      throw new AgentAppPackError("tar-failed", `tar failed with exit code ${unpackCode}`);
+    }
+    const manifestPath = join(temp, "manifest.json");
+    if (!await pathExists(manifestPath)) {
+      throw new AgentAppPackError(
+        "missing-manifest",
+        `${bundleAbs} is not a valid .agentapp (missing manifest.json).`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(await readFile(manifestPath, "utf8"));
+    } catch {
+      throw new AgentAppPackError("malformed-manifest", `${bundleAbs} has a malformed manifest.json.`);
+    }
+    if (!isManifest(parsed)) {
+      throw new AgentAppPackError("malformed-manifest", `${bundleAbs} has a malformed manifest.json.`);
+    }
+    const manifest = parsed;
+    if (manifest.format !== AGENTAPP_FORMAT) {
+      throw new AgentAppPackError(
+        "unsupported-format",
+        `unsupported bundle format '${manifest.format}' (expected ${AGENTAPP_FORMAT}).`
+      );
+    }
+    const unsafe = manifest.files.find((f) => typeof f !== "string" || isUnsafeBundlePath(f));
+    if (unsafe !== void 0) {
+      throw new AgentAppPackError(
+        "unsafe-path",
+        `manifest.json lists a path outside the bundle root: ${JSON.stringify(unsafe)}.`
+      );
+    }
+    const actual = await aggregateSha256(temp, manifest.files);
+    if (actual !== manifest.sha256) {
+      throw new AgentAppPackError(
+        "digest-mismatch",
+        `SHA-256 mismatch (expected ${manifest.sha256}, got ${actual}). Bundle is corrupted.`
+      );
+    }
+    const outDir = input.dest !== void 0 ? resolve(input.dest) : resolve(process.cwd(), `${safeId(manifest.id)}-${manifest.version}`);
+    await rm(manifestPath, { force: true });
+    await mkdir(outDir, { recursive: true });
+    await cp(temp, outDir, { recursive: true });
+    return { dir: outDir, manifest };
+  } finally {
+    await rm(temp, { recursive: true, force: true });
+  }
+}
 
-export { AppDefinitionError, AppLoadError, defineApp, emitApp, loadAppBundledTools, loadAppHandle, peekAppUi, refKey, resolveAppUIRoot, stripOwner };
+export { AGENTAPP_FORMAT, AgentAppPackError, AppDefinitionError, AppLoadError, aggregateSha256, collectFiles, defineApp, emitApp, isManifest, loadAppBundledTools, loadAppHandle, packApp, peekAppUi, refKey, resolveAppUIRoot, safeId, stripOwner, unpackApp };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map