@agentproto/app-kit 1.4.1 → 1.6.0

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { join, relative, isAbsolute, dirname, resolve, basename } from 'path';
+import { join, relative, isAbsolute, dirname, resolve, posix, basename } from 'path';
 import { defineWorkspace } from '@agentproto/workspace';
-import { mkdir, writeFile, copyFile, cp, readFile, mkdtemp, readdir, rm, stat } from 'fs/promises';
+import { mkdir, writeFile, copyFile, cp, readFile, mkdtemp, stat, readdir, rm } from 'fs/promises';
 import matter2 from 'gray-matter';
 import { parseAgentManifest, agentFromManifest } from '@agentproto/agent/manifest';
 import { loadWorkflowHandle } from '@agentproto/workflow-loader';
@@ -62,7 +62,8 @@ async function emitApp(app, dir) {
       ...app.ui.tools !== void 0 ? { tools: app.ui.tools } : {},
       ...app.ui.port !== void 0 ? { port: app.ui.port } : {},
       ...app.ui.csp !== void 0 ? { csp: app.ui.csp } : {},
-      ...app.ui.build !== void 0 ? { build: app.ui.build } : {}
+      ...app.ui.build !== void 0 ? { build: app.ui.build } : {},
+      ...app.ui.extensions !== void 0 ? { extensions: app.ui.extensions } : {}
     };
   }
   let artifactPath;
@@ -142,13 +143,28 @@ async function emitApp(app, dir) {
 }
 function requiresFrontmatter(app) {
   const r = app.requirements;
+  const apps = appsFrontmatter(app);
+  const hasAppDetail = (app.appRequirements ?? []).some(
+    (e) => e.version !== void 0 || e.workflows !== void 0 && e.workflows.length > 0
+  );
   if (r && (r.browser || r.fs || r.gpu || r.secrets.length > 0)) {
     return {
-      requires: { browser: r.browser, fs: r.fs, gpu: r.gpu, secrets: r.secrets, apps: r.apps }
+      requires: { browser: r.browser, fs: r.fs, gpu: r.gpu, secrets: r.secrets, apps }
     };
   }
+  if (hasAppDetail) {
+    return { requires: { apps } };
+  }
   return app.requires !== void 0 ? { requires: app.requires } : {};
 }
+function appsFrontmatter(app) {
+  const entries = app.appRequirements ?? app.requires ?? [];
+  return entries.map((e) => {
+    if (typeof e === "string") return e;
+    if (e.version === void 0 && (e.workflows === void 0 || e.workflows.length === 0)) return e.id;
+    return e;
+  });
+}
 function toManifest(handle, body) {
   const data = JSON.parse(JSON.stringify(handle));
   return matter2.stringify(`
@@ -156,6 +172,52 @@ ${body}
 `, data);
 }
 
+// src/version-range.ts
+var VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:[-+][\w.\-]+)?$/;
+function parseVersion(v) {
+  const m = VERSION_RE.exec(v);
+  if (!m) {
+    throw new Error(`invalid version "${v}" \u2014 expected major.minor.patch (e.g. "1.2.3").`);
+  }
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function compare(a, b) {
+  return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+function parseVersionRange(range) {
+  let m = /^\^(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(range);
+  if (m !== null) {
+    return {
+      kind: "caret",
+      version: [Number(m[1]), m[2] !== void 0 ? Number(m[2]) : 0, m[3] !== void 0 ? Number(m[3]) : 0]
+    };
+  }
+  m = /^~(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(range);
+  if (m !== null) {
+    return {
+      kind: "tilde",
+      version: [Number(m[1]), m[2] !== void 0 ? Number(m[2]) : 0, m[3] !== void 0 ? Number(m[3]) : 0],
+      minorGiven: m[2] !== void 0
+    };
+  }
+  if (VERSION_RE.test(range)) return { kind: "exact", version: parseVersion(range) };
+  throw new Error(
+    `invalid version range "${range}" \u2014 expected an exact version ("1.2.3"), a caret ("^1", "^1.2", "^1.2.3"), or a tilde ("~1", "~1.2", "~1.2.3").`
+  );
+}
+function versionSatisfies(version, range) {
+  const v = parseVersion(version);
+  const r = parseVersionRange(range);
+  if (r.kind === "exact") return compare(v, r.version) === 0;
+  if (compare(v, r.version) < 0) return false;
+  if (r.kind === "caret") {
+    if (r.version[0] > 0) return v[0] === r.version[0];
+    if (r.version[1] > 0) return v[0] === 0 && v[1] === r.version[1];
+    return v[0] === 0 && v[1] === 0 && v[2] === r.version[2];
+  }
+  return v[0] === r.version[0] && (!r.minorGiven || v[1] === r.version[1]);
+}
+
 // src/manifest-fields.ts
 var APP_PLACEMENTS = ["local", "box", "any", "split"];
 function isRecord(v) {
@@ -173,6 +235,52 @@ function bool(v, key, fail) {
   if (typeof v !== "boolean") throw fail(`'${key}' must be a boolean.`);
   return v;
 }
+function appRequirementEntry(entry, key, fail) {
+  if (typeof entry === "string") {
+    if (entry.trim() === "") throw fail(`'${key}' entries must be non-empty strings or objects.`);
+    return { id: entry };
+  }
+  if (!isRecord(entry)) {
+    throw fail(`'${key}' entries must be non-empty strings or objects, got ${JSON.stringify(entry)}.`);
+  }
+  const id = entry.id;
+  if (typeof id !== "string" || id.trim() === "") {
+    throw fail(`'${key}.id' must be a non-empty string.`);
+  }
+  const version = entry.version;
+  if (version !== void 0) {
+    if (typeof version !== "string" || version.trim() === "") {
+      throw fail(`'${key}.version' must be a non-empty string.`);
+    }
+    try {
+      parseVersionRange(version);
+    } catch (err) {
+      throw fail(`'${key}.version' ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const workflows = entry.workflows;
+  if (workflows !== void 0) {
+    if (!Array.isArray(workflows) || !workflows.every((w) => typeof w === "string" && w.trim() !== "")) {
+      throw fail(`'${key}.workflows' must be an array of non-empty strings.`);
+    }
+  }
+  const extra = Object.keys(entry).filter((k) => k !== "id" && k !== "version" && k !== "workflows");
+  if (extra.length > 0) {
+    throw fail(`'${key}.${extra[0]}' is not a supported requires.apps entry field (expected id, version, workflows).`);
+  }
+  return {
+    id,
+    ...version !== void 0 ? { version } : {},
+    ...workflows !== void 0 ? { workflows: [...workflows] } : {}
+  };
+}
+function appRequirementList(v, key, fail) {
+  if (v === void 0) return [];
+  if (!Array.isArray(v)) {
+    throw fail(`'${key}' must be an array of non-empty strings or { id, version?, workflows? } objects.`);
+  }
+  return v.map((e, i) => appRequirementEntry(e, `${key}[${i}]`, fail));
+}
 function normalizeManifestFields(input, declared, fail) {
   let placement = "any";
   if (input.placement !== void 0) {
@@ -185,6 +293,7 @@ function normalizeManifestFields(input, declared, fail) {
   }
   let requires;
   let requirements = { browser: false, fs: false, gpu: false, secrets: [], apps: [] };
+  let appRequirements = [];
   const r = input.requires;
   if (r !== void 0) {
     if (Array.isArray(r)) {
@@ -193,16 +302,18 @@ function normalizeManifestFields(input, declared, fail) {
       }
       requires = [...r];
       requirements = { ...requirements, apps: requires };
+      appRequirements = appRequirementList(r, "requires", fail);
     } else if (isRecord(r)) {
-      const apps = stringList(r.apps, "requires.apps", fail);
+      const apps = appRequirementList(r.apps, "requires.apps", fail);
       requirements = {
         browser: bool(r.browser, "requires.browser", fail),
         fs: bool(r.fs, "requires.fs", fail),
         gpu: bool(r.gpu, "requires.gpu", fail),
         secrets: stringList(r.secrets, "requires.secrets", fail),
-        apps
+        apps: apps.map((e) => e.id)
       };
-      if (apps.length > 0) requires = apps;
+      appRequirements = apps;
+      if (apps.length > 0) requires = apps.map((e) => e.id);
     } else {
       throw fail("'requires' must be an array of strings or an object { browser, fs, gpu, secrets, apps }.");
     }
@@ -233,7 +344,7 @@ function normalizeManifestFields(input, declared, fail) {
     if (!isRecord(input.accepts)) throw fail("'accepts' must be an object { tasks }.");
     accepts = { tasks: bool(input.accepts.tasks, "accepts.tasks", fail) };
   }
-  return { placement, requires, requirements, exposes, accepts };
+  return { placement, requires, requirements, appRequirements, exposes, accepts };
 }
 
 // src/define-app.ts
@@ -301,13 +412,28 @@ function defineApp(def) {
     secrets: Object.freeze([...fields.requirements.secrets]),
     apps: Object.freeze([...fields.requirements.apps])
   });
+  const appRequirements = Object.freeze(
+    fields.appRequirements.map((e) => Object.freeze({ ...e, ...e.workflows !== void 0 ? { workflows: Object.freeze([...e.workflows]) } : {} }))
+  );
   const placement = fields.placement;
   const exposes = Object.freeze({
     agents: Object.freeze([...fields.exposes.agents]),
     workflows: Object.freeze([...fields.exposes.workflows])
   });
   const accepts = Object.freeze({ ...fields.accepts });
-  const ui = def.ui ? Object.freeze({ ...def.ui }) : void 0;
+  const uiExtensions = def.ui === void 0 || def.ui.extensions === void 0 ? void 0 : Object.freeze({
+    openai: freezeDeep(
+      normalizeOpenAIUiExtension(
+        validateOpenAIExtensionsNamespace(def.ui.extensions),
+        def.ui.tools,
+        (msg) => new AppDefinitionError(msg)
+      )
+    )
+  });
+  const ui = def.ui ? Object.freeze({
+    ...def.ui,
+    ...uiExtensions !== void 0 ? { extensions: uiExtensions } : {}
+  }) : void 0;
   const artifact = def.artifact ? Object.freeze({ ...def.artifact }) : void 0;
   const skill = def.skill ? Object.freeze({ ...def.skill }) : void 0;
   const artifacts = def.artifacts ? Object.freeze(def.artifacts.map((a) => Object.freeze({ ...a }))) : void 0;
@@ -337,6 +463,7 @@ function defineApp(def) {
     ...description !== void 0 ? { description } : {},
     ...requires !== void 0 ? { requires } : {},
     requirements,
+    appRequirements,
     placement,
     exposes,
     accepts,
@@ -380,6 +507,7 @@ function defineApp(def) {
           ...description !== void 0 ? { description } : {},
           ...requires !== void 0 ? { requires } : {},
           requirements,
+          appRequirements,
           placement,
           exposes,
           accepts,
@@ -478,6 +606,240 @@ function validateUniqueIds(items, kind) {
     seen.add(item.id);
   }
 }
+function validateOpenAIExtensionsNamespace(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new AppDefinitionError("`ui.extensions` must be an object.");
+  }
+  for (const key of Object.keys(raw)) {
+    if (key !== "openai") {
+      throw new AppDefinitionError(
+        `\`ui.extensions.${key}\` is not supported \u2014 \`extensions\` accepts only \`openai\` (v1).`
+      );
+    }
+  }
+  return raw.openai;
+}
+var OPENAI_EXTENSION_KEYS = /* @__PURE__ */ new Set(["entrypoints", "icons", "display", "mentions"]);
+var OPENAI_CUT_KEY_MESSAGE = "is not a supported OpenAI extension field in v1 (cut would be silently half-advertised)";
+var DOT_EXTENSION_RE = /^\.[a-z0-9][a-z0-9._+-]{0,31}$/;
+var OPENAI_MODES = ["inline", "fullscreen"];
+function normalizeOpenAIUiExtension(raw, tools, fail) {
+  if (raw === void 0) return void 0;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw fail("`ui.extensions.openai` must be an object.");
+  }
+  for (const key of Object.keys(raw)) {
+    if (!OPENAI_EXTENSION_KEYS.has(key)) {
+      throw fail(`\`ui.extensions.openai.${key}\` ${OPENAI_CUT_KEY_MESSAGE}.`);
+    }
+  }
+  const entrypoints = normalizeOpenAIEntrypoints(raw.entrypoints, fail);
+  const icons = normalizeOpenAIIcons(raw.icons, fail);
+  const display = normalizeOpenAIDisplay(raw.display, fail);
+  const mentions = normalizeOpenAIMentions(raw.mentions, tools, fail);
+  return {
+    ...entrypoints !== void 0 ? { entrypoints } : {},
+    ...icons !== void 0 ? { icons } : {},
+    ...display !== void 0 ? { display } : {},
+    ...mentions !== void 0 ? { mentions } : {}
+  };
+}
+function normalizeOpenAIEntrypoints(raw, fail) {
+  if (raw === void 0) return void 0;
+  if (!Array.isArray(raw)) {
+    throw fail("`ui.extensions.openai.entrypoints` must be an array.");
+  }
+  if (raw.length < 1 || raw.length > 3) {
+    throw fail(
+      `\`ui.extensions.openai.entrypoints\` must contain 1..3 entries, got ${raw.length}.`
+    );
+  }
+  const seenTypes = /* @__PURE__ */ new Set();
+  const out = [];
+  for (let i = 0; i < raw.length; i++) {
+    const path = `ui.extensions.openai.entrypoints[${i}]`;
+    const ep = raw[i];
+    if (typeof ep !== "object" || ep === null || Array.isArray(ep)) {
+      throw fail(`\`${path}\` must be an object.`);
+    }
+    const keys = Object.keys(ep);
+    const invalidKeys = keys.filter((k) => k !== "type" && k !== "extensions");
+    if (invalidKeys.length > 0) {
+      throw fail(
+        `\`${path}.${invalidKeys[0]}\` is not a supported \`${ep.type}\` entrypoint field.`
+      );
+    }
+    const type = ep.type;
+    if (type !== "global" && type !== "thread" && type !== "file") {
+      throw fail(`\`${path}.type\` must be "global", "thread" or "file", got ${JSON.stringify(type)}.`);
+    }
+    if (seenTypes.has(type)) {
+      throw fail(`\`ui.extensions.openai.entrypoints\` declares \`${type}\` more than once.`);
+    }
+    seenTypes.add(type);
+    if (type === "file") {
+      out.push({ type, extensions: normalizeDotExtensions(ep.extensions, path, fail) });
+    } else {
+      out.push({ type });
+    }
+  }
+  return out;
+}
+function normalizeDotExtensions(raw, path, fail) {
+  if (!Array.isArray(raw)) {
+    throw fail(`\`${path}.extensions\` must be an array of dot-prefixed strings.`);
+  }
+  if (raw.length < 1 || raw.length > 32) {
+    throw fail(`\`${path}.extensions\` must contain 1..32 entries, got ${raw.length}.`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (let i = 0; i < raw.length; i++) {
+    const ext = raw[i];
+    if (typeof ext !== "string" || ext.trim() === "") {
+      throw fail(`\`${path}.extensions[${i}]\` must be a non-empty string.`);
+    }
+    const normalized = ext.toLowerCase();
+    if (seen.has(normalized)) {
+      throw fail(`\`${path}.extensions\` declares '${normalized}' more than once.`);
+    }
+    seen.add(normalized);
+    if (!DOT_EXTENSION_RE.test(normalized)) {
+      throw fail(
+        `\`${path}.extensions[${i}]\` ('${ext}') must be a dot-prefixed lowercase suffix matching /^\\.[a-z0-9][a-z0-9._+-]{0,31}$/, e.g. '.md'.`
+      );
+    }
+    out.push(normalized);
+  }
+  return out;
+}
+function normalizeOpenAIIcons(raw, fail) {
+  if (raw === void 0) return void 0;
+  if (!Array.isArray(raw)) throw fail("`ui.extensions.openai.icons` must be an array.");
+  if (raw.length < 1) {
+    throw fail("`ui.extensions.openai.icons` must contain at least one icon when present.");
+  }
+  return raw.map((icon, i) => {
+    const path = `ui.extensions.openai.icons[${i}]`;
+    if (typeof icon !== "object" || icon === null || Array.isArray(icon)) {
+      throw fail(`\`${path}\` must be an object.`);
+    }
+    const keys = Object.keys(icon);
+    for (const key of keys) {
+      if (key !== "src" && key !== "mimeType" && key !== "sizes" && key !== "theme") {
+        throw fail(`\`${path}.${key}\` is not a supported icon field.`);
+      }
+    }
+    const src = icon.src;
+    if (typeof src !== "string" || src.trim() === "") {
+      throw fail(`\`${path}.src\` must be a non-empty string.`);
+    }
+    if (!(ICON_SRC_HTTPS_RE.test(src) || hasValidIconSrcDataUrl(src))) {
+      throw fail(
+        `\`${path}.src\` must be an HTTPS URL or a 'data:image/\u2026;base64,\u2026' URL (inline SVG data allowed), got '${src.slice(0, 64)}'.`
+      );
+    }
+    const mimeType = icon.mimeType;
+    if (mimeType !== void 0 && (typeof mimeType !== "string" || mimeType.trim() === "")) {
+      throw fail(`\`${path}.mimeType\` must be a non-empty string when present.`);
+    }
+    const sizes = icon.sizes;
+    if (sizes !== void 0 && (!Array.isArray(sizes) || sizes.length === 0 || !sizes.every((s) => typeof s === "string" && s.trim() !== ""))) {
+      throw fail(`\`${path}.sizes\` must be an array of non-empty strings when present.`);
+    }
+    const theme = icon.theme;
+    if (theme !== void 0 && theme !== "light" && theme !== "dark") {
+      throw fail(`\`${path}.theme\` must be "light" or "dark" when present, got ${JSON.stringify(theme)}.`);
+    }
+    return {
+      src,
+      ...mimeType !== void 0 ? { mimeType } : {},
+      ...sizes !== void 0 ? { sizes: Object.freeze([...sizes]) } : {},
+      ...theme !== void 0 ? { theme } : {}
+    };
+  });
+}
+var ICON_SRC_HTTPS_RE = /^https:\/\/\S+$/;
+function hasValidIconSrcDataUrl(src) {
+  const comma = src.indexOf(",");
+  if (comma < 0) return false;
+  const header = src.slice(0, comma);
+  const payload = src.slice(comma + 1);
+  if (!/^data:image\/[a-z0-9.+-]+(?:;charset=[\w-]+)?(?:;base64|;utf8)?$/i.test(header)) return false;
+  if (/;base64$/i.test(header)) return /^[A-Za-z0-9+/=\r\n]+$/.test(payload);
+  return payload.trim() !== "";
+}
+function normalizeOpenAIDisplay(raw, fail) {
+  if (raw === void 0) return void 0;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw fail("`ui.extensions.openai.display` must be an object.");
+  }
+  const availableModes = raw.availableModes;
+  if (availableModes !== void 0) {
+    if (!Array.isArray(availableModes) || availableModes.length === 0) {
+      throw fail("`ui.extensions.openai.display.availableModes` must be a non-empty array when present.");
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const mode of availableModes) {
+      if (mode !== "inline" && mode !== "fullscreen") {
+        throw fail(
+          `\`ui.extensions.openai.display.availableModes\` supports only "inline" and "fullscreen", got ${JSON.stringify(mode)}.`
+        );
+      }
+      if (seen.has(mode)) {
+        throw fail(`\`ui.extensions.openai.display.availableModes\` declares '${mode}' more than once.`);
+      }
+      seen.add(mode);
+    }
+  }
+  const preferredMode = raw.preferredMode;
+  if (preferredMode !== void 0 && !OPENAI_MODES.includes(preferredMode)) {
+    throw fail(
+      `\`ui.extensions.openai.display.preferredMode\` must be "inline" or "fullscreen", got ${JSON.stringify(preferredMode)}.`
+    );
+  }
+  if (availableModes !== void 0 && preferredMode !== void 0 && !availableModes.includes(preferredMode)) {
+    throw fail(
+      `\`ui.extensions.openai.display.preferredMode\` ('${preferredMode}') must occur in \`ui.extensions.openai.display.availableModes\` when both are declared.`
+    );
+  }
+  return {
+    ...availableModes !== void 0 ? { availableModes: Object.freeze([...availableModes]) } : {},
+    ...preferredMode !== void 0 ? { preferredMode } : {}
+  };
+}
+function normalizeOpenAIMentions(raw, tools, fail) {
+  if (raw === void 0) return void 0;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw fail("`ui.extensions.openai.mentions` must be an object.");
+  }
+  for (const key of Object.keys(raw)) {
+    if (key !== "searchTool") {
+      throw fail(`\`ui.extensions.openai.mentions.${key}\` is not a supported mentions field.`);
+    }
+  }
+  const searchTool = raw.searchTool;
+  if (typeof searchTool !== "string" || searchTool.trim() === "") {
+    throw fail("`ui.extensions.openai.mentions.searchTool` must be a non-empty string.");
+  }
+  if (tools === void 0 || !tools.includes(searchTool)) {
+    throw fail(
+      `\`ui.extensions.openai.mentions.searchTool\` '${searchTool}' must be declared in this same ui block's \`tools\`${tools ? ` (${tools.join(", ")})` : " \u2014 the ui declares none"}.`
+    );
+  }
+  return { searchTool };
+}
+function freezeDeep(value) {
+  if (Array.isArray(value)) return Object.freeze(value.map(freezeDeep));
+  if (typeof value === "object" && value !== null) {
+    const out = {};
+    for (const [key, v] of Object.entries(value)) {
+      out[key] = freezeDeep(v);
+    }
+    return Object.freeze(out);
+  }
+  return value;
+}
 
 // src/errors.ts
 var AppLoadError = class extends Error {
@@ -842,7 +1204,13 @@ async function loadAppHandle(dir) {
       ...fm.ui.tools !== void 0 ? { tools: fm.ui.tools } : {},
       ...fm.ui.port !== void 0 ? { port: fm.ui.port } : {},
       ...fm.ui.csp !== void 0 ? { csp: fm.ui.csp } : {},
-      ...build !== void 0 ? { build } : {}
+      ...build !== void 0 ? { build } : {},
+      // Pass through UNFILTERED — `defineApp`'s
+      // `validateOpenAIExtensionsNamespace` rejects any sibling vendor key
+      // (a typo, a future vendor block, hand-authored drift) with the same
+      // diagnostic the TS-authoring path throws. Pre-filtering to `openai`
+      // here would silently drop those instead of failing loudly.
+      ...fm.ui.extensions !== void 0 ? { extensions: fm.ui.extensions } : {}
     };
   }
   return defineApp({
@@ -974,8 +1342,92 @@ function extractMeta(front) {
     ...ui !== void 0 ? { ui } : {}
   };
 }
+var RELEASE_DEFAULT_EXCLUDE = [
+  "ui/**",
+  "docs/**",
+  "data/**",
+  "scripts/**",
+  // Root-level only: `**/dev/**` would also drop a shipped agent named
+  // `dev` (`.agentproto/agents/dev/`); `ui/dev/` is covered by `ui/**`.
+  "dev/**",
+  "**/*.log",
+  "**/*.map",
+  "**/.DS_Store",
+  "**/.env",
+  "**/.env.*"
+];
+function globToRegExp(glob) {
+  const g = glob.replace(/^\.\//, "");
+  let re = "";
+  for (let i = 0; i < g.length; i++) {
+    const c = g[i];
+    if (c === "*") {
+      if (g[i + 1] === "*") {
+        i++;
+        if (g[i + 1] === "/") {
+          i++;
+          re += "(?:.*/)?";
+        } else {
+          re += ".*";
+        }
+      } else {
+        re += "[^/]*";
+      }
+    } else if ("\\^$+?.()|{}[]".includes(c)) {
+      re += "\\" + c;
+    } else {
+      re += c;
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+function toPosix(p) {
+  return p.replace(/\\/g, "/");
+}
+function matchesAny(path, globs) {
+  const p = toPosix(path);
+  return globs.some((re) => re.test(p));
+}
+function readPackageRules(front) {
+  const raw = front.package;
+  if (raw === void 0 || raw === null) return {};
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new AgentAppPackError("invalid-package", "APP.md `package` must be an object.");
+  }
+  const r = raw;
+  const list = (key) => {
+    const v = r[key];
+    if (v === void 0) return void 0;
+    if (!Array.isArray(v) || v.some((s) => typeof s !== "string" || s.trim() === "")) {
+      throw new AgentAppPackError(
+        "invalid-package",
+        `APP.md \`package.${key}\` must be an array of non-empty glob strings.`
+      );
+    }
+    return v;
+  };
+  if (r.stripBuild !== void 0 && typeof r.stripBuild !== "boolean") {
+    throw new AgentAppPackError("invalid-package", "APP.md `package.stripBuild` must be a boolean.");
+  }
+  const include = list("include");
+  const exclude = list("exclude");
+  return {
+    ...include !== void 0 ? { include } : {},
+    ...exclude !== void 0 ? { exclude } : {},
+    ...typeof r.stripBuild === "boolean" ? { stripBuild: r.stripBuild } : {}
+  };
+}
+function uiRelPath(front) {
+  const ui = front.ui;
+  const raw = typeof ui === "string" ? ui : ui && typeof ui === "object" && !Array.isArray(ui) && typeof ui.path === "string" ? ui.path : void 0;
+  if (raw === void 0 || raw === "" || isAbsolute(raw)) return void 0;
+  const rel = posix.normalize(toPosix(raw)).replace(/^\.\//, "");
+  if (rel.startsWith("../") || rel === "..") return void 0;
+  return rel;
+}
 async function packApp(input) {
   const appDirAbs = resolve(input.appDir);
+  const release = input.release === true;
   const appMdPath = join(appDirAbs, ".agentproto", "APP.md");
   if (!await pathExists(appMdPath)) {
     throw new AgentAppPackError(
@@ -984,49 +1436,82 @@ async function packApp(input) {
     );
   }
   const raw = await readFile(appMdPath, "utf8");
-  const front = matter2(raw).data;
+  const parsedAppMd = matter2(raw);
+  const front = parsedAppMd.data;
   const meta = extractMeta(front);
+  const rules = readPackageRules(front);
   const outAbs = input.out !== void 0 ? resolve(input.out) : resolve(process.cwd(), `${safeId(meta.id)}-${meta.version}.agentapp`);
   await mkdir(dirname(outAbs), { recursive: true });
-  const files = (await collectFiles(appDirAbs)).filter((f) => f.path !== "manifest.json").filter((f) => join(appDirAbs, f.path) !== outAbs).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-  const fileCount = files.length;
-  const totalSize = files.reduce((sum, f) => sum + f.size, 0);
-  const sha256 = await aggregateSha256(
-    appDirAbs,
-    files.map((f) => f.path)
-  );
-  const manifest = {
-    format: AGENTAPP_FORMAT,
-    id: meta.id,
-    ...meta.name !== void 0 ? { name: meta.name } : {},
-    version: meta.version,
-    ...meta.description !== void 0 ? { description: meta.description } : {},
-    agents: meta.agents,
-    workflows: meta.workflows,
-    ...meta.ui !== void 0 ? { ui: meta.ui } : {},
-    files: files.map((f) => f.path),
-    fileCount,
-    totalSize,
-    sha256,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    agentprotoVersion: ">=0.1.0"
-  };
+  const appMdRel = ".agentproto/APP.md";
+  const uiRel = uiRelPath(front);
+  const uiAssetsPrefix = uiRel !== void 0 ? `${posix.dirname(uiRel)}/assets/`.replace(/^\.\//, "") : void 0;
+  const includeRes = rules.include?.map(globToRegExp);
+  const excludeRes = [...release ? RELEASE_DEFAULT_EXCLUDE : [], ...rules.exclude ?? []].map(globToRegExp);
+  const alwaysShip = (p) => p === appMdRel || p === uiRel || uiAssetsPrefix !== void 0 && p.startsWith(uiAssetsPrefix);
+  const selected = (await collectFiles(appDirAbs)).filter((f) => f.path !== "manifest.json").filter((f) => join(appDirAbs, f.path) !== outAbs).filter((f) => {
+    const p = toPosix(f.path);
+    if (alwaysShip(p)) return true;
+    if (includeRes !== void 0 && !matchesAny(p, includeRes)) return false;
+    return !matchesAny(p, excludeRes);
+  }).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  if (release && uiRel !== void 0 && !selected.some((f) => toPosix(f.path) === uiRel)) {
+    throw new AgentAppPackError(
+      "missing-ui",
+      `ui.path "${uiRel}" does not exist in ${appDirAbs} \u2014 build the UI first (\`agentproto app build <appDir>\`, or \`agentproto app pack --release\`, which runs \`ui.build\`).`
+    );
+  }
+  const stripBuild = rules.stripBuild ?? release;
   const staging = await mkdtemp(join(tmpdir(), "agentapp-"));
   try {
-    await cp(appDirAbs, staging, {
-      recursive: true,
-      filter: (source) => !SKIP_DIR_NAMES.has(basename(source))
-    });
+    for (const f of selected) {
+      const dest = join(staging, f.path);
+      await mkdir(dirname(dest), { recursive: true });
+      await copyFile(join(appDirAbs, f.path), dest);
+    }
+    if (stripBuild) {
+      const ui = front.ui;
+      if (ui && typeof ui === "object" && !Array.isArray(ui) && "build" in ui) {
+        const data = structuredClone(front);
+        delete data.ui.build;
+        await writeFile(join(staging, appMdRel), matter2.stringify(parsedAppMd.content, data), "utf8");
+      }
+    }
+    const files = [];
+    for (const f of selected) {
+      files.push({ path: f.path, size: (await stat(join(staging, f.path))).size });
+    }
+    const fileCount = files.length;
+    const totalSize = files.reduce((sum, f) => sum + f.size, 0);
+    const sha256 = await aggregateSha256(
+      staging,
+      files.map((f) => f.path)
+    );
+    const manifest = {
+      format: AGENTAPP_FORMAT,
+      id: meta.id,
+      ...meta.name !== void 0 ? { name: meta.name } : {},
+      version: meta.version,
+      ...meta.description !== void 0 ? { description: meta.description } : {},
+      agents: meta.agents,
+      workflows: meta.workflows,
+      ...meta.ui !== void 0 ? { ui: meta.ui } : {},
+      files: files.map((f) => f.path),
+      fileCount,
+      totalSize,
+      sha256,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      agentprotoVersion: ">=0.1.0"
+    };
     await writeFile(join(staging, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n", "utf8");
     const entries = (await readdir(staging)).sort();
     const packCode = await runTar(["-czf", outAbs, ...entries], { cwd: staging });
     if (packCode !== 0) {
       throw new AgentAppPackError("tar-failed", `tar failed with exit code ${packCode}`);
     }
+    return { file: outAbs, manifest };
   } finally {
     await rm(staging, { recursive: true, force: true });
   }
-  return { file: outAbs, manifest };
 }
 function isUnsafeBundlePath(p) {
   if (p === "" || isAbsolute(p)) return true;
@@ -1090,6 +1575,6 @@ async function unpackApp(input) {
   }
 }
 
-export { AGENTAPP_FORMAT, AgentAppPackError, AppDefinitionError, AppLoadError, aggregateSha256, collectFiles, defineApp, emitApp, isManifest, loadAppBundledTools, loadAppHandle, packApp, peekAppUi, refKey, resolveAppUIRoot, safeId, stripOwner, unpackApp };
+export { AGENTAPP_FORMAT, AgentAppPackError, AppDefinitionError, AppLoadError, RELEASE_DEFAULT_EXCLUDE, aggregateSha256, collectFiles, defineApp, emitApp, globToRegExp, isManifest, loadAppBundledTools, loadAppHandle, packApp, peekAppUi, readPackageRules, refKey, resolveAppUIRoot, safeId, stripOwner, unpackApp, versionSatisfies };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map