@agentproto/app-kit 1.5.0 → 1.6.1

package/README.md

@@ -140,7 +140,7 @@ runtime app registry:
   /apps/:appId/ui`, the MCP panel cache, and `agentproto app serve` all call
   the same `ensureAppUiBuilt` (`@agentproto/runtime/app-ui-build`) before
   serving, single-flight per bundle path so concurrent first requests only
-  build once. Output is captured to `<appDir>/.agentproto/ui-build.log`; a
+  build once. Output is captured to `~/.agentproto/logs/app-ui-build/<app>-<hash>.log`; a
   failing build surfaces that log's tail as the tool/route error instead of
   a bare 404. No `ui.build` declared ⇒ today's behavior: the bundle must
   already exist on disk.
@@ -394,7 +394,7 @@ ui:
 `agentproto app serve` all resolve this the same way (`peekAppUi` +
 `ensureAppUiBuilt` from `@agentproto/runtime/app-ui-build`): missing or
 older than the newest matching source → run `command` once (single-flight
-per bundle path, output captured to `.agentproto/ui-build.log`) → serve.
+per bundle path, output captured to `~/.agentproto/logs/app-ui-build/`) → serve.
 Omit `build` to keep committing the bundle, unchanged from before this
 existed.
 

package/dist/define-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-app.d.ts","sourceRoot":"","sources":["../src/define-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,KAAK,EAEV,aAAa,EACb,SAAS,EACT,aAAa,EACb,oBAAoB,EAKrB,MAAM,YAAY,CAAA;AAKnB,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,CA0LvD;AA8JD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACpC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,GAC/B,oBAAoB,GAAG,SAAS,CAsBlC;AAmPD,YAAY,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"define-app.d.ts","sourceRoot":"","sources":["../src/define-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,KAAK,EAEV,aAAa,EACb,SAAS,EAET,aAAa,EACb,oBAAoB,EAKrB,MAAM,YAAY,CAAA;AAKnB,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,CA+LvD;AA8JD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACpC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,GAC/B,oBAAoB,GAAG,SAAS,CAsBlC;AAmPD,YAAY,EAAE,aAAa,EAAE,CAAA"}

package/dist/emit.d.ts

@@ -32,7 +32,7 @@
  */
 import type { WorkflowHandle } from "@agentproto/workflow";
 import type { WorkspaceHandle } from "@agentproto/workspace";
-import type { AgentEntry, AppAccepts, AppArtifactDecl, AppArtifactSurface, AppBoundariesDefinition, AppDataDefinition, AppDevDefinition, AppExposes, AppPlacement, AppRequirements, AppSkillSurface, AppUiDefinition, EmittedApp } from "./types.js";
+import type { AgentEntry, AppAccepts, AppArtifactDecl, AppArtifactSurface, AppBoundariesDefinition, AppDataDefinition, AppDevDefinition, AppExposes, AppPlacement, AppRequirement, AppRequirements, AppSkillSurface, AppUiDefinition, EmittedApp } from "./types.js";
 interface EmitInput {
     readonly agents: readonly AgentEntry[];
     readonly workflows: readonly WorkflowHandle[];
@@ -43,6 +43,7 @@ interface EmitInput {
     readonly description?: string;
     readonly requires?: readonly string[];
     readonly requirements?: AppRequirements;
+    readonly appRequirements?: readonly AppRequirement[];
     readonly placement?: AppPlacement;
     readonly exposes?: AppExposes;
     readonly accepts?: AppAccepts;

package/dist/emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../src/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAGpP,UAAU,SAAS;IACjB,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAA;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe,CAAA;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAA;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAA;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAwH9E"}
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../src/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAGpQ,UAAU,SAAS;IACjB,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAA;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe,CAAA;IACvC,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAA;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAA;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAwH9E"}

package/dist/index.d.ts

@@ -41,8 +41,9 @@ export { emitApp } from "./emit.js";
 export { loadAppHandle, AppLoadError, resolveAppUIRoot, peekAppUi } from "./load-app.js";
 export type { AppUiPeek } from "./load-app.js";
 export { loadAppBundledTools } from "./load-app-tools.js";
-export { packApp, unpackApp, aggregateSha256, collectFiles, isManifest, safeId, AGENTAPP_FORMAT, AgentAppPackError, } from "./pack.js";
-export type { AgentAppManifest, BundleFile, AgentAppPackErrorCode } from "./pack.js";
+export { packApp, unpackApp, aggregateSha256, collectFiles, isManifest, safeId, AGENTAPP_FORMAT, AgentAppPackError, RELEASE_DEFAULT_EXCLUDE, globToRegExp, readPackageRules, } from "./pack.js";
+export type { AgentAppManifest, BundleFile, AgentAppPackErrorCode, AppPackageRules } from "./pack.js";
 export { refKey, stripOwner } from "./refs.js";
-export type { AppDefinition, AppHandle, AgentEntry, DoctypeHandle, WorkspaceShorthand, WorkspaceInput, AppUiDefinition, AppUiBuildConfig, OpenAIAppUiExtension, OpenAIEntrypoint, OpenAIIcon, AppArtifactSurface, AppSkillSurface, AppArtifactDecl, AppDevLaunchConfig, AppBoundariesDefinition, AppDataDefinition, AppDevDefinition, AppPlacement, AppRequirements, AppExposes, AppAccepts, ToMastraAgentOptions, EmittedApp, } from "./types.js";
+export { versionSatisfies } from "./version-range.js";
+export type { AppDefinition, AppHandle, AgentEntry, DoctypeHandle, WorkspaceShorthand, WorkspaceInput, AppUiDefinition, AppUiBuildConfig, OpenAIAppUiExtension, OpenAIEntrypoint, OpenAIIcon, AppArtifactSurface, AppSkillSurface, AppArtifactDecl, AppDevLaunchConfig, AppBoundariesDefinition, AppDataDefinition, AppDevDefinition, AppPlacement, AppRequirements, AppRequirement, AppRequirementEntry, AppExposes, AppAccepts, ToMastraAgentOptions, EmittedApp, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACxF,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,YAAY,EACZ,UAAU,EACV,MAAM,EACN,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACpF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC9C,YAAY,EACV,aAAa,EACb,SAAS,EACT,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,UAAU,GACX,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACxF,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,YAAY,EACZ,UAAU,EACV,MAAM,EACN,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACZ,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACrG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,YAAY,EACV,aAAa,EACb,SAAS,EACT,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,UAAU,GACX,MAAM,YAAY,CAAA"}

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { join, relative, isAbsolute, dirname, resolve, basename } from 'path';
+import { join, relative, isAbsolute, dirname, resolve, posix, basename } from 'path';
 import { defineWorkspace } from '@agentproto/workspace';
-import { mkdir, writeFile, copyFile, cp, readFile, mkdtemp, readdir, rm, stat } from 'fs/promises';
+import { mkdir, writeFile, copyFile, cp, readFile, mkdtemp, stat, readdir, rm } from 'fs/promises';
 import matter2 from 'gray-matter';
 import { parseAgentManifest, agentFromManifest } from '@agentproto/agent/manifest';
 import { loadWorkflowHandle } from '@agentproto/workflow-loader';
@@ -143,13 +143,28 @@ async function emitApp(app, dir) {
 }
 function requiresFrontmatter(app) {
   const r = app.requirements;
+  const apps = appsFrontmatter(app);
+  const hasAppDetail = (app.appRequirements ?? []).some(
+    (e) => e.version !== void 0 || e.workflows !== void 0 && e.workflows.length > 0
+  );
   if (r && (r.browser || r.fs || r.gpu || r.secrets.length > 0)) {
     return {
-      requires: { browser: r.browser, fs: r.fs, gpu: r.gpu, secrets: r.secrets, apps: r.apps }
+      requires: { browser: r.browser, fs: r.fs, gpu: r.gpu, secrets: r.secrets, apps }
     };
   }
+  if (hasAppDetail) {
+    return { requires: { apps } };
+  }
   return app.requires !== void 0 ? { requires: app.requires } : {};
 }
+function appsFrontmatter(app) {
+  const entries = app.appRequirements ?? app.requires ?? [];
+  return entries.map((e) => {
+    if (typeof e === "string") return e;
+    if (e.version === void 0 && (e.workflows === void 0 || e.workflows.length === 0)) return e.id;
+    return e;
+  });
+}
 function toManifest(handle, body) {
   const data = JSON.parse(JSON.stringify(handle));
   return matter2.stringify(`
@@ -157,6 +172,52 @@ ${body}
 `, data);
 }
 
+// src/version-range.ts
+var VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:[-+][\w.\-]+)?$/;
+function parseVersion(v) {
+  const m = VERSION_RE.exec(v);
+  if (!m) {
+    throw new Error(`invalid version "${v}" \u2014 expected major.minor.patch (e.g. "1.2.3").`);
+  }
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function compare(a, b) {
+  return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+function parseVersionRange(range) {
+  let m = /^\^(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(range);
+  if (m !== null) {
+    return {
+      kind: "caret",
+      version: [Number(m[1]), m[2] !== void 0 ? Number(m[2]) : 0, m[3] !== void 0 ? Number(m[3]) : 0]
+    };
+  }
+  m = /^~(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(range);
+  if (m !== null) {
+    return {
+      kind: "tilde",
+      version: [Number(m[1]), m[2] !== void 0 ? Number(m[2]) : 0, m[3] !== void 0 ? Number(m[3]) : 0],
+      minorGiven: m[2] !== void 0
+    };
+  }
+  if (VERSION_RE.test(range)) return { kind: "exact", version: parseVersion(range) };
+  throw new Error(
+    `invalid version range "${range}" \u2014 expected an exact version ("1.2.3"), a caret ("^1", "^1.2", "^1.2.3"), or a tilde ("~1", "~1.2", "~1.2.3").`
+  );
+}
+function versionSatisfies(version, range) {
+  const v = parseVersion(version);
+  const r = parseVersionRange(range);
+  if (r.kind === "exact") return compare(v, r.version) === 0;
+  if (compare(v, r.version) < 0) return false;
+  if (r.kind === "caret") {
+    if (r.version[0] > 0) return v[0] === r.version[0];
+    if (r.version[1] > 0) return v[0] === 0 && v[1] === r.version[1];
+    return v[0] === 0 && v[1] === 0 && v[2] === r.version[2];
+  }
+  return v[0] === r.version[0] && (!r.minorGiven || v[1] === r.version[1]);
+}
+
 // src/manifest-fields.ts
 var APP_PLACEMENTS = ["local", "box", "any", "split"];
 function isRecord(v) {
@@ -174,6 +235,52 @@ function bool(v, key, fail) {
   if (typeof v !== "boolean") throw fail(`'${key}' must be a boolean.`);
   return v;
 }
+function appRequirementEntry(entry, key, fail) {
+  if (typeof entry === "string") {
+    if (entry.trim() === "") throw fail(`'${key}' entries must be non-empty strings or objects.`);
+    return { id: entry };
+  }
+  if (!isRecord(entry)) {
+    throw fail(`'${key}' entries must be non-empty strings or objects, got ${JSON.stringify(entry)}.`);
+  }
+  const id = entry.id;
+  if (typeof id !== "string" || id.trim() === "") {
+    throw fail(`'${key}.id' must be a non-empty string.`);
+  }
+  const version = entry.version;
+  if (version !== void 0) {
+    if (typeof version !== "string" || version.trim() === "") {
+      throw fail(`'${key}.version' must be a non-empty string.`);
+    }
+    try {
+      parseVersionRange(version);
+    } catch (err) {
+      throw fail(`'${key}.version' ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const workflows = entry.workflows;
+  if (workflows !== void 0) {
+    if (!Array.isArray(workflows) || !workflows.every((w) => typeof w === "string" && w.trim() !== "")) {
+      throw fail(`'${key}.workflows' must be an array of non-empty strings.`);
+    }
+  }
+  const extra = Object.keys(entry).filter((k) => k !== "id" && k !== "version" && k !== "workflows");
+  if (extra.length > 0) {
+    throw fail(`'${key}.${extra[0]}' is not a supported requires.apps entry field (expected id, version, workflows).`);
+  }
+  return {
+    id,
+    ...version !== void 0 ? { version } : {},
+    ...workflows !== void 0 ? { workflows: [...workflows] } : {}
+  };
+}
+function appRequirementList(v, key, fail) {
+  if (v === void 0) return [];
+  if (!Array.isArray(v)) {
+    throw fail(`'${key}' must be an array of non-empty strings or { id, version?, workflows? } objects.`);
+  }
+  return v.map((e, i) => appRequirementEntry(e, `${key}[${i}]`, fail));
+}
 function normalizeManifestFields(input, declared, fail) {
   let placement = "any";
   if (input.placement !== void 0) {
@@ -186,6 +293,7 @@ function normalizeManifestFields(input, declared, fail) {
   }
   let requires;
   let requirements = { browser: false, fs: false, gpu: false, secrets: [], apps: [] };
+  let appRequirements = [];
   const r = input.requires;
   if (r !== void 0) {
     if (Array.isArray(r)) {
@@ -194,16 +302,18 @@ function normalizeManifestFields(input, declared, fail) {
       }
       requires = [...r];
       requirements = { ...requirements, apps: requires };
+      appRequirements = appRequirementList(r, "requires", fail);
     } else if (isRecord(r)) {
-      const apps = stringList(r.apps, "requires.apps", fail);
+      const apps = appRequirementList(r.apps, "requires.apps", fail);
       requirements = {
         browser: bool(r.browser, "requires.browser", fail),
         fs: bool(r.fs, "requires.fs", fail),
         gpu: bool(r.gpu, "requires.gpu", fail),
         secrets: stringList(r.secrets, "requires.secrets", fail),
-        apps
+        apps: apps.map((e) => e.id)
       };
-      if (apps.length > 0) requires = apps;
+      appRequirements = apps;
+      if (apps.length > 0) requires = apps.map((e) => e.id);
     } else {
       throw fail("'requires' must be an array of strings or an object { browser, fs, gpu, secrets, apps }.");
     }
@@ -234,7 +344,7 @@ function normalizeManifestFields(input, declared, fail) {
     if (!isRecord(input.accepts)) throw fail("'accepts' must be an object { tasks }.");
     accepts = { tasks: bool(input.accepts.tasks, "accepts.tasks", fail) };
   }
-  return { placement, requires, requirements, exposes, accepts };
+  return { placement, requires, requirements, appRequirements, exposes, accepts };
 }
 
 // src/define-app.ts
@@ -302,6 +412,9 @@ function defineApp(def) {
     secrets: Object.freeze([...fields.requirements.secrets]),
     apps: Object.freeze([...fields.requirements.apps])
   });
+  const appRequirements = Object.freeze(
+    fields.appRequirements.map((e) => Object.freeze({ ...e, ...e.workflows !== void 0 ? { workflows: Object.freeze([...e.workflows]) } : {} }))
+  );
   const placement = fields.placement;
   const exposes = Object.freeze({
     agents: Object.freeze([...fields.exposes.agents]),
@@ -350,6 +463,7 @@ function defineApp(def) {
     ...description !== void 0 ? { description } : {},
     ...requires !== void 0 ? { requires } : {},
     requirements,
+    appRequirements,
     placement,
     exposes,
     accepts,
@@ -393,6 +507,7 @@ function defineApp(def) {
           ...description !== void 0 ? { description } : {},
           ...requires !== void 0 ? { requires } : {},
           requirements,
+          appRequirements,
           placement,
           exposes,
           accepts,
@@ -1227,8 +1342,116 @@ function extractMeta(front) {
     ...ui !== void 0 ? { ui } : {}
   };
 }
+var RELEASE_DEFAULT_EXCLUDE = [
+  "ui/**",
+  "docs/**",
+  "data/**",
+  "scripts/**",
+  // Root-level only: `**/dev/**` would also drop a shipped agent named
+  // `dev` (`.agentproto/agents/dev/`); `ui/dev/` is covered by `ui/**`.
+  // Same for `test/` and `tests/`.
+  "dev/**",
+  "test/**",
+  "tests/**",
+  // Test files and folders anywhere (a workflow's `foo.test.mjs` next to
+  // its `entry.mjs`); these names are never a runtime import.
+  "**/__tests__/**",
+  "**/*.test.*",
+  "**/*.spec.*",
+  // Repo docs at the app root (the catalog entry carries the description).
+  "README.md",
+  "CHANGELOG.md",
+  "CONTRIBUTING.md",
+  // Repo and editor tooling.
+  ".github/**",
+  ".vscode/**",
+  ".idea/**",
+  ".gitignore",
+  ".editorconfig",
+  "tsconfig*.json",
+  "vitest.config.*",
+  "jest.config.*",
+  "eslint.config.*",
+  ".eslintrc*",
+  ".prettierrc*",
+  "**/*.log",
+  "**/*.map",
+  "**/.DS_Store",
+  "**/.env",
+  "**/.env.*"
+];
+function globToRegExp(glob) {
+  const g = glob.replace(/^\.\//, "");
+  let re = "";
+  for (let i = 0; i < g.length; i++) {
+    const c = g[i];
+    if (c === "*") {
+      if (g[i + 1] === "*") {
+        i++;
+        if (g[i + 1] === "/") {
+          i++;
+          re += "(?:.*/)?";
+        } else {
+          re += ".*";
+        }
+      } else {
+        re += "[^/]*";
+      }
+    } else if ("\\^$+?.()|{}[]".includes(c)) {
+      re += "\\" + c;
+    } else {
+      re += c;
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+function toPosix(p) {
+  return p.replace(/\\/g, "/");
+}
+function matchesAny(path, globs) {
+  const p = toPosix(path);
+  return globs.some((re) => re.test(p));
+}
+function readPackageRules(front) {
+  const raw = front.package;
+  if (raw === void 0 || raw === null) return {};
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new AgentAppPackError("invalid-package", "APP.md `package` must be an object.");
+  }
+  const r = raw;
+  const list = (key) => {
+    const v = r[key];
+    if (v === void 0) return void 0;
+    if (!Array.isArray(v) || v.some((s) => typeof s !== "string" || s.trim() === "")) {
+      throw new AgentAppPackError(
+        "invalid-package",
+        `APP.md \`package.${key}\` must be an array of non-empty glob strings.`
+      );
+    }
+    return v;
+  };
+  if (r.stripBuild !== void 0 && typeof r.stripBuild !== "boolean") {
+    throw new AgentAppPackError("invalid-package", "APP.md `package.stripBuild` must be a boolean.");
+  }
+  const include = list("include");
+  const exclude = list("exclude");
+  return {
+    ...include !== void 0 ? { include } : {},
+    ...exclude !== void 0 ? { exclude } : {},
+    ...typeof r.stripBuild === "boolean" ? { stripBuild: r.stripBuild } : {}
+  };
+}
+function uiRelPath(front) {
+  const ui = front.ui;
+  const raw = typeof ui === "string" ? ui : ui && typeof ui === "object" && !Array.isArray(ui) && typeof ui.path === "string" ? ui.path : void 0;
+  if (raw === void 0 || raw === "" || isAbsolute(raw)) return void 0;
+  const rel = posix.normalize(toPosix(raw)).replace(/^\.\//, "");
+  if (rel.startsWith("../") || rel === "..") return void 0;
+  return rel;
+}
 async function packApp(input) {
   const appDirAbs = resolve(input.appDir);
+  const release = input.release === true;
   const appMdPath = join(appDirAbs, ".agentproto", "APP.md");
   if (!await pathExists(appMdPath)) {
     throw new AgentAppPackError(
@@ -1237,49 +1460,82 @@ async function packApp(input) {
     );
   }
   const raw = await readFile(appMdPath, "utf8");
-  const front = matter2(raw).data;
+  const parsedAppMd = matter2(raw);
+  const front = parsedAppMd.data;
   const meta = extractMeta(front);
+  const rules = readPackageRules(front);
   const outAbs = input.out !== void 0 ? resolve(input.out) : resolve(process.cwd(), `${safeId(meta.id)}-${meta.version}.agentapp`);
   await mkdir(dirname(outAbs), { recursive: true });
-  const files = (await collectFiles(appDirAbs)).filter((f) => f.path !== "manifest.json").filter((f) => join(appDirAbs, f.path) !== outAbs).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-  const fileCount = files.length;
-  const totalSize = files.reduce((sum, f) => sum + f.size, 0);
-  const sha256 = await aggregateSha256(
-    appDirAbs,
-    files.map((f) => f.path)
-  );
-  const manifest = {
-    format: AGENTAPP_FORMAT,
-    id: meta.id,
-    ...meta.name !== void 0 ? { name: meta.name } : {},
-    version: meta.version,
-    ...meta.description !== void 0 ? { description: meta.description } : {},
-    agents: meta.agents,
-    workflows: meta.workflows,
-    ...meta.ui !== void 0 ? { ui: meta.ui } : {},
-    files: files.map((f) => f.path),
-    fileCount,
-    totalSize,
-    sha256,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    agentprotoVersion: ">=0.1.0"
-  };
+  const appMdRel = ".agentproto/APP.md";
+  const uiRel = uiRelPath(front);
+  const uiAssetsPrefix = uiRel !== void 0 ? `${posix.dirname(uiRel)}/assets/`.replace(/^\.\//, "") : void 0;
+  const includeRes = rules.include?.map(globToRegExp);
+  const excludeRes = [...release ? RELEASE_DEFAULT_EXCLUDE : [], ...rules.exclude ?? []].map(globToRegExp);
+  const alwaysShip = (p) => p === appMdRel || p === uiRel || uiAssetsPrefix !== void 0 && p.startsWith(uiAssetsPrefix);
+  const selected = (await collectFiles(appDirAbs)).filter((f) => f.path !== "manifest.json").filter((f) => join(appDirAbs, f.path) !== outAbs).filter((f) => {
+    const p = toPosix(f.path);
+    if (alwaysShip(p)) return true;
+    if (includeRes !== void 0 && !matchesAny(p, includeRes)) return false;
+    return !matchesAny(p, excludeRes);
+  }).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  if (release && uiRel !== void 0 && !selected.some((f) => toPosix(f.path) === uiRel)) {
+    throw new AgentAppPackError(
+      "missing-ui",
+      `ui.path "${uiRel}" does not exist in ${appDirAbs} \u2014 build the UI first (\`agentproto app build <appDir>\`, or \`agentproto app pack --release\`, which runs \`ui.build\`).`
+    );
+  }
+  const stripBuild = rules.stripBuild ?? release;
   const staging = await mkdtemp(join(tmpdir(), "agentapp-"));
   try {
-    await cp(appDirAbs, staging, {
-      recursive: true,
-      filter: (source) => !SKIP_DIR_NAMES.has(basename(source))
-    });
+    for (const f of selected) {
+      const dest = join(staging, f.path);
+      await mkdir(dirname(dest), { recursive: true });
+      await copyFile(join(appDirAbs, f.path), dest);
+    }
+    if (stripBuild) {
+      const ui = front.ui;
+      if (ui && typeof ui === "object" && !Array.isArray(ui) && "build" in ui) {
+        const data = structuredClone(front);
+        delete data.ui.build;
+        await writeFile(join(staging, appMdRel), matter2.stringify(parsedAppMd.content, data), "utf8");
+      }
+    }
+    const files = [];
+    for (const f of selected) {
+      files.push({ path: f.path, size: (await stat(join(staging, f.path))).size });
+    }
+    const fileCount = files.length;
+    const totalSize = files.reduce((sum, f) => sum + f.size, 0);
+    const sha256 = await aggregateSha256(
+      staging,
+      files.map((f) => f.path)
+    );
+    const manifest = {
+      format: AGENTAPP_FORMAT,
+      id: meta.id,
+      ...meta.name !== void 0 ? { name: meta.name } : {},
+      version: meta.version,
+      ...meta.description !== void 0 ? { description: meta.description } : {},
+      agents: meta.agents,
+      workflows: meta.workflows,
+      ...meta.ui !== void 0 ? { ui: meta.ui } : {},
+      files: files.map((f) => f.path),
+      fileCount,
+      totalSize,
+      sha256,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      agentprotoVersion: ">=0.1.0"
+    };
     await writeFile(join(staging, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n", "utf8");
     const entries = (await readdir(staging)).sort();
     const packCode = await runTar(["-czf", outAbs, ...entries], { cwd: staging });
     if (packCode !== 0) {
       throw new AgentAppPackError("tar-failed", `tar failed with exit code ${packCode}`);
     }
+    return { file: outAbs, manifest };
   } finally {
     await rm(staging, { recursive: true, force: true });
   }
-  return { file: outAbs, manifest };
 }
 function isUnsafeBundlePath(p) {
   if (p === "" || isAbsolute(p)) return true;
@@ -1343,6 +1599,6 @@ async function unpackApp(input) {
   }
 }
 
-export { AGENTAPP_FORMAT, AgentAppPackError, AppDefinitionError, AppLoadError, aggregateSha256, collectFiles, defineApp, emitApp, isManifest, loadAppBundledTools, loadAppHandle, packApp, peekAppUi, refKey, resolveAppUIRoot, safeId, stripOwner, unpackApp };
+export { AGENTAPP_FORMAT, AgentAppPackError, AppDefinitionError, AppLoadError, RELEASE_DEFAULT_EXCLUDE, aggregateSha256, collectFiles, defineApp, emitApp, globToRegExp, isManifest, loadAppBundledTools, loadAppHandle, packApp, peekAppUi, readPackageRules, refKey, resolveAppUIRoot, safeId, stripOwner, unpackApp, versionSatisfies };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map