Package an app with wu pack
Create a signed .wuapp from a native build and prepare installation in another shell.
Requires WU CLI 1.2.0 and WU Framework 4.0.0 for application APIs. Check wu --version and the project dependencies.
wu build --native
wu pack --keygen keys/catalog.pem --json
wu pack catalog --sign keys/catalog.pem --version 1.2.0 --out catalog-1.2.0.wuapp --jsonRun commands from the workspace. catalog is the name in dist/wu-manifest.json, not necessarily the directory name. --keygen outputs the public JWK used by host trust; the private key stays in the PEM file.
| Argument | Contract |
|---|---|
<app> |
App name from the build manifest. |
--dist <dir> |
Build directory; default dist. |
--out <file> |
Output file; default <name>-<version>.wuapp. |
--version <version> |
App version inside the package. |
--sign <key.pem> |
Signs with an ECDSA P-256 private key. |
--keygen <key.pem> |
Generates a private key and prints the public key; does not pack. |
--json |
Outputs the result or error as JSON. |
Format and module resolution
The wuapp/1 format is gzip-compressed JSON. It contains name, version, entry, manifest and files with type, encoding, content and SHA-256. Internal JavaScript imports become relative paths and ?v=<build> is removed. /@modules/ references remain for host-shared modules; the package does not automatically include every shell dependency.
Version comes from --version, the app manifest, its package.json, or finally 0.0.0. The signature covers the canonical representation of format, identity, entry, manifest and hashes. Without --sign, output is unsigned; the installer requires explicit authorization to accept it.
Result and errors
JSON output includes out, name, version, entry, files, bytes, signed and publicKey. A missing build manifest, unknown app, missing entry or invalid key produces exit 1. --version identifies the packaged app version, not the WU CLI version. To verify the signature and mount the content, follow Install .wuapp files.
In 1.2.0, --keygen refuses to overwrite an existing key; --force permits that explicit replacement. Signatures accept only ECDSA P-256. The packager assigns MIME by extension and validates paths, types and limits against installer rules. Hashed names from the native build retain their identity inside the package.
Implementation references
wu-cli/src/commands/pack.cjswu-cli/tests/pack-safety.test.cjswu-cli/tests/pack.test.cjs