# Package an app with wu pack

Create a signed .wuapp from a native build and prepare installation in another shell.

Requires WU CLI `1.2.0` and WU Framework `4.0.0` for application APIs. Check `wu --version` and the project dependencies.

```sh
wu build --native
wu pack --keygen keys/catalog.pem --json
wu pack catalog --sign keys/catalog.pem --version 1.2.0 --out catalog-1.2.0.wuapp --json
```

Run commands from the workspace. `catalog` is the name in `dist/wu-manifest.json`, not necessarily the directory name. `--keygen` outputs the public JWK used by host `trust`; the private key stays in the PEM file.

| Argument | Contract |
| --- | --- |
| `<app>` | App name from the build manifest. |
| `--dist <dir>` | Build directory; default `dist`. |
| `--out <file>` | Output file; default `<name>-<version>.wuapp`. |
| `--version <version>` | App version inside the package. |
| `--sign <key.pem>` | Signs with an ECDSA P-256 private key. |
| `--keygen <key.pem>` | Generates a private key and prints the public key; does not pack. |
| `--json` | Outputs the result or error as JSON. |

<span id="formato-y-resolución-de-módulos"></span>

<span class="section-anchor" id="section-1"></span>

## Format and module resolution

The `wuapp/1` format is gzip-compressed JSON. It contains name, version, entry, manifest and files with type, encoding, content and SHA-256. Internal JavaScript imports become relative paths and `?v=<build>` is removed. `/@modules/` references remain for host-shared modules; the package does not automatically include every shell dependency.

Version comes from `--version`, the app manifest, its `package.json`, or finally `0.0.0`. The signature covers the canonical representation of format, identity, entry, manifest and hashes. Without `--sign`, output is unsigned; the installer requires explicit authorization to accept it.

<span id="resultado-y-errores"></span>

<span class="section-anchor" id="section-2"></span>

## Result and errors

JSON output includes `out`, `name`, `version`, `entry`, `files`, `bytes`, `signed` and `publicKey`. A missing build manifest, unknown app, missing entry or invalid key produces exit `1`. `--version` identifies the packaged app version, not the WU CLI version. To verify the signature and mount the content, follow [Install .wuapp files](/docs/framework/installable-apps/).

In 1.2.0, `--keygen` refuses to overwrite an existing key; `--force` permits that explicit replacement. Signatures accept only ECDSA P-256. The packager assigns MIME by extension and validates paths, types and limits against installer rules. Hashed names from the native build retain their identity inside the package.

<span id="referencia-de-implementación"></span>

<span class="section-anchor" id="section-3"></span>

## Implementation references

- `wu-cli/src/commands/pack.cjs`
- `wu-cli/tests/pack-safety.test.cjs`
- `wu-cli/tests/pack.test.cjs`