Workflow packages

A workflow is rarely just one file. It usually carries prompt files, JSON schemas, and sometimes a custom validator script. A package bundles all of that into a single folder you can hand to someone else, with a checksum for every file so the other side can tell it arrived intact. Exporting a package is a Professional feature; importing one is always free.

What's in a package

A package is a plain folder with a package.json manifest at its root and the workflow's files alongside it. The manifest records the package's name and version, a content hash for the workflow, and an entry for every bundled file: the prompts, the schemas, any custom-validator scripts, and the workflow YAML itself. Each entry carries a SHA-256 checksum of that file's bytes.

Those checksums are the point. They let an import verify that nothing was lost or altered in transit. They detect corruption and casual edits; they are not cryptographic signatures, so they don't prove who made the package. Signed packages are planned for a later release.

Exporting

In the app, right-click a workflow in the Workflows list and choose Export as Package…, or use Export as Package… on the Editor tab. From the command line:

ringmaster package export workflow.yaml --out ./dist --package-version 1.2.0

--out is the folder to write into (the current directory by default), and --package-version stamps the manifest (1.0.0 by default). Export gathers the workflow's prompts and schemas, copies them with their checksums, and writes the manifest. If you don't hold a Professional license, the app explains what's needed and the CLI exits with its licensing code; see The ringmaster CLI.

Importing

In the app, use Import Package… on the Editor tab. From the command line:

ringmaster package import ./dist/my-workflow --into ./workflows

--into is the workflows folder to install into (the current directory by default). Import is free, and it is careful: before it copies anything, it checks every file against its recorded checksum, confirms the workflow matches the hash in the manifest, and makes sure no file path points outside the package. A package that is incomplete, modified, or tries to escape its own folder is refused with a message that says which check failed, and nothing is installed. A custom-validator script keeps its executable bit so it's ready to run on the other side, subject to the same consent prompt as any custom script.