Build a local runtime package

ktape package build turns an application directory into a deterministic static runtime package that the KTAPEOUT Shell loads directly. It is a local packaging step: it does not upload bytes, request wallet access, sign, broadcast, or activate a release.

ktape package build `
  --source .\my-app `
  --application-uri example/my-app `
  --entrypoint index.html `
  --output .\out\my-app-package

The command currently admits testnet-10 only. The application URI argument is the <namespace>/<slug> suffix; the manifest records the full ktape://testnet-10/app/<namespace>/<slug> URI.

Output layout

<output>/runtime/testnet-10/<namespace>/<slug>/<release_id>/
  runtime-manifest.json      KTAPEOUT-STATIC-RUNTIME-MANIFEST-V1
  index.html                 files keep their original relative paths
  assets/...

Copy the runtime/ tree to the site root unchanged. The manifest entrypoint is the absolute same-origin path /runtime/testnet-10/<namespace>/<slug>/<release_id>/<entrypoint>.

package_digest is SHA-256 over the domain KTAPEOUT/0.5.0/STATIC_RUNTIME_PACKAGE/V1 and the canonical JSON of the schema, network, application URI, relative entrypoint and sorted file records (path, sha256, byte_length, media_type). It does not include release_id. Without --release-id the release id equals the package digest; pass --release-id <64 lowercase hex> when the release identity is assigned by the publish flow. The package digest is the same either way.

Re-running against identical inputs reports UNCHANGED; an occupied output with different bytes is rejected. A failed build removes its staging directory.

Rules

Limits match the browser verifier, so a package that builds also loads:

The packager fails closed on content that must never be published: any file or directory whose name starts with . (for example .env, .git, .npmrc), key material (*.pem, *.key, *.p12, *.pfx, *.jks, *.keystore, *.kdbx, id_rsa*, id_ecdsa*, id_ed25519*, id_dsa*) and source maps (*.map). Point --source at the build output directory, not the project root. Symbolic links, special files, a missing entrypoint, and an output directory inside the source are also rejected. On Windows, creating a symlink-based fixture may require Developer Mode or elevated privileges; the packager itself rejects symlink entries when present.

Packaging does not publish a locator or select a storage provider. Continue with the documented publish flow to review locator identity, publisher authorization, storage, and activation. A successful package build alone does not mean that users can resolve or open the application.