Packages

A package is a versioned bundle of AI workflow assets in the Workloom registry.

What goes in a package

A package contains one or more assets — the atomic units of AI workflow content:

Asset type	Example
`instruction`	Coding guidelines, project context
`skill`	Specialized capability with a SKILL.md
`agent`	Subagent definition
`workflow`	Multi-step orchestration
`prompt`	Reusable prompt template
`hook`	Pre/post-command hook
`mcp_server`	MCP server configuration
`provider_config`	Provider-specific settings
`template`	Scaffolding template
`policy`	Governance rule
`telemetry_schema`	Telemetry event definition

Naming

Packages use scoped names: @org/package-name.

@acme/security-review
@acme/react-component-skill
@acme/incident-response-agent
@acme/monorepo-defaults

Versioning

Packages use semantic versioning. Once published, a version is immutable — it can never be changed or overwritten.

@acme/security-review@1.0.0
@acme/security-review@1.1.0
@acme/security-review@2.0.0

Workspaces reference packages with version constraints:

^1.4.0    →  resolves to latest 1.x.x
~1.4.0    →  resolves to latest 1.4.x
2.0.0     →  exact version

Release channels

Each version belongs to a release channel:

Channel	Purpose
`stable`	Production-ready, default
`beta`	Pre-release testing
`canary`	Bleeding edge
`team-default`	Org-mandated baseline
`deprecated`	Superseded, avoid
`security-required`	Must-update for security

Content addressing

Every file in a package is stored by its SHA-256 content hash. This provides deduplication across versions, integrity verification on every sync, and tamper detection.

Publishing

wl push .claude/skills/security-review \
  --package @acme/security-review \
  --bump minor

This validates the asset structure, computes content hashes, uploads objects, and creates a draft package version.

What goes in a package​

Naming​

Versioning​

Release channels​

Content addressing​

Publishing​