@bridgeline-digital/hawk-app-cli 0.1.0-dev.20261020202308 → 0.1.0

package/schema/hawk-app.schema.json

@@ -1,611 +1,611 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://hawksearch.com/schemas/hawk-app.schema.json",
-  "title": "Hawk App manifest (hawk-app.json)",
-  "description": "Registers a Hawk App: its name, settings, visibility and the data it needs. Which clients have the app is managed in the Hawk Analytics portal or with `hawk-app clients`, not here.",
-  "type": "object",
-  "required": [
-    "slug",
-    "name",
-    "visibility"
-  ],
-  "additionalProperties": false,
-  "properties": {
-    "$schema": {
-      "type": "string"
-    },
-    "slug": {
-      "description": "Unique id, also the app's folder on the apps CDN (/<slug>/). Cannot be changed later.",
-      "type": "string",
-      "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
-      "maxLength": 64
-    },
-    "name": {
-      "description": "Shown on the Apps page.",
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 100
-    },
-    "description": {
-      "type": "string"
-    },
-    "icon": {
-      "description": "The app's icon: an .svg or .png file next to hawk-app.json, e.g. icon.svg. Hosts draw an SVG in their own color (only its shape counts: one color, square viewBox, at most 32 KB) and show a PNG as is (square, 64 to 1024 px, at most 256 KB). hawk-app deploy uploads it with each version. Without one, hosts show their default icon.",
-      "type": "string",
-      "pattern": "^(?!.*\\.\\.)[A-Za-z0-9_-][A-Za-z0-9_.-]*(/[A-Za-z0-9_-][A-Za-z0-9_.-]*)*\\.([sS][vV][gG]|[pP][nN][gG])$",
-      "maxLength": 200,
-      "examples": ["icon.svg", "assets/app-icon.png"]
-    },
-    "category": {
-      "type": "string"
-    },
-    "version": {
-      "type": "string"
-    },
-    "entryUrl": {
-      "description": "Optional, rarely needed. The platform serves the deployed version (<apps CDN>/<slug>/v<n>/); this is only used until a version has been deployed. Must be on the apps CDN, under /<slug>/.",
-      "type": "string",
-      "format": "uri"
-    },
-    "status": {
-      "description": "Deprecated and ignored: Bridgeline staff publish apps (draft/live) from the Apps page in HawkSearch. Remove it from hawk-app.json.",
-      "deprecated": true,
-      "enum": [
-        "draft",
-        "live",
-        "disabled"
-      ]
-    },
-    "visibility": {
-      "description": "Who can see the app. allowList: only the clients given the app. all: every client except excluded ones. internal: Bridgeline users only. store: the clients given the app have it; every other client sees it on the Store tab of the Apps page (with \"store\": its listing) and can request it, and a Hawk-App-Manager approves or declines. Which clients have the app (or are excluded) is managed in the Hawk Analytics portal or with `hawk-app clients`, not in hawk-app.json.",
-      "enum": [
-        "allowList",
-        "all",
-        "internal",
-        "store"
-      ]
-    },
-    "store": {
-      "description": "The store listing, required with visibility \"store\": what clients that don't have the app see on the Store tab of the Apps page, with the app's name, icon, category and description. Bridgeline sets the price label in the portal, not here. Reviewed like other settings on a live app.",
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["tagline", "screenshots"],
-      "properties": {
-        "tagline": { "description": "One line: what the app does for the client.", "type": "string", "minLength": 1, "maxLength": 120 },
-        "highlights": { "description": "Up to 5 short points.", "type": "array", "maxItems": 5, "items": { "type": "string", "minLength": 1, "maxLength": 120 } },
-        "screenshots": {
-          "description": "1 to 5 images next to hawk-app.json (.png, .jpg or .webp, at most 1 MB each; 1600×1000 is a good size), in order. hawk-app deploy uploads them with each version.",
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 5,
-          "items": { "type": "string", "pattern": "^(?!.*\\.\\.)[A-Za-z0-9_-][A-Za-z0-9_.-]*(/[A-Za-z0-9_-][A-Za-z0-9_.-]*)*\\.([pP][nN][gG]|[jJ][pP][eE]?[gG]|[wW][eE][bB][pP])$", "maxLength": 200 }
-        }
-      },
-      "examples": [
-        { "tagline": "Find and fix searches that return nothing", "highlights": ["Zero-result searches by volume", "One-click redirects"], "screenshots": ["store/overview.png", "store/fix.png"] }
-      ]
-    },
-    "listed": {
-      "description": "Whether hosts show the app on their Apps landing page (default true). false: the app is left off the list and the host hides its own title and back button for it, but it still opens by its direct URL. It does not change who can open the app (visibility and the app's clients still apply). Reviewed like other settings on a live app.",
-      "type": "boolean",
-      "default": true
-    },
-    "hosting": {
-      "description": "How the app is served. \"static\" (the default): built files (HTML/JS/CSS) on the apps CDN, deployed with hawk-app deploy. \"server\" is reserved for server-rendered apps and is not accepted yet.",
-      "enum": [
-        "static",
-        "server"
-      ],
-      "default": "static"
-    },
-    "scopes": {
-      "description": "Data the app needs. reports:read (HawkSearch Analytics reports), hawksearch:read (read the HawkSearch dashboard API), hawksearch:write (create, update and delete in the HawkSearch dashboard API: banners, boost/bury, campaigns, visibility, visitor targets, redirects, synonyms, spellcheck, pagination and sorting sets, recommendation visibility, landing page layouts, facets and landing pages; site API keys only, limited per app and client per minute, every write audit-logged), data:read (the app's own SQL queries in queries/, run against the current client's analytics data), functions:invoke (the app's own server-side functions in functions/, see \"functions\"), email:send (send email from noreply@hawksearch.com with the app's name, from the app or its functions; sends are limited per app and client per day), hawksearch:sysparams:write (read and set the HawkSearch system parameters listed in \"systemParameters\" for the user's current engine), hawksearch:search (HawkSearch search and autocomplete for the user's current engine, live or in preview; limited per app and client per minute), ai:invoke (Claude through the platform, tiers fast and smart, from the app or its functions; a daily token budget per tier and requests per minute per app and client; an app with it is never auto-approved), lambdas:invoke (call the Lambdas outside Hawk Apps listed in \"lambdas\" that the platform allows, with app.lambdas.invoke; an app with it is never auto-approved) and hawksearch:features:write (turn HawkSearch features on and off for the user's current engine, additional and facet features, one code at a time with app.hawksearch.features; any feature, including paid add-ons, so an app with it is never auto-approved), hawksearch:index (rebuild the user's engine's index from its feed and follow the rebuild with app.hawksearch.index, only where the engine's EnableRebuildIndex system parameter is on, one rebuild at a time per engine, and read the engine's indexes, current index, hierarchy and mappings through HawkSearch's Indexing API; never auto-approved), hawksearch:index:items (add, update and delete items and their attributes in the engine's indexes through the Indexing API, live at once on the current index; at most 125 items a call; never auto-approved), hawksearch:index:manage (create indexes, set the current one, delete others, rebuild autocomplete and the rest, hierarchy and facet mappings through the Indexing API; never auto-approved), hawksearch:recommendations (HawkSearch's recommendation widgets for the user's current engine with app.hawksearch.recommendations, never tracked in the client's recommendation reports; limited per app and client per minute), storage (the app's own key-value data and files kept by the platform with app.storage and app.storage.files, per app and client, within quotas; shared by everyone at the client and the app's functions and schedules) and assistant (ask the host's assistant, Hawk Assistant in HawkSearch, as the user with app.assistant.ask, from a click; the user sees the question and the answer in the assistant's chat; show the buttons only while context.features.assistant is true).",
-      "type": "array",
-      "items": {
-        "enum": [
-          "hawksearch:read",
-          "hawksearch:write",
-          "reports:read",
-          "data:read",
-          "functions:invoke",
-          "email:send",
-          "hawksearch:sysparams:write",
-          "hawksearch:search",
-          "ai:invoke",
-          "lambdas:invoke",
-          "hawksearch:features:write",
-          "hawksearch:index",
-          "hawksearch:index:items",
-          "hawksearch:index:manage",
-          "hawksearch:recommendations",
-          "storage",
-          "assistant"
-        ]
-      },
-      "uniqueItems": true
-    },
-    "template": {
-      "description": "The template the app was created from (hawk-app create writes it). hawk-app upgrade uses it to bring the app's template-owned dependencies and config files up to the template the CLI ships. Local only: not sent to the platform.",
-      "enum": [
-        "react",
-        "preact",
-        "next",
-        "next-mui",
-        "vanilla"
-      ]
-    },
-    "lambdas": {
-      "description": "Lambdas written outside Hawk Apps that the app calls with app.lambdas.invoke(name, input) (or ctx.platform.lambdas.invoke in a function), by name. Needs the lambdas:invoke scope (and the scope needs a non-empty list). Each name only works on a platform where Bridgeline Engineering allows it; the Lambda gets { caller, input }, where caller (client, user, engine) comes from the app token. Reviewed like scopes.",
-      "type": "array",
-      "maxItems": 10,
-      "uniqueItems": true,
-      "items": {
-        "type": "string",
-        "pattern": "^[A-Za-z0-9_-]{1,64}$"
-      },
-      "examples": [
-        [
-          "analytics-client-setup"
-        ]
-      ]
-    },
-    "systemParameters": {
-      "description": "HawkSearch system parameters (Sites > System Parameters) the app may read and set for the user's current engine, with app.hawksearch.systemParameters. Needs the hawksearch:sysparams:write scope (and the scope needs a non-empty list). Names match case-insensitively and must be unique. Reviewed like scopes. Encrypted, internal (AE only), global and read-only parameters are never settable; changes apply within about 3 minutes and are not synchronized to other engines of a group.",
-      "type": "array",
-      "maxItems": 50,
-      "uniqueItems": true,
-      "items": {
-        "type": "string",
-        "pattern": "^[A-Za-z0-9_.-]{1,50}$"
-      },
-      "examples": [
-        [
-          "Timezone",
-          "SearchPreviewURL"
-        ]
-      ]
-    },
-    "views": {
-      "description": "Pages of the app's build that hosts show inside other pages, by name: \"preview\" is shown on the Apps page under the description, and views with \"embeddable\": true can be placed by Bridgeline users in other pages (reports, Spark pages). Each is a page at <entry URL><path>/, with the same version, scopes and token as the app; it reads app.context.view ({ name, params, embedded, maxHeight }). A setting: pending on a live app until approved.",
-      "type": "object",
-      "maxProperties": 10,
-      "propertyNames": { "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$", "maxLength": 40 },
-      "additionalProperties": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": ["path", "title"],
-        "properties": {
-          "path": { "description": "The page within the build, e.g. views/preview (a Next.js route src/app/views/preview/page.tsx).", "type": "string", "pattern": "^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*/?$", "maxLength": 200 },
-          "title": { "description": "Shown in hosts' pickers and while the view loads.", "type": "string", "minLength": 1, "maxLength": 80 },
-          "height": { "description": "The height to start at, in px (80-1200, default 300). The view may grow within the host's limit.", "type": "integer", "minimum": 80, "maximum": 1200, "default": 300 },
-          "embeddable": { "description": "Bridgeline users may place it in other pages (report builder, Spark).", "type": "boolean", "default": false },
-          "params": { "description": "Inputs the page passes in (app.context.view.params), all strings, e.g. [\"sku\"].", "type": "array", "maxItems": 10, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z][A-Za-z0-9]{0,39}$" } },
-          "trial": { "description": "A store app's trial view (at most one, no params): shown live on its store card to clients that don't have the app, with a read-only trial token (only the app's reports:read, hawksearch:read, hawksearch:search, hawksearch:recommendations and data:read). app.context.trial is true there: hide actions that need other scopes.", "type": "boolean", "default": false },
-          "cacheMinutes": { "description": "How long the platform keeps the answers to this view's read calls (data queries, analytics reports, HawkSearch dashboard reads, search, recommendations), per client and engine, in minutes (0-1440; 0 = not cached). Default: 60 for \"preview\", 0 (not cached) for other views. The full app page is never cached. Engineering can change or stop it per app in the Hawk Analytics portal.", "type": "integer", "minimum": 0, "maximum": 1440 }
-        }
-      },
-      "examples": [
-        { "preview": { "path": "views/preview", "title": "Price position", "height": 220, "cacheMinutes": 60 }, "product": { "path": "views/product", "title": "This product", "embeddable": true, "params": ["sku"] } }
-      ]
-    },
-    "config": {
-      "description": "App config: named, non-secret values the app reads at runtime with app.config.get(key) / app.config.all() (ctx.config in a function). Declare each key here with its type and an optional default; the values are set from the Hawk Analytics portal or with `hawk-app config set`, for the whole app or one client, and apply within about 30 seconds without a deploy. Each key resolves to the client's value, else the global value, else the default, else null. Values reach the browser: never put secrets here (use secrets / clientSecrets). Reviewed like scopes.",
-      "type": "object",
-      "maxProperties": 50,
-      "propertyNames": {
-        "pattern": "^[A-Za-z][A-Za-z0-9_]{0,63}$"
-      },
-      "additionalProperties": {
-        "$ref": "#/$defs/configKey"
-      },
-      "examples": [
-        {
-          "signupNotifyEmails": {
-            "type": "emails",
-            "label": "Sign-up notification recipients",
-            "description": "Who is emailed when a client signs up.",
-            "default": ["support@example.com"]
-          },
-          "connectorsRequestEmails": {
-            "type": "emails",
-            "label": "API Connections request recipients"
-          }
-        }
-      ]
-    },
-    "externalOrigins": {
-      "description": "Outside origins the app may load scripts, styles, fonts and images from, embed, and call (fetch/XHR/WebSocket). [\"*\"] (the default when omitted) allows any https origin; a list allows only those; [] allows none. Entries starting with img: are for images only: \"img:*\" shows images from any https origin (e.g. a client's product images) and \"img:https://cdn.example.com\" from one, without allowing scripts, styles or calls there. Enforced by the apps CDN's Content-Security-Policy.",
-      "type": "array",
-      "default": [
-        "*"
-      ],
-      "maxItems": 20,
-      "uniqueItems": true,
-      "items": {
-        "type": "string",
-        "anyOf": [
-          {
-            "const": "*"
-          },
-          {
-            "pattern": "^(https|wss)://(\\*\\.)?([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\\.)*[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(:[0-9]{1,5})?/?$"
-          },
-          {
-            "pattern": "^img:(\\*|https://(\\*\\.)?([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\\.)*[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(:[0-9]{1,5})?/?)$"
-          }
-        ]
-      },
-      "examples": [
-        [
-          "*"
-        ],
-        [
-          "https://api.example.com",
-          "https://*.cdn.example.com"
-        ],
-        [
-          "img:*"
-        ]
-      ]
-    },
-    "functions": {
-      "description": "Server-side functions, one per functions/<name>.ts (or .js/.mts/.mjs) exporting `handler`. Bundled and deployed with each version as AWS Lambda functions and called from the app with app.functions.call(name, input). Needs the functions:invoke scope, and Engineering must enable functions for the app. A version whose functions changed always needs review.",
-      "type": "object",
-      "maxProperties": 10,
-      "propertyNames": {
-        "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
-        "maxLength": 40
-      },
-      "additionalProperties": {
-        "$ref": "#/$defs/function"
-      },
-      "examples": [
-        {
-          "sync-feed": {
-            "timeoutSeconds": 20,
-            "memoryMb": 512,
-            "secrets": [
-              "FEED_API_KEY"
-            ]
-          },
-          "nightly-report": {
-            "job": true,
-            "timeoutSeconds": 600
-          }
-        }
-      ]
-    },
-    "schedules": {
-      "description": "Recurring runs of job functions (\"job\": true). A schedule runs only for the clients where a user turns it on from the app (app.schedules.enable), as \"schedule:<name>\" for that client and site. Needs the functions:invoke scope. Reviewed like scopes.",
-      "type": "object",
-      "maxProperties": 5,
-      "propertyNames": {
-        "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
-        "maxLength": 40
-      },
-      "additionalProperties": {
-        "$ref": "#/$defs/schedule"
-      },
-      "examples": [
-        {
-          "nightly": {
-            "function": "nightly-report",
-            "cron": "0 7 ? * MON-FRI *",
-            "timezone": "America/Chicago"
-          }
-        }
-      ]
-    },
-    "minProtocolVersion": {
-      "type": "integer",
-      "minimum": 1,
-      "maximum": 1
-    }
-  },
-  "allOf": [
-    {
-      "if": {
-        "required": ["visibility"],
-        "properties": { "visibility": { "const": "store" } }
-      },
-      "then": { "required": ["store"] }
-    },
-    {
-      "if": {
-        "required": [
-          "functions"
-        ],
-        "properties": {
-          "functions": {
-            "minProperties": 1
-          }
-        }
-      },
-      "then": {
-        "required": [
-          "scopes"
-        ],
-        "properties": {
-          "scopes": {
-            "contains": {
-              "const": "functions:invoke"
-            }
-          }
-        }
-      }
-    },
-    {
-      "if": {
-        "required": [
-          "schedules"
-        ],
-        "properties": {
-          "schedules": {
-            "minProperties": 1
-          }
-        }
-      },
-      "then": {
-        "required": [
-          "scopes"
-        ],
-        "properties": {
-          "scopes": {
-            "contains": {
-              "const": "functions:invoke"
-            }
-          }
-        }
-      }
-    },
-    {
-      "if": {
-        "required": [
-          "systemParameters"
-        ],
-        "properties": {
-          "systemParameters": {
-            "minItems": 1
-          }
-        }
-      },
-      "then": {
-        "required": [
-          "scopes"
-        ],
-        "properties": {
-          "scopes": {
-            "contains": {
-              "const": "hawksearch:sysparams:write"
-            }
-          }
-        }
-      }
-    },
-    {
-      "if": {
-        "required": [
-          "scopes"
-        ],
-        "properties": {
-          "scopes": {
-            "contains": {
-              "const": "hawksearch:sysparams:write"
-            }
-          }
-        }
-      },
-      "then": {
-        "required": [
-          "systemParameters"
-        ],
-        "properties": {
-          "systemParameters": {
-            "minItems": 1
-          }
-        }
-      }
-    },
-    {
-      "if": {
-        "required": [
-          "lambdas"
-        ],
-        "properties": {
-          "lambdas": {
-            "minItems": 1
-          }
-        }
-      },
-      "then": {
-        "required": [
-          "scopes"
-        ],
-        "properties": {
-          "scopes": {
-            "contains": {
-              "const": "lambdas:invoke"
-            }
-          }
-        }
-      }
-    },
-    {
-      "if": {
-        "required": [
-          "scopes"
-        ],
-        "properties": {
-          "scopes": {
-            "contains": {
-              "const": "lambdas:invoke"
-            }
-          }
-        }
-      },
-      "then": {
-        "required": [
-          "lambdas"
-        ],
-        "properties": {
-          "lambdas": {
-            "minItems": 1
-          }
-        }
-      }
-    }
-  ],
-  "$defs": {
-    "configKey": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "type"
-      ],
-      "properties": {
-        "type": {
-          "description": "string (up to 4000 characters), number (finite), boolean, emails (a list of up to 50 different plain addresses), or json (any JSON value except null). Every value is at most 16 KB as JSON.",
-          "enum": [
-            "string",
-            "number",
-            "boolean",
-            "emails",
-            "json"
-          ]
-        },
-        "label": {
-          "description": "Shown in the Hawk Analytics portal next to the value.",
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 100
-        },
-        "description": {
-          "description": "What the value is for, shown in the portal.",
-          "type": "string",
-          "maxLength": 500
-        },
-        "default": {
-          "description": "The value when neither the client nor the app has one set. Must be a valid value of the type."
-        }
-      },
-      "allOf": [
-        {
-          "if": { "properties": { "type": { "const": "string" } } },
-          "then": { "properties": { "default": { "type": "string", "maxLength": 4000 } } }
-        },
-        {
-          "if": { "properties": { "type": { "const": "number" } } },
-          "then": { "properties": { "default": { "type": "number" } } }
-        },
-        {
-          "if": { "properties": { "type": { "const": "boolean" } } },
-          "then": { "properties": { "default": { "type": "boolean" } } }
-        },
-        {
-          "if": { "properties": { "type": { "const": "emails" } } },
-          "then": { "properties": { "default": { "type": "array", "maxItems": 50, "uniqueItems": true, "items": { "type": "string", "format": "email", "maxLength": 254 } } } }
-        },
-        {
-          "if": { "properties": { "type": { "const": "json" } } },
-          "then": { "properties": { "default": { "not": { "type": "null" } } } }
-        }
-      ]
-    },
-    "function": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "job": {
-          "description": "A background job: started with app.functions.start(name, input) (not called), runs up to 900 s, and its result is read later with app.functions.wait/job. Schedules can only run job functions.",
-          "type": "boolean",
-          "default": false
-        },
-        "timeoutSeconds": {
-          "description": "Maximum run time in seconds: 1-25, or 1-900 for a job. Default 10 (300 for a job).",
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 900
-        },
-        "memoryMb": {
-          "description": "Memory in MB (128-1024); more memory also means more CPU. Default 256.",
-          "type": "integer",
-          "minimum": 128,
-          "maximum": 1024,
-          "default": 256
-        },
-        "secrets": {
-          "description": "Names of the app secrets this function receives as ctx.secrets.<NAME>. Set the values with `hawk-app secrets set <NAME>`.",
-          "type": "array",
-          "maxItems": 20,
-          "uniqueItems": true,
-          "items": {
-            "type": "string",
-            "pattern": "^[A-Z][A-Z0-9_]{0,63}$"
-          },
-          "default": []
-        },
-        "clientSecrets": {
-          "description": "Names of per-client secrets this function receives as ctx.clientSecrets.<NAME>: each client's own value (e.g. their email platform's API key), set by the client's users in the app with app.clientSecrets.set(NAME, value) and never readable again. Missing when the client hasn't set one.",
-          "type": "array",
-          "maxItems": 10,
-          "uniqueItems": true,
-          "items": {
-            "type": "string",
-            "pattern": "^[A-Z][A-Z0-9_]{0,63}$"
-          },
-          "default": []
-        }
-      },
-      "if": {
-        "not": {
-          "required": [
-            "job"
-          ],
-          "properties": {
-            "job": {
-              "const": true
-            }
-          }
-        }
-      },
-      "then": {
-        "properties": {
-          "timeoutSeconds": {
-            "maximum": 25
-          }
-        }
-      }
-    },
-    "schedule": {
-      "type": "object",
-      "required": [
-        "function",
-        "cron"
-      ],
-      "additionalProperties": false,
-      "properties": {
-        "function": {
-          "description": "The job function to run (a key of \"functions\" with \"job\": true).",
-          "type": "string",
-          "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
-          "maxLength": 40
-        },
-        "cron": {
-          "description": "EventBridge cron, 6 space-separated fields: \"minutes hours day-of-month month day-of-week year\" (no cron( ) wrapper), e.g. \"0 7 ? * MON *\". At most hourly: minutes must be a single number (0-59). Day-of-month or day-of-week must be \"?\".",
-          "type": "string",
-          "pattern": "^([0-9]|[1-5][0-9]) [0-9A-Za-z*?,/#-]{1,40} (\\? [0-9A-Za-z*?,/#-]{1,40} [0-9A-Za-z*?,/#-]{1,40}|[0-9A-Za-z*?,/#-]{1,40} [0-9A-Za-z*?,/#-]{1,40} \\?) [0-9A-Za-z*?,/#-]{1,40}$",
-          "examples": [
-            "0 7 ? * MON *",
-            "30 * * * ? *"
-          ]
-        },
-        "timezone": {
-          "description": "IANA time zone the cron is evaluated in, e.g. \"America/Chicago\", or \"UTC\" (the default).",
-          "type": "string",
-          "pattern": "^(UTC|[A-Za-z0-9_+-]+(/[A-Za-z0-9_+-]+)+)$",
-          "default": "UTC"
-        }
-      }
-    }
-  }
-}
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hawksearch.com/schemas/hawk-app.schema.json",
+  "title": "Hawk App manifest (hawk-app.json)",
+  "description": "Registers a Hawk App: its name, settings, visibility and the data it needs. Which clients have the app is managed in the Hawk Analytics portal or with `hawk-app clients`, not here.",
+  "type": "object",
+  "required": [
+    "slug",
+    "name",
+    "visibility"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "slug": {
+      "description": "Unique id, also the app's folder on the apps CDN (/<slug>/). Cannot be changed later.",
+      "type": "string",
+      "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
+      "maxLength": 64
+    },
+    "name": {
+      "description": "Shown on the Apps page.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 100
+    },
+    "description": {
+      "type": "string"
+    },
+    "icon": {
+      "description": "The app's icon: an .svg or .png file next to hawk-app.json, e.g. icon.svg. Hosts draw an SVG in their own color (only its shape counts: one color, square viewBox, at most 32 KB) and show a PNG as is (square, 64 to 1024 px, at most 256 KB). hawk-app deploy uploads it with each version. Without one, hosts show their default icon.",
+      "type": "string",
+      "pattern": "^(?!.*\\.\\.)[A-Za-z0-9_-][A-Za-z0-9_.-]*(/[A-Za-z0-9_-][A-Za-z0-9_.-]*)*\\.([sS][vV][gG]|[pP][nN][gG])$",
+      "maxLength": 200,
+      "examples": ["icon.svg", "assets/app-icon.png"]
+    },
+    "category": {
+      "type": "string"
+    },
+    "version": {
+      "type": "string"
+    },
+    "entryUrl": {
+      "description": "Optional, rarely needed. The platform serves the deployed version (<apps CDN>/<slug>/v<n>/); this is only used until a version has been deployed. Must be on the apps CDN, under /<slug>/.",
+      "type": "string",
+      "format": "uri"
+    },
+    "status": {
+      "description": "Deprecated and ignored: Bridgeline staff publish apps (draft/live) from the Apps page in HawkSearch. Remove it from hawk-app.json.",
+      "deprecated": true,
+      "enum": [
+        "draft",
+        "live",
+        "disabled"
+      ]
+    },
+    "visibility": {
+      "description": "Who can see the app. allowList: only the clients given the app. all: every client except excluded ones. internal: Bridgeline users only. store: the clients given the app have it; every other client sees it on the Store tab of the Apps page (with \"store\": its listing) and can request it, and a Hawk-App-Manager approves or declines. Which clients have the app (or are excluded) is managed in the Hawk Analytics portal or with `hawk-app clients`, not in hawk-app.json.",
+      "enum": [
+        "allowList",
+        "all",
+        "internal",
+        "store"
+      ]
+    },
+    "store": {
+      "description": "The store listing, required with visibility \"store\": what clients that don't have the app see on the Store tab of the Apps page, with the app's name, icon, category and description. Bridgeline sets the price label in the portal, not here. Reviewed like other settings on a live app.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["tagline", "screenshots"],
+      "properties": {
+        "tagline": { "description": "One line: what the app does for the client.", "type": "string", "minLength": 1, "maxLength": 120 },
+        "highlights": { "description": "Up to 5 short points.", "type": "array", "maxItems": 5, "items": { "type": "string", "minLength": 1, "maxLength": 120 } },
+        "screenshots": {
+          "description": "1 to 5 images next to hawk-app.json (.png, .jpg or .webp, at most 1 MB each; 1600×1000 is a good size), in order. hawk-app deploy uploads them with each version.",
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 5,
+          "items": { "type": "string", "pattern": "^(?!.*\\.\\.)[A-Za-z0-9_-][A-Za-z0-9_.-]*(/[A-Za-z0-9_-][A-Za-z0-9_.-]*)*\\.([pP][nN][gG]|[jJ][pP][eE]?[gG]|[wW][eE][bB][pP])$", "maxLength": 200 }
+        }
+      },
+      "examples": [
+        { "tagline": "Find and fix searches that return nothing", "highlights": ["Zero-result searches by volume", "One-click redirects"], "screenshots": ["store/overview.png", "store/fix.png"] }
+      ]
+    },
+    "listed": {
+      "description": "Whether hosts show the app on their Apps landing page (default true). false: the app is left off the list and the host hides its own title and back button for it, but it still opens by its direct URL. It does not change who can open the app (visibility and the app's clients still apply). Reviewed like other settings on a live app.",
+      "type": "boolean",
+      "default": true
+    },
+    "hosting": {
+      "description": "How the app is served. \"static\" (the default): built files (HTML/JS/CSS) on the apps CDN, deployed with hawk-app deploy. \"server\" is reserved for server-rendered apps and is not accepted yet.",
+      "enum": [
+        "static",
+        "server"
+      ],
+      "default": "static"
+    },
+    "scopes": {
+      "description": "Data the app needs. reports:read (HawkSearch Analytics reports), hawksearch:read (read the HawkSearch dashboard API), hawksearch:write (create, update and delete in the HawkSearch dashboard API: banners, boost/bury, campaigns, visibility, visitor targets, redirects, synonyms, spellcheck, pagination and sorting sets, recommendation visibility, landing page layouts, facets and landing pages; site API keys only, limited per app and client per minute, every write audit-logged), data:read (the app's own SQL queries in queries/, run against the current client's analytics data), functions:invoke (the app's own server-side functions in functions/, see \"functions\"), email:send (send email from noreply@hawksearch.com with the app's name, from the app or its functions; sends are limited per app and client per day), hawksearch:sysparams:write (read and set the HawkSearch system parameters listed in \"systemParameters\" for the user's current engine), hawksearch:search (HawkSearch search and autocomplete for the user's current engine, live or in preview; limited per app and client per minute), ai:invoke (Claude through the platform, tiers fast and smart, from the app or its functions; a daily token budget per tier and requests per minute per app and client; an app with it is never auto-approved), lambdas:invoke (call the Lambdas outside Hawk Apps listed in \"lambdas\" that the platform allows, with app.lambdas.invoke; an app with it is never auto-approved) and hawksearch:features:write (turn HawkSearch features on and off for the user's current engine, additional and facet features, one code at a time with app.hawksearch.features; any feature, including paid add-ons, so an app with it is never auto-approved), hawksearch:index (rebuild the user's engine's index from its feed and follow the rebuild with app.hawksearch.index, only where the engine's EnableRebuildIndex system parameter is on, one rebuild at a time per engine, and read the engine's indexes, current index, hierarchy and mappings through HawkSearch's Indexing API; never auto-approved), hawksearch:index:items (add, update and delete items and their attributes in the engine's indexes through the Indexing API, live at once on the current index; at most 125 items a call; never auto-approved), hawksearch:index:manage (create indexes, set the current one, delete others, rebuild autocomplete and the rest, hierarchy and facet mappings through the Indexing API; never auto-approved), hawksearch:recommendations (HawkSearch's recommendation widgets for the user's current engine with app.hawksearch.recommendations, never tracked in the client's recommendation reports; limited per app and client per minute), storage (the app's own key-value data and files kept by the platform with app.storage and app.storage.files, per app and client, within quotas; shared by everyone at the client and the app's functions and schedules) and assistant (ask the host's assistant, Hawk Assistant in HawkSearch, as the user with app.assistant.ask, from a click; the user sees the question and the answer in the assistant's chat; show the buttons only while context.features.assistant is true).",
+      "type": "array",
+      "items": {
+        "enum": [
+          "hawksearch:read",
+          "hawksearch:write",
+          "reports:read",
+          "data:read",
+          "functions:invoke",
+          "email:send",
+          "hawksearch:sysparams:write",
+          "hawksearch:search",
+          "ai:invoke",
+          "lambdas:invoke",
+          "hawksearch:features:write",
+          "hawksearch:index",
+          "hawksearch:index:items",
+          "hawksearch:index:manage",
+          "hawksearch:recommendations",
+          "storage",
+          "assistant"
+        ]
+      },
+      "uniqueItems": true
+    },
+    "template": {
+      "description": "The template the app was created from (hawk-app create writes it). hawk-app upgrade uses it to bring the app's template-owned dependencies and config files up to the template the CLI ships. Local only: not sent to the platform.",
+      "enum": [
+        "react",
+        "preact",
+        "next",
+        "next-mui",
+        "vanilla"
+      ]
+    },
+    "lambdas": {
+      "description": "Lambdas written outside Hawk Apps that the app calls with app.lambdas.invoke(name, input) (or ctx.platform.lambdas.invoke in a function), by name. Needs the lambdas:invoke scope (and the scope needs a non-empty list). Each name only works on a platform where Bridgeline Engineering allows it; the Lambda gets { caller, input }, where caller (client, user, engine) comes from the app token. Reviewed like scopes.",
+      "type": "array",
+      "maxItems": 10,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9_-]{1,64}$"
+      },
+      "examples": [
+        [
+          "analytics-client-setup"
+        ]
+      ]
+    },
+    "systemParameters": {
+      "description": "HawkSearch system parameters (Sites > System Parameters) the app may read and set for the user's current engine, with app.hawksearch.systemParameters. Needs the hawksearch:sysparams:write scope (and the scope needs a non-empty list). Names match case-insensitively and must be unique. Reviewed like scopes. Encrypted, internal (AE only), global and read-only parameters are never settable; changes apply within about 3 minutes and are not synchronized to other engines of a group.",
+      "type": "array",
+      "maxItems": 50,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9_.-]{1,50}$"
+      },
+      "examples": [
+        [
+          "Timezone",
+          "SearchPreviewURL"
+        ]
+      ]
+    },
+    "views": {
+      "description": "Pages of the app's build that hosts show inside other pages, by name: \"preview\" is shown on the Apps page under the description, and views with \"embeddable\": true can be placed by Bridgeline users in other pages (reports, Spark pages). Each is a page at <entry URL><path>/, with the same version, scopes and token as the app; it reads app.context.view ({ name, params, embedded, maxHeight }). A setting: pending on a live app until approved.",
+      "type": "object",
+      "maxProperties": 10,
+      "propertyNames": { "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$", "maxLength": 40 },
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "title"],
+        "properties": {
+          "path": { "description": "The page within the build, e.g. views/preview (a Next.js route src/app/views/preview/page.tsx).", "type": "string", "pattern": "^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*/?$", "maxLength": 200 },
+          "title": { "description": "Shown in hosts' pickers and while the view loads.", "type": "string", "minLength": 1, "maxLength": 80 },
+          "height": { "description": "The height to start at, in px (80-1200, default 300). The view may grow within the host's limit.", "type": "integer", "minimum": 80, "maximum": 1200, "default": 300 },
+          "embeddable": { "description": "Bridgeline users may place it in other pages (report builder, Spark).", "type": "boolean", "default": false },
+          "params": { "description": "Inputs the page passes in (app.context.view.params), all strings, e.g. [\"sku\"].", "type": "array", "maxItems": 10, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z][A-Za-z0-9]{0,39}$" } },
+          "trial": { "description": "A store app's trial view (at most one, no params): shown live on its store card to clients that don't have the app, with a read-only trial token (only the app's reports:read, hawksearch:read, hawksearch:search, hawksearch:recommendations and data:read). app.context.trial is true there: hide actions that need other scopes.", "type": "boolean", "default": false },
+          "cacheMinutes": { "description": "How long the platform keeps the answers to this view's read calls (data queries, analytics reports, HawkSearch dashboard reads, search, recommendations), per client and engine, in minutes (0-1440; 0 = not cached). Default: 60 for \"preview\", 0 (not cached) for other views. The full app page is never cached. Engineering can change or stop it per app in the Hawk Analytics portal.", "type": "integer", "minimum": 0, "maximum": 1440 }
+        }
+      },
+      "examples": [
+        { "preview": { "path": "views/preview", "title": "Price position", "height": 220, "cacheMinutes": 60 }, "product": { "path": "views/product", "title": "This product", "embeddable": true, "params": ["sku"] } }
+      ]
+    },
+    "config": {
+      "description": "App config: named, non-secret values the app reads at runtime with app.config.get(key) / app.config.all() (ctx.config in a function). Declare each key here with its type and an optional default; the values are set from the Hawk Analytics portal or with `hawk-app config set`, for the whole app or one client, and apply within about 30 seconds without a deploy. Each key resolves to the client's value, else the global value, else the default, else null. Values reach the browser: never put secrets here (use secrets / clientSecrets). Reviewed like scopes.",
+      "type": "object",
+      "maxProperties": 50,
+      "propertyNames": {
+        "pattern": "^[A-Za-z][A-Za-z0-9_]{0,63}$"
+      },
+      "additionalProperties": {
+        "$ref": "#/$defs/configKey"
+      },
+      "examples": [
+        {
+          "signupNotifyEmails": {
+            "type": "emails",
+            "label": "Sign-up notification recipients",
+            "description": "Who is emailed when a client signs up.",
+            "default": ["support@example.com"]
+          },
+          "connectorsRequestEmails": {
+            "type": "emails",
+            "label": "API Connections request recipients"
+          }
+        }
+      ]
+    },
+    "externalOrigins": {
+      "description": "Outside origins the app may load scripts, styles, fonts and images from, embed, and call (fetch/XHR/WebSocket). [\"*\"] (the default when omitted) allows any https origin; a list allows only those; [] allows none. Entries starting with img: are for images only: \"img:*\" shows images from any https origin (e.g. a client's product images) and \"img:https://cdn.example.com\" from one, without allowing scripts, styles or calls there. Enforced by the apps CDN's Content-Security-Policy.",
+      "type": "array",
+      "default": [
+        "*"
+      ],
+      "maxItems": 20,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "anyOf": [
+          {
+            "const": "*"
+          },
+          {
+            "pattern": "^(https|wss)://(\\*\\.)?([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\\.)*[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(:[0-9]{1,5})?/?$"
+          },
+          {
+            "pattern": "^img:(\\*|https://(\\*\\.)?([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\\.)*[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(:[0-9]{1,5})?/?)$"
+          }
+        ]
+      },
+      "examples": [
+        [
+          "*"
+        ],
+        [
+          "https://api.example.com",
+          "https://*.cdn.example.com"
+        ],
+        [
+          "img:*"
+        ]
+      ]
+    },
+    "functions": {
+      "description": "Server-side functions, one per functions/<name>.ts (or .js/.mts/.mjs) exporting `handler`. Bundled and deployed with each version as AWS Lambda functions and called from the app with app.functions.call(name, input). Needs the functions:invoke scope, and Engineering must enable functions for the app. A version whose functions changed always needs review.",
+      "type": "object",
+      "maxProperties": 10,
+      "propertyNames": {
+        "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
+        "maxLength": 40
+      },
+      "additionalProperties": {
+        "$ref": "#/$defs/function"
+      },
+      "examples": [
+        {
+          "sync-feed": {
+            "timeoutSeconds": 20,
+            "memoryMb": 512,
+            "secrets": [
+              "FEED_API_KEY"
+            ]
+          },
+          "nightly-report": {
+            "job": true,
+            "timeoutSeconds": 600
+          }
+        }
+      ]
+    },
+    "schedules": {
+      "description": "Recurring runs of job functions (\"job\": true). A schedule runs only for the clients where a user turns it on from the app (app.schedules.enable), as \"schedule:<name>\" for that client and site. Needs the functions:invoke scope. Reviewed like scopes.",
+      "type": "object",
+      "maxProperties": 5,
+      "propertyNames": {
+        "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
+        "maxLength": 40
+      },
+      "additionalProperties": {
+        "$ref": "#/$defs/schedule"
+      },
+      "examples": [
+        {
+          "nightly": {
+            "function": "nightly-report",
+            "cron": "0 7 ? * MON-FRI *",
+            "timezone": "America/Chicago"
+          }
+        }
+      ]
+    },
+    "minProtocolVersion": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 1
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "required": ["visibility"],
+        "properties": { "visibility": { "const": "store" } }
+      },
+      "then": { "required": ["store"] }
+    },
+    {
+      "if": {
+        "required": [
+          "functions"
+        ],
+        "properties": {
+          "functions": {
+            "minProperties": 1
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "scopes"
+        ],
+        "properties": {
+          "scopes": {
+            "contains": {
+              "const": "functions:invoke"
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "required": [
+          "schedules"
+        ],
+        "properties": {
+          "schedules": {
+            "minProperties": 1
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "scopes"
+        ],
+        "properties": {
+          "scopes": {
+            "contains": {
+              "const": "functions:invoke"
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "required": [
+          "systemParameters"
+        ],
+        "properties": {
+          "systemParameters": {
+            "minItems": 1
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "scopes"
+        ],
+        "properties": {
+          "scopes": {
+            "contains": {
+              "const": "hawksearch:sysparams:write"
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "required": [
+          "scopes"
+        ],
+        "properties": {
+          "scopes": {
+            "contains": {
+              "const": "hawksearch:sysparams:write"
+            }
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "systemParameters"
+        ],
+        "properties": {
+          "systemParameters": {
+            "minItems": 1
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "required": [
+          "lambdas"
+        ],
+        "properties": {
+          "lambdas": {
+            "minItems": 1
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "scopes"
+        ],
+        "properties": {
+          "scopes": {
+            "contains": {
+              "const": "lambdas:invoke"
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "required": [
+          "scopes"
+        ],
+        "properties": {
+          "scopes": {
+            "contains": {
+              "const": "lambdas:invoke"
+            }
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "lambdas"
+        ],
+        "properties": {
+          "lambdas": {
+            "minItems": 1
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "configKey": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type"
+      ],
+      "properties": {
+        "type": {
+          "description": "string (up to 4000 characters), number (finite), boolean, emails (a list of up to 50 different plain addresses), or json (any JSON value except null). Every value is at most 16 KB as JSON.",
+          "enum": [
+            "string",
+            "number",
+            "boolean",
+            "emails",
+            "json"
+          ]
+        },
+        "label": {
+          "description": "Shown in the Hawk Analytics portal next to the value.",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100
+        },
+        "description": {
+          "description": "What the value is for, shown in the portal.",
+          "type": "string",
+          "maxLength": 500
+        },
+        "default": {
+          "description": "The value when neither the client nor the app has one set. Must be a valid value of the type."
+        }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "type": { "const": "string" } } },
+          "then": { "properties": { "default": { "type": "string", "maxLength": 4000 } } }
+        },
+        {
+          "if": { "properties": { "type": { "const": "number" } } },
+          "then": { "properties": { "default": { "type": "number" } } }
+        },
+        {
+          "if": { "properties": { "type": { "const": "boolean" } } },
+          "then": { "properties": { "default": { "type": "boolean" } } }
+        },
+        {
+          "if": { "properties": { "type": { "const": "emails" } } },
+          "then": { "properties": { "default": { "type": "array", "maxItems": 50, "uniqueItems": true, "items": { "type": "string", "format": "email", "maxLength": 254 } } } }
+        },
+        {
+          "if": { "properties": { "type": { "const": "json" } } },
+          "then": { "properties": { "default": { "not": { "type": "null" } } } }
+        }
+      ]
+    },
+    "function": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "job": {
+          "description": "A background job: started with app.functions.start(name, input) (not called), runs up to 900 s, and its result is read later with app.functions.wait/job. Schedules can only run job functions.",
+          "type": "boolean",
+          "default": false
+        },
+        "timeoutSeconds": {
+          "description": "Maximum run time in seconds: 1-25, or 1-900 for a job. Default 10 (300 for a job).",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 900
+        },
+        "memoryMb": {
+          "description": "Memory in MB (128-1024); more memory also means more CPU. Default 256.",
+          "type": "integer",
+          "minimum": 128,
+          "maximum": 1024,
+          "default": 256
+        },
+        "secrets": {
+          "description": "Names of the app secrets this function receives as ctx.secrets.<NAME>. Set the values with `hawk-app secrets set <NAME>`.",
+          "type": "array",
+          "maxItems": 20,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[A-Z][A-Z0-9_]{0,63}$"
+          },
+          "default": []
+        },
+        "clientSecrets": {
+          "description": "Names of per-client secrets this function receives as ctx.clientSecrets.<NAME>: each client's own value (e.g. their email platform's API key), set by the client's users in the app with app.clientSecrets.set(NAME, value) and never readable again. Missing when the client hasn't set one.",
+          "type": "array",
+          "maxItems": 10,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[A-Z][A-Z0-9_]{0,63}$"
+          },
+          "default": []
+        }
+      },
+      "if": {
+        "not": {
+          "required": [
+            "job"
+          ],
+          "properties": {
+            "job": {
+              "const": true
+            }
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "timeoutSeconds": {
+            "maximum": 25
+          }
+        }
+      }
+    },
+    "schedule": {
+      "type": "object",
+      "required": [
+        "function",
+        "cron"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "function": {
+          "description": "The job function to run (a key of \"functions\" with \"job\": true).",
+          "type": "string",
+          "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
+          "maxLength": 40
+        },
+        "cron": {
+          "description": "EventBridge cron, 6 space-separated fields: \"minutes hours day-of-month month day-of-week year\" (no cron( ) wrapper), e.g. \"0 7 ? * MON *\". At most hourly: minutes must be a single number (0-59). Day-of-month or day-of-week must be \"?\".",
+          "type": "string",
+          "pattern": "^([0-9]|[1-5][0-9]) [0-9A-Za-z*?,/#-]{1,40} (\\? [0-9A-Za-z*?,/#-]{1,40} [0-9A-Za-z*?,/#-]{1,40}|[0-9A-Za-z*?,/#-]{1,40} [0-9A-Za-z*?,/#-]{1,40} \\?) [0-9A-Za-z*?,/#-]{1,40}$",
+          "examples": [
+            "0 7 ? * MON *",
+            "30 * * * ? *"
+          ]
+        },
+        "timezone": {
+          "description": "IANA time zone the cron is evaluated in, e.g. \"America/Chicago\", or \"UTC\" (the default).",
+          "type": "string",
+          "pattern": "^(UTC|[A-Za-z0-9_+-]+(/[A-Za-z0-9_+-]+)+)$",
+          "default": "UTC"
+        }
+      }
+    }
+  }
+}