@bridgeline-digital/hawk-app-cli 0.1.0-dev.20261020202308 → 0.1.0

package/src/manifest.mjs

@@ -1,425 +1,425 @@
-import { readFile } from 'node:fs/promises';
-import { FUNCTION_NAME, FUNCTIONS_SCOPE, MAX_NAME_LENGTH, validateFunctionsManifest } from './functions.mjs';
-import { ICON_PATH, ICON_PATH_HINT } from './app-icon.mjs';
-import { validateStore } from './store-listing.mjs';
-
-export const MANIFEST_FILE = 'hawk-app.json';
-const SLUG = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-const VISIBILITIES = ['allowList', 'all', 'internal', 'store'];
-const SCOPES = ['reports:read', 'hawksearch:read', 'hawksearch:write', 'data:read', 'functions:invoke', 'email:send', 'hawksearch:sysparams:write', 'hawksearch:search', 'ai:invoke', 'lambdas:invoke', 'hawksearch:features:write', 'hawksearch:index', 'hawksearch:index:items', 'hawksearch:index:manage', 'hawksearch:recommendations', 'storage', 'assistant'];
-export const SYSPARAMS_SCOPE = 'hawksearch:sysparams:write';
-/** The templates `hawk-app create` offers (the keys of create.mjs's TEMPLATES): `"template"` in hawk-app.json. */
-export const TEMPLATE_NAMES = ['react', 'preact', 'next', 'next-mui', 'vanilla'];
-export const LAMBDAS_SCOPE = 'lambdas:invoke';
-// Same rules as the platform: Lambda function names, at most 10.
-const LAMBDA_NAME = /^[A-Za-z0-9_-]{1,64}$/;
-const MAX_LAMBDAS = 10;
-// Same rules as the platform: HawkSearch system parameter names the app may read and set.
-const SYSPARAM_NAME = /^[A-Za-z0-9_.-]{1,50}$/;
-const MAX_SYSPARAMS = 50;
-// Same rules as the platform: schedules run job functions, at most hourly (EventBridge Scheduler cron).
-export const MAX_SCHEDULES = 5;
-const CRON_MINUTES = /^([0-9]|[1-5][0-9])$/;
-const CRON_FIELD = /^[0-9A-Za-z*?,/#-]{1,40}$/;
-const TIMEZONE = /^(UTC|[A-Za-z0-9_+-]+(\/[A-Za-z0-9_+-]+)+)$/;
-// Same message as the platform: the registry is the only source of truth for which clients have the app.
-export const CLIENTS_NOT_IN_MANIFEST =
-    'clients and excludeClients are no longer set in hawk-app.json: manage clients in the Hawk Analytics portal or with `hawk-app clients`.';
-const STATUS_IGNORED = 'status is ignored: an approver releases versions from the Apps page in HawkSearch.';
-
-export async function loadManifest(file = MANIFEST_FILE) {
-    let text;
-    try {
-        text = await readFile(file, 'utf8');
-    } catch {
-        throw new Error(`Cannot read ${file}. Run \`hawk-app init\` to create one.`);
-    }
-    try {
-        return JSON.parse(text);
-    } catch (error) {
-        throw new Error(`${file} is not valid JSON: ${error.message}`);
-    }
-}
-
-/**
- * Local checks so mistakes show up before anything is sent. The platform validates again on
- * `hawk-app register` (`hawk-app register --dry-run` shows its verdict without changing anything).
- * @returns {{ errors: string[], warnings: string[] }}
- */
-// Same rules as the platform (ExternalOrigins.cs): https or wss, optional "*." subdomain wildcard, optional port, no path.
-const ORIGIN = /^(https|wss):\/\/(\*\.)?([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)*[a-z0-9]([a-z0-9-]*[a-z0-9])?(:[0-9]{1,5})?$/;
-const MAX_ORIGINS = 20;
-
-// Same rules as the platform (AppViewRules): views are pages of the app's build that hosts show inside other pages.
-const VIEW_NAME = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-const VIEW_PATH = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*\/?$/;
-const VIEW_PARAM = /^[a-z][A-Za-z0-9]{0,39}$/;
-const VIEW_KEYS = ['path', 'title', 'height', 'embeddable', 'params', 'cacheMinutes', 'trial'];
-// Same as the platform (AppStoreRules.TrialScopes): what a store trial's token may have, at most.
-export const TRIAL_SCOPES = ['reports:read', 'hawksearch:read', 'hawksearch:search', 'hawksearch:recommendations', 'data:read'];
-
-function validateViews(m) {
-    const errors = [];
-    const views = m.views;
-    if (views === undefined || views === null) return errors;
-    if (typeof views !== 'object' || Array.isArray(views)) {
-        return ['views must be an object: { "preview": { "path": "views/preview", "title": "…" } }.'];
-    }
-    const names = Object.keys(views);
-    if (names.length > 10) errors.push('views: at most 10 views.');
-    for (const name of names) {
-        const where = `views.${name}`;
-        const view = views[name];
-        if (!VIEW_NAME.test(name) || name.length > 40) {
-            errors.push(`views: "${name}" must be lowercase letters, digits and single dashes (at most 40).`);
-            continue;
-        }
-        if (!view || typeof view !== 'object' || Array.isArray(view)) {
-            errors.push(`${where} must be an object.`);
-            continue;
-        }
-        const unknown = Object.keys(view).filter((k) => !VIEW_KEYS.includes(k));
-        if (unknown.length) errors.push(`${where}: unknown setting${unknown.length === 1 ? '' : 's'} ${unknown.map((k) => `"${k}"`).join(', ')} (allowed: ${VIEW_KEYS.join(', ')}).`);
-        if (typeof view.path !== 'string' || view.path.length > 200 || !VIEW_PATH.test(view.path) || view.path.split('/').some((s) => s === '.' || s === '..')) {
-            errors.push(`${where}.path must be a page of the app's build, like "views/${name}" (letters, digits, . _ - and /; no leading /).`);
-        }
-        if (typeof view.title !== 'string' || !view.title.trim() || view.title.length > 80) errors.push(`${where}.title is required, at most 80 characters.`);
-        if (view.height !== undefined && !(Number.isInteger(view.height) && view.height >= 80 && view.height <= 1200)) {
-            errors.push(`${where}.height must be a whole number of pixels from 80 to 1200 (default 300).`);
-        }
-        if (view.embeddable !== undefined && typeof view.embeddable !== 'boolean') errors.push(`${where}.embeddable must be true or false.`);
-        if (view.cacheMinutes !== undefined && !(Number.isInteger(view.cacheMinutes) && view.cacheMinutes >= 0 && view.cacheMinutes <= 1440)) {
-            errors.push(`${where}.cacheMinutes must be a whole number of minutes from 0 (not cached) to 1440.`);
-        }
-        if (view.params !== undefined) {
-            if (!Array.isArray(view.params) || view.params.some((p) => typeof p !== 'string')) {
-                errors.push(`${where}.params must be a list of names, e.g. ["sku"].`);
-            } else {
-                const bad = view.params.filter((p) => !VIEW_PARAM.test(p));
-                if (bad.length) errors.push(`${where}.params: ${bad.map((p) => `"${p}"`).join(', ')} must be camelCase names.`);
-                if (new Set(view.params).size !== view.params.length) errors.push(`${where}.params lists a name more than once.`);
-                if (view.params.length > 10) errors.push(`${where}.params: at most 10.`);
-            }
-        }
-        if (view.trial !== undefined && typeof view.trial !== 'boolean') errors.push(`${where}.trial must be true or false.`);
-        if (view.trial === true && Array.isArray(view.params) && view.params.length) errors.push(`${where}: a trial view takes no params (the store card has none to pass).`);
-    }
-    if (names.filter((name) => views[name]?.trial === true).length > 1) errors.push('views: only one view can be the trial view ("trial": true).');
-    return errors;
-}
-
-/** The trial view's warnings: only store apps show it, and its token lacks the app's other scopes. */
-function trialWarnings(m) {
-    const views = m.views && typeof m.views === 'object' && !Array.isArray(m.views) ? m.views : {};
-    const trial = Object.keys(views).find((name) => views[name]?.trial === true);
-    if (!trial) return [];
-    if (m.visibility !== 'store') return [`views.${trial} is a trial view, but only store apps (visibility "store") show one.`];
-    const missing = (Array.isArray(m.scopes) ? m.scopes : []).filter((s) => !TRIAL_SCOPES.includes(s));
-    return missing.length
-        ? [`views.${trial}: a trial's token is read-only, without ${missing.join(', ')}. Hide what needs them while app.context.trial is true.`]
-        : [];
-}
-
-// Same rules as the platform: app config, named non-secret values set outside the manifest (portal or `hawk-app config`).
-export const CONFIG_KEY = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
-export const CONFIG_TYPES = ['string', 'number', 'boolean', 'emails', 'json'];
-const CONFIG_FIELDS = ['type', 'label', 'description', 'default'];
-const MAX_CONFIG_KEYS = 50;
-const MAX_CONFIG_STRING = 4000;
-const MAX_CONFIG_EMAILS = 50;
-export const MAX_CONFIG_VALUE_BYTES = 16 * 1024;
-// Same rule as `POST /v1/email` `to` (the platform's EmailRules.IsValidAddress): ASCII local@domain.tld, no display
-// names, no whitespace, local part at most 64 characters, at most 254 in all.
-const EMAIL_ADDRESS = /^[A-Za-z0-9!#$%&'*+/=?^_`{|}~-]+(\.[A-Za-z0-9!#$%&'*+/=?^_`{|}~-]+)*@([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$/;
-
-export function isEmailAddress(address) {
-    if (typeof address !== 'string' || !address || address.length > 254) return false;
-    const at = address.indexOf('@');
-    return at > 0 && at <= 64 && EMAIL_ADDRESS.test(address);
-}
-
-/**
- * Why `value` isn't a valid value of a config `type`, as an error starting with `field` (e.g. "signupNotifyEmails must
- * be a list of email addresses."), or null when it is. The same rules and messages as the platform (AppConfigRules):
- * they apply to `default` and to every value set later.
- */
-export function configValueError(type, value, field) {
-    if (value !== undefined && Buffer.byteLength(JSON.stringify(value) ?? '', 'utf8') > MAX_CONFIG_VALUE_BYTES) {
-        return `${field} is larger than ${MAX_CONFIG_VALUE_BYTES / 1024} KB.`;
-    }
-    switch (type) {
-        case 'string':
-            return typeof value === 'string' && value.length <= MAX_CONFIG_STRING ? null : `${field} must be a string of up to ${MAX_CONFIG_STRING} characters.`;
-        case 'number':
-            return typeof value === 'number' && Number.isFinite(value) ? null : `${field} must be a number.`;
-        case 'boolean':
-            return typeof value === 'boolean' ? null : `${field} must be true or false.`;
-        case 'emails':
-            if (!Array.isArray(value) || !value.every(isEmailAddress)) return `${field} must be a list of email addresses.`;
-            if (value.length > MAX_CONFIG_EMAILS) return `${field} must be a list of at most ${MAX_CONFIG_EMAILS} email addresses.`;
-            return new Set(value.map((a) => a.toLowerCase())).size !== value.length ? `${field} lists the same email address more than once.` : null;
-        case 'json':
-            return value === null || value === undefined ? `${field} must be a JSON value (not null).` : null;
-        default:
-            return `${field} has an unknown type.`;
-    }
-}
-
-/**
- * "config": { "<key>": { "type", "label"?, "description"?, "default"? } }, at most 50 keys. The same checks and messages
- * as the platform (AppConfigRules.ParseManifest): an entry with unknown fields is reported for those only, and its
- * default is checked only when the rest of the entry is valid.
- */
-export function validateConfig(m) {
-    const errors = [];
-    const config = m.config;
-    if (config === undefined || config === null) return errors;
-    if (typeof config !== 'object' || Array.isArray(config)) return ['config must be an object: { "<key>": { "type": "string" } }.'];
-    const keys = Object.keys(config);
-    if (keys.length > MAX_CONFIG_KEYS) errors.push(`config can declare at most ${MAX_CONFIG_KEYS} keys.`);
-    for (const key of keys) {
-        const field = `config.${key}`;
-        if (!CONFIG_KEY.test(key)) {
-            errors.push(`config: "${key}" must start with a letter, then letters, digits and underscores (at most 64).`);
-            continue;
-        }
-        const entry = config[key];
-        if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
-            errors.push(`${field} must be an object: { "type": "string" }.`);
-            continue;
-        }
-        const unknown = Object.keys(entry).filter((k) => !CONFIG_FIELDS.includes(k));
-        if (unknown.length) {
-            errors.push(`${field}: unknown setting${unknown.length === 1 ? '' : 's'} ${unknown.map((k) => `"${k}"`).join(', ')} (allowed: ${CONFIG_FIELDS.join(', ')}).`);
-            continue;
-        }
-        const before = errors.length;
-        if (!CONFIG_TYPES.includes(entry.type)) errors.push(`${field}.type is required: one of ${CONFIG_TYPES.join(', ')}.`);
-        if (entry.label !== undefined && (typeof entry.label !== 'string' || !entry.label.trim() || entry.label.trim().length > 100)) {
-            errors.push(`${field}.label must be a string of 1 to 100 characters.`);
-        }
-        if (entry.description !== undefined && (typeof entry.description !== 'string' || entry.description.trim().length > 500)) {
-            errors.push(`${field}.description must be a string of up to 500 characters.`);
-        }
-        if (Object.hasOwn(entry, 'default') && errors.length === before) {
-            const problem = configValueError(entry.type, entry.default, `${field}.default`);
-            if (problem) errors.push(problem);
-        }
-    }
-    return errors;
-}
-
-export function validateManifest(manifest) {
-    const errors = [];
-    const warnings = [];
-    const m = manifest ?? {};
-
-    if (typeof m.slug !== 'string' || !SLUG.test(m.slug) || m.slug.length > 64) {
-        errors.push('slug must be 1-64 lowercase letters, digits and single dashes (e.g. "keyword-explorer").');
-    }
-    if (typeof m.name !== 'string' || !m.name.trim() || m.name.length > 100) {
-        errors.push('name is required (up to 100 characters).');
-    }
-    if (!VISIBILITIES.includes(m.visibility)) {
-        errors.push(`visibility must be one of: ${VISIBILITIES.join(', ')}.`);
-    }
-
-    if (m.clients !== undefined || m.excludeClients !== undefined) errors.push(CLIENTS_NOT_IN_MANIFEST);
-
-    // The file itself (there, type, size, square) is checked by validate and deploy (app-icon.mjs).
-    if (m.icon !== undefined && (typeof m.icon !== 'string' || !ICON_PATH.test(m.icon))) {
-        errors.push(`icon must be ${ICON_PATH_HINT}, not ${JSON.stringify(m.icon)} (icon names from HawkSearch's set are no longer used).`);
-    }
-
-    if (m.listed !== undefined && typeof m.listed !== 'boolean') {
-        errors.push('listed must be true or false.');
-    }
-
-    if (m.hosting !== undefined && m.hosting !== 'static') {
-        errors.push(
-            m.hosting === 'server'
-                ? 'hosting "server" (server-rendered apps) is not available yet. Use "static": build to static files and deploy them with hawk-app deploy.'
-                : `hosting must be "static" (or "server" once server-rendered apps are supported), not "${m.hosting}".`,
-        );
-    }
-
-    if (m.externalOrigins !== undefined) {
-        const origins = m.externalOrigins;
-        if (!Array.isArray(origins) || origins.some((o) => typeof o !== 'string')) {
-            errors.push('externalOrigins must be a list, e.g. ["*"] or ["https://api.example.com"].');
-        } else if (origins.includes('*') && origins.length > 1) {
-            errors.push('externalOrigins: "*" already allows every origin, so list it on its own.');
-        } else {
-            const norm = (o) => o.trim().replace(/\/$/, '').toLowerCase();
-            const isImage = (o) => norm(o).startsWith('img:');
-            const bad = origins.filter((o) => o !== '*' && !isImage(o) && !ORIGIN.test(norm(o)));
-            const badImages = origins.filter((o) => isImage(o) && norm(o) !== 'img:*' && !(norm(o).startsWith('img:https://') && ORIGIN.test(norm(o).slice(4))));
-            if (badImages.length) {
-                errors.push(`externalOrigins: ${badImages.map((o) => `"${o}"`).join(', ')} must be image origins like img:https://cdn.example.com, or img:* for images from any https origin.`);
-            }
-            if (origins.map(norm).includes('img:*') && origins.filter(isImage).length > 1) {
-                errors.push('externalOrigins: "img:*" already allows images from every https origin, so drop the other img: entries.');
-            }
-            if (bad.length) {
-                errors.push(`externalOrigins: ${bad.map((o) => `"${o}"`).join(', ')} must be origins like https://api.example.com or https://*.example.com (https or wss, no path).`);
-            }
-            if (origins.length > MAX_ORIGINS) errors.push(`externalOrigins: at most ${MAX_ORIGINS} origins (or "*" for any).`);
-        }
-    }
-
-    errors.push(...validateFunctionsManifest(m));
-    errors.push(...validateSystemParameters(m));
-    errors.push(...validateLambdas(m));
-    if (m.template !== undefined && !TEMPLATE_NAMES.includes(m.template)) {
-        errors.push(`template must be one of ${TEMPLATE_NAMES.join(', ')} (the template the app was created from; \`hawk-app upgrade\` uses it).`);
-    }
-    errors.push(...validateSchedules(m));
-    errors.push(...validateViews(m));
-    errors.push(...validateConfig(m));
-    const store = validateStore(m);
-    errors.push(...store.errors);
-    warnings.push(...store.warnings);
-    warnings.push(...trialWarnings(m));
-
-    const unknownScopes = (m.scopes ?? []).filter((s) => !SCOPES.includes(s));
-    if (unknownScopes.length) warnings.push(`These scopes are not available and will not be granted: ${unknownScopes.join(', ')}.`);
-    // Status is host-controlled now: approvers release versions in HawkSearch.
-    if (m.status !== undefined) warnings.push(STATUS_IGNORED);
-
-    return { errors, warnings };
-}
-
-/**
- * "lambdas": Lambdas outside Hawk Apps the app calls (scope lambdas:invoke). A list of up to 10 unique Lambda function
- * names; the list needs the scope and the scope needs a non-empty list. Whether a platform allows a name is only known
- * when the app calls it.
- */
-export function validateLambdas(m) {
-    const errors = [];
-    const hasScope = Array.isArray(m.scopes) && m.scopes.includes(LAMBDAS_SCOPE);
-    const list = m.lambdas;
-    if (list === undefined) {
-        if (hasScope) errors.push(`The "${LAMBDAS_SCOPE}" scope needs "lambdas": the Lambdas the app calls, e.g. ["analytics-client-setup"].`);
-        return errors;
-    }
-    if (!Array.isArray(list) || list.some((name) => typeof name !== 'string')) {
-        errors.push('lambdas must be a list of Lambda function names, e.g. ["analytics-client-setup"].');
-        return errors;
-    }
-    const bad = list.filter((name) => !LAMBDA_NAME.test(name));
-    if (bad.length) errors.push(`lambdas: ${bad.map((name) => JSON.stringify(name)).join(', ')} must be a Lambda function name: 1-64 letters, digits, "-" or "_".`);
-    const duplicates = [...new Set(list.filter((name, i) => list.indexOf(name) !== i))];
-    if (duplicates.length) errors.push(`lambdas lists ${duplicates.join(', ')} more than once.`);
-    if (list.length > MAX_LAMBDAS) errors.push(`lambdas: at most ${MAX_LAMBDAS} names (found ${list.length}).`);
-    if (list.length && !hasScope) errors.push(`lambdas need the "${LAMBDAS_SCOPE}" scope: add it to "scopes" in hawk-app.json.`);
-    if (!list.length && hasScope) errors.push(`The "${LAMBDAS_SCOPE}" scope needs at least one name in "lambdas".`);
-    return errors;
-}
-
-/**
- * "systemParameters": the HawkSearch system parameters the app may set (scope hawksearch:sysparams:write). A list of
- * up to 50 unique names (case-insensitive); the list needs the scope and the scope needs a non-empty list.
- */
-export function validateSystemParameters(m) {
-    const errors = [];
-    const hasScope = Array.isArray(m.scopes) && m.scopes.includes(SYSPARAMS_SCOPE);
-    const list = m.systemParameters;
-    if (list === undefined) {
-        if (hasScope) errors.push(`The "${SYSPARAMS_SCOPE}" scope needs "systemParameters": the system parameters the app may set, e.g. ["Timezone"].`);
-        return errors;
-    }
-    if (!Array.isArray(list) || list.some((name) => typeof name !== 'string')) {
-        errors.push('systemParameters must be a list of HawkSearch system parameter names, e.g. ["Timezone", "SearchPreviewURL"].');
-        return errors;
-    }
-    const bad = list.filter((name) => !SYSPARAM_NAME.test(name));
-    if (bad.length) {
-        errors.push(`systemParameters: ${bad.map((name) => JSON.stringify(name)).join(', ')} must be 1-50 letters, digits, "_", "." or "-".`);
-    }
-    const lower = list.map((name) => name.toLowerCase());
-    const duplicates = [...new Set(list.filter((name, i) => lower.indexOf(name.toLowerCase()) !== i))];
-    if (duplicates.length) errors.push(`systemParameters lists ${duplicates.join(', ')} more than once (names are not case-sensitive).`);
-    if (list.length > MAX_SYSPARAMS) errors.push(`systemParameters: at most ${MAX_SYSPARAMS} names (found ${list.length}).`);
-    if (list.length && !hasScope) errors.push(`systemParameters need the "${SYSPARAMS_SCOPE}" scope: add it to "scopes" in hawk-app.json.`);
-    if (!list.length && hasScope) errors.push(`The "${SYSPARAMS_SCOPE}" scope needs at least one name in "systemParameters".`);
-    return errors;
-}
-
-/**
- * "schedules": recurring runs of the app's job functions, { "<name>": { "function", "cron", "timezone"? } }. Up to 5;
- * each runs a function of this manifest with "job": true, on a 6-field EventBridge cron
- * ("minutes hours day-of-month month day-of-week year") at most hourly: the minutes field is a single number.
- */
-export function validateSchedules(m) {
-    const errors = [];
-    const schedules = m.schedules;
-    if (schedules === undefined) return errors;
-    if (!schedules || typeof schedules !== 'object' || Array.isArray(schedules)) {
-        errors.push('schedules must be an object: { "<name>": { "function": "<job function>", "cron": "0 7 ? * MON *" } }.');
-        return errors;
-    }
-    const names = Object.keys(schedules);
-    if (names.length > MAX_SCHEDULES) errors.push(`schedules: at most ${MAX_SCHEDULES} schedules per app (found ${names.length}).`);
-    const functions = m.functions && typeof m.functions === 'object' && !Array.isArray(m.functions) ? m.functions : {};
-    for (const name of names) {
-        const where = `schedules.${name}`;
-        if (!FUNCTION_NAME.test(name) || name.length > MAX_NAME_LENGTH) {
-            errors.push(`${where}: schedule names must be 1-${MAX_NAME_LENGTH} lowercase letters, digits and single dashes (e.g. "nightly").`);
-        }
-        const schedule = schedules[name];
-        if (!schedule || typeof schedule !== 'object' || Array.isArray(schedule)) {
-            errors.push(`${where} must be an object, e.g. { "function": "nightly-report", "cron": "0 7 ? * MON *", "timezone": "America/Chicago" }.`);
-            continue;
-        }
-        const unknown = Object.keys(schedule).filter((key) => !['function', 'cron', 'timezone'].includes(key));
-        if (unknown.length) errors.push(`${where}: unknown setting${unknown.length === 1 ? '' : 's'} ${unknown.map((k) => `"${k}"`).join(', ')} (allowed: function, cron, timezone).`);
-        if (typeof schedule.function !== 'string' || !schedule.function) {
-            errors.push(`${where}.function is required: the name of a job function under "functions".`);
-        } else if (!Object.hasOwn(functions, schedule.function)) {
-            errors.push(`${where}.function: "${schedule.function}" is not declared under "functions".`);
-        } else if (functions[schedule.function]?.job !== true) {
-            errors.push(`${where}.function: "${schedule.function}" must be a job function: set "job": true on it.`);
-        }
-        if (typeof schedule.cron !== 'string') {
-            errors.push(`${where}.cron is required: an EventBridge cron like "0 7 ? * MON *" (minutes hours day-of-month month day-of-week year).`);
-        } else {
-            const fields = schedule.cron.trim().split(/\s+/);
-            if (/^cron\(/i.test(schedule.cron.trim())) {
-                errors.push(`${where}.cron: leave out the cron( ) wrapper, e.g. "0 7 ? * MON *".`);
-            } else if (fields.length !== 6) {
-                errors.push(`${where}.cron must have 6 fields: minutes hours day-of-month month day-of-week year, e.g. "0 7 ? * MON *" (found ${fields.length}).`);
-            } else if (fields.some((field) => !CRON_FIELD.test(field))) {
-                errors.push(`${where}.cron: each field may only use digits, letters and * ? , / # - (found "${schedule.cron}").`);
-            } else if (!CRON_MINUTES.test(fields[0])) {
-                errors.push(`${where}.cron: schedules run at most hourly, so the minutes field must be a single number from 0 to 59 (found "${fields[0]}").`);
-            } else if (fields[2] !== '?' && fields[4] !== '?') {
-                errors.push(`${where}.cron: day-of-month or day-of-week must be "?" (EventBridge needs one of them), e.g. "0 7 ? * MON *" or "0 7 1 * ? *".`);
-            }
-        }
-        if (schedule.timezone !== undefined && (typeof schedule.timezone !== 'string' || !TIMEZONE.test(schedule.timezone))) {
-            errors.push(`${where}.timezone must be an IANA time zone such as "America/Chicago", or "UTC" (the default).`);
-        }
-    }
-    if (names.length && !(m.scopes ?? []).includes(FUNCTIONS_SCOPE)) {
-        errors.push(`schedules need the "${FUNCTIONS_SCOPE}" scope: add it to "scopes" in hawk-app.json.`);
-    }
-    return errors;
-}
-
-export function newManifest({ slug, name, template }) {
-    return {
-        $schema: './node_modules/@bridgeline-digital/hawk-app-cli/schema/hawk-app.schema.json',
-        slug,
-        // The template it came from: `hawk-app upgrade` keeps the app in step with it.
-        ...(template ? { template } : {}),
-        name,
-        description: '',
-        // An .svg (drawn in the host's color) or .png file next to this one; create and init add a default icon.svg.
-        icon: 'icon.svg',
-        visibility: 'allowList',
-        scopes: ['reports:read'],
-        // Outside origins the app may load scripts, styles and images from and call (e.g. "https://api.example.com",
-        // or "img:*" for images from anywhere). The vanilla template loads the bridge from jsDelivr.
-        externalOrigins: template === 'vanilla' ? ['https://cdn.jsdelivr.net'] : [],
-    };
-}
+import { readFile } from 'node:fs/promises';
+import { FUNCTION_NAME, FUNCTIONS_SCOPE, MAX_NAME_LENGTH, validateFunctionsManifest } from './functions.mjs';
+import { ICON_PATH, ICON_PATH_HINT } from './app-icon.mjs';
+import { validateStore } from './store-listing.mjs';
+
+export const MANIFEST_FILE = 'hawk-app.json';
+const SLUG = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const VISIBILITIES = ['allowList', 'all', 'internal', 'store'];
+const SCOPES = ['reports:read', 'hawksearch:read', 'hawksearch:write', 'data:read', 'functions:invoke', 'email:send', 'hawksearch:sysparams:write', 'hawksearch:search', 'ai:invoke', 'lambdas:invoke', 'hawksearch:features:write', 'hawksearch:index', 'hawksearch:index:items', 'hawksearch:index:manage', 'hawksearch:recommendations', 'storage', 'assistant'];
+export const SYSPARAMS_SCOPE = 'hawksearch:sysparams:write';
+/** The templates `hawk-app create` offers (the keys of create.mjs's TEMPLATES): `"template"` in hawk-app.json. */
+export const TEMPLATE_NAMES = ['react', 'preact', 'next', 'next-mui', 'vanilla'];
+export const LAMBDAS_SCOPE = 'lambdas:invoke';
+// Same rules as the platform: Lambda function names, at most 10.
+const LAMBDA_NAME = /^[A-Za-z0-9_-]{1,64}$/;
+const MAX_LAMBDAS = 10;
+// Same rules as the platform: HawkSearch system parameter names the app may read and set.
+const SYSPARAM_NAME = /^[A-Za-z0-9_.-]{1,50}$/;
+const MAX_SYSPARAMS = 50;
+// Same rules as the platform: schedules run job functions, at most hourly (EventBridge Scheduler cron).
+export const MAX_SCHEDULES = 5;
+const CRON_MINUTES = /^([0-9]|[1-5][0-9])$/;
+const CRON_FIELD = /^[0-9A-Za-z*?,/#-]{1,40}$/;
+const TIMEZONE = /^(UTC|[A-Za-z0-9_+-]+(\/[A-Za-z0-9_+-]+)+)$/;
+// Same message as the platform: the registry is the only source of truth for which clients have the app.
+export const CLIENTS_NOT_IN_MANIFEST =
+    'clients and excludeClients are no longer set in hawk-app.json: manage clients in the Hawk Analytics portal or with `hawk-app clients`.';
+const STATUS_IGNORED = 'status is ignored: an approver releases versions from the Apps page in HawkSearch.';
+
+export async function loadManifest(file = MANIFEST_FILE) {
+    let text;
+    try {
+        text = await readFile(file, 'utf8');
+    } catch {
+        throw new Error(`Cannot read ${file}. Run \`hawk-app init\` to create one.`);
+    }
+    try {
+        return JSON.parse(text);
+    } catch (error) {
+        throw new Error(`${file} is not valid JSON: ${error.message}`);
+    }
+}
+
+/**
+ * Local checks so mistakes show up before anything is sent. The platform validates again on
+ * `hawk-app register` (`hawk-app register --dry-run` shows its verdict without changing anything).
+ * @returns {{ errors: string[], warnings: string[] }}
+ */
+// Same rules as the platform (ExternalOrigins.cs): https or wss, optional "*." subdomain wildcard, optional port, no path.
+const ORIGIN = /^(https|wss):\/\/(\*\.)?([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)*[a-z0-9]([a-z0-9-]*[a-z0-9])?(:[0-9]{1,5})?$/;
+const MAX_ORIGINS = 20;
+
+// Same rules as the platform (AppViewRules): views are pages of the app's build that hosts show inside other pages.
+const VIEW_NAME = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const VIEW_PATH = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*\/?$/;
+const VIEW_PARAM = /^[a-z][A-Za-z0-9]{0,39}$/;
+const VIEW_KEYS = ['path', 'title', 'height', 'embeddable', 'params', 'cacheMinutes', 'trial'];
+// Same as the platform (AppStoreRules.TrialScopes): what a store trial's token may have, at most.
+export const TRIAL_SCOPES = ['reports:read', 'hawksearch:read', 'hawksearch:search', 'hawksearch:recommendations', 'data:read'];
+
+function validateViews(m) {
+    const errors = [];
+    const views = m.views;
+    if (views === undefined || views === null) return errors;
+    if (typeof views !== 'object' || Array.isArray(views)) {
+        return ['views must be an object: { "preview": { "path": "views/preview", "title": "…" } }.'];
+    }
+    const names = Object.keys(views);
+    if (names.length > 10) errors.push('views: at most 10 views.');
+    for (const name of names) {
+        const where = `views.${name}`;
+        const view = views[name];
+        if (!VIEW_NAME.test(name) || name.length > 40) {
+            errors.push(`views: "${name}" must be lowercase letters, digits and single dashes (at most 40).`);
+            continue;
+        }
+        if (!view || typeof view !== 'object' || Array.isArray(view)) {
+            errors.push(`${where} must be an object.`);
+            continue;
+        }
+        const unknown = Object.keys(view).filter((k) => !VIEW_KEYS.includes(k));
+        if (unknown.length) errors.push(`${where}: unknown setting${unknown.length === 1 ? '' : 's'} ${unknown.map((k) => `"${k}"`).join(', ')} (allowed: ${VIEW_KEYS.join(', ')}).`);
+        if (typeof view.path !== 'string' || view.path.length > 200 || !VIEW_PATH.test(view.path) || view.path.split('/').some((s) => s === '.' || s === '..')) {
+            errors.push(`${where}.path must be a page of the app's build, like "views/${name}" (letters, digits, . _ - and /; no leading /).`);
+        }
+        if (typeof view.title !== 'string' || !view.title.trim() || view.title.length > 80) errors.push(`${where}.title is required, at most 80 characters.`);
+        if (view.height !== undefined && !(Number.isInteger(view.height) && view.height >= 80 && view.height <= 1200)) {
+            errors.push(`${where}.height must be a whole number of pixels from 80 to 1200 (default 300).`);
+        }
+        if (view.embeddable !== undefined && typeof view.embeddable !== 'boolean') errors.push(`${where}.embeddable must be true or false.`);
+        if (view.cacheMinutes !== undefined && !(Number.isInteger(view.cacheMinutes) && view.cacheMinutes >= 0 && view.cacheMinutes <= 1440)) {
+            errors.push(`${where}.cacheMinutes must be a whole number of minutes from 0 (not cached) to 1440.`);
+        }
+        if (view.params !== undefined) {
+            if (!Array.isArray(view.params) || view.params.some((p) => typeof p !== 'string')) {
+                errors.push(`${where}.params must be a list of names, e.g. ["sku"].`);
+            } else {
+                const bad = view.params.filter((p) => !VIEW_PARAM.test(p));
+                if (bad.length) errors.push(`${where}.params: ${bad.map((p) => `"${p}"`).join(', ')} must be camelCase names.`);
+                if (new Set(view.params).size !== view.params.length) errors.push(`${where}.params lists a name more than once.`);
+                if (view.params.length > 10) errors.push(`${where}.params: at most 10.`);
+            }
+        }
+        if (view.trial !== undefined && typeof view.trial !== 'boolean') errors.push(`${where}.trial must be true or false.`);
+        if (view.trial === true && Array.isArray(view.params) && view.params.length) errors.push(`${where}: a trial view takes no params (the store card has none to pass).`);
+    }
+    if (names.filter((name) => views[name]?.trial === true).length > 1) errors.push('views: only one view can be the trial view ("trial": true).');
+    return errors;
+}
+
+/** The trial view's warnings: only store apps show it, and its token lacks the app's other scopes. */
+function trialWarnings(m) {
+    const views = m.views && typeof m.views === 'object' && !Array.isArray(m.views) ? m.views : {};
+    const trial = Object.keys(views).find((name) => views[name]?.trial === true);
+    if (!trial) return [];
+    if (m.visibility !== 'store') return [`views.${trial} is a trial view, but only store apps (visibility "store") show one.`];
+    const missing = (Array.isArray(m.scopes) ? m.scopes : []).filter((s) => !TRIAL_SCOPES.includes(s));
+    return missing.length
+        ? [`views.${trial}: a trial's token is read-only, without ${missing.join(', ')}. Hide what needs them while app.context.trial is true.`]
+        : [];
+}
+
+// Same rules as the platform: app config, named non-secret values set outside the manifest (portal or `hawk-app config`).
+export const CONFIG_KEY = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+export const CONFIG_TYPES = ['string', 'number', 'boolean', 'emails', 'json'];
+const CONFIG_FIELDS = ['type', 'label', 'description', 'default'];
+const MAX_CONFIG_KEYS = 50;
+const MAX_CONFIG_STRING = 4000;
+const MAX_CONFIG_EMAILS = 50;
+export const MAX_CONFIG_VALUE_BYTES = 16 * 1024;
+// Same rule as `POST /v1/email` `to` (the platform's EmailRules.IsValidAddress): ASCII local@domain.tld, no display
+// names, no whitespace, local part at most 64 characters, at most 254 in all.
+const EMAIL_ADDRESS = /^[A-Za-z0-9!#$%&'*+/=?^_`{|}~-]+(\.[A-Za-z0-9!#$%&'*+/=?^_`{|}~-]+)*@([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$/;
+
+export function isEmailAddress(address) {
+    if (typeof address !== 'string' || !address || address.length > 254) return false;
+    const at = address.indexOf('@');
+    return at > 0 && at <= 64 && EMAIL_ADDRESS.test(address);
+}
+
+/**
+ * Why `value` isn't a valid value of a config `type`, as an error starting with `field` (e.g. "signupNotifyEmails must
+ * be a list of email addresses."), or null when it is. The same rules and messages as the platform (AppConfigRules):
+ * they apply to `default` and to every value set later.
+ */
+export function configValueError(type, value, field) {
+    if (value !== undefined && Buffer.byteLength(JSON.stringify(value) ?? '', 'utf8') > MAX_CONFIG_VALUE_BYTES) {
+        return `${field} is larger than ${MAX_CONFIG_VALUE_BYTES / 1024} KB.`;
+    }
+    switch (type) {
+        case 'string':
+            return typeof value === 'string' && value.length <= MAX_CONFIG_STRING ? null : `${field} must be a string of up to ${MAX_CONFIG_STRING} characters.`;
+        case 'number':
+            return typeof value === 'number' && Number.isFinite(value) ? null : `${field} must be a number.`;
+        case 'boolean':
+            return typeof value === 'boolean' ? null : `${field} must be true or false.`;
+        case 'emails':
+            if (!Array.isArray(value) || !value.every(isEmailAddress)) return `${field} must be a list of email addresses.`;
+            if (value.length > MAX_CONFIG_EMAILS) return `${field} must be a list of at most ${MAX_CONFIG_EMAILS} email addresses.`;
+            return new Set(value.map((a) => a.toLowerCase())).size !== value.length ? `${field} lists the same email address more than once.` : null;
+        case 'json':
+            return value === null || value === undefined ? `${field} must be a JSON value (not null).` : null;
+        default:
+            return `${field} has an unknown type.`;
+    }
+}
+
+/**
+ * "config": { "<key>": { "type", "label"?, "description"?, "default"? } }, at most 50 keys. The same checks and messages
+ * as the platform (AppConfigRules.ParseManifest): an entry with unknown fields is reported for those only, and its
+ * default is checked only when the rest of the entry is valid.
+ */
+export function validateConfig(m) {
+    const errors = [];
+    const config = m.config;
+    if (config === undefined || config === null) return errors;
+    if (typeof config !== 'object' || Array.isArray(config)) return ['config must be an object: { "<key>": { "type": "string" } }.'];
+    const keys = Object.keys(config);
+    if (keys.length > MAX_CONFIG_KEYS) errors.push(`config can declare at most ${MAX_CONFIG_KEYS} keys.`);
+    for (const key of keys) {
+        const field = `config.${key}`;
+        if (!CONFIG_KEY.test(key)) {
+            errors.push(`config: "${key}" must start with a letter, then letters, digits and underscores (at most 64).`);
+            continue;
+        }
+        const entry = config[key];
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+            errors.push(`${field} must be an object: { "type": "string" }.`);
+            continue;
+        }
+        const unknown = Object.keys(entry).filter((k) => !CONFIG_FIELDS.includes(k));
+        if (unknown.length) {
+            errors.push(`${field}: unknown setting${unknown.length === 1 ? '' : 's'} ${unknown.map((k) => `"${k}"`).join(', ')} (allowed: ${CONFIG_FIELDS.join(', ')}).`);
+            continue;
+        }
+        const before = errors.length;
+        if (!CONFIG_TYPES.includes(entry.type)) errors.push(`${field}.type is required: one of ${CONFIG_TYPES.join(', ')}.`);
+        if (entry.label !== undefined && (typeof entry.label !== 'string' || !entry.label.trim() || entry.label.trim().length > 100)) {
+            errors.push(`${field}.label must be a string of 1 to 100 characters.`);
+        }
+        if (entry.description !== undefined && (typeof entry.description !== 'string' || entry.description.trim().length > 500)) {
+            errors.push(`${field}.description must be a string of up to 500 characters.`);
+        }
+        if (Object.hasOwn(entry, 'default') && errors.length === before) {
+            const problem = configValueError(entry.type, entry.default, `${field}.default`);
+            if (problem) errors.push(problem);
+        }
+    }
+    return errors;
+}
+
+export function validateManifest(manifest) {
+    const errors = [];
+    const warnings = [];
+    const m = manifest ?? {};
+
+    if (typeof m.slug !== 'string' || !SLUG.test(m.slug) || m.slug.length > 64) {
+        errors.push('slug must be 1-64 lowercase letters, digits and single dashes (e.g. "keyword-explorer").');
+    }
+    if (typeof m.name !== 'string' || !m.name.trim() || m.name.length > 100) {
+        errors.push('name is required (up to 100 characters).');
+    }
+    if (!VISIBILITIES.includes(m.visibility)) {
+        errors.push(`visibility must be one of: ${VISIBILITIES.join(', ')}.`);
+    }
+
+    if (m.clients !== undefined || m.excludeClients !== undefined) errors.push(CLIENTS_NOT_IN_MANIFEST);
+
+    // The file itself (there, type, size, square) is checked by validate and deploy (app-icon.mjs).
+    if (m.icon !== undefined && (typeof m.icon !== 'string' || !ICON_PATH.test(m.icon))) {
+        errors.push(`icon must be ${ICON_PATH_HINT}, not ${JSON.stringify(m.icon)} (icon names from HawkSearch's set are no longer used).`);
+    }
+
+    if (m.listed !== undefined && typeof m.listed !== 'boolean') {
+        errors.push('listed must be true or false.');
+    }
+
+    if (m.hosting !== undefined && m.hosting !== 'static') {
+        errors.push(
+            m.hosting === 'server'
+                ? 'hosting "server" (server-rendered apps) is not available yet. Use "static": build to static files and deploy them with hawk-app deploy.'
+                : `hosting must be "static" (or "server" once server-rendered apps are supported), not "${m.hosting}".`,
+        );
+    }
+
+    if (m.externalOrigins !== undefined) {
+        const origins = m.externalOrigins;
+        if (!Array.isArray(origins) || origins.some((o) => typeof o !== 'string')) {
+            errors.push('externalOrigins must be a list, e.g. ["*"] or ["https://api.example.com"].');
+        } else if (origins.includes('*') && origins.length > 1) {
+            errors.push('externalOrigins: "*" already allows every origin, so list it on its own.');
+        } else {
+            const norm = (o) => o.trim().replace(/\/$/, '').toLowerCase();
+            const isImage = (o) => norm(o).startsWith('img:');
+            const bad = origins.filter((o) => o !== '*' && !isImage(o) && !ORIGIN.test(norm(o)));
+            const badImages = origins.filter((o) => isImage(o) && norm(o) !== 'img:*' && !(norm(o).startsWith('img:https://') && ORIGIN.test(norm(o).slice(4))));
+            if (badImages.length) {
+                errors.push(`externalOrigins: ${badImages.map((o) => `"${o}"`).join(', ')} must be image origins like img:https://cdn.example.com, or img:* for images from any https origin.`);
+            }
+            if (origins.map(norm).includes('img:*') && origins.filter(isImage).length > 1) {
+                errors.push('externalOrigins: "img:*" already allows images from every https origin, so drop the other img: entries.');
+            }
+            if (bad.length) {
+                errors.push(`externalOrigins: ${bad.map((o) => `"${o}"`).join(', ')} must be origins like https://api.example.com or https://*.example.com (https or wss, no path).`);
+            }
+            if (origins.length > MAX_ORIGINS) errors.push(`externalOrigins: at most ${MAX_ORIGINS} origins (or "*" for any).`);
+        }
+    }
+
+    errors.push(...validateFunctionsManifest(m));
+    errors.push(...validateSystemParameters(m));
+    errors.push(...validateLambdas(m));
+    if (m.template !== undefined && !TEMPLATE_NAMES.includes(m.template)) {
+        errors.push(`template must be one of ${TEMPLATE_NAMES.join(', ')} (the template the app was created from; \`hawk-app upgrade\` uses it).`);
+    }
+    errors.push(...validateSchedules(m));
+    errors.push(...validateViews(m));
+    errors.push(...validateConfig(m));
+    const store = validateStore(m);
+    errors.push(...store.errors);
+    warnings.push(...store.warnings);
+    warnings.push(...trialWarnings(m));
+
+    const unknownScopes = (m.scopes ?? []).filter((s) => !SCOPES.includes(s));
+    if (unknownScopes.length) warnings.push(`These scopes are not available and will not be granted: ${unknownScopes.join(', ')}.`);
+    // Status is host-controlled now: approvers release versions in HawkSearch.
+    if (m.status !== undefined) warnings.push(STATUS_IGNORED);
+
+    return { errors, warnings };
+}
+
+/**
+ * "lambdas": Lambdas outside Hawk Apps the app calls (scope lambdas:invoke). A list of up to 10 unique Lambda function
+ * names; the list needs the scope and the scope needs a non-empty list. Whether a platform allows a name is only known
+ * when the app calls it.
+ */
+export function validateLambdas(m) {
+    const errors = [];
+    const hasScope = Array.isArray(m.scopes) && m.scopes.includes(LAMBDAS_SCOPE);
+    const list = m.lambdas;
+    if (list === undefined) {
+        if (hasScope) errors.push(`The "${LAMBDAS_SCOPE}" scope needs "lambdas": the Lambdas the app calls, e.g. ["analytics-client-setup"].`);
+        return errors;
+    }
+    if (!Array.isArray(list) || list.some((name) => typeof name !== 'string')) {
+        errors.push('lambdas must be a list of Lambda function names, e.g. ["analytics-client-setup"].');
+        return errors;
+    }
+    const bad = list.filter((name) => !LAMBDA_NAME.test(name));
+    if (bad.length) errors.push(`lambdas: ${bad.map((name) => JSON.stringify(name)).join(', ')} must be a Lambda function name: 1-64 letters, digits, "-" or "_".`);
+    const duplicates = [...new Set(list.filter((name, i) => list.indexOf(name) !== i))];
+    if (duplicates.length) errors.push(`lambdas lists ${duplicates.join(', ')} more than once.`);
+    if (list.length > MAX_LAMBDAS) errors.push(`lambdas: at most ${MAX_LAMBDAS} names (found ${list.length}).`);
+    if (list.length && !hasScope) errors.push(`lambdas need the "${LAMBDAS_SCOPE}" scope: add it to "scopes" in hawk-app.json.`);
+    if (!list.length && hasScope) errors.push(`The "${LAMBDAS_SCOPE}" scope needs at least one name in "lambdas".`);
+    return errors;
+}
+
+/**
+ * "systemParameters": the HawkSearch system parameters the app may set (scope hawksearch:sysparams:write). A list of
+ * up to 50 unique names (case-insensitive); the list needs the scope and the scope needs a non-empty list.
+ */
+export function validateSystemParameters(m) {
+    const errors = [];
+    const hasScope = Array.isArray(m.scopes) && m.scopes.includes(SYSPARAMS_SCOPE);
+    const list = m.systemParameters;
+    if (list === undefined) {
+        if (hasScope) errors.push(`The "${SYSPARAMS_SCOPE}" scope needs "systemParameters": the system parameters the app may set, e.g. ["Timezone"].`);
+        return errors;
+    }
+    if (!Array.isArray(list) || list.some((name) => typeof name !== 'string')) {
+        errors.push('systemParameters must be a list of HawkSearch system parameter names, e.g. ["Timezone", "SearchPreviewURL"].');
+        return errors;
+    }
+    const bad = list.filter((name) => !SYSPARAM_NAME.test(name));
+    if (bad.length) {
+        errors.push(`systemParameters: ${bad.map((name) => JSON.stringify(name)).join(', ')} must be 1-50 letters, digits, "_", "." or "-".`);
+    }
+    const lower = list.map((name) => name.toLowerCase());
+    const duplicates = [...new Set(list.filter((name, i) => lower.indexOf(name.toLowerCase()) !== i))];
+    if (duplicates.length) errors.push(`systemParameters lists ${duplicates.join(', ')} more than once (names are not case-sensitive).`);
+    if (list.length > MAX_SYSPARAMS) errors.push(`systemParameters: at most ${MAX_SYSPARAMS} names (found ${list.length}).`);
+    if (list.length && !hasScope) errors.push(`systemParameters need the "${SYSPARAMS_SCOPE}" scope: add it to "scopes" in hawk-app.json.`);
+    if (!list.length && hasScope) errors.push(`The "${SYSPARAMS_SCOPE}" scope needs at least one name in "systemParameters".`);
+    return errors;
+}
+
+/**
+ * "schedules": recurring runs of the app's job functions, { "<name>": { "function", "cron", "timezone"? } }. Up to 5;
+ * each runs a function of this manifest with "job": true, on a 6-field EventBridge cron
+ * ("minutes hours day-of-month month day-of-week year") at most hourly: the minutes field is a single number.
+ */
+export function validateSchedules(m) {
+    const errors = [];
+    const schedules = m.schedules;
+    if (schedules === undefined) return errors;
+    if (!schedules || typeof schedules !== 'object' || Array.isArray(schedules)) {
+        errors.push('schedules must be an object: { "<name>": { "function": "<job function>", "cron": "0 7 ? * MON *" } }.');
+        return errors;
+    }
+    const names = Object.keys(schedules);
+    if (names.length > MAX_SCHEDULES) errors.push(`schedules: at most ${MAX_SCHEDULES} schedules per app (found ${names.length}).`);
+    const functions = m.functions && typeof m.functions === 'object' && !Array.isArray(m.functions) ? m.functions : {};
+    for (const name of names) {
+        const where = `schedules.${name}`;
+        if (!FUNCTION_NAME.test(name) || name.length > MAX_NAME_LENGTH) {
+            errors.push(`${where}: schedule names must be 1-${MAX_NAME_LENGTH} lowercase letters, digits and single dashes (e.g. "nightly").`);
+        }
+        const schedule = schedules[name];
+        if (!schedule || typeof schedule !== 'object' || Array.isArray(schedule)) {
+            errors.push(`${where} must be an object, e.g. { "function": "nightly-report", "cron": "0 7 ? * MON *", "timezone": "America/Chicago" }.`);
+            continue;
+        }
+        const unknown = Object.keys(schedule).filter((key) => !['function', 'cron', 'timezone'].includes(key));
+        if (unknown.length) errors.push(`${where}: unknown setting${unknown.length === 1 ? '' : 's'} ${unknown.map((k) => `"${k}"`).join(', ')} (allowed: function, cron, timezone).`);
+        if (typeof schedule.function !== 'string' || !schedule.function) {
+            errors.push(`${where}.function is required: the name of a job function under "functions".`);
+        } else if (!Object.hasOwn(functions, schedule.function)) {
+            errors.push(`${where}.function: "${schedule.function}" is not declared under "functions".`);
+        } else if (functions[schedule.function]?.job !== true) {
+            errors.push(`${where}.function: "${schedule.function}" must be a job function: set "job": true on it.`);
+        }
+        if (typeof schedule.cron !== 'string') {
+            errors.push(`${where}.cron is required: an EventBridge cron like "0 7 ? * MON *" (minutes hours day-of-month month day-of-week year).`);
+        } else {
+            const fields = schedule.cron.trim().split(/\s+/);
+            if (/^cron\(/i.test(schedule.cron.trim())) {
+                errors.push(`${where}.cron: leave out the cron( ) wrapper, e.g. "0 7 ? * MON *".`);
+            } else if (fields.length !== 6) {
+                errors.push(`${where}.cron must have 6 fields: minutes hours day-of-month month day-of-week year, e.g. "0 7 ? * MON *" (found ${fields.length}).`);
+            } else if (fields.some((field) => !CRON_FIELD.test(field))) {
+                errors.push(`${where}.cron: each field may only use digits, letters and * ? , / # - (found "${schedule.cron}").`);
+            } else if (!CRON_MINUTES.test(fields[0])) {
+                errors.push(`${where}.cron: schedules run at most hourly, so the minutes field must be a single number from 0 to 59 (found "${fields[0]}").`);
+            } else if (fields[2] !== '?' && fields[4] !== '?') {
+                errors.push(`${where}.cron: day-of-month or day-of-week must be "?" (EventBridge needs one of them), e.g. "0 7 ? * MON *" or "0 7 1 * ? *".`);
+            }
+        }
+        if (schedule.timezone !== undefined && (typeof schedule.timezone !== 'string' || !TIMEZONE.test(schedule.timezone))) {
+            errors.push(`${where}.timezone must be an IANA time zone such as "America/Chicago", or "UTC" (the default).`);
+        }
+    }
+    if (names.length && !(m.scopes ?? []).includes(FUNCTIONS_SCOPE)) {
+        errors.push(`schedules need the "${FUNCTIONS_SCOPE}" scope: add it to "scopes" in hawk-app.json.`);
+    }
+    return errors;
+}
+
+export function newManifest({ slug, name, template }) {
+    return {
+        $schema: './node_modules/@bridgeline-digital/hawk-app-cli/schema/hawk-app.schema.json',
+        slug,
+        // The template it came from: `hawk-app upgrade` keeps the app in step with it.
+        ...(template ? { template } : {}),
+        name,
+        description: '',
+        // An .svg (drawn in the host's color) or .png file next to this one; create and init add a default icon.svg.
+        icon: 'icon.svg',
+        visibility: 'allowList',
+        scopes: ['reports:read'],
+        // Outside origins the app may load scripts, styles and images from and call (e.g. "https://api.example.com",
+        // or "img:*" for images from anywhere). The vanilla template loads the bridge from jsDelivr.
+        externalOrigins: template === 'vanilla' ? ['https://cdn.jsdelivr.net'] : [],
+    };
+}