Manifest

manifest.json sits at the root of the package. It is validated when the package is previewed, again after extraction, and the two must match — a package whose manifest changes between consent and install is rejected.

Fields

Package-relative paths are POSIX (/ separators), never absolute, never contain .., and never start with the reserved __cherry directory.

Localized text

A string, or an object keyed by locale. At least one of en / zh must be present; any other locale key is optional; at most 20 keys.

"name": "My Game"
"name": { "en": "My Game", "zh": "我的游戏", "ja": "マイゲーム" }

Resolution for the user's locale: exact locale (zh-TW) → language subtag (zh) → en → zh. Writing zh once covers zh-CN, zh-TW and zh-HK.

App id

^(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])(?:\.(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9]))*$

Permissions

Each entry is either a leaf (file.save) or a namespace wildcard (file.*). A wildcard is authoring shorthand: it is expanded to the leaves that exist at consent time and never stored, so a method Cherry adds later is not silently granted by an old wildcard.

Only methods gated grant are declarable. sibling methods become callable as soon as any leaf in their namespace is granted; none methods need nothing.

Users never see these names raw: the consent card and the detail panel show the copy under miniApp.permission.* in the renderer catalog (namespace title and description, one label per leaf). Adding a grant method means adding that copy — a contract test fails until both en-us and zh-cn have it.

Cross-field rules, all rejected at validation:

Required permissions cannot be revoked after install; the only way to remove one is to uninstall. Optional permissions can be revoked and re-granted from the app's detail panel, and take effect on the next call. Query the current state with cherry.app.getPermissions().

Network hosts

network is the scope of network.fetch, not a permission of its own — a host cannot be individually revoked. Entries are bare hostnames matched exactly (no scheme, path, port or wildcard):

"network": ["api.example.com", "cdn.example.com"]

cherry.network.fetch accepts https:// URLs on the default port whose hostname is in this list. api.example.com does not cover www.api.example.com or example.com. Adding a host in an update is shown on the update card and requires consent.

Example

{
  "id": "com.example.mygame",
  "name": { "en": "My Game", "zh": "我的游戏" },
  "description": { "en": "A tiny sample game.", "zh": "一个小样例游戏。" },
  "version": "1.0.0",
  "entry": "index.html",
  "icon": { "path": "icon.png", "sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" },
  "permissions": ["ai.chat", "storage.*", "file.save", "file.load"],
  "optionalPermissions": ["notification.show", "network.fetch"],
  "network": ["api.example.com"],
  "releaseNotes": { "en": "Fixes a save bug.", "zh": "修复了一个存档问题。" },
  "update": {
    "url": "https://example.com/mygame/manifest.json",
    "urlCn": "https://cdn.example.cn/mygame/manifest.json"
  }
}

The manifest served at update.url is this document plus a package block; see Packaging.

Limits