Manifest and branding

zship.app.json is the app-level source of truth for public identity.

Required fields

• appKey: tenant key injected server-side into backend requests
• domain and siteUrl: production host metadata
• siteName, tagline, and description: public copy
• brand.name, brand.logo, and brand.logoDark: brand assets
• seo.landingTitle and seo.landingDescription: default head metadata
• dashboard.url and dashboard.features: dashboard entry and feature flags
• header / footer: optional shell navigation and footer sections
• analytics: optional GA / Plausible / Clarity plus consent banner switch

Runtime adapter

src/lib/site.ts imports the manifest, validates required strings, and exports APP_KEY plus siteConfig.

Safety rules

• Do not store secrets in zship.app.json.
• Do not trust a browser-supplied app_key for authenticated or billing operations.
• Keep feature switches in the manifest and enforcement in the page/API code where needed.