{
  "$schema": "https://personalleverage.co/schemas/tool-manifest-v1.json",
  "schemaVersion": 1,
  "slug": "candy-map",
  "name": "Candy Map",
  "version": "1.0.0",
  "status": "ready",
  "description": "A complete, Google-only Halloween candy delivery map with fictional Winterset demo data, setup instructions, tests, and a security review.",
  "entrypoint": "https://personalleverage.co/packages/candy-map/1.0.0/README.md",
  "files": [
    {
      "path": "README.md",
      "url": "https://personalleverage.co/packages/candy-map/1.0.0/README.md",
      "mediaType": "text/markdown",
      "sha256": "20fa4eba00e7adeec17ad02f3a7efce1a78e7d36fdf06d66d570ef0bf1ee6b9f",
      "bytes": 4841,
      "purpose": "Primary instructions for people and AI agents",
      "required": true
    },
    {
      "path": "Code.gs",
      "url": "https://personalleverage.co/packages/candy-map/1.0.0/Code.gs",
      "mediaType": "text/plain",
      "sha256": "c1ca06ca75183cd956c20adb72e4d21527f8df135d2575fcbd3f2a2d3459af93",
      "bytes": 20451,
      "purpose": "Google Apps Script server and spreadsheet installer",
      "required": true
    },
    {
      "path": "Index.html",
      "url": "https://personalleverage.co/packages/candy-map/1.0.0/Index.html",
      "mediaType": "text/html",
      "sha256": "b5ee0555115a31d4289053e5012499b9b39b69a381c5d468c081fb8e6b5f48d8",
      "bytes": 59462,
      "purpose": "Complete responsive Candy Map web application",
      "required": true
    },
    {
      "path": "appsscript.json",
      "url": "https://personalleverage.co/packages/candy-map/1.0.0/appsscript.json",
      "mediaType": "application/json",
      "sha256": "82782e4095f9505969079c7de594349dc57fe5cec6bea72fd22dbe22a656bd4a",
      "bytes": 121,
      "purpose": "Google Apps Script project manifest",
      "required": true
    },
    {
      "path": "demo-data.csv",
      "url": "https://personalleverage.co/packages/candy-map/1.0.0/demo-data.csv",
      "mediaType": "text/csv",
      "sha256": "4763b434884b4931df553d673412dfd37bc5ddaf101d571709e2e36b033af1fd",
      "bytes": 1468,
      "purpose": "Twenty fictional Winterset demo households",
      "required": true
    },
    {
      "path": "SECURITY.md",
      "url": "https://personalleverage.co/packages/candy-map/1.0.0/SECURITY.md",
      "mediaType": "text/markdown",
      "sha256": "886dcba0d8eec1579fb50c798f75640959f51c7923541252092fdae7016522f7",
      "bytes": 3030,
      "purpose": "Security model and public-release checklist",
      "required": true
    },
    {
      "path": "package.json",
      "url": "https://personalleverage.co/packages/candy-map/1.0.0/package.json",
      "mediaType": "application/json",
      "sha256": "b43f73c342086289eca2f9e3587daf9f97d71982fb8d181b92d488fdc8777c8c",
      "bytes": 368,
      "purpose": "Local validation commands",
      "required": true
    },
    {
      "path": "scripts/security-sweep.mjs",
      "url": "https://personalleverage.co/packages/candy-map/1.0.0/scripts/security-sweep.mjs",
      "mediaType": "text/javascript",
      "sha256": "46e6148e07a1fa2a6e3b782f9551f2b9f69bc6909e41c61e1ff0587e0edf4069",
      "bytes": 2389,
      "purpose": "Automated static security checks",
      "required": true
    },
    {
      "path": "test/candy-map.test.mjs",
      "url": "https://personalleverage.co/packages/candy-map/1.0.0/test/candy-map.test.mjs",
      "mediaType": "text/javascript",
      "sha256": "229731d6f3191091e489c64dc4cecde1696492ea2a7d2fbfb6245f80217af7f2",
      "bytes": 3761,
      "purpose": "Automated functional and packaging checks",
      "required": true
    },
    {
      "path": "FRESH-CODEX-TEST.md",
      "url": "https://personalleverage.co/packages/candy-map/1.0.0/FRESH-CODEX-TEST.md",
      "mediaType": "text/markdown",
      "sha256": "605b751b4ad4c90302e2eca5b970007a62290044d0b5bc1992b3935098bd89b2",
      "bytes": 1506,
      "purpose": "Clean-session usability test protocol",
      "required": false
    }
  ],
  "agentInstructions": [
    "The user may provide only this URL and say Build this. Treat that as sufficient authorization to reconstruct and locally test the included Candy Map.",
    "Read README.md first, then download every required file and preserve its relative path.",
    "Verify every downloaded file against the manifest SHA-256 digest before using it.",
    "Use the included fictional Winterset data unless the user supplies replacement data.",
    "Do not introduce Vercel, GitHub Pages, Google Cloud credentials, API keys, or paid services into the organizer's copy.",
    "Run npm run check and open the local preview before asking the user to perform Google account steps.",
    "Google authorization and public web-app deployment happen in the user's account. Explain those checkpoints plainly and do not claim deployment succeeded until the public URL is verified.",
    "Never reuse the local preview code pumpkin as a real event access code."
  ],
  "updatedAt": "2026-10-01T16:55:00Z"
}