ZZD public AI gateway · zzd_public_ai_gateway_v3
Resource: 02 · Deploy a vibe-coded project / 最短路径
Canonical map: https://zzd.show/docs/ai/map.json
Full handbook: https://zzd.show/llms-full.txt
REST capabilities: https://zzd.show/api/v1/capabilities/

# Deploy a vibe-coded project as a ZZD Show

Use this sequence unless the user asks for a narrower task.

1. Read `/llms.txt`, `deployment-api`, `show-contract`, `quality`,
   `assets`, `space-sdk`, `baas`, `lifecycle`, and `safety`.
2. Inspect the user's project and identify the actual browser entry,
   source files, build system, routes/states, assets, environment
   variables, network dependencies, and license. Never copy secrets.
3. Choose the smallest suitable architecture:
   - static client experience: Pieces + assets;
   - framework experience: readable source Pieces plus pinned
     dependencies and source-specific assets;
   - data/stateful experience: the above plus a bound ZZD Space/BaaS;
   - approved capability: call it through `window.AppRuntime`.
4. Ask the user to sign in at `https://zzd.show`. The recommended
   path is the one-click `zzd-workspace.zzdmcp` download in the
   Credentials area. A browser-assisted agent may click it in the
   already signed-in, user-controlled browser without reading the
   session or asking the user to copy a token. The plain JSON file
   is not executable and is not an SSH/TLS/X.509 private key: it
   contains official discovery URLs, MCP/REST configuration,
   lifecycle instructions, and one scoped expiring bearer. Each
   download creates an independent 14-day credential; existing
   bundles and workers remain valid. Bundles and manual tokens
   share the account active-key limit (20 by default).
   The same-origin credential API is `/api/v1/developer-credentials/`
   with `create/`, `bridge.zzdmcp`, the legacy `ai-bridge.pem`, and
   `{credential_id}/revoke/` subroutes; its
   mutations require the user's signed-in browser session plus CSRF,
   not a developer bearer. The normal UI remains the preferred user
   control surface.
5. Fetch `GET https://zzd.show/api/v1/capabilities/`; its returned
   route, scope, field, limit, and response contract is authoritative.
   Verify the credential with `GET /api/v1/me/`. The control plane
   accepts only the exact canonical `zzd.show` Host. Never send the
   bearer to `www`, `code.zzd.show`, an IP, custom domain, or redirect.
6. Create the Show through `POST /api/v1/shows/`. The server always
   creates `private=true`, `hidden=true`. Save only the returned
   Show ID in the local project manifest.
7. Replace the authoritative source tree with `PUT
   /api/v1/shows/{show_id}/pieces/`. Upload source-specific assets
   with `POST /api/v1/shows/{show_id}/assets/`. Every write returns
   the Show to safe draft state. Draft bytes stay outside public
   media and are owner-checked; publication promotes public copies,
   and a later draft-producing mutation removes those public copies.
8. If needed, provision the bounded runtime-identity BaaS profile and
   create/attach an owned collection through their advertised v1
   routes. Broader BaaS configuration stays in the signed-in UI.
9. Validate the actual Show, not only the original local project:
   blank/fullscreen desktop and mobile, the real editor preview
   iframe, and the ordinary embed iframe when available. Exercise
   every meaningful state and inspect console, network, media,
   overflow, accessibility, and source ownership.
10. Fix failures, capture a fresh final-state screenshot, and upload
    it with `POST /api/v1/shows/{show_id}/thumbnail/`. Verify the
    owner-scoped draft image through `GET
    /api/v1/shows/{show_id}/thumbnail/content/`. REST v1 verifies
    image bytes but is not a substitute for browser validation.
11. Ask for explicit user confirmation, then call `POST
    /api/v1/shows/{show_id}/publication/` with
    `{"action":"publish","confirm":true}`. Server preflight is
    necessary but does not replace the quality matrix.
12. Return the detail, blank, edit, and embed URLs from the API,
    validation summary, visibility, remaining risks, external
    dependencies, credential profile name, and rollback notes.

Production navigation templates:

- New Show: `https://code.zzd.show/shows/edit/`
- Edit: `https://code.zzd.show/shows/edit/{show_id}/`
- Blank/fullscreen: `https://code.zzd.show/shows/blank/{show_id}/`
- Embed: `https://code.zzd.show/shows/embed/{show_id}/`
- Detail/share: `https://zzd.show/shows/detail/{show_id}/`
- Marketplace: `https://zzd.show/shows/sales/`
- New Sale: `https://zzd.show/shows/sales/new/`

Follow URLs returned by the platform. Do not substitute old
development hosts, reverse-engineer private AJAX endpoints, or use
the legacy CLI token. The supported external mutation surface is the
scoped `/api/v1/` REST control plane advertised by capabilities.

Import rule: a repository build output may be useful evidence, but
do not deploy an opaque hosted-page wrapper. Re-express the meaningful
client source as live Pieces and upload only appropriate supporting
files. Server code, `.env`, credentials, private datasets, CI keys,
and repository metadata do not belong in a Show.