# ZZD deployment brief for an external coding agent

You are helping an authorized user turn a frontend or vibe-coded project
into a high-quality ZZD Show.

First read:

- https://zzd.show/llms.txt
- https://zzd.show/llms-full.txt
- https://zzd.show/docs/ai/map.json
- https://zzd.show/api/v1/capabilities/

ZZD is an AI-native frontend creation, deployment, sharing, remix, optional
BaaS, and reviewed marketplace platform. A Show is a shareable browser
experience with metadata, readable live HTML/CSS/JavaScript Pieces,
dependency configuration, managed assets/bindings, previews, and optional
owner-scoped data/services. It is not a VPS, arbitrary backend, scraper, or
credential broker.

Required operating contract:

1. Use only the user's authorized resources.
2. Build and test in the user's local workspace first. Keep credentials and
   server/private files out of the project and Show, except the explicitly
   supported project-local AI Bridge file when it is excluded by `.gitignore`
   and readable only by the authorized local agent.
3. Use a least-privilege, expiring developer credential. Prefer the signed-in
   homepage's one-click `zzd-workspace.zzdmcp`: the plain JSON, non-executable,
   non-SSH/non-X.509 bundle is self-describing, and each new download revokes the user's
   previous Bridge file. It may be read by the authorized local coding agent
   from a `.gitignore`-excluded project path. Never paste its bearer into
   source, logs, screenshots, URLs, prompts, or output, and never upload
   the file to cloud drives, tickets, unrelated services, or unrelated chats.
4. Fetch `GET https://zzd.show/api/v1/capabilities/`, then verify the intended
   account with authenticated `GET /api/v1/me/`. The exact canonical Host is
   required: send bearer requests only to `https://zzd.show/api/v1/...`,
   never www/code/IP/custom hosts or across redirects. Do not assume routes.
5. `POST /api/v1/shows/` to create a server-enforced
   `private=true`, `hidden=true` draft. Keep only non-secret IDs, Piece
   hashes, mount paths, and validation notes in the local project manifest.
6. `PUT /api/v1/shows/{show_id}/pieces/` with the complete authoritative,
   readable HTML/CSS/JavaScript source tree. It replaces rather than merges.
7. Upload approved source-specific bytes one at a time through
   `POST /api/v1/shows/{show_id}/assets/` with a stable relative mount path.
   Draft bytes are private and owner-checked; publication promotes public
   copies, and re-drafting removes those copies but retains private sources.
   Pin suitable shared public HTTPS dependencies.
8. If required, use the bounded runtime-identity BaaS endpoint and/or create
   and attach an owned collection. Never infer arbitrary database routes or
   put runtime/service credentials in client code.
9. Pass two gates: intended rendered experience and genuinely live,
   maintainable source. Loader shells, uploaded all-in-one pages, nested
   iframes, document swapping, global request rewriting, opaque core blobs,
   and fake sidecar Pieces fail.
10. Validate blank desktop/mobile, real editor iframe, ordinary embed iframe,
   every meaningful interaction/state, media, console/network, overflow,
   accessibility, privacy, and rights.
11. Capture a fresh final-state screenshot, POST it to
    `/api/v1/shows/{show_id}/thumbnail/` as one verified JPEG/PNG/WebP, then
    verify the owner-scoped `/thumbnail/content/` route. This available REST
    mutation does not replace browser validation.
12. Ask for explicit confirmation before publishing, unpublishing, deleting,
   destructive BaaS changes, Sale submission/purchase/repricing/deletion, or
   credential changes.
13. Publish only via `POST /api/v1/shows/{show_id}/publication/` with
    `{"action":"publish","confirm":true}` and `shows:publish`. Successful
    v1 publication sets both `private=false` and `hidden=false`.
14. A Sale is a separate reviewed UI workflow and bundle of owned Shows.
    REST v1 does not manage Sales. Never promise
    approval, revenue, withdrawal, or business results.
15. Return the ZZD edit/detail/blank/embed URLs, architecture/Piece map,
    assets/bindings/BaaS, validation evidence, visibility, remaining external
    dependencies, risks, rollback notes, and non-secret credential profile
    name. Never return the bearer value.

Live navigation:

- New: https://code.zzd.show/shows/edit/
- Edit: https://code.zzd.show/shows/edit/{show_id}/
- Blank: https://code.zzd.show/shows/blank/{show_id}/
- Embed: https://code.zzd.show/shows/embed/{show_id}/
- Detail: https://zzd.show/shows/detail/{show_id}/
- Sales: https://zzd.show/shows/sales/

Public gateway pages are unauthenticated discovery and an adoption spec;
mutations go only to canonical `https://zzd.show/api/v1/` scoped HTTPS
routes or the authenticated `https://zzd.show/mcp/v1/` Streamable HTTP
adapter. If you have neither a signed-in
browser nor a valid ZZD-issued developer credential, stop at a safe plan or
guide credential creation. Do not reverse-engineer browser endpoints.