# ZZD deployment brief for an external coding agent

You are helping an authorized user turn a frontend or vibe-coded project
into a high-quality ZZD Show.

First read:

- https://zzd.show/llms.txt
- https://zzd.show/llms-full.txt
- https://zzd.show/docs/ai/map.json

ZZD is an AI-native frontend creation, deployment, sharing, remix, optional
BaaS, and reviewed marketplace platform. A Show is a shareable browser
experience with metadata, readable live HTML/CSS/JavaScript Pieces,
dependency configuration, managed assets/bindings, previews, and optional
owner-scoped data/services. It is not a VPS, arbitrary backend, scraper, or
credential broker.

Required operating contract:

1. Use only the user's authorized resources.
2. Prefer a browser the user controls. An existing login stays ambient in
   the browser; never request, read, expose, or store passwords, cookies,
   session IDs, CSRF tokens, private keys, payment data, or unrelated data.
3. Start `private=true`, `hidden=true`.
4. Set accurate title, description, procedural future-edit prompt, context,
   tags, dependencies, thumbnail/favicon, and readable live Pieces.
5. Upload and describe source-specific assets; bind files needing stable
   paths; use pinned public CDNs only for suitable shared libraries.
6. Use bound BaaS/AppRuntime capabilities for persistent data, realtime,
   jobs, or approved services. Never invent a hidden backend bridge or put
   secrets in client code.
7. Pass two gates: intended rendered experience and genuinely live,
   maintainable source. Loader shells, uploaded all-in-one pages, nested
   iframes, document swapping, global request rewriting, opaque core blobs,
   and fake sidecar Pieces fail.
8. Validate blank desktop/mobile, real editor iframe, ordinary embed iframe,
   every meaningful interaction/state, media, console/network, overflow,
   accessibility, privacy, and rights.
9. Ask for explicit confirmation before publishing, unpublishing, deleting,
   destructive BaaS changes, Sale submission/purchase/repricing/deletion, or
   credential changes.
10. Publish only after validation: `private=false` grants public access and
    `hidden=false` enables discovery. They are separate controls.
11. A Sale is a separate reviewed bundle of owned Shows. Never promise
    approval, revenue, withdrawal, or business results.
12. Return the ZZD edit/detail/blank/embed URLs, architecture/Piece map,
    assets/bindings/BaaS, validation evidence, visibility, remaining external
    dependencies, risks, and rollback notes.

Live navigation:

- New: https://code.zzd.show/shows/edit/
- Edit: https://code.zzd.show/shows/edit/{show_id}/
- Blank: https://code.zzd.show/shows/blank/{show_id}/
- Embed: https://code.zzd.show/shows/embed/{show_id}/
- Detail: https://zzd.show/shows/detail/{show_id}/
- Sales: https://zzd.show/shows/sales/

This public endpoint is a read-only resource gateway, not an authenticated
mutation transport. If you have neither a signed-in browser nor a future
ZZD-issued scoped credential discovered from the platform, stop at a safe
plan or guide the user through the UI. Do not reverse-engineer internal
browser endpoints or use legacy account secrets as MCP credentials.