@zaip-ai/cli 2.2.0 → 2.6.0

package/templates/.agents/skills/zaip-skill-test-data/scripts/generate.mjs

@@ -0,0 +1,72 @@
+import { lstat, mkdir, readFile, realpath, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+
+const [output, ...rest] = process.argv.slice(2);
+if (!output || (rest.length !== 0 && (rest.length !== 2 || rest[0] !== "--seed"))) {
+  throw new Error("Usage: generate.mjs <output.json> [--seed <text>]");
+}
+const seed = rest[1] ?? "zaip-test-data";
+if (seed.length === 0 || seed.length > 120) throw new Error("seed must contain 1-120 characters");
+const fixture = createFixture(seed);
+const target = resolve(output);
+await safeOutput(target);
+await mkdir(dirname(target), { recursive: true });
+if (await unchanged(target, fixture))
+  process.stdout.write(`${JSON.stringify({ written: false, fixture }, null, 2)}\n`);
+else {
+  if (await existing(target)) throw new Error("refusing divergent existing output");
+  await safeOutput(target);
+  await writeFile(target, `${JSON.stringify(fixture, null, 2)}\n`, {
+    encoding: "utf8",
+    flag: "wx",
+  });
+  process.stdout.write(`${JSON.stringify({ written: true, fixture }, null, 2)}\n`);
+}
+function createFixture(seed) {
+  const suffix = hash(seed).toString(36).padStart(7, "0").slice(-7);
+  return {
+    schema_version: 1,
+    seed,
+    tenants: [
+      { id: `tenant-${suffix}-a`, name: "Tenant A" },
+      { id: `tenant-${suffix}-b`, name: "Tenant B" },
+    ],
+    users: [
+      { id: `user-${suffix}-owner`, tenant_id: `tenant-${suffix}-a`, role: "owner" },
+      { id: `user-${suffix}-member`, tenant_id: `tenant-${suffix}-a`, role: "member" },
+      { id: `user-${suffix}-other`, tenant_id: `tenant-${suffix}-b`, role: "owner" },
+    ],
+  };
+}
+async function unchanged(path, fixture) {
+  try {
+    return (await readFile(path, "utf8")) === `${JSON.stringify(fixture, null, 2)}\n`;
+  } catch {
+    return false;
+  }
+}
+async function existing(path) {
+  try {
+    await lstat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function safeOutput(path) {
+  for (let current = dirname(path); ; current = dirname(current)) {
+    const stat = await lstat(current).catch(() => null);
+    if (stat) {
+      const resolved = await realpath(current);
+      if (stat.isSymbolicLink() || resolved.toLowerCase() !== resolve(current).toLowerCase())
+        throw new Error("output path cannot use a symbolic link or junction");
+    }
+    const parent = dirname(current);
+    if (parent === current) break;
+  }
+}
+function hash(value) {
+  let total = 2166136261;
+  for (const character of value) total = Math.imul(total ^ character.charCodeAt(0), 16777619);
+  return total >>> 0;
+}

package/templates/.agents/skills/zaip-skill-testing-strategy/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: zaip-skill-testing-strategy
+description: Map acceptance risks to focused unit, integration, contract, and end-to-end tests with meaningful evidence.
+---
+
+# Plan tests
+
+Use when a change needs a proportionate verification plan or existing tests do not prove important behavior.
+Read `references/example-map.md` for a Hono and Kysely multi-tenant mutation.
+
+1. Start with acceptance criteria, failure modes, external boundaries, and user-visible states rather than a target coverage number.
+2. Choose the lowest layer that can prove each behavior; use real integration boundaries when mocks cannot prove configuration or policy.
+3. Define deterministic fixtures, isolation, cleanup, and the observable assertion for each high-risk case.
+4. Include unauthorized, invalid, retry, and regression cases where the altered behavior makes them meaningful.
+5. Keep test execution evidence separate from a test plan and record baseline failures as baseline failures.

package/templates/.agents/skills/zaip-skill-testing-strategy/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Testing Strategy"
+  short_description: "Map risks to meaningful test evidence"
+  default_prompt: "Use $zaip-skill-testing-strategy to create a focused verification strategy for this change."

package/templates/.agents/skills/zaip-skill-testing-strategy/references/example-map.md

@@ -0,0 +1,3 @@
+# Example map
+
+A Hono multi-tenant mutation needs a unit test for use-case invariants, a route contract test for validation and response, a Kysely integration test for transaction and tenant context, and a UI assertion for loading, validation error, and success feedback. Add a cross-tenant denial test through the actual database access path.

package/templates/.agents/skills/zaip-skill-website-readiness/SKILL.md

@@ -5,6 +5,9 @@ description: Build capability-aware websites with discoverable agent-readable me
 
 # Website and Agent Readiness
 
+Para componentes de UI novos ou alterados, carregue também
+`$zaip-skill-frontend-componentization`.
+
 Use this skill for `apps/site/**`, landing pages, institutional websites, SEO, GEO,
 Markdown for Agents, or an Agent Readiness audit. Jonny owns implementation inside the
 site scope; Manu remains the owner of central design rules and must be called first when
@@ -21,6 +24,11 @@ the work changes `DESIGN.md`, design tokens, or canonical components.
    [references/capability-checklist.md](references/capability-checklist.md).
 6. Verify the rendered HTML, structured data, crawler files, Markdown representation,
    links, and response headers. Record unsupported capabilities explicitly.
+7. Publish only to the configured validation branch and the site's own validation
+   environment. Production promotion follows the [deployment and access
+   contract](../zaip-skill-backend/references/deployment-environments.md); a
+   Supabase query, when relevant, uses only a configured READ-ONLY-BETA or
+   READ-ONLY-PROD context.
 
 ## Required outcomes
 

package/templates/.agents/zaip-aios/VERSION

@@ -1 +1 @@
-2.0
+2.6

package/templates/.agents/zaip-aios/guides/10-seguranca.md

@@ -237,7 +237,8 @@ ao novo token. Não edite ACLs manualmente e preserve o backup para rollback.
 | `.codex/zaip-aios-security.config.toml` | configuração dedicada do perfil restrito |
 | `.codex/zaip-aios-full-access.config.toml` | configuração dedicada do perfil completo |
 | `.agents/skills/zaip-skill-security/SKILL.md` | avaliação dos riscos e controles |
-| `.agents/skills/zaip-skill-setup/SKILL.md` | instalação, correção e validação dos perfis |
+| `.agents/skills/zaip-skill-setup/SKILL.md` | instalação inicial dos modelos de perfil entregues pelo release |
+| `.agents/skills/zaip-skill-config/SKILL.md` | seleção, personalização, correção e validação dos perfis |
 | `.codex/hooks/zaip-pre-tool-use.mjs` | guarda adicional de comandos |
 | `.codex/rules/` | decisões determinísticas de comandos permitidos e proibidos |
 | este guia | contrato operacional e comparação dos perfis |

package/templates/.agents/zaip-aios/guides/20-instalacao-detalhada.md

@@ -17,12 +17,14 @@ o runtime distribuído. No checkout mantenedor, use o pnpm fixado em
 Na raiz do projeto-alvo:
 
 ```bash
-npx @zaip-ai/cli@latest init --dry-run
-npx @zaip-ai/cli@latest init
+npx --yes @zaip-ai/cli@latest init --project-only --dry-run
+npx --yes @zaip-ai/cli@latest init --project-only
 node .agents/runtime/bin/zaip.mjs doctor --json
 ```
 
-Revise o dry-run antes da instalação. `@latest` seleciona a versão publicada,
+Revise o dry-run antes da instalação. O primeiro sucesso verificável é a saída
+de `doctor --json` com `"valid": true`; ela confirma layout, checksums e adapters
+do projeto que recebeu a instalação. `@latest` seleciona a versão publicada,
 não alterações ainda locais neste repositório. O binário público `zaip` é o
 instalador; nos exemplos de lifecycle deste guia, `zaip ...` é uma abreviação
 de `node .agents/runtime/bin/zaip.mjs ...` no projeto consumidor. Use o caminho

package/templates/scripts/validate-cloud-hostinger-contract.mjs

@@ -10,6 +10,7 @@ const files = {
   terraform: "infra/terraform/main.tf",
   variables: "infra/terraform/variables.tf",
   skill: ".agents/skills/zaip-skill-hostinger-cloudflare-terraform/SKILL.md",
+  aws: ".agents/skills/zaip-skill-hostinger-cloudflare-terraform/references/aws-cli-terraform.md",
   readiness: "infra/terraform/deployment-inputs.example.yaml",
 };
 const source = Object.fromEntries(
@@ -75,6 +76,39 @@ const checks = [
     source.skill.includes("read-after-write") && source.skill.includes("prova estática/local"),
     "skill must require truthful live validation",
   ],
+  [
+    source.aws.includes("aws configure sso") &&
+      source.aws.includes("OIDC") &&
+      source.aws.includes("aws sts get-caller-identity"),
+    "AWS contract must support bounded authentication and identity verification",
+  ],
+  [
+    source.aws.includes("source_profile") &&
+      source.aws.includes("backend") &&
+      source.aws.includes("provider"),
+    "AWS contract must separate backend and provider authentication",
+  ],
+  [
+    source.aws.includes("use_lockfile = true") &&
+      source.aws.includes("Terraform >= 1.10") &&
+      source.aws.includes("lockfile=readonly") &&
+      source.aws.includes("apply"),
+    "AWS contract must require modern S3 locking and authorized saved-plan apply",
+  ],
+  [
+    source.aws.includes("Bootstrap AWS de ambiente zero") &&
+      source.aws.includes("não cria o bucket S3") &&
+      source.aws.includes("versionamento") &&
+      source.aws.includes("recuperação") &&
+      source.aws.includes("criptografia"),
+    "AWS contract must define separate zero-environment S3 bootstrap and recovery",
+  ],
+  [
+    source.skill.includes("**AWS:**") &&
+      source.skill.includes("Não leia, exija ou derive") &&
+      source.skill.includes("**Cloudflare/Hostinger:**"),
+    "skill must keep AWS inputs separate from the Cloudflare/Hostinger runner flow",
+  ],
   [
     source.readiness.includes("deployment_readiness: failed") &&
       source.readiness.includes("image_digests: {}"),