@zaip-ai/cli 7.5.0 → 7.6.0

package/templates/.agents/dashboard/packages/local-runtime/src/server-release-receipt.ts

@@ -0,0 +1,71 @@
+import { lstat, open, realpath } from "node:fs/promises";
+import { resolve } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import {
+  type PostPublicationReceipt,
+  postPublicationAuthorization,
+  postPublicationIssuance,
+  postPublicationIssuanceId,
+  postPublicationReceiptPath,
+} from "@zaip-ai/core";
+
+type Fields = Record<string, unknown>;
+export type PublicAttestation = { record: Fields; payload: Fields; path: string };
+
+// Read one bounded file from the local workspace. The browser receives only the
+// public decision locator. SQLite never copies the private receipt into its index.
+export async function confirmsReleaseReceipt(
+  root: string,
+  issuer: PublicAttestation,
+  human: PublicAttestation,
+) {
+  const digest = issuer.payload.receipt_sha256;
+  if (typeof digest !== "string" || !/^[a-f0-9]{64}$/.test(digest)) return false;
+  const relative = `.agents/private/state/recovery/post-publication/${digest}.json`;
+  const target = resolve(await realpath(root), relative);
+  try {
+    if ((await realpath(target)) !== target) return false;
+    const original = await lstat(target);
+    if (!original.isFile() || original.nlink !== 1) return false;
+    const handle = await open(target, "r");
+    try {
+      const info = await handle.stat();
+      if (
+        info.ino !== original.ino ||
+        info.dev !== original.dev ||
+        !info.isFile() ||
+        info.nlink !== 1 ||
+        info.size < 2 ||
+        info.size > 2 * 1024 * 1024
+      )
+        return false;
+      const bytes = Buffer.alloc(info.size);
+      let offset = 0;
+      while (offset < bytes.length) {
+        const { bytesRead } = await handle.read(bytes, offset, bytes.length - offset, offset);
+        if (!bytesRead) return false;
+        offset += bytesRead;
+      }
+      const source = bytes.toString("utf8");
+      const receipt = JSON.parse(source) as PostPublicationReceipt;
+      if (source !== JSON.stringify(receipt) + "\n") return false;
+      const { issuance_decision_id, ...base } = receipt;
+      return (
+        [1, 2, 3].includes(receipt.schema_version) &&
+        receipt.kind === "post_publication_closure" &&
+        typeof human.record.confirmed_at === "string" &&
+        Number.isFinite(Date.parse(human.record.confirmed_at)) &&
+        postPublicationReceiptPath(receipt) === relative &&
+        postPublicationIssuanceId(base) === issuance_decision_id &&
+        issuer.record.id === issuance_decision_id &&
+        human.record.id === receipt.human_decision_id &&
+        isDeepStrictEqual(issuer.payload, JSON.parse(postPublicationIssuance(receipt))) &&
+        isDeepStrictEqual(human.payload, postPublicationAuthorization(receipt))
+      );
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    return false;
+  }
+}

package/templates/.agents/dashboard/packages/local-runtime/src/server-trace-release-delivery.ts

@@ -0,0 +1,120 @@
+import {
+  parseYaml,
+  resolveArtifactReadPath,
+  type WorkspaceFileSystem,
+  type WorkspaceLayout,
+} from "@zaip-ai/core";
+import type {
+  ReleaseDeliveryProjection,
+  TaskTrace,
+} from "@zaip-ai/dashboard-traceability/contracts";
+import { confirmsReleaseReceipt, type PublicAttestation } from "./server-release-receipt.js";
+
+type Fields = Record<string, unknown>;
+const fields = (value: unknown): Fields =>
+  value !== null && typeof value === "object" && !Array.isArray(value) ? (value as Fields) : {};
+
+function metadata(content: string): Fields {
+  const front = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(content);
+  return front ? fields(parseYaml(front[1]!)) : {};
+}
+
+// Project the public attestation produced by the verified closure workflow. No private
+// receipt contents or provider credentials belong in the dashboard's SQLite database.
+export async function traceReleaseDelivery(
+  filesystem: WorkspaceFileSystem,
+  layout: WorkspaceLayout,
+  trace: TaskTrace,
+): Promise<ReleaseDeliveryProjection | undefined> {
+  const attestations = trace.documents.flatMap((doc) => {
+    if (!/\/decisions\/DEC-(?:AI-POSTPUB-|HUMAN-)[A-Z0-9-]+\.md$/.test(doc.path)) return [];
+    try {
+      const record = metadata(doc.content);
+      if (
+        typeof record.decision !== "string" ||
+        record.category !== "contract" ||
+        record.scope_type !== "change" ||
+        !doc.path.endsWith(`/${record.scope_id}/decisions/${record.id}.md`)
+      )
+        return [];
+      const payload = fields(JSON.parse(record.decision));
+      return payload.target_task_id === trace.task_id ? [{ record, payload, path: doc.path }] : [];
+    } catch {
+      return [];
+    }
+  });
+  const human = attestations.filter(
+    ({ record, payload }) =>
+      record.origin === "human" &&
+      String(record.id).startsWith("DEC-HUMAN-") &&
+      payload.target_change_id === trace.change_id &&
+      typeof payload.published_sha === "string" &&
+      /^[a-f0-9]{40}$/.test(payload.published_sha) &&
+      /^sha512-[A-Za-z0-9+/]{86}==$/.test(String(payload.npm_integrity)),
+  );
+  const issued = attestations.filter(
+    ({ record, payload }) =>
+      record.origin === "agent" &&
+      /^DEC-AI-POSTPUB-[0-9A-F]{24}$/.test(String(record.id)) &&
+      payload.kind === "post_publication_closure",
+  );
+  if (!issued.length && !human.length) return;
+
+  const readRecord = async (kind: "task" | "change" | "execution", id: string) => {
+    const path = await resolveArtifactReadPath(filesystem, layout, kind, id);
+    if (!path) return {};
+    const result = metadata(await filesystem.readText(path));
+    return result.id === id ? result : {};
+  };
+  const task = await readRecord("task", trace.task_id);
+  const executionId = fields(task.plan_ref).execution_id;
+  const matching = human.filter(
+    ({ payload }) =>
+      payload.target_execution_id === executionId &&
+      payload.target_release === task.target_release &&
+      task.change_id === trace.change_id,
+  );
+  let proof: PublicAttestation | undefined;
+  for (const issuer of issued) {
+    if (issuer.payload.target_execution_id !== executionId) continue;
+    for (const auth of matching) {
+      if (
+        auth.record.scope_id === issuer.record.scope_id &&
+        (await confirmsReleaseReceipt(filesystem.root, issuer, auth))
+      ) {
+        proof = issuer;
+        break;
+      }
+    }
+    if (proof) break;
+  }
+  const change = await readRecord("change", trace.change_id);
+  const execution =
+    typeof executionId === "string" && /^EXEC-[A-Z0-9-]+$/.test(executionId)
+      ? await readRecord("execution", executionId)
+      : {};
+  const status = (record: Fields) => (typeof record.status === "string" ? record.status : null);
+  const pending = [
+    ["Task", task],
+    ["Change", change],
+    ["Execution", execution],
+  ] as const;
+  const next = pending.find(([, record]) => status(record) !== "completed");
+  return {
+    publication: proof ? "verified" : "unverified",
+    receipt_path: proof?.path ?? null,
+    task_status: status(task) ?? "unknown",
+    change_status: status(change),
+    execution_status: status(execution),
+    blocker: !proof
+      ? "Falta a confirmação de publicação vinculada a esta Task."
+      : next
+        ? `${next[0]} · ${status(next[1]) ?? "registro ausente"}`
+        : null,
+    next_action: !proof
+      ? "Confira a decisão de emissão e o vínculo com o recibo da publicação."
+      : next
+        ? `Retome o fechamento de ${next[0]} no ZAIP usando a prova indicada.`
+        : null,
+  };
+}

package/templates/.agents/dashboard/packages/local-runtime/src/server-trace-routes.ts

@@ -8,6 +8,7 @@ import type { Hono } from "hono";
 import { API_PREFIX, headOrJson, V2WorkspaceRequiredError } from "./server-http-contracts.js";
 import type { DashboardRouteContext } from "./server-route-context.js";
 import { buildSqliteTaskTrace } from "./server-sqlite-task-trace.js";
+import { traceReleaseDelivery } from "./server-trace-release-delivery.js";
 import { SqliteReadModelFileSystem } from "./sqlite-read-model.js";
 export function registerTraceRoutes(app: Hono, dependencies: DashboardRouteContext) {
   const { filesystem, readLayout } = dependencies;
@@ -42,12 +43,12 @@ export function registerTraceRoutes(app: Hono, dependencies: DashboardRouteConte
     try {
       const layout = await readLayout();
       const taskId = context.req.param("id");
-      return headOrJson(
-        context,
+      const trace =
         filesystem instanceof SqliteReadModelFileSystem
           ? await buildSqliteTaskTrace(filesystem, layout, taskId)
-          : await buildTaskTrace(filesystem, layout, taskId),
-      );
+          : await buildTaskTrace(filesystem, layout, taskId);
+      const delivery = await traceReleaseDelivery(filesystem, layout, trace);
+      return headOrJson(context, delivery ? { ...trace, release_delivery: delivery } : trace);
     } catch (error) {
       if (error instanceof V2WorkspaceRequiredError) throw error;
       return headOrJson(context, { error: "Task trace not found" }, 404);

package/templates/.agents/dashboard/packages/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaip-ai/dashboard-ui",
-  "version": "7.5.0",
+  "version": "7.6.0",
   "private": true,
   "type": "module",
   "exports": {

package/templates/.agents/dashboard/stack-dependencies.json

@@ -3,11 +3,11 @@
   "node": "22.16.0",
   "packages": [
     { "name": "typescript", "version": "7.0.2", "development": true },
-    { "name": "vite", "version": "8.1.4", "development": true },
-    { "name": "astro", "version": "7.2.4", "development": true },
+    { "name": "vite", "version": "8.1.6", "development": true },
+    { "name": "astro", "version": "7.2.8", "development": true },
     { "name": "redis", "version": "6.2.1", "development": false },
     { "name": "bullmq", "version": "6.2.0", "development": false },
-    { "name": "hono", "version": "4.12.34", "development": false },
+    { "name": "hono", "version": "4.13.11", "development": false },
     { "name": "react", "version": "19.2.7", "development": false },
     { "name": "react-dom", "version": "19.2.7", "development": false }
   ]

package/templates/.agents/dashboard/tests/e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaip-ai/dashboard-e2e",
-  "version": "7.5.0",
+  "version": "7.6.0",
   "private": true,
   "type": "module",
   "scripts": {

package/templates/.agents/design/.zaip-managed.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "version": "7.5.0",
+  "version": "7.6.0",
   "files": [
     {
       "path": "DESIGN.md",
@@ -344,7 +344,7 @@
     },
     {
       "path": "apps/catalog/package.json",
-      "sha256": "f66897db33f87b773d8b4ea90f2f2a8768901c93c0cdfa10669db07c9f48a9b8"
+      "sha256": "f32827d0c7e1d17419abec5a1ebd5567dc31e416c44fbcf62dab716ae6db3214"
     },
     {
       "path": "apps/catalog/public/logo_novo_azul.png",
@@ -532,7 +532,7 @@
     },
     {
       "path": "design-system-maker/build.json",
-      "sha256": "72f11f8707328b968c9a4612949f2bbf71cf7a841cb964700560e8ea15d67dda"
+      "sha256": "946d4d9573678a60ba6a1dee670f37fedce17a0ff3940478ddbc5fc8befc2fee"
     },
     {
       "path": "design-system-maker/frontend/ADAPTATION.md",
@@ -860,7 +860,7 @@
     },
     {
       "path": "packages/local-runtime/package.json",
-      "sha256": "516bb71c6c8d76780bf28a8b04895fc74c936487db9afe784924f767103dfc81"
+      "sha256": "4f790abb693907fa022cf3bac506dcdf7c2201dbc4b95c90da31125538738e00"
     },
     {
       "path": "packages/local-runtime/runtime.mjs",

package/templates/.agents/design/apps/catalog/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaip-ai/design-catalog",
-  "version": "7.5.0",
+  "version": "7.6.0",
   "private": true,
   "type": "module",
   "scripts": {