@zaip-ai/cli 7.5.0 → 7.6.0

package/templates/.agents/runtime/checksums.sha256

@@ -1,11 +1,12 @@
 b146bd0c7c60b1ab43c4f71e0b1d2262c6df6da6f7053a0425f834ccb77a6b48  LICENSE
 bc02cba77e8d51e5c580f43668863dc868eda66f1ff663bfaa49fcf3ca16320e  THIRD_PARTY_NOTICES.md
-738a7f927a20e3184a388ef7fcdbbd6745f22738b7205fccf454e0737dae0294  VERSION
-b3dd42298c1d284e4838a77c794cd6f282ca4cd5dd02f9924ce7a19c7c26f675  bin/zaip.mjs
-e67c5fd26cbfeeddb5f474c7d4a9a6f51a37d85842419d39d2decd835ec2d111  manifest.json
+ed168794d9d7df063a415e5653b0e30779b6004fefbae2a84b96cfbad461d62a  VERSION
+b6b6516200bdb412c92063e887ccef329d7c5193b5610cba5346e97c71301394  bin/historical-catalog-b6b6516200bdb412c92063e887ccef329d7c5193b5610cba5346e97c71301394.mjs
+b9b75c646ab4c6da685335e36fd855e4b110e9b7168476a9f9ef3f8fb098add8  bin/zaip.mjs
+70306752086ae84d604684f64a952429245c68cc68c96aaa5277158b6cab5aef  manifest.json
 7f89219d7c567c82a51679ad136d84364bded7ac659492537e125d33b1d58a7a  migrations/001-layout-v1.json
 5f8c48b286d0b44d8fbb57a9a5d009a8a500439aa3148d750b8f193f72995c9f  migrations/002-layout-v2.json
 a565a60a140384751f84a15824df29ddda4a9dc2c608aca96171d2c75731f0f6  pnpm-lock.sha256
-aacb317929e35a22880495faae95d76ffcbbdb1e650c4545cd629baedaaf72b2  provenance.json
-8b38027b9122081aeadcb4d3bd9976428e38c0c6bdf33da93bf36eb83724ffd4  sbom.cdx.json
+0c3c5460bba91a82f280bc5923f306ac9c1b6a67bb908b88a472de772e1fcd67  provenance.json
+f6fef16eef724861d7a5a13cb5dcde75270b104b44681a3fd9d7561b6e0cc40b  sbom.cdx.json
 b3ffedf9e146be802a15b4009f33e031dec3071ca1525e12c67606fd964a3067  schemas/contracts.schema.json

package/templates/.agents/runtime/manifest.json

@@ -1,12 +1,13 @@
 {
   "schemaVersion": 2,
   "name": "zaip-aios",
-  "version": "7.5.0",
+  "version": "7.6.0",
   "node": ">=22",
   "files": [
     "LICENSE",
     "THIRD_PARTY_NOTICES.md",
     "VERSION",
+    "bin/historical-catalog-b6b6516200bdb412c92063e887ccef329d7c5193b5610cba5346e97c71301394.mjs",
     "bin/zaip.mjs",
     "migrations/001-layout-v1.json",
     "migrations/002-layout-v2.json",

package/templates/.agents/runtime/provenance.json

@@ -2,10 +2,10 @@
   "schema_version": 1,
   "statement_type": "self_reported_build_integrity",
   "authenticity": "unverified",
-  "version": "7.5.0",
+  "version": "7.6.0",
   "source_origin": "zaip-aios:local-build",
   "lockfile_sha256": "4bc8b0268e9eac5d04122c1b38e72ad075d5037ac9082f84c025ae86fe83bfcd",
-  "sbom_sha256": "8b38027b9122081aeadcb4d3bd9976428e38c0c6bdf33da93bf36eb83724ffd4",
-  "runtime_sha256": "8dc9e7d7e6d39ddb4f944b813e5826e058c36408e02f79f712ddd43fbdcd5244",
-  "statement_sha256": "3a672d721e5010bac1565bc95281d20b28b3ad17b1cfeb9c269a0c6787ca0b3c"
+  "sbom_sha256": "f6fef16eef724861d7a5a13cb5dcde75270b104b44681a3fd9d7561b6e0cc40b",
+  "runtime_sha256": "a17a233d253f35db64282a05f664d86b4b9742612c6eaed34ee7a98c6ea0bab1",
+  "statement_sha256": "01db7127e41f37005bad2a3f3ca742764181c2d703b110d76682e496c27ad00d"
 }

package/templates/.agents/runtime/sbom.cdx.json

@@ -6,7 +6,7 @@
     "component": {
       "type": "application",
       "name": "zaip-aios",
-      "version": "7.5.0"
+      "version": "7.6.0"
     }
   },
   "components": [

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-contract.mjs

@@ -18,8 +18,11 @@ import { bindQualifiedPublicationPlan } from "./publication-plan-binding.mjs";
 import { unsupportedPublicationPlan } from "./publication-plan-refusal.mjs";
 import { readPublicationProjectPolicy } from "./publication-project-policy.mjs";
 import {
+  assertNativeClosureAuthority,
+  assertNativeClosureContract,
   assertNativePublicationAuthority,
   assertNativePublicationContract,
+  resolveNativeClosureAuthority,
   resolveNativePublicationAuthority,
 } from "./publication-proof-schema.mjs";
 
@@ -61,16 +64,19 @@ export function repositoryKind({
   return "builder";
 }
 
-export function resolveDeployment({
-  request,
-  policy,
-  identity,
-  conditionProof,
-  nativeAuthority,
-  candidate,
-  destination,
-  projectRestrictions,
-}) {
+function resolveDeploymentForPurpose(
+  {
+    request,
+    policy,
+    identity,
+    conditionProof,
+    nativeAuthority,
+    candidate,
+    destination,
+    projectRestrictions,
+  },
+  purpose,
+) {
   const preference = validatePolicy(policy);
   const kind = repositoryKind(identity);
   const refusal = unsupportedPublicationPlan(request);
@@ -106,7 +112,10 @@ export function resolveDeployment({
     mode = "commits";
   }
   if (nativeAuthority) {
-    assertNativePublicationAuthority(nativeAuthority, request);
+    (purpose === "closure" ? assertNativeClosureAuthority : assertNativePublicationAuthority)(
+      nativeAuthority,
+      request,
+    );
     if (nativeAuthority.constraints.release === "forbidden") {
       assert(
         intent.override !== "release",
@@ -199,8 +208,12 @@ export function resolveDeployment({
   };
   return { ...authorization, contract_sha256: digest(authorization) };
 }
-export function verifyContract(plan, input, expectedMode, expectedPhase = "publish") {
-  const actual = resolveDeployment(input);
+export function resolveDeployment(input) {
+  return resolveDeploymentForPurpose(input, "publication");
+}
+function verifyContractForPurpose(plan, input, expectedMode, expectedPhase, purpose) {
+  if (purpose === "closure") assertNativeClosureAuthority(input.nativeAuthority, input.request);
+  const actual = resolveDeploymentForPurpose(input, purpose);
   assert(
     actual.mode === expectedMode && actual.phase === expectedPhase,
     "Deployment intent does not authorize this delivery route",
@@ -210,72 +223,31 @@ export function verifyContract(plan, input, expectedMode, expectedPhase = "publi
     "Deployment contract changed; resolve again before any mutation",
   );
   if (input.nativeAuthority && actual.phase === "publish")
-    assertNativePublicationContract(input.nativeAuthority, actual);
+    (purpose === "closure" ? assertNativeClosureContract : assertNativePublicationContract)(
+      input.nativeAuthority,
+      actual,
+    );
   return actual;
 }
-export function nextRelease(
-  tags = [],
-  {
-    major = false,
-    publishedSha = null,
-    candidateSha = null,
-    publishedTag = null,
-    existingTag = null,
-    existingTagSha = null,
-  } = {},
-) {
-  assert(
-    Array.isArray(tags) && tags.every((x) => typeof x === "string"),
-    "Verified tag list required",
-  );
-  const valid = tags
-    .map((tag) => /^v(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/.exec(tag))
-    .filter(Boolean);
-  valid.sort((a, b) =>
-    BigInt(a[1]) === BigInt(b[1])
-      ? BigInt(a[2]) < BigInt(b[2])
-        ? -1
-        : BigInt(a[2]) > BigInt(b[2])
-          ? 1
-          : 0
-      : BigInt(a[1]) < BigInt(b[1])
-        ? -1
-        : 1,
-  );
-  if (publishedSha && publishedSha === candidateSha) {
-    assert(
-      /^[a-f0-9]{40}$/i.test(candidateSha ?? "") &&
-        tags.includes(publishedTag) &&
-        /^v(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(publishedTag ?? ""),
-      "Published identity must include its verified tag and SHA",
-    );
-    return { action: "verify-existing", tag: publishedTag, create_release: false };
-  }
-  if (existingTag) {
-    assert(
-      /^v(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(existingTag) &&
-        /^[a-f0-9]{40}$/i.test(candidateSha ?? "") &&
-        existingTagSha === candidateSha,
-      "Retry requires the exact existing tag and candidate SHA",
-    );
-    return { action: "resume", tag: existingTag, create_release: false };
-  }
-  const last = valid.at(-1);
-  const version = !last
-    ? "1.0"
-    : major
-      ? `${BigInt(last[1]) + 1n}.0`
-      : `${last[1]}.${BigInt(last[2]) + 1n}`;
-  return { action: "new", tag: `v${version}`, version, create_release: true };
+export function verifyContract(plan, input, expectedMode, expectedPhase = "publish") {
+  return verifyContractForPurpose(plan, input, expectedMode, expectedPhase, "publication");
+}
+export function verifyClosureContract(plan, input) {
+  assert(plan.kind === "builder", "Closure requires the original builder release contract");
+  return verifyContractForPurpose(plan, input, "release", "publish", "closure");
 }
-export async function readDeploymentInput(repository, request, options = {}) {
+export { nextRelease } from "./deployment-next-release.mjs";
+
+async function readDeploymentInputForPurpose(repository, request, options, purpose) {
   const root = await realpath(resolve(repository));
   assert(
     (await realpath(git(root, ["rev-parse", "--show-toplevel"]))) === root,
     "Use the exact Git workspace root",
   );
   const sourceRunId = options.source_run_id ?? options.condition?.authorization_run_id;
-  const nativeAuthority = await resolveNativePublicationAuthority(root, request, sourceRunId);
+  const nativeAuthority = await (purpose === "closure"
+    ? resolveNativeClosureAuthority
+    : resolveNativePublicationAuthority)(root, request, sourceRunId);
   if (requestedDeployment(request).completionOnly) {
     const policy = JSON.parse(git(root, ["show", "HEAD:.github/ci-validation.json"]));
     assert(
@@ -348,6 +320,13 @@ export async function readDeploymentInput(repository, request, options = {}) {
     identity,
   };
 }
+export function readDeploymentInput(repository, request, options = {}) {
+  return readDeploymentInputForPurpose(repository, request, options, "publication");
+}
+export function readClosureDeploymentInput(repository, request, options = {}) {
+  assert(!options.condition, "publication_closure_conditional_authority_unsupported");
+  return readDeploymentInputForPurpose(repository, request, options, "closure");
+}
 export async function main() {
   const { values } = parseArgs({
     options: {

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-idempotent-intent.test.mjs

@@ -15,6 +15,45 @@ const plan = (request, identity = builder, policy) =>
   resolveDeployment({ request, identity, policy });
 const checkedAdjustments =
   "verifique se foi feito deploy da v7.5. Se ainda não, faça os ajustes necessários para realizar o deploy corretamente. Garanta que o deploy seja feito.";
+const distributionRecovery =
+  "revise se o deploy foi feito no github e no npm, caso contrário resolva as pendencias, faça os ajustes necessários e garanta o deploy feito.";
+
+test("check both distribution surfaces and repair only missing publication", () => {
+  for (const request of [
+    distributionRecovery,
+    "Verifique se o deploy foi feito no GitHub e no npm, caso contrário faça deploy!",
+    "Confira se deploy foi feito no github e no npm, caso contrário faça os ajustes necessários e faça o deploy",
+  ]) {
+    const resolved = plan(request);
+    assert.equal(resolved.phase, "publish");
+    assert.equal(resolved.mode, "release");
+    assert.equal(resolved.version, null);
+    assert.equal(resolved.scope, "current-work");
+    assert.equal(resolved.completion_only, "github-and-npm");
+    assert.equal(resolved.npm_publication, true);
+    assert.equal(plan(request, consumer).mode, "none");
+  }
+});
+
+test("distribution recovery retains provenance, holds and exact scope", () => {
+  for (const request of [
+    `"${distributionRecovery}"`,
+    `Ele disse: ${distributionRecovery}`,
+    `Exemplo: ${distributionRecovery}`,
+    `${distributionRecovery}?`,
+    `Não ${distributionRecovery}`,
+    `${distributionRecovery} Só publique com minha autorização.`,
+    `${distributionRecovery} se eu aprovar`,
+    `${distributionRecovery} de tudo`,
+    `${distributionRecovery} e publique a v7.7`,
+    distributionRecovery.replace("garanta o deploy feito", "não faça deploy"),
+    distributionRecovery.replace(" e garanta o deploy feito", ""),
+    distributionRecovery.split(", caso contrário")[0],
+  ]) {
+    assert.notEqual(plan(request).phase, "publish", request);
+    assert.notEqual(plan(request).npm_publication, true, request);
+  }
+});
 
 test("complete only missing GitHub or npm delivery of the same explicit release", () => {
   const request =

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deployment-next-release.mjs

@@ -0,0 +1,57 @@
+import { assert } from "./deployment-request.mjs";
+
+export function nextRelease(
+  tags = [],
+  {
+    major = false,
+    publishedSha = null,
+    candidateSha = null,
+    publishedTag = null,
+    existingTag = null,
+    existingTagSha = null,
+  } = {},
+) {
+  assert(
+    Array.isArray(tags) && tags.every((x) => typeof x === "string"),
+    "Verified tag list required",
+  );
+  const valid = tags
+    .map((tag) => /^v(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/.exec(tag))
+    .filter(Boolean);
+  valid.sort((a, b) =>
+    BigInt(a[1]) === BigInt(b[1])
+      ? BigInt(a[2]) < BigInt(b[2])
+        ? -1
+        : BigInt(a[2]) > BigInt(b[2])
+          ? 1
+          : 0
+      : BigInt(a[1]) < BigInt(b[1])
+        ? -1
+        : 1,
+  );
+  if (publishedSha && publishedSha === candidateSha) {
+    assert(
+      /^[a-f0-9]{40}$/i.test(candidateSha ?? "") &&
+        tags.includes(publishedTag) &&
+        /^v(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(publishedTag ?? ""),
+      "Published identity must include its verified tag and SHA",
+    );
+    return { action: "verify-existing", tag: publishedTag, create_release: false };
+  }
+  if (existingTag) {
+    assert(
+      /^v(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(existingTag) &&
+        /^[a-f0-9]{40}$/i.test(candidateSha ?? "") &&
+        existingTagSha === candidateSha,
+      "Retry requires the exact existing tag and candidate SHA",
+    );
+    return { action: "resume", tag: existingTag, create_release: false };
+  }
+  const last = valid.at(-1);
+  const version = !last
+    ? "1.0"
+    : major
+      ? `${BigInt(last[1]) + 1n}.0`
+      : `${last[1]}.${BigInt(last[2]) + 1n}`;
+  return { action: "new", tag: `v${version}`, version, create_release: true };
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deployment-request.mjs

@@ -64,6 +64,21 @@ export function requestedDeployment(request) {
       scope: "current-work",
       completionOnly: true,
     };
+  // Both explicitly requested surfaces require the builder's existing release
+  // completion path. The active cycle supplies the version; no scope is widened.
+  if (
+    /^(?:revise|verifique|confira) se (?:o )?deploy foi feito no github e no npm, caso contrario (?:resolva as pendencias, )?(?:faca os ajustes necessarios e )?(?:faca (?:o )?deploy|garanta o deploy feito)[.!]?$/.test(
+      text,
+    )
+  )
+    return {
+      authorized: true,
+      override: "release",
+      version: null,
+      phase: "publish",
+      scope: "current-work",
+      completionOnly: true,
+    };
   // Checking whether delivery already happened is the existing idempotency gate,
   // not a pending human approval. Accept only this complete bounded instruction.
   const verifyThenDeploy =

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/publication-intent.mjs

@@ -1,4 +1,4 @@
-// Generated from packages/core/src/authorization/publication-intent.ts; sha256=72ffe2de36705c3947d4f7436dad1f853318741eb7c97741dadb2533aeb595ec
+// Generated from packages/core/src/authorization/publication-intent.ts; sha256=e5d855489d0833801d4cd58e88a27f6889813c1212712f44a481267f3a5523d8
 /** Intent only: this parser never proves a condition or grants publication. */
 export function inspectPublicationIntent(source) {
   const text = source
@@ -18,6 +18,9 @@ export function inspectPublicationIntent(source) {
       text,
     );
   const idempotentCheck =
+    /^(?:revise|verifique|confira) se (?:o )?deploy foi feito no github e no npm, caso contrario (?:resolva as pendencias, )?(?:faca os ajustes necessarios e )?(?:faca (?:o )?deploy|garanta o deploy feito)[.!]?$/.test(
+      text,
+    ) ||
     /^(?:revise|verifique|confira) se (?:ja )?foi feito (?:o )?deploy, caso contrario faca deploy(?: (?:da|de) v?(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))?[.!]?$/.test(
       text,
     ) ||