@zalosai/zalos-cli 0.2.16 → 0.2.17

package/PUBLISHING.md

@@ -59,6 +59,9 @@ Do not publish with uncommitted package changes or reuse an existing version.
 
 ## Central developer access release
 
+Version 0.2.17 bundles Custom Page authoring guidance for team-local navigation and self-contained
+downloads. Custom Page navigation never starts workflows, and downloads are limited to supplied
+in-memory content.
 Version 0.2.15 bundles the `zl-ops` production-operations skill and adds offline `zl skills`
 commands to list, read, and install it into Codex or Claude skill roots.
 Version 0.2.16 adds `zl execution replay export`, which materializes a SHA-256-verified local

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zalosai/zalos-cli",
-  "version": "0.2.16",
+  "version": "0.2.17",
   "description": "API-only product command-line interface for Zalos",
   "repository": {
     "type": "git",

package/skills/custom-page-authoring/SKILL.md

@@ -17,9 +17,10 @@ If the request is to reproduce a third-party portal, preserve that portal's appe
 ## Packaging and navigation
 
 Produce one HTML file with embedded CSS, fonts, JavaScript, and data/SVG images, under the 1,000,000 UTF-8 byte upload limit. No CDN scripts, network fetches, external images, cookies, localStorage, popup windows, or dependence on the parent DOM. The iframe has scripts enabled but no same-origin privileges. Use in-memory state. Prefer type=button and click handlers; remote form submission is blocked.
-Use `mesh.navigate('/agents')` in an HTML button to navigate within the current Mesh team. Preview shows the destination without navigating. Workflow launch actions are unavailable in Custom Pages.
+Use `mesh.navigate('/agents')` in an HTML button to navigate within the current Mesh team. Existing links with a current-team `/t/<team-id>/...` path also navigate in the host. Preview shows the destination without navigating. Workflow launch actions are unavailable in Custom Pages.
 Preserve the behavior of supplied examples when importing them; replace unsupported actions only when requested.
 For a button that opens another page in the current Mesh team, call `mesh.navigate('/agents')` with an app-local path. Preview reports the destination without navigating. Full URLs, protocol-relative URLs, and another team's `/t/...` path are rejected. The host applies the current team prefix; do not build it into the HTML.
+For a self-contained export, call `mesh.download('report.csv', csv, 'text/csv;charset=utf-8')`. It downloads generated UTF-8 content up to 10 MB. To export a binary file, pass base64 content as the second argument and `base64` as the fourth argument. The host never fetches download content from a URL.
 
 ## Iteration