@dzhechkov/cloudru-hub 0.1.13 → 0.1.15

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@dzhechkov/cloudru-hub",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "licenseHold": {
     "adr": "features/hermes-claude-adaptation/03_adr/001-licence-and-provenance-precondition.md",
-    "note": "SATISFIED hold (ADR-001 AM-2, grant recorded 2026-08-12 — see grant-record-2026-08-12.md). The field deliberately STAYS: the dz guard `licence-hold` rule passes a satisfied hold with the trigger in place and keeps verifying LICENSE (no PENDING placeholder, Grant-Confirmation URL), THIRD_PARTY_NOTICES and the SPDX license field on every publish. test/pack-holds.test.mjs goes RED if this field is dropped or the LICENSE grant record is degraded."
+    "note": "SATISFIED hold. Timur is credited for substantial Cloud.ru API testing. The 2026-10-20 correction is in the historical grant record. This field keeps the dz guard licence-hold rule checking LICENSE, THIRD_PARTY_NOTICES and SPDX on every publish."
   },
   "description": "Unofficial Cloud.ru Evolution launcher with a pinned cloud-write-blocking MCP proxy for Codex, Hermes, OpenCode and Pi, Claude Code permissions, and skill dialect compiler. Engine binary resolved at runtime, never bundled. NOT affiliated with Cloud.ru.",
   "main": "src/cli.js",
@@ -26,7 +26,7 @@
   ],
   "cloudruHub": {
     "binaryHashes": {
-      "linux-x64": "89c5073418927ee71ac1de381eaba5ab69d599d615edc51b868d876e712dbf10"
+      "linux-x64": "4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6"
     },
     "engineVersion": "cloudru-vm 0.2.6-20261020",
     "platformPackages": {
@@ -52,13 +52,16 @@
   "dependencies": {
     "yaml": "^2.9.0"
   },
+  "optionalDependencies": {
+    "@dzhechkov/cloudru-vm-linux-x64": "0.2.6"
+  },
   "scripts": {
     "test": "node --test 'test/*.test.mjs'"
   },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/djd1m/dz-harness.git",
-    "directory": "packages/@dzhechkov/cloudru-hub"
+    "directory": "packages/cloudru-hub"
   },
   "homepage": "https://aicoding.space",
   "bugs": {

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d2be06e900ab3d02d367ff5d91129ef3faa9a16e1afac6fba8ae9cec4a51c322"
+          "content": "2b0dbd83deb813844a658814b9a6fa1640f1e5255c676210e61dceaa6b42195b"
         }
       ]
     },
@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "68da42b10dcc095cdfd7249557cee30285664e5dea00dc85475ff047d975616a"
+          "content": "78a14ae697528fa79451ea10725c5ca356f6658378bfb39849b51d05207ab3f3"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c505a9bb7ab6f8d9fbe1cac64e22b12ec14f674f979af7120457b8ba49039484"
+          "content": "4f6a2d5928fec42f021eb10471677b902e831b99d53096661a821f6460bd55a6"
         }
       ]
     },
@@ -45,7 +45,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "109cffdaaf9402e88f6cc35a0497ba49db015b329fce87ba20762f34dc95c051"
+          "content": "1986a75d5f90631adea8fb40c9fc182371cb875c9d62d65d07fd479b32c876df"
         }
       ]
     },
@@ -85,7 +85,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b1216e31ed28655ea99d9ef06d82d4d35d5499bad1ecadc8e7051e8c74bd7c97"
+          "content": "9abb3ca6347b0cd6cd51b23649c59e0a0c816e6c12a325f573b392affa350d0b"
         }
       ]
     },
@@ -95,7 +95,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c9f53d02b7ee06791eac22214ca91e999aeec2ee4dbd53b6a27dc46d4e5bcbc2"
+          "content": "dff98bb859dfbbf8ed2fb6f16f17b767444cc2172ecc7684ca3df8188c95707c"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "docs/COST-COMPARE.md",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "80b4d7ac3868f17d93565274cd6736fe5f2bd7fb059cbed0c2f0afe3f4924317"
         }
       ]
     },
@@ -105,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "08e1e83985c31b51aa053811b1b6a76fb1960323c5ccb8ae1d5fdd8b91b8df11"
+          "content": "3605797972f9a7c79c13fbcce0cd9ac8b8fb3a8249abbab938f2b1a45f515420"
         }
       ]
     },
@@ -115,7 +125,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f043a370b9f23b2efc6c64702ab358ee168b6c9cd1b5d9efe4a9da287274e42c"
+          "content": "de6f709e820fbb831f390e274238b28ba938644670a8db04fd50d1fa0d86da75"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "docs/cost-compare.example.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "7eafb1ff555fb5443ded1a2c578b17eae6e73e3056efb9cbb5129b424c8c5097"
         }
       ]
     },
@@ -129,7 +149,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "671ebb618e9d0a939a047433791cd9a34e502339596d11a697b50fb32a0694ec"
+          "value": "1b355df670fb092da7ce8956141e702f9f78e1e2f2724c6aaba61bbab2acd8c8"
         }
       ]
     },
@@ -149,7 +169,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "af553e9261300eb46240212eb03b01ccc17234fed1a9f1587d5784f3bfacb5f4"
+          "content": "b1bd4a0ce7f1ca869c2873ca1979a74630483ee2909ff8b4f91189622f5aa2a7"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/cost-compare.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "6084ecd7f7fc53bbd441fb9e91dcd7c7bd5c409d1d4e95613fad0fd0735b7b05"
         }
       ]
     },
@@ -219,7 +249,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5cbd0861c2973fab62271269b10f748b9638e74f40e8ea034f78ac63bed58001"
+          "content": "d3eba14c23be5bfb7e73952e6ae27908667d535f91be9c43e11dbf7b7c4de49d"
         }
       ]
     },
@@ -273,6 +303,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "test/cost-compare.test.mjs",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "b354913220bf725ec6b8a708b7851e2f5779a3c594cd411732d19acad9001870"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "test/deploy-approval.test.mjs",
@@ -349,7 +389,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a083ff619f1d97b3e0e1b95dec6e98b56c4296da5171e2eb41c713dd983c8d69"
+          "content": "f5e66cce7344efb22c40bba91b422ce84979948b66bb0305377f8c12eb078002"
         }
       ]
     },
@@ -359,7 +399,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3b695381c2df4f5b592b377bd3ef5b3f3953af9f6f140600cfcddc975563bffc"
+          "content": "9ad83ba418dee86ef680575a0cc7da4af4be3ae995c00f23f84b336838fbda47"
         }
       ]
     },

package/src/cli.js

@@ -3,21 +3,27 @@
 // Zero dependencies, CommonJS, boots from any cwd (dz release smoke contract).
 
 const { spawn, spawnSync } = require('child_process');
-const { resolveEngine } = require('./resolve');
-const { loadClassification, loadSnapshot, coverageGaps } = require('./classification');
-const { install } = require('./install');
-const { runSafeMcp } = require('./safe-mcp');
-const { issueApproval } = require('./deploy-approval');
-const { issueK8sApproval } = require('./k8s-approval');
-const { compileSkill, writeCompiled } = require('./dialects');
 const PKG = require('../package.json');
+let resolveEngine, loadClassification, loadSnapshot, coverageGaps, install, runSafeMcp;
+let issueApproval, issueK8sApproval, compileSkill, writeCompiled;
+let legacyLoaded = false;
+function loadLegacyCommands() {
+  if (legacyLoaded) return;
+  ({ resolveEngine } = require('./resolve'));
+  ({ loadClassification, loadSnapshot, coverageGaps } = require('./classification'));
+  ({ install } = require('./install'));
+  ({ runSafeMcp } = require('./safe-mcp'));
+  ({ issueApproval } = require('./deploy-approval'));
+  ({ issueK8sApproval } = require('./k8s-approval'));
+  ({ compileSkill, writeCompiled } = require('./dialects'));
+  legacyLoaded = true;
+}
 
 function showHelp(write) {
   write(`cloudru-hub ${PKG.version} — unofficial Cloud.ru Evolution launcher (NOT affiliated with Cloud.ru)
 
 The cloudru-vm engine binary is resolved at RUNTIME, never bundled in this package.
-Engine additions authored by Тимур (publication approved — grant record in LICENSE Part 2);
-launcher, adapters and CLI foundation by Dmitry Zhechkov (MIT).
+Тимур contributed extensive Cloud.ru API testing and identified API defects.
 
 Usage: cloudru-hub <command> [options]
 
@@ -33,6 +39,8 @@ Commands:
                            Static sites require the artifact digest shown by deploy_plan.
   k8s-approve --cluster-id <uuid> --namespace <name> --manifest <file> --manifest-sha256 <digest>
                            Authorize one exact three-resource Snake manifest on an existing cluster.
+  cost-compare --input <json> [--json]
+                           Offline VM vs Kubernetes cost worksheet; no engine or credentials.
   install --target <t>     claude-code: permissions + executed hook probe;
                            codex|opencode|pi: project MCP config using mcp-safe;
                            hermes: guarded $HERMES_HOME/config.yaml entry using mcp-safe;
@@ -140,6 +148,9 @@ function cmdMcp() {
 }
 
 function main(argv, write = (s) => process.stdout.write(s + '\n')) {
+  // This command validates its raw flags before the permissive legacy parser sees them.
+  if (argv[0] === 'cost-compare') return require('./cost-compare').run(argv.slice(1), write);
+  loadLegacyCommands();
   const { flags, opts, positional } = parseArgs(argv);
   const cmd = positional[0] || 'help';
   if (flags.has('help') || flags.has('h') || cmd === 'help') { showHelp(write); return 0; }

package/src/cost-compare.js

@@ -0,0 +1,348 @@
+'use strict';
+
+// Offline worksheet. All money and resource divisions use integer decimal arithmetic.
+const fs = require('fs');
+
+const MAX_INPUT = 128 * 1024;
+const MAX_MONEY = 10n ** 18n;
+const CATEGORIES = Object.freeze({
+  compute: 'instance-hour',
+  controlPlane: 'instance-hour',
+  storage: 'GB-hour',
+  publicIp: 'IP-hour',
+  snat: 'gateway-hour',
+  loadBalancer: 'LB-hour',
+  traffic: 'traffic-GB',
+});
+const TIME_UNITS = new Set(['instance-hour', 'GB-hour', 'IP-hour', 'gateway-hour', 'LB-hour']);
+
+function fail(path, message) { throw new Error(`${path}: ${message}`); }
+function record(value, path, keys) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) fail(path, 'must be an object');
+  for (const key of Object.keys(value)) if (!keys.includes(key)) fail(`${path}.${key}`, 'unknown field');
+  return value;
+}
+function required(obj, key, path) {
+  if (!Object.hasOwn(obj, key)) fail(`${path}.${key}`, 'required');
+  return obj[key];
+}
+function positiveInteger(value, path, max = 1000000, zero = false) {
+  if (!Number.isSafeInteger(value) || value < (zero ? 0 : 1) || value > max) fail(path, `must be an integer from ${zero ? 0 : 1} to ${max}`);
+  return value;
+}
+function words(value, path, max = 500) {
+  if (typeof value !== 'string' || !value.trim() || value.length > max || /[\x00-\x1f\x7f]/.test(value)) fail(path, 'must be a nonempty bounded single-line string');
+  return value;
+}
+function decimal(value, path, { zero = false, max = 1000000000n } = {}) {
+  if (typeof value !== 'string' || !/^(?:0|[1-9]\d{0,12})(?:\.\d{1,9})?$/.test(value)) fail(path, 'must be a non-negative decimal string with at most 9 fractional places');
+  const [whole, fraction = ''] = value.split('.');
+  const coefficient = BigInt(whole + fraction);
+  const scale = 10n ** BigInt(fraction.length);
+  if ((!zero && coefficient === 0n) || coefficient > max * scale) fail(path, `must be ${zero ? 'non-negative' : 'positive'} and at most ${max}`);
+  return { coefficient, scale };
+}
+const integerDecimal = value => ({ coefficient: BigInt(value), scale: 1n });
+const multiply = (a, b) => ({ coefficient: a.coefficient * b.coefficient, scale: a.scale * b.scale });
+const subtract = (a, b) => ({ coefficient: a.coefficient * b.scale - b.coefficient * a.scale, scale: a.scale * b.scale });
+const compare = (a, b) => a.coefficient * b.scale < b.coefficient * a.scale ? -1 : a.coefficient * b.scale > b.coefficient * a.scale ? 1 : 0;
+function add(a, b) { return { coefficient: a.coefficient * b.scale + b.coefficient * a.scale, scale: a.scale * b.scale }; }
+function exact(value) {
+  const whole = value.coefficient / value.scale;
+  const remainder = value.coefficient % value.scale;
+  if (!remainder) return String(whole);
+  return `${whole}.${String(remainder).padStart(String(value.scale).length - 1, '0').replace(/0+$/, '')}`;
+}
+function display(value) {
+  const cents = (value.coefficient * 200n + value.scale) / (2n * value.scale);
+  return `${cents / 100n}.${String(cents % 100n).padStart(2, '0')}`;
+}
+function monetary(value, path) {
+  if (value.coefficient < 0n || value.coefficient > MAX_MONEY * value.scale) fail(path, 'amount exceeds supported RUB magnitude');
+  return value;
+}
+function slots(usable, perReplica, path) {
+  const count = usable.coefficient * perReplica.scale / (usable.scale * perReplica.coefficient);
+  if (count > 1000000n) fail(path, 'per-node capacity exceeds supported bound');
+  return Number(count);
+}
+
+// JSON.parse discards duplicate members and rounds large/fractional numeric tokens.
+// Inspect the bounded original text first, including decoded spellings of object keys.
+function validateJsonLexemes(text) {
+  const number = /-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+  let offset = 0, tokens = 0;
+  const bad = message => fail('--input', message);
+  const space = () => { while (offset < text.length && /[ \t\r\n]/.test(text[offset])) offset++; };
+  const count = () => { if (++tokens > 10000) bad('JSON has too many members or values'); };
+  const string = () => {
+    const start = offset++;
+    while (offset < text.length) {
+      if (text[offset] === '\\') { offset += 2; continue; }
+      if (text[offset++] === '"') {
+        try { return JSON.parse(text.slice(start, offset)); }
+        catch { bad('invalid JSON string'); }
+      }
+    }
+    bad('unterminated JSON string');
+  };
+  const value = depth => {
+    count();
+    if (depth > 64) bad('JSON nesting exceeds 64 levels');
+    space();
+    const marker = text[offset];
+    if (marker === '{') {
+      offset++; space();
+      const seen = new Set();
+      if (text[offset] === '}') { offset++; return; }
+      while (true) {
+        if (text[offset] !== '"') bad('object member must be a JSON string');
+        count();
+        const key = string();
+        if (seen.has(key)) bad('duplicate decoded object member');
+        seen.add(key);
+        space();
+        if (text[offset++] !== ':') bad('object member requires a colon');
+        value(depth + 1); space();
+        const separator = text[offset++];
+        if (separator === '}') return;
+        if (separator !== ',') bad('object member requires a comma or closing brace');
+        space();
+      }
+    }
+    if (marker === '[') {
+      offset++; space();
+      if (text[offset] === ']') { offset++; return; }
+      while (true) {
+        value(depth + 1); space();
+        const separator = text[offset++];
+        if (separator === ']') return;
+        if (separator !== ',') bad('array element requires a comma or closing bracket');
+      }
+    }
+    if (marker === '"') { string(); return; }
+    for (const literal of ['true', 'false', 'null']) if (text.startsWith(literal, offset)) { offset += literal.length; return; }
+    number.lastIndex = offset;
+    const match = number.exec(text);
+    if (!match) bad('invalid JSON value or number');
+    const lexeme = match[0];
+    offset = number.lastIndex;
+    if (!/^(?:0|[1-9]\d*)$/.test(lexeme) || lexeme.length > 16 || BigInt(lexeme) > BigInt(Number.MAX_SAFE_INTEGER)) {
+      bad('numeric tokens must be canonical non-negative safe integers; decimals must be strings');
+    }
+  };
+  space(); value(0); space();
+  if (offset !== text.length) bad('trailing or malformed JSON token');
+}
+
+function readInput(path) {
+  words(path, '--input', 4096);
+  const flags = fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK;
+  const fd = fs.openSync(path, flags);
+  try {
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile() || stat.size > MAX_INPUT) fail('--input', 'must be a regular file of at most 128 KiB');
+    const chunks = [], buffer = Buffer.alloc(8192);
+    let length = 0, read;
+    while ((read = fs.readSync(fd, buffer, 0, Math.min(buffer.length, MAX_INPUT + 1 - length), null)) > 0) {
+      chunks.push(Buffer.from(buffer.subarray(0, read)));
+      length += read;
+      if (length > MAX_INPUT) fail('--input', 'file exceeds 128 KiB');
+    }
+    const bytes = Buffer.concat(chunks), text = bytes.toString('utf8');
+    if (!Buffer.from(text).equals(bytes)) fail('--input', 'must be valid UTF-8');
+    validateJsonLexemes(text);
+    return JSON.parse(text);
+  } finally { fs.closeSync(fd); }
+}
+
+function tariff(value, path, vatBasis) {
+  record(value, path, ['url', 'version', 'asOf', 'vatBasis', 'pageOrRow', 'sha256']);
+  const url = words(required(value, 'url', path), `${path}.url`, 1000);
+  if (!/^https:\/\/[^\s/@?#]+(?:[/?#][^\s]*)?$/.test(url)) fail(`${path}.url`, 'must be an HTTPS tariff URL');
+  words(required(value, 'version', path), `${path}.version`, 100);
+  const asOf = required(value, 'asOf', path);
+  if (typeof asOf !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(asOf) || Number.isNaN(Date.parse(`${asOf}T00:00:00Z`)) || new Date(`${asOf}T00:00:00Z`).toISOString().slice(0, 10) !== asOf) fail(`${path}.asOf`, 'must be a valid YYYY-MM-DD date');
+  if (required(value, 'vatBasis', path) !== vatBasis) fail(`${path}.vatBasis`, 'must match the common VAT basis');
+  words(required(value, 'pageOrRow', path), `${path}.pageOrRow`, 100);
+  if (value.sha256 !== undefined && (typeof value.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(value.sha256))) fail(`${path}.sha256`, 'must be lowercase SHA-256');
+  return value;
+}
+
+function category(value, path, name, expected, horizon, vatBasis) {
+  record(value, path, ['status', 'reason', 'items']);
+  const status = required(value, 'status', path);
+  if (!['priced', 'not-used', 'unpriced'].includes(status)) fail(`${path}.status`, 'must be priced, not-used or unpriced');
+  if (status !== 'priced') {
+    if (value.items !== undefined) fail(`${path}.items`, 'allowed only when priced');
+    const reason = words(required(value, 'reason', path), `${path}.reason`);
+    if (status === 'not-used' && (expected === null || expected.coefficient !== 0n)) fail(path, 'not-used requires a declared zero quantity');
+    if (status === 'unpriced' && expected !== null && expected.coefficient === 0n) fail(path, 'declared zero quantity must be not-used');
+    return { status, reason, items: [], totalRubExact: null, totalRubDisplay: null };
+  }
+  if (value.reason !== undefined) fail(`${path}.reason`, 'allowed only when unpriced or not-used');
+  if (expected === null || expected.coefficient === 0n) fail(path, 'priced requires a positive declared quantity');
+  const items = required(value, 'items', path);
+  if (!Array.isArray(items) || !items.length || items.length > 16) fail(`${path}.items`, 'must have 1 to 16 items');
+  const seen = new Set();
+  let quantitySum = integerDecimal(0), total = integerDecimal(0);
+  const result = items.map((item, index) => {
+    const at = `${path}.items[${index}]`;
+    record(item, at, ['id', 'description', 'quantity', 'unit', 'rateRub', 'tariff']);
+    const id = words(required(item, 'id', at), `${at}.id`, 80);
+    if (!/^[a-z][a-z0-9-]*$/.test(id) || seen.has(id)) fail(`${at}.id`, 'must be a unique slug');
+    seen.add(id);
+    words(required(item, 'description', at), `${at}.description`);
+    const q = decimal(required(item, 'quantity', at), `${at}.quantity`);
+    if (required(item, 'unit', at) !== CATEGORIES[name]) fail(`${at}.unit`, `must be ${CATEGORIES[name]}`);
+    if (['compute', 'controlPlane', 'publicIp', 'snat', 'loadBalancer'].includes(name) && q.scale !== 1n) fail(`${at}.quantity`, 'must be an integer service count');
+    const rate = decimal(required(item, 'rateRub', at), `${at}.rateRub`);
+    tariff(required(item, 'tariff', at), `${at}.tariff`, vatBasis);
+    quantitySum = add(quantitySum, q);
+    const amount = monetary(multiply(multiply(q, rate), TIME_UNITS.has(item.unit) ? horizon : integerDecimal(1)), `${at}.amount`);
+    total = monetary(add(total, amount), `${path}.total`);
+    return { ...item, amountRubExact: exact(amount), amountRubDisplay: display(amount), formula: TIME_UNITS.has(item.unit) ? `${item.quantity} ${item.unit.slice(0, -5)} × ${item.rateRub} RUB/${item.unit} × ${exact(horizon)} hours` : `${item.quantity} ${item.unit} × ${item.rateRub} RUB/${item.unit} once` };
+  });
+  if (compare(quantitySum, expected) !== 0) fail(`${path}.items`, `quantities must sum to declared ${exact(expected)} ${CATEGORIES[name]}`);
+  return { status, items: result, totalRubExact: exact(total), totalRubDisplay: display(total), _total: total };
+}
+
+function scenario(value, path, workload, horizon, vatBasis) {
+  record(value, path, ['id', 'kind', 'nodes', 'controlPlaneCount', 'resources', 'categories']);
+  const id = words(required(value, 'id', path), `${path}.id`, 80);
+  if (!/^[a-z][a-z0-9-]*$/.test(id)) fail(`${path}.id`, 'must be a slug');
+  const kind = required(value, 'kind', path);
+  if (!['vm', 'k8s'].includes(kind)) fail(`${path}.kind`, 'must be vm or k8s');
+  const node = record(required(value, 'nodes', path), `${path}.nodes`, ['count', 'cpu', 'ramGB', 'reservedCpu', 'reservedRamGB', 'cpuShare']);
+  const count = positiveInteger(required(node, 'count', `${path}.nodes`), `${path}.nodes.count`, 1000);
+  if (workload.failedNodes > count) fail(`${path}.nodes.count`, 'must be at least the declared failedNodes');
+  const cpu = decimal(required(node, 'cpu', `${path}.nodes`), `${path}.nodes.cpu`, { max: 10000n });
+  const ram = decimal(required(node, 'ramGB', `${path}.nodes`), `${path}.nodes.ramGB`, { max: 1000000n });
+  const share = decimal(required(node, 'cpuShare', `${path}.nodes`), `${path}.nodes.cpuShare`, { max: 1n });
+  const reservedCpu = decimal(required(node, 'reservedCpu', `${path}.nodes`), `${path}.nodes.reservedCpu`, { zero: true, max: 10000n });
+  const reservedRam = decimal(required(node, 'reservedRamGB', `${path}.nodes`), `${path}.nodes.reservedRamGB`, { zero: true, max: 1000000n });
+  const guaranteedCpu = multiply(cpu, share);
+  if (compare(reservedCpu, guaranteedCpu) > 0 || compare(reservedRam, ram) > 0) fail(`${path}.nodes`, 'reservations exceed guaranteed CPU or RAM');
+  const controlPlaneCount = positiveInteger(required(value, 'controlPlaneCount', path), `${path}.controlPlaneCount`, 1000, kind === 'vm');
+  if (kind === 'vm' && controlPlaneCount !== 0) fail(`${path}.controlPlaneCount`, 'VM must declare zero control-plane service instances');
+  const resources = record(required(value, 'resources', path), `${path}.resources`, ['storageGB', 'publicIpCount', 'snatGatewayCount', 'loadBalancerCount', 'trafficGB']);
+  const storage = decimal(required(resources, 'storageGB', `${path}.resources`), `${path}.resources.storageGB`, { zero: true });
+  const publicIp = positiveInteger(required(resources, 'publicIpCount', `${path}.resources`), `${path}.resources.publicIpCount`, 1000000, true);
+  const snat = positiveInteger(required(resources, 'snatGatewayCount', `${path}.resources`), `${path}.resources.snatGatewayCount`, 1000000, true);
+  const lb = positiveInteger(required(resources, 'loadBalancerCount', `${path}.resources`), `${path}.resources.loadBalancerCount`, 1000000, true);
+  const trafficValue = required(resources, 'trafficGB', `${path}.resources`);
+  const traffic = trafficValue === null ? null : decimal(trafficValue, `${path}.resources.trafficGB`, { zero: true });
+  const expected = { compute: integerDecimal(count), controlPlane: integerDecimal(controlPlaneCount), storage, publicIp: integerDecimal(publicIp), snat: integerDecimal(snat), loadBalancer: integerDecimal(lb), traffic };
+  const raw = record(required(value, 'categories', path), `${path}.categories`, Object.keys(CATEGORIES));
+  const categories = {}, unpriced = [];
+  let known = integerDecimal(0);
+  for (const name of Object.keys(CATEGORIES)) {
+    const result = category(required(raw, name, `${path}.categories`), `${path}.categories.${name}`, name, expected[name], horizon, vatBasis);
+    if (result._total) { known = monetary(add(known, result._total), `${path}.knownSubtotal`); delete result._total; }
+    if (result.status === 'unpriced') unpriced.push({ category: name, reason: result.reason });
+    categories[name] = result;
+  }
+  const perNodeCpu = slots(subtract(guaranteedCpu, reservedCpu), workload.cpu, `${path}.nodes.cpu`);
+  const perNodeRam = slots(subtract(ram, reservedRam), workload.ram, `${path}.nodes.ramGB`);
+  const perNodeSlots = Math.min(perNodeCpu, perNodeRam);
+  const normalSlots = count * perNodeSlots;
+  const survivingNodes = Math.max(0, count - workload.failedNodes);
+  const survivingSlots = survivingNodes * perNodeSlots;
+  const feasible = normalSlots >= workload.replicas && survivingSlots >= workload.survivingReplicas;
+  return {
+    id, kind, nodes: node, controlPlaneCount, resources, categories,
+    capacity: { perNodeCpuSlots: perNodeCpu, perNodeRamSlots: perNodeRam, perNodeSlots, normalSlots, survivingNodes, survivingSlots, feasible,
+      formula: 'usable guaranteed CPU = cpu × cpuShare − reservedCpu; usable RAM = ramGB − reservedRamGB; per-node slots = min(floor(usable CPU / cpuPerReplica), floor(usable RAM / ramGBPerReplica)); normal/surviving slots = per-node slots × available nodes' },
+    unpriced, complete: unpriced.length === 0, knownSubtotalRubExact: exact(known), knownSubtotalRubDisplay: display(known), _known: known,
+  };
+}
+
+function calculate(input) {
+  record(input, 'input', ['schemaVersion', 'horizonHours', 'currency', 'vatBasis', 'workload', 'equivalence', 'scenarios']);
+  if (required(input, 'schemaVersion', 'input') !== 1) fail('input.schemaVersion', 'must be 1');
+  const horizon = decimal(required(input, 'horizonHours', 'input'), 'input.horizonHours', { max: 8760n });
+  if (required(input, 'currency', 'input') !== 'RUB') fail('input.currency', 'must be RUB');
+  const vatBasis = required(input, 'vatBasis', 'input');
+  if (vatBasis !== 'included') fail('input.vatBasis', 'must be included');
+  const rawWorkload = record(required(input, 'workload', 'input'), 'input.workload', ['replicas', 'cpuPerReplica', 'ramGBPerReplica', 'survivingReplicas', 'failedNodes']);
+  const workload = {
+    replicas: positiveInteger(required(rawWorkload, 'replicas', 'input.workload'), 'input.workload.replicas'),
+    cpu: decimal(required(rawWorkload, 'cpuPerReplica', 'input.workload'), 'input.workload.cpuPerReplica', { max: 10000n }),
+    ram: decimal(required(rawWorkload, 'ramGBPerReplica', 'input.workload'), 'input.workload.ramGBPerReplica', { max: 1000000n }),
+    survivingReplicas: positiveInteger(required(rawWorkload, 'survivingReplicas', 'input.workload'), 'input.workload.survivingReplicas', 1000000, true),
+    failedNodes: positiveInteger(required(rawWorkload, 'failedNodes', 'input.workload'), 'input.workload.failedNodes', 1000, true),
+  };
+  if (workload.survivingReplicas > workload.replicas) fail('input.workload.survivingReplicas', 'cannot exceed replicas');
+  const equivalence = record(required(input, 'equivalence', 'input'), 'input.equivalence', ['status', 'assumptions', 'reason']);
+  if (!['assumed', 'unknown'].includes(required(equivalence, 'status', 'input.equivalence'))) fail('input.equivalence.status', 'must be assumed or unknown');
+  const assumptions = required(equivalence, 'assumptions', 'input.equivalence');
+  if (!Array.isArray(assumptions) || assumptions.length > 16 || (equivalence.status === 'assumed' && assumptions.length === 0)) fail('input.equivalence.assumptions', 'must have 1 to 16 assumptions when assumed');
+  assumptions.forEach((item, i) => words(item, `input.equivalence.assumptions[${i}]`));
+  if (equivalence.status === 'unknown') words(required(equivalence, 'reason', 'input.equivalence'), 'input.equivalence.reason');
+  else if (equivalence.reason !== undefined) fail('input.equivalence.reason', 'allowed only when unknown');
+  const rawScenarios = required(input, 'scenarios', 'input');
+  if (!Array.isArray(rawScenarios) || rawScenarios.length !== 2) fail('input.scenarios', 'must contain exactly one VM and one K8s scenario');
+  const scenarios = rawScenarios.map((item, i) => scenario(item, `input.scenarios[${i}]`, workload, horizon, vatBasis));
+  if (new Set(scenarios.map(item => item.kind)).size !== 2 || new Set(scenarios.map(item => item.id)).size !== 2) fail('input.scenarios', 'must have unique IDs and one scenario of each kind');
+  const reasons = [];
+  if (equivalence.status === 'unknown') reasons.push('architecture/HA equivalence is unknown');
+  for (const item of scenarios) {
+    if (!item.capacity.feasible) reasons.push(`${item.id}: declared normal or node-failure capacity is insufficient`);
+    if (!item.complete) reasons.push(`${item.id}: unpriced categories remain`);
+  }
+  const eligible = reasons.length === 0;
+  let winner = null, savings = null, tie = false;
+  if (eligible) {
+    const [a, b] = scenarios;
+    const relation = compare(a._known, b._known);
+    tie = relation === 0;
+    if (!tie) { winner = relation < 0 ? a.id : b.id; savings = subtract(relation < 0 ? b._known : a._known, relation < 0 ? a._known : b._known); }
+  }
+  for (const item of scenarios) delete item._known;
+  return {
+    schemaVersion: 1, horizonHours: input.horizonHours, currency: 'RUB', vatBasis,
+    workload: rawWorkload, equivalence,
+    scenarios,
+    comparison: { eligible, reasons, basis: eligible ? 'conditional lower modeled infrastructure cost under supplied assumptions' : null,
+      winner, tie: eligible ? tie : null, savingsRubExact: savings ? exact(savings) : null, savingsRubDisplay: savings ? display(savings) : null },
+    limitations: ['Declared quantities and tariff provenance are user assertions, not verified inventory or live prices.',
+      'Capacity is a homogeneous per-node packing bound, not a placement, performance, HA or SLA proof.',
+      'Static full-horizon resources only; no tiered, monthly, stopped-resource, discount or heterogeneous-fleet modeling.'],
+  };
+}
+
+function parseFlags(argv) {
+  let input = null, json = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--json') { if (json) fail('flags', 'duplicate --json'); json = true; }
+    else if (arg === '--input') { if (input !== null) fail('flags', 'duplicate --input'); input = argv[++i]; if (!input || input.startsWith('--')) fail('flags', '--input requires a path'); }
+    else fail('flags', `unknown argument ${JSON.stringify(arg)}`);
+  }
+  if (input === null) fail('flags', '--input is required');
+  return { input, json };
+}
+
+function run(argv, write = s => process.stdout.write(s + '\n'), error = s => process.stderr.write(s + '\n')) {
+  try {
+    const flags = parseFlags(argv);
+    const result = calculate(readInput(flags.input));
+    if (flags.json) write(JSON.stringify(result, null, 2));
+    else {
+      write(`Offline Cloud.ru cost worksheet — ${result.horizonHours} hours, RUB, VAT included`);
+      for (const item of result.scenarios) {
+        write(`${item.id} (${item.kind}): known subtotal ${item.knownSubtotalRubExact} RUB (${item.knownSubtotalRubDisplay} displayed); capacity ${item.capacity.normalSlots} normal / ${item.capacity.survivingSlots} after ${result.workload.failedNodes} node failure(s): ${item.capacity.feasible ? 'feasible packing bound' : 'INSUFFICIENT'}`);
+        for (const [name, category] of Object.entries(item.categories)) for (const line of category.items) write(`  ${name}/${line.id}: ${line.formula} = ${line.amountRubExact} RUB; tariff ${line.tariff.url} version ${line.tariff.version} as of ${line.tariff.asOf}, ${line.tariff.pageOrRow}, VAT ${line.tariff.vatBasis}`);
+        for (const missing of item.unpriced) write(`  unpriced ${missing.category}: ${missing.reason}`);
+      }
+      write(`Architecture equivalence: ${result.equivalence.status}${result.equivalence.reason ? ` — ${result.equivalence.reason}` : ''}`);
+      for (const assumption of result.equivalence.assumptions) write(`  assumption: ${assumption}`);
+      write(result.comparison.eligible ? (result.comparison.tie ? 'Conditional modeled cost: tie under supplied assumptions' : `Conditional lower modeled infrastructure cost: ${result.comparison.winner}; savings ${result.comparison.savingsRubExact} RUB (${result.comparison.savingsRubDisplay} displayed)`) : `No winner: ${result.comparison.reasons.join('; ')}`);
+      for (const limitation of result.limitations) write(`Limit: ${limitation}`);
+      write(`Formulas and tariff provenance: use --json or inspect ${flags.input}`);
+    }
+    return 0;
+  } catch (e) { error(`cloudru-hub cost-compare: ${e.message}`); return 1; }
+}
+
+module.exports = { run, calculate, readInput };

package/src/resolve.js

@@ -4,7 +4,7 @@
 //   1. env CLOUDRU_VM_BIN                          — explicit path (local baseline testing)
 //   2. config enginePath                           — ~/.cloudru-hub/config.json (or $CLOUDRU_HUB_CONFIG)
 //   3. platform package @dzhechkov/cloudru-vm-<os>-<cpu>/native/cloudru-vm
-//      (does not exist until the ADR-001 licence grant clears — see LICENSE Part 2)
+//      (installed automatically when its optional dependency is published)
 //   4. loud, esbuild-style error explaining all three paths and the licence hold.
 //
 // sha256 policy: the resolved binary is hashed and compared against the pinned map in
@@ -64,7 +64,7 @@ function resolveEngine(env = process.env) {
       const pkgJson = require.resolve(`${platformPkg}/package.json`);
       candidates.push({ path: path.join(path.dirname(pkgJson), 'native', 'cloudru-vm'), source: 'platform-package' });
     } catch {
-      /* optional platform package not installed — expected while the ADR-001 hold is in force */
+      /* optional platform package unavailable on this host or omitted by the installer */
     }
   }
 
@@ -94,7 +94,7 @@ function resolveEngine(env = process.env) {
       `  2. enginePath in ${configPath(env)}          ${cfg.enginePath ? `(set, but not a file: ${cfg.enginePath})` : '(unset/absent)'}\n` +
       `  3. optional dependency ${(PKG.cloudruHub && PKG.cloudruHub.platformPackages && PKG.cloudruHub.platformPackages[key]) || '<none for ' + key + '>'} (not installed)\n` +
       'Local testing: point $CLOUDRU_VM_BIN at an engine build (see docs/LOCAL-TESTING.md).\n' +
-      'The hosted platform package does not exist yet: its first publication still requires the ADR-002 trusted-CI binary build (see LICENSE Part 2 and THIRD_PARTY_NOTICES).',
+      'If the platform package has been released, install optional dependencies; otherwise provide a pinned local engine build.',
   };
 }