@dzhechkov/cloudru-hub 0.1.14 → 0.1.16

package/src/cost-compare.js

@@ -0,0 +1,348 @@
+'use strict';
+
+// Offline worksheet. All money and resource divisions use integer decimal arithmetic.
+const fs = require('fs');
+
+const MAX_INPUT = 128 * 1024;
+const MAX_MONEY = 10n ** 18n;
+const CATEGORIES = Object.freeze({
+  compute: 'instance-hour',
+  controlPlane: 'instance-hour',
+  storage: 'GB-hour',
+  publicIp: 'IP-hour',
+  snat: 'gateway-hour',
+  loadBalancer: 'LB-hour',
+  traffic: 'traffic-GB',
+});
+const TIME_UNITS = new Set(['instance-hour', 'GB-hour', 'IP-hour', 'gateway-hour', 'LB-hour']);
+
+function fail(path, message) { throw new Error(`${path}: ${message}`); }
+function record(value, path, keys) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) fail(path, 'must be an object');
+  for (const key of Object.keys(value)) if (!keys.includes(key)) fail(`${path}.${key}`, 'unknown field');
+  return value;
+}
+function required(obj, key, path) {
+  if (!Object.hasOwn(obj, key)) fail(`${path}.${key}`, 'required');
+  return obj[key];
+}
+function positiveInteger(value, path, max = 1000000, zero = false) {
+  if (!Number.isSafeInteger(value) || value < (zero ? 0 : 1) || value > max) fail(path, `must be an integer from ${zero ? 0 : 1} to ${max}`);
+  return value;
+}
+function words(value, path, max = 500) {
+  if (typeof value !== 'string' || !value.trim() || value.length > max || /[\x00-\x1f\x7f]/.test(value)) fail(path, 'must be a nonempty bounded single-line string');
+  return value;
+}
+function decimal(value, path, { zero = false, max = 1000000000n } = {}) {
+  if (typeof value !== 'string' || !/^(?:0|[1-9]\d{0,12})(?:\.\d{1,9})?$/.test(value)) fail(path, 'must be a non-negative decimal string with at most 9 fractional places');
+  const [whole, fraction = ''] = value.split('.');
+  const coefficient = BigInt(whole + fraction);
+  const scale = 10n ** BigInt(fraction.length);
+  if ((!zero && coefficient === 0n) || coefficient > max * scale) fail(path, `must be ${zero ? 'non-negative' : 'positive'} and at most ${max}`);
+  return { coefficient, scale };
+}
+const integerDecimal = value => ({ coefficient: BigInt(value), scale: 1n });
+const multiply = (a, b) => ({ coefficient: a.coefficient * b.coefficient, scale: a.scale * b.scale });
+const subtract = (a, b) => ({ coefficient: a.coefficient * b.scale - b.coefficient * a.scale, scale: a.scale * b.scale });
+const compare = (a, b) => a.coefficient * b.scale < b.coefficient * a.scale ? -1 : a.coefficient * b.scale > b.coefficient * a.scale ? 1 : 0;
+function add(a, b) { return { coefficient: a.coefficient * b.scale + b.coefficient * a.scale, scale: a.scale * b.scale }; }
+function exact(value) {
+  const whole = value.coefficient / value.scale;
+  const remainder = value.coefficient % value.scale;
+  if (!remainder) return String(whole);
+  return `${whole}.${String(remainder).padStart(String(value.scale).length - 1, '0').replace(/0+$/, '')}`;
+}
+function display(value) {
+  const cents = (value.coefficient * 200n + value.scale) / (2n * value.scale);
+  return `${cents / 100n}.${String(cents % 100n).padStart(2, '0')}`;
+}
+function monetary(value, path) {
+  if (value.coefficient < 0n || value.coefficient > MAX_MONEY * value.scale) fail(path, 'amount exceeds supported RUB magnitude');
+  return value;
+}
+function slots(usable, perReplica, path) {
+  const count = usable.coefficient * perReplica.scale / (usable.scale * perReplica.coefficient);
+  if (count > 1000000n) fail(path, 'per-node capacity exceeds supported bound');
+  return Number(count);
+}
+
+// JSON.parse discards duplicate members and rounds large/fractional numeric tokens.
+// Inspect the bounded original text first, including decoded spellings of object keys.
+function validateJsonLexemes(text) {
+  const number = /-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+  let offset = 0, tokens = 0;
+  const bad = message => fail('--input', message);
+  const space = () => { while (offset < text.length && /[ \t\r\n]/.test(text[offset])) offset++; };
+  const count = () => { if (++tokens > 10000) bad('JSON has too many members or values'); };
+  const string = () => {
+    const start = offset++;
+    while (offset < text.length) {
+      if (text[offset] === '\\') { offset += 2; continue; }
+      if (text[offset++] === '"') {
+        try { return JSON.parse(text.slice(start, offset)); }
+        catch { bad('invalid JSON string'); }
+      }
+    }
+    bad('unterminated JSON string');
+  };
+  const value = depth => {
+    count();
+    if (depth > 64) bad('JSON nesting exceeds 64 levels');
+    space();
+    const marker = text[offset];
+    if (marker === '{') {
+      offset++; space();
+      const seen = new Set();
+      if (text[offset] === '}') { offset++; return; }
+      while (true) {
+        if (text[offset] !== '"') bad('object member must be a JSON string');
+        count();
+        const key = string();
+        if (seen.has(key)) bad('duplicate decoded object member');
+        seen.add(key);
+        space();
+        if (text[offset++] !== ':') bad('object member requires a colon');
+        value(depth + 1); space();
+        const separator = text[offset++];
+        if (separator === '}') return;
+        if (separator !== ',') bad('object member requires a comma or closing brace');
+        space();
+      }
+    }
+    if (marker === '[') {
+      offset++; space();
+      if (text[offset] === ']') { offset++; return; }
+      while (true) {
+        value(depth + 1); space();
+        const separator = text[offset++];
+        if (separator === ']') return;
+        if (separator !== ',') bad('array element requires a comma or closing bracket');
+      }
+    }
+    if (marker === '"') { string(); return; }
+    for (const literal of ['true', 'false', 'null']) if (text.startsWith(literal, offset)) { offset += literal.length; return; }
+    number.lastIndex = offset;
+    const match = number.exec(text);
+    if (!match) bad('invalid JSON value or number');
+    const lexeme = match[0];
+    offset = number.lastIndex;
+    if (!/^(?:0|[1-9]\d*)$/.test(lexeme) || lexeme.length > 16 || BigInt(lexeme) > BigInt(Number.MAX_SAFE_INTEGER)) {
+      bad('numeric tokens must be canonical non-negative safe integers; decimals must be strings');
+    }
+  };
+  space(); value(0); space();
+  if (offset !== text.length) bad('trailing or malformed JSON token');
+}
+
+function readInput(path) {
+  words(path, '--input', 4096);
+  const flags = fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK;
+  const fd = fs.openSync(path, flags);
+  try {
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile() || stat.size > MAX_INPUT) fail('--input', 'must be a regular file of at most 128 KiB');
+    const chunks = [], buffer = Buffer.alloc(8192);
+    let length = 0, read;
+    while ((read = fs.readSync(fd, buffer, 0, Math.min(buffer.length, MAX_INPUT + 1 - length), null)) > 0) {
+      chunks.push(Buffer.from(buffer.subarray(0, read)));
+      length += read;
+      if (length > MAX_INPUT) fail('--input', 'file exceeds 128 KiB');
+    }
+    const bytes = Buffer.concat(chunks), text = bytes.toString('utf8');
+    if (!Buffer.from(text).equals(bytes)) fail('--input', 'must be valid UTF-8');
+    validateJsonLexemes(text);
+    return JSON.parse(text);
+  } finally { fs.closeSync(fd); }
+}
+
+function tariff(value, path, vatBasis) {
+  record(value, path, ['url', 'version', 'asOf', 'vatBasis', 'pageOrRow', 'sha256']);
+  const url = words(required(value, 'url', path), `${path}.url`, 1000);
+  if (!/^https:\/\/[^\s/@?#]+(?:[/?#][^\s]*)?$/.test(url)) fail(`${path}.url`, 'must be an HTTPS tariff URL');
+  words(required(value, 'version', path), `${path}.version`, 100);
+  const asOf = required(value, 'asOf', path);
+  if (typeof asOf !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(asOf) || Number.isNaN(Date.parse(`${asOf}T00:00:00Z`)) || new Date(`${asOf}T00:00:00Z`).toISOString().slice(0, 10) !== asOf) fail(`${path}.asOf`, 'must be a valid YYYY-MM-DD date');
+  if (required(value, 'vatBasis', path) !== vatBasis) fail(`${path}.vatBasis`, 'must match the common VAT basis');
+  words(required(value, 'pageOrRow', path), `${path}.pageOrRow`, 100);
+  if (value.sha256 !== undefined && (typeof value.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(value.sha256))) fail(`${path}.sha256`, 'must be lowercase SHA-256');
+  return value;
+}
+
+function category(value, path, name, expected, horizon, vatBasis) {
+  record(value, path, ['status', 'reason', 'items']);
+  const status = required(value, 'status', path);
+  if (!['priced', 'not-used', 'unpriced'].includes(status)) fail(`${path}.status`, 'must be priced, not-used or unpriced');
+  if (status !== 'priced') {
+    if (value.items !== undefined) fail(`${path}.items`, 'allowed only when priced');
+    const reason = words(required(value, 'reason', path), `${path}.reason`);
+    if (status === 'not-used' && (expected === null || expected.coefficient !== 0n)) fail(path, 'not-used requires a declared zero quantity');
+    if (status === 'unpriced' && expected !== null && expected.coefficient === 0n) fail(path, 'declared zero quantity must be not-used');
+    return { status, reason, items: [], totalRubExact: null, totalRubDisplay: null };
+  }
+  if (value.reason !== undefined) fail(`${path}.reason`, 'allowed only when unpriced or not-used');
+  if (expected === null || expected.coefficient === 0n) fail(path, 'priced requires a positive declared quantity');
+  const items = required(value, 'items', path);
+  if (!Array.isArray(items) || !items.length || items.length > 16) fail(`${path}.items`, 'must have 1 to 16 items');
+  const seen = new Set();
+  let quantitySum = integerDecimal(0), total = integerDecimal(0);
+  const result = items.map((item, index) => {
+    const at = `${path}.items[${index}]`;
+    record(item, at, ['id', 'description', 'quantity', 'unit', 'rateRub', 'tariff']);
+    const id = words(required(item, 'id', at), `${at}.id`, 80);
+    if (!/^[a-z][a-z0-9-]*$/.test(id) || seen.has(id)) fail(`${at}.id`, 'must be a unique slug');
+    seen.add(id);
+    words(required(item, 'description', at), `${at}.description`);
+    const q = decimal(required(item, 'quantity', at), `${at}.quantity`);
+    if (required(item, 'unit', at) !== CATEGORIES[name]) fail(`${at}.unit`, `must be ${CATEGORIES[name]}`);
+    if (['compute', 'controlPlane', 'publicIp', 'snat', 'loadBalancer'].includes(name) && q.scale !== 1n) fail(`${at}.quantity`, 'must be an integer service count');
+    const rate = decimal(required(item, 'rateRub', at), `${at}.rateRub`);
+    tariff(required(item, 'tariff', at), `${at}.tariff`, vatBasis);
+    quantitySum = add(quantitySum, q);
+    const amount = monetary(multiply(multiply(q, rate), TIME_UNITS.has(item.unit) ? horizon : integerDecimal(1)), `${at}.amount`);
+    total = monetary(add(total, amount), `${path}.total`);
+    return { ...item, amountRubExact: exact(amount), amountRubDisplay: display(amount), formula: TIME_UNITS.has(item.unit) ? `${item.quantity} ${item.unit.slice(0, -5)} × ${item.rateRub} RUB/${item.unit} × ${exact(horizon)} hours` : `${item.quantity} ${item.unit} × ${item.rateRub} RUB/${item.unit} once` };
+  });
+  if (compare(quantitySum, expected) !== 0) fail(`${path}.items`, `quantities must sum to declared ${exact(expected)} ${CATEGORIES[name]}`);
+  return { status, items: result, totalRubExact: exact(total), totalRubDisplay: display(total), _total: total };
+}
+
+function scenario(value, path, workload, horizon, vatBasis) {
+  record(value, path, ['id', 'kind', 'nodes', 'controlPlaneCount', 'resources', 'categories']);
+  const id = words(required(value, 'id', path), `${path}.id`, 80);
+  if (!/^[a-z][a-z0-9-]*$/.test(id)) fail(`${path}.id`, 'must be a slug');
+  const kind = required(value, 'kind', path);
+  if (!['vm', 'k8s'].includes(kind)) fail(`${path}.kind`, 'must be vm or k8s');
+  const node = record(required(value, 'nodes', path), `${path}.nodes`, ['count', 'cpu', 'ramGB', 'reservedCpu', 'reservedRamGB', 'cpuShare']);
+  const count = positiveInteger(required(node, 'count', `${path}.nodes`), `${path}.nodes.count`, 1000);
+  if (workload.failedNodes > count) fail(`${path}.nodes.count`, 'must be at least the declared failedNodes');
+  const cpu = decimal(required(node, 'cpu', `${path}.nodes`), `${path}.nodes.cpu`, { max: 10000n });
+  const ram = decimal(required(node, 'ramGB', `${path}.nodes`), `${path}.nodes.ramGB`, { max: 1000000n });
+  const share = decimal(required(node, 'cpuShare', `${path}.nodes`), `${path}.nodes.cpuShare`, { max: 1n });
+  const reservedCpu = decimal(required(node, 'reservedCpu', `${path}.nodes`), `${path}.nodes.reservedCpu`, { zero: true, max: 10000n });
+  const reservedRam = decimal(required(node, 'reservedRamGB', `${path}.nodes`), `${path}.nodes.reservedRamGB`, { zero: true, max: 1000000n });
+  const guaranteedCpu = multiply(cpu, share);
+  if (compare(reservedCpu, guaranteedCpu) > 0 || compare(reservedRam, ram) > 0) fail(`${path}.nodes`, 'reservations exceed guaranteed CPU or RAM');
+  const controlPlaneCount = positiveInteger(required(value, 'controlPlaneCount', path), `${path}.controlPlaneCount`, 1000, kind === 'vm');
+  if (kind === 'vm' && controlPlaneCount !== 0) fail(`${path}.controlPlaneCount`, 'VM must declare zero control-plane service instances');
+  const resources = record(required(value, 'resources', path), `${path}.resources`, ['storageGB', 'publicIpCount', 'snatGatewayCount', 'loadBalancerCount', 'trafficGB']);
+  const storage = decimal(required(resources, 'storageGB', `${path}.resources`), `${path}.resources.storageGB`, { zero: true });
+  const publicIp = positiveInteger(required(resources, 'publicIpCount', `${path}.resources`), `${path}.resources.publicIpCount`, 1000000, true);
+  const snat = positiveInteger(required(resources, 'snatGatewayCount', `${path}.resources`), `${path}.resources.snatGatewayCount`, 1000000, true);
+  const lb = positiveInteger(required(resources, 'loadBalancerCount', `${path}.resources`), `${path}.resources.loadBalancerCount`, 1000000, true);
+  const trafficValue = required(resources, 'trafficGB', `${path}.resources`);
+  const traffic = trafficValue === null ? null : decimal(trafficValue, `${path}.resources.trafficGB`, { zero: true });
+  const expected = { compute: integerDecimal(count), controlPlane: integerDecimal(controlPlaneCount), storage, publicIp: integerDecimal(publicIp), snat: integerDecimal(snat), loadBalancer: integerDecimal(lb), traffic };
+  const raw = record(required(value, 'categories', path), `${path}.categories`, Object.keys(CATEGORIES));
+  const categories = {}, unpriced = [];
+  let known = integerDecimal(0);
+  for (const name of Object.keys(CATEGORIES)) {
+    const result = category(required(raw, name, `${path}.categories`), `${path}.categories.${name}`, name, expected[name], horizon, vatBasis);
+    if (result._total) { known = monetary(add(known, result._total), `${path}.knownSubtotal`); delete result._total; }
+    if (result.status === 'unpriced') unpriced.push({ category: name, reason: result.reason });
+    categories[name] = result;
+  }
+  const perNodeCpu = slots(subtract(guaranteedCpu, reservedCpu), workload.cpu, `${path}.nodes.cpu`);
+  const perNodeRam = slots(subtract(ram, reservedRam), workload.ram, `${path}.nodes.ramGB`);
+  const perNodeSlots = Math.min(perNodeCpu, perNodeRam);
+  const normalSlots = count * perNodeSlots;
+  const survivingNodes = Math.max(0, count - workload.failedNodes);
+  const survivingSlots = survivingNodes * perNodeSlots;
+  const feasible = normalSlots >= workload.replicas && survivingSlots >= workload.survivingReplicas;
+  return {
+    id, kind, nodes: node, controlPlaneCount, resources, categories,
+    capacity: { perNodeCpuSlots: perNodeCpu, perNodeRamSlots: perNodeRam, perNodeSlots, normalSlots, survivingNodes, survivingSlots, feasible,
+      formula: 'usable guaranteed CPU = cpu × cpuShare − reservedCpu; usable RAM = ramGB − reservedRamGB; per-node slots = min(floor(usable CPU / cpuPerReplica), floor(usable RAM / ramGBPerReplica)); normal/surviving slots = per-node slots × available nodes' },
+    unpriced, complete: unpriced.length === 0, knownSubtotalRubExact: exact(known), knownSubtotalRubDisplay: display(known), _known: known,
+  };
+}
+
+function calculate(input) {
+  record(input, 'input', ['schemaVersion', 'horizonHours', 'currency', 'vatBasis', 'workload', 'equivalence', 'scenarios']);
+  if (required(input, 'schemaVersion', 'input') !== 1) fail('input.schemaVersion', 'must be 1');
+  const horizon = decimal(required(input, 'horizonHours', 'input'), 'input.horizonHours', { max: 8760n });
+  if (required(input, 'currency', 'input') !== 'RUB') fail('input.currency', 'must be RUB');
+  const vatBasis = required(input, 'vatBasis', 'input');
+  if (vatBasis !== 'included') fail('input.vatBasis', 'must be included');
+  const rawWorkload = record(required(input, 'workload', 'input'), 'input.workload', ['replicas', 'cpuPerReplica', 'ramGBPerReplica', 'survivingReplicas', 'failedNodes']);
+  const workload = {
+    replicas: positiveInteger(required(rawWorkload, 'replicas', 'input.workload'), 'input.workload.replicas'),
+    cpu: decimal(required(rawWorkload, 'cpuPerReplica', 'input.workload'), 'input.workload.cpuPerReplica', { max: 10000n }),
+    ram: decimal(required(rawWorkload, 'ramGBPerReplica', 'input.workload'), 'input.workload.ramGBPerReplica', { max: 1000000n }),
+    survivingReplicas: positiveInteger(required(rawWorkload, 'survivingReplicas', 'input.workload'), 'input.workload.survivingReplicas', 1000000, true),
+    failedNodes: positiveInteger(required(rawWorkload, 'failedNodes', 'input.workload'), 'input.workload.failedNodes', 1000, true),
+  };
+  if (workload.survivingReplicas > workload.replicas) fail('input.workload.survivingReplicas', 'cannot exceed replicas');
+  const equivalence = record(required(input, 'equivalence', 'input'), 'input.equivalence', ['status', 'assumptions', 'reason']);
+  if (!['assumed', 'unknown'].includes(required(equivalence, 'status', 'input.equivalence'))) fail('input.equivalence.status', 'must be assumed or unknown');
+  const assumptions = required(equivalence, 'assumptions', 'input.equivalence');
+  if (!Array.isArray(assumptions) || assumptions.length > 16 || (equivalence.status === 'assumed' && assumptions.length === 0)) fail('input.equivalence.assumptions', 'must have 1 to 16 assumptions when assumed');
+  assumptions.forEach((item, i) => words(item, `input.equivalence.assumptions[${i}]`));
+  if (equivalence.status === 'unknown') words(required(equivalence, 'reason', 'input.equivalence'), 'input.equivalence.reason');
+  else if (equivalence.reason !== undefined) fail('input.equivalence.reason', 'allowed only when unknown');
+  const rawScenarios = required(input, 'scenarios', 'input');
+  if (!Array.isArray(rawScenarios) || rawScenarios.length !== 2) fail('input.scenarios', 'must contain exactly one VM and one K8s scenario');
+  const scenarios = rawScenarios.map((item, i) => scenario(item, `input.scenarios[${i}]`, workload, horizon, vatBasis));
+  if (new Set(scenarios.map(item => item.kind)).size !== 2 || new Set(scenarios.map(item => item.id)).size !== 2) fail('input.scenarios', 'must have unique IDs and one scenario of each kind');
+  const reasons = [];
+  if (equivalence.status === 'unknown') reasons.push('architecture/HA equivalence is unknown');
+  for (const item of scenarios) {
+    if (!item.capacity.feasible) reasons.push(`${item.id}: declared normal or node-failure capacity is insufficient`);
+    if (!item.complete) reasons.push(`${item.id}: unpriced categories remain`);
+  }
+  const eligible = reasons.length === 0;
+  let winner = null, savings = null, tie = false;
+  if (eligible) {
+    const [a, b] = scenarios;
+    const relation = compare(a._known, b._known);
+    tie = relation === 0;
+    if (!tie) { winner = relation < 0 ? a.id : b.id; savings = subtract(relation < 0 ? b._known : a._known, relation < 0 ? a._known : b._known); }
+  }
+  for (const item of scenarios) delete item._known;
+  return {
+    schemaVersion: 1, horizonHours: input.horizonHours, currency: 'RUB', vatBasis,
+    workload: rawWorkload, equivalence,
+    scenarios,
+    comparison: { eligible, reasons, basis: eligible ? 'conditional lower modeled infrastructure cost under supplied assumptions' : null,
+      winner, tie: eligible ? tie : null, savingsRubExact: savings ? exact(savings) : null, savingsRubDisplay: savings ? display(savings) : null },
+    limitations: ['Declared quantities and tariff provenance are user assertions, not verified inventory or live prices.',
+      'Capacity is a homogeneous per-node packing bound, not a placement, performance, HA or SLA proof.',
+      'Static full-horizon resources only; no tiered, monthly, stopped-resource, discount or heterogeneous-fleet modeling.'],
+  };
+}
+
+function parseFlags(argv) {
+  let input = null, json = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--json') { if (json) fail('flags', 'duplicate --json'); json = true; }
+    else if (arg === '--input') { if (input !== null) fail('flags', 'duplicate --input'); input = argv[++i]; if (!input || input.startsWith('--')) fail('flags', '--input requires a path'); }
+    else fail('flags', `unknown argument ${JSON.stringify(arg)}`);
+  }
+  if (input === null) fail('flags', '--input is required');
+  return { input, json };
+}
+
+function run(argv, write = s => process.stdout.write(s + '\n'), error = s => process.stderr.write(s + '\n')) {
+  try {
+    const flags = parseFlags(argv);
+    const result = calculate(readInput(flags.input));
+    if (flags.json) write(JSON.stringify(result, null, 2));
+    else {
+      write(`Offline Cloud.ru cost worksheet — ${result.horizonHours} hours, RUB, VAT included`);
+      for (const item of result.scenarios) {
+        write(`${item.id} (${item.kind}): known subtotal ${item.knownSubtotalRubExact} RUB (${item.knownSubtotalRubDisplay} displayed); capacity ${item.capacity.normalSlots} normal / ${item.capacity.survivingSlots} after ${result.workload.failedNodes} node failure(s): ${item.capacity.feasible ? 'feasible packing bound' : 'INSUFFICIENT'}`);
+        for (const [name, category] of Object.entries(item.categories)) for (const line of category.items) write(`  ${name}/${line.id}: ${line.formula} = ${line.amountRubExact} RUB; tariff ${line.tariff.url} version ${line.tariff.version} as of ${line.tariff.asOf}, ${line.tariff.pageOrRow}, VAT ${line.tariff.vatBasis}`);
+        for (const missing of item.unpriced) write(`  unpriced ${missing.category}: ${missing.reason}`);
+      }
+      write(`Architecture equivalence: ${result.equivalence.status}${result.equivalence.reason ? ` — ${result.equivalence.reason}` : ''}`);
+      for (const assumption of result.equivalence.assumptions) write(`  assumption: ${assumption}`);
+      write(result.comparison.eligible ? (result.comparison.tie ? 'Conditional modeled cost: tie under supplied assumptions' : `Conditional lower modeled infrastructure cost: ${result.comparison.winner}; savings ${result.comparison.savingsRubExact} RUB (${result.comparison.savingsRubDisplay} displayed)`) : `No winner: ${result.comparison.reasons.join('; ')}`);
+      for (const limitation of result.limitations) write(`Limit: ${limitation}`);
+      write(`Formulas and tariff provenance: use --json or inspect ${flags.input}`);
+    }
+    return 0;
+  } catch (e) { error(`cloudru-hub cost-compare: ${e.message}`); return 1; }
+}
+
+module.exports = { run, calculate, readInput };

package/src/install.js

@@ -45,7 +45,7 @@ const TIERS = {
 const DEGRADED_REASONS = {
   openclaude: 'all three legs exist upstream (.mcp.json, PreToolUse deny, .openclaude/skills) but NOTHING has been probed live — degraded-until-proven (ADR-005).',
   cursor: 'veto hooks documented only; R3 broken by the .mdc adapter, R4 truncation history (~40 tools) unresolved (ADR-005).',
-  windsurf: 'R4 FAILS as-is: Cascade budget 100 tools < 144 — needs the engine tool-profile before any delivery (ADR-005).',
+  windsurf: 'R4 FAILS as-is: Cascade budget 100 tools < 146 — needs the engine tool-profile before any delivery (ADR-005).',
   copilot: 'only Copilot CLI is a candidate; the coding agent fails R2 by construction ("will not ask for your approval" + hook timeout fail-open) (ADR-005).',
 };
 

package/src/k8s-approval.js

@@ -10,6 +10,7 @@ const { isDeepStrictEqual } = require('util');
 const YAML = require('yaml');
 const { readCredentials, UUID } = require('./credentials');
 const { approvalRoot } = require('./deploy-approval');
+const { validateImageManifest } = require('./k8s-image-manifest');
 
 const APPROVAL_ID = /^k8s-[0-9a-f]{12}$/;
 const DNS_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -49,7 +50,9 @@ function privateJson(file) {
   return JSON.parse(fs.readFileSync(file, 'utf8'));
 }
 
-function validateManifest(raw, namespace) {
+function validateManifest(raw, namespace, profile = 'snake') {
+  if (profile === 'web-image') return validateImageManifest(raw, namespace);
+  if (profile !== 'snake') throw new Error('unsupported Kubernetes profile');
   if (typeof raw !== 'string' || Buffer.byteLength(raw) < 1 || Buffer.byteLength(raw) > MAX_MANIFEST) {
     throw new Error('manifest must be non-empty and at most 64 KiB');
   }
@@ -143,7 +146,7 @@ function approvalFile(id, env = process.env) {
   return path.join(approvalRoot(env), `${id}.json`);
 }
 
-function issueK8sApproval(clusterId, namespace, manifestFile, reviewedSha256, env = process.env, now = Date.now()) {
+function issueK8sApproval(clusterId, namespace, manifestFile, reviewedSha256, env = process.env, now = Date.now(), profile = 'snake') {
   if (!UUID.test(clusterId || '')) throw new Error('cluster_id must be a UUID');
   if (!DIGEST.test(reviewedSha256 || '')) throw new Error('reviewed manifest SHA-256 is required');
   const st = fs.lstatSync(manifestFile);
@@ -151,17 +154,17 @@ function issueK8sApproval(clusterId, namespace, manifestFile, reviewedSha256, en
     throw new Error('manifest source must be a bounded regular file');
   }
   const manifest = fs.readFileSync(manifestFile, 'utf8');
-  const details = validateManifest(manifest, namespace);
+  const details = validateManifest(manifest, namespace, profile);
   const digest = sha256(manifest);
   if (digest !== reviewedSha256) throw new Error('manifest digest differs from reviewed SHA-256');
   const credentials = readCredentials(env);
   const root = approvalRoot(env);
   privateDir(root);
   const id = `k8s-${crypto.randomBytes(6).toString('hex')}`;
-  const record = { id, projectId: credentials.projectId, clusterId, namespace, manifest, digest,
+  const record = { id, projectId: credentials.projectId, clusterId, namespace, manifest, digest, profile,
     app: details.app, issuedAt: now, expiresAt: now + 10 * 60_000 };
   fs.writeFileSync(approvalFile(id, env), JSON.stringify(record) + '\n', { flag: 'wx', mode: 0o600 });
-  return { approvalId: id, projectId: record.projectId, clusterId, namespace, manifestSha256: digest,
+  return { approvalId: id, projectId: record.projectId, clusterId, namespace, manifestSha256: digest, profile,
     resources: details.resources, image: details.image, expiresAt: record.expiresAt,
     estimateScope: 'existing cluster only; no cluster, worker, NAT or public load balancer is created' };
 }
@@ -172,7 +175,7 @@ function consumeK8sApproval(id, env = process.env, now = Date.now()) {
   const credentials = readCredentials(env);
   if (a.id !== id || a.projectId !== credentials.projectId || !UUID.test(a.clusterId || '') ||
       !Number.isFinite(a.expiresAt) || a.expiresAt <= now || !DIGEST.test(a.digest || '') ||
-      sha256(a.manifest) !== a.digest || validateManifest(a.manifest, a.namespace).app !== a.app) {
+      sha256(a.manifest) !== a.digest || validateManifest(a.manifest, a.namespace, a.profile).app !== a.app) {
     throw new Error('Kubernetes approval does not match manifest, project or time');
   }
   const spent = path.join(approvalRoot(env), `${id}.used-${crypto.randomBytes(8).toString('hex')}.json`);

package/src/k8s-image-manifest.js

@@ -0,0 +1,75 @@
+'use strict';
+
+// A narrow generic web workload: one digest-pinned image, one Deployment and
+// one internal Service. The reviewed digest is the security boundary; source
+// build and image registry publication are separate operator steps.
+const YAML = require('yaml');
+const { isDeepStrictEqual } = require('util');
+const DNS = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const SERVICE_NAME = /^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const IMAGE = /^[a-z0-9][a-z0-9._:/-]*@sha256:[a-f0-9]{64}$/;
+const isRecord = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+const fields = (obj, allowed, label) => {
+  if (!isRecord(obj) || Object.keys(obj).some((key) => !allowed.includes(key))) throw new Error(`${label} contains unsupported fields`);
+};
+const equal = (actual, expected, label) => {
+  if (!isDeepStrictEqual(actual, expected)) throw new Error(`${label} differs from the reviewed web-image profile`);
+};
+
+function validateImageManifest(raw, namespace) {
+  if (typeof raw !== 'string' || Buffer.byteLength(raw) < 1 || Buffer.byteLength(raw) > 64 * 1024) throw new Error('manifest must be 1..65536 bytes');
+  if (typeof namespace !== 'string' || !DNS.test(namespace) || namespace.length > 63 || namespace === 'default' || namespace === 'kube-system') {
+    throw new Error('a dedicated DNS namespace is required');
+  }
+  const docs = YAML.parseAllDocuments(raw, { uniqueKeys: true, maxAliasCount: 0 });
+  if (docs.length !== 2 || docs.some((doc) => doc.errors.length)) throw new Error('web-image manifest needs exactly Deployment and Service');
+  const resources = docs.map((doc) => doc.toJS({ maxAliasCount: 0 }));
+  const deployment = resources.find((r) => r?.kind === 'Deployment');
+  const service = resources.find((r) => r?.kind === 'Service');
+  if (!deployment || !service || deployment === service) throw new Error('web-image manifest needs Deployment and Service');
+  for (const [r, kind, api] of [[deployment, 'Deployment', 'apps/v1'], [service, 'Service', 'v1']]) {
+    fields(r, ['apiVersion', 'kind', 'metadata', 'spec'], kind);
+    if (r.apiVersion !== api || r.kind !== kind) throw new Error(`invalid ${kind} API`);
+    fields(r.metadata, ['name', 'namespace'], `${kind} metadata`);
+    if (!SERVICE_NAME.test(r.metadata.name || '') || r.metadata.namespace !== namespace) throw new Error(`${kind} must use the reviewed namespace and a Service-compatible name`);
+  }
+  const app = deployment.metadata.name;
+  if (service.metadata.name !== app) throw new Error('Service name must match Deployment');
+  const spec = deployment.spec;
+  fields(spec, ['replicas', 'selector', 'template'], 'Deployment spec');
+  if (spec.replicas !== 1) throw new Error('only one replica is allowed');
+  fields(spec.selector, ['matchLabels'], 'selector');
+  equal(spec.selector.matchLabels, { app }, 'selector');
+  fields(spec.template, ['metadata', 'spec'], 'pod template');
+  fields(spec.template.metadata, ['labels'], 'pod metadata');
+  equal(spec.template.metadata.labels, { app }, 'pod labels');
+  const pod = spec.template.spec;
+  fields(pod, ['automountServiceAccountToken', 'securityContext', 'containers'], 'pod spec');
+  if (pod.automountServiceAccountToken !== false) throw new Error('service account token must be disabled');
+  equal(pod.securityContext, { runAsNonRoot: true }, 'pod security context');
+  if (!Array.isArray(pod.containers) || pod.containers.length !== 1) throw new Error('exactly one container is required');
+  const container = pod.containers[0];
+  fields(container, ['name', 'image', 'ports', 'readinessProbe', 'resources', 'securityContext'], 'container');
+  if (container.name !== app || !IMAGE.test(container.image || '') || container.image.includes('://') || container.image.includes('//')) throw new Error('container needs a digest-pinned OCI image');
+  equal(container.ports, [{ containerPort: 8080 }], 'container ports');
+  equal(container.readinessProbe, { httpGet: { path: '/health', port: 8080 } }, 'readiness probe');
+  equal(container.securityContext, { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true,
+    runAsUser: 10001, runAsGroup: 10001, capabilities: { drop: ['ALL'] } }, 'container security context');
+  const requests = container.resources?.requests;
+  const limits = container.resources?.limits;
+  fields(container.resources, ['requests', 'limits'], 'resources');
+  fields(requests, ['cpu', 'memory'], 'requests');
+  fields(limits, ['cpu', 'memory'], 'limits');
+  const cpu = (v, max) => typeof v === 'string' && /^[1-9][0-9]{0,3}m$/.test(v) && Number.parseInt(v, 10) <= max;
+  const mem = (v, max) => typeof v === 'string' && /^[1-9][0-9]{0,3}Mi$/.test(v) && Number.parseInt(v, 10) <= max;
+  if (!cpu(requests.cpu, 500) || !cpu(limits.cpu, 1000) || !mem(requests.memory, 512) || !mem(limits.memory, 1024) ||
+      Number.parseInt(requests.cpu, 10) > Number.parseInt(limits.cpu, 10) ||
+      Number.parseInt(requests.memory, 10) > Number.parseInt(limits.memory, 10)) throw new Error('resources exceed bounded web-image limits');
+  fields(service.spec, ['type', 'selector', 'ports'], 'Service spec');
+  if (service.spec.type !== 'ClusterIP') throw new Error('Service must be internal ClusterIP');
+  equal(service.spec.selector, { app }, 'Service selector');
+  equal(service.spec.ports, [{ port: 80, targetPort: 8080 }], 'Service ports');
+  return { app, image: container.image, resources: [{ kind: 'Deployment', name: app }, { kind: 'Service', name: app }] };
+}
+
+module.exports = { validateImageManifest };

package/src/safe-mcp.js

@@ -6,13 +6,18 @@ const { spawn } = require('child_process');
 const { loadClassification } = require('./classification');
 const { resolveEngine } = require('./resolve');
 const { selectedToolNames } = require('./toolsets');
-const { readCredentials, readOptionalCredentials } = require('./credentials');
+const { readCredentials, readOptionalCredentials, UUID } = require('./credentials');
 const { consumeApproval, recordDeployedVM, approvedVM } = require('./deploy-approval');
 const { consumeK8sApproval, k8sSession, verificationArgs } = require('./k8s-approval');
 
 const MAX_LINE = 1024 * 1024;
 const idKey = (id) => JSON.stringify(id);
 const errorResponse = (id, message, code = -32000) => ({ jsonrpc: '2.0', id, error: { code, message } });
+const uncertainDeploy = (id, approval, reason) => ({ jsonrpc: '2.0', id,
+  result: { isError: true, content: [{ type: 'text', text: JSON.stringify({
+    status: 'recovery_required', plan_id: approval.planId, verdict: 'unknown',
+    reason, next: 'Call deploy_reconcile with this plan_id; inspect live inventory before any new plan or mutation.',
+  }) }] } });
 
 function redactDeploySecrets(value) {
   if (Array.isArray(value)) return value.map(redactDeploySecrets);
@@ -81,8 +86,10 @@ function runSafeMcp(options = {}) {
     if (stopped) return;
     stopped = true;
     stderr.write(`cloudru-hub mcp-safe: ${reason}\n`);
-    for (const key of pending.keys()) {
-      emit(errorResponse(JSON.parse(key), 'Cloud.ru engine connection closed'));
+    for (const [key, request] of pending) {
+      const id = JSON.parse(key);
+      emit(request.approval ? uncertainDeploy(id, request.approval, 'Cloud.ru engine connection closed during deploy_apply') :
+        errorResponse(id, 'Cloud.ru engine connection closed'));
     }
     pending.clear();
     stdin.destroy();
@@ -210,10 +217,10 @@ function runSafeMcp(options = {}) {
         tool && typeof tool.name === 'string' && selected.has(tool.name)).map((tool) => {
         if (!k8sProfile) return tool;
         if (tool.name === 'k8s_apply') return { ...tool,
-          description: 'Apply one locally reviewed Snake manifest to one existing cluster. Pass only the local approval ID.',
+          description: 'Apply one locally reviewed bounded Snake or web-image manifest to one existing cluster. Pass only the local approval ID.',
           inputSchema: { type: 'object', properties: { approval_id: { type: 'string' } }, required: ['approval_id'], additionalProperties: false } };
         if (tool.name === 'k8s_kubectl') return { ...tool,
-          description: 'Read only pods, deployment, service or rollout status for the previously approved Snake workload.',
+          description: 'Read only pods, deployment, service or rollout status for the previously approved workload.',
           inputSchema: { type: 'object', properties: { approval_id: { type: 'string' },
             query: { type: 'string', enum: ['pods', 'deployment', 'service', 'rollout'] } },
           required: ['approval_id', 'query'], additionalProperties: false } };
@@ -226,7 +233,11 @@ function runSafeMcp(options = {}) {
     if (method === 'initialize' && message.result && message.result.capabilities) {
       message.result = { ...message.result, capabilities: { tools: message.result.capabilities.tools || {} } };
     }
-    if (approval && !message.error) {
+    if (approval && message.error) {
+      emit(uncertainDeploy(message.id, approval, 'Cloud.ru engine returned an error after approval was consumed'));
+      closeIfDone(); return;
+    }
+    if (approval) {
       // The engine returns an MCP text result containing its JSON deploy result.
       // Keep the model from seeing a generated login password: vm_exec uses the
       // engine-managed SSH key. Ambiguous responses require inspection.
@@ -234,28 +245,32 @@ function runSafeMcp(options = {}) {
       let deploy;
       try { deploy = JSON.parse(item?.text || ''); }
       catch {
-        message.result = { isError: true, content: [{ type: 'text', text: 'deploy_apply returned an unreadable outcome; inspect the live VM inventory before retrying' }] };
-        emit(message); closeIfDone(); return;
+        emit(uncertainDeploy(message.id, approval, 'deploy_apply returned an unreadable outcome'));
+        closeIfDone(); return;
       }
       if (!deploy || typeof deploy !== 'object' || Array.isArray(deploy)) {
-        message.result = { isError: true, content: [{ type: 'text', text: 'deploy_apply returned an invalid outcome; inspect the live VM inventory before retrying' }] };
-        emit(message); closeIfDone(); return;
+        emit(uncertainDeploy(message.id, approval, 'deploy_apply returned an invalid outcome'));
+        closeIfDone(); return;
       }
       const safe = redactDeploySecrets(deploy);
-      if (!message.result?.isError && approval.siteMode && deploy.status === 'running' && deploy.http_verification?.verified === true) {
+      safe.operation = { plan_id: approval.planId, verdict: 'unknown', observed_at: new Date().toISOString() };
+      if (!message.result?.isError && approval.siteMode && deploy.status === 'running' && deploy.http_verification?.verified === true &&
+          UUID.test(deploy.vm_id || '')) {
         // Static-site delivery is verified over HTTP. It does not imply SSH is
         // available, so never create a vm_exec session for this VM.
+        safe.operation.verdict = 'http_verified';
       } else if (!message.result?.isError && !approval.siteMode && deploy.status === 'running') {
         try {
           const session = recordDeployedVM(approval, deploy, options.env || process.env);
           safe.approved_vm_session_expires_at = new Date(session.expiresAt).toISOString();
+          safe.operation.verdict = 'vm_running';
         } catch (error) {
           message.result.isError = true;
           safe.recovery = `VM may exist but the approved execution session was not recorded: ${error.message}. Inspect VM inventory before retrying.`;
         }
       } else {
         message.result.isError = true;
-        safe.recovery = 'A VM may exist. Inspect the returned VM UUID and live inventory before retrying; a fresh plan and approval may be needed.';
+        safe.recovery = 'A VM may exist. Call deploy_reconcile with the plan_id. Inspect live inventory before retrying; a fresh plan and approval may be needed.';
       }
       item.text = JSON.stringify(safe);
     }

package/src/toolsets.js

@@ -15,7 +15,7 @@ const GROUPS = Object.freeze({
 // A separate, opt-in workflow. Mutators pass the proxy's local plan/VM guard;
 // combining this with a read-only group would blur that boundary.
 const VM_DEPLOY = Object.freeze([
-  'deploy_plan', 'deploy_apply', 'vm_exec', 'vm_list', 'vm_get',
+  'deploy_plan', 'deploy_preflight', 'deploy_apply', 'deploy_reconcile', 'vm_exec', 'vm_list', 'vm_get',
   'list_zones', 'list_images', 'list_flavors', 'list_disk_types',
   'list_subnets', 'list_security_groups', 'status',
 ]);

package/test/classification.test.mjs

@@ -16,15 +16,15 @@ test('every snapshot tool is classified, and nothing extra', () => {
   const snapNames = snap.tools.map((t) => t.name).sort();
   const clsNames = Object.keys(cls.tools).sort();
   assert.deepEqual(clsNames, snapNames);
-  assert.equal(snapNames.length, 144);
+  assert.equal(snapNames.length, 146);
 });
 
-test('counts are the reviewed golden split: 64 ask / 2 deny / 78 allow', () => {
-  assert.deepEqual(cls.counts, { ask: 64, deny: 2, allow: 78 });
+test('counts are the reviewed golden split: 64 ask / 2 deny / 80 allow', () => {
+  assert.deepEqual(cls.counts, { ask: 64, deny: 2, allow: 80 });
   const by = namesByPermission(cls);
   assert.equal(by.ask.length, 64);
   assert.equal(by.deny.length, 2);
-  assert.equal(by.allow.length, 78);
+  assert.equal(by.allow.length, 80);
 });
 
 // The imported engine now makes status observational. The Go regression test
@@ -121,7 +121,7 @@ test('permissionRules expands every name in BOTH prefix spellings (unverified no
   assert.equal(SERVER_PREFIXES.length, 2);
   assert.equal(rules.ask.length, 64 * 2);
   assert.equal(rules.deny.length, 2 * 2);
-  assert.equal(rules.allow.length, 78 * 2);
+  assert.equal(rules.allow.length, 80 * 2);
   assert.ok(rules.ask.includes('mcp__cloudru-vm__deploy'));
   assert.ok(rules.ask.includes('mcp__cloudru_vm__deploy'));
   assert.ok(rules.deny.includes('mcp__cloudru-vm__secret_value'));