@zaip-ai/cli 1.3.8 → 1.4.1

package/templates/.agents/tools/cloud-runner.mjs

@@ -0,0 +1,786 @@
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { access, mkdir, readFile, realpath, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseEnv } from "node:util";
+import { authHeaders, dnsBody, dnsInventory, sameDns } from "./cloud-runner-dns.mjs";
+import { runTerraform } from "./cloud-runner-terraform.mjs";
+
+const root = resolve(import.meta.dirname, "..", "..");
+const main =
+  process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url));
+if (main) {
+  try {
+    process.stdout.write(
+      `${JSON.stringify({ ok: true, ...(await run(parse(process.argv.slice(2)))) })}\n`,
+    );
+  } catch (error) {
+    process.stderr.write(`${JSON.stringify({ ok: false, code: errorCode(error) })}\n`);
+    process.exitCode = 1;
+  }
+}
+
+/** Runs one contract-bound operation. Dependencies are injectable for offline tests. */
+export async function run(args, injected = {}) {
+  const deps = dependencies(injected);
+  if (args.operation === "contract:derive") {
+    exact(args, ["operation", "credentials-source"]);
+    if (args.credentialsSource !== "root") fail("invalid_credentials_source");
+    const values = await dotenvValues("root", deps);
+    if (values.ZAIP_CLOUD_PROFILE !== "autonomous-cloud") fail("invalid_contract");
+    const contract = JSON.parse(
+      await deps.readFile(insideRoot(".agents/config/autonomous-cloud-inputs.json"), "utf8"),
+    );
+    if (
+      contract.version !== 1 ||
+      contract.profile !== "autonomous-cloud" ||
+      contract.authorization?.standing !== true ||
+      !nonempty(contract.authorization.reference)
+    )
+      fail("authorization_unavailable");
+    contract.cloudflare = {
+      ...contract.cloudflare,
+      account_id: requiredEnv(values, "TF_VAR_cloudflare_account_id"),
+      zone_id: requiredEnv(values, "TF_VAR_cloudflare_zone_id"),
+      zone_name: requiredEnv(values, "TF_VAR_cloudflare_zone_name"),
+    };
+    contract.hostinger = {
+      ...contract.hostinger,
+      account_id: requiredEnv(values, "ZAIP_HOSTINGER_ACCOUNT_ID"),
+      vps: structuredClone(contract.hostinger?.vps ?? {}),
+    };
+    for (const role of ["edge", "application"]) {
+      const target = contract.hostinger.vps[role] ?? {};
+      const id = nonempty(values[`TF_VAR_${role}_vps_id`]) ?? nonempty(target.id);
+      if (id) {
+        target.id = id;
+        target.ssh_host =
+          nonempty(values[`TF_VAR_${role}_vps_ipv4`]) ?? requireString(target, "ssh_host");
+        target.host_key_sha256 = nonempty(values[`ZAIP_${role.toUpperCase()}_SSH_HOSTKEY_SHA256`]);
+        target.private_key_path = nonempty(values.ZAIP_CLOUD_SSH_PRIVATE_KEY_PATH);
+      } else if (
+        !target.creation ||
+        !(contract.authorization.max_cost > 0) ||
+        !nonempty(contract.authorization.currency)
+      )
+        fail("target_unavailable");
+      contract.hostinger.vps[role] = target;
+    }
+    const credentials = credentialsFrom(values);
+    await preflight(contract, credentials, deps);
+    contract.observed_at = new Date().toISOString();
+    const path = ".agents/config/autonomous-cloud-contract.json";
+    await deps.writeFile(insideRoot(path), `${JSON.stringify(contract, null, 2)}\n`, {
+      mode: 0o600,
+    });
+    return {
+      ...result("contract:derive", null, [
+        contract.cloudflare.account_id,
+        contract.cloudflare.zone_id,
+        contract.hostinger.account_id,
+      ]),
+      contract_path: path,
+    };
+  }
+  const contractPath = requireValue(args, "contract");
+  const contract = JSON.parse(await deps.readFile(insideRoot(contractPath), "utf8"));
+  if (contract.version !== 1 || contract.profile !== "autonomous-cloud") fail("invalid_contract");
+  const credentials = await dotenv(requireValue(args, "credentials-source"), deps);
+  if (args.operation.startsWith("cloudflare:dns:"))
+    return cloudflare(args, contract, credentials, deps);
+  if (args.operation.startsWith("hostinger:")) return hostinger(args, contract, credentials, deps);
+  if (args.operation.startsWith("terraform:"))
+    return runTerraform(args, contract, credentials, {
+      deps,
+      root,
+      dirname,
+      exact,
+      fail,
+      insideRoot,
+      nonempty,
+      requiredEnv,
+      requireString,
+      result,
+      sha256,
+      preflight,
+      validPlan,
+      verifyPolicyTargets,
+      verifyBackendSource,
+      verifyBackend,
+      receipt,
+      observeState,
+    });
+  fail("operation_not_allowed");
+}
+
+async function cloudflare(args, contract, credentials, deps) {
+  exact(args, [
+    "contract",
+    "operation",
+    "provider",
+    "account-id",
+    "credentials-source",
+    "zone-id",
+    "dns-record",
+  ]);
+  const scope = contract.cloudflare;
+  if (!credentials.cloudflare || args.provider !== "cloudflare") fail("credential_unavailable");
+  if (!scope || args.accountId !== scope.account_id || args.zoneId !== scope.zone_id)
+    fail("target_mismatch");
+  if (
+    !new Set(["cloudflare:dns:read", "cloudflare:dns:create", "cloudflare:dns:edit"]).has(
+      args.operation,
+    ) ||
+    !scope.allowed_operations?.includes(args.operation)
+  )
+    fail("operation_not_allowed");
+  const managed = dnsInventory(scope).has(args.dnsRecord);
+  const direct = scope.direct_dns_records?.[args.dnsRecord];
+  if (args.operation === "cloudflare:dns:read" ? !managed && !direct : !direct || managed)
+    fail("operation_not_allowed");
+  const headers = authHeaders(credentials.cloudflare);
+  const zone = await request(
+    deps,
+    `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(args.zoneId)}`,
+    { method: "GET", headers },
+  );
+  if (zone?.result?.id !== args.zoneId || zone?.result?.account?.id !== args.accountId)
+    fail("target_mismatch");
+  const listUrl = `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(args.zoneId)}/dns_records?name=${encodeURIComponent(args.dnsRecord)}`;
+  const listed = await request(deps, listUrl, { method: "GET", headers });
+  const matches = Array.isArray(listed?.result)
+    ? listed.result.filter((record) => record?.name === args.dnsRecord)
+    : [];
+  if (matches.length > 1) fail("ambiguous_dns_record");
+  const current = matches[0];
+  if (args.operation === "cloudflare:dns:read") {
+    if (!current) fail("record_not_found");
+    return result(
+      args.operation,
+      "cloudflare",
+      [args.accountId, args.zoneId, args.dnsRecord, current.id].filter(Boolean),
+    );
+  }
+  const body = dnsBody(direct, fail);
+  if (
+    body.name !== args.dnsRecord ||
+    !inZone(body.name, scope.zone_name) ||
+    body.content === contract.hostinger?.vps?.application?.ssh_host
+  )
+    fail("target_mismatch");
+  if (args.operation === "cloudflare:dns:create" && current) fail("record_already_exists");
+  if (args.operation === "cloudflare:dns:edit" && !current?.id) fail("record_not_found");
+  const endpoint = current?.id
+    ? `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(args.zoneId)}/dns_records/${encodeURIComponent(current.id)}`
+    : `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(args.zoneId)}/dns_records`;
+  await request(deps, endpoint, {
+    method: current?.id ? "PATCH" : "POST",
+    headers,
+    body: JSON.stringify(body),
+  });
+  const observed = await request(deps, listUrl, { method: "GET", headers });
+  const after = Array.isArray(observed?.result)
+    ? observed.result.find((record) => record?.name === args.dnsRecord)
+    : null;
+  if (!after?.id || !sameDns(after, body)) fail("read_after_write_failed");
+  return result(args.operation, "cloudflare", [
+    args.accountId,
+    args.zoneId,
+    args.dnsRecord,
+    after.id,
+  ]);
+}
+
+async function hostinger(args, contract, credentials, deps) {
+  const ssh = args.operation.startsWith("hostinger:ssh:");
+  exact(
+    args,
+    ssh
+      ? [
+          "contract",
+          "operation",
+          "provider",
+          "account-id",
+          "credentials-source",
+          "vps-role",
+          "vps-id",
+          "host-key-sha256",
+        ]
+      : [
+          "contract",
+          "operation",
+          "provider",
+          "account-id",
+          "credentials-source",
+          "vps-role",
+          "vps-id",
+        ],
+  );
+  const scope = contract.hostinger;
+  const vps = scope?.vps?.[args.vpsRole];
+  if ((!ssh && !credentials.hostinger) || args.provider !== "hostinger")
+    fail("credential_unavailable");
+  if (
+    !scope ||
+    args.accountId !== scope.account_id ||
+    !vps ||
+    args.vpsId !== vps.id ||
+    !scope.allowed_operations?.includes(args.operation)
+  )
+    fail("target_mismatch");
+  if (args.operation === "hostinger:vps:read") {
+    await observeVps(vps, credentials.hostinger, deps);
+    return result(args.operation, "hostinger", [args.accountId, args.vpsRole, args.vpsId]);
+  }
+  if (
+    !new Set(["hostinger:ssh:read", "hostinger:ssh:test", "hostinger:ssh:configure"]).has(
+      args.operation,
+    )
+  )
+    fail("operation_not_allowed");
+  if (args.hostKeySha256 !== vps.host_key_sha256) fail("target_mismatch");
+  const key = insideRoot(requireString(vps, "private_key_path"));
+  const knownHosts = insideRoot(requireString(vps, "known_hosts_path"));
+  await deps.access(key);
+  const timeout = positiveTimeout(vps.ssh_timeout_seconds);
+  const port =
+    Number.isInteger(vps.ssh_port) && vps.ssh_port > 0 && vps.ssh_port <= 65535 ? vps.ssh_port : 22;
+  if (
+    typeof vps.ssh_host !== "string" ||
+    !/^[A-Za-z0-9.:-]+$/.test(vps.ssh_host) ||
+    vps.ssh_host.startsWith("-")
+  )
+    fail("invalid_contract");
+  const hostIdentity = port === 22 ? vps.ssh_host : `[${vps.ssh_host}]:${port}`;
+  let known,
+    scanned = false;
+  try {
+    await deps.access(knownHosts);
+    known = await deps.exec("ssh-keygen", ["-F", hostIdentity, "-f", knownHosts], {
+      timeout: timeout * 1000,
+    });
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    scanned = true;
+    known = await deps.exec(
+      "ssh-keyscan",
+      ["-T", String(timeout), "-p", String(port), vps.ssh_host],
+      { timeout: timeout * 1000 },
+    );
+  }
+  const keyLines = String(known.stdout ?? "")
+    .split(/\r?\n/)
+    .filter((line) => line && !line.startsWith("#"))
+    .join("\n");
+  const lines = keyLines.split("\n").filter(Boolean);
+  const fingerprints = lines.map((line) => {
+    const fields = line.trim().split(/\s+/);
+    if (fields[0].startsWith("@") || fields.length < 3 || !/^[A-Za-z0-9+/]+={0,2}$/.test(fields[2]))
+      fail("host_key_mismatch");
+    return `SHA256:${createHash("sha256").update(Buffer.from(fields[2], "base64")).digest("base64").replace(/=+$/, "")}`;
+  });
+  if (
+    known.code !== 0 ||
+    !fingerprints.length ||
+    (!scanned && fingerprints.some((value) => value !== args.hostKeySha256))
+  )
+    fail("host_key_mismatch");
+  const pinned = lines.filter((_, index) => fingerprints[index] === args.hostKeySha256);
+  if (!pinned.length) fail("host_key_mismatch");
+  if (scanned) {
+    await deps.mkdir(dirname(knownHosts), { recursive: true });
+    await deps.writeFile(knownHosts, `${pinned.join("\n")}\n`, { mode: 0o600 });
+  }
+  const user = requireString(vps, "ssh_user");
+  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(user)) fail("invalid_contract");
+  const command = args.operation === "hostinger:ssh:read" ? "uname -s" : "true";
+  const argv = [
+    "-F",
+    process.platform === "win32" ? "NUL" : "/dev/null",
+    "-i",
+    key,
+    "-l",
+    user,
+    "-o",
+    "IdentitiesOnly=yes",
+    "-o",
+    "IdentityAgent=none",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "StrictHostKeyChecking=yes",
+    "-o",
+    "GlobalKnownHostsFile=none",
+    "-o",
+    `UserKnownHostsFile=${knownHosts}`,
+    "-o",
+    `ConnectTimeout=${timeout}`,
+    "-p",
+    String(port),
+    vps.ssh_host,
+    command,
+  ];
+  const options = { input: undefined, timeout: timeout * 1000 };
+  if (args.operation === "hostinger:ssh:configure") {
+    options.input = await deps.readFile(insideRoot(requireString(vps, "ssh_script_path")), "utf8");
+    if (sha256(options.input) !== vps.ssh_script_sha256) fail("script_hash_mismatch");
+    argv.splice(-1, 1, "sh -s");
+  }
+  if ((await deps.exec("ssh", argv, options)).code !== 0)
+    fail(
+      args.operation === "hostinger:ssh:configure"
+        ? "remote_result_requires_reconciliation"
+        : "ssh_failed",
+    );
+  return result(args.operation, "hostinger", [args.accountId, args.vpsRole, args.vpsId]);
+}
+
+async function preflight(contract, credentials, deps) {
+  if (!credentials.cloudflare || !credentials.hostinger) fail("credential_unavailable");
+  const scope = contract.cloudflare;
+  if (!scope?.account_id || !scope.zone_id || !scope.zone_name) fail("target_unavailable");
+  const zone = await request(
+    deps,
+    `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(scope.zone_id)}`,
+    { method: "GET", headers: authHeaders(credentials.cloudflare) },
+  );
+  if (
+    zone.result?.id !== scope.zone_id ||
+    zone.result?.account?.id !== scope.account_id ||
+    zone.result?.name !== scope.zone_name
+  )
+    fail("target_mismatch");
+  if (!nonempty(contract.hostinger?.account_id)) fail("target_unavailable");
+  let creating = false;
+  for (const role of ["edge", "application"]) {
+    const target = contract.hostinger.vps?.[role];
+    if (target?.id) await observeVps(target, credentials.hostinger, deps);
+    else if (
+      target?.creation &&
+      contract.authorization?.max_cost > 0 &&
+      nonempty(contract.authorization.currency)
+    )
+      creating = true;
+    else fail("target_unavailable");
+  }
+  // Hostinger's VPS endpoint proves token visibility of IDs, not an account ID.
+  // The account label remains an explicit operator input, never an observed claim.
+  if (creating) {
+    await request(deps, "https://developers.hostinger.com/api/vps/v1/virtual-machines", {
+      method: "GET",
+      headers: authHeaders(credentials.hostinger),
+    });
+    const response = await request(
+      deps,
+      "https://developers.hostinger.com/api/billing/v1/catalog?category=VPS",
+      { method: "GET", headers: authHeaders(credentials.hostinger) },
+    );
+    const items = Array.isArray(response) ? response : response.data;
+    if (!Array.isArray(items)) fail("price_unavailable");
+    let total = 0;
+    for (const target of Object.values(contract.hostinger.vps)) {
+      if (target.id) continue;
+      const quote = target.creation.quote;
+      const item = items.find((item) => item.id === quote?.catalog_item_id);
+      const price = item?.prices?.find((price) => price.id === target.creation.plan);
+      if (
+        !price ||
+        quote.price_id !== price.id ||
+        quote.currency !== price.currency ||
+        quote.currency !== contract.authorization.currency ||
+        quote.price_cents !== price.price ||
+        quote.first_period_price_cents !== price.first_period_price ||
+        quote.period !== price.period ||
+        quote.period_unit !== price.period_unit
+      )
+        fail("price_changed_or_unavailable");
+      if (
+        ![price.price, price.first_period_price].every(
+          (value) => Number.isSafeInteger(value) && value >= 0,
+        )
+      )
+        fail("price_unavailable");
+      total += Math.max(price.price, price.first_period_price);
+    }
+    if (total > Math.floor(contract.authorization.max_cost * 100)) fail("budget_exceeded");
+  }
+}
+async function observeVps(target, token, deps) {
+  const body = await request(
+    deps,
+    `https://developers.hostinger.com/api/vps/v1/virtual-machines/${encodeURIComponent(target.id)}`,
+    { method: "GET", headers: authHeaders(token) },
+  );
+  const actual = body.data ?? body;
+  if (String(actual.id) !== String(target.id)) fail("target_mismatch");
+  const addresses = [
+    actual.ipv4_address,
+    ...(Array.isArray(actual.ipv4)
+      ? actual.ipv4.map((ip) => (typeof ip === "string" ? ip : ip.address))
+      : []),
+  ];
+  if (target.ssh_host && !addresses.includes(target.ssh_host)) fail("target_mismatch");
+  return actual;
+}
+async function observeState(state, contract, credentials, deps) {
+  const resources = [];
+  const walk = (module) => {
+    resources.push(...(module?.resources ?? []));
+    for (const child of module?.child_modules ?? []) walk(child);
+  };
+  walk(state.values?.root_module);
+  const targets = [],
+    bindings = [];
+  for (const resource of resources) {
+    const value = resource.values;
+    if (resource.type === "hostinger_vps") {
+      const role =
+        resource.address === "hostinger_vps.edge[0]"
+          ? "edge"
+          : resource.address === "hostinger_vps.application[0]"
+            ? "application"
+            : null;
+      if (!role || !value?.id || !value.ipv4_address) fail("read_after_write_failed");
+      const approved = contract.hostinger.vps[role];
+      if (approved.id && String(approved.id) !== String(value.id)) fail("target_mismatch");
+      if (!approved.id && !approved.creation) fail("target_mismatch");
+      await observeVps(
+        { id: String(value.id), ssh_host: value.ipv4_address },
+        credentials.hostinger,
+        deps,
+      );
+      targets.push(String(value.id));
+      if (!approved.id) bindings.push({ role, id: String(value.id), ipv4: value.ipv4_address });
+    } else if (resource.type === "cloudflare_dns_record") {
+      if (value.zone_id !== contract.cloudflare.zone_id || !value.id) fail("target_mismatch");
+      const body = await request(
+        deps,
+        `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(value.zone_id)}/dns_records/${encodeURIComponent(value.id)}`,
+        { method: "GET", headers: authHeaders(credentials.cloudflare) },
+      );
+      if (!sameDns(body.result ?? {}, value)) fail("read_after_write_failed");
+      targets.push(value.id);
+    } else if (resource.mode !== "data") fail("unexpected_state_resource");
+  }
+  return { targets, bindings };
+}
+function inZone(name, zone) {
+  return typeof zone === "string" && (name === zone || name.endsWith(`.${zone}`));
+}
+
+async function dotenv(source, deps) {
+  return credentialsFrom(await dotenvValues(source, deps));
+}
+function credentialsFrom(values) {
+  return {
+    values,
+    cloudflare: nonempty(values.CLOUDFLARE_API_TOKEN),
+    hostinger: nonempty(values.HOSTINGER_API_TOKEN),
+  };
+}
+function requiredEnv(values, key) {
+  const value = nonempty(values[key]);
+  if (!value || /^(replace[-_ ]|your[-_ ]|<)/i.test(value)) fail("target_unavailable");
+  return value;
+}
+async function dotenvValues(source, deps) {
+  if (!new Set(["root", "agents"]).has(source)) fail("invalid_credentials_source");
+  const canonical = await deps.realpath(insideRoot(source === "root" ? ".env" : ".agents/.env"));
+  if (!insideRoot(canonical)) fail("path_outside_project");
+  return parseEnv(await deps.readFile(canonical, "utf8"));
+}
+function dependencies(overrides) {
+  return {
+    access: guarded(access),
+    mkdir: guarded(mkdir),
+    readFile: guarded(readFile),
+    realpath: guarded(realpath),
+    writeFile: guarded(writeFile),
+    http: boundedFetch,
+    exec: execute,
+    ...overrides,
+  };
+}
+function guarded(operation) {
+  return async (path, ...args) => {
+    await guardRealPath(path);
+    return operation(path, ...args);
+  };
+}
+async function guardRealPath(path) {
+  let candidate = insideRoot(path);
+  const canonicalRoot = await realpath(root);
+  for (;;) {
+    try {
+      const canonical = await realpath(candidate);
+      const rel = relative(canonicalRoot, canonical);
+      if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`))
+        fail("path_outside_project");
+      return;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      candidate = dirname(candidate);
+    }
+  }
+}
+async function request(deps, url, options) {
+  try {
+    const response = await deps.http(url, {
+      ...options,
+      redirect: "error",
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (!response?.ok) fail("provider_request_failed");
+    const body = typeof response.json === "function" ? await response.json() : response;
+    if (body.success === false) fail("provider_request_failed");
+    return body;
+  } catch (error) {
+    if (options.method !== "GET") fail("remote_result_requires_reconciliation");
+    throw error;
+  }
+}
+function boundedFetch(url, options) {
+  return fetch(url, options);
+}
+export function execute(file, args, options = {}) {
+  return new Promise((done, reject) => {
+    const child = spawn(file, args, {
+      cwd: options.cwd,
+      env: safeEnv(options.env),
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true,
+    });
+    let stdout = "",
+      stderr = "",
+      overflow = false,
+      timedOut = false;
+    const limit = options.maxOutput ?? 1_000_000;
+    const append = (current, chunk) => {
+      if (Buffer.byteLength(current) + chunk.length > limit) {
+        overflow = true;
+        child.kill();
+        return current;
+      }
+      return current + chunk.toString("utf8");
+    };
+    child.stdout.on("data", (chunk) => {
+      stdout = append(stdout, chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr = append(stderr, chunk);
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+    }, options.timeout ?? 30_000);
+    child.once("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.stdin.on("error", () => {});
+    child.stdin.end(options.input);
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      done({ code: overflow || timedOut ? 1 : (code ?? 1), stdout, stderr, overflow, timedOut });
+    });
+  });
+}
+function safeEnv(extra = {}) {
+  const allowed = ["PATH", "Path", "SYSTEMROOT", "SystemRoot", "WINDIR", "ComSpec", "PATHEXT"];
+  const base = Object.fromEntries(
+    allowed.filter((key) => process.env[key]).map((key) => [key, process.env[key]]),
+  );
+  return { ...base, ...extra };
+}
+function validPlan(plan, accountId) {
+  if (
+    !plan ||
+    !canonicalPlan(plan.path) ||
+    !canonicalPlan(plan.policy_json_path, ".json") ||
+    typeof plan.policy_contract_path !== "string"
+  )
+    fail("invalid_contract");
+  const backend = plan.backend;
+  if (
+    backend?.type !== "s3" ||
+    !nonempty(backend.config?.bucket) ||
+    !nonempty(backend.config?.key) ||
+    !nonempty(backend.config?.region) ||
+    backend.config.use_lockfile !== true
+  )
+    fail("remote_backend_unavailable");
+  const allowed = new Set(["bucket", "key", "region", "encrypt", "use_lockfile"]);
+  if (backend.config.endpoints) {
+    if (
+      stable(backend.config.endpoints) !==
+        stable({ s3: `https://${accountId}.r2.cloudflarestorage.com` }) ||
+      backend.config.region !== "auto" ||
+      backend.config.encrypt === true
+    )
+      fail("invalid_backend_config");
+    const flags = [
+      "skip_credentials_validation",
+      "skip_metadata_api_check",
+      "skip_region_validation",
+      "skip_requesting_account_id",
+      "skip_s3_checksum",
+      "use_path_style",
+    ];
+    for (const flag of flags) {
+      allowed.add(flag);
+      if (backend.config[flag] !== true) fail("invalid_backend_config");
+    }
+    allowed.add("endpoints");
+  } else if (backend.config.encrypt !== true) fail("remote_backend_unavailable");
+  if (Object.keys(backend.config).some((key) => !allowed.has(key))) fail("invalid_backend_config");
+  insideRoot(plan.policy_contract_path);
+  return plan;
+}
+async function verifyBackendSource(plan, cwd, deps) {
+  const source = JSON.parse(await deps.readFile(resolve(cwd, "backend.tf.json"), "utf8"));
+  if (
+    stable(source) !==
+    stable({ terraform: { backend: { [plan.backend.type]: plan.backend.config } } })
+  )
+    fail("backend_mismatch");
+}
+async function verifyBackend(plan, cwd, deps) {
+  const metadata = JSON.parse(
+    await deps.readFile(resolve(cwd, ".terraform/terraform.tfstate"), "utf8"),
+  );
+  if (
+    metadata.backend?.type !== plan.backend.type ||
+    Object.entries(plan.backend.config).some(
+      ([key, value]) => stable(metadata.backend.config?.[key]) !== stable(value),
+    )
+  )
+    fail("backend_mismatch");
+}
+async function receipt(contract, policyOutput, deps) {
+  const copy = structuredClone(contract);
+  delete copy.terraform.plan.sha256;
+  delete copy.terraform.plan.policy_result_sha256;
+  return sha256(
+    stable({
+      contract: copy,
+      policyOutput,
+      policy: await deps.readFile(insideRoot(copy.terraform.plan.policy_contract_path), "utf8"),
+      lock: await deps.readFile(insideRoot("infra/terraform/.terraform.lock.hcl"), "utf8"),
+    }),
+  );
+}
+async function verifyPolicyTargets(contract, deps) {
+  const policy = JSON.parse(
+    await deps.readFile(insideRoot(contract.terraform.plan.policy_contract_path), "utf8"),
+  );
+  for (const field of ["account_id", "zone_id", "zone_name"])
+    if (policy.cloudflare?.[field] !== contract.cloudflare[field]) fail("policy_target_mismatch");
+  for (const role of ["edge", "application"]) {
+    const primary = contract.hostinger.vps[role],
+      expected = policy.hostinger?.[role];
+    if (!expected || String(expected.id ?? "") !== String(primary.id ?? ""))
+      fail("policy_target_mismatch");
+    if (primary.creation)
+      for (const field of ["plan", "data_center_id", "template_id", "hostname", "ssh_key_ids"])
+        if (stable(expected[field]) !== stable(primary.creation[field]))
+          fail("policy_target_mismatch");
+  }
+  if (
+    contract.hostinger.vps.edge.ssh_host &&
+    policy.cloudflare.edge_ipv4 !== contract.hostinger.vps.edge.ssh_host
+  )
+    fail("policy_target_mismatch");
+  if (
+    contract.hostinger.vps.application.ssh_host &&
+    policy.hostinger.application.ipv4 !== contract.hostinger.vps.application.ssh_host
+  )
+    fail("policy_target_mismatch");
+  const full = (name) =>
+    name === "@"
+      ? contract.cloudflare.zone_name
+      : inZone(name, contract.cloudflare.zone_name)
+        ? name
+        : `${name}.${contract.cloudflare.zone_name}`;
+  const primaryNames = [...dnsInventory(contract.cloudflare)].map(full).sort();
+  const policyNames = Object.keys(policy.cloudflare.dns_records ?? {})
+    .map(full)
+    .sort();
+  if (stable(primaryNames) !== stable(policyNames)) fail("policy_target_mismatch");
+}
+function stable(value) {
+  if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${stable(value[key])}`)
+      .join(",")}}`;
+  return JSON.stringify(value);
+}
+function canonicalPlan(path, extension = ".tfplan") {
+  return new RegExp(`^\\.local/cloud/plans/[A-Za-z0-9_-]+${extension.replace(".", "\\.")}$`).test(
+    path ?? "",
+  );
+}
+function requireString(object, key) {
+  if (typeof object?.[key] !== "string" || !object[key].trim()) fail("invalid_contract");
+  return object[key];
+}
+function positiveTimeout(value) {
+  return Number.isInteger(value) && value > 0 && value <= 120 ? value : 15;
+}
+function result(operation, provider, targets) {
+  return { operation, provider, targets, observed_at: new Date().toISOString() };
+}
+function nonempty(value) {
+  return typeof value === "string" && value.trim() ? value : null;
+}
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function parse(values) {
+  const out = {};
+  for (let index = 0; index < values.length; index += 2) {
+    if (
+      !values[index]?.startsWith("--") ||
+      values[index + 1] === undefined ||
+      values[index + 1].startsWith("--")
+    )
+      fail("invalid_arguments");
+    const key = normalize(values[index].slice(2));
+    if (Object.hasOwn(out, key)) fail("invalid_arguments");
+    out[key] = values[index + 1];
+  }
+  return out;
+}
+function exact(actual, allowed) {
+  const normalized = allowed.map(normalize);
+  if (
+    Object.keys(actual).some((key) => !normalized.includes(key)) ||
+    normalized.some((key) => actual[key] === undefined)
+  )
+    fail("invalid_arguments");
+}
+function requireValue(actual, key) {
+  const value = actual[normalize(key)];
+  if (!value) fail("invalid_arguments");
+  return value;
+}
+function normalize(key) {
+  return key.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+function insideRoot(path) {
+  const absolute = resolve(root, path);
+  const rel = relative(root, absolute);
+  if (rel === "" || isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`))
+    fail("path_outside_project");
+  return absolute;
+}
+function fail(code) {
+  const error = new Error(code);
+  error.code = code;
+  throw error;
+}
+function errorCode(error) {
+  return typeof error?.code === "string" ? error.code : "invalid_request";
+}