@zaip-ai/cli 1.3.8 → 1.4.1

package/templates/.agents/tools/cloud-terraform-plan-policy.mjs

@@ -0,0 +1,262 @@
+import { readFile } from "node:fs/promises";
+
+const args = parseArgs(process.argv.slice(2));
+const usage =
+  "Usage: node scripts/validate-cloud-terraform-plan.mjs --plan <terraform-show.json> --contract <approved-targets.json>";
+if (![args.plan, args.contract].every(Boolean)) {
+  throw new Error(usage);
+}
+
+const plan = JSON.parse(await readFile(args.plan, "utf8"));
+const contract = JSON.parse(await readFile(args.contract, "utf8"));
+const cloudflare = contract.cloudflare ?? {};
+const hostinger = contract.hostinger ?? {};
+const phase = contract.phase ?? "combined";
+const changes = plan.resource_changes ?? [];
+const errors = [];
+const approvedVps = {
+  "hostinger_vps.edge[0]": hostinger.edge,
+  "hostinger_vps.application[0]": hostinger.application,
+};
+const allowedAddresses = new Set(Object.keys(approvedVps));
+const vps = new Map();
+const dnsNames = new Set();
+
+for (const change of changes) {
+  const actions = change.change?.actions ?? [];
+  if (
+    !Array.isArray(actions) ||
+    actions.length !== 1 ||
+    !["create", "update", "no-op", "read"].includes(actions[0])
+  ) {
+    errors.push(`${change.address}: deletion, replacement, or unknown action is forbidden`);
+    continue;
+  }
+  if (change.type === "hostinger_vps") {
+    if (!allowedAddresses.has(change.address)) {
+      errors.push(`${change.address}: only edge[0] and application[0] Hostinger VPS are allowed`);
+      continue;
+    }
+    validateVps(change, approvedVps[change.address], errors);
+    vps.set(change.address, change.change.after);
+    continue;
+  }
+  if (change.type === "cloudflare_dns_record") {
+    const after = change.change.after ?? {};
+    const destination = String(after.comment ?? "").match(/destination=(edge|pages|explicit)/)?.[1];
+    const expected = cloudflare.dns_records?.[after.name];
+    if (after.zone_id !== cloudflare.zone_id)
+      errors.push(`${change.address}: DNS zone differs from approved zone`);
+    if (!inZone(after.name, cloudflare.zone_name))
+      errors.push(`${change.address}: DNS name is outside approved zone`);
+    if (!expected) errors.push(`${change.address}: DNS record is not in the approved inventory`);
+    else {
+      if (dnsNames.has(after.name)) errors.push(`${change.address}: duplicate DNS inventory name`);
+      dnsNames.add(after.name);
+      for (const field of ["type", "content", "proxied"]) {
+        if (after[field] !== expected[field])
+          errors.push(`${change.address}: ${field} differs from approved DNS inventory`);
+      }
+    }
+    rejectUnknownAfter(
+      change.address,
+      after,
+      new Set([
+        "zone_id",
+        "name",
+        "type",
+        "content",
+        "proxied",
+        "ttl",
+        "comment",
+        "id",
+        "created_on",
+        "modified_on",
+        "comment_modified_on",
+        "tags_modified_on",
+        "proxiable",
+        "meta",
+        "settings",
+        "tags",
+        "data",
+        "priority",
+        "private_routing",
+      ]),
+      errors,
+    );
+    if (!destination) errors.push(`${change.address}: missing approved destination marker`);
+    if (destination === "edge" && after.content !== cloudflare.edge_ipv4)
+      errors.push(`${change.address}: edge record must target VPS 1 IP`);
+    if (after.content === hostinger.application?.ipv4)
+      errors.push(`${change.address}: no public DNS record may target VPS 2 IP`);
+    if (destination === "pages" && after.type !== "CNAME")
+      errors.push(`${change.address}: Pages record must be CNAME`);
+    continue;
+  }
+  errors.push(`${change.address}: resource ${change.type} is not approved by this root`);
+}
+
+if (phase === "compute") {
+  if (Object.keys(cloudflare.dns_records ?? {}).length !== 0 || dnsNames.size !== 0)
+    errors.push("compute phase must have empty Cloudflare DNS inventories");
+  validateComputeCreation(changes, hostinger, approvedVps, contract.authorization, errors);
+} else
+  for (const name of Object.keys(cloudflare.dns_records ?? {}))
+    if (!dnsNames.has(name)) errors.push(`plan omits required Cloudflare DNS record ${name}`);
+for (const address of allowedAddresses) {
+  if (changes.some((change) => change.type === "hostinger_vps") && !vps.has(address)) {
+    errors.push(`plan manages VPS but omits required ${address}`);
+  }
+}
+if (errors.length > 0) throw new Error(`Terraform plan policy rejected:\n${errors.join("\n")}`);
+process.stdout.write(
+  `Validated Terraform plan policy: ${changes.length} resource changes, ${dnsNames.size} DNS records.\n`,
+);
+
+function inZone(name, zone) {
+  return name === "@" || name === zone || /^[a-z0-9-]+$/.test(name) || name.endsWith(`.${zone}`);
+}
+
+function validateVps(change, expected, findings) {
+  if (!expected) {
+    findings.push(`${change.address}: VPS role is not approved`);
+    return;
+  }
+  const before = change.change.before ?? {};
+  const after = change.change.after ?? {};
+  const creating = change.change.actions?.[0] === "create";
+  if (expected.id && !creating && before.id !== expected.id)
+    findings.push(`${change.address}: before.id differs from approved VPS ID`);
+  if (expected.id && after.id && after.id !== expected.id)
+    findings.push(`${change.address}: after.id differs from approved VPS ID`);
+  rejectUnknownAfter(
+    change.address,
+    after,
+    new Set([
+      "id",
+      "vps_id",
+      "plan",
+      "data_center_id",
+      "template_id",
+      "hostname",
+      "ssh_key_ids",
+      "ipv4_address",
+      "ipv6_address",
+      "status",
+      "password",
+      "payment_method_id",
+      "post_install_script_id",
+    ]),
+    findings,
+  );
+  for (const field of ["password", "payment_method_id", "post_install_script_id"])
+    if (after[field] !== undefined && after[field] !== null)
+      findings.push(`${change.address}: ${field} must remain unset in the approved VPS plan`);
+  for (const field of ["plan", "data_center_id", "template_id", "hostname", "ssh_key_ids"]) {
+    if (JSON.stringify(after[field]) !== JSON.stringify(expected[field]))
+      findings.push(`${change.address}: ${field} differs from approved VPS specification`);
+  }
+}
+
+function validateComputeCreation(changes, hostinger, approved, authorization, findings) {
+  const vpsChanges = changes.filter((change) => change.type === "hostinger_vps");
+  if (changes.length !== 2 || vpsChanges.length !== 2) {
+    findings.push(
+      "compute phase requires exactly two Hostinger VPS creates and no other resource changes",
+    );
+  }
+  const roles = hostinger.roles;
+  if (!Array.isArray(roles) || roles.length !== 2) {
+    findings.push("compute phase requires exactly two approved Hostinger role quotes");
+    return;
+  }
+  for (const [address, target] of Object.entries(approved)) {
+    const role = address.includes("edge") ? "edge" : "application";
+    const matching = vpsChanges.filter((change) => change.address === address);
+    if (
+      matching.length !== 1 ||
+      matching[0].change?.actions?.length !== 1 ||
+      matching[0].change.actions[0] !== "create"
+    ) {
+      findings.push(`${address}: compute phase requires exactly one create action`);
+      continue;
+    }
+    const roleQuote = roles.find((entry) => entry?.role === role)?.quote;
+    validateCreationQuote(
+      address,
+      matching[0].change.after ?? {},
+      target,
+      roleQuote,
+      authorization,
+      findings,
+    );
+  }
+  const quoteRoles = roles.map((entry) => entry?.role);
+  if (
+    new Set(quoteRoles).size !== 2 ||
+    quoteRoles.some((role) => !["edge", "application"].includes(role))
+  )
+    findings.push("compute phase quote has an unapproved or duplicate VPS role");
+  if (!authorization)
+    findings.push("compute phase requires authorization.max_cost and authorization.currency");
+}
+
+function validateCreationQuote(address, after, target, quote, authorization, findings) {
+  authorization ??= {};
+  const required = [
+    "catalog_item_id",
+    "price_id",
+    "currency",
+    "price_cents",
+    "first_period_price_cents",
+    "period",
+    "period_unit",
+  ];
+  if (
+    !quote ||
+    required.some(
+      (field) => quote[field] === undefined || quote[field] === null || quote[field] === "",
+    )
+  ) {
+    findings.push(`${address}: missing provider quote bound to the approved role`);
+    return;
+  }
+  if (quote.price_id !== after.plan || quote.price_id !== target?.plan)
+    findings.push(`${address}: provider quote price_id differs from the planned VPS SKU`);
+  if (quote.currency !== authorization.currency || !/^[A-Z]{3}$/.test(String(quote.currency)))
+    findings.push(`${address}: provider quote currency differs from authorization`);
+  if (
+    !Number.isSafeInteger(quote.price_cents) ||
+    !Number.isSafeInteger(quote.first_period_price_cents) ||
+    quote.price_cents < 0 ||
+    quote.first_period_price_cents < 0
+  )
+    findings.push(`${address}: provider quote prices must be non-negative integer cents`);
+  if (
+    !String(quote.catalog_item_id).trim() ||
+    !String(quote.period).trim() ||
+    !String(quote.period_unit).trim()
+  )
+    findings.push(`${address}: provider quote must bind catalog item and billing period`);
+  const ceiling = Number(authorization.max_cost) * 100;
+  if (!Number.isFinite(ceiling) || ceiling <= 0)
+    findings.push(`${address}: authorization.max_cost must be a positive amount`);
+  else if (Math.max(quote.price_cents, quote.first_period_price_cents) > ceiling)
+    findings.push(`${address}: provider quote exceeds authorization.max_cost`);
+}
+
+function rejectUnknownAfter(address, after, allowed, findings) {
+  for (const field of Object.keys(after))
+    if (!allowed.has(field)) findings.push(`${address}: unknown managed after field ${field}`);
+}
+
+function parseArgs(values) {
+  const parsed = {};
+  for (let index = 0; index < values.length; index += 2) {
+    const key = values[index];
+    const value = values[index + 1];
+    if (!key?.startsWith("--") || value === undefined) throw new Error(usage);
+    parsed[key.slice(2).replace(/-([a-z])/g, (_, letter) => letter.toUpperCase())] = value;
+  }
+  return parsed;
+}

package/templates/.agents/tools/mcp/development/meta-devtools/README.md

@@ -0,0 +1,14 @@
+# Meta Social Technologies Dev Tools
+
+MCP remoto oficial Meta, desabilitado por padrão. Endpoint: `https://mcp.facebook.com/devtools`; streamable HTTP com OAuth. Configuração/OAuth não prova acesso real.
+
+## Uso seguro
+
+Use skills `$zaip-skill-meta-devtools-*`. Diagnóstico começa em leitura; subscribe, update_fields e test_send exigem aprovação.
+
+## Capacidades
+
+- `apps.read`
+- `api_usage.read`
+- `webhooks.read`
+- `documentation.read`

package/templates/.agents/tools/mcp/development/meta-devtools/manifest.yaml

@@ -0,0 +1,28 @@
+schema_version: 1
+id: meta-devtools
+name: "Meta Social Technologies Dev Tools"
+type: mcp
+category: development
+status: example
+enabled: false
+transport: streamable-http
+url: https://mcp.facebook.com/devtools
+authentication:
+  source: oauth
+  metadata_url: https://mcp.facebook.com/.well-known/oauth-protected-resource/devtools
+  metadata_checked_at: "2026-09-05"
+  supported_scopes:
+    - developer_tools_mcp_app_read
+    - developer_tools_mcp_app_management
+policy:
+  preferred_access: read-only
+capabilities:
+    - apps.read
+    - api_usage.read
+    - webhooks.read
+    - documentation.read
+security:
+  default_access: read-only
+  write_requires_approval: true
+  redact_secrets: true
+  destructive_operations: blocked

package/templates/.agents/tools/mcp/infra/cloudflare/manifest.yaml

@@ -16,9 +16,8 @@ authentication:
     - CLOUDFLARE_API_TOKEN
     - CLOUDFLARE_ACCOUNT_ID
 capabilities:
-    - dns.read
-    - workers.read
-    - dns.write
+  - dns.read
+  - dns.write
 security:
   default_access: read-only
   write_requires_approval: true

package/templates/.agents/tools/mcp/infra/hostinger/manifest.yaml

@@ -15,9 +15,7 @@ authentication:
   required_variables:
     - HOSTINGER_API_TOKEN
 capabilities:
-    - vps.read
-    - dns.read
-    - deployments.write
+  - vps.read
 security:
   default_access: read-only
   write_requires_approval: true

package/templates/.agents/tools/mcp/marketing/meta-ads/README.md

@@ -1,21 +1,23 @@
 # Meta Ads
 
-Exemplo MCP desabilitado para `meta-ads`. Ele documenta descoberta e políticas; escolha e audite uma implementação real antes de ativar.
+MCP remoto oficial Meta, desabilitado por padrão. Endpoint: `https://mcp.facebook.com/ads`; streamable HTTP com OAuth nativo do Codex. Use `$zaip-skill-meta-ads-setup` para inserir o pequeno bloco project-scoped de forma idempotente; `codex mcp add` é global e não é usado. Configuração ou OAuth não prova acesso real.
 
-## Capacidades
+Em um pedido explícito para configurar/conectar, o executor grava a configuração local habilitada e inicia `codex mcp login meta-ads` no projeto; o usuário conclui somente login e consentimento no navegador. Para este servidor, o cliente negocia DCR/PKCE: não exige Meta App, App ID, client secret ou access token manual.
 
-- `campaigns.read`
-- `insights.read`
-- `campaigns.write`
+## Uso seguro
 
-## Configuração
+Use `$zaip-skill-meta-ads`: leitura com escopo Read, paginação, timezone, moeda e atribuição declarados. Escrita, ads_management e ativação exigem aprovação.
 
-1. Revise o manifest e limite as capacidades necessárias.
-2. Configure as variáveis fora do Git:
+## Estados verificáveis
 
-- `META_ACCESS_TOKEN`
-- `META_AD_ACCOUNT_ID`
+- `configured`: bloco TOML presente.
+- `tools-listed`: a sessão exibiu tools e schemas em `/mcp`.
+- `auth-pending` ou `auth-error`: o OAuth ainda não terminou ou falhou.
+- `startup-or-reload-error`, `transport-error`, `policy-blocked` e `scope-insufficient`: causas distintas a diagnosticar.
+- `rollout-unavailable`: somente uma resposta explícita do provider confirmou que a tool não foi entregue.
+- `real-read`: consulta explicitamente read-only retornou dados ou vazio.
 
-3. Teste em sandbox usando somente leitura.
-4. Registre aprovação antes de habilitar qualquer operação de escrita.
-5. Valide redaction, timeout, retry, rate limit e idempotência.
+## Capacidades
+
+- `campaigns.read`
+- `insights.read`

package/templates/.agents/tools/mcp/marketing/meta-ads/manifest.yaml

@@ -5,20 +5,25 @@ type: mcp
 category: marketing
 status: example
 enabled: false
-transport: external
-installation:
-  implementation: required
-  command: null
-  args: []
+transport: streamable-http
+url: https://mcp.facebook.com/ads
 authentication:
-  source: environment
-  required_variables:
-    - META_ACCESS_TOKEN
-    - META_AD_ACCOUNT_ID
+  source: oauth
+  metadata_url: https://mcp.facebook.com/.well-known/oauth-protected-resource/ads
+  metadata_checked_at: "2026-09-05"
+  supported_scopes:
+    - ads_management
+    - ads_read
+    - catalog_management
+    - business_management
+    - pages_show_list
+    - instagram_basic
+    - ads_mcp_management
+policy:
+  preferred_access: read-only
 capabilities:
     - campaigns.read
     - insights.read
-    - campaigns.write
 security:
   default_access: read-only
   write_requires_approval: true

package/templates/.agents/tools/profiles/development.yaml

@@ -11,3 +11,6 @@ tools:
   - id: postgresql
     type: mcp
     enabled: false
+  - id: meta-devtools
+    type: mcp
+    enabled: false

package/templates/infra/terraform/.terraform.lock.hcl

@@ -0,0 +1,42 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/cloudflare/cloudflare" {
+  version     = "5.24.0"
+  constraints = "~> 5.23"
+  hashes = [
+    "h1:PIAng5QYiHeydJm1S6sG6d1YYIjaFuIwnifvq/qEV1Q=",
+    "zh:2390fc5df95addfd47d3f638964a1f9f6192a8c84ad3b1eab554ef88e0ac4091",
+    "zh:2b09c0afbebeb3139a3094e3debda1ba5ff3d73b6eca536549bdc903284b6798",
+    "zh:3241ce471f20745b1dc93baea73a716e1db4637ff41acc134114b7a8c9684714",
+    "zh:3513243e5582836054076a21abeadd8142a8421df6ec1ead53d96dc37a9e6326",
+    "zh:99b33ccb8a1c10a08e8903a2848eb2664c889dc79801a1e61e0373dd41c6c0f9",
+    "zh:99c7b510b100a605b0c80e0c3665d99c2381b0834f52ad6ca767e161c2ffa416",
+    "zh:c523d747a2d8457bc2d2cc00967c419ef38a5ebebd12d5091cf18322b7201f04",
+    "zh:f520e37f4d875b6fee95cffb74cf5fe9efc3cd54fe6bb4b815da5cee87e517e8",
+    "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
+  ]
+}
+
+provider "registry.terraform.io/hostinger/hostinger" {
+  version     = "0.1.22"
+  constraints = "~> 0.1.22"
+  hashes = [
+    "h1:HY2h9loTO/4fH54LkPPu9poETBQSQXCLp50OJnG91O0=",
+    "zh:129908e811883fac30f6e257564e88915451d4c2dbbea5c9dc0bbb0f86175278",
+    "zh:295920de29330b74f1483efcced42773320e7bbf6c7d557141b0e70fe3e14f3a",
+    "zh:944fabea08baa19a8ec240f25712cdc4a4b8347c87d3ed0b95fc1a23a1a16fb0",
+    "zh:9f6352eb3e59da178ba368feee9cbc200c3d6ed27ab4cefa224b15fdac75bbae",
+    "zh:a26f33c6a146efb56b9b5b69fc70faad78a61143f953c39555dc83a010f75978",
+    "zh:a3c2182926674f129ff31943fc146cca56f37ba2253d7622f8fe7b6ef86713f5",
+    "zh:a5a13179449801dd9545ba0b3277fa82ace02dfa61cb855b9ac6939c94e61630",
+    "zh:ae39f199da15974dff66f5d3aedb44b4f248c1e78e7580bd95fa7505640cf420",
+    "zh:cb8631d91c3e1796ebd6884d201d688c53498d62fa0fd5e82fecfee7b971b8fc",
+    "zh:cc6aa110902b8c4a9fe9c2ed3b9a757a987df49019b49f39ea35c66ae3dab204",
+    "zh:d9583a4727901f94995fa59f9b7f65a6c3a4eb5b38ba19a788c2d3dd1500e9d1",
+    "zh:df70733ad3abd633c7a7f46a6e50e01c896d8d6cf486585979e2dfa05ecb0c60",
+    "zh:e536dc4cad0af548759e1da1f8bc7763792153b44da501171ff954d6db9dac7b",
+    "zh:ee55224e9911f1286a12f7553ac26a3061f902cdc5996f00c3b1a23954d87f46",
+    "zh:fdbb821a45c29cbd9531373b1c34550d5a4e6471fea45b530b4e80428474a9cb",
+  ]
+}

package/templates/infra/terraform/README.md

@@ -0,0 +1,31 @@
+# Terraform: Cloudflare DNS and Hostinger VPS
+
+This root implements the resource boundary in `.agents/architecture/hostinger-cloudflare-terraform.md`: Cloudflare owns DNS and edge; Hostinger owns only VPS. It deliberately contains no Hostinger DNS resource, no SSH provisioner, no firewall resource with unverified provider support, and no container deployment. Those host-level controls require the declared configuration executor and observed validation.
+
+## Local inputs
+
+Merge only the relevant names from `.agents/.env.example` into the ignored root `.env`; do not overwrite unrelated existing credentials. `.agents/.env` is an optional alternate location when selected by the execution. Fill values outside chat. The environment file carries credentials and target identifiers but never grants target authority. Before a remote command, compare its Cloudflare account/zone, Hostinger account/VPS IDs and SSH host-key fingerprints to the active `autonomous-cloud` scope.
+
+Use the provider-supported `CLOUDFLARE_API_TOKEN` and `HOSTINGER_API_TOKEN` environment variables for tokens. Use a local ignored `terraform.tfvars` for non-secret input. Do not place a private SSH key in any environment file: `ZAIP_CLOUD_SSH_PRIVATE_KEY_PATH` is a local reference only.
+
+## Modes
+
+`manage_vps = false` consumes explicitly approved but unmanaged external IP inputs and manages only approved Cloudflare records. It is not adoption and does not import a VPS into Terraform state. `manage_vps = true` creates the two declared Hostinger VPS resources. Existing VPS instances must be imported only after their IDs are in scope and their observed configuration has been reviewed.
+
+Provider tokens are supplied only through `CLOUDFLARE_API_TOKEN` and `HOSTINGER_API_TOKEN`; they are never `TF_VAR_*` values. The non-secret `TF_VAR_cloudflare_*`, `TF_VAR_edge_vps_*` and `TF_VAR_application_vps_*` inputs in `.env` are the single source for a generated ignored `terraform.tfvars` or contract input. The generator may copy only these declared non-secret values after validating profile and targets; it must never copy credentials, private-key references, saved plans, state, or arbitrary environment variables.
+
+Use [`.agents/config/autonomous-cloud-inputs.json`](../../.agents/config/autonomous-cloud-inputs.json) as the neutral contract schema and `backend.tf.json` as the exact backend source checked by the runner. The Terraform executable is declared by `terraform.binary_path` and verified with `terraform.binary_sha256`; the runner does not resolve Terraform from `PATH` or an environment variable. The backend uses the encrypted S3 protocol with `use_lockfile`: provide either AWS S3 credentials or a scoped Cloudflare R2 S3-compatible credential and exact endpoint configuration. Locking and restore remain live validation gates. `ZAIP_HOSTINGER_ACCOUNT_ID` is a declared scope label, while every VPS ID must be observed through the Hostinger VPS API before it becomes a usable target.
+
+Terraform source alone does not create private transport or host firewall controls. Declare the configuration executor, WireGuard or equivalent transport, port policy, Docker images and backup/restore plan before applying infrastructure. WAF, TLS edge settings, Cloudflare Pages routing, host configuration, containers, and observability are extension paths: each needs an approved resource specification and observed validation before it is added to this foundation.
+
+`deployment-inputs.example.yaml` is deliberately incomplete. It lists the host IDs, image digests, network/firewall controls and restore evidence that must be declared for readiness. Its `deployment_readiness: failed` status is expected until those concrete inputs exist; no template supplies defaults.
+
+## Safe cycle
+
+1. Resolve the minimum credential set for the selected operation with `$zaip-skill-local-credentials`: Cloudflare for DNS, Hostinger for VPS, the private-key reference and fingerprint for SSH, and AWS S3 or scoped R2 S3-compatible credentials only when Terraform remote state needs them. Run the preflight defined by `$zaip-skill-hostinger-cloudflare-terraform`.
+2. Configure encrypted, versioned remote state with locking. Saved plans and state are protected operational artifacts, never Git or log content; do not treat their protection as permission to publish or expose them.
+3. Run `terraform init`, `terraform fmt -check -recursive`, `terraform validate`, then a saved, reviewed plan.
+4. Apply the exact reviewed plan. Immediately perform refresh/read-after-write and record non-secret IDs and plan hash.
+5. Prove DNS resolution, TLS, health endpoints, blocked private ports, production/beta isolation, backup restore and rollback readiness.
+
+Without step 5 performed against the delimited live targets, report only local/static validation; fixture and mock checks never establish live readiness. Terraform `sensitive` only masks normal CLI rendering; provider/resource values can still be present in saved plans or state. These artifacts persist, so keep them encrypted and access-controlled, define retention and cleanup, and keep them out of Git and logs. Hostinger's catalog prices are pre-tax quoted values, not a claim of the total amount charged.

package/templates/infra/terraform/backend.tf.json

@@ -0,0 +1,13 @@
+{
+  "terraform": {
+    "backend": {
+      "s3": {
+        "bucket": "replace-with-approved-s3-bucket",
+        "key": "terraform/terraform.tfstate",
+        "region": "us-east-1",
+        "encrypt": true,
+        "use_lockfile": true
+      }
+    }
+  }
+}

package/templates/infra/terraform/deployment-inputs.example.yaml

@@ -0,0 +1,22 @@
+# This is an intentionally incomplete readiness inventory, not a deployment manifest.
+# All values remain local project inputs. A missing input means deployment-readiness: failed.
+deployment_readiness: failed
+reason: "Host IDs, image digests, private-network executor, firewall policy, and restore proof are not yet declared."
+profiles:
+  edge:
+    vps_id: null
+    image_digests: {}
+    firewall_policy: null
+  production:
+    vps_id: null
+    image_digests: {}
+    backup_restore_plan: null
+  beta_on_demand:
+    image_digests: {}
+    activation_policy: null
+  observability:
+    image_digests: {}
+    retention_policy: null
+  load_tools:
+    image_digests: {}
+    execution_budget: null

package/templates/infra/terraform/fixtures/approved-targets.json

@@ -0,0 +1,32 @@
+{
+  "phase": "combined",
+  "cloudflare": {
+    "account_id": "account-approved",
+    "zone_id": "zone-approved",
+    "zone_name": "example.com",
+    "edge_ipv4": "203.0.113.10",
+    "dns_records": {
+      "api": { "type": "A", "content": "203.0.113.10", "proxied": true },
+      "app": { "type": "CNAME", "content": "pages.example.invalid", "proxied": true }
+    }
+  },
+  "hostinger": {
+    "edge": {
+      "id": "100001",
+      "plan": "hostingercom-vps-kvm2-usd-1m",
+      "data_center_id": 13,
+      "template_id": 1002,
+      "hostname": "edge.example.com",
+      "ssh_key_ids": ["key-edge"]
+    },
+    "application": {
+      "id": "100002",
+      "ipv4": "203.0.113.20",
+      "plan": "hostingercom-vps-kvm2-usd-1m",
+      "data_center_id": 13,
+      "template_id": 1002,
+      "hostname": "application.example.internal",
+      "ssh_key_ids": ["key-application"]
+    }
+  }
+}

package/templates/infra/terraform/fixtures/plan-approved.json

@@ -0,0 +1,67 @@
+{
+  "planned_values": {},
+  "resource_changes": [
+    {
+      "address": "hostinger_vps.edge[0]",
+      "type": "hostinger_vps",
+      "change": {
+        "actions": ["update"],
+        "before": { "id": "100001" },
+        "after": {
+          "id": "100001",
+          "plan": "hostingercom-vps-kvm2-usd-1m",
+          "data_center_id": 13,
+          "template_id": 1002,
+          "hostname": "edge.example.com",
+          "ssh_key_ids": ["key-edge"]
+        }
+      }
+    },
+    {
+      "address": "hostinger_vps.application[0]",
+      "type": "hostinger_vps",
+      "change": {
+        "actions": ["update"],
+        "before": { "id": "100002" },
+        "after": {
+          "id": "100002",
+          "plan": "hostingercom-vps-kvm2-usd-1m",
+          "data_center_id": 13,
+          "template_id": 1002,
+          "hostname": "application.example.internal",
+          "ssh_key_ids": ["key-application"]
+        }
+      }
+    },
+    {
+      "address": "cloudflare_dns_record.approved[\"api\"]",
+      "type": "cloudflare_dns_record",
+      "change": {
+        "actions": ["create"],
+        "after": {
+          "zone_id": "zone-approved",
+          "name": "api",
+          "type": "A",
+          "content": "203.0.113.10",
+          "proxied": true,
+          "comment": "Managed by Zaip Terraform; destination=edge"
+        }
+      }
+    },
+    {
+      "address": "cloudflare_dns_record.approved[\"app\"]",
+      "type": "cloudflare_dns_record",
+      "change": {
+        "actions": ["create"],
+        "after": {
+          "zone_id": "zone-approved",
+          "name": "app",
+          "type": "CNAME",
+          "content": "pages.example.invalid",
+          "proxied": true,
+          "comment": "Managed by Zaip Terraform; destination=pages"
+        }
+      }
+    }
+  ]
+}