@zaip-ai/cli 1.3.8 → 1.4.1

package/templates/infra/terraform/main.tf

@@ -0,0 +1,77 @@
+resource "hostinger_vps" "edge" {
+  count          = var.manage_vps ? 1 : 0
+  plan           = var.edge_vps.plan
+  data_center_id = var.edge_vps.data_center_id
+  template_id    = var.edge_vps.template_id
+  hostname       = var.edge_vps.hostname
+  ssh_key_ids    = var.edge_vps.ssh_key_ids
+
+  lifecycle {
+    precondition {
+      condition     = var.edge_vps != null
+      error_message = "edge_vps is required when manage_vps is true."
+    }
+  }
+}
+
+resource "hostinger_vps" "application" {
+  count          = var.manage_vps ? 1 : 0
+  plan           = var.application_vps.plan
+  data_center_id = var.application_vps.data_center_id
+  template_id    = var.application_vps.template_id
+  hostname       = var.application_vps.hostname
+  ssh_key_ids    = var.application_vps.ssh_key_ids
+
+  lifecycle {
+    precondition {
+      condition     = var.application_vps != null
+      error_message = "application_vps is required when manage_vps is true."
+    }
+  }
+}
+
+locals {
+  edge_ipv4 = var.manage_vps ? hostinger_vps.edge[0].ipv4_address : var.edge_vps_ipv4
+  dns_content = {
+    for key, record in var.cloudflare_dns_records : key => (
+      record.destination == "edge" ? local.edge_ipv4 : record.content
+    )
+  }
+}
+
+resource "cloudflare_dns_record" "approved" {
+  for_each = var.cloudflare_dns_records
+
+  zone_id = var.cloudflare_zone_id
+  name    = each.value.name
+  type    = each.value.type
+  content = local.dns_content[each.key]
+  proxied = each.value.proxied
+  ttl     = each.value.ttl
+  comment = "Managed by Zaip Terraform; destination=${each.value.destination}"
+
+  lifecycle {
+    precondition {
+      condition     = each.value.destination != "edge" || local.edge_ipv4 != null
+      error_message = "An edge record requires the approved VPS 1 IPv4."
+    }
+    precondition {
+      condition     = each.value.destination != "explicit" || try(length(trimspace(each.value.content)) > 0, false)
+      error_message = "An explicit DNS record requires content."
+    }
+    precondition {
+      condition     = each.value.destination != "pages" || each.value.type == "CNAME"
+      error_message = "Cloudflare Pages records must use CNAME and explicit content."
+    }
+    precondition {
+      condition = each.value.name == "@" || each.value.name == var.cloudflare_zone_name || (
+        can(regex("^[a-z0-9-]+$", each.value.name)) || endswith(each.value.name, ".${var.cloudflare_zone_name}")
+      )
+      error_message = "DNS record names must be the zone apex, a relative label, or a name in the approved zone."
+    }
+    precondition {
+      condition     = each.value.destination != "explicit" || each.value.content != var.application_vps_ipv4
+      error_message = "An explicit record cannot target the private application VPS IPv4."
+    }
+  }
+}

package/templates/infra/terraform/outputs.tf

@@ -0,0 +1,20 @@
+output "edge_vps_ipv4" {
+  description = "VPS 1 public IPv4, used only as the approved Cloudflare edge origin."
+  value       = local.edge_ipv4
+}
+
+output "application_vps_ipv4" {
+  description = "VPS 2 IPv4 for controlled administration; never use as a public DNS origin."
+  value       = var.manage_vps ? hostinger_vps.application[0].ipv4_address : var.application_vps_ipv4
+  sensitive   = true
+}
+
+output "cloudflare_dns_record_ids" {
+  description = "Managed Cloudflare DNS record IDs for read-after-write evidence."
+  value       = { for key, record in cloudflare_dns_record.approved : key => record.id }
+}
+
+output "authorized_cloudflare_account_id" {
+  description = "Account identifier declared for plan-policy verification; it is not a credential."
+  value       = var.cloudflare_account_id
+}

package/templates/infra/terraform/terraform.tfvars.example

@@ -0,0 +1,26 @@
+# Copy only non-secret values to a local ignored terraform.tfvars. Supply tokens through TF_VAR_*.
+cloudflare_account_id = "replace-with-approved-account-id"
+cloudflare_zone_id    = "replace-with-approved-zone-id"
+cloudflare_zone_name  = "example.com"
+manage_vps           = false
+edge_vps_ipv4        = "replace-with-approved-edge-ip"
+application_vps_ipv4 = "replace-with-approved-private-vps-ip"
+
+# Only Cloudflare records are managed here. Pages CNAME targets are supplied explicitly.
+cloudflare_dns_records = {
+  app = {
+    name        = "app"
+    type        = "CNAME"
+    destination = "pages"
+    content     = "replace-with-pages-target"
+    proxied     = true
+    ttl         = 1
+  }
+  api = {
+    name        = "api"
+    type        = "A"
+    destination = "edge"
+    proxied     = true
+    ttl         = 1
+  }
+}

package/templates/infra/terraform/variables.tf

@@ -0,0 +1,91 @@
+variable "cloudflare_account_id" {
+  description = "Cloudflare account ID explicitly authorized for this execution."
+  type        = string
+  validation {
+    condition     = length(trimspace(var.cloudflare_account_id)) > 0
+    error_message = "cloudflare_account_id must identify the approved Cloudflare account."
+  }
+}
+
+variable "cloudflare_zone_id" {
+  description = "Cloudflare zone ID explicitly authorized for this execution."
+  type        = string
+  validation {
+    condition     = length(trimspace(var.cloudflare_zone_id)) > 0
+    error_message = "cloudflare_zone_id must identify the approved Cloudflare zone."
+  }
+}
+
+variable "cloudflare_zone_name" {
+  description = "Human-verifiable DNS zone name paired with cloudflare_zone_id."
+  type        = string
+  validation {
+    condition     = can(regex("^[A-Za-z0-9.-]+$", var.cloudflare_zone_name))
+    error_message = "cloudflare_zone_name must be a DNS name."
+  }
+}
+
+variable "manage_vps" {
+  description = "Create Hostinger VPS resources. False adopts explicitly approved existing VPS IPs."
+  type        = bool
+  default     = false
+}
+
+variable "edge_vps" {
+  description = "VPS 1 edge specification. Required only when manage_vps is true."
+  type = object({
+    plan           = string
+    data_center_id = number
+    template_id    = number
+    hostname       = string
+    ssh_key_ids    = list(string)
+  })
+  default  = null
+  nullable = true
+}
+
+variable "application_vps" {
+  description = "VPS 2 private application specification. Required only when manage_vps is true."
+  type = object({
+    plan           = string
+    data_center_id = number
+    template_id    = number
+    hostname       = string
+    ssh_key_ids    = list(string)
+  })
+  default  = null
+  nullable = true
+}
+
+variable "edge_vps_ipv4" {
+  description = "Approved VPS 1 IPv4 for adoption mode."
+  type        = string
+  default     = null
+  nullable    = true
+}
+
+variable "application_vps_ipv4" {
+  description = "Approved VPS 2 IPv4 for adoption mode; DNS must never target this address."
+  type        = string
+  default     = null
+  nullable    = true
+}
+
+variable "cloudflare_dns_records" {
+  description = "Approved Cloudflare DNS records. destination is edge, pages, or explicit; application is forbidden."
+  type = map(object({
+    name        = string
+    type        = string
+    destination = string
+    content     = optional(string)
+    proxied     = bool
+    ttl         = number
+  }))
+  default = {}
+  validation {
+    condition = alltrue([
+      for record in values(var.cloudflare_dns_records) : contains(["edge", "pages", "explicit"], record.destination)
+    ])
+    error_message = "DNS destination must be edge, pages, or explicit; application/private is forbidden."
+  }
+}

package/templates/infra/terraform/versions.tf

@@ -0,0 +1,18 @@
+terraform {
+  required_version = "~> 1.16"
+
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 5.23"
+    }
+    hostinger = {
+      source  = "hostinger/hostinger"
+      version = "~> 0.1.22"
+    }
+  }
+}
+
+provider "cloudflare" {}
+
+provider "hostinger" {}

package/templates/scripts/validate-cloud-hostinger-contract.mjs

@@ -0,0 +1,89 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+
+const root = resolve(import.meta.dirname, "..");
+const files = {
+  architecture: ".agents/architecture/hostinger-cloudflare-terraform.md",
+  requirement: ".agents/requirements/cloud-hostinger-autonomy.md",
+  rule: ".agents/rules/cloud-hostinger-autonomy.md",
+  env: ".agents/.env.example",
+  terraform: "infra/terraform/main.tf",
+  variables: "infra/terraform/variables.tf",
+  skill: ".agents/skills/zaip-skill-hostinger-cloudflare-terraform/SKILL.md",
+  readiness: "infra/terraform/deployment-inputs.example.yaml",
+};
+const source = Object.fromEntries(
+  await Promise.all(
+    Object.entries(files).map(async ([name, path]) => [
+      name,
+      await readFile(resolve(root, path), "utf8"),
+    ]),
+  ),
+);
+const checks = [
+  [source.architecture.includes("Hostinger DNS nunca"), "architecture must prohibit Hostinger DNS"],
+  [
+    source.architecture.includes("VPS 1") && source.architecture.includes("VPS 2"),
+    "architecture must define two VPS roles",
+  ],
+  [
+    source.architecture.includes("redis-prod-queue") &&
+      source.architecture.includes("redis-beta-cache"),
+    "architecture must inventory four Redis roles",
+  ],
+  [
+    source.architecture.includes("Redis") && source.architecture.includes("npm:redis"),
+    "architecture must distinguish Redis server and npm client",
+  ],
+  [
+    source.architecture.includes("BullMQ") && source.architecture.includes("noeviction"),
+    "architecture must define BullMQ queue safety",
+  ],
+  [
+    source.rule.includes("credenciais") && source.rule.includes("nunca autorizam alvo"),
+    "rule must bind credentials to targets",
+  ],
+  [
+    source.env.includes("CLOUDFLARE_API_TOKEN=") &&
+      source.env.includes("ZAIP_EDGE_SSH_HOSTKEY_SHA256="),
+    "env example must name provider and host-key inputs",
+  ],
+  [
+    !/(?:PRIVATE KEY|BEGIN RSA|BEGIN OPENSSH)/.test(source.env),
+    "env example must not contain key material",
+  ],
+  [
+    !/(?:hostinger_[a-z_]*dns|hostinger.*dns)/i.test(source.terraform),
+    "Terraform must not manage Hostinger DNS",
+  ],
+  [
+    source.terraform.includes('resource "hostinger_vps" "edge"') &&
+      source.terraform.includes('resource "hostinger_vps" "application"'),
+    "Terraform must declare edge and application VPS",
+  ],
+  [
+    source.terraform.includes('resource "cloudflare_dns_record"'),
+    "Terraform must manage Cloudflare DNS",
+  ],
+  [
+    source.variables
+      .replace(/\s+/g, " ")
+      .includes('contains(["edge", "pages", "explicit"], record.destination)'),
+    "Terraform DNS destinations must exclude application VPS",
+  ],
+  [
+    source.skill.includes("read-after-write") && source.skill.includes("prova estática/local"),
+    "skill must require truthful live validation",
+  ],
+  [
+    source.readiness.includes("deployment_readiness: failed") &&
+      source.readiness.includes("image_digests: {}"),
+    "readiness template must fail until host and image inputs exist",
+  ],
+];
+const failures = checks.filter(([passed]) => !passed).map(([, message]) => message);
+if (failures.length > 0)
+  throw new Error(`Cloud contract validation failed:\n${failures.join("\n")}`);
+process.stdout.write(
+  `Validated ${checks.length} Cloudflare/Hostinger infrastructure invariants.\n`,
+);

package/templates/scripts/validate-cloud-terraform-plan.mjs

@@ -0,0 +1 @@
+await import("../.agents/tools/cloud-terraform-plan-policy.mjs");