@apexops/cli 0.10.0-next.0 → 0.10.0-next.1

package/dist/azure-mcp-environment.d.ts

@@ -0,0 +1,2 @@
+export declare function azureMcpEnvironment(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+//# sourceMappingURL=azure-mcp-environment.d.ts.map

package/dist/azure-mcp-environment.js

@@ -0,0 +1,7 @@
+export function azureMcpEnvironment(environment) {
+    return {
+        ...environment,
+        DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: environment.DOTNET_SYSTEM_GLOBALIZATION_INVARIANT ?? "1",
+    };
+}
+//# sourceMappingURL=azure-mcp-environment.js.map

package/dist/azure-mcp.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=azure-mcp.d.ts.map

package/dist/azure-mcp.js

@@ -0,0 +1,21 @@
+import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import process from "node:process";
+import { azureMcpEnvironment } from "./azure-mcp-environment.js";
+const require = createRequire(import.meta.url);
+const azureMcpEntrypoint = require.resolve("@azure/mcp");
+const child = spawn(process.execPath, [azureMcpEntrypoint, "server", "start"], {
+    stdio: "inherit",
+    env: azureMcpEnvironment(process.env),
+});
+child.on("error", (error) => {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+});
+child.on("exit", (code, signal) => {
+    if (signal !== null)
+        process.kill(process.pid, signal);
+    else
+        process.exitCode = code ?? 1;
+});
+//# sourceMappingURL=azure-mcp.js.map

package/dist/cli.js

@@ -426,6 +426,9 @@ export async function execute(argv, root = process.cwd(), options = {}) {
                 ...(typeof flags.target === "string" ? { targetScope: flags.target } : {}),
                 iacTool: flags.iac === "terraform" ? "terraform" : "bicep",
             });
+        case "project delete":
+            confirmed(flags, "project delete");
+            return service.deleteProject(required(flags, "project"), true);
         case "project use":
             return service.use(required(flags, "project"), typeof flags.run === "string" ? flags.run : undefined);
         case "project show":

package/dist/mcp.js

@@ -53,6 +53,18 @@ const inputSubmission = z
         .min(1),
 })
     .strict();
+const projectCreateInput = z
+    .object({
+    projectId: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+    displayName: z.string().min(1).max(256),
+    environment: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+    targetScope: z.string().min(1).max(1024).optional(),
+    iacTool: z.enum(["bicep", "terraform"]),
+})
+    .strict();
+const projectIdInput = z.object({ projectId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/) }).strict();
+const projectUseInput = projectIdInput.extend({ runId: z.string().min(1).optional() });
+const projectDeleteInput = projectIdInput.extend({ confirm: z.literal(true) });
 const normalizeOutputs = (outputs) => outputs.map(({ kind, value, summary }) => ({
     kind,
     value,
@@ -75,6 +87,16 @@ export function createMcpServer(service) {
         inputSchema: { taskId: z.string() },
     }, async ({ taskId }) => result(await service.taskContext(taskId)));
     server.registerTool("recordInput", { description: "Record answers for the exact pending kernel input request", inputSchema: inputSubmission }, async (input) => result(await service.recordInput(input)));
+    server.registerTool("projectCreate", {
+        description: "Create and select a new project with its initial environment run",
+        inputSchema: projectCreateInput,
+    }, async (input) => result(await service.createProject(input)));
+    server.registerTool("projectList", { description: "List projects in the current workspace" }, async () => result({ projects: await service.listProjects() }));
+    server.registerTool("projectUse", { description: "Select an existing project and optionally one of its runs", inputSchema: projectUseInput }, async ({ projectId, runId }) => result(await service.use(projectId, runId)));
+    server.registerTool("projectDelete", {
+        description: "Delete a project and all of its run-bound state after explicit confirmation",
+        inputSchema: projectDeleteInput,
+    }, async ({ projectId, confirm }) => result(await service.deleteProject(projectId, confirm)));
     server.registerTool("stageArtifact", {
         inputSchema: {
             taskId: z.string(),

package/dist/service.d.ts

@@ -579,6 +579,10 @@ export declare class ApexService {
         projectId: string;
         displayName: string;
     }>>;
+    deleteProject(projectId: ProjectId, confirmed: boolean): Promise<{
+        deleted: ProjectId;
+        selected?: Selection;
+    }>;
     use(projectId: ProjectId, runId?: RunId): Promise<Selection>;
     show(projectId?: ProjectId): Promise<unknown>;
     search(term: string, limit?: number): Promise<Array<{

package/dist/service.js

@@ -111,7 +111,20 @@ const REQUIREMENTS_INTAKE = [
         round: "business-discovery",
         questions: [
             { id: "workload", prompt: "Briefly describe the workload and its users." },
-            { id: "industry", prompt: "Which industry or domain does this workload serve?" },
+            {
+                id: "industry",
+                prompt: "Choose the industry or domain that best fits the workload.",
+                options: [
+                    "financial-services",
+                    "healthcare",
+                    "retail",
+                    "public-sector",
+                    "manufacturing",
+                    "education",
+                    "technology",
+                    "other",
+                ],
+            },
             {
                 id: "delivery-scenario",
                 prompt: "Is this a greenfield build, migration, modernization, or extension?",
@@ -139,6 +152,7 @@ const REQUIREMENTS_INTAKE = [
             {
                 id: "data-sensitivity",
                 prompt: "Choose the data classification or explicitly defer it.",
+                options: ["public", "internal", "confidential", "restricted"],
                 valueType: "data-classification",
             },
             { id: "iac-preference", prompt: "Choose the preferred infrastructure tool.", options: ["bicep", "terraform"] },
@@ -151,7 +165,22 @@ const REQUIREMENTS_INTAKE = [
             { id: "prohibited-services", prompt: "List prohibited services or use 'none'." },
             {
                 id: "service-preferences",
-                prompt: "State preferred compute, database, integration, and observability services.",
+                prompt: "Select preferred Azure services. Select all that apply; architecture chooses the exact combination.",
+                options: [
+                    "app-service",
+                    "container-apps",
+                    "azure-functions",
+                    "aks",
+                    "azure-sql",
+                    "azure-cosmos-db",
+                    "storage",
+                    "service-bus",
+                    "event-hubs",
+                    "api-management",
+                    "azure-monitor",
+                    "application-insights",
+                ],
+                multiSelect: true,
             },
             { id: "sku-preferences", prompt: "State required SKUs, tier floors, reservations, or use 'no preference'." },
             { id: "environment-overrides", prompt: "State environment-specific service or sizing overrides, or 'none'." },
@@ -162,22 +191,49 @@ const REQUIREMENTS_INTAKE = [
         questions: [
             {
                 id: "compliance",
-                prompt: "List compliance and regulatory scopes or explicitly defer them.",
+                prompt: "Select applicable compliance and regulatory scopes, or explicitly defer them.",
+                options: ["gdpr", "hipaa", "pci-dss", "iso-27001", "soc-2", "other"],
+                multiSelect: true,
                 valueType: "compliance",
             },
             {
                 id: "security-controls",
-                prompt: "List required identity, network, encryption, and secret-management controls.",
+                prompt: "Select required security controls. The Azure baseline recommends managed identity, private access, Key Vault, and diagnostic logging.",
+                options: [
+                    "managed-identity",
+                    "private-endpoints",
+                    "private-dns",
+                    "disable-public-network-access",
+                    "key-vault",
+                    "platform-managed-encryption",
+                    "customer-managed-keys",
+                    "diagnostic-logging",
+                ],
+                multiSelect: true,
+            },
+            {
+                id: "authentication",
+                prompt: "Select the required authentication and authorization mechanisms.",
+                options: ["microsoft-entra-id", "managed-identity", "external-oidc", "api-key", "anonymous"],
+                multiSelect: true,
+            },
+            {
+                id: "region",
+                prompt: "Choose the Azure region, or explicitly defer the decision.",
+                options: ["swedencentral", "westeurope", "germanywestcentral"],
             },
-            { id: "authentication", prompt: "Describe authentication and authorization requirements." },
-            { id: "region", prompt: "State the required Azure region or use 'deferred: <owner>'." },
             { id: "availability-recovery", prompt: "State availability, RTO, RPO, backup, and recovery requirements." },
             {
                 id: "recovery",
                 prompt: "Provide RTO and RPO in whole minutes or explicitly defer them.",
                 valueType: "recovery",
             },
-            { id: "operations", prompt: "State monitoring, alerting, support, and operational requirements." },
+            {
+                id: "operations",
+                prompt: "Select operational capabilities required for the workload.",
+                options: ["azure-monitor", "application-insights", "log-analytics", "managed-alerts", "24x7-support"],
+                multiSelect: true,
+            },
         ],
     },
 ];
@@ -536,6 +592,45 @@ export class ApexService {
         const projects = await Promise.all(names.sort().map(async (projectId) => this.projects.getProject(projectId)));
         return projects.map(({ projectId, displayName }) => ({ projectId, displayName }));
     }
+    async deleteProject(projectId, confirmed) {
+        if (!confirmed)
+            throw new ApexError("APEX_USAGE", "project deletion requires explicit confirmation", EXIT_CODES.usage);
+        const projects = await this.listProjects();
+        if (!projects.some((project) => project.projectId === projectId)) {
+            throw new ApexError("APEX_NOT_FOUND", `Project not found: ${projectId}`, EXIT_CODES.notFound);
+        }
+        if (projects.length <= 1) {
+            throw new ApexError("APEX_CONFLICT", "Cannot delete the only project in a workspace", EXIT_CODES.conflict);
+        }
+        const selection = await this.selection();
+        const nextSelection = selection.projectId !== projectId
+            ? undefined
+            : await (async () => {
+                const replacement = projects.find((project) => project.projectId !== projectId);
+                const replacementProjectId = replacement.projectId;
+                const runId = await this.latestRun(replacementProjectId);
+                await this.projects.getRun(replacementProjectId, runId);
+                return { projectId: replacementProjectId, runId };
+            })();
+        const projectDirectory = this.projects.projectDirectory(projectId);
+        await this.assertSafeExistingPath(join(this.root, ".apex"), projectDirectory);
+        const runDirectory = join(projectDirectory, "runs");
+        await this.assertSafeExistingPath(projectDirectory, runDirectory);
+        const runIds = await readdir(runDirectory);
+        for (const runId of runIds) {
+            const workDirectory = join(this.root, ".apex", "work", runId);
+            if (await this.pathExistsLstat(workDirectory)) {
+                await this.assertSafeExistingPath(join(this.root, ".apex"), workDirectory);
+                await rm(workDirectory, { recursive: true, force: true });
+            }
+        }
+        await rm(projectDirectory, { recursive: true, force: true });
+        if (nextSelection === undefined)
+            return { deleted: projectId };
+        await this.writeSelection(nextSelection);
+        await this.append(await this.run(nextSelection), "selection.changed", nextSelection);
+        return { deleted: projectId, selected: nextSelection };
+    }
     async use(projectId, runId) {
         await this.projects.getProject(projectId);
         const selectedRun = runId ?? (await this.latestRun(projectId));

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const APEX_VERSION: "0.10.0-next.0";
+export declare const APEX_VERSION: "0.10.0-next.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const APEX_VERSION = "0.10.0-next.0";
+export const APEX_VERSION = "0.10.0-next.1";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apexops/cli",
-  "version": "0.10.0-next.0",
+  "version": "0.10.0-next.1",
   "description": "Portable no-shell CLI and MCP facade for APEX",
   "license": "MIT",
   "repository": {
@@ -32,10 +32,11 @@
     "assets"
   ],
   "dependencies": {
-    "@apexops/capabilities": "0.10.0-next.0",
-    "@apexops/contracts": "0.10.0-next.0",
-    "@apexops/kernel": "0.10.0-next.0",
-    "@apexops/renderers": "0.10.0-next.0",
+    "@apexops/capabilities": "0.10.0-next.1",
+    "@apexops/contracts": "0.10.0-next.1",
+    "@apexops/kernel": "0.10.0-next.1",
+    "@apexops/renderers": "0.10.0-next.1",
+    "@azure/mcp": "3.0.0-beta.37",
     "@hono/node-server": "2.0.11",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sinclair/typebox": "0.34.52",