@apexops/cli 0.10.0-next.0

package/dist/errors.d.ts

@@ -0,0 +1,19 @@
+export declare const EXIT_CODES: {
+    readonly success: 0;
+    readonly usage: 2;
+    readonly notFound: 3;
+    readonly conflict: 4;
+    readonly validation: 5;
+    readonly stale: 6;
+    readonly authorization: 7;
+    readonly internal: 10;
+};
+export type ApexErrorCode = "APEX_USAGE" | "APEX_NOT_FOUND" | "APEX_CONFLICT" | "APEX_VALIDATION" | "APEX_STALE" | "APEX_AUTHORIZATION" | "APEX_INTERNAL";
+export declare class ApexError extends Error {
+    readonly code: ApexErrorCode;
+    readonly exitCode: number;
+    readonly details?: unknown;
+    constructor(code: ApexErrorCode, message: string, exitCode: number, details?: unknown, options?: ErrorOptions);
+}
+export declare function normalizeError(error: unknown): ApexError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.js

@@ -0,0 +1,34 @@
+export const EXIT_CODES = {
+    success: 0,
+    usage: 2,
+    notFound: 3,
+    conflict: 4,
+    validation: 5,
+    stale: 6,
+    authorization: 7,
+    internal: 10,
+};
+export class ApexError extends Error {
+    code;
+    exitCode;
+    details;
+    constructor(code, message, exitCode, details, options) {
+        super(message, options);
+        this.code = code;
+        this.exitCode = exitCode;
+        this.details = details;
+        this.name = "ApexError";
+    }
+}
+export function normalizeError(error) {
+    if (error instanceof ApexError)
+        return error;
+    if (error instanceof Error && /expired|stale/i.test(error.message)) {
+        return new ApexError("APEX_STALE", error.message, EXIT_CODES.stale, undefined, { cause: error });
+    }
+    if (error instanceof Error && error.code === "ENOENT") {
+        return new ApexError("APEX_NOT_FOUND", error.message, EXIT_CODES.notFound, undefined, { cause: error });
+    }
+    return new ApexError("APEX_INTERNAL", error instanceof Error ? error.message : String(error), EXIT_CODES.internal, undefined, { cause: error });
+}
+//# sourceMappingURL=errors.js.map

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./assets.js";
+export * from "./cli.js";
+export * from "./errors.js";
+export * from "./mcp.js";
+export * from "./provider-transfer.js";
+export * from "./service.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,7 @@
+export * from "./assets.js";
+export * from "./cli.js";
+export * from "./errors.js";
+export * from "./mcp.js";
+export * from "./provider-transfer.js";
+export * from "./service.js";
+//# sourceMappingURL=index.js.map

package/dist/mcp.d.ts

@@ -0,0 +1,5 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { ApexService } from "./service.js";
+export declare function createMcpServer(service: ApexService): McpServer;
+export declare function serveMcp(service: ApexService): Promise<void>;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.js

@@ -0,0 +1,210 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { ApexService, SUPPORTED_ARTIFACT_KINDS } from "./service.js";
+import { APEX_VERSION } from "./version.js";
+const artifactKind = z.enum(SUPPORTED_ARTIFACT_KINDS);
+const taskOutput = z.object({ kind: artifactKind, value: z.unknown(), summary: z.string().optional() });
+const uniqueStrings = z
+    .array(z.string().min(1))
+    .min(1)
+    .refine((values) => new Set(values).size === values.length);
+const inputValue = z.union([
+    z.string().min(1),
+    uniqueStrings,
+    z.object({ kind: z.literal("deferred"), owner: z.string().min(1) }).strict(),
+    z.object({ kind: z.literal("unknown") }).strict(),
+    z
+        .object({
+        kind: z.literal("budget"),
+        amount: z.number().nonnegative(),
+        currency: z.string().regex(/^[A-Z]{3}$/),
+        cadence: z.literal("monthly"),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal("recovery"),
+        rtoMinutes: z.number().int().nonnegative(),
+        rpoMinutes: z.number().int().nonnegative(),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal("data-classification"),
+        classification: z.enum(["public", "internal", "confidential", "restricted"]),
+    })
+        .strict(),
+    z.object({ kind: z.literal("compliance"), scopes: uniqueStrings }).strict(),
+]);
+const inputSubmission = z
+    .object({
+    schemaVersion: z.literal("1.0.0"),
+    requestId: z.string().min(1),
+    expectedHead: z.string().regex(/^[0-9a-f]{64}$/),
+    ownerEpoch: z.number().int().positive(),
+    answers: z
+        .array(z
+        .object({
+        questionId: z.string().min(1),
+        value: inputValue,
+    })
+        .strict())
+        .min(1),
+})
+    .strict();
+const normalizeOutputs = (outputs) => outputs.map(({ kind, value, summary }) => ({
+    kind,
+    value,
+    ...(summary === undefined ? {} : { summary }),
+}));
+export function createMcpServer(service) {
+    const server = new McpServer({ name: "apex", version: APEX_VERSION });
+    const result = (value) => ({
+        content: [{ type: "text", text: JSON.stringify(value) }],
+        structuredContent: value,
+    });
+    server.registerTool("status", { description: "Read selected APEX run status" }, async () => result(await service.status()));
+    server.registerTool("capabilityList", { description: "Read capability pack availability" }, async () => result(await service.capabilityList()));
+    server.registerTool("capabilityStatus", { description: "Read one capability pack status", inputSchema: { pack: z.string() } }, async ({ pack }) => result(await service.capabilityStatus(pack)));
+    server.registerTool("nextTask", {
+        description: "Get the next workflow result. Handle needs_input before requesting context; only status=task returns a task.taskId.",
+    }, async () => result(await service.nextTask()));
+    server.registerTool("taskContext", {
+        description: "Read context only for the exact task.taskId returned by nextTask with status=task.",
+        inputSchema: { taskId: z.string() },
+    }, async ({ taskId }) => result(await service.taskContext(taskId)));
+    server.registerTool("recordInput", { description: "Record answers for the exact pending kernel input request", inputSchema: inputSubmission }, async (input) => result(await service.recordInput(input)));
+    server.registerTool("stageArtifact", {
+        inputSchema: {
+            taskId: z.string(),
+            kind: artifactKind.optional(),
+            value: z.unknown().optional(),
+            summary: z.string().optional(),
+            outputs: z.array(taskOutput).optional(),
+        },
+    }, async ({ taskId, kind, value, summary, outputs }) => {
+        if (outputs !== undefined)
+            return result(await Promise.all(normalizeOutputs(outputs).map((output) => service.stageArtifact(taskId, output))));
+        if (kind === undefined)
+            throw new Error("stageArtifact requires kind/value or outputs[]");
+        return result(await service.stageArtifact(taskId, { kind, value, ...(summary === undefined ? {} : { summary }) }));
+    });
+    server.registerTool("stageFile", {
+        inputSchema: {
+            taskId: z.string(),
+            path: z.string(),
+            content: z.string(),
+            expectedSha: z
+                .string()
+                .regex(/^[0-9a-f]{64}$/)
+                .optional(),
+        },
+    }, async ({ taskId, path, content, expectedSha }) => result(await service.stageFile(taskId, path, content, expectedSha)));
+    server.registerTool("generateIac", {
+        inputSchema: {
+            taskId: z.string(),
+            existingResources: z.array(z.string()).optional(),
+            azurermProviderConstraint: z.string().optional(),
+            azapiProviderConstraint: z.string().optional(),
+            lockFileContent: z.string().optional(),
+        },
+    }, async ({ taskId, existingResources, azurermProviderConstraint, azapiProviderConstraint, lockFileContent }) => result(await service.generateIac(taskId, {
+        ...(existingResources === undefined ? {} : { existingResources }),
+        ...(azurermProviderConstraint === undefined ? {} : { azurermProviderConstraint }),
+        ...(azapiProviderConstraint === undefined ? {} : { azapiProviderConstraint }),
+        ...(lockFileContent === undefined ? {} : { lockFileContent }),
+    })));
+    server.registerTool("validateTask", {
+        inputSchema: {
+            taskId: z.string(),
+            kind: artifactKind.optional(),
+            value: z.unknown().optional(),
+            summary: z.string().optional(),
+            outputs: z.array(taskOutput).optional(),
+        },
+    }, async ({ taskId, kind, value, summary, outputs }) => result(await service.validateTask(taskId, outputs === undefined
+        ? kind === undefined
+            ? undefined
+            : { kind, value, ...(summary === undefined ? {} : { summary }) }
+        : normalizeOutputs(outputs))));
+    server.registerTool("completeTask", {
+        description: "Complete a task atomically. Supply outputs[] for every task with multiple required output kinds.",
+        inputSchema: {
+            taskId: z.string(),
+            kind: artifactKind.optional(),
+            value: z.unknown().optional(),
+            summary: z.string().optional(),
+            outputs: z.array(taskOutput).optional(),
+        },
+    }, async ({ taskId, kind, value, summary, outputs }) => {
+        if (outputs !== undefined)
+            return result(await service.completeTaskOutputs(taskId, normalizeOutputs(outputs)));
+        if (kind === undefined)
+            throw new Error("completeTask requires kind/value or outputs[]");
+        const context = await service.taskContext(taskId);
+        if (context.task.allowedOutputKinds.length > 1) {
+            throw new Error("completeTask requires outputs[] when the task has multiple required output kinds");
+        }
+        return result(await service.completeTask(taskId, { kind, value, ...(summary === undefined ? {} : { summary }) }));
+    });
+    server.registerTool("preview", { description: "Read the current operator-created deployment preview" }, async () => result(await service.currentPreview()));
+    server.registerTool("reconcile", {}, async () => result(await service.reconcile()));
+    server.registerTool("inventory", {}, async () => result(await service.inventory()));
+    server.registerTool("diagnose", {}, async () => result(await service.diagnose()));
+    server.registerTool("improvementObserve", {
+        description: "Submit one bounded redacted observation for the selected run",
+        inputSchema: {
+            taskId: z.string().optional(),
+            observedAt: z.string().datetime().optional(),
+            source: z.enum([
+                "task-completion",
+                "deterministic-test",
+                "validation-failure",
+                "capability-execution",
+                "cache-check",
+                "explicit-correction",
+            ]),
+            category: z.enum([
+                "correctness",
+                "security",
+                "reliability",
+                "performance",
+                "usability",
+                "documentation",
+                "capability-gap",
+            ]),
+            severity: z.enum(["critical", "high", "medium", "low", "info"]),
+            statement: z.string().min(1).max(1024),
+            evidenceRefs: z
+                .array(z.string().regex(/^[0-9a-f]{64}$/))
+                .min(1)
+                .max(32),
+        },
+    }, async ({ taskId, observedAt, ...input }) => result(await service.improvementObserve({
+        ...input,
+        ...(taskId === undefined ? {} : { taskId }),
+        ...(observedAt === undefined ? {} : { observedAt }),
+    })));
+    server.registerTool("improvementObservations", { description: "Read bounded observations" }, async () => result(await service.improvementObservations()));
+    server.registerTool("improvementProposals", { description: "Read inert improvement proposals" }, async () => result(await service.improvementProposals()));
+    server.registerTool("render", { inputSchema: { kind: z.enum(["status", "requirements", "preview", "approval", "inventory"]) } }, async ({ kind }) => result(await service.render(kind)));
+    server.registerTool("promote", { inputSchema: { environment: z.string(), target: z.string() } }, async ({ environment, target }) => result(await service.promote(environment, target)));
+    server.registerTool("doctor", { inputSchema: { fix: z.boolean().optional(), yes: z.boolean().optional() } }, async ({ fix, yes }) => result(await service.doctor(fix, yes)));
+    server.registerTool("submitEvidence", {
+        inputSchema: {
+            taskId: z.string(),
+            kind: z.string(),
+            value: z.record(z.string(), z.json()),
+            required: z.boolean().optional(),
+        },
+    }, async ({ taskId, kind, value, required }) => {
+        await service.taskContext(taskId);
+        return result(await service.acceptEvidence({ kind, contentType: "application/json", value, required: required ?? false }));
+    });
+    return server;
+}
+export async function serveMcp(service) {
+    await createMcpServer(service).connect(new StdioServerTransport());
+}
+//# sourceMappingURL=mcp.js.map

package/dist/provider-runtime.d.ts

@@ -0,0 +1,27 @@
+import type { EncryptedPlanArtifactStore, LocalEncryptedPlan, PersistedPreviewBinding, PreviewBindingStore } from "@apexops/capabilities";
+export declare function hashTerraformLockFile(terraformRoot: string): Promise<string>;
+export declare function hashTerraformConfiguration(terraformRoot: string): Promise<string>;
+export declare class FilePreviewBindingStore implements PreviewBindingStore {
+    private readonly bindingsRoot;
+    private readonly latestRoot;
+    private readonly kind;
+    constructor(bindingsRoot: string, latestRoot: string, kind: PersistedPreviewBinding["kind"]);
+    save(previewHash: string, binding: PersistedPreviewBinding): Promise<void>;
+    load(previewHash: string): Promise<PersistedPreviewBinding | undefined>;
+    loadLatest(projectId: string, runId: string, operation: "apply" | "destroy"): Promise<PersistedPreviewBinding | undefined>;
+}
+export declare class FileEncryptedPlanArtifactStore implements EncryptedPlanArtifactStore {
+    private readonly artifactsRoot;
+    constructor(artifactsRoot: string);
+    put(reference: string, artifact: LocalEncryptedPlan): Promise<void>;
+    get(reference: string): Promise<LocalEncryptedPlan | undefined>;
+}
+export declare function createFileProviderRuntime(workspaceRoot: string): Promise<{
+    bindingStores: {
+        bicep: FilePreviewBindingStore;
+        terraform: FilePreviewBindingStore;
+    };
+    artifactStore: FileEncryptedPlanArtifactStore;
+    keyProvider: () => Promise<Uint8Array>;
+}>;
+//# sourceMappingURL=provider-runtime.d.ts.map

package/dist/provider-runtime.js

@@ -0,0 +1,229 @@
+import { randomBytes } from "node:crypto";
+import { chmod, lstat, mkdir, readFile, readdir } from "node:fs/promises";
+import { join, relative } from "node:path";
+import { atomicWriteBytes, atomicWriteJson, sha256Bytes, sha256Json } from "@apexops/kernel";
+const HASH_PATTERN = /^[0-9a-f]{64}$/;
+async function ensureDirectory(path, mode) {
+    try {
+        const existing = await lstat(path);
+        if (existing.isSymbolicLink() || !existing.isDirectory()) {
+            throw new Error(`Provider runtime directory is not a regular directory: ${path}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        await mkdir(path, { mode });
+    }
+    if (mode !== undefined)
+        await chmod(path, mode);
+}
+async function createRuntimeRoot(workspaceRoot) {
+    const apexRoot = join(workspaceRoot, ".apex");
+    const localRoot = join(apexRoot, "local");
+    const runtimeRoot = join(localRoot, "provider-runtime");
+    await ensureDirectory(apexRoot);
+    await ensureDirectory(localRoot, 0o700);
+    await ensureDirectory(runtimeRoot, 0o700);
+    return runtimeRoot;
+}
+async function createRuntimeDirectory(runtimeRoot, name) {
+    const path = join(runtimeRoot, name);
+    await ensureDirectory(path, 0o700);
+    return path;
+}
+function requireHash(value, label) {
+    if (!HASH_PATTERN.test(value))
+        throw new Error(`${label} must be a SHA-256 hash`);
+    return value;
+}
+function storageKey(value) {
+    return sha256Bytes(Buffer.from(value, "utf8"));
+}
+async function readJsonFile(path) {
+    try {
+        const info = await lstat(path);
+        if (info.isSymbolicLink() || !info.isFile())
+            throw new Error(`Provider runtime file is not a regular file: ${path}`);
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+async function readRegularFile(path, label) {
+    const info = await lstat(path);
+    if (info.isSymbolicLink() || !info.isFile())
+        throw new Error(`${label} is not a regular file: ${path}`);
+    return await readFile(path);
+}
+function isTerraformInputFile(name) {
+    return (name === ".terraform.lock.hcl" ||
+        name.endsWith(".tf") ||
+        name.endsWith(".tf.json") ||
+        name.endsWith(".tfvars") ||
+        name.endsWith(".tfvars.json"));
+}
+async function terraformInputFiles(root, directory = root) {
+    const files = [];
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+        const path = join(directory, entry.name);
+        if (entry.isSymbolicLink())
+            throw new Error(`Terraform configuration contains a symlink: ${path}`);
+        if (entry.isDirectory()) {
+            if (entry.name !== ".terraform")
+                files.push(...(await terraformInputFiles(root, path)));
+            continue;
+        }
+        if (entry.isFile() && isTerraformInputFile(entry.name))
+            files.push(path);
+    }
+    return files.sort((left, right) => relative(root, left).localeCompare(relative(root, right)));
+}
+export async function hashTerraformLockFile(terraformRoot) {
+    return sha256Bytes(await readRegularFile(join(terraformRoot, ".terraform.lock.hcl"), "Terraform lock file"));
+}
+export async function hashTerraformConfiguration(terraformRoot) {
+    const files = await terraformInputFiles(terraformRoot);
+    if (files.length === 0)
+        throw new Error(`Terraform configuration has no input files: ${terraformRoot}`);
+    return sha256Json(await Promise.all(files.map(async (path) => ({
+        path: relative(terraformRoot, path).replaceAll("\\", "/"),
+        hash: sha256Bytes(await readRegularFile(path, "Terraform input")),
+    }))));
+}
+function requireBinding(value, previewHash) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Persisted preview binding is invalid");
+    }
+    const binding = value;
+    const preview = binding.preview;
+    if ((binding.kind !== "bicep" && binding.kind !== "terraform") ||
+        preview === null ||
+        typeof preview !== "object" ||
+        Array.isArray(preview) ||
+        preview.previewHash !== previewHash) {
+        throw new Error("Persisted preview binding does not match its hash");
+    }
+    return value;
+}
+function requireArtifact(value, reference) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Persisted encrypted plan artifact is invalid");
+    }
+    const stored = value;
+    if (stored.reference !== reference || stored.artifact === null || typeof stored.artifact !== "object") {
+        throw new Error("Persisted encrypted plan artifact does not match its reference");
+    }
+    return stored.artifact;
+}
+export class FilePreviewBindingStore {
+    bindingsRoot;
+    latestRoot;
+    kind;
+    constructor(bindingsRoot, latestRoot, kind) {
+        this.bindingsRoot = bindingsRoot;
+        this.latestRoot = latestRoot;
+        this.kind = kind;
+    }
+    async save(previewHash, binding) {
+        requireHash(previewHash, "Preview hash");
+        requireBinding(binding, previewHash);
+        if (binding.kind !== this.kind)
+            throw new Error(`Expected a ${this.kind} preview binding`);
+        await atomicWriteJson(join(this.bindingsRoot, `${previewHash}.json`), binding);
+        const preview = binding.preview;
+        const latestKey = storageKey(JSON.stringify([this.kind, preview.projectId, preview.runId, preview.operation]));
+        await atomicWriteJson(join(this.latestRoot, `${latestKey}.json`), { previewHash });
+    }
+    async load(previewHash) {
+        requireHash(previewHash, "Preview hash");
+        const value = await readJsonFile(join(this.bindingsRoot, `${previewHash}.json`));
+        if (value === undefined)
+            return undefined;
+        const binding = requireBinding(value, previewHash);
+        if (binding.kind !== this.kind)
+            throw new Error(`Expected a ${this.kind} preview binding`);
+        return binding;
+    }
+    async loadLatest(projectId, runId, operation) {
+        const latestKey = storageKey(JSON.stringify([this.kind, projectId, runId, operation]));
+        const value = await readJsonFile(join(this.latestRoot, `${latestKey}.json`));
+        if (value === undefined)
+            return undefined;
+        if (value === null ||
+            typeof value !== "object" ||
+            Array.isArray(value) ||
+            typeof value.previewHash !== "string") {
+            throw new Error("Latest preview binding pointer is invalid");
+        }
+        return await this.load(requireHash(value.previewHash, "Latest preview hash"));
+    }
+}
+export class FileEncryptedPlanArtifactStore {
+    artifactsRoot;
+    constructor(artifactsRoot) {
+        this.artifactsRoot = artifactsRoot;
+    }
+    async put(reference, artifact) {
+        if (reference.trim().length === 0)
+            throw new Error("Encrypted plan reference is required");
+        await atomicWriteJson(join(this.artifactsRoot, `${storageKey(reference)}.json`), {
+            reference,
+            artifact,
+        });
+    }
+    async get(reference) {
+        if (reference.trim().length === 0)
+            throw new Error("Encrypted plan reference is required");
+        const value = await readJsonFile(join(this.artifactsRoot, `${storageKey(reference)}.json`));
+        return value === undefined ? undefined : requireArtifact(value, reference);
+    }
+}
+async function readLocalKey(path) {
+    const info = await lstat(path);
+    if (info.isSymbolicLink() || !info.isFile())
+        throw new Error("Local plan transport key is not a regular file");
+    if (process.platform !== "win32" && (info.mode & 0o077) !== 0) {
+        throw new Error("Local plan transport key permissions must be 0600");
+    }
+    const key = await readFile(path);
+    if (key.byteLength !== 32)
+        throw new Error("Local plan transport key must contain exactly 32 bytes");
+    return key;
+}
+async function localKeyProvider(runtimeRoot) {
+    const path = join(runtimeRoot, "plan-transport.key");
+    try {
+        return await readLocalKey(path);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    try {
+        await atomicWriteBytes(path, randomBytes(32), { refuseOverwrite: true });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    return await readLocalKey(path);
+}
+export async function createFileProviderRuntime(workspaceRoot) {
+    const runtimeRoot = await createRuntimeRoot(workspaceRoot);
+    const bindingsRoot = await createRuntimeDirectory(runtimeRoot, "bindings");
+    const latestRoot = await createRuntimeDirectory(runtimeRoot, "latest");
+    const artifactsRoot = await createRuntimeDirectory(runtimeRoot, "artifacts");
+    return {
+        bindingStores: {
+            bicep: new FilePreviewBindingStore(bindingsRoot, latestRoot, "bicep"),
+            terraform: new FilePreviewBindingStore(bindingsRoot, latestRoot, "terraform"),
+        },
+        artifactStore: new FileEncryptedPlanArtifactStore(artifactsRoot),
+        keyProvider: async () => await localKeyProvider(runtimeRoot),
+    };
+}
+//# sourceMappingURL=provider-runtime.js.map

package/dist/provider-transfer.d.ts

@@ -0,0 +1,52 @@
+import { type EnvelopeBindings } from "@apexops/capabilities";
+export declare const PROVIDER_TRANSFER_KIND = "apex-provider-authority";
+export declare const PROVIDER_TRANSFER_MAX_BUNDLE_BYTES: number;
+export declare const PROVIDER_TRANSFER_MAX_FILE_BYTES: number;
+export type ProviderTransferProvider = "bicep" | "terraform";
+export type ProviderTransferOperation = "apply" | "destroy";
+export interface ProviderTransferBindings extends EnvelopeBindings {
+    readonly provider: ProviderTransferProvider;
+    readonly operation: ProviderTransferOperation;
+    readonly projectId: string;
+    readonly runId: string;
+    readonly ownerEpoch: number;
+    readonly previewHash: string;
+    readonly recipient: string;
+    readonly authorityExpiresAt: string;
+    readonly artifactRef?: string;
+    readonly planDigest?: string;
+}
+export interface ProviderTransferFile {
+    readonly path: string;
+    readonly bytes: number;
+    readonly sha256: string;
+    readonly content: string;
+}
+export interface ProviderTransferBundle {
+    readonly implementation: "apex-provider-transfer";
+    readonly version: 1;
+    readonly bindings: ProviderTransferBindings;
+    readonly files: readonly ProviderTransferFile[];
+}
+export interface ProviderTransferExportOptions {
+    readonly previewHash: string;
+    readonly provider: ProviderTransferProvider;
+    readonly recipient: string;
+    readonly ttlMs: number;
+}
+export declare function createProviderTransferBundle(root: string, options: ProviderTransferExportOptions, now?: Date): Promise<ProviderTransferBundle>;
+export declare function exportProviderTransfer(root: string, outputPath: string, options: ProviderTransferExportOptions, dependencies?: {
+    readonly now?: () => Date;
+}): Promise<{
+    path: string;
+    sha256: string;
+    files: number;
+    expiresAt: string;
+}>;
+export declare function importProviderTransfer(root: string, envelopeValue: unknown, recipient: string, now?: () => Date): Promise<{
+    provider: ProviderTransferProvider;
+    operation: ProviderTransferOperation;
+    previewHash: string;
+    files: number;
+}>;
+//# sourceMappingURL=provider-transfer.d.ts.map