@nurix/apollo 0.2.0 → 0.3.1

package/README.md

@@ -23,7 +23,11 @@ npm install -g @nurix/apollo         # or install the `apollo` binary globally
 ## Commands (implemented)
 
 ```
-apollo init                  # store + validate APOLLO_APP_KEY, gitignore .env,
+apollo login [--no-open]     # browser SSO via 24h device trust: approve once at
+                             # /device (Google SSO / OTP); re-logins within the
+                             # window need no browser. Issues APOLLO_APP_KEY +
+                             # APOLLO_APP_ID into the managed block.
+apollo init                  # login (or paste a key), gitignore .env,
                              # scaffold apollo.service.json
 apollo add <service>         # the installer (see flow below)
 apollo add                   # same, picking the service from the catalogue

package/dist/commands/init.js

@@ -7,6 +7,7 @@ import { resolveApolloUrl, validateAppKey } from "../lib/apollo_client.js";
 import { ensureEnvGitignored, readManagedValues, upsertManagedValues } from "../lib/env_file.js";
 import { hasManifest, scaffoldManifest } from "../lib/manifest.js";
 import { isInteractive } from "../lib/interactive.js";
+import { performDeviceLogin } from "./login.js";
 // Run the init flow: collect + validate the key, write managed blocks, scaffold.
 export async function runInit(options) {
     const cwd = process.cwd();
@@ -28,6 +29,18 @@ export async function runInit(options) {
             return;
         }
     }
+    const viaBrowser = await p.confirm({
+        message: "Sign in via the browser to create your application & key? (No = paste a key)",
+    });
+    if (!p.isCancel(viaBrowser) && viaBrowser) {
+        if (!(await performDeviceLogin(baseUrl, cwd))) {
+            p.outro("Sign-in failed — re-run `apollo init`, or pick the paste option.");
+            process.exitCode = 1;
+            return;
+        }
+        await finishInit(cwd);
+        return;
+    }
     const appKey = await p.password({
         message: `Paste your APOLLO_APP_KEY (create an application in the Apollo console: ${baseUrl})`,
         validate: (value) => value?.startsWith("apollo_app_") ? undefined : "Expected a key starting with apollo_app_",
@@ -51,6 +64,10 @@ export async function runInit(options) {
     if (await ensureEnvGitignored(cwd)) {
         p.log.info("Added .env to .gitignore");
     }
+    await finishInit(cwd);
+}
+// Shared init tail: offer the manifest scaffold, then close out.
+async function finishInit(cwd) {
     if (!hasManifest(cwd)) {
         const repoName = deriveRepoName(cwd);
         const shouldScaffold = await p.confirm({

package/dist/commands/login.js

@@ -0,0 +1,90 @@
+// packages/cli/src/commands/login.ts - `apollo login`: browser SSO via Apollo's
+// 24h device-trust flow (consumer-journey Stage 1). A device approved within
+// the window re-issues keys with no browser round-trip; only a fresh / expired
+// device needs the approval leg. Writes APOLLO_APP_KEY + APOLLO_APP_ID into
+// the managed .env block — no key pasting.
+import path from "node:path";
+import * as p from "@clack/prompts";
+import { resolveApolloUrl } from "../lib/apollo_client.js";
+import { ensureEnvGitignored, readManagedValues, upsertManagedValues } from "../lib/env_file.js";
+import { launchBrowser } from "../lib/browser_opener.js";
+import { getOrCreateDeviceId } from "../lib/device_identity.js";
+import { pollDeviceOnce, pollUntilIssued, startDeviceTrust, } from "../lib/device_flow.js";
+// Browser-approval wait cap; the trust window itself is 24h server-side.
+const APPROVAL_TIMEOUT_SECONDS = 10 * 60;
+// Run the login flow and write the issued key; returns false on failure.
+export async function performDeviceLogin(baseUrl, cwd, flags = {}) {
+    const deviceId = await getOrCreateDeviceId();
+    const start = await startDeviceTrust(baseUrl, deviceId);
+    const managedValues = await readManagedValues(path.join(cwd, ".env"));
+    const pollParams = {
+        deviceCode: start.device_code,
+        deviceId,
+        appName: deriveAppName(cwd),
+        applicationId: managedValues.APOLLO_APP_ID || undefined,
+    };
+    // Trusted-device fast path: an approval inside the 24h window is not
+    // consumed, so a single poll may already succeed with no browser at all.
+    let issued = null;
+    const firstAttempt = await pollDeviceOnce(baseUrl, pollParams);
+    if (firstAttempt.kind === "issued") {
+        issued = firstAttempt.issued;
+        p.log.success("Device already trusted — no browser approval needed");
+    }
+    else if (firstAttempt.kind === "failed") {
+        p.log.error(firstAttempt.message);
+        return false;
+    }
+    if (!issued) {
+        const verificationUrl = start.verification_uri_complete ?? start.verification_uri;
+        p.note(`Code: ${start.user_code}\n\nApprove at: ${verificationUrl}\n(valid for ~${Math.round(start.expires_in / 3600)}h on this device)`, "Confirm this code in your browser");
+        if (flags.open !== false)
+            launchBrowser(verificationUrl);
+        const spinner = p.spinner();
+        spinner.start("Waiting for approval in the browser");
+        try {
+            issued = await pollUntilIssued(baseUrl, pollParams, start.interval, Math.min(start.expires_in, APPROVAL_TIMEOUT_SECONDS));
+        }
+        catch (error) {
+            spinner.stop("Sign-in failed", 1);
+            p.log.error(error instanceof Error ? error.message : String(error));
+            return false;
+        }
+        spinner.stop("Approved");
+    }
+    p.log.success(`Key issued for application '${issued.name}' (${issued.environment})`);
+    await upsertManagedValues(path.join(cwd, ".env"), {
+        APOLLO_APP_KEY: issued.token,
+        APOLLO_APP_ID: issued.appId,
+    });
+    await upsertManagedValues(path.join(cwd, ".env.example"), {
+        APOLLO_APP_KEY: "",
+        APOLLO_APP_ID: "",
+    });
+    if (await ensureEnvGitignored(cwd)) {
+        p.log.info("Added .env to .gitignore");
+    }
+    p.log.success("APOLLO_APP_KEY + APOLLO_APP_ID written to the managed .env block");
+    return true;
+}
+// `apollo login` — the standalone command wrapper.
+export async function runLogin(options, flags = {}) {
+    const cwd = process.cwd();
+    const baseUrl = resolveApolloUrl(options);
+    p.intro("apollo login");
+    const didLogin = await performDeviceLogin(baseUrl, cwd, flags);
+    if (!didLogin) {
+        p.outro("Nothing was written.");
+        process.exitCode = 1;
+        return;
+    }
+    p.outro("Ready — run `apollo add <service>` to wire in stack services.");
+}
+// Derive a spec-conformant application name from the folder name.
+function deriveAppName(cwd) {
+    return (path
+        .basename(cwd)
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/^-+|-+$/g, "") || "app");
+}

package/dist/commands/open.js

@@ -1,8 +1,8 @@
 // packages/cli/src/commands/open.ts - `apollo open <service>`: open the
 // service's endpoint (or repository) in the default browser.
-import { spawn } from "node:child_process";
 import * as p from "@clack/prompts";
 import { fetchCatalogue, resolveApolloUrl } from "../lib/apollo_client.js";
+import { launchBrowser } from "../lib/browser_opener.js";
 // Resolve the URL to open (chosen endpoint > production > any > repository) and launch it.
 export async function runOpen(serviceName, options, globals) {
     const baseUrl = resolveApolloUrl(globals);
@@ -26,12 +26,3 @@ export async function runOpen(serviceName, options, globals) {
     launchBrowser(url);
     p.log.success(`Opening ${url}`);
 }
-// Launch the platform's default opener, detached so the CLI can exit.
-function launchBrowser(url) {
-    const [command, args] = process.platform === "darwin"
-        ? ["open", [url]]
-        : process.platform === "win32"
-            ? ["cmd", ["/c", "start", "", url]]
-            : ["xdg-open", [url]];
-    spawn(command, args, { detached: true, stdio: "ignore" }).unref();
-}

package/dist/commands/sync.js

@@ -35,6 +35,10 @@ export async function runSync(options) {
     spinner.stop(`Application '${projection.app.name}' (${projection.app.environment}): ${projection.credentials.length} credential(s)`);
     const nextValues = { APOLLO_APP_KEY: appKey };
     const placeholders = { APOLLO_APP_KEY: "" };
+    if (managedValues.APOLLO_APP_ID) {
+        nextValues.APOLLO_APP_ID = managedValues.APOLLO_APP_ID;
+        placeholders.APOLLO_APP_ID = "";
+    }
     for (const credential of [...projection.credentials].sort((a, b) => a.service.localeCompare(b.service))) {
         const prefix = toEnvPrefix(credential.service);
         nextValues[`${prefix}_ENDPOINT`] = credential.endpoint;

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 // packages/cli/src/index.ts - `apollo` CLI entry: command wiring.
 import { Command } from "commander";
+import { runLogin } from "./commands/login.js";
 import { runInit } from "./commands/init.js";
 import { runAdd } from "./commands/add.js";
 import { runList } from "./commands/list.js";
@@ -14,8 +15,13 @@ const program = new Command();
 program
     .name("apollo")
     .description("Bootstrap NuStack services into your repo via the Apollo discovery plane.")
-    .version("0.2.0")
+    .version("0.3.0")
     .option("--apollo-url <url>", "Apollo base URL (defaults to $APOLLO_URL, then the hosted instance)");
+program
+    .command("login")
+    .description("Sign in via the browser (24h device trust) and issue your APOLLO_APP_KEY")
+    .option("--no-open", "don't auto-open the browser; just print the approval URL")
+    .action(async (options) => runLogin(program.opts(), options));
 program
     .command("init")
     .description("Store your APOLLO_APP_KEY in the managed .env block and scaffold the manifest")

package/dist/lib/browser_opener.js

@@ -0,0 +1,17 @@
+// packages/cli/src/lib/browser_opener.ts - Open a URL in the platform's
+// default browser, detached so the CLI can keep running.
+import { spawn } from "node:child_process";
+// Launch the platform's default opener; never throws (callers print the URL anyway).
+export function launchBrowser(url) {
+    const [command, args] = process.platform === "darwin"
+        ? ["open", [url]]
+        : process.platform === "win32"
+            ? ["cmd", ["/c", "start", "", url]]
+            : ["xdg-open", [url]];
+    try {
+        spawn(command, args, { detached: true, stdio: "ignore" }).unref();
+    }
+    catch {
+        // the printed URL is the fallback
+    }
+}

package/dist/lib/device_flow.js

@@ -0,0 +1,60 @@
+// packages/cli/src/lib/device_flow.ts - Apollo's 24h device-trust flow. The
+// CLI never talks to Google: it registers its device id with Apollo, the human
+// approves the device's code at /device in the browser (where Apollo's own
+// Google SSO runs), and the CLI redeems the approval for an APOLLO_APP_KEY.
+// The same code is reused for the same device within the 24h window, and an
+// approval is not consumed by redemption — re-login inside the window needs
+// no browser round-trip.
+// Register (or re-fetch) this device's trust code.
+export async function startDeviceTrust(baseUrl, deviceId) {
+    const response = await fetch(`${baseUrl}/api/v1/device/start`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ device_id: deviceId }),
+        signal: AbortSignal.timeout(10_000),
+    });
+    const payload = (await response.json().catch(() => null));
+    if (!response.ok || !payload?.device_code || !payload?.user_code) {
+        throw new Error(payload?.message ?? `device start failed: HTTP ${response.status}`);
+    }
+    return payload;
+}
+// One redemption attempt — used directly for the trusted-device fast path.
+export async function pollDeviceOnce(baseUrl, params) {
+    const response = await fetch(`${baseUrl}/api/v1/device/poll`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            device_code: params.deviceCode,
+            device_id: params.deviceId,
+            name: params.appName,
+            applicationId: params.applicationId,
+        }),
+        signal: AbortSignal.timeout(10_000),
+    });
+    const payload = (await response.json().catch(() => null));
+    if (response.ok && payload?.token && payload?.appId) {
+        return { kind: "issued", issued: payload };
+    }
+    if (payload?.error === "authorization_pending") {
+        return { kind: "pending" };
+    }
+    return {
+        kind: "failed",
+        message: payload?.message ?? `device poll failed: HTTP ${response.status}`,
+    };
+}
+// Poll until approved in the browser, denied, or the window expires.
+export async function pollUntilIssued(baseUrl, params, intervalSeconds, timeoutSeconds) {
+    const deadline = Date.now() + timeoutSeconds * 1_000;
+    const waitMs = Math.max(intervalSeconds, 1) * 1_000;
+    while (Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, waitMs));
+        const outcome = await pollDeviceOnce(baseUrl, params);
+        if (outcome.kind === "issued")
+            return outcome.issued;
+        if (outcome.kind === "failed")
+            throw new Error(outcome.message);
+    }
+    throw new Error("timed out waiting for browser approval — run `apollo login` again");
+}

package/dist/lib/device_identity.js

@@ -0,0 +1,22 @@
+// packages/cli/src/lib/device_identity.ts - Stable per-machine device identity
+// for the 24h device-trust window. Generated once, persisted at
+// ~/.apollo/device_id, and sent with every device/start + device/poll call.
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+// Read the persisted device id, creating one on first use.
+export async function getOrCreateDeviceId() {
+    const dir = path.join(os.homedir(), ".apollo");
+    const file = path.join(dir, "device_id");
+    if (existsSync(file)) {
+        const existing = (await readFile(file, "utf8")).trim();
+        if (existing)
+            return existing;
+    }
+    const deviceId = `dev_${randomBytes(16).toString("hex")}`;
+    await mkdir(dir, { recursive: true });
+    await writeFile(file, `${deviceId}\n`, "utf8");
+    return deviceId;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/apollo",
-    "version": "0.2.0",
+    "version": "0.3.1",
     "description": "The apollo CLI — bootstrap NuStack services into a repo via the Apollo discovery plane.",
     "type": "module",
     "private": false,