@nurix/apollo 0.3.4 → 0.3.5

package/README.md

@@ -23,10 +23,17 @@ npm install -g @nurix/apollo         # or install the `apollo` binary globally
 ## Commands (implemented)
 
 ```
+apollo                       # bootstrap: validate the stored APOLLO_APP_KEY,
+                             # run the login flow if it's missing/rejected,
+                             # then finish with init's manifest scaffold
 apollo login [--no-open]     # browser SSO via 24h device trust: approve once at
                              # /device (Google SSO / OTP); re-logins within the
                              # window need no browser. Issues APOLLO_APP_KEY +
                              # APOLLO_APP_ID into the managed block.
+apollo logout                # local sign-out: drop APOLLO_APP_KEY from the
+                             # managed block + sever device trust (next login
+                             # needs browser approval); the key stays valid
+                             # server-side until revoked in the console
 apollo init                  # login (or paste a key), gitignore .env,
                              # scaffold apollo.service.json
 apollo add <service>         # the installer (see flow below)
@@ -46,8 +53,8 @@ apollo doctor                # key validity + per-credential health probes +
 apollo open <svc> [--env <name>] # open endpoint (default production) or repo URL
 ```
 
-Global options: `--apollo-url <url>` (defaults to `$APOLLO_URL`, then the
-hosted instance `https://apollo.nurix-ai.co`).
+The Apollo base URL is hardcoded to the hosted instance
+(`https://apollo.nurix-ai.co`) — there is no flag or env override.
 
 ### `apollo init`
 

package/dist/commands/add.js

@@ -4,15 +4,14 @@
 // records the consumes edge (consumer-journey.md §4–§5).
 import path from "node:path";
 import * as p from "@clack/prompts";
-import { exchangeServiceCredential, fetchCatalogue, resolveApolloUrl, } from "../lib/apollo_client.js";
+import { APOLLO_URL, exchangeServiceCredential, fetchCatalogue, } from "../lib/apollo_client.js";
 import { readManagedValues, upsertManagedValues } from "../lib/env_file.js";
 import { detectPackageManager, installPackage } from "../lib/package_manager.js";
 import { appendConsumesEdge, hasManifest, scaffoldManifest } from "../lib/manifest.js";
 import { confirmOrFallback, isInteractive } from "../lib/interactive.js";
 // Run the installer flow end to end for one service.
-export async function runAdd(serviceArg, options) {
+export async function runAdd(serviceArg) {
     const cwd = process.cwd();
-    const baseUrl = resolveApolloUrl(options);
     p.intro(`apollo add${serviceArg ? ` ${serviceArg}` : ""}`);
     const managedValues = await readManagedValues(path.join(cwd, ".env"));
     const appKey = managedValues.APOLLO_APP_KEY ?? process.env.APOLLO_APP_KEY;
@@ -24,7 +23,7 @@ export async function runAdd(serviceArg, options) {
     }
     const spinner = p.spinner();
     spinner.start("Fetching the catalogue");
-    const catalogue = await fetchCatalogue(baseUrl).catch(() => null);
+    const catalogue = await fetchCatalogue(APOLLO_URL).catch(() => null);
     const services = catalogue?.services ?? [];
     spinner.stop(`Catalogue loaded: ${services.length} service(s)`);
     const serviceName = serviceArg ?? (await pickService(services));
@@ -40,7 +39,7 @@ export async function runAdd(serviceArg, options) {
     spinner.start(`Exchanging credentials for '${serviceName}'`);
     let credential;
     try {
-        credential = await exchangeServiceCredential(baseUrl, appKey, serviceName);
+        credential = await exchangeServiceCredential(APOLLO_URL, appKey, serviceName);
     }
     catch (error) {
         spinner.stop("Exchange failed", 1);

package/dist/commands/bootstrap.js

@@ -0,0 +1,40 @@
+// packages/cli/src/commands/bootstrap.ts - Bare `apollo` (no subcommand): the
+// zero-to-ready flow. Probes the stored APOLLO_APP_KEY; when it's missing or
+// rejected, runs the login flow, then finishes with init's manifest scaffold.
+import path from "node:path";
+import * as p from "@clack/prompts";
+import { APOLLO_URL, validateAppKey } from "../lib/apollo_client.js";
+import { readManagedValues } from "../lib/env_file.js";
+import { isInteractive } from "../lib/interactive.js";
+import { performDeviceLogin } from "./login.js";
+import { finishInit } from "./init.js";
+// Run the bootstrap flow: ensure a valid app key (login when needed), then init.
+export async function runBootstrap() {
+    const cwd = process.cwd();
+    p.intro("apollo");
+    if (!isInteractive()) {
+        p.log.error("Bare `apollo` needs an interactive terminal (browser sign-in + prompts).");
+        p.outro("In scripted contexts run `apollo login --no-open`, then `apollo init`.");
+        process.exitCode = 1;
+        return;
+    }
+    const managedValues = await readManagedValues(path.join(cwd, ".env"));
+    let isSignedIn = false;
+    if (managedValues.APOLLO_APP_KEY) {
+        const spinner = p.spinner();
+        spinner.start("Checking the stored APOLLO_APP_KEY against Apollo");
+        isSignedIn = await validateAppKey(APOLLO_URL, managedValues.APOLLO_APP_KEY).catch(() => false);
+        spinner.stop(isSignedIn
+            ? "Signed in — the stored key is valid"
+            : "Stored key rejected — signing in again", isSignedIn ? 0 : 1);
+    }
+    else {
+        p.log.info("No APOLLO_APP_KEY in the managed .env block — signing in");
+    }
+    if (!isSignedIn && !(await performDeviceLogin(cwd))) {
+        p.outro("Sign-in failed — nothing was written. Run `apollo` again, or `apollo login` to retry.");
+        process.exitCode = 1;
+        return;
+    }
+    await finishInit(cwd);
+}

package/dist/commands/describe.js

@@ -1,14 +1,13 @@
 // packages/cli/src/commands/describe.ts - `apollo describe <service>`: the full
 // catalogue entry for one service, prettified or raw JSON.
 import * as p from "@clack/prompts";
-import { fetchCatalogue, resolveApolloUrl } from "../lib/apollo_client.js";
+import { APOLLO_URL, fetchCatalogue } from "../lib/apollo_client.js";
 // Print one catalogue entry; --json emits the raw object for piping.
-export async function runDescribe(serviceName, options, globals) {
-    const baseUrl = resolveApolloUrl(globals);
-    const catalogue = await fetchCatalogue(baseUrl);
+export async function runDescribe(serviceName, options) {
+    const catalogue = await fetchCatalogue(APOLLO_URL);
     const entry = (catalogue.services ?? []).find((service) => service.name === serviceName);
     if (!entry) {
-        p.log.error(`'${serviceName}' is not in the catalogue at ${baseUrl} (${catalogue.services?.length ?? 0} services listed).`);
+        p.log.error(`'${serviceName}' is not in the catalogue at ${APOLLO_URL} (${catalogue.services?.length ?? 0} services listed).`);
         process.exitCode = 1;
         return;
     }

package/dist/commands/doctor.js

@@ -5,20 +5,19 @@
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 import * as p from "@clack/prompts";
-import { fetchCatalogue, resolveApolloUrl, validateAppKey, } from "../lib/apollo_client.js";
+import { APOLLO_URL, fetchCatalogue, validateAppKey } from "../lib/apollo_client.js";
 import { readManagedValues } from "../lib/env_file.js";
 import { hasManifest, manifestPath } from "../lib/manifest.js";
 import { loadSchema, validateManifest } from "../lib/schema_validator.js";
 // Run every check; exit 1 when any error (not warning) was found.
-export async function runDoctor(globals) {
+export async function runDoctor() {
     const cwd = process.cwd();
-    const baseUrl = resolveApolloUrl(globals);
     p.intro("apollo doctor");
     const counters = { errors: 0, warnings: 0 };
     const managedValues = await readManagedValues(path.join(cwd, ".env"));
-    await checkAppKey(managedValues, baseUrl, counters);
+    await checkAppKey(managedValues, counters);
     await checkServiceCredentials(managedValues, counters);
-    await checkManifest(cwd, baseUrl, counters);
+    await checkManifest(cwd, counters);
     const summary = `${counters.errors} error(s), ${counters.warnings} warning(s)`;
     if (counters.errors > 0) {
         p.outro(`Unhealthy — ${summary}.`);
@@ -29,14 +28,14 @@ export async function runDoctor(globals) {
     }
 }
 // Check the APOLLO_APP_KEY exists and is still accepted by Apollo.
-async function checkAppKey(managedValues, baseUrl, counters) {
+async function checkAppKey(managedValues, counters) {
     const appKey = managedValues.APOLLO_APP_KEY ?? process.env.APOLLO_APP_KEY;
     if (!appKey) {
         p.log.error("APOLLO_APP_KEY missing — run `apollo init`.");
         counters.errors += 1;
         return;
     }
-    const isValid = await validateAppKey(baseUrl, appKey).catch(() => false);
+    const isValid = await validateAppKey(APOLLO_URL, appKey).catch(() => false);
     if (isValid) {
         p.log.success("APOLLO_APP_KEY accepted by Apollo");
     }
@@ -81,7 +80,7 @@ async function checkServiceCredentials(managedValues, counters) {
     }
 }
 // Validate the manifest and cross-check its consumes edges against the catalogue.
-async function checkManifest(cwd, baseUrl, counters) {
+async function checkManifest(cwd, counters) {
     if (!hasManifest(cwd)) {
         p.log.warn("No apollo.service.json — the app has no bill of materials. `apollo init` scaffolds one.");
         counters.warnings += 1;
@@ -110,7 +109,7 @@ async function checkManifest(cwd, baseUrl, counters) {
     const edges = (manifest.services ?? []).flatMap((service) => service.consumes ?? []);
     if (edges.length === 0)
         return;
-    const catalogue = await fetchCatalogue(baseUrl).catch(() => null);
+    const catalogue = await fetchCatalogue(APOLLO_URL).catch(() => null);
     const services = catalogue?.services ?? [];
     if (services.length === 0) {
         p.log.info("Catalogue empty — consumes edges not cross-checked.");

package/dist/commands/graph.js

@@ -1,10 +1,9 @@
 // packages/cli/src/commands/graph.ts - `apollo graph`: render the catalogue's
 // consumes-graph as an ascii edge list or a mermaid block.
-import { fetchCatalogue, resolveApolloUrl } from "../lib/apollo_client.js";
+import { APOLLO_URL, fetchCatalogue } from "../lib/apollo_client.js";
 // Print every consumes edge in the catalogue; --mermaid emits `graph LR`.
-export async function runGraph(options, globals) {
-    const baseUrl = resolveApolloUrl(globals);
-    const catalogue = await fetchCatalogue(baseUrl);
+export async function runGraph(options) {
+    const catalogue = await fetchCatalogue(APOLLO_URL);
     const services = catalogue.services ?? [];
     const edges = services.flatMap((service) => (service.consumes ?? []).map((edge) => ({
         from: service.name,
@@ -12,7 +11,7 @@ export async function runGraph(options, globals) {
         via: edge.via ?? "http",
     })));
     if (services.length === 0) {
-        console.log(`Catalogue at ${baseUrl} is empty — nothing to graph.`);
+        console.log(`Catalogue at ${APOLLO_URL} is empty — nothing to graph.`);
         return;
     }
     if (edges.length === 0) {

package/dist/commands/init.js

@@ -3,15 +3,14 @@
 // gitignore .env, and scaffold the repo manifest.
 import path from "node:path";
 import * as p from "@clack/prompts";
-import { resolveApolloUrl, validateAppKey } from "../lib/apollo_client.js";
+import { APOLLO_URL, validateAppKey } from "../lib/apollo_client.js";
 import { ensureEnvGitignored, readManagedValues, upsertManagedValues } from "../lib/env_file.js";
 import { hasManifest, scaffoldManifest } from "../lib/manifest.js";
 import { isInteractive } from "../lib/interactive.js";
 import { performDeviceLogin } from "./login.js";
 // Run the init flow: collect + validate the key, write managed blocks, scaffold.
-export async function runInit(options) {
+export async function runInit() {
     const cwd = process.cwd();
-    const baseUrl = resolveApolloUrl(options);
     p.intro("apollo init");
     if (!isInteractive()) {
         p.log.error("apollo init needs an interactive terminal (it prompts for the key).");
@@ -33,7 +32,7 @@ export async function runInit(options) {
         message: "Sign in via the browser to create your application & key? (No = paste a key)",
     });
     if (!p.isCancel(viaBrowser) && viaBrowser) {
-        if (!(await performDeviceLogin(baseUrl, cwd))) {
+        if (!(await performDeviceLogin(cwd))) {
             p.outro("Sign-in failed — re-run `apollo init`, or pick the paste option.");
             process.exitCode = 1;
             return;
@@ -42,7 +41,7 @@ export async function runInit(options) {
         return;
     }
     const appKey = await p.password({
-        message: `Paste your APOLLO_APP_KEY (create an application in the Apollo console: ${baseUrl})`,
+        message: `Paste your APOLLO_APP_KEY (create an application in the Apollo console: ${APOLLO_URL})`,
         validate: (value) => value?.startsWith("apollo_app_") ? undefined : "Expected a key starting with apollo_app_",
     });
     if (p.isCancel(appKey)) {
@@ -51,7 +50,7 @@ export async function runInit(options) {
     }
     const spinner = p.spinner();
     spinner.start("Validating the key against Apollo");
-    const isValid = await validateAppKey(baseUrl, appKey).catch(() => false);
+    const isValid = await validateAppKey(APOLLO_URL, appKey).catch(() => false);
     if (!isValid) {
         spinner.stop("Key rejected by Apollo", 1);
         p.outro("No key, no install — fix the key and re-run `apollo init`.");
@@ -66,8 +65,9 @@ export async function runInit(options) {
     }
     await finishInit(cwd);
 }
-// Shared init tail: offer the manifest scaffold, then close out.
-async function finishInit(cwd) {
+// Shared init tail (also the bootstrap command's closing step): offer the
+// manifest scaffold, then close out.
+export async function finishInit(cwd) {
     if (!hasManifest(cwd)) {
         const repoName = deriveRepoName(cwd);
         const shouldScaffold = await p.confirm({

package/dist/commands/list.js

@@ -1,13 +1,12 @@
 // packages/cli/src/commands/list.ts - `apollo list`: print the discovery
 // catalogue, one line per service.
-import { fetchCatalogue, resolveApolloUrl } from "../lib/apollo_client.js";
+import { APOLLO_URL, fetchCatalogue } from "../lib/apollo_client.js";
 // Print the catalogue as aligned columns: name, classifier, status, description.
-export async function runList(options) {
-    const baseUrl = resolveApolloUrl(options);
-    const catalogue = await fetchCatalogue(baseUrl);
+export async function runList() {
+    const catalogue = await fetchCatalogue(APOLLO_URL);
     const services = catalogue.services ?? [];
     if (services.length === 0) {
-        console.log(`Catalogue at ${baseUrl} is empty — the registry read path / refresh isn't wired yet.`);
+        console.log(`Catalogue at ${APOLLO_URL} is empty — the registry read path / refresh isn't wired yet.`);
         return;
     }
     for (const service of services) {

package/dist/commands/login.js

@@ -5,7 +5,7 @@
 // the managed .env block — no key pasting.
 import path from "node:path";
 import * as p from "@clack/prompts";
-import { resolveApolloUrl } from "../lib/apollo_client.js";
+import { APOLLO_URL } from "../lib/apollo_client.js";
 import { ensureEnvGitignored, readManagedValues, upsertManagedValues } from "../lib/env_file.js";
 import { launchBrowser } from "../lib/browser_opener.js";
 import { getOrCreateDeviceId } from "../lib/device_identity.js";
@@ -13,9 +13,9 @@ import { pollDeviceOnce, pollUntilIssued, startDeviceTrust, } from "../lib/devic
 // Browser-approval wait cap; the trust window itself is 24h server-side.
 const APPROVAL_TIMEOUT_SECONDS = 10 * 60;
 // Run the login flow and write the issued key; returns false on failure.
-export async function performDeviceLogin(baseUrl, cwd, flags = {}) {
+export async function performDeviceLogin(cwd, flags = {}) {
     const deviceId = await getOrCreateDeviceId();
-    const start = await startDeviceTrust(baseUrl, deviceId);
+    const start = await startDeviceTrust(APOLLO_URL, deviceId);
     const managedValues = await readManagedValues(path.join(cwd, ".env"));
     const pollParams = {
         deviceCode: start.device_code,
@@ -26,7 +26,7 @@ export async function performDeviceLogin(baseUrl, cwd, flags = {}) {
     // Trusted-device fast path: an approval inside the 24h window is not
     // consumed, so a single poll may already succeed with no browser at all.
     let issued = null;
-    const firstAttempt = await pollDeviceOnce(baseUrl, pollParams);
+    const firstAttempt = await pollDeviceOnce(APOLLO_URL, pollParams);
     if (firstAttempt.kind === "issued") {
         issued = firstAttempt.issued;
         p.log.success("Device already trusted — no browser approval needed");
@@ -43,7 +43,7 @@ export async function performDeviceLogin(baseUrl, cwd, flags = {}) {
         const spinner = p.spinner();
         spinner.start("Waiting for approval in the browser");
         try {
-            issued = await pollUntilIssued(baseUrl, pollParams, start.interval, Math.min(start.expires_in, APPROVAL_TIMEOUT_SECONDS));
+            issued = await pollUntilIssued(APOLLO_URL, pollParams, start.interval, Math.min(start.expires_in, APPROVAL_TIMEOUT_SECONDS));
         }
         catch (error) {
             spinner.stop("Sign-in failed", 1);
@@ -68,11 +68,10 @@ export async function performDeviceLogin(baseUrl, cwd, flags = {}) {
     return true;
 }
 // `apollo login` — the standalone command wrapper.
-export async function runLogin(options, flags = {}) {
+export async function runLogin(flags = {}) {
     const cwd = process.cwd();
-    const baseUrl = resolveApolloUrl(options);
     p.intro("apollo login");
-    const didLogin = await performDeviceLogin(baseUrl, cwd, flags);
+    const didLogin = await performDeviceLogin(cwd, flags);
     if (!didLogin) {
         p.outro("Nothing was written.");
         process.exitCode = 1;

package/dist/commands/logout.js

@@ -0,0 +1,35 @@
+// packages/cli/src/commands/logout.ts - `apollo logout`: the inverse of login.
+// Removes APOLLO_APP_KEY from the managed .env block and clears the local
+// device identity so the next login needs a fresh browser approval. Local
+// only — there is no self-revoke endpoint yet, so the issued key stays valid
+// server-side until revoked in the Apollo console.
+import path from "node:path";
+import * as p from "@clack/prompts";
+import { readManagedValues, removeManagedValues } from "../lib/env_file.js";
+import { clearDeviceId } from "../lib/device_identity.js";
+// Run the logout flow: drop the personal key locally and sever device trust.
+export async function runLogout() {
+    const cwd = process.cwd();
+    p.intro("apollo logout");
+    const removedKeys = await removeManagedValues(path.join(cwd, ".env"), ["APOLLO_APP_KEY"]);
+    const didClearDevice = await clearDeviceId();
+    if (removedKeys.length === 0 && !didClearDevice) {
+        p.outro("Nothing to do — no APOLLO_APP_KEY here and no device identity stored.");
+        return;
+    }
+    if (removedKeys.length > 0) {
+        p.log.success("Removed APOLLO_APP_KEY from the managed .env block");
+        p.log.warn("The key itself stays valid server-side — revoke it in the Apollo console if it shouldn't.");
+    }
+    else {
+        p.log.info("No APOLLO_APP_KEY in the managed .env block.");
+    }
+    if (didClearDevice) {
+        p.log.success("Cleared the device identity — the next login needs browser approval");
+    }
+    const remainingValues = await readManagedValues(path.join(cwd, ".env"));
+    if (remainingValues.APOLLO_APP_ID) {
+        p.log.info("Kept APOLLO_APP_ID — the next login re-binds to the same application.");
+    }
+    p.outro("Signed out. Run `apollo login` to sign back in.");
+}

package/dist/commands/open.js

@@ -1,15 +1,14 @@
 // packages/cli/src/commands/open.ts - `apollo open <service>`: open the
 // service's endpoint (or repository) in the default browser.
 import * as p from "@clack/prompts";
-import { fetchCatalogue, resolveApolloUrl } from "../lib/apollo_client.js";
+import { APOLLO_URL, fetchCatalogue } from "../lib/apollo_client.js";
 import { launchBrowser } from "../lib/browser_opener.js";
 // Resolve the URL to open (chosen endpoint > production > any > repository) and launch it.
-export async function runOpen(serviceName, options, globals) {
-    const baseUrl = resolveApolloUrl(globals);
-    const catalogue = await fetchCatalogue(baseUrl);
+export async function runOpen(serviceName, options) {
+    const catalogue = await fetchCatalogue(APOLLO_URL);
     const entry = (catalogue.services ?? []).find((service) => service.name === serviceName);
     if (!entry) {
-        p.log.error(`'${serviceName}' is not in the catalogue at ${baseUrl}.`);
+        p.log.error(`'${serviceName}' is not in the catalogue at ${APOLLO_URL}.`);
         process.exitCode = 1;
         return;
     }

package/dist/commands/sync.js

@@ -4,12 +4,11 @@
 // credentials disappear).
 import path from "node:path";
 import * as p from "@clack/prompts";
-import { fetchAppCredentials, resolveApolloUrl } from "../lib/apollo_client.js";
+import { APOLLO_URL, fetchAppCredentials } from "../lib/apollo_client.js";
 import { readManagedValues, upsertManagedValues, writeManagedValues } from "../lib/env_file.js";
 // Run the sync flow: fetch the projection, rewrite the managed block wholly.
-export async function runSync(options) {
+export async function runSync() {
     const cwd = process.cwd();
-    const baseUrl = resolveApolloUrl(options);
     p.intro("apollo sync");
     const managedValues = await readManagedValues(path.join(cwd, ".env"));
     const appKey = managedValues.APOLLO_APP_KEY ?? process.env.APOLLO_APP_KEY;
@@ -23,7 +22,7 @@ export async function runSync(options) {
     spinner.start("Fetching the application's credential projection");
     let projection;
     try {
-        projection = await fetchAppCredentials(baseUrl, appKey);
+        projection = await fetchAppCredentials(APOLLO_URL, appKey);
     }
     catch (error) {
         spinner.stop("Projection failed", 1);

package/dist/index.js

@@ -12,6 +12,8 @@ import { runValidate } from "./commands/validate.js";
 import { runGraph } from "./commands/graph.js";
 import { runDoctor } from "./commands/doctor.js";
 import { runOpen } from "./commands/open.js";
+import { runBootstrap } from "./commands/bootstrap.js";
+import { runLogout } from "./commands/logout.js";
 // Single version source: package.json (npm ships it alongside dist/).
 const { version } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 const program = new Command();
@@ -19,33 +21,39 @@ program
     .name("apollo")
     .description("Bootstrap NuStack services into your repo via the Apollo discovery plane.")
     .version(version)
-    .option("--apollo-url <url>", "Apollo base URL (defaults to $APOLLO_URL, then the hosted instance)");
+    // Bare `apollo`: bootstrap — check sign-in, login if needed, then init.
+    .action(async () => runBootstrap());
+program.addHelpText("after", "\nRun `apollo` with no command to bootstrap: it checks your sign-in, runs login if needed, then init.");
 program
     .command("login")
     .description("Sign in via the browser (24h device trust) and issue your APOLLO_APP_KEY")
     .option("--no-open", "don't auto-open the browser; just print the approval URL")
-    .action(async (options) => runLogin(program.opts(), options));
+    .action(async (options) => runLogin(options));
+program
+    .command("logout")
+    .description("Sign out: remove APOLLO_APP_KEY from the managed .env block and sever device trust")
+    .action(async () => runLogout());
 program
     .command("init")
     .description("Store your APOLLO_APP_KEY in the managed .env block and scaffold the manifest")
-    .action(async () => runInit(program.opts()));
+    .action(async () => runInit());
 program
     .command("add [service]")
     .description("Install a stack service: exchange credentials, write .env, install the package")
-    .action(async (service) => runAdd(service, program.opts()));
+    .action(async (service) => runAdd(service));
 program
     .command("list")
     .description("List the services in the Apollo catalogue")
-    .action(async () => runList(program.opts()));
+    .action(async () => runList());
 program
     .command("sync")
     .description("Re-project all credentials issued to this application into the managed .env block")
-    .action(async () => runSync(program.opts()));
+    .action(async () => runSync());
 program
     .command("describe <service>")
     .description("Show the full catalogue entry for a service")
     .option("--json", "emit the raw catalogue entry as JSON")
-    .action(async (service, options) => runDescribe(service, options, program.opts()));
+    .action(async (service, options) => runDescribe(service, options));
 program
     .command("validate [manifest]")
     .description("Validate an apollo.service.json (path or URL) against the apollo.dev/v1 schema")
@@ -55,14 +63,14 @@ program
     .command("graph")
     .description("Render the catalogue's consumes-graph")
     .option("--mermaid", "emit a mermaid `graph LR` block instead of ascii")
-    .action(async (options) => runGraph(options, program.opts()));
+    .action(async (options) => runGraph(options));
 program
     .command("doctor")
     .description("Check key validity, credential health, and manifest conformance")
-    .action(async () => runDoctor(program.opts()));
+    .action(async () => runDoctor());
 program
     .command("open <service>")
     .description("Open the service's endpoint (or repository) in the browser")
     .option("--env <name>", "pick a specific endpoint environment (default: production)")
-    .action(async (service, options) => runOpen(service, options, program.opts()));
+    .action(async (service, options) => runOpen(service, options));
 await program.parseAsync(process.argv);

package/dist/lib/apollo_client.js

@@ -1,11 +1,9 @@
 // packages/cli/src/lib/apollo_client.ts - HTTP client for the Apollo discovery
 // plane: catalogue fetch + credential exchange + key validation.
-const DEFAULT_APOLLO_URL = "https://apollo.nurix-ai.co";
+// The discovery plane lives at one hosted location (consumer-journey §9.1 —
+// location baked in). Hardcoded; no flag or env override.
+export const APOLLO_URL = "https://apollo.nurix-ai.co";
 const REQUEST_TIMEOUT_MS = 10_000;
-// Resolve the Apollo base URL: --apollo-url flag > APOLLO_URL env > hosted default.
-export function resolveApolloUrl(options) {
-    return (options.apolloUrl ?? process.env.APOLLO_URL ?? DEFAULT_APOLLO_URL).replace(/\/+$/, "");
-}
 // Fetch the public discovery catalogue.
 export async function fetchCatalogue(baseUrl) {
     const response = await fetch(`${baseUrl}/api/catalog.json`, {

package/dist/lib/device_identity.js

@@ -1,15 +1,19 @@
 // packages/cli/src/lib/device_identity.ts - Stable per-machine device identity
 // for the 24h device-trust window. Generated once, persisted at
 // ~/.apollo/device_id, and sent with every device/start + device/poll call.
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
+// Absolute path of the persisted device id file.
+function deviceIdFilePath() {
+    return path.join(os.homedir(), ".apollo", "device_id");
+}
 // Read the persisted device id, creating one on first use.
 export async function getOrCreateDeviceId() {
-    const dir = path.join(os.homedir(), ".apollo");
-    const file = path.join(dir, "device_id");
+    const file = deviceIdFilePath();
+    const dir = path.dirname(file);
     if (existsSync(file)) {
         const existing = (await readFile(file, "utf8")).trim();
         if (existing)
@@ -20,3 +24,11 @@ export async function getOrCreateDeviceId() {
     await writeFile(file, `${deviceId}\n`, "utf8");
     return deviceId;
 }
+// Delete the persisted device id (severs the 24h trust locally); true when one existed.
+export async function clearDeviceId() {
+    const file = deviceIdFilePath();
+    if (!existsSync(file))
+        return false;
+    await rm(file, { force: true });
+    return true;
+}

package/dist/lib/env_file.js

@@ -39,6 +39,17 @@ export async function writeManagedValues(filePath, values) {
     const existingContent = existsSync(filePath) ? await readFile(filePath, "utf8") : "";
     await writeFile(filePath, replaceBlock(existingContent, block), "utf8");
 }
+// Remove keys from the managed block; returns the keys actually removed.
+export async function removeManagedValues(filePath, keys) {
+    const currentValues = await readManagedValues(filePath);
+    const removedKeys = keys.filter((key) => key in currentValues);
+    if (removedKeys.length === 0)
+        return [];
+    for (const key of removedKeys)
+        delete currentValues[key];
+    await writeManagedValues(filePath, currentValues);
+    return removedKeys;
+}
 // Ensure .gitignore covers .env so managed secrets never get committed.
 export async function ensureEnvGitignored(cwd) {
     const gitignorePath = path.join(cwd, ".gitignore");

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/apollo",
-    "version": "0.3.4",
+    "version": "0.3.5",
     "description": "The apollo CLI — bootstrap NuStack services into a repo via the Apollo discovery plane.",
     "type": "module",
     "private": false,