@nurix/apollo 0.4.1 → 0.4.3

package/README.md

@@ -1,19 +1,12 @@
 # `@nurix/apollo` — the `apollo` CLI
 
-The consumer-side installer for the Apollo discovery plane. It implements the
-build-time integration flow of the
-[consumer journey](../../docs/discovery/consumer-journey.md): exchange your
-application key for service-scoped credentials, write them into a managed
-`.env` block, install the service's npm package, and record the `consumes`
-edge in your `apollo.service.json` (the application's bill of materials).
+The consumer-side installer for the Apollo discovery plane. It implements the build-time integration flow of the [consumer journey](../../docs/discovery/consumer-journey.md): exchange your application key for service-scoped credentials, write them into a managed `.env` block, install the service's npm package, and record the `consumes` edge in your `apollo.service.json` (the application's bill of materials).
 
 Interactive UX is built on [`@clack/prompts`](https://github.com/bombshell-dev/clack).
 
 ## Install
 
-Published to npm with **restricted access** under the `@nurix` scope — you need
-an npm account with read rights to the `nurix` org (`npm login`, then verify
-with `npm whoami`).
+Published to npm with **restricted access** under the `@nurix` scope — you need an npm account with read rights to the `nurix` org (`npm login`, then verify with `npm whoami`).
 
 ```
 npx @nurix/apollo@latest --help      # one-shot
@@ -53,51 +46,39 @@ apollo doctor                # key validity + per-credential health probes +
 apollo open <svc> [--env <name>] # open endpoint (default production) or repo URL
 ```
 
-Global options: `--apollo-url <url>` (defaults to `$APOLLO_URL`, then the
-hosted instance `https://apollo.nurix-ai.co`) — the default means you never
-need to pass the URL; override only for a non-hosted Apollo.
+Global options: `--apollo-url <url>` (defaults to `$APOLLO_URL`, then the hosted instance `https://apollo.nurix-ai.co`) — the default means you never need to pass the URL; override only for a non-hosted Apollo.
 
 ### `apollo init`
 
-1. Prompts for your `APOLLO_APP_KEY` (created with your application in the
-   Apollo console) and **validates it against Apollo — no key, no install**.
-2. Writes it into the **Apollo-managed block** of `.env` (+ a placeholder in
-   `.env.example`) and makes sure `.env` is gitignored.
+1. Prompts for your `APOLLO_APP_KEY` (created with your application in the Apollo console) and **validates it against Apollo — no key, no install**.
+2. Writes it into the **Apollo-managed block** of `.env` (+ a placeholder in `.env.example`) and makes sure `.env` is gitignored.
 3. Offers to scaffold `apollo.service.json` if the repo has none.
 
 ### `apollo add <service>` — the installer
 
-1. Reads `APOLLO_APP_KEY` from the managed block (or the environment); fails
-   loudly with remediation if missing.
-2. Fetches the catalogue and resolves the service (interactive select when no
-   name is passed).
-3. `POST /api/v1/keys/exchange` → `{ endpoint, serviceKey }` — idempotent per
-   (application × service), so re-running is safe.
-4. Writes `<SERVICE>_ENDPOINT` + `<SERVICE>_KEY` into the managed `.env`
-   block, placeholders into `.env.example`.
-5. Installs the service's npm package when it ships one (package manager
-   detected from the repo's lockfile).
-6. Appends the `consumes` edge to `apollo.service.json` (offers a scaffold if
-   the manifest is missing).
+1. Reads `APOLLO_APP_KEY` from the managed block (or the environment); fails loudly with remediation if missing.
+2. Fetches the catalogue and resolves the service (interactive select when no name is passed).
+3. `POST /api/v1/keys/exchange` → `{ endpoint, serviceKey }` — idempotent per (application × service), so re-running is safe.
+4. Writes `<SERVICE>_ENDPOINT` + `<SERVICE>_KEY` into the managed `.env` block, placeholders into `.env.example`.
+5. Installs the service's npm package when it ships one (package manager detected from the repo's lockfile).
+6. Appends the `consumes` edge to `apollo.service.json` (offers a scaffold if the manifest is missing).
 7. Best-effort health probe against the issued endpoint (never blocks).
 
 ### The managed `.env` block
 
-The CLI owns **only** the delimited block — everything outside it is yours and
-is never touched:
+The CLI owns **only** the delimited block — everything outside it is yours and is never touched:
 
 ```
 MY_OWN_SECRET=untouched
 
 # >>> apollo:managed — do not edit by hand; the apollo CLI rewrites this block >>>
-APOLLO_APP_KEY=apollo_app_…
+APOLLO_APP_KEY=018f…  # opaque app id (UUID), no fixed prefix
 EMAIL_ENDPOINT=https://…
 EMAIL_KEY=apollo_svc_…
 # <<< apollo:managed <<<
 ```
 
-Inside the block the server is the source of truth (manual edits get
-overwritten); outside it, nothing is ever rewritten.
+Inside the block the server is the source of truth (manual edits get overwritten); outside it, nothing is ever rewritten.
 
 ## Development
 
@@ -107,20 +88,10 @@ pnpm --filter @nurix/apollo typecheck
 node packages/cli/dist/index.js --help         # run from the repo root
 ```
 
-ESM, Node ≥ 22, strict TypeScript. `bin` is `dist/index.js` (`apollo`).
-Releases ship via `.github/workflows/publish-cli-to-npm.yml` — merges to `dev`
-touching `packages/cli/**` auto-publish a patch; dispatch the workflow for
-minor/major.
+ESM, Node ≥ 22, strict TypeScript. `bin` is `dist/index.js` (`apollo`). Releases ship via `.github/workflows/publish-cli-to-npm.yml` — merges to `dev` touching `packages/cli/**` auto-publish a patch; dispatch the workflow for minor/major.
 
 ## Current limitations
 
-- The hosted catalogue is empty until the registry read path lands
-  (consumer-journey.md R3) — `list`/`describe`/`graph`/`open` degrade with a
-  clear message; `apollo add <name>` still works for services seeded into the
-  KV catalogue, since the exchange resolves endpoints server-side.
-- `apollo sync` needs `GET /api/v1/keys/credentials` (journey R7) — the route
-  is in the worker code; it goes live with the next worker deploy.
-- Exchange still returns `{endpoint, serviceKey}` together; once it slims to
-  credential-only with Apollo-served definitions (journey §9.2–§9.3), the
-  client picks the endpoint up from the definition instead
-  (`src/lib/apollo_client.ts` is the seam).
+- The hosted catalogue is empty until the registry read path lands (consumer-journey.md R3) — `list`/`describe`/`graph`/`open` degrade with a clear message; `apollo add <name>` still works for services seeded into the KV catalogue, since the exchange resolves endpoints server-side.
+- `apollo sync` needs `GET /api/v1/keys/credentials` (journey R7) — the route is in the worker code; it goes live with the next worker deploy.
+- Exchange still returns `{endpoint, serviceKey}` together; once it slims to credential-only with Apollo-served definitions (journey §9.2–§9.3), the client picks the endpoint up from the definition instead (`src/lib/apollo_client.ts` is the seam).

package/dist/commands/init.js

@@ -43,7 +43,9 @@ export async function runInit(options) {
     }
     const appKey = await p.password({
         message: `Paste your APOLLO_APP_KEY (create an application in the Apollo console: ${baseUrl})`,
-        validate: (value) => value?.startsWith("apollo_app_") ? undefined : "Expected a key starting with apollo_app_",
+        // The key is an opaque app id (a high-entropy UUID, no fixed prefix); the
+        // authoritative check is the server probe below, so only reject empties here.
+        validate: (value) => (value?.trim() ? undefined : "Paste your APOLLO_APP_KEY"),
     });
     if (p.isCancel(appKey)) {
         p.cancel("init cancelled — nothing written.");

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/apollo",
-    "version": "0.4.1",
+    "version": "0.4.3",
     "description": "The apollo CLI — bootstrap NuStack services into a repo via the Apollo discovery plane.",
     "type": "module",
     "private": false,