@nurix/nustack 0.10.0-dev.8 → 0.11.0

package/dist/lib/logs/answer.js

@@ -0,0 +1,99 @@
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { printJsonSuccess } from "../json_output.js";
+import { loadLogscope } from "./library.js";
+export class LogsNoRepository extends Error {
+    code = "LOGS_NO_REPOSITORY";
+    constructor(where) {
+        super(`not a git repository: ${where} — pass --root <path> or run inside a checkout`);
+        this.name = "LogsNoRepository";
+    }
+}
+export class LogsUnavailable extends Error {
+    code = "LOGS_UNAVAILABLE";
+    constructor(reason) {
+        super(reason);
+        this.name = "LogsUnavailable";
+    }
+}
+export class LogsRefused extends Error {
+    code = "LOGS_REFUSED";
+    constructor(reason) {
+        super(reason);
+        this.name = "LogsRefused";
+    }
+}
+export class LogsNotFound extends Error {
+    code = "LOGS_NOT_FOUND";
+    constructor(reason) {
+        super(reason);
+        this.name = "LogsNotFound";
+    }
+}
+export function resolveRoot(root, cwd) {
+    if (root !== undefined) {
+        const path = resolve(cwd, root);
+        if (!existsSync(path))
+            throw new LogsNoRepository(root);
+        return path;
+    }
+    return gitRoot(cwd);
+}
+function gitRoot(from) {
+    try {
+        return execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: from, stdio: ["ignore", "pipe", "ignore"] })
+            .toString("utf8")
+            .trim();
+    }
+    catch {
+        throw new LogsNoRepository(from);
+    }
+}
+export const progress = (line) => {
+    process.stderr.write(`${line}\n`);
+};
+export async function answerLogscope(fn, argv, options, cwd) {
+    const library = await loadLogscope();
+    const known = library.findFn(fn);
+    if (known === undefined) {
+        throw new LogsUnavailable(`unknown logscope function '${fn}' — run \`nustack logscope functions\` for the list`);
+    }
+    const args = library.parseArgs(known, argv);
+    if (known.args["root"] !== undefined && args["root"] === undefined) {
+        args["root"] = resolveRoot(options.root, cwd);
+    }
+    if (args["limit"] === undefined && options.limit !== undefined)
+        args["limit"] = Number(options.limit);
+    const limit = args["limit"];
+    const budget = options.budget !== undefined ? Number(options.budget) : limit !== undefined ? 0 : library.DEFAULT_BUDGET;
+    const result = library.dispatch({ fn: known.name, args, corpus: options.corpus, budget });
+    if (result.answer.unavailable !== undefined)
+        throw new LogsUnavailable(result.answer.unavailable);
+    if (options.json === true) {
+        printJsonSuccess(`logscope ${known.name}`, result.answer);
+        return;
+    }
+    console.log(result.rendered);
+}
+export async function listLogscopeFunctions(options) {
+    const library = await loadLogscope();
+    const budget = options.budget !== undefined ? Number(options.budget) : 0;
+    const result = library.dispatch({ fn: "functions", args: {}, budget });
+    if (options.json === true) {
+        printJsonSuccess("logscope functions", result.answer);
+        return;
+    }
+    console.log(result.rendered);
+    console.log([
+        "",
+        "lifecycle — `nustack logscope <verb>`",
+        "  allow <targets...>   grant a log source; nothing is read before this",
+        "  allowed              the grants covering this project",
+        "  revoke <targets...>  withdraw grants",
+        "  index <sources...>   ingest or refresh a corpus from granted sources",
+        "  corpora              every corpus indexed on this machine",
+        "  prune [--dry-run]    drop every corpus past its retention",
+        "  forget <id>          drop one corpus and its store",
+    ].join("\n"));
+}

package/dist/lib/logs/library.js

@@ -0,0 +1,19 @@
+export class LogsLibraryMissing extends Error {
+    code = "LOGS_LIBRARY_MISSING";
+    constructor() {
+        super("the log-tracking library is not installed with this nustack — install it beside the CLI (`npm i -g @nurix/logscope`) or run nustack from a checkout of the monorepo.");
+        this.name = "LogsLibraryMissing";
+    }
+}
+let cached = null;
+export async function loadLogscope() {
+    if (cached !== null)
+        return cached;
+    try {
+        cached = (await import("@nurix/logscope"));
+        return cached;
+    }
+    catch {
+        throw new LogsLibraryMissing();
+    }
+}

package/dist/lib/logs/lifecycle.js

@@ -0,0 +1,159 @@
+import { printJsonSuccess } from "../json_output.js";
+import { loadLogscope } from "./library.js";
+import { LogsNotFound, LogsRefused, progress, resolveRoot } from "./answer.js";
+function reportPruneToStderr(library) {
+    for (const record of library.prune()) {
+        progress(`pruned ${record.id} (retention ${library.retentionOf(record)} days, indexed ${record.indexedAt ?? "unknown"})`);
+    }
+}
+export async function indexLogs(targets, options, cwd) {
+    const library = await loadLogscope();
+    const root = resolveRoot(options.root, cwd);
+    const retentionDays = Number(options.retain ?? String(library.DEFAULT_RETENTION_DAYS));
+    if (!Number.isInteger(retentionDays) || retentionDays < 0) {
+        throw new LogsRefused("--retain takes a non-negative whole number of days");
+    }
+    reportPruneToStderr(library);
+    const outcome = await library.indexCorpus({
+        targets,
+        root,
+        since: options.since,
+        until: options.until,
+        revision: options.revision,
+        redact: options.redact !== false,
+        keepExamples: options.examples === true,
+        retentionDays,
+    });
+    if (!outcome.ok)
+        throw new LogsRefused(outcome.message);
+    if (options.json === true) {
+        printJsonSuccess("logscope index", {
+            id: outcome.id,
+            sources: outcome.sources,
+            events: outcome.events,
+            templates: outcome.templates,
+            ratio: outcome.ratio,
+            resumes: outcome.resumes,
+            retentionDays: outcome.retentionDays,
+            hasExamples: outcome.hasExamples,
+            expiresAt: outcome.expiresAt ?? null,
+            warning: outcome.warning ?? null,
+        });
+        return;
+    }
+    console.log([
+        `indexed ${outcome.id}`,
+        `  ${outcome.events} events -> ${outcome.templates} templates (ratio ${outcome.ratio.toFixed(4)})`,
+        `  sources      ${Object.entries(outcome.resumes).map(([path, resume]) => `${path} [${resume}]`).join(", ")}`,
+        `  retention    ${outcome.retentionDays === 0 ? "off (kept until forgotten)" : `${outcome.retentionDays} days (expires ${outcome.expiresAt ?? "unknown"})`}`,
+        `  examples     ${outcome.hasExamples ? "kept" : "not kept — drill and trace <id> cannot answer on this corpus"}`,
+        ...(outcome.warning === undefined ? [] : [`  WARNING: ${outcome.warning}`]),
+    ].join("\n"));
+}
+export async function listCorpora(options) {
+    const library = await loadLogscope();
+    reportPruneToStderr(library);
+    const corpora = library.readRegistry().map((record) => ({
+        id: record.id,
+        sources: record.sources,
+        events: record.events ?? 0,
+        templates: record.templates ?? 0,
+        indexedAt: record.indexedAt ?? null,
+        retentionDays: library.retentionOf(record),
+        expiresAt: library.expiresAt(record) ?? null,
+        hasExamples: record.hasExamples === true,
+    }));
+    if (options.json === true) {
+        printJsonSuccess("logscope corpora", { corpora });
+        return;
+    }
+    if (corpora.length === 0) {
+        console.log("no corpus has been indexed on this machine — run: nustack logscope index <sources...>");
+        return;
+    }
+    console.log(corpora
+        .map((corpus) => `${corpus.id}  ${corpus.events} events, ${corpus.templates} templates  (${corpus.sources.length} sources)  ` +
+        (corpus.retentionDays === 0
+            ? "retention off"
+            : `retention ${corpus.retentionDays} days, expires ${corpus.expiresAt ?? "unknown"}`))
+        .join("\n"));
+}
+export async function allowSources(targets, options, cwd) {
+    const library = await loadLogscope();
+    const root = resolveRoot(options.root, cwd);
+    const allowed = library.allow(root, targets, options.note).map((grant) => grant.path);
+    if (options.json === true) {
+        printJsonSuccess("logscope allow", { root, allowed });
+        return;
+    }
+    console.log(allowed.map((path) => `allowed ${path}`).join("\n"));
+}
+export async function listAllowed(options, cwd) {
+    const library = await loadLogscope();
+    const root = resolveRoot(options.root, cwd);
+    const grants = library.allowedFor(root);
+    if (options.json === true) {
+        printJsonSuccess("logscope allowed", { root, grants });
+        return;
+    }
+    if (grants.length === 0) {
+        console.log(`no source is allowed for ${root} — run: nustack logscope allow <path...>`);
+        return;
+    }
+    console.log(grants
+        .map((grant) => `${grant.path}  granted ${grant.grantedAt}${grant.note === undefined ? "" : `  ${grant.note}`}`)
+        .join("\n"));
+}
+export async function revokeSources(targets, options, cwd) {
+    const library = await loadLogscope();
+    const root = resolveRoot(options.root, cwd);
+    const revoked = library.revoke(root, targets);
+    if (revoked === 0)
+        throw new LogsNotFound(`no grant under ${root} names ${targets.join(", ")}`);
+    if (options.json === true) {
+        printJsonSuccess("logscope revoke", { root, revoked });
+        return;
+    }
+    console.log(`revoked ${revoked} grant(s)`);
+}
+export async function pruneCorpora(options, cwd) {
+    const library = await loadLogscope();
+    resolveRoot(options.root, cwd);
+    const dryRun = options.dryRun === true;
+    const now = new Date();
+    const candidates = dryRun
+        ? library.readRegistry().filter((record) => {
+            const at = library.expiresAt(record);
+            return at !== null && at !== undefined && new Date(at).getTime() <= now.getTime();
+        })
+        : library.prune();
+    const pruned = candidates.map((record) => ({
+        id: record.id,
+        retentionDays: library.retentionOf(record),
+        indexedAt: record.indexedAt ?? null,
+    }));
+    if (options.json === true) {
+        printJsonSuccess("logscope prune", { dryRun, pruned });
+        return;
+    }
+    if (pruned.length === 0) {
+        console.log("nothing to prune");
+        return;
+    }
+    console.log(pruned
+        .map((record) => `${dryRun ? "would prune" : "pruned"} ${record.id} (retention ${record.retentionDays} days, indexed ${record.indexedAt ?? "unknown"})`)
+        .join("\n"));
+}
+export async function forgetCorpusCommand(ref, options) {
+    const library = await loadLogscope();
+    if (ref === undefined)
+        throw new LogsNotFound("name the corpus to forget — run: nustack logscope corpora");
+    const forgot = library.forgetCorpus(ref);
+    if (forgot === undefined)
+        throw new LogsNotFound(`no corpus matches ${ref}`);
+    if (options.json === true) {
+        printJsonSuccess("logscope forget", { forgot });
+        return;
+    }
+    console.log(`forgot ${forgot}`);
+}

package/dist/lib/nustack_client.js

@@ -1,6 +1,6 @@
 import { assertSafeNuStackUrl, assertSafeOpaqueId } from "./guards.js";
 import { createSseParser } from "./sse_framing.js";
-import { DEVICE_HEADER, knownDeviceId, refreshAccessTokenAfterRefusal, userAgent } from "./auth_grant.js";
+import { DEVICE_HEADER, envToken, knownDeviceId, refreshAccessTokenAfterRefusal, TokenRefusedError, userAgent } from "./auth_grant.js";
 import { getOrCreateDeviceId } from "./device_identity.js";
 const DEFAULT_NUSTACK_URL = "https://apps.nustack.ai";
 const REQUEST_TIMEOUT_MS = 10_000;
@@ -12,6 +12,8 @@ async function authorizedFetch(input, init = {}) {
     const bearer = headers.get("Authorization")?.replace(/^Bearer\s+/i, "");
     if (response.status !== 401 || !bearer || isStreamBody(init.body))
         return response;
+    if (envToken())
+        throw new TokenRefusedError();
     const fresh = await refreshAccessTokenAfterRefusal(bearer).catch(() => null);
     if (!fresh)
         return response;
@@ -60,7 +62,7 @@ export async function exchangeServiceCredential(baseUrl, accessToken, params) {
     const response = await authorizedFetch(`${baseUrl}/api/v1/keys/exchange`, {
         method: "POST",
         headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
-        body: JSON.stringify({ workspaceId: params.workspaceId, service: params.service }),
+        body: JSON.stringify({ projectId: params.projectId, service: params.service }),
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
     const payload = (await response.json().catch(() => null));
@@ -71,7 +73,7 @@ export async function exchangeServiceCredential(baseUrl, accessToken, params) {
 }
 export async function fetchServiceCredential(baseUrl, accessToken, params) {
     const url = new URL(`${baseUrl}/api/v1/keys/credentials`);
-    url.searchParams.set("workspaceId", assertSafeOpaqueId("The Workspace id", params.workspaceId));
+    url.searchParams.set("projectId", assertSafeOpaqueId("The Project id", params.projectId));
     url.searchParams.set("service", assertSafeOpaqueId("The Service slug", params.service));
     const response = await authorizedFetch(url, {
         headers: { Authorization: `Bearer ${accessToken}` },
@@ -83,9 +85,9 @@ export async function fetchServiceCredential(baseUrl, accessToken, params) {
     }
     return narrowProjection(payload, params.service);
 }
-export async function listWorkspaceIntegrations(baseUrl, accessToken, workspaceId) {
+export async function listProjectIntegrations(baseUrl, accessToken, projectId) {
     const url = new URL(`${baseUrl}/api/v1/keys/integrations`);
-    url.searchParams.set("workspaceId", assertSafeOpaqueId("The Workspace id", workspaceId));
+    url.searchParams.set("projectId", assertSafeOpaqueId("The Project id", projectId));
     const response = await authorizedFetch(url, {
         headers: { Authorization: `Bearer ${accessToken}` },
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -101,7 +103,7 @@ export async function fetchBrokeredCredential(baseUrl, accessToken, params) {
     const response = await authorizedFetch(`${baseUrl}/api/v1/keys/broker/${encodeURIComponent(service)}`, {
         method: "POST",
         headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
-        body: JSON.stringify({ workspaceId: params.workspaceId }),
+        body: JSON.stringify({ projectId: params.projectId }),
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
     const payload = (await response.json().catch(() => null));
@@ -110,8 +112,8 @@ export async function fetchBrokeredCredential(baseUrl, accessToken, params) {
     }
     return { url: payload.url ?? null, key: payload.key, meta: payload.meta ?? null, grantId: payload.grantId };
 }
-export async function searchWorkspaces(baseUrl, query, opts = {}) {
-    const url = new URL(`${baseUrl}/public/v1/workspaces`);
+export async function searchProjects(baseUrl, query, opts = {}) {
+    const url = new URL(`${baseUrl}/public/v1/projects`);
     url.searchParams.set("q", query);
     if (opts.category)
         url.searchParams.set("category", opts.category);
@@ -120,7 +122,7 @@ export async function searchWorkspaces(baseUrl, query, opts = {}) {
     const response = await authorizedFetch(url, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !Array.isArray(payload?.data?.items)) {
-        throw new Error(errorMessage(payload, response.status, "workspace search failed"));
+        throw new Error(errorMessage(payload, response.status, "project search failed"));
     }
     return payload.data.items;
 }
@@ -190,10 +192,10 @@ export async function acknowledgeBindingCursor(baseUrl, accessToken, params) {
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
     const payload = (await response.json().catch(() => null));
-    if (!response.ok || typeof payload?.data?.lastAppliedWorkspaceSequence !== "number") {
+    if (!response.ok || typeof payload?.data?.lastAppliedProjectSequence !== "number") {
         throw new Error(errorMessage(payload, response.status, "cursor acknowledgement failed"));
     }
-    return payload.data.lastAppliedWorkspaceSequence;
+    return payload.data.lastAppliedProjectSequence;
 }
 export async function fetchSyncWhitelist(baseUrl, accessToken, bindingId) {
     const safeId = assertSafeOpaqueId("The binding id", bindingId);
@@ -282,6 +284,46 @@ export async function listOrganizations(baseUrl, accessToken) {
     }
     return payload.data.items;
 }
+export class PersonalTokenRequestError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "PersonalTokenRequestError";
+    }
+}
+async function readTokenEnvelope(response, label) {
+    const payload = (await response.json().catch(() => null));
+    if (!response.ok || payload?.data === undefined) {
+        throw new PersonalTokenRequestError(payload?.error?.code ?? "REQUEST_FAILED", errorMessage(payload, response.status, label));
+    }
+    return payload.data;
+}
+export async function listPersonalTokens(baseUrl, accessToken) {
+    const response = await authorizedFetch(`${baseUrl}/api/v2/tokens`, {
+        headers: authHeaders(accessToken),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    const data = await readTokenEnvelope(response, "token list failed");
+    return Array.isArray(data.items) ? data.items : [];
+}
+export async function createPersonalToken(baseUrl, accessToken, params) {
+    const response = await authorizedFetch(`${baseUrl}/api/v2/tokens`, {
+        method: "POST",
+        headers: { ...authHeaders(accessToken), "Content-Type": "application/json" },
+        body: JSON.stringify(params),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    return readTokenEnvelope(response, "token create failed");
+}
+export async function revokePersonalToken(baseUrl, accessToken, tokenId) {
+    const response = await authorizedFetch(`${baseUrl}/api/v2/tokens/${encodeURIComponent(assertSafeOpaqueId("The token id", tokenId))}`, {
+        method: "DELETE",
+        headers: authHeaders(accessToken),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    return readTokenEnvelope(response, "token revoke failed");
+}
 export async function createOrganization(baseUrl, accessToken, params, idempotencyKey) {
     const response = await authorizedFetch(`${baseUrl}/api/v2/organizations`, {
         method: "POST",
@@ -295,31 +337,31 @@ export async function createOrganization(baseUrl, accessToken, params, idempoten
     }
     return payload.data;
 }
-export async function listWorkspaces(baseUrl, accessToken, organizationId) {
+export async function listProjects(baseUrl, accessToken, organizationId) {
     const safeId = assertSafeOpaqueId("The Organization id", organizationId);
-    const response = await authorizedFetch(`${baseUrl}/api/v2/workspaces`, {
+    const response = await authorizedFetch(`${baseUrl}/api/v2/projects`, {
         headers: { ...authHeaders(accessToken), "X-NuStack-Organization": safeId },
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !Array.isArray(payload?.data?.items)) {
-        throw new Error(errorMessage(payload, response.status, "workspace list failed"));
+        throw new Error(errorMessage(payload, response.status, "project list failed"));
     }
     return payload.data.items;
 }
-export async function getWorkspace(baseUrl, accessToken, workspaceId) {
-    const safeId = assertSafeOpaqueId("The Workspace id", workspaceId);
-    const response = await authorizedFetch(`${baseUrl}/api/v2/workspaces/${encodeURIComponent(safeId)}`, {
+export async function getProject(baseUrl, accessToken, projectId) {
+    const safeId = assertSafeOpaqueId("The Project id", projectId);
+    const response = await authorizedFetch(`${baseUrl}/api/v2/projects/${encodeURIComponent(safeId)}`, {
         headers: authHeaders(accessToken),
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.id) {
-        throw new Error(errorMessage(payload, response.status, "workspace fetch failed"));
+        throw new Error(errorMessage(payload, response.status, "project fetch failed"));
     }
     return payload.data;
 }
-export function mintWorkspaceId() {
+export function mintProjectId() {
     const bytes = crypto.getRandomValues(new Uint8Array(16));
     const ms = Date.now();
     bytes[0] = Math.floor(ms / 2 ** 40) & 0xff;
@@ -360,9 +402,9 @@ async function* readSseFrames(body) {
     for (const block of parser.flush())
         yield toFrame(block);
 }
-export async function createWorkspaceViaAsk(baseUrl, accessToken, organizationId, prompt, opts = {}) {
+export async function createProjectViaAsk(baseUrl, accessToken, organizationId, prompt, opts = {}) {
     const safeOrganization = assertSafeOpaqueId("The Organization id", organizationId);
-    const workspaceId = opts.workspaceId ?? mintWorkspaceId();
+    const projectId = opts.projectId ?? mintProjectId();
     const fetchImpl = opts.fetchImpl ?? fetch;
     const response = await fetchImpl(`${baseUrl}/api/v2/ask`, {
         method: "POST",
@@ -371,11 +413,11 @@ export async function createWorkspaceViaAsk(baseUrl, accessToken, organizationId
             "Content-Type": "application/json",
             "X-NuStack-Organization": safeOrganization,
         },
-        body: JSON.stringify({ prompt, workspaceId }),
+        body: JSON.stringify({ prompt, projectId }),
     });
     if (!response.ok || !response.body) {
         const payload = (await response.json().catch(() => null));
-        throw new Error(errorMessage(payload, response.status, "workspace create failed"));
+        throw new Error(errorMessage(payload, response.status, "project create failed"));
     }
     let started = false;
     let turnId = null;
@@ -384,7 +426,7 @@ export async function createWorkspaceViaAsk(baseUrl, accessToken, organizationId
         if (frame.event === "start") {
             started = true;
             turnId = typeof frame.data.turnId === "string" ? frame.data.turnId : null;
-            opts.onPhase?.("Workspace created — writing the first document");
+            opts.onPhase?.("Project created — writing the first document");
         }
         else if (frame.event === "thinking" && typeof frame.data.message === "string") {
             opts.onPhase?.(frame.data.message);
@@ -392,7 +434,7 @@ export async function createWorkspaceViaAsk(baseUrl, accessToken, organizationId
         else if (frame.event === "error") {
             const message = typeof frame.data.message === "string" ? frame.data.message : "generation failed";
             if (!started)
-                throw new Error(`workspace create failed: ${message}`);
+                throw new Error(`project create failed: ${message}`);
             generationError = message;
             break;
         }
@@ -401,12 +443,12 @@ export async function createWorkspaceViaAsk(baseUrl, accessToken, organizationId
         }
     }
     if (!started)
-        throw new Error("workspace create failed: the stream ended before the Workspace was reported");
-    return { workspaceId, turnId, generationError };
+        throw new Error("project create failed: the stream ended before the Project was reported");
+    return { projectId, turnId, generationError };
 }
-async function postWorkspacePublication(baseUrl, accessToken, workspaceId, action, body, idempotencyKey) {
-    const safeId = assertSafeOpaqueId("The Workspace id", workspaceId);
-    const response = await authorizedFetch(`${baseUrl}/api/v2/workspaces/${encodeURIComponent(safeId)}/${action}`, {
+async function postProjectPublication(baseUrl, accessToken, projectId, action, body, idempotencyKey) {
+    const safeId = assertSafeOpaqueId("The Project id", projectId);
+    const response = await authorizedFetch(`${baseUrl}/api/v2/projects/${encodeURIComponent(safeId)}/${action}`, {
         method: "POST",
         headers: mutationHeaders(accessToken, idempotencyKey),
         body: JSON.stringify(body),
@@ -414,19 +456,19 @@ async function postWorkspacePublication(baseUrl, accessToken, workspaceId, actio
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || payload?.data === undefined) {
-        throw new Error(errorMessage(payload, response.status, `workspace ${action} failed`));
+        throw new Error(errorMessage(payload, response.status, `project ${action} failed`));
     }
     return payload.data;
 }
-export async function publishWorkspace(baseUrl, accessToken, workspaceId, profile, idempotencyKey) {
-    return postWorkspacePublication(baseUrl, accessToken, workspaceId, "publish", profile, idempotencyKey);
+export async function publishProject(baseUrl, accessToken, projectId, profile, idempotencyKey) {
+    return postProjectPublication(baseUrl, accessToken, projectId, "publish", profile, idempotencyKey);
 }
-export async function unpublishWorkspace(baseUrl, accessToken, workspaceId, idempotencyKey) {
-    return postWorkspacePublication(baseUrl, accessToken, workspaceId, "unpublish", {}, idempotencyKey);
+export async function unpublishProject(baseUrl, accessToken, projectId, idempotencyKey) {
+    return postProjectPublication(baseUrl, accessToken, projectId, "unpublish", {}, idempotencyKey);
 }
-export async function listDocuments(baseUrl, accessToken, workspaceId) {
-    const safeId = assertSafeOpaqueId("The Workspace id", workspaceId);
-    const response = await authorizedFetch(`${baseUrl}/api/v2/documents?workspaceId=${encodeURIComponent(safeId)}`, {
+export async function listDocuments(baseUrl, accessToken, projectId) {
+    const safeId = assertSafeOpaqueId("The Project id", projectId);
+    const response = await authorizedFetch(`${baseUrl}/api/v2/documents?projectId=${encodeURIComponent(safeId)}`, {
         headers: authHeaders(accessToken),
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
@@ -448,9 +490,9 @@ export async function getDocument(baseUrl, accessToken, documentId) {
     }
     return payload.data;
 }
-export async function listHandoffs(baseUrl, accessToken, workspaceId) {
-    const safeId = assertSafeOpaqueId("The Workspace id", workspaceId);
-    const response = await authorizedFetch(`${baseUrl}/api/v2/workspaces/${encodeURIComponent(safeId)}/handoffs`, {
+export async function listHandoffs(baseUrl, accessToken, projectId) {
+    const safeId = assertSafeOpaqueId("The Project id", projectId);
+    const response = await authorizedFetch(`${baseUrl}/api/v2/projects/${encodeURIComponent(safeId)}/handoffs`, {
         headers: authHeaders(accessToken),
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
@@ -472,13 +514,13 @@ export async function getHandoff(baseUrl, accessToken, handoffId) {
     }
     return payload.data;
 }
-export async function latestHandoff(baseUrl, accessToken, workspaceId) {
-    const handoffs = await listHandoffs(baseUrl, accessToken, workspaceId);
+export async function latestHandoff(baseUrl, accessToken, projectId) {
+    const handoffs = await listHandoffs(baseUrl, accessToken, projectId);
     return handoffs.length > 0 ? handoffs[0] : null;
 }
-export async function createBinding(baseUrl, accessToken, workspaceId, input, idempotencyKey) {
-    const safeId = assertSafeOpaqueId("The Workspace id", workspaceId);
-    const response = await authorizedFetch(`${baseUrl}/api/v2/workspaces/${encodeURIComponent(safeId)}/bindings`, {
+export async function createBinding(baseUrl, accessToken, projectId, input, idempotencyKey) {
+    const safeId = assertSafeOpaqueId("The Project id", projectId);
+    const response = await authorizedFetch(`${baseUrl}/api/v2/projects/${encodeURIComponent(safeId)}/bindings`, {
         method: "POST",
         headers: mutationHeaders(accessToken, idempotencyKey),
         body: JSON.stringify({

package/dist/lib/onboarding/attach_existing_git.js

@@ -7,24 +7,24 @@ import { runRepositoryOnboarding, } from "./binding.js";
 export async function attachExistingGit(ctx, options) {
     const state = classifyFolder(ctx.cwd);
     if (state.class !== "git_worktree" || !state.repository || !state.git) {
-        return { ok: false, code: "NOT_A_WORKTREE", message: "`nustack workspace attach` needs an existing Git worktree — run `nustack init` to establish one." };
+        return { ok: false, code: "NOT_A_WORKTREE", message: "`nustack project attach` needs an existing Git worktree — run `nustack init` to establish one." };
     }
     const rejection = attachRejection(state.git);
     if (rejection) {
         return { ok: false, code: rejection.toUpperCase(), message: rejectionMessage(rejection) };
     }
-    if (state.git.markerWorkspaceId && state.git.markerWorkspaceId !== options.workspaceId && !options.confirmRebind) {
+    if (state.git.markerProjectId && state.git.markerProjectId !== options.projectId && !options.confirmRebind) {
         return {
             ok: false,
             code: "REBIND_CONFIRMATION_REQUIRED",
-            message: `This repository is bound to Workspace ${state.git.markerWorkspaceId}. Re-run with confirmation to rebind it to ${options.workspaceId}.`,
+            message: `This repository is bound to Project ${state.git.markerProjectId}. Re-run with confirmation to rebind it to ${options.projectId}.`,
         };
     }
     const boundBranch = readSymbolicBranch(state.repository);
     if (!boundBranch) {
         return { ok: false, code: "DETACHED_HEAD", message: "HEAD is detached — check out a branch before attaching." };
     }
-    const profile = await fetchToolkitProfile(ctx.baseUrl, ctx.accessToken, options.workspaceId);
+    const profile = await fetchToolkitProfile(ctx.baseUrl, ctx.accessToken, options.projectId);
     const baselineCommitId = readHeadCommit(state.repository);
     const result = await runRepositoryOnboarding({
         store: ctx.store,
@@ -32,7 +32,7 @@ export async function attachExistingGit(ctx, options) {
         accessToken: ctx.accessToken,
         deviceRef: ctx.deviceRef,
         flow: "existing_git",
-        workspaceId: options.workspaceId,
+        projectId: options.projectId,
         organizationId: options.organizationId,
         repository: state.repository,
         boundBranch,
@@ -55,8 +55,8 @@ async function reconcileLatest(ctx, bindingId) {
 }
 function rejectionMessage(rejection) {
     switch (rejection) {
-        case "nested_workspace":
-            return "This repository is nested inside another NuStack Workspace — one Workspace has one logical repository root (F-014).";
+        case "nested_project":
+            return "This repository is nested inside another NuStack Project — one Project has one logical repository root (F-014).";
         case "operation_in_progress":
             return "A merge, rebase, cherry-pick, or revert is in progress — finish or abort it, then re-attach.";
         case "detached_head":