@nurix/nustack 0.10.0-dev.9 → 0.11.0

package/dist/commands/review.js

@@ -8,16 +8,30 @@ const EXIT_FOR = {
     none: 1,
     unreachable: 2,
 };
+const latestAnswered = (items) => items.find((item) => item.answer?.verdict === "signed" || item.answer?.verdict === "refused");
 export function decisionStateOf(items) {
-    const latest = items.find((item) => item.answer?.verdict === "signed" || item.answer?.verdict === "refused");
+    const latest = latestAnswered(items);
     if (!latest)
         return "none";
     return latest.answer?.verdict === "signed" ? "signed" : "refused";
 }
-function checkLine(state, commit) {
+export function waivedKeysOf(items) {
+    const latest = latestAnswered(items);
+    if (latest?.answer?.verdict !== "signed")
+        return [];
+    const waivers = latest.answer.waivers;
+    if (!Array.isArray(waivers))
+        return [];
+    return waivers
+        .map((waiver) => waiver?.criterionKey)
+        .filter((key) => typeof key === "string" && key.length > 0);
+}
+function checkLine(state, commit, waived) {
     switch (state) {
         case "signed":
-            return `review check: ${commit} is signed off\n`;
+            return waived.length
+                ? `review check: ${commit} is signed off — ${waived.length} ${waived.length === 1 ? "criterion" : "criteria"} waived: ${waived.join(", ")}\n`
+                : `review check: ${commit} is signed off\n`;
         case "refused":
             return `review check: ${commit} was refused\n`;
         case "none":
@@ -34,11 +48,11 @@ export async function runReviewCheck(options, globals) {
         process.exitCode = 2;
         return;
     }
-    const report = (state) => {
+    const report = (state, waived = []) => {
         if (json)
-            printJsonSuccess("review check", { commit, state, exitCode: EXIT_FOR[state] });
+            printJsonSuccess("review check", { commit, state, exitCode: EXIT_FOR[state], waived });
         else
-            process.stdout.write(checkLine(state, commit));
+            process.stdout.write(checkLine(state, commit, waived));
         process.exitCode = EXIT_FOR[state];
     };
     const baseUrl = resolveNuStackUrl(globals);
@@ -47,7 +61,7 @@ export async function runReviewCheck(options, globals) {
         return report("unreachable");
     try {
         const items = await makeReviewClient(baseUrl, deviceAuth.accessToken).readDecisions(commit, options.repository?.trim() || null);
-        report(decisionStateOf(items));
+        report(decisionStateOf(items), waivedKeysOf(items));
     }
     catch (error) {
         if (error instanceof ReviewUnreachableError)
@@ -77,7 +91,16 @@ function readSubject(raw) {
         type: "tool_permission",
         toolName,
         displayName,
-        toolInput: row.toolInput ?? null,
+        ...(typeof row.target === "string" || row.target === null ? { target: row.target } : {}),
+        ...(typeof row.inputBytes === "number" && Number.isFinite(row.inputBytes)
+            ? { inputBytes: row.inputBytes }
+            : {}),
+        ...(Array.isArray(row.inputFields) && row.inputFields.every((field) => typeof field === "string")
+            ? { inputFields: row.inputFields }
+            : {}),
+        ...(typeof row.redactionVersion === "number" && Number.isFinite(row.redactionVersion)
+            ? { redactionVersion: row.redactionVersion }
+            : {}),
         ...(typeof row.description === "string" ? { description: row.description } : {}),
     };
 }
@@ -117,13 +140,13 @@ export async function runReviewMirror(options, globals) {
             const answered = await client.answerReviewItem(id, verdict);
             return mirrorReport(json, "answered", answered.id);
         }
-        const workspaceId = options.workspace?.trim() ?? "";
-        if (!workspaceId)
-            return mirrorReport(json, "skipped", null, "--workspace is required to open a mirrored prompt");
+        const projectId = options.project?.trim() ?? "";
+        if (!projectId)
+            return mirrorReport(json, "skipped", null, "--project is required to open a mirrored prompt");
         const subject = readSubject(options.subject);
         if (!subject)
             return mirrorReport(json, "skipped", null, "--subject must be a tool-permission JSON object");
-        const created = await client.createReviewItem({ workspaceId, sessionId, subject });
+        const created = await client.createReviewItem({ projectId, sessionId, subject });
         return mirrorReport(json, "open", created.id);
     }
     catch (error) {
@@ -140,9 +163,9 @@ export function registerReviewCommands(reviewCommand, getGlobalOptions) {
         .action(async (options) => runReviewCheck(options, getGlobalOptions()));
     reviewCommand
         .command("mirror")
-        .description("Reflect a lane's permission prompt, or its answer, into the Review pane")
-        .option("--session <laneId>", "the lane's session id")
-        .option("--workspace <id>", "the Workspace the lane's folder is bound to (required with --state open)")
+        .description("Reflect a session's permission prompt, or its answer, into the Review pane")
+        .option("--session <sessionId>", "the session's id")
+        .option("--project <id>", "the Project the session's folder is bound to (required with --state open)")
         .option("--state <state>", "open or answered")
         .option("--subject <json>", "the tool-permission subject, as JSON (required with --state open)")
         .option("--verdict <verdict>", "allow or deny (required with --state answered)")

package/dist/commands/search.js

@@ -1,4 +1,4 @@
-import { resolveNuStackUrl, searchWorkspaces, searchCatalogue, } from "../lib/nustack_client.js";
+import { resolveNuStackUrl, searchProjects, searchCatalogue, } from "../lib/nustack_client.js";
 export async function runSearch(keywords, options, globals) {
     const query = keywords.join(" ").trim();
     if (!query) {
@@ -12,20 +12,20 @@ export async function runSearch(keywords, options, globals) {
         return;
     }
     const baseUrl = resolveNuStackUrl(globals);
-    const results = await searchWorkspaces(baseUrl, query, { category: options.category, limit: options.limit });
+    const results = await searchProjects(baseUrl, query, { category: options.category, limit: options.limit });
     if (options.json) {
         console.log(JSON.stringify(results, null, 2));
         return;
     }
     if (results.length === 0) {
-        console.log(`No workspaces matched "${query}". Looking for a platform capability? Try \`nustack search services ${query}\`.`);
+        console.log(`No projects matched "${query}". Looking for a platform capability? Try \`nustack search services ${query}\`.`);
         return;
     }
     console.log(`${results.length} result${results.length === 1 ? "" : "s"} for "${query}"`);
-    for (const workspace of results) {
-        const category = workspace.categories[0] ?? "—";
-        console.log(`${workspace.displayName.padEnd(28)} ${category.padEnd(16)} ${workspace.tagline ?? ""}`);
-        const link = workspace.links[0];
+    for (const project of results) {
+        const category = project.categories[0] ?? "—";
+        console.log(`${project.displayName.padEnd(28)} ${category.padEnd(16)} ${project.tagline ?? ""}`);
+        const link = project.links[0];
         if (link)
             console.log(`  ${link.url}`);
     }

package/dist/commands/sessions.js

@@ -1,9 +1,25 @@
 import { readFile } from "node:fs/promises";
+import path from "node:path";
+import * as p from "@clack/prompts";
 import { ensureAccessToken } from "../lib/auth_grant.js";
+import { isInteractive } from "../lib/interactive.js";
 import { resolveNuStackUrl } from "../lib/nustack_client.js";
-import { makeSessionsClient } from "../lib/sessions/client.js";
+import { makeSessionsClient, sessionsClientFromEnv } from "../lib/sessions/client.js";
 import { recordOutsideSessions, } from "../lib/sessions/outsideSessions.js";
-import { printJsonSuccess } from "../lib/json_output.js";
+import { inspectSession, readOrphanedWorktrees, reclaimSession, } from "../lib/session-engine/prune.js";
+import { readSessionRegistry, sessionRegistryPath } from "../lib/session-engine/registry.js";
+import { SessionSupervisor } from "../lib/session-engine/supervisor.js";
+import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+export async function runSessionsServe(engineVersion) {
+    const supervisor = new SessionSupervisor({
+        input: process.stdin,
+        output: process.stdout,
+        engineVersion,
+        sessions: sessionsClientFromEnv(process.env),
+    });
+    await supervisor.run();
+    process.exit(0);
+}
 async function readScanArgument(raw) {
     const body = raw.startsWith("@") ? await readFile(raw.slice(1), "utf8") : raw;
     return JSON.parse(body);
@@ -25,7 +41,7 @@ function readTranscripts(value) {
             sessionKey,
             provider,
             modifiedMs,
-            workspaceId: typeof row.workspaceId === "string" && row.workspaceId ? row.workspaceId : null,
+            projectId: typeof row.projectId === "string" && row.projectId ? row.projectId : null,
             vendorSessionId: typeof row.id === "string" && row.id ? row.id : null,
             ...(typeof row.sizeBytes === "number" ? { sizeBytes: row.sizeBytes } : {}),
         });
@@ -46,6 +62,10 @@ export async function runSessionsRecord(options, globals) {
     if (!options.scan)
         return report("sessions record", EMPTY, json, "no scan payload");
     const payload = (await readScanArgument(options.scan).catch(() => null));
+    if (payload && "laneSessionIds" in payload) {
+        process.stderr.write("sessions record: this NuStack desktop is older than this CLI: it sent laneSessionIds, which is now engineSessionIds. Update both.\n");
+        process.exit(1);
+    }
     const transcripts = readTranscripts(payload?.sessions);
     if (transcripts.length === 0)
         return report("sessions record", EMPTY, json, "nothing to record");
@@ -54,9 +74,140 @@ export async function runSessionsRecord(options, globals) {
         return report("sessions record", EMPTY, json, "signed out");
     const summary = await recordOutsideSessions(makeSessionsClient(baseUrl, deviceAuth.accessToken), {
         transcripts,
-        laneSessionIds: Array.isArray(payload?.laneSessionIds)
-            ? payload.laneSessionIds.filter((id) => typeof id === "string")
+        engineSessionIds: Array.isArray(payload?.engineSessionIds)
+            ? payload.engineSessionIds.filter((id) => typeof id === "string")
             : [],
     });
     report("sessions record", summary, json);
 }
+async function readSessions() {
+    const { records, dropped } = await readSessionRegistry();
+    const orphans = await readOrphanedWorktrees();
+    const sessions = [];
+    for (const record of [...records, ...orphans.records]) {
+        sessions.push({ record, facts: await inspectSession(record) });
+    }
+    return { sessions, unreadable: dropped, undecipherableOrphans: orphans.undecipherable };
+}
+function statusWord(entry) {
+    if (entry.facts.orphaned)
+        return "orphaned";
+    if (entry.facts.stale)
+        return "stale";
+    return entry.record.status;
+}
+function formatSessionRow(entry) {
+    const checkout = path.basename(entry.record.projectPath);
+    return (`${entry.record.sessionId.padEnd(38)} ${checkout.padEnd(22)} ${(entry.record.branch ?? "—").padEnd(31)} ` +
+        `${statusWord(entry).padEnd(10)} ${entry.facts.reason}`);
+}
+function toJsonView(entry) {
+    const { record, facts } = entry;
+    return {
+        sessionId: record.sessionId,
+        projectPath: record.projectPath,
+        worktreePath: record.worktreePath,
+        branch: record.branch,
+        status: record.status,
+        nustack: record.nustack,
+        createdAt: record.createdAt,
+        closedAt: record.closedAt ?? null,
+        permissionMode: record.permissionMode ?? null,
+        baseBranch: record.baseBranch ?? null,
+        isolated: facts.isolated,
+        checkoutPresent: facts.checkoutPresent,
+        worktreePresent: facts.worktreePresent,
+        branchExists: facts.branchExists,
+        reading: facts.reading,
+        dirty: facts.dirty,
+        stale: facts.stale,
+        orphaned: facts.orphaned,
+        reclaimable: facts.reclaimable,
+        reason: facts.reason,
+    };
+}
+export async function runSessionsList(options) {
+    const json = options.json === true;
+    const { sessions, unreadable, undecipherableOrphans } = await readSessions();
+    if (json) {
+        printJsonSuccess("sessions list", {
+            registryPath: sessionRegistryPath(),
+            unreadable,
+            undecipherableOrphans,
+            sessions: sessions.map(toJsonView),
+        });
+        return;
+    }
+    if (sessions.length === 0 && unreadable === 0 && undecipherableOrphans.length === 0) {
+        console.log("No engine-opened sessions on this machine.");
+        return;
+    }
+    if (sessions.length > 0) {
+        console.log(`${"SESSION".padEnd(38)} ${"CHECKOUT".padEnd(22)} ${"BRANCH".padEnd(31)} ${"STATUS".padEnd(10)} HOLDS`);
+        for (const entry of sessions)
+            console.log(formatSessionRow(entry));
+    }
+    if (unreadable > 0)
+        console.log(`${unreadable} row(s) in the registry could not be read and were skipped.`);
+    for (const orphan of undecipherableOrphans) {
+        console.log(`1 worktree under the pre-rename engine home names no checkout and must be removed by hand: ${orphan}.`);
+    }
+}
+function previewLine(entry) {
+    const verb = entry.facts.reclaimable ? "reclaim" : "refuse";
+    return `  ${verb}  ${entry.record.sessionId}  ${entry.record.branch ?? "—"}  — ${entry.facts.reason}`;
+}
+export async function runSessionsPrune(options) {
+    const json = options.json === true;
+    const force = options.force === true;
+    const { sessions } = await readSessions();
+    const scoped = options.session ? sessions.filter((entry) => entry.record.sessionId === options.session) : sessions;
+    if (options.session && scoped.length === 0) {
+        const message = `No session ${options.session} in this machine's registry — pass one from \`nustack sessions list\`.`;
+        if (json)
+            return printJsonError("sessions prune", { code: "SESSION_NOT_FOUND", message });
+        p.log.error(message);
+        process.exitCode = 1;
+        return;
+    }
+    const candidates = scoped.filter((entry) => force || entry.facts.reclaimable);
+    if (options.yes !== true) {
+        const plan = candidates.map((entry) => ({
+            sessionId: entry.record.sessionId,
+            branch: entry.record.branch,
+            worktreePath: entry.record.worktreePath,
+            orphaned: entry.facts.orphaned,
+            reclaimable: entry.facts.reclaimable,
+            reason: entry.facts.reason,
+        }));
+        if (json)
+            return printJsonSuccess("sessions prune", { applied: false, plan, note: "preview only — pass --yes to apply" });
+        if (plan.length === 0) {
+            console.log("Nothing to reclaim.");
+            return;
+        }
+        console.log(`Would reclaim ${plan.length} session(s):`);
+        for (const entry of candidates)
+            console.log(previewLine(entry));
+        if (!isInteractive()) {
+            console.log("Preview only — re-run with --yes to apply.");
+            return;
+        }
+        const answer = await p.confirm({ message: "Remove these worktrees and delete their branches?" });
+        if (p.isCancel(answer) || !answer) {
+            p.outro("Cancelled — nothing reclaimed.");
+            return;
+        }
+    }
+    const reclaimed = [];
+    const refused = [];
+    for (const entry of candidates) {
+        const outcome = await reclaimSession(entry.record, { force });
+        (outcome.reason === null ? reclaimed : refused).push(outcome);
+    }
+    if (json)
+        return printJsonSuccess("sessions prune", { applied: true, reclaimed, refused });
+    console.log(`Reclaimed ${reclaimed.length} session(s); refused ${refused.length}.`);
+    for (const outcome of refused)
+        console.log(`  refused  ${outcome.sessionId} — ${outcome.reason ?? "unknown"}`);
+}

package/dist/commands/sync.js

@@ -1,9 +1,9 @@
 import path from "node:path";
 import * as p from "@clack/prompts";
-import { exchangeServiceCredential, fetchServiceCredential, listWorkspaceIntegrations, resolveNuStackUrl, } from "../lib/nustack_client.js";
+import { exchangeServiceCredential, fetchServiceCredential, listProjectIntegrations, resolveNuStackUrl, } from "../lib/nustack_client.js";
 import { readConsumesEdges } from "../lib/manifest.js";
 import { ensureAccessToken, signedOutCopy } from "../lib/auth_grant.js";
-import { resolveWorkspaceId } from "../lib/workspace_context.js";
+import { resolveProjectId } from "../lib/project_context.js";
 import { readManagedValues, writeManagedValues } from "../lib/env_file.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
 const COMMAND = "sync";
@@ -18,23 +18,23 @@ export async function runSync(options) {
     if (!deviceAuth)
         return failSync(json, "SIGNED_OUT", signedOut(), "The managed block was not touched.");
     const accessToken = deviceAuth.accessToken;
-    const workspace = await resolveWorkspaceId(cwd, { workspace: options.workspace });
-    if (!workspace.ok)
-        return failSync(json, "WORKSPACE_UNRESOLVED", workspace.message, "The managed block was not touched.");
+    const project = await resolveProjectId(cwd, { project: options.project });
+    if (!project.ok)
+        return failSync(json, "PROJECT_UNRESOLVED", project.message, "The managed block was not touched.");
     const spinner = json ? null : p.spinner();
     spinner?.start("Exchanging declared services");
     let activeServices;
     let projections;
     try {
         for (const edge of await readConsumesEdges(cwd)) {
-            await exchangeServiceCredential(baseUrl, accessToken, { workspaceId: workspace.workspaceId, service: edge.service });
+            await exchangeServiceCredential(baseUrl, accessToken, { projectId: project.projectId, service: edge.service });
         }
         spinner?.message("Enumerating active integrations");
-        const integrations = await listWorkspaceIntegrations(baseUrl, accessToken, workspace.workspaceId);
+        const integrations = await listProjectIntegrations(baseUrl, accessToken, project.projectId);
         activeServices = integrations.filter((i) => i.status === "active").map((i) => i.serviceSlug);
         projections = [];
         for (const service of activeServices) {
-            projections.push(await fetchServiceCredential(baseUrl, accessToken, { workspaceId: workspace.workspaceId, service }));
+            projections.push(await fetchServiceCredential(baseUrl, accessToken, { projectId: project.projectId, service }));
         }
     }
     catch (error) {
@@ -59,7 +59,7 @@ export async function runSync(options) {
     await writeManagedValues(path.join(cwd, ".env.example"), placeholders);
     if (json) {
         printJsonSuccess(COMMAND, {
-            workspaceId: workspace.workspaceId,
+            projectId: project.projectId,
             integrations: activeServices.map((service) => ({ service, status: "active" })),
             envKeysWritten: Object.keys(nextValues),
             removedKeys,
@@ -69,7 +69,7 @@ export async function runSync(options) {
     p.log.success(`Managed block rewritten: ${projections.length} service credential(s).`);
     if (removedKeys.length > 0)
         p.log.info(`Removed stale entries: ${removedKeys.join(", ")}`);
-    p.outro("In sync with NuStack — Service credentials only (Documents & Git are `nustack workspace sync`).");
+    p.outro("In sync with NuStack — Service credentials only (Documents & Git are `nustack project sync`).");
 }
 function failSync(json, code, message, humanTail) {
     if (json) {

package/dist/commands/token.js

@@ -0,0 +1,102 @@
+import { createPersonalToken, listPersonalTokens, PersonalTokenRequestError, resolveNuStackUrl, revokePersonalToken } from "../lib/nustack_client.js";
+import { ensureAuthWithRecovery, lastAuthFailure } from "../lib/auth_recovery.js";
+import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+const MAX_EXPIRY_DAYS = 365;
+async function requireAuth(command, json, globals) {
+    const baseUrl = resolveNuStackUrl(globals);
+    const auth = await ensureAuthWithRecovery(baseUrl, json);
+    if (!auth) {
+        const failure = lastAuthFailure();
+        if (json)
+            printJsonError(command, { code: failure.code, message: failure.message });
+        else {
+            console.error(failure.message);
+            process.exitCode = 1;
+        }
+        return null;
+    }
+    return { baseUrl, accessToken: auth.accessToken };
+}
+function refuse(command, json, error) {
+    const code = error instanceof PersonalTokenRequestError ? error.code : "REQUEST_FAILED";
+    const message = error instanceof Error ? error.message : String(error);
+    if (json)
+        printJsonError(command, { code, message });
+    else {
+        console.error(message);
+        process.exitCode = 1;
+    }
+}
+export async function runTokenCreate(options, globals) {
+    const json = options.json === true;
+    const label = options.label?.trim() ?? "";
+    if (!label)
+        return refuse("token create", json, new PersonalTokenRequestError("VALIDATION_FAILED", "A label is required: `nustack token create --label <name>`."));
+    let expiresInDays;
+    if (options.expires !== undefined) {
+        const parsed = Number(options.expires);
+        if (!Number.isInteger(parsed) || parsed < 1 || parsed > MAX_EXPIRY_DAYS) {
+            return refuse("token create", json, new PersonalTokenRequestError("VALIDATION_FAILED", `--expires is a whole number of days, 1–${MAX_EXPIRY_DAYS}.`));
+        }
+        expiresInDays = parsed;
+    }
+    const auth = await requireAuth("token create", json, globals);
+    if (!auth)
+        return;
+    try {
+        const minted = await createPersonalToken(auth.baseUrl, auth.accessToken, { label, ...(expiresInDays ? { expiresInDays } : {}) });
+        if (json) {
+            printJsonSuccess("token create", minted);
+            return;
+        }
+        console.error(`Minted \`${minted.token.label}\` (${minted.token.tokenPrefix}…)${minted.token.expiresAt ? `, expires ${minted.token.expiresAt}` : ""}.`);
+        console.error(`This is the only time the secret is shown. Store it as ${"NUSTACK_TOKEN"} in your pipeline; revoke it with \`nustack token revoke ${minted.token.id}\`.`);
+        console.log(minted.secret);
+    }
+    catch (error) {
+        refuse("token create", json, error);
+    }
+}
+export async function runTokenList(options, globals) {
+    const json = options.json === true;
+    const auth = await requireAuth("token list", json, globals);
+    if (!auth)
+        return;
+    try {
+        const tokens = await listPersonalTokens(auth.baseUrl, auth.accessToken);
+        if (json) {
+            printJsonSuccess("token list", { tokens });
+            return;
+        }
+        if (tokens.length === 0) {
+            console.log("No personal access tokens. Mint one with `nustack token create --label <name>`.");
+            return;
+        }
+        for (const token of tokens) {
+            const state = token.revokedAt ? `revoked ${token.revokedAt}` : token.expiresAt ? `expires ${token.expiresAt}` : "no expiry";
+            console.log(`${token.id.padEnd(38)} ${`${token.tokenPrefix}…`.padEnd(18)} ${token.label.padEnd(24)} ${state.padEnd(30)} last used ${token.lastUsedAt ?? "never"}`);
+        }
+    }
+    catch (error) {
+        refuse("token list", json, error);
+    }
+}
+export async function runTokenRevoke(tokenId, options, globals) {
+    const json = options.json === true;
+    if (!tokenId?.trim())
+        return refuse("token revoke", json, new PersonalTokenRequestError("VALIDATION_FAILED", "A token id is required: `nustack token revoke <id>` (see `nustack token list`)."));
+    const auth = await requireAuth("token revoke", json, globals);
+    if (!auth)
+        return;
+    try {
+        const revoked = await revokePersonalToken(auth.baseUrl, auth.accessToken, tokenId.trim());
+        if (json) {
+            printJsonSuccess("token revoke", revoked);
+            return;
+        }
+        console.log(`Revoked ${revoked.id} at ${revoked.revokedAt}.`);
+    }
+    catch (error) {
+        refuse("token revoke", json, error);
+    }
+}

package/dist/commands/toolkit.js

@@ -1,12 +1,12 @@
 import * as p from "@clack/prompts";
 import { resolveNuStackUrl } from "../lib/nustack_client.js";
 import { ensureAuthWithRecovery, lastAuthFailure } from "../lib/auth_recovery.js";
-import { resolveWorkspaceId } from "../lib/workspace_context.js";
+import { resolveProjectId } from "../lib/project_context.js";
 import { isInteractive } from "../lib/interactive.js";
 import { openLocalStore } from "../lib/local_store/database.js";
 import { getBindingByRepositoryRoot } from "../lib/local_store/bindings.js";
 import { resolveRepository } from "../lib/git-sync/core/repository.js";
-import { readWorkspaceManifests, diagnoseManifests } from "../lib/onboarding/manifest_writer.js";
+import { readProjectManifests, diagnoseManifests } from "../lib/onboarding/manifest_writer.js";
 import { fetchToolkitProfile, ToolkitProfileUnavailableError } from "../lib/etna/profile.js";
 import { buildReconcilePlan, applyReconcile, toolkitCompatibility } from "../lib/etna/reconcile.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
@@ -28,9 +28,9 @@ async function resolveContext(command, json, options, globals) {
         return null;
     }
     const baseUrl = resolveNuStackUrl(globals);
-    const workspace = await resolveWorkspaceId(root, options);
-    if (!workspace.ok) {
-        emitFail(command, json, "WORKSPACE_CONTEXT_MISSING", workspace.message);
+    const project = await resolveProjectId(root, options);
+    if (!project.ok) {
+        emitFail(command, json, "PROJECT_CONTEXT_MISSING", project.message);
         return null;
     }
     const deviceAuth = await ensureAuthWithRecovery(baseUrl, json);
@@ -39,7 +39,7 @@ async function resolveContext(command, json, options, globals) {
         emitFail(command, json, failure.code, failure.message);
         return null;
     }
-    return { baseUrl, accessToken: deviceAuth.accessToken, workspaceId: workspace.workspaceId, root };
+    return { baseUrl, accessToken: deviceAuth.accessToken, projectId: project.projectId, root };
 }
 export async function runToolkitStatus(options, globals) {
     const json = options.json === true;
@@ -48,7 +48,7 @@ export async function runToolkitStatus(options, globals) {
         return;
     let cloud;
     try {
-        cloud = await fetchToolkitProfile(ctx.baseUrl, ctx.accessToken, ctx.workspaceId);
+        cloud = await fetchToolkitProfile(ctx.baseUrl, ctx.accessToken, ctx.projectId);
     }
     catch (error) {
         if (error instanceof ToolkitProfileUnavailableError) {
@@ -57,24 +57,24 @@ export async function runToolkitStatus(options, globals) {
         }
         throw error;
     }
-    const manifests = await readWorkspaceManifests(ctx.root);
-    const diagnosis = diagnoseManifests({ name: cloud.name, version: cloud.version }, manifests.workspaceManifest?.toolkit ?? null, manifests.serviceToolkit);
+    const manifests = await readProjectManifests(ctx.root);
+    const diagnosis = diagnoseManifests({ name: cloud.name, version: cloud.version }, manifests.projectManifest?.toolkit ?? null, manifests.serviceToolkit);
     const binding = await withStore((store) => getBindingByRepositoryRoot(store, ctx.root));
     const compatibility = toolkitCompatibility(binding ?? { etnaProfileJson: null }, cloud);
     if (json) {
         printJsonSuccess("toolkit status", {
-            workspaceId: ctx.workspaceId,
+            projectId: ctx.projectId,
             cloud,
-            workspaceJson: manifests.workspaceManifest?.toolkit ?? null,
+            projectJson: manifests.projectManifest?.toolkit ?? null,
             serviceJson: manifests.serviceToolkit,
             diagnosis,
             compatibility,
         });
         return;
     }
-    console.log(`Toolkit for Workspace ${ctx.workspaceId}`);
+    console.log(`Toolkit for Project ${ctx.projectId}`);
     console.log(`  cloud pin:          ${cloud.name}@${cloud.version} (renderer ${cloud.rendererVersion}, placement ${cloud.placementMapVersion})`);
-    console.log(`  .nustack/app.json:   ${fmtToolkit(manifests.workspaceManifest?.toolkit)}`);
+    console.log(`  .nustack/app.json:   ${fmtToolkit(manifests.projectManifest?.toolkit)}`);
     console.log(`  nustack.service.json:${fmtToolkit(manifests.serviceToolkit)}`);
     console.log(`  diagnosis:          ${diagnosis}`);
     console.log(`  write gate:         ${compatibility.blocksWrites ? `BLOCKED — ${compatibility.reason}` : "clear (projection and sync writes allowed)"}`);
@@ -89,7 +89,7 @@ export async function runToolkitReconcile(options, globals) {
         return;
     let cloud;
     try {
-        cloud = await fetchToolkitProfile(ctx.baseUrl, ctx.accessToken, ctx.workspaceId);
+        cloud = await fetchToolkitProfile(ctx.baseUrl, ctx.accessToken, ctx.projectId);
     }
     catch (error) {
         if (error instanceof ToolkitProfileUnavailableError) {
@@ -99,12 +99,12 @@ export async function runToolkitReconcile(options, globals) {
         throw error;
     }
     const binding = await withStore((store) => getBindingByRepositoryRoot(store, ctx.root));
-    const manifests = await readWorkspaceManifests(ctx.root);
-    const identity = manifests.workspaceManifest
-        ? { workspaceId: manifests.workspaceManifest.workspaceId, organizationId: manifests.workspaceManifest.organizationId }
-        : manifests.serviceWorkspaceBinding;
+    const manifests = await readProjectManifests(ctx.root);
+    const identity = manifests.projectManifest
+        ? { projectId: manifests.projectManifest.workspaceId, organizationId: manifests.projectManifest.organizationId }
+        : manifests.serviceProjectBinding;
     if (!identity) {
-        emitFail("toolkit reconcile", json, "WORKSPACE_CONTEXT_MISSING", "No `.nustack/app.json` binding to reconcile — attach the repository first.");
+        emitFail("toolkit reconcile", json, "PROJECT_CONTEXT_MISSING", "No `.nustack/app.json` binding to reconcile — attach the repository first.");
         return;
     }
     const plan = await buildReconcilePlan(ctx.root, binding ?? { etnaProfileJson: null }, cloud);