@nurix/nustack 0.20.4 → 0.21.0

package/README.md

@@ -13,7 +13,7 @@ npx @nurix/nustack@latest --help      # one-shot, no auth
 npm install -g @nurix/nustack         # or install the `nustack` binary globally
 ```
 
-The tarball ships no secrets. Authentication is the **device-trust flow**: `nustack login` registers this machine, you approve its code once in the browser (at `/device`, behind the studio's Google SSO), and the durable refresh material lands in your OS keychain — never in a file. Every authenticated command then rides a short-lived access token minted from it. Signing in on the CLI signs in the desktop workspace too: both clients share one keychain item and one `~/.nustack/device_id`.
+The tarball ships no secrets. Authentication is a browser sign-in at Studio: `nustack login` opens Studio's `/cli/authorize` (or, with `--manual`, shows a code to paste), you sign in with Google or your enterprise email, and the device token Studio mints for this machine lands in your OS keychain — never in a file. Every authenticated command sends that token as-is until you revoke it with `nustack logout` or from the Devices tab. Signing in on the CLI signs in the desktop workspace too: both clients share one keychain item and one `~/.nustack/device_id`.
 
 A dead credential is never a dead end: if the server refuses this device's sign-in (revoked, stale), the CLI clears the dead keychain item and drops you straight back into `nustack login` — you never edit a config file by hand.
 

package/dist/commands/deploy.js

@@ -173,7 +173,7 @@ export async function runStatus(options, globals) {
         return;
     }
     const baseUrl = resolveNuStackUrl(globals);
-    const auth = await ensureAccessToken(baseUrl).catch(() => null);
+    const auth = await ensureAccessToken().catch(() => null);
     const overview = await readProjectOverview(project.projectId, cwd, baseUrl, auth?.accessToken ?? null);
     let hosting = null;
     if (auth && overview.cloudProject) {

package/dist/commands/device.js

@@ -1,14 +1,14 @@
 import * as p from "@clack/prompts";
 import { listDevices, resolveNuStackUrl } from "../lib/nustack_client.js";
-import { readGrant, revokeGrant } from "../lib/auth_grant.js";
+import { readStoredCredential, revokeDeviceToken } from "../lib/auth_grant.js";
 import { ensureAuthWithRecovery, lastAuthFailure } from "../lib/auth_recovery.js";
 import { deleteDeviceCredential } from "../lib/device_keychain.js";
 import { isInteractive } from "../lib/interactive.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
 function clientLabel(client) {
-    if (client === "nustack-cli")
+    if (client === "cli" || client === "nustack-cli")
         return "NuStack CLI";
-    if (client === "nustack-desktop")
+    if (client === "desktop" || client === "nustack-desktop")
         return "NuStack desktop";
     if (client === "browser")
         return "Browser";
@@ -67,8 +67,8 @@ async function liveGrant(baseUrl, json) {
     const auth = await ensureAuthWithRecovery(baseUrl, json);
     if (!auth)
         return null;
-    const grant = await readGrant();
-    return grant ? { grant, accessToken: auth.accessToken } : null;
+    const { credential } = await readStoredCredential();
+    return credential ? { grant: credential, accessToken: auth.accessToken } : null;
 }
 export async function runDeviceList(options, globals) {
     const baseUrl = resolveNuStackUrl(globals);
@@ -102,8 +102,7 @@ export async function runDeviceStatus(options, globals) {
         printJsonSuccess("device status", {
             deviceId: grant.deviceId,
             email: grant.userEmail,
-            authBaseUrl: grant.authBaseUrl,
-            resources: grant.grantedResources,
+            studioBaseUrl: grant.studioBaseUrl,
             keychainMaterial: true,
             server: current,
         });
@@ -113,9 +112,8 @@ export async function runDeviceStatus(options, globals) {
     p.note([
         `device id:        ${grant.deviceId}`,
         `signed in as:     ${grant.userEmail || "—"}`,
-        `auth service:     ${grant.authBaseUrl}`,
-        `resources:        ${grant.grantedResources.join(", ") || "—"}`,
-        `keychain grant:   present`,
+        `NuStack:          ${grant.studioBaseUrl}`,
+        `stored sign-in:   present`,
         `server record:    ${current ? `${current.id} (${clientLabel(current.client)})` : "not found"}`,
         `last active:      ${current?.lastActiveAt ?? "—"}`,
     ].join("\n"), "This device");
@@ -145,10 +143,9 @@ export async function runDeviceRevoke(deviceRefArg, options, globals) {
             return;
         }
     }
-    const clientId = grant.clientId;
-    const outcome = clientId ? await revokeGrant({ authBaseUrl: grant.authBaseUrl, refreshToken: grant.grantToken, clientId }) : "unreachable";
+    const outcome = await revokeDeviceToken({ baseUrl: grant.studioBaseUrl || baseUrl, deviceToken: grant.deviceToken, deviceId: grant.deviceId });
     if (outcome === "refused" || outcome === "unreachable") {
-        return fail("device revoke", json, "REVOKE_FAILED", outcome === "refused" ? "The auth service refused to end the grant." : "Couldn't reach the auth service to end the grant.");
+        return fail("device revoke", json, "REVOKE_FAILED", outcome === "refused" ? "NuStack refused to end this machine's sign-in." : "Couldn't reach NuStack to end this machine's sign-in.");
     }
     await deleteDeviceCredential(grant.deviceId).catch(() => false);
     if (json) {

package/dist/commands/doctor.js

@@ -58,7 +58,7 @@ export async function runDoctor(options) {
         rows.push({ area, check, status, detail });
     };
     const fromEnv = envToken();
-    const deviceAuth = await ensureAccessToken(baseUrl).catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(() => null);
     if (fromEnv?.kind === "malformed")
         add("identity", "Device sign-in", "error", fromEnv.message);
     else if (fromEnv)

package/dist/commands/init.js

@@ -35,7 +35,7 @@ export async function runInit(options) {
     });
 }
 export async function ensureSignedIn(baseUrl, cwd) {
-    const deviceAuth = await ensureAccessToken(baseUrl).catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(() => null);
     if (deviceAuth) {
         p.log.success(`Signed in as ${deviceAuth.userEmail}`);
         return deviceAuth.accessToken;
@@ -45,7 +45,7 @@ export async function ensureSignedIn(baseUrl, cwd) {
         process.exitCode = 1;
         return null;
     }
-    const refreshed = await ensureAccessToken(baseUrl).catch(() => null);
+    const refreshed = await ensureAccessToken().catch(() => null);
     if (!refreshed) {
         p.outro("Sign-in did not complete — run `nustack login` and retry.");
         process.exitCode = 1;

package/dist/commands/login.js

@@ -44,9 +44,8 @@ function waitForEnter() {
         process.stdin.resume();
     });
 }
-async function pasteFlow(ctx, flags) {
+async function pasteFlow(ctx) {
     return loginWithPastedCode(ctx, {
-        force: flags.force,
         onAuthorizeUrl: (url) => p.note(`${url}\n\nSign in there, then copy the code the page shows.`, "Open this URL in any browser"),
         promptForCode,
     });
@@ -56,7 +55,6 @@ async function loopbackFlow(ctx, flags) {
     const switchToPaste = waitForEnter();
     try {
         return await loginWithLoopback(ctx, {
-            force: flags.force,
             onAuthorizeUrl: (url) => {
                 p.note(`${url}\n\n${isInteractive() ? "Press Enter to paste a code instead." : ""}`.trim(), "Sign in with your browser");
                 if (flags.open !== false)
@@ -92,9 +90,9 @@ export async function performDeviceLogin(baseUrl, _cwd = process.cwd(), flags =
         return false;
     }
     if (!flags.force && !flags.reauthorize) {
-        const live = await ensureAccessToken(baseUrl).catch(() => null);
+        const live = await ensureAccessToken().catch(() => null);
         if (live) {
-            p.log.success(`Signed in as ${live.userEmail || "this account"} — already signed in on this machine (use --force to switch accounts).`);
+            p.log.success(`Signed in as ${live.userEmail || "this account"} — already signed in on this machine (use --force to sign in again).`);
             return true;
         }
     }
@@ -115,10 +113,10 @@ export async function performDeviceLogin(baseUrl, _cwd = process.cwd(), flags =
                 p.log.warn("Sign-in cancelled.");
                 return false;
             }
-            result = choice === "paste" ? await pasteFlow(ctx, flags) : await loopbackFlow(ctx, flags);
+            result = choice === "paste" ? await pasteFlow(ctx) : await loopbackFlow(ctx, flags);
         }
         else {
-            result = useManual ? await pasteFlow(ctx, flags) : await loopbackFlow(ctx, flags);
+            result = useManual ? await pasteFlow(ctx) : await loopbackFlow(ctx, flags);
         }
     }
     catch (error) {
@@ -127,10 +125,10 @@ export async function performDeviceLogin(baseUrl, _cwd = process.cwd(), flags =
     }
     p.log.success(`Signed in as ${result.userEmail || "this account"}`);
     if (store.name === "file") {
-        p.log.info(`This machine's grant is saved to ~/.nustack/credentials.json, readable only by you — no OS keychain here. Manage it with \`nustack device list\`.`);
+        p.log.info(`This machine's sign-in is saved to ~/.nustack/credentials.json, readable only by you — no OS keychain here. Manage it with \`nustack device list\`.`);
     }
     else {
-        p.log.info("This machine's grant is saved to your keychain — the desktop shares it. Manage it with `nustack device list`.");
+        p.log.info("This machine's sign-in is saved to your keychain — the desktop shares it. Manage it with `nustack device list`.");
     }
     return true;
 }

package/dist/commands/logout.js

@@ -3,7 +3,7 @@ import { resolveNuStackUrl } from "../lib/nustack_client.js";
 import { clearDeviceId } from "../lib/device_identity.js";
 import { deleteDeviceCredential } from "../lib/device_keychain.js";
 import { selectCredentialStore } from "../lib/credential_store.js";
-import { ENV_TOKEN_VARIABLE, envToken, fetchAuthConfig, readGrant, revokeGrant } from "../lib/auth_grant.js";
+import { ENV_TOKEN_VARIABLE, envToken, readStoredCredential, revokeDeviceToken } from "../lib/auth_grant.js";
 const SHARED_SIGNOUT_NOTE = "This signs out both the CLI and the desktop on this machine.";
 export async function runLogout(options, flags = {}) {
     p.intro("nustack logout");
@@ -14,25 +14,24 @@ export async function runLogout(options, flags = {}) {
         return;
     }
     const store = selectCredentialStore();
-    const grant = await readGrant();
-    if (grant) {
-        const clientId = grant.clientId ?? (await fetchAuthConfig(baseUrl).then((c) => c.clientId).catch(() => null));
-        const outcome = clientId ? await revokeGrant({ authBaseUrl: grant.authBaseUrl, refreshToken: grant.grantToken, clientId }) : "unreachable";
+    const { credential } = await readStoredCredential();
+    if (credential) {
+        const outcome = await revokeDeviceToken({ baseUrl: credential.studioBaseUrl || baseUrl, deviceToken: credential.deviceToken, deviceId: credential.deviceId });
         if (outcome === "revoked") {
-            p.log.success("Ended this machine's grant at the auth service — it can no longer mint access.");
+            p.log.success("Ended this machine's sign-in at NuStack — its token no longer works.");
         }
         else if (outcome === "already_ended") {
-            p.log.info("This machine's grant had already been ended at the auth service.");
+            p.log.info("This machine's sign-in had already been ended at NuStack.");
         }
         else if (outcome === "refused") {
-            p.log.warn("The auth service refused to end the grant — clearing local material anyway. Revoke it from Profile › Devices.");
+            p.log.warn("NuStack refused to end this machine's sign-in — clearing local material anyway. Revoke it from Profile › Devices.");
         }
         else {
-            p.log.warn("Couldn't reach the auth service to end the grant — clearing local material anyway. Revoke it from Profile › Devices when you are back online.");
+            p.log.warn("Couldn't reach NuStack to end this machine's sign-in — clearing local material anyway. Revoke it from Profile › Devices when you are back online.");
         }
-        const cleared = await deleteDeviceCredential(grant.deviceId);
+        const cleared = await deleteDeviceCredential(credential.deviceId);
         if (cleared)
-            p.log.success(store.name === "keychain" ? "Cleared the keychain grant." : `Cleared the stored grant (${store.name}).`);
+            p.log.success(store.name === "keychain" ? "Cleared the keychain sign-in." : `Cleared the stored sign-in (${store.name}).`);
     }
     else {
         p.log.info(store.name === "keychain" ? "No keychain credential to clear on this machine." : `No stored credential to clear on this machine (${store.name}).`);

package/dist/commands/project-sync.js

@@ -92,7 +92,7 @@ export function registerProjectSyncCommands(projectCommand, getGlobalOptions) {
 }
 async function buildInboundRuntime(store, globals) {
     const baseUrl = resolveNuStackUrl(globals);
-    const auth = await ensureAccessToken(baseUrl).catch(() => null);
+    const auth = await ensureAccessToken().catch(() => null);
     if (!auth)
         return null;
     const deviceState = readDeviceState(store);
@@ -465,7 +465,7 @@ async function runReconcileHistory(globals, options) {
                 continue;
             }
             const baseUrl = resolveNuStackUrl(globals);
-            const client = createUploadClient({ baseUrl, getAccessToken: deviceTokenProvider(baseUrl) });
+            const client = createUploadClient({ baseUrl, getAccessToken: deviceTokenProvider() });
             if (options.publish) {
                 const result = await publishCurrentState(store, binding, repo, { client });
                 if (result.ok) {

package/dist/commands/review.js

@@ -56,7 +56,7 @@ export async function runReviewCheck(options, globals) {
         process.exitCode = EXIT_FOR[state];
     };
     const baseUrl = resolveNuStackUrl(globals);
-    const deviceAuth = await ensureAccessToken(baseUrl).catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(() => null);
     if (!deviceAuth)
         return report("unreachable");
     try {
@@ -124,7 +124,7 @@ export async function runReviewMirror(options, globals) {
     if (!sessionId)
         return mirrorReport(json, "skipped", null, "--session is required");
     const baseUrl = resolveNuStackUrl(globals);
-    const deviceAuth = await ensureAccessToken(baseUrl).catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(() => null);
     if (!deviceAuth)
         return mirrorReport(json, "skipped", null, "signed out");
     const client = makeReviewClient(baseUrl, deviceAuth.accessToken);

package/dist/commands/sessions.js

@@ -69,7 +69,7 @@ export async function runSessionsRecord(options, globals) {
     const transcripts = readTranscripts(payload?.sessions);
     if (transcripts.length === 0)
         return report("sessions record", EMPTY, json, "nothing to record");
-    const deviceAuth = await ensureAccessToken(baseUrl).catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(() => null);
     if (!deviceAuth)
         return report("sessions record", EMPTY, json, "signed out");
     const summary = await recordOutsideSessions(makeSessionsClient(baseUrl, deviceAuth.accessToken), {

package/dist/commands/sync.js

@@ -14,7 +14,7 @@ export async function runSync(options) {
     const json = options.json === true;
     if (!json)
         p.intro("nustack sync");
-    const deviceAuth = await ensureAccessToken(baseUrl).catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(() => null);
     if (!deviceAuth)
         return failSync(json, "SIGNED_OUT", signedOut(), "The managed block was not touched.");
     const accessToken = deviceAuth.accessToken;

package/dist/index.js

@@ -53,7 +53,7 @@ program
     .description("Sign in with your browser; this machine's grant is saved to your OS keychain")
     .option("--no-open", "don't auto-open the browser; just print the sign-in URL")
     .option("--manual", "sign in anywhere and paste the code here instead of using a browser on this machine")
-    .option("--force", "sign in again even if this machine already holds a grant, and ask for the account")
+    .option("--force", "sign in again even if this machine is already signed in")
     .action(async (options) => runLogin(program.opts(), options));
 program
     .command("logout")

package/dist/lib/auth_grant.js

@@ -1,20 +1,17 @@
 import os from "node:os";
 import { createHash, randomBytes } from "node:crypto";
-import { assertSafeNuStackUrl } from "./guards.js";
 import { getOrCreateDeviceId } from "./device_identity.js";
 import { deleteDeviceCredential, readCredentialFailure, readDeviceCredential, writeDeviceCredential } from "./device_keychain.js";
 import { openLoopbackListener } from "./loopback.js";
 const REQUEST_TIMEOUT_MS = 10_000;
 const BOOTSTRAP_TIMEOUT_MS = 25_000;
-const ACCESS_TOKEN_SKEW_MS = 30_000;
 const LOOPBACK_TIMEOUT_MS = 10 * 60_000;
-const MACHINE_SCOPE = "offline_access";
-export const CLI_CODE_PAGE_PATH = "/cli-code";
+export const PASTE_REDIRECT = "paste";
 export const DEVICE_HEADER = "X-NuStack-Device";
 export function deadCredentialCopy(reason) {
     if (reason === "older-schema")
         return "This machine's sign-in predates the current NuStack CLI — run `nustack login` to sign in again.";
-    if (reason === "invalid_grant")
+    if (reason === "revoked")
         return "Your sign-in on this device is no longer valid — run `nustack login` to reconnect.";
     return "Signed out on this device — run `nustack login` first.";
 }
@@ -37,142 +34,61 @@ export function signedOutReason() {
 export function signedOutCopy() {
     return deadCredentialCopy(lastDeadReason);
 }
-export async function fetchAuthConfig(nustackBaseUrl) {
-    const response = await fetch(`${nustackBaseUrl}/api/v1/auth/config`, {
-        headers: { Accept: "application/json", "User-Agent": userAgent() },
-        signal: AbortSignal.timeout(BOOTSTRAP_TIMEOUT_MS),
-    });
-    const payload = (await response.json().catch(() => null));
-    if (!response.ok || typeof payload?.auth_base_url !== "string" || typeof payload?.client_id !== "string") {
-        throw new Error(`this NuStack does not describe its auth service (HTTP ${response.status}) — it may predate machine grants`);
-    }
-    const resources = Array.isArray(payload.resources) ? payload.resources.filter((r) => typeof r === "string") : [];
-    if (resources.length === 0)
-        throw new Error("this NuStack names no resource for a machine to hold — its auth configuration is incomplete");
-    return { authBaseUrl: assertSafeNuStackUrl(payload.auth_base_url), clientId: payload.client_id, resources };
-}
-export async function discover(authBaseUrl) {
-    const response = await fetch(`${authBaseUrl}/.well-known/openid-configuration`, {
-        headers: { Accept: "application/json", "User-Agent": userAgent() },
-        signal: AbortSignal.timeout(BOOTSTRAP_TIMEOUT_MS),
-    });
-    const payload = (await response.json().catch(() => null));
-    if (!response.ok || !payload?.issuer || !payload.authorization_endpoint || !payload.token_endpoint) {
-        throw new Error(`the auth service at ${authBaseUrl} published no usable discovery document (HTTP ${response.status})`);
-    }
-    return {
-        issuer: payload.issuer,
-        authorizationEndpoint: payload.authorization_endpoint,
-        tokenEndpoint: payload.token_endpoint,
-        revocationEndpoint: payload.revocation_endpoint ?? `${authBaseUrl}/oauth2/revoke`,
-    };
-}
 export function mintPkce() {
     const verifier = randomBytes(32).toString("base64url");
     const challenge = createHash("sha256").update(verifier).digest("base64url");
     return { verifier, challenge, state: randomBytes(16).toString("base64url") };
 }
-export function buildAuthorizeUrl(config, discovery, request) {
-    const url = new URL(discovery.authorizationEndpoint);
-    url.searchParams.set("response_type", "code");
-    url.searchParams.set("client_id", config.clientId);
+export async function prepareLogin(nustackBaseUrl) {
+    const deviceId = await getOrCreateDeviceId();
+    resolvedDeviceId = deviceId;
+    return { baseUrl: nustackBaseUrl.replace(/\/+$/, ""), deviceId };
+}
+export function buildAuthorizeUrl(ctx, request) {
+    const url = new URL(`${ctx.baseUrl}/cli/authorize`);
     url.searchParams.set("redirect_uri", request.redirectUri);
-    url.searchParams.set("scope", MACHINE_SCOPE);
     url.searchParams.set("state", request.pkce.state);
     url.searchParams.set("code_challenge", request.pkce.challenge);
     url.searchParams.set("code_challenge_method", "S256");
-    for (const resource of config.resources)
-        url.searchParams.append("resource", resource);
-    if (request.force)
-        url.searchParams.set("prompt", "login");
+    url.searchParams.set("device", ctx.deviceId);
+    url.searchParams.set("client", "cli");
     return url.toString();
 }
-export function cliCodePageUrl(authBaseUrl) {
-    return `${authBaseUrl}${CLI_CODE_PAGE_PATH}`;
-}
-export async function exchangeCode(config, discovery, input) {
-    const form = new URLSearchParams({
-        grant_type: "authorization_code",
-        code: input.code,
-        code_verifier: input.verifier,
-        redirect_uri: input.redirectUri,
-        client_id: config.clientId,
-    });
-    for (const resource of config.resources)
-        form.append("resource", resource);
-    const response = await fetch(discovery.tokenEndpoint, {
+const PREDATES = "This NuStack predates the CLI's sign-in — update the server, or point the CLI at one that matches.";
+export async function exchangeCode(ctx, input) {
+    const response = await fetch(`${ctx.baseUrl}/api/v1/cli/token`, {
         method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": userAgent() },
-        body: form.toString(),
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": userAgent() },
+        body: JSON.stringify({ code: input.code, code_verifier: input.verifier, redirect_uri: input.redirectUri, device: ctx.deviceId, client: "cli" }),
+        signal: AbortSignal.timeout(BOOTSTRAP_TIMEOUT_MS),
     });
     const payload = (await response.json().catch(() => null));
-    if (!response.ok || typeof payload?.access_token !== "string") {
-        if (payload?.error === "invalid_grant")
-            throw new Error("That code expired or was already used — run `nustack login` again.");
-        throw new Error(payload?.error_description ?? payload?.error ?? `the auth service refused the code (HTTP ${response.status})`);
-    }
-    if (typeof payload.refresh_token !== "string" || !payload.refresh_token) {
-        throw new Error("The auth service issued no refresh token — the sign-in cannot be kept on this machine.");
-    }
-    return {
-        accessToken: payload.access_token,
-        refreshToken: payload.refresh_token,
-        expiresInSeconds: typeof payload.expires_in === "number" ? payload.expires_in : 0,
-    };
-}
-export function decodeJwtPayload(token) {
-    const segment = token.split(".")[1];
-    if (!segment)
-        return null;
-    try {
-        const parsed = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
-        return parsed && typeof parsed === "object" ? parsed : null;
-    }
-    catch {
-        return null;
+    if (response.status === 404 || payload === null)
+        throw new Error(PREDATES);
+    if (!response.ok || typeof payload.data?.token !== "string") {
+        throw new Error(payload.error?.message ?? `NuStack refused the sign-in code (HTTP ${response.status}).`);
     }
+    return { token: payload.data.token, email: typeof payload.data.email === "string" ? payload.data.email : "" };
 }
-async function persistGrant(config, discovery, issued) {
-    const deviceId = await getOrCreateDeviceId();
-    resolvedDeviceId = deviceId;
-    const claims = decodeJwtPayload(issued.accessToken);
-    const userEmail = typeof claims?.email === "string" ? claims.email : "";
-    const apiResource = config.resources[0];
-    await writeDeviceCredential({
-        refresh_token: issued.refreshToken,
-        auth_base_url: config.authBaseUrl,
-        issuer: discovery.issuer,
-        device_id: deviceId,
-        user_email: userEmail,
-        granted_resources: config.resources,
-        client_id: config.clientId,
-        access_tokens: { [apiResource]: { token: issued.accessToken, expires_at_ms: Date.now() + issued.expiresInSeconds * 1000 } },
-    });
+async function persistToken(ctx, issued) {
+    await writeDeviceCredential({ device_token: issued.token, studio_base_url: ctx.baseUrl, device_id: ctx.deviceId, user_email: issued.email });
     lastDeadReason = null;
-    return { userEmail, deviceId, authBaseUrl: config.authBaseUrl };
-}
-export async function prepareLogin(nustackBaseUrl) {
-    const config = await fetchAuthConfig(nustackBaseUrl);
-    const discovery = await discover(config.authBaseUrl);
-    return { config, discovery };
+    return { userEmail: issued.email, deviceId: ctx.deviceId };
 }
 export async function loginWithPastedCode(ctx, steps) {
     const pkce = mintPkce();
-    const redirectUri = cliCodePageUrl(ctx.config.authBaseUrl);
-    steps.onAuthorizeUrl(buildAuthorizeUrl(ctx.config, ctx.discovery, { redirectUri, pkce, force: steps.force }));
+    steps.onAuthorizeUrl(buildAuthorizeUrl(ctx, { redirectUri: PASTE_REDIRECT, pkce }));
     const code = (await steps.promptForCode()).trim();
     if (!code)
         throw new Error("No code was entered — run `nustack login` again.");
-    const issued = await exchangeCode(ctx.config, ctx.discovery, { code, verifier: pkce.verifier, redirectUri });
-    return persistGrant(ctx.config, ctx.discovery, issued);
+    return persistToken(ctx, await exchangeCode(ctx, { code, verifier: pkce.verifier, redirectUri: PASTE_REDIRECT }));
 }
 export async function loginWithLoopback(ctx, steps) {
     const pkce = mintPkce();
     const listener = await openLoopbackListener(pkce.state);
     let timer = null;
     try {
-        steps.onAuthorizeUrl(buildAuthorizeUrl(ctx.config, ctx.discovery, { redirectUri: listener.redirectUri, pkce, force: steps.force }));
+        steps.onAuthorizeUrl(buildAuthorizeUrl(ctx, { redirectUri: listener.redirectUri, pkce }));
         const timeout = new Promise((_, reject) => {
             timer = setTimeout(() => reject(new Error("Timed out waiting for the browser — run `nustack login` again, or `nustack login --manual`.")), steps.timeoutMs ?? LOOPBACK_TIMEOUT_MS);
         });
@@ -182,12 +98,8 @@ export async function loginWithLoopback(ctx, steps) {
             await listener.close();
             return loginWithPastedCode(ctx, steps);
         }
-        const { callback } = outcome;
-        if (callback.iss !== null && callback.iss !== ctx.discovery.issuer) {
-            throw new Error(`The sign-in came back from ${callback.iss}, not from ${ctx.discovery.issuer} — refusing it.`);
-        }
-        const issued = await exchangeCode(ctx.config, ctx.discovery, { code: callback.code, verifier: pkce.verifier, redirectUri: listener.redirectUri });
-        return persistGrant(ctx.config, ctx.discovery, issued);
+        const issued = await exchangeCode(ctx, { code: outcome.callback.code, verifier: pkce.verifier, redirectUri: listener.redirectUri });
+        return persistToken(ctx, issued);
     }
     finally {
         if (timer)
@@ -195,85 +107,18 @@ export async function loginWithLoopback(ctx, steps) {
         await listener.close().catch(() => undefined);
     }
 }
-export function readAnswer(status, body) {
-    const record = body && typeof body === "object" ? body : null;
-    const str = (key) => {
-        const value = record?.[key];
-        return typeof value === "string" && value.length > 0 ? value : null;
-    };
-    if (status >= 200 && status < 300) {
-        return { kind: "tokens", hasAccessToken: str("access_token") !== null, hasRefreshToken: str("refresh_token") !== null };
-    }
-    if (status >= 500)
-        return { kind: "unusable" };
-    return { kind: "refusal", code: str("error") };
-}
-export function classifyAnswer(answer) {
-    switch (answer.kind) {
-        case "tokens":
-            return answer.hasAccessToken ? "signed_in" : "transport_error";
-        case "refusal":
-            if (answer.code === "invalid_grant")
-                return "credential_dead";
-            if (answer.code === "invalid_target")
-                return "needs_reauthorization";
-            return "transport_error";
-        default:
-            return "transport_error";
-    }
-}
-export function classifyRefresh(status, body) {
-    return classifyAnswer(readAnswer(status, body));
-}
-export async function refreshGrant(tokenEndpoint, refreshToken, resource, clientId) {
-    const form = new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: clientId, resource });
-    const response = await fetch(tokenEndpoint, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": userAgent() },
-        body: form.toString(),
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-    });
-    const payload = (await response.json().catch(() => null));
-    switch (classifyRefresh(response.status, payload)) {
-        case "signed_in":
-            return {
-                kind: "minted",
-                accessToken: payload.access_token,
-                expiresInSeconds: typeof payload.expires_in === "number" ? payload.expires_in : 0,
-                ...(typeof payload.refresh_token === "string" ? { rotatedRefreshToken: payload.refresh_token } : {}),
-            };
-        case "credential_dead":
-            return { kind: "dead", reason: "invalid_grant" };
-        case "needs_reauthorization":
-            return { kind: "needs_reauthorization", resource };
-        default:
-            throw new Error(`token refresh failed: HTTP ${response.status}`);
-    }
-}
-function isAlreadyEnded(status, payload) {
-    if (status !== 400 || !payload)
-        return false;
-    if (payload.error === "invalid_grant")
-        return true;
-    return payload.error === "invalid_request" && /revoked|not found|expired|invalid/i.test(payload.error_description ?? "");
-}
-export async function revokeGrant(input) {
+export async function revokeDeviceToken(input) {
     try {
-        const endpoint = await discover(input.authBaseUrl)
-            .then((d) => d.revocationEndpoint)
-            .catch(() => `${input.authBaseUrl}/oauth2/revoke`);
-        const response = await fetch(endpoint, {
+        const response = await fetch(`${input.baseUrl.replace(/\/+$/, "")}/api/v2/devices/self/revoke`, {
             method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": userAgent() },
-            body: new URLSearchParams({ token: input.refreshToken, token_type_hint: "refresh_token", client_id: input.clientId }).toString(),
+            headers: { Authorization: `Bearer ${input.deviceToken}`, [DEVICE_HEADER]: input.deviceId, Accept: "application/json", "User-Agent": userAgent() },
             signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
         });
         if (response.ok)
             return "revoked";
-        if (response.status >= 500)
-            return "unreachable";
-        const payload = (await response.json().catch(() => null));
-        return isAlreadyEnded(response.status, payload) ? "already_ended" : "refused";
+        if (response.status === 401)
+            return "already_ended";
+        return response.status >= 500 ? "unreachable" : "refused";
     }
     catch {
         return "unreachable";
@@ -301,130 +146,47 @@ export class TokenRefusedError extends Error {
         this.name = "TokenRefusedError";
     }
 }
-async function readStoredGrant() {
+export async function readStoredCredential() {
     const deviceId = await getOrCreateDeviceId();
     resolvedDeviceId = deviceId;
     const credential = await readDeviceCredential(deviceId);
     if (!credential) {
         const failure = await readCredentialFailure(deviceId);
-        return { deviceId, grant: null, failure: failure === "older-schema" ? "older-schema" : null };
+        return { deviceId, credential: null, failure: failure === "older-schema" ? "older-schema" : null };
     }
     return {
         deviceId,
         failure: null,
-        grant: {
-            deviceId,
-            refreshToken: credential.refresh_token,
-            authBaseUrl: credential.auth_base_url,
-            issuer: credential.issuer,
-            userEmail: credential.user_email,
-            grantedResources: Array.isArray(credential.granted_resources) ? credential.granted_resources : [],
-            clientId: typeof credential.client_id === "string" ? credential.client_id : null,
-            accessTokens: credential.access_tokens ?? {},
-        },
+        credential: { deviceToken: credential.device_token, studioBaseUrl: credential.studio_base_url, deviceId, userEmail: credential.user_email },
     };
 }
-async function clientIdFor(grant, nustackBaseUrl) {
-    if (grant.clientId)
-        return grant.clientId;
-    if (!nustackBaseUrl)
-        throw new Error("this machine's grant names no client and no NuStack URL was given to ask");
-    return (await fetchAuthConfig(nustackBaseUrl)).clientId;
-}
-async function refreshAndPersist(grant, audience, nustackBaseUrl) {
-    const clientId = await clientIdFor(grant, nustackBaseUrl);
-    const refreshed = await refreshGrant(`${grant.authBaseUrl}/oauth2/token`, grant.refreshToken, audience, clientId);
-    if (refreshed.kind !== "minted")
-        return refreshed;
-    const claims = decodeJwtPayload(refreshed.accessToken);
-    const userEmail = (typeof claims?.email === "string" && claims.email) || grant.userEmail;
-    await writeDeviceCredential({
-        refresh_token: refreshed.rotatedRefreshToken ?? grant.refreshToken,
-        auth_base_url: grant.authBaseUrl,
-        issuer: grant.issuer,
-        device_id: grant.deviceId,
-        user_email: userEmail,
-        granted_resources: grant.grantedResources,
-        client_id: clientId,
-        access_tokens: {
-            ...grant.accessTokens,
-            [audience]: { token: refreshed.accessToken, expires_at_ms: Date.now() + refreshed.expiresInSeconds * 1000 },
-        },
-    });
-    return refreshed;
-}
-export async function resolveAccessToken(nustackBaseUrl, resource) {
+export async function resolveAccessToken() {
     const fromEnv = envToken();
     if (fromEnv) {
         if (fromEnv.kind === "malformed")
             return { kind: "malformed_token", message: fromEnv.message };
         const deviceId = resolvedDeviceId ?? (await getOrCreateDeviceId());
         resolvedDeviceId = deviceId;
-        return { kind: "ok", session: { accessToken: fromEnv.token, userEmail: "", deviceId, authBaseUrl: "" } };
+        return { kind: "ok", session: { accessToken: fromEnv.token, userEmail: "", deviceId } };
     }
-    const { deviceId, grant, failure } = await readStoredGrant();
-    if (!grant) {
+    const { deviceId, credential, failure } = await readStoredCredential();
+    if (!credential) {
         if (failure)
             lastDeadReason = failure;
         return { kind: "none", reason: failure };
     }
-    const audience = resource ?? grant.grantedResources[0];
-    if (!audience)
-        return { kind: "none", reason: null };
-    const cached = grant.accessTokens[audience];
-    if (cached && cached.expires_at_ms - ACCESS_TOKEN_SKEW_MS > Date.now()) {
-        return { kind: "ok", session: { accessToken: cached.token, userEmail: grant.userEmail, deviceId, authBaseUrl: grant.authBaseUrl } };
-    }
-    const refreshed = await refreshAndPersist(grant, audience, nustackBaseUrl);
-    if (refreshed.kind === "dead") {
-        lastDeadReason = refreshed.reason;
-        await deleteDeviceCredential(deviceId).catch(() => false);
-        return { kind: "dead", reason: refreshed.reason };
-    }
-    if (refreshed.kind === "needs_reauthorization")
-        return { kind: "needs_reauthorization", resource: audience };
-    lastDeadReason = null;
-    const claims = decodeJwtPayload(refreshed.accessToken);
-    const userEmail = (typeof claims?.email === "string" && claims.email) || grant.userEmail;
-    return { kind: "ok", session: { accessToken: refreshed.accessToken, userEmail, deviceId, authBaseUrl: grant.authBaseUrl } };
+    return { kind: "ok", session: { accessToken: credential.deviceToken, userEmail: credential.userEmail, deviceId } };
 }
-export async function ensureAccessToken(nustackBaseUrl, resource) {
-    const outcome = await resolveAccessToken(nustackBaseUrl, resource);
+export async function ensureAccessToken() {
+    const outcome = await resolveAccessToken();
     return outcome.kind === "ok" ? { accessToken: outcome.session.accessToken, userEmail: outcome.session.userEmail } : null;
 }
-export async function refreshAccessTokenAfterRefusal(staleToken, nustackBaseUrl, resource) {
+export async function forgetRefusedToken(staleToken) {
     if (envToken())
-        return null;
-    const { deviceId, grant } = await readStoredGrant();
-    if (!grant)
-        return null;
-    const audience = resource ?? grant.grantedResources[0];
-    if (!audience)
-        return null;
-    const cached = grant.accessTokens[audience];
-    if (cached && cached.token !== staleToken)
-        return cached.token;
-    const refreshed = await refreshAndPersist(grant, audience, nustackBaseUrl);
-    if (refreshed.kind === "dead") {
-        lastDeadReason = refreshed.reason;
-        await deleteDeviceCredential(deviceId).catch(() => false);
-        return null;
-    }
-    if (refreshed.kind === "needs_reauthorization")
-        return null;
-    return refreshed.accessToken;
-}
-export async function readGrant() {
-    const { grant } = await readStoredGrant();
-    if (!grant)
-        return null;
-    return {
-        grantToken: grant.refreshToken,
-        authBaseUrl: grant.authBaseUrl,
-        issuer: grant.issuer,
-        deviceId: grant.deviceId,
-        userEmail: grant.userEmail,
-        grantedResources: grant.grantedResources,
-        clientId: grant.clientId,
-    };
+        return;
+    const { deviceId, credential } = await readStoredCredential();
+    if (!credential || credential.deviceToken !== staleToken)
+        return;
+    lastDeadReason = "revoked";
+    await deleteDeviceCredential(deviceId).catch(() => false);
 }

package/dist/lib/auth_recovery.js

@@ -8,19 +8,14 @@ export function lastAuthFailure() {
 }
 function describeFailure(outcome) {
     if (outcome === "unreachable") {
-        return { code: "AUTH_UNAVAILABLE", message: "Couldn't reach the auth service to refresh this machine's sign-in — try again in a moment.", retryable: true };
-    }
-    if (outcome.kind === "needs_reauthorization") {
-        return { code: "REAUTHORIZATION_REQUIRED", message: `This machine isn't approved for ${outcome.resource} yet — run \`nustack login\` to approve it.`, retryable: false };
+        return { code: "AUTH_UNAVAILABLE", message: "Couldn't read this machine's sign-in — try again in a moment.", retryable: true };
     }
     if (outcome.kind === "malformed_token")
         return { code: "TOKEN_MALFORMED", message: outcome.message, retryable: false };
     return { code: "SIGNED_OUT", message: deadCredentialCopy(outcome.reason), retryable: false };
 }
 function reconnectingCopy(outcome) {
-    if (outcome.kind === "needs_reauthorization")
-        return `This machine isn't approved for ${outcome.resource} yet. Opening the browser to sign in…`;
-    if (outcome.kind === "dead")
+    if (outcome.reason === "revoked")
         return "This machine's access was revoked. Opening the browser to sign in…";
     if (outcome.reason === "older-schema")
         return "This machine's sign-in predates the current NuStack CLI. Opening the browser to sign in…";
@@ -29,7 +24,7 @@ function reconnectingCopy(outcome) {
 export async function ensureAuthWithRecovery(baseUrl, json) {
     let outcome;
     try {
-        outcome = await resolveAccessToken(baseUrl);
+        outcome = await resolveAccessToken();
     }
     catch {
         lastFailure = describeFailure("unreachable");
@@ -44,7 +39,7 @@ export async function ensureAuthWithRecovery(baseUrl, json) {
     const didLogin = await performDeviceLogin(baseUrl, process.cwd(), { reauthorize: true });
     if (!didLogin)
         return null;
-    return ensureAccessToken(baseUrl).catch(() => {
+    return ensureAccessToken().catch(() => {
         lastFailure = describeFailure("unreachable");
         return null;
     });

package/dist/lib/device_keychain.js

@@ -1,7 +1,7 @@
 import { selectCredentialStore } from "./credential_store.js";
 export { isKeychainAvailable } from "./credential_store.js";
-export const KEYCHAIN_SCHEMA_VERSION = 3;
-const REQUIRED_FIELDS = ["refresh_token", "auth_base_url", "issuer", "device_id", "user_email"];
+export const KEYCHAIN_SCHEMA_VERSION = 4;
+const REQUIRED_FIELDS = ["device_token", "studio_base_url", "device_id", "user_email"];
 export function decodeCredential(raw) {
     let parsed;
     try {

package/dist/lib/git-sync/outbound/index.js

@@ -1,18 +1,18 @@
 import { ensureAccessToken } from "../../auth_grant.js";
 import { createUploadClient } from "./upload_client.js";
 import { runOutboundPublisher } from "./publisher.js";
-export function deviceTokenProvider(baseUrl) {
+export function deviceTokenProvider() {
     let cached = null;
     return async (forceRefresh) => {
         if (cached && !forceRefresh)
             return cached;
-        const result = await ensureAccessToken(baseUrl);
+        const result = await ensureAccessToken();
         cached = result?.accessToken ?? null;
         return cached;
     };
 }
 export function registerOutbound(engine, options) {
-    const getAccessToken = options.getAccessToken ?? deviceTokenProvider(options.baseUrl);
+    const getAccessToken = options.getAccessToken ?? deviceTokenProvider();
     const client = createUploadClient({ baseUrl: options.baseUrl, getAccessToken, fetchImpl: options.fetchImpl });
     engine.registerOutboundPublisher((ctx) => runOutboundPublisher(ctx, { client, now: options.now }));
     return client;

package/dist/lib/loopback.js

@@ -34,7 +34,7 @@ export async function openLoopbackListener(expectedState) {
         if (error) {
             response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
             response.end(page("Sign-in did not complete", url.searchParams.get("error_description") ?? error));
-            settle?.reject(new Error(`The auth service refused the sign-in (${error}).`));
+            settle?.reject(new Error(`NuStack refused the sign-in (${error}).`));
             settle = null;
             void closeServer(server);
             return;
@@ -47,7 +47,7 @@ export async function openLoopbackListener(expectedState) {
         }
         response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         response.end(page("Signed in", "You can close this tab and return to the terminal."));
-        settle?.resolve({ code, iss: url.searchParams.get("iss") });
+        settle?.resolve({ code });
         settle = null;
         void closeServer(server);
     });

package/dist/lib/nustack_client.js

@@ -1,6 +1,6 @@
 import { assertSafeNuStackUrl, assertSafeOpaqueId } from "./guards.js";
 import { createSseParser } from "./sse_framing.js";
-import { DEVICE_HEADER, envToken, knownDeviceId, refreshAccessTokenAfterRefusal, TokenRefusedError, userAgent } from "./auth_grant.js";
+import { deadCredentialCopy, DEVICE_HEADER, envToken, forgetRefusedToken, knownDeviceId, TokenRefusedError, userAgent } from "./auth_grant.js";
 import { getOrCreateDeviceId } from "./device_identity.js";
 const DEFAULT_NUSTACK_URL = "https://apps.nustack.ai";
 const REQUEST_TIMEOUT_MS = 10_000;
@@ -10,20 +10,20 @@ export async function authorizedFetch(input, init = {}) {
     headers.set("User-Agent", userAgent());
     const response = await globalThis.fetch(input, { ...init, headers });
     const bearer = headers.get("Authorization")?.replace(/^Bearer\s+/i, "");
-    if (response.status !== 401 || !bearer || isStreamBody(init.body))
+    if (response.status !== 401 || !bearer)
         return response;
     if (envToken())
         throw new TokenRefusedError();
-    const fresh = await refreshAccessTokenAfterRefusal(bearer).catch(() => null);
-    if (!fresh)
-        return response;
-    headers.set("Authorization", `Bearer ${fresh}`);
-    return globalThis.fetch(input, { ...init, headers });
-}
-function isStreamBody(body) {
-    return body != null && typeof body !== "string" && !(body instanceof ArrayBuffer) && !ArrayBuffer.isView(body) && !(body instanceof URLSearchParams);
+    await forgetRefusedToken(bearer).catch(() => undefined);
+    return response;
 }
 const KEYS_PLANE = "the credential plane (/api/v1/keys)";
+export function apiError(payload, status, label, plane) {
+    if (status === 401 && !envToken())
+        return Object.assign(new Error(deadCredentialCopy("revoked")), { code: "SIGNED_OUT" });
+    const code = typeof payload?.error === "object" && typeof payload.error?.code === "string" ? payload.error.code : "UNEXPECTED";
+    return Object.assign(new Error(errorMessage(payload, status, label, plane)), { code });
+}
 export function errorMessage(payload, status, label, plane) {
     if (plane && status === 404 && typeof payload?.error === "string") {
         return `${label}: this NuStack deployment does not serve ${plane} — the server half of this command is not deployed, so it cannot succeed against this host.`;
@@ -67,7 +67,7 @@ export async function exchangeServiceCredential(baseUrl, accessToken, params) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.serviceKey) {
-        throw new Error(errorMessage(payload, response.status, "exchange failed", KEYS_PLANE));
+        throw apiError(payload, response.status, "exchange failed", KEYS_PLANE);
     }
     return narrowProjection(payload, params.service);
 }
@@ -81,7 +81,7 @@ export async function fetchServiceCredential(baseUrl, accessToken, params) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.serviceKey) {
-        throw new Error(errorMessage(payload, response.status, `projection for '${params.service}' failed`, KEYS_PLANE));
+        throw apiError(payload, response.status, `projection for '${params.service}' failed`, KEYS_PLANE);
     }
     return narrowProjection(payload, params.service);
 }
@@ -94,7 +94,7 @@ export async function listProjectIntegrations(baseUrl, accessToken, projectId) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !Array.isArray(payload?.integrations)) {
-        throw new Error(errorMessage(payload, response.status, "integration list failed", KEYS_PLANE));
+        throw apiError(payload, response.status, "integration list failed", KEYS_PLANE);
     }
     return payload.integrations;
 }
@@ -108,7 +108,7 @@ export async function fetchBrokeredCredential(baseUrl, accessToken, params) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.key || !payload?.grantId) {
-        throw new Error(errorMessage(payload, response.status, "broker fetch failed", KEYS_PLANE));
+        throw apiError(payload, response.status, "broker fetch failed", KEYS_PLANE);
     }
     return { url: payload.url ?? null, key: payload.key, meta: payload.meta ?? null, grantId: payload.grantId };
 }
@@ -122,7 +122,7 @@ export async function searchProjects(baseUrl, query, opts = {}) {
     const response = await authorizedFetch(url, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !Array.isArray(payload?.data?.items)) {
-        throw new Error(errorMessage(payload, response.status, "project search failed"));
+        throw apiError(payload, response.status, "project search failed");
     }
     return payload.data.items;
 }
@@ -150,7 +150,7 @@ export async function fetchHandoffManifest(baseUrl, accessToken, params) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.manifestSha256) {
-        throw new Error(errorMessage(payload, response.status, "handoff manifest fetch failed"));
+        throw apiError(payload, response.status, "handoff manifest fetch failed");
     }
     return payload.data;
 }
@@ -179,7 +179,7 @@ export async function fetchBindingEvents(baseUrl, accessToken, params) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !Array.isArray(payload?.data?.items)) {
-        throw new Error(errorMessage(payload, response.status, "binding events fetch failed"));
+        throw apiError(payload, response.status, "binding events fetch failed");
     }
     return payload.data.items;
 }
@@ -193,7 +193,7 @@ export async function acknowledgeBindingCursor(baseUrl, accessToken, params) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || typeof payload?.data?.lastAppliedProjectSequence !== "number") {
-        throw new Error(errorMessage(payload, response.status, "cursor acknowledgement failed"));
+        throw apiError(payload, response.status, "cursor acknowledgement failed");
     }
     return payload.data.lastAppliedProjectSequence;
 }
@@ -205,7 +205,7 @@ export async function fetchSyncWhitelist(baseUrl, accessToken, bindingId) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.manifestSha256) {
-        throw new Error(errorMessage(payload, response.status, "sync whitelist fetch failed"));
+        throw apiError(payload, response.status, "sync whitelist fetch failed");
     }
     return payload.data;
 }
@@ -220,7 +220,7 @@ export async function reportApplicationDecision(baseUrl, accessToken, report) {
         return { ok: false, code: "HANDOFF_SUPERSEDED" };
     }
     if (!response.ok || payload?.data?.recorded !== true) {
-        throw new Error(errorMessage(payload, response.status, "decision report failed"));
+        throw apiError(payload, response.status, "decision report failed");
     }
     return { ok: true };
 }
@@ -260,7 +260,7 @@ function postApplicationReport(baseUrl, accessToken, report, action, body) {
 async function assertReportRecorded(response, label) {
     const payload = (await response.json().catch(() => null));
     if (!response.ok || payload?.data?.recorded !== true) {
-        throw new Error(errorMessage(payload, response.status, label));
+        throw apiError(payload, response.status, label);
     }
 }
 function authHeaders(accessToken) {
@@ -280,7 +280,7 @@ export async function listOrganizations(baseUrl, accessToken) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !Array.isArray(payload?.data?.items)) {
-        throw new Error(errorMessage(payload, response.status, "organization list failed"));
+        throw apiError(payload, response.status, "organization list failed");
     }
     return payload.data.items;
 }
@@ -333,7 +333,7 @@ export async function createOrganization(baseUrl, accessToken, params, idempoten
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.id) {
-        throw new Error(errorMessage(payload, response.status, "organization create failed"));
+        throw apiError(payload, response.status, "organization create failed");
     }
     return payload.data;
 }
@@ -345,7 +345,7 @@ export async function listProjects(baseUrl, accessToken, organizationId) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !Array.isArray(payload?.data?.items)) {
-        throw new Error(errorMessage(payload, response.status, "project list failed"));
+        throw apiError(payload, response.status, "project list failed");
     }
     return payload.data.items;
 }
@@ -357,7 +357,7 @@ export async function getProject(baseUrl, accessToken, projectId) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.id) {
-        throw new Error(errorMessage(payload, response.status, "project fetch failed"));
+        throw apiError(payload, response.status, "project fetch failed");
     }
     return payload.data;
 }
@@ -417,7 +417,7 @@ export async function createProjectViaAsk(baseUrl, accessToken, organizationId,
     });
     if (!response.ok || !response.body) {
         const payload = (await response.json().catch(() => null));
-        throw new Error(errorMessage(payload, response.status, "project create failed"));
+        throw apiError(payload, response.status, "project create failed");
     }
     let started = false;
     let turnId = null;
@@ -456,7 +456,7 @@ async function postProjectPublication(baseUrl, accessToken, projectId, action, b
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || payload?.data === undefined) {
-        throw new Error(errorMessage(payload, response.status, `project ${action} failed`));
+        throw apiError(payload, response.status, `project ${action} failed`);
     }
     return payload.data;
 }
@@ -474,7 +474,7 @@ export async function listDocuments(baseUrl, accessToken, projectId) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !Array.isArray(payload?.data?.items)) {
-        throw new Error(errorMessage(payload, response.status, "document list failed"));
+        throw apiError(payload, response.status, "document list failed");
     }
     return payload.data.items;
 }
@@ -486,7 +486,7 @@ export async function getDocument(baseUrl, accessToken, documentId) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.document?.id) {
-        throw new Error(errorMessage(payload, response.status, "document fetch failed"));
+        throw apiError(payload, response.status, "document fetch failed");
     }
     return payload.data;
 }
@@ -498,7 +498,7 @@ export async function listHandoffs(baseUrl, accessToken, projectId) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !Array.isArray(payload?.data?.items)) {
-        throw new Error(errorMessage(payload, response.status, "handoff list failed"));
+        throw apiError(payload, response.status, "handoff list failed");
     }
     return payload.data.items;
 }
@@ -510,7 +510,7 @@ export async function getHandoff(baseUrl, accessToken, handoffId) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.id) {
-        throw new Error(errorMessage(payload, response.status, "handoff fetch failed"));
+        throw apiError(payload, response.status, "handoff fetch failed");
     }
     return payload.data;
 }
@@ -533,7 +533,7 @@ export async function createBinding(baseUrl, accessToken, projectId, input, idem
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.id) {
-        throw new Error(errorMessage(payload, response.status, "binding create failed"));
+        throw apiError(payload, response.status, "binding create failed");
     }
     return payload.data;
 }
@@ -545,7 +545,7 @@ export async function getBinding(baseUrl, accessToken, bindingId) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.id) {
-        throw new Error(errorMessage(payload, response.status, "binding fetch failed"));
+        throw apiError(payload, response.status, "binding fetch failed");
     }
     return payload.data;
 }
@@ -558,7 +558,7 @@ export async function deleteBinding(baseUrl, accessToken, bindingId) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.id) {
-        throw new Error(errorMessage(payload, response.status, "binding remove failed"));
+        throw apiError(payload, response.status, "binding remove failed");
     }
     return { id: payload.data.id, status: payload.data.status ?? "removed" };
 }
@@ -572,7 +572,7 @@ export async function postBindingHealth(baseUrl, accessToken, bindingId, report)
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload?.data?.id) {
-        throw new Error(errorMessage(payload, response.status, "binding health failed"));
+        throw apiError(payload, response.status, "binding health failed");
     }
     return payload.data;
 }
@@ -583,7 +583,7 @@ export async function listDevices(baseUrl, accessToken) {
     });
     const payload = (await response.json().catch(() => null));
     if (!response.ok || !Array.isArray(payload?.data?.items)) {
-        throw new Error(errorMessage(payload, response.status, "device list failed"));
+        throw apiError(payload, response.status, "device list failed");
     }
     return payload.data.items;
 }

package/dist/lib/records/door.js

@@ -43,7 +43,7 @@ export async function resolveDoor(root, globals, projectFlag) {
 export class DoorRefusedError extends Error {
 }
 export async function postRecords(doorUrl, projectId, kind, rows) {
-    const auth = await ensureAccessToken(doorUrl).catch(() => null);
+    const auth = await ensureAccessToken().catch(() => null);
     if (!auth)
         throw new DoorRefusedError("this device is signed out");
     let response;

package/dist/lib/review/client.js

@@ -1,3 +1,4 @@
+import { apiError } from "../nustack_client.js";
 const REQUEST_TIMEOUT_MS = 10_000;
 export class ReviewUnreachableError extends Error {
     constructor(message) {
@@ -31,7 +32,7 @@ export function makeReviewClient(baseUrl, accessToken) {
             if (response.status === 401 || response.status === 403) {
                 throw new ReviewUnreachableError(errorMessage(payload, response.status, label));
             }
-            throw new Error(errorMessage(payload, response.status, label));
+            throw apiError(payload, response.status, label);
         }
         return payload?.data ?? null;
     }

package/dist/lib/session_telemetry.js

@@ -30,7 +30,7 @@ function defaultSeams() {
         restartService: () => restartService(),
         unregisterService: () => unregisterService(),
         fetchImpl: fetch,
-        ensureAccessToken: (baseUrl) => ensureAccessToken(baseUrl),
+        ensureAccessToken: () => ensureAccessToken(),
     };
 }
 function centralReloadContext(seams, configDir) {

package/dist/lib/sessions/client.js

@@ -1,9 +1,6 @@
 import { assertSafeOpaqueId } from "../guards.js";
+import { apiError } from "../nustack_client.js";
 const REQUEST_TIMEOUT_MS = 10_000;
-function errorMessage(payload, status, label) {
-    const enveloped = typeof payload?.error === "object" ? payload.error?.message : undefined;
-    return enveloped ?? `${label}: HTTP ${status}`;
-}
 export function makeSessionsClient(baseUrl, accessToken) {
     const headers = {
         Authorization: `Bearer ${accessToken}`,
@@ -18,7 +15,7 @@ export function makeSessionsClient(baseUrl, accessToken) {
         });
         const payload = (await response.json().catch(() => null));
         if (!response.ok || !payload?.data?.id) {
-            throw new Error(errorMessage(payload, response.status, label));
+            throw apiError(payload, response.status, label);
         }
         return { status: response.status, session: payload.data };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/nustack",
-  "version": "0.20.4",
+  "version": "0.21.0",
   "description": "The nustack CLI — bootstrap NuStack services into a repo via the NuStack discovery plane.",
   "type": "module",
   "private": false,