@gonovus-ai/spec-flow-cli 0.2.0 → 0.3.1

package/dist/cli.js

@@ -5,6 +5,7 @@ import { z } from "zod";
 import { addAuthenticationCommandTopology } from "./authentication-command-topology.js";
 import { registerGitHubAccountCommands } from "./github-account-commands.js";
 import { parseHttpOrigin, unresolvedSpecFlowApiOrigin, } from "./http-origin.js";
+import { registerProductMapCommands } from "./product-map-commands.js";
 import { specFlowCliUserAgent } from "./user-agent.js";
 import { registerUserApiKeyCommands } from "./user-api-key-commands.js";
 import { registerWorkItemAssetCommands } from "./work-item-asset-commands.js";
@@ -56,7 +57,7 @@ const findingReferenceSchema = z
 const findingTargetSchema = z
     .object({
     references: z.array(findingReferenceSchema).min(1).max(50),
-    specId: z.string().trim().toUpperCase().regex(/^[A-Z]{2,10}-[1-9]\d*$/u),
+    specId: z.string().trim().toUpperCase().regex(/^[A-Z]{2,10}-S[1-9]\d*$/u),
 })
     .strict();
 const findingEvidenceSchema = z.discriminatedUnion("kind", [
@@ -169,21 +170,37 @@ export async function runCli(arguments_, dependencies) {
     workspace
         .command("list")
         .action(async () => {
-        exitCode = await run((client) => client.GET("/v1/workspaces"), { rejectProjectReadToken: true });
+        exitCode = await run((client) => client.GET("/v1/workspaces"), { rejectWorkspaceReadToken: true });
     });
     workspace
         .command("create")
         .requiredOption("--name <name>")
+        .requiredOption("--prefix <prefix>", "Immutable Workspace number prefix, 2 to 10 uppercase letters")
+        .option("--spec-language <language>", "Workspace keyword language: zh-CN or en", (value) => z.enum(["zh-CN", "en"]).parse(value), "zh-CN")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
         exitCode = await run((client) => client.POST("/v1/workspaces", {
-            body: { name: options.name },
+            body: { name: options.name, prefix: options.prefix, specLanguage: options.specLanguage },
             params: { header: { "idempotency-key": idempotencyKey } },
-        }), { retryTransportOnce: true });
+        }), { retryTransportOnce: true, ambiguousOutcomeMessage: "Workspace creation outcome is unknown; run workspace list before trying a new command identity" });
+    });
+    workspace.command("rename").requiredOption("--workspace-id <workspaceId>").requiredOption("--name <name>").requiredOption("--expected-version <version>", "Observed Workspace settings version", parseOpaqueVersion).requiredOption("--idempotency-key <key>").action(async (options) => {
+        exitCode = await run(client => client.PATCH("/v1/workspaces/{workspaceId}/settings", { params: { path: { workspaceId: options.workspaceId }, header: { "idempotency-key": options.idempotencyKey, "if-match": options.expectedVersion } }, body: { name: options.name } }), { retryTransportOnce: true });
+    });
+    const workspaceSettings = workspace.command("settings");
+    workspaceSettings.command("read").requiredOption("--workspace-id <workspaceId>").action(async (options) => {
+        exitCode = await run(client => client.GET("/v1/workspaces/{workspaceId}/settings", { params: { path: options } }));
+    });
+    workspaceSettings.command("update").requiredOption("--workspace-id <workspaceId>").requiredOption("--spec-language <language>", "Workspace keyword language", (value) => z.enum(["zh-CN", "en"]).parse(value)).requiredOption("--expected-version <version>", "Observed Workspace settings version", parseOpaqueVersion).requiredOption("--idempotency-key <key>").action(async (options) => {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
+            exitCode = rejectTokenWrite(dependencies);
+            return;
+        }
+        exitCode = await run(client => client.PATCH("/v1/workspaces/{workspaceId}/settings", { params: { path: { workspaceId: options.workspaceId }, header: { "idempotency-key": options.idempotencyKey, "if-match": options.expectedVersion } }, body: { specLanguage: options.specLanguage } }), { retryTransportOnce: true });
     });
     const workspaceMember = workspace.command("member");
     workspaceMember
@@ -192,7 +209,7 @@ export async function runCli(arguments_, dependencies) {
         .action(async (options) => {
         exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/members", {
             params: { path: { workspaceId: options.workspaceId } },
-        }), { rejectProjectReadToken: true });
+        }), { rejectWorkspaceReadToken: true });
     });
     workspaceMember
         .command("search")
@@ -205,7 +222,7 @@ export async function runCli(arguments_, dependencies) {
                 path: { workspaceId: options.workspaceId },
                 query: { limit: options.limit, query: options.query },
             },
-        }), { rejectProjectReadToken: true });
+        }), { rejectWorkspaceReadToken: true });
     });
     workspaceMember
         .command("add")
@@ -214,7 +231,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--subject <subject>", "Authentik subject from `workspace member search`")
         .requiredOption("--role <role>", "Workspace Role name")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -238,7 +255,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--role <role>", "Workspace Role name")
         .requiredOption("--expected-version <version>", "Opaque Member version from `workspace member list`", parseOpaqueVersion)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -266,7 +283,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--user-id <userId>", "Member User ID from `workspace member list`")
         .requiredOption("--expected-version <version>", "Opaque Member version from `workspace member list`", parseOpaqueVersion)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -294,7 +311,7 @@ export async function runCli(arguments_, dependencies) {
         .action(async (options) => {
         exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/roles", {
             params: { path: { workspaceId: options.workspaceId } },
-        }), { rejectProjectReadToken: true });
+        }), { rejectWorkspaceReadToken: true });
     });
     workspaceRole
         .command("create")
@@ -302,7 +319,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--name <name>", "Custom Workspace Role name")
         .requiredOption("--statements <statements>", "JSON object mapping permission resources to granted actions", parseRoleStatements)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -322,7 +339,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--statements <statements>", "JSON object mapping permission resources to granted actions", parseRoleStatements)
         .requiredOption("--expected-version <version>", "Opaque Role version from `workspace role list`", parseOpaqueVersion)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -350,7 +367,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--name <name>", "Custom Workspace Role name")
         .requiredOption("--expected-version <version>", "Opaque Role version from `workspace role list`", parseOpaqueVersion)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -388,16 +405,14 @@ export async function runCli(arguments_, dependencies) {
                         : { workspaceId: options.workspaceId }),
                 },
             },
-        }), { rejectProjectReadToken: true });
+        }), { rejectWorkspaceReadToken: true });
     });
     project
         .command("create")
         .requiredOption("--name <name>")
-        .requiredOption("--project-id <projectId>", "Immutable Project ID (2-10 letters)", parseProjectId)
         .requiredOption("--workspace-id <workspaceId>", "Workspace ID returned by `workspace list` or `workspace create`")
-        .option("--spec-language <language>", "Spec Language: en or zh-CN (default: en)")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -405,11 +420,7 @@ export async function runCli(arguments_, dependencies) {
         exitCode = await run((client) => client.POST("/v1/projects", {
             body: {
                 name: options.name,
-                projectId: options.projectId,
                 workspaceId: options.workspaceId,
-                ...(options.specLanguage === undefined
-                    ? {}
-                    : { specLanguage: options.specLanguage }),
             },
             params: { header: { "idempotency-key": idempotencyKey } },
         }), { retryTransportOnce: true });
@@ -431,7 +442,7 @@ export async function runCli(arguments_, dependencies) {
                 },
             }), {
                 ambiguousOutcomeMessage: `Project ${operation} outcome is unknown; read Project context before retrying`,
-                rejectProjectReadToken: true,
+                rejectWorkspaceReadToken: true,
                 retryTransportOnce: true,
             });
         });
@@ -444,21 +455,13 @@ export async function runCli(arguments_, dependencies) {
             params: { path: { projectId: options.projectId } },
         }));
     });
-    project
-        .command("directory")
-        .requiredOption("--project-id <projectId>")
-        .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/spec-directory", {
-            params: { path: { projectId: options.projectId } },
-        }));
-    });
     const sharing = project.command("sharing").description("Manage anonymous task-only Project sharing");
     sharing.command("read")
         .requiredOption("--project-id <projectId>")
         .action(async (options) => {
         exitCode = await run((client) => client.GET("/v1/projects/{projectId}/sharing", {
             params: { path: { projectId: options.projectId } },
-        }), { rejectProjectReadToken: true });
+        }), { rejectWorkspaceReadToken: true });
     });
     sharing.command("set")
         .requiredOption("--project-id <projectId>")
@@ -474,42 +477,45 @@ export async function runCli(arguments_, dependencies) {
         return value;
     })
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         exitCode = await run((client) => client.PUT("/v1/projects/{projectId}/sharing", {
             body: { isPublic: options.public },
             params: { path: { projectId: options.projectId }, header: { "if-match": options.expectedVersion, "idempotency-key": options.idempotencyKey } },
-        }), { rejectProjectReadToken: true, retryTransportOnce: true, ambiguousOutcomeMessage: "Sharing outcome is unknown; reread project sharing and retry the same command key and intent" });
+        }), { rejectWorkspaceReadToken: true, retryTransportOnce: true, ambiguousOutcomeMessage: "Sharing outcome is unknown; reread project sharing and retry the same command key and intent" });
     });
     const spec = program.command("spec");
+    spec.command("list").requiredOption("--workspace-id <workspaceId>").option("--project-id <projectId>").option("--query <query>").option("--limit <limit>", "Maximum results", parseSearchLimit, 50).option("--cursor <cursor>").action(async (options) => {
+        exitCode = await run(client => client.GET("/v1/workspaces/{workspaceId}/spec-directory", { params: { path: { workspaceId: options.workspaceId }, query: { ...(options.projectId === undefined ? {} : { projectId: options.projectId }), ...(options.query === undefined ? {} : { query: options.query }), limit: options.limit, ...(options.cursor === undefined ? {} : { cursor: options.cursor }) } } }), { rejectWorkspaceReadToken: true });
+    });
     spec
         .command("read")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/specs/{specId}", {
+        exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/specs/{specId}", {
             params: { path: options },
-        }), { rejectProjectReadToken: true });
+        }), { rejectWorkspaceReadToken: true });
     });
     spec
         .command("changelog")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/specs/{specId}/changelog", { params: { path: options } }), { rejectProjectReadToken: true });
+        exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/specs/{specId}/changelog", { params: { path: options } }), { rejectWorkspaceReadToken: true });
     });
     spec
         .command("search")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--query <query>")
         .option("--limit <limit>", "Maximum results", parseSearchLimit, 20)
         .option("--cursor <cursor>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/spec-search", {
+        exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/spec-search", {
             params: {
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
                 query: {
                     ...(options.cursor === undefined
                         ? {}
@@ -522,33 +528,33 @@ export async function runCli(arguments_, dependencies) {
     });
     spec
         .command("current")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/specs/{specId}/current-revision", { params: { path: options } }));
+        exitCode = await run((client) => client.GET(hasWorkspaceReadToken(dependencies.environment) ? "/v1/workspaces/{workspaceId}/published/specs/{specId}/current-revision" : "/v1/workspaces/{workspaceId}/specs/{specId}/current-revision", { params: { path: options } }));
     });
     spec
         .command("revision")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .requiredOption("--revision-id <revisionId>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/specs/{specId}/revisions/{revisionId}", { params: { path: options } }));
+        exitCode = await run((client) => client.GET(hasWorkspaceReadToken(dependencies.environment) ? "/v1/workspaces/{workspaceId}/published/specs/{specId}/revisions/{revisionId}" : "/v1/workspaces/{workspaceId}/specs/{specId}/revisions/{revisionId}", { params: { path: options } }));
     });
     spec
         .command("edit")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .requiredOption("--content <content>")
         .option("--agent-revision <agentRevision>")
         .option("--agent-model <agentModel>")
         .option("--source-reference-ids <sourceReferenceIds>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
-        exitCode = await run((client) => client.PUT("/v1/projects/{projectId}/specs/{specId}/draft", {
+        exitCode = await run((client) => client.PUT("/v1/workspaces/{workspaceId}/specs/{specId}/draft", {
             body: {
                 content: options.content,
                 provenance: toAgentProvenance(options),
@@ -558,17 +564,17 @@ export async function runCli(arguments_, dependencies) {
     });
     spec
         .command("assign-scenario-ids")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .option("--agent-revision <agentRevision>")
         .option("--agent-model <agentModel>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/specs/{specId}/draft/scenario-ids", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/specs/{specId}/draft/scenario-ids", {
             body: { provenance: toAgentProvenance(options) },
             params: {
                 header: { "idempotency-key": idempotencyKey },
@@ -581,15 +587,15 @@ export async function runCli(arguments_, dependencies) {
     });
     spec
         .command("publish")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/specs/{specId}/publish", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/specs/{specId}/publish", {
             params: {
                 header: { "idempotency-key": idempotencyKey },
                 path: options,
@@ -601,18 +607,18 @@ export async function runCli(arguments_, dependencies) {
     });
     spec
         .command("create")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .option("--capability-id <capabilityId>")
         .requiredOption("--feature-name <featureName>")
         .option("--source-references <sourceReferences>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
         const sourceReferences = parseSourceReferences(options.sourceReferences ?? "[]");
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/specs", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/specs", {
             body: {
                 capabilityId: options.capabilityId ?? null,
                 featureName: options.featureName,
@@ -620,7 +626,7 @@ export async function runCli(arguments_, dependencies) {
             },
             params: {
                 header: { "idempotency-key": idempotencyKey },
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
             },
         }), {
             ambiguousOutcomeMessage: "Spec Creation outcome is unknown; inspect the Project directory before retrying",
@@ -629,13 +635,13 @@ export async function runCli(arguments_, dependencies) {
     });
     spec
         .command("update")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .option("--capability-id <capabilityId>")
         .option("--source-references <sourceReferences>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -646,7 +652,7 @@ export async function runCli(arguments_, dependencies) {
         const sourceReferences = options.sourceReferences === undefined
             ? undefined
             : parseSourceReferences(options.sourceReferences);
-        exitCode = await run((client) => client.PATCH("/v1/projects/{projectId}/specs/{specId}", {
+        exitCode = await run((client) => client.PATCH("/v1/workspaces/{workspaceId}/specs/{specId}", {
             body: {
                 ...(options.capabilityId === undefined
                     ? {}
@@ -663,16 +669,16 @@ export async function runCli(arguments_, dependencies) {
     });
     spec
         .command("draft")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/specs/{specId}/draft-session", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/specs/{specId}/draft-session", {
             params: {
                 header: {
                     "idempotency-key": idempotencyKey,
@@ -687,13 +693,13 @@ export async function runCli(arguments_, dependencies) {
     });
     spec
         .command("state")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .requiredOption("--state <state>", "Ready or Unavailable", parseSpecState)
         .option("--unavailability-reason <unavailabilityReason>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -705,7 +711,7 @@ export async function runCli(arguments_, dependencies) {
             options.unavailabilityReason !== undefined) {
             throw invalidArgument("Ready does not accept --unavailability-reason");
         }
-        exitCode = await run((client) => client.PATCH("/v1/projects/{projectId}/specs/{specId}/state", {
+        exitCode = await run((client) => client.PATCH("/v1/workspaces/{workspaceId}/specs/{specId}/state", {
             body: options.state === "Ready"
                 ? { state: "Ready" }
                 : {
@@ -720,16 +726,16 @@ export async function runCli(arguments_, dependencies) {
     });
     spec
         .command("rollback")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .requiredOption("--revision-id <revisionId>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/specs/{specId}/rollback", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/specs/{specId}/rollback", {
             body: { revisionId: options.revisionId },
             params: {
                 header: { "idempotency-key": idempotencyKey },
@@ -742,127 +748,131 @@ export async function runCli(arguments_, dependencies) {
     });
     spec
         .command("delete")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
-        exitCode = await run(async (client) => withSuccessData(await client.DELETE("/v1/projects/{projectId}/specs/{specId}", {
+        exitCode = await run(async (client) => withSuccessData(await client.DELETE("/v1/workspaces/{workspaceId}/specs/{specId}", {
             params: {
                 header: { "if-match": options.expectedVersion },
                 path: options,
             },
         }), { deleted: { specId: options.specId } }));
     });
-    const glossary = program.command("glossary");
-    glossary
+    const workspaceGlossary = workspace.command("glossary");
+    workspaceGlossary
         .command("revision")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--revision-id <revisionId>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/glossary/revisions/{revisionId}", { params: { path: options } }));
+        exitCode = await run((client) => client.GET(hasWorkspaceReadToken(dependencies.environment) ? "/v1/workspaces/{workspaceId}/published/glossary/revisions/{revisionId}" : "/v1/workspaces/{workspaceId}/glossary/revisions/{revisionId}", { params: { path: options } }));
     });
-    glossary
+    workspaceGlossary
         .command("read")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/glossary", {
-            params: { path: { projectId: options.projectId } },
-        }), { rejectProjectReadToken: true });
+        exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/glossary", {
+            params: { path: { workspaceId: options.workspaceId } },
+        }), { rejectWorkspaceReadToken: true });
     });
-    glossary
+    workspaceGlossary
         .command("changelog")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/glossary/changelog", {
-            params: { path: { projectId: options.projectId } },
-        }), { rejectProjectReadToken: true });
+        exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/glossary/changelog", {
+            params: { path: { workspaceId: options.workspaceId } },
+        }), { rejectWorkspaceReadToken: true });
     });
-    glossary
+    workspaceGlossary
         .command("draft")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/glossary/draft-session", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/glossary/draft-session", {
             params: {
                 header: { "idempotency-key": idempotencyKey },
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
             },
         }), {
             ambiguousOutcomeMessage: "Glossary Draft Session outcome is unknown; read the Glossary before retrying",
             retryTransportOnce: true,
         });
     });
-    glossary
+    workspaceGlossary
         .command("edit")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--entries <entries>")
         .option("--agent-revision <agentRevision>")
         .option("--agent-model <agentModel>")
         .option("--source-reference-ids <sourceReferenceIds>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const entries = parseGlossaryEntries(options.entries);
-        exitCode = await run((client) => client.PUT("/v1/projects/{projectId}/glossary/draft", {
+        exitCode = await run((client) => client.PUT("/v1/workspaces/{workspaceId}/glossary/draft", {
             body: { entries, provenance: toAgentProvenance(options) },
-            params: { path: { projectId: options.projectId } },
+            params: { path: { workspaceId: options.workspaceId } },
         }));
     });
-    glossary
+    workspaceGlossary
         .command("publish")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
+        .option("--entry-ids <entryIds...>", "Publish only the selected term changes")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/glossary/publish", {
-            body: {},
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/glossary/publish", {
+            body: options.entryIds === undefined ? {} : { entryIds: options.entryIds },
             params: {
                 header: { "idempotency-key": idempotencyKey },
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
             },
         }), {
             ambiguousOutcomeMessage: "Glossary Publish outcome is unknown; inspect the Glossary Changelog before retrying",
             retryTransportOnce: true,
         });
     });
-    glossary
+    workspaceGlossary
         .command("rollback")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--revision-id <revisionId>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/glossary/rollback", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/glossary/rollback", {
             body: { revisionId: options.revisionId },
             params: {
                 header: { "idempotency-key": idempotencyKey },
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
             },
         }), {
             ambiguousOutcomeMessage: "Glossary Rollback outcome is unknown; inspect the Glossary Changelog before retrying",
             retryTransportOnce: true,
         });
     });
+    workspace.command("context").requiredOption("--workspace-id <workspaceId>").action(async (options) => {
+        exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/knowledge-context", { params: { path: { workspaceId: options.workspaceId } } }), { rejectWorkspaceReadToken: true });
+    });
     const proposal = program.command("proposal");
     proposal
         .command("create-spec")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--spec-id <specId>")
         .requiredOption("--baseline-content <baselineContent>")
         .requiredOption("--proposed-content <proposedContent>")
@@ -870,12 +880,12 @@ export async function runCli(arguments_, dependencies) {
         .option("--agent-model <agentModel>")
         .option("--source-reference-ids <sourceReferenceIds>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/draft-proposals", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/draft-proposals", {
             body: {
                 baselineContent: options.baselineContent,
                 kind: "Spec",
@@ -885,7 +895,7 @@ export async function runCli(arguments_, dependencies) {
             },
             params: {
                 header: { "idempotency-key": idempotencyKey },
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
             },
         }), {
             ambiguousOutcomeMessage: "Draft Proposal Creation outcome is unknown; list open Proposals before retrying",
@@ -894,19 +904,19 @@ export async function runCli(arguments_, dependencies) {
     });
     proposal
         .command("create-glossary")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--baseline-entries <baselineEntries>")
         .requiredOption("--proposed-entries <proposedEntries>")
         .option("--agent-revision <agentRevision>")
         .option("--agent-model <agentModel>")
         .option("--source-reference-ids <sourceReferenceIds>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/draft-proposals", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/draft-proposals", {
             body: {
                 baselineEntries: parseGlossaryEntries(options.baselineEntries),
                 kind: "Glossary",
@@ -915,7 +925,7 @@ export async function runCli(arguments_, dependencies) {
             },
             params: {
                 header: { "idempotency-key": idempotencyKey },
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
             },
         }), {
             ambiguousOutcomeMessage: "Draft Proposal Creation outcome is unknown; list open Proposals before retrying",
@@ -924,7 +934,7 @@ export async function runCli(arguments_, dependencies) {
     });
     proposal
         .command("list")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .option("--target-kind <targetKind>", "Spec or Glossary", parseProposalTargetKind)
         .option("--spec-id <specId>")
         .option("--status <status>", "Open, Applied, or Discarded", parseProposalStatus)
@@ -933,9 +943,9 @@ export async function runCli(arguments_, dependencies) {
             (options.targetKind !== "Spec" && options.specId !== undefined)) {
             throw invalidArgument("--spec-id requires --target-kind Spec");
         }
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/draft-proposals", {
+        exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/draft-proposals", {
             params: {
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
                 query: {
                     ...(options.specId === undefined ? {} : { specId: options.specId }),
                     ...(options.status === undefined ? {} : { status: options.status }),
@@ -948,16 +958,16 @@ export async function runCli(arguments_, dependencies) {
     });
     proposal
         .command("apply")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--proposal-id <proposalId>")
         .option("--change-ids <changeIds>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/draft-proposals/{proposalId}/apply", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/draft-proposals/{proposalId}/apply", {
             body: {
                 changeIds: options.changeIds === undefined
                     ? null
@@ -966,7 +976,7 @@ export async function runCli(arguments_, dependencies) {
             params: {
                 header: { "idempotency-key": idempotencyKey },
                 path: {
-                    projectId: options.projectId,
+                    workspaceId: options.workspaceId,
                     proposalId: options.proposalId,
                 },
             },
@@ -977,19 +987,19 @@ export async function runCli(arguments_, dependencies) {
     });
     proposal
         .command("discard")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--proposal-id <proposalId>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/draft-proposals/{proposalId}/discard", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/draft-proposals/{proposalId}/discard", {
             params: {
                 header: { "idempotency-key": idempotencyKey },
                 path: {
-                    projectId: options.projectId,
+                    workspaceId: options.workspaceId,
                     proposalId: options.proposalId,
                 },
             },
@@ -1000,32 +1010,30 @@ export async function runCli(arguments_, dependencies) {
     });
     program
         .command("authoring-history")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/authoring-history", {
-            params: { path: { projectId: options.projectId } },
-        }));
+        exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/authoring-history", { params: { path: options } }));
     });
     const capability = program.command("capability");
     capability
         .command("create")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--name <name>")
         .option("--parent-id <parentId>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/capabilities", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/capabilities", {
             body: {
                 name: options.name,
                 parentId: options.parentId ?? null,
             },
             params: {
                 header: { "idempotency-key": idempotencyKey },
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
             },
         }), {
             ambiguousOutcomeMessage: "Capability Creation outcome is unknown; inspect the Project directory before retrying",
@@ -1034,14 +1042,14 @@ export async function runCli(arguments_, dependencies) {
     });
     capability
         .command("update")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--capability-id <capabilityId>")
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .option("--name <name>")
         .option("--parent-id <parentId>")
         .option("--move-to-root")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1053,7 +1061,7 @@ export async function runCli(arguments_, dependencies) {
             options.moveToRoot !== true) {
             throw invalidArgument("Capability update requires a change");
         }
-        exitCode = await run((client) => client.PATCH("/v1/projects/{projectId}/capabilities/{capabilityId}", {
+        exitCode = await run((client) => client.PATCH("/v1/workspaces/{workspaceId}/capabilities/{capabilityId}", {
             body: {
                 ...(options.name === undefined ? {} : { name: options.name }),
                 ...(options.moveToRoot === true
@@ -1071,71 +1079,60 @@ export async function runCli(arguments_, dependencies) {
     capability
         .command("delete")
         .option("--idempotency-key <key>", "Reuse this key when retrying the same deletion")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--capability-id <capabilityId>")
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = options.idempotencyKey ?? randomUUID();
-        exitCode = await run(async (client) => withSuccessData(await client.DELETE("/v1/projects/{projectId}/capabilities/{capabilityId}", {
+        exitCode = await run(async (client) => withSuccessData(await client.DELETE("/v1/workspaces/{workspaceId}/capabilities/{capabilityId}", {
             params: {
                 header: { "if-match": options.expectedVersion, "idempotency-key": idempotencyKey },
                 path: options,
             },
         }), { deleted: { capabilityId: options.capabilityId } }));
     });
-    const finding = program.command("finding");
-    finding
+    const workspaceFinding = workspace.command("finding");
+    workspaceFinding
         .command("list")
-        .requiredOption("--project-id <projectId>")
-        .requiredOption("--spec-id <specId>")
+        .requiredOption("--workspace-id <workspaceId>")
+        .option("--spec-id <specId>")
         .option("--status <status>", "Finding status", parseFindingStatus)
         .option("--limit <limit>", "Maximum results", parseSearchLimit, 20)
         .option("--cursor <cursor>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/specs/{specId}/findings", {
-            params: {
-                path: { projectId: options.projectId, specId: options.specId },
-                query: {
-                    ...(options.cursor === undefined
-                        ? {}
-                        : { cursor: options.cursor }),
-                    limit: options.limit,
-                    ...(options.status === undefined
-                        ? {}
-                        : { status: options.status }),
-                },
-            },
-        }), { rejectProjectReadToken: true });
+        exitCode = await run(client => options.specId === undefined
+            ? client.GET("/v1/workspaces/{workspaceId}/findings", { params: { path: { workspaceId: options.workspaceId }, query: { limit: options.limit, ...(options.cursor === undefined ? {} : { cursor: options.cursor }), ...(options.status === undefined ? {} : { status: options.status }) } } })
+            : client.GET("/v1/workspaces/{workspaceId}/specs/{specId}/findings", { params: { path: { workspaceId: options.workspaceId, specId: options.specId }, query: { limit: options.limit, ...(options.cursor === undefined ? {} : { cursor: options.cursor }), ...(options.status === undefined ? {} : { status: options.status }) } } }), { rejectWorkspaceReadToken: true });
     });
-    finding
+    workspaceFinding
         .command("read")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--finding-id <findingId>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/findings/{findingId}", {
+        exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/findings/{findingId}", {
             params: { path: options },
-        }), { rejectProjectReadToken: true });
+        }), { rejectWorkspaceReadToken: true });
     });
-    finding
+    workspaceFinding
         .command("create")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--input <input>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
         const input = parseFindingInput(options.input);
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/findings", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/findings", {
             body: input,
             params: {
                 header: { "idempotency-key": idempotencyKey },
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
             },
         }), {
             ambiguousOutcomeMessage: "Finding Creation outcome is unknown; inspect the Finding list before retrying",
@@ -1147,18 +1144,18 @@ export async function runCli(arguments_, dependencies) {
         ["dismiss", "Dismissed"],
         ["resolve", "Resolved"],
     ]) {
-        finding
+        workspaceFinding
             .command(commandName)
-            .requiredOption("--project-id <projectId>")
+            .requiredOption("--workspace-id <workspaceId>")
             .requiredOption("--finding-id <findingId>")
             .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
             .action(async (options) => {
-            if (hasProjectReadToken(dependencies.environment)) {
+            if (hasWorkspaceReadToken(dependencies.environment)) {
                 exitCode = rejectTokenWrite(dependencies);
                 return;
             }
             const idempotencyKey = randomUUID();
-            exitCode = await run((client) => client.PATCH("/v1/projects/{projectId}/findings/{findingId}/status", {
+            exitCode = await run((client) => client.PATCH("/v1/workspaces/{workspaceId}/findings/{findingId}/status", {
                 body: { status },
                 params: {
                     header: {
@@ -1173,10 +1170,39 @@ export async function runCli(arguments_, dependencies) {
             });
         });
     }
+    workspaceFinding.command("handler").requiredOption("--workspace-id <workspaceId>").requiredOption("--finding-id <findingId>").option("--user-id <userId>", "Workspace member; omit to clear the handler").requiredOption("--expected-version <expectedVersion>", "Opaque version", parseOpaqueVersion).requiredOption("--idempotency-key <key>").action(async (options) => {
+        exitCode = await run(client => client.PATCH("/v1/workspaces/{workspaceId}/findings/{findingId}/handler", { body: { handlerUserId: options.userId ?? null }, params: { path: options, header: { "idempotency-key": options.idempotencyKey, "if-match": options.expectedVersion } } }), { rejectWorkspaceReadToken: true });
+    });
+    workspaceFinding.command("follow-up").requiredOption("--workspace-id <workspaceId>").requiredOption("--finding-id <findingId>").requiredOption("--project-id <projectId>").requiredOption("--idempotency-key <key>").action(async (options) => {
+        exitCode = await run(client => client.POST("/v1/workspaces/{workspaceId}/findings/{findingId}/work-item", { body: { projectId: options.projectId }, params: { path: { workspaceId: options.workspaceId, findingId: options.findingId }, header: { "idempotency-key": options.idempotencyKey } } }), { rejectWorkspaceReadToken: true });
+    });
+    workspaceFinding.command("discussion").requiredOption("--workspace-id <workspaceId>").requiredOption("--finding-id <findingId>").action(async (options) => {
+        exitCode = await run(client => client.GET("/v1/workspaces/{workspaceId}/findings/{findingId}/discussion", { params: { path: options } }), { rejectWorkspaceReadToken: true });
+    });
+    workspaceFinding.command("comment").requiredOption("--workspace-id <workspaceId>").requiredOption("--finding-id <findingId>").requiredOption("--body <body>").option("--parent-id <parentId>").requiredOption("--idempotency-key <key>").action(async (options) => {
+        exitCode = await run(client => client.POST("/v1/workspaces/{workspaceId}/findings/{findingId}/discussion", { body: { body: options.body, parentId: options.parentId ?? null }, params: { path: options, header: { "idempotency-key": options.idempotencyKey } } }), { rejectWorkspaceReadToken: true });
+    });
+    const workspaceReview = workspace.command("review");
+    workspaceReview.command("request").requiredOption("--workspace-id <workspaceId>").requiredOption("--spec-id <specId>").option("--idempotency-key <key>").action(async (options) => {
+        exitCode = await run(client => client.POST("/v1/workspaces/{workspaceId}/specs/{specId}/reviews", { params: { path: options, header: { "idempotency-key": options.idempotencyKey ?? randomUUID() } } }), { rejectWorkspaceReadToken: true });
+    });
+    workspaceReview.command("history").requiredOption("--workspace-id <workspaceId>").action(async (options) => {
+        exitCode = await run(client => client.GET("/v1/workspaces/{workspaceId}/reviews", { params: { path: options } }), { rejectWorkspaceReadToken: true });
+    });
+    workspaceReview.command("read").requiredOption("--workspace-id <workspaceId>").requiredOption("--review-id <reviewId>").action(async (options) => {
+        exitCode = await run(client => client.GET("/v1/workspaces/{workspaceId}/reviews/{reviewId}", { params: { path: options } }), { rejectWorkspaceReadToken: true });
+    });
+    workspaceReview.command("plan").requiredOption("--workspace-id <workspaceId>").action(async (options) => {
+        exitCode = await run(client => client.GET("/v1/workspaces/{workspaceId}/review-schedule", { params: { path: options } }), { rejectWorkspaceReadToken: true });
+    });
+    workspaceReview.command("configure").requiredOption("--workspace-id <workspaceId>").requiredOption("--expected-version <expectedVersion>", "Opaque version", parseOpaqueVersion).requiredOption("--input <input>", "Review plan JSON").action(async (options) => {
+        const body = reviewPlanInputSchema.parse(JSON.parse(options.input));
+        exitCode = await run(client => client.PUT("/v1/workspaces/{workspaceId}/review-schedule", { body, params: { path: options, header: { "if-match": options.expectedVersion } } }), { rejectWorkspaceReadToken: true });
+    });
     const notification = program.command("notification").description("Read and manage your personal task notifications");
     notification.command("list").action(async () => {
-        if (hasProjectReadToken(dependencies.environment)) {
-            exitCode = rejectProjectReadTokenOperation(dependencies);
+        if (hasWorkspaceReadToken(dependencies.environment)) {
+            exitCode = rejectWorkspaceReadTokenOperation(dependencies);
             return;
         }
         exitCode = await run((client) => client.GET("/v1/notifications"));
@@ -1191,8 +1217,8 @@ export async function runCli(arguments_, dependencies) {
         throw invalidArgument("Notification target must be task or workspace"); return value; })
         .requiredOption("--idempotency-key <key>", "Reuse the same command key and inputs when retrying", parseNotificationUuid)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
-            exitCode = rejectProjectReadTokenOperation(dependencies);
+        if (hasWorkspaceReadToken(dependencies.environment)) {
+            exitCode = rejectWorkspaceReadTokenOperation(dependencies);
             return;
         }
         if ((options.relatedEntityId === undefined) !== (options.relatedEntityType === undefined))
@@ -1203,8 +1229,8 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--notification-id <id>", "Notification UUID returned by the list", parseNotificationUuid)
         .requiredOption("--idempotency-key <key>", "Reuse the same key when retrying", parseNotificationUuid)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
-            exitCode = rejectProjectReadTokenOperation(dependencies);
+        if (hasWorkspaceReadToken(dependencies.environment)) {
+            exitCode = rejectWorkspaceReadTokenOperation(dependencies);
             return;
         }
         exitCode = await run((client) => client.PATCH("/v1/notifications/{notificationId}/read", { params: { path: { notificationId: options.notificationId }, header: { "idempotency-key": options.idempotencyKey } } }), { retryTransportOnce: true, ambiguousOutcomeMessage: "Notification read outcome is unknown; retry with the same notification and command key" });
@@ -1212,8 +1238,8 @@ export async function runCli(arguments_, dependencies) {
     for (const action of ["read-all", "clear"]) {
         notification.command(action).requiredOption("--idempotency-key <key>", "Reuse the same key to avoid changing notifications that arrived after the first command", parseNotificationUuid)
             .action(async (options) => {
-            if (hasProjectReadToken(dependencies.environment)) {
-                exitCode = rejectProjectReadTokenOperation(dependencies);
+            if (hasWorkspaceReadToken(dependencies.environment)) {
+                exitCode = rejectWorkspaceReadTokenOperation(dependencies);
                 return;
             }
             const params = { header: { "idempotency-key": options.idempotencyKey } };
@@ -1222,8 +1248,8 @@ export async function runCli(arguments_, dependencies) {
     }
     const notificationPreferences = notification.command("preferences");
     notificationPreferences.command("get").action(async () => {
-        if (hasProjectReadToken(dependencies.environment)) {
-            exitCode = rejectProjectReadTokenOperation(dependencies);
+        if (hasWorkspaceReadToken(dependencies.environment)) {
+            exitCode = rejectWorkspaceReadTokenOperation(dependencies);
             return;
         }
         exitCode = await run((client) => client.GET("/v1/notification-preferences"));
@@ -1233,15 +1259,16 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--preferences <json>", "JSON category settings; omitted settings remain unchanged", parseNotificationPreferences)
         .requiredOption("--idempotency-key <key>", "Reuse the same key and settings when retrying", parseNotificationUuid)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
-            exitCode = rejectProjectReadTokenOperation(dependencies);
+        if (hasWorkspaceReadToken(dependencies.environment)) {
+            exitCode = rejectWorkspaceReadTokenOperation(dependencies);
             return;
         }
         exitCode = await run((client) => client.PATCH("/v1/notification-preferences", { body: options.preferences, params: { header: { "idempotency-key": options.idempotencyKey, "if-match": options.expectedVersion } } }), { retryTransportOnce: true, ambiguousOutcomeMessage: "Notification preference outcome is unknown; retry with the same settings and command key" });
     });
     const workItem = program.command("work-item");
     registerWorkItemAssetCommands(workItem, { dependencies, run, setExitCode: (value) => { exitCode = value; }, rejectWrite: () => rejectTokenWrite(dependencies) });
-    registerWorkItemResourceLinkCommands(workItem, spec, { run, setExitCode: (value) => { exitCode = value; }, canWrite: () => !hasProjectReadToken(dependencies.environment), rejectWrite: () => rejectTokenWrite(dependencies), parseOpaqueVersion, parseLimit: parseSearchLimit });
+    registerProductMapCommands(program, { run, setExitCode: value => { exitCode = value; }, canWrite: () => !hasWorkspaceReadToken(dependencies.environment), rejectWrite: () => rejectTokenWrite(dependencies), parseOpaqueVersion });
+    registerWorkItemResourceLinkCommands(workItem, spec, { run, setExitCode: (value) => { exitCode = value; }, canWrite: () => !hasWorkspaceReadToken(dependencies.environment), rejectWrite: () => rejectTokenWrite(dependencies), parseOpaqueVersion, parseLimit: parseSearchLimit });
     const timeEntry = workItem.command("time-entry").description("Record and read task time entries");
     timeEntry.command("list")
         .requiredOption("--project-id <projectId>")
@@ -1299,7 +1326,7 @@ export async function runCli(arguments_, dependencies) {
                 throw invalidArgument("Time Entry ID must be a UUID");
             } }).requiredOption("--expected-version <version>", "Opaque version returned by SpecFlow", parseOpaqueVersion);
         command.action(async (options) => {
-            if (hasProjectReadToken(dependencies.environment)) {
+            if (hasWorkspaceReadToken(dependencies.environment)) {
                 exitCode = rejectTokenWrite(dependencies);
                 return;
             }
@@ -1344,7 +1371,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--content <markdown>", "Markdown comment body, up to 20000 characters", parseCommentContent)
         .requiredOption("--idempotency-key <key>", "Reuse the same key and inputs when retrying", parseCommentCommandKey)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1361,7 +1388,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--expected-version <version>", "Opaque comment version returned by SpecFlow", parseOpaqueVersion)
         .requiredOption("--idempotency-key <key>", "Reuse the same key and inputs when retrying", parseCommentCommandKey)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1378,7 +1405,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--expected-version <version>", "Opaque comment version returned by SpecFlow", parseOpaqueVersion)
         .requiredOption("--idempotency-key <key>", "Reuse the same key and inputs when retrying", parseCommentCommandKey)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1407,7 +1434,7 @@ export async function runCli(arguments_, dependencies) {
     })
         .requiredOption("--idempotency-key <key>", "Reuse the same key and inputs when retrying", parseRelationCommandKey)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1428,7 +1455,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--expected-version <expectedVersion>", "Opaque relation version returned by SpecFlow", parseOpaqueVersion)
         .requiredOption("--idempotency-key <key>", "Reuse the same key and inputs when retrying", parseRelationCommandKey)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1494,7 +1521,7 @@ export async function runCli(arguments_, dependencies) {
         .option("--due-date <dueDate>", "ISO 8601 date", parseWorkItemDate)
         .option("--status <status>", "Workflow Column slug or virtual status to create the Work Item in")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1550,7 +1577,7 @@ export async function runCli(arguments_, dependencies) {
         .option("--clear-start-date", "Remove the Work Item start date")
         .option("--clear-due-date", "Remove the Work Item due date")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1622,7 +1649,7 @@ export async function runCli(arguments_, dependencies) {
         .option("--assignee <assignee>", "Workspace member User ID")
         .option("--unassign", "Remove the Work Item assignee")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1658,7 +1685,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--work-item-id <workItemId>")
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1693,7 +1720,7 @@ export async function runCli(arguments_, dependencies) {
         .command("bulk")
         .requiredOption("--project-id <projectId>")
         .requiredOption("--action <action>", `Bulk action: ${workItemBulkActions.join(", ")}`, parseWorkItemBulkAction)
-        .requiredOption("--target <id@version>", "Target Work Item ID with its observed version, e.g. PAY-1@3; repeat for several Projects in the same Workspace", parseWorkItemBulkTarget, [])
+        .requiredOption("--target <[projectId/]id@version>", "Target with its observed version, e.g. PAY-1@3 or project-id/PAY-2@4; repeat within the same Workspace", parseWorkItemBulkTarget, [])
         .option("--status <status>", "Destination Workflow Column slug or virtual status (updateStatus)")
         .option("--priority <priority>", "Priority (updatePriority)", parseWorkItemPriority)
         .option("--assignee <assignee>", "Assignee User ID (updateAssignee)")
@@ -1703,7 +1730,7 @@ export async function runCli(arguments_, dependencies) {
         .option("--clear-due-date", "Clear the due date (updateDueDate)")
         .description("Apply one action to several Work Items, which may span Projects inside the same Workspace")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1758,6 +1785,7 @@ export async function runCli(arguments_, dependencies) {
                     : {}),
                 workItems: options.target.map((target) => ({
                     id: target.id,
+                    ...(target.projectId === undefined ? {} : { projectId: target.projectId }),
                     version: target.expectedVersion,
                 })),
             },
@@ -1777,7 +1805,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--file <path>", "JSON task file, at most 1 MiB and 1000 tasks")
         .requiredOption("--idempotency-key <key>", "Reuse this key with the same file when retrying")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1832,7 +1860,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .option("--destination-status <status>", "Destination Workflow Column slug; defaults to the matching or first column")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1859,7 +1887,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--status <status>", "Destination Workflow Column slug or virtual status")
         .option("--position <position>", "Board index inside the destination column", parseBoardPosition)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1893,7 +1921,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .description("Move a Work Item into the Project's first final Workflow Column")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1964,7 +1992,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--color <color>")
         .option("--work-item-id <workItemId>", "Create the label directly on the named Work Item instead of the Workspace definition")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -1994,7 +2022,7 @@ export async function runCli(arguments_, dependencies) {
         .option("--name <name>")
         .option("--color <color>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2031,7 +2059,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .description("Delete a Work Item Label; a Workspace definition's task-copy cascade resumes automatically across bounded batches")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2081,7 +2109,7 @@ export async function runCli(arguments_, dependencies) {
         .option("--expected-version <expectedVersion>", "Opaque version of the task copy being moved; required when the Label is already attached elsewhere", parseOpaqueVersion)
         .description("Attach a Work Item Label to a Work Item as a task-level copy")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2113,7 +2141,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow for the attached copy", parseOpaqueVersion)
         .description("Detach a Work Item Label copy from a Work Item")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2153,7 +2181,7 @@ export async function runCli(arguments_, dependencies) {
         .option("--default-value <defaultValue>")
         .option("--required", "Reject Work Items that leave the field blank")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2188,7 +2216,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .description("Delete a Work Item Custom Field; its stored values cascade with the definition")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2214,7 +2242,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--project-id <projectId>")
         .requiredOption("--order <order>", "Comma-separated id@version pairs in display order — version is the integer inside the field's opaque \"N\" version")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2263,7 +2291,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--expected-version <version>", "The opaque Work Item version returned by SpecFlow")
         .requiredOption("--value <value>", "Stored value; an empty string clears a non-required field")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2304,7 +2332,7 @@ export async function runCli(arguments_, dependencies) {
         .option("--color <color>", "Column color")
         .option("--final", "Mark the column as an explicit completion lane")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2342,7 +2370,7 @@ export async function runCli(arguments_, dependencies) {
         .option("--final", "Mark the column as an explicit completion lane")
         .option("--not-final", "Remove the column's completion marker")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2407,7 +2435,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--column-slug <columnSlug>")
         .requiredOption("--expected-version <expectedVersion>", "Opaque version returned by SpecFlow", parseOpaqueVersion)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2433,7 +2461,7 @@ export async function runCli(arguments_, dependencies) {
         .requiredOption("--project-id <projectId>")
         .requiredOption("--order <order>", "Comma-separated slug@version pairs in board order — version is the integer inside the column's opaque \"N\" version")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
@@ -2453,82 +2481,52 @@ export async function runCli(arguments_, dependencies) {
     const token = program.command("token");
     token
         .command("issue")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--name <name>")
         .option("--expires-at <expiresAt>", "ISO 8601 expiry date-time", parseIsoDateTime)
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
         const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/read-tokens", {
+        exitCode = await run((client) => client.POST("/v1/workspaces/{workspaceId}/read-tokens", {
             body: {
                 expiresAt: options.expiresAt ?? null,
                 name: options.name,
             },
             params: {
                 header: { "idempotency-key": idempotencyKey },
-                path: { projectId: options.projectId },
+                path: { workspaceId: options.workspaceId },
             },
         }), {
-            ambiguousOutcomeMessage: "Project Read Token issuance outcome is unknown; list tokens before retrying",
+            ambiguousOutcomeMessage: "Workspace read-only Token issuance outcome is unknown; list tokens before retrying",
             retryTransportOnce: true,
-            validateSuccess: validateIssuedProjectReadToken,
+            validateSuccess: validateIssuedWorkspaceReadToken,
         });
     });
     token
         .command("list")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/read-tokens", {
-            params: { path: { projectId: options.projectId } },
-        }), { rejectProjectReadToken: true });
+        exitCode = await run((client) => client.GET("/v1/workspaces/{workspaceId}/read-tokens", {
+            params: { path: { workspaceId: options.workspaceId } },
+        }), { rejectWorkspaceReadToken: true });
     });
     token
         .command("revoke")
-        .requiredOption("--project-id <projectId>")
+        .requiredOption("--workspace-id <workspaceId>")
         .requiredOption("--token-id <tokenId>")
         .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
+        if (hasWorkspaceReadToken(dependencies.environment)) {
             exitCode = rejectTokenWrite(dependencies);
             return;
         }
-        exitCode = await run(async (client) => withSuccessData(await client.DELETE("/v1/projects/{projectId}/read-tokens/{tokenId}", { params: { path: options } }), { revoked: { tokenId: options.tokenId } }), {
-            ambiguousOutcomeMessage: "Project Read Token revocation outcome is unknown; list tokens before retrying",
+        exitCode = await run(async (client) => withSuccessData(await client.DELETE("/v1/workspaces/{workspaceId}/read-tokens/{tokenId}", { params: { path: options } }), { revoked: { tokenId: options.tokenId } }), {
+            ambiguousOutcomeMessage: "Workspace read-only Token revocation outcome is unknown; list tokens before retrying",
             retryTransportOnce: true,
         });
     });
-    const review = program.command("review");
-    review
-        .command("request")
-        .requiredOption("--project-id <projectId>")
-        .requiredOption("--spec-id <specId>")
-        .action(async (options) => {
-        if (hasProjectReadToken(dependencies.environment)) {
-            exitCode = rejectTokenWrite(dependencies);
-            return;
-        }
-        const idempotencyKey = randomUUID();
-        exitCode = await run((client) => client.POST("/v1/projects/{projectId}/specs/{specId}/reviews", {
-            params: {
-                header: { "idempotency-key": idempotencyKey },
-                path: options,
-            },
-        }), {
-            ambiguousOutcomeMessage: "Manual Review request outcome is unknown; inspect Review Records before retrying",
-            retryTransportOnce: true,
-        });
-    });
-    review
-        .command("read")
-        .requiredOption("--project-id <projectId>")
-        .requiredOption("--review-id <reviewId>")
-        .action(async (options) => {
-        exitCode = await run((client) => client.GET("/v1/projects/{projectId}/reviews/{reviewId}", {
-            params: { path: options },
-        }), { rejectProjectReadToken: true });
-    });
     try {
         await program.parseAsync([...arguments_], { from: "user" });
         return exitCode;
@@ -2539,7 +2537,8 @@ export async function runCli(arguments_, dependencies) {
                 return cause.exitCode;
             }
             writeSkillError(dependencies, {
-                message: "The command does not match the supported CLI contract",
+                message: cause.message.replace(/'[^']*'/gu, (quoted) => /^'--?[a-z][a-z-]*(?: [<[][^>\]]+[>\]])?'$/u.test(quoted) ? quoted : "'<redacted>'").replace(/[\r\n]/gu, " ").slice(0, 500),
+                code: "INVALID_CLI_INPUT",
                 reason: "Invalid Operation",
                 retryable: false,
             });
@@ -2549,15 +2548,19 @@ export async function runCli(arguments_, dependencies) {
     }
 }
 async function executeRequest(dependencies, request, options = {}, serverFlag, apiKeyIdFlag) {
-    const environmentCredential = dependencies.environment.SPEC_FLOW_PROJECT_READ_TOKEN;
+    if (dependencies.environment.SPEC_FLOW_PROJECT_READ_TOKEN !== undefined) {
+        writeSkillError(dependencies, { message: "Project Read Tokens are retired; use a Workspace read-only Token", reason: "Authentication Failed", retryable: false });
+        return 2;
+    }
+    const environmentCredential = dependencies.environment.SPEC_FLOW_WORKSPACE_READ_TOKEN;
     const apiKeyEnvironment = dependencies.environment.SPEC_FLOW_API_KEY;
     const usesApiKey = apiKeyEnvironment !== undefined || apiKeyIdFlag !== undefined;
-    if (options.requireUserSession === true && (usesApiKey || hasProjectReadToken(dependencies.environment))) {
+    if (options.requireUserSession === true && (usesApiKey || hasWorkspaceReadToken(dependencies.environment))) {
         writeSkillError(dependencies, { message: "A User Session is required for account management", reason: "Permission Denied", retryable: false });
         return 3;
     }
-    if ((apiKeyEnvironment !== undefined && apiKeyIdFlag !== undefined) || (usesApiKey && hasProjectReadToken(dependencies.environment))) {
-        writeSkillError(dependencies, { message: "Select exactly one API Key or Project Read Token credential", reason: "Invalid Operation", retryable: false });
+    if ((apiKeyEnvironment !== undefined && apiKeyIdFlag !== undefined) || (usesApiKey && hasWorkspaceReadToken(dependencies.environment))) {
+        writeSkillError(dependencies, { message: "Select exactly one API Key or Workspace read-only Token credential", reason: "Invalid Operation", retryable: false });
         return 2;
     }
     if (apiKeyIdFlag !== undefined && !z.uuid().safeParse(apiKeyIdFlag).success) {
@@ -2568,9 +2571,9 @@ async function executeRequest(dependencies, request, options = {}, serverFlag, a
         writeSkillError(dependencies, { message: "SPEC_FLOW_API_KEY does not contain a User API Key", reason: "Authentication Failed", retryable: false });
         return 2;
     }
-    if (options.rejectProjectReadToken === true &&
-        hasProjectReadToken(dependencies.environment)) {
-        return rejectProjectReadTokenOperation(dependencies);
+    if (options.rejectWorkspaceReadToken === true &&
+        hasWorkspaceReadToken(dependencies.environment)) {
+        return rejectWorkspaceReadTokenOperation(dependencies);
     }
     const baseUrl = resolveApiOrigin(dependencies, serverFlag);
     if (baseUrl === null) {
@@ -2586,8 +2589,7 @@ async function executeRequest(dependencies, request, options = {}, serverFlag, a
             credential = await dependencies.credentialStore.readApiKey(apiKeyIdFlag.toLowerCase());
         }
         else {
-            credential = environmentCredential === undefined || environmentCredential.trim().length === 0
-                ? await dependencies.credentialStore.read() : environmentCredential;
+            credential = environmentCredential ?? await dependencies.credentialStore.read();
         }
     }
     catch {
@@ -2600,7 +2602,7 @@ async function executeRequest(dependencies, request, options = {}, serverFlag, a
     }
     if (credential === null || credential.trim().length === 0) {
         writeSkillError(dependencies, {
-            message: "An authenticated CLI Session, User API Key or Project Read Token is required",
+            message: "An authenticated CLI Session, User API Key or Workspace read-only Token is required",
             reason: "Authentication Failed",
             retryable: false,
         });
@@ -2663,18 +2665,19 @@ function retryTransportOnce(fetch) {
 function ambiguousMutationError(message) {
     return {
         message: message ??
-            "Project creation outcome is unknown; run project list before trying a new create",
+            "Write outcome is unknown; read the target resource before trying a new command identity",
+        code: "EXECUTION_OUTCOME_UNKNOWN",
         reason: "Temporary Failure",
         retryable: false,
     };
 }
-function validateIssuedProjectReadToken(data) {
+function validateIssuedWorkspaceReadToken(data) {
     if (typeof data === "object" &&
         data !== null &&
         "credential" in data &&
         data.credential === null) {
         return {
-            message: "Project Read Token issuance completed, but its credential cannot be recovered; list or revoke the token before deliberately issuing another",
+            message: "Workspace read-only Token issuance completed, but its credential cannot be recovered; list or revoke the token before deliberately issuing another",
             reason: "Temporary Failure",
             retryable: false,
         };
@@ -2726,18 +2729,17 @@ function parseProjectStatus(value) {
     throw new CommanderError(1, "commander.invalidArgument", "Project status must be Active, Archived, or Trashed");
 }
 function parseProjectId(value) {
-    const normalized = value.trim().toUpperCase();
-    if (/^[A-Z]{2,10}$/u.test(normalized)) {
+    const normalized = value.trim();
+    if (/^[A-Za-z0-9_-]{1,200}$/u.test(normalized))
         return normalized;
-    }
-    throw invalidArgument("Project ID must contain 2-10 letters");
+    throw invalidArgument("Project ID must be the system identity returned by Project discovery");
 }
 function parseSpecId(value) {
     const normalized = value.trim().toUpperCase();
-    if (/^[A-Z]{2,10}-[1-9]\d*$/u.test(normalized)) {
+    if (/^[A-Z]{2,10}-S[1-9]\d*$/u.test(normalized)) {
         return normalized;
     }
-    throw invalidArgument("Spec ID must be a Project ID followed by a positive number");
+    throw invalidArgument("Spec ID must have the Workspace prefix, S marker and positive number");
 }
 function parseWorkItemId(value) {
     const normalized = value.trim().toUpperCase();
@@ -2826,6 +2828,7 @@ function workItemSelectionQuery(options) {
         ...(options.priority.length === 0
             ? {}
             : { priority: options.priority.join(",") }),
+        ...(options.repositoryConnectionId === undefined ? {} : { repositoryConnectionId: options.repositoryConnectionId }),
         ...(options.search === undefined ? {} : { search: options.search }),
         ...(options.sort === undefined ? {} : { sortBy: options.sort }),
         ...(options.order === undefined ? {} : { sortOrder: options.order }),
@@ -2859,6 +2862,7 @@ function workItemSelectionFlags(command) {
         ...previous,
         parseWorkItemPriority(value),
     ], [])
+        .option("--repository-connection-id <id>", "Filter by an explicit GitHub repository connection")
         .option("--search <search>", "Filter by title search text")
         .option("--sort <field>", "Sort by field", parseWorkItemSortField)
         .option("--order <order>", "Sort order", parseWorkItemSortOrder)
@@ -2873,12 +2877,16 @@ function parseWorkItemBulkAction(value) {
     throw invalidArgument(`Bulk action must be ${workItemBulkActions.join(", ")}`);
 }
 /**
- * A bulk target is `WORKITEM@version` — the public id and its observed
- * version, echoed back as the `"N"` precondition each item carries.
+ * Targets default to the route Project; an explicit `projectId/` selects
+ * another owner without inferring Project identity from Workspace numbering.
  */
 function parseWorkItemBulkTarget(value, previous) {
-    const [id, version, extra] = value.split("@");
-    if (id === undefined ||
+    const [identity, version, extra] = value.split("@");
+    const segments = identity?.split("/") ?? [];
+    const id = segments.length === 2 ? segments[1] : segments[0];
+    const projectId = segments.length === 2 ? parseProjectId(segments[0] ?? "") : undefined;
+    if (segments.length > 2 ||
+        id === undefined ||
         version === undefined ||
         extra !== undefined ||
         !/^[A-Z]{2,10}-[1-9]\d*$/u.test(id.trim().toUpperCase()) ||
@@ -2892,7 +2900,7 @@ function parseWorkItemBulkTarget(value, previous) {
     }
     return [
         ...previous,
-        { expectedVersion: `"${version}"`, id: id.trim().toUpperCase() },
+        { expectedVersion: `"${version}"`, id: id.trim().toUpperCase(), ...(projectId === undefined ? {} : { projectId }) },
     ];
 }
 function parseBoardPosition(value) {
@@ -3140,9 +3148,9 @@ function isWorkItemLabelDeletionPending(data) {
             undefined);
 }
 function rejectTokenWrite(dependencies) {
-    if (hasProjectReadToken(dependencies.environment)) {
+    if (hasWorkspaceReadToken(dependencies.environment)) {
         writeSkillError(dependencies, {
-            message: "Project Read Token does not permit write operations",
+            message: "Workspace read-only Token does not permit write operations",
             reason: "Permission Denied",
             retryable: false,
         });
@@ -3155,32 +3163,39 @@ function rejectTokenWrite(dependencies) {
     });
     return 2;
 }
-function rejectProjectReadTokenOperation(dependencies) {
+function rejectWorkspaceReadTokenOperation(dependencies) {
     writeSkillError(dependencies, {
-        message: "Project Read Token does not permit this operation",
+        message: "Workspace read-only Token does not permit this operation",
         reason: "Permission Denied",
         retryable: false,
     });
     return 3;
 }
-function hasProjectReadToken(environment) {
-    const credential = environment.SPEC_FLOW_PROJECT_READ_TOKEN;
+function hasWorkspaceReadToken(environment) {
+    const credential = environment.SPEC_FLOW_WORKSPACE_READ_TOKEN;
     return credential !== undefined && credential.trim().length > 0;
 }
 function mapHttpFailure(response, payload) {
+    const failure = classifyHttpFailure(response, payload);
+    const issues = z.array(z.object({ location: z.enum(["body", "query", "path", "headers", "tool"]), path: z.array(z.union([z.string().max(100), z.number()])), rule: z.string().max(100), message: z.string().max(500) })).max(20).safeParse(z.object({ issues: z.unknown() }).safeParse(payload).data?.issues);
+    const code = readServerCode(payload);
+    const requestId = response.headers.get("x-request-id");
+    return { ...failure, ...(requestId !== null && /^[A-Za-z0-9._:-]{1,100}$/u.test(requestId) ? { requestId } : {}), status: response.status, ...(code !== null && /^[A-Z][A-Z0-9_]{0,79}$/u.test(code) ? { code } : {}), ...(issues.success ? { issues: issues.data } : {}) };
+}
+function classifyHttpFailure(response, payload) {
     const { status } = response;
     const serverMessage = readServerMessage(payload);
     const serverCode = readServerCode(payload);
     if (status === 401) {
         return {
-            message: serverMessage ?? "Project Read Token is invalid, expired, or revoked",
+            message: serverMessage ?? "Workspace read-only Token is invalid, expired, or revoked",
             reason: "Authentication Failed",
             retryable: false,
         };
     }
     if (status === 403) {
         return {
-            message: serverMessage ?? "Project Read Token does not permit this operation",
+            message: serverMessage ?? "Workspace read-only Token does not permit this operation",
             reason: "Permission Denied",
             retryable: false,
         };
@@ -3206,7 +3221,7 @@ function mapHttpFailure(response, payload) {
             retryable: false,
         };
     }
-    if (status === 400 || status === 409 || status === 422) {
+    if (status === 400 || status === 409 || status === 413 || status === 422 || status === 428) {
         const diagnostics = readServerDiagnostics(payload);
         return {
             ...(diagnostics === undefined ? {} : { diagnostics }),
@@ -3336,4 +3351,5 @@ function parseNotificationPreferences(value) {
     const data = result.data;
     return { ...(data.taskAssignmentEnabled === undefined ? {} : { taskAssignmentEnabled: data.taskAssignmentEnabled }), ...(data.taskCommentEnabled === undefined ? {} : { taskCommentEnabled: data.taskCommentEnabled }), ...(data.taskStatusChangeEnabled === undefined ? {} : { taskStatusChangeEnabled: data.taskStatusChangeEnabled }), ...(data.dueDateReminderEnabled === undefined ? {} : { dueDateReminderEnabled: data.dueDateReminderEnabled }), ...(data.dueDateReminderMinutes === undefined ? {} : { dueDateReminderMinutes: data.dueDateReminderMinutes }) };
 }
+const reviewPlanInputSchema = z.discriminatedUnion("cadence", [z.object({ cadence: z.literal("Disabled") }).strict(), z.object({ cadence: z.literal("Daily"), timeOfDay: z.string(), timeZone: z.string() }).strict(), z.object({ cadence: z.literal("Weekly"), dayOfWeek: z.number().int().min(1).max(7), timeOfDay: z.string(), timeZone: z.string() }).strict()]);
 //# sourceMappingURL=cli.js.map