@workflow-code/cli 0.1.1 → 0.1.3

package/dist/workspace-MLJHPOLS.js

@@ -0,0 +1,2501 @@
+#!/usr/bin/env node
+import {
+  __commonJS,
+  __toESM,
+  getCurrentLocale,
+  i18n,
+  prepareCliInvocation,
+  translateWorkflowCodeError
+} from "./chunk-ONAQ5F5R.js";
+
+// ../../node_modules/.pnpm/ignore@7.0.6/node_modules/ignore/index.js
+var require_ignore = __commonJS({
+  "../../node_modules/.pnpm/ignore@7.0.6/node_modules/ignore/index.js"(exports, module) {
+    "use strict";
+    function makeArray(subject) {
+      return Array.isArray(subject) ? subject : [subject];
+    }
+    var UNDEFINED = void 0;
+    var EMPTY = "";
+    var SPACE = " ";
+    var ESCAPE = "\\";
+    var REGEX_TEST_BLANK_LINE = /^\s+$/;
+    var REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/;
+    var REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/;
+    var REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/;
+    var REGEX_SPLITALL_CRLF = /\r?\n/g;
+    var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
+    var REGEX_TEST_TRAILING_SLASH = /\/$/;
+    var SLASH = "/";
+    var TMP_KEY_IGNORE = "node-ignore";
+    if (typeof Symbol !== "undefined") {
+      TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
+    }
+    var KEY_IGNORE = TMP_KEY_IGNORE;
+    var define = (object, key, value) => {
+      Object.defineProperty(object, key, { value });
+      return value;
+    };
+    var REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g;
+    var RETURN_FALSE = () => false;
+    var sanitizeRange = (range) => range.replace(
+      REGEX_REGEXP_RANGE,
+      (match, from, to) => from.charCodeAt(0) <= to.charCodeAt(0) ? match : EMPTY
+    );
+    var negateRange = (range) => range.startsWith("!") || range.startsWith("\\^") ? `^${range.slice(range[0] === "!" ? 1 : 2)}` : range;
+    var cleanRangeBackSlash = (slashes) => {
+      const { length } = slashes;
+      return slashes.slice(0, length - length % 2);
+    };
+    var REPLACERS = [
+      [
+        // Remove BOM
+        // TODO:
+        // Other similar zero-width characters?
+        /^\uFEFF/,
+        () => EMPTY
+      ],
+      // > Trailing spaces are ignored unless they are quoted with backslash ("\")
+      [
+        // (a\ ) -> (a )
+        // (a  ) -> (a)
+        // (a ) -> (a)
+        // (a \ ) -> (a  )
+        /((?:\\\\)*?)(\\?\s+)$/,
+        (_, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY)
+      ],
+      // Replace (\ ) with ' '
+      // (\ ) -> ' '
+      // (\\ ) -> '\\ '
+      // (\\\ ) -> '\\ '
+      [
+        /(\\+?)\s/g,
+        (_, m1) => {
+          const { length } = m1;
+          return m1.slice(0, length - length % 2) + SPACE;
+        }
+      ],
+      // Escape metacharacters
+      // which is written down by users but means special for regular expressions.
+      // > There are 12 characters with special meanings:
+      // > - the backslash \,
+      // > - the caret ^,
+      // > - the dollar sign $,
+      // > - the period or dot .,
+      // > - the vertical bar or pipe symbol |,
+      // > - the question mark ?,
+      // > - the asterisk or star *,
+      // > - the plus sign +,
+      // > - the opening parenthesis (,
+      // > - the closing parenthesis ),
+      // > - and the opening square bracket [,
+      // > - the opening curly brace {,
+      // > These special characters are often called "metacharacters".
+      [
+        /[\\$.|*+(){^]/g,
+        (match) => `\\${match}`
+      ],
+      [
+        // > a question mark (?) matches a single character
+        /(?!\\)\?/g,
+        () => "[^/]"
+      ],
+      // leading slash
+      [
+        // > A leading slash matches the beginning of the pathname.
+        // > For example, "/*.c" matches "cat-file.c" but not "mozilla-sha1/sha1.c".
+        // A leading slash matches the beginning of the pathname
+        /^\//,
+        () => "^"
+      ],
+      // replace special metacharacter slash after the leading slash
+      [
+        /\//g,
+        () => "\\/"
+      ],
+      [
+        // > A leading "**" followed by a slash means match in all directories.
+        // > For example, "**/foo" matches file or directory "foo" anywhere,
+        // > the same as pattern "foo".
+        // > "**/foo/bar" matches file or directory "bar" anywhere that is directly
+        // >   under directory "foo".
+        // Notice that the '*'s have been replaced as '\\*'
+        /^\^*(?:\\\*\\\*\\\/)+/,
+        // '**/foo' <-> 'foo'
+        () => "^(?:.*\\/)?"
+      ],
+      // starting
+      [
+        // there will be no leading '/'
+        //   (which has been replaced by section "leading slash")
+        // If starts with '**', adding a '^' to the regular expression also works
+        /^(?=[^^])/,
+        function startingReplacer() {
+          return !/\/(?!$)/.test(this) ? "(?:^|\\/)" : "^";
+        }
+      ],
+      // two globstars
+      [
+        // Use lookahead assertions so that we could match more than one `'/**'`
+        /\\\/\\\*\\\*(?=\\\/|$)/g,
+        // Zero, one or several directories
+        // should not use '*', or it will be replaced by the next replacer
+        // Check if it is not the last `'/**'`
+        (_, index, str) => index + 6 < str.length ? "(?:\\/[^\\/]+)*" : "\\/.+"
+      ],
+      // normal intermediate wildcards
+      [
+        // Never replace escaped '*'
+        // ignore rule '\*' will match the path '*'
+        // 'abc.*/' -> go
+        // 'abc.*'  -> skip this rule,
+        //    coz trailing single wildcard will be handed by [trailing wildcard]
+        /(^|[^\\]+)(\\\*)+(?=.+)/g,
+        // '*.js' matches '.js'
+        // '*.js' doesn't match 'abc'
+        (_, p1, p2) => {
+          const unescaped = p2.replace(/\\\*/g, "[^\\/]*");
+          return p1 + unescaped;
+        }
+      ],
+      [
+        // unescape, revert step 3 except for back slash
+        // For example, if a user escape a '\\*',
+        // after step 3, the result will be '\\\\\\*'
+        /\\\\\\(?=[$.|*+(){^])/g,
+        () => ESCAPE
+      ],
+      [
+        // '\\\\' -> '\\'
+        /\\\\/g,
+        () => ESCAPE
+      ],
+      [
+        // > The range notation, e.g. [a-zA-Z],
+        // > can be used to match one of the characters in a range.
+        // `\` is escaped by step 3
+        /(\\)?\[([^\]/]*?)(\\*)($|\])/g,
+        (match, leadEscape, range, endEscape, close) => leadEscape === ESCAPE ? `\\[${range}${cleanRangeBackSlash(endEscape)}${close}` : close === "]" ? endEscape.length % 2 === 0 ? `[${negateRange(sanitizeRange(range))}${endEscape}]` : "[]" : "[]"
+      ],
+      // ending
+      [
+        // 'js' will not match 'js.'
+        // 'ab' will not match 'abc'
+        /(?:[^*])$/,
+        // WTF!
+        // https://git-scm.com/docs/gitignore
+        // changes in [2.22.1](https://git-scm.com/docs/gitignore/2.22.1)
+        // which re-fixes #24, #38
+        // > If there is a separator at the end of the pattern then the pattern
+        // > will only match directories, otherwise the pattern can match both
+        // > files and directories.
+        // 'js*' will not match 'a.js'
+        // 'js/' will not match 'a.js'
+        // 'js' will match 'a.js' and 'a.js/'
+        (match) => /\/$/.test(match) ? `${match}$` : `${match}(?=$|\\/$)`
+      ]
+    ];
+    var REGEX_REPLACE_TRAILING_WILDCARD = /(^|\\\/)?\\\*$/;
+    var MODE_IGNORE = "regex";
+    var MODE_CHECK_IGNORE = "checkRegex";
+    var UNDERSCORE = "_";
+    var TRAILING_WILD_CARD_REPLACERS = {
+      [MODE_IGNORE](_, p1) {
+        const prefix = p1 ? `${p1}[^/]+` : "[^/]*";
+        return `${prefix}(?=$|\\/$)`;
+      },
+      [MODE_CHECK_IGNORE](_, p1) {
+        const prefix = p1 ? `${p1}[^/]*` : "[^/]*";
+        return `${prefix}(?=$|\\/$)`;
+      }
+    };
+    var makeRegexPrefix = (pattern) => REPLACERS.reduce(
+      (prev, [matcher, replacer]) => prev.replace(matcher, replacer.bind(pattern)),
+      pattern
+    );
+    var isString = (subject) => typeof subject === "string";
+    var checkPattern = (pattern) => pattern && isString(pattern) && !REGEX_TEST_BLANK_LINE.test(pattern) && !REGEX_INVALID_TRAILING_BACKSLASH.test(pattern) && pattern.indexOf("#") !== 0;
+    var splitPattern = (pattern) => pattern.split(REGEX_SPLITALL_CRLF).filter(Boolean);
+    var IgnoreRule = class {
+      constructor(pattern, mark, body, ignoreCase, negative, prefix) {
+        this.pattern = pattern;
+        this.mark = mark;
+        this.negative = negative;
+        define(this, "body", body);
+        define(this, "ignoreCase", ignoreCase);
+        define(this, "regexPrefix", prefix);
+      }
+      get regex() {
+        const key = UNDERSCORE + MODE_IGNORE;
+        if (this[key]) {
+          return this[key];
+        }
+        return this._make(MODE_IGNORE, key);
+      }
+      get checkRegex() {
+        const key = UNDERSCORE + MODE_CHECK_IGNORE;
+        if (this[key]) {
+          return this[key];
+        }
+        return this._make(MODE_CHECK_IGNORE, key);
+      }
+      _make(mode, key) {
+        const str = this.regexPrefix.replace(
+          REGEX_REPLACE_TRAILING_WILDCARD,
+          // It does not need to bind pattern
+          TRAILING_WILD_CARD_REPLACERS[mode]
+        );
+        const regex = this.ignoreCase ? new RegExp(str, "i") : new RegExp(str);
+        return define(this, key, regex);
+      }
+    };
+    var createRule = ({
+      pattern,
+      mark
+    }, ignoreCase) => {
+      let negative = false;
+      let body = pattern;
+      if (body.indexOf("!") === 0) {
+        negative = true;
+        body = body.substr(1);
+      }
+      body = body.replace(REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION, "!").replace(REGEX_REPLACE_LEADING_EXCAPED_HASH, "#");
+      const regexPrefix = makeRegexPrefix(body);
+      return new IgnoreRule(
+        pattern,
+        mark,
+        body,
+        ignoreCase,
+        negative,
+        regexPrefix
+      );
+    };
+    var RuleManager = class {
+      constructor(ignoreCase) {
+        this._ignoreCase = ignoreCase;
+        this._rules = [];
+      }
+      _add(pattern) {
+        if (pattern && pattern[KEY_IGNORE]) {
+          this._rules = this._rules.concat(pattern._rules._rules);
+          this._added = true;
+          return;
+        }
+        if (isString(pattern)) {
+          pattern = {
+            pattern
+          };
+        }
+        if (checkPattern(pattern.pattern)) {
+          const rule = createRule(pattern, this._ignoreCase);
+          this._added = true;
+          this._rules.push(rule);
+        }
+      }
+      // @param {Array<string> | string | Ignore} pattern
+      add(pattern) {
+        this._added = false;
+        makeArray(
+          isString(pattern) ? splitPattern(pattern) : pattern
+        ).forEach(this._add, this);
+        return this._added;
+      }
+      // Test one single path without recursively checking parent directories
+      //
+      // - checkUnignored `boolean` whether should check if the path is unignored,
+      //   setting `checkUnignored` to `false` could reduce additional
+      //   path matching.
+      // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
+      // @returns {TestResult} true if a file is ignored
+      test(path5, checkUnignored, mode) {
+        let ignored = false;
+        let unignored = false;
+        let matchedRule;
+        this._rules.forEach((rule) => {
+          const { negative } = rule;
+          if (unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored) {
+            return;
+          }
+          const matched = rule[mode].test(path5);
+          if (!matched) {
+            return;
+          }
+          ignored = !negative;
+          unignored = negative;
+          matchedRule = negative ? UNDEFINED : rule;
+        });
+        const ret = {
+          ignored,
+          unignored
+        };
+        if (matchedRule) {
+          ret.rule = matchedRule;
+        }
+        return ret;
+      }
+    };
+    var throwError = (message, Ctor) => {
+      throw new Ctor(message);
+    };
+    var checkPath = (path5, originalPath, doThrow) => {
+      if (!isString(path5)) {
+        return doThrow(
+          `path must be a string, but got \`${originalPath}\``,
+          TypeError
+        );
+      }
+      if (!path5) {
+        return doThrow(`path must not be empty`, TypeError);
+      }
+      if (checkPath.isNotRelative(path5)) {
+        const r = "`path.relative()`d";
+        return doThrow(
+          `path should be a ${r} string, but got "${originalPath}"`,
+          RangeError
+        );
+      }
+      return true;
+    };
+    var isNotRelative = (path5) => REGEX_TEST_INVALID_PATH.test(path5);
+    checkPath.isNotRelative = isNotRelative;
+    checkPath.convert = (p) => p;
+    var Ignore = class {
+      constructor({
+        ignorecase = true,
+        ignoreCase = ignorecase,
+        allowRelativePaths = false
+      } = {}) {
+        define(this, KEY_IGNORE, true);
+        this._rules = new RuleManager(ignoreCase);
+        this._strictPathCheck = !allowRelativePaths;
+        this._initCache();
+      }
+      _initCache() {
+        this._ignoreCache = /* @__PURE__ */ Object.create(null);
+        this._testCache = /* @__PURE__ */ Object.create(null);
+      }
+      add(pattern) {
+        if (this._rules.add(pattern)) {
+          this._initCache();
+        }
+        return this;
+      }
+      // legacy
+      addPattern(pattern) {
+        return this.add(pattern);
+      }
+      // @returns {TestResult}
+      _test(originalPath, cache, checkUnignored, slices) {
+        const path5 = originalPath && checkPath.convert(originalPath);
+        checkPath(
+          path5,
+          originalPath,
+          this._strictPathCheck ? throwError : RETURN_FALSE
+        );
+        return this._t(path5, cache, checkUnignored, slices);
+      }
+      checkIgnore(path5) {
+        if (!REGEX_TEST_TRAILING_SLASH.test(path5)) {
+          return this.test(path5);
+        }
+        const slices = path5.split(SLASH).filter(Boolean);
+        slices.pop();
+        if (slices.length) {
+          const parent = this._t(
+            slices.join(SLASH) + SLASH,
+            this._testCache,
+            true,
+            slices
+          );
+          if (parent.ignored) {
+            return parent;
+          }
+        }
+        return this._rules.test(path5, false, MODE_CHECK_IGNORE);
+      }
+      _t(path5, cache, checkUnignored, slices) {
+        if (path5 in cache) {
+          return cache[path5];
+        }
+        if (!slices) {
+          slices = path5.split(SLASH).filter(Boolean);
+        }
+        slices.pop();
+        if (!slices.length) {
+          return cache[path5] = this._rules.test(path5, checkUnignored, MODE_IGNORE);
+        }
+        const parent = this._t(
+          slices.join(SLASH) + SLASH,
+          cache,
+          checkUnignored,
+          slices
+        );
+        return cache[path5] = parent.ignored ? parent : this._rules.test(path5, checkUnignored, MODE_IGNORE);
+      }
+      ignores(path5) {
+        return this._test(path5, this._ignoreCache, false).ignored;
+      }
+      createFilter() {
+        return (path5) => !this.ignores(path5);
+      }
+      filter(paths) {
+        return makeArray(paths).filter(this.createFilter());
+      }
+      // @returns {TestResult}
+      test(path5) {
+        return this._test(path5, this._testCache, true);
+      }
+    };
+    var factory = (options) => new Ignore(options);
+    var isPathValid = (path5) => checkPath(path5 && checkPath.convert(path5), path5, RETURN_FALSE);
+    var setupWindows = () => {
+      const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
+      checkPath.convert = makePosix;
+      const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
+      checkPath.isNotRelative = (path5) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path5) || isNotRelative(path5);
+    };
+    if (
+      // Detect `process` so that it can run in browsers.
+      typeof process !== "undefined" && process.platform === "win32"
+    ) {
+      setupWindows();
+    }
+    module.exports = factory;
+    factory.default = factory;
+    module.exports.isPathValid = isPathValid;
+    define(module.exports, /* @__PURE__ */ Symbol.for("setupWindows"), setupWindows);
+  }
+});
+
+// src/workspace.ts
+import { spawn } from "child_process";
+import { createHash, randomUUID } from "crypto";
+import { existsSync as existsSync2 } from "fs";
+import { copyFile as copyFile2, mkdir as mkdir3, readFile as readFile3, readdir as readdir2, rename, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import path4 from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+
+// ../../shared/auth-config/index.ts
+var WORKFLOW_AUTH_FILE_NAME = "workflow-auth.json";
+var DEFAULT_MAC_PLATFORM = "darwin";
+var DEFAULT_WINDOWS_PLATFORM = "win32";
+var DEFAULT_OTHER_PLATFORM = "linux";
+function createEmptyWorkflowAuthConfig() {
+  return {
+    serverUrl: "",
+    apiKey: ""
+  };
+}
+function normalizeWorkflowAuthConfig(value) {
+  if (!isRecord(value)) {
+    return createEmptyWorkflowAuthConfig();
+  }
+  return {
+    // issue #90 Accept legacy field names (remoteUrl, token) from pre-migration
+    // config files so existing users don't lose their credentials on upgrade.
+    serverUrl: readString(value.serverUrl) ?? readString(value.remoteUrl) ?? "",
+    apiKey: readString(value.apiKey) ?? readString(value.token) ?? "",
+    expiresAt: readString(value.expiresAt),
+    user: isRecord(value.user) ? {
+      userId: readString(value.user.userId) ?? "",
+      email: readString(value.user.email) ?? "",
+      displayName: readString(value.user.displayName) ?? "",
+      avatarUrl: readString(value.user.avatarUrl)
+    } : void 0,
+    source: value.source === "device_flow" || value.source === "manual" || value.source === "password" ? value.source : void 0
+  };
+}
+function isWorkflowAuthExpiringSoon(expiresAt, options = {}) {
+  if (!expiresAt) {
+    return false;
+  }
+  const expiresAtMs = new Date(expiresAt).getTime();
+  if (!Number.isFinite(expiresAtMs)) {
+    return false;
+  }
+  const now = options.now ?? Date.now();
+  const thresholdMs = options.thresholdMs ?? 1e3 * 60 * 60 * 24 * 3;
+  return expiresAtMs - now <= thresholdMs;
+}
+function resolveWorkflowCliAuthDir(env = readProcessEnv()) {
+  if (readString(env.WORKFLOW_CLI_AUTH_DIR)) {
+    return normalizePath(env.WORKFLOW_CLI_AUTH_DIR);
+  }
+  if (readPlatform(env) === DEFAULT_WINDOWS_PLATFORM) {
+    return joinPath(
+      env.APPDATA ?? joinPath(resolveHomeDir(env), "AppData", "Roaming"),
+      "workflow-code"
+    );
+  }
+  if (readPlatform(env) === DEFAULT_MAC_PLATFORM) {
+    return joinPath(resolveHomeDir(env), "Library", "Application Support", "workflow-code");
+  }
+  return joinPath(
+    env.XDG_CONFIG_HOME ?? joinPath(resolveHomeDir(env), ".config"),
+    "workflow-code"
+  );
+}
+function resolveWorkflowCliAuthFilePath(env = readProcessEnv()) {
+  return joinPath(resolveWorkflowCliAuthDir(env), WORKFLOW_AUTH_FILE_NAME);
+}
+function resolveHomeDir(env) {
+  return env.HOME ?? "";
+}
+function readPlatform(env) {
+  return env.platform ?? readProcessPlatform();
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function readString(value) {
+  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function joinPath(...parts) {
+  return normalizePath(parts.filter((part) => part !== "").join("/"));
+}
+function normalizePath(value) {
+  const normalized = value.replaceAll("\\", "/");
+  if (/^[A-Za-z]:\//.test(normalized)) {
+    const drive = normalized.slice(0, 2);
+    const rest = normalized.slice(2).replace(/\/+/g, "/");
+    return `${drive}${rest.startsWith("/") ? rest : `/${rest}`}`;
+  }
+  return normalized.replace(/\/+/g, "/");
+}
+function readProcessEnv() {
+  const processValue = readGlobalProcess();
+  return {
+    ...processValue?.env ?? {},
+    platform: processValue?.platform ?? DEFAULT_OTHER_PLATFORM
+  };
+}
+function readProcessPlatform() {
+  return readGlobalProcess()?.platform ?? DEFAULT_OTHER_PLATFORM;
+}
+function readGlobalProcess() {
+  const processValue = Reflect.get(globalThis, "process");
+  if (typeof processValue !== "object" || processValue === null) {
+    return void 0;
+  }
+  return processValue;
+}
+
+// ../../shared/workflow-ids/index.ts
+import path from "path";
+var WORKFLOW_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function isWorkflowUuid(value) {
+  return WORKFLOW_UUID_PATTERN.test(value.trim());
+}
+
+// ../../shared/project-upload/node.ts
+import { copyFile, lstat, mkdir, readFile, readdir } from "fs/promises";
+import path2 from "path";
+
+// ../../shared/project-upload/index.ts
+var import_ignore = __toESM(require_ignore(), 1);
+
+// ../../shared/kanban-project/index.ts
+var KANBAN_MANIFEST_FILE = "kanban.json";
+var KANBAN_ENTRY_FILE = "index.html";
+var KANBAN_ARTIFACT_DIR = ".";
+var KANBAN_DATA_SOURCE_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+var KANBAN_WORKFLOW_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var MAX_KANBAN_DATA_SOURCES = 32;
+var MAX_KANBAN_DATA_SOURCE_PREFIXES = 32;
+var MAX_KANBAN_DATA_SOURCE_KEY_LENGTH = 1024;
+function readPackageProjectType(value) {
+  if (!isRecord2(value)) return void 0;
+  const workflowCode = value["workflowCode"];
+  if (!isRecord2(workflowCode)) return void 0;
+  return workflowCode["projectType"] === "kanban" ? "kanban" : void 0;
+}
+function readKanbanArtifactConfig(value) {
+  if (!isRecord2(value)) {
+    throw new Error("package.json root must be an object.");
+  }
+  const workflowCode = value["workflowCode"];
+  if (!isRecord2(workflowCode)) {
+    throw new Error("package.json workflowCode must be an object for a Kanban project.");
+  }
+  const rawConfig = workflowCode["kanban"];
+  if (rawConfig !== void 0 && !isRecord2(rawConfig)) {
+    throw new Error("package.json workflowCode.kanban must be an object.");
+  }
+  return {
+    artifactDir: readKanbanRelativePath(
+      rawConfig?.["artifactDir"],
+      "workflowCode.kanban.artifactDir",
+      KANBAN_ARTIFACT_DIR,
+      true
+    ),
+    entry: readKanbanRelativePath(
+      rawConfig?.["entry"],
+      "workflowCode.kanban.entry",
+      KANBAN_ENTRY_FILE,
+      false
+    ),
+    dataSources: parseKanbanDataSources(rawConfig?.["dataSources"])
+  };
+}
+function createKanbanArtifactEntryPath(config) {
+  return config.artifactDir === KANBAN_ARTIFACT_DIR ? config.entry : `${config.artifactDir}/${config.entry}`;
+}
+function readKanbanRelativePath(value, field, fallback, allowDot) {
+  const raw = value === void 0 ? fallback : value;
+  if (typeof raw !== "string" || raw.trim() === "") {
+    throw new Error(`package.json ${field} must be a non-empty string.`);
+  }
+  const normalized = raw.trim().replaceAll("\\", "/").replace(/\/+$/, "");
+  if (allowDot && normalized === ".") return normalized;
+  if (normalized === "" || normalized === "." || normalized.startsWith("/") || normalized.startsWith("//") || /^[a-zA-Z]:/.test(normalized) || normalized.includes("\0") || normalized.split("/").some((part) => part === "" || part === "." || part === "..")) {
+    throw new Error(`package.json ${field} must be a safe project-relative path.`);
+  }
+  const reservedDirectory = normalized.split("/").find((part) => [".git", ".hg", ".svn", "node_modules"].includes(part.toLowerCase()));
+  if (reservedDirectory !== void 0) {
+    throw new Error(
+      `package.json ${field} must not use reserved directory ${JSON.stringify(reservedDirectory)}.`
+    );
+  }
+  if (!allowDot && !/\.html?$/i.test(normalized)) {
+    throw new Error(`package.json ${field} must point to an HTML file.`);
+  }
+  return normalized;
+}
+function parseKanbanDataSources(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) {
+    throw new Error("package.json workflowCode.kanban.dataSources must be an array.");
+  }
+  if (value.length > MAX_KANBAN_DATA_SOURCES) {
+    throw new Error(`package.json workflowCode.kanban.dataSources supports at most ${MAX_KANBAN_DATA_SOURCES} items.`);
+  }
+  const ids = /* @__PURE__ */ new Set();
+  return value.map((item, index) => {
+    if (!isRecord2(item)) {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}] must be an object.`);
+    }
+    const supportedFields = /* @__PURE__ */ new Set(["id", "kind", "projectId", "keyPrefixes"]);
+    if (Object.keys(item).some((field) => !supportedFields.has(field))) {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}] contains unsupported fields.`);
+    }
+    const id = readNonEmptyString(item["id"], `workflowCode.kanban.dataSources[${index}].id`);
+    if (!KANBAN_DATA_SOURCE_ID_PATTERN.test(id)) {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].id is invalid.`);
+    }
+    if (ids.has(id)) {
+      throw new Error(`package.json workflowCode.kanban.dataSources contains duplicate id "${id}".`);
+    }
+    ids.add(id);
+    if (item["kind"] !== "workflow-kv") {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].kind is unsupported.`);
+    }
+    const projectId = readNonEmptyString(
+      item["projectId"],
+      `workflowCode.kanban.dataSources[${index}].projectId`
+    );
+    if (!KANBAN_WORKFLOW_UUID_PATTERN.test(projectId)) {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].projectId must be a UUID.`);
+    }
+    const rawPrefixes = item["keyPrefixes"];
+    if (!Array.isArray(rawPrefixes) || rawPrefixes.length === 0 || rawPrefixes.length > MAX_KANBAN_DATA_SOURCE_PREFIXES) {
+      throw new Error(
+        `package.json workflowCode.kanban.dataSources[${index}].keyPrefixes must contain 1 to ${MAX_KANBAN_DATA_SOURCE_PREFIXES} items.`
+      );
+    }
+    const keyPrefixes = rawPrefixes.map((prefix, prefixIndex) => {
+      const normalized = readNonEmptyString(
+        prefix,
+        `workflowCode.kanban.dataSources[${index}].keyPrefixes[${prefixIndex}]`
+      );
+      if (normalized.length > MAX_KANBAN_DATA_SOURCE_KEY_LENGTH || normalized.includes("\0")) {
+        throw new Error(`package.json workflowCode.kanban.dataSources[${index}].keyPrefixes[${prefixIndex}] is invalid.`);
+      }
+      return normalized;
+    });
+    if (new Set(keyPrefixes).size !== keyPrefixes.length) {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].keyPrefixes contains duplicates.`);
+    }
+    return { id, kind: "workflow-kv", projectId, keyPrefixes };
+  });
+}
+function readNonEmptyString(value, field) {
+  if (typeof value !== "string" || value.trim() === "") throw new Error(`kanban.json ${field} must be a non-empty string.`);
+  return value.trim();
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// ../../shared/project-upload/index.ts
+var WORKFLOW_IGNORE_FILE = ".workflowignore";
+function hasWorkflowIgnoreRules(content) {
+  if (content === void 0) return false;
+  return content.split(/\r?\n/).some((line) => {
+    const trimmed = line.trim();
+    return trimmed !== "" && !trimmed.startsWith("#");
+  });
+}
+function resolveWorkflowUploadRequiredPaths(packageJson, availablePaths) {
+  const normalizedAvailablePaths = new Set(
+    Array.from(availablePaths, (filePath) => normalizeWorkflowUploadPath(filePath))
+  );
+  if (readPackageProjectType(packageJson) === "kanban") {
+    const artifact = readKanbanArtifactConfig(packageJson);
+    return [
+      "package.json",
+      createKanbanArtifactEntryPath(artifact),
+      ...normalizedAvailablePaths.has(KANBAN_MANIFEST_FILE) ? [KANBAN_MANIFEST_FILE] : []
+    ];
+  }
+  return ["package.json", "index.ts"];
+}
+function createWorkflowUploadMatcher(content) {
+  const ruleLines = content === void 0 ? [] : content.split(/\r?\n/);
+  const matcher = (0, import_ignore.default)().add(ruleLines);
+  return {
+    ignores(relativePath, options) {
+      const normalized = normalizeWorkflowUploadPath(relativePath, options);
+      return normalized === WORKFLOW_IGNORE_FILE ? false : matcher.ignores(normalized);
+    },
+    explain(relativePath, options) {
+      const normalized = normalizeWorkflowUploadPath(relativePath, options);
+      if (normalized === WORKFLOW_IGNORE_FILE) return void 0;
+      return findEffectiveWorkflowIgnoreRule(normalized, ruleLines);
+    },
+    assertRequiredPaths(relativePaths) {
+      for (const relativePath of relativePaths) {
+        const normalized = normalizeWorkflowUploadPath(relativePath);
+        if (!matcher.ignores(normalized)) continue;
+        const rule = findEffectiveWorkflowIgnoreRule(normalized, ruleLines);
+        const suffix = rule === void 0 ? "" : ` by rule ${JSON.stringify(rule)}`;
+        throw new Error(
+          `Required upload path ${JSON.stringify(normalized)} is excluded by ${WORKFLOW_IGNORE_FILE}${suffix}.`
+        );
+      }
+    }
+  };
+}
+function normalizeWorkflowUploadPath(relativePath, options = {}) {
+  const normalized = relativePath.replaceAll("\\", "/").replace(/^\.\/+/, "");
+  const withoutTrailingSlash = normalized.replace(/\/+$/, "");
+  if (withoutTrailingSlash === "" || withoutTrailingSlash.startsWith("/") || /^[a-zA-Z]:/.test(withoutTrailingSlash) || withoutTrailingSlash.includes("\0") || withoutTrailingSlash.split("/").some((part) => part === "" || part === "." || part === "..")) {
+    throw new Error(`Invalid workflow upload path ${JSON.stringify(relativePath)}.`);
+  }
+  return options.directory === true ? `${withoutTrailingSlash}/` : withoutTrailingSlash;
+}
+function createWorkflowUploadPortablePathKey(relativePath) {
+  return normalizeWorkflowUploadPath(relativePath).normalize("NFC").toLowerCase();
+}
+function findEffectiveWorkflowIgnoreRule(normalizedPath, ruleLines) {
+  const matcher = (0, import_ignore.default)();
+  let ignored = false;
+  let effectiveRule;
+  for (const ruleLine of ruleLines) {
+    matcher.add(ruleLine);
+    const nextIgnored = matcher.ignores(normalizedPath);
+    if (nextIgnored !== ignored) {
+      ignored = nextIgnored;
+      effectiveRule = ruleLine;
+    }
+  }
+  return ignored ? effectiveRule : void 0;
+}
+
+// ../../shared/project-upload/node.ts
+async function createWorkflowUploadPlan(rootDir) {
+  const projectRoot = path2.resolve(rootDir);
+  const workflowIgnorePath = path2.join(projectRoot, WORKFLOW_IGNORE_FILE);
+  const workflowIgnoreStat = await lstat(workflowIgnorePath).catch(() => void 0);
+  if (workflowIgnoreStat?.isSymbolicLink()) {
+    throw new Error(`${WORKFLOW_IGNORE_FILE} must be a regular file.`);
+  }
+  const workflowIgnorePresent = workflowIgnoreStat?.isFile() === true;
+  if (workflowIgnoreStat !== void 0 && !workflowIgnorePresent) {
+    throw new Error(`${WORKFLOW_IGNORE_FILE} must be a regular file.`);
+  }
+  const workflowIgnoreContent = workflowIgnorePresent ? await readWorkflowUploadUtf8File(workflowIgnorePath, WORKFLOW_IGNORE_FILE) : void 0;
+  const matcher = createWorkflowUploadMatcher(
+    workflowIgnoreContent
+  );
+  const files = [];
+  const availableRegularPaths = /* @__PURE__ */ new Set();
+  const portablePaths = /* @__PURE__ */ new Map();
+  const ignoredPaths = [];
+  const walk = async (currentDir) => {
+    const entries = await readdir(currentDir, { withFileTypes: true });
+    for (const entry of entries) {
+      const absolutePath = path2.join(currentDir, entry.name);
+      const relativePath = normalizeWorkflowUploadPath(path2.relative(projectRoot, absolutePath));
+      const portablePath = createWorkflowUploadPortablePathKey(relativePath);
+      const conflictingPath = portablePaths.get(portablePath);
+      if (conflictingPath !== void 0 && conflictingPath !== relativePath) {
+        throw new Error(
+          `Workflow upload paths ${JSON.stringify(conflictingPath)} and ${JSON.stringify(relativePath)} conflict on a case-insensitive filesystem.`
+        );
+      }
+      portablePaths.set(portablePath, relativePath);
+      if (entry.isDirectory()) {
+        if (matcher.ignores(relativePath, { directory: true })) {
+          ignoredPaths.push(`${relativePath}/`);
+          continue;
+        }
+        await walk(absolutePath);
+        continue;
+      }
+      if (!entry.isFile()) {
+        throw new Error(`Workflow upload path ${JSON.stringify(relativePath)} must be a regular file or directory.`);
+      }
+      availableRegularPaths.add(relativePath);
+      if (matcher.ignores(relativePath)) {
+        ignoredPaths.push(relativePath);
+        continue;
+      }
+      const fileStat = await lstat(absolutePath);
+      files.push({ path: relativePath, absolutePath, size: fileStat.size });
+    }
+  };
+  await walk(projectRoot);
+  files.sort((left, right) => left.path.localeCompare(right.path));
+  ignoredPaths.sort((left, right) => left.localeCompare(right));
+  if (!availableRegularPaths.has("package.json")) {
+    throw new Error("Workflow package must contain package.json.");
+  }
+  const packageJson = parsePackageJson(await readWorkflowUploadUtf8File(
+    path2.join(projectRoot, "package.json"),
+    "package.json"
+  ));
+  const requiredPaths = resolveWorkflowUploadRequiredPaths(
+    packageJson,
+    availableRegularPaths
+  );
+  matcher.assertRequiredPaths(requiredPaths);
+  for (const requiredPath of requiredPaths) {
+    if (!availableRegularPaths.has(requiredPath)) {
+      throw new Error(`Workflow package must contain required upload path ${JSON.stringify(requiredPath)}.`);
+    }
+  }
+  return {
+    workflowIgnorePresent,
+    workflowIgnoreConfigured: hasWorkflowIgnoreRules(workflowIgnoreContent),
+    files,
+    ignoredPaths,
+    totalBytes: files.reduce((total, file) => total + file.size, 0),
+    requiredPaths
+  };
+}
+async function copyWorkflowUploadFiles(sourceDir, targetDir) {
+  const plan = await createWorkflowUploadPlan(sourceDir);
+  await mkdir(targetDir, { recursive: true });
+  for (const file of plan.files) {
+    const targetPath = path2.join(targetDir, ...file.path.split("/"));
+    await mkdir(path2.dirname(targetPath), { recursive: true });
+    await copyFile(file.absolutePath, targetPath);
+  }
+  return plan;
+}
+function parsePackageJson(content) {
+  try {
+    return JSON.parse(content);
+  } catch {
+    throw new Error("Workflow package.json is invalid JSON.");
+  }
+}
+async function readWorkflowUploadUtf8File(filePath, label) {
+  const content = await readFile(filePath);
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(content);
+  } catch {
+    throw new Error(`Workflow ${label} must be a UTF-8 text file.`);
+  }
+}
+
+// src/workspace.ts
+import {
+  createWorkflowProjectDependencyLocks,
+  inspectLocalWorkflowStructure,
+  isProjectGroupHostDataPath,
+  parseWorkflowProjectDependencyLocks,
+  readKanbanArtifactConfig as readKanbanArtifactConfig2
+} from "workflow-code";
+
+// src/auth-config.ts
+import { readFileSync } from "fs";
+import { mkdir as mkdir2, readFile as readFile2, rm, writeFile } from "fs/promises";
+async function readCliAuthConfig(env = process.env) {
+  try {
+    const raw = await readFile2(resolveWorkflowCliAuthFilePath(env), "utf8");
+    return normalizeWorkflowAuthConfig(JSON.parse(raw));
+  } catch {
+    return createEmptyWorkflowAuthConfig();
+  }
+}
+function readCliAuthConfigSync(env = process.env) {
+  try {
+    const raw = readFileSync(resolveWorkflowCliAuthFilePath(env), "utf8");
+    return normalizeWorkflowAuthConfig(JSON.parse(raw));
+  } catch {
+    return createEmptyWorkflowAuthConfig();
+  }
+}
+async function writeCliAuthConfig(config, env = process.env) {
+  await mkdir2(resolveWorkflowCliAuthDir(env), { recursive: true });
+  await writeFile(
+    resolveWorkflowCliAuthFilePath(env),
+    `${JSON.stringify(normalizeWorkflowAuthConfig(config), null, 2)}
+`,
+    "utf8"
+  );
+}
+async function clearCliAuthConfig(env = process.env) {
+  await rm(resolveWorkflowCliAuthFilePath(env), { force: true });
+}
+
+// src/env.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import path3 from "path";
+import { parse } from "dotenv";
+function loadCliEnv() {
+  const cliRoot = process.cwd();
+  const defaultRepoRoot = findRepoRoot(cliRoot) ?? cliRoot;
+  const initialRepoRoot = process.env.WORKFLOW_REPO_ROOT ? path3.resolve(process.env.WORKFLOW_REPO_ROOT) : defaultRepoRoot;
+  loadEnvFiles([
+    path3.join(cliRoot, ".env"),
+    path3.join(initialRepoRoot, ".env")
+  ]);
+  const resolvedRepoRoot = process.env.WORKFLOW_REPO_ROOT ? path3.resolve(process.env.WORKFLOW_REPO_ROOT) : initialRepoRoot;
+  if (resolvedRepoRoot !== initialRepoRoot) {
+    loadEnvFiles([path3.join(resolvedRepoRoot, ".env")]);
+  }
+}
+function findRepoRoot(startDir) {
+  let current = path3.resolve(startDir);
+  while (true) {
+    if (existsSync(path3.join(current, "pnpm-workspace.yaml")) && existsSync(path3.join(current, "packages", "cli", "package.json"))) {
+      return current;
+    }
+    const parent = path3.dirname(current);
+    if (parent === current) return void 0;
+    current = parent;
+  }
+}
+function loadEnvFiles(filePaths) {
+  for (const filePath of unique(filePaths)) {
+    if (!existsSync(filePath)) {
+      continue;
+    }
+    const values = parse(readFileSync2(filePath));
+    for (const [key, value] of Object.entries(values)) {
+      if (process.env[key] === void 0) {
+        process.env[key] = value;
+      }
+    }
+  }
+}
+function unique(values) {
+  return [...new Set(values)];
+}
+
+// src/workspace.ts
+var DEFAULT_SERVER_URL = "http://localhost:7125";
+var CLI_MODULE_DIR = path4.dirname(fileURLToPath(import.meta.url));
+var DEFAULT_DEVICE_FLOW_CLIENT_NAME = "Workflow Workspace CLI";
+loadCliEnv();
+async function main(argv = process.argv.slice(2), options = {}) {
+  if (options.localeInitialized !== true) {
+    argv = prepareCliInvocation(argv).argv;
+  }
+  const parsed = parseArgs(argv);
+  switch (parsed.command) {
+    case "login":
+      await commandLogin(parsed);
+      return;
+    case "logout":
+      await commandLogout();
+      return;
+    case "status":
+      await commandStatus();
+      return;
+    case "pack":
+      await commandPack(parsed);
+      return;
+    case "upload":
+      await commandUpload(parsed);
+      return;
+    case "preparation":
+      await commandPreparation(parsed);
+      return;
+    case "run":
+      await commandRun(parsed);
+      return;
+    case "debug-node":
+      await commandDebugNode(parsed);
+      return;
+    case "download":
+      await commandDownload(parsed);
+      return;
+    case "publish":
+      await commandPublish(parsed);
+      return;
+    case "versions":
+      await commandVersions(parsed);
+      return;
+    case "health":
+      await commandHealth(parsed);
+      return;
+    case "":
+    case "help":
+    case "--help":
+    case "-h":
+      printUsage();
+      return;
+    default:
+      throw new Error(i18n.t("unknownWorkspaceCommand", { ns: "cli", command: parsed.command }));
+  }
+}
+async function commandLogin(parsed) {
+  const server = parsed.options.server.trim();
+  if (server === "") {
+    throw new Error(i18n.t("loginRequiresServer", { ns: "cli" }));
+  }
+  const started = await fetchApi({
+    server,
+    token: "",
+    path: "/api/auth/device/start",
+    method: "POST",
+    body: {
+      // issue #93 phase 1 moves workspace login to device flow and stores a
+      // dedicated CLI auth file instead of sharing the App config.
+      clientName: DEFAULT_DEVICE_FLOW_CLIENT_NAME,
+      source: "cli"
+    },
+    auth: false
+  });
+  if (started.errCode !== 0 || started.data === void 0) {
+    printApiResponse(started);
+    assertApiOk(started);
+    return;
+  }
+  const verificationUrl = started.data.verificationUriComplete || started.data.verificationUri;
+  void openExternalBrowser(verificationUrl);
+  console.error(i18n.t("deviceLoginPrompt", {
+    ns: "cli",
+    url: verificationUrl,
+    code: started.data.userCode
+  }));
+  const completed = await waitForDeviceToken({
+    server,
+    deviceCode: started.data.deviceCode,
+    intervalSeconds: started.data.intervalSeconds,
+    expiresAt: started.data.expiresAt
+  });
+  if (completed.errCode !== 0 || completed.data === void 0) {
+    printApiResponse(completed);
+    assertApiOk(completed);
+    return;
+  }
+  await writeCliAuthConfig({
+    serverUrl: server,
+    apiKey: completed.data.accessToken,
+    expiresAt: completed.data.expiresAt ?? completed.data.apiKey.expiresAt,
+    user: completed.data.user,
+    source: "device_flow"
+  });
+  printApiResponse({
+    errCode: 0,
+    errMessage: "",
+    data: {
+      loggedIn: true,
+      serverUrl: server,
+      user: completed.data.user,
+      expiresAt: completed.data.expiresAt ?? completed.data.apiKey.expiresAt,
+      apiKeyPrefix: completed.data.apiKey.prefix
+    }
+  });
+}
+async function commandLogout() {
+  await clearCliAuthConfig();
+  printApiResponse({ errCode: 0, errMessage: "", data: { loggedIn: false } });
+}
+async function commandStatus() {
+  const authConfig = await readCliAuthConfig();
+  printApiResponse({
+    errCode: 0,
+    errMessage: "",
+    data: {
+      loggedIn: authConfig.serverUrl.trim() !== "" && authConfig.apiKey.trim() !== "",
+      serverUrl: authConfig.serverUrl,
+      user: authConfig.user,
+      expiresAt: authConfig.expiresAt,
+      expiringSoon: isWorkflowAuthExpiringSoon(authConfig.expiresAt),
+      source: authConfig.source ?? null
+    }
+  });
+}
+async function commandPack(parsed) {
+  const workflowName = requirePositional(parsed, 0, "workflow");
+  if (parsed.options.projectGroup === true || parsed.options.publishGroup === true || parsed.options.dependencies.length > 0 || parsed.options.dataGrants.length > 0) {
+    const packed = await packProjectGroup({
+      workflowArg: workflowName,
+      sourcePath: parsed.options.path,
+      outputPath: parsed.options.output,
+      dependencyOptions: parsed.options.dependencies
+    });
+    console.log(JSON.stringify({ archivePath: packed.archivePath, manifest: packed.manifest }, null, 2));
+    return;
+  }
+  const archivePath = await packWorkflow(workflowName, parsed.options.output, parsed.options.path);
+  console.log(JSON.stringify({ archivePath }, null, 2));
+}
+async function commandUpload(parsed) {
+  requireLogin(parsed);
+  const workflowArg = requirePositional(parsed, 0, "workflow");
+  if (shouldUseProjectGroupUpload(parsed.options)) {
+    await commandProjectGroupUpload(parsed, workflowArg);
+    return;
+  }
+  const packageContext = await readWorkflowPackageContext(workflowArg, parsed.options.path);
+  let workflowId = packageContext.workflowId;
+  if (parsed.options.create === true) {
+    const created = await ensureWorkflowProjectCreated({
+      packageContext,
+      server: parsed.options.server,
+      token: parsed.options.token
+    });
+    workflowId = created.workflowId;
+  }
+  if (!workflowId) {
+    throw new Error(i18n.t("workflowIdRequired", { ns: "cli" }));
+  }
+  const archivePath = parsed.options.file ? path4.resolve(parsed.options.file) : await packWorkflow(workflowArg, parsed.options.output, parsed.options.path);
+  const uploadResult = await uploadPackage({
+    workflowId,
+    archivePath,
+    server: parsed.options.server,
+    token: parsed.options.token
+  });
+  if (uploadResult.errCode !== 0 || uploadResult.data === void 0) {
+    printApiResponse(uploadResult);
+    assertApiOk(uploadResult);
+    return;
+  }
+  if (parsed.options.noWait === true) {
+    printApiResponse(uploadResult);
+    return;
+  }
+  const preparationResult = await waitForPreparation({
+    workflowId,
+    jobId: uploadResult.data.jobId,
+    server: parsed.options.server,
+    token: parsed.options.token
+  });
+  printApiResponse(preparationResult);
+  assertApiOk(preparationResult);
+  if (preparationResult.errCode !== 0) {
+    return;
+  }
+  if (parsed.options.releaseLog !== void 0) {
+    const publishResult = await fetchApi({
+      server: parsed.options.server,
+      token: parsed.options.token,
+      path: `/api/workflows/${encodeURIComponent(workflowId)}/publish`,
+      method: "POST",
+      body: {
+        releaseLog: parsed.options.releaseLog,
+        sourceMode: parsed.options.sourceMode ?? "bundled"
+      }
+    });
+    printApiResponse(publishResult);
+    assertApiOk(publishResult);
+  }
+}
+function shouldUseProjectGroupUpload(options) {
+  return options.projectGroup === true || options.publishGroup === true || options.dependencies.length > 0 || options.dataGrants.length > 0;
+}
+async function commandProjectGroupUpload(parsed, workflowArg, forcePublish = false) {
+  if (parsed.options.file !== void 0) {
+    throw new Error(i18n.t("projectGroupUploadFileUnsupported", { ns: "cli" }));
+  }
+  let rootContext = await readWorkflowPackageContext(workflowArg, parsed.options.path);
+  if (parsed.options.create === true || rootContext.workflowId !== void 0) {
+    await ensureWorkflowProjectCreated({
+      packageContext: rootContext,
+      server: parsed.options.server,
+      token: parsed.options.token
+    });
+    rootContext = await readWorkflowPackageContext(workflowArg, parsed.options.path);
+  }
+  if (!rootContext.workflowId) {
+    throw new Error(i18n.t("projectGroupUploadRootIdRequired", { ns: "cli" }));
+  }
+  const contexts = await readProjectGroupContexts({
+    workflowArg,
+    sourcePath: parsed.options.path,
+    dependencyOptions: parsed.options.dependencies
+  });
+  for (const dependency of contexts.dependencies) {
+    await ensureWorkflowProjectCreated({
+      packageContext: dependency,
+      server: parsed.options.server,
+      token: parsed.options.token
+    });
+  }
+  const packed = await packProjectGroup({
+    workflowArg,
+    sourcePath: parsed.options.path,
+    outputPath: parsed.options.output,
+    dependencyOptions: parsed.options.dependencies,
+    contexts
+  });
+  const planned = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: "/api/deployments",
+    method: "POST",
+    body: {
+      manifest: packed.manifest,
+      releaseLog: parsed.options.releaseLog
+    }
+  });
+  if (planned.errCode !== 0 || planned.data === void 0) {
+    printApiResponse(planned);
+    assertApiOk(planned);
+    return;
+  }
+  const prepared = await uploadProjectGroupPackage({
+    deploymentId: planned.data.id,
+    archivePath: packed.archivePath,
+    server: parsed.options.server,
+    token: parsed.options.token
+  });
+  if (prepared.errCode !== 0 || prepared.data === void 0) {
+    printApiResponse(prepared);
+    assertApiOk(prepared);
+    return;
+  }
+  const grantsByProject = resolveExplicitDataGrants(
+    packed.manifest.dependencies,
+    parsed.options.dataGrants
+  );
+  for (const [sourceProjectId, prefixes] of grantsByProject) {
+    const grant = await fetchApi({
+      server: parsed.options.server,
+      token: parsed.options.token,
+      path: `/api/workflows/${encodeURIComponent(sourceProjectId)}/data-source-grants/${encodeURIComponent(packed.manifest.rootProjectId)}`,
+      method: "PUT",
+      body: { keyPrefixes: prefixes }
+    });
+    if (grant.errCode !== 0) {
+      printApiResponse(grant);
+      assertApiOk(grant);
+      return;
+    }
+  }
+  if (!forcePublish && parsed.options.releaseLog === void 0 && parsed.options.publishGroup !== true) {
+    printApiResponse(prepared);
+    return;
+  }
+  const published = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/deployments/${encodeURIComponent(planned.data.id)}/publish`,
+    method: "POST"
+  });
+  printApiResponse(published);
+  assertApiOk(published);
+}
+async function commandPreparation(parsed) {
+  requireLogin(parsed);
+  const workflowId = requirePositional(parsed, 0, "workflow");
+  const jobId = requirePositional(parsed, 1, "jobId");
+  const result = await getPreparation({
+    workflowId,
+    jobId,
+    server: parsed.options.server,
+    token: parsed.options.token
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+}
+async function commandRun(parsed) {
+  requireLogin(parsed);
+  const workflowId = await resolveRemoteWorkflowId(parsed);
+  const workflowArgs = parsed.positional.slice(1);
+  const result = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/workflows/${encodeURIComponent(workflowId)}/run`,
+    method: "POST",
+    body: {
+      target: parsed.options.target ?? "latest",
+      entrypointId: parsed.options.entrypoint,
+      args: workflowArgs
+    }
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+}
+async function commandDebugNode(parsed) {
+  requireLogin(parsed);
+  const workflowId = await resolveRemoteWorkflowId(parsed);
+  const nodeName = requirePositional(parsed, 1, "node");
+  const workflowArgs = parsed.positional.slice(2);
+  const result = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/workflows/${encodeURIComponent(workflowId)}/debug/nodes/${encodeURIComponent(nodeName)}`,
+    method: "POST",
+    body: {
+      target: parsed.options.target ?? "latest",
+      entrypointId: parsed.options.entrypoint,
+      args: workflowArgs
+    }
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+}
+async function commandVersions(parsed) {
+  requireLogin(parsed);
+  const workflowId = await resolveRemoteWorkflowId(parsed);
+  const result = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/workflows/${encodeURIComponent(workflowId)}/versions`
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+}
+async function commandDownload(parsed) {
+  requireLogin(parsed);
+  const workflowArg = requirePositional(parsed, 0, "workflow");
+  const workflowId = await resolveRemoteWorkflowId(parsed);
+  const target = parsed.options.target ?? "latest";
+  if (target !== "draft") {
+    const result2 = await fetchApi({
+      server: parsed.options.server,
+      token: parsed.options.token,
+      path: `/api/workflows/${encodeURIComponent(workflowId)}/project-group-download?target=${encodeURIComponent(target)}`
+    });
+    assertApiOk(result2);
+    if (result2.errCode !== 0 || result2.data === void 0) {
+      printApiResponse(result2);
+      return;
+    }
+    const repoRoot2 = resolveRepoRoot();
+    const rootTargetDir = parsed.options.path ? path4.resolve(parsed.options.path) : path4.join(repoRoot2, "workspace", "workflow", workflowArg);
+    const materialized = await materializeProjectGroupDownload(result2.data, rootTargetDir);
+    const locallyAvailableProjectIds = new Set(materialized.map((project) => project.projectId));
+    const skippedDependencies = result2.data.skippedDependencies.filter((item) => item.dependency.delivery !== "included" || !locallyAvailableProjectIds.has(item.dependency.projectId));
+    const complete = !skippedDependencies.some((item) => item.dependency.delivery === "included");
+    printApiResponse({
+      ...result2,
+      data: {
+        ...result2.data,
+        complete,
+        copyAllowed: complete,
+        skippedDependencies,
+        projects: materialized
+      }
+    });
+    return;
+  }
+  const result = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/workflows/${encodeURIComponent(workflowId)}/files?target=${encodeURIComponent(target)}&includeBinary=true`
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+  if (result.errCode !== 0 || result.data === void 0) {
+    return;
+  }
+  const repoRoot = resolveRepoRoot();
+  const targetDir = parsed.options.path ? path4.resolve(parsed.options.path) : path4.join(repoRoot, "workspace", "workflow", workflowArg);
+  await rm2(targetDir, { recursive: true, force: true });
+  await mkdir3(targetDir, { recursive: true });
+  for (const file of result.data.files) {
+    const safePath = normalizeWorkflowFilePath(file.path);
+    const targetPath = path4.join(targetDir, safePath);
+    await mkdir3(path4.dirname(targetPath), { recursive: true });
+    await writeFile2(targetPath, decodeWorkflowFileContent(file));
+  }
+}
+async function commandPublish(parsed) {
+  requireLogin(parsed);
+  if (parsed.options.deployment !== void 0) {
+    const publishResult2 = await fetchApi({
+      server: parsed.options.server,
+      token: parsed.options.token,
+      path: `/api/deployments/${encodeURIComponent(parsed.options.deployment)}/publish`,
+      method: "POST"
+    });
+    printApiResponse(publishResult2);
+    assertApiOk(publishResult2);
+    return;
+  }
+  if (shouldUseProjectGroupUpload(parsed.options)) {
+    const workflowArg = requirePositional(parsed, 0, "workflow");
+    await commandProjectGroupUpload(parsed, workflowArg, true);
+    return;
+  }
+  const workflowId = await resolveRemoteWorkflowId(parsed);
+  const publishResult = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/workflows/${encodeURIComponent(workflowId)}/publish`,
+    method: "POST",
+    body: {
+      releaseLog: parsed.options.releaseLog,
+      sourceMode: parsed.options.sourceMode ?? "bundled"
+    }
+  });
+  printApiResponse(publishResult);
+  assertApiOk(publishResult);
+}
+async function materializeProjectGroupDownload(download, rootTargetDir) {
+  if (!isWorkflowUuid(download.rootProjectId)) {
+    throw new Error(i18n.t("projectGroupDownloadInvalidRootId", { ns: "cli" }));
+  }
+  const dependencies = parseWorkflowProjectDependencyLocks(download.dependencies, { published: true });
+  const includedDependencies = dependencies.filter((dependency) => dependency.delivery === "included");
+  const includedProjectIds = new Set(includedDependencies.map((dependency) => dependency.projectId));
+  const rootProjects = download.projects.filter((project) => project.role === "root");
+  if (rootProjects.length !== 1 || rootProjects[0]?.projectId !== download.rootProjectId) {
+    throw new Error(i18n.t("projectGroupDownloadRootCountInvalid", { ns: "cli" }));
+  }
+  const rootProject = rootProjects[0];
+  if (rootProject.version !== download.rootVersion) {
+    throw new Error(i18n.t("projectGroupDownloadRootVersionMismatch", { ns: "cli" }));
+  }
+  const rootPackageFile = rootProject.files.find((file) => normalizeWorkflowFilePath(file.path) === "package.json");
+  if (rootPackageFile === void 0 || rootPackageFile.encoding === "base64") {
+    throw new Error(i18n.t("projectGroupDownloadRootPackageUtf8", { ns: "cli" }));
+  }
+  let rootPackageJson;
+  try {
+    rootPackageJson = JSON.parse(rootPackageFile.content);
+  } catch {
+    throw new Error(i18n.t("projectGroupDownloadRootPackageInvalidJson", { ns: "cli" }));
+  }
+  const declaredSources = readKanbanArtifactConfig2(rootPackageJson).dataSources;
+  const selfReference = declaredSources.find((source) => source.projectId === download.rootProjectId);
+  if (selfReference !== void 0) {
+    throw new Error(i18n.t("projectGroupDownloadSelfReference", {
+      ns: "cli",
+      sourceId: JSON.stringify(selfReference.id)
+    }));
+  }
+  if (declaredSources.length !== dependencies.length || declaredSources.some((source) => {
+    const dependency = dependencies.find((candidate) => candidate.sourceId === source.id);
+    return dependency === void 0 || dependency.kind !== source.kind || dependency.projectId !== source.projectId || JSON.stringify(dependency.keyPrefixes) !== JSON.stringify(source.keyPrefixes);
+  })) {
+    throw new Error(i18n.t("projectGroupDownloadLockMismatch", { ns: "cli" }));
+  }
+  const responseProjectIds = /* @__PURE__ */ new Set();
+  for (const project of download.projects) {
+    if (!isWorkflowUuid(project.projectId) || responseProjectIds.has(project.projectId)) {
+      throw new Error(i18n.t("projectGroupDownloadInvalidOrDuplicateProjectId", {
+        ns: "cli",
+        projectId: JSON.stringify(project.projectId)
+      }));
+    }
+    responseProjectIds.add(project.projectId);
+    const filePaths = /* @__PURE__ */ new Set();
+    for (const file of project.files) {
+      const safePath = normalizeWorkflowFilePath(file.path);
+      if (isProjectGroupHostDataPath(safePath)) {
+        throw new Error(i18n.t("projectGroupDownloadForbiddenHostData", {
+          ns: "cli",
+          path: JSON.stringify(file.path)
+        }));
+      }
+      const fileKey = createPortableLocalPathKey(safePath);
+      if (filePaths.has(fileKey)) {
+        throw new Error(i18n.t("projectGroupDownloadDuplicateFile", {
+          ns: "cli",
+          path: JSON.stringify(safePath)
+        }));
+      }
+      filePaths.add(fileKey);
+    }
+    const packageFile = project.files.find((file) => normalizeWorkflowFilePath(file.path) === "package.json");
+    if (packageFile === void 0 || packageFile.encoding === "base64") {
+      throw new Error(i18n.t("projectGroupDownloadPackageUtf8", { ns: "cli", role: project.role }));
+    }
+    let packageJson;
+    try {
+      packageJson = JSON.parse(packageFile.content);
+    } catch {
+      throw new Error(i18n.t("projectGroupDownloadPackageInvalidJson", { ns: "cli", role: project.role }));
+    }
+    if (packageJson["id"] !== project.projectId) {
+      throw new Error(i18n.t("projectGroupDownloadedPackageIdMismatch", {
+        ns: "cli",
+        projectId: JSON.stringify(project.projectId)
+      }));
+    }
+    if (hashWorkflowSourceFiles(project.files) !== project.sourceHash) {
+      throw new Error(i18n.t("projectGroupDownloadSourceHashMismatch", {
+        ns: "cli",
+        role: project.role,
+        projectId: JSON.stringify(project.projectId)
+      }));
+    }
+    if (project.role === "root" && project.sourceId !== void 0) {
+      throw new Error(i18n.t("projectGroupDownloadRootSourceIdForbidden", { ns: "cli" }));
+    }
+    if (project.role === "dependency") {
+      const matchingDependencies = includedDependencies.filter((dependency) => dependency.projectId === project.projectId && dependency.version === project.version && dependency.sourceHash === project.sourceHash);
+      if (matchingDependencies.length === 0 || project.sourceId !== void 0 && !matchingDependencies.some((dependency) => dependency.sourceId === project.sourceId)) {
+        throw new Error(i18n.t("projectGroupDownloadUndeclaredDependency", {
+          ns: "cli",
+          projectId: JSON.stringify(project.projectId)
+        }));
+      }
+    }
+  }
+  const parentDir = path4.dirname(rootTargetDir);
+  const existingById = await findSiblingProjectsById(parentDir);
+  const materialized = [];
+  const pending = [];
+  const targetKeys = /* @__PURE__ */ new Set();
+  const orderedProjects = [...download.projects].sort((left, right) => left.role === right.role ? left.projectId.localeCompare(right.projectId) : left.role === "root" ? -1 : 1);
+  for (const project of orderedProjects) {
+    const existingPath = existingById.get(project.projectId);
+    if (existingPath !== void 0) {
+      await assertDownloadedProjectRole(existingPath, project.projectId, project.role);
+      materialized.push({
+        ...project.sourceId === void 0 ? {} : { sourceId: project.sourceId },
+        projectId: project.projectId,
+        projectName: project.projectName,
+        role: project.role,
+        path: existingPath,
+        alreadyAvailable: true
+      });
+      continue;
+    }
+    const targetDir = project.role === "root" ? rootTargetDir : path4.join(parentDir, createProjectDirectoryName(project.projectName, project.projectId));
+    if (existsSync2(targetDir)) {
+      throw new Error(i18n.t("projectGroupDownloadDirectoryProjectMismatch", {
+        ns: "cli",
+        projectName: JSON.stringify(project.projectName),
+        path: JSON.stringify(targetDir)
+      }));
+    }
+    const targetKey = createPortableLocalPathKey(path4.resolve(targetDir));
+    if (targetKeys.has(targetKey)) {
+      throw new Error(i18n.t("projectGroupDownloadDirectoryCollision", {
+        ns: "cli",
+        projectName: JSON.stringify(project.projectName),
+        path: JSON.stringify(targetDir)
+      }));
+    }
+    targetKeys.add(targetKey);
+    pending.push({ project, targetDir });
+  }
+  for (const projectId of includedProjectIds) {
+    if (responseProjectIds.has(projectId)) continue;
+    const existingPath = existingById.get(projectId);
+    if (existingPath === void 0) continue;
+    const packageJson = await assertDownloadedProjectRole(existingPath, projectId, "dependency");
+    materialized.push({
+      projectId,
+      projectName: readRequiredPackageString(packageJson, "name"),
+      role: "dependency",
+      path: existingPath,
+      alreadyAvailable: true
+    });
+  }
+  await mkdir3(parentDir, { recursive: true });
+  const stagingRoot = path4.join(parentDir, `.workflow-download-group-${randomUUID()}`);
+  const staged = [];
+  const moved = [];
+  try {
+    await mkdir3(stagingRoot, { recursive: false });
+    for (const item of pending) {
+      const { project, targetDir } = item;
+      const stagingDir = path4.join(stagingRoot, project.projectId);
+      await mkdir3(stagingDir, { recursive: true });
+      for (const file of project.files) {
+        const safePath = normalizeWorkflowFilePath(file.path);
+        const targetPath = path4.join(stagingDir, ...safePath.split("/"));
+        await mkdir3(path4.dirname(targetPath), { recursive: true });
+        await writeFile2(targetPath, decodeWorkflowFileContent(file));
+      }
+      const packageJson = await readPackageJsonFile(path4.join(stagingDir, "package.json"));
+      if (packageJson["id"] !== project.projectId) {
+        throw new Error(i18n.t("projectGroupDownloadedPackageIdMismatch", {
+          ns: "cli",
+          projectId: JSON.stringify(project.projectId)
+        }));
+      }
+      await assertDownloadedProjectRole(stagingDir, project.projectId, project.role, packageJson);
+      staged.push({ project, targetDir, stagingDir });
+    }
+    for (const item of staged) {
+      await rename(item.stagingDir, item.targetDir);
+      moved.push(item.targetDir);
+      existingById.set(item.project.projectId, item.targetDir);
+      materialized.push({
+        ...item.project.sourceId === void 0 ? {} : { sourceId: item.project.sourceId },
+        projectId: item.project.projectId,
+        projectName: item.project.projectName,
+        role: item.project.role,
+        path: item.targetDir,
+        alreadyAvailable: false
+      });
+    }
+  } catch (error) {
+    for (const targetDir of moved) {
+      await rm2(targetDir, { recursive: true, force: true }).catch(() => void 0);
+    }
+    throw error;
+  } finally {
+    await rm2(stagingRoot, { recursive: true, force: true }).catch(() => void 0);
+  }
+  return materialized.sort((left, right) => left.role === right.role ? left.projectId.localeCompare(right.projectId) : left.role === "root" ? -1 : 1);
+}
+async function assertDownloadedProjectRole(projectDir, projectId, role, packageJson) {
+  const metadata = packageJson ?? await readPackageJsonFile(path4.join(projectDir, "package.json"));
+  if (metadata["id"] !== projectId) {
+    throw new Error(i18n.t("projectGroupDownloadedPackageIdMismatch", {
+      ns: "cli",
+      projectId: JSON.stringify(projectId)
+    }));
+  }
+  const projectType = inspectLocalWorkflowStructure({ workflowDir: projectDir }).projectType;
+  const expectedProjectType = role === "root" ? "kanban" : "workflow";
+  if (projectType !== expectedProjectType) {
+    throw new Error(i18n.t("projectGroupDownloadedProjectTypeMismatch", {
+      ns: "cli",
+      projectId: JSON.stringify(projectId),
+      projectType: expectedProjectType
+    }));
+  }
+  return metadata;
+}
+function createPortableLocalPathKey(filePath) {
+  return filePath.normalize("NFC").toLowerCase();
+}
+function resolveExplicitDataGrants(dependencies, sourceIds) {
+  const selected = /* @__PURE__ */ new Set();
+  for (const sourceId of sourceIds) {
+    if (selected.has(sourceId)) {
+      throw new Error(i18n.t("duplicateGrantDataAccessSource", {
+        ns: "cli",
+        sourceId: JSON.stringify(sourceId)
+      }));
+    }
+    selected.add(sourceId);
+  }
+  const grants = /* @__PURE__ */ new Map();
+  for (const sourceId of selected) {
+    const dependency = dependencies.find((candidate) => candidate.sourceId === sourceId);
+    if (dependency === void 0) {
+      throw new Error(i18n.t("unknownGrantDataAccessSource", {
+        ns: "cli",
+        sourceId: JSON.stringify(sourceId)
+      }));
+    }
+    grants.set(dependency.projectId, [
+      ...grants.get(dependency.projectId) ?? [],
+      ...dependency.keyPrefixes
+    ]);
+  }
+  for (const [projectId, prefixes] of grants) {
+    grants.set(projectId, [...new Set(prefixes)]);
+  }
+  return grants;
+}
+async function findSiblingProjectsById(parentDir) {
+  const projects = /* @__PURE__ */ new Map();
+  const entries = await readdir2(parentDir, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const projectDir = path4.join(parentDir, entry.name);
+    const packageJson = await readPackageJsonFile(path4.join(projectDir, "package.json")).catch(() => void 0);
+    const projectId = packageJson?.["id"];
+    if (typeof projectId === "string" && isWorkflowUuid(projectId) && !projects.has(projectId)) {
+      projects.set(projectId, projectDir);
+    }
+  }
+  return projects;
+}
+function createProjectDirectoryName(projectName, projectId) {
+  const normalized = projectName.normalize("NFC").replace(/^@/, "").replace(/[\\/:*?"<>|\u0000-\u001f]/g, "-").replace(/^\.+|\.+$/g, "").trim();
+  return normalized === "" ? projectId : normalized;
+}
+async function commandHealth(parsed) {
+  const result = await fetchApi({
+    server: parsed.options.server,
+    token: "",
+    path: "/health",
+    auth: false
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+}
+async function packWorkflow(workflowName, outputPath, sourcePath, options = {}) {
+  const repoRoot = resolveRepoRoot();
+  const workflowDir = sourcePath === void 0 ? path4.join(repoRoot, "workspace", "workflow", workflowName) : path4.resolve(sourcePath);
+  await readPackageJsonFile(path4.join(workflowDir, "package.json"));
+  const packsDir = process.env.WORKFLOW_WORKSPACE_PACKS_DIR ? path4.resolve(process.env.WORKFLOW_WORKSPACE_PACKS_DIR) : path4.join(repoRoot, "workspace", ".packs");
+  const stagingDir = path4.join(packsDir, "tmp", randomUUID(), workflowName);
+  const archivePath = outputPath ? path4.resolve(outputPath) : path4.join(packsDir, `${workflowName}-${createTimestamp()}.tgz`);
+  const workspaceRoot = sourcePath === void 0 ? path4.join(repoRoot, "workspace", "workflow") : path4.dirname(workflowDir);
+  await rm2(path4.dirname(stagingDir), { recursive: true, force: true });
+  await mkdir3(path4.join(stagingDir, "workspace", "workflow"), { recursive: true });
+  await mkdir3(path4.dirname(archivePath), { recursive: true });
+  await stageWorkflowWithLocalDependencies({
+    workspaceRoot,
+    workflowDir,
+    workflowName,
+    stagingRoot: path4.join(stagingDir, "workspace", "workflow"),
+    projectGroupSafe: options.projectGroupSafe === true
+  });
+  const result = await runCommand("tar", ["-czf", archivePath, "-C", stagingDir, "."], {
+    cwd: repoRoot
+  });
+  await rm2(path4.dirname(stagingDir), { recursive: true, force: true });
+  if (result.exitCode !== 0) {
+    throw new Error(i18n.t("archiveCreateFailed", {
+      ns: "cli",
+      details: result.stderr || result.stdout
+    }));
+  }
+  return archivePath;
+}
+async function readProjectGroupContexts(options) {
+  const root = await readWorkflowPackageContext(options.workflowArg, options.sourcePath);
+  if (root.projectType !== "kanban") {
+    throw new Error(i18n.t("projectGroupRootMustBeKanban", { ns: "cli" }));
+  }
+  if (!root.workflowId) {
+    throw new Error(i18n.t("projectGroupRootIdRequired", { ns: "cli" }));
+  }
+  const dataSources = readKanbanArtifactConfig2(root.packageJson).dataSources;
+  const selfReference = dataSources.find((source) => source.projectId === root.workflowId);
+  if (selfReference !== void 0) {
+    throw new Error(i18n.t("projectGroupSelfReference", {
+      ns: "cli",
+      sourceId: JSON.stringify(selfReference.id)
+    }));
+  }
+  const dependencyPaths = /* @__PURE__ */ new Map();
+  for (const option of options.dependencyOptions) {
+    const separator = option.indexOf("=");
+    const sourceId = separator < 1 ? "" : option.slice(0, separator).trim();
+    const dependencyPath = separator < 0 ? "" : option.slice(separator + 1).trim();
+    if (sourceId === "" || dependencyPath === "") {
+      throw new Error(i18n.t("invalidDependencyOption", {
+        ns: "cli",
+        option: JSON.stringify(option)
+      }));
+    }
+    if (dependencyPaths.has(sourceId)) {
+      throw new Error(i18n.t("duplicateDependencySource", {
+        ns: "cli",
+        sourceId: JSON.stringify(sourceId)
+      }));
+    }
+    dependencyPaths.set(sourceId, path4.resolve(dependencyPath));
+  }
+  const locks = createWorkflowProjectDependencyLocks(
+    dataSources,
+    [...dependencyPaths.keys()].map((sourceId) => ({ sourceId, delivery: "included" }))
+  );
+  const dependenciesByProject = /* @__PURE__ */ new Map();
+  for (const [sourceId, dependencyPath] of dependencyPaths) {
+    const source = dataSources.find((candidate) => candidate.id === sourceId);
+    const context = await readWorkflowPackageContext(sourceId, dependencyPath);
+    if (context.projectType !== "workflow") {
+      throw new Error(i18n.t("dependencyMustBeWorkflow", {
+        ns: "cli",
+        sourceId: JSON.stringify(sourceId)
+      }));
+    }
+    if (context.workflowId !== source.projectId) {
+      throw new Error(i18n.t("dependencyPackageIdMismatch", {
+        ns: "cli",
+        sourceId: JSON.stringify(sourceId),
+        projectId: JSON.stringify(source.projectId)
+      }));
+    }
+    const existing = dependenciesByProject.get(source.projectId);
+    if (existing !== void 0 && existing.workflowDir !== context.workflowDir) {
+      throw new Error(i18n.t("dependencyProjectPathConflict", {
+        ns: "cli",
+        projectId: JSON.stringify(source.projectId)
+      }));
+    }
+    dependenciesByProject.set(source.projectId, context);
+  }
+  return { root, dependencies: [...dependenciesByProject.values()], locks };
+}
+async function packProjectGroup(options) {
+  const contexts = options.contexts ?? await readProjectGroupContexts(options);
+  const repoRoot = resolveRepoRoot();
+  const packsDir = process.env.WORKFLOW_WORKSPACE_PACKS_DIR ? path4.resolve(process.env.WORKFLOW_WORKSPACE_PACKS_DIR) : path4.join(repoRoot, "workspace", ".packs");
+  const groupRoot = path4.join(packsDir, "tmp", `project-group-${randomUUID()}`);
+  const projectsDir = path4.join(groupRoot, "projects");
+  const archivePath = options.outputPath ? path4.resolve(options.outputPath) : path4.join(packsDir, `project-group-${createTimestamp()}.tgz`);
+  await mkdir3(projectsDir, { recursive: true });
+  await mkdir3(path4.dirname(archivePath), { recursive: true });
+  const rootArchivePath = `projects/${contexts.root.workflowId}.tgz`;
+  const projects = [{
+    projectId: contexts.root.workflowId,
+    role: "root",
+    archivePath: rootArchivePath
+  }];
+  try {
+    await packWorkflow(
+      contexts.root.workflowArg,
+      path4.join(groupRoot, ...rootArchivePath.split("/")),
+      contexts.root.workflowDir,
+      { projectGroupSafe: true }
+    );
+    for (const dependency of contexts.dependencies) {
+      const dependencyArchivePath = `projects/${dependency.workflowId}.tgz`;
+      projects.push({
+        projectId: dependency.workflowId,
+        role: "dependency",
+        archivePath: dependencyArchivePath
+      });
+      await packWorkflow(
+        dependency.workflowArg,
+        path4.join(groupRoot, ...dependencyArchivePath.split("/")),
+        dependency.workflowDir,
+        { projectGroupSafe: true }
+      );
+    }
+    const manifest = {
+      version: 1,
+      rootProjectId: contexts.root.workflowId,
+      projects,
+      dependencies: contexts.locks
+    };
+    await writeFile2(path4.join(groupRoot, "project-group.json"), `${JSON.stringify(manifest, null, 2)}
+`);
+    const result = await runCommand("tar", ["-czf", archivePath, "-C", groupRoot, "."], { cwd: repoRoot });
+    if (result.exitCode !== 0) {
+      throw new Error(i18n.t("projectGroupArchiveCreateFailed", {
+        ns: "cli",
+        details: result.stderr || result.stdout
+      }));
+    }
+    return {
+      archivePath,
+      manifest,
+      root: contexts.root,
+      dependencies: contexts.dependencies
+    };
+  } finally {
+    await rm2(groupRoot, { recursive: true, force: true });
+  }
+}
+async function uploadProjectGroupPackage(options) {
+  const archiveBuffer = await readFile3(options.archivePath);
+  const archiveName = path4.basename(options.archivePath);
+  const response = await fetch(
+    `${trimTrailingSlash(options.server)}/api/deployments/${encodeURIComponent(options.deploymentId)}/package?fileName=${encodeURIComponent(archiveName)}`,
+    {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${options.token}`,
+        "content-type": "application/octet-stream",
+        "x-workflow-package-name": archiveName
+      },
+      body: new Blob([archiveBuffer])
+    }
+  );
+  return response.json();
+}
+async function resolveRemoteWorkflowId(parsed) {
+  const workflowArg = requirePositional(parsed, 0, "workflow");
+  if (isWorkflowUuid(workflowArg)) {
+    return workflowArg;
+  }
+  const packageContext = await readWorkflowPackageContext(workflowArg, parsed.options.path);
+  if (packageContext.workflowId) {
+    return packageContext.workflowId;
+  }
+  throw new Error(i18n.t("workflowNotBound", {
+    ns: "cli",
+    workflow: workflowArg
+  }));
+}
+async function readWorkflowPackageContext(workflowArg, sourcePath) {
+  const repoRoot = resolveRepoRoot();
+  const workflowDir = sourcePath === void 0 ? path4.join(repoRoot, "workspace", "workflow", workflowArg) : path4.resolve(sourcePath);
+  const packageJsonPath = path4.join(workflowDir, "package.json");
+  const packageJson = await readPackageJsonFile(packageJsonPath);
+  const workflowId = typeof packageJson.id === "string" && isWorkflowUuid(packageJson.id) ? packageJson.id.trim() : void 0;
+  const workflowName = readRequiredPackageString(packageJson, "name");
+  const projectType = inspectLocalWorkflowStructure({ workflowDir }).projectType;
+  return {
+    workflowArg,
+    workflowDir,
+    packageJsonPath,
+    workflowId,
+    workflowName,
+    projectType,
+    packageJson
+  };
+}
+async function ensureWorkflowProjectCreated(options) {
+  const created = await fetchApi({
+    server: options.server,
+    token: options.token,
+    path: "/api/workflows",
+    method: "POST",
+    body: {
+      name: options.packageContext.workflowName,
+      projectType: options.packageContext.projectType,
+      ...options.packageContext.workflowId ? { workflowId: options.packageContext.workflowId } : {}
+    }
+  });
+  if (created.errCode !== 0 || created.data === void 0) {
+    printApiResponse(created);
+    assertApiOk(created);
+    throw new Error(i18n.t("projectCreationFailed", { ns: "cli" }));
+  }
+  if (!options.packageContext.workflowId || options.packageContext.workflowId !== created.data.workflowId) {
+    await writeWorkflowPackageId(options.packageContext.packageJsonPath, created.data.workflowId);
+  }
+  return created.data;
+}
+async function readPackageJsonFile(packageJsonPath) {
+  try {
+    const raw = JSON.parse(await readFile3(packageJsonPath, "utf8"));
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      throw new Error(i18n.t("packageMustBeObject", { ns: "cli", path: packageJsonPath }));
+    }
+    return raw;
+  } catch (error) {
+    if (error instanceof Error) {
+      throw error;
+    }
+    throw new Error(i18n.t("packageReadFailed", { ns: "cli", path: packageJsonPath }));
+  }
+}
+function readRequiredPackageString(packageJson, key) {
+  const value = packageJson[key];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(i18n.t("packageStringRequired", { ns: "cli", key }));
+  }
+  return value.trim();
+}
+async function writeWorkflowPackageId(packageJsonPath, workflowId) {
+  const packageJson = await readPackageJsonFile(packageJsonPath);
+  await writeFile2(
+    packageJsonPath,
+    `${JSON.stringify({
+      ...packageJson,
+      id: workflowId
+    }, null, 2)}
+`
+  );
+}
+async function uploadPackage(options) {
+  const archiveBuffer = await readFile3(options.archivePath);
+  const archiveName = path4.basename(options.archivePath);
+  const response = await fetch(
+    `${trimTrailingSlash(options.server)}/api/workflows/${encodeURIComponent(options.workflowId)}/package?fileName=${encodeURIComponent(archiveName)}`,
+    {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${options.token}`,
+        "content-type": "application/octet-stream",
+        "x-workflow-package-name": archiveName,
+        "x-workflow-locale": getCurrentLocale()
+      },
+      body: new Blob([archiveBuffer])
+    }
+  );
+  return response.json();
+}
+async function waitForPreparation(options) {
+  let previousStage = "";
+  while (true) {
+    const response = await fetchApi({
+      server: options.server,
+      token: options.token,
+      path: `/api/workflows/${encodeURIComponent(options.workflowId)}/preparations/${encodeURIComponent(options.jobId)}`
+    });
+    if (response.errCode !== 0 || response.data === void 0) {
+      return response;
+    }
+    if (response.data.stage !== previousStage) {
+      previousStage = response.data.stage;
+      process.stderr.write(`${i18n.t("preparationProgress", {
+        ns: "cli",
+        status: response.data.status,
+        stage: response.data.stage
+      })}
+`);
+    }
+    if (response.data.status === "success") {
+      return {
+        errCode: 0,
+        errMessage: "",
+        data: response.data.result
+      };
+    }
+    if (response.data.status === "failed") {
+      return {
+        errCode: 500,
+        errMessage: response.data.failureReason ?? `Preparation failed during ${response.data.stage}.`,
+        data: response.data
+      };
+    }
+    await delay(options.pollIntervalMs ?? 1e3);
+  }
+}
+async function getPreparation(options) {
+  return fetchApi({
+    server: options.server,
+    token: options.token,
+    path: `/api/workflows/${encodeURIComponent(options.workflowId)}/preparations/${encodeURIComponent(options.jobId)}`
+  });
+}
+async function fetchApi(options) {
+  const headers = {};
+  if (options.auth !== false) {
+    headers.authorization = `Bearer ${options.token}`;
+  }
+  if (options.body !== void 0) {
+    headers["content-type"] = "application/json";
+  }
+  headers["x-workflow-locale"] = getCurrentLocale();
+  const response = await fetch(`${trimTrailingSlash(options.server)}${options.path}`, {
+    method: options.method ?? "GET",
+    headers,
+    body: options.body === void 0 ? void 0 : JSON.stringify(options.body)
+  });
+  return response.json();
+}
+async function copyWorkflowSource(sourceDir, targetDir, options = {}) {
+  if (options.projectGroupSafe !== true) return copyWorkflowUploadFiles(sourceDir, targetDir);
+  const plan = await createWorkflowUploadPlan(sourceDir);
+  const files = plan.files.filter((file) => !isProjectGroupHostDataPath(file.path));
+  const forbiddenRequiredPath = plan.requiredPaths.find((requiredPath) => isProjectGroupHostDataPath(requiredPath));
+  if (forbiddenRequiredPath !== void 0) {
+    throw new Error(i18n.t("projectGroupRequiredPathForbidden", {
+      ns: "cli",
+      path: JSON.stringify(forbiddenRequiredPath)
+    }));
+  }
+  await mkdir3(targetDir, { recursive: true });
+  for (const file of files) {
+    const targetPath = path4.join(targetDir, ...file.path.split("/"));
+    await mkdir3(path4.dirname(targetPath), { recursive: true });
+    await copyFile2(file.absolutePath, targetPath);
+  }
+  return {
+    ...plan,
+    files,
+    ignoredPaths: [...plan.ignoredPaths, ...plan.files.filter((file) => isProjectGroupHostDataPath(file.path)).map((file) => file.path)].sort((left, right) => left.localeCompare(right)),
+    totalBytes: files.reduce((total, file) => total + file.size, 0)
+  };
+}
+async function stageWorkflowWithLocalDependencies(options) {
+  const queue = [options.workflowName];
+  const visited = /* @__PURE__ */ new Set();
+  while (queue.length > 0) {
+    const currentWorkflowName = queue.shift();
+    if (!currentWorkflowName || visited.has(currentWorkflowName)) {
+      continue;
+    }
+    visited.add(currentWorkflowName);
+    const sourceDir = currentWorkflowName === options.workflowName ? options.workflowDir : path4.join(options.workspaceRoot, currentWorkflowName);
+    if (!existsSync2(path4.join(sourceDir, "package.json"))) {
+      throw new Error(i18n.t("localDependencyMissingPackage", {
+        ns: "cli",
+        workflow: options.workflowName,
+        dependency: currentWorkflowName,
+        path: sourceDir
+      }));
+    }
+    const uploadPlan = await copyWorkflowSource(
+      sourceDir,
+      path4.join(options.stagingRoot, currentWorkflowName),
+      { projectGroupSafe: options.projectGroupSafe }
+    );
+    if (currentWorkflowName === options.workflowName && !uploadPlan.workflowIgnoreConfigured) {
+      process.stderr.write(`${i18n.t("workflowIgnoreWarning", {
+        ns: "cli",
+        files: uploadPlan.files.length,
+        bytes: uploadPlan.totalBytes
+      })}
+`);
+    }
+    for (const dependency of await findLocalWorkflowDependencies(sourceDir)) {
+      if (!visited.has(dependency)) {
+        queue.push(dependency);
+      }
+    }
+  }
+}
+async function findLocalWorkflowDependencies(sourceDir) {
+  const discovered = /* @__PURE__ */ new Set();
+  for (const fileName of ["index.ts", "interface.ts", "globals.d.ts"]) {
+    const filePath = path4.join(sourceDir, fileName);
+    if (!existsSync2(filePath)) {
+      continue;
+    }
+    const source = await readFile3(filePath, "utf8");
+    for (const match of source.matchAll(/(?:from\s+|reference path=)\"(\.\.\/([^/\"']+)(?:\/[^\"']*)?)\"/g)) {
+      const workflowName = match[2]?.trim();
+      if (workflowName) {
+        discovered.add(workflowName);
+      }
+    }
+    for (const match of source.matchAll(/(?:from\s+|reference path=)'(\.\.\/([^/'"]+)(?:\/[^'"]*)?)'/g)) {
+      const workflowName = match[2]?.trim();
+      if (workflowName) {
+        discovered.add(workflowName);
+      }
+    }
+  }
+  return [...discovered].sort((left, right) => left.localeCompare(right));
+}
+function normalizeWorkflowFilePath(filePath) {
+  const normalized = filePath.replaceAll("\\", "/").replace(/^\.\/+/, "");
+  if (normalized === "" || normalized.startsWith("/") || /^[a-zA-Z]:/.test(normalized) || normalized.split("/").some((part) => part === "" || part === "." || part === "..")) {
+    throw new Error(i18n.t("invalidWorkflowFilePath", { ns: "cli", path: filePath }));
+  }
+  return normalized;
+}
+function decodeWorkflowFileContent(file) {
+  if (file.encoding === void 0) {
+    return file.content;
+  }
+  if (file.encoding !== "base64") {
+    throw new Error(i18n.t("unsupportedWorkflowEncoding", { ns: "cli", path: file.path }));
+  }
+  const normalized = file.content.replace(/=+$/, "");
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(file.content)) {
+    throw new Error(i18n.t("invalidBase64Content", { ns: "cli", path: file.path }));
+  }
+  const decoded = Buffer.from(file.content, "base64");
+  if (decoded.toString("base64").replace(/=+$/, "") !== normalized) {
+    throw new Error(i18n.t("invalidBase64Content", { ns: "cli", path: file.path }));
+  }
+  return decoded;
+}
+function hashWorkflowSourceFiles(files) {
+  const hash = createHash("sha256");
+  const normalizedFiles = files.map((file) => ({
+    file,
+    path: normalizeWorkflowFilePath(file.path)
+  })).sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+  for (const item of normalizedFiles) {
+    hash.update(item.path);
+    hash.update("\0");
+    hash.update(decodeWorkflowFileContent(item.file));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function parseArgs(argv) {
+  const [command = "", ...rest] = argv;
+  const positional = [];
+  const authConfig = readCliAuthConfigSync();
+  const options = {
+    server: process.env.WORKFLOW_SERVER_URL ?? authConfig.serverUrl ?? DEFAULT_SERVER_URL,
+    token: process.env.WORKFLOW_SERVER_ADMIN_KEY ?? authConfig.apiKey ?? "",
+    dependencies: [],
+    dataGrants: []
+  };
+  for (let index = 0; index < rest.length; index += 1) {
+    const arg = rest[index];
+    if (arg === "--") {
+      positional.push(...rest.slice(index + 1));
+      break;
+    }
+    switch (arg) {
+      case "--server":
+        options.server = requireValue(rest, index += 1, "--server");
+        break;
+      case "--token":
+        options.token = requireValue(rest, index += 1, "--token");
+        break;
+      case "--target":
+        options.target = requireValue(rest, index += 1, "--target");
+        break;
+      case "--entrypoint":
+        options.entrypoint = requireValue(rest, index += 1, "--entrypoint");
+        break;
+      case "--version":
+        throw new Error(i18n.t("versionOptionUnsupported", { ns: "cli" }));
+      case "--release-log":
+        options.releaseLog = requireValue(rest, index += 1, "--release-log");
+        break;
+      case "--file":
+        options.file = requireValue(rest, index += 1, "--file");
+        break;
+      case "--output":
+        options.output = requireValue(rest, index += 1, "--output");
+        break;
+      case "--path":
+        options.path = requireValue(rest, index += 1, "--path");
+        break;
+      case "--create":
+        options.create = true;
+        break;
+      case "--no-wait":
+        options.noWait = true;
+        break;
+      case "--dependency":
+        options.dependencies.push(requireValue(rest, index += 1, "--dependency"));
+        break;
+      case "--grant-data-access":
+        options.dataGrants.push(requireValue(rest, index += 1, "--grant-data-access"));
+        break;
+      case "--project-group":
+        options.projectGroup = true;
+        break;
+      case "--publish-group":
+        options.publishGroup = true;
+        break;
+      case "--deployment":
+        options.deployment = requireValue(rest, index += 1, "--deployment");
+        break;
+      case "--source-mode": {
+        const value = requireValue(rest, index += 1, "--source-mode");
+        if (value !== "bundled" && value !== "source") {
+          throw new Error(i18n.t("invalidSourceMode", { ns: "cli" }));
+        }
+        options.sourceMode = value;
+        break;
+      }
+      default:
+        positional.push(arg);
+        break;
+    }
+  }
+  if (command === "upload" && options.noWait === true && options.releaseLog !== void 0) {
+    throw new Error(i18n.t("noWaitReleaseLogConflict", { ns: "cli" }));
+  }
+  if (options.noWait === true && command !== "upload") {
+    throw new Error(i18n.t("noWaitCommandUnsupported", { ns: "cli" }));
+  }
+  if (command === "upload" && options.noWait === true && shouldUseProjectGroupUpload(options)) {
+    throw new Error(i18n.t("noWaitProjectGroupUnsupported", { ns: "cli" }));
+  }
+  if (options.dependencies.length > 0 && command !== "pack" && command !== "upload" && command !== "publish") {
+    throw new Error(i18n.t("dependencyOptionCommandUnsupported", { ns: "cli" }));
+  }
+  if (options.dataGrants.length > 0 && command !== "upload" && command !== "publish") {
+    throw new Error(i18n.t("grantDataAccessCommandUnsupported", { ns: "cli" }));
+  }
+  if (options.deployment !== void 0 && command !== "publish") {
+    throw new Error(i18n.t("deploymentCommandUnsupported", { ns: "cli" }));
+  }
+  if (options.publishGroup === true && command !== "upload") {
+    throw new Error(i18n.t("publishGroupCommandUnsupported", { ns: "cli" }));
+  }
+  if (options.projectGroup === true && command !== "pack" && command !== "upload" && command !== "publish") {
+    throw new Error(i18n.t("projectGroupCommandUnsupported", { ns: "cli" }));
+  }
+  if (options.deployment !== void 0 && (options.projectGroup === true || options.dependencies.length > 0 || options.dataGrants.length > 0 || options.path !== void 0 || options.file !== void 0 || options.output !== void 0 || options.create === true || options.releaseLog !== void 0 || options.sourceMode !== void 0)) {
+    throw new Error(i18n.t("deploymentOptionsConflict", { ns: "cli" }));
+  }
+  return {
+    command,
+    positional,
+    options
+  };
+}
+function requireLogin(parsed) {
+  if (parsed.options.server.trim() === "" || parsed.options.token.trim() === "") {
+    throw new Error(i18n.t("notLoggedIn", { ns: "cli" }));
+  }
+}
+function requirePositional(parsed, index, name) {
+  const value = parsed.positional[index];
+  if (value === void 0 || value.trim() === "") {
+    throw new Error(i18n.t("missingPositional", { ns: "cli", name }));
+  }
+  return value;
+}
+function requireValue(argv, index, name) {
+  const value = argv[index];
+  if (value === void 0 || value.trim() === "") {
+    throw new Error(i18n.t("missingOptionValue", { ns: "cli", name }));
+  }
+  return value;
+}
+function runCommand(command, args, options = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(chunk));
+    child.stderr.on("data", (chunk) => stderr.push(chunk));
+    child.on("error", (error) => {
+      resolve({
+        exitCode: 1,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: `${Buffer.concat(stderr).toString("utf8")}${error.message}`
+      });
+    });
+    child.on("close", (exitCode) => {
+      resolve({
+        exitCode: exitCode ?? 1,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8")
+      });
+    });
+  });
+}
+function printApiResponse(response) {
+  console.log(JSON.stringify(response, null, 2));
+}
+function assertApiOk(response) {
+  if (response.errCode !== 0) {
+    if (response.errCode === 403) {
+      process.stderr.write(`${formatForbiddenMessage(response)}
+`);
+    }
+    process.exitCode = 1;
+  }
+}
+function formatForbiddenMessage(response) {
+  const message = response.errMessage.toLowerCase();
+  if (message.includes("blocked from running")) {
+    return i18n.t("forbiddenBlocked", { ns: "cli" });
+  }
+  if (message.includes("permission denied")) {
+    return i18n.t("forbiddenNoPermission", { ns: "cli" });
+  }
+  return i18n.t("forbiddenFallback", { ns: "cli", message: response.errMessage });
+}
+function printUsage() {
+  console.log(i18n.t("workspaceHelp", { ns: "cli" }));
+}
+function resolveRepoRoot(startDir = process.cwd()) {
+  if (process.env.WORKFLOW_REPO_ROOT !== void 0) {
+    return path4.resolve(process.env.WORKFLOW_REPO_ROOT);
+  }
+  for (const candidate of [startDir, CLI_MODULE_DIR]) {
+    const repoRoot = findRepoRoot2(candidate);
+    if (repoRoot !== void 0) {
+      return repoRoot;
+    }
+  }
+  return process.cwd();
+}
+function findRepoRoot2(startDir) {
+  let current = path4.resolve(startDir);
+  while (true) {
+    if (isRepoRoot(current)) {
+      return current;
+    }
+    const parent = path4.dirname(current);
+    if (parent === current) {
+      return void 0;
+    }
+    current = parent;
+  }
+}
+function isRepoRoot(candidate) {
+  return existsSync2(path4.join(candidate, "pnpm-workspace.yaml")) && existsSync2(path4.join(candidate, "package.json")) && existsSync2(path4.join(candidate, "workspace", "package.json")) && existsSync2(path4.join(candidate, "packages", "cli", "package.json"));
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function createTimestamp() {
+  const date = /* @__PURE__ */ new Date();
+  const pad = (value) => String(value).padStart(2, "0");
+  return [
+    date.getUTCFullYear(),
+    pad(date.getUTCMonth() + 1),
+    pad(date.getUTCDate()),
+    "-",
+    pad(date.getUTCHours()),
+    pad(date.getUTCMinutes()),
+    pad(date.getUTCSeconds())
+  ].join("");
+}
+async function waitForDeviceToken(options) {
+  const expiresAtMs = new Date(options.expiresAt).getTime();
+  const pollMs = Math.max(1e3, options.intervalSeconds * 1e3);
+  while (!Number.isFinite(expiresAtMs) || Date.now() < expiresAtMs) {
+    const response = await fetchApi({
+      server: options.server,
+      token: "",
+      path: "/api/auth/device/token",
+      method: "POST",
+      body: { deviceCode: options.deviceCode },
+      auth: false
+    });
+    if (response.errCode === 0) {
+      return response;
+    }
+    if (response.errMessage === "slow_down") {
+      const retryAfterSeconds = readRetryAfterSeconds(response.data) ?? Math.max(options.intervalSeconds * 2, 5);
+      await delay(retryAfterSeconds * 1e3);
+      continue;
+    }
+    if (response.errMessage !== "authorization_pending") {
+      return response;
+    }
+    await delay(pollMs);
+  }
+  return {
+    errCode: 409,
+    errMessage: "expired_token"
+  };
+}
+async function openExternalBrowser(url) {
+  const commands = process.platform === "darwin" ? [["open", url]] : process.platform === "win32" ? [["cmd", "/c", "start", "", url]] : [["xdg-open", url]];
+  for (const [command, ...args] of commands) {
+    const result = await runCommand(command, args);
+    if (result.exitCode === 0) {
+      return;
+    }
+  }
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function readRetryAfterSeconds(data) {
+  if (typeof data !== "object" || data === null) {
+    return void 0;
+  }
+  const value = data.retryAfterSeconds;
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
+}
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL(path4.resolve(process.argv[1])).href) {
+  main().catch((error) => {
+    console.error(translateWorkflowCodeError(error));
+    process.exitCode = 1;
+  });
+}
+export {
+  decodeWorkflowFileContent,
+  ensureWorkflowProjectCreated,
+  findLocalWorkflowDependencies,
+  formatForbiddenMessage,
+  getPreparation,
+  main,
+  materializeProjectGroupDownload,
+  normalizeWorkflowFilePath,
+  packProjectGroup,
+  packWorkflow,
+  parseArgs,
+  readPackageJsonFile,
+  readProjectGroupContexts,
+  readWorkflowPackageContext,
+  resolveExplicitDataGrants,
+  resolveRemoteWorkflowId,
+  resolveRepoRoot,
+  shouldUseProjectGroupUpload,
+  stageWorkflowWithLocalDependencies,
+  waitForDeviceToken,
+  waitForPreparation,
+  writeWorkflowPackageId
+};