@workflow-code/cli 0.1.2 → 0.1.4-20260814002

package/dist/{workspace-QUP6RU65.js → workspace-HHW34WVB.js}

@@ -1,12 +1,16 @@
 #!/usr/bin/env node
 import {
   __commonJS,
-  __toESM
-} from "./chunk-FYS2JH42.js";
+  __toESM,
+  getCurrentLocale,
+  i18n,
+  prepareCliInvocation,
+  translateWorkflowCodeError
+} from "./chunk-3ZXXRODP.js";
 
-// ../../node_modules/.pnpm/ignore@7.0.6/node_modules/ignore/index.js
+// node_modules/.pnpm/ignore@7.0.6/node_modules/ignore/index.js
 var require_ignore = __commonJS({
-  "../../node_modules/.pnpm/ignore@7.0.6/node_modules/ignore/index.js"(exports, module) {
+  "node_modules/.pnpm/ignore@7.0.6/node_modules/ignore/index.js"(exports, module) {
     "use strict";
     function makeArray(subject) {
       return Array.isArray(subject) ? subject : [subject];
@@ -465,13 +469,13 @@ var require_ignore = __commonJS({
 
 // src/workspace.ts
 import { spawn } from "child_process";
-import { randomUUID } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import { existsSync as existsSync2 } from "fs";
-import { mkdir as mkdir3, readFile as readFile3, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { copyFile as copyFile2, mkdir as mkdir3, readFile as readFile3, readdir as readdir2, rename, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import path4 from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 
-// ../../shared/auth-config/index.ts
+// .shared/auth-config/index.ts
 var WORKFLOW_AUTH_FILE_NAME = "workflow-auth.json";
 var DEFAULT_MAC_PLATFORM = "darwin";
 var DEFAULT_WINDOWS_PLATFORM = "win32";
@@ -487,7 +491,7 @@ function normalizeWorkflowAuthConfig(value) {
     return createEmptyWorkflowAuthConfig();
   }
   return {
-    // issue #90 Accept legacy field names (remoteUrl, token) from pre-migration
+    // Accept legacy field names (remoteUrl, token) from pre-migration
     // config files so existing users don't lose their credentials on upgrade.
     serverUrl: readString(value.serverUrl) ?? readString(value.remoteUrl) ?? "",
     apiKey: readString(value.apiKey) ?? readString(value.token) ?? "",
@@ -576,24 +580,29 @@ function readGlobalProcess() {
   return processValue;
 }
 
-// ../../shared/workflow-ids/index.ts
+// .shared/workflow-ids/index.ts
 import path from "path";
 var WORKFLOW_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function isWorkflowUuid(value) {
   return WORKFLOW_UUID_PATTERN.test(value.trim());
 }
 
-// ../../shared/project-upload/node.ts
+// .shared/project-upload/node.ts
 import { copyFile, lstat, mkdir, readFile, readdir } from "fs/promises";
 import path2 from "path";
 
-// ../../shared/project-upload/index.ts
+// .shared/project-upload/index.ts
 var import_ignore = __toESM(require_ignore(), 1);
 
-// ../../shared/kanban-project/index.ts
+// .shared/kanban-project/index.ts
 var KANBAN_MANIFEST_FILE = "kanban.json";
 var KANBAN_ENTRY_FILE = "index.html";
 var KANBAN_ARTIFACT_DIR = ".";
+var KANBAN_DATA_SOURCE_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+var KANBAN_WORKFLOW_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var MAX_KANBAN_DATA_SOURCES = 32;
+var MAX_KANBAN_DATA_SOURCE_PREFIXES = 32;
+var MAX_KANBAN_DATA_SOURCE_KEY_LENGTH = 1024;
 function readPackageProjectType(value) {
   if (!isRecord2(value)) return void 0;
   const workflowCode = value["workflowCode"];
@@ -624,7 +633,8 @@ function readKanbanArtifactConfig(value) {
       "workflowCode.kanban.entry",
       KANBAN_ENTRY_FILE,
       false
-    )
+    ),
+    dataSources: parseKanbanDataSources(rawConfig?.["dataSources"])
   };
 }
 function createKanbanArtifactEntryPath(config) {
@@ -651,11 +661,72 @@ function readKanbanRelativePath(value, field, fallback, allowDot) {
   }
   return normalized;
 }
+function parseKanbanDataSources(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) {
+    throw new Error("package.json workflowCode.kanban.dataSources must be an array.");
+  }
+  if (value.length > MAX_KANBAN_DATA_SOURCES) {
+    throw new Error(`package.json workflowCode.kanban.dataSources supports at most ${MAX_KANBAN_DATA_SOURCES} items.`);
+  }
+  const ids = /* @__PURE__ */ new Set();
+  return value.map((item, index) => {
+    if (!isRecord2(item)) {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}] must be an object.`);
+    }
+    const supportedFields = /* @__PURE__ */ new Set(["id", "kind", "projectId", "keyPrefixes"]);
+    if (Object.keys(item).some((field) => !supportedFields.has(field))) {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}] contains unsupported fields.`);
+    }
+    const id = readNonEmptyString(item["id"], `workflowCode.kanban.dataSources[${index}].id`);
+    if (!KANBAN_DATA_SOURCE_ID_PATTERN.test(id)) {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].id is invalid.`);
+    }
+    if (ids.has(id)) {
+      throw new Error(`package.json workflowCode.kanban.dataSources contains duplicate id "${id}".`);
+    }
+    ids.add(id);
+    if (item["kind"] !== "workflow-kv") {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].kind is unsupported.`);
+    }
+    const projectId = readNonEmptyString(
+      item["projectId"],
+      `workflowCode.kanban.dataSources[${index}].projectId`
+    );
+    if (!KANBAN_WORKFLOW_UUID_PATTERN.test(projectId)) {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].projectId must be a UUID.`);
+    }
+    const rawPrefixes = item["keyPrefixes"];
+    if (!Array.isArray(rawPrefixes) || rawPrefixes.length === 0 || rawPrefixes.length > MAX_KANBAN_DATA_SOURCE_PREFIXES) {
+      throw new Error(
+        `package.json workflowCode.kanban.dataSources[${index}].keyPrefixes must contain 1 to ${MAX_KANBAN_DATA_SOURCE_PREFIXES} items.`
+      );
+    }
+    const keyPrefixes = rawPrefixes.map((prefix, prefixIndex) => {
+      const normalized = readNonEmptyString(
+        prefix,
+        `workflowCode.kanban.dataSources[${index}].keyPrefixes[${prefixIndex}]`
+      );
+      if (normalized.length > MAX_KANBAN_DATA_SOURCE_KEY_LENGTH || normalized.includes("\0")) {
+        throw new Error(`package.json workflowCode.kanban.dataSources[${index}].keyPrefixes[${prefixIndex}] is invalid.`);
+      }
+      return normalized;
+    });
+    if (new Set(keyPrefixes).size !== keyPrefixes.length) {
+      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].keyPrefixes contains duplicates.`);
+    }
+    return { id, kind: "workflow-kv", projectId, keyPrefixes };
+  });
+}
+function readNonEmptyString(value, field) {
+  if (typeof value !== "string" || value.trim() === "") throw new Error(`kanban.json ${field} must be a non-empty string.`);
+  return value.trim();
+}
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-// ../../shared/project-upload/index.ts
+// .shared/project-upload/index.ts
 var WORKFLOW_IGNORE_FILE = ".workflowignore";
 function hasWorkflowIgnoreRules(content) {
   if (content === void 0) return false;
@@ -730,7 +801,7 @@ function findEffectiveWorkflowIgnoreRule(normalizedPath, ruleLines) {
   return ignored ? effectiveRule : void 0;
 }
 
-// ../../shared/project-upload/node.ts
+// .shared/project-upload/node.ts
 async function createWorkflowUploadPlan(rootDir) {
   const projectRoot = path2.resolve(rootDir);
   const workflowIgnorePath = path2.join(projectRoot, WORKFLOW_IGNORE_FILE);
@@ -838,6 +909,15 @@ async function readWorkflowUploadUtf8File(filePath, label) {
   }
 }
 
+// src/workspace.ts
+import {
+  createWorkflowProjectDependencyLocks,
+  inspectLocalWorkflowStructure,
+  isProjectGroupHostDataPath,
+  parseWorkflowProjectDependencyLocks,
+  readKanbanArtifactConfig as readKanbanArtifactConfig2
+} from "workflow-code";
+
 // src/auth-config.ts
 import { readFileSync } from "fs";
 import { mkdir as mkdir2, readFile as readFile2, rm, writeFile } from "fs/promises";
@@ -876,7 +956,7 @@ import path3 from "path";
 import { parse } from "dotenv";
 function loadCliEnv() {
   const cliRoot = process.cwd();
-  const defaultRepoRoot = findRepoRoot(cliRoot) ?? cliRoot;
+  const defaultRepoRoot = findWorkspaceRepositoryRoot(cliRoot) ?? cliRoot;
   const initialRepoRoot = process.env.WORKFLOW_REPO_ROOT ? path3.resolve(process.env.WORKFLOW_REPO_ROOT) : defaultRepoRoot;
   loadEnvFiles([
     path3.join(cliRoot, ".env"),
@@ -887,10 +967,10 @@ function loadCliEnv() {
     loadEnvFiles([path3.join(resolvedRepoRoot, ".env")]);
   }
 }
-function findRepoRoot(startDir) {
+function findWorkspaceRepositoryRoot(startDir) {
   let current = path3.resolve(startDir);
   while (true) {
-    if (existsSync(path3.join(current, "pnpm-workspace.yaml")) && existsSync(path3.join(current, "packages", "cli", "package.json"))) {
+    if (existsSync(path3.join(current, "pnpm-workspace.yaml")) && existsSync(path3.join(current, "package.json")) && existsSync(path3.join(current, "workspace", "package.json")) && existsSync(path3.join(current, "workspace", "workflow"))) {
       return current;
     }
     const parent = path3.dirname(current);
@@ -920,7 +1000,10 @@ var DEFAULT_SERVER_URL = "http://localhost:7125";
 var CLI_MODULE_DIR = path4.dirname(fileURLToPath(import.meta.url));
 var DEFAULT_DEVICE_FLOW_CLIENT_NAME = "Workflow Workspace CLI";
 loadCliEnv();
-async function main(argv = process.argv.slice(2)) {
+async function main(argv = process.argv.slice(2), options = {}) {
+  if (options.localeInitialized !== true) {
+    argv = prepareCliInvocation(argv).argv;
+  }
   const parsed = parseArgs(argv);
   switch (parsed.command) {
     case "login":
@@ -966,13 +1049,13 @@ async function main(argv = process.argv.slice(2)) {
       printUsage();
       return;
     default:
-      throw new Error(`Unknown command: ${parsed.command}`);
+      throw new Error(i18n.t("unknownWorkspaceCommand", { ns: "cli", command: parsed.command }));
   }
 }
 async function commandLogin(parsed) {
   const server = parsed.options.server.trim();
   if (server === "") {
-    throw new Error("login requires --server.");
+    throw new Error(i18n.t("loginRequiresServer", { ns: "cli" }));
   }
   const started = await fetchApi({
     server,
@@ -980,7 +1063,7 @@ async function commandLogin(parsed) {
     path: "/api/auth/device/start",
     method: "POST",
     body: {
-      // issue #93 phase 1 moves workspace login to device flow and stores a
+      // phase 1 moves workspace login to device flow and stores a
       // dedicated CLI auth file instead of sharing the App config.
       clientName: DEFAULT_DEVICE_FLOW_CLIENT_NAME,
       source: "cli"
@@ -994,9 +1077,11 @@ async function commandLogin(parsed) {
   }
   const verificationUrl = started.data.verificationUriComplete || started.data.verificationUri;
   void openExternalBrowser(verificationUrl);
-  console.error(`Open the verification page to approve this login:
-${verificationUrl}
-User code: ${started.data.userCode}`);
+  console.error(i18n.t("deviceLoginPrompt", {
+    ns: "cli",
+    url: verificationUrl,
+    code: started.data.userCode
+  }));
   const completed = await waitForDeviceToken({
     server,
     deviceCode: started.data.deviceCode,
@@ -1048,12 +1133,26 @@ async function commandStatus() {
 }
 async function commandPack(parsed) {
   const workflowName = requirePositional(parsed, 0, "workflow");
+  if (parsed.options.projectGroup === true || parsed.options.publishGroup === true || parsed.options.dependencies.length > 0 || parsed.options.dataGrants.length > 0) {
+    const packed = await packProjectGroup({
+      workflowArg: workflowName,
+      sourcePath: parsed.options.path,
+      outputPath: parsed.options.output,
+      dependencyOptions: parsed.options.dependencies
+    });
+    console.log(JSON.stringify({ archivePath: packed.archivePath, manifest: packed.manifest }, null, 2));
+    return;
+  }
   const archivePath = await packWorkflow(workflowName, parsed.options.output, parsed.options.path);
   console.log(JSON.stringify({ archivePath }, null, 2));
 }
 async function commandUpload(parsed) {
   requireLogin(parsed);
   const workflowArg = requirePositional(parsed, 0, "workflow");
+  if (shouldUseProjectGroupUpload(parsed.options)) {
+    await commandProjectGroupUpload(parsed, workflowArg);
+    return;
+  }
   const packageContext = await readWorkflowPackageContext(workflowArg, parsed.options.path);
   let workflowId = packageContext.workflowId;
   if (parsed.options.create === true) {
@@ -1065,7 +1164,7 @@ async function commandUpload(parsed) {
     workflowId = created.workflowId;
   }
   if (!workflowId) {
-    throw new Error("Workflow package.json must include a UUID id. Use `workflow-code workspace upload <workflow> --create` after login to create and bind a server project.");
+    throw new Error(i18n.t("workflowIdRequired", { ns: "cli" }));
   }
   const archivePath = parsed.options.file ? path4.resolve(parsed.options.file) : await packWorkflow(workflowArg, parsed.options.output, parsed.options.path);
   const uploadResult = await uploadPackage({
@@ -1109,6 +1208,101 @@ async function commandUpload(parsed) {
     assertApiOk(publishResult);
   }
 }
+function shouldUseProjectGroupUpload(options) {
+  return options.projectGroup === true || options.publishGroup === true || options.dependencies.length > 0 || options.dataGrants.length > 0;
+}
+async function commandProjectGroupUpload(parsed, workflowArg, forcePublish = false) {
+  if (parsed.options.file !== void 0) {
+    throw new Error(i18n.t("projectGroupUploadFileUnsupported", { ns: "cli" }));
+  }
+  let rootContext = await readWorkflowPackageContext(workflowArg, parsed.options.path);
+  if (parsed.options.create === true || rootContext.workflowId !== void 0) {
+    await ensureWorkflowProjectCreated({
+      packageContext: rootContext,
+      server: parsed.options.server,
+      token: parsed.options.token
+    });
+    rootContext = await readWorkflowPackageContext(workflowArg, parsed.options.path);
+  }
+  if (!rootContext.workflowId) {
+    throw new Error(i18n.t("projectGroupUploadRootIdRequired", { ns: "cli" }));
+  }
+  const contexts = await readProjectGroupContexts({
+    workflowArg,
+    sourcePath: parsed.options.path,
+    dependencyOptions: parsed.options.dependencies
+  });
+  for (const dependency of contexts.dependencies) {
+    await ensureWorkflowProjectCreated({
+      packageContext: dependency,
+      server: parsed.options.server,
+      token: parsed.options.token
+    });
+  }
+  const packed = await packProjectGroup({
+    workflowArg,
+    sourcePath: parsed.options.path,
+    outputPath: parsed.options.output,
+    dependencyOptions: parsed.options.dependencies,
+    contexts
+  });
+  const planned = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: "/api/deployments",
+    method: "POST",
+    body: {
+      manifest: packed.manifest,
+      releaseLog: parsed.options.releaseLog
+    }
+  });
+  if (planned.errCode !== 0 || planned.data === void 0) {
+    printApiResponse(planned);
+    assertApiOk(planned);
+    return;
+  }
+  const prepared = await uploadProjectGroupPackage({
+    deploymentId: planned.data.id,
+    archivePath: packed.archivePath,
+    server: parsed.options.server,
+    token: parsed.options.token
+  });
+  if (prepared.errCode !== 0 || prepared.data === void 0) {
+    printApiResponse(prepared);
+    assertApiOk(prepared);
+    return;
+  }
+  const grantsByProject = resolveExplicitDataGrants(
+    packed.manifest.dependencies,
+    parsed.options.dataGrants
+  );
+  for (const [sourceProjectId, prefixes] of grantsByProject) {
+    const grant = await fetchApi({
+      server: parsed.options.server,
+      token: parsed.options.token,
+      path: `/api/workflows/${encodeURIComponent(sourceProjectId)}/data-source-grants/${encodeURIComponent(packed.manifest.rootProjectId)}`,
+      method: "PUT",
+      body: { keyPrefixes: prefixes }
+    });
+    if (grant.errCode !== 0) {
+      printApiResponse(grant);
+      assertApiOk(grant);
+      return;
+    }
+  }
+  if (!forcePublish && parsed.options.releaseLog === void 0 && parsed.options.publishGroup !== true) {
+    printApiResponse(prepared);
+    return;
+  }
+  const published = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/deployments/${encodeURIComponent(planned.data.id)}/publish`,
+    method: "POST"
+  });
+  printApiResponse(published);
+  assertApiOk(published);
+}
 async function commandPreparation(parsed) {
   requireLogin(parsed);
   const workflowId = requirePositional(parsed, 0, "workflow");
@@ -1133,6 +1327,7 @@ async function commandRun(parsed) {
     method: "POST",
     body: {
       target: parsed.options.target ?? "latest",
+      entrypointId: parsed.options.entrypoint,
       args: workflowArgs
     }
   });
@@ -1151,6 +1346,7 @@ async function commandDebugNode(parsed) {
     method: "POST",
     body: {
       target: parsed.options.target ?? "latest",
+      entrypointId: parsed.options.entrypoint,
       args: workflowArgs
     }
   });
@@ -1172,7 +1368,36 @@ async function commandDownload(parsed) {
   requireLogin(parsed);
   const workflowArg = requirePositional(parsed, 0, "workflow");
   const workflowId = await resolveRemoteWorkflowId(parsed);
-  const target = parsed.options.target ?? "draft";
+  const target = parsed.options.target ?? "latest";
+  if (target !== "draft") {
+    const result2 = await fetchApi({
+      server: parsed.options.server,
+      token: parsed.options.token,
+      path: `/api/workflows/${encodeURIComponent(workflowId)}/project-group-download?target=${encodeURIComponent(target)}`
+    });
+    assertApiOk(result2);
+    if (result2.errCode !== 0 || result2.data === void 0) {
+      printApiResponse(result2);
+      return;
+    }
+    const repoRoot2 = resolveRepoRoot();
+    const rootTargetDir = parsed.options.path ? path4.resolve(parsed.options.path) : path4.join(repoRoot2, "workspace", "workflow", workflowArg);
+    const materialized = await materializeProjectGroupDownload(result2.data, rootTargetDir);
+    const locallyAvailableProjectIds = new Set(materialized.map((project) => project.projectId));
+    const skippedDependencies = result2.data.skippedDependencies.filter((item) => item.dependency.delivery !== "included" || !locallyAvailableProjectIds.has(item.dependency.projectId));
+    const complete = !skippedDependencies.some((item) => item.dependency.delivery === "included");
+    printApiResponse({
+      ...result2,
+      data: {
+        ...result2.data,
+        complete,
+        copyAllowed: complete,
+        skippedDependencies,
+        projects: materialized
+      }
+    });
+    return;
+  }
   const result = await fetchApi({
     server: parsed.options.server,
     token: parsed.options.token,
@@ -1196,6 +1421,22 @@ async function commandDownload(parsed) {
 }
 async function commandPublish(parsed) {
   requireLogin(parsed);
+  if (parsed.options.deployment !== void 0) {
+    const publishResult2 = await fetchApi({
+      server: parsed.options.server,
+      token: parsed.options.token,
+      path: `/api/deployments/${encodeURIComponent(parsed.options.deployment)}/publish`,
+      method: "POST"
+    });
+    printApiResponse(publishResult2);
+    assertApiOk(publishResult2);
+    return;
+  }
+  if (shouldUseProjectGroupUpload(parsed.options)) {
+    const workflowArg = requirePositional(parsed, 0, "workflow");
+    await commandProjectGroupUpload(parsed, workflowArg, true);
+    return;
+  }
   const workflowId = await resolveRemoteWorkflowId(parsed);
   const publishResult = await fetchApi({
     server: parsed.options.server,
@@ -1210,6 +1451,279 @@ async function commandPublish(parsed) {
   printApiResponse(publishResult);
   assertApiOk(publishResult);
 }
+async function materializeProjectGroupDownload(download, rootTargetDir) {
+  if (!isWorkflowUuid(download.rootProjectId)) {
+    throw new Error(i18n.t("projectGroupDownloadInvalidRootId", { ns: "cli" }));
+  }
+  const dependencies = parseWorkflowProjectDependencyLocks(download.dependencies, { published: true });
+  const includedDependencies = dependencies.filter((dependency) => dependency.delivery === "included");
+  const includedProjectIds = new Set(includedDependencies.map((dependency) => dependency.projectId));
+  const rootProjects = download.projects.filter((project) => project.role === "root");
+  if (rootProjects.length !== 1 || rootProjects[0]?.projectId !== download.rootProjectId) {
+    throw new Error(i18n.t("projectGroupDownloadRootCountInvalid", { ns: "cli" }));
+  }
+  const rootProject = rootProjects[0];
+  if (rootProject.version !== download.rootVersion) {
+    throw new Error(i18n.t("projectGroupDownloadRootVersionMismatch", { ns: "cli" }));
+  }
+  const rootPackageFile = rootProject.files.find((file) => normalizeWorkflowFilePath(file.path) === "package.json");
+  if (rootPackageFile === void 0 || rootPackageFile.encoding === "base64") {
+    throw new Error(i18n.t("projectGroupDownloadRootPackageUtf8", { ns: "cli" }));
+  }
+  let rootPackageJson;
+  try {
+    rootPackageJson = JSON.parse(rootPackageFile.content);
+  } catch {
+    throw new Error(i18n.t("projectGroupDownloadRootPackageInvalidJson", { ns: "cli" }));
+  }
+  const declaredSources = readKanbanArtifactConfig2(rootPackageJson).dataSources;
+  const selfReference = declaredSources.find((source) => source.projectId === download.rootProjectId);
+  if (selfReference !== void 0) {
+    throw new Error(i18n.t("projectGroupDownloadSelfReference", {
+      ns: "cli",
+      sourceId: JSON.stringify(selfReference.id)
+    }));
+  }
+  if (declaredSources.length !== dependencies.length || declaredSources.some((source) => {
+    const dependency = dependencies.find((candidate) => candidate.sourceId === source.id);
+    return dependency === void 0 || dependency.kind !== source.kind || dependency.projectId !== source.projectId || JSON.stringify(dependency.keyPrefixes) !== JSON.stringify(source.keyPrefixes);
+  })) {
+    throw new Error(i18n.t("projectGroupDownloadLockMismatch", { ns: "cli" }));
+  }
+  const responseProjectIds = /* @__PURE__ */ new Set();
+  for (const project of download.projects) {
+    if (!isWorkflowUuid(project.projectId) || responseProjectIds.has(project.projectId)) {
+      throw new Error(i18n.t("projectGroupDownloadInvalidOrDuplicateProjectId", {
+        ns: "cli",
+        projectId: JSON.stringify(project.projectId)
+      }));
+    }
+    responseProjectIds.add(project.projectId);
+    const filePaths = /* @__PURE__ */ new Set();
+    for (const file of project.files) {
+      const safePath = normalizeWorkflowFilePath(file.path);
+      if (isProjectGroupHostDataPath(safePath)) {
+        throw new Error(i18n.t("projectGroupDownloadForbiddenHostData", {
+          ns: "cli",
+          path: JSON.stringify(file.path)
+        }));
+      }
+      const fileKey = createPortableLocalPathKey(safePath);
+      if (filePaths.has(fileKey)) {
+        throw new Error(i18n.t("projectGroupDownloadDuplicateFile", {
+          ns: "cli",
+          path: JSON.stringify(safePath)
+        }));
+      }
+      filePaths.add(fileKey);
+    }
+    const packageFile = project.files.find((file) => normalizeWorkflowFilePath(file.path) === "package.json");
+    if (packageFile === void 0 || packageFile.encoding === "base64") {
+      throw new Error(i18n.t("projectGroupDownloadPackageUtf8", { ns: "cli", role: project.role }));
+    }
+    let packageJson;
+    try {
+      packageJson = JSON.parse(packageFile.content);
+    } catch {
+      throw new Error(i18n.t("projectGroupDownloadPackageInvalidJson", { ns: "cli", role: project.role }));
+    }
+    if (packageJson["id"] !== project.projectId) {
+      throw new Error(i18n.t("projectGroupDownloadedPackageIdMismatch", {
+        ns: "cli",
+        projectId: JSON.stringify(project.projectId)
+      }));
+    }
+    if (hashWorkflowSourceFiles(project.files) !== project.sourceHash) {
+      throw new Error(i18n.t("projectGroupDownloadSourceHashMismatch", {
+        ns: "cli",
+        role: project.role,
+        projectId: JSON.stringify(project.projectId)
+      }));
+    }
+    if (project.role === "root" && project.sourceId !== void 0) {
+      throw new Error(i18n.t("projectGroupDownloadRootSourceIdForbidden", { ns: "cli" }));
+    }
+    if (project.role === "dependency") {
+      const matchingDependencies = includedDependencies.filter((dependency) => dependency.projectId === project.projectId && dependency.version === project.version && dependency.sourceHash === project.sourceHash);
+      if (matchingDependencies.length === 0 || project.sourceId !== void 0 && !matchingDependencies.some((dependency) => dependency.sourceId === project.sourceId)) {
+        throw new Error(i18n.t("projectGroupDownloadUndeclaredDependency", {
+          ns: "cli",
+          projectId: JSON.stringify(project.projectId)
+        }));
+      }
+    }
+  }
+  const parentDir = path4.dirname(rootTargetDir);
+  const existingById = await findSiblingProjectsById(parentDir);
+  const materialized = [];
+  const pending = [];
+  const targetKeys = /* @__PURE__ */ new Set();
+  const orderedProjects = [...download.projects].sort((left, right) => left.role === right.role ? left.projectId.localeCompare(right.projectId) : left.role === "root" ? -1 : 1);
+  for (const project of orderedProjects) {
+    const existingPath = existingById.get(project.projectId);
+    if (existingPath !== void 0) {
+      await assertDownloadedProjectRole(existingPath, project.projectId, project.role);
+      materialized.push({
+        ...project.sourceId === void 0 ? {} : { sourceId: project.sourceId },
+        projectId: project.projectId,
+        projectName: project.projectName,
+        role: project.role,
+        path: existingPath,
+        alreadyAvailable: true
+      });
+      continue;
+    }
+    const targetDir = project.role === "root" ? rootTargetDir : path4.join(parentDir, createProjectDirectoryName(project.projectName, project.projectId));
+    if (existsSync2(targetDir)) {
+      throw new Error(i18n.t("projectGroupDownloadDirectoryProjectMismatch", {
+        ns: "cli",
+        projectName: JSON.stringify(project.projectName),
+        path: JSON.stringify(targetDir)
+      }));
+    }
+    const targetKey = createPortableLocalPathKey(path4.resolve(targetDir));
+    if (targetKeys.has(targetKey)) {
+      throw new Error(i18n.t("projectGroupDownloadDirectoryCollision", {
+        ns: "cli",
+        projectName: JSON.stringify(project.projectName),
+        path: JSON.stringify(targetDir)
+      }));
+    }
+    targetKeys.add(targetKey);
+    pending.push({ project, targetDir });
+  }
+  for (const projectId of includedProjectIds) {
+    if (responseProjectIds.has(projectId)) continue;
+    const existingPath = existingById.get(projectId);
+    if (existingPath === void 0) continue;
+    const packageJson = await assertDownloadedProjectRole(existingPath, projectId, "dependency");
+    materialized.push({
+      projectId,
+      projectName: readRequiredPackageString(packageJson, "name"),
+      role: "dependency",
+      path: existingPath,
+      alreadyAvailable: true
+    });
+  }
+  await mkdir3(parentDir, { recursive: true });
+  const stagingRoot = path4.join(parentDir, `.workflow-download-group-${randomUUID()}`);
+  const staged = [];
+  const moved = [];
+  try {
+    await mkdir3(stagingRoot, { recursive: false });
+    for (const item of pending) {
+      const { project, targetDir } = item;
+      const stagingDir = path4.join(stagingRoot, project.projectId);
+      await mkdir3(stagingDir, { recursive: true });
+      for (const file of project.files) {
+        const safePath = normalizeWorkflowFilePath(file.path);
+        const targetPath = path4.join(stagingDir, ...safePath.split("/"));
+        await mkdir3(path4.dirname(targetPath), { recursive: true });
+        await writeFile2(targetPath, decodeWorkflowFileContent(file));
+      }
+      const packageJson = await readPackageJsonFile(path4.join(stagingDir, "package.json"));
+      if (packageJson["id"] !== project.projectId) {
+        throw new Error(i18n.t("projectGroupDownloadedPackageIdMismatch", {
+          ns: "cli",
+          projectId: JSON.stringify(project.projectId)
+        }));
+      }
+      await assertDownloadedProjectRole(stagingDir, project.projectId, project.role, packageJson);
+      staged.push({ project, targetDir, stagingDir });
+    }
+    for (const item of staged) {
+      await rename(item.stagingDir, item.targetDir);
+      moved.push(item.targetDir);
+      existingById.set(item.project.projectId, item.targetDir);
+      materialized.push({
+        ...item.project.sourceId === void 0 ? {} : { sourceId: item.project.sourceId },
+        projectId: item.project.projectId,
+        projectName: item.project.projectName,
+        role: item.project.role,
+        path: item.targetDir,
+        alreadyAvailable: false
+      });
+    }
+  } catch (error) {
+    for (const targetDir of moved) {
+      await rm2(targetDir, { recursive: true, force: true }).catch(() => void 0);
+    }
+    throw error;
+  } finally {
+    await rm2(stagingRoot, { recursive: true, force: true }).catch(() => void 0);
+  }
+  return materialized.sort((left, right) => left.role === right.role ? left.projectId.localeCompare(right.projectId) : left.role === "root" ? -1 : 1);
+}
+async function assertDownloadedProjectRole(projectDir, projectId, role, packageJson) {
+  const metadata = packageJson ?? await readPackageJsonFile(path4.join(projectDir, "package.json"));
+  if (metadata["id"] !== projectId) {
+    throw new Error(i18n.t("projectGroupDownloadedPackageIdMismatch", {
+      ns: "cli",
+      projectId: JSON.stringify(projectId)
+    }));
+  }
+  const projectType = inspectLocalWorkflowStructure({ workflowDir: projectDir }).projectType;
+  const expectedProjectType = role === "root" ? "kanban" : "workflow";
+  if (projectType !== expectedProjectType) {
+    throw new Error(i18n.t("projectGroupDownloadedProjectTypeMismatch", {
+      ns: "cli",
+      projectId: JSON.stringify(projectId),
+      projectType: expectedProjectType
+    }));
+  }
+  return metadata;
+}
+function createPortableLocalPathKey(filePath) {
+  return filePath.normalize("NFC").toLowerCase();
+}
+function resolveExplicitDataGrants(dependencies, sourceIds) {
+  const selected = /* @__PURE__ */ new Set();
+  for (const sourceId of sourceIds) {
+    if (selected.has(sourceId)) {
+      throw new Error(i18n.t("duplicateGrantDataAccessSource", {
+        ns: "cli",
+        sourceId: JSON.stringify(sourceId)
+      }));
+    }
+    selected.add(sourceId);
+  }
+  const grants = /* @__PURE__ */ new Map();
+  for (const sourceId of selected) {
+    const dependency = dependencies.find((candidate) => candidate.sourceId === sourceId);
+    if (dependency === void 0) {
+      throw new Error(i18n.t("unknownGrantDataAccessSource", {
+        ns: "cli",
+        sourceId: JSON.stringify(sourceId)
+      }));
+    }
+    grants.set(dependency.projectId, [
+      ...grants.get(dependency.projectId) ?? [],
+      ...dependency.keyPrefixes
+    ]);
+  }
+  for (const [projectId, prefixes] of grants) {
+    grants.set(projectId, [...new Set(prefixes)]);
+  }
+  return grants;
+}
+async function findSiblingProjectsById(parentDir) {
+  const projects = /* @__PURE__ */ new Map();
+  const entries = await readdir2(parentDir, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const projectDir = path4.join(parentDir, entry.name);
+    const packageJson = await readPackageJsonFile(path4.join(projectDir, "package.json")).catch(() => void 0);
+    const projectId = packageJson?.["id"];
+    if (typeof projectId === "string" && isWorkflowUuid(projectId) && !projects.has(projectId)) {
+      projects.set(projectId, projectDir);
+    }
+  }
+  return projects;
+}
+function createProjectDirectoryName(projectName, projectId) {
+  const normalized = projectName.normalize("NFC").replace(/^@/, "").replace(/[\\/:*?"<>|\u0000-\u001f]/g, "-").replace(/^\.+|\.+$/g, "").trim();
+  return normalized === "" ? projectId : normalized;
+}
 async function commandHealth(parsed) {
   const result = await fetchApi({
     server: parsed.options.server,
@@ -1220,7 +1734,7 @@ async function commandHealth(parsed) {
   printApiResponse(result);
   assertApiOk(result);
 }
-async function packWorkflow(workflowName, outputPath, sourcePath) {
+async function packWorkflow(workflowName, outputPath, sourcePath, options = {}) {
   const repoRoot = resolveRepoRoot();
   const workflowDir = sourcePath === void 0 ? path4.join(repoRoot, "workspace", "workflow", workflowName) : path4.resolve(sourcePath);
   await readPackageJsonFile(path4.join(workflowDir, "package.json"));
@@ -1235,17 +1749,166 @@ async function packWorkflow(workflowName, outputPath, sourcePath) {
     workspaceRoot,
     workflowDir,
     workflowName,
-    stagingRoot: path4.join(stagingDir, "workspace", "workflow")
+    stagingRoot: path4.join(stagingDir, "workspace", "workflow"),
+    projectGroupSafe: options.projectGroupSafe === true
   });
   const result = await runCommand("tar", ["-czf", archivePath, "-C", stagingDir, "."], {
     cwd: repoRoot
   });
   await rm2(path4.dirname(stagingDir), { recursive: true, force: true });
   if (result.exitCode !== 0) {
-    throw new Error(`Failed to create archive: ${result.stderr || result.stdout}`);
+    throw new Error(i18n.t("archiveCreateFailed", {
+      ns: "cli",
+      details: result.stderr || result.stdout
+    }));
   }
   return archivePath;
 }
+async function readProjectGroupContexts(options) {
+  const root = await readWorkflowPackageContext(options.workflowArg, options.sourcePath);
+  if (root.projectType !== "kanban") {
+    throw new Error(i18n.t("projectGroupRootMustBeKanban", { ns: "cli" }));
+  }
+  if (!root.workflowId) {
+    throw new Error(i18n.t("projectGroupRootIdRequired", { ns: "cli" }));
+  }
+  const dataSources = readKanbanArtifactConfig2(root.packageJson).dataSources;
+  const selfReference = dataSources.find((source) => source.projectId === root.workflowId);
+  if (selfReference !== void 0) {
+    throw new Error(i18n.t("projectGroupSelfReference", {
+      ns: "cli",
+      sourceId: JSON.stringify(selfReference.id)
+    }));
+  }
+  const dependencyPaths = /* @__PURE__ */ new Map();
+  for (const option of options.dependencyOptions) {
+    const separator = option.indexOf("=");
+    const sourceId = separator < 1 ? "" : option.slice(0, separator).trim();
+    const dependencyPath = separator < 0 ? "" : option.slice(separator + 1).trim();
+    if (sourceId === "" || dependencyPath === "") {
+      throw new Error(i18n.t("invalidDependencyOption", {
+        ns: "cli",
+        option: JSON.stringify(option)
+      }));
+    }
+    if (dependencyPaths.has(sourceId)) {
+      throw new Error(i18n.t("duplicateDependencySource", {
+        ns: "cli",
+        sourceId: JSON.stringify(sourceId)
+      }));
+    }
+    dependencyPaths.set(sourceId, path4.resolve(dependencyPath));
+  }
+  const locks = createWorkflowProjectDependencyLocks(
+    dataSources,
+    [...dependencyPaths.keys()].map((sourceId) => ({ sourceId, delivery: "included" }))
+  );
+  const dependenciesByProject = /* @__PURE__ */ new Map();
+  for (const [sourceId, dependencyPath] of dependencyPaths) {
+    const source = dataSources.find((candidate) => candidate.id === sourceId);
+    const context = await readWorkflowPackageContext(sourceId, dependencyPath);
+    if (context.projectType !== "workflow") {
+      throw new Error(i18n.t("dependencyMustBeWorkflow", {
+        ns: "cli",
+        sourceId: JSON.stringify(sourceId)
+      }));
+    }
+    if (context.workflowId !== source.projectId) {
+      throw new Error(i18n.t("dependencyPackageIdMismatch", {
+        ns: "cli",
+        sourceId: JSON.stringify(sourceId),
+        projectId: JSON.stringify(source.projectId)
+      }));
+    }
+    const existing = dependenciesByProject.get(source.projectId);
+    if (existing !== void 0 && existing.workflowDir !== context.workflowDir) {
+      throw new Error(i18n.t("dependencyProjectPathConflict", {
+        ns: "cli",
+        projectId: JSON.stringify(source.projectId)
+      }));
+    }
+    dependenciesByProject.set(source.projectId, context);
+  }
+  return { root, dependencies: [...dependenciesByProject.values()], locks };
+}
+async function packProjectGroup(options) {
+  const contexts = options.contexts ?? await readProjectGroupContexts(options);
+  const repoRoot = resolveRepoRoot();
+  const packsDir = process.env.WORKFLOW_WORKSPACE_PACKS_DIR ? path4.resolve(process.env.WORKFLOW_WORKSPACE_PACKS_DIR) : path4.join(repoRoot, "workspace", ".packs");
+  const groupRoot = path4.join(packsDir, "tmp", `project-group-${randomUUID()}`);
+  const projectsDir = path4.join(groupRoot, "projects");
+  const archivePath = options.outputPath ? path4.resolve(options.outputPath) : path4.join(packsDir, `project-group-${createTimestamp()}.tgz`);
+  await mkdir3(projectsDir, { recursive: true });
+  await mkdir3(path4.dirname(archivePath), { recursive: true });
+  const rootArchivePath = `projects/${contexts.root.workflowId}.tgz`;
+  const projects = [{
+    projectId: contexts.root.workflowId,
+    role: "root",
+    archivePath: rootArchivePath
+  }];
+  try {
+    await packWorkflow(
+      contexts.root.workflowArg,
+      path4.join(groupRoot, ...rootArchivePath.split("/")),
+      contexts.root.workflowDir,
+      { projectGroupSafe: true }
+    );
+    for (const dependency of contexts.dependencies) {
+      const dependencyArchivePath = `projects/${dependency.workflowId}.tgz`;
+      projects.push({
+        projectId: dependency.workflowId,
+        role: "dependency",
+        archivePath: dependencyArchivePath
+      });
+      await packWorkflow(
+        dependency.workflowArg,
+        path4.join(groupRoot, ...dependencyArchivePath.split("/")),
+        dependency.workflowDir,
+        { projectGroupSafe: true }
+      );
+    }
+    const manifest = {
+      version: 1,
+      rootProjectId: contexts.root.workflowId,
+      projects,
+      dependencies: contexts.locks
+    };
+    await writeFile2(path4.join(groupRoot, "project-group.json"), `${JSON.stringify(manifest, null, 2)}
+`);
+    const result = await runCommand("tar", ["-czf", archivePath, "-C", groupRoot, "."], { cwd: repoRoot });
+    if (result.exitCode !== 0) {
+      throw new Error(i18n.t("projectGroupArchiveCreateFailed", {
+        ns: "cli",
+        details: result.stderr || result.stdout
+      }));
+    }
+    return {
+      archivePath,
+      manifest,
+      root: contexts.root,
+      dependencies: contexts.dependencies
+    };
+  } finally {
+    await rm2(groupRoot, { recursive: true, force: true });
+  }
+}
+async function uploadProjectGroupPackage(options) {
+  const archiveBuffer = await readFile3(options.archivePath);
+  const archiveName = path4.basename(options.archivePath);
+  const response = await fetch(
+    `${trimTrailingSlash(options.server)}/api/deployments/${encodeURIComponent(options.deploymentId)}/package?fileName=${encodeURIComponent(archiveName)}`,
+    {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${options.token}`,
+        "content-type": "application/octet-stream",
+        "x-workflow-package-name": archiveName
+      },
+      body: new Blob([archiveBuffer])
+    }
+  );
+  return response.json();
+}
 async function resolveRemoteWorkflowId(parsed) {
   const workflowArg = requirePositional(parsed, 0, "workflow");
   if (isWorkflowUuid(workflowArg)) {
@@ -1255,7 +1918,10 @@ async function resolveRemoteWorkflowId(parsed) {
   if (packageContext.workflowId) {
     return packageContext.workflowId;
   }
-  throw new Error(`Workflow "${workflowArg}" is not bound to a server UUID. Create or bind it first with \`workflow-code workspace upload ${workflowArg} --create\`.`);
+  throw new Error(i18n.t("workflowNotBound", {
+    ns: "cli",
+    workflow: workflowArg
+  }));
 }
 async function readWorkflowPackageContext(workflowArg, sourcePath) {
   const repoRoot = resolveRepoRoot();
@@ -1264,12 +1930,14 @@ async function readWorkflowPackageContext(workflowArg, sourcePath) {
   const packageJson = await readPackageJsonFile(packageJsonPath);
   const workflowId = typeof packageJson.id === "string" && isWorkflowUuid(packageJson.id) ? packageJson.id.trim() : void 0;
   const workflowName = readRequiredPackageString(packageJson, "name");
+  const projectType = inspectLocalWorkflowStructure({ workflowDir }).projectType;
   return {
     workflowArg,
     workflowDir,
     packageJsonPath,
     workflowId,
     workflowName,
+    projectType,
     packageJson
   };
 }
@@ -1281,13 +1949,14 @@ async function ensureWorkflowProjectCreated(options) {
     method: "POST",
     body: {
       name: options.packageContext.workflowName,
+      projectType: options.packageContext.projectType,
       ...options.packageContext.workflowId ? { workflowId: options.packageContext.workflowId } : {}
     }
   });
   if (created.errCode !== 0 || created.data === void 0) {
     printApiResponse(created);
     assertApiOk(created);
-    throw new Error("Workflow project creation failed.");
+    throw new Error(i18n.t("projectCreationFailed", { ns: "cli" }));
   }
   if (!options.packageContext.workflowId || options.packageContext.workflowId !== created.data.workflowId) {
     await writeWorkflowPackageId(options.packageContext.packageJsonPath, created.data.workflowId);
@@ -1298,20 +1967,20 @@ async function readPackageJsonFile(packageJsonPath) {
   try {
     const raw = JSON.parse(await readFile3(packageJsonPath, "utf8"));
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-      throw new Error(`Workflow package "${packageJsonPath}" must contain a JSON object.`);
+      throw new Error(i18n.t("packageMustBeObject", { ns: "cli", path: packageJsonPath }));
     }
     return raw;
   } catch (error) {
     if (error instanceof Error) {
       throw error;
     }
-    throw new Error(`Unable to read workflow package "${packageJsonPath}".`);
+    throw new Error(i18n.t("packageReadFailed", { ns: "cli", path: packageJsonPath }));
   }
 }
 function readRequiredPackageString(packageJson, key) {
   const value = packageJson[key];
   if (typeof value !== "string" || value.trim() === "") {
-    throw new Error(`Workflow package.json must include string "${key}".`);
+    throw new Error(i18n.t("packageStringRequired", { ns: "cli", key }));
   }
   return value.trim();
 }
@@ -1336,7 +2005,8 @@ async function uploadPackage(options) {
       headers: {
         authorization: `Bearer ${options.token}`,
         "content-type": "application/octet-stream",
-        "x-workflow-package-name": archiveName
+        "x-workflow-package-name": archiveName,
+        "x-workflow-locale": getCurrentLocale()
       },
       body: new Blob([archiveBuffer])
     }
@@ -1356,7 +2026,11 @@ async function waitForPreparation(options) {
     }
     if (response.data.stage !== previousStage) {
       previousStage = response.data.stage;
-      process.stderr.write(`Preparation ${response.data.status}: ${response.data.stage}
+      process.stderr.write(`${i18n.t("preparationProgress", {
+        ns: "cli",
+        status: response.data.status,
+        stage: response.data.stage
+      })}
 `);
     }
     if (response.data.status === "success") {
@@ -1391,6 +2065,7 @@ async function fetchApi(options) {
   if (options.body !== void 0) {
     headers["content-type"] = "application/json";
   }
+  headers["x-workflow-locale"] = getCurrentLocale();
   const response = await fetch(`${trimTrailingSlash(options.server)}${options.path}`, {
     method: options.method ?? "GET",
     headers,
@@ -1398,8 +2073,29 @@ async function fetchApi(options) {
   });
   return response.json();
 }
-async function copyWorkflowSource(sourceDir, targetDir) {
-  return copyWorkflowUploadFiles(sourceDir, targetDir);
+async function copyWorkflowSource(sourceDir, targetDir, options = {}) {
+  if (options.projectGroupSafe !== true) return copyWorkflowUploadFiles(sourceDir, targetDir);
+  const plan = await createWorkflowUploadPlan(sourceDir);
+  const files = plan.files.filter((file) => !isProjectGroupHostDataPath(file.path));
+  const forbiddenRequiredPath = plan.requiredPaths.find((requiredPath) => isProjectGroupHostDataPath(requiredPath));
+  if (forbiddenRequiredPath !== void 0) {
+    throw new Error(i18n.t("projectGroupRequiredPathForbidden", {
+      ns: "cli",
+      path: JSON.stringify(forbiddenRequiredPath)
+    }));
+  }
+  await mkdir3(targetDir, { recursive: true });
+  for (const file of files) {
+    const targetPath = path4.join(targetDir, ...file.path.split("/"));
+    await mkdir3(path4.dirname(targetPath), { recursive: true });
+    await copyFile2(file.absolutePath, targetPath);
+  }
+  return {
+    ...plan,
+    files,
+    ignoredPaths: [...plan.ignoredPaths, ...plan.files.filter((file) => isProjectGroupHostDataPath(file.path)).map((file) => file.path)].sort((left, right) => left.localeCompare(right)),
+    totalBytes: files.reduce((total, file) => total + file.size, 0)
+  };
 }
 async function stageWorkflowWithLocalDependencies(options) {
   const queue = [options.workflowName];
@@ -1412,20 +2108,25 @@ async function stageWorkflowWithLocalDependencies(options) {
     visited.add(currentWorkflowName);
     const sourceDir = currentWorkflowName === options.workflowName ? options.workflowDir : path4.join(options.workspaceRoot, currentWorkflowName);
     if (!existsSync2(path4.join(sourceDir, "package.json"))) {
-      throw new Error(
-        `Workflow "${options.workflowName}" references local workflow "${currentWorkflowName}", but ${sourceDir} is missing package.json.`
-      );
+      throw new Error(i18n.t("localDependencyMissingPackage", {
+        ns: "cli",
+        workflow: options.workflowName,
+        dependency: currentWorkflowName,
+        path: sourceDir
+      }));
     }
     const uploadPlan = await copyWorkflowSource(
       sourceDir,
-      path4.join(options.stagingRoot, currentWorkflowName)
+      path4.join(options.stagingRoot, currentWorkflowName),
+      { projectGroupSafe: options.projectGroupSafe }
     );
     if (currentWorkflowName === options.workflowName && !uploadPlan.workflowIgnoreConfigured) {
-      process.stderr.write([
-        "Warning: .workflowignore is missing or has no active rules; all regular project files will be uploaded.",
-        `.gitignore is not used. Files: ${uploadPlan.files.length}; bytes: ${uploadPlan.totalBytes}.`,
-        ""
-      ].join("\n"));
+      process.stderr.write(`${i18n.t("workflowIgnoreWarning", {
+        ns: "cli",
+        files: uploadPlan.files.length,
+        bytes: uploadPlan.totalBytes
+      })}
+`);
     }
     for (const dependency of await findLocalWorkflowDependencies(sourceDir)) {
       if (!visited.has(dependency)) {
@@ -1460,7 +2161,7 @@ async function findLocalWorkflowDependencies(sourceDir) {
 function normalizeWorkflowFilePath(filePath) {
   const normalized = filePath.replaceAll("\\", "/").replace(/^\.\/+/, "");
   if (normalized === "" || normalized.startsWith("/") || /^[a-zA-Z]:/.test(normalized) || normalized.split("/").some((part) => part === "" || part === "." || part === "..")) {
-    throw new Error(`Invalid workflow file path "${filePath}".`);
+    throw new Error(i18n.t("invalidWorkflowFilePath", { ns: "cli", path: filePath }));
   }
   return normalized;
 }
@@ -1469,28 +2170,48 @@ function decodeWorkflowFileContent(file) {
     return file.content;
   }
   if (file.encoding !== "base64") {
-    throw new Error(`Unsupported encoding for workflow file "${file.path}".`);
+    throw new Error(i18n.t("unsupportedWorkflowEncoding", { ns: "cli", path: file.path }));
   }
   const normalized = file.content.replace(/=+$/, "");
   if (!/^[A-Za-z0-9+/]*={0,2}$/.test(file.content)) {
-    throw new Error(`Invalid base64 content for workflow file "${file.path}".`);
+    throw new Error(i18n.t("invalidBase64Content", { ns: "cli", path: file.path }));
   }
   const decoded = Buffer.from(file.content, "base64");
   if (decoded.toString("base64").replace(/=+$/, "") !== normalized) {
-    throw new Error(`Invalid base64 content for workflow file "${file.path}".`);
+    throw new Error(i18n.t("invalidBase64Content", { ns: "cli", path: file.path }));
   }
   return decoded;
 }
+function hashWorkflowSourceFiles(files) {
+  const hash = createHash("sha256");
+  const normalizedFiles = files.map((file) => ({
+    file,
+    path: normalizeWorkflowFilePath(file.path)
+  })).sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+  for (const item of normalizedFiles) {
+    hash.update(item.path);
+    hash.update("\0");
+    hash.update(decodeWorkflowFileContent(item.file));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
 function parseArgs(argv) {
   const [command = "", ...rest] = argv;
   const positional = [];
   const authConfig = readCliAuthConfigSync();
   const options = {
     server: process.env.WORKFLOW_SERVER_URL ?? authConfig.serverUrl ?? DEFAULT_SERVER_URL,
-    token: process.env.WORKFLOW_SERVER_ADMIN_KEY ?? authConfig.apiKey ?? ""
+    token: process.env.WORKFLOW_SERVER_ADMIN_KEY ?? authConfig.apiKey ?? "",
+    dependencies: [],
+    dataGrants: []
   };
   for (let index = 0; index < rest.length; index += 1) {
     const arg = rest[index];
+    if (arg === "--") {
+      positional.push(...rest.slice(index + 1));
+      break;
+    }
     switch (arg) {
       case "--server":
         options.server = requireValue(rest, index += 1, "--server");
@@ -1501,8 +2222,11 @@ function parseArgs(argv) {
       case "--target":
         options.target = requireValue(rest, index += 1, "--target");
         break;
+      case "--entrypoint":
+        options.entrypoint = requireValue(rest, index += 1, "--entrypoint");
+        break;
       case "--version":
-        throw new Error("--version is no longer supported. Publish versions are managed by the system.");
+        throw new Error(i18n.t("versionOptionUnsupported", { ns: "cli" }));
       case "--release-log":
         options.releaseLog = requireValue(rest, index += 1, "--release-log");
         break;
@@ -1521,10 +2245,25 @@ function parseArgs(argv) {
       case "--no-wait":
         options.noWait = true;
         break;
+      case "--dependency":
+        options.dependencies.push(requireValue(rest, index += 1, "--dependency"));
+        break;
+      case "--grant-data-access":
+        options.dataGrants.push(requireValue(rest, index += 1, "--grant-data-access"));
+        break;
+      case "--project-group":
+        options.projectGroup = true;
+        break;
+      case "--publish-group":
+        options.publishGroup = true;
+        break;
+      case "--deployment":
+        options.deployment = requireValue(rest, index += 1, "--deployment");
+        break;
       case "--source-mode": {
         const value = requireValue(rest, index += 1, "--source-mode");
         if (value !== "bundled" && value !== "source") {
-          throw new Error('--source-mode must be "bundled" or "source".');
+          throw new Error(i18n.t("invalidSourceMode", { ns: "cli" }));
         }
         options.sourceMode = value;
         break;
@@ -1535,7 +2274,31 @@ function parseArgs(argv) {
     }
   }
   if (command === "upload" && options.noWait === true && options.releaseLog !== void 0) {
-    throw new Error("--no-wait cannot be combined with --release-log because publishing requires a prepared draft.");
+    throw new Error(i18n.t("noWaitReleaseLogConflict", { ns: "cli" }));
+  }
+  if (options.noWait === true && command !== "upload") {
+    throw new Error(i18n.t("noWaitCommandUnsupported", { ns: "cli" }));
+  }
+  if (command === "upload" && options.noWait === true && shouldUseProjectGroupUpload(options)) {
+    throw new Error(i18n.t("noWaitProjectGroupUnsupported", { ns: "cli" }));
+  }
+  if (options.dependencies.length > 0 && command !== "pack" && command !== "upload" && command !== "publish") {
+    throw new Error(i18n.t("dependencyOptionCommandUnsupported", { ns: "cli" }));
+  }
+  if (options.dataGrants.length > 0 && command !== "upload" && command !== "publish") {
+    throw new Error(i18n.t("grantDataAccessCommandUnsupported", { ns: "cli" }));
+  }
+  if (options.deployment !== void 0 && command !== "publish") {
+    throw new Error(i18n.t("deploymentCommandUnsupported", { ns: "cli" }));
+  }
+  if (options.publishGroup === true && command !== "upload") {
+    throw new Error(i18n.t("publishGroupCommandUnsupported", { ns: "cli" }));
+  }
+  if (options.projectGroup === true && command !== "pack" && command !== "upload" && command !== "publish") {
+    throw new Error(i18n.t("projectGroupCommandUnsupported", { ns: "cli" }));
+  }
+  if (options.deployment !== void 0 && (options.projectGroup === true || options.dependencies.length > 0 || options.dataGrants.length > 0 || options.path !== void 0 || options.file !== void 0 || options.output !== void 0 || options.create === true || options.releaseLog !== void 0 || options.sourceMode !== void 0)) {
+    throw new Error(i18n.t("deploymentOptionsConflict", { ns: "cli" }));
   }
   return {
     command,
@@ -1545,20 +2308,20 @@ function parseArgs(argv) {
 }
 function requireLogin(parsed) {
   if (parsed.options.server.trim() === "" || parsed.options.token.trim() === "") {
-    throw new Error("Not logged in. Run: workspace login --server <url> or pass --token / WORKFLOW_SERVER_ADMIN_KEY.");
+    throw new Error(i18n.t("notLoggedIn", { ns: "cli" }));
   }
 }
 function requirePositional(parsed, index, name) {
   const value = parsed.positional[index];
   if (value === void 0 || value.trim() === "") {
-    throw new Error(`Missing ${name}.`);
+    throw new Error(i18n.t("missingPositional", { ns: "cli", name }));
   }
   return value;
 }
 function requireValue(argv, index, name) {
   const value = argv[index];
   if (value === void 0 || value.trim() === "") {
-    throw new Error(`Missing value for ${name}.`);
+    throw new Error(i18n.t("missingOptionValue", { ns: "cli", name }));
   }
   return value;
 }
@@ -1603,67 +2366,28 @@ function assertApiOk(response) {
 function formatForbiddenMessage(response) {
   const message = response.errMessage.toLowerCase();
   if (message.includes("blocked from running")) {
-    return "403: \u5F53\u524D\u8D26\u53F7\u5DF2\u88AB\u8BE5\u9879\u76EE\u7981\u6B62\u8FD0\u884C\u3002";
+    return i18n.t("forbiddenBlocked", { ns: "cli" });
   }
   if (message.includes("permission denied")) {
-    return "403: \u5F53\u524D\u8D26\u53F7\u5BF9\u8BE5\u9879\u76EE\u6CA1\u6709\u8DB3\u591F\u6743\u9650\u3002";
+    return i18n.t("forbiddenNoPermission", { ns: "cli" });
   }
-  return `403: ${response.errMessage}`;
+  return i18n.t("forbiddenFallback", { ns: "cli", message: response.errMessage });
 }
 function printUsage() {
-  console.log([
-    "Usage: workflow-code workspace <command> [args]",
-    "",
-    "Local repo wrapper:",
-    "  pnpm -C workspace workspace <command> [args]",
-    "",
-    "Commands:",
-    "  login --server <url>",
-    "  logout",
-    "  status",
-    "  health",
-    "  pack <workflow> [--path <workflow-dir>] [--output <file.tgz>]",
-    "  upload <workflow> [--path <workflow-dir>] [--file <archive>] [--release-log <text>] [--source-mode bundled|source] [--no-wait] [--create]",
-    "  preparation <workflow-id> <job-id>",
-    "  download <workflow> [--target draft|latest|version] [--path <dir>]",
-    "  publish <workflow> [--release-log <text>] [--source-mode bundled|source]",
-    "  run <workflow> [...args] [--target draft|latest|version]",
-    "  debug-node <workflow> <node> [...args] [--target draft|latest|version]",
-    "  versions <workflow>",
-    "",
-    "Options:",
-    "  --server <url>   Defaults to WORKFLOW_SERVER_URL, saved CLI auth, or http://localhost:7125",
-    "  --token <token>  Optional manual override. Defaults to WORKFLOW_SERVER_ADMIN_KEY or saved CLI auth API key"
-  ].join("\n"));
+  console.log(i18n.t("workspaceHelp", { ns: "cli" }));
 }
 function resolveRepoRoot(startDir = process.cwd()) {
   if (process.env.WORKFLOW_REPO_ROOT !== void 0) {
     return path4.resolve(process.env.WORKFLOW_REPO_ROOT);
   }
   for (const candidate of [startDir, CLI_MODULE_DIR]) {
-    const repoRoot = findRepoRoot2(candidate);
+    const repoRoot = findWorkspaceRepositoryRoot(candidate);
     if (repoRoot !== void 0) {
       return repoRoot;
     }
   }
   return process.cwd();
 }
-function findRepoRoot2(startDir) {
-  let current = path4.resolve(startDir);
-  while (true) {
-    if (isRepoRoot(current)) {
-      return current;
-    }
-    const parent = path4.dirname(current);
-    if (parent === current) {
-      return void 0;
-    }
-    current = parent;
-  }
-}
-function isRepoRoot(candidate) {
-  return existsSync2(path4.join(candidate, "pnpm-workspace.yaml")) && existsSync2(path4.join(candidate, "package.json")) && existsSync2(path4.join(candidate, "workspace", "package.json")) && existsSync2(path4.join(candidate, "packages", "cli", "package.json"));
-}
 function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
@@ -1731,7 +2455,7 @@ function readRetryAfterSeconds(data) {
 }
 if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL(path4.resolve(process.argv[1])).href) {
   main().catch((error) => {
-    console.error(error instanceof Error ? error.message : String(error));
+    console.error(translateWorkflowCodeError(error));
     process.exitCode = 1;
   });
 }
@@ -1742,13 +2466,18 @@ export {
   formatForbiddenMessage,
   getPreparation,
   main,
+  materializeProjectGroupDownload,
   normalizeWorkflowFilePath,
+  packProjectGroup,
   packWorkflow,
   parseArgs,
   readPackageJsonFile,
+  readProjectGroupContexts,
   readWorkflowPackageContext,
+  resolveExplicitDataGrants,
   resolveRemoteWorkflowId,
   resolveRepoRoot,
+  shouldUseProjectGroupUpload,
   stageWorkflowWithLocalDependencies,
   waitForDeviceToken,
   waitForPreparation,