@workflow-code/cli 0.2.2-20260826002 → 0.2.3-20260901001

package/dist/{workspace-Y4TEIVC7.js → workspace-4DAJK3ZR.js}

@@ -1,12 +1,28 @@
 #!/usr/bin/env node
 import {
-  __commonJS,
-  __toESM,
+  clearCliAuthConfig,
+  isWorkflowAuthExpiringSoon,
+  readCliAuthConfig,
+  readCliAuthConfigSync,
+  writeCliAuthConfig
+} from "./chunk-PGM3IPWA.js";
+import {
+  prepareCliInvocation
+} from "./chunk-DPFPLLLT.js";
+import {
+  isWorkflowUuid,
+  readWorkflowProjectInfo,
+  resolveWorkflowRelatedProjectAccess
+} from "./chunk-27OW6OJ3.js";
+import {
   getCurrentLocale,
   i18n,
-  prepareCliInvocation,
   translateWorkflowCodeError
-} from "./chunk-2DNWG5WR.js";
+} from "./chunk-TCYG46PO.js";
+import {
+  __commonJS,
+  __toESM
+} from "./chunk-NSPRIPOP.js";
 
 // node_modules/.pnpm/ignore@7.0.6/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -307,7 +323,7 @@ var require_ignore = __commonJS({
       //   path matching.
       // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
       // @returns {TestResult} true if a file is ignored
-      test(path5, checkUnignored, mode) {
+      test(path4, checkUnignored, mode) {
         let ignored = false;
         let unignored = false;
         let matchedRule;
@@ -316,7 +332,7 @@ var require_ignore = __commonJS({
           if (unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored) {
             return;
           }
-          const matched = rule[mode].test(path5);
+          const matched = rule[mode].test(path4);
           if (!matched) {
             return;
           }
@@ -337,17 +353,17 @@ var require_ignore = __commonJS({
     var throwError = (message, Ctor) => {
       throw new Ctor(message);
     };
-    var checkPath = (path5, originalPath, doThrow) => {
-      if (!isString(path5)) {
+    var checkPath = (path4, originalPath, doThrow) => {
+      if (!isString(path4)) {
         return doThrow(
           `path must be a string, but got \`${originalPath}\``,
           TypeError
         );
       }
-      if (!path5) {
+      if (!path4) {
         return doThrow(`path must not be empty`, TypeError);
       }
-      if (checkPath.isNotRelative(path5)) {
+      if (checkPath.isNotRelative(path4)) {
         const r = "`path.relative()`d";
         return doThrow(
           `path should be a ${r} string, but got "${originalPath}"`,
@@ -356,7 +372,7 @@ var require_ignore = __commonJS({
       }
       return true;
     };
-    var isNotRelative = (path5) => REGEX_TEST_INVALID_PATH.test(path5);
+    var isNotRelative = (path4) => REGEX_TEST_INVALID_PATH.test(path4);
     checkPath.isNotRelative = isNotRelative;
     checkPath.convert = (p) => p;
     var Ignore = class {
@@ -386,19 +402,19 @@ var require_ignore = __commonJS({
       }
       // @returns {TestResult}
       _test(originalPath, cache, checkUnignored, slices) {
-        const path5 = originalPath && checkPath.convert(originalPath);
+        const path4 = originalPath && checkPath.convert(originalPath);
         checkPath(
-          path5,
+          path4,
           originalPath,
           this._strictPathCheck ? throwError : RETURN_FALSE
         );
-        return this._t(path5, cache, checkUnignored, slices);
+        return this._t(path4, cache, checkUnignored, slices);
       }
-      checkIgnore(path5) {
-        if (!REGEX_TEST_TRAILING_SLASH.test(path5)) {
-          return this.test(path5);
+      checkIgnore(path4) {
+        if (!REGEX_TEST_TRAILING_SLASH.test(path4)) {
+          return this.test(path4);
         }
-        const slices = path5.split(SLASH).filter(Boolean);
+        const slices = path4.split(SLASH).filter(Boolean);
         slices.pop();
         if (slices.length) {
           const parent = this._t(
@@ -411,18 +427,18 @@ var require_ignore = __commonJS({
             return parent;
           }
         }
-        return this._rules.test(path5, false, MODE_CHECK_IGNORE);
+        return this._rules.test(path4, false, MODE_CHECK_IGNORE);
       }
-      _t(path5, cache, checkUnignored, slices) {
-        if (path5 in cache) {
-          return cache[path5];
+      _t(path4, cache, checkUnignored, slices) {
+        if (path4 in cache) {
+          return cache[path4];
         }
         if (!slices) {
-          slices = path5.split(SLASH).filter(Boolean);
+          slices = path4.split(SLASH).filter(Boolean);
         }
         slices.pop();
         if (!slices.length) {
-          return cache[path5] = this._rules.test(path5, checkUnignored, MODE_IGNORE);
+          return cache[path4] = this._rules.test(path4, checkUnignored, MODE_IGNORE);
         }
         const parent = this._t(
           slices.join(SLASH) + SLASH,
@@ -430,29 +446,29 @@ var require_ignore = __commonJS({
           checkUnignored,
           slices
         );
-        return cache[path5] = parent.ignored ? parent : this._rules.test(path5, checkUnignored, MODE_IGNORE);
+        return cache[path4] = parent.ignored ? parent : this._rules.test(path4, checkUnignored, MODE_IGNORE);
       }
-      ignores(path5) {
-        return this._test(path5, this._ignoreCache, false).ignored;
+      ignores(path4) {
+        return this._test(path4, this._ignoreCache, false).ignored;
       }
       createFilter() {
-        return (path5) => !this.ignores(path5);
+        return (path4) => !this.ignores(path4);
       }
       filter(paths) {
         return makeArray(paths).filter(this.createFilter());
       }
       // @returns {TestResult}
-      test(path5) {
-        return this._test(path5, this._testCache, true);
+      test(path4) {
+        return this._test(path4, this._testCache, true);
       }
     };
     var factory = (options) => new Ignore(options);
-    var isPathValid = (path5) => checkPath(path5 && checkPath.convert(path5), path5, RETURN_FALSE);
+    var isPathValid = (path4) => checkPath(path4 && checkPath.convert(path4), path4, RETURN_FALSE);
     var setupWindows = () => {
       const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
       checkPath.convert = makePosix;
       const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
-      checkPath.isNotRelative = (path5) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path5) || isNotRelative(path5);
+      checkPath.isNotRelative = (path4) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path4) || isNotRelative(path4);
     };
     if (
       // Detect `process` so that it can run in browsers.
@@ -471,122 +487,10 @@ var require_ignore = __commonJS({
 import { spawn } from "child_process";
 import { createHash, randomUUID } from "crypto";
 import { existsSync as existsSync2 } from "fs";
-import { copyFile as copyFile2, mkdir as mkdir3, readFile as readFile3, readdir as readdir2, rename, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import path4 from "path";
+import { copyFile as copyFile2, mkdir as mkdir2, readFile as readFile2, readdir as readdir2, rename, rm, writeFile } from "fs/promises";
+import path3 from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 
-// .shared/auth-config/index.ts
-var WORKFLOW_AUTH_FILE_NAME = "workflow-auth.json";
-var DEFAULT_MAC_PLATFORM = "darwin";
-var DEFAULT_WINDOWS_PLATFORM = "win32";
-var DEFAULT_OTHER_PLATFORM = "linux";
-function createEmptyWorkflowAuthConfig() {
-  return {
-    serverUrl: "",
-    apiKey: ""
-  };
-}
-function normalizeWorkflowAuthConfig(value) {
-  if (!isRecord(value)) {
-    return createEmptyWorkflowAuthConfig();
-  }
-  return {
-    // Accept legacy field names (remoteUrl, token) from pre-migration
-    // config files so existing users don't lose their credentials on upgrade.
-    serverUrl: readString(value.serverUrl) ?? readString(value.remoteUrl) ?? "",
-    apiKey: readString(value.apiKey) ?? readString(value.token) ?? "",
-    expiresAt: readString(value.expiresAt),
-    user: isRecord(value.user) ? {
-      userId: readString(value.user.userId) ?? "",
-      email: readString(value.user.email) ?? "",
-      displayName: readString(value.user.displayName) ?? "",
-      avatarUrl: readString(value.user.avatarUrl)
-    } : void 0,
-    source: value.source === "device_flow" || value.source === "manual" || value.source === "password" ? value.source : void 0
-  };
-}
-function isWorkflowAuthExpiringSoon(expiresAt, options = {}) {
-  if (!expiresAt) {
-    return false;
-  }
-  const expiresAtMs = new Date(expiresAt).getTime();
-  if (!Number.isFinite(expiresAtMs)) {
-    return false;
-  }
-  const now = options.now ?? Date.now();
-  const thresholdMs = options.thresholdMs ?? 1e3 * 60 * 60 * 24 * 3;
-  return expiresAtMs - now <= thresholdMs;
-}
-function resolveWorkflowCliAuthDir(env = readProcessEnv()) {
-  if (readString(env.WORKFLOW_CLI_AUTH_DIR)) {
-    return normalizePath(env.WORKFLOW_CLI_AUTH_DIR);
-  }
-  if (readPlatform(env) === DEFAULT_WINDOWS_PLATFORM) {
-    return joinPath(
-      env.APPDATA ?? joinPath(resolveHomeDir(env), "AppData", "Roaming"),
-      "workflow-code"
-    );
-  }
-  if (readPlatform(env) === DEFAULT_MAC_PLATFORM) {
-    return joinPath(resolveHomeDir(env), "Library", "Application Support", "workflow-code");
-  }
-  return joinPath(
-    env.XDG_CONFIG_HOME ?? joinPath(resolveHomeDir(env), ".config"),
-    "workflow-code"
-  );
-}
-function resolveWorkflowCliAuthFilePath(env = readProcessEnv()) {
-  return joinPath(resolveWorkflowCliAuthDir(env), WORKFLOW_AUTH_FILE_NAME);
-}
-function resolveHomeDir(env) {
-  return env.HOME ?? "";
-}
-function readPlatform(env) {
-  return env.platform ?? readProcessPlatform();
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function readString(value) {
-  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
-}
-function joinPath(...parts) {
-  return normalizePath(parts.filter((part) => part !== "").join("/"));
-}
-function normalizePath(value) {
-  const normalized = value.replaceAll("\\", "/");
-  if (/^[A-Za-z]:\//.test(normalized)) {
-    const drive = normalized.slice(0, 2);
-    const rest = normalized.slice(2).replace(/\/+/g, "/");
-    return `${drive}${rest.startsWith("/") ? rest : `/${rest}`}`;
-  }
-  return normalized.replace(/\/+/g, "/");
-}
-function readProcessEnv() {
-  const processValue = readGlobalProcess();
-  return {
-    ...processValue?.env ?? {},
-    platform: processValue?.platform ?? DEFAULT_OTHER_PLATFORM
-  };
-}
-function readProcessPlatform() {
-  return readGlobalProcess()?.platform ?? DEFAULT_OTHER_PLATFORM;
-}
-function readGlobalProcess() {
-  const processValue = Reflect.get(globalThis, "process");
-  if (typeof processValue !== "object" || processValue === null) {
-    return void 0;
-  }
-  return processValue;
-}
-
-// .shared/workflow-ids/index.ts
-import path from "path";
-var WORKFLOW_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-function isWorkflowUuid(value) {
-  return WORKFLOW_UUID_PATTERN.test(value.trim());
-}
-
 // .shared/project-types/index.ts
 var WORKFLOW_PROJECT_TYPE_DEFINITIONS = [
   {
@@ -633,7 +537,7 @@ function mapNodePlatformToWorkflowDesktopPlatform(platform) {
 
 // .shared/project-upload/node.ts
 import { copyFile, lstat, mkdir, readFile, readdir } from "fs/promises";
-import path2 from "path";
+import path from "path";
 
 // .shared/project-upload/index.ts
 var import_ignore = __toESM(require_ignore(), 1);
@@ -642,29 +546,29 @@ var import_ignore = __toESM(require_ignore(), 1);
 var KANBAN_MANIFEST_FILE = "kanban.json";
 var KANBAN_ENTRY_FILE = "index.html";
 var KANBAN_ARTIFACT_DIR = ".";
-var KANBAN_DATA_SOURCE_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
-var KANBAN_WORKFLOW_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-var MAX_KANBAN_DATA_SOURCES = 32;
-var MAX_KANBAN_DATA_SOURCE_PREFIXES = 32;
-var MAX_KANBAN_DATA_SOURCE_KEY_LENGTH = 1024;
 function readPackageProjectType(value) {
-  if (!isRecord2(value)) return void 0;
+  if (!isRecord(value)) return void 0;
   const workflowCode = value["workflowCode"];
-  if (!isRecord2(workflowCode)) return void 0;
+  if (!isRecord(workflowCode)) return void 0;
   return workflowCode["projectType"] === "kanban" ? "kanban" : void 0;
 }
 function readKanbanArtifactConfig(value) {
-  if (!isRecord2(value)) {
+  if (!isRecord(value)) {
     throw new Error("package.json root must be an object.");
   }
   const workflowCode = value["workflowCode"];
-  if (!isRecord2(workflowCode)) {
+  if (!isRecord(workflowCode)) {
     throw new Error("package.json workflowCode must be an object for a Kanban project.");
   }
   const rawConfig = workflowCode["kanban"];
-  if (rawConfig !== void 0 && !isRecord2(rawConfig)) {
+  if (rawConfig !== void 0 && !isRecord(rawConfig)) {
     throw new Error("package.json workflowCode.kanban must be an object.");
   }
+  if (rawConfig?.["dataSources"] !== void 0) {
+    throw new Error(
+      "package.json workflowCode.kanban.dataSources was removed; declare workflowCode.projectInfo.relatedProjects instead."
+    );
+  }
   return {
     artifactDir: readKanbanRelativePath(
       rawConfig?.["artifactDir"],
@@ -677,8 +581,7 @@ function readKanbanArtifactConfig(value) {
       "workflowCode.kanban.entry",
       KANBAN_ENTRY_FILE,
       false
-    ),
-    dataSources: parseKanbanDataSources(rawConfig?.["dataSources"])
+    )
   };
 }
 function createKanbanArtifactEntryPath(config) {
@@ -705,68 +608,7 @@ function readKanbanRelativePath(value, field, fallback, allowDot) {
   }
   return normalized;
 }
-function parseKanbanDataSources(value) {
-  if (value === void 0) return [];
-  if (!Array.isArray(value)) {
-    throw new Error("package.json workflowCode.kanban.dataSources must be an array.");
-  }
-  if (value.length > MAX_KANBAN_DATA_SOURCES) {
-    throw new Error(`package.json workflowCode.kanban.dataSources supports at most ${MAX_KANBAN_DATA_SOURCES} items.`);
-  }
-  const ids = /* @__PURE__ */ new Set();
-  return value.map((item, index) => {
-    if (!isRecord2(item)) {
-      throw new Error(`package.json workflowCode.kanban.dataSources[${index}] must be an object.`);
-    }
-    const supportedFields = /* @__PURE__ */ new Set(["id", "kind", "projectId", "keyPrefixes"]);
-    if (Object.keys(item).some((field) => !supportedFields.has(field))) {
-      throw new Error(`package.json workflowCode.kanban.dataSources[${index}] contains unsupported fields.`);
-    }
-    const id = readNonEmptyString(item["id"], `workflowCode.kanban.dataSources[${index}].id`);
-    if (!KANBAN_DATA_SOURCE_ID_PATTERN.test(id)) {
-      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].id is invalid.`);
-    }
-    if (ids.has(id)) {
-      throw new Error(`package.json workflowCode.kanban.dataSources contains duplicate id "${id}".`);
-    }
-    ids.add(id);
-    if (item["kind"] !== "workflow-kv") {
-      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].kind is unsupported.`);
-    }
-    const projectId = readNonEmptyString(
-      item["projectId"],
-      `workflowCode.kanban.dataSources[${index}].projectId`
-    );
-    if (!KANBAN_WORKFLOW_UUID_PATTERN.test(projectId)) {
-      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].projectId must be a UUID.`);
-    }
-    const rawPrefixes = item["keyPrefixes"];
-    if (!Array.isArray(rawPrefixes) || rawPrefixes.length === 0 || rawPrefixes.length > MAX_KANBAN_DATA_SOURCE_PREFIXES) {
-      throw new Error(
-        `package.json workflowCode.kanban.dataSources[${index}].keyPrefixes must contain 1 to ${MAX_KANBAN_DATA_SOURCE_PREFIXES} items.`
-      );
-    }
-    const keyPrefixes = rawPrefixes.map((prefix, prefixIndex) => {
-      const normalized = readNonEmptyString(
-        prefix,
-        `workflowCode.kanban.dataSources[${index}].keyPrefixes[${prefixIndex}]`
-      );
-      if (normalized.length > MAX_KANBAN_DATA_SOURCE_KEY_LENGTH || normalized.includes("\0")) {
-        throw new Error(`package.json workflowCode.kanban.dataSources[${index}].keyPrefixes[${prefixIndex}] is invalid.`);
-      }
-      return normalized;
-    });
-    if (new Set(keyPrefixes).size !== keyPrefixes.length) {
-      throw new Error(`package.json workflowCode.kanban.dataSources[${index}].keyPrefixes contains duplicates.`);
-    }
-    return { id, kind: "workflow-kv", projectId, keyPrefixes };
-  });
-}
-function readNonEmptyString(value, field) {
-  if (typeof value !== "string" || value.trim() === "") throw new Error(`kanban.json ${field} must be a non-empty string.`);
-  return value.trim();
-}
-function isRecord2(value) {
+function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -847,8 +689,8 @@ function findEffectiveWorkflowIgnoreRule(normalizedPath, ruleLines) {
 
 // .shared/project-upload/node.ts
 async function createWorkflowUploadPlan(rootDir) {
-  const projectRoot = path2.resolve(rootDir);
-  const workflowIgnorePath = path2.join(projectRoot, WORKFLOW_IGNORE_FILE);
+  const projectRoot = path.resolve(rootDir);
+  const workflowIgnorePath = path.join(projectRoot, WORKFLOW_IGNORE_FILE);
   const workflowIgnoreStat = await lstat(workflowIgnorePath).catch(() => void 0);
   if (workflowIgnoreStat?.isSymbolicLink()) {
     throw new Error(`${WORKFLOW_IGNORE_FILE} must be a regular file.`);
@@ -868,8 +710,8 @@ async function createWorkflowUploadPlan(rootDir) {
   const walk = async (currentDir) => {
     const entries = await readdir(currentDir, { withFileTypes: true });
     for (const entry of entries) {
-      const absolutePath = path2.join(currentDir, entry.name);
-      const relativePath = normalizeWorkflowUploadPath(path2.relative(projectRoot, absolutePath));
+      const absolutePath = path.join(currentDir, entry.name);
+      const relativePath = normalizeWorkflowUploadPath(path.relative(projectRoot, absolutePath));
       const portablePath = createWorkflowUploadPortablePathKey(relativePath);
       const conflictingPath = portablePaths.get(portablePath);
       if (conflictingPath !== void 0 && conflictingPath !== relativePath) {
@@ -905,7 +747,7 @@ async function createWorkflowUploadPlan(rootDir) {
     throw new Error("Workflow package must contain package.json.");
   }
   const packageJson = parsePackageJson(await readWorkflowUploadUtf8File(
-    path2.join(projectRoot, "package.json"),
+    path.join(projectRoot, "package.json"),
     "package.json"
   ));
   const requiredPaths = resolveWorkflowUploadRequiredPaths(
@@ -931,8 +773,8 @@ async function copyWorkflowUploadFiles(sourceDir, targetDir) {
   const plan = await createWorkflowUploadPlan(sourceDir);
   await mkdir(targetDir, { recursive: true });
   for (const file of plan.files) {
-    const targetPath = path2.join(targetDir, ...file.path.split("/"));
-    await mkdir(path2.dirname(targetPath), { recursive: true });
+    const targetPath = path.join(targetDir, ...file.path.split("/"));
+    await mkdir(path.dirname(targetPath), { recursive: true });
     await copyFile(file.absolutePath, targetPath);
   }
   return plan;
@@ -953,71 +795,230 @@ async function readWorkflowUploadUtf8File(filePath, label) {
   }
 }
 
-// src/workspace.ts
-import {
-  createWorkflowProjectDependencyLocks,
-  inspectLocalWorkflowStructure,
-  isProjectGroupHostDataPath,
-  parseWorkflowProjectDependencyLocks,
-  readKanbanArtifactConfig as readKanbanArtifactConfig2
-} from "workflow-code";
-
-// src/auth-config.ts
-import { readFileSync } from "fs";
-import { mkdir as mkdir2, readFile as readFile2, rm, writeFile } from "fs/promises";
-async function readCliAuthConfig(env = process.env) {
-  try {
-    const raw = await readFile2(resolveWorkflowCliAuthFilePath(env), "utf8");
-    return normalizeWorkflowAuthConfig(JSON.parse(raw));
-  } catch {
-    return createEmptyWorkflowAuthConfig();
+// .shared/project-dependencies/index.ts
+function createWorkflowProjectDependencyLocks(relatedProjects, selections) {
+  const selectionsById = /* @__PURE__ */ new Map();
+  for (const selection of selections) {
+    if (selectionsById.has(selection.alias)) {
+      throw dependencyError(
+        "duplicateSelection",
+        `Duplicate dependency selection ${JSON.stringify(selection.alias)}.`,
+        { alias: selection.alias }
+      );
+    }
+    selectionsById.set(selection.alias, selection.delivery);
+  }
+  const locks = relatedProjects.map((relatedProject) => ({
+    alias: relatedProject.alias,
+    projectId: relatedProject.projectId,
+    delivery: selectionsById.get(relatedProject.alias) ?? "external"
+  }));
+  for (const alias of selectionsById.keys()) {
+    if (!relatedProjects.some((relatedProject) => relatedProject.alias === alias)) {
+      throw dependencyError(
+        "unknownSelection",
+        `Unknown dependency selection ${JSON.stringify(alias)}.`,
+        { alias }
+      );
+    }
   }
+  return locks;
 }
-function readCliAuthConfigSync(env = process.env) {
-  try {
-    const raw = readFileSync(resolveWorkflowCliAuthFilePath(env), "utf8");
-    return normalizeWorkflowAuthConfig(JSON.parse(raw));
-  } catch {
-    return createEmptyWorkflowAuthConfig();
+function parseWorkflowProjectDependencyLocks(value, options = {}) {
+  if (!Array.isArray(value)) {
+    throw dependencyError("lockArray", "Project dependency lock must be an array.");
   }
+  const aliases = /* @__PURE__ */ new Set();
+  const projectIds = /* @__PURE__ */ new Set();
+  return value.map((item, index) => {
+    const dependency = parseDependencyLock(item, index, options.published === true);
+    if (aliases.has(dependency.alias)) {
+      throw dependencyError(
+        "duplicateAlias",
+        `Project dependency alias ${JSON.stringify(dependency.alias)} is duplicated.`,
+        { alias: dependency.alias }
+      );
+    }
+    aliases.add(dependency.alias);
+    if (projectIds.has(dependency.projectId)) {
+      throw dependencyError(
+        "duplicateDependencyProjectId",
+        `Project dependency projectId ${JSON.stringify(dependency.projectId)} is duplicated.`,
+        { projectId: dependency.projectId }
+      );
+    }
+    projectIds.add(dependency.projectId);
+    return dependency;
+  });
 }
-async function writeCliAuthConfig(config, env = process.env) {
-  await mkdir2(resolveWorkflowCliAuthDir(env), { recursive: true });
-  await writeFile(
-    resolveWorkflowCliAuthFilePath(env),
-    `${JSON.stringify(normalizeWorkflowAuthConfig(config), null, 2)}
-`,
-    "utf8"
+function isProjectGroupHostDataPath(filePath) {
+  const normalized = filePath.replaceAll("\\", "/").replace(/^\.\/+/, "").toLowerCase();
+  const parts = normalized.split("/");
+  if (parts.some((part) => [
+    ".workflow-kv",
+    ".workflow-persistent-values",
+    ".workflow-runs",
+    ".workflow-schedules",
+    ".workflow-code",
+    ".workflow-files",
+    ".data",
+    "local-project-registries",
+    "workflow-files"
+  ].includes(part))) {
+    return true;
+  }
+  const baseName = parts.at(-1) ?? "";
+  if (baseName === "workflow-code.sqlite" || baseName.startsWith("workflow-code.sqlite-") || baseName === "workflow-auth.json" || baseName === "local-projects.json") {
+    return true;
+  }
+  return baseName === ".env" || baseName === ".envrc" || baseName.startsWith(".env.") && baseName !== ".env.example";
+}
+function parseDependencyLock(value, index, published) {
+  if (!isRecord2(value)) {
+    throw dependencyError(
+      "lockObject",
+      `Project dependency lock[${index}] must be an object.`,
+      { field: `Project dependency lock[${index}]` }
+    );
+  }
+  assertSupportedFields(
+    value,
+    ["alias", "projectId", "delivery", "version", "sourceHash"],
+    `dependencies[${index}]`
   );
+  const alias = readNonEmptyString(value["alias"], `dependencies[${index}].alias`);
+  if (!/^[a-z][a-z0-9_-]{0,63}$/.test(alias)) {
+    throw dependencyError(
+      "lockAlias",
+      `Project dependency lock[${index}].alias is invalid.`,
+      { field: `Project dependency lock[${index}].alias` }
+    );
+  }
+  const projectId = readUuid(value["projectId"], `dependencies[${index}].projectId`);
+  const delivery = value["delivery"];
+  if (delivery !== "included" && delivery !== "external") {
+    throw dependencyError(
+      "lockDelivery",
+      `Project dependency lock[${index}].delivery is invalid.`,
+      { field: `Project dependency lock[${index}].delivery` }
+    );
+  }
+  const version = readOptionalString(value["version"], `dependencies[${index}].version`);
+  const sourceHash = readOptionalString(value["sourceHash"], `dependencies[${index}].sourceHash`);
+  if (delivery === "external" && (version !== void 0 || sourceHash !== void 0)) {
+    throw dependencyError(
+      "externalPinned",
+      `External dependency ${JSON.stringify(alias)} cannot pin a version or source hash.`,
+      { alias }
+    );
+  }
+  if (published && delivery === "included" && (version === void 0 || sourceHash === void 0)) {
+    throw dependencyError(
+      "includedPinRequired",
+      `Included dependency ${JSON.stringify(alias)} must pin version and sourceHash.`,
+      { alias }
+    );
+  }
+  if (version !== void 0 && !/^\d+\.\d+\.\d+$/.test(version)) {
+    throw dependencyError(
+      "includedVersionInvalid",
+      `Included dependency ${JSON.stringify(alias)} has an invalid version.`,
+      { alias }
+    );
+  }
+  if (sourceHash !== void 0 && !/^[a-f0-9]{64}$/.test(sourceHash)) {
+    throw dependencyError(
+      "includedHashInvalid",
+      `Included dependency ${JSON.stringify(alias)} has an invalid sourceHash.`,
+      { alias }
+    );
+  }
+  return {
+    alias,
+    projectId,
+    delivery,
+    ...version === void 0 ? {} : { version },
+    ...sourceHash === void 0 ? {} : { sourceHash }
+  };
 }
-async function clearCliAuthConfig(env = process.env) {
-  await rm(resolveWorkflowCliAuthFilePath(env), { force: true });
+function readUuid(value, field) {
+  const result = readNonEmptyString(value, field);
+  if (!isWorkflowUuid(result)) {
+    throw dependencyError("uuidRequired", `Project group ${field} must be a UUID.`, { field });
+  }
+  return result;
+}
+function readNonEmptyString(value, field) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw dependencyError("nonEmptyString", `${field} must be a non-empty string.`, { field });
+  }
+  return value.trim();
+}
+function readOptionalString(value, field) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || value.trim() === "") {
+    throw dependencyError(
+      "optionalNonEmptyString",
+      `${field} must be a non-empty string when provided.`,
+      { field }
+    );
+  }
+  return value.trim();
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertSupportedFields(value, supportedFields, field) {
+  const supported = new Set(supportedFields);
+  const unsupported = Object.keys(value).find((key) => !supported.has(key));
+  if (unsupported !== void 0) {
+    throw dependencyError(
+      "unsupportedField",
+      `${field}.${unsupported} is not supported.`,
+      { field: `${field}.${unsupported}` }
+    );
+  }
+}
+function dependencyError(key, message, values) {
+  return Object.assign(new Error(message), {
+    name: "WorkflowProjectDependencyLocalizedError",
+    workflowCodeI18n: {
+      namespace: "common",
+      key: `projectDependencies.validation.${key}`,
+      ...values === void 0 ? {} : { values }
+    }
+  });
 }
 
+// src/workspace.ts
+import {
+  inspectLocalWorkflowStructure
+} from "workflow-code";
+
 // src/env.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import path3 from "path";
+import { existsSync, readFileSync } from "fs";
+import path2 from "path";
 import { parse } from "dotenv";
 function loadCliEnv() {
   const cliRoot = process.cwd();
   const defaultRepoRoot = findWorkspaceRepositoryRoot(cliRoot) ?? cliRoot;
-  const initialRepoRoot = process.env.WORKFLOW_REPO_ROOT ? path3.resolve(process.env.WORKFLOW_REPO_ROOT) : defaultRepoRoot;
+  const initialRepoRoot = process.env.WORKFLOW_REPO_ROOT ? path2.resolve(process.env.WORKFLOW_REPO_ROOT) : defaultRepoRoot;
   loadEnvFiles([
-    path3.join(cliRoot, ".env"),
-    path3.join(initialRepoRoot, ".env")
+    path2.join(cliRoot, ".env"),
+    path2.join(initialRepoRoot, ".env")
   ]);
-  const resolvedRepoRoot = process.env.WORKFLOW_REPO_ROOT ? path3.resolve(process.env.WORKFLOW_REPO_ROOT) : initialRepoRoot;
+  const resolvedRepoRoot = process.env.WORKFLOW_REPO_ROOT ? path2.resolve(process.env.WORKFLOW_REPO_ROOT) : initialRepoRoot;
   if (resolvedRepoRoot !== initialRepoRoot) {
-    loadEnvFiles([path3.join(resolvedRepoRoot, ".env")]);
+    loadEnvFiles([path2.join(resolvedRepoRoot, ".env")]);
   }
 }
 function findWorkspaceRepositoryRoot(startDir) {
-  let current = path3.resolve(startDir);
+  let current = path2.resolve(startDir);
   while (true) {
-    if (existsSync(path3.join(current, "pnpm-workspace.yaml")) && existsSync(path3.join(current, "package.json")) && existsSync(path3.join(current, "workspace", "package.json")) && existsSync(path3.join(current, "workspace", "workflow"))) {
+    if (existsSync(path2.join(current, "pnpm-workspace.yaml")) && existsSync(path2.join(current, "package.json")) && existsSync(path2.join(current, "workspace", "package.json")) && existsSync(path2.join(current, "workspace", "workflow"))) {
       return current;
     }
-    const parent = path3.dirname(current);
+    const parent = path2.dirname(current);
     if (parent === current) return void 0;
     current = parent;
   }
@@ -1027,7 +1028,7 @@ function loadEnvFiles(filePaths) {
     if (!existsSync(filePath)) {
       continue;
     }
-    const values = parse(readFileSync2(filePath));
+    const values = parse(readFileSync(filePath));
     for (const [key, value] of Object.entries(values)) {
       if (process.env[key] === void 0) {
         process.env[key] = value;
@@ -1041,7 +1042,7 @@ function unique(values) {
 
 // src/workspace.ts
 var DEFAULT_SERVER_URL = "http://localhost:7125";
-var CLI_MODULE_DIR = path4.dirname(fileURLToPath(import.meta.url));
+var CLI_MODULE_DIR = path3.dirname(fileURLToPath(import.meta.url));
 var DEFAULT_DEVICE_FLOW_CLIENT_NAME = "Workflow Workspace CLI";
 loadCliEnv();
 async function main(argv = process.argv.slice(2), options = {}) {
@@ -1177,7 +1178,7 @@ async function commandStatus() {
 }
 async function commandPack(parsed) {
   const workflowName = requirePositional(parsed, 0, "workflow");
-  if (parsed.options.projectGroup === true || parsed.options.publishGroup === true || parsed.options.dependencies.length > 0 || parsed.options.dataGrants.length > 0) {
+  if (parsed.options.projectGroup === true || parsed.options.publishGroup === true || parsed.options.dependencies.length > 0) {
     const packed = await packProjectGroup({
       workflowArg: workflowName,
       sourcePath: parsed.options.path,
@@ -1210,7 +1211,7 @@ async function commandUpload(parsed) {
   if (!workflowId) {
     throw new Error(i18n.t("workflowIdRequired", { ns: "cli" }));
   }
-  const archivePath = parsed.options.file ? path4.resolve(parsed.options.file) : await packWorkflow(workflowArg, parsed.options.output, parsed.options.path);
+  const archivePath = parsed.options.file ? path3.resolve(parsed.options.file) : await packWorkflow(workflowArg, parsed.options.output, parsed.options.path);
   const executionTargets = resolveRequestedExecutionTargets(parsed.options, packageContext.projectType);
   const uploadResult = await uploadPackage({
     workflowId,
@@ -1256,7 +1257,7 @@ async function commandUpload(parsed) {
   }
 }
 function shouldUseProjectGroupUpload(options) {
-  return options.projectGroup === true || options.publishGroup === true || options.dependencies.length > 0 || options.dataGrants.length > 0;
+  return options.projectGroup === true || options.publishGroup === true || options.dependencies.length > 0;
 }
 async function commandProjectGroupUpload(parsed, workflowArg, forcePublish = false) {
   if (parsed.options.file !== void 0) {
@@ -1281,7 +1282,7 @@ async function commandProjectGroupUpload(parsed, workflowArg, forcePublish = fal
   });
   for (const dependency of contexts.dependencies) {
     await ensureWorkflowProjectCreated({
-      packageContext: dependency,
+      packageContext: dependency.packageContext,
       server: parsed.options.server,
       token: parsed.options.token
     });
@@ -1320,24 +1321,6 @@ async function commandProjectGroupUpload(parsed, workflowArg, forcePublish = fal
     assertApiOk(prepared);
     return;
   }
-  const grantsByProject = resolveExplicitDataGrants(
-    packed.manifest.dependencies,
-    parsed.options.dataGrants
-  );
-  for (const [sourceProjectId, prefixes] of grantsByProject) {
-    const grant = await fetchApi({
-      server: parsed.options.server,
-      token: parsed.options.token,
-      path: `/api/workflows/${encodeURIComponent(sourceProjectId)}/data-source-grants/${encodeURIComponent(packed.manifest.rootProjectId)}`,
-      method: "PUT",
-      body: { keyPrefixes: prefixes }
-    });
-    if (grant.errCode !== 0) {
-      printApiResponse(grant);
-      assertApiOk(grant);
-      return;
-    }
-  }
   if (!forcePublish && parsed.options.releaseLog === void 0 && parsed.options.publishGroup !== true) {
     printApiResponse(prepared);
     return;
@@ -1436,7 +1419,7 @@ async function commandDownload(parsed) {
       return;
     }
     const repoRoot2 = resolveRepoRoot();
-    const rootTargetDir = parsed.options.path ? path4.resolve(parsed.options.path) : path4.join(repoRoot2, "workspace", "workflow", workflowArg);
+    const rootTargetDir = parsed.options.path ? path3.resolve(parsed.options.path) : path3.join(repoRoot2, "workspace", "workflow", workflowArg);
     const materialized = await materializeProjectGroupDownload(result2.data, rootTargetDir);
     const locallyAvailableProjectIds = new Set(materialized.map((project) => project.projectId));
     const skippedDependencies = result2.data.skippedDependencies.filter((item) => item.dependency.delivery !== "included" || !locallyAvailableProjectIds.has(item.dependency.projectId));
@@ -1464,14 +1447,14 @@ async function commandDownload(parsed) {
     return;
   }
   const repoRoot = resolveRepoRoot();
-  const targetDir = parsed.options.path ? path4.resolve(parsed.options.path) : path4.join(repoRoot, "workspace", "workflow", workflowArg);
-  await rm2(targetDir, { recursive: true, force: true });
-  await mkdir3(targetDir, { recursive: true });
+  const targetDir = parsed.options.path ? path3.resolve(parsed.options.path) : path3.join(repoRoot, "workspace", "workflow", workflowArg);
+  await rm(targetDir, { recursive: true, force: true });
+  await mkdir2(targetDir, { recursive: true });
   for (const file of result.data.files) {
     const safePath = normalizeWorkflowFilePath(file.path);
-    const targetPath = path4.join(targetDir, safePath);
-    await mkdir3(path4.dirname(targetPath), { recursive: true });
-    await writeFile2(targetPath, decodeWorkflowFileContent(file));
+    const targetPath = path3.join(targetDir, safePath);
+    await mkdir2(path3.dirname(targetPath), { recursive: true });
+    await writeFile(targetPath, decodeWorkflowFileContent(file));
   }
 }
 async function commandPublish(parsed) {
@@ -1547,17 +1530,11 @@ async function materializeProjectGroupDownload(download, rootTargetDir) {
   } catch {
     throw new Error(i18n.t("projectGroupDownloadRootPackageInvalidJson", { ns: "cli" }));
   }
-  const declaredSources = readKanbanArtifactConfig2(rootPackageJson).dataSources;
-  const selfReference = declaredSources.find((source) => source.projectId === download.rootProjectId);
-  if (selfReference !== void 0) {
-    throw new Error(i18n.t("projectGroupDownloadSelfReference", {
-      ns: "cli",
-      sourceId: JSON.stringify(selfReference.id)
-    }));
-  }
-  if (declaredSources.length !== dependencies.length || declaredSources.some((source) => {
-    const dependency = dependencies.find((candidate) => candidate.sourceId === source.id);
-    return dependency === void 0 || dependency.kind !== source.kind || dependency.projectId !== source.projectId || JSON.stringify(dependency.keyPrefixes) !== JSON.stringify(source.keyPrefixes);
+  const rootProjectInfo = readWorkflowProjectInfo(rootPackageJson);
+  const declaredRelations = rootProjectInfo.relatedProjects;
+  if (declaredRelations.length !== dependencies.length || declaredRelations.some((relation) => {
+    const dependency = dependencies.find((candidate) => candidate.alias === relation.alias);
+    return dependency === void 0 || dependency.projectId.toLowerCase() !== relation.projectId.toLowerCase();
   })) {
     throw new Error(i18n.t("projectGroupDownloadLockMismatch", { ns: "cli" }));
   }
@@ -1611,20 +1588,30 @@ async function materializeProjectGroupDownload(download, rootTargetDir) {
         projectId: JSON.stringify(project.projectId)
       }));
     }
-    if (project.role === "root" && project.sourceId !== void 0) {
-      throw new Error(i18n.t("projectGroupDownloadRootSourceIdForbidden", { ns: "cli" }));
+    if (project.role === "root" && project.alias !== void 0) {
+      throw new Error(i18n.t("projectGroupDownloadRootAliasForbidden", { ns: "cli" }));
     }
     if (project.role === "dependency") {
       const matchingDependencies = includedDependencies.filter((dependency) => dependency.projectId === project.projectId && dependency.version === project.version && dependency.sourceHash === project.sourceHash);
-      if (matchingDependencies.length === 0 || project.sourceId !== void 0 && !matchingDependencies.some((dependency) => dependency.sourceId === project.sourceId)) {
+      if (matchingDependencies.length === 0 || project.alias !== void 0 && !matchingDependencies.some((dependency) => dependency.alias === project.alias)) {
         throw new Error(i18n.t("projectGroupDownloadUndeclaredDependency", {
           ns: "cli",
           projectId: JSON.stringify(project.projectId)
         }));
       }
+      const matchingDependency = project.alias === void 0 ? matchingDependencies[0] : matchingDependencies.find((dependency) => dependency.alias === project.alias);
+      if (matchingDependency !== void 0) {
+        assertConfirmedRelatedProject({
+          rootProjectId: download.rootProjectId,
+          rootProjectInfo,
+          targetProjectId: project.projectId,
+          targetPackageJson: packageJson,
+          alias: matchingDependency.alias
+        });
+      }
     }
   }
-  const parentDir = path4.dirname(rootTargetDir);
+  const parentDir = path3.dirname(rootTargetDir);
   const existingById = await findSiblingProjectsById(parentDir);
   const materialized = [];
   const pending = [];
@@ -1633,9 +1620,21 @@ async function materializeProjectGroupDownload(download, rootTargetDir) {
   for (const project of orderedProjects) {
     const existingPath = existingById.get(project.projectId);
     if (existingPath !== void 0) {
-      await assertDownloadedProjectRole(existingPath, project.projectId, project.role);
+      const packageJson = await assertDownloadedProjectRole(existingPath, project.projectId, project.role);
+      if (project.role === "dependency") {
+        const dependency = includedDependencies.find((candidate) => candidate.projectId === project.projectId && (project.alias === void 0 || candidate.alias === project.alias));
+        if (dependency !== void 0) {
+          assertConfirmedRelatedProject({
+            rootProjectId: download.rootProjectId,
+            rootProjectInfo,
+            targetProjectId: project.projectId,
+            targetPackageJson: packageJson,
+            alias: dependency.alias
+          });
+        }
+      }
       materialized.push({
-        ...project.sourceId === void 0 ? {} : { sourceId: project.sourceId },
+        ...project.alias === void 0 ? {} : { alias: project.alias },
         projectId: project.projectId,
         projectName: project.projectName,
         role: project.role,
@@ -1644,7 +1643,7 @@ async function materializeProjectGroupDownload(download, rootTargetDir) {
       });
       continue;
     }
-    const targetDir = project.role === "root" ? rootTargetDir : path4.join(parentDir, createProjectDirectoryName(project.projectName, project.projectId));
+    const targetDir = project.role === "root" ? rootTargetDir : path3.join(parentDir, createProjectDirectoryName(project.projectName, project.projectId));
     if (existsSync2(targetDir)) {
       throw new Error(i18n.t("projectGroupDownloadDirectoryProjectMismatch", {
         ns: "cli",
@@ -1652,7 +1651,7 @@ async function materializeProjectGroupDownload(download, rootTargetDir) {
         path: JSON.stringify(targetDir)
       }));
     }
-    const targetKey = createPortableLocalPathKey(path4.resolve(targetDir));
+    const targetKey = createPortableLocalPathKey(path3.resolve(targetDir));
     if (targetKeys.has(targetKey)) {
       throw new Error(i18n.t("projectGroupDownloadDirectoryCollision", {
         ns: "cli",
@@ -1668,6 +1667,16 @@ async function materializeProjectGroupDownload(download, rootTargetDir) {
     const existingPath = existingById.get(projectId);
     if (existingPath === void 0) continue;
     const packageJson = await assertDownloadedProjectRole(existingPath, projectId, "dependency");
+    const dependency = includedDependencies.find((candidate) => candidate.projectId === projectId);
+    if (dependency !== void 0) {
+      assertConfirmedRelatedProject({
+        rootProjectId: download.rootProjectId,
+        rootProjectInfo,
+        targetProjectId: projectId,
+        targetPackageJson: packageJson,
+        alias: dependency.alias
+      });
+    }
     materialized.push({
       projectId,
       projectName: readRequiredPackageString(packageJson, "name"),
@@ -1676,23 +1685,23 @@ async function materializeProjectGroupDownload(download, rootTargetDir) {
       alreadyAvailable: true
     });
   }
-  await mkdir3(parentDir, { recursive: true });
-  const stagingRoot = path4.join(parentDir, `.workflow-download-group-${randomUUID()}`);
+  await mkdir2(parentDir, { recursive: true });
+  const stagingRoot = path3.join(parentDir, `.workflow-download-group-${randomUUID()}`);
   const staged = [];
   const moved = [];
   try {
-    await mkdir3(stagingRoot, { recursive: false });
+    await mkdir2(stagingRoot, { recursive: false });
     for (const item of pending) {
       const { project, targetDir } = item;
-      const stagingDir = path4.join(stagingRoot, project.projectId);
-      await mkdir3(stagingDir, { recursive: true });
+      const stagingDir = path3.join(stagingRoot, project.projectId);
+      await mkdir2(stagingDir, { recursive: true });
       for (const file of project.files) {
         const safePath = normalizeWorkflowFilePath(file.path);
-        const targetPath = path4.join(stagingDir, ...safePath.split("/"));
-        await mkdir3(path4.dirname(targetPath), { recursive: true });
-        await writeFile2(targetPath, decodeWorkflowFileContent(file));
+        const targetPath = path3.join(stagingDir, ...safePath.split("/"));
+        await mkdir2(path3.dirname(targetPath), { recursive: true });
+        await writeFile(targetPath, decodeWorkflowFileContent(file));
       }
-      const packageJson = await readPackageJsonFile(path4.join(stagingDir, "package.json"));
+      const packageJson = await readPackageJsonFile(path3.join(stagingDir, "package.json"));
       if (packageJson["id"] !== project.projectId) {
         throw new Error(i18n.t("projectGroupDownloadedPackageIdMismatch", {
           ns: "cli",
@@ -1707,7 +1716,7 @@ async function materializeProjectGroupDownload(download, rootTargetDir) {
       moved.push(item.targetDir);
       existingById.set(item.project.projectId, item.targetDir);
       materialized.push({
-        ...item.project.sourceId === void 0 ? {} : { sourceId: item.project.sourceId },
+        ...item.project.alias === void 0 ? {} : { alias: item.project.alias },
         projectId: item.project.projectId,
         projectName: item.project.projectName,
         role: item.project.role,
@@ -1717,16 +1726,16 @@ async function materializeProjectGroupDownload(download, rootTargetDir) {
     }
   } catch (error) {
     for (const targetDir of moved) {
-      await rm2(targetDir, { recursive: true, force: true }).catch(() => void 0);
+      await rm(targetDir, { recursive: true, force: true }).catch(() => void 0);
     }
     throw error;
   } finally {
-    await rm2(stagingRoot, { recursive: true, force: true }).catch(() => void 0);
+    await rm(stagingRoot, { recursive: true, force: true }).catch(() => void 0);
   }
   return materialized.sort((left, right) => left.role === right.role ? left.projectId.localeCompare(right.projectId) : left.role === "root" ? -1 : 1);
 }
 async function assertDownloadedProjectRole(projectDir, projectId, role, packageJson) {
-  const metadata = packageJson ?? await readPackageJsonFile(path4.join(projectDir, "package.json"));
+  const metadata = packageJson ?? await readPackageJsonFile(path3.join(projectDir, "package.json"));
   if (metadata["id"] !== projectId) {
     throw new Error(i18n.t("projectGroupDownloadedPackageIdMismatch", {
       ns: "cli",
@@ -1734,56 +1743,40 @@ async function assertDownloadedProjectRole(projectDir, projectId, role, packageJ
     }));
   }
   const projectType = inspectLocalWorkflowStructure({ workflowDir: projectDir }).projectType;
-  const expectedProjectType = role === "root" ? "kanban" : "workflow";
-  if (projectType !== expectedProjectType) {
+  if (role === "root" && projectType !== "kanban") {
     throw new Error(i18n.t("projectGroupDownloadedProjectTypeMismatch", {
       ns: "cli",
       projectId: JSON.stringify(projectId),
-      projectType: expectedProjectType
+      projectType: "kanban"
     }));
   }
   return metadata;
 }
+function assertConfirmedRelatedProject(options) {
+  const targetProjectInfo = readWorkflowProjectInfo(options.targetPackageJson);
+  if (resolveWorkflowRelatedProjectAccess({
+    consumerProjectId: options.rootProjectId,
+    consumerProjectInfo: options.rootProjectInfo,
+    targetProjectId: options.targetProjectId,
+    targetProjectInfo,
+    alias: options.alias
+  }) === void 0) {
+    throw new Error(i18n.t("projectGroupRelatedProjectPending", {
+      ns: "cli",
+      alias: JSON.stringify(options.alias)
+    }));
+  }
+}
 function createPortableLocalPathKey(filePath) {
   return filePath.normalize("NFC").toLowerCase();
 }
-function resolveExplicitDataGrants(dependencies, sourceIds) {
-  const selected = /* @__PURE__ */ new Set();
-  for (const sourceId of sourceIds) {
-    if (selected.has(sourceId)) {
-      throw new Error(i18n.t("duplicateGrantDataAccessSource", {
-        ns: "cli",
-        sourceId: JSON.stringify(sourceId)
-      }));
-    }
-    selected.add(sourceId);
-  }
-  const grants = /* @__PURE__ */ new Map();
-  for (const sourceId of selected) {
-    const dependency = dependencies.find((candidate) => candidate.sourceId === sourceId);
-    if (dependency === void 0) {
-      throw new Error(i18n.t("unknownGrantDataAccessSource", {
-        ns: "cli",
-        sourceId: JSON.stringify(sourceId)
-      }));
-    }
-    grants.set(dependency.projectId, [
-      ...grants.get(dependency.projectId) ?? [],
-      ...dependency.keyPrefixes
-    ]);
-  }
-  for (const [projectId, prefixes] of grants) {
-    grants.set(projectId, [...new Set(prefixes)]);
-  }
-  return grants;
-}
 async function findSiblingProjectsById(parentDir) {
   const projects = /* @__PURE__ */ new Map();
   const entries = await readdir2(parentDir, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const projectDir = path4.join(parentDir, entry.name);
-    const packageJson = await readPackageJsonFile(path4.join(projectDir, "package.json")).catch(() => void 0);
+    const projectDir = path3.join(parentDir, entry.name);
+    const packageJson = await readPackageJsonFile(path3.join(projectDir, "package.json")).catch(() => void 0);
     const projectId = packageJson?.["id"];
     if (typeof projectId === "string" && isWorkflowUuid(projectId) && !projects.has(projectId)) {
       projects.set(projectId, projectDir);
@@ -1807,26 +1800,26 @@ async function commandHealth(parsed) {
 }
 async function packWorkflow(workflowName, outputPath, sourcePath, options = {}) {
   const repoRoot = resolveRepoRoot();
-  const workflowDir = sourcePath === void 0 ? path4.join(repoRoot, "workspace", "workflow", workflowName) : path4.resolve(sourcePath);
-  await readPackageJsonFile(path4.join(workflowDir, "package.json"));
-  const packsDir = process.env.WORKFLOW_WORKSPACE_PACKS_DIR ? path4.resolve(process.env.WORKFLOW_WORKSPACE_PACKS_DIR) : path4.join(repoRoot, "workspace", ".packs");
-  const stagingDir = path4.join(packsDir, "tmp", randomUUID(), workflowName);
-  const archivePath = outputPath ? path4.resolve(outputPath) : path4.join(packsDir, `${workflowName}-${createTimestamp()}.tgz`);
-  const workspaceRoot = sourcePath === void 0 ? path4.join(repoRoot, "workspace", "workflow") : path4.dirname(workflowDir);
-  await rm2(path4.dirname(stagingDir), { recursive: true, force: true });
-  await mkdir3(path4.join(stagingDir, "workspace", "workflow"), { recursive: true });
-  await mkdir3(path4.dirname(archivePath), { recursive: true });
+  const workflowDir = sourcePath === void 0 ? path3.join(repoRoot, "workspace", "workflow", workflowName) : path3.resolve(sourcePath);
+  await readPackageJsonFile(path3.join(workflowDir, "package.json"));
+  const packsDir = process.env.WORKFLOW_WORKSPACE_PACKS_DIR ? path3.resolve(process.env.WORKFLOW_WORKSPACE_PACKS_DIR) : path3.join(repoRoot, "workspace", ".packs");
+  const stagingDir = path3.join(packsDir, "tmp", randomUUID(), workflowName);
+  const archivePath = outputPath ? path3.resolve(outputPath) : path3.join(packsDir, `${workflowName}-${createTimestamp()}.tgz`);
+  const workspaceRoot = sourcePath === void 0 ? path3.join(repoRoot, "workspace", "workflow") : path3.dirname(workflowDir);
+  await rm(path3.dirname(stagingDir), { recursive: true, force: true });
+  await mkdir2(path3.join(stagingDir, "workspace", "workflow"), { recursive: true });
+  await mkdir2(path3.dirname(archivePath), { recursive: true });
   await stageWorkflowWithLocalDependencies({
     workspaceRoot,
     workflowDir,
     workflowName,
-    stagingRoot: path4.join(stagingDir, "workspace", "workflow"),
+    stagingRoot: path3.join(stagingDir, "workspace", "workflow"),
     projectGroupSafe: options.projectGroupSafe === true
   });
   const result = await runCommand("tar", ["-czf", archivePath, "-C", stagingDir, "."], {
     cwd: repoRoot
   });
-  await rm2(path4.dirname(stagingDir), { recursive: true, force: true });
+  await rm(path3.dirname(stagingDir), { recursive: true, force: true });
   if (result.exitCode !== 0) {
     throw new Error(i18n.t("archiveCreateFailed", {
       ns: "cli",
@@ -1843,74 +1836,69 @@ async function readProjectGroupContexts(options) {
   if (!root.workflowId) {
     throw new Error(i18n.t("projectGroupRootIdRequired", { ns: "cli" }));
   }
-  const dataSources = readKanbanArtifactConfig2(root.packageJson).dataSources;
-  const selfReference = dataSources.find((source) => source.projectId === root.workflowId);
-  if (selfReference !== void 0) {
-    throw new Error(i18n.t("projectGroupSelfReference", {
-      ns: "cli",
-      sourceId: JSON.stringify(selfReference.id)
-    }));
-  }
+  const rootProjectInfo = readWorkflowProjectInfo(root.packageJson);
+  const relatedProjects = rootProjectInfo.relatedProjects;
   const dependencyPaths = /* @__PURE__ */ new Map();
   for (const option of options.dependencyOptions) {
     const separator = option.indexOf("=");
-    const sourceId = separator < 1 ? "" : option.slice(0, separator).trim();
+    const alias = separator < 1 ? "" : option.slice(0, separator).trim();
     const dependencyPath = separator < 0 ? "" : option.slice(separator + 1).trim();
-    if (sourceId === "" || dependencyPath === "") {
+    if (alias === "" || dependencyPath === "") {
       throw new Error(i18n.t("invalidDependencyOption", {
         ns: "cli",
         option: JSON.stringify(option)
       }));
     }
-    if (dependencyPaths.has(sourceId)) {
+    if (dependencyPaths.has(alias)) {
       throw new Error(i18n.t("duplicateDependencySource", {
         ns: "cli",
-        sourceId: JSON.stringify(sourceId)
+        alias: JSON.stringify(alias)
       }));
     }
-    dependencyPaths.set(sourceId, path4.resolve(dependencyPath));
+    dependencyPaths.set(alias, path3.resolve(dependencyPath));
   }
   const locks = createWorkflowProjectDependencyLocks(
-    dataSources,
-    [...dependencyPaths.keys()].map((sourceId) => ({ sourceId, delivery: "included" }))
+    relatedProjects,
+    [...dependencyPaths.keys()].map((alias) => ({ alias, delivery: "included" }))
   );
   const dependenciesByProject = /* @__PURE__ */ new Map();
-  for (const [sourceId, dependencyPath] of dependencyPaths) {
-    const source = dataSources.find((candidate) => candidate.id === sourceId);
-    const context = await readWorkflowPackageContext(sourceId, dependencyPath);
-    if (context.projectType !== "workflow") {
-      throw new Error(i18n.t("dependencyMustBeWorkflow", {
-        ns: "cli",
-        sourceId: JSON.stringify(sourceId)
-      }));
-    }
-    if (context.workflowId !== source.projectId) {
+  for (const [alias, dependencyPath] of dependencyPaths) {
+    const relation = relatedProjects.find((candidate) => candidate.alias === alias);
+    const context = await readWorkflowPackageContext(alias, dependencyPath);
+    if (context.workflowId !== relation.projectId) {
       throw new Error(i18n.t("dependencyPackageIdMismatch", {
         ns: "cli",
-        sourceId: JSON.stringify(sourceId),
-        projectId: JSON.stringify(source.projectId)
+        alias: JSON.stringify(alias),
+        projectId: JSON.stringify(relation.projectId)
       }));
     }
-    const existing = dependenciesByProject.get(source.projectId);
-    if (existing !== void 0 && existing.workflowDir !== context.workflowDir) {
+    assertConfirmedRelatedProject({
+      rootProjectId: root.workflowId,
+      rootProjectInfo,
+      targetProjectId: context.workflowId,
+      targetPackageJson: context.packageJson,
+      alias
+    });
+    const existing = dependenciesByProject.get(relation.projectId);
+    if (existing !== void 0 && existing.packageContext.workflowDir !== context.workflowDir) {
       throw new Error(i18n.t("dependencyProjectPathConflict", {
         ns: "cli",
-        projectId: JSON.stringify(source.projectId)
+        projectId: JSON.stringify(relation.projectId)
       }));
     }
-    dependenciesByProject.set(source.projectId, context);
+    dependenciesByProject.set(relation.projectId, { alias, packageContext: context });
   }
   return { root, dependencies: [...dependenciesByProject.values()], locks };
 }
 async function packProjectGroup(options) {
   const contexts = options.contexts ?? await readProjectGroupContexts(options);
   const repoRoot = resolveRepoRoot();
-  const packsDir = process.env.WORKFLOW_WORKSPACE_PACKS_DIR ? path4.resolve(process.env.WORKFLOW_WORKSPACE_PACKS_DIR) : path4.join(repoRoot, "workspace", ".packs");
-  const groupRoot = path4.join(packsDir, "tmp", `project-group-${randomUUID()}`);
-  const projectsDir = path4.join(groupRoot, "projects");
-  const archivePath = options.outputPath ? path4.resolve(options.outputPath) : path4.join(packsDir, `project-group-${createTimestamp()}.tgz`);
-  await mkdir3(projectsDir, { recursive: true });
-  await mkdir3(path4.dirname(archivePath), { recursive: true });
+  const packsDir = process.env.WORKFLOW_WORKSPACE_PACKS_DIR ? path3.resolve(process.env.WORKFLOW_WORKSPACE_PACKS_DIR) : path3.join(repoRoot, "workspace", ".packs");
+  const groupRoot = path3.join(packsDir, "tmp", `project-group-${randomUUID()}`);
+  const projectsDir = path3.join(groupRoot, "projects");
+  const archivePath = options.outputPath ? path3.resolve(options.outputPath) : path3.join(packsDir, `project-group-${createTimestamp()}.tgz`);
+  await mkdir2(projectsDir, { recursive: true });
+  await mkdir2(path3.dirname(archivePath), { recursive: true });
   const rootArchivePath = `projects/${contexts.root.workflowId}.tgz`;
   const projects = [{
     projectId: contexts.root.workflowId,
@@ -1920,21 +1908,22 @@ async function packProjectGroup(options) {
   try {
     await packWorkflow(
       contexts.root.workflowArg,
-      path4.join(groupRoot, ...rootArchivePath.split("/")),
+      path3.join(groupRoot, ...rootArchivePath.split("/")),
       contexts.root.workflowDir,
       { projectGroupSafe: true }
     );
     for (const dependency of contexts.dependencies) {
-      const dependencyArchivePath = `projects/${dependency.workflowId}.tgz`;
+      const dependencyArchivePath = `projects/${dependency.packageContext.workflowId}.tgz`;
       projects.push({
-        projectId: dependency.workflowId,
+        projectId: dependency.packageContext.workflowId,
         role: "dependency",
-        archivePath: dependencyArchivePath
+        archivePath: dependencyArchivePath,
+        alias: dependency.alias
       });
       await packWorkflow(
-        dependency.workflowArg,
-        path4.join(groupRoot, ...dependencyArchivePath.split("/")),
-        dependency.workflowDir,
+        dependency.packageContext.workflowArg,
+        path3.join(groupRoot, ...dependencyArchivePath.split("/")),
+        dependency.packageContext.workflowDir,
         { projectGroupSafe: true }
       );
     }
@@ -1944,7 +1933,7 @@ async function packProjectGroup(options) {
       projects,
       dependencies: contexts.locks
     };
-    await writeFile2(path4.join(groupRoot, "project-group.json"), `${JSON.stringify(manifest, null, 2)}
+    await writeFile(path3.join(groupRoot, "project-group.json"), `${JSON.stringify(manifest, null, 2)}
 `);
     const result = await runCommand("tar", ["-czf", archivePath, "-C", groupRoot, "."], { cwd: repoRoot });
     if (result.exitCode !== 0) {
@@ -1957,15 +1946,15 @@ async function packProjectGroup(options) {
       archivePath,
       manifest,
       root: contexts.root,
-      dependencies: contexts.dependencies
+      dependencies: contexts.dependencies.map((dependency) => dependency.packageContext)
     };
   } finally {
-    await rm2(groupRoot, { recursive: true, force: true });
+    await rm(groupRoot, { recursive: true, force: true });
   }
 }
 async function uploadProjectGroupPackage(options) {
-  const archiveBuffer = await readFile3(options.archivePath);
-  const archiveName = path4.basename(options.archivePath);
+  const archiveBuffer = await readFile2(options.archivePath);
+  const archiveName = path3.basename(options.archivePath);
   const query = new URLSearchParams({ fileName: archiveName });
   if (options.executionTargets !== void 0) {
     query.set("serverRuntime", String(options.executionTargets.server));
@@ -2003,8 +1992,8 @@ async function resolveRemoteWorkflowId(parsed) {
 }
 async function readWorkflowPackageContext(workflowArg, sourcePath) {
   const repoRoot = resolveRepoRoot();
-  const workflowDir = sourcePath === void 0 ? path4.join(repoRoot, "workspace", "workflow", workflowArg) : path4.resolve(sourcePath);
-  const packageJsonPath = path4.join(workflowDir, "package.json");
+  const workflowDir = sourcePath === void 0 ? path3.join(repoRoot, "workspace", "workflow", workflowArg) : path3.resolve(sourcePath);
+  const packageJsonPath = path3.join(workflowDir, "package.json");
   const packageJson = await readPackageJsonFile(packageJsonPath);
   const workflowId = typeof packageJson.id === "string" && isWorkflowUuid(packageJson.id) ? packageJson.id.trim() : void 0;
   const workflowName = readRequiredPackageString(packageJson, "name");
@@ -2020,6 +2009,14 @@ async function readWorkflowPackageContext(workflowArg, sourcePath) {
   };
 }
 async function ensureWorkflowProjectCreated(options) {
+  const workflowId = options.packageContext.workflowId;
+  if (workflowId === void 0) {
+    throw new Error(i18n.t("workflowIdRequired", { ns: "cli" }));
+  }
+  const projectInfo = readWorkflowProjectInfo(options.packageContext.packageJson);
+  if (projectInfo.dataStorage === null) {
+    throw new Error(i18n.t("projectInfoDataStorageRequired", { ns: "cli" }));
+  }
   const created = await fetchApi({
     server: options.server,
     token: options.token,
@@ -2028,7 +2025,8 @@ async function ensureWorkflowProjectCreated(options) {
     body: {
       name: options.packageContext.workflowName,
       projectType: options.packageContext.projectType,
-      ...options.packageContext.workflowId ? { workflowId: options.packageContext.workflowId } : {}
+      workflowId,
+      projectInfo
     }
   });
   if (created.errCode !== 0 || created.data === void 0) {
@@ -2036,14 +2034,14 @@ async function ensureWorkflowProjectCreated(options) {
     assertApiOk(created);
     throw new Error(i18n.t("projectCreationFailed", { ns: "cli" }));
   }
-  if (!options.packageContext.workflowId || options.packageContext.workflowId !== created.data.workflowId) {
-    await writeWorkflowPackageId(options.packageContext.packageJsonPath, created.data.workflowId);
+  if (created.data.workflowId !== workflowId) {
+    throw new Error(i18n.t("projectCreationIdMismatch", { ns: "cli" }));
   }
   return created.data;
 }
 async function readPackageJsonFile(packageJsonPath) {
   try {
-    const raw = JSON.parse(await readFile3(packageJsonPath, "utf8"));
+    const raw = JSON.parse(await readFile2(packageJsonPath, "utf8"));
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
       throw new Error(i18n.t("packageMustBeObject", { ns: "cli", path: packageJsonPath }));
     }
@@ -2062,20 +2060,9 @@ function readRequiredPackageString(packageJson, key) {
   }
   return value.trim();
 }
-async function writeWorkflowPackageId(packageJsonPath, workflowId) {
-  const packageJson = await readPackageJsonFile(packageJsonPath);
-  await writeFile2(
-    packageJsonPath,
-    `${JSON.stringify({
-      ...packageJson,
-      id: workflowId
-    }, null, 2)}
-`
-  );
-}
 async function uploadPackage(options) {
-  const archiveBuffer = await readFile3(options.archivePath);
-  const archiveName = path4.basename(options.archivePath);
+  const archiveBuffer = await readFile2(options.archivePath);
+  const archiveName = path3.basename(options.archivePath);
   const query = new URLSearchParams({ fileName: archiveName });
   if (options.executionTargets !== void 0) {
     query.set("serverRuntime", String(options.executionTargets.server));
@@ -2169,10 +2156,10 @@ async function copyWorkflowSource(sourceDir, targetDir, options = {}) {
       path: JSON.stringify(forbiddenRequiredPath)
     }));
   }
-  await mkdir3(targetDir, { recursive: true });
+  await mkdir2(targetDir, { recursive: true });
   for (const file of files) {
-    const targetPath = path4.join(targetDir, ...file.path.split("/"));
-    await mkdir3(path4.dirname(targetPath), { recursive: true });
+    const targetPath = path3.join(targetDir, ...file.path.split("/"));
+    await mkdir2(path3.dirname(targetPath), { recursive: true });
     await copyFile2(file.absolutePath, targetPath);
   }
   return {
@@ -2191,8 +2178,8 @@ async function stageWorkflowWithLocalDependencies(options) {
       continue;
     }
     visited.add(currentWorkflowName);
-    const sourceDir = currentWorkflowName === options.workflowName ? options.workflowDir : path4.join(options.workspaceRoot, currentWorkflowName);
-    if (!existsSync2(path4.join(sourceDir, "package.json"))) {
+    const sourceDir = currentWorkflowName === options.workflowName ? options.workflowDir : path3.join(options.workspaceRoot, currentWorkflowName);
+    if (!existsSync2(path3.join(sourceDir, "package.json"))) {
       throw new Error(i18n.t("localDependencyMissingPackage", {
         ns: "cli",
         workflow: options.workflowName,
@@ -2202,7 +2189,7 @@ async function stageWorkflowWithLocalDependencies(options) {
     }
     const uploadPlan = await copyWorkflowSource(
       sourceDir,
-      path4.join(options.stagingRoot, currentWorkflowName),
+      path3.join(options.stagingRoot, currentWorkflowName),
       { projectGroupSafe: options.projectGroupSafe }
     );
     if (currentWorkflowName === options.workflowName && !uploadPlan.workflowIgnoreConfigured) {
@@ -2223,11 +2210,11 @@ async function stageWorkflowWithLocalDependencies(options) {
 async function findLocalWorkflowDependencies(sourceDir) {
   const discovered = /* @__PURE__ */ new Set();
   for (const fileName of ["index.ts", "interface.ts", "globals.d.ts"]) {
-    const filePath = path4.join(sourceDir, fileName);
+    const filePath = path3.join(sourceDir, fileName);
     if (!existsSync2(filePath)) {
       continue;
     }
-    const source = await readFile3(filePath, "utf8");
+    const source = await readFile2(filePath, "utf8");
     for (const match of source.matchAll(/(?:from\s+|reference path=)\"(\.\.\/([^/\"']+)(?:\/[^\"']*)?)\"/g)) {
       const workflowName = match[2]?.trim();
       if (workflowName) {
@@ -2289,7 +2276,6 @@ function parseArgs(argv) {
     server: process.env.WORKFLOW_SERVER_URL ?? authConfig.serverUrl ?? DEFAULT_SERVER_URL,
     token: process.env.WORKFLOW_SERVER_ADMIN_KEY ?? authConfig.apiKey ?? "",
     dependencies: [],
-    dataGrants: [],
     desktopPlatforms: []
   };
   for (let index = 0; index < rest.length; index += 1) {
@@ -2355,8 +2341,7 @@ function parseArgs(argv) {
         options.dependencies.push(requireValue(rest, index += 1, "--dependency"));
         break;
       case "--grant-data-access":
-        options.dataGrants.push(requireValue(rest, index += 1, "--grant-data-access"));
-        break;
+        throw new Error(i18n.t("unknownWorkspaceOption", { ns: "cli", option: arg }));
       case "--project-group":
         options.projectGroup = true;
         break;
@@ -2391,9 +2376,6 @@ function parseArgs(argv) {
   if (options.dependencies.length > 0 && command !== "pack" && command !== "upload" && command !== "publish") {
     throw new Error(i18n.t("dependencyOptionCommandUnsupported", { ns: "cli" }));
   }
-  if (options.dataGrants.length > 0 && command !== "upload" && command !== "publish") {
-    throw new Error(i18n.t("grantDataAccessCommandUnsupported", { ns: "cli" }));
-  }
   if (options.deployment !== void 0 && command !== "publish") {
     throw new Error(i18n.t("deploymentCommandUnsupported", { ns: "cli" }));
   }
@@ -2410,7 +2392,7 @@ function parseArgs(argv) {
   if (options.sourceMode === "bundled" && options.desktopPlatforms.length > 0) {
     throw new Error(i18n.t("desktopPlatformRequiresSource", { ns: "cli" }));
   }
-  if (options.deployment !== void 0 && (options.projectGroup === true || options.dependencies.length > 0 || options.dataGrants.length > 0 || options.path !== void 0 || options.file !== void 0 || options.output !== void 0 || options.create === true || options.releaseLog !== void 0 || options.sourceMode !== void 0 || hasExecutionTargetOptions)) {
+  if (options.deployment !== void 0 && (options.projectGroup === true || options.dependencies.length > 0 || options.path !== void 0 || options.file !== void 0 || options.output !== void 0 || options.create === true || options.releaseLog !== void 0 || options.sourceMode !== void 0 || hasExecutionTargetOptions)) {
     throw new Error(i18n.t("deploymentOptionsConflict", { ns: "cli" }));
   }
   return {
@@ -2501,7 +2483,7 @@ function printUsage() {
 }
 function resolveRepoRoot(startDir = process.cwd()) {
   if (process.env.WORKFLOW_REPO_ROOT !== void 0) {
-    return path4.resolve(process.env.WORKFLOW_REPO_ROOT);
+    return path3.resolve(process.env.WORKFLOW_REPO_ROOT);
   }
   for (const candidate of [startDir, CLI_MODULE_DIR]) {
     const repoRoot = findWorkspaceRepositoryRoot(candidate);
@@ -2576,7 +2558,7 @@ function readRetryAfterSeconds(data) {
   const value = data.retryAfterSeconds;
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
 }
-if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL(path4.resolve(process.argv[1])).href) {
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL(path3.resolve(process.argv[1])).href) {
   main().catch((error) => {
     console.error(translateWorkflowCodeError(error));
     process.exitCode = 1;
@@ -2597,13 +2579,11 @@ export {
   readPackageJsonFile,
   readProjectGroupContexts,
   readWorkflowPackageContext,
-  resolveExplicitDataGrants,
   resolveRemoteWorkflowId,
   resolveRepoRoot,
   resolveRequestedExecutionTargets,
   shouldUseProjectGroupUpload,
   stageWorkflowWithLocalDependencies,
   waitForDeviceToken,
-  waitForPreparation,
-  writeWorkflowPackageId
+  waitForPreparation
 };