@carthooks/arcubase-cli 0.1.9 → 0.1.12

package/bundle/arcubase-admin.mjs

@@ -78,10 +78,17 @@ function envValue(env, scope, key) {
 function requiredValue(env, scope, key) {
   const value = envValue(env, scope, key);
   if (!value || value.trim() === "") {
-    throw new Error(`${key} is required`);
+    throw new CLIError("RUNTIME_ENV_REQUIRED", `${key} is required`, 2);
   }
   return value;
 }
+function requiredDirectValue(env, key) {
+  const value = env[key];
+  if (!value || value.trim() === "") {
+    throw new CLIError("RUNTIME_ENV_REQUIRED", `${key} is required`, 2);
+  }
+  return value.trim();
+}
 function optionalValue(env, scope, key) {
   const value = envValue(env, scope, key);
   if (!value || value.trim() === "") {
@@ -93,6 +100,7 @@ function loadRuntimeEnv(scope, env = process.env) {
   return {
     ARCUBASE_BASE_URL: requiredValue(env, scope, "ARCUBASE_BASE_URL"),
     ARCUBASE_ACCESS_TOKEN: requiredValue(env, scope, "ARCUBASE_ACCESS_TOKEN"),
+    ARCUBASE_SDK_ROOT: requiredDirectValue(env, "ARCUBASE_SDK_ROOT"),
     ARCUBASE_TRACE_ID: optionalValue(env, scope, "ARCUBASE_TRACE_ID"),
     ARCUBASE_SUBJECT_TYPE: optionalValue(env, scope, "ARCUBASE_SUBJECT_TYPE"),
     ARCUBASE_SUBJECT_ID: optionalValue(env, scope, "ARCUBASE_SUBJECT_ID"),
@@ -151,7 +159,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "common",
+    "module": "app",
     "functionName": "getAppDetail",
     "commandPath": [
       "app",
@@ -230,7 +238,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "app",
+    "module": "table",
     "functionName": "getEntities",
     "commandPath": [
       "table",
@@ -251,7 +259,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "entity",
+    "module": "table",
     "functionName": "adminGetEntityInfo",
     "commandPath": [
       "table",
@@ -276,7 +284,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "app",
+    "module": "table",
     "functionName": "createEntity",
     "commandPath": [
       "table",
@@ -297,7 +305,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "entity",
+    "module": "table",
     "functionName": "adminSaveEntity",
     "commandPath": [
       "table",
@@ -322,7 +330,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "entity",
+    "module": "table",
     "functionName": "adminSaveEntityName",
     "commandPath": [
       "table",
@@ -347,7 +355,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "entity",
+    "module": "table",
     "functionName": "adminDeleteEntity",
     "commandPath": [
       "table",
@@ -372,7 +380,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "ingress",
+    "module": "access-rule",
     "functionName": "getEntityIngressList",
     "commandPath": [
       "access-rule",
@@ -397,7 +405,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "ingress",
+    "module": "access-rule",
     "functionName": "getEntityIngress",
     "commandPath": [
       "access-rule",
@@ -426,7 +434,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "ingress",
+    "module": "access-rule",
     "functionName": "createEntityIngress",
     "commandPath": [
       "access-rule",
@@ -451,7 +459,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "ingress",
+    "module": "access-rule",
     "functionName": "updateEntityIngress",
     "commandPath": [
       "access-rule",
@@ -480,7 +488,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "ingress",
+    "module": "access-rule",
     "functionName": "deleteEntityIngress",
     "commandPath": [
       "access-rule",
@@ -509,7 +517,7 @@ var adminCommands = [
   },
   {
     "scope": "admin",
-    "module": "ingress",
+    "module": "access-rule",
     "functionName": "updateEntityIngress",
     "commandPath": [
       "access-rule",
@@ -647,7 +655,7 @@ var adminCommands = [
 var userCommands = [
   {
     "scope": "user",
-    "module": "global-action",
+    "module": "entry",
     "functionName": "getEntry",
     "commandPath": [
       "entry"
@@ -660,16 +668,17 @@ var userCommands = [
     "queryParams": [
       {
         "key": "include_app_tables",
-        "flag": "include-app-tables",
+        "flag": "",
         "type": "boolean",
-        "hasDefault": true
+        "hasDefault": true,
+        "fixedValue": "true"
       }
     ],
     "responseType": "GlobalActionEntryRespVO"
   },
   {
     "scope": "user",
-    "module": "entity",
+    "module": "table",
     "functionName": "getEntityInfo",
     "commandPath": [
       "table",
@@ -694,7 +703,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "common",
+    "module": "table",
     "functionName": "getDataset",
     "commandPath": [
       "table",
@@ -719,7 +728,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "common",
+    "module": "table",
     "functionName": "queryLinktoPickOptions",
     "commandPath": [
       "table",
@@ -744,7 +753,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "workflow",
+    "module": "row",
     "functionName": "queryEntity",
     "commandPath": [
       "row",
@@ -769,7 +778,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "workflow",
+    "module": "row",
     "functionName": "getEntityRow",
     "commandPath": [
       "row",
@@ -805,7 +814,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "workflow",
+    "module": "row",
     "functionName": "insertEntity",
     "commandPath": [
       "row",
@@ -830,7 +839,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "workflow",
+    "module": "row",
     "functionName": "updateEntityRow",
     "commandPath": [
       "row",
@@ -859,7 +868,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "workflow",
+    "module": "row",
     "functionName": "deleteEntityRow",
     "commandPath": [
       "row",
@@ -884,7 +893,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "entity",
+    "module": "row",
     "functionName": "updateEntityBulk",
     "commandPath": [
       "row",
@@ -909,7 +918,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "workflow",
+    "module": "row",
     "functionName": "queryEntitySelection",
     "commandPath": [
       "row",
@@ -938,7 +947,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "common",
+    "module": "upload",
     "functionName": "getUploadToken",
     "commandPath": [
       "upload",
@@ -954,7 +963,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "common",
+    "module": "upload",
     "functionName": "uploadPreview",
     "commandPath": [
       "upload",
@@ -970,7 +979,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "common",
+    "module": "upload",
     "functionName": "mobileUpload",
     "commandPath": [
       "upload",
@@ -986,7 +995,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "common",
+    "module": "upload",
     "functionName": "checkMobileUpload",
     "commandPath": [
       "upload",
@@ -1034,7 +1043,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "entity",
+    "module": "workflow",
     "functionName": "getEntityProcessMap",
     "commandPath": [
       "workflow",
@@ -1063,7 +1072,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "entity",
+    "module": "workflow",
     "functionName": "doEntityAction",
     "commandPath": [
       "workflow",
@@ -1097,7 +1106,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "entity",
+    "module": "workflow",
     "functionName": "doEntityAction",
     "commandPath": [
       "workflow",
@@ -1131,7 +1140,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "entity",
+    "module": "workflow",
     "functionName": "doEntityAction",
     "commandPath": [
       "workflow",
@@ -1165,7 +1174,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "entity",
+    "module": "workflow",
     "functionName": "doEntityAction",
     "commandPath": [
       "workflow",
@@ -1199,7 +1208,7 @@ var userCommands = [
   },
   {
     "scope": "user",
-    "module": "entity",
+    "module": "workflow",
     "functionName": "doEntityAction",
     "commandPath": [
       "workflow",
@@ -1881,8 +1890,8 @@ function getErrorMap() {
 
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path2, errorMaps, issueData } = params;
-  const fullPath = [...path2, ...issueData.path || []];
+  const { data, path, errorMaps, issueData } = params;
+  const fullPath = [...path, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -1998,11 +2007,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path2, key) {
+  constructor(parent, value, path, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path2;
+    this._path = path;
     this._key = key;
   }
   get path() {
@@ -5555,99 +5564,113 @@ var unsupportedBodySchemas = {};
 // src/generated/type_index.generated.ts
 var typeIndex = {
   "AppCreateByTenantsReqVO": {
-    "file": "/opt/arcubase-sdk/types/app.ts",
+    "file": "types/app.ts",
     "dependencies": []
   },
   "AppCreateEntityReqVO": {
-    "file": "/opt/arcubase-sdk/types/app.ts",
+    "file": "types/app.ts",
     "dependencies": []
   },
   "AppIngressCreateReqVO": {
-    "file": "/opt/arcubase-sdk/types/ingress.ts",
+    "file": "types/ingress.ts",
     "dependencies": []
   },
   "AppIngressUpdateReqVO": {
-    "file": "/opt/arcubase-sdk/types/ingress.ts",
+    "file": "types/ingress.ts",
     "dependencies": []
   },
   "AppUpdateAppReqVO": {
-    "file": "/opt/arcubase-sdk/types/app.ts",
+    "file": "types/app.ts",
     "dependencies": []
   },
   "EntityBulkUpdateReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "EntityDoActionReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "EntityQueryRelationReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "EntityQueryReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "EntityResolveWorkflowReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "EntitySaveNameReqVO": {
-    "file": "/opt/arcubase-sdk/types/entity.ts",
+    "file": "types/entity.ts",
     "dependencies": []
   },
   "EntitySaveReqVO": {
-    "file": "/opt/arcubase-sdk/types/entity.ts",
+    "file": "types/entity.ts",
     "dependencies": []
   },
   "EntitySelectionActionReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "EntityUpdateReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "EntityWorkflowApproveUsersReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "EntityWorkflowDeployReqVO": {
-    "file": "/opt/arcubase-sdk/types/workflow.ts",
+    "file": "types/workflow.ts",
     "dependencies": []
   },
   "EntityWorkflowUpdateReqVO": {
-    "file": "/opt/arcubase-sdk/types/workflow.ts",
+    "file": "types/workflow.ts",
     "dependencies": []
   },
   "GetUploadTokenReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "InsertReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "MobileUploadCheckReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "MobileUploadReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   },
   "UploadPreviewReqVO": {
-    "file": "/opt/arcubase-sdk/types/common.ts",
+    "file": "types/common.ts",
     "dependencies": []
   },
   "UserProfileUpdateReqVO": {
-    "file": "/opt/arcubase-sdk/types/user-action.ts",
+    "file": "types/user-action.ts",
     "dependencies": []
   }
 };
 
+// src/runtime/paths.ts
+function resolveArcubaseSDKRoot(env = process.env) {
+  const value = env.ARCUBASE_SDK_ROOT?.trim();
+  if (value) return value;
+  throw new CLIError("RUNTIME_ENV_REQUIRED", "ARCUBASE_SDK_ROOT is required", 2);
+}
+function resolveArcubaseSDKPath(filePath, env = process.env) {
+  const cleanPath = String(filePath || "").trim().replace(/^\/+/, "");
+  if (!cleanPath) {
+    throw new CLIError("RUNTIME_ENV_REQUIRED", "ARCUBASE_SDK_ROOT path is required", 2);
+  }
+  return `${resolveArcubaseSDKRoot(env).replace(/\/+$/, "")}/${cleanPath}`;
+}
+
 // src/runtime/entity_save_schema.ts
 var simpleFieldTypes = [
   "text",
@@ -5791,6 +5814,32 @@ function isRecord(value) {
 function cloneJSON(value) {
   return JSON.parse(JSON.stringify(value));
 }
+function normalizeFieldVO(value) {
+  if (!isRecord(value)) {
+    return value;
+  }
+  const field = { ...value };
+  field.unique ??= false;
+  field.editable ??= true;
+  field.visible ??= true;
+  field.show_label ??= true;
+  field.scannable ??= false;
+  field.default_value_mode ??= 0;
+  field.description ??= "";
+  field.value ??= null;
+  field.number_decimal ??= 0;
+  field.depends ??= [];
+  field.code_index ??= false;
+  field.transfers ??= null;
+  if (field.type === "subform") {
+    if (Array.isArray(field.children)) {
+      field.children = field.children.map((child) => normalizeFieldVO(child));
+    }
+  } else {
+    field.children ??= null;
+  }
+  return field;
+}
 function makeSimpleFieldSchema(type) {
   return external_exports.object({
     ...fieldCommonShape,
@@ -5942,6 +5991,9 @@ function normalizeEntitySaveInput(value) {
       }
     }
   }
+  if (Array.isArray(entity.fields)) {
+    entity.fields = entity.fields.map((field) => normalizeFieldVO(field));
+  }
   return entity;
 }
 function collectAllFieldIds(fields) {
@@ -6320,60 +6372,105 @@ function getUnsupportedBodySchemaReason(typeName) {
   if (!name) return null;
   return unsupportedBodySchemas[name] ?? null;
 }
+function sdkPath(file, env = process.env) {
+  return resolveArcubaseSDKPath(file.replace(/^\/?opt\/arcubase-sdk\/?/, ""), env);
+}
+function resolveTypeHintFiles(hints, env = process.env) {
+  return hints.map((item) => ({ ...item, file: sdkPath(item.file, env) }));
+}
+function resolveDocHintFiles(hints, env = process.env) {
+  return hints.map((item) => ({ ...item, file: sdkPath(item.file, env) }));
+}
 var examplesIndexDocHint = {
   title: "Examples index",
-  file: "/opt/arcubase-sdk/docs/runtime-reference/examples/README.md"
+  file: "docs/runtime-reference/examples/README.md"
+};
+var selectionDocHint = {
+  title: "Selection",
+  file: "docs/runtime-reference/selection.md"
+};
+var conditionDocHint = {
+  title: "Condition",
+  file: "docs/runtime-reference/condition.md"
 };
 var docHintIndex = {
   AppCreateByTenantsReqVO: [
-    { title: "Table lifecycle", file: "/opt/arcubase-sdk/docs/runtime-reference/table-lifecycle.md" },
+    { title: "Table lifecycle", file: "docs/runtime-reference/table-lifecycle.md" },
     examplesIndexDocHint
   ],
   AppCreateEntityReqVO: [
-    { title: "Table lifecycle", file: "/opt/arcubase-sdk/docs/runtime-reference/table-lifecycle.md" },
+    { title: "Table lifecycle", file: "docs/runtime-reference/table-lifecycle.md" },
+    { title: "Table schema cheatsheet", file: "docs/runtime-reference/entity-schema.md" },
+    { title: "Field type index", file: "docs/runtime-reference/entity-schema/README.md" },
+    examplesIndexDocHint
+  ],
+  AppIngressCreateReqVO: [
+    { title: "Access rule", file: "docs/runtime-reference/access-rule.md" },
+    examplesIndexDocHint
+  ],
+  AppIngressUpdateReqVO: [
+    { title: "Access rule", file: "docs/runtime-reference/access-rule.md" },
     examplesIndexDocHint
   ],
   EntitySaveReqVO: [
-    { title: "Entity schema", file: "/opt/arcubase-sdk/docs/runtime-reference/entity-schema.md" },
+    { title: "Table schema cheatsheet", file: "docs/runtime-reference/entity-schema.md" },
+    { title: "Field type index", file: "docs/runtime-reference/entity-schema/README.md" },
+    { title: "Text field", file: "docs/runtime-reference/entity-schema/text.md" },
+    { title: "Textarea field", file: "docs/runtime-reference/entity-schema/textarea.md" },
+    { title: "Number field", file: "docs/runtime-reference/entity-schema/number.md" },
+    { title: "Datetime field", file: "docs/runtime-reference/entity-schema/datetime.md" },
+    { title: "Boolean field", file: "docs/runtime-reference/entity-schema/boolean.md" },
+    { title: "Select field", file: "docs/runtime-reference/entity-schema/select.md" },
     examplesIndexDocHint
   ],
   EntityQueryReqVO: [
-    { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" },
-    { title: "Search and bulk actions", file: "/opt/arcubase-sdk/docs/runtime-reference/search-and-bulk-actions.md" },
+    { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
+    { title: "Search and bulk actions", file: "docs/runtime-reference/search-and-bulk-actions.md" },
+    conditionDocHint,
     examplesIndexDocHint
   ],
   EntityUpdateReqVO: [
-    { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" },
-    { title: "Uploads", file: "/opt/arcubase-sdk/docs/runtime-reference/uploads.md" },
+    { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
+    { title: "Uploads", file: "docs/runtime-reference/uploads.md" },
     examplesIndexDocHint
   ],
   EntitySelectionActionReqVO: [
-    { title: "Search and bulk actions", file: "/opt/arcubase-sdk/docs/runtime-reference/search-and-bulk-actions.md" },
+    selectionDocHint,
+    conditionDocHint,
+    { title: "Search and bulk actions", file: "docs/runtime-reference/search-and-bulk-actions.md" },
     examplesIndexDocHint
   ],
   InsertReqVO: [
-    { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" },
-    { title: "Uploads", file: "/opt/arcubase-sdk/docs/runtime-reference/uploads.md" },
+    { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
+    { title: "Uploads", file: "docs/runtime-reference/uploads.md" },
     examplesIndexDocHint
   ],
   EntityBulkUpdateReqVO: [
-    { title: "Search and bulk actions", file: "/opt/arcubase-sdk/docs/runtime-reference/search-and-bulk-actions.md" },
+    selectionDocHint,
+    conditionDocHint,
+    { title: "Search and bulk actions", file: "docs/runtime-reference/search-and-bulk-actions.md" },
     examplesIndexDocHint
   ],
   "EntityInvokeBatchOperatorReqVO & InvokeRequestVO": [
-    { title: "Search and bulk actions", file: "/opt/arcubase-sdk/docs/runtime-reference/search-and-bulk-actions.md" },
+    selectionDocHint,
+    conditionDocHint,
+    { title: "Search and bulk actions", file: "docs/runtime-reference/search-and-bulk-actions.md" },
     examplesIndexDocHint
   ],
   "{ policy_id: string selection: any }": [
-    { title: "Search and bulk actions", file: "/opt/arcubase-sdk/docs/runtime-reference/search-and-bulk-actions.md" },
+    selectionDocHint,
+    conditionDocHint,
+    { title: "Search and bulk actions", file: "docs/runtime-reference/search-and-bulk-actions.md" },
     examplesIndexDocHint
   ],
   "{ policy_id: string selection: any tag_names: string[] }": [
-    { title: "Search and bulk actions", file: "/opt/arcubase-sdk/docs/runtime-reference/search-and-bulk-actions.md" },
+    selectionDocHint,
+    conditionDocHint,
+    { title: "Search and bulk actions", file: "docs/runtime-reference/search-and-bulk-actions.md" },
     examplesIndexDocHint
   ]
 };
-function getTypeHints(typeName) {
+function getTypeHints(typeName, env = process.env) {
   const name = String(typeName || "").trim();
   if (!name) return [];
   const entry = typeIndex[name];
@@ -6393,211 +6490,86 @@ function getTypeHints(typeName) {
   for (const dep of entry.dependencies ?? []) {
     append(dep.symbol, dep.file);
   }
-  return out;
+  return resolveTypeHintFiles(out, env);
 }
-function getDocHints(typeName) {
+function getDocHints(typeName, env = process.env) {
   const name = String(typeName || "").trim();
   if (!name) return [];
-  return docHintIndex[name] ?? [];
+  return resolveDocHintFiles(docHintIndex[name] ?? [], env);
 }
 var commandDocHintIndex = {
   "admin.app.createAppByTenants": [
-    { title: "Table lifecycle", file: "/opt/arcubase-sdk/docs/runtime-reference/table-lifecycle.md" },
+    { title: "Table lifecycle", file: "docs/runtime-reference/table-lifecycle.md" },
     examplesIndexDocHint
   ],
   "admin.app.createEntity": [
-    { title: "Table lifecycle", file: "/opt/arcubase-sdk/docs/runtime-reference/table-lifecycle.md" },
+    { title: "Table lifecycle", file: "docs/runtime-reference/table-lifecycle.md" },
+    examplesIndexDocHint
+  ],
+  "admin.table.adminGetEntityInfo": [
+    { title: "Table lifecycle", file: "docs/runtime-reference/table-lifecycle.md" },
     examplesIndexDocHint
   ],
-  "admin.entity.adminGetEntityInfo": [
-    { title: "Table lifecycle", file: "/opt/arcubase-sdk/docs/runtime-reference/table-lifecycle.md" },
+  "admin.table.adminSaveEntity": [
+    { title: "Table schema cheatsheet", file: "docs/runtime-reference/entity-schema.md" },
+    { title: "Field type index", file: "docs/runtime-reference/entity-schema/README.md" },
+    { title: "Table lifecycle", file: "docs/runtime-reference/table-lifecycle.md" },
+    { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
     examplesIndexDocHint
   ],
-  "admin.entity.adminSaveEntity": [
-    { title: "Entity schema", file: "/opt/arcubase-sdk/docs/runtime-reference/entity-schema.md" },
-    { title: "Table lifecycle", file: "/opt/arcubase-sdk/docs/runtime-reference/table-lifecycle.md" },
-    { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" },
+  "admin.access-rule.createEntityIngress": [
+    { title: "Access rule", file: "docs/runtime-reference/access-rule.md" },
     examplesIndexDocHint
   ],
-  "user.workflow.insertEntity": [
-    { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" },
-    { title: "Uploads", file: "/opt/arcubase-sdk/docs/runtime-reference/uploads.md" },
+  "admin.access-rule.updateEntityIngress": [
+    { title: "Access rule", file: "docs/runtime-reference/access-rule.md" },
     examplesIndexDocHint
   ],
-  "user.workflow.queryEntity": [
-    { title: "Search and bulk actions", file: "/opt/arcubase-sdk/docs/runtime-reference/search-and-bulk-actions.md" },
-    { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" },
+  "user.row.insertEntity": [
+    { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
+    { title: "Uploads", file: "docs/runtime-reference/uploads.md" },
     examplesIndexDocHint
   ],
-  "user.workflow.getEntityRow": [
-    { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" },
+  "user.row.queryEntity": [
+    { title: "Search and bulk actions", file: "docs/runtime-reference/search-and-bulk-actions.md" },
+    conditionDocHint,
+    { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
     examplesIndexDocHint
   ],
-  "user.workflow.updateEntityRow": [
-    { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" },
-    { title: "Uploads", file: "/opt/arcubase-sdk/docs/runtime-reference/uploads.md" },
+  "user.row.getEntityRow": [
+    { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
     examplesIndexDocHint
   ],
-  "user.workflow.queryEntitySelection": [
-    { title: "Search and bulk actions", file: "/opt/arcubase-sdk/docs/runtime-reference/search-and-bulk-actions.md" },
+  "user.row.updateEntityRow": [
+    { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
+    { title: "Uploads", file: "docs/runtime-reference/uploads.md" },
     examplesIndexDocHint
   ],
-  "user.workflow.deleteEntityRow": [
-    { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" },
+  "user.row.queryEntitySelection": [
+    selectionDocHint,
+    conditionDocHint,
+    { title: "Search and bulk actions", file: "docs/runtime-reference/search-and-bulk-actions.md" },
     examplesIndexDocHint
   ],
-  "user.workflow.restoreEntityRow": [
-    { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" },
+  "user.row.deleteEntityRow": [
+    { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
     examplesIndexDocHint
   ],
-  "user.entity.updateEntityBulk": [
-    { title: "Search and bulk actions", file: "/opt/arcubase-sdk/docs/runtime-reference/search-and-bulk-actions.md" },
+  "user.row.restoreEntityRow": [
+    { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
+    examplesIndexDocHint
+  ],
+  "user.row.updateEntityBulk": [
+    selectionDocHint,
+    conditionDocHint,
+    { title: "Search and bulk actions", file: "docs/runtime-reference/search-and-bulk-actions.md" },
     examplesIndexDocHint
   ]
 };
-function getCommandDocHints(operation) {
+function getCommandDocHints(operation, env = process.env) {
   const key = String(operation || "").trim();
   if (!key) return [];
-  return commandDocHintIndex[key] ?? [];
-}
-
-// src/runtime/upload.ts
-import fs2 from "fs";
-import path from "path";
-function readUploadSource(sourcePath) {
-  const absolutePath = path.resolve(sourcePath);
-  if (!fs2.existsSync(absolutePath)) {
-    throw new CLIError("UPLOAD_SOURCE_NOT_FOUND", `upload source file does not exist: ${sourcePath}`, 2);
-  }
-  const stat = fs2.statSync(absolutePath);
-  if (!stat.isFile()) {
-    throw new CLIError("UPLOAD_SOURCE_INVALID", `upload source path must be a file: ${sourcePath}`, 2);
-  }
-  return {
-    absolutePath,
-    bytes: fs2.readFileSync(absolutePath)
-  };
-}
-function parseJSONResponse(raw) {
-  try {
-    return raw ? JSON.parse(raw) : null;
-  } catch {
-    return raw;
-  }
-}
-function requireTokenPayload(payload) {
-  if (payload && typeof payload === "object" && payload.error) {
-    const upstreamError = payload.error;
-    const message = typeof upstreamError === "object" && upstreamError && "message" in upstreamError && typeof upstreamError.message === "string" ? upstreamError.message : typeof upstreamError === "string" ? upstreamError : JSON.stringify(upstreamError);
-    throw new CLIError("UPSTREAM_BODY_ERROR", message, 1, {
-      endpoint: "/api/upload/token",
-      method: "POST",
-      traceId: typeof payload.trace_id === "string" ? payload.trace_id : void 0,
-      upstreamError
-    });
-  }
-  if (!payload?.data || typeof payload.data !== "object") {
-    throw new CLIError("UPLOAD_TOKEN_INVALID", "upload token response did not include data", 1);
-  }
-  return payload.data;
-}
-function renderUploadHelp() {
-  return [
-    "arcubase upload <local-file> [flags]",
-    "",
-    "purpose:",
-    "  - upload one local file through Arcubase",
-    "  - return a field value that can be used directly in file or image row payloads",
-    "",
-    "flags:",
-    "  --filename <name>   override the uploaded filename stored in Arcubase",
-    "  --global            request a global upload token instead of a tenant-scoped token",
-    "",
-    "result shape:",
-    "  - data is a JSON array",
-    "  - use that array directly as the value of a file or image field in insert/update payloads",
-    "",
-    "example:",
-    "  arcubase upload ./contract.pdf",
-    "  arcubase upload ./photo.jpg --filename lead-photo.jpg",
-    "",
-    "docs:",
-    "  - Uploads: /opt/arcubase-sdk/docs/runtime-reference/uploads.md",
-    "  - Row CRUD: /opt/arcubase-sdk/docs/runtime-reference/row-crud.md",
-    "  - File field: /opt/arcubase-sdk/docs/runtime-reference/entity-schema/file.md",
-    "  - Image field: /opt/arcubase-sdk/docs/runtime-reference/entity-schema/image.md"
-  ].join("\n");
-}
-async function uploadLocalFile(env, sourcePath, options, fetchImpl = fetch) {
-  const { absolutePath, bytes } = readUploadSource(sourcePath);
-  const filename = options.filename && options.filename.trim() || path.basename(absolutePath);
-  const tokenResponse = await fetchImpl(buildURL(env.ARCUBASE_BASE_URL, "/api/upload/token"), {
-    method: "POST",
-    headers: {
-      ...buildRequestHeaders(env),
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
-      global: Boolean(options.global)
-    })
-  });
-  const tokenRaw = await tokenResponse.text();
-  const tokenParsed = parseJSONResponse(tokenRaw);
-  if (!tokenResponse.ok) {
-    throw new CLIError("UPLOAD_TOKEN_REQUEST_FAILED", typeof tokenParsed === "string" ? tokenParsed : JSON.stringify(tokenParsed), 1, {
-      endpoint: "/api/upload/token",
-      method: "POST"
-    });
-  }
-  const tokenData = requireTokenPayload(tokenParsed);
-  if (tokenData.mode !== "aliyun-oss" && tokenData.mode !== "s3-post-policy") {
-    throw new CLIError("UPLOAD_MODE_UNSUPPORTED", `unsupported upload mode: ${String(tokenData.mode || "")}`, 1);
-  }
-  if (!tokenData.token_data?.dir || !tokenData.token_data.policy || !tokenData.token_data.host) {
-    throw new CLIError("UPLOAD_TOKEN_INVALID", "upload token response is missing required token_data fields", 1);
-  }
-  if (tokenData.id === void 0 || tokenData.id === null || tokenData.id === "") {
-    throw new CLIError("UPLOAD_TOKEN_INVALID", "upload token response is missing id", 1);
-  }
-  const form = new FormData();
-  form.append("key", `${tokenData.token_data.dir}${filename}`);
-  form.append("policy", tokenData.token_data.policy);
-  if (tokenData.mode === "aliyun-oss") {
-    if (!tokenData.token_data.accessid || !tokenData.token_data.signature) {
-      throw new CLIError("UPLOAD_TOKEN_INVALID", "upload token response is missing required token_data fields", 1);
-    }
-    form.append("OSSAccessKeyId", tokenData.token_data.accessid);
-    form.append("success_action_status", "200");
-    form.append("signature", tokenData.token_data.signature);
-  } else {
-    if (!tokenData.token_data.x_amz_algorithm || !tokenData.token_data.x_amz_credential || !tokenData.token_data.x_amz_date || !tokenData.token_data.x_amz_signature) {
-      throw new CLIError("UPLOAD_TOKEN_INVALID", "upload token response is missing required s3 token_data fields", 1);
-    }
-    form.append("x-amz-algorithm", tokenData.token_data.x_amz_algorithm);
-    form.append("x-amz-credential", tokenData.token_data.x_amz_credential);
-    form.append("x-amz-date", tokenData.token_data.x_amz_date);
-    form.append("x-amz-signature", tokenData.token_data.x_amz_signature);
-  }
-  form.append("file", new Blob([new Uint8Array(bytes)]), filename);
-  const uploadResponse = await fetchImpl(tokenData.token_data.host, {
-    method: "POST",
-    body: form
-  });
-  const uploadRaw = await uploadResponse.text();
-  if (!uploadResponse.ok) {
-    throw new CLIError("UPLOAD_TRANSFER_FAILED", uploadRaw || `upload failed with status ${uploadResponse.status}`, 1, {
-      endpoint: tokenData.token_data.host,
-      method: "POST"
-    });
-  }
-  return [
-    {
-      upload_id: tokenData.id,
-      file: filename,
-      file_name: filename,
-      meta: {}
-    }
-  ];
+  return resolveDocHintFiles(commandDocHintIndex[key] ?? [], env);
 }
 
 // src/runtime/execute.ts
@@ -6608,24 +6580,27 @@ function renderRootHelp(scope) {
     `${binary} <command> [subcommand] [flags]`,
     "",
     ...scope === "admin" ? ["use arcubase-admin for app, table, access-rule, and workflow management", ""] : ["use arcubase for entry, table, row, upload, profile, and workflow actions", ""],
+    "prefer --body-json <json-string> for normal payloads, including table schema; use --body-file only when JSON is too large for one tool call",
+    "",
     "modules:",
-    ...items,
-    ...scope === "user" ? ["", "special commands:", "  - upload <local-file>"] : []
+    ...items
   ].join("\n");
 }
-function renderModuleHelp(scope, moduleName) {
+function renderModuleHelp(scope, moduleName, env = process.env) {
   const items = listModuleCommands(scope, moduleName);
   if (items.length === 0) {
     const suggestions = findCommandSuggestions(moduleName, "").map((item) => `${item.binary} ${item.moduleName}${item.commandName ? ` ${item.commandName}` : ""}`);
     throw new CLIError("UNKNOWN_MODULE", `unknown module: ${moduleName}`, 2, suggestions.length > 0 ? { suggestions } : void 0);
   }
   if (items.length === 1 && items[0].commandPath.length === 1) {
-    return renderCommandHelp(scope, moduleName);
+    return renderCommandHelp(scope, moduleName, void 0, env);
   }
   return [
     `${scope === "admin" ? "arcubase-admin" : "arcubase"} ${moduleName} <command> [flags]`,
     "",
     ...scope === "admin" ? ["use arcubase-admin for app, table, access-rule, and workflow management", ""] : ["use arcubase for entry, table, row, upload, profile, and workflow actions", ""],
+    "prefer --body-json <json-string> for normal payloads, including table schema; use --body-file only when JSON is too large for one tool call",
+    "",
     "commands:",
     ...items.filter((item) => item.commandPath.length > 1).map((item) => `  - ${item.commandPath[1]}`)
   ].join("\n");
@@ -6634,31 +6609,76 @@ function buildUnknownCommandDetails(scope, moduleName, commandName) {
   const suggestions = findCommandSuggestions(moduleName, commandName).map((item) => `${item.binary} ${item.moduleName}${item.commandName ? ` ${item.commandName}` : ""}`);
   return suggestions.length > 0 ? { suggestions } : void 0;
 }
-function renderCommandHelp(scope, moduleName, commandName) {
+function sdkPath2(file, env = process.env) {
+  return resolveArcubaseSDKPath(file, env);
+}
+function renderCommandHelp(scope, moduleName, commandName, env = process.env) {
   const command = findCommand(scope, moduleName, commandName);
   if (!command) {
     throw new CLIError("UNKNOWN_COMMAND", `unknown command: ${moduleName}${commandName ? ` ${commandName}` : ""}`, 2, buildUnknownCommandDetails(scope, moduleName, commandName ?? ""));
   }
   const docHints = [
-    ...getCommandDocHints(`${scope}.${command.module}.${command.functionName}`),
-    ...command.requestType ? getDocHints(command.requestType) : []
+    ...getCommandDocHints(`${scope}.${command.module}.${command.functionName}`, env),
+    ...command.requestType ? getDocHints(command.requestType, env) : []
   ].filter((item, index, list) => list.findIndex((candidate) => candidate.file === item.file) === index);
+  const typeHints = command.requestType ? getTypeHints(command.requestType, env) : [];
   const pathFlags = command.pathParams.filter((item) => !getFixedValue(item)).map((item) => `--${item.flag}`);
-  const queryFlags = command.queryParams.filter((item) => !getFixedValue(item)).map((item) => `--${item.flag}`);
+  const queryFlags = visibleQueryParams(command).map((item) => `--${item.flag}`);
+  const isTableCreate = scope === "admin" && command.commandPath[0] === "table" && command.commandPath[1] === "create";
+  const bodyTypeText = isTableCreate ? "TableCreateWithSchema" : command.requestType;
+  const tableCreateExampleBody = JSON.stringify(buildTableCreateExampleBody());
   return [
     `${scope === "admin" ? "arcubase-admin" : "arcubase"} ${command.commandPath.join(" ")}`,
     `method: ${command.method}`,
     `endpoint: ${normalizeExternalEndpoint(command.endpoint)}`,
-    command.requestType ? `body: ${command.requestType} via --body-file or --body-json` : "body: none",
+    command.requestType ? `body: ${bodyTypeText} via --body-json <json-string> | --body-file <file>.json` : "body: none",
     queryFlags.length ? `query flags: ${queryFlags.join(", ")}, --query-file` : "query flags: --query-file",
     pathFlags.length ? `path flags: ${pathFlags.join(", ")}` : "path flags: none",
+    ...isTableCreate ? [
+      "body-json example:",
+      `  - ${tableCreateExampleBody}`,
+      "body rules:",
+      "  - fields must be non-empty; empty table shell creation is not allowed",
+      "  - field_id_seq must be greater than every field.id",
+      "  - use text, not string; use member, not user",
+      "  - for select/radio/checkbox/status, use options.options.items",
+      "schema refs:",
+      `  - Table schema cheatsheet: ${sdkPath2("docs/runtime-reference/entity-schema.md", env)}`,
+      `  - Field type index: ${sdkPath2("docs/runtime-reference/entity-schema/README.md", env)}`
+    ] : [],
     ...scope === "admin" && command.commandPath[0] === "table" && command.commandPath[1] === "update-schema" ? [
       "next step:",
+      "  - prefer --body-json for schema save to avoid file creation and JSON file corruption",
       "  - switch to arcubase for row operations",
-      "  - row create: arcubase row create --app-id <app_id> --table-id <table_id> --body-file insert.json",
-      "  - row query: arcubase row query --app-id <app_id> --table-id <table_id> --body-file query.json"
+      "  - row create: arcubase row create --app-id <app_id> --table-id <table_id> --body-json <json-string> | --body-file insert.json",
+      "  - row query: arcubase row query --app-id <app_id> --table-id <table_id> --body-json <json-string> | --body-file query.json"
+    ] : [],
+    ...scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "update" ? [
+      "body-json examples:",
+      '  - enable: {"update":["enabled"],"enabled":true}',
+      '  - rename: {"update":["name"],"name":"Sales read only"}',
+      '  - update policy: {"update":["options"],"options":{"policy":{"key":"custom","actions":["view","add","edit"],"all_fields_read":true,"all_fields_write":true,"fields":[{"key":":1002","read":false,"write":false,"report":false}]},"list_options":{}}}'
+    ] : [],
+    ...scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "create" ? [
+      "body-json example:",
+      '  - {"name":"Sales read write","enabled":true,"type":"form","options":{"user_scope":[{"type":"user","id":2188889901}],"policy":{"key":"custom","actions":["view","add","edit"],"all_fields_read":false,"all_fields_write":false,"fields":[{"key":":1001","read":true,"write":true,"report":false},{"key":":1002","read":false,"write":false,"report":false}]},"list_options":{}}}',
+      "success requires:",
+      "  - result.enabled must be true",
+      '  - options.user_scope[].type is "user" for tenant users',
+      '  - hidden fields use colon field keys such as ":1002"'
     ] : [],
-    ...docHints.length > 0 ? ["docs:", ...docHints.map((item) => `  - ${item.title}: ${item.file}`)] : []
+    ...scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "assign-users" ? [
+      "body-json example:",
+      '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+      "success requires:",
+      "  - result.enabled must be true",
+      "  - result.options.user_scope must contain the assigned numeric TenantUser.ID values",
+      "  - PermitUserScope.id must be numeric TenantUser.ID",
+      "  - Do not copy hash arcubaseTenantUserId into PermitUserScope.id",
+      "  - If result.enabled is false, enable the rule first and retry assign-users"
+    ] : [],
+    ...docHints.length > 0 ? ["docs:", ...docHints.map((item) => `  - ${item.title}: ${item.file}`)] : [],
+    ...typeHints.length > 0 ? ["types:", ...typeHints.map((item) => `  - ${item.symbol}: ${item.file}`)] : []
   ].join("\n");
 }
 function coerceScalar(value, typeText) {
@@ -6700,16 +6720,126 @@ function buildScalarQuery(command, flags) {
     return void 0;
   }
   const out = {};
-  for (const scalar of command.queryParams) {
+  for (const scalar of effectiveQueryParams(command)) {
     const value = getFixedValue(scalar) ?? flagValue(flags, scalar.flag);
     if (value === void 0) continue;
     out[scalar.key] = coerceScalar(value, scalar.type);
   }
   return Object.keys(out).length > 0 ? out : void 0;
 }
+function validateKnownFlags(command, flags, env = process.env) {
+  const allowed = /* @__PURE__ */ new Set(["help", "body-file", "body-json", "query-file"]);
+  for (const mapping of command.pathParams) {
+    if (!getFixedValue(mapping)) {
+      allowed.add(mapping.flag);
+    }
+  }
+  for (const query of visibleQueryParams(command)) {
+    if (!getFixedValue(query)) {
+      allowed.add(query.flag);
+    }
+  }
+  for (const flag of Object.keys(flags)) {
+    if (!allowed.has(flag)) {
+      throw new CLIError("UNKNOWN_FLAG", `unknown flag --${flag} for ${command.commandPath.join(" ")}`, 2, {
+        ...buildUnknownFlagDetails(command, flag, env)
+      });
+    }
+  }
+}
+function buildUnknownFlagDetails(command, flag, env = process.env) {
+  const operation = command.commandPath.join(" ");
+  const details = {
+    operation,
+    hint: `run ${operation} --help for the supported flags`
+  };
+  if (command.requestType) {
+    details.requestType = command.requestType;
+    details.tsHints = getTypeHints(command.requestType, env);
+    details.docHints = getDocHints(command.requestType, env);
+    details.commonMistakes = [
+      `do not pass request body fields as --${flag}`,
+      "put request body fields inside --body-json <json-string>"
+    ];
+    details.suggestions = [`retry with: ${command.commandPath.join(" ")} ${command.pathParams.filter((item) => !getFixedValue(item)).map((item) => `--${item.flag} <${item.flag.replace(/-/g, "_")}>`).join(" ")} --body-json '<json>'`.replace(/\s+/g, " ").trim()];
+  }
+  if (command.commandPath[0] === "row" && command.commandPath[1] === "query" && ["limit", "offset", "search", "sorts", "view-mode"].includes(flag)) {
+    details.shapeHint = { limit: 20, offset: 0, search: { text_search: "SO-1001" } };
+    details.suggestions = [`retry with: row query --app-id <app_id> --table-id <table_id> --body-json '{"limit":20,"offset":0}'`];
+  }
+  if (command.commandPath[0] === "table" && command.commandPath[1] === "dataset" && ["app-id", "table-id"].includes(flag)) {
+    details.hint = "table dataset uses --dataset-id and --node-id; use table get for app/table metadata";
+    details.suggestions = [
+      "retry metadata read with: table get --app-id <app_id> --table-id <table_id>",
+      "retry dataset read with: table dataset --dataset-id <dataset_id> --node-id <node_id>"
+    ];
+  }
+  return details;
+}
+function visibleQueryParams(command) {
+  if (!command) return [];
+  return effectiveQueryParams(command).filter((item) => !getFixedValue(item));
+}
+function effectiveQueryParams(command) {
+  if (!command) return [];
+  return command.queryParams.filter((item) => {
+    if (rowCommandNeedsPolicy(command) && item.key === "policy_id") {
+      return false;
+    }
+    return true;
+  });
+}
 function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
+function stringifyUpstreamBody(value) {
+  if (typeof value === "string") return value;
+  if (value == null) return "";
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function extractTraceID(value) {
+  if (!isRecord2(value)) return void 0;
+  if (typeof value.trace_id === "string") return value.trace_id;
+  if (typeof value.request_id === "string") return value.request_id;
+  return void 0;
+}
+function upstreamErrorMessage(value) {
+  if (isRecord2(value) && typeof value.message === "string") return value.message;
+  if (typeof value === "string") return value;
+  return stringifyUpstreamBody(value);
+}
+function throwUpstreamHTTPError(endpoint, method, response, parsedResponse) {
+  const upstreamError = isRecord2(parsedResponse) && parsedResponse.error ? parsedResponse.error : void 0;
+  const body = stringifyUpstreamBody(parsedResponse);
+  throw new CLIError(
+    "UPSTREAM_REQUEST_FAILED",
+    upstreamError ? upstreamErrorMessage(upstreamError) : body || `HTTP ${response.status}`,
+    1,
+    {
+      endpoint,
+      method,
+      status: response.status,
+      traceId: extractTraceID(parsedResponse),
+      responseBody: body,
+      ...upstreamError ? { upstreamError } : {}
+    }
+  );
+}
+async function fetchUpstream(url, init, endpoint, method, fetchImpl) {
+  try {
+    return await fetchImpl(url, init);
+  } catch (error) {
+    throw new CLIError("UPSTREAM_NETWORK_ERROR", error instanceof Error ? error.message : String(error), 1, {
+      endpoint,
+      method,
+      reason: "network or DNS failure before Arcubase returned an HTTP response"
+    });
+  }
+}
 function extractEntityFields(payload) {
   const candidate = isRecord2(payload) && isRecord2(payload.data) ? payload.data : payload;
   if (!isRecord2(candidate) || !Array.isArray(candidate.fields)) {
@@ -6722,10 +6852,12 @@ function extractEntityFields(payload) {
   }));
 }
 async function fetchEntityFields(runtimeEnv, appId, entityId, fetchImpl) {
-  const response = await fetchImpl(buildURL(runtimeEnv.ARCUBASE_BASE_URL, `/api/entity/${encodeURIComponent(appId)}/${encodeURIComponent(entityId)}`), {
+  const endpoint = `/api/entity/${appId}/${entityId}`;
+  const encodedEndpoint = `/api/entity/${encodeURIComponent(appId)}/${encodeURIComponent(entityId)}`;
+  const response = await fetchUpstream(buildURL(runtimeEnv.ARCUBASE_BASE_URL, encodedEndpoint), {
     method: "GET",
     headers: buildRequestHeaders(runtimeEnv)
-  });
+  }, endpoint, "GET", fetchImpl);
   const raw = await response.text();
   let parsedResponse = raw;
   try {
@@ -6734,14 +6866,15 @@ async function fetchEntityFields(runtimeEnv, appId, entityId, fetchImpl) {
     parsedResponse = raw;
   }
   if (!response.ok) {
-    throw new CLIError("UPSTREAM_REQUEST_FAILED", typeof parsedResponse === "string" ? parsedResponse : JSON.stringify(parsedResponse), 1);
+    throwUpstreamHTTPError(endpoint, "GET", response, parsedResponse);
   }
   if (isRecord2(parsedResponse) && parsedResponse.error) {
     const upstreamError = parsedResponse.error;
-    const upstreamMessage = isRecord2(upstreamError) && typeof upstreamError.message === "string" ? upstreamError.message : typeof upstreamError === "string" ? upstreamError : JSON.stringify(upstreamError);
+    const upstreamMessage = upstreamErrorMessage(upstreamError);
     throw new CLIError("UPSTREAM_BODY_ERROR", upstreamMessage, 1, {
-      endpoint: `/api/entity/${appId}/${entityId}`,
+      endpoint,
       method: "GET",
+      traceId: extractTraceID(parsedResponse),
       upstreamError
     });
   }
@@ -6785,75 +6918,680 @@ async function validateFileFieldPayloads(scope, command, runtimeEnv, flags, body
     const fieldPath = command.functionName === "updateEntityRow" ? `body.data.${fieldId}` : `body.fields.${fieldId}`;
     const fieldName = field.label ? `${field.label} (${field.type})` : `${field.type} field ${fieldId}`;
     if (typeof value === "string") {
-      const guidance = looksLikeLocalFilePath(value) ? `do not put a local file path directly into ${fieldName}; run "arcubase upload ${value}" first and use the returned data array as the field value` : `${fieldName} must be an array returned by "arcubase upload <local-file>", not a string`;
+      const guidance = looksLikeLocalFilePath(value) ? `do not put a local file path directly into ${fieldName}; use arcubase upload token flow and pass the returned upload value array` : `${fieldName} must be an upload value array, not a string`;
       throw new CLIError("BODY_VALIDATION_FAILED", guidance, 2, {
         operation: `${scope}.${command.module}.${command.functionName}`,
         requestType: command.requestType ?? void 0,
         issues: [{ path: fieldPath, message: guidance }],
         docHints: [
-          { title: "Uploads", file: "/opt/arcubase-sdk/docs/runtime-reference/uploads.md" },
-          { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" }
+          { title: "Uploads", file: sdkPath2("docs/runtime-reference/uploads.md", runtimeEnv) },
+          { title: "Row CRUD", file: sdkPath2("docs/runtime-reference/row-crud.md", runtimeEnv) }
         ]
       });
     }
     if (isRecord2(value)) {
-      const guidance = `${fieldName} must be an array. Run "arcubase upload <local-file>" and use the returned data array directly as the field value`;
+      const guidance = `${fieldName} must be an upload value array. Use the upload token flow and pass the returned array directly`;
       throw new CLIError("BODY_VALIDATION_FAILED", guidance, 2, {
         operation: `${scope}.${command.module}.${command.functionName}`,
         requestType: command.requestType ?? void 0,
         issues: [{ path: fieldPath, message: guidance }],
         docHints: [
-          { title: "Uploads", file: "/opt/arcubase-sdk/docs/runtime-reference/uploads.md" },
-          { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" }
+          { title: "Uploads", file: sdkPath2("docs/runtime-reference/uploads.md", runtimeEnv) },
+          { title: "Row CRUD", file: sdkPath2("docs/runtime-reference/row-crud.md", runtimeEnv) }
         ]
       });
     }
     if (!Array.isArray(value)) {
-      const guidance = `${fieldName} must be an array returned by "arcubase upload <local-file>"`;
+      const guidance = `${fieldName} must be an upload value array`;
       throw new CLIError("BODY_VALIDATION_FAILED", guidance, 2, {
         operation: `${scope}.${command.module}.${command.functionName}`,
         requestType: command.requestType ?? void 0,
         issues: [{ path: fieldPath, message: guidance }],
         docHints: [
-          { title: "Uploads", file: "/opt/arcubase-sdk/docs/runtime-reference/uploads.md" },
-          { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" }
+          { title: "Uploads", file: sdkPath2("docs/runtime-reference/uploads.md", runtimeEnv) },
+          { title: "Row CRUD", file: sdkPath2("docs/runtime-reference/row-crud.md", runtimeEnv) }
         ]
       });
     }
     for (const [index, item] of value.entries()) {
       if (!isValidUploadEntry(item)) {
-        const guidance = `${fieldName} entries must include upload_id or assets_id plus file and file_name. Use "arcubase upload <local-file>" and copy the returned array item as-is`;
+        const guidance = `${fieldName} entries must include upload_id or assets_id plus file and file_name. Use the upload token flow and copy the returned array item as-is`;
         throw new CLIError("BODY_VALIDATION_FAILED", guidance, 2, {
           operation: `${scope}.${command.module}.${command.functionName}`,
           requestType: command.requestType ?? void 0,
           issues: [{ path: `${fieldPath}.${index}`, message: guidance }],
           docHints: [
-            { title: "Uploads", file: "/opt/arcubase-sdk/docs/runtime-reference/uploads.md" },
-            { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" }
+            { title: "Uploads", file: sdkPath2("docs/runtime-reference/uploads.md", runtimeEnv) },
+            { title: "Row CRUD", file: sdkPath2("docs/runtime-reference/row-crud.md", runtimeEnv) }
           ]
         });
       }
     }
   }
 }
-function throwBodyValidationFailure(message, requestType, path2, scope, command) {
-  throw new CLIError("BODY_VALIDATION_FAILED", message, 2, {
-    operation: `${scope}.${command.module}.${command.functionName}`,
-    requestType,
-    issues: [
+function buildTableCreateExampleBody() {
+  return {
+    name: "\u6295\u7968\u9879\u76EE",
+    parent: 0,
+    schema_version: 0,
+    field_id_seq: 1003,
+    layout: [[1001], [1002]],
+    fields: [
+      {
+        id: 1001,
+        label: "\u6295\u7968\u540D\u79F0",
+        type: "text",
+        required: true,
+        unique: false,
+        editable: true,
+        visible: true,
+        show_label: true,
+        scannable: false,
+        default_value_mode: 0,
+        description: "",
+        value: null,
+        number_decimal: 0,
+        depends: [],
+        key: "vote_name",
+        code_index: false,
+        options: { type: "text", placeholder: "", lengthLimit: false, lengthMin: 0, lengthMax: 255 },
+        transfers: null,
+        children: null
+      },
       {
-        path: path2,
-        message
+        id: 1002,
+        label: "\u6295\u7968\u63CF\u8FF0",
+        type: "textarea",
+        required: false,
+        unique: false,
+        editable: true,
+        visible: true,
+        show_label: true,
+        scannable: false,
+        default_value_mode: 0,
+        description: "",
+        value: null,
+        number_decimal: 0,
+        depends: [],
+        key: "vote_description",
+        code_index: false,
+        options: { placeholder: "", html: false, size: "default", lengthLimit: false, lengthMin: 0, lengthMax: 2e3 },
+        transfers: null,
+        children: null
       }
     ],
-    tsHints: getTypeHints(requestType),
-    docHints: getDocHints(requestType)
-  });
+    options: { Buttons: [], CustomActions: [], FrontendEvents: [], TitleFormat: { Fields: [], Parts: [], Body: "" }, misc: {} },
+    workflow_enabled: false
+  };
+}
+function isAssignUsersCommand(scope, command) {
+  return scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "assign-users";
+}
+function isTableCreateCommand(scope, command) {
+  return scope === "admin" && command.commandPath[0] === "table" && command.commandPath[1] === "create";
+}
+function isTableSchemaCommand(scope, command) {
+  return scope === "admin" && command.commandPath[0] === "table" && (command.commandPath[1] === "create" || command.commandPath[1] === "update-schema");
+}
+function isAccessRuleCommand(scope, command) {
+  return scope === "admin" && command.commandPath[0] === "access-rule";
+}
+function isAccessRuleUpdateCommand(scope, command) {
+  return scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "update";
+}
+function buildAccessRuleShapeHint(userId = 2188889901) {
+  return {
+    name: "Sales read write",
+    enabled: true,
+    type: "form",
+    options: {
+      user_scope: [{ type: "user", id: userId }],
+      policy: {
+        key: "custom",
+        actions: ["view", "add", "edit"],
+        all_fields_read: true,
+        all_fields_write: true,
+        fields: [{ key: ":1002", read: false, write: false, report: false }]
+      },
+      list_options: {}
+    }
+  };
+}
+function buildAssignUsersValidationDetails(scope, command, requestType, path, message, env = process.env) {
+  return {
+    operation: `${scope}.${command.module}.${command.functionName}`,
+    requestType,
+    issues: [{ path, message }],
+    tsHints: [
+      { symbol: "AppIngressUpdateReqVO", file: sdkPath2("types/ingress.ts", env) },
+      { symbol: "EntityIngressOptions", file: sdkPath2("types/ingress.ts", env) },
+      { symbol: "PermitUserScope", file: sdkPath2("types/common.ts", env) }
+    ],
+    docHints: getDocHints(requestType, env),
+    shapeHint: {
+      update: ["user_scope"],
+      options: {
+        user_scope: [{ type: "user", id: 2188889901 }]
+      }
+    },
+    commonMistakes: [
+      "do not use user_scope at top level",
+      "do not use users or allowedUsers",
+      "do not use hash tenant user id as id",
+      "id must be numeric TenantUser.ID"
+    ]
+  };
+}
+function buildBodyGuidance(requestType) {
+  if (requestType === "EntitySaveReqVO" || requestType === "AppCreateEntityReqVO") {
+    return {
+      shapeHint: {
+        id: 2188889845,
+        app_id: 2188889844,
+        name: "\u8BA2\u5355",
+        schema_version: 0,
+        field_id_seq: 1004,
+        layout: [[1001], [1002], [1003]],
+        fields: [
+          {
+            id: 1001,
+            label: "\u8BA2\u5355\u53F7",
+            type: "text",
+            required: true,
+            unique: false,
+            editable: true,
+            visible: true,
+            show_label: true,
+            scannable: false,
+            default_value_mode: 0,
+            description: "",
+            value: null,
+            number_decimal: 0,
+            depends: [],
+            key: "order_no",
+            code_index: false,
+            options: { type: "text", placeholder: "", lengthLimit: false, lengthMin: 0, lengthMax: 255 },
+            transfers: null,
+            children: null
+          },
+          {
+            id: 1002,
+            label: "\u63CF\u8FF0",
+            type: "textarea",
+            required: false,
+            unique: false,
+            editable: true,
+            visible: true,
+            show_label: true,
+            scannable: false,
+            default_value_mode: 0,
+            description: "",
+            value: null,
+            number_decimal: 0,
+            depends: [],
+            key: "description",
+            code_index: false,
+            options: { placeholder: "", html: false, size: "default", lengthLimit: false, lengthMin: 0, lengthMax: 2e3 },
+            transfers: null,
+            children: null
+          },
+          {
+            id: 1003,
+            label: "\u72B6\u6001",
+            type: "select",
+            required: true,
+            unique: false,
+            editable: true,
+            visible: true,
+            show_label: true,
+            scannable: false,
+            default_value_mode: 1,
+            description: "",
+            value: "draft",
+            number_decimal: 0,
+            depends: [],
+            key: "status",
+            code_index: false,
+            options: {
+              horizontal: false,
+              numberMax: "",
+              numberMin: "",
+              numberRange: false,
+              repeatRemind: "This value already exists and duplicate submission is not allowed",
+              options: {
+                mode: "custom",
+                colorful: false,
+                items: [
+                  { key: 1, value: "draft" },
+                  { key: 2, value: "active" }
+                ]
+              }
+            },
+            transfers: null,
+            children: null
+          }
+        ],
+        options: { Buttons: [], CustomActions: [], FrontendEvents: [], TitleFormat: { Fields: [], Parts: [], Body: "" }, misc: {} },
+        workflow_enabled: false
+      },
+      commonMistakes: [
+        "table create must include fields and field_id_seq; do not create an empty table shell",
+        "prefer --body-json for table create/update-schema; do not create a body file unless JSON is too large for one tool call",
+        "fields must be an array of full FieldVO objects, not an object map",
+        "get table shell first: arcubase-admin table get --app-id <app_id> --table-id <table_id>",
+        "save the full returned schema after editing; do not submit only changed fields",
+        "field_id_seq must be greater than every field.id",
+        "layout must reference existing field ids",
+        'use type "text", not "string"',
+        'use type "member", not "user"',
+        "for select/radio/checkbox/status, options must contain options.items",
+        "for linkto/relation/query, options must contain relation.app_id, relation.entity_id, relation.type",
+        "do not put per-user permissions in FieldVO; use access-rule for read/write and hidden fields"
+      ],
+      suggestions: [
+        `retry with: arcubase-admin table create --app-id <app_id> --body-json '${JSON.stringify(buildTableCreateExampleBody())}'`
+      ]
+    };
+  }
+  if (requestType === "AppIngressCreateReqVO" || requestType === "AppIngressUpdateReqVO") {
+    return {
+      shapeHint: buildAccessRuleShapeHint(),
+      commonMistakes: [
+        "use options.policy, not top-level permissions",
+        "use options.policy.fields, not field_visibility",
+        "actions must use Arcubase action codes: view, add, edit; do not use read, write, or insert",
+        'field permission keys must be strings prefixed with colon, for example ":1002"; do not use FieldVO.key values such as "vote_name"',
+        'for access-rule update policy changes, use {"update":["options"],"options":{"policy":...,"list_options":{}}}; do not use update:["options.policy"]',
+        'use options.user_scope with type user/department/actor and numeric id; do not use FieldVO type "member" here',
+        "use assign-users only for updating user_scope later",
+        'assign-users preserves existing policy when body.update=["user_scope"]'
+      ]
+    };
+  }
+  if (requestType === "InsertReqVO") {
+    return {
+      shapeHint: {
+        fields: {
+          "1001": "SO-1001",
+          "1002": 199
+        }
+      },
+      commonMistakes: [
+        "row fields must use numeric field ids as JSON object keys",
+        'do not use field labels such as "\u6807\u9898" or "\u6295\u7968\u6807\u9898" as keys',
+        "run table get first when field ids are unclear",
+        "do not add access policy fields; the CLI resolves access policy internally"
+      ],
+      suggestions: [
+        "run: arcubase table get --app-id <app_id> --table-id <table_id>",
+        `retry with: arcubase row create --app-id <app_id> --table-id <table_id> --body-json '{"fields":{"1001":"\u4ECA\u5929\u5403\u4EC0\u4E48"}}'`
+      ]
+    };
+  }
+  if (requestType === "EntityQueryReqVO") {
+    return {
+      shapeHint: {
+        limit: 20,
+        offset: 0,
+        search: { text_search: "SO-1001" }
+      },
+      commonMistakes: [
+        "limit, offset, search, sorts, and view_mode belong inside --body-json",
+        "do not pass --limit or --offset flags",
+        "do not add access policy fields; the CLI resolves access policy internally"
+      ],
+      suggestions: [
+        `retry with: arcubase row query --app-id <app_id> --table-id <table_id> --body-json '{"limit":20,"offset":0}'`
+      ]
+    };
+  }
+  if (requestType === "EntityUpdateReqVO") {
+    return {
+      shapeHint: {
+        data: { "1002": 299 },
+        changed_fields: [1002]
+      },
+      commonMistakes: [
+        "use data, not fields",
+        "changed_fields is required and must match data keys",
+        "do not add access policy fields; the CLI resolves access policy internally"
+      ]
+    };
+  }
+  if (requestType === "EntityBulkUpdateReqVO") {
+    return {
+      shapeHint: {
+        selection: {
+          type: "ids",
+          ids: [2188890411, 2188890412],
+          length: 2
+        },
+        fields: [
+          {
+            id: 1003,
+            action: {
+              type: "set",
+              value: 2
+            }
+          }
+        ]
+      },
+      commonMistakes: [
+        "bulk update fields[].action must be an object with type",
+        'use {"type":"set","value":2} to assign a scalar value',
+        "do not use value_set, setValue, or a top-level value field",
+        'use {"type":"number_add","number_add":10} only for numeric increments',
+        "selection.type=ids requires ids and length"
+      ],
+      suggestions: [
+        `retry with: arcubase row bulk-update --app-id <app_id> --table-id <table_id> --body-json '{"selection":{"type":"ids","ids":[2188890411],"length":1},"fields":[{"id":1003,"action":{"type":"set","value":2}}]}'`
+      ]
+    };
+  }
+  return {};
+}
+function buildBodyValidationDetails(scope, command, requestType, issues, env = process.env) {
+  return {
+    operation: `${scope}.${command.module}.${command.functionName}`,
+    requestType,
+    issues,
+    tsHints: getTypeHints(requestType, env),
+    docHints: getDocHints(requestType, env),
+    ...buildBodyGuidance(requestType)
+  };
+}
+function throwBodyValidationFailure(message, requestType, path, scope, command, env = process.env) {
+  if (isAssignUsersCommand(scope, command)) {
+    throw new CLIError("BODY_VALIDATION_FAILED", message, 2, buildAssignUsersValidationDetails(scope, command, requestType, path, message, env));
+  }
+  throw new CLIError("BODY_VALIDATION_FAILED", message, 2, buildBodyValidationDetails(scope, command, requestType, [{ path, message }], env));
+}
+function requireTableCreateSchemaBody(scope, command, body, env) {
+  if (!isRecord2(body)) {
+    throwBodyValidationFailure(
+      "table create requires a JSON object with name, fields, field_id_seq, layout, options, and workflow_enabled",
+      "AppCreateEntityReqVO",
+      "body",
+      scope,
+      command,
+      env
+    );
+  }
+  if (!Array.isArray(body.fields) || body.fields.length === 0) {
+    throwBodyValidationFailure(
+      "table create must include non-empty body.fields; empty table shell creation is not allowed",
+      "AppCreateEntityReqVO",
+      "body.fields",
+      scope,
+      command,
+      env
+    );
+  }
+  if (typeof body.field_id_seq !== "number") {
+    throwBodyValidationFailure(
+      "table create must include body.field_id_seq greater than every field.id",
+      "AppCreateEntityReqVO",
+      "body.field_id_seq",
+      scope,
+      command,
+      env
+    );
+  }
+}
+function stringArray(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function validateAccessRuleUserScope(scope, command, requestType, userScope, env, pathPrefix = "body.options.user_scope") {
+  if (userScope === void 0) return;
+  if (!Array.isArray(userScope)) {
+    throwBodyValidationFailure(
+      'access-rule user_scope must be an array of {"type":"user","id":2188889901}',
+      requestType,
+      pathPrefix,
+      scope,
+      command,
+      env
+    );
+  }
+  const allowedTypes = /* @__PURE__ */ new Set(["user", "department", "actor"]);
+  for (const [index, item] of userScope.entries()) {
+    if (!isRecord2(item)) {
+      throwBodyValidationFailure(
+        "access-rule user_scope item must be an object",
+        requestType,
+        `${pathPrefix}.${index}`,
+        scope,
+        command,
+        env
+      );
+    }
+    if (typeof item.type !== "string" || !allowedTypes.has(item.type)) {
+      throwBodyValidationFailure(
+        'access-rule user_scope[].type must be "user", "department", or "actor"; do not use FieldVO type "member" here',
+        requestType,
+        `${pathPrefix}.${index}.type`,
+        scope,
+        command,
+        env
+      );
+    }
+    if (typeof item.id !== "number" || !Number.isInteger(item.id) || item.id <= 0) {
+      throwBodyValidationFailure(
+        "access-rule user_scope[].id must be numeric TenantUser.ID, department ID, or actor ID",
+        requestType,
+        `${pathPrefix}.${index}.id`,
+        scope,
+        command,
+        env
+      );
+    }
+  }
+}
+function requireUpdateContains(scope, command, body, field, env) {
+  if (!(field in body)) return;
+  const update = stringArray(body.update);
+  if (!update.includes(field)) {
+    throwBodyValidationFailure(
+      `body.update must include "${field}" when body.${field} is present. Example: {"update":["${field}"],"${field}":${field === "enabled" ? "true" : '"value"'}}`,
+      command.requestType ?? "AppIngressUpdateReqVO",
+      "body.update",
+      scope,
+      command,
+      env
+    );
+  }
+}
+function validateActionSpecificRawBody(scope, command, body, env) {
+  if (!isRecord2(body) || !command.requestType) {
+    return;
+  }
+  if (isAssignUsersCommand(scope, command)) {
+    if ("users" in body || "allowedUsers" in body || "user_scope" in body) {
+      throwBodyValidationFailure(
+        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+        command.requestType,
+        "body.options.user_scope",
+        scope,
+        command,
+        env
+      );
+    }
+  }
+  if (isTableSchemaCommand(scope, command)) {
+    const fields = Array.isArray(body.fields) ? body.fields : [];
+    const hasPermissionPatch = fields.some((field) => isRecord2(field) && ("permission" in field || "permissions" in field || "field_visibility" in field));
+    if (hasPermissionPatch) {
+      throwBodyValidationFailure(
+        "table schema cannot configure per-user permissions. Use access-rule create/update with options.policy.fields for hidden fields",
+        command.requestType,
+        "body.fields",
+        scope,
+        command,
+        env
+      );
+    }
+  }
+  if (isAccessRuleCommand(scope, command)) {
+    const update = stringArray(body.update);
+    if (isAccessRuleUpdateCommand(scope, command) && update.some((item) => item.startsWith("options."))) {
+      throwBodyValidationFailure(
+        'access-rule update cannot patch nested options paths. Use {"update":["options"],"options":{"policy":{"key":"custom","actions":["view","add","edit"],"all_fields_read":true,"all_fields_write":true,"fields":[{"key":":1002","read":false,"write":false,"report":false}]},"list_options":{}}}',
+        command.requestType,
+        "body.update",
+        scope,
+        command,
+        env
+      );
+    }
+    if ("permissions" in body || "field_visibility" in body || "description" in body) {
+      throwBodyValidationFailure(
+        "access-rule body only supports name, enabled, type, and options; use options.policy.actions and options.policy.fields",
+        command.requestType,
+        "body",
+        scope,
+        command,
+        env
+      );
+    }
+    const options = isRecord2(body.options) ? body.options : void 0;
+    if (options && ("permissions" in options || "field_visibility" in options)) {
+      throwBodyValidationFailure(
+        "access-rule options only supports user_scope, policy, list_options, i18n_name; use options.policy.actions and options.policy.fields",
+        command.requestType,
+        "body.options",
+        scope,
+        command,
+        env
+      );
+    }
+    const policy = options && isRecord2(options.policy) ? options.policy : void 0;
+    if (isAccessRuleUpdateCommand(scope, command) && update.includes("options") && options?.user_scope !== void 0 && !policy) {
+      throwBodyValidationFailure(
+        'access-rule update with update:["options"] cannot change only options.user_scope because it overwrites policy. Use access-rule assign-users for user assignment, or include the full options.policy and options.list_options.',
+        command.requestType,
+        "body.options.policy",
+        scope,
+        command,
+        env
+      );
+    }
+    validateAccessRuleUserScope(scope, command, command.requestType, options?.user_scope, env);
+    const actions = policy && Array.isArray(policy.actions) ? policy.actions : [];
+    if (actions.includes("read") || actions.includes("write")) {
+      throwBodyValidationFailure(
+        'access-rule policy.actions must use Arcubase action codes: use "view" for read and "add","edit" for write; do not use "read", "write", or "insert"',
+        command.requestType,
+        "body.options.policy.actions",
+        scope,
+        command,
+        env
+      );
+    }
+    const fields = policy && Array.isArray(policy.fields) ? policy.fields : [];
+    const allowedSystemFieldKeys = /* @__PURE__ */ new Set(["created", "updated", "creator"]);
+    for (const [index, field] of fields.entries()) {
+      if (!isRecord2(field)) continue;
+      if (typeof field.key === "number" || typeof field.key === "string" && /^\d+$/.test(field.key)) {
+        throwBodyValidationFailure(
+          'access-rule policy.fields[].key must be a string prefixed with colon, for example ":1002"; do not use raw numbers',
+          command.requestType,
+          `body.options.policy.fields.${index}.key`,
+          scope,
+          command,
+          env
+        );
+      }
+      if (typeof field.key === "string" && !field.key.startsWith(":") && !allowedSystemFieldKeys.has(field.key)) {
+        throwBodyValidationFailure(
+          'access-rule policy.fields[].key must use Arcubase permission keys such as ":1002"; do not use FieldVO.key values such as "vote_name"',
+          command.requestType,
+          `body.options.policy.fields.${index}.key`,
+          scope,
+          command,
+          env
+        );
+      }
+    }
+  }
 }
-function validateActionSpecificBody(scope, command, flags, body) {
+function validateActionSpecificBody(scope, command, flags, body, env) {
   if (!isRecord2(body) || !command.requestType) {
     return;
   }
+  if (scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "update") {
+    requireUpdateContains(scope, command, body, "enabled", env);
+    requireUpdateContains(scope, command, body, "name", env);
+    requireUpdateContains(scope, command, body, "options", env);
+  }
+  if (isAssignUsersCommand(scope, command)) {
+    const update = stringArray(body.update);
+    const options = isRecord2(body.options) ? body.options : void 0;
+    const userScope = options && Array.isArray(options.user_scope) ? options.user_scope : void 0;
+    if ("users" in body || "allowedUsers" in body) {
+      throwBodyValidationFailure(
+        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+        command.requestType,
+        "body.options.user_scope",
+        scope,
+        command,
+        env
+      );
+    }
+    if (!update.includes("user_scope")) {
+      throwBodyValidationFailure(
+        'access-rule assign-users requires body.update to include "user_scope"',
+        command.requestType,
+        "body.update",
+        scope,
+        command,
+        env
+      );
+    }
+    if (!userScope || userScope.length === 0) {
+      throwBodyValidationFailure(
+        "access-rule assign-users requires non-empty body.options.user_scope",
+        command.requestType,
+        "body.options.user_scope",
+        scope,
+        command,
+        env
+      );
+    }
+    validateAccessRuleUserScope(scope, command, command.requestType, userScope, env);
+    const assignedUserScope = userScope;
+    for (const [index, item] of assignedUserScope.entries()) {
+      if (!isRecord2(item)) {
+        throwBodyValidationFailure(
+          "access-rule assign-users requires each body.options.user_scope item to be an object",
+          command.requestType,
+          `body.options.user_scope.${index}`,
+          scope,
+          command,
+          env
+        );
+      }
+      if (item.type !== "user") {
+        throwBodyValidationFailure(
+          'access-rule assign-users requires body.options.user_scope[].type to be "user"',
+          command.requestType,
+          `body.options.user_scope.${index}.type`,
+          scope,
+          command,
+          env
+        );
+      }
+      if (typeof item.id !== "number" || !Number.isInteger(item.id) || item.id <= 0) {
+        throwBodyValidationFailure(
+          "access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID",
+          command.requestType,
+          `body.options.user_scope.${index}.id`,
+          scope,
+          command,
+          env
+        );
+      }
+    }
+  }
   if (command.commandPath[0] === "row" && command.commandPath[1] === "selection-action") {
     const action = flagValue(flags, "action");
     const selection = body.selection;
@@ -6870,7 +7608,8 @@ function validateActionSpecificBody(scope, command, flags, body) {
           command.requestType,
           "body.selection.type",
           scope,
-          command
+          command,
+          env
         );
       }
       return;
@@ -6881,7 +7620,8 @@ function validateActionSpecificBody(scope, command, flags, body) {
         command.requestType,
         "body.selection.type",
         scope,
-        command
+        command,
+        env
       );
     }
     if ((action === "archive" || action === "delete") && type === "condition" && conditionKeys.length === 0) {
@@ -6890,38 +7630,299 @@ function validateActionSpecificBody(scope, command, flags, body) {
         command.requestType,
         "body.selection.condition",
         scope,
-        command
+        command,
+        env
       );
     }
   }
 }
-async function executeCLI(scope, argv, env, fetchImpl = fetch) {
-  const parsed = parseCLIArgs(argv);
-  if (scope === "user" && parsed.commandTokens[0] === "upload") {
-    if (hasFlag(parsed.flags, "help") || parsed.commandTokens.length === 1) {
-      return { kind: "help", text: renderUploadHelp() };
-    }
-    const sourcePath = parsed.commandTokens[1];
-    if (!sourcePath) {
-      throw new CLIError("UPLOAD_SOURCE_REQUIRED", "upload requires a local file path", 2);
-    }
-    const runtimeEnv2 = env ?? loadRuntimeEnv(scope);
-    const data = await uploadLocalFile(
-      runtimeEnv2,
-      sourcePath,
-      {
-        filename: flagValue(parsed.flags, "filename"),
-        global: hasFlag(parsed.flags, "global")
-      },
-      fetchImpl
+function unwrapData(value) {
+  let current = value;
+  for (let i = 0; i < 3; i += 1) {
+    if (isRecord2(current) && isRecord2(current.data)) {
+      current = current.data;
+      continue;
+    }
+    break;
+  }
+  return current;
+}
+function requiredRowAction(command, flags) {
+  if (command.commandPath[0] !== "row") return void 0;
+  switch (command.commandPath[1]) {
+    case "query":
+    case "get":
+      return "view";
+    case "create":
+      return "add";
+    case "update":
+      return "edit";
+    case "delete":
+      return "delete";
+    case "bulk-update":
+      return "bulk_update";
+    case "selection-action":
+      return flagValue(flags, "action") || void 0;
+    default:
+      return void 0;
+  }
+}
+function rowCommandNeedsPolicy(command) {
+  return command.scope === "user" && command.commandPath[0] === "row";
+}
+function extractIngressItems(appDetail) {
+  const appData = unwrapData(appDetail);
+  const ingress = isRecord2(appData) ? appData.ingress : void 0;
+  const groups = isRecord2(ingress) && Array.isArray(ingress.groups) ? ingress.groups : [];
+  const items = [];
+  for (const group of groups) {
+    const groupItems = isRecord2(group) && Array.isArray(group.items) ? group.items : [];
+    for (const item of groupItems) {
+      if (!isRecord2(item)) continue;
+      const id = typeof item.id === "string" ? item.id : typeof item.ID === "string" ? item.ID : "";
+      if (id) {
+        items.push({ id });
+      }
+    }
+  }
+  return items;
+}
+function ingressMatchesTableAndAction(ingressDetail, tableId, action) {
+  const ingressData = unwrapData(ingressDetail);
+  if (!isRecord2(ingressData)) return void 0;
+  const id = typeof ingressData.id === "number" || typeof ingressData.id === "string" ? ingressData.id : typeof ingressData.ID === "number" || typeof ingressData.ID === "string" ? ingressData.ID : void 0;
+  if (String(id ?? "") !== tableId) return void 0;
+  const policyID = typeof ingressData.hash_id === "string" ? ingressData.hash_id : typeof ingressData.hashId === "string" ? ingressData.hashId : void 0;
+  const policy = isRecord2(ingressData.policy) ? ingressData.policy : void 0;
+  if (!action) return { policyID: policyID || "", policy };
+  const actions = policy && Array.isArray(policy.actions) ? policy.actions.filter((item) => typeof item === "string") : [];
+  if (!actions.includes(action)) return void 0;
+  return { policyID: policyID || "", policy };
+}
+function writtenRowFieldIds(command, body) {
+  if (!isRecord2(body)) return [];
+  const source = command.commandPath[1] === "create" ? body.fields : command.commandPath[1] === "update" ? body.data : void 0;
+  if (!isRecord2(source)) return [];
+  return Object.keys(source).filter((key) => /^\d+$/.test(key)).map((key) => Number(key));
+}
+function fieldWriteAllowedByPolicy(policy, fieldId) {
+  if (!policy) return true;
+  const fields = Array.isArray(policy.fields) ? policy.fields : [];
+  const explicit = fields.find((item) => isRecord2(item) && item.key === `:${fieldId}`);
+  if (isRecord2(explicit) && explicit.write === false) return false;
+  if (isRecord2(explicit) && explicit.write === true) return true;
+  if (policy.all_fields_write === false) return false;
+  return true;
+}
+function assertWritableFieldsForRowCommand(command, runtimeEnv, body, policy) {
+  if (command.commandPath[1] !== "create" && command.commandPath[1] !== "update") {
+    return;
+  }
+  const denied = writtenRowFieldIds(command, body).filter((fieldId) => !fieldWriteAllowedByPolicy(policy, fieldId));
+  if (denied.length === 0) {
+    return;
+  }
+  const payloadKey = command.commandPath[1] === "create" ? "fields" : "data";
+  throw new CLIError("FIELD_PERMISSION_REQUIRED", `row ${command.commandPath[1]} includes field ids without write permission: ${denied.join(", ")}`, 2, {
+    operation: `user.${command.module}.${command.functionName}`,
+    requestType: command.requestType ?? void 0,
+    issues: denied.map((fieldId) => ({
+      path: `body.${payloadKey}.${fieldId}`,
+      message: "field is not writable for the resolved Arcubase access rule"
+    })),
+    docHints: [
+      { title: "Row CRUD", file: sdkPath2("docs/runtime-reference/row-crud.md", runtimeEnv) },
+      { title: "Runtime reference", file: sdkPath2("docs/runtime-reference/README.md", runtimeEnv) }
+    ],
+    suggestions: [
+      "remove non-writable field ids from the row body and retry",
+      "run arcubase table get to map visible business fields to numeric field ids",
+      "ask an admin to update the access-rule if this field should be writable"
+    ]
+  });
+}
+async function resolvePolicyIDForRowCommand(command, runtimeEnv, flags, fetchImpl) {
+  const appId = flagValue(flags, "app-id");
+  const tableId = flagValue(flags, "table-id");
+  const action = requiredRowAction(command, flags);
+  if (!appId || !tableId) {
+    throw new CLIError("POLICY_ID_RESOLUTION_FAILED", "row command requires --app-id and --table-id to resolve Arcubase policy_id", 2, {
+      operation: `user.${command.module}.${command.functionName}`,
+      docHints: getDocHints(command.requestType ?? "", runtimeEnv)
+    });
+  }
+  const appDetail = await requestJSON(runtimeEnv, "GET", `/api/apps/${encodeURIComponent(appId)}`, void 0, fetchImpl);
+  const ingressItems = extractIngressItems(appDetail.data);
+  for (const item of ingressItems) {
+    const ingressDetail = await requestJSON(runtimeEnv, "GET", `/api/ingress/${encodeURIComponent(appId)}/${encodeURIComponent(item.id)}`, void 0, fetchImpl);
+    const match = ingressMatchesTableAndAction(ingressDetail.data, tableId, action);
+    if (match) {
+      return { ...match, policyID: match.policyID || item.id };
+    }
+  }
+  throw new CLIError("POLICY_ID_RESOLUTION_FAILED", `no accessible ingress policy found for app ${appId}, table ${tableId}${action ? `, action ${action}` : ""}`, 2, {
+    operation: `user.${command.module}.${command.functionName}`,
+    requestType: command.requestType ?? void 0,
+    issues: [{ path: "policy_id", message: "CLI could not resolve policy_id from accessible ingress" }],
+    docHints: [
+      { title: "Row CRUD", file: sdkPath2("docs/runtime-reference/row-crud.md", runtimeEnv) },
+      { title: "Runtime reference", file: sdkPath2("docs/runtime-reference/README.md", runtimeEnv) }
+    ],
+    suggestions: [
+      "run arcubase entry and confirm the app/table is visible",
+      "ask an admin to create an enabled access-rule with the required action for this table"
+    ]
+  });
+}
+async function injectResolvedPolicyID(command, runtimeEnv, flags, query, body, fetchImpl) {
+  if (!rowCommandNeedsPolicy(command)) {
+    return { query, body };
+  }
+  if (typeof query.policy_id === "string" && query.policy_id) {
+    return { query, body };
+  }
+  if (isRecord2(body) && typeof body.policy_id === "string" && body.policy_id) {
+    return { query, body };
+  }
+  const resolvedPolicy = await resolvePolicyIDForRowCommand(command, runtimeEnv, flags, fetchImpl);
+  const policyID = resolvedPolicy.policyID;
+  assertWritableFieldsForRowCommand(command, runtimeEnv, body, resolvedPolicy.policy);
+  if (command.commandPath[1] === "get") {
+    return { query: { ...query, policy_id: policyID }, body };
+  }
+  if (isRecord2(body)) {
+    return { query, body: { ...body, policy_id: policyID } };
+  }
+  return { query, body };
+}
+function assertNoUserPolicyIDInput(command, runtimeEnv, query, body) {
+  if (!rowCommandNeedsPolicy(command)) {
+    return;
+  }
+  if ("policy_id" in query || isRecord2(body) && "policy_id" in body) {
+    throw new CLIError("INTERNAL_POLICY_ID_NOT_ALLOWED", "policy_id is an internal Arcubase ingress parameter; use app/table/row ids only", 2, {
+      operation: `user.${command.module}.${command.functionName}`,
+      issues: [{ path: "policy_id", message: "do not provide policy_id in flags, query file, or body JSON" }],
+      docHints: [
+        { title: "Row CRUD", file: sdkPath2("docs/runtime-reference/row-crud.md", runtimeEnv) },
+        { title: "Runtime reference", file: sdkPath2("docs/runtime-reference/README.md", runtimeEnv) }
+      ],
+      suggestions: ["run arcubase entry to find the app/table ids, then retry without policy_id"]
+    });
+  }
+}
+async function requestJSON(runtimeEnv, method, endpoint, body, fetchImpl) {
+  const response = await fetchUpstream(buildURL(runtimeEnv.ARCUBASE_BASE_URL, endpoint), {
+    method,
+    headers: {
+      ...buildRequestHeaders(runtimeEnv),
+      "Content-Type": "application/json"
+    },
+    body: body === void 0 || method === "GET" ? void 0 : JSON.stringify(body)
+  }, endpoint, method, fetchImpl);
+  const raw = await response.text();
+  let parsedResponse = raw;
+  try {
+    parsedResponse = raw ? JSON.parse(raw) : null;
+  } catch {
+  }
+  if (!response.ok) {
+    throwUpstreamHTTPError(endpoint, method, response, parsedResponse);
+  }
+  if (parsedResponse && typeof parsedResponse === "object" && "error" in parsedResponse && parsedResponse.error) {
+    const upstreamError = parsedResponse.error;
+    const upstreamMessage = upstreamErrorMessage(upstreamError);
+    throw new CLIError("UPSTREAM_BODY_ERROR", upstreamMessage, 1, { upstreamError });
+  }
+  return { status: response.status, data: parsedResponse };
+}
+function extractCreatedTableID(value) {
+  const candidates = [
+    value,
+    isRecord2(value) ? value.data : void 0,
+    isRecord2(value) && isRecord2(value.data) ? value.data.data : void 0
+  ];
+  for (const candidate of candidates) {
+    if (isRecord2(candidate) && typeof candidate.id === "number") {
+      return candidate.id;
+    }
+  }
+  throw new CLIError("UPSTREAM_RESPONSE_INVALID", "table create response did not include numeric table id", 1);
+}
+function normalizeTableCreateSchemaBody(body, appId, tableId) {
+  const { parent: _parent, ...schemaBody } = body;
+  return {
+    ...schemaBody,
+    id: tableId,
+    app_id: Number.isFinite(Number(appId)) ? Number(appId) : body.app_id,
+    schema_version: typeof body.schema_version === "number" ? body.schema_version : 0,
+    layout: Array.isArray(body.layout) ? body.layout : [],
+    options: isRecord2(body.options) ? body.options : { Buttons: [], CustomActions: [], FrontendEvents: [], TitleFormat: { Fields: [], Parts: [], Body: "" }, misc: {} },
+    workflow_enabled: typeof body.workflow_enabled === "boolean" ? body.workflow_enabled : false
+  };
+}
+async function executeTableCreateWithSchema(command, runtimeEnv, flags, body, fetchImpl) {
+  const appId = flagValue(flags, "app-id");
+  if (!appId) {
+    throw new CLIError("MISSING_PATH_FLAG", "missing required flag --app-id", 2);
+  }
+  if (!isRecord2(body)) {
+    throw new CLIError("BODY_VALIDATION_FAILED", "table create body must be an object", 2);
+  }
+  const createBody = {
+    name: typeof body.name === "string" ? body.name : void 0,
+    parent: typeof body.parent === "number" ? body.parent : 0
+  };
+  if (!createBody.name) {
+    throw new CLIError("BODY_VALIDATION_FAILED", "table create requires body.name", 2);
+  }
+  const createResult = await requestJSON(runtimeEnv, command.method, resolveEndpoint(command, flags), createBody, fetchImpl);
+  const tableId = extractCreatedTableID(createResult.data);
+  const saveBody = normalizeTableCreateSchemaBody(body, appId, tableId);
+  const saveSchema = getBodySchema("EntitySaveReqVO");
+  if (!saveSchema) {
+    throw new CLIError("BODY_VALIDATION_FAILED", "EntitySaveReqVO schema is not available", 2);
+  }
+  const parsedSaveBody = saveSchema.safeParse(saveBody);
+  if (!parsedSaveBody.success) {
+    const message = parsedSaveBody.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ");
+    throw new CLIError(
+      "BODY_VALIDATION_FAILED",
+      message,
+      2,
+      buildBodyValidationDetails(
+        "admin",
+        command,
+        "EntitySaveReqVO",
+        parsedSaveBody.error.issues.map((issue) => ({
+          path: issue.path.length > 0 ? `body.${issue.path.join(".")}` : "body",
+          message: issue.message
+        })),
+        runtimeEnv
+      )
     );
-    return {
-      kind: "result",
-      commandPath: ["upload", sourcePath],
-      status: 200,
-      data
-    };
   }
+  const saveResult = await requestJSON(
+    runtimeEnv,
+    "PUT",
+    `/api/apps/${encodeURIComponent(appId)}/entity/${encodeURIComponent(String(tableId))}`,
+    parsedSaveBody.data,
+    fetchImpl
+  );
+  return {
+    kind: "result",
+    commandPath: command.commandPath,
+    status: saveResult.status,
+    data: {
+      id: tableId,
+      created: createResult.data,
+      schema: saveResult.data
+    }
+  };
+}
+async function executeCLI(scope, argv, env, fetchImpl = fetch) {
+  const parsed = parseCLIArgs(argv);
+  const envInput = env ?? process.env;
   if (parsed.commandTokens.length === 0) {
     return { kind: "help", text: renderRootHelp(scope) };
   }
@@ -6931,51 +7932,108 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
   }
   const singleTokenCommand = !commandName ? findCommand(scope, moduleName) : null;
   if (!commandName && !singleTokenCommand) {
-    return { kind: "help", text: renderModuleHelp(scope, moduleName) };
+    return { kind: "help", text: renderModuleHelp(scope, moduleName, envInput) };
   }
   if (hasFlag(parsed.flags, "help")) {
-    return { kind: "help", text: renderCommandHelp(scope, moduleName, commandName) };
+    return { kind: "help", text: renderCommandHelp(scope, moduleName, commandName, envInput) };
   }
-  const runtimeEnv = env ?? loadRuntimeEnv(scope);
   const command = findCommand(scope, moduleName, commandName);
   if (!command) {
     throw new CLIError("UNKNOWN_COMMAND", `unknown command: ${moduleName}${commandName ? ` ${commandName}` : ""}`, 2, buildUnknownCommandDetails(scope, moduleName, commandName ?? ""));
   }
+  validateKnownFlags(command, parsed.flags, envInput);
+  const runtimeEnv = env ?? loadRuntimeEnv(scope);
   const endpoint = resolveEndpoint(command, parsed.flags);
   const scalarQuery = buildScalarQuery(command, parsed.flags);
   const fileQuery = loadQueryFromFlags(parsed.flags);
-  const query = { ...scalarQuery ?? {}, ...fileQuery ?? {} };
-  const body = loadBodyFromFlags(parsed.flags);
+  let query = { ...fileQuery ?? {}, ...scalarQuery ?? {} };
+  let body;
+  try {
+    body = loadBodyFromFlags(parsed.flags);
+  } catch (error) {
+    if (error instanceof CLIError && error.code === "INVALID_BODY_JSON" && command.requestType) {
+      throw new CLIError(
+        "INVALID_BODY_JSON",
+        `body json is invalid for ${scope}.${command.commandPath.join(" ")}; fix JSON syntax, then use the canonical ${command.requestType} shape from docs/types`,
+        2,
+        buildBodyValidationDetails(scope, command, command.requestType, [{ path: "body", message: "invalid JSON syntax" }], runtimeEnv)
+      );
+    }
+    throw error;
+  }
   let validatedBody = body;
   if (!command.requestType && body !== void 0) {
     throw new CLIError("BODY_JSON_NOT_SUPPORTED", `command does not accept a request body: ${moduleName} ${commandName}`, 2);
   }
   if (command.requestType) {
     if (body === void 0) {
-      throw new CLIError("MISSING_BODY_FILE", `command requires --body-file or --body-json for ${command.requestType}`, 2);
+      throw new CLIError("MISSING_BODY_FILE", `command requires --body-json or --body-file for ${command.requestType}; prefer --body-json to avoid file creation`, 2);
+    }
+    if (isTableCreateCommand(scope, command)) {
+      requireTableCreateSchemaBody(scope, command, body, runtimeEnv);
+      validateActionSpecificRawBody(scope, command, body, runtimeEnv);
+      const { parent: _parent, ...schemaBody } = isRecord2(body) ? body : {};
+      const parsedBody = getBodySchema("EntitySaveReqVO")?.safeParse(schemaBody);
+      if (!parsedBody?.success) {
+        const message = parsedBody ? parsedBody.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ") : "EntitySaveReqVO schema is not available";
+        throw new CLIError(
+          "BODY_VALIDATION_FAILED",
+          message,
+          2,
+          buildBodyValidationDetails(
+            scope,
+            command,
+            "EntitySaveReqVO",
+            parsedBody && !parsedBody.success ? parsedBody.error.issues.map((issue) => ({
+              path: issue.path.length > 0 ? `body.${issue.path.join(".")}` : "body",
+              message: issue.message
+            })) : [{ path: "body", message }],
+            runtimeEnv
+          )
+        );
+      }
+      return executeTableCreateWithSchema(command, runtimeEnv, parsed.flags, parsedBody.data, fetchImpl);
     }
+    validateActionSpecificRawBody(scope, command, body, runtimeEnv);
     const schema = getBodySchema(command.requestType);
     if (schema) {
       const parsedBody = schema.safeParse(body);
       if (!parsedBody.success) {
+        const message = parsedBody.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ");
+        if (isAssignUsersCommand(scope, command)) {
+          const hasUserScopeIDIssue = parsedBody.error.issues.some((issue) => issue.path.join(".") === "options.user_scope.0.id" || issue.path.join(".").startsWith("options.user_scope."));
+          throw new CLIError(
+            "BODY_VALIDATION_FAILED",
+            hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID" : message,
+            2,
+            buildAssignUsersValidationDetails(
+              scope,
+              command,
+              command.requestType,
+              hasUserScopeIDIssue ? "body.options.user_scope" : "body",
+              hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID" : message,
+              runtimeEnv
+            )
+          );
+        }
         throw new CLIError(
           "BODY_VALIDATION_FAILED",
-          parsedBody.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; "),
+          message,
           2,
-          {
-            operation: `${scope}.${command.module}.${command.functionName}`,
-            requestType: command.requestType,
-            issues: parsedBody.error.issues.map((issue) => ({
+          buildBodyValidationDetails(
+            scope,
+            command,
+            command.requestType,
+            parsedBody.error.issues.map((issue) => ({
               path: issue.path.length > 0 ? `body.${issue.path.join(".")}` : "body",
               message: issue.message
             })),
-            tsHints: getTypeHints(command.requestType),
-            docHints: getDocHints(command.requestType)
-          }
+            runtimeEnv
+          )
         );
       }
       validatedBody = parsedBody.data;
-      validateActionSpecificBody(scope, command, parsed.flags, validatedBody);
+      validateActionSpecificBody(scope, command, parsed.flags, validatedBody, runtimeEnv);
     } else {
       const unsupportedReason = getUnsupportedBodySchemaReason(command.requestType);
       if (unsupportedReason) {
@@ -6983,23 +8041,27 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
           operation: `${scope}.${command.module}.${command.functionName}`,
           requestType: command.requestType,
           reason: unsupportedReason,
-          tsHints: getTypeHints(command.requestType),
-          docHints: getDocHints(command.requestType)
+          tsHints: getTypeHints(command.requestType, runtimeEnv),
+          docHints: getDocHints(command.requestType, runtimeEnv)
         });
       }
     }
   }
+  assertNoUserPolicyIDInput(command, runtimeEnv, query, validatedBody);
   if (scope === "user" && (command.functionName === "insertEntity" || command.functionName === "updateEntityRow")) {
     await validateFileFieldPayloads(scope, command, runtimeEnv, parsed.flags, validatedBody, fetchImpl);
   }
-  const response = await fetchImpl(buildURL(runtimeEnv.ARCUBASE_BASE_URL, endpoint, Object.keys(query).length > 0 ? query : void 0), {
+  const policyInjected = await injectResolvedPolicyID(command, runtimeEnv, parsed.flags, query, validatedBody, fetchImpl);
+  query = policyInjected.query;
+  validatedBody = policyInjected.body;
+  const response = await fetchUpstream(buildURL(runtimeEnv.ARCUBASE_BASE_URL, endpoint, Object.keys(query).length > 0 ? query : void 0), {
     method: command.method,
     headers: {
       ...buildRequestHeaders(runtimeEnv),
       "Content-Type": "application/json"
     },
     body: validatedBody === void 0 || command.method === "GET" ? void 0 : JSON.stringify(validatedBody)
-  });
+  }, endpoint, command.method, fetchImpl);
   const raw = await response.text();
   let parsedResponse = raw;
   try {
@@ -7007,12 +8069,12 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
   } catch {
   }
   if (!response.ok) {
-    throw new CLIError("UPSTREAM_REQUEST_FAILED", typeof parsedResponse === "string" ? parsedResponse : JSON.stringify(parsedResponse), 1);
+    throwUpstreamHTTPError(endpoint, command.method, response, parsedResponse);
   }
   if (parsedResponse && typeof parsedResponse === "object" && "error" in parsedResponse && parsedResponse.error) {
     const upstreamError = parsedResponse.error;
-    const upstreamMessage = typeof upstreamError === "object" && upstreamError && "message" in upstreamError && typeof upstreamError.message === "string" ? upstreamError.message : typeof upstreamError === "string" ? upstreamError : JSON.stringify(upstreamError);
-    const traceId = typeof parsedResponse.trace_id === "string" ? parsedResponse.trace_id : typeof parsedResponse.request_id === "string" ? parsedResponse.request_id : void 0;
+    const upstreamMessage = upstreamErrorMessage(upstreamError);
+    const traceId = extractTraceID(parsedResponse);
     const uploadBindFailure = upstreamMessage.includes("failed to bind upload to assets");
     throw new CLIError("UPSTREAM_BODY_ERROR", upstreamMessage, 1, {
       endpoint,
@@ -7021,10 +8083,10 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
       upstreamError,
       ...uploadBindFailure ? {
         reason: "the row payload used a file/image upload entry, but Arcubase could not bind that upload into an asset record",
-        hint: "verify the upload storage host is reachable from the Arcubase server, then rerun arcubase upload and retry the row insert/update",
+        hint: "verify the upload storage host is reachable from the Arcubase server, then use the upload token flow again and retry the row insert/update",
         docHints: [
-          { title: "Uploads", file: "/opt/arcubase-sdk/docs/runtime-reference/uploads.md" },
-          { title: "Row CRUD", file: "/opt/arcubase-sdk/docs/runtime-reference/row-crud.md" }
+          { title: "Uploads", file: "docs/runtime-reference/uploads.md" },
+          { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" }
         ]
       } : {}
     });