@seclai/cli 1.5.0 → 1.6.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command3 } from "commander";
+import { Command as Command4 } from "commander";
 import { realpathSync } from "fs";
 import { fileURLToPath, pathToFileURL } from "url";
 
@@ -75,12 +75,25 @@ function getCliVersion() {
 }
 function createClient(opts) {
   const seclaiOpts = {};
+  const identityFlags = [
+    ["apiKey", "--api-key", "Pass a key, or omit the flag to use SECLAI_API_KEY or SSO."],
+    ["profile", "--profile", "Pass a profile name, or omit the flag to use the default profile."],
+    ["accountId", "--account-id", "Pass an account ID, or omit the flag to use the default org."],
+    ["configDir", "--config-dir", "Pass a directory, or omit the flag to use ~/.seclai."]
+  ];
+  for (const [key, flag, hint] of identityFlags) {
+    const value = opts[key];
+    if (typeof value === "string" && value.trim().length === 0) {
+      throw new Error(`${flag} was given an empty value. ${hint}`);
+    }
+  }
   if (opts.apiKey !== void 0) seclaiOpts.apiKey = opts.apiKey;
   if (opts.profile !== void 0) seclaiOpts.profile = opts.profile;
   if (opts.configDir !== void 0) seclaiOpts.configDir = opts.configDir;
   if (opts.accountId !== void 0) seclaiOpts.accountId = opts.accountId;
   const envVersion = process2.env.SECLAI_API_VERSION;
-  const version = opts.apiVersion ?? (envVersion && envVersion.length > 0 ? envVersion : void 0);
+  const blank = (v) => v === void 0 || v.trim().length === 0;
+  const version = blank(opts.apiVersion) ? opts.apiVersion !== void 0 ? void 0 : blank(envVersion) ? void 0 : envVersion : opts.apiVersion;
   if (version !== void 0) seclaiOpts.apiVersion = version;
   if (opts.allowUnknownApiVersion) seclaiOpts.allowUnknownApiVersion = true;
   const envUrl = process2.env.SECLAI_API_URL;
@@ -92,8 +105,9 @@ function printJson(rt, value) {
   rt.writeOut(`${JSON.stringify(value, null, indent)}
 `);
 }
-function warnDeprecated(rt, message) {
-  rt.writeErr(`warning: ${message} This will be rejected in a future release.
+function warnDeprecated(rt, message, fate = "rejected") {
+  const suffix = fate === "kept" ? "" : fate === "removed" ? " This will be removed in a future release." : " This will be rejected in a future release.";
+  rt.writeErr(`warning: ${message}${suffix}
 `);
 }
 function printError(rt, err) {
@@ -123,8 +137,13 @@ function printError(rt, err) {
   if (err instanceof SeclaiConfigurationError) {
     rt.writeErr(`${err.name}: ${err.message}
 `);
-    rt.writeErr(`hint: Set the SECLAI_API_KEY environment variable or pass --api-key.
+    if (/api version/i.test(err.message)) {
+      rt.writeErr(`hint: Pass --allow-unknown-api-version to send it anyway.
+`);
+    } else {
+      rt.writeErr(`hint: Set the SECLAI_API_KEY environment variable or pass --api-key.
 `);
+    }
     return;
   }
   if (err instanceof Error) {
@@ -144,18 +163,30 @@ async function run(rt, main) {
   }
 }
 function parseNumber(value) {
-  const parsed = value.trim() === "" ? Number.NaN : Number(value);
-  if (!Number.isFinite(parsed)) {
-    throw new InvalidArgumentError("Expected a number.");
+  if (!/^\d+$/.test(value.trim())) {
+    throw new InvalidArgumentError("Expected a non-negative whole number.");
   }
-  return parsed;
+  return Number(value.trim());
 }
-function withLimitOption(cmd) {
-  return cmd.option("--limit <n>", "Page size.", parseNumber);
+function withLimitOption(cmd, description = "Page size.") {
+  return cmd.option("--limit <n>", description, parseNumber);
 }
 function withOffsetListOptions(cmd) {
   return withLimitOption(cmd).option("--offset <n>", "Number of items to skip.", parseNumber);
 }
+function toPagedEnvelope(res, ...legacyKeys) {
+  if (Array.isArray(res)) return { data: res };
+  if (res === null || typeof res !== "object") return res;
+  const obj = res;
+  if (Array.isArray(obj.data)) return obj;
+  for (const key of legacyKeys) {
+    if (Array.isArray(obj[key])) {
+      const { [key]: rows, ...rest } = obj;
+      return { data: rows, ...rest };
+    }
+  }
+  return res;
+}
 function offsetListOpts(opts) {
   const o = {};
   if (opts.limit !== void 0) o.limit = opts.limit;
@@ -339,7 +370,10 @@ function register(program, rt) {
     await run(rt, async () => {
       warnDeprecated(
         rt,
-        `'agents runs delete' is deprecated and cancels the run rather than deleting it \u2014 the API has no delete-a-run operation. Use 'agents runs cancel', which also prints the cancelled run instead of {"ok": true}.`
+        `'agents runs delete' is deprecated and cancels the run rather than deleting it \u2014 the API has no delete-a-run operation. Use 'agents runs cancel', which also prints the cancelled run instead of {"ok": true}.`,
+        // Kept, not scheduled for removal — the whole point of the alias is
+        // that existing scripts keep working.
+        "kept"
       );
       const client = createClient(program.opts());
       await client.cancelAgentRun(runId);
@@ -487,10 +521,14 @@ function register(program, rt) {
       printJson(rt, { ok: true });
     });
   });
-  runs.command("eval-results").description("List evaluation results for a run.").argument("<agentId>", "Agent ID.").argument("<runId>", "Run ID.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).action(async (agentId, runId, opts) => {
+  runs.command("eval-results").description("List evaluation results for a run.").argument("<agentId>", "Agent ID.").argument("<runId>", "Run ID.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).option(
+    "--paged",
+    "Wrap the results in {data: [...]}, the shape this endpoint moves to from --api-version 2026-07-27."
+  ).action(async (agentId, runId, opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
-      printJson(rt, await client.listRunEvaluationResults(agentId, runId, listOpts(opts)));
+      const res = await client.listRunEvaluationResults(agentId, runId, listOpts(opts));
+      printJson(rt, opts.paged ? toPagedEnvelope(res) : res);
     });
   });
 }
@@ -498,7 +536,7 @@ function register(program, rt) {
 // src/commands/sources.ts
 function register2(program, rt) {
   const sources = program.command("sources").alias("source").description("Manage content sources.");
-  sources.command("list").description("List sources.").option("--page <n>", "Page number.", (v) => Number(v)).option("--limit <n>", "Page size.", (v) => Number(v)).option("--sort <field>", "Sort field.").option("--order <asc|desc>", "Sort direction.").option("--account-id <id>", "Filter by account ID.").action(async (opts) => {
+  sources.command("list").description("List sources.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).option("--sort <field>", "Sort field.").option("--order <asc|desc>", "Sort direction.").option("--account-id <id>", "Filter by account ID.").action(async (opts) => {
     await run(rt, async () => {
       const globalOpts = program.opts();
       const client = createClient(globalOpts);
@@ -551,7 +589,7 @@ function register2(program, rt) {
     });
   });
   const exports_ = sources.command("exports").description("Manage source exports.");
-  exports_.command("list").description("List exports for a source.").argument("<sourceId>", "Source ID.").option("--page <n>", "Page number.", (v) => Number(v)).option("--limit <n>", "Page size.", (v) => Number(v)).action(async (sourceId, opts) => {
+  exports_.command("list").description("List exports for a source.").argument("<sourceId>", "Source ID.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).action(async (sourceId, opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       printJson(rt, await client.listSourceExports(sourceId, listOpts(opts)));
@@ -622,7 +660,7 @@ function register2(program, rt) {
 // src/commands/contents.ts
 function register3(program, rt) {
   const contents = program.command("contents").description("Manage indexed content and embeddings.");
-  contents.command("get").description("Get content version details.").argument("<contentVersionId>", "Content version ID.").option("--start <n>", "Text start offset (0-based).", (v) => Number(v)).option("--end <n>", "Text end offset (exclusive).", (v) => Number(v)).action(async (contentVersionId, opts) => {
+  contents.command("get").description("Get content version details.").argument("<contentVersionId>", "Content version ID.").option("--start <n>", "Text start offset (0-based).", parseNumber).option("--end <n>", "Text end offset (exclusive).", parseNumber).action(async (contentVersionId, opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       const o = {};
@@ -653,7 +691,7 @@ function register3(program, rt) {
       printJson(rt, await client.replaceContentWithInlineText(contentVersionId, body));
     });
   });
-  contents.command("embeddings").description("List embeddings for a content version.").argument("<contentVersionId>", "Content version ID.").option("--page <n>", "Page number.", (v) => Number(v)).option("--limit <n>", "Page size.", (v) => Number(v)).action(async (contentVersionId, opts) => {
+  contents.command("embeddings").description("List embeddings for a content version.").argument("<contentVersionId>", "Content version ID.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).action(async (contentVersionId, opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       printJson(rt, await client.listContentEmbeddings(contentVersionId, listOpts(opts)));
@@ -664,7 +702,7 @@ function register3(program, rt) {
 // src/commands/kb.ts
 function register4(program, rt) {
   const kb = program.command("kb").description("Manage knowledge bases.");
-  kb.command("list").description("List knowledge bases.").option("--page <n>", "Page number.", (v) => Number(v)).option("--limit <n>", "Page size.", (v) => Number(v)).option("--sort <field>", "Sort field.").option("--order <asc|desc>", "Sort direction.").action(async (opts) => {
+  kb.command("list").description("List knowledge bases.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).option("--sort <field>", "Sort field.").option("--order <asc|desc>", "Sort direction.").action(async (opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       printJson(rt, await client.listKnowledgeBases(listOpts(opts)));
@@ -702,7 +740,7 @@ function register4(program, rt) {
 // src/commands/memory.ts
 function register5(program, rt) {
   const memory = program.command("memory").description("Manage memory banks.");
-  memory.command("list").description("List memory banks.").option("--page <n>", "Page number.", (v) => Number(v)).option("--limit <n>", "Page size.", (v) => Number(v)).option("--sort <field>", "Sort field.").option("--order <asc|desc>", "Sort direction.").action(async (opts) => {
+  memory.command("list").description("List memory banks.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).option("--sort <field>", "Sort field.").option("--order <asc|desc>", "Sort direction.").action(async (opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       printJson(rt, await client.listMemoryBanks(listOpts(opts)));
@@ -905,7 +943,7 @@ function register6(program, rt) {
 // src/commands/solutions.ts
 function register7(program, rt) {
   const solutions = program.command("solutions").description("Manage solutions.");
-  solutions.command("list").description("List solutions.").option("--page <n>", "Page number.", (v) => Number(v)).option("--limit <n>", "Page size.", (v) => Number(v)).option("--sort <field>", "Sort field.").option("--order <asc|desc>", "Sort direction.").action(async (opts) => {
+  solutions.command("list").description("List solutions.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).option("--sort <field>", "Sort field.").option("--order <asc|desc>", "Sort direction.").action(async (opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       printJson(rt, await client.listSolutions(listOpts(opts)));
@@ -1083,20 +1121,11 @@ function register8(program, rt) {
 // src/commands/alerts.ts
 function register9(program, rt) {
   const alerts = program.command("alerts").description("Manage alerts and alert configurations.");
-  alerts.command("list").description("List alerts.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).option("--status <status>", "Filter by status.").option(
-    "--severity <severity>",
-    "Deprecated and ignored \u2014 GET /alerts declares no severity filter. Filter with jq instead."
-  ).action(async (opts) => {
+  alerts.command("list").description("List alerts.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).option("--status <status>", "Filter by status.").action(async (opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       const o = listOpts(opts);
       if (opts.status) o.status = opts.status;
-      if (opts.severity !== void 0) {
-        warnDeprecated(
-          rt,
-          `'alerts list --severity' is ignored \u2014 the API has no severity filter, so it never filtered anything. Filter client-side, e.g. | jq '[.data[] | select(.severity == "high")]'.`
-        );
-      }
       printJson(rt, await client.listAlerts(o));
     });
   });
@@ -1133,10 +1162,14 @@ function register9(program, rt) {
     });
   });
   const configs = alerts.command("configs").description("Alert configurations.");
-  configs.command("list").description("List alert configurations.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).action(async (opts) => {
+  configs.command("list").description("List alert configurations.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).option(
+    "--paged",
+    "Wrap the results in {data: [...]}, the shape this endpoint moves to from --api-version 2026-07-27."
+  ).action(async (opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
-      printJson(rt, await client.listAlertConfigs(listOpts(opts)));
+      const res = await client.listAlertConfigs(listOpts(opts));
+      printJson(rt, opts.paged ? toPagedEnvelope(res, "configs") : res);
     });
   });
   configs.command("create").description("Create an alert configuration.").option("--json <json>", "Config body JSON.").option("--json-file <path>", "Config body JSON file.").action(async (opts) => {
@@ -1183,6 +1216,7 @@ function register9(program, rt) {
 }
 
 // src/commands/email.ts
+import { Argument, Option } from "commander";
 function register10(program, rt) {
   const email = program.command("email").description("Agent email: sending domains, inbound blocklist, inbound health, and opt-outs.");
   const domains = email.command("domains").description("Agent-email sending domains.");
@@ -1192,7 +1226,9 @@ function register10(program, rt) {
       printJson(rt, await client.listEmailDomains());
     });
   });
-  domains.command("add").description("Add and provision a new agent-email domain. Returns the DNS records to publish.").requiredOption("--kind <kind>", "'vanity' (a subdomain of seclai.com) or 'custom' (your own domain).").requiredOption("--value <domain>", "The domain to add.").option("--delegated", "The domain's DNS is delegated to Seclai, so records are published automatically.").action(async (opts) => {
+  domains.command("add").description("Add and provision a new agent-email domain. Returns the DNS records to publish.").addOption(
+    new Option("--kind <kind>", "'vanity' (a subdomain of seclai.com) or 'custom' (your own domain).").choices(["vanity", "custom"]).makeOptionMandatory()
+  ).requiredOption("--value <domain>", "The domain to add.").option("--delegated", "The domain's DNS is delegated to Seclai, so records are published automatically.").action(async (opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       const body = {
@@ -1252,7 +1288,9 @@ function register10(program, rt) {
       printJson(rt, await client.listBlockedEmailSenders(offsetListOpts(opts)));
     });
   });
-  blocked.command("add").description("Block an inbound sender address or domain.").requiredOption("--sender-email <email>", "Sender address, or the domain when --match-type is 'domain'.").option("--match-type <type>", "'address' or 'domain'.", "address").option("--note <text>", "Why the sender was blocked.").action(async (opts) => {
+  blocked.command("add").description("Block an inbound sender address or domain.").requiredOption("--sender-email <email>", "Sender address, or the domain when --match-type is 'domain'.").addOption(
+    new Option("--match-type <type>", "'address' or 'domain'.").choices(["address", "domain"]).default("address")
+  ).option("--note <text>", "Why the sender was blocked.").action(async (opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       const body = {
@@ -1270,7 +1308,15 @@ function register10(program, rt) {
       printJson(rt, { ok: true });
     });
   });
-  blocked.command("auto-block-mode").description("Set whether a governance BLOCK on an authenticated sender auto-adds them to the blocklist.").argument("<mode>", "One of 'disabled', 'input', or 'input_and_output'.").action(async (mode) => {
+  blocked.command("auto-block-mode").description("Set whether a governance BLOCK on an authenticated sender auto-adds them to the blocklist.").addArgument(
+    // A closed set the API will only ever 422 on. Failing the parse names the
+    // accepted values; the server names nothing.
+    new Argument("<mode>", "How governance BLOCK verdicts feed the blocklist.").choices([
+      "disabled",
+      "input",
+      "input_and_output"
+    ])
+  ).action(async (mode) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       printJson(rt, await client.setAutoBlockMode({ mode }));
@@ -1325,6 +1371,7 @@ function register10(program, rt) {
 }
 
 // src/commands/account.ts
+import { SeclaiApiVersion } from "@seclai/sdk";
 function register11(program, rt) {
   program.command("me").description("Show the authenticated user's account ID and organization memberships.").action(async () => {
     await run(rt, async () => {
@@ -1343,8 +1390,11 @@ function register11(program, rt) {
   });
   version.command("set").description("Pin the account to a dated API version. Affects every client, not just this CLI.").argument("<date>", "API version as YYYY-MM-DD.").action(async (date) => {
     await run(rt, async () => {
-      if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) {
-        throw new Error(`Expected an API version as YYYY-MM-DD, got "${date}".`);
+      const known = Object.values(SeclaiApiVersion);
+      if (!known.includes(date) && !program.opts().allowUnknownApiVersion) {
+        throw new Error(
+          `Unknown API version "${date}". This release knows ${[...new Set(known)].sort().join(", ")}. Pass --allow-unknown-api-version to pin it anyway.`
+        );
       }
       const client = createClient(program.opts());
       printJson(rt, await client.updateApiVersion(date));
@@ -1386,10 +1436,14 @@ function register12(program, rt) {
     });
   });
   const alerts = models.command("alerts").description("Model alerts.");
-  alerts.command("list").description("List model alerts.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).action(async (opts) => {
+  alerts.command("list").description("List model alerts.").option("--page <n>", "Page number.", parseNumber).option("--limit <n>", "Page size.", parseNumber).option(
+    "--paged",
+    "Wrap the results in {data: [...]}, the shape this endpoint moves to from --api-version 2026-07-27."
+  ).action(async (opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
-      printJson(rt, await client.listModelAlerts(listOpts(opts)));
+      const res = await client.listModelAlerts(listOpts(opts));
+      printJson(rt, opts.paged ? toPagedEnvelope(res, "alerts") : res);
     });
   });
   alerts.command("mark-read").description("Mark a model alert as read.").argument("<alertId>", "Alert ID.").action(async (alertId) => {
@@ -1460,19 +1514,19 @@ function register12(program, rt) {
 }
 
 // src/commands/search.ts
-import { Option } from "commander";
+import { Option as Option2 } from "commander";
 function register13(program, rt) {
   program.command("search").description("Search across Seclai resources.").requiredOption("--query <text>", "Search query text.").option("--limit <n>", "Max results.", parseNumber).option("--entity-type <type>", "Filter by entity type (e.g. agent, source, knowledge_base, memory_bank).").action(async (opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       const o = { query: opts.query };
       if (opts.limit !== void 0) o.limit = opts.limit;
-      if (opts.entityType) o.entityType = opts.entityType;
+      if (opts.entityType !== void 0) o.entityType = opts.entityType;
       printJson(rt, await client.search(o));
     });
   });
   const docs = program.command("docs").description("Seclai documentation.");
-  docs.command("search").description("Search the Seclai documentation.").requiredOption("--query <text>", "Search query text.").addOption(new Option("--mode <mode>", "Search mode.").choices(["keyword", "semantic"])).option("--limit <n>", "Max results.", parseNumber).action(async (opts) => {
+  docs.command("search").description("Search the Seclai documentation.").requiredOption("--query <text>", "Search query text.").addOption(new Option2("--mode <mode>", "Search mode.").choices(["keyword", "semantic"])).option("--limit <n>", "Max results.", parseNumber).action(async (opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
       const o = { query: opts.query };
@@ -1608,6 +1662,7 @@ seclai agents runs list <agentId>
 | \`models\` | Model catalog, generation tiers, model alerts, recommendations, playground experiments | [references/models.md](references/models.md) |
 | \`auth\` \`configure\` \`api-version\` \`mcp\` \`skills\` \`completion\` | Authentication, profiles, API version pinning, editor integration | [references/setup.md](references/setup.md) |
 | \`ai\` | Top-level AI assistant for knowledge bases, sources, solutions and memory | [references/ai-assistant.md](references/ai-assistant.md) |
+| \`search\` \`docs\` \`me\` | Search across resources, search the documentation, show the authenticated account | below, under [Search and account](#search-and-account) |
 
 Cross-cutting topics: [streaming and event modes](references/streaming.md),
 [file uploads](references/uploads.md).
@@ -1878,9 +1933,9 @@ seclai alerts subscribe <alertId>
 seclai alerts unsubscribe <alertId>
 \`\`\`
 
-\`GET /alerts\` declares no severity filter. \`--severity\` still parses, but it is
-ignored with a warning and will be removed \u2014 it never filtered anything. Filter
-client-side instead:
+\`GET /alerts\` declares no severity filter, so there is no \`--severity\` \u2014 it
+never filtered anything, and returned unfiltered rows that looked filtered.
+Filter client-side instead:
 
 \`\`\`bash
 seclai alerts list | jq '[.data[] | select(.severity == "high")]'
@@ -2635,302 +2690,156 @@ function register16(program, rt) {
 }
 
 // src/commands/completion.ts
-var BASH = `#!/usr/bin/env bash
+function collectTree(program) {
+  const tree = /* @__PURE__ */ new Map();
+  const walk = (cmd, prefix) => {
+    const children = [];
+    for (const sub of cmd.commands) {
+      const name = sub.name();
+      if (name === "help") continue;
+      children.push({ name, description: sub.description().replace(/\s+/g, " ").trim() });
+      walk(sub, [...prefix, name]);
+    }
+    if (children.length > 0) tree.set(prefix.join(" "), children);
+  };
+  walk(program, []);
+  return tree;
+}
+function globalOptions(program) {
+  return program.options.filter((o) => o.long && o.long !== "--help").map((o) => ({
+    flag: o.long,
+    description: o.description.replace(/\s+/g, " ").trim()
+  }));
+}
+var names = (children) => children.map((c) => c.name).join(" ");
+function renderBash(tree, options) {
+  const cases = [...tree.entries()].map(([prefix, children]) => `    ${JSON.stringify(prefix)}) __seclai_reply "${names(children)}" ;;`).join("\n");
+  return `#!/usr/bin/env bash
 # seclai bash completion \u2014 add to ~/.bashrc:
 #   eval "$(seclai completion bash)"
+#
+# Generated from the command tree by \`seclai completion bash\`. Do not edit.
+
+__seclai_reply() {
+  COMPREPLY=( $(compgen -W "$1" -- "$__seclai_cur") )
+}
 
 _seclai_completions() {
-  local cur prev commands
-  cur="\${COMP_WORDS[COMP_CWORD]}"
-  prev="\${COMP_WORDS[COMP_CWORD-1]}"
-
-  # Top-level commands
-  commands="agents sources contents kb memory evals solutions governance alerts email models search docs me api-version ai skills mcp completion auth configure help"
-
-  case "\${COMP_WORDS[1]}" in
-    agents)
-      case "\${COMP_WORDS[2]}" in
-        runs)     COMPREPLY=( $(compgen -W "list get delete cancel search eval-results download-attachment" -- "$cur") ); return ;;
-        def)      COMPREPLY=( $(compgen -W "get update" -- "$cur") ); return ;;
-        ai)       COMPREPLY=( $(compgen -W "gen-steps step-config history mark" -- "$cur") ); return ;;
-        triggers) COMPREPLY=( $(compgen -W "email-config" -- "$cur") ); return ;;
-        *)        COMPREPLY=( $(compgen -W "list create get update delete disable enable callers triggers run runs def export preview-import upload-input input-status attachment-references ai" -- "$cur") ); return ;;
-      esac ;;
-    sources|source)
-      case "\${COMP_WORDS[2]}" in
-        exports)    COMPREPLY=( $(compgen -W "list create get cancel delete download estimate" -- "$cur") ); return ;;
-        migration)  COMPREPLY=( $(compgen -W "get start cancel" -- "$cur") ); return ;;
-        *)          COMPREPLY=( $(compgen -W "list create get update delete upload upload-text exports migration" -- "$cur") ); return ;;
-      esac ;;
-    contents) COMPREPLY=( $(compgen -W "get delete upload replace replace-text embeddings" -- "$cur") ); return ;;
-    kb)       COMPREPLY=( $(compgen -W "list create get update delete" -- "$cur") ); return ;;
-    memory)
-      case "\${COMP_WORDS[2]}" in
-        ai) COMPREPLY=( $(compgen -W "generate last accept" -- "$cur") ); return ;;
-        *)  COMPREPLY=( $(compgen -W "list create get update delete stats agents compact delete-source templates test-compaction test-compaction-standalone ai" -- "$cur") ); return ;;
-      esac ;;
-    evals)
-      case "\${COMP_WORDS[2]}" in
-        criteria) COMPREPLY=( $(compgen -W "list create get update delete summary" -- "$cur") ); return ;;
-        results)  COMPREPLY=( $(compgen -W "list create" -- "$cur") ); return ;;
-        *)        COMPREPLY=( $(compgen -W "criteria results compatible-runs test-draft agent-results agent-runs non-manual-summary" -- "$cur") ); return ;;
-      esac ;;
-    solutions)
-      case "\${COMP_WORDS[2]}" in
-        convos) COMPREPLY=( $(compgen -W "list add mark" -- "$cur") ); return ;;
-        ai)     COMPREPLY=( $(compgen -W "generate kb source accept decline" -- "$cur") ); return ;;
-        *)      COMPREPLY=( $(compgen -W "list create get update delete link unlink convos ai" -- "$cur") ); return ;;
-      esac ;;
-    governance)
-      case "\${COMP_WORDS[2]}" in
-        ai) COMPREPLY=( $(compgen -W "generate list accept decline" -- "$cur") ); return ;;
-        *)  COMPREPLY=( $(compgen -W "ai" -- "$cur") ); return ;;
-      esac ;;
-    alerts)
-      case "\${COMP_WORDS[2]}" in
-        configs) COMPREPLY=( $(compgen -W "list create get update delete" -- "$cur") ); return ;;
-        prefs)   COMPREPLY=( $(compgen -W "list update" -- "$cur") ); return ;;
-        *)       COMPREPLY=( $(compgen -W "list get status comment subscribe unsubscribe configs prefs" -- "$cur") ); return ;;
-      esac ;;
-    email)
-      case "\${COMP_WORDS[2]}" in
-        domains) COMPREPLY=( $(compgen -W "list add remove verify set-primary use-shared test-email dmarc" -- "$cur") ); return ;;
-        blocked) COMPREPLY=( $(compgen -W "list add remove auto-block-mode" -- "$cur") ); return ;;
-        inbound) COMPREPLY=( $(compgen -W "status rejections cancel-queued resume" -- "$cur") ); return ;;
-        optouts) COMPREPLY=( $(compgen -W "list remove" -- "$cur") ); return ;;
-        *)       COMPREPLY=( $(compgen -W "domains blocked inbound optouts" -- "$cur") ); return ;;
-      esac ;;
-    models)
-      case "\${COMP_WORDS[2]}" in
-        alerts)      COMPREPLY=( $(compgen -W "list mark-read mark-all-read unread-count" -- "$cur") ); return ;;
-        experiments) COMPREPLY=( $(compgen -W "list create get cancel delete" -- "$cur") ); return ;;
-        *)           COMPREPLY=( $(compgen -W "list get tiers alerts recommendations experiments" -- "$cur") ); return ;;
-      esac ;;
-    docs) COMPREPLY=( $(compgen -W "search" -- "$cur") ); return ;;
-    api-version) COMPREPLY=( $(compgen -W "get set clear" -- "$cur") ); return ;;
-    auth) COMPREPLY=( $(compgen -W "login logout status refresh" -- "$cur") ); return ;;
-    configure) COMPREPLY=( $(compgen -W "sso list" -- "$cur") ); return ;;
-    ai) COMPREPLY=( $(compgen -W "feedback kb source solution memory memory-history accept decline memory-accept" -- "$cur") ); return ;;
-    skills) COMPREPLY=( $(compgen -W "install" -- "$cur") ); return ;;
-    mcp) COMPREPLY=( $(compgen -W "configure show" -- "$cur") ); return ;;
-    completion) COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") ); return ;;
+  local __seclai_cur prefix i
+  __seclai_cur="\${COMP_WORDS[COMP_CWORD]}"
+
+  # Everything typed so far except the program name and the word being
+  # completed, with flags dropped, joined by spaces.
+  prefix=""
+  for ((i = 1; i < COMP_CWORD; i++)); do
+    case "\${COMP_WORDS[i]}" in
+      -*) continue ;;
+    esac
+    if [ -z "$prefix" ]; then
+      prefix="\${COMP_WORDS[i]}"
+    else
+      prefix="$prefix \${COMP_WORDS[i]}"
+    fi
+  done
+
+  case "$__seclai_cur" in
+    -*) __seclai_reply "${options.map((o) => o.flag).join(" ")}"; return ;;
   esac
 
-  COMPREPLY=( $(compgen -W "$commands" -- "$cur") )
+  case "$prefix" in
+${cases}
+    *) COMPREPLY=() ;;
+  esac
 }
 
 complete -F _seclai_completions seclai
 `;
-var ZSH = `#compdef seclai
+}
+function renderZsh(tree, options) {
+  const cases = [...tree.entries()].map(([prefix, children]) => {
+    const described = children.map((c) => `'${c.name}:${c.description.replace(/['`$]/g, "")}'`).join(" ");
+    return `    ${JSON.stringify(prefix)}) sub=(${described}) ;;`;
+  }).join("\n");
+  const opts = options.map((o) => `'${o.flag}[${o.description.replace(/['\]`$]/g, "")}]'`).join(" ");
+  return `#compdef seclai
 # seclai zsh completion \u2014 add to ~/.zshrc:
 #   eval "$(seclai completion zsh)"
+#
+# Generated from the command tree by \`seclai completion zsh\`. Do not edit.
 
 _seclai() {
-  local -a commands
-  commands=(
-    'agents:Manage agents, runs, definitions, and AI assistance'
-    'sources:Manage content sources'
-    'contents:Manage indexed content and embeddings'
-    'kb:Manage knowledge bases'
-    'memory:Manage memory banks'
-    'evals:Manage evaluations'
-    'solutions:Manage solutions'
-    'governance:Governance AI assistant'
-    'alerts:Manage alerts and alert configurations'
-    'email:Agent email domains, blocklist, inbound health, opt-outs'
-    'models:Models, model alerts, recommendations, experiments'
-    'search:Search across Seclai resources'
-    'docs:Search the Seclai documentation'
-    'me:Show the authenticated user and organizations'
-    'api-version:Read or pin the dated API version'
-    'ai:Top-level AI assistant'
-    'skills:Install skill files for AI coding tools'
-    'mcp:Configure the Seclai MCP server'
-    'completion:Generate shell completion scripts'
-    'auth:SSO authentication'
-    'configure:Manage SSO profiles'
-    'help:Display help for command'
-  )
-
-  _arguments -C \\
-    '--api-key[Seclai API key]:key' \\
-    '--profile[SSO profile name]:name' \\
-    '--account-id[Account ID (X-Account-Id header)]:id' \\
-    '--config-dir[Config directory]:path' \\
-    '--api-version[Dated API version (YYYY-MM-DD)]:date' \\
-    '--allow-unknown-api-version[Permit an unrecognized --api-version]' \\
-    '--compact[Output compact JSON]' \\
-    '-V[Output version]' \\
-    '-h[Display help]' \\
-    '1:command:->cmd' \\
-    '*::arg:->args'
-
-  case $state in
-    cmd) _describe 'command' commands ;;
-    args)
-      case \${words[1]} in
-        agents)
-          local -a sub=(list create get update delete disable enable callers triggers run runs def export preview-import upload-input input-status attachment-references ai)
-          _describe 'subcommand' sub ;;
-        sources|source)
-          local -a sub=(list create get update delete upload upload-text exports migration)
-          _describe 'subcommand' sub ;;
-        contents)
-          local -a sub=(get delete upload replace replace-text embeddings)
-          _describe 'subcommand' sub ;;
-        kb)
-          local -a sub=(list create get update delete)
-          _describe 'subcommand' sub ;;
-        memory)
-          local -a sub=(list create get update delete stats agents compact delete-source templates test-compaction test-compaction-standalone ai)
-          _describe 'subcommand' sub ;;
-        evals)
-          local -a sub=(criteria results compatible-runs test-draft agent-results agent-runs non-manual-summary)
-          _describe 'subcommand' sub ;;
-        solutions)
-          local -a sub=(list create get update delete link unlink convos ai)
-          _describe 'subcommand' sub ;;
-        governance)
-          local -a sub=(ai)
-          _describe 'subcommand' sub ;;
-        alerts)
-          local -a sub=(list get status comment subscribe unsubscribe configs prefs)
-          _describe 'subcommand' sub ;;
-        email)
-          local -a sub=(domains blocked inbound optouts)
-          _describe 'subcommand' sub ;;
-        models)
-          local -a sub=(list get tiers alerts recommendations experiments)
-          _describe 'subcommand' sub ;;
-        docs)
-          local -a sub=(search)
-          _describe 'subcommand' sub ;;
-        api-version)
-          local -a sub=(get set clear)
-          _describe 'subcommand' sub ;;
-        auth)
-          local -a sub=(login logout status refresh)
-          _describe 'subcommand' sub ;;
-        configure)
-          local -a sub=(sso list)
-          _describe 'subcommand' sub ;;
-        ai)
-          local -a sub=(feedback kb source solution memory memory-history accept decline memory-accept)
-          _describe 'subcommand' sub ;;
-        skills)
-          local -a sub=(install)
-          _describe 'subcommand' sub ;;
-        mcp)
-          local -a sub=(configure show)
-          _describe 'subcommand' sub ;;
-        completion)
-          local -a sub=(bash zsh fish)
-          _describe 'shell' sub ;;
-      esac ;;
+  local prefix cur
+  local -a sub opts
+  cur="\${words[CURRENT]}"
+
+  opts=(${opts})
+  if [[ "$cur" == -* ]]; then
+    _describe 'option' opts
+    return
+  fi
+
+  # Words typed so far, minus the program name, the word being completed, and
+  # any flags.
+  prefix="\${(j: :)\${(M)words[2,CURRENT-1]:#[^-]*}}"
+
+  case "$prefix" in
+${cases}
+    *) return ;;
   esac
+
+  _describe 'command' sub
 }
 
-_seclai "$@"
+compdef _seclai seclai
 `;
-var FISH = `# seclai fish completion \u2014 save to ~/.config/fish/completions/seclai.fish
+}
+function renderFish(tree, options) {
+  const lines = [...tree.entries()].map(
+    ([prefix, children]) => children.map(
+      (c) => `complete -c seclai -f -n "__seclai_at '${prefix}'" -a "${c.name}" -d "${c.description.replace(/["$`]/g, "")}"`
+    ).join("\n")
+  ).join("\n");
+  const opts = options.map(
+    (o) => `complete -c seclai -l ${o.flag.replace(/^--/, "")} -d "${o.description.replace(/["$`]/g, "")}"`
+  ).join("\n");
+  return `# seclai fish completion \u2014 save to your completions directory:
 #   seclai completion fish > ~/.config/fish/completions/seclai.fish
-
-set -l top agents sources contents kb memory evals solutions governance alerts email models search docs me api-version ai skills mcp completion auth configure help
-
-# Top-level
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "agents" -d "Manage agents"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "sources" -d "Manage sources"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "contents" -d "Manage content"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "kb" -d "Knowledge bases"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "memory" -d "Memory banks"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "evals" -d "Evaluations"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "solutions" -d "Solutions"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "governance" -d "Governance AI"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "alerts" -d "Alerts"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "email" -d "Agent email"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "models" -d "Models and model alerts"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "search" -d "Search resources"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "docs" -d "Search documentation"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "me" -d "Authenticated user"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "api-version" -d "Dated API version"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "ai" -d "AI assistant"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "skills" -d "Skill files"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "mcp" -d "MCP server config"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "completion" -d "Shell completions"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "auth" -d "SSO authentication"
-complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "configure" -d "Manage SSO profiles"
-
-# agents
-complete -c seclai -n "__fish_seen_subcommand_from agents; and not __fish_seen_subcommand_from list create get update delete disable enable callers triggers run runs def export preview-import upload-input input-status attachment-references ai" -f -a "list create get update delete disable enable callers triggers run runs def export preview-import upload-input input-status attachment-references ai"
-
-# sources
-complete -c seclai -n "__fish_seen_subcommand_from sources; and not __fish_seen_subcommand_from list create get update delete upload upload-text exports migration" -f -a "list create get update delete upload upload-text exports migration"
-
-# contents
-complete -c seclai -n "__fish_seen_subcommand_from contents; and not __fish_seen_subcommand_from get delete upload replace replace-text embeddings" -f -a "get delete upload replace replace-text embeddings"
-
-# kb
-complete -c seclai -n "__fish_seen_subcommand_from kb; and not __fish_seen_subcommand_from list create get update delete" -f -a "list create get update delete"
-
-# memory
-complete -c seclai -n "__fish_seen_subcommand_from memory; and not __fish_seen_subcommand_from list create get update delete stats agents compact delete-source templates test-compaction test-compaction-standalone ai" -f -a "list create get update delete stats agents compact delete-source templates test-compaction test-compaction-standalone ai"
-
-# evals
-complete -c seclai -n "__fish_seen_subcommand_from evals; and not __fish_seen_subcommand_from criteria results compatible-runs test-draft agent-results agent-runs non-manual-summary" -f -a "criteria results compatible-runs test-draft agent-results agent-runs non-manual-summary"
-
-# solutions
-complete -c seclai -n "__fish_seen_subcommand_from solutions; and not __fish_seen_subcommand_from list create get update delete link unlink convos ai" -f -a "list create get update delete link unlink convos ai"
-
-# governance
-complete -c seclai -n "__fish_seen_subcommand_from governance; and not __fish_seen_subcommand_from ai" -f -a "ai"
-
-# alerts
-complete -c seclai -n "__fish_seen_subcommand_from alerts; and not __fish_seen_subcommand_from list get status comment subscribe unsubscribe configs prefs" -f -a "list get status comment subscribe unsubscribe configs prefs"
-
-# email
-complete -c seclai -n "__fish_seen_subcommand_from email; and not __fish_seen_subcommand_from domains blocked inbound optouts" -f -a "domains blocked inbound optouts"
-
-# models
-complete -c seclai -n "__fish_seen_subcommand_from models; and not __fish_seen_subcommand_from list get tiers alerts recommendations experiments" -f -a "list get tiers alerts recommendations experiments"
-
-# docs
-complete -c seclai -n "__fish_seen_subcommand_from docs; and not __fish_seen_subcommand_from search" -f -a "search"
-
-# api-version
-complete -c seclai -n "__fish_seen_subcommand_from api-version; and not __fish_seen_subcommand_from get set clear" -f -a "get set clear"
-
-# auth
-complete -c seclai -n "__fish_seen_subcommand_from auth; and not __fish_seen_subcommand_from login logout status refresh" -f -a "login logout status refresh"
-
-# configure
-complete -c seclai -n "__fish_seen_subcommand_from configure; and not __fish_seen_subcommand_from sso list" -f -a "sso list"
-
-# ai
-complete -c seclai -n "__fish_seen_subcommand_from ai; and not __fish_seen_subcommand_from feedback kb source solution memory memory-history accept decline memory-accept" -f -a "feedback kb source solution memory memory-history accept decline memory-accept"
-
-# skills
-complete -c seclai -n "__fish_seen_subcommand_from skills; and not __fish_seen_subcommand_from install" -f -a "install"
-
-# mcp
-complete -c seclai -n "__fish_seen_subcommand_from mcp; and not __fish_seen_subcommand_from configure show" -f -a "configure show"
-
-# completion
-complete -c seclai -n "__fish_seen_subcommand_from completion; and not __fish_seen_subcommand_from bash zsh fish" -f -a "bash zsh fish"
+#
+# Generated from the command tree by \`seclai completion fish\`. Do not edit.
+
+function __seclai_prefix
+    set -l toks (commandline -opc)
+    set -e toks[1]
+    set -l out
+    for t in $toks
+        if not string match -q -- '-*' $t
+            set -a out $t
+        end
+    end
+    string join ' ' $out
+end
+
+function __seclai_at
+    test (__seclai_prefix) = "$argv[1]"
+end
+
+${lines}
 
 # Global options
-complete -c seclai -l api-key -d "Seclai API key"
-complete -c seclai -l profile -d "SSO profile name"
-complete -c seclai -l account-id -d "Account ID (X-Account-Id header)"
-complete -c seclai -l config-dir -d "Config directory"
-complete -c seclai -l api-version -d "Dated API version (YYYY-MM-DD)"
-complete -c seclai -l allow-unknown-api-version -d "Permit an unrecognized --api-version"
-complete -c seclai -l compact -d "Output compact JSON"
-complete -c seclai -s V -l version -d "Output version"
+${opts}
 `;
-var SCRIPTS = { bash: BASH, zsh: ZSH, fish: FISH };
+}
+function renderCompletion(shell, program) {
+  const tree = collectTree(program);
+  const options = globalOptions(program);
+  if (shell === "bash") return renderBash(tree, options);
+  if (shell === "zsh") return renderZsh(tree, options);
+  if (shell === "fish") return renderFish(tree, options);
+  return void 0;
+}
 function register17(program, rt) {
-  const completion = program.command("completion").description("Generate shell completion scripts.").argument("<shell>", "Shell type: bash, zsh, or fish.").action(async (shell) => {
-    const script = SCRIPTS[shell];
+  program.command("completion").description("Generate shell completion scripts.").argument("<shell>", "Shell type: bash, zsh, or fish.").action((shell) => {
+    const script = renderCompletion(shell, program);
     if (!script) {
       rt.writeErr(`Unknown shell "${shell}". Use: bash, zsh, or fish.
 `);
@@ -3389,15 +3298,8 @@ function escapeRegExp(s) {
 }
 
 // src/cli.ts
-var VALUED_GLOBAL_OPTIONS = [
-  ["apiKey", "--api-key", "reject", "Pass a key, or omit the flag to use SECLAI_API_KEY or SSO."],
-  ["profile", "--profile", "reject", "Pass a profile name, or omit the flag to use the default profile."],
-  ["accountId", "--account-id", "reject", "Pass an account ID, or omit the flag to use the default org."],
-  ["configDir", "--config-dir", "reject", "Pass a directory, or omit the flag to use ~/.seclai."],
-  ["apiVersion", "--api-version", "warn", "Pass a YYYY-MM-DD date, or omit the flag to use the account default."]
-];
 function createProgram(rt = defaultRuntime()) {
-  const program = new Command3();
+  const program = new Command4();
   const cliVersion = getCliVersion();
   program.name("seclai").description(
     `Seclai Command Line Interface (v${cliVersion})
@@ -3455,14 +3357,12 @@ Examples:
   program.exitOverride();
   program.hook("preAction", (thisCommand) => {
     const globalOpts = thisCommand.opts();
-    for (const [key, flag, policy, hint] of VALUED_GLOBAL_OPTIONS) {
-      const value = globalOpts[key];
-      if (typeof value !== "string" || value.length > 0) continue;
-      if (policy === "reject") {
-        throw new Error(`${flag} was given an empty value. ${hint}`);
-      }
-      delete globalOpts[key];
-      warnDeprecated(rt, `${flag} was given an empty value and is being ignored. ${hint}`);
+    if (typeof globalOpts.apiVersion === "string" && globalOpts.apiVersion.trim().length === 0) {
+      warnDeprecated(
+        rt,
+        "--api-version was given an empty value and is being ignored. Pass a YYYY-MM-DD date, or omit the flag to use the account default.",
+        "rejected"
+      );
     }
     rt.compact = Boolean(globalOpts.compact);
   });
@@ -3531,4 +3431,3 @@ export {
   createProgram,
   runCli
 };
-//# sourceMappingURL=cli.js.map