sim 2.0.0-dev.12.1 → 2.0.0-dev.19.1

package/dist/index.js

@@ -2403,7 +2403,7 @@ function removeSection(doc, name) {
 
 // src/config/profile.ts
 var DEFAULT_PROFILE = "default";
-var DEFAULT_ENDPOINT = "https://sim.ai";
+var DEFAULT_ENDPOINT = "https://www.sim.ai";
 var OUTPUT_FORMATS = ["table", "json", "yaml", "text"];
 
 class ProfileConfigError extends Error {
@@ -2466,8 +2466,18 @@ function deleteProfile(profile) {
     writeIni(credentialsPath(), credentialsDoc, true);
   return { config, credentials };
 }
-function normalizeEndpoint(endpoint) {
-  return endpoint.replace(/\/+$/, "");
+function normalizeEndpoint(endpoint, source) {
+  const trimmed = endpoint.replace(/\/+$/, "");
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new ProfileConfigError(`Invalid endpoint "${endpoint}" from ${source}. Use an absolute URL, e.g. ${DEFAULT_ENDPOINT} or http://localhost:3000`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new ProfileConfigError(`Unsupported endpoint scheme "${parsed.protocol.replace(/:$/, "")}" from ${source}. Use http or https, e.g. ${DEFAULT_ENDPOINT}`);
+  }
+  return trimmed;
 }
 function resolve(candidates, fallback, fallbackSource) {
   for (const [source, value] of candidates) {
@@ -2505,7 +2515,7 @@ function resolveProfile(overrides = {}) {
   }
   return {
     name,
-    endpoint: normalizeEndpoint(endpoint.value),
+    endpoint: normalizeEndpoint(endpoint.value, endpoint.source),
     apiKey: apiKey.value,
     workspaceId: workspaceId.value,
     output: output.value,
@@ -2517,6 +2527,18 @@ function resolveProfile(overrides = {}) {
     }
   };
 }
+// src/version.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+function readPackageVersion() {
+  const metadata = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
+  if (typeof metadata !== "object" || metadata === null || !("version" in metadata) || typeof metadata.version !== "string") {
+    throw new Error("CLI package metadata is missing a valid version");
+  }
+  return metadata.version;
+}
+var CLI_VERSION = readPackageVersion();
+var USER_AGENT = `sim-cli/${CLI_VERSION} node/${process.versions.node} (${process.platform}; ${process.arch})`;
+
 // src/http/client.ts
 class SimApiError extends Error {
   status;
@@ -2539,13 +2561,28 @@ function buildUrl(endpoint, path, query) {
   }
   return url.toString();
 }
-function toApiError(status, raw) {
+var REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+var MARKUP_PREFIX = /^\s*<(?:!doctype|html|\?xml)/i;
+var KEY_SCOPE_REFUSALS = new Set([
+  "WORKSPACE_KEY_OPERATION_NOT_PERMITTED",
+  "PRINCIPAL_KIND_NOT_PERMITTED"
+]);
+function toNonJsonError(url, status, contentType, raw) {
+  const type = contentType?.split(";")[0]?.trim().toLowerCase();
+  const isMarkup = type === "text/html" || type === "application/xhtml+xml" || MARKUP_PREFIX.test(raw);
+  const kind = isMarkup ? "HTML" : type && type !== "application/json" ? type : "a non-JSON response";
+  const text = raw.trim();
+  const keepSnippet = !isMarkup && text.length > 0 && text.length <= 200;
+  return new SimApiError(`${url} returned ${kind}, not JSON (HTTP ${status}) — check your endpoint.${keepSnippet ? ` Response: ${truncate(text, 200)}` : ""}`, status);
+}
+function toApiError(url, status, contentType, raw) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    const text = raw.trim();
-    return new SimApiError(text ? truncate(text, 300) : `Request failed with status ${status}`, status);
+    if (!raw.trim())
+      return new SimApiError(`Request failed with status ${status}`, status);
+    return toNonJsonError(url, status, contentType, raw);
   }
   const body = parsed;
   if (body.error && typeof body.error === "object") {
@@ -2561,8 +2598,34 @@ function toApiError(status, raw) {
 function truncate(value, max) {
   return value.length <= max ? value : `${value.slice(0, max)}…`;
 }
+function namesKeyScopeRefusal(error) {
+  if (typeof error.code === "string" && KEY_SCOPE_REFUSALS.has(error.code))
+    return true;
+  const details = error.details;
+  if (!details || typeof details !== "object")
+    return false;
+  const code = details.code;
+  return typeof code === "string" && KEY_SCOPE_REFUSALS.has(code);
+}
+function isStrictPrefix(path, other) {
+  if (path.length >= other.length)
+    return false;
+  return path.every((segment, index) => segment === other[index]);
+}
+function rejectsAKeyThatValidated(issue, other) {
+  if (!issue.unrecognizedKeys || !isStrictPrefix(issue.path, other.path))
+    return false;
+  return issue.unrecognizedKeys.includes(other.path[issue.path.length]);
+}
+function dropUnionBranchNoise(issues) {
+  if (issues.length < 2)
+    return issues;
+  const kept = issues.filter((issue) => !issues.some((other) => rejectsAKeyThatValidated(issue, other)));
+  return kept.length > 0 ? kept : issues;
+}
 function formatApiErrorDetails(details) {
-  const issues = new Set;
+  const issues = [];
+  const seen = new Set;
   const visit = (value, parentPath = []) => {
     if (Array.isArray(value)) {
       value.forEach((item) => visit(item, parentPath));
@@ -2580,15 +2643,27 @@ function formatApiErrorDetails(details) {
     }
     if (typeof issue.message !== "string" || issue.message === "Invalid input")
       return;
-    issues.add(`${path.length > 0 ? path.join(".") : "request"}: ${issue.message}`);
+    const line = `${path.join(".")}: ${issue.message}`;
+    if (seen.has(line))
+      return;
+    seen.add(line);
+    issues.push({
+      path,
+      message: issue.message,
+      unrecognizedKeys: issue.code === "unrecognized_keys" && Array.isArray(issue.keys) ? issue.keys.map(String) : null
+    });
   };
   visit(details);
-  if (issues.size === 0)
+  if (issues.length === 0)
     return [`  details: ${truncate(JSON.stringify(details), 1000)}`];
-  const visible = [...issues].slice(0, 8);
-  const lines = ["  details:", ...visible.map((issue) => `    ${issue}`)];
-  if (issues.size > visible.length)
-    lines.push(`    … ${issues.size - visible.length} more issues`);
+  const kept = dropUnionBranchNoise(issues);
+  const visible = kept.slice(0, 8);
+  const lines = [
+    "  details:",
+    ...visible.map((issue) => `    ${issue.path.length > 0 ? issue.path.join(".") : "request"}: ${issue.message}`)
+  ];
+  if (kept.length > visible.length)
+    lines.push(`    … ${kept.length - visible.length} more issues`);
   return lines;
 }
 
@@ -2614,6 +2689,20 @@ class SimClient {
     return workspaceId;
   }
   async requestRaw(path, options = {}) {
+    return (await this.send(path, options)).response;
+  }
+  async request(path, options = {}) {
+    const { response, url } = await this.send(path, options);
+    const raw = await response.text();
+    if (!raw)
+      return;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw toNonJsonError(url, response.status, response.headers.get("content-type"), raw);
+    }
+  }
+  async send(path, options) {
     const apiKey = this.resolveApiKey(options.auth);
     const url = buildUrl(this.profile.endpoint, path, options.query);
     const hasBody = options.body !== undefined;
@@ -2624,11 +2713,13 @@ class SimClient {
         headers: {
           ...apiKey ? { "x-api-key": apiKey } : {},
           accept: "application/json",
+          "user-agent": USER_AGENT,
           ...hasBody ? { "content-type": "application/json" } : {},
           ...options.headers
         },
         body: hasBody ? JSON.stringify(options.body) : undefined,
-        signal: options.signal
+        signal: options.signal,
+        redirect: "manual"
       });
     } catch (cause) {
       if (options.signal?.aborted) {
@@ -2636,43 +2727,87 @@ class SimClient {
       }
       throw new SimApiError(`Could not reach ${this.profile.endpoint}: ${cause.message}`, 0);
     }
+    if (REDIRECT_STATUSES.has(response.status))
+      throw this.toRedirectError(url, path, response);
     if (!response.ok) {
       const raw = await response.text();
-      const error = toApiError(response.status, raw);
+      const error = toApiError(url, response.status, response.headers.get("content-type"), raw);
       if (response.status === 401) {
         error.message = `${error.message} — run: sim login --profile ${this.profile.name}`;
       }
+      if (namesKeyScopeRefusal(error)) {
+        error.message = `${error.message} — this operation needs a personal API key: sim login --profile ${this.profile.name}`;
+      }
       throw error;
     }
-    return response;
+    return { response, url };
   }
-  async request(path, options = {}) {
-    const response = await this.requestRaw(path, options);
-    const raw = await response.text();
-    if (!raw)
-      return;
-    return JSON.parse(raw);
+  toRedirectError(url, path, response) {
+    const location = response.headers.get("location")?.trim();
+    let target = null;
+    if (location) {
+      try {
+        target = new URL(location, url);
+      } catch {
+        target = null;
+      }
+    }
+    if (!target) {
+      return new SimApiError(`${url} answered HTTP ${response.status} with no usable redirect target. Check the endpoint for profile "${this.profile.name}".`, response.status);
+    }
+    const suggested = redirectEndpoint(this.profile.endpoint, path, target);
+    if (!suggested) {
+      return new SimApiError(`${url} redirected to ${target.href}. The CLI does not follow redirects, because a redirect can drop the request body and turn a write into a silent no-op.`, response.status);
+    }
+    return new SimApiError(`Endpoint redirected to ${suggested}. Run: sim configure --profile ${this.profile.name} --set-endpoint ${suggested}`, response.status);
   }
 }
+function redirectEndpoint(endpoint, requestPath, target) {
+  const prefix = target.pathname.endsWith(requestPath) ? target.pathname.slice(0, target.pathname.length - requestPath.length) : "";
+  const suggested = `${target.origin}${prefix}`.replace(/\/+$/, "");
+  return suggested === endpoint.replace(/\/+$/, "") ? null : suggested;
+}
+function pageProgress() {
+  let reported = false;
+  return {
+    advance: (fetched) => {
+      if (!process.stderr.isTTY)
+        return;
+      reported = true;
+      process.stderr.write(`\r${source_default.dim(`fetched ${fetched}…`)}\x1B[K`);
+    },
+    finish: () => {
+      if (reported)
+        process.stderr.write("\r\x1B[K");
+    }
+  };
+}
 async function requestAllPages(client, path, options) {
   const { query, pageSize, limit: requestedLimit, ...requestOptions } = options;
   const limit = requestedLimit ?? Number.POSITIVE_INFINITY;
   if (limit <= 0)
     return [];
   const items = [];
+  const progress = pageProgress();
   let cursor = null;
-  do {
-    const page = await client.request(path, {
-      ...requestOptions,
-      query: {
-        ...query,
-        limit: Math.min(pageSize, limit - items.length),
-        cursor
-      }
-    });
-    items.push(...page.data);
-    cursor = page.nextCursor;
-  } while (cursor && items.length < limit);
+  try {
+    do {
+      const page = await client.request(path, {
+        ...requestOptions,
+        query: {
+          ...query,
+          limit: Math.min(pageSize, limit - items.length),
+          cursor
+        }
+      });
+      items.push(...page.data);
+      cursor = page.nextCursor;
+      if (cursor && items.length < limit)
+        progress.advance(items.length);
+    } while (cursor && items.length < limit);
+  } finally {
+    progress.finish();
+  }
   return items.slice(0, limit);
 }
 function resolvePath(template, params = {}) {
@@ -5894,7 +6029,7 @@ function duration(ms) {
   if (ms === null || ms === undefined)
     return EMPTY;
   if (ms < 1000)
-    return `${ms}ms`;
+    return `${Math.round(ms)}ms`;
   if (ms < 60000)
     return `${(ms / 1000).toFixed(1)}s`;
   return `${Math.floor(ms / 60000)}m${Math.round(ms % 60000 / 1000)}s`;
@@ -5914,17 +6049,18 @@ function oneLine(value) {
   return value.replace(/\s*[\r\n\t]+\s*/g, " ");
 }
 var MAX_CELL_WIDTH = 60;
-function clampCell(value) {
-  if (visibleWidth(value) <= MAX_CELL_WIDTH || value !== value.replace(ANSI_PATTERN, "")) {
+var MAX_RECORD_WIDTH = 160;
+function clamp(value, width) {
+  if (visibleWidth(value) <= width || value !== value.replace(ANSI_PATTERN, "")) {
     return value;
   }
-  return `${value.slice(0, MAX_CELL_WIDTH - 1)}…`;
+  return `${value.slice(0, width - 1)}…`;
 }
 function renderTable(rows, columns) {
   if (rows.length === 0)
     return source_default.dim("No results.");
   const headers = columns.map((column) => sanitize(column.header));
-  const cells = rows.map((row) => columns.map((column) => clampCell(oneLine(column.value(row)))));
+  const cells = rows.map((row) => columns.map((column) => clamp(oneLine(column.value(row)), MAX_CELL_WIDTH)));
   const widths = columns.map((_column, index) => Math.max(visibleWidth(headers[index]), ...cells.map((line) => visibleWidth(line[index]))));
   const header = headers.map((label, index) => source_default.dim(pad(label.toUpperCase(), widths[index]))).join("  ").trimEnd();
   const body = cells.map((line) => line.map((cell, index) => pad(cell, widths[index])).join("  ").trimEnd());
@@ -5970,13 +6106,10 @@ function printRecord(format, fields, raw) {
   }
   const width = Math.max(...safeFields.map(([label]) => visibleWidth(label)));
   for (const [label, value] of safeFields) {
-    console.log(`${source_default.dim(pad(`${label}:`, width + 1))}  ${oneLine(value)}`);
+    console.log(`${source_default.dim(pad(`${label}:`, width + 1))}  ${clamp(oneLine(value), MAX_RECORD_WIDTH)}`);
   }
 }
 
-// src/program.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-
 // ../../node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
@@ -6009,6 +6142,8 @@ function sleep(ms) {
 var PAIRING_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
 var POLL_INTERVAL_MS = 2000;
 var POLL_TIMEOUT_MS = 15 * 60 * 1000;
+var APPROVAL_PATH = "/cli/auth";
+var POLL_PATH = "/api/cli/auth/poll";
 var RETRYABLE_POLL_STATUSES = new Set([409, 429, 500, 502, 503, 504]);
 function token() {
   return randomBytes(32).toString("base64url");
@@ -6027,14 +6162,30 @@ function createAuthRequest() {
   };
 }
 function buildApprovalUrl(endpoint, auth, scope, workspaceId) {
-  const url = new URL("/cli/auth", endpoint);
-  url.searchParams.set("request", auth.request);
-  url.searchParams.set("challenge", auth.challenge);
-  url.searchParams.set("pairing", auth.pairing);
-  url.searchParams.set("scope", scope);
-  if (workspaceId)
-    url.searchParams.set("workspace", workspaceId);
-  return url.toString();
+  return buildUrl(endpoint, APPROVAL_PATH, {
+    request: auth.request,
+    challenge: auth.challenge,
+    pairing: auth.pairing,
+    scope,
+    workspace: workspaceId
+  });
+}
+function toRedirectError(endpoint, response) {
+  const location = response.headers.get("location")?.trim();
+  let target = null;
+  if (location) {
+    try {
+      target = new URL(location, endpoint);
+    } catch {
+      target = null;
+    }
+  }
+  if (!target) {
+    return new SimApiError(`${endpoint} answered the login poll with HTTP ${response.status} and no usable redirect target. Check the endpoint.`, response.status);
+  }
+  const refusal = `${endpoint} redirected the login poll to ${target.href}. The CLI does not follow redirects, because a redirect drops the request body and would carry the login secret to another origin.`;
+  const suggested = redirectEndpoint(endpoint, POLL_PATH, target);
+  return new SimApiError(suggested ? `${refusal} Re-run with --endpoint ${suggested}, or run: sim configure --set-endpoint ${suggested}` : refusal, response.status);
 }
 async function pollForKey(endpoint, auth, signal) {
   const deadline = Date.now() + POLL_TIMEOUT_MS;
@@ -6043,16 +6194,23 @@ async function pollForKey(endpoint, auth, signal) {
       throw new SimApiError("Login cancelled.", 0);
     let response = null;
     try {
-      response = await fetch(new URL("/api/cli/auth/poll", endpoint), {
+      response = await fetch(buildUrl(endpoint, POLL_PATH), {
         method: "POST",
-        headers: { "content-type": "application/json", accept: "application/json" },
+        headers: {
+          "content-type": "application/json",
+          accept: "application/json",
+          "user-agent": USER_AGENT
+        },
         body: JSON.stringify({ request: auth.request, verifier: auth.pollSecret }),
-        signal
+        signal,
+        redirect: "manual"
       });
     } catch {
       response = null;
     }
     if (response) {
+      if (REDIRECT_STATUSES.has(response.status))
+        throw toRedirectError(endpoint, response);
       const raw = await response.text();
       if (!response.ok) {
         if (!RETRYABLE_POLL_STATUSES.has(response.status)) {
@@ -6106,275 +6264,88 @@ function clientFrom(command) {
   return { client: new SimClient(profile), profile };
 }
 
-// src/commands/auth.ts
-function openBrowser(url) {
-  const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : [process.platform === "darwin" ? "open" : "xdg-open", [url]];
-  try {
-    const child = spawn(command, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {});
-    child.unref();
-  } catch {}
-}
-function presentAuthentication(source) {
-  switch (source) {
-    case "flag":
-      return { authenticated: true, source: "flag" };
-    case "env":
-      return { authenticated: true, source: "env" };
-    case "credentials":
-      return { authenticated: true, source: "credentials" };
-    case "unset":
-      return { authenticated: false, source: "unset" };
-    case "config":
-    case "default":
-      throw new SimApiError(`Unexpected API key source "${source}".`, 0);
-  }
-}
-async function confirmProfileOverwrite(profileName) {
-  if (!process.stdin.isTTY) {
-    throw new SimApiError(`Profile "${profileName}" already exists. Re-run with --yes to overwrite it.`, 0);
-  }
-  const prompt = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await prompt.question(`Profile "${profileName}" already exists. Replace its API key and login defaults? (y/N) `);
-    return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
-  } finally {
-    prompt.close();
-  }
-}
-function loginCommand() {
-  return new Command("login").description("Authorize this terminal and store an API key for the profile").option("--scope <scope>", "Key space to mint from: platform or copilot", "platform").option("--no-browser", "Print the URL instead of opening a browser").option("-y, --yes", "Overwrite an existing profile without prompting").action(async (options, command) => {
-    const profile = profileFrom(command);
-    if (options.scope !== "platform" && options.scope !== "copilot") {
-      throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
-    }
-    const scope = options.scope;
-    if (readCredentialsProfile(profile.name).api_key && !options.yes) {
-      const confirmed = await confirmProfileOverwrite(profile.name);
-      if (!confirmed) {
-        console.log(source_default.dim("Login cancelled; the existing profile was not changed."));
-        return;
+// src/generated/v2-api.ts
+var V2_OPERATIONS = {
+  abortFileUpload: {
+    method: "DELETE",
+    path: "/api/v2/files/uploads/[uploadId]",
+    pathParams: ["uploadId"],
+    pathParamDocs: { uploadId: "Upload session identifier." },
+    responseMode: "json",
+    summary: "Abort File Upload",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the upload session."
       }
     }
-    const auth = createAuthRequest();
-    const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
-    console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(profile.name)}`);
-    console.log(`
-Pairing code: ${source_default.bold(auth.pairing)}`);
-    console.log(source_default.dim(`Confirm this code matches what the browser shows before approving.
-`));
-    console.log(url);
-    if (options.browser)
-      openBrowser(url);
-    console.log(source_default.dim(`
-Waiting for approval…`));
-    const key = await pollForKey(profile.endpoint, auth);
-    if (key.scope !== scope) {
-      throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
+  },
+  abortKnowledgeDocumentUpload: {
+    method: "DELETE",
+    path: "/api/v2/knowledge/[id]/documents/uploads/[uploadId]",
+    pathParams: ["id", "uploadId"],
+    pathParamDocs: {
+      id: "Unique knowledge base identifier.",
+      uploadId: "Upload session identifier returned when the upload was created."
+    },
+    responseMode: "json",
+    summary: "Abort Document Upload",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      }
     }
-    writeCredentialsProfile(profile.name, key.apiKey);
-    const settings = {
-      endpoint: profile.endpoint,
-      workspace: key.workspaceId ?? null
-    };
-    writeConfigProfile(profile.name, settings);
-    console.log(source_default.green(`
-✓ Logged in. Key stored in ${credentialsPath()}`));
-    if (key.workspaceBound && key.workspaceId) {
-      console.log(source_default.dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
-    } else if (key.workspaceId) {
-      console.log(source_default.dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
-    } else {
-      console.log(source_default.dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
+  },
+  addTableColumn: {
+    method: "POST",
+    path: "/api/v2/tables/[tableId]/columns",
+    pathParams: ["tableId"],
+    pathParamDocs: { tableId: "Unique table identifier." },
+    responseMode: "json",
+    summary: "Add Column",
+    body: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." },
+      column: { kind: "object", required: true, describe: "Column definition to add." }
     }
-  });
-}
-function logoutCommand() {
-  return new Command("logout").description("Remove the profile's stored API key").option("--all", "Remove the profile entirely, including its settings").action((options, command) => {
-    const profile = profileFrom(command);
-    if (options.all) {
-      const removed = deleteProfile(profile.name);
-      if (!removed.config && !removed.credentials) {
-        console.log(source_default.dim(`Nothing stored for profile "${profile.name}".`));
-        return;
+  },
+  addWorkflowGroup: {
+    method: "POST",
+    path: "/api/v2/tables/[tableId]/groups",
+    pathParams: ["tableId"],
+    pathParamDocs: { tableId: "Unique table identifier." },
+    responseMode: "json",
+    summary: "Add Workflow Group",
+    body: {
+      workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
+      group: {
+        kind: "object",
+        required: true,
+        describe: "Workflow or enrichment producer definition."
+      },
+      outputColumns: {
+        kind: "array",
+        required: true,
+        describe: "Columns created for producer outputs."
+      },
+      autoRun: {
+        kind: "boolean",
+        default: false,
+        describe: "Whether to schedule existing rows after group creation."
       }
-      console.log(source_default.green(`✓ Removed profile "${profile.name}".`));
-      return;
     }
-    if (!readCredentialsProfile(profile.name).api_key) {
-      console.log(source_default.dim(`No stored key for profile "${profile.name}".`));
-      return;
-    }
-    writeCredentialsProfile(profile.name, null);
-    console.log(source_default.green(`✓ Removed the stored key for profile "${profile.name}".`));
-    console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
-  });
-}
-function whoamiCommand() {
-  return new Command("whoami").description("Show the resolved profile and where each setting came from").action((_options, command) => {
-    const profile = profileFrom(command);
-    const { sources } = profile;
-    const authentication = presentAuthentication(sources.apiKey);
-    const annotate = (value, source) => source === "unset" ? source_default.dim("not set") : `${value} ${source_default.dim(`(${source})`)}`;
-    printRecord(profile.output, [
-      ["Profile", profile.name],
-      ["Endpoint", annotate(profile.endpoint, sources.endpoint)],
-      [
-        "API key",
-        authentication.authenticated ? annotate("configured", authentication.source) : source_default.yellow("not logged in")
-      ],
-      ["Workspace", annotate(profile.workspaceId ?? "", sources.workspaceId)],
-      ["Output", annotate(profile.output, sources.output)]
-    ], {
-      profile: profile.name,
-      endpoint: profile.endpoint,
-      workspaceId: profile.workspaceId,
-      output: profile.output,
-      authenticated: authentication.authenticated,
-      sources: {
-        endpoint: sources.endpoint,
-        authentication: authentication.source,
-        workspaceId: sources.workspaceId,
-        output: sources.output
-      }
-    });
-  });
-}
-function profilesCommand() {
-  return new Command("profiles").alias("profile").description("List the profiles defined in the config and credentials files").action((_options, command) => {
-    const profiles = listProfiles();
-    if (profiles.length === 0) {
-      console.log(source_default.dim("No profiles yet. Run: sim login"));
-      return;
-    }
-    const active = profileFrom(command).name;
-    for (const name of profiles) {
-      const marker = name === active ? source_default.green("*") : " ";
-      const hasKey = Boolean(readCredentialsProfile(name).api_key);
-      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}`);
-    }
-  });
-}
-
-// src/commands/configure.ts
-function configureCommand() {
-  return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
-    const profile = profileFrom(command);
-    const updates = {};
-    if (options.setEndpoint)
-      updates.endpoint = options.setEndpoint.replace(/\/+$/, "");
-    if (options.setWorkspace)
-      updates.workspace = options.setWorkspace;
-    if (options.setOutput) {
-      if (!OUTPUT_FORMATS.includes(options.setOutput)) {
-        throw new SimApiError(`Unknown output format "${options.setOutput}". Use one of: ${OUTPUT_FORMATS.join(", ")}`, 0);
-      }
-      updates.output = options.setOutput;
-    }
-    for (const key of options.unset ?? []) {
-      if (!["endpoint", "workspace", "output"].includes(key)) {
-        throw new SimApiError(`Cannot unset "${key}". Use endpoint, workspace, or output.`, 0);
-      }
-      updates[key] = null;
-    }
-    if (Object.keys(updates).length === 0) {
-      const current = readConfigProfile(profile.name);
-      if (Object.keys(current).length === 0) {
-        console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
-        return;
-      }
-      for (const [key, value] of Object.entries(current)) {
-        console.log(`${source_default.dim(`${key}:`)} ${value}`);
-      }
-      return;
-    }
-    writeConfigProfile(profile.name, updates);
-    console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
-  });
-}
-
-// src/generated/v2-api.ts
-var V2_OPERATIONS = {
-  abortFileUpload: {
-    method: "DELETE",
-    path: "/api/v2/files/uploads/[uploadId]",
-    pathParams: ["uploadId"],
-    pathParamDocs: { uploadId: "Upload session identifier." },
-    responseMode: "json",
-    summary: "Abort File Upload",
-    query: {
-      workspaceId: {
-        kind: "string",
-        required: true,
-        describe: "Workspace that owns the upload session."
-      }
-    }
-  },
-  abortKnowledgeDocumentUpload: {
-    method: "DELETE",
-    path: "/api/v2/knowledge/[id]/documents/uploads/[uploadId]",
-    pathParams: ["id", "uploadId"],
-    pathParamDocs: {
-      id: "Unique knowledge base identifier.",
-      uploadId: "Upload session identifier returned when the upload was created."
-    },
-    responseMode: "json",
-    summary: "Abort Document Upload",
-    query: {
-      workspaceId: {
-        kind: "string",
-        required: true,
-        describe: "Workspace that owns the knowledge base."
-      }
-    }
-  },
-  addTableColumn: {
-    method: "POST",
-    path: "/api/v2/tables/[tableId]/columns",
-    pathParams: ["tableId"],
-    pathParamDocs: { tableId: "Unique table identifier." },
-    responseMode: "json",
-    summary: "Add Column",
-    body: {
-      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." },
-      column: { kind: "object", required: true, describe: "Column definition to add." }
-    }
-  },
-  addWorkflowGroup: {
-    method: "POST",
-    path: "/api/v2/tables/[tableId]/groups",
-    pathParams: ["tableId"],
-    pathParamDocs: { tableId: "Unique table identifier." },
-    responseMode: "json",
-    summary: "Add Workflow Group",
-    body: {
-      workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
-      group: {
-        kind: "object",
-        required: true,
-        describe: "Workflow or enrichment producer definition."
-      },
-      outputColumns: {
-        kind: "array",
-        required: true,
-        describe: "Columns created for producer outputs."
-      },
-      autoRun: {
-        kind: "boolean",
-        default: false,
-        describe: "Whether to schedule existing rows after group creation."
-      }
-    }
-  },
-  bulkDeleteFiles: {
-    method: "POST",
-    path: "/api/v2/files/bulk-delete",
-    pathParams: [],
-    responseMode: "json",
-    summary: "Delete Files",
-    body: {
-      workspaceId: { kind: "string", required: true, describe: "Workspace containing the files." },
-      fileIds: { kind: "array", required: true, describe: "File identifiers to update." }
+  },
+  bulkDeleteFiles: {
+    method: "POST",
+    path: "/api/v2/files/bulk-delete",
+    pathParams: [],
+    responseMode: "json",
+    summary: "Delete Files",
+    body: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace containing the files." },
+      fileIds: { kind: "array", required: true, describe: "File identifiers to update." }
     }
   },
   bulkUpdateKnowledgeDocuments: {
@@ -8968,6 +8939,10 @@ var V2_OPERATIONS = {
         kind: "string",
         required: true,
         describe: "Write-only secret value. It is never returned."
+      },
+      description: {
+        kind: "string",
+        describe: "What the secret is for, shown to teammates. Workspace scope only — sending it for a personal secret is rejected. Omit it to leave an existing description untouched; send null or an empty string to clear one."
       }
     }
   },
@@ -9380,8 +9355,263 @@ var V2_OPERATIONS = {
   }
 };
 
+// src/commands/auth.ts
+function openBrowser(url) {
+  const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : [process.platform === "darwin" ? "open" : "xdg-open", [url]];
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+function presentAuthentication(source) {
+  switch (source) {
+    case "flag":
+      return { authenticated: true, source: "flag" };
+    case "env":
+      return { authenticated: true, source: "env" };
+    case "credentials":
+      return { authenticated: true, source: "credentials" };
+    case "unset":
+      return { authenticated: false, source: "unset" };
+    case "config":
+    case "default":
+      throw new SimApiError(`Unexpected API key source "${source}".`, 0);
+  }
+}
+async function confirmProfileOverwrite(profileName) {
+  if (!process.stdin.isTTY) {
+    throw new SimApiError(`Profile "${profileName}" already exists. Re-run with --yes to overwrite it.`, 0);
+  }
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await prompt.question(`Profile "${profileName}" already exists. Replace its API key and login defaults? (y/N) `);
+    return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+  } finally {
+    prompt.close();
+  }
+}
+function loginCommand() {
+  return new Command("login").description("Authorize this terminal and store an API key for the profile").option("--scope <scope>", "Key space to mint from: platform or copilot", "platform").option("--no-browser", "Print the URL instead of opening a browser").option("-y, --yes", "Overwrite an existing profile without prompting").action(async (options, command) => {
+    const profile = profileFrom(command);
+    if (options.scope !== "platform" && options.scope !== "copilot") {
+      throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
+    }
+    const scope = options.scope;
+    if (readCredentialsProfile(profile.name).api_key && !options.yes) {
+      const confirmed = await confirmProfileOverwrite(profile.name);
+      if (!confirmed) {
+        console.log(source_default.dim("Login cancelled; the existing profile was not changed."));
+        return;
+      }
+    }
+    const auth = createAuthRequest();
+    const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
+    console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(profile.name)}`);
+    console.log(`
+Pairing code: ${source_default.bold(auth.pairing)}`);
+    console.log(source_default.dim(`Confirm this code matches what the browser shows before approving.
+`));
+    console.log(url);
+    if (options.browser)
+      openBrowser(url);
+    console.log(source_default.dim(`
+Waiting for approval…`));
+    const key = await pollForKey(profile.endpoint, auth);
+    if (key.scope !== scope) {
+      throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
+    }
+    writeCredentialsProfile(profile.name, key.apiKey);
+    const settings = {
+      endpoint: profile.endpoint,
+      workspace: key.workspaceId ?? null
+    };
+    writeConfigProfile(profile.name, settings);
+    console.log(source_default.green(`
+✓ Logged in. Key stored in ${credentialsPath()}`));
+    if (key.workspaceBound && key.workspaceId) {
+      console.log(source_default.dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
+    } else if (key.workspaceId) {
+      console.log(source_default.dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
+    } else {
+      console.log(source_default.dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
+    }
+  });
+}
+function logoutCommand() {
+  return new Command("logout").description("Remove the profile's stored API key").option("--all", "Remove the profile entirely, including its settings").action((options, command) => {
+    const profile = profileFrom(command);
+    if (options.all) {
+      const removed = deleteProfile(profile.name);
+      if (!removed.config && !removed.credentials) {
+        console.log(source_default.dim(`Nothing stored for profile "${profile.name}".`));
+        return;
+      }
+      console.log(source_default.green(`✓ Removed profile "${profile.name}".`));
+      return;
+    }
+    if (!readCredentialsProfile(profile.name).api_key) {
+      console.log(source_default.dim(`No stored key for profile "${profile.name}".`));
+      return;
+    }
+    writeCredentialsProfile(profile.name, null);
+    console.log(source_default.green(`✓ Removed the stored key for profile "${profile.name}".`));
+    console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
+  });
+}
+var CREDENTIAL_VERDICT_STATUSES = new Set([401, 403, 404]);
+var WHOAMI_EXIT_CODES = {
+  verified: 0,
+  disabled: 0,
+  unauthenticated: 1,
+  rejected: 1,
+  unreachable: 2,
+  "no-workspace": 2
+};
+async function verifyProfile(client, profile) {
+  if (!profile.apiKey) {
+    return {
+      status: "unauthenticated",
+      workspace: null,
+      detail: `no API key — run: sim login --profile ${profile.name}`
+    };
+  }
+  if (!profile.workspaceId) {
+    return {
+      status: "no-workspace",
+      workspace: null,
+      detail: `no workspace to check against — run: sim configure --profile ${profile.name} --set-workspace <id>`
+    };
+  }
+  const operation = V2_OPERATIONS.getWorkspace;
+  try {
+    const response = await client.request(resolvePath(operation.path, { workspaceId: profile.workspaceId }), { method: operation.method });
+    const { id, name, memberCount } = response.data;
+    return { status: "verified", workspace: { id, name, memberCount }, detail: null };
+  } catch (error) {
+    if (!(error instanceof SimApiError))
+      throw error;
+    return {
+      status: CREDENTIAL_VERDICT_STATUSES.has(error.status) ? "rejected" : "unreachable",
+      workspace: null,
+      detail: error.message
+    };
+  }
+}
+function presentVerification(verification) {
+  if (verification.status === "verified") {
+    const { name, memberCount } = verification.workspace;
+    const members = `${memberCount} ${memberCount === 1 ? "member" : "members"}`;
+    return `${source_default.green("✓")} ${safeOneLine(name)} · ${members}`;
+  }
+  const detail = safeOneLine(verification.detail);
+  switch (verification.status) {
+    case "rejected":
+      return `${source_default.red("✗")} ${detail}`;
+    case "unauthenticated":
+      return source_default.yellow(`not logged in — ${detail}`);
+    case "disabled":
+      return source_default.dim(detail);
+    default:
+      return source_default.yellow(`could not check — ${detail}`);
+  }
+}
+function whoamiCommand() {
+  return new Command("whoami").description("Show the resolved profile, where each setting came from, and whether it works").option("--no-verify", "Skip the API check and only print the resolved settings").action(async (options, command) => {
+    const { client, profile } = clientFrom(command);
+    const { sources } = profile;
+    const authentication = presentAuthentication(sources.apiKey);
+    const verification = options.verify ? await verifyProfile(client, profile) : { status: "disabled", workspace: null, detail: "not checked (--no-verify)" };
+    const annotate = (value, source) => source === "unset" ? source_default.dim("not set") : `${value} ${source_default.dim(`(${source})`)}`;
+    printRecord(profile.output, [
+      ["Profile", profile.name],
+      ["Endpoint", annotate(profile.endpoint, sources.endpoint)],
+      [
+        "API key",
+        authentication.authenticated ? annotate("configured", authentication.source) : source_default.yellow("not logged in")
+      ],
+      ["Workspace", annotate(profile.workspaceId ?? "", sources.workspaceId)],
+      ["Output", annotate(profile.output, sources.output)],
+      ["Verified", presentVerification(verification)]
+    ], {
+      profile: profile.name,
+      endpoint: profile.endpoint,
+      workspaceId: profile.workspaceId,
+      output: profile.output,
+      authenticated: authentication.authenticated,
+      sources: {
+        endpoint: sources.endpoint,
+        authentication: authentication.source,
+        workspaceId: sources.workspaceId,
+        output: sources.output
+      },
+      verification: {
+        status: verification.status,
+        workspace: verification.workspace,
+        detail: verification.detail
+      }
+    });
+    const exitCode = WHOAMI_EXIT_CODES[verification.status];
+    if (exitCode !== 0)
+      process.exitCode = exitCode;
+  });
+}
+function profilesCommand() {
+  return new Command("profiles").alias("profile").description("List the profiles defined in the config and credentials files").action((_options, command) => {
+    const profiles = listProfiles();
+    if (profiles.length === 0) {
+      console.log(source_default.dim("No profiles yet. Run: sim login"));
+      return;
+    }
+    const active = profileFrom(command).name;
+    for (const name of profiles) {
+      const marker = name === active ? source_default.green("*") : " ";
+      const hasKey = Boolean(readCredentialsProfile(name).api_key);
+      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}`);
+    }
+  });
+}
+
+// src/commands/configure.ts
+function configureCommand() {
+  return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
+    const profile = profileFrom(command);
+    const updates = {};
+    if (options.setEndpoint) {
+      updates.endpoint = normalizeEndpoint(options.setEndpoint, "--set-endpoint");
+    }
+    if (options.setWorkspace)
+      updates.workspace = options.setWorkspace;
+    if (options.setOutput) {
+      if (!OUTPUT_FORMATS.includes(options.setOutput)) {
+        throw new SimApiError(`Unknown output format "${options.setOutput}". Use one of: ${OUTPUT_FORMATS.join(", ")}`, 0);
+      }
+      updates.output = options.setOutput;
+    }
+    for (const key of options.unset ?? []) {
+      if (!["endpoint", "workspace", "output"].includes(key)) {
+        throw new SimApiError(`Cannot unset "${key}". Use endpoint, workspace, or output.`, 0);
+      }
+      updates[key] = null;
+    }
+    if (Object.keys(updates).length === 0) {
+      const current = readConfigProfile(profile.name);
+      if (Object.keys(current).length === 0) {
+        console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+        return;
+      }
+      for (const [key, value] of Object.entries(current)) {
+        console.log(`${source_default.dim(`${key}:`)} ${value}`);
+      }
+      return;
+    }
+    writeConfigProfile(profile.name, updates);
+    console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
+  });
+}
+
 // src/runtime/request.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readSync } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, readSync } from "node:fs";
 
 // src/contract/commands.ts
 var TABLE_NAME_HELP = "Identifier: letters, numbers, and underscores; cannot start with a number";
@@ -9389,7 +9619,8 @@ var TABLE_FILTER_HELP = 'Predicate: {"all":[{"field":"status","op":"eq","value":
 var TABLE_SORT_HELP = 'Ordered sort keys: [{"field":"createdAt","direction":"desc"}] (direction: asc or desc)';
 var CUSTOM_TOOL_SCHEMA_HELP = 'OpenAI function schema: {"type":"function","function":{"name":"...","parameters":{"type":"object","properties":{}}}}';
 var FOLDER_PATH_INPUT = {
-  describe: "Folder path; the leading / is optional"
+  describe: "Folder path as shown in the app; the leading / is optional",
+  folderPath: true
 };
 var FOLDER_PATH_FLAG = {
   ...FOLDER_PATH_INPUT,
@@ -9399,7 +9630,7 @@ var FOLDER_DELETE_FLAGS = {
   path: FOLDER_PATH_INPUT,
   recursive: { boolean: true, describe: "Delete the folder and its descendants" }
 };
-var KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS = { id: "knowledgeBaseId" };
+var KNOWLEDGE_BASE_PATH_ARGUMENT = { id: "knowledgeBaseId" };
 var WORKFLOW_RUN_SCOPE = {
   id: {
     name: "workflow",
@@ -9407,10 +9638,11 @@ var WORKFLOW_RUN_SCOPE = {
     describe: "Workflow ID"
   }
 };
+var FOLDER_COLUMN = { header: "folder", path: "folderPath", format: "folder-path" };
 var FOLDER_LIST_COLUMNS = [
-  { header: "path" },
+  { header: "path", format: "folder-path" },
   { header: "name" },
-  { header: "parent", path: "parentPath" },
+  { header: "parent", path: "parentPath", format: "folder-path" },
   { header: "updated", path: "updatedAt", format: "timestamp" }
 ];
 function moveResource(command, resource) {
@@ -9480,7 +9712,7 @@ var CLI_CONTRACT = {
   bulkUpdateKnowledgeDocuments: {
     command: "knowledge documents batch-update",
     describe: "Enable or disable every matching document",
-    pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS,
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     flags: {
       documentIds: { name: "document", list: true },
       selectAll: { boolean: true, describe: "Apply to every document in the knowledge base" }
@@ -9490,6 +9722,11 @@ var CLI_CONTRACT = {
     command: "workflows undeploy",
     describe: "Take a workflow out of deployment"
   },
+  getWorkflowDeployment: {
+    command: "workflows deployment status",
+    renamedFrom: ["workflows deployment list"],
+    describe: "Show a workflow’s current deployment"
+  },
   setSecret: { hidden: true },
   deleteTable: { confirm: "This deletes the table and all of its rows." },
   deleteTableRow: { confirm: "This deletes the row." },
@@ -9499,7 +9736,7 @@ var CLI_CONTRACT = {
   },
   deleteKnowledgeBase: { confirm: "This deletes the knowledge base and every document in it." },
   deleteKnowledgeDocument: {
-    pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS,
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     confirm: "This deletes the document and its embeddings."
   },
   deleteFile: { confirm: "This archives the file." },
@@ -9529,7 +9766,10 @@ var CLI_CONTRACT = {
       workflowIds: { name: "workflow", list: true },
       folderPaths: { ...FOLDER_PATH_FLAG, list: true },
       triggers: { name: "trigger", list: true },
-      details: { describe: "Response detail level" },
+      details: {
+        requestDefault: "full",
+        describe: "Response detail level; full is requested by default to name each run’s workflow"
+      },
       includeTraceSpans: {
         boolean: true,
         describe: "Include trace spans in JSON or YAML output (implies full detail)"
@@ -9582,7 +9822,7 @@ var CLI_CONTRACT = {
     },
     itemsPath: "results",
     columns: [
-      { header: "score", path: "similarity" },
+      { header: "score", path: "similarity", format: "score" },
       { header: "document", path: "documentName" },
       { header: "chunk", path: "chunkIndex" },
       { header: "content" }
@@ -9656,7 +9896,7 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "rows", path: "rowCount" },
       { header: "updated", path: "updatedAt", format: "timestamp" }
     ]
@@ -9666,7 +9906,7 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "deployed", path: "isDeployed", format: "bool" },
       { header: "runs", path: "runCount" },
       { header: "last run", path: "lastRunAt", format: "timestamp" }
@@ -9677,7 +9917,7 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "size", format: "bytes" },
       { header: "type" },
       { header: "uploaded by", path: "uploadedByEmail" },
@@ -9690,15 +9930,17 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "docs", path: "docCount" },
       { header: "tokens", path: "tokenCount" },
       { header: "model", path: "embeddingModel" }
     ]
   },
-  getKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS },
+  getKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
+  updateKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
+  listKnowledgeTags: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
   listKnowledgeDocuments: {
-    pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS,
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     columns: [
       { header: "id" },
       { header: "filename" },
@@ -9742,12 +9984,24 @@ var CLI_CONTRACT = {
       { header: "updated", path: "updatedAt", format: "timestamp" }
     ]
   },
+  listCredentialProviders: {
+    columns: [
+      { header: "type" },
+      { header: "service", path: "serviceId" },
+      { header: "provider", path: "providerId" },
+      { header: "name" },
+      { header: "family", path: "providerFamily" },
+      { header: "available", format: "bool" },
+      { header: "description" }
+    ]
+  },
   listSecrets: {
     columns: [
       { header: "name" },
       { header: "scope" },
       { header: "role" },
-      { header: "updated", path: "updatedAt", format: "timestamp" }
+      { header: "updated", path: "updatedAt", format: "timestamp" },
+      { header: "description" }
     ]
   },
   getWorkspace: {
@@ -9813,7 +10067,7 @@ var CLI_CONTRACT = {
       { header: "name" },
       { header: "size", format: "bytes" },
       { header: "type" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "uploaded by", path: "uploadedByEmail" },
       { header: "uploaded", path: "uploadedAt", format: "timestamp" },
       { header: "updated", path: "updatedAt", format: "timestamp" },
@@ -9840,6 +10094,11 @@ var CLI_CONTRACT = {
     command: "files rename",
     describe: "Rename a file"
   },
+  restoreFile: {
+    command: "files restore",
+    renamedFrom: ["files restore create"],
+    describe: "Restore an archived file"
+  },
   updateFileContent: {
     command: "files set-content",
     describe: "Replace a file’s contents",
@@ -9992,13 +10251,26 @@ var CLI_CONTRACT = {
     command: "tables rows find",
     describe: "Find rows matching a predicate",
     flags: {
-      q: { describe: "Value to find" },
+      q: { name: "query", renamedFrom: ["q"], describe: "Value to find" },
       predicate: { name: "filter", json: true, describe: TABLE_FILTER_HELP },
       sort: { json: true, describe: TABLE_SORT_HELP }
     },
     itemsPath: "matches",
     columns: [{ header: "ordinal" }, { header: "row", path: "rowId" }, { header: "column" }]
   },
+  queryRowsCount: {
+    command: "tables rows count",
+    renamedFrom: ["tables count create"],
+    describe: "Count rows matching a filter",
+    flags: {
+      predicate: {
+        name: "filter",
+        renamedFrom: ["predicate"],
+        json: true,
+        describe: TABLE_FILTER_HELP
+      }
+    }
+  },
   runTableColumn: {
     command: "tables columns run",
     describe: "Run a column’s workflow",
@@ -10216,7 +10488,7 @@ function readArgumentSource(raw, flagName) {
     }
   }
   try {
-    return { text: readFileSync2(path, "utf8"), from: ` (read from ${path})` };
+    return { text: readFileSync3(path, "utf8"), from: ` (read from ${path})` };
   } catch (error) {
     throw new SimApiError(`--${flagName} cannot read ${path}: ${error.message}`, 0);
   }
@@ -10251,6 +10523,26 @@ function readListValues(raw, flagName) {
     return trimmed;
   });
 }
+var PERCENT_ESCAPE = /%[0-9A-Fa-f]{2}/;
+var SUB_DELIMITERS = /[!'()*]/g;
+function encodeFolderPathSegment(name) {
+  if (name === ".")
+    return "%2E";
+  if (name === "..")
+    return "%2E%2E";
+  return encodeURIComponent(name).replace(SUB_DELIMITERS, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function encodeFolderPath(value) {
+  return value.split("/").map((segment) => {
+    if (!PERCENT_ESCAPE.test(segment))
+      return encodeFolderPathSegment(segment);
+    try {
+      return encodeFolderPathSegment(decodeURIComponent(segment));
+    } catch {
+      return encodeFolderPathSegment(segment);
+    }
+  }).join("/");
+}
 function pathHint(raw) {
   if (raw.startsWith("@") || /^\s*[[{"\-\d]|^\s*(true|false|null)/.test(raw))
     return "";
@@ -10260,7 +10552,7 @@ function coerce(raw, field, flag, flagName) {
   if (raw === undefined)
     return;
   if (flag.list) {
-    const values = readListValues(raw, flagName);
+    const values = readListValues(raw, flagName).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
     return field.kind === "string" ? values.join(",") : values;
   }
   if (takesJson(field, flag)) {
@@ -10285,6 +10577,8 @@ function coerce(raw, field, flag, flagName) {
   if (choices && !choices.includes(String(raw))) {
     throw new SimApiError(`--${flagName} must be one of: ${choices.join(", ")}`, 0);
   }
+  if (flag.folderPath && typeof raw === "string")
+    return encodeFolderPath(raw);
   return raw;
 }
 function asQueryValue(value) {
@@ -10325,7 +10619,8 @@ function buildRequest(operation, positional, flags, workspaceId) {
         continue;
       const flagName = flagNameFor(operation, field);
       const omitProfileWorkspace = commandSpec.allWorkspaces && flags.allWorkspaces === true;
-      const raw = field === PROFILE_INJECTED_FIELD ? omitProfileWorkspace ? undefined : workspaceId : flags[camel(flagName)];
+      const provided = field === PROFILE_INJECTED_FIELD ? omitProfileWorkspace ? undefined : workspaceId : flags[camel(flagName)];
+      const raw = provided ?? flag.requestDefault;
       const value = coerce(raw ?? undefined, descriptor, flag, flagName);
       if (value === undefined) {
         if (descriptor.required) {
@@ -10498,6 +10793,15 @@ function countTraceSpans(value) {
 function at(row, path) {
   return path.split(".").reduce((value, key) => value && typeof value === "object" ? value[key] : undefined, row);
 }
+function decodeFolderPath(value) {
+  return value.split("/").map((segment) => {
+    try {
+      return decodeURIComponent(segment);
+    } catch {
+      return segment;
+    }
+  }).join("/");
+}
 function renderCell(value, format, options = {}) {
   switch (format) {
     case "timestamp":
@@ -10510,8 +10814,12 @@ function renderCell(value, format, options = {}) {
       return bool2(value);
     case "cost":
       return typeof value === "number" ? `$${value.toFixed(4)}` : text(null);
+    case "score":
+      return typeof value === "number" ? value.toFixed(4) : text(null);
     case "count":
       return Array.isArray(value) ? String(value.length) : text(null);
+    case "folder-path":
+      return typeof value === "string" ? text(decodeFolderPath(value)) : text(value);
     case "trace-count": {
       const count = countTraceSpans(value);
       return `${count} ${count === 1 ? "span" : "spans"}${options.expandedTrace ? "" : " (use --trace)"}`;
@@ -10522,10 +10830,42 @@ function renderCell(value, format, options = {}) {
       return sanitize(typeof value === "object" ? JSON.stringify(value) : String(value));
   }
 }
-var NESTED_CELL_WIDTH = 160;
-function recordCell(value) {
-  const rendered = renderCell(value, "auto");
-  return rendered.length > NESTED_CELL_WIDTH ? `${rendered.slice(0, NESTED_CELL_WIDTH)}…` : rendered;
+var TIMESTAMP_KEY = /(?:At|Date)$/;
+var DURATION_KEY = /Ms$|^duration/;
+var BYTES_KEY = /^size$|(?:Size|Bytes)$/;
+var BOOL_KEY = /^(?:is|has)[A-Z]/;
+var RATIO_KEY = /^(?:similarity|score)$|(?:Similarity|Score)$/;
+var FOLDER_PATH_KEY = /^(?:path|parentPath|folderPath)$/;
+var ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}/;
+var RATIO_PRECISION = 4;
+function inferFormat(key, value) {
+  if (typeof value === "boolean")
+    return BOOL_KEY.test(key) ? "bool" : null;
+  if (typeof value === "string") {
+    if (FOLDER_PATH_KEY.test(key))
+      return "folder-path";
+    return TIMESTAMP_KEY.test(key) && ISO_TIMESTAMP.test(value) && !Number.isNaN(Date.parse(value)) ? "timestamp" : null;
+  }
+  if (typeof value !== "number" || !Number.isFinite(value))
+    return null;
+  if (DURATION_KEY.test(key))
+    return "duration";
+  if (BYTES_KEY.test(key))
+    return "bytes";
+  return null;
+}
+function inferredCell(key, value) {
+  if (typeof value === "number" && Number.isFinite(value) && RATIO_KEY.test(key)) {
+    return value.toFixed(RATIO_PRECISION);
+  }
+  return renderCell(value, inferFormat(key, value) ?? "auto");
+}
+function humanizeKey(key) {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim().toLowerCase();
+}
+function inferHeader(key, format) {
+  const trimmed = format === "duration" || format === "bytes" ? key.replace(/(?:Ms|Bytes)$/, "") : format === "bool" ? key.replace(/^is(?=[A-Z])/, "") : key;
+  return humanizeKey(trimmed || key);
 }
 function columnsFrom(specs) {
   return specs.map((spec) => ({
@@ -10534,9 +10874,9 @@ function columnsFrom(specs) {
   }));
 }
 function fieldsFrom(data, specs, options = {}) {
-  return specs.flatMap((spec) => {
+  return specs.map((spec) => {
     const value = at(data, spec.path ?? spec.header);
-    return value === undefined ? [] : [[spec.header, renderCell(value, spec.format, options)]];
+    return [spec.header, value === undefined ? text(null) : renderCell(value, spec.format, options)];
   });
 }
 function inferColumns(rows, expand) {
@@ -10551,7 +10891,7 @@ function inferColumns(rows, expand) {
       if (value !== null && typeof value === "object")
         continue;
       seen.add(key);
-      paths.push({ path: key, header: key });
+      paths.push({ path: key, key, header: inferHeader(key, inferFormat(key, value)), owned: true });
     }
   }
   if (expand) {
@@ -10564,13 +10904,18 @@ function inferColumns(rows, expand) {
         if (nested.has(key))
           continue;
         nested.add(key);
-        paths.push({ path: `${expand}.${key}`, header: seen.has(key) ? `${expand}.${key}` : key });
+        paths.push({
+          path: `${expand}.${key}`,
+          key,
+          header: seen.has(key) ? `${expand}.${key}` : key,
+          owned: false
+        });
       }
     }
   }
-  return paths.map(({ path, header }) => ({
+  return paths.map(({ path, key, header, owned }) => ({
     header: sanitize(header),
-    value: (row) => renderCell(at(row, path), "auto")
+    value: (row) => owned ? inferredCell(key, at(row, path)) : renderCell(at(row, path), "auto")
   }));
 }
 function unwrapResource(data) {
@@ -10603,7 +10948,10 @@ function renderResult(operation, format, raw, spec, options = {}) {
     printList(format, data, spec.columns ? columnsFrom(spec.columns) : inferColumns(data, spec.expand));
     return;
   }
-  const fields = spec.fields ? fieldsFrom(data, spec.fields, options) : data && typeof data === "object" ? Object.entries(data).map(([key, value]) => [key, recordCell(value)]) : [];
+  const fields = spec.fields ? fieldsFrom(data, spec.fields, options) : data && typeof data === "object" ? Object.entries(data).map(([key, value]) => [
+    inferHeader(key, inferFormat(key, value)),
+    inferredCell(key, value)
+  ]) : [];
   printRecord(format, fields, data);
   if (spec.expandedTrace && options.expandedTrace) {
     const traceSpans = at(data, "traceSpans");
@@ -11001,7 +11349,7 @@ async function finishUploadSession(client, workspaceId, session, path) {
 
 // src/commands/protocol/files-upload.ts
 function attachFileUpload(files) {
-  files.command("upload").argument("<path>", "Local file to upload").description("Upload a file to the workspace").option("--folder <path>", "Destination folder path (defaults to /)").option("--name <name>", "Store it under a different name").action(async (path, options, command) => {
+  files.command("upload").argument("<path>", "Local file to upload").description("Upload a file to the workspace").option("--folder <path>", "Folder path as shown in the app; defaults to the root folder").option("--name <name>", "Store it under a different name").action(async (path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     const { name, size } = await localFile(path, options.name);
@@ -11012,7 +11360,7 @@ function attachFileUpload(files) {
         name,
         contentType: contentTypeFor(name),
         size,
-        ...options.folder !== undefined ? { folderPath: options.folder } : {}
+        ...options.folder !== undefined ? { folderPath: encodeFolderPath(options.folder) } : {}
       }
     });
     const { session, uploadToken, transfer } = created.data;
@@ -11114,15 +11462,22 @@ function addFieldOption(command, operation, field, descriptor) {
   const placeholder = takesList ? "<value...>" : wantsJson ? "<json|@file>" : "<value>";
   const choices = flag.choices ?? descriptor.values;
   const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}`;
+  const renamedFrom = flag.renamedFrom ?? [];
   const option = new Option(`${short}--${name} ${placeholder}`, describe);
   if (choices && !takesList)
     option.choices([...choices]);
   if (descriptor.default !== undefined && field !== "limit") {
     option.default(undefined, String(descriptor.default));
   }
-  if (descriptor.required)
+  if (descriptor.required && renamedFrom.length === 0)
     option.makeOptionMandatory();
   command.addOption(option);
+  for (const previous of renamedFrom) {
+    const retired = new Option(`--${previous} ${placeholder}`).hideHelp();
+    if (choices && !takesList)
+      retired.choices([...choices]);
+    command.addOption(retired);
+  }
 }
 function addOperationOptions(command, operation, commandSpec, operationSpec) {
   for (const param of operationSpec.pathParams) {
@@ -11158,7 +11513,7 @@ function addOperationOptions(command, operation, commandSpec, operationSpec) {
     }
   }
   if (commandSpec.confirm) {
-    command.option("-y, --yes", "Skip the confirmation");
+    command.option("-y, --yes", "Confirm this destructive operation (required)");
   }
 }
 
@@ -11166,8 +11521,11 @@ function addOperationOptions(command, operation, commandSpec, operationSpec) {
 var COLUMNS = [
   { header: "kind", value: (entry) => text(entry.kind) },
   { header: "name", value: (entry) => text(entry.name) },
-  { header: "ref", value: (entry) => text(entry.ref) },
-  { header: "folder", value: (entry) => text(entry.folderPath) },
+  {
+    header: "ref",
+    value: (entry) => text(entry.kind === "folder" ? decodeFolderPath(entry.ref) : entry.ref)
+  },
+  { header: "folder", value: (entry) => text(decodeFolderPath(entry.folderPath)) },
   { header: "updated", value: (entry) => timestamp2(entry.updatedAt) }
 ];
 function operationPath(operation) {
@@ -11218,7 +11576,7 @@ function attachResourceDirectoryCommands(group, config) {
       throw new SimApiError("--limit must be a non-negative integer", 0);
     }
     const limit = rawLimit === 0 ? Number.POSITIVE_INFINITY : rawLimit;
-    const folderPath = path ?? "/";
+    const folderPath = encodeFolderPath(path ?? "/");
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     const [folders, resources] = await Promise.all([
@@ -11233,7 +11591,7 @@ function attachResourceDirectoryCommands(group, config) {
     const operation = V2_OPERATIONS[config.createFolder];
     const result = await client.request(operation.path, {
       method: operation.method,
-      body: { workspaceId: client.requireWorkspace(), path }
+      body: { workspaceId: client.requireWorkspace(), path: encodeFolderPath(path) }
     });
     renderResult(config.createFolder, profile.output, result.data ?? result, {});
   });
@@ -11287,7 +11645,7 @@ function validateTargetOptions(options) {
   return intoExisting;
 }
 function attachTableImport(tables) {
-  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
+  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table, as shown in the app").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     if (Boolean(path) === Boolean(options.fileId)) {
@@ -11312,7 +11670,7 @@ function attachTableImport(tables) {
       target = {
         type: "new",
         name,
-        ...options.folder !== undefined ? { folderPath: options.folder } : {}
+        ...options.folder !== undefined ? { folderPath: encodeFolderPath(options.folder) } : {}
       };
     }
     const started = await client.request(V2_OPERATIONS.createTableImport.path, {
@@ -11481,7 +11839,8 @@ var SECRET_RESULT = {
     { header: "name" },
     { header: "scope" },
     { header: "role" },
-    { header: "updated", path: "updatedAt", format: "timestamp" }
+    { header: "updated", path: "updatedAt", format: "timestamp" },
+    { header: "description" }
   ]
 };
 function validateSecretValue(value) {
@@ -11492,7 +11851,16 @@ function validateSecretValue(value) {
   }
   return value;
 }
+function validateDescriptionScope(description, scope) {
+  if (description === undefined)
+    return;
+  if (scope === "personal") {
+    throw new SimApiError("--description is only supported for a workspace secret.", 0);
+  }
+  return description;
+}
 async function setSecret(name, options, command) {
+  const description = validateDescriptionScope(options.description, options.scope);
   const value = validateSecretValue(options.value ?? await promptSecret());
   const { client, profile } = clientFrom(command);
   const operation = V2_OPERATIONS.setSecret;
@@ -11501,7 +11869,8 @@ async function setSecret(name, options, command) {
     body: {
       workspaceId: client.requireWorkspace(),
       scope: options.scope,
-      value
+      value,
+      description
     }
   });
   renderResult("setSecret", profile.output, response.data, SECRET_RESULT);
@@ -11510,7 +11879,24 @@ function attachSecretCommands(program2) {
   const secrets = program2.commands.find((command) => command.name() === "secrets");
   if (!secrets)
     throw new Error("The generated secrets command group is missing");
-  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value>", "Secret value; visible to shell history when supplied directly").action((name, options, command) => setSecret(name, options, command));
+  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value>", "Secret value; visible to shell history when supplied directly").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").action((name, options, command) => setSecret(name, options, command));
+}
+
+// src/runtime/renamed.ts
+var warned = new Set;
+function warn(kind, from, to) {
+  const key = `${kind}:${from}`;
+  if (warned.has(key))
+    return;
+  warned.add(key);
+  process.stderr.write(`warning: ${kind} "${from}" has been renamed to "${to}". The old name still works.
+`);
+}
+function warnRenamedCommand(from, to) {
+  warn("command", `sim ${from}`, `sim ${to}`);
+}
+function warnRenamedFlag(from, to) {
+  warn("flag", `--${from}`, `--${to}`);
 }
 
 // src/runtime/execute.ts
@@ -11521,6 +11907,23 @@ function cursorSlot(operationSpec) {
     return "body";
   return null;
 }
+function foldRenamedFlags(operation, commandSpec, flags) {
+  for (const [field, flag] of Object.entries(commandSpec.flags ?? {})) {
+    if (!flag.renamedFrom?.length)
+      continue;
+    const current = flagNameFor(operation, field);
+    for (const previous of flag.renamedFrom) {
+      const supplied = flags[camel(previous)];
+      if (supplied === undefined)
+        continue;
+      if (flags[camel(current)] !== undefined) {
+        throw new SimApiError(`--${previous} is the former name of --${current}; pass one, not both`, 0);
+      }
+      warnRenamedFlag(previous, current);
+      flags[camel(current)] = supplied;
+    }
+  }
+}
 async function executeOperation(operation, commandSpec, operationSpec, invocation) {
   const host = invocation[invocation.length - 1];
   const inheritedFlags = host.optsWithGlobals();
@@ -11535,6 +11938,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
   for (const [index, field] of (commandSpec.positionals ?? []).entries()) {
     requestFlags[camel(flagNameFor(operation, field))] = invocation[pathPositionalCount + index];
   }
+  foldRenamedFlags(operation, commandSpec, requestFlags);
   if (commandSpec.confirm && !requestFlags.yes) {
     throw new SimApiError(`${commandSpec.confirm} Re-run with --yes to confirm.`, 0);
   }
@@ -11555,16 +11959,23 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
     const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
     const pageLimit = "limit" in (operationSpec[paging] ?? {}) ? { limit: pageSize } : {};
     const rows = [];
+    const progress = pageProgress();
     let cursor = null;
-    do {
-      const page = await client.request(request.path, {
-        method: operationSpec.method,
-        query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
-        body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
-      });
-      rows.push(...page.data);
-      cursor = page.nextCursor;
-    } while (cursor && rows.length < limit);
+    try {
+      do {
+        const page = await client.request(request.path, {
+          method: operationSpec.method,
+          query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
+          body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
+        });
+        rows.push(...page.data);
+        cursor = page.nextCursor;
+        if (cursor && rows.length < limit)
+          progress.advance(rows.length);
+      } while (cursor && rows.length < limit);
+    } finally {
+      progress.finish();
+    }
     renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec);
     return;
   }
@@ -11693,6 +12104,19 @@ function configureOperation(command, operation, spec) {
 function buildLeaf(operation, spec, leafName) {
   return addMissingArgumentExample(configureOperation(new Command(leafName), operation, spec));
 }
+function addRenamedCommand(groups, operation, spec, from, to) {
+  const segments = from.split(" ");
+  const [groupName, ...rest] = segments;
+  if (rest.length === 0)
+    throw new Error(`${operation}.renamedFrom "${from}" must include a verb`);
+  let parent = groupFor(groups, groupName);
+  for (const segment of rest.slice(0, -1)) {
+    parent = nestedGroup(parent, segment, { hidden: true });
+  }
+  const leaf = buildLeaf(operation, spec, rest[rest.length - 1]);
+  leaf.hook("preAction", () => warnRenamedCommand(from, to));
+  parent.addCommand(leaf, { hidden: true });
+}
 function groupFor(groups, name) {
   const existing = groups.get(name);
   if (existing)
@@ -11708,12 +12132,12 @@ function resourceLabel(name) {
   const label = name.endsWith("s") ? name.slice(0, -1) : name;
   return label.replaceAll("-", " ");
 }
-function nestedGroup(parent, name) {
+function nestedGroup(parent, name, options = {}) {
   const existing = parent.commands.find((candidate) => candidate.name() === name);
   if (existing)
     return existing;
   const created = new Command(name).description(`Manage ${resourceLabel(parent.name())} ${name.replaceAll("-", " ")}`);
-  parent.addCommand(created);
+  parent.addCommand(created, { hidden: options.hidden });
   return created;
 }
 function addLeafCommand(groups, operation, spec, segments) {
@@ -11742,6 +12166,7 @@ function variantCommandSpec(spec, variant) {
 }
 function buildGeneratedCommands() {
   const groups = new Map;
+  const renamed = [];
   for (const operation of Object.keys(V2_OPERATIONS)) {
     const spec = CLI_CONTRACT[operation] ?? {};
     const operationSpec = V2_OPERATIONS[operation];
@@ -11764,6 +12189,12 @@ function buildGeneratedCommands() {
     for (const variant of spec.variants ?? []) {
       addLeafCommand(groups, operation, variantCommandSpec(spec, variant), variant.command.split(" "));
     }
+    for (const from of spec.renamedFrom ?? []) {
+      renamed.push({ operation, spec, from, to: segments.join(" ") });
+    }
+  }
+  for (const { operation, spec, from, to } of renamed) {
+    addRenamedCommand(groups, operation, spec, from, to);
   }
   return [...groups.values()].sort((a, b) => a.name().localeCompare(b.name()));
 }
@@ -11772,7 +12203,8 @@ function buildGeneratedCommands() {
 var PROGRAM_DESCRIPTION = "Talk to the Sim API from your terminal";
 var HELP_EPILOGUE = `
 Profiles work like the AWS CLI: settings live in ~/.sim/config, keys in
-~/.sim/credentials (0600). Select one with -P, --profile, or SIM_PROFILE.
+~/.sim/credentials (0600), or under SIM_CONFIG_DIR when it is set. Select one
+with -P, --profile, or SIM_PROFILE.
 
 Examples:
   $ sim login                                    Authorize the default profile
@@ -11786,18 +12218,11 @@ Examples:
   $ sim workflows import --workflow @wf.json
   $ sim whoami --profile dev
 `;
-function readPackageVersion() {
-  const metadata = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8"));
-  if (typeof metadata !== "object" || metadata === null || !("version" in metadata) || typeof metadata.version !== "string") {
-    throw new Error("CLI package metadata is missing a valid version");
-  }
-  return metadata.version;
-}
 function buildProgram(options = {}) {
   const program2 = new Command;
   program2.name("sim").description(PROGRAM_DESCRIPTION);
   if (options.version !== false)
-    program2.version(readPackageVersion());
+    program2.version(CLI_VERSION);
   program2.option("-P, --profile <name>", "Profile to use (env: SIM_PROFILE)").option("--endpoint <url>", "Sim deployment to talk to (env: SIM_ENDPOINT)").option("-w, --workspace <id>", "Workspace to target (env: SIM_WORKSPACE)").addOption(new Option("--output <format>", "Output format for this command").choices([...OUTPUT_FORMATS]));
   program2.addCommand(loginCommand());
   program2.addCommand(logoutCommand());