sim 2.1.1-preview.41.1 → 2.1.1-preview.43.1

package/dist/index.js

@@ -538,7 +538,7 @@ var require_option = __commonJS((exports) => {
 // ../../node_modules/commander/lib/suggestSimilar.js
 var require_suggestSimilar = __commonJS((exports) => {
   var maxDistance = 3;
-  function editDistance(a, b) {
+  function editDistance2(a, b) {
     if (Math.abs(a.length - b.length) > maxDistance)
       return Math.max(a.length, b.length);
     const d = [];
@@ -579,7 +579,7 @@ var require_suggestSimilar = __commonJS((exports) => {
     candidates.forEach((candidate) => {
       if (candidate.length <= 1)
         return;
-      const distance = editDistance(word, candidate);
+      const distance = editDistance2(word, candidate);
       const length = Math.max(word.length, candidate.length);
       const similarity = (length - distance) / length;
       if (similarity > minSimilarity) {
@@ -2320,8 +2320,11 @@ var KV_PATTERN = /^\s*([A-Za-z0-9_.-]+)\s*=\s*(.*?)\s*$/;
 function parseIni(text) {
   const doc = { preamble: [], sections: [] };
   let current = null;
-  for (const line of text.split(`
-`)) {
+  const lines = text.split(`
+`);
+  if (lines.length > 1 && lines[lines.length - 1] === "")
+    lines.pop();
+  for (const line of lines) {
     const sectionMatch = SECTION_PATTERN.exec(line);
     if (sectionMatch) {
       current = { name: sectionMatch[1].trim(), entries: [] };
@@ -2360,13 +2363,15 @@ function serializeIni(doc) {
 ` : "";
 }
 function getSection(doc, name) {
-  const section = doc.sections.find((s) => s.name === name);
-  if (!section)
+  const sections = doc.sections.filter((s) => s.name === name);
+  if (sections.length === 0)
     return null;
   const values = {};
-  for (const entry of section.entries) {
-    if (entry.kind === "kv")
-      values[entry.key] = entry.value;
+  for (const section of sections) {
+    for (const entry of section.entries) {
+      if (entry.kind === "kv" && !Object.hasOwn(values, entry.key))
+        values[entry.key] = entry.value;
+    }
   }
   return values;
 }
@@ -2374,18 +2379,21 @@ function listSections(doc) {
   return doc.sections.map((s) => s.name);
 }
 function setSectionValues(doc, name, values) {
-  let section = doc.sections.find((s) => s.name === name);
+  const matching = doc.sections.filter((s) => s.name === name);
+  let section = matching[0];
   if (!section) {
     section = { name, entries: [] };
     doc.sections.push(section);
+    matching.push(section);
   }
   for (const [key, value] of Object.entries(values)) {
-    const index = section.entries.findIndex((e) => e.kind === "kv" && e.key === key);
     if (value === null) {
-      if (index !== -1)
-        section.entries.splice(index, 1);
+      for (const target of matching) {
+        target.entries = target.entries.filter((e) => !(e.kind === "kv" && e.key === key));
+      }
       continue;
     }
+    const index = section.entries.findIndex((e) => e.kind === "kv" && e.key === key);
     if (index === -1) {
       section.entries.push({ kind: "kv", key, value });
     } else {
@@ -2394,10 +2402,10 @@ function setSectionValues(doc, name, values) {
   }
 }
 function removeSection(doc, name) {
-  const index = doc.sections.findIndex((s) => s.name === name);
-  if (index === -1)
+  const remaining = doc.sections.filter((s) => s.name !== name);
+  if (remaining.length === doc.sections.length)
     return false;
-  doc.sections.splice(index, 1);
+  doc.sections = remaining;
   return true;
 }
 
@@ -2472,6 +2480,42 @@ function listProfiles() {
   }
   return [...names].sort();
 }
+function editDistance(a, b) {
+  let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (let i = 1;i <= a.length; i++) {
+    const current = [i];
+    for (let j = 1;j <= b.length; j++) {
+      current[j] = Math.min(previous[j] + 1, current[j - 1] + 1, previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    }
+    previous = current;
+  }
+  return previous[b.length];
+}
+function nearestProfile(name, known) {
+  const lowered = name.toLowerCase();
+  let best = null;
+  let bestDistance = Number.POSITIVE_INFINITY;
+  for (const candidate of known) {
+    const distance = editDistance(lowered, candidate.toLowerCase());
+    if (distance < bestDistance) {
+      best = candidate;
+      bestDistance = distance;
+    }
+  }
+  return bestDistance <= 2 ? best : null;
+}
+function requireKnownProfile(name) {
+  if (name === DEFAULT_PROFILE)
+    return;
+  const known = listProfiles();
+  if (known.includes(name))
+    return;
+  if (known.length === 0) {
+    throw new ProfileConfigError(`Unknown profile "${name}". No profiles are configured yet. Run: sim login --profile ${name}`);
+  }
+  const suggestion = nearestProfile(name, known);
+  throw new ProfileConfigError(`Unknown profile "${name}".${suggestion ? ` Did you mean "${suggestion}"?` : ""} Configured profiles: ${known.join(", ")}.`);
+}
 function listAuthenticationDependents(authProfile) {
   return listProfiles().filter((profile) => profile !== authProfile && readConfigProfile(profile).auth_profile?.trim() === authProfile);
 }
@@ -2517,7 +2561,10 @@ function resolve(candidates, fallback, fallbackSource) {
   return { value: fallback, source: fallbackSource };
 }
 function resolveProfile(overrides = {}) {
-  const name = overrides.profile || process.env.SIM_PROFILE || DEFAULT_PROFILE;
+  const named = overrides.profile || process.env.SIM_PROFILE;
+  const name = named || DEFAULT_PROFILE;
+  if (named && !overrides.allowUnknownProfile)
+    requireKnownProfile(named);
   const config = readConfigProfile(name);
   const authProfile = resolveAuthenticationProfileName(name);
   const authConfig = authProfile === name ? config : readConfigProfile(authProfile);
@@ -6284,6 +6331,7 @@ var POLL_TIMEOUT_MS = 15 * 60 * 1000;
 var APPROVAL_PATH = "/cli/auth";
 var POLL_PATH = "/api/cli/auth/poll";
 var RETRYABLE_POLL_STATUSES = new Set([409, 429, 500, 502, 503, 504]);
+var TRANSPORT_FAILURES_BEFORE_WARNING = 3;
 function token() {
   return randomBytes(32).toString("base64url");
 }
@@ -6328,6 +6376,8 @@ function toRedirectError(endpoint, response) {
 }
 async function pollForKey(endpoint, auth, signal) {
   const deadline = Date.now() + POLL_TIMEOUT_MS;
+  let consecutiveTransportFailures = 0;
+  let warnedAboutTransport = false;
   while (Date.now() < deadline) {
     if (signal?.aborted)
       throw new SimApiError("Login cancelled.", 0);
@@ -6344,10 +6394,17 @@ async function pollForKey(endpoint, auth, signal) {
         signal,
         redirect: "manual"
       });
-    } catch {
+    } catch (cause) {
       response = null;
+      consecutiveTransportFailures++;
+      if (!warnedAboutTransport && consecutiveTransportFailures >= TRANSPORT_FAILURES_BEFORE_WARNING) {
+        warnedAboutTransport = true;
+        process.stderr.write(`Still waiting: ${endpoint} is not answering the login poll (${cause.message}). Check the endpoint; retrying until you approve or the login times out.
+`);
+      }
     }
     if (response) {
+      consecutiveTransportFailures = 0;
       if (REDIRECT_STATUSES.has(response.status))
         throw toRedirectError(endpoint, response);
       const raw = await response.text();
@@ -6418,6 +6475,13 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Workspace that owns the upload session."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        required: true,
+        describe: "Signed upload control token returned when the upload session was created."
+      }
     }
   },
   abortKnowledgeDocumentUpload: {
@@ -6436,6 +6500,13 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Workspace that owns the knowledge base."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        required: true,
+        describe: "Signed upload control token returned when the upload session was created."
+      }
     }
   },
   activateWorkflowVersion: {
@@ -6751,6 +6822,12 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Workspace that owns the transfer resource."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        describe: "Signed upload control token returned when an upload-backed import was created."
+      }
     }
   },
   cancelTableRuns: {
@@ -6818,6 +6895,13 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Workspace that owns the upload session."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        required: true,
+        describe: "Signed upload control token returned when the upload session was created."
+      }
     }
   },
   completeKnowledgeDocumentUpload: {
@@ -6836,6 +6920,13 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Workspace that owns the knowledge base."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        required: true,
+        describe: "Signed upload control token returned when the upload session was created."
+      }
     }
   },
   completeTableImport: {
@@ -6851,6 +6942,13 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Workspace that owns the transfer resource."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        required: true,
+        describe: "Signed upload control token returned when the upload session was created."
+      }
     }
   },
   createCredentialConnection: {
@@ -6991,6 +7089,13 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Multipart part numbers for which signed URLs should be created."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        required: true,
+        describe: "Signed upload control token returned when the upload session was created."
+      }
     }
   },
   createKnowledgeBase: {
@@ -7136,6 +7241,13 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Multipart part numbers for which signed URLs should be created."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        required: true,
+        describe: "Signed upload control token returned when the upload session was created."
+      }
     }
   },
   createKnowledgeFolder: {
@@ -7441,6 +7553,13 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Multipart part numbers for which signed URLs should be created."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        required: true,
+        describe: "Signed upload control token returned when the upload session was created."
+      }
     }
   },
   createTableRows: {
@@ -7540,7 +7659,7 @@ var V2_OPERATIONS = {
     method: "DELETE",
     path: "/api/v2/credentials/[credentialId]",
     pathParams: ["credentialId"],
-    pathParamDocs: { credentialId: "Credential to update or disconnect." },
+    pathParamDocs: { credentialId: "Credential to disconnect." },
     responseMode: "json",
     summary: "Disconnect Credential",
     query: {
@@ -8070,7 +8189,7 @@ var V2_OPERATIONS = {
       },
       selectedOutputs: {
         kind: "array",
-        describe: "Block output references to include in a streamed response. Rejected when `async` is true."
+        describe: "Block output references to include in a streamed response, as `blockId`, `blockId.path`, or `BlockName.path` (resolved against the live workflow). Requires `stream: true` — it shapes the streamed envelope only, so it is rejected on a sync request and when `async` is true. To narrow a finished run, pass `selectedOutputs` to the run resource instead."
       },
       includeThinking: {
         kind: "boolean",
@@ -8090,6 +8209,16 @@ var V2_OPERATIONS = {
         kind: "integer",
         describe: "Maximum total bytes of file content to inline as base64, lowering but never raising the server limit of 16 MiB. Rejected when `async` is true."
       }
+    },
+    headers: {
+      "x-run-id": {
+        kind: "string",
+        describe: 'Caller-supplied run identifier, available only to API-key callers. A one-shot uniqueness claim, NOT an idempotency key: reusing a value fails with `409` and `error.details.code: "RUN_ID_CONFLICT"` rather than replaying the original result. To retry safely, send a fresh value per attempt, or omit the header and let the server allocate one.'
+      },
+      "x-sim-via": {
+        kind: "string",
+        describe: 'Comma-separated workflow identifiers naming the workflow-to-workflow call chain that led to this request. Each hop appends its own workflow id, and Sim sets it automatically; supply it yourself only when relaying an existing chain. A chain at the maximum depth is rejected with `409` and `error.details.code: "CALL_CHAIN_DEPTH_EXCEEDED"`.'
+      }
     }
   },
   exportWorkflow: {
@@ -8110,8 +8239,7 @@ var V2_OPERATIONS = {
     query: {
       organizationId: {
         kind: "string",
-        required: true,
-        describe: "Organization whose audit-log entry should be returned."
+        describe: "Organization whose audit-log entry should be returned. Defaults to the caller's own organization when omitted. A caller that belongs to no organization, or that names one it is not a member of, is refused with a 403."
       }
     }
   },
@@ -8201,6 +8329,13 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Workspace that owns the upload session."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        required: true,
+        describe: "Signed upload control token returned when the upload session was created."
+      }
     }
   },
   getKnowledgeBase: {
@@ -8456,6 +8591,12 @@ var V2_OPERATIONS = {
         required: true,
         describe: "Workspace that owns the transfer resource."
       }
+    },
+    headers: {
+      "upload-token": {
+        kind: "string",
+        describe: "Signed upload control token returned when an upload-backed import was created."
+      }
     }
   },
   getTableRow: {
@@ -8550,7 +8691,7 @@ var V2_OPERATIONS = {
       },
       selectedOutputs: {
         kind: "string",
-        describe: "Comma-separated block output references to include, as `blockId` or `blockId.path`. Block *names* are not resolved here — unlike the execute request, this resource reads a recorded run and matches ids only, so a name selects nothing and yields an empty `blockOutputs`."
+        describe: "Comma-separated block output references to include, as `blockId` or `blockId.path`. Block *names* are not resolved here — unlike the execute request, this resource reads a recorded run and matches ids only, so a selector that is not headed by a block id answers `400` instead of an empty `blockOutputs`."
       },
       includeFileBase64: {
         kind: "boolean",
@@ -8669,8 +8810,7 @@ var V2_OPERATIONS = {
       },
       organizationId: {
         kind: "string",
-        required: true,
-        describe: "Organization whose audit trail should be queried."
+        describe: "Organization whose audit trail should be queried. Defaults to the caller's own organization when omitted. A caller that belongs to no organization, or that names one it is not a member of, is refused with a 403."
       },
       actorEmail: { kind: "string", describe: "Filter by actor email address." }
     }
@@ -8699,7 +8839,7 @@ var V2_OPERATIONS = {
       },
       workspaceId: {
         kind: "string",
-        describe: "Restrict results to one workspace whose payer the caller can inspect."
+        describe: "Narrow the ledger to usage events attributed to one workspace. It does not change whose events are reported — a personal API key always reports the usage of the person holding it, and a workspace API key always reports its own workspace's complete ledger across every member. The response `scope` field says which of the two you received. A workspace API key is pinned to its own workspace: any other id answers `404 Workspace not found`, which is also what an id that does not exist answers."
       },
       period: {
         kind: "enum",
@@ -10648,7 +10788,7 @@ var V2_OPERATIONS = {
     method: "PATCH",
     path: "/api/v2/credentials/[credentialId]",
     pathParams: ["credentialId"],
-    pathParamDocs: { credentialId: "Credential to update or disconnect." },
+    pathParamDocs: { credentialId: "Credential to update." },
     responseMode: "json",
     summary: "Update Credential",
     query: {
@@ -11346,7 +11486,7 @@ function addProfileCommand() {
 }
 function loginCommand() {
   return new Command("login").description("Authorize this terminal and store an API key for the profile").option("--scope <scope>", "Key space to mint from: platform or copilot", "platform").option("--no-browser", "Print the URL instead of opening a browser").option("-y, --yes", "Overwrite an existing profile without prompting").action(async (options, command) => {
-    const profile = profileFrom(command);
+    const profile = profileFrom(command, { allowUnknownProfile: true });
     const authProfile = resolveAuthenticationProfileName(profile.name);
     if (authProfile !== profile.name) {
       throw new SimApiError(`Profile "${profile.name}" shares authentication with "${authProfile}". Run: sim login --profile ${authProfile}`, 0);
@@ -11425,6 +11565,17 @@ function logoutCommand() {
     console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
   });
 }
+async function readKeyType(client) {
+  const operation = V2_OPERATIONS.getMeta;
+  try {
+    const response = await client.request(operation.path, {
+      method: operation.method
+    });
+    return response.data.keyType;
+  } catch {
+    return null;
+  }
+}
 var CREDENTIAL_VERDICT_STATUSES = new Set([401, 403, 404]);
 var WHOAMI_EXIT_CODES = {
   verified: 0,
@@ -11439,13 +11590,16 @@ async function verifyProfile(client, profile) {
     return {
       status: "unauthenticated",
       workspace: null,
+      keyType: null,
       detail: `no API key — run: sim login --profile ${profile.name}`
     };
   }
+  const keyType = await readKeyType(client);
   if (!profile.workspaceId) {
     return {
       status: "no-workspace",
       workspace: null,
+      keyType,
       detail: `no workspace to check against — run: sim configure --profile ${profile.name} --set-workspace <id>`
     };
   }
@@ -11453,13 +11607,14 @@ async function verifyProfile(client, profile) {
   try {
     const response = await client.request(resolvePath(operation.path, { workspaceId: profile.workspaceId }), { method: operation.method });
     const { id, name, memberCount } = response.data;
-    return { status: "verified", workspace: { id, name, memberCount }, detail: null };
+    return { status: "verified", workspace: { id, name, memberCount }, keyType, detail: null };
   } catch (error) {
     if (!(error instanceof SimApiError))
       throw error;
     return {
       status: CREDENTIAL_VERDICT_STATUSES.has(error.status) ? "rejected" : "unreachable",
       workspace: null,
+      keyType,
       detail: error.message
     };
   }
@@ -11487,7 +11642,12 @@ function whoamiCommand() {
     const { client, profile } = clientFrom(command);
     const { sources } = profile;
     const authentication = presentAuthentication(sources.apiKey);
-    const verification = options.verify ? await verifyProfile(client, profile) : { status: "disabled", workspace: null, detail: "not checked (--no-verify)" };
+    const verification = options.verify ? await verifyProfile(client, profile) : {
+      status: "disabled",
+      workspace: null,
+      keyType: null,
+      detail: "not checked (--no-verify)"
+    };
     const annotate = (value, source) => source === "unset" ? source_default.dim("not set") : `${value} ${source_default.dim(`(${source})`)}`;
     printRecord(profile.output, [
       ["Profile", profile.name],
@@ -11496,6 +11656,10 @@ function whoamiCommand() {
         "API key",
         authentication.authenticated ? annotate("configured", authentication.source) : source_default.yellow("not logged in")
       ],
+      [
+        "Key type",
+        verification.keyType ?? source_default.dim(options.verify ? "unknown" : "not checked (--no-verify)")
+      ],
       ["Workspace", annotate(profile.workspaceId ?? "", sources.workspaceId)],
       ["Output", annotate(profile.output, sources.output)],
       ["Verified", presentVerification(verification)]
@@ -11514,6 +11678,7 @@ function whoamiCommand() {
       verification: {
         status: verification.status,
         workspace: verification.workspace,
+        keyType: verification.keyType,
         detail: verification.detail
       }
     });
@@ -11533,7 +11698,15 @@ function profilesCommand() {
     const active = selectedProfileName(actionCommand);
     for (const name of profiles) {
       const marker = name === active ? source_default.green("*") : " ";
-      const authProfile = resolveAuthenticationProfileName(name);
+      let authProfile;
+      try {
+        authProfile = resolveAuthenticationProfileName(name);
+      } catch (error) {
+        if (!(error instanceof ProfileConfigError))
+          throw error;
+        console.log(`${marker} ${name}${source_default.red(`  (${safeOneLine(error.message)})`)}`);
+        continue;
+      }
       const hasKey = Boolean(readCredentialsProfile(authProfile).api_key);
       const authentication = authProfile === name ? "" : source_default.dim(`  (auth: ${authProfile})`);
       console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}${authentication}`);
@@ -11546,11 +11719,19 @@ function profilesCommand() {
 }
 
 // src/commands/configure.ts
+function requireValue(value, flag, key) {
+  if (value !== undefined && value.trim() === "") {
+    throw new SimApiError(`${flag} requires a value. To remove it, run: sim configure --unset ${key}`, 0);
+  }
+}
 function configureCommand() {
   return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
-    const profile = profileFrom(command);
+    const profile = profileFrom(command, { allowUnknownProfile: true });
     const authProfile = resolveAuthenticationProfileName(profile.name);
     const updates = {};
+    requireValue(options.setEndpoint, "--set-endpoint", "endpoint");
+    requireValue(options.setWorkspace, "--set-workspace", "workspace");
+    requireValue(options.setOutput, "--set-output", "output");
     if (options.setEndpoint) {
       if (authProfile !== profile.name) {
         throw new SimApiError(`Profile "${profile.name}" shares its endpoint with authentication profile "${authProfile}". Run: sim configure --profile ${authProfile} --set-endpoint ${options.setEndpoint}`, 0);
@@ -11600,6 +11781,11 @@ var TABLE_READ_FILTER_HELP = 'Condition: {"field":"status","op":"eq","value":"ac
 var TABLE_SORT_HELP = 'Ordered sort keys: [{"field":"createdAt","direction":"desc"}] (direction: asc or desc)';
 var KNOWLEDGE_TAG_DEFINITIONS_HELP = 'Tag definitions: [{"tagSlot":"tag1","displayName":"category","fieldType":"text"}]';
 var CUSTOM_TOOL_SCHEMA_HELP = 'OpenAI function schema: {"type":"function","function":{"name":"...","parameters":{"type":"object","properties":{}}}}';
+var DISPATCH_ROW_LIMIT_HELP = "Stop after this many eligible rows have run (1-1,000,000). Omit for an unbounded run";
+var WORKFLOW_OPERATIONS_HELP = 'Edits to apply, in a single batch, keyed by operation_type: [{"operation_type":"add","block_id":"my-fn","params":{"type":"function","name":"My Fn","inputs":{"code":"return {ok:true}"}}},{"operation_type":"edit","block_id":"<uuid>","params":{"name":"Renamed","connections":{"success":"my-fn"}}},{"operation_type":"delete","block_id":"<uuid>"}]. Also insert_into_subflow and extract_from_subflow, whose params carry {"subflowId":"<loop-id>"}';
+var WORKFLOW_SET_BLOCK_ENABLED_HELP = 'Blocks to enable or disable, applied after --operations: [{"block_id":"<uuid>","enabled":false}]. Disabling a loop or parallel cascades to its unlocked descendants; enabling a block whose container is disabled is declined';
+var WORKFLOW_VARIABLE_OPERATIONS_HELP = 'Variable changes to apply in order, keyed by operation: [{"operation":"add","name":"my_var","type":"string","value":"hello"},{"operation":"edit","name":"my_var","value":"updated"},{"operation":"delete","name":"my_var"}]';
+var MCP_PARAMETER_DESCRIPTIONS_HELP = 'Per-field description overrides applied to the schema generated from the deployed workflow inputs, as [{"name":"email","description":"Customer email address"}]. A name matching no input field is ignored';
 var FOLDER_PATH_INPUT = {
   describe: "Folder path as shown in the app; the leading / is optional",
   folderPath: true
@@ -11613,6 +11799,7 @@ var FOLDER_DELETE_FLAGS = {
   recursive: { boolean: true, describe: "Delete the folder and its descendants" }
 };
 var KNOWLEDGE_BASE_PATH_ARGUMENT = { knowledgeBaseId: "knowledgeBaseId" };
+var TRANSFER_TOKEN_OMITTED = { "upload-token": { omit: true } };
 var WORKFLOW_RUN_SCOPE = {
   workflowId: {
     name: "workflow",
@@ -11653,7 +11840,7 @@ var CLI_CONTRACT = {
   getBillingStatus: {
     command: "billing status",
     allWorkspaces: true,
-    describe: "Show billing status and current-period credit usage",
+    describe: "Show billing status and current-period credit usage (credits and storage require a personal API key)",
     fields: [
       { header: "plan" },
       { header: "status" },
@@ -11662,7 +11849,10 @@ var CLI_CONTRACT = {
       { header: "period end", path: "period.end", format: "timestamp" },
       { header: "used credits", path: "credits.used" },
       { header: "limit credits", path: "credits.limit" },
-      { header: "remaining credits", path: "credits.remaining" }
+      { header: "remaining credits", path: "credits.remaining" },
+      { header: "used storage", path: "storage.usedBytes", format: "bytes" },
+      { header: "limit storage", path: "storage.limitBytes", format: "bytes" },
+      { header: "storage used %", path: "storage.percentUsed" }
     ]
   },
   listBillingLogs: {
@@ -11675,6 +11865,7 @@ var CLI_CONTRACT = {
       startDate: { describe: "Custom period start (ISO 8601)" },
       endDate: { describe: "Custom period end (ISO 8601)" }
     },
+    pageNote: { path: "scope", label: "scope" },
     columns: [
       { header: "at", path: "createdAt", format: "timestamp" },
       { header: "workspace", path: "workspaceId" },
@@ -11719,7 +11910,7 @@ var CLI_CONTRACT = {
     flags: {
       chunkIds: { name: "chunk", list: true }
     },
-    confirm: "This can delete every named chunk and its embedding, and cannot be undone."
+    confirm: "This applies --operation to every named chunk; with --operation delete it deletes them and their embeddings, which cannot be undone."
   },
   createKnowledgeConnector: {
     pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT
@@ -11751,7 +11942,8 @@ var CLI_CONTRACT = {
   },
   undeployWorkflow: {
     command: "workflows undeploy",
-    describe: "Take a workflow out of deployment"
+    describe: "Take a workflow out of deployment",
+    confirm: "This takes the workflow offline for every API and chat consumer, and agents calling its MCP tools lose access until it is deployed again."
   },
   getWorkflowDeployment: {
     command: "workflows deployment status",
@@ -11759,13 +11951,17 @@ var CLI_CONTRACT = {
     describe: "Show a workflow’s current deployment"
   },
   setSecret: { hidden: true },
-  deleteTable: { confirm: "This deletes the table and all of its rows." },
+  deleteTable: {
+    confirm: "This archives the table and all of its rows; restore with `tables restore`."
+  },
   deleteTableRow: { confirm: "This deletes the row." },
   deleteTableColumn: {
     confirm: "This deletes the column and its values in every row.",
     fields: [{ header: "remaining columns", path: "columns", format: "count" }]
   },
-  deleteKnowledgeBase: { confirm: "This deletes the knowledge base and every document in it." },
+  deleteKnowledgeBase: {
+    confirm: "This archives the knowledge base and every document in it; restore with `knowledge restore`."
+  },
   deleteKnowledgeDocument: {
     pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     confirm: "This deletes the document and its embeddings."
@@ -11789,7 +11985,9 @@ var CLI_CONTRACT = {
   deleteSecret: {
     confirm: "This deletes the secret; anything using it may stop working."
   },
-  deleteWorkflow: { confirm: "This deletes the workflow and its run history." },
+  deleteWorkflow: {
+    confirm: "This archives the workflow and its run history; restore with `workflows restore`."
+  },
   deleteTableView: { confirm: "This deletes the saved view and its filters." },
   deleteWorkflowGroup: {
     confirm: "This deletes the group, every column it fed, and the values in them.",
@@ -11854,7 +12052,17 @@ var CLI_CONTRACT = {
   getLogStats: {
     command: "logs stats",
     describe: "Summarize run counts, failures, and cost over a window",
-    flags: LOG_LIST_FILTER_FLAGS
+    flags: LOG_LIST_FILTER_FLAGS,
+    fields: [
+      { header: "runs", path: "totalRuns" },
+      { header: "errors", path: "totalErrors" },
+      { header: "avg latency", path: "avgLatency", format: "duration" },
+      { header: "window start", path: "timeBounds.start", format: "timestamp" },
+      { header: "window end", path: "timeBounds.end", format: "timestamp" },
+      { header: "bucket width", path: "segmentMs", format: "duration" },
+      { header: "workflows", format: "count" },
+      { header: "workflows truncated", path: "workflowsTruncated", format: "bool" }
+    ]
   },
   readFileText: {
     command: "files read",
@@ -11866,6 +12074,29 @@ var CLI_CONTRACT = {
   deleteWorkflowMcpServer: {
     confirm: "This deletes the MCP server, and any agent calling its tools loses access."
   },
+  deployWorkflowMcpTool: {
+    flags: {
+      parameterDescriptions: { json: true, describe: MCP_PARAMETER_DESCRIPTIONS_HELP }
+    }
+  },
+  listWorkflowMcpServers: {
+    columns: [
+      { header: "id" },
+      { header: "name" },
+      { header: "tools", path: "toolCount" },
+      { header: "public", path: "isPublic", format: "bool" },
+      { header: "url", path: "mcpServerUrl" },
+      { header: "updated", path: "updatedAt", format: "timestamp" }
+    ]
+  },
+  listWorkflowMcpTools: {
+    columns: [
+      { header: "tool", path: "toolName" },
+      { header: "workflow", path: "workflowId" },
+      { header: "description", path: "toolDescription" },
+      { header: "updated", path: "updatedAt", format: "timestamp" }
+    ]
+  },
   undeployWorkflowMcpTool: {
     confirm: "This withdraws the tool, and any agent calling it loses access."
   },
@@ -11879,25 +12110,43 @@ var CLI_CONTRACT = {
   },
   applyWorkflowOperations: {
     command: "workflows operations apply",
-    confirm: "This edits the draft graph, and a delete operation removes blocks and their edges."
+    confirm: "This edits the draft graph, and a delete operation removes blocks and their edges.",
+    flags: {
+      operations: { json: true, describe: WORKFLOW_OPERATIONS_HELP },
+      setBlockEnabled: { json: true, describe: WORKFLOW_SET_BLOCK_ENABLED_HELP }
+    }
   },
   applyWorkflowVariables: {
-    confirm: "This replaces the workflow’s variables and cannot be undone."
+    confirm: "This replaces the workflow’s variables and cannot be undone.",
+    flags: {
+      operations: { json: true, describe: WORKFLOW_VARIABLE_OPERATIONS_HELP }
+    }
   },
   revertWorkflowVersion: {
     confirm: "This overwrites the draft graph with the selected version and cannot be undone."
   },
+  rollbackWorkflow: {
+    confirm: "This changes which deployed version runs in production for every API and chat consumer."
+  },
   moveWorkflows: {
     command: "workflows move",
     flags: {
       workflowIds: { name: "workflow", list: true },
-      folderPath: FOLDER_PATH_FLAG
+      folderPath: {
+        ...FOLDER_PATH_INPUT,
+        name: "to",
+        renamedFrom: ["folder"],
+        describe: "Destination folder path; / moves the workflows to the workspace root"
+      }
     }
   },
   moveTables: {
     command: "tables move",
     flags: {
-      folderPaths: FOLDER_PATHS_FLAG,
+      folderPaths: {
+        ...FOLDER_PATHS_FLAG,
+        describe: "Table folders to move, by path as shown in the app; the leading / is optional"
+      },
       targetFolderPath: TARGET_FOLDER_PATH_FLAG
     }
   },
@@ -12016,7 +12265,10 @@ var CLI_CONTRACT = {
     ]
   },
   listFiles: {
-    flags: { folderPath: FOLDER_PATH_FLAG },
+    flags: {
+      folderPath: FOLDER_PATH_FLAG,
+      recursive: { boolean: true, negatable: true }
+    },
     columns: [
       { header: "id" },
       { header: "name" },
@@ -12040,9 +12292,19 @@ var CLI_CONTRACT = {
     ]
   },
   getKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
-  updateKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
+  updateKnowledgeDocument: {
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
+    flags: { retryProcessing: { boolean: true } }
+  },
   listKnowledgeTags: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
-  createKnowledgeTag: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
+  createKnowledgeTag: {
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
+    flags: {
+      fieldType: {
+        describe: "Value type stored in the slot; it decides which slots are usable and which filter operators apply. Defaults to text, so a number, date, or boolean slot must name its type here. Slot capacity per type: text 7, number 5, date 2, boolean 3"
+      }
+    }
+  },
   updateKnowledgeTag: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
   deleteKnowledgeTag: {
     pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
@@ -12147,7 +12409,8 @@ var CLI_CONTRACT = {
       { header: "scope" },
       { header: "role" },
       { header: "updated", path: "updatedAt", format: "timestamp" },
-      { header: "description" }
+      { header: "description" },
+      { header: "unredacted", format: "bool" }
     ]
   },
   getWorkspace: {
@@ -12155,7 +12418,8 @@ var CLI_CONTRACT = {
     fields: [
       { header: "id" },
       { header: "name" },
-      { header: "mode" },
+      { header: "color" },
+      { header: "logo", path: "logoUrl" },
       { header: "members", path: "memberCount" },
       { header: "created", path: "createdAt", format: "timestamp" },
       { header: "updated", path: "updatedAt", format: "timestamp" }
@@ -12178,7 +12442,7 @@ var CLI_CONTRACT = {
     flags: {
       organizationId: {
         name: "organization",
-        describe: "Organization ID (personal API key required)"
+        describe: "Organization ID; defaults to your only organization, and is required when your account belongs to more than one (personal API key required)"
       }
     },
     columns: [
@@ -12186,14 +12450,15 @@ var CLI_CONTRACT = {
       { header: "workspace", path: "workspaceId" },
       { header: "actor", path: "actorEmail" },
       { header: "action" },
-      { header: "resource", path: "resourceName" }
+      { header: "resource", path: "resourceName" },
+      { header: "id" }
     ]
   },
   getAuditLog: {
     flags: {
       organizationId: {
         name: "organization",
-        describe: "Organization ID (personal API key required)"
+        describe: "Organization ID; defaults to your only organization, and is required when your account belongs to more than one (personal API key required)"
       }
     }
   },
@@ -12293,6 +12558,11 @@ var CLI_CONTRACT = {
     command: "knowledge tags cleanup",
     pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     describe: "Remove tag definitions no document still uses",
+    flags: {
+      unused: {
+        describe: "Whether to remove only the tag definitions no document in the knowledge base still carries a value for. Defaults to true. Pass --no-unused to delete every definition on the knowledge base, which also clears its slot on every document and chunk and is not recoverable"
+      }
+    },
     confirm: "This deletes every tag definition no document still uses. Their slots become free for a different field."
   },
   unzipFile: {
@@ -12454,7 +12724,8 @@ var CLI_CONTRACT = {
     flags: {
       excludeRowIds: { list: true },
       filter: { json: true, describe: TABLE_FILTER_HELP }
-    }
+    },
+    confirm: "This cancels running column jobs — the whole table with --scope all, one row with --scope row."
   },
   searchTableRows: {
     command: "tables rows search",
@@ -12489,7 +12760,13 @@ var CLI_CONTRACT = {
       groupIds: { list: true },
       rowIds: { list: true },
       excludeRowIds: { list: true },
-      filter: { json: true, describe: TABLE_FILTER_HELP }
+      filter: { json: true, describe: TABLE_FILTER_HELP },
+      limit: {
+        name: "max-rows",
+        renamedFrom: ["limit"],
+        rowCap: true,
+        describe: DISPATCH_ROW_LIMIT_HELP
+      }
     }
   },
   runRowEnrichment: {
@@ -12499,7 +12776,8 @@ var CLI_CONTRACT = {
   createTableImport: { hidden: true },
   createTableImportPartUrls: { hidden: true },
   completeTableImport: { hidden: true },
-  cancelTableImport: { command: "tables imports cancel" },
+  getTableImport: { flags: TRANSFER_TOKEN_OMITTED },
+  cancelTableImport: { command: "tables imports cancel", flags: TRANSFER_TOKEN_OMITTED },
   cancelTableExport: { command: "tables exports cancel" },
   tableExportDownload: {
     command: "tables exports download",
@@ -12526,7 +12804,12 @@ var CLI_CONTRACT = {
       },
       stream: { omit: true },
       includeThinking: { omit: true },
-      includeToolCalls: { omit: true }
+      includeToolCalls: { omit: true },
+      "x-run-id": {
+        name: "run-id",
+        describe: "One-shot identifier for this run; NOT an idempotency key — reusing a claimed value fails with RUN_ID_CONFLICT instead of replaying the first result, and a fresh value starts another run"
+      },
+      "x-sim-via": { omit: true }
     }
   },
   getWorkflowRun: {
@@ -12614,7 +12897,8 @@ var CLI_CONTRACT = {
   createFileUpload: { hidden: true },
   createFileUploadPartUrls: { hidden: true },
   completeFileUpload: { hidden: true },
-  abortFileUpload: { hidden: true }
+  abortFileUpload: { hidden: true },
+  getFileUpload: { hidden: true }
 };
 
 // src/runtime/derive.ts
@@ -12655,15 +12939,44 @@ var JSON_KINDS = new Set(["object", "array", "unknown"]);
 function flagSpecFor(operation, field) {
   return CLI_CONTRACT[operation]?.flags?.[field] ?? {};
 }
+var RESERVED_PROGRAM_FLAGS = new Set([
+  "--version",
+  "-V",
+  "--help",
+  "-h",
+  "--profile",
+  "-P",
+  "--endpoint",
+  "--workspace",
+  "-w",
+  "--output"
+]);
+var RESERVED_FLAG_REPLACEMENTS = {
+  version: "to-version"
+};
 function flagNameFor(operation, field) {
-  return flagSpecFor(operation, field).name ?? kebab(field);
+  const declared = flagSpecFor(operation, field).name;
+  if (declared)
+    return declared;
+  const derived = kebab(field);
+  return RESERVED_FLAG_REPLACEMENTS[derived] ?? derived;
 }
 function pathFlagNameFor(commandSpec, param) {
   return commandSpec.pathFlags?.[param]?.name ?? kebab(param);
 }
 function takesJson(field, flag) {
+  if (flag.rowCap)
+    return false;
   return flag.json === true || JSON_KINDS.has(field.kind);
 }
+var MAX_ROW_CAP = 1e6;
+function coerceRowCap(raw, flagName) {
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 1 || value > MAX_ROW_CAP) {
+    throw new SimApiError(`--${flagName} must be a whole number between 1 and ${MAX_ROW_CAP.toLocaleString("en-US")}`, 0);
+  }
+  return { type: "rows", max: value };
+}
 function readStdin() {
   const idle = new Int32Array(new SharedArrayBuffer(4));
   const buffer = Buffer.alloc(64 * 1024);
@@ -12689,6 +13002,8 @@ function readStdin() {
   return Buffer.concat(chunks).toString("utf8");
 }
 function readArgumentSource(raw, flagName) {
+  if (raw.startsWith("@@"))
+    return { text: raw.slice(1), from: "" };
   if (!raw.startsWith("@"))
     return { text: raw, from: "" };
   const path = raw.slice(1);
@@ -12770,6 +13085,8 @@ function coerce(raw, field, flag, flagName) {
     const values = readListValues(raw, flagName).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
     return field.kind === "string" ? values.join(",") : values;
   }
+  if (flag.rowCap)
+    return coerceRowCap(raw, flagName);
   if (takesJson(field, flag)) {
     if (typeof raw !== "string")
       return raw;
@@ -12827,7 +13144,8 @@ function buildRequest(operation, positional, flags, workspaceId) {
   }
   const query = {};
   const body = {};
-  for (const slot of ["query", "body"]) {
+  const headers = {};
+  for (const slot of ["query", "body", "headers"]) {
     for (const [field, descriptor] of Object.entries(spec[slot] ?? {})) {
       const flag = flagSpecFor(operation, field);
       if (flag.omit)
@@ -12845,10 +13163,13 @@ function buildRequest(operation, positional, flags, workspaceId) {
       }
       if (slot === "query")
         query[field] = asQueryValue(value);
+      else if (slot === "headers")
+        headers[field] = String(value);
       else
         body[field] = value;
     }
   }
+  const headerSlot = Object.keys(headers).length > 0 ? { headers } : {};
   if (spec.opaqueBody) {
     if (commandSpec.bodyVariants) {
       const provided = commandSpec.bodyVariants.filter((variant2) => flags[camel(variant2.name)] !== undefined);
@@ -12864,7 +13185,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
       if (variant.kind === "object" && (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2)) || variant.kind === "array" && !Array.isArray(parsed2)) {
         throw new SimApiError(`--${variant.name} must be a JSON ${variant.kind}`, 0);
       }
-      return { path, query, body: { ...body, [variant.property]: parsed2 } };
+      return { path, query, body: { ...body, [variant.property]: parsed2 }, ...headerSlot };
     }
     const raw = flags.body;
     if (typeof raw !== "string")
@@ -12873,12 +13194,13 @@ function buildRequest(operation, positional, flags, workspaceId) {
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       throw new SimApiError("--body must be a JSON object", 0);
     }
-    return { path, query, body: { ...body, ...parsed } };
+    return { path, query, body: { ...body, ...parsed }, ...headerSlot };
   }
   return {
     path,
     query,
-    body: spec.body ? body : undefined
+    body: spec.body ? body : undefined,
+    ...headerSlot
   };
 }
 
@@ -13142,9 +13464,19 @@ function unwrapResource(data) {
   const [, value] = entries[0];
   return value && typeof value === "object" && !Array.isArray(value) ? value : data;
 }
-function renderPage(format, rows, spec) {
+function renderPage(format, rows, spec, envelope) {
+  writePageNote(spec, envelope);
   printList(format, rows, spec.columns ? columnsFrom(spec.columns) : inferColumns(rows, spec.expand));
 }
+function writePageNote(spec, envelope) {
+  if (!spec.pageNote)
+    return;
+  const value = at(envelope, spec.pageNote.path);
+  if (value === undefined || value === null)
+    return;
+  process.stderr.write(source_default.dim(`${spec.pageNote.label}: ${String(value)}
+`));
+}
 function renderResult(operation, format, raw, spec, options = {}) {
   if (spec.document) {
     printDocument(format, raw);
@@ -13269,10 +13601,25 @@ async function createConnectionLink(command, body) {
   });
   renderResult("createCredentialConnection", profile.output, response.data, CONNECTION_RESULT);
 }
+function acceptNameOnUpdate(credentials) {
+  const update = credentials.commands.find((command) => command.name() === "update");
+  if (!update)
+    throw new Error("The generated credentials update command is missing");
+  update.addOption(new Option("--name <displayName>", "Alias for --display-name")).hook("preAction", (_parent, action) => {
+    const options = action.opts();
+    if (options.name === undefined)
+      return;
+    if (options.displayName !== undefined) {
+      throw new SimApiError("--name and --display-name are the same field; pass one, not both", 0);
+    }
+    options.displayName = options.name;
+  });
+}
 function attachCredentialCommands(program2) {
   const credentials = program2.commands.find((command) => command.name() === "credentials");
   if (!credentials)
     throw new Error("The generated credentials command group is missing");
+  acceptNameOnUpdate(credentials);
   credentials.command("create").argument("<providerId>", "Service-account provider to create a credential for").description("Create a service-account credential using its discovered provider schema").requiredOption("--name <displayName>", "Name shown for the credential in Sim").requiredOption("--credentials <json|@file>", "Provider credentials as JSON (or @path / @- to read a file or stdin)").option("--description <description>", "Optional credential description").option("--id <credentialId>", "Client-generated credential ID when provider discovery requires it").action((providerId, options, command) => createServiceAccount(command, providerId, options));
   credentials.command("connect").argument("<providerId>", "OAuth provider to connect").description("Create a short-lived link for connecting an OAuth provider").requiredOption("--name <displayName>", "Name shown for the new credential in Sim").action(async (providerId, options, command) => createConnectionLink(command, { providerId, displayName: options.name }));
   credentials.command("reconnect").argument("<credentialId>", "Existing OAuth credential to re-authorize").description("Create a short-lived link for reconnecting an OAuth credential").action((credentialId, _options, command) => createConnectionLink(command, { credentialId }));
@@ -13306,23 +13653,24 @@ async function readChatStream(response, onChunk) {
   const processLine = (line) => {
     const event = parseChatStreamLine(line);
     if (!event || event.type === "heartbeat")
-      return;
+      return false;
     if (event.type === "chunk") {
       if (event.content)
         onChunk(sanitize(event.content));
-      return;
+      return false;
     }
     if (event.type === "error") {
       throw new SimApiError(event.error || "Chat request failed", 0);
     }
     if (event.type === "final") {
       finalResult = event.data;
-      return;
+      return true;
     }
     throw new SimApiError("Chat stream returned an unknown event", 0);
   };
   try {
-    while (true) {
+    let ended = false;
+    while (!ended) {
       const { done, value } = await reader.read();
       if (done)
         break;
@@ -13331,21 +13679,39 @@ async function readChatStream(response, onChunk) {
 `);
       buffer = lines.pop() ?? "";
       for (const line of lines) {
-        processLine(line);
+        if (processLine(line)) {
+          ended = true;
+          break;
+        }
       }
     }
-    buffer += decoder.decode();
-    processLine(buffer);
+    if (!ended) {
+      buffer += decoder.decode();
+      processLine(buffer);
+    }
     if (!finalResult) {
       throw new SimApiError("Chat stream ended without a final result", 0);
     }
     return finalResult;
   } finally {
-    reader.releaseLock();
+    reader.cancel().catch(() => {
+      return;
+    });
   }
 }
+function ignoreBrokenPipe(stream) {
+  const onError = (error) => {
+    if (error.code !== "EPIPE")
+      throw error;
+    process.exit(0);
+  };
+  stream.on("error", onError);
+  return () => {
+    stream.off("error", onError);
+  };
+}
 function attachChat(program2) {
-  program2.command("chat").description("Ask Sim and print the reply").argument("<message>", "What to ask Sim").option("-c, --conversation <id>", "Continue the conversation with this ID").addHelpText("after", `
+  program2.command("chat").description("Ask Sim and print the reply").argument("<message>", "What to ask Sim").allowExcessArguments(false).option("-c, --conversation <id>", "Continue the conversation with this ID").addHelpText("after", `
 Each turn prints the reply on stdout and the conversation ID on stderr; pass
 that ID back with -c to continue the same conversation. With --output json or
 yaml the reply is not streamed — the finished result is printed as one
@@ -13369,28 +13735,41 @@ Examples:
     });
     const streaming = profile.output === "table" || profile.output === "text";
     let streamed = "";
-    const result = await readChatStream(response, (content2) => {
-      if (!streaming)
-        return;
-      streamed += content2;
-      process.stdout.write(content2);
-    });
-    if (!streaming) {
-      printProtocolResult(profile.output, result);
-      return;
-    }
-    const content = sanitize(result.content ?? "");
-    if (content.startsWith(streamed) && content.length > streamed.length) {
-      process.stdout.write(content.slice(streamed.length));
-      streamed = content;
-    }
-    if (streamed.length > 0 && !streamed.endsWith(`
+    const endStreamedLine = () => {
+      if (streamed.length > 0 && !streamed.endsWith(`
 `)) {
-      process.stdout.write(`
+        process.stdout.write(`
 `);
-    }
-    process.stderr.write(`${source_default.dim(`conversation: ${result.conversationId}`)}
+        streamed += `
+`;
+      }
+    };
+    const restorePipeHandling = streaming ? ignoreBrokenPipe(process.stdout) : undefined;
+    try {
+      const result = await readChatStream(response, (content2) => {
+        if (!streaming)
+          return;
+        streamed += content2;
+        process.stdout.write(content2);
+      });
+      if (!streaming) {
+        printProtocolResult(profile.output, result);
+        return;
+      }
+      const content = sanitize(result.content ?? "");
+      if (content.startsWith(streamed) && content.length > streamed.length) {
+        process.stdout.write(content.slice(streamed.length));
+        streamed = content;
+      }
+      endStreamedLine();
+      process.stderr.write(`${source_default.dim(`conversation: ${result.conversationId}`)}
 `);
+    } catch (error) {
+      endStreamedLine();
+      throw error;
+    } finally {
+      restorePipeHandling?.();
+    }
   });
 }
 
@@ -13518,7 +13897,7 @@ function isTerminalSafeContentType(contentType) {
   ].includes(mediaType);
 }
 function attachFileGet(files) {
-  files.command("get").argument("<fileId>", "File whose content to read").description("Get a file’s content").option("-o, --output-file <path>", "Write content to a file instead of stdout").option("--force", "Overwrite --output-file if it already exists").action(async (fileId, options, command) => {
+  files.command("get").argument("<fileId>", "File whose content to read").allowExcessArguments(false).description("Get a file’s content").option("-o, --output-file <path>", "Write content to a file instead of stdout").option("--force", "Overwrite --output-file if it already exists").action(async (fileId, options, command) => {
     const writesToStdout = options.outputFile === undefined || options.outputFile === "-";
     if (writesToStdout && options.force) {
       throw new SimApiError("--force requires --output-file <path>", 0);
@@ -13553,7 +13932,8 @@ function attachFileGet(files) {
 }
 
 // src/transfer/local-file.ts
-import { stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { access, stat } from "node:fs/promises";
 import { basename } from "node:path";
 var CONTENT_TYPES = {
   css: "text/css",
@@ -13593,6 +13973,7 @@ async function localFile(path, override) {
     const stats = await stat(path);
     if (!stats.isFile())
       throw new SimApiError(`${path} is not a regular file`, 0);
+    await access(path, constants.R_OK);
     size = stats.size;
   } catch (error) {
     if (error instanceof SimApiError)
@@ -13675,7 +14056,7 @@ async function finishUploadSession(client, workspaceId, session, path) {
 
 // src/commands/protocol/files-upload.ts
 function attachFileUpload(files) {
-  files.command("upload").argument("<path>", "Local file to upload").description("Upload a file to the workspace").option("--folder <path>", "Folder path as shown in the app; defaults to the root folder").option("--name <name>", "Store it under a different name").action(async (path, options, command) => {
+  files.command("upload").argument("<path>", "Local file to upload").allowExcessArguments(false).description("Upload a file to the workspace").option("--folder <path>", "Folder path as shown in the app; defaults to the root folder").option("--name <name>", "Store it under a different name").action(async (path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     const { name, size } = await localFile(path, options.name);
@@ -13721,7 +14102,7 @@ function uploadMetadata(options) {
   return metadata;
 }
 function attachKnowledgeDocumentUpload(documents) {
-  documents.command("upload").argument("<knowledgeBaseId>", "Knowledge base to upload into").argument("<path>", "Local file to upload").description("Upload a document to a knowledge base").option("--name <name>", "Store it under a different name").option("--tag <value...>", "Document tags, in tag1 through tag7 order").option("--recipe <name>", "Document processing recipe").option("--lang <code>", "Document language code").action(async (knowledgeBaseId, path, options, command) => {
+  documents.command("upload").argument("<knowledgeBaseId>", "Knowledge base to upload into").argument("<path>", "Local file to upload").allowExcessArguments(false).description("Upload a document to a knowledge base").option("--name <name>", "Store it under a different name").option("--tag <value...>", "Document tags, in tag1 through tag7 order").option("--recipe <name>", "Document processing recipe").option("--lang <code>", "Document language code").action(async (knowledgeBaseId, path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     const { name, size } = await localFile(path, options.name);
@@ -13980,7 +14361,8 @@ Examples:
       triggers: options.trigger?.length ? options.trigger.join(",") : undefined,
       level: options.level,
       details: options.details,
-      order: "desc"
+      sortBy: "startedAt",
+      sortOrder: "desc"
     };
     const write = createWriter(profile.output);
     const status = followStatus();
@@ -14032,7 +14414,14 @@ var DEFAULT_LIMIT = 100;
 function describeField(flag, descriptor, name, field) {
   return flag.describe ?? descriptor.describe ?? `Set ${name.replaceAll("-", " ") || field}`;
 }
-function addFieldOption(command, operation, field, descriptor) {
+function literalNullHint(documented, name) {
+  return /\bnull\b/i.test(documented) ? ` (--${name} null sends the word, not JSON null)` : "";
+}
+var WIRE_VOCABULARY_SENTENCE = /\s*The listed spellings[^.]*\.\s*/g;
+function withoutWireVocabulary(documented) {
+  return documented.replace(WIRE_VOCABULARY_SENTENCE, " ").trim();
+}
+function addFieldOption(command, operation, field, descriptor, slot) {
   if (field === PROFILE_INJECTED_FIELD || field === "cursor")
     return;
   const flag = flagSpecFor(operation, field);
@@ -14046,20 +14435,23 @@ function addFieldOption(command, operation, field, descriptor) {
   }
   const documented = describeField(flag, descriptor, name, field);
   if (descriptor.kind === "boolean" || flag.boolean) {
+    const booleanDoc = withoutWireVocabulary(documented);
     if (descriptor.required) {
-      command.addOption(new Option(`${short}--${name} <true|false>`, `${documented} (required)`).choices(["true", "false"]).makeOptionMandatory());
+      command.addOption(new Option(`${short}--${name} <true|false>`, `${booleanDoc} (required)`).choices(["true", "false"]).makeOptionMandatory());
       return;
     }
-    command.option(`${short}--${name}`, documented);
-    if (!flag.boolean)
+    command.option(`${short}--${name}`, booleanDoc);
+    if (!flag.boolean || flag.negatable) {
       command.option(`--no-${name}`, `Send --${name} as false`);
+    }
     return;
   }
   const takesList = flag.list === true;
   const wantsJson = takesJson(descriptor, flag);
-  const placeholder = takesList ? "<value...>" : wantsJson ? "<json|@file>" : "<value>";
+  const placeholder = takesList ? "<value...>" : flag.rowCap ? "<n>" : wantsJson ? "<json|@file>" : "<value>";
   const choices = flag.choices ?? descriptor.values;
-  const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}`;
+  const literalNull = slot === "body" && !takesList && !wantsJson;
+  const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}${literalNull ? literalNullHint(documented, name) : ""}`;
   const renamedFrom = flag.renamedFrom ?? [];
   const option = new Option(`${short}--${name} ${placeholder}`, describe);
   if (flag.hidden)
@@ -14088,13 +14480,13 @@ function addOperationOptions(command, operation, commandSpec, operationSpec) {
     const short = flag.short ? `-${flag.short}, ` : "";
     command.addOption(new Option(`${short}--${name} <${flag.placeholder ?? "value"}>`, `${flag.describe ?? operationSpec.pathParamDocs?.[param] ?? `Set ${name.replaceAll("-", " ")}`} (required)`).makeOptionMandatory());
   }
-  for (const slot of ["query", "body"]) {
+  for (const slot of ["query", "body", "headers"]) {
     for (const [field, descriptor] of Object.entries(operationSpec[slot] ?? {})) {
       if (commandSpec.requestFields && !commandSpec.requestFields.includes(field))
         continue;
       if (commandSpec.positionals?.includes(field))
         continue;
-      addFieldOption(command, operation, field, descriptor);
+      addFieldOption(command, operation, field, descriptor, slot);
     }
   }
   if (commandSpec.allWorkspaces) {
@@ -14113,7 +14505,8 @@ function addOperationOptions(command, operation, commandSpec, operationSpec) {
     }
   }
   if (commandSpec.confirm) {
-    command.option("-y, --yes", "Confirm this destructive operation (required)");
+    const exemptedByDryRun = operationSpec.query?.dryRun !== undefined || operationSpec.body?.dryRun !== undefined;
+    command.option("-y, --yes", exemptedByDryRun ? "Confirm this destructive operation (required unless --dry-run)" : "Confirm this destructive operation (required)");
   }
 }
 
@@ -14212,19 +14605,43 @@ function tableNameFrom(fileName) {
 function jsonFlag(raw, flagName, kind) {
   return coerce(raw, { kind }, { json: true }, flagName);
 }
+function rejectionFields(job) {
+  const rows = job.rowsRejected ?? 0;
+  const cells = job.cellsRejected ?? 0;
+  if (rows === 0 && cells === 0)
+    return {};
+  const samples = (job.rejectedSamples ?? []).map((sample) => sample.line === null || sample.line === undefined ? `${sample.message} (${sample.code})` : `line ${sample.line}: ${sample.message} (${sample.code})`);
+  return {
+    rowsRejected: rows,
+    cellsRejected: cells,
+    ...samples.length > 0 ? { rejectedSamples: samples } : {}
+  };
+}
+function progressLine(job) {
+  const rows = job.rowsRejected ?? 0;
+  const cells = job.cellsRejected ?? 0;
+  const parts = [];
+  if (rows > 0)
+    parts.push(`${rows} rows rejected`);
+  if (cells > 0)
+    parts.push(`${cells} cells rejected`);
+  const suffix = parts.length > 0 ? `, ${parts.join(", ")}` : "";
+  return `${job.status}… ${job.rowsProcessed} rows${suffix}`;
+}
 async function watchImport(client, workspaceId, job) {
   let current = job;
-  let reported2 = -1;
+  let reported2 = null;
   while (!IMPORT_SETTLED.has(current.status)) {
     await sleep2(IMPORT_POLL_MS);
     const next = await client.request(`/api/v2/tables/imports/${encodeURIComponent(current.id)}`, { query: { workspaceId } });
     current = next.data;
-    if (process.stderr.isTTY && current.rowsProcessed !== reported2) {
-      reported2 = current.rowsProcessed;
-      process.stderr.write(`\r${source_default.dim(`${current.status}… ${reported2} rows`)}\x1B[K`);
+    const line = progressLine(current);
+    if (process.stderr.isTTY && line !== reported2) {
+      reported2 = line;
+      process.stderr.write(`\r${source_default.dim(line)}\x1B[K`);
     }
   }
-  if (process.stderr.isTTY && reported2 >= 0)
+  if (process.stderr.isTTY && reported2 !== null)
     process.stderr.write("\r\x1B[K");
   return current;
 }
@@ -14246,7 +14663,7 @@ function validateTargetOptions(options) {
   return intoExisting;
 }
 function attachTableImport(tables) {
-  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table, as shown in the app").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
+  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").allowExcessArguments(false).description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table, as shown in the app").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     if (Boolean(path) === Boolean(options.fileId)) {
@@ -14302,7 +14719,8 @@ function attachTableImport(tables) {
         id: job.id,
         status: job.status,
         tableId: job.tableId,
-        rowsProcessed: job.rowsProcessed
+        rowsProcessed: job.rowsProcessed,
+        ...rejectionFields(job)
       });
       return;
     }
@@ -14314,7 +14732,8 @@ function attachTableImport(tables) {
       id: finished.id,
       status: finished.status,
       tableId: finished.tableId,
-      rowsProcessed: finished.rowsProcessed
+      rowsProcessed: finished.rowsProcessed,
+      ...rejectionFields(finished)
     });
   });
 }
@@ -14337,6 +14756,75 @@ function warnRenamedFlag(from, to) {
 }
 
 // src/runtime/execute.ts
+var RUN_OUTCOME_OPERATIONS = new Set(["executeWorkflow"]);
+var FAILED_RUN_STATUS_MESSAGES = {
+  failed: "The workflow run failed.",
+  cancelled: "The workflow run was cancelled."
+};
+function runFailureMessage(operation, payload) {
+  if (!RUN_OUTCOME_OPERATIONS.has(operation))
+    return null;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const { status, error } = payload;
+  if (typeof status !== "string")
+    return null;
+  const fallback = FAILED_RUN_STATUS_MESSAGES[status];
+  if (!fallback)
+    return null;
+  const reported2 = error?.message;
+  return safeOneLine(typeof reported2 === "string" && reported2 ? reported2 : fallback);
+}
+var BULK_OUTCOME_CHECKS = {
+  bulkDeleteFiles: (payload, body) => {
+    if (countOf(payload.deletedItems?.files) > 0)
+      return null;
+    const requested = lengthOf(body?.fileIds);
+    if (requested === 0)
+      return null;
+    return `Deleted nothing: none of the ${requested} requested ${requested === 1 ? "file was" : "files were"} deleted.`;
+  },
+  bulkDeleteTables: (payload) => {
+    const items = payload.deletedItems;
+    const deleted = countOf(items?.tables) + countOf(items?.folders);
+    if (deleted > 0)
+      return null;
+    const missed = lengthOf(payload.notFound) + lengthOf(payload.failed);
+    if (missed === 0)
+      return null;
+    return `Deleted nothing: ${missed} of ${missed} ${missed === 1 ? "item was" : "items were"} not found or could not be deleted.`;
+  },
+  moveTables: (payload) => {
+    if (lengthOf(payload.moved) > 0)
+      return null;
+    const missed = lengthOf(payload.notFound) + lengthOf(payload.failed);
+    if (missed === 0)
+      return null;
+    return `Moved nothing: ${missed} of ${missed} ${missed === 1 ? "item was" : "items were"} not found or could not be moved.`;
+  },
+  moveWorkflows: (payload) => {
+    if (lengthOf(payload.moved) > 0)
+      return null;
+    const failed = lengthOf(payload.failed);
+    if (failed === 0)
+      return null;
+    return `Moved nothing: ${failed} of ${failed} ${failed === 1 ? "workflow" : "workflows"} could not be moved.`;
+  }
+};
+function countOf(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function lengthOf(value) {
+  return Array.isArray(value) ? value.length : 0;
+}
+function bulkFailureMessage(operation, payload, body) {
+  const check = BULK_OUTCOME_CHECKS[operation];
+  if (!check)
+    return null;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  return check(payload, body);
+}
 function cursorSlot(operationSpec) {
   if (operationSpec.query && "cursor" in operationSpec.query)
     return "query";
@@ -14398,13 +14886,16 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
     const rows = [];
     const progress = pageProgress();
     let cursor = null;
+    let envelope;
     try {
       do {
         const page = await client.request(request.path, {
           method: operationSpec.method,
+          headers: request.headers,
           query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
           body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
         });
+        envelope ??= page;
         rows.push(...page.data);
         cursor = page.nextCursor;
         if (cursor && rows.length < limit)
@@ -14413,17 +14904,22 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
     } finally {
       progress.finish();
     }
-    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec);
+    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec, envelope);
     return;
   }
   const result = await client.request(request.path, {
     method: operationSpec.method,
+    headers: request.headers,
     query: request.query,
     body: request.body
   });
-  renderResult(operation, profile.output, result?.data ?? result, commandSpec, {
+  const payload = result?.data ?? result;
+  renderResult(operation, profile.output, payload, commandSpec, {
     expandedTrace: requestFlags.trace === true
   });
+  const failure = runFailureMessage(operation, payload) ?? bulkFailureMessage(operation, payload, request.body);
+  if (failure)
+    throw new SimApiError(failure, 0);
 }
 
 // src/commands/protocol/workflow-run-follow.ts
@@ -14746,7 +15242,7 @@ function runSpec() {
   return CLI_CONTRACT.getWorkflowRun ?? {};
 }
 function attachWorkflowRunWait(runs) {
-  runs.command("wait").argument("<runId>", V2_OPERATIONS.getWorkflowRun.pathParamDocs?.runId).description("Wait for a run to reach a terminal state, then show it").addOption(new Option("--workflow <workflowId>", "Workflow ID (required)").makeOptionMandatory()).addOption(new Option(WAIT_TIMEOUT_FLAG, `Give up after this many seconds, or 0 to wait indefinitely (default: ${DEFAULT_WAIT_TIMEOUT_SECONDS}). Bounds the whole wait; SIM_TIMEOUT_SECONDS bounds one request`)).action(async (runId, options, command) => {
+  runs.command("wait").argument("<runId>", V2_OPERATIONS.getWorkflowRun.pathParamDocs?.runId).allowExcessArguments(false).description("Wait for a run to reach a terminal state, then show it").addOption(new Option("--workflow <workflowId>", "Workflow ID (required)").makeOptionMandatory()).addOption(new Option(WAIT_TIMEOUT_FLAG, `Give up after this many seconds, or 0 to wait indefinitely (default: ${DEFAULT_WAIT_TIMEOUT_SECONDS}). Bounds the whole wait; SIM_TIMEOUT_SECONDS bounds one request`)).action(async (runId, options, command) => {
     const timeoutSeconds = options.waitTimeout === undefined ? DEFAULT_WAIT_TIMEOUT_SECONDS : parseWaitTimeout(options.waitTimeout);
     const { client, profile } = clientFrom(command);
     const operation = V2_OPERATIONS.getWorkflowRun;
@@ -14838,6 +15334,21 @@ function attachProtocolCommands(program2) {
 // src/terminal/secret-input.ts
 import { emitKeypressEvents } from "node:readline";
 var MAX_SECRET_LENGTH = 65536;
+
+class SecretInputCancelledError extends SimApiError {
+  constructor() {
+    super("Secret input cancelled.", 0);
+    this.name = "SecretInputCancelledError";
+  }
+}
+function metaCharacter(key) {
+  if (!key.meta || !key.sequence)
+    return "";
+  const character = key.sequence.replace(/^\u001b+/, "");
+  if (character.length !== 1 || character < " " || character === "")
+    return "";
+  return character;
+}
 function promptSecret(input = process.stdin, output = process.stderr) {
   if (!input.isTTY) {
     throw new SimApiError("Interactive secret input requires a terminal. Pass --value instead.", 0);
@@ -14871,9 +15382,10 @@ function promptSecret(input = process.stdin, output = process.stderr) {
       }
     };
     const fail = (message) => finish(() => reject(new SimApiError(message, 0)));
+    const cancel = () => finish(() => reject(new SecretInputCancelledError));
     function onKeypress(text2, key) {
       if (key.ctrl && (key.name === "c" || key.name === "d")) {
-        fail("Secret input cancelled.");
+        cancel();
         return;
       }
       if (key.name === "return" || key.name === "enter") {
@@ -14892,14 +15404,15 @@ function promptSecret(input = process.stdin, output = process.stderr) {
         }
         return;
       }
-      if (!text2 || key.ctrl || key.meta || key.name === "escape")
+      const entered = text2 || metaCharacter(key);
+      if (!entered || key.ctrl || key.name === "escape")
         return;
-      if (value.length + text2.length > MAX_SECRET_LENGTH) {
+      if (value.length + entered.length > MAX_SECRET_LENGTH) {
         fail(`Secret value cannot exceed ${MAX_SECRET_LENGTH} characters.`);
         return;
       }
-      value += text2;
-      output.write("*".repeat(Array.from(text2).length));
+      value += entered;
+      output.write("*".repeat(Array.from(entered).length));
     }
     input.on("keypress", onKeypress);
   });
@@ -14907,6 +15420,7 @@ function promptSecret(input = process.stdin, output = process.stderr) {
 
 // src/commands/secrets.ts
 var MAX_SECRET_LENGTH2 = 65536;
+var CANCELLED_EXIT_CODE = 130;
 var SECRET_SCOPES = ["workspace", "personal"];
 var SECRET_RESULT = {
   fields: [
@@ -14917,6 +15431,13 @@ var SECRET_RESULT = {
     { header: "description" }
   ]
 };
+function readValueArgument(raw) {
+  if (raw.startsWith("@@"))
+    return raw.slice(1);
+  if (!raw.startsWith("@"))
+    return raw;
+  return readArgumentSource(raw, "value").text;
+}
 function validateSecretValue(value) {
   if (value.length === 0)
     throw new SimApiError("Secret value cannot be empty.", 0);
@@ -14925,17 +15446,30 @@ function validateSecretValue(value) {
   }
   return value;
 }
-function validateDescriptionScope(description, scope) {
-  if (description === undefined)
+function validateWorkspaceOnlyFlag(flag, value, scope) {
+  if (value === undefined)
     return;
   if (scope === "personal") {
-    throw new SimApiError("--description is only supported for a workspace secret.", 0);
+    throw new SimApiError(`--${flag} is only supported for a workspace secret.`, 0);
+  }
+  return value;
+}
+async function readSecretValue(options) {
+  if (options.value !== undefined)
+    return validateSecretValue(readValueArgument(options.value));
+  try {
+    return validateSecretValue(await promptSecret());
+  } catch (error) {
+    if (!(error instanceof SecretInputCancelledError))
+      throw error;
+    console.error(source_default.red(`Error: ${error.message}`));
+    return process.exit(CANCELLED_EXIT_CODE);
   }
-  return description;
 }
 async function setSecret(name, options, command) {
-  const description = validateDescriptionScope(options.description, options.scope);
-  const value = validateSecretValue(options.value ?? await promptSecret());
+  const description = validateWorkspaceOnlyFlag("description", options.description, options.scope);
+  const unredacted = validateWorkspaceOnlyFlag("unredacted", options.unredacted, options.scope);
+  const value = await readSecretValue(options);
   const { client, profile } = clientFrom(command);
   const operation = V2_OPERATIONS.setSecret;
   const response = await client.request(resolvePath(operation.path, { name }), {
@@ -14944,7 +15478,8 @@ async function setSecret(name, options, command) {
       workspaceId: client.requireWorkspace(),
       scope: options.scope,
       value,
-      description
+      description,
+      ...unredacted === undefined ? {} : { unredacted }
     }
   });
   renderResult("setSecret", profile.output, response.data, SECRET_RESULT);
@@ -14953,7 +15488,7 @@ function attachSecretCommands(program2) {
   const secrets = program2.commands.find((command) => command.name() === "secrets");
   if (!secrets)
     throw new Error("The generated secrets command group is missing");
-  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value>", "Secret value; visible to shell history when supplied directly").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").action((name, options, command) => setSecret(name, options, command));
+  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value|@file>", "Secret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").option("--unredacted", `${V2_OPERATIONS.setSecret.body.unredacted.describe} Pass --no-unredacted to restore redaction`).option("--no-unredacted", "Send --unredacted as false").action((name, options, command) => setSecret(name, options, command));
 }
 
 // src/runtime/build.ts
@@ -15003,6 +15538,35 @@ function addMissingArgumentExample(command) {
   });
   return command;
 }
+function assertNoReservedFlags(command, operation) {
+  for (const option of command.options) {
+    for (const flag of [option.long, option.short]) {
+      if (flag && RESERVED_PROGRAM_FLAGS.has(flag)) {
+        throw new Error(`${operation} declares ${flag}, which the root program already owns; give the flag another name`);
+      }
+    }
+  }
+}
+var RESERVED_FLAG_EXEMPTIONS = new Set(["profiles add"]);
+function assertNoReservedProgramFlags(program2) {
+  const walk = (command, prefix) => {
+    const path = [...prefix, command.name()];
+    const name = path.join(" ");
+    if (!RESERVED_FLAG_EXEMPTIONS.has(name)) {
+      for (const option of command.options) {
+        for (const flag of [option.long, option.short]) {
+          if (flag && RESERVED_PROGRAM_FLAGS.has(flag)) {
+            throw new Error(`"sim ${name}" declares ${flag}, which the root program already owns; give the flag another name`);
+          }
+        }
+      }
+    }
+    for (const child of command.commands)
+      walk(child, path);
+  };
+  for (const child of program2.commands)
+    walk(child, []);
+}
 function configureOperation(command, operation, spec) {
   const operationSpec = V2_OPERATIONS[operation];
   command.allowExcessArguments(false);
@@ -15051,11 +15615,11 @@ function configureOperation(command, operation, spec) {
   }
   if (spec.requestFields) {
     for (const field of spec.requestFields) {
-      if (!operationSpec.query?.[field] && !operationSpec.body?.[field]) {
+      if (!operationSpec.query?.[field] && !operationSpec.body?.[field] && !operationSpec.headers?.[field]) {
         throw new Error(`${operation}.${field} is not a request field`);
       }
     }
-    for (const slot of ["query", "body"]) {
+    for (const slot of ["query", "body", "headers"]) {
       for (const [field, descriptor] of Object.entries(operationSpec[slot] ?? {})) {
         if (descriptor.required && field !== PROFILE_INJECTED_FIELD && !spec.requestFields.includes(field)) {
           throw new Error(`${operation}.${field} is required but not exposed`);
@@ -15065,6 +15629,7 @@ function configureOperation(command, operation, spec) {
   }
   command.description(spec.describe ?? operationSpec.summary ?? `${operationSpec.method} ${operationSpec.path}`);
   addOperationOptions(command, operation, spec, operationSpec);
+  assertNoReservedFlags(command, operation);
   command.action((...invocation) => executeOperation(operation, spec, operationSpec, invocation));
   return command;
 }
@@ -15082,7 +15647,14 @@ function addRenamedCommand(groups, operation, spec, from, to) {
   }
   const leaf = buildLeaf(operation, spec, rest[rest.length - 1]);
   leaf.hook("preAction", () => warnRenamedCommand(from, to));
-  parent.addCommand(leaf, { hidden: true });
+  addSubcommand(parent, leaf, { hidden: true });
+}
+function addSubcommand(parent, child, options = {}) {
+  const wasLeaf = parent.commands.length === 0 && parent.registeredArguments.length > 0;
+  const usage = wasLeaf ? parent.usage() : null;
+  parent.addCommand(child, { hidden: options.hidden });
+  if (usage !== null)
+    parent.usage(usage);
 }
 function groupFor(groups, name) {
   const existing = groups.get(name);
@@ -15104,7 +15676,7 @@ function nestedGroup(parent, name, options = {}) {
   if (existing)
     return existing;
   const created = new Command(name).description(`Manage ${resourceLabel(parent.name())} ${name.replaceAll("-", " ")}`);
-  parent.addCommand(created, { hidden: options.hidden });
+  addSubcommand(parent, created, { hidden: options.hidden });
   return created;
 }
 function addLeafCommand(groups, operation, spec, segments) {
@@ -15176,24 +15748,63 @@ Profiles work like the AWS CLI: settings live in ~/.sim/config, keys in
 ~/.sim/credentials (0600), or under SIM_CONFIG_DIR when it is set. Select one
 with -P, --profile, or SIM_PROFILE.
 
+Workflow, knowledge-base and workspace IDs are bare UUIDs. Table IDs carry a
+tbl_ prefix and file IDs a wf_ one, so wf_ never names a workflow.
+
 Examples:
-  $ sim login                                    Authorize the default profile
-  $ sim profile add acme --workspace ws_123      Reuse that login for a workspace
+  $ sim login                          Authorize the default profile
   $ sim login --profile dev --endpoint http://localhost:3000
+  $ sim profile add acme --workspace 7e2d9c14-6b83-4a55-8f01-c4d3e9a76b28
   $ sim workflows list
   $ sim logs list --level error --limit 20
-  $ sim --output json tables get tbl_123        Override output for one command
-  $ sim configure --set-output json             Save a profile output default
-  $ sim knowledge search --query "refund policy" --kb kb_123
-  $ sim workflows export wf_123 > wf.json        JSON flags read files with @
+  $ sim configure --set-output json    Save a profile output default
+  $ sim --output json tables get tbl_9f3c1a05d4b7426e8c2f0917ab35de64
+  $ sim knowledge search --query "refund policy" --kb 4c1b7f60-2d55-4a3e-9c18-70b6ea2f9d31
+  $ sim workflows export 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 > wf.json
   $ sim workflows import --workflow @wf.json
   $ sim whoami --profile dev
 `;
+var ROOT_VALUE_FLAGS = new Set([
+  "-P",
+  "--profile",
+  "--endpoint",
+  "-w",
+  "--workspace",
+  "--output"
+]);
+function namesASubcommandFirst(rawArgs) {
+  const tokens = rawArgs.slice(2);
+  for (let index = 0;index < tokens.length; index += 1) {
+    const token2 = tokens[index];
+    if (token2 === "--version" || token2 === "-V")
+      return false;
+    if (ROOT_VALUE_FLAGS.has(token2)) {
+      index += 1;
+      continue;
+    }
+    if (token2.startsWith("-"))
+      continue;
+    return true;
+  }
+  return false;
+}
+function addVersionOption(program2) {
+  program2.on("option:version", (value) => {
+    if (value === null || value === undefined) {
+      const { rawArgs } = program2;
+      if (!namesASubcommandFirst(rawArgs ?? []))
+        return;
+      program2.error("error: --version reports the Sim CLI version and is not a command flag. A command that acts on a deployment version reads it from --to-version.");
+    }
+    program2.error("error: --version reports the Sim CLI version and takes no value. A command that acts on a deployment version reads it from --to-version.");
+  });
+  program2.version(CLI_VERSION, "-V, --version [none]", "output the version number (takes no value)");
+}
 function buildProgram(options = {}) {
   const program2 = new Command;
   program2.name("sim").description(PROGRAM_DESCRIPTION);
   if (options.version !== false)
-    program2.version(CLI_VERSION);
+    addVersionOption(program2);
   program2.option("-P, --profile <name>", "Profile to use (env: SIM_PROFILE)").option("--endpoint <url>", "Sim deployment to talk to (env: SIM_ENDPOINT)").option("-w, --workspace <id>", "Workspace to target (env: SIM_WORKSPACE)").addOption(new Option("--output <format>", "Output format for this command").choices([...OUTPUT_FORMATS]));
   program2.addCommand(loginCommand());
   program2.addCommand(logoutCommand());
@@ -15207,6 +15818,7 @@ function buildProgram(options = {}) {
   attachProtocolCommands(program2);
   attachSecretCommands(program2);
   program2.addHelpText("after", HELP_EPILOGUE);
+  assertNoReservedProgramFlags(program2);
   return program2;
 }