sim 2.1.17 → 2.1.18-dev.129.1

package/dist/index.js

@@ -3692,6 +3692,12 @@ var applyOptions = (object, options = {}) => {
   const colorLevel = stdoutColor ? stdoutColor.level : 0;
   object.level = options.level === undefined ? colorLevel : options.level;
 };
+
+class Chalk {
+  constructor(options) {
+    return chalkFactory(options);
+  }
+}
 var chalkFactory = (options) => {
   const chalk = (...strings) => strings.join(" ");
   applyOptions(chalk, options);
@@ -3820,6 +3826,56 @@ var chalk = createChalk();
 var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
 
+// src/embed-context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+function setSoftExitCode(code) {
+  const ctx = embedStore.getStore();
+  if (ctx)
+    ctx.softExitCode = code;
+  else
+    process.exitCode = code;
+}
+var embedStore = new AsyncLocalStorage;
+
+class EmbeddedExit extends Error {
+  code;
+  constructor(code) {
+    super(`CLI exited with code ${code}`);
+    this.code = code;
+  }
+}
+function embeddedProfile() {
+  const ctx = embedStore.getStore();
+  if (!ctx)
+    return null;
+  return {
+    name: "embedded",
+    authProfile: "embedded",
+    oauth: null,
+    endpoint: ctx.identity.endpoint,
+    apiKey: ctx.identity.apiKey,
+    workspaceId: ctx.identity.workspaceId ?? null,
+    output: "json",
+    ...ctx.identity.transport ? { transport: ctx.identity.transport } : {},
+    ...ctx.identity.signal ? { signal: ctx.identity.signal } : {},
+    sources: { endpoint: "flag", credential: "flag", workspaceId: "flag", output: "flag" }
+  };
+}
+function exitCli(code) {
+  if (embedStore.getStore())
+    throw new EmbeddedExit(code);
+  return process.exit(code);
+}
+
+// src/output/presentation.ts
+var plain = new Chalk({ level: 0 });
+function styles3() {
+  return embedStore.getStore() ? plain : source_default;
+}
+function hasProgressTerminal() {
+  return !embedStore.getStore() && Boolean(process.stderr.isTTY);
+}
+
 // node_modules/js-yaml/dist/js-yaml.mjs
 function getDefaultExportFromCjs(x) {
   return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x["default"] : x;
@@ -6962,15 +7018,6 @@ function getErrorMessage(value, fallback) {
   return fallback ?? String(value);
 }
 
-// ../utils/src/object.ts
-function omit(obj, keys) {
-  const result = { ...obj };
-  for (const key of keys) {
-    delete result[key];
-  }
-  return result;
-}
-
 // src/update/install.ts
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
 
@@ -7103,14 +7150,22 @@ function childProcessEnv(strip, extra = {}) {
 // src/version.ts
 import { readFileSync } from "node:fs";
 function readPackageVersion() {
-  const metadata = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
-  if (typeof metadata !== "object" || metadata === null || !("version" in metadata) || typeof metadata.version !== "string") {
-    throw new Error("CLI package metadata is missing a valid version");
-  }
-  return metadata.version;
+  try {
+    const metadata = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof metadata === "object" && metadata !== null && "version" in metadata && typeof metadata.version === "string") {
+      return metadata.version;
+    }
+  } catch {}
+  return "0.0.0-embedded";
+}
+var cachedVersion = null;
+function cliVersion() {
+  cachedVersion ??= readPackageVersion();
+  return cachedVersion;
+}
+function userAgent() {
+  return `sim-cli/${cliVersion()} node/${process.versions.node} (${process.platform}; ${process.arch})`;
 }
-var CLI_VERSION = readPackageVersion();
-var USER_AGENT = `sim-cli/${CLI_VERSION} node/${process.versions.node} (${process.platform}; ${process.arch})`;
 
 // src/update/check.ts
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
@@ -7243,7 +7298,7 @@ async function fetchDistTags(env, request) {
     if (!url)
       return null;
     const text = await request(url, {
-      headers: { accept: "application/json", "user-agent": `${PACKAGE_NAME}-cli/${CLI_VERSION}` },
+      headers: { accept: "application/json", "user-agent": `${PACKAGE_NAME}-cli/${cliVersion()}` },
       maxResponseBytes: MAX_RESPONSE_BYTES,
       timeoutMs: REGISTRY_TIMEOUT_MS
     });
@@ -7315,7 +7370,7 @@ async function announceUpdateIfAvailable(options = {}) {
       return;
     if (isUnadvisableInstall(modulePath, env, cwd))
       return;
-    const currentVersion = options.currentVersion ?? CLI_VERSION;
+    const currentVersion = options.currentVersion ?? cliVersion();
     const current = parseStableVersion(currentVersion);
     if (!current)
       return;
@@ -7438,7 +7493,7 @@ function parseRegistryVersion(output, manager) {
 }
 async function installUpdate(options = {}) {
   const modulePath = resolveInstallationPath(options.modulePath ?? fileURLToPath2(import.meta.url));
-  const env = omit(options.env ?? process.env, ["SIM_API_KEY"]);
+  const env = { ...options.env ?? process.env, SIM_API_KEY: undefined };
   const normalized = modulePath.replaceAll("\\", "/").toLowerCase();
   if (env.npm_command === "exec" || normalized.includes("/_npx/") || normalized.includes("/bunx-") || !normalized.endsWith("/node_modules/sim/dist/index.js")) {
     throw new CliUpdateError("sim update requires a global installation. Update project dependencies with their package manager, or use sim@latest with your package runner.");
@@ -7449,7 +7504,7 @@ async function installUpdate(options = {}) {
   }
   const packageManager = manager;
   const run = options.run ?? runPackageManager;
-  const currentVersion = options.currentVersion ?? CLI_VERSION;
+  const currentVersion = options.currentVersion ?? cliVersion();
   const current = parseReleaseVersion(currentVersion);
   const target = current.channel;
   const write = options.write ?? ((message) => void process.stderr.write(message));
@@ -7516,7 +7571,7 @@ async function installUpdate(options = {}) {
 }
 // src/config/profile.ts
 var import_proper_lockfile2 = __toESM(require_proper_lockfile(), 1);
-import { AsyncLocalStorage } from "node:async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 import { createHash } from "node:crypto";
 import {
   chmodSync,
@@ -7850,7 +7905,7 @@ function readStoredCredential(profile) {
 var CREDENTIALS_LOCK_STALE_MS = 30000;
 var CREDENTIALS_LOCK_WAIT_MS = 20000;
 var CREDENTIALS_LOCK_POLL_MS = 50;
-var heldLock = new AsyncLocalStorage;
+var heldLock = new AsyncLocalStorage2;
 async function withProfileLoginLease(profile, work) {
   const digest = createHash("sha256").update(profile, "utf8").digest("hex");
   const path = `${credentialsPath()}.login-${digest}`;
@@ -7964,6 +8019,9 @@ function refuseBlankOverrides(overrides) {
   }
 }
 function resolveProfile(overrides = {}) {
+  const embedded = embeddedProfile();
+  if (embedded)
+    return embedded;
   refuseBlankOverrides(overrides);
   const named = overrides.profile || process.env.SIM_PROFILE;
   const name = named || DEFAULT_PROFILE;
@@ -8021,6 +8079,39 @@ function resolveProfile(overrides = {}) {
     }
   };
 }
+// src/output/io.ts
+import { format } from "node:util";
+function printLine(...args) {
+  const context = embedStore.getStore();
+  if (context)
+    context.stdout.write(`${format(...args)}
+`);
+  else
+    console.log(...args);
+}
+function printError(...args) {
+  const context = embedStore.getStore();
+  if (context)
+    context.stderr.write(`${format(...args)}
+`);
+  else
+    console.error(...args);
+}
+function writeStdout(chunk) {
+  const context = embedStore.getStore();
+  if (!context)
+    return process.stdout.write(chunk);
+  context.stdout.write(chunk);
+  return true;
+}
+function writeStderr(chunk) {
+  const context = embedStore.getStore();
+  if (!context)
+    return process.stderr.write(chunk);
+  context.stderr.write(chunk);
+  return true;
+}
+
 // ../utils/src/client-info.ts
 var CLIENT_INFO_HEADER = "x-sim-client-info";
 var SIM_SURFACES = ["web", "desktop", "cli", "sdk-js", "sdk-python"];
@@ -8192,12 +8283,12 @@ function clientInfoHeader(env = process.env) {
   return cached;
 }
 function identityHeaders() {
-  return { "user-agent": USER_AGENT, [CLIENT_INFO_HEADER]: clientInfoHeader() };
+  return { "user-agent": userAgent(), [CLIENT_INFO_HEADER]: clientInfoHeader() };
 }
 function buildClientInfoHeader(env) {
   return formatClientInfo({
     surface: "cli",
-    version: CLI_VERSION,
+    version: cliVersion(),
     runtime: { name: "node", version: process.versions.node },
     os: process.platform,
     arch: process.arch,
@@ -8214,7 +8305,7 @@ function once(key, message) {
   if (reported.has(key))
     return;
   reported.add(key);
-  process.stderr.write(`warning: ${message}
+  writeStderr(`warning: ${message}
 `);
 }
 var PROXY_VARIABLES = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
@@ -8406,7 +8497,7 @@ function debugEnabled(env = process.env) {
   return raw !== undefined && raw !== "" && raw !== "0" && raw.toLowerCase() !== "false";
 }
 function traceRequest(method, url, status, startedAt) {
-  process.stderr.write(`${source_default.dim(`[sim] ${method} ${url} → ${status} ${Math.round(performance.now() - startedAt)}ms`)}
+  writeStderr(`${styles3().dim(`[sim] ${method} ${url} → ${status} ${Math.round(performance.now() - startedAt)}ms`)}
 `);
 }
 function withoutLeadingLabel(message, label) {
@@ -8534,12 +8625,15 @@ class SimClient {
     warnIfCredentialOverCleartext(this.profile.endpoint, Boolean(credential));
     const timeoutMs = resolveTimeoutMs();
     const timeout = timeoutMs > 0 ? AbortSignal.timeout(timeoutMs) : undefined;
-    const signal = combineSignals(options.signal, timeout);
+    const caller = combineSignals(options.signal, this.profile.signal);
+    if (caller?.aborted)
+      throw new SimApiError("Request cancelled.", 0);
+    const signal = combineSignals(caller, timeout);
     const trace = debugEnabled();
     const startedAt = performance.now();
     let response;
     try {
-      response = await fetch(url, {
+      response = await (this.profile.transport ?? fetch)(url, {
         method,
         headers: {
           ...credential?.kind === "api_key" ? { "x-api-key": credential.apiKey } : {},
@@ -8556,7 +8650,7 @@ class SimClient {
     } catch (cause) {
       if (trace)
         traceRequest(method, url, "failed", startedAt);
-      if (options.signal?.aborted) {
+      if (caller?.aborted) {
         throw new SimApiError("Request cancelled.", 0);
       }
       if (timeout?.aborted) {
@@ -8615,14 +8709,14 @@ function pageProgress() {
   let reported = false;
   return {
     advance: (fetched) => {
-      if (!process.stderr.isTTY)
+      if (!hasProgressTerminal())
         return;
       reported = true;
-      process.stderr.write(`\r${source_default.dim(`fetched ${fetched}…`)}\x1B[K`);
+      writeStderr(`\r${styles3().dim(`fetched ${fetched}…`)}\x1B[K`);
     },
     finish: () => {
       if (reported)
-        process.stderr.write("\r\x1B[K");
+        writeStderr("\r\x1B[K");
     }
   };
 }
@@ -9046,7 +9140,6 @@ function isWideCodePoint(codePoint) {
 
 // src/output/render.ts
 var EMPTY_GLYPH = "—";
-var EMPTY = source_default.dim(EMPTY_GLYPH);
 var ESC = String.fromCharCode(27);
 var CONTROL_PATTERN = new RegExp([
   `${ESC}\\][^\\u0007${ESC}]*(?:\\u0007|${ESC}\\\\)?`,
@@ -9065,12 +9158,12 @@ function safeOneLine(value) {
 }
 function text(value) {
   if (value === null || value === undefined || value === "")
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   return sanitize(String(value));
 }
 function timestamp2(value) {
   if (!value)
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   const date = new Date(value);
   if (Number.isNaN(date.getTime()))
     return sanitize(String(value));
@@ -9078,12 +9171,12 @@ function timestamp2(value) {
 }
 function bool2(value) {
   if (value === null || value === undefined)
-    return EMPTY;
-  return value ? source_default.green("yes") : source_default.dim("no");
+    return styles3().dim(EMPTY_GLYPH);
+  return value ? styles3().green("yes") : styles3().dim("no");
 }
 function bytes(value) {
   if (value === null || value === undefined)
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   const units = ["B", "KB", "MB", "GB", "TB"];
   let size = value;
   let unit = 0;
@@ -9095,7 +9188,7 @@ function bytes(value) {
 }
 function duration(ms) {
   if (ms === null || ms === undefined)
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   if (ms < 1000)
     return `${Math.round(ms)}ms`;
   if (ms < 60000)
@@ -9126,11 +9219,11 @@ function clamp(value, width) {
 }
 function renderTable(rows, columns) {
   if (rows.length === 0)
-    return source_default.dim("No results.");
+    return styles3().dim("No results.");
   const headers = columns.map((column) => sanitize(column.header));
   const cells = rows.map((row) => columns.map((column) => clamp(oneLine(column.value(row)), MAX_CELL_WIDTH)));
   const widths = columns.map((_column, index) => Math.max(visibleWidth(headers[index]), ...cells.map((line) => visibleWidth(line[index]))));
-  const header = headers.map((label, index) => source_default.dim(pad(label.toUpperCase(), widths[index]))).join("  ").trimEnd();
+  const header = headers.map((label, index) => styles3().dim(pad(label.toUpperCase(), widths[index]))).join("  ").trimEnd();
   const body = cells.map((line) => line.map((cell, index) => pad(cell, widths[index])).join("  ").trimEnd());
   return [header, ...body].join(`
 `);
@@ -9145,36 +9238,36 @@ function renderMachine(format, raw) {
 function printList(format, rows, columns, raw = rows) {
   const machine = renderMachine(format, raw);
   if (machine !== null) {
-    console.log(machine);
+    printLine(machine);
     return;
   }
   if (format === "text") {
     for (const row of rows) {
-      console.log(columns.map((column) => oneLine(stripAnsi(column.value(row)))).join("\t"));
+      printLine(columns.map((column) => oneLine(stripAnsi(column.value(row)))).join("\t"));
     }
     return;
   }
-  console.log(renderTable(rows, columns));
+  printLine(renderTable(rows, columns));
 }
 function printDocument(format, raw) {
-  console.log(format === "yaml" ? renderMachine("yaml", raw) : JSON.stringify(raw, null, 2));
+  printLine(format === "yaml" ? renderMachine("yaml", raw) : JSON.stringify(raw, null, 2));
 }
 function printRecord(format, fields, raw) {
   const machine = renderMachine(format, raw);
   if (machine !== null) {
-    console.log(machine);
+    printLine(machine);
     return;
   }
   const safeFields = fields.map(([label, value]) => [safeOneLine(label), value]);
   if (format === "text") {
     for (const [label, value] of safeFields) {
-      console.log(`${label}	${oneLine(stripAnsi(value))}`);
+      printLine(`${label}	${oneLine(stripAnsi(value))}`);
     }
     return;
   }
   const width = Math.max(...safeFields.map(([label]) => visibleWidth(label)));
   for (const [label, value] of safeFields) {
-    console.log(`${source_default.dim(pad(`${label}:`, width + 1))}  ${clamp(oneLine(value), MAX_RECORD_WIDTH)}`);
+    printLine(`${styles3().dim(pad(`${label}:`, width + 1))}  ${clamp(oneLine(value), MAX_RECORD_WIDTH)}`);
   }
 }
 
@@ -9289,7 +9382,7 @@ async function pollForKey(endpoint, auth, signal) {
       consecutiveTransportFailures++;
       if (!warnedAboutTransport && consecutiveTransportFailures >= TRANSPORT_FAILURES_BEFORE_WARNING) {
         warnedAboutTransport = true;
-        process.stderr.write(`Still waiting: ${endpoint} is not answering the login poll (${cause.message}). Check the endpoint; retrying until you approve or the login times out.
+        writeStderr(`Still waiting: ${endpoint} is not answering the login poll (${cause.message}). Check the endpoint; retrying until you approve or the login times out.
 `);
       }
     }
@@ -9420,8 +9513,8 @@ var V2_OPERATIONS = {
       },
       outputColumns: {
         kind: "array",
-        required: true,
-        describe: "Columns created for producer outputs."
+        default: [],
+        describe: "Columns to create for producer outputs. An entry naming a column the table already has attaches that column to the group instead of creating it (its `type` must match), and an output whose column already exists may omit its entry entirely — so `[]` attaches existing columns only."
       },
       autoRun: {
         kind: "boolean",
@@ -9462,7 +9555,7 @@ var V2_OPERATIONS = {
     query: {
       dryRun: {
         kind: "boolean",
-        describe: "Validate and lint without persisting. The response is identical to the committed write of the same body, so a caller can inspect `lint` and then re-send the request for real. Nothing is written, no audit entry is recorded, and collaborators are not notified."
+        describe: "Validate and lint without writing, auditing, or notifying collaborators. Returns the same validation, preparation warnings, lint findings, and ID-ownership conflicts (`409`) as a committed write. `needsRedeployment` describes the pre-write state. For semantic operations, `mintedBlockIds` is empty; `previewBlockIds` contains provisional IDs with a warning, since committing mints new IDs."
       }
     },
     body: {
@@ -9507,7 +9600,7 @@ var V2_OPERATIONS = {
     summary: "Delete Files",
     body: {
       workspaceId: { kind: "string", required: true, describe: "Workspace containing the files." },
-      fileIds: { kind: "array", required: true, describe: "File identifiers to update." }
+      fileIds: { kind: "array", required: true, describe: "File identifiers to delete." }
     }
   },
   bulkDeleteTables: {
@@ -9725,7 +9818,7 @@ var V2_OPERATIONS = {
       rowId: { kind: "string", describe: "Row whose runs should be canceled for row scope." },
       filter: {
         kind: "unknown",
-        describe: "Recursive non-empty `all`/`any` groups containing groups or conditions; the root cannot be a condition. Limits: 100 members per group, 10 levels, and 500 nodes. The negating operators include nulls and absent cells, multi-select included; combine with `isNotNull` or `isNotEmpty` to exclude them. Pattern operators use `*` as the only wildcard; `%`, `_`, and backslash are literal. Select operators: single-select uses `eq`/`ne`/`in`/`nin`; multi-select uses `contains`/`ncontains`; option names resolve to IDs. Full operand rules are documented on `op`."
+        describe: "One condition or a recursive `all`/`any` group, normalized to a grouped predicate. Limits: 100 members per group, 10 levels, and 500 nodes. The negating operators include nulls and absent cells, multi-select included; combine with `isNotNull` or `isNotEmpty` to exclude them. Pattern operators use `*` as the only wildcard; `%`, `_`, and backslash are literal. Select operators: single-select uses `eq`/`ne`/`in`/`nin`; multi-select uses `contains`/`ncontains`; option names resolve to IDs. Full operand rules are documented on `op`."
       },
       excludeRowIds: { kind: "array", describe: "Rows excluded from an all-scope cancellation." }
     }
@@ -9756,6 +9849,11 @@ var V2_OPERATIONS = {
       conversationId: {
         kind: "string",
         describe: "Conversation to continue; a new one starts when omitted."
+      },
+      effort: {
+        kind: "enum",
+        values: ["low", "medium", "high", "xhigh", "max"],
+        describe: "Model effort for this turn; defaults to the deployment default (high)."
       }
     }
   },
@@ -10318,7 +10416,7 @@ var V2_OPERATIONS = {
       description: { kind: "string", describe: "Optional credential description." },
       id: {
         kind: "string",
-        describe: "Required only when provider discovery requests a client-generated ID."
+        describe: "Optional client-generated credential ID. The server mints one when it is omitted, so no provider requires it. A `slack-custom-bot` credential may supply one so its Slack Request URL, which embeds the ID, can be configured before the credential exists; every other provider ignores it."
       },
       credentials: {
         kind: "string",
@@ -10394,7 +10492,7 @@ var V2_OPERATIONS = {
       rowIds: { kind: "array", describe: "Explicit row subset to run." },
       filter: {
         kind: "unknown",
-        describe: "Recursive non-empty `all`/`any` groups containing groups or conditions; the root cannot be a condition. Limits: 100 members per group, 10 levels, and 500 nodes. The negating operators include nulls and absent cells, multi-select included; combine with `isNotNull` or `isNotEmpty` to exclude them. Pattern operators use `*` as the only wildcard; `%`, `_`, and backslash are literal. Select operators: single-select uses `eq`/`ne`/`in`/`nin`; multi-select uses `contains`/`ncontains`; option names resolve to IDs. Full operand rules are documented on `op`."
+        describe: "One condition or a recursive `all`/`any` group, normalized to a grouped predicate. Limits: 100 members per group, 10 levels, and 500 nodes. The negating operators include nulls and absent cells, multi-select included; combine with `isNotNull` or `isNotEmpty` to exclude them. Pattern operators use `*` as the only wildcard; `%`, `_`, and backslash are literal. Select operators: single-select uses `eq`/`ne`/`in`/`nin`; multi-select uses `contains`/`ncontains`; option names resolve to IDs. Full operand rules are documented on `op`."
       },
       excludeRowIds: { kind: "array", describe: "Rows excluded from a select-all run scope." },
       limit: { kind: "object", describe: "Optional cap on eligible rows to run." }
@@ -10928,7 +11026,7 @@ var V2_OPERATIONS = {
       workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
       filter: {
         kind: "unknown",
-        describe: "Recursive non-empty `all`/`any` groups containing groups or conditions; the root cannot be a condition. Limits: 100 members per group, 10 levels, and 500 nodes. The negating operators include nulls and absent cells, multi-select included; combine with `isNotNull` or `isNotEmpty` to exclude them. Pattern operators use `*` as the only wildcard; `%`, `_`, and backslash are literal. Select operators: single-select uses `eq`/`ne`/`in`/`nin`; multi-select uses `contains`/`ncontains`; option names resolve to IDs. Full operand rules are documented on `op`."
+        describe: "One condition or a recursive `all`/`any` group, normalized to a grouped predicate. Limits: 100 members per group, 10 levels, and 500 nodes. The negating operators include nulls and absent cells, multi-select included; combine with `isNotNull` or `isNotEmpty` to exclude them. Pattern operators use `*` as the only wildcard; `%`, `_`, and backslash are literal. Select operators: single-select uses `eq`/`ne`/`in`/`nin`; multi-select uses `contains`/`ncontains`; option names resolve to IDs. Full operand rules are documented on `op`."
       },
       limit: { kind: "integer", describe: "Maximum matching rows to delete." },
       rowIds: { kind: "array", describe: "Explicit row identifiers to delete." }
@@ -11177,7 +11275,7 @@ var V2_OPERATIONS = {
       },
       selectedOutputs: {
         kind: "array",
-        describe: "Output references for streaming: `<blockName>.<outputPath>` or `<childWorkflowId>.<blockName>.<outputPath>`, using normalized block names. Child references apply to every invocation. Requires `stream: true` and rejects synchronous or async requests. Use `selectedOutputs` with Get Workflow Run to narrow an existing run."
+        describe: "Select `<blockName>.<outputPath>` or `<childWorkflowId>.<blockName>.<outputPath>` using normalized block reference names. Child selectors cover every invocation. Synchronous results use selector strings verbatim as `blockOutputs` keys; streaming selections shape the envelope. Unknown block names or IDs return `400` with available blocks before execution. Unexecuted blocks and absent paths are omitted. Incompatible with `async`; select outputs from the finished run resource instead."
       },
       includeThinking: {
         kind: "boolean",
@@ -11239,6 +11337,10 @@ var V2_OPERATIONS = {
       includeReferences: {
         kind: "boolean",
         describe: "Include non-secret resource identifiers and source field occurrences for mapped imports."
+      },
+      includeWorkspaceBindings: {
+        kind: "boolean",
+        describe: "Whether to keep workspace-scoped bindings — table, knowledge base, document, folder, channel, and other resource selectors — in the exported state. Defaults to false, the sharing-safe export in which those ids are cleared because they resolve nowhere else. Send true for a same-workspace round trip so the re-imported workflow can run without re-selecting them. Credentials, passwords, and table sub-block values are cleared either way."
       }
     }
   },
@@ -11487,6 +11589,10 @@ var V2_OPERATIONS = {
         values: ["info", "error"],
         describe: "Severity level to include."
       },
+      includeHandledErrors: {
+        kind: "boolean",
+        describe: "Whether runs with a handled block error are counted as `handledErrorRuns`, and whether `level=error` also selects them. Off by default: counting them scans each run’s stored trace."
+      },
       startDate: {
         kind: "string",
         describe: "Only include runs started at or after this UTC ISO 8601 timestamp, e.g. `2026-08-06T00:00:00Z`. A date without a time, or a timestamp carrying a UTC offset instead of `Z`, is rejected, as is year `0000`, which names no storable instant."
@@ -11498,7 +11604,26 @@ var V2_OPERATIONS = {
       segmentCount: {
         kind: "integer",
         default: 72,
-        describe: "Number of time buckets, up to 500. Exactly this many are returned, each at least one minute wide. Short windows extend past the requested end and include empty trailing buckets."
+        describe: "Number of equal time buckets to divide the window into, from 1 to 500. It is the ceiling on how many buckets a series carries: with `includeEmpty=true` exactly this many are returned, otherwise only the buckets holding at least one run. Buckets are never narrower than one minute, so on a short window the series extends past the end of the window rather than being compressed, and the trailing buckets are empty."
+      },
+      includeEmpty: {
+        kind: "enum",
+        values: [
+          "true",
+          "1",
+          "yes",
+          "on",
+          "y",
+          "enabled",
+          "false",
+          "0",
+          "no",
+          "off",
+          "n",
+          "disabled"
+        ],
+        default: false,
+        describe: "Whether buckets with no runs are included in every series. Off by default, so each series carries only the buckets that hold at least one run; set it to publish exactly `segmentCount` buckets per series, empty ones included. The listed spellings are the whole accepted vocabulary and are case-sensitive; any other value is rejected."
       }
     }
   },
@@ -11556,7 +11681,7 @@ var V2_OPERATIONS = {
       groupId: "Workflow or enrichment group to run."
     },
     responseMode: "json",
-    summary: "Get Enrichment Run Detail",
+    summary: "Get Row Group Run",
     query: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." }
     }
@@ -12166,7 +12291,11 @@ var V2_OPERATIONS = {
       source: {
         kind: "enum",
         values: ["builtin", "custom"],
-        describe: "Restrict to built-in blocks or this workspace's deployed custom blocks."
+        describe: "Restrict to shipped blocks or to this workspace’s deployed custom blocks."
+      },
+      includeSunset: {
+        kind: "boolean",
+        describe: "Include `legacy` and `deprecated` blocks. Off by default: a sunset block keeps executing where it is already placed, but it is not offered for new authoring. Each returned entry carries `sunset.replacedBy`, the block to build with instead."
       },
       sortBy: {
         kind: "enum",
@@ -12243,6 +12372,21 @@ var V2_OPERATIONS = {
       search: {
         kind: "string",
         describe: "Case-insensitive substring match against the connector name."
+      },
+      detail: {
+        kind: "enum",
+        values: ["summary", "full"],
+        default: "summary",
+        describe: "Projection of each item. `summary` (the default) carries the identifier, name, description, and auth mode; `full` adds the version, the complete auth settings, the `sourceConfig` field schema, incremental-sync support, and tag definitions."
+      },
+      limit: {
+        kind: "integer",
+        default: 25,
+        describe: "Maximum connector types to return per page. Must be a whole number from 1 to 100. Defaults to 25."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
       }
     }
   },
@@ -12844,6 +12988,10 @@ var V2_OPERATIONS = {
         kind: "string",
         describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
       },
+      includeHandledErrors: {
+        kind: "boolean",
+        describe: "Whether `level=error` also selects runs that finished at `info` after a block error was recovered by an error path. Off by default: such a run succeeded, so it is an error only to a caller auditing error handling. Every row reports `hasHandledErrors` whether or not this is set. Job runs carry no block trace, so the flag never widens that branch."
+      },
       status: {
         kind: "string",
         describe: "Comma-separated execution statuses to include, from `pending` | `running` | `paused` | `redacting` | `completed` | `failed` | `cancelled`. An empty entry is rejected. ANDed with `level`, which reports severity rather than lifecycle."
@@ -13218,7 +13366,7 @@ var V2_OPERATIONS = {
     pathParams: ["tableId"],
     pathParamDocs: { tableId: "Unique table identifier." },
     responseMode: "json",
-    summary: "List Active Run Dispatches",
+    summary: "List Run Dispatches",
     query: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." }
     }
@@ -13731,8 +13879,8 @@ var V2_OPERATIONS = {
       },
       limit: {
         kind: "integer",
-        default: 50,
-        describe: "Maximum workspaces to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+        default: 25,
+        describe: "Maximum workspaces to return per page. Must be a whole number from 1 to 100. Defaults to 25."
       },
       cursor: {
         kind: "string",
@@ -14071,7 +14219,9 @@ var V2_OPERATIONS = {
     method: "GET",
     path: "/api/v2/files/[fileId]/text",
     pathParams: ["fileId"],
-    pathParamDocs: { fileId: "File identifier." },
+    pathParamDocs: {
+      fileId: "File identifier, or the file’s VFS path: `files/<folder>/<name>`, or `uploads/<name>` for a Chat upload."
+    },
     responseMode: "json",
     summary: "Read File Text",
     query: {
@@ -14102,7 +14252,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -14118,7 +14268,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -14134,7 +14284,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -14150,7 +14300,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -14230,7 +14380,7 @@ var V2_OPERATIONS = {
     query: {
       dryRun: {
         kind: "boolean",
-        describe: "Validate and lint without persisting. The response is identical to the committed write of the same body, so a caller can inspect `lint` and then re-send the request for real. Nothing is written, no audit entry is recorded, and collaborators are not notified."
+        describe: "Validate and lint without writing, auditing, or notifying collaborators. Returns the same validation, preparation warnings, lint findings, and ID-ownership conflicts (`409`) as a committed write. `needsRedeployment` describes the pre-write state. For semantic operations, `mintedBlockIds` is empty; `previewBlockIds` contains provisional IDs with a warning, since committing mints new IDs."
       }
     },
     body: {
@@ -14539,7 +14689,7 @@ var V2_OPERATIONS = {
       q: { kind: "string", required: true, describe: "Case-insensitive cell substring to find." },
       predicate: {
         kind: "unknown",
-        describe: "Recursive non-empty `all`/`any` groups containing groups or conditions; the root cannot be a condition. Limits: 100 members per group, 10 levels, and 500 nodes. The negating operators include nulls and absent cells, multi-select included; combine with `isNotNull` or `isNotEmpty` to exclude them. Pattern operators use `*` as the only wildcard; `%`, `_`, and backslash are literal. Select operators: single-select uses `eq`/`ne`/`in`/`nin`; multi-select uses `contains`/`ncontains`; option names resolve to IDs. Full operand rules are documented on `op`."
+        describe: "One condition or a recursive `all`/`any` group, normalized to a grouped predicate. Limits: 100 members per group, 10 levels, and 500 nodes. The negating operators include nulls and absent cells, multi-select included; combine with `isNotNull` or `isNotEmpty` to exclude them. Pattern operators use `*` as the only wildcard; `%`, `_`, and backslash are literal. Select operators: single-select uses `eq`/`ne`/`in`/`nin`; multi-select uses `contains`/`ncontains`; option names resolve to IDs. Full operand rules are documented on `op`."
       },
       sort: { kind: "array", describe: "Ordered table-row sort specification." }
     }
@@ -15002,7 +15152,7 @@ var V2_OPERATIONS = {
       filter: {
         kind: "unknown",
         required: true,
-        describe: "Recursive non-empty `all`/`any` groups containing groups or conditions; the root cannot be a condition. Limits: 100 members per group, 10 levels, and 500 nodes. The negating operators include nulls and absent cells, multi-select included; combine with `isNotNull` or `isNotEmpty` to exclude them. Pattern operators use `*` as the only wildcard; `%`, `_`, and backslash are literal. Select operators: single-select uses `eq`/`ne`/`in`/`nin`; multi-select uses `contains`/`ncontains`; option names resolve to IDs. Full operand rules are documented on `op`."
+        describe: "One condition or a recursive `all`/`any` group, normalized to a grouped predicate. Limits: 100 members per group, 10 levels, and 500 nodes. The negating operators include nulls and absent cells, multi-select included; combine with `isNotNull` or `isNotEmpty` to exclude them. Pattern operators use `*` as the only wildcard; `%`, `_`, and backslash are literal. Select operators: single-select uses `eq`/`ne`/`in`/`nin`; multi-select uses `contains`/`ncontains`; option names resolve to IDs. Full operand rules are documented on `op`."
       },
       data: {
         kind: "object",
@@ -15466,10 +15616,10 @@ async function chooseWorkspace(client) {
   if (workspaces.length > MAX_INTERACTIVE_WORKSPACES) {
     throw new SimApiError(`The active credential can access more than ${MAX_INTERACTIVE_WORKSPACES} workspaces, which is too many to show interactively. Pass --workspace <id> instead.`, 0);
   }
-  console.log(`
+  printLine(`
 Available workspaces:`);
   for (const [index, workspace] of workspaces.entries()) {
-    console.log(`  ${index + 1}) ${safeOneLine(workspace.name)} (${workspace.id})`);
+    printLine(`  ${index + 1}) ${safeOneLine(workspace.name)} (${workspace.id})`);
   }
   const prompt = createInterface({ input: process.stdin, output: process.stderr });
   try {
@@ -15504,10 +15654,10 @@ function addProfileCommand() {
         workspace: normalizedWorkspaceId
       });
     });
-    console.log(source_default.green(`✓ Added profile "${safeOneLine(profileName)}" in ${configPath()}`));
-    console.log(`  Workspace: ${safeOneLine(workspace.name)} (${workspace.id})`);
-    console.log(`  Authentication: ${safeOneLine(authProfile)}`);
-    console.log(source_default.dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`));
+    printLine(styles3().green(`✓ Added profile "${safeOneLine(profileName)}" in ${configPath()}`));
+    printLine(`  Workspace: ${safeOneLine(workspace.name)} (${workspace.id})`);
+    printLine(`  Authentication: ${safeOneLine(authProfile)}`);
+    printLine(styles3().dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`));
   });
 }
 async function chooseLoginFlow(profile, options) {
@@ -15515,7 +15665,7 @@ async function chooseLoginFlow(profile, options) {
   if (options.method === "api-key")
     return "handoff";
   if (options.method === undefined && isLikelyRemoteSession() && options.callbackPort === undefined) {
-    console.log(source_default.dim(`This looks like a remote session; using the pairing code to create a personal API key. To use OAuth, forward a port and pass --method oauth --callback-port <port>.
+    printLine(styles3().dim(`This looks like a remote session; using the pairing code to create a personal API key. To use OAuth, forward a port and pass --method oauth --callback-port <port>.
 `));
     return "handoff";
   }
@@ -15527,7 +15677,7 @@ async function chooseLoginFlow(profile, options) {
     if (options.method === "oauth") {
       throw new SimApiError(`${profile.endpoint} does not offer OAuth sign-in. Enable OAuth on the server or explicitly choose sim login --method api-key.`, 0);
     }
-    console.log(source_default.dim(`${profile.endpoint} does not offer OAuth sign-in; using the pairing code to create a personal API key.
+    printLine(styles3().dim(`${profile.endpoint} does not offer OAuth sign-in; using the pairing code to create a personal API key.
 `));
     return "handoff";
   }
@@ -15543,16 +15693,16 @@ function parseCallbackPort(value) {
   return port;
 }
 async function loginWithOAuth(profile, options, callbackPort, expected) {
-  console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(safeOneLine(profile.name))}`);
+  printLine(`Signing in to ${styles3().bold(profile.endpoint)} as profile ${styles3().bold(safeOneLine(profile.name))}`);
   const tokens = await loginWithBrowser(profile.endpoint, {
     scopes: options.readOnly ? OAUTH_SCOPES_READ_ONLY : OAUTH_SCOPES_FULL,
     callbackPort,
     onAuthorizeUrl: (url) => {
-      console.log(`
+      printLine(`
 ${url}`);
       if (options.browser)
         openBrowser(url);
-      console.log(source_default.dim(`
+      printLine(styles3().dim(`
 Waiting for you to approve in the browser…`));
     }
   });
@@ -15584,7 +15734,7 @@ Waiting for you to approve in the browser…`));
           try {
             writeCredentialsProfile(profile.name, null);
           } catch {}
-          console.log(source_default.yellow(`Could not restore the previous profile safely (${safeOneLine(getErrorMessage(rollbackError))}). Its local login was cleared to avoid using it against the wrong endpoint. The new server login will still be revoked.`));
+          printLine(styles3().yellow(`Could not restore the previous profile safely (${safeOneLine(getErrorMessage(rollbackError))}). Its local login was cleared to avoid using it against the wrong endpoint. The new server login will still be revoked.`));
         }
         throw error;
       }
@@ -15593,15 +15743,15 @@ Waiting for you to approve in the browser…`));
     try {
       await revokeToken(profile.endpoint, tokens.refreshToken);
     } catch (revocationError) {
-      console.log(source_default.yellow(`Could not revoke the uncommitted login (${safeOneLine(getErrorMessage(revocationError))}). Revoke Sim CLI in Settings → General → Authorized apps.`));
+      printLine(styles3().yellow(`Could not revoke the uncommitted login (${safeOneLine(getErrorMessage(revocationError))}). Revoke Sim CLI in Settings → General → Authorized apps.`));
     }
     throw error;
   }
-  console.log(source_default.green(`
+  printLine(styles3().green(`
 ✓ Logged in. Login stored in ${credentialsPath()}`));
-  console.log(source_default.dim(grantsWriteAccess(tokens.scope) ? "  Renews itself; revoke it any time in Settings → General → Authorized apps, or with: sim logout" : "  Read-only login — commands that change anything will be refused."));
+  printLine(styles3().dim(grantsWriteAccess(tokens.scope) ? "  Renews itself; revoke it any time in Settings → General → Authorized apps, or with: sim logout" : "  Read-only login — commands that change anything will be refused."));
   if (!profile.workspaceId) {
-    console.log(source_default.dim("  No default workspace. Set one with: sim configure --set-workspace <id>"));
+    printLine(styles3().dim("  No default workspace. Set one with: sim configure --set-workspace <id>"));
   }
 }
 function loginCommand() {
@@ -15619,7 +15769,7 @@ function loginCommand() {
     if (storedCredential && !options.yes) {
       const confirmed = await confirmProfileOverwrite(profile.name);
       if (!confirmed) {
-        console.log(source_default.dim("Login cancelled; the existing profile was not changed."));
+        printLine(styles3().dim("Login cancelled; the existing profile was not changed."));
         return;
       }
     }
@@ -15646,15 +15796,15 @@ function loginCommand() {
 async function loginWithHandoff(profile, options, expected) {
   const auth = createAuthRequest();
   const url = buildApprovalUrl(profile.endpoint, auth, profile.workspaceId ?? undefined);
-  console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(safeOneLine(profile.name))}`);
-  console.log(`
-Pairing code: ${source_default.bold(auth.pairing)}`);
-  console.log(source_default.dim(`Confirm this code matches what the browser shows before approving.
+  printLine(`Signing in to ${styles3().bold(profile.endpoint)} as profile ${styles3().bold(safeOneLine(profile.name))}`);
+  printLine(`
+Pairing code: ${styles3().bold(auth.pairing)}`);
+  printLine(styles3().dim(`Confirm this code matches what the browser shows before approving.
 `));
-  console.log(url);
+  printLine(url);
   if (options.browser)
     openBrowser(url);
-  console.log(source_default.dim(`
+  printLine(styles3().dim(`
 Waiting for approval…`));
   const key = await pollForKey(profile.endpoint, auth);
   try {
@@ -15683,24 +15833,24 @@ Waiting for approval…`));
           try {
             writeCredentialsProfile(profile.name, null);
           } catch {}
-          console.log(source_default.yellow(`Could not restore the previous profile safely (${safeOneLine(getErrorMessage(rollbackError))}). Its local login was cleared to avoid using it against the wrong endpoint.`));
+          printLine(styles3().yellow(`Could not restore the previous profile safely (${safeOneLine(getErrorMessage(rollbackError))}). Its local login was cleared to avoid using it against the wrong endpoint.`));
         }
         throw error;
       }
     });
   } catch (error) {
     const keyId = typeof key.id === "string" && key.id ? safeOneLine(key.id) : "unknown";
-    console.log(source_default.yellow(`API key ${keyId} was created but could not be stored safely. Revoke it in Settings → API keys.`));
+    printLine(styles3().yellow(`API key ${keyId} was created but could not be stored safely. Revoke it in Settings → API keys.`));
     throw error;
   }
-  console.log(source_default.green(`
+  printLine(styles3().green(`
 ✓ Logged in. Key stored in ${credentialsPath()}`));
   if (key.workspaceBound && key.workspaceId) {
-    console.log(source_default.dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
+    printLine(styles3().dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
   } else if (key.workspaceId) {
-    console.log(source_default.dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
+    printLine(styles3().dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
   } else {
-    console.log(source_default.dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
+    printLine(styles3().dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
   }
 }
 async function revokeStoredOAuth(credential) {
@@ -15718,9 +15868,9 @@ async function revokeStoredOAuth(credential) {
     const endpoint = issuer.toString().replace(/\/$/, "");
     displayEndpoint = safeOneLine(endpoint);
     await revokeToken(endpoint, credential.refreshToken);
-    console.log(source_default.dim("  Signed out of Sim; every token from this login was revoked."));
+    printLine(styles3().dim("  Signed out of Sim; every token from this login was revoked."));
   } catch (error) {
-    console.log(source_default.yellow(`  Could not revoke the login on ${displayEndpoint} (${safeOneLine(getErrorMessage(error))}). Revoke it in Settings → General → Authorized apps.`));
+    printLine(styles3().yellow(`  Could not revoke the login on ${displayEndpoint} (${safeOneLine(getErrorMessage(error))}). Revoke it in Settings → General → Authorized apps.`));
   }
 }
 function logoutCommand() {
@@ -15739,12 +15889,12 @@ function logoutCommand() {
         return { removed: deleteProfile(profileName), credential };
       });
       if (!removed.config && !removed.credentials) {
-        console.log(source_default.dim(`Nothing stored for profile "${safeOneLine(profileName)}".`));
+        printLine(styles3().dim(`Nothing stored for profile "${safeOneLine(profileName)}".`));
         return;
       }
-      console.log(source_default.green(`✓ Removed profile "${safeOneLine(profileName)}".`));
+      printLine(styles3().green(`✓ Removed profile "${safeOneLine(profileName)}".`));
       if (credential?.kind === "api_key") {
-        console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
+        printLine(styles3().dim("  The key itself is still active — revoke it in Settings → API keys."));
       }
       return;
     }
@@ -15764,12 +15914,12 @@ function logoutCommand() {
       return credential;
     });
     if (!credential) {
-      console.log(source_default.dim(`No stored login for profile "${safeOneLine(profileName)}".`));
+      printLine(styles3().dim(`No stored login for profile "${safeOneLine(profileName)}".`));
       return;
     }
-    console.log(source_default.green(`✓ Removed the stored login for profile "${safeOneLine(profileName)}".`));
+    printLine(styles3().green(`✓ Removed the stored login for profile "${safeOneLine(profileName)}".`));
     if (credential.kind === "api_key") {
-      console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
+      printLine(styles3().dim("  The key itself is still active — revoke it in Settings → API keys."));
     }
   });
 }
@@ -15831,18 +15981,18 @@ function presentVerification(verification) {
   if (verification.status === "verified") {
     const { name, memberCount } = verification.workspace;
     const members = `${memberCount} ${memberCount === 1 ? "member" : "members"}`;
-    return `${source_default.green("✓")} ${safeOneLine(name)} · ${members}`;
+    return `${styles3().green("✓")} ${safeOneLine(name)} · ${members}`;
   }
   const detail = safeOneLine(verification.detail);
   switch (verification.status) {
     case "rejected":
-      return `${source_default.red("✗")} ${detail}`;
+      return `${styles3().red("✗")} ${detail}`;
     case "unauthenticated":
-      return source_default.yellow(`not logged in — ${detail}`);
+      return styles3().yellow(`not logged in — ${detail}`);
     case "disabled":
-      return source_default.dim(detail);
+      return styles3().dim(detail);
     default:
-      return source_default.yellow(`could not check — ${detail}`);
+      return styles3().yellow(`could not check — ${detail}`);
   }
 }
 function whoamiCommand() {
@@ -15856,17 +16006,17 @@ function whoamiCommand() {
       keyType: null,
       detail: "not checked (--no-verify)"
     };
-    const annotate = (value, source) => source === "unset" ? source_default.dim("not set") : `${value} ${source_default.dim(`(${source})`)}`;
+    const annotate = (value, source) => source === "unset" ? styles3().dim("not set") : `${value} ${styles3().dim(`(${source})`)}`;
     printRecord(profile.output, [
       ["Profile", profile.name],
       ["Endpoint", annotate(profile.endpoint, sources.endpoint)],
       [
         "Login",
-        authentication.authenticated ? annotate(profile.oauth ? "OAuth" : "API key", authentication.source) : source_default.yellow("not logged in")
+        authentication.authenticated ? annotate(profile.oauth ? "OAuth" : "API key", authentication.source) : styles3().yellow("not logged in")
       ],
       [
         "Key type",
-        verification.keyType ?? source_default.dim(options.verify ? "unknown" : "not checked (--no-verify)")
+        verification.keyType ?? styles3().dim(options.verify ? "unknown" : "not checked (--no-verify)")
       ],
       ["Workspace", annotate(profile.workspaceId ?? "", sources.workspaceId)],
       ["Output", annotate(profile.output, sources.output)],
@@ -15892,15 +16042,15 @@ function whoamiCommand() {
     });
     const exitCode = WHOAMI_EXIT_CODES[verification.status];
     if (exitCode !== 0)
-      process.exitCode = exitCode;
+      setSoftExitCode(exitCode);
   });
 }
 var PROFILE_COLUMNS = [
-  { header: "", value: (row) => row.active ? source_default.green("*") : " " },
+  { header: "", value: (row) => row.active ? styles3().green("*") : " " },
   { header: "profile", value: (row) => safeOneLine(row.name) },
   { header: "key", value: (row) => row.error ? text(null) : row.hasKey ? "yes" : "no" },
   { header: "auth", value: (row) => row.authProfile ? safeOneLine(row.authProfile) : text(null) },
-  { header: "error", value: (row) => row.error ? source_default.red(safeOneLine(row.error)) : text(null) }
+  { header: "error", value: (row) => row.error ? styles3().red(safeOneLine(row.error)) : text(null) }
 ];
 function buildProfileRow(name, active) {
   try {
@@ -15947,7 +16097,7 @@ function profilesCommand() {
     const rows = listProfiles().map((name) => buildProfileRow(name, name === activeName));
     if (rows.length === 0) {
       if (output === "table")
-        console.log(source_default.dim("No profiles yet. Run: sim login"));
+        printLine(styles3().dim("No profiles yet. Run: sim login"));
       else
         printList(output, rows, PROFILE_COLUMNS);
       return;
@@ -16020,11 +16170,11 @@ function configureCommand() {
     if (Object.keys(updates).length === 0) {
       const current = readConfigProfile(profile.name);
       if (Object.keys(current).length === 0) {
-        console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+        printLine(styles3().dim(`No settings stored for profile "${profile.name}".`));
         return;
       }
       for (const [key, value] of Object.entries(current)) {
-        console.log(`${source_default.dim(`${key}:`)} ${value}`);
+        printLine(`${styles3().dim(`${key}:`)} ${value}`);
       }
       return;
     }
@@ -16049,10 +16199,10 @@ function configureCommand() {
       return true;
     });
     if (!changed) {
-      console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+      printLine(styles3().dim(`No settings stored for profile "${profile.name}".`));
       return;
     }
-    console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
+    printLine(styles3().green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
   });
 }
 
@@ -16276,7 +16426,7 @@ var CLI_CONTRACT = {
   },
   deleteTableView: { confirm: "This deletes the saved view and its filters." },
   deleteWorkflowGroup: {
-    confirm: "This deletes the group, every column it fed, and the values in them.",
+    confirm: "This deletes the group AND its output columns with all of their row data; the workflow it pointed at is untouched.",
     fields: [
       { header: "id" },
       { header: "deleted", format: "bool" },
@@ -16396,7 +16546,7 @@ var CLI_CONTRACT = {
   },
   applyWorkflowOperations: {
     command: "workflows operations apply",
-    confirm: "This edits the draft graph, and a delete operation removes blocks and their edges.",
+    confirm: "This edits the draft graph: the batch adds, edits, or deletes blocks and their edges as written.",
     flags: {
       operations: { json: true, describe: WORKFLOW_OPERATIONS_HELP },
       setBlockEnabled: { json: true, describe: WORKFLOW_SET_BLOCK_ENABLED_HELP }
@@ -17248,7 +17398,7 @@ var CLI_CONTRACT = {
       selectedOutputs: {
         name: "select-output",
         list: true,
-        describe: "Return streamed outputs as blockName.path or childWorkflowId.blockName.path; selecting a child workflow applies to every invocation, requires --follow"
+        describe: "Return blockName.path values (e.g. agent_1.content), or childWorkflowId.blockName.path for a child workflow (applies to every invocation) — in blockOutputs on a sync run, or from the streamed result with --follow; missing paths are omitted. Not available with --async"
       },
       stream: { omit: true },
       includeThinking: { omit: true },
@@ -17272,7 +17422,7 @@ var CLI_CONTRACT = {
       selectedOutputs: {
         name: "select-output",
         list: true,
-        describe: "Include blockId or blockId.path values in JSON or YAML output; block names are not resolved on a finished run"
+        describe: "Include blockName.path or blockId.path values (e.g. agent_1.content) in JSON or YAML output; names resolve against the workflow’s current blocks, and missing paths are omitted"
       }
     },
     fields: [
@@ -17378,6 +17528,22 @@ function camel(flag) {
   return flag.replace(/-([a-z])/g, (_match, character) => character.toUpperCase());
 }
 
+// src/output/truncation.ts
+var TRUNCATION_FLAG = /^truncated$|^[A-Za-z0-9]+Truncated$/;
+var NEGATED_TRUNCATION_FLAG = /^(?:not|un|non|never)Truncated$|(?:Not|Un|Non|Never)Truncated$/;
+function isTruncationField(key) {
+  return TRUNCATION_FLAG.test(key) && !NEGATED_TRUNCATION_FLAG.test(key);
+}
+function truncationMetadata(container) {
+  if (!container || typeof container !== "object" || Array.isArray(container))
+    return {};
+  const metadata = {};
+  for (const [key, value] of Object.entries(container))
+    if (typeof value === "boolean" && isTruncationField(key))
+      metadata[key] = value;
+  return metadata;
+}
+
 // src/output/trace.ts
 function traceSpan(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -17480,13 +17646,13 @@ function renderSpan(value, depth) {
 function printTraceSpans(format, traceSpans) {
   if (format === "json" || format === "yaml")
     return;
-  console.log("");
-  console.log(format === "table" ? source_default.dim("trace:") : "trace:");
+  printLine("");
+  printLine(format === "table" ? styles3().dim("trace:") : "trace:");
   if (traceSpans.length === 0) {
-    console.log(source_default.dim("  No trace spans."));
+    printLine(styles3().dim("  No trace spans."));
     return;
   }
-  console.log(traceSpans.flatMap((span) => renderSpan(span, 0)).join(`
+  printLine(traceSpans.flatMap((span) => renderSpan(span, 0)).join(`
 `));
 }
 
@@ -17650,20 +17816,9 @@ function writePageNote(spec, envelope) {
   const value = at(envelope, spec.pageNote.path);
   if (value === undefined || value === null)
     return;
-  process.stderr.write(source_default.dim(`${spec.pageNote.label}: ${String(value)}
+  writeStderr(styles3().dim(`${spec.pageNote.label}: ${String(value)}
 `));
 }
-var TRUNCATION_FLAG = /^truncated$|^[A-Za-z0-9]+Truncated$/;
-var NEGATED_TRUNCATION_FLAG = /^(?:not|un|non|never)Truncated$|(?:Not|Un|Non|Never)Truncated$/;
-function truncationMetadata(container) {
-  if (!container || typeof container !== "object" || Array.isArray(container))
-    return {};
-  const metadata = {};
-  for (const [key, value] of Object.entries(container))
-    if (typeof value === "boolean" && TRUNCATION_FLAG.test(key) && !NEGATED_TRUNCATION_FLAG.test(key))
-      metadata[key] = value;
-  return metadata;
-}
 function truncationFlags(container) {
   return Object.entries(truncationMetadata(container)).filter(([, value]) => value).map(([key]) => key);
 }
@@ -17689,7 +17844,7 @@ function clippedSubject(flag) {
 }
 function writeEnvelopeTruncation(envelope) {
   for (const flag of responseTruncationFlags(envelope)) {
-    process.stderr.write(source_default.dim(`${spellOut(flag)}: the server clipped ${clippedSubject(flag)}, so the answer is incomplete
+    writeStderr(styles3().dim(`${spellOut(flag)}: the server clipped ${clippedSubject(flag)}, so the answer is incomplete
 `));
   }
 }
@@ -17699,7 +17854,7 @@ function renderResult(operation, format, raw, spec, options = {}, envelope) {
     printDocument(format, raw);
     return;
   }
-  const data = unwrapResource(raw);
+  const data = format === "json" || format === "yaml" ? raw : unwrapResource(raw);
   if (spec.itemsPath) {
     const items = at(data, spec.itemsPath);
     if (!Array.isArray(items)) {
@@ -17821,6 +17976,87 @@ function attachWorkspaceOperationWait(operations) {
 
 // src/runtime/request.ts
 import { closeSync as closeSync2, existsSync as existsSync2, fstatSync as fstatSync2, openSync as openSync2, readSync as readSync2 } from "node:fs";
+
+// src/transfer/local-file.ts
+import { constants as constants2 } from "node:fs";
+import { access, stat } from "node:fs/promises";
+import { basename } from "node:path";
+function embeddedFileKey(path) {
+  return path.startsWith("@") ? path.slice(1) : path;
+}
+async function embeddedFileContent(embedded, path) {
+  const key = embeddedFileKey(path);
+  embedded.identity.signal?.throwIfAborted();
+  if (!embedded.readFile)
+    throw new SimApiError("This invocation has no machine to read from", 0);
+  const content = await embedded.readFile(key);
+  embedded.identity.signal?.throwIfAborted();
+  return typeof content === "string" ? content : new Uint8Array(content);
+}
+var CONTENT_TYPES = {
+  css: "text/css",
+  csv: "text/csv",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  gif: "image/gif",
+  html: "text/html",
+  htm: "text/html",
+  jpeg: "image/jpeg",
+  jpg: "image/jpeg",
+  js: "text/javascript",
+  json: "application/json",
+  jsonl: "application/jsonl",
+  md: "text/markdown",
+  pdf: "application/pdf",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  png: "image/png",
+  svg: "image/svg+xml",
+  txt: "text/plain",
+  webp: "image/webp",
+  yaml: "application/yaml",
+  yml: "application/yaml",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  zip: "application/zip"
+};
+function contentTypeFor(name) {
+  const dot = name.lastIndexOf(".");
+  const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
+  return CONTENT_TYPES[extension] ?? "application/octet-stream";
+}
+async function localFile(path, override) {
+  const embedded = embedStore.getStore();
+  if (embedded) {
+    embedded.identity.signal?.throwIfAborted();
+    if (!embedded.openFile)
+      throw new SimApiError("This invocation has no machine to read from", 0);
+    const { size } = await embedded.openFile(embeddedFileKey(path));
+    embedded.identity.signal?.throwIfAborted();
+    if (!Number.isSafeInteger(size) || size < 0)
+      throw new SimApiError("Invalid file size", 0);
+    if (size === 0)
+      throw new SimApiError(`${path} is empty`, 0);
+    return { name: override ?? basename(embeddedFileKey(path)), size };
+  }
+  let size;
+  try {
+    const stats = await stat(path);
+    if (!stats.isFile())
+      throw new SimApiError(`${path} is not a regular file`, 0);
+    await access(path, constants2.R_OK);
+    size = stats.size;
+  } catch (error) {
+    if (error instanceof SimApiError)
+      throw error;
+    throw new SimApiError(`Cannot read ${path}: ${error.message}`, 0);
+  }
+  if (size === 0)
+    throw new SimApiError(`${path} is empty`, 0);
+  return { name: override ?? basename(path), size };
+}
+
+// src/runtime/request.ts
 var PROFILE_INJECTED_FIELD = "workspaceId";
 function isProfileWorkspacePath(commandSpec, param) {
   return commandSpec.profileWorkspacePath === true && param === PROFILE_INJECTED_FIELD;
@@ -17907,13 +18143,25 @@ function readArgumentDescriptor(descriptor) {
 function literalAtHint(error, path) {
   return error?.code === "ENOENT" ? `. To pass the literal value @${path}, write @@${path}` : "";
 }
-function readArgumentSource(raw, flagName) {
+async function readArgumentSource(raw, flagName) {
   if (Buffer.byteLength(raw, "utf8") > MAX_JSON_ARGUMENT_BYTES)
     throw new SimApiError(`--${flagName} exceeds the 10 MiB JSON input limit`, 0);
   if (raw.startsWith("@@"))
     return { text: raw.slice(1), from: "" };
   if (!raw.startsWith("@"))
     return { text: raw, from: "" };
+  const embedded = embedStore.getStore();
+  if (embedded) {
+    if (raw === "@-")
+      throw new SimApiError(`--${flagName}: this invocation has no stdin; use @path or an inline value`, 0);
+    const content = await embeddedFileContent(embedded, raw);
+    if (Buffer.byteLength(content) > MAX_JSON_ARGUMENT_BYTES)
+      throw new SimApiError(`--${flagName} exceeds the 10 MiB JSON input limit`, 0);
+    return {
+      text: typeof content === "string" ? content : new TextDecoder("utf-8", { fatal: true }).decode(content),
+      from: " (read from your machine)"
+    };
+  }
   const path = raw.slice(1);
   if (path === "-") {
     if (process.stdin.isTTY) {
@@ -17942,15 +18190,18 @@ function isManifestNoise(line) {
   const trimmed = line.trim();
   return trimmed === "" || trimmed.startsWith("#");
 }
-function readListValues(raw, flagName, manifest = false) {
+async function readListValues(raw, flagName, manifest = false) {
   const arguments_ = Array.isArray(raw) ? raw : [raw];
-  const values = arguments_.flatMap((argument) => {
+  const values = [];
+  for (const argument of arguments_) {
     if (typeof argument !== "string") {
       throw new SimApiError(`--${flagName} values must be strings`, 0);
     }
-    if (!argument.startsWith("@"))
-      return [argument];
-    const source = readArgumentSource(argument, flagName);
+    if (!argument.startsWith("@")) {
+      values.push(argument);
+      continue;
+    }
+    const source = await readArgumentSource(argument, flagName);
     const lines = source.text.split(/\r?\n/);
     if (lines.at(-1) === "")
       lines.pop();
@@ -17958,14 +18209,14 @@ function readListValues(raw, flagName, manifest = false) {
     if (kept.length === 0) {
       throw new SimApiError(`--${flagName}${source.from} contains no values`, 0);
     }
-    return kept.map((line, index) => {
+    values.push(...kept.map((line, index) => {
       const value = line.trim();
       if (!value) {
         throw new SimApiError(`--${flagName}${source.from} has an empty value on line ${index + 1}`, 0);
       }
       return value;
-    });
-  });
+    }));
+  }
   return values.map((value) => {
     const trimmed = value.trim();
     if (!trimmed)
@@ -17997,13 +18248,13 @@ var FRACTIONAL_DIGITS = /\.\d*[1-9]/;
 function pathHint(raw) {
   if (raw.startsWith("@") || /^\s*[[{"\-\d]|^\s*(true|false|null)/.test(raw))
     return "";
-  return existsSync2(raw) ? `. ${raw} is a file — pass it as @${raw}` : ". To read a file, pass @path (or @- for stdin)";
+  return !embedStore.getStore() && existsSync2(raw) ? `. ${raw} is a file — pass it as @${raw}` : ". To read a file, pass @path (or @- for stdin)";
 }
-function coerce(raw, field, flag, flagName) {
+async function coerce(raw, field, flag, flagName) {
   if (raw === undefined)
     return;
   if (flag.list) {
-    const values = readListValues(raw, flagName, flag.manifest === true).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
+    const values = (await readListValues(raw, flagName, flag.manifest === true)).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
     return field.kind === "string" ? values.join(",") : values;
   }
   if (flag.rowCap)
@@ -18011,7 +18262,7 @@ function coerce(raw, field, flag, flagName) {
   if (takesJson(field, flag)) {
     if (typeof raw !== "string")
       return raw;
-    const source = readArgumentSource(raw, flagName);
+    const source = await readArgumentSource(raw, flagName);
     try {
       return JSON.parse(source.text);
     } catch (error) {
@@ -18053,7 +18304,7 @@ function boundedRequest(request) {
     throw new SimApiError("Aggregate JSON request body exceeds 10 MiB", 0);
   return request;
 }
-function buildRequest(operation, positional, flags, workspaceId) {
+async function buildRequest(operation, positional, flags, workspaceId) {
   const commandSpec = CLI_CONTRACT[operation] ?? {};
   const spec = V2_OPERATIONS[operation];
   let path = spec.path;
@@ -18091,7 +18342,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
       if ((slot === "query" || NUMERIC_KINDS.has(descriptor.kind)) && typeof raw === "string" && raw.trim() === "" && !(field === "limit" && paginatedLimit)) {
         throw new SimApiError(`--${flagName} cannot be empty`, 0);
       }
-      const value = coerce(raw ?? undefined, descriptor, flag, flagName);
+      const value = await coerce(raw ?? undefined, descriptor, flag, flagName);
       if (field === "limit" && !paginatedLimit && NUMERIC_KINDS.has(descriptor.kind) && typeof value === "number" && value < 1) {
         throw new SimApiError(`--${flagName} must be 1 or more`, 0);
       }
@@ -18121,7 +18372,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
       const raw = flags[camel(variant.name)];
       if (typeof raw !== "string")
         throw new SimApiError(`--${variant.name} is required`, 0);
-      const parsed = coerce(raw, { kind: variant.kind }, { json: true }, variant.name);
+      const parsed = await coerce(raw, { kind: variant.kind }, { json: true }, variant.name);
       if (variant.kind === "object" && (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) || variant.kind === "array" && !Array.isArray(parsed)) {
         throw new SimApiError(`--${variant.name} must be a JSON ${variant.kind}`, 0);
       }
@@ -18135,7 +18386,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
     const raw = flags.body;
     if (typeof raw !== "string")
       throw new SimApiError("--body is required", 0);
-    const parsed = coerce(raw, { kind: "object" }, { json: true }, "body");
+    const parsed = await coerce(raw, { kind: "object" }, { json: true }, "body");
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       throw new SimApiError("--body must be a JSON object", 0);
     }
@@ -18298,7 +18549,7 @@ function warn(kind, from, to) {
   if (warned.has(key))
     return;
   warned.add(key);
-  process.stderr.write(`warning: ${kind} "${from}" has been renamed to "${to}". The old name still works.
+  writeStderr(`warning: ${kind} "${from}" has been renamed to "${to}". The old name still works.
 `);
 }
 function warnRenamedCommand(from, to) {
@@ -18406,6 +18657,22 @@ function countOf(value) {
 function lengthOf(value) {
   return Array.isArray(value) ? value.length : 0;
 }
+var RESULT_NOTES = {
+  replaceWorkflowChatDeployment: (payload, body) => {
+    const authType = payload.authType ?? body?.authType ?? "public";
+    return authType === "public" ? "note: auth type is public — anyone with the link can chat; pass --auth-type password|email to restrict it." : null;
+  }
+};
+function writeResultNote(operation, payload, body) {
+  const note = RESULT_NOTES[operation];
+  if (!note)
+    return;
+  const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+  const message = note(record, body);
+  if (message)
+    writeStderr(styles3().dim(`${message}
+`));
+}
 function bulkFailureMessage(operation, payload, body) {
   const check = BULK_OUTCOME_CHECKS[operation];
   if (!check)
@@ -18495,7 +18762,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
   const paging = cursorSlot(operationSpec);
   const pagedLimit = paging ? readPagedLimit(requestFlags.limit, operation) : 0;
   const requestWorkspaceId = needsWorkspace ? client.requireWorkspace() : profile.workspaceId;
-  const request = buildRequest(operation, positional, requestFlags, requestWorkspaceId);
+  const request = await buildRequest(operation, positional, requestFlags, requestWorkspaceId);
   if (commandSpec.workspaceOperation) {
     if (!WORKSPACE_OPERATION_KINDS[operation])
       throw new SimApiError("This command has no workspace operation identity configured", 0);
@@ -18585,6 +18852,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
     return;
   }
   renderResult(operation, profile.output, payload, commandSpec, { expandedTrace: requestFlags.trace === true }, result);
+  writeResultNote(operation, payload, request.body);
   const failure = runFailureMessage(operation, payload) ?? bulkFailureMessage(operation, payload, request.body);
   if (failure)
     throw new SimApiError(failure, 0);
@@ -18992,8 +19260,8 @@ function serviceAccountProvider(providers, providerId) {
   }
   return provider;
 }
-function credentialValues(provider, raw) {
-  const parsed = coerce(raw, { kind: "object" }, { json: true }, "credentials");
+async function credentialValues(provider, raw) {
+  const parsed = await coerce(raw, { kind: "object" }, { json: true }, "credentials");
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new SimApiError("--credentials must be a JSON object", 0);
   }
@@ -19030,7 +19298,7 @@ async function createServiceAccount(command, providerId, options) {
   if (provider.requiresClientGeneratedCredentialId && !options.id) {
     throw new SimApiError(`--id is required for ${providerId}.`, 0);
   }
-  const credentialFields = credentialValues(provider, options.credentials);
+  const credentialFields = await credentialValues(provider, options.credentials);
   const operation = V2_OPERATIONS.createServiceAccountCredential;
   const response = await client.request(operation.path, {
     method: operation.method,
@@ -19198,19 +19466,19 @@ Examples:
     const endStreamedLine = () => {
       if (streamed.length > 0 && !streamed.endsWith(`
 `)) {
-        process.stdout.write(`
+        writeStdout(`
 `);
         streamed += `
 `;
       }
     };
-    const restorePipeHandling = streaming ? ignoreBrokenPipe(process.stdout) : undefined;
+    const restorePipeHandling = streaming && !embedStore.getStore() ? ignoreBrokenPipe(process.stdout) : undefined;
     try {
       const result = await readChatStream(response, (content) => {
         if (!streaming)
           return;
         streamed += content;
-        process.stdout.write(content);
+        writeStdout(content);
       });
       if (!streaming) {
         printProtocolResult(profile.output, result);
@@ -19218,11 +19486,11 @@ Examples:
       }
       const content = sanitize(result.content ?? "");
       if (content.startsWith(streamed) && content.length > streamed.length) {
-        process.stdout.write(content.slice(streamed.length));
+        writeStdout(content.slice(streamed.length));
         streamed = content;
       }
       endStreamedLine();
-      process.stderr.write(`${source_default.dim(`conversation: ${result.conversationId}`)}
+      writeStderr(`${styles3().dim(`conversation: ${result.conversationId}`)}
 `);
     } catch (error) {
       endStreamedLine();
@@ -19353,19 +19621,38 @@ async function saveStagedFile(body, target, force) {
   }
 }
 async function saveToFile(body, target, force) {
+  const embedded = embedStore.getStore();
+  if (embedded) {
+    try {
+      embedded.identity.signal?.throwIfAborted();
+      if (!embedded.writeFile) {
+        throw new SimApiError(`--output-file cannot save ${target} here: this surface has no machine to write to. Read the file instead, or use a client with filesystem access to download it.`, 0);
+      }
+      await embedded.writeFile(target, body, { overwrite: force });
+      embedded.identity.signal?.throwIfAborted();
+    } finally {
+      await body.cancel().catch(() => {});
+    }
+    return;
+  }
   return saveStagedFile(body, target, force);
 }
-async function streamToStdout(body, output = process.stdout) {
+async function streamToStdout(body, output) {
   const reader = body.getReader();
   try {
     while (true) {
       const { done, value } = await reader.read();
       if (done)
         return;
-      if (!output.write(value))
-        await once2(output, "drain");
+      if (output) {
+        if (!output.write(value))
+          await once2(output, "drain");
+      } else if (!writeStdout(value)) {
+        await once2(process.stdout, "drain");
+      }
     }
   } finally {
+    await reader.cancel().catch(() => {});
     reader.releaseLock();
   }
 }
@@ -19403,9 +19690,10 @@ function attachFileGet(files) {
     }
     if (options.outputFile === undefined || options.outputFile === "-") {
       const contentType = response.headers.get("content-type");
-      if (process.stdout.isTTY && !isTerminalSafeContentType(contentType)) {
+      const embedded = embedStore.getStore();
+      if ((embedded || process.stdout.isTTY) && !isTerminalSafeContentType(contentType)) {
         await response.body.cancel();
-        throw new SimApiError(`Refusing to write ${contentType ?? "unknown content"} to an interactive terminal. Use --output-file <path> or pipe stdout.`, 0);
+        throw new SimApiError(embedded ? `Refusing to put ${contentType ?? "unknown content"} in a text result. Use --output-file <path>.` : `Refusing to write ${contentType ?? "unknown content"} to an interactive terminal. Use --output-file <path> or pipe stdout.`, 0);
       }
       await streamToStdout(response.body);
       return;
@@ -19420,74 +19708,120 @@ function attachFileGet(files) {
   });
 }
 
-// src/transfer/local-file.ts
-import { constants as constants2 } from "node:fs";
-import { access, stat } from "node:fs/promises";
-import { basename } from "node:path";
-var CONTENT_TYPES = {
-  css: "text/css",
-  csv: "text/csv",
-  doc: "application/msword",
-  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  gif: "image/gif",
-  html: "text/html",
-  htm: "text/html",
-  jpeg: "image/jpeg",
-  jpg: "image/jpeg",
-  js: "text/javascript",
-  json: "application/json",
-  jsonl: "application/jsonl",
-  md: "text/markdown",
-  pdf: "application/pdf",
-  ppt: "application/vnd.ms-powerpoint",
-  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  png: "image/png",
-  svg: "image/svg+xml",
-  txt: "text/plain",
-  webp: "image/webp",
-  yaml: "application/yaml",
-  yml: "application/yaml",
-  xls: "application/vnd.ms-excel",
-  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  zip: "application/zip"
-};
-function contentTypeFor(name) {
-  const dot = name.lastIndexOf(".");
-  const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
-  return CONTENT_TYPES[extension] ?? "application/octet-stream";
-}
-async function localFile(path, override) {
-  let size;
-  try {
-    const stats = await stat(path);
-    if (!stats.isFile())
-      throw new SimApiError(`${path} is not a regular file`, 0);
-    await access(path, constants2.R_OK);
-    size = stats.size;
-  } catch (error) {
-    if (error instanceof SimApiError)
-      throw error;
-    throw new SimApiError(`Cannot read ${path}: ${error.message}`, 0);
+// src/transfer/upload-session.ts
+import { openAsBlob } from "node:fs";
+
+// src/transfer/streaming-upload.ts
+class StreamingUpload {
+  size;
+  position = 0;
+  pending = new Uint8Array(0);
+  closed = false;
+  reader;
+  onAbort;
+  stopped = new AbortController;
+  signal;
+  constructor(stream, size, signal) {
+    this.size = size;
+    this.signal = signal ? AbortSignal.any([signal, this.stopped.signal]) : this.stopped.signal;
+    this.reader = stream.getReader();
+    this.onAbort = () => {
+      this.reader.cancel(this.signal.reason).catch(() => {});
+    };
+    this.signal.addEventListener("abort", this.onAbort, { once: true });
+    if (this.signal.aborted)
+      this.onAbort();
+  }
+  slice(start, end) {
+    this.signal.throwIfAborted();
+    if (this.closed || start !== this.position || end <= start || end > this.size) {
+      throw new SimApiError("Upload parts must consume the snapshot in order", 0);
+    }
+    return new ReadableStream({
+      pull: async (controller) => {
+        try {
+          this.signal.throwIfAborted();
+          while (this.pending.byteLength === 0) {
+            const next = await this.reader.read();
+            this.signal.throwIfAborted();
+            if (next.done)
+              throw new SimApiError("Upload file ended before its declared size", 0);
+            this.pending = next.value;
+          }
+          const length = Math.min(this.pending.byteLength, end - this.position);
+          controller.enqueue(this.pending.subarray(0, length));
+          this.pending = this.pending.subarray(length);
+          this.position += length;
+          if (this.position === end)
+            controller.close();
+        } catch (error) {
+          controller.error(error);
+        }
+      },
+      cancel: (reason) => this.reader.cancel(reason)
+    }, { highWaterMark: 0 });
+  }
+  assertConsumed(end) {
+    this.signal.throwIfAborted();
+    if (this.position !== end) {
+      throw new SimApiError("Upload was acknowledged before its complete body was consumed", 0);
+    }
+  }
+  async verifyComplete() {
+    this.assertConsumed(this.size);
+    if (this.pending.byteLength > 0) {
+      throw new SimApiError("Upload file exceeds its declared size", 0);
+    }
+    while (true) {
+      const next = await this.reader.read();
+      this.signal.throwIfAborted();
+      if (next.done)
+        return;
+      if (next.value.byteLength > 0)
+        throw new SimApiError("Upload file exceeds its declared size", 0);
+    }
+  }
+  async close() {
+    if (this.closed)
+      return;
+    this.closed = true;
+    this.stopped.abort();
+    this.signal.removeEventListener("abort", this.onAbort);
+    try {
+      await this.reader.cancel().catch(() => {});
+    } finally {
+      this.reader.releaseLock();
+    }
   }
-  if (size === 0)
-    throw new SimApiError(`${path} is empty`, 0);
-  return { name: override ?? basename(path), size };
 }
 
 // src/transfer/upload-session.ts
-import { openAsBlob } from "node:fs";
 var PART_URL_BATCH = 100;
-async function uploadPut(transfer, blob) {
-  const response = await fetch(transfer.url, {
+async function uploadBytes(url, headers, file, start, end, label) {
+  const body = file.slice(start, end);
+  const options = {
     method: "PUT",
-    headers: transfer.headers,
-    body: blob
-  });
+    headers,
+    body,
+    signal: file instanceof StreamingUpload ? file.signal : embedStore.getStore()?.identity.signal
+  };
+  if (file instanceof StreamingUpload) {
+    const streamedHeaders = new Headers(headers);
+    streamedHeaders.set("content-length", String(end - start));
+    options.headers = streamedHeaders;
+    options.duplex = "half";
+  }
+  const response = await fetch(url, options);
   if (!response.ok) {
-    throw new SimApiError(`Upload failed with status ${response.status}`, response.status);
+    throw new SimApiError(`${label} failed with status ${response.status}`, response.status);
   }
+  if (file instanceof StreamingUpload)
+    file.assertConsumed(end);
 }
-async function uploadParts(client, workspaceId, session, transfer, blob) {
+async function uploadParts(client, workspaceId, session, transfer, file) {
+  if (file instanceof StreamingUpload && (!Number.isSafeInteger(transfer.partSize) || transfer.partSize <= 0)) {
+    throw new SimApiError("Invalid upload part size", 0);
+  }
   const expectedPartCount = Math.ceil(session.size / transfer.partSize);
   if (expectedPartCount !== transfer.partCount) {
     throw new Error(`Upload session expected ${transfer.partCount} parts, but file requires ${expectedPartCount}`);
@@ -19503,28 +19837,49 @@ async function uploadParts(client, workspaceId, session, transfer, blob) {
       headers: { "upload-token": session.uploadToken },
       body: { partNumbers }
     });
-    for (const part of signed.data.parts) {
-      const start = (part.partNumber - 1) * transfer.partSize;
-      const chunk = blob.slice(start, Math.min(start + transfer.partSize, session.size));
-      const response = await fetch(part.url, {
-        method: "PUT",
-        headers: part.headers,
-        body: chunk
-      });
-      if (!response.ok) {
-        throw new SimApiError(`Part ${part.partNumber} failed with status ${response.status}`, response.status);
+    let parts = signed.data.parts;
+    if (file instanceof StreamingUpload) {
+      const numbers = new Set(parts.map((part) => part.partNumber));
+      if (parts.length !== partNumbers.length || partNumbers.some((n) => !numbers.has(n))) {
+        throw new SimApiError("Upload part URLs do not match the requested parts", 0);
       }
+      parts = [...parts].sort((a, b) => a.partNumber - b.partNumber);
+    }
+    for (const part of parts) {
+      const start = (part.partNumber - 1) * transfer.partSize;
+      await uploadBytes(part.url, part.headers, file, start, Math.min(start + transfer.partSize, session.size), `Part ${part.partNumber}`);
     }
   }
 }
 async function finishUploadSession(client, workspaceId, session, path) {
+  let snapshot;
+  let streamed;
   try {
-    const blob = await openAsBlob(path);
+    const embedded = embedStore.getStore();
+    let file;
+    if (embedded) {
+      embedded.identity.signal?.throwIfAborted();
+      if (!embedded.openFile)
+        throw new SimApiError("This invocation has no machine to read from", 0);
+      snapshot = await embedded.openFile(embeddedFileKey(path));
+      if (snapshot.size !== session.size)
+        throw new SimApiError("Upload snapshot size changed", 0);
+      streamed = new StreamingUpload(await snapshot.stream(), snapshot.size, AbortSignal.any([
+        ...embedded.identity.signal ? [embedded.identity.signal] : [],
+        ...snapshot.signal ? [snapshot.signal] : []
+      ]));
+      file = streamed;
+    } else {
+      file = await openAsBlob(path);
+    }
     if (session.transfer.method === "put") {
-      await uploadPut(session.transfer, blob);
+      await uploadBytes(session.transfer.url, session.transfer.headers, file, 0, file instanceof Blob ? file.size : session.size, "Upload");
     } else {
-      await uploadParts(client, workspaceId, session, session.transfer, blob);
+      await uploadParts(client, workspaceId, session, session.transfer, file);
     }
+    await streamed?.verifyComplete();
+    await streamed?.close();
+    await snapshot?.dispose().catch(() => {});
     const completed = await client.request(`${session.basePath}/complete`, {
       method: "POST",
       query: { workspaceId },
@@ -19532,7 +19887,10 @@ async function finishUploadSession(client, workspaceId, session, path) {
     });
     return completed.data;
   } catch (error) {
-    await client.request(session.basePath, {
+    await streamed?.close();
+    const profile = embeddedProfile();
+    const cleanupClient = profile ? new SimClient({ ...profile, signal: AbortSignal.timeout(5000) }) : client;
+    await cleanupClient.request(session.basePath, {
       method: "DELETE",
       query: { workspaceId },
       headers: { "upload-token": session.uploadToken }
@@ -19540,6 +19898,9 @@ async function finishUploadSession(client, workspaceId, session, path) {
       return;
     });
     throw error;
+  } finally {
+    await streamed?.close();
+    await snapshot?.dispose().catch(() => {});
   }
 }
 
@@ -19625,9 +19986,11 @@ function attachKnowledgeDocumentUpload(documents) {
     printProtocolResult(profile.output, {
       id: completed.document.id,
       knowledgeBaseId: completed.document.knowledgeBaseId,
-      name: completed.document.filename,
-      size: completed.document.fileSize,
-      status: completed.document.processingStatus
+      filename: completed.document.filename,
+      fileSize: completed.document.fileSize,
+      mimeType: completed.document.mimeType,
+      processingStatus: completed.document.processingStatus,
+      chunkCount: completed.document.chunkCount
     });
   });
 }
@@ -19743,11 +20106,11 @@ function createTableWriter() {
     if (!widths) {
       widths = COLUMNS.map((column, index) => Math.min(MAX_CELL_WIDTH2, Math.max(column.floor, visibleWidth(column.header), ...lines.map((line) => visibleWidth(line[index])))));
       const header = widths;
-      console.log(source_default.dim(COLUMNS.map((column, index) => pad2(column.header.toUpperCase(), header[index])).join("  ").trimEnd()));
+      printLine(styles3().dim(COLUMNS.map((column, index) => pad2(column.header.toUpperCase(), header[index])).join("  ").trimEnd()));
     }
     const locked = widths;
     for (const line of lines) {
-      console.log(line.map((cell, index) => pad2(cell, locked[index])).join("  ").trimEnd());
+      printLine(line.map((cell, index) => pad2(cell, locked[index])).join("  ").trimEnd());
     }
   };
 }
@@ -19755,13 +20118,13 @@ function createWriter(format) {
   if (format === "json") {
     return (rows) => {
       for (const row of rows)
-        console.log(JSON.stringify(row));
+        printLine(JSON.stringify(row));
     };
   }
   if (format === "yaml") {
     return (rows) => {
       for (const row of rows) {
-        console.log(`---
+        printLine(`---
 ${dump(row, { lineWidth: 0, noRefs: true }).trimEnd()}`);
       }
     };
@@ -19778,24 +20141,24 @@ function followStatus() {
   let reported = false;
   return {
     note: (message) => {
-      if (!process.stderr.isTTY)
+      if (!hasProgressTerminal())
         return;
       reported = true;
-      process.stderr.write(`\r${source_default.dim(message)}${ERASE_LINE}`);
+      writeStderr(`\r${styles3().dim(message)}${ERASE_LINE}`);
     },
     warn: (message) => {
       if (reported) {
         reported = false;
-        process.stderr.write(`\r${ERASE_LINE}`);
+        writeStderr(`\r${ERASE_LINE}`);
       }
-      process.stderr.write(`warning: ${message}
+      writeStderr(`warning: ${message}
 `);
     },
     clear: () => {
       if (!reported)
         return;
       reported = false;
-      process.stderr.write(`\r${ERASE_LINE}`);
+      writeStderr(`\r${ERASE_LINE}`);
     }
   };
 }
@@ -20087,13 +20450,13 @@ async function watchImport(client, workspaceId, job) {
     const next = await client.request(`/api/v2/tables/imports/${encodeURIComponent(current.id)}`, { query: { workspaceId } });
     current = next.data;
     const line = progressLine(current);
-    if (process.stderr.isTTY && line !== reported) {
+    if (hasProgressTerminal() && line !== reported) {
       reported = line;
-      process.stderr.write(`\r${source_default.dim(line)}\x1B[K`);
+      writeStderr(`\r${styles3().dim(line)}\x1B[K`);
     }
   }
-  if (process.stderr.isTTY && reported !== null)
-    process.stderr.write("\r\x1B[K");
+  if (hasProgressTerminal() && reported !== null)
+    writeStderr("\r\x1B[K");
   return current;
 }
 function validateTargetOptions(options) {
@@ -20151,8 +20514,8 @@ function attachTableImport(tables) {
         workspaceId,
         source,
         target,
-        ...options.mapping ? { mapping: jsonFlag(options.mapping, "mapping", "object") } : {},
-        ...options.createColumns ? { createColumns: jsonFlag(options.createColumns, "create-columns", "array") } : {},
+        ...options.mapping ? { mapping: await jsonFlag(options.mapping, "mapping", "object") } : {},
+        ...options.createColumns ? { createColumns: await jsonFlag(options.createColumns, "create-columns", "array") } : {},
         ...options.timezone ? { timezone: options.timezone } : {}
       }
     });
@@ -20198,14 +20561,11 @@ var AGENT_STREAM_PROTOCOL_V1 = "agent-events-v1";
 var WORKFLOW_RESULT_STREAM_CONTENT_TYPE = "application/x-ndjson";
 var DONE_SENTINEL = "[DONE]";
 function resolveWorkflowRunSelection(flags) {
-  const manual = flags.manual === true;
   const trigger = typeof flags.trigger === "string" ? flags.trigger : undefined;
   const useMockPayload = flags.mockPayload === true;
+  const manual = flags.manual === true || trigger !== undefined || useMockPayload;
   const fromBlock = typeof flags.fromBlock === "string" ? flags.fromBlock : undefined;
   const sourceRun = typeof flags.sourceRun === "string" ? flags.sourceRun : undefined;
-  if ((trigger || useMockPayload) && !manual) {
-    throw new SimApiError("--trigger and --mock-payload require --manual", 0);
-  }
   if (fromBlock && (trigger || useMockPayload)) {
     throw new SimApiError("--from-block cannot be combined with --trigger or --mock-payload", 0);
   }
@@ -20282,7 +20642,7 @@ async function runWithResultStream(workflowId, command) {
   const operation = V2_OPERATIONS.executeWorkflow;
   const commandSpec = CLI_CONTRACT.executeWorkflow ?? {};
   try {
-    const request = buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
+    const request = await buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
     const response = await client.requestRaw(request.path, {
       method: operation.method,
       query: request.query,
@@ -20357,11 +20717,11 @@ class Commentary {
 function toolNotice(frame) {
   const name = safeOneLine(stringField(frame, "name") ?? "tool");
   if (frame.phase === "start")
-    return source_default.dim(`→ ${name}`);
+    return styles3().dim(`→ ${name}`);
   const status = stringField(frame, "status");
   if (status && status !== "success")
-    return source_default.yellow(`✗ ${name} (${safeOneLine(status)})`);
-  return source_default.dim(`✓ ${name}`);
+    return styles3().yellow(`✗ ${name} (${safeOneLine(status)})`);
+  return styles3().dim(`✓ ${name}`);
 }
 async function renderRunStream(body, options) {
   const commentary = new Commentary(options.stderr);
@@ -20383,11 +20743,11 @@ async function renderRunStream(body, options) {
     }
     switch (frame.event) {
       case "chunk_reset":
-        commentary.line(source_default.dim("… retracted; that turn resolved to tool calls"));
+        commentary.line(styles3().dim("… retracted; that turn resolved to tool calls"));
         break;
       case "thinking":
         if (options.includeThinking && typeof frame.data === "string") {
-          commentary.inline(source_default.dim(sanitize(frame.data)));
+          commentary.inline(styles3().dim(sanitize(frame.data)));
         }
         break;
       case "tool":
@@ -20395,7 +20755,7 @@ async function renderRunStream(body, options) {
           commentary.line(toolNotice(frame));
         break;
       case "stream_error":
-        commentary.line(source_default.yellow(`warning: ${safeOneLine(stringField(frame, "error") ?? "stream read failed")}`));
+        commentary.line(styles3().yellow(`warning: ${safeOneLine(stringField(frame, "error") ?? "stream read failed")}`));
         break;
       case "error":
         commentary.endLine();
@@ -20424,7 +20784,7 @@ async function followRun(workflowId, command) {
   const negotiates = includeThinking || includeToolCalls;
   const { client, profile } = clientFrom(command);
   const operation = V2_OPERATIONS.executeWorkflow;
-  const request = buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
+  const request = await buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
   const response = await client.requestRaw(request.path, {
     method: "POST",
     query: request.query,
@@ -20450,7 +20810,7 @@ async function followRun(workflowId, command) {
   const final = await renderRunStream(response.body, {
     includeThinking,
     includeToolCalls,
-    stderr: process.stderr
+    stderr: { write: writeStderr }
   });
   renderResult("executeWorkflow", profile.output, final, CLI_CONTRACT.executeWorkflow ?? {});
   if (final.success === false) {
@@ -20465,8 +20825,8 @@ function followOrDelegate(previous) {
       command.setOptionValue("run", selection);
     const flags = command.optsWithGlobals();
     if (flags.follow !== true) {
-      if (Array.isArray(flags.selectOutput) && flags.selectOutput.length > 0) {
-        throw new SimApiError(flags.async === true ? "--select-output shapes a streamed result, and --async returns as soon as the run is queued, so there is no stream to shape. Drop one of them, or read the finished run with: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockId>[.path] — that resource matches block ids, not the block names --select-output takes here." : "--select-output shapes a streamed result; add --follow. To narrow a run that has already finished: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockId>[.path] — that resource matches block ids, not the block names --select-output takes here.", 0);
+      if (Array.isArray(flags.selectOutput) && flags.selectOutput.length > 0 && flags.async === true) {
+        throw new SimApiError("--select-output names outputs of a completed run, and --async returns as soon as the run is queued. Drop one of them, or read the finished run with: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockName|blockId>[.path] — that resource takes the same selectors --select-output takes here.", 0);
       }
       if (flags.includeThinking === true || flags.includeToolCalls === true) {
         throw new SimApiError("--include-thinking and --include-tool-calls describe a stream; add --follow", 0);
@@ -20492,7 +20852,119 @@ function attachWorkflowRunFollow(workflows) {
   }
   const held = run._actionHandler;
   const previous = typeof held === "function" ? held : null;
-  run.option("--manual", "Run the current saved workflow state instead of the active deployment").option("--trigger <blockId>", "Enter a manual run through this runnable trigger (requires --manual)").option("--mock-payload", "Use the selected trigger's server-derived mock payload (requires --manual)").option("--from-block <blockId>", "Run manually from this saved workflow block").option("--source-run <runId>", "Prior run whose persisted state supplies upstream outputs (requires --from-block)").option("--follow", "Stream the run as it happens; progress on stderr, result on stdout. The stream reports only success and output, so the result omits the run id and timings a non-streaming run returns").option("--include-thinking", "Show model reasoning while following (requires --follow)").option("--include-tool-calls", "Show tool calls while following (requires --follow)").action(followOrDelegate(previous));
+  run.option("--manual", "Run the current saved workflow state instead of the active deployment").option("--trigger <blockId>", "Enter the run through this runnable trigger; runs the current saved workflow state (implies --manual)").option("--mock-payload", "Use the selected trigger's server-derived mock payload; runs the current saved workflow state (implies --manual)").option("--from-block <blockId>", "Run manually from this saved workflow block").option("--source-run <runId>", "Prior run whose persisted state supplies upstream outputs (requires --from-block)").option("--follow", "Stream the run as it happens; progress on stderr, result on stdout. The stream reports only success and output, so the result omits the run id and timings a non-streaming run returns").option("--include-thinking", "Show model reasoning while following (requires --follow)").option("--include-tool-calls", "Show tool calls while following (requires --follow)").action(followOrDelegate(previous));
+}
+
+// src/commands/protocol/workflow-run-get.ts
+var BLOCK_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var SELECT_OUTPUT_FLAG = "select-output";
+function normalizeBlockName(name) {
+  return name.toLowerCase().replace(/\s+/g, "").replace(/\./g, "");
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function loadWorkflowBlocks(client, workflowId) {
+  const operation = V2_OPERATIONS.getWorkflowState;
+  const raw = await client.request(resolvePath(operation.path, { workflowId }), {
+    method: operation.method
+  });
+  const state = isRecord2(raw) && isRecord2(raw.data) ? raw.data : raw;
+  const blocks = isRecord2(state) && isRecord2(state.blocks) ? Object.entries(state.blocks) : [];
+  return blocks.map(([key, block]) => ({
+    id: isRecord2(block) && typeof block.id === "string" ? block.id : key,
+    name: isRecord2(block) && typeof block.name === "string" ? block.name : ""
+  }));
+}
+function splitSelector(selector) {
+  const dot = selector.indexOf(".");
+  return dot === -1 ? { head: selector, path: "" } : { head: selector.slice(0, dot), path: selector.slice(dot) };
+}
+function isIdHeaded(selector) {
+  return BLOCK_ID.test(splitSelector(selector).head);
+}
+function resolveSelection(typed, blocks, workflowId) {
+  const resolved = [];
+  const typedBy = new Map;
+  const unresolved = [];
+  for (const selector of typed) {
+    const { head, path } = splitSelector(selector);
+    let blockId = head;
+    if (!BLOCK_ID.test(head)) {
+      const wanted = normalizeBlockName(head);
+      const matches = blocks.filter((block) => block.id === head || normalizeBlockName(block.name) === wanted);
+      if (matches.length === 0) {
+        unresolved.push(selector);
+        continue;
+      }
+      if (matches.length > 1) {
+        throw new SimApiError(`--${SELECT_OUTPUT_FLAG} ${selector} names ${matches.length} blocks (${matches.map((block) => block.id).join(", ")}); pass the block id instead`, 0);
+      }
+      blockId = matches[0].id;
+    }
+    const rewritten = `${blockId}${path}`;
+    resolved.push(rewritten);
+    if (!typedBy.has(rewritten))
+      typedBy.set(rewritten, selector);
+  }
+  if (unresolved.length > 0) {
+    const names = blocks.map((block) => block.name).filter((name) => name !== "");
+    throw new SimApiError(`--${SELECT_OUTPUT_FLAG} did not resolve to any block on this run: ${unresolved.join(", ")}. Pass a block id or its name — "blockId", "blockId.path", "blockName" or "blockName.path"; names match ignoring case, spaces and dots. Blocks on workflow ${workflowId}: ${names.length > 0 ? names.join(", ") : "none"}.`, 0);
+  }
+  return { resolved, typedBy };
+}
+function keyByTyped(payload, typedBy) {
+  if (!isRecord2(payload) || !isRecord2(payload.blockOutputs))
+    return payload;
+  const blockOutputs = {};
+  for (const [key, value] of Object.entries(payload.blockOutputs)) {
+    blockOutputs[typedBy.get(key) ?? key] = value;
+  }
+  return { ...payload, blockOutputs };
+}
+async function readRunByName(runId, typed, command) {
+  const flags = command.optsWithGlobals();
+  const { client, profile } = clientFrom(command);
+  const operation = V2_OPERATIONS.getWorkflowRun;
+  const spec = CLI_CONTRACT.getWorkflowRun ?? {};
+  await buildRequest("getWorkflowRun", [runId], flags, profile.workspaceId);
+  const workflowId = String(flags.workflow);
+  const selection = resolveSelection(typed, await loadWorkflowBlocks(client, workflowId), workflowId);
+  const request = await buildRequest("getWorkflowRun", [runId], { ...flags, selectOutput: selection.resolved }, profile.workspaceId);
+  let result;
+  try {
+    result = await client.request(request.path, {
+      method: operation.method,
+      headers: request.headers,
+      query: request.query,
+      body: request.body
+    });
+  } catch (error) {
+    throw retypeApiError(error, "getWorkflowRun", spec, operation);
+  }
+  renderResult("getWorkflowRun", profile.output, keyByTyped(result?.data ?? result, selection.typedBy), spec, {}, result);
+}
+function attachWorkflowRunGet(runs) {
+  const get = runs.commands.find((command) => command.name() === "get");
+  const held = get?._actionHandler;
+  if (!get || typeof held !== "function") {
+    throw new Error("workflows runs get must be registered before block names can be attached to it");
+  }
+  const previous = held;
+  get.action(async (runId, _options, command) => {
+    const raw = command.optsWithGlobals().selectOutput;
+    if (raw === undefined) {
+      await previous(command.processedArgs);
+      return;
+    }
+    const typed = await readListValues(raw, SELECT_OUTPUT_FLAG);
+    command.setOptionValue("selectOutput", typed);
+    if (typed.every(isIdHeaded)) {
+      await previous(command.processedArgs);
+      return;
+    }
+    await readRunByName(runId, typed, command);
+  });
 }
 
 // src/commands/protocol/workflow-run-wait.ts
@@ -20509,18 +20981,21 @@ var MAX_POLL_DELAY_MS = 15000;
 var POLL_BACKOFF_FACTOR = 2;
 var DEFAULT_WAIT_TIMEOUT_SECONDS = 3600;
 var WAIT_TIMEOUT_FLAG = "--wait-timeout <seconds>";
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function optionalString(value) {
   return typeof value === "string" && value !== "" ? value : null;
 }
+function runData(raw) {
+  return isRecord3(raw) && isRecord3(raw.data) ? raw.data : raw;
+}
 function readRun(raw) {
-  const run = isRecord2(raw) && isRecord2(raw.data) ? raw.data : raw;
-  if (!isRecord2(run) || typeof run.status !== "string") {
+  const run = isRecord3(raw) && isRecord3(raw.data) ? raw.data : raw;
+  if (!isRecord3(run) || typeof run.status !== "string") {
     throw new SimApiError("Run status response carried no status.", 0);
   }
-  const paused = isRecord2(run.paused) ? run.paused : null;
+  const paused = isRecord3(run.paused) ? run.paused : null;
   return {
     status: run.status,
     pauseKind: paused ? optionalString(paused.pauseKind) : null,
@@ -20539,16 +21014,16 @@ function waitProgress() {
   let reported = false;
   return {
     advance: (status, elapsedMs) => {
-      if (!process.stderr.isTTY)
+      if (!hasProgressTerminal())
         return;
       reported = true;
-      process.stderr.write(`\r${source_default.dim(`${status} — waiting ${Math.round(elapsedMs / 1000)}s…`)}\x1B[K`);
+      writeStderr(`\r${styles3().dim(`${status} — waiting ${Math.round(elapsedMs / 1000)}s…`)}\x1B[K`);
     },
     finish: () => {
       if (!reported)
         return;
       reported = false;
-      process.stderr.write("\r\x1B[K");
+      writeStderr("\r\x1B[K");
     }
   };
 }
@@ -20589,19 +21064,19 @@ function attachWorkflowRunWait(runs) {
         const outcome = classify(snapshot);
         if (outcome) {
           progress.finish();
-          renderResult("getWorkflowRun", profile.output, raw, runSpec());
+          renderResult("getWorkflowRun", profile.output, runData(raw), runSpec());
           const message = explain(outcome, runId, options.workflow, snapshot);
           if (message)
-            console.error(source_default.red(message));
-          process.exitCode = WAIT_EXIT_CODES[outcome];
+            printError(styles3().red(message));
+          setSoftExitCode(WAIT_EXIT_CODES[outcome]);
           return;
         }
         const remainingMs = deadline - Date.now();
         if (remainingMs <= 0) {
           progress.finish();
-          renderResult("getWorkflowRun", profile.output, raw, runSpec());
-          console.error(source_default.red(`Timed out after ${timeoutSeconds}s waiting for run ${runId} (status: ${snapshot.status}${snapshot.resumeAt ? `, resuming at ${snapshot.resumeAt}` : ""}). Raise ${WAIT_TIMEOUT_FLAG}, or set it to 0 to wait indefinitely.`));
-          process.exitCode = WAIT_EXIT_CODES.timeout;
+          renderResult("getWorkflowRun", profile.output, runData(raw), runSpec());
+          printError(styles3().red(`Timed out after ${timeoutSeconds}s waiting for run ${runId} (status: ${snapshot.status}${snapshot.resumeAt ? `, resuming at ${snapshot.resumeAt}` : ""}). Raise ${WAIT_TIMEOUT_FLAG}, or set it to 0 to wait indefinitely.`));
+          setSoftExitCode(WAIT_EXIT_CODES.timeout);
           return;
         }
         progress.advance(snapshot.status, Date.now() - startedAt);
@@ -20658,7 +21133,9 @@ function attachProtocolCommands(program) {
     createFolder: "createWorkflowFolder"
   });
   attachWorkflowRunFollow(workflows);
-  attachWorkflowRunWait(group(workflows, "runs"));
+  const runs = group(workflows, "runs");
+  attachWorkflowRunGet(runs);
+  attachWorkflowRunWait(runs);
   attachWorkspaceOperationWait(group(group(program, "workspaces"), "operations"));
   attachLogsFollow(group(program, "logs"));
   attachChat(program);
@@ -20762,12 +21239,12 @@ var SECRET_RESULT = {
     { header: "description" }
   ]
 };
-function readValueArgument(raw) {
+async function readValueArgument(raw) {
   if (raw.startsWith("@@"))
     return raw.slice(1);
   if (!raw.startsWith("@"))
     return raw;
-  return readArgumentSource(raw, "value").text;
+  return (await readArgumentSource(raw, "value")).text;
 }
 function validateSecretValue(value) {
   if (value.length === 0)
@@ -20787,7 +21264,7 @@ function validateWorkspaceOnlyFlag(flag, value, scope) {
 }
 async function readSecretValue(options) {
   if (options.value !== undefined)
-    return validateSecretValue(readValueArgument(options.value));
+    return validateSecretValue(await readValueArgument(options.value));
   if (options.description !== undefined || options.unredacted !== undefined)
     return;
   try {
@@ -20795,8 +21272,8 @@ async function readSecretValue(options) {
   } catch (error) {
     if (!(error instanceof SecretInputCancelledError))
       throw error;
-    console.error(source_default.red(`Error: ${error.message}`));
-    return process.exit(CANCELLED_EXIT_CODE);
+    printError(styles3().red(`Error: ${error.message}`));
+    return exitCli(CANCELLED_EXIT_CODE);
   }
 }
 async function setSecret(name, options, command, redactionSpellings) {
@@ -20968,7 +21445,7 @@ function createCommandTelemetry(options = {}) {
     writeTelemetryState({ ...state, session });
     const properties = {
       $lib: LIBRARY_NAME,
-      $lib_version: CLI_VERSION,
+      $lib_version: cliVersion(),
       $process_person_profile: false,
       $session_id: session.id,
       session_sequence: session.sequence,
@@ -20979,7 +21456,7 @@ function createCommandTelemetry(options = {}) {
       exit_code: outcome.exitCode,
       duration_ms: Math.round(elapsed()),
       ...failureProperties(outcome.error),
-      cli_version: CLI_VERSION,
+      cli_version: cliVersion(),
       node_version: process.versions.node,
       os: process.platform,
       arch: process.arch,
@@ -21118,19 +21595,22 @@ function addVersionOption(program) {
     }
     program.error("error: --version reports the Sim CLI version and takes no value. A command that acts on a deployment version reads it from --to-version.");
   });
-  program.version(CLI_VERSION, "-V, --version [none]", "output the version number (takes no value)");
+  program.version(cliVersion(), "-V, --version [none]", "output the version number (takes no value)");
 }
 function buildProgram(options = {}) {
-  const program = new Command;
+  const program = options.program ?? new Command;
   program.name("sim").description(PROGRAM_DESCRIPTION);
   if (options.version !== false)
     addVersionOption(program);
   program.option("-P, --profile <name>", "Profile to use (env: SIM_PROFILE)").option("--endpoint <url>", "Sim deployment to talk to (env: SIM_ENDPOINT)").option("-w, --workspace <id>", "Workspace to target (env: SIM_WORKSPACE)").addOption(new Option("--output <format>", "Output format for this command").choices([...OUTPUT_FORMATS]));
-  program.addCommand(loginCommand());
-  program.addCommand(logoutCommand());
-  program.addCommand(whoamiCommand());
-  program.addCommand(profilesCommand());
-  program.addCommand(configureCommand());
+  for (const command of [
+    loginCommand,
+    logoutCommand,
+    whoamiCommand,
+    profilesCommand,
+    configureCommand
+  ])
+    program.addCommand(command());
   const update = updateCommand();
   program.addCommand(update);
   program.addCommand(telemetryCommand());
@@ -21140,7 +21620,7 @@ function buildProgram(options = {}) {
   attachCredentialCommands(program);
   attachProtocolCommands(program);
   attachSecretCommands(program);
-  program.addHelpText("after", HELP_EPILOGUE);
+  program.addHelpText("after", options.helpText ?? HELP_EPILOGUE);
   program.hook("preAction", async (_program, command) => {
     if (command === update)
       return;
@@ -21151,14 +21631,14 @@ function buildProgram(options = {}) {
   return program;
 }
 
-// src/index.ts
+// src/terminal.ts
 function explainFailure(error, program) {
   if (error instanceof ProfileConfigError || error instanceof CliUpdateError) {
-    console.error(source_default.red(`Error: ${sanitize(error.message)}`));
+    console.error(styles3().red(`Error: ${sanitize(error.message)}`));
     return 1;
   }
   if (isRequestTimeout(error)) {
-    console.error(source_default.red(`Error: the request timed out. ${RAISE_TIMEOUT_HINT}`));
+    console.error(styles3().red(`Error: the request timed out. ${RAISE_TIMEOUT_HINT}`));
     return 1;
   }
   if (error instanceof SimApiError) {
@@ -21178,30 +21658,32 @@ function explainFailure(error, program) {
 ` : dump(payload));
       return error.exitCode;
     }
-    console.error(source_default.red(`Error: ${sanitize(error.message)}`));
+    console.error(styles3().red(`Error: ${sanitize(error.message)}`));
     if (error.code)
-      console.error(source_default.dim(`  code: ${sanitize(error.code)}`));
+      console.error(styles3().dim(`  code: ${sanitize(error.code)}`));
     if (error.details !== undefined) {
       for (const line of formatApiErrorDetails(error.details)) {
-        console.error(source_default.dim(sanitize(line)));
+        console.error(styles3().dim(sanitize(line)));
       }
     }
     return error.exitCode;
   }
   return null;
 }
-async function main() {
-  const telemetry = createCommandTelemetry();
-  const program = buildProgram();
-  telemetry.observe(program);
+async function runTerminalCli(suppliedProgram) {
+  const telemetry = suppliedProgram ? undefined : createCommandTelemetry();
+  const program = suppliedProgram ?? buildProgram();
+  telemetry?.observe(program);
   try {
     await program.parseAsync(process.argv);
   } catch (error) {
     const exitCode = explainFailure(error, program);
-    telemetry.complete({ exitCode: exitCode ?? 1, error });
+    telemetry?.complete({ exitCode: exitCode ?? 1, error });
     if (exitCode === null)
       throw error;
     process.exit(exitCode);
   }
 }
-main();
+
+// src/index.ts
+runTerminalCli();