sim 2.1.2-preview.47.1 → 2.1.2-preview.49.1

package/dist/index.js

@@ -2315,8 +2315,26 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "n
 import { dirname } from "node:path";
 
 // src/config/ini.ts
+class ProfileConfigError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProfileConfigError";
+  }
+}
 var SECTION_PATTERN = /^\s*\[([^\]]*)\]\s*$/;
 var KV_PATTERN = /^\s*([A-Za-z0-9_.-]+)\s*=\s*(.*?)\s*$/;
+var FORBIDDEN_CLASS = "\\u0000-\\u001f\\u007f-\\u009f\\u2028\\u2029";
+var FORBIDDEN_IN_VALUE = new RegExp(`[${FORBIDDEN_CLASS}]`);
+var FORBIDDEN_IN_NAME = new RegExp(`[${FORBIDDEN_CLASS}[\\]]`);
+var WRITABLE_KEY = /^[A-Za-z0-9_.-]+$/;
+function assertWritable(text, what, forbidden) {
+  if (forbidden.test(text)) {
+    throw new ProfileConfigError(`Refusing to write ${what}: line breaks and control characters cannot be stored in the ~/.sim files, because the format has no way to escape them.`);
+  }
+  if (text !== text.trim()) {
+    throw new ProfileConfigError(`Refusing to write ${what}: leading or trailing whitespace is not preserved by the ~/.sim files, so it would not read back as written.`);
+  }
+}
 function parseIni(text) {
   const doc = { preamble: [], sections: [] };
   let current = null;
@@ -2379,9 +2397,23 @@ function listSections(doc) {
   return doc.sections.map((s) => s.name);
 }
 function setSectionValues(doc, name, values) {
+  assertWritable(name, `a section named "${name}"`, FORBIDDEN_IN_NAME);
+  for (const [key, value] of Object.entries(values)) {
+    if (!WRITABLE_KEY.test(key)) {
+      throw new ProfileConfigError(`Refusing to write an unreadable setting name "${key}".`);
+    }
+    if (value === null)
+      continue;
+    if (value.trim() === "") {
+      throw new ProfileConfigError(`Refusing to write a blank value for "${key}".`);
+    }
+    assertWritable(value, `a value for "${key}"`, FORBIDDEN_IN_VALUE);
+  }
   const matching = doc.sections.filter((s) => s.name === name);
   let section = matching[0];
   if (!section) {
+    if (Object.values(values).every((value) => value === null))
+      return;
     section = { name, entries: [] };
     doc.sections.push(section);
     matching.push(section);
@@ -2413,11 +2445,11 @@ function removeSection(doc, name) {
 var DEFAULT_PROFILE = "default";
 var DEFAULT_ENDPOINT = "https://www.sim.ai";
 var OUTPUT_FORMATS = ["table", "json", "yaml", "text"];
-
-class ProfileConfigError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ProfileConfigError";
+var FORBIDDEN_IN_VALUE_GLOBAL = new RegExp(FORBIDDEN_IN_VALUE.source, "g");
+var PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function validateProfileName(name) {
+  if (!PROFILE_NAME_PATTERN.test(name)) {
+    throw new ProfileConfigError(`Invalid profile name "${name.replace(FORBIDDEN_IN_VALUE_GLOBAL, " ")}". Use letters, numbers, dots, underscores, or hyphens, starting with a letter or number.`);
   }
 }
 function configSectionName(profile) {
@@ -2541,18 +2573,31 @@ function deleteProfile(profile) {
   return { config, credentials };
 }
 function normalizeEndpoint(endpoint, source) {
-  const trimmed = endpoint.replace(/\/+$/, "");
+  const trimmed = endpoint.trim().replace(/\/+$/, "");
+  if (FORBIDDEN_IN_VALUE.test(trimmed)) {
+    throw new ProfileConfigError(`Invalid endpoint "${endpoint.replace(FORBIDDEN_IN_VALUE_GLOBAL, " ")}" from ${source}. An endpoint cannot contain line breaks or control characters.`);
+  }
   let parsed;
   try {
     parsed = new URL(trimmed);
   } catch {
-    throw new ProfileConfigError(`Invalid endpoint "${endpoint}" from ${source}. Use an absolute URL, e.g. ${DEFAULT_ENDPOINT} or http://localhost:3000`);
+    throw new ProfileConfigError(`Invalid endpoint "${endpoint.replace(FORBIDDEN_IN_VALUE_GLOBAL, " ")}" from ${source}. Use an absolute URL, e.g. ${DEFAULT_ENDPOINT} or http://localhost:3000`);
   }
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
     throw new ProfileConfigError(`Unsupported endpoint scheme "${parsed.protocol.replace(/:$/, "")}" from ${source}. Use http or https, e.g. ${DEFAULT_ENDPOINT}`);
   }
   return trimmed;
 }
+function normalizeWorkspaceId(workspaceId, source) {
+  const trimmed = workspaceId.trim();
+  if (!trimmed) {
+    throw new ProfileConfigError(`Empty workspace id from ${source}.`);
+  }
+  if (FORBIDDEN_IN_VALUE.test(trimmed)) {
+    throw new ProfileConfigError(`Invalid workspace id "${trimmed.replace(FORBIDDEN_IN_VALUE_GLOBAL, " ")}" from ${source}. A workspace id cannot contain line breaks or control characters.`);
+  }
+  return trimmed;
+}
 function resolve(candidates, fallback, fallbackSource) {
   for (const [source, value] of candidates) {
     if (value !== null && value !== undefined && value !== "")
@@ -2565,6 +2610,9 @@ function resolveProfile(overrides = {}) {
   const name = named || DEFAULT_PROFILE;
   if (named && !overrides.allowUnknownProfile)
     requireKnownProfile(named);
+  if (named && overrides.allowUnknownProfile && !listProfiles().includes(named)) {
+    validateProfileName(named);
+  }
   const config = readConfigProfile(name);
   const authProfile = resolveAuthenticationProfileName(name);
   const authConfig = authProfile === name ? config : readConfigProfile(authProfile);
@@ -6518,7 +6566,8 @@ var V2_OPERATIONS = {
       version: "Numeric deployment version."
     },
     responseMode: "json",
-    summary: "Activate Workflow Version"
+    summary: "Activate Workflow Version",
+    personalKeyOnly: true
   },
   addTableColumn: {
     method: "POST",
@@ -6565,6 +6614,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Index Workspace Files",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -6585,6 +6635,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Apply Workflow Operations",
+    personalKeyOnly: true,
     query: {
       dryRun: {
         kind: "boolean",
@@ -6684,6 +6735,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Bulk Save Tag Definitions",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -6707,6 +6759,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Bulk Update Chunks",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -6722,7 +6775,7 @@ var V2_OPERATIONS = {
       chunkIds: {
         kind: "array",
         required: true,
-        describe: "Chunks to operate on, by identifier. Ids outside the document are ignored."
+        describe: "Chunks to operate on, by identifier. An id naming no chunk in the document is reported in errors and does not fail the request."
       }
     }
   },
@@ -6733,6 +6786,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Bulk Enable or Disable Documents",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -6957,6 +7011,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "Create Credential Connection",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7132,6 +7187,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Create Chunk",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7157,6 +7213,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Create Knowledge Connector",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7272,6 +7329,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Create Tag",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7379,6 +7437,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "Create Service-Account Credential",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7417,6 +7476,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "Create Skill",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7632,6 +7692,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "Create Workflow MCP Server",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7662,6 +7723,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { credentialId: "Credential to disconnect." },
     responseMode: "json",
     summary: "Disconnect Credential",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7752,6 +7814,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Delete Chunk",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7770,6 +7833,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Delete Knowledge Connector",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7840,6 +7904,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Delete Tag",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7855,6 +7920,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Delete Tag Definitions",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7886,9 +7952,10 @@ var V2_OPERATIONS = {
     method: "DELETE",
     path: "/api/v2/secrets/[name]",
     pathParams: ["name"],
-    pathParamDocs: { name: "Secret to create, replace, or delete." },
+    pathParamDocs: { name: "Secret to delete." },
     responseMode: "json",
     summary: "Delete Secret",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7912,6 +7979,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Delete Skill",
+    personalKeyOnly: true,
     query: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." }
     }
@@ -8022,7 +8090,8 @@ var V2_OPERATIONS = {
     pathParams: ["workflowId"],
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
-    summary: "Delete Workflow Chat Deployment"
+    summary: "Delete Workflow Chat Deployment",
+    personalKeyOnly: true
   },
   deleteWorkflowFolder: {
     method: "DELETE",
@@ -8072,7 +8141,8 @@ var V2_OPERATIONS = {
     pathParams: ["serverId"],
     pathParamDocs: { serverId: "Unique workflow-MCP server identifier." },
     responseMode: "json",
-    summary: "Delete Workflow MCP Server"
+    summary: "Delete Workflow MCP Server",
+    personalKeyOnly: true
   },
   deployWorkflow: {
     method: "POST",
@@ -8081,6 +8151,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Deploy Workflow",
+    personalKeyOnly: true,
     body: {
       name: { kind: "string", describe: "Optional label for the deployment version." },
       description: {
@@ -8096,6 +8167,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { serverId: "Unique workflow-MCP server identifier." },
     responseMode: "json",
     summary: "Publish Workflow As MCP Tool",
+    personalKeyOnly: true,
     body: {
       workflowId: {
         kind: "string",
@@ -8236,6 +8308,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { auditLogId: "Audit-log entry identifier." },
     responseMode: "json",
     summary: "Get Audit Log",
+    personalKeyOnly: true,
     query: {
       organizationId: {
         kind: "string",
@@ -8301,7 +8374,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["active", "archived"],
         default: "active",
-        describe: "Which lifecycle set to read from: `active` (default) resolves live files only and returns `404` for a file a `DELETE` soft-deleted; `archived` also resolves soft-deleted files, so metadata stays readable before `POST /files/{fileId}/restore`. Authorization is identical for both."
+        describe: "Which lifecycle set to read from: `active` (default) resolves live files only and returns `404` for a file a delete soft-deleted; `archived` also resolves soft-deleted files, so metadata stays readable before the file is restored. Authorization is identical for both."
       }
     }
   },
@@ -8364,6 +8437,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Get Chunk",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -8382,6 +8456,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Get Knowledge Connector",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -8489,6 +8564,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Get Next Tag Slot",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -8656,7 +8732,8 @@ var V2_OPERATIONS = {
     pathParams: ["workflowId"],
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
-    summary: "Get Workflow Chat Deployment"
+    summary: "Get Workflow Chat Deployment",
+    personalKeyOnly: true
   },
   getWorkflowDeployment: {
     method: "GET",
@@ -8672,7 +8749,8 @@ var V2_OPERATIONS = {
     pathParams: ["serverId"],
     pathParamDocs: { serverId: "Unique workflow-MCP server identifier." },
     responseMode: "json",
-    summary: "Get Workflow MCP Server"
+    summary: "Get Workflow MCP Server",
+    personalKeyOnly: true
   },
   getWorkflowRun: {
     method: "GET",
@@ -8739,6 +8817,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Grant Skill Editor",
+    personalKeyOnly: true,
     body: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
       email: {
@@ -8779,6 +8858,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "List Audit Logs",
+    personalKeyOnly: true,
     query: {
       action: { kind: "string", describe: "Filter by exact action name." },
       resourceType: {
@@ -9116,7 +9196,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["active", "archived"],
         default: "active",
-        describe: "Which lifecycle set to list: `active` (default) returns live folders only; `archived` returns folders a recursive `DELETE` soft-deleted, which is how a caller finds a path to hand to `POST /api/v2/files/folders/restore`. Authorization is identical for both."
+        describe: "Which lifecycle set to list: `active` (default) returns live folders only; `archived` returns folders a recursive delete soft-deleted, which is how a caller finds a path to hand to the folder restore. Authorization is identical for both."
       }
     }
   },
@@ -9158,7 +9238,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["active", "archived"],
         default: "active",
-        describe: "Which lifecycle set to list: `active` (default) for live files, `archived` for files a `DELETE` soft-deleted. `folderPath` resolves against active folders only, so pairing it with `scope=archived` returns an empty page when the containing folder was archived too."
+        describe: "Which lifecycle set to list: `active` (default) for live files, `archived` for files a delete soft-deleted. `folderPath` resolves against active folders only, so pairing it with `scope=archived` returns an empty page when the containing folder was archived too."
       },
       search: {
         kind: "string",
@@ -9246,6 +9326,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "List Chunks",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9295,6 +9376,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "List Knowledge Connector Documents",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9323,6 +9405,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "List Knowledge Connectors",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9466,6 +9549,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "List Tag Usage",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9624,6 +9708,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { mcpServerId: "Unique MCP server identifier." },
     responseMode: "json",
     summary: "List MCP Server Tools",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9642,6 +9727,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "List Secrets",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9834,7 +9920,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["active", "archived"],
         default: "active",
-        describe: "Which lifecycle set to list: `active` (default) for live tables, `archived` for tables a `DELETE` archived and `POST /tables/{tableId}/restore` can bring back. `folderPath` resolves against active folders only, so pairing it with `scope=archived` returns an empty page when the containing folder was archived too."
+        describe: "Which lifecycle set to list: `active` (default) for live tables, `archived` for tables a delete archived and a table restore can bring back. `folderPath` resolves against active folders only, so pairing it with `scope=archived` returns an empty page when the containing folder was archived too."
       },
       folderPath: {
         kind: "string",
@@ -9977,6 +10063,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "List Workflow MCP Servers",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -10012,7 +10099,8 @@ var V2_OPERATIONS = {
     pathParams: ["serverId"],
     pathParamDocs: { serverId: "Unique workflow-MCP server identifier." },
     responseMode: "json",
-    summary: "List Workflow MCP Tools"
+    summary: "List Workflow MCP Tools",
+    personalKeyOnly: true
   },
   listWorkflowRuns: {
     method: "GET",
@@ -10372,6 +10460,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Create or Replace Workflow Chat Deployment",
+    personalKeyOnly: true,
     body: {
       identifier: {
         kind: "string",
@@ -10424,6 +10513,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Replace Workflow State",
+    personalKeyOnly: true,
     query: {
       dryRun: {
         kind: "boolean",
@@ -10477,7 +10567,7 @@ var V2_OPERATIONS = {
       path: {
         kind: "string",
         required: true,
-        describe: "Path of the archived folder to restore, as reported by `GET /api/v2/files/folders?scope=archived`."
+        describe: "Path of the archived folder to restore, as reported by an archived-scope folder list."
       }
     }
   },
@@ -10522,7 +10612,7 @@ var V2_OPERATIONS = {
       path: {
         kind: "string",
         required: true,
-        describe: "Path the folder held when `DELETE /api/v2/tables/folders` archived it."
+        describe: "Path the folder held when a folder delete archived it."
       }
     }
   },
@@ -10562,7 +10652,8 @@ var V2_OPERATIONS = {
       version: "Numeric deployment version, or `active` for the currently live version."
     },
     responseMode: "json",
-    summary: "Revert Workflow To Version"
+    summary: "Revert Workflow To Version",
+    personalKeyOnly: true
   },
   revokeSkillEditor: {
     method: "DELETE",
@@ -10573,6 +10664,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Revoke Skill Editor",
+    personalKeyOnly: true,
     query: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
       email: {
@@ -10589,6 +10681,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Rollback Workflow",
+    personalKeyOnly: true,
     body: {
       version: {
         kind: "integer",
@@ -10683,9 +10776,10 @@ var V2_OPERATIONS = {
     method: "PUT",
     path: "/api/v2/secrets/[name]",
     pathParams: ["name"],
-    pathParamDocs: { name: "Secret to create, replace, or delete." },
+    pathParamDocs: { name: "Secret to create or replace." },
     responseMode: "json",
     summary: "Set Secret",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -10700,8 +10794,7 @@ var V2_OPERATIONS = {
       },
       value: {
         kind: "string",
-        required: true,
-        describe: "Write-only secret value. It is never returned."
+        describe: "Write-only secret value. It is never returned. Omit it on a workspace secret to change description or unredacted alone, leaving the stored value untouched; the secret must already exist. Always required for a personal secret, which carries no other writable field."
       },
       description: {
         kind: "string",
@@ -10723,6 +10816,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Sync Knowledge Connector",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -10760,7 +10854,8 @@ var V2_OPERATIONS = {
     pathParams: ["workflowId"],
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
-    summary: "Undeploy Workflow"
+    summary: "Undeploy Workflow",
+    personalKeyOnly: true
   },
   undeployWorkflowMcpTool: {
     method: "DELETE",
@@ -10771,7 +10866,8 @@ var V2_OPERATIONS = {
       workflowId: "Workflow published as a tool on this server."
     },
     responseMode: "json",
-    summary: "Unpublish Workflow MCP Tool"
+    summary: "Unpublish Workflow MCP Tool",
+    personalKeyOnly: true
   },
   unzipFile: {
     method: "POST",
@@ -10791,6 +10887,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { credentialId: "Credential to update." },
     responseMode: "json",
     summary: "Update Credential",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -10892,6 +10989,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Chunk",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -10918,6 +11016,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Knowledge Connector",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -10949,6 +11048,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Knowledge Connector Documents",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -10978,6 +11078,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Document",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -11022,6 +11123,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Tag",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -11126,6 +11228,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Skill",
+    personalKeyOnly: true,
     body: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
       name: { kind: "string", describe: "New kebab-case skill name." },
@@ -11263,6 +11366,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { serverId: "Unique workflow-MCP server identifier." },
     responseMode: "json",
     summary: "Update Workflow MCP Server",
+    personalKeyOnly: true,
     body: {
       name: { kind: "string", describe: "Server display name, shown to connecting MCP clients." },
       description: { kind: "string", describe: "New server description, or null to clear it." },
@@ -11279,6 +11383,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Update Workflow Public API Access",
+    personalKeyOnly: true,
     body: {
       isPublicApi: {
         kind: "boolean",
@@ -11327,6 +11432,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { fileId: "File identifier." },
     responseMode: "json",
     summary: "Enable or Disable File Share",
+    personalKeyOnly: true,
     body: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the file." },
       isActive: {
@@ -11361,7 +11467,7 @@ var V2_OPERATIONS = {
       data: {
         kind: "object",
         required: true,
-        describe: "Complete set of row cells keyed by column name. On the update branch this REPLACES the matched row: any column not present here is cleared, unlike the merging `PATCH /api/v2/tables/{tableId}/rows/{rowId}`."
+        describe: "Complete set of row cells keyed by column name. On the update branch this REPLACES the matched row: any column not present here is cleared, unlike a single-row update, which merges."
       },
       conflictTarget: { kind: "string", describe: "Unique column used to detect a conflict." }
     }
@@ -11369,7 +11475,6 @@ var V2_OPERATIONS = {
 };
 
 // src/commands/auth.ts
-var PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 var MAX_INTERACTIVE_WORKSPACES = 1000;
 function openBrowser(url) {
   const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : [process.platform === "darwin" ? "open" : "xdg-open", [url]];
@@ -11410,13 +11515,16 @@ function selectedProfileName(command) {
   return globalsOf(command).profile || process.env.SIM_PROFILE || DEFAULT_PROFILE;
 }
 function validateNewProfileName(profileName) {
-  if (!PROFILE_NAME_PATTERN.test(profileName)) {
-    throw new SimApiError(`Invalid profile name "${profileName}". Use letters, numbers, dots, underscores, or hyphens, starting with a letter or number.`, 0);
-  }
+  validateProfileName(profileName);
   if (listProfiles().includes(profileName)) {
     throw new SimApiError(`Profile "${profileName}" already exists. Remove it first with: sim logout --all --profile ${profileName}`, 0);
   }
 }
+function requireStorableKey(apiKey) {
+  if (typeof apiKey !== "string" || !apiKey || apiKey !== apiKey.trim() || FORBIDDEN_IN_VALUE.test(apiKey)) {
+    throw new SimApiError("The server returned a malformed API key. Nothing was stored; check the endpoint.", 0);
+  }
+}
 function requireStoredAuthentication(profile) {
   const authProfile = resolveAuthenticationProfileName(profile.name);
   const storedKey = readCredentialsProfile(authProfile).api_key;
@@ -11476,7 +11584,7 @@ function addProfileCommand() {
     const workspace = workspaceId ? await getWorkspaceById(client, workspaceId) : await chooseWorkspace(client);
     writeConfigProfile(profileName, {
       auth_profile: authProfile,
-      workspace: workspace.id
+      workspace: normalizeWorkspaceId(workspace.id, "the workspace response")
     });
     console.log(source_default.green(`✓ Added profile "${profileName}" in ${configPath()}`));
     console.log(`  Workspace: ${safeOneLine(workspace.name)} (${workspace.id})`);
@@ -11518,12 +11626,13 @@ Waiting for approval…`));
     if (key.scope !== scope) {
       throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
     }
-    writeCredentialsProfile(profile.name, key.apiKey);
     const settings = {
       endpoint: profile.endpoint,
-      workspace: key.workspaceId ?? null
+      workspace: key.workspaceId == null ? null : normalizeWorkspaceId(key.workspaceId, "the login response")
     };
+    requireStorableKey(key.apiKey);
     writeConfigProfile(profile.name, settings);
+    writeCredentialsProfile(profile.name, key.apiKey);
     console.log(source_default.green(`
 ✓ Logged in. Key stored in ${credentialsPath()}`));
     if (key.workspaceBound && key.workspaceId) {
@@ -11687,30 +11796,62 @@ function whoamiCommand() {
       process.exitCode = exitCode;
   });
 }
+var PROFILE_COLUMNS = [
+  { header: "", value: (row) => row.active ? source_default.green("*") : " " },
+  { header: "profile", value: (row) => text(row.name) },
+  { header: "key", value: (row) => row.error ? text(null) : row.hasKey ? "yes" : "no" },
+  { header: "auth", value: (row) => text(row.authProfile) },
+  { header: "error", value: (row) => row.error ? source_default.red(safeOneLine(row.error)) : text(null) }
+];
+function buildProfileRow(name, active) {
+  try {
+    const authProfile = resolveAuthenticationProfileName(name);
+    return {
+      name,
+      active,
+      hasKey: Boolean(readCredentialsProfile(authProfile).api_key),
+      authProfile,
+      error: null
+    };
+  } catch (error) {
+    if (!(error instanceof ProfileConfigError))
+      throw error;
+    return { name, active, hasKey: false, authProfile: null, error: error.message };
+  }
+}
+function profileListingContext(command) {
+  try {
+    const profile = profileFrom(command);
+    return { activeName: profile.name, output: profile.output };
+  } catch (error) {
+    if (!(error instanceof ProfileConfigError))
+      throw error;
+    const globals = globalsOf(command);
+    const named = globals.profile || process.env.SIM_PROFILE;
+    if (named && named !== DEFAULT_PROFILE && !listProfiles().includes(named))
+      throw error;
+    const requested = globals.output ?? process.env.SIM_OUTPUT;
+    if (requested && !OUTPUT_FORMATS.includes(requested))
+      throw error;
+    return {
+      activeName: named || DEFAULT_PROFILE,
+      output: requested ? requested : "table"
+    };
+  }
+}
 function profilesCommand() {
   const command = new Command("profiles").alias("profile").description("List profiles or add a workspace profile that shares a stored login");
   const printProfiles = (_options, actionCommand) => {
-    const profiles = listProfiles();
-    if (profiles.length === 0) {
-      console.log(source_default.dim("No profiles yet. Run: sim login"));
+    const { activeName, output } = profileListingContext(actionCommand);
+    const rows = listProfiles().map((name) => buildProfileRow(name, name === activeName));
+    if (rows.length === 0) {
+      if (output === "table")
+        console.log(source_default.dim("No profiles yet. Run: sim login"));
+      else
+        printList(output, rows, PROFILE_COLUMNS);
       return;
     }
-    const active = selectedProfileName(actionCommand);
-    for (const name of profiles) {
-      const marker = name === active ? source_default.green("*") : " ";
-      let authProfile;
-      try {
-        authProfile = resolveAuthenticationProfileName(name);
-      } catch (error) {
-        if (!(error instanceof ProfileConfigError))
-          throw error;
-        console.log(`${marker} ${name}${source_default.red(`  (${safeOneLine(error.message)})`)}`);
-        continue;
-      }
-      const hasKey = Boolean(readCredentialsProfile(authProfile).api_key);
-      const authentication = authProfile === name ? "" : source_default.dim(`  (auth: ${authProfile})`);
-      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}${authentication}`);
-    }
+    printList(output, rows, PROFILE_COLUMNS);
   };
   command.action(printProfiles);
   command.addCommand(new Command("list").description("List configured profiles").action(printProfiles));
@@ -11719,6 +11860,11 @@ function profilesCommand() {
 }
 
 // src/commands/configure.ts
+var GLOBAL_FLAG_TWINS = [
+  { option: "endpoint", flag: "--endpoint", setFlag: "--set-endpoint" },
+  { option: "workspace", flag: "-w, --workspace", setFlag: "--set-workspace" },
+  { option: "output", flag: "--output", setFlag: "--set-output" }
+];
 function requireValue(value, flag, key) {
   if (value !== undefined && value.trim() === "") {
     throw new SimApiError(`${flag} requires a value. To remove it, run: sim configure --unset ${key}`, 0);
@@ -11726,6 +11872,13 @@ function requireValue(value, flag, key) {
 }
 function configureCommand() {
   return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
+    const globals = globalsOf(command);
+    for (const { option, flag, setFlag } of GLOBAL_FLAG_TWINS) {
+      const value = globals[option];
+      if (value === undefined)
+        continue;
+      throw new SimApiError(`${flag} applies to a single command and is not stored. To save it, run: sim configure ${setFlag} ${value}`, 0);
+    }
     const profile = profileFrom(command, { allowUnknownProfile: true });
     const authProfile = resolveAuthenticationProfileName(profile.name);
     const updates = {};
@@ -11738,8 +11891,9 @@ function configureCommand() {
       }
       updates.endpoint = normalizeEndpoint(options.setEndpoint, "--set-endpoint");
     }
-    if (options.setWorkspace)
-      updates.workspace = options.setWorkspace;
+    if (options.setWorkspace) {
+      updates.workspace = normalizeWorkspaceId(options.setWorkspace, "--set-workspace");
+    }
     if (options.setOutput) {
       if (!OUTPUT_FORMATS.includes(options.setOutput)) {
         throw new SimApiError(`Unknown output format "${options.setOutput}". Use one of: ${OUTPUT_FORMATS.join(", ")}`, 0);
@@ -11766,6 +11920,11 @@ function configureCommand() {
       }
       return;
     }
+    const removalOnly = Object.values(updates).every((value) => value === null);
+    if (removalOnly && Object.keys(readConfigProfile(profile.name)).length === 0) {
+      console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+      return;
+    }
     writeConfigProfile(profile.name, updates);
     console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
   });
@@ -11858,7 +12017,7 @@ var CLI_CONTRACT = {
   listBillingLogs: {
     command: "billing logs",
     allWorkspaces: true,
-    describe: "List credit usage events",
+    describe: "List credit usage events (a personal API key reports only your own events; a workspace API key reports every member's)",
     flags: {
       source: { describe: "Filter by usage source; sim-chat combines Copilot and workspace chat" },
       period: { describe: "Billing period" },
@@ -12014,14 +12173,14 @@ var CLI_CONTRACT = {
       }
     },
     columns: [
-      { header: "started", path: "startedAt", format: "timestamp" },
-      { header: "status" },
+      { header: "started", path: "startedAt", format: "timestamp", minWidth: 19 },
+      { header: "status", minWidth: 9 },
       { header: "level" },
-      { header: "trigger" },
-      { header: "workflow", path: "workflow.name" },
+      { header: "trigger", minWidth: 12 },
+      { header: "workflow", path: "workflow.name", minWidth: 24 },
       { header: "duration", path: "totalDurationMs", format: "duration" },
-      { header: "cost", path: "cost.total", format: "cost" },
-      { header: "run", path: "runId" }
+      { header: "cost", path: "cost.total", format: "cost", minWidth: 8 },
+      { header: "run", path: "runId", minWidth: 36 }
     ]
   },
   getLog: {
@@ -12769,6 +12928,23 @@ var CLI_CONTRACT = {
       }
     }
   },
+  listTableDispatches: {
+    columns: [
+      { header: "id" },
+      { header: "status" },
+      { header: "mode" },
+      { header: "max rows", path: "limit.max" },
+      { header: "processed", path: "processedCount" },
+      { header: "manual", path: "isManualRun", format: "bool" },
+      { header: "requested", path: "requestedAt", format: "timestamp" },
+      { header: "completed", path: "completedAt", format: "timestamp" },
+      { header: "canceled", path: "canceledAt", format: "timestamp" },
+      { header: "groups", path: "scope.groupIds", format: "count" },
+      { header: "rows", path: "scope.rowIds", format: "count" },
+      { header: "filtered", path: "scope.filtered", format: "bool" },
+      { header: "excluded", path: "scope.excludeRowIds", format: "count" }
+    ]
+  },
   runRowEnrichment: {
     command: "tables rows enrich",
     describe: "Run one row’s enrichment group"
@@ -12777,8 +12953,16 @@ var CLI_CONTRACT = {
   createTableImportPartUrls: { hidden: true },
   completeTableImport: { hidden: true },
   getTableImport: { flags: TRANSFER_TOKEN_OMITTED },
-  cancelTableImport: { command: "tables imports cancel", flags: TRANSFER_TOKEN_OMITTED },
-  cancelTableExport: { command: "tables exports cancel" },
+  cancelTableImport: {
+    command: "tables imports cancel",
+    flags: TRANSFER_TOKEN_OMITTED,
+    describe: "Stop a running import",
+    confirm: "This stops the import between row batches, so whatever it already wrote stays and nothing resumes it. A replace import empties the table before its first batch, so cancelling one leaves only part of the new file; an append adds its rows again if you import the file a second time."
+  },
+  cancelTableExport: {
+    command: "tables exports cancel",
+    describe: "Stop a running export"
+  },
   tableExportDownload: {
     command: "tables exports download",
     describe: "Get the download URL for a finished export"
@@ -12800,7 +12984,7 @@ var CLI_CONTRACT = {
       selectedOutputs: {
         name: "select-output",
         list: true,
-        describe: "Return blockName.field values (e.g. agent_1.content); missing fields are omitted"
+        describe: "Return blockName.field values from the streamed result (e.g. agent_1.content), requires --follow; missing fields are omitted"
       },
       stream: { omit: true },
       includeThinking: { omit: true },
@@ -12824,7 +13008,7 @@ var CLI_CONTRACT = {
       selectedOutputs: {
         name: "select-output",
         list: true,
-        describe: "Include blockName.field values in JSON or YAML output (e.g. agent_1.content)"
+        describe: "Include blockId or blockId.path values in JSON or YAML output; block names are not resolved on a finished run"
       }
     },
     fields: [
@@ -12935,6 +13119,13 @@ var PROFILE_INJECTED_FIELD = "workspaceId";
 function isProfileWorkspacePath(commandSpec, param) {
   return commandSpec.profileWorkspacePath === true && param === PROFILE_INJECTED_FIELD;
 }
+function cursorSlot(operationSpec) {
+  if (operationSpec.query && "cursor" in operationSpec.query)
+    return "query";
+  if (operationSpec.body && "cursor" in operationSpec.body)
+    return "body";
+  return null;
+}
 var JSON_KINDS = new Set(["object", "array", "unknown"]);
 function flagSpecFor(operation, field) {
   return CLI_CONTRACT[operation]?.flags?.[field] ?? {};
@@ -13001,6 +13192,9 @@ function readStdin() {
   }
   return Buffer.concat(chunks).toString("utf8");
 }
+function literalAtHint(error, path) {
+  return error?.code === "ENOENT" ? `. To pass the literal value @${path}, write @@${path}` : "";
+}
 function readArgumentSource(raw, flagName) {
   if (raw.startsWith("@@"))
     return { text: raw.slice(1), from: "" };
@@ -13020,7 +13214,7 @@ function readArgumentSource(raw, flagName) {
   try {
     return { text: readFileSync3(path, "utf8"), from: ` (read from ${path})` };
   } catch (error) {
-    throw new SimApiError(`--${flagName} cannot read ${path}: ${error.message}`, 0);
+    throw new SimApiError(`--${flagName} cannot read ${path}: ${error.message}${literalAtHint(error, path)}`, 0);
   }
 }
 function readListValues(raw, flagName) {
@@ -13113,6 +13307,7 @@ function coerce(raw, field, flag, flagName) {
     return encodeFolderPath(raw);
   return raw;
 }
+var NO_WORKSPACE_FALLBACK = "No workspace set. Pass --workspace, or run: sim configure --set-workspace <id>";
 function asQueryValue(value) {
   if (value === null || value === undefined)
     return;
@@ -13133,7 +13328,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
     const value = profileWorkspacePath ? workspaceId : pathFlag ? flags[camel(flagName)] : positional[positionalIndex++];
     if (value === undefined || value === null) {
       if (profileWorkspacePath) {
-        throw new SimApiError("No workspace set. Pass --workspace, or run: sim configure --set-workspace <id>", 0);
+        throw new SimApiError(NO_WORKSPACE_FALLBACK, 0);
       }
       throw new SimApiError(pathFlag ? `--${flagName} is required` : `Missing <${argumentName}>`, 0);
     }
@@ -13145,6 +13340,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
   const query = {};
   const body = {};
   const headers = {};
+  const paginatedLimit = cursorSlot(spec) !== null;
   for (const slot of ["query", "body", "headers"]) {
     for (const [field, descriptor] of Object.entries(spec[slot] ?? {})) {
       const flag = flagSpecFor(operation, field);
@@ -13154,10 +13350,13 @@ function buildRequest(operation, positional, flags, workspaceId) {
       const omitProfileWorkspace = commandSpec.allWorkspaces && flags.allWorkspaces === true;
       const provided = field === PROFILE_INJECTED_FIELD ? omitProfileWorkspace ? undefined : workspaceId : flags[camel(flagName)];
       const raw = provided ?? flag.requestDefault;
+      if (slot === "query" && typeof raw === "string" && raw.trim() === "" && !(field === "limit" && paginatedLimit)) {
+        throw new SimApiError(`--${flagName} cannot be empty`, 0);
+      }
       const value = coerce(raw ?? undefined, descriptor, flag, flagName);
       if (value === undefined) {
         if (descriptor.required) {
-          throw new SimApiError(field === PROFILE_INJECTED_FIELD ? "No workspace set. Pass --workspace, or run: sim configure --set-workspace <id>" : `--${flagName} is required`, 0);
+          throw new SimApiError(field === PROFILE_INJECTED_FIELD ? NO_WORKSPACE_FALLBACK : `--${flagName} is required`, 0);
         }
         continue;
       }
@@ -13333,7 +13532,8 @@ function at(row, path) {
 function decodeFolderPath(value) {
   return value.split("/").map((segment) => {
     try {
-      return decodeURIComponent(segment);
+      const decoded = decodeURIComponent(segment);
+      return decoded.includes("/") ? segment : decoded;
     } catch {
       return segment;
     }
@@ -13464,8 +13664,10 @@ function unwrapResource(data) {
   const [, value] = entries[0];
   return value && typeof value === "object" && !Array.isArray(value) ? value : data;
 }
-function renderPage(format, rows, spec, envelope) {
+function renderPage(format, rows, spec, envelope, options = {}) {
   writePageNote(spec, envelope);
+  writeEnvelopeTruncation(envelope);
+  writeCursorTruncation(rows.length, options.truncated === true);
   printList(format, rows, spec.columns ? columnsFrom(spec.columns) : inferColumns(rows, spec.expand));
 }
 function writePageNote(spec, envelope) {
@@ -13477,7 +13679,48 @@ function writePageNote(spec, envelope) {
   process.stderr.write(source_default.dim(`${spec.pageNote.label}: ${String(value)}
 `));
 }
-function renderResult(operation, format, raw, spec, options = {}) {
+var TRUNCATION_FLAG = /^truncated$|^[A-Za-z0-9]+Truncated$/;
+var NEGATED_TRUNCATION_FLAG = /^(?:not|un|non|never)Truncated$|(?:Not|Un|Non|Never)Truncated$/;
+function truncationFlags(container) {
+  if (!container || typeof container !== "object" || Array.isArray(container))
+    return [];
+  return Object.entries(container).filter(([key, value]) => value === true && TRUNCATION_FLAG.test(key) && !NEGATED_TRUNCATION_FLAG.test(key)).map(([key]) => key);
+}
+function responseTruncationFlags(envelope) {
+  return [...truncationFlags(envelope), ...truncationFlags(at(envelope, "data"))];
+}
+function foldPageEnvelope(current, page) {
+  if (current === undefined)
+    return page;
+  const raised = truncationFlags(page);
+  if (raised.length === 0 || !current || typeof current !== "object")
+    return current;
+  return {
+    ...current,
+    ...Object.fromEntries(raised.map((flag) => [flag, true]))
+  };
+}
+function spellOut(flag) {
+  return flag.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().trim();
+}
+function clippedSubject(flag) {
+  const subject = flag.replace(/^truncated$|Truncated$/, "");
+  return subject ? `the ${spellOut(subject)} it returned` : "this result";
+}
+function writeEnvelopeTruncation(envelope) {
+  for (const flag of responseTruncationFlags(envelope)) {
+    process.stderr.write(source_default.dim(`${spellOut(flag)}: the server clipped ${clippedSubject(flag)}, so the answer is incomplete
+`));
+  }
+}
+function writeCursorTruncation(count, truncated) {
+  if (!truncated)
+    return;
+  process.stderr.write(source_default.dim(`showing the first ${count}; more results exist — re-run with --limit 0 for all
+`));
+}
+function renderResult(operation, format, raw, spec, options = {}, envelope) {
+  writeEnvelopeTruncation(envelope);
   if (spec.document) {
     printDocument(format, raw);
     return;
@@ -13620,8 +13863,8 @@ function attachCredentialCommands(program2) {
   if (!credentials)
     throw new Error("The generated credentials command group is missing");
   acceptNameOnUpdate(credentials);
-  credentials.command("create").argument("<providerId>", "Service-account provider to create a credential for").description("Create a service-account credential using its discovered provider schema").requiredOption("--name <displayName>", "Name shown for the credential in Sim").requiredOption("--credentials <json|@file>", "Provider credentials as JSON (or @path / @- to read a file or stdin)").option("--description <description>", "Optional credential description").option("--id <credentialId>", "Client-generated credential ID when provider discovery requires it").action((providerId, options, command) => createServiceAccount(command, providerId, options));
-  credentials.command("connect").argument("<providerId>", "OAuth provider to connect").description("Create a short-lived link for connecting an OAuth provider").requiredOption("--name <displayName>", "Name shown for the new credential in Sim").action(async (providerId, options, command) => createConnectionLink(command, { providerId, displayName: options.name }));
+  credentials.command("create").argument("<providerId>", "Service-account provider to create a credential for").description("Create a service-account credential using its discovered provider schema").requiredOption("--name <displayName>", "Name shown for the credential in Sim (required)").requiredOption("--credentials <json|@file>", "Provider credentials as JSON (or @path / @- to read a file or stdin) (required)").option("--description <description>", "Optional credential description").option("--id <credentialId>", "Client-generated credential ID when provider discovery requires it").action((providerId, options, command) => createServiceAccount(command, providerId, options));
+  credentials.command("connect").argument("<providerId>", "OAuth provider to connect").description("Create a short-lived link for connecting an OAuth provider").requiredOption("--name <displayName>", "Name shown for the new credential in Sim (required)").action(async (providerId, options, command) => createConnectionLink(command, { providerId, displayName: options.name }));
   credentials.command("reconnect").argument("<credentialId>", "Existing OAuth credential to re-authorize").description("Create a short-lived link for reconnecting an OAuth credential").action((credentialId, _options, command) => createConnectionLink(command, { credentialId }));
 }
 
@@ -13775,7 +14018,7 @@ Examples:
 
 // src/commands/protocol/files-get.ts
 import { once as once2 } from "node:events";
-import { createWriteStream } from "node:fs";
+import { createWriteStream, rmSync } from "node:fs";
 import { link, lstat, mkdtemp, readlink, rename, rm } from "node:fs/promises";
 import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
 import { Readable } from "node:stream";
@@ -13831,37 +14074,66 @@ async function streamToFile(body, file, reportedPath = file.path) {
     throw writeFailure(reportedPath, error);
   }
 }
+var STAGE_SIGNALS = ["SIGINT", "SIGTERM"];
+function reRaise(signal) {
+  process.kill(process.pid, signal);
+}
+function removeStagingOnSignal(stagingDirectory, terminate = reRaise) {
+  const installed = STAGE_SIGNALS.map((signal) => {
+    const onSignal = () => {
+      process.off(signal, onSignal);
+      const directory = stagingDirectory();
+      if (directory) {
+        try {
+          rmSync(directory, { recursive: true, force: true });
+        } catch {}
+      }
+      terminate(signal);
+    };
+    process.on(signal, onSignal);
+    return [signal, onSignal];
+  });
+  return () => {
+    for (const [signal, onSignal] of installed)
+      process.off(signal, onSignal);
+  };
+}
 async function saveStagedFile(body, target, force) {
   let temporaryDirectory = null;
   let failure = null;
+  const disposeSignalCleanup = removeStagingOnSignal(() => temporaryDirectory);
   try {
-    const publicationTarget = force ? await forcedPublicationTarget(target) : target;
-    temporaryDirectory = await mkdtemp(join2(dirname2(publicationTarget), ".sim-download-"));
-    const temporaryPath = join2(temporaryDirectory, "payload");
-    await streamToFile(body, createWriteStream(temporaryPath, { flags: "wx" }), target);
-    if (force) {
-      await rename(temporaryPath, publicationTarget);
-    } else {
-      try {
-        await link(temporaryPath, publicationTarget);
-      } catch (error) {
-        throw unsupportedAtomicPublish(target, error) ?? error;
+    try {
+      const publicationTarget = force ? await forcedPublicationTarget(target) : target;
+      temporaryDirectory = await mkdtemp(join2(dirname2(publicationTarget), ".sim-download-"));
+      const temporaryPath = join2(temporaryDirectory, "payload");
+      await streamToFile(body, createWriteStream(temporaryPath, { flags: "wx" }), target);
+      if (force) {
+        await rename(temporaryPath, publicationTarget);
+      } else {
+        try {
+          await link(temporaryPath, publicationTarget);
+        } catch (error) {
+          throw unsupportedAtomicPublish(target, error) ?? error;
+        }
       }
+    } catch (error) {
+      failure = normalizedWriteFailure(target, error);
     }
-  } catch (error) {
-    failure = normalizedWriteFailure(target, error);
-  }
-  if (temporaryDirectory) {
-    try {
-      await rm(temporaryDirectory, { recursive: true, force: true });
-    } catch (cleanupError) {
-      if (failure)
-        throw combinedCleanupFailure(failure, temporaryDirectory, cleanupError);
-      throw new SimApiError(`Saved ${target}, but could not remove temporary directory ${temporaryDirectory}: ${cleanupError.message}`, 0);
+    if (temporaryDirectory) {
+      try {
+        await rm(temporaryDirectory, { recursive: true, force: true });
+      } catch (cleanupError) {
+        if (failure)
+          throw combinedCleanupFailure(failure, temporaryDirectory, cleanupError);
+        throw new SimApiError(`Saved ${target}, but could not remove temporary directory ${temporaryDirectory}: ${cleanupError.message}`, 0);
+      }
     }
+    if (failure)
+      throw failure;
+  } finally {
+    disposeSignalCleanup();
   }
-  if (failure)
-    throw failure;
 }
 async function saveToFile(body, target, force) {
   return saveStagedFile(body, target, force);
@@ -14172,6 +14444,7 @@ function renderCell2(value, format) {
 }
 var COLUMNS = (CLI_CONTRACT.listLogs?.columns ?? []).map((spec) => ({
   header: spec.header,
+  floor: Math.min(MAX_CELL_WIDTH2, spec.minWidth ?? 0),
   value: (row) => renderCell2(at2(row, spec.path ?? spec.header), spec.format)
 }));
 function oneLine2(value) {
@@ -14188,15 +14461,15 @@ function clamp2(value, width) {
 function createTableWriter() {
   let widths = null;
   return (rows) => {
-    const lines = rows.map((row) => COLUMNS.map((column) => oneLine2(column.value(row))));
+    const lines = rows.map((row) => COLUMNS.map((column) => clamp2(oneLine2(column.value(row)), MAX_CELL_WIDTH2)));
     if (!widths) {
-      widths = COLUMNS.map((column, index) => Math.min(MAX_CELL_WIDTH2, Math.max(visibleWidth(column.header), ...lines.map((line) => visibleWidth(line[index])))));
+      widths = COLUMNS.map((column, index) => Math.min(MAX_CELL_WIDTH2, Math.max(column.floor, visibleWidth(column.header), ...lines.map((line) => visibleWidth(line[index])))));
       const header = widths;
       console.log(source_default.dim(COLUMNS.map((column, index) => pad2(column.header.toUpperCase(), header[index])).join("  ").trimEnd()));
     }
     const locked = widths;
     for (const line of lines) {
-      console.log(line.map((cell, index) => pad2(clamp2(cell, locked[index]), locked[index])).join("  ").trimEnd());
+      console.log(line.map((cell, index) => pad2(cell, locked[index])).join("  ").trimEnd());
     }
   };
 }
@@ -14421,7 +14694,8 @@ var WIRE_VOCABULARY_SENTENCE = /\s*The listed spellings[^.]*\.\s*/g;
 function withoutWireVocabulary(documented) {
   return documented.replace(WIRE_VOCABULARY_SENTENCE, " ").trim();
 }
-function addFieldOption(command, operation, field, descriptor, slot) {
+var NON_PAGINATED_LIMIT_HINT = " (caps a --filter match only; omit it to act on every match, and note 0 is not accepted)";
+function addFieldOption(command, operation, field, descriptor, slot, paginates) {
   if (field === PROFILE_INJECTED_FIELD || field === "cursor")
     return;
   const flag = flagSpecFor(operation, field);
@@ -14429,11 +14703,11 @@ function addFieldOption(command, operation, field, descriptor, slot) {
     return;
   const name = flagNameFor(operation, field);
   const short = flag.short ? `-${flag.short}, ` : "";
-  if (field === "limit" && (descriptor.kind === "number" || descriptor.kind === "integer")) {
+  if (paginates && field === "limit" && (descriptor.kind === "number" || descriptor.kind === "integer")) {
     command.option("--limit <n>", "Maximum items to return (0 for everything)", String(DEFAULT_LIMIT));
     return;
   }
-  const documented = describeField(flag, descriptor, name, field);
+  const documented = `${describeField(flag, descriptor, name, field)}${field === "limit" && (descriptor.kind === "number" || descriptor.kind === "integer") ? NON_PAGINATED_LIMIT_HINT : ""}`;
   if (descriptor.kind === "boolean" || flag.boolean) {
     const booleanDoc = withoutWireVocabulary(documented);
     if (descriptor.required) {
@@ -14451,7 +14725,7 @@ function addFieldOption(command, operation, field, descriptor, slot) {
   const placeholder = takesList ? "<value...>" : flag.rowCap ? "<n>" : wantsJson ? "<json|@file>" : "<value>";
   const choices = flag.choices ?? descriptor.values;
   const literalNull = slot === "body" && !takesList && !wantsJson;
-  const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}${literalNull ? literalNullHint(documented, name) : ""}`;
+  const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line; @@value for a literal leading @)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}${literalNull ? literalNullHint(documented, name) : ""}`;
   const renamedFrom = flag.renamedFrom ?? [];
   const option = new Option(`${short}--${name} ${placeholder}`, describe);
   if (flag.hidden)
@@ -14480,13 +14754,14 @@ function addOperationOptions(command, operation, commandSpec, operationSpec) {
     const short = flag.short ? `-${flag.short}, ` : "";
     command.addOption(new Option(`${short}--${name} <${flag.placeholder ?? "value"}>`, `${flag.describe ?? operationSpec.pathParamDocs?.[param] ?? `Set ${name.replaceAll("-", " ")}`} (required)`).makeOptionMandatory());
   }
+  const paginates = cursorSlot(operationSpec) !== null;
   for (const slot of ["query", "body", "headers"]) {
     for (const [field, descriptor] of Object.entries(operationSpec[slot] ?? {})) {
       if (commandSpec.requestFields && !commandSpec.requestFields.includes(field))
         continue;
       if (commandSpec.positionals?.includes(field))
         continue;
-      addFieldOption(command, operation, field, descriptor, slot);
+      addFieldOption(command, operation, field, descriptor, slot, paginates);
     }
   }
   if (commandSpec.allWorkspaces) {
@@ -14663,13 +14938,16 @@ function validateTargetOptions(options) {
   return intoExisting;
 }
 function attachTableImport(tables) {
-  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").allowExcessArguments(false).description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table, as shown in the app").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
+  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").allowExcessArguments(false).description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table, as shown in the app").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("-y, --yes", "Confirm this destructive operation (required with --mode replace)").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     if (Boolean(path) === Boolean(options.fileId)) {
       throw new SimApiError("Pass exactly one of <path> or --file-id <id>", 0);
     }
     const intoExisting = validateTargetOptions(options);
+    if (intoExisting && options.mode === "replace" && options.yes !== true) {
+      throw new SimApiError("This deletes every row in the table before loading the CSV and cannot be undone. Re-run with --yes to confirm.", 0);
+    }
     const local = path ? await localFile(path) : null;
     const source = local ? {
       type: "upload",
@@ -14784,6 +15062,14 @@ var BULK_OUTCOME_CHECKS = {
       return null;
     return `Deleted nothing: none of the ${requested} requested ${requested === 1 ? "file was" : "files were"} deleted.`;
   },
+  addWorkspaceFilesToKnowledgeBase: (payload) => {
+    if (lengthOf(payload.added) > 0)
+      return null;
+    const failed = lengthOf(payload.failed);
+    if (failed === 0)
+      return null;
+    return `Indexed nothing: none of the ${failed} requested ${failed === 1 ? "file was" : "files were"} added.`;
+  },
   bulkDeleteTables: (payload) => {
     const items = payload.deletedItems;
     const deleted = countOf(items?.tables) + countOf(items?.folders);
@@ -14794,6 +15080,15 @@ var BULK_OUTCOME_CHECKS = {
       return null;
     return `Deleted nothing: ${missed} of ${missed} ${missed === 1 ? "item was" : "items were"} not found or could not be deleted.`;
   },
+  bulkUpdateKnowledgeChunks: (payload, body) => {
+    if (countOf(payload.processed) > 0)
+      return null;
+    const requested = lengthOf(body?.chunkIds);
+    if (requested === 0)
+      return null;
+    const reported2 = payload.errors?.[0];
+    return typeof reported2 === "string" && reported2 ? safeOneLine(reported2) : `Updated nothing: none of the ${requested} requested ${requested === 1 ? "chunk" : "chunks"} matched.`;
+  },
   moveTables: (payload) => {
     if (lengthOf(payload.moved) > 0)
       return null;
@@ -14825,12 +15120,18 @@ function bulkFailureMessage(operation, payload, body) {
     return null;
   return check(payload, body);
 }
-function cursorSlot(operationSpec) {
-  if (operationSpec.query && "cursor" in operationSpec.query)
-    return "query";
-  if (operationSpec.body && "cursor" in operationSpec.body)
-    return "body";
-  return null;
+var EXCLUSIVE_CAP_FIELDS = {
+  deleteTableRows: { cap: "limit", ids: "rowIds" }
+};
+function assertCapIsUsable(operation, flags) {
+  const exclusive = EXCLUSIVE_CAP_FIELDS[operation];
+  if (!exclusive)
+    return;
+  const cap = flagNameFor(operation, exclusive.cap);
+  const ids = flagNameFor(operation, exclusive.ids);
+  if (flags[camel(cap)] === undefined || flags[camel(ids)] === undefined)
+    return;
+  throw new SimApiError(`--${cap} caps a --filter match and does nothing to an explicit --${ids} list; pass one, not both`, 0);
 }
 function foldRenamedFlags(operation, commandSpec, flags) {
   for (const [field, flag] of Object.entries(commandSpec.flags ?? {})) {
@@ -14864,6 +15165,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
     requestFlags[camel(flagNameFor(operation, field))] = invocation[pathPositionalCount + index];
   }
   foldRenamedFlags(operation, commandSpec, requestFlags);
+  assertCapIsUsable(operation, requestFlags);
   if (commandSpec.confirm && !requestFlags.yes && requestFlags.dryRun !== true) {
     throw new SimApiError(`${commandSpec.confirm} Re-run with --yes to confirm.`, 0);
   }
@@ -14873,12 +15175,14 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
   const { client, profile } = clientFrom(host);
   const hasWorkspaceField = Boolean(operationSpec.query && PROFILE_INJECTED_FIELD in operationSpec.query || operationSpec.body && PROFILE_INJECTED_FIELD in operationSpec.body);
   const omitsWorkspace = commandSpec.allWorkspaces && requestFlags.allWorkspaces === true;
-  const request = buildRequest(operation, positional, requestFlags, hasWorkspaceField && !omitsWorkspace ? client.requireWorkspace() : profile.workspaceId);
+  const needsWorkspace = (hasWorkspaceField || commandSpec.profileWorkspacePath === true) && !omitsWorkspace;
+  const request = buildRequest(operation, positional, requestFlags, needsWorkspace ? client.requireWorkspace() : profile.workspaceId);
   const paging = cursorSlot(operationSpec);
   if (paging) {
-    const rawLimit = Number.parseInt(String(requestFlags.limit ?? DEFAULT_LIMIT), 10);
-    if (Number.isNaN(rawLimit) || rawLimit < 0) {
-      throw new SimApiError("--limit must be a non-negative number", 0);
+    const limitText = String(requestFlags.limit ?? DEFAULT_LIMIT).trim();
+    const rawLimit = limitText === "" ? Number.NaN : Number(limitText);
+    if (!Number.isInteger(rawLimit) || rawLimit < 0) {
+      throw new SimApiError("--limit must be a whole number of 0 or more (0 for everything)", 0);
     }
     const limit = rawLimit === 0 ? Number.POSITIVE_INFINITY : rawLimit;
     const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
@@ -14895,7 +15199,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
           query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
           body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
         });
-        envelope ??= page;
+        envelope = foldPageEnvelope(envelope, page);
         rows.push(...page.data);
         cursor = page.nextCursor;
         if (cursor && rows.length < limit)
@@ -14904,7 +15208,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
     } finally {
       progress.finish();
     }
-    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec, envelope);
+    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec, envelope, { truncated: Boolean(cursor) });
     return;
   }
   const result = await client.request(request.path, {
@@ -14914,9 +15218,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
     body: request.body
   });
   const payload = result?.data ?? result;
-  renderResult(operation, profile.output, payload, commandSpec, {
-    expandedTrace: requestFlags.trace === true
-  });
+  renderResult(operation, profile.output, payload, commandSpec, { expandedTrace: requestFlags.trace === true }, result);
   const failure = runFailureMessage(operation, payload) ?? bulkFailureMessage(operation, payload, request.body);
   if (failure)
     throw new SimApiError(failure, 0);
@@ -15141,6 +15443,9 @@ function followOrDelegate(previous) {
       command.setOptionValue("run", selection);
     const flags = command.optsWithGlobals();
     if (flags.follow !== true) {
+      if (Array.isArray(flags.selectOutput) && flags.selectOutput.length > 0) {
+        throw new SimApiError(flags.async === true ? "--select-output shapes a streamed result, and --async returns as soon as the run is queued, so there is no stream to shape. Drop one of them, or read the finished run with: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockId>[.path] — that resource matches block ids, not the block names --select-output takes here." : "--select-output shapes a streamed result; add --follow. To narrow a run that has already finished: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockId>[.path] — that resource matches block ids, not the block names --select-output takes here.", 0);
+      }
       if (flags.includeThinking === true || flags.includeToolCalls === true) {
         throw new SimApiError("--include-thinking and --include-tool-calls describe a stream; add --follow", 0);
       }
@@ -15455,6 +15760,8 @@ function validateWorkspaceOnlyFlag(flag, value, scope) {
 async function readSecretValue(options) {
   if (options.value !== undefined)
     return validateSecretValue(readValueArgument(options.value));
+  if (options.description !== undefined || options.unredacted !== undefined)
+    return;
   try {
     return validateSecretValue(await promptSecret());
   } catch (error) {
@@ -15464,7 +15771,10 @@ async function readSecretValue(options) {
     return process.exit(CANCELLED_EXIT_CODE);
   }
 }
-async function setSecret(name, options, command) {
+async function setSecret(name, options, command, redactionSpellings) {
+  if (redactionSpellings.size > 1) {
+    throw new SimApiError("Pass either --unredacted or --no-unredacted, not both: they are one setting, and commander keeps only whichever came last.", 0);
+  }
   const description = validateWorkspaceOnlyFlag("description", options.description, options.scope);
   const unredacted = validateWorkspaceOnlyFlag("unredacted", options.unredacted, options.scope);
   const value = await readSecretValue(options);
@@ -15475,7 +15785,7 @@ async function setSecret(name, options, command) {
     body: {
       workspaceId: client.requireWorkspace(),
       scope: options.scope,
-      value,
+      ...value === undefined ? {} : { value },
       description,
       ...unredacted === undefined ? {} : { unredacted }
     }
@@ -15486,7 +15796,85 @@ function attachSecretCommands(program2) {
   const secrets = program2.commands.find((command) => command.name() === "secrets");
   if (!secrets)
     throw new Error("The generated secrets command group is missing");
-  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value|@file>", "Secret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").option("--unredacted", `${V2_OPERATIONS.setSecret.body.unredacted.describe} Pass --no-unredacted to restore redaction`).option("--no-unredacted", "Send --unredacted as false").action((name, options, command) => setSecret(name, options, command));
+  const redactionSpellings = new Set;
+  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope (required)").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value|@file>", "Secret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").option("--unredacted", `${V2_OPERATIONS.setSecret.body.unredacted.describe} Pass --no-unredacted to restore redaction`).option("--no-unredacted", "Send --unredacted as false").on("option:unredacted", () => redactionSpellings.add("--unredacted")).on("option:no-unredacted", () => redactionSpellings.add("--no-unredacted")).action((name, options, command) => setSecret(name, options, command, redactionSpellings));
+}
+
+// src/runtime/naming.ts
+var WIRE_IDENTIFIER = /^[a-z]+[A-Z]/;
+function spellingFor(operation, commandSpec, operationSpec, field) {
+  if (field === PROFILE_INJECTED_FIELD)
+    return "--workspace";
+  if (field === "cursor")
+    return null;
+  if (operationSpec.pathParams.includes(field)) {
+    return commandSpec.pathFlags?.[field] ? `--${pathFlagNameFor(commandSpec, field)}` : `<${commandSpec.pathArgumentNames?.[field] ?? field}>`;
+  }
+  if (commandSpec.positionals?.includes(field))
+    return `<${flagNameFor(operation, field)}>`;
+  if (flagSpecFor(operation, field).omit)
+    return null;
+  if (commandSpec.requestFields && !commandSpec.requestFields.includes(field))
+    return null;
+  const declared = operationSpec.query && field in operationSpec.query || operationSpec.body && field in operationSpec.body || operationSpec.headers && field in operationSpec.headers;
+  if (!declared)
+    return null;
+  return `--${flagNameFor(operation, field)}`;
+}
+function typeableFields(operation, commandSpec, operationSpec) {
+  const spellings = new Map;
+  const fields = [
+    ...operationSpec.pathParams,
+    ...Object.keys(operationSpec.query ?? {}),
+    ...Object.keys(operationSpec.body ?? {}),
+    ...Object.keys(operationSpec.headers ?? {})
+  ];
+  for (const field of fields) {
+    if (spellings.has(field))
+      continue;
+    const spelling = spellingFor(operation, commandSpec, operationSpec, field);
+    if (spelling)
+      spellings.set(field, spelling);
+  }
+  return spellings;
+}
+function retypeMessage(message, spellings) {
+  let retyped = message;
+  for (const [field, spelling] of spellings) {
+    if (!WIRE_IDENTIFIER.test(field))
+      continue;
+    retyped = retyped.replaceAll(new RegExp(`\\b${field}\\b`, "g"), spelling);
+  }
+  return retyped;
+}
+function retypeDetails(details, spellings) {
+  if (Array.isArray(details))
+    return details.map((issue2) => retypeDetails(issue2, spellings));
+  if (!details || typeof details !== "object")
+    return details;
+  const issue = details;
+  const retyped = { ...issue };
+  if (Array.isArray(issue.path) && issue.path.length > 0) {
+    const [head, ...rest] = issue.path.map(String);
+    const spelling = spellings.get(head);
+    if (spelling)
+      retyped.path = [spelling, ...rest];
+  }
+  if (typeof issue.message === "string") {
+    retyped.message = retypeMessage(issue.message, spellings);
+  }
+  if (Array.isArray(issue.errors)) {
+    retyped.errors = retypeDetails(issue.errors, spellings);
+  }
+  return retyped;
+}
+function retypeApiError(error, operation, commandSpec, operationSpec) {
+  if (!(error instanceof SimApiError) || error.status === 0)
+    return error;
+  const spellings = typeableFields(operation, commandSpec, operationSpec);
+  if (spellings.size === 0)
+    return error;
+  return new SimApiError(retypeMessage(error.message, spellings), error.status, error.code, error.details === undefined ? undefined : retypeDetails(error.details, spellings));
 }
 
 // src/runtime/build.ts
@@ -15565,6 +15953,29 @@ function assertNoReservedProgramFlags(program2) {
   for (const child of program2.commands)
     walk(child, []);
 }
+function refuseHelpAfterUnknownCommand(program2) {
+  const walk = (command) => {
+    const internals = command;
+    const dispatchesOnly = command.commands.length > 0 && !internals._actionHandler && command.registeredArguments.length === 0;
+    if (dispatchesOnly) {
+      const known = new Set(["help"]);
+      for (const child of command.commands) {
+        known.add(child.name());
+        for (const alias of child.aliases())
+          known.add(alias);
+      }
+      command.on("beforeHelp", () => {
+        const first = command.args[0];
+        if (first === undefined || first.startsWith("-") || known.has(first))
+          return;
+        internals.unknownCommand();
+      });
+    }
+    for (const child of command.commands)
+      walk(child);
+  };
+  walk(program2);
+}
 function configureOperation(command, operation, spec) {
   const operationSpec = V2_OPERATIONS[operation];
   command.allowExcessArguments(false);
@@ -15625,10 +16036,13 @@ function configureOperation(command, operation, spec) {
       }
     }
   }
-  command.description(spec.describe ?? operationSpec.summary ?? `${operationSpec.method} ${operationSpec.path}`);
+  const described = spec.describe ?? operationSpec.summary ?? `${operationSpec.method} ${operationSpec.path}`;
+  command.description(operationSpec.personalKeyOnly ? `${described} (personal API key required)` : described);
   addOperationOptions(command, operation, spec, operationSpec);
   assertNoReservedFlags(command, operation);
-  command.action((...invocation) => executeOperation(operation, spec, operationSpec, invocation));
+  command.action((...invocation) => executeOperation(operation, spec, operationSpec, invocation).catch((error) => {
+    throw retypeApiError(error, operation, spec, operationSpec);
+  }));
   return command;
 }
 function buildLeaf(operation, spec, leafName) {
@@ -15816,6 +16230,7 @@ function buildProgram(options = {}) {
   attachProtocolCommands(program2);
   attachSecretCommands(program2);
   program2.addHelpText("after", HELP_EPILOGUE);
+  refuseHelpAfterUnknownCommand(program2);
   assertNoReservedProgramFlags(program2);
   return program2;
 }