sim 2.1.2 → 2.1.3-preview.50.1

package/dist/index.js

@@ -2315,8 +2315,26 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "n
 import { dirname } from "node:path";
 
 // src/config/ini.ts
+class ProfileConfigError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProfileConfigError";
+  }
+}
 var SECTION_PATTERN = /^\s*\[([^\]]*)\]\s*$/;
 var KV_PATTERN = /^\s*([A-Za-z0-9_.-]+)\s*=\s*(.*?)\s*$/;
+var FORBIDDEN_CLASS = "\\u0000-\\u001f\\u007f-\\u009f\\u2028\\u2029";
+var FORBIDDEN_IN_VALUE = new RegExp(`[${FORBIDDEN_CLASS}]`);
+var FORBIDDEN_IN_NAME = new RegExp(`[${FORBIDDEN_CLASS}[\\]]`);
+var WRITABLE_KEY = /^[A-Za-z0-9_.-]+$/;
+function assertWritable(text, what, forbidden) {
+  if (forbidden.test(text)) {
+    throw new ProfileConfigError(`Refusing to write ${what}: line breaks and control characters cannot be stored in the ~/.sim files, because the format has no way to escape them.`);
+  }
+  if (text !== text.trim()) {
+    throw new ProfileConfigError(`Refusing to write ${what}: leading or trailing whitespace is not preserved by the ~/.sim files, so it would not read back as written.`);
+  }
+}
 function parseIni(text) {
   const doc = { preamble: [], sections: [] };
   let current = null;
@@ -2327,7 +2345,7 @@ function parseIni(text) {
   for (const line of lines) {
     const sectionMatch = SECTION_PATTERN.exec(line);
     if (sectionMatch) {
-      current = { name: sectionMatch[1].trim(), entries: [] };
+      current = { name: sectionMatch[1].trim(), header: line, entries: [] };
       doc.sections.push(current);
       continue;
     }
@@ -2351,7 +2369,7 @@ function serializeIni(doc) {
       lines.pop();
     if (lines.length > 0)
       lines.push("");
-    lines.push(`[${section.name}]`);
+    lines.push(section.header ?? `[${section.name}]`);
     for (const entry of section.entries) {
       lines.push(entry.kind === "kv" ? `${entry.key} = ${entry.value}` : entry.text);
     }
@@ -2379,9 +2397,23 @@ function listSections(doc) {
   return doc.sections.map((s) => s.name);
 }
 function setSectionValues(doc, name, values) {
+  assertWritable(name, `a section named "${name}"`, FORBIDDEN_IN_NAME);
+  for (const [key, value] of Object.entries(values)) {
+    if (!WRITABLE_KEY.test(key)) {
+      throw new ProfileConfigError(`Refusing to write an unreadable setting name "${key}".`);
+    }
+    if (value === null)
+      continue;
+    if (value.trim() === "") {
+      throw new ProfileConfigError(`Refusing to write a blank value for "${key}".`);
+    }
+    assertWritable(value, `a value for "${key}"`, FORBIDDEN_IN_VALUE);
+  }
   const matching = doc.sections.filter((s) => s.name === name);
   let section = matching[0];
   if (!section) {
+    if (Object.values(values).every((value) => value === null))
+      return;
     section = { name, entries: [] };
     doc.sections.push(section);
     matching.push(section);
@@ -2413,11 +2445,21 @@ function removeSection(doc, name) {
 var DEFAULT_PROFILE = "default";
 var DEFAULT_ENDPOINT = "https://www.sim.ai";
 var OUTPUT_FORMATS = ["table", "json", "yaml", "text"];
+var FORBIDDEN_IN_VALUE_GLOBAL = new RegExp(FORBIDDEN_IN_VALUE.source, "g");
+function redact(value) {
+  return value.replace(FORBIDDEN_IN_VALUE_GLOBAL, " ");
+}
 
-class ProfileConfigError extends Error {
+class ProfileOverrideError extends ProfileConfigError {
   constructor(message) {
     super(message);
-    this.name = "ProfileConfigError";
+    this.name = "ProfileOverrideError";
+  }
+}
+var PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function validateProfileName(name) {
+  if (!PROFILE_NAME_PATTERN.test(name)) {
+    throw new ProfileConfigError(`Invalid profile name "${redact(name)}". Use letters, numbers, dots, underscores, or hyphens, starting with a letter or number.`);
   }
 }
 function configSectionName(profile) {
@@ -2446,24 +2488,24 @@ function resolveAuthenticationProfileName(profile) {
     return profile;
   const authProfile = config.auth_profile.trim();
   if (!authProfile) {
-    throw new ProfileConfigError(`Profile "${profile}" has an empty auth_profile.`);
+    throw new ProfileConfigError(`Profile "${redact(profile)}" has an empty auth_profile.`);
   }
   if (authProfile === profile) {
-    throw new ProfileConfigError(`Profile "${profile}" cannot use itself as auth_profile. Remove the auth_profile setting instead.`);
+    throw new ProfileConfigError(`Profile "${redact(profile)}" cannot use itself as auth_profile. Remove the auth_profile setting instead.`);
   }
   if (Object.hasOwn(config, "endpoint")) {
-    throw new ProfileConfigError(`Profile "${profile}" cannot set both auth_profile and endpoint. Set the endpoint on authentication profile "${authProfile}".`);
+    throw new ProfileConfigError(`Profile "${redact(profile)}" cannot set both auth_profile and endpoint. Set the endpoint on authentication profile "${redact(authProfile)}".`);
   }
   if (readCredentialsProfile(profile).api_key) {
-    throw new ProfileConfigError(`Profile "${profile}" cannot set both auth_profile and its own API key. Remove one of them.`);
+    throw new ProfileConfigError(`Profile "${redact(profile)}" cannot set both auth_profile and its own API key. Remove one of them.`);
   }
   const authConfig = readConfigProfile(authProfile);
   const credentials = readCredentialsProfile(authProfile);
   if (Object.keys(authConfig).length === 0 && Object.keys(credentials).length === 0) {
-    throw new ProfileConfigError(`Profile "${profile}" references missing auth_profile "${authProfile}".`);
+    throw new ProfileConfigError(`Profile "${redact(profile)}" references missing auth_profile "${redact(authProfile)}".`);
   }
   if (Object.hasOwn(authConfig, "auth_profile")) {
-    throw new ProfileConfigError(`Profile "${profile}" references auth_profile "${authProfile}", which also has auth_profile set. Authentication profile references cannot be chained.`);
+    throw new ProfileConfigError(`Profile "${redact(profile)}" references auth_profile "${redact(authProfile)}", which also has auth_profile set. Authentication profile references cannot be chained.`);
   }
   return authProfile;
 }
@@ -2473,7 +2515,7 @@ function listProfiles() {
     if (section === DEFAULT_PROFILE)
       names.add(DEFAULT_PROFILE);
     else if (section.startsWith("profile "))
-      names.add(section.slice("profile ".length).trim());
+      names.add(section.slice("profile ".length));
   }
   for (const section of listSections(readIni(credentialsPath()))) {
     names.add(section);
@@ -2511,10 +2553,10 @@ function requireKnownProfile(name) {
   if (known.includes(name))
     return;
   if (known.length === 0) {
-    throw new ProfileConfigError(`Unknown profile "${name}". No profiles are configured yet. Run: sim login --profile ${name}`);
+    throw new ProfileConfigError(`Unknown profile "${redact(name)}". No profiles are configured yet. Run: sim login --profile ${redact(name)}`);
   }
   const suggestion = nearestProfile(name, known);
-  throw new ProfileConfigError(`Unknown profile "${name}".${suggestion ? ` Did you mean "${suggestion}"?` : ""} Configured profiles: ${known.join(", ")}.`);
+  throw new ProfileConfigError(`Unknown profile "${redact(name)}".${suggestion ? ` Did you mean "${redact(suggestion)}"?` : ""} Configured profiles: ${known.map(redact).join(", ")}.`);
 }
 function listAuthenticationDependents(authProfile) {
   return listProfiles().filter((profile) => profile !== authProfile && readConfigProfile(profile).auth_profile?.trim() === authProfile);
@@ -2541,18 +2583,31 @@ function deleteProfile(profile) {
   return { config, credentials };
 }
 function normalizeEndpoint(endpoint, source) {
-  const trimmed = endpoint.replace(/\/+$/, "");
+  const trimmed = endpoint.trim().replace(/\/+$/, "");
+  if (FORBIDDEN_IN_VALUE.test(trimmed)) {
+    throw new ProfileConfigError(`Invalid endpoint "${redact(endpoint)}" from ${source}. An endpoint cannot contain line breaks or control characters.`);
+  }
   let parsed;
   try {
     parsed = new URL(trimmed);
   } catch {
-    throw new ProfileConfigError(`Invalid endpoint "${endpoint}" from ${source}. Use an absolute URL, e.g. ${DEFAULT_ENDPOINT} or http://localhost:3000`);
+    throw new ProfileConfigError(`Invalid endpoint "${redact(endpoint)}" from ${source}. Use an absolute URL, e.g. ${DEFAULT_ENDPOINT} or http://localhost:3000`);
   }
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
     throw new ProfileConfigError(`Unsupported endpoint scheme "${parsed.protocol.replace(/:$/, "")}" from ${source}. Use http or https, e.g. ${DEFAULT_ENDPOINT}`);
   }
   return trimmed;
 }
+function normalizeWorkspaceId(workspaceId, source) {
+  const trimmed = workspaceId.trim();
+  if (!trimmed) {
+    throw new ProfileConfigError(`Empty workspace id from ${source}.`);
+  }
+  if (FORBIDDEN_IN_VALUE.test(trimmed)) {
+    throw new ProfileConfigError(`Invalid workspace id "${redact(trimmed)}" from ${source}. A workspace id cannot contain line breaks or control characters.`);
+  }
+  return trimmed;
+}
 function resolve(candidates, fallback, fallbackSource) {
   for (const [source, value] of candidates) {
     if (value !== null && value !== undefined && value !== "")
@@ -2560,11 +2615,28 @@ function resolve(candidates, fallback, fallbackSource) {
   }
   return { value: fallback, source: fallbackSource };
 }
+var OVERRIDE_FLAGS = {
+  profile: "--profile",
+  endpoint: "--endpoint",
+  workspaceId: "--workspace"
+};
+function refuseBlankOverrides(overrides) {
+  for (const [key, flag] of Object.entries(OVERRIDE_FLAGS)) {
+    const value = overrides[key];
+    if (value !== undefined && value.trim() === "") {
+      throw new ProfileOverrideError(`${flag} requires a value. Omit the flag to fall back to what is configured.`);
+    }
+  }
+}
 function resolveProfile(overrides = {}) {
+  refuseBlankOverrides(overrides);
   const named = overrides.profile || process.env.SIM_PROFILE;
   const name = named || DEFAULT_PROFILE;
   if (named && !overrides.allowUnknownProfile)
     requireKnownProfile(named);
+  if (named && overrides.allowUnknownProfile && !listProfiles().includes(named)) {
+    validateProfileName(named);
+  }
   const config = readConfigProfile(name);
   const authProfile = resolveAuthenticationProfileName(name);
   const authConfig = authProfile === name ? config : readConfigProfile(authProfile);
@@ -2590,7 +2662,7 @@ function resolveProfile(overrides = {}) {
     ["config", config.output]
   ], "table", "default");
   if (!OUTPUT_FORMATS.includes(output.value)) {
-    throw new ProfileConfigError(`Unknown output format "${output.value}" from ${output.source}. Use one of: ${OUTPUT_FORMATS.join(", ")}`);
+    throw new ProfileConfigError(`Unknown output format "${redact(String(output.value))}" from ${output.source}. Use one of: ${OUTPUT_FORMATS.join(", ")}`);
   }
   return {
     name,
@@ -6518,7 +6590,8 @@ var V2_OPERATIONS = {
       version: "Numeric deployment version."
     },
     responseMode: "json",
-    summary: "Activate Workflow Version"
+    summary: "Activate Workflow Version",
+    personalKeyOnly: true
   },
   addTableColumn: {
     method: "POST",
@@ -6565,6 +6638,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Index Workspace Files",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -6585,6 +6659,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Apply Workflow Operations",
+    personalKeyOnly: true,
     query: {
       dryRun: {
         kind: "boolean",
@@ -6684,6 +6759,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Bulk Save Tag Definitions",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -6707,6 +6783,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Bulk Update Chunks",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -6722,7 +6799,7 @@ var V2_OPERATIONS = {
       chunkIds: {
         kind: "array",
         required: true,
-        describe: "Chunks to operate on, by identifier. Ids outside the document are ignored."
+        describe: "Chunks to operate on, by identifier. An id naming no chunk in the document is reported in errors and does not fail the request."
       }
     }
   },
@@ -6733,6 +6810,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Bulk Enable or Disable Documents",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -6957,6 +7035,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "Create Credential Connection",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7132,6 +7211,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Create Chunk",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7157,6 +7237,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Create Knowledge Connector",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7272,6 +7353,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Create Tag",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7379,6 +7461,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "Create Service-Account Credential",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7417,6 +7500,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "Create Skill",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7632,6 +7716,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "Create Workflow MCP Server",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -7662,6 +7747,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { credentialId: "Credential to disconnect." },
     responseMode: "json",
     summary: "Disconnect Credential",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7752,6 +7838,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Delete Chunk",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7770,6 +7857,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Delete Knowledge Connector",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7840,6 +7928,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Delete Tag",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7855,6 +7944,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Delete Tag Definitions",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7886,9 +7976,10 @@ var V2_OPERATIONS = {
     method: "DELETE",
     path: "/api/v2/secrets/[name]",
     pathParams: ["name"],
-    pathParamDocs: { name: "Secret to create, replace, or delete." },
+    pathParamDocs: { name: "Secret to delete." },
     responseMode: "json",
     summary: "Delete Secret",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -7912,6 +8003,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Delete Skill",
+    personalKeyOnly: true,
     query: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." }
     }
@@ -8022,7 +8114,8 @@ var V2_OPERATIONS = {
     pathParams: ["workflowId"],
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
-    summary: "Delete Workflow Chat Deployment"
+    summary: "Delete Workflow Chat Deployment",
+    personalKeyOnly: true
   },
   deleteWorkflowFolder: {
     method: "DELETE",
@@ -8072,7 +8165,8 @@ var V2_OPERATIONS = {
     pathParams: ["serverId"],
     pathParamDocs: { serverId: "Unique workflow-MCP server identifier." },
     responseMode: "json",
-    summary: "Delete Workflow MCP Server"
+    summary: "Delete Workflow MCP Server",
+    personalKeyOnly: true
   },
   deployWorkflow: {
     method: "POST",
@@ -8081,6 +8175,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Deploy Workflow",
+    personalKeyOnly: true,
     body: {
       name: { kind: "string", describe: "Optional label for the deployment version." },
       description: {
@@ -8096,6 +8191,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { serverId: "Unique workflow-MCP server identifier." },
     responseMode: "json",
     summary: "Publish Workflow As MCP Tool",
+    personalKeyOnly: true,
     body: {
       workflowId: {
         kind: "string",
@@ -8236,6 +8332,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { auditLogId: "Audit-log entry identifier." },
     responseMode: "json",
     summary: "Get Audit Log",
+    personalKeyOnly: true,
     query: {
       organizationId: {
         kind: "string",
@@ -8301,7 +8398,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["active", "archived"],
         default: "active",
-        describe: "Which lifecycle set to read from: `active` (default) resolves live files only and returns `404` for a file a `DELETE` soft-deleted; `archived` also resolves soft-deleted files, so metadata stays readable before `POST /files/{fileId}/restore`. Authorization is identical for both."
+        describe: "Which lifecycle set to read from: `active` (default) resolves live files only and returns `404` for a file a delete soft-deleted; `archived` also resolves soft-deleted files, so metadata stays readable before the file is restored. Authorization is identical for both."
       }
     }
   },
@@ -8364,6 +8461,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Get Chunk",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -8382,6 +8480,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Get Knowledge Connector",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -8489,6 +8588,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "Get Next Tag Slot",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -8656,7 +8756,8 @@ var V2_OPERATIONS = {
     pathParams: ["workflowId"],
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
-    summary: "Get Workflow Chat Deployment"
+    summary: "Get Workflow Chat Deployment",
+    personalKeyOnly: true
   },
   getWorkflowDeployment: {
     method: "GET",
@@ -8672,7 +8773,8 @@ var V2_OPERATIONS = {
     pathParams: ["serverId"],
     pathParamDocs: { serverId: "Unique workflow-MCP server identifier." },
     responseMode: "json",
-    summary: "Get Workflow MCP Server"
+    summary: "Get Workflow MCP Server",
+    personalKeyOnly: true
   },
   getWorkflowRun: {
     method: "GET",
@@ -8739,6 +8841,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Grant Skill Editor",
+    personalKeyOnly: true,
     body: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
       email: {
@@ -8779,6 +8882,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "List Audit Logs",
+    personalKeyOnly: true,
     query: {
       action: { kind: "string", describe: "Filter by exact action name." },
       resourceType: {
@@ -9116,7 +9220,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["active", "archived"],
         default: "active",
-        describe: "Which lifecycle set to list: `active` (default) returns live folders only; `archived` returns folders a recursive `DELETE` soft-deleted, which is how a caller finds a path to hand to `POST /api/v2/files/folders/restore`. Authorization is identical for both."
+        describe: "Which lifecycle set to list: `active` (default) returns live folders only; `archived` returns folders a recursive delete soft-deleted, which is how a caller finds a path to hand to the folder restore. Authorization is identical for both."
       }
     }
   },
@@ -9158,7 +9262,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["active", "archived"],
         default: "active",
-        describe: "Which lifecycle set to list: `active` (default) for live files, `archived` for files a `DELETE` soft-deleted. `folderPath` resolves against active folders only, so pairing it with `scope=archived` returns an empty page when the containing folder was archived too."
+        describe: "Which lifecycle set to list: `active` (default) for live files, `archived` for files a delete soft-deleted. `folderPath` resolves against active folders only, so pairing it with `scope=archived` returns an empty page when the containing folder was archived too."
       },
       search: {
         kind: "string",
@@ -9246,6 +9350,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "List Chunks",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9295,6 +9400,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "List Knowledge Connector Documents",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9323,6 +9429,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "List Knowledge Connectors",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9466,6 +9573,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { knowledgeBaseId: "Unique knowledge base identifier." },
     responseMode: "json",
     summary: "List Tag Usage",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9557,14 +9665,14 @@ var V2_OPERATIONS = {
       },
       includeJobRuns: {
         kind: "boolean",
-        describe: 'Whether Chat and Sim-agent job runs join the sequence alongside workflow runs. Job runs report `kind: "job"`, carry no `workflow` summary, and never carry a cost ledger. They are dropped entirely — not partially matched — whenever a filter they cannot answer is set (`workflowIds`, `workflowName`, `folderPaths`, `model`, or `status`), so a filter never means two different things across the union. Accepted only under `sortBy=startedAt`: job runs record cost as a document and no comparable status, so they cannot participate in the other orderings.'
+        describe: 'Whether Chat and Sim-agent job runs join the sequence alongside workflow runs. Job runs report `kind: "job"`, carry no `workflow` summary, and never carry a cost ledger. They are dropped entirely — not partially matched — whenever a filter they cannot answer is set: by workflow, workflow name, folder, model, or status. A filter therefore never means two different things across the union. Accepted only when sorting by `startedAt`: job runs record cost as a document and no comparable status, so they cannot participate in the other orderings.'
       },
       runId: { kind: "string", describe: "Exact run identifier to match." },
       sortBy: {
         kind: "enum",
         values: ["startedAt", "durationMs", "cost", "status"],
         default: "startedAt",
-        describe: "Field used to sort the result. `durationMs` and `cost` are null until a run settles; those runs order as though the value were below every recorded one, so they trail an ascending page and lead a descending one. Only `startedAt` can order Chat and Sim-agent job runs, so any other value is rejected together with `includeJobRuns=true`."
+        describe: "Field used to sort the result. `durationMs` and `cost` are null until a run settles; those runs order as though the value were below every recorded one, so they trail an ascending page and lead a descending one. Only `startedAt` can order Chat and Sim-agent job runs, so any other value is rejected when job runs are included."
       },
       sortOrder: {
         kind: "enum",
@@ -9624,6 +9732,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { mcpServerId: "Unique MCP server identifier." },
     responseMode: "json",
     summary: "List MCP Server Tools",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9642,6 +9751,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "List Secrets",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -9834,7 +9944,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["active", "archived"],
         default: "active",
-        describe: "Which lifecycle set to list: `active` (default) for live tables, `archived` for tables a `DELETE` archived and `POST /tables/{tableId}/restore` can bring back. `folderPath` resolves against active folders only, so pairing it with `scope=archived` returns an empty page when the containing folder was archived too."
+        describe: "Which lifecycle set to list: `active` (default) for live tables, `archived` for tables a delete archived and a table restore can bring back. `folderPath` resolves against active folders only, so pairing it with `scope=archived` returns an empty page when the containing folder was archived too."
       },
       folderPath: {
         kind: "string",
@@ -9977,6 +10087,7 @@ var V2_OPERATIONS = {
     pathParams: [],
     responseMode: "json",
     summary: "List Workflow MCP Servers",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -10012,7 +10123,8 @@ var V2_OPERATIONS = {
     pathParams: ["serverId"],
     pathParamDocs: { serverId: "Unique workflow-MCP server identifier." },
     responseMode: "json",
-    summary: "List Workflow MCP Tools"
+    summary: "List Workflow MCP Tools",
+    personalKeyOnly: true
   },
   listWorkflowRuns: {
     method: "GET",
@@ -10069,7 +10181,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["active", "archived"],
         default: "active",
-        describe: "Which lifecycle set to list: `active` (default) for live workflows, `archived` for workflows a `DELETE` archived. `folderPath` resolves against active folders only, so pairing it with `scope=archived` returns an empty page when the containing folder was archived too."
+        describe: "Which lifecycle set to list: `active` (default) for live workflows, `archived` for workflows a `DELETE` archived. The folder filter resolves against active folders only, so pairing it with `archived` returns an empty page when the containing folder was archived too."
       },
       folderPath: {
         kind: "string",
@@ -10372,6 +10484,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Create or Replace Workflow Chat Deployment",
+    personalKeyOnly: true,
     body: {
       identifier: {
         kind: "string",
@@ -10424,6 +10537,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Replace Workflow State",
+    personalKeyOnly: true,
     query: {
       dryRun: {
         kind: "boolean",
@@ -10477,7 +10591,7 @@ var V2_OPERATIONS = {
       path: {
         kind: "string",
         required: true,
-        describe: "Path of the archived folder to restore, as reported by `GET /api/v2/files/folders?scope=archived`."
+        describe: "Path of the archived folder to restore, as reported by an archived-scope folder list."
       }
     }
   },
@@ -10522,7 +10636,7 @@ var V2_OPERATIONS = {
       path: {
         kind: "string",
         required: true,
-        describe: "Path the folder held when `DELETE /api/v2/tables/folders` archived it."
+        describe: "Path the folder held when a folder delete archived it."
       }
     }
   },
@@ -10562,7 +10676,8 @@ var V2_OPERATIONS = {
       version: "Numeric deployment version, or `active` for the currently live version."
     },
     responseMode: "json",
-    summary: "Revert Workflow To Version"
+    summary: "Revert Workflow To Version",
+    personalKeyOnly: true
   },
   revokeSkillEditor: {
     method: "DELETE",
@@ -10573,6 +10688,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Revoke Skill Editor",
+    personalKeyOnly: true,
     query: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
       email: {
@@ -10589,6 +10705,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Rollback Workflow",
+    personalKeyOnly: true,
     body: {
       version: {
         kind: "integer",
@@ -10683,9 +10800,10 @@ var V2_OPERATIONS = {
     method: "PUT",
     path: "/api/v2/secrets/[name]",
     pathParams: ["name"],
-    pathParamDocs: { name: "Secret to create, replace, or delete." },
+    pathParamDocs: { name: "Secret to create or replace." },
     responseMode: "json",
     summary: "Set Secret",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -10700,8 +10818,7 @@ var V2_OPERATIONS = {
       },
       value: {
         kind: "string",
-        required: true,
-        describe: "Write-only secret value. It is never returned."
+        describe: "Write-only secret value. It is never returned. Omit it on a workspace secret to change description or unredacted alone, leaving the stored value untouched; the secret must already exist. Always required for a personal secret, which carries no other writable field."
       },
       description: {
         kind: "string",
@@ -10723,6 +10840,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Sync Knowledge Connector",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -10760,7 +10878,8 @@ var V2_OPERATIONS = {
     pathParams: ["workflowId"],
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
-    summary: "Undeploy Workflow"
+    summary: "Undeploy Workflow",
+    personalKeyOnly: true
   },
   undeployWorkflowMcpTool: {
     method: "DELETE",
@@ -10771,7 +10890,8 @@ var V2_OPERATIONS = {
       workflowId: "Workflow published as a tool on this server."
     },
     responseMode: "json",
-    summary: "Unpublish Workflow MCP Tool"
+    summary: "Unpublish Workflow MCP Tool",
+    personalKeyOnly: true
   },
   unzipFile: {
     method: "POST",
@@ -10791,6 +10911,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { credentialId: "Credential to update." },
     responseMode: "json",
     summary: "Update Credential",
+    personalKeyOnly: true,
     query: {
       workspaceId: {
         kind: "string",
@@ -10892,6 +11013,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Chunk",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -10918,6 +11040,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Knowledge Connector",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -10949,6 +11072,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Knowledge Connector Documents",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -10978,6 +11102,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Document",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -11022,6 +11147,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Tag",
+    personalKeyOnly: true,
     body: {
       workspaceId: {
         kind: "string",
@@ -11126,6 +11252,7 @@ var V2_OPERATIONS = {
     },
     responseMode: "json",
     summary: "Update Skill",
+    personalKeyOnly: true,
     body: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
       name: { kind: "string", describe: "New kebab-case skill name." },
@@ -11263,6 +11390,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { serverId: "Unique workflow-MCP server identifier." },
     responseMode: "json",
     summary: "Update Workflow MCP Server",
+    personalKeyOnly: true,
     body: {
       name: { kind: "string", describe: "Server display name, shown to connecting MCP clients." },
       description: { kind: "string", describe: "New server description, or null to clear it." },
@@ -11279,6 +11407,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Update Workflow Public API Access",
+    personalKeyOnly: true,
     body: {
       isPublicApi: {
         kind: "boolean",
@@ -11327,6 +11456,7 @@ var V2_OPERATIONS = {
     pathParamDocs: { fileId: "File identifier." },
     responseMode: "json",
     summary: "Enable or Disable File Share",
+    personalKeyOnly: true,
     body: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the file." },
       isActive: {
@@ -11361,7 +11491,7 @@ var V2_OPERATIONS = {
       data: {
         kind: "object",
         required: true,
-        describe: "Complete set of row cells keyed by column name. On the update branch this REPLACES the matched row: any column not present here is cleared, unlike the merging `PATCH /api/v2/tables/{tableId}/rows/{rowId}`."
+        describe: "Complete set of row cells keyed by column name. On the update branch this REPLACES the matched row: any column not present here is cleared, unlike a single-row update, which merges."
       },
       conflictTarget: { kind: "string", describe: "Unique column used to detect a conflict." }
     }
@@ -11369,7 +11499,6 @@ var V2_OPERATIONS = {
 };
 
 // src/commands/auth.ts
-var PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 var MAX_INTERACTIVE_WORKSPACES = 1000;
 function openBrowser(url) {
   const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : [process.platform === "darwin" ? "open" : "xdg-open", [url]];
@@ -11396,11 +11525,11 @@ function presentAuthentication(source) {
 }
 async function confirmProfileOverwrite(profileName) {
   if (!process.stdin.isTTY) {
-    throw new SimApiError(`Profile "${profileName}" already exists. Re-run with --yes to overwrite it.`, 0);
+    throw new SimApiError(`Profile "${redact(profileName)}" already exists. Re-run with --yes to overwrite it.`, 0);
   }
   const prompt = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = await prompt.question(`Profile "${profileName}" already exists. Replace its API key and login defaults? (y/N) `);
+    const answer = await prompt.question(`Profile "${redact(profileName)}" already exists. Replace its API key and login defaults? (y/N) `);
     return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
   } finally {
     prompt.close();
@@ -11410,21 +11539,24 @@ function selectedProfileName(command) {
   return globalsOf(command).profile || process.env.SIM_PROFILE || DEFAULT_PROFILE;
 }
 function validateNewProfileName(profileName) {
-  if (!PROFILE_NAME_PATTERN.test(profileName)) {
-    throw new SimApiError(`Invalid profile name "${profileName}". Use letters, numbers, dots, underscores, or hyphens, starting with a letter or number.`, 0);
-  }
+  validateProfileName(profileName);
   if (listProfiles().includes(profileName)) {
-    throw new SimApiError(`Profile "${profileName}" already exists. Remove it first with: sim logout --all --profile ${profileName}`, 0);
+    throw new SimApiError(`Profile "${redact(profileName)}" already exists. Remove it first with: sim logout --all --profile ${redact(profileName)}`, 0);
+  }
+}
+function requireStorableKey(apiKey) {
+  if (typeof apiKey !== "string" || !apiKey || apiKey !== apiKey.trim() || FORBIDDEN_IN_VALUE.test(apiKey)) {
+    throw new SimApiError("The server returned a malformed API key. Nothing was stored; check the endpoint.", 0);
   }
 }
 function requireStoredAuthentication(profile) {
   const authProfile = resolveAuthenticationProfileName(profile.name);
   const storedKey = readCredentialsProfile(authProfile).api_key;
   if (profile.sources.apiKey !== "credentials" || !storedKey) {
-    throw new SimApiError(`Cannot create a shared profile from "${profile.name}": the active API key is not stored. Run: sim login --profile ${authProfile}`, 0);
+    throw new SimApiError(`Cannot create a shared profile from "${redact(profile.name)}": the active API key is not stored. Run: sim login --profile ${redact(authProfile)}`, 0);
   }
   if (profile.sources.endpoint === "flag" || profile.sources.endpoint === "env") {
-    throw new SimApiError(`Cannot create a shared profile from "${profile.name}": the active endpoint comes from ${profile.sources.endpoint}. Save it with: sim configure --profile ${authProfile} --set-endpoint ${profile.endpoint}`, 0);
+    throw new SimApiError(`Cannot create a shared profile from "${redact(profile.name)}": the active endpoint comes from ${profile.sources.endpoint}. Save it with: sim configure --profile ${redact(authProfile)} --set-endpoint ${profile.endpoint}`, 0);
   }
   return authProfile;
 }
@@ -11476,12 +11608,12 @@ function addProfileCommand() {
     const workspace = workspaceId ? await getWorkspaceById(client, workspaceId) : await chooseWorkspace(client);
     writeConfigProfile(profileName, {
       auth_profile: authProfile,
-      workspace: workspace.id
+      workspace: normalizeWorkspaceId(workspace.id, "the workspace response")
     });
-    console.log(source_default.green(`✓ Added profile "${profileName}" in ${configPath()}`));
+    console.log(source_default.green(`✓ Added profile "${safeOneLine(profileName)}" in ${configPath()}`));
     console.log(`  Workspace: ${safeOneLine(workspace.name)} (${workspace.id})`);
-    console.log(`  Authentication: ${authProfile}`);
-    console.log(source_default.dim(`  Try: sim --profile ${profileName} whoami`));
+    console.log(`  Authentication: ${safeOneLine(authProfile)}`);
+    console.log(source_default.dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`));
   });
 }
 function loginCommand() {
@@ -11489,7 +11621,7 @@ function loginCommand() {
     const profile = profileFrom(command, { allowUnknownProfile: true });
     const authProfile = resolveAuthenticationProfileName(profile.name);
     if (authProfile !== profile.name) {
-      throw new SimApiError(`Profile "${profile.name}" shares authentication with "${authProfile}". Run: sim login --profile ${authProfile}`, 0);
+      throw new SimApiError(`Profile "${redact(profile.name)}" shares authentication with "${redact(authProfile)}". Run: sim login --profile ${redact(authProfile)}`, 0);
     }
     if (options.scope !== "platform" && options.scope !== "copilot") {
       throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
@@ -11504,7 +11636,7 @@ function loginCommand() {
     }
     const auth = createAuthRequest();
     const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
-    console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(profile.name)}`);
+    console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(safeOneLine(profile.name))}`);
     console.log(`
 Pairing code: ${source_default.bold(auth.pairing)}`);
     console.log(source_default.dim(`Confirm this code matches what the browser shows before approving.
@@ -11518,12 +11650,13 @@ Waiting for approval…`));
     if (key.scope !== scope) {
       throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
     }
-    writeCredentialsProfile(profile.name, key.apiKey);
     const settings = {
       endpoint: profile.endpoint,
-      workspace: key.workspaceId ?? null
+      workspace: key.workspaceId == null ? null : normalizeWorkspaceId(key.workspaceId, "the login response")
     };
+    requireStorableKey(key.apiKey);
     writeConfigProfile(profile.name, settings);
+    writeCredentialsProfile(profile.name, key.apiKey);
     console.log(source_default.green(`
 ✓ Logged in. Key stored in ${credentialsPath()}`));
     if (key.workspaceBound && key.workspaceId) {
@@ -11541,27 +11674,27 @@ function logoutCommand() {
       const profileName = selectedProfileName(command);
       const dependents = listAuthenticationDependents(profileName);
       if (dependents.length > 0) {
-        throw new SimApiError(`Cannot remove authentication profile "${profileName}" because it is used by: ${dependents.join(", ")}. Remove those profiles first.`, 0);
+        throw new SimApiError(`Cannot remove authentication profile "${redact(profileName)}" because it is used by: ${dependents.map(redact).join(", ")}. Remove those profiles first.`, 0);
       }
       const removed = deleteProfile(profileName);
       if (!removed.config && !removed.credentials) {
-        console.log(source_default.dim(`Nothing stored for profile "${profileName}".`));
+        console.log(source_default.dim(`Nothing stored for profile "${safeOneLine(profileName)}".`));
         return;
       }
-      console.log(source_default.green(`✓ Removed profile "${profileName}".`));
+      console.log(source_default.green(`✓ Removed profile "${safeOneLine(profileName)}".`));
       return;
     }
     const profile = profileFrom(command);
     const authProfile = resolveAuthenticationProfileName(profile.name);
     if (authProfile !== profile.name) {
-      throw new SimApiError(`Profile "${profile.name}" shares authentication with "${authProfile}". Log out of the authentication profile instead: sim logout --profile ${authProfile}`, 0);
+      throw new SimApiError(`Profile "${redact(profile.name)}" shares authentication with "${redact(authProfile)}". Log out of the authentication profile instead: sim logout --profile ${redact(authProfile)}`, 0);
     }
     if (!readCredentialsProfile(profile.name).api_key) {
-      console.log(source_default.dim(`No stored key for profile "${profile.name}".`));
+      console.log(source_default.dim(`No stored key for profile "${safeOneLine(profile.name)}".`));
       return;
     }
     writeCredentialsProfile(profile.name, null);
-    console.log(source_default.green(`✓ Removed the stored key for profile "${profile.name}".`));
+    console.log(source_default.green(`✓ Removed the stored key for profile "${safeOneLine(profile.name)}".`));
     console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
   });
 }
@@ -11591,7 +11724,7 @@ async function verifyProfile(client, profile) {
       status: "unauthenticated",
       workspace: null,
       keyType: null,
-      detail: `no API key — run: sim login --profile ${profile.name}`
+      detail: `no API key — run: sim login --profile ${safeOneLine(profile.name)}`
     };
   }
   const keyType = await readKeyType(client);
@@ -11600,7 +11733,7 @@ async function verifyProfile(client, profile) {
       status: "no-workspace",
       workspace: null,
       keyType,
-      detail: `no workspace to check against — run: sim configure --profile ${profile.name} --set-workspace <id>`
+      detail: `no workspace to check against — run: sim configure --profile ${safeOneLine(profile.name)} --set-workspace <id>`
     };
   }
   const operation = V2_OPERATIONS.getWorkspace;
@@ -11687,38 +11820,83 @@ function whoamiCommand() {
       process.exitCode = exitCode;
   });
 }
+var PROFILE_COLUMNS = [
+  { header: "", value: (row) => row.active ? source_default.green("*") : " " },
+  { header: "profile", value: (row) => safeOneLine(row.name) },
+  { header: "key", value: (row) => row.error ? text(null) : row.hasKey ? "yes" : "no" },
+  { header: "auth", value: (row) => row.authProfile ? safeOneLine(row.authProfile) : text(null) },
+  { header: "error", value: (row) => row.error ? source_default.red(safeOneLine(row.error)) : text(null) }
+];
+function buildProfileRow(name, active) {
+  try {
+    const authProfile = resolveAuthenticationProfileName(name);
+    return {
+      name,
+      active,
+      hasKey: Boolean(readCredentialsProfile(authProfile).api_key),
+      authProfile,
+      error: null
+    };
+  } catch (error) {
+    if (!(error instanceof ProfileConfigError))
+      throw error;
+    return { name, active, hasKey: false, authProfile: null, error: error.message };
+  }
+}
+function profileListingContext(command) {
+  try {
+    const profile = profileFrom(command);
+    return { activeName: profile.name, output: profile.output };
+  } catch (error) {
+    if (!(error instanceof ProfileConfigError))
+      throw error;
+    if (error instanceof ProfileOverrideError)
+      throw error;
+    const globals = globalsOf(command);
+    const named = globals.profile || process.env.SIM_PROFILE;
+    if (named && named !== DEFAULT_PROFILE && !listProfiles().includes(named))
+      throw error;
+    const requested = globals.output ?? process.env.SIM_OUTPUT;
+    if (requested && !OUTPUT_FORMATS.includes(requested))
+      throw error;
+    return {
+      activeName: named || DEFAULT_PROFILE,
+      output: requested ? requested : "table"
+    };
+  }
+}
 function profilesCommand() {
   const command = new Command("profiles").alias("profile").description("List profiles or add a workspace profile that shares a stored login");
   const printProfiles = (_options, actionCommand) => {
-    const profiles = listProfiles();
-    if (profiles.length === 0) {
-      console.log(source_default.dim("No profiles yet. Run: sim login"));
+    const { activeName, output } = profileListingContext(actionCommand);
+    const rows = listProfiles().map((name) => buildProfileRow(name, name === activeName));
+    if (rows.length === 0) {
+      if (output === "table")
+        console.log(source_default.dim("No profiles yet. Run: sim login"));
+      else
+        printList(output, rows, PROFILE_COLUMNS);
       return;
     }
-    const active = selectedProfileName(actionCommand);
-    for (const name of profiles) {
-      const marker = name === active ? source_default.green("*") : " ";
-      let authProfile;
-      try {
-        authProfile = resolveAuthenticationProfileName(name);
-      } catch (error) {
-        if (!(error instanceof ProfileConfigError))
-          throw error;
-        console.log(`${marker} ${name}${source_default.red(`  (${safeOneLine(error.message)})`)}`);
-        continue;
-      }
-      const hasKey = Boolean(readCredentialsProfile(authProfile).api_key);
-      const authentication = authProfile === name ? "" : source_default.dim(`  (auth: ${authProfile})`);
-      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}${authentication}`);
-    }
+    printList(output, rows, PROFILE_COLUMNS);
   };
-  command.action(printProfiles);
-  command.addCommand(new Command("list").description("List configured profiles").action(printProfiles));
+  command.addCommand(new Command("list").allowExcessArguments(false).description("List configured profiles").action(printProfiles), { isDefault: true });
   command.addCommand(addProfileCommand());
+  const known = new Set(command.commands.flatMap((child) => [child.name(), ...child.aliases()]));
+  command.hook("preSubcommand", (group) => {
+    const first = group.args[0];
+    if (first !== undefined && !first.startsWith("-") && !known.has(first)) {
+      group.unknownCommand();
+    }
+  });
   return command;
 }
 
 // src/commands/configure.ts
+var GLOBAL_FLAG_TWINS = [
+  { option: "endpoint", flag: "--endpoint", setFlag: "--set-endpoint" },
+  { option: "workspace", flag: "-w, --workspace", setFlag: "--set-workspace" },
+  { option: "output", flag: "--output", setFlag: "--set-output" }
+];
 function requireValue(value, flag, key) {
   if (value !== undefined && value.trim() === "") {
     throw new SimApiError(`${flag} requires a value. To remove it, run: sim configure --unset ${key}`, 0);
@@ -11726,6 +11904,13 @@ function requireValue(value, flag, key) {
 }
 function configureCommand() {
   return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
+    const globals = globalsOf(command);
+    for (const { option, flag, setFlag } of GLOBAL_FLAG_TWINS) {
+      const value = globals[option];
+      if (value === undefined)
+        continue;
+      throw new SimApiError(`${flag} applies to a single command and is not stored. To save it, run: sim configure ${setFlag} ${value}`, 0);
+    }
     const profile = profileFrom(command, { allowUnknownProfile: true });
     const authProfile = resolveAuthenticationProfileName(profile.name);
     const updates = {};
@@ -11738,8 +11923,9 @@ function configureCommand() {
       }
       updates.endpoint = normalizeEndpoint(options.setEndpoint, "--set-endpoint");
     }
-    if (options.setWorkspace)
-      updates.workspace = options.setWorkspace;
+    if (options.setWorkspace) {
+      updates.workspace = normalizeWorkspaceId(options.setWorkspace, "--set-workspace");
+    }
     if (options.setOutput) {
       if (!OUTPUT_FORMATS.includes(options.setOutput)) {
         throw new SimApiError(`Unknown output format "${options.setOutput}". Use one of: ${OUTPUT_FORMATS.join(", ")}`, 0);
@@ -11748,7 +11934,7 @@ function configureCommand() {
     }
     for (const key of options.unset ?? []) {
       if (!["endpoint", "workspace", "output"].includes(key)) {
-        throw new SimApiError(`Cannot unset "${key}". Use endpoint, workspace, or output.`, 0);
+        throw new SimApiError(`Cannot unset "${redact(key)}". Use endpoint, workspace, or output.`, 0);
       }
       if (key === "endpoint" && authProfile !== profile.name) {
         throw new SimApiError(`Profile "${profile.name}" shares its endpoint with authentication profile "${authProfile}". Run: sim configure --profile ${authProfile} --unset endpoint`, 0);
@@ -11766,14 +11952,16 @@ function configureCommand() {
       }
       return;
     }
+    const removalOnly = Object.values(updates).every((value) => value === null);
+    if (removalOnly && Object.keys(readConfigProfile(profile.name)).length === 0) {
+      console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+      return;
+    }
     writeConfigProfile(profile.name, updates);
     console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
   });
 }
 
-// src/runtime/request.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, readSync } from "node:fs";
-
 // src/contract/commands.ts
 var TABLE_NAME_HELP = "Identifier: letters, numbers, and underscores; cannot start with a number";
 var TABLE_FILTER_HELP = 'Predicate: {"all":[{"field":"status","op":"eq","value":"active"}]}; groups use all/any. Operators: eq, ne, gt, gte, lt, lte, in, nin, contains, ncontains, startsWith, endsWith, like, ilike, nlike, nilike, isEmpty, isNotEmpty, isNull, isNotNull';
@@ -11858,7 +12046,7 @@ var CLI_CONTRACT = {
   listBillingLogs: {
     command: "billing logs",
     allWorkspaces: true,
-    describe: "List credit usage events",
+    describe: "List credit usage events (a personal API key reports only your own events; a workspace API key reports every member's)",
     flags: {
       source: { describe: "Filter by usage source; sim-chat combines Copilot and workspace chat" },
       period: { describe: "Billing period" },
@@ -12014,14 +12202,14 @@ var CLI_CONTRACT = {
       }
     },
     columns: [
-      { header: "started", path: "startedAt", format: "timestamp" },
-      { header: "status" },
+      { header: "started", path: "startedAt", format: "timestamp", minWidth: 19 },
+      { header: "status", minWidth: 9 },
       { header: "level" },
-      { header: "trigger" },
-      { header: "workflow", path: "workflow.name" },
+      { header: "trigger", minWidth: 12 },
+      { header: "workflow", path: "workflow.name", minWidth: 24 },
       { header: "duration", path: "totalDurationMs", format: "duration" },
-      { header: "cost", path: "cost.total", format: "cost" },
-      { header: "run", path: "runId" }
+      { header: "cost", path: "cost.total", format: "cost", minWidth: 8 },
+      { header: "run", path: "runId", minWidth: 36 }
     ]
   },
   getLog: {
@@ -12769,6 +12957,23 @@ var CLI_CONTRACT = {
       }
     }
   },
+  listTableDispatches: {
+    columns: [
+      { header: "id" },
+      { header: "status" },
+      { header: "mode" },
+      { header: "max rows", path: "limit.max" },
+      { header: "processed", path: "processedCount" },
+      { header: "manual", path: "isManualRun", format: "bool" },
+      { header: "requested", path: "requestedAt", format: "timestamp" },
+      { header: "completed", path: "completedAt", format: "timestamp" },
+      { header: "canceled", path: "canceledAt", format: "timestamp" },
+      { header: "groups", path: "scope.groupIds", format: "count" },
+      { header: "rows", path: "scope.rowIds", format: "count" },
+      { header: "filtered", path: "scope.filtered", format: "bool" },
+      { header: "excluded", path: "scope.excludeRowIds", format: "count" }
+    ]
+  },
   runRowEnrichment: {
     command: "tables rows enrich",
     describe: "Run one row’s enrichment group"
@@ -12777,8 +12982,16 @@ var CLI_CONTRACT = {
   createTableImportPartUrls: { hidden: true },
   completeTableImport: { hidden: true },
   getTableImport: { flags: TRANSFER_TOKEN_OMITTED },
-  cancelTableImport: { command: "tables imports cancel", flags: TRANSFER_TOKEN_OMITTED },
-  cancelTableExport: { command: "tables exports cancel" },
+  cancelTableImport: {
+    command: "tables imports cancel",
+    flags: TRANSFER_TOKEN_OMITTED,
+    describe: "Stop a running import",
+    confirm: "This stops the import between row batches, so whatever it already wrote stays and nothing resumes it. A replace import empties the table before its first batch, so cancelling one leaves only part of the new file; an append adds its rows again if you import the file a second time."
+  },
+  cancelTableExport: {
+    command: "tables exports cancel",
+    describe: "Stop a running export"
+  },
   tableExportDownload: {
     command: "tables exports download",
     describe: "Get the download URL for a finished export"
@@ -12800,7 +13013,7 @@ var CLI_CONTRACT = {
       selectedOutputs: {
         name: "select-output",
         list: true,
-        describe: "Return blockName.field values (e.g. agent_1.content); missing fields are omitted"
+        describe: "Return blockName.field values from the streamed result (e.g. agent_1.content), requires --follow; missing fields are omitted"
       },
       stream: { omit: true },
       includeThinking: { omit: true },
@@ -12824,7 +13037,7 @@ var CLI_CONTRACT = {
       selectedOutputs: {
         name: "select-output",
         list: true,
-        describe: "Include blockName.field values in JSON or YAML output (e.g. agent_1.content)"
+        describe: "Include blockId or blockId.path values in JSON or YAML output; block names are not resolved on a finished run"
       }
     },
     fields: [
@@ -12931,11 +13144,20 @@ function camel(flag) {
 }
 
 // src/runtime/request.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, readSync } from "node:fs";
 var PROFILE_INJECTED_FIELD = "workspaceId";
 function isProfileWorkspacePath(commandSpec, param) {
   return commandSpec.profileWorkspacePath === true && param === PROFILE_INJECTED_FIELD;
 }
+function cursorSlot(operationSpec) {
+  if (operationSpec.query && "cursor" in operationSpec.query)
+    return "query";
+  if (operationSpec.body && "cursor" in operationSpec.body)
+    return "body";
+  return null;
+}
 var JSON_KINDS = new Set(["object", "array", "unknown"]);
+var NUMERIC_KINDS = new Set(["number", "integer"]);
 function flagSpecFor(operation, field) {
   return CLI_CONTRACT[operation]?.flags?.[field] ?? {};
 }
@@ -13001,6 +13223,9 @@ function readStdin() {
   }
   return Buffer.concat(chunks).toString("utf8");
 }
+function literalAtHint(error, path) {
+  return error?.code === "ENOENT" ? `. To pass the literal value @${path}, write @@${path}` : "";
+}
 function readArgumentSource(raw, flagName) {
   if (raw.startsWith("@@"))
     return { text: raw.slice(1), from: "" };
@@ -13020,7 +13245,7 @@ function readArgumentSource(raw, flagName) {
   try {
     return { text: readFileSync3(path, "utf8"), from: ` (read from ${path})` };
   } catch (error) {
-    throw new SimApiError(`--${flagName} cannot read ${path}: ${error.message}`, 0);
+    throw new SimApiError(`--${flagName} cannot read ${path}: ${error.message}${literalAtHint(error, path)}`, 0);
   }
 }
 function readListValues(raw, flagName) {
@@ -13097,7 +13322,7 @@ function coerce(raw, field, flag, flagName) {
       throw new SimApiError(`--${flagName} must be valid JSON${source.from}: ${error.message}${pathHint(raw)}`, 0);
     }
   }
-  if (field.kind === "number" || field.kind === "integer") {
+  if (NUMERIC_KINDS.has(field.kind)) {
     const value = Number(raw);
     if (Number.isNaN(value))
       throw new SimApiError(`--${flagName} must be a number`, 0);
@@ -13113,6 +13338,7 @@ function coerce(raw, field, flag, flagName) {
     return encodeFolderPath(raw);
   return raw;
 }
+var NO_WORKSPACE_FALLBACK = "No workspace set. Pass --workspace, or run: sim configure --set-workspace <id>";
 function asQueryValue(value) {
   if (value === null || value === undefined)
     return;
@@ -13133,7 +13359,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
     const value = profileWorkspacePath ? workspaceId : pathFlag ? flags[camel(flagName)] : positional[positionalIndex++];
     if (value === undefined || value === null) {
       if (profileWorkspacePath) {
-        throw new SimApiError("No workspace set. Pass --workspace, or run: sim configure --set-workspace <id>", 0);
+        throw new SimApiError(NO_WORKSPACE_FALLBACK, 0);
       }
       throw new SimApiError(pathFlag ? `--${flagName} is required` : `Missing <${argumentName}>`, 0);
     }
@@ -13145,6 +13371,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
   const query = {};
   const body = {};
   const headers = {};
+  const paginatedLimit = cursorSlot(spec) !== null;
   for (const slot of ["query", "body", "headers"]) {
     for (const [field, descriptor] of Object.entries(spec[slot] ?? {})) {
       const flag = flagSpecFor(operation, field);
@@ -13154,10 +13381,13 @@ function buildRequest(operation, positional, flags, workspaceId) {
       const omitProfileWorkspace = commandSpec.allWorkspaces && flags.allWorkspaces === true;
       const provided = field === PROFILE_INJECTED_FIELD ? omitProfileWorkspace ? undefined : workspaceId : flags[camel(flagName)];
       const raw = provided ?? flag.requestDefault;
+      if ((slot === "query" || NUMERIC_KINDS.has(descriptor.kind)) && typeof raw === "string" && raw.trim() === "" && !(field === "limit" && paginatedLimit)) {
+        throw new SimApiError(`--${flagName} cannot be empty`, 0);
+      }
       const value = coerce(raw ?? undefined, descriptor, flag, flagName);
       if (value === undefined) {
         if (descriptor.required) {
-          throw new SimApiError(field === PROFILE_INJECTED_FIELD ? "No workspace set. Pass --workspace, or run: sim configure --set-workspace <id>" : `--${flagName} is required`, 0);
+          throw new SimApiError(field === PROFILE_INJECTED_FIELD ? NO_WORKSPACE_FALLBACK : `--${flagName} is required`, 0);
         }
         continue;
       }
@@ -13204,6 +13434,126 @@ function buildRequest(operation, positional, flags, workspaceId) {
   };
 }
 
+// src/runtime/options.ts
+var DEFAULT_LIMIT = 100;
+function describeField(flag, descriptor, name, field) {
+  return flag.describe ?? descriptor.describe ?? `Set ${name.replaceAll("-", " ") || field}`;
+}
+function literalNullHint(documented, name) {
+  return /\bnull\b/i.test(documented) ? ` (--${name} null sends the word, not JSON null)` : "";
+}
+var WIRE_VOCABULARY_SENTENCE = /\s*The listed spellings[^.]*\.\s*/g;
+function withoutWireVocabulary(documented) {
+  return documented.replace(WIRE_VOCABULARY_SENTENCE, " ").trim();
+}
+var NON_PAGINATED_LIMIT_HINT = " (caps a --filter match only; omit it to act on every match, and note 0 is not accepted)";
+function addFieldOption(command, operation, field, descriptor, slot, paginates) {
+  if (field === PROFILE_INJECTED_FIELD || field === "cursor")
+    return;
+  const flag = flagSpecFor(operation, field);
+  if (flag.omit)
+    return;
+  const name = flagNameFor(operation, field);
+  const short = flag.short ? `-${flag.short}, ` : "";
+  if (paginates && field === "limit" && (descriptor.kind === "number" || descriptor.kind === "integer")) {
+    command.option("--limit <n>", "Maximum items to return (0 for everything)", String(DEFAULT_LIMIT));
+    return;
+  }
+  const documented = `${describeField(flag, descriptor, name, field)}${field === "limit" && (descriptor.kind === "number" || descriptor.kind === "integer") ? NON_PAGINATED_LIMIT_HINT : ""}`;
+  if (descriptor.kind === "boolean" || flag.boolean) {
+    const booleanDoc = withoutWireVocabulary(documented);
+    if (descriptor.required) {
+      command.addOption(new Option(`${short}--${name} <true|false>`, `${booleanDoc} (required)`).choices(["true", "false"]).makeOptionMandatory());
+      return;
+    }
+    command.option(`${short}--${name}`, booleanDoc);
+    if (!flag.boolean || flag.negatable) {
+      command.option(`--no-${name}`, `Send --${name} as false`);
+    }
+    return;
+  }
+  const takesList = flag.list === true;
+  const wantsJson = takesJson(descriptor, flag);
+  const placeholder = takesList ? "<value...>" : flag.rowCap ? "<n>" : wantsJson ? "<json|@file>" : "<value>";
+  const choices = flag.choices ?? descriptor.values;
+  const literalNull = slot === "body" && !takesList && !wantsJson;
+  const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line; @@value for a literal leading @)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}${literalNull ? literalNullHint(documented, name) : ""}`;
+  const renamedFrom = flag.renamedFrom ?? [];
+  const option = new Option(`${short}--${name} ${placeholder}`, describe);
+  if (flag.hidden)
+    option.hideHelp();
+  if (choices && !takesList)
+    option.choices([...choices]);
+  if (descriptor.default !== undefined && field !== "limit") {
+    option.default(undefined, String(descriptor.default));
+  }
+  if (descriptor.required && renamedFrom.length === 0)
+    option.makeOptionMandatory();
+  command.addOption(option);
+  for (const previous of renamedFrom) {
+    const retired = new Option(`--${previous} ${placeholder}`).hideHelp();
+    if (choices && !takesList)
+      retired.choices([...choices]);
+    command.addOption(retired);
+  }
+}
+function addOperationOptions(command, operation, commandSpec, operationSpec) {
+  for (const param of operationSpec.pathParams) {
+    const flag = commandSpec.pathFlags?.[param];
+    if (!flag)
+      continue;
+    const name = pathFlagNameFor(commandSpec, param);
+    const short = flag.short ? `-${flag.short}, ` : "";
+    command.addOption(new Option(`${short}--${name} <${flag.placeholder ?? "value"}>`, `${flag.describe ?? operationSpec.pathParamDocs?.[param] ?? `Set ${name.replaceAll("-", " ")}`} (required)`).makeOptionMandatory());
+  }
+  const paginates = cursorSlot(operationSpec) !== null;
+  for (const slot of ["query", "body", "headers"]) {
+    for (const [field, descriptor] of Object.entries(operationSpec[slot] ?? {})) {
+      if (commandSpec.requestFields && !commandSpec.requestFields.includes(field))
+        continue;
+      if (commandSpec.positionals?.includes(field))
+        continue;
+      addFieldOption(command, operation, field, descriptor, slot, paginates);
+    }
+  }
+  if (commandSpec.allWorkspaces) {
+    command.option("--all-workspaces", "Do not filter to the configured workspace (personal API key required for account-wide access)");
+  }
+  if (commandSpec.expandedTrace) {
+    command.option("--trace", "Show expanded trace spans with inputs, outputs, errors, timing, and cost");
+  }
+  if (operationSpec.opaqueBody) {
+    if (commandSpec.bodyVariants) {
+      for (const variant of commandSpec.bodyVariants) {
+        command.option(`--${variant.name} <json|@file>`, `${variant.describe} (JSON, or @path / @-; choose exactly one body flag)`);
+      }
+    } else {
+      command.requiredOption("--body <json|@file>", "Request body as JSON (or @path / @- to read a file or stdin) (required)");
+    }
+  }
+  if (commandSpec.confirm) {
+    const exemptedByDryRun = operationSpec.query?.dryRun !== undefined || operationSpec.body?.dryRun !== undefined;
+    command.option("-y, --yes", exemptedByDryRun ? "Confirm this destructive operation (required unless --dry-run)" : "Confirm this destructive operation (required)");
+  }
+}
+
+// src/runtime/renamed.ts
+var warned = new Set;
+function warn(kind, from, to) {
+  const key = `${kind}:${from}`;
+  if (warned.has(key))
+    return;
+  warned.add(key);
+  process.stderr.write(`warning: ${kind} "${from}" has been renamed to "${to}". The old name still works.
+`);
+}
+function warnRenamedCommand(from, to) {
+  warn("command", `sim ${from}`, `sim ${to}`);
+}
+function warnRenamedFlag(from, to) {
+  warn("flag", `--${from}`, `--${to}`);
+}
+
 // src/output/trace.ts
 function traceSpan(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -13333,7 +13683,8 @@ function at(row, path) {
 function decodeFolderPath(value) {
   return value.split("/").map((segment) => {
     try {
-      return decodeURIComponent(segment);
+      const decoded = decodeURIComponent(segment);
+      return decoded.includes("/") ? segment : decoded;
     } catch {
       return segment;
     }
@@ -13464,8 +13815,10 @@ function unwrapResource(data) {
   const [, value] = entries[0];
   return value && typeof value === "object" && !Array.isArray(value) ? value : data;
 }
-function renderPage(format, rows, spec, envelope) {
+function renderPage(format, rows, spec, envelope, options = {}) {
   writePageNote(spec, envelope);
+  writeEnvelopeTruncation(envelope);
+  writeCursorTruncation(rows.length, options.truncated === true);
   printList(format, rows, spec.columns ? columnsFrom(spec.columns) : inferColumns(rows, spec.expand));
 }
 function writePageNote(spec, envelope) {
@@ -13477,7 +13830,48 @@ function writePageNote(spec, envelope) {
   process.stderr.write(source_default.dim(`${spec.pageNote.label}: ${String(value)}
 `));
 }
-function renderResult(operation, format, raw, spec, options = {}) {
+var TRUNCATION_FLAG = /^truncated$|^[A-Za-z0-9]+Truncated$/;
+var NEGATED_TRUNCATION_FLAG = /^(?:not|un|non|never)Truncated$|(?:Not|Un|Non|Never)Truncated$/;
+function truncationFlags(container) {
+  if (!container || typeof container !== "object" || Array.isArray(container))
+    return [];
+  return Object.entries(container).filter(([key, value]) => value === true && TRUNCATION_FLAG.test(key) && !NEGATED_TRUNCATION_FLAG.test(key)).map(([key]) => key);
+}
+function responseTruncationFlags(envelope) {
+  return [...truncationFlags(envelope), ...truncationFlags(at(envelope, "data"))];
+}
+function foldPageEnvelope(current, page) {
+  if (current === undefined)
+    return page;
+  const raised = truncationFlags(page);
+  if (raised.length === 0 || !current || typeof current !== "object")
+    return current;
+  return {
+    ...current,
+    ...Object.fromEntries(raised.map((flag) => [flag, true]))
+  };
+}
+function spellOut(flag) {
+  return flag.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().trim();
+}
+function clippedSubject(flag) {
+  const subject = flag.replace(/^truncated$|Truncated$/, "").replace(/^is(?=[A-Z]|$)/, "");
+  return subject ? `the ${spellOut(subject)} it returned` : "this result";
+}
+function writeEnvelopeTruncation(envelope) {
+  for (const flag of responseTruncationFlags(envelope)) {
+    process.stderr.write(source_default.dim(`${spellOut(flag)}: the server clipped ${clippedSubject(flag)}, so the answer is incomplete
+`));
+  }
+}
+function writeCursorTruncation(count, truncated) {
+  if (!truncated)
+    return;
+  process.stderr.write(source_default.dim(`showing the first ${count}; more results exist — re-run with --limit 0 for all
+`));
+}
+function renderResult(operation, format, raw, spec, options = {}, envelope) {
+  writeEnvelopeTruncation(envelope);
   if (spec.document) {
     printDocument(format, raw);
     return;
@@ -13509,31 +13903,577 @@ function renderResult(operation, format, raw, spec, options = {}) {
   }
 }
 
-// src/commands/credentials.ts
-var CONNECTION_RESULT = {
-  fields: [
-    { header: "connection link", path: "authorizationUrl" },
-    { header: "expires", path: "expiresAt", format: "timestamp" }
-  ]
-};
-var SERVICE_ACCOUNT_RESULT = {
-  fields: [
-    { header: "id" },
-    { header: "name", path: "displayName" },
-    { header: "provider", path: "providerId" },
-    { header: "role" },
-    { header: "created", path: "createdAt", format: "timestamp" }
-  ]
+// src/runtime/execute.ts
+var RUN_OUTCOME_OPERATIONS = new Set(["executeWorkflow"]);
+var FAILED_RUN_STATUS_MESSAGES = {
+  failed: "The workflow run failed.",
+  cancelled: "The workflow run was cancelled."
 };
-function serviceAccountProvider(providers, providerId) {
-  const provider = providers.find((candidate) => candidate.type === "service_account" && candidate.providerId === providerId);
-  if (!provider) {
-    throw new SimApiError(`Unknown service-account provider "${providerId}".`, 0);
-  }
-  if (!provider.available) {
-    throw new SimApiError(`Service-account provider "${providerId}" is not available.`, 0);
-  }
-  return provider;
+function runFailureMessage(operation, payload) {
+  if (!RUN_OUTCOME_OPERATIONS.has(operation))
+    return null;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const { status, error } = payload;
+  if (typeof status !== "string")
+    return null;
+  const fallback = FAILED_RUN_STATUS_MESSAGES[status];
+  if (!fallback)
+    return null;
+  const reported2 = error?.message;
+  return safeOneLine(typeof reported2 === "string" && reported2 ? reported2 : fallback);
+}
+var BULK_OUTCOME_CHECKS = {
+  bulkDeleteFiles: (payload, body) => {
+    if (countOf(payload.deletedItems?.files) > 0)
+      return null;
+    const requested = lengthOf(body?.fileIds);
+    if (requested === 0)
+      return null;
+    return `Deleted nothing: none of the ${requested} requested ${requested === 1 ? "file was" : "files were"} deleted.`;
+  },
+  addWorkspaceFilesToKnowledgeBase: (payload) => {
+    if (lengthOf(payload.added) > 0)
+      return null;
+    const failed = lengthOf(payload.failed);
+    if (failed === 0)
+      return null;
+    return `Indexed nothing: none of the ${failed} requested ${failed === 1 ? "file was" : "files were"} added.`;
+  },
+  bulkDeleteTables: (payload) => {
+    const items = payload.deletedItems;
+    const deleted = countOf(items?.tables) + countOf(items?.folders);
+    if (deleted > 0)
+      return null;
+    const missed = lengthOf(payload.notFound) + lengthOf(payload.failed);
+    if (missed === 0)
+      return null;
+    return `Deleted nothing: ${missed} of ${missed} ${missed === 1 ? "item was" : "items were"} not found or could not be deleted.`;
+  },
+  bulkUpdateKnowledgeChunks: (payload, body) => {
+    if (countOf(payload.processed) > 0)
+      return null;
+    const requested = lengthOf(body?.chunkIds);
+    if (requested === 0)
+      return null;
+    const reported2 = payload.errors?.[0];
+    return typeof reported2 === "string" && reported2 ? safeOneLine(reported2) : `Updated nothing: none of the ${requested} requested ${requested === 1 ? "chunk" : "chunks"} matched.`;
+  },
+  moveTables: (payload) => {
+    if (lengthOf(payload.moved) > 0)
+      return null;
+    const missed = lengthOf(payload.notFound) + lengthOf(payload.failed);
+    if (missed === 0)
+      return null;
+    return `Moved nothing: ${missed} of ${missed} ${missed === 1 ? "item was" : "items were"} not found or could not be moved.`;
+  },
+  moveWorkflows: (payload) => {
+    if (lengthOf(payload.moved) > 0)
+      return null;
+    const failed = lengthOf(payload.failed);
+    if (failed === 0)
+      return null;
+    return `Moved nothing: ${failed} of ${failed} ${failed === 1 ? "workflow" : "workflows"} could not be moved.`;
+  }
+};
+function countOf(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function lengthOf(value) {
+  return Array.isArray(value) ? value.length : 0;
+}
+function bulkFailureMessage(operation, payload, body) {
+  const check = BULK_OUTCOME_CHECKS[operation];
+  if (!check)
+    return null;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  return check(payload, body);
+}
+var EXCLUSIVE_CAP_FIELDS = {
+  deleteTableRows: { cap: "limit", ids: "rowIds" }
+};
+function assertCapIsUsable(operation, flags) {
+  const exclusive = EXCLUSIVE_CAP_FIELDS[operation];
+  if (!exclusive)
+    return;
+  const cap = flagNameFor(operation, exclusive.cap);
+  const ids = flagNameFor(operation, exclusive.ids);
+  if (flags[camel(cap)] === undefined || flags[camel(ids)] === undefined)
+    return;
+  throw new SimApiError(`--${cap} caps a --filter match and does nothing to an explicit --${ids} list; pass one, not both`, 0);
+}
+function foldRenamedFlags(operation, commandSpec, flags) {
+  for (const [field, flag] of Object.entries(commandSpec.flags ?? {})) {
+    if (!flag.renamedFrom?.length)
+      continue;
+    const current = flagNameFor(operation, field);
+    for (const previous of flag.renamedFrom) {
+      const supplied = flags[camel(previous)];
+      if (supplied === undefined)
+        continue;
+      if (flags[camel(current)] !== undefined) {
+        throw new SimApiError(`--${previous} is the former name of --${current}; pass one, not both`, 0);
+      }
+      warnRenamedFlag(previous, current);
+      flags[camel(current)] = supplied;
+    }
+  }
+}
+async function executeOperation(operation, commandSpec, operationSpec, invocation) {
+  const host = invocation[invocation.length - 1];
+  const inheritedFlags = host.optsWithGlobals();
+  const flags = {
+    ...inheritedFlags.workspace === undefined ? {} : { workspace: inheritedFlags.workspace },
+    ...inheritedFlags.allWorkspaces === undefined ? {} : { allWorkspaces: inheritedFlags.allWorkspaces },
+    ...invocation[invocation.length - 2]
+  };
+  const pathPositionalCount = operationSpec.pathParams.filter((param) => !commandSpec.pathFlags?.[param] && !isProfileWorkspacePath(commandSpec, param)).length;
+  const positional = invocation.slice(0, pathPositionalCount);
+  const requestFlags = { ...flags };
+  for (const [index, field] of (commandSpec.positionals ?? []).entries()) {
+    requestFlags[camel(flagNameFor(operation, field))] = invocation[pathPositionalCount + index];
+  }
+  foldRenamedFlags(operation, commandSpec, requestFlags);
+  assertCapIsUsable(operation, requestFlags);
+  if (commandSpec.confirm && !requestFlags.yes && requestFlags.dryRun !== true) {
+    throw new SimApiError(`${commandSpec.confirm} Re-run with --yes to confirm.`, 0);
+  }
+  if (commandSpec.allWorkspaces && requestFlags.allWorkspaces && requestFlags.workspace) {
+    throw new SimApiError("--all-workspaces cannot be combined with --workspace", 0);
+  }
+  const { client, profile } = clientFrom(host);
+  const hasWorkspaceField = Boolean(operationSpec.query && PROFILE_INJECTED_FIELD in operationSpec.query || operationSpec.body && PROFILE_INJECTED_FIELD in operationSpec.body);
+  const omitsWorkspace = commandSpec.allWorkspaces && requestFlags.allWorkspaces === true;
+  const needsWorkspace = (hasWorkspaceField || commandSpec.profileWorkspacePath === true) && !omitsWorkspace;
+  const request = buildRequest(operation, positional, requestFlags, needsWorkspace ? client.requireWorkspace() : profile.workspaceId);
+  const paging = cursorSlot(operationSpec);
+  if (paging) {
+    const limitText = String(requestFlags.limit ?? DEFAULT_LIMIT).trim();
+    const rawLimit = limitText === "" ? Number.NaN : Number(limitText);
+    if (!Number.isInteger(rawLimit) || rawLimit < 0) {
+      throw new SimApiError("--limit must be a whole number of 0 or more (0 for everything)", 0);
+    }
+    const limit = rawLimit === 0 ? Number.POSITIVE_INFINITY : rawLimit;
+    const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
+    const pageLimit = "limit" in (operationSpec[paging] ?? {}) ? { limit: pageSize } : {};
+    const rows = [];
+    const progress = pageProgress();
+    let cursor = null;
+    let envelope;
+    try {
+      do {
+        const page = await client.request(request.path, {
+          method: operationSpec.method,
+          headers: request.headers,
+          query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
+          body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
+        });
+        envelope = foldPageEnvelope(envelope, page);
+        rows.push(...page.data);
+        cursor = page.nextCursor;
+        if (cursor && rows.length < limit)
+          progress.advance(rows.length);
+      } while (cursor && rows.length < limit);
+    } finally {
+      progress.finish();
+    }
+    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec, envelope, { truncated: Boolean(cursor) });
+    return;
+  }
+  const result = await client.request(request.path, {
+    method: operationSpec.method,
+    headers: request.headers,
+    query: request.query,
+    body: request.body
+  });
+  const payload = result?.data ?? result;
+  renderResult(operation, profile.output, payload, commandSpec, { expandedTrace: requestFlags.trace === true }, result);
+  const failure = runFailureMessage(operation, payload) ?? bulkFailureMessage(operation, payload, request.body);
+  if (failure)
+    throw new SimApiError(failure, 0);
+}
+
+// src/runtime/naming.ts
+var WIRE_IDENTIFIER = /^[a-z]+[A-Z]/;
+function spellingFor(operation, commandSpec, operationSpec, field) {
+  if (field === PROFILE_INJECTED_FIELD)
+    return "--workspace";
+  if (field === "cursor")
+    return null;
+  if (operationSpec.pathParams.includes(field)) {
+    return commandSpec.pathFlags?.[field] ? `--${pathFlagNameFor(commandSpec, field)}` : `<${commandSpec.pathArgumentNames?.[field] ?? field}>`;
+  }
+  if (commandSpec.positionals?.includes(field))
+    return `<${flagNameFor(operation, field)}>`;
+  if (flagSpecFor(operation, field).omit)
+    return null;
+  if (commandSpec.requestFields && !commandSpec.requestFields.includes(field))
+    return null;
+  const declared = operationSpec.query && field in operationSpec.query || operationSpec.body && field in operationSpec.body || operationSpec.headers && field in operationSpec.headers;
+  if (!declared)
+    return null;
+  return `--${flagNameFor(operation, field)}`;
+}
+function typeableFields(operation, commandSpec, operationSpec) {
+  const spellings = new Map;
+  const fields = [
+    ...operationSpec.pathParams,
+    ...Object.keys(operationSpec.query ?? {}),
+    ...Object.keys(operationSpec.body ?? {}),
+    ...Object.keys(operationSpec.headers ?? {})
+  ];
+  for (const field of fields) {
+    if (spellings.has(field))
+      continue;
+    const spelling = spellingFor(operation, commandSpec, operationSpec, field);
+    if (spelling)
+      spellings.set(field, spelling);
+  }
+  return spellings;
+}
+function retypeMessage(message, spellings) {
+  let retyped = message;
+  for (const [field, spelling] of spellings) {
+    if (!WIRE_IDENTIFIER.test(field))
+      continue;
+    retyped = retyped.replaceAll(new RegExp(`\\b${field}\\b`, "g"), spelling);
+  }
+  return retyped;
+}
+function retypeDetails(details, spellings) {
+  if (Array.isArray(details))
+    return details.map((issue2) => retypeDetails(issue2, spellings));
+  if (!details || typeof details !== "object")
+    return details;
+  const issue = details;
+  const retyped = { ...issue };
+  if (Array.isArray(issue.path) && issue.path.length > 0) {
+    const [head, ...rest] = issue.path.map(String);
+    const spelling = spellings.get(head);
+    if (spelling)
+      retyped.path = [spelling, ...rest];
+  }
+  if (typeof issue.message === "string") {
+    retyped.message = retypeMessage(issue.message, spellings);
+  }
+  if (Array.isArray(issue.errors)) {
+    retyped.errors = retypeDetails(issue.errors, spellings);
+  }
+  return retyped;
+}
+function retypeApiError(error, operation, commandSpec, operationSpec) {
+  if (!(error instanceof SimApiError) || error.status === 0)
+    return error;
+  const spellings = typeableFields(operation, commandSpec, operationSpec);
+  if (spellings.size === 0)
+    return error;
+  return new SimApiError(retypeMessage(error.message, spellings), error.status, error.code, error.details === undefined ? undefined : retypeDetails(error.details, spellings));
+}
+
+// src/runtime/build.ts
+var GROUP_ALIASES = {
+  "audit-logs": "audit-log",
+  credentials: "credential",
+  "custom-tools": "custom-tool",
+  files: "file",
+  knowledge: "kb",
+  logs: "log",
+  "mcp-servers": "mcp-server",
+  secrets: "secret",
+  skills: "skill",
+  tables: "table",
+  workflows: "workflow",
+  workspaces: "workspace"
+};
+function describeOperation(operationSpec, described) {
+  return operationSpec.personalKeyOnly ? `${described} (personal API key required)` : described;
+}
+function argumentSyntax(command) {
+  return command.registeredArguments.map((argument) => {
+    const name = `${argument.name()}${argument.variadic ? "..." : ""}`;
+    return argument.required ? `<${name}>` : `[${name}]`;
+  }).join(" ");
+}
+function commandPath(command) {
+  const names = [];
+  let current = command;
+  while (current) {
+    names.unshift(current.name());
+    current = current.parent;
+  }
+  return names.join(" ");
+}
+function addMissingArgumentExample(command) {
+  const outputError = command.configureOutput().outputError;
+  if (!outputError)
+    throw new Error("Commander output formatter is not configured");
+  command.configureOutput({
+    outputError: (message, write) => {
+      outputError(message, write);
+      if (!message.startsWith("error: missing required argument "))
+        return;
+      const syntax = argumentSyntax(command);
+      const example = syntax ? `${commandPath(command)} ${syntax}` : commandPath(command);
+      write(`Example: ${example}
+`);
+    }
+  });
+  return command;
+}
+function assertNoReservedFlags(command, operation) {
+  for (const option of command.options) {
+    for (const flag of [option.long, option.short]) {
+      if (flag && RESERVED_PROGRAM_FLAGS.has(flag)) {
+        throw new Error(`${operation} declares ${flag}, which the root program already owns; give the flag another name`);
+      }
+    }
+  }
+}
+var RESERVED_FLAG_EXEMPTIONS = new Set(["profiles add"]);
+function assertNoReservedProgramFlags(program2) {
+  const walk = (command, prefix) => {
+    const path = [...prefix, command.name()];
+    const name = path.join(" ");
+    if (!RESERVED_FLAG_EXEMPTIONS.has(name)) {
+      for (const option of command.options) {
+        for (const flag of [option.long, option.short]) {
+          if (flag && RESERVED_PROGRAM_FLAGS.has(flag)) {
+            throw new Error(`"sim ${name}" declares ${flag}, which the root program already owns; give the flag another name`);
+          }
+        }
+      }
+    }
+    for (const child of command.commands)
+      walk(child, path);
+  };
+  for (const child of program2.commands)
+    walk(child, []);
+}
+function refuseHelpAfterUnknownCommand(program2) {
+  const walk = (command) => {
+    const internals = command;
+    const dispatchesOnly = command.commands.length > 0 && !internals._actionHandler && command.registeredArguments.length === 0;
+    if (dispatchesOnly) {
+      const known = new Set(["help"]);
+      for (const child of command.commands) {
+        known.add(child.name());
+        for (const alias of child.aliases())
+          known.add(alias);
+      }
+      command.on("beforeHelp", () => {
+        const first = command.args[0];
+        if (first === undefined || first.startsWith("-") || known.has(first))
+          return;
+        internals.unknownCommand();
+      });
+    }
+    for (const child of command.commands)
+      walk(child);
+  };
+  walk(program2);
+}
+function configureOperation(command, operation, spec) {
+  const operationSpec = V2_OPERATIONS[operation];
+  command.allowExcessArguments(false);
+  for (const alias of spec.aliases ?? [])
+    command.alias(alias);
+  for (const param of Object.keys(spec.pathFlags ?? {})) {
+    if (!operationSpec.pathParams.includes(param)) {
+      throw new Error(`${operation}.${param} is not a path parameter`);
+    }
+  }
+  for (const param of Object.keys(spec.pathArgumentNames ?? {})) {
+    if (!operationSpec.pathParams.includes(param)) {
+      throw new Error(`${operation}.${param} is not a path parameter`);
+    }
+    if (spec.pathFlags?.[param]) {
+      throw new Error(`${operation}.${param} cannot be both a path argument and a path flag`);
+    }
+  }
+  if (spec.profileWorkspacePath) {
+    if (!operationSpec.pathParams.includes(PROFILE_INJECTED_FIELD)) {
+      throw new Error(`${operation}.profileWorkspacePath requires a workspaceId path parameter`);
+    }
+    if (spec.pathFlags?.[PROFILE_INJECTED_FIELD]) {
+      throw new Error(`${operation}.workspaceId cannot be both profile-injected and a path flag`);
+    }
+  }
+  for (const param of operationSpec.pathParams) {
+    if (spec.pathFlags?.[param] || isProfileWorkspacePath(spec, param))
+      continue;
+    command.argument(`<${spec.pathArgumentNames?.[param] ?? param}>`, operationSpec.pathParamDocs?.[param]);
+  }
+  if (spec.allWorkspaces) {
+    const workspace = operationSpec.query?.workspaceId ?? operationSpec.body?.workspaceId;
+    if (!workspace || workspace.required) {
+      throw new Error(`${operation}.allWorkspaces requires an optional workspaceId field`);
+    }
+  }
+  for (const field of spec.positionals ?? []) {
+    const descriptor = operationSpec.query?.[field] ?? operationSpec.body?.[field];
+    if (!descriptor)
+      throw new Error(`${operation}.${field} is not a request field`);
+    if (spec.requestFields && !spec.requestFields.includes(field)) {
+      throw new Error(`${operation}.${field} is positional but not exposed`);
+    }
+    command.argument(`<${flagNameFor(operation, field)}>`, flagSpecFor(operation, field).describe ?? descriptor.describe);
+  }
+  if (spec.requestFields) {
+    for (const field of spec.requestFields) {
+      if (!operationSpec.query?.[field] && !operationSpec.body?.[field] && !operationSpec.headers?.[field]) {
+        throw new Error(`${operation}.${field} is not a request field`);
+      }
+    }
+    for (const slot of ["query", "body", "headers"]) {
+      for (const [field, descriptor] of Object.entries(operationSpec[slot] ?? {})) {
+        if (descriptor.required && field !== PROFILE_INJECTED_FIELD && !spec.requestFields.includes(field)) {
+          throw new Error(`${operation}.${field} is required but not exposed`);
+        }
+      }
+    }
+  }
+  command.description(describeOperation(operationSpec, spec.describe ?? operationSpec.summary ?? `${operationSpec.method} ${operationSpec.path}`));
+  addOperationOptions(command, operation, spec, operationSpec);
+  assertNoReservedFlags(command, operation);
+  command.action((...invocation) => executeOperation(operation, spec, operationSpec, invocation).catch((error) => {
+    throw retypeApiError(error, operation, spec, operationSpec);
+  }));
+  return command;
+}
+function buildLeaf(operation, spec, leafName) {
+  return addMissingArgumentExample(configureOperation(new Command(leafName), operation, spec));
+}
+function addRenamedCommand(groups, operation, spec, from, to) {
+  const segments = from.split(" ");
+  const [groupName, ...rest] = segments;
+  if (rest.length === 0)
+    throw new Error(`${operation}.renamedFrom "${from}" must include a verb`);
+  let parent = groupFor(groups, groupName);
+  for (const segment of rest.slice(0, -1)) {
+    parent = nestedGroup(parent, segment, { hidden: true });
+  }
+  const leaf = buildLeaf(operation, spec, rest[rest.length - 1]);
+  leaf.hook("preAction", () => warnRenamedCommand(from, to));
+  addSubcommand(parent, leaf, { hidden: true });
+}
+function addSubcommand(parent, child, options = {}) {
+  const wasLeaf = parent.commands.length === 0 && parent.registeredArguments.length > 0;
+  const usage = wasLeaf ? parent.usage() : null;
+  parent.addCommand(child, { hidden: options.hidden });
+  if (usage !== null)
+    parent.usage(usage);
+}
+function groupFor(groups, name) {
+  const existing = groups.get(name);
+  if (existing)
+    return existing;
+  const group = new Command(name).description(`Manage ${name.replaceAll("-", " ")}`);
+  const alias = GROUP_ALIASES[name];
+  if (alias)
+    group.alias(alias);
+  groups.set(name, group);
+  return group;
+}
+function resourceLabel(name) {
+  const label = name.endsWith("s") ? name.slice(0, -1) : name;
+  return label.replaceAll("-", " ");
+}
+function nestedGroup(parent, name, options = {}) {
+  const existing = parent.commands.find((candidate) => candidate.name() === name);
+  if (existing)
+    return existing;
+  const created = new Command(name).description(`Manage ${resourceLabel(parent.name())} ${name.replaceAll("-", " ")}`);
+  addSubcommand(parent, created, { hidden: options.hidden });
+  return created;
+}
+function addLeafCommand(groups, operation, spec, segments) {
+  const [groupName, ...rest] = segments;
+  if (rest.length === 0)
+    throw new Error(`${operation} leaf command must include a verb`);
+  const group = groupFor(groups, groupName);
+  if (rest.length > 1) {
+    let parent = group;
+    for (const segment of rest.slice(0, -1)) {
+      parent = nestedGroup(parent, segment);
+    }
+    parent.addCommand(buildLeaf(operation, spec, rest[rest.length - 1]));
+    return;
+  }
+  group.addCommand(buildLeaf(operation, spec, rest[0]));
+}
+function variantCommandSpec(spec, variant) {
+  return {
+    ...spec,
+    command: variant.command,
+    groupDefault: false,
+    aliases: [],
+    positionals: variant.positionals,
+    requestFields: variant.requestFields,
+    variants: [],
+    describe: variant.describe ?? spec.describe
+  };
+}
+function buildGeneratedCommands() {
+  const groups = new Map;
+  const renamed = [];
+  for (const operation of Object.keys(V2_OPERATIONS)) {
+    const spec = CLI_CONTRACT[operation] ?? {};
+    const operationSpec = V2_OPERATIONS[operation];
+    if (spec.hidden || operationSpec.responseMode !== "json")
+      continue;
+    const segments = spec.command ? spec.command.split(" ") : deriveCommandPath(operation);
+    if (spec.groupDefault) {
+      const [groupName, ...rest] = segments;
+      const group = groupFor(groups, groupName);
+      if (rest.length > 0)
+        throw new Error(`${operation} groupDefault must name a command group`);
+      const pathPositionals = operationSpec.pathParams.filter((param) => !spec.pathFlags?.[param] && !isProfileWorkspacePath(spec, param));
+      if (pathPositionals.length > 0 || spec.positionals?.length) {
+        throw new Error(`${operation} groupDefault cannot require positional arguments`);
+      }
+      configureOperation(group, operation, spec);
+    } else {
+      addLeafCommand(groups, operation, spec, segments);
+    }
+    for (const variant of spec.variants ?? []) {
+      addLeafCommand(groups, operation, variantCommandSpec(spec, variant), variant.command.split(" "));
+    }
+    for (const from of spec.renamedFrom ?? []) {
+      renamed.push({ operation, spec, from, to: segments.join(" ") });
+    }
+  }
+  for (const { operation, spec, from, to } of renamed) {
+    addRenamedCommand(groups, operation, spec, from, to);
+  }
+  return [...groups.values()].sort((a, b) => a.name().localeCompare(b.name()));
+}
+
+// src/commands/credentials.ts
+var CONNECTION_RESULT = {
+  fields: [
+    { header: "connection link", path: "authorizationUrl" },
+    { header: "expires", path: "expiresAt", format: "timestamp" }
+  ]
+};
+var SERVICE_ACCOUNT_RESULT = {
+  fields: [
+    { header: "id" },
+    { header: "name", path: "displayName" },
+    { header: "provider", path: "providerId" },
+    { header: "role" },
+    { header: "created", path: "createdAt", format: "timestamp" }
+  ]
+};
+function serviceAccountProvider(providers, providerId) {
+  const provider = providers.find((candidate) => candidate.type === "service_account" && candidate.providerId === providerId);
+  if (!provider) {
+    throw new SimApiError(`Unknown service-account provider "${providerId}".`, 0);
+  }
+  if (!provider.available) {
+    throw new SimApiError(`Service-account provider "${providerId}" is not available.`, 0);
+  }
+  return provider;
 }
 function credentialValues(provider, raw) {
   const parsed = coerce(raw, { kind: "object" }, { json: true }, "credentials");
@@ -13620,9 +14560,9 @@ function attachCredentialCommands(program2) {
   if (!credentials)
     throw new Error("The generated credentials command group is missing");
   acceptNameOnUpdate(credentials);
-  credentials.command("create").argument("<providerId>", "Service-account provider to create a credential for").description("Create a service-account credential using its discovered provider schema").requiredOption("--name <displayName>", "Name shown for the credential in Sim").requiredOption("--credentials <json|@file>", "Provider credentials as JSON (or @path / @- to read a file or stdin)").option("--description <description>", "Optional credential description").option("--id <credentialId>", "Client-generated credential ID when provider discovery requires it").action((providerId, options, command) => createServiceAccount(command, providerId, options));
-  credentials.command("connect").argument("<providerId>", "OAuth provider to connect").description("Create a short-lived link for connecting an OAuth provider").requiredOption("--name <displayName>", "Name shown for the new credential in Sim").action(async (providerId, options, command) => createConnectionLink(command, { providerId, displayName: options.name }));
-  credentials.command("reconnect").argument("<credentialId>", "Existing OAuth credential to re-authorize").description("Create a short-lived link for reconnecting an OAuth credential").action((credentialId, _options, command) => createConnectionLink(command, { credentialId }));
+  credentials.command("create").argument("<providerId>", "Service-account provider to create a credential for").description(describeOperation(V2_OPERATIONS.createServiceAccountCredential, "Create a service-account credential using its discovered provider schema")).requiredOption("--name <displayName>", "Name shown for the credential in Sim (required)").requiredOption("--credentials <json|@file>", "Provider credentials as JSON (or @path / @- to read a file or stdin) (required)").option("--description <description>", "Optional credential description").option("--id <credentialId>", "Client-generated credential ID when provider discovery requires it").action((providerId, options, command) => createServiceAccount(command, providerId, options));
+  credentials.command("connect").argument("<providerId>", "OAuth provider to connect").description(describeOperation(V2_OPERATIONS.createCredentialConnection, "Create a short-lived link for connecting an OAuth provider")).requiredOption("--name <displayName>", "Name shown for the new credential in Sim (required)").action(async (providerId, options, command) => createConnectionLink(command, { providerId, displayName: options.name }));
+  credentials.command("reconnect").argument("<credentialId>", "Existing OAuth credential to re-authorize").description(describeOperation(V2_OPERATIONS.createCredentialConnection, "Create a short-lived link for reconnecting an OAuth credential")).action((credentialId, _options, command) => createConnectionLink(command, { credentialId }));
 }
 
 // src/commands/protocol/result.ts
@@ -13775,7 +14715,7 @@ Examples:
 
 // src/commands/protocol/files-get.ts
 import { once as once2 } from "node:events";
-import { createWriteStream } from "node:fs";
+import { createWriteStream, rmSync } from "node:fs";
 import { link, lstat, mkdtemp, readlink, rename, rm } from "node:fs/promises";
 import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
 import { Readable } from "node:stream";
@@ -13831,37 +14771,66 @@ async function streamToFile(body, file, reportedPath = file.path) {
     throw writeFailure(reportedPath, error);
   }
 }
+var STAGE_SIGNALS = ["SIGINT", "SIGTERM"];
+function reRaise(signal) {
+  process.kill(process.pid, signal);
+}
+function removeStagingOnSignal(stagingDirectory, terminate = reRaise) {
+  const installed = STAGE_SIGNALS.map((signal) => {
+    const onSignal = () => {
+      process.off(signal, onSignal);
+      const directory = stagingDirectory();
+      if (directory) {
+        try {
+          rmSync(directory, { recursive: true, force: true });
+        } catch {}
+      }
+      terminate(signal);
+    };
+    process.on(signal, onSignal);
+    return [signal, onSignal];
+  });
+  return () => {
+    for (const [signal, onSignal] of installed)
+      process.off(signal, onSignal);
+  };
+}
 async function saveStagedFile(body, target, force) {
   let temporaryDirectory = null;
   let failure = null;
+  const disposeSignalCleanup = removeStagingOnSignal(() => temporaryDirectory);
   try {
-    const publicationTarget = force ? await forcedPublicationTarget(target) : target;
-    temporaryDirectory = await mkdtemp(join2(dirname2(publicationTarget), ".sim-download-"));
-    const temporaryPath = join2(temporaryDirectory, "payload");
-    await streamToFile(body, createWriteStream(temporaryPath, { flags: "wx" }), target);
-    if (force) {
-      await rename(temporaryPath, publicationTarget);
-    } else {
-      try {
-        await link(temporaryPath, publicationTarget);
-      } catch (error) {
-        throw unsupportedAtomicPublish(target, error) ?? error;
+    try {
+      const publicationTarget = force ? await forcedPublicationTarget(target) : target;
+      temporaryDirectory = await mkdtemp(join2(dirname2(publicationTarget), ".sim-download-"));
+      const temporaryPath = join2(temporaryDirectory, "payload");
+      await streamToFile(body, createWriteStream(temporaryPath, { flags: "wx" }), target);
+      if (force) {
+        await rename(temporaryPath, publicationTarget);
+      } else {
+        try {
+          await link(temporaryPath, publicationTarget);
+        } catch (error) {
+          throw unsupportedAtomicPublish(target, error) ?? error;
+        }
       }
+    } catch (error) {
+      failure = normalizedWriteFailure(target, error);
     }
-  } catch (error) {
-    failure = normalizedWriteFailure(target, error);
-  }
-  if (temporaryDirectory) {
-    try {
-      await rm(temporaryDirectory, { recursive: true, force: true });
-    } catch (cleanupError) {
-      if (failure)
-        throw combinedCleanupFailure(failure, temporaryDirectory, cleanupError);
-      throw new SimApiError(`Saved ${target}, but could not remove temporary directory ${temporaryDirectory}: ${cleanupError.message}`, 0);
+    if (temporaryDirectory) {
+      try {
+        await rm(temporaryDirectory, { recursive: true, force: true });
+      } catch (cleanupError) {
+        if (failure)
+          throw combinedCleanupFailure(failure, temporaryDirectory, cleanupError);
+        throw new SimApiError(`Saved ${target}, but could not remove temporary directory ${temporaryDirectory}: ${cleanupError.message}`, 0);
+      }
     }
+    if (failure)
+      throw failure;
+  } finally {
+    disposeSignalCleanup();
   }
-  if (failure)
-    throw failure;
 }
 async function saveToFile(body, target, force) {
   return saveStagedFile(body, target, force);
@@ -14172,6 +15141,7 @@ function renderCell2(value, format) {
 }
 var COLUMNS = (CLI_CONTRACT.listLogs?.columns ?? []).map((spec) => ({
   header: spec.header,
+  floor: Math.min(MAX_CELL_WIDTH2, spec.minWidth ?? 0),
   value: (row) => renderCell2(at2(row, spec.path ?? spec.header), spec.format)
 }));
 function oneLine2(value) {
@@ -14188,15 +15158,15 @@ function clamp2(value, width) {
 function createTableWriter() {
   let widths = null;
   return (rows) => {
-    const lines = rows.map((row) => COLUMNS.map((column) => oneLine2(column.value(row))));
+    const lines = rows.map((row) => COLUMNS.map((column) => clamp2(oneLine2(column.value(row)), MAX_CELL_WIDTH2)));
     if (!widths) {
-      widths = COLUMNS.map((column, index) => Math.min(MAX_CELL_WIDTH2, Math.max(visibleWidth(column.header), ...lines.map((line) => visibleWidth(line[index])))));
+      widths = COLUMNS.map((column, index) => Math.min(MAX_CELL_WIDTH2, Math.max(column.floor, visibleWidth(column.header), ...lines.map((line) => visibleWidth(line[index])))));
       const header = widths;
       console.log(source_default.dim(COLUMNS.map((column, index) => pad2(column.header.toUpperCase(), header[index])).join("  ").trimEnd()));
     }
     const locked = widths;
     for (const line of lines) {
-      console.log(line.map((cell, index) => pad2(clamp2(cell, locked[index]), locked[index])).join("  ").trimEnd());
+      console.log(line.map((cell, index) => pad2(cell, locked[index])).join("  ").trimEnd());
     }
   };
 }
@@ -14341,173 +15311,72 @@ function attachLogsFollow(logs) {
 Each run prints once, when it is first seen, so its status is the status it had
 at that moment. With --output json every run is a JSON object on its own line
 (JSONL) rather than a member of an array, because a follow never ends and so can
-never close one; --output yaml emits a --- separated document stream. Progress
-and retries go to stderr, leaving stdout a clean stream of rows. Ctrl-C stops the
-follow.
-
-Examples:
-  $ sim logs follow --level error
-  $ sim logs follow --workflow wf_123 -n 0
-  $ sim --output json logs follow | jq -r '.runId'
-`).action(async (options, command) => {
-    const lines = nonNegativeInteger(options.lines, "--lines");
-    const delay = intervalMs(options.interval);
-    const { client, profile } = clientFrom(command);
-    const path = V2_OPERATIONS.listLogs.path;
-    const query = {
-      workspaceId: client.requireWorkspace(),
-      workflowIds: options.workflow?.length ? options.workflow.join(",") : undefined,
-      folderPaths: options.folder?.length ? options.folder.map(encodeFolderPath).join(",") : undefined,
-      triggers: options.trigger?.length ? options.trigger.join(",") : undefined,
-      level: options.level,
-      details: options.details,
-      sortBy: "startedAt",
-      sortOrder: "desc"
-    };
-    const write = createWriter(profile.output);
-    const status = followStatus();
-    const interrupt = watchForInterrupt();
-    const state = { seen: new Map, floor: null };
-    try {
-      const seed = await collectUnprinted(client, path, query, state, Math.max(lines, 1), 1);
-      remember(state, seed.rows);
-      state.floor = seed.rows.at(-1)?.startedAt ?? null;
-      if (seed.truncated && seed.rows.length < lines) {
-        status.warn(`asked for ${lines} earlier runs but a page holds ${seed.rows.length}; following from there — see sim logs list for more`);
-      }
-      write(lines > 0 ? seed.rows.slice(0, lines).reverse() : []);
-      let failures = 0;
-      while (!interrupt.interrupted()) {
-        await waitFor(failures === 0 ? delay : Math.min(delay * 2 ** failures, MAX_BACKOFF_MS), interrupt.interrupted);
-        if (interrupt.interrupted())
-          break;
-        let fresh;
-        try {
-          fresh = await collectUnprinted(client, path, query, state, POLL_PAGE_SIZE, MAX_PAGES_PER_POLL);
-        } catch (error) {
-          if (!isTransient(error))
-            throw error;
-          failures += 1;
-          const next = Math.min(delay * 2 ** failures, MAX_BACKOFF_MS);
-          status.note(`poll failed (${error.message}); retrying in ${inSeconds(next)}s…`);
-          continue;
-        }
-        failures = 0;
-        status.clear();
-        if (fresh.truncated) {
-          status.warn(`more than ${MAX_PAGES_PER_POLL * POLL_PAGE_SIZE} runs arrived at once; older ones were skipped — see sim logs list`);
-        }
-        if (fresh.rows.length === 0)
-          continue;
-        remember(state, fresh.rows);
-        write(fresh.rows.reverse());
-      }
-    } finally {
-      status.clear();
-      interrupt.dispose();
-    }
-  });
-}
-
-// src/runtime/options.ts
-var DEFAULT_LIMIT = 100;
-function describeField(flag, descriptor, name, field) {
-  return flag.describe ?? descriptor.describe ?? `Set ${name.replaceAll("-", " ") || field}`;
-}
-function literalNullHint(documented, name) {
-  return /\bnull\b/i.test(documented) ? ` (--${name} null sends the word, not JSON null)` : "";
-}
-var WIRE_VOCABULARY_SENTENCE = /\s*The listed spellings[^.]*\.\s*/g;
-function withoutWireVocabulary(documented) {
-  return documented.replace(WIRE_VOCABULARY_SENTENCE, " ").trim();
-}
-function addFieldOption(command, operation, field, descriptor, slot) {
-  if (field === PROFILE_INJECTED_FIELD || field === "cursor")
-    return;
-  const flag = flagSpecFor(operation, field);
-  if (flag.omit)
-    return;
-  const name = flagNameFor(operation, field);
-  const short = flag.short ? `-${flag.short}, ` : "";
-  if (field === "limit" && (descriptor.kind === "number" || descriptor.kind === "integer")) {
-    command.option("--limit <n>", "Maximum items to return (0 for everything)", String(DEFAULT_LIMIT));
-    return;
-  }
-  const documented = describeField(flag, descriptor, name, field);
-  if (descriptor.kind === "boolean" || flag.boolean) {
-    const booleanDoc = withoutWireVocabulary(documented);
-    if (descriptor.required) {
-      command.addOption(new Option(`${short}--${name} <true|false>`, `${booleanDoc} (required)`).choices(["true", "false"]).makeOptionMandatory());
-      return;
-    }
-    command.option(`${short}--${name}`, booleanDoc);
-    if (!flag.boolean || flag.negatable) {
-      command.option(`--no-${name}`, `Send --${name} as false`);
-    }
-    return;
-  }
-  const takesList = flag.list === true;
-  const wantsJson = takesJson(descriptor, flag);
-  const placeholder = takesList ? "<value...>" : flag.rowCap ? "<n>" : wantsJson ? "<json|@file>" : "<value>";
-  const choices = flag.choices ?? descriptor.values;
-  const literalNull = slot === "body" && !takesList && !wantsJson;
-  const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}${literalNull ? literalNullHint(documented, name) : ""}`;
-  const renamedFrom = flag.renamedFrom ?? [];
-  const option = new Option(`${short}--${name} ${placeholder}`, describe);
-  if (flag.hidden)
-    option.hideHelp();
-  if (choices && !takesList)
-    option.choices([...choices]);
-  if (descriptor.default !== undefined && field !== "limit") {
-    option.default(undefined, String(descriptor.default));
-  }
-  if (descriptor.required && renamedFrom.length === 0)
-    option.makeOptionMandatory();
-  command.addOption(option);
-  for (const previous of renamedFrom) {
-    const retired = new Option(`--${previous} ${placeholder}`).hideHelp();
-    if (choices && !takesList)
-      retired.choices([...choices]);
-    command.addOption(retired);
-  }
-}
-function addOperationOptions(command, operation, commandSpec, operationSpec) {
-  for (const param of operationSpec.pathParams) {
-    const flag = commandSpec.pathFlags?.[param];
-    if (!flag)
-      continue;
-    const name = pathFlagNameFor(commandSpec, param);
-    const short = flag.short ? `-${flag.short}, ` : "";
-    command.addOption(new Option(`${short}--${name} <${flag.placeholder ?? "value"}>`, `${flag.describe ?? operationSpec.pathParamDocs?.[param] ?? `Set ${name.replaceAll("-", " ")}`} (required)`).makeOptionMandatory());
-  }
-  for (const slot of ["query", "body", "headers"]) {
-    for (const [field, descriptor] of Object.entries(operationSpec[slot] ?? {})) {
-      if (commandSpec.requestFields && !commandSpec.requestFields.includes(field))
-        continue;
-      if (commandSpec.positionals?.includes(field))
-        continue;
-      addFieldOption(command, operation, field, descriptor, slot);
-    }
-  }
-  if (commandSpec.allWorkspaces) {
-    command.option("--all-workspaces", "Do not filter to the configured workspace (personal API key required for account-wide access)");
-  }
-  if (commandSpec.expandedTrace) {
-    command.option("--trace", "Show expanded trace spans with inputs, outputs, errors, timing, and cost");
-  }
-  if (operationSpec.opaqueBody) {
-    if (commandSpec.bodyVariants) {
-      for (const variant of commandSpec.bodyVariants) {
-        command.option(`--${variant.name} <json|@file>`, `${variant.describe} (JSON, or @path / @-; choose exactly one body flag)`);
+never close one; --output yaml emits a --- separated document stream. Progress
+and retries go to stderr, leaving stdout a clean stream of rows. Ctrl-C stops the
+follow.
+
+Examples:
+  $ sim logs follow --level error
+  $ sim logs follow --workflow wf_123 -n 0
+  $ sim --output json logs follow | jq -r '.runId'
+`).action(async (options, command) => {
+    const lines = nonNegativeInteger(options.lines, "--lines");
+    const delay = intervalMs(options.interval);
+    const { client, profile } = clientFrom(command);
+    const path = V2_OPERATIONS.listLogs.path;
+    const query = {
+      workspaceId: client.requireWorkspace(),
+      workflowIds: options.workflow?.length ? options.workflow.join(",") : undefined,
+      folderPaths: options.folder?.length ? options.folder.map(encodeFolderPath).join(",") : undefined,
+      triggers: options.trigger?.length ? options.trigger.join(",") : undefined,
+      level: options.level,
+      details: options.details,
+      sortBy: "startedAt",
+      sortOrder: "desc"
+    };
+    const write = createWriter(profile.output);
+    const status = followStatus();
+    const interrupt = watchForInterrupt();
+    const state = { seen: new Map, floor: null };
+    try {
+      const seed = await collectUnprinted(client, path, query, state, Math.max(lines, 1), 1);
+      remember(state, seed.rows);
+      state.floor = seed.rows.at(-1)?.startedAt ?? null;
+      if (seed.truncated && seed.rows.length < lines) {
+        status.warn(`asked for ${lines} earlier runs but a page holds ${seed.rows.length}; following from there — see sim logs list for more`);
       }
-    } else {
-      command.requiredOption("--body <json|@file>", "Request body as JSON (or @path / @- to read a file or stdin) (required)");
+      write(lines > 0 ? seed.rows.slice(0, lines).reverse() : []);
+      let failures = 0;
+      while (!interrupt.interrupted()) {
+        await waitFor(failures === 0 ? delay : Math.min(delay * 2 ** failures, MAX_BACKOFF_MS), interrupt.interrupted);
+        if (interrupt.interrupted())
+          break;
+        let fresh;
+        try {
+          fresh = await collectUnprinted(client, path, query, state, POLL_PAGE_SIZE, MAX_PAGES_PER_POLL);
+        } catch (error) {
+          if (!isTransient(error))
+            throw error;
+          failures += 1;
+          const next = Math.min(delay * 2 ** failures, MAX_BACKOFF_MS);
+          status.note(`poll failed (${error.message}); retrying in ${inSeconds(next)}s…`);
+          continue;
+        }
+        failures = 0;
+        status.clear();
+        if (fresh.truncated) {
+          status.warn(`more than ${MAX_PAGES_PER_POLL * POLL_PAGE_SIZE} runs arrived at once; older ones were skipped — see sim logs list`);
+        }
+        if (fresh.rows.length === 0)
+          continue;
+        remember(state, fresh.rows);
+        write(fresh.rows.reverse());
+      }
+    } finally {
+      status.clear();
+      interrupt.dispose();
     }
-  }
-  if (commandSpec.confirm) {
-    const exemptedByDryRun = operationSpec.query?.dryRun !== undefined || operationSpec.body?.dryRun !== undefined;
-    command.option("-y, --yes", exemptedByDryRun ? "Confirm this destructive operation (required unless --dry-run)" : "Confirm this destructive operation (required)");
-  }
+  });
 }
 
 // src/commands/protocol/resource-directory.ts
@@ -14663,13 +15532,16 @@ function validateTargetOptions(options) {
   return intoExisting;
 }
 function attachTableImport(tables) {
-  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").allowExcessArguments(false).description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table, as shown in the app").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
+  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").allowExcessArguments(false).description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table, as shown in the app").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("-y, --yes", "Confirm this destructive operation (required with --mode replace)").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     if (Boolean(path) === Boolean(options.fileId)) {
       throw new SimApiError("Pass exactly one of <path> or --file-id <id>", 0);
     }
     const intoExisting = validateTargetOptions(options);
+    if (intoExisting && options.mode === "replace" && options.yes !== true) {
+      throw new SimApiError("This deletes every row in the table before loading the CSV and cannot be undone. Re-run with --yes to confirm.", 0);
+    }
     const local = path ? await localFile(path) : null;
     const source = local ? {
       type: "upload",
@@ -14724,202 +15596,18 @@ function attachTableImport(tables) {
       });
       return;
     }
-    const finished = await watchImport(client, workspaceId, job);
-    if (finished.status !== "completed") {
-      throw new SimApiError(`Import ${finished.status}${finished.error ? `: ${finished.error}` : ""}`, 0);
-    }
-    printProtocolResult(profile.output, {
-      id: finished.id,
-      status: finished.status,
-      tableId: finished.tableId,
-      rowsProcessed: finished.rowsProcessed,
-      ...rejectionFields(finished)
-    });
-  });
-}
-
-// src/runtime/renamed.ts
-var warned = new Set;
-function warn(kind, from, to) {
-  const key = `${kind}:${from}`;
-  if (warned.has(key))
-    return;
-  warned.add(key);
-  process.stderr.write(`warning: ${kind} "${from}" has been renamed to "${to}". The old name still works.
-`);
-}
-function warnRenamedCommand(from, to) {
-  warn("command", `sim ${from}`, `sim ${to}`);
-}
-function warnRenamedFlag(from, to) {
-  warn("flag", `--${from}`, `--${to}`);
-}
-
-// src/runtime/execute.ts
-var RUN_OUTCOME_OPERATIONS = new Set(["executeWorkflow"]);
-var FAILED_RUN_STATUS_MESSAGES = {
-  failed: "The workflow run failed.",
-  cancelled: "The workflow run was cancelled."
-};
-function runFailureMessage(operation, payload) {
-  if (!RUN_OUTCOME_OPERATIONS.has(operation))
-    return null;
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const { status, error } = payload;
-  if (typeof status !== "string")
-    return null;
-  const fallback = FAILED_RUN_STATUS_MESSAGES[status];
-  if (!fallback)
-    return null;
-  const reported2 = error?.message;
-  return safeOneLine(typeof reported2 === "string" && reported2 ? reported2 : fallback);
-}
-var BULK_OUTCOME_CHECKS = {
-  bulkDeleteFiles: (payload, body) => {
-    if (countOf(payload.deletedItems?.files) > 0)
-      return null;
-    const requested = lengthOf(body?.fileIds);
-    if (requested === 0)
-      return null;
-    return `Deleted nothing: none of the ${requested} requested ${requested === 1 ? "file was" : "files were"} deleted.`;
-  },
-  bulkDeleteTables: (payload) => {
-    const items = payload.deletedItems;
-    const deleted = countOf(items?.tables) + countOf(items?.folders);
-    if (deleted > 0)
-      return null;
-    const missed = lengthOf(payload.notFound) + lengthOf(payload.failed);
-    if (missed === 0)
-      return null;
-    return `Deleted nothing: ${missed} of ${missed} ${missed === 1 ? "item was" : "items were"} not found or could not be deleted.`;
-  },
-  moveTables: (payload) => {
-    if (lengthOf(payload.moved) > 0)
-      return null;
-    const missed = lengthOf(payload.notFound) + lengthOf(payload.failed);
-    if (missed === 0)
-      return null;
-    return `Moved nothing: ${missed} of ${missed} ${missed === 1 ? "item was" : "items were"} not found or could not be moved.`;
-  },
-  moveWorkflows: (payload) => {
-    if (lengthOf(payload.moved) > 0)
-      return null;
-    const failed = lengthOf(payload.failed);
-    if (failed === 0)
-      return null;
-    return `Moved nothing: ${failed} of ${failed} ${failed === 1 ? "workflow" : "workflows"} could not be moved.`;
-  }
-};
-function countOf(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : 0;
-}
-function lengthOf(value) {
-  return Array.isArray(value) ? value.length : 0;
-}
-function bulkFailureMessage(operation, payload, body) {
-  const check = BULK_OUTCOME_CHECKS[operation];
-  if (!check)
-    return null;
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  return check(payload, body);
-}
-function cursorSlot(operationSpec) {
-  if (operationSpec.query && "cursor" in operationSpec.query)
-    return "query";
-  if (operationSpec.body && "cursor" in operationSpec.body)
-    return "body";
-  return null;
-}
-function foldRenamedFlags(operation, commandSpec, flags) {
-  for (const [field, flag] of Object.entries(commandSpec.flags ?? {})) {
-    if (!flag.renamedFrom?.length)
-      continue;
-    const current = flagNameFor(operation, field);
-    for (const previous of flag.renamedFrom) {
-      const supplied = flags[camel(previous)];
-      if (supplied === undefined)
-        continue;
-      if (flags[camel(current)] !== undefined) {
-        throw new SimApiError(`--${previous} is the former name of --${current}; pass one, not both`, 0);
-      }
-      warnRenamedFlag(previous, current);
-      flags[camel(current)] = supplied;
-    }
-  }
-}
-async function executeOperation(operation, commandSpec, operationSpec, invocation) {
-  const host = invocation[invocation.length - 1];
-  const inheritedFlags = host.optsWithGlobals();
-  const flags = {
-    ...inheritedFlags.workspace === undefined ? {} : { workspace: inheritedFlags.workspace },
-    ...inheritedFlags.allWorkspaces === undefined ? {} : { allWorkspaces: inheritedFlags.allWorkspaces },
-    ...invocation[invocation.length - 2]
-  };
-  const pathPositionalCount = operationSpec.pathParams.filter((param) => !commandSpec.pathFlags?.[param] && !isProfileWorkspacePath(commandSpec, param)).length;
-  const positional = invocation.slice(0, pathPositionalCount);
-  const requestFlags = { ...flags };
-  for (const [index, field] of (commandSpec.positionals ?? []).entries()) {
-    requestFlags[camel(flagNameFor(operation, field))] = invocation[pathPositionalCount + index];
-  }
-  foldRenamedFlags(operation, commandSpec, requestFlags);
-  if (commandSpec.confirm && !requestFlags.yes && requestFlags.dryRun !== true) {
-    throw new SimApiError(`${commandSpec.confirm} Re-run with --yes to confirm.`, 0);
-  }
-  if (commandSpec.allWorkspaces && requestFlags.allWorkspaces && requestFlags.workspace) {
-    throw new SimApiError("--all-workspaces cannot be combined with --workspace", 0);
-  }
-  const { client, profile } = clientFrom(host);
-  const hasWorkspaceField = Boolean(operationSpec.query && PROFILE_INJECTED_FIELD in operationSpec.query || operationSpec.body && PROFILE_INJECTED_FIELD in operationSpec.body);
-  const omitsWorkspace = commandSpec.allWorkspaces && requestFlags.allWorkspaces === true;
-  const request = buildRequest(operation, positional, requestFlags, hasWorkspaceField && !omitsWorkspace ? client.requireWorkspace() : profile.workspaceId);
-  const paging = cursorSlot(operationSpec);
-  if (paging) {
-    const rawLimit = Number.parseInt(String(requestFlags.limit ?? DEFAULT_LIMIT), 10);
-    if (Number.isNaN(rawLimit) || rawLimit < 0) {
-      throw new SimApiError("--limit must be a non-negative number", 0);
-    }
-    const limit = rawLimit === 0 ? Number.POSITIVE_INFINITY : rawLimit;
-    const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
-    const pageLimit = "limit" in (operationSpec[paging] ?? {}) ? { limit: pageSize } : {};
-    const rows = [];
-    const progress = pageProgress();
-    let cursor = null;
-    let envelope;
-    try {
-      do {
-        const page = await client.request(request.path, {
-          method: operationSpec.method,
-          headers: request.headers,
-          query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
-          body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
-        });
-        envelope ??= page;
-        rows.push(...page.data);
-        cursor = page.nextCursor;
-        if (cursor && rows.length < limit)
-          progress.advance(rows.length);
-      } while (cursor && rows.length < limit);
-    } finally {
-      progress.finish();
-    }
-    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec, envelope);
-    return;
-  }
-  const result = await client.request(request.path, {
-    method: operationSpec.method,
-    headers: request.headers,
-    query: request.query,
-    body: request.body
-  });
-  const payload = result?.data ?? result;
-  renderResult(operation, profile.output, payload, commandSpec, {
-    expandedTrace: requestFlags.trace === true
+    const finished = await watchImport(client, workspaceId, job);
+    if (finished.status !== "completed") {
+      throw new SimApiError(`Import ${finished.status}${finished.error ? `: ${finished.error}` : ""}`, 0);
+    }
+    printProtocolResult(profile.output, {
+      id: finished.id,
+      status: finished.status,
+      tableId: finished.tableId,
+      rowsProcessed: finished.rowsProcessed,
+      ...rejectionFields(finished)
+    });
   });
-  const failure = runFailureMessage(operation, payload) ?? bulkFailureMessage(operation, payload, request.body);
-  if (failure)
-    throw new SimApiError(failure, 0);
 }
 
 // src/commands/protocol/workflow-run-follow.ts
@@ -15141,6 +15829,9 @@ function followOrDelegate(previous) {
       command.setOptionValue("run", selection);
     const flags = command.optsWithGlobals();
     if (flags.follow !== true) {
+      if (Array.isArray(flags.selectOutput) && flags.selectOutput.length > 0) {
+        throw new SimApiError(flags.async === true ? "--select-output shapes a streamed result, and --async returns as soon as the run is queued, so there is no stream to shape. Drop one of them, or read the finished run with: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockId>[.path] — that resource matches block ids, not the block names --select-output takes here." : "--select-output shapes a streamed result; add --follow. To narrow a run that has already finished: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockId>[.path] — that resource matches block ids, not the block names --select-output takes here.", 0);
+      }
       if (flags.includeThinking === true || flags.includeToolCalls === true) {
         throw new SimApiError("--include-thinking and --include-tool-calls describe a stream; add --follow", 0);
       }
@@ -15455,6 +16146,8 @@ function validateWorkspaceOnlyFlag(flag, value, scope) {
 async function readSecretValue(options) {
   if (options.value !== undefined)
     return validateSecretValue(readValueArgument(options.value));
+  if (options.description !== undefined || options.unredacted !== undefined)
+    return;
   try {
     return validateSecretValue(await promptSecret());
   } catch (error) {
@@ -15464,7 +16157,10 @@ async function readSecretValue(options) {
     return process.exit(CANCELLED_EXIT_CODE);
   }
 }
-async function setSecret(name, options, command) {
+async function setSecret(name, options, command, redactionSpellings) {
+  if (redactionSpellings.size > 1) {
+    throw new SimApiError("Pass either --unredacted or --no-unredacted, not both: they are one setting, and commander keeps only whichever came last.", 0);
+  }
   const description = validateWorkspaceOnlyFlag("description", options.description, options.scope);
   const unredacted = validateWorkspaceOnlyFlag("unredacted", options.unredacted, options.scope);
   const value = await readSecretValue(options);
@@ -15475,7 +16171,7 @@ async function setSecret(name, options, command) {
     body: {
       workspaceId: client.requireWorkspace(),
       scope: options.scope,
-      value,
+      ...value === undefined ? {} : { value },
       description,
       ...unredacted === undefined ? {} : { unredacted }
     }
@@ -15486,257 +16182,8 @@ function attachSecretCommands(program2) {
   const secrets = program2.commands.find((command) => command.name() === "secrets");
   if (!secrets)
     throw new Error("The generated secrets command group is missing");
-  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value|@file>", "Secret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").option("--unredacted", `${V2_OPERATIONS.setSecret.body.unredacted.describe} Pass --no-unredacted to restore redaction`).option("--no-unredacted", "Send --unredacted as false").action((name, options, command) => setSecret(name, options, command));
-}
-
-// src/runtime/build.ts
-var GROUP_ALIASES = {
-  "audit-logs": "audit-log",
-  credentials: "credential",
-  "custom-tools": "custom-tool",
-  files: "file",
-  knowledge: "kb",
-  logs: "log",
-  "mcp-servers": "mcp-server",
-  secrets: "secret",
-  skills: "skill",
-  tables: "table",
-  workflows: "workflow",
-  workspaces: "workspace"
-};
-function argumentSyntax(command) {
-  return command.registeredArguments.map((argument) => {
-    const name = `${argument.name()}${argument.variadic ? "..." : ""}`;
-    return argument.required ? `<${name}>` : `[${name}]`;
-  }).join(" ");
-}
-function commandPath(command) {
-  const names = [];
-  let current = command;
-  while (current) {
-    names.unshift(current.name());
-    current = current.parent;
-  }
-  return names.join(" ");
-}
-function addMissingArgumentExample(command) {
-  const outputError = command.configureOutput().outputError;
-  if (!outputError)
-    throw new Error("Commander output formatter is not configured");
-  command.configureOutput({
-    outputError: (message, write) => {
-      outputError(message, write);
-      if (!message.startsWith("error: missing required argument "))
-        return;
-      const syntax = argumentSyntax(command);
-      const example = syntax ? `${commandPath(command)} ${syntax}` : commandPath(command);
-      write(`Example: ${example}
-`);
-    }
-  });
-  return command;
-}
-function assertNoReservedFlags(command, operation) {
-  for (const option of command.options) {
-    for (const flag of [option.long, option.short]) {
-      if (flag && RESERVED_PROGRAM_FLAGS.has(flag)) {
-        throw new Error(`${operation} declares ${flag}, which the root program already owns; give the flag another name`);
-      }
-    }
-  }
-}
-var RESERVED_FLAG_EXEMPTIONS = new Set(["profiles add"]);
-function assertNoReservedProgramFlags(program2) {
-  const walk = (command, prefix) => {
-    const path = [...prefix, command.name()];
-    const name = path.join(" ");
-    if (!RESERVED_FLAG_EXEMPTIONS.has(name)) {
-      for (const option of command.options) {
-        for (const flag of [option.long, option.short]) {
-          if (flag && RESERVED_PROGRAM_FLAGS.has(flag)) {
-            throw new Error(`"sim ${name}" declares ${flag}, which the root program already owns; give the flag another name`);
-          }
-        }
-      }
-    }
-    for (const child of command.commands)
-      walk(child, path);
-  };
-  for (const child of program2.commands)
-    walk(child, []);
-}
-function configureOperation(command, operation, spec) {
-  const operationSpec = V2_OPERATIONS[operation];
-  command.allowExcessArguments(false);
-  for (const alias of spec.aliases ?? [])
-    command.alias(alias);
-  for (const param of Object.keys(spec.pathFlags ?? {})) {
-    if (!operationSpec.pathParams.includes(param)) {
-      throw new Error(`${operation}.${param} is not a path parameter`);
-    }
-  }
-  for (const param of Object.keys(spec.pathArgumentNames ?? {})) {
-    if (!operationSpec.pathParams.includes(param)) {
-      throw new Error(`${operation}.${param} is not a path parameter`);
-    }
-    if (spec.pathFlags?.[param]) {
-      throw new Error(`${operation}.${param} cannot be both a path argument and a path flag`);
-    }
-  }
-  if (spec.profileWorkspacePath) {
-    if (!operationSpec.pathParams.includes(PROFILE_INJECTED_FIELD)) {
-      throw new Error(`${operation}.profileWorkspacePath requires a workspaceId path parameter`);
-    }
-    if (spec.pathFlags?.[PROFILE_INJECTED_FIELD]) {
-      throw new Error(`${operation}.workspaceId cannot be both profile-injected and a path flag`);
-    }
-  }
-  for (const param of operationSpec.pathParams) {
-    if (spec.pathFlags?.[param] || isProfileWorkspacePath(spec, param))
-      continue;
-    command.argument(`<${spec.pathArgumentNames?.[param] ?? param}>`, operationSpec.pathParamDocs?.[param]);
-  }
-  if (spec.allWorkspaces) {
-    const workspace = operationSpec.query?.workspaceId ?? operationSpec.body?.workspaceId;
-    if (!workspace || workspace.required) {
-      throw new Error(`${operation}.allWorkspaces requires an optional workspaceId field`);
-    }
-  }
-  for (const field of spec.positionals ?? []) {
-    const descriptor = operationSpec.query?.[field] ?? operationSpec.body?.[field];
-    if (!descriptor)
-      throw new Error(`${operation}.${field} is not a request field`);
-    if (spec.requestFields && !spec.requestFields.includes(field)) {
-      throw new Error(`${operation}.${field} is positional but not exposed`);
-    }
-    command.argument(`<${flagNameFor(operation, field)}>`, flagSpecFor(operation, field).describe ?? descriptor.describe);
-  }
-  if (spec.requestFields) {
-    for (const field of spec.requestFields) {
-      if (!operationSpec.query?.[field] && !operationSpec.body?.[field] && !operationSpec.headers?.[field]) {
-        throw new Error(`${operation}.${field} is not a request field`);
-      }
-    }
-    for (const slot of ["query", "body", "headers"]) {
-      for (const [field, descriptor] of Object.entries(operationSpec[slot] ?? {})) {
-        if (descriptor.required && field !== PROFILE_INJECTED_FIELD && !spec.requestFields.includes(field)) {
-          throw new Error(`${operation}.${field} is required but not exposed`);
-        }
-      }
-    }
-  }
-  command.description(spec.describe ?? operationSpec.summary ?? `${operationSpec.method} ${operationSpec.path}`);
-  addOperationOptions(command, operation, spec, operationSpec);
-  assertNoReservedFlags(command, operation);
-  command.action((...invocation) => executeOperation(operation, spec, operationSpec, invocation));
-  return command;
-}
-function buildLeaf(operation, spec, leafName) {
-  return addMissingArgumentExample(configureOperation(new Command(leafName), operation, spec));
-}
-function addRenamedCommand(groups, operation, spec, from, to) {
-  const segments = from.split(" ");
-  const [groupName, ...rest] = segments;
-  if (rest.length === 0)
-    throw new Error(`${operation}.renamedFrom "${from}" must include a verb`);
-  let parent = groupFor(groups, groupName);
-  for (const segment of rest.slice(0, -1)) {
-    parent = nestedGroup(parent, segment, { hidden: true });
-  }
-  const leaf = buildLeaf(operation, spec, rest[rest.length - 1]);
-  leaf.hook("preAction", () => warnRenamedCommand(from, to));
-  addSubcommand(parent, leaf, { hidden: true });
-}
-function addSubcommand(parent, child, options = {}) {
-  const wasLeaf = parent.commands.length === 0 && parent.registeredArguments.length > 0;
-  const usage = wasLeaf ? parent.usage() : null;
-  parent.addCommand(child, { hidden: options.hidden });
-  if (usage !== null)
-    parent.usage(usage);
-}
-function groupFor(groups, name) {
-  const existing = groups.get(name);
-  if (existing)
-    return existing;
-  const group2 = new Command(name).description(`Manage ${name.replaceAll("-", " ")}`);
-  const alias = GROUP_ALIASES[name];
-  if (alias)
-    group2.alias(alias);
-  groups.set(name, group2);
-  return group2;
-}
-function resourceLabel(name) {
-  const label = name.endsWith("s") ? name.slice(0, -1) : name;
-  return label.replaceAll("-", " ");
-}
-function nestedGroup(parent, name, options = {}) {
-  const existing = parent.commands.find((candidate) => candidate.name() === name);
-  if (existing)
-    return existing;
-  const created = new Command(name).description(`Manage ${resourceLabel(parent.name())} ${name.replaceAll("-", " ")}`);
-  addSubcommand(parent, created, { hidden: options.hidden });
-  return created;
-}
-function addLeafCommand(groups, operation, spec, segments) {
-  const [groupName, ...rest] = segments;
-  if (rest.length === 0)
-    throw new Error(`${operation} leaf command must include a verb`);
-  const group2 = groupFor(groups, groupName);
-  if (rest.length > 1) {
-    let parent = group2;
-    for (const segment of rest.slice(0, -1)) {
-      parent = nestedGroup(parent, segment);
-    }
-    parent.addCommand(buildLeaf(operation, spec, rest[rest.length - 1]));
-    return;
-  }
-  group2.addCommand(buildLeaf(operation, spec, rest[0]));
-}
-function variantCommandSpec(spec, variant) {
-  return {
-    ...spec,
-    command: variant.command,
-    groupDefault: false,
-    aliases: [],
-    positionals: variant.positionals,
-    requestFields: variant.requestFields,
-    variants: [],
-    describe: variant.describe ?? spec.describe
-  };
-}
-function buildGeneratedCommands() {
-  const groups = new Map;
-  const renamed = [];
-  for (const operation of Object.keys(V2_OPERATIONS)) {
-    const spec = CLI_CONTRACT[operation] ?? {};
-    const operationSpec = V2_OPERATIONS[operation];
-    if (spec.hidden || operationSpec.responseMode !== "json")
-      continue;
-    const segments = spec.command ? spec.command.split(" ") : deriveCommandPath(operation);
-    if (spec.groupDefault) {
-      const [groupName, ...rest] = segments;
-      const group2 = groupFor(groups, groupName);
-      if (rest.length > 0)
-        throw new Error(`${operation} groupDefault must name a command group`);
-      const pathPositionals = operationSpec.pathParams.filter((param) => !spec.pathFlags?.[param] && !isProfileWorkspacePath(spec, param));
-      if (pathPositionals.length > 0 || spec.positionals?.length) {
-        throw new Error(`${operation} groupDefault cannot require positional arguments`);
-      }
-      configureOperation(group2, operation, spec);
-    } else {
-      addLeafCommand(groups, operation, spec, segments);
-    }
-    for (const variant of spec.variants ?? []) {
-      addLeafCommand(groups, operation, variantCommandSpec(spec, variant), variant.command.split(" "));
-    }
-    for (const from of spec.renamedFrom ?? []) {
-      renamed.push({ operation, spec, from, to: segments.join(" ") });
-    }
-  }
-  for (const { operation, spec, from, to } of renamed) {
-    addRenamedCommand(groups, operation, spec, from, to);
-  }
-  return [...groups.values()].sort((a, b) => a.name().localeCompare(b.name()));
+  const redactionSpellings = new Set;
+  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description(describeOperation(V2_OPERATIONS.setSecret, "Create or replace a named secret")).addOption(new Option("--scope <scope>", "Secret ownership scope (required)").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value|@file>", "Secret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").option("--unredacted", `${V2_OPERATIONS.setSecret.body.unredacted.describe} Pass --no-unredacted to restore redaction`).option("--no-unredacted", "Send --unredacted as false").on("option:unredacted", () => redactionSpellings.add("--unredacted")).on("option:no-unredacted", () => redactionSpellings.add("--no-unredacted")).action((name, options, command) => setSecret(name, options, command, redactionSpellings));
 }
 
 // src/program.ts
@@ -15816,6 +16263,7 @@ function buildProgram(options = {}) {
   attachProtocolCommands(program2);
   attachSecretCommands(program2);
   program2.addHelpText("after", HELP_EPILOGUE);
+  refuseHelpAfterUnknownCommand(program2);
   assertNoReservedProgramFlags(program2);
   return program2;
 }