sim 2.1.7-preview.92.1 → 2.1.8-dev.101.1

package/dist/index.js

@@ -2172,6 +2172,12 @@ var applyOptions = (object, options = {}) => {
   const colorLevel = stdoutColor ? stdoutColor.level : 0;
   object.level = options.level === undefined ? colorLevel : options.level;
 };
+
+class Chalk {
+  constructor(options) {
+    return chalkFactory(options);
+  }
+}
 var chalkFactory = (options) => {
   const chalk = (...strings) => strings.join(" ");
   applyOptions(chalk, options);
@@ -2300,6 +2306,54 @@ var chalk = createChalk();
 var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
 
+// src/embed-context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+function setSoftExitCode(code) {
+  const ctx = embedStore.getStore();
+  if (ctx)
+    ctx.softExitCode = code;
+  else
+    process.exitCode = code;
+}
+var embedStore = new AsyncLocalStorage;
+
+class EmbeddedExit extends Error {
+  code;
+  constructor(code) {
+    super(`CLI exited with code ${code}`);
+    this.code = code;
+  }
+}
+function embeddedProfile() {
+  const ctx = embedStore.getStore();
+  if (!ctx)
+    return null;
+  return {
+    name: "embedded",
+    endpoint: ctx.identity.endpoint,
+    apiKey: ctx.identity.apiKey,
+    workspaceId: ctx.identity.workspaceId ?? null,
+    output: "json",
+    ...ctx.identity.transport ? { transport: ctx.identity.transport } : {},
+    ...ctx.identity.signal ? { signal: ctx.identity.signal } : {},
+    sources: { endpoint: "flag", apiKey: "flag", workspaceId: "flag", output: "flag" }
+  };
+}
+function exitCli(code) {
+  if (embedStore.getStore())
+    throw new EmbeddedExit(code);
+  return process.exit(code);
+}
+
+// src/output/presentation.ts
+var plain = new Chalk({ level: 0 });
+function styles3() {
+  return embedStore.getStore() ? plain : source_default;
+}
+function hasProgressTerminal() {
+  return !embedStore.getStore() && Boolean(process.stderr.isTTY);
+}
+
 // src/config/paths.ts
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -2634,6 +2688,9 @@ function refuseBlankOverrides(overrides) {
   }
 }
 function resolveProfile(overrides = {}) {
+  const embedded = embeddedProfile();
+  if (embedded)
+    return embedded;
   refuseBlankOverrides(overrides);
   const named = overrides.profile || process.env.SIM_PROFILE;
   const name = named || DEFAULT_PROFILE;
@@ -2683,17 +2740,58 @@ function resolveProfile(overrides = {}) {
     }
   };
 }
+// src/output/io.ts
+import { format } from "node:util";
+function printLine(...args) {
+  const context = embedStore.getStore();
+  if (context)
+    context.stdout.write(`${format(...args)}
+`);
+  else
+    console.log(...args);
+}
+function printError(...args) {
+  const context = embedStore.getStore();
+  if (context)
+    context.stderr.write(`${format(...args)}
+`);
+  else
+    console.error(...args);
+}
+function writeStdout(chunk) {
+  const context = embedStore.getStore();
+  if (!context)
+    return process.stdout.write(chunk);
+  context.stdout.write(chunk);
+  return true;
+}
+function writeStderr(chunk) {
+  const context = embedStore.getStore();
+  if (!context)
+    return process.stderr.write(chunk);
+  context.stderr.write(chunk);
+  return true;
+}
+
 // src/version.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 function readPackageVersion() {
-  const metadata = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
-  if (typeof metadata !== "object" || metadata === null || !("version" in metadata) || typeof metadata.version !== "string") {
-    throw new Error("CLI package metadata is missing a valid version");
-  }
-  return metadata.version;
+  try {
+    const metadata = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof metadata === "object" && metadata !== null && "version" in metadata && typeof metadata.version === "string") {
+      return metadata.version;
+    }
+  } catch {}
+  return "0.0.0-embedded";
+}
+var cachedVersion = null;
+function cliVersion() {
+  cachedVersion ??= readPackageVersion();
+  return cachedVersion;
+}
+function userAgent() {
+  return `sim-cli/${cliVersion()} node/${process.versions.node} (${process.platform}; ${process.arch})`;
 }
-var CLI_VERSION = readPackageVersion();
-var USER_AGENT = `sim-cli/${CLI_VERSION} node/${process.versions.node} (${process.platform}; ${process.arch})`;
 
 // src/http/environment.ts
 var reported = new Set;
@@ -2701,7 +2799,7 @@ function once(key, message) {
   if (reported.has(key))
     return;
   reported.add(key);
-  process.stderr.write(`warning: ${message}
+  writeStderr(`warning: ${message}
 `);
 }
 var PROXY_VARIABLES = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
@@ -2868,7 +2966,7 @@ function debugEnabled(env = process.env) {
   return raw !== undefined && raw !== "" && raw !== "0" && raw.toLowerCase() !== "false";
 }
 function traceRequest(method, url, status, startedAt) {
-  process.stderr.write(`${source_default.dim(`[sim] ${method} ${url} → ${status} ${Math.round(performance.now() - startedAt)}ms`)}
+  writeStderr(`${styles3().dim(`[sim] ${method} ${url} → ${status} ${Math.round(performance.now() - startedAt)}ms`)}
 `);
 }
 function withoutLeadingLabel(message, label) {
@@ -2966,17 +3064,20 @@ class SimClient {
     warnIfKeyOverCleartext(this.profile.endpoint, Boolean(apiKey));
     const timeoutMs = resolveTimeoutMs();
     const timeout = timeoutMs > 0 ? AbortSignal.timeout(timeoutMs) : undefined;
-    const signal = combineSignals(options.signal, timeout);
+    const caller = combineSignals(options.signal, this.profile.signal);
+    if (caller?.aborted)
+      throw new SimApiError("Request cancelled.", 0);
+    const signal = combineSignals(caller, timeout);
     const trace = debugEnabled();
     const startedAt = performance.now();
     let response;
     try {
-      response = await fetch(url, {
+      response = await (this.profile.transport ?? fetch)(url, {
         method,
         headers: {
           ...apiKey ? { "x-api-key": apiKey } : {},
           accept: "application/json",
-          "user-agent": USER_AGENT,
+          "user-agent": userAgent(),
           ...hasBody ? { "content-type": "application/json" } : {},
           ...options.headers
         },
@@ -2987,7 +3088,7 @@ class SimClient {
     } catch (cause) {
       if (trace)
         traceRequest(method, url, "failed", startedAt);
-      if (options.signal?.aborted) {
+      if (caller?.aborted) {
         throw new SimApiError("Request cancelled.", 0);
       }
       if (timeout?.aborted) {
@@ -3041,14 +3142,14 @@ function pageProgress() {
   let reported = false;
   return {
     advance: (fetched) => {
-      if (!process.stderr.isTTY)
+      if (!hasProgressTerminal())
         return;
       reported = true;
-      process.stderr.write(`\r${source_default.dim(`fetched ${fetched}…`)}\x1B[K`);
+      writeStderr(`\r${styles3().dim(`fetched ${fetched}…`)}\x1B[K`);
     },
     finish: () => {
       if (reported)
-        process.stderr.write("\r\x1B[K");
+        writeStderr("\r\x1B[K");
     }
   };
 }
@@ -6251,7 +6352,6 @@ function isWideCodePoint(codePoint) {
 
 // src/output/render.ts
 var EMPTY_GLYPH = "—";
-var EMPTY = source_default.dim(EMPTY_GLYPH);
 var ESC = String.fromCharCode(27);
 var CONTROL_PATTERN = new RegExp([
   `${ESC}\\][^\\u0007${ESC}]*(?:\\u0007|${ESC}\\\\)?`,
@@ -6270,12 +6370,12 @@ function safeOneLine(value) {
 }
 function text(value) {
   if (value === null || value === undefined || value === "")
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   return sanitize(String(value));
 }
 function timestamp2(value) {
   if (!value)
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   const date = new Date(value);
   if (Number.isNaN(date.getTime()))
     return sanitize(String(value));
@@ -6283,12 +6383,12 @@ function timestamp2(value) {
 }
 function bool2(value) {
   if (value === null || value === undefined)
-    return EMPTY;
-  return value ? source_default.green("yes") : source_default.dim("no");
+    return styles3().dim(EMPTY_GLYPH);
+  return value ? styles3().green("yes") : styles3().dim("no");
 }
 function bytes(value) {
   if (value === null || value === undefined)
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   const units = ["B", "KB", "MB", "GB", "TB"];
   let size = value;
   let unit = 0;
@@ -6300,7 +6400,7 @@ function bytes(value) {
 }
 function duration(ms) {
   if (ms === null || ms === undefined)
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   if (ms < 1000)
     return `${Math.round(ms)}ms`;
   if (ms < 60000)
@@ -6331,11 +6431,11 @@ function clamp(value, width) {
 }
 function renderTable(rows, columns) {
   if (rows.length === 0)
-    return source_default.dim("No results.");
+    return styles3().dim("No results.");
   const headers = columns.map((column) => sanitize(column.header));
   const cells = rows.map((row) => columns.map((column) => clamp(oneLine(column.value(row)), MAX_CELL_WIDTH)));
   const widths = columns.map((_column, index) => Math.max(visibleWidth(headers[index]), ...cells.map((line) => visibleWidth(line[index]))));
-  const header = headers.map((label, index) => source_default.dim(pad(label.toUpperCase(), widths[index]))).join("  ").trimEnd();
+  const header = headers.map((label, index) => styles3().dim(pad(label.toUpperCase(), widths[index]))).join("  ").trimEnd();
   const body = cells.map((line) => line.map((cell, index) => pad(cell, widths[index])).join("  ").trimEnd());
   return [header, ...body].join(`
 `);
@@ -6350,36 +6450,36 @@ function renderMachine(format, raw) {
 function printList(format, rows, columns, raw = rows) {
   const machine = renderMachine(format, raw);
   if (machine !== null) {
-    console.log(machine);
+    printLine(machine);
     return;
   }
   if (format === "text") {
     for (const row of rows) {
-      console.log(columns.map((column) => oneLine(stripAnsi(column.value(row)))).join("\t"));
+      printLine(columns.map((column) => oneLine(stripAnsi(column.value(row)))).join("\t"));
     }
     return;
   }
-  console.log(renderTable(rows, columns));
+  printLine(renderTable(rows, columns));
 }
 function printDocument(format, raw) {
-  console.log(format === "yaml" ? renderMachine("yaml", raw) : JSON.stringify(raw, null, 2));
+  printLine(format === "yaml" ? renderMachine("yaml", raw) : JSON.stringify(raw, null, 2));
 }
 function printRecord(format, fields, raw) {
   const machine = renderMachine(format, raw);
   if (machine !== null) {
-    console.log(machine);
+    printLine(machine);
     return;
   }
   const safeFields = fields.map(([label, value]) => [safeOneLine(label), value]);
   if (format === "text") {
     for (const [label, value] of safeFields) {
-      console.log(`${label}	${oneLine(stripAnsi(value))}`);
+      printLine(`${label}	${oneLine(stripAnsi(value))}`);
     }
     return;
   }
   const width = Math.max(...safeFields.map(([label]) => visibleWidth(label)));
   for (const [label, value] of safeFields) {
-    console.log(`${source_default.dim(pad(`${label}:`, width + 1))}  ${clamp(oneLine(value), MAX_RECORD_WIDTH)}`);
+    printLine(`${styles3().dim(pad(`${label}:`, width + 1))}  ${clamp(oneLine(value), MAX_RECORD_WIDTH)}`);
   }
 }
 
@@ -6475,7 +6575,7 @@ async function pollForKey(endpoint, auth, signal) {
         headers: {
           "content-type": "application/json",
           accept: "application/json",
-          "user-agent": USER_AGENT
+          "user-agent": userAgent()
         },
         body: JSON.stringify({ request: auth.request, verifier: auth.pollSecret }),
         signal,
@@ -6486,7 +6586,7 @@ async function pollForKey(endpoint, auth, signal) {
       consecutiveTransportFailures++;
       if (!warnedAboutTransport && consecutiveTransportFailures >= TRANSPORT_FAILURES_BEFORE_WARNING) {
         warnedAboutTransport = true;
-        process.stderr.write(`Still waiting: ${endpoint} is not answering the login poll (${cause.message}). Check the endpoint; retrying until you approve or the login times out.
+        writeStderr(`Still waiting: ${endpoint} is not answering the login poll (${cause.message}). Check the endpoint; retrying until you approve or the login times out.
 `);
       }
     }
@@ -6636,8 +6736,8 @@ var V2_OPERATIONS = {
       },
       outputColumns: {
         kind: "array",
-        required: true,
-        describe: "Columns created for producer outputs."
+        default: [],
+        describe: "Columns to create for producer outputs. An entry naming a column the table already has attaches that column to the group instead of creating it (its `type` must match), and an output whose column already exists may omit its entry entirely — so `[]` attaches existing columns only."
       },
       autoRun: {
         kind: "boolean",
@@ -6723,7 +6823,7 @@ var V2_OPERATIONS = {
     summary: "Delete Files",
     body: {
       workspaceId: { kind: "string", required: true, describe: "Workspace containing the files." },
-      fileIds: { kind: "array", required: true, describe: "File identifiers to update." }
+      fileIds: { kind: "array", required: true, describe: "File identifiers to delete." }
     }
   },
   bulkDeleteTables: {
@@ -6941,7 +7041,7 @@ var V2_OPERATIONS = {
       rowId: { kind: "string", describe: "Row whose runs should be canceled for row scope." },
       filter: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       excludeRowIds: { kind: "array", describe: "Rows excluded from an all-scope cancellation." }
     }
@@ -6972,6 +7072,11 @@ var V2_OPERATIONS = {
       conversationId: {
         kind: "string",
         describe: "Conversation to continue; a new one starts when omitted."
+      },
+      effort: {
+        kind: "enum",
+        values: ["low", "medium", "high", "xhigh", "max"],
+        describe: "Model effort for this turn; defaults to the deployment default (high)."
       }
     }
   },
@@ -7534,7 +7639,7 @@ var V2_OPERATIONS = {
       description: { kind: "string", describe: "Optional credential description." },
       id: {
         kind: "string",
-        describe: "Required only when provider discovery requests a client-generated ID."
+        describe: "Optional client-generated credential ID. The server mints one when it is omitted, so no provider requires it. A `slack-custom-bot` credential may supply one so its Slack Request URL, which embeds the ID, can be configured before the credential exists; every other provider ignores it."
       },
       credentials: {
         kind: "string",
@@ -7610,7 +7715,7 @@ var V2_OPERATIONS = {
       rowIds: { kind: "array", describe: "Explicit row subset to run." },
       filter: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       excludeRowIds: { kind: "array", describe: "Rows excluded from a select-all run scope." },
       limit: { kind: "object", describe: "Optional cap on eligible rows to run." }
@@ -8144,7 +8249,7 @@ var V2_OPERATIONS = {
       workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
       filter: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       limit: { kind: "integer", describe: "Maximum matching rows to delete." },
       rowIds: { kind: "array", describe: "Explicit row identifiers to delete." }
@@ -8393,7 +8498,7 @@ var V2_OPERATIONS = {
       },
       selectedOutputs: {
         kind: "array",
-        describe: "Block output references to include in a streamed response. Use `<blockName>.<outputPath>` for the executed workflow or `<childWorkflowId>.<blockName>.<outputPath>` for a child workflow; block names are normalized workflow reference names. Selecting a child workflow applies to every invocation of it. Requires `stream: true` — it shapes the streamed envelope only, so it is rejected on a sync request and when `async` is true. To narrow a finished run, pass `selectedOutputs` to the run resource instead."
+        describe: "Block output references to include in the response. Use `<blockName>.<outputPath>` for the executed workflow or `<childWorkflowId>.<blockName>.<outputPath>` for a child workflow; block names are normalized workflow reference names, and selecting a child workflow applies to every invocation of it. On a sync request the named outputs come back in `blockOutputs`, keyed by these selector strings exactly as sent; on a stream they shape the streamed envelope. A selector whose block name or id matches no block in the workflow is rejected with `400` naming the available blocks, before the run starts. A selector whose block did not run or whose path is absent is omitted. Rejected when `async` is true — a queued run has produced nothing to select; narrow the finished run via the run resource instead."
       },
       includeThinking: {
         kind: "boolean",
@@ -8431,7 +8536,13 @@ var V2_OPERATIONS = {
     pathParams: ["workflowId"],
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
-    summary: "Export Workflow"
+    summary: "Export Workflow",
+    query: {
+      includeWorkspaceBindings: {
+        kind: "boolean",
+        describe: "Whether to keep workspace-scoped bindings — table, knowledge base, document, folder, channel, and other resource selectors — in the exported state. Defaults to false, the sharing-safe export in which those ids are cleared because they resolve nowhere else. Send true for a same-workspace round trip so the re-imported workflow can run without re-selecting them. Credentials, passwords, and table sub-block values are cleared either way."
+      }
+    }
   },
   getAuditLog: {
     method: "GET",
@@ -8652,6 +8763,10 @@ var V2_OPERATIONS = {
         values: ["info", "error"],
         describe: "Severity level to include."
       },
+      includeHandledErrors: {
+        kind: "boolean",
+        describe: "Whether runs with a handled block error are counted as `handledErrorRuns`, and whether `level=error` also selects them. Off by default: counting them scans each run’s stored trace."
+      },
       startDate: {
         kind: "string",
         describe: "Only include runs started at or after this UTC ISO 8601 timestamp, e.g. `2026-08-06T00:00:00Z`. A date without a time, or a timestamp carrying a UTC offset instead of `Z`, is rejected, as is year `0000`, which names no storable instant."
@@ -8663,7 +8778,26 @@ var V2_OPERATIONS = {
       segmentCount: {
         kind: "integer",
         default: 72,
-        describe: "Number of equal time buckets to divide the window into, from 1 to 500. Exactly this many buckets are always returned. Buckets are never narrower than one minute, so on a short window the series extends past the end of the window rather than being compressed, and the trailing buckets are empty."
+        describe: "Number of equal time buckets to divide the window into, from 1 to 500. It is the ceiling on how many buckets a series carries: with `includeEmpty=true` exactly this many are returned, otherwise only the buckets holding at least one run. Buckets are never narrower than one minute, so on a short window the series extends past the end of the window rather than being compressed, and the trailing buckets are empty."
+      },
+      includeEmpty: {
+        kind: "enum",
+        values: [
+          "true",
+          "1",
+          "yes",
+          "on",
+          "y",
+          "enabled",
+          "false",
+          "0",
+          "no",
+          "off",
+          "n",
+          "disabled"
+        ],
+        default: false,
+        describe: "Whether buckets with no runs are included in every series. Off by default, so each series carries only the buckets that hold at least one run; set it to publish exactly `segmentCount` buckets per series, empty ones included. The listed spellings are the whole accepted vocabulary and are case-sensitive; any other value is rejected."
       }
     }
   },
@@ -8721,7 +8855,7 @@ var V2_OPERATIONS = {
       groupId: "Workflow or enrichment group to run."
     },
     responseMode: "json",
-    summary: "Get Enrichment Run Detail",
+    summary: "Get Row Group Run",
     query: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." }
     }
@@ -9121,6 +9255,10 @@ var V2_OPERATIONS = {
         values: ["builtin", "custom"],
         describe: "Restrict to shipped blocks or to this workspace’s deployed custom blocks."
       },
+      includeSunset: {
+        kind: "boolean",
+        describe: "Include `legacy` and `deprecated` blocks. Off by default: a sunset block keeps executing where it is already placed, but it is not offered for new authoring. Each returned entry carries `sunset.replacedBy`, the block to build with instead."
+      },
       sortBy: {
         kind: "enum",
         values: ["id", "name", "category"],
@@ -9196,6 +9334,21 @@ var V2_OPERATIONS = {
       search: {
         kind: "string",
         describe: "Case-insensitive substring match against the connector name."
+      },
+      detail: {
+        kind: "enum",
+        values: ["summary", "full"],
+        default: "summary",
+        describe: "Projection of each item. `summary` (the default) carries the identifier, name, description, and auth mode; `full` adds the version, the complete auth settings, the `sourceConfig` field schema, incremental-sync support, and tag definitions."
+      },
+      limit: {
+        kind: "integer",
+        default: 25,
+        describe: "Maximum connector types to return per page. Must be a whole number from 1 to 100. Defaults to 25."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
       }
     }
   },
@@ -9797,6 +9950,10 @@ var V2_OPERATIONS = {
         kind: "string",
         describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
       },
+      includeHandledErrors: {
+        kind: "boolean",
+        describe: "Whether `level=error` also selects runs that finished at `info` after a block error was recovered by an error path. Off by default: such a run succeeded, so it is an error only to a caller auditing error handling. Every row reports `hasHandledErrors` whether or not this is set. Job runs carry no block trace, so the flag never widens that branch."
+      },
       status: {
         kind: "string",
         describe: "Comma-separated execution statuses to include, from `pending` | `running` | `paused` | `redacting` | `completed` | `failed` | `cancelled`. An empty entry is rejected. ANDed with `level`, which reports severity rather than lifecycle."
@@ -10042,7 +10199,7 @@ var V2_OPERATIONS = {
     pathParams: ["tableId"],
     pathParamDocs: { tableId: "Unique table identifier." },
     responseMode: "json",
-    summary: "List Active Run Dispatches",
+    summary: "List Run Dispatches",
     query: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." }
     }
@@ -10454,8 +10611,8 @@ var V2_OPERATIONS = {
       },
       limit: {
         kind: "integer",
-        default: 50,
-        describe: "Maximum workspaces to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+        default: 25,
+        describe: "Maximum workspaces to return per page. Must be a whole number from 1 to 100. Defaults to 25."
       },
       cursor: {
         kind: "string",
@@ -10567,7 +10724,9 @@ var V2_OPERATIONS = {
     method: "GET",
     path: "/api/v2/files/[fileId]/text",
     pathParams: ["fileId"],
-    pathParamDocs: { fileId: "File identifier." },
+    pathParamDocs: {
+      fileId: "File identifier, or the file’s VFS path: `files/<folder>/<name>`, or `uploads/<name>` for a Chat upload."
+    },
     responseMode: "json",
     summary: "Read File Text",
     query: {
@@ -10598,7 +10757,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -10614,7 +10773,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -10630,7 +10789,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -10646,7 +10805,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -11019,7 +11178,7 @@ var V2_OPERATIONS = {
       q: { kind: "string", required: true, describe: "Case-insensitive cell substring to find." },
       predicate: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       sort: { kind: "array", describe: "Ordered table-row sort specification." }
     }
@@ -11461,7 +11620,7 @@ var V2_OPERATIONS = {
       filter: {
         kind: "unknown",
         required: true,
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       data: {
         kind: "object",
@@ -11843,10 +12002,10 @@ async function chooseWorkspace(client) {
   if (workspaces.length > MAX_INTERACTIVE_WORKSPACES) {
     throw new SimApiError(`The active API key can access more than ${MAX_INTERACTIVE_WORKSPACES} workspaces, which is too many to show interactively. Pass --workspace <id> instead.`, 0);
   }
-  console.log(`
+  printLine(`
 Available workspaces:`);
   for (const [index, workspace] of workspaces.entries()) {
-    console.log(`  ${index + 1}) ${safeOneLine(workspace.name)} (${workspace.id})`);
+    printLine(`  ${index + 1}) ${safeOneLine(workspace.name)} (${workspace.id})`);
   }
   const prompt = createInterface({ input: process.stdin, output: process.stderr });
   try {
@@ -11871,10 +12030,10 @@ function addProfileCommand() {
       auth_profile: authProfile,
       workspace: normalizeWorkspaceId(workspace.id, "the workspace response")
     });
-    console.log(source_default.green(`✓ Added profile "${safeOneLine(profileName)}" in ${configPath()}`));
-    console.log(`  Workspace: ${safeOneLine(workspace.name)} (${workspace.id})`);
-    console.log(`  Authentication: ${safeOneLine(authProfile)}`);
-    console.log(source_default.dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`));
+    printLine(styles3().green(`✓ Added profile "${safeOneLine(profileName)}" in ${configPath()}`));
+    printLine(`  Workspace: ${safeOneLine(workspace.name)} (${workspace.id})`);
+    printLine(`  Authentication: ${safeOneLine(authProfile)}`);
+    printLine(styles3().dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`));
   });
 }
 function loginCommand() {
@@ -11891,21 +12050,21 @@ function loginCommand() {
     if (readCredentialsProfile(profile.name).api_key && !options.yes) {
       const confirmed = await confirmProfileOverwrite(profile.name);
       if (!confirmed) {
-        console.log(source_default.dim("Login cancelled; the existing profile was not changed."));
+        printLine(styles3().dim("Login cancelled; the existing profile was not changed."));
         return;
       }
     }
     const auth = createAuthRequest();
     const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
-    console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(safeOneLine(profile.name))}`);
-    console.log(`
-Pairing code: ${source_default.bold(auth.pairing)}`);
-    console.log(source_default.dim(`Confirm this code matches what the browser shows before approving.
+    printLine(`Signing in to ${styles3().bold(profile.endpoint)} as profile ${styles3().bold(safeOneLine(profile.name))}`);
+    printLine(`
+Pairing code: ${styles3().bold(auth.pairing)}`);
+    printLine(styles3().dim(`Confirm this code matches what the browser shows before approving.
 `));
-    console.log(url);
+    printLine(url);
     if (options.browser)
       openBrowser(url);
-    console.log(source_default.dim(`
+    printLine(styles3().dim(`
 Waiting for approval…`));
     const key = await pollForKey(profile.endpoint, auth);
     if (key.scope !== scope) {
@@ -11918,14 +12077,14 @@ Waiting for approval…`));
     requireStorableKey(key.apiKey);
     writeConfigProfile(profile.name, settings);
     writeCredentialsProfile(profile.name, key.apiKey);
-    console.log(source_default.green(`
+    printLine(styles3().green(`
 ✓ Logged in. Key stored in ${credentialsPath()}`));
     if (key.workspaceBound && key.workspaceId) {
-      console.log(source_default.dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
+      printLine(styles3().dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
     } else if (key.workspaceId) {
-      console.log(source_default.dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
+      printLine(styles3().dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
     } else {
-      console.log(source_default.dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
+      printLine(styles3().dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
     }
   });
 }
@@ -11939,10 +12098,10 @@ function logoutCommand() {
       }
       const removed = deleteProfile(profileName);
       if (!removed.config && !removed.credentials) {
-        console.log(source_default.dim(`Nothing stored for profile "${safeOneLine(profileName)}".`));
+        printLine(styles3().dim(`Nothing stored for profile "${safeOneLine(profileName)}".`));
         return;
       }
-      console.log(source_default.green(`✓ Removed profile "${safeOneLine(profileName)}".`));
+      printLine(styles3().green(`✓ Removed profile "${safeOneLine(profileName)}".`));
       return;
     }
     const profile = profileFrom(command);
@@ -11951,12 +12110,12 @@ function logoutCommand() {
       throw new SimApiError(`Profile "${redact(profile.name)}" shares authentication with "${redact(authProfile)}". Log out of the authentication profile instead: sim logout --profile ${redact(authProfile)}`, 0);
     }
     if (!readCredentialsProfile(profile.name).api_key) {
-      console.log(source_default.dim(`No stored key for profile "${safeOneLine(profile.name)}".`));
+      printLine(styles3().dim(`No stored key for profile "${safeOneLine(profile.name)}".`));
       return;
     }
     writeCredentialsProfile(profile.name, null);
-    console.log(source_default.green(`✓ Removed the stored key for profile "${safeOneLine(profile.name)}".`));
-    console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
+    printLine(styles3().green(`✓ Removed the stored key for profile "${safeOneLine(profile.name)}".`));
+    printLine(styles3().dim("  The key itself is still active — revoke it in Settings → Sim API keys."));
   });
 }
 async function readKeyType(client) {
@@ -12017,18 +12176,18 @@ function presentVerification(verification) {
   if (verification.status === "verified") {
     const { name, memberCount } = verification.workspace;
     const members = `${memberCount} ${memberCount === 1 ? "member" : "members"}`;
-    return `${source_default.green("✓")} ${safeOneLine(name)} · ${members}`;
+    return `${styles3().green("✓")} ${safeOneLine(name)} · ${members}`;
   }
   const detail = safeOneLine(verification.detail);
   switch (verification.status) {
     case "rejected":
-      return `${source_default.red("✗")} ${detail}`;
+      return `${styles3().red("✗")} ${detail}`;
     case "unauthenticated":
-      return source_default.yellow(`not logged in — ${detail}`);
+      return styles3().yellow(`not logged in — ${detail}`);
     case "disabled":
-      return source_default.dim(detail);
+      return styles3().dim(detail);
     default:
-      return source_default.yellow(`could not check — ${detail}`);
+      return styles3().yellow(`could not check — ${detail}`);
   }
 }
 function whoamiCommand() {
@@ -12042,17 +12201,17 @@ function whoamiCommand() {
       keyType: null,
       detail: "not checked (--no-verify)"
     };
-    const annotate = (value, source) => source === "unset" ? source_default.dim("not set") : `${value} ${source_default.dim(`(${source})`)}`;
+    const annotate = (value, source) => source === "unset" ? styles3().dim("not set") : `${value} ${styles3().dim(`(${source})`)}`;
     printRecord(profile.output, [
       ["Profile", profile.name],
       ["Endpoint", annotate(profile.endpoint, sources.endpoint)],
       [
         "API key",
-        authentication.authenticated ? annotate("configured", authentication.source) : source_default.yellow("not logged in")
+        authentication.authenticated ? annotate("configured", authentication.source) : styles3().yellow("not logged in")
       ],
       [
         "Key type",
-        verification.keyType ?? source_default.dim(options.verify ? "unknown" : "not checked (--no-verify)")
+        verification.keyType ?? styles3().dim(options.verify ? "unknown" : "not checked (--no-verify)")
       ],
       ["Workspace", annotate(profile.workspaceId ?? "", sources.workspaceId)],
       ["Output", annotate(profile.output, sources.output)],
@@ -12078,15 +12237,18 @@ function whoamiCommand() {
     });
     const exitCode = WHOAMI_EXIT_CODES[verification.status];
     if (exitCode !== 0)
-      process.exitCode = exitCode;
+      setSoftExitCode(exitCode);
   });
 }
 var PROFILE_COLUMNS = [
-  { header: "", value: (row) => row.active ? source_default.green("*") : " " },
+  { header: "", value: (row) => row.active ? styles3().green("*") : " " },
   { header: "profile", value: (row) => safeOneLine(row.name) },
   { header: "key", value: (row) => row.error ? text(null) : row.hasKey ? "yes" : "no" },
   { header: "auth", value: (row) => row.authProfile ? safeOneLine(row.authProfile) : text(null) },
-  { header: "error", value: (row) => row.error ? source_default.red(safeOneLine(row.error)) : text(null) }
+  {
+    header: "error",
+    value: (row) => row.error ? styles3().red(safeOneLine(row.error)) : text(null)
+  }
 ];
 function buildProfileRow(name, active) {
   try {
@@ -12133,7 +12295,7 @@ function profilesCommand() {
     const rows = listProfiles().map((name) => buildProfileRow(name, name === activeName));
     if (rows.length === 0) {
       if (output === "table")
-        console.log(source_default.dim("No profiles yet. Run: sim login"));
+        printLine(styles3().dim("No profiles yet. Run: sim login"));
       else
         printList(output, rows, PROFILE_COLUMNS);
       return;
@@ -12213,21 +12375,21 @@ function configureCommand() {
     if (Object.keys(updates).length === 0) {
       const current = readConfigProfile(profile.name);
       if (Object.keys(current).length === 0) {
-        console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+        printLine(styles3().dim(`No settings stored for profile "${profile.name}".`));
         return;
       }
       for (const [key, value] of Object.entries(current)) {
-        console.log(`${source_default.dim(`${key}:`)} ${value}`);
+        printLine(`${styles3().dim(`${key}:`)} ${value}`);
       }
       return;
     }
     const removalOnly = Object.values(updates).every((value) => value === null);
     if (removalOnly && Object.keys(readConfigProfile(profile.name)).length === 0) {
-      console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+      printLine(styles3().dim(`No settings stored for profile "${profile.name}".`));
       return;
     }
     writeConfigProfile(profile.name, updates);
-    console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
+    printLine(styles3().green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
   });
 }
 
@@ -12451,7 +12613,7 @@ var CLI_CONTRACT = {
   },
   deleteTableView: { confirm: "This deletes the saved view and its filters." },
   deleteWorkflowGroup: {
-    confirm: "This deletes the group, every column it fed, and the values in them.",
+    confirm: "This deletes the group AND its output columns with all of their row data; the workflow it pointed at is untouched.",
     fields: [
       { header: "id" },
       { header: "deleted", format: "bool" },
@@ -12571,7 +12733,7 @@ var CLI_CONTRACT = {
   },
   applyWorkflowOperations: {
     command: "workflows operations apply",
-    confirm: "This edits the draft graph, and a delete operation removes blocks and their edges.",
+    confirm: "This edits the draft graph: the batch adds, edits, or deletes blocks and their edges as written.",
     flags: {
       operations: { json: true, describe: WORKFLOW_OPERATIONS_HELP },
       setBlockEnabled: { json: true, describe: WORKFLOW_SET_BLOCK_ENABLED_HELP }
@@ -13360,7 +13522,7 @@ var CLI_CONTRACT = {
       selectedOutputs: {
         name: "select-output",
         list: true,
-        describe: "Return streamed outputs as blockName.path or childWorkflowId.blockName.path; selecting a child workflow applies to every invocation, requires --follow"
+        describe: "Return blockName.path values (e.g. agent_1.content), or childWorkflowId.blockName.path for a child workflow (applies to every invocation) — in blockOutputs on a sync run, or from the streamed result with --follow; missing paths are omitted. Not available with --async"
       },
       stream: { omit: true },
       includeThinking: { omit: true },
@@ -13384,7 +13546,7 @@ var CLI_CONTRACT = {
       selectedOutputs: {
         name: "select-output",
         list: true,
-        describe: "Include blockId or blockId.path values in JSON or YAML output; block names are not resolved on a finished run"
+        describe: "Include blockName.path or blockId.path values (e.g. agent_1.content) in JSON or YAML output; names resolve against the workflow’s current blocks, and missing paths are omitted"
       }
     },
     fields: [
@@ -13492,6 +13654,87 @@ function camel(flag) {
 
 // src/runtime/request.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3, readSync } from "node:fs";
+
+// src/transfer/local-file.ts
+import { constants } from "node:fs";
+import { access, stat } from "node:fs/promises";
+import { basename } from "node:path";
+function embeddedFileKey(path) {
+  return path.startsWith("@") ? path.slice(1) : path;
+}
+async function embeddedFileContent(embedded, path) {
+  const key = embeddedFileKey(path);
+  embedded.identity.signal?.throwIfAborted();
+  if (!embedded.readFile)
+    throw new SimApiError("This invocation has no machine to read from", 0);
+  const content = await embedded.readFile(key);
+  embedded.identity.signal?.throwIfAborted();
+  return typeof content === "string" ? content : new Uint8Array(content);
+}
+var CONTENT_TYPES = {
+  css: "text/css",
+  csv: "text/csv",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  gif: "image/gif",
+  html: "text/html",
+  htm: "text/html",
+  jpeg: "image/jpeg",
+  jpg: "image/jpeg",
+  js: "text/javascript",
+  json: "application/json",
+  jsonl: "application/jsonl",
+  md: "text/markdown",
+  pdf: "application/pdf",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  png: "image/png",
+  svg: "image/svg+xml",
+  txt: "text/plain",
+  webp: "image/webp",
+  yaml: "application/yaml",
+  yml: "application/yaml",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  zip: "application/zip"
+};
+function contentTypeFor(name) {
+  const dot = name.lastIndexOf(".");
+  const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
+  return CONTENT_TYPES[extension] ?? "application/octet-stream";
+}
+async function localFile(path, override) {
+  const embedded = embedStore.getStore();
+  if (embedded) {
+    embedded.identity.signal?.throwIfAborted();
+    if (!embedded.openFile)
+      throw new SimApiError("This invocation has no machine to read from", 0);
+    const { size } = await embedded.openFile(embeddedFileKey(path));
+    embedded.identity.signal?.throwIfAborted();
+    if (!Number.isSafeInteger(size) || size < 0)
+      throw new SimApiError("Invalid file size", 0);
+    if (size === 0)
+      throw new SimApiError(`${path} is empty`, 0);
+    return { name: override ?? basename(embeddedFileKey(path)), size };
+  }
+  let size;
+  try {
+    const stats = await stat(path);
+    if (!stats.isFile())
+      throw new SimApiError(`${path} is not a regular file`, 0);
+    await access(path, constants.R_OK);
+    size = stats.size;
+  } catch (error) {
+    if (error instanceof SimApiError)
+      throw error;
+    throw new SimApiError(`Cannot read ${path}: ${error.message}`, 0);
+  }
+  if (size === 0)
+    throw new SimApiError(`${path} is empty`, 0);
+  return { name: override ?? basename(path), size };
+}
+
+// src/runtime/request.ts
 var PROFILE_INJECTED_FIELD = "workspaceId";
 function isProfileWorkspacePath(commandSpec, param) {
   return commandSpec.profileWorkspacePath === true && param === PROFILE_INJECTED_FIELD;
@@ -13573,11 +13816,21 @@ function readStdin() {
 function literalAtHint(error, path) {
   return error?.code === "ENOENT" ? `. To pass the literal value @${path}, write @@${path}` : "";
 }
-function readArgumentSource(raw, flagName) {
+async function readArgumentSource(raw, flagName) {
   if (raw.startsWith("@@"))
     return { text: raw.slice(1), from: "" };
   if (!raw.startsWith("@"))
     return { text: raw, from: "" };
+  const embedded = embedStore.getStore();
+  if (embedded) {
+    if (raw === "@-")
+      throw new SimApiError(`--${flagName}: this invocation has no stdin; use @path or an inline value`, 0);
+    const content = await embeddedFileContent(embedded, raw);
+    return {
+      text: typeof content === "string" ? content : new TextDecoder("utf-8", { fatal: true }).decode(content),
+      from: " (read from your machine)"
+    };
+  }
   const path = raw.slice(1);
   if (path === "-") {
     if (process.stdin.isTTY) {
@@ -13599,15 +13852,18 @@ function isManifestNoise(line) {
   const trimmed = line.trim();
   return trimmed === "" || trimmed.startsWith("#");
 }
-function readListValues(raw, flagName, manifest = false) {
+async function readListValues(raw, flagName, manifest = false) {
   const arguments_ = Array.isArray(raw) ? raw : [raw];
-  const values = arguments_.flatMap((argument) => {
+  const values = [];
+  for (const argument of arguments_) {
     if (typeof argument !== "string") {
       throw new SimApiError(`--${flagName} values must be strings`, 0);
     }
-    if (!argument.startsWith("@"))
-      return [argument];
-    const source = readArgumentSource(argument, flagName);
+    if (!argument.startsWith("@")) {
+      values.push(argument);
+      continue;
+    }
+    const source = await readArgumentSource(argument, flagName);
     const lines = source.text.split(/\r?\n/);
     if (lines.at(-1) === "")
       lines.pop();
@@ -13615,14 +13871,14 @@ function readListValues(raw, flagName, manifest = false) {
     if (kept.length === 0) {
       throw new SimApiError(`--${flagName}${source.from} contains no values`, 0);
     }
-    return kept.map((line, index) => {
+    values.push(...kept.map((line, index) => {
       const value = line.trim();
       if (!value) {
         throw new SimApiError(`--${flagName}${source.from} has an empty value on line ${index + 1}`, 0);
       }
       return value;
-    });
-  });
+    }));
+  }
   return values.map((value) => {
     const trimmed = value.trim();
     if (!trimmed)
@@ -13654,13 +13910,13 @@ var FRACTIONAL_DIGITS = /\.\d*[1-9]/;
 function pathHint(raw) {
   if (raw.startsWith("@") || /^\s*[[{"\-\d]|^\s*(true|false|null)/.test(raw))
     return "";
-  return existsSync2(raw) ? `. ${raw} is a file — pass it as @${raw}` : ". To read a file, pass @path (or @- for stdin)";
+  return !embedStore.getStore() && existsSync2(raw) ? `. ${raw} is a file — pass it as @${raw}` : ". To read a file, pass @path (or @- for stdin)";
 }
-function coerce(raw, field, flag, flagName) {
+async function coerce(raw, field, flag, flagName) {
   if (raw === undefined)
     return;
   if (flag.list) {
-    const values = readListValues(raw, flagName, flag.manifest === true).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
+    const values = (await readListValues(raw, flagName, flag.manifest === true)).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
     return field.kind === "string" ? values.join(",") : values;
   }
   if (flag.rowCap)
@@ -13668,7 +13924,7 @@ function coerce(raw, field, flag, flagName) {
   if (takesJson(field, flag)) {
     if (typeof raw !== "string")
       return raw;
-    const source = readArgumentSource(raw, flagName);
+    const source = await readArgumentSource(raw, flagName);
     try {
       return JSON.parse(source.text);
     } catch (error) {
@@ -13705,7 +13961,7 @@ function asQueryValue(value) {
     return JSON.stringify(value);
   return value;
 }
-function buildRequest(operation, positional, flags, workspaceId) {
+async function buildRequest(operation, positional, flags, workspaceId) {
   const commandSpec = CLI_CONTRACT[operation] ?? {};
   const spec = V2_OPERATIONS[operation];
   let path = spec.path;
@@ -13743,7 +13999,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
       if ((slot === "query" || NUMERIC_KINDS.has(descriptor.kind)) && typeof raw === "string" && raw.trim() === "" && !(field === "limit" && paginatedLimit)) {
         throw new SimApiError(`--${flagName} cannot be empty`, 0);
       }
-      const value = coerce(raw ?? undefined, descriptor, flag, flagName);
+      const value = await coerce(raw ?? undefined, descriptor, flag, flagName);
       if (field === "limit" && !paginatedLimit && NUMERIC_KINDS.has(descriptor.kind) && typeof value === "number" && value < 1) {
         throw new SimApiError(`--${flagName} must be 1 or more`, 0);
       }
@@ -13773,7 +14029,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
       const raw = flags[camel(variant.name)];
       if (typeof raw !== "string")
         throw new SimApiError(`--${variant.name} is required`, 0);
-      const parsed = coerce(raw, { kind: variant.kind }, { json: true }, variant.name);
+      const parsed = await coerce(raw, { kind: variant.kind }, { json: true }, variant.name);
       if (variant.kind === "object" && (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) || variant.kind === "array" && !Array.isArray(parsed)) {
         throw new SimApiError(`--${variant.name} must be a JSON ${variant.kind}`, 0);
       }
@@ -13782,7 +14038,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
     const raw = flags.body;
     if (typeof raw !== "string")
       throw new SimApiError("--body is required", 0);
-    const parsed = coerce(raw, { kind: "object" }, { json: true }, "body");
+    const parsed = await coerce(raw, { kind: "object" }, { json: true }, "body");
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       throw new SimApiError("--body must be a JSON object", 0);
     }
@@ -13907,7 +14163,7 @@ function warn(kind, from, to) {
   if (warned.has(key))
     return;
   warned.add(key);
-  process.stderr.write(`warning: ${kind} "${from}" has been renamed to "${to}". The old name still works.
+  writeStderr(`warning: ${kind} "${from}" has been renamed to "${to}". The old name still works.
 `);
 }
 function warnRenamedCommand(from, to) {
@@ -14019,13 +14275,13 @@ function renderSpan(value, depth) {
 function printTraceSpans(format, traceSpans) {
   if (format === "json" || format === "yaml")
     return;
-  console.log("");
-  console.log(format === "table" ? source_default.dim("trace:") : "trace:");
+  printLine("");
+  printLine(format === "table" ? styles3().dim("trace:") : "trace:");
   if (traceSpans.length === 0) {
-    console.log(source_default.dim("  No trace spans."));
+    printLine(styles3().dim("  No trace spans."));
     return;
   }
-  console.log(traceSpans.flatMap((span) => renderSpan(span, 0)).join(`
+  printLine(traceSpans.flatMap((span) => renderSpan(span, 0)).join(`
 `));
 }
 
@@ -14190,7 +14446,7 @@ function writePageNote(spec, envelope) {
   const value = at(envelope, spec.pageNote.path);
   if (value === undefined || value === null)
     return;
-  process.stderr.write(source_default.dim(`${spec.pageNote.label}: ${String(value)}
+  writeStderr(styles3().dim(`${spec.pageNote.label}: ${String(value)}
 `));
 }
 var TRUNCATION_FLAG = /^truncated$|^[A-Za-z0-9]+Truncated$/;
@@ -14223,14 +14479,14 @@ function clippedSubject(flag) {
 }
 function writeEnvelopeTruncation(envelope) {
   for (const flag of responseTruncationFlags(envelope)) {
-    process.stderr.write(source_default.dim(`${spellOut(flag)}: the server clipped ${clippedSubject(flag)}, so the answer is incomplete
+    writeStderr(styles3().dim(`${spellOut(flag)}: the server clipped ${clippedSubject(flag)}, so the answer is incomplete
 `));
   }
 }
 function writeCursorTruncation(count, truncated) {
   if (!truncated)
     return;
-  process.stderr.write(source_default.dim(`showing the first ${count}; more results exist — re-run with --limit 0 for all
+  writeStderr(styles3().dim(`showing the first ${count}; more results exist — re-run with --limit 0 for all
 `));
 }
 function renderResult(operation, format, raw, spec, options = {}, envelope) {
@@ -14239,7 +14495,7 @@ function renderResult(operation, format, raw, spec, options = {}, envelope) {
     printDocument(format, raw);
     return;
   }
-  const data = unwrapResource(raw);
+  const data = format === "json" || format === "yaml" ? raw : unwrapResource(raw);
   if (spec.itemsPath) {
     const items = at(data, spec.itemsPath);
     if (!Array.isArray(items)) {
@@ -14358,6 +14614,22 @@ function countOf(value) {
 function lengthOf(value) {
   return Array.isArray(value) ? value.length : 0;
 }
+var RESULT_NOTES = {
+  replaceWorkflowChatDeployment: (payload, body) => {
+    const authType = payload.authType ?? body?.authType ?? "public";
+    return authType === "public" ? "note: auth type is public — anyone with the link can chat; pass --auth-type password|email to restrict it." : null;
+  }
+};
+function writeResultNote(operation, payload, body) {
+  const note = RESULT_NOTES[operation];
+  if (!note)
+    return;
+  const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+  const message = note(record, body);
+  if (message)
+    writeStderr(styles3().dim(`${message}
+`));
+}
 function bulkFailureMessage(operation, payload, body) {
   const check = BULK_OUTCOME_CHECKS[operation];
   if (!check)
@@ -14446,7 +14718,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
   const needsWorkspace = (hasWorkspaceField || commandSpec.profileWorkspacePath === true) && !omitsWorkspace;
   const paging = cursorSlot(operationSpec);
   const pagedLimit = paging ? readPagedLimit(requestFlags.limit) : 0;
-  const request = buildRequest(operation, positional, requestFlags, needsWorkspace ? client.requireWorkspace() : profile.workspaceId);
+  const request = await buildRequest(operation, positional, requestFlags, needsWorkspace ? client.requireWorkspace() : profile.workspaceId);
   if (paging) {
     const limit = pagedLimit === 0 ? Number.POSITIVE_INFINITY : pagedLimit;
     const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
@@ -14483,6 +14755,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
   });
   const payload = result?.data ?? result;
   renderResult(operation, profile.output, payload, commandSpec, { expandedTrace: requestFlags.trace === true }, result);
+  writeResultNote(operation, payload, request.body);
   const failure = runFailureMessage(operation, payload) ?? bulkFailureMessage(operation, payload, request.body);
   if (failure)
     throw new SimApiError(failure, 0);
@@ -14890,8 +15163,8 @@ function serviceAccountProvider(providers, providerId) {
   }
   return provider;
 }
-function credentialValues(provider, raw) {
-  const parsed = coerce(raw, { kind: "object" }, { json: true }, "credentials");
+async function credentialValues(provider, raw) {
+  const parsed = await coerce(raw, { kind: "object" }, { json: true }, "credentials");
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new SimApiError("--credentials must be a JSON object", 0);
   }
@@ -14928,7 +15201,7 @@ async function createServiceAccount(command, providerId, options) {
   if (provider.requiresClientGeneratedCredentialId && !options.id) {
     throw new SimApiError(`--id is required for ${providerId}.`, 0);
   }
-  const credentialFields = credentialValues(provider, options.credentials);
+  const credentialFields = await credentialValues(provider, options.credentials);
   const operation = V2_OPERATIONS.createServiceAccountCredential;
   const response = await client.request(operation.path, {
     method: operation.method,
@@ -15099,19 +15372,19 @@ Examples:
     const endStreamedLine = () => {
       if (streamed.length > 0 && !streamed.endsWith(`
 `)) {
-        process.stdout.write(`
+        writeStdout(`
 `);
         streamed += `
 `;
       }
     };
-    const restorePipeHandling = streaming ? ignoreBrokenPipe(process.stdout) : undefined;
+    const restorePipeHandling = streaming && !embedStore.getStore() ? ignoreBrokenPipe(process.stdout) : undefined;
     try {
       const result = await readChatStream(response, (content) => {
         if (!streaming)
           return;
         streamed += content;
-        process.stdout.write(content);
+        writeStdout(content);
       });
       if (!streaming) {
         printProtocolResult(profile.output, result);
@@ -15119,11 +15392,11 @@ Examples:
       }
       const content = sanitize(result.content ?? "");
       if (content.startsWith(streamed) && content.length > streamed.length) {
-        process.stdout.write(content.slice(streamed.length));
+        writeStdout(content.slice(streamed.length));
         streamed = content;
       }
       endStreamedLine();
-      process.stderr.write(`${source_default.dim(`conversation: ${result.conversationId}`)}
+      writeStderr(`${styles3().dim(`conversation: ${result.conversationId}`)}
 `);
     } catch (error) {
       endStreamedLine();
@@ -15254,19 +15527,38 @@ async function saveStagedFile(body, target, force) {
   }
 }
 async function saveToFile(body, target, force) {
+  const embedded = embedStore.getStore();
+  if (embedded) {
+    try {
+      embedded.identity.signal?.throwIfAborted();
+      if (!embedded.writeFile) {
+        throw new SimApiError(`--output-file cannot save ${target} here: this surface has no machine to write to. Read the file instead, or use a client with filesystem access to download it.`, 0);
+      }
+      await embedded.writeFile(target, body, { overwrite: force });
+      embedded.identity.signal?.throwIfAborted();
+    } finally {
+      await body.cancel().catch(() => {});
+    }
+    return;
+  }
   return saveStagedFile(body, target, force);
 }
-async function streamToStdout(body, output = process.stdout) {
+async function streamToStdout(body, output) {
   const reader = body.getReader();
   try {
     while (true) {
       const { done, value } = await reader.read();
       if (done)
         return;
-      if (!output.write(value))
-        await once2(output, "drain");
+      if (output) {
+        if (!output.write(value))
+          await once2(output, "drain");
+      } else if (!writeStdout(value)) {
+        await once2(process.stdout, "drain");
+      }
     }
   } finally {
+    await reader.cancel().catch(() => {});
     reader.releaseLock();
   }
 }
@@ -15304,9 +15596,10 @@ function attachFileGet(files) {
     }
     if (options.outputFile === undefined || options.outputFile === "-") {
       const contentType = response.headers.get("content-type");
-      if (process.stdout.isTTY && !isTerminalSafeContentType(contentType)) {
+      const embedded = embedStore.getStore();
+      if ((embedded || process.stdout.isTTY) && !isTerminalSafeContentType(contentType)) {
         await response.body.cancel();
-        throw new SimApiError(`Refusing to write ${contentType ?? "unknown content"} to an interactive terminal. Use --output-file <path> or pipe stdout.`, 0);
+        throw new SimApiError(embedded ? `Refusing to put ${contentType ?? "unknown content"} in a text result. Use --output-file <path>.` : `Refusing to write ${contentType ?? "unknown content"} to an interactive terminal. Use --output-file <path> or pipe stdout.`, 0);
       }
       await streamToStdout(response.body);
       return;
@@ -15321,74 +15614,120 @@ function attachFileGet(files) {
   });
 }
 
-// src/transfer/local-file.ts
-import { constants } from "node:fs";
-import { access, stat } from "node:fs/promises";
-import { basename } from "node:path";
-var CONTENT_TYPES = {
-  css: "text/css",
-  csv: "text/csv",
-  doc: "application/msword",
-  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  gif: "image/gif",
-  html: "text/html",
-  htm: "text/html",
-  jpeg: "image/jpeg",
-  jpg: "image/jpeg",
-  js: "text/javascript",
-  json: "application/json",
-  jsonl: "application/jsonl",
-  md: "text/markdown",
-  pdf: "application/pdf",
-  ppt: "application/vnd.ms-powerpoint",
-  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  png: "image/png",
-  svg: "image/svg+xml",
-  txt: "text/plain",
-  webp: "image/webp",
-  yaml: "application/yaml",
-  yml: "application/yaml",
-  xls: "application/vnd.ms-excel",
-  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  zip: "application/zip"
-};
-function contentTypeFor(name) {
-  const dot = name.lastIndexOf(".");
-  const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
-  return CONTENT_TYPES[extension] ?? "application/octet-stream";
-}
-async function localFile(path, override) {
-  let size;
-  try {
-    const stats = await stat(path);
-    if (!stats.isFile())
-      throw new SimApiError(`${path} is not a regular file`, 0);
-    await access(path, constants.R_OK);
-    size = stats.size;
-  } catch (error) {
-    if (error instanceof SimApiError)
-      throw error;
-    throw new SimApiError(`Cannot read ${path}: ${error.message}`, 0);
+// src/transfer/upload-session.ts
+import { openAsBlob } from "node:fs";
+
+// src/transfer/streaming-upload.ts
+class StreamingUpload {
+  size;
+  position = 0;
+  pending = new Uint8Array(0);
+  closed = false;
+  reader;
+  onAbort;
+  stopped = new AbortController;
+  signal;
+  constructor(stream, size, signal) {
+    this.size = size;
+    this.signal = signal ? AbortSignal.any([signal, this.stopped.signal]) : this.stopped.signal;
+    this.reader = stream.getReader();
+    this.onAbort = () => {
+      this.reader.cancel(this.signal.reason).catch(() => {});
+    };
+    this.signal.addEventListener("abort", this.onAbort, { once: true });
+    if (this.signal.aborted)
+      this.onAbort();
+  }
+  slice(start, end) {
+    this.signal.throwIfAborted();
+    if (this.closed || start !== this.position || end <= start || end > this.size) {
+      throw new SimApiError("Upload parts must consume the snapshot in order", 0);
+    }
+    return new ReadableStream({
+      pull: async (controller) => {
+        try {
+          this.signal.throwIfAborted();
+          while (this.pending.byteLength === 0) {
+            const next = await this.reader.read();
+            this.signal.throwIfAborted();
+            if (next.done)
+              throw new SimApiError("Upload file ended before its declared size", 0);
+            this.pending = next.value;
+          }
+          const length = Math.min(this.pending.byteLength, end - this.position);
+          controller.enqueue(this.pending.subarray(0, length));
+          this.pending = this.pending.subarray(length);
+          this.position += length;
+          if (this.position === end)
+            controller.close();
+        } catch (error) {
+          controller.error(error);
+        }
+      },
+      cancel: (reason) => this.reader.cancel(reason)
+    }, { highWaterMark: 0 });
+  }
+  assertConsumed(end) {
+    this.signal.throwIfAborted();
+    if (this.position !== end) {
+      throw new SimApiError("Upload was acknowledged before its complete body was consumed", 0);
+    }
+  }
+  async verifyComplete() {
+    this.assertConsumed(this.size);
+    if (this.pending.byteLength > 0) {
+      throw new SimApiError("Upload file exceeds its declared size", 0);
+    }
+    while (true) {
+      const next = await this.reader.read();
+      this.signal.throwIfAborted();
+      if (next.done)
+        return;
+      if (next.value.byteLength > 0)
+        throw new SimApiError("Upload file exceeds its declared size", 0);
+    }
+  }
+  async close() {
+    if (this.closed)
+      return;
+    this.closed = true;
+    this.stopped.abort();
+    this.signal.removeEventListener("abort", this.onAbort);
+    try {
+      await this.reader.cancel().catch(() => {});
+    } finally {
+      this.reader.releaseLock();
+    }
   }
-  if (size === 0)
-    throw new SimApiError(`${path} is empty`, 0);
-  return { name: override ?? basename(path), size };
 }
 
 // src/transfer/upload-session.ts
-import { openAsBlob } from "node:fs";
 var PART_URL_BATCH = 100;
-async function uploadPut(transfer, blob) {
-  const response = await fetch(transfer.url, {
+async function uploadBytes(url, headers, file, start, end, label) {
+  const body = file.slice(start, end);
+  const options = {
     method: "PUT",
-    headers: transfer.headers,
-    body: blob
-  });
+    headers,
+    body,
+    signal: file instanceof StreamingUpload ? file.signal : embedStore.getStore()?.identity.signal
+  };
+  if (file instanceof StreamingUpload) {
+    const streamedHeaders = new Headers(headers);
+    streamedHeaders.set("content-length", String(end - start));
+    options.headers = streamedHeaders;
+    options.duplex = "half";
+  }
+  const response = await fetch(url, options);
   if (!response.ok) {
-    throw new SimApiError(`Upload failed with status ${response.status}`, response.status);
+    throw new SimApiError(`${label} failed with status ${response.status}`, response.status);
   }
+  if (file instanceof StreamingUpload)
+    file.assertConsumed(end);
 }
-async function uploadParts(client, workspaceId, session, transfer, blob) {
+async function uploadParts(client, workspaceId, session, transfer, file) {
+  if (file instanceof StreamingUpload && (!Number.isSafeInteger(transfer.partSize) || transfer.partSize <= 0)) {
+    throw new SimApiError("Invalid upload part size", 0);
+  }
   const expectedPartCount = Math.ceil(session.size / transfer.partSize);
   if (expectedPartCount !== transfer.partCount) {
     throw new Error(`Upload session expected ${transfer.partCount} parts, but file requires ${expectedPartCount}`);
@@ -15404,28 +15743,49 @@ async function uploadParts(client, workspaceId, session, transfer, blob) {
       headers: { "upload-token": session.uploadToken },
       body: { partNumbers }
     });
-    for (const part of signed.data.parts) {
-      const start = (part.partNumber - 1) * transfer.partSize;
-      const chunk = blob.slice(start, Math.min(start + transfer.partSize, session.size));
-      const response = await fetch(part.url, {
-        method: "PUT",
-        headers: part.headers,
-        body: chunk
-      });
-      if (!response.ok) {
-        throw new SimApiError(`Part ${part.partNumber} failed with status ${response.status}`, response.status);
+    let parts = signed.data.parts;
+    if (file instanceof StreamingUpload) {
+      const numbers = new Set(parts.map((part) => part.partNumber));
+      if (parts.length !== partNumbers.length || partNumbers.some((n) => !numbers.has(n))) {
+        throw new SimApiError("Upload part URLs do not match the requested parts", 0);
       }
+      parts = [...parts].sort((a, b) => a.partNumber - b.partNumber);
+    }
+    for (const part of parts) {
+      const start = (part.partNumber - 1) * transfer.partSize;
+      await uploadBytes(part.url, part.headers, file, start, Math.min(start + transfer.partSize, session.size), `Part ${part.partNumber}`);
     }
   }
 }
 async function finishUploadSession(client, workspaceId, session, path) {
+  let snapshot;
+  let streamed;
   try {
-    const blob = await openAsBlob(path);
+    const embedded = embedStore.getStore();
+    let file;
+    if (embedded) {
+      embedded.identity.signal?.throwIfAborted();
+      if (!embedded.openFile)
+        throw new SimApiError("This invocation has no machine to read from", 0);
+      snapshot = await embedded.openFile(embeddedFileKey(path));
+      if (snapshot.size !== session.size)
+        throw new SimApiError("Upload snapshot size changed", 0);
+      streamed = new StreamingUpload(await snapshot.stream(), snapshot.size, AbortSignal.any([
+        ...embedded.identity.signal ? [embedded.identity.signal] : [],
+        ...snapshot.signal ? [snapshot.signal] : []
+      ]));
+      file = streamed;
+    } else {
+      file = await openAsBlob(path);
+    }
     if (session.transfer.method === "put") {
-      await uploadPut(session.transfer, blob);
+      await uploadBytes(session.transfer.url, session.transfer.headers, file, 0, file instanceof Blob ? file.size : session.size, "Upload");
     } else {
-      await uploadParts(client, workspaceId, session, session.transfer, blob);
+      await uploadParts(client, workspaceId, session, session.transfer, file);
     }
+    await streamed?.verifyComplete();
+    await streamed?.close();
+    await snapshot?.dispose().catch(() => {});
     const completed = await client.request(`${session.basePath}/complete`, {
       method: "POST",
       query: { workspaceId },
@@ -15433,7 +15793,10 @@ async function finishUploadSession(client, workspaceId, session, path) {
     });
     return completed.data;
   } catch (error) {
-    await client.request(session.basePath, {
+    await streamed?.close();
+    const profile = embeddedProfile();
+    const cleanupClient = profile ? new SimClient({ ...profile, signal: AbortSignal.timeout(5000) }) : client;
+    await cleanupClient.request(session.basePath, {
       method: "DELETE",
       query: { workspaceId },
       headers: { "upload-token": session.uploadToken }
@@ -15441,6 +15804,9 @@ async function finishUploadSession(client, workspaceId, session, path) {
       return;
     });
     throw error;
+  } finally {
+    await streamed?.close();
+    await snapshot?.dispose().catch(() => {});
   }
 }
 
@@ -15526,9 +15892,11 @@ function attachKnowledgeDocumentUpload(documents) {
     printProtocolResult(profile.output, {
       id: completed.document.id,
       knowledgeBaseId: completed.document.knowledgeBaseId,
-      name: completed.document.filename,
-      size: completed.document.fileSize,
-      status: completed.document.processingStatus
+      filename: completed.document.filename,
+      fileSize: completed.document.fileSize,
+      mimeType: completed.document.mimeType,
+      processingStatus: completed.document.processingStatus,
+      chunkCount: completed.document.chunkCount
     });
   });
 }
@@ -15590,11 +15958,11 @@ function createTableWriter() {
     if (!widths) {
       widths = COLUMNS.map((column, index) => Math.min(MAX_CELL_WIDTH2, Math.max(column.floor, visibleWidth(column.header), ...lines.map((line) => visibleWidth(line[index])))));
       const header = widths;
-      console.log(source_default.dim(COLUMNS.map((column, index) => pad2(column.header.toUpperCase(), header[index])).join("  ").trimEnd()));
+      printLine(styles3().dim(COLUMNS.map((column, index) => pad2(column.header.toUpperCase(), header[index])).join("  ").trimEnd()));
     }
     const locked = widths;
     for (const line of lines) {
-      console.log(line.map((cell, index) => pad2(cell, locked[index])).join("  ").trimEnd());
+      printLine(line.map((cell, index) => pad2(cell, locked[index])).join("  ").trimEnd());
     }
   };
 }
@@ -15602,13 +15970,13 @@ function createWriter(format) {
   if (format === "json") {
     return (rows) => {
       for (const row of rows)
-        console.log(JSON.stringify(row));
+        printLine(JSON.stringify(row));
     };
   }
   if (format === "yaml") {
     return (rows) => {
       for (const row of rows) {
-        console.log(`---
+        printLine(`---
 ${dump(row, { lineWidth: 0, noRefs: true }).trimEnd()}`);
       }
     };
@@ -15625,24 +15993,24 @@ function followStatus() {
   let reported = false;
   return {
     note: (message) => {
-      if (!process.stderr.isTTY)
+      if (!hasProgressTerminal())
         return;
       reported = true;
-      process.stderr.write(`\r${source_default.dim(message)}${ERASE_LINE}`);
+      writeStderr(`\r${styles3().dim(message)}${ERASE_LINE}`);
     },
     warn: (message) => {
       if (reported) {
         reported = false;
-        process.stderr.write(`\r${ERASE_LINE}`);
+        writeStderr(`\r${ERASE_LINE}`);
       }
-      process.stderr.write(`warning: ${message}
+      writeStderr(`warning: ${message}
 `);
     },
     clear: () => {
       if (!reported)
         return;
       reported = false;
-      process.stderr.write(`\r${ERASE_LINE}`);
+      writeStderr(`\r${ERASE_LINE}`);
     }
   };
 }
@@ -15935,13 +16303,13 @@ async function watchImport(client, workspaceId, job) {
     const next = await client.request(`/api/v2/tables/imports/${encodeURIComponent(current.id)}`, { query: { workspaceId } });
     current = next.data;
     const line = progressLine(current);
-    if (process.stderr.isTTY && line !== reported) {
+    if (hasProgressTerminal() && line !== reported) {
       reported = line;
-      process.stderr.write(`\r${source_default.dim(line)}\x1B[K`);
+      writeStderr(`\r${styles3().dim(line)}\x1B[K`);
     }
   }
-  if (process.stderr.isTTY && reported !== null)
-    process.stderr.write("\r\x1B[K");
+  if (hasProgressTerminal() && reported !== null)
+    writeStderr("\r\x1B[K");
   return current;
 }
 function validateTargetOptions(options) {
@@ -15999,8 +16367,8 @@ function attachTableImport(tables) {
         workspaceId,
         source,
         target,
-        ...options.mapping ? { mapping: jsonFlag(options.mapping, "mapping", "object") } : {},
-        ...options.createColumns ? { createColumns: jsonFlag(options.createColumns, "create-columns", "array") } : {},
+        ...options.mapping ? { mapping: await jsonFlag(options.mapping, "mapping", "object") } : {},
+        ...options.createColumns ? { createColumns: await jsonFlag(options.createColumns, "create-columns", "array") } : {},
         ...options.timezone ? { timezone: options.timezone } : {}
       }
     });
@@ -16045,14 +16413,11 @@ var AGENT_STREAM_PROTOCOL_HEADER = "x-sim-stream-protocol";
 var AGENT_STREAM_PROTOCOL_V1 = "agent-events-v1";
 var DONE_SENTINEL = "[DONE]";
 function resolveWorkflowRunSelection(flags) {
-  const manual = flags.manual === true;
   const trigger = typeof flags.trigger === "string" ? flags.trigger : undefined;
   const useMockPayload = flags.mockPayload === true;
+  const manual = flags.manual === true || trigger !== undefined || useMockPayload;
   const fromBlock = typeof flags.fromBlock === "string" ? flags.fromBlock : undefined;
   const sourceRun = typeof flags.sourceRun === "string" ? flags.sourceRun : undefined;
-  if ((trigger || useMockPayload) && !manual) {
-    throw new SimApiError("--trigger and --mock-payload require --manual", 0);
-  }
   if (fromBlock && (trigger || useMockPayload)) {
     throw new SimApiError("--from-block cannot be combined with --trigger or --mock-payload", 0);
   }
@@ -16151,11 +16516,11 @@ class Commentary {
 function toolNotice(frame) {
   const name = safeOneLine(stringField(frame, "name") ?? "tool");
   if (frame.phase === "start")
-    return source_default.dim(`→ ${name}`);
+    return styles3().dim(`→ ${name}`);
   const status = stringField(frame, "status");
   if (status && status !== "success")
-    return source_default.yellow(`✗ ${name} (${safeOneLine(status)})`);
-  return source_default.dim(`✓ ${name}`);
+    return styles3().yellow(`✗ ${name} (${safeOneLine(status)})`);
+  return styles3().dim(`✓ ${name}`);
 }
 async function renderRunStream(body, options) {
   const commentary = new Commentary(options.stderr);
@@ -16177,11 +16542,11 @@ async function renderRunStream(body, options) {
     }
     switch (frame.event) {
       case "chunk_reset":
-        commentary.line(source_default.dim("… retracted; that turn resolved to tool calls"));
+        commentary.line(styles3().dim("… retracted; that turn resolved to tool calls"));
         break;
       case "thinking":
         if (options.includeThinking && typeof frame.data === "string") {
-          commentary.inline(source_default.dim(sanitize(frame.data)));
+          commentary.inline(styles3().dim(sanitize(frame.data)));
         }
         break;
       case "tool":
@@ -16189,7 +16554,7 @@ async function renderRunStream(body, options) {
           commentary.line(toolNotice(frame));
         break;
       case "stream_error":
-        commentary.line(source_default.yellow(`warning: ${safeOneLine(stringField(frame, "error") ?? "stream read failed")}`));
+        commentary.line(styles3().yellow(`warning: ${safeOneLine(stringField(frame, "error") ?? "stream read failed")}`));
         break;
       case "error":
         commentary.endLine();
@@ -16218,7 +16583,7 @@ async function followRun(workflowId, command) {
   const negotiates = includeThinking || includeToolCalls;
   const { client, profile } = clientFrom(command);
   const operation = V2_OPERATIONS.executeWorkflow;
-  const request = buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
+  const request = await buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
   const response = await client.requestRaw(request.path, {
     method: "POST",
     query: request.query,
@@ -16244,7 +16609,7 @@ async function followRun(workflowId, command) {
   const final = await renderRunStream(response.body, {
     includeThinking,
     includeToolCalls,
-    stderr: process.stderr
+    stderr: { write: writeStderr }
   });
   renderResult("executeWorkflow", profile.output, final, CLI_CONTRACT.executeWorkflow ?? {});
   if (final.success === false) {
@@ -16259,8 +16624,8 @@ function followOrDelegate(previous) {
       command.setOptionValue("run", selection);
     const flags = command.optsWithGlobals();
     if (flags.follow !== true) {
-      if (Array.isArray(flags.selectOutput) && flags.selectOutput.length > 0) {
-        throw new SimApiError(flags.async === true ? "--select-output shapes a streamed result, and --async returns as soon as the run is queued, so there is no stream to shape. Drop one of them, or read the finished run with: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockId>[.path] — that resource matches block ids, not the block names --select-output takes here." : "--select-output shapes a streamed result; add --follow. To narrow a run that has already finished: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockId>[.path] — that resource matches block ids, not the block names --select-output takes here.", 0);
+      if (Array.isArray(flags.selectOutput) && flags.selectOutput.length > 0 && flags.async === true) {
+        throw new SimApiError("--select-output names outputs of a completed run, and --async returns as soon as the run is queued. Drop one of them, or read the finished run with: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockName|blockId>[.path] — that resource takes the same selectors --select-output takes here.", 0);
       }
       if (flags.includeThinking === true || flags.includeToolCalls === true) {
         throw new SimApiError("--include-thinking and --include-tool-calls describe a stream; add --follow", 0);
@@ -16282,7 +16647,119 @@ function attachWorkflowRunFollow(workflows) {
   }
   const held = run._actionHandler;
   const previous = typeof held === "function" ? held : null;
-  run.option("--manual", "Run the current saved workflow state instead of the active deployment").option("--trigger <blockId>", "Enter a manual run through this runnable trigger (requires --manual)").option("--mock-payload", "Use the selected trigger's server-derived mock payload (requires --manual)").option("--from-block <blockId>", "Run manually from this saved workflow block").option("--source-run <runId>", "Prior run whose persisted state supplies upstream outputs (requires --from-block)").option("--follow", "Stream the run as it happens; progress on stderr, result on stdout. The stream reports only success and output, so the result omits the run id and timings a non-streaming run returns").option("--include-thinking", "Show model reasoning while following (requires --follow)").option("--include-tool-calls", "Show tool calls while following (requires --follow)").action(followOrDelegate(previous));
+  run.option("--manual", "Run the current saved workflow state instead of the active deployment").option("--trigger <blockId>", "Enter the run through this runnable trigger; runs the current saved workflow state (implies --manual)").option("--mock-payload", "Use the selected trigger's server-derived mock payload; runs the current saved workflow state (implies --manual)").option("--from-block <blockId>", "Run manually from this saved workflow block").option("--source-run <runId>", "Prior run whose persisted state supplies upstream outputs (requires --from-block)").option("--follow", "Stream the run as it happens; progress on stderr, result on stdout. The stream reports only success and output, so the result omits the run id and timings a non-streaming run returns").option("--include-thinking", "Show model reasoning while following (requires --follow)").option("--include-tool-calls", "Show tool calls while following (requires --follow)").action(followOrDelegate(previous));
+}
+
+// src/commands/protocol/workflow-run-get.ts
+var BLOCK_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var SELECT_OUTPUT_FLAG = "select-output";
+function normalizeBlockName(name) {
+  return name.toLowerCase().replace(/\s+/g, "").replace(/\./g, "");
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function loadWorkflowBlocks(client, workflowId) {
+  const operation = V2_OPERATIONS.getWorkflowState;
+  const raw = await client.request(resolvePath(operation.path, { workflowId }), {
+    method: operation.method
+  });
+  const state = isRecord2(raw) && isRecord2(raw.data) ? raw.data : raw;
+  const blocks = isRecord2(state) && isRecord2(state.blocks) ? Object.entries(state.blocks) : [];
+  return blocks.map(([key, block]) => ({
+    id: isRecord2(block) && typeof block.id === "string" ? block.id : key,
+    name: isRecord2(block) && typeof block.name === "string" ? block.name : ""
+  }));
+}
+function splitSelector(selector) {
+  const dot = selector.indexOf(".");
+  return dot === -1 ? { head: selector, path: "" } : { head: selector.slice(0, dot), path: selector.slice(dot) };
+}
+function isIdHeaded(selector) {
+  return BLOCK_ID.test(splitSelector(selector).head);
+}
+function resolveSelection(typed, blocks, workflowId) {
+  const resolved = [];
+  const typedBy = new Map;
+  const unresolved = [];
+  for (const selector of typed) {
+    const { head, path } = splitSelector(selector);
+    let blockId = head;
+    if (!BLOCK_ID.test(head)) {
+      const wanted = normalizeBlockName(head);
+      const matches = blocks.filter((block) => block.id === head || normalizeBlockName(block.name) === wanted);
+      if (matches.length === 0) {
+        unresolved.push(selector);
+        continue;
+      }
+      if (matches.length > 1) {
+        throw new SimApiError(`--${SELECT_OUTPUT_FLAG} ${selector} names ${matches.length} blocks (${matches.map((block) => block.id).join(", ")}); pass the block id instead`, 0);
+      }
+      blockId = matches[0].id;
+    }
+    const rewritten = `${blockId}${path}`;
+    resolved.push(rewritten);
+    if (!typedBy.has(rewritten))
+      typedBy.set(rewritten, selector);
+  }
+  if (unresolved.length > 0) {
+    const names = blocks.map((block) => block.name).filter((name) => name !== "");
+    throw new SimApiError(`--${SELECT_OUTPUT_FLAG} did not resolve to any block on this run: ${unresolved.join(", ")}. Pass a block id or its name — "blockId", "blockId.path", "blockName" or "blockName.path"; names match ignoring case, spaces and dots. Blocks on workflow ${workflowId}: ${names.length > 0 ? names.join(", ") : "none"}.`, 0);
+  }
+  return { resolved, typedBy };
+}
+function keyByTyped(payload, typedBy) {
+  if (!isRecord2(payload) || !isRecord2(payload.blockOutputs))
+    return payload;
+  const blockOutputs = {};
+  for (const [key, value] of Object.entries(payload.blockOutputs)) {
+    blockOutputs[typedBy.get(key) ?? key] = value;
+  }
+  return { ...payload, blockOutputs };
+}
+async function readRunByName(runId, typed, command) {
+  const flags = command.optsWithGlobals();
+  const { client, profile } = clientFrom(command);
+  const operation = V2_OPERATIONS.getWorkflowRun;
+  const spec = CLI_CONTRACT.getWorkflowRun ?? {};
+  await buildRequest("getWorkflowRun", [runId], flags, profile.workspaceId);
+  const workflowId = String(flags.workflow);
+  const selection = resolveSelection(typed, await loadWorkflowBlocks(client, workflowId), workflowId);
+  const request = await buildRequest("getWorkflowRun", [runId], { ...flags, selectOutput: selection.resolved }, profile.workspaceId);
+  let result;
+  try {
+    result = await client.request(request.path, {
+      method: operation.method,
+      headers: request.headers,
+      query: request.query,
+      body: request.body
+    });
+  } catch (error) {
+    throw retypeApiError(error, "getWorkflowRun", spec, operation);
+  }
+  renderResult("getWorkflowRun", profile.output, keyByTyped(result?.data ?? result, selection.typedBy), spec, {}, result);
+}
+function attachWorkflowRunGet(runs) {
+  const get = runs.commands.find((command) => command.name() === "get");
+  const held = get?._actionHandler;
+  if (!get || typeof held !== "function") {
+    throw new Error("workflows runs get must be registered before block names can be attached to it");
+  }
+  const previous = held;
+  get.action(async (runId, _options, command) => {
+    const raw = command.optsWithGlobals().selectOutput;
+    if (raw === undefined) {
+      await previous(command.processedArgs);
+      return;
+    }
+    const typed = await readListValues(raw, SELECT_OUTPUT_FLAG);
+    command.setOptionValue("selectOutput", typed);
+    if (typed.every(isIdHeaded)) {
+      await previous(command.processedArgs);
+      return;
+    }
+    await readRunByName(runId, typed, command);
+  });
 }
 
 // src/commands/protocol/workflow-run-wait.ts
@@ -16299,18 +16776,21 @@ var MAX_POLL_DELAY_MS = 15000;
 var POLL_BACKOFF_FACTOR = 2;
 var DEFAULT_WAIT_TIMEOUT_SECONDS = 3600;
 var WAIT_TIMEOUT_FLAG = "--wait-timeout <seconds>";
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function optionalString(value) {
   return typeof value === "string" && value !== "" ? value : null;
 }
+function runData(raw) {
+  return isRecord3(raw) && isRecord3(raw.data) ? raw.data : raw;
+}
 function readRun(raw) {
-  const run = isRecord2(raw) && isRecord2(raw.data) ? raw.data : raw;
-  if (!isRecord2(run) || typeof run.status !== "string") {
+  const run = isRecord3(raw) && isRecord3(raw.data) ? raw.data : raw;
+  if (!isRecord3(run) || typeof run.status !== "string") {
     throw new SimApiError("Run status response carried no status.", 0);
   }
-  const paused = isRecord2(run.paused) ? run.paused : null;
+  const paused = isRecord3(run.paused) ? run.paused : null;
   return {
     status: run.status,
     pauseKind: paused ? optionalString(paused.pauseKind) : null,
@@ -16329,16 +16809,16 @@ function waitProgress() {
   let reported = false;
   return {
     advance: (status, elapsedMs) => {
-      if (!process.stderr.isTTY)
+      if (!hasProgressTerminal())
         return;
       reported = true;
-      process.stderr.write(`\r${source_default.dim(`${status} — waiting ${Math.round(elapsedMs / 1000)}s…`)}\x1B[K`);
+      writeStderr(`\r${styles3().dim(`${status} — waiting ${Math.round(elapsedMs / 1000)}s…`)}\x1B[K`);
     },
     finish: () => {
       if (!reported)
         return;
       reported = false;
-      process.stderr.write("\r\x1B[K");
+      writeStderr("\r\x1B[K");
     }
   };
 }
@@ -16379,19 +16859,19 @@ function attachWorkflowRunWait(runs) {
         const outcome = classify(snapshot);
         if (outcome) {
           progress.finish();
-          renderResult("getWorkflowRun", profile.output, raw, runSpec());
+          renderResult("getWorkflowRun", profile.output, runData(raw), runSpec());
           const message = explain(outcome, runId, options.workflow, snapshot);
           if (message)
-            console.error(source_default.red(message));
-          process.exitCode = WAIT_EXIT_CODES[outcome];
+            printError(styles3().red(message));
+          setSoftExitCode(WAIT_EXIT_CODES[outcome]);
           return;
         }
         const remainingMs = deadline - Date.now();
         if (remainingMs <= 0) {
           progress.finish();
-          renderResult("getWorkflowRun", profile.output, raw, runSpec());
-          console.error(source_default.red(`Timed out after ${timeoutSeconds}s waiting for run ${runId} (status: ${snapshot.status}${snapshot.resumeAt ? `, resuming at ${snapshot.resumeAt}` : ""}). Raise ${WAIT_TIMEOUT_FLAG}, or set it to 0 to wait indefinitely.`));
-          process.exitCode = WAIT_EXIT_CODES.timeout;
+          renderResult("getWorkflowRun", profile.output, runData(raw), runSpec());
+          printError(styles3().red(`Timed out after ${timeoutSeconds}s waiting for run ${runId} (status: ${snapshot.status}${snapshot.resumeAt ? `, resuming at ${snapshot.resumeAt}` : ""}). Raise ${WAIT_TIMEOUT_FLAG}, or set it to 0 to wait indefinitely.`));
+          setSoftExitCode(WAIT_EXIT_CODES.timeout);
           return;
         }
         progress.advance(snapshot.status, Date.now() - startedAt);
@@ -16447,7 +16927,9 @@ function attachProtocolCommands(program) {
     createFolder: "createWorkflowFolder"
   });
   attachWorkflowRunFollow(workflows);
-  attachWorkflowRunWait(group(workflows, "runs"));
+  const runs = group(workflows, "runs");
+  attachWorkflowRunGet(runs);
+  attachWorkflowRunWait(runs);
   attachLogsFollow(group(program, "logs"));
   attachChat(program);
 }
@@ -16550,12 +17032,12 @@ var SECRET_RESULT = {
     { header: "description" }
   ]
 };
-function readValueArgument(raw) {
+async function readValueArgument(raw) {
   if (raw.startsWith("@@"))
     return raw.slice(1);
   if (!raw.startsWith("@"))
     return raw;
-  return readArgumentSource(raw, "value").text;
+  return (await readArgumentSource(raw, "value")).text;
 }
 function validateSecretValue(value) {
   if (value.length === 0)
@@ -16575,7 +17057,7 @@ function validateWorkspaceOnlyFlag(flag, value, scope) {
 }
 async function readSecretValue(options) {
   if (options.value !== undefined)
-    return validateSecretValue(readValueArgument(options.value));
+    return validateSecretValue(await readValueArgument(options.value));
   if (options.description !== undefined || options.unredacted !== undefined)
     return;
   try {
@@ -16583,8 +17065,8 @@ async function readSecretValue(options) {
   } catch (error) {
     if (!(error instanceof SecretInputCancelledError))
       throw error;
-    console.error(source_default.red(`Error: ${error.message}`));
-    return process.exit(CANCELLED_EXIT_CODE);
+    printError(styles3().red(`Error: ${error.message}`));
+    return exitCli(CANCELLED_EXIT_CODE);
   }
 }
 async function setSecret(name, options, command, redactionSpellings) {
@@ -16786,7 +17268,7 @@ async function fetchDistTags(env, request) {
     if (!url)
       return null;
     const text = await request(url, {
-      headers: { accept: "application/json", "user-agent": `${PACKAGE_NAME}-cli/${CLI_VERSION}` },
+      headers: { accept: "application/json", "user-agent": `${PACKAGE_NAME}-cli/${cliVersion()}` },
       maxResponseBytes: MAX_RESPONSE_BYTES,
       timeoutMs: REGISTRY_TIMEOUT_MS
     });
@@ -16913,7 +17395,7 @@ async function announceUpdateIfAvailable(options = {}) {
       return;
     if (isUnadvisableInstall(modulePath, env, cwd))
       return;
-    const currentVersion = options.currentVersion ?? CLI_VERSION;
+    const currentVersion = options.currentVersion ?? cliVersion();
     const current = parseStableVersion(currentVersion);
     if (!current)
       return;
@@ -16997,52 +17479,55 @@ function addVersionOption(program) {
     }
     program.error("error: --version reports the Sim CLI version and takes no value. A command that acts on a deployment version reads it from --to-version.");
   });
-  program.version(CLI_VERSION, "-V, --version [none]", "output the version number (takes no value)");
+  program.version(cliVersion(), "-V, --version [none]", "output the version number (takes no value)");
 }
 function buildProgram(options = {}) {
-  const program = new Command;
+  const program = options.program ?? new Command;
   program.name("sim").description(PROGRAM_DESCRIPTION);
   if (options.version !== false)
     addVersionOption(program);
   program.option("-P, --profile <name>", "Profile to use (env: SIM_PROFILE)").option("--endpoint <url>", "Sim deployment to talk to (env: SIM_ENDPOINT)").option("-w, --workspace <id>", "Workspace to target (env: SIM_WORKSPACE)").addOption(new Option("--output <format>", "Output format for this command").choices([...OUTPUT_FORMATS]));
-  program.addCommand(loginCommand());
-  program.addCommand(logoutCommand());
-  program.addCommand(whoamiCommand());
-  program.addCommand(profilesCommand());
-  program.addCommand(configureCommand());
+  for (const command of [
+    loginCommand,
+    logoutCommand,
+    whoamiCommand,
+    profilesCommand,
+    configureCommand
+  ])
+    program.addCommand(command());
   for (const command of buildGeneratedCommands()) {
     program.addCommand(command);
   }
   attachCredentialCommands(program);
   attachProtocolCommands(program);
   attachSecretCommands(program);
-  program.addHelpText("after", HELP_EPILOGUE);
+  program.addHelpText("after", options.helpText ?? HELP_EPILOGUE);
   program.hook("preAction", () => announceUpdateIfAvailable());
   refuseHelpAfterUnknownCommand(program);
   assertNoReservedProgramFlags(program);
   return program;
 }
 
-// src/index.ts
-async function main() {
+// src/terminal.ts
+async function runTerminalCli(program = buildProgram()) {
   try {
-    await buildProgram().parseAsync(process.argv);
+    await program.parseAsync(process.argv);
   } catch (error) {
     if (error instanceof ProfileConfigError) {
-      console.error(source_default.red(`Error: ${sanitize(error.message)}`));
+      console.error(styles3().red(`Error: ${sanitize(error.message)}`));
       process.exit(1);
     }
     if (isRequestTimeout(error)) {
-      console.error(source_default.red(`Error: the request timed out. ${RAISE_TIMEOUT_HINT}`));
+      console.error(styles3().red(`Error: the request timed out. ${RAISE_TIMEOUT_HINT}`));
       process.exit(1);
     }
     if (error instanceof SimApiError) {
-      console.error(source_default.red(`Error: ${sanitize(error.message)}`));
+      console.error(styles3().red(`Error: ${sanitize(error.message)}`));
       if (error.code)
-        console.error(source_default.dim(`  code: ${sanitize(error.code)}`));
+        console.error(styles3().dim(`  code: ${sanitize(error.code)}`));
       if (error.details !== undefined) {
         for (const line of formatApiErrorDetails(error.details)) {
-          console.error(source_default.dim(sanitize(line)));
+          console.error(styles3().dim(sanitize(line)));
         }
       }
       process.exit(1);
@@ -17050,4 +17535,6 @@ async function main() {
     throw error;
   }
 }
-main();
+
+// src/index.ts
+runTerminalCli();