sim 2.1.7 → 2.1.8-dev.94.1

package/dist/index.js

@@ -19,15 +19,13 @@ var __toESM = (mod, isNodeMode, target) => {
       return cached;
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
-  const to = isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  if (mod && typeof mod === "object" || typeof mod === "function") {
-    for (let key of __getOwnPropNames(mod))
-      if (!__hasOwnProp.call(to, key))
-        __defProp(to, key, {
-          get: __accessProp.bind(mod, key),
-          enumerable: true
-        });
-  }
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -36,7 +34,7 @@ var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports,
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // ../../node_modules/commander/lib/error.js
-var require_error = __commonJS(function(exports) {
+var require_error = __commonJS((exports) => {
   class CommanderError extends Error {
     constructor(exitCode, code, message) {
       super(message);
@@ -60,7 +58,7 @@ var require_error = __commonJS(function(exports) {
 });
 
 // ../../node_modules/commander/lib/argument.js
-var require_argument = __commonJS(function(exports) {
+var require_argument = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
   class Argument {
@@ -139,7 +137,7 @@ var require_argument = __commonJS(function(exports) {
 });
 
 // ../../node_modules/commander/lib/help.js
-var require_help = __commonJS(function(exports) {
+var require_help = __commonJS((exports) => {
   var { humanReadableArgName } = require_argument();
 
   class Help {
@@ -150,7 +148,7 @@ var require_help = __commonJS(function(exports) {
       this.showGlobalOptions = false;
     }
     visibleCommands(cmd) {
-      const visibleCommands = cmd.commands.filter((cmd) => !cmd._hidden);
+      const visibleCommands = cmd.commands.filter((cmd2) => !cmd2._hidden);
       if (cmd._hasImplicitHelpCommand()) {
         const [, helpName, helpArgs] = cmd._helpCommandnameAndArgs.match(/([^ ]+) *(.*)/);
         const helpCommand = cmd.createCommand(helpName).helpOption(false);
@@ -343,8 +341,8 @@ var require_help = __commonJS(function(exports) {
           output = output.concat(["Global Options:", formatList(globalOptionList), ""]);
         }
       }
-      const commandList = helper.visibleCommands(cmd).map((cmd) => {
-        return formatItem(helper.subcommandTerm(cmd), helper.subcommandDescription(cmd));
+      const commandList = helper.visibleCommands(cmd).map((cmd2) => {
+        return formatItem(helper.subcommandTerm(cmd2), helper.subcommandDescription(cmd2));
       });
       if (commandList.length > 0) {
         output = output.concat(["Commands:", formatList(commandList), ""]);
@@ -355,16 +353,16 @@ var require_help = __commonJS(function(exports) {
     padWidth(cmd, helper) {
       return Math.max(helper.longestOptionTermLength(cmd, helper), helper.longestGlobalOptionTermLength(cmd, helper), helper.longestSubcommandTermLength(cmd, helper), helper.longestArgumentTermLength(cmd, helper));
     }
-    wrap(str, width, indent, minColumnWidth = 40) {
+    wrap(str2, width, indent, minColumnWidth = 40) {
       const indents = " \\f\\t\\v   -   　\uFEFF";
       const manualIndent = new RegExp(`[\\n][${indents}]+`);
-      if (str.match(manualIndent))
-        return str;
+      if (str2.match(manualIndent))
+        return str2;
       const columnWidth = width - indent;
       if (columnWidth < minColumnWidth)
-        return str;
-      const leadingStr = str.slice(0, indent);
-      const columnText = str.slice(indent).replace(`\r
+        return str2;
+      const leadingStr = str2.slice(0, indent);
+      const columnText = str2.slice(indent).replace(`\r
 `, `
 `);
       const indentString = " ".repeat(indent);
@@ -386,7 +384,7 @@ var require_help = __commonJS(function(exports) {
 });
 
 // ../../node_modules/commander/lib/option.js
-var require_option = __commonJS(function(exports) {
+var require_option = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
   class Option {
@@ -514,9 +512,9 @@ var require_option = __commonJS(function(exports) {
       return option.negate === (negativeValue === value);
     }
   }
-  function camelcase(str) {
-    return str.split("-").reduce((str, word) => {
-      return str + word[0].toUpperCase() + word.slice(1);
+  function camelcase(str2) {
+    return str2.split("-").reduce((str3, word) => {
+      return str3 + word[0].toUpperCase() + word.slice(1);
     });
   }
   function splitOptionFlags(flags) {
@@ -538,9 +536,9 @@ var require_option = __commonJS(function(exports) {
 });
 
 // ../../node_modules/commander/lib/suggestSimilar.js
-var require_suggestSimilar = __commonJS(function(exports) {
+var require_suggestSimilar = __commonJS((exports) => {
   var maxDistance = 3;
-  function editDistance(a, b) {
+  function editDistance2(a, b) {
     if (Math.abs(a.length - b.length) > maxDistance)
       return Math.max(a.length, b.length);
     const d = [];
@@ -581,7 +579,7 @@ var require_suggestSimilar = __commonJS(function(exports) {
     candidates.forEach((candidate) => {
       if (candidate.length <= 1)
         return;
-      const distance = editDistance(word, candidate);
+      const distance = editDistance2(word, candidate);
       const length = Math.max(word.length, candidate.length);
       const similarity = (length - distance) / length;
       if (similarity > minSimilarity) {
@@ -611,12 +609,12 @@ var require_suggestSimilar = __commonJS(function(exports) {
 });
 
 // ../../node_modules/commander/lib/command.js
-var require_command = __commonJS(function(exports) {
+var require_command = __commonJS((exports) => {
   var EventEmitter = __require("events").EventEmitter;
   var childProcess = __require("child_process");
   var path = __require("path");
   var fs = __require("fs");
-  var process2 = __require("process");
+  var process3 = __require("process");
   var { Argument, humanReadableArgName } = require_argument();
   var { CommanderError } = require_error();
   var { Help } = require_help();
@@ -658,11 +656,11 @@ var require_command = __commonJS(function(exports) {
       this._showHelpAfterError = false;
       this._showSuggestionAfterError = true;
       this._outputConfiguration = {
-        writeOut: (str) => process2.stdout.write(str),
-        writeErr: (str) => process2.stderr.write(str),
-        getOutHelpWidth: () => process2.stdout.isTTY ? process2.stdout.columns : undefined,
-        getErrHelpWidth: () => process2.stderr.isTTY ? process2.stderr.columns : undefined,
-        outputError: (str, write) => write(str)
+        writeOut: (str2) => process3.stdout.write(str2),
+        writeErr: (str2) => process3.stderr.write(str2),
+        getOutHelpWidth: () => process3.stdout.isTTY ? process3.stdout.columns : undefined,
+        getErrHelpWidth: () => process3.stderr.isTTY ? process3.stderr.columns : undefined,
+        outputError: (str2, write) => write(str2)
       };
       this._hidden = false;
       this._hasHelpOption = true;
@@ -850,7 +848,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
       if (this._exitCallback) {
         this._exitCallback(new CommanderError(exitCode, code, message));
       }
-      process2.exit(exitCode);
+      process3.exit(exitCode);
     }
     action(fn) {
       const listener = (args) => {
@@ -1012,35 +1010,35 @@ Expecting one of '${allowedValues.join("', '")}'`);
       });
       return source;
     }
-    _prepareUserArgs(argv2, parseOptions) {
-      if (argv2 !== undefined && !Array.isArray(argv2)) {
+    _prepareUserArgs(argv, parseOptions) {
+      if (argv !== undefined && !Array.isArray(argv)) {
         throw new Error("first parameter to parse must be array or undefined");
       }
       parseOptions = parseOptions || {};
-      if (argv2 === undefined) {
-        argv2 = process2.argv;
-        if (process2.versions && process2.versions.electron) {
+      if (argv === undefined) {
+        argv = process3.argv;
+        if (process3.versions && process3.versions.electron) {
           parseOptions.from = "electron";
         }
       }
-      this.rawArgs = argv2.slice();
+      this.rawArgs = argv.slice();
       let userArgs;
       switch (parseOptions.from) {
         case undefined:
         case "node":
-          this._scriptPath = argv2[1];
-          userArgs = argv2.slice(2);
+          this._scriptPath = argv[1];
+          userArgs = argv.slice(2);
           break;
         case "electron":
-          if (process2.defaultApp) {
-            this._scriptPath = argv2[1];
-            userArgs = argv2.slice(2);
+          if (process3.defaultApp) {
+            this._scriptPath = argv[1];
+            userArgs = argv.slice(2);
           } else {
-            userArgs = argv2.slice(1);
+            userArgs = argv.slice(1);
           }
           break;
         case "user":
-          userArgs = argv2.slice(0);
+          userArgs = argv.slice(0);
           break;
         default:
           throw new Error(`unexpected parse option { from: '${parseOptions.from}' }`);
@@ -1100,23 +1098,23 @@ Expecting one of '${allowedValues.join("', '")}'`);
       }
       launchWithNode = sourceExt.includes(path.extname(executableFile));
       let proc;
-      if (process2.platform !== "win32") {
+      if (process3.platform !== "win32") {
         if (launchWithNode) {
           args.unshift(executableFile);
-          args = incrementNodeInspectorPort(process2.execArgv).concat(args);
-          proc = childProcess.spawn(process2.argv[0], args, { stdio: "inherit" });
+          args = incrementNodeInspectorPort(process3.execArgv).concat(args);
+          proc = childProcess.spawn(process3.argv[0], args, { stdio: "inherit" });
         } else {
           proc = childProcess.spawn(executableFile, args, { stdio: "inherit" });
         }
       } else {
         args.unshift(executableFile);
-        args = incrementNodeInspectorPort(process2.execArgv).concat(args);
-        proc = childProcess.spawn(process2.execPath, args, { stdio: "inherit" });
+        args = incrementNodeInspectorPort(process3.execArgv).concat(args);
+        proc = childProcess.spawn(process3.execPath, args, { stdio: "inherit" });
       }
       if (!proc.killed) {
         const signals = ["SIGUSR1", "SIGUSR2", "SIGTERM", "SIGINT", "SIGHUP"];
         signals.forEach((signal) => {
-          process2.on(signal, () => {
+          process3.on(signal, () => {
             if (proc.killed === false && proc.exitCode === null) {
               proc.kill(signal);
             }
@@ -1125,10 +1123,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
       }
       const exitCallback = this._exitCallback;
       if (!exitCallback) {
-        proc.on("close", process2.exit.bind(process2));
+        proc.on("close", process3.exit.bind(process3));
       } else {
         proc.on("close", () => {
-          exitCallback(new CommanderError(process2.exitCode || 0, "commander.executeSubCommandAsync", "(close)"));
+          exitCallback(new CommanderError(process3.exitCode || 0, "commander.executeSubCommandAsync", "(close)"));
         });
       }
       proc.on("error", (err) => {
@@ -1143,7 +1141,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           throw new Error(`'${executableFile}' not executable`);
         }
         if (!exitCallback) {
-          process2.exit(1);
+          process3.exit(1);
         } else {
           const wrappedError = new CommanderError(1, "commander.executeSubCommandAsync", "(error)");
           wrappedError.nestedError = err;
@@ -1493,11 +1491,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
     }
     _parseOptionsEnv() {
       this.options.forEach((option) => {
-        if (option.envVar && option.envVar in process2.env) {
+        if (option.envVar && option.envVar in process3.env) {
           const optionKey = option.attributeName();
           if (this.getOptionValue(optionKey) === undefined || ["default", "config", "env"].includes(this.getOptionValueSource(optionKey))) {
             if (option.required || option.optional) {
-              this.emit(`optionEnv:${option.name()}`, process2.env[option.envVar]);
+              this.emit(`optionEnv:${option.name()}`, process3.env[option.envVar]);
             } else {
               this.emit(`optionEnv:${option.name()}`);
             }
@@ -1529,18 +1527,18 @@ Expecting one of '${allowedValues.join("', '")}'`);
       this.error(message, { code: "commander.missingMandatoryOptionValue" });
     }
     _conflictingOption(option, conflictingOption) {
-      const findBestOptionFromValue = (option) => {
-        const optionKey = option.attributeName();
+      const findBestOptionFromValue = (option2) => {
+        const optionKey = option2.attributeName();
         const optionValue = this.getOptionValue(optionKey);
         const negativeOption = this.options.find((target) => target.negate && optionKey === target.attributeName());
         const positiveOption = this.options.find((target) => !target.negate && optionKey === target.attributeName());
         if (negativeOption && (negativeOption.presetArg === undefined && optionValue === false || negativeOption.presetArg !== undefined && optionValue === negativeOption.presetArg)) {
           return negativeOption;
         }
-        return positiveOption || option;
+        return positiveOption || option2;
       };
-      const getErrorMessage = (option) => {
-        const bestOption = findBestOptionFromValue(option);
+      const getErrorMessage = (option2) => {
+        const bestOption = findBestOptionFromValue(option2);
         const optionKey = bestOption.attributeName();
         const source = this.getOptionValueSource(optionKey);
         if (source === "env") {
@@ -1592,35 +1590,35 @@ Expecting one of '${allowedValues.join("', '")}'`);
       const message = `error: unknown command '${unknownName}'${suggestion}`;
       this.error(message, { code: "commander.unknownCommand" });
     }
-    version(str, flags, description) {
-      if (str === undefined)
+    version(str2, flags, description) {
+      if (str2 === undefined)
         return this._version;
-      this._version = str;
+      this._version = str2;
       flags = flags || "-V, --version";
       description = description || "output the version number";
       const versionOption = this.createOption(flags, description);
       this._versionOptionName = versionOption.attributeName();
       this.options.push(versionOption);
       this.on("option:" + versionOption.name(), () => {
-        this._outputConfiguration.writeOut(`${str}
+        this._outputConfiguration.writeOut(`${str2}
 `);
-        this._exit(0, "commander.version", str);
+        this._exit(0, "commander.version", str2);
       });
       return this;
     }
-    description(str, argsDescription) {
-      if (str === undefined && argsDescription === undefined)
+    description(str2, argsDescription) {
+      if (str2 === undefined && argsDescription === undefined)
         return this._description;
-      this._description = str;
+      this._description = str2;
       if (argsDescription) {
         this._argsDescription = argsDescription;
       }
       return this;
     }
-    summary(str) {
-      if (str === undefined)
+    summary(str2) {
+      if (str2 === undefined)
         return this._summary;
-      this._summary = str;
+      this._summary = str2;
       return this;
     }
     alias(alias) {
@@ -1641,8 +1639,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
       aliases.forEach((alias) => this.alias(alias));
       return this;
     }
-    usage(str) {
-      if (str === undefined) {
+    usage(str2) {
+      if (str2 === undefined) {
         if (this._usage)
           return this._usage;
         const args = this.registeredArguments.map((arg) => {
@@ -1650,23 +1648,23 @@ Expecting one of '${allowedValues.join("', '")}'`);
         });
         return [].concat(this.options.length || this._hasHelpOption ? "[options]" : [], this.commands.length ? "[command]" : [], this.registeredArguments.length ? args : []).join(" ");
       }
-      this._usage = str;
+      this._usage = str2;
       return this;
     }
-    name(str) {
-      if (str === undefined)
+    name(str2) {
+      if (str2 === undefined)
         return this._name;
-      this._name = str;
+      this._name = str2;
       return this;
     }
     nameFromFilename(filename) {
       this._name = path.basename(filename, path.extname(filename));
       return this;
     }
-    executableDir(path) {
-      if (path === undefined)
+    executableDir(path2) {
+      if (path2 === undefined)
         return this._executableDir;
-      this._executableDir = path;
+      this._executableDir = path2;
       return this;
     }
     helpInformation(contextOptions) {
@@ -1726,13 +1724,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
     }
     help(contextOptions) {
       this.outputHelp(contextOptions);
-      let exitCode2 = process2.exitCode || 0;
-      if (exitCode2 === 0 && contextOptions && typeof contextOptions !== "function" && contextOptions.error) {
-        exitCode2 = 1;
+      let exitCode = process3.exitCode || 0;
+      if (exitCode === 0 && contextOptions && typeof contextOptions !== "function" && contextOptions.error) {
+        exitCode = 1;
       }
-      this._exit(exitCode2, "commander.help", "(outputHelp)");
+      this._exit(exitCode, "commander.help", "(outputHelp)");
     }
-    addHelpText(position, text) {
+    addHelpText(position, text2) {
       const allowedValues = ["beforeAll", "before", "after", "afterAll"];
       if (!allowedValues.includes(position)) {
         throw new Error(`Unexpected value for position to addHelpText.
@@ -1741,10 +1739,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
       const helpEvent = `${position}Help`;
       this.on(helpEvent, (context) => {
         let helpStr;
-        if (typeof text === "function") {
-          helpStr = text({ error: context.error, command: context.command });
+        if (typeof text2 === "function") {
+          helpStr = text2({ error: context.error, command: context.command });
         } else {
-          helpStr = text;
+          helpStr = text2;
         }
         if (helpStr) {
           context.write(`${helpStr}
@@ -1794,7 +1792,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
 });
 
 // ../../node_modules/commander/index.js
-var require_commander = __commonJS(function(exports, module) {
+var require_commander = __commonJS((exports, module) => {
   var { Argument } = require_argument();
   var { Command } = require_command();
   var { CommanderError, InvalidArgumentError } = require_error();
@@ -2172,6 +2170,12 @@ var applyOptions = (object, options = {}) => {
   const colorLevel = stdoutColor ? stdoutColor.level : 0;
   object.level = options.level === undefined ? colorLevel : options.level;
 };
+
+class Chalk {
+  constructor(options) {
+    return chalkFactory(options);
+  }
+}
 var chalkFactory = (options) => {
   const chalk = (...strings) => strings.join(" ");
   applyOptions(chalk, options);
@@ -2300,6 +2304,41 @@ var chalk = createChalk();
 var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
 
+// src/embed-context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+function setSoftExitCode(code) {
+  const ctx = embedStore.getStore();
+  if (ctx)
+    ctx.softExitCode = code;
+  else
+    process.exitCode = code;
+}
+var embedStore = new AsyncLocalStorage;
+function embeddedProfile() {
+  const ctx = embedStore.getStore();
+  if (!ctx)
+    return null;
+  return {
+    name: "embedded",
+    endpoint: ctx.identity.endpoint,
+    apiKey: ctx.identity.apiKey,
+    workspaceId: ctx.identity.workspaceId ?? null,
+    output: "json",
+    ...ctx.identity.transport ? { transport: ctx.identity.transport } : {},
+    ...ctx.identity.signal ? { signal: ctx.identity.signal } : {},
+    sources: { endpoint: "flag", apiKey: "flag", workspaceId: "flag", output: "flag" }
+  };
+}
+
+// src/output/presentation.ts
+var plain = new Chalk({ level: 0 });
+function styles3() {
+  return embedStore.getStore() ? plain : source_default;
+}
+function hasProgressTerminal() {
+  return !embedStore.getStore() && Boolean(process.stderr.isTTY);
+}
+
 // src/config/paths.ts
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -2312,9 +2351,6 @@ function configPath() {
 function credentialsPath() {
   return process.env.SIM_CREDENTIALS_FILE || join(configDir(), "credentials");
 }
-function updateCachePath() {
-  return join(configDir(), "update-check.json");
-}
 // src/config/profile.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
@@ -2634,6 +2670,9 @@ function refuseBlankOverrides(overrides) {
   }
 }
 function resolveProfile(overrides = {}) {
+  const embedded = embeddedProfile();
+  if (embedded)
+    return embedded;
   refuseBlankOverrides(overrides);
   const named = overrides.profile || process.env.SIM_PROFILE;
   const name = named || DEFAULT_PROFILE;
@@ -2686,14 +2725,22 @@ function resolveProfile(overrides = {}) {
 // src/version.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 function readPackageVersion() {
-  const metadata = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
-  if (typeof metadata !== "object" || metadata === null || !("version" in metadata) || typeof metadata.version !== "string") {
-    throw new Error("CLI package metadata is missing a valid version");
-  }
-  return metadata.version;
+  try {
+    const metadata = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof metadata === "object" && metadata !== null && "version" in metadata && typeof metadata.version === "string") {
+      return metadata.version;
+    }
+  } catch {}
+  return "0.0.0-embedded";
+}
+var cachedVersion = null;
+function cliVersion() {
+  cachedVersion ??= readPackageVersion();
+  return cachedVersion;
+}
+function userAgent() {
+  return `sim-cli/${cliVersion()} node/${process.versions.node} (${process.platform}; ${process.arch})`;
 }
-var CLI_VERSION = readPackageVersion();
-var USER_AGENT = `sim-cli/${CLI_VERSION} node/${process.versions.node} (${process.platform}; ${process.arch})`;
 
 // src/http/environment.ts
 var reported = new Set;
@@ -2716,11 +2763,11 @@ function runtimeCanProxy(version) {
     return minor >= firstSupportedMinor;
   return major > FIRST_SUPPORTED_MAJOR;
 }
-function warnIfProxyIgnored(env = process.env, version = process.version) {
-  const variable = PROXY_VARIABLES.find((name) => env[name]);
+function warnIfProxyIgnored(env2 = process.env, version = process.version) {
+  const variable = PROXY_VARIABLES.find((name) => env2[name]);
   if (!variable)
     return;
-  if (env.NODE_USE_ENV_PROXY && runtimeCanProxy(version))
+  if (env2.NODE_USE_ENV_PROXY && runtimeCanProxy(version))
     return;
   once("proxy", runtimeCanProxy(version) ? `${variable} is set but Node only uses it when NODE_USE_ENV_PROXY=1. Re-run with NODE_USE_ENV_PROXY=1 to route through the proxy.` : `${variable} is set but Node ${version} cannot use it. Upgrade to Node 22.21 or 24.5 and set NODE_USE_ENV_PROXY=1 to route through the proxy.`);
 }
@@ -2832,8 +2879,8 @@ var RAISE_TIMEOUT_HINT = "Raise SIM_TIMEOUT_SECONDS, or set it to 0 to wait inde
 function isRequestTimeout(error) {
   return error instanceof DOMException && error.name === "TimeoutError";
 }
-function resolveTimeoutMs(env = process.env) {
-  const raw = env.SIM_TIMEOUT_SECONDS;
+function resolveTimeoutMs(env2 = process.env) {
+  const raw = env2.SIM_TIMEOUT_SECONDS;
   if (raw === undefined || raw.trim() === "")
     return DEFAULT_TIMEOUT_SECONDS * 1000;
   const seconds = Number(raw);
@@ -2863,12 +2910,12 @@ function combineSignals(caller, timeout) {
   }
   return controller.signal;
 }
-function debugEnabled(env = process.env) {
-  const raw = env.SIM_DEBUG;
+function debugEnabled(env2 = process.env) {
+  const raw = env2.SIM_DEBUG;
   return raw !== undefined && raw !== "" && raw !== "0" && raw.toLowerCase() !== "false";
 }
 function traceRequest(method, url, status, startedAt) {
-  process.stderr.write(`${source_default.dim(`[sim] ${method} ${url} → ${status} ${Math.round(performance.now() - startedAt)}ms`)}
+  process.stderr.write(`${styles3().dim(`[sim] ${method} ${url} → ${status} ${Math.round(performance.now() - startedAt)}ms`)}
 `);
 }
 function withoutLeadingLabel(message, label) {
@@ -2966,17 +3013,20 @@ class SimClient {
     warnIfKeyOverCleartext(this.profile.endpoint, Boolean(apiKey));
     const timeoutMs = resolveTimeoutMs();
     const timeout = timeoutMs > 0 ? AbortSignal.timeout(timeoutMs) : undefined;
-    const signal = combineSignals(options.signal, timeout);
+    const caller = combineSignals(options.signal, this.profile.signal);
+    if (caller?.aborted)
+      throw new SimApiError("Request cancelled.", 0);
+    const signal = combineSignals(caller, timeout);
     const trace = debugEnabled();
     const startedAt = performance.now();
     let response;
     try {
-      response = await fetch(url, {
+      response = await (this.profile.transport ?? fetch)(url, {
         method,
         headers: {
           ...apiKey ? { "x-api-key": apiKey } : {},
           accept: "application/json",
-          "user-agent": USER_AGENT,
+          "user-agent": userAgent(),
           ...hasBody ? { "content-type": "application/json" } : {},
           ...options.headers
         },
@@ -2987,7 +3037,7 @@ class SimClient {
     } catch (cause) {
       if (trace)
         traceRequest(method, url, "failed", startedAt);
-      if (options.signal?.aborted) {
+      if (caller?.aborted) {
         throw new SimApiError("Request cancelled.", 0);
       }
       if (timeout?.aborted) {
@@ -3038,16 +3088,16 @@ function redirectEndpoint(endpoint, requestPath, target) {
   return suggested === endpoint.replace(/\/+$/, "") ? null : suggested;
 }
 function pageProgress() {
-  let reported = false;
+  let reported2 = false;
   return {
     advance: (fetched) => {
-      if (!process.stderr.isTTY)
+      if (!hasProgressTerminal())
         return;
-      reported = true;
-      process.stderr.write(`\r${source_default.dim(`fetched ${fetched}…`)}\x1B[K`);
+      reported2 = true;
+      process.stderr.write(`\r${styles3().dim(`fetched ${fetched}…`)}\x1B[K`);
     },
     finish: () => {
-      if (reported)
+      if (reported2)
         process.stderr.write("\r\x1B[K");
     }
   };
@@ -5721,14 +5771,14 @@ function requireDumper() {
     let hasFoldableLine = false;
     const shouldTrackWidth = lineWidth !== -1;
     let previousLineBreak = -1;
-    let plain = isPlainSafeFirst(codePointAt(string, 0)) && isPlainSafeLast(codePointAt(string, string.length - 1));
+    let plain2 = isPlainSafeFirst(codePointAt(string, 0)) && isPlainSafeLast(codePointAt(string, string.length - 1));
     if (singleLineOnly || forceQuotes) {
       for (i = 0;i < string.length; char >= 65536 ? i += 2 : i++) {
         char = codePointAt(string, i);
         if (!isPrintable(char)) {
           return STYLE_DOUBLE;
         }
-        plain = plain && isPlainSafe(char, prevChar, inblock);
+        plain2 = plain2 && isPlainSafe(char, prevChar, inblock);
         prevChar = char;
       }
     } else {
@@ -5743,13 +5793,13 @@ function requireDumper() {
         } else if (!isPrintable(char)) {
           return STYLE_DOUBLE;
         }
-        plain = plain && isPlainSafe(char, prevChar, inblock);
+        plain2 = plain2 && isPlainSafe(char, prevChar, inblock);
         prevChar = char;
       }
       hasFoldableLine = hasFoldableLine || shouldTrackWidth && (i - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ");
     }
     if (!hasLineBreak && !hasFoldableLine) {
-      if (plain && !forceQuotes && !testAmbiguousType(string)) {
+      if (plain2 && !forceQuotes && !testAmbiguousType(string)) {
         return STYLE_PLAIN;
       }
       return quotingType === QUOTING_TYPE_DOUBLE ? STYLE_DOUBLE : STYLE_SINGLE;
@@ -6251,7 +6301,6 @@ function isWideCodePoint(codePoint) {
 
 // src/output/render.ts
 var EMPTY_GLYPH = "—";
-var EMPTY = source_default.dim(EMPTY_GLYPH);
 var ESC = String.fromCharCode(27);
 var CONTROL_PATTERN = new RegExp([
   `${ESC}\\][^\\u0007${ESC}]*(?:\\u0007|${ESC}\\\\)?`,
@@ -6270,12 +6319,12 @@ function safeOneLine(value) {
 }
 function text(value) {
   if (value === null || value === undefined || value === "")
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   return sanitize(String(value));
 }
 function timestamp2(value) {
   if (!value)
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   const date = new Date(value);
   if (Number.isNaN(date.getTime()))
     return sanitize(String(value));
@@ -6283,12 +6332,12 @@ function timestamp2(value) {
 }
 function bool2(value) {
   if (value === null || value === undefined)
-    return EMPTY;
-  return value ? source_default.green("yes") : source_default.dim("no");
+    return styles3().dim(EMPTY_GLYPH);
+  return value ? styles3().green("yes") : styles3().dim("no");
 }
 function bytes(value) {
   if (value === null || value === undefined)
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   const units = ["B", "KB", "MB", "GB", "TB"];
   let size = value;
   let unit = 0;
@@ -6300,7 +6349,7 @@ function bytes(value) {
 }
 function duration(ms) {
   if (ms === null || ms === undefined)
-    return EMPTY;
+    return styles3().dim(EMPTY_GLYPH);
   if (ms < 1000)
     return `${Math.round(ms)}ms`;
   if (ms < 60000)
@@ -6312,8 +6361,8 @@ function visibleWidth(value) {
   return displayWidth(value);
 }
 function stripAnsi(value) {
-  const plain = value.replace(ANSI_PATTERN, "");
-  return plain === EMPTY_GLYPH ? "" : plain;
+  const plain2 = value.replace(ANSI_PATTERN, "");
+  return plain2 === EMPTY_GLYPH ? "" : plain2;
 }
 function pad(value, width) {
   return value + " ".repeat(Math.max(0, width - visibleWidth(value)));
@@ -6331,11 +6380,11 @@ function clamp(value, width) {
 }
 function renderTable(rows, columns) {
   if (rows.length === 0)
-    return source_default.dim("No results.");
+    return styles3().dim("No results.");
   const headers = columns.map((column) => sanitize(column.header));
   const cells = rows.map((row) => columns.map((column) => clamp(oneLine(column.value(row)), MAX_CELL_WIDTH)));
   const widths = columns.map((_column, index) => Math.max(visibleWidth(headers[index]), ...cells.map((line) => visibleWidth(line[index]))));
-  const header = headers.map((label, index) => source_default.dim(pad(label.toUpperCase(), widths[index]))).join("  ").trimEnd();
+  const header = headers.map((label, index) => styles3().dim(pad(label.toUpperCase(), widths[index]))).join("  ").trimEnd();
   const body = cells.map((line) => line.map((cell, index) => pad(cell, widths[index])).join("  ").trimEnd());
   return [header, ...body].join(`
 `);
@@ -6379,7 +6428,7 @@ function printRecord(format, fields, raw) {
   }
   const width = Math.max(...safeFields.map(([label]) => visibleWidth(label)));
   for (const [label, value] of safeFields) {
-    console.log(`${source_default.dim(pad(`${label}:`, width + 1))}  ${clamp(oneLine(value), MAX_RECORD_WIDTH)}`);
+    console.log(`${styles3().dim(pad(`${label}:`, width + 1))}  ${clamp(oneLine(value), MAX_RECORD_WIDTH)}`);
   }
 }
 
@@ -6408,7 +6457,7 @@ import { createHash, randomBytes, randomInt } from "node:crypto";
 
 // src/helpers.ts
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 
 // src/auth/device-flow.ts
@@ -6475,7 +6524,7 @@ async function pollForKey(endpoint, auth, signal) {
         headers: {
           "content-type": "application/json",
           accept: "application/json",
-          "user-agent": USER_AGENT
+          "user-agent": userAgent()
         },
         body: JSON.stringify({ request: auth.request, verifier: auth.pollSecret }),
         signal,
@@ -6636,8 +6685,8 @@ var V2_OPERATIONS = {
       },
       outputColumns: {
         kind: "array",
-        required: true,
-        describe: "Columns created for producer outputs."
+        default: [],
+        describe: "Columns to create for producer outputs. An entry naming a column the table already has attaches that column to the group instead of creating it (its `type` must match), and an output whose column already exists may omit its entry entirely — so `[]` attaches existing columns only."
       },
       autoRun: {
         kind: "boolean",
@@ -6723,7 +6772,7 @@ var V2_OPERATIONS = {
     summary: "Delete Files",
     body: {
       workspaceId: { kind: "string", required: true, describe: "Workspace containing the files." },
-      fileIds: { kind: "array", required: true, describe: "File identifiers to update." }
+      fileIds: { kind: "array", required: true, describe: "File identifiers to delete." }
     }
   },
   bulkDeleteTables: {
@@ -6941,7 +6990,7 @@ var V2_OPERATIONS = {
       rowId: { kind: "string", describe: "Row whose runs should be canceled for row scope." },
       filter: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       excludeRowIds: { kind: "array", describe: "Rows excluded from an all-scope cancellation." }
     }
@@ -6972,6 +7021,11 @@ var V2_OPERATIONS = {
       conversationId: {
         kind: "string",
         describe: "Conversation to continue; a new one starts when omitted."
+      },
+      effort: {
+        kind: "enum",
+        values: ["low", "medium", "high", "xhigh", "max"],
+        describe: "Model effort for this turn; defaults to the deployment default (high)."
       }
     }
   },
@@ -7051,6 +7105,13 @@ var V2_OPERATIONS = {
     responseMode: "json",
     summary: "Create Credential Connection",
     personalKeyOnly: true,
+    body: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that will own the credential."
+      }
+    },
     opaqueBody: true
   },
   createCustomTool: {
@@ -7463,47 +7524,6 @@ var V2_OPERATIONS = {
       }
     }
   },
-  createSandbox: {
-    method: "POST",
-    path: "/api/v2/sandboxes",
-    pathParams: [],
-    responseMode: "json",
-    summary: "Create Sandbox",
-    personalKeyOnly: true,
-    body: {
-      workspaceId: {
-        kind: "string",
-        required: true,
-        describe: "Workspace in which to create the sandbox."
-      },
-      name: {
-        kind: "string",
-        required: true,
-        describe: "Display name, unique within the workspace; 1 to 64 characters."
-      },
-      language: {
-        kind: "enum",
-        required: true,
-        values: ["javascript", "python"],
-        describe: "Dependency ecosystem: `javascript` installs from npm, `python` from PyPI."
-      },
-      dependencies: {
-        kind: "array",
-        default: [],
-        describe: "Package specifiers installed into the sandbox, one per entry."
-      },
-      cliTools: {
-        kind: "array",
-        default: [],
-        describe: "Pinned managed CLI ids installed into the sandbox, at most 10, no duplicates."
-      },
-      systemPackages: {
-        kind: "array",
-        default: [],
-        describe: "Debian packages installed into the sandbox, one per entry."
-      }
-    }
-  },
   createServiceAccountCredential: {
     method: "POST",
     path: "/api/v2/credentials",
@@ -7534,7 +7554,7 @@ var V2_OPERATIONS = {
       description: { kind: "string", describe: "Optional credential description." },
       id: {
         kind: "string",
-        describe: "Required only when provider discovery requests a client-generated ID."
+        describe: "Optional client-generated credential ID. The server mints one when it is omitted, so no provider requires it. A `slack-custom-bot` credential may supply one so its Slack Request URL, which embeds the ID, can be configured before the credential exists; every other provider ignores it."
       },
       credentials: {
         kind: "string",
@@ -7610,7 +7630,7 @@ var V2_OPERATIONS = {
       rowIds: { kind: "array", describe: "Explicit row subset to run." },
       filter: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       excludeRowIds: { kind: "array", describe: "Rows excluded from a select-all run scope." },
       limit: { kind: "object", describe: "Optional cap on eligible rows to run." }
@@ -8021,18 +8041,6 @@ var V2_OPERATIONS = {
       }
     }
   },
-  deleteSandbox: {
-    method: "DELETE",
-    path: "/api/v2/sandboxes/[sandboxId]",
-    pathParams: ["sandboxId"],
-    pathParamDocs: { sandboxId: "Unique sandbox identifier." },
-    responseMode: "json",
-    summary: "Delete Sandbox",
-    personalKeyOnly: true,
-    query: {
-      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the sandbox." }
-    }
-  },
   deleteSecret: {
     method: "DELETE",
     path: "/api/v2/secrets/[name]",
@@ -8144,7 +8152,7 @@ var V2_OPERATIONS = {
       workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
       filter: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       limit: { kind: "integer", describe: "Maximum matching rows to delete." },
       rowIds: { kind: "array", describe: "Explicit row identifiers to delete." }
@@ -8314,53 +8322,6 @@ var V2_OPERATIONS = {
       }
     }
   },
-  editFileContent: {
-    method: "PATCH",
-    path: "/api/v2/files/[fileId]/content",
-    pathParams: ["fileId"],
-    pathParamDocs: { fileId: "File identifier." },
-    responseMode: "json",
-    summary: "Edit File Content",
-    body: {
-      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the file." },
-      edit: {
-        kind: "unknown",
-        required: true,
-        describe: "One exact or anchor-based edit: search_replace, replace_between, insert_after, or delete_between."
-      }
-    }
-  },
-  executeTool: {
-    method: "POST",
-    path: "/api/v2/tools/[toolId]/execute",
-    pathParams: ["toolId"],
-    pathParamDocs: {
-      toolId: "Tool identifier. An unversioned name resolves to the newest version, and the response echoes the resolved id."
-    },
-    responseMode: "json",
-    summary: "Run Tool",
-    personalKeyOnly: true,
-    body: {
-      workspaceId: {
-        kind: "string",
-        required: true,
-        describe: "Workspace whose integration allowlist, credentials, and environment variables govern this call."
-      },
-      input: {
-        kind: "object",
-        default: {},
-        describe: "Arguments for the tool, keyed by the parameter ids the tool catalog publishes for it. A parameter whose visibility is `user-only` also accepts an environment-variable reference written as the whole value, `{{VAR_NAME}}`, resolved server-side against the workspace environment; any other value is sent verbatim."
-      },
-      credentialId: {
-        kind: "string",
-        describe: "Credential to authenticate with. Required when the tool declares an OAuth requirement; the workspace credentials list names the candidates."
-      },
-      timeoutSeconds: {
-        kind: "integer",
-        describe: "How long to wait for the tool before abandoning the call."
-      }
-    }
-  },
   executeWorkflow: {
     method: "POST",
     path: "/api/v2/workflows/[workflowId]/execute",
@@ -8393,7 +8354,7 @@ var V2_OPERATIONS = {
       },
       selectedOutputs: {
         kind: "array",
-        describe: "Block output references to include in a streamed response. Use `<blockName>.<outputPath>` for the executed workflow or `<childWorkflowId>.<blockName>.<outputPath>` for a child workflow; block names are normalized workflow reference names. Selecting a child workflow applies to every invocation of it. Requires `stream: true` — it shapes the streamed envelope only, so it is rejected on a sync request and when `async` is true. To narrow a finished run, pass `selectedOutputs` to the run resource instead."
+        describe: "Block output references to include in the response. Use `<blockName>.<outputPath>` for the executed workflow or `<childWorkflowId>.<blockName>.<outputPath>` for a child workflow; block names are normalized workflow reference names, and selecting a child workflow applies to every invocation of it. On a sync request the named outputs come back in `blockOutputs`, keyed by these selector strings exactly as sent; on a stream they shape the streamed envelope. A selector whose block name or id matches no block in the workflow is rejected with `400` naming the available blocks, before the run starts. A selector whose block did not run or whose path is absent is omitted. Rejected when `async` is true — a queued run has produced nothing to select; narrow the finished run via the run resource instead."
       },
       includeThinking: {
         kind: "boolean",
@@ -8431,7 +8392,13 @@ var V2_OPERATIONS = {
     pathParams: ["workflowId"],
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
-    summary: "Export Workflow"
+    summary: "Export Workflow",
+    query: {
+      includeWorkspaceBindings: {
+        kind: "boolean",
+        describe: "Whether to keep workspace-scoped bindings — table, knowledge base, document, folder, channel, and other resource selectors — in the exported state. Defaults to false, the sharing-safe export in which those ids are cleared because they resolve nowhere else. Send true for a same-workspace round trip so the re-imported workflow can run without re-selecting them. Credentials, passwords, and table sub-block values are cleared either way."
+      }
+    }
   },
   getAuditLog: {
     method: "GET",
@@ -8652,6 +8619,10 @@ var V2_OPERATIONS = {
         values: ["info", "error"],
         describe: "Severity level to include."
       },
+      includeHandledErrors: {
+        kind: "boolean",
+        describe: "Whether runs with a handled block error are counted as `handledErrorRuns`, and whether `level=error` also selects them. Off by default: counting them scans each run’s stored trace."
+      },
       startDate: {
         kind: "string",
         describe: "Only include runs started at or after this UTC ISO 8601 timestamp, e.g. `2026-08-06T00:00:00Z`. A date without a time, or a timestamp carrying a UTC offset instead of `Z`, is rejected, as is year `0000`, which names no storable instant."
@@ -8663,7 +8634,26 @@ var V2_OPERATIONS = {
       segmentCount: {
         kind: "integer",
         default: 72,
-        describe: "Number of equal time buckets to divide the window into, from 1 to 500. Exactly this many buckets are always returned. Buckets are never narrower than one minute, so on a short window the series extends past the end of the window rather than being compressed, and the trailing buckets are empty."
+        describe: "Number of equal time buckets to divide the window into, from 1 to 500. It is the ceiling on how many buckets a series carries: with `includeEmpty=true` exactly this many are returned, otherwise only the buckets holding at least one run. Buckets are never narrower than one minute, so on a short window the series extends past the end of the window rather than being compressed, and the trailing buckets are empty."
+      },
+      includeEmpty: {
+        kind: "enum",
+        values: [
+          "true",
+          "1",
+          "yes",
+          "on",
+          "y",
+          "enabled",
+          "false",
+          "0",
+          "no",
+          "off",
+          "n",
+          "disabled"
+        ],
+        default: false,
+        describe: "Whether buckets with no runs are included in every series. Off by default, so each series carries only the buckets that hold at least one run; set it to publish exactly `segmentCount` buckets per series, empty ones included. The listed spellings are the whole accepted vocabulary and are case-sensitive; any other value is rejected."
       }
     }
   },
@@ -8721,22 +8711,11 @@ var V2_OPERATIONS = {
       groupId: "Workflow or enrichment group to run."
     },
     responseMode: "json",
-    summary: "Get Enrichment Run Detail",
+    summary: "Get Row Group Run",
     query: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." }
     }
   },
-  getSandbox: {
-    method: "GET",
-    path: "/api/v2/sandboxes/[sandboxId]",
-    pathParams: ["sandboxId"],
-    pathParamDocs: { sandboxId: "Unique sandbox identifier." },
-    responseMode: "json",
-    summary: "Get Sandbox",
-    query: {
-      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the sandbox." }
-    }
-  },
   getSkill: {
     method: "GET",
     path: "/api/v2/skills/[skillId]",
@@ -9056,8 +9035,7 @@ var V2_OPERATIONS = {
           "knowledge-base",
           "voice-input",
           "enrichment",
-          "voice-output",
-          "api-tool"
+          "voice-output"
         ],
         describe: "Restrict results to one usage source."
       },
@@ -9121,6 +9099,10 @@ var V2_OPERATIONS = {
         values: ["builtin", "custom"],
         describe: "Restrict to shipped blocks or to this workspace’s deployed custom blocks."
       },
+      includeSunset: {
+        kind: "boolean",
+        describe: "Include `legacy` and `deprecated` blocks. Off by default: a sunset block keeps executing where it is already placed, but it is not offered for new authoring. Each returned entry carries `sunset.replacedBy`, the block to build with instead."
+      },
       sortBy: {
         kind: "enum",
         values: ["id", "name", "category"],
@@ -9196,6 +9178,21 @@ var V2_OPERATIONS = {
       search: {
         kind: "string",
         describe: "Case-insensitive substring match against the connector name."
+      },
+      detail: {
+        kind: "enum",
+        values: ["summary", "full"],
+        default: "summary",
+        describe: "Projection of each item. `summary` (the default) carries the identifier, name, description, and auth mode; `full` adds the version, the complete auth settings, the `sourceConfig` field schema, incremental-sync support, and tag definitions."
+      },
+      limit: {
+        kind: "integer",
+        default: 25,
+        describe: "Maximum connector types to return per page. Must be a whole number from 1 to 100. Defaults to 25."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
       }
     }
   },
@@ -9341,28 +9338,6 @@ var V2_OPERATIONS = {
         values: ["active", "archived"],
         default: "active",
         describe: "Which lifecycle set to list: `active` (default) returns live folders only; `archived` returns folders a recursive delete soft-deleted, which is how a caller finds a path to hand to the folder restore. Authorization is identical for both."
-      },
-      recursive: {
-        kind: "enum",
-        values: [
-          "true",
-          "1",
-          "yes",
-          "on",
-          "y",
-          "enabled",
-          "false",
-          "0",
-          "no",
-          "off",
-          "n",
-          "disabled"
-        ],
-        describe: "Whether parentPath includes every descendant instead of direct children only."
-      },
-      depth: {
-        kind: "integer",
-        describe: "Deepest level below parentPath to include when recursive is true."
       }
     }
   },
@@ -9797,6 +9772,10 @@ var V2_OPERATIONS = {
         kind: "string",
         describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
       },
+      includeHandledErrors: {
+        kind: "boolean",
+        describe: "Whether `level=error` also selects runs that finished at `info` after a block error was recovered by an error path. Off by default: such a run succeeded, so it is an error only to a caller auditing error handling. Every row reports `hasHandledErrors` whether or not this is set. Job runs carry no block trace, so the flag never widens that branch."
+      },
       status: {
         kind: "string",
         describe: "Comma-separated execution statuses to include, from `pending` | `running` | `paused` | `redacting` | `completed` | `failed` | `cancelled`. An empty entry is rejected. ANDed with `level`, which reports severity rather than lifecycle."
@@ -9887,41 +9866,6 @@ var V2_OPERATIONS = {
       }
     }
   },
-  listSandboxes: {
-    method: "GET",
-    path: "/api/v2/sandboxes",
-    pathParams: [],
-    responseMode: "json",
-    summary: "List Sandboxes",
-    query: {
-      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the sandbox." },
-      search: {
-        kind: "string",
-        describe: "Case-insensitive substring match against the sandbox name."
-      },
-      sortBy: {
-        kind: "enum",
-        values: ["name", "createdAt", "updatedAt"],
-        default: "name",
-        describe: "Field used to sort the result. Sorting by `name` is case-sensitive and follows the storage collation, so do not rely on a case-insensitive order."
-      },
-      sortOrder: {
-        kind: "enum",
-        values: ["asc", "desc"],
-        default: "asc",
-        describe: "Sort direction."
-      },
-      limit: {
-        kind: "integer",
-        default: 50,
-        describe: "Maximum sandboxes to return per page. Must be a whole number from 1 to 100. Defaults to 50."
-      },
-      cursor: {
-        kind: "string",
-        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
-      }
-    }
-  },
   listSecrets: {
     method: "GET",
     path: "/api/v2/secrets",
@@ -10042,7 +9986,7 @@ var V2_OPERATIONS = {
     pathParams: ["tableId"],
     pathParamDocs: { tableId: "Unique table identifier." },
     responseMode: "json",
-    summary: "List Active Run Dispatches",
+    summary: "List Run Dispatches",
     query: {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." }
     }
@@ -10454,8 +10398,8 @@ var V2_OPERATIONS = {
       },
       limit: {
         kind: "integer",
-        default: 50,
-        describe: "Maximum workspaces to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+        default: 25,
+        describe: "Maximum workspaces to return per page. Must be a whole number from 1 to 100. Defaults to 25."
       },
       cursor: {
         kind: "string",
@@ -10567,7 +10511,9 @@ var V2_OPERATIONS = {
     method: "GET",
     path: "/api/v2/files/[fileId]/text",
     pathParams: ["fileId"],
-    pathParamDocs: { fileId: "File identifier." },
+    pathParamDocs: {
+      fileId: "File identifier, or the file’s VFS path: `files/<folder>/<name>`, or `uploads/<name>` for a Chat upload."
+    },
     responseMode: "json",
     summary: "Read File Text",
     query: {
@@ -10575,14 +10521,6 @@ var V2_OPERATIONS = {
       maxBytes: {
         kind: "integer",
         describe: "Optional ceiling on the source bytes fed to the parser, lowering but never raising the server limit."
-      },
-      offset: {
-        kind: "integer",
-        describe: "First line to return, 1-based. Absent starts at the first line."
-      },
-      limit: {
-        kind: "integer",
-        describe: "How many lines to return from `offset`. Absent reads to the end."
       }
     }
   },
@@ -10598,7 +10536,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -10614,7 +10552,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -10630,7 +10568,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -10646,7 +10584,7 @@ var V2_OPERATIONS = {
       destinationPath: {
         kind: "string",
         required: true,
-        describe: "New full path for the folder and its descendants."
+        describe: "Where the folder lands, with `mv` semantics. A path naming an existing folder receives the source as a child under its current name; `/` moves it to the workspace root under its current name; any other path becomes the folder’s new full path (a rename, a relocation, or both)."
       }
     }
   },
@@ -10913,50 +10851,6 @@ var V2_OPERATIONS = {
       workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." }
     }
   },
-  searchFileContent: {
-    method: "GET",
-    path: "/api/v2/files/search",
-    pathParams: [],
-    responseMode: "json",
-    summary: "Search File Content",
-    query: {
-      workspaceId: { kind: "string", required: true, describe: "Workspace to search." },
-      query: {
-        kind: "string",
-        required: true,
-        describe: "Regular expression, or exact text when `mode` is `exact`."
-      },
-      mode: {
-        kind: "enum",
-        values: ["exact", "regex"],
-        default: "regex",
-        describe: "How `query` is read."
-      },
-      maxResults: { kind: "integer", default: 50, describe: "Maximum matching lines to return." },
-      folderPaths: {
-        kind: "string",
-        describe: "Folders the search is confined to, comma-separated. Absent searches the whole workspace. The scope also narrows `indexStatus`, so `complete` describes the folders searched rather than the workspace."
-      },
-      includeSubfolders: {
-        kind: "enum",
-        values: [
-          "true",
-          "1",
-          "yes",
-          "on",
-          "y",
-          "enabled",
-          "false",
-          "0",
-          "no",
-          "off",
-          "n",
-          "disabled"
-        ],
-        describe: "Whether the scope descends into nested folders. Absent means yes. The listed spellings are the whole accepted vocabulary and are case-sensitive; any other value is rejected."
-      }
-    }
-  },
   searchKnowledge: {
     method: "POST",
     path: "/api/v2/knowledge/search",
@@ -10989,6 +10883,7 @@ var V2_OPERATIONS = {
       },
       searchMode: {
         kind: "enum",
+        default: "vector",
         describe: "Retrieval strategy: vector is semantic-only, while hybrid also runs full-text search."
       },
       rerankerEnabled: {
@@ -11019,7 +10914,7 @@ var V2_OPERATIONS = {
       q: { kind: "string", required: true, describe: "Case-insensitive cell substring to find." },
       predicate: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       sort: { kind: "array", describe: "Ordered table-row sort specification." }
     }
@@ -11461,7 +11356,7 @@ var V2_OPERATIONS = {
       filter: {
         kind: "unknown",
         required: true,
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       data: {
         kind: "object",
@@ -11471,39 +11366,6 @@ var V2_OPERATIONS = {
       limit: { kind: "integer", describe: "Maximum matching rows to update." }
     }
   },
-  updateSandbox: {
-    method: "PATCH",
-    path: "/api/v2/sandboxes/[sandboxId]",
-    pathParams: ["sandboxId"],
-    pathParamDocs: { sandboxId: "Unique sandbox identifier." },
-    responseMode: "json",
-    summary: "Update Sandbox",
-    personalKeyOnly: true,
-    body: {
-      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the sandbox." },
-      name: {
-        kind: "string",
-        describe: "New display name, unique within the workspace; 1 to 64 characters."
-      },
-      language: {
-        kind: "enum",
-        values: ["javascript", "python"],
-        describe: "Replacement dependency ecosystem. The whole spec is revalidated against it, so a Python dependency list does not survive a switch to JavaScript."
-      },
-      dependencies: {
-        kind: "array",
-        describe: "Replacement package list; replaces the whole list."
-      },
-      cliTools: {
-        kind: "array",
-        describe: "Replacement managed CLI list; replaces the whole list."
-      },
-      systemPackages: {
-        kind: "array",
-        describe: "Replacement Debian package list; replaces the whole list."
-      }
-    }
-  },
   updateSkill: {
     method: "PATCH",
     path: "/api/v2/skills/[skillId]",
@@ -11871,10 +11733,10 @@ function addProfileCommand() {
       auth_profile: authProfile,
       workspace: normalizeWorkspaceId(workspace.id, "the workspace response")
     });
-    console.log(source_default.green(`✓ Added profile "${safeOneLine(profileName)}" in ${configPath()}`));
+    console.log(styles3().green(`✓ Added profile "${safeOneLine(profileName)}" in ${configPath()}`));
     console.log(`  Workspace: ${safeOneLine(workspace.name)} (${workspace.id})`);
     console.log(`  Authentication: ${safeOneLine(authProfile)}`);
-    console.log(source_default.dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`));
+    console.log(styles3().dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`));
   });
 }
 function loginCommand() {
@@ -11891,21 +11753,21 @@ function loginCommand() {
     if (readCredentialsProfile(profile.name).api_key && !options.yes) {
       const confirmed = await confirmProfileOverwrite(profile.name);
       if (!confirmed) {
-        console.log(source_default.dim("Login cancelled; the existing profile was not changed."));
+        console.log(styles3().dim("Login cancelled; the existing profile was not changed."));
         return;
       }
     }
     const auth = createAuthRequest();
     const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
-    console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(safeOneLine(profile.name))}`);
+    console.log(`Signing in to ${styles3().bold(profile.endpoint)} as profile ${styles3().bold(safeOneLine(profile.name))}`);
     console.log(`
-Pairing code: ${source_default.bold(auth.pairing)}`);
-    console.log(source_default.dim(`Confirm this code matches what the browser shows before approving.
+Pairing code: ${styles3().bold(auth.pairing)}`);
+    console.log(styles3().dim(`Confirm this code matches what the browser shows before approving.
 `));
     console.log(url);
     if (options.browser)
       openBrowser(url);
-    console.log(source_default.dim(`
+    console.log(styles3().dim(`
 Waiting for approval…`));
     const key = await pollForKey(profile.endpoint, auth);
     if (key.scope !== scope) {
@@ -11918,14 +11780,14 @@ Waiting for approval…`));
     requireStorableKey(key.apiKey);
     writeConfigProfile(profile.name, settings);
     writeCredentialsProfile(profile.name, key.apiKey);
-    console.log(source_default.green(`
+    console.log(styles3().green(`
 ✓ Logged in. Key stored in ${credentialsPath()}`));
     if (key.workspaceBound && key.workspaceId) {
-      console.log(source_default.dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
+      console.log(styles3().dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
     } else if (key.workspaceId) {
-      console.log(source_default.dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
+      console.log(styles3().dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
     } else {
-      console.log(source_default.dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
+      console.log(styles3().dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
     }
   });
 }
@@ -11939,10 +11801,10 @@ function logoutCommand() {
       }
       const removed = deleteProfile(profileName);
       if (!removed.config && !removed.credentials) {
-        console.log(source_default.dim(`Nothing stored for profile "${safeOneLine(profileName)}".`));
+        console.log(styles3().dim(`Nothing stored for profile "${safeOneLine(profileName)}".`));
         return;
       }
-      console.log(source_default.green(`✓ Removed profile "${safeOneLine(profileName)}".`));
+      console.log(styles3().green(`✓ Removed profile "${safeOneLine(profileName)}".`));
       return;
     }
     const profile = profileFrom(command);
@@ -11951,12 +11813,12 @@ function logoutCommand() {
       throw new SimApiError(`Profile "${redact(profile.name)}" shares authentication with "${redact(authProfile)}". Log out of the authentication profile instead: sim logout --profile ${redact(authProfile)}`, 0);
     }
     if (!readCredentialsProfile(profile.name).api_key) {
-      console.log(source_default.dim(`No stored key for profile "${safeOneLine(profile.name)}".`));
+      console.log(styles3().dim(`No stored key for profile "${safeOneLine(profile.name)}".`));
       return;
     }
     writeCredentialsProfile(profile.name, null);
-    console.log(source_default.green(`✓ Removed the stored key for profile "${safeOneLine(profile.name)}".`));
-    console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
+    console.log(styles3().green(`✓ Removed the stored key for profile "${safeOneLine(profile.name)}".`));
+    console.log(styles3().dim("  The key itself is still active — revoke it in Settings → Sim API keys."));
   });
 }
 async function readKeyType(client) {
@@ -12017,18 +11879,18 @@ function presentVerification(verification) {
   if (verification.status === "verified") {
     const { name, memberCount } = verification.workspace;
     const members = `${memberCount} ${memberCount === 1 ? "member" : "members"}`;
-    return `${source_default.green("✓")} ${safeOneLine(name)} · ${members}`;
+    return `${styles3().green("✓")} ${safeOneLine(name)} · ${members}`;
   }
   const detail = safeOneLine(verification.detail);
   switch (verification.status) {
     case "rejected":
-      return `${source_default.red("✗")} ${detail}`;
+      return `${styles3().red("✗")} ${detail}`;
     case "unauthenticated":
-      return source_default.yellow(`not logged in — ${detail}`);
+      return styles3().yellow(`not logged in — ${detail}`);
     case "disabled":
-      return source_default.dim(detail);
+      return styles3().dim(detail);
     default:
-      return source_default.yellow(`could not check — ${detail}`);
+      return styles3().yellow(`could not check — ${detail}`);
   }
 }
 function whoamiCommand() {
@@ -12042,17 +11904,17 @@ function whoamiCommand() {
       keyType: null,
       detail: "not checked (--no-verify)"
     };
-    const annotate = (value, source) => source === "unset" ? source_default.dim("not set") : `${value} ${source_default.dim(`(${source})`)}`;
+    const annotate = (value, source) => source === "unset" ? styles3().dim("not set") : `${value} ${styles3().dim(`(${source})`)}`;
     printRecord(profile.output, [
       ["Profile", profile.name],
       ["Endpoint", annotate(profile.endpoint, sources.endpoint)],
       [
         "API key",
-        authentication.authenticated ? annotate("configured", authentication.source) : source_default.yellow("not logged in")
+        authentication.authenticated ? annotate("configured", authentication.source) : styles3().yellow("not logged in")
       ],
       [
         "Key type",
-        verification.keyType ?? source_default.dim(options.verify ? "unknown" : "not checked (--no-verify)")
+        verification.keyType ?? styles3().dim(options.verify ? "unknown" : "not checked (--no-verify)")
       ],
       ["Workspace", annotate(profile.workspaceId ?? "", sources.workspaceId)],
       ["Output", annotate(profile.output, sources.output)],
@@ -12078,15 +11940,18 @@ function whoamiCommand() {
     });
     const exitCode = WHOAMI_EXIT_CODES[verification.status];
     if (exitCode !== 0)
-      process.exitCode = exitCode;
+      setSoftExitCode(exitCode);
   });
 }
 var PROFILE_COLUMNS = [
-  { header: "", value: (row) => row.active ? source_default.green("*") : " " },
+  { header: "", value: (row) => row.active ? styles3().green("*") : " " },
   { header: "profile", value: (row) => safeOneLine(row.name) },
   { header: "key", value: (row) => row.error ? text(null) : row.hasKey ? "yes" : "no" },
   { header: "auth", value: (row) => row.authProfile ? safeOneLine(row.authProfile) : text(null) },
-  { header: "error", value: (row) => row.error ? source_default.red(safeOneLine(row.error)) : text(null) }
+  {
+    header: "error",
+    value: (row) => row.error ? styles3().red(safeOneLine(row.error)) : text(null)
+  }
 ];
 function buildProfileRow(name, active) {
   try {
@@ -12133,7 +11998,7 @@ function profilesCommand() {
     const rows = listProfiles().map((name) => buildProfileRow(name, name === activeName));
     if (rows.length === 0) {
       if (output === "table")
-        console.log(source_default.dim("No profiles yet. Run: sim login"));
+        console.log(styles3().dim("No profiles yet. Run: sim login"));
       else
         printList(output, rows, PROFILE_COLUMNS);
       return;
@@ -12213,21 +12078,21 @@ function configureCommand() {
     if (Object.keys(updates).length === 0) {
       const current = readConfigProfile(profile.name);
       if (Object.keys(current).length === 0) {
-        console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+        console.log(styles3().dim(`No settings stored for profile "${profile.name}".`));
         return;
       }
       for (const [key, value] of Object.entries(current)) {
-        console.log(`${source_default.dim(`${key}:`)} ${value}`);
+        console.log(`${styles3().dim(`${key}:`)} ${value}`);
       }
       return;
     }
     const removalOnly = Object.values(updates).every((value) => value === null);
     if (removalOnly && Object.keys(readConfigProfile(profile.name)).length === 0) {
-      console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+      console.log(styles3().dim(`No settings stored for profile "${profile.name}".`));
       return;
     }
     writeConfigProfile(profile.name, updates);
-    console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
+    console.log(styles3().green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
   });
 }
 
@@ -12239,7 +12104,6 @@ var TABLE_SORT_HELP = 'Ordered sort keys: [{"field":"createdAt","direction":"des
 var KNOWLEDGE_TAG_DEFINITIONS_HELP = 'Tag definitions: [{"tagSlot":"tag1","displayName":"category","fieldType":"text"}]';
 var CUSTOM_TOOL_SCHEMA_HELP = 'OpenAI function schema: {"type":"function","function":{"name":"...","parameters":{"type":"object","properties":{}}}}';
 var DISPATCH_ROW_LIMIT_HELP = "Stop after this many eligible rows have run (1-1,000,000). Omit for an unbounded run";
-var FILE_EDIT_HELP = 'One edit object: {"mode":"search_replace","search":"old","content":"new","replaceAll":false}, {"mode":"replace_between","beforeAnchor":"start line","afterAnchor":"end line","content":"new"}, {"mode":"insert_after","anchor":"line","content":"new"}, or {"mode":"delete_between","startAnchor":"first line deleted","endAnchor":"ending line kept"}. Anchored modes also accept occurrence starting at 1';
 var WORKFLOW_OPERATIONS_HELP = 'Edits to apply, in a single batch, keyed by operation_type: [{"operation_type":"add","block_id":"my-fn","params":{"type":"function","name":"My Fn","inputs":{"code":"return {ok:true}"}}},{"operation_type":"edit","block_id":"<uuid>","params":{"name":"Renamed","connections":{"success":"my-fn"}}},{"operation_type":"delete","block_id":"<uuid>"}]. Also extract_from_subflow, whose params carry {"subflowId":"<loop-id>"}, and insert_into_subflow, which creates a block and so takes an add’s params plus that subflowId';
 var WORKFLOW_SET_BLOCK_ENABLED_HELP = 'Blocks to enable or disable, applied after --operations: [{"block_id":"<uuid>","enabled":false}]. Disabling a loop or parallel cascades to its unlocked descendants; enabling a block whose container is disabled is declined';
 var WORKFLOW_VARIABLE_OPERATIONS_HELP = 'Variable changes to apply in order, keyed by operation: [{"operation":"add","name":"my_var","type":"string","value":"hello"},{"operation":"edit","name":"my_var","value":"updated"},{"operation":"delete","name":"my_var"}]';
@@ -12437,9 +12301,6 @@ var CLI_CONTRACT = {
     confirm: "This revokes the explicit skill editor grant for the selected email."
   },
   deleteCustomTool: { confirm: "This deletes the custom tool." },
-  deleteSandbox: {
-    confirm: "This deletes the sandbox; Function blocks that select it fail until re-pointed."
-  },
   deleteMcpServer: {
     confirm: "This removes the MCP server and the tools it provides."
   },
@@ -12451,7 +12312,7 @@ var CLI_CONTRACT = {
   },
   deleteTableView: { confirm: "This deletes the saved view and its filters." },
   deleteWorkflowGroup: {
-    confirm: "This deletes the group, every column it fed, and the values in them.",
+    confirm: "This deletes the group AND its output columns with all of their row data; the workflow it pointed at is untouched.",
     fields: [
       { header: "id" },
       { header: "deleted", format: "bool" },
@@ -12571,7 +12432,7 @@ var CLI_CONTRACT = {
   },
   applyWorkflowOperations: {
     command: "workflows operations apply",
-    confirm: "This edits the draft graph, and a delete operation removes blocks and their edges.",
+    confirm: "This edits the draft graph: the batch adds, edits, or deletes blocks and their edges as written.",
     flags: {
       operations: { json: true, describe: WORKFLOW_OPERATIONS_HELP },
       setBlockEnabled: { json: true, describe: WORKFLOW_SET_BLOCK_ENABLED_HELP }
@@ -12623,26 +12484,7 @@ var CLI_CONTRACT = {
     flags: { folderPaths: FOLDER_PATHS_FLAG },
     confirm: "This deletes every listed table and all of their rows."
   },
-  searchFileContent: {
-    flags: {
-      folderPaths: {
-        ...FOLDER_PATHS_FLAG,
-        describe: "Folders to search, by path as shown in the app; omit to search the whole workspace"
-      },
-      includeSubfolders: {
-        boolean: true,
-        negatable: true,
-        describe: "Whether each folder scope includes nested folders; on by default"
-      }
-    },
-    itemsPath: "results",
-    columns: [
-      { header: "file", path: "fileId" },
-      { header: "line", path: "lineNumber" },
-      { header: "text" }
-    ]
-  },
-  searchKnowledge: {
+  searchKnowledge: {
     flags: {
       knowledgeBaseIds: { name: "kb", list: true, describe: "Knowledge base ID (repeatable)" },
       query: { describe: "Text to search for" },
@@ -12726,20 +12568,6 @@ var CLI_CONTRACT = {
   importWorkflow: { flags: { folderPath: FOLDER_PATH_FLAG } },
   createCustomTool: { flags: { schema: { json: true, describe: CUSTOM_TOOL_SCHEMA_HELP } } },
   updateCustomTool: { flags: { schema: { json: true, describe: CUSTOM_TOOL_SCHEMA_HELP } } },
-  createSandbox: {
-    flags: {
-      dependencies: { list: true, manifest: true },
-      cliTools: { list: true },
-      systemPackages: { list: true, manifest: true }
-    }
-  },
-  updateSandbox: {
-    flags: {
-      dependencies: { list: true, manifest: true },
-      cliTools: { list: true },
-      systemPackages: { list: true, manifest: true }
-    }
-  },
   listTables: {
     flags: { folderPath: FOLDER_PATH_FLAG },
     columns: [
@@ -12881,15 +12709,6 @@ var CLI_CONTRACT = {
       { header: "updated", path: "updatedAt", format: "timestamp" }
     ]
   },
-  listSandboxes: {
-    columns: [
-      { header: "id" },
-      { header: "name" },
-      { header: "language" },
-      { header: "status", path: "buildStatus" },
-      { header: "updated", path: "updatedAt", format: "timestamp" }
-    ]
-  },
   listCredentials: {
     columns: [
       { header: "id" },
@@ -13084,13 +12903,6 @@ var CLI_CONTRACT = {
       folderPaths: FOLDER_PATHS_FLAG
     }
   },
-  editFileContent: {
-    command: "files edit",
-    describe: "Apply one exact or anchor-based edit to a text file",
-    flags: {
-      edit: { describe: FILE_EDIT_HELP }
-    }
-  },
   updateFileContent: {
     command: "files set-content",
     describe: "Replace a file’s contents",
@@ -13329,24 +13141,6 @@ var CLI_CONTRACT = {
     describe: "Print a workflow as a portable JSON document",
     document: true
   },
-  executeTool: {
-    command: "tools execute",
-    describe: "Run one built-in tool and print what it produced",
-    flags: {
-      input: {
-        json: true,
-        describe: "Tool arguments as JSON, keyed by the parameter ids `sim tools get <toolId>` lists"
-      },
-      credentialId: { describe: "Credential to authenticate with, required for OAuth tools" },
-      timeoutSeconds: { name: "timeout", describe: "Seconds to wait before abandoning the call" }
-    },
-    fields: [
-      { path: "toolId", header: "Tool" },
-      { path: "status", header: "Status" },
-      { path: "output", header: "Output" },
-      { path: "error.message", header: "Error" }
-    ]
-  },
   executeWorkflow: {
     command: "workflows run",
     describe: "Run a deployed workflow or execute saved state manually",
@@ -13360,7 +13154,7 @@ var CLI_CONTRACT = {
       selectedOutputs: {
         name: "select-output",
         list: true,
-        describe: "Return streamed outputs as blockName.path or childWorkflowId.blockName.path; selecting a child workflow applies to every invocation, requires --follow"
+        describe: "Return blockName.path values (e.g. agent_1.content), or childWorkflowId.blockName.path for a child workflow (applies to every invocation) — in blockOutputs on a sync run, or from the streamed result with --follow; missing paths are omitted. Not available with --async"
       },
       stream: { omit: true },
       includeThinking: { omit: true },
@@ -13384,7 +13178,7 @@ var CLI_CONTRACT = {
       selectedOutputs: {
         name: "select-output",
         list: true,
-        describe: "Include blockId or blockId.path values in JSON or YAML output; block names are not resolved on a finished run"
+        describe: "Include blockName.path or blockId.path values (e.g. agent_1.content) in JSON or YAML output; names resolve against the workflow’s current blocks, and missing paths are omitted"
       }
     },
     fields: [
@@ -13492,6 +13286,87 @@ function camel(flag) {
 
 // src/runtime/request.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3, readSync } from "node:fs";
+
+// src/transfer/local-file.ts
+import { constants } from "node:fs";
+import { access, stat } from "node:fs/promises";
+import { basename } from "node:path";
+function embeddedFileKey(path) {
+  return path.startsWith("@") ? path.slice(1) : path;
+}
+async function embeddedFileContent(embedded, path) {
+  const key = embeddedFileKey(path);
+  embedded.identity.signal?.throwIfAborted();
+  if (!embedded.readFile)
+    throw new SimApiError("This invocation has no machine to read from", 0);
+  const content = await embedded.readFile(key);
+  embedded.identity.signal?.throwIfAborted();
+  return typeof content === "string" ? content : new Uint8Array(content);
+}
+var CONTENT_TYPES = {
+  css: "text/css",
+  csv: "text/csv",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  gif: "image/gif",
+  html: "text/html",
+  htm: "text/html",
+  jpeg: "image/jpeg",
+  jpg: "image/jpeg",
+  js: "text/javascript",
+  json: "application/json",
+  jsonl: "application/jsonl",
+  md: "text/markdown",
+  pdf: "application/pdf",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  png: "image/png",
+  svg: "image/svg+xml",
+  txt: "text/plain",
+  webp: "image/webp",
+  yaml: "application/yaml",
+  yml: "application/yaml",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  zip: "application/zip"
+};
+function contentTypeFor(name) {
+  const dot = name.lastIndexOf(".");
+  const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
+  return CONTENT_TYPES[extension] ?? "application/octet-stream";
+}
+async function localFile(path, override) {
+  const embedded = embedStore.getStore();
+  if (embedded) {
+    embedded.identity.signal?.throwIfAborted();
+    if (!embedded.openFile)
+      throw new SimApiError("This invocation has no machine to read from", 0);
+    const { size: size2 } = await embedded.openFile(embeddedFileKey(path));
+    embedded.identity.signal?.throwIfAborted();
+    if (!Number.isSafeInteger(size2) || size2 < 0)
+      throw new SimApiError("Invalid file size", 0);
+    if (size2 === 0)
+      throw new SimApiError(`${path} is empty`, 0);
+    return { name: override ?? basename(embeddedFileKey(path)), size: size2 };
+  }
+  let size;
+  try {
+    const stats = await stat(path);
+    if (!stats.isFile())
+      throw new SimApiError(`${path} is not a regular file`, 0);
+    await access(path, constants.R_OK);
+    size = stats.size;
+  } catch (error) {
+    if (error instanceof SimApiError)
+      throw error;
+    throw new SimApiError(`Cannot read ${path}: ${error.message}`, 0);
+  }
+  if (size === 0)
+    throw new SimApiError(`${path} is empty`, 0);
+  return { name: override ?? basename(path), size };
+}
+
+// src/runtime/request.ts
 var PROFILE_INJECTED_FIELD = "workspaceId";
 function isProfileWorkspacePath(commandSpec, param) {
   return commandSpec.profileWorkspacePath === true && param === PROFILE_INJECTED_FIELD;
@@ -13573,11 +13448,21 @@ function readStdin() {
 function literalAtHint(error, path) {
   return error?.code === "ENOENT" ? `. To pass the literal value @${path}, write @@${path}` : "";
 }
-function readArgumentSource(raw, flagName) {
+async function readArgumentSource(raw, flagName) {
   if (raw.startsWith("@@"))
     return { text: raw.slice(1), from: "" };
   if (!raw.startsWith("@"))
     return { text: raw, from: "" };
+  const embedded = embedStore.getStore();
+  if (embedded) {
+    if (raw === "@-")
+      throw new SimApiError(`--${flagName}: this invocation has no stdin; use @path or an inline value`, 0);
+    const content = await embeddedFileContent(embedded, raw);
+    return {
+      text: typeof content === "string" ? content : new TextDecoder("utf-8", { fatal: true }).decode(content),
+      from: " (read from your machine)"
+    };
+  }
   const path = raw.slice(1);
   if (path === "-") {
     if (process.stdin.isTTY) {
@@ -13595,34 +13480,32 @@ function readArgumentSource(raw, flagName) {
     throw new SimApiError(`--${flagName} cannot read ${path}: ${error.message}${literalAtHint(error, path)}`, 0);
   }
 }
-function isManifestNoise(line) {
-  const trimmed = line.trim();
-  return trimmed === "" || trimmed.startsWith("#");
-}
-function readListValues(raw, flagName, manifest = false) {
+async function readListValues(raw, flagName) {
   const arguments_ = Array.isArray(raw) ? raw : [raw];
-  const values = arguments_.flatMap((argument) => {
+  const values = [];
+  for (const argument of arguments_) {
     if (typeof argument !== "string") {
       throw new SimApiError(`--${flagName} values must be strings`, 0);
     }
-    if (!argument.startsWith("@"))
-      return [argument];
-    const source = readArgumentSource(argument, flagName);
+    if (!argument.startsWith("@")) {
+      values.push(argument);
+      continue;
+    }
+    const source = await readArgumentSource(argument, flagName);
     const lines = source.text.split(/\r?\n/);
     if (lines.at(-1) === "")
       lines.pop();
-    const kept = manifest ? lines.filter((line) => !isManifestNoise(line)) : lines;
-    if (kept.length === 0) {
+    if (lines.length === 0) {
       throw new SimApiError(`--${flagName}${source.from} contains no values`, 0);
     }
-    return kept.map((line, index) => {
+    values.push(...lines.map((line, index) => {
       const value = line.trim();
       if (!value) {
         throw new SimApiError(`--${flagName}${source.from} has an empty value on line ${index + 1}`, 0);
       }
       return value;
-    });
-  });
+    }));
+  }
   return values.map((value) => {
     const trimmed = value.trim();
     if (!trimmed)
@@ -13654,13 +13537,13 @@ var FRACTIONAL_DIGITS = /\.\d*[1-9]/;
 function pathHint(raw) {
   if (raw.startsWith("@") || /^\s*[[{"\-\d]|^\s*(true|false|null)/.test(raw))
     return "";
-  return existsSync2(raw) ? `. ${raw} is a file — pass it as @${raw}` : ". To read a file, pass @path (or @- for stdin)";
+  return !embedStore.getStore() && existsSync2(raw) ? `. ${raw} is a file — pass it as @${raw}` : ". To read a file, pass @path (or @- for stdin)";
 }
-function coerce(raw, field, flag, flagName) {
+async function coerce(raw, field, flag, flagName) {
   if (raw === undefined)
     return;
   if (flag.list) {
-    const values = readListValues(raw, flagName, flag.manifest === true).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
+    const values = (await readListValues(raw, flagName)).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
     return field.kind === "string" ? values.join(",") : values;
   }
   if (flag.rowCap)
@@ -13668,7 +13551,7 @@ function coerce(raw, field, flag, flagName) {
   if (takesJson(field, flag)) {
     if (typeof raw !== "string")
       return raw;
-    const source = readArgumentSource(raw, flagName);
+    const source = await readArgumentSource(raw, flagName);
     try {
       return JSON.parse(source.text);
     } catch (error) {
@@ -13705,7 +13588,7 @@ function asQueryValue(value) {
     return JSON.stringify(value);
   return value;
 }
-function buildRequest(operation, positional, flags, workspaceId) {
+async function buildRequest(operation, positional, flags, workspaceId) {
   const commandSpec = CLI_CONTRACT[operation] ?? {};
   const spec = V2_OPERATIONS[operation];
   let path = spec.path;
@@ -13743,7 +13626,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
       if ((slot === "query" || NUMERIC_KINDS.has(descriptor.kind)) && typeof raw === "string" && raw.trim() === "" && !(field === "limit" && paginatedLimit)) {
         throw new SimApiError(`--${flagName} cannot be empty`, 0);
       }
-      const value = coerce(raw ?? undefined, descriptor, flag, flagName);
+      const value = await coerce(raw ?? undefined, descriptor, flag, flagName);
       if (field === "limit" && !paginatedLimit && NUMERIC_KINDS.has(descriptor.kind) && typeof value === "number" && value < 1) {
         throw new SimApiError(`--${flagName} must be 1 or more`, 0);
       }
@@ -13764,25 +13647,25 @@ function buildRequest(operation, positional, flags, workspaceId) {
   const headerSlot = Object.keys(headers).length > 0 ? { headers } : {};
   if (spec.opaqueBody) {
     if (commandSpec.bodyVariants) {
-      const provided = commandSpec.bodyVariants.filter((variant) => flags[camel(variant.name)] !== undefined);
-      const names = commandSpec.bodyVariants.map((variant) => `--${variant.name}`).join(" or ");
+      const provided = commandSpec.bodyVariants.filter((variant2) => flags[camel(variant2.name)] !== undefined);
+      const names = commandSpec.bodyVariants.map((variant2) => `--${variant2.name}`).join(" or ");
       if (provided.length !== 1) {
         throw new SimApiError(`Pass exactly one of ${names}`, 0);
       }
       const variant = provided[0];
-      const raw = flags[camel(variant.name)];
-      if (typeof raw !== "string")
+      const raw2 = flags[camel(variant.name)];
+      if (typeof raw2 !== "string")
         throw new SimApiError(`--${variant.name} is required`, 0);
-      const parsed = coerce(raw, { kind: variant.kind }, { json: true }, variant.name);
-      if (variant.kind === "object" && (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) || variant.kind === "array" && !Array.isArray(parsed)) {
+      const parsed2 = await coerce(raw2, { kind: variant.kind }, { json: true }, variant.name);
+      if (variant.kind === "object" && (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2)) || variant.kind === "array" && !Array.isArray(parsed2)) {
         throw new SimApiError(`--${variant.name} must be a JSON ${variant.kind}`, 0);
       }
-      return { path, query, body: { ...body, [variant.property]: parsed }, ...headerSlot };
+      return { path, query, body: { ...body, [variant.property]: parsed2 }, ...headerSlot };
     }
     const raw = flags.body;
     if (typeof raw !== "string")
       throw new SimApiError("--body is required", 0);
-    const parsed = coerce(raw, { kind: "object" }, { json: true }, "body");
+    const parsed = await coerce(raw, { kind: "object" }, { json: true }, "body");
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       throw new SimApiError("--body must be a JSON object", 0);
     }
@@ -13809,7 +13692,7 @@ function withoutWireVocabulary(documented) {
   return documented.replace(WIRE_VOCABULARY_SENTENCE, " ").trim();
 }
 var NON_PAGINATED_LIMIT_HINT = " (caps a --filter match only; omit it to act on every match, and note 0 is not accepted)";
-function addFieldOption(command, operation, field, descriptor, slot, paginates, capsAFilter) {
+function addFieldOption(command, operation, field, descriptor, slot, paginates) {
   if (field === PROFILE_INJECTED_FIELD || field === "cursor")
     return;
   const flag = flagSpecFor(operation, field);
@@ -13821,7 +13704,7 @@ function addFieldOption(command, operation, field, descriptor, slot, paginates,
     command.option("--limit <n>", "Maximum items to return (0 for everything)", String(DEFAULT_LIMIT));
     return;
   }
-  const documented = `${describeField(flag, descriptor, name, field)}${capsAFilter && field === "limit" && (descriptor.kind === "number" || descriptor.kind === "integer") ? NON_PAGINATED_LIMIT_HINT : ""}`;
+  const documented = `${describeField(flag, descriptor, name, field)}${field === "limit" && (descriptor.kind === "number" || descriptor.kind === "integer") ? NON_PAGINATED_LIMIT_HINT : ""}`;
   if (descriptor.kind === "boolean" || flag.boolean) {
     const booleanDoc = withoutWireVocabulary(documented);
     if (descriptor.required) {
@@ -13839,7 +13722,7 @@ function addFieldOption(command, operation, field, descriptor, slot, paginates,
   const placeholder = takesList ? "<value...>" : flag.rowCap ? "<n>" : wantsJson ? "<json|@file>" : "<value>";
   const choices = flag.choices ?? descriptor.values;
   const literalNull = slot === "body" && !takesList && !wantsJson;
-  const describe = `${documented}${takesList ? flag.manifest ? " (space-separated, or @path / @- with one value per line; in a file, blank lines and # comments are ignored, while inline values are sent as typed and may not be empty; @@value for a literal leading @)" : " (space-separated, or @path / @- with one value per line; @@value for a literal leading @)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}${literalNull ? literalNullHint(documented, name) : ""}`;
+  const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line; @@value for a literal leading @)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}${literalNull ? literalNullHint(documented, name) : ""}`;
   const renamedFrom = flag.renamedFrom ?? [];
   const option = new Option(`${short}--${name} ${placeholder}`, describe);
   if (flag.hidden)
@@ -13869,14 +13752,13 @@ function addOperationOptions(command, operation, commandSpec, operationSpec) {
     command.addOption(new Option(`${short}--${name} <${flag.placeholder ?? "value"}>`, `${flag.describe ?? operationSpec.pathParamDocs?.[param] ?? `Set ${name.replaceAll("-", " ")}`} (required)`).makeOptionMandatory());
   }
   const paginates = cursorSlot(operationSpec) !== null;
-  const capsAFilter = ["query", "body", "headers"].some((slot) => operationSpec[slot] !== undefined && ("filter" in operationSpec[slot]));
   for (const slot of ["query", "body", "headers"]) {
     for (const [field, descriptor] of Object.entries(operationSpec[slot] ?? {})) {
       if (commandSpec.requestFields && !commandSpec.requestFields.includes(field))
         continue;
       if (commandSpec.positionals?.includes(field))
         continue;
-      addFieldOption(command, operation, field, descriptor, slot, paginates, capsAFilter);
+      addFieldOption(command, operation, field, descriptor, slot, paginates);
     }
   }
   if (commandSpec.allWorkspaces) {
@@ -13975,13 +13857,13 @@ function renderSpan(value, depth) {
   const indent = "  ".repeat(depth);
   const detailIndent = `${indent}  `;
   const name = requiredText(span, "name");
-  const type = requiredText(span, "type");
+  const type2 = requiredText(span, "type");
   const status = optionalText(span, "status");
   const elapsed = optionalNumber(span, "durationMs") ?? optionalNumber(span, "duration");
   const totalCost = costTotal(span);
   const summary = [
     `${indent}- ${name}`,
-    `[${type}]`,
+    `[${type2}]`,
     status,
     elapsed === undefined ? undefined : duration(Math.round(elapsed)),
     totalCost === undefined ? undefined : `$${totalCost.toFixed(4)}`
@@ -14020,9 +13902,9 @@ function printTraceSpans(format, traceSpans) {
   if (format === "json" || format === "yaml")
     return;
   console.log("");
-  console.log(format === "table" ? source_default.dim("trace:") : "trace:");
+  console.log(format === "table" ? styles3().dim("trace:") : "trace:");
   if (traceSpans.length === 0) {
-    console.log(source_default.dim("  No trace spans."));
+    console.log(styles3().dim("  No trace spans."));
     return;
   }
   console.log(traceSpans.flatMap((span) => renderSpan(span, 0)).join(`
@@ -14190,7 +14072,7 @@ function writePageNote(spec, envelope) {
   const value = at(envelope, spec.pageNote.path);
   if (value === undefined || value === null)
     return;
-  process.stderr.write(source_default.dim(`${spec.pageNote.label}: ${String(value)}
+  process.stderr.write(styles3().dim(`${spec.pageNote.label}: ${String(value)}
 `));
 }
 var TRUNCATION_FLAG = /^truncated$|^[A-Za-z0-9]+Truncated$/;
@@ -14223,14 +14105,14 @@ function clippedSubject(flag) {
 }
 function writeEnvelopeTruncation(envelope) {
   for (const flag of responseTruncationFlags(envelope)) {
-    process.stderr.write(source_default.dim(`${spellOut(flag)}: the server clipped ${clippedSubject(flag)}, so the answer is incomplete
+    process.stderr.write(styles3().dim(`${spellOut(flag)}: the server clipped ${clippedSubject(flag)}, so the answer is incomplete
 `));
   }
 }
 function writeCursorTruncation(count, truncated) {
   if (!truncated)
     return;
-  process.stderr.write(source_default.dim(`showing the first ${count}; more results exist — re-run with --limit 0 for all
+  process.stderr.write(styles3().dim(`showing the first ${count}; more results exist — re-run with --limit 0 for all
 `));
 }
 function renderResult(operation, format, raw, spec, options = {}, envelope) {
@@ -14239,7 +14121,7 @@ function renderResult(operation, format, raw, spec, options = {}, envelope) {
     printDocument(format, raw);
     return;
   }
-  const data = unwrapResource(raw);
+  const data = format === "json" || format === "yaml" ? raw : unwrapResource(raw);
   if (spec.itemsPath) {
     const items = at(data, spec.itemsPath);
     if (!Array.isArray(items)) {
@@ -14267,29 +14149,24 @@ function renderResult(operation, format, raw, spec, options = {}, envelope) {
 }
 
 // src/runtime/execute.ts
-var RUN_OUTCOME_OPERATIONS = {
-  executeWorkflow: {
-    failed: "The workflow run failed.",
-    cancelled: "The workflow run was cancelled."
-  },
-  executeTool: {
-    failed: "The tool call failed."
-  }
+var RUN_OUTCOME_OPERATIONS = new Set(["executeWorkflow"]);
+var FAILED_RUN_STATUS_MESSAGES = {
+  failed: "The workflow run failed.",
+  cancelled: "The workflow run was cancelled."
 };
 function runFailureMessage(operation, payload) {
-  const failureMessages = RUN_OUTCOME_OPERATIONS[operation];
-  if (!failureMessages)
+  if (!RUN_OUTCOME_OPERATIONS.has(operation))
     return null;
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
     return null;
   const { status, error } = payload;
   if (typeof status !== "string")
     return null;
-  const fallback = failureMessages[status];
+  const fallback = FAILED_RUN_STATUS_MESSAGES[status];
   if (!fallback)
     return null;
-  const reported = error?.message;
-  return safeOneLine(typeof reported === "string" && reported ? reported : fallback);
+  const reported2 = error?.message;
+  return safeOneLine(typeof reported2 === "string" && reported2 ? reported2 : fallback);
 }
 var BULK_OUTCOME_CHECKS = {
   bulkDeleteFiles: (payload, body) => {
@@ -14324,8 +14201,8 @@ var BULK_OUTCOME_CHECKS = {
     const requested = lengthOf(body?.chunkIds);
     if (requested === 0)
       return null;
-    const reported = payload.errors?.[0];
-    return typeof reported === "string" && reported ? safeOneLine(reported) : `Updated nothing: none of the ${requested} requested ${requested === 1 ? "chunk" : "chunks"} matched.`;
+    const reported2 = payload.errors?.[0];
+    return typeof reported2 === "string" && reported2 ? safeOneLine(reported2) : `Updated nothing: none of the ${requested} requested ${requested === 1 ? "chunk" : "chunks"} matched.`;
   },
   deleteTableRows: (payload) => {
     if (countOf(payload.deletedCount) > 0)
@@ -14358,6 +14235,22 @@ function countOf(value) {
 function lengthOf(value) {
   return Array.isArray(value) ? value.length : 0;
 }
+var RESULT_NOTES = {
+  replaceWorkflowChatDeployment: (payload, body) => {
+    const authType = payload.authType ?? body?.authType ?? "public";
+    return authType === "public" ? "note: auth type is public — anyone with the link can chat; pass --auth-type password|email to restrict it." : null;
+  }
+};
+function writeResultNote(operation, payload, body) {
+  const note = RESULT_NOTES[operation];
+  if (!note)
+    return;
+  const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+  const message = note(record, body);
+  if (message)
+    process.stderr.write(styles3().dim(`${message}
+`));
+}
 function bulkFailureMessage(operation, payload, body) {
   const check = BULK_OUTCOME_CHECKS[operation];
   if (!check)
@@ -14370,8 +14263,8 @@ var EXCLUSIVE_CAP_FIELDS = {
   deleteTableRows: { cap: "limit", ids: "rowIds" }
 };
 function readPagedLimit(raw) {
-  const text = String(raw ?? DEFAULT_LIMIT).trim();
-  const value = text === "" ? Number.NaN : Number(text);
+  const text2 = String(raw ?? DEFAULT_LIMIT).trim();
+  const value = text2 === "" ? Number.NaN : Number(text2);
   if (!Number.isInteger(value) || value < 0) {
     throw new SimApiError("--limit must be a whole number of 0 or more (0 for everything)", 0);
   }
@@ -14446,7 +14339,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
   const needsWorkspace = (hasWorkspaceField || commandSpec.profileWorkspacePath === true) && !omitsWorkspace;
   const paging = cursorSlot(operationSpec);
   const pagedLimit = paging ? readPagedLimit(requestFlags.limit) : 0;
-  const request = buildRequest(operation, positional, requestFlags, needsWorkspace ? client.requireWorkspace() : profile.workspaceId);
+  const request = await buildRequest(operation, positional, requestFlags, needsWorkspace ? client.requireWorkspace() : profile.workspaceId);
   if (paging) {
     const limit = pagedLimit === 0 ? Number.POSITIVE_INFINITY : pagedLimit;
     const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
@@ -14483,6 +14376,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
   });
   const payload = result?.data ?? result;
   renderResult(operation, profile.output, payload, commandSpec, { expandedTrace: requestFlags.trace === true }, result);
+  writeResultNote(operation, payload, request.body);
   const failure = runFailureMessage(operation, payload) ?? bulkFailureMessage(operation, payload, request.body);
   if (failure)
     throw new SimApiError(failure, 0);
@@ -14545,7 +14439,7 @@ function retypeMessage(message, spellings) {
 }
 function retypeDetails(details, spellings) {
   if (Array.isArray(details))
-    return details.map((issue) => retypeDetails(issue, spellings));
+    return details.map((issue2) => retypeDetails(issue2, spellings));
   if (!details || typeof details !== "object")
     return details;
   const issue = details;
@@ -14582,7 +14476,6 @@ var GROUP_ALIASES = {
   knowledge: "kb",
   logs: "log",
   "mcp-servers": "mcp-server",
-  sandboxes: "sandbox",
   secrets: "secret",
   skills: "skill",
   tables: "table",
@@ -14608,8 +14501,8 @@ function commandPath(command) {
   return names.join(" ");
 }
 var UNKNOWN_OPTION_TOKEN = /^error: unknown option '(.+?)'/;
-function looksLikeAnId(token) {
-  return token.length > 2 && !token.startsWith("--") && /^-[A-Za-z0-9_-]*[A-Z0-9][A-Za-z0-9_-]*$/.test(token);
+function looksLikeAnId(token2) {
+  return token2.length > 2 && !token2.startsWith("--") && /^-[A-Za-z0-9_-]*[A-Z0-9][A-Za-z0-9_-]*$/.test(token2);
 }
 function addArgumentExamples(command) {
   const outputError = command.configureOutput().outputError;
@@ -14627,10 +14520,10 @@ function addArgumentExamples(command) {
       }
       if (command.registeredArguments.length === 0)
         return;
-      const token = UNKNOWN_OPTION_TOKEN.exec(message)?.[1];
-      if (!token || !looksLikeAnId(token))
+      const token2 = UNKNOWN_OPTION_TOKEN.exec(message)?.[1];
+      if (!token2 || !looksLikeAnId(token2))
         return;
-      write(`Example: ${commandPath(command)} -- ${token}
+      write(`Example: ${commandPath(command)} -- ${token2}
 `);
     }
   });
@@ -14646,7 +14539,7 @@ function assertNoReservedFlags(command, operation) {
   }
 }
 var RESERVED_FLAG_EXEMPTIONS = new Set(["profiles add"]);
-function assertNoReservedProgramFlags(program) {
+function assertNoReservedProgramFlags(program2) {
   const walk = (command, prefix) => {
     const path = [...prefix, command.name()];
     const name = path.join(" ");
@@ -14662,10 +14555,10 @@ function assertNoReservedProgramFlags(program) {
     for (const child of command.commands)
       walk(child, path);
   };
-  for (const child of program.commands)
+  for (const child of program2.commands)
     walk(child, []);
 }
-function refuseHelpAfterUnknownCommand(program) {
+function refuseHelpAfterUnknownCommand(program2) {
   const walk = (command) => {
     const internals = command;
     const dispatchesOnly = command.commands.length > 0 && !internals._actionHandler && command.registeredArguments.length === 0;
@@ -14686,7 +14579,7 @@ function refuseHelpAfterUnknownCommand(program) {
     for (const child of command.commands)
       walk(child);
   };
-  walk(program);
+  walk(program2);
 }
 function configureOperation(command, operation, spec) {
   const operationSpec = V2_OPERATIONS[operation];
@@ -14890,8 +14783,8 @@ function serviceAccountProvider(providers, providerId) {
   }
   return provider;
 }
-function credentialValues(provider, raw) {
-  const parsed = coerce(raw, { kind: "object" }, { json: true }, "credentials");
+async function credentialValues(provider, raw) {
+  const parsed = await coerce(raw, { kind: "object" }, { json: true }, "credentials");
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new SimApiError("--credentials must be a JSON object", 0);
   }
@@ -14928,7 +14821,7 @@ async function createServiceAccount(command, providerId, options) {
   if (provider.requiresClientGeneratedCredentialId && !options.id) {
     throw new SimApiError(`--id is required for ${providerId}.`, 0);
   }
-  const credentialFields = credentialValues(provider, options.credentials);
+  const credentialFields = await credentialValues(provider, options.credentials);
   const operation = V2_OPERATIONS.createServiceAccountCredential;
   const response = await client.request(operation.path, {
     method: operation.method,
@@ -14970,8 +14863,8 @@ function acceptNameOnUpdate(credentials) {
     options.displayName = options.name;
   });
 }
-function attachCredentialCommands(program) {
-  const credentials = program.commands.find((command) => command.name() === "credentials");
+function attachCredentialCommands(program2) {
+  const credentials = program2.commands.find((command) => command.name() === "credentials");
   if (!credentials)
     throw new Error("The generated credentials command group is missing");
   acceptNameOnUpdate(credentials);
@@ -15065,8 +14958,8 @@ function ignoreBrokenPipe(stream) {
     stream.off("error", onError);
   };
 }
-function attachChat(program) {
-  program.command("chat").description("Ask Sim and print the reply").argument("<message>", "What to ask Sim").allowExcessArguments(false).option("-c, --conversation <id>", "Continue the conversation with this ID").addHelpText("after", `
+function attachChat(program2) {
+  program2.command("chat").description("Ask Sim and print the reply").argument("<message>", "What to ask Sim").allowExcessArguments(false).option("-c, --conversation <id>", "Continue the conversation with this ID").addHelpText("after", `
 Each turn prints the reply on stdout and the conversation ID on stderr; pass
 that ID back with -c to continue the same conversation. With --output json or
 yaml the reply is not streamed — the finished result is printed as one
@@ -15107,11 +15000,11 @@ Examples:
     };
     const restorePipeHandling = streaming ? ignoreBrokenPipe(process.stdout) : undefined;
     try {
-      const result = await readChatStream(response, (content) => {
+      const result = await readChatStream(response, (content2) => {
         if (!streaming)
           return;
-        streamed += content;
-        process.stdout.write(content);
+        streamed += content2;
+        process.stdout.write(content2);
       });
       if (!streaming) {
         printProtocolResult(profile.output, result);
@@ -15123,7 +15016,7 @@ Examples:
         streamed = content;
       }
       endStreamedLine();
-      process.stderr.write(`${source_default.dim(`conversation: ${result.conversationId}`)}
+      process.stderr.write(`${styles3().dim(`conversation: ${result.conversationId}`)}
 `);
     } catch (error) {
       endStreamedLine();
@@ -15254,6 +15147,20 @@ async function saveStagedFile(body, target, force) {
   }
 }
 async function saveToFile(body, target, force) {
+  const embedded = embedStore.getStore();
+  if (embedded) {
+    try {
+      embedded.identity.signal?.throwIfAborted();
+      if (!embedded.writeFile) {
+        throw new SimApiError(`--output-file cannot save ${target} here: this surface has no machine to write to. Read the file instead, or use a client with filesystem access to download it.`, 0);
+      }
+      await embedded.writeFile(target, body, { overwrite: force });
+      embedded.identity.signal?.throwIfAborted();
+    } finally {
+      await body.cancel().catch(() => {});
+    }
+    return;
+  }
   return saveStagedFile(body, target, force);
 }
 async function streamToStdout(body, output = process.stdout) {
@@ -15267,6 +15174,7 @@ async function streamToStdout(body, output = process.stdout) {
         await once2(output, "drain");
     }
   } finally {
+    await reader.cancel().catch(() => {});
     reader.releaseLock();
   }
 }
@@ -15304,9 +15212,10 @@ function attachFileGet(files) {
     }
     if (options.outputFile === undefined || options.outputFile === "-") {
       const contentType = response.headers.get("content-type");
-      if (process.stdout.isTTY && !isTerminalSafeContentType(contentType)) {
+      const embedded = embedStore.getStore();
+      if ((embedded || process.stdout.isTTY) && !isTerminalSafeContentType(contentType)) {
         await response.body.cancel();
-        throw new SimApiError(`Refusing to write ${contentType ?? "unknown content"} to an interactive terminal. Use --output-file <path> or pipe stdout.`, 0);
+        throw new SimApiError(embedded ? `Refusing to put ${contentType ?? "unknown content"} in a text result. Use --output-file <path>.` : `Refusing to write ${contentType ?? "unknown content"} to an interactive terminal. Use --output-file <path> or pipe stdout.`, 0);
       }
       await streamToStdout(response.body);
       return;
@@ -15321,74 +15230,120 @@ function attachFileGet(files) {
   });
 }
 
-// src/transfer/local-file.ts
-import { constants } from "node:fs";
-import { access, stat } from "node:fs/promises";
-import { basename } from "node:path";
-var CONTENT_TYPES = {
-  css: "text/css",
-  csv: "text/csv",
-  doc: "application/msword",
-  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  gif: "image/gif",
-  html: "text/html",
-  htm: "text/html",
-  jpeg: "image/jpeg",
-  jpg: "image/jpeg",
-  js: "text/javascript",
-  json: "application/json",
-  jsonl: "application/jsonl",
-  md: "text/markdown",
-  pdf: "application/pdf",
-  ppt: "application/vnd.ms-powerpoint",
-  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  png: "image/png",
-  svg: "image/svg+xml",
-  txt: "text/plain",
-  webp: "image/webp",
-  yaml: "application/yaml",
-  yml: "application/yaml",
-  xls: "application/vnd.ms-excel",
-  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  zip: "application/zip"
-};
-function contentTypeFor(name) {
-  const dot = name.lastIndexOf(".");
-  const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
-  return CONTENT_TYPES[extension] ?? "application/octet-stream";
-}
-async function localFile(path, override) {
-  let size;
-  try {
-    const stats = await stat(path);
-    if (!stats.isFile())
-      throw new SimApiError(`${path} is not a regular file`, 0);
-    await access(path, constants.R_OK);
-    size = stats.size;
-  } catch (error) {
-    if (error instanceof SimApiError)
-      throw error;
-    throw new SimApiError(`Cannot read ${path}: ${error.message}`, 0);
+// src/transfer/upload-session.ts
+import { openAsBlob } from "node:fs";
+
+// src/transfer/streaming-upload.ts
+class StreamingUpload {
+  size;
+  position = 0;
+  pending = new Uint8Array(0);
+  closed = false;
+  reader;
+  onAbort;
+  stopped = new AbortController;
+  signal;
+  constructor(stream, size, signal) {
+    this.size = size;
+    this.signal = signal ? AbortSignal.any([signal, this.stopped.signal]) : this.stopped.signal;
+    this.reader = stream.getReader();
+    this.onAbort = () => {
+      this.reader.cancel(this.signal.reason).catch(() => {});
+    };
+    this.signal.addEventListener("abort", this.onAbort, { once: true });
+    if (this.signal.aborted)
+      this.onAbort();
+  }
+  slice(start, end) {
+    this.signal.throwIfAborted();
+    if (this.closed || start !== this.position || end <= start || end > this.size) {
+      throw new SimApiError("Upload parts must consume the snapshot in order", 0);
+    }
+    return new ReadableStream({
+      pull: async (controller) => {
+        try {
+          this.signal.throwIfAborted();
+          while (this.pending.byteLength === 0) {
+            const next = await this.reader.read();
+            this.signal.throwIfAborted();
+            if (next.done)
+              throw new SimApiError("Upload file ended before its declared size", 0);
+            this.pending = next.value;
+          }
+          const length = Math.min(this.pending.byteLength, end - this.position);
+          controller.enqueue(this.pending.subarray(0, length));
+          this.pending = this.pending.subarray(length);
+          this.position += length;
+          if (this.position === end)
+            controller.close();
+        } catch (error) {
+          controller.error(error);
+        }
+      },
+      cancel: (reason) => this.reader.cancel(reason)
+    }, { highWaterMark: 0 });
+  }
+  assertConsumed(end) {
+    this.signal.throwIfAborted();
+    if (this.position !== end) {
+      throw new SimApiError("Upload was acknowledged before its complete body was consumed", 0);
+    }
+  }
+  async verifyComplete() {
+    this.assertConsumed(this.size);
+    if (this.pending.byteLength > 0) {
+      throw new SimApiError("Upload file exceeds its declared size", 0);
+    }
+    while (true) {
+      const next = await this.reader.read();
+      this.signal.throwIfAborted();
+      if (next.done)
+        return;
+      if (next.value.byteLength > 0)
+        throw new SimApiError("Upload file exceeds its declared size", 0);
+    }
+  }
+  async close() {
+    if (this.closed)
+      return;
+    this.closed = true;
+    this.stopped.abort();
+    this.signal.removeEventListener("abort", this.onAbort);
+    try {
+      await this.reader.cancel().catch(() => {});
+    } finally {
+      this.reader.releaseLock();
+    }
   }
-  if (size === 0)
-    throw new SimApiError(`${path} is empty`, 0);
-  return { name: override ?? basename(path), size };
 }
 
 // src/transfer/upload-session.ts
-import { openAsBlob } from "node:fs";
 var PART_URL_BATCH = 100;
-async function uploadPut(transfer, blob) {
-  const response = await fetch(transfer.url, {
+async function uploadBytes(url, headers, file, start, end, label) {
+  const body = file.slice(start, end);
+  const options = {
     method: "PUT",
-    headers: transfer.headers,
-    body: blob
-  });
+    headers,
+    body,
+    signal: file instanceof StreamingUpload ? file.signal : embedStore.getStore()?.identity.signal
+  };
+  if (file instanceof StreamingUpload) {
+    const streamedHeaders = new Headers(headers);
+    streamedHeaders.set("content-length", String(end - start));
+    options.headers = streamedHeaders;
+    options.duplex = "half";
+  }
+  const response = await fetch(url, options);
   if (!response.ok) {
-    throw new SimApiError(`Upload failed with status ${response.status}`, response.status);
+    throw new SimApiError(`${label} failed with status ${response.status}`, response.status);
   }
+  if (file instanceof StreamingUpload)
+    file.assertConsumed(end);
 }
-async function uploadParts(client, workspaceId, session, transfer, blob) {
+async function uploadParts(client, workspaceId, session, transfer, file) {
+  if (file instanceof StreamingUpload && (!Number.isSafeInteger(transfer.partSize) || transfer.partSize <= 0)) {
+    throw new SimApiError("Invalid upload part size", 0);
+  }
   const expectedPartCount = Math.ceil(session.size / transfer.partSize);
   if (expectedPartCount !== transfer.partCount) {
     throw new Error(`Upload session expected ${transfer.partCount} parts, but file requires ${expectedPartCount}`);
@@ -15404,28 +15359,49 @@ async function uploadParts(client, workspaceId, session, transfer, blob) {
       headers: { "upload-token": session.uploadToken },
       body: { partNumbers }
     });
-    for (const part of signed.data.parts) {
-      const start = (part.partNumber - 1) * transfer.partSize;
-      const chunk = blob.slice(start, Math.min(start + transfer.partSize, session.size));
-      const response = await fetch(part.url, {
-        method: "PUT",
-        headers: part.headers,
-        body: chunk
-      });
-      if (!response.ok) {
-        throw new SimApiError(`Part ${part.partNumber} failed with status ${response.status}`, response.status);
+    let parts = signed.data.parts;
+    if (file instanceof StreamingUpload) {
+      const numbers = new Set(parts.map((part) => part.partNumber));
+      if (parts.length !== partNumbers.length || partNumbers.some((n) => !numbers.has(n))) {
+        throw new SimApiError("Upload part URLs do not match the requested parts", 0);
       }
+      parts = [...parts].sort((a, b) => a.partNumber - b.partNumber);
+    }
+    for (const part of parts) {
+      const start = (part.partNumber - 1) * transfer.partSize;
+      await uploadBytes(part.url, part.headers, file, start, Math.min(start + transfer.partSize, session.size), `Part ${part.partNumber}`);
     }
   }
 }
 async function finishUploadSession(client, workspaceId, session, path) {
+  let snapshot;
+  let streamed;
   try {
-    const blob = await openAsBlob(path);
+    const embedded = embedStore.getStore();
+    let file;
+    if (embedded) {
+      embedded.identity.signal?.throwIfAborted();
+      if (!embedded.openFile)
+        throw new SimApiError("This invocation has no machine to read from", 0);
+      snapshot = await embedded.openFile(embeddedFileKey(path));
+      if (snapshot.size !== session.size)
+        throw new SimApiError("Upload snapshot size changed", 0);
+      streamed = new StreamingUpload(await snapshot.stream(), snapshot.size, AbortSignal.any([
+        ...embedded.identity.signal ? [embedded.identity.signal] : [],
+        ...snapshot.signal ? [snapshot.signal] : []
+      ]));
+      file = streamed;
+    } else {
+      file = await openAsBlob(path);
+    }
     if (session.transfer.method === "put") {
-      await uploadPut(session.transfer, blob);
+      await uploadBytes(session.transfer.url, session.transfer.headers, file, 0, file instanceof Blob ? file.size : session.size, "Upload");
     } else {
-      await uploadParts(client, workspaceId, session, session.transfer, blob);
+      await uploadParts(client, workspaceId, session, session.transfer, file);
     }
+    await streamed?.verifyComplete();
+    await streamed?.close();
+    await snapshot?.dispose().catch(() => {});
     const completed = await client.request(`${session.basePath}/complete`, {
       method: "POST",
       query: { workspaceId },
@@ -15433,7 +15409,10 @@ async function finishUploadSession(client, workspaceId, session, path) {
     });
     return completed.data;
   } catch (error) {
-    await client.request(session.basePath, {
+    await streamed?.close();
+    const profile = embeddedProfile();
+    const cleanupClient = profile ? new SimClient({ ...profile, signal: AbortSignal.timeout(5000) }) : client;
+    await cleanupClient.request(session.basePath, {
       method: "DELETE",
       query: { workspaceId },
       headers: { "upload-token": session.uploadToken }
@@ -15441,6 +15420,9 @@ async function finishUploadSession(client, workspaceId, session, path) {
       return;
     });
     throw error;
+  } finally {
+    await streamed?.close();
+    await snapshot?.dispose().catch(() => {});
   }
 }
 
@@ -15526,9 +15508,11 @@ function attachKnowledgeDocumentUpload(documents) {
     printProtocolResult(profile.output, {
       id: completed.document.id,
       knowledgeBaseId: completed.document.knowledgeBaseId,
-      name: completed.document.filename,
-      size: completed.document.fileSize,
-      status: completed.document.processingStatus
+      filename: completed.document.filename,
+      fileSize: completed.document.fileSize,
+      mimeType: completed.document.mimeType,
+      processingStatus: completed.document.processingStatus,
+      chunkCount: completed.document.chunkCount
     });
   });
 }
@@ -15590,7 +15574,7 @@ function createTableWriter() {
     if (!widths) {
       widths = COLUMNS.map((column, index) => Math.min(MAX_CELL_WIDTH2, Math.max(column.floor, visibleWidth(column.header), ...lines.map((line) => visibleWidth(line[index])))));
       const header = widths;
-      console.log(source_default.dim(COLUMNS.map((column, index) => pad2(column.header.toUpperCase(), header[index])).join("  ").trimEnd()));
+      console.log(styles3().dim(COLUMNS.map((column, index) => pad2(column.header.toUpperCase(), header[index])).join("  ").trimEnd()));
     }
     const locked = widths;
     for (const line of lines) {
@@ -15622,26 +15606,26 @@ ${dump(row, { lineWidth: 0, noRefs: true }).trimEnd()}`);
   return createTableWriter();
 }
 function followStatus() {
-  let reported = false;
+  let reported2 = false;
   return {
     note: (message) => {
-      if (!process.stderr.isTTY)
+      if (!hasProgressTerminal())
         return;
-      reported = true;
-      process.stderr.write(`\r${source_default.dim(message)}${ERASE_LINE}`);
+      reported2 = true;
+      process.stderr.write(`\r${styles3().dim(message)}${ERASE_LINE}`);
     },
     warn: (message) => {
-      if (reported) {
-        reported = false;
+      if (reported2) {
+        reported2 = false;
         process.stderr.write(`\r${ERASE_LINE}`);
       }
       process.stderr.write(`warning: ${message}
 `);
     },
     clear: () => {
-      if (!reported)
+      if (!reported2)
         return;
-      reported = false;
+      reported2 = false;
       process.stderr.write(`\r${ERASE_LINE}`);
     }
   };
@@ -15929,18 +15913,18 @@ function progressLine(job) {
 }
 async function watchImport(client, workspaceId, job) {
   let current = job;
-  let reported = null;
+  let reported2 = null;
   while (!IMPORT_SETTLED.has(current.status)) {
     await sleep2(IMPORT_POLL_MS);
     const next = await client.request(`/api/v2/tables/imports/${encodeURIComponent(current.id)}`, { query: { workspaceId } });
     current = next.data;
     const line = progressLine(current);
-    if (process.stderr.isTTY && line !== reported) {
-      reported = line;
-      process.stderr.write(`\r${source_default.dim(line)}\x1B[K`);
+    if (hasProgressTerminal() && line !== reported2) {
+      reported2 = line;
+      process.stderr.write(`\r${styles3().dim(line)}\x1B[K`);
     }
   }
-  if (process.stderr.isTTY && reported !== null)
+  if (hasProgressTerminal() && reported2 !== null)
     process.stderr.write("\r\x1B[K");
   return current;
 }
@@ -15999,8 +15983,8 @@ function attachTableImport(tables) {
         workspaceId,
         source,
         target,
-        ...options.mapping ? { mapping: jsonFlag(options.mapping, "mapping", "object") } : {},
-        ...options.createColumns ? { createColumns: jsonFlag(options.createColumns, "create-columns", "array") } : {},
+        ...options.mapping ? { mapping: await jsonFlag(options.mapping, "mapping", "object") } : {},
+        ...options.createColumns ? { createColumns: await jsonFlag(options.createColumns, "create-columns", "array") } : {},
         ...options.timezone ? { timezone: options.timezone } : {}
       }
     });
@@ -16045,14 +16029,11 @@ var AGENT_STREAM_PROTOCOL_HEADER = "x-sim-stream-protocol";
 var AGENT_STREAM_PROTOCOL_V1 = "agent-events-v1";
 var DONE_SENTINEL = "[DONE]";
 function resolveWorkflowRunSelection(flags) {
-  const manual = flags.manual === true;
   const trigger = typeof flags.trigger === "string" ? flags.trigger : undefined;
   const useMockPayload = flags.mockPayload === true;
+  const manual = flags.manual === true || trigger !== undefined || useMockPayload;
   const fromBlock = typeof flags.fromBlock === "string" ? flags.fromBlock : undefined;
   const sourceRun = typeof flags.sourceRun === "string" ? flags.sourceRun : undefined;
-  if ((trigger || useMockPayload) && !manual) {
-    throw new SimApiError("--trigger and --mock-payload require --manual", 0);
-  }
   if (fromBlock && (trigger || useMockPayload)) {
     throw new SimApiError("--from-block cannot be combined with --trigger or --mock-payload", 0);
   }
@@ -16127,16 +16108,16 @@ class Commentary {
   constructor(sink) {
     this.sink = sink;
   }
-  inline(text) {
-    if (text.length === 0)
+  inline(text2) {
+    if (text2.length === 0)
       return;
-    this.sink.write(text);
-    this.atLineStart = text.endsWith(`
+    this.sink.write(text2);
+    this.atLineStart = text2.endsWith(`
 `);
   }
-  line(text) {
+  line(text2) {
     this.sink.write(`${this.atLineStart ? "" : `
-`}${text}
+`}${text2}
 `);
     this.atLineStart = true;
   }
@@ -16151,11 +16132,11 @@ class Commentary {
 function toolNotice(frame) {
   const name = safeOneLine(stringField(frame, "name") ?? "tool");
   if (frame.phase === "start")
-    return source_default.dim(`→ ${name}`);
+    return styles3().dim(`→ ${name}`);
   const status = stringField(frame, "status");
   if (status && status !== "success")
-    return source_default.yellow(`✗ ${name} (${safeOneLine(status)})`);
-  return source_default.dim(`✓ ${name}`);
+    return styles3().yellow(`✗ ${name} (${safeOneLine(status)})`);
+  return styles3().dim(`✓ ${name}`);
 }
 async function renderRunStream(body, options) {
   const commentary = new Commentary(options.stderr);
@@ -16177,11 +16158,11 @@ async function renderRunStream(body, options) {
     }
     switch (frame.event) {
       case "chunk_reset":
-        commentary.line(source_default.dim("… retracted; that turn resolved to tool calls"));
+        commentary.line(styles3().dim("… retracted; that turn resolved to tool calls"));
         break;
       case "thinking":
         if (options.includeThinking && typeof frame.data === "string") {
-          commentary.inline(source_default.dim(sanitize(frame.data)));
+          commentary.inline(styles3().dim(sanitize(frame.data)));
         }
         break;
       case "tool":
@@ -16189,7 +16170,7 @@ async function renderRunStream(body, options) {
           commentary.line(toolNotice(frame));
         break;
       case "stream_error":
-        commentary.line(source_default.yellow(`warning: ${safeOneLine(stringField(frame, "error") ?? "stream read failed")}`));
+        commentary.line(styles3().yellow(`warning: ${safeOneLine(stringField(frame, "error") ?? "stream read failed")}`));
         break;
       case "error":
         commentary.endLine();
@@ -16218,7 +16199,7 @@ async function followRun(workflowId, command) {
   const negotiates = includeThinking || includeToolCalls;
   const { client, profile } = clientFrom(command);
   const operation = V2_OPERATIONS.executeWorkflow;
-  const request = buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
+  const request = await buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
   const response = await client.requestRaw(request.path, {
     method: "POST",
     query: request.query,
@@ -16259,8 +16240,8 @@ function followOrDelegate(previous) {
       command.setOptionValue("run", selection);
     const flags = command.optsWithGlobals();
     if (flags.follow !== true) {
-      if (Array.isArray(flags.selectOutput) && flags.selectOutput.length > 0) {
-        throw new SimApiError(flags.async === true ? "--select-output shapes a streamed result, and --async returns as soon as the run is queued, so there is no stream to shape. Drop one of them, or read the finished run with: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockId>[.path] — that resource matches block ids, not the block names --select-output takes here." : "--select-output shapes a streamed result; add --follow. To narrow a run that has already finished: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockId>[.path] — that resource matches block ids, not the block names --select-output takes here.", 0);
+      if (Array.isArray(flags.selectOutput) && flags.selectOutput.length > 0 && flags.async === true) {
+        throw new SimApiError("--select-output names outputs of a completed run, and --async returns as soon as the run is queued. Drop one of them, or read the finished run with: sim workflows runs get <runId> --workflow <workflowId> --select-output <blockName|blockId>[.path] — that resource takes the same selectors --select-output takes here.", 0);
       }
       if (flags.includeThinking === true || flags.includeToolCalls === true) {
         throw new SimApiError("--include-thinking and --include-tool-calls describe a stream; add --follow", 0);
@@ -16282,7 +16263,119 @@ function attachWorkflowRunFollow(workflows) {
   }
   const held = run._actionHandler;
   const previous = typeof held === "function" ? held : null;
-  run.option("--manual", "Run the current saved workflow state instead of the active deployment").option("--trigger <blockId>", "Enter a manual run through this runnable trigger (requires --manual)").option("--mock-payload", "Use the selected trigger's server-derived mock payload (requires --manual)").option("--from-block <blockId>", "Run manually from this saved workflow block").option("--source-run <runId>", "Prior run whose persisted state supplies upstream outputs (requires --from-block)").option("--follow", "Stream the run as it happens; progress on stderr, result on stdout. The stream reports only success and output, so the result omits the run id and timings a non-streaming run returns").option("--include-thinking", "Show model reasoning while following (requires --follow)").option("--include-tool-calls", "Show tool calls while following (requires --follow)").action(followOrDelegate(previous));
+  run.option("--manual", "Run the current saved workflow state instead of the active deployment").option("--trigger <blockId>", "Enter the run through this runnable trigger; runs the current saved workflow state (implies --manual)").option("--mock-payload", "Use the selected trigger's server-derived mock payload; runs the current saved workflow state (implies --manual)").option("--from-block <blockId>", "Run manually from this saved workflow block").option("--source-run <runId>", "Prior run whose persisted state supplies upstream outputs (requires --from-block)").option("--follow", "Stream the run as it happens; progress on stderr, result on stdout. The stream reports only success and output, so the result omits the run id and timings a non-streaming run returns").option("--include-thinking", "Show model reasoning while following (requires --follow)").option("--include-tool-calls", "Show tool calls while following (requires --follow)").action(followOrDelegate(previous));
+}
+
+// src/commands/protocol/workflow-run-get.ts
+var BLOCK_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var SELECT_OUTPUT_FLAG = "select-output";
+function normalizeBlockName(name) {
+  return name.toLowerCase().replace(/\s+/g, "").replace(/\./g, "");
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function loadWorkflowBlocks(client, workflowId) {
+  const operation = V2_OPERATIONS.getWorkflowState;
+  const raw = await client.request(resolvePath(operation.path, { workflowId }), {
+    method: operation.method
+  });
+  const state = isRecord2(raw) && isRecord2(raw.data) ? raw.data : raw;
+  const blocks = isRecord2(state) && isRecord2(state.blocks) ? Object.entries(state.blocks) : [];
+  return blocks.map(([key, block]) => ({
+    id: isRecord2(block) && typeof block.id === "string" ? block.id : key,
+    name: isRecord2(block) && typeof block.name === "string" ? block.name : ""
+  }));
+}
+function splitSelector(selector) {
+  const dot = selector.indexOf(".");
+  return dot === -1 ? { head: selector, path: "" } : { head: selector.slice(0, dot), path: selector.slice(dot) };
+}
+function isIdHeaded(selector) {
+  return BLOCK_ID.test(splitSelector(selector).head);
+}
+function resolveSelection(typed, blocks, workflowId) {
+  const resolved = [];
+  const typedBy = new Map;
+  const unresolved = [];
+  for (const selector of typed) {
+    const { head, path } = splitSelector(selector);
+    let blockId = head;
+    if (!BLOCK_ID.test(head)) {
+      const wanted = normalizeBlockName(head);
+      const matches = blocks.filter((block) => block.id === head || normalizeBlockName(block.name) === wanted);
+      if (matches.length === 0) {
+        unresolved.push(selector);
+        continue;
+      }
+      if (matches.length > 1) {
+        throw new SimApiError(`--${SELECT_OUTPUT_FLAG} ${selector} names ${matches.length} blocks (${matches.map((block) => block.id).join(", ")}); pass the block id instead`, 0);
+      }
+      blockId = matches[0].id;
+    }
+    const rewritten = `${blockId}${path}`;
+    resolved.push(rewritten);
+    if (!typedBy.has(rewritten))
+      typedBy.set(rewritten, selector);
+  }
+  if (unresolved.length > 0) {
+    const names = blocks.map((block) => block.name).filter((name) => name !== "");
+    throw new SimApiError(`--${SELECT_OUTPUT_FLAG} did not resolve to any block on this run: ${unresolved.join(", ")}. Pass a block id or its name — "blockId", "blockId.path", "blockName" or "blockName.path"; names match ignoring case, spaces and dots. Blocks on workflow ${workflowId}: ${names.length > 0 ? names.join(", ") : "none"}.`, 0);
+  }
+  return { resolved, typedBy };
+}
+function keyByTyped(payload, typedBy) {
+  if (!isRecord2(payload) || !isRecord2(payload.blockOutputs))
+    return payload;
+  const blockOutputs = {};
+  for (const [key, value] of Object.entries(payload.blockOutputs)) {
+    blockOutputs[typedBy.get(key) ?? key] = value;
+  }
+  return { ...payload, blockOutputs };
+}
+async function readRunByName(runId, typed, command) {
+  const flags = command.optsWithGlobals();
+  const { client, profile } = clientFrom(command);
+  const operation = V2_OPERATIONS.getWorkflowRun;
+  const spec = CLI_CONTRACT.getWorkflowRun ?? {};
+  await buildRequest("getWorkflowRun", [runId], flags, profile.workspaceId);
+  const workflowId = String(flags.workflow);
+  const selection = resolveSelection(typed, await loadWorkflowBlocks(client, workflowId), workflowId);
+  const request = await buildRequest("getWorkflowRun", [runId], { ...flags, selectOutput: selection.resolved }, profile.workspaceId);
+  let result;
+  try {
+    result = await client.request(request.path, {
+      method: operation.method,
+      headers: request.headers,
+      query: request.query,
+      body: request.body
+    });
+  } catch (error) {
+    throw retypeApiError(error, "getWorkflowRun", spec, operation);
+  }
+  renderResult("getWorkflowRun", profile.output, keyByTyped(result?.data ?? result, selection.typedBy), spec, {}, result);
+}
+function attachWorkflowRunGet(runs) {
+  const get = runs.commands.find((command) => command.name() === "get");
+  const held = get?._actionHandler;
+  if (!get || typeof held !== "function") {
+    throw new Error("workflows runs get must be registered before block names can be attached to it");
+  }
+  const previous = held;
+  get.action(async (runId, _options, command) => {
+    const raw = command.optsWithGlobals().selectOutput;
+    if (raw === undefined) {
+      await previous(command.processedArgs);
+      return;
+    }
+    const typed = await readListValues(raw, SELECT_OUTPUT_FLAG);
+    command.setOptionValue("selectOutput", typed);
+    if (typed.every(isIdHeaded)) {
+      await previous(command.processedArgs);
+      return;
+    }
+    await readRunByName(runId, typed, command);
+  });
 }
 
 // src/commands/protocol/workflow-run-wait.ts
@@ -16299,18 +16392,21 @@ var MAX_POLL_DELAY_MS = 15000;
 var POLL_BACKOFF_FACTOR = 2;
 var DEFAULT_WAIT_TIMEOUT_SECONDS = 3600;
 var WAIT_TIMEOUT_FLAG = "--wait-timeout <seconds>";
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function optionalString(value) {
   return typeof value === "string" && value !== "" ? value : null;
 }
+function runData(raw) {
+  return isRecord3(raw) && isRecord3(raw.data) ? raw.data : raw;
+}
 function readRun(raw) {
-  const run = isRecord2(raw) && isRecord2(raw.data) ? raw.data : raw;
-  if (!isRecord2(run) || typeof run.status !== "string") {
+  const run = isRecord3(raw) && isRecord3(raw.data) ? raw.data : raw;
+  if (!isRecord3(run) || typeof run.status !== "string") {
     throw new SimApiError("Run status response carried no status.", 0);
   }
-  const paused = isRecord2(run.paused) ? run.paused : null;
+  const paused = isRecord3(run.paused) ? run.paused : null;
   return {
     status: run.status,
     pauseKind: paused ? optionalString(paused.pauseKind) : null,
@@ -16326,18 +16422,18 @@ function classify(snapshot) {
   return snapshot.status === "completed" ? "completed" : snapshot.status === "cancelled" ? "cancelled" : "failed";
 }
 function waitProgress() {
-  let reported = false;
+  let reported2 = false;
   return {
     advance: (status, elapsedMs) => {
-      if (!process.stderr.isTTY)
+      if (!hasProgressTerminal())
         return;
-      reported = true;
-      process.stderr.write(`\r${source_default.dim(`${status} — waiting ${Math.round(elapsedMs / 1000)}s…`)}\x1B[K`);
+      reported2 = true;
+      process.stderr.write(`\r${styles3().dim(`${status} — waiting ${Math.round(elapsedMs / 1000)}s…`)}\x1B[K`);
     },
     finish: () => {
-      if (!reported)
+      if (!reported2)
         return;
-      reported = false;
+      reported2 = false;
       process.stderr.write("\r\x1B[K");
     }
   };
@@ -16379,19 +16475,19 @@ function attachWorkflowRunWait(runs) {
         const outcome = classify(snapshot);
         if (outcome) {
           progress.finish();
-          renderResult("getWorkflowRun", profile.output, raw, runSpec());
+          renderResult("getWorkflowRun", profile.output, runData(raw), runSpec());
           const message = explain(outcome, runId, options.workflow, snapshot);
           if (message)
-            console.error(source_default.red(message));
-          process.exitCode = WAIT_EXIT_CODES[outcome];
+            console.error(styles3().red(message));
+          setSoftExitCode(WAIT_EXIT_CODES[outcome]);
           return;
         }
         const remainingMs = deadline - Date.now();
         if (remainingMs <= 0) {
           progress.finish();
-          renderResult("getWorkflowRun", profile.output, raw, runSpec());
-          console.error(source_default.red(`Timed out after ${timeoutSeconds}s waiting for run ${runId} (status: ${snapshot.status}${snapshot.resumeAt ? `, resuming at ${snapshot.resumeAt}` : ""}). Raise ${WAIT_TIMEOUT_FLAG}, or set it to 0 to wait indefinitely.`));
-          process.exitCode = WAIT_EXIT_CODES.timeout;
+          renderResult("getWorkflowRun", profile.output, runData(raw), runSpec());
+          console.error(styles3().red(`Timed out after ${timeoutSeconds}s waiting for run ${runId} (status: ${snapshot.status}${snapshot.resumeAt ? `, resuming at ${snapshot.resumeAt}` : ""}). Raise ${WAIT_TIMEOUT_FLAG}, or set it to 0 to wait indefinitely.`));
+          setSoftExitCode(WAIT_EXIT_CODES.timeout);
           return;
         }
         progress.advance(snapshot.status, Date.now() - startedAt);
@@ -16405,16 +16501,16 @@ function attachWorkflowRunWait(runs) {
 }
 
 // src/commands/protocol/index.ts
-function group(program, name) {
-  const existing = program.commands.find((command) => command.name() === name);
+function group(program2, name) {
+  const existing = program2.commands.find((command) => command.name() === name);
   if (existing)
     return existing;
   const created = new Command(name);
-  program.addCommand(created);
+  program2.addCommand(created);
   return created;
 }
-function attachProtocolCommands(program) {
-  const files = group(program, "files");
+function attachProtocolCommands(program2) {
+  const files = group(program2, "files");
   attachFileUpload(files);
   attachFileGet(files);
   attachResourceDirectoryCommands(files, {
@@ -16423,7 +16519,7 @@ function attachProtocolCommands(program) {
     folders: "listFileFolders",
     createFolder: "createFileFolder"
   });
-  const knowledge = group(program, "knowledge");
+  const knowledge = group(program2, "knowledge");
   attachKnowledgeDocumentUpload(group(knowledge, "documents"));
   attachResourceDirectoryCommands(knowledge, {
     kind: "knowledge",
@@ -16431,7 +16527,7 @@ function attachProtocolCommands(program) {
     folders: "listKnowledgeFolders",
     createFolder: "createKnowledgeFolder"
   });
-  const tables = group(program, "tables");
+  const tables = group(program2, "tables");
   attachTableImport(tables);
   attachResourceDirectoryCommands(tables, {
     kind: "table",
@@ -16439,7 +16535,7 @@ function attachProtocolCommands(program) {
     folders: "listTableFolders",
     createFolder: "createTableFolder"
   });
-  const workflows = group(program, "workflows");
+  const workflows = group(program2, "workflows");
   attachResourceDirectoryCommands(workflows, {
     kind: "workflow",
     resources: "listWorkflows",
@@ -16447,9 +16543,11 @@ function attachProtocolCommands(program) {
     createFolder: "createWorkflowFolder"
   });
   attachWorkflowRunFollow(workflows);
-  attachWorkflowRunWait(group(workflows, "runs"));
-  attachLogsFollow(group(program, "logs"));
-  attachChat(program);
+  const runs = group(workflows, "runs");
+  attachWorkflowRunGet(runs);
+  attachWorkflowRunWait(runs);
+  attachLogsFollow(group(program2, "logs"));
+  attachChat(program2);
 }
 
 // src/terminal/secret-input.ts
@@ -16481,7 +16579,7 @@ function promptSecret(input = process.stdin, output = process.stderr) {
   emitKeypressEvents(input);
   input.setRawMode(true);
   input.resume();
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     const cleanup = () => {
       input.removeListener("keypress", onKeypress);
       input.setRawMode(wasRaw);
@@ -16502,7 +16600,7 @@ function promptSecret(input = process.stdin, output = process.stderr) {
     };
     const fail = (message) => finish(() => reject(new SimApiError(message, 0)));
     const cancel = () => finish(() => reject(new SecretInputCancelledError));
-    function onKeypress(text, key) {
+    function onKeypress(text2, key) {
       if (key.ctrl && (key.name === "c" || key.name === "d")) {
         cancel();
         return;
@@ -16511,7 +16609,7 @@ function promptSecret(input = process.stdin, output = process.stderr) {
         if (value.length === 0)
           fail("Secret value cannot be empty.");
         else
-          finish(() => resolve(value));
+          finish(() => resolve3(value));
         return;
       }
       if (key.name === "backspace") {
@@ -16523,7 +16621,7 @@ function promptSecret(input = process.stdin, output = process.stderr) {
         }
         return;
       }
-      const entered = text || metaCharacter(key);
+      const entered = text2 || metaCharacter(key);
       if (!entered || key.ctrl || key.name === "escape")
         return;
       if (value.length + entered.length > MAX_SECRET_LENGTH) {
@@ -16550,12 +16648,12 @@ var SECRET_RESULT = {
     { header: "description" }
   ]
 };
-function readValueArgument(raw) {
+async function readValueArgument(raw) {
   if (raw.startsWith("@@"))
     return raw.slice(1);
   if (!raw.startsWith("@"))
     return raw;
-  return readArgumentSource(raw, "value").text;
+  return (await readArgumentSource(raw, "value")).text;
 }
 function validateSecretValue(value) {
   if (value.length === 0)
@@ -16575,7 +16673,7 @@ function validateWorkspaceOnlyFlag(flag, value, scope) {
 }
 async function readSecretValue(options) {
   if (options.value !== undefined)
-    return validateSecretValue(readValueArgument(options.value));
+    return validateSecretValue(await readValueArgument(options.value));
   if (options.description !== undefined || options.unredacted !== undefined)
     return;
   try {
@@ -16583,7 +16681,7 @@ async function readSecretValue(options) {
   } catch (error) {
     if (!(error instanceof SecretInputCancelledError))
       throw error;
-    console.error(source_default.red(`Error: ${error.message}`));
+    console.error(styles3().red(`Error: ${error.message}`));
     return process.exit(CANCELLED_EXIT_CODE);
   }
 }
@@ -16608,336 +16706,14 @@ async function setSecret(name, options, command, redactionSpellings) {
   });
   renderResult("setSecret", profile.output, response.data, SECRET_RESULT);
 }
-function attachSecretCommands(program) {
-  const secrets = program.commands.find((command) => command.name() === "secrets");
+function attachSecretCommands(program2) {
+  const secrets = program2.commands.find((command) => command.name() === "secrets");
   if (!secrets)
     throw new Error("The generated secrets command group is missing");
   const redactionSpellings = new Set;
   secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description(describeOperation(V2_OPERATIONS.setSecret, "Create or replace a named secret")).addOption(new Option("--scope <scope>", "Secret ownership scope (required)").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value|@file>", "Secret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").option("--unredacted", `${V2_OPERATIONS.setSecret.body.unredacted.describe} Pass --no-unredacted to restore redaction`).option("--no-unredacted", "Send --unredacted as false").on("option:unredacted", () => redactionSpellings.add("--unredacted")).on("option:no-unredacted", () => redactionSpellings.add("--no-unredacted")).action((name, options, command) => setSecret(name, options, command, redactionSpellings));
 }
 
-// src/update/check.ts
-import { spawn as spawn2 } from "node:child_process";
-import {
-  closeSync,
-  constants as constants2,
-  fstatSync,
-  lstatSync,
-  mkdirSync as mkdirSync2,
-  openSync,
-  readSync as readSync2,
-  renameSync,
-  unlinkSync,
-  writeFileSync as writeFileSync2
-} from "node:fs";
-import { dirname as dirname3 } from "node:path";
-import { fileURLToPath } from "node:url";
-var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
-var REGISTRY_TIMEOUT_MS = 1000;
-var DEFAULT_REGISTRY = "https://registry.npmjs.org";
-var PACKAGE_NAME = "sim";
-var DIST_TAGS_PATH = `-/package/${PACKAGE_NAME}/dist-tags`;
-var MAX_RESPONSE_BYTES = 64 * 1024;
-var MAX_CACHE_BYTES = 4 * 1024;
-var STABLE_VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
-function parseStableVersion(version) {
-  const match = STABLE_VERSION_PATTERN.exec(version);
-  if (!match)
-    return null;
-  const parsed = [Number(match[1]), Number(match[2]), Number(match[3])];
-  return parsed.every(Number.isSafeInteger) ? parsed : null;
-}
-function isNewerVersion(candidate, current) {
-  if (candidate[0] !== current[0])
-    return candidate[0] > current[0];
-  if (candidate[1] !== current[1])
-    return candidate[1] > current[1];
-  return candidate[2] > current[2];
-}
-var CI_VARIABLES = [
-  "CI",
-  "GITHUB_ACTIONS",
-  "JENKINS_URL",
-  "TEAMCITY_VERSION",
-  "BUILDKITE"
-];
-var CACHE_VERSION = 1;
-var cacheWriteSequence = 0;
-function isEnabled(value) {
-  if (value === undefined)
-    return false;
-  const normalized = value.trim().toLowerCase();
-  return normalized !== "" && normalized !== "0" && normalized !== "false";
-}
-function isProjectLocalInstall(modulePath, cwd) {
-  const normalizedModulePath = normalizeModulePath(modulePath);
-  const nodeModulesIndex = normalizedModulePath.indexOf("/node_modules/");
-  if (nodeModulesIndex < 0)
-    return false;
-  const installRoot = normalizedModulePath.slice(0, nodeModulesIndex);
-  const workingDirectory = normalizeModulePath(cwd).replace(/\/+$/, "");
-  return workingDirectory === installRoot || workingDirectory.startsWith(`${installRoot}/`);
-}
-function isUnadvisableInstall(modulePath, env, cwd) {
-  const normalized = normalizeModulePath(modulePath);
-  return env.npm_command === "exec" || normalized.includes("/_npx/") || normalized.includes("/packages/sim-cli/") || isProjectLocalInstall(modulePath, cwd);
-}
-function normalizeModulePath(modulePath) {
-  return modulePath.replace(/\\/g, "/").toLowerCase();
-}
-function registryUrl(env) {
-  const fallback = new URL(DIST_TAGS_PATH, DEFAULT_REGISTRY);
-  const configured = env.npm_config_registry?.trim();
-  if (!configured)
-    return fallback;
-  try {
-    const base = new URL(configured);
-    if (base.protocol !== "http:" && base.protocol !== "https:")
-      return null;
-    if (base.username || base.password)
-      return null;
-    base.pathname = `${base.pathname.replace(/\/$/, "")}/${DIST_TAGS_PATH}`;
-    return base;
-  } catch {
-    return null;
-  }
-}
-var REGISTRY_REQUEST_SCRIPT = `
-let input = ''
-process.stdin.setEncoding('utf8')
-for await (const chunk of process.stdin) input += chunk
-
-try {
-  const { url, headers, maxResponseBytes, timeoutMs } = JSON.parse(input)
-  const deadline = setTimeout(() => process.exit(1), timeoutMs)
-  const response = await fetch(url, { headers, redirect: 'error' })
-  const declared = Number(response.headers.get('content-length'))
-
-  if (!response.ok || !response.body || (Number.isFinite(declared) && declared > maxResponseBytes)) {
-    process.exit(1)
-  }
-
-  const reader = response.body.getReader()
-  const chunks = []
-  let seen = 0
-
-  while (true) {
-    const { done, value } = await reader.read()
-    if (done) break
-    seen += value.byteLength
-    if (seen > maxResponseBytes) {
-      process.exit(1)
-    }
-    chunks.push(Buffer.from(value))
-  }
-
-  clearTimeout(deadline)
-  process.stdout.write(Buffer.concat(chunks), () => process.exit(0))
-} catch {
-  process.exit(1)
-}
-`;
-function registryProcessEnv() {
-  const env = { ...process.env };
-  for (const key of Object.keys(env)) {
-    const normalized = key.toLowerCase();
-    if (normalized === "npm_config_registry" || normalized === "sim_api_key")
-      delete env[key];
-  }
-  return env;
-}
-function requestRegistry(url, { headers, maxResponseBytes, timeoutMs }) {
-  return new Promise((resolve, reject) => {
-    const proxyArguments = process.execArgv.filter((argument) => argument === "--use-env-proxy" || argument === "--no-use-env-proxy");
-    const child = spawn2(process.execPath, [...proxyArguments, "--input-type=module", "--eval", REGISTRY_REQUEST_SCRIPT], {
-      env: registryProcessEnv(),
-      killSignal: "SIGKILL",
-      stdio: ["pipe", "pipe", "ignore"],
-      timeout: timeoutMs,
-      windowsHide: true
-    });
-    const chunks = [];
-    let failed = false;
-    let seen = 0;
-    child.stdout.on("data", (chunk) => {
-      seen += chunk.byteLength;
-      if (seen > maxResponseBytes) {
-        failed = true;
-        child.kill("SIGKILL");
-        return;
-      }
-      chunks.push(chunk);
-    });
-    child.stdout.on("error", () => {
-      failed = true;
-      child.kill("SIGKILL");
-    });
-    child.stdin.on("error", () => {});
-    child.once("error", reject);
-    child.once("close", (code) => {
-      resolve(code === 0 && !failed ? Buffer.concat(chunks).toString("utf8") : null);
-    });
-    child.stdin.end(JSON.stringify({ headers, maxResponseBytes, timeoutMs, url: url.href }));
-  });
-}
-async function fetchDistTags(env, request) {
-  try {
-    const url = registryUrl(env);
-    if (!url)
-      return null;
-    const text = await request(url, {
-      headers: { accept: "application/json", "user-agent": `${PACKAGE_NAME}-cli/${CLI_VERSION}` },
-      maxResponseBytes: MAX_RESPONSE_BYTES,
-      timeoutMs: REGISTRY_TIMEOUT_MS
-    });
-    if (text === null || Buffer.byteLength(text) > MAX_RESPONSE_BYTES)
-      return null;
-    const body = JSON.parse(text);
-    if (typeof body !== "object" || body === null || Array.isArray(body))
-      return null;
-    const tags = {};
-    for (const [tag, version] of Object.entries(body)) {
-      if (typeof version === "string")
-        tags[tag] = version;
-    }
-    return tags;
-  } catch {
-    return null;
-  }
-}
-function readCache(path) {
-  let descriptor = null;
-  try {
-    if (!lstatSync(path).isFile())
-      return null;
-    descriptor = openSync(path, constants2.O_RDONLY | constants2.O_NONBLOCK | constants2.O_NOFOLLOW);
-    const descriptorStats = fstatSync(descriptor);
-    if (!descriptorStats.isFile() || descriptorStats.size > MAX_CACHE_BYTES) {
-      return null;
-    }
-    const buffer = Buffer.allocUnsafe(MAX_CACHE_BYTES + 1);
-    let bytesRead = 0;
-    while (bytesRead < buffer.byteLength) {
-      const count = readSync2(descriptor, buffer, bytesRead, buffer.byteLength - bytesRead, bytesRead);
-      if (count === 0)
-        break;
-      bytesRead += count;
-    }
-    if (bytesRead > MAX_CACHE_BYTES)
-      return null;
-    const parsed = JSON.parse(buffer.subarray(0, bytesRead).toString("utf8"));
-    if (typeof parsed !== "object" || parsed === null)
-      return null;
-    const entry = parsed;
-    if (entry.version !== CACHE_VERSION)
-      return null;
-    if (typeof entry.checkedAt !== "string" || Number.isNaN(Date.parse(entry.checkedAt)))
-      return null;
-    return {
-      version: CACHE_VERSION,
-      checkedAt: entry.checkedAt
-    };
-  } catch {
-    return null;
-  } finally {
-    if (descriptor !== null) {
-      try {
-        closeSync(descriptor);
-      } catch {}
-    }
-  }
-}
-function writeCache(path, entry) {
-  let descriptor = null;
-  let temporaryCreated = false;
-  const temporaryPath = `${path}.${process.pid}.${Date.now()}.${cacheWriteSequence++}.tmp`;
-  try {
-    mkdirSync2(dirname3(path), { recursive: true, mode: 448 });
-    descriptor = openSync(temporaryPath, "wx", 420);
-    temporaryCreated = true;
-    writeFileSync2(descriptor, `${JSON.stringify(entry, null, 2)}
-`);
-    closeSync(descriptor);
-    descriptor = null;
-    renameSync(temporaryPath, path);
-    temporaryCreated = false;
-  } catch {} finally {
-    if (descriptor !== null) {
-      try {
-        closeSync(descriptor);
-      } catch {}
-    }
-    if (temporaryCreated) {
-      try {
-        unlinkSync(temporaryPath);
-      } catch {}
-    }
-  }
-}
-function isFresh(entry, now) {
-  const age = now.getTime() - Date.parse(entry.checkedAt);
-  return age >= 0 && age < CHECK_INTERVAL_MS;
-}
-function upgradeCommand(modulePath = fileURLToPath(import.meta.url), env = process.env) {
-  const target = `${PACKAGE_NAME}@latest`;
-  const normalized = normalizeModulePath(modulePath);
-  if (normalized.includes(".bun/install/global"))
-    return `bun add -g ${target}`;
-  if (normalized.includes("/pnpm/") || normalized.includes("/.pnpm/")) {
-    return `pnpm add -g ${target}`;
-  }
-  if (normalized.includes("/.yarn/") || normalized.includes("/yarn/")) {
-    return `yarn global add ${target}`;
-  }
-  const agent = env.npm_config_user_agent ?? "";
-  if (agent.startsWith("pnpm/"))
-    return `pnpm add -g ${target}`;
-  if (agent.startsWith("yarn/"))
-    return `yarn global add ${target}`;
-  if (agent.startsWith("bun/"))
-    return `bun add -g ${target}`;
-  return `npm install -g ${target}`;
-}
-async function announceUpdateIfAvailable(options = {}) {
-  try {
-    const env = options.env ?? process.env;
-    const isTty = options.isTty ?? process.stderr.isTTY === true;
-    const modulePath = options.modulePath ?? fileURLToPath(import.meta.url);
-    const cwd = options.cwd ?? process.cwd();
-    const now = options.now ?? new Date;
-    if (isEnabled(env.SIM_NO_UPDATE_CHECK))
-      return;
-    if (!isTty)
-      return;
-    if (CI_VARIABLES.some((variable) => isEnabled(env[variable])))
-      return;
-    if (isUnadvisableInstall(modulePath, env, cwd))
-      return;
-    const currentVersion = options.currentVersion ?? CLI_VERSION;
-    const current = parseStableVersion(currentVersion);
-    if (!current)
-      return;
-    const cachePath = updateCachePath();
-    const cached = readCache(cachePath);
-    if (cached && isFresh(cached, now))
-      return;
-    const tags = await fetchDistTags(env, options.registryRequest ?? requestRegistry);
-    const latest = tags?.latest ?? null;
-    const available = latest ? parseStableVersion(latest) : null;
-    writeCache(cachePath, {
-      version: CACHE_VERSION,
-      checkedAt: now.toISOString()
-    });
-    if (!latest || !available)
-      return;
-    if (!isNewerVersion(available, current))
-      return;
-    const write = options.write ?? ((message) => void process.stderr.write(message));
-    write(`Update available: sim ${currentVersion} → ${latest}. Run: ${upgradeCommand(modulePath, env)}
-`);
-  } catch {}
-}
-
 // src/program.ts
 var PROGRAM_DESCRIPTION = "Talk to the Sim API from your terminal";
 var HELP_EPILOGUE = `
@@ -16974,75 +16750,77 @@ var ROOT_VALUE_FLAGS = new Set([
 function namesASubcommandFirst(rawArgs) {
   const tokens = rawArgs.slice(2);
   for (let index = 0;index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (token === "--version" || token === "-V")
+    const token2 = tokens[index];
+    if (token2 === "--version" || token2 === "-V")
       return false;
-    if (ROOT_VALUE_FLAGS.has(token)) {
+    if (ROOT_VALUE_FLAGS.has(token2)) {
       index += 1;
       continue;
     }
-    if (token.startsWith("-"))
+    if (token2.startsWith("-"))
       continue;
     return true;
   }
   return false;
 }
-function addVersionOption(program) {
-  program.on("option:version", (value) => {
+function addVersionOption(program2) {
+  program2.on("option:version", (value) => {
     if (value === null || value === undefined) {
-      const { rawArgs } = program;
+      const { rawArgs } = program2;
       if (!namesASubcommandFirst(rawArgs ?? []))
         return;
-      program.error("error: --version reports the Sim CLI version and is not a command flag. A command that acts on a deployment version reads it from --to-version.");
+      program2.error("error: --version reports the Sim CLI version and is not a command flag. A command that acts on a deployment version reads it from --to-version.");
     }
-    program.error("error: --version reports the Sim CLI version and takes no value. A command that acts on a deployment version reads it from --to-version.");
+    program2.error("error: --version reports the Sim CLI version and takes no value. A command that acts on a deployment version reads it from --to-version.");
   });
-  program.version(CLI_VERSION, "-V, --version [none]", "output the version number (takes no value)");
+  program2.version(cliVersion(), "-V, --version [none]", "output the version number (takes no value)");
 }
 function buildProgram(options = {}) {
-  const program = new Command;
-  program.name("sim").description(PROGRAM_DESCRIPTION);
+  const program2 = options.program ?? new Command;
+  program2.name("sim").description(PROGRAM_DESCRIPTION);
   if (options.version !== false)
-    addVersionOption(program);
-  program.option("-P, --profile <name>", "Profile to use (env: SIM_PROFILE)").option("--endpoint <url>", "Sim deployment to talk to (env: SIM_ENDPOINT)").option("-w, --workspace <id>", "Workspace to target (env: SIM_WORKSPACE)").addOption(new Option("--output <format>", "Output format for this command").choices([...OUTPUT_FORMATS]));
-  program.addCommand(loginCommand());
-  program.addCommand(logoutCommand());
-  program.addCommand(whoamiCommand());
-  program.addCommand(profilesCommand());
-  program.addCommand(configureCommand());
+    addVersionOption(program2);
+  program2.option("-P, --profile <name>", "Profile to use (env: SIM_PROFILE)").option("--endpoint <url>", "Sim deployment to talk to (env: SIM_ENDPOINT)").option("-w, --workspace <id>", "Workspace to target (env: SIM_WORKSPACE)").addOption(new Option("--output <format>", "Output format for this command").choices([...OUTPUT_FORMATS]));
+  for (const command of [
+    loginCommand,
+    logoutCommand,
+    whoamiCommand,
+    profilesCommand,
+    configureCommand
+  ])
+    program2.addCommand(command());
   for (const command of buildGeneratedCommands()) {
-    program.addCommand(command);
+    program2.addCommand(command);
   }
-  attachCredentialCommands(program);
-  attachProtocolCommands(program);
-  attachSecretCommands(program);
-  program.addHelpText("after", HELP_EPILOGUE);
-  program.hook("preAction", () => announceUpdateIfAvailable());
-  refuseHelpAfterUnknownCommand(program);
-  assertNoReservedProgramFlags(program);
-  return program;
+  attachCredentialCommands(program2);
+  attachProtocolCommands(program2);
+  attachSecretCommands(program2);
+  program2.addHelpText("after", options.helpText ?? HELP_EPILOGUE);
+  refuseHelpAfterUnknownCommand(program2);
+  assertNoReservedProgramFlags(program2);
+  return program2;
 }
 
-// src/index.ts
-async function main() {
+// src/terminal.ts
+async function runTerminalCli(program2 = buildProgram()) {
   try {
-    await buildProgram().parseAsync(process.argv);
+    await program2.parseAsync(process.argv);
   } catch (error) {
     if (error instanceof ProfileConfigError) {
-      console.error(source_default.red(`Error: ${sanitize(error.message)}`));
+      console.error(styles3().red(`Error: ${sanitize(error.message)}`));
       process.exit(1);
     }
     if (isRequestTimeout(error)) {
-      console.error(source_default.red(`Error: the request timed out. ${RAISE_TIMEOUT_HINT}`));
+      console.error(styles3().red(`Error: the request timed out. ${RAISE_TIMEOUT_HINT}`));
       process.exit(1);
     }
     if (error instanceof SimApiError) {
-      console.error(source_default.red(`Error: ${sanitize(error.message)}`));
+      console.error(styles3().red(`Error: ${sanitize(error.message)}`));
       if (error.code)
-        console.error(source_default.dim(`  code: ${sanitize(error.code)}`));
+        console.error(styles3().dim(`  code: ${sanitize(error.code)}`));
       if (error.details !== undefined) {
         for (const line of formatApiErrorDetails(error.details)) {
-          console.error(source_default.dim(sanitize(line)));
+          console.error(styles3().dim(sanitize(line)));
         }
       }
       process.exit(1);
@@ -17050,4 +16828,6 @@ async function main() {
     throw error;
   }
 }
-main();
+
+// src/index.ts
+runTerminalCli();