diff --git a/lib/llm/index.js b/lib/llm/index.js
index fec8d0c..9703797 100644
--- a/lib/llm/index.js
+++ b/lib/llm/index.js
@@ -588,7 +588,7 @@ The \`--body\` flag replaces the whole page content; pass \`--append\` to add to
   n8nctl: {
     filename: 'cli-n8nctl.md',
     name: 'n8nctl',
-    purpose: 'n8n workflow management, execution, variables, and source control',
+    purpose: 'n8n workflows, versions, executions, data tables, variables, and source control',
     content: `## n8n Workflow CLI (n8nctl)
 
 CLI for managing n8n workflows - pull/push for version control, execute workflows, and manage multiple instances.
@@ -641,6 +641,23 @@ n8nctl workflow deactivate <id>
 n8nctl workflow transfer <id> <project-id>
 \`\`\`
 
+### Workflow versions and publishing
+
+n8n keeps a draft (\`versionId\`) and a published version (\`activeVersionId\`). \`workflow view\` shows both and whether the draft has unpublished changes.
+
+\`\`\`bash
+n8nctl workflow history <id>                  # Saved versions, newest first
+n8nctl workflow version <id> <version-id>     # One saved version as JSON
+n8nctl workflow publish <id>                  # Publish the current draft
+n8nctl workflow publish <id> --version <version-id>  # Publish / roll back to a specific version
+n8nctl workflow unpublish <id>
+n8nctl workflow archive <id>                  # Soft delete (unpublishes)
+n8nctl workflow unarchive <id>
+n8nctl workflow delete <id>                   # Permanent; archive or unpublish first
+\`\`\`
+
+- \`workflow push\` to a published workflow publishes the new version immediately.
+
 ### Projects
 
 \`\`\`bash
@@ -670,6 +687,8 @@ n8nctl execution list --resolve-names # Show workflow names (slower)
 n8nctl execution view <id>            # View execution details
 n8nctl execution retry <id>           # Retry failed execution
 n8nctl execution delete <id>          # Delete execution
+n8nctl execution stop <id>            # Stop a running/waiting execution
+n8nctl execution stop --status running,waiting --workflow <id>  # Bulk stop
 \`\`\`
 
 ### Source control (instance Git connection)
@@ -690,10 +709,61 @@ n8nctl source-control pull --force    # Discard conflicting local changes
 - A 409 lists the conflicting items; check them before rerunning with \`--force\`.
 - 403 means the API key lacks \`sourceControl:read\` / \`sourceControl:push\` / \`sourceControl:pull\`, or source control is not connected.
 
+### Data tables
+
+\`\`\`bash
+n8nctl dt list                        # Data tables (alias of datatable)
+n8nctl dt view <table-id>             # Columns
+n8nctl dt rows <table-id> --where 'status=pending' --where 'n>=10' --sort n:desc
+n8nctl dt rows <table-id> --where 'name~%inv%' --where 'name~%rech%' --or   # --or: match any condition
+n8nctl dt rows <table-id> --search foo
+n8nctl dt insert <table-id> --data '{"k":"a"}'    # Object or array (use --data - to read stdin)
+n8nctl dt update <table-id> --where 'k=a' --data '{"status":"done"}' --dry-run
+n8nctl dt upsert <table-id> --where 'k=a' --data '{"k":"a","n":1}'
+n8nctl dt delete-rows <table-id> --where 'k=a' --dry-run
+\`\`\`
+
+- \`--where\` operators: \`= != > >= < <= ~\` (\`~\` = case-insensitive LIKE, \`%\` wildcard); use \`--filter '<json>'\` for typed values.
+- Run writes with \`--dry-run\` first; date-column comparisons do not match stored UTC timestamps exactly.
+
+### Credentials, tags, folders, users, audit
+
+\`\`\`bash
+n8nctl cred list                      # ID, type, owning project (alias of credential)
+n8nctl cred test <id>                 # Exits non-zero when the test fails
+n8nctl cred schema <type>             # JSON schema of a credential type
+n8nctl cred delete <id>
+n8nctl tag list
+n8nctl tag create <name>
+n8nctl tag rename <tag-id> <new-name>
+n8nctl tag delete <tag-id>
+n8nctl folder list --project <project-id>
+n8nctl folder view <folder-id> --project <project-id>
+n8nctl folder create <name> --project <project-id> --parent <folder-id>
+n8nctl folder update <folder-id> --project <project-id> --name <new-name>
+n8nctl folder delete <folder-id> --project <project-id> --transfer-to <target-folder-id>  # without --transfer-to its workflows are archived
+n8nctl user list --project <project-id>  # omit --project for all users
+n8nctl user view <user-id-or-email>
+n8nctl project member list <project-id>
+n8nctl project member add <project-id> <user-id> --role project:editor   # changes access: confirm with the user first
+n8nctl project member set-role <project-id> <user-id> project:viewer   # role is positional
+n8nctl project member remove <project-id> <user-id>
+n8nctl audit --categories credentials,nodes   # Security audit JSON; omit --categories for all
+\`\`\`
+
+- A 403 means the API key lacks the scope for that command (e.g. \`folder:list\`, \`dataTableRow:read\`).
+
+### Safety Rules
+
+**Safety**: Before any n8nctl operation on a production instance that deactivates, deletes, archives, unpublishes, changes access, or pulls source control (for example \`workflow deactivate\`, \`workflow push\`, \`workflow delete\`, \`workflow archive\`, \`workflow unpublish\`, \`credential delete\`, \`folder delete\`, \`variable delete\`, \`tag delete\`, \`dt delete-rows\`, \`project member add\`/\`set-role\`/\`remove\`, \`source-control pull\`):
+1. Check the active instance: \`n8nctl config list\`
+2. Show the command and the target instance to the user
+3. Ask for explicit confirmation before executing
+
 ### Tips
 
 - Use \`--json\` flag on any command for JSON output (useful for scripting)
-- Aliases: \`workflow\` → \`wf\`, \`execution\` → \`exec\`, \`variable\` → \`var\`, \`source-control\` → \`sc\`
+- Aliases: \`workflow\` → \`wf\`, \`execution\` → \`exec\`, \`variable\` → \`var\`, \`source-control\` → \`sc\`, \`datatable\` → \`dt\`, \`credential\` → \`cred\`
 - Recursive pull creates \`manifest.json\` tracking workflow dependencies
 - Push with manifest handles sub-workflow ID remapping automatically
 `,
@@ -1263,6 +1333,11 @@ ${rows}
 \`atl --context <alias-or-hostname>\`. Never rely on or mutate atl's shared
 persistent context from an agent session.
 
+**Safety**: Before any n8nctl operation on a production instance that deactivates, deletes, archives, unpublishes, changes access, or pulls source control (for example \`workflow deactivate\`, \`workflow push\`, \`workflow delete\`, \`workflow archive\`, \`workflow unpublish\`, \`credential delete\`, \`folder delete\`, \`variable delete\`, \`tag delete\`, \`dt delete-rows\`, \`project member add\`/\`set-role\`/\`remove\`, \`source-control pull\`):
+1. Check the active instance: \`n8nctl config list\`
+2. Show the command and the target instance to the user
+3. Ask for explicit confirmation before executing
+
 **Safety**: Before executing any M365 write or delete operation (add, set, remove, copy, move):
 1. Show the full command and target URL to the user
 2. Ask for explicit confirmation before executing