sim 2.1.0-dev.24.1 → 2.1.0-dev.32.1

package/README.md

@@ -12,9 +12,9 @@ Full documentation: **https://docs.sim.ai/cli**
 
 ## Profiles
 
-Profiles work like the AWS CLI: one identity and one set of defaults per named
-profile, selected with `-P`, `--profile`, or `SIM_PROFILE`. This is what lets you keep
-production and a local dev stack side by side without re-authenticating.
+Profiles work like the AWS CLI and are selected with `-P`, `--profile`, or
+`SIM_PROFILE`. A profile normally owns one identity and one set of defaults; a
+workspace profile can instead share a stored identity through `auth_profile`.
 
 Non-secret settings live in `~/.sim/config`:
 
@@ -27,6 +27,10 @@ output = table
 [profile dev]
 endpoint = http://localhost:3000
 workspace = ws_local
+
+[profile acme]
+auth_profile = default
+workspace = ws_acme
 ```
 
 Keys live in `~/.sim/credentials`, written `0600`:
@@ -45,7 +49,8 @@ The section-naming asymmetry — `[profile dev]` in config, `[dev]` in credentia
 ```bash
 sim configure --set-endpoint http://localhost:3000 --profile dev
 sim configure --set-workspace ws_local --profile dev
-sim profiles          # list them; * marks the active one
+sim profiles                                      # list them; * marks the active one
+sim profile add acme --workspace ws_acme          # share the active stored login
 sim whoami            # resolved values, where each came from, and whether they work
 ```
 
@@ -62,7 +67,7 @@ Each setting resolves independently, first match wins:
 indefinitely) and `SIM_DEBUG=1` traces requests to stderr. Node ignores
 `HTTPS_PROXY` unless `NODE_USE_ENV_PROXY=1` is also set, on Node 22.21+ or
 24.5+; the CLI warns when a proxy is configured but will not be used.
-| 3 | `~/.sim/config` / `~/.sim/credentials` for the selected profile |
+| 3 | `~/.sim/config` for the selected profile and credentials for its `auth_profile`, when set |
 | 4 | Built-in default (`https://www.sim.ai`, `table`) |
 
 Formats are listed under [Output formats](#output-formats).
@@ -112,8 +117,11 @@ the key can access.
 `sim login --workspace <id>` preselects a workspace in the picker, and an
 existing profile's workspace preselects itself on re-login.
 
-`sim logout` removes the stored key. It does not revoke it — do that in
-Settings → API keys.
+`sim logout` removes the stored key. A shared workspace profile cannot remove
+its authentication profile's key; use `sim logout --all --profile <name>` to
+remove only the workspace profile. An authentication profile cannot be removed
+entirely while workspace profiles reference it. Logging out does not revoke a
+key — do that in Settings → API keys.
 
 ## Commands
 
@@ -147,6 +155,7 @@ sim logs get <runId>
 sim audit-logs list --organization <organizationId> [--all-workspaces]
 sim audit-logs get <id> --organization <organizationId>
 
+sim workspaces list
 sim workspaces get
 sim workspaces members
 

package/dist/index.js

@@ -2432,6 +2432,33 @@ function readConfigProfile(profile) {
 function readCredentialsProfile(profile) {
   return getSection(readIni(credentialsPath()), profile) ?? {};
 }
+function resolveAuthenticationProfileName(profile) {
+  const config = readConfigProfile(profile);
+  if (!Object.hasOwn(config, "auth_profile"))
+    return profile;
+  const authProfile = config.auth_profile.trim();
+  if (!authProfile) {
+    throw new ProfileConfigError(`Profile "${profile}" has an empty auth_profile.`);
+  }
+  if (authProfile === profile) {
+    throw new ProfileConfigError(`Profile "${profile}" cannot use itself as auth_profile. Remove the auth_profile setting instead.`);
+  }
+  if (Object.hasOwn(config, "endpoint")) {
+    throw new ProfileConfigError(`Profile "${profile}" cannot set both auth_profile and endpoint. Set the endpoint on authentication profile "${authProfile}".`);
+  }
+  if (readCredentialsProfile(profile).api_key) {
+    throw new ProfileConfigError(`Profile "${profile}" cannot set both auth_profile and its own API key. Remove one of them.`);
+  }
+  const authConfig = readConfigProfile(authProfile);
+  const credentials = readCredentialsProfile(authProfile);
+  if (Object.keys(authConfig).length === 0 && Object.keys(credentials).length === 0) {
+    throw new ProfileConfigError(`Profile "${profile}" references missing auth_profile "${authProfile}".`);
+  }
+  if (Object.hasOwn(authConfig, "auth_profile")) {
+    throw new ProfileConfigError(`Profile "${profile}" references auth_profile "${authProfile}", which also has auth_profile set. Authentication profile references cannot be chained.`);
+  }
+  return authProfile;
+}
 function listProfiles() {
   const names = new Set;
   for (const section of listSections(readIni(configPath()))) {
@@ -2445,6 +2472,9 @@ function listProfiles() {
   }
   return [...names].sort();
 }
+function listAuthenticationDependents(authProfile) {
+  return listProfiles().filter((profile) => profile !== authProfile && readConfigProfile(profile).auth_profile?.trim() === authProfile);
+}
 function writeConfigProfile(profile, values) {
   const doc = readIni(configPath());
   setSectionValues(doc, configSectionName(profile), values);
@@ -2489,11 +2519,13 @@ function resolve(candidates, fallback, fallbackSource) {
 function resolveProfile(overrides = {}) {
   const name = overrides.profile || process.env.SIM_PROFILE || DEFAULT_PROFILE;
   const config = readConfigProfile(name);
-  const credentials = readCredentialsProfile(name);
+  const authProfile = resolveAuthenticationProfileName(name);
+  const authConfig = authProfile === name ? config : readConfigProfile(authProfile);
+  const credentials = readCredentialsProfile(authProfile);
   const endpoint = resolve([
     ["flag", overrides.endpoint],
     ["env", process.env.SIM_ENDPOINT],
-    ["config", config.endpoint]
+    ["config", authConfig.endpoint]
   ], DEFAULT_ENDPOINT, "default");
   const apiKey = resolve([
     ["flag", overrides.apiKey],
@@ -6759,6 +6791,40 @@ var V2_OPERATIONS = {
       }
     }
   },
+  createKnowledgeConnector: {
+    method: "POST",
+    path: "/api/v2/knowledge/[id]/connectors",
+    pathParams: ["id"],
+    pathParamDocs: { id: "Unique knowledge base identifier." },
+    responseMode: "json",
+    summary: "Create Knowledge Connector",
+    body: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      connectorType: { kind: "string", required: true, describe: "Registered connector type." },
+      credentialId: {
+        kind: "string",
+        describe: "OAuth credential identifier for connectors that require OAuth."
+      },
+      apiKey: {
+        kind: "string",
+        describe: "Write-only API key for connectors that use API-key authentication."
+      },
+      sourceConfig: {
+        kind: "object",
+        required: true,
+        describe: "Connector-specific source selection and filtering configuration."
+      },
+      syncIntervalMinutes: {
+        kind: "integer",
+        default: 1440,
+        describe: "Scheduled synchronization interval in minutes; zero disables scheduling."
+      }
+    }
+  },
   createKnowledgeDocumentUpload: {
     method: "POST",
     path: "/api/v2/knowledge/[id]/documents/uploads",
@@ -6923,22 +6989,11 @@ var V2_OPERATIONS = {
         kind: "string",
         describe: "Required only when provider discovery requests a client-generated ID."
       },
-      serviceAccountJson: {
+      credentials: {
         kind: "string",
-        describe: "Write-only Google service-account JSON key."
-      },
-      apiToken: { kind: "string", describe: "Write-only provider API token." },
-      domain: { kind: "string", describe: "Provider account domain." },
-      signingSecret: { kind: "string", describe: "Write-only webhook signing secret." },
-      botToken: { kind: "string", describe: "Write-only bot token." },
-      clientId: { kind: "string", describe: "OAuth client identifier." },
-      clientSecret: { kind: "string", describe: "Write-only OAuth client secret." },
-      certificateId: { kind: "string", describe: "Provider certificate mapping identifier." },
-      orgId: { kind: "string", describe: "Provider organization ID." },
-      dataCenter: { kind: "string", describe: "Provider data center." },
-      authMethod: { kind: "string", describe: "Provider authentication method." },
-      privateKey: { kind: "string", describe: "Write-only PEM private key." },
-      username: { kind: "string", describe: "Provider run-as username." }
+        required: true,
+        describe: "Write-only JSON object string containing the fields declared by credential-provider discovery."
+      }
     }
   },
   createSkill: {
@@ -7206,6 +7261,28 @@ var V2_OPERATIONS = {
       }
     }
   },
+  deleteKnowledgeConnector: {
+    method: "DELETE",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "Delete Knowledge Connector",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      deleteDocuments: {
+        kind: "boolean",
+        describe: "Also permanently delete documents produced by this connector."
+      }
+    }
+  },
   deleteKnowledgeDocument: {
     method: "DELETE",
     path: "/api/v2/knowledge/[id]/documents/[documentId]",
@@ -7632,6 +7709,24 @@ var V2_OPERATIONS = {
       }
     }
   },
+  getKnowledgeConnector: {
+    method: "GET",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "Get Knowledge Connector",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      }
+    }
+  },
   getKnowledgeDocument: {
     method: "GET",
     path: "/api/v2/knowledge/[id]/documents/[documentId]",
@@ -7799,6 +7894,24 @@ var V2_OPERATIONS = {
     responseMode: "json",
     summary: "Get Workspace"
   },
+  grantSkillEditor: {
+    method: "POST",
+    path: "/api/v2/skills/[id]/editors",
+    pathParams: ["id"],
+    pathParamDocs: {
+      id: "Unique skill identifier. A built-in skill is `builtin-` followed by its name, for example `builtin-research`."
+    },
+    responseMode: "json",
+    summary: "Grant Skill Editor",
+    body: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
+      email: {
+        kind: "string",
+        required: true,
+        describe: "Email address of a current workspace member."
+      }
+    }
+  },
   importWorkflow: {
     method: "POST",
     path: "/api/v2/workflows/import",
@@ -8071,7 +8184,25 @@ var V2_OPERATIONS = {
       },
       folderPath: {
         kind: "string",
-        describe: "Restrict results to files directly inside this folder. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
+        describe: "Restrict results to files inside this folder — its direct children, or its whole subtree when `recursive` is true. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
+      },
+      recursive: {
+        kind: "enum",
+        values: [
+          "true",
+          "1",
+          "yes",
+          "on",
+          "y",
+          "enabled",
+          "false",
+          "0",
+          "no",
+          "off",
+          "n",
+          "disabled"
+        ],
+        describe: "Whether the folder filter includes files in subfolders. Defaults to true when a search is set, false otherwise, so listing a folder shows that folder while searching one looks through everything in it. Ignored when no folder filter is set, which already spans the workspace. The listed spellings are the whole accepted vocabulary and are case-sensitive; any other value is rejected."
       },
       scope: {
         kind: "enum",
@@ -8149,6 +8280,73 @@ var V2_OPERATIONS = {
       }
     }
   },
+  listKnowledgeConnectorDocuments: {
+    method: "GET",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]/documents",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "List Knowledge Connector Documents",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      includeExcluded: {
+        kind: "boolean",
+        describe: "Include documents explicitly excluded by a user."
+      },
+      limit: {
+        kind: "integer",
+        default: 50,
+        describe: "Maximum connector documents to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
+      }
+    }
+  },
+  listKnowledgeConnectors: {
+    method: "GET",
+    path: "/api/v2/knowledge/[id]/connectors",
+    pathParams: ["id"],
+    pathParamDocs: { id: "Unique knowledge base identifier." },
+    responseMode: "json",
+    summary: "List Knowledge Connectors",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      sortBy: {
+        kind: "enum",
+        values: ["connectorType", "createdAt", "updatedAt"],
+        default: "createdAt",
+        describe: "Field used to sort the result."
+      },
+      sortOrder: {
+        kind: "enum",
+        values: ["asc", "desc"],
+        default: "desc",
+        describe: "Sort direction."
+      },
+      limit: {
+        kind: "integer",
+        default: 50,
+        describe: "Maximum connectors to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
+      }
+    }
+  },
   listKnowledgeDocuments: {
     method: "GET",
     path: "/api/v2/knowledge/[id]/documents",
@@ -8444,6 +8642,40 @@ var V2_OPERATIONS = {
       }
     }
   },
+  listSkillEditors: {
+    method: "GET",
+    path: "/api/v2/skills/[id]/editors",
+    pathParams: ["id"],
+    pathParamDocs: {
+      id: "Unique skill identifier. A built-in skill is `builtin-` followed by its name, for example `builtin-research`."
+    },
+    responseMode: "json",
+    summary: "List Skill Editors",
+    query: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
+      sortBy: {
+        kind: "enum",
+        values: ["email", "name"],
+        default: "email",
+        describe: "Field used to sort the result. Sorting by `name` is case-sensitive and follows the storage collation, so do not rely on a case-insensitive order."
+      },
+      sortOrder: {
+        kind: "enum",
+        values: ["asc", "desc"],
+        default: "asc",
+        describe: "Sort direction."
+      },
+      limit: {
+        kind: "integer",
+        default: 50,
+        describe: "Maximum skill editors to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
+      }
+    }
+  },
   listSkills: {
     method: "GET",
     path: "/api/v2/skills",
@@ -8756,6 +8988,36 @@ var V2_OPERATIONS = {
       }
     }
   },
+  listWorkspaces: {
+    method: "GET",
+    path: "/api/v2/workspaces",
+    pathParams: [],
+    responseMode: "json",
+    summary: "List Workspaces",
+    query: {
+      sortBy: {
+        kind: "enum",
+        values: ["name", "createdAt", "updatedAt"],
+        default: "createdAt",
+        describe: "Field used to sort the result. Sorting by `name` is case-sensitive and follows the storage collation, so do not rely on a case-insensitive order."
+      },
+      sortOrder: {
+        kind: "enum",
+        values: ["asc", "desc"],
+        default: "desc",
+        describe: "Sort direction."
+      },
+      limit: {
+        kind: "integer",
+        default: 50,
+        describe: "Maximum workspaces to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
+      }
+    }
+  },
   moveFileItems: {
     method: "POST",
     path: "/api/v2/files/move",
@@ -8782,7 +9044,7 @@ var V2_OPERATIONS = {
       workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
       predicate: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       sort: { kind: "array", describe: "Ordered table-row sort specification." },
       limit: {
@@ -8803,7 +9065,7 @@ var V2_OPERATIONS = {
       workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
       predicate: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       }
     }
   },
@@ -8914,6 +9176,24 @@ var V2_OPERATIONS = {
       input: { kind: "unknown", describe: "Input supplied to the paused workflow block." }
     }
   },
+  revokeSkillEditor: {
+    method: "DELETE",
+    path: "/api/v2/skills/[id]/editors",
+    pathParams: ["id"],
+    pathParamDocs: {
+      id: "Unique skill identifier. A built-in skill is `builtin-` followed by its name, for example `builtin-research`."
+    },
+    responseMode: "json",
+    summary: "Revoke Skill Editor",
+    query: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
+      email: {
+        kind: "string",
+        required: true,
+        describe: "Email address of a current workspace member."
+      }
+    }
+  },
   rollbackWorkflow: {
     method: "POST",
     path: "/api/v2/workflows/[id]/rollback",
@@ -9053,6 +9333,29 @@ var V2_OPERATIONS = {
       }
     }
   },
+  syncKnowledgeConnector: {
+    method: "POST",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]/sync",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "Sync Knowledge Connector",
+    body: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      rehydrate: {
+        kind: "boolean",
+        default: false,
+        describe: "Re-fetch and re-index every existing connector document."
+      }
+    }
+  },
   tableExportDownload: {
     method: "GET",
     path: "/api/v2/tables/exports/[exportId]/download",
@@ -9135,6 +9438,66 @@ var V2_OPERATIONS = {
       folderPath: { kind: "string", describe: "New containing-folder path." }
     }
   },
+  updateKnowledgeConnector: {
+    method: "PATCH",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "Update Knowledge Connector",
+    body: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      sourceConfig: {
+        kind: "object",
+        describe: "Replacement source selection and filtering configuration."
+      },
+      syncIntervalMinutes: {
+        kind: "integer",
+        describe: "New scheduled synchronization interval in minutes."
+      },
+      status: {
+        kind: "enum",
+        values: ["active", "paused"],
+        describe: "New connector state."
+      }
+    }
+  },
+  updateKnowledgeConnectorDocuments: {
+    method: "PATCH",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]/documents",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "Update Knowledge Connector Documents",
+    body: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      operation: {
+        kind: "enum",
+        required: true,
+        values: ["restore", "exclude"],
+        describe: "Whether to restore or exclude the selected documents."
+      },
+      documentIds: {
+        kind: "array",
+        required: true,
+        describe: "Connector document identifiers to update."
+      }
+    }
+  },
   updateKnowledgeDocument: {
     method: "PATCH",
     path: "/api/v2/knowledge/[id]/documents/[documentId]",
@@ -9463,6 +9826,8 @@ var V2_OPERATIONS = {
 };
 
 // src/commands/auth.ts
+var PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var MAX_INTERACTIVE_WORKSPACES = 1000;
 function openBrowser(url) {
   const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : [process.platform === "darwin" ? "open" : "xdg-open", [url]];
   try {
@@ -9498,9 +9863,91 @@ async function confirmProfileOverwrite(profileName) {
     prompt.close();
   }
 }
+function selectedProfileName(command) {
+  return globalsOf(command).profile || process.env.SIM_PROFILE || DEFAULT_PROFILE;
+}
+function validateNewProfileName(profileName) {
+  if (!PROFILE_NAME_PATTERN.test(profileName)) {
+    throw new SimApiError(`Invalid profile name "${profileName}". Use letters, numbers, dots, underscores, or hyphens, starting with a letter or number.`, 0);
+  }
+  if (listProfiles().includes(profileName)) {
+    throw new SimApiError(`Profile "${profileName}" already exists. Remove it first with: sim logout --all --profile ${profileName}`, 0);
+  }
+}
+function requireStoredAuthentication(profile) {
+  const authProfile = resolveAuthenticationProfileName(profile.name);
+  const storedKey = readCredentialsProfile(authProfile).api_key;
+  if (profile.sources.apiKey !== "credentials" || !storedKey) {
+    throw new SimApiError(`Cannot create a shared profile from "${profile.name}": the active API key is not stored. Run: sim login --profile ${authProfile}`, 0);
+  }
+  if (profile.sources.endpoint === "flag" || profile.sources.endpoint === "env") {
+    throw new SimApiError(`Cannot create a shared profile from "${profile.name}": the active endpoint comes from ${profile.sources.endpoint}. Save it with: sim configure --profile ${authProfile} --set-endpoint ${profile.endpoint}`, 0);
+  }
+  return authProfile;
+}
+async function getWorkspaceById(client, workspaceId) {
+  const operation = V2_OPERATIONS.getWorkspace;
+  const response = await client.request(resolvePath(operation.path, { workspaceId }), { method: operation.method });
+  return response.data;
+}
+async function chooseWorkspace(client) {
+  if (!process.stdin.isTTY) {
+    throw new SimApiError("No workspace provided. Pass --workspace <id> when creating a profile non-interactively.", 0);
+  }
+  const operation = V2_OPERATIONS.listWorkspaces;
+  const workspaces = await requestAllPages(client, operation.path, {
+    method: operation.method,
+    query: { sortBy: "name", sortOrder: "asc" },
+    pageSize: 100,
+    limit: MAX_INTERACTIVE_WORKSPACES + 1
+  });
+  if (workspaces.length === 0) {
+    throw new SimApiError("The active API key cannot access any workspaces.", 0);
+  }
+  if (workspaces.length > MAX_INTERACTIVE_WORKSPACES) {
+    throw new SimApiError(`The active API key can access more than ${MAX_INTERACTIVE_WORKSPACES} workspaces, which is too many to show interactively. Pass --workspace <id> instead.`, 0);
+  }
+  console.log(`
+Available workspaces:`);
+  for (const [index, workspace] of workspaces.entries()) {
+    console.log(`  ${index + 1}) ${safeOneLine(workspace.name)} (${workspace.id})`);
+  }
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await prompt.question(`Choose a workspace [1-${workspaces.length}]: `);
+    const selected = Number(answer.trim());
+    if (!Number.isInteger(selected) || selected < 1 || selected > workspaces.length) {
+      throw new SimApiError(`Invalid workspace selection "${safeOneLine(answer)}". Choose a number from 1 to ${workspaces.length}.`, 0);
+    }
+    return workspaces[selected - 1];
+  } finally {
+    prompt.close();
+  }
+}
+function addProfileCommand() {
+  return new Command("add").description("Add a workspace profile that shares the active stored login").argument("<name>", "Name for the new profile").option("-w, --workspace <id>", "Existing workspace to use; omit for an interactive picker").action(async (profileName, _options, command) => {
+    validateNewProfileName(profileName);
+    const { client, profile } = clientFrom(command);
+    const authProfile = requireStoredAuthentication(profile);
+    const workspaceId = globalsOf(command).workspace;
+    const workspace = workspaceId ? await getWorkspaceById(client, workspaceId) : await chooseWorkspace(client);
+    writeConfigProfile(profileName, {
+      auth_profile: authProfile,
+      workspace: workspace.id
+    });
+    console.log(source_default.green(`✓ Added profile "${profileName}" in ${configPath()}`));
+    console.log(`  Workspace: ${safeOneLine(workspace.name)} (${workspace.id})`);
+    console.log(`  Authentication: ${authProfile}`);
+    console.log(source_default.dim(`  Try: sim --profile ${profileName} whoami`));
+  });
+}
 function loginCommand() {
   return new Command("login").description("Authorize this terminal and store an API key for the profile").option("--scope <scope>", "Key space to mint from: platform or copilot", "platform").option("--no-browser", "Print the URL instead of opening a browser").option("-y, --yes", "Overwrite an existing profile without prompting").action(async (options, command) => {
     const profile = profileFrom(command);
+    const authProfile = resolveAuthenticationProfileName(profile.name);
+    if (authProfile !== profile.name) {
+      throw new SimApiError(`Profile "${profile.name}" shares authentication with "${authProfile}". Run: sim login --profile ${authProfile}`, 0);
+    }
     if (options.scope !== "platform" && options.scope !== "copilot") {
       throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
     }
@@ -9547,16 +9994,25 @@ Waiting for approval…`));
 }
 function logoutCommand() {
   return new Command("logout").description("Remove the profile's stored API key").option("--all", "Remove the profile entirely, including its settings").action((options, command) => {
-    const profile = profileFrom(command);
     if (options.all) {
-      const removed = deleteProfile(profile.name);
+      const profileName = selectedProfileName(command);
+      const dependents = listAuthenticationDependents(profileName);
+      if (dependents.length > 0) {
+        throw new SimApiError(`Cannot remove authentication profile "${profileName}" because it is used by: ${dependents.join(", ")}. Remove those profiles first.`, 0);
+      }
+      const removed = deleteProfile(profileName);
       if (!removed.config && !removed.credentials) {
-        console.log(source_default.dim(`Nothing stored for profile "${profile.name}".`));
+        console.log(source_default.dim(`Nothing stored for profile "${profileName}".`));
         return;
       }
-      console.log(source_default.green(`✓ Removed profile "${profile.name}".`));
+      console.log(source_default.green(`✓ Removed profile "${profileName}".`));
       return;
     }
+    const profile = profileFrom(command);
+    const authProfile = resolveAuthenticationProfileName(profile.name);
+    if (authProfile !== profile.name) {
+      throw new SimApiError(`Profile "${profile.name}" shares authentication with "${authProfile}". Log out of the authentication profile instead: sim logout --profile ${authProfile}`, 0);
+    }
     if (!readCredentialsProfile(profile.name).api_key) {
       console.log(source_default.dim(`No stored key for profile "${profile.name}".`));
       return;
@@ -9664,27 +10120,38 @@ function whoamiCommand() {
   });
 }
 function profilesCommand() {
-  return new Command("profiles").alias("profile").description("List the profiles defined in the config and credentials files").action((_options, command) => {
+  const command = new Command("profiles").alias("profile").description("List profiles or add a workspace profile that shares a stored login");
+  const printProfiles = (_options, actionCommand) => {
     const profiles = listProfiles();
     if (profiles.length === 0) {
       console.log(source_default.dim("No profiles yet. Run: sim login"));
       return;
     }
-    const active = profileFrom(command).name;
+    const active = selectedProfileName(actionCommand);
     for (const name of profiles) {
       const marker = name === active ? source_default.green("*") : " ";
-      const hasKey = Boolean(readCredentialsProfile(name).api_key);
-      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}`);
+      const authProfile = resolveAuthenticationProfileName(name);
+      const hasKey = Boolean(readCredentialsProfile(authProfile).api_key);
+      const authentication = authProfile === name ? "" : source_default.dim(`  (auth: ${authProfile})`);
+      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}${authentication}`);
     }
-  });
+  };
+  command.action(printProfiles);
+  command.addCommand(new Command("list").description("List configured profiles").action(printProfiles));
+  command.addCommand(addProfileCommand());
+  return command;
 }
 
 // src/commands/configure.ts
 function configureCommand() {
   return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
     const profile = profileFrom(command);
+    const authProfile = resolveAuthenticationProfileName(profile.name);
     const updates = {};
     if (options.setEndpoint) {
+      if (authProfile !== profile.name) {
+        throw new SimApiError(`Profile "${profile.name}" shares its endpoint with authentication profile "${authProfile}". Run: sim configure --profile ${authProfile} --set-endpoint ${options.setEndpoint}`, 0);
+      }
       updates.endpoint = normalizeEndpoint(options.setEndpoint, "--set-endpoint");
     }
     if (options.setWorkspace)
@@ -9699,6 +10166,9 @@ function configureCommand() {
       if (!["endpoint", "workspace", "output"].includes(key)) {
         throw new SimApiError(`Cannot unset "${key}". Use endpoint, workspace, or output.`, 0);
       }
+      if (key === "endpoint" && authProfile !== profile.name) {
+        throw new SimApiError(`Profile "${profile.name}" shares its endpoint with authentication profile "${authProfile}". Run: sim configure --profile ${authProfile} --unset endpoint`, 0);
+      }
       updates[key] = null;
     }
     if (Object.keys(updates).length === 0) {
@@ -9723,6 +10193,7 @@ import { existsSync as existsSync2, readFileSync as readFileSync3, readSync } fr
 // src/contract/commands.ts
 var TABLE_NAME_HELP = "Identifier: letters, numbers, and underscores; cannot start with a number";
 var TABLE_FILTER_HELP = 'Predicate: {"all":[{"field":"status","op":"eq","value":"active"}]}; groups use all/any. Operators: eq, ne, gt, gte, lt, lte, in, nin, contains, ncontains, startsWith, endsWith, like, ilike, nlike, nilike, isEmpty, isNotEmpty, isNull, isNotNull';
+var TABLE_READ_FILTER_HELP = 'Condition: {"field":"status","op":"eq","value":"active"}. Groups: {"all":[{"field":"status","op":"eq","value":"active"}]} or {"any":[{"field":"status","op":"eq","value":"active"}]}; group entries may also be nested groups. Operators: eq, ne, gt, gte, lt, lte, in, nin, contains, ncontains, startsWith, endsWith, like, ilike, nlike, nilike, isEmpty, isNotEmpty, isNull, isNotNull';
 var TABLE_SORT_HELP = 'Ordered sort keys: [{"field":"createdAt","direction":"desc"}] (direction: asc or desc)';
 var CUSTOM_TOOL_SCHEMA_HELP = 'OpenAI function schema: {"type":"function","function":{"name":"...","parameters":{"type":"object","properties":{}}}}';
 var FOLDER_PATH_INPUT = {
@@ -9825,6 +10296,15 @@ var CLI_CONTRACT = {
       selectAll: { boolean: true, describe: "Apply to every document in the knowledge base" }
     }
   },
+  listKnowledgeConnectorDocuments: {
+    command: "knowledge connectors documents list"
+  },
+  updateKnowledgeConnectorDocuments: {
+    command: "knowledge connectors documents update",
+    flags: {
+      documentIds: { name: "document", list: true }
+    }
+  },
   undeployWorkflow: {
     command: "workflows undeploy",
     describe: "Take a workflow out of deployment"
@@ -9846,11 +10326,17 @@ var CLI_CONTRACT = {
     pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     confirm: "This deletes the document and its embeddings."
   },
+  deleteKnowledgeConnector: {
+    confirm: "This deletes the connector; --delete-documents also deletes its synchronized documents."
+  },
   deleteFile: { confirm: "This archives the file." },
   deleteCredential: {
     confirm: "This disconnects the credential and removes its stored authentication."
   },
   deleteSkill: { confirm: "This deletes the skill." },
+  revokeSkillEditor: {
+    confirm: "This revokes the explicit skill editor grant for the selected email."
+  },
   deleteCustomTool: { confirm: "This deletes the custom tool." },
   deleteMcpServer: {
     confirm: "This removes the MCP server and the tools it provides."
@@ -9946,7 +10432,7 @@ var CLI_CONTRACT = {
   queryRows: {
     command: "tables rows query",
     flags: {
-      predicate: { name: "filter", json: true, describe: TABLE_FILTER_HELP },
+      predicate: { name: "filter", json: true, describe: TABLE_READ_FILTER_HELP },
       sort: { json: true, describe: TABLE_SORT_HELP }
     },
     expand: "data"
@@ -10374,7 +10860,7 @@ var CLI_CONTRACT = {
         name: "filter",
         renamedFrom: ["predicate"],
         json: true,
-        describe: TABLE_FILTER_HELP
+        describe: TABLE_READ_FILTER_HELP
       }
     }
   },
@@ -11133,7 +11619,7 @@ async function createServiceAccount(command, providerId, options) {
   if (provider.requiresClientGeneratedCredentialId && !options.id) {
     throw new SimApiError(`--id is required for ${providerId}.`, 0);
   }
-  const credentials = credentialValues(provider, options.credentials);
+  const credentialFields = credentialValues(provider, options.credentials);
   const operation = V2_OPERATIONS.createServiceAccountCredential;
   const response = await client.request(operation.path, {
     method: operation.method,
@@ -11144,7 +11630,7 @@ async function createServiceAccount(command, providerId, options) {
       displayName: options.name,
       ...options.description ? { description: options.description } : {},
       ...options.id ? { id: options.id } : {},
-      ...credentials
+      credentials: JSON.stringify(credentialFields)
     }
   });
   renderResult("createServiceAccountCredential", profile.output, response.data, SERVICE_ACCOUNT_RESULT);
@@ -12908,6 +13394,7 @@ with -P, --profile, or SIM_PROFILE.
 
 Examples:
   $ sim login                                    Authorize the default profile
+  $ sim profile add acme --workspace ws_123      Reuse that login for a workspace
   $ sim login --profile dev --endpoint http://localhost:3000
   $ sim workflows list
   $ sim logs list --level error --limit 20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sim",
-  "version": "2.1.0-dev.24.1",
+  "version": "2.1.0-dev.32.1",
   "description": "Sim CLI - talk to the Sim API from your terminal",
   "type": "module",
   "bin": {