sim 2.1.0-dev.28.1 → 2.1.0-dev.32.1

package/README.md

@@ -12,9 +12,9 @@ Full documentation: **https://docs.sim.ai/cli**
 
 ## Profiles
 
-Profiles work like the AWS CLI: one identity and one set of defaults per named
-profile, selected with `-P`, `--profile`, or `SIM_PROFILE`. This is what lets you keep
-production and a local dev stack side by side without re-authenticating.
+Profiles work like the AWS CLI and are selected with `-P`, `--profile`, or
+`SIM_PROFILE`. A profile normally owns one identity and one set of defaults; a
+workspace profile can instead share a stored identity through `auth_profile`.
 
 Non-secret settings live in `~/.sim/config`:
 
@@ -27,6 +27,10 @@ output = table
 [profile dev]
 endpoint = http://localhost:3000
 workspace = ws_local
+
+[profile acme]
+auth_profile = default
+workspace = ws_acme
 ```
 
 Keys live in `~/.sim/credentials`, written `0600`:
@@ -45,7 +49,8 @@ The section-naming asymmetry — `[profile dev]` in config, `[dev]` in credentia
 ```bash
 sim configure --set-endpoint http://localhost:3000 --profile dev
 sim configure --set-workspace ws_local --profile dev
-sim profiles          # list them; * marks the active one
+sim profiles                                      # list them; * marks the active one
+sim profile add acme --workspace ws_acme          # share the active stored login
 sim whoami            # resolved values, where each came from, and whether they work
 ```
 
@@ -62,7 +67,7 @@ Each setting resolves independently, first match wins:
 indefinitely) and `SIM_DEBUG=1` traces requests to stderr. Node ignores
 `HTTPS_PROXY` unless `NODE_USE_ENV_PROXY=1` is also set, on Node 22.21+ or
 24.5+; the CLI warns when a proxy is configured but will not be used.
-| 3 | `~/.sim/config` / `~/.sim/credentials` for the selected profile |
+| 3 | `~/.sim/config` for the selected profile and credentials for its `auth_profile`, when set |
 | 4 | Built-in default (`https://www.sim.ai`, `table`) |
 
 Formats are listed under [Output formats](#output-formats).
@@ -112,8 +117,11 @@ the key can access.
 `sim login --workspace <id>` preselects a workspace in the picker, and an
 existing profile's workspace preselects itself on re-login.
 
-`sim logout` removes the stored key. It does not revoke it — do that in
-Settings → API keys.
+`sim logout` removes the stored key. A shared workspace profile cannot remove
+its authentication profile's key; use `sim logout --all --profile <name>` to
+remove only the workspace profile. An authentication profile cannot be removed
+entirely while workspace profiles reference it. Logging out does not revoke a
+key — do that in Settings → API keys.
 
 ## Commands
 
@@ -147,6 +155,7 @@ sim logs get <runId>
 sim audit-logs list --organization <organizationId> [--all-workspaces]
 sim audit-logs get <id> --organization <organizationId>
 
+sim workspaces list
 sim workspaces get
 sim workspaces members
 

package/dist/index.js

@@ -2432,6 +2432,33 @@ function readConfigProfile(profile) {
 function readCredentialsProfile(profile) {
   return getSection(readIni(credentialsPath()), profile) ?? {};
 }
+function resolveAuthenticationProfileName(profile) {
+  const config = readConfigProfile(profile);
+  if (!Object.hasOwn(config, "auth_profile"))
+    return profile;
+  const authProfile = config.auth_profile.trim();
+  if (!authProfile) {
+    throw new ProfileConfigError(`Profile "${profile}" has an empty auth_profile.`);
+  }
+  if (authProfile === profile) {
+    throw new ProfileConfigError(`Profile "${profile}" cannot use itself as auth_profile. Remove the auth_profile setting instead.`);
+  }
+  if (Object.hasOwn(config, "endpoint")) {
+    throw new ProfileConfigError(`Profile "${profile}" cannot set both auth_profile and endpoint. Set the endpoint on authentication profile "${authProfile}".`);
+  }
+  if (readCredentialsProfile(profile).api_key) {
+    throw new ProfileConfigError(`Profile "${profile}" cannot set both auth_profile and its own API key. Remove one of them.`);
+  }
+  const authConfig = readConfigProfile(authProfile);
+  const credentials = readCredentialsProfile(authProfile);
+  if (Object.keys(authConfig).length === 0 && Object.keys(credentials).length === 0) {
+    throw new ProfileConfigError(`Profile "${profile}" references missing auth_profile "${authProfile}".`);
+  }
+  if (Object.hasOwn(authConfig, "auth_profile")) {
+    throw new ProfileConfigError(`Profile "${profile}" references auth_profile "${authProfile}", which also has auth_profile set. Authentication profile references cannot be chained.`);
+  }
+  return authProfile;
+}
 function listProfiles() {
   const names = new Set;
   for (const section of listSections(readIni(configPath()))) {
@@ -2445,6 +2472,9 @@ function listProfiles() {
   }
   return [...names].sort();
 }
+function listAuthenticationDependents(authProfile) {
+  return listProfiles().filter((profile) => profile !== authProfile && readConfigProfile(profile).auth_profile?.trim() === authProfile);
+}
 function writeConfigProfile(profile, values) {
   const doc = readIni(configPath());
   setSectionValues(doc, configSectionName(profile), values);
@@ -2489,11 +2519,13 @@ function resolve(candidates, fallback, fallbackSource) {
 function resolveProfile(overrides = {}) {
   const name = overrides.profile || process.env.SIM_PROFILE || DEFAULT_PROFILE;
   const config = readConfigProfile(name);
-  const credentials = readCredentialsProfile(name);
+  const authProfile = resolveAuthenticationProfileName(name);
+  const authConfig = authProfile === name ? config : readConfigProfile(authProfile);
+  const credentials = readCredentialsProfile(authProfile);
   const endpoint = resolve([
     ["flag", overrides.endpoint],
     ["env", process.env.SIM_ENDPOINT],
-    ["config", config.endpoint]
+    ["config", authConfig.endpoint]
   ], DEFAULT_ENDPOINT, "default");
   const apiKey = resolve([
     ["flag", overrides.apiKey],
@@ -6759,6 +6791,40 @@ var V2_OPERATIONS = {
       }
     }
   },
+  createKnowledgeConnector: {
+    method: "POST",
+    path: "/api/v2/knowledge/[id]/connectors",
+    pathParams: ["id"],
+    pathParamDocs: { id: "Unique knowledge base identifier." },
+    responseMode: "json",
+    summary: "Create Knowledge Connector",
+    body: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      connectorType: { kind: "string", required: true, describe: "Registered connector type." },
+      credentialId: {
+        kind: "string",
+        describe: "OAuth credential identifier for connectors that require OAuth."
+      },
+      apiKey: {
+        kind: "string",
+        describe: "Write-only API key for connectors that use API-key authentication."
+      },
+      sourceConfig: {
+        kind: "object",
+        required: true,
+        describe: "Connector-specific source selection and filtering configuration."
+      },
+      syncIntervalMinutes: {
+        kind: "integer",
+        default: 1440,
+        describe: "Scheduled synchronization interval in minutes; zero disables scheduling."
+      }
+    }
+  },
   createKnowledgeDocumentUpload: {
     method: "POST",
     path: "/api/v2/knowledge/[id]/documents/uploads",
@@ -6923,22 +6989,11 @@ var V2_OPERATIONS = {
         kind: "string",
         describe: "Required only when provider discovery requests a client-generated ID."
       },
-      serviceAccountJson: {
+      credentials: {
         kind: "string",
-        describe: "Write-only Google service-account JSON key."
-      },
-      apiToken: { kind: "string", describe: "Write-only provider API token." },
-      domain: { kind: "string", describe: "Provider account domain." },
-      signingSecret: { kind: "string", describe: "Write-only webhook signing secret." },
-      botToken: { kind: "string", describe: "Write-only bot token." },
-      clientId: { kind: "string", describe: "OAuth client identifier." },
-      clientSecret: { kind: "string", describe: "Write-only OAuth client secret." },
-      certificateId: { kind: "string", describe: "Provider certificate mapping identifier." },
-      orgId: { kind: "string", describe: "Provider organization ID." },
-      dataCenter: { kind: "string", describe: "Provider data center." },
-      authMethod: { kind: "string", describe: "Provider authentication method." },
-      privateKey: { kind: "string", describe: "Write-only PEM private key." },
-      username: { kind: "string", describe: "Provider run-as username." }
+        required: true,
+        describe: "Write-only JSON object string containing the fields declared by credential-provider discovery."
+      }
     }
   },
   createSkill: {
@@ -7206,6 +7261,28 @@ var V2_OPERATIONS = {
       }
     }
   },
+  deleteKnowledgeConnector: {
+    method: "DELETE",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "Delete Knowledge Connector",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      deleteDocuments: {
+        kind: "boolean",
+        describe: "Also permanently delete documents produced by this connector."
+      }
+    }
+  },
   deleteKnowledgeDocument: {
     method: "DELETE",
     path: "/api/v2/knowledge/[id]/documents/[documentId]",
@@ -7632,6 +7709,24 @@ var V2_OPERATIONS = {
       }
     }
   },
+  getKnowledgeConnector: {
+    method: "GET",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "Get Knowledge Connector",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      }
+    }
+  },
   getKnowledgeDocument: {
     method: "GET",
     path: "/api/v2/knowledge/[id]/documents/[documentId]",
@@ -7799,6 +7894,24 @@ var V2_OPERATIONS = {
     responseMode: "json",
     summary: "Get Workspace"
   },
+  grantSkillEditor: {
+    method: "POST",
+    path: "/api/v2/skills/[id]/editors",
+    pathParams: ["id"],
+    pathParamDocs: {
+      id: "Unique skill identifier. A built-in skill is `builtin-` followed by its name, for example `builtin-research`."
+    },
+    responseMode: "json",
+    summary: "Grant Skill Editor",
+    body: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
+      email: {
+        kind: "string",
+        required: true,
+        describe: "Email address of a current workspace member."
+      }
+    }
+  },
   importWorkflow: {
     method: "POST",
     path: "/api/v2/workflows/import",
@@ -8167,6 +8280,73 @@ var V2_OPERATIONS = {
       }
     }
   },
+  listKnowledgeConnectorDocuments: {
+    method: "GET",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]/documents",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "List Knowledge Connector Documents",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      includeExcluded: {
+        kind: "boolean",
+        describe: "Include documents explicitly excluded by a user."
+      },
+      limit: {
+        kind: "integer",
+        default: 50,
+        describe: "Maximum connector documents to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
+      }
+    }
+  },
+  listKnowledgeConnectors: {
+    method: "GET",
+    path: "/api/v2/knowledge/[id]/connectors",
+    pathParams: ["id"],
+    pathParamDocs: { id: "Unique knowledge base identifier." },
+    responseMode: "json",
+    summary: "List Knowledge Connectors",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      sortBy: {
+        kind: "enum",
+        values: ["connectorType", "createdAt", "updatedAt"],
+        default: "createdAt",
+        describe: "Field used to sort the result."
+      },
+      sortOrder: {
+        kind: "enum",
+        values: ["asc", "desc"],
+        default: "desc",
+        describe: "Sort direction."
+      },
+      limit: {
+        kind: "integer",
+        default: 50,
+        describe: "Maximum connectors to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
+      }
+    }
+  },
   listKnowledgeDocuments: {
     method: "GET",
     path: "/api/v2/knowledge/[id]/documents",
@@ -8462,6 +8642,40 @@ var V2_OPERATIONS = {
       }
     }
   },
+  listSkillEditors: {
+    method: "GET",
+    path: "/api/v2/skills/[id]/editors",
+    pathParams: ["id"],
+    pathParamDocs: {
+      id: "Unique skill identifier. A built-in skill is `builtin-` followed by its name, for example `builtin-research`."
+    },
+    responseMode: "json",
+    summary: "List Skill Editors",
+    query: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
+      sortBy: {
+        kind: "enum",
+        values: ["email", "name"],
+        default: "email",
+        describe: "Field used to sort the result. Sorting by `name` is case-sensitive and follows the storage collation, so do not rely on a case-insensitive order."
+      },
+      sortOrder: {
+        kind: "enum",
+        values: ["asc", "desc"],
+        default: "asc",
+        describe: "Sort direction."
+      },
+      limit: {
+        kind: "integer",
+        default: 50,
+        describe: "Maximum skill editors to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
+      }
+    }
+  },
   listSkills: {
     method: "GET",
     path: "/api/v2/skills",
@@ -8774,6 +8988,36 @@ var V2_OPERATIONS = {
       }
     }
   },
+  listWorkspaces: {
+    method: "GET",
+    path: "/api/v2/workspaces",
+    pathParams: [],
+    responseMode: "json",
+    summary: "List Workspaces",
+    query: {
+      sortBy: {
+        kind: "enum",
+        values: ["name", "createdAt", "updatedAt"],
+        default: "createdAt",
+        describe: "Field used to sort the result. Sorting by `name` is case-sensitive and follows the storage collation, so do not rely on a case-insensitive order."
+      },
+      sortOrder: {
+        kind: "enum",
+        values: ["asc", "desc"],
+        default: "desc",
+        describe: "Sort direction."
+      },
+      limit: {
+        kind: "integer",
+        default: 50,
+        describe: "Maximum workspaces to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
+      }
+    }
+  },
   moveFileItems: {
     method: "POST",
     path: "/api/v2/files/move",
@@ -8800,7 +9044,7 @@ var V2_OPERATIONS = {
       workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
       predicate: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       },
       sort: { kind: "array", describe: "Ordered table-row sort specification." },
       limit: {
@@ -8821,7 +9065,7 @@ var V2_OPERATIONS = {
       workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
       predicate: {
         kind: "unknown",
-        describe: 'Recursive predicate tree. Each group node is exactly one non-empty `all` or `any` array whose members are further groups or `{ field, op, value }` conditions; the root must be a group, not a bare condition. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
+        describe: 'A single `{ field, op, value }` condition or a recursive `all`/`any` group; either form is normalized to a grouped predicate after validation. At most 100 members per group, 10 levels of nesting, and 500 nodes in total. The negating operators include nulls: `ne`, `nin`, `ncontains`, `nlike`, and `nilike` match rows whose column is null or absent, so "not X" is not the complement of "X" over a nullable column. That holds for every column type, multi-select included. To exclude nulls, `all`-combine the negation with `isNotEmpty` (multi-select) or `isNotNull`. Comparison: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`. Membership: `in`, `nin` (array operand). Emptiness: `isEmpty`, `isNotEmpty`, `isNull`, `isNotNull` (no operand). Substring, always case-insensitive, operand matched literally: `contains`, `ncontains`, `startsWith`, `endsWith`. Pattern: `like`/`nlike` (case-sensitive), `ilike`/`nilike` (case-insensitive). **`*` is the only wildcard** and stands for any run of characters; `%`, `_`, and backslash match themselves. Use `like: "Hi*"`, not `like: "Hi%"`. A `select` column compares by option id and restricts its operators: single-select accepts `eq`, `ne`, `in`, `nin`; multi-select accepts `contains`, `ncontains`. Option names are accepted as operands and resolved to ids.'
       }
     }
   },
@@ -8932,6 +9176,24 @@ var V2_OPERATIONS = {
       input: { kind: "unknown", describe: "Input supplied to the paused workflow block." }
     }
   },
+  revokeSkillEditor: {
+    method: "DELETE",
+    path: "/api/v2/skills/[id]/editors",
+    pathParams: ["id"],
+    pathParamDocs: {
+      id: "Unique skill identifier. A built-in skill is `builtin-` followed by its name, for example `builtin-research`."
+    },
+    responseMode: "json",
+    summary: "Revoke Skill Editor",
+    query: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the skill." },
+      email: {
+        kind: "string",
+        required: true,
+        describe: "Email address of a current workspace member."
+      }
+    }
+  },
   rollbackWorkflow: {
     method: "POST",
     path: "/api/v2/workflows/[id]/rollback",
@@ -9071,6 +9333,29 @@ var V2_OPERATIONS = {
       }
     }
   },
+  syncKnowledgeConnector: {
+    method: "POST",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]/sync",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "Sync Knowledge Connector",
+    body: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      rehydrate: {
+        kind: "boolean",
+        default: false,
+        describe: "Re-fetch and re-index every existing connector document."
+      }
+    }
+  },
   tableExportDownload: {
     method: "GET",
     path: "/api/v2/tables/exports/[exportId]/download",
@@ -9153,6 +9438,66 @@ var V2_OPERATIONS = {
       folderPath: { kind: "string", describe: "New containing-folder path." }
     }
   },
+  updateKnowledgeConnector: {
+    method: "PATCH",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "Update Knowledge Connector",
+    body: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      sourceConfig: {
+        kind: "object",
+        describe: "Replacement source selection and filtering configuration."
+      },
+      syncIntervalMinutes: {
+        kind: "integer",
+        describe: "New scheduled synchronization interval in minutes."
+      },
+      status: {
+        kind: "enum",
+        values: ["active", "paused"],
+        describe: "New connector state."
+      }
+    }
+  },
+  updateKnowledgeConnectorDocuments: {
+    method: "PATCH",
+    path: "/api/v2/knowledge/[id]/connectors/[connectorId]/documents",
+    pathParams: ["id", "connectorId"],
+    pathParamDocs: {
+      id: "Knowledge base that owns the connector.",
+      connectorId: "Connector selected for the operation."
+    },
+    responseMode: "json",
+    summary: "Update Knowledge Connector Documents",
+    body: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      },
+      operation: {
+        kind: "enum",
+        required: true,
+        values: ["restore", "exclude"],
+        describe: "Whether to restore or exclude the selected documents."
+      },
+      documentIds: {
+        kind: "array",
+        required: true,
+        describe: "Connector document identifiers to update."
+      }
+    }
+  },
   updateKnowledgeDocument: {
     method: "PATCH",
     path: "/api/v2/knowledge/[id]/documents/[documentId]",
@@ -9481,6 +9826,8 @@ var V2_OPERATIONS = {
 };
 
 // src/commands/auth.ts
+var PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var MAX_INTERACTIVE_WORKSPACES = 1000;
 function openBrowser(url) {
   const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : [process.platform === "darwin" ? "open" : "xdg-open", [url]];
   try {
@@ -9516,9 +9863,91 @@ async function confirmProfileOverwrite(profileName) {
     prompt.close();
   }
 }
+function selectedProfileName(command) {
+  return globalsOf(command).profile || process.env.SIM_PROFILE || DEFAULT_PROFILE;
+}
+function validateNewProfileName(profileName) {
+  if (!PROFILE_NAME_PATTERN.test(profileName)) {
+    throw new SimApiError(`Invalid profile name "${profileName}". Use letters, numbers, dots, underscores, or hyphens, starting with a letter or number.`, 0);
+  }
+  if (listProfiles().includes(profileName)) {
+    throw new SimApiError(`Profile "${profileName}" already exists. Remove it first with: sim logout --all --profile ${profileName}`, 0);
+  }
+}
+function requireStoredAuthentication(profile) {
+  const authProfile = resolveAuthenticationProfileName(profile.name);
+  const storedKey = readCredentialsProfile(authProfile).api_key;
+  if (profile.sources.apiKey !== "credentials" || !storedKey) {
+    throw new SimApiError(`Cannot create a shared profile from "${profile.name}": the active API key is not stored. Run: sim login --profile ${authProfile}`, 0);
+  }
+  if (profile.sources.endpoint === "flag" || profile.sources.endpoint === "env") {
+    throw new SimApiError(`Cannot create a shared profile from "${profile.name}": the active endpoint comes from ${profile.sources.endpoint}. Save it with: sim configure --profile ${authProfile} --set-endpoint ${profile.endpoint}`, 0);
+  }
+  return authProfile;
+}
+async function getWorkspaceById(client, workspaceId) {
+  const operation = V2_OPERATIONS.getWorkspace;
+  const response = await client.request(resolvePath(operation.path, { workspaceId }), { method: operation.method });
+  return response.data;
+}
+async function chooseWorkspace(client) {
+  if (!process.stdin.isTTY) {
+    throw new SimApiError("No workspace provided. Pass --workspace <id> when creating a profile non-interactively.", 0);
+  }
+  const operation = V2_OPERATIONS.listWorkspaces;
+  const workspaces = await requestAllPages(client, operation.path, {
+    method: operation.method,
+    query: { sortBy: "name", sortOrder: "asc" },
+    pageSize: 100,
+    limit: MAX_INTERACTIVE_WORKSPACES + 1
+  });
+  if (workspaces.length === 0) {
+    throw new SimApiError("The active API key cannot access any workspaces.", 0);
+  }
+  if (workspaces.length > MAX_INTERACTIVE_WORKSPACES) {
+    throw new SimApiError(`The active API key can access more than ${MAX_INTERACTIVE_WORKSPACES} workspaces, which is too many to show interactively. Pass --workspace <id> instead.`, 0);
+  }
+  console.log(`
+Available workspaces:`);
+  for (const [index, workspace] of workspaces.entries()) {
+    console.log(`  ${index + 1}) ${safeOneLine(workspace.name)} (${workspace.id})`);
+  }
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await prompt.question(`Choose a workspace [1-${workspaces.length}]: `);
+    const selected = Number(answer.trim());
+    if (!Number.isInteger(selected) || selected < 1 || selected > workspaces.length) {
+      throw new SimApiError(`Invalid workspace selection "${safeOneLine(answer)}". Choose a number from 1 to ${workspaces.length}.`, 0);
+    }
+    return workspaces[selected - 1];
+  } finally {
+    prompt.close();
+  }
+}
+function addProfileCommand() {
+  return new Command("add").description("Add a workspace profile that shares the active stored login").argument("<name>", "Name for the new profile").option("-w, --workspace <id>", "Existing workspace to use; omit for an interactive picker").action(async (profileName, _options, command) => {
+    validateNewProfileName(profileName);
+    const { client, profile } = clientFrom(command);
+    const authProfile = requireStoredAuthentication(profile);
+    const workspaceId = globalsOf(command).workspace;
+    const workspace = workspaceId ? await getWorkspaceById(client, workspaceId) : await chooseWorkspace(client);
+    writeConfigProfile(profileName, {
+      auth_profile: authProfile,
+      workspace: workspace.id
+    });
+    console.log(source_default.green(`✓ Added profile "${profileName}" in ${configPath()}`));
+    console.log(`  Workspace: ${safeOneLine(workspace.name)} (${workspace.id})`);
+    console.log(`  Authentication: ${authProfile}`);
+    console.log(source_default.dim(`  Try: sim --profile ${profileName} whoami`));
+  });
+}
 function loginCommand() {
   return new Command("login").description("Authorize this terminal and store an API key for the profile").option("--scope <scope>", "Key space to mint from: platform or copilot", "platform").option("--no-browser", "Print the URL instead of opening a browser").option("-y, --yes", "Overwrite an existing profile without prompting").action(async (options, command) => {
     const profile = profileFrom(command);
+    const authProfile = resolveAuthenticationProfileName(profile.name);
+    if (authProfile !== profile.name) {
+      throw new SimApiError(`Profile "${profile.name}" shares authentication with "${authProfile}". Run: sim login --profile ${authProfile}`, 0);
+    }
     if (options.scope !== "platform" && options.scope !== "copilot") {
       throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
     }
@@ -9565,16 +9994,25 @@ Waiting for approval…`));
 }
 function logoutCommand() {
   return new Command("logout").description("Remove the profile's stored API key").option("--all", "Remove the profile entirely, including its settings").action((options, command) => {
-    const profile = profileFrom(command);
     if (options.all) {
-      const removed = deleteProfile(profile.name);
+      const profileName = selectedProfileName(command);
+      const dependents = listAuthenticationDependents(profileName);
+      if (dependents.length > 0) {
+        throw new SimApiError(`Cannot remove authentication profile "${profileName}" because it is used by: ${dependents.join(", ")}. Remove those profiles first.`, 0);
+      }
+      const removed = deleteProfile(profileName);
       if (!removed.config && !removed.credentials) {
-        console.log(source_default.dim(`Nothing stored for profile "${profile.name}".`));
+        console.log(source_default.dim(`Nothing stored for profile "${profileName}".`));
         return;
       }
-      console.log(source_default.green(`✓ Removed profile "${profile.name}".`));
+      console.log(source_default.green(`✓ Removed profile "${profileName}".`));
       return;
     }
+    const profile = profileFrom(command);
+    const authProfile = resolveAuthenticationProfileName(profile.name);
+    if (authProfile !== profile.name) {
+      throw new SimApiError(`Profile "${profile.name}" shares authentication with "${authProfile}". Log out of the authentication profile instead: sim logout --profile ${authProfile}`, 0);
+    }
     if (!readCredentialsProfile(profile.name).api_key) {
       console.log(source_default.dim(`No stored key for profile "${profile.name}".`));
       return;
@@ -9682,27 +10120,38 @@ function whoamiCommand() {
   });
 }
 function profilesCommand() {
-  return new Command("profiles").alias("profile").description("List the profiles defined in the config and credentials files").action((_options, command) => {
+  const command = new Command("profiles").alias("profile").description("List profiles or add a workspace profile that shares a stored login");
+  const printProfiles = (_options, actionCommand) => {
     const profiles = listProfiles();
     if (profiles.length === 0) {
       console.log(source_default.dim("No profiles yet. Run: sim login"));
       return;
     }
-    const active = profileFrom(command).name;
+    const active = selectedProfileName(actionCommand);
     for (const name of profiles) {
       const marker = name === active ? source_default.green("*") : " ";
-      const hasKey = Boolean(readCredentialsProfile(name).api_key);
-      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}`);
+      const authProfile = resolveAuthenticationProfileName(name);
+      const hasKey = Boolean(readCredentialsProfile(authProfile).api_key);
+      const authentication = authProfile === name ? "" : source_default.dim(`  (auth: ${authProfile})`);
+      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}${authentication}`);
     }
-  });
+  };
+  command.action(printProfiles);
+  command.addCommand(new Command("list").description("List configured profiles").action(printProfiles));
+  command.addCommand(addProfileCommand());
+  return command;
 }
 
 // src/commands/configure.ts
 function configureCommand() {
   return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
     const profile = profileFrom(command);
+    const authProfile = resolveAuthenticationProfileName(profile.name);
     const updates = {};
     if (options.setEndpoint) {
+      if (authProfile !== profile.name) {
+        throw new SimApiError(`Profile "${profile.name}" shares its endpoint with authentication profile "${authProfile}". Run: sim configure --profile ${authProfile} --set-endpoint ${options.setEndpoint}`, 0);
+      }
       updates.endpoint = normalizeEndpoint(options.setEndpoint, "--set-endpoint");
     }
     if (options.setWorkspace)
@@ -9717,6 +10166,9 @@ function configureCommand() {
       if (!["endpoint", "workspace", "output"].includes(key)) {
         throw new SimApiError(`Cannot unset "${key}". Use endpoint, workspace, or output.`, 0);
       }
+      if (key === "endpoint" && authProfile !== profile.name) {
+        throw new SimApiError(`Profile "${profile.name}" shares its endpoint with authentication profile "${authProfile}". Run: sim configure --profile ${authProfile} --unset endpoint`, 0);
+      }
       updates[key] = null;
     }
     if (Object.keys(updates).length === 0) {
@@ -9741,6 +10193,7 @@ import { existsSync as existsSync2, readFileSync as readFileSync3, readSync } fr
 // src/contract/commands.ts
 var TABLE_NAME_HELP = "Identifier: letters, numbers, and underscores; cannot start with a number";
 var TABLE_FILTER_HELP = 'Predicate: {"all":[{"field":"status","op":"eq","value":"active"}]}; groups use all/any. Operators: eq, ne, gt, gte, lt, lte, in, nin, contains, ncontains, startsWith, endsWith, like, ilike, nlike, nilike, isEmpty, isNotEmpty, isNull, isNotNull';
+var TABLE_READ_FILTER_HELP = 'Condition: {"field":"status","op":"eq","value":"active"}. Groups: {"all":[{"field":"status","op":"eq","value":"active"}]} or {"any":[{"field":"status","op":"eq","value":"active"}]}; group entries may also be nested groups. Operators: eq, ne, gt, gte, lt, lte, in, nin, contains, ncontains, startsWith, endsWith, like, ilike, nlike, nilike, isEmpty, isNotEmpty, isNull, isNotNull';
 var TABLE_SORT_HELP = 'Ordered sort keys: [{"field":"createdAt","direction":"desc"}] (direction: asc or desc)';
 var CUSTOM_TOOL_SCHEMA_HELP = 'OpenAI function schema: {"type":"function","function":{"name":"...","parameters":{"type":"object","properties":{}}}}';
 var FOLDER_PATH_INPUT = {
@@ -9843,6 +10296,15 @@ var CLI_CONTRACT = {
       selectAll: { boolean: true, describe: "Apply to every document in the knowledge base" }
     }
   },
+  listKnowledgeConnectorDocuments: {
+    command: "knowledge connectors documents list"
+  },
+  updateKnowledgeConnectorDocuments: {
+    command: "knowledge connectors documents update",
+    flags: {
+      documentIds: { name: "document", list: true }
+    }
+  },
   undeployWorkflow: {
     command: "workflows undeploy",
     describe: "Take a workflow out of deployment"
@@ -9864,11 +10326,17 @@ var CLI_CONTRACT = {
     pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     confirm: "This deletes the document and its embeddings."
   },
+  deleteKnowledgeConnector: {
+    confirm: "This deletes the connector; --delete-documents also deletes its synchronized documents."
+  },
   deleteFile: { confirm: "This archives the file." },
   deleteCredential: {
     confirm: "This disconnects the credential and removes its stored authentication."
   },
   deleteSkill: { confirm: "This deletes the skill." },
+  revokeSkillEditor: {
+    confirm: "This revokes the explicit skill editor grant for the selected email."
+  },
   deleteCustomTool: { confirm: "This deletes the custom tool." },
   deleteMcpServer: {
     confirm: "This removes the MCP server and the tools it provides."
@@ -9964,7 +10432,7 @@ var CLI_CONTRACT = {
   queryRows: {
     command: "tables rows query",
     flags: {
-      predicate: { name: "filter", json: true, describe: TABLE_FILTER_HELP },
+      predicate: { name: "filter", json: true, describe: TABLE_READ_FILTER_HELP },
       sort: { json: true, describe: TABLE_SORT_HELP }
     },
     expand: "data"
@@ -10392,7 +10860,7 @@ var CLI_CONTRACT = {
         name: "filter",
         renamedFrom: ["predicate"],
         json: true,
-        describe: TABLE_FILTER_HELP
+        describe: TABLE_READ_FILTER_HELP
       }
     }
   },
@@ -11151,7 +11619,7 @@ async function createServiceAccount(command, providerId, options) {
   if (provider.requiresClientGeneratedCredentialId && !options.id) {
     throw new SimApiError(`--id is required for ${providerId}.`, 0);
   }
-  const credentials = credentialValues(provider, options.credentials);
+  const credentialFields = credentialValues(provider, options.credentials);
   const operation = V2_OPERATIONS.createServiceAccountCredential;
   const response = await client.request(operation.path, {
     method: operation.method,
@@ -11162,7 +11630,7 @@ async function createServiceAccount(command, providerId, options) {
       displayName: options.name,
       ...options.description ? { description: options.description } : {},
       ...options.id ? { id: options.id } : {},
-      ...credentials
+      credentials: JSON.stringify(credentialFields)
     }
   });
   renderResult("createServiceAccountCredential", profile.output, response.data, SERVICE_ACCOUNT_RESULT);
@@ -12926,6 +13394,7 @@ with -P, --profile, or SIM_PROFILE.
 
 Examples:
   $ sim login                                    Authorize the default profile
+  $ sim profile add acme --workspace ws_123      Reuse that login for a workspace
   $ sim login --profile dev --endpoint http://localhost:3000
   $ sim workflows list
   $ sim logs list --level error --limit 20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sim",
-  "version": "2.1.0-dev.28.1",
+  "version": "2.1.0-dev.32.1",
   "description": "Sim CLI - talk to the Sim API from your terminal",
   "type": "module",
   "bin": {