docs(knowledge): state saved-credential availability and rollback limits

Catalog and connector credentialId descriptions say saved credentials work
once the deployment enables them, the connector credentialId field covers
saved credentials, and the flag notes that a release rollback is unsafe
once any connector uses one. Regenerates OpenAPI, CLI API and CLI docs.

Author: waleedlatif1

apps/docs/content/docs/cli/knowledge.mdx

@@ -1040,7 +1040,7 @@ sim knowledge connectors create <knowledgeBaseId> [options]
 | Option | Required | Description |
 | --- | --- | --- |
 | `--connector-type <value>` | Yes | Registered connector type. |
-| `--credential-id <value>` | No | OAuth credential identifier for connector types whose `auth.mode` is `oauth` (see connector types), or a saved credential for an `apiKey` connector type that declares `auth.savedCredential` (such as Amazon S3 with a saved AWS credential); otherwise omit it for `apiKey` connectors. |
+| `--credential-id <value>` | No | OAuth credential identifier for connector types whose `auth.mode` is `oauth` (see connector types), or, when this deployment enables it, a saved credential for an `apiKey` connector type that declares `auth.savedCredential` (such as Amazon S3 with a saved AWS credential); otherwise omit it for `apiKey` connectors. |
 | `--api-key <value>` | No | Write-only API key for connector types whose `auth.mode` is `apiKey` (see connector types), or a personal access token for an OAuth connector that also accepts one, such as GitHub. Send it instead of `credentialId`. Pass a raw key, or a secret reference written as the whole value `{{SECRET_NAME}}`, which the server resolves; `$SECRET_NAME` is not a reference. |
 | `--source-config <json\|@file>` | Yes | Connector-specific source selection and filtering configuration. (JSON, or @path / @- to read a file or stdin). |
 | `--sync-interval-minutes <value>` | No | Scheduled synchronization interval in minutes; zero disables scheduling. Defaults to 1440. |

apps/docs/content/docs/cli/reference.mdx

@@ -2645,7 +2645,7 @@ sim knowledge connectors create <knowledgeBaseId> [options]
 | Option | Required | Description |
 | --- | --- | --- |
 | `--connector-type <value>` | Yes | Registered connector type. |
-| `--credential-id <value>` | No | OAuth credential identifier for connector types whose `auth.mode` is `oauth` (see connector types), or a saved credential for an `apiKey` connector type that declares `auth.savedCredential` (such as Amazon S3 with a saved AWS credential); otherwise omit it for `apiKey` connectors. |
+| `--credential-id <value>` | No | OAuth credential identifier for connector types whose `auth.mode` is `oauth` (see connector types), or, when this deployment enables it, a saved credential for an `apiKey` connector type that declares `auth.savedCredential` (such as Amazon S3 with a saved AWS credential); otherwise omit it for `apiKey` connectors. |
 | `--api-key <value>` | No | Write-only API key for connector types whose `auth.mode` is `apiKey` (see connector types), or a personal access token for an OAuth connector that also accepts one, such as GitHub. Send it instead of `credentialId`. Pass a raw key, or a secret reference written as the whole value `{{SECRET_NAME}}`, which the server resolves; `$SECRET_NAME` is not a reference. |
 | `--source-config <json\|@file>` | Yes | Connector-specific source selection and filtering configuration. (JSON, or @path / @- to read a file or stdin). |
 | `--sync-interval-minutes <value>` | No | Scheduled synchronization interval in minutes; zero disables scheduling. Defaults to 1440. |

apps/docs/openapi-v2-knowledge.json

@@ -6933,7 +6933,7 @@
                 "type": "null"
               }
             ],
-            "description": "OAuth credential identifier, or null for API-key and unauthenticated sources."
+            "description": "OAuth credential identifier, or the saved credential an `apiKey` source syncs with (see `auth.savedCredential`); null for API-key and unauthenticated sources."
           },
           "sourceConfig": {
             "type": "object",
@@ -7155,7 +7155,7 @@
             "description": "Registered connector type."
           },
           "credentialId": {
-            "description": "OAuth credential identifier for connector types whose `auth.mode` is `oauth` (see connector types), or a saved credential for an `apiKey` connector type that declares `auth.savedCredential` (such as Amazon S3 with a saved AWS credential); otherwise omit it for `apiKey` connectors.",
+            "description": "OAuth credential identifier for connector types whose `auth.mode` is `oauth` (see connector types), or, when this deployment enables it, a saved credential for an `apiKey` connector type that declares `auth.savedCredential` (such as Amazon S3 with a saved AWS credential); otherwise omit it for `apiKey` connectors.",
             "type": "string",
             "minLength": 1,
             "maxLength": 255
@@ -7331,7 +7331,7 @@
                 "type": "null"
               }
             ],
-            "description": "OAuth credential identifier, or null for API-key and unauthenticated sources."
+            "description": "OAuth credential identifier, or the saved credential an `apiKey` source syncs with (see `auth.savedCredential`); null for API-key and unauthenticated sources."
           },
           "sourceConfig": {
             "type": "object",

apps/docs/openapi-v2-resources.json

@@ -21715,7 +21715,7 @@
                     "description": "Whether the key may be left blank, for a source reachable without authentication."
                   },
                   "savedCredential": {
-                    "description": "When present, a saved credential of this service may be passed as `credentialId` instead of `apiKey`. Fields marked `apiKeyOnly` are then omitted.",
+                    "description": "When present, a saved credential of this service may be passed as `credentialId` instead of `apiKey`, once saved-credential setup is enabled on this deployment (until then it is refused with a validation error). Fields marked `apiKeyOnly` are then omitted.",
                     "type": "object",
                     "properties": {
                       "provider": {

apps/sim/lib/api/contracts/v2/catalog.ts

@@ -755,7 +755,7 @@ export const v2ConnectorTypeSchema = z
             })
             .optional()
             .describe(
-              'When present, a saved credential of this service may be passed as `credentialId` instead of `apiKey`. Fields marked `apiKeyOnly` are then omitted.'
+              'When present, a saved credential of this service may be passed as `credentialId` instead of `apiKey`, once saved-credential setup is enabled on this deployment (until then it is refused with a validation error). Fields marked `apiKeyOnly` are then omitted.'
             ),
         }),
       ])

apps/sim/lib/api/contracts/v2/knowledge.ts

@@ -1777,7 +1777,9 @@ export const v2KnowledgeConnectorSchema = z
     credentialId: z
       .string()
       .nullable()
-      .describe('OAuth credential identifier, or null for API-key and unauthenticated sources.'),
+      .describe(
+        'OAuth credential identifier, or the saved credential an `apiKey` source syncs with (see `auth.savedCredential`); null for API-key and unauthenticated sources.'
+      ),
     sourceConfig: z
       .record(z.string(), z.unknown().describe('Connector-specific source configuration value.'))
       .describe('Connector-specific source selection and filtering configuration.'),
@@ -1932,7 +1934,7 @@ export const v2CreateKnowledgeConnectorBodySchema = z
       .max(255)
       .optional()
       .describe(
-        'OAuth credential identifier for connector types whose `auth.mode` is `oauth` (see connector types), or a saved credential for an `apiKey` connector type that declares `auth.savedCredential` (such as Amazon S3 with a saved AWS credential); otherwise omit it for `apiKey` connectors.'
+        'OAuth credential identifier for connector types whose `auth.mode` is `oauth` (see connector types), or, when this deployment enables it, a saved credential for an `apiKey` connector type that declares `auth.savedCredential` (such as Amazon S3 with a saved AWS credential); otherwise omit it for `apiKey` connectors.'
       ),
     apiKey: z
       .string()

apps/sim/lib/core/config/feature-flags.ts

@@ -120,6 +120,8 @@ const FEATURE_FLAGS = {
       'with a saved AWS credential) be set up with that credential. Global on/off only; gates new ' +
       'setup and credential changes, never syncing of connectors already using a credential. Turn ' +
       'on only after the release that adds it is live on both the app and Trigger.dev workers. ' +
+      'Once any connector uses a saved credential, rolling back to an earlier release is unsafe ' +
+      'even with the flag off: older workers unschedule those connectors as credential-removed. ' +
       'Off-AppConfig falls back to KNOWLEDGE_CONNECTOR_SAVED_CREDENTIALS.',
     fallback: 'KNOWLEDGE_CONNECTOR_SAVED_CREDENTIALS',
   },

apps/sim/lib/knowledge/connectors/saved-credential-rollout.ts

@@ -8,6 +8,9 @@ import type { ConnectorAuthConfig } from '@/connectors/types'
  * A global switch that gates setup only. Workers from an older release read a key
  * connector without a key as one whose credential was removed and unschedule it, so
  * the switch stays off until every app and worker runs a release that reads these rows.
+ * Turning it off later does not protect rows already set up: once any exist, a release
+ * rollback unschedules them as credential-removed, and they stay idle until edited or
+ * synced manually.
  */
 export function isConnectorSavedCredentialSetupEnabled(): Promise<boolean> {
   return isFeatureEnabled('knowledge-connector-saved-credentials')

packages/sim-cli/src/generated/v2-api.ts

@@ -17349,7 +17349,7 @@ export const V2_OPERATIONS = {
       credentialId: {
         kind: 'string',
         describe:
-          'OAuth credential identifier for connector types whose `auth.mode` is `oauth` (see connector types), or a saved credential for an `apiKey` connector type that declares `auth.savedCredential` (such as Amazon S3 with a saved AWS credential); otherwise omit it for `apiKey` connectors.',
+          'OAuth credential identifier for connector types whose `auth.mode` is `oauth` (see connector types), or, when this deployment enables it, a saved credential for an `apiKey` connector type that declares `auth.savedCredential` (such as Amazon S3 with a saved AWS credential); otherwise omit it for `apiKey` connectors.',
       },
       apiKey: {
         kind: 'string',