@withone/cli 1.36.0 → 1.37.1

package/dist/index.js

@@ -4334,6 +4334,7 @@ async function relayCreateCommand(options) {
     if (options.description) body.description = options.description;
     if (options.eventFilters) body.eventFilters = parseJsonArg2(options.eventFilters, "--event-filters");
     if (options.tags) body.tags = parseJsonArg2(options.tags, "--tags");
+    if (options.metadata) body.metadata = parseJsonArg2(options.metadata, "--metadata");
     if (options.createWebhook) body.createWebhook = true;
     const result = await api.createRelayEndpoint(body);
     if (isAgentMode()) {
@@ -4348,6 +4349,10 @@ async function relayCreateCommand(options) {
     if (result.description) console.log(`  ${pc8.dim("Description:")} ${result.description}`);
     if (result.eventFilters?.length) console.log(`  ${pc8.dim("Events:")}      ${result.eventFilters.join(", ")}`);
     if (result.webhookPayload?.id) console.log(`  ${pc8.dim("Webhook ID:")}  ${result.webhookPayload.id}`);
+    if (result.warning) {
+      console.log();
+      console.log(`  ${pc8.yellow("\u26A0 Warning:")} ${result.warning}`);
+    }
     console.log();
   } catch (error2) {
     spinner6.stop("Failed to create relay endpoint");
@@ -5262,6 +5267,80 @@ function runShellHook(command, events) {
   });
 }
 
+// src/lib/sync/transform.ts
+import { spawn as spawn3 } from "child_process";
+var TRANSFORM_TIMEOUT_MS = 6e4;
+async function transformRecords(command, records) {
+  const input = JSON.stringify(records);
+  return new Promise((resolve) => {
+    const child = spawn3("sh", ["-c", command], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    const timer = setTimeout(() => {
+      try {
+        child.kill();
+      } catch {
+      }
+      if (!isAgentMode()) {
+        process.stderr.write(`  Transform timed out after ${TRANSFORM_TIMEOUT_MS / 1e3}s \u2014 using original records
+`);
+      }
+      resolve(null);
+    }, TRANSFORM_TIMEOUT_MS);
+    child.on("exit", (code) => {
+      clearTimeout(timer);
+      if (stderr.trim() && !isAgentMode()) {
+        process.stderr.write(`  Transform stderr: ${stderr.trim()}
+`);
+      }
+      if (code !== 0) {
+        if (!isAgentMode()) {
+          process.stderr.write(`  Transform exited with code ${code} \u2014 using original records
+`);
+        }
+        resolve(null);
+        return;
+      }
+      try {
+        const parsed = JSON.parse(stdout.trim());
+        if (!Array.isArray(parsed)) {
+          if (!isAgentMode()) {
+            process.stderr.write(`  Transform returned non-array JSON \u2014 using original records
+`);
+          }
+          resolve(null);
+          return;
+        }
+        resolve(parsed);
+      } catch {
+        if (!isAgentMode()) {
+          process.stderr.write(`  Transform returned invalid JSON \u2014 using original records
+`);
+        }
+        resolve(null);
+      }
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      if (!isAgentMode()) {
+        process.stderr.write(`  Transform failed to start: ${err.message} \u2014 using original records
+`);
+      }
+      resolve(null);
+    });
+    child.stdin.write(input);
+    child.stdin.end();
+  });
+}
+
 // src/lib/sync/enrich.ts
 var DEFAULT_CONCURRENCY = 5;
 var MAX_RETRIES = 3;
@@ -5351,7 +5430,7 @@ function pickFields(obj, fields) {
   }
   return result;
 }
-async function enrichPhase(api, db, config2, model, idField, connectionKey, platform) {
+async function enrichPhase(api, db, config2, model, idField, connectionKey, platform, ctx = {}) {
   const startTime = Date.now();
   const tsField = config2.timestampField ?? "_enriched_at";
   const safeTable = model.replace(/[^a-zA-Z0-9_]/g, "_");
@@ -5399,6 +5478,7 @@ async function enrichPhase(api, db, config2, model, idField, connectionKey, plat
     );
     let batchHitRateLimit = false;
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const pending = [];
     for (let j = 0; j < results.length; j++) {
       const result = results[j];
       const row = batch[j];
@@ -5413,28 +5493,7 @@ async function enrichPhase(api, db, config2, model, idField, connectionKey, plat
         }
         const merged = config2.merge !== false ? deepMerge(row, enrichedData) : { ...enrichedData, [idField]: id };
         merged[tsField] = now;
-        const setClauses = [];
-        const values = [];
-        for (const [key, val] of Object.entries(merged)) {
-          if (key === idField) continue;
-          setClauses.push(`"${key}" = ?`);
-          values.push(prepareValue2(val));
-        }
-        values.push(prepareValue2(id));
-        if (setClauses.length > 0) {
-          const existingCols = new Set(db.prepare(`PRAGMA table_info("${safeTable}")`).all().map((c) => c.name));
-          for (const [key, val] of Object.entries(merged)) {
-            if (!existingCols.has(key)) {
-              const colType = detectColumnType2(val);
-              db.exec(`ALTER TABLE "${safeTable}" ADD COLUMN "${key}" ${colType}`);
-              existingCols.add(key);
-            }
-          }
-          db.prepare(
-            `UPDATE "${safeTable}" SET ${setClauses.join(", ")} WHERE "${safeIdField}" = ?`
-          ).run(...values);
-        }
-        enriched++;
+        pending.push({ merged, id });
       } else if (result.status === "fulfilled" && result.value === null) {
         rateLimited++;
         skipped++;
@@ -5443,6 +5502,62 @@ async function enrichPhase(api, db, config2, model, idField, connectionKey, plat
         skipped++;
       }
     }
+    let writes = pending;
+    if (ctx.transform && pending.length > 0) {
+      const transformed = await transformRecords(ctx.transform, pending.map((p10) => p10.merged));
+      if (transformed) {
+        const byId = /* @__PURE__ */ new Map();
+        for (const r of transformed) byId.set(r[idField], r);
+        writes = [];
+        for (const p10 of pending) {
+          const t = byId.get(p10.id);
+          if (!t) continue;
+          if (!t[tsField]) t[tsField] = now;
+          writes.push({ merged: t, id: p10.id });
+        }
+      }
+    }
+    const hookEvents = [];
+    for (const { merged, id } of writes) {
+      if (ctx.exclude && ctx.exclude.length > 0) {
+        stripExcludedFields(merged, ctx.exclude);
+      }
+      if (ctx.identityKey) {
+        const raw = getByDotPath2(merged, ctx.identityKey);
+        if (raw !== null && raw !== void 0) {
+          merged._identity = String(raw).toLowerCase().trim();
+        }
+      }
+      const setClauses = [];
+      const values = [];
+      for (const [key, val] of Object.entries(merged)) {
+        if (key === idField) continue;
+        setClauses.push(`"${key}" = ?`);
+        values.push(prepareValue2(val));
+      }
+      values.push(prepareValue2(id));
+      if (setClauses.length > 0) {
+        const existingCols = new Set(db.prepare(`PRAGMA table_info("${safeTable}")`).all().map((c) => c.name));
+        for (const [key, val] of Object.entries(merged)) {
+          if (!existingCols.has(key)) {
+            const colType = detectColumnType2(val);
+            db.exec(`ALTER TABLE "${safeTable}" ADD COLUMN "${key}" ${colType}`);
+            existingCols.add(key);
+          }
+        }
+        db.prepare(
+          `UPDATE "${safeTable}" SET ${setClauses.join(", ")} WHERE "${safeIdField}" = ?`
+        ).run(...values);
+      }
+      enriched++;
+      if (ctx.onUpdate || ctx.onChange) {
+        hookEvents.push({ type: "update", platform, model, record: merged, timestamp: now });
+      }
+    }
+    if (hookEvents.length > 0) {
+      const hook = ctx.onUpdate || ctx.onChange;
+      if (hook) await fireHooks(hook, hookEvents);
+    }
     if (batchHitRateLimit) {
       concurrency = Math.max(1, Math.floor(concurrency / 2));
       if (!isAgentMode()) {
@@ -5522,80 +5637,6 @@ function detectColumnType2(value) {
   return "TEXT";
 }
 
-// src/lib/sync/transform.ts
-import { spawn as spawn3 } from "child_process";
-var TRANSFORM_TIMEOUT_MS = 6e4;
-async function transformRecords(command, records) {
-  const input = JSON.stringify(records);
-  return new Promise((resolve) => {
-    const child = spawn3("sh", ["-c", command], {
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString();
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString();
-    });
-    const timer = setTimeout(() => {
-      try {
-        child.kill();
-      } catch {
-      }
-      if (!isAgentMode()) {
-        process.stderr.write(`  Transform timed out after ${TRANSFORM_TIMEOUT_MS / 1e3}s \u2014 using original records
-`);
-      }
-      resolve(null);
-    }, TRANSFORM_TIMEOUT_MS);
-    child.on("exit", (code) => {
-      clearTimeout(timer);
-      if (stderr.trim() && !isAgentMode()) {
-        process.stderr.write(`  Transform stderr: ${stderr.trim()}
-`);
-      }
-      if (code !== 0) {
-        if (!isAgentMode()) {
-          process.stderr.write(`  Transform exited with code ${code} \u2014 using original records
-`);
-        }
-        resolve(null);
-        return;
-      }
-      try {
-        const parsed = JSON.parse(stdout.trim());
-        if (!Array.isArray(parsed)) {
-          if (!isAgentMode()) {
-            process.stderr.write(`  Transform returned non-array JSON \u2014 using original records
-`);
-          }
-          resolve(null);
-          return;
-        }
-        resolve(parsed);
-      } catch {
-        if (!isAgentMode()) {
-          process.stderr.write(`  Transform returned invalid JSON \u2014 using original records
-`);
-        }
-        resolve(null);
-      }
-    });
-    child.on("error", (err) => {
-      clearTimeout(timer);
-      if (!isAgentMode()) {
-        process.stderr.write(`  Transform failed to start: ${err.message} \u2014 using original records
-`);
-      }
-      resolve(null);
-    });
-    child.stdin.write(input);
-    child.stdin.end();
-  });
-}
-
 // src/lib/sync/runner.ts
 var MAX_RETRIES_PER_PAGE = 3;
 var DEFAULT_SINCE_DAYS = 90;
@@ -5995,11 +6036,22 @@ async function syncModel(api, profile, options) {
         model,
         profile.idField,
         profile.connectionKey,
-        platform
+        platform,
+        {
+          transform: profile.transform,
+          exclude: profile.exclude,
+          identityKey: profile.identityKey,
+          onInsert: profile.onInsert,
+          onUpdate: profile.onUpdate,
+          onChange: profile.onChange
+        }
       );
       enrichedTotal = enrichResult.enriched;
       enrichSkipped = enrichResult.skipped;
       enrichRateLimited = enrichResult.rateLimited;
+      if (hasHooks && (profile.onUpdate || profile.onChange)) {
+        hooksUpdated += enrichResult.enriched;
+      }
       if (enrichResult.enriched > 0) {
         rebuildFtsIndex(db, model);
       }
@@ -8201,8 +8253,32 @@ one --agent relay deliveries --endpoint-id <id>    # Check delivery status
 2. **Get event types** \u2014 \`one --agent relay event-types <platform>\`
 3. **Get source knowledge** \u2014 understand the incoming webhook payload shape (\`{{payload.*}}\` paths)
 4. **Get destination knowledge** \u2014 understand the outgoing API body shape
-5. **Create endpoint** \u2014 with \`--create-webhook\` and \`--event-filters\`
-6. **Activate** \u2014 with passthrough action mapping source fields to destination fields
+5. **Create endpoint** \u2014 with \`--create-webhook\`, \`--event-filters\`, and \`--metadata\` if the source platform requires it
+6. **Activate** \u2014 with passthrough action mapping source fields to destination fields. **Do NOT pass \`--webhook-secret\`** when the endpoint was created with \`--create-webhook\` \u2014 the correct secret is auto-stored, and supplying a wrong one silently drops every delivery (events arrive, 0 deliveries).
+
+## Platform-Specific Metadata (\`--metadata\`)
+
+Some source platforms need extra identifiers to register a webhook. Pass these via \`--metadata '<json>'\` on \`relay create\`. Without them, \`--create-webhook\` silently fails:
+
+| Platform | Required metadata keys |
+|---|---|
+| \`github\` | \`GITHUB_OWNER\`, \`GITHUB_REPOSITORY\` |
+| \`typeform\` | \`TYPEFORM_FORM_ID\` |
+| \`stripe\` | (none) |
+| \`airtable\` | (none) |
+| \`attio\` | (none) |
+| \`google-calendar\` | (none) |
+
+Example (GitHub):
+
+\`\`\`bash
+one --agent relay create \\
+  --connection-key "live::github::default::<key>" \\
+  --event-filters '["issues","pull_request"]' \\
+  --metadata '{"GITHUB_OWNER":"my-org","GITHUB_REPOSITORY":"my-repo"}' \\
+  --description "GitHub relay" \\
+  --create-webhook
+\`\`\`
 
 ## Template Context
 
@@ -8253,6 +8329,8 @@ Any connected platform can be a destination via passthrough actions.
 2. \`relay events --platform <p>\` \u2014 check events are arriving
 3. \`relay deliveries --event-id <id>\` \u2014 check delivery status and errors
 4. \`relay event <id>\` \u2014 inspect full payload to verify template paths
+
+**If events arrive but 0 deliveries succeed**: you likely passed a wrong \`--webhook-secret\` on \`relay activate\`. When you created the endpoint with \`--create-webhook\`, the secret was registered with the source platform and stored automatically \u2014 do not pass it again on activate. Signature verification will fail silently and every event will be dropped.
 `;
 var GUIDE_CACHE = `# One Cache \u2014 Reference
 
@@ -8478,6 +8556,8 @@ The transform can be any command: \`jq\`, \`python3\`, a bash script, or \`one f
 
 **Pipeline order:** fetch \u2192 enrich \u2192 transform \u2192 **exclude** \u2192 create table \u2192 schema evolution \u2192 upsert \u2192 hooks
 
+Transform, exclude, identityKey, and hooks all fire in **both** phases. In Phase 1 they run on the raw list page; in Phase 2 they run again on the merged (list + enriched) record so that transforms can extract columns from fields that only appear after enrichment. Phase 2 fires \`onUpdate\`/\`onChange\` for every row it writes \u2014 \`onInsert\` is Phase-1-only because the row already exists in SQL by the time enrichment runs.
+
 ## Cross-Platform Identity
 
 Add \`identityKey\` to a sync profile to extract a stable cross-platform identifier (e.g. email) into a normalized \`_identity\` column:
@@ -9416,7 +9496,7 @@ flow.command("scaffold [template]").description("Generate a workflow scaffold (t
   await flowScaffoldCommand(template);
 });
 var relay = program.command("relay").alias("r").description("Receive webhooks from platforms and relay them via passthrough actions");
-relay.command("create").description("Create a new relay endpoint for a connection").requiredOption("--connection-key <key>", "Connection key for the source platform").option("--description <desc>", "Description of the relay endpoint").option("--event-filters <json>", `JSON array of event types to filter (e.g. '["customer.created"]')`).option("--tags <json>", "JSON array of tags").option("--create-webhook", "Automatically register the webhook with the source platform").action(async (options) => {
+relay.command("create").description("Create a new relay endpoint for a connection").requiredOption("--connection-key <key>", "Connection key for the source platform").option("--description <desc>", "Description of the relay endpoint").option("--event-filters <json>", `JSON array of event types to filter (e.g. '["customer.created"]')`).option("--tags <json>", "JSON array of tags").option("--metadata <json>", `JSON object of platform-specific metadata required to register the webhook (e.g. GitHub: '{"GITHUB_OWNER":"org","GITHUB_REPOSITORY":"repo"}', Typeform: '{"TYPEFORM_FORM_ID":"abc"}')`).option("--create-webhook", "Automatically register the webhook with the source platform").action(async (options) => {
   await relayCreateCommand(options);
 });
 relay.command("list").alias("ls").description("List all relay endpoints").option("--limit <n>", "Max results per page").option("--page <n>", "Page number").action(async (options) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "1.36.0",
+  "version": "1.37.1",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/skills/one/references/relay.md

@@ -52,6 +52,25 @@ one --agent relay create \
 
 Always use `--create-webhook` — it registers the webhook URL with the source platform automatically.
 
+**Some source platforms require extra identifiers via `--metadata`:**
+
+| Platform | Required metadata keys |
+|---|---|
+| `github` | `GITHUB_OWNER`, `GITHUB_REPOSITORY` |
+| `typeform` | `TYPEFORM_FORM_ID` |
+| `stripe`, `airtable`, `attio`, `google-calendar` | (none) |
+
+Without metadata, `--create-webhook` silently fails for these platforms. Example for GitHub:
+
+```bash
+one --agent relay create \
+  --connection-key "live::github::default::<key>" \
+  --event-filters '["issues","pull_request"]' \
+  --metadata '{"GITHUB_OWNER":"my-org","GITHUB_REPOSITORY":"my-repo"}' \
+  --description "GitHub relay" \
+  --create-webhook
+```
+
 ### Step 6: Activate with a passthrough action
 
 ```bash
@@ -66,6 +85,8 @@ one --agent relay activate <relay-id> --actions '[{
 }]'
 ```
 
+**Do NOT pass `--webhook-secret` on activate** when you created the endpoint with `--create-webhook`. The correct secret is registered with the source platform and stored automatically. Supplying a wrong one does not error — events arrive but every delivery is dropped during signature verification (0 deliveries). If you don't have a reason to override the secret, omit the flag.
+
 ## Template Context
 
 | Variable | Description |
@@ -177,3 +198,5 @@ one --agent relay deliveries --event-id <id>
 - Event filters on both the endpoint and individual actions must match
 - Multiple actions can be attached to a single relay endpoint
 - Missing template variables resolve to empty strings — verify `{{payload.*}}` paths against the actual payload
+- GitHub and Typeform relays require `--metadata` on create; without it `--create-webhook` silently fails
+- Never pass `--webhook-secret` on activate when the endpoint was created with `--create-webhook` — the auto-stored secret is correct, and a wrong one causes signature verification to drop every event silently