@withone/cli 1.48.0 → 1.50.0

package/README.md

@@ -179,7 +179,7 @@ Opens your browser, you authorize, done. The CLI polls until the connection is l
 
 ### `one list`
 
-List your active connections with their status and connection keys.
+List your active connections with their status, connection keys, and what your access config lets you run on each.
 
 ```bash
 one list
@@ -193,6 +193,37 @@ one list
 
 You need the connection key (rightmost column) when executing actions.
 
+**Access reporting.** Every connection carries an `access` field describing what the current [access control](#one-config) config permits — so an agent knows its reach up front instead of discovering it as a failure mid-workflow. Three policies:
+
+| Policy | Means | Shown when |
+|--------|-------|-----------|
+| `{"policy": "full"}` | Every action on the connection | Default (admin, no action allowlist) |
+| `{"policy": "methods", "methods": ["GET"]}` | Only actions with those HTTP methods | Permission level is `read` or `write` |
+| `{"policy": "actions", "actions": [{"actionId": "...", "title": "...", "method": "..."}]}` | Only these specific actions | An action allowlist is configured |
+
+An action allowlist wins over the permission level (and is then method-filtered by it). When the policy is `actions`, those actions are exactly what may run — no `actions search` needed.
+
+```jsonc
+// one --agent list
+{
+  "total": 2,
+  "showing": 2,
+  "connections": [
+    {
+      "platform": "gmail",
+      "state": "operational",
+      "key": "live::gmail::default::abc123",
+      "access": { "policy": "methods", "methods": ["GET"] }
+    }
+  ],
+  "accessHint": "Permission level \"read\": only GET actions will execute."
+}
+```
+
+`knowledgeOnly: true` appears when knowledge-only mode is on (execution disabled), and `unresolvedActionIds` lists any allowlisted action ids that could not be looked up. In human output, an `Access` column and a summary note appear only when access is actually scoped.
+
+This mirrors the `access` field on the One MCP server's `list_one_integrations` tool, so both surfaces report access the same way.
+
 ### `one connection delete <connection-key>`
 
 Remove a connection by its key.
@@ -329,9 +360,18 @@ One ships a local memory store (a real Postgres process bootstrapped on demand v
 ```bash
 # User memories — works immediately on a new install
 one mem add note '{"content":"Design review is Thursday"}' --tags work --weight 7
+one mem update <id> '{"status":"done"}'              # merges into data; refreshes searchable_text
 one mem search "design review"                       # hybrid FTS + semantic (if key set)
 one mem list note --limit 20
 
+# Identity keys are a first-class column (unique across ACTIVE records; archiving
+# frees them). Manage them after creation with `mem key` — NOT via `mem update`.
+one mem key <id> --add email:x@y.com                 # also --remove / --set <csv>
+
+# Backfill searchable_text for rows that landed NULL or with UUID-noise-heavy text
+# (drops ids/timestamps, leads with name/title/email). No embedding provider needed.
+one mem reindex --searchable --type attio/attioPeople
+
 # Listing synced platform rows — type is positional and namespaced as <platform>/<model>;
 # there is NO --platform flag and NO platform column in the schema.
 one mem list "gmail/threads"
@@ -567,6 +607,8 @@ one config
 
 Settings propagate automatically to all installed agent configs.
 
+Run [`one list`](#one-list) to see the effect: each connection reports an `access` field describing exactly what these settings let you run on it.
+
 #### `one config skills status` / `one config skills sync`
 
 `one init` copies the packaged skill files (`SKILL.md`, `references/`) into `~/.agents/skills/one/` and symlinks per-agent paths to that canonical directory. When the CLI self-updates, the skill files in the canonical dir would normally stay frozen at the version that was installed. To prevent stale docs, every CLI command checks a `.one-cli-version` marker in the canonical dir and silently refreshes the skill files if they don't match the running CLI version. No user action required.

package/dist/{chunk-H2PP5XEQ.js → chunk-4WWK3GO5.js}

@@ -3,10 +3,10 @@ import {
   isAgentMode,
   json,
   requireMemoryInit
-} from "./chunk-M326Y5X6.js";
+} from "./chunk-CLJFSFFM.js";
 import {
   getBackend
-} from "./chunk-BHAEEALR.js";
+} from "./chunk-7RV7T5PX.js";
 
 // src/commands/mem/sql.ts
 async function memSqlCommand(sql) {

package/dist/{chunk-BHAEEALR.js → chunk-7RV7T5PX.js}

@@ -5,13 +5,13 @@ import {
   getMemoryConfig,
   getMemoryConfigOrDefault,
   updateMemoryConfig
-} from "./chunk-BV2NYIA7.js";
+} from "./chunk-C7DWZ7B5.js";
 import {
   getOpenAiApiKey
 } from "./chunk-SO323PZP.js";
 
 // src/lib/memory/schema.ts
-var SCHEMA_VERSION = "2.1.0";
+var SCHEMA_VERSION = "2.2.0";
 var EXTENSIONS_SQL = ``;
 var VECTOR_EXTENSION_SQL = `
 CREATE EXTENSION IF NOT EXISTS vector;
@@ -105,19 +105,31 @@ BEGIN
 END $$;
 `;
 var FUNCTIONS_SQL = `
--- Enforce global uniqueness of the "keys" array across records.
+-- Enforce uniqueness of the "keys" array across ACTIVE records only.
+--
+-- Scoping to active is deliberate: an archived record must not squat on a
+-- key forever. If it did, re-adding the same identity (e.g. a person who
+-- was archived and re-surfaced) would hard-fail with 23505 and the key
+-- could never be reclaimed. So:
+--   - Only ACTIVE incoming rows are checked (an archived NEW row can hold
+--     any keys, including ones a live record also holds \u2014 provenance).
+--   - Conflicts are only raised against other ACTIVE records.
+-- Array-overlap uniqueness can't be expressed as a partial UNIQUE index
+-- (btree can't index "arrays overlap"), so the invariant lives here in a
+-- trigger. find-by-source, key lookups, and mem_upsert_by_keys all
+-- prefer active rows to match this scoping (see below).
 CREATE OR REPLACE FUNCTION mem_enforce_key_uniqueness()
 RETURNS TRIGGER LANGUAGE plpgsql AS $$
 DECLARE
     conflicting_id UUID;
 BEGIN
-    IF NEW.keys IS NULL THEN RETURN NEW; END IF;
+    IF NEW.keys IS NULL OR NEW.status <> 'active' THEN RETURN NEW; END IF;
     SELECT id INTO conflicting_id
     FROM mem_records
-    WHERE keys && NEW.keys AND id != NEW.id
+    WHERE keys && NEW.keys AND id != NEW.id AND status = 'active'
     LIMIT 1;
     IF conflicting_id IS NOT NULL THEN
-        RAISE EXCEPTION 'Key conflict: one or more keys in % already exist on record %',
+        RAISE EXCEPTION 'Key conflict: one or more keys in % already exist on active record %',
             NEW.keys, conflicting_id USING ERRCODE = 'unique_violation';
     END IF;
     RETURN NEW;
@@ -224,14 +236,15 @@ DECLARE
 BEGIN
     -- Deterministic pick when more than one row's keys[] overlap p_keys
     -- (e.g. the incoming row identity-merges with an old Attio-id row AND
-    -- a newer email-keyed row from a separate sync). Newest-updated wins;
-    -- ties broken by id. Without ORDER BY, PG returns whichever row the
-    -- planner happens to surface first, leaving the loser persisted with
-    -- overlapping keys and breaking the keys-are-unique invariant.
+    -- a newer email-keyed row from a separate sync). Active rows win over
+    -- archived (key uniqueness is scoped to active, so an archived dupe may
+    -- coexist \u2014 never merge into it when a live owner exists); then newest-
+    -- updated; ties broken by id. Without ORDER BY, PG returns whichever
+    -- row the planner surfaces first, breaking the keys-are-unique invariant.
     SELECT r.id INTO existing_id
     FROM mem_records r
     WHERE r.keys && p_keys
-    ORDER BY r.updated_at DESC NULLS LAST, r.id ASC
+    ORDER BY (r.status = 'active') DESC, r.updated_at DESC NULLS LAST, r.id ASC
     LIMIT 1;
 
     IF existing_id IS NOT NULL THEN
@@ -308,12 +321,12 @@ DECLARE
 BEGIN
     v_embedding := CASE WHEN p_embedding IS NOT NULL THEN p_embedding::vector ELSE NULL END;
 
-    -- See no-vector variant for ORDER BY rationale (deterministic pick
-    -- when multiple rows' keys overlap p_keys).
+    -- See no-vector variant for ORDER BY rationale (active-preferred,
+    -- deterministic pick when multiple rows' keys overlap p_keys).
     SELECT r.id INTO existing_id
     FROM mem_records r
     WHERE r.keys && p_keys
-    ORDER BY r.updated_at DESC NULLS LAST, r.id ASC
+    ORDER BY (r.status = 'active') DESC, r.updated_at DESC NULLS LAST, r.id ASC
     LIMIT 1;
 
     IF existing_id IS NOT NULL THEN
@@ -478,6 +491,13 @@ function hotColumnIndexName(type, jsonPath) {
 
 // src/lib/memory/plugins/postgres-core/backend.ts
 var SCHEMA_LOCK_ID = 7193095520723763200n.toString();
+function isUniqueViolation(err) {
+  if (!err || typeof err !== "object") return false;
+  const e = err;
+  if (e.code === "23505") return true;
+  const msg = typeof e.message === "string" ? e.message : "";
+  return /23505|unique_violation|Key conflict/i.test(msg);
+}
 function toRecord(row) {
   return {
     id: row.id,
@@ -512,6 +532,10 @@ var CoreBackend = class {
   }
   async ensureSchema() {
     const caps = this.caps;
+    try {
+      if (await this.getSchemaVersion() === SCHEMA_VERSION) return;
+    } catch {
+    }
     await this.client.transaction(async (tx) => {
       try {
         await tx.query(`SELECT pg_advisory_xact_lock(${SCHEMA_LOCK_ID}::bigint)`);
@@ -623,6 +647,9 @@ var CoreBackend = class {
     const searchable = patch.searchable_text ?? existing.searchable_text ?? null;
     const hash = patch.content_hash ?? existing.content_hash ?? null;
     const weight = patch.weight ?? existing.weight;
+    const textChanged = searchable !== (existing.searchable_text ?? null);
+    const clearEmbedding = textChanged && this.caps.vectorSearch;
+    const embeddingReset = clearEmbedding ? `, embedding = NULL, embedded_at = NULL, embedding_model = NULL` : "";
     const res = await this.client.query(
       `UPDATE mem_records
          SET data = $2::jsonb,
@@ -631,13 +658,46 @@ var CoreBackend = class {
              sources = $5::jsonb,
              searchable_text = $6,
              content_hash = $7,
-             weight = $8
+             weight = $8${embeddingReset}
        WHERE id = $1
        RETURNING *`,
       [id, JSON.stringify(data), tags, keys, JSON.stringify(sources), searchable, hash, weight]
     );
     return res.rows[0] ? toRecord(res.rows[0]) : null;
   }
+  async updateKeys(id, keys) {
+    try {
+      return await this.client.transaction(async (tx) => {
+        const exists = await tx.query(
+          `SELECT id FROM mem_records WHERE id = $1`,
+          [id]
+        );
+        if (!exists.rows[0]) return { status: "not_found" };
+        const conflict = await tx.query(
+          `SELECT r.id, r.type,
+                  (SELECT k FROM unnest($2::text[]) AS k WHERE k = ANY(r.keys) LIMIT 1) AS key
+             FROM mem_records r
+            WHERE r.keys && $2::text[] AND r.id != $1 AND r.status = 'active'
+            LIMIT 1`,
+          [id, keys]
+        );
+        const c = conflict.rows[0];
+        if (c) {
+          return { status: "conflict", key: c.key, recordId: c.id, recordType: c.type };
+        }
+        const res = await tx.query(
+          `UPDATE mem_records SET keys = $2::text[] WHERE id = $1 RETURNING *`,
+          [id, keys.length > 0 ? keys : null]
+        );
+        return { status: "ok", record: toRecord(res.rows[0]) };
+      });
+    } catch (err) {
+      if (isUniqueViolation(err)) {
+        return { status: "conflict", key: keys[0] ?? "", recordId: "unknown", recordType: "unknown" };
+      }
+      throw err;
+    }
+  }
   async remove(id) {
     const res = await this.client.query(`DELETE FROM mem_records WHERE id = $1`, [id]);
     return (res.rowCount ?? 0) > 0;
@@ -651,12 +711,30 @@ var CoreBackend = class {
     return (res.rowCount ?? 0) > 0;
   }
   async unarchive(id) {
-    const res = await this.client.query(
-      `UPDATE mem_records SET status = 'active', archived_reason = NULL
-       WHERE id = $1 AND status = 'archived'`,
-      [id]
-    );
-    return (res.rowCount ?? 0) > 0;
+    try {
+      const res = await this.client.query(
+        `UPDATE mem_records SET status = 'active', archived_reason = NULL
+         WHERE id = $1 AND status = 'archived'`,
+        [id]
+      );
+      return (res.rowCount ?? 0) > 0;
+    } catch (err) {
+      if (!isUniqueViolation(err)) throw err;
+      const owner = await this.client.query(
+        `SELECT r.id, r.type,
+                (SELECT k FROM unnest(a.keys) AS k
+                  WHERE k = ANY(r.keys) LIMIT 1) AS key
+           FROM mem_records a
+           JOIN mem_records r
+             ON r.keys && a.keys AND r.id != a.id AND r.status = 'active'
+          WHERE a.id = $1
+          LIMIT 1`,
+        [id]
+      );
+      const o = owner.rows[0];
+      const detail = o ? `key "${o.key}" was reclaimed by active record ${o.id} (type ${o.type}) \u2014 re-key it or archive that record first` : `one of its keys was reclaimed by another active record`;
+      throw new Error(`Cannot unarchive ${id}: ${detail}`);
+    }
   }
   async list(type, opts = {}) {
     const limit = opts.limit ?? 100;
@@ -733,6 +811,48 @@ var CoreBackend = class {
       [id, literal, model]
     );
   }
+  async listForSearchableBackfill(opts = {}) {
+    const limit = opts.limit ?? 1e3;
+    const offset = opts.offset ?? 0;
+    const params = [];
+    const clauses = [`status = 'active'`];
+    if (opts.type) {
+      params.push(opts.type);
+      clauses.push(`type = $${params.length}`);
+    }
+    if (opts.onlyNull) {
+      clauses.push(`(searchable_text IS NULL OR searchable_text = '')`);
+    }
+    params.push(limit);
+    params.push(offset);
+    const res = await this.client.query(
+      `SELECT id, type, data, searchable_text
+         FROM mem_records
+        WHERE ${clauses.join(" AND ")}
+        ORDER BY id ASC
+        LIMIT $${params.length - 1} OFFSET $${params.length}`,
+      params
+    );
+    return res.rows;
+  }
+  async updateSearchableText(id, text) {
+    if (this.caps.vectorSearch) {
+      await this.client.query(
+        `UPDATE mem_records
+            SET searchable_text = $2,
+                embedding = NULL,
+                embedded_at = NULL,
+                embedding_model = NULL
+          WHERE id = $1`,
+        [id, text]
+      );
+      return;
+    }
+    await this.client.query(
+      `UPDATE mem_records SET searchable_text = $2 WHERE id = $1`,
+      [id, text]
+    );
+  }
   async listKeysByType(type) {
     const res = await this.client.query(
       `SELECT id, keys FROM mem_records WHERE type = $1 AND status = 'active'`,
@@ -871,7 +991,10 @@ var CoreBackend = class {
   }
   async findBySource(sourceKey) {
     const res = await this.client.query(
-      `SELECT * FROM mem_records WHERE $1 = ANY(keys) LIMIT 1`,
+      `SELECT * FROM mem_records
+        WHERE $1 = ANY(keys)
+        ORDER BY (status = 'active') DESC, updated_at DESC
+        LIMIT 1`,
       [sourceKey]
     );
     return res.rows[0] ? toRecord(res.rows[0]) : null;
@@ -1105,6 +1228,9 @@ var LazyPostgresBackend = class {
   async update(...a) {
     return (await this.ensure()).update(...a);
   }
+  async updateKeys(...a) {
+    return (await this.ensure()).updateKeys(...a);
+  }
   async remove(...a) {
     return (await this.ensure()).remove(...a);
   }
@@ -1126,9 +1252,15 @@ var LazyPostgresBackend = class {
   async listKeysByType(...a) {
     return (await this.ensure()).listKeysByType(...a);
   }
+  async listForSearchableBackfill(...a) {
+    return (await this.ensure()).listForSearchableBackfill(...a);
+  }
   async updateEmbedding(...a) {
     return (await this.ensure()).updateEmbedding(...a);
   }
+  async updateSearchableText(...a) {
+    return (await this.ensure()).updateSearchableText(...a);
+  }
   async raw(sql, params) {
     const b = await this.ensure();
     if (!b.raw) throw new Error("Backend does not support raw SQL");
@@ -1451,6 +1583,9 @@ var LazyEmbeddedPostgresBackend = class {
   async update(...a) {
     return (await this.ensure()).update(...a);
   }
+  async updateKeys(...a) {
+    return (await this.ensure()).updateKeys(...a);
+  }
   async remove(...a) {
     return (await this.ensure()).remove(...a);
   }
@@ -1472,9 +1607,15 @@ var LazyEmbeddedPostgresBackend = class {
   async listKeysByType(...a) {
     return (await this.ensure()).listKeysByType(...a);
   }
+  async listForSearchableBackfill(...a) {
+    return (await this.ensure()).listForSearchableBackfill(...a);
+  }
   async updateEmbedding(...a) {
     return (await this.ensure()).updateEmbedding(...a);
   }
+  async updateSearchableText(...a) {
+    return (await this.ensure()).updateSearchableText(...a);
+  }
   async raw(sql, params) {
     const b = await this.ensure();
     if (!b.raw) throw new Error("Backend does not support raw SQL");
@@ -1671,6 +1812,21 @@ async function addRecord(input, opts = {}) {
   };
   return backend.insert(prepared);
 }
+async function updateRecord(id, patch) {
+  const backend = await getBackend();
+  const existing = await backend.getById(id);
+  if (!existing) return null;
+  const mergedData = patch.data ? { ...existing.data, ...patch.data } : existing.data;
+  const dataChanged = patch.data !== void 0;
+  const searchable_text = patch.searchable_text ?? (dataChanged ? defaultSearchableText(mergedData) : existing.searchable_text ?? void 0);
+  const content_hash = patch.content_hash ?? (dataChanged ? contentHash(mergedData) : existing.content_hash ?? void 0);
+  return backend.update(id, {
+    ...patch,
+    data: mergedData,
+    searchable_text,
+    content_hash
+  });
+}
 async function upsertRecord(input, opts = {}) {
   const backend = await getBackend();
   const { searchable_text, content_hash, embedding, embedding_model } = await prepareRecord(input, opts, "sync");
@@ -1706,5 +1862,6 @@ export {
   resetBackendSingleton,
   closeBackendIfCached,
   addRecord,
+  updateRecord,
   upsertRecord
 };

package/dist/{chunk-BV2NYIA7.js → chunk-C7DWZ7B5.js}

@@ -172,29 +172,78 @@ async function embedBatch(texts, opts = {}) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}([T ]\d{2}:\d{2}(:\d{2})?(\.\d+)?(Z|[+-]\d{2}:?\d{2})?)?$/;
+var NOISE_KEY_RE = /(^|_)(id|ids|uuid|guid|url|href|link|avatar|photo|icon|hash|token|slug)$/i;
+var NOISE_KEY_EXACT = /* @__PURE__ */ new Set([
+  "attribute_type",
+  "actor_type",
+  "created_by_actor",
+  "active_from",
+  "active_until",
+  "created_at",
+  "updated_at",
+  "last_synced_at"
+]);
+var CONTAINER_KEYS = /* @__PURE__ */ new Set([
+  "values",
+  "value",
+  "data",
+  "attributes",
+  "properties",
+  "items",
+  "records",
+  "result",
+  "results",
+  "fields"
+]);
+var PRIORITY_KEY_RE = /(^|_)(name|full_name|first_name|last_name|display_name|title|job_title|role|position|email|email_address|company|organization|org|description|bio|summary|headline|label|subject|content|body|text_content)$/i;
 function defaultSearchableText(data, maxLen = 4e3) {
-  const parts = [];
-  const walk = (value, depth = 0) => {
+  const priority = [];
+  const normal = [];
+  const push = (key, text) => {
+    if (key && PRIORITY_KEY_RE.test(key)) priority.push(text);
+    else normal.push(text);
+  };
+  const walk = (value, key, depth) => {
     if (value === null || value === void 0) return;
-    if (typeof value === "string" && value.trim()) {
-      parts.push(value.trim());
+    if (typeof value === "string") {
+      const t = value.trim();
+      if (!t) return;
+      if (UUID_RE.test(t) || TIMESTAMP_RE.test(t)) return;
+      if (key && NOISE_KEY_RE.test(key)) return;
+      push(key, t);
       return;
     }
     if (typeof value === "number" || typeof value === "boolean") {
-      parts.push(String(value));
+      if (key && NOISE_KEY_RE.test(key)) return;
+      push(key, String(value));
       return;
     }
-    if (depth > 4) return;
+    if (depth > 6) return;
     if (Array.isArray(value)) {
-      for (const v of value) walk(v, depth + 1);
+      for (const v of value) walk(v, key, depth + 1);
       return;
     }
     if (typeof value === "object") {
-      for (const v of Object.values(value)) walk(v, depth + 1);
+      for (const [k, v] of Object.entries(value)) {
+        const lower = k.toLowerCase();
+        if (NOISE_KEY_EXACT.has(lower) || NOISE_KEY_RE.test(k)) continue;
+        const nextKey = CONTAINER_KEYS.has(lower) ? key : k;
+        walk(v, nextKey, depth + 1);
+      }
     }
   };
-  walk(data);
-  const joined = parts.join(" ").replace(/\s+/g, " ").trim();
+  walk(data, void 0, 0);
+  const seen = /* @__PURE__ */ new Set();
+  const ordered = [];
+  for (const t of [...priority, ...normal]) {
+    const norm = t.toLowerCase();
+    if (seen.has(norm)) continue;
+    seen.add(norm);
+    ordered.push(t);
+  }
+  const joined = ordered.join(" ").replace(/\s+/g, " ").trim();
   return joined.length > maxLen ? joined.slice(0, maxLen) : joined;
 }
 

package/dist/{chunk-M326Y5X6.js → chunk-CLJFSFFM.js}

@@ -1,6 +1,6 @@
 import {
   getMemoryConfigOrDefault
-} from "./chunk-BV2NYIA7.js";
+} from "./chunk-C7DWZ7B5.js";
 import {
   getOpenAiApiKey,
   readConfig

package/dist/{chunk-2TWFL3CS.js → chunk-D6W756DN.js}

@@ -2319,7 +2319,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-IBB42ED2.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-YDKAYGZW.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,
@@ -3238,11 +3238,11 @@ export {
   ApiError,
   OneApi,
   TimeoutError,
+  PERMISSION_METHODS,
   filterByPermissions,
   isMethodAllowed,
   isActionAllowed,
   buildActionKnowledgeWithGuidance,
-  validateActionInput,
   knowledgeCachePath,
   searchCachePath,
   readCache,
@@ -3256,6 +3256,7 @@ export {
   clearEntry,
   makeCacheEntry,
   resolveActionDetails,
+  validateActionInput,
   FLOW_SCHEMA,
   getStepTypeDescriptor,
   getNestedStepsKeys,

package/dist/{chunk-QE6Z676D.js → chunk-GXOIR3GF.js}

@@ -6,11 +6,11 @@ import {
   note,
   okJson,
   requireMemoryInit
-} from "./chunk-M326Y5X6.js";
+} from "./chunk-CLJFSFFM.js";
 import {
   getBackend,
   upsertRecord
-} from "./chunk-BHAEEALR.js";
+} from "./chunk-7RV7T5PX.js";
 
 // src/commands/mem/migrate.ts
 import fs4 from "fs";

package/dist/{embedding-K2CFCLXI.js → embedding-2YB6CGBA.js}

@@ -2,7 +2,7 @@ import {
   defaultSearchableText,
   embed,
   embedBatch
-} from "./chunk-BV2NYIA7.js";
+} from "./chunk-C7DWZ7B5.js";
 import "./chunk-SO323PZP.js";
 export {
   defaultSearchableText,

package/dist/{flow-runner-IBB42ED2.js → flow-runner-YDKAYGZW.js}

@@ -12,7 +12,7 @@ import {
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-2TWFL3CS.js";
+} from "./chunk-D6W756DN.js";
 import "./chunk-44CV5IMX.js";
 import "./chunk-SO323PZP.js";
 export {

package/dist/index.js

@@ -3,6 +3,7 @@ import {
   FLOW_SCHEMA,
   FlowRunner,
   OneApi,
+  PERMISSION_METHODS,
   TimeoutError,
   buildActionKnowledgeWithGuidance,
   buildCacheMeta,
@@ -31,10 +32,10 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-2TWFL3CS.js";
+} from "./chunk-D6W756DN.js";
 import {
   memSqlCommand
-} from "./chunk-H2PP5XEQ.js";
+} from "./chunk-4WWK3GO5.js";
 import {
   countRecords,
   deleteDatabase,
@@ -59,7 +60,7 @@ import {
   upsertRecords,
   writeDraftProfile,
   writeProfile
-} from "./chunk-QE6Z676D.js";
+} from "./chunk-GXOIR3GF.js";
 import {
   getByDotPath
 } from "./chunk-44CV5IMX.js";
@@ -83,7 +84,7 @@ import {
   semanticSearchUpgradeLine,
   setAgentMode,
   silenceWarningsInAgentMode
-} from "./chunk-M326Y5X6.js";
+} from "./chunk-CLJFSFFM.js";
 import {
   SCHEMA_VERSION,
   addRecord,
@@ -92,8 +93,9 @@ import {
   getBackendPlugin,
   listBackendPlugins,
   loadBackendFromConfig,
+  updateRecord,
   upsertRecord
-} from "./chunk-BHAEEALR.js";
+} from "./chunk-7RV7T5PX.js";
 import {
   DEFAULT_MEMORY_CONFIG,
   defaultSearchableText,
@@ -103,7 +105,7 @@ import {
   memoryConfigExists,
   setOpenAiApiKey,
   updateMemoryConfig
-} from "./chunk-BV2NYIA7.js";
+} from "./chunk-C7DWZ7B5.js";
 import {
   appendAnalyticsQueue,
   appendUsageLog,
@@ -1941,6 +1943,54 @@ function maskApiKey(key) {
 import * as p4 from "@clack/prompts";
 import pc4 from "picocolors";
 
+// src/lib/access.ts
+async function resolveAllowedActions(api, actionIds) {
+  if (actionIds.includes("*")) return [];
+  const resolved = await Promise.all(
+    actionIds.map(async (actionId) => {
+      try {
+        const { details } = await resolveActionDetails(api, actionId, { warn: () => {
+        } });
+        if (!details.connectionPlatform) return null;
+        return {
+          actionId,
+          title: details.title,
+          method: details.method,
+          platform: details.connectionPlatform
+        };
+      } catch {
+        return null;
+      }
+    })
+  );
+  return resolved.filter((a) => a !== null);
+}
+function computeConnectionAccess(platform, permissions, allowedActionIds, grantedActions) {
+  if (!allowedActionIds.includes("*")) {
+    const actions2 = grantedActions.filter((a) => a.platform === platform).map(({ actionId, title, method }) => ({ actionId, title, method }));
+    return { policy: "actions", actions: actions2 };
+  }
+  const methods = PERMISSION_METHODS[permissions];
+  if (methods !== null) {
+    return { policy: "methods", methods };
+  }
+  return { policy: "full" };
+}
+function formatAccess(access, maxActions = 2) {
+  switch (access.policy) {
+    case "full":
+      return "full";
+    case "methods":
+      return access.methods.join(", ");
+    case "actions": {
+      if (access.actions.length === 0) return "none";
+      const shown = access.actions.slice(0, maxActions).map((a) => `${a.title} (${a.method})`);
+      const rest = access.actions.length - shown.length;
+      return rest > 0 ? `${shown.join(", ")} +${rest} more` : shown.join(", ");
+    }
+  }
+}
+
 // src/lib/platforms.ts
 function findPlatform(platforms, query) {
   const normalizedQuery = query.toLowerCase().trim();
@@ -2154,8 +2204,16 @@ async function connectionListCommand(options) {
   try {
     const allConnections = await api.listConnections();
     const ac = getAccessControlFromAllSources();
+    const permissions = ac.permissions || "admin";
     const allowedKeys = ac.connectionKeys || ["*"];
+    const actionIds = ac.actionIds || ["*"];
+    const knowledgeOnly = ac.knowledgeAgent || false;
     const accessFiltered = allowedKeys.includes("*") ? allConnections : allConnections.filter((conn) => allowedKeys.includes(conn.key));
+    const resolvedActions = await resolveAllowedActions(api, actionIds);
+    const unresolvedActionIds = actionIds.includes("*") ? [] : actionIds.filter((id) => !resolvedActions.some((a) => a.actionId === id));
+    const grantedActions = resolvedActions.filter((a) => isMethodAllowed(a.method, permissions));
+    const accessFor = (platform) => computeConnectionAccess(platform, permissions, actionIds, grantedActions);
+    const hintText = accessHint(permissions, actionIds, knowledgeOnly);
     const searchQuery = options?.search?.toLowerCase();
     const filtered = searchQuery ? accessFiltered.filter((conn) => conn.platform.toLowerCase().includes(searchQuery)) : accessFiltered;
     const limitArg = options?.limit ? parseInt(options.limit, 10) : void 0;
@@ -2171,8 +2229,12 @@ async function connectionListCommand(options) {
           state: conn.state,
           key: conn.key,
           ...conn.name && { name: conn.name },
-          ...conn.tags?.length && { tags: conn.tags }
+          ...conn.tags?.length && { tags: conn.tags },
+          access: accessFor(conn.platform)
         })),
+        ...knowledgeOnly && { knowledgeOnly: true },
+        ...unresolvedActionIds.length > 0 && { unresolvedActionIds },
+        ...hintText && { accessHint: hintText },
         ...limited.length < filtered.length && {
           hint: `Showing ${limited.length} of ${filtered.length} connections. Use --search <query> to filter by platform or --limit <n> to see more.`
         }
@@ -2205,20 +2267,34 @@ Add one with: ${pc4.cyan("one connection add gmail")}`,
       platform: conn.platform,
       state: conn.state,
       key: conn.key,
-      tags: conn.tags?.length ? conn.tags.join(", ") : ""
+      tags: conn.tags?.length ? conn.tags.join(", ") : "",
+      access: formatAccess(accessFor(conn.platform))
     }));
     const hasTags = rows.some((r) => r.tags);
+    const hasScopedAccess = rows.some((r) => r.access !== "full");
     printTable(
       [
         { key: "status", label: "" },
         { key: "platform", label: "Platform" },
         { key: "state", label: "Status" },
         { key: "key", label: "Connection Key", color: pc4.dim },
-        ...hasTags ? [{ key: "tags", label: "Tags", color: pc4.dim }] : []
+        ...hasTags ? [{ key: "tags", label: "Tags", color: pc4.dim }] : [],
+        ...hasScopedAccess ? [{ key: "access", label: "Access", color: pc4.yellow }] : []
       ],
       rows
     );
     console.log();
+    if (hintText) {
+      const lines = [hintText];
+      if (unresolvedActionIds.length > 0) {
+        lines.push(
+          `Could not resolve ${unresolvedActionIds.length} allowlisted action id(s): ${unresolvedActionIds.join(", ")}`
+        );
+      }
+      p4.note(`${wrapText(lines.join("\n"))}
+
+Change it with: ${pc4.cyan("one config")}`, "Access");
+    }
     if (displayed.length < filtered.length) {
       p4.note(
         `Showing ${displayed.length} of ${filtered.length}. Increase --limit or run without it to see all.`,
@@ -2291,6 +2367,37 @@ async function connectionDeleteCommand(connectionKey, options) {
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
+function accessHint(permissions, actionIds, knowledgeOnly) {
+  const parts = [];
+  if (!actionIds.includes("*")) {
+    parts.push(
+      "Action-scoped: each connection's `access.actions` are the only actions you may run \u2014 use them directly, no `actions search` needed."
+    );
+  } else if (permissions !== "admin") {
+    const methods = PERMISSION_METHODS[permissions]?.join(", ") ?? "";
+    parts.push(`Permission level "${permissions}": only ${methods} actions will execute.`);
+  }
+  if (knowledgeOnly) {
+    parts.push("Knowledge-only mode: `actions execute` is disabled \u2014 read knowledge and write code instead.");
+  }
+  return parts.length > 0 ? parts.join(" ") : null;
+}
+function wrapText(text5, width = 72) {
+  return text5.split("\n").map((paragraph) => {
+    const lines = [];
+    let line = "";
+    for (const word of paragraph.split(/\s+/)) {
+      if (line && line.length + 1 + word.length > width) {
+        lines.push(line);
+        line = word;
+      } else {
+        line = line ? `${line} ${word}` : word;
+      }
+    }
+    if (line) lines.push(line);
+    return lines.join("\n");
+  }).join("\n");
+}
 function getStatusIndicator(state) {
   switch (state) {
     case "operational":
@@ -6062,7 +6169,7 @@ async function syncModel(api, profile, options) {
         updateModelState(platform, model, { status: "failed", pagesProcessed, lastCursor }),
         (async () => {
           try {
-            const { getBackend: getBackend2 } = await import("./runtime-V4PXJJUV.js");
+            const { getBackend: getBackend2 } = await import("./runtime-2PRVL2NO.js");
             const backend = await getBackend2();
             await Promise.race([
               backend.close(),
@@ -6417,7 +6524,7 @@ async function syncModel(api, profile, options) {
         db.exec(`DROP TABLE IF EXISTS _seen_ids`);
       }
       if (options.toMemory !== false) {
-        const backend = await (await import("./runtime-V4PXJJUV.js")).getBackend();
+        const backend = await (await import("./runtime-2PRVL2NO.js")).getBackend();
         const type = `${platform}/${model}`;
         const existing = await backend.listKeysByType(type);
         const sourcePrefix = `${type}:`;
@@ -6497,7 +6604,7 @@ async function syncModel(api, profile, options) {
     let statusCounts;
     if (options.toMemory !== false) {
       try {
-        const backend = await (await import("./runtime-V4PXJJUV.js")).getBackend();
+        const backend = await (await import("./runtime-2PRVL2NO.js")).getBackend();
         const typeName = `${platform}/${model}`;
         const [active, archived] = await Promise.all([
           backend.count(typeName, { status: "active" }),
@@ -8130,7 +8237,7 @@ ${result.total} results`);
   }
 }
 async function syncSqlCommand(platformModel, sql) {
-  const { syncSqlCommand: runSyncSql } = await import("./sql-CBZQHP4R.js");
+  const { syncSqlCommand: runSyncSql } = await import("./sql-HG7R2JML.js");
   await runSyncSql(platformModel, sql);
 }
 async function syncDeleteCommand(platformModel, options) {
@@ -8208,7 +8315,7 @@ async function syncDeleteCommand(platformModel, options) {
 async function maybeAutoMigrateLegacy(platform, models) {
   const dbSize = getDatabaseSize(platform);
   if (!dbSize || dbSize === "0 B") return;
-  const { getBackend: getBackend2 } = await import("./runtime-V4PXJJUV.js");
+  const { getBackend: getBackend2 } = await import("./runtime-2PRVL2NO.js");
   const backend = await getBackend2();
   let memoryHasData = false;
   for (const model of models) {
@@ -8224,7 +8331,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
       `  detected legacy .one/sync/data/${platform}.db (${dbSize}) \u2014 auto-migrating into memory before sync.
 `
     );
-    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-CO4LQVY6.js");
+    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-TRUZVAT5.js");
     await memMigrateCommand3({ platform, yes: true });
     return;
   }
@@ -8233,7 +8340,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
     initialValue: true
   });
   if (p7.isCancel(shouldMigrate) || !shouldMigrate) return;
-  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-CO4LQVY6.js");
+  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-TRUZVAT5.js");
   await memMigrateCommand2({ platform, yes: true });
 }
 async function syncSuggestSearchableCommand(platformModel, options = {}) {
@@ -8294,7 +8401,7 @@ async function syncSuggestSearchableCommand(platformModel, options = {}) {
 async function syncListCommand(platform) {
   const profiles = listProfiles(platform);
   const state = await readSyncState();
-  const { getBackend: getBackend2 } = await import("./runtime-V4PXJJUV.js");
+  const { getBackend: getBackend2 } = await import("./runtime-2PRVL2NO.js");
   const backend = await getBackend2();
   const syncs = await Promise.all(profiles.map(async (p10) => {
     const modelState = state[p10.platform]?.[p10.model];
@@ -8569,7 +8676,7 @@ function registerSyncSubcommands(sync) {
     await syncSqlCommand(platformModel, sql);
   });
   sync.command("schema <platform/model>").description("Inspect the JSON structure of synced records (field paths, types, examples) \u2014 useful before writing `sync sql` queries").action(async (platformModel) => {
-    const { syncSchemaCommand } = await import("./schema-UC4LBV5V.js");
+    const { syncSchemaCommand } = await import("./schema-LCRWSFD5.js");
     await syncSchemaCommand(platformModel);
   });
   sync.command("delete <platform/model>").description('Delete records from local sync data (e.g. one sync delete notion/pages --id "abc-123")').option("--id <value>", "Delete record by ID").option("--where <conditions>", 'Delete records matching conditions (e.g. "status=archived")').option("--where-sql <predicate>", `Delete using a raw SQL WHERE clause (e.g. "json_extract(data, '$.type') = 'promotion'")`).option("--yes", "Skip confirmation prompt").action(async (platformModel, options) => {
@@ -9015,11 +9122,41 @@ async function memGetCommand(id, flags) {
 async function memUpdateCommand(id, patchRaw) {
   requireMemoryInit();
   const patch = parseJsonArg(patchRaw, "patch");
-  const backend = await getBackend();
-  const updated = await backend.update(id, { type: "", data: patch });
+  if (patch && typeof patch === "object" && !Array.isArray(patch) && "keys" in patch) {
+    error("`keys` is not a data field. Use `one mem key <id> --set <csv>` (or --add/--remove) to change a record's keys.");
+  }
+  const updated = await updateRecord(id, { data: patch });
   if (!updated) error(`Record ${id} not found`);
   printRecord(updated);
 }
+async function memKeyCommand(id, flags) {
+  requireMemoryInit();
+  const backend = await getBackend();
+  const setList = parseCsv(flags.set);
+  const addList = parseCsv(flags.add) ?? [];
+  const removeList = parseCsv(flags.remove) ?? [];
+  if (!setList && addList.length === 0 && removeList.length === 0) {
+    error("Pass at least one of --add <csv>, --remove <csv>, or --set <csv>.");
+  }
+  const existing = await backend.getById(id);
+  if (!existing) error(`Record ${id} not found`);
+  let next;
+  if (setList) {
+    next = setList;
+  } else {
+    const removeSet = new Set(removeList);
+    next = [...existing.keys ?? [], ...addList].filter((k) => !removeSet.has(k));
+  }
+  next = [...new Set(next)];
+  const outcome = await backend.updateKeys(id, next);
+  if (outcome.status === "not_found") error(`Record ${id} not found`);
+  if (outcome.status === "conflict") {
+    error(
+      `Key "${outcome.key}" is already owned by active record ${outcome.recordId} (type ${outcome.recordType}). Keys must be unique across active records \u2014 archive or re-key that record first.`
+    );
+  }
+  printRecord(outcome.record);
+}
 async function memArchiveCommand(id, flags) {
   requireMemoryInit();
   const backend = await getBackend();
@@ -9216,7 +9353,7 @@ async function memDoctorCommand() {
   }
   if (cfg.embedding.provider === "openai") {
     try {
-      const { embed: embed2 } = await import("./embedding-K2CFCLXI.js");
+      const { embed: embed2 } = await import("./embedding-2YB6CGBA.js");
       const result = await embed2("connectivity check");
       checks.push({
         name: "OpenAI embedding provider reachable",
@@ -9375,6 +9512,9 @@ async function memVacuumCommand() {
 }
 async function memReindexCommand(flags) {
   requireMemoryInit();
+  if (flags.searchable) {
+    return memReindexSearchableCommand(flags);
+  }
   const backend = await getBackend();
   const cfg = getMemoryConfigOrDefault();
   if (cfg.embedding.provider !== "openai") {
@@ -9437,6 +9577,58 @@ async function memReindexCommand(flags) {
     force: !!flags.force
   });
 }
+async function memReindexSearchableCommand(flags) {
+  const backend = await getBackend();
+  const onlyNull = !flags.all;
+  const totalCap = flags.limit ? parsePositiveInt(flags.limit, 1e6, "limit") : 1e6;
+  const PAGE = 500;
+  let considered = 0;
+  let updated = 0;
+  let unchanged = 0;
+  let emptied = 0;
+  let offset = 0;
+  while (considered < totalCap) {
+    const pageSize = Math.min(PAGE, totalCap - considered);
+    const rows = await backend.listForSearchableBackfill({
+      type: flags.type,
+      onlyNull,
+      limit: pageSize,
+      offset
+    });
+    if (rows.length === 0) break;
+    considered += rows.length;
+    let updatedThisPage = 0;
+    for (const r of rows) {
+      const next = defaultSearchableText(r.data);
+      if (!next) {
+        emptied++;
+        continue;
+      }
+      if (next === (r.searchable_text ?? "")) {
+        unchanged++;
+        continue;
+      }
+      await backend.updateSearchableText(r.id, next);
+      updated++;
+      updatedThisPage++;
+    }
+    offset += onlyNull ? rows.length - updatedThisPage : rows.length;
+    if (!isAgentMode()) {
+      process.stderr.write(`  searchable: updated ${updated} / considered ${considered}\r`);
+    }
+  }
+  if (!isAgentMode()) process.stderr.write("\n");
+  okJson({
+    status: "ok",
+    mode: "searchable",
+    type: flags.type ?? null,
+    scope: onlyNull ? "null_only" : "all",
+    considered,
+    updated,
+    unchanged,
+    emptied
+  });
+}
 
 // src/commands/mem.ts
 function memStatusCommand() {
@@ -9475,11 +9667,12 @@ function registerMemoryCommands(program2) {
   );
   mem.command("doctor").description("Diagnose schema, indexes, plugin resolution, connectivity, embeddings").action(memDoctorCommand);
   mem.command("vacuum").description("Run backend maintenance (VACUUM ANALYZE on tables)").action(memVacuumCommand);
-  mem.command("reindex").description("Backfill embeddings: re-embed records missing an embedding or under a different model").option("--type <type>", "Restrict to one record type, e.g. attio/attioPeople").option("--model <name>", "Override the embedding model").option("--force", "Re-embed even rows that already have a matching embedding", false).option("--batch <n>", "OpenAI calls per batch (default 50)", "50").option("--limit <n>", "Safety cap on total records to scan (default 100000)").action(memReindexCommand);
+  mem.command("reindex").description("Backfill embeddings (default) or searchable_text (--searchable)").option("--type <type>", "Restrict to one record type, e.g. attio/attioPeople").option("--model <name>", "Override the embedding model").option("--force", "Re-embed even rows that already have a matching embedding", false).option("--batch <n>", "OpenAI calls per batch (default 50)", "50").option("--limit <n>", "Safety cap on total records to scan (default 100000)").option("--searchable", "Regenerate searchable_text (NULL or stale vs. data) instead of embeddings", false).option("--all", "With --searchable: also rewrite rows whose text is stale, not just NULL", false).action(memReindexCommand);
   mem.command("sql <query>").description("Run a read-only SELECT / WITH / EXPLAIN against the memory store").action(memSqlCommand);
   mem.command("add <type> <data>").description("Add a new memory record (data is JSON)").option("--tags <csv>", "Comma-separated tags").option("--keys <csv>", "Comma-separated keys (prefixed, e.g. email:x@y.com)").option("--weight <n>", "Importance 1-10 (default 5)").option("--embed", "Force embedding for this record").option("--no-embed", "Skip embedding for this record").action(memAddCommand);
   mem.command("get <id>").description("Get a record by id").option("--links", "Include outgoing and incoming links", false).action(memGetCommand);
-  mem.command("update <id> <patch>").description("Update a record (patch is JSON merged into data)").action(memUpdateCommand);
+  mem.command("update <id> <patch>").description("Update a record (patch is JSON merged into data; regenerates searchable_text)").action(memUpdateCommand);
+  mem.command("key <id>").description("Manage a record's identity keys (unique across active records)").option("--add <csv>", "Keys to add (comma-separated, e.g. email:x@y.com)").option("--remove <csv>", "Keys to remove (comma-separated)").option("--set <csv>", "Replace all keys with this comma-separated list").action((id, flags) => memKeyCommand(id, flags));
   mem.command("archive <id>").description("Archive a record").option("--reason <text>", "Why it was archived (user_archived | deleted_upstream | superseded | \u2026)").action(memArchiveCommand);
   mem.command("weight <id> <n>").description("Set record relevance weight (1-10)").action(memWeightCommand);
   mem.command("flush <id>").description("Reset access count for a record").action(memFlushCommand);
@@ -9690,7 +9883,7 @@ Search for actions, read their docs, and execute them. This is the core workflow
 
 **Quick start:**
 \`\`\`bash
-one --agent connection list                                    # See connected platforms
+one --agent connection list                                    # See connected platforms + your access on each
 one --agent connection delete <connection-key>                 # Remove a connection
 one --agent actions search <platform> "<query>" -t execute     # Find an action
 one --agent actions knowledge <platform> <actionId>            # Read docs (REQUIRED)
@@ -9779,6 +9972,7 @@ Request specific sections:
 - Always use the **exact action ID** from search results \u2014 don't guess
 - Always read **knowledge** before executing any action
 - Connection keys come from \`one connection list\` \u2014 don't hardcode them
+- \`connection list\` also reports an \`access\` field per connection (\`full\` / \`methods\` / \`actions\`) \u2014 read it before planning so you don't propose an action the access config will reject
 - Skills stay in lockstep with the CLI version automatically \u2014 every command checks a \`.one-cli-version\` marker in the canonical skill dir and refreshes the files if the CLI has been upgraded. Check manually with \`one config skills status\`; force a resync with \`one config skills sync\`
 `;
 var GUIDE_ACTIONS = `# One Actions \u2014 Reference
@@ -9793,7 +9987,17 @@ Always follow this sequence. Never skip the knowledge step.
 one --agent connection list
 \`\`\`
 
-Returns platforms, status, connection keys, and tags.
+Returns platforms, status, connection keys, tags, and an \`access\` field per connection describing what the current access config lets you run there:
+
+| \`access\` | Meaning |
+|----------|---------|
+| \`{"policy": "full"}\` | Every action on the connection |
+| \`{"policy": "methods", "methods": ["GET"]}\` | Only actions with these HTTP methods will execute |
+| \`{"policy": "actions", "actions": [{"actionId", "title", "method"}]}\` | Only these exact actions \u2014 use them directly, skip \`actions search\` |
+
+Also present when relevant: \`knowledgeOnly: true\` (execution disabled \u2014 read knowledge and write code instead), \`unresolvedActionIds\` (allowlisted ids that could not be looked up), and \`accessHint\` (a one-line summary of the restriction).
+
+Read \`access\` before planning \u2014 it prevents proposing an action the config will reject. Change it with \`one config\`.
 
 ### 1b. Delete a Connection
 
@@ -10122,10 +10326,19 @@ one --agent mem add note '{"content":"..."}' --tags work,urgent --weight 8 --key
 # Get (optionally with links)
 one --agent mem get <id> --links
 
-# Update (shallow merge into data)
+# Update (shallow merge into data; regenerates searchable_text from the merged data)
 one --agent mem update <id> '{"status":"done"}'
 
-# Archive / unarchive
+# Manage identity keys AFTER creation (keys are a first-class column, NOT data).
+# Unique across ACTIVE records \u2014 a clear error names the record that owns a taken key.
+one --agent mem key <id> --add email:new@x.com
+one --agent mem key <id> --remove email:old@x.com
+one --agent mem key <id> --set 'email:a@x.com,phone:+1555'   # replace all keys
+# NOTE: passing keys to 'mem update' is rejected \u2014 keys are not a data field.
+
+# Archive / unarchive. Archiving FREES a record's keys: an archived record no
+# longer blocks a new active record from reusing the same key (uniqueness is
+# scoped to active records).
 one --agent mem archive <id> --reason superseded
 
 # List by type \u2014 type is positional. Synced rows are namespaced as <platform>/<model>.
@@ -10191,8 +10404,12 @@ one --agent mem status          # backend, provider, _upgrade hint
 one --agent mem doctor          # 7-check health report
 one --agent mem vacuum          # backend maintenance (VACUUM ANALYZE)
 one --agent mem reindex         # re-embed records under current model
+one --agent mem reindex --searchable              # backfill searchable_text where NULL
+one --agent mem reindex --searchable --type attio/attioPeople --all   # also rewrite stale text
 \`\`\`
 
+\`mem reindex --searchable\` regenerates \`searchable_text\` from each record's own \`data\` (no embedding provider needed). It fixes rows that landed with NULL searchable_text and, thanks to the cleaned-up text builder, drops UUID/timestamp noise and leads with name/title/email fields so FTS ranks on what humans search. Regenerated rows are re-queued for embedding on the next \`mem reindex\`.
+
 ## Admin
 
 \`\`\`bash
@@ -11356,7 +11573,7 @@ program.name("one").option("--agent", "Machine-readable JSON output (no colors,
     one whoami                            Show current user, organization, and project
 
   Workflow (use these in order):
-    1. one list                           List your connected platforms and connection keys
+    1. one list                           List connected platforms, keys, and your access on each
     2. one actions search <platform> <q>  Search for actions using natural language
     3. one actions knowledge <plat> <id>  Get full docs for an action (ALWAYS do this before execute)
     4. one actions execute <p> <id> <key> Execute the action
@@ -11614,7 +11831,7 @@ var connection = program.command("connection").description("Manage connections")
 connection.command("add [platform]").alias("a").description("Add a new connection").option("--tag <name>", "Tag the new connection (disambiguates multiple connections per platform in sync/flow profiles)").action(async (platform, options) => {
   await connectionAddCommand(platform, { tag: options.tag });
 });
-connection.command("list").alias("ls").description("List your connections").option("-s, --search <query>", "Filter connections by platform name").option("-l, --limit <n>", "Max connections to return (agent mode default: 20)").action(async (options) => {
+connection.command("list").alias("ls").description("List your connections and what your access config lets you run on each").option("-s, --search <query>", "Filter connections by platform name").option("-l, --limit <n>", "Max connections to return (agent mode default: 20)").action(async (options) => {
   await connectionListCommand(options);
 });
 connection.command("delete <connection-key>").alias("rm").description("Delete a connection").option("-f, --force", "Skip confirmation prompt").action(async (connectionKey, options) => {

package/dist/{migrate-CO4LQVY6.js → migrate-TRUZVAT5.js}

@@ -3,11 +3,11 @@ import {
   dotPathToJsonbExpr,
   memMigrateCommand,
   reviveStringifiedJson
-} from "./chunk-QE6Z676D.js";
+} from "./chunk-GXOIR3GF.js";
 import "./chunk-44CV5IMX.js";
-import "./chunk-M326Y5X6.js";
-import "./chunk-BHAEEALR.js";
-import "./chunk-BV2NYIA7.js";
+import "./chunk-CLJFSFFM.js";
+import "./chunk-7RV7T5PX.js";
+import "./chunk-C7DWZ7B5.js";
 import "./chunk-SO323PZP.js";
 export {
   buildIdentityMap,

package/dist/{runtime-V4PXJJUV.js → runtime-2PRVL2NO.js}

@@ -3,14 +3,16 @@ import {
   closeBackendIfCached,
   getBackend,
   resetBackendSingleton,
+  updateRecord,
   upsertRecord
-} from "./chunk-BHAEEALR.js";
-import "./chunk-BV2NYIA7.js";
+} from "./chunk-7RV7T5PX.js";
+import "./chunk-C7DWZ7B5.js";
 import "./chunk-SO323PZP.js";
 export {
   addRecord,
   closeBackendIfCached,
   getBackend,
   resetBackendSingleton,
+  updateRecord,
   upsertRecord
 };

package/dist/{schema-UC4LBV5V.js → schema-LCRWSFD5.js}

@@ -3,11 +3,11 @@ import {
   note,
   okJson,
   requireMemoryInit
-} from "./chunk-M326Y5X6.js";
+} from "./chunk-CLJFSFFM.js";
 import {
   getBackend
-} from "./chunk-BHAEEALR.js";
-import "./chunk-BV2NYIA7.js";
+} from "./chunk-7RV7T5PX.js";
+import "./chunk-C7DWZ7B5.js";
 import "./chunk-SO323PZP.js";
 
 // src/lib/memory/sync/schema.ts

package/dist/sql-HG7R2JML.js

@@ -0,0 +1,12 @@
+import {
+  memSqlCommand,
+  syncSqlCommand
+} from "./chunk-4WWK3GO5.js";
+import "./chunk-CLJFSFFM.js";
+import "./chunk-7RV7T5PX.js";
+import "./chunk-C7DWZ7B5.js";
+import "./chunk-SO323PZP.js";
+export {
+  memSqlCommand,
+  syncSqlCommand
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "1.48.0",
+  "version": "1.50.0",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/skills/one/SKILL.md

@@ -45,7 +45,21 @@ Always follow this sequence when the user wants to do something on a connected p
 one --agent connection list
 ```
 
-Returns connected platforms with their connection keys (needed for execution) and platform names in kebab-case (needed for searching).
+Returns connected platforms with their connection keys (needed for execution), platform names in kebab-case (needed for searching), and an `access` field per connection telling you what you may run there.
+
+**Read `access` before you plan a workflow** — it saves you from discovering a restriction as a 403 halfway through:
+
+| `access` | What it means |
+|----------|---------------|
+| `{"policy": "full"}` | Every action on this connection is available |
+| `{"policy": "methods", "methods": ["GET"]}` | Only actions with these HTTP methods will execute — don't propose writes |
+| `{"policy": "actions", "actions": [...]}` | Only these exact actions may run. Each has `actionId`, `title`, `method` — **use them directly and skip `actions search`** |
+
+Two more fields appear only when relevant:
+- `"knowledgeOnly": true` — `actions execute` is disabled. Read knowledge and write integration code instead of executing.
+- `"unresolvedActionIds": [...]` — allowlisted ids that couldn't be looked up; treat them as unavailable and tell the user.
+
+An empty `actions` array means the allowlist grants nothing on that connection — say so rather than searching for alternatives.
 
 ### 1b. Delete a connection
 
@@ -170,10 +184,19 @@ Underneath, the store has no `platform` column — `type` is the only platform-s
 ```bash
 # User memories
 one --agent mem add note '{"content":"..."}' --tags work --weight 7
+one --agent mem update <id> '{"status":"done"}'         # merges into data; refreshes searchable_text
 one --agent mem search "deadline"                       # hybrid if key set, else FTS
 one --agent mem list note --limit 20
 one --agent mem link <from-id> <to-id> relates_to --bi
 
+# Identity keys (first-class column, NOT data). Unique across ACTIVE records;
+# archiving a record frees its keys. `mem update '{"keys":[...]}'` is rejected.
+one --agent mem key <id> --add email:x@y.com            # add/--remove/--set
+one --agent mem find-by-source email:x@y.com            # prefers the active owner
+
+# Backfill searchable_text (no embedding provider needed) — fixes NULL/noisy text
+one --agent mem reindex --searchable --type attio/attioPeople
+
 # Status + diagnostics
 one --agent mem status                                  # backend, provider, _upgrade hint
 one --agent mem doctor                                  # full health report

package/dist/sql-CBZQHP4R.js

@@ -1,12 +0,0 @@
-import {
-  memSqlCommand,
-  syncSqlCommand
-} from "./chunk-H2PP5XEQ.js";
-import "./chunk-M326Y5X6.js";
-import "./chunk-BHAEEALR.js";
-import "./chunk-BV2NYIA7.js";
-import "./chunk-SO323PZP.js";
-export {
-  memSqlCommand,
-  syncSqlCommand
-};